about summary refs log tree commit diff
path: root/pkgs/applications
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs/applications')
-rw-r--r--pkgs/applications/audio/gtkpod/default.nix9
-rw-r--r--pkgs/applications/audio/industrializer/default.nix4
-rw-r--r--pkgs/applications/audio/pd-plugins/zexy/default.nix3
-rw-r--r--pkgs/applications/audio/sonic-pi/default.nix2
-rw-r--r--pkgs/applications/audio/spotify/default.nix4
-rw-r--r--pkgs/applications/audio/strawberry/default.nix2
-rw-r--r--pkgs/applications/audio/timemachine/default.nix4
-rw-r--r--pkgs/applications/audio/xsynth-dssi/default.nix3
-rw-r--r--pkgs/applications/blockchains/cgminer/default.nix4
-rw-r--r--pkgs/applications/blockchains/go-ethereum/default.nix6
-rw-r--r--pkgs/applications/blockchains/snarkos/default.nix2
-rw-r--r--pkgs/applications/blockchains/solana/default.nix2
-rw-r--r--pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix7
-rw-r--r--pkgs/applications/editors/jetbrains/default.nix2
-rw-r--r--pkgs/applications/editors/jucipp/default.nix3
-rw-r--r--pkgs/applications/editors/kodestudio/default.nix2
-rw-r--r--pkgs/applications/editors/neovim/default.nix31
-rw-r--r--pkgs/applications/editors/pinegrow/default.nix13
-rw-r--r--pkgs/applications/editors/poke/default.nix4
-rw-r--r--pkgs/applications/editors/sublime/3/common.nix2
-rw-r--r--pkgs/applications/editors/vim/plugins/overrides.nix3
-rw-r--r--pkgs/applications/editors/vscode/extensions/ms-dotnettools-csharp/default.nix2
-rw-r--r--pkgs/applications/editors/vscode/vscode.nix12
-rw-r--r--pkgs/applications/editors/vscode/vscodium.nix10
-rw-r--r--pkgs/applications/editors/wxhexeditor/default.nix3
-rw-r--r--pkgs/applications/emulators/rpcs3/default.nix8
-rw-r--r--pkgs/applications/graphics/ImageMagick/6.x.nix2
-rw-r--r--pkgs/applications/graphics/drawing/default.nix6
-rw-r--r--pkgs/applications/graphics/exrtools/default.nix2
-rw-r--r--pkgs/applications/graphics/icon-library/default.nix14
-rw-r--r--pkgs/applications/graphics/sane/config.nix2
-rw-r--r--pkgs/applications/misc/1password/default.nix9
-rw-r--r--pkgs/applications/misc/HentaiAtHome/default.nix2
-rw-r--r--pkgs/applications/misc/dasel/default.nix4
-rw-r--r--pkgs/applications/misc/fuzzel/default.nix2
-rw-r--r--pkgs/applications/misc/gofu/default.nix6
-rw-r--r--pkgs/applications/misc/gpxsee/default.nix4
-rw-r--r--pkgs/applications/misc/gsimplecal/default.nix4
-rw-r--r--pkgs/applications/misc/gtk2fontsel/default.nix2
-rw-r--r--pkgs/applications/misc/p2pool/default.nix4
-rw-r--r--pkgs/applications/misc/pcmanx-gtk2/default.nix4
-rw-r--r--pkgs/applications/misc/stag/default.nix2
-rw-r--r--pkgs/applications/misc/taskwarrior-tui/default.nix6
-rw-r--r--pkgs/applications/misc/yubioath-desktop/default.nix2
-rw-r--r--pkgs/applications/networking/browsers/brave/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/chromium/browser.nix2
-rw-r--r--pkgs/applications/networking/browsers/chromium/upstream-info.json34
-rw-r--r--pkgs/applications/networking/browsers/microsoft-edge/browser.nix191
-rw-r--r--pkgs/applications/networking/browsers/microsoft-edge/default.nix20
-rwxr-xr-xpkgs/applications/networking/browsers/microsoft-edge/update.sh50
-rw-r--r--pkgs/applications/networking/browsers/palemoon/default.nix35
-rw-r--r--pkgs/applications/networking/cluster/driftctl/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/fluxcd/default.nix8
-rw-r--r--pkgs/applications/networking/cluster/openshift/default.nix86
-rw-r--r--pkgs/applications/networking/cluster/pluto/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/terraform-providers/providers.json9
-rw-r--r--pkgs/applications/networking/instant-messengers/bitlbee-steam/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/chatty/default.nix2
-rw-r--r--pkgs/applications/networking/instant-messengers/profanity/default.nix26
-rw-r--r--pkgs/applications/networking/irc/bip/default.nix3
-rw-r--r--pkgs/applications/networking/irc/irssi/fish/default.nix4
-rw-r--r--pkgs/applications/networking/irc/wraith/configure.patch2
-rw-r--r--pkgs/applications/networking/irc/wraith/default.nix6
-rw-r--r--pkgs/applications/networking/mailreaders/mailspring/default.nix11
-rw-r--r--pkgs/applications/networking/mullvad/default.nix8
-rw-r--r--pkgs/applications/networking/mullvad/libwg.nix35
-rw-r--r--pkgs/applications/networking/mullvad/mullvad.nix107
-rw-r--r--pkgs/applications/networking/mullvad/openvpn.nix87
-rw-r--r--pkgs/applications/networking/owamp/default.nix3
-rw-r--r--pkgs/applications/networking/p2p/twister/default.nix4
-rw-r--r--pkgs/applications/networking/remote/citrix-workspace/generic.nix2
-rw-r--r--pkgs/applications/networking/sniffers/wireshark/default.nix4
-rw-r--r--pkgs/applications/networking/sync/lsyncd/default.nix3
-rw-r--r--pkgs/applications/office/hledger-check-fancyassertions/default.nix13
-rw-r--r--pkgs/applications/office/morgen/default.nix4
-rw-r--r--pkgs/applications/office/pinpoint/default.nix4
-rw-r--r--pkgs/applications/office/zotero/default.nix2
-rw-r--r--pkgs/applications/science/biology/kssd/default.nix3
-rw-r--r--pkgs/applications/science/electronics/gerbv/default.nix4
-rw-r--r--pkgs/applications/science/logic/nuXmv/default.nix16
-rw-r--r--pkgs/applications/science/misc/rink/default.nix6
-rw-r--r--pkgs/applications/terminal-emulators/kitty/default.nix5
-rw-r--r--pkgs/applications/version-management/git-and-tools/gh/default.nix6
-rw-r--r--pkgs/applications/version-management/git-and-tools/git-annex-utils/default.nix3
-rw-r--r--pkgs/applications/version-management/gitlab/data.json14
-rw-r--r--pkgs/applications/version-management/gitlab/gitaly/default.nix4
-rw-r--r--pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix2
-rw-r--r--pkgs/applications/version-management/gitlab/rubyEnv/Gemfile2
-rw-r--r--pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock8
-rw-r--r--pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix4
-rw-r--r--pkgs/applications/version-management/subversion/default.nix2
-rw-r--r--pkgs/applications/version-management/verco/default.nix6
-rw-r--r--pkgs/applications/video/davinci-resolve/default.nix178
-rw-r--r--pkgs/applications/video/entangle/default.nix20
-rw-r--r--pkgs/applications/virtualization/arion/default.nix12
-rw-r--r--pkgs/applications/virtualization/podman-tui/default.nix4
-rw-r--r--pkgs/applications/virtualization/podman/default.nix4
-rw-r--r--pkgs/applications/virtualization/spike/default.nix18
-rw-r--r--pkgs/applications/virtualization/virt-viewer/default.nix10
99 files changed, 1027 insertions, 311 deletions
diff --git a/pkgs/applications/audio/gtkpod/default.nix b/pkgs/applications/audio/gtkpod/default.nix
index 61484bc2fbb1..e741f6fe2982 100644
--- a/pkgs/applications/audio/gtkpod/default.nix
+++ b/pkgs/applications/audio/gtkpod/default.nix
@@ -1,6 +1,7 @@
-{ lib, stdenv, fetchurl, pkg-config, wrapGAppsHook, intltool, libgpod, curl, flac,
-  gnome, gtk3, gettext, perlPackages, flex, libid3tag, gdl,
-  libvorbis, gdk-pixbuf }:
+{ lib, stdenv, fetchurl, pkg-config, wrapGAppsHook, intltool, libgpod, libxml2, curl, flac
+, gnome, gtk3, gettext, perlPackages, flex, libid3tag, gdl
+, libvorbis, gdk-pixbuf
+}:
 
 stdenv.mkDerivation rec {
   version = "2.1.5";
@@ -14,7 +15,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config wrapGAppsHook intltool ];
   buildInputs = [
     curl gettext
-    flex libgpod libid3tag flac libvorbis gtk3 gdk-pixbuf
+    flex libgpod libid3tag flac libvorbis libxml2 gtk3 gdk-pixbuf
     gdl gnome.adwaita-icon-theme gnome.anjuta
   ] ++ (with perlPackages; [ perl XMLParser ]);
 
diff --git a/pkgs/applications/audio/industrializer/default.nix b/pkgs/applications/audio/industrializer/default.nix
index 91f7175e391a..f894c856c751 100644
--- a/pkgs/applications/audio/industrializer/default.nix
+++ b/pkgs/applications/audio/industrializer/default.nix
@@ -20,13 +20,11 @@ stdenv.mkDerivation rec {
     sha256 = "0vls94hqpkk8h17da6fddgqbl5dgm6250av3raimhhzwvm5r1gfi";
   };
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config autoconf automake ];
 
   buildInputs = [
     alsa-lib
     audiofile
-    autoconf
-    automake
     gnome2.gtkglext
     gtk2
     libjack2
diff --git a/pkgs/applications/audio/pd-plugins/zexy/default.nix b/pkgs/applications/audio/pd-plugins/zexy/default.nix
index 67c7cd18be8e..13944c8a01b2 100644
--- a/pkgs/applications/audio/pd-plugins/zexy/default.nix
+++ b/pkgs/applications/audio/pd-plugins/zexy/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1xpgl82c2lc6zfswjsa7z10yhv5jb7a4znzh3nc7ffrzm1z8vylp";
   };
 
-  buildInputs = [ autoconf automake puredata ];
+  nativeBuildInputs = [ autoconf automake  ];
+  buildInputs = [ puredata ];
 
   preBuild = ''
     export LD=$CXX
diff --git a/pkgs/applications/audio/sonic-pi/default.nix b/pkgs/applications/audio/sonic-pi/default.nix
index e9d8f979e4ad..b41bea58453c 100644
--- a/pkgs/applications/audio/sonic-pi/default.nix
+++ b/pkgs/applications/audio/sonic-pi/default.nix
@@ -54,9 +54,9 @@ in
 mkDerivation rec {
   inherit pname version src;
 
+  nativeBuildInputs = [ cmake ];
   buildInputs = [
     bash
-    cmake
     pkg-config
     qtbase
     qwt
diff --git a/pkgs/applications/audio/spotify/default.nix b/pkgs/applications/audio/spotify/default.nix
index aa04eba7fe8a..d2fe381ac6ae 100644
--- a/pkgs/applications/audio/spotify/default.nix
+++ b/pkgs/applications/audio/spotify/default.nix
@@ -126,8 +126,8 @@ stdenv.mkDerivation {
       # Work around Spotify referring to a specific minor version of
       # OpenSSL.
 
-      ln -s ${openssl.out}/lib/libssl.so $libdir/libssl.so.1.0.0
-      ln -s ${openssl.out}/lib/libcrypto.so $libdir/libcrypto.so.1.0.0
+      ln -s ${lib.getLib openssl}/lib/libssl.so $libdir/libssl.so.1.0.0
+      ln -s ${lib.getLib openssl}/lib/libcrypto.so $libdir/libcrypto.so.1.0.0
       ln -s ${nspr.out}/lib/libnspr4.so $libdir/libnspr4.so
       ln -s ${nspr.out}/lib/libplc4.so $libdir/libplc4.so
 
diff --git a/pkgs/applications/audio/strawberry/default.nix b/pkgs/applications/audio/strawberry/default.nix
index fb440c6dc514..ee77144104c2 100644
--- a/pkgs/applications/audio/strawberry/default.nix
+++ b/pkgs/applications/audio/strawberry/default.nix
@@ -19,6 +19,7 @@
 , protobuf
 , sqlite
 , taglib
+, libgpod
 , libpulseaudio
 , libselinux
 , libsepol
@@ -63,6 +64,7 @@ mkDerivation rec {
     qtbase
     qtx11extras
   ] ++ lib.optionals stdenv.isLinux [
+    libgpod
     libpulseaudio
     libselinux
     libsepol
diff --git a/pkgs/applications/audio/timemachine/default.nix b/pkgs/applications/audio/timemachine/default.nix
index 623714e706fb..042e6b430756 100644
--- a/pkgs/applications/audio/timemachine/default.nix
+++ b/pkgs/applications/audio/timemachine/default.nix
@@ -12,8 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "16fgyw6jnscx9279dczv72092dddghwlp53rkfw469kcgvjhwx0z";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-    buildInputs = [ autoconf automake gtk2 libjack2
+  nativeBuildInputs = [ pkg-config autoconf automake ];
+    buildInputs = [ gtk2 libjack2
       libsndfile
     ];
 
diff --git a/pkgs/applications/audio/xsynth-dssi/default.nix b/pkgs/applications/audio/xsynth-dssi/default.nix
index 0802a79df04a..61d49d110a9e 100644
--- a/pkgs/applications/audio/xsynth-dssi/default.nix
+++ b/pkgs/applications/audio/xsynth-dssi/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation  rec {
     sha256 = "00nwv2pqjbmxqdc6xdm0cljq6z05lv4y6bibmhz1kih9lm0lklnk";
   };
 
-  buildInputs = [ alsa-lib autoconf automake dssi gtk2 libjack2 ladspaH
+  nativeBuildInputs = [ autoconf automake  ];
+  buildInputs = [ alsa-lib dssi gtk2 libjack2 ladspaH
     ladspaPlugins liblo pkg-config ];
 
   installPhase = ''
diff --git a/pkgs/applications/blockchains/cgminer/default.nix b/pkgs/applications/blockchains/cgminer/default.nix
index 250379ee7109..a77924bb1f05 100644
--- a/pkgs/applications/blockchains/cgminer/default.nix
+++ b/pkgs/applications/blockchains/cgminer/default.nix
@@ -23,8 +23,8 @@ stdenv.mkDerivation rec {
     sha256 = "0l1ms3nxnjzh4mpiadikvngcr9k3jnjqy3yna207za0va0c28dj5";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ autoconf automake libtool curl ncurses ocl-icd opencl-headers
+  nativeBuildInputs = [ pkg-config autoconf automake ];
+  buildInputs = [ libtool curl ncurses ocl-icd opencl-headers
     xorg.libX11 xorg.libXext xorg.libXinerama jansson libusb1 ];
 
   configureScript = "./autogen.sh";
diff --git a/pkgs/applications/blockchains/go-ethereum/default.nix b/pkgs/applications/blockchains/go-ethereum/default.nix
index 842ebcc69ec8..661a25c8314b 100644
--- a/pkgs/applications/blockchains/go-ethereum/default.nix
+++ b/pkgs/applications/blockchains/go-ethereum/default.nix
@@ -9,16 +9,16 @@ let
 
 in buildGoModule rec {
   pname = "go-ethereum";
-  version = "1.10.16";
+  version = "1.10.17";
 
   src = fetchFromGitHub {
     owner = "ethereum";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-l+hxAUw55d9MYLIUdF6qSEIelJQYRCvHyw1yuossmyA=";
+    sha256 = "sha256-GBlrg4wOiqEQTZC3CtfAZbIvS16/pSjEedEDrPGNUtY=";
   };
 
-  vendorSha256 = "sha256-keeox2d2WEzY9ynEcovPaU95YzVQlbTu1i7PLpjkjZU=";
+  vendorSha256 = "sha256-D4odWuGFipSvbKbNlA6PkTo3rWGTCptJcn/7V7ZA7qs=";
 
   doCheck = false;
 
diff --git a/pkgs/applications/blockchains/snarkos/default.nix b/pkgs/applications/blockchains/snarkos/default.nix
index c52780c9564e..82c3555f64d6 100644
--- a/pkgs/applications/blockchains/snarkos/default.nix
+++ b/pkgs/applications/blockchains/snarkos/default.nix
@@ -27,7 +27,7 @@ rustPlatform.buildRustPackage rec {
 
   # Needed to get openssl-sys to use pkg-config.
   OPENSSL_NO_VENDOR = 1;
-  OPENSSL_LIB_DIR = "${openssl.out}/lib";
+  OPENSSL_LIB_DIR = "${lib.getLib openssl}/lib";
   OPENSSL_DIR="${lib.getDev openssl}";
 
   LIBCLANG_PATH="${llvmPackages.libclang.lib}/lib";
diff --git a/pkgs/applications/blockchains/solana/default.nix b/pkgs/applications/blockchains/solana/default.nix
index bfa9382b245a..0eb48b19c88f 100644
--- a/pkgs/applications/blockchains/solana/default.nix
+++ b/pkgs/applications/blockchains/solana/default.nix
@@ -37,7 +37,7 @@ rustPlatform.buildRustPackage rec {
   # checkInputs = lib.optionals stdenv.isDarwin [ pkg-config rustfmt ];
   # Needed to get openssl-sys to use pkg-config.
   # OPENSSL_NO_VENDOR = 1;
-  # OPENSSL_LIB_DIR = "${openssl.out}/lib";
+  # OPENSSL_LIB_DIR = "${lib.getLib openssl}/lib";
   # OPENSSL_DIR="${lib.getDev openssl}";
   # LLVM_CONFIG_PATH="${llvm}/bin/llvm-config";
   # LIBCLANG_PATH="${llvmPackages.libclang.lib}/lib";
diff --git a/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix b/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
index 18c8549b9cca..7c481c6d977e 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
@@ -547,6 +547,13 @@ let
               '';
           });
         });
+
+        mozc = super.mozc.overrideAttrs (attrs: {
+          postPatch = attrs.postPatch or "" + ''
+            substituteInPlace src/unix/emacs/mozc.el \
+              --replace '"mozc_emacs_helper"' '"${pkgs.ibus-engines.mozc}/lib/mozc/mozc_emacs_helper"'
+          '';
+        });
       };
 
     in lib.mapAttrs (n: v: if lib.hasAttr n overrides then overrides.${n} else v) super);
diff --git a/pkgs/applications/editors/jetbrains/default.nix b/pkgs/applications/editors/jetbrains/default.nix
index f0ee51dde3c6..86eb399dd44a 100644
--- a/pkgs/applications/editors/jetbrains/default.nix
+++ b/pkgs/applications/editors/jetbrains/default.nix
@@ -49,7 +49,7 @@ let
       dontAutoPatchelf = true;
       postFixup = (attrs.postFixup or "") + optionalString (stdenv.isLinux) ''
         (
-          cd $out/clion-${version}
+          cd $out/clion
           # bundled cmake does not find libc
           rm -rf bin/cmake/linux
           ln -s ${cmake} bin/cmake/linux
diff --git a/pkgs/applications/editors/jucipp/default.nix b/pkgs/applications/editors/jucipp/default.nix
index 7a57e2171095..b06c93c10340 100644
--- a/pkgs/applications/editors/jucipp/default.nix
+++ b/pkgs/applications/editors/jucipp/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     sha256 = "0xp6ijnrggskjrvscp204bmdpz48l5a8nxr9abp17wni6akb5wiq";
   };
 
-  nativeBuildInputs = [ pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config wrapGAppsHook cmake ];
   buildInputs = [
     dbus
     openssl
@@ -38,7 +38,6 @@ stdenv.mkDerivation rec {
     libepoxy
     boost
     libXdmcp
-    cmake
     aspell
     libgit2
     libxkbcommon
diff --git a/pkgs/applications/editors/kodestudio/default.nix b/pkgs/applications/editors/kodestudio/default.nix
index e975678591c7..2620a87ce425 100644
--- a/pkgs/applications/editors/kodestudio/default.nix
+++ b/pkgs/applications/editors/kodestudio/default.nix
@@ -57,7 +57,7 @@ in
           $out/kodestudio
       patchelf \
           --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-          --set-rpath ".:${stdenv.cc.libc}/lib:${xorg.libXinerama}/lib:${xorg.libX11}/lib:${alsa-lib}/lib:${libGL}/lib:${libGLU}/lib:${openssl.out}/lib" \
+          --set-rpath ".:${stdenv.cc.libc}/lib:${xorg.libXinerama}/lib:${xorg.libX11}/lib:${alsa-lib}/lib:${libGL}/lib:${libGLU}/lib:${lib.getLib openssl}/lib" \
           $out/resources/app/extensions/krom/Krom/linux/Krom
       patchelf \
           --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
diff --git a/pkgs/applications/editors/neovim/default.nix b/pkgs/applications/editors/neovim/default.nix
index 03cc0b35b8d3..e06096933c97 100644
--- a/pkgs/applications/editors/neovim/default.nix
+++ b/pkgs/applications/editors/neovim/default.nix
@@ -5,7 +5,8 @@
 , tree-sitter
 , glibcLocales ? null, procps ? null
 
-# now defaults to false because some tests can be flaky (clipboard etc)
+# now defaults to false because some tests can be flaky (clipboard etc), see
+# also: https://github.com/neovim/neovim/issues/16233
 , doCheck ? false
 , nodejs ? null, fish ? null, python3 ? null
 }:
@@ -21,14 +22,6 @@ let
     ));
 
   pyEnv = python3.withPackages(ps: with ps; [ pynvim msgpack ]);
-
-  # FIXME: this is verry messy and strange.
-  # see https://github.com/NixOS/nixpkgs/pull/80528
-  luv = lua.pkgs.luv;
-  luvpath = with builtins ; if stdenv.isDarwin
-    then "${luv.libluv}/lib/lua/${lua.luaversion}/libluv.${head (match "([0-9.]+).*" luv.version)}.dylib"
-    else "${luv}/lib/lua/${lua.luaversion}/luv.so";
-
 in
   stdenv.mkDerivation rec {
     pname = "neovim-unwrapped";
@@ -57,7 +50,11 @@ in
       libtermkey
       libuv
       libvterm-neovim
-      luv.libluv
+      # This is actually a c library, hence it's not included in neovimLuaEnv,
+      # see:
+      # https://github.com/luarocks/luarocks/issues/1402#issuecomment-1080616570
+      # and it's definition at: pkgs/development/lua-modules/overrides.nix
+      lua.pkgs.libluv
       msgpack
       ncurses
       neovimLuaEnv
@@ -97,12 +94,12 @@ in
     disallowedReferences = [ stdenv.cc ];
 
     cmakeFlags = [
-      "-DGPERF_PRG=${gperf}/bin/gperf"
-      "-DLUA_PRG=${neovimLuaEnv.interpreter}"
-      "-DLIBLUV_LIBRARY=${luvpath}"
+      # Don't use downloaded dependencies. At the end of the configurePhase one
+      # can spot that cmake says this option was "not used by the project".
+      # That's because all dependencies were found and
+      # third-party/CMakeLists.txt is not read at all.
       "-DUSE_BUNDLED=OFF"
     ]
-    ++ optional doCheck "-DBUSTED_PRG=${neovimLuaEnv}/bin/busted"
     ++ optional (!lua.pkgs.isLuaJIT) "-DPREFER_LUA=ON"
     ;
 
@@ -113,12 +110,6 @@ in
       substituteInPlace src/nvim/CMakeLists.txt --replace "    util" ""
     '';
 
-    # For treesitter plugins, libstdc++.so.6, or equivalent will be needed
-    NIX_LDFLAGS =
-      lib.optionals stdenv.cc.isGNU [ "-lstdc++"]
-      ++ lib.optionals stdenv.cc.isClang [ "-lc++" ];
-
-    # export PATH=$PWD/build/bin:${PATH}
     shellHook=''
       export VIMRUNTIME=$PWD/runtime
     '';
diff --git a/pkgs/applications/editors/pinegrow/default.nix b/pkgs/applications/editors/pinegrow/default.nix
index 1f069024eb9e..dfcf8e4f787c 100644
--- a/pkgs/applications/editors/pinegrow/default.nix
+++ b/pkgs/applications/editors/pinegrow/default.nix
@@ -8,6 +8,7 @@
 , autoPatchelfHook
 , gsettings-desktop-schemas
 , gtk3
+, wrapGAppsHook
 , makeWrapper
 }:
 
@@ -24,6 +25,7 @@ stdenv.mkDerivation rec {
     unzip
     autoPatchelfHook
     makeWrapper
+    wrapGAppsHook
   ];
 
   buildInputs = [
@@ -34,7 +36,8 @@ stdenv.mkDerivation rec {
     gtk3
   ];
 
-  wrapProgramFlags = [
+  dontWrapGApps = true;
+  makeWrapperArgs = [
     "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ gcc-unwrapped.lib gtk3 udev ]}"
     "--prefix PATH : ${lib.makeBinPath [ stdenv.cc ]}"
   ];
@@ -51,7 +54,7 @@ stdenv.mkDerivation rec {
     # we can't unzip it in $out/lib, because nw.js will start with
     # an empty screen. Therefore it will be unzipped in a non-typical
     # folder and symlinked.
-    unzip $src -d $out/opt/pinegrow
+    unzip -q $src -d $out/opt/pinegrow
     substituteInPlace $out/opt/pinegrow/Pinegrow.desktop \
       --replace 'Exec=sh -c "$(dirname %k)/PinegrowLibrary"' 'Exec=sh -c "$out/bin/Pinegrow"'
     mv $out/opt/pinegrow/Pinegrow.desktop $out/share/applications/Pinegrow.desktop
@@ -60,9 +63,11 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
+  # GSETTINGS_SCHEMAS_PATH is not set in installPhase
   preFixup = ''
-    export XDG_DATA_DIRS=${gsettings-desktop-schemas}/share/gsettings-schemas/${gsettings-desktop-schemas.name}:${gtk3}/share/gsettings-schemas/${gtk3.name}:$XDG_DATA_DIRS
-    wrapProgram "$out/opt/pinegrow/PinegrowLibrary" ''${wrapProgramFlags[@]}
+    wrapProgram $out/bin/Pinegrow \
+      ''${makeWrapperArgs[@]} \
+      ''${gappsWrapperArgs[@]}
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/editors/poke/default.nix b/pkgs/applications/editors/poke/default.nix
index e05008613910..c2ade207d609 100644
--- a/pkgs/applications/editors/poke/default.nix
+++ b/pkgs/applications/editors/poke/default.nix
@@ -22,11 +22,11 @@ let
   isCross = stdenv.hostPlatform != stdenv.buildPlatform;
 in stdenv.mkDerivation rec {
   pname = "poke";
-  version = "2.1";
+  version = "2.2";
 
   src = fetchurl {
     url = "mirror://gnu/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-zVKObBu8VAw7YpwrTza3hLMKAmsAWji5koNCJZlEJnA=";
+    sha256 = "sha256-xF6k5xpRohhTZzhcAc65dZbsW3EDOGm+xKYLHLciWQM=";
   };
 
   outputs = [ "out" "dev" "info" "lib" "man" ];
diff --git a/pkgs/applications/editors/sublime/3/common.nix b/pkgs/applications/editors/sublime/3/common.nix
index b4bfc6c9ea73..a5cf2d560c01 100644
--- a/pkgs/applications/editors/sublime/3/common.nix
+++ b/pkgs/applications/editors/sublime/3/common.nix
@@ -101,7 +101,7 @@ in let
         "''${gappsWrapperArgs[@]}"
 
       # Without this, plugin_host crashes, even though it has the rpath
-      wrapProgram $out/plugin_host --prefix LD_PRELOAD : ${stdenv.cc.cc.lib}/lib${lib.optionalString stdenv.is64bit "64"}/libgcc_s.so.1:${openssl.out}/lib/libssl.so:${bzip2.out}/lib/libbz2.so
+      wrapProgram $out/plugin_host --prefix LD_PRELOAD : ${stdenv.cc.cc.lib}/lib${lib.optionalString stdenv.is64bit "64"}/libgcc_s.so.1:${lib.getLib openssl}/lib/libssl.so:${bzip2.out}/lib/libbz2.so
     '';
   };
 in stdenv.mkDerivation (rec {
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index f3e1a5f12c33..8b55c1706939 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -173,10 +173,9 @@ self: super: {
   });
 
   cpsm = super.cpsm.overrideAttrs (old: {
+    nativeBuildInputs = [ cmake ];
     buildInputs = [
       python3
-      stdenv
-      cmake
       boost
       icu
       ncurses
diff --git a/pkgs/applications/editors/vscode/extensions/ms-dotnettools-csharp/default.nix b/pkgs/applications/editors/vscode/extensions/ms-dotnettools-csharp/default.nix
index d91cbccb8083..b1a3917417d9 100644
--- a/pkgs/applications/editors/vscode/extensions/ms-dotnettools-csharp/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-dotnettools-csharp/default.nix
@@ -107,7 +107,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
       patchelf_add_icu_as_needed "$elf"
       patchelf --add-needed "libssl.so" "$elf"
       patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-        --set-rpath "${lib.makeLibraryPath [ stdenv.cc.cc openssl.out icu.out ]}:\$ORIGIN" \
+        --set-rpath "${lib.makeLibraryPath [ stdenv.cc.cc openssl icu.out ]}:\$ORIGIN" \
         "$elf"
     }
 
diff --git a/pkgs/applications/editors/vscode/vscode.nix b/pkgs/applications/editors/vscode/vscode.nix
index 370647de1fcf..a9ab7e8e55de 100644
--- a/pkgs/applications/editors/vscode/vscode.nix
+++ b/pkgs/applications/editors/vscode/vscode.nix
@@ -14,17 +14,17 @@ let
   archive_fmt = if stdenv.isDarwin then "zip" else "tar.gz";
 
   sha256 = {
-    x86_64-linux = "0x8vc6gj83mn767wi285k0hxhlh5gh1lcvq63na89vglja4ipna4";
-    x86_64-darwin = "1x47xfq0fgd10wq6aa8gq55aqrl1ir1f6v1mm6324yny16pf20k2";
-    aarch64-linux = "1ibg2qvpnwfwwzgby2xva9xz138b13x9q8vf1xf6plazv0arla1l";
-    aarch64-darwin = "100834mqix7b46frlqf0jz4qs673lavxm8sizfjm7c9y0xxy4ld3";
-    armv7l-linux = "100yfkzvnjccp1g3p353jr2vicvkjc0skiwmmzgad6i8j1m9js62";
+    x86_64-linux = "077a847p8l2yk3dpn8qqwjdch5nqm8a7fxlnwg5xzx892lr6l4ax";
+    x86_64-darwin = "03gbrnkzks4if3mkpwn4yjajj3z9cax0jskhw8pz5n1mibv4kg4p";
+    aarch64-linux = "0xqpc69m5jmm6dyvhlc20bpbr2czmi0pn00jxpf5md8fqxmbvj90";
+    aarch64-darwin = "1zd2s841xpq5fk6bkrbqbzbcyladpp8sp7wx2spkzj1gmbjfzw4a";
+    armv7l-linux = "1swbg3zklixyk3cf0nh0xcwszm9rrvw1caqzmb80lc3c7qx9qx1s";
   }.${system};
 in
   callPackage ./generic.nix rec {
     # Please backport all compatible updates to the stable release.
     # This is important for the extension ecosystem.
-    version = "1.65.2";
+    version = "1.66.0";
     pname = "vscode";
 
     executableName = "code" + lib.optionalString isInsiders "-insiders";
diff --git a/pkgs/applications/editors/vscode/vscodium.nix b/pkgs/applications/editors/vscode/vscodium.nix
index a91227d9db40..0101b896e8cf 100644
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@@ -13,10 +13,10 @@ let
   archive_fmt = if system == "x86_64-darwin" then "zip" else "tar.gz";
 
   sha256 = {
-    x86_64-linux = "1sh2f7hwhilwmlgy11kl0s2n3phpcir15wyl2fkyhsr2kdj4jz9r";
-    x86_64-darwin = "1s04d91f08982wi8hb4dw0j57d6zqrdgns16ihrgsvahrzksgq4b";
-    aarch64-linux = "1a97lk1qz2lz0lk5lpja32zy07iwdbskp6baf429iz7fz232rshm";
-    armv7l-linux = "0vjqxqcr7fq3ncx1nl6ny7qcqm4vlsn33c074hhcg5292blg2a0p";
+    x86_64-linux = "0dv28i8mxf45n7xj4gzgh4gsx76875nxs4yfqswxij8kzz72vqfn";
+    x86_64-darwin = "0xs4f1ffqcbvzw1v64f9l8i7rflz7h1j5xgjxdz6l0hw0j4aalb2";
+    aarch64-linux = "1fa7g531apigp8k7fxkp2ijmhz5axx7ixzdhlwgbsb80rb2mqhi0";
+    armv7l-linux = "1ry9qm6rk46s0jn7hl30jbjdhi3fshzcs0x9krd9qin7by18hhz3";
   }.${system};
 
   sourceRoot = {
@@ -31,7 +31,7 @@ in
 
     # Please backport all compatible updates to the stable release.
     # This is important for the extension ecosystem.
-    version = "1.65.2";
+    version = "1.66.0";
     pname = "vscodium";
 
     executableName = "codium";
diff --git a/pkgs/applications/editors/wxhexeditor/default.nix b/pkgs/applications/editors/wxhexeditor/default.nix
index c769ab426312..f310fb85a26c 100644
--- a/pkgs/applications/editors/wxhexeditor/default.nix
+++ b/pkgs/applications/editors/wxhexeditor/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "08xnhaif8syv1fa0k6lc3jm7yg2k50b02lyds8w0jyzh4xi5crqj";
   };
 
-  buildInputs = [ wxGTK autoconf automake libtool python2 gettext ];
+  nativeBuildInputs = [ autoconf automake ];
+  buildInputs = [ wxGTK libtool python2 gettext ];
 
   preConfigure = "patchShebangs .";
 
diff --git a/pkgs/applications/emulators/rpcs3/default.nix b/pkgs/applications/emulators/rpcs3/default.nix
index 74c5b8ee6b35..ee85b71cf8a4 100644
--- a/pkgs/applications/emulators/rpcs3/default.nix
+++ b/pkgs/applications/emulators/rpcs3/default.nix
@@ -9,10 +9,10 @@
 
 let
   # Keep these separate so the update script can regex them
-  rpcs3GitVersion = "13352-e58906cb4";
-  rpcs3Version = "0.0.21-13352-e58906cb4";
-  rpcs3Revision = "e58906cb4df26c14fcade07d7c15ab432dae6882";
-  rpcs3Sha256 = "1bzx6af77z5l6jdgazw8x59pi2xhwkz0knynmf5kzww39m6npx0a";
+  rpcs3GitVersion = "13388-4a86638ce";
+  rpcs3Version = "0.0.21-13388-4a86638ce";
+  rpcs3Revision = "4a86638ce898e3bd68ade8e7ba794253782ea411";
+  rpcs3Sha256 = "0bc1n0jy4a869mn1g5i008vb5m2a6qfhyf7lw0d0jiljgsppiys1";
 
   ittapi = fetchFromGitHub {
     owner = "intel";
diff --git a/pkgs/applications/graphics/ImageMagick/6.x.nix b/pkgs/applications/graphics/ImageMagick/6.x.nix
index 4c06eb7962bc..032af6cf6144 100644
--- a/pkgs/applications/graphics/ImageMagick/6.x.nix
+++ b/pkgs/applications/graphics/ImageMagick/6.x.nix
@@ -83,7 +83,7 @@ stdenv.mkDerivation rec {
     changelog = "https://legacy.imagemagick.org/script/changelog.php";
     description = "A software suite to create, edit, compose, or convert bitmap images";
     platforms = platforms.linux ++ platforms.darwin;
-    maintainers = with maintainers; [ erictapen ];
+    maintainers = with maintainers; [ ];
     license = licenses.asl20;
   };
 }
diff --git a/pkgs/applications/graphics/drawing/default.nix b/pkgs/applications/graphics/drawing/default.nix
index a08f75d3b71d..40c651ac2570 100644
--- a/pkgs/applications/graphics/drawing/default.nix
+++ b/pkgs/applications/graphics/drawing/default.nix
@@ -13,11 +13,12 @@
 , gdk-pixbuf
 , pango
 , gettext
+, itstool
 }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "drawing";
-  version = "0.8.5";
+  version = "1.0.0";
 
   format = "other";
 
@@ -25,7 +26,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "maoschanz";
     repo = pname;
     rev = version;
-    sha256 = "1q4a1gwmzz0rm10cnd4nzd51zfc2bjc6dsvf90qk1di9x7svis64";
+    sha256 = "sha256-qNaljtuA5E/QaLJ9QILPRQCqOvKmX4ZGq/0z5unA8KA=";
   };
 
   nativeBuildInputs = [
@@ -38,6 +39,7 @@ python3.pkgs.buildPythonApplication rec {
     wrapGAppsHook
     glib
     gettext
+    itstool
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/graphics/exrtools/default.nix b/pkgs/applications/graphics/exrtools/default.nix
index 1985176765f0..b29d1d586900 100644
--- a/pkgs/applications/graphics/exrtools/default.nix
+++ b/pkgs/applications/graphics/exrtools/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ stdenv openexr libpng12 libjpeg ];
+  buildInputs = [ openexr libpng12 libjpeg ];
 
   meta = with lib; {
     description = "Collection of utilities for manipulating OpenEXR images";
diff --git a/pkgs/applications/graphics/icon-library/default.nix b/pkgs/applications/graphics/icon-library/default.nix
index 4dd97d92217d..4f16a0d6e2d8 100644
--- a/pkgs/applications/graphics/icon-library/default.nix
+++ b/pkgs/applications/graphics/icon-library/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, wrapGAppsHook
+{ lib, stdenv, fetchurl, fetchpatch, wrapGAppsHook4
 , cargo, desktop-file-utils, meson, ninja, pkg-config, rustc
 , gdk-pixbuf, glib, gtk4, gtksourceview5, libadwaita
 }:
@@ -12,8 +12,18 @@ stdenv.mkDerivation rec {
     sha256 = "1zrcnc5dn5fgcl3vklfpbp3m0qzi2n2viw59vw5fhwkysvp670y7";
   };
 
+  patches = [
+    # Fix build with meson 0.61
+    # data/meson.build:85:0: ERROR: gnome.compile_resources takes exactly 2 arguments, but got 3.
+    # https://gitlab.gnome.org/World/design/icon-library/-/merge_requests/54
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/World/design/icon-library/-/commit/c629dbf6670f9bb0b98ff21c17110489b58f5c85.patch";
+      sha256 = "UKC1CPaM58/z0zINN794luWZdoFx1zGxETPb8VtbO3E=";
+    })
+  ];
+
   nativeBuildInputs = [
-    cargo desktop-file-utils meson ninja pkg-config rustc wrapGAppsHook
+    cargo desktop-file-utils meson ninja pkg-config rustc wrapGAppsHook4
   ];
   buildInputs = [ gdk-pixbuf glib gtk4 gtksourceview5 libadwaita ];
 
diff --git a/pkgs/applications/graphics/sane/config.nix b/pkgs/applications/graphics/sane/config.nix
index 397e17837bcc..8c7b94faca6c 100644
--- a/pkgs/applications/graphics/sane/config.nix
+++ b/pkgs/applications/graphics/sane/config.nix
@@ -35,7 +35,7 @@ installSanePath = path: ''
 in
 stdenv.mkDerivation {
   name = "sane-config";
-  phases = "installPhase";
+  dontUnpack = true;
 
   installPhase = ''
     function symlink () {
diff --git a/pkgs/applications/misc/1password/default.nix b/pkgs/applications/misc/1password/default.nix
index 25685b2e125e..9d7a4fcd94ca 100644
--- a/pkgs/applications/misc/1password/default.nix
+++ b/pkgs/applications/misc/1password/default.nix
@@ -42,12 +42,17 @@ stdenv.mkDerivation {
   '';
 
   installPhase = ''
+    runHook preInstall
     install -D ${mainProgram} $out/bin/${mainProgram}
     runHook postInstall
   '';
 
-  postInstall = "installShellCompletion --cmd ${mainProgram}" + lib.concatMapStrings
-    (s: " --${s} <($out/bin/${mainProgram} completion ${s})") [ "bash" "fish" "zsh" ];
+  postInstall = ''
+    installShellCompletion --cmd ${mainProgram} \
+      --bash <($out/bin/${mainProgram} completion bash) \
+      --fish <($out/bin/${mainProgram} completion fish) \
+      --zsh <($out/bin/${mainProgram} completion zsh)
+  '';
 
   dontStrip = stdenv.isDarwin;
 
diff --git a/pkgs/applications/misc/HentaiAtHome/default.nix b/pkgs/applications/misc/HentaiAtHome/default.nix
index dc2b7ab804ab..d185096aa797 100644
--- a/pkgs/applications/misc/HentaiAtHome/default.nix
+++ b/pkgs/applications/misc/HentaiAtHome/default.nix
@@ -13,7 +13,7 @@ buildGraalvmNativeImage rec {
   jar = "${src}/HentaiAtHome.jar";
   dontUnpack = true;
 
-  graalvm = graalvm17-ce;
+  graalvmDrv = graalvm17-ce;
   extraNativeImageBuildArgs = [
     "--enable-url-protocols=http,https"
     "--install-exit-handlers"
diff --git a/pkgs/applications/misc/dasel/default.nix b/pkgs/applications/misc/dasel/default.nix
index d8fd18f9de4e..317613ffd533 100644
--- a/pkgs/applications/misc/dasel/default.nix
+++ b/pkgs/applications/misc/dasel/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "dasel";
-  version = "1.24.0";
+  version = "1.24.1";
 
   src = fetchFromGitHub {
     owner = "TomWright";
     repo = "dasel";
     rev = "v${version}";
-    sha256 = "sha256-Em+WAI8G492h7FJTnTHFj5L7M4xBZhW4qC0MMc2JRUU=";
+    sha256 = "sha256-B6MWoGYNjFBUxnSqAXt2DRRjSlmgbqIC7qEoMFGQ+zU=";
   };
 
   vendorSha256 = "sha256-NP+Is7Dxz4LGzx5vpv8pJOJhodAYHia1JXYfhJD54as=";
diff --git a/pkgs/applications/misc/fuzzel/default.nix b/pkgs/applications/misc/fuzzel/default.nix
index 5668006dfd3f..d697e8412adc 100644
--- a/pkgs/applications/misc/fuzzel/default.nix
+++ b/pkgs/applications/misc/fuzzel/default.nix
@@ -60,6 +60,8 @@ stdenv.mkDerivation rec {
     "-Dsvg-backend=${withSVGBackend}"
   ];
 
+  CFLAGS = "-Wno-error=comment"; # https://gitlab.gnome.org/GNOME/librsvg/-/issues/856
+
   meta = with lib; {
     description = "Wayland-native application launcher, similar to rofi’s drun mode";
     homepage = "https://codeberg.org/dnkl/fuzzel";
diff --git a/pkgs/applications/misc/gofu/default.nix b/pkgs/applications/misc/gofu/default.nix
index 13cb7129a00b..ea3cbde3adb7 100644
--- a/pkgs/applications/misc/gofu/default.nix
+++ b/pkgs/applications/misc/gofu/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "gofu";
-  version = "unstable-2021-09-11";
+  version = "unstable-2022-04-01";
 
   src = fetchFromGitHub {
     owner = "majewsky";
     repo = pname;
-    rev = "cb398f58a5cb4f3e858fe60e84debde6ab58f7c8";
-    sha256 = "sha256-R8Pr8SyLeoTaYKKV+PzHDPi1/RY4j7pkUbW8kE4ydBU=";
+    rev = "be0e424eecec3fec19ba3518f8fd1bb07b6908dc";
+    sha256 = "sha256-jMOmvCsuRtL9EgPicdNEksVgFepL/JZA53o2wzr8uzQ=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/applications/misc/gpxsee/default.nix b/pkgs/applications/misc/gpxsee/default.nix
index ac9b56f48c11..b4e8e7151c15 100644
--- a/pkgs/applications/misc/gpxsee/default.nix
+++ b/pkgs/applications/misc/gpxsee/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gpxsee";
-  version = "10.4";
+  version = "10.5";
 
   src = fetchFromGitHub {
     owner = "tumic0";
     repo = "GPXSee";
     rev = version;
-    sha256 = "sha256-3AwUfx8IIWJO4uVAhXJE5Oola+60VUpXUwmALqJo2vw=";
+    sha256 = "sha256-TvOdyzWvGSdl8aSA+pAOpPVpQzK9POmqtClqdXAMsws=";
   };
 
   patches = (substituteAll {
diff --git a/pkgs/applications/misc/gsimplecal/default.nix b/pkgs/applications/misc/gsimplecal/default.nix
index 7068954baac8..c751f4c28026 100644
--- a/pkgs/applications/misc/gsimplecal/default.nix
+++ b/pkgs/applications/misc/gsimplecal/default.nix
@@ -17,8 +17,8 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ automake autoconf gtk3 ];
+  nativeBuildInputs = [ pkg-config automake autoconf ];
+  buildInputs = [ gtk3 ];
 
   preConfigure = "./autogen.sh";
 
diff --git a/pkgs/applications/misc/gtk2fontsel/default.nix b/pkgs/applications/misc/gtk2fontsel/default.nix
index d635fa8d8657..b622d9f19cca 100644
--- a/pkgs/applications/misc/gtk2fontsel/default.nix
+++ b/pkgs/applications/misc/gtk2fontsel/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ stdenv gtk2 ];
+  buildInputs = [ gtk2 ];
 
   preferLocalBuild = true;
 
diff --git a/pkgs/applications/misc/p2pool/default.nix b/pkgs/applications/misc/p2pool/default.nix
index f888d162fc44..cb0b53e887b2 100644
--- a/pkgs/applications/misc/p2pool/default.nix
+++ b/pkgs/applications/misc/p2pool/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "p2pool";
-  version = "1.8";
+  version = "1.9";
 
   src = fetchFromGitHub {
     owner = "SChernykh";
     repo = "p2pool";
     rev = "v${version}";
-    sha256 = "sha256-cQd3dtih7C+pEmkvlrsYTJtQWBVVMiFbtNQUM0Ck3tg=";
+    sha256 = "sha256-nqJ0F99QjrpwXHRPxZ7kLCYA9VJWGH2ahcr/MBQrhyY=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/misc/pcmanx-gtk2/default.nix b/pkgs/applications/misc/pcmanx-gtk2/default.nix
index 484b9d3b4073..dffbd2079aea 100644
--- a/pkgs/applications/misc/pcmanx-gtk2/default.nix
+++ b/pkgs/applications/misc/pcmanx-gtk2/default.nix
@@ -11,8 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "0fbwd149wny67rfhczz4cbh713a1qnswjiz7b6c2bxfcwh51f9rc";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ gtk2 libXft intltool automake autoconf libtool ];
+  nativeBuildInputs = [ pkg-config automake autoconf ];
+  buildInputs = [ gtk2 libXft intltool libtool ];
 
   preConfigure = ''
     ./autogen.sh
diff --git a/pkgs/applications/misc/stag/default.nix b/pkgs/applications/misc/stag/default.nix
index f9c91d28f14a..974ebb78c2f1 100644
--- a/pkgs/applications/misc/stag/default.nix
+++ b/pkgs/applications/misc/stag/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
     sha256 = "1yrzjhcwrxrxq5jj695wvpgb0pz047m88yq5n5ymkcw5qr78fy1v";
   };
 
-  buildInputs = [ stdenv curses ];
+  buildInputs = [ curses ];
 
   installPhase = ''
     make install PREFIX=$out
diff --git a/pkgs/applications/misc/taskwarrior-tui/default.nix b/pkgs/applications/misc/taskwarrior-tui/default.nix
index 7d730421398c..1346cba9acd5 100644
--- a/pkgs/applications/misc/taskwarrior-tui/default.nix
+++ b/pkgs/applications/misc/taskwarrior-tui/default.nix
@@ -5,19 +5,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "taskwarrior-tui";
-  version = "0.21.1";
+  version = "0.22.0";
 
   src = fetchFromGitHub {
     owner = "kdheepak";
     repo = "taskwarrior-tui";
     rev = "v${version}";
-    sha256 = "sha256-fgoK7Y+3h2VFfP8yiR8JM8Xf7UJbkX9PO1RoJRoYLW4=";
+    sha256 = "sha256-121TfmaWrWppsOiuF+8gxy+3J5YzbliYj88nw4aLt9w=";
   };
 
   # Because there's a test that requires terminal access
   doCheck = false;
 
-  cargoSha256 = "sha256-3rDvla1mCcQclALbomUTvE3aLzsMeIjcIbEv4KfCKZE=";
+  cargoSha256 = "sha256-oTb1pSA9g9cExCXKaQjNm+h5WB4bWuqODkU7MvvspGQ=";
 
   meta = with lib; {
     description = "A terminal user interface for taskwarrior ";
diff --git a/pkgs/applications/misc/yubioath-desktop/default.nix b/pkgs/applications/misc/yubioath-desktop/default.nix
index 9cfd7650c49f..3d35e3658e56 100644
--- a/pkgs/applications/misc/yubioath-desktop/default.nix
+++ b/pkgs/applications/misc/yubioath-desktop/default.nix
@@ -15,7 +15,7 @@ mkDerivation rec {
 
   doCheck = false;
 
-  buildInputs = [ stdenv qtbase qtquickcontrols2 qtgraphicaleffects python3 ];
+  buildInputs = [ qtbase qtquickcontrols2 qtgraphicaleffects python3 ];
 
   nativeBuildInputs = [ qmake makeWrapper python3.pkgs.wrapPython ];
 
diff --git a/pkgs/applications/networking/browsers/brave/default.nix b/pkgs/applications/networking/browsers/brave/default.nix
index 65627a490d10..7c0006f745c6 100644
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@@ -91,11 +91,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "brave";
-  version = "1.36.122";
+  version = "1.37.109";
 
   src = fetchurl {
     url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    sha256 = "aBHoEu1egRPMpeUBgRl2V5J3op1Ju+CvprG14dIWc8M=";
+    sha256 = "fL3vuCqUnzq38JD0bzM/DxLVb5P31iChbMVY2eax9RE=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/applications/networking/browsers/chromium/browser.nix b/pkgs/applications/networking/browsers/chromium/browser.nix
index 40a0d7997528..ca52cf94d8c6 100644
--- a/pkgs/applications/networking/browsers/chromium/browser.nix
+++ b/pkgs/applications/networking/browsers/chromium/browser.nix
@@ -87,7 +87,7 @@ mkChromiumDerivation (base: rec {
       then "https://github.com/Eloston/ungoogled-chromium"
       else "https://www.chromium.org/";
     maintainers = with maintainers; if ungoogled
-      then [ squalus primeos ]
+      then [ squalus primeos michaeladler ]
       else [ primeos thefloweringash ];
     license = if enableWideVine then licenses.unfree else licenses.bsd3;
     platforms = platforms.linux;
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.json b/pkgs/applications/networking/browsers/chromium/upstream-info.json
index 78377193eb35..35610f1537a7 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@@ -19,22 +19,22 @@
     }
   },
   "beta": {
-    "version": "100.0.4896.60",
-    "sha256": "1p7zggnhsz9gj3zil0nyas4ym5bd94vs0z6mdg7r1l0s0vrsaphf",
-    "sha256bin64": "059zrf3mm04iyzmgp594m3m7pw4458vym3wpawmdn94h5zi705i7",
+    "version": "101.0.4951.15",
+    "sha256": "1gm70mz6gzildh1g082q4dg5q9namm9kvxfj5qrdcj67gvz5m66y",
+    "sha256bin64": "0z2rx7mw9wg5ly8wmxkflk8f9gifq4cxqvi224v9dr11qqj8gwm2",
     "deps": {
       "gn": {
-        "version": "2022-01-21",
+        "version": "2022-03-14",
         "url": "https://gn.googlesource.com/gn",
-        "rev": "0725d7827575b239594fbc8fd5192873a1d62f44",
-        "sha256": "1dzdvcn2r5c9giknvasf3y5y4901kav7igivjvrpww66ywsj8fzr"
+        "rev": "bd99dbf98cbdefe18a4128189665c5761263bcfb",
+        "sha256": "0nql15ckjqkm001xajq3qyn4h4q80i7x6dm9zinxxr1a8q5lppx3"
       }
     }
   },
   "dev": {
-    "version": "101.0.4951.7",
-    "sha256": "0xnvbiqi50hgky35qaivcyzfp05nnwfwqrd50dksqkzycl8avb4z",
-    "sha256bin64": "19my3zr9d3w2ypl9cm1xa15vhyv9add1f283alb9fmh2qwhl4scg",
+    "version": "101.0.4951.15",
+    "sha256": "1gm70mz6gzildh1g082q4dg5q9namm9kvxfj5qrdcj67gvz5m66y",
+    "sha256bin64": "0m1q85ai9pyam9anh8aiv7hyadam0hjkkhnsa6s05d82k8kz5rvc",
     "deps": {
       "gn": {
         "version": "2022-03-14",
@@ -45,19 +45,19 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "99.0.4844.84",
-    "sha256": "05bma8lsm5lad58mlfiv8bg0fw5k5mxh0v6g1ik7xp2bsd71iv10",
-    "sha256bin64": "0sdnsnp7hnpip91hwbz3hiw2727g0a3ydf55ldqv9bgik3vn1wln",
+    "version": "100.0.4896.60",
+    "sha256": "1p7zggnhsz9gj3zil0nyas4ym5bd94vs0z6mdg7r1l0s0vrsaphf",
+    "sha256bin64": "07wavs9r6ilwx5rzyqvydcjskg6sml5b8m6mw7qzykvhs8bnvfh5",
     "deps": {
       "gn": {
-        "version": "2022-01-10",
+        "version": "2022-01-21",
         "url": "https://gn.googlesource.com/gn",
-        "rev": "80a40b07305373617eba2d5878d353532af77da3",
-        "sha256": "1103lf38h7412949j6nrk48m2vv2rrxacn42sjg33lg88nyv7skv"
+        "rev": "0725d7827575b239594fbc8fd5192873a1d62f44",
+        "sha256": "1dzdvcn2r5c9giknvasf3y5y4901kav7igivjvrpww66ywsj8fzr"
       },
       "ungoogled-patches": {
-        "rev": "99.0.4844.84-1",
-        "sha256": "1j02zcam09mdw7wg30r1mx27b8bw0s9dvk4qjl6vrhp24rbmscs7"
+        "rev": "100.0.4896.60-1",
+        "sha256": "02q7ghxynkgkbilcb8bx8q26s80fvd4hbc58zq74pnzpmn7qi342"
       }
     }
   }
diff --git a/pkgs/applications/networking/browsers/microsoft-edge/browser.nix b/pkgs/applications/networking/browsers/microsoft-edge/browser.nix
new file mode 100644
index 000000000000..ce7aecb1dc57
--- /dev/null
+++ b/pkgs/applications/networking/browsers/microsoft-edge/browser.nix
@@ -0,0 +1,191 @@
+{ channel, version, revision, sha256 }:
+
+{ stdenv
+, fetchurl
+, lib
+
+, binutils-unwrapped
+, xz
+, gnutar
+, file
+
+, glibc
+, glib
+, nss
+, nspr
+, atk
+, at-spi2-atk
+, xorg
+, cups
+, dbus
+, expat
+, libdrm
+, libxkbcommon
+, gtk3
+, pango
+, cairo
+, gdk-pixbuf
+, mesa
+, alsa-lib
+, at-spi2-core
+, libuuid
+, systemd
+}:
+
+let
+
+  baseName = "microsoft-edge";
+
+  shortName = if channel == "stable"
+              then "msedge"
+              else "msedge-" + channel;
+
+  longName = if channel == "stable"
+             then baseName
+             else baseName + "-" + channel;
+
+  iconSuffix = if channel == "stable"
+               then ""
+               else "_${channel}";
+
+  desktopSuffix = if channel == "stable"
+                  then ""
+                  else "-${channel}";
+in
+
+stdenv.mkDerivation rec {
+  name="${baseName}-${channel}-${version}";
+
+  src = fetchurl {
+    url = "https://packages.microsoft.com/repos/edge/pool/main/m/${baseName}-${channel}/${baseName}-${channel}_${version}-${revision}_amd64.deb";
+    inherit sha256;
+  };
+
+  unpackCmd = "${binutils-unwrapped}/bin/ar p $src data.tar.xz | ${xz}/bin/xz -dc | ${gnutar}/bin/tar -xf -";
+  sourceRoot = ".";
+
+  dontPatch = true;
+  dontConfigure = true;
+  dontPatchELF = true;
+
+  buildPhase = let
+    libPath = {
+      msedge = lib.makeLibraryPath [
+        glibc glib nss nspr atk at-spi2-atk xorg.libX11
+        xorg.libxcb cups.lib dbus.lib expat libdrm
+        xorg.libXcomposite xorg.libXdamage xorg.libXext
+        xorg.libXfixes xorg.libXrandr libxkbcommon
+        gtk3 pango cairo gdk-pixbuf mesa
+        alsa-lib at-spi2-core xorg.libxshmfence systemd
+      ];
+      naclHelper = lib.makeLibraryPath [
+        glib nspr atk libdrm xorg.libxcb mesa xorg.libX11
+        xorg.libXext dbus.lib libxkbcommon
+      ];
+      libwidevinecdm = lib.makeLibraryPath [
+        glib nss nspr
+      ];
+      libGLESv2 = lib.makeLibraryPath [
+        xorg.libX11 xorg.libXext xorg.libxcb
+      ];
+      libsmartscreen = lib.makeLibraryPath [
+        libuuid stdenv.cc.cc.lib
+      ];
+      libsmartscreenn = lib.makeLibraryPath [
+        libuuid
+      ];
+      liboneauth = lib.makeLibraryPath [
+        libuuid xorg.libX11
+      ];
+    };
+  in ''
+    patchelf \
+      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      --set-rpath "${libPath.msedge}" \
+      opt/microsoft/${shortName}/msedge
+
+    patchelf \
+      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      opt/microsoft/${shortName}/msedge-sandbox
+
+    patchelf \
+      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      opt/microsoft/${shortName}/msedge_crashpad_handler
+
+    patchelf \
+      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      --set-rpath "${libPath.naclHelper}" \
+      opt/microsoft/${shortName}/nacl_helper
+
+    patchelf \
+      --set-rpath "${libPath.libwidevinecdm}" \
+      opt/microsoft/${shortName}/WidevineCdm/_platform_specific/linux_x64/libwidevinecdm.so
+
+    patchelf \
+      --set-rpath "${libPath.libGLESv2}" \
+      opt/microsoft/${shortName}/libGLESv2.so
+
+    patchelf \
+      --set-rpath "${libPath.libsmartscreen}" \
+      opt/microsoft/${shortName}/libsmartscreen.so
+
+    patchelf \
+      --set-rpath "${libPath.libsmartscreenn}" \
+      opt/microsoft/${shortName}/libsmartscreenn.so
+
+    patchelf \
+      --set-rpath "${libPath.liboneauth}" \
+      opt/microsoft/${shortName}/liboneauth.so
+  '';
+
+  installPhase = ''
+    mkdir -p $out
+    cp -R opt usr/bin usr/share $out
+
+    ${if channel == "stable"
+      then ""
+      else "ln -sf $out/opt/microsoft/${shortName}/${baseName}-${channel} $out/opt/microsoft/${shortName}/${baseName}"}
+
+    ln -sf $out/opt/microsoft/${shortName}/${longName} $out/bin/${longName}
+
+    rm -rf $out/share/doc
+    rm -rf $out/opt/microsoft/${shortName}/cron
+
+    for icon in '16' '24' '32' '48' '64' '128' '256'
+    do
+      ${ "icon_source=$out/opt/microsoft/${shortName}/product_logo_\${icon}${iconSuffix}.png" }
+      ${ "icon_target=$out/share/icons/hicolor/\${icon}x\${icon}/apps" }
+      mkdir -p $icon_target
+      cp $icon_source $icon_target/microsoft-edge${desktopSuffix}.png
+    done
+
+    substituteInPlace $out/share/applications/${longName}.desktop \
+      --replace /usr/bin/${baseName}-${channel} $out/bin/${longName}
+
+    substituteInPlace $out/share/gnome-control-center/default-apps/${longName}.xml \
+      --replace /opt/microsoft/${shortName} $out/opt/microsoft/${shortName}
+
+    substituteInPlace $out/share/menu/${longName}.menu \
+      --replace /opt/microsoft/${shortName} $out/opt/microsoft/${shortName}
+
+    substituteInPlace $out/opt/microsoft/${shortName}/xdg-mime \
+      --replace "''${XDG_DATA_DIRS:-/usr/local/share:/usr/share}" "''${XDG_DATA_DIRS:-/run/current-system/sw/share}" \
+      --replace "xdg_system_dirs=/usr/local/share/:/usr/share/" "xdg_system_dirs=/run/current-system/sw/share/" \
+      --replace /usr/bin/file ${file}/bin/file
+
+    substituteInPlace $out/opt/microsoft/${shortName}/default-app-block \
+      --replace /opt/microsoft/${shortName} $out/opt/microsoft/${shortName}
+
+    substituteInPlace $out/opt/microsoft/${shortName}/xdg-settings \
+      --replace "''${XDG_DATA_DIRS:-/usr/local/share:/usr/share}" "''${XDG_DATA_DIRS:-/run/current-system/sw/share}" \
+      --replace "''${XDG_CONFIG_DIRS:-/etc/xdg}" "''${XDG_CONFIG_DIRS:-/run/current-system/sw/etc/xdg}"
+  '';
+
+  meta = with lib; {
+    homepage = "https://www.microsoft.com/en-us/edge";
+    description = "The web browser from Microsoft";
+    license = licenses.unfree;
+    platforms = [ "x86_64-linux" ];
+    maintainers = with maintainers; [ zanculmarktum kuwii ];
+  };
+}
diff --git a/pkgs/applications/networking/browsers/microsoft-edge/default.nix b/pkgs/applications/networking/browsers/microsoft-edge/default.nix
new file mode 100644
index 000000000000..6598ba27a872
--- /dev/null
+++ b/pkgs/applications/networking/browsers/microsoft-edge/default.nix
@@ -0,0 +1,20 @@
+{
+  beta = import ./browser.nix {
+    channel = "beta";
+    version = "99.0.1150.16";
+    revision = "1";
+    sha256 = "sha256:0qsgs889d6qwxz9qf42psmjqfhmrqgp07srq5r38npl5pncr137h";
+  };
+  dev = import ./browser.nix {
+    channel = "dev";
+    version = "100.0.1163.1";
+    revision = "1";
+    sha256 = "sha256:153faqxyw5f5b6cqnvd71dl7941znkzci8dwbcgaxway0b6882jq";
+  };
+  stable = import ./browser.nix {
+    channel = "stable";
+    version = "98.0.1108.56";
+    revision = "1";
+    sha256 = "sha256:03jbj2s2fs60fzfgsmyb284q7nckji87qgb86mvl5g0hbl19aza7";
+  };
+}
diff --git a/pkgs/applications/networking/browsers/microsoft-edge/update.sh b/pkgs/applications/networking/browsers/microsoft-edge/update.sh
new file mode 100755
index 000000000000..c76c31c7f5a7
--- /dev/null
+++ b/pkgs/applications/networking/browsers/microsoft-edge/update.sh
@@ -0,0 +1,50 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -i bash -p curl gzip
+
+# To update: ./update.sh > default.nix
+
+index_file=$(curl -sL https://packages.microsoft.com/repos/edge/dists/stable/main/binary-amd64/Packages.gz | gzip -dc)
+
+echo "{"
+
+packages=()
+echo "$index_file" | while read -r line; do
+    if [[ "$line" =~ ^Package:[[:space:]]*(.*) ]]; then
+        Package="${BASH_REMATCH[1]}"
+    fi
+    if [[ "$line" =~ ^Version:[[:space:]]*(.*)-([a-zA-Z0-9+.~]*) ]]; then
+        Version="${BASH_REMATCH[1]}"
+        Revision="${BASH_REMATCH[2]}"
+    fi
+    if [[ "$line" =~ ^SHA256:[[:space:]]*(.*) ]]; then
+        SHA256="${BASH_REMATCH[1]}"
+    fi
+
+    if ! [[ "$line" ]]; then
+        found=0
+        for i in "${packages[@]}"; do
+            if [[ "$i" == "$Package" ]]; then
+                found=1
+            fi
+        done
+
+        if (( ! $found )); then
+            channel="${Package##*-}"
+            name="${Package%-${channel}}"
+            cat <<EOF
+  ${channel} = import ./browser.nix {
+    channel = "${channel}";
+    version = "${Version}";
+    revision = "${Revision}";
+    sha256 = "sha256:$(nix-hash --type sha256 --to-base32 ${SHA256})";
+  };
+EOF
+        fi
+
+        packages+=($Package)
+        Package=""
+        Version=""
+    fi
+done
+
+echo "}"
diff --git a/pkgs/applications/networking/browsers/palemoon/default.nix b/pkgs/applications/networking/browsers/palemoon/default.nix
index 0a0a7f341c06..cce3f39d3c31 100644
--- a/pkgs/applications/networking/browsers/palemoon/default.nix
+++ b/pkgs/applications/networking/browsers/palemoon/default.nix
@@ -31,6 +31,8 @@
 , zip
 , zlib
 , withGTK3 ? true, gtk3, gtk2
+, testVersion
+, palemoon
 }:
 
 # Only specific GCC versions are supported with branding
@@ -44,12 +46,12 @@ assert with lib.strings; (
 
 stdenv.mkDerivation rec {
   pname = "palemoon";
-  version = "29.4.5";
+  version = "29.4.5.1";
 
   src = fetchzip {
     name = "${pname}-${version}";
     url = "http://archive.palemoon.org/source/${pname}-${version}.source.tar.xz";
-    sha256 = "sha256-ls4uhfFaiFHkmAVbwwBenm71sNm6Tql2tMpzk9D2b5Y=";
+    sha256 = "sha256-IC7E88dECAz2diVLEEdjMltpNMBhPTlPvbz05BniBMI=";
   };
 
   nativeBuildInputs = [
@@ -194,18 +196,23 @@ stdenv.mkDerivation rec {
     platforms = [ "i686-linux" "x86_64-linux" ];
   };
 
-  passthru.updateScript = writeScript "update-${pname}" ''
-    #!/usr/bin/env nix-shell
-    #!nix-shell -i bash -p common-updater-scripts curl libxml2
+  passthru = {
+    updateScript = writeScript "update-${pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts curl libxml2
 
-    set -eu -o pipefail
+      set -eu -o pipefail
 
-    # Only release note announcement == finalized release
-    version="$(
-      curl -s 'http://www.palemoon.org/releasenotes.shtml' |
-      xmllint --html --xpath 'html/body/table/tbody/tr/td/h3/text()' - 2>/dev/null | head -n1 |
-      sed 's/v\(\S*\).*/\1/'
-    )"
-    update-source-version ${pname} "$version"
-  '';
+      # Only release note announcement == finalized release
+      version="$(
+        curl -s 'http://www.palemoon.org/releasenotes.shtml' |
+        xmllint --html --xpath 'html/body/table/tbody/tr/td/h3/text()' - 2>/dev/null | head -n1 |
+        sed 's/v\(\S*\).*/\1/'
+      )"
+      update-source-version ${pname} "$version"
+    '';
+    tests.version = testVersion {
+      package = palemoon;
+    };
+  };
 }
diff --git a/pkgs/applications/networking/cluster/driftctl/default.nix b/pkgs/applications/networking/cluster/driftctl/default.nix
index 28dd421c72c5..fc8d8da18af8 100644
--- a/pkgs/applications/networking/cluster/driftctl/default.nix
+++ b/pkgs/applications/networking/cluster/driftctl/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "driftctl";
-  version = "0.25.0";
+  version = "0.26.0";
 
   src = fetchFromGitHub {
     owner = "snyk";
     repo = "driftctl";
     rev = "v${version}";
-    sha256 = "sha256-opR1NkMGptZilSPVZ7yNjYBBjnOXxrqAFCYzQ1tNS78=";
+    sha256 = "sha256-cwI27hAfnSKT7P2rfM86tRtSKRR9bruRV9w440uGLIU=";
   };
 
   vendorSha256 = "sha256-I0OCRhUvuaF4k5qqPaV6R24mrd9AG5GgQCCF6yodK0E=";
diff --git a/pkgs/applications/networking/cluster/fluxcd/default.nix b/pkgs/applications/networking/cluster/fluxcd/default.nix
index ff686314f0c4..0e9630a23d53 100644
--- a/pkgs/applications/networking/cluster/fluxcd/default.nix
+++ b/pkgs/applications/networking/cluster/fluxcd/default.nix
@@ -1,9 +1,9 @@
 { lib, buildGoModule, fetchFromGitHub, fetchzip, installShellFiles }:
 
 let
-  version = "0.28.4";
-  sha256 = "1b98hna3qhg7gzs5rqpkrxdvas7zjzavzmi9rzn9936rw88lpgx6";
-  manifestsSha256 = "0k8hpkcnxw2w1pvdkvvmmqzrmsrrbij5f734iwh4n9fd326bqgwc";
+  version = "0.28.5";
+  sha256 = "11k8sb8pjhrg8ar256rfdw736cg32m6n8xcfhyqc3r4pkj3ksli8";
+  manifestsSha256 = "1gjya8xcmx065ywx7bc2xdsp3qj2y47b7l1dlr4y0hzp19pclmcw";
 
   manifests = fetchzip {
     url =
@@ -23,7 +23,7 @@ in buildGoModule rec {
     inherit sha256;
   };
 
-  vendorSha256 = "sha256-IL9RjmMQahFZ04FXKxH6L2PHsOM1MJnqCJorRdr49FY=";
+  vendorSha256 = "sha256-kxI2sOaY66XLIRMT1l3VLQh1XR4nvvsYvsdZbVLxbHM=";
 
   postUnpack = ''
     cp -r ${manifests} source/cmd/flux/manifests
diff --git a/pkgs/applications/networking/cluster/openshift/default.nix b/pkgs/applications/networking/cluster/openshift/default.nix
index dd542f9ffac6..aade6c549f31 100644
--- a/pkgs/applications/networking/cluster/openshift/default.nix
+++ b/pkgs/applications/networking/cluster/openshift/default.nix
@@ -1,84 +1,68 @@
-{ lib, fetchFromGitHub, buildGoPackage, which, go-bindata, rsync, util-linux
-, coreutils, libkrb5, ncurses, clang, installShellFiles
-, components ? [
-  "cmd/oc"
-  "cmd/openshift"
-  ]
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, libkrb5
+, git
+, installShellFiles
+, testVersion
+, openshift
 }:
 
-with lib;
-
-let
-  version = "4.1.0";
-  ver = lib.elemAt (lib.splitVersion version);
-  versionMajor = ver 0;
-  versionMinor = ver 1;
-  versionPatch = ver 2;
-  gitCommit = "b4261e0";
-  # version is in vendor/k8s.io/kubernetes/pkg/version/base.go
-  k8sversion = "v1.11.1";
-  k8sgitcommit = "b1b2997";
-  k8sgitMajor = "0";
-  k8sgitMinor = "1";
-in buildGoPackage rec {
-  pname = "openshift-origin";
-  inherit version;
+buildGoModule rec {
+  pname = "openshift";
+  version = "4.10.0";
+  gitCommit = "346b183";
 
   src = fetchFromGitHub {
     owner = "openshift";
-    repo = "origin";
-    rev = "v${version}";
-    sha256 = "16bc6ljm418kxz92gz8ldm82491mvlqamrvigyr6ff72rf7ml7ba";
+    repo = "oc";
+    rev = "release-4.10";
+    sha256 = "Pdq3OwT5P7vvB70X+GVglT9CdJbhkm35nvEGurO1HPc=";
   };
 
-  goPackagePath = "github.com/openshift/origin";
+  vendorSha256 = null;
 
   buildInputs = [ libkrb5 ];
 
-  nativeBuildInputs = [
-    clang
-    go-bindata
-    installShellFiles
-    ncurses
-    rsync
-    which
-  ];
+  nativeBuildInputs = [ installShellFiles ];
 
   patchPhase = ''
     patchShebangs ./hack
   '';
 
   buildPhase = ''
-    cd go/src/${goPackagePath}
     # Openshift build require this variables to be set
     # unless there is a .git folder which is not the case with fetchFromGitHub
-    echo "OS_GIT_VERSION=v${version}" >> os-version-defs
-    echo "OS_GIT_TREE_STATE=clean" >> os-version-defs
-    echo "OS_GIT_MAJOR=${versionMajor}" >> os-version-defs
-    echo "OS_GIT_MINOR=${versionMinor}" >> os-version-defs
-    echo "OS_GIT_PATCH=${versionPatch}" >> os-version-defs
-    echo "OS_GIT_COMMIT=${gitCommit}" >> os-version-defs
-    echo "KUBE_GIT_VERSION=${k8sversion}" >> os-version-defs
-    echo "KUBE_GIT_COMMIT=${k8sgitcommit}" >> os-version-defs
-    echo "KUBE_GIT_MAJOR=${k8sgitMajor}" >> os-version-defs
-    echo "KUBE_GIT_MINOR=${k8sgitMinor}" >> os-version-defs
-    export OS_VERSION_FILE="os-version-defs"
-    export CC=clang
-    make all WHAT='${concatStringsSep " " components}'
+    export SOURCE_GIT_COMMIT=${gitCommit}
+    export SOURCE_GIT_TAG=v${version}
+    export SOURCE_GIT_TREE_STATE=clean
+
+    make all
   '';
 
   installPhase = ''
     mkdir -p $out/bin
-    cp -a "_output/local/bin/$(go env GOOS)/$(go env GOARCH)/"* "$out/bin/"
+    cp oc $out/bin
+
+    mkdir -p man
+    ./genman man oc
+    installManPage man/*.1
+
     installShellCompletion --bash contrib/completions/bash/*
     installShellCompletion --zsh contrib/completions/zsh/*
   '';
 
+  passthru.tests.version = testVersion {
+    package = openshift;
+    command = "oc version";
+    version = "v${version}";
+  };
+
   meta = with lib; {
     description = "Build, deploy, and manage your applications with Docker and Kubernetes";
     license = licenses.asl20;
     homepage = "http://www.openshift.org";
-    maintainers = with maintainers; [offline bachp moretea];
+    maintainers = with maintainers; [ offline bachp moretea stehessel ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/applications/networking/cluster/pluto/default.nix b/pkgs/applications/networking/cluster/pluto/default.nix
index 1fa4dc161952..4297ec62376d 100644
--- a/pkgs/applications/networking/cluster/pluto/default.nix
+++ b/pkgs/applications/networking/cluster/pluto/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "pluto";
-  version = "5.6.0";
+  version = "5.7.0";
 
   src = fetchFromGitHub {
     owner = "FairwindsOps";
     repo = "pluto";
     rev = "v${version}";
-    sha256 = "0nr8h8vg8ifgibgw80rs4mk63bj3qhmd37lfjc89iyml4g6p9mwr";
+    sha256 = "sha256-/H8/wpDqlo96qb6QBIxpIGMv6VtK/nn/GwozIJjZyNY=";
   };
 
-  vendorSha256 = "08x5mzypg66s54apkd7hhj6bi5pgbch9if2dbr58ksd3arkji2pv";
+  vendorSha256 = "sha256-jPVlHyKZ1ygF08OypXOMzHBfb2z5mhg5B8zJmAcQbLk=";
 
   ldflags = [
     "-w" "-s"
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 56743624efaa..b70bf0de63e9 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -697,6 +697,15 @@
     "vendorSha256": "0kkkrdbapyvfzmnbh5kmhlcz5l8g8gf0mfwbya66iy1bb6f6w4mz",
     "version": "1.3.0"
   },
+  "namecheap": {
+    "owner": "namecheap",
+    "provider-source-address": "registry.terraform.io/namecheap/namecheap",
+    "repo": "terraform-provider-namecheap",
+    "rev": "v2.1.0",
+    "sha256": "sha256-cms8YUL+SjTeYyIOQibksi8ZHEBYq2JlgTEpOO1uMZE=",
+    "vendorSha256": null,
+    "version": "2.1.0"
+  },
   "ncloud": {
     "owner": "NaverCloudPlatform",
     "provider-source-address": "registry.terraform.io/NaverCloudPlatform/ncloud",
diff --git a/pkgs/applications/networking/instant-messengers/bitlbee-steam/default.nix b/pkgs/applications/networking/instant-messengers/bitlbee-steam/default.nix
index 14464247659c..00b970cd6871 100644
--- a/pkgs/applications/networking/instant-messengers/bitlbee-steam/default.nix
+++ b/pkgs/applications/networking/instant-messengers/bitlbee-steam/default.nix
@@ -12,8 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "121r92mgwv445wwxzh35n19fs5k81ihr0j19k256ia5502b1xxaq";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ bitlbee autoconf automake libtool libgcrypt ];
+  nativeBuildInputs = [ pkg-config autoconf automake ];
+  buildInputs = [ bitlbee libtool libgcrypt ];
 
   preConfigure = ''
     export BITLBEE_PLUGINDIR=$out/lib/bitlbee
diff --git a/pkgs/applications/networking/instant-messengers/chatty/default.nix b/pkgs/applications/networking/instant-messengers/chatty/default.nix
index 97282c76d04c..34b525a98a61 100644
--- a/pkgs/applications/networking/instant-messengers/chatty/default.nix
+++ b/pkgs/applications/networking/instant-messengers/chatty/default.nix
@@ -3,6 +3,7 @@
 , fetchFromGitLab
 , appstream-glib
 , desktop-file-utils
+, itstool
 , meson
 , ninja
 , pkg-config
@@ -46,6 +47,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     appstream-glib
     desktop-file-utils
+    itstool
     meson
     ninja
     pkg-config
diff --git a/pkgs/applications/networking/instant-messengers/profanity/default.nix b/pkgs/applications/networking/instant-messengers/profanity/default.nix
index 42671f5d974b..2034f1761f2e 100644
--- a/pkgs/applications/networking/instant-messengers/profanity/default.nix
+++ b/pkgs/applications/networking/instant-messengers/profanity/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , autoconf-archive
 , autoreconfHook
 , cmocka
@@ -10,7 +9,7 @@
 , expect
 , glib
 , glibcLocales
-, libmesode
+, libstrophe
 , libmicrohttpd
 , libotr
 , libuuid
@@ -36,34 +35,17 @@ assert omemoSupport        -> libsignal-protocol-c != null && libgcrypt != null;
 
 stdenv.mkDerivation rec {
   pname = "profanity";
-  version = "0.11.1";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "profanity-im";
     repo = "profanity";
     rev = version;
-    hash = "sha256-8WGHOy0fSW8o7vMCYZqqpvDsn81JZefM6wGfjQ5iKbU=";
+    hash = "sha256-kmixWp9Q2tMVp+tk5kbTdBfgRNghKk3+48L582hqlm8=";
   };
 
   patches = [
     ./patches/packages-osx.patch
-
-    # pullupstream fixes for ncurses-6.3
-    (fetchpatch {
-      name = "ncurses-6.3-p1.patch";
-      url = "https://github.com/profanity-im/profanity/commit/e5b6258c997d4faf36e2ffb8a47b386c5629b4eb.patch";
-      sha256 = "sha256-4rwpvsgfIQ60GcLS0O7Hyn7ZidREjYT+dVND54z0zrw=";
-    })
-    (fetchpatch {
-      name = "ncurses-6.3-p2.patch";
-      url = "https://github.com/profanity-im/profanity/commit/fd9ccec8dc604902bbb1d444dba4223ccee0a092.patch";
-      sha256 = "sha256-4gZaXoDNulBIR+e6y/9bJKXVactCHWS8H8lPJaJwVwE=";
-    })
-    (fetchpatch {
-      name = "ncurses-6.3-p3.patch";
-      url = "https://github.com/profanity-im/profanity/commit/242696f09a49c8446ba6aef8bdad65fb58a77715.patch";
-      sha256 = "sha256-BOYHkae9aIA7HaVM23Yu25TTK9e3SuV+u0FEi7Sn62I=";
-    })
   ];
 
   enableParallelBuilding = true;
@@ -81,7 +63,7 @@ stdenv.mkDerivation rec {
     expat
     expect
     glib
-    libmesode
+    libstrophe
     libmicrohttpd
     libotr
     libuuid
diff --git a/pkgs/applications/networking/irc/bip/default.nix b/pkgs/applications/networking/irc/bip/default.nix
index a7b57aa31028..c144b4bf5853 100644
--- a/pkgs/applications/networking/irc/bip/default.nix
+++ b/pkgs/applications/networking/irc/bip/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "0q942g9lyd8pjvqimv547n6vik5759r9npw3ws3bdj4ixxqhz59w";
   };
 
-  buildInputs = [ bison flex autoconf automake openssl ];
+  nativeBuildInputs = [ autoconf automake ];
+  buildInputs = [ bison flex openssl ];
 
   # includes an important security patch
   patches = [
diff --git a/pkgs/applications/networking/irc/irssi/fish/default.nix b/pkgs/applications/networking/irc/irssi/fish/default.nix
index a3ee4e4ab9c7..c275f904660b 100644
--- a/pkgs/applications/networking/irc/irssi/fish/default.nix
+++ b/pkgs/applications/networking/irc/irssi/fish/default.nix
@@ -23,8 +23,8 @@ stdenv.mkDerivation rec {
     cp src/.libs/libfish.so $out/lib/irssi/modules
   '';
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ gmp automake autoconf libtool openssl glib ];
+  nativeBuildInputs = [ pkg-config autoconf automake ];
+  buildInputs = [ gmp libtool openssl glib ];
 
   meta = {
     homepage = "https://github.com/falsovsky/FiSH-irssi";
diff --git a/pkgs/applications/networking/irc/wraith/configure.patch b/pkgs/applications/networking/irc/wraith/configure.patch
index 16e65be00a25..2ecba77920eb 100644
--- a/pkgs/applications/networking/irc/wraith/configure.patch
+++ b/pkgs/applications/networking/irc/wraith/configure.patch
@@ -52,7 +52,7 @@
 -fi
 -unset cf_openssl_basedir
 +SSL_INCLUDES="-I@openssl.dev@/include"
-+SSL_LIBS="-L@openssl.out@/lib"
++SSL_LIBS="-L@openssl-lib@/lib"
  
  save_CXX="$CXX"
  CXX="$CXX $SSL_INCLUDES"
diff --git a/pkgs/applications/networking/irc/wraith/default.nix b/pkgs/applications/networking/irc/wraith/default.nix
index 30aec18c107f..a8923042c7d6 100644
--- a/pkgs/applications/networking/irc/wraith/default.nix
+++ b/pkgs/applications/networking/irc/wraith/default.nix
@@ -12,9 +12,9 @@ stdenv.mkDerivation rec {
   patches = [ ./configure.patch ./dlopen.patch ];
   postPatch = ''
     substituteInPlace configure        --subst-var-by openssl.dev ${openssl.dev} \
-                                       --subst-var-by openssl.out ${openssl.out}
-    substituteInPlace src/libssl.cc    --subst-var-by openssl ${openssl.out}
-    substituteInPlace src/libcrypto.cc --subst-var-by openssl ${openssl.out}
+                                       --subst-var-by openssl-lib ${lib.getLib openssl}
+    substituteInPlace src/libssl.cc    --subst-var-by openssl ${lib.getLib openssl}
+    substituteInPlace src/libcrypto.cc --subst-var-by openssl ${lib.getLib openssl}
   '';
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/applications/networking/mailreaders/mailspring/default.nix b/pkgs/applications/networking/mailreaders/mailspring/default.nix
index d2e5beb17180..d30282f44c7f 100644
--- a/pkgs/applications/networking/mailreaders/mailspring/default.nix
+++ b/pkgs/applications/networking/mailreaders/mailspring/default.nix
@@ -15,15 +15,17 @@
 , openssl
 , udev
 , xorg
+, mesa
+, libdrm
 }:
 
 stdenv.mkDerivation rec {
   pname = "mailspring";
-  version = "1.9.2";
+  version = "1.10.2";
 
   src = fetchurl {
     url = "https://github.com/Foundry376/Mailspring/releases/download/${version}/mailspring-${version}-amd64.deb";
-    sha256 = "sha256-o7w2XHd5FnPYt9j8IIGy6OgKtdeNb/qZ+EiXGEn0NUQ=";
+    sha256 = "sha256-6KHhkmHWhj/AgECYqNuJ0iSPEYyuBDac/3fW6J0fgTg=";
   };
 
   nativeBuildInputs = [
@@ -44,6 +46,9 @@ stdenv.mkDerivation rec {
     xorg.libXdamage
     xorg.libXScrnSaver
     xorg.libXtst
+    xorg.libxshmfence
+    mesa
+    libdrm
   ];
 
   runtimeDependencies = [
@@ -70,7 +75,7 @@ stdenv.mkDerivation rec {
       --replace dirname ${coreutils}/bin/dirname
 
     ln -s $out/share/mailspring/mailspring $out/bin/mailspring
-    ln -s ${openssl.out}/lib/libcrypto.so $out/lib/libcrypto.so.1.0.0
+    ln -s ${lib.getLib openssl}/lib/libcrypto.so $out/lib/libcrypto.so.1.0.0
 
     runHook postInstall
   '';
diff --git a/pkgs/applications/networking/mullvad/default.nix b/pkgs/applications/networking/mullvad/default.nix
new file mode 100644
index 000000000000..7b4bcf9d61b2
--- /dev/null
+++ b/pkgs/applications/networking/mullvad/default.nix
@@ -0,0 +1,8 @@
+{ lib
+, newScope
+}:
+lib.makeScope newScope (self: {
+  libwg = self.callPackage ./libwg.nix { };
+  mullvad = self.callPackage ./mullvad.nix { };
+  openvpn-mullvad = self.callPackage ./openvpn.nix { };
+})
diff --git a/pkgs/applications/networking/mullvad/libwg.nix b/pkgs/applications/networking/mullvad/libwg.nix
new file mode 100644
index 000000000000..d54a2cafe8c0
--- /dev/null
+++ b/pkgs/applications/networking/mullvad/libwg.nix
@@ -0,0 +1,35 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, mullvad
+}:
+buildGoModule {
+  pname = "libwg";
+
+  inherit (mullvad)
+    version
+    src
+    ;
+
+  sourceRoot = "source/wireguard/libwg";
+
+  vendorSha256 = "qvymWCdJ+GY90W/Fpdp+r1+mTq6O4LyN2Yw/PjKdFm0=";
+
+  # XXX: hack to make the ar archive go to the correct place
+  # This is necessary because passing `-o ...` to `ldflags` does not work
+  # (this doesn't get communicated everywhere in the chain, apparently, so
+  # `go` complains that it can't find an `a.out` file).
+  GOBIN = "${placeholder "out"}/lib";
+  ldflags = [ "-s" "-w" "-buildmode=c-archive" ];
+
+  postInstall = ''
+    mv $out/lib/libwg{,.a}
+  '';
+
+  meta = with lib; {
+    description = "A tiny wrapper around wireguard-go";
+    homepage = "https://github.com/mullvad/mullvadvpn-app/tree/master/wireguard/libwg";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ cole-h ];
+  };
+}
diff --git a/pkgs/applications/networking/mullvad/mullvad.nix b/pkgs/applications/networking/mullvad/mullvad.nix
new file mode 100644
index 000000000000..801e8602cc95
--- /dev/null
+++ b/pkgs/applications/networking/mullvad/mullvad.nix
@@ -0,0 +1,107 @@
+{ lib
+, stdenv
+, writeText
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, protobuf
+, makeWrapper
+, dbus
+, libnftnl
+, libmnl
+, libwg
+, openvpn-mullvad
+, shadowsocks-rust
+}:
+let
+  # result of running address_cache as of 02 Mar 2022
+  bootstrap-address-cache = writeText "api-ip-address.txt" ''
+    193.138.218.78:443
+    193.138.218.71:444
+    185.65.134.66:444
+    185.65.135.117:444
+    217.138.254.130:444
+    91.90.44.10:444
+  '';
+in
+rustPlatform.buildRustPackage rec {
+  pname = "mullvad";
+  version = "2022.1";
+
+  src = fetchFromGitHub {
+    owner = "mullvad";
+    repo = "mullvadvpn-app";
+    rev = version;
+    hash = "sha256-bLwuM3Qy2iStbXIvDEWp31vuiihSQThOej297XKo5Xc=";
+  };
+
+  cargoHash = "sha256-CBbm8cJHTjyvvzCFQfKmsE5d9N7azEm8nI6KeWLVaa8=";
+
+  nativeBuildInputs = [
+    pkg-config
+    protobuf
+    makeWrapper
+  ];
+
+  buildInputs = [
+    dbus.dev
+    libnftnl
+    libmnl
+  ];
+
+  # talpid-core wants libwg.a in build/lib/{triple}
+  preBuild = ''
+    dest=build/lib/${stdenv.targetPlatform.config}
+    mkdir -p $dest
+    ln -s ${libwg}/lib/libwg.a $dest
+  '';
+
+  postFixup =
+    # Place all binaries in the 'mullvad-' namespace, even though these
+    # specific binaries aren't used in the lifetime of the program.
+    # `address_cache` is used to generate the `api-ip-address.txt` file, which
+    # contains list of Mullvad API servers -- though we provide a "backup" of
+    # the output of this command, it could change at any time, so we want
+    # users to be able to regenerate the list at any time. (The daemon will
+    # refuse to start without this file.)
+    ''
+      for bin in address_cache relay_list translations-converter; do
+        mv "$out/bin/$bin" "$out/bin/mullvad-$bin"
+      done
+    '' +
+    # Put distributed assets in-place -- specifically, the
+    # bootstrap-address-cache is necessary; otherwise, the user will have to run
+    # the `address_cache` binary and move the contents into place at
+    # `/var/cache/mullvad-vpn/api-ip-address.txt` manually.
+    ''
+      mkdir -p $out/share/mullvad
+      ln -s ${bootstrap-address-cache} $out/share/mullvad/api-ip-address.txt
+    '' +
+    # Files necessary for OpenVPN tunnels to work.
+    ''
+      cp dist-assets/ca.crt $out/share/mullvad
+      ln -s ${openvpn-mullvad}/bin/openvpn $out/share/mullvad
+      ln -s ${shadowsocks-rust}/bin/sslocal $out/share/mullvad
+      ln -s $out/lib/libtalpid_openvpn_plugin.so $out/share/mullvad
+    '' +
+    # Set the directory where Mullvad will look for its resources by default to
+    # `$out/share`, so that we can avoid putting the files in `$out/bin` --
+    # Mullvad defaults to looking inside the directory its binary is located in
+    # for its resources.
+    ''
+      wrapProgram $out/bin/mullvad-daemon \
+        --set-default MULLVAD_RESOURCE_DIR "$out/share/mullvad"
+    '';
+
+  passthru = {
+    inherit libwg;
+    inherit openvpn-mullvad;
+  };
+
+  meta = with lib; {
+    description = "Mullvad VPN command-line client tools";
+    homepage = "https://github.com/mullvad/mullvadvpn-app";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ cole-h ];
+  };
+}
diff --git a/pkgs/applications/networking/mullvad/openvpn.nix b/pkgs/applications/networking/mullvad/openvpn.nix
new file mode 100644
index 000000000000..b191c31d39ac
--- /dev/null
+++ b/pkgs/applications/networking/mullvad/openvpn.nix
@@ -0,0 +1,87 @@
+{ lib
+, openvpn
+, fetchpatch
+, fetchurl
+, iproute2
+, autoconf
+, automake
+}:
+
+openvpn.overrideAttrs (oldAttrs:
+  let
+    fetchMullvadPatch = { commit, sha256 }: fetchpatch {
+      url = "https://github.com/mullvad/openvpn/commit/${commit}.patch";
+      inherit sha256;
+    };
+  in
+  rec {
+    pname = "openvpn-mullvad";
+    version = "2.5.3";
+
+    src = fetchurl {
+      url = "https://swupdate.openvpn.net/community/releases/openvpn-${version}.tar.gz";
+      sha256 = "sha256-dfAETfRJQwVVynuZWit3qyTylG/cNmgwG47cI5hqX34=";
+    };
+
+    buildInputs = oldAttrs.buildInputs or [ ] ++ [
+      iproute2
+    ];
+
+    configureFlags = oldAttrs.configureFlags  or [ ] ++ [
+      "--enable-iproute2"
+      "IPROUTE=${iproute2}/sbin/ip"
+    ];
+
+    nativeBuildInputs = oldAttrs.nativeBuildInputs or [ ] ++ [
+      autoconf
+      automake
+    ];
+
+    patches = oldAttrs.patches or [ ] ++ [
+      # look at compare to find the relevant commits
+      # https://github.com/OpenVPN/openvpn/compare/release/2.5...mullvad:mullvad-patches
+      # used openvpn version is the latest tag ending with -mullvad
+      # https://github.com/mullvad/openvpn/tags
+      (fetchMullvadPatch {
+        # "Reduce PUSH_REQUEST_INTERVAL to one second"
+        commit = "41e44158fc71bb6cc8cc6edb6ada3307765a12e8";
+        sha256 = "sha256-UoH0V6gTPdEuybFkWxdaB4zomt7rZeEUyXs9hVPbLb4=";
+      })
+      (fetchMullvadPatch {
+        # "Allow auth plugins to set a failure reason"
+        commit = "f51781c601e8c72ae107deaf25bf66f7c193e9cd";
+        sha256 = "sha256-+kwG0YElL16T0e+avHlI8gNQdAxneRS6fylv7QXvC1s=";
+      })
+      (fetchMullvadPatch {
+        # "Send an event to any plugins when authentication fails"
+        commit = "c2f810f966f2ffd68564d940b5b8946ea6007d5a";
+        sha256 = "sha256-PsKIxYwpLD66YaIpntXJM8OGcObyWBSAJsQ60ojvj30=";
+      })
+      (fetchMullvadPatch {
+        # "Shutdown when STDIN is closed"
+        commit = "879d6a3c0288b5443bbe1b94261655c329fc2e0e";
+        sha256 = "sha256-pRFY4r+b91/xAKXx6u5GLzouQySXuO5gH0kMGm77a3c=";
+      })
+      (fetchMullvadPatch {
+        # "Update TAP hardware ID"
+        commit = "7f71b37a3b25bec0b33a0e29780c222aef869e9d";
+        sha256 = "sha256-RF/GvD/ZvhLdt34wDdUT/yxa+IVWx0eY6WRdNWXxXeQ=";
+      })
+      (fetchMullvadPatch {
+        # "Undo dependency on Python docutils"
+        commit = "abd3c6214529d9f4143cc92dd874d8743abea17c";
+        sha256 = "sha256-SC2RlpWHUDMAEKap1t60dC4hmalk3vok6xY+/xhC2U0=";
+      })
+      (fetchMullvadPatch {
+        # "Prevent signal when stdin is closed from being cleared (#10)"
+        commit = "b45b090c81e7b4f2dc938642af7a1e12f699f5c5";
+        sha256 = "sha256-KPTFmbuJhMI+AvaRuu30CPPLQAXiE/VApxlUCqbZFls=";
+      })
+    ];
+
+    meta = oldAttrs.meta or { } // {
+      description = "OpenVPN with Mullvad-specific patches applied";
+      homepage = "https://github.com/mullvad/openvpn";
+      maintainers = with lib; [ maintainers.cole-h ];
+    };
+  })
diff --git a/pkgs/applications/networking/owamp/default.nix b/pkgs/applications/networking/owamp/default.nix
index c357e78ccf29..785fa6886a86 100644
--- a/pkgs/applications/networking/owamp/default.nix
+++ b/pkgs/applications/networking/owamp/default.nix
@@ -4,7 +4,8 @@
 stdenv.mkDerivation rec {
   pname = "owamp";
   version = "3.5.6";
-  buildInputs = [ autoconf automake mandoc ];
+  nativeBuildInputs = [ autoconf automake ];
+  buildInputs = [ mandoc ];
   src = fetchFromGitHub {
     owner = "perfsonar";
     repo = "owamp";
diff --git a/pkgs/applications/networking/p2p/twister/default.nix b/pkgs/applications/networking/p2p/twister/default.nix
index c8e3c4ce7b91..979ac955caf3 100644
--- a/pkgs/applications/networking/p2p/twister/default.nix
+++ b/pkgs/applications/networking/p2p/twister/default.nix
@@ -38,9 +38,9 @@ in stdenv.mkDerivation rec {
     "--with-boost-libdir=${boostPython.out}/lib"
   ];
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config automake autoconf ];
   buildInputs = [
-    autoconf automake libtool python2
+    libtool python2
     boostPython db openssl geoip miniupnpc libiconv
   ];
 
diff --git a/pkgs/applications/networking/remote/citrix-workspace/generic.nix b/pkgs/applications/networking/remote/citrix-workspace/generic.nix
index ac0030961183..bfd9e402f956 100644
--- a/pkgs/applications/networking/remote/citrix-workspace/generic.nix
+++ b/pkgs/applications/networking/remote/citrix-workspace/generic.nix
@@ -14,7 +14,7 @@ let
   openssl' = symlinkJoin {
     name = "openssl-backwards-compat";
     nativeBuildInputs = [ makeWrapper ];
-    paths = [ openssl.out ];
+    paths = [ (lib.getLib openssl) ];
     postBuild = ''
       ln -sf $out/lib/libcrypto.so $out/lib/libcrypto.so.1.0.0
       ln -sf $out/lib/libssl.so $out/lib/libssl.so.1.0.0
diff --git a/pkgs/applications/networking/sniffers/wireshark/default.nix b/pkgs/applications/networking/sniffers/wireshark/default.nix
index b667c7671bdc..931606f32489 100644
--- a/pkgs/applications/networking/sniffers/wireshark/default.nix
+++ b/pkgs/applications/networking/sniffers/wireshark/default.nix
@@ -11,7 +11,7 @@ assert withQt  -> qt5  != null;
 with lib;
 
 let
-  version = "3.6.2";
+  version = "3.6.3";
   variant = if withQt then "qt" else "cli";
 
 in stdenv.mkDerivation {
@@ -21,7 +21,7 @@ in stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.wireshark.org/download/src/all-versions/wireshark-${version}.tar.xz";
-    sha256 = "sha256-XZAaVXKu+VPwStwlPtKgaZ1MYnedMkkCHh6FQaAkww4=";
+    sha256 = "sha256-tgNkpMAGihCBGrP9B1ymwesOddRGACcbiKIO2Tou9jE=";
   };
 
   cmakeFlags = [
diff --git a/pkgs/applications/networking/sync/lsyncd/default.nix b/pkgs/applications/networking/sync/lsyncd/default.nix
index 4c95a35ab85a..7690bf6ee540 100644
--- a/pkgs/applications/networking/sync/lsyncd/default.nix
+++ b/pkgs/applications/networking/sync/lsyncd/default.nix
@@ -31,9 +31,10 @@ stdenv.mkDerivation rec {
 
   dontUseCmakeBuildDir = true;
 
+  nativeBuildInputs = [ cmake ];
   buildInputs = [
     rsync
-    cmake lua pkg-config
+    lua pkg-config
     asciidoc libxml2 docbook_xml_dtd_45 docbook_xsl libxslt
   ];
 
diff --git a/pkgs/applications/office/hledger-check-fancyassertions/default.nix b/pkgs/applications/office/hledger-check-fancyassertions/default.nix
index df3752eac3e0..6edef5b621bd 100644
--- a/pkgs/applications/office/hledger-check-fancyassertions/default.nix
+++ b/pkgs/applications/office/hledger-check-fancyassertions/default.nix
@@ -1,17 +1,13 @@
 {lib, stdenvNoCC, haskellPackages, fetchurl, writers}:
 
-let
-  hledger-lib = haskellPackages.hledger-lib_1_24_1;
-in
-
 stdenvNoCC.mkDerivation rec {
   pname = "hledger-check-fancyassertions";
-  inherit (hledger-lib) version;
+  inherit (haskellPackages.hledger-lib) version;
 
   src = fetchurl {
     name = "hledger-check-fancyassertion-${version}.hs";
     url = "https://raw.githubusercontent.com/simonmichael/hledger/hledger-lib-${version}/bin/hledger-check-fancyassertions.hs";
-    sha256 = "0naggvivc6szsc8haa52a6lm079ikz5qfva0ljnqx0f1zlkxv984";
+    sha256 = "1xy3ssxnwybq40nlffz95w7m9xbzf8ysb13svg0i8g5sfgrw11vk";
   };
 
   dontUnpack = true;
@@ -20,13 +16,12 @@ stdenvNoCC.mkDerivation rec {
   executable = writers.writeHaskell
     "hledger-check-fancyassertions"
     {
-      libraries = [
+      libraries = with haskellPackages; [
         hledger-lib
-      ] ++ (with haskellPackages; [
         base base-compat base-compat-batteries filepath
         megaparsec microlens optparse-applicative string-qq text time
         transformers
-      ]);
+      ];
       inherit (haskellPackages) ghc;
     }
     src;
diff --git a/pkgs/applications/office/morgen/default.nix b/pkgs/applications/office/morgen/default.nix
index b461b2ba19e1..a9fce9ff8edb 100644
--- a/pkgs/applications/office/morgen/default.nix
+++ b/pkgs/applications/office/morgen/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "morgen";
-  version = "2.4.4";
+  version = "2.5.0";
 
   src = fetchurl {
     url = "https://download.todesktop.com/210203cqcj00tw1/morgen-${version}.deb";
-    sha256 = "sha256-5/85ro206o3SsvAvcZeDD2Dmo2jU4zXmtI3X4WdQaRI=";
+    sha256 = "sha256-6hBhfJ18ROCfmqoxrJZ5TiYCFb1xZKsJeobXFy5yfQM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/office/pinpoint/default.nix b/pkgs/applications/office/pinpoint/default.nix
index b6d0d373f35b..d7b1984b0d73 100644
--- a/pkgs/applications/office/pinpoint/default.nix
+++ b/pkgs/applications/office/pinpoint/default.nix
@@ -8,8 +8,8 @@ stdenv.mkDerivation rec {
     url = "http://ftp.gnome.org/pub/GNOME/sources/pinpoint/0.1/${pname}-${version}.tar.xz";
     sha256 = "1jp8chr9vjlpb5lybwp5cg6g90ak5jdzz9baiqkbg0anlg8ps82s";
   };
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ autoconf automake clutter clutter-gst gdk-pixbuf
+  nativeBuildInputs = [ pkg-config autoconf automake ];
+  buildInputs = [ clutter clutter-gst gdk-pixbuf
                   cairo clutter-gtk ];
 
   meta = with lib; {
diff --git a/pkgs/applications/office/zotero/default.nix b/pkgs/applications/office/zotero/default.nix
index 53c61f0d993c..749b6959b740 100644
--- a/pkgs/applications/office/zotero/default.nix
+++ b/pkgs/applications/office/zotero/default.nix
@@ -105,7 +105,7 @@ stdenv.mkDerivation rec {
     genericName = "Reference Management";
     categories = [ "Office" "Database" ];
     startupNotify = true;
-    mimeTypes = [ "text/plain" ];
+    mimeTypes = [ "x-scheme-handler/zotero" "text/plain" ];
   };
 
   installPhase = ''
diff --git a/pkgs/applications/science/biology/kssd/default.nix b/pkgs/applications/science/biology/kssd/default.nix
index bcf47e6b6a3d..2da7f627cb40 100644
--- a/pkgs/applications/science/biology/kssd/default.nix
+++ b/pkgs/applications/science/biology/kssd/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-8jzYqo9LXF66pQ1EIusm+gba2VbTYpJz2K3NVlA3QxY=";
   };
 
-  buildInputs = [ zlib automake autoconf libtool ];
+  nativeBuildInputs = [ autoconf automake ];
+  buildInputs = [ zlib libtool ];
 
   installPhase = ''
       install -vD kssd $out/bin/kssd
diff --git a/pkgs/applications/science/electronics/gerbv/default.nix b/pkgs/applications/science/electronics/gerbv/default.nix
index 94a8f081f69a..a16d5f32e27a 100644
--- a/pkgs/applications/science/electronics/gerbv/default.nix
+++ b/pkgs/applications/science/electronics/gerbv/default.nix
@@ -10,8 +10,8 @@ stdenv.mkDerivation {
     sha256 = "00jn1xhf6kblxc5gac1wvk8zm12fy6sk81nj3jwdag0z6wk3z446";
   };
 
-  nativeBuildInputs = [ autoreconfHook pkg-config ];
-  buildInputs = [ gettext libtool automake autoconf cairo gtk2 ];
+  nativeBuildInputs = [ autoreconfHook pkg-config automake autoconf ];
+  buildInputs = [ gettext libtool cairo gtk2 ];
 
   configureFlags = ["--disable-update-desktop-database"];
 
diff --git a/pkgs/applications/science/logic/nuXmv/default.nix b/pkgs/applications/science/logic/nuXmv/default.nix
index 021c612d1069..710cfdad39a8 100644
--- a/pkgs/applications/science/logic/nuXmv/default.nix
+++ b/pkgs/applications/science/logic/nuXmv/default.nix
@@ -1,25 +1,33 @@
-{ lib, stdenv, fetchurl }:
+{ lib, stdenv, fetchurl, gmp, makeWrapper }:
 
 stdenv.mkDerivation rec {
   pname = "nuXmv";
   version = "2.0.0";
 
   src = fetchurl {
-    url = "https://es-static.fbk.eu/tools/nuxmv/downloads/nuXmv-${version}-linux64.tar.gz";
-    sha256 = "0nndrw994clf8lnlcfzdf1mf00vif3fvd4xsiwcjpbyk12091zqr";
+    url = "https://es-static.fbk.eu/tools/nuxmv/downloads/nuXmv-${version}-${if stdenv.isDarwin then "macosx64" else "linux64"}.tar.gz";
+    sha256 = if stdenv.isDarwin
+             then "sha256-48I+FhJUUam1nMCMMM47CwGO82BYsNz0eHDHXBfqO2E="
+             else "sha256-Gf+QgAjTrysZj7qTtt1wcQPganDtO0YtRY4ykhLPzVo=";
   };
 
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = lib.optionals stdenv.isDarwin [ gmp ];
   installPhase= ''
     runHook preInstall
     install -Dm755 -t $out/bin ./bin/nuXmv
     runHook postInstall
   '';
 
+  postFixup = lib.optionalString stdenv.isDarwin ''
+    wrapProgram $out/bin/nuXmv --prefix DYLD_LIBRARY_PATH : ${gmp}/lib
+  '';
+
   meta = with lib; {
     description = "Symbolic model checker for analysis of finite and infinite state systems";
     homepage = "https://nuxmv.fbk.eu/pmwiki.php";
     license = licenses.unfree;
     maintainers = with maintainers; [ siraben ];
-    platforms = [ "x86_64-linux" ];
+    platforms = [ "x86_64-linux" "x86_64-darwin" ];
   };
 }
diff --git a/pkgs/applications/science/misc/rink/default.nix b/pkgs/applications/science/misc/rink/default.nix
index d319dbe3e704..18b1e46fde2e 100644
--- a/pkgs/applications/science/misc/rink/default.nix
+++ b/pkgs/applications/science/misc/rink/default.nix
@@ -2,17 +2,17 @@
 , libiconv, Security }:
 
 rustPlatform.buildRustPackage rec {
-  version = "0.6.2";
+  version = "0.6.3";
   pname = "rink";
 
   src = fetchFromGitHub {
     owner = "tiffany352";
     repo = "rink-rs";
     rev = "v${version}";
-    sha256 = "sha256-l2Rj15zaJm94EHwvOssfvYQNOoWj45Nq9M85n+A0vo4=";
+    sha256 = "sha256-AhC3c6CpV0tlD6d/hFWt7hGj2UsXsOCeujkRSDlpvCM=";
   };
 
-  cargoSha256 = "sha256-GhuvwVkDRFjC6BghaNMFZZG9hResTN1u0AuvIXlFmig=";
+  cargoSha256 = "sha256-Xo5iYwL4Db+GWMl5UXbPmj0Y0PJYR4Q0aUGnYCd+NB8=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ ncurses ]
diff --git a/pkgs/applications/terminal-emulators/kitty/default.nix b/pkgs/applications/terminal-emulators/kitty/default.nix
index d06c6d937c11..52e691f98504 100644
--- a/pkgs/applications/terminal-emulators/kitty/default.nix
+++ b/pkgs/applications/terminal-emulators/kitty/default.nix
@@ -90,6 +90,11 @@ buildPythonApplication rec {
       url = "https://github.com/kovidgoyal/kitty/commit/d8ed42ae8e014d9abf9550a65ae203468f8bfa43.patch";
       sha256 = "sha256-Azgzqf5atW999FVn9rSGKMyZLsI692dYXhJPx07GBO0=";
     })
+    (fetchpatch {
+      name = "fix-build-with-non-framework-python-on-darwin.patch";
+      url = "https://github.com/kovidgoyal/kitty/commit/57cffc71b78244e6a9d49f4c9af24d1a88dbf537.patch";
+      sha256 = "sha256-1IGONSVCVo5SmLKw90eqxaI5Mwc764O1ur+aMsc7h94=";
+    })
   ];
 
   # Causes build failure due to warning
diff --git a/pkgs/applications/version-management/git-and-tools/gh/default.nix b/pkgs/applications/version-management/git-and-tools/gh/default.nix
index 36b813f547e0..3a66a4d8af7d 100644
--- a/pkgs/applications/version-management/git-and-tools/gh/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/gh/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "gh";
-  version = "2.6.0";
+  version = "2.7.0";
 
   src = fetchFromGitHub {
     owner = "cli";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-NvVm/deO4LSIl5TSziqsrGt9atCXjt4UZ/VJfmX3i4c=";
+    sha256 = "sha256-edlGJD+80k1ySpyNcKc5c2O0MX+S4fQgH5mwHQUxXM8=";
   };
 
-  vendorSha256 = "sha256-pBjg6WyD61+Bl3ttcpl/b9XoWBCi7cDvE8NPaZGu7Aw=";
+  vendorSha256 = "sha256-YLkNua0Pz0gVIYnWOzOlV5RuLBaoZ4l7l1Pf4QIfUVQ=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/applications/version-management/git-and-tools/git-annex-utils/default.nix b/pkgs/applications/version-management/git-and-tools/git-annex-utils/default.nix
index 7ad040a7c17e..0ba747d72350 100644
--- a/pkgs/applications/version-management/git-and-tools/git-annex-utils/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-annex-utils/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     rev = "531bb33";
     sha256 = "1sv7s2ykc840cjwbfn7ayy743643x9i1lvk4cd55w9l052xvzj65";
   };
-  buildInputs = [ autoconf automake libtool gmp ];
+  nativeBuildInputs = [ autoconf automake ];
+  buildInputs = [ libtool gmp ];
   preConfigure = "./autogen.sh";
 
   meta = {
diff --git a/pkgs/applications/version-management/gitlab/data.json b/pkgs/applications/version-management/gitlab/data.json
index bd524c622d6f..dbae269aab8c 100644
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@@ -1,14 +1,14 @@
 {
-  "version": "14.9.1",
-  "repo_hash": "0jkhvglisaj3h9ls8q8wrxnnp4xp3zggc8vmwg6jqqjsmbpi332h",
-  "yarn_hash": "1bq1ka0nlb2nkjx70qpwpm8x6crbkfj0c8m39pwwc42j8wn10r9g",
+  "version": "14.9.2",
+  "repo_hash": "sha256-+tZN6isOb7LtUVwGshx9TP+P42sftJmQGVk1L9UJqcY=",
+  "yarn_hash": "1mya6y0cb9x8491gpf7f1i7qi2rb0l7d9g5yzj44vvy3mb4rcqaj",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v14.9.1-ee",
+  "rev": "v14.9.2-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "14.9.1",
-    "GITLAB_PAGES_VERSION": "1.56.0",
+    "GITALY_SERVER_VERSION": "14.9.2",
+    "GITLAB_PAGES_VERSION": "1.56.1",
     "GITLAB_SHELL_VERSION": "13.24.0",
-    "GITLAB_WORKHORSE_VERSION": "14.9.1"
+    "GITLAB_WORKHORSE_VERSION": "14.9.2"
   }
 }
diff --git a/pkgs/applications/version-management/gitlab/gitaly/default.nix b/pkgs/applications/version-management/gitlab/gitaly/default.nix
index d8ab7f36b39c..cd76768aee49 100644
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@@ -11,7 +11,7 @@ let
     gemdir = ./.;
   };
 
-  version = "14.9.1";
+  version = "14.9.2";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/v${lib.versions.major version}";
 in
 
@@ -23,7 +23,7 @@ buildGoModule {
     owner = "gitlab-org";
     repo = "gitaly";
     rev = "v${version}";
-    sha256 = "sha256-mk6JZuu6b2r/OqRI4ZUf8AV/ObRKhTIQT9bQE8sH894=";
+    sha256 = "sha256-eEo+WZ2N/5bLfvwJCNf9qt+h/V5dIVqCjVJeomzw/Ps=";
   };
 
   vendorSha256 = "sha256-kEjgWA/Task23PScPYrqdDu3vdVR/FJl7OilUug/Bds=";
diff --git a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
index e16d7f75bf69..9fcecc53a070 100644
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@@ -5,7 +5,7 @@ in
 buildGoModule rec {
   pname = "gitlab-workhorse";
 
-  version = "14.9.1";
+  version = "14.9.2";
 
   src = fetchFromGitLab {
     owner = data.owner;
diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
index fd469fd8bcc7..ae8a8e012414 100644
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
@@ -67,7 +67,7 @@ gem 'akismet', '~> 3.0'
 gem 'invisible_captcha', '~> 1.1.0'
 
 # Two-factor authentication
-gem 'devise-two-factor', '~> 4.0.0'
+gem 'devise-two-factor', '~> 4.0.2'
 gem 'rqrcode-rails3', '~> 0.1.7'
 gem 'attr_encrypted', '~> 3.1.0'
 gem 'u2f', '~> 0.2.1'
diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
index da4987d35dcd..658d79dfcc66 100644
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
@@ -263,11 +263,11 @@ GEM
       railties (>= 4.1.0)
       responders
       warden (~> 1.2.3)
-    devise-two-factor (4.0.0)
-      activesupport (< 6.2)
+    devise-two-factor (4.0.2)
+      activesupport (< 7.1)
       attr_encrypted (>= 1.3, < 4, != 2)
       devise (~> 4.0)
-      railties (< 6.2)
+      railties (< 7.1)
       rotp (~> 6.0)
     diff-lcs (1.4.4)
     diff_match_patch (0.1.0)
@@ -1450,7 +1450,7 @@ DEPENDENCIES
   derailed_benchmarks
   device_detector
   devise (~> 4.7.2)
-  devise-two-factor (~> 4.0.0)
+  devise-two-factor (~> 4.0.2)
   diff_match_patch (~> 0.1.0)
   diffy (~> 3.3)
   discordrb-webhooks (~> 3.4)
diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix b/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
index 5fc9a183a8b9..cc88cbbbab5b 100644
--- a/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
@@ -1088,10 +1088,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "148pfr6g8dwikdq3994gsid2a3n6p5h4z1a1dzh1898shr5f9znc";
+      sha256 = "04f5rb8fg4cvzm32v413z3h53wc0fgxg927q8rqd546hdrlx4j35";
       type = "gem";
     };
-    version = "4.0.0";
+    version = "4.0.2";
   };
   diff-lcs = {
     groups = ["default" "development" "test"];
diff --git a/pkgs/applications/version-management/subversion/default.nix b/pkgs/applications/version-management/subversion/default.nix
index 2e7484327674..4789d654ae68 100644
--- a/pkgs/applications/version-management/subversion/default.nix
+++ b/pkgs/applications/version-management/subversion/default.nix
@@ -92,7 +92,7 @@ let
           --replace "${expat.dev}/lib" "${expat.out}/lib" \
           --replace "${zlib.dev}/lib" "${zlib.out}/lib" \
           --replace "${sqlite.dev}/lib" "${sqlite.out}/lib" \
-          --replace "${openssl.dev}/lib" "${openssl.out}/lib"
+          --replace "${openssl.dev}/lib" "${lib.getLib openssl}/lib"
       done
     '';
 
diff --git a/pkgs/applications/version-management/verco/default.nix b/pkgs/applications/version-management/verco/default.nix
index 715ae0978cc1..407608cc22d5 100644
--- a/pkgs/applications/version-management/verco/default.nix
+++ b/pkgs/applications/version-management/verco/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "verco";
-  version = "6.7.0";
+  version = "6.8.0";
 
   src = fetchFromGitHub {
     owner = "vamolessa";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-H8rDaRVU3G3iuBv0Tz/YOuYbL2k8wEoEIIEG7hjU6eM=";
+    sha256 = "sha256-E1kqJLnTLPu38zvDGaPHiKSW/yKormbx5N1CBSzQxgc=";
   };
 
-  cargoSha256 = "sha256-4Ou/stedL3WCY4Awsl++lc5fZ9gxd4uorf4G2/0DiPc=";
+  cargoSha256 = "sha256-9342LAChCv61kxTJoeOy7EdafMfR10s8dtkc2pTgXT0=";
 
   meta = with lib; {
     description = "A simple Git/Mercurial/PlasticSCM tui client based on keyboard shortcuts";
diff --git a/pkgs/applications/video/davinci-resolve/default.nix b/pkgs/applications/video/davinci-resolve/default.nix
new file mode 100644
index 000000000000..289fcdad5227
--- /dev/null
+++ b/pkgs/applications/video/davinci-resolve/default.nix
@@ -0,0 +1,178 @@
+{ stdenv
+, lib
+, cacert
+, curl
+, runCommandLocal
+, targetPlatform
+, unzip
+, appimage-run
+, addOpenGLRunpath
+, libGLU
+, xorg
+, buildFHSUserEnv
+, bash
+, writeText
+, ocl-icd
+, xkeyboard_config
+, glib
+, libarchive
+}:
+
+let
+  davinci = (
+    stdenv.mkDerivation rec {
+      pname = "davinci-resolve";
+      version = "17.4.3";
+
+      nativeBuildInputs = [ unzip appimage-run addOpenGLRunpath ];
+
+      # Pretty sure, there are missing dependencies ...
+      buildInputs = [ libGLU xorg.libXxf86vm ];
+
+      src = runCommandLocal "${pname}-src.zip"
+        rec {
+          outputHashMode = "recursive";
+          outputHashAlgo = "sha256";
+          outputHash = "0hq374n26mbcds8f1z644cvnh4h2rjdrbxxxbj4p34mx9b04ab28";
+
+          impureEnvVars = lib.fetchers.proxyImpureEnvVars;
+
+          nativeBuildInputs = [ curl ];
+
+          # ENV VARS
+          SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+
+          DOWNLOADID = "5efad1a052e8471989f662338d5247f1";
+          REFERID = "263d62f31cbb49e0868005059abcb0c9";
+          SITEURL = "https://www.blackmagicdesign.com/api/register/us/download/${DOWNLOADID}";
+
+          USERAGENT = builtins.concatStringsSep " " [
+            "User-Agent: Mozilla/5.0 (X11; Linux ${targetPlatform.linuxArch})"
+            "AppleWebKit/537.36 (KHTML, like Gecko)"
+            "Chrome/77.0.3865.75"
+            "Safari/537.36"
+          ];
+
+          REQJSON = builtins.toJSON {
+            "firstname" = "NixOS";
+            "lastname" = "Linux";
+            "email" = "someone@nixos.org";
+            "phone" = "+31 71 452 5670";
+            "country" = "nl";
+            "state" = "Province of Utrecht";
+            "city" = "Utrecht";
+            "product" = "DaVinci Resolve";
+          };
+
+        } ''
+        RESOLVEURL=$(curl \
+          -s \
+          -H 'Host: www.blackmagicdesign.com' \
+          -H 'Accept: application/json, text/plain, */*' \
+          -H 'Origin: https://www.blackmagicdesign.com' \
+          -H "$USERAGENT" \
+          -H 'Content-Type: application/json;charset=UTF-8' \
+          -H "Referer: https://www.blackmagicdesign.com/support/download/$REFERID/Linux" \
+          -H 'Accept-Encoding: gzip, deflate, br' \
+          -H 'Accept-Language: en-US,en;q=0.9' \
+          -H 'Authority: www.blackmagicdesign.com' \
+          -H 'Cookie: _ga=GA1.2.1849503966.1518103294; _gid=GA1.2.953840595.1518103294' \
+          --data-ascii "$REQJSON" \
+          --compressed \
+          "$SITEURL")
+
+        curl \
+          --retry 3 --retry-delay 3 \
+          -H "Host: sw.blackmagicdesign.com" \
+          -H "Upgrade-Insecure-Requests: 1" \
+          -H "$USERAGENT" \
+          -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8" \
+          -H "Accept-Language: en-US,en;q=0.9" \
+          --compressed \
+          "$RESOLVEURL" \
+          > $out
+      '';
+
+      # The unpack phase won't generate a directory
+      setSourceRoot = ''
+        sourceRoot=$PWD
+      '';
+
+      installPhase = ''
+        runHook preInstall
+
+        export HOME=$PWD/home
+        mkdir -p $HOME
+
+        mkdir -p $out
+        appimage-run ./DaVinci_Resolve_${version}_Linux.run -i -y -n -C $out
+
+        mkdir -p $out/{configs,DolbyVision,easyDCP,Fairlight,GPUCache,logs,Media,"Resolve Disk Database",.crashreport,.license,.LUT}
+        runHook postInstall
+      '';
+
+      dontStrip = true;
+
+      postFixup = ''
+        for program in $out/bin/*; do
+          isELF "$program" || continue
+          addOpenGLRunpath "$program"
+        done
+
+        for program in $out/libs/*; do
+          isELF "$program" || continue
+          if [[ "$program" != *"libcudnn_cnn_infer"* ]];then
+            echo $program
+            addOpenGLRunpath "$program"
+          fi
+        done
+      '';
+    }
+  );
+in
+buildFHSUserEnv {
+  name = "davinci-resolve";
+  targetPkgs = pkgs: with pkgs; [
+    librsvg
+    libGLU
+    libGL
+    xorg.libICE
+    xorg.libSM
+    xorg.libXxf86vm
+    xorg.libxcb
+    udev
+    opencl-headers
+    alsa-lib
+    xorg.libX11
+    xorg.libXext
+    expat
+    zlib
+    libuuid
+    bzip2
+    libtool
+    ocl-icd
+    glib
+    libarchive
+    xdg-utils # xdg-open needed to open URLs
+    python
+    # currently they want python 3.6 which is EOL
+    #python3
+  ];
+
+  runScript = "${bash}/bin/bash ${
+    writeText "davinci-wrapper"
+    ''
+    export QT_XKB_CONFIG_ROOT="${xkeyboard_config}/share/X11/xkb"
+    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:${davinci}/libs
+    ${davinci}/bin/resolve
+    ''
+  }";
+
+  meta = with lib; {
+    description = "Professional Video Editing, Color, Effects and Audio Post";
+    homepage = "https://www.blackmagicdesign.com/products/davinciresolve/";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ jshcmpbll ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/applications/video/entangle/default.nix b/pkgs/applications/video/entangle/default.nix
index 2c7563380895..761a3849c315 100644
--- a/pkgs/applications/video/entangle/default.nix
+++ b/pkgs/applications/video/entangle/default.nix
@@ -1,7 +1,8 @@
 { lib
 , stdenv
 , fetchFromGitLab
-, cmake
+, fetchpatch
+, itstool
 , libxml2
 , meson
 , ninja
@@ -49,10 +50,19 @@ stdenv.mkDerivation rec {
     sha256 = "hz2WSDOjriQSavFlDT+35x1X5MeInq80ZrSP1WR/td0=";
   };
 
+  patches = [
+    # Fix build with meson 0.61, can be removed on next update
+    # https://gitlab.com/entangle/entangle/-/issues/67
+    (fetchpatch {
+      url = "https://gitlab.com/entangle/entangle/-/commit/54795d275a93e94331a614c8712740fcedbdd4f0.patch";
+      sha256 = "iEgqGjKa0xwSdctwvNdEV361l9nx+bz53xn3fuDgtzY=";
+    })
+  ];
+
   nativeBuildInputs = [
-    cmake
-    glib.dev
-    libxml2.bin # for xmllint
+    itstool
+    glib
+    libxml2 # for xmllint
     meson
     ninja
     perl # for pod2man and build scripts
@@ -93,8 +103,6 @@ stdenv.mkDerivation rec {
     libXtst
   ]);
 
-  dontUseCmakeConfigure = true;
-
   # Disable building of doc/reference since it requires network connection to render XML to HTML
   # Patch build script shebangs
   postPatch = ''
diff --git a/pkgs/applications/virtualization/arion/default.nix b/pkgs/applications/virtualization/arion/default.nix
index 33b2b000cbfc..efe13868524b 100644
--- a/pkgs/applications/virtualization/arion/default.nix
+++ b/pkgs/applications/virtualization/arion/default.nix
@@ -16,11 +16,16 @@ let
        - make it self-contained by including docker-compose
    */
   arion =
-    justStaticExecutables (
+    (justStaticExecutables (
       overrideCabal
         cabalOverrides
         arion-compose
-      );
+      )
+    ).overrideAttrs (o: {
+      # Patch away the arion-compose name. Unlike the Haskell library, the program
+      # is called arion (arion was already taken on hackage).
+      pname = "arion";
+    });
 
   inherit (haskell.lib.compose) justStaticExecutables overrideCabal;
 
@@ -31,9 +36,6 @@ let
     passthru = (o.passthru or {}) // {
       inherit eval build;
     };
-    # Patch away the arion-compose name. Unlike the Haskell library, the program
-    # is called arion (arion was already taken on hackage).
-    pname = "arion";
     src = arion-compose.src;
 
     # PYTHONPATH
diff --git a/pkgs/applications/virtualization/podman-tui/default.nix b/pkgs/applications/virtualization/podman-tui/default.nix
index 7a8ed6fed284..17272acd86eb 100644
--- a/pkgs/applications/virtualization/podman-tui/default.nix
+++ b/pkgs/applications/virtualization/podman-tui/default.nix
@@ -11,13 +11,13 @@
 }:
 buildGoModule rec {
   pname = "podman-tui";
-  version = "0.2.0";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "podman-tui";
     rev = "v${version}";
-    sha256 = "sha256-y5bFr31CQ4JES6tjvThyy7qmoKFC59uwtDMG5r+r8K4=";
+    sha256 = "sha256-1WbDmnKyFosp4Kz9QINr3lOR/wD0UW2QZf7nAAaoClM=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/applications/virtualization/podman/default.nix b/pkgs/applications/virtualization/podman/default.nix
index 7d783b211bbd..1f596c609062 100644
--- a/pkgs/applications/virtualization/podman/default.nix
+++ b/pkgs/applications/virtualization/podman/default.nix
@@ -17,13 +17,13 @@
 
 buildGoModule rec {
   pname = "podman";
-  version = "4.0.2";
+  version = "4.0.3";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "podman";
     rev = "v${version}";
-    sha256 = "sha256-uLpvTnn2EWEI8+5gC3ofMjsZ9O7nLOaaUGGuvSE1gdE=";
+    sha256 = "sha256-o/CIs+3LnbaUUpOQI1hijrxH7f1qBnrQw56TJ18jKQw=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/applications/virtualization/spike/default.nix b/pkgs/applications/virtualization/spike/default.nix
index cc2489356c5d..291328ee7fe8 100644
--- a/pkgs/applications/virtualization/spike/default.nix
+++ b/pkgs/applications/virtualization/spike/default.nix
@@ -1,27 +1,19 @@
-{ lib, stdenv, fetchFromGitHub, dtc, fetchpatch, pkgsCross }:
+{ lib, stdenv, fetchFromGitHub, dtc, pkgsCross }:
 
 stdenv.mkDerivation rec {
   pname = "spike";
-  version = "1.0.0";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "riscv";
     repo = "riscv-isa-sim";
     rev = "v${version}";
-    sha256 = "1hcl01nj96s3rkz4mrq747s5lkw81lgdjdimb8b1b9h8qnida7ww";
+    sha256 = "sha256-4D2Fezej0ioOOupw3kgMT5VLs+/jXQjwvek6v0AVMzI=";
   };
 
   nativeBuildInputs = [ dtc ];
   enableParallelBuilding = true;
 
-  patches = [
-    # Add missing headers to fix build.
-    (fetchpatch {
-      url = "https://github.com/riscv/riscv-isa-sim/commit/b3855682c2d744c613d2ffd6b53e3f021ecea4f3.patch";
-      sha256 = "1v1mpp4iddf5n4h3kmj65g075m7xc31bxww7gldnmgl607ma7cnl";
-    })
-  ];
-
   postPatch = ''
     patchShebangs scripts/*.sh
     patchShebangs tests/ebreak.py
@@ -39,7 +31,9 @@ stdenv.mkDerivation rec {
     ''
       runHook preInstallCheck
 
-      $out/bin/spike -m64 ${riscvPkgs.riscv-pk}/bin/pk ${riscvPkgs.hello}/bin/hello | grep -Fq "Hello, world"
+      echo -e "#include<stdio.h>\nint main() {printf(\"Hello, world\");return 0;}" > hello.c
+      ${riscvPkgs.stdenv.cc}/bin/riscv64-none-elf-gcc -o hello hello.c
+      $out/bin/spike -m64 ${riscvPkgs.riscv-pk}/bin/pk hello | grep -Fq "Hello, world"
 
       runHook postInstallCheck
     '';
diff --git a/pkgs/applications/virtualization/virt-viewer/default.nix b/pkgs/applications/virtualization/virt-viewer/default.nix
index 86474da9ee61..95909e36d0c0 100644
--- a/pkgs/applications/virtualization/virt-viewer/default.nix
+++ b/pkgs/applications/virtualization/virt-viewer/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , bash-completion
 , fetchurl
+, fetchpatch
 , gdbm ? null
 , glib
 , gsettings-desktop-schemas
@@ -43,6 +44,15 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-pD+iMlxMHHelyMmAZaww7wURohrJjlkPIjQIabrZq9A=";
   };
 
+  patches = [
+    # Fix build with meson 0.61
+    # https://gitlab.com/virt-viewer/virt-viewer/-/merge_requests/117
+    (fetchpatch {
+      url = "https://gitlab.com/virt-viewer/virt-viewer/-/commit/ed19e51407bee53988878a6ebed4e7279d00b1a1.patch";
+      sha256 = "sha256-3AbnkbhWOh0aNjUkmVoSV/9jFQtvTllOr7plnkntb2o=";
+    })
+  ];
+
   nativeBuildInputs = [
     glib
     intltool