about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--doc/contributing/coding-conventions.chapter.md2
-rw-r--r--doc/stdenv/meta.chapter.md4
-rw-r--r--flake.nix6
-rw-r--r--nixos/doc/manual/from_md/release-notes/rl-2205.section.xml84
-rw-r--r--nixos/doc/manual/man-nixos-rebuild.xml2
-rw-r--r--nixos/doc/manual/release-notes/rl-2205.section.md27
-rw-r--r--nixos/lib/systemd-unit-options.nix2
-rw-r--r--nixos/maintainers/scripts/azure-new/examples/basic/system.nix2
-rw-r--r--nixos/modules/installer/virtualbox-demo.nix2
-rw-r--r--nixos/modules/misc/documentation.nix76
-rw-r--r--nixos/modules/misc/nixpkgs.nix2
-rw-r--r--nixos/modules/profiles/hardened.nix2
-rw-r--r--nixos/modules/security/misc.nix4
-rw-r--r--nixos/modules/services/continuous-integration/gitlab-runner.nix2
-rw-r--r--nixos/modules/services/continuous-integration/hercules-ci-agent/default.nix2
-rw-r--r--nixos/modules/services/continuous-integration/hydra/default.nix27
-rw-r--r--nixos/modules/services/misc/mx-puppet-discord.nix5
-rw-r--r--nixos/modules/services/misc/nix-daemon.nix660
-rw-r--r--nixos/modules/services/misc/nix-ssh-serve.nix2
-rw-r--r--nixos/modules/services/monitoring/prometheus/exporters/smartctl.nix15
-rw-r--r--nixos/modules/services/web-apps/nextcloud.nix5
-rw-r--r--nixos/modules/system/activation/switch-to-configuration.pl135
-rw-r--r--nixos/modules/system/activation/top-level.nix4
-rw-r--r--nixos/modules/system/boot/binfmt.nix13
-rw-r--r--nixos/tests/all-tests.nix1
-rw-r--r--nixos/tests/containers-imperative.nix4
-rw-r--r--nixos/tests/hardened.nix2
-rw-r--r--nixos/tests/hibernate.nix10
-rw-r--r--nixos/tests/hydra/common.nix2
-rw-r--r--nixos/tests/installed-tests/flatpak.nix1
-rw-r--r--nixos/tests/installer.nix10
-rw-r--r--nixos/tests/iscsi-multipath-root.nix10
-rw-r--r--nixos/tests/iscsi-root.nix10
-rw-r--r--nixos/tests/nixops/default.nix2
-rw-r--r--nixos/tests/nixops/legacy/base-configuration.nix2
-rw-r--r--nixos/tests/os-prober.nix10
-rw-r--r--nixos/tests/switch-test.nix79
-rw-r--r--nixos/tests/vscodium.nix9
-rw-r--r--nixos/tests/xxh.nix67
-rw-r--r--pkgs/applications/audio/ptcollab/default.nix4
-rw-r--r--pkgs/applications/audio/spot/default.nix6
-rw-r--r--pkgs/applications/backup/vorta/default.nix4
-rw-r--r--pkgs/applications/editors/vscode/generic.nix1
-rw-r--r--pkgs/applications/gis/grass/default.nix23
-rw-r--r--pkgs/applications/graphics/ImageMagick/7.0.nix10
-rw-r--r--pkgs/applications/graphics/darktable/default.nix5
-rw-r--r--pkgs/applications/graphics/hydrus/default.nix4
-rw-r--r--pkgs/applications/graphics/inkscape/default.nix8
-rw-r--r--pkgs/applications/graphics/qiv/default.upstream3
-rw-r--r--pkgs/applications/graphics/tev/default.nix5
-rw-r--r--pkgs/applications/misc/auto-multiple-choice/default.nix3
-rw-r--r--pkgs/applications/misc/gallery-dl/default.nix4
-rw-r--r--pkgs/applications/misc/mupdf/default.upstream7
-rw-r--r--pkgs/applications/misc/tomboy/default.nix43
-rw-r--r--pkgs/applications/misc/vifm/default.nix1
-rw-r--r--pkgs/applications/networking/browsers/chromium/default.nix3
-rw-r--r--pkgs/applications/networking/browsers/firefox-bin/release_sources.nix786
-rw-r--r--pkgs/applications/networking/browsers/firefox/packages.nix8
-rw-r--r--pkgs/applications/networking/browsers/google-chrome/default.nix5
-rw-r--r--pkgs/applications/networking/instant-messengers/discord/linux.nix1
-rw-r--r--pkgs/applications/networking/instant-messengers/element/element-desktop.nix5
-rw-r--r--pkgs/applications/networking/instant-messengers/gajim/default.nix1
-rw-r--r--pkgs/applications/networking/instant-messengers/mcabber/default.nix2
-rw-r--r--pkgs/applications/networking/instant-messengers/schildichat/schildichat-desktop.nix31
-rw-r--r--pkgs/applications/networking/instant-messengers/signal-desktop/default.nix5
-rw-r--r--pkgs/applications/networking/instant-messengers/slack/default.nix5
-rw-r--r--pkgs/applications/networking/nextcloud-client/default.nix4
-rw-r--r--pkgs/applications/office/qownnotes/default.nix4
-rw-r--r--pkgs/applications/office/scribus/unstable.nix5
-rw-r--r--pkgs/applications/radio/soapyhackrf/default.nix4
-rw-r--r--pkgs/applications/science/logic/leo2/default.upstream6
-rw-r--r--pkgs/applications/science/logic/potassco/clingo.upstream6
-rw-r--r--pkgs/applications/science/logic/satallax/default.nix1
-rw-r--r--pkgs/applications/science/math/pari/default.nix1
-rw-r--r--pkgs/applications/science/math/ratpoints/default.nix1
-rw-r--r--pkgs/applications/science/misc/golly/default.upstream5
-rw-r--r--pkgs/applications/science/misc/root/default.nix4
-rw-r--r--pkgs/applications/version-management/mercurial/default.nix1
-rw-r--r--pkgs/applications/version-management/monotone/default.upstream8
-rw-r--r--pkgs/applications/video/kodi/addons/controller-topology-project/default.nix35
-rw-r--r--pkgs/applications/video/kodi/addons/controllers/default.nix22
-rw-r--r--pkgs/build-support/trivial-builders/test/references.nix2
-rw-r--r--pkgs/build-support/upstream-updater/attrset-to-dir.nix19
-rwxr-xr-xpkgs/build-support/upstream-updater/create-src-info-git.sh24
-rwxr-xr-xpkgs/build-support/upstream-updater/create-src-info.sh20
-rw-r--r--pkgs/build-support/upstream-updater/design.txt29
-rw-r--r--pkgs/build-support/upstream-updater/snippets.sh14
-rw-r--r--pkgs/build-support/upstream-updater/test-case.nix13
-rwxr-xr-xpkgs/build-support/upstream-updater/update-upstream-data.sh182
-rw-r--r--pkgs/build-support/upstream-updater/update-walker-service-specific.sh20
-rwxr-xr-xpkgs/build-support/upstream-updater/update-walker.sh320
-rw-r--r--pkgs/build-support/upstream-updater/update-walker.txt118
-rw-r--r--pkgs/data/misc/hackage/pin.json8
-rw-r--r--pkgs/data/misc/poppler-data/default.nix22
-rw-r--r--pkgs/desktops/pantheon/apps/switchboard-plugs/network/default.nix4
-rw-r--r--pkgs/desktops/pantheon/services/elementary-capnet-assist/default.nix14
-rw-r--r--pkgs/desktops/pantheon/services/xdg-desktop-portal-pantheon/default.nix4
-rw-r--r--pkgs/development/compilers/fpc/default.upstream6
-rw-r--r--pkgs/development/compilers/sbcl/common.nix4
-rw-r--r--pkgs/development/coq-modules/gaia/default.nix2
-rw-r--r--pkgs/development/coq-modules/mathcomp-zify/default.nix2
-rw-r--r--pkgs/development/coq-modules/paramcoq/default.nix3
-rw-r--r--pkgs/development/coq-modules/serapi/default.nix8
-rw-r--r--pkgs/development/haskell-modules/configuration-common.nix15
-rw-r--r--pkgs/development/haskell-modules/configuration-ghc-9.2.x.nix2
-rw-r--r--pkgs/development/haskell-modules/configuration-hackage2nix/broken.yaml4
-rw-r--r--pkgs/development/haskell-modules/configuration-hackage2nix/stackage.yaml46
-rw-r--r--pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml7
-rw-r--r--pkgs/development/haskell-modules/configuration-nix.nix8
-rw-r--r--pkgs/development/haskell-modules/hackage-packages.nix899
-rw-r--r--pkgs/development/interpreters/regina/default.upstream5
-rw-r--r--pkgs/development/libraries/boehm-gc/default.nix15
-rw-r--r--pkgs/development/libraries/botan/2.0.upstream10
-rw-r--r--pkgs/development/libraries/botan/default.upstream9
-rw-r--r--pkgs/development/libraries/eigen/default.upstream4
-rw-r--r--pkgs/development/libraries/flatpak/default.nix12
-rw-r--r--pkgs/development/libraries/flint/default.nix1
-rw-r--r--pkgs/development/libraries/gdal/default.nix6
-rw-r--r--pkgs/development/libraries/iml/default.nix1
-rw-r--r--pkgs/development/libraries/libesmtp/default.nix27
-rw-r--r--pkgs/development/libraries/libosmium/default.nix4
-rw-r--r--pkgs/development/libraries/libzmf/default.nix1
-rw-r--r--pkgs/development/libraries/loudmouth/default.nix2
-rw-r--r--pkgs/development/libraries/mdds/default.upstream10
-rw-r--r--pkgs/development/libraries/mpir/default.nix1
-rw-r--r--pkgs/development/libraries/mysocketw/default.nix18
-rw-r--r--pkgs/development/libraries/osip/default.upstream3
-rw-r--r--pkgs/development/libraries/phash/default.nix1
-rw-r--r--pkgs/development/libraries/poco/default.nix10
-rw-r--r--pkgs/development/libraries/poppler/default.nix4
-rw-r--r--pkgs/development/libraries/qt-5/5.12/default.nix5
-rw-r--r--pkgs/development/libraries/qt-5/5.14/default.nix5
-rw-r--r--pkgs/development/libraries/qt-5/5.15/default.nix5
-rw-r--r--pkgs/development/libraries/safefile/default.nix17
-rw-r--r--pkgs/development/libraries/smooth/default.nix4
-rw-r--r--pkgs/development/libraries/spandsp/default.nix1
-rw-r--r--pkgs/development/libraries/tbb/default.nix2
-rw-r--r--pkgs/development/libraries/xmlsec/default.nix1
-rw-r--r--pkgs/development/php-packages/ds/default.nix19
-rw-r--r--pkgs/development/python-modules/aioesphomeapi/default.nix4
-rw-r--r--pkgs/development/python-modules/azure-mgmt-applicationinsights/default.nix4
-rw-r--r--pkgs/development/python-modules/azure-mgmt-resource/default.nix4
-rw-r--r--pkgs/development/python-modules/azure-mgmt-web/default.nix4
-rw-r--r--pkgs/development/python-modules/chalice/default.nix3
-rw-r--r--pkgs/development/python-modules/fakeredis/default.nix13
-rw-r--r--pkgs/development/python-modules/flux-led/default.nix4
-rw-r--r--pkgs/development/python-modules/ftputil/default.nix45
-rw-r--r--pkgs/development/python-modules/google-cloud-dlp/default.nix4
-rw-r--r--pkgs/development/python-modules/halohome/default.nix5
-rw-r--r--pkgs/development/python-modules/ibm-watson/default.nix26
-rw-r--r--pkgs/development/python-modules/losant-rest/default.nix4
-rw-r--r--pkgs/development/python-modules/mailchecker/default.nix4
-rw-r--r--pkgs/development/python-modules/mautrix/default.nix4
-rw-r--r--pkgs/development/python-modules/meshtastic/default.nix4
-rw-r--r--pkgs/development/python-modules/minikerberos/default.nix12
-rw-r--r--pkgs/development/python-modules/objax/default.nix13
-rw-r--r--pkgs/development/python-modules/ocrmypdf/default.nix4
-rw-r--r--pkgs/development/python-modules/pikepdf/default.nix4
-rw-r--r--pkgs/development/python-modules/pycm/default.nix4
-rw-r--r--pkgs/development/python-modules/pyeight/default.nix17
-rw-r--r--pkgs/development/python-modules/pylaunches/default.nix4
-rw-r--r--pkgs/development/python-modules/rokuecp/default.nix4
-rw-r--r--pkgs/development/python-modules/sagemaker/default.nix4
-rw-r--r--pkgs/development/python-modules/sendgrid/default.nix4
-rw-r--r--pkgs/development/python-modules/sqlite-utils/default.nix4
-rw-r--r--pkgs/development/python-modules/warcio/default.nix56
-rw-r--r--pkgs/development/tools/database/sqlfluff/default.nix4
-rw-r--r--pkgs/development/tools/electron/default.nix16
-rw-r--r--pkgs/development/tools/flatpak-builder/default.nix8
-rw-r--r--pkgs/development/tools/go-swagger/default.nix6
-rw-r--r--pkgs/development/tools/jq/default.nix1
-rw-r--r--pkgs/development/tools/misc/hydra/default.nix4
-rw-r--r--pkgs/development/tools/misc/luarocks/3.7.nix1
-rw-r--r--pkgs/development/tools/misc/luarocks/default.nix1
-rw-r--r--pkgs/development/tools/mold/default.nix7
-rw-r--r--pkgs/development/tools/sentry-cli/default.nix6
-rw-r--r--pkgs/development/tools/typos/default.nix6
-rw-r--r--pkgs/games/blobby/default.upstream8
-rw-r--r--pkgs/games/polymc/0001-pick-latest-java-first.patch48
-rw-r--r--pkgs/games/polymc/default.nix22
-rw-r--r--pkgs/games/sgt-puzzles/default.upstream5
-rw-r--r--pkgs/misc/screensavers/xscreensaver/default.nix1
-rw-r--r--pkgs/os-specific/linux/amdgpu-pro/default.nix2
-rw-r--r--pkgs/os-specific/linux/atop/default.upstream4
-rw-r--r--pkgs/os-specific/linux/iptables/default.nix1
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.14.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.19.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.4.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.9.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-5.10.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-5.15.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-5.16.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-5.4.nix4
-rw-r--r--pkgs/os-specific/linux/sysdig/default.upstream8
-rw-r--r--pkgs/servers/http/lighttpd/default.nix18
-rw-r--r--pkgs/servers/http/nginx/mainline.upstream8
-rw-r--r--pkgs/servers/http/nginx/stable.upstream8
-rw-r--r--pkgs/servers/mail/sympa/default.nix4
-rw-r--r--pkgs/servers/monitoring/fusion-inventory/default.nix1
-rw-r--r--pkgs/servers/softether/4.25.nix53
-rw-r--r--pkgs/servers/sshportal/default.nix24
-rw-r--r--pkgs/servers/tailscale/default.nix4
-rw-r--r--pkgs/stdenv/generic/check-meta.nix2
-rw-r--r--pkgs/tools/X11/autocutsel/default.nix1
-rw-r--r--pkgs/tools/X11/xpra/default.nix1
-rw-r--r--pkgs/tools/admin/procs/default.nix6
-rw-r--r--pkgs/tools/admin/stripe-cli/default.nix4
-rw-r--r--pkgs/tools/compression/lrzip/default.upstream8
-rw-r--r--pkgs/tools/filesystems/nilfs-utils/default.nix1
-rw-r--r--pkgs/tools/filesystems/smbnetfs/default.nix1
-rw-r--r--pkgs/tools/filesystems/smbnetfs/default.upstream6
-rw-r--r--pkgs/tools/graphics/barcode/default.nix1
-rw-r--r--pkgs/tools/graphics/cuneiform/default.upstream8
-rw-r--r--pkgs/tools/misc/ised/default.upstream4
-rw-r--r--pkgs/tools/misc/mandown/default.nix20
-rw-r--r--pkgs/tools/misc/mc/default.nix1
-rw-r--r--pkgs/tools/misc/nncp/default.nix4
-rw-r--r--pkgs/tools/misc/phoronix-test-suite/default.nix4
-rw-r--r--pkgs/tools/networking/getmail6/default.nix1
-rw-r--r--pkgs/tools/networking/keepalived/default.nix4
-rw-r--r--pkgs/tools/networking/twa/default.nix31
-rw-r--r--pkgs/tools/networking/xxh/default.nix26
-rw-r--r--pkgs/tools/package-management/nix/common.nix208
-rw-r--r--pkgs/tools/package-management/nix/default.nix297
-rw-r--r--pkgs/tools/package-management/nix/nix-perl.nix44
-rw-r--r--pkgs/tools/package-management/nix/patches/aws-sdk-cpp-TransferManager-ContentEncoding.patch (renamed from pkgs/tools/package-management/nix/aws-sdk-cpp-TransferManager-ContentEncoding.patch)0
-rw-r--r--pkgs/tools/package-management/nix/patches/boehmgc-coroutine-sp-fallback.patch45
-rw-r--r--pkgs/tools/package-management/nix/patches/install-nlohmann_json-headers.patch36
-rw-r--r--pkgs/tools/security/doas/default.nix4
-rw-r--r--pkgs/tools/security/exploitdb/default.nix4
-rw-r--r--pkgs/tools/system/dd_rescue/default.nix1
-rw-r--r--pkgs/tools/system/di/default.nix1
-rw-r--r--pkgs/tools/system/freeipmi/default.nix2
-rw-r--r--pkgs/tools/system/ipmiutil/default.upstream4
-rw-r--r--pkgs/tools/text/kdiff3/default.nix26
-rw-r--r--pkgs/tools/text/vgrep/default.nix4
-rw-r--r--pkgs/tools/virtualization/linode-cli/default.nix8
-rw-r--r--pkgs/top-level/aliases.nix9
-rw-r--r--pkgs/top-level/all-packages.nix61
-rw-r--r--pkgs/top-level/config.nix14
-rw-r--r--pkgs/top-level/kodi-packages.nix28
-rw-r--r--pkgs/top-level/perl-packages.nix18
-rw-r--r--pkgs/top-level/php-packages.nix2
-rw-r--r--pkgs/top-level/python-packages.nix6
244 files changed, 2846 insertions, 3099 deletions
diff --git a/doc/contributing/coding-conventions.chapter.md b/doc/contributing/coding-conventions.chapter.md
index 79d90c23a40f..cfe8582e514a 100644
--- a/doc/contributing/coding-conventions.chapter.md
+++ b/doc/contributing/coding-conventions.chapter.md
@@ -224,7 +224,7 @@ There are a few naming guidelines:
 
 - Dashes in the package name _should_ be preserved in new variable names, rather than converted to underscores or camel cased — e.g., `http-parser` instead of `http_parser` or `httpParser`. The hyphenated style is preferred in all three package names.
 
-- If there are multiple versions of a package, this _should_ be reflected in the variable names in `all-packages.nix`, e.g. `json-c-0-9` and `json-c-0-11`. If there is an obvious “default” version, make an attribute like `json-c = json-c-0-9;`. See also [](#sec-versioning)
+- If there are multiple versions of a package, this _should_ be reflected in the variable names in `all-packages.nix`, e.g. `json-c_0_9` and `json-c_0_11`. If there is an obvious “default” version, make an attribute like `json-c = json-c_0_9;`. See also [](#sec-versioning)
 
 ## File naming and organisation {#sec-organisation}
 
diff --git a/doc/stdenv/meta.chapter.md b/doc/stdenv/meta.chapter.md
index ac518cee524c..d3e1dd5b27d8 100644
--- a/doc/stdenv/meta.chapter.md
+++ b/doc/stdenv/meta.chapter.md
@@ -192,10 +192,6 @@ meta.hydraPlatforms = [];
 
 If set to `true`, the package is marked as "broken", meaning that it won’t show up in `nix-env -qa`, and cannot be built or installed. Such packages should be removed from Nixpkgs eventually unless they are fixed.
 
-### `updateWalker` {#var-meta-updateWalker}
-
-If set to `true`, the package is tested to be updated correctly by the `update-walker.sh` script without additional settings. Such packages have `meta.version` set and their homepage (or the page specified by `meta.downloadPage`) contains a direct link to the package tarball.
-
 ## Licenses {#sec-meta-license}
 
 The `meta.license` attribute should preferably contain a value from `lib.licenses` defined in [`nixpkgs/lib/licenses.nix`](https://github.com/NixOS/nixpkgs/blob/master/lib/licenses.nix), or in-place license description of the same format if the license is unlikely to be useful in another expression.
diff --git a/flake.nix b/flake.nix
index 39553cde0ab5..29dffa9fa4e4 100644
--- a/flake.nix
+++ b/flake.nix
@@ -48,10 +48,6 @@
                   system.nixos.versionSuffix =
                     ".${final.substring 0 8 (self.lastModifiedDate or self.lastModified or "19700101")}.${self.shortRev or "dirty"}";
                   system.nixos.revision = final.mkIf (self ? rev) self.rev;
-
-                  # NOTE: This assumes that `nixpkgs.config` is _not_ used when
-                  #       nixpkgs.pkgs is set OR _module.args.pkgs is set.
-                  nixpkgs.config.path = self.outPath;
                 }
               ];
           });
@@ -66,7 +62,7 @@
         }).nixos.manual.x86_64-linux;
       };
 
-      legacyPackages = forAllSystems (system: import ./. { inherit system; config.path = self.outPath; });
+      legacyPackages = forAllSystems (system: import ./. { inherit system; });
 
       nixosModules = {
         notDetected = import ./nixos/modules/installer/scan/not-detected.nix;
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
index edbfbd643161..9324ec5e090f 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@@ -442,13 +442,49 @@
       </listitem>
       <listitem>
         <para>
-          The interface that allows activation scripts to restart units
-          has been reworked. Restarting and reloading is now done by a
-          single file
-          <literal>/run/nixos/activation-restart-list</literal> that
-          honors <literal>restartIfChanged</literal> and
-          <literal>reloadIfChanged</literal> of the units.
+          <literal>switch-to-configuration</literal> (the script that is
+          run when running <literal>nixos-rebuild switch</literal> for
+          example) has been reworked
         </para>
+        <itemizedlist spacing="compact">
+          <listitem>
+            <para>
+              The interface that allows activation scripts to restart
+              units has been streamlined. Restarting and reloading is
+              now done by a single file
+              <literal>/run/nixos/activation-restart-list</literal> that
+              honors <literal>restartIfChanged</literal> and
+              <literal>reloadIfChanged</literal> of the units.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              The script now uses a proper ini-file parser to parse
+              systemd units. Some values are now only searched in one
+              section instead of in the entire unit. This is only
+              relevant for units that don’t use the NixOS systemd moule.
+            </para>
+            <itemizedlist spacing="compact">
+              <listitem>
+                <para>
+                  <literal>RefuseManualStop</literal>,
+                  <literal>X-OnlyManualStart</literal>,
+                  <literal>X-StopOnRemoval</literal>,
+                  <literal>X-StopOnReconfiguration</literal> are only
+                  searched in the <literal>[Unit]</literal> section
+                </para>
+              </listitem>
+              <listitem>
+                <para>
+                  <literal>X-ReloadIfChanged</literal>,
+                  <literal>X-RestartIfChanged</literal>,
+                  <literal>X-StopIfChanged</literal> are only searched
+                  in the <literal>[Service]</literal> section
+                </para>
+              </listitem>
+            </itemizedlist>
+          </listitem>
+        </itemizedlist>
       </listitem>
       <listitem>
         <para>
@@ -533,6 +569,29 @@
       </listitem>
       <listitem>
         <para>
+          The configuration portion of the <literal>nix-daemon</literal>
+          module has been reworked and exposed as
+          <link xlink:href="options.html#opt-nix-settings">nix.settings</link>:
+        </para>
+        <itemizedlist spacing="compact">
+          <listitem>
+            <para>
+              Legacy options have been mapped to the corresponding
+              options under under
+              <link xlink:href="options.html#opt-nix.settings">nix.settings</link>
+              but may be deprecated in the future.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-nix.buildMachines.publicHostKey">nix.buildMachines.publicHostKey</link>
+              has been added.
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
+      <listitem>
+        <para>
           The
           <literal>writers.writePyPy2</literal>/<literal>writers.writePyPy3</literal>
           and corresponding
@@ -543,6 +602,19 @@
       </listitem>
       <listitem>
         <para>
+          If you are using Wayland you can choose to use the Ozone
+          Wayland support in Chrome and several Electron apps by setting
+          the environment variable <literal>NIXOS_OZONE_WL=1</literal>
+          (for example via
+          <literal>environment.sessionVariables.NIXOS_OZONE_WL = &quot;1&quot;</literal>).
+          This is not enabled by default because Ozone Wayland is still
+          under heavy development and behavior is not always flawless.
+          Furthermore, not all Electron apps use the latest Electron
+          versions.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
           The <literal>influxdb2</literal> package was split into
           <literal>influxdb2-server</literal> and
           <literal>influxdb2-cli</literal>, matching the split that took
diff --git a/nixos/doc/manual/man-nixos-rebuild.xml b/nixos/doc/manual/man-nixos-rebuild.xml
index 6c7fc57f8d83..ab2a5d83a089 100644
--- a/nixos/doc/manual/man-nixos-rebuild.xml
+++ b/nixos/doc/manual/man-nixos-rebuild.xml
@@ -453,7 +453,7 @@
       Allow ad-hoc remote builders for building the new system. This requires
       the user executing <command>nixos-rebuild</command> (usually root) to be
       configured as a trusted user in the Nix daemon. This can be achieved by
-      using the <literal>nix.trustedUsers</literal> NixOS option. Examples
+      using the <literal>nix.settings.trusted-users</literal> NixOS option. Examples
       values for that option are described in the <literal>Remote builds
       chapter</literal> in the Nix manual, (i.e. <command>--builders
       "ssh://bigbrother x86_64-linux"</command>). By specifying an empty string
diff --git a/nixos/doc/manual/release-notes/rl-2205.section.md b/nixos/doc/manual/release-notes/rl-2205.section.md
index b140e255854e..cb3fd0a1f400 100644
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@@ -60,7 +60,7 @@ In addition to numerous new and upgraded packages, this release has the followin
 ## Backward Incompatibilities {#sec-release-22.05-incompatibilities}
 
 - `pkgs.ghc` now refers to `pkgs.targetPackages.haskellPackages.ghc`.
-  This *only* makes a difference if you are cross-compiling and will
+  This _only_ makes a difference if you are cross-compiling and will
   ensure that `pkgs.ghc` always runs on the host platform and compiles
   for the target platform (similar to `pkgs.gcc` for example).
   `haskellPackages.ghc` still behaves as before, running on the build
@@ -141,7 +141,11 @@ In addition to numerous new and upgraded packages, this release has the followin
   `pkgs.noto-fonts-cjk` is currently an alias of `pkgs.noto-fonts-cjk-sans` and
   doesn't include serif fonts.
 
-- The interface that allows activation scripts to restart units has been reworked. Restarting and reloading is now done by a single file `/run/nixos/activation-restart-list` that honors `restartIfChanged` and `reloadIfChanged` of the units.
+- `switch-to-configuration` (the script that is run when running `nixos-rebuild switch` for example) has been reworked
+    * The interface that allows activation scripts to restart units has been streamlined. Restarting and reloading is now done by a single file `/run/nixos/activation-restart-list` that honors `restartIfChanged` and `reloadIfChanged` of the units.
+    * The script now uses a proper ini-file parser to parse systemd units. Some values are now only searched in one section instead of in the entire unit. This is only relevant for units that don't use the NixOS systemd moule.
+        * `RefuseManualStop`, `X-OnlyManualStart`, `X-StopOnRemoval`, `X-StopOnReconfiguration` are only searched in the `[Unit]` section
+        * `X-ReloadIfChanged`, `X-RestartIfChanged`, `X-StopIfChanged` are only searched in the `[Service]` section
 
 - The `services.bookstack.cacheDir` option has been removed, since the
   cache directory is now handled by systemd.
@@ -177,14 +181,26 @@ In addition to numerous new and upgraded packages, this release has the followin
   to allow users to make changes to the `nixos-rebuild build-vm` configuration
   that do not apply to their normal system.
 
-  The `config.system.build.vm` attribute now always exists and  defaults to the
+  The `config.system.build.vm` attribute now always exists and defaults to the
   value from `vmVariant`. Configurations that import the `virtualisation/qemu-vm.nix`
   module themselves will override this value, such that `vmVariant` is not used.
 
   Similarly [virtualisation.vmVariantWithBootloader](#opt-virtualisation.vmVariantWithBootLoader) was added.
 
+- The configuration portion of the `nix-daemon` module has been reworked and exposed as [nix.settings](options.html#opt-nix-settings):
+  * Legacy options have been mapped to the corresponding options under under [nix.settings](options.html#opt-nix.settings) but may be deprecated in the future.
+  * [nix.buildMachines.publicHostKey](options.html#opt-nix.buildMachines.publicHostKey) has been added.
+
 - The `writers.writePyPy2`/`writers.writePyPy3` and corresponding `writers.writePyPy2Bin`/`writers.writePyPy3Bin` convenience functions to create executable Python 2/3 scripts using the PyPy interpreter were added.
 
+- If you are using Wayland you can choose to use the Ozone Wayland support
+  in Chrome and several Electron apps by setting the environment variable
+  `NIXOS_OZONE_WL=1` (for example via
+  `environment.sessionVariables.NIXOS_OZONE_WL = "1"`).
+  This is not enabled by default because Ozone Wayland is
+  still under heavy development and behavior is not always flawless.
+  Furthermore, not all Electron apps use the latest Electron versions.
+
 - The `influxdb2` package was split into `influxdb2-server` and
   `influxdb2-cli`, matching the split that took place upstream. A
   combined `influxdb2` package is still provided in this release for
@@ -236,8 +252,9 @@ In addition to numerous new and upgraded packages, this release has the followin
   Plugins are automatically repackaged using autoPatchelf.
 
 - The `zrepl` package has been updated from 0.4.0 to 0.5:
-    * The RPC protocol version was bumped; all zrepl daemons in a setup must be updated and restarted before replication can resume.
-    * A bug involving encrypt-on-receive has been fixed.  Read the [zrepl documentation](https://zrepl.github.io/configuration/sendrecvoptions.html#job-recv-options-placeholder) and check the output of `zfs get -r encryption,zrepl:placeholder PATH_TO_ROOTFS` on the receiver.
+
+  - The RPC protocol version was bumped; all zrepl daemons in a setup must be updated and restarted before replication can resume.
+  - A bug involving encrypt-on-receive has been fixed. Read the [zrepl documentation](https://zrepl.github.io/configuration/sendrecvoptions.html#job-recv-options-placeholder) and check the output of `zfs get -r encryption,zrepl:placeholder PATH_TO_ROOTFS` on the receiver.
 
 - Renamed option `services.openssh.challengeResponseAuthentication` to `services.openssh.kbdInteractiveAuthentication`.
   Reason is that the old name has been deprecated upstream.
diff --git a/nixos/lib/systemd-unit-options.nix b/nixos/lib/systemd-unit-options.nix
index 01f954a4d3e0..832a33d64290 100644
--- a/nixos/lib/systemd-unit-options.nix
+++ b/nixos/lib/systemd-unit-options.nix
@@ -98,7 +98,7 @@ in rec {
 
     description = mkOption {
       default = "";
-      type = types.str;
+      type = types.singleLineStr;
       description = "Description of this unit used in systemd messages and progress indicators.";
     };
 
diff --git a/nixos/maintainers/scripts/azure-new/examples/basic/system.nix b/nixos/maintainers/scripts/azure-new/examples/basic/system.nix
index 855bd3bab719..d283742701d1 100644
--- a/nixos/maintainers/scripts/azure-new/examples/basic/system.nix
+++ b/nixos/maintainers/scripts/azure-new/examples/basic/system.nix
@@ -17,7 +17,7 @@ in
     description = "Azure NixOS Test User";
     openssh.authorizedKeys.keys = [ (builtins.readFile ~/.ssh/id_ed25519.pub) ];
   };
-  nix.trustedUsers = [ username ];
+  nix.settings.trusted-users = [ username ];
 
   virtualisation.azureImage.diskSize = 2500;
 
diff --git a/nixos/modules/installer/virtualbox-demo.nix b/nixos/modules/installer/virtualbox-demo.nix
index 2768e17590b3..27a7651382b2 100644
--- a/nixos/modules/installer/virtualbox-demo.nix
+++ b/nixos/modules/installer/virtualbox-demo.nix
@@ -25,7 +25,7 @@ with lib;
 
   installer.cloneConfigExtra = ''
   # Let demo build as a trusted user.
-  # nix.trustedUsers = [ "demo" ];
+  # nix.settings.trusted-users = [ "demo" ];
 
   # Mount a VirtualBox shared folder.
   # This is configurable in the VirtualBox menu at
diff --git a/nixos/modules/misc/documentation.nix b/nixos/modules/misc/documentation.nix
index 2afa43a3fe71..b7746ddc2115 100644
--- a/nixos/modules/misc/documentation.nix
+++ b/nixos/modules/misc/documentation.nix
@@ -61,85 +61,17 @@ let
       in scrubbedEval.options;
     baseOptionsJSON =
       let
-        filterIntoStore =
+        filter =
           builtins.filterSource
             (n: t:
               (t == "directory" -> baseNameOf n != "tests")
               && (t == "file" -> hasSuffix ".nix" n)
             );
-
-        # Figure out if Nix runs in pure evaluation mode. May return true in
-        # impure mode, but this is highly unlikely.
-        # We need to know because of https://github.com/NixOS/nix/issues/1888
-        # and https://github.com/NixOS/nix/issues/5868
-        isPureEval = builtins.getEnv "PATH" == "" && builtins.getEnv "_" == "";
-
-        # Return a nixpkgs subpath with minimal copying.
-        #
-        # The sources for the base options json derivation can come in one of
-        # two forms:
-        #   - single source: a store path with all of nixpkgs, postfix with
-        #     subpaths to access various directories. This has the benefit of
-        #     not creating copies of these subtrees in the Nix store, but
-        #     can cause unnecessary rebuilds if you update the Nixpkgs `pkgs`
-        #     tree often.
-        #   - split sources: multiple store paths with subdirectories of
-        #     nixpkgs that exclude the bulk of the pkgs directory.
-        #     This requires more copying and hashing during evaluation but
-        #     requires fewer files to be copied. This method produces fewer
-        #     unnecessary rebuilds of the base options json.
-        #
-        # Flake
-        #
-        # Flakes always put a copy of the full nixpkgs sources in the store,
-        # so we can use the "single source" method. This method is ideal
-        # for using nixpkgs as a dependency, as the base options json will be
-        # substitutable from cache.nixos.org.
-        #
-        # This requires that the `self.outPath` is wired into `pkgs` correctly,
-        # which is done for you if `pkgs` comes from the `lib.nixosSystem` or
-        # `legacyPackages` flake attributes.
-        #
-        # Other Nixpkgs invocation
-        #
-        # If you do not use the known-correct flake attributes, but rather
-        # invoke Nixpkgs yourself, set `config.path` to the correct path value,
-        # e.g. `import nixpkgs { config.path = nixpkgs; }`.
-        #
-        # Choosing between single or split source paths
-        #
-        # We make assumptions based on the type and contents of `pkgs.path`.
-        # By passing a different `config.path` to Nixpkgs, you can influence
-        # how your documentation cache is evaluated and rebuilt.
-        #
-        # Single source
-        #  - If pkgs.path is a string containing a store path, the code has no
-        #    choice but to create this store path, if it hasn't already been.
-        #    We assume that the "single source" method is most efficient.
-        #  - If pkgs.path is a path value containing that is a store path,
-        #    we try to convert it to a string with context without copying.
-        #    This occurs for example when nixpkgs was fetched and using its
-        #    default `config.path`, which is `./.`.
-        #    Nix currently does not allow this conversion when evaluating in
-        #    pure mode. If the conversion is not possible, we use the
-        #    "split source" method.
-        #
-        # Split source
-        #  - If pkgs.path is a path value that is not a store path, we assume
-        #    that it's unlikely for all of nixpkgs to end up in the store for
-        #    other reasons and try to keep both the copying and rebuilds low.
-        pull =
-          if builtins.typeOf pkgs.path == "string" && isStorePath pkgs.path then
-            dir: "${pkgs.path}/${dir}"
-          else if !isPureEval && isStorePath pkgs.path then
-            dir: "${builtins.storePath pkgs.path}/${dir}"
-          else
-            dir: filterIntoStore "${toString pkgs.path}/${dir}";
       in
         pkgs.runCommand "lazy-options.json" {
-          libPath = pull "lib";
-          pkgsLibPath = pull "pkgs/pkgs-lib";
-          nixosPath = pull "nixos";
+          libPath = filter "${toString pkgs.path}/lib";
+          pkgsLibPath = filter "${toString pkgs.path}/pkgs/pkgs-lib";
+          nixosPath = filter "${toString pkgs.path}/nixos";
           modules = map (p: ''"${removePrefix "${modulesPath}/" (toString p)}"'') docModules.lazy;
         } ''
           export NIX_STORE_DIR=$TMPDIR/store
diff --git a/nixos/modules/misc/nixpkgs.nix b/nixos/modules/misc/nixpkgs.nix
index 14dd1d816dbe..69967c8a7601 100644
--- a/nixos/modules/misc/nixpkgs.nix
+++ b/nixos/modules/misc/nixpkgs.nix
@@ -59,8 +59,6 @@ let
     inherit (cfg) config overlays localSystem crossSystem;
   };
 
-  # NOTE: flake.nix assumes that nixpkgs.config is only used with ../../..
-  #       as nixpkgs.config.path should be equivalent to ../../..
   finalPkgs = if opt.pkgs.isDefined then cfg.pkgs.appendOverlays cfg.overlays else defaultPkgs;
 
 in
diff --git a/nixos/modules/profiles/hardened.nix b/nixos/modules/profiles/hardened.nix
index 3f8f78f012a7..856ee480fc0b 100644
--- a/nixos/modules/profiles/hardened.nix
+++ b/nixos/modules/profiles/hardened.nix
@@ -17,7 +17,7 @@ with lib;
 
   boot.kernelPackages = mkDefault pkgs.linuxPackages_hardened;
 
-  nix.allowedUsers = mkDefault [ "@users" ];
+  nix.settings.allowed-users = mkDefault [ "@users" ];
 
   environment.memoryAllocator.provider = mkDefault "scudo";
   environment.variables.SCUDO_OPTIONS = mkDefault "ZeroContents=1";
diff --git a/nixos/modules/security/misc.nix b/nixos/modules/security/misc.nix
index e7abc1e0d597..c20e067b8cc7 100644
--- a/nixos/modules/security/misc.nix
+++ b/nixos/modules/security/misc.nix
@@ -123,8 +123,8 @@ with lib;
       boot.kernel.sysctl."user.max_user_namespaces" = 0;
 
       assertions = [
-        { assertion = config.nix.useSandbox -> config.security.allowUserNamespaces;
-          message = "`nix.useSandbox = true` conflicts with `!security.allowUserNamespaces`.";
+        { assertion = config.nix.settings.sandbox -> config.security.allowUserNamespaces;
+          message = "`nix.settings.sandbox = true` conflicts with `!security.allowUserNamespaces`.";
         }
       ];
     })
diff --git a/nixos/modules/services/continuous-integration/gitlab-runner.nix b/nixos/modules/services/continuous-integration/gitlab-runner.nix
index d4b8541c6a1b..dc58c6345239 100644
--- a/nixos/modules/services/continuous-integration/gitlab-runner.nix
+++ b/nixos/modules/services/continuous-integration/gitlab-runner.nix
@@ -147,7 +147,7 @@ in
     concurrent = mkOption {
       type = types.int;
       default = 1;
-      example = literalExpression "config.nix.maxJobs";
+      example = literalExpression "config.nix.settings.max-jobs";
       description = ''
         Limits how many jobs globally can be run concurrently.
         The most upper limit of jobs using all defined runners.
diff --git a/nixos/modules/services/continuous-integration/hercules-ci-agent/default.nix b/nixos/modules/services/continuous-integration/hercules-ci-agent/default.nix
index 968bc8f1e54e..ef1933e12284 100644
--- a/nixos/modules/services/continuous-integration/hercules-ci-agent/default.nix
+++ b/nixos/modules/services/continuous-integration/hercules-ci-agent/default.nix
@@ -67,7 +67,7 @@ in
 
     # Trusted user allows simplified configuration and better performance
     # when operating in a cluster.
-    nix.trustedUsers = [ config.systemd.services.hercules-ci-agent.serviceConfig.User ];
+    nix.settings.trusted-users = [ config.systemd.services.hercules-ci-agent.serviceConfig.User ];
     services.hercules-ci-agent = {
       settings = {
         nixUserIsTrusted = true;
diff --git a/nixos/modules/services/continuous-integration/hydra/default.nix b/nixos/modules/services/continuous-integration/hydra/default.nix
index ccb7cc21734e..cc5de97d6d10 100644
--- a/nixos/modules/services/continuous-integration/hydra/default.nix
+++ b/nixos/modules/services/continuous-integration/hydra/default.nix
@@ -258,8 +258,6 @@ in
         uid = config.ids.uids.hydra-www;
       };
 
-    nix.trustedUsers = [ "hydra-queue-runner" ];
-
     services.hydra.extraConfig =
       ''
         using_frontend_proxy = 1
@@ -277,16 +275,21 @@ in
 
     environment.variables = hydraEnv;
 
-    nix.extraOptions = ''
-      keep-outputs = true
-      keep-derivations = true
-
-
-    '' + optionalString (versionOlder (getVersion config.nix.package.out) "2.4pre") ''
-      # The default (`true') slows Nix down a lot since the build farm
-      # has so many GC roots.
-      gc-check-reachability = false
-    '';
+    nix.settings = mkMerge [
+      {
+        keep-outputs = true;
+        keep-derivations = true;
+        trusted-users = [ "hydra-queue-runner" ];
+      }
+
+      (mkIf (versionOlder (getVersion config.nix.package.out) "2.4pre")
+        {
+          # The default (`true') slows Nix down a lot since the build farm
+          # has so many GC roots.
+          gc-check-reachability = false;
+        }
+      )
+    ];
 
     systemd.services.hydra-init =
       { wantedBy = [ "multi-user.target" ];
diff --git a/nixos/modules/services/misc/mx-puppet-discord.nix b/nixos/modules/services/misc/mx-puppet-discord.nix
index b6f5e04511ae..6214f7f7eb6b 100644
--- a/nixos/modules/services/misc/mx-puppet-discord.nix
+++ b/nixos/modules/services/misc/mx-puppet-discord.nix
@@ -79,10 +79,7 @@ in {
 
   config = mkIf cfg.enable {
     systemd.services.mx-puppet-discord = {
-      description = ''
-        mx-puppet-discord is a discord puppeting bridge for matrix.
-        It handles bridging private and group DMs, as well as Guilds (servers).
-      '';
+      description = "Matrix to Discord puppeting bridge";
 
       wantedBy = [ "multi-user.target" ];
       wants = [ "network-online.target" ] ++ cfg.serviceDependencies;
diff --git a/nixos/modules/services/misc/nix-daemon.nix b/nixos/modules/services/misc/nix-daemon.nix
index 869feb05eb7b..cd4408cef411 100644
--- a/nixos/modules/services/misc/nix-daemon.nix
+++ b/nixos/modules/services/misc/nix-daemon.nix
@@ -6,20 +6,20 @@ let
 
   cfg = config.nix;
 
-  nix = cfg.package.out;
+  nixPackage = cfg.package.out;
 
-  nixVersion = getVersion nix;
-
-  isNix23 = versionAtLeast nixVersion "2.3pre";
+  isNixAtLeast = versionAtLeast (getVersion nixPackage);
 
   makeNixBuildUser = nr: {
-    name  = "nixbld${toString nr}";
+    name = "nixbld${toString nr}";
     value = {
       description = "Nix build user ${toString nr}";
 
-      /* For consistency with the setgid(2), setuid(2), and setgroups(2)
-         calls in `libstore/build.cc', don't add any supplementary group
-         here except "nixbld".  */
+      /*
+        For consistency with the setgid(2), setuid(2), and setgroups(2)
+        calls in `libstore/build.cc', don't add any supplementary group
+        here except "nixbld".
+      */
       uid = builtins.add config.ids.uids.nixbld nr;
       isSystemUser = true;
       group = "nixbld";
@@ -30,43 +30,82 @@ let
   nixbldUsers = listToAttrs (map makeNixBuildUser (range 1 cfg.nrBuildUsers));
 
   nixConf =
-    assert versionAtLeast nixVersion "2.2";
-    pkgs.runCommand "nix.conf" { preferLocalBuild = true; extraOptions = cfg.extraOptions; } (
-      ''
-        cat > $out <<END
+    assert isNixAtLeast "2.2";
+    let
+
+      mkValueString = v:
+        if v == null then ""
+        else if isInt v then toString v
+        else if isBool v then boolToString v
+        else if isFloat v then floatToString v
+        else if isList v then toString v
+        else if isDerivation v then toString v
+        else if builtins.isPath v then toString v
+        else if isString v then v
+        else if isCoercibleToString v then toString v
+        else abort "The nix conf value: ${toPretty {} v} can not be encoded";
+
+      mkKeyValue = k: v: "${escape [ "=" ] k} = ${mkValueString v}";
+
+      mkKeyValuePairs = attrs: concatStringsSep "\n" (mapAttrsToList mkKeyValue attrs);
+
+    in
+    pkgs.writeTextFile {
+      name = "nix.conf";
+      text = ''
         # WARNING: this file is generated from the nix.* options in
         # your NixOS configuration, typically
         # /etc/nixos/configuration.nix.  Do not edit it!
-        build-users-group = nixbld
-        max-jobs = ${toString (cfg.maxJobs)}
-        cores = ${toString (cfg.buildCores)}
-        sandbox = ${if (builtins.isBool cfg.useSandbox) then boolToString cfg.useSandbox else cfg.useSandbox}
-        extra-sandbox-paths = ${toString cfg.sandboxPaths}
-        substituters = ${toString cfg.binaryCaches}
-        trusted-substituters = ${toString cfg.trustedBinaryCaches}
-        trusted-public-keys = ${toString cfg.binaryCachePublicKeys}
-        auto-optimise-store = ${boolToString cfg.autoOptimiseStore}
-        require-sigs = ${boolToString cfg.requireSignedBinaryCaches}
-        trusted-users = ${toString cfg.trustedUsers}
-        allowed-users = ${toString cfg.allowedUsers}
-        ${optionalString (!cfg.distributedBuilds) ''
-          builders =
-        ''}
-        system-features = ${toString cfg.systemFeatures}
-        ${optionalString isNix23 ''
-          sandbox-fallback = false
-        ''}
-        $extraOptions
-        END
-      '' + optionalString cfg.checkConfig (
-            if pkgs.stdenv.hostPlatform != pkgs.stdenv.buildPlatform then ''
-              echo "Ignore nix.checkConfig when cross-compiling"
-            '' else ''
-              echo "Checking that Nix can read nix.conf..."
-              ln -s $out ./nix.conf
-              NIX_CONF_DIR=$PWD ${cfg.package}/bin/nix show-config ${optionalString isNix23 "--no-net --option experimental-features nix-command"} >/dev/null
-            '')
-      );
+        ${mkKeyValuePairs cfg.settings}
+        ${cfg.extraOptions}
+      '';
+      checkPhase =
+        if pkgs.stdenv.hostPlatform != pkgs.stdenv.buildPlatform then ''
+          echo "Ignoring validation for cross-compilation"
+        ''
+        else ''
+          echo "Validating generated nix.conf"
+          ln -s $out ./nix.conf
+          set -e
+          set +o pipefail
+          NIX_CONF_DIR=$PWD \
+            ${cfg.package}/bin/nix show-config ${optionalString (isNixAtLeast "2.3pre") "--no-net --option experimental-features nix-command"} \
+            |& sed -e 's/^warning:/error:/' \
+            | (! grep '${if cfg.checkConfig then "^error:" else "^error: unknown setting"}')
+          set -o pipefail
+        '';
+    };
+
+  legacyConfMappings = {
+    useSandbox = "sandbox";
+    buildCores = "cores";
+    maxJobs = "max-jobs";
+    sandboxPaths = "extra-sandbox-paths";
+    binaryCaches = "substituters";
+    trustedBinaryCaches = "trusted-substituters";
+    binaryCachePublicKeys = "trusted-public-keys";
+    autoOptimiseStore = "auto-optimise-store";
+    requireSignedBinaryCaches = "require-sigs";
+    trustedUsers = "trusted-users";
+    allowedUsers = "allowed-users";
+    systemFeatures = "system-feature";
+  };
+
+  semanticConfType = with types;
+    let
+      confAtom = nullOr
+        (oneOf [
+          bool
+          int
+          float
+          str
+          path
+          package
+        ]) // {
+        description = "Nix config atom (null, bool, int, float, str, path or package)";
+      };
+    in
+    attrsOf (either confAtom (listOf confAtom));
 
 in
 
@@ -76,7 +115,7 @@ in
     (mkRenamedOptionModule [ "nix" "chrootDirs" ] [ "nix" "sandboxPaths" ])
     (mkRenamedOptionModule [ "nix" "daemonIONiceLevel" ] [ "nix" "daemonIOSchedPriority" ])
     (mkRemovedOptionModule [ "nix" "daemonNiceLevel" ] "Consider nix.daemonCPUSchedPolicy instead.")
-  ];
+  ] ++ mapAttrsToList (oldConf: newConf: mkRenamedOptionModule [ "nix" oldConf ] [ "nix" "settings" newConf ]) legacyConfMappings;
 
   ###### interface
 
@@ -102,81 +141,6 @@ in
         '';
       };
 
-      maxJobs = mkOption {
-        type = types.either types.int (types.enum ["auto"]);
-        default = "auto";
-        example = 64;
-        description = ''
-          This option defines the maximum number of jobs that Nix will try to
-          build in parallel. The default is auto, which means it will use all
-          available logical cores. It is recommend to set it to the total
-          number of logical cores in your system (e.g., 16 for two CPUs with 4
-          cores each and hyper-threading).
-        '';
-      };
-
-      autoOptimiseStore = mkOption {
-        type = types.bool;
-        default = false;
-        example = true;
-        description = ''
-         If set to true, Nix automatically detects files in the store that have
-         identical contents, and replaces them with hard links to a single copy.
-         This saves disk space. If set to false (the default), you can still run
-         nix-store --optimise to get rid of duplicate files.
-        '';
-      };
-
-      buildCores = mkOption {
-        type = types.int;
-        default = 0;
-        example = 64;
-        description = ''
-          This option defines the maximum number of concurrent tasks during
-          one build. It affects, e.g., -j option for make.
-          The special value 0 means that the builder should use all
-          available CPU cores in the system. Some builds may become
-          non-deterministic with this option; use with care! Packages will
-          only be affected if enableParallelBuilding is set for them.
-        '';
-      };
-
-      useSandbox = mkOption {
-        type = types.either types.bool (types.enum ["relaxed"]);
-        default = true;
-        description = "
-          If set, Nix will perform builds in a sandboxed environment that it
-          will set up automatically for each build. This prevents impurities
-          in builds by disallowing access to dependencies outside of the Nix
-          store by using network and mount namespaces in a chroot environment.
-          This is enabled by default even though it has a possible performance
-          impact due to the initial setup time of a sandbox for each build. It
-          doesn't affect derivation hashes, so changing this option will not
-          trigger a rebuild of packages.
-        ";
-      };
-
-      sandboxPaths = mkOption {
-        type = types.listOf types.str;
-        default = [];
-        example = [ "/dev" "/proc" ];
-        description =
-          ''
-            Directories from the host filesystem to be included
-            in the sandbox.
-          '';
-      };
-
-      extraOptions = mkOption {
-        type = types.lines;
-        default = "";
-        example = ''
-          keep-outputs = true
-          keep-derivations = true
-        '';
-        description = "Additional text appended to <filename>nix.conf</filename>.";
-      };
-
       distributedBuilds = mkOption {
         type = types.bool;
         default = false;
@@ -187,7 +151,7 @@ in
       };
 
       daemonCPUSchedPolicy = mkOption {
-        type = types.enum ["other" "batch" "idle"];
+        type = types.enum [ "other" "batch" "idle" ];
         default = "other";
         example = "batch";
         description = ''
@@ -218,7 +182,7 @@ in
       };
 
       daemonIOSchedClass = mkOption {
-        type = types.enum ["best-effort" "idle"];
+        type = types.enum [ "best-effort" "idle" ];
         default = "best-effort";
         example = "idle";
         description = ''
@@ -250,11 +214,11 @@ in
           scheduling policy: With idle, priorities are not used in scheduling
           decisions. best-effort supports values in the range 0 (high) to 7
           (low).
-      '';
+        '';
       };
 
       buildMachines = mkOption {
-        type = types.listOf (types.submodule ({
+        type = types.listOf (types.submodule {
           options = {
             hostName = mkOption {
               type = types.str;
@@ -276,7 +240,7 @@ in
             };
             systems = mkOption {
               type = types.listOf types.str;
-              default = [];
+              default = [ ];
               example = [ "x86_64-linux" "aarch64-linux" ];
               description = ''
                 The system types the build machine can execute derivations on.
@@ -293,7 +257,7 @@ in
                 The username to log in as on the remote host. This user must be
                 able to log in and run nix commands non-interactively. It must
                 also be privileged to build derivations, so must be included in
-                <option>nix.trustedUsers</option>.
+                <option>nix.settings.trusted-users</option>.
               '';
             };
             sshKey = mkOption {
@@ -331,7 +295,7 @@ in
             };
             mandatoryFeatures = mkOption {
               type = types.listOf types.str;
-              default = [];
+              default = [ ];
               example = [ "big-parallel" ];
               description = ''
                 A list of features mandatory for this builder. The builder will
@@ -342,7 +306,7 @@ in
             };
             supportedFeatures = mkOption {
               type = types.listOf types.str;
-              default = [];
+              default = [ ];
               example = [ "kvm" "big-parallel" ];
               description = ''
                 A list of features supported by this builder. The builder will
@@ -350,9 +314,18 @@ in
                 list.
               '';
             };
+            publicHostKey = mkOption {
+              type = types.nullOr types.str;
+              default = null;
+              description = ''
+                The (base64-encoded) public host key of this builder. The field
+                is calculated via <command>base64 -w0 /etc/ssh/ssh_host_type_key.pub</command>.
+                If null, SSH will use its regular known-hosts file when connecting.
+              '';
+            };
           };
-        }));
-        default = [];
+        });
+        default = [ ];
         description = ''
           This option lists the machines to be used if distributed builds are
           enabled (see <option>nix.distributedBuilds</option>).
@@ -366,7 +339,7 @@ in
       envVars = mkOption {
         type = types.attrs;
         internal = true;
-        default = {};
+        default = { };
         description = "Environment variables used by Nix.";
       };
 
@@ -391,92 +364,13 @@ in
         '';
       };
 
-      binaryCaches = mkOption {
-        type = types.listOf types.str;
-        description = ''
-          List of binary cache URLs used to obtain pre-built binaries
-          of Nix packages.
-
-          By default https://cache.nixos.org/ is added,
-          to override it use <literal>lib.mkForce []</literal>.
-        '';
-      };
-
-      trustedBinaryCaches = mkOption {
-        type = types.listOf types.str;
-        default = [ ];
-        example = [ "https://hydra.nixos.org/" ];
-        description = ''
-          List of binary cache URLs that non-root users can use (in
-          addition to those specified using
-          <option>nix.binaryCaches</option>) by passing
-          <literal>--option binary-caches</literal> to Nix commands.
-        '';
-      };
-
-      requireSignedBinaryCaches = mkOption {
-        type = types.bool;
-        default = true;
-        description = ''
-          If enabled (the default), Nix will only download binaries from binary caches if
-          they are cryptographically signed with any of the keys listed in
-          <option>nix.binaryCachePublicKeys</option>. If disabled, signatures are neither
-          required nor checked, so it's strongly recommended that you use only
-          trustworthy caches and https to prevent man-in-the-middle attacks.
-        '';
-      };
-
-      binaryCachePublicKeys = mkOption {
-        type = types.listOf types.str;
-        example = [ "hydra.nixos.org-1:CNHJZBh9K4tP3EKF6FkkgeVYsS3ohTl+oS0Qa8bezVs=" ];
-        description = ''
-          List of public keys used to sign binary caches. If
-          <option>nix.requireSignedBinaryCaches</option> is enabled,
-          then Nix will use a binary from a binary cache if and only
-          if it is signed by <emphasis>any</emphasis> of the keys
-          listed here. By default, only the key for
-          <uri>cache.nixos.org</uri> is included.
-        '';
-      };
-
-      trustedUsers = mkOption {
-        type = types.listOf types.str;
-        default = [ "root" ];
-        example = [ "root" "alice" "@wheel" ];
-        description = ''
-          A list of names of users that have additional rights when
-          connecting to the Nix daemon, such as the ability to specify
-          additional binary caches, or to import unsigned NARs. You
-          can also specify groups by prefixing them with
-          <literal>@</literal>; for instance,
-          <literal>@wheel</literal> means all users in the wheel
-          group.
-        '';
-      };
-
-      allowedUsers = mkOption {
-        type = types.listOf types.str;
-        default = [ "*" ];
-        example = [ "@wheel" "@builders" "alice" "bob" ];
-        description = ''
-          A list of names of users (separated by whitespace) that are
-          allowed to connect to the Nix daemon. As with
-          <option>nix.trustedUsers</option>, you can specify groups by
-          prefixing them with <literal>@</literal>. Also, you can
-          allow all users by specifying <literal>*</literal>. The
-          default is <literal>*</literal>. Note that trusted users are
-          always allowed to connect.
-        '';
-      };
-
       nixPath = mkOption {
         type = types.listOf types.str;
-        default =
-          [
-            "nixpkgs=/nix/var/nix/profiles/per-user/root/channels/nixos"
-            "nixos-config=/etc/nixos/configuration.nix"
-            "/nix/var/nix/profiles/per-user/root/channels"
-          ];
+        default = [
+          "nixpkgs=/nix/var/nix/profiles/per-user/root/channels/nixos"
+          "nixos-config=/etc/nixos/configuration.nix"
+          "/nix/var/nix/profiles/per-user/root/channels"
+        ];
         description = ''
           The default Nix expression search path, used by the Nix
           evaluator to look up paths enclosed in angle brackets
@@ -484,45 +378,44 @@ in
         '';
       };
 
-      systemFeatures = mkOption {
-        type = types.listOf types.str;
-        example = [ "kvm" "big-parallel" "gccarch-skylake" ];
-        description = ''
-          The supported features of a machine
-        '';
-      };
-
       checkConfig = mkOption {
         type = types.bool;
         default = true;
         description = ''
-          If enabled (the default), checks that Nix can parse the generated nix.conf.
+          If enabled (the default), checks for data type mismatches and that Nix
+          can parse the generated nix.conf.
         '';
       };
 
       registry = mkOption {
         type = types.attrsOf (types.submodule (
           let
-            inputAttrs = types.attrsOf (types.oneOf [types.str types.int types.bool types.package]);
+            referenceAttrs = with types; attrsOf (oneOf [
+              str
+              int
+              bool
+              package
+            ]);
           in
           { config, name, ... }:
-          { options = {
+          {
+            options = {
               from = mkOption {
-                type = inputAttrs;
+                type = referenceAttrs;
                 example = { type = "indirect"; id = "nixpkgs"; };
                 description = "The flake reference to be rewritten.";
               };
               to = mkOption {
-                type = inputAttrs;
+                type = referenceAttrs;
                 example = { type = "github"; owner = "my-org"; repo = "my-nixpkgs"; };
-                description = "The flake reference to which <option>from></option> is to be rewritten.";
+                description = "The flake reference <option>from></option> is rewritten to.";
               };
               flake = mkOption {
                 type = types.nullOr types.attrs;
                 default = null;
                 example = literalExpression "nixpkgs";
                 description = ''
-                  The flake input to which <option>from></option> is to be rewritten.
+                  The flake input <option>from></option> is rewritten to.
                 '';
               };
               exact = mkOption {
@@ -537,35 +430,232 @@ in
             };
             config = {
               from = mkDefault { type = "indirect"; id = name; };
-              to = mkIf (config.flake != null)
-                ({ type = "path";
-                   path = config.flake.outPath;
-                 } // lib.filterAttrs
-                   (n: v: n == "lastModified" || n == "rev" || n == "revCount" || n == "narHash")
-                   config.flake);
+              to = mkIf (config.flake != null) (mkDefault
+                {
+                  type = "path";
+                  path = config.flake.outPath;
+                } // filterAttrs
+                (n: _: n == "lastModified" || n == "rev" || n == "revCount" || n == "narHash")
+                config.flake);
             };
           }
         ));
-        default = {};
+        default = { };
         description = ''
           A system-wide flake registry.
         '';
       };
 
-    };
+      extraOptions = mkOption {
+        type = types.lines;
+        default = "";
+        example = ''
+          keep-outputs = true
+          keep-derivations = true
+        '';
+        description = "Additional text appended to <filename>nix.conf</filename>.";
+      };
+
+      settings = mkOption {
+        type = types.submodule {
+          freeformType = semanticConfType;
+
+          options = {
+            max-jobs = mkOption {
+              type = types.either types.int (types.enum [ "auto" ]);
+              default = "auto";
+              example = 64;
+              description = ''
+                This option defines the maximum number of jobs that Nix will try to
+                build in parallel. The default is auto, which means it will use all
+                available logical cores. It is recommend to set it to the total
+                number of logical cores in your system (e.g., 16 for two CPUs with 4
+                cores each and hyper-threading).
+              '';
+            };
+
+            auto-optimise-store = mkOption {
+              type = types.bool;
+              default = false;
+              example = true;
+              description = ''
+                If set to true, Nix automatically detects files in the store that have
+                identical contents, and replaces them with hard links to a single copy.
+                This saves disk space. If set to false (the default), you can still run
+                nix-store --optimise to get rid of duplicate files.
+              '';
+            };
 
+            cores = mkOption {
+              type = types.int;
+              default = 0;
+              example = 64;
+              description = ''
+                This option defines the maximum number of concurrent tasks during
+                one build. It affects, e.g., -j option for make.
+                The special value 0 means that the builder should use all
+                available CPU cores in the system. Some builds may become
+                non-deterministic with this option; use with care! Packages will
+                only be affected if enableParallelBuilding is set for them.
+              '';
+            };
+
+            sandbox = mkOption {
+              type = types.either types.bool (types.enum [ "relaxed" ]);
+              default = true;
+              description = ''
+                If set, Nix will perform builds in a sandboxed environment that it
+                will set up automatically for each build. This prevents impurities
+                in builds by disallowing access to dependencies outside of the Nix
+                store by using network and mount namespaces in a chroot environment.
+                This is enabled by default even though it has a possible performance
+                impact due to the initial setup time of a sandbox for each build. It
+                doesn't affect derivation hashes, so changing this option will not
+                trigger a rebuild of packages.
+              '';
+            };
+
+            extra-sandbox-paths = mkOption {
+              type = types.listOf types.str;
+              default = [ ];
+              example = [ "/dev" "/proc" ];
+              description = ''
+                Directories from the host filesystem to be included
+                in the sandbox.
+              '';
+            };
+
+            substituters = mkOption {
+              type = types.listOf types.str;
+              description = ''
+                List of binary cache URLs used to obtain pre-built binaries
+                of Nix packages.
+
+                By default https://cache.nixos.org/ is added.
+              '';
+            };
+
+            trusted-substituters = mkOption {
+              type = types.listOf types.str;
+              default = [ ];
+              example = [ "https://hydra.nixos.org/" ];
+              description = ''
+                List of binary cache URLs that non-root users can use (in
+                addition to those specified using
+                <option>nix.settings.substituters</option>) by passing
+                <literal>--option binary-caches</literal> to Nix commands.
+              '';
+            };
+
+            require-sigs = mkOption {
+              type = types.bool;
+              default = true;
+              description = ''
+                If enabled (the default), Nix will only download binaries from binary caches if
+                they are cryptographically signed with any of the keys listed in
+                <option>nix.settings.trusted-public-keys</option>. If disabled, signatures are neither
+                required nor checked, so it's strongly recommended that you use only
+                trustworthy caches and https to prevent man-in-the-middle attacks.
+              '';
+            };
+
+            trusted-public-keys = mkOption {
+              type = types.listOf types.str;
+              example = [ "hydra.nixos.org-1:CNHJZBh9K4tP3EKF6FkkgeVYsS3ohTl+oS0Qa8bezVs=" ];
+              description = ''
+                List of public keys used to sign binary caches. If
+                <option>nix.settings.trusted-public-keys</option> is enabled,
+                then Nix will use a binary from a binary cache if and only
+                if it is signed by <emphasis>any</emphasis> of the keys
+                listed here. By default, only the key for
+                <uri>cache.nixos.org</uri> is included.
+              '';
+            };
+
+            trusted-users = mkOption {
+              type = types.listOf types.str;
+              default = [ "root" ];
+              example = [ "root" "alice" "@wheel" ];
+              description = ''
+                A list of names of users that have additional rights when
+                connecting to the Nix daemon, such as the ability to specify
+                additional binary caches, or to import unsigned NARs. You
+                can also specify groups by prefixing them with
+                <literal>@</literal>; for instance,
+                <literal>@wheel</literal> means all users in the wheel
+                group.
+              '';
+            };
+
+            system-features = mkOption {
+              type = types.listOf types.str;
+              example = [ "kvm" "big-parallel" "gccarch-skylake" ];
+              description = ''
+                The set of features supported by the machine. Derivations
+                can express dependencies on system features through the
+                <literal>requiredSystemFeatures</literal> attribute.
+
+                By default, pseudo-features <literal>nixos-test</literal>, <literal>benchmark</literal>,
+                and <literal>big-parallel</literal> used in Nixpkgs are set, <literal>kvm</literal>
+                is also included in it is avaliable.
+              '';
+            };
+
+            allowed-users = mkOption {
+              type = types.listOf types.str;
+              default = [ "*" ];
+              example = [ "@wheel" "@builders" "alice" "bob" ];
+              description = ''
+                A list of names of users (separated by whitespace) that are
+                allowed to connect to the Nix daemon. As with
+                <option>nix.settings.trusted-users</option>, you can specify groups by
+                prefixing them with <literal>@</literal>. Also, you can
+                allow all users by specifying <literal>*</literal>. The
+                default is <literal>*</literal>. Note that trusted users are
+                always allowed to connect.
+              '';
+            };
+          };
+        };
+        default = { };
+        example = literalExpression ''
+          {
+            use-sandbox = true;
+            show-trace = true;
+
+            system-features = [ "big-parallel" "kvm" "recursive-nix" ];
+            sandbox-paths = { "/bin/sh" = "''${pkgs.busybox-sandbox-shell.out}/bin/busybox"; };
+          }
+        '';
+        description = ''
+          Configuration for Nix, see
+          <link xlink:href="https://nixos.org/manual/nix/stable/#sec-conf-file"/> or
+          <citerefentry>
+            <refentrytitle>nix.conf</refentrytitle>
+            <manvolnum>5</manvolnum>
+          </citerefentry> for avalaible options.
+          The value declared here will be translated directly to the key-value pairs Nix expects.
+          </para>
+          <para>
+          You can use <command>nix-instantiate --eval --strict '&lt;nixpkgs/nixos&gt;' -A config.nix.settings</command>
+          to view the current value. By default it is empty.
+          </para>
+          <para>
+          Nix configurations defined under <option>nix.*</option> will be translated and applied to this
+          option. In addition, configuration specified in <option>nix.extraOptions</option> which will be appended
+          verbatim to the resulting config file.
+        '';
+      };
+    };
   };
 
 
   ###### implementation
 
   config = mkIf cfg.enable {
-
-    nix.binaryCachePublicKeys = [ "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" ];
-    nix.binaryCaches = [ "https://cache.nixos.org/" ];
-
     environment.systemPackages =
-      [ nix
+      [
+        nixPackage
         pkgs.nix-info
       ]
       ++ optional (config.programs.bash.enableCompletion) pkgs.nix-bash-completions;
@@ -579,44 +669,49 @@ in
 
     # List of machines for distributed Nix builds in the format
     # expected by build-remote.pl.
-    environment.etc."nix/machines" =
-      { enable = cfg.buildMachines != [];
-        text =
-          concatMapStrings (machine:
-            "${if machine.sshUser != null then "${machine.sshUser}@" else ""}${machine.hostName} "
-            + (if machine.system != null then machine.system else concatStringsSep "," machine.systems)
-            + " ${if machine.sshKey != null then machine.sshKey else "-"} ${toString machine.maxJobs} "
-            + toString (machine.speedFactor)
-            + " "
-            + concatStringsSep "," (machine.mandatoryFeatures ++ machine.supportedFeatures)
-            + " "
-            + concatStringsSep "," machine.mandatoryFeatures
+    environment.etc."nix/machines" = mkIf (cfg.buildMachines != [ ]) {
+      text =
+        concatMapStrings
+          (machine:
+            (concatStringsSep " " ([
+              "${optionalString (machine.sshUser != null) "${machine.sshUser}@"}${machine.hostName}"
+              (if machine.system != null then machine.system else if machine.systems != [ ] then concatStringsSep "," machine.systems else "-")
+              (if machine.sshKey != null then machine.sshKey else "-")
+              (toString machine.maxJobs)
+              (toString machine.speedFactor)
+              (concatStringsSep "," machine.supportedFeatures)
+              (concatStringsSep "," machine.mandatoryFeatures)
+            ]
+            ++ optional (isNixAtLeast "2.4pre") (if machine.publicHostKey != null then machine.publicHostKey else "-")))
             + "\n"
-          ) cfg.buildMachines;
-      };
+          )
+          cfg.buildMachines;
+    };
+
     assertions =
-      let badMachine = m: m.system == null && m.systems == [];
-      in [
+      let badMachine = m: m.system == null && m.systems == [ ];
+      in
+      [
         {
-          assertion = !(builtins.any badMachine cfg.buildMachines);
+          assertion = !(any badMachine cfg.buildMachines);
           message = ''
             At least one system type (via <varname>system</varname> or
               <varname>systems</varname>) must be set for every build machine.
               Invalid machine specifications:
           '' + "      " +
-          (builtins.concatStringsSep "\n      "
-            (builtins.map (m: m.hostName)
-              (builtins.filter (badMachine) cfg.buildMachines)));
+          (concatStringsSep "\n      "
+            (map (m: m.hostName)
+              (filter (badMachine) cfg.buildMachines)));
         }
       ];
 
-
-    systemd.packages = [ nix ];
+    systemd.packages = [ nixPackage ];
 
     systemd.sockets.nix-daemon.wantedBy = [ "sockets.target" ];
 
     systemd.services.nix-daemon =
-      { path = [ nix pkgs.util-linux config.programs.ssh.package ]
+      {
+        path = [ nixPackage pkgs.util-linux config.programs.ssh.package ]
           ++ optionals cfg.distributedBuilds [ pkgs.gzip ];
 
         environment = cfg.envVars
@@ -626,7 +721,8 @@ in
         unitConfig.RequiresMountsFor = "/nix/store";
 
         serviceConfig =
-          { CPUSchedulingPolicy = cfg.daemonCPUSchedPolicy;
+          {
+            CPUSchedulingPolicy = cfg.daemonCPUSchedPolicy;
             IOSchedulingClass = cfg.daemonIOSchedClass;
             IOSchedulingPriority = cfg.daemonIOSchedPriority;
             LimitNOFILE = 4096;
@@ -636,9 +732,7 @@ in
       };
 
     # Set up the environment variables for running Nix.
-    environment.sessionVariables = cfg.envVars //
-      { NIX_PATH = cfg.nixPath;
-      };
+    environment.sessionVariables = cfg.envVars // { NIX_PATH = cfg.nixPath; };
 
     environment.extraInit =
       ''
@@ -647,7 +741,7 @@ in
         fi
       '';
 
-    nix.nrBuildUsers = mkDefault (lib.max 32 (if cfg.maxJobs == "auto" then 0 else cfg.maxJobs));
+    nix.nrBuildUsers = mkDefault (max 32 (if cfg.settings.max-jobs == "auto" then 0 else cfg.settings.max-jobs));
 
     users.users = nixbldUsers;
 
@@ -663,14 +757,26 @@ in
         fi
       '';
 
-    nix.systemFeatures = mkDefault (
-      [ "nixos-test" "benchmark" "big-parallel" "kvm" ] ++
-      optionals (pkgs.hostPlatform ? gcc.arch) (
-        # a builder can run code for `gcc.arch` and inferior architectures
-        [ "gccarch-${pkgs.hostPlatform.gcc.arch}" ] ++
-        map (x: "gccarch-${x}") lib.systems.architectures.inferiors.${pkgs.hostPlatform.gcc.arch}
-      )
-    );
+    # Legacy configuration conversion.
+    nix.settings = mkMerge [
+      {
+        trusted-public-keys = [ "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" ];
+        substituters = [ "https://cache.nixos.org/" ];
+
+        system-features = mkDefault (
+          [ "nixos-test" "benchmark" "big-parallel" "kvm" ] ++
+          optionals (pkgs.hostPlatform ? gcc.arch) (
+            # a builder can run code for `gcc.arch` and inferior architectures
+            [ "gccarch-${pkgs.hostPlatform.gcc.arch}" ] ++
+            map (x: "gccarch-${x}") systems.architectures.inferiors.${pkgs.hostPlatform.gcc.arch}
+          )
+        );
+      }
+
+      (mkIf (!cfg.distributedBuilds) { builders = null; })
+
+      (mkIf (isNixAtLeast "2.3pre") { sandbox-fallback = false; })
+    ];
 
   };
 
diff --git a/nixos/modules/services/misc/nix-ssh-serve.nix b/nixos/modules/services/misc/nix-ssh-serve.nix
index d5c64fdb2647..355fad5db468 100644
--- a/nixos/modules/services/misc/nix-ssh-serve.nix
+++ b/nixos/modules/services/misc/nix-ssh-serve.nix
@@ -20,7 +20,7 @@ in {
       write = mkOption {
         type = types.bool;
         default = false;
-        description = "Whether to enable writing to the Nix store as a remote store via SSH. Note: the sshServe user is named nix-ssh and is not a trusted-user. nix-ssh should be added to the nix.trustedUsers option in most use cases, such as allowing remote building of derivations.";
+        description = "Whether to enable writing to the Nix store as a remote store via SSH. Note: the sshServe user is named nix-ssh and is not a trusted-user. nix-ssh should be added to the <option>nix.settings.trusted-users</option> option in most use cases, such as allowing remote building of derivations.";
       };
 
       keys = mkOption {
diff --git a/nixos/modules/services/monitoring/prometheus/exporters/smartctl.nix b/nixos/modules/services/monitoring/prometheus/exporters/smartctl.nix
index b6416b93e69c..9e49601ce1a7 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters/smartctl.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/smartctl.nix
@@ -25,7 +25,8 @@ in {
         [ "/dev/sda", "/dev/nvme0n1" ];
       '';
       description = ''
-        Paths to disks that will be monitored.
+        Paths to the disks that will be monitored. Will autodiscover
+        all disks if none given.
       '';
     };
     maxInterval = mkOption {
@@ -41,13 +42,23 @@ in {
   serviceOpts = {
     serviceConfig = {
       AmbientCapabilities = [
+        "CAP_RAW_SYSIO"
         "CAP_SYS_ADMIN"
       ];
       CapabilityBoundingSet = [
+        "CAP_RAW_SYSIO"
         "CAP_SYS_ADMIN"
       ];
       DevicePolicy = "closed";
-      DeviceAllow = lib.mkForce cfg.devices;
+      DeviceAllow = lib.mkOverride 100 (
+        if cfg.devices != [] then
+          cfg.devices
+        else [
+          "block-blkext rw"
+          "block-sd rw"
+          "char-nvme rw"
+        ]
+      );
       ExecStart = ''
         ${pkgs.prometheus-smartctl-exporter}/bin/smartctl_exporter -config ${configFile}
       '';
diff --git a/nixos/modules/services/web-apps/nextcloud.nix b/nixos/modules/services/web-apps/nextcloud.nix
index 739ba1ea12f6..141ab98e29bf 100644
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@@ -599,6 +599,8 @@ in {
         timerConfig.Unit = "nextcloud-cron.service";
       };
 
+      systemd.tmpfiles.rules = ["d ${cfg.home} 0750 nextcloud nextcloud"];
+
       systemd.services = {
         # When upgrading the Nextcloud package, Nextcloud can report errors such as
         # "The files of the app [all apps in /var/lib/nextcloud/apps] were not replaced correctly"
@@ -720,8 +722,6 @@ in {
           before = [ "phpfpm-nextcloud.service" ];
           path = [ occ ];
           script = ''
-            chmod og+x ${cfg.home}
-
             ${optionalString (c.dbpassFile != null) ''
               if [ ! -r "${c.dbpassFile}" ]; then
                 echo "dbpassFile ${c.dbpassFile} is not readable by nextcloud:nextcloud! Aborting..."
@@ -814,7 +814,6 @@ in {
       users.users.nextcloud = {
         home = "${cfg.home}";
         group = "nextcloud";
-        createHome = true;
         isSystemUser = true;
       };
       users.groups.nextcloud.members = [ "nextcloud" config.services.nginx.user ];
diff --git a/nixos/modules/system/activation/switch-to-configuration.pl b/nixos/modules/system/activation/switch-to-configuration.pl
index 93fff889d6bc..1fe346114e43 100644
--- a/nixos/modules/system/activation/switch-to-configuration.pl
+++ b/nixos/modules/system/activation/switch-to-configuration.pl
@@ -2,6 +2,7 @@
 
 use strict;
 use warnings;
+use Config::IniFiles;
 use File::Path qw(make_path);
 use File::Basename;
 use File::Slurp;
@@ -113,26 +114,77 @@ sub parseFstab {
     return ($fss, $swaps);
 }
 
-sub parseUnit {
-    my ($filename) = @_;
-    my $info = {};
-    parseKeyValues($info, read_file($filename)) if -f $filename;
-    parseKeyValues($info, read_file("${filename}.d/overrides.conf")) if -f "${filename}.d/overrides.conf";
-    return $info;
+# This subroutine takes a single ini file that specified systemd configuration
+# like unit configuration and parses it into a hash where the keys are the sections
+# of the unit file and the values are hashes themselves. These hashes have the unit file
+# keys as their keys (left side of =) and an array of all values that were set as their
+# values. If a value is empty (for example `ExecStart=`), then all current definitions are
+# removed.
+#
+# Instead of returning the hash, this subroutine takes a hashref to return the data in. This
+# allows calling the subroutine multiple times with the same hash to parse override files.
+sub parseSystemdIni {
+    my ($unitContents, $path) = @_;
+    # Tie the ini file to a hash for easier access
+    my %fileContents;
+    tie %fileContents, "Config::IniFiles", (-file => $path, -allowempty => 1, -allowcontinue => 1);
+
+    # Copy over all sections
+    foreach my $sectionName (keys %fileContents) {
+        # Copy over all keys
+        foreach my $iniKey (keys %{$fileContents{$sectionName}}) {
+            # Ensure the value is an array so it's easier to work with
+            my $iniValue = $fileContents{$sectionName}{$iniKey};
+            my @iniValues;
+            if (ref($iniValue) eq "ARRAY") {
+                @iniValues = @{$iniValue};
+            } else {
+                @iniValues = $iniValue;
+            }
+            # Go over all values
+            for my $iniValue (@iniValues) {
+                # If a value is empty, it's an override that tells us to clean the value
+                if ($iniValue eq "") {
+                    delete $unitContents->{$sectionName}->{$iniKey};
+                    next;
+                }
+                push(@{$unitContents->{$sectionName}->{$iniKey}}, $iniValue);
+            }
+        }
+    }
+    return;
 }
 
-sub parseKeyValues {
-    my $info = shift;
-    foreach my $line (@_) {
-        # FIXME: not quite correct.
-        $line =~ /^([^=]+)=(.*)$/ or next;
-        $info->{$1} = $2;
-    }
+# This subroutine takes the path to a systemd configuration file (like a unit configuration),
+# parses it, and returns a hash that contains the contents. The contents of this hash are
+# explained in the `parseSystemdIni` subroutine. Neither the sections nor the keys inside
+# the sections are consistently sorted.
+#
+# If a directory with the same basename ending in .d exists next to the unit file, it will be
+# assumed to contain override files which will be parsed as well and handled properly.
+sub parseUnit {
+    my ($unitPath) = @_;
+
+    # Parse the main unit and all overrides
+    my %unitData;
+    parseSystemdIni(\%unitData, $_) for glob("${unitPath}{,.d/*.conf}");
+    return %unitData;
 }
 
-sub boolIsTrue {
-    my ($s) = @_;
-    return $s eq "yes" || $s eq "true";
+# Checks whether a specified boolean in a systemd unit is true
+# or false, with a default that is applied when the value is not set.
+sub parseSystemdBool {
+    my ($unitConfig, $sectionName, $boolName, $default) = @_;
+
+    my @values = @{$unitConfig->{$sectionName}{$boolName} // []};
+    # Return default if value is not set
+    if (scalar @values lt 1 || not defined $values[-1]) {
+        return $default;
+    }
+    # If value is defined multiple times, use the last definition
+    my $last = $values[-1];
+    # These are valid values as of systemd.syntax(7)
+    return $last eq "1" || $last eq "yes" || $last eq "true" || $last eq "on";
 }
 
 sub recordUnit {
@@ -167,17 +219,17 @@ sub handleModifiedUnit {
         # Revert of the attempt: https://github.com/NixOS/nixpkgs/pull/147609
         # More details: https://github.com/NixOS/nixpkgs/issues/74899#issuecomment-981142430
     } else {
-        my $unitInfo = parseUnit($newUnitFile);
-        if (boolIsTrue($unitInfo->{'X-ReloadIfChanged'} // "no")) {
+        my %unitInfo = parseUnit($newUnitFile);
+        if (parseSystemdBool(\%unitInfo, "Service", "X-ReloadIfChanged", 0)) {
             $unitsToReload->{$unit} = 1;
             recordUnit($reloadListFile, $unit);
         }
-        elsif (!boolIsTrue($unitInfo->{'X-RestartIfChanged'} // "yes") || boolIsTrue($unitInfo->{'RefuseManualStop'} // "no") || boolIsTrue($unitInfo->{'X-OnlyManualStart'} // "no")) {
+        elsif (!parseSystemdBool(\%unitInfo, "Service", "X-RestartIfChanged", 1) || parseSystemdBool(\%unitInfo, "Unit", "RefuseManualStop", 0) || parseSystemdBool(\%unitInfo, "Unit", "X-OnlyManualStart", 0)) {
             $unitsToSkip->{$unit} = 1;
         } else {
             # It doesn't make sense to stop and start non-services because
             # they can't have ExecStop=
-            if (!boolIsTrue($unitInfo->{'X-StopIfChanged'} // "yes") || $unit !~ /\.service$/) {
+            if (!parseSystemdBool(\%unitInfo, "Service", "X-StopIfChanged", 1) || $unit !~ /\.service$/) {
                 # This unit should be restarted instead of
                 # stopped and started.
                 $unitsToRestart->{$unit} = 1;
@@ -188,7 +240,7 @@ sub handleModifiedUnit {
                 # socket(s) instead of the service.
                 my $socketActivated = 0;
                 if ($unit =~ /\.service$/) {
-                    my @sockets = split / /, ($unitInfo->{Sockets} // "");
+                    my @sockets = split(/ /, join(" ", @{$unitInfo{Service}{Sockets} // []}));
                     if (scalar @sockets == 0) {
                         @sockets = ("$baseName.socket");
                     }
@@ -254,12 +306,12 @@ while (my ($unit, $state) = each %{$activePrev}) {
 
     if (-e $prevUnitFile && ($state->{state} eq "active" || $state->{state} eq "activating")) {
         if (! -e $newUnitFile || abs_path($newUnitFile) eq "/dev/null") {
-            my $unitInfo = parseUnit($prevUnitFile);
-            $unitsToStop{$unit} = 1 if boolIsTrue($unitInfo->{'X-StopOnRemoval'} // "yes");
+            my %unitInfo = parseUnit($prevUnitFile);
+            $unitsToStop{$unit} = 1 if parseSystemdBool(\%unitInfo, "Unit", "X-StopOnRemoval", 1);
         }
 
         elsif ($unit =~ /\.target$/) {
-            my $unitInfo = parseUnit($newUnitFile);
+            my %unitInfo = parseUnit($newUnitFile);
 
             # Cause all active target units to be restarted below.
             # This should start most changed units we stop here as
@@ -268,7 +320,7 @@ while (my ($unit, $state) = each %{$activePrev}) {
             # active after the system has resumed, which probably
             # should not be the case.  Just ignore it.
             if ($unit ne "suspend.target" && $unit ne "hibernate.target" && $unit ne "hybrid-sleep.target") {
-                unless (boolIsTrue($unitInfo->{'RefuseManualStart'} // "no") || boolIsTrue($unitInfo->{'X-OnlyManualStart'} // "no")) {
+                unless (parseSystemdBool(\%unitInfo, "Unit", "RefuseManualStart", 0) || parseSystemdBool(\%unitInfo, "Unit", "X-OnlyManualStart", 0)) {
                     $unitsToStart{$unit} = 1;
                     recordUnit($startListFile, $unit);
                     # Don't spam the user with target units that always get started.
@@ -287,7 +339,7 @@ while (my ($unit, $state) = each %{$activePrev}) {
             # Stopping a target generally has no effect on other units
             # (unless there is a PartOf dependency), so this is just a
             # bookkeeping thing to get systemd to do the right thing.
-            if (boolIsTrue($unitInfo->{'X-StopOnReconfiguration'} // "no")) {
+            if (parseSystemdBool(\%unitInfo, "Unit", "X-StopOnReconfiguration", 0)) {
                 $unitsToStop{$unit} = 1;
             }
         }
@@ -546,33 +598,36 @@ my $activeNew = getActiveUnits;
 while (my ($unit, $state) = each %{$activeNew}) {
     if ($state->{state} eq "failed") {
         push @failed, $unit;
+        next;
     }
-    elsif ($state->{state} eq "auto-restart") {
-        # A unit in auto-restart state is a failure *if* it previously failed to start
-        my $lines = `@systemd@/bin/systemctl show '$unit'`;
-        my $info = {};
-        parseKeyValues($info, split("\n", $lines));
 
-        if ($info->{ExecMainStatus} ne '0') {
+    if ($state->{substate} eq "auto-restart") {
+        # A unit in auto-restart substate is a failure *if* it previously failed to start
+        my $main_status = `@systemd@/bin/systemctl show --value --property=ExecMainStatus '$unit'`;
+        chomp($main_status);
+
+        if ($main_status ne "0") {
             push @failed, $unit;
+            next;
         }
     }
+
     # Ignore scopes since they are not managed by this script but rather
     # created and managed by third-party services via the systemd dbus API.
-    elsif ($state->{state} ne "failed" && !defined $activePrev->{$unit} && $unit !~ /\.scope$/) {
+    # This only lists units that are not failed (including ones that are in auto-restart but have not failed previously)
+    if ($state->{state} ne "failed" && !defined $activePrev->{$unit} && $unit !~ /\.scope$/msx) {
         push @new, $unit;
     }
 }
 
-print STDERR "the following new units were started: ", join(", ", sort(@new)), "\n"
-    if scalar @new > 0;
+if (scalar @new > 0) {
+    print STDERR "the following new units were started: ", join(", ", sort(@new)), "\n"
+}
 
 if (scalar @failed > 0) {
-    print STDERR "warning: the following units failed: ", join(", ", sort(@failed)), "\n";
-    foreach my $unit (@failed) {
-        print STDERR "\n";
-        system("COLUMNS=1000 @systemd@/bin/systemctl status --no-pager '$unit' >&2");
-    }
+    my @failed_sorted = sort @failed;
+    print STDERR "warning: the following units failed: ", join(", ", @failed_sorted), "\n\n";
+    system "@systemd@/bin/systemctl status --no-pager --full '" . join("' '", @failed_sorted) . "' >&2";
     $res = 4;
 }
 
diff --git a/nixos/modules/system/activation/top-level.nix b/nixos/modules/system/activation/top-level.nix
index 18ac717f5dd6..9e6ca75b9da4 100644
--- a/nixos/modules/system/activation/top-level.nix
+++ b/nixos/modules/system/activation/top-level.nix
@@ -117,7 +117,7 @@ let
     configurationName = config.boot.loader.grub.configurationName;
 
     # Needed by switch-to-configuration.
-    perl = pkgs.perl.withPackages (p: with p; [ FileSlurp NetDBus XMLParser XMLTwig ]);
+    perl = pkgs.perl.withPackages (p: with p; [ FileSlurp NetDBus XMLParser XMLTwig ConfigIniFiles ]);
   };
 
   # Handle assertions and warnings
@@ -156,7 +156,7 @@ in
 
     specialisation = mkOption {
       default = {};
-      example = lib.literalExpression "{ fewJobsManyCores.configuration = { nix.buildCores = 0; nix.maxJobs = 1; }; }";
+      example = lib.literalExpression "{ fewJobsManyCores.configuration = { nix.settings = { core = 0; max-jobs = 1; }; }";
       description = ''
         Additional configurations to build. If
         <literal>inheritParentConfig</literal> is true, the system
diff --git a/nixos/modules/system/boot/binfmt.nix b/nixos/modules/system/boot/binfmt.nix
index 5bc603530f7e..33748358e45b 100644
--- a/nixos/modules/system/boot/binfmt.nix
+++ b/nixos/modules/system/boot/binfmt.nix
@@ -300,18 +300,15 @@ in {
         interpreterSandboxPath = dirOf (dirOf interpreterReg);
       } // (magics.${system} or (throw "Cannot create binfmt registration for system ${system}"));
     }) cfg.emulatedSystems);
-    # TODO: add a nix.extraPlatforms option to NixOS!
-    nix.extraOptions = lib.mkIf (cfg.emulatedSystems != []) ''
-      extra-platforms = ${toString (cfg.emulatedSystems ++ lib.optional pkgs.stdenv.hostPlatform.isx86_64 "i686-linux")}
-    '';
-    nix.sandboxPaths = lib.mkIf (cfg.emulatedSystems != []) (
-      let
+    nix.settings = lib.mkIf (cfg.emulatedSystems != []) {
+      extra-platforms = cfg.emulatedSystems ++ lib.optional pkgs.stdenv.hostPlatform.isx86_64 "i686-linux";
+      extra-sandbox-paths = let
         ruleFor = system: cfg.registrations.${system};
         hasWrappedRule = lib.any (system: (ruleFor system).wrapInterpreterInShell) cfg.emulatedSystems;
       in [ "/run/binfmt" ]
         ++ lib.optional hasWrappedRule "${pkgs.bash}"
-        ++ (map (system: (ruleFor system).interpreterSandboxPath) cfg.emulatedSystems)
-      );
+        ++ (map (system: (ruleFor system).interpreterSandboxPath) cfg.emulatedSystems);
+    };
 
     environment.etc."binfmt.d/nixos.conf".source = builtins.toFile "binfmt_nixos.conf"
       (lib.concatStringsSep "\n" (lib.mapAttrsToList makeBinfmtLine config.boot.binfmt.registrations));
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 62bc8acef606..740405493a43 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -558,6 +558,7 @@ in
   xrdp = handleTest ./xrdp.nix {};
   xss-lock = handleTest ./xss-lock.nix {};
   xterm = handleTest ./xterm.nix {};
+  xxh = handleTest ./xxh.nix {};
   yabar = handleTest ./yabar.nix {};
   yggdrasil = handleTest ./yggdrasil.nix {};
   zfs = handleTest ./zfs.nix {};
diff --git a/nixos/tests/containers-imperative.nix b/nixos/tests/containers-imperative.nix
index a126a5480c03..14001657bee0 100644
--- a/nixos/tests/containers-imperative.nix
+++ b/nixos/tests/containers-imperative.nix
@@ -10,8 +10,8 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
 
       # XXX: Sandbox setup fails while trying to hardlink files from the host's
       #      store file system into the prepared chroot directory.
-      nix.useSandbox = false;
-      nix.binaryCaches = []; # don't try to access cache.nixos.org
+      nix.settings.sandbox = false;
+      nix.settings.substituters = []; # don't try to access cache.nixos.org
 
       virtualisation.writableStore = true;
       # Make sure we always have all the required dependencies for creating a
diff --git a/nixos/tests/hardened.nix b/nixos/tests/hardened.nix
index da7e0972e131..dc455f971f5c 100644
--- a/nixos/tests/hardened.nix
+++ b/nixos/tests/hardened.nix
@@ -11,7 +11,7 @@ import ./make-test-python.nix ({ pkgs, ... } : {
       users.users.sybil = { isNormalUser = true; group = "wheel"; };
       imports = [ ../modules/profiles/hardened.nix ];
       environment.memoryAllocator.provider = "graphene-hardened";
-      nix.useSandbox = false;
+      nix.settings.sandbox = false;
       virtualisation.emptyDiskImages = [ 4096 ];
       boot.initrd.postDeviceCommands = ''
         ${pkgs.dosfstools}/bin/mkfs.vfat -n EFISYS /dev/vdb
diff --git a/nixos/tests/hibernate.nix b/nixos/tests/hibernate.nix
index 4f05b99a5a11..3880f1649bd3 100644
--- a/nixos/tests/hibernate.nix
+++ b/nixos/tests/hibernate.nix
@@ -45,11 +45,11 @@ in makeTest {
         ../modules/profiles/base.nix
       ];
 
-      nix.binaryCaches = mkForce [ ];
-      nix.extraOptions = ''
-        hashed-mirrors =
-        connect-timeout = 1
-      '';
+      nix.settings = {
+        substituters = mkForce [];
+        hashed-mirrors = null;
+        connect-timeout = 1;
+      };
 
       virtualisation.diskSize = 8 * 1024;
       virtualisation.emptyDiskImages = [
diff --git a/nixos/tests/hydra/common.nix b/nixos/tests/hydra/common.nix
index 1a3a4d8fb3d4..fdf2b2c6f6dc 100644
--- a/nixos/tests/hydra/common.nix
+++ b/nixos/tests/hydra/common.nix
@@ -42,7 +42,7 @@
         hostName = "localhost";
         systems = [ system ];
       }];
-      binaryCaches = [];
+      settings.substituters = [];
     };
   };
 }
diff --git a/nixos/tests/installed-tests/flatpak.nix b/nixos/tests/installed-tests/flatpak.nix
index 8aeeaca90f61..c7fe9cf45882 100644
--- a/nixos/tests/installed-tests/flatpak.nix
+++ b/nixos/tests/installed-tests/flatpak.nix
@@ -6,6 +6,7 @@ makeInstalledTest {
 
   testConfig = {
     xdg.portal.enable = true;
+    xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
     services.flatpak.enable = true;
     environment.systemPackages = with pkgs; [ gnupg ostree python3 ];
     virtualisation.memorySize = 2047;
diff --git a/nixos/tests/installer.nix b/nixos/tests/installer.nix
index 7c7eb004e550..761020571fa6 100644
--- a/nixos/tests/installer.nix
+++ b/nixos/tests/installer.nix
@@ -334,11 +334,11 @@ let
             (pkgs.grub2_efi.override { inherit zfsSupport; })
           ]);
 
-          nix.binaryCaches = mkForce [ ];
-          nix.extraOptions = ''
-            hashed-mirrors =
-            connect-timeout = 1
-          '';
+          nix.settings = {
+            substituters = mkForce [];
+            hashed-mirrors = null;
+            connect-timeout = 1;
+          };
         };
 
       };
diff --git a/nixos/tests/iscsi-multipath-root.nix b/nixos/tests/iscsi-multipath-root.nix
index a26fea503b62..92ae9990c947 100644
--- a/nixos/tests/iscsi-multipath-root.nix
+++ b/nixos/tests/iscsi-multipath-root.nix
@@ -111,11 +111,11 @@ import ./make-test-python.nix (
 
         environment.etc."initiator-root-disk-closure".source = nodes.initiatorRootDisk.config.system.build.toplevel;
 
-        nix.binaryCaches = lib.mkForce [ ];
-        nix.extraOptions = ''
-          hashed-mirrors =
-          connect-timeout = 1
-        '';
+        nix.settings = {
+          substituters = lib.mkForce [ ];
+          hashed-mirrors = null;
+          connect-timeout = 1;
+        };
       };
 
       initiatorRootDisk = { config, pkgs, modulesPath, lib, ... }: {
diff --git a/nixos/tests/iscsi-root.nix b/nixos/tests/iscsi-root.nix
index bda51d2c2e42..eb0719edc379 100644
--- a/nixos/tests/iscsi-root.nix
+++ b/nixos/tests/iscsi-root.nix
@@ -95,11 +95,11 @@ import ./make-test-python.nix (
 
             system.extraDependencies = [ nodes.initiatorRootDisk.config.system.build.toplevel ];
 
-            nix.binaryCaches = lib.mkForce [];
-            nix.extraOptions = ''
-              hashed-mirrors =
-              connect-timeout = 1
-            '';
+            nix.settings = {
+              substituters = lib.mkForce [];
+              hashed-mirrors = null;
+              connect-timeout = 1;
+            };
           };
 
           initiatorRootDisk = { config, pkgs, modulesPath, lib, ... }: {
diff --git a/nixos/tests/nixops/default.nix b/nixos/tests/nixops/default.nix
index ec3d028aabae..b25fc95f4b30 100644
--- a/nixos/tests/nixops/default.nix
+++ b/nixos/tests/nixops/default.nix
@@ -23,7 +23,7 @@ let
       deployer = { config, lib, nodes, pkgs, ... }: {
         imports = [ ../../modules/installer/cd-dvd/channel.nix ];
         environment.systemPackages = [ nixopsPkg ];
-        nix.binaryCaches = lib.mkForce [ ];
+        nix.settings.substituters = lib.mkForce [ ];
         users.users.person.isNormalUser = true;
         virtualisation.writableStore = true;
         virtualisation.additionalPaths = [
diff --git a/nixos/tests/nixops/legacy/base-configuration.nix b/nixos/tests/nixops/legacy/base-configuration.nix
index dba960f595c2..7f1c07a5c4a9 100644
--- a/nixos/tests/nixops/legacy/base-configuration.nix
+++ b/nixos/tests/nixops/legacy/base-configuration.nix
@@ -16,7 +16,7 @@ in
     (modulesPath + "/testing/test-instrumentation.nix")
   ];
   virtualisation.writableStore = true;
-  nix.binaryCaches = lib.mkForce [ ];
+  nix.settings.substituters = lib.mkForce [ ];
   virtualisation.graphics = false;
   documentation.enable = false;
   services.qemuGuest.enable = true;
diff --git a/nixos/tests/os-prober.nix b/nixos/tests/os-prober.nix
index c1e29b0f68b4..90375450fe1b 100644
--- a/nixos/tests/os-prober.nix
+++ b/nixos/tests/os-prober.nix
@@ -43,11 +43,11 @@ let
       # vda is a filesystem without partition table
       forceInstall = true;
     };
-    nix.binaryCaches = lib.mkForce [ ];
-    nix.extraOptions = ''
-      hashed-mirrors =
-      connect-timeout = 1
-    '';
+    nix.settings = {
+      substituters = lib.mkForce [];
+      hashed-mirrors = null;
+      connect-timeout = 1;
+    };
     # save some memory
     documentation.enable = false;
   };
diff --git a/nixos/tests/switch-test.nix b/nixos/tests/switch-test.nix
index 1c32bf6beb95..8e425f0f8779 100644
--- a/nixos/tests/switch-test.nix
+++ b/nixos/tests/switch-test.nix
@@ -45,6 +45,31 @@ import ./make-test-python.nix ({ pkgs, ...} : {
           systemd.services.test.restartIfChanged = false;
         };
 
+        simpleServiceFailing.configuration = {
+          imports = [ simpleServiceModified.configuration ];
+          systemd.services.test.serviceConfig.ExecStart = lib.mkForce "${pkgs.coreutils}/bin/false";
+        };
+
+        autorestartService.configuration = {
+          # A service that immediately goes into restarting (but without failing)
+          systemd.services.autorestart = {
+            wantedBy = [ "multi-user.target" ];
+            serviceConfig = {
+              Type = "simple";
+              Restart = "always";
+              RestartSec = "20y"; # Should be long enough
+              ExecStart = "${pkgs.coreutils}/bin/true";
+            };
+          };
+        };
+
+        autorestartServiceFailing.configuration = {
+          imports = [ autorestartService.configuration ];
+          systemd.services.autorestart.serviceConfig = {
+            ExecStart = lib.mkForce "${pkgs.coreutils}/bin/false";
+          };
+        };
+
         restart-and-reload-by-activation-script.configuration = {
           systemd.services = rec {
             simple-service = {
@@ -189,12 +214,13 @@ import ./make-test-python.nix ({ pkgs, ...} : {
       exec env -i "$@" | tee /dev/stderr
     '';
   in /* python */ ''
-    def switch_to_specialisation(system, name, action="test"):
+    def switch_to_specialisation(system, name, action="test", fail=False):
         if name == "":
             stc = f"{system}/bin/switch-to-configuration"
         else:
             stc = f"{system}/specialisation/{name}/bin/switch-to-configuration"
-        out = machine.succeed(f"{stc} {action} 2>&1")
+        out = machine.fail(f"{stc} {action} 2>&1") if fail \
+            else machine.succeed(f"{stc} {action} 2>&1")
         assert_lacks(out, "switch-to-configuration line")  # Perl warnings
         return out
 
@@ -305,7 +331,56 @@ import ./make-test-python.nix ({ pkgs, ...} : {
         assert_lacks(out, "as well:")
         assert_contains(out, "would start the following units: test.service\n")
 
+    with subtest("failing units"):
+        # Let the simple service fail
+        switch_to_specialisation("${machine}", "simpleServiceModified")
+        out = switch_to_specialisation("${machine}", "simpleServiceFailing", fail=True)
+        assert_contains(out, "stopping the following units: test.service\n")
+        assert_lacks(out, "NOT restarting the following changed units:")
+        assert_lacks(out, "reloading the following units:")
+        assert_lacks(out, "\nrestarting the following units:")
+        assert_contains(out, "\nstarting the following units: test.service\n")
+        assert_lacks(out, "the following new units were started:")
+        assert_contains(out, "warning: the following units failed: test.service\n")
+        assert_contains(out, "Main PID:")  # output of systemctl
+        assert_lacks(out, "as well:")
+
+        # A unit that gets into autorestart without failing is not treated as failed
+        out = switch_to_specialisation("${machine}", "autorestartService")
+        assert_lacks(out, "stopping the following units:")
+        assert_lacks(out, "NOT restarting the following changed units:")
+        assert_lacks(out, "reloading the following units:")
+        assert_lacks(out, "\nrestarting the following units:")
+        assert_lacks(out, "\nstarting the following units:")
+        assert_contains(out, "the following new units were started: autorestart.service\n")
+        assert_lacks(out, "as well:")
+        machine.systemctl('stop autorestart.service')  # cancel the 20y timer
+
+        # Switching to the same system should do nothing (especially not treat the unit as failed)
+        out = switch_to_specialisation("${machine}", "autorestartService")
+        assert_lacks(out, "stopping the following units:")
+        assert_lacks(out, "NOT restarting the following changed units:")
+        assert_lacks(out, "reloading the following units:")
+        assert_lacks(out, "\nrestarting the following units:")
+        assert_lacks(out, "\nstarting the following units:")
+        assert_contains(out, "the following new units were started: autorestart.service\n")
+        assert_lacks(out, "as well:")
+        machine.systemctl('stop autorestart.service')  # cancel the 20y timer
+
+        # If systemd thinks the unit has failed and is in autorestart, we should show it as failed
+        out = switch_to_specialisation("${machine}", "autorestartServiceFailing", fail=True)
+        assert_lacks(out, "stopping the following units:")
+        assert_lacks(out, "NOT restarting the following changed units:")
+        assert_lacks(out, "reloading the following units:")
+        assert_lacks(out, "\nrestarting the following units:")
+        assert_lacks(out, "\nstarting the following units:")
+        assert_lacks(out, "the following new units were started:")
+        assert_contains(out, "warning: the following units failed: autorestart.service\n")
+        assert_contains(out, "Main PID:")  # output of systemctl
+        assert_lacks(out, "as well:")
+
     with subtest("restart and reload by activation script"):
+        switch_to_specialisation("${machine}", "simpleServiceNorestart")
         out = switch_to_specialisation("${machine}", "restart-and-reload-by-activation-script")
         assert_contains(out, "stopping the following units: test.service\n")
         assert_lacks(out, "NOT restarting the following changed units:")
diff --git a/nixos/tests/vscodium.nix b/nixos/tests/vscodium.nix
index 66baea73ec62..688ddfe07e3e 100644
--- a/nixos/tests/vscodium.nix
+++ b/nixos/tests/vscodium.nix
@@ -3,11 +3,10 @@ let
     wayland = { pkgs, ... }: {
       imports = [ ./common/wayland-cage.nix ];
 
-      services.cage.program = ''
-        ${pkgs.vscodium}/bin/codium \
-          --enable-features=UseOzonePlatform \
-          --ozone-platform=wayland
-      '';
+      services.cage.program = "${pkgs.vscodium}/bin/codium";
+
+      environment.variables.NIXOS_OZONE_WL = "1";
+      environment.variables.DISPLAY = "do not use";
 
       fonts.fonts = with pkgs; [ dejavu_fonts ];
     };
diff --git a/nixos/tests/xxh.nix b/nixos/tests/xxh.nix
new file mode 100644
index 000000000000..3af8e53779e3
--- /dev/null
+++ b/nixos/tests/xxh.nix
@@ -0,0 +1,67 @@
+import ./make-test-python.nix ({ pkgs, lib, ... }:
+
+  let
+    inherit (import ./ssh-keys.nix pkgs) snakeOilPrivateKey snakeOilPublicKey;
+    xxh-shell-zsh = pkgs.stdenv.mkDerivation {
+      pname = "xxh-shell-zsh";
+      version = "";
+      src = pkgs.fetchFromGitHub {
+        owner = "xxh";
+        repo = "xxh-shell-zsh";
+        # gets rarely updated, we can then just replace the hash
+        rev = "91e1f84f8d6e0852c3235d4813f341230cac439f";
+        sha256 = "sha256-Y1FrIRxTd0yooK+ZzKcCd6bLSy5E2fRXYAzrIsm7rIc=";
+      };
+
+      postPatch = ''
+        substituteInPlace build.sh \
+          --replace "echo Install wget or curl" "cp ${zsh-portable-binary} zsh-5.8-linux-x86_64.tar.gz" \
+          --replace "command -v curl" "command -v this-should-not-trigger"
+      '';
+
+      installPhase = ''
+        mkdir -p $out
+        mv * $out/
+      '';
+    };
+
+    zsh-portable-binary = pkgs.fetchurl {
+      # kept in sync with https://github.com/xxh/xxh-shell-zsh/tree/master/build.sh#L27
+      url = "https://github.com/romkatv/zsh-bin/releases/download/v3.0.1/zsh-5.8-linux-x86_64.tar.gz";
+      sha256 = "sha256-i8flMd2Isc0uLoeYQNDnOGb/kK3oTFVqQgIx7aOAIIo=";
+    };
+  in
+  {
+    name = "xxh";
+    meta = with lib.maintainers; {
+      maintainers = [ lom ];
+    };
+
+    nodes = {
+      server = { ... }: {
+        services.openssh.enable = true;
+        users.users.root.openssh.authorizedKeys.keys = [ snakeOilPublicKey ];
+      };
+
+      client = { ... }: {
+        programs.zsh.enable = true;
+        users.users.root.shell = pkgs.zsh;
+        environment.systemPackages = with pkgs; [ xxh git ];
+      };
+    };
+
+    testScript = ''
+      start_all()
+
+      client.succeed("mkdir -m 700 /root/.ssh")
+
+      client.succeed(
+         "cat ${snakeOilPrivateKey} > /root/.ssh/id_ecdsa"
+      )
+      client.succeed("chmod 600 /root/.ssh/id_ecdsa")
+
+      server.wait_for_unit("sshd")
+
+      client.succeed("xxh server -i /root/.ssh/id_ecdsa +hc \'echo $0\' +i +s zsh +I xxh-shell-zsh+path+${xxh-shell-zsh} | grep -Fq '/root/.xxh/.xxh/shells/xxh-shell-zsh/build/zsh-bin/bin/zsh'")
+    '';
+  })
diff --git a/pkgs/applications/audio/ptcollab/default.nix b/pkgs/applications/audio/ptcollab/default.nix
index 16ef4ed6e45e..279105605d34 100644
--- a/pkgs/applications/audio/ptcollab/default.nix
+++ b/pkgs/applications/audio/ptcollab/default.nix
@@ -13,13 +13,13 @@
 
 mkDerivation rec {
   pname = "ptcollab";
-  version = "0.5.0.3";
+  version = "0.6.0.2";
 
   src = fetchFromGitHub {
     owner = "yuxshao";
     repo = "ptcollab";
     rev = "v${version}";
-    sha256 = "sha256-8bgi621psvUlhiLyZ15tKGmGOs6HTf5/6Ru2Z9l8QIo=";
+    sha256 = "sha256-9goELqV7GP2/8w3Tw4Gph0UBgR/2T+wo2g+lhrQG4tA=";
   };
 
   nativeBuildInputs = [ qmake pkg-config ];
diff --git a/pkgs/applications/audio/spot/default.nix b/pkgs/applications/audio/spot/default.nix
index e91cc9cc0207..3fe3b0d06d31 100644
--- a/pkgs/applications/audio/spot/default.nix
+++ b/pkgs/applications/audio/spot/default.nix
@@ -21,19 +21,19 @@
 
 stdenv.mkDerivation rec {
   pname = "spot";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "xou816";
     repo = "spot";
     rev = version;
-    hash = "sha256-An9PJsuXZkvJhP67cisWxFd2dpky53EY/xcR6StgWFY=";
+    hash = "sha256-uZzylK9imEazwC/ogsDO8ZBvByE5/SNSV+mIlp7Z9Ww=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-2qMmPIBoZS6WT06VzCmnYWaIfLzWN2HUvk7y9GKuuXg=";
+    hash = "sha256-v5xdlsI6OlEpCYOTFePTyI8BkIrAwT6FR2JwiRTGgOA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/backup/vorta/default.nix b/pkgs/applications/backup/vorta/default.nix
index 7434c12cba29..271efc0283d7 100644
--- a/pkgs/applications/backup/vorta/default.nix
+++ b/pkgs/applications/backup/vorta/default.nix
@@ -8,13 +8,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "vorta";
-  version = "0.8.2";
+  version = "0.8.3";
 
   src = fetchFromGitHub {
     owner = "borgbase";
     repo = "vorta";
     rev = "v${version}";
-    sha256 = "sha256-ut4HCfLU/P22y5QbNakTV4d4CnFRxJvn+cnJ0ZGpTlw=";
+    sha256 = "06sb24pimq9ckdkp9hzp4r9d3i21kxacsx5b7x9q99qcwf7h6372";
   };
 
   nativeBuildInputs = [ wrapQtAppsHook ];
diff --git a/pkgs/applications/editors/vscode/generic.nix b/pkgs/applications/editors/vscode/generic.nix
index f2c262ece95d..72c753745168 100644
--- a/pkgs/applications/editors/vscode/generic.nix
+++ b/pkgs/applications/editors/vscode/generic.nix
@@ -108,6 +108,7 @@ let
       gappsWrapperArgs+=(
         # Add gio to PATH so that moving files to the trash works when not using a desktop environment
         --prefix PATH : ${glib.bin}/bin
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform --ozone-platform=wayland}}"
       )
     '';
 
diff --git a/pkgs/applications/gis/grass/default.nix b/pkgs/applications/gis/grass/default.nix
index 16e6a818e5ae..5ca31cc04052 100644
--- a/pkgs/applications/gis/grass/default.nix
+++ b/pkgs/applications/gis/grass/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, flex, bison, pkg-config, zlib, libtiff, libpng, fftw
-, cairo, readline, ffmpeg, makeWrapper, wxGTK30, netcdf, blas
+, cairo, readline, ffmpeg, makeWrapper, wxGTK30, wxmac, netcdf, blas
 , proj, gdal, geos, sqlite, postgresql, libmysqlclient, python3Packages, libLAS, proj-datumgrid
 , zstd, pdal, wrapGAppsHook
 }:
@@ -16,10 +16,14 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ flex bison zlib proj gdal libtiff libpng fftw sqlite cairo
-  readline ffmpeg makeWrapper wxGTK30 netcdf geos postgresql libmysqlclient blas
-  libLAS proj-datumgrid zstd pdal wrapGAppsHook ]
-    ++ (with python3Packages; [ python python-dateutil wxPython_4_1 numpy ]);
+  buildInputs = [ flex bison zlib proj gdal libtiff libpng fftw sqlite
+  readline ffmpeg makeWrapper netcdf geos postgresql libmysqlclient blas
+  libLAS proj-datumgrid zstd wrapGAppsHook ]
+    ++ lib.optionals stdenv.isLinux [ cairo pdal wxGTK30 ]
+    ++ lib.optional stdenv.isDarwin wxmac
+    ++ (with python3Packages; [ python python-dateutil numpy ]
+      ++ lib.optional stdenv.isDarwin wxPython_4_0
+      ++ lib.optional stdenv.isLinux wxPython_4_1);
 
   # On Darwin the installer tries to symlink the help files into a system
   # directory
@@ -33,12 +37,11 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--with-proj-share=${proj}/share/proj"
     "--with-proj-includes=${proj.dev}/include"
-    "--with-proj-lib=${proj}/lib"
+    "--with-proj-libs=${proj}/lib"
     "--without-opengl"
     "--with-readline"
     "--with-wxwidgets"
     "--with-netcdf"
-    "--with-pdal"
     "--with-geos"
     "--with-postgres"
     "--with-postgres-libs=${postgresql.lib}/lib/"
@@ -51,6 +54,12 @@ stdenv.mkDerivation rec {
     "--with-zstd"
     "--with-fftw"
     "--with-pthread"
+  ] ++ lib.optionals stdenv.isLinux [
+    "--with-pdal"
+  ] ++ lib.optionals stdenv.isDarwin [
+    "--without-cairo"
+    "--without-freetype"
+    "--without-x"
   ];
 
   # Otherwise a very confusing "Can't load GDAL library" error
diff --git a/pkgs/applications/graphics/ImageMagick/7.0.nix b/pkgs/applications/graphics/ImageMagick/7.0.nix
index 3b215ea24fc7..76490682477a 100644
--- a/pkgs/applications/graphics/ImageMagick/7.0.nix
+++ b/pkgs/applications/graphics/ImageMagick/7.0.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, libtool
+{ lib, stdenv, fetchFromGitHub, fetchpatch, pkg-config, libtool
 , bzip2, zlib, libX11, libXext, libXt, fontconfig, freetype, ghostscript, libjpeg, djvulibre
 , lcms2, openexr, libjxl, libpng, liblqr1, libraw, librsvg, libtiff, libxml2, openjpeg, libwebp, libheif
 , ApplicationServices
@@ -27,6 +27,14 @@ stdenv.mkDerivation rec {
     sha256 = "0r8zmk2cfmf09l94hqzfz4aspnzn178ggdbgm7w4hr0p864cbvc3";
   };
 
+  patches = [
+    # fix a type confusion bug introduced in 7.1.0-20 with commit 075565e93c71bcaaabf0ce70b7d1060bccdf0020
+    (fetchpatch {
+      url = "https://github.com/ImageMagick/ImageMagick/commit/62845d5672eca4446b952dd0ab2e3e0dab0309d4.patch";
+      sha256 = "1kni5i8b5hl69niypidm90mhir8cafi6r9i857fxdlv045h3dg4p";
+    })
+  ];
+
   outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big
   outputMan = "out"; # it's tiny
 
diff --git a/pkgs/applications/graphics/darktable/default.nix b/pkgs/applications/graphics/darktable/default.nix
index d62addea4fea..7feeb08105d5 100644
--- a/pkgs/applications/graphics/darktable/default.nix
+++ b/pkgs/applications/graphics/darktable/default.nix
@@ -52,8 +52,7 @@
 , libaom
 , portmidi
 , fetchpatch
-, lua5_4
-, ...
+, lua
 }:
 
 stdenv.mkDerivation rec {
@@ -104,7 +103,7 @@ stdenv.mkDerivation rec {
     libheif
     libaom
     portmidi
-    lua5_4
+    lua
   ] ++ lib.optionals stdenv.isLinux [
     colord
     colord-gtk
diff --git a/pkgs/applications/graphics/hydrus/default.nix b/pkgs/applications/graphics/hydrus/default.nix
index 08293f748de7..7efd1192642a 100644
--- a/pkgs/applications/graphics/hydrus/default.nix
+++ b/pkgs/applications/graphics/hydrus/default.nix
@@ -10,14 +10,14 @@
 
 python3Packages.buildPythonPackage rec {
   pname = "hydrus";
-  version = "470b";
+  version = "471";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "hydrusnetwork";
     repo = "hydrus";
     rev = "v${version}";
-    sha256 = "0v52krjcqykrm3zqj6idzvbpjv4fhbgvq2jr8k0g63f7db7p08h9";
+    sha256 = "sha256-KRAPnYjDWXZ56OctGvEticQs5wSMFS27kGdpxj0mk0g=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/graphics/inkscape/default.nix b/pkgs/applications/graphics/inkscape/default.nix
index 24f3a555fd5a..271173a8b027 100644
--- a/pkgs/applications/graphics/inkscape/default.nix
+++ b/pkgs/applications/graphics/inkscape/default.nix
@@ -81,6 +81,14 @@ stdenv.mkDerivation rec {
       stripLen = 1;
       extraPrefix = "share/extensions/";
     })
+
+    # Fix build with Poppler 21.11.0.
+    # https://gitlab.com/inkscape/inkscape/-/merge_requests/3622
+    (fetchpatch {
+      url = "https://gitlab.com/inkscape/inkscape/-/commit/5724c21b9cb7b6176a7b36ca24068b148c817e82.patch";
+      sha256 = "/1p/Vkes1HuZN0v09Ey4kiT+4zrEaoSXyPAmc4O3sDg=";
+    })
+
     # Remove mandatory break from end of paragraphs, added in Pango 1.49
     # https://gitlab.com/inkscape/inkscape/-/merge_requests/3630
     # TODO: Remove in Inkscape 1.1.2
diff --git a/pkgs/applications/graphics/qiv/default.upstream b/pkgs/applications/graphics/qiv/default.upstream
deleted file mode 100644
index e6c7ef2408e8..000000000000
--- a/pkgs/applications/graphics/qiv/default.upstream
+++ /dev/null
@@ -1,3 +0,0 @@
-url http://spiegl.de/qiv/download/
-version_link '[.]tgz$'
-do_overwrite() { do_overwrite_just_version; }
diff --git a/pkgs/applications/graphics/tev/default.nix b/pkgs/applications/graphics/tev/default.nix
index b82c3ff96288..ffa76a6c07ab 100644
--- a/pkgs/applications/graphics/tev/default.nix
+++ b/pkgs/applications/graphics/tev/default.nix
@@ -5,14 +5,14 @@
 
 stdenv.mkDerivation rec {
   pname = "tev";
-  version = "1.19";
+  version = "1.22";
 
   src = fetchFromGitHub {
     owner = "Tom94";
     repo = pname;
     rev = "v${version}";
     fetchSubmodules = true;
-    sha256 = "sha256-laP47xOND6PMA6dwTcCupcTIW+9zCaxO6rHzvDSL9JU=";
+    sha256 = "sha256-WLDQaN6wHnadvp0JyUzlcZVNiSbFudmmBSNYRMaE6U4=";
   };
 
   nativeBuildInputs = [ cmake wrapGAppsHook ];
@@ -53,6 +53,7 @@ stdenv.mkDerivation rec {
     changelog = "https://github.com/Tom94/tev/releases/tag/v${version}";
     license = licenses.bsd3;
     platforms = platforms.unix;
+    badPlatforms = [ "aarch64-linux" ]; # fails on Hydra since forever
     maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/applications/misc/auto-multiple-choice/default.nix b/pkgs/applications/misc/auto-multiple-choice/default.nix
index 174d6e22ccb3..d8db5441df5e 100644
--- a/pkgs/applications/misc/auto-multiple-choice/default.nix
+++ b/pkgs/applications/misc/auto-multiple-choice/default.nix
@@ -65,7 +65,7 @@ stdenv.mkDerivation rec {
   postFixup = ''
     wrapProgram $out/bin/auto-multiple-choice \
     ''${makeWrapperArgs[@]} \
-    --prefix PERL5LIB : "${with perlPackages; makePerlPath [
+    --prefix PERL5LIB : "${with perlPackages; makeFullPerlPath [
       ArchiveZip
       DBDSQLite
       Cairo
@@ -75,6 +75,7 @@ stdenv.mkDerivation rec {
       GlibObjectIntrospection
       Gtk3
       LocaleGettext
+      OpenOfficeOODoc
       PerlMagick
       TextCSV
       XMLParser
diff --git a/pkgs/applications/misc/gallery-dl/default.nix b/pkgs/applications/misc/gallery-dl/default.nix
index 26c76988169e..8f5eaf47b550 100644
--- a/pkgs/applications/misc/gallery-dl/default.nix
+++ b/pkgs/applications/misc/gallery-dl/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonApplication rec {
   pname = "gallery_dl";
-  version = "1.20.1";
+  version = "1.20.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a1c06625381485f82aa14a038a622d40ab9cc2c8d150dd65c66df96dbf427f62";
+    sha256 = "6d1d97bd08a2a0dcfb0578e759fb83c4902b395405b3e3238673f684973b0556";
   };
 
   propagatedBuildInputs = [ requests yt-dlp ];
diff --git a/pkgs/applications/misc/mupdf/default.upstream b/pkgs/applications/misc/mupdf/default.upstream
deleted file mode 100644
index 852233633ca5..000000000000
--- a/pkgs/applications/misc/mupdf/default.upstream
+++ /dev/null
@@ -1,7 +0,0 @@
-url https://mupdf.com/downloads/archive/
-do_overwrite(){
-  ensure_hash
-  ensure_version
-  set_var_value version $CURRENT_VERSION
-  set_var_value sha256 $CURRENT_HASH
-}
diff --git a/pkgs/applications/misc/tomboy/default.nix b/pkgs/applications/misc/tomboy/default.nix
deleted file mode 100644
index 5aaec7a1e600..000000000000
--- a/pkgs/applications/misc/tomboy/default.nix
+++ /dev/null
@@ -1,43 +0,0 @@
-{ stdenv, fetchurl, itstool, intltool, pkg-config
-, libxml2, gnome2, atk, gtk2, glib
-, mono, mono-addins, dbus-sharp-2_0, dbus-sharp-glib-2_0, gnome-sharp, gtk-sharp-2_0
-, makeWrapper, lib}:
-
-let
-  version = "1.15.9";
-in
-
-stdenv.mkDerivation {
-  pname = "tomboy";
-  inherit version;
-
-  src = fetchurl {
-    url = "https://github.com/tomboy-notes/tomboy/releases/download/${version}/tomboy-${version}.tar.xz";
-    sha256 = "0j5jmd079bm2fydqaic5ymbfdxna3qlx6fkp2mqhgcdr7prsbl3q";
-  };
-
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ itstool intltool
-    libxml2 gnome2.GConf atk gtk2
-    mono mono-addins dbus-sharp-2_0 dbus-sharp-glib-2_0 gnome-sharp gtk-sharp-2_0
-    makeWrapper ];
-
-  postInstall = ''
-    makeWrapper "${mono}/bin/mono" "$out/bin/tomboy" \
-      --add-flags "$out/lib/tomboy/Tomboy.exe" \
-      --prefix MONO_GAC_PREFIX : ${dbus-sharp-2_0} \
-      --prefix MONO_GAC_PREFIX : ${dbus-sharp-glib-2_0} \
-      --prefix MONO_GAC_PREFIX : ${gtk-sharp-2_0} \
-      --prefix MONO_GAC_PREFIX : ${gnome-sharp} \
-      --prefix MONO_GAC_PREFIX : ${mono-addins} \
-      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ glib gtk-sharp-2_0 gtk-sharp-2_0.gtk gnome2.GConf ]}
-  '';
-
-  meta = with lib; {
-    homepage = "https://wiki.gnome.org/Apps/Tomboy";
-    description = "A simple note-taking application with synchronization";
-    platforms = platforms.linux;
-    license = lib.licenses.lgpl2;
-    maintainers = with maintainers; [ stesie ];
-  };
-}
diff --git a/pkgs/applications/misc/vifm/default.nix b/pkgs/applications/misc/vifm/default.nix
index 2765cd5ad7aa..e3f2e80c47a5 100644
--- a/pkgs/applications/misc/vifm/default.nix
+++ b/pkgs/applications/misc/vifm/default.nix
@@ -38,7 +38,6 @@ in stdenv.mkDerivation rec {
     license = licenses.gpl2;
     downloadPage = "https://vifm.info/downloads.shtml";
     homepage = "https://vifm.info/";
-    updateWalker = true;
     changelog = "https://github.com/vifm/vifm/blob/v${version}/ChangeLog";
   };
 }
diff --git a/pkgs/applications/networking/browsers/chromium/default.nix b/pkgs/applications/networking/browsers/chromium/default.nix
index c4521c89caa6..f296da05c313 100644
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@@ -183,7 +183,8 @@ in stdenv.mkDerivation {
     mkdir -p "$out/bin"
 
     eval makeWrapper "${browserBinary}" "$out/bin/chromium" \
-      --add-flags ${escapeShellArg (escapeShellArg commandLineArgs)}
+      --add-flags ${escapeShellArg (escapeShellArg commandLineArgs)} \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform --ozone-platform=wayland}}"
 
     ed -v -s "$out/bin/chromium" << EOF
     2i
diff --git a/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix b/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
index 5734dfe9f03c..935739b52257 100644
--- a/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
@@ -1,985 +1,985 @@
 {
-  version = "96.0.2";
+  version = "96.0.3";
   sources = [
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/ach/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/ach/firefox-96.0.3.tar.bz2";
       locale = "ach";
       arch = "linux-x86_64";
-      sha256 = "b7120e412b7c111f8d136a93aea6f426770cf58319e7b410a4eddc4698e052aa";
+      sha256 = "aee9a5f570fec2c8c0566f70673a6db1f60a92bb2c165ceb30f434b0dcf1a65b";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/af/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/af/firefox-96.0.3.tar.bz2";
       locale = "af";
       arch = "linux-x86_64";
-      sha256 = "b3068543e15fdf9c0f9cc6bf7407baded25ad4154f1c2034d9a00d91b5a68c11";
+      sha256 = "f929516c277cfb2d45100e677ed9dd200f8b3a09166455f39c2474bad7cc4d74";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/an/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/an/firefox-96.0.3.tar.bz2";
       locale = "an";
       arch = "linux-x86_64";
-      sha256 = "6a74fe71edde4d2c47010dd0fdc7d33471ca31cb29b5a145bcdb30018a5e364c";
+      sha256 = "daee2330478c036da51128c1f32d372b73b5400c8c0f261d50bfd821456042c5";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/ar/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/ar/firefox-96.0.3.tar.bz2";
       locale = "ar";
       arch = "linux-x86_64";
-      sha256 = "be9c0fc67c7f3997e8c9b25dae08b9310c435caf60fc4eba6eef1ac0b2717aa9";
+      sha256 = "51549041ec1cbf2e0caea181f4468f46d15dd1a7b6a620e359f6de533118f8af";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/ast/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/ast/firefox-96.0.3.tar.bz2";
       locale = "ast";
       arch = "linux-x86_64";
-      sha256 = "9a0e4231595413451039d598ac1dcfefa76784741f59b99a904c65b401786a6d";
+      sha256 = "6cbce2293f1982e3e1cc993104a46f3093bec3f420af9ea561eb2601776b9cf6";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/az/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/az/firefox-96.0.3.tar.bz2";
       locale = "az";
       arch = "linux-x86_64";
-      sha256 = "41f3fc81dfdf6b151763a15686f7ee3aab6814b35835502180dc2e2f229feda6";
+      sha256 = "45ba4e47ef4a32d4a8daa7b873a3658de2ebe88532f33af2fead1619939c8294";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/be/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/be/firefox-96.0.3.tar.bz2";
       locale = "be";
       arch = "linux-x86_64";
-      sha256 = "e6b32fa0e50d3c5694e6bad54e86f78d78fcc9c3e2ae83545e6dc1f42044ce30";
+      sha256 = "58666c9b75862076b00144de96bbcdd8b0b3a5bf5bd0895065fb38d3c12a30ac";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/bg/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/bg/firefox-96.0.3.tar.bz2";
       locale = "bg";
       arch = "linux-x86_64";
-      sha256 = "b89cca59abc9566b07ac04796d3955df76dd31a3e99f2b28a8fd91a3197b2fb8";
+      sha256 = "4ff97af116eb450edbb2a4c2d9864da3c0b07c5f6913f198b905779f2be48f98";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/bn/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/bn/firefox-96.0.3.tar.bz2";
       locale = "bn";
       arch = "linux-x86_64";
-      sha256 = "e837daeb90214878ab4bb230955fcb67cbdfe4738ee6b93e41972d6789cb0713";
+      sha256 = "bda665d796fe62524f1d1c96afc4c8da569e9b264895a26aaeb20bab7c2f3030";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/br/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/br/firefox-96.0.3.tar.bz2";
       locale = "br";
       arch = "linux-x86_64";
-      sha256 = "acc80a336e85db0a4648f4cb6a389645647ac3a01920bd301953b6f80faee7fd";
+      sha256 = "2305e226c5e492505dfc82fe34f17c8725eeab2ea10b61b089c92ad7b85a5186";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/bs/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/bs/firefox-96.0.3.tar.bz2";
       locale = "bs";
       arch = "linux-x86_64";
-      sha256 = "8be349dbb749401c23fa5679764372d536486ccc85950fed6d1818eeeb9df9c3";
+      sha256 = "6aeb690c82790a72906ff80d55ae5de2dc7aa5a430c45a0ef2861336a6e73b15";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/ca-valencia/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/ca-valencia/firefox-96.0.3.tar.bz2";
       locale = "ca-valencia";
       arch = "linux-x86_64";
-      sha256 = "246d56a18b93e956299b0d9e4c3bcd37e33b08981cbf949f23999746da81ba2b";
+      sha256 = "86e2a4720b991d6ffd7c9ce996162db9ef9ccd80da96fd5ad184ef006ae8fb1a";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/ca/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/ca/firefox-96.0.3.tar.bz2";
       locale = "ca";
       arch = "linux-x86_64";
-      sha256 = "7e4076f7f4ce566f1900850c04ca314cbd3e2ac0490d1e93e6fc2d405936f66c";
+      sha256 = "0e9675d739eec02c98812e4d707c37d352de7605e9567d9d4adccd0e6ab40e8e";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/cak/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/cak/firefox-96.0.3.tar.bz2";
       locale = "cak";
       arch = "linux-x86_64";
-      sha256 = "e0f3494fbd1c4ec6ba9993b9ef6fe6d5d8659034533afdeed8a539bad20451b6";
+      sha256 = "35d5d2c5eef32819499b4078c7f31f23c848b44c40788ff42ba66d10b3771fda";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/cs/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/cs/firefox-96.0.3.tar.bz2";
       locale = "cs";
       arch = "linux-x86_64";
-      sha256 = "8bd32a17696fc93fddb14efa1ae60d98aa267f84482ec110c697cba380fc254f";
+      sha256 = "67f42b8ce23ef78aab9fd5e61abada98d7fba5dd76d8c57ceefb43a1783d29a5";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/cy/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/cy/firefox-96.0.3.tar.bz2";
       locale = "cy";
       arch = "linux-x86_64";
-      sha256 = "761c62b1cd57d7c2e35195232fd094181c18f0ea10c5f4ae3ecc35f40d4061ca";
+      sha256 = "c6bb154bb341b88994d060f18430670184bd3646c662da6351df11e2ce9a6abb";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/da/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/da/firefox-96.0.3.tar.bz2";
       locale = "da";
       arch = "linux-x86_64";
-      sha256 = "b08494880033516192c61fce66a64cc7dbebcaec595a089a24f2f7cd55f89396";
+      sha256 = "3c268391a116f9b8ada73a98020c44f67bb9f275fbb7462a188e6d2d8acede7a";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/de/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/de/firefox-96.0.3.tar.bz2";
       locale = "de";
       arch = "linux-x86_64";
-      sha256 = "71459eef80ae2003549422041ab7741668497de3ccf36680037cdf3eb7cddc6b";
+      sha256 = "dc5ce8991db83708bfbe686db8a3244e28e61077a754b6dc41f29946b8afb489";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/dsb/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/dsb/firefox-96.0.3.tar.bz2";
       locale = "dsb";
       arch = "linux-x86_64";
-      sha256 = "7c9e4aaf9874846eb403260ca20f05b3d02e9b0b125e106fb8bc77c8abcaaebd";
+      sha256 = "9afd277a20cc47de854ec48c9aa484118e274ce24532e53076eafeb78d4f8e0a";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/el/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/el/firefox-96.0.3.tar.bz2";
       locale = "el";
       arch = "linux-x86_64";
-      sha256 = "d7180afa9621488ba28bd7ada933451e11e080f74d6925d7b9d6edb7dbba3dfc";
+      sha256 = "58130d71888ee7f3c40a1656ee0e7ab9f3538573f1dde104a93e850863ea1be9";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/en-CA/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/en-CA/firefox-96.0.3.tar.bz2";
       locale = "en-CA";
       arch = "linux-x86_64";
-      sha256 = "26d179040167f5ae244a7c7f040ea8114ca8094b0394bb25e092e93496ca545b";
+      sha256 = "2548098aa8527abd10b0f23203a1a4fafb231c6bf853d67c938006d6c230856a";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/en-GB/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/en-GB/firefox-96.0.3.tar.bz2";
       locale = "en-GB";
       arch = "linux-x86_64";
-      sha256 = "6c53b1227cf43e1a8cf2cc0a4255efe28a852b395f8c9504f1c63ebd9ee1baae";
+      sha256 = "c8f8e171e28b629fc9cfc4557409987e7a72aa9507a51fe2bf0f8347530cc962";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/en-US/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/en-US/firefox-96.0.3.tar.bz2";
       locale = "en-US";
       arch = "linux-x86_64";
-      sha256 = "ae8aad9fddd1e3b28da71a0811eda5dff49593371d5e3f6b8852835bdf43bced";
+      sha256 = "2b642cfd2db0c2cb0f67453307a5a7d8c90e372a03274644212b51f60d503965";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/eo/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/eo/firefox-96.0.3.tar.bz2";
       locale = "eo";
       arch = "linux-x86_64";
-      sha256 = "e8e4a44511a5b0855b430063a2f6413603eda572e6f6567835fe7dbdfa4428ff";
+      sha256 = "803ea1560568fb1c2af0bc0ff47a01ec7d854866b209bce7ceff8f7351a1cffc";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/es-AR/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/es-AR/firefox-96.0.3.tar.bz2";
       locale = "es-AR";
       arch = "linux-x86_64";
-      sha256 = "3e18ce4633e66f51a2e89028cdb60cb68f01dea799590bf38ff663957ef7900a";
+      sha256 = "4ab03c3623f26785b09308ca3d334536b169aec7690050db2141e40a83bd7b0d";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/es-CL/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/es-CL/firefox-96.0.3.tar.bz2";
       locale = "es-CL";
       arch = "linux-x86_64";
-      sha256 = "8456b5c6a474221679a26803cebb1be001e97c195a3bd322f8c8996c1e8f2258";
+      sha256 = "578e4ae8697ddf6754c88e94c7676b1f1fb4d0cd65dadd833966f1b69a277f14";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/es-ES/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/es-ES/firefox-96.0.3.tar.bz2";
       locale = "es-ES";
       arch = "linux-x86_64";
-      sha256 = "28cc54e6d1f540a139ad1cd5961799326c526ffd13bc611c2f276cf3853e8d5d";
+      sha256 = "91ed54c34aac2fa5f3345403f4123f154679759bdbc4d6453de093216db630d4";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/es-MX/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/es-MX/firefox-96.0.3.tar.bz2";
       locale = "es-MX";
       arch = "linux-x86_64";
-      sha256 = "0796ca6961f66801162f44022704c921671066ce044514489bdf3a784c517b33";
+      sha256 = "8cad63aedba46ae735a6d69e510c912f746ed5f1d0af8a8bc7f396a53ca9bd7d";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/et/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/et/firefox-96.0.3.tar.bz2";
       locale = "et";
       arch = "linux-x86_64";
-      sha256 = "fc8f8b3ed9dff593a3b6968b86364c516a910601c1d6576b160ccf9ca51d0adf";
+      sha256 = "c12317af0fc4a4ae13a0ddb376192ba62ef3a2bc3205a0a87531ea4147707c5d";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/eu/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/eu/firefox-96.0.3.tar.bz2";
       locale = "eu";
       arch = "linux-x86_64";
-      sha256 = "1950fa86d15392b76b51a76ece16b9fae1fab449c7883cc6232e30bff75aa46f";
+      sha256 = "a244b1fbd2ef6197c739834177e6bf9c8f1241f9257baa77eeebac149da0919e";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/fa/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/fa/firefox-96.0.3.tar.bz2";
       locale = "fa";
       arch = "linux-x86_64";
-      sha256 = "8a7bc2e996ae85f7478792eef2ab9e0c2e67f845e8f89cebb8923a24f84c5dea";
+      sha256 = "7eac238a916f009c83f8a95cb5f6d13e08461630094d85a78cfae041df7b9179";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/ff/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/ff/firefox-96.0.3.tar.bz2";
       locale = "ff";
       arch = "linux-x86_64";
-      sha256 = "158ead011e5e65f84f7f2801760331d157008cfc2916bb50ee3dfe65c5c78bc2";
+      sha256 = "afd6d4635f3840287ac5497ec33555fa6399d0555e8a9a8cd8c58384d6aba6c3";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/fi/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/fi/firefox-96.0.3.tar.bz2";
       locale = "fi";
       arch = "linux-x86_64";
-      sha256 = "1472f32f694fd2e41b08c6be8cfdb35078a019c29ff03c39b141d0c69266e909";
+      sha256 = "3e68e136d8a9a1522fe6477fec66df20fb454ab017d9337fbaab39cd4e607192";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/fr/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/fr/firefox-96.0.3.tar.bz2";
       locale = "fr";
       arch = "linux-x86_64";
-      sha256 = "b630159914423bf066f7b5ba22524731ab69e05a96f00f11c803b1aa91e24dd6";
+      sha256 = "5b1b622c122acba08315918969dfc14f952de946e121c7c037d53ca422fbc3d6";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/fy-NL/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/fy-NL/firefox-96.0.3.tar.bz2";
       locale = "fy-NL";
       arch = "linux-x86_64";
-      sha256 = "85c3e5a6bfcf6275334878ecbba0feed4c56033e2874dba1ee322d37f157de98";
+      sha256 = "c6588dc0436e8c96fe2660c356bd26dbd3065f04ab439aa034a154c28e5feb49";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/ga-IE/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/ga-IE/firefox-96.0.3.tar.bz2";
       locale = "ga-IE";
       arch = "linux-x86_64";
-      sha256 = "57dec3d400e4525d65e3867c6e128010ca8b9017167e41a5ebfb70fc6041576e";
+      sha256 = "d289f690338b6191f6da0201745d361915c83839f829375913a004bf63482fd3";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/gd/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/gd/firefox-96.0.3.tar.bz2";
       locale = "gd";
       arch = "linux-x86_64";
-      sha256 = "d40c385478802645530b18d5340e7a37daec86fcbb265df224869bf944c0aaf1";
+      sha256 = "f007344cb0ff1a2999d87ab4563cde87c2afa416cf3e20f7c369c9e6d4f17193";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/gl/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/gl/firefox-96.0.3.tar.bz2";
       locale = "gl";
       arch = "linux-x86_64";
-      sha256 = "7c9c4974907567315bec93adc4985367a5773cfbfeb39fb31270b6c21f346ab2";
+      sha256 = "d42233e3a6cce9d0464428bf8e2dbaecac1eebf2c03f58e0045f971d38a2d844";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/gn/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/gn/firefox-96.0.3.tar.bz2";
       locale = "gn";
       arch = "linux-x86_64";
-      sha256 = "33f2312e3368ee5bbd09ad397a16d5b1b376b91d75433575b8ed7d995d263ef9";
+      sha256 = "333e9de73b08a2c86d3491ff15a39312c63fcd2ab46f45d271fc37244242f39f";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/gu-IN/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/gu-IN/firefox-96.0.3.tar.bz2";
       locale = "gu-IN";
       arch = "linux-x86_64";
-      sha256 = "bde662d7941d6afdadd84ad8c8b66e6463a7d7e20af7c6afda7b4f4a9ff23538";
+      sha256 = "2ef9974b7281e17ba3469947365b299b821afca28d5369c374e18d9498a5d15f";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/he/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/he/firefox-96.0.3.tar.bz2";
       locale = "he";
       arch = "linux-x86_64";
-      sha256 = "d983738db39c773b3d9edb942d9ed6b202943fbcd58f94c21d7968c0d4526354";
+      sha256 = "6df30dc08a3f85cb1c78269d05fc56af9651efed5d5bd2d09cbd1eba264e5eeb";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/hi-IN/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/hi-IN/firefox-96.0.3.tar.bz2";
       locale = "hi-IN";
       arch = "linux-x86_64";
-      sha256 = "9c5ca38a1ed0e7f20606e9e67139625f9c3896eb95f9f9f6c07271e1eb231cfd";
+      sha256 = "1ddb67ff888a37dac8e92637a051d3cc4f632bf3b22d05b91bd58bbad223e04f";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/hr/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/hr/firefox-96.0.3.tar.bz2";
       locale = "hr";
       arch = "linux-x86_64";
-      sha256 = "3c372a95a03d12fc53f171de4a652ec083efede32d954c1a5aedb2c699000d35";
+      sha256 = "85425e1a026d9ae2a5d55b0ad2b355a715e35904ac88a706f027dbf18ba11a0b";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/hsb/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/hsb/firefox-96.0.3.tar.bz2";
       locale = "hsb";
       arch = "linux-x86_64";
-      sha256 = "1c68037a98166e5c1332c45e1c583cbe266baa88373d921656722bd9846423c3";
+      sha256 = "abeee49422541d11d2eed2d159b7f20f3f0f36b7ce82505a2991368275f6bccb";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/hu/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/hu/firefox-96.0.3.tar.bz2";
       locale = "hu";
       arch = "linux-x86_64";
-      sha256 = "4a0b9577dfd5be293ca64d7311fbcb0cbd46d9b300bcfbe8fc89ac7726f6b71b";
+      sha256 = "2c42e7ed59de20b5377c37a41bfe083279f0e481c61cba6249790ff83ce2977a";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/hy-AM/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/hy-AM/firefox-96.0.3.tar.bz2";
       locale = "hy-AM";
       arch = "linux-x86_64";
-      sha256 = "1b3c910074db508b7ff0fe120cc1ac52bdeb36d6ec5f2bc931bd42ce81aa5ff3";
+      sha256 = "74a0b038ca4cbccbfcd276b299ed0d127f4d4cdea159789cf01313095ee8874f";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/ia/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/ia/firefox-96.0.3.tar.bz2";
       locale = "ia";
       arch = "linux-x86_64";
-      sha256 = "9954901a886af4e290e64bbb6f6787436182850dc29f5e246c9a53b1df10ff8e";
+      sha256 = "c711c1cf38ab231ae74404852999d74e4d802f36c12e44835e9bc6916133eab9";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/id/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/id/firefox-96.0.3.tar.bz2";
       locale = "id";
       arch = "linux-x86_64";
-      sha256 = "6f8452d04dfdfdd013c18db31f88934203c6d3321b34d6d92dcc393ef9cce523";
+      sha256 = "e03819b47694a6ded168212877294b187f3e3218ab78dcf888a947d90479fc30";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/is/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/is/firefox-96.0.3.tar.bz2";
       locale = "is";
       arch = "linux-x86_64";
-      sha256 = "fbdb3b7fa4ac13e654d5b1be90a7558c0912bf6288ce4c3d0214a4cf53768a45";
+      sha256 = "94eabb7522d56e732ee816a7ee1236307d8dd7ebe22fafa6bf4a3ae14d3a0d8b";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/it/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/it/firefox-96.0.3.tar.bz2";
       locale = "it";
       arch = "linux-x86_64";
-      sha256 = "7e9ef17a0a854a1616d37fa684bcc8f9447cb98eac9232b70adcdc3d61d3e558";
+      sha256 = "5b73da04bfd5601fd199e1ad32cc02b41ccd056551e3e14ae975ae401baebb53";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/ja/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/ja/firefox-96.0.3.tar.bz2";
       locale = "ja";
       arch = "linux-x86_64";
-      sha256 = "b278b661cfba935010b827564ba4229350b692e5a0cc6f04536fe38d16c6f37a";
+      sha256 = "2e8992b199d36c9857627942b43d3472f56e7657f929dc655cd4bc74b0441fe5";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/ka/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/ka/firefox-96.0.3.tar.bz2";
       locale = "ka";
       arch = "linux-x86_64";
-      sha256 = "0dec6bd016fa636a1422a4d705bf5813e2d717c865eb1c5e1bcaf539980be89c";
+      sha256 = "6c4059f00b2598bc28755f8051ef20159cf8cffc9732f1644822769799e886ca";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/kab/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/kab/firefox-96.0.3.tar.bz2";
       locale = "kab";
       arch = "linux-x86_64";
-      sha256 = "9789005dc9c6e708fbcd5b0dc1d41ae92703f8aca99e77a5b9ff82ec5e901810";
+      sha256 = "730e62f6d18da4519ae2ed46266d2014fd44260549d8d2dd4d0fd8b6174a2831";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/kk/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/kk/firefox-96.0.3.tar.bz2";
       locale = "kk";
       arch = "linux-x86_64";
-      sha256 = "2f8265737bd4e9f77e346caf56fc442c243e4183a6d679b1dc2a602617b94741";
+      sha256 = "a7f4afdd9d43f0bfec34edf17dd5ff0d68d529731b51deb86e2a09d85e7b86b1";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/km/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/km/firefox-96.0.3.tar.bz2";
       locale = "km";
       arch = "linux-x86_64";
-      sha256 = "25181612508656ba6ea558d3085e31860bfc70196d0011478885cc46af1e310e";
+      sha256 = "c69f54f1a9775c76f7126a18c5c8c66f683737076e3e59479b3e36a34a6c30f6";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/kn/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/kn/firefox-96.0.3.tar.bz2";
       locale = "kn";
       arch = "linux-x86_64";
-      sha256 = "d8383e317ba7e9c599b87ebfe15dbe0fd45580fe8faa155e62ad466d883a405d";
+      sha256 = "c9fb9ff1e2c79dc0ad804846bbcccf608a09ad380932bd7d68267e10cc9eeb65";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/ko/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/ko/firefox-96.0.3.tar.bz2";
       locale = "ko";
       arch = "linux-x86_64";
-      sha256 = "64a359934fc21a3d3d4c6447fc3b869ddf017356d1dd23ee9c71cafcde7e80bf";
+      sha256 = "43adfc767b7869adcbb2d39410813eeab6ca7d50df6398bc00106f1b73daa564";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/lij/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/lij/firefox-96.0.3.tar.bz2";
       locale = "lij";
       arch = "linux-x86_64";
-      sha256 = "372f106a7c5b0f1499c5562b51918e9ea349018c7716677629ea984f185eb27a";
+      sha256 = "812ebc60c69de188a12247cf82881824ee0efff571b91527fc343f50f216c27b";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/lt/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/lt/firefox-96.0.3.tar.bz2";
       locale = "lt";
       arch = "linux-x86_64";
-      sha256 = "05b0f431719ab8cb7df2e803d824bd42c0b30107010bb037343852c265460cd4";
+      sha256 = "375ce82258424250c48051f33551958adad2b72bff9c06f2109a54618fb0a038";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/lv/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/lv/firefox-96.0.3.tar.bz2";
       locale = "lv";
       arch = "linux-x86_64";
-      sha256 = "946f16a920a0581c7a201b3228c15014d92ea94c2c6ed9d833170e4b9d029b20";
+      sha256 = "5b27b13ae0406e6ac0bdd612ab8523fab2665b8e4e146aaf2f47a83712453958";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/mk/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/mk/firefox-96.0.3.tar.bz2";
       locale = "mk";
       arch = "linux-x86_64";
-      sha256 = "c8fd718b2e61971795d7dedb687821d5a46c0eb88c0af67bff3272c03395660b";
+      sha256 = "5215eb91572c7f863d79d44d23fff9181b1c910817d40383a83459d6ce0fffd5";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/mr/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/mr/firefox-96.0.3.tar.bz2";
       locale = "mr";
       arch = "linux-x86_64";
-      sha256 = "515b7b538e487c23e25eeb59d414a8a5b54cefa8f7bb4924be6327c8f9b9edf7";
+      sha256 = "056491449edc305d2994f8eb985dad136d9687b3f0aaf9b95d134a352f72ea34";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/ms/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/ms/firefox-96.0.3.tar.bz2";
       locale = "ms";
       arch = "linux-x86_64";
-      sha256 = "3a6af28c127183f75fdfbb4484d32230c4639ef8c7890d6786525900552b0ed2";
+      sha256 = "eb7244a97611860167f98dd038e4d1f60c3b52a2cf81fdf93c2402d780c1ecfd";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/my/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/my/firefox-96.0.3.tar.bz2";
       locale = "my";
       arch = "linux-x86_64";
-      sha256 = "1aca62c666431d987940852d1cda29281e30846e38a3855babd7230eaf7db5fa";
+      sha256 = "93b93324e305b5ba0f9a005b73230de8acc6607ff0e284c5d3814892f95181a6";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/nb-NO/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/nb-NO/firefox-96.0.3.tar.bz2";
       locale = "nb-NO";
       arch = "linux-x86_64";
-      sha256 = "04ed45b20776d517a08496bbe300d46c85c9a5c2ecbb74b03b0f22584ed506cd";
+      sha256 = "255056583e093d4b733326f732a529ddbe18010b64e5a093e6a17e09953f6c5b";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/ne-NP/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/ne-NP/firefox-96.0.3.tar.bz2";
       locale = "ne-NP";
       arch = "linux-x86_64";
-      sha256 = "7a921f5c2667fe21cf62596e5eba8152c0c68abb3e81aaa25d4cb134ca9efc1b";
+      sha256 = "65fcb5475f2ad6e4e9471e4129ed26c615786e6b90c13e1f38c1c679b913b023";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/nl/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/nl/firefox-96.0.3.tar.bz2";
       locale = "nl";
       arch = "linux-x86_64";
-      sha256 = "6379dcfb0c3a739dc65314531a425f03483f2b2b2359d89ddc8924d74a349743";
+      sha256 = "1197ff7d9bb843d56d081da51105283923768884cecee4ce9cb50a93952e909d";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/nn-NO/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/nn-NO/firefox-96.0.3.tar.bz2";
       locale = "nn-NO";
       arch = "linux-x86_64";
-      sha256 = "2872e3a05a7cb5dcc974f0f11b785207d21c76932958d6c6b0f3da73f73e4351";
+      sha256 = "47fe60e6c0115914630edf99a56447f5a1536da0e55e6253e58e4e9ac54c9eec";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/oc/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/oc/firefox-96.0.3.tar.bz2";
       locale = "oc";
       arch = "linux-x86_64";
-      sha256 = "9ee1a08401c0a605ba42d90c3c4e297a4f295357faa82bf7b99950cfe6bbfa16";
+      sha256 = "17d363269d5b0911d47ea3ba52e9a7b28f911e4f0a1eaa83849d749b4bfe906c";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/pa-IN/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/pa-IN/firefox-96.0.3.tar.bz2";
       locale = "pa-IN";
       arch = "linux-x86_64";
-      sha256 = "97f250aac0f6e096bcaebbe50e3482554454746eb73868e323fce73e72781464";
+      sha256 = "6c1f582c50b36055fb9f3b8c20db1bc823cbd2d56cf36c8495e7c18599a906a9";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/pl/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/pl/firefox-96.0.3.tar.bz2";
       locale = "pl";
       arch = "linux-x86_64";
-      sha256 = "3e1a7c882c02907e39b6bdc4f21899bcfd3ec21c66425727f8db0d3e897ba8fd";
+      sha256 = "e4a1fdc104a58966e760a1ea78bd353f61272462920085c347693adbac769d43";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/pt-BR/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/pt-BR/firefox-96.0.3.tar.bz2";
       locale = "pt-BR";
       arch = "linux-x86_64";
-      sha256 = "ad31fd6dfd33647cfc2c886b99f06d868c9de3684d601ad39a0e16ad42fa98a7";
+      sha256 = "90a1bff86400f555d284fd8094df9d7c13556ebad0ce982710508d901c6cb1ff";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/pt-PT/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/pt-PT/firefox-96.0.3.tar.bz2";
       locale = "pt-PT";
       arch = "linux-x86_64";
-      sha256 = "5a61590a49cebcac6ee9b6bdca80adf77458aa49eaaa989dd82bebfcdce6da1e";
+      sha256 = "7e59d9ab9369f8f7ef00b85c6c6be62b4bb9da488071268ddab808367541892c";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/rm/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/rm/firefox-96.0.3.tar.bz2";
       locale = "rm";
       arch = "linux-x86_64";
-      sha256 = "f03d956145c0780500c4eb5bc244f85ef826fe02606ac3df666f70bf6c8a28fd";
+      sha256 = "ca20e98f9703ccf00cde6793b2e1d28c0c429c0fff01a2eb592e4270181e8c1b";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/ro/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/ro/firefox-96.0.3.tar.bz2";
       locale = "ro";
       arch = "linux-x86_64";
-      sha256 = "42c514d296923177bf9b19a961a6cc322f5c3970dd42de583dc630320daa139a";
+      sha256 = "55ac07f7ffa919ba37d29899f8fcbb13793db9f198e2a9cc0b5dda717b1d4116";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/ru/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/ru/firefox-96.0.3.tar.bz2";
       locale = "ru";
       arch = "linux-x86_64";
-      sha256 = "90247a6c685b3bbae9a1073b9003239d5185927c68e75b3399b27af1c3702ed5";
+      sha256 = "f05ba84219501f904d51f320fecd84df6c51cb1f4ad541afbdbf8a781e46699a";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/sco/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/sco/firefox-96.0.3.tar.bz2";
       locale = "sco";
       arch = "linux-x86_64";
-      sha256 = "c7d3799d03df9e50e57b1e2264196962146ca9bb953c8a2610ad62927426d07a";
+      sha256 = "5186773e72363dd05e46ba418e58a9e4d80381fc530c509135c76c5e63353d48";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/si/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/si/firefox-96.0.3.tar.bz2";
       locale = "si";
       arch = "linux-x86_64";
-      sha256 = "2e27aa9eb0eba899a27d12a1d6ef63776365c06bafbfd6d3aa3c3ce2418de05e";
+      sha256 = "8bdc526c6d7b4c672d12c860376458d03efd5305f4823405c0827a4b75912a8c";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/sk/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/sk/firefox-96.0.3.tar.bz2";
       locale = "sk";
       arch = "linux-x86_64";
-      sha256 = "1e4ca0a7d7c11444a31de6dff04ef4a98ad92e6cd30187c7287c01d570bdfa48";
+      sha256 = "bb17d52c6c549dc7861c32ec9a4f57a0df323845a6076a9499c1faa9ae3c8d28";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/sl/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/sl/firefox-96.0.3.tar.bz2";
       locale = "sl";
       arch = "linux-x86_64";
-      sha256 = "59307696ffb8727e95cb2e390e3d00c31a590cb0d5bf5b860dc516085ae57755";
+      sha256 = "fecd2cf24bed949a02360ae74f6701ac9b65186a7a51f851249a2cee67ccb63a";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/son/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/son/firefox-96.0.3.tar.bz2";
       locale = "son";
       arch = "linux-x86_64";
-      sha256 = "4b1c5a2a46570913fd6784e91f2b55db39666fcebdaa2b56684e6f1d674a4abc";
+      sha256 = "c3130c49ad77912107c61d0b24e5290f20ec7dcf95d329682a0703f43c768c28";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/sq/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/sq/firefox-96.0.3.tar.bz2";
       locale = "sq";
       arch = "linux-x86_64";
-      sha256 = "ef1bc449a6649e8476beddec58ca363601b1ff09a27ad053a0c576e7f9375dc7";
+      sha256 = "4cf2ac0f3957a205a26548655f00c3af0c35751ff6f69d25e5a38dde86dbc335";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/sr/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/sr/firefox-96.0.3.tar.bz2";
       locale = "sr";
       arch = "linux-x86_64";
-      sha256 = "76e5cff9bc3001c7ae66b3971ee6b526ca52a04654b98bfa8f027200329123bb";
+      sha256 = "7f3e01919220b39029bf48c651864dfe9970c858f4c379a0a458bbadc1cea666";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/sv-SE/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/sv-SE/firefox-96.0.3.tar.bz2";
       locale = "sv-SE";
       arch = "linux-x86_64";
-      sha256 = "efcf35ec4f65496f4e1b81cd0fb6ebbbf460dfd5257ccf44d75547d4474f8f23";
+      sha256 = "bdeba12b07803a1bf86c7e38185fc1add59a10e09ed59aff7d135107d004f0bb";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/szl/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/szl/firefox-96.0.3.tar.bz2";
       locale = "szl";
       arch = "linux-x86_64";
-      sha256 = "e62f290ab601c5b4899de0115a476a6e5c6fe854a89c2555a059de0e9ad4f446";
+      sha256 = "f6b69c4e88e23da50b4f7f3b4961a92ddb3321dab8a988d29150fc1ad60258f5";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/ta/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/ta/firefox-96.0.3.tar.bz2";
       locale = "ta";
       arch = "linux-x86_64";
-      sha256 = "7eba2c9394ea70e3cb1d56e1e1ac0c3d2e423fef6b6ae523962ac5f13f93f0c1";
+      sha256 = "d7bb8645992788ac5161f3becf98248526b02b767cff958d5094ad24086cad06";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/te/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/te/firefox-96.0.3.tar.bz2";
       locale = "te";
       arch = "linux-x86_64";
-      sha256 = "f66730392b3a7ca2480b997288ef3502636722314731a33e930d30490c762715";
+      sha256 = "692b65313b3b792e35b1160ee830fd9c9ff082d6f6177af7be135dd6096efe09";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/th/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/th/firefox-96.0.3.tar.bz2";
       locale = "th";
       arch = "linux-x86_64";
-      sha256 = "9dcbc894d4cbccf0132808d56a4b1f45242bfb439d9219315ca72839ea46c5b4";
+      sha256 = "c792a126f487b51f4832a56fec8a6fb502fe3a0a38dea7a8f3c5a7060b9d7576";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/tl/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/tl/firefox-96.0.3.tar.bz2";
       locale = "tl";
       arch = "linux-x86_64";
-      sha256 = "461a6e1f9107973da675594cbde1c3371f3636eb7f0bc1287f162f6b8e6b7823";
+      sha256 = "ef633b565abf5349aaa86afcd9934145b70abc036bcddc733075e5157a736406";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/tr/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/tr/firefox-96.0.3.tar.bz2";
       locale = "tr";
       arch = "linux-x86_64";
-      sha256 = "d3dabac4567b81f988d209c094b7e80db12465f62622c21332d7f05e4e26fedd";
+      sha256 = "ef04eff4e101405dbf8291b0384f8ecc95febf6730aabdc28d8c8cfaf305810e";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/trs/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/trs/firefox-96.0.3.tar.bz2";
       locale = "trs";
       arch = "linux-x86_64";
-      sha256 = "0978b21a644764974d2bba3a532d3ab5f9ac66127cc51d9b0411016c6778c696";
+      sha256 = "0a5c709f86dd33c771aec4760a5df1dbfd7baade90c8d9519c46a1dee8f18aad";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/uk/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/uk/firefox-96.0.3.tar.bz2";
       locale = "uk";
       arch = "linux-x86_64";
-      sha256 = "f42e4a326aa1aeb2e2d82bf2ecc7c8d38fcbd613e090736a047f4f715f955727";
+      sha256 = "488baa16c6d60043d5da0aa667e3973eb0df141d50bef117effecc2a39a30019";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/ur/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/ur/firefox-96.0.3.tar.bz2";
       locale = "ur";
       arch = "linux-x86_64";
-      sha256 = "bf863ace693a73a187867600ced36a26e9236ae94b753a3c8c6f20801b49f2b0";
+      sha256 = "039278fc25b62c6ccc024965ea296de4381f86c485b10cfa93cd5025d39f7e47";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/uz/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/uz/firefox-96.0.3.tar.bz2";
       locale = "uz";
       arch = "linux-x86_64";
-      sha256 = "89044b270b36a97b9d39350ea20df1d1cdd19628f048a4fb908316a9b081393c";
+      sha256 = "59c1a1f8a85f1f569112df4dbfeaaf15f4337210f50111193b36bdedf4d3b2b4";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/vi/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/vi/firefox-96.0.3.tar.bz2";
       locale = "vi";
       arch = "linux-x86_64";
-      sha256 = "a983b8b260feb7777e55fc3022a130d7eac1e70c2d2472759009d3154ef208c3";
+      sha256 = "e9a1a2330b1d09ae8f9ecb95613799db87a06f7a4fcd70265ebca2a6aa179bf9";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/xh/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/xh/firefox-96.0.3.tar.bz2";
       locale = "xh";
       arch = "linux-x86_64";
-      sha256 = "ccf3c8ec1c3aa9401693398deb82ae3a5bb3d4b085406f4f9986267309e04972";
+      sha256 = "8dd8816267c62f309206a45cab60bd6dd4d067b0de3002111d86b737f4f9d11e";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/zh-CN/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/zh-CN/firefox-96.0.3.tar.bz2";
       locale = "zh-CN";
       arch = "linux-x86_64";
-      sha256 = "3dfa8a328952a2072431d8b532c0c47312e35bf7dea70c45344fe5198a2fc1e7";
+      sha256 = "b080362a5fa2a660770698915abbbc9230d85ce1eb3510e96ff9374ee19fbf94";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-x86_64/zh-TW/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-x86_64/zh-TW/firefox-96.0.3.tar.bz2";
       locale = "zh-TW";
       arch = "linux-x86_64";
-      sha256 = "d9028ad8fa1467c8ad16d16d758d9039cbad8c9de03f8c730680e82d95ad49e1";
+      sha256 = "34f43a3dc69a116d5b9a136d89fe0180deee13907a94eb6d02ef2ffacb94ef49";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/ach/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/ach/firefox-96.0.3.tar.bz2";
       locale = "ach";
       arch = "linux-i686";
-      sha256 = "117b128a7a24f7b582ef47afe4f1277f8c41e56cc2dabefa9e2761985a922c4a";
+      sha256 = "b2f21e188e6ab08be9b57a1a50dc735c50cc6586a70c3243af1dc242def66f79";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/af/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/af/firefox-96.0.3.tar.bz2";
       locale = "af";
       arch = "linux-i686";
-      sha256 = "4d7e19a89324ccbc740f1466b425a7ee8643c61c2b912e8c1682d26ed2161b8a";
+      sha256 = "c153b40cccdb36903e3ced9d8685443a9dd4550419b45f09c201fc5b9ef2d12c";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/an/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/an/firefox-96.0.3.tar.bz2";
       locale = "an";
       arch = "linux-i686";
-      sha256 = "025f3022d2d1147c0d34ecdee4b5cc569e9ed4a0bf06f1d6ab57ec897bd1ecfb";
+      sha256 = "0514725b38a83e6385362dfdac57b7d374a458e6621296c4285d769933aa7bdc";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/ar/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/ar/firefox-96.0.3.tar.bz2";
       locale = "ar";
       arch = "linux-i686";
-      sha256 = "551fd200855a19e9a6f340143112011e02b148e01ab1e7fefaeedbeb9db6e464";
+      sha256 = "ba1003e913322f06aa113f61d6de5ce52e08bdb5644fd6c5c8d9f059765a7737";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/ast/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/ast/firefox-96.0.3.tar.bz2";
       locale = "ast";
       arch = "linux-i686";
-      sha256 = "b0268f0f8ef786c7ae565bdda7bc18c40abe0c88a697c477532dad777540db3c";
+      sha256 = "c2983efe1ba2b201006581d10fa629e2704f70590290a2720817b49ea3cb6ec0";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/az/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/az/firefox-96.0.3.tar.bz2";
       locale = "az";
       arch = "linux-i686";
-      sha256 = "69b7da590e9788548fe4acf2441780ad9aed2e896f799f9f38e9e49b8613400b";
+      sha256 = "b4cf2197f83835fb580ed79e01851e7be2d9d7e319e1dcea3028e075f244d6f6";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/be/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/be/firefox-96.0.3.tar.bz2";
       locale = "be";
       arch = "linux-i686";
-      sha256 = "1b96a70a6dc272e5a97df6a83598baf3065c54b02286a77df1cf459b750fe400";
+      sha256 = "519c34bffab78065fcd3b9027eac4e0eda7ab864784f98474dcc04d887540bc4";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/bg/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/bg/firefox-96.0.3.tar.bz2";
       locale = "bg";
       arch = "linux-i686";
-      sha256 = "06f3e54d8a0dac7fd696c9e205d57dcc7ff3bf61be8afe0e125ed94b6cfb0dc2";
+      sha256 = "fc897672d9eed6bcc835fa3e9e6e7fe07214192fd6899b2e7f85d64a0fbb1179";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/bn/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/bn/firefox-96.0.3.tar.bz2";
       locale = "bn";
       arch = "linux-i686";
-      sha256 = "f6e416409075720bd440163a5f852a8b9e34684de966fe7675733dcd3cf1b9eb";
+      sha256 = "67550724f06e82f430e398171715a96eb2b4aa6e902066faf7e7a1efc5bfcbb1";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/br/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/br/firefox-96.0.3.tar.bz2";
       locale = "br";
       arch = "linux-i686";
-      sha256 = "8d9ab421a13aaf130b2487e3b2ff0a4c68da19ccc019ebaea9fbc506ccc02ac9";
+      sha256 = "22d15a81ee580824465ff2bae1f134efc4525cb2b7e3707c365f8b720f8511b9";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/bs/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/bs/firefox-96.0.3.tar.bz2";
       locale = "bs";
       arch = "linux-i686";
-      sha256 = "3348a5431c072589366e2226b096c24c5c206dfd088f475f6814b56a674ba8a1";
+      sha256 = "0d2bca33d770c88b808c74f3178e5f4782424f804e59acfdb884879e195e3ba4";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/ca-valencia/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/ca-valencia/firefox-96.0.3.tar.bz2";
       locale = "ca-valencia";
       arch = "linux-i686";
-      sha256 = "38c46aa9998c09a5498115c2747bae7af74e79aba3e84ae8030979eb566e67a6";
+      sha256 = "3214ba1b640b1802d1a22c0a76ed5a26f0f2c23785cced7ed1cc8eaecb0c0030";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/ca/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/ca/firefox-96.0.3.tar.bz2";
       locale = "ca";
       arch = "linux-i686";
-      sha256 = "5e1f0a52844e54f689ddd8d101a1a35373aff57d2123bd764808c5e6e00f9a33";
+      sha256 = "07fa269368d120c547c6faad6c896c73cd95cfb1a99da9bb7bcdec1453e4c898";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/cak/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/cak/firefox-96.0.3.tar.bz2";
       locale = "cak";
       arch = "linux-i686";
-      sha256 = "0bdd0ff060093c85c3dc4ac690b4e8e094165da76c1cc32df0ce2bd738f6d629";
+      sha256 = "3350662d19a2f4bf68688917c4b37565c9049f22c272ed860e1d47f6f11e3be0";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/cs/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/cs/firefox-96.0.3.tar.bz2";
       locale = "cs";
       arch = "linux-i686";
-      sha256 = "7adf999a82970a477e174b06bd20d0454a72fffa8e3ee3f21e72d02850069918";
+      sha256 = "2a70bc5fe26c427ac4d0c6ff75670dc485d9f4701926572ff46f6e6044a94d97";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/cy/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/cy/firefox-96.0.3.tar.bz2";
       locale = "cy";
       arch = "linux-i686";
-      sha256 = "b8aec416d144b49395230194f056bb1749a5056adaabb132ff95da7bb653cde6";
+      sha256 = "d5e4177638e84295f2733357548791a179cd32e97c1080666a6b48270236f8e8";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/da/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/da/firefox-96.0.3.tar.bz2";
       locale = "da";
       arch = "linux-i686";
-      sha256 = "6f1ef67a6394380d948e0365610e81e2fc0ccf850d6167f90c258c26cc363598";
+      sha256 = "3d31f922d743c9ec84841bacfcc563c6c71716f75cef8b78b5331bfe6916dcb3";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/de/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/de/firefox-96.0.3.tar.bz2";
       locale = "de";
       arch = "linux-i686";
-      sha256 = "efd33ca5b825d9d62380f28a0ce6f9e4d1413570eddb94922522e8ac5272b8f3";
+      sha256 = "2e1ff6056e589d420ae813a448317de248910694fa89ecfdce9b5545a647e2b5";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/dsb/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/dsb/firefox-96.0.3.tar.bz2";
       locale = "dsb";
       arch = "linux-i686";
-      sha256 = "b426f1945115787abafd1d91dea98e1e5b420a017cc596392cd4df7d246eb580";
+      sha256 = "73d2c7e568d7e6bf8831dc4405f407357e3066896446d3ea2bbaf7de45c1314f";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/el/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/el/firefox-96.0.3.tar.bz2";
       locale = "el";
       arch = "linux-i686";
-      sha256 = "8b9882be7db1ed6442e46fb47d8615ff1f408d95472cc40b96b44f0626907983";
+      sha256 = "1669c35b9ab66367d998f1b15556ababbb3b80aa191bed6a7b7f34c6f29fef1c";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/en-CA/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/en-CA/firefox-96.0.3.tar.bz2";
       locale = "en-CA";
       arch = "linux-i686";
-      sha256 = "d73debdbd205a77d813570072c900251da002ad829b62bda7921e8ae2b749876";
+      sha256 = "c5aba93081eaf416dab845e0e8d2e5db10992c3aaeab209182c4af2e725dc5c6";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/en-GB/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/en-GB/firefox-96.0.3.tar.bz2";
       locale = "en-GB";
       arch = "linux-i686";
-      sha256 = "a523d57d573b59c1ca4be7912c2a84b77db89f50417d7064f041474fe270d95a";
+      sha256 = "72acf998d686d34727ca307855d3c0139c620868b13614ef5c7a61953a3c2ac8";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/en-US/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/en-US/firefox-96.0.3.tar.bz2";
       locale = "en-US";
       arch = "linux-i686";
-      sha256 = "0bfaf456bdcfa41e0ca4c45718734a70fac419f29edec41d3357708f38813240";
+      sha256 = "096169898ad97b2575b0b5e07c012f55f8749b7bc85f373c276d97948c3b7e08";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/eo/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/eo/firefox-96.0.3.tar.bz2";
       locale = "eo";
       arch = "linux-i686";
-      sha256 = "1223972105ead68b14903d9bd081fb23fdaa4cd6cfb8eef970253e64b467f141";
+      sha256 = "365611e7265d56b3c9bab3a6aca71b838d48b945119b710624696080170443cd";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/es-AR/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/es-AR/firefox-96.0.3.tar.bz2";
       locale = "es-AR";
       arch = "linux-i686";
-      sha256 = "268fa9d6a476dbed0f2f20ad32d3de8784159dbbfeb8fab67f22088167b3ebe6";
+      sha256 = "49a54d184ea10380fac710f49f6c3e36c2e338e5324acf94b39535f6e06c91ce";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/es-CL/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/es-CL/firefox-96.0.3.tar.bz2";
       locale = "es-CL";
       arch = "linux-i686";
-      sha256 = "7c0b04a76748c77f78e629b4ece02ba8c9b237c229f699584408deb975a618cc";
+      sha256 = "3a5fbabf862c35f29db2c325e6b2e89af8a2fafea9c6613dbe4f367ce07e1abe";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/es-ES/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/es-ES/firefox-96.0.3.tar.bz2";
       locale = "es-ES";
       arch = "linux-i686";
-      sha256 = "59d9a063c4e072f7db25fca31b2ea93bc660a5290bf0a52b6936e3b7f6526708";
+      sha256 = "241fb3c9a2d07276085d586cf51fc55eaa6293d188ec286f25c6f58eb1919f31";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/es-MX/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/es-MX/firefox-96.0.3.tar.bz2";
       locale = "es-MX";
       arch = "linux-i686";
-      sha256 = "f9ea0cdb41fba2b058df9a8547fa626f368c820de40a07a5630e46c751f09e0d";
+      sha256 = "066bfc95073b28afbf61accf2455e3294281749eb048bfab0670b21f920e51bf";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/et/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/et/firefox-96.0.3.tar.bz2";
       locale = "et";
       arch = "linux-i686";
-      sha256 = "9dd85d7102378cbdf2a8307fadfc3c875ac7586aff93592a026fec03d924cc76";
+      sha256 = "437b61d073054cfb81063991c03afeeb5be52a31bd4f3bd1a2e65bef0c92a1d5";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/eu/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/eu/firefox-96.0.3.tar.bz2";
       locale = "eu";
       arch = "linux-i686";
-      sha256 = "fb7de46ac3086baa493410aa184fe2e8af2dcc74d516f702a019bd091cf93563";
+      sha256 = "bf998de6b1b2dee067ee05d0a28d0128f63c9e6e7b788181d785b8afce8b0789";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/fa/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/fa/firefox-96.0.3.tar.bz2";
       locale = "fa";
       arch = "linux-i686";
-      sha256 = "f2036970faecc4e37e80fb8a128aa35ad260ed6774d42b4f1b797e63dbe756fb";
+      sha256 = "efe1cd9c8acbb8cdd8d72eee6c81f100c17c90fe0e13784992c5cfbe712a1eaa";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/ff/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/ff/firefox-96.0.3.tar.bz2";
       locale = "ff";
       arch = "linux-i686";
-      sha256 = "b4d4cab79e00bed477a26da373e134fe319ea296c46ebcf20e5e92622a241bc8";
+      sha256 = "dcd0dbe923403f1b078695257bb2705a4be9c91ad51fe065500ebfdfd0e8bf45";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/fi/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/fi/firefox-96.0.3.tar.bz2";
       locale = "fi";
       arch = "linux-i686";
-      sha256 = "8185c38f9511b0b38a15679c8e4965d29a6f3f0dee94f1c3c7b51d1f46e175c4";
+      sha256 = "8c2288c2c7e96e2176b005227c504d7be001e03c43757f9e945f8a5a360dfc74";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/fr/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/fr/firefox-96.0.3.tar.bz2";
       locale = "fr";
       arch = "linux-i686";
-      sha256 = "9ca5fa4bb1ad4329ba16e3926d78d59012f5c602f076fdcb302714e843dd2d1a";
+      sha256 = "dbb3ebec1fb7da951c30d9a9fb50d59fe4b10cc56354c6d988708b4912092ae7";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/fy-NL/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/fy-NL/firefox-96.0.3.tar.bz2";
       locale = "fy-NL";
       arch = "linux-i686";
-      sha256 = "4f3e48689490a883f68e5501759d31f7f415897aff6bc435265ec1ceff4868c5";
+      sha256 = "510522af3fa4c2f264223ac1970222c6d77abee42cf41ae1725f615bc519ba0f";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/ga-IE/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/ga-IE/firefox-96.0.3.tar.bz2";
       locale = "ga-IE";
       arch = "linux-i686";
-      sha256 = "0b6eba35cf420252b9864b51785f9ad3122fce63e73dfea103619c6a4e9b2ea0";
+      sha256 = "82225bd4f8a00ffd38af9c4ce19cc3d224bcced34f6523cbe02a9c7f3d228697";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/gd/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/gd/firefox-96.0.3.tar.bz2";
       locale = "gd";
       arch = "linux-i686";
-      sha256 = "62d500428de85366503c11beb87370d67bbf0cc26a3396ec22535f6e7c731fcc";
+      sha256 = "5c11e2efaab296b436c6d21c7693612b910297681c49af90d376d9e1525b1aa8";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/gl/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/gl/firefox-96.0.3.tar.bz2";
       locale = "gl";
       arch = "linux-i686";
-      sha256 = "cbbdc4165500ab3dcb10035b3fcbef5ca84612b8972821f2a9c974c55bf2de2d";
+      sha256 = "8895ec691bdcebfc5eb13ef4a59fc1e08bd7aebd8ba336fc2a99db47608e03ca";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/gn/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/gn/firefox-96.0.3.tar.bz2";
       locale = "gn";
       arch = "linux-i686";
-      sha256 = "376ef506f3197384d4f93bf0e9c535181c82014190c881b0d61c957016b455a5";
+      sha256 = "fb6f99ee38f85d45b4d529934acdb94e804c5d8e85ae54124667c302156523b0";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/gu-IN/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/gu-IN/firefox-96.0.3.tar.bz2";
       locale = "gu-IN";
       arch = "linux-i686";
-      sha256 = "a2c77948f281162c8d430f5b5e3ccb1cd787e2b57177987a2b1a55c2f4c6c617";
+      sha256 = "69aaf403dc5fb15f92b95175a1be399452cd06ab751d3c6ff2a78c2ec9ebcab0";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/he/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/he/firefox-96.0.3.tar.bz2";
       locale = "he";
       arch = "linux-i686";
-      sha256 = "89cd9df5f34c129e9cb6d8a2c5cd964608f798a878aa2b695df00f8132fc12a2";
+      sha256 = "eedd4f7d709b56e002f8f9955debe3bd4b2c4caef61b5160af78a44677f44530";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/hi-IN/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/hi-IN/firefox-96.0.3.tar.bz2";
       locale = "hi-IN";
       arch = "linux-i686";
-      sha256 = "aab1f42deaa1cfecc31e3c7cb5f604da1856363f230ec61b921397838fd86b48";
+      sha256 = "3df9f781a68686c430da2f5aeafec68b983e1a9c64989701a78cec7a25830202";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/hr/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/hr/firefox-96.0.3.tar.bz2";
       locale = "hr";
       arch = "linux-i686";
-      sha256 = "bd585129e356ef3777358a38a86ae8452a5b86abdd9b28778d12ed73564561a4";
+      sha256 = "e809039217112743f459f37ae9b8cda21bb63aa00a23641a5f869a65ac55a527";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/hsb/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/hsb/firefox-96.0.3.tar.bz2";
       locale = "hsb";
       arch = "linux-i686";
-      sha256 = "6895520f5a675d5234b1556823684c6e26b7fa68b92b63931f28995face794ba";
+      sha256 = "4ee840b8014aa7b0e8ef5262ac2d69e48049a7b2beab803ee7dc09c35dee8f03";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/hu/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/hu/firefox-96.0.3.tar.bz2";
       locale = "hu";
       arch = "linux-i686";
-      sha256 = "ebfe02bac09e691ef4dc2b2c4e9710816d629b30bfc9a799f47adb81a9df1ce7";
+      sha256 = "8e62842f1be4afd2d61c0ef9a9be05f6e3c133d1994a55d8b165d39560d96018";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/hy-AM/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/hy-AM/firefox-96.0.3.tar.bz2";
       locale = "hy-AM";
       arch = "linux-i686";
-      sha256 = "fa1bd0398ab30da697189fb5ac3ecc641bb63c42917259234e11e4fc1d1f8710";
+      sha256 = "e0fa7cbc6bc4679585ce832f8cc1380e7de0cb0ca46b93293c9ba08fb04f91d7";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/ia/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/ia/firefox-96.0.3.tar.bz2";
       locale = "ia";
       arch = "linux-i686";
-      sha256 = "f981b9d9e290fd2efd8627a0f5e831de59d4d62833c0e5dd4c2f249791233d51";
+      sha256 = "d20630531aba75aa0641422fadcfd2d3bc663fc817c22641a63e9bfc4cd29a76";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/id/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/id/firefox-96.0.3.tar.bz2";
       locale = "id";
       arch = "linux-i686";
-      sha256 = "e8b5511d6e24e783677a4e4766151943283ae9b6b7047cf380ab33d7d557de80";
+      sha256 = "b11550957bf6caf0f088e5791db67f7685d4626f7535691c4201764244649fd5";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/is/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/is/firefox-96.0.3.tar.bz2";
       locale = "is";
       arch = "linux-i686";
-      sha256 = "3e2eb36a19c5cbf69d958d7f19c0938039f1c26fc94ddd33696316cd709f5298";
+      sha256 = "d9112f5dc6c3fbc415d9bb9da52f36dbce325d36d8ec1843cf96b093d19d4b69";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/it/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/it/firefox-96.0.3.tar.bz2";
       locale = "it";
       arch = "linux-i686";
-      sha256 = "0365c8a8395cba72a2f57a65034c00c87e1dd392efb4bcf073812efc49713225";
+      sha256 = "35f4350d1cec94cb4402b7b22f11e929e8a08b44a150f7910f278c9a5cb77324";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/ja/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/ja/firefox-96.0.3.tar.bz2";
       locale = "ja";
       arch = "linux-i686";
-      sha256 = "6c3d8d2f71b3e1d0d5e270008dcd53ada5106b3f5239d2f2039eadf03b9dc076";
+      sha256 = "5fe015cc6d0250500912187edc04e697cbf62028b447e47e8d1532dfd0628d2c";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/ka/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/ka/firefox-96.0.3.tar.bz2";
       locale = "ka";
       arch = "linux-i686";
-      sha256 = "a63591cd5b0ff79c2ab0baf125cdbfff0baac178dbb8fec5d50c313e2d63a4d4";
+      sha256 = "a696df24f1b95e5b228f53328514c77639020a8719cdb23f88017be7e6d2a037";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/kab/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/kab/firefox-96.0.3.tar.bz2";
       locale = "kab";
       arch = "linux-i686";
-      sha256 = "80e09564908adc6fd6219ffd58ff2e4f91da04a42ba2535014526317fb63763f";
+      sha256 = "4d9c7c0cf22aacd5c18f75eb511db2ebffc393019af1f01fb5d1dbb837da96a6";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/kk/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/kk/firefox-96.0.3.tar.bz2";
       locale = "kk";
       arch = "linux-i686";
-      sha256 = "382fdf810ea304cfb12d8d19c28e407a404c75bf09770b882abdad3c5d101eb8";
+      sha256 = "db9c1eee0cd6a696e24b7edb142aa3f04a89bb3b30ec46e76be3738e3787bbe4";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/km/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/km/firefox-96.0.3.tar.bz2";
       locale = "km";
       arch = "linux-i686";
-      sha256 = "2ff261744a3d3466086d175c860b7a7565848870e77bbd8af93bb1f0b7b1baea";
+      sha256 = "e05b5a315de970a2bb58276204a341870d0028214b2a402eef5db36ce8ca8190";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/kn/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/kn/firefox-96.0.3.tar.bz2";
       locale = "kn";
       arch = "linux-i686";
-      sha256 = "bdd6864ae5fa723f47d029a0f0d8265c865b7635d33aaed9003f26d4962ba34f";
+      sha256 = "1c60915882ba74ddb257517036932c154a5081e9418b98e0fb533f1c71479eaf";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/ko/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/ko/firefox-96.0.3.tar.bz2";
       locale = "ko";
       arch = "linux-i686";
-      sha256 = "643a9b2ed25c15a3e2139af4cb80e249dd8da3719a36cc3d21549fd36de8631c";
+      sha256 = "1c69656cf1e302973ee92d9064388cd537b70ca8e36882b2aba5ba477522192b";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/lij/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/lij/firefox-96.0.3.tar.bz2";
       locale = "lij";
       arch = "linux-i686";
-      sha256 = "326260fd6b0a996016cdbc0668cbd819199cc9f39584eb81e46182032b2e4175";
+      sha256 = "bef0d7289833480363ab76d610e2cfecb286f5ed614d910ee84c9016da358c1c";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/lt/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/lt/firefox-96.0.3.tar.bz2";
       locale = "lt";
       arch = "linux-i686";
-      sha256 = "7888d9db18476a8f5d1e6bc69159b80266bd0bc58e302c66b3aecc6bb304871a";
+      sha256 = "738746e5e17271ebc97963a890e6951c9338c7f9bdb6021c3db0de1f346eb66c";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/lv/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/lv/firefox-96.0.3.tar.bz2";
       locale = "lv";
       arch = "linux-i686";
-      sha256 = "6c6eb3f523fbcee8342de1d0a159afa8a182621bd126e030ae0bf663fc7341ef";
+      sha256 = "d16713a766aecb20428d6642805fdb94a70523c0eb557b4a143c60afbc7ab623";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/mk/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/mk/firefox-96.0.3.tar.bz2";
       locale = "mk";
       arch = "linux-i686";
-      sha256 = "d86c29d3a883d7caa7b6d5eacd43dbd7c25ec2cb01f8cd6a2a81da794bb4e7e4";
+      sha256 = "f04eb09a5ccf6fb017a652ed8016d2e6f83202acb1f596a9f1b972caea8bc6ad";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/mr/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/mr/firefox-96.0.3.tar.bz2";
       locale = "mr";
       arch = "linux-i686";
-      sha256 = "d2af69b599ef0793361909104e7ad7889f86789e534dfee13b977a044802a834";
+      sha256 = "8cb8bdfe8b57fde90425e242de2a6c6a2fd76341efe32017febce6eb8189595b";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/ms/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/ms/firefox-96.0.3.tar.bz2";
       locale = "ms";
       arch = "linux-i686";
-      sha256 = "8876f2df083506768b674e20d43e4da2c0d54f717fc4df306c3386548ae42921";
+      sha256 = "785a87e3cbd7521913c47b9ba0f3838ee44e729df17680d780c78735c2ede188";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/my/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/my/firefox-96.0.3.tar.bz2";
       locale = "my";
       arch = "linux-i686";
-      sha256 = "ce16c5c94d81c3d0b7cd763123c97ef8e56bcd01ddebb616ebd1ab77d37f1650";
+      sha256 = "6a555d259acd118123630f2da9c82c72fb95208b6aa02cec36ee8f803a94db82";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/nb-NO/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/nb-NO/firefox-96.0.3.tar.bz2";
       locale = "nb-NO";
       arch = "linux-i686";
-      sha256 = "c56b6baf9439af5612e4b141d3af24bc12b256e93f13775f3e6d98065bea079b";
+      sha256 = "a095c6f9991033a60015416f049e39f403368aafd85b3eb63dc3b7ab1183b9a0";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/ne-NP/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/ne-NP/firefox-96.0.3.tar.bz2";
       locale = "ne-NP";
       arch = "linux-i686";
-      sha256 = "8c9dca9eb2f824697a66cedf1f3b92ab94b312b1463fa72596962b7aaa93cfb6";
+      sha256 = "3e3d546d2c2671f026414c809ac29431e4497a609c429c549f3183b101282766";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/nl/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/nl/firefox-96.0.3.tar.bz2";
       locale = "nl";
       arch = "linux-i686";
-      sha256 = "b20a48a30c36750578b1365837be5bdb190f338a046c47748890edf96c4cd661";
+      sha256 = "5a0f987ddf354053e128a9c4d27b0eb73df227569643bfdca211aa2d4aef9208";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/nn-NO/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/nn-NO/firefox-96.0.3.tar.bz2";
       locale = "nn-NO";
       arch = "linux-i686";
-      sha256 = "9b7c79689c11d95acecb34a9a8022bf197384dc79b229fe3e648f92e08ab58bb";
+      sha256 = "736ed19fe6aabe0db06c3b5ba8971b9f73ec7014d876ce5fc0b5caff491cdff9";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/oc/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/oc/firefox-96.0.3.tar.bz2";
       locale = "oc";
       arch = "linux-i686";
-      sha256 = "f2df32774438f105d67a80e8c3c0ef72b0606dbad796b34ae60f48942ab755b6";
+      sha256 = "abde35c0c8ec426bdf5b35d0d19d2076fb72091939dded1318af90234efdc795";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/pa-IN/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/pa-IN/firefox-96.0.3.tar.bz2";
       locale = "pa-IN";
       arch = "linux-i686";
-      sha256 = "d5e66f3c0f9c3a554f7c9254f46f15e2e087e1ece1a6cd946df03cc1067b42a1";
+      sha256 = "f40fca6a7f15b21ed61ff1293f9ce26cd4331736c4f59dc3515fa895176a15af";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/pl/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/pl/firefox-96.0.3.tar.bz2";
       locale = "pl";
       arch = "linux-i686";
-      sha256 = "5eb5863b680e85e322d92cabed13683264d1503e596ef604cd60ee6c9a2c30ff";
+      sha256 = "37dbcf64865442c1e42d22cb926888dee9aed8f3d99e08c8a8da3fc3bbcc18a0";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/pt-BR/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/pt-BR/firefox-96.0.3.tar.bz2";
       locale = "pt-BR";
       arch = "linux-i686";
-      sha256 = "b1f14be92a6e861fc7dc04274d9260d863fad697ea3bd5b39f2254430ca5999c";
+      sha256 = "60059b1fd78fd5dbf4df958274dc3c272142b4daaaf7fcd527491674bafbc234";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/pt-PT/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/pt-PT/firefox-96.0.3.tar.bz2";
       locale = "pt-PT";
       arch = "linux-i686";
-      sha256 = "e72d8c50059ca2b87f7f75d53dd8c3e8523792326ac1b245c012353a11244023";
+      sha256 = "958dd069404ef0b5aa3426c0436f7cc2fb0665d7aeb17b894f555baa875b1808";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/rm/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/rm/firefox-96.0.3.tar.bz2";
       locale = "rm";
       arch = "linux-i686";
-      sha256 = "47809c62aa91491b0856c1d775f700197d7b97b6b26d1ac2e41cdcbcedbe25a8";
+      sha256 = "5d1379af25c004d0e16b3763fe2a78ddbd766a1ed8d3aa966a71bf44b65a8140";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/ro/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/ro/firefox-96.0.3.tar.bz2";
       locale = "ro";
       arch = "linux-i686";
-      sha256 = "5517806008befa780195a69a8f5a0b1f0c21b9e93ab2acddc6defa58bcd5ca23";
+      sha256 = "11ac629ea7b38db0043e9563fc5d75ea26ad75b0a3565d12798d56d2c7256992";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/ru/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/ru/firefox-96.0.3.tar.bz2";
       locale = "ru";
       arch = "linux-i686";
-      sha256 = "6a2050e7b67aa42b5deaf2455daaee8294cd987c5b7bbc95f6055e7c767c29f6";
+      sha256 = "2cc4cc849625dfc20a3dcdfa3a964218b521d4271c0cc166312b016948944b33";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/sco/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/sco/firefox-96.0.3.tar.bz2";
       locale = "sco";
       arch = "linux-i686";
-      sha256 = "e6a0ad3eeebde291d3196ea98704708bf23f22ee51df05c6d3e8170a97be7003";
+      sha256 = "956160210c34a207a129a08667c3c3a3f978ad444a3f524e5cf4ce3406205c3b";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/si/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/si/firefox-96.0.3.tar.bz2";
       locale = "si";
       arch = "linux-i686";
-      sha256 = "61d878e6e91a4aeced23cbdab43362fa12ff378b1f71eaa334fb052894cff070";
+      sha256 = "68b2d054ed0af6e2608b42f958e5790d22552882ae2c143fd5a35b755232577b";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/sk/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/sk/firefox-96.0.3.tar.bz2";
       locale = "sk";
       arch = "linux-i686";
-      sha256 = "8cf44c88119dcc189e3792aa0da589f539b7986cb909c690262ca27d8f354cdf";
+      sha256 = "5e5f318c5783feedcdd155afd7b2755fe0db513766378d823bec141a34245d73";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/sl/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/sl/firefox-96.0.3.tar.bz2";
       locale = "sl";
       arch = "linux-i686";
-      sha256 = "36799bbf527451d66dbbe93c9c59ca2f2b57c9a7541ba5ca26169eccdce67e76";
+      sha256 = "75be9829bc9b3e9167eac5c24a9c1d091a7f932c99c496b7a07c0d438523ba13";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/son/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/son/firefox-96.0.3.tar.bz2";
       locale = "son";
       arch = "linux-i686";
-      sha256 = "a40fdc44a5dc12fe62a4a86d88c2ce970bb95d20d8b9f99f6826339ed286129f";
+      sha256 = "eb18e65b5ff61953e8a8a2eff766dd13b9ecc5ce66179108eeb919b64219efcc";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/sq/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/sq/firefox-96.0.3.tar.bz2";
       locale = "sq";
       arch = "linux-i686";
-      sha256 = "b40fb49c73b5d1d6c0784b94f99bfb9804c0c5dfb40f579dc58ecb3e1625733a";
+      sha256 = "e21779796d19e344b518cc06106d9da298430dea03842c37e7856676999e57f4";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/sr/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/sr/firefox-96.0.3.tar.bz2";
       locale = "sr";
       arch = "linux-i686";
-      sha256 = "6f91b48edc1a158c0d3e9413771d4de8086bfc271ce353a7af5849f9ca8ae969";
+      sha256 = "12ff3eb22ea684b81909f9c03a4ce2ea802d6160bf1b7b939a808b28ad042d7e";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/sv-SE/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/sv-SE/firefox-96.0.3.tar.bz2";
       locale = "sv-SE";
       arch = "linux-i686";
-      sha256 = "24e91611cbeaf0f4276e92f7f2eb8fec2138daef6928ae0520fbac941eb80a67";
+      sha256 = "ed48713a2c50e806fa4ecb082bf87765e00f4b496f7087ac642d4b7d5287a373";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/szl/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/szl/firefox-96.0.3.tar.bz2";
       locale = "szl";
       arch = "linux-i686";
-      sha256 = "3ae32ba0b3543f09f3420d049818fac9cb1640585d7a28f1dd6716bc2f7254d3";
+      sha256 = "0a8335399ff54640d374c0c1035a4ba74a0a88b3940c02e7351c0372be4efd3e";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/ta/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/ta/firefox-96.0.3.tar.bz2";
       locale = "ta";
       arch = "linux-i686";
-      sha256 = "f5c15f7ed3794950b59ecc53a1131225b47a9ca80b511a4ad6d8102c59fc1f2d";
+      sha256 = "6d39220c2d88014acbfcb0d6ac93f1539a668b787a26acd31b80312f59f6be12";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/te/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/te/firefox-96.0.3.tar.bz2";
       locale = "te";
       arch = "linux-i686";
-      sha256 = "d57ec26edb702f4e266f312f58301291e8591f27e1b192271abb02eb1c0b2b98";
+      sha256 = "f037e673f47ce4569eec2525be5c1b903ffe0df71e322eeda033c91cc92cdd0b";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/th/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/th/firefox-96.0.3.tar.bz2";
       locale = "th";
       arch = "linux-i686";
-      sha256 = "2f8c857dc7a76dd6b67227db7c4e96a46731e62c94ecb4aea9fc0db02d564550";
+      sha256 = "dc7aae98e8b4928f7b3b703aeca5d07aa1a820efb5bf34b1d07d9360b2eefbec";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/tl/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/tl/firefox-96.0.3.tar.bz2";
       locale = "tl";
       arch = "linux-i686";
-      sha256 = "5c32180b070711556389f075b4534af36512402b27d1b830b7ff61b6ac6dd6de";
+      sha256 = "1fac0d3b63677d85d1921a7b9a9e81bb45be52a63ddeaa679022a9178acb2081";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/tr/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/tr/firefox-96.0.3.tar.bz2";
       locale = "tr";
       arch = "linux-i686";
-      sha256 = "bae06b7dd30733e5577e115f38422d19446da1b0688285f7c42dad67541ab99e";
+      sha256 = "d380b853b024daa0c11a34ce80c90b1840a2439b89b9f471ed1d483577c9e297";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/trs/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/trs/firefox-96.0.3.tar.bz2";
       locale = "trs";
       arch = "linux-i686";
-      sha256 = "abfda71628b8e1e2bde86313a40d6020af23375a35d5ca358b913018eaabf48c";
+      sha256 = "4b143569552d987f05fa482c481b846398cc45fa98edb59b257764762198a5f2";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/uk/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/uk/firefox-96.0.3.tar.bz2";
       locale = "uk";
       arch = "linux-i686";
-      sha256 = "b3e5b473ef65142c874db372f0e91d9bccb98cdd036b6836d152763e3da9e91f";
+      sha256 = "a6df28358b227cbc03887ecc6e3ef516a71b09050fed3ba19f13a7bba8fe7f3f";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/ur/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/ur/firefox-96.0.3.tar.bz2";
       locale = "ur";
       arch = "linux-i686";
-      sha256 = "9cab179f8d78ff1e560b8abfe16a9c706196edadbe89533fd5fdf249922c978c";
+      sha256 = "0eb5d0680e985acc6bd5dc9602080c953a0664260e0ad62ba697b9a13b0282ca";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/uz/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/uz/firefox-96.0.3.tar.bz2";
       locale = "uz";
       arch = "linux-i686";
-      sha256 = "69f13464ba86fe89e601752dbb0a65f3c9f2d1316708830ec049f0b98933e4b1";
+      sha256 = "a1916a60680587dad773be1a63eb6a8959d84d08ffd3aaf9c062d12a7bb9f1fa";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/vi/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/vi/firefox-96.0.3.tar.bz2";
       locale = "vi";
       arch = "linux-i686";
-      sha256 = "87fbc304b7a1da8b27cc2b1e3d15c6206293bdc3d535a98afcc9020b5ed205d9";
+      sha256 = "b4072149b45d7514af7260f1f13605823dc3420c5f45198266503f3a9e42119f";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/xh/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/xh/firefox-96.0.3.tar.bz2";
       locale = "xh";
       arch = "linux-i686";
-      sha256 = "cdcc87ed3e583f4a1720fe3fc8a9fa4d1241e999cd334c6caa9cf7692901807a";
+      sha256 = "ed0c483448b2eeff1adac520be15dee6ecff162f0420669902e565eaf30e0dd2";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/zh-CN/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/zh-CN/firefox-96.0.3.tar.bz2";
       locale = "zh-CN";
       arch = "linux-i686";
-      sha256 = "4c19940887575f104a1f54a7cfdf98899894a51242cd3fe619512114fd8cc22a";
+      sha256 = "c1416988cbff23e6a68a04ff54b65fe11909dba59e9a0b2709a5ce4599a9d8aa";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.2/linux-i686/zh-TW/firefox-96.0.2.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/96.0.3/linux-i686/zh-TW/firefox-96.0.3.tar.bz2";
       locale = "zh-TW";
       arch = "linux-i686";
-      sha256 = "0da0137f4abf987b7e8f20e49d6b04ba83f6f54e16d3fe9cb57ec2be8a6e6902";
+      sha256 = "ee7b2c30ae3e685f631a132ef1992b6b59c189781385ef0823330ee24fd4d43e";
     }
     ];
 }
diff --git a/pkgs/applications/networking/browsers/firefox/packages.nix b/pkgs/applications/networking/browsers/firefox/packages.nix
index e0d75d9fc36b..6fc369c60dc6 100644
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@@ -7,10 +7,10 @@ in
 rec {
   firefox = common rec {
     pname = "firefox";
-    version = "96.0.2";
+    version = "96.0.3";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "5ceb1f023a9217c6a9c08b6525882d4091f989859cf209cc1d0ea22c846d05a967e1c47102ae052f7a5029d18118a558dd96da00437ee2c6fbf2896caf99d9dd";
+      sha512 = "3dd5fbc96e369d5f4fb3eca778c2bd3e2313d089f867de9fac3556810a797e9b5629ef1b8840fb2f22a18df7de95ea1993eee052f691d861a555cea544b05966";
     };
 
     meta = {
@@ -32,10 +32,10 @@ rec {
 
   firefox-esr-91 = common rec {
     pname = "firefox-esr";
-    version = "91.5.0esr";
+    version = "91.5.1esr";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "1712415b6b73c6a21edfefc39eaba5fcbbca54032f78627c0005d291501d16ef4daffb8b9a160d1d5361113ceba04eb5ddb21d903e3dd8d58838aa9596f2d781";
+      sha512 = "26239e7a94b79f1e24a6667d7cf1c398d75992e8850144affbc5d3f34f04b91f0c9b020cab662b2cd4927924839ff2ddd2f3605c537bb5494fd9ac0d951b14fa";
     };
 
     meta = {
diff --git a/pkgs/applications/networking/browsers/google-chrome/default.nix b/pkgs/applications/networking/browsers/google-chrome/default.nix
index e93ea8ca66d1..b0fc87a18014 100644
--- a/pkgs/applications/networking/browsers/google-chrome/default.nix
+++ b/pkgs/applications/networking/browsers/google-chrome/default.nix
@@ -142,8 +142,9 @@ in stdenv.mkDerivation {
     makeWrapper "$out/share/google/$appname/google-$appname" "$exe" \
       --prefix LD_LIBRARY_PATH : "$rpath" \
       --prefix PATH            : "$binpath" \
-      --prefix XDG_DATA_DIRS   : "$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH:${addOpenGLRunpath.driverLink}/share" \
-      --add-flags ${escapeShellArg commandLineArgs}
+      --prefix XDG_DATA_DIRS   : "$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH" \
+      --add-flags ${escapeShellArg commandLineArgs} \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform --ozone-platform=wayland}}"
 
     for elf in $out/share/google/$appname/{chrome,chrome-sandbox,${crashpadHandlerBinary},nacl_helper}; do
       patchelf --set-rpath $rpath $elf
diff --git a/pkgs/applications/networking/instant-messengers/discord/linux.nix b/pkgs/applications/networking/instant-messengers/discord/linux.nix
index 866b28890948..c9e642aceb99 100644
--- a/pkgs/applications/networking/instant-messengers/discord/linux.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/linux.nix
@@ -80,6 +80,7 @@ stdenv.mkDerivation rec {
 
     wrapProgram $out/opt/${binaryName}/${binaryName} \
         "''${gappsWrapperArgs[@]}" \
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform --ozone-platform=wayland}}" \
         --prefix XDG_DATA_DIRS : "${gtk3}/share/gsettings-schemas/${gtk3.name}/" \
         --prefix LD_LIBRARY_PATH : ${libPath}:$out/opt/${binaryName}
 
diff --git a/pkgs/applications/networking/instant-messengers/element/element-desktop.nix b/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
index 1a0c25c606b0..5ba7a1f7b205 100644
--- a/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
@@ -12,8 +12,6 @@
 , Security
 , AppKit
 , CoreServices
-
-, useWayland ? false
 }:
 
 let
@@ -82,7 +80,8 @@ mkYarnPackage rec {
     # LD_PRELOAD workaround for sqlcipher not found: https://github.com/matrix-org/seshat/issues/102
     makeWrapper '${electron_exec}' "$out/bin/${executableName}" \
       --set LD_PRELOAD ${sqlcipher}/lib/libsqlcipher.so \
-      --add-flags "$out/share/element/electron${lib.optionalString useWayland " --enable-features=UseOzonePlatform --ozone-platform=wayland"}"
+      --add-flags "$out/share/element/electron" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform --ozone-platform=wayland}}"
   '';
 
   # Do not attempt generating a tarball for element-web again.
diff --git a/pkgs/applications/networking/instant-messengers/gajim/default.nix b/pkgs/applications/networking/instant-messengers/gajim/default.nix
index 05a8b9969575..3c56d84db4b5 100644
--- a/pkgs/applications/networking/instant-messengers/gajim/default.nix
+++ b/pkgs/applications/networking/instant-messengers/gajim/default.nix
@@ -87,7 +87,6 @@ python3.pkgs.buildPythonApplication rec {
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [ raskin abbradar ];
     downloadPage = "http://gajim.org/downloads.php";
-    updateWalker = true;
     platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/applications/networking/instant-messengers/mcabber/default.nix b/pkgs/applications/networking/instant-messengers/mcabber/default.nix
index 2ca94953c4f6..3acd11a9a0d3 100644
--- a/pkgs/applications/networking/instant-messengers/mcabber/default.nix
+++ b/pkgs/applications/networking/instant-messengers/mcabber/default.nix
@@ -38,8 +38,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2;
     maintainers = with maintainers; [ pSub ];
     platforms = with platforms; linux;
-    updateWalker = true;
     downloadPage = "http://mcabber.com/files/";
-    downloadURLRegexp = "mcabber-[0-9.]+[.]tar[.][a-z0-9]+$";
   };
 }
diff --git a/pkgs/applications/networking/instant-messengers/schildichat/schildichat-desktop.nix b/pkgs/applications/networking/instant-messengers/schildichat/schildichat-desktop.nix
index 4e1d330f5000..f16c7b599e4a 100644
--- a/pkgs/applications/networking/instant-messengers/schildichat/schildichat-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/schildichat/schildichat-desktop.nix
@@ -7,13 +7,13 @@
 , makeDesktopItem
 , copyDesktopItems
 , fetchYarnDeps
-, yarn, nodejs, fixup_yarn_lock
+, yarn
+, nodejs
+, fixup_yarn_lock
 , electron
 , Security
 , AppKit
 , CoreServices
-
-, useWayland ? false
 }:
 
 let
@@ -88,7 +88,8 @@ stdenv.mkDerivation rec {
 
     # executable wrapper
     makeWrapper '${electron_exec}' "$out/bin/${executableName}" \
-      --add-flags "$out/share/element/electron${lib.optionalString useWayland " --enable-features=UseOzonePlatform --ozone-platform=wayland"}"
+      --add-flags "$out/share/element/electron" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform --ozone-platform=wayland}}"
 
     runHook postInstall
   '';
@@ -101,17 +102,17 @@ stdenv.mkDerivation rec {
   # https://github.com/schildichat/element-desktop/blob/sc/package.json
   desktopItems = [
     (makeDesktopItem {
-     name = "schildichat-desktop";
-     exec = "${executableName} %u";
-     icon = "schildichat";
-     desktopName = "SchildiChat";
-     genericName = "Matrix Client";
-     comment = meta.description;
-     categories = "Network;InstantMessaging;Chat;";
-     extraEntries = ''
-       StartupWMClass=schildichat
-       MimeType=x-scheme-handler/element;
-     '';
+      name = "schildichat-desktop";
+      exec = "${executableName} %u";
+      icon = "schildichat";
+      desktopName = "SchildiChat";
+      genericName = "Matrix Client";
+      comment = meta.description;
+      categories = "Network;InstantMessaging;Chat;";
+      extraEntries = ''
+        StartupWMClass=schildichat
+        MimeType=x-scheme-handler/element;
+      '';
     })
   ];
 
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
index f1bcd1012797..7489e765acac 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@@ -24,7 +24,7 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "signal-desktop";
-  version = "5.27.1"; # Please backport all updates to the stable channel.
+  version = "5.29.1"; # Please backport all updates to the stable channel.
   # All releases have a limited lifetime and "expire" 90 days after the release.
   # When releases "expire" the application becomes unusable until an update is
   # applied. The expiration date for the current release can be extracted with:
@@ -34,7 +34,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "0z0v7q0rpxdx7ic78jv7wp1hq8nrfp51jjdr6d85x0hsfdj0z1mc";
+    sha256 = "1a56mnmv0lnizmd4dl8fya3mdsy0jy5qr5bqb72m9cipq0069alc";
   };
 
   nativeBuildInputs = [
@@ -123,6 +123,7 @@ in stdenv.mkDerivation rec {
     gappsWrapperArgs+=(
       --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ stdenv.cc.cc ] }"
       ${customLanguageWrapperArgs}
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform --ozone-platform=wayland}}"
     )
 
     # Fix the desktop link
diff --git a/pkgs/applications/networking/instant-messengers/slack/default.nix b/pkgs/applications/networking/instant-messengers/slack/default.nix
index 5e0175518716..2ba8fcf579c9 100644
--- a/pkgs/applications/networking/instant-messengers/slack/default.nix
+++ b/pkgs/applications/networking/instant-messengers/slack/default.nix
@@ -84,7 +84,7 @@ let
     homepage = "https://slack.com";
     license = licenses.unfree;
     maintainers = with maintainers; [ mmahut ];
-    platforms = [ "x86_64-darwin" "x86_64-linux" "aarch64-darwin"];
+    platforms = [ "x86_64-darwin" "x86_64-linux" "aarch64-darwin" ];
   };
 
   linux = stdenv.mkDerivation rec {
@@ -170,7 +170,8 @@ let
       rm $out/bin/slack
       makeWrapper $out/lib/slack/slack $out/bin/slack \
         --prefix XDG_DATA_DIRS : $GSETTINGS_SCHEMAS_PATH \
-        --prefix PATH : ${lib.makeBinPath [xdg-utils]}
+        --prefix PATH : ${lib.makeBinPath [xdg-utils]} \
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform --ozone-platform=wayland}}"
 
       # Fix the desktop link
       substituteInPlace $out/share/applications/slack.desktop \
diff --git a/pkgs/applications/networking/nextcloud-client/default.nix b/pkgs/applications/networking/nextcloud-client/default.nix
index bbdddbf60682..874c0f8a177f 100644
--- a/pkgs/applications/networking/nextcloud-client/default.nix
+++ b/pkgs/applications/networking/nextcloud-client/default.nix
@@ -21,13 +21,13 @@
 
 mkDerivation rec {
   pname = "nextcloud-client";
-  version = "3.4.1";
+  version = "3.4.2";
 
   src = fetchFromGitHub {
     owner = "nextcloud";
     repo = "desktop";
     rev = "v${version}";
-    sha256 = "sha256-1fUk4PUFkWcLOvrYvM+K+ZarUSeq/JtDU2bHHPoAoC8=";
+    sha256 = "sha256-cqpdn2STxJtUTBRFrUh1lRIDaFZfrRkJMxcJuTKxgk8=";
   };
 
   patches = [
diff --git a/pkgs/applications/office/qownnotes/default.nix b/pkgs/applications/office/qownnotes/default.nix
index c6ee045dfbf9..2f2446169891 100644
--- a/pkgs/applications/office/qownnotes/default.nix
+++ b/pkgs/applications/office/qownnotes/default.nix
@@ -5,13 +5,13 @@
 
 mkDerivation rec {
   pname = "qownnotes";
-  version = "22.1.9";
+  version = "22.1.10.1";
 
   src = fetchurl {
     url = "https://download.tuxfamily.org/${pname}/src/${pname}-${version}.tar.xz";
     # Fetch the checksum of current version with curl:
     # curl https://download.tuxfamily.org/qownnotes/src/qownnotes-<version>.tar.xz.sha256
-    sha256 = "sha256-vUYfZpqOe7cZJxrNPXN2gCyNRNqC2/NA83+UCL9+mq0=";
+    sha256 = "sha256-uXDkLDDIRGSxXCczG9TQxtcLFjjOjKtyl/LRMax7JX4=";
   };
 
   nativeBuildInputs = [ qmake qttools ];
diff --git a/pkgs/applications/office/scribus/unstable.nix b/pkgs/applications/office/scribus/unstable.nix
index 6aed41d7f9af..21adb90cab9e 100644
--- a/pkgs/applications/office/scribus/unstable.nix
+++ b/pkgs/applications/office/scribus/unstable.nix
@@ -83,6 +83,11 @@ mkDerivation rec {
     qttools
   ];
 
+  cmakeFlags = [
+    # poppler uses std::optional
+    "-DWANT_CPP17=ON"
+  ];
+
   meta = with lib; {
     maintainers = with maintainers; [
       erictapen
diff --git a/pkgs/applications/radio/soapyhackrf/default.nix b/pkgs/applications/radio/soapyhackrf/default.nix
index 8fe3dc90008f..1d2aaca9362b 100644
--- a/pkgs/applications/radio/soapyhackrf/default.nix
+++ b/pkgs/applications/radio/soapyhackrf/default.nix
@@ -3,7 +3,7 @@
 } :
 
 let
-  version = "0.3.3";
+  version = "0.3.4";
 
 in stdenv.mkDerivation {
   pname = "soapyhackrf";
@@ -13,7 +13,7 @@ in stdenv.mkDerivation {
     owner = "pothosware";
     repo = "SoapyHackRF";
     rev = "soapy-hackrf-${version}";
-    sha256 = "1awn89z462500gb3fjb7x61b1znkjri9n1d39bqfip1qk4s11pxc";
+    sha256 = "sha256-fzPYHJAPX8FkFxPXpLlUagTd/NoamRX0YnxHwkbV1nI=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/applications/science/logic/leo2/default.upstream b/pkgs/applications/science/logic/leo2/default.upstream
deleted file mode 100644
index 52b8ed1cdaa2..000000000000
--- a/pkgs/applications/science/logic/leo2/default.upstream
+++ /dev/null
@@ -1,6 +0,0 @@
-url http://page.mi.fu-berlin.de/cbenzmueller/leo/download.html
-version_link '[.]tgz'
-version '.*_v([0-9.]+)[.][a-z0-9]+$' '\1'
-do_overwrite () {
-  do_overwrite_just_version
-}
diff --git a/pkgs/applications/science/logic/potassco/clingo.upstream b/pkgs/applications/science/logic/potassco/clingo.upstream
deleted file mode 100644
index 062577d1451b..000000000000
--- a/pkgs/applications/science/logic/potassco/clingo.upstream
+++ /dev/null
@@ -1,6 +0,0 @@
-target clingo.nix
-attribute_name clingo
-url https://github.com/potassco/clingo/releases/
-ensure_choice
-version '.*/v([0-9.]+)[.]tar[.].*' '\1'
-minimize_overwrite
diff --git a/pkgs/applications/science/logic/satallax/default.nix b/pkgs/applications/science/logic/satallax/default.nix
index 9bfad1fa010e..7a523bbf24ef 100644
--- a/pkgs/applications/science/logic/satallax/default.nix
+++ b/pkgs/applications/science/logic/satallax/default.nix
@@ -66,6 +66,5 @@ stdenv.mkDerivation rec {
     platforms = lib.platforms.linux;
     downloadPage = "http://www.ps.uni-saarland.de/~cebrown/satallax/downloads.php";
     homepage = "http://www.ps.uni-saarland.de/~cebrown/satallax/index.php";
-    updateWalker = true;
   };
 }
diff --git a/pkgs/applications/science/math/pari/default.nix b/pkgs/applications/science/math/pari/default.nix
index 4ba1d5c6b474..a9c002d210f2 100644
--- a/pkgs/applications/science/math/pari/default.nix
+++ b/pkgs/applications/science/math/pari/default.nix
@@ -82,6 +82,5 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ ertes AndersonTorres ] ++ teams.sage.members;
     platforms = platforms.linux ++ platforms.darwin;
-    updateWalker = true;
   };
 }
diff --git a/pkgs/applications/science/math/ratpoints/default.nix b/pkgs/applications/science/math/ratpoints/default.nix
index ec5d9ef366f8..dd8258a3456d 100644
--- a/pkgs/applications/science/math/ratpoints/default.nix
+++ b/pkgs/applications/science/math/ratpoints/default.nix
@@ -31,6 +31,5 @@ stdenv.mkDerivation rec {
     maintainers = [lib.maintainers.raskin];
     platforms = lib.platforms.unix;
     homepage = "http://www.mathe2.uni-bayreuth.de/stoll/programs/";
-    updateWalker = true;
   };
 }
diff --git a/pkgs/applications/science/misc/golly/default.upstream b/pkgs/applications/science/misc/golly/default.upstream
deleted file mode 100644
index e8ce81586a8d..000000000000
--- a/pkgs/applications/science/misc/golly/default.upstream
+++ /dev/null
@@ -1,5 +0,0 @@
-url https://sourceforge.net/projects/golly/files/golly/
-version_link '[-][0-9.]+/$'
-SF_version_tarball 'src'
-SF_redirect
-minimize_overwrite
diff --git a/pkgs/applications/science/misc/root/default.nix b/pkgs/applications/science/misc/root/default.nix
index 9962b1ce60f5..f8037c01e087 100644
--- a/pkgs/applications/science/misc/root/default.nix
+++ b/pkgs/applications/science/misc/root/default.nix
@@ -120,7 +120,6 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [
     "-Drpath=ON"
-    "-DCMAKE_CXX_STANDARD=17"
     "-DCMAKE_INSTALL_BINDIR=bin"
     "-DCMAKE_INSTALL_LIBDIR=lib"
     "-DCMAKE_INSTALL_INCLUDEDIR=include"
@@ -176,7 +175,8 @@ stdenv.mkDerivation rec {
   postInstall = ''
     for prog in rootbrowse rootcp rooteventselector rootls rootmkdir rootmv rootprint rootrm rootslimtree; do
       wrapProgram "$out/bin/$prog" \
-        --prefix PYTHONPATH : "$out/lib"
+        --set PYTHONPATH "$out/lib" \
+        --set ${lib.optionalString stdenv.isDarwin "DY"}LD_LIBRARY_PATH "$out/lib"
     done
   '';
 
diff --git a/pkgs/applications/version-management/mercurial/default.nix b/pkgs/applications/version-management/mercurial/default.nix
index 85993487fb37..405b9394552c 100644
--- a/pkgs/applications/version-management/mercurial/default.nix
+++ b/pkgs/applications/version-management/mercurial/default.nix
@@ -92,7 +92,6 @@ let
       downloadPage = "https://www.mercurial-scm.org/release/";
       license = licenses.gpl2Plus;
       maintainers = with maintainers; [ eelco lukegb pacien ];
-      updateWalker = true;
       platforms = platforms.unix;
     };
   };
diff --git a/pkgs/applications/version-management/monotone/default.upstream b/pkgs/applications/version-management/monotone/default.upstream
deleted file mode 100644
index e0d01fb190c6..000000000000
--- a/pkgs/applications/version-management/monotone/default.upstream
+++ /dev/null
@@ -1,8 +0,0 @@
-url http://www.monotone.ca/downloads.php
-
-do_overwrite(){
-  ensure_version
-  ensure_hash
-  set_var_value version $CURRENT_VERSION
-  set_var_value sha256 $CURRENT_HASH
-}
diff --git a/pkgs/applications/video/kodi/addons/controller-topology-project/default.nix b/pkgs/applications/video/kodi/addons/controller-topology-project/default.nix
new file mode 100644
index 000000000000..2607ee64f70a
--- /dev/null
+++ b/pkgs/applications/video/kodi/addons/controller-topology-project/default.nix
@@ -0,0 +1,35 @@
+{ lib, stdenv, fetchFromGitHub, toKodiAddon, addonDir }:
+let
+  drv = stdenv.mkDerivation {
+    pname = "controller-topology-project";
+    version = "unstable-2022-01-22";
+
+    src = fetchFromGitHub {
+      owner = "kodi-game";
+      repo = "controller-topology-project";
+      rev = "e2a9bac903f21b2acfeee374070cfc97d03aba2d";
+      sha256 = "sha256-o6uKxOjEYNAK27drvNOokOFPdjkOEnr49mBre9ycM0w=";
+    };
+
+    postPatch = ''
+      # remove addons already included in the base kodi package
+      rm -r addons/game.controller.default
+      rm -r addons/game.controller.snes
+    '';
+
+    installPhase = ''
+      runHook preInstall
+      mkdir -p $out${addonDir}
+      cp -r addons/* $out${addonDir}
+      runHook postInstall
+    '';
+
+    meta = with lib; {
+      homepage = "https://github.com/kodi-game/controller-topology-project";
+      description = "Models how controllers connect to and map to each other for all gaming history";
+      license = with licenses; [ odbl ];
+      maintainers = teams.kodi.members;
+    };
+  };
+in
+  toKodiAddon drv
diff --git a/pkgs/applications/video/kodi/addons/controllers/default.nix b/pkgs/applications/video/kodi/addons/controllers/default.nix
deleted file mode 100644
index 825ad5d53fc4..000000000000
--- a/pkgs/applications/video/kodi/addons/controllers/default.nix
+++ /dev/null
@@ -1,22 +0,0 @@
-{ lib, buildKodiAddon, fetchFromGitHub, controller }:
-buildKodiAddon rec {
-  pname = "game-controller-${controller}";
-  namespace = "game.controller.${controller}";
-  version = "1.0.3";
-
-  sourceDir = "addons/" + namespace;
-
-  src = fetchFromGitHub {
-    owner = "kodi-game";
-    repo = "kodi-game-controllers";
-    rev = "01acb5b6e8b85392b3cb298b034aadb1b24ccf18";
-    sha256 = "0sbc0w0fwbp7rbmbgb6a1kglhnn5g85hijcbbvf5x6jdq9v3f1qb";
-  };
-
-  meta = with lib; {
-    description = "Add support for different gaming controllers.";
-    platforms = platforms.all;
-    license = licenses.odbl;
-    maintainers = teams.kodi.members;
-  };
-}
diff --git a/pkgs/build-support/trivial-builders/test/references.nix b/pkgs/build-support/trivial-builders/test/references.nix
index a2bee51b13e7..989722121cb0 100644
--- a/pkgs/build-support/trivial-builders/test/references.nix
+++ b/pkgs/build-support/trivial-builders/test/references.nix
@@ -28,7 +28,7 @@ nixosTest {
     virtualisation.writableStore = true;
 
     # Test runs without network, so we don't substitute and prepare our deps
-    nix.binaryCaches = lib.mkForce [];
+    nix.settings.substituters = lib.mkForce [];
     environment.etc."pre-built-paths".source = writeText "pre-built-paths" (
       builtins.toJSON [hello figlet stdenvNoCC]
     );
diff --git a/pkgs/build-support/upstream-updater/attrset-to-dir.nix b/pkgs/build-support/upstream-updater/attrset-to-dir.nix
deleted file mode 100644
index 006537278dae..000000000000
--- a/pkgs/build-support/upstream-updater/attrset-to-dir.nix
+++ /dev/null
@@ -1,19 +0,0 @@
-a :
-a.stdenv.mkDerivation {
-  buildCommand = ''
-    mkdir -p "$out/attributes"
-  '' + (a.lib.concatStrings (map
-    (n: ''
-      ln -s "${a.writeTextFile {name=n; text=builtins.getAttr n a.theAttrSet;}}" $out/attributes/${n};
-    '')
-    (builtins.attrNames a.theAttrSet)
-  ));
-
-  name = "attribute-set";
-  meta = {
-    description = "Contents of an attribute set";
-    maintainers = [
-      a.lib.maintainers.raskin
-    ];
-  };
-}
diff --git a/pkgs/build-support/upstream-updater/create-src-info-git.sh b/pkgs/build-support/upstream-updater/create-src-info-git.sh
deleted file mode 100755
index 6687a1f8f411..000000000000
--- a/pkgs/build-support/upstream-updater/create-src-info-git.sh
+++ /dev/null
@@ -1,24 +0,0 @@
-#! /bin/sh
-
-[ -z "$1" ] && {
-  echo "Use $0 expression-basename repo-url branch-name package-base-name"
-  echo "Like:"
-  echo "$0 default http://git.example.com/repo origin/master hello"
-  exit 1;
-} >&2
-
-own_dir="$(cd "$(dirname "$0")"; sh -c pwd)"
-
-cp "$own_dir/../builder-defs/template-bdp-uud.nix" "$1.nix" 
-sed -e "s@src-for-default.nix@src-for-$1.nix@g; 
-    s@fetchUrlFromSrcInfo@fetchGitFromSrcInfo@g" -i "$1.nix"
-echo '{}' > "src-for-$1.nix"
-cat << EOF > src-info-for-$1.nix
-{
-  repoUrl = "$2";
-  rev = "$3";
-  baseName = "$4";
-  method = "fetchgit";
-}
-EOF
-
diff --git a/pkgs/build-support/upstream-updater/create-src-info.sh b/pkgs/build-support/upstream-updater/create-src-info.sh
deleted file mode 100755
index fbbbe33a9e7b..000000000000
--- a/pkgs/build-support/upstream-updater/create-src-info.sh
+++ /dev/null
@@ -1,20 +0,0 @@
-#! /bin/sh
-
-[ -z "$1" ] && {
-  echo "Use $0 expression-basename download-page package-base-name"
-  echo "Like:"
-  echo "$0 default http://example.com/downloads hello"
-  exit 1;
-} >&2
-
-own_dir="$(cd "$(dirname "$0")"; sh -c pwd)"
-
-cp "$own_dir/../builder-defs/template-auto-callable.nix" "$1.nix" 
-sed -e "s@src-for-default.nix@src-for-$1.nix@g" -i "$1.nix"
-echo '{}' > "src-for-$1.nix"
-cat << EOF > src-info-for-$1.nix
-{
-  downloadPage = "$2";
-  baseName = "$3";
-}
-EOF
diff --git a/pkgs/build-support/upstream-updater/design.txt b/pkgs/build-support/upstream-updater/design.txt
deleted file mode 100644
index 128be89d2075..000000000000
--- a/pkgs/build-support/upstream-updater/design.txt
+++ /dev/null
@@ -1,29 +0,0 @@
-Next to file.nix we get src-for-file.nix 
-src-for-file.nix should evaluate to a flat attribute set with 
-string values.
-It is supposed to be imported in the main expression.
-In the ideal world it can export url, hash, version.
-
-src-for-file.nix generation is directed by 
-src-info-for-file.nix.
-
-Attributes:
-
-src-info-for-file.nix:
-
-downloadPage
-rev (for repos)
-baseName (default = unnamed-package)
-sourceRegexp (default = '.*[.]tar[.].*')
-choiceCommand (default = 'head -1')
-versionExtractorSedScript (default = 's/.*-([0-9.]+)[.].*/\1/')
-versionReferenceCreator (default = 's/-([0-9.]+)[.]/-${version}./')
-mirrorSedScript (default = none)
-
-src-for-file.nix:
-
-advertisedUrl (its match is the check for update presence)
-url
-hash
-version
-name
diff --git a/pkgs/build-support/upstream-updater/snippets.sh b/pkgs/build-support/upstream-updater/snippets.sh
deleted file mode 100644
index 2c06696c928f..000000000000
--- a/pkgs/build-support/upstream-updater/snippets.sh
+++ /dev/null
@@ -1,14 +0,0 @@
-# sed scripts
-
-#http://sourceforge.net/projects/webdruid/files/webdruid/0.6.0-alpha5/webdruid-0.6.0-alpha5.tar.gz/download
-#http://downloads.sourceforge.net/webdruid/files/webdruid/0.6.0-alpha5/webdruid-0.6.0-alpha5.tar.gz
-skipRedirectSF='s@sourceforge.net/projects@downloads.sourceforge.net/project@; s@/files@@; s@/download$@@;'
-extractReleaseSF='s@.*/([^/]+)/[^/]+@\1@'
-extractVersionSF='s@.*/[^/0-9]*([0-9].*)[.](tar|tgz|tbz2|zip).*@\1@'
-apacheMirror='s@http://www.apache.org/dist/@mirror://apache/@'
-skipRedirectApache='s@/dyn/closer.cgi[?]path=@/dist@'
-
-replaceAllVersionOccurences() {
-	echo s/"$version"/\${version}/g
-}
-dashDelimitedVersion='s/.*-([0-9.]+)-.*/\1/'
diff --git a/pkgs/build-support/upstream-updater/test-case.nix b/pkgs/build-support/upstream-updater/test-case.nix
deleted file mode 100644
index 498f15c28a78..000000000000
--- a/pkgs/build-support/upstream-updater/test-case.nix
+++ /dev/null
@@ -1,13 +0,0 @@
-{
-  a=1;
-  b="text";
-  c=''
-  text
-  '';
-  d=''
-    Multi-line text with special characters - 
-    like \ (backslash) and ''${} (dollar + 
-    curly braces) and $ (dollar) and ' (quote)
-    and " (double quote).
-  '';
-}
diff --git a/pkgs/build-support/upstream-updater/update-upstream-data.sh b/pkgs/build-support/upstream-updater/update-upstream-data.sh
deleted file mode 100755
index 38c0d13a723d..000000000000
--- a/pkgs/build-support/upstream-updater/update-upstream-data.sh
+++ /dev/null
@@ -1,182 +0,0 @@
-#! /bin/sh
-
-set -x
-
-own_dir="$(cd "$(dirname "$0")"; sh -c pwd)"
-
-source "$own_dir/snippets.sh"
-
-[ -z "$1" ] && {
-  echo "Specify main expression filename."
-  exit 1;
-}
-
-main_file="$1"
-main_dir="$(cd "$(dirname "$main_file")" ; sh -c pwd)"
-file_name="$(basename "$main_file")"
-defs_file="$main_dir"/src-info-for-"$file_name"
-src_file="$main_dir"/src-for-"$file_name"
-# OK, [vcs] revert is always possible
-new_src_file="$main_dir"/src-for-"$file_name"
-
-forcedUrl="$2"
-
-defs_dir="$("$own_dir"/attrset-to-dir.sh "$defs_file")"
-src_defs_dir="$("$own_dir"/attrset-to-dir.sh "$src_file")"
-
-getAttr () {
-    file="$defs_dir"/"$1"
-    data="$( ( [ -f "$file" ] && cat "$file" ) || echo "$2" )"
-    echo "attribute $1 obtained as: [[$data]]" >&2
-    echo "$data"
-}
-
-method="$(getAttr method fetchurl)"
-baseName="$(getAttr baseName 'unnamed-package')"
-commonPrefetchVars=" version name hash"
-
-prefetchClause=""
-[ fetchSFdirs = "$method" ] && {
-    if [ -z "$forcedUrl" ]; then 
-	freshUrl="$("$own_dir"/urls-from-page.sh "$(getAttr downloadPage)" |
-          eval "egrep '$(getAttr sourceRegexp '[-][0-9.]+/$')'" | 
-	  eval "egrep -v '$(getAttr blacklistRegexp '^$')'" |
-	  eval "$(getAttr choiceCommand 'head -n 1')" |
-	  eval "$(getAttr versionToFileCommand "sed -re 's@/([^/]*-[0-9.]+)/@/\1/\1$(getAttr fileSuffix .tar.gz)@'")" 
-	)"
-
-	if ! egrep ':' <<< "$freshUrl" ; then 
-		freshUrl="$(dirname "$(getAttr downloadPage).")/$freshUrl"
-	fi
-
-	echo "Found download link: $freshUrl" >&2
-    else
-        freshUrl="$forcedUrl"
-    fi
-
-    freshUrl="$(echo "$freshUrl" | sed -re "$skipRedirectSF")"
-    echo "Sourceforge-corrected URL: $freshUrl" >&2
-    
-    version="$(echo "$freshUrl" | 
-      sed -re "$(getAttr versionExtractorSedScript "$extractVersionSF")")"
-    baseName="$(getAttr baseName "$(echo "$freshUrl" | sed -re 's@.*/project/([^/]+)/.*@\1@')")"
-    url="$freshUrl"
-    name="$baseName-$version"
-    advertisedUrl="$freshUrl"
-
-    if [ x"$freshUrl" = x"$(cat "$src_defs_dir"/advertisedUrl)" ]; then
-        echo "Source link not changed" >&2
-        exit
-    fi
-    hash=$(nix-prefetch-url "$freshUrl")
-
-    prefetchVars="url advertisedUrl";
-}
-[ fetchSF = "$method" ] && {
-    if [ -z "$forcedUrl" ]; then 
-	freshUrl="$("$own_dir"/urls-from-page.sh "$(getAttr downloadPage)" |
-          eval "egrep \"$(getAttr sourceRegexp '.*[.]tar[.].*|.*[.]tgz$|.*[.]tbz2$')\"" | 
-	  eval "egrep -v \"$(getAttr blacklistRegexp '^$')\"" |
-          eval "$(getAttr choiceCommand 'head -1')")"
-
-	if ! egrep ':' <<< "$freshUrl" ; then 
-		freshUrl="$(dirname "$(getAttr downloadPage).")/$freshUrl"
-	fi
-
-	echo "Found download link: $freshUrl" >&2
-    else
-        freshUrl="$forcedUrl"
-    fi
-
-    freshUrl="$(echo "$freshUrl" | sed -re "$skipRedirectSF")"
-    echo "Sourceforge-corrected URL: $freshUrl" >&2
-    
-    version="$(echo "$freshUrl" | 
-      sed -re "$(getAttr versionExtractorSedScript "$extractVersionSF")")"
-    baseName="$(getAttr baseName "$(echo "$freshUrl" | sed -re 's@.*/project/([^/]+)/.*@\1@')")"
-    url="$freshUrl"
-    name="$baseName-$version"
-    advertisedUrl="$freshUrl"
-
-    if [ x"$freshUrl" = x"$(cat "$src_defs_dir"/advertisedUrl)" ]; then
-        echo "Source link not changed" >&2
-        exit
-    fi
-    hash=$(nix-prefetch-url "$freshUrl")
-
-    prefetchVars="url advertisedUrl";
-}
-[ fetchurl = "$method" ] && {
-    if [ -z "$forcedUrl" ] ; then
-        freshUrl="$("$own_dir"/urls-from-page.sh "$(getAttr downloadPage)" |
-          eval "egrep \"$(getAttr sourceRegexp  '.*[.]tar[.].*|.*[.]tgz$|.*[.]tbz2$')\"" | 
-	  eval "egrep -v \"$(getAttr blacklistRegexp '^$')\"" |
-          eval "$(getAttr choiceCommand 'head -1')")"
-    
-        if ! egrep ':' <<< "$freshUrl" ; then 
-    	    freshUrl="$(dirname "$(getAttr downloadPage).")/$freshUrl"
-        fi
-    
-        echo "Found download link: $freshUrl" >&2
-    else
-        freshUrl="$forcedUrl"
-    fi
-    
-    version="$(echo "$freshUrl" | 
-      eval "sed -re \"$(getAttr versionExtractorSedScript \
-        's/.*-([0-9.]+)[.].*/\1/')\"")"
-    
-    mirrorUrl="$(echo "$freshUrl" | 
-      eval "sed -r -e \"$(getAttr versionReferenceCreator \
-        's/-'"${version}"'[.]/-\${version}./')\"" |
-      eval "sed -r -e \"$(getAttr mirrorSedScript)\"")"
-    url="$mirrorUrl"
-    
-    name="$baseName-$version"
-    
-    advertisedUrl="$freshUrl"
-    url="$mirrorUrl"
-    
-    if [ x"$freshUrl" = x"$(cat "$src_defs_dir"/advertisedUrl)" ]; then
-        echo "Source link not changed" >&2
-        exit
-    fi
-    hash=$(nix-prefetch-url "$freshUrl")
-
-    prefetchVars="url advertisedUrl";
-}
-[ "fetchgit" = "$method" ] && {
-    repoUrl="$(getAttr repoUrl)"
-    export NIX_PREFETCH_GIT_CHECKOUT_HOOK="
-        cat .git/HEAD
-    "
-    export NIX_HASH_ALGO=sha256
-    rev="$(getAttr rev '')";
-    rev_and_hash="$("$own_dir"/../fetchgit/nix-prefetch-git "$repoUrl" "$rev" | tee /dev/stderr | tail -2)"
-
-    rev="$(echo "$rev_and_hash" | head -1)"
-    url="$repoUrl";
-    hash="$(echo "$rev_and_hash" | tail -1)"
-    version="$rev"
-    name="$baseName-$version"
-
-    prefetchVars="rev url";
-}
-
-prefetchAssignments="";
-for i in $commonPrefetchVars $prefetchVars; do
-  prefetchAssignments="$prefetchAssignments $i=\"$(eval echo \"\$$i\")\";$(echo -e '\n  ')"
-done;
-
-extraAssignments=""
-for i in $(getAttr extraVars ''); do
-  eval "$(getAttr "eval_$i" 'i=""')"
-  extraAssignments="$extraAssignments $i=\"$(eval echo \"\$$i\")\";$(echo -e '\n  ')"
-done
-
-cat << EOF > "$new_src_file"
-rec {
-  $prefetchAssignments
-  $extraAssignments
-}
-EOF
diff --git a/pkgs/build-support/upstream-updater/update-walker-service-specific.sh b/pkgs/build-support/upstream-updater/update-walker-service-specific.sh
deleted file mode 100644
index d92d223845e6..000000000000
--- a/pkgs/build-support/upstream-updater/update-walker-service-specific.sh
+++ /dev/null
@@ -1,20 +0,0 @@
-SF_redirect () {
-  redirect 99
-  process 'http://[a-z]+[.]dl[.]sourceforge[.]net/' 'mirror://sourceforge/'
-  process '[?].*' ''
-}
-
-SF_version_dir () {
-  version_link 'http://sourceforge.net/.+/'"$1"'[0-9.]+/$'
-}
-
-SF_version_tarball () {
-  version_link "${1:-[.]tar[.]}.*/download\$"
-}
-
-GH_latest () {
-  prefetch_command_rel ../fetchgit/nix-prefetch-git
-  revision "$("$(dirname "$0")/urls-from-page.sh" "$CURRENT_URL/commits" | grep /commit/ | head -n 1 | xargs basename )"
-  version '.*' "git-$(date +%Y-%m-%d)"
-  NEED_TO_CHOOSE_URL=
-}
diff --git a/pkgs/build-support/upstream-updater/update-walker.sh b/pkgs/build-support/upstream-updater/update-walker.sh
deleted file mode 100755
index 9172a41718c8..000000000000
--- a/pkgs/build-support/upstream-updater/update-walker.sh
+++ /dev/null
@@ -1,320 +0,0 @@
-#! /bin/sh
-
-own_dir="$(cd "$(dirname "$0")"; pwd)"
-
-URL_WAS_SET=
-DL_URL_RE=
-CURRENT_URL=
-CURRENT_REV=
-PREFETCH_COMMAND=
-NEED_TO_CHOOSE_URL=1
-
-url () {
-  URL_WAS_SET=1
-  CURRENT_URL="$1"
-}
-
-dl_url_re () {
-  DL_URL_RE="$1"
-}
-
-version_unpack () {
-  sed -re '
-    s/[.]/ /g; 
-    s@/@ / @g
-    s/-(rc|pre)/ -1 \1 /g; 
-    s/-(gamma)/ -2 \1 /g; 
-    s/-(beta)/ -3 \1 /g; 
-    s/-(alpha)/ -4 \1 /g;
-    s/[-]/ - /g; 
-    '
-}
-
-version_repack () {
-  sed -re '
-    s/ - /-/g;
-    s/ -[0-9]+ ([a-z]+) /-\1/g;
-    s@ / @/@g
-    s/ /./g; 
-    '
-}
-
-version_sort () {
-  version_unpack | 
-    sort -t ' ' -n $(for i in $(seq 30); do echo " -k${i}n" ; done) | tac |
-    version_repack
-}
-
-position_choice () {
-  head -n "${1:-1}" | tail -n "${2:-1}"
-}
-
-matching_links () {
-  "$own_dir"/urls-from-page.sh "$CURRENT_URL" | grep -E "$1"
-}
-
-link () {
-  CURRENT_URL="$(matching_links "$1" | position_choice "$2" "$3")"
-  unset NEED_TO_CHOOSE_URL
-  echo "Linked by: $*"
-  echo "URL: $CURRENT_URL" >&2
-}
-
-version_link () {
-  CURRENT_URL="$(matching_links "$1" | version_sort | position_choice "$2" "$3")"
-  unset NEED_TO_CHOOSE_URL
-  echo "Linked version by: $*"
-  echo "URL: $CURRENT_URL" >&2
-}
-
-redirect () {
-  CURRENT_URL="$(curl -I -L --max-redirs "${1:-99}" "$CURRENT_URL" | 
-    grep -E '^[Ll]ocation: ' | position_choice "${2:-999999}" "$3" |
-    sed -e 's/^[Ll]ocation: //; s/\r//')"
-  echo "Redirected: $*"
-  echo "URL: $CURRENT_URL" >&2
-}
-
-replace () {
-  sed -re "s	$1	$2	g"
-}
-
-process () {
-  CURRENT_URL="$(echo "$CURRENT_URL" | replace "$1" "$2")"
-  echo "Processed: $*"
-  echo "URL: $CURRENT_URL" >&2
-}
-
-version () {
-  CURRENT_VERSION="$(echo "$CURRENT_URL" | replace "$1" "$2")"
-  echo "Version: $CURRENT_VERSION" >&2
-}
-
-ensure_version () {
-  echo "Ensuring version. CURRENT_VERSION: $CURRENT_VERSION" >&2
-  [ -z "$CURRENT_VERSION" ] && version '.*-([0-9.]+)[-._].*' '\1'
-}
-
-ensure_target () {
-  echo "Ensuring target. CURRENT_TARGET: $CURRENT_TARGET" >&2
-  [ -z "$CURRENT_TARGET" ] && target "$(basename "$CONFIG_NAME" .upstream).nix"
-}
-
-ensure_name () {
-  echo "Ensuring name. CURRENT_NAME: $CURRENT_NAME" >&2
-  [ -z "$CURRENT_NAME" ] && name "$(basename "$CONFIG_DIR")"
-  echo "Resulting name: $CURRENT_NAME"
-}
-
-ensure_attribute_name () {
-  echo "Ensuring attribute name. CURRENT_ATTRIBUTE_NAME: $CURRENT_ATTRIBUTE_NAME" >&2
-  ensure_name
-  [ -z "$CURRENT_ATTRIBUTE_NAME" ] && attribute_name "$CURRENT_NAME"
-  echo "Resulting attribute name: $CURRENT_ATTRIBUTE_NAME"
-}
-
-ensure_url () {
-  echo "Ensuring starting URL. CURRENT_URL: $CURRENT_URL" >&2
-  ensure_attribute_name
-  [ -z "$CURRENT_URL" ] && CURRENT_URL="$(retrieve_meta downloadPage)"
-  [ -z "$CURRENT_URL" ] && CURRENT_URL="$(retrieve_meta downloadpage)"
-  [ -z "$CURRENT_URL" ] && CURRENT_URL="$(retrieve_meta homepage)"
-  echo "Resulting URL: $CURRENT_URL"
-}
-
-ensure_choice () {
-  echo "Ensuring that choice is made." >&2
-  echo "NEED_TO_CHOOSE_URL: [$NEED_TO_CHOOSE_URL]." >&2
-  echo "CURRENT_URL: $CURRENT_URL" >&2
-  [ -z "$URL_WAS_SET" ] && [ -z "$CURRENT_URL" ] && ensure_url
-  [ -n "$NEED_TO_CHOOSE_URL" ] && {
-    version_link "${DL_URL_RE:-[.]tar[.]([^./])+\$}"
-    unset NEED_TO_CHOOSE_URL
-  }
-  [ -z "$CURRENT_URL" ] && {
-    echo "Error: empty CURRENT_URL"
-    echo "Error: empty CURRENT_URL" >&2
-    exit 1
-  }
-}
-
-revision () {
-  CURRENT_REV="$1"
-  echo "CURRENT_REV: $CURRENT_REV"
-}
-
-prefetch_command () {
-  PREFETCH_COMMAND="$1"
-}
-
-prefetch_command_rel () {
-  PREFETCH_COMMAND="$(dirname "$0")/$1"
-}
-
-ensure_hash () {
-  echo "Ensuring hash. CURRENT_HASH: $CURRENT_HASH" >&2
-  [ -z "$CURRENT_HASH" ] && hash
-}
-
-hash () {
-  CURRENT_HASH="$(${PREFETCH_COMMAND:-nix-prefetch-url} "$CURRENT_URL" $CURRENT_REV)"
-  echo "CURRENT_HASH: $CURRENT_HASH" >&2
-}
-
-name () {
-  CURRENT_NAME="$1"
-  echo "CURRENT_NAME: $CURRENT_NAME" >&2
-}
-
-attribute_name () {
-  CURRENT_ATTRIBUTE_NAME="$1"
-  echo "CURRENT_ATTRIBUTE_NAME: $CURRENT_ATTRIBUTE_NAME" >&2
-}
-
-retrieve_meta () {
-  nix-instantiate --eval-only '<nixpkgs>' -A "$CURRENT_ATTRIBUTE_NAME".meta."$1" | xargs
-}
-
-retrieve_version () {
-  PACKAGED_VERSION="$(retrieve_meta version)"
-}
-
-ensure_dl_url_re () {
-  echo "Ensuring DL_URL_RE. DL_URL_RE: $DL_URL_RE" >&2
-  [ -z "$DL_URL_RE" ] && dl_url_re "$(retrieve_meta downloadURLRegexp)"
-  echo "DL_URL_RE: $DL_URL_RE" >&2
-}
-
-directory_of () {
-  cd "$(dirname "$1")"; pwd
-}
-
-full_path () {
-  echo "$(directory_of "$1")/$(basename "$1")"
-}
-
-target () {
-  CURRENT_TARGET="$1"
-  { [ "$CURRENT_TARGET" = "${CURRENT_TARGET#/}" ] && CURRENT_TARGET="$CONFIG_DIR/$CURRENT_TARGET"; }
-  echo "Target set to: $CURRENT_TARGET"
-}
-
-marker () {
-  BEGIN_EXPRESSION="$1"
-}
-
-update_found () {
-  echo "Compare: $CURRENT_VERSION vs $PACKAGED_VERSION"
-  [ "$CURRENT_VERSION" != "$PACKAGED_VERSION" ]
-}
-
-do_write_expression () {
-  echo "${1}rec {"
-  echo "${1}  baseName=\"$CURRENT_NAME\";"
-  echo "${1}  version=\"$CURRENT_VERSION\";"
-  echo "${1}  name=\"\${baseName}-\${version}\";"
-  echo "${1}  hash=\"$CURRENT_HASH\";"
-  echo "${1}  url=\"$CURRENT_URL\";"
-  [ -n "$CURRENT_REV" ] && echo "${1}  rev=\"$CURRENT_REV\";"
-  echo "${1}  sha256=\"$CURRENT_HASH\";"
-  echo "$2"
-}
-
-line_position () {
-  file="$1"
-  regexp="$2"
-  count="${3:-1}"
-  grep -E "$regexp" -m "$count" -B 999999 "$file" | wc -l
-}
-
-replace_once () {
-  file="$1"
-  regexp="$2"
-  replacement="$3"
-  instance="${4:-1}"
-
-  echo "Replacing once:"
-  echo "file: [[$file]]"
-  echo "regexp: [[$regexp]]"
-  echo "replacement: [[$replacement]]"
-  echo "instance: [[$instance]]"
-
-  position="$(line_position "$file" "$regexp" "$instance")"
-  sed -re "${position}s	$regexp	$replacement	" -i "$file"
-}
-
-set_var_value () {
-  var="${1}"
-  value="${2}"
-  instance="${3:-1}"
-  file="${4:-$CURRENT_TARGET}"
-  no_quotes="${5:-0}"
-
-  quote='"'
-  let "$no_quotes" && quote=""
-
-  replace_once "$file" "${var} *= *.*" "${var} = ${quote}${value}${quote};" "$instance"
-}
-
-do_regenerate () {
-  BEFORE="$(cat "$1" | grep -F "$BEGIN_EXPRESSION" -B 999999;)"
-  AFTER_EXPANDED="$(cat "$1" | grep -F "$BEGIN_EXPRESSION" -A 999999 | grep -E '^ *[}] *; *$' -A 999999;)"
-  AFTER="$(echo "$AFTER_EXPANDED" | tail -n +2)"
-  CLOSE_BRACE="$(echo "$AFTER_EXPANDED" | head -n 1)"
-  SPACING="$(echo "$CLOSE_BRACE" | sed -re 's/[^ ].*//')"
-
-  echo "$BEFORE"
-  do_write_expression "$SPACING" "$CLOSE_BRACE"
-  echo "$AFTER"
-}
-
-do_overwrite () {
-  ensure_hash
-  do_regenerate "$1" > "$1.new.tmp"
-  mv "$1.new.tmp" "$1"
-}
-
-do_overwrite_just_version () {
-  ensure_hash
-  set_var_value version $CURRENT_VERSION
-  set_var_value sha256 $CURRENT_HASH
-}
-
-minimize_overwrite() {
-  do_overwrite(){
-    do_overwrite_just_version
-  }
-}
-
-process_config () {
-  CONFIG_DIR="$(directory_of "$1")"
-  CONFIG_NAME="$(basename "$1")"
-  BEGIN_EXPRESSION='# Generated upstream information';
-  if [ -f  "$CONFIG_DIR/$CONFIG_NAME" ] &&
-      [ "${CONFIG_NAME}" = "${CONFIG_NAME%.nix}" ]; then
-    source "$CONFIG_DIR/$CONFIG_NAME"
-  else
-    CONFIG_NAME="${CONFIG_NAME%.nix}"
-    ensure_attribute_name
-    [ -n "$(retrieve_meta updateWalker)" ] ||
-        [ -n "$FORCE_UPDATE_WALKER" ] || {
-      echo "Error: package not marked as safe for update-walker" >&2
-      echo "Set FORCE_UPDATE_WALKER=1 to override" >&2
-      exit 1;
-    }
-    [ -z "$(retrieve_meta fullRegenerate)" ] && eval "
-      minimize_overwrite
-    "
-  fi
-  ensure_attribute_name
-  retrieve_version
-  ensure_dl_url_re
-  ensure_choice
-  ensure_version
-  ensure_target
-  update_found && do_overwrite "$CURRENT_TARGET"
-}
-
-source "$own_dir/update-walker-service-specific.sh"
-
-process_config "$1"
diff --git a/pkgs/build-support/upstream-updater/update-walker.txt b/pkgs/build-support/upstream-updater/update-walker.txt
deleted file mode 100644
index ae47e5590294..000000000000
--- a/pkgs/build-support/upstream-updater/update-walker.txt
+++ /dev/null
@@ -1,118 +0,0 @@
-update-walker is an imperative semiautomated update helper.
-
-It runs the X.upstream file to find the freshest version of the package in
-the specified upstream source and updates the corresponding X.nix file.
-
-
-
-The simplest available commands:
-
-url: set the upstream source list URL equal to $1; the default is
-meta.downloadPage with meta.homepage fallback
-
-dl_url_re: set the regular expression used to select download links to $1; the
-default is meta.downloadURLRegexp or '[.]tar[.]([^./])+\$' if it is not set
-
-target: specify target expression; default is to replace .upstream extension
-with .nix extension
-
-name: specify the derivation name; default is the basename of the dirname
-of the .upstream file
-
-attribute_name: specify the attribute name to evaluate for getting the current
-version from meta.version; default is to use the derivation name
-
-minimize_overwrite: set config options that mean that only version= and
-sha256= have to be replaced; the default is to regenerate a full upstream
-description block with url, name, version, hash etc.
-
-
-
-A lot of packages can be updated in a pseudo-declarative style using only
-the commands from the previous paragraph.
-
-Some packages do not need any non-default settings, in these case just setting
-meta.updateWalker to true is enough, you can run update-walker directly on the
-.nix file afterwards. In this case minimize_overwrite it implied unless
-meta.fullRegenerate is set.
-
-
-
-The packages that require more fine-grained control than the described options
-allow, you need to take into account the default control flow of the tool.
-
-First, the definitions from update-walker script and additional definitions
-from update-walker-service-specific.sh are loaded. Then the config is executed
-as a shell script. Some of the commands it can use do remember whether they
-have been used. Afterwards the following steps happen: 
-
-attribute_name is set to name unless it has been already set
-
-meta.version is read from the NixPkgs package called attribute_name
-
-download URL regexp is set to default unless it has been already set in the
-updater script
-
-the download page URL gets set to default value unless it has been set
-previously
-
-if the action of getting the download page and choosing the freshest link by
-version has not yet been taken, it happens
-
-if the version has not yet been extracted from the URL, it gets extracted
-
-target nix expression to update gets set to the default value unless it has
-been set explicitly
-
-if the URL version is fresher than the packaged version, the new file gets
-downloaded and its hash is calculated
-
-do_overwrite function is called; the default calculates a big upstream data
-block and puts it after the '# Generated upstream information' marker (the
-marker can be changed by the command marker)
-
-
-
-If the update needs some special logic, it is put into the updater script and
-the corresponding steps are skipped because the needed action has already been
-performed. 
-
-For example: 
-
-minimize_overwrite is exactly the same as
-
-do_overwrite() { do_overwrite_just_version; }
-
-redefinition. You can do a more complex do_overwrite redifinition, if needed.
-It can probably use ensure_hash to download the source and calculate the hash
-and set_var_value.
-
-set_var_value alters the $3-th instance of assigning the $1 name in the
-expression to the value $2. $3 defaults to 1. It can modify $4 instead of the
-current target, it can put the value without quotes if $5 is 1.
-
-
-
-Typical steps include:
-
-ensure_choice: download current URL and find the freshest version link on the
-page, it is now the new URL
-
-ensure_hash: download current URL and calculate the source package hash
-
-ensure_version: extract version from the URL
-
-SF_redirect: replace the current URL with a SourceForge.net mirror:// URL
-
-SF_version_dir: assume SourceForge.net layout and choose the freshest
-version-named subdirectory in the file catalog; you can optionally specify $1
-as a directory name regexp (digits and periods will be required after it)
-
-SF_version_tarball: assume SourceForge.net layout and choose the freshest
-tarball download link
-
-version: apply replacement of $1 with $2 (extended regexp format) to extract
-the version from URL
-
-version_link: choose the freshest versioned link, $1 is the regexp of
-acceptable links
diff --git a/pkgs/data/misc/hackage/pin.json b/pkgs/data/misc/hackage/pin.json
index 6b2c5fc92553..c695ea268886 100644
--- a/pkgs/data/misc/hackage/pin.json
+++ b/pkgs/data/misc/hackage/pin.json
@@ -1,6 +1,6 @@
 {
-  "commit": "6f406277d7106375f7148466c985061d20cb028b",
-  "url": "https://github.com/commercialhaskell/all-cabal-hashes/archive/6f406277d7106375f7148466c985061d20cb028b.tar.gz",
-  "sha256": "0jvxybgv975lmk268x12dlp8xxv12vmpwc00k3nv6qqp0xd9bwla",
-  "msg": "Update from Hackage at 2022-01-18T22:54:05Z"
+  "commit": "3034b8f1052c41d5b3c571cb2bedb5f62bbede65",
+  "url": "https://github.com/commercialhaskell/all-cabal-hashes/archive/3034b8f1052c41d5b3c571cb2bedb5f62bbede65.tar.gz",
+  "sha256": "0kqga1mf7vr292jcaqw8qk4s1bjwc2z1wwjih5xwli3hkk584l20",
+  "msg": "Update from Hackage at 2022-01-24T10:21:35Z"
 }
diff --git a/pkgs/data/misc/poppler-data/default.nix b/pkgs/data/misc/poppler-data/default.nix
index d1e0434dc286..6d35279b6de2 100644
--- a/pkgs/data/misc/poppler-data/default.nix
+++ b/pkgs/data/misc/poppler-data/default.nix
@@ -1,20 +1,30 @@
-{ fetchurl, lib, stdenv, cmake, ninja }:
+{ fetchurl
+, lib
+, stdenv
+, cmake
+, ninja
+, poppler
+}:
 
 stdenv.mkDerivation rec {
-  name = "poppler-data-0.4.11";
+  pname = "poppler-data";
+  version = "0.4.11";
 
   src = fetchurl {
-    url = "https://poppler.freedesktop.org/${name}.tar.gz";
-    sha256 = "sha256-LOwFzRuwOvmKiwah4i9ubhplseLzgWyzBpuwh0gl8Iw=";
+    url = "https://poppler.freedesktop.org/${pname}-${version}.tar.gz";
+    sha256 = "LOwFzRuwOvmKiwah4i9ubhplseLzgWyzBpuwh0gl8Iw=";
   };
 
-  nativeBuildInputs = [ cmake ninja ];
+  nativeBuildInputs = [
+    cmake
+    ninja
+  ];
 
   meta = with lib; {
     homepage = "https://poppler.freedesktop.org/";
     description = "Encoding files for Poppler, a PDF rendering library";
     platforms = platforms.all;
     license = licenses.free; # more free licenses combined
-    maintainers = with maintainers; [ ];
+    maintainers = poppler.meta.maintainers;
   };
 }
diff --git a/pkgs/desktops/pantheon/apps/switchboard-plugs/network/default.nix b/pkgs/desktops/pantheon/apps/switchboard-plugs/network/default.nix
index 64a3083c6c2c..fbad5aa7a012 100644
--- a/pkgs/desktops/pantheon/apps/switchboard-plugs/network/default.nix
+++ b/pkgs/desktops/pantheon/apps/switchboard-plugs/network/default.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "switchboard-plug-network";
-  version = "2.4.1";
+  version = "2.4.2";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = pname;
     rev = version;
-    sha256 = "0nqihsbrpjw4nx1c50g854bqybniw38adi78vzg8nyl6ikj2r0z4";
+    sha256 = "sha256-CdSX4p98HQNC0VF5Ae/ZnDqm000+9KJ6JhQWhSHC4CI=";
   };
 
   patches = [
diff --git a/pkgs/desktops/pantheon/services/elementary-capnet-assist/default.nix b/pkgs/desktops/pantheon/services/elementary-capnet-assist/default.nix
index 588061b22e1b..24ce7b5ad56b 100644
--- a/pkgs/desktops/pantheon/services/elementary-capnet-assist/default.nix
+++ b/pkgs/desktops/pantheon/services/elementary-capnet-assist/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , nix-update-script
 , pkg-config
 , meson
@@ -20,24 +19,15 @@
 
 stdenv.mkDerivation rec {
   pname = "elementary-capnet-assist";
-  version = "2.4.0";
+  version = "2.4.1";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = "capnet-assist";
     rev = version;
-    sha256 = "sha256-UdkS+w61c8z2TCJyG7YsDb0n0b2LOpFyaHzMbdCJsZI=";
+    sha256 = "sha256-8hhp37EBzZxEVvPaRw9PohjaPWKQZ/AfqqvwLxQCBKk=";
   };
 
-  patches = [
-    # Fix build with meson 0.61
-    # https://github.com/elementary/capnet-assist/pull/76
-    (fetchpatch {
-      url = "https://github.com/elementary/capnet-assist/commit/0e77bf8023ba1b35e3a5badb72c246cabf6552b9.patch";
-      sha256 = "sha256-B/KEs/TCxR+i3uQSRtWxTi2+cu0n6QLcfKCbMCvSsvs=";
-    })
-  ];
-
   nativeBuildInputs = [
     desktop-file-utils
     meson
diff --git a/pkgs/desktops/pantheon/services/xdg-desktop-portal-pantheon/default.nix b/pkgs/desktops/pantheon/services/xdg-desktop-portal-pantheon/default.nix
index 3ceff2095d2b..614be5603a8e 100644
--- a/pkgs/desktops/pantheon/services/xdg-desktop-portal-pantheon/default.nix
+++ b/pkgs/desktops/pantheon/services/xdg-desktop-portal-pantheon/default.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xdg-desktop-portal-pantheon";
-  version = "1.0.1";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = "portals";
     rev = version;
-    sha256 = "sha256-8gBMjCMEzrFmKHhkXsgcIESC93EOT0ADkRUIJMmerjw=";
+    sha256 = "sha256-YICNOeNrpO2tJFyULjQEhZQCrrMyQau59EC7c5K9q40=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/compilers/fpc/default.upstream b/pkgs/development/compilers/fpc/default.upstream
deleted file mode 100644
index 9f16c1b645cd..000000000000
--- a/pkgs/development/compilers/fpc/default.upstream
+++ /dev/null
@@ -1,6 +0,0 @@
-url https://sourceforge.net/projects/freepascal/files/Source/
-SF_version_dir
-version_link 'fpcbuild-[0-9.]+[.]tar[.]gz/download$'
-SF_redirect
-version '.*-([0-9.]+)[.]tar[.]gz' '\1'
-do_overwrite () { do_overwrite_just_version; }
diff --git a/pkgs/development/compilers/sbcl/common.nix b/pkgs/development/compilers/sbcl/common.nix
index 9cfb38109f7b..6a3b40066d99 100644
--- a/pkgs/development/compilers/sbcl/common.nix
+++ b/pkgs/development/compilers/sbcl/common.nix
@@ -119,7 +119,5 @@ stdenv.mkDerivation rec {
     }
   '');
 
-  meta = sbclBootstrap.meta // {
-    updateWalker = true;
-  };
+  meta = sbclBootstrap.meta;
 }
diff --git a/pkgs/development/coq-modules/gaia/default.nix b/pkgs/development/coq-modules/gaia/default.nix
index cf52916605e9..c7c64c9d257c 100644
--- a/pkgs/development/coq-modules/gaia/default.nix
+++ b/pkgs/development/coq-modules/gaia/default.nix
@@ -10,7 +10,7 @@ with lib; mkCoqDerivation {
 
   inherit version;
   defaultVersion = with versions; switch [ coq.version mathcomp.version ] [
-    { cases = [ (range "8.10" "8.14") (isGe "1.12.0") ]; out = "1.13"; }
+    { cases = [ (range "8.10" "8.15") (isGe "1.12.0") ]; out = "1.13"; }
     { cases = [ (range "8.10" "8.12") "1.11.0" ]; out = "1.11"; }
   ] null;
 
diff --git a/pkgs/development/coq-modules/mathcomp-zify/default.nix b/pkgs/development/coq-modules/mathcomp-zify/default.nix
index fd3f31d3fe0d..ce2bd98f3d01 100644
--- a/pkgs/development/coq-modules/mathcomp-zify/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-zify/default.nix
@@ -9,7 +9,7 @@ with lib; mkCoqDerivation rec {
 
   defaultVersion = with versions;
      switch [ coq.coq-version mathcomp-algebra.version ] [
-       { cases = [ (range "8.13" "8.14") (isGe "1.12") ]; out = "1.1.0+1.12+8.13"; }
+       { cases = [ (range "8.13" "8.15") (isGe "1.12") ]; out = "1.1.0+1.12+8.13"; }
      ] null;
 
   release."1.0.0+1.12+8.13".sha256 = "1j533vx6lacr89bj1bf15l1a0s7rvrx4l00wyjv99aczkfbz6h6k";
diff --git a/pkgs/development/coq-modules/paramcoq/default.nix b/pkgs/development/coq-modules/paramcoq/default.nix
index d73d14c84a0c..7f65e6643c55 100644
--- a/pkgs/development/coq-modules/paramcoq/default.nix
+++ b/pkgs/development/coq-modules/paramcoq/default.nix
@@ -4,10 +4,11 @@ with lib; mkCoqDerivation {
   pname = "paramcoq";
   inherit version;
   defaultVersion = with versions; switch coq.version [
-    { case = range "8.10" "8.14"; out = "1.1.3+coq${coq.coq-version}"; }
+    { case = range "8.10" "8.15"; out = "1.1.3+coq${coq.coq-version}"; }
     { case = range "8.7"  "8.13"; out = "1.1.2+coq${coq.coq-version}"; }
   ] null;
   displayVersion = { paramcoq = "..."; };
+  release."1.1.3+coq8.15".sha256 = "0sl7ihznwz05d2x2v78w1zd4q55c1sgy06vxasbcls4v2pkw53hl";
   release."1.1.3+coq8.14".sha256 = "00zqq9dc2p5v0ib1jgizl25xkwxrs9mrlylvy0zvb96dpridjc71";
   release."1.1.3+coq8.13".sha256 = "06ndly736k4pmdn4baqa7fblp6lx7a9pxm9gvz1vzd6ic51825wp";
   release."1.1.3+coq8.12".sha256 = "sha256:10j23ws8ymqpxhapni75sxbzz0dl4n9sgasrx618i7s7b705y2rh";
diff --git a/pkgs/development/coq-modules/serapi/default.nix b/pkgs/development/coq-modules/serapi/default.nix
index 5820f98fa0f9..b3bff95b5eaf 100644
--- a/pkgs/development/coq-modules/serapi/default.nix
+++ b/pkgs/development/coq-modules/serapi/default.nix
@@ -2,8 +2,8 @@
 
 let
   release = {
-    "8.14.0+0.14.0".sha256 = "sha256:1kh80yb791yl771qbqkvwhbhydfii23a7lql0jgifvllm2k8hd8d";
-    "8.14+rc1+0.14.0".sha256 = "1w7d7anvcfx8vz51mnrf1jkw6rlpzjkjlr06avf58wlhymww7pja";
+    "8.15.0+0.15.0".sha256 = "1vh99ya2dq6a8xl2jrilgs0rpj4j227qx8zvzd2v5xylx0p4bbrp";
+    "8.14.0+0.14.0".sha256 = "1kh80yb791yl771qbqkvwhbhydfii23a7lql0jgifvllm2k8hd8d";
     "8.13.0+0.13.0".sha256 = "0k69907xn4k61w4mkhwf8kh8drw9pijk9ynijsppihw98j8w38fy";
     "8.12.0+0.12.1".sha256 = "048x3sgcq4h845hi6hm4j4dsfca8zfj70dm42w68n63qcm6xf9hn";
     "8.11.0+0.11.1".sha256 = "1phmh99yqv71vlwklqgfxiq2vj99zrzxmryj2j4qvg5vav3y3y6c";
@@ -17,6 +17,7 @@ in
 
   defaultVersion =  with versions;
     switch coq.version [
+      { case = isEq "8.15"; out = "8.15.0+0.15.0"; }
       { case = isEq "8.14"; out = "8.14.0+0.14.0"; }
       { case = isEq "8.13"; out = "8.13.0+0.13.0"; }
       { case = isEq "8.12"; out = "8.12.0+0.12.1"; }
@@ -55,9 +56,6 @@ in
   let inherit (o) version; in {
   src = fetchzip {
     url =
-      if version == "8.14+rc1+0.14.0"
-      then "https://github.com/ejgallego/coq-serapi/archive/refs/tags/8.14+rc1+0.14.0.tar.gz"
-      else
         "https://github.com/ejgallego/coq-serapi/releases/download/${version}/coq-serapi-${
           if version == "8.11.0+0.11.1" then version
           else builtins.replaceStrings [ "+" ] [ "." ] version
diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix
index ddc9f47c0453..4fc26f4403b7 100644
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@@ -54,9 +54,9 @@ self: super: {
   # There's an open PR updating the lower bound for `network`:
   # > https://github.com/abhinav/pinch/pull/46
   # With that said version tracked for `network` right now is 3.1.1.1 so we're
-  # replacing the network pinch uses with `network_3_1_2_5` for now.
+  # replacing the network pinch uses with `network_3_1_2_7` for now.
   pinch = super.pinch.overrideScope (self : super: {
-    network = self.network_3_1_2_5;
+    network = self.network_3_1_2_7;
   });
 
   # We can remove this once fakedata version gets to 1.0.1 as the test suite
@@ -1524,10 +1524,7 @@ self: super: {
   # Upstream issue: https://github.com/haskell-servant/servant-swagger/issues/129
   servant-swagger = dontCheck super.servant-swagger;
 
-  # substituteInPlace: https://github.com/hercules-ci/hercules-ci-agent/issues/363
-  hercules-ci-agent = overrideCabal { preConfigure = ''
-    substituteInPlace hercules-ci-agent/Hercules/Agent/Cachix/Init.hs --replace "Cachix.Client.Env" "Cachix.Client.Version"
-  ''; } (generateOptparseApplicativeCompletion "hercules-ci-agent" super.hercules-ci-agent);
+  hercules-ci-agent = generateOptparseApplicativeCompletion "hercules-ci-agent" super.hercules-ci-agent;
 
   hercules-ci-cli = pkgs.lib.pipe super.hercules-ci-cli [
     unmarkBroken
@@ -2065,11 +2062,11 @@ self: super: {
 
   # Needs network >= 3.1.2
   quic = super.quic.overrideScope (self: super: {
-    network = self.network_3_1_2_5;
+    network = self.network_3_1_2_7;
   });
 
   http3 = super.http3.overrideScope (self: super: {
-    network = self.network_3_1_2_5;
+    network = self.network_3_1_2_7;
   });
 
   # Fixes https://github.com/NixOS/nixpkgs/issues/140613
@@ -2104,7 +2101,7 @@ self: super: {
 
   # Needs brick > 0.64
   nix-tree = super.nix-tree.override {
-    brick = self.brick_0_66;
+    brick = self.brick_0_66_1;
   };
 
   # build newer version for `pkgs.shellcheck`
diff --git a/pkgs/development/haskell-modules/configuration-ghc-9.2.x.nix b/pkgs/development/haskell-modules/configuration-ghc-9.2.x.nix
index 5c388504bcc9..bb2527b2e130 100644
--- a/pkgs/development/haskell-modules/configuration-ghc-9.2.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-9.2.x.nix
@@ -127,7 +127,7 @@ self: super: {
   indexed-traversable-instances = doJailbreak super.indexed-traversable-instances;
   lifted-async = doJailbreak super.lifted-async;
   lukko = doJailbreak super.lukko;
-  network = super.network_3_1_2_5;
+  network = super.network_3_1_2_7;
   ormolu = self.ormolu_0_4_0_0;
   OneTuple = super.OneTuple_0_3_1;
   parallel = doJailbreak super.parallel;
diff --git a/pkgs/development/haskell-modules/configuration-hackage2nix/broken.yaml b/pkgs/development/haskell-modules/configuration-hackage2nix/broken.yaml
index afc2a63bffae..a46ff40c9548 100644
--- a/pkgs/development/haskell-modules/configuration-hackage2nix/broken.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix/broken.yaml
@@ -2032,6 +2032,7 @@ broken-packages:
   - hasql-dynamic-statements
   - hasql-generic
   - hasql-simple
+  - hasql-transaction-io
   - hastache
   - haste
   - haste-prim
@@ -2219,6 +2220,7 @@ broken-packages:
   - hlongurl
   - hlrdb-core
   - hls-exactprint-utils
+  - hls-rename-plugin
   - hlwm
   - hmarkup
   - hmatrix-banded
@@ -2598,6 +2600,7 @@ broken-packages:
   - introduction
   - intro-prelude
   - invert
+  - invertible
   - invertible-syntax
   - io-capture
   - io-choice
@@ -5378,6 +5381,7 @@ broken-packages:
   - weather-api
   - webapi
   - webapp
+  - webauthn
   - WebBits
   - webby
   - webcloud
diff --git a/pkgs/development/haskell-modules/configuration-hackage2nix/stackage.yaml b/pkgs/development/haskell-modules/configuration-hackage2nix/stackage.yaml
index 5365abd0ad26..7bb891786b6c 100644
--- a/pkgs/development/haskell-modules/configuration-hackage2nix/stackage.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix/stackage.yaml
@@ -1,4 +1,4 @@
-# Stackage LTS 18.22
+# Stackage LTS 18.23
 # This file is auto-generated by
 # maintainers/scripts/haskell/update-stackage.sh
 default-package-overrides:
@@ -280,6 +280,7 @@ default-package-overrides:
   - BNFC ==2.9.3
   - BNFC-meta ==0.6.1
   - board-games ==0.3
+  - bodhi ==0.1.0
   - boltzmann-samplers ==0.1.1.0
   - Boolean ==0.2.4
   - boolean-like ==0.1.1.0
@@ -337,6 +338,7 @@ default-package-overrides:
   - cabal-flatpak ==0.1.0.2
   - cabal-plan ==0.7.2.0
   - cabal-rpm ==2.0.10
+  - Cabal-syntax ==3.6.0.0
   - cache ==0.1.3.0
   - cached-json-file ==0.1.1
   - cacophony ==0.10.1
@@ -478,6 +480,7 @@ default-package-overrides:
   - control-monad-omega ==0.3.2
   - convertible ==1.1.1.0
   - cookie ==0.4.5
+  - copr-api ==0.1.0
   - core-data ==0.2.1.11
   - core-program ==0.2.12.0
   - core-text ==0.3.5.0
@@ -579,7 +582,7 @@ default-package-overrides:
   - declarative ==0.5.4
   - deepseq-generics ==0.2.0.0
   - deepseq-instances ==0.1.0.1
-  - deferred-folds ==0.9.18
+  - deferred-folds ==0.9.18.1
   - dejafu ==2.4.0.3
   - dense-linear-algebra ==0.1.0.0
   - dependent-map ==0.4.0.0
@@ -964,14 +967,14 @@ default-package-overrides:
   - guarded-allocation ==0.0.1
   - H ==0.9.0.1
   - hackage-db ==2.1.2
-  - hackage-security ==0.6.0.1
+  - hackage-security ==0.6.2.0
   - haddock-library ==1.10.0
   - hadoop-streaming ==0.2.0.3
   - hakyll-convert ==0.3.0.4
   - hal ==0.4.8
   - half ==0.3.1
   - hall-symbols ==0.1.0.6
-  - hamtsolo ==1.0.3
+  - hamtsolo ==1.0.4
   - HandsomeSoup ==0.4.2
   - hapistrano ==0.4.3.0
   - happstack-server ==7.7.1.2
@@ -981,7 +984,7 @@ default-package-overrides:
   - hasbolt ==0.1.6.1
   - hashable ==1.3.0.0
   - hashable-time ==0.2.1
-  - hashids ==1.0.2.4
+  - hashids ==1.0.2.7
   - hashing ==0.1.0.1
   - hashmap ==1.3.3
   - hashtables ==1.2.4.2
@@ -999,7 +1002,7 @@ default-package-overrides:
   - haskell-src ==1.0.3.1
   - haskell-src-exts ==1.23.1
   - haskell-src-exts-util ==0.2.5
-  - haskell-src-meta ==0.8.7
+  - haskell-src-meta ==0.8.8
   - haskey-btree ==0.3.0.1
   - hasktags ==0.72.0
   - hasql ==1.4.5.3
@@ -1016,7 +1019,7 @@ default-package-overrides:
   - hdaemonize ==0.5.6
   - HDBC ==2.4.0.3
   - HDBC-session ==0.1.2.0
-  - headroom ==0.4.2.0
+  - headroom ==0.4.3.0
   - heap ==1.0.4
   - heaps ==0.4
   - hebrew-time ==0.1.2
@@ -1130,6 +1133,7 @@ default-package-overrides:
   - hspec-parsec ==0
   - hspec-smallcheck ==0.5.2
   - hspec-tables ==0.0.1
+  - hspec-tmp-proc ==0.5.0.1
   - hspec-wai ==0.11.0
   - hspec-wai-json ==0.11.0
   - hs-php-session ==0.0.9.3
@@ -1335,7 +1339,7 @@ default-package-overrides:
   - lambdabot-core ==5.3.0.2
   - LambdaHack ==0.10.3.0
   - lame ==0.2.0
-  - language-avro ==0.1.3.1
+  - language-avro ==0.1.4.0
   - language-bash ==0.9.2
   - language-c ==0.9.0.1
   - language-c-quote ==0.13
@@ -1706,6 +1710,7 @@ default-package-overrides:
   - packdeps ==0.6.0.0
   - pager ==0.1.1.0
   - pagination ==0.2.2
+  - pagure ==0.1.0
   - pagure-cli ==0.2
   - pandoc ==2.14.0.3
   - pandoc-dhall-decoder ==0.1.0.1
@@ -1747,6 +1752,7 @@ default-package-overrides:
   - pcre-heavy ==1.0.0.2
   - pcre-light ==0.4.1.0
   - pcre-utils ==0.1.8.2
+  - pdc ==0.1.1
   - pdfinfo ==1.5.4
   - peano ==0.1.0.1
   - pem ==0.2.4
@@ -1757,15 +1763,15 @@ default-package-overrides:
   - persist ==0.1.1.5
   - persistable-record ==0.6.0.5
   - persistable-types-HDBC-pg ==0.0.3.5
-  - persistent ==2.13.2.1
+  - persistent ==2.13.2.2
   - persistent-mtl ==0.2.2.0
   - persistent-mysql ==2.13.0.2
   - persistent-pagination ==0.1.1.2
-  - persistent-postgresql ==2.13.2.1
-  - persistent-qq ==2.12.0.1
-  - persistent-sqlite ==2.13.0.3
+  - persistent-postgresql ==2.13.2.2
+  - persistent-qq ==2.12.0.2
+  - persistent-sqlite ==2.13.0.4
   - persistent-template ==2.12.0.0
-  - persistent-test ==2.13.0.3
+  - persistent-test ==2.13.0.4
   - persistent-typed-db ==0.1.0.5
   - pg-harness-client ==0.6.0
   - pgp-wordlist ==0.1.0.3
@@ -2429,13 +2435,14 @@ default-package-overrides:
   - tinylog ==0.15.0
   - titlecase ==1.0.1
   - tldr ==0.9.2
-  - tls ==1.5.6
+  - tls ==1.5.7
   - tls-debug ==0.4.8
   - tls-session-manager ==0.0.4
   - tlynx ==0.5.1.1
   - tmapchan ==0.0.3
   - tmapmvar ==0.0.4
   - tmp-postgres ==1.34.1.0
+  - tmp-proc ==0.5.0.1
   - tomland ==1.3.2.0
   - tonalude ==0.1.1.1
   - topograph ==1.0.0.1
@@ -2576,7 +2583,7 @@ default-package-overrides:
   - vector-split ==1.0.0.2
   - vector-th-unbox ==0.2.2
   - verbosity ==0.4.0.0
-  - versions ==5.0.1
+  - versions ==5.0.2
   - vformat ==0.14.1.0
   - vformat-aeson ==0.1.0.1
   - vformat-time ==0.1.0.0
@@ -2597,6 +2604,7 @@ default-package-overrides:
   - wai-middleware-auth ==0.2.5.1
   - wai-middleware-caching ==0.1.0.2
   - wai-middleware-clacks ==0.1.0.1
+  - wai-middleware-delegate ==0.1.2.4
   - wai-middleware-prometheus ==1.0.0.1
   - wai-middleware-static ==0.9.1
   - wai-rate-limit ==0.1.0.0
@@ -2653,10 +2661,10 @@ default-package-overrides:
   - X11 ==1.10.2
   - X11-xft ==0.3.4
   - x11-xim ==0.0.9.0
-  - x509 ==1.7.5
-  - x509-store ==1.6.7
-  - x509-system ==1.6.6
-  - x509-validation ==1.6.11
+  - x509 ==1.7.6
+  - x509-store ==1.6.9
+  - x509-system ==1.6.7
+  - x509-validation ==1.6.12
   - Xauth ==0.1
   - xdg-basedir ==0.2.2
   - xdg-userdirs ==0.1.0.2
diff --git a/pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml b/pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml
index a0b69748b21d..e037891b80a6 100644
--- a/pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml
@@ -481,7 +481,7 @@ dont-distribute-packages:
  - atuin
  - audiovisual
  - aura
- - aura_3_2_6
+ - aura_3_2_7
  - authoring
  - autonix-deps-kf5
  - avers
@@ -1030,6 +1030,7 @@ dont-distribute-packages:
  - edges
  - editable
  - effective-aspects-mzv
+ - eflint
  - egison
  - egison-pattern-src-haskell-mode
  - egison-pattern-src-th-mode
@@ -1784,6 +1785,7 @@ dont-distribute-packages:
  - introduction-test
  - intset
  - invertible-hlist
+ - invertible-hxt
  - ion
  - ip
  - ipatch
@@ -2546,6 +2548,7 @@ dont-distribute-packages:
  - reactor
  - readpyc
  - reanimate
+ - reanimate_1_1_5_0
  - record-aeson
  - record-gl
  - record-preprocessor
@@ -3057,6 +3060,7 @@ dont-distribute-packages:
  - trasa-reflex
  - trasa-server
  - trasa-th
+ - traverse-code
  - treemap-html-tools
  - treersec
  - trek-app
@@ -3210,6 +3214,7 @@ dont-distribute-packages:
  - warped
  - wavesurfer
  - wavy
+ - web-inv-route
  - web-mongrel2
  - web-page
  - web-rep
diff --git a/pkgs/development/haskell-modules/configuration-nix.nix b/pkgs/development/haskell-modules/configuration-nix.nix
index e6b2ff48c945..48ef3d1515e6 100644
--- a/pkgs/development/haskell-modules/configuration-nix.nix
+++ b/pkgs/development/haskell-modules/configuration-nix.nix
@@ -972,11 +972,11 @@ self: super: builtins.intersectAttrs super {
 
   rel8 = addTestToolDepend pkgs.postgresql super.rel8;
 
-  cachix = generateOptparseApplicativeCompletion "cachix" (super.cachix.override { nix = pkgs.nix_2_4; });
+  cachix = generateOptparseApplicativeCompletion "cachix" (super.cachix.override { nix = pkgs.nixVersions.nix_2_4; });
 
-  hercules-ci-agent = appendConfigureFlag "-fnix-2_4" (super.hercules-ci-agent.override { nix = pkgs.nix_2_4; });
-  hercules-ci-cnix-expr = appendConfigureFlag "-fnix-2_4" (super.hercules-ci-cnix-expr.override { nix = pkgs.nix_2_4; });
-  hercules-ci-cnix-store = appendConfigureFlag "-fnix-2_4" (super.hercules-ci-cnix-store.override { nix = pkgs.nix_2_4; });
+  hercules-ci-agent = appendConfigureFlag "-fnix-2_4" (super.hercules-ci-agent.override { nix = pkgs.nixVersions.nix_2_4; });
+  hercules-ci-cnix-expr = appendConfigureFlag "-fnix-2_4" (super.hercules-ci-cnix-expr.override { nix = pkgs.nixVersions.nix_2_4; });
+  hercules-ci-cnix-store = appendConfigureFlag "-fnix-2_4" (super.hercules-ci-cnix-store.override { nix = pkgs.nixVersions.nix_2_4; });
 
   # Enable extra optimisations which increase build time, but also
   # later compiler performance, so we should do this for user's benefit.
diff --git a/pkgs/development/haskell-modules/hackage-packages.nix b/pkgs/development/haskell-modules/hackage-packages.nix
index 222534de8aa2..8822a77d5fa2 100644
--- a/pkgs/development/haskell-modules/hackage-packages.nix
+++ b/pkgs/development/haskell-modules/hackage-packages.nix
@@ -2857,6 +2857,18 @@ self: {
        broken = true;
      }) {};
 
+  "Cabal-syntax" = callPackage
+    ({ mkDerivation, Cabal }:
+     mkDerivation {
+       pname = "Cabal-syntax";
+       version = "3.6.0.0";
+       sha256 = "0lcj4g55sj5iv727g7k57pscgyj0fx3smwapm1gmd5qkc3yfa9fa";
+       libraryHaskellDepends = [ Cabal ];
+       doHaddock = false;
+       description = "A library for working with .cabal files";
+       license = lib.licenses.bsd3;
+     }) {};
+
   "CabalSearch" = callPackage
     ({ mkDerivation, base, bytestring, directory, filepath, HDBC
      , HDBC-sqlite3, process, unix
@@ -4683,6 +4695,17 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
+  "DigitGroup" = callPackage
+    ({ mkDerivation, base, split }:
+     mkDerivation {
+       pname = "DigitGroup";
+       version = "0.1.0.0";
+       sha256 = "1g9bxrawx2ard4pm6rs9li0kk3wj5f5ll0b2l2dwc74i23anb9lz";
+       libraryHaskellDepends = [ base split ];
+       description = "Group the digits of numbers by lots";
+       license = lib.licenses.bsd3;
+     }) {};
+
   "DigitalOcean" = callPackage
     ({ mkDerivation, aeson, base, bytestring, containers, exceptions
      , hspec, lens, mtl, text, transformers, unordered-containers
@@ -10968,6 +10991,8 @@ self: {
        pname = "HsYAML-aeson";
        version = "0.2.0.1";
        sha256 = "139hqd07hkr8ykvrgmcshh9f3vp9dnrj6ks5nl8hgrpi990jsy5r";
+       revision = "1";
+       editedCabalFile = "0d9gih7mkm0k47351539x9vdjvjjysk1rvba88r214qsjxnh4kym";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -21000,8 +21025,8 @@ self: {
     ({ mkDerivation, base, bytestring, transformers, vector, vulkan }:
      mkDerivation {
        pname = "VulkanMemoryAllocator";
-       version = "0.7.5";
-       sha256 = "0wcq09q5jhvigfp8vshgs3yc170g7c39jz2m6jk2j6v0nji2lp40";
+       version = "0.8";
+       sha256 = "1cxgf1ly0hqlyn01jd7ipdvvw1mm5r4ifc7694a3dr2wv2pnq5c0";
        libraryHaskellDepends = [
          base bytestring transformers vector vulkan
        ];
@@ -25639,6 +25664,8 @@ self: {
        pname = "aeson-yaml";
        version = "1.1.0.1";
        sha256 = "06x1l0a0dvzf8n2xmqny5qpsgdsl03xlh2z9x7wdxiykl8p4xd24";
+       revision = "1";
+       editedCabalFile = "16jz8x7dbc66vcnfam52pzxcic6c40rmixc5p1y3xds2f695i1xl";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -26416,6 +26443,24 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
+  "alex_3_2_7_1" = callPackage
+    ({ mkDerivation, array, base, containers, directory, happy, process
+     }:
+     mkDerivation {
+       pname = "alex";
+       version = "3.2.7.1";
+       sha256 = "1v0vm1l4xvybzwj1p6j5j58yiw5nhbnx7yxjnpyjy6wggsig3llv";
+       isLibrary = false;
+       isExecutable = true;
+       enableSeparateDataOutput = true;
+       executableHaskellDepends = [ array base containers directory ];
+       executableToolDepends = [ happy ];
+       testHaskellDepends = [ base process ];
+       description = "Alex is a tool for generating lexical analysers in Haskell";
+       license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "alex-meta" = callPackage
     ({ mkDerivation, alex, array, base, containers, happy
      , haskell-src-meta, QuickCheck, template-haskell
@@ -36089,7 +36134,7 @@ self: {
        hydraPlatforms = lib.platforms.none;
      }) {};
 
-  "aura_3_2_6" = callPackage
+  "aura_3_2_7" = callPackage
     ({ mkDerivation, aeson, algebraic-graphs, aur, base, bytestring
      , containers, filepath, hashable, http-client, http-client-tls
      , http-types, language-bash, megaparsec, network-uri
@@ -36099,10 +36144,8 @@ self: {
      }:
      mkDerivation {
        pname = "aura";
-       version = "3.2.6";
-       sha256 = "07sry2nf41f101ldcfcf2x5pp0w7qvlvl6m4j5bbkvxp3rmsjbx2";
-       revision = "2";
-       editedCabalFile = "02vbh06llfj3f1crf5nqkx8crkh3lhv3mi2zqanjhj1wx98r4g7v";
+       version = "3.2.7";
+       sha256 = "07ya2vd94grh6fs7k5kq25yh95xfk5mdqcgqq84anjz0phprq5z3";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -46823,7 +46866,7 @@ self: {
        hydraPlatforms = lib.platforms.none;
      }) {};
 
-  "brick_0_66" = callPackage
+  "brick_0_66_1" = callPackage
     ({ mkDerivation, base, bytestring, config-ini, containers
      , contravariant, data-clist, deepseq, directory, dlist, exceptions
      , filepath, microlens, microlens-mtl, microlens-th, QuickCheck, stm
@@ -46832,8 +46875,8 @@ self: {
      }:
      mkDerivation {
        pname = "brick";
-       version = "0.66";
-       sha256 = "0iaa22vjjrgasd7mhchib6r8hr73b540iqmcw5dkidg95y9jr00z";
+       version = "0.66.1";
+       sha256 = "04acisnnrhhq0xh470wfqjyyym8wjv5zv93pmwklz84ypzfdw60a";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -48908,6 +48951,8 @@ self: {
        pname = "bytestring-encoding";
        version = "0.1.1.0";
        sha256 = "0m2w1nvj5izmb4j08c57lk89i3rnhhb0n0rz511pb6s75ijqrb71";
+       revision = "1";
+       editedCabalFile = "0vfigz5181rpk6lcajdbljvsrip3nlwxly1pflc6isn24wcd2jn1";
        libraryHaskellDepends = [ base bytestring text ];
        testHaskellDepends = [
          base bytestring deepseq QuickCheck tasty tasty-hunit
@@ -59284,23 +59329,25 @@ self: {
      }) {};
 
   "cobot-io" = callPackage
-    ({ mkDerivation, array, attoparsec, base, binary, bytestring
+    ({ mkDerivation, array, attoparsec, base, binary, bytestring, cobot
      , containers, data-msgpack, deepseq, directory, hspec, http-conduit
-     , hyraxAbif, lens, linear, mtl, neat-interpolation, QuickCheck
-     , split, text, vector
+     , hyraxAbif, lens, linear, megaparsec, mtl, neat-interpolation
+     , parser-combinators, QuickCheck, split, text, vector
      }:
      mkDerivation {
        pname = "cobot-io";
-       version = "0.1.3.20";
-       sha256 = "075s6rhzyldm5c9g27ljwhs8xyxghk8cpm2742l3h69j9y7v3xnc";
+       version = "0.1.4.2";
+       sha256 = "1gh51097r6z35vbvdfg8fasv00midmdxgya0b2acm3hbrjnrdvp4";
        libraryHaskellDepends = [
-         array attoparsec base binary bytestring containers data-msgpack
-         deepseq http-conduit hyraxAbif lens linear mtl split text vector
+         array attoparsec base binary bytestring cobot containers
+         data-msgpack deepseq http-conduit hyraxAbif lens linear megaparsec
+         mtl parser-combinators split text vector
        ];
        testHaskellDepends = [
-         array attoparsec base binary bytestring containers data-msgpack
-         deepseq directory hspec http-conduit hyraxAbif lens linear mtl
-         neat-interpolation QuickCheck split text vector
+         array attoparsec base binary bytestring cobot containers
+         data-msgpack deepseq directory hspec http-conduit hyraxAbif lens
+         linear megaparsec mtl neat-interpolation parser-combinators
+         QuickCheck split text vector
        ];
        description = "Biological data file formats and IO";
        license = lib.licenses.bsd3;
@@ -60868,8 +60915,8 @@ self: {
     ({ mkDerivation, base, hspec, mtl }:
      mkDerivation {
        pname = "commandert";
-       version = "0.1.1.0";
-       sha256 = "0li8ja7j8386k5j7l6vczq3g74bnj0qrz4n4f1hkgf82sg333jxz";
+       version = "0.1.1.1";
+       sha256 = "02sdmba5ri40qx5j2bdx11h8k7b0ndik8wwzf3wki8c00y2jpmnd";
        libraryHaskellDepends = [ base mtl ];
        testHaskellDepends = [ base hspec mtl ];
        description = "A monad for commanders";
@@ -73743,8 +73790,8 @@ self: {
      }:
      mkDerivation {
        pname = "dear-imgui";
-       version = "1.3.0";
-       sha256 = "1b8yafkgr41lizgg3zvzwf5rx1hwr84pqsrhzyfbpjhl0kbwvn54";
+       version = "1.3.1";
+       sha256 = "1ndwwnvx89pz0rmkr5ba4gv7w2q2q8j9n3a31s9aibxd0qjd6ijx";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -74386,28 +74433,6 @@ self: {
      }:
      mkDerivation {
        pname = "deferred-folds";
-       version = "0.9.18";
-       sha256 = "15yd5wqkksainhwwiq8vlf49ih2789wz9njv7050s5mr20b2rqy1";
-       libraryHaskellDepends = [
-         base bytestring containers foldl hashable primitive text
-         transformers unordered-containers vector
-       ];
-       testHaskellDepends = [
-         QuickCheck quickcheck-instances rerebase tasty tasty-hunit
-         tasty-quickcheck
-       ];
-       description = "Abstractions over deferred folds";
-       license = lib.licenses.mit;
-     }) {};
-
-  "deferred-folds_0_9_18_1" = callPackage
-    ({ mkDerivation, base, bytestring, containers, foldl, hashable
-     , primitive, QuickCheck, quickcheck-instances, rerebase, tasty
-     , tasty-hunit, tasty-quickcheck, text, transformers
-     , unordered-containers, vector
-     }:
-     mkDerivation {
-       pname = "deferred-folds";
        version = "0.9.18.1";
        sha256 = "1hf14xa9fdfyk9ijxnll402x96m59giqrpj9s5rjqkd5pyi1yj6w";
        libraryHaskellDepends = [
@@ -74420,7 +74445,6 @@ self: {
        ];
        description = "Abstractions over deferred folds";
        license = lib.licenses.mit;
-       hydraPlatforms = lib.platforms.none;
      }) {};
 
   "definitive-base" = callPackage
@@ -78783,8 +78807,8 @@ self: {
      }:
      mkDerivation {
        pname = "disco";
-       version = "0.1.0.0";
-       sha256 = "1pnqqx6dlqzxk7am66d25lcs596xfh0fw81yhyikfcb5sf1z3mx1";
+       version = "0.1.1.0";
+       sha256 = "04z203dvqc6ipcw6mhnx63q2s2hlmvxy5d5v0ml2z53b4crbprha";
        isLibrary = true;
        isExecutable = true;
        enableSeparateDataOutput = true;
@@ -78887,6 +78911,35 @@ self: {
        broken = true;
      }) {};
 
+  "discord-haskell-voice" = callPackage
+    ({ mkDerivation, aeson, async, base, binary, BoundedChan
+     , bytestring, conduit, discord-haskell, lens, mtl, network
+     , optparse-applicative, opus, process, safe-exceptions, saltine
+     , stm, stm-containers, text, time, unliftio, websockets, wuss
+     }:
+     mkDerivation {
+       pname = "discord-haskell-voice";
+       version = "2.2.1";
+       sha256 = "07vwd9l9aa87wfs8gpqdi39h0j2jvc7mdn48yzkn68canv1wf95q";
+       isLibrary = true;
+       isExecutable = true;
+       libraryHaskellDepends = [
+         aeson async base binary BoundedChan bytestring conduit
+         discord-haskell lens mtl network opus process safe-exceptions
+         saltine text time unliftio websockets wuss
+       ];
+       executableHaskellDepends = [
+         aeson async base binary BoundedChan bytestring conduit
+         discord-haskell lens mtl network optparse-applicative opus process
+         safe-exceptions saltine stm stm-containers text time unliftio
+         websockets wuss
+       ];
+       description = "Voice support for discord-haskell";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+       broken = true;
+     }) {opus = null;};
+
   "discord-hs" = callPackage
     ({ mkDerivation, base, discord-gateway, discord-rest, discord-types
      , hashable, mtl, url, websockets
@@ -84788,6 +84841,33 @@ self: {
        broken = true;
      }) {};
 
+  "eflint" = callPackage
+    ({ mkDerivation, aeson, base, bytestring, containers, directory
+     , exploring-interpreters, fgl, filepath, gll, haskeline, hxt, mtl
+     , network, regex-applicative, text, time, transformers
+     }:
+     mkDerivation {
+       pname = "eflint";
+       version = "3.0.0.1";
+       sha256 = "1cij1g1mrw41dn4c63bzkahya3li9v7pkzisj0v129p6ckypv7cc";
+       revision = "1";
+       editedCabalFile = "10bi07ilvvmglbgsc1xf2fq4vsndrqh9d6c823d897s4didcv8rk";
+       isLibrary = true;
+       isExecutable = true;
+       libraryHaskellDepends = [
+         aeson base bytestring containers directory exploring-interpreters
+         fgl filepath gll hxt mtl network regex-applicative time
+       ];
+       executableHaskellDepends = [
+         aeson base bytestring containers directory exploring-interpreters
+         fgl filepath gll haskeline hxt mtl network regex-applicative text
+         time transformers
+       ];
+       description = "Simulation interpreter for FLINT policy descriptions";
+       license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "egison" = callPackage
     ({ mkDerivation, base, containers, criterion, directory, exceptions
      , filepath, Glob, hashable, haskeline, HUnit, megaparsec, mtl
@@ -86372,27 +86452,28 @@ self: {
 
   "ema" = callPackage
     ({ mkDerivation, aeson, async, base, blaze-html, blaze-markup
-     , commonmark, commonmark-extensions, commonmark-pandoc, containers
-     , data-default, directory, filepath, filepattern, fsnotify
+     , commonmark, commonmark-extensions, commonmark-pandoc
+     , constraints-extras, containers, data-default, dependent-sum
+     , dependent-sum-template, directory, filepath, filepattern
      , http-types, lvar, megaparsec, monad-logger, monad-logger-extras
      , neat-interpolation, optparse-applicative, pandoc-types, parsec
-     , parser-combinators, relude, safe-exceptions, stm, text, time
-     , unicode-transforms, unionmount, unliftio, uri-encode, wai
-     , wai-middleware-static, wai-websockets, warp, websockets, yaml
+     , parser-combinators, relude, text, time, unicode-transforms
+     , unionmount, unliftio, uri-encode, wai, wai-middleware-static
+     , wai-websockets, warp, websockets, yaml
      }:
      mkDerivation {
        pname = "ema";
-       version = "0.2.0.0";
-       sha256 = "1pjgpy4rvpwvrdszppb51nys281aglbpjgx4yci9hklp0kbkkh9i";
+       version = "0.4.0.0";
+       sha256 = "1l44mmcghhgyyxxnannmqsabdbwdz5yka0vk3pbiziqjjlkjxpnj";
        libraryHaskellDepends = [
          aeson async base blaze-html blaze-markup commonmark
-         commonmark-extensions commonmark-pandoc containers data-default
-         directory filepath filepattern fsnotify http-types lvar megaparsec
+         commonmark-extensions commonmark-pandoc constraints-extras
+         containers data-default dependent-sum dependent-sum-template
+         directory filepath filepattern http-types lvar megaparsec
          monad-logger monad-logger-extras neat-interpolation
          optparse-applicative pandoc-types parsec parser-combinators relude
-         safe-exceptions stm text time unicode-transforms unionmount
-         unliftio uri-encode wai wai-middleware-static wai-websockets warp
-         websockets yaml
+         text time unicode-transforms unionmount unliftio uri-encode wai
+         wai-middleware-static wai-websockets warp websockets yaml
        ];
        description = "Static site generator library with hot reload";
        license = lib.licenses.agpl3Only;
@@ -92267,15 +92348,15 @@ self: {
        maintainers = with lib.maintainers; [ sternenseemann ];
      }) {};
 
-  "fast-logger_3_1_0" = callPackage
+  "fast-logger_3_1_1" = callPackage
     ({ mkDerivation, array, auto-update, base, bytestring, directory
      , easy-file, filepath, hspec, hspec-discover, text, unix-compat
      , unix-time
      }:
      mkDerivation {
        pname = "fast-logger";
-       version = "3.1.0";
-       sha256 = "1qry775yd962zcx16k1syhx001hlkk15v6m6l3yylibhqh9b753y";
+       version = "3.1.1";
+       sha256 = "1rx866swvqq7lzngv4bx7qinnwmm3aa2la8caljvbfbi0xz6wps3";
        libraryHaskellDepends = [
          array auto-update base bytestring directory easy-file filepath text
          unix-compat unix-time
@@ -93174,6 +93255,22 @@ self: {
        license = lib.licenses.gpl3Only;
      }) {};
 
+  "fedora-dists_2_0_0" = callPackage
+    ({ mkDerivation, aeson, base, bytestring, cached-json-file, pdc
+     , text, time
+     }:
+     mkDerivation {
+       pname = "fedora-dists";
+       version = "2.0.0";
+       sha256 = "1igw3rl99g48c46qzclj15896c97qd8g02pdscjwm0zid83pbimk";
+       libraryHaskellDepends = [
+         aeson base bytestring cached-json-file pdc text time
+       ];
+       description = "Library for Fedora distribution versions";
+       license = lib.licenses.gpl3Only;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "fedora-haskell-tools" = callPackage
     ({ mkDerivation, base, csv, directory, fedora-dists, filepath, HTTP
      , optparse-applicative, process, simple-cmd, simple-cmd-args, split
@@ -93193,6 +93290,28 @@ self: {
        license = lib.licenses.gpl3Only;
      }) {};
 
+  "fedora-haskell-tools_1_0" = callPackage
+    ({ mkDerivation, base, bytestring, csv, directory, extra
+     , fedora-dists, filepath, http-conduit, http-types
+     , optparse-applicative, process, simple-cmd, simple-cmd-args, split
+     , time, unix
+     }:
+     mkDerivation {
+       pname = "fedora-haskell-tools";
+       version = "1.0";
+       sha256 = "13nqsf4p5cm9zzdryl09hcxsya5qn3h8q8wl1sz02jswkhwlhlzb";
+       isLibrary = false;
+       isExecutable = true;
+       executableHaskellDepends = [
+         base bytestring csv directory extra fedora-dists filepath
+         http-conduit http-types optparse-applicative process simple-cmd
+         simple-cmd-args split time unix
+       ];
+       description = "Building and maintenance tools for Fedora Haskell";
+       license = lib.licenses.gpl3Only;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "fedora-img-dl" = callPackage
     ({ mkDerivation, base, bytestring, directory, filepath
      , http-directory, http-types, optparse-applicative, simple-cmd
@@ -98261,6 +98380,8 @@ self: {
        pname = "foundation";
        version = "0.0.26.1";
        sha256 = "1hri3raqf6nhh6631gfm2yrkv4039gb0cqfa9cqmjp8bbqv28w5d";
+       revision = "1";
+       editedCabalFile = "0ylg660ldg20jdy61jwlvj7x606m2wjs67djijk2i9db36sgpx00";
        libraryHaskellDepends = [ base basement ghc-prim ];
        testHaskellDepends = [ base basement ];
        benchmarkHaskellDepends = [ base basement gauge ];
@@ -102894,14 +103015,14 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
-  "generic-lens_2_2_0_0" = callPackage
+  "generic-lens_2_2_1_0" = callPackage
     ({ mkDerivation, base, doctest, generic-lens-core, HUnit
      , inspection-testing, lens, profunctors, text
      }:
      mkDerivation {
        pname = "generic-lens";
-       version = "2.2.0.0";
-       sha256 = "0n61hrfciryl33w6vxd5p1yqjfxl02n717dahlvb6fxlg9339nxp";
+       version = "2.2.1.0";
+       sha256 = "17an4669igzs6pwzqxnpkx9gmxwz64p32d1zcinhh5agd56y70pa";
        libraryHaskellDepends = [
          base generic-lens-core profunctors text
        ];
@@ -102924,12 +103045,12 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
-  "generic-lens-core_2_2_0_0" = callPackage
+  "generic-lens-core_2_2_1_0" = callPackage
     ({ mkDerivation, base, indexed-profunctors, text }:
      mkDerivation {
        pname = "generic-lens-core";
-       version = "2.2.0.0";
-       sha256 = "0nj6ldwfidbyid85076gy8f5sa02xnbdhn51pkyg4dfqqz4r4hg8";
+       version = "2.2.1.0";
+       sha256 = "08i4c9yb6z84iknrnl9f3f343121j7ilp0a679v81nsjm9xz3rlf";
        libraryHaskellDepends = [ base indexed-profunctors text ];
        description = "Generically derive traversals, lenses and prisms";
        license = lib.licenses.bsd3;
@@ -103042,14 +103163,14 @@ self: {
        maintainers = with lib.maintainers; [ maralorn ];
      }) {};
 
-  "generic-optics_2_2_0_0" = callPackage
+  "generic-optics_2_2_1_0" = callPackage
     ({ mkDerivation, base, doctest, generic-lens-core, HUnit
      , inspection-testing, optics-core, text
      }:
      mkDerivation {
        pname = "generic-optics";
-       version = "2.2.0.0";
-       sha256 = "1iy7m5rs7rhk38zipwc018vcbkvlkpyr0rljkms6v0ajsvgkb783";
+       version = "2.2.1.0";
+       sha256 = "1bw7bbkrd1sfshzx7v1nbdnkxc82krw96x7vnl7myz9748m4472z";
        libraryHaskellDepends = [
          base generic-lens-core optics-core text
        ];
@@ -115015,8 +115136,8 @@ self: {
      }:
      mkDerivation {
        pname = "gopro-plus";
-       version = "0.6.0.3";
-       sha256 = "1mqfp7r7l4p3xfh9scnqa0fh23vm50klg5aw1l15xh8slip11qx7";
+       version = "0.6.0.4";
+       sha256 = "0w0nbrbv7vb9i19wqn1za1prhj9bglqm1ac0sp1jpv8vbksiv21w";
        libraryHaskellDepends = [
          aeson base bytestring containers exceptions filepath
          generic-deriving generic-random lens lens-aeson mtl QuickCheck
@@ -115936,8 +116057,8 @@ self: {
      }:
      mkDerivation {
        pname = "graph-trace";
-       version = "0.1.0.0";
-       sha256 = "1nxmj3gd77ffy0441ikvassy5figb5cgav3qbwmgir10jnrqhhbl";
+       version = "0.1.0.1";
+       sha256 = "1pwlgn5w4rxrd0bx69d76li2cadfzfii79ynxvay9fp719bqgbqn";
        libraryHaskellDepends = [
          base bytestring containers ghc ghc-boot ghc-prim random syb
          template-haskell transformers
@@ -115954,6 +116075,8 @@ self: {
        pname = "graph-trace-dot";
        version = "0.1.1.1";
        sha256 = "11hwxccy7yaz3mwixp1gjlpdfi9525ydqlbmpgyasg9ndg7dvl8i";
+       revision = "1";
+       editedCabalFile = "0caa9xcxwrqzqwsl76kmwv3fq9klsnm7wamrwjs8lrliyxcriwl6";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -119603,50 +119726,21 @@ self: {
 
   "hackage-security" = callPackage
     ({ mkDerivation, aeson, base, base16-bytestring, base64-bytestring
-     , bytestring, Cabal, containers, cryptohash-sha256, directory
-     , ed25519, filepath, ghc-prim, lukko, mtl, network, network-uri
-     , parsec, pretty, QuickCheck, tar, tasty, tasty-hunit
-     , tasty-quickcheck, template-haskell, temporary, time, transformers
-     , unordered-containers, vector, zlib
-     }:
-     mkDerivation {
-       pname = "hackage-security";
-       version = "0.6.0.1";
-       sha256 = "05rgz31cmp52137j4jk0074z8lfgk8mrf2x56bzw28asmxrv8qli";
-       revision = "9";
-       editedCabalFile = "14g1zr05qcvrn5ghhjmk6pz9h2ypa84bgqddxm0sk0qxbzpnxmqi";
-       libraryHaskellDepends = [
-         base base16-bytestring base64-bytestring bytestring Cabal
-         containers cryptohash-sha256 directory ed25519 filepath ghc-prim
-         lukko mtl network network-uri parsec pretty tar template-haskell
-         time transformers zlib
-       ];
-       testHaskellDepends = [
-         aeson base bytestring Cabal containers network-uri QuickCheck tar
-         tasty tasty-hunit tasty-quickcheck temporary time
-         unordered-containers vector zlib
-       ];
-       description = "Hackage security library";
-       license = lib.licenses.bsd3;
-     }) {};
-
-  "hackage-security_0_6_1_0" = callPackage
-    ({ mkDerivation, aeson, base, base16-bytestring, base64-bytestring
-     , bytestring, Cabal, containers, cryptohash-sha256, directory
-     , ed25519, filepath, ghc-prim, lukko, mtl, network, network-uri
-     , parsec, pretty, QuickCheck, tar, tasty, tasty-hunit
+     , bytestring, Cabal, Cabal-syntax, containers, cryptohash-sha256
+     , directory, ed25519, filepath, ghc-prim, lukko, mtl, network
+     , network-uri, parsec, pretty, QuickCheck, tar, tasty, tasty-hunit
      , tasty-quickcheck, template-haskell, temporary, text, time
      , transformers, unordered-containers, vector, zlib
      }:
      mkDerivation {
        pname = "hackage-security";
-       version = "0.6.1.0";
-       sha256 = "063p07hc1v1whlrwrzf0rzb6gzmba2x208ij1f2wz03zx2gsxwwb";
+       version = "0.6.2.0";
+       sha256 = "1jqpxcpsrixpvficqw5vdfrksg568967ncmisnd3j3jw3sxja5q8";
        libraryHaskellDepends = [
          base base16-bytestring base64-bytestring bytestring Cabal
-         containers cryptohash-sha256 directory ed25519 filepath ghc-prim
-         lukko mtl network network-uri parsec pretty tar template-haskell
-         time transformers zlib
+         Cabal-syntax containers cryptohash-sha256 directory ed25519
+         filepath ghc-prim lukko mtl network network-uri parsec pretty tar
+         template-haskell time transformers zlib
        ];
        testHaskellDepends = [
          aeson base bytestring Cabal containers network-uri QuickCheck tar
@@ -119655,7 +119749,6 @@ self: {
        ];
        description = "Hackage security library";
        license = lib.licenses.bsd3;
-       hydraPlatforms = lib.platforms.none;
      }) {};
 
   "hackage-security-HTTP" = callPackage
@@ -120659,10 +120752,8 @@ self: {
      }:
      mkDerivation {
        pname = "hakyll";
-       version = "4.15.1.0";
-       sha256 = "18nhpnhi63xvmb14khw1ad8rwj2lxdyhpc58gnmr9vb5zz2db6bh";
-       revision = "1";
-       editedCabalFile = "1kxdvh7250nvfdz5wnchyqhghhp05i06sfnjg9ar17p0wyqzv46z";
+       version = "4.15.1.1";
+       sha256 = "0b3bw275q1xbx8qs9a6gzzs3c9z3qdj7skqhpp09jkchi5kdvhvi";
        isLibrary = true;
        isExecutable = true;
        enableSeparateDataOutput = true;
@@ -121543,8 +121634,8 @@ self: {
      }:
      mkDerivation {
        pname = "hamtsolo";
-       version = "1.0.3";
-       sha256 = "0dbhpdfmbs6ydin2p75wqia9lcrw82gfv3kx8659gnw2ll3dmpnh";
+       version = "1.0.4";
+       sha256 = "1zgkwj2q3jpg6x6acrq2dbp0n0gps2wrrg2wx4ybpvy9vbw9qppc";
        isLibrary = false;
        isExecutable = true;
        executableHaskellDepends = [
@@ -123555,18 +123646,6 @@ self: {
      }) {};
 
   "hashids" = callPackage
-    ({ mkDerivation, base, bytestring, containers, split }:
-     mkDerivation {
-       pname = "hashids";
-       version = "1.0.2.4";
-       sha256 = "1kzkyni9hfwpvyq9rdv62iziwiax5avzd05ghsh7dgnylv41z697";
-       libraryHaskellDepends = [ base bytestring containers split ];
-       testHaskellDepends = [ base bytestring containers split ];
-       description = "Hashids generates short, unique, non-sequential ids from numbers";
-       license = lib.licenses.mit;
-     }) {};
-
-  "hashids_1_0_2_7" = callPackage
     ({ mkDerivation, base, bytestring, containers, hedgehog, split }:
      mkDerivation {
        pname = "hashids";
@@ -123576,7 +123655,6 @@ self: {
        testHaskellDepends = [ base bytestring containers hedgehog split ];
        description = "Hashids generates short, unique, non-sequential ids from numbers";
        license = lib.licenses.mit;
-       hydraPlatforms = lib.platforms.none;
      }) {};
 
   "hashing" = callPackage
@@ -125502,27 +125580,6 @@ self: {
      }:
      mkDerivation {
        pname = "haskell-src-meta";
-       version = "0.8.7";
-       sha256 = "1yy2dfb1ip1zqx3xh28g92209555abzvxrxiwcl95j27zzqxc6in";
-       revision = "1";
-       editedCabalFile = "1xf1rrbqa6fsr072xv4j4h687kk3glr9vlf16as6pdfaq7h5mz73";
-       libraryHaskellDepends = [
-         base haskell-src-exts pretty syb template-haskell th-orphans
-       ];
-       testHaskellDepends = [
-         base containers haskell-src-exts HUnit pretty syb tasty tasty-hunit
-         template-haskell
-       ];
-       description = "Parse source to template-haskell abstract syntax";
-       license = lib.licenses.bsd3;
-     }) {};
-
-  "haskell-src-meta_0_8_8" = callPackage
-    ({ mkDerivation, base, containers, haskell-src-exts, HUnit, pretty
-     , syb, tasty, tasty-hunit, template-haskell, th-orphans
-     }:
-     mkDerivation {
-       pname = "haskell-src-meta";
        version = "0.8.8";
        sha256 = "0fg5h6k8m6hf7vwmczp8my2p1js5srhj7bcl7q0pdgd2d0lx43dd";
        libraryHaskellDepends = [
@@ -125534,7 +125591,6 @@ self: {
        ];
        description = "Parse source to template-haskell abstract syntax";
        license = lib.licenses.bsd3;
-       hydraPlatforms = lib.platforms.none;
      }) {};
 
   "haskell-src-meta-mwotton" = callPackage
@@ -127037,8 +127093,8 @@ self: {
      }:
      mkDerivation {
        pname = "haskoin-store";
-       version = "0.64.16";
-       sha256 = "13dbx5szx87zhb5xq007lbpisr94593sf3a144a5052pbghcyj4s";
+       version = "0.64.18";
+       sha256 = "19prs0gz8klr52w0kiad7s26mpr352i4q98ixdn2409di4mzl42x";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -127085,8 +127141,8 @@ self: {
      }:
      mkDerivation {
        pname = "haskoin-store-data";
-       version = "0.64.16";
-       sha256 = "01fgnbvwhxz4829ksv01165bvnhqyd3djjqm96819jp5r1ifzjin";
+       version = "0.64.18";
+       sha256 = "0kpzvl4xv4gxln9qcnlg658fakjr6j1yxxz8f6ixn8bsaqmaicrx";
        libraryHaskellDepends = [
          aeson base binary bytes bytestring cereal containers data-default
          deepseq hashable haskoin-core http-client http-types lens mtl
@@ -128361,6 +128417,24 @@ self: {
        license = lib.licenses.mit;
      }) {};
 
+  "hasql-transaction-io" = callPackage
+    ({ mkDerivation, base, bytestring, bytestring-tree-builder, hasql
+     , mtl, resourcet, safe-exceptions, transformers, unliftio-core
+     }:
+     mkDerivation {
+       pname = "hasql-transaction-io";
+       version = "0.1.0.0";
+       sha256 = "0cqm6c4axivxvw5r35ass9qa0bmgxnz7n8d8l12vz78nsfxp76ci";
+       libraryHaskellDepends = [
+         base bytestring bytestring-tree-builder hasql mtl resourcet
+         safe-exceptions transformers unliftio-core
+       ];
+       description = "Perform IO actions during transactions for Hasql";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+       broken = true;
+     }) {};
+
   "hasql-url" = callPackage
     ({ mkDerivation, base, bytestring, hasql, network-uri, split, tasty
      , tasty-quickcheck
@@ -130194,21 +130268,23 @@ self: {
   "headroom" = callPackage
     ({ mkDerivation, aeson, base, doctest, either, extra, file-embed
      , generic-data, hspec, hspec-discover, http-client, http-types
-     , microlens, microlens-th, modern-uri, mtl, mustache
-     , optparse-applicative, pcre-heavy, pcre-light, QuickCheck, req
-     , rio, string-interpolate, template-haskell, time, vcs-ignore, yaml
+     , microlens, microlens-aeson, microlens-th, modern-uri, mtl
+     , mustache, optparse-applicative, pcre-heavy, pcre-light
+     , persistent, persistent-sqlite, QuickCheck, req, rio
+     , string-interpolate, template-haskell, time, vcs-ignore, yaml
      }:
      mkDerivation {
        pname = "headroom";
-       version = "0.4.2.0";
-       sha256 = "1rg1n3pa6lh1a1flk8g8r5m1s77hl0cyd0c129rw8h1w2w2kkpj0";
+       version = "0.4.3.0";
+       sha256 = "17y1v6kfh1zbyqww5a4v54xqn06ix4ba8rr5dk8nfh5qsgf211d7";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
          aeson base either extra file-embed generic-data http-client
-         http-types microlens microlens-th modern-uri mtl mustache
-         optparse-applicative pcre-heavy pcre-light req rio
-         string-interpolate template-haskell time vcs-ignore yaml
+         http-types microlens microlens-aeson microlens-th modern-uri mtl
+         mustache optparse-applicative pcre-heavy pcre-light persistent
+         persistent-sqlite req rio string-interpolate template-haskell time
+         vcs-ignore yaml
        ];
        executableHaskellDepends = [ base optparse-applicative rio ];
        testHaskellDepends = [
@@ -131633,8 +131709,8 @@ self: {
      }:
      mkDerivation {
        pname = "hercules-ci-agent";
-       version = "0.8.4";
-       sha256 = "1w93027i5kddn1rj5dgnmvgsadfv3s6ziyga4k3mp094wx2g6syy";
+       version = "0.8.5";
+       sha256 = "1m1hak1ckch84ld2x0pg7jz6gixxanbjdhslmlygpgxaq1757hax";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -136873,6 +136949,8 @@ self: {
        testHaskellDepends = [ base filepath hls-test-utils ];
        description = "Rename plugin for Haskell Language Server";
        license = lib.licenses.asl20;
+       hydraPlatforms = lib.platforms.none;
+       broken = true;
      }) {};
 
   "hls-retrie-plugin" = callPackage
@@ -142335,8 +142413,8 @@ self: {
        pname = "hsass";
        version = "0.8.0";
        sha256 = "1bnjvj6dpmcbpkbi4g5m5hvr0w5rmd7y5zkiwbqc8n9y4l2dkd5g";
-       revision = "1";
-       editedCabalFile = "0d085g21zvawl2jv6ap5fyk70c9igbjiwknvk1mgdydxbm1kvyq5";
+       revision = "2";
+       editedCabalFile = "11xmb3mssql6ksdra03h9cqv0pdxgyj3askapbgpx6rmziw7a136";
        libraryHaskellDepends = [
          base bytestring data-default-class filepath hlibsass monad-loops
          transformers
@@ -145469,8 +145547,8 @@ self: {
      }:
      mkDerivation {
        pname = "hspec-snap";
-       version = "1.0.2.0";
-       sha256 = "1rqqyrnny5wk4xql1ddavq72qcvdhblm7ga8728i42v14n6z80i4";
+       version = "1.0.3.0";
+       sha256 = "19kpxxmfampssas8xjicsxka3lyscgg8yh04vxvnyiz48rr00194";
        libraryHaskellDepends = [
          aeson base bytestring containers digestive-functors HandsomeSoup
          hspec hspec-core HUnit hxt lens mtl snap snap-core text
@@ -146968,8 +147046,8 @@ self: {
     ({ mkDerivation, base, cli-arguments, lists-flines }:
      mkDerivation {
        pname = "html-presentation-text";
-       version = "0.2.0.0";
-       sha256 = "08fxj4nbjz3smx7h552id5z984jbbfyfj9m5aabh5vj5gi5i9jwl";
+       version = "0.2.1.0";
+       sha256 = "16lnshmxhxwx31kb9nji68imb492bigcb11mngyi94xbs40jayrr";
        isLibrary = false;
        isExecutable = true;
        executableHaskellDepends = [ base cli-arguments lists-flines ];
@@ -155008,8 +155086,8 @@ self: {
      }:
      mkDerivation {
        pname = "inline-asm";
-       version = "0.5.0.0";
-       sha256 = "02zxgkaa4wgacgj6si4158cxgk3cdf0gkvl5avmyrivbcc18xkdi";
+       version = "0.5.0.1";
+       sha256 = "1h1g9k71cihc1g0jfprvklcwlcw9ymihlvnsa1fy2mfr759xgjzy";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -156156,15 +156234,16 @@ self: {
      }) {};
 
   "interval-algebra" = callPackage
-    ({ mkDerivation, base, containers, foldl, hspec, QuickCheck, safe
-     , time, witherable
+    ({ mkDerivation, base, binary, containers, deepseq, foldl, hspec
+     , QuickCheck, safe, time, witherable
      }:
      mkDerivation {
        pname = "interval-algebra";
-       version = "1.2.0";
-       sha256 = "1n9db9p3v7da1d3j21lrm46s2py0m1rdfjpvilx43n7yd6630i81";
+       version = "1.3.0";
+       sha256 = "0qb23l8jsam2j58pvmqv3gcmxri1bsb1m8nayspssnrapwis0ig6";
        libraryHaskellDepends = [
-         base containers foldl QuickCheck safe time witherable
+         base binary containers deepseq foldl QuickCheck safe time
+         witherable
        ];
        testHaskellDepends = [
          base containers hspec QuickCheck safe time witherable
@@ -156448,6 +156527,8 @@ self: {
        testHaskellDepends = [ base QuickCheck transformers ];
        description = "bidirectional arrows, bijective functions, and invariant functors";
        license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
+       broken = true;
      }) {};
 
   "invertible-grammar" = callPackage
@@ -156492,6 +156573,7 @@ self: {
        ];
        description = "invertible transformer instances for HXT Picklers";
        license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
      }) {};
 
   "invertible-syntax" = callPackage
@@ -162363,6 +162445,8 @@ self: {
        pname = "katip";
        version = "0.8.7.0";
        sha256 = "1m74n6fyxczfgg3swkkgr6864mzji1l0dpwpxk5zd93488zrij9v";
+       revision = "1";
+       editedCabalFile = "14a0j9i7vn81qwsd343pswcamldhpyiic2nld57xw2lg50rdshfj";
        libraryHaskellDepends = [
          aeson async auto-update base bytestring containers either hostname
          microlens microlens-th monad-control mtl old-locale resourcet
@@ -165960,8 +166044,8 @@ self: {
      }:
      mkDerivation {
        pname = "language-avro";
-       version = "0.1.3.1";
-       sha256 = "0b54041z1sfrd7fck975i8d69agxij6jml6mxlcr41y7ywvizq0l";
+       version = "0.1.4.0";
+       sha256 = "1x7279nk306pc9db8bav6aj5g36g338mzjnhkgl21dqxh1qb43rx";
        libraryHaskellDepends = [
          avro base containers directory filepath megaparsec text vector
        ];
@@ -170332,8 +170416,8 @@ self: {
      }:
      mkDerivation {
        pname = "libmdbx";
-       version = "0.2.1.0";
-       sha256 = "1v5gjp1hr4c1r5nbf4r2j3pd2kxl36b9xpphmmxqin7jfmpj5fjj";
+       version = "0.2.1.1";
+       sha256 = "0rh6zq1p6yz858m3mb5jfqydglw54gr7pvniyjvd3zprsr0pa0jf";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -176315,7 +176399,7 @@ self: {
        hydraPlatforms = lib.platforms.none;
      }) {};
 
-  "lsp-types_1_4_0_0" = callPackage
+  "lsp-types_1_4_0_1" = callPackage
     ({ mkDerivation, aeson, base, binary, bytestring, containers
      , data-default, deepseq, Diff, directory, dlist, filepath, hashable
      , hslogger, lens, mod, mtl, network-uri, rope-utf16-splay
@@ -176324,8 +176408,8 @@ self: {
      }:
      mkDerivation {
        pname = "lsp-types";
-       version = "1.4.0.0";
-       sha256 = "0rzvjfn26qrgb7h21m20rvdc7x730z93lgmrz4m4l7g9s2xa7s3s";
+       version = "1.4.0.1";
+       sha256 = "0dxf5nnaxs2564hgjldkclhm5gvszjxxvz6gk00jmx0gf8k6dm8z";
        libraryHaskellDepends = [
          aeson base binary bytestring containers data-default deepseq Diff
          directory dlist filepath hashable hslogger lens mod mtl network-uri
@@ -181374,8 +181458,8 @@ self: {
      }:
      mkDerivation {
        pname = "mega-sdist";
-       version = "0.4.1.0";
-       sha256 = "124wa7v8vx82gd04brgv3kphyqs0p5x9hp1vlp39bkha9w1yab7w";
+       version = "0.4.2.0";
+       sha256 = "002qwccn4nwd7ik78k3qq9jxchj1v57c0c4b56w8424xg5291lzk";
        isLibrary = false;
        isExecutable = true;
        executableHaskellDepends = [
@@ -182985,15 +183069,15 @@ self: {
        license = lib.licenses.mit;
      }) {};
 
-  "microlens-aeson_2_4_0" = callPackage
+  "microlens-aeson_2_4_1" = callPackage
     ({ mkDerivation, aeson, attoparsec, base, bytestring, deepseq
      , hashable, microlens, scientific, tasty, tasty-hunit, text
      , unordered-containers, vector
      }:
      mkDerivation {
        pname = "microlens-aeson";
-       version = "2.4.0";
-       sha256 = "103r9i4ky58y34rb82dmw20npbzzk4brn9nn4650m7mdzcgmz0zm";
+       version = "2.4.1";
+       sha256 = "0h11h1vg467aq1w6gfb0jvzvhk6xsl1i1bl7qfw5kdsnvrd3nbg9";
        libraryHaskellDepends = [
          aeson attoparsec base bytestring deepseq hashable microlens
          scientific text unordered-containers vector
@@ -184819,8 +184903,8 @@ self: {
        pname = "mmark";
        version = "0.0.7.4";
        sha256 = "0flsg9jsnzab74hfidrfdmjvarj3n86db4ysv007j2hlr3iynnxx";
-       revision = "1";
-       editedCabalFile = "05021pxrdgymlk51zs72mbf6lg3j0zf9f0sim1qlhviwp0dwk5nv";
+       revision = "2";
+       editedCabalFile = "06sq65cmqr5yva4spf14bkdsvw465m73hjmvxcfh7vxn0nslp2bc";
        enableSeparateDataOutput = true;
        libraryHaskellDepends = [
          aeson base case-insensitive containers deepseq dlist email-validate
@@ -187779,6 +187863,26 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
+  "monoid-subclasses_1_1_3" = callPackage
+    ({ mkDerivation, base, bytestring, containers, primes, QuickCheck
+     , quickcheck-instances, tasty, tasty-quickcheck, text, vector
+     }:
+     mkDerivation {
+       pname = "monoid-subclasses";
+       version = "1.1.3";
+       sha256 = "1nglki10rlpi872p55pa8g809q5sna7yzh3zw4rqfhq89kb15wcv";
+       libraryHaskellDepends = [
+         base bytestring containers primes text vector
+       ];
+       testHaskellDepends = [
+         base bytestring containers primes QuickCheck quickcheck-instances
+         tasty tasty-quickcheck text vector
+       ];
+       description = "Subclasses of Monoid";
+       license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "monoid-transformer" = callPackage
     ({ mkDerivation, base, semigroups }:
      mkDerivation {
@@ -187865,10 +187969,10 @@ self: {
      }:
      mkDerivation {
        pname = "monomer";
-       version = "1.2.0.0";
-       sha256 = "1hd65flmygy2afvnpjcj7l06ic1lycb6x5gbxhgmxxb2ilj6h6wf";
-       revision = "1";
-       editedCabalFile = "146sy318bf3bdv2xjnpxv0i8g5q04hq32grdjqs2nw2javx2qlc1";
+       version = "1.3.0.0";
+       sha256 = "19k31vppid5lyvqg4q4r07yzw9yisydhx012yn1fzlfjwc89g9bp";
+       revision = "3";
+       editedCabalFile = "1jz12ww843d0qk7gy6f8fw4l2mpynkcs9knxfc865zyhcjvimfw2";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -189905,8 +190009,8 @@ self: {
     ({ mkDerivation, base, mtl }:
      mkDerivation {
        pname = "mtl-uplift";
-       version = "0.1.0.0";
-       sha256 = "1y75za4xl941aadn3bmc3rsa2jklv8z0l4vkwz7x92pbxv5ym8xq";
+       version = "0.1.0.1";
+       sha256 = "01f70cwsy8qinwsmh27js8165bmqkr6ykzmwi2r3svlpxpaiiazk";
        libraryHaskellDepends = [ base mtl ];
        testHaskellDepends = [ base mtl ];
        description = "Lift substacks of monad transformer stacks";
@@ -192972,8 +193076,8 @@ self: {
        pname = "nanovg";
        version = "0.8.0.0";
        sha256 = "1il4305wv7f53225jv5s04nf7gf5rw6cfxm8j3v1di2xvhdingz5";
-       revision = "1";
-       editedCabalFile = "0m69iqs8jaqh1gq1vfp92j2adf05v0isakl3ijxf7akxs5j2i3da";
+       revision = "2";
+       editedCabalFile = "1vvlmbvpafvqawfph2aicysy9nklm8rqdz2bdpkq0kg4dgi72jr2";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [ base bytestring containers text vector ];
@@ -194551,14 +194655,14 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
-  "network_3_1_2_5" = callPackage
+  "network_3_1_2_7" = callPackage
     ({ mkDerivation, base, bytestring, deepseq, directory, hspec
      , hspec-discover, HUnit, QuickCheck, temporary
      }:
      mkDerivation {
        pname = "network";
-       version = "3.1.2.5";
-       sha256 = "0l8qn0m1pza4iv0x14izgpggisbk91yfipwmwpjbmcb73j7c08zj";
+       version = "3.1.2.7";
+       sha256 = "119xqsyj44ix0z79mzfpww0cd9936bki1xa7cwykvbx1y7z20xkz";
        libraryHaskellDepends = [ base bytestring deepseq directory ];
        testHaskellDepends = [
          base bytestring directory hspec HUnit QuickCheck temporary
@@ -200916,8 +201020,8 @@ self: {
      }:
      mkDerivation {
        pname = "openai-hs";
-       version = "0.2.1.0";
-       sha256 = "1b92hkah0ac3mac8lcfvq9c37wfk9hfgcd0nzhpznqsk72zhb4v6";
+       version = "0.2.2.0";
+       sha256 = "07jyz6bgz2s21j5w5avpi7hllcxw9ix3m3r1lyjb0kwa5rvvpl7d";
        libraryHaskellDepends = [
          aeson base bytestring casing cpphs http-client http-types
          openai-servant servant servant-client servant-multipart-client text
@@ -200939,8 +201043,8 @@ self: {
      }:
      mkDerivation {
        pname = "openai-servant";
-       version = "0.2.1.0";
-       sha256 = "0cwr8mz1kdc3xp5a5g5d08amgy9y6h79k0l0w6ypafr9yf6braw8";
+       version = "0.2.2.0";
+       sha256 = "1h9g7sak3142hlw83dlb8h5q5fkdgy6rz81syidq0cvg8hzx9bzq";
        libraryHaskellDepends = [
          aeson base bytestring casing servant servant-multipart-api text
          time vector
@@ -204680,8 +204784,8 @@ self: {
      }:
      mkDerivation {
        pname = "pandoc-crossref";
-       version = "0.3.12.1";
-       sha256 = "036lw5qa23bg292hgfj3ybfykbqj80fb2f8a26rnivj5pfqblm3w";
+       version = "0.3.12.2";
+       sha256 = "1d2g4aggv47gv83p4382bcy1x97z0bs4nqww37ay92n9r4jh6m4l";
        isLibrary = true;
        isExecutable = true;
        enableSeparateDataOutput = true;
@@ -209701,10 +209805,8 @@ self: {
      }:
      mkDerivation {
        pname = "persistent";
-       version = "2.13.2.1";
-       sha256 = "13lp9i94f57qhifdmr1vnsrra34526f7kqa1sybcaj2jh2v3q85k";
-       revision = "1";
-       editedCabalFile = "15lx2kd8ijn91h65nhzxmd50hmmybhs6x6qfg5wnl3ylcmgi6glg";
+       version = "2.13.2.2";
+       sha256 = "1pj5svwf85b0yndixlcqzjpqwp50zfqra99qm7hf1hlwq5g4amy9";
        libraryHaskellDepends = [
          aeson attoparsec base base64-bytestring blaze-html bytestring
          conduit containers fast-logger http-api-data lift-type monad-logger
@@ -210161,8 +210263,8 @@ self: {
      }:
      mkDerivation {
        pname = "persistent-postgresql";
-       version = "2.13.2.1";
-       sha256 = "07pnr8m0nk43jaz6l293lzx4ivyqgnw94fjypazzm008b4irh7ir";
+       version = "2.13.2.2";
+       sha256 = "0giwwndy8f6pr4xvqgkv939x93r3sj2a6rkz4v8xrrrvmgq9hbpi";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -210226,8 +210328,8 @@ self: {
      }:
      mkDerivation {
        pname = "persistent-qq";
-       version = "2.12.0.1";
-       sha256 = "1dvniapxjaw2vmdqd5cplwxdxiy2l6z6gns8gp3ci3rn3xp0pf6p";
+       version = "2.12.0.2";
+       sha256 = "0pzlhwl4h9q358zc6d0m5zv0ii2yhf2lzw0a3v2spfc1ch4a014a";
        libraryHaskellDepends = [
          base haskell-src-meta mtl persistent template-haskell text
        ];
@@ -210345,8 +210447,8 @@ self: {
      }:
      mkDerivation {
        pname = "persistent-sqlite";
-       version = "2.13.0.3";
-       sha256 = "12za89crbk74mya4qxpw5fp5fqp64vwz5s8vbjd7m8r3j3vbw338";
+       version = "2.13.0.4";
+       sha256 = "1lvjdh2c4c7z8z8fsl8bz5rygnkph6ql01jnn53mp0v98crk2s9w";
        configureFlags = [ "-fsystemlib" ];
        isLibrary = true;
        isExecutable = true;
@@ -210412,8 +210514,8 @@ self: {
      }:
      mkDerivation {
        pname = "persistent-test";
-       version = "2.13.0.3";
-       sha256 = "07q53jvhz00cf10k7a8fkvykgwcl10fgzh8k9gv1d248f336crvs";
+       version = "2.13.0.4";
+       sha256 = "0vcq5wg63py4k5nv5042lcdzz24wbpwzhd2ww02ijf5wmgqqg63p";
        libraryHaskellDepends = [
          aeson base blaze-html bytestring conduit containers exceptions
          hspec hspec-expectations http-api-data HUnit monad-control
@@ -215450,8 +215552,8 @@ self: {
      }:
      mkDerivation {
        pname = "polysemy-RandomFu";
-       version = "0.4.4.0";
-       sha256 = "0mh6iiyz859446l8r54bqg8hmaig40kdapq9k4niry35nba6fdr1";
+       version = "0.4.4.1";
+       sha256 = "1zw8n16dm2l8rwrf014kb9jhp3q4a719bp8p08s4fnlksqkf88vl";
        libraryHaskellDepends = [
          base polysemy polysemy-plugin polysemy-zoo random-fu random-source
        ];
@@ -215682,8 +215784,8 @@ self: {
      }:
      mkDerivation {
        pname = "polysemy-log";
-       version = "0.4.2.0";
-       sha256 = "106b9y3apffc84k9idb1vmfjjfwjww4xlpqn4mphrf7w2cxyn6gv";
+       version = "0.4.3.0";
+       sha256 = "0n7szglzj8jkb6cpkbj0496wd5k4cy4lvih026r6bcb7m943ki71";
        libraryHaskellDepends = [
          ansi-terminal async base polysemy polysemy-conc polysemy-time
          relude template-haskell text time
@@ -215702,8 +215804,8 @@ self: {
      }:
      mkDerivation {
        pname = "polysemy-log-co";
-       version = "0.4.2.0";
-       sha256 = "03ipk2085zr3mm7m2qyiixxf4gpmv0bbyw1s1ykqngh7f6d6f2pp";
+       version = "0.4.3.0";
+       sha256 = "1qhhhlbkvx4jxanfwgnnhn0yvhi2zp7sm3ssn3nc48vm1gzmb867";
        libraryHaskellDepends = [
          base co-log co-log-core co-log-polysemy polysemy polysemy-conc
          polysemy-log polysemy-time
@@ -215723,8 +215825,8 @@ self: {
      }:
      mkDerivation {
        pname = "polysemy-log-di";
-       version = "0.4.2.0";
-       sha256 = "0kmrwyfsldpaafkimfi4plx6ngppq0jj5mhrpknfg5v2ca9j691k";
+       version = "0.4.3.0";
+       sha256 = "0cy1iwybb4m6n2rivmzzp4ikj8n1qhw1k4f13xiwf98s7abasa5l";
        libraryHaskellDepends = [
          base di-polysemy polysemy polysemy-conc polysemy-log polysemy-time
        ];
@@ -229215,6 +229317,43 @@ self: {
        hydraPlatforms = lib.platforms.none;
      }) {};
 
+  "reanimate_1_1_5_0" = callPackage
+    ({ mkDerivation, aeson, ansi-terminal, array, attoparsec, base
+     , base64-bytestring, bytestring, cassava, cereal, colour
+     , containers, cryptohash-sha256, cubicbezier, directory, filelock
+     , filepath, fingertree, fsnotify, geojson, hashable, hgeometry
+     , hgeometry-combinatorial, JuicyPixels, lens, linear, matrix, mtl
+     , neat-interpolation, network, open-browser, optparse-applicative
+     , parallel, process, QuickCheck, random, random-shuffle
+     , reanimate-svg, split, tasty, tasty-expected-failure, tasty-golden
+     , tasty-hunit, tasty-quickcheck, tasty-rerun, temporary, text, time
+     , unix, unordered-containers, vector, vector-space, websockets, xml
+     }:
+     mkDerivation {
+       pname = "reanimate";
+       version = "1.1.5.0";
+       sha256 = "0gy5s68d00szs1ljfcyisp19g3vz4i1mlbxpym0mymzc5v723wfa";
+       enableSeparateDataOutput = true;
+       libraryHaskellDepends = [
+         aeson ansi-terminal array attoparsec base base64-bytestring
+         bytestring cassava cereal colour containers cryptohash-sha256
+         cubicbezier directory filelock filepath fingertree fsnotify geojson
+         hashable hgeometry hgeometry-combinatorial JuicyPixels lens linear
+         matrix mtl neat-interpolation network open-browser
+         optparse-applicative parallel process random random-shuffle
+         reanimate-svg split temporary text time unix unordered-containers
+         vector vector-space websockets xml
+       ];
+       testHaskellDepends = [
+         base bytestring directory filepath linear process QuickCheck tasty
+         tasty-expected-failure tasty-golden tasty-hunit tasty-quickcheck
+         tasty-rerun temporary text vector
+       ];
+       description = "Animation library based on SVGs";
+       license = lib.licenses.publicDomain;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "reanimate-svg" = callPackage
     ({ mkDerivation, attoparsec, base, bytestring, containers, Diff
      , directory, double-conversion, filepath, hashable, JuicyPixels
@@ -231641,8 +231780,8 @@ self: {
      }:
      mkDerivation {
        pname = "regex-rure";
-       version = "0.1.0.2";
-       sha256 = "1nqly1c2pg7c44jaajl3kj8hibybm5w8ly4ndyfgmrs60d2kzhyw";
+       version = "0.1.1.0";
+       sha256 = "1ap1cpm82dv9q9w8y6cf0rp9f5zvspnql9zr35fknaxaskr86zgj";
        libraryHaskellDepends = [ base bytestring ];
        librarySystemDepends = [ rure ];
        libraryToolDepends = [ c2hs ];
@@ -251058,48 +251197,47 @@ self: {
     ({ mkDerivation, aeson, ansi-terminal, asn1-encoding, asn1-types
      , async, attoparsec, base, base64-bytestring, bytestring
      , composition, constraints, containers, cryptonite, cryptostore
-     , data-default, direct-sqlite, directory, file-embed, filepath
-     , generic-random, hspec, hspec-core, http-types, HUnit, ini
-     , iso8601-time, memory, mtl, network, network-transport
-     , optparse-applicative, process, QuickCheck, random, simple-logger
-     , sqlite-simple, stm, template-haskell, text, time, timeit, tls
-     , transformers, unliftio, unliftio-core, websockets, x509
-     , x509-store, x509-validation
+     , data-default, direct-sqlite, directory, filepath, generic-random
+     , hspec, hspec-core, http-types, HUnit, ini, iso8601-time, memory
+     , mtl, network, network-transport, optparse-applicative, process
+     , QuickCheck, random, simple-logger, sqlite-simple, stm
+     , template-haskell, text, time, timeit, tls, transformers, unliftio
+     , unliftio-core, websockets, x509, x509-store, x509-validation
      }:
      mkDerivation {
        pname = "simplexmq";
-       version = "1.0.0";
-       sha256 = "0ldri2kp1hadsx9kbypkkijijak1c6zy2h5apj6kgnh7f9a851pm";
+       version = "1.0.2";
+       sha256 = "142jpsy8myjffx4c1iw21iv210wgnyikmr66bih4gm3xgbqniz9q";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
          aeson ansi-terminal asn1-encoding asn1-types async attoparsec base
          base64-bytestring bytestring composition constraints containers
          cryptonite cryptostore data-default direct-sqlite directory
-         file-embed filepath generic-random http-types iso8601-time memory
-         mtl network network-transport QuickCheck random simple-logger
-         sqlite-simple stm template-haskell text time tls transformers
-         unliftio unliftio-core websockets x509 x509-store x509-validation
+         filepath generic-random http-types iso8601-time memory mtl network
+         network-transport QuickCheck random simple-logger sqlite-simple stm
+         template-haskell text time tls transformers unliftio unliftio-core
+         websockets x509 x509-store x509-validation
        ];
        executableHaskellDepends = [
          aeson ansi-terminal asn1-encoding asn1-types async attoparsec base
          base64-bytestring bytestring composition constraints containers
          cryptonite cryptostore data-default direct-sqlite directory
-         file-embed filepath generic-random http-types ini iso8601-time
-         memory mtl network network-transport optparse-applicative process
-         QuickCheck random simple-logger sqlite-simple stm template-haskell
-         text time tls transformers unliftio unliftio-core websockets x509
-         x509-store x509-validation
+         filepath generic-random http-types ini iso8601-time memory mtl
+         network network-transport optparse-applicative process QuickCheck
+         random simple-logger sqlite-simple stm template-haskell text time
+         tls transformers unliftio unliftio-core websockets x509 x509-store
+         x509-validation
        ];
        testHaskellDepends = [
          aeson ansi-terminal asn1-encoding asn1-types async attoparsec base
          base64-bytestring bytestring composition constraints containers
          cryptonite cryptostore data-default direct-sqlite directory
-         file-embed filepath generic-random hspec hspec-core http-types
-         HUnit iso8601-time memory mtl network network-transport QuickCheck
-         random simple-logger sqlite-simple stm template-haskell text time
-         timeit tls transformers unliftio unliftio-core websockets x509
-         x509-store x509-validation
+         filepath generic-random hspec hspec-core http-types HUnit
+         iso8601-time memory mtl network network-transport QuickCheck random
+         simple-logger sqlite-simple stm template-haskell text time timeit
+         tls transformers unliftio unliftio-core websockets x509 x509-store
+         x509-validation
        ];
        description = "SimpleXMQ message broker";
        license = lib.licenses.agpl3Only;
@@ -252021,14 +252159,14 @@ self: {
        license = lib.licenses.gpl2Only;
      }) {};
 
-  "skylighting_0_12_1" = callPackage
+  "skylighting_0_12_2" = callPackage
     ({ mkDerivation, base, binary, blaze-html, bytestring, containers
      , pretty-show, skylighting-core, text
      }:
      mkDerivation {
        pname = "skylighting";
-       version = "0.12.1";
-       sha256 = "0aaxw2b6lwdnabm5p7nj7xv39lscypvzyivnsjrxham5qvgsvnn8";
+       version = "0.12.2";
+       sha256 = "11qzlbzw66ryp1n3fkkhh4g0g29zajs3kf7rv3byjvy9bny5qfi6";
        configureFlags = [ "-fexecutable" ];
        isLibrary = true;
        isExecutable = true;
@@ -252074,7 +252212,7 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
-  "skylighting-core_0_12_1" = callPackage
+  "skylighting-core_0_12_2" = callPackage
     ({ mkDerivation, aeson, ansi-terminal, attoparsec, base
      , base64-bytestring, binary, blaze-html, bytestring
      , case-insensitive, colour, containers, criterion, Diff, directory
@@ -252084,8 +252222,8 @@ self: {
      }:
      mkDerivation {
        pname = "skylighting-core";
-       version = "0.12.1";
-       sha256 = "0lyiax1smgv729109h3yhbpm0l6r7rwrfmp2df2ypmh3k6s88rhf";
+       version = "0.12.2";
+       sha256 = "0zgwzk69ww8w88gaga9fnk2inf6rsqhy5hmj0i29xhd6pb78v92v";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -258537,8 +258675,8 @@ self: {
        pname = "stack";
        version = "2.7.3";
        sha256 = "0i2v5i6bg90n6i4clcaww8m8702d3y5z8r03xdizdisjhf0zijj7";
-       revision = "1";
-       editedCabalFile = "0j99hh3lf886qvf86xwgv9a0ps9vp40z2s3xnl4lr4mgn9f0lrvb";
+       revision = "2";
+       editedCabalFile = "0i1fgairidy8g8zcf9wim4cg2y2xsvknkyz7dnb1mzy02ls6kqjb";
        configureFlags = [
          "-fdisable-git-info" "-fhide-dependency-versions"
          "-fsupported-build"
@@ -258616,8 +258754,8 @@ self: {
      }:
      mkDerivation {
        pname = "stack-all";
-       version = "0.3.1";
-       sha256 = "0jsz28p1xpzh77r3mhjh98jsz3lnzirfvh9w64rcgxpacdyajwhf";
+       version = "0.4";
+       sha256 = "0m9wiy233lw6bp6gz4h2x8bdi0lwsjl36bzx6544cdp91vllkzj1";
        isLibrary = false;
        isExecutable = true;
        executableHaskellDepends = [
@@ -260611,8 +260749,8 @@ self: {
      }:
      mkDerivation {
        pname = "stm-actor";
-       version = "0.2.3.1";
-       sha256 = "1gl4hladndwbjdb02hcb5mdirm9gnz23ayclh0wws8xsq23dv2b4";
+       version = "0.2.3.2";
+       sha256 = "0h81amww5caa8950nn124sn5804vdsvxz2nahwvx88hbgsgldpkg";
        libraryHaskellDepends = [
          base mtl stm stm-queue transformers unliftio-core
        ];
@@ -273220,6 +273358,22 @@ self: {
        broken = true;
      }) {};
 
+  "text-rope" = callPackage
+    ({ mkDerivation, base, deepseq, random, tasty, tasty-bench
+     , tasty-quickcheck, text, vector
+     }:
+     mkDerivation {
+       pname = "text-rope";
+       version = "0.1";
+       sha256 = "0dfn8hjnw38zh9nw7wy2jfyg0acg9jpfhngj65aczb9qxv6yj3hv";
+       enableSeparateDataOutput = true;
+       libraryHaskellDepends = [ base deepseq text vector ];
+       testHaskellDepends = [ base tasty tasty-quickcheck text ];
+       benchmarkHaskellDepends = [ base random tasty-bench text ];
+       description = "Text lines and ropes";
+       license = lib.licenses.bsd3;
+     }) {};
+
   "text-short" = callPackage
     ({ mkDerivation, base, binary, bytestring, deepseq, ghc-prim
      , hashable, quickcheck-instances, tasty, tasty-hunit
@@ -276983,8 +277137,8 @@ self: {
      }:
      mkDerivation {
        pname = "tls";
-       version = "1.5.6";
-       sha256 = "0mr5p1h161bdhnkfx4mvlk1hqq89z0fh7z37jgrbx4i8aa61cs96";
+       version = "1.5.7";
+       sha256 = "16pp6q0r4l23l3qi8v4yn4gjdsck8mg2jy3x7m7z5g6v9047v7mq";
        libraryHaskellDepends = [
          asn1-encoding asn1-types async base bytestring cereal cryptonite
          data-default-class hourglass memory mtl network transformers x509
@@ -279479,6 +279633,27 @@ self: {
        broken = true;
      }) {};
 
+  "traverse-code" = callPackage
+    ({ mkDerivation, array, base, containers, ghc-prim, linear-generics
+     , primitive, tasty, tasty-hunit, template-haskell
+     }:
+     mkDerivation {
+       pname = "traverse-code";
+       version = "0.1.1.1";
+       sha256 = "0nz3zmmcvfsm6xsl6sy7c88dzdxglhjpk8h8sah2xdy58gwdgjd2";
+       libraryHaskellDepends = [
+         array base containers ghc-prim linear-generics primitive
+         template-haskell
+       ];
+       testHaskellDepends = [
+         base containers linear-generics primitive tasty tasty-hunit
+         template-haskell
+       ];
+       description = "General data structure lifting for Template Haskell";
+       license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "traverse-with-class" = callPackage
     ({ mkDerivation, base, tasty, tasty-hunit, template-haskell
      , transformers
@@ -286794,8 +286969,8 @@ self: {
        pname = "uri-encode";
        version = "1.5.0.7";
        sha256 = "0lj2h701af12539p957rw24bxr07mfqd5r4h52i42f43ax165767";
-       revision = "1";
-       editedCabalFile = "172mgdd8dgy8wphgl9vbvp26lrzp01prr5jshbng4rlhpyd340p1";
+       revision = "2";
+       editedCabalFile = "03pmvbi56gmg1z2wr3glncc7dbyh666bqp565inh31qzsp9zwmgj";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -289374,6 +289549,25 @@ self: {
        license = lib.licenses.mit;
      }) {};
 
+  "vector-circular_0_1_4" = callPackage
+    ({ mkDerivation, base, deepseq, hedgehog, hedgehog-classes
+     , nonempty-vector, primitive, semigroupoids, template-haskell
+     , vector
+     }:
+     mkDerivation {
+       pname = "vector-circular";
+       version = "0.1.4";
+       sha256 = "18aijs6yn01bv3zal7l0wsck0hd54bbhckjc67cvr8wmpqdk2xxw";
+       libraryHaskellDepends = [
+         base deepseq nonempty-vector primitive semigroupoids
+         template-haskell vector
+       ];
+       testHaskellDepends = [ base hedgehog hedgehog-classes ];
+       description = "circular vectors";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "vector-clock" = callPackage
     ({ mkDerivation, array, base, binary, ghc-prim, hashable, HUnit
      , QuickCheck, test-framework, test-framework-hunit
@@ -290092,8 +290286,8 @@ self: {
      }:
      mkDerivation {
        pname = "versions";
-       version = "5.0.1";
-       sha256 = "0m7c0iiws3j716a5wksv9dxfcsz6dlvpw147m7ah2b8pfjwqg48c";
+       version = "5.0.2";
+       sha256 = "1955mng820n4bmk5vb8h7whlcwnnvxmwbdp7bxabyfy536bkdb77";
        libraryHaskellDepends = [
          base deepseq hashable megaparsec parser-combinators text
        ];
@@ -291276,8 +291470,8 @@ self: {
      }:
      mkDerivation {
        pname = "vulkan";
-       version = "3.14.2";
-       sha256 = "0zd6zki6hx0bhqvy20yhvd3597nxaasl2665s7m64bi02qjgjwsj";
+       version = "3.15";
+       sha256 = "1b76crd9nib0pcgpwbrbwr88zij5wrc6hs240w3sg16zxhwpllh1";
        libraryHaskellDepends = [ base bytestring transformers vector ];
        libraryPkgconfigDepends = [ vulkan ];
        testHaskellDepends = [
@@ -291309,8 +291503,8 @@ self: {
      }:
      mkDerivation {
        pname = "vulkan-utils";
-       version = "0.5.4";
-       sha256 = "1mkx2h7yjmq8djgg1pi3vlx2pq4armasa1hvam955p3x09vwbisk";
+       version = "0.5.5";
+       sha256 = "0p5ciadgkamgkzmay5rwc1mjs2wq8pqv21rbbbxlnjwmfsayrb9j";
        setupHaskellDepends = [ base Cabal cabal-doctest ];
        libraryHaskellDepends = [
          base bytestring containers dependent-map dependent-sum extra
@@ -294009,6 +294203,7 @@ self: {
        testHaskellDepends = [ base bytestring HUnit network-uri text ];
        description = "Composable, reversible, efficient web routing using invertible invariants and bijections";
        license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
      }) {};
 
   "web-mongrel2" = callPackage
@@ -294396,22 +294591,36 @@ self: {
      }) {};
 
   "webauthn" = callPackage
-    ({ mkDerivation, aeson, asn1-encoding, asn1-types, base
-     , base16-bytestring, base64-bytestring, bytestring, cborg, cereal
-     , containers, cryptonite, hashable, memory, serialise, text, x509
+    ({ mkDerivation, aeson, asn1-encoding, asn1-parse, asn1-types, base
+     , base16-bytestring, base64-bytestring, binary, bytestring, cborg
+     , containers, cryptonite, deriving-aeson, directory, file-embed
+     , filepath, hashable, hourglass, hspec, hspec-expectations-json
+     , jose, lens, memory, monad-time, mtl, pem, QuickCheck
+     , quickcheck-instances, serialise, singletons, text, time
+     , unordered-containers, uuid, validation, x509, x509-store
      , x509-validation
      }:
      mkDerivation {
        pname = "webauthn";
-       version = "0";
-       sha256 = "1nmrxpc0q7bs4z7gnkxbm02qpp8c2rn48hxi52y1k4iqglp9mmp0";
+       version = "0.1.1.0";
+       sha256 = "1zjkx57k2j998gxi7gylq0d8djiwdi4b4b486msn4q998jn2h8qy";
        libraryHaskellDepends = [
-         aeson asn1-encoding asn1-types base base16-bytestring
-         base64-bytestring bytestring cborg cereal containers cryptonite
-         hashable memory serialise text x509 x509-validation
+         aeson asn1-encoding asn1-parse asn1-types base base16-bytestring
+         base64-bytestring binary bytestring cborg containers cryptonite
+         deriving-aeson file-embed hashable hourglass jose lens memory
+         monad-time mtl serialise singletons text time unordered-containers
+         uuid validation x509 x509-store x509-validation
        ];
-       description = "Web Authentication API";
-       license = lib.licenses.bsd3;
+       testHaskellDepends = [
+         aeson asn1-encoding base bytestring containers cryptonite directory
+         filepath hourglass hspec hspec-expectations-json memory mtl pem
+         QuickCheck quickcheck-instances serialise singletons text uuid
+         validation x509 x509-store
+       ];
+       description = "Relying party (server) implementation of the WebAuthn 2 specification";
+       license = lib.licenses.asl20;
+       hydraPlatforms = lib.platforms.none;
+       broken = true;
      }) {};
 
   "webby" = callPackage
@@ -298173,29 +298382,6 @@ self: {
      }:
      mkDerivation {
        pname = "x509";
-       version = "1.7.5";
-       sha256 = "1j67c35g8334jx7x32hh6awhr43dplp0qwal5gnlkmx09axzrc5i";
-       revision = "1";
-       editedCabalFile = "1z98llpggldy4yb7afcsn3r3q4vklvx2pqyrhy9fir5y2yd5l601";
-       libraryHaskellDepends = [
-         asn1-encoding asn1-parse asn1-types base bytestring containers
-         cryptonite hourglass memory mtl pem
-       ];
-       testHaskellDepends = [
-         asn1-types base bytestring cryptonite hourglass mtl tasty
-         tasty-quickcheck
-       ];
-       description = "X509 reader and writer";
-       license = lib.licenses.bsd3;
-     }) {};
-
-  "x509_1_7_6" = callPackage
-    ({ mkDerivation, asn1-encoding, asn1-parse, asn1-types, base
-     , bytestring, containers, cryptonite, hourglass, memory, mtl, pem
-     , tasty, tasty-quickcheck
-     }:
-     mkDerivation {
-       pname = "x509";
        version = "1.7.6";
        sha256 = "114qjgx080zxbw5w9c3yy28k905bq99rwl6zgbsa0y3gawx9mmd5";
        libraryHaskellDepends = [
@@ -298208,7 +298394,6 @@ self: {
        ];
        description = "X509 reader and writer";
        license = lib.licenses.bsd3;
-       hydraPlatforms = lib.platforms.none;
      }) {};
 
   "x509-store" = callPackage
@@ -298218,26 +298403,6 @@ self: {
      }:
      mkDerivation {
        pname = "x509-store";
-       version = "1.6.7";
-       sha256 = "1y8yyr1i95jkllg8k0z54k5v4vachp848clc07m33xpxidn3b1lp";
-       revision = "1";
-       editedCabalFile = "04h2h8kdzhd2fp3w4a834xc1n88b1jgrxlgcsynfn0iwpbsb41x7";
-       libraryHaskellDepends = [
-         asn1-encoding asn1-types base bytestring containers cryptonite
-         directory filepath mtl pem x509
-       ];
-       testHaskellDepends = [ base bytestring tasty tasty-hunit x509 ];
-       description = "X.509 collection accessing and storing methods";
-       license = lib.licenses.bsd3;
-     }) {};
-
-  "x509-store_1_6_9" = callPackage
-    ({ mkDerivation, asn1-encoding, asn1-types, base, bytestring
-     , containers, cryptonite, directory, filepath, mtl, pem, tasty
-     , tasty-hunit, x509
-     }:
-     mkDerivation {
-       pname = "x509-store";
        version = "1.6.9";
        sha256 = "1nn8ql7vkp4qgf2msm600sr6ranpsajbhq0sc4c0l6pk1i9174n5";
        libraryHaskellDepends = [
@@ -298247,7 +298412,6 @@ self: {
        testHaskellDepends = [ base bytestring tasty tasty-hunit x509 ];
        description = "X.509 collection accessing and storing methods";
        license = lib.licenses.bsd3;
-       hydraPlatforms = lib.platforms.none;
      }) {};
 
   "x509-system" = callPackage
@@ -298256,22 +298420,6 @@ self: {
      }:
      mkDerivation {
        pname = "x509-system";
-       version = "1.6.6";
-       sha256 = "06a4m9c7vlr9nhp9gmqbb46arf0yj1dkdm4nip03hzy67spdmp20";
-       libraryHaskellDepends = [
-         base bytestring containers directory filepath mtl pem process x509
-         x509-store
-       ];
-       description = "Handle per-operating-system X.509 accessors and storage";
-       license = lib.licenses.bsd3;
-     }) {};
-
-  "x509-system_1_6_7" = callPackage
-    ({ mkDerivation, base, bytestring, containers, directory, filepath
-     , mtl, pem, process, x509, x509-store
-     }:
-     mkDerivation {
-       pname = "x509-system";
        version = "1.6.7";
        sha256 = "049bdaxrih49nkhkyl2342qnbx2f0q99z8rld648bz1kkgyizz38";
        libraryHaskellDepends = [
@@ -298280,7 +298428,6 @@ self: {
        ];
        description = "Handle per-operating-system X.509 accessors and storage";
        license = lib.licenses.bsd3;
-       hydraPlatforms = lib.platforms.none;
      }) {};
 
   "x509-util" = callPackage
@@ -298309,28 +298456,6 @@ self: {
      }:
      mkDerivation {
        pname = "x509-validation";
-       version = "1.6.11";
-       sha256 = "16yihzljql3z8w5rgdl95fv3hgk7yd86kbl9b3glllsark5j2hzr";
-       libraryHaskellDepends = [
-         asn1-encoding asn1-types base bytestring containers cryptonite
-         data-default-class hourglass memory mtl pem x509 x509-store
-       ];
-       testHaskellDepends = [
-         asn1-encoding asn1-types base bytestring cryptonite
-         data-default-class hourglass memory tasty tasty-hunit x509
-         x509-store
-       ];
-       description = "X.509 Certificate and CRL validation";
-       license = lib.licenses.bsd3;
-     }) {};
-
-  "x509-validation_1_6_12" = callPackage
-    ({ mkDerivation, asn1-encoding, asn1-types, base, bytestring
-     , containers, cryptonite, data-default-class, hourglass, memory
-     , mtl, pem, tasty, tasty-hunit, x509, x509-store
-     }:
-     mkDerivation {
-       pname = "x509-validation";
        version = "1.6.12";
        sha256 = "1j7is28ljz4yxwxz5ax3x7ykgwkr38dx46bw7vgj4arkk7hl93hd";
        libraryHaskellDepends = [
@@ -298344,7 +298469,6 @@ self: {
        ];
        description = "X.509 Certificate and CRL validation";
        license = lib.licenses.bsd3;
-       hydraPlatforms = lib.platforms.none;
      }) {};
 
   "x86-64bit" = callPackage
@@ -299461,6 +299585,29 @@ self: {
        broken = true;
      }) {};
 
+  "xml-prettify-text" = callPackage
+    ({ mkDerivation, base, filepath, gauge, mtl, optparse-applicative
+     , protolude, tasty, tasty-golden, text, text-show, with-utf8
+     }:
+     mkDerivation {
+       pname = "xml-prettify-text";
+       version = "1.0.0.2";
+       sha256 = "02rnglx1fm4xirpl1y0g3q34k593cbijg33hh77nzsp78qcnvfr9";
+       isLibrary = true;
+       isExecutable = true;
+       enableSeparateDataOutput = true;
+       libraryHaskellDepends = [ base mtl protolude text text-show ];
+       executableHaskellDepends = [
+         base optparse-applicative protolude text with-utf8
+       ];
+       testHaskellDepends = [
+         base filepath protolude tasty tasty-golden text
+       ];
+       benchmarkHaskellDepends = [ base gauge protolude ];
+       description = "XML pretty printer";
+       license = lib.licenses.gpl2Only;
+     }) {};
+
   "xml-push" = callPackage
     ({ mkDerivation, base, bytestring, crypto-random, handle-like
      , monad-control, monads-tf, peyotls, random, sasl, simple-pipe, stm
diff --git a/pkgs/development/interpreters/regina/default.upstream b/pkgs/development/interpreters/regina/default.upstream
deleted file mode 100644
index 481d9848f830..000000000000
--- a/pkgs/development/interpreters/regina/default.upstream
+++ /dev/null
@@ -1,5 +0,0 @@
-url https://sourceforge.net/projects/regina-rexx/files/regina-rexx/
-SF_version_dir
-SF_version_tarball
-SF_redirect
-minimize_overwrite
diff --git a/pkgs/development/libraries/boehm-gc/default.nix b/pkgs/development/libraries/boehm-gc/default.nix
index 944fba33d6ec..b20bdac90876 100644
--- a/pkgs/development/libraries/boehm-gc/default.nix
+++ b/pkgs/development/libraries/boehm-gc/default.nix
@@ -1,9 +1,7 @@
 { lib, stdenv, fetchurl
 , autoreconfHook
 , enableLargeConfig ? false # doc: https://github.com/ivmai/bdwgc/blob/v8.0.6/doc/README.macros (LARGE_CONFIG)
-, nix
-, nix_2_3
-, nixUnstable
+, nixVersions
 }:
 
 stdenv.mkDerivation rec {
@@ -39,16 +37,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  passthru = {
-    tests = {
-      # Assuming this package is picked up by these packages as expected.
-      inherit
-        nix
-        nixUnstable
-        nix_2_3
-        ;
-    };
-  };
+  passthru.tests = nixVersions;
 
   meta = {
     description = "The Boehm-Demers-Weiser conservative garbage collector for C and C++";
diff --git a/pkgs/development/libraries/botan/2.0.upstream b/pkgs/development/libraries/botan/2.0.upstream
deleted file mode 100644
index 74eb1a2ca83f..000000000000
--- a/pkgs/development/libraries/botan/2.0.upstream
+++ /dev/null
@@ -1,10 +0,0 @@
-url https://botan.randombit.net/
-version_link 'Botan-[0-9]+([.][0-9]+)*[.](tgz|tbz|tbz2|tar[.]bz2)$'
-ensure_version
-attribute_name botan2
-do_overwrite(){
-  ensure_hash
-  set_var_value sha256 $CURRENT_HASH
-  set_var_value baseVersion ${CURRENT_VERSION%.*}
-  set_var_value revision ${CURRENT_VERSION##*.}
-}
diff --git a/pkgs/development/libraries/botan/default.upstream b/pkgs/development/libraries/botan/default.upstream
deleted file mode 100644
index 43f6a3b268ee..000000000000
--- a/pkgs/development/libraries/botan/default.upstream
+++ /dev/null
@@ -1,9 +0,0 @@
-url http://botan.randombit.net/download.html
-version_link 'Botan-[0-9]+[.][0-9]*[02468]([.][0-9]+)?[.](tgz|tbz|tbz2|tar[.]bz2)$'
-ensure_version
-do_overwrite(){
-  ensure_hash
-  set_var_value sha256 $CURRENT_HASH
-  set_var_value baseVersion ${CURRENT_VERSION%.*}
-  set_var_value revision ${CURRENT_VERSION##*.}
-}
diff --git a/pkgs/development/libraries/eigen/default.upstream b/pkgs/development/libraries/eigen/default.upstream
deleted file mode 100644
index c0c05efc466c..000000000000
--- a/pkgs/development/libraries/eigen/default.upstream
+++ /dev/null
@@ -1,4 +0,0 @@
-url http://eigen.tuxfamily.org/
-ensure_choice
-version '.*/([-0-9.]+)[.]tar[.].*' '\1'
-do_overwrite() { do_overwrite_just_version; }
diff --git a/pkgs/development/libraries/flatpak/default.nix b/pkgs/development/libraries/flatpak/default.nix
index 72b652e1be46..c97f1effd67c 100644
--- a/pkgs/development/libraries/flatpak/default.nix
+++ b/pkgs/development/libraries/flatpak/default.nix
@@ -1,6 +1,5 @@
 { lib, stdenv
 , fetchurl
-, fetchpatch
 , autoreconfHook
 , docbook_xml_dtd_45
 , docbook-xsl-nons
@@ -54,14 +53,14 @@
 
 stdenv.mkDerivation rec {
   pname = "flatpak";
-  version = "1.12.2";
+  version = "1.12.4";
 
   # TODO: split out lib once we figure out what to do with triggerdir
   outputs = [ "out" "dev" "man" "doc" "devdoc" "installedTests" ];
 
   src = fetchurl {
     url = "https://github.com/flatpak/flatpak/releases/download/${version}/${pname}-${version}.tar.xz";
-    sha256 = "df1eb464f9142c11627f99f04f6a5c02c868bbb145489b8902cb6c105e774b75"; # Taken from https://github.com/flatpak/flatpak/releases/
+    sha256 = "792e6265f7f6d71b2a087028472a048287bed2587e43d2eec2c31d360c16211c"; # Taken from https://github.com/flatpak/flatpak/releases/
   };
 
   patches = [
@@ -97,13 +96,6 @@ stdenv.mkDerivation rec {
 
     # But we want the GDK_PIXBUF_MODULE_FILE from the wrapper affect the icon validator.
     ./validate-icon-pixbuf.patch
-
-    # Tests don't respect the FLATPAK_BINARY override that was added, this is a workaround.
-    # https://github.com/flatpak/flatpak/pull/4496 (Can be removed once included).
-    (fetchpatch {
-      url = "https://github.com/flatpak/flatpak/commit/96dbe28cfa96e80b23fa1d8072eb36edad41279c.patch";
-      sha256 = "1jczk06ymfs98h3nsg245g0jwxvml7wg2x6pb7mrfpsdmrpz2czd";
-    })
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/flint/default.nix b/pkgs/development/libraries/flint/default.nix
index 858144b150aa..6873508eb7dc 100644
--- a/pkgs/development/libraries/flint/default.nix
+++ b/pkgs/development/libraries/flint/default.nix
@@ -51,6 +51,5 @@ stdenv.mkDerivation rec {
     platforms = platforms.unix;
     homepage = "https://www.flintlib.org/";
     downloadPage = "https://www.flintlib.org/downloads.html";
-    updateWalker = true;
   };
 }
diff --git a/pkgs/development/libraries/gdal/default.nix b/pkgs/development/libraries/gdal/default.nix
index 124c0a48cde6..3e5ae303dd77 100644
--- a/pkgs/development/libraries/gdal/default.nix
+++ b/pkgs/development/libraries/gdal/default.nix
@@ -62,7 +62,11 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
-  CXXFLAGS = "-fpermissive";
+  CXXFLAGS = lib.concatStringsSep " " [
+    "-fpermissive"
+    # poppler uses std::optional
+    "-std=c++17"
+  ];
 
   # - Unset CC and CXX as they confuse libtool.
   # - teach gdal that libdf is the legacy name for libhdf
diff --git a/pkgs/development/libraries/iml/default.nix b/pkgs/development/libraries/iml/default.nix
index 474605fe7696..884cebab2e30 100644
--- a/pkgs/development/libraries/iml/default.nix
+++ b/pkgs/development/libraries/iml/default.nix
@@ -24,6 +24,5 @@ stdenv.mkDerivation rec {
     maintainers = [lib.maintainers.raskin];
     platforms = lib.platforms.unix;
     homepage = "https://cs.uwaterloo.ca/~astorjoh/iml.html";
-    updateWalker = true;
   };
 }
diff --git a/pkgs/development/libraries/libesmtp/default.nix b/pkgs/development/libraries/libesmtp/default.nix
index 542cff712c82..3193f383d610 100644
--- a/pkgs/development/libraries/libesmtp/default.nix
+++ b/pkgs/development/libraries/libesmtp/default.nix
@@ -1,18 +1,29 @@
-{ lib, stdenv, fetchurl }:
+{ lib, stdenv, fetchFromGitHub, meson, ninja, pkg-config, openssl }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "libESMTP";
-  version = "1.0.6";
+  version = "1.1.0";
 
-  src = fetchurl {
-    url = "http://brianstafford.info/libesmtp/libesmtp-1.0.6.tar.bz2";
-    sha256 = "02zbniyz7qys1jmx3ghx21kxmns1wc3hmv80gp7ag7yra9f1m9nh";
+  nativeBuildInputs = [ meson ninja pkg-config ];
+  buildInputs = [ openssl ];
+
+  src = fetchFromGitHub {
+    owner = "libesmtp";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1bhh8hlsl9597x0bnfl563k2c09b61qnkb9mfyqcmzlq63m1zw5y";
   };
 
   meta = with lib; {
-    homepage = "http://brianstafford.info/libesmtp/index.html";
     description = "A Library for Posting Electronic Mail";
-    license = licenses.lgpl21;
+    longDescription = ''
+      libESMTP is an SMTP client library which manages submission of electronic mail
+      via a preconfigured Mail Transport Agent (MTA) such as Exim or Postfix.
+      It implements many SMTP extensions including TLS for security
+      and PIPELINING for high performance.
+    '';
+    homepage = "https://libesmtp.github.io/";
+    license = licenses.lgpl21Plus;
   };
 }
 
diff --git a/pkgs/development/libraries/libosmium/default.nix b/pkgs/development/libraries/libosmium/default.nix
index 917a64f40e94..f0ddd26900f3 100644
--- a/pkgs/development/libraries/libosmium/default.nix
+++ b/pkgs/development/libraries/libosmium/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libosmium";
-  version = "2.17.2";
+  version = "2.17.3";
 
   src = fetchFromGitHub {
     owner = "osmcode";
     repo = "libosmium";
     rev = "v${version}";
-    sha256 = "sha256-+WeEK7rWoUPAiAsgd5qT2bwDf+5IlP4uuyh7+i2L/HU=";
+    sha256 = "sha256-XpC5gb19jPakYS3QSgOU6WnGad+VEoEtxyT38d9Beug=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/libzmf/default.nix b/pkgs/development/libraries/libzmf/default.nix
index 7965c934df3e..378a7202f371 100644
--- a/pkgs/development/libraries/libzmf/default.nix
+++ b/pkgs/development/libraries/libzmf/default.nix
@@ -20,6 +20,5 @@ stdenv.mkDerivation rec {
     platforms = lib.platforms.unix;
     homepage = "https://wiki.documentfoundation.org/DLP/Libraries/libzmf";
     downloadPage = "http://dev-www.libreoffice.org/src/libzmf/";
-    updateWalker = true;
   };
 }
diff --git a/pkgs/development/libraries/loudmouth/default.nix b/pkgs/development/libraries/loudmouth/default.nix
index a8d9b23cc84c..fb5409a7e727 100644
--- a/pkgs/development/libraries/loudmouth/default.nix
+++ b/pkgs/development/libraries/loudmouth/default.nix
@@ -22,8 +22,6 @@ stdenv.mkDerivation rec {
     description = "A lightweight C library for the Jabber protocol";
     platforms = platforms.all;
     downloadPage = "http://mcabber.com/files/loudmouth/";
-    downloadURLRegexp = "loudmouth-[0-9.]+[.]tar[.]bz2$";
-    updateWalker = true;
     license = licenses.lgpl21;
   };
 }
diff --git a/pkgs/development/libraries/mdds/default.upstream b/pkgs/development/libraries/mdds/default.upstream
deleted file mode 100644
index 96c5bc35d169..000000000000
--- a/pkgs/development/libraries/mdds/default.upstream
+++ /dev/null
@@ -1,10 +0,0 @@
-url https://gitlab.com/mdds/mdds
-version_link 'mdds-.*[.]tar[.][a-z0-9]+$'
-version '.*-([0-9.]+)[.]tar[.].*' '\1'
-
-do_overwrite(){
-  ensure_hash
-  ensure_version
-  set_var_value version $CURRENT_VERSION
-  set_var_value sha256 $CURRENT_HASH
-}
diff --git a/pkgs/development/libraries/mpir/default.nix b/pkgs/development/libraries/mpir/default.nix
index b8ee4fb4e765..b7d31066de1a 100644
--- a/pkgs/development/libraries/mpir/default.nix
+++ b/pkgs/development/libraries/mpir/default.nix
@@ -21,6 +21,5 @@ stdenv.mkDerivation rec {
     platforms = lib.platforms.unix;
     downloadPage = "https://mpir.org/downloads.html";
     homepage = "https://mpir.org/";
-    updateWalker = true;
   };
 }
diff --git a/pkgs/development/libraries/mysocketw/default.nix b/pkgs/development/libraries/mysocketw/default.nix
index 7997fc18d111..62bd7cea1a1a 100644
--- a/pkgs/development/libraries/mysocketw/default.nix
+++ b/pkgs/development/libraries/mysocketw/default.nix
@@ -1,15 +1,17 @@
-{ lib, stdenv, fetchurl, openssl }:
+{ lib, stdenv, fetchFromGitHub, openssl, cmake }:
 
 stdenv.mkDerivation rec {
   pname = "mysocketw";
-  version = "031026";
-  src = fetchurl {
-    url = "https://www.digitalfanatics.org/cal/socketw/files/SocketW${version}.tar.gz";
-    sha256 = "0crinikhdl7xihzmc3k3k41pgxy16d5ci8m9sza1lbibns7pdwj4";
-  };
+  version = "3.10.27";
 
-  patches = [ ./gcc.patch ];
+  src = fetchFromGitHub {
+    owner = "RigsOfRods";
+    repo = "socketw";
+    rev = version;
+    sha256 = "0xqcgwb1lyc2d8834sq5adbmggyn6vvb26jw20862sxa15j0qfd4";
+  };
 
+  nativeBuildInputs = [ cmake ];
   buildInputs = [ openssl ];
 
   postPatch = lib.optionalString stdenv.isDarwin ''
@@ -17,8 +19,6 @@ stdenv.mkDerivation rec {
         --replace -Wl,-soname, -Wl,-install_name,$out/lib/
   '';
 
-  makeFlags = [ "PREFIX=$(out)" "CXX=${stdenv.cc.targetPrefix}c++" ];
-
   meta = {
     description = "Cross platform (Linux/FreeBSD/Unix/Win32) streaming socket C++";
     license = lib.licenses.lgpl21Plus;
diff --git a/pkgs/development/libraries/osip/default.upstream b/pkgs/development/libraries/osip/default.upstream
deleted file mode 100644
index ba0ed2a9b299..000000000000
--- a/pkgs/development/libraries/osip/default.upstream
+++ /dev/null
@@ -1,3 +0,0 @@
-url http://ftp.u-tx.net/gnu/osip/
-attribute_name libosip
-minimize_overwrite
diff --git a/pkgs/development/libraries/phash/default.nix b/pkgs/development/libraries/phash/default.nix
index 8d3f3e987023..4596c5aaf4f6 100644
--- a/pkgs/development/libraries/phash/default.nix
+++ b/pkgs/development/libraries/phash/default.nix
@@ -31,6 +31,5 @@ stdenv.mkDerivation rec {
     platforms = platforms.all;
     homepage = "http://www.phash.org";
     downloadPage = "https://github.com/clearscene/pHash";
-    updateWalker = true;
   };
 }
diff --git a/pkgs/development/libraries/poco/default.nix b/pkgs/development/libraries/poco/default.nix
index 57e8fb1a5a75..15a1f8d62bf7 100644
--- a/pkgs/development/libraries/poco/default.nix
+++ b/pkgs/development/libraries/poco/default.nix
@@ -3,19 +3,19 @@
 stdenv.mkDerivation rec {
   pname = "poco";
 
-  version = "1.10.1";
+  version = "1.11.1";
 
   src = fetchurl {
     url = "https://pocoproject.org/releases/${pname}-${version}/${pname}-${version}-all.tar.gz";
-    sha256 = "1jilzh0h6ik5lr167nax7q6nrpzxl99p11pkl202ig06pgh32nbz";
+    sha256 = "sha256-MczOYCAEcnAAO/tbDafirUMohMI9PNUJyG9HzzpeXSo=";
   };
 
   patches = [
-    # Use GNUInstallDirs (https://github.com/pocoproject/poco/pull/3105)
+    # Use GNUInstallDirs (https://github.com/pocoproject/poco/pull/3503)
     (fetchpatch {
       name = "use-gnuinstalldirs.patch";
-      url = "https://github.com/pocoproject/poco/commit/9e8f84dff4575f01be02e0b07364efd1561ce66c.patch";
-      sha256 = "1bj4i93gxr7pwx33bfyhg20ad4ak1rbxkrlpsgzk7rm6mh0mld26";
+      url = "https://github.com/pocoproject/poco/commit/16a2a74f6c28c6e6baca2ba26b4964b51d8a1b74.patch";
+      sha256 = "sha256-mkemG8UemJEUQxae1trKakhnJFJW0AufDYFAbmnINbY=";
       # Files not included in release tarball
       excludes = [
         "Encodings/Compiler/CMakeLists.txt"
diff --git a/pkgs/development/libraries/poppler/default.nix b/pkgs/development/libraries/poppler/default.nix
index 08ca1456ea8f..6fa07bcaf806 100644
--- a/pkgs/development/libraries/poppler/default.nix
+++ b/pkgs/development/libraries/poppler/default.nix
@@ -34,13 +34,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "poppler-${suffix}";
-  version = "21.06.1"; # beware: updates often break cups-filters build, check texlive and scribusUnstable too!
+  version = "22.01.0"; # beware: updates often break cups-filters build, check texlive and scribusUnstable too!
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://poppler.freedesktop.org/poppler-${version}.tar.xz";
-    sha256 = "sha256-hrCeWgLeQAgaORbvhxHFEo6vSx/FnV+H0Oxm8E9ZXbQ=";
+    sha256 = "sha256-fTSTBWtbhkE+XGk8LK4CxcBs2OYY0UwsMeLIS2eyMT4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/qt-5/5.12/default.nix b/pkgs/development/libraries/qt-5/5.12/default.nix
index ef053eba9cb7..d89547261880 100644
--- a/pkgs/development/libraries/qt-5/5.12/default.nix
+++ b/pkgs/development/libraries/qt-5/5.12/default.nix
@@ -108,6 +108,11 @@ let
         url = "https://github.com/qtwebkit/qtwebkit/pull/1058/commits/5b698ba3faffd4e198a45be9fe74f53307395e4b.patch";
         sha256 = "0a3xv0h4lv8wggckgy8cg8xnpkg7n9h45312pdjdnnwy87xvzss0";
       })
+      (fetchpatch {
+        name = "qtwebkit-darwin-handle.patch";
+        url = "https://github.com/qtwebkit/qtwebkit/commit/5c272a21e621a66862821d3ae680f27edcc64c19.patch";
+        sha256 = "9hjqLyABz372QDgoq7nXXXQ/3OXBGcYN1/92ekcC3WE=";
+      })
       ./qtwebkit.patch
       ./qtwebkit-icu68.patch
 
diff --git a/pkgs/development/libraries/qt-5/5.14/default.nix b/pkgs/development/libraries/qt-5/5.14/default.nix
index 1f893fb05191..65ce74dac021 100644
--- a/pkgs/development/libraries/qt-5/5.14/default.nix
+++ b/pkgs/development/libraries/qt-5/5.14/default.nix
@@ -108,6 +108,11 @@ let
         url = "https://github.com/qtwebkit/qtwebkit/pull/1058/commits/5b698ba3faffd4e198a45be9fe74f53307395e4b.patch";
         sha256 = "0a3xv0h4lv8wggckgy8cg8xnpkg7n9h45312pdjdnnwy87xvzss0";
       })
+      (fetchpatch {
+        name = "qtwebkit-darwin-handle.patch";
+        url = "https://github.com/qtwebkit/qtwebkit/commit/5c272a21e621a66862821d3ae680f27edcc64c19.patch";
+        sha256 = "9hjqLyABz372QDgoq7nXXXQ/3OXBGcYN1/92ekcC3WE=";
+      })
       ./qtwebkit.patch
       ./qtwebkit-icu68.patch
     ] ++ lib.optionals stdenv.isDarwin [
diff --git a/pkgs/development/libraries/qt-5/5.15/default.nix b/pkgs/development/libraries/qt-5/5.15/default.nix
index 2a76409ce4bc..5943a80a701e 100644
--- a/pkgs/development/libraries/qt-5/5.15/default.nix
+++ b/pkgs/development/libraries/qt-5/5.15/default.nix
@@ -71,6 +71,11 @@ let
         url = "https://github.com/qtwebkit/qtwebkit/pull/1058/commits/5b698ba3faffd4e198a45be9fe74f53307395e4b.patch";
         sha256 = "0a3xv0h4lv8wggckgy8cg8xnpkg7n9h45312pdjdnnwy87xvzss0";
       })
+      (fetchpatch {
+        name = "qtwebkit-darwin-handle.patch";
+        url = "https://github.com/qtwebkit/qtwebkit/commit/5c272a21e621a66862821d3ae680f27edcc64c19.patch";
+        sha256 = "9hjqLyABz372QDgoq7nXXXQ/3OXBGcYN1/92ekcC3WE=";
+      })
       ./qtwebkit.patch
       ./qtwebkit-icu68.patch
     ] ++ lib.optionals stdenv.isDarwin [
diff --git a/pkgs/development/libraries/safefile/default.nix b/pkgs/development/libraries/safefile/default.nix
index 2865ab06319f..1f49afbacff2 100644
--- a/pkgs/development/libraries/safefile/default.nix
+++ b/pkgs/development/libraries/safefile/default.nix
@@ -8,20 +8,11 @@ stdenv.mkDerivation rec {
     sha256 = "1y0gikds2nr8jk8smhrl617njk23ymmpxyjb2j1xbj0k82xspv78";
   };
 
-  passthru = {
-    updateScript = ''
-      #!${runtimeShell}
-      cd ${toString ./.}
-      ${toString path}/pkgs/build-support/upstream-updater/update-walker.sh default.nix
-    '';
-  };
-
-  meta = {
+  meta = with lib; {
     description = "File open routines to safely open a file when in the presence of an attack";
-    license = lib.licenses.asl20 ;
-    maintainers = [lib.maintainers.raskin];
-    platforms = lib.platforms.all;
+    license = licenses.asl20;
+    maintainers = with maintainers; [ raskin ];
+    platforms = platforms.all;
     homepage = "https://research.cs.wisc.edu/mist/safefile/";
-    updateWalker = true;
   };
 }
diff --git a/pkgs/development/libraries/smooth/default.nix b/pkgs/development/libraries/smooth/default.nix
index 8e55c8f4128a..cc71bca442a0 100644
--- a/pkgs/development/libraries/smooth/default.nix
+++ b/pkgs/development/libraries/smooth/default.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "smooth";
-  version = "0.9.8";
+  version = "0.9.9";
 
   src = fetchFromGitHub {
     owner = "enzo1982";
     repo = "smooth";
     rev = "v${version}";
-    sha256 = "sha256-4092Od/wCWe4br80Ry6mr8GpUIUeeF6sk3unELdfQJU=";
+    sha256 = "sha256-30qVXK54SDL2+ZPbTINZix4Ax1iOMg2WLeEDyAr77Og=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/spandsp/default.nix b/pkgs/development/libraries/spandsp/default.nix
index 406603e66225..f2bc63d4f6d6 100644
--- a/pkgs/development/libraries/spandsp/default.nix
+++ b/pkgs/development/libraries/spandsp/default.nix
@@ -29,6 +29,5 @@ stdenv.mkDerivation rec {
     maintainers = with lib.maintainers; [raskin];
     license = lib.licenses.gpl2;
     downloadPage = "http://www.soft-switch.org/downloads/spandsp/";
-    updateWalker = true;
   };
 }
diff --git a/pkgs/development/libraries/tbb/default.nix b/pkgs/development/libraries/tbb/default.nix
index 7aef5ba74768..7913f05354d4 100644
--- a/pkgs/development/libraries/tbb/default.nix
+++ b/pkgs/development/libraries/tbb/default.nix
@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
 
   postInstall = let
     pcTemplate = fetchurl {
-      url = "https://github.com/oneapi-src/oneTBB/raw/master/integration/pkg-config/tbb.pc.in";
+      url = "https://github.com/oneapi-src/oneTBB/raw/478de5b1887c928e52f029d706af6ea640a877be/integration/pkg-config/tbb.pc.in";
       sha256 = "2pCad9txSpNbzac0vp/VY3x7HNySaYkbH3Rx8LK53pI=";
     };
   in ''
diff --git a/pkgs/development/libraries/xmlsec/default.nix b/pkgs/development/libraries/xmlsec/default.nix
index 1f63b2cfc871..5f2557514804 100644
--- a/pkgs/development/libraries/xmlsec/default.nix
+++ b/pkgs/development/libraries/xmlsec/default.nix
@@ -73,7 +73,6 @@ stdenv.mkDerivation rec {
     description = "XML Security Library in C based on libxml2";
     license = lib.licenses.mit;
     platforms = with lib.platforms; linux ++ darwin;
-    updateWalker = true;
   };
 }
 )
diff --git a/pkgs/development/php-packages/ds/default.nix b/pkgs/development/php-packages/ds/default.nix
new file mode 100644
index 000000000000..c6417fd5513a
--- /dev/null
+++ b/pkgs/development/php-packages/ds/default.nix
@@ -0,0 +1,19 @@
+{ buildPecl, lib, pcre2, php }:
+
+buildPecl {
+  pname = "ds";
+
+  version = "1.4.0";
+  sha256 = "1vwk5d27zd746767l8cvbcdr8r70v74vw0im38mlw1g85mc31fd9";
+
+  buildInputs = [ pcre2 ];
+
+  internalDeps = lib.optionals (lib.versionOlder php.version "8.0") [ php.extensions.json ];
+
+  meta = with lib; {
+    description = "An extension providing efficient data structures for PHP";
+    license = licenses.mit;
+    homepage = "https://github.com/php-ds/ext-ds";
+    maintainers = teams.php.members;
+  };
+}
diff --git a/pkgs/development/python-modules/aioesphomeapi/default.nix b/pkgs/development/python-modules/aioesphomeapi/default.nix
index e0f1b1df3c77..a10a84a0425e 100644
--- a/pkgs/development/python-modules/aioesphomeapi/default.nix
+++ b/pkgs/development/python-modules/aioesphomeapi/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "aioesphomeapi";
-  version = "10.8.0";
+  version = "10.8.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "esphome";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1349b2as6r3m9sxlfss8plzafn31kf3rihwa58b4f7cmc4dhb2s8";
+    sha256 = "1hi312gvkrmcxhrc8s3zxwbh87hakd42k5hk7c3xqilc4in3d5dv";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/azure-mgmt-applicationinsights/default.nix b/pkgs/development/python-modules/azure-mgmt-applicationinsights/default.nix
index 545eef7f6d89..d71539efc232 100644
--- a/pkgs/development/python-modules/azure-mgmt-applicationinsights/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-applicationinsights/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-applicationinsights";
-  version = "2.0.0";
+  version = "2.1.0";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "c5f831ff09573247579c0dabe7854324620d176143b28cc4ef2e71ca49791dcc";
+    sha256 = "68deed8ee884dd0b9631804e8b9c65fcd94e8e01c7218beae96a9fe557d7a0d7";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/azure-mgmt-resource/default.nix b/pkgs/development/python-modules/azure-mgmt-resource/default.nix
index 5166c8ead8e4..37a30147aa5f 100644
--- a/pkgs/development/python-modules/azure-mgmt-resource/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-resource/default.nix
@@ -8,14 +8,14 @@
 
 
 buildPythonPackage rec {
-  version = "20.0.0";
+  version = "20.1.0";
   pname = "azure-mgmt-resource";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "622dca4484be64f9f5ce335d327dffabf3e71e14e8a3f4a1051dc85a5c3ebbca";
+    sha256 = "4fbb2158320e0bdd367882642f266a6dfb3b4b8610792b3afbbca39089f212d7";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/azure-mgmt-web/default.nix b/pkgs/development/python-modules/azure-mgmt-web/default.nix
index ad7930016ab0..cd19e88e9bd0 100644
--- a/pkgs/development/python-modules/azure-mgmt-web/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-web/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-web";
-  version = "6.0.0";
+  version = "6.1.0";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "a58750df23d5d4cb8eff283a93312e933ee3ef4272324576005c3dc8c22ce944";
+    sha256 = "c26635089276515b0488fcf014aab50a0446f54800c6e0e5583cc493ac8d738f";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/chalice/default.nix b/pkgs/development/python-modules/chalice/default.nix
index a4e0538e348e..762846ab34c2 100644
--- a/pkgs/development/python-modules/chalice/default.nix
+++ b/pkgs/development/python-modules/chalice/default.nix
@@ -61,7 +61,8 @@ buildPythonPackage rec {
   postPatch = ''
     sed -i setup.py -e "/pip>=/c\'pip',"
     substituteInPlace setup.py \
-      --replace 'typing==3.6.4' 'typing'
+      --replace "typing==3.6.4" "typing" \
+      --replace "attrs>=19.3.0,<21.3.0" "attrs"
   '';
 
   disabledTestPaths = [
diff --git a/pkgs/development/python-modules/fakeredis/default.nix b/pkgs/development/python-modules/fakeredis/default.nix
index 91a0a797a5fd..3127ac0dcdbf 100644
--- a/pkgs/development/python-modules/fakeredis/default.nix
+++ b/pkgs/development/python-modules/fakeredis/default.nix
@@ -18,9 +18,10 @@
 buildPythonPackage rec {
   pname = "fakeredis";
   version = "1.7.0";
+
   format = "pyproject";
 
-  disabled = pythonOlder "3.5";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
@@ -39,11 +40,6 @@ buildPythonPackage rec {
     })
   ];
 
-  postPatch = ''
-    substituteInPlace setup.cfg \
-      --replace "redis<4.1.0" "redis"
-  '';
-
   propagatedBuildInputs = [
     aioredis
     lupa
@@ -64,6 +60,11 @@ buildPythonPackage rec {
     "fakeredis"
   ];
 
+  postPatch = ''
+    substituteInPlace setup.cfg \
+      --replace "redis<4.1.0" "redis"
+  '';
+
   meta = with lib; {
     description = "Fake implementation of Redis API";
     homepage = "https://github.com/jamesls/fakeredis";
diff --git a/pkgs/development/python-modules/flux-led/default.nix b/pkgs/development/python-modules/flux-led/default.nix
index 0834b5fa22ed..d49c965c86ec 100644
--- a/pkgs/development/python-modules/flux-led/default.nix
+++ b/pkgs/development/python-modules/flux-led/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "flux-led";
-  version = "0.28.11";
+  version = "0.28.17";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "Danielhiversen";
     repo = "flux_led";
     rev = version;
-    sha256 = "sha256-6EBHFqfCCDKMY9T8suPDIOoiA2LugMJh0OJiHoICioU=";
+    sha256 = "1brh2wmv29vsvnndsjf1nbh2brwrkxicwcyj9brs9kgsrhvlv71s";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/ftputil/default.nix b/pkgs/development/python-modules/ftputil/default.nix
index 501b95f81f14..e9e445f11c3d 100644
--- a/pkgs/development/python-modules/ftputil/default.nix
+++ b/pkgs/development/python-modules/ftputil/default.nix
@@ -1,32 +1,45 @@
-{ stdenv, lib, buildPythonPackage, fetchPypi, pythonOlder, pytest, freezegun }:
+{ lib
+, stdenv
+, buildPythonPackage
+, fetchPypi
+, freezegun
+, pytestCheckHook
+, pythonOlder
+}:
 
 buildPythonPackage rec {
-  version = "5.0.2";
   pname = "ftputil";
+  version = "5.0.3";
+  format = "setuptools";
+
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "afa2ba402235e8c6583c1d2630269628344134c9246b961ff14f182047f3e633";
+    hash = "sha256-m4buZ8GYDOHYmxN1K8SLlJP+4GNJy0doKFlOduCPhIg=";
   };
 
-  checkInputs = [ pytest freezegun ];
+  checkInputs = [
+    freezegun
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # Tests require network access
+    "test_public_servers"
+    "test_real_ftp"
+    "test_set_parser"
+    "test_upload"
+  ];
 
-  checkPhase = ''
-    touch Makefile
-    # Disable tests that require network access or access /home or assume execution before year 2020
-    py.test test \
-      -k "not test_public_servers and not test_real_ftp \
-          and not test_set_parser and not test_repr \
-          and not test_conditional_upload and not test_conditional_download_with_older_target \
-  ''
-  # need until https://ftputil.sschwarzer.net/trac/ticket/140#ticket is fixed
-  + lib.optionalString stdenv.isDarwin "and not test_error_message_reuse"
-  + ''"'';
+  pythonImportsCheck = [
+    "ftputil"
+  ];
 
   meta = with lib; {
     description = "High-level FTP client library (virtual file system and more)";
     homepage = "http://ftputil.sschwarzer.net/";
-    license = licenses.bsd2; # "Modified BSD license, says pypi"
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/google-cloud-dlp/default.nix b/pkgs/development/python-modules/google-cloud-dlp/default.nix
index a3418e3a9029..d2e3abef82d1 100644
--- a/pkgs/development/python-modules/google-cloud-dlp/default.nix
+++ b/pkgs/development/python-modules/google-cloud-dlp/default.nix
@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-dlp";
-  version = "3.5.0";
+  version = "3.6.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "3a757a3fafab46f28ffd2465ae06c5f87071aee1b41aee13f44255074483d480";
+    sha256 = "20abce8d8d3939db243cbc0da62a73ff1a4e3b3b341f7ced0cfeb5e2c4a66621";
   };
 
   propagatedBuildInputs = [ google-api-core libcst proto-plus pytz ];
diff --git a/pkgs/development/python-modules/halohome/default.nix b/pkgs/development/python-modules/halohome/default.nix
index b87b59a46ec0..7d8dbe2efbb8 100644
--- a/pkgs/development/python-modules/halohome/default.nix
+++ b/pkgs/development/python-modules/halohome/default.nix
@@ -9,7 +9,8 @@
 
 buildPythonPackage rec {
   pname = "halohome";
-  version = "0.4.0";
+  version = "0.5.0";
+  format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
@@ -17,7 +18,7 @@ buildPythonPackage rec {
     owner = "nayaverdier";
     repo = pname;
     rev = version;
-    sha256 = "W7cqBJmoBUT0VvXeNKxUK0FfAuprjfvFv6rgyL2gqYQ=";
+    sha256 = "sha256-xnUOObqVg1E7mTDKHZMoC95KI9ZIn0YpkQjoASa5Dds=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/ibm-watson/default.nix b/pkgs/development/python-modules/ibm-watson/default.nix
index a0c12758069b..e8ecdfff32ba 100644
--- a/pkgs/development/python-modules/ibm-watson/default.nix
+++ b/pkgs/development/python-modules/ibm-watson/default.nix
@@ -10,19 +10,30 @@
 , python-dateutil
 , websocket-client
 , ibm-cloud-sdk-core
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "ibm-watson";
-  version = "5.3.0";
+  version = "5.3.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "watson-developer-cloud";
     repo = "python-sdk";
     rev = "v${version}";
-    sha256 = "0g63h7rf0710bxcsr115857bvz69sl2g5d13k5a7qi7hjh33bxrk";
+    sha256 = "1x6r8j0xyi81jb0q4pzr6l7aglykrwqz8nw45clv79v33i2sgdcs";
   };
 
+  propagatedBuildInputs = [
+    requests
+    python-dateutil
+    websocket-client
+    ibm-cloud-sdk-core
+  ];
+
   checkInputs = [
     responses
     pytestCheckHook
@@ -31,18 +42,15 @@ buildPythonPackage rec {
     tox
   ];
 
-  propagatedBuildInputs = [
-    requests
-    python-dateutil
-    websocket-client
-    ibm-cloud-sdk-core
-  ];
-
   postPatch = ''
     substituteInPlace setup.py \
       --replace websocket-client==1.1.0 websocket-client>=1.1.0
   '';
 
+  pythonImportsCheck = [
+    "ibm_watson"
+  ];
+
   meta = with lib; {
     description = "Client library to use the IBM Watson Services";
     homepage = "https://github.com/watson-developer-cloud/python-sdk";
diff --git a/pkgs/development/python-modules/losant-rest/default.nix b/pkgs/development/python-modules/losant-rest/default.nix
index 36b6efa724e2..83ff792a62a3 100644
--- a/pkgs/development/python-modules/losant-rest/default.nix
+++ b/pkgs/development/python-modules/losant-rest/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "losant-rest";
-  version = "1.15.1";
+  version = "1.15.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "Losant";
     repo = "losant-rest-python";
     rev = "v${version}";
-    sha256 = "sha256-j8Vzr83pvl/AnXfA+nl5uRXf+y6ndKmQHM3bl306wFM=";
+    sha256 = "sha256-JmLQ3Hj9WnL/XfMxDiVAizGFASWMwF36ohp8asErUMM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/mailchecker/default.nix b/pkgs/development/python-modules/mailchecker/default.nix
index 83485f4252b8..51e3292a92de 100644
--- a/pkgs/development/python-modules/mailchecker/default.nix
+++ b/pkgs/development/python-modules/mailchecker/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "mailchecker";
-  version = "4.1.9";
+  version = "4.1.10";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-vr70AB8EiOmb8lgwrq78iTnHdrp14Ppyh57Trh8SQ8Q=";
+    hash = "sha256-SOUOoVPrWc+NqXyBchtvtreufqSeQPJg+MgBr8n+U/Y=";
   };
 
   # Module has no tests
diff --git a/pkgs/development/python-modules/mautrix/default.nix b/pkgs/development/python-modules/mautrix/default.nix
index dcdc946e21d6..4d578a97c78e 100644
--- a/pkgs/development/python-modules/mautrix/default.nix
+++ b/pkgs/development/python-modules/mautrix/default.nix
@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "mautrix";
-  version = "0.14.5";
+  version = "0.14.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-dh3uQUBEMqtlrOpnO5Aa7GC5gajwQ12rWyVPwX6xIsQ=";
+    sha256 = "46a87a8ee9e45e90c72e17ebb75190073e773f0890cfde7b81b0a36e15caec5d";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/meshtastic/default.nix b/pkgs/development/python-modules/meshtastic/default.nix
index 9ddabb97ec83..9193d0590697 100644
--- a/pkgs/development/python-modules/meshtastic/default.nix
+++ b/pkgs/development/python-modules/meshtastic/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "meshtastic";
-  version = "1.2.75";
+  version = "1.2.76";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "meshtastic";
     repo = "Meshtastic-python";
     rev = version;
-    sha256 = "sha256-VIeW7RloEIBU7YNG7f2e8PdFR+FauIwKLkd7v4qRCOA=";
+    sha256 = "sha256-LQo7TwD91o9j/fJ5BTNV7WoCDFXnJVy1PDObH5FiNtk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/minikerberos/default.nix b/pkgs/development/python-modules/minikerberos/default.nix
index d1e0616cfb68..ebd2b3f0b6bd 100644
--- a/pkgs/development/python-modules/minikerberos/default.nix
+++ b/pkgs/development/python-modules/minikerberos/default.nix
@@ -4,15 +4,19 @@
 , buildPythonPackage
 , fetchPypi
 , oscrypto
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "minikerberos";
-  version = "0.2.14";
+  version = "0.2.15";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-MND7r4Gkx9RnEMgEl62QXFYr1NEloihQ2HeU9hyhsx8=";
+    sha256 = "20fae3cf1b329451eb3cba55d6b3c5b44501db5a23e49f47bc770e7461308672";
   };
 
   propagatedBuildInputs = [
@@ -24,7 +28,9 @@ buildPythonPackage rec {
   # no tests are published: https://github.com/skelsec/minikerberos/pull/5
   doCheck = false;
 
-  pythonImportsCheck = [ "minikerberos" ];
+  pythonImportsCheck = [
+    "minikerberos"
+  ];
 
   meta = with lib; {
     description = "Kerberos manipulation library in Python";
diff --git a/pkgs/development/python-modules/objax/default.nix b/pkgs/development/python-modules/objax/default.nix
index fb48f9141e2a..5926848b5afb 100644
--- a/pkgs/development/python-modules/objax/default.nix
+++ b/pkgs/development/python-modules/objax/default.nix
@@ -7,7 +7,7 @@
 , parameterized
 , pillow
 , scipy
-, tensorflow-tensorboard_2 ? null
+, tensorflow-tensorboard
 }:
 
 buildPythonPackage rec {
@@ -21,14 +21,19 @@ buildPythonPackage rec {
     sha256 = "09gm61ghn5mi92q5mhx22mcv6aa6z78jsrnfar1hd3nwwyn9dq42";
   };
 
+  # Avoid propagating the dependency on `jaxlib`, see
+  # https://github.com/NixOS/nixpkgs/issues/156767
+  buildInputs = [
+    jaxlib
+  ];
+
   propagatedBuildInputs = [
     jax
-    jaxlib
     numpy
     parameterized
     pillow
     scipy
-    tensorflow-tensorboard_2
+    tensorflow-tensorboard
   ];
 
   pythonImportsCheck = [
@@ -40,7 +45,5 @@ buildPythonPackage rec {
     homepage = "https://github.com/google/objax";
     license = licenses.asl20;
     maintainers = with maintainers; [ ndl ];
-    # Darwin doesn't have `tensorflow-tensorboard_2` which is required by wheel deps.
-    platforms = [ "aarch64-linux" "x86_64-linux" ];
   };
 }
diff --git a/pkgs/development/python-modules/ocrmypdf/default.nix b/pkgs/development/python-modules/ocrmypdf/default.nix
index a6c9b150ead7..e3dcfafb958f 100644
--- a/pkgs/development/python-modules/ocrmypdf/default.nix
+++ b/pkgs/development/python-modules/ocrmypdf/default.nix
@@ -27,7 +27,7 @@
 
 buildPythonPackage rec {
   pname = "ocrmypdf";
-  version = "13.2.0";
+  version = "13.3.0";
 
   src = fetchFromGitHub {
     owner = "jbarlow83";
@@ -39,7 +39,7 @@ buildPythonPackage rec {
     extraPostFetch = ''
       rm "$out/.git_archival.txt"
     '';
-    sha256 = "sha256-mVPKcxTKoRgttwJdsY7r0kF7W1+G45iCc+mFctDipSM=";
+    sha256 = "sha256-8QOxHka2kl/keYbsP1zOZ8hrZ+15ZGJaw91F+cpWvcA=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/pikepdf/default.nix b/pkgs/development/python-modules/pikepdf/default.nix
index f52467f3e59e..ca8133549164 100644
--- a/pkgs/development/python-modules/pikepdf/default.nix
+++ b/pkgs/development/python-modules/pikepdf/default.nix
@@ -25,7 +25,7 @@
 
 buildPythonPackage rec {
   pname = "pikepdf";
-  version = "4.3.1";
+  version = "4.4.0";
   disabled = ! isPy3k;
 
   src = fetchFromGitHub {
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     extraPostFetch = ''
       rm "$out/.git_archival.txt"
     '';
-    hash = "sha256-u/NDDJGCcctWL3ivxtU+8CSlQH+5qkmXUcF4RkQOiPI=";
+    hash = "sha256-AfHqKcb+ejEmY53irbIv9+1fPEczMgd7/VaFt01cNUs=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/pycm/default.nix b/pkgs/development/python-modules/pycm/default.nix
index 878e36e5c07a..90bd83f85d29 100644
--- a/pkgs/development/python-modules/pycm/default.nix
+++ b/pkgs/development/python-modules/pycm/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pycm";
-  version = "3.3";
+  version = "3.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.5";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "sepandhaghighi";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0i3qpb20mnc22qny1ar3yvxb1dac7njwi8bvi5sy5kywz10c5dkw";
+    sha256 = "0agis9jh6kjf7k1vf1fiyf5h3lb9p0w9k710wwpsby292ydazr4f";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyeight/default.nix b/pkgs/development/python-modules/pyeight/default.nix
index dc390120f600..f84612716975 100644
--- a/pkgs/development/python-modules/pyeight/default.nix
+++ b/pkgs/development/python-modules/pyeight/default.nix
@@ -3,19 +3,21 @@
 , async-timeout
 , buildPythonPackage
 , fetchFromGitHub
-, isPy3k
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "pyeight";
-  version = "0.1.9";
-  disabled = !isPy3k;
+  version = "0.2.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "mezz64";
     repo = "pyEight";
     rev = version;
-    sha256 = "1ybhs09wyzzaryghd6ijxhajp3677x63c4qzqsgln1mmxhj8wm5k";
+    sha256 = "sha256-ERilZWroFaBCYjTfU7W0vegJaGibmJYVcgt0z84TPEI=";
   };
 
   propagatedBuildInputs = [
@@ -23,9 +25,12 @@ buildPythonPackage rec {
     async-timeout
   ];
 
-  # Project has no tests
+  # Module has no tests
   doCheck = false;
-  pythonImportsCheck = [ "pyeight" ];
+
+  pythonImportsCheck = [
+    "pyeight"
+  ];
 
   meta = with lib; {
     description = "Python library to interface with the Eight Sleep API";
diff --git a/pkgs/development/python-modules/pylaunches/default.nix b/pkgs/development/python-modules/pylaunches/default.nix
index 56e93af84a06..8f2ed7083580 100644
--- a/pkgs/development/python-modules/pylaunches/default.nix
+++ b/pkgs/development/python-modules/pylaunches/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pylaunches";
-  version = "1.2.2";
+  version = "1.3.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "ludeeus";
     repo = pname;
     rev = version;
-    sha256 = "16fh901qlcxwycq6gqgqn076dybjnj432hb596i28avaplml4qzx";
+    sha256 = "1b41j384lqg3gc7dsmdzp7anrsymqgc1895lc5j8g43x2mfgbjnh";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/rokuecp/default.nix b/pkgs/development/python-modules/rokuecp/default.nix
index 30bf2a43b78e..9f102c5c924c 100644
--- a/pkgs/development/python-modules/rokuecp/default.nix
+++ b/pkgs/development/python-modules/rokuecp/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "rokuecp";
-  version = "0.11.0";
+  version = "0.12.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "ctalkington";
     repo = "python-rokuecp";
     rev = version;
-    sha256 = "sha256-Y4Ge7IOR7//MJ0w7kdOgchLWFGR1qJbY0PSpJrjucaQ=";
+    sha256 = "1pqiba4zgx7knm1k53p6w6b9a81dalqfq2agdyrz3734nhl6gx1h";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/sagemaker/default.nix b/pkgs/development/python-modules/sagemaker/default.nix
index 1caa20b38511..20da548c0e67 100644
--- a/pkgs/development/python-modules/sagemaker/default.nix
+++ b/pkgs/development/python-modules/sagemaker/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "sagemaker";
-  version = "2.73.0";
+  version = "2.74.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "6735874a29aefc1e989a132a2e24945e5b0d057d8b297a2da695cf8421a78810";
+    sha256 = "14215f5077151a7f32ca048ff7fad63c977d7cdeadc93d93c8957efbe3c89ba6";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/sendgrid/default.nix b/pkgs/development/python-modules/sendgrid/default.nix
index 2ba415adda0d..4b1d79d0e572 100644
--- a/pkgs/development/python-modules/sendgrid/default.nix
+++ b/pkgs/development/python-modules/sendgrid/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "sendgrid";
-  version = "6.9.4";
+  version = "6.9.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = "sendgrid-python";
     rev = version;
-    sha256 = "sha256-xNd0IPhaVw4X6URsg6hrDJhxmBRWam4bqgLN0uvMUxI=";
+    sha256 = "1r8xh0c6wivrajj6gl1hv25vsb9i79n19nd4x53207i5vz9d55g5";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/sqlite-utils/default.nix b/pkgs/development/python-modules/sqlite-utils/default.nix
index 5247850173ed..362b6dadd028 100644
--- a/pkgs/development/python-modules/sqlite-utils/default.nix
+++ b/pkgs/development/python-modules/sqlite-utils/default.nix
@@ -14,12 +14,12 @@
 
 buildPythonPackage rec {
   pname = "sqlite-utils";
-  version = "3.22";
+  version = "3.22.1";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "24803ea4d63e2123d2040db2da43fea95fabada80e1af1fe1da69643ae376689";
+    sha256 = "35ebb4f7e2b09f1818b36e7da6dc62f1ca57e2c0d99a9cbc8151e634d75a7906";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/warcio/default.nix b/pkgs/development/python-modules/warcio/default.nix
new file mode 100644
index 000000000000..ae870a37fe57
--- /dev/null
+++ b/pkgs/development/python-modules/warcio/default.nix
@@ -0,0 +1,56 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, fetchpatch
+, six
+, setuptools
+, pytestCheckHook
+, httpbin
+, requests
+, wsgiprox
+, multidict
+}:
+
+buildPythonPackage rec {
+  pname = "warcio";
+  version = "1.7.4";
+
+  src = fetchFromGitHub {
+    owner = "webrecorder";
+    repo = "warcio";
+    rev = "aa702cb321621b233c6e5d2a4780151282a778be"; # Repo has no git tags, see https://github.com/webrecorder/warcio/issues/126
+    sha256 = "sha256-wn2rd73wRfOqHu9H0GIn76tmEsERBBCQatnk4b/JToU=";
+  };
+
+  patches = [
+    (fetchpatch {
+      name = "add-offline-option.patch";
+      url = "https://github.com/webrecorder/warcio/pull/135/commits/2546fe457c57ab0b391764a4ce419656458d9d07.patch";
+      sha256 = "sha256-3izm9LvAeOFixiIUUqmd5flZIxH92+NxL7jeu35aObQ=";
+    })
+  ];
+
+  propagatedBuildInputs = [
+    six
+    setuptools
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+    httpbin
+    requests
+    wsgiprox
+    multidict # Optional. Without this, one test in test/test_utils.py is skipped.
+  ];
+
+  pytestFlagsArray = [ "--offline" ];
+
+  pythonImportsCheck = [ "warcio" ];
+
+  meta = with lib; {
+    description = "Streaming WARC/ARC library for fast web archive IO";
+    homepage = "https://github.com/webrecorder/warcio";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ Luflosi ];
+  };
+}
diff --git a/pkgs/development/tools/database/sqlfluff/default.nix b/pkgs/development/tools/database/sqlfluff/default.nix
index 4dcaa7c43232..f312b522add3 100644
--- a/pkgs/development/tools/database/sqlfluff/default.nix
+++ b/pkgs/development/tools/database/sqlfluff/default.nix
@@ -5,13 +5,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "sqlfluff";
-  version = "0.9.2";
+  version = "0.9.3";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    hash = "sha256-BzO7S2sxZeklzIh1qRHJ4mGLsKLNpg8PuGGRVAkPlzc=";
+    hash = "sha256-Cg85NdbbZs0tkBy2kq5ZRKDuQwLIixdhggOBSFpUM04=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/development/tools/electron/default.nix b/pkgs/development/tools/electron/default.nix
index b7b8e3ed3b71..e5fdce7cf285 100644
--- a/pkgs/development/tools/electron/default.nix
+++ b/pkgs/development/tools/electron/default.nix
@@ -80,14 +80,14 @@ rec {
     headers = "1idam1xirxqxqg4g7n33kdx2skk0r351m00g59a8yx9z82g06ah9";
   };
 
-  electron_13 = mkElectron "13.6.7" {
-    armv7l-linux = "13acf496801d2a311f9c0644d086df26976259e915cb2201fd29665d8122a98b";
-    aarch64-linux = "8d751e9e998f5eece15dba8cae1a7aa4b780da1b802235bafcd86a3540f4efe2";
-    x86_64-linux = "af93b62e197a40c648c964d44939d24fc56ff4fa8ccac22cfb020660c726f4e7";
-    i686-linux = "68085a6849aa571fea7682b66207abd2b6adb0a515195a00862776f37f2ff3f0";
-    x86_64-darwin = "70d51ac6adc50df3195af022e700d3d10056c9e1fb770c79540215cdee9d67b3";
-    aarch64-darwin = "4d9facf75a94f6d053c02db97ca4012833274b3d3f9ab0438733a302d4a28f60";
-    headers = "1ydyl2s58vf65ywih2n3iam8l6yggmsn6hv0jhwp1rsash8hl4x4";
+  electron_13 = mkElectron "13.6.8" {
+    armv7l-linux = "94cf65f1454ea26017d80cd98a9fd3d9c9767d2a2ba7030d29d674d643814d59";
+    aarch64-linux = "5579b20438e5637f0ec8e0f07a46d5359691bfd631290372d538217c1904e07b";
+    x86_64-linux = "054f2a83a1361ea25438b609a681adb8c8dec8a2f03fd5b3605b10818799ea01";
+    i686-linux = "87cb2af357ba568fb56c99aea0a25714501fbacd02ce27c9ba55e3db8deb5535";
+    x86_64-darwin = "d8fa0254c4a5fe61f5a047f9cb6968a2dbc817cbd10cac1fd9c9d362608bc58d";
+    aarch64-darwin = "8e59ea97744791f7edaf3ff4c2fa1a144f9737c165c29ee0f0d13175a2140399";
+    headers = "0s253jdmfyfgb5mwslqd50g623fwj3dgsgsq4cn3pl5qfpmcm26x";
   };
 
   electron_14 = mkElectron "14.2.4" {
diff --git a/pkgs/development/tools/flatpak-builder/default.nix b/pkgs/development/tools/flatpak-builder/default.nix
index ce3420fd911b..4e96294fe3e0 100644
--- a/pkgs/development/tools/flatpak-builder/default.nix
+++ b/pkgs/development/tools/flatpak-builder/default.nix
@@ -47,13 +47,13 @@ let
   installed_test_metadir = "${placeholder "installedTests"}/share/installed-tests/flatpak-builder";
 in stdenv.mkDerivation rec {
   pname = "flatpak-builder";
-  version = "1.2.0";
+  version = "1.2.2";
 
   outputs = [ "out" "doc" "man" "installedTests" ];
 
   src = fetchurl {
     url = "https://github.com/flatpak/flatpak-builder/releases/download/${version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-38tqPKONYeB3W3CkaatQUoXhKTYUYt8JAE5tQlHCRqg=";
+    sha256 = "sha256-if2mjlN8Hp3gI1JpC9icMhenKRZFWNNfNbCPea2E4D4=";
   };
 
   patches = [
@@ -87,10 +87,6 @@ in stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     autoreconfHook
-    # TODO: Remove older versions.
-    # https://github.com/flatpak/flatpak-builder/pull/437
-    docbook_xml_dtd_412
-    docbook_xml_dtd_42
     docbook_xml_dtd_43
     docbook_xsl
     gettext
diff --git a/pkgs/development/tools/go-swagger/default.nix b/pkgs/development/tools/go-swagger/default.nix
index 06ae29938198..4f3a32fc3995 100644
--- a/pkgs/development/tools/go-swagger/default.nix
+++ b/pkgs/development/tools/go-swagger/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "go-swagger";
-  version = "0.28.0";
+  version = "0.29.0";
 
   src = fetchFromGitHub {
     owner = "go-swagger";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Bw84HQxrI8cSBEM1cxXmWCPqKZa5oGsob2iuUsiAZ+A=";
+    sha256 = "sha256-sahInHXv1GtylsY8kpw1dDjKiENmq4myx+7mq60vJAI=";
   };
 
-  vendorSha256 = "sha256-ZNRJZQ7DwT/+scsbSud/IpSX06veOtJ5Aszj0RbS870=";
+  vendorSha256 = "sha256-DL2eN277cXfsw1dDvIbzkJRuKThgqFOzIufPQVpUzmU=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/jq/default.nix b/pkgs/development/tools/jq/default.nix
index f18d09bf7d0e..5671f5dbe641 100644
--- a/pkgs/development/tools/jq/default.nix
+++ b/pkgs/development/tools/jq/default.nix
@@ -72,6 +72,5 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ raskin globin ];
     platforms = platforms.unix;
     downloadPage = "https://stedolan.github.io/jq/download/";
-    updateWalker = true;
   };
 }
diff --git a/pkgs/development/tools/misc/hydra/default.nix b/pkgs/development/tools/misc/hydra/default.nix
index ac5600519b49..1688e92c8441 100644
--- a/pkgs/development/tools/misc/hydra/default.nix
+++ b/pkgs/development/tools/misc/hydra/default.nix
@@ -1,4 +1,4 @@
-{ fetchFromGitHub, nixStable, callPackage, nixUnstable, nixosTests }:
+{ fetchFromGitHub, callPackage, nixVersions, nixosTests }:
 
 {
   hydra-unstable = callPackage ./common.nix {
@@ -9,7 +9,7 @@
       rev = "9bce425c3304173548d8e822029644bb51d35263";
       sha256 = "sha256-tGzwKNW/odtAYcazWA9bPVSmVXMGKfXsqCA1UYaaxmU=";
     };
-    nix = nixUnstable;
+    nix = nixVersions.unstable;
 
     tests = {
       basic = nixosTests.hydra.hydra-unstable;
diff --git a/pkgs/development/tools/misc/luarocks/3.7.nix b/pkgs/development/tools/misc/luarocks/3.7.nix
index aa49af753b32..95fa79c6d125 100644
--- a/pkgs/development/tools/misc/luarocks/3.7.nix
+++ b/pkgs/development/tools/misc/luarocks/3.7.nix
@@ -77,6 +77,5 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [raskin teto];
     platforms = platforms.linux ++ platforms.darwin;
     downloadPage = "http://luarocks.org/releases/";
-    updateWalker = true;
   };
 }
diff --git a/pkgs/development/tools/misc/luarocks/default.nix b/pkgs/development/tools/misc/luarocks/default.nix
index c2449de5dd28..58f5996992af 100644
--- a/pkgs/development/tools/misc/luarocks/default.nix
+++ b/pkgs/development/tools/misc/luarocks/default.nix
@@ -77,6 +77,5 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [raskin teto];
     platforms = platforms.linux ++ platforms.darwin;
     downloadPage = "http://luarocks.org/releases/";
-    updateWalker = true;
   };
 }
diff --git a/pkgs/development/tools/mold/default.nix b/pkgs/development/tools/mold/default.nix
index d0f33d750c23..a63822428b26 100644
--- a/pkgs/development/tools/mold/default.nix
+++ b/pkgs/development/tools/mold/default.nix
@@ -7,6 +7,7 @@
 , xxHash
 , zlib
 , openssl
+, nix-update-script
 }:
 
 stdenv.mkDerivation rec {
@@ -29,6 +30,12 @@ stdenv.mkDerivation rec {
   LTO = 1;
   makeFlags = [ "PREFIX=${placeholder "out"}" ];
 
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = pname;
+    };
+  };
+
   meta = with lib; {
     description = "A high performance drop-in replacement for existing unix linkers";
     homepage = "https://github.com/rui314/mold";
diff --git a/pkgs/development/tools/sentry-cli/default.nix b/pkgs/development/tools/sentry-cli/default.nix
index a3e176216216..021ba8c7f93b 100644
--- a/pkgs/development/tools/sentry-cli/default.nix
+++ b/pkgs/development/tools/sentry-cli/default.nix
@@ -9,13 +9,13 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "sentry-cli";
-  version = "1.72.0";
+  version = "1.72.1";
 
   src = fetchFromGitHub {
     owner = "getsentry";
     repo = "sentry-cli";
     rev = version;
-    sha256 = "sha256-2Aj2Y0c8JR8s6Ek7sZfU+5RENkoCVSAxtOvkHilfb48=";
+    sha256 = "sha256-qFEvDslAjXpIpSanM4iorgTRfKWQPKKzxxwguFUlFZA=";
   };
   doCheck = false;
 
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ Security SystemConfiguration ];
   nativeBuildInputs = [ pkg-config ];
 
-  cargoSha256 = "sha256-sSIQ7Wa0otbq82WELxP3oFYa1FoaoZz2jCB59Ob6zNM=";
+  cargoSha256 = "sha256-PRyQWohxlSNRiVj3r7xTxFVWsYL+C50bkhDU4NLaMBo=";
 
   meta = with lib; {
     homepage = "https://docs.sentry.io/cli/";
diff --git a/pkgs/development/tools/typos/default.nix b/pkgs/development/tools/typos/default.nix
index 18533469a0c9..6958a7b11d94 100644
--- a/pkgs/development/tools/typos/default.nix
+++ b/pkgs/development/tools/typos/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "typos";
-  version = "1.3.5";
+  version = "1.3.7";
 
   src = fetchFromGitHub {
     owner = "crate-ci";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-zL9Ylrl541RCSOliH+X7TfvRZyEXvISsH3N1agjoC8U=";
+    sha256 = "sha256-bsPwyTucFJdKp+r8uJ2XLOzvbTM4i5EmSY+3VgyAFuE=";
   };
 
-  cargoSha256 = "sha256-qc32MX56/0JaHx/x/5em3SoNi6YM5nduVLrDOQbMZDg=";
+  cargoSha256 = "sha256-2wJXx8xHPrjzKupuen3XfRMSviYEwYK3nbL5/uTDIzE=";
 
   meta = with lib; {
     description = "Source code spell checker";
diff --git a/pkgs/games/blobby/default.upstream b/pkgs/games/blobby/default.upstream
deleted file mode 100644
index 8f2804e07946..000000000000
--- a/pkgs/games/blobby/default.upstream
+++ /dev/null
@@ -1,8 +0,0 @@
-url https://sourceforge.net/projects/blobby/files/Blobby%20Volley%202%20%28Linux%29/
-SF_version_dir
-version_link '[.]tar[.][^.]+/download$'
-SF_redirect
-do_overwrite(){
-  do_overwrite_just_version
-  set_var_value url $CURRENT_URL
-}
diff --git a/pkgs/games/polymc/0001-pick-latest-java-first.patch b/pkgs/games/polymc/0001-pick-latest-java-first.patch
deleted file mode 100644
index a65dcbfd037d..000000000000
--- a/pkgs/games/polymc/0001-pick-latest-java-first.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From 44e1b2a19a869b907b40e56c85c8a47aa6c22097 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Mustafa=20=C3=87al=C4=B1=C5=9Fkan?= <musfay@protonmail.com>
-Date: Tue, 22 Jun 2021 21:50:11 +0300
-Subject: [PATCH] pick latest java first
-
----
- launcher/java/JavaInstallList.cpp | 4 ++--
- launcher/java/JavaUtils.cpp       | 2 +-
- 2 files changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/launcher/java/JavaInstallList.cpp b/launcher/java/JavaInstallList.cpp
-index 0bded03c..40898e20 100644
---- a/launcher/java/JavaInstallList.cpp
-+++ b/launcher/java/JavaInstallList.cpp
-@@ -120,8 +120,8 @@ void JavaInstallList::updateListData(QList<BaseVersionPtr> versions)
- 
- bool sortJavas(BaseVersionPtr left, BaseVersionPtr right)
- {
--    auto rleft = std::dynamic_pointer_cast<JavaInstall>(left);
--    auto rright = std::dynamic_pointer_cast<JavaInstall>(right);
-+    auto rleft = std::dynamic_pointer_cast<JavaInstall>(right);
-+    auto rright = std::dynamic_pointer_cast<JavaInstall>(left);
-     return (*rleft) > (*rright);
- }
- 
-diff --git a/launcher/java/JavaUtils.cpp b/launcher/java/JavaUtils.cpp
-index 5f004a10..6d633631 100644
---- a/launcher/java/JavaUtils.cpp
-+++ b/launcher/java/JavaUtils.cpp
-@@ -350,7 +350,6 @@ QList<QString> JavaUtils::FindJavaPaths()
-     qDebug() << "Linux Java detection incomplete - defaulting to \"java\"";
- 
-     QList<QString> javas;
--    javas.append(this->GetDefaultJava()->path);
-     auto scanJavaDir = [&](const QString & dirPath)
-     {
-         QDir dir(dirPath);
-@@ -379,6 +378,7 @@ QList<QString> JavaUtils::FindJavaPaths()
-     // general locations used by distro packaging
-     scanJavaDir("/usr/lib/jvm");
-     scanJavaDir("/usr/lib32/jvm");
-+    javas.append(this->GetDefaultJava()->path);
-     // javas stored in MultiMC's folder
-     scanJavaDir("java");
-     return javas;
--- 
-2.31.1
-
diff --git a/pkgs/games/polymc/default.nix b/pkgs/games/polymc/default.nix
index ddfc76b8b97b..0d63a8ad5f91 100644
--- a/pkgs/games/polymc/default.nix
+++ b/pkgs/games/polymc/default.nix
@@ -1,6 +1,5 @@
 { lib
 , mkDerivation
-, makeDesktopItem
 , fetchFromGitHub
 , cmake
 , jdk8
@@ -17,21 +16,19 @@
 
 mkDerivation rec {
   pname = "polymc";
-  version = "1.0.4";
+  version = "1.0.6";
 
   src = fetchFromGitHub {
     owner = "PolyMC";
     repo = "PolyMC";
     rev = version;
-    sha256 = "sha256-8aya0KfV9F+i2qBpweWcR9hwyTSQkqn2wHdtkCEeNvk=";
+    sha256 = "sha256-KgLWbZxtxTpuFdMOJNyADYw9rMWoLgczrbSrH4qv6NI=";
     fetchSubmodules = true;
   };
 
   nativeBuildInputs = [ cmake file makeWrapper ];
   buildInputs = [ qtbase jdk8 zlib ];
 
-  patches = [ ./0001-pick-latest-java-first.patch ];
-
   postPatch = ''
     # hardcode jdk paths
     substituteInPlace launcher/java/JavaUtils.cpp \
@@ -42,19 +39,6 @@ mkDerivation rec {
   cmakeFlags = [ "-DLauncher_LAYOUT=lin-system" ] ++
                lib.optionals (msaClientID != "") [ "-DLauncher_MSA_CLIENT_ID=${msaClientID}" ];
 
-  desktopItems = [
-    (makeDesktopItem {
-      name = "polymc";
-      desktopName = "PolyMC";
-      genericName = "Minecraft Launcher";
-      comment = "Free, open source launcher and instance manager for Minecraft.";
-      icon = "launcher";
-      exec = "polymc";
-      categories = "Game";
-      terminal = "false";
-    })
-  ];
-
   dontWrapQtApps = true;
 
   postInstall = let
@@ -68,8 +52,6 @@ mkDerivation rec {
       libGL
     ];
   in ''
-    install -Dm644 ../launcher/resources/multimc/scalable/launcher.svg $out/share/pixmaps/polymc.svg
-
     # xorg.xrandr needed for LWJGL [2.9.2, 3) https://github.com/LWJGL/lwjgl/issues/128
     wrapProgram $out/bin/polymc \
       "''${qtWrapperArgs[@]}" \
diff --git a/pkgs/games/sgt-puzzles/default.upstream b/pkgs/games/sgt-puzzles/default.upstream
deleted file mode 100644
index b6d048b68ae9..000000000000
--- a/pkgs/games/sgt-puzzles/default.upstream
+++ /dev/null
@@ -1,5 +0,0 @@
-minimize_overwrite
-url http://www.chiark.greenend.org.uk/~sgtatham/puzzles/puzzles.tar.gz
-redirect
-NEED_TO_CHOOSE_URL=
-version '.*[-_.]([0-9]{8}[.][^.]+)[.]tar[.].*' '\1'
diff --git a/pkgs/misc/screensavers/xscreensaver/default.nix b/pkgs/misc/screensavers/xscreensaver/default.nix
index b90f75f6a042..5c30040f4912 100644
--- a/pkgs/misc/screensavers/xscreensaver/default.nix
+++ b/pkgs/misc/screensavers/xscreensaver/default.nix
@@ -62,6 +62,5 @@ stdenv.mkDerivation rec {
     maintainers = with lib.maintainers; [ raskin ];
     platforms = lib.platforms.unix; # Once had cygwin problems
     downloadPage = "https://www.jwz.org/xscreensaver/download.html";
-    updateWalker = true;
   };
 }
diff --git a/pkgs/os-specific/linux/amdgpu-pro/default.nix b/pkgs/os-specific/linux/amdgpu-pro/default.nix
index b293f8513bbd..241145a24843 100644
--- a/pkgs/os-specific/linux/amdgpu-pro/default.nix
+++ b/pkgs/os-specific/linux/amdgpu-pro/default.nix
@@ -11,6 +11,7 @@
 , expat
 , libffi
 , libselinux
+, libdrm
 , udev
 , kernel ? null
 }:
@@ -204,6 +205,7 @@ in stdenv.mkDerivation rec {
   '';
 
   buildInputs = [
+    libdrm
     patchelf
     perl
   ];
diff --git a/pkgs/os-specific/linux/atop/default.upstream b/pkgs/os-specific/linux/atop/default.upstream
deleted file mode 100644
index 46099d9c9595..000000000000
--- a/pkgs/os-specific/linux/atop/default.upstream
+++ /dev/null
@@ -1,4 +0,0 @@
-url http://atoptool.nl/downloadatop.php
-version_link '[.]tar[.]'
-version '[^0-9]*[-.]([0-9]([-0-9.]*[0-9])?)[.].*' '\1'
-minimize_overwrite
diff --git a/pkgs/os-specific/linux/iptables/default.nix b/pkgs/os-specific/linux/iptables/default.nix
index 50730597d9e6..c6dc10f32bac 100644
--- a/pkgs/os-specific/linux/iptables/default.nix
+++ b/pkgs/os-specific/linux/iptables/default.nix
@@ -49,6 +49,5 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ fpletz ];
     license = licenses.gpl2;
     downloadPage = "https://www.netfilter.org/projects/iptables/files/";
-    updateWalker = true;
   };
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index bf36ad52169e..7b9013fbaf3a 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "4.14.262";
+  version = "4.14.263";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "05yl51r5n3q9l8pq6azx3bbl69l79lk8vkdivy3cvgzdh59pizac";
+    sha256 = "0bn17p1mmkc37bqv7bvksli4xpyp660mbcjm6jmh6k348i1bfwqf";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix
index 5953b9ff22ce..98cc13927343 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "4.19.225";
+  version = "4.19.226";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "15k7b04zx5ggfjagp8sfrylr9xgwgz3hb2bygdml7ka1jnbv76jb";
+    sha256 = "1b9qvl994n09708sql3q3g5l3xq2hxam83fnws5asd8mdnk7i7wk";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index 1addff89c2a2..d2de100ad3b5 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,12 +1,12 @@
 { buildPackages, fetchurl, perl, buildLinux, nixosTests, stdenv, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.4.299";
+  version = "4.4.300";
   extraMeta.branch = "4.4";
   extraMeta.broken = stdenv.isAarch64;
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "019hmplv1zhghl840qky9awziba3gx7jm80khny44gjfbyzf7d4v";
+    sha256 = "19mpqg48yi7qm1a2mncqax7pj42accryj6yrkbywd7kj4q0b64kg";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index 81f576616f7f..70457c1b3bb4 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,12 +1,12 @@
 { buildPackages, fetchurl, perl, buildLinux, nixosTests, stdenv, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.297";
+  version = "4.9.298";
   extraMeta.branch = "4.9";
   extraMeta.broken = stdenv.isAarch64;
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "17yqnr6p0prgcw8nikjmi49ll4s77ylaixcja5m15cq9x36shfz4";
+    sha256 = "0nrhjqn6bfp9h5dc7yacgkbfvfdhlks8ph4dzqyfjljmx9cf95ym";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.10.nix b/pkgs/os-specific/linux/kernel/linux-5.10.nix
index 41a48908ff4e..90bd4dc2ae00 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.10.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.10.93";
+  version = "5.10.94";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1jxv7can60rc5i2yjgj8frcjvwi1jnba1jl8i3070xmb1d1qqy56";
+    sha256 = "023mrm8wjmxi6qp21p1d0kzs8k0pls6l8kp75ajix2ls9am49zr8";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.15.nix b/pkgs/os-specific/linux/kernel/linux-5.15.nix
index 607521af1385..336ee4149ac7 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.15.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.15.16";
+  version = "5.15.17";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "150pzxra564z9xaaclmbbd29x4x9il8y78zz7szi50lzx0a0l2ms";
+    sha256 = "1pmbf3xin533z4jpqj8p733ii5zk0k36v4cpzl14k62rrk0gb1r7";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.16.nix b/pkgs/os-specific/linux/kernel/linux-5.16.nix
index be238fb9edcd..096c48c008b6 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.16.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.16.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.16.2";
+  version = "5.16.3";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0i1vcv2zi80ixmgjdcq6yk8qhwaqlbbmmrq0prxk41339lx87zh9";
+    sha256 = "1cdmp7k6qfm8gyr8zv589y6bgmyj7n6wyk36f98m0w2vq3ljyh5s";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.4.nix b/pkgs/os-specific/linux/kernel/linux-5.4.nix
index bdfa568ba25d..fd47f8c0ec2b 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.4.173";
+  version = "5.4.174";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0ff2jvwxj55547wvwp94a8bsd610s72906d4nsyhiirrn9sy5s4r";
+    sha256 = "1a88hfcskrcbz7gyh8pkcymka4djdhdy6fdh4i0b9ygsmvjipkg8";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/sysdig/default.upstream b/pkgs/os-specific/linux/sysdig/default.upstream
deleted file mode 100644
index 485de5741d79..000000000000
--- a/pkgs/os-specific/linux/sysdig/default.upstream
+++ /dev/null
@@ -1,8 +0,0 @@
-url https://github.com/draios/sysdig/releases
-ensure_choice
-version '.*/([0-9.]+)[.]tar[.].*' '\1'
-do_overwrite () {
-  ensure_hash
-  set_var_value sha256 $CURRENT_HASH
-  set_var_value version $CURRENT_VERSION
-}
diff --git a/pkgs/servers/http/lighttpd/default.nix b/pkgs/servers/http/lighttpd/default.nix
index 356b21d354f7..d0b11d9b7c16 100644
--- a/pkgs/servers/http/lighttpd/default.nix
+++ b/pkgs/servers/http/lighttpd/default.nix
@@ -1,4 +1,5 @@
-{ lib, stdenv, buildPackages, fetchurl, pkg-config, pcre, libxml2, zlib, bzip2, which, file
+{ lib, stdenv, buildPackages, fetchurl, pkg-config, pcre2, libxml2, zlib, bzip2, which, file
+, fetchpatch
 , openssl
 , enableDbi ? false, libdbi
 , enableMagnet ? false, lua5_1
@@ -9,23 +10,22 @@
 , enableWebDAV ? false, sqlite, libuuid
 , enableExtendedAttrs ? false, attr
 , perl
-, fetchpatch
 }:
 
 stdenv.mkDerivation rec {
   pname = "lighttpd";
-  version = "1.4.63";
+  version = "1.4.64";
 
   src = fetchurl {
     url = "https://download.lighttpd.net/lighttpd/releases-${lib.versions.majorMinor version}.x/${pname}-${version}.tar.xz";
-    sha256 = "1fgasvif13gvzz4rf5mjpy28cbw9fs4ymhx18494mxgb080pzvra";
+    sha256 = "sha256-4Uidn6dJb78uBxwzi1k7IwDTjCPx5ZZ+UsnvSC4bDiY=";
   };
 
   patches = [
     (fetchpatch {
-      name = "CVE-2022-22707.patch";
-      url = "https://github.com/lighttpd/lighttpd1.4/commit/8c62a890e23f5853b1a562b03fe3e1bccc6e7664.patch";
-      sha256 = "0zm2khgllsd1ivh9m7sisfsyrdfz45zsmiwl963wf0gn8m100gzk";
+      name = "macos-10.12-avoid-ccrandomgeneratebytes.patch";
+      url = "https://redmine.lighttpd.net/projects/lighttpd/repository/14/revisions/6791f71b20a127b5b0091020dd065f4f9c7cafb6/diff?format=diff";
+      sha256 = "1x5ybkvxwinl7s1nv3rrc57m4mj38q0gbyjp1ijr4w5lhabw4vzs";
     })
   ];
 
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
   depsBuildBuild = [ buildPackages.stdenv.cc ];
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ pcre pcre.dev libxml2 zlib bzip2 which file openssl ]
+  buildInputs = [ pcre2 pcre2.dev libxml2 zlib bzip2 which file openssl ]
              ++ lib.optional enableDbi libdbi
              ++ lib.optional enableMagnet lua5_1
              ++ lib.optional enableMysql libmysqlclient
@@ -64,7 +64,7 @@ stdenv.mkDerivation rec {
                 ++ lib.optional enableExtendedAttrs "--with-attr";
 
   preConfigure = ''
-    export PATH=$PATH:${pcre.dev}/bin
+    export PATH=$PATH:${pcre2.dev}/bin
     sed -i "s:/usr/bin/file:${file}/bin/file:g" configure
   '';
 
diff --git a/pkgs/servers/http/nginx/mainline.upstream b/pkgs/servers/http/nginx/mainline.upstream
deleted file mode 100644
index 7bb025499592..000000000000
--- a/pkgs/servers/http/nginx/mainline.upstream
+++ /dev/null
@@ -1,8 +0,0 @@
-url http://nginx.org/en/download.html
-version_link '.*-([0-9]+[.][0-9]+([.][0-9]+)*)[.]tar[.][a-z0-9]*$' 
-
-do_overwrite() {
-  ensure_hash
-  set_var_value version "$CURRENT_VERSION"
-  set_var_value sha256 "$CURRENT_HASH"
-}
diff --git a/pkgs/servers/http/nginx/stable.upstream b/pkgs/servers/http/nginx/stable.upstream
deleted file mode 100644
index c20139017436..000000000000
--- a/pkgs/servers/http/nginx/stable.upstream
+++ /dev/null
@@ -1,8 +0,0 @@
-url http://nginx.org/en/download.html
-version_link '.*-([0-9]+[.][0-9]*[02468]([.][0-9]+)*)[.]tar[.][a-z0-9]*$' 
-
-do_overwrite() {
-  ensure_hash
-  set_var_value version "$CURRENT_VERSION"
-  set_var_value sha256 "$CURRENT_HASH"
-}
diff --git a/pkgs/servers/mail/sympa/default.nix b/pkgs/servers/mail/sympa/default.nix
index 4d439bf760af..196cd07ceff8 100644
--- a/pkgs/servers/mail/sympa/default.nix
+++ b/pkgs/servers/mail/sympa/default.nix
@@ -61,13 +61,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "sympa";
-  version = "6.2.66";
+  version = "6.2.68";
 
   src = fetchFromGitHub {
     owner = "sympa-community";
     repo = pname;
     rev = version;
-    sha256 = "sha256-rD6sYsEsAyu+4Vy2wMtWCtlzXoLeZgeu9hkoxOvwiP4=";
+    sha256 = "sha256-biTF2We9/ZBFBNpltyJonAe5tpXz+eNam+Bu6esJPiY=";
   };
 
   configureFlags = [
diff --git a/pkgs/servers/monitoring/fusion-inventory/default.nix b/pkgs/servers/monitoring/fusion-inventory/default.nix
index c55c67f5f62d..c4e2cc53291b 100644
--- a/pkgs/servers/monitoring/fusion-inventory/default.nix
+++ b/pkgs/servers/monitoring/fusion-inventory/default.nix
@@ -63,6 +63,7 @@ perlPackages.buildPerlPackage rec {
 
     cp -r bin $out
     cp -r lib $out
+    cp -r share $out
 
     for cur in $out/bin/*; do
       if [ -x "$cur" ]; then
diff --git a/pkgs/servers/softether/4.25.nix b/pkgs/servers/softether/4.25.nix
deleted file mode 100644
index f22bd0859ada..000000000000
--- a/pkgs/servers/softether/4.25.nix
+++ /dev/null
@@ -1,53 +0,0 @@
-{ lib, stdenv, fetchurl
-, openssl, readline, ncurses, zlib
-, dataDir ? "/var/lib/softether" }:
-
-let
-  os = if stdenv.isLinux then "1"
-       else if stdenv.isFreeBSD then "2"
-       else if stdenv.isSunOS then "3"
-       else if stdenv.isDarwin then "4"
-       else if stdenv.isOpenBSD then "5"
-       else "";
-  cpuBits = if stdenv.is64bit then "2" else "1";
-
-in
-
-stdenv.mkDerivation rec {
-  pname = "softether";
-  version = "4.25";
-  build = "9656";
-  compiledDate = "2018.01.15";
-
-  src = fetchurl {
-    url = "http://www.softether-download.com/files/softether/v${version}-${build}-rtm-${compiledDate}-tree/Source_Code/softether-src-v${version}-${build}-rtm.tar.gz";
-    sha256 = "1y1m8lf0xfh7m70d15wj2jjf5a5qhi3j49ciwqmsscsqvb1xwimr";
-  };
-
-  buildInputs = [ openssl readline ncurses zlib ];
-
-  preConfigure = ''
-      echo "${os}
-      ${cpuBits}
-      " | ./configure
-      rm configure
-  '';
-
-  buildPhase = ''
-      mkdir -p $out/bin
-      sed -i \
-          -e "/INSTALL_BINDIR=/s|/usr/bin|/bin|g" \
-          -e "/_DIR=/s|/usr|${dataDir}|g" \
-          -e "s|\$(INSTALL|$out/\$(INSTALL|g" \
-          -e "/echo/s|echo $out/|echo |g" \
-          Makefile
-  '';
-
-  meta = with lib; {
-    description = "An Open-Source Free Cross-platform Multi-protocol VPN Program";
-    homepage = "https://www.softether.org/";
-    license = licenses.gpl2;
-    maintainers = [ maintainers.rick68 ];
-    platforms = [ "x86_64-linux" ];
-  };
-}
diff --git a/pkgs/servers/sshportal/default.nix b/pkgs/servers/sshportal/default.nix
new file mode 100644
index 000000000000..73aec946fd91
--- /dev/null
+++ b/pkgs/servers/sshportal/default.nix
@@ -0,0 +1,24 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "sshportal";
+  version = "1.18.5";
+
+  src = fetchFromGitHub {
+    owner = "moul";
+    repo = "sshportal";
+    rev = "v${version}";
+    sha256 = "1d9zws7b6ng23vyk8di5jmnbsxz7kaj4z8wz43wkwr6b65c2h0bf";
+  };
+
+  ldflags = [ "-X main.GitTag=${version}" "-X main.GitSha=${version}" "-s" "-w" ];
+
+  vendorSha256 = "0fnn455adw4bhz68dpqaii08wv7lifdd5kx95rpqxsi2sqrzr4br";
+
+  meta = with lib; {
+    description = "Simple, fun and transparent SSH (and telnet) bastion server";
+    homepage = "https://manfred.life/sshportal";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ zaninime ];
+  };
+}
diff --git a/pkgs/servers/tailscale/default.nix b/pkgs/servers/tailscale/default.nix
index ee768981f9bc..e3852931d18f 100644
--- a/pkgs/servers/tailscale/default.nix
+++ b/pkgs/servers/tailscale/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "tailscale";
-  version = "1.20.2";
+  version = "1.20.3";
 
   src = fetchFromGitHub {
     owner = "tailscale";
     repo = "tailscale";
     rev = "v${version}";
-    sha256 = "sha256-uW/C4Bks7qGJEQhPoqd2LSk8MAD9gcDRsJbbowgsSuY=";
+    sha256 = "sha256-6ZiMkid5RneOIlDDSDkB8m0nAywZEUCJ96qveE2l53k=";
   };
 
   nativeBuildInputs = lib.optionals stdenv.isLinux [ makeWrapper ];
diff --git a/pkgs/stdenv/generic/check-meta.nix b/pkgs/stdenv/generic/check-meta.nix
index ba3c8eef20e6..7a70accb723f 100644
--- a/pkgs/stdenv/generic/check-meta.nix
+++ b/pkgs/stdenv/generic/check-meta.nix
@@ -236,7 +236,6 @@ let
     name = str;
     version = str;
     tag = str;
-    updateWalker = bool;
     executables = listOf str;
     outputsToInstall = listOf str;
     position = str;
@@ -244,7 +243,6 @@ let
     repositories = attrsOf str;
     isBuildPythonPackage = platforms;
     schedulingPriority = int;
-    downloadURLRegexp = str;
     isFcitxEngine = bool;
     isIbusEngine = bool;
     isGutenprint = bool;
diff --git a/pkgs/tools/X11/autocutsel/default.nix b/pkgs/tools/X11/autocutsel/default.nix
index 036ba8bc4e9a..61a80bcbcdd6 100644
--- a/pkgs/tools/X11/autocutsel/default.nix
+++ b/pkgs/tools/X11/autocutsel/default.nix
@@ -20,6 +20,5 @@ stdenv.mkDerivation rec {
     description = "Tracks changes in the server's cutbuffer and CLIPBOARD selection";
     license = lib.licenses.gpl2Plus;
     platforms = with lib.platforms; all;
-    updateWalker = true;
   };
 }
diff --git a/pkgs/tools/X11/xpra/default.nix b/pkgs/tools/X11/xpra/default.nix
index 78aaa355d6e2..330722898ce6 100644
--- a/pkgs/tools/X11/xpra/default.nix
+++ b/pkgs/tools/X11/xpra/default.nix
@@ -135,7 +135,6 @@ in buildPythonApplication rec {
   meta = {
     homepage = "https://xpra.org/";
     downloadPage = "https://xpra.org/src/";
-    downloadURLRegexp = "xpra-.*[.]tar[.][gx]z$";
     description = "Persistent remote applications for X";
     platforms = platforms.linux;
     license = licenses.gpl2;
diff --git a/pkgs/tools/admin/procs/default.nix b/pkgs/tools/admin/procs/default.nix
index 25287dca9c5f..382ce503622a 100644
--- a/pkgs/tools/admin/procs/default.nix
+++ b/pkgs/tools/admin/procs/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "procs";
-  version = "0.12.0";
+  version = "0.12.1";
 
   src = fetchFromGitHub {
     owner = "dalance";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-UZTt/+K8jDFhkNIMRfyDzRqOlceAEQKWwgEf1lcZIkY=";
+    sha256 = "sha256-hJe9JAUZZY2fx4I6+pVg1BYwzZrUWCkqPvQUT2OQXDo=";
   };
 
-  cargoSha256 = "sha256-VE161UZKUiG2WW7CwjazQfR9ouOAsYCjiA5dczFQliM=";
+  cargoSha256 = "sha256-BChYzSnM9jnLioRhRDez6XOjJwGrU+giV4Ld3rp/57M=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/admin/stripe-cli/default.nix b/pkgs/tools/admin/stripe-cli/default.nix
index e843c0d347a0..04f66eaba95a 100644
--- a/pkgs/tools/admin/stripe-cli/default.nix
+++ b/pkgs/tools/admin/stripe-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "stripe-cli";
-  version = "1.7.9";
+  version = "1.7.10";
 
   src = fetchFromGitHub {
     owner = "stripe";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-rCo3iHLfiEH/+APNztKKSdoJerz161jF7sNx8qTFw3U=";
+    sha256 = "sha256-F1+goZURc0f1dWV/PGxSVtqHkuePACq4+UzfMTEVJ0M=";
   };
 
   vendorSha256 = "sha256-Duu6lP87KKLC1eGIebycBSIPw7FN6BBxPexize9+jPE=";
diff --git a/pkgs/tools/compression/lrzip/default.upstream b/pkgs/tools/compression/lrzip/default.upstream
deleted file mode 100644
index 1b8345986374..000000000000
--- a/pkgs/tools/compression/lrzip/default.upstream
+++ /dev/null
@@ -1,8 +0,0 @@
-url http://ck.kolivas.org/apps/lrzip/
-version_link '[.]tar[.]bz2$'
-
-do_overwrite () {
-  ensure_hash
-  set_var_value version "$CURRENT_VERSION"
-  set_var_value sha256 "$CURRENT_HASH"
-}
diff --git a/pkgs/tools/filesystems/nilfs-utils/default.nix b/pkgs/tools/filesystems/nilfs-utils/default.nix
index 3c2dfaf2f1d3..fe2047a6f139 100644
--- a/pkgs/tools/filesystems/nilfs-utils/default.nix
+++ b/pkgs/tools/filesystems/nilfs-utils/default.nix
@@ -47,6 +47,5 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
     license =  with licenses; [ gpl2 lgpl21 ];
     downloadPage = "http://nilfs.sourceforge.net/en/download.html";
-    updateWalker = true;
   };
 }
diff --git a/pkgs/tools/filesystems/smbnetfs/default.nix b/pkgs/tools/filesystems/smbnetfs/default.nix
index bb042a95ecc4..a1831d44ada4 100644
--- a/pkgs/tools/filesystems/smbnetfs/default.nix
+++ b/pkgs/tools/filesystems/smbnetfs/default.nix
@@ -17,7 +17,6 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
     license = licenses.gpl2;
     downloadPage = "https://sourceforge.net/projects/smbnetfs/files/smbnetfs";
-    updateWalker = true;
     homepage = "https://sourceforge.net/projects/smbnetfs/";
   };
 }
diff --git a/pkgs/tools/filesystems/smbnetfs/default.upstream b/pkgs/tools/filesystems/smbnetfs/default.upstream
deleted file mode 100644
index d56fa42f1d1b..000000000000
--- a/pkgs/tools/filesystems/smbnetfs/default.upstream
+++ /dev/null
@@ -1,6 +0,0 @@
-url https://sourceforge.net/projects/smbnetfs/files/smbnetfs/
-version_link '[-][0-9.]+[a-z]*/$'
-version_link '[.]tar[.][a-z0-9]+/download$'
-SF_redirect
-version '.*[-]([0-9.]+[a-z]*)[.]tar[.].*' '\1'
-do_overwrite () { do_overwrite_just_version; }
diff --git a/pkgs/tools/graphics/barcode/default.nix b/pkgs/tools/graphics/barcode/default.nix
index e77e8fae0c23..eed06602a5dd 100644
--- a/pkgs/tools/graphics/barcode/default.nix
+++ b/pkgs/tools/graphics/barcode/default.nix
@@ -23,7 +23,6 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ raskin ];
     platforms = platforms.linux; # Maybe other non-darwin Unix
     downloadPage = "https://ftp.gnu.org/gnu/barcode/";
-    updateWalker = true;
     homepage = "https://www.gnu.org/software/barcode/";
     license = licenses.gpl3;
   };
diff --git a/pkgs/tools/graphics/cuneiform/default.upstream b/pkgs/tools/graphics/cuneiform/default.upstream
deleted file mode 100644
index 4fb85a2a1e89..000000000000
--- a/pkgs/tools/graphics/cuneiform/default.upstream
+++ /dev/null
@@ -1,8 +0,0 @@
-url https://launchpad.net/cuneiform-linux/+download
-
-do_overwrite () {
-  ensure_hash
-  set_var_value version "$CURRENT_VERSION"
-  set_var_value sha256 "$CURRENT_HASH"
-  set_var_value ' url' "$CURRENT_URL"
-}
diff --git a/pkgs/tools/misc/ised/default.upstream b/pkgs/tools/misc/ised/default.upstream
deleted file mode 100644
index 6539bf477e54..000000000000
--- a/pkgs/tools/misc/ised/default.upstream
+++ /dev/null
@@ -1,4 +0,0 @@
-url http://ised.sourceforge.net/web_nav.html
-SF_version_tarball
-SF_redirect
-minimize_overwrite
diff --git a/pkgs/tools/misc/mandown/default.nix b/pkgs/tools/misc/mandown/default.nix
new file mode 100644
index 000000000000..08755ede14db
--- /dev/null
+++ b/pkgs/tools/misc/mandown/default.nix
@@ -0,0 +1,20 @@
+{ lib, rustPlatform, fetchCrate }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "mandown";
+  version = "0.1.3";
+
+  src = fetchCrate {
+    inherit pname version;
+    sha256 = "sha256-8a4sImsjw+lzeVK4V74VpIKDcAhMR1bOmJYVWzfWEfc=";
+  };
+
+  cargoHash = "sha256-Wf1+dxwgPZ4CHpas+3P6n6kKDIISbnfI01+XksjxQlQ=";
+
+  meta = with lib; {
+    description = "Markdown to groff (man page) converter";
+    homepage = "https://gitlab.com/kornelski/mandown";
+    license = with licenses; [ asl20 /* or */ mit ];
+    maintainers = with maintainers; [ zowoq ];
+  };
+}
diff --git a/pkgs/tools/misc/mc/default.nix b/pkgs/tools/misc/mc/default.nix
index 511314324fc2..3b12175fb567 100644
--- a/pkgs/tools/misc/mc/default.nix
+++ b/pkgs/tools/misc/mc/default.nix
@@ -94,6 +94,5 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ sander ];
     platforms = with platforms; linux ++ darwin;
     repositories.git = "https://github.com/MidnightCommander/mc.git";
-    updateWalker = true;
   };
 }
diff --git a/pkgs/tools/misc/nncp/default.nix b/pkgs/tools/misc/nncp/default.nix
index 8008ffe77065..a9c2a43734e9 100644
--- a/pkgs/tools/misc/nncp/default.nix
+++ b/pkgs/tools/misc/nncp/default.nix
@@ -3,12 +3,12 @@
 
 stdenv.mkDerivation rec {
   pname = "nncp";
-  version = "8.3.0";
+  version = "8.5.0";
   outputs = [ "out" "doc" "info" ];
 
   src = fetchurl {
     url = "http://www.nncpgo.org/download/${pname}-${version}.tar.xz";
-    sha256 = "sha256-bBSIep72htYRLyCW7R2la6q+X+tLqSVziazGsm0KI+o=";
+    sha256 = "sha256-6IUNJ3DE+nRc+bmpDO7l1gXlD6UDGggTSYRMFT57v/Q=";
   };
 
   nativeBuildInputs = [ go redo-apenwarr ];
diff --git a/pkgs/tools/misc/phoronix-test-suite/default.nix b/pkgs/tools/misc/phoronix-test-suite/default.nix
index edf61ddf6b40..4d0c33137345 100644
--- a/pkgs/tools/misc/phoronix-test-suite/default.nix
+++ b/pkgs/tools/misc/phoronix-test-suite/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "phoronix-test-suite";
-  version = "10.8.0";
+  version = "10.8.1";
 
   src = fetchurl {
     url = "https://phoronix-test-suite.com/releases/${pname}-${version}.tar.gz";
-    sha256 = "sha256-HvyMkafW2QdSlizWkOsv9U8VSN9Y9Z3F1jt1PwF9nuo=";
+    sha256 = "sha256-O1jqaUQZymCNcp+mznLtK0xRr0RHKe77zcbmcCkMqn8=";
   };
 
   buildInputs = [ php ];
diff --git a/pkgs/tools/networking/getmail6/default.nix b/pkgs/tools/networking/getmail6/default.nix
index 54c9c9fca050..dc508ff53efe 100644
--- a/pkgs/tools/networking/getmail6/default.nix
+++ b/pkgs/tools/networking/getmail6/default.nix
@@ -28,7 +28,6 @@ python3.pkgs.buildPythonApplication rec {
   meta = with lib; {
     description = "A program for retrieving mail";
     homepage = "https://getmail6.org";
-    updateWalker = true;
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ abbe dotlambda ];
   };
diff --git a/pkgs/tools/networking/keepalived/default.nix b/pkgs/tools/networking/keepalived/default.nix
index 22606ec78b69..647378f1a046 100644
--- a/pkgs/tools/networking/keepalived/default.nix
+++ b/pkgs/tools/networking/keepalived/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "keepalived";
-  version = "2.2.4";
+  version = "2.2.7";
 
   src = fetchFromGitHub {
     owner = "acassen";
     repo = "keepalived";
     rev = "v${version}";
-    sha256 = "sha256-WXKu+cabMmXNHiLwXrQqS8GQHIWYkee7vPddyGURWic=";
+    sha256 = "sha256-erpYC4klkgvZ9D+4qM/qIHajsyOGKRbX7lhs6lfWFTQ=";
   };
 
   buildInputs = [
diff --git a/pkgs/tools/networking/twa/default.nix b/pkgs/tools/networking/twa/default.nix
index b6038aa54353..ab73eae70046 100644
--- a/pkgs/tools/networking/twa/default.nix
+++ b/pkgs/tools/networking/twa/default.nix
@@ -1,25 +1,25 @@
-{ stdenv
+{ lib
+, stdenv
+, fetchFromGitHub
+, makeWrapper
 , bash
 , curl
-, fetchFromGitHub
+, dnsutils
 , gawk
-, host
 , jq
-, lib
-, makeWrapper
 , ncurses
 , netcat
 }:
 
 stdenv.mkDerivation rec {
   pname = "twa";
-  version = "1.9.1";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "trailofbits";
     repo = "twa";
-    rev = version;
-    sha256 = "1ab3bcyhfach9y15w8ffvqqan2qk8h62n6z8nqbgygi7n1mf6jzx";
+    rev = "v${version}";
+    hash = "sha256-8c1o03iwStmhjKHmEXIZGyaSOAJRlOuhu0ERjCO5SHg=";
   };
 
   dontBuild = true;
@@ -28,12 +28,14 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ bash
                   curl
+                  dnsutils
                   gawk
-                  host.dnsutils
                   jq
                   netcat ];
 
   installPhase = ''
+    runHook preInstall
+
     install -Dm 0755 twa "$out/bin/twa"
     install -Dm 0755 tscore "$out/bin/tscore"
     install -Dm 0644 twa.1 "$out/share/man/man1/twa.1"
@@ -41,10 +43,13 @@ stdenv.mkDerivation rec {
 
     wrapProgram "$out/bin/twa" \
       --prefix PATH : ${lib.makeBinPath [ curl
-                                                 host.dnsutils
-                                                 jq
-                                                 ncurses
-                                                 netcat ]}
+                                          dnsutils
+                                          gawk
+                                          jq
+                                          ncurses
+                                          netcat ]}
+
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/networking/xxh/default.nix b/pkgs/tools/networking/xxh/default.nix
new file mode 100644
index 000000000000..c03708f08a31
--- /dev/null
+++ b/pkgs/tools/networking/xxh/default.nix
@@ -0,0 +1,26 @@
+{ lib, fetchFromGitHub, buildPythonApplication, pexpect, pyyaml, openssh, nixosTests }:
+
+buildPythonApplication rec{
+  pname = "xxh";
+  version = "0.8.8";
+
+  src = fetchFromGitHub {
+    owner = pname;
+    repo = pname;
+    rev = version;
+    hash = "sha256-TzC8GTDmnYN56Rp5DyZxh+yGrkgWr6Xt86a/jyB3j5k=";
+  };
+
+  propagatedBuildInputs = [ pexpect pyyaml openssh ];
+
+  passthru.tests = {
+    inherit (nixosTests) xxh;
+  };
+
+  meta = with lib; {
+    description = "Bring your favorite shell wherever you go through ssh";
+    homepage = "https://github.com/xxh/xxh";
+    license = licenses.bsd2;
+    maintainers = [ maintainers.pasqui23 ];
+  };
+}
diff --git a/pkgs/tools/package-management/nix/common.nix b/pkgs/tools/package-management/nix/common.nix
new file mode 100644
index 000000000000..ba95e0ddbf43
--- /dev/null
+++ b/pkgs/tools/package-management/nix/common.nix
@@ -0,0 +1,208 @@
+{ lib, fetchFromGitHub
+, version
+, suffix ? ""
+, sha256 ? null
+, src ? fetchFromGitHub { owner = "NixOS"; repo = "nix"; rev = version; inherit sha256; }
+, patches ? [ ]
+}:
+assert (sha256 == null) -> (src != null);
+let
+  atLeast24 = lib.versionAtLeast version "2.4pre";
+  atLeast25 = lib.versionAtLeast version "2.5pre";
+in
+{ stdenv
+, autoconf-archive
+, autoreconfHook
+, bash
+, bison
+, boehmgc
+, boost
+, brotli
+, busybox-sandbox-shell
+, bzip2
+, callPackage
+, coreutils
+, curl
+, editline
+, flex
+, gnutar
+, gtest
+, gzip
+, jq
+, lib
+, libarchive
+, libcpuid
+, libsodium
+, lowdown
+, mdbook
+, nlohmann_json
+, openssl
+, perl
+, pkg-config
+, Security
+, sqlite
+, util-linuxMinimal
+, xz
+
+, enableDocumentation ? atLeast24 || stdenv.hostPlatform == stdenv.buildPlatform
+, enableStatic ? stdenv.hostPlatform.isStatic
+, withAWS ? !enableStatic && (stdenv.isLinux || stdenv.isDarwin), aws-sdk-cpp
+, withLibseccomp ? lib.meta.availableOn stdenv.hostPlatform libseccomp, libseccomp
+
+, confDir
+, stateDir
+, storeDir
+}:
+stdenv.mkDerivation {
+  pname = "nix";
+
+  version = "${version}${suffix}";
+  VERSION_SUFFIX = suffix;
+
+  inherit src patches;
+
+  outputs =
+    [ "out" "dev" ]
+    ++ lib.optionals enableDocumentation [ "man" "doc" ];
+
+  hardeningEnable = lib.optionals (!stdenv.isDarwin) [ "pie" ];
+
+  nativeBuildInputs = [
+    pkg-config
+  ] ++ lib.optionals atLeast24 [
+    autoconf-archive
+    autoreconfHook
+    bison
+    flex
+    jq
+  ] ++ lib.optionals (atLeast24 && enableDocumentation) [
+    (lib.getBin lowdown)
+    mdbook
+  ] ++ lib.optionals stdenv.isLinux [
+    util-linuxMinimal
+  ];
+
+  buildInputs = [
+    boost
+    brotli
+    bzip2
+    curl
+    editline
+    libsodium
+    openssl
+    sqlite
+    xz
+  ] ++ lib.optionals stdenv.isDarwin [
+    Security
+  ] ++ lib.optionals atLeast24 [
+    gtest
+    libarchive
+    lowdown
+  ] ++ lib.optionals (atLeast24 && stdenv.isx86_64) [
+    libcpuid
+  ] ++ lib.optionals withLibseccomp [
+    libseccomp
+  ] ++ lib.optionals withAWS [
+    aws-sdk-cpp
+  ];
+
+  propagatedBuildInputs = [ boehmgc ];
+
+  NIX_LDFLAGS = lib.optionals (!atLeast24) [
+    # https://github.com/NixOS/nix/commit/3e85c57a6cbf46d5f0fe8a89b368a43abd26daba
+    (lib.optionalString enableStatic "-lssl -lbrotlicommon -lssh2 -lz -lnghttp2 -lcrypto")
+    # https://github.com/NixOS/nix/commits/74b4737d8f0e1922ef5314a158271acf81cd79f8
+    (lib.optionalString (stdenv.hostPlatform.system == "armv5tel-linux" || stdenv.hostPlatform.system == "armv6l-linux") "-latomic")
+  ];
+
+  preConfigure =
+    # Copy libboost_context so we don't get all of Boost in our closure.
+    # https://github.com/NixOS/nixpkgs/issues/45462
+    lib.optionalString (!enableStatic) ''
+      mkdir -p $out/lib
+      cp -pd ${boost}/lib/{libboost_context*,libboost_thread*,libboost_system*} $out/lib
+      rm -f $out/lib/*.a
+      ${lib.optionalString stdenv.isLinux ''
+        chmod u+w $out/lib/*.so.*
+        patchelf --set-rpath $out/lib:${stdenv.cc.cc.lib}/lib $out/lib/libboost_thread.so.*
+      ''}
+    '' +
+    # On all versions before c9f51e87057652db0013289a95deffba495b35e7, which
+    # removes config.nix entirely and is not present in 2.3.x, we need to
+    # patch around an issue where the Nix configure step pulls in the build
+    # system's bash and other utilities when cross-compiling.
+    lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform && !atLeast24) ''
+      mkdir tmp/
+      substitute corepkgs/config.nix.in tmp/config.nix.in \
+        --subst-var-by bash ${bash}/bin/bash \
+        --subst-var-by coreutils ${coreutils}/bin \
+        --subst-var-by bzip2 ${bzip2}/bin/bzip2 \
+        --subst-var-by gzip ${gzip}/bin/gzip \
+        --subst-var-by xz ${xz}/bin/xz \
+        --subst-var-by tar ${gnutar}/bin/tar \
+        --subst-var-by tr ${coreutils}/bin/tr
+      mv tmp/config.nix.in corepkgs/config.nix.in
+    '';
+
+  configureFlags = [
+    "--with-store-dir=${storeDir}"
+    "--localstatedir=${stateDir}"
+    "--sysconfdir=${confDir}"
+    "--enable-gc"
+  ] ++ lib.optionals (!enableDocumentation) [
+    "--disable-doc-gen"
+  ] ++ lib.optionals (!atLeast24) [
+    # option was removed in 2.4
+    "--disable-init-state"
+  ] ++ lib.optionals stdenv.isLinux [
+    "--with-sandbox-shell=${busybox-sandbox-shell}/bin/busybox"
+  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform && stdenv.hostPlatform ? nix && stdenv.hostPlatform.nix ? system) [
+    "--with-system=${stdenv.hostPlatform.nix.system}"
+  ] ++ lib.optionals (!withLibseccomp) [
+    # RISC-V support in progress https://github.com/seccomp/libseccomp/pull/50
+    "--disable-seccomp-sandboxing"
+  ];
+
+  makeFlags = [
+    "profiledir=$(out)/etc/profile.d"
+  ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) "PRECOMPILE_HEADERS=0";
+
+  installFlags = [ "sysconfdir=$(out)/etc" ];
+
+  doInstallCheck = true;
+
+  # socket path becomes too long otherwise
+  preInstallCheck = lib.optionalString stdenv.isDarwin ''
+    export TMPDIR=$NIX_BUILD_TOP
+  ''
+  # See https://github.com/NixOS/nix/issues/5687
+  + lib.optionalString (atLeast25 && stdenv.isDarwin) ''
+    echo "exit 99" > tests/gc-non-blocking.sh
+  '';
+
+  separateDebugInfo = stdenv.isLinux && (atLeast24 -> !enableStatic);
+
+  enableParallelBuilding = true;
+
+  meta = with lib; {
+    description = "Powerful package manager that makes package management reliable and reproducible";
+    longDescription = ''
+      Nix is a powerful package manager for Linux and other Unix systems that
+      makes package management reliable and reproducible. It provides atomic
+      upgrades and rollbacks, side-by-side installation of multiple versions of
+      a package, multi-user package management and easy setup of build
+      environments.
+    '';
+    homepage = "https://nixos.org/";
+    license = licenses.lgpl2Plus;
+    maintainers = with maintainers; [ eelco lovesegfault ];
+    platforms = platforms.unix;
+    outputsToInstall = [ "out" ] ++ optional enableDocumentation "man";
+  };
+
+  passthru = {
+    inherit boehmgc;
+
+    perl-bindings = perl.pkgs.toPerlModule (callPackage ./nix-perl.nix { inherit src version;  });
+  };
+}
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index cfcc3c68c301..490ddcc53bf9 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -1,288 +1,71 @@
-{ lib, fetchurl, fetchFromGitHub, fetchpatch, callPackage
+{ lib
+, aws-sdk-cpp
+, boehmgc
+, callPackage
+, fetchFromGitHub
+, fetchurl
+, fetchpatch
+, Security
+
 , storeDir ? "/nix/store"
 , stateDir ? "/nix/var"
 , confDir ? "/etc"
-, boehmgc
-, Security
 }:
-
 let
+  boehmgc-nix_2_3 = boehmgc.override { enableLargeConfig = true; };
 
-common =
-  { lib, stdenv, perl, curl, bzip2, sqlite, openssl ? null, xz
-  , bash, coreutils, util-linuxMinimal, gzip, gnutar
-  , pkg-config, boehmgc, libsodium, brotli, boost, editline, nlohmann_json
-  , autoreconfHook, autoconf-archive, bison, flex
-  , jq, libarchive, libcpuid
-  , lowdown, mdbook
-  # Used by tests
-  , gtest
-  , busybox-sandbox-shell
-  , storeDir
-  , stateDir
-  , confDir
-  , withLibseccomp ? lib.meta.availableOn stdenv.hostPlatform libseccomp, libseccomp
-  , withAWS ? !enableStatic && (stdenv.isLinux || stdenv.isDarwin), aws-sdk-cpp
-  , enableStatic ? stdenv.hostPlatform.isStatic
-  , enableDocumentation ? lib.versionOlder version "2.4pre" ||
-                          stdenv.hostPlatform == stdenv.buildPlatform
-  , pname, version, suffix ? "", src
-  , patches ? [ ]
-  }:
-  let
-     sh = busybox-sandbox-shell;
-
-    is24 = lib.versionAtLeast version "2.4pre";
-    is25 = lib.versionAtLeast version "2.5pre";
-
-    nix = stdenv.mkDerivation {
-      inherit pname version src patches;
-
-      VERSION_SUFFIX = suffix;
-
-      outputs =
-        [ "out" "dev" ]
-        ++ lib.optionals enableDocumentation [ "man" "doc" ];
-
-      hardeningEnable = lib.optionals (!stdenv.isDarwin) [ "pie" ];
-
-      nativeBuildInputs =
-        [ pkg-config ]
-        ++ lib.optionals stdenv.isLinux [ util-linuxMinimal ]
-        ++ lib.optionals (is24 && enableDocumentation) [
-          (lib.getBin lowdown) mdbook
-        ]
-        ++ lib.optionals is24
-          [ autoreconfHook
-            autoconf-archive
-            bison flex
-            jq
-           ];
-
-      buildInputs =
-        [ curl libsodium openssl sqlite xz bzip2
-          brotli boost editline
-        ]
-        ++ lib.optionals stdenv.isDarwin [ Security ]
-        ++ lib.optionals is24 [ libarchive gtest lowdown ]
-        ++ lib.optional (is24 && stdenv.isx86_64) libcpuid
-        ++ lib.optional withLibseccomp libseccomp
-        ++ lib.optional withAWS
-            ((aws-sdk-cpp.override {
-              apis = ["s3" "transfer"];
-              customMemoryManagement = false;
-            }).overrideDerivation (args: {
-              patches = args.patches or [] ++ [
-                ./aws-sdk-cpp-TransferManager-ContentEncoding.patch
-              ];
-            }));
-
-      propagatedBuildInputs = [ boehmgc ];
-
-      NIX_LDFLAGS = lib.optionals (!is24) [
-        # https://github.com/NixOS/nix/commit/3e85c57a6cbf46d5f0fe8a89b368a43abd26daba
-        (lib.optionalString enableStatic "-lssl -lbrotlicommon -lssh2 -lz -lnghttp2 -lcrypto")
-        # https://github.com/NixOS/nix/commits/74b4737d8f0e1922ef5314a158271acf81cd79f8
-        (lib.optionalString (stdenv.hostPlatform.system == "armv5tel-linux" || stdenv.hostPlatform.system == "armv6l-linux") "-latomic")
-      ];
-
-      preConfigure =
-        # Copy libboost_context so we don't get all of Boost in our closure.
-        # https://github.com/NixOS/nixpkgs/issues/45462
-        lib.optionalString (!enableStatic) ''
-          mkdir -p $out/lib
-          cp -pd ${boost}/lib/{libboost_context*,libboost_thread*,libboost_system*} $out/lib
-          rm -f $out/lib/*.a
-          ${lib.optionalString stdenv.isLinux ''
-            chmod u+w $out/lib/*.so.*
-            patchelf --set-rpath $out/lib:${stdenv.cc.cc.lib}/lib $out/lib/libboost_thread.so.*
-          ''}
-        '' +
-        # On all versions before c9f51e87057652db0013289a95deffba495b35e7, which
-        # removes config.nix entirely and is not present in 2.3.x, we need to
-        # patch around an issue where the Nix configure step pulls in the build
-        # system's bash and other utilities when cross-compiling.
-        lib.optionalString (
-          stdenv.buildPlatform != stdenv.hostPlatform && !is24
-        ) ''
-          mkdir tmp/
-          substitute corepkgs/config.nix.in tmp/config.nix.in \
-            --subst-var-by bash ${bash}/bin/bash \
-            --subst-var-by coreutils ${coreutils}/bin \
-            --subst-var-by bzip2 ${bzip2}/bin/bzip2 \
-            --subst-var-by gzip ${gzip}/bin/gzip \
-            --subst-var-by xz ${xz}/bin/xz \
-            --subst-var-by tar ${gnutar}/bin/tar \
-            --subst-var-by tr ${coreutils}/bin/tr
-          mv tmp/config.nix.in corepkgs/config.nix.in
-          '';
-
-      configureFlags =
-        [ "--with-store-dir=${storeDir}"
-          "--localstatedir=${stateDir}"
-          "--sysconfdir=${confDir}"
-          "--enable-gc"
-        ]
-        ++ lib.optional (!enableDocumentation) "--disable-doc-gen"
-        ++ lib.optionals (!is24) [
-          # option was removed in 2.4
-          "--disable-init-state"
-        ]
-        ++ lib.optionals stdenv.isLinux [
-          "--with-sandbox-shell=${sh}/bin/busybox"
-        ]
-        ++ lib.optional (
-            stdenv.hostPlatform != stdenv.buildPlatform && stdenv.hostPlatform ? nix && stdenv.hostPlatform.nix ? system
-        ) "--with-system=${stdenv.hostPlatform.nix.system}"
-           # RISC-V support in progress https://github.com/seccomp/libseccomp/pull/50
-        ++ lib.optional (!withLibseccomp) "--disable-seccomp-sandboxing";
-
-      makeFlags = [ "profiledir=$(out)/etc/profile.d" ]
-        ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) "PRECOMPILE_HEADERS=0";
-
-      installFlags = [ "sysconfdir=$(out)/etc" ];
-
-      doInstallCheck = true; # not cross
-
-      # socket path becomes too long otherwise
-      preInstallCheck = lib.optionalString stdenv.isDarwin ''
-        export TMPDIR=$NIX_BUILD_TOP
-      ''
-      # See https://github.com/NixOS/nix/issues/5687
-      + lib.optionalString (is25 && stdenv.isDarwin) ''
-        echo "exit 99" > tests/gc-non-blocking.sh
-      '';
-
-      separateDebugInfo = stdenv.isLinux && (is24 -> !enableStatic);
-
-      enableParallelBuilding = true;
-
-      meta = with lib; {
-        description = "Powerful package manager that makes package management reliable and reproducible";
-        longDescription = ''
-          Nix is a powerful package manager for Linux and other Unix systems that
-          makes package management reliable and reproducible. It provides atomic
-          upgrades and rollbacks, side-by-side installation of multiple versions of
-          a package, multi-user package management and easy setup of build
-          environments.
-        '';
-        homepage = "https://nixos.org/";
-        license = licenses.lgpl2Plus;
-        maintainers = with maintainers; [ eelco lovesegfault ];
-        platforms = platforms.unix;
-        outputsToInstall = [ "out" ] ++ optional enableDocumentation "man";
-      };
-
-      passthru = {
-        is24 = lib.warn ''nix package: attribute .is24 is deprecated. Please use lib.versionAtLeast X.version "2.4pre".'' is24;
-        is25 = lib.warn ''nix package: attribute .is25 is deprecated. Please use lib.versionAtLeast X.version "2.5pre".'' is25;
-
-        perl-bindings = perl.pkgs.toPerlModule (stdenv.mkDerivation {
-          pname = "nix-perl";
-          inherit version;
-
-          inherit src;
-
-          postUnpack = "sourceRoot=$sourceRoot/perl";
-
-          # This is not cross-compile safe, don't have time to fix right now
-          # but noting for future travellers.
-          nativeBuildInputs =
-            [ perl pkg-config curl nix libsodium boost autoreconfHook autoconf-archive nlohmann_json ];
-
-          configureFlags =
-            [ "--with-dbi=${perl.pkgs.DBI}/${perl.libPrefix}"
-              "--with-dbd-sqlite=${perl.pkgs.DBDSQLite}/${perl.libPrefix}"
-            ];
-
-          preConfigure = "export NIX_STATE_DIR=$TMPDIR";
-
-          preBuild = "unset NIX_INDENT_MAKE";
-        });
-        inherit boehmgc;
-      };
-    };
-  in nix;
-
-  boehmgc_nix_2_3 = boehmgc.override {
-    enableLargeConfig = true;
-  };
-
-  boehmgc_nix = boehmgc_nix_2_3.overrideAttrs (drv: {
-    patches = (drv.patches or []) ++ [
-      # Part of the GC solution in https://github.com/NixOS/nix/pull/4944
-      (fetchpatch {
-        url = "https://github.com/hercules-ci/nix/raw/5c58d84a76d96f269e3ff1e72c9c9ba5f68576af/boehmgc-coroutine-sp-fallback.diff";
-        sha256 = "sha256-JvnWVTlkltmQUs/0qApv/LPZ690UX1/2hEP+LYRwKbI=";
-      })
-    ];
+  boehmgc-nix = boehmgc-nix_2_3.overrideAttrs (drv: {
+    # Part of the GC solution in https://github.com/NixOS/nix/pull/4944
+    patches = (drv.patches or [ ]) ++ [ ./patches/boehmgc-coroutine-sp-fallback.patch ];
   });
 
-  # master: https://github.com/NixOS/nix/pull/5536
-  # 2.4: https://github.com/NixOS/nix/pull/5537
-  installNlohmannJsonPatch = fetchpatch {
-    url = "https://github.com/NixOS/nix/pull/5536.diff";
-    sha256 = "sha256-SPnam4xNIjbMgnq6IP1AaM1V62X0yZNo4DEVmI8sHOo=";
-  };
-
-  buildNix =
-  { version, suffix ? ""
-  , src ? null, sha256 ? null
-  , boehmgc ? boehmgc_nix, patches ? [ ]
-  }:
-    assert (src == null) -> (sha256 != null);
-    assert (sha256 == null) -> (src != null);
-    callPackage common {
-      pname = "nix";
-      version = "${version}${suffix}";
-      inherit suffix;
-
-      src =
-        if src != null
-        then src
-        else fetchFromGitHub {
-          owner = "NixOS";
-          repo = "nix";
-          rev = version;
-          inherit sha256;
-        };
-
-      inherit boehmgc patches;
-      inherit storeDir stateDir confDir;
-    };
+  aws-sdk-cpp-nix = (aws-sdk-cpp.override {
+    apis = [ "s3" "transfer" ];
+    customMemoryManagement = false;
+  }).overrideDerivation (args: {
+    patches = (args.patches or [ ]) ++ [ ./patches/aws-sdk-cpp-TransferManager-ContentEncoding.patch ];
+  });
 
+  common = args:
+    callPackage
+      (import ./common.nix ({ inherit lib fetchFromGitHub; } // args))
+      {
+        inherit Security storeDir stateDir confDir;
+        boehmgc = boehmgc-nix;
+        aws-sdk-cpp = aws-sdk-cpp-nix;
+      };
 in rec {
-  nix = nixStable;
-
-  nixStable = nix_2_5;
-
-  nix_2_3 = buildNix rec {
+  nix_2_3 = (common rec {
     version = "2.3.16";
     src = fetchurl {
       url = "https://nixos.org/releases/nix/nix-${version}/nix-${version}.tar.xz";
       sha256 = "sha256-fuaBtp8FtSVJLSAsO+3Nne4ZYLuBj2JpD2xEk7fCqrw=";
     };
-    boehmgc = boehmgc_nix_2_3;
-  };
+  }).override { boehmgc = boehmgc-nix_2_3; };
 
-  nix_2_4 = buildNix {
+  nix_2_4 = common {
     version = "2.4";
     sha256 = "sha256-op48CCDgLHK0qV1Batz4Ln5FqBiRjlE6qHTiZgt3b6k=";
-    patches = [ installNlohmannJsonPatch ];
+    # https://github.com/NixOS/nix/pull/5537
+    patches = [ ./patches/install-nlohmann_json-headers.patch ];
   };
 
-  nix_2_5 = buildNix {
+  nix_2_5 = common {
     version = "2.5.1";
     sha256 = "sha256-GOsiqy9EaTwDn2PLZ4eFj1VkXcBUbqrqHehRE9GuGdU=";
-    patches = [ installNlohmannJsonPatch ];
+    # https://github.com/NixOS/nix/pull/5536
+    patches = [ ./patches/install-nlohmann_json-headers.patch ];
   };
 
-  nix_2_6 = buildNix {
+  nix_2_6 = common {
     version = "2.6.0";
     sha256 = "sha256-xEPeMcNJVOeZtoN+d+aRwolpW8mFSEQx76HTRdlhPhg=";
   };
 
-  nixUnstable = lib.lowPrio (buildNix rec {
+  # FIXME: nix_2_6 is broken on aarch64-darwin for now.
+  stable = nix_2_5;
+
+  unstable = lib.lowPrio (common rec {
     version = "2.7";
     suffix = "pre20220124_${lib.substring 0 7 src.rev}";
     src = fetchFromGitHub {
diff --git a/pkgs/tools/package-management/nix/nix-perl.nix b/pkgs/tools/package-management/nix/nix-perl.nix
new file mode 100644
index 000000000000..069a22d3a853
--- /dev/null
+++ b/pkgs/tools/package-management/nix/nix-perl.nix
@@ -0,0 +1,44 @@
+{ stdenv
+, perl
+, pkg-config
+, curl
+, nix
+, libsodium
+, boost
+, autoreconfHook
+, autoconf-archive
+, nlohmann_json
+
+, version
+, src
+}:
+
+stdenv.mkDerivation {
+  pname = "nix-perl";
+  inherit version src;
+
+  postUnpack = "sourceRoot=$sourceRoot/perl";
+
+  # This is not cross-compile safe, don't have time to fix right now
+  # but noting for future travellers.
+  nativeBuildInputs = [
+    autoconf-archive
+    autoreconfHook
+    boost
+    curl
+    libsodium
+    nix
+    nlohmann_json
+    perl
+    pkg-config
+  ];
+
+  configureFlags = [
+    "--with-dbi=${perl.pkgs.DBI}/${perl.libPrefix}"
+    "--with-dbd-sqlite=${perl.pkgs.DBDSQLite}/${perl.libPrefix}"
+  ];
+
+  preConfigure = "export NIX_STATE_DIR=$TMPDIR";
+
+  preBuild = "unset NIX_INDENT_MAKE";
+}
diff --git a/pkgs/tools/package-management/nix/aws-sdk-cpp-TransferManager-ContentEncoding.patch b/pkgs/tools/package-management/nix/patches/aws-sdk-cpp-TransferManager-ContentEncoding.patch
index 59cc305a60bc..59cc305a60bc 100644
--- a/pkgs/tools/package-management/nix/aws-sdk-cpp-TransferManager-ContentEncoding.patch
+++ b/pkgs/tools/package-management/nix/patches/aws-sdk-cpp-TransferManager-ContentEncoding.patch
diff --git a/pkgs/tools/package-management/nix/patches/boehmgc-coroutine-sp-fallback.patch b/pkgs/tools/package-management/nix/patches/boehmgc-coroutine-sp-fallback.patch
new file mode 100644
index 000000000000..e659bf470d39
--- /dev/null
+++ b/pkgs/tools/package-management/nix/patches/boehmgc-coroutine-sp-fallback.patch
@@ -0,0 +1,45 @@
+diff --git a/pthread_stop_world.c b/pthread_stop_world.c
+index 4b2c429..1fb4c52 100644
+--- a/pthread_stop_world.c
++++ b/pthread_stop_world.c
+@@ -673,6 +673,8 @@ GC_INNER void GC_push_all_stacks(void)
+     struct GC_traced_stack_sect_s *traced_stack_sect;
+     pthread_t self = pthread_self();
+     word total_size = 0;
++    size_t stack_limit;
++    pthread_attr_t pattr;
+ 
+     if (!EXPECT(GC_thr_initialized, TRUE))
+       GC_thr_init();
+@@ -722,6 +724,31 @@ GC_INNER void GC_push_all_stacks(void)
+           hi = p->altstack + p->altstack_size;
+           /* FIXME: Need to scan the normal stack too, but how ? */
+           /* FIXME: Assume stack grows down */
++        } else {
++          if (pthread_getattr_np(p->id, &pattr)) {
++            ABORT("GC_push_all_stacks: pthread_getattr_np failed!");
++          }
++          if (pthread_attr_getstacksize(&pattr, &stack_limit)) {
++            ABORT("GC_push_all_stacks: pthread_attr_getstacksize failed!");
++          }
++          if (pthread_attr_destroy(&pattr)) {
++            ABORT("GC_push_all_stacks: pthread_attr_destroy failed!");
++          }
++          // When a thread goes into a coroutine, we lose its original sp until
++          // control flow returns to the thread.
++          // While in the coroutine, the sp points outside the thread stack,
++          // so we can detect this and push the entire thread stack instead,
++          // as an approximation.
++          // We assume that the coroutine has similarly added its entire stack.
++          // This could be made accurate by cooperating with the application
++          // via new functions and/or callbacks.
++          #ifndef STACK_GROWS_UP
++            if (lo >= hi || lo < hi - stack_limit) { // sp outside stack
++              lo = hi - stack_limit;
++            }
++          #else
++          #error "STACK_GROWS_UP not supported in boost_coroutine2 (as of june 2021), so we don't support it in Nix."
++          #endif
+         }
+         GC_push_all_stack_sections(lo, hi, traced_stack_sect);
+ #       ifdef STACK_GROWS_UP
diff --git a/pkgs/tools/package-management/nix/patches/install-nlohmann_json-headers.patch b/pkgs/tools/package-management/nix/patches/install-nlohmann_json-headers.patch
new file mode 100644
index 000000000000..8b92de229032
--- /dev/null
+++ b/pkgs/tools/package-management/nix/patches/install-nlohmann_json-headers.patch
@@ -0,0 +1,36 @@
+From 3884f7a69a57d8ecfcbcaae476ec2ff53ffbd549 Mon Sep 17 00:00:00 2001
+From: Robert Hensing <robert@roberthensing.nl>
+Date: Thu, 11 Nov 2021 11:03:21 +0100
+Subject: [PATCH] Install nlohmann_json headers
+
+These headers are included by the libexpr, libfetchers, libstore
+and libutil headers.
+Considering that these are vendored sources, Nix should expose them,
+as it is not a good idea for reverse dependencies to rely on a
+potentially different source that can go out of sync.
+---
+ Makefile              | 1 +
+ src/nlohmann/local.mk | 2 ++
+ 2 files changed, 3 insertions(+)
+ create mode 100644 src/nlohmann/local.mk
+
+diff --git a/Makefile b/Makefile
+index 5040d288485..e6ce50cbdb7 100644
+--- a/Makefile
++++ b/Makefile
+@@ -10,6 +10,7 @@ makefiles = \
+   src/libexpr/local.mk \
+   src/libcmd/local.mk \
+   src/nix/local.mk \
++  src/nlohmann/local.mk \
+   src/resolve-system-dependencies/local.mk \
+   scripts/local.mk \
+   misc/bash/local.mk \
+diff --git a/src/nlohmann/local.mk b/src/nlohmann/local.mk
+new file mode 100644
+index 00000000000..63c427e000e
+--- /dev/null
++++ b/src/nlohmann/local.mk
+@@ -0,0 +1,2 @@
++$(foreach i, $(wildcard src/nlohmann/*.hpp), \
++  $(eval $(call install-file-in, $(i), $(includedir)/nlohmann, 0644)))
diff --git a/pkgs/tools/security/doas/default.nix b/pkgs/tools/security/doas/default.nix
index f88abbd7e1ba..b79dba7c325f 100644
--- a/pkgs/tools/security/doas/default.nix
+++ b/pkgs/tools/security/doas/default.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "doas";
-  version = "6.8.1";
+  version = "6.8.2";
 
   src = fetchFromGitHub {
     owner = "Duncaen";
     repo = "OpenDoas";
     rev = "v${version}";
-    sha256 = "sha256-F0FVVspGDZmzxy4nsb/wsEoCw4eHscymea7tIKrWzD0=";
+    sha256 = "9uOQ2Ta5HzEpbCz2vbqZEEksPuIjL8lvmfmynfqxMeM=";
   };
 
   # otherwise confuses ./configure
diff --git a/pkgs/tools/security/exploitdb/default.nix b/pkgs/tools/security/exploitdb/default.nix
index fabab51525b3..a59fc1dc90eb 100644
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2022-01-25";
+  version = "2022-01-26";
 
   src = fetchFromGitHub {
     owner = "offensive-security";
     repo = pname;
     rev = version;
-    sha256 = "sha256-kqb5MhdKA6qvIdnTzPNUscksyz2GWaiPJg2JxA1C3p0=";
+    sha256 = "sha256-5WdAh4YFNLOF8h8f0pN6GHdoyASf/3fN345Mp9b1Cfg=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/system/dd_rescue/default.nix b/pkgs/tools/system/dd_rescue/default.nix
index ce996bf7c6f4..f7501d768034 100644
--- a/pkgs/tools/system/dd_rescue/default.nix
+++ b/pkgs/tools/system/dd_rescue/default.nix
@@ -36,6 +36,5 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
     homepage = "http://www.garloff.de/kurt/linux/ddrescue/";
     license = licenses.gpl2Plus;
-    updateWalker = true;
   };
 }
diff --git a/pkgs/tools/system/di/default.nix b/pkgs/tools/system/di/default.nix
index 6dcd3e87f68f..06d91305909c 100644
--- a/pkgs/tools/system/di/default.nix
+++ b/pkgs/tools/system/di/default.nix
@@ -15,7 +15,6 @@ stdenv.mkDerivation rec {
     description = "Disk information utility; displays everything 'df' does and more";
     homepage = "https://gentoo.com/di/";
     license = licenses.zlib;
-    updateWalker = true;
     maintainers = with maintainers; [ manveru ];
     platforms = platforms.all;
   };
diff --git a/pkgs/tools/system/freeipmi/default.nix b/pkgs/tools/system/freeipmi/default.nix
index 9d2e66876239..a3bb99735a17 100644
--- a/pkgs/tools/system/freeipmi/default.nix
+++ b/pkgs/tools/system/freeipmi/default.nix
@@ -37,7 +37,5 @@ stdenv.mkDerivation rec {
 
     maintainers = with lib.maintainers; [ raskin ];
     platforms = lib.platforms.gnu ++ lib.platforms.linux;  # arbitrary choice
-
-    updateWalker = true;
   };
 }
diff --git a/pkgs/tools/system/ipmiutil/default.upstream b/pkgs/tools/system/ipmiutil/default.upstream
deleted file mode 100644
index 45e3a936825a..000000000000
--- a/pkgs/tools/system/ipmiutil/default.upstream
+++ /dev/null
@@ -1,4 +0,0 @@
-url https://sourceforge.net/projects/ipmiutil/files/
-SF_version_tarball
-SF_redirect
-minimize_overwrite
diff --git a/pkgs/tools/text/kdiff3/default.nix b/pkgs/tools/text/kdiff3/default.nix
index c230278c0a02..1362591e24c1 100644
--- a/pkgs/tools/text/kdiff3/default.nix
+++ b/pkgs/tools/text/kdiff3/default.nix
@@ -1,26 +1,38 @@
-{
-  mkDerivation, lib, fetchurl,
-  extra-cmake-modules, kdoctools, wrapGAppsHook,
-  kcrash, kconfig, kinit, kparts, kiconthemes
+{ mkDerivation
+, lib
+, fetchurl
+, extra-cmake-modules
+, kdoctools
+, wrapGAppsHook
+, boost
+, kcrash
+, kconfig
+, kinit
+, kparts
+, kiconthemes
 }:
 
 mkDerivation rec {
   pname = "kdiff3";
-  version = "1.8.5";
+  version = "1.9.4";
 
   src = fetchurl {
     url = "https://download.kde.org/stable/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-vJL30E6xI/nFbb4wR69nv3FSQPqZSHrB0czypF4IVME=";
+    sha256 = "sha256-oTBxLO7wdN9pFCaQn8SjMrZvTD8UkKVIq1v7RjFsOFo=";
   };
 
+  buildInputs = [ boost ];
+
   nativeBuildInputs = [ extra-cmake-modules kdoctools wrapGAppsHook ];
 
   propagatedBuildInputs = [ kconfig kcrash kinit kparts kiconthemes ];
 
+  cmakeFlags = [ "-Wno-dev" ];
+
   meta = with lib; {
+    description = "Compares and merges 2 or 3 files or directories";
     homepage = "https://invent.kde.org/sdk/kdiff3";
     license = licenses.gpl2Plus;
-    description = "Compares and merges 2 or 3 files or directories";
     maintainers = with maintainers; [ peterhoeg ];
     platforms = with platforms; linux;
   };
diff --git a/pkgs/tools/text/vgrep/default.nix b/pkgs/tools/text/vgrep/default.nix
index 928f401c3839..8da1917fdd01 100644
--- a/pkgs/tools/text/vgrep/default.nix
+++ b/pkgs/tools/text/vgrep/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "vgrep";
-  version = "2.5.5";
+  version = "2.6.0";
 
   src = fetchFromGitHub {
     owner = "vrothberg";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-pWRc1EjL09zFT/8HLrosuCJ5qTDj2VaizoI/Eu8jsgM=";
+    sha256 = "sha256-RLyEOvNhb1oXPYYxVZKc+xN2uCgUaWMxh8dPEOUfAFA=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/tools/virtualization/linode-cli/default.nix b/pkgs/tools/virtualization/linode-cli/default.nix
index b7b20996bd3b..ade2b437c5c3 100644
--- a/pkgs/tools/virtualization/linode-cli/default.nix
+++ b/pkgs/tools/virtualization/linode-cli/default.nix
@@ -11,10 +11,10 @@
 }:
 
 let
-  sha256 = "10mlkkprky7qqjrkv43v1lzmlgdjpkzy3729k9xxdm5mpq5bjdwj";
+  sha256 = "0vyvmfrq3jnwqqjf2rsd5qnnwvvq71165ws7smnxk5jn8lqkq6z1";
   # specVersion taken from: https://www.linode.com/docs/api/openapi.yaml at `info.version`.
-  specVersion = "4.112.3";
-  specSha256 = "15qlk0vd6l1gkxjbmvfwwdgjv7517y0kf0s3d32r3m2xqdsw9pc6";
+  specVersion = "4.113.0";
+  specSha256 = "0r02h6a75ad2yahff62ilmlcnp3w4j4djkx187zyh9kdvf1lzqb9";
   spec = fetchurl {
     url = "https://raw.githubusercontent.com/linode/linode-api-docs/v${specVersion}/openapi.yaml";
     sha256 = specSha256;
@@ -24,7 +24,7 @@ in
 
 buildPythonApplication rec {
   pname = "linode-cli";
-  version = "5.14.0";
+  version = "5.15.0";
 
   src = fetchFromGitHub {
     owner = "linode";
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index c8b38f310a85..328e62f2258d 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -667,7 +667,13 @@ mapAliases ({
   nilfs_utils = nilfs-utils; # added 2018-04-25
   nix-direnv-flakes = nix-direnv;
   nix-review = nixpkgs-review; # added 2019-12-22
-  nixFlakes = nixStable; # added 2021-05-21
+  nixFlakes = nixVersions.stable; # added 2021-05-21
+  nixStable = nixVersions.stable; # added 2022-01-24
+  nixUnstable = nixVersions.unstable; # added 2022-01-26
+  nix_2_3 = nixVersions.nix_2_3;
+  nix_2_4 = nixVersions.nix_2_4;
+  nix_2_5 = nixVersions.nix_2_5;
+  nix_2_6 = nixVersions.nix_2_6;
   nmap_graphical = nmap-graphical;  # added 2017-01-19
   nmap-unfree = nmap; # added 2021-04-06
   nologin = shadow; # added 2018-04-25
@@ -1033,6 +1039,7 @@ mapAliases ({
   tftp_hpa = tftp-hpa; # added 2015-04-03
   timescale-prometheus = promscale; # added 2020-09-29
   timetable = throw "timetable has been removed, as the upstream project has been abandoned"; # added 2021-09-05
+  tomboy = throw "tomboy is not actively developed anymore and was removed."; # added 2022-01-27
   tomcat7 = throw "tomcat7 has been removed from nixpkgs as it has reached end of life."; # added 2021-06-16
   tomcat8 = throw "tomcat8 has been removed from nixpkgs as it has reached end of life."; # added 2021-06-16
   tomcat85 = throw "tomcat85 has been removed from nixpkgs as it has reached end of life."; # added 2020-03-11
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index e0159f16a4f9..ad712425ffad 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -67,7 +67,7 @@ with pkgs;
   clangStdenvNoLibs = mkStdenvNoLibs clangStdenv;
 
   # For convenience, allow callers to get the path to Nixpkgs.
-  path = config.path;
+  path = ../..;
 
 
   ### Helper functions.
@@ -2929,9 +2929,10 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) Security AppKit CoreServices;
     electron = electron_13;
   };
-  element-desktop-wayland = element-desktop.override {
-    useWayland = true;
-  };
+  element-desktop-wayland = writeScript "element-desktop-wayland" ''
+    #!/bin/sh
+    NIXOS_OZONE_WL=1 exec ${element-desktop}/bin/element-desktop "$@"
+  '';
 
   element-web = callPackage ../applications/networking/instant-messengers/element/element-web.nix {
     conf = config.element-web.conf or {};
@@ -3366,6 +3367,8 @@ with pkgs;
 
   maliit-keyboard = libsForQt5.callPackage ../applications/misc/maliit-keyboard { };
 
+  mandown = callPackage ../tools/misc/mandown { };
+
   mapcidr = callPackage ../tools/misc/mapcidr { };
 
   mapproxy = callPackage ../applications/misc/mapproxy { };
@@ -4923,9 +4926,10 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) Security AppKit CoreServices;
     electron = electron_13;
   };
-  schildichat-desktop-wayland = schildichat-desktop.override {
-    useWayland = true;
-  };
+  schildichat-desktop-wayland = writeScript "schildichat-desktop-wayland" ''
+    #!/bin/sh
+    NIXOS_OZONE_WL=1 exec ${schildichat-desktop}/bin/schildichat-desktop "$@"
+  '';
 
   schildichat-web = callPackage ../applications/networking/instant-messengers/schildichat/schildichat-web.nix {
     conf = config.schildichat-web.conf or {};
@@ -19025,9 +19029,7 @@ with pkgs;
     ogre = ogre1_9;
   };
 
-  mysocketw = callPackage ../development/libraries/mysocketw {
-    openssl = openssl_1_0_2;
-  };
+  mysocketw = callPackage ../development/libraries/mysocketw { };
 
   mythes = callPackage ../development/libraries/mythes { };
 
@@ -21640,7 +21642,6 @@ with pkgs;
 
   openfire = callPackage ../servers/xmpp/openfire { };
 
-  softether_4_25 = callPackage ../servers/softether/4.25.nix { openssl = openssl_1_0_2; };
   softether_4_29 = callPackage ../servers/softether/4.29.nix { };
   softether = softether_4_29;
 
@@ -24933,7 +24934,7 @@ with pkgs;
   darcs-to-git = callPackage ../applications/version-management/git-and-tools/darcs-to-git { };
 
   darktable = callPackage ../applications/graphics/darktable {
-    lua = lua5_3;
+    lua = lua5_4;
     pugixml = pugixml.override { shared = true; };
   };
 
@@ -29753,6 +29754,8 @@ with pkgs;
     gtk = gtk2;
   };
 
+  xxh = with python3Packages; toPythonApplication xxh;
+
   kodiPackages = recurseIntoAttrs (kodi.packages);
 
   kodi = callPackage ../applications/video/kodi {
@@ -31113,9 +31116,14 @@ with pkgs;
 
   pong3d = callPackage ../games/pong3d { };
 
-  pokerth = libsForQt5.callPackage ../games/pokerth { };
+  pokerth = libsForQt5.callPackage ../games/pokerth {
+    boost = boost16x;
+  };
 
-  pokerth-server = libsForQt5.callPackage ../games/pokerth { target = "server"; };
+  pokerth-server = libsForQt5.callPackage ../games/pokerth {
+    boost = boost16x;
+    target = "server";
+  };
 
   powermanga = callPackage ../games/powermanga { };
 
@@ -33120,18 +33128,13 @@ with pkgs;
 
   neo = callPackage ../applications/misc/neo { };
 
-  inherit (callPackage ../tools/package-management/nix {
-      storeDir = config.nix.storeDir or "/nix/store";
-      stateDir = config.nix.stateDir or "/nix/var";
-      inherit (darwin.apple_sdk.frameworks) Security;
-      })
-    nix
-    nixStable
-    nix_2_3
-    nix_2_4
-    nix_2_5
-    nix_2_6
-    nixUnstable;
+  nixVersions = callPackage ../tools/package-management/nix {
+    storeDir = config.nix.storeDir or "/nix/store";
+    stateDir = config.nix.stateDir or "/nix/var";
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
+
+  nix = nixVersions.stable;
 
   nixStatic = pkgsStatic.nix;
 
@@ -33304,7 +33307,7 @@ with pkgs;
 
   nix-linter = haskell.lib.compose.justStaticExecutables (haskellPackages.nix-linter);
 
-  nixos-option = callPackage ../tools/nix/nixos-option { nix = nix_2_3; };
+  nixos-option = callPackage ../tools/nix/nixos-option { nix = nixVersions.nix_2_3; };
 
   nix-pin = callPackage ../tools/package-management/nix-pin { };
 
@@ -33772,6 +33775,8 @@ with pkgs;
 
   vnote = libsForQt5.callPackage ../applications/office/vnote { };
 
+  sshportal = callPackage ../servers/sshportal { };
+
   ssh-audit = callPackage ../tools/security/ssh-audit { };
 
   ssh-tools = callPackage ../applications/misc/ssh-tools { };
@@ -34163,8 +34168,6 @@ with pkgs;
 
   tomb = callPackage ../os-specific/linux/tomb {};
 
-  tomboy = callPackage ../applications/misc/tomboy { };
-
   imatix_gsl = callPackage ../development/tools/imatix_gsl {};
 
   sccache = callPackage ../development/tools/misc/sccache {
diff --git a/pkgs/top-level/config.nix b/pkgs/top-level/config.nix
index bb4f668d60f1..7a5b4bdd1798 100644
--- a/pkgs/top-level/config.nix
+++ b/pkgs/top-level/config.nix
@@ -32,20 +32,6 @@ let
       feature = "run <literal>checkPhase</literal> by default";
     };
 
-    path = mkOption {
-      type = types.path;
-      default = ../..;
-      defaultText = lib.literalDocBook "a path expression";
-      internal = true;
-      description = ''
-        A reference to Nixpkgs' own sources.
-
-        This is overridable in order to avoid copying sources unnecessarily,
-        as a path expression that references a store path will not short-circuit
-        to the store path itself, but copy the store path instead.
-      '';
-    };
-
   };
 
 in {
diff --git a/pkgs/top-level/kodi-packages.nix b/pkgs/top-level/kodi-packages.nix
index d86c9c6778e8..6771ffe65b1d 100644
--- a/pkgs/top-level/kodi-packages.nix
+++ b/pkgs/top-level/kodi-packages.nix
@@ -1,4 +1,4 @@
-{ lib, newScope, kodi, libretro }:
+{ config, lib, newScope, kodi, libretro }:
 
 with lib;
 
@@ -54,25 +54,7 @@ let self = rec {
 
   arteplussept = callPackage ../applications/video/kodi/addons/arteplussept { };
 
-  controllers = {
-    default = callPackage ../applications/video/kodi/addons/controllers { controller = "default"; };
-
-    dreamcast = callPackage ../applications/video/kodi/addons/controllers { controller = "dreamcast"; };
-
-    gba = callPackage ../applications/video/kodi/addons/controllers { controller = "gba"; };
-
-    genesis = callPackage ../applications/video/kodi/addons/controllers { controller = "genesis"; };
-
-    mouse = callPackage ../applications/video/kodi/addons/controllers { controller = "mouse"; };
-
-    n64 = callPackage ../applications/video/kodi/addons/controllers { controller = "n64"; };
-
-    nes = callPackage ../applications/video/kodi/addons/controllers { controller = "nes"; };
-
-    ps = callPackage ../applications/video/kodi/addons/controllers { controller = "ps"; };
-
-    snes = callPackage ../applications/video/kodi/addons/controllers { controller = "snes"; };
-  };
+  controller-topology-project = callPackage ../applications/video/kodi/addons/controller-topology-project { };
 
   iagl = callPackage ../applications/video/kodi/addons/iagl { };
 
@@ -171,4 +153,8 @@ let self = rec {
   trakt-module = callPackage ../applications/video/kodi/addons/trakt-module { };
 
   trakt = callPackage ../applications/video/kodi/addons/trakt { };
-}; in self
+}; in self // lib.optionalAttrs (config.allowAliases or true) {
+  # deprecated or renamed packages
+
+  controllers = throw "kodi.packages.controllers has been replaced with kodi.packages.controller-topology-project - a package which contains a large number of controller profiles." { };
+}
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index e8cdd09e544f..f7d291928f37 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -11863,8 +11863,8 @@ let
     pname = "libnet";
     version = "3.12";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/S/SH/SHAY/libnet-3.12.tar.gz";
-      sha256 = "1px35q9qchzd7rxqldj87vbrall8v31blidhmh0d25d5hyq9lw25";
+      url = "mirror://cpan/authors/id/S/SH/SHAY/libnet-3.13.tar.gz";
+      sha256 = "sha256-WjX7Hy1KopFoDrGvOImfq0U8IsKOcffHvTdHtaPbNIw=";
     };
     patches = [
       (fetchpatch {
@@ -17024,6 +17024,20 @@ let
     doCheck = false;
   };
 
+  OpenOfficeOODoc = buildPerlPackage {
+    pname = "OpenOffice-OODoc";
+    version = "2.125";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/J/JM/JMGDOC/OpenOffice-OODoc-2.125.tar.gz";
+      sha256 = "1dnsj63svxq0hi3aci4x7binql8kr754inlkks5jmi4k0sblh561";
+    };
+    propagatedBuildInputs = [ ArchiveZip XMLTwig ];
+    meta = {
+      license = with lib.licenses; [ lgpl21 ];
+      maintainers = [ maintainers.wentasah ];
+    };
+  };
+
   NetOpenIDCommon = buildPerlPackage {
     pname = "Net-OpenID-Common";
     version = "1.20";
diff --git a/pkgs/top-level/php-packages.nix b/pkgs/top-level/php-packages.nix
index 9180421746a5..cea65edb41fc 100644
--- a/pkgs/top-level/php-packages.nix
+++ b/pkgs/top-level/php-packages.nix
@@ -175,6 +175,8 @@ lib.makeScope pkgs.newScope (self: with self; {
 
     couchbase = callPackage ../development/php-packages/couchbase { };
 
+    ds = callPackage ../development/php-packages/ds { };
+
     event = callPackage ../development/php-packages/event { };
 
     gnupg = callPackage ../development/php-packages/gnupg { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 6fa63a74c3dc..3c9d482a6690 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -7915,7 +7915,7 @@ in {
   python-http-client = callPackage ../development/python-modules/python-http-client { };
 
   pythonix = callPackage ../development/python-modules/pythonix {
-    nix = pkgs.nix_2_3;
+    nix = pkgs.nixVersions.nix_2_3;
     meson = pkgs.meson.override { python3 = self.python; };
   };
 
@@ -10306,6 +10306,8 @@ in {
 
   wandb = callPackage ../development/python-modules/wandb { };
 
+  warcio = callPackage ../development/python-modules/warcio { };
+
   warlock = callPackage ../development/python-modules/warlock { };
 
   warrant = callPackage ../development/python-modules/warrant { };
@@ -10581,6 +10583,8 @@ in {
     inherit (pkgs.xorg) xorgserver;
   };
 
+  xxh = callPackage ../tools/networking/xxh { };
+
   xxhash = callPackage ../development/python-modules/xxhash { };
 
   yahooweather = callPackage ../development/python-modules/yahooweather { };