Merge remote-tracking branch 'origin/master' into staging-next

162 files changed, 2819 insertions, 1145 deletions

diff --git a/doc/stdenv/meta.chapter.md b/doc/stdenv/meta.chapter.md
index 51ad29b4b16..a83aa0bd90f 100644
--- a/doc/stdenv/meta.chapter.md
+++ b/doc/stdenv/meta.chapter.md
@@ -213,6 +213,10 @@ runCommand "my-package-test" {
 
 A timeout (in seconds) for building the derivation. If the derivation takes longer than this time to build, it can fail due to breaking the timeout. However, all computers do not have the same computing power, hence some builders may decide to apply a multiplicative factor to this value. When filling this value in, try to keep it approximately consistent with other values already present in `nixpkgs`.
 
+`meta` attributes are not stored in the instantiated derivation.
+Therefore, this setting may be lost when the package is used as a dependency.
+To be effective, it must be presented directly to an evaluation process that handles the `meta.timeout` attribute.
+
 ### `hydraPlatforms` {#var-meta-hydraPlatforms}
 
 The list of Nix platform types for which the Hydra instance at `hydra.nixos.org` will build the package. (Hydra is the Nix-based continuous build system.) It defaults to the value of `meta.platforms`. Thus, the only reason to set `meta.hydraPlatforms` is if you want `hydra.nixos.org` to build the package on a subset of `meta.platforms`, or not at all, e.g.
diff --git a/lib/default.nix b/lib/default.nix
index e2a93e63ac1..0c0e2d5e102 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -23,6 +23,7 @@ let
 
     # packaging
     customisation = callLibs ./customisation.nix;
+    derivations = callLibs ./derivations.nix;
     maintainers = import ../maintainers/maintainer-list.nix;
     teams = callLibs ../maintainers/team-list.nix;
     meta = callLibs ./meta.nix;
@@ -108,6 +109,7 @@ let
     inherit (self.customisation) overrideDerivation makeOverridable
       callPackageWith callPackagesWith extendDerivation hydraJob
       makeScope makeScopeWithSplicing;
+    inherit (self.derivations) lazyDerivation;
     inherit (self.meta) addMetaAttrs dontDistribute setName updateName
       appendToName mapDerivationAttrset setPrio lowPrio lowPrioSet hiPrio
       hiPrioSet getLicenseFromSpdxId getExe;
diff --git a/lib/derivations.nix b/lib/derivations.nix
new file mode 100644
index 00000000000..9a88087f2e3
--- /dev/null
+++ b/lib/derivations.nix
@@ -0,0 +1,101 @@
+{ lib }:
+
+let
+  inherit (lib) throwIfNot;
+in
+{
+  /*
+    Restrict a derivation to a predictable set of attribute names, so
+    that the returned attrset is not strict in the actual derivation,
+    saving a lot of computation when the derivation is non-trivial.
+
+    This is useful in situations where a derivation might only be used for its
+    passthru attributes, improving evaluation performance.
+
+    The returned attribute set is lazy in `derivation`. Specifically, this
+    means that the derivation will not be evaluated in at least the
+    situations below.
+
+    For illustration and/or testing, we define derivation such that its
+    evaluation is very noticable.
+
+        let derivation = throw "This won't be evaluated.";
+
+    In the following expressions, `derivation` will _not_ be evaluated:
+
+        (lazyDerivation { inherit derivation; }).type
+
+        attrNames (lazyDerivation { inherit derivation; })
+
+        (lazyDerivation { inherit derivation; } // { foo = true; }).foo
+
+        (lazyDerivation { inherit derivation; meta.foo = true; }).meta
+
+    In these expressions, it `derivation` _will_ be evaluated:
+
+        "${lazyDerivation { inherit derivation }}"
+
+        (lazyDerivation { inherit derivation }).outPath
+
+        (lazyDerivation { inherit derivation }).meta
+
+    And the following expressions are not valid, because the refer to
+    implementation details and/or attributes that may not be present on
+    some derivations:
+
+        (lazyDerivation { inherit derivation }).buildInputs
+
+        (lazyDerivation { inherit derivation }).passthru
+
+        (lazyDerivation { inherit derivation }).pythonPath
+
+  */
+  lazyDerivation =
+    args@{
+      # The derivation to be wrapped.
+      derivation
+    , # Optional meta attribute.
+      #
+      # While this function is primarily about derivations, it can improve
+      # the `meta` package attribute, which is usually specified through
+      # `mkDerivation`.
+      meta ? null
+    , # Optional extra values to add to the returned attrset.
+      #
+      # This can be used for adding package attributes, such as `tests`.
+      passthru ? { }
+    }:
+    let
+      # These checks are strict in `drv` and some `drv` attributes, but the
+      # attrset spine returned by lazyDerivation does not depend on it.
+      # Instead, the individual derivation attributes do depend on it.
+      checked =
+        throwIfNot (derivation.type or null == "derivation")
+          "lazySimpleDerivation: input must be a derivation."
+          throwIfNot
+          (derivation.outputs == [ "out" ])
+          # Supporting multiple outputs should be a matter of inheriting more attrs.
+          "The derivation ${derivation.name or "<unknown>"} has multiple outputs. This is not supported by lazySimpleDerivation yet. Support could be added, and be useful as long as the set of outputs is known in advance, without evaluating the actual derivation."
+          derivation;
+    in
+    {
+      # Hardcoded `type`
+      #
+      # `lazyDerivation` requires its `derivation` argument to be a derivation,
+      # so if it is not, that is a programming error by the caller and not
+      # something that `lazyDerivation` consumers should be able to correct
+      # for after the fact.
+      # So, to improve laziness, we assume correctness here and check it only
+      # when actual derivation values are accessed later.
+      type = "derivation";
+
+      # A fixed set of derivation values, so that `lazyDerivation` can return
+      # its attrset before evaluating `derivation`.
+      # This must only list attributes that are available on _all_ derivations.
+      inherit (checked) outputs out outPath outputName drvPath name system;
+
+      # The meta attribute can either be taken from the derivation, or if the
+      # `lazyDerivation` caller knew a shortcut, be taken from there.
+      meta = args.meta or checked.meta;
+    } // passthru;
+}
diff --git a/lib/modules.nix b/lib/modules.nix
index b6751d17f8f..46e22088a20 100644
--- a/lib/modules.nix
+++ b/lib/modules.nix
@@ -440,13 +440,14 @@ rec {
           config = addFreeformType (addMeta (m.config or {}));
         }
     else
+      # shorthand syntax
       lib.throwIfNot (isAttrs m) "module ${file} (${key}) does not look like a module."
       { _file = toString m._file or file;
         key = toString m.key or key;
         disabledModules = m.disabledModules or [];
         imports = m.require or [] ++ m.imports or [];
         options = {};
-        config = addFreeformType (addMeta (removeAttrs m ["_file" "key" "disabledModules" "require" "imports" "freeformType"]));
+        config = addFreeformType (removeAttrs m ["_file" "key" "disabledModules" "require" "imports" "freeformType"]);
       };
 
   applyModuleArgsIfFunction = key: f: args@{ config, options, lib, ... }: if isFunction f then
diff --git a/lib/tests/misc.nix b/lib/tests/misc.nix
index 9b1397a7915..74020bc7c8e 100644
--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@@ -1207,6 +1207,59 @@ runTests {
     expected = true;
   };
 
+  # lazyDerivation
+
+  testLazyDerivationIsLazyInDerivationForAttrNames = {
+    expr = attrNames (lazyDerivation {
+      derivation = throw "not lazy enough";
+    });
+    # It's ok to add attribute names here when lazyDerivation is improved
+    # in accordance with its inline comments.
+    expected = [ "drvPath" "meta" "name" "out" "outPath" "outputName" "outputs" "system" "type" ];
+  };
+
+  testLazyDerivationIsLazyInDerivationForPassthruAttr = {
+    expr = (lazyDerivation {
+      derivation = throw "not lazy enough";
+      passthru.tests = "whatever is in tests";
+    }).tests;
+    expected = "whatever is in tests";
+  };
+
+  testLazyDerivationIsLazyInDerivationForPassthruAttr2 = {
+    # passthru.tests is not a special case. It works for any attr.
+    expr = (lazyDerivation {
+      derivation = throw "not lazy enough";
+      passthru.foo = "whatever is in foo";
+    }).foo;
+    expected = "whatever is in foo";
+  };
+
+  testLazyDerivationIsLazyInDerivationForMeta = {
+    expr = (lazyDerivation {
+      derivation = throw "not lazy enough";
+      meta = "whatever is in meta";
+    }).meta;
+    expected = "whatever is in meta";
+  };
+
+  testLazyDerivationReturnsDerivationAttrs = let
+    derivation = {
+      type = "derivation";
+      outputs = ["out"];
+      out = "test out";
+      outPath = "test outPath";
+      outputName = "out";
+      drvPath = "test drvPath";
+      name = "test name";
+      system = "test system";
+      meta = "test meta";
+    };
+  in {
+    expr = lazyDerivation { inherit derivation; };
+    expected = derivation;
+  };
+
   testTypeDescriptionInt = {
     expr = (with types; int).description;
     expected = "signed integer";
diff --git a/lib/tests/modules.sh b/lib/tests/modules.sh
index 2ef7c480659..57d3b5a76ce 100755
--- a/lib/tests/modules.sh
+++ b/lib/tests/modules.sh
@@ -58,6 +58,9 @@ checkConfigError() {
     fi
 }
 
+# Shorthand meta attribute does not duplicate the config
+checkConfigOutput '^"one two"$' config.result ./shorthand-meta.nix
+
 # Check boolean option.
 checkConfigOutput '^false$' config.enable ./declare-enable.nix
 checkConfigError 'The option .* does not exist. Definition values:\n\s*- In .*: true' config.enable ./define-enable.nix
diff --git a/lib/tests/modules/shorthand-meta.nix b/lib/tests/modules/shorthand-meta.nix
new file mode 100644
index 00000000000..8c9619e18a2
--- /dev/null
+++ b/lib/tests/modules/shorthand-meta.nix
@@ -0,0 +1,19 @@
+{ lib, ... }:
+let
+  inherit (lib) types mkOption;
+in
+{
+  imports = [
+    ({ config, ... }: {
+      options = {
+        meta.foo = mkOption {
+          type = types.listOf types.str;
+        };
+        result = mkOption { default = lib.concatStringsSep " " config.meta.foo; };
+      };
+    })
+    {
+      meta.foo = [ "one" "two" ];
+    }
+  ];
+}
diff --git a/nixos/doc/manual/default.nix b/nixos/doc/manual/default.nix
index d61bbaddf76..ecd62eb4e84 100644
--- a/nixos/doc/manual/default.nix
+++ b/nixos/doc/manual/default.nix
@@ -13,6 +13,8 @@
 with pkgs;
 
 let
+  inherit (lib) hasPrefix removePrefix;
+
   lib = pkgs.lib;
 
   docbook_xsl_ns = pkgs.docbook-xsl-ns.override {
@@ -36,6 +38,33 @@ let
     };
   };
 
+  nixos-lib = import ../../lib { };
+
+  testOptionsDoc = let
+      eval = nixos-lib.evalTest {
+        # Avoid evaluating a NixOS config prototype.
+        config.node.type = lib.types.deferredModule;
+        options._module.args = lib.mkOption { internal = true; };
+      };
+    in buildPackages.nixosOptionsDoc {
+      inherit (eval) options;
+      inherit (revision);
+      transformOptions = opt: opt // {
+        # Clean up declaration sites to not refer to the NixOS source tree.
+        declarations =
+          map
+            (decl:
+              if hasPrefix (toString ../../..) (toString decl)
+              then
+                let subpath = removePrefix "/" (removePrefix (toString ../../..) (toString decl));
+                in { url = "https://github.com/NixOS/nixpkgs/blob/master/${subpath}"; name = subpath; }
+              else decl)
+            opt.declarations;
+      };
+      documentType = "none";
+      variablelistId = "test-options-list";
+    };
+
   sources = lib.sourceFilesBySuffices ./. [".xml"];
 
   modulesDoc = builtins.toFile "modules.xml" ''
@@ -50,6 +79,7 @@ let
     mkdir $out
     ln -s ${modulesDoc} $out/modules.xml
     ln -s ${optionsDoc.optionsDocBook} $out/options-db.xml
+    ln -s ${testOptionsDoc.optionsDocBook} $out/test-options-db.xml
     printf "%s" "${version}" > $out/version
   '';
 
diff --git a/nixos/doc/manual/development/running-nixos-tests-interactively.section.md b/nixos/doc/manual/development/running-nixos-tests-interactively.section.md
index a1431859ff5..d9c316f4b13 100644
--- a/nixos/doc/manual/development/running-nixos-tests-interactively.section.md
+++ b/nixos/doc/manual/development/running-nixos-tests-interactively.section.md
@@ -24,6 +24,8 @@ back into the test driver command line upon its completion. This allows
 you to inspect the state of the VMs after the test (e.g. to debug the
 test script).
 
+## Reuse VM state {#sec-nixos-test-reuse-vm-state}
+
 You can re-use the VM states coming from a previous run by setting the
 `--keep-vm-state` flag.
 
@@ -33,3 +35,15 @@ $ ./result/bin/nixos-test-driver --keep-vm-state
 
 The machine state is stored in the `$TMPDIR/vm-state-machinename`
 directory.
+
+## Interactive-only test configuration {#sec-nixos-test-interactive-configuration}
+
+The `.driverInteractive` attribute combines the regular test configuration with
+definitions from the [`interactive` submodule](#opt-interactive). This gives you
+a more usable, graphical, but slightly different configuration.
+
+You can add your own interactive-only test configuration by adding extra
+configuration to the [`interactive` submodule](#opt-interactive).
+
+To interactively run only the regular configuration, build the `<test>.driver` attribute
+instead, and call it with the flag `result/bin/nixos-test-driver --interactive`.
diff --git a/nixos/doc/manual/development/running-nixos-tests.section.md b/nixos/doc/manual/development/running-nixos-tests.section.md
index 1bec023b613..33076f5dc2a 100644
--- a/nixos/doc/manual/development/running-nixos-tests.section.md
+++ b/nixos/doc/manual/development/running-nixos-tests.section.md
@@ -2,22 +2,11 @@
 
 You can run tests using `nix-build`. For example, to run the test
 [`login.nix`](https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/login.nix),
-you just do:
+you do:
 
 ```ShellSession
-$ nix-build '<nixpkgs/nixos/tests/login.nix>'
-```
-
-or, if you don't want to rely on `NIX_PATH`:
-
-```ShellSession
-$ cd /my/nixpkgs/nixos/tests
-$ nix-build login.nix
-…
-running the VM test script
-machine: QEMU running (pid 8841)
-…
-6 out of 6 tests succeeded
+$ cd /my/git/clone/of/nixpkgs
+$ nix-build -A nixosTests.login
 ```
 
 After building/downloading all required dependencies, this will perform
diff --git a/nixos/doc/manual/development/writing-nixos-tests.section.md b/nixos/doc/manual/development/writing-nixos-tests.section.md
index 6934bb0face..99704ec3c14 100644
--- a/nixos/doc/manual/development/writing-nixos-tests.section.md
+++ b/nixos/doc/manual/development/writing-nixos-tests.section.md
@@ -1,9 +1,9 @@
 # Writing Tests {#sec-writing-nixos-tests}
 
-A NixOS test is a Nix expression that has the following structure:
+A NixOS test is a module that has the following structure:
 
 ```nix
-import ./make-test-python.nix {
+{
 
   # One or more machines:
   nodes =
@@ -21,10 +21,13 @@ import ./make-test-python.nix {
 }
 ```
 
-The attribute `testScript` is a bit of Python code that executes the
+We refer to the whole test above as a test module, whereas the values
+in [`nodes.<name>`](#opt-nodes) are NixOS modules themselves.
+
+The option [`testScript`](#opt-testScript) is a piece of Python code that executes the
 test (described below). During the test, it will start one or more
 virtual machines, the configuration of which is described by
-the attribute `nodes`.
+the option [`nodes`](#opt-nodes).
 
 An example of a single-node test is
 [`login.nix`](https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/login.nix).
@@ -34,7 +37,54 @@ when switching between consoles, and so on. An interesting multi-node test is
 [`nfs/simple.nix`](https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/nfs/simple.nix).
 It uses two client nodes to test correct locking across server crashes.
 
-There are a few special NixOS configuration options for test VMs:
+## Calling a test {#sec-calling-nixos-tests}
+
+Tests are invoked differently depending on whether the test is part of NixOS or lives in a different project.
+
+### Testing within NixOS {#sec-call-nixos-test-in-nixos}
+
+Tests that are part of NixOS are added to [`nixos/tests/all-tests.nix`](https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/all-tests.nix).
+
+```nix
+  hostname = runTest ./hostname.nix;
+```
+
+Overrides can be added by defining an anonymous module in `all-tests.nix`.
+
+```nix
+  hostname = runTest {
+    imports = [ ./hostname.nix ];
+    defaults.networking.firewall.enable = false;
+  };
+```
+
+You can run a test with attribute name `hostname` in `nixos/tests/all-tests.nix` by invoking:
+
+```shell
+cd /my/git/clone/of/nixpkgs
+nix-build -A nixosTests.hostname
+```
+
+### Testing outside the NixOS project {#sec-call-nixos-test-outside-nixos}
+
+Outside the `nixpkgs` repository, you can instantiate the test by first importing the NixOS library,
+
+```nix
+let nixos-lib = import (nixpkgs + "/nixos/lib") { };
+in
+
+nixos-lib.runTest {
+  imports = [ ./test.nix ];
+  hostPkgs = pkgs;  # the Nixpkgs package set used outside the VMs
+  defaults.services.foo.package = mypkg;
+}
+```
+
+`runTest` returns a derivation that runs the test.
+
+## Configuring the nodes {#sec-nixos-test-nodes}
+
+There are a few special NixOS options for test VMs:
 
 `virtualisation.memorySize`
 
@@ -121,7 +171,7 @@ The following methods are available on machine objects:
     least one will be returned.
 
     ::: {.note}
-    This requires passing `enableOCR` to the test attribute set.
+    This requires [`enableOCR`](#opt-enableOCR) to be set to `true`.
     :::
 
 `get_screen_text`
@@ -130,7 +180,7 @@ The following methods are available on machine objects:
     machine\'s screen using optical character recognition.
 
     ::: {.note}
-    This requires passing `enableOCR` to the test attribute set.
+    This requires [`enableOCR`](#opt-enableOCR) to be set to `true`.
     :::
 
 `send_monitor_command`
@@ -241,7 +291,7 @@ The following methods are available on machine objects:
     `get_screen_text` and `get_screen_text_variants`).
 
     ::: {.note}
-    This requires passing `enableOCR` to the test attribute set.
+    This requires [`enableOCR`](#opt-enableOCR) to be set to `true`.
     :::
 
 `wait_for_console_text`
@@ -304,7 +354,7 @@ For faster dev cycles it\'s also possible to disable the code-linters
 (this shouldn\'t be commited though):
 
 ```nix
-import ./make-test-python.nix {
+{
   skipLint = true;
   nodes.machine =
     { config, pkgs, ... }:
@@ -336,7 +386,7 @@ Similarly, the type checking of test scripts can be disabled in the following
 way:
 
 ```nix
-import ./make-test-python.nix {
+{
   skipTypeCheck = true;
   nodes.machine =
     { config, pkgs, ... }:
@@ -400,7 +450,6 @@ added using the parameter `extraPythonPackages`. For example, you could add
 `numpy` like this:
 
 ```nix
-import ./make-test-python.nix
 {
   extraPythonPackages = p: [ p.numpy ];
 
@@ -417,3 +466,11 @@ import ./make-test-python.nix
 ```
 
 In that case, `numpy` is chosen from the generic `python3Packages`.
+
+## Test Options Reference {#sec-test-options-reference}
+
+The following options can be used when writing tests.
+
+```{=docbook}
+<xi:include href="../../generated/test-options-db.xml" xpointer="test-options-list"/>
+```
diff --git a/nixos/doc/manual/from_md/development/running-nixos-tests-interactively.section.xml b/nixos/doc/manual/from_md/development/running-nixos-tests-interactively.section.xml
index 0e47350a0d2..35d9bbd1c1f 100644
--- a/nixos/doc/manual/from_md/development/running-nixos-tests-interactively.section.xml
+++ b/nixos/doc/manual/from_md/development/running-nixos-tests-interactively.section.xml
@@ -25,15 +25,40 @@ $ ./result/bin/nixos-test-driver
     completion. This allows you to inspect the state of the VMs after
     the test (e.g. to debug the test script).
   </para>
-  <para>
-    You can re-use the VM states coming from a previous run by setting
-    the <literal>--keep-vm-state</literal> flag.
-  </para>
-  <programlisting>
+  <section xml:id="sec-nixos-test-reuse-vm-state">
+    <title>Reuse VM state</title>
+    <para>
+      You can re-use the VM states coming from a previous run by setting
+      the <literal>--keep-vm-state</literal> flag.
+    </para>
+    <programlisting>
 $ ./result/bin/nixos-test-driver --keep-vm-state
 </programlisting>
-  <para>
-    The machine state is stored in the
-    <literal>$TMPDIR/vm-state-machinename</literal> directory.
-  </para>
+    <para>
+      The machine state is stored in the
+      <literal>$TMPDIR/vm-state-machinename</literal> directory.
+    </para>
+  </section>
+  <section xml:id="sec-nixos-test-interactive-configuration">
+    <title>Interactive-only test configuration</title>
+    <para>
+      The <literal>.driverInteractive</literal> attribute combines the
+      regular test configuration with definitions from the
+      <link linkend="opt-interactive"><literal>interactive</literal>
+      submodule</link>. This gives you a more usable, graphical, but
+      slightly different configuration.
+    </para>
+    <para>
+      You can add your own interactive-only test configuration by adding
+      extra configuration to the
+      <link linkend="opt-interactive"><literal>interactive</literal>
+      submodule</link>.
+    </para>
+    <para>
+      To interactively run only the regular configuration, build the
+      <literal>&lt;test&gt;.driver</literal> attribute instead, and call
+      it with the flag
+      <literal>result/bin/nixos-test-driver --interactive</literal>.
+    </para>
+  </section>
 </section>
diff --git a/nixos/doc/manual/from_md/development/running-nixos-tests.section.xml b/nixos/doc/manual/from_md/development/running-nixos-tests.section.xml
index da2e5076c95..23abb546899 100644
--- a/nixos/doc/manual/from_md/development/running-nixos-tests.section.xml
+++ b/nixos/doc/manual/from_md/development/running-nixos-tests.section.xml
@@ -4,22 +4,11 @@
     You can run tests using <literal>nix-build</literal>. For example,
     to run the test
     <link xlink:href="https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/login.nix"><literal>login.nix</literal></link>,
-    you just do:
+    you do:
   </para>
   <programlisting>
-$ nix-build '&lt;nixpkgs/nixos/tests/login.nix&gt;'
-</programlisting>
-  <para>
-    or, if you don’t want to rely on <literal>NIX_PATH</literal>:
-  </para>
-  <programlisting>
-$ cd /my/nixpkgs/nixos/tests
-$ nix-build login.nix
-…
-running the VM test script
-machine: QEMU running (pid 8841)
-…
-6 out of 6 tests succeeded
+$ cd /my/git/clone/of/nixpkgs
+$ nix-build -A nixosTests.login
 </programlisting>
   <para>
     After building/downloading all required dependencies, this will
diff --git a/nixos/doc/manual/from_md/development/writing-nixos-tests.section.xml b/nixos/doc/manual/from_md/development/writing-nixos-tests.section.xml
index d6f4f61c064..32f5fdb77f5 100644
--- a/nixos/doc/manual/from_md/development/writing-nixos-tests.section.xml
+++ b/nixos/doc/manual/from_md/development/writing-nixos-tests.section.xml
@@ -1,10 +1,10 @@
-<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="sec-writing-nixos-tests">
+<section xmlns="http://docbook.org/ns/docbook"  xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:xi="http://www.w3.org/2001/XInclude" xml:id="sec-writing-nixos-tests">
   <title>Writing Tests</title>
   <para>
-    A NixOS test is a Nix expression that has the following structure:
+    A NixOS test is a module that has the following structure:
   </para>
   <programlisting language="bash">
-import ./make-test-python.nix {
+{
 
   # One or more machines:
   nodes =
@@ -22,10 +22,18 @@ import ./make-test-python.nix {
 }
 </programlisting>
   <para>
-    The attribute <literal>testScript</literal> is a bit of Python code
-    that executes the test (described below). During the test, it will
-    start one or more virtual machines, the configuration of which is
-    described by the attribute <literal>nodes</literal>.
+    We refer to the whole test above as a test module, whereas the
+    values in
+    <link linkend="opt-nodes"><literal>nodes.&lt;name&gt;</literal></link>
+    are NixOS modules themselves.
+  </para>
+  <para>
+    The option
+    <link linkend="opt-testScript"><literal>testScript</literal></link>
+    is a piece of Python code that executes the test (described below).
+    During the test, it will start one or more virtual machines, the
+    configuration of which is described by the option
+    <link linkend="opt-nodes"><literal>nodes</literal></link>.
   </para>
   <para>
     An example of a single-node test is
@@ -38,78 +46,138 @@ import ./make-test-python.nix {
     It uses two client nodes to test correct locking across server
     crashes.
   </para>
-  <para>
-    There are a few special NixOS configuration options for test VMs:
-  </para>
-  <variablelist>
-    <varlistentry>
-      <term>
-        <literal>virtualisation.memorySize</literal>
-      </term>
-      <listitem>
-        <para>
-          The memory of the VM in megabytes.
-        </para>
-      </listitem>
-    </varlistentry>
-    <varlistentry>
-      <term>
-        <literal>virtualisation.vlans</literal>
-      </term>
-      <listitem>
-        <para>
-          The virtual networks to which the VM is connected. See
-          <link xlink:href="https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/nat.nix"><literal>nat.nix</literal></link>
-          for an example.
-        </para>
-      </listitem>
-    </varlistentry>
-    <varlistentry>
-      <term>
-        <literal>virtualisation.writableStore</literal>
-      </term>
-      <listitem>
-        <para>
-          By default, the Nix store in the VM is not writable. If you
-          enable this option, a writable union file system is mounted on
-          top of the Nix store to make it appear writable. This is
-          necessary for tests that run Nix operations that modify the
-          store.
-        </para>
-      </listitem>
-    </varlistentry>
-  </variablelist>
-  <para>
-    For more options, see the module
-    <link xlink:href="https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/virtualisation/qemu-vm.nix"><literal>qemu-vm.nix</literal></link>.
-  </para>
-  <para>
-    The test script is a sequence of Python statements that perform
-    various actions, such as starting VMs, executing commands in the
-    VMs, and so on. Each virtual machine is represented as an object
-    stored in the variable <literal>name</literal> if this is also the
-    identifier of the machine in the declarative config. If you
-    specified a node <literal>nodes.machine</literal>, the following
-    example starts the machine, waits until it has finished booting,
-    then executes a command and checks that the output is more-or-less
-    correct:
-  </para>
-  <programlisting language="python">
+  <section xml:id="sec-calling-nixos-tests">
+    <title>Calling a test</title>
+    <para>
+      Tests are invoked differently depending on whether the test is
+      part of NixOS or lives in a different project.
+    </para>
+    <section xml:id="sec-call-nixos-test-in-nixos">
+      <title>Testing within NixOS</title>
+      <para>
+        Tests that are part of NixOS are added to
+        <link xlink:href="https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/all-tests.nix"><literal>nixos/tests/all-tests.nix</literal></link>.
+      </para>
+      <programlisting language="bash">
+  hostname = runTest ./hostname.nix;
+</programlisting>
+      <para>
+        Overrides can be added by defining an anonymous module in
+        <literal>all-tests.nix</literal>.
+      </para>
+      <programlisting language="bash">
+  hostname = runTest {
+    imports = [ ./hostname.nix ];
+    defaults.networking.firewall.enable = false;
+  };
+</programlisting>
+      <para>
+        You can run a test with attribute name
+        <literal>hostname</literal> in
+        <literal>nixos/tests/all-tests.nix</literal> by invoking:
+      </para>
+      <programlisting>
+cd /my/git/clone/of/nixpkgs
+nix-build -A nixosTests.hostname
+</programlisting>
+    </section>
+    <section xml:id="sec-call-nixos-test-outside-nixos">
+      <title>Testing outside the NixOS project</title>
+      <para>
+        Outside the <literal>nixpkgs</literal> repository, you can
+        instantiate the test by first importing the NixOS library,
+      </para>
+      <programlisting language="bash">
+let nixos-lib = import (nixpkgs + &quot;/nixos/lib&quot;) { };
+in
+
+nixos-lib.runTest {
+  imports = [ ./test.nix ];
+  hostPkgs = pkgs;  # the Nixpkgs package set used outside the VMs
+  defaults.services.foo.package = mypkg;
+}
+</programlisting>
+      <para>
+        <literal>runTest</literal> returns a derivation that runs the
+        test.
+      </para>
+    </section>
+  </section>
+  <section xml:id="sec-nixos-test-nodes">
+    <title>Configuring the nodes</title>
+    <para>
+      There are a few special NixOS options for test VMs:
+    </para>
+    <variablelist>
+      <varlistentry>
+        <term>
+          <literal>virtualisation.memorySize</literal>
+        </term>
+        <listitem>
+          <para>
+            The memory of the VM in megabytes.
+          </para>
+        </listitem>
+      </varlistentry>
+      <varlistentry>
+        <term>
+          <literal>virtualisation.vlans</literal>
+        </term>
+        <listitem>
+          <para>
+            The virtual networks to which the VM is connected. See
+            <link xlink:href="https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/nat.nix"><literal>nat.nix</literal></link>
+            for an example.
+          </para>
+        </listitem>
+      </varlistentry>
+      <varlistentry>
+        <term>
+          <literal>virtualisation.writableStore</literal>
+        </term>
+        <listitem>
+          <para>
+            By default, the Nix store in the VM is not writable. If you
+            enable this option, a writable union file system is mounted
+            on top of the Nix store to make it appear writable. This is
+            necessary for tests that run Nix operations that modify the
+            store.
+          </para>
+        </listitem>
+      </varlistentry>
+    </variablelist>
+    <para>
+      For more options, see the module
+      <link xlink:href="https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/virtualisation/qemu-vm.nix"><literal>qemu-vm.nix</literal></link>.
+    </para>
+    <para>
+      The test script is a sequence of Python statements that perform
+      various actions, such as starting VMs, executing commands in the
+      VMs, and so on. Each virtual machine is represented as an object
+      stored in the variable <literal>name</literal> if this is also the
+      identifier of the machine in the declarative config. If you
+      specified a node <literal>nodes.machine</literal>, the following
+      example starts the machine, waits until it has finished booting,
+      then executes a command and checks that the output is more-or-less
+      correct:
+    </para>
+    <programlisting language="python">
 machine.start()
 machine.wait_for_unit(&quot;default.target&quot;)
 if not &quot;Linux&quot; in machine.succeed(&quot;uname&quot;):
   raise Exception(&quot;Wrong OS&quot;)
 </programlisting>
-  <para>
-    The first line is technically unnecessary; machines are implicitly
-    started when you first execute an action on them (such as
-    <literal>wait_for_unit</literal> or <literal>succeed</literal>). If
-    you have multiple machines, you can speed up the test by starting
-    them in parallel:
-  </para>
-  <programlisting language="python">
+    <para>
+      The first line is technically unnecessary; machines are implicitly
+      started when you first execute an action on them (such as
+      <literal>wait_for_unit</literal> or <literal>succeed</literal>).
+      If you have multiple machines, you can speed up the test by
+      starting them in parallel:
+    </para>
+    <programlisting language="python">
 start_all()
 </programlisting>
+  </section>
   <section xml:id="ssec-machine-objects">
     <title>Machine objects</title>
     <para>
@@ -194,8 +262,9 @@ start_all()
           </para>
           <note>
             <para>
-              This requires passing <literal>enableOCR</literal> to the
-              test attribute set.
+              This requires
+              <link linkend="opt-enableOCR"><literal>enableOCR</literal></link>
+              to be set to <literal>true</literal>.
             </para>
           </note>
         </listitem>
@@ -211,8 +280,9 @@ start_all()
           </para>
           <note>
             <para>
-              This requires passing <literal>enableOCR</literal> to the
-              test attribute set.
+              This requires
+              <link linkend="opt-enableOCR"><literal>enableOCR</literal></link>
+              to be set to <literal>true</literal>.
             </para>
           </note>
         </listitem>
@@ -451,8 +521,9 @@ start_all()
           </para>
           <note>
             <para>
-              This requires passing <literal>enableOCR</literal> to the
-              test attribute set.
+              This requires
+              <link linkend="opt-enableOCR"><literal>enableOCR</literal></link>
+              to be set to <literal>true</literal>.
             </para>
           </note>
         </listitem>
@@ -563,7 +634,7 @@ machine.wait_for_unit(&quot;xautolock.service&quot;, &quot;x-session-user&quot;)
       code-linters (this shouldn't be commited though):
     </para>
     <programlisting language="bash">
-import ./make-test-python.nix {
+{
   skipLint = true;
   nodes.machine =
     { config, pkgs, ... }:
@@ -595,7 +666,7 @@ import ./make-test-python.nix {
       the following way:
     </para>
     <programlisting language="bash">
-import ./make-test-python.nix {
+{
   skipTypeCheck = true;
   nodes.machine =
     { config, pkgs, ... }:
@@ -669,7 +740,6 @@ def foo_running():
       <literal>numpy</literal> like this:
     </para>
     <programlisting language="bash">
-import ./make-test-python.nix
 {
   extraPythonPackages = p: [ p.numpy ];
 
@@ -689,4 +759,11 @@ import ./make-test-python.nix
       <literal>python3Packages</literal>.
     </para>
   </section>
+  <section xml:id="sec-test-options-reference">
+    <title>Test Options Reference</title>
+    <para>
+      The following options can be used when writing tests.
+    </para>
+    <xi:include href="../../generated/test-options-db.xml" xpointer="test-options-list"/>
+  </section>
 </section>
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
index 566001c06bf..009b57bad86 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
@@ -719,6 +719,21 @@
       </listitem>
       <listitem>
         <para>
+          systemd-oomd is enabled by default. Depending on which systemd
+          units have <literal>ManagedOOMSwap=kill</literal> or
+          <literal>ManagedOOMMemoryPressure=kill</literal>, systemd-oomd
+          will SIGKILL all the processes under the appropriate
+          descendant cgroups when the configured limits are exceeded.
+          NixOS does currently not configure cgroups with oomd by
+          default, this can be enabled using
+          <link xlink:href="options.html#opt-systemd.oomd.enableRootSlice">systemd.oomd.enableRootSlice</link>,
+          <link xlink:href="options.html#opt-systemd.oomd.enableSystemSlice">systemd.oomd.enableSystemSlice</link>,
+          and
+          <link xlink:href="options.html#opt-systemd.oomd.enableUserServices">systemd.oomd.enableUserServices</link>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
           The <literal>pass-secret-service</literal> package now
           includes systemd units from upstream, so adding it to the
           NixOS <literal>services.dbus.packages</literal> option will
diff --git a/nixos/doc/manual/release-notes/rl-2211.section.md b/nixos/doc/manual/release-notes/rl-2211.section.md
index 8ab9f27edb9..b4e051a841f 100644
--- a/nixos/doc/manual/release-notes/rl-2211.section.md
+++ b/nixos/doc/manual/release-notes/rl-2211.section.md
@@ -235,6 +235,15 @@ Available as [services.patroni](options.html#opt-services.patroni.enable).
 
 - Add udev rules for the Teensy family of microcontrollers.
 
+- systemd-oomd is enabled by default. Depending on which systemd units have
+  `ManagedOOMSwap=kill` or `ManagedOOMMemoryPressure=kill`, systemd-oomd will
+  SIGKILL all the processes under the appropriate descendant cgroups when the
+  configured limits are exceeded. NixOS does currently not configure cgroups
+  with oomd by default, this can be enabled using
+  [systemd.oomd.enableRootSlice](options.html#opt-systemd.oomd.enableRootSlice),
+  [systemd.oomd.enableSystemSlice](options.html#opt-systemd.oomd.enableSystemSlice),
+  and [systemd.oomd.enableUserServices](options.html#opt-systemd.oomd.enableUserServices).
+
 - The `pass-secret-service` package now includes systemd units from upstream, so adding it to the NixOS `services.dbus.packages` option will make it start automatically as a systemd user service when an application tries to talk to the libsecret D-Bus API.
 
 - There is a new module for AMD SEV CPU functionality, which grants access to the hardware.
diff --git a/nixos/lib/build-vms.nix b/nixos/lib/build-vms.nix
deleted file mode 100644
index 18af49db177..00000000000
--- a/nixos/lib/build-vms.nix
+++ /dev/null
@@ -1,113 +0,0 @@
-{ system
-, # Use a minimal kernel?
-  minimal ? false
-, # Ignored
-  config ? null
-, # Nixpkgs, for qemu, lib and more
-  pkgs, lib
-, # !!! See comment about args in lib/modules.nix
-  specialArgs ? {}
-, # NixOS configuration to add to the VMs
-  extraConfigurations ? []
-}:
-
-with lib;
-
-rec {
-
-  inherit pkgs;
-
-  # Build a virtual network from an attribute set `{ machine1 =
-  # config1; ... machineN = configN; }', where `machineX' is the
-  # hostname and `configX' is a NixOS system configuration.  Each
-  # machine is given an arbitrary IP address in the virtual network.
-  buildVirtualNetwork =
-    nodes: let nodesOut = mapAttrs (n: buildVM nodesOut) (assignIPAddresses nodes); in nodesOut;
-
-
-  buildVM =
-    nodes: configurations:
-
-    import ./eval-config.nix {
-      inherit system specialArgs;
-      modules = configurations ++ extraConfigurations;
-      baseModules =  (import ../modules/module-list.nix) ++
-        [ ../modules/virtualisation/qemu-vm.nix
-          ../modules/testing/test-instrumentation.nix # !!! should only get added for automated test runs
-          { key = "no-manual"; documentation.nixos.enable = false; }
-          { key = "no-revision";
-            # Make the revision metadata constant, in order to avoid needless retesting.
-            # The human version (e.g. 21.05-pre) is left as is, because it is useful
-            # for external modules that test with e.g. testers.nixosTest and rely on that
-            # version number.
-            config.system.nixos.revision = mkForce "constant-nixos-revision";
-          }
-          { key = "nodes"; _module.args.nodes = nodes; }
-        ] ++ optional minimal ../modules/testing/minimal-kernel.nix;
-    };
-
-
-  # Given an attribute set { machine1 = config1; ... machineN =
-  # configN; }, sequentially assign IP addresses in the 192.168.1.0/24
-  # range to each machine, and set the hostname to the attribute name.
-  assignIPAddresses = nodes:
-
-    let
-
-      machines = attrNames nodes;
-
-      machinesNumbered = zipLists machines (range 1 254);
-
-      nodes_ = forEach machinesNumbered (m: nameValuePair m.fst
-        [ ( { config, nodes, ... }:
-            let
-              interfacesNumbered = zipLists config.virtualisation.vlans (range 1 255);
-              interfaces = forEach interfacesNumbered ({ fst, snd }:
-                nameValuePair "eth${toString snd}" { ipv4.addresses =
-                  [ { address = "192.168.${toString fst}.${toString m.snd}";
-                      prefixLength = 24;
-                  } ];
-                });
-
-              networkConfig =
-                { networking.hostName = mkDefault m.fst;
-
-                  networking.interfaces = listToAttrs interfaces;
-
-                  networking.primaryIPAddress =
-                    optionalString (interfaces != []) (head (head interfaces).value.ipv4.addresses).address;
-
-                  # Put the IP addresses of all VMs in this machine's
-                  # /etc/hosts file.  If a machine has multiple
-                  # interfaces, use the IP address corresponding to
-                  # the first interface (i.e. the first network in its
-                  # virtualisation.vlans option).
-                  networking.extraHosts = flip concatMapStrings machines
-                    (m': let config = (getAttr m' nodes).config; in
-                      optionalString (config.networking.primaryIPAddress != "")
-                        ("${config.networking.primaryIPAddress} " +
-                         optionalString (config.networking.domain != null)
-                           "${config.networking.hostName}.${config.networking.domain} " +
-                         "${config.networking.hostName}\n"));
-
-                  virtualisation.qemu.options =
-                    let qemu-common = import ../lib/qemu-common.nix { inherit lib pkgs; };
-                    in flip concatMap interfacesNumbered
-                      ({ fst, snd }: qemu-common.qemuNICFlags snd fst m.snd);
-                };
-
-              in
-                { key = "ip-address";
-                  config = networkConfig // {
-                    # Expose the networkConfig items for tests like nixops
-                    # that need to recreate the network config.
-                    system.build.networkConfig = networkConfig;
-                  };
-                }
-          )
-          (getAttr m.fst nodes)
-        ] );
-
-    in listToAttrs nodes_;
-
-}
diff --git a/nixos/lib/default.nix b/nixos/lib/default.nix
index 2b3056e0145..65d91342d4d 100644
--- a/nixos/lib/default.nix
+++ b/nixos/lib/default.nix
@@ -21,6 +21,8 @@ let
   seqAttrsIf = cond: a: lib.mapAttrs (_: v: seqIf cond a v);
 
   eval-config-minimal = import ./eval-config-minimal.nix { inherit lib; };
+
+  testing-lib = import ./testing/default.nix { inherit lib; };
 in
 /*
   This attribute set appears as lib.nixos in the flake, or can be imported
@@ -30,4 +32,10 @@ in
   inherit (seqAttrsIf (!featureFlags?minimalModules) minimalModulesWarning eval-config-minimal)
     evalModules
     ;
+
+  inherit (testing-lib)
+    evalTest
+    runTest
+    ;
+
 }
diff --git a/nixos/lib/eval-config.nix b/nixos/lib/eval-config.nix
index 791a03a3ba3..1e086271e52 100644
--- a/nixos/lib/eval-config.nix
+++ b/nixos/lib/eval-config.nix
@@ -17,6 +17,8 @@ evalConfigArgs@
   # be set modularly anyway.
   pkgs ? null
 , # !!! what do we gain by making this configurable?
+  #     we can add modules that are included in specialisations, regardless
+  #     of inheritParentConfig.
   baseModules ? import ../modules/module-list.nix
 , # !!! See comment about args in lib/modules.nix
   extraArgs ? {}
diff --git a/nixos/lib/testing-python.nix b/nixos/lib/testing-python.nix
index 4bb1689ffd7..c303b0bf17b 100644
--- a/nixos/lib/testing-python.nix
+++ b/nixos/lib/testing-python.nix
@@ -12,159 +12,22 @@
 
 with pkgs;
 
+let
+  nixos-lib = import ./default.nix { inherit (pkgs) lib; };
+in
+
 rec {
 
   inherit pkgs;
 
-  # Run an automated test suite in the given virtual network.
-  runTests = { driver, driverInteractive, pos }:
-    stdenv.mkDerivation {
-      name = "vm-test-run-${driver.testName}";
-
-      requiredSystemFeatures = [ "kvm" "nixos-test" ];
-
-      buildCommand =
-        ''
-          mkdir -p $out
-
-          # effectively mute the XMLLogger
-          export LOGFILE=/dev/null
-
-          ${driver}/bin/nixos-test-driver -o $out
-        '';
+  evalTest = module: nixos-lib.evalTest { imports = [ extraTestModule module ]; };
+  runTest = module: nixos-lib.runTest { imports = [ extraTestModule module ]; };
 
-      passthru = driver.passthru // {
-        inherit driver driverInteractive;
-      };
-
-      inherit pos; # for better debugging
+  extraTestModule = {
+    config = {
+      hostPkgs = pkgs;
     };
-
-  # Generate convenience wrappers for running the test driver
-  # has vlans, vms and test script defaulted through env variables
-  # also instantiates test script with nodes, if it's a function (contract)
-  setupDriverForTest = {
-      testScript
-    , testName
-    , nodes
-    , qemu_pkg ? pkgs.qemu_test
-    , enableOCR ? false
-    , skipLint ? false
-    , skipTypeCheck ? false
-    , passthru ? {}
-    , interactive ? false
-    , extraPythonPackages ? (_ :[])
-  }:
-    let
-      # Reifies and correctly wraps the python test driver for
-      # the respective qemu version and with or without ocr support
-      testDriver = pkgs.callPackage ./test-driver {
-        inherit enableOCR extraPythonPackages;
-        qemu_pkg = qemu_test;
-        imagemagick_light = imagemagick_light.override { inherit libtiff; };
-        tesseract4 = tesseract4.override { enableLanguages = [ "eng" ]; };
-      };
-
-
-      testDriverName =
-        let
-          # A standard store path to the vm monitor is built like this:
-          #   /tmp/nix-build-vm-test-run-$name.drv-0/vm-state-machine/monitor
-          # The max filename length of a unix domain socket is 108 bytes.
-          # This means $name can at most be 50 bytes long.
-          maxTestNameLen = 50;
-          testNameLen = builtins.stringLength testName;
-        in with builtins;
-          if testNameLen > maxTestNameLen then
-            abort
-              ("The name of the test '${testName}' must not be longer than ${toString maxTestNameLen} " +
-                "it's currently ${toString testNameLen} characters long.")
-          else
-            "nixos-test-driver-${testName}";
-
-      vlans = map (m: m.config.virtualisation.vlans) (lib.attrValues nodes);
-      vms = map (m: m.config.system.build.vm) (lib.attrValues nodes);
-
-      nodeHostNames = let
-        nodesList = map (c: c.config.system.name) (lib.attrValues nodes);
-      in nodesList ++ lib.optional (lib.length nodesList == 1 && !lib.elem "machine" nodesList) "machine";
-
-      # TODO: This is an implementation error and needs fixing
-      # the testing famework cannot legitimately restrict hostnames further
-      # beyond RFC1035
-      invalidNodeNames = lib.filter
-        (node: builtins.match "^[A-z_]([A-z0-9_]+)?$" node == null)
-        nodeHostNames;
-
-      testScript' =
-        # Call the test script with the computed nodes.
-        if lib.isFunction testScript
-        then testScript { inherit nodes; }
-        else testScript;
-
-      uniqueVlans = lib.unique (builtins.concatLists vlans);
-      vlanNames = map (i: "vlan${toString i}: VLan;") uniqueVlans;
-      machineNames = map (name: "${name}: Machine;") nodeHostNames;
-    in
-    if lib.length invalidNodeNames > 0 then
-      throw ''
-        Cannot create machines out of (${lib.concatStringsSep ", " invalidNodeNames})!
-        All machines are referenced as python variables in the testing framework which will break the
-        script when special characters are used.
-
-        This is an IMPLEMENTATION ERROR and needs to be fixed. Meanwhile,
-        please stick to alphanumeric chars and underscores as separation.
-      ''
-    else lib.warnIf skipLint "Linting is disabled" (runCommand testDriverName
-      {
-        inherit testName;
-        nativeBuildInputs = [ makeWrapper mypy ];
-        buildInputs = [ testDriver ];
-        testScript = testScript';
-        preferLocalBuild = true;
-        passthru = passthru // {
-          inherit nodes;
-        };
-        meta.mainProgram = "nixos-test-driver";
-      }
-      ''
-        mkdir -p $out/bin
-
-        vmStartScripts=($(for i in ${toString vms}; do echo $i/bin/run-*-vm; done))
-
-        ${lib.optionalString (!skipTypeCheck) ''
-          # prepend type hints so the test script can be type checked with mypy
-          cat "${./test-script-prepend.py}" >> testScriptWithTypes
-          echo "${builtins.toString machineNames}" >> testScriptWithTypes
-          echo "${builtins.toString vlanNames}" >> testScriptWithTypes
-          echo -n "$testScript" >> testScriptWithTypes
-
-          mypy  --no-implicit-optional \
-                --pretty \
-                --no-color-output \
-                testScriptWithTypes
-        ''}
-
-        echo -n "$testScript" >> $out/test-script
-
-        ln -s ${testDriver}/bin/nixos-test-driver $out/bin/nixos-test-driver
-
-        ${testDriver}/bin/generate-driver-symbols
-        ${lib.optionalString (!skipLint) ''
-          PYFLAKES_BUILTINS="$(
-            echo -n ${lib.escapeShellArg (lib.concatStringsSep "," nodeHostNames)},
-            < ${lib.escapeShellArg "driver-symbols"}
-          )" ${python3Packages.pyflakes}/bin/pyflakes $out/test-script
-        ''}
-
-        # set defaults through environment
-        # see: ./test-driver/test-driver.py argparse implementation
-        wrapProgram $out/bin/nixos-test-driver \
-          --set startScripts "''${vmStartScripts[*]}" \
-          --set testScript "$out/test-script" \
-          --set vlans '${toString vlans}' \
-          ${lib.optionalString (interactive) "--add-flags --interactive"}
-      '');
+  };
 
   # Make a full-blown test
   makeTest =
@@ -184,91 +47,20 @@ rec {
           then builtins.unsafeGetAttrPos "description" meta
           else builtins.unsafeGetAttrPos "testScript" t)
     , extraPythonPackages ? (_ : [])
+    , interactive ? {}
     } @ t:
-    let
-      mkNodes = qemu_pkg:
-        let
-          testScript' =
-            # Call the test script with the computed nodes.
-            if lib.isFunction testScript
-            then testScript { nodes = mkNodes qemu_pkg; }
-            else testScript;
-
-          build-vms = import ./build-vms.nix {
-            inherit system lib pkgs minimal specialArgs;
-            extraConfigurations = extraConfigurations ++ [(
-              { config, ... }:
-              {
-                virtualisation.qemu.package = qemu_pkg;
-
-                # Make sure all derivations referenced by the test
-                # script are available on the nodes. When the store is
-                # accessed through 9p, this isn't important, since
-                # everything in the store is available to the guest,
-                # but when building a root image it is, as all paths
-                # that should be available to the guest has to be
-                # copied to the image.
-                virtualisation.additionalPaths =
-                  lib.optional
-                    # A testScript may evaluate nodes, which has caused
-                    # infinite recursions. The demand cycle involves:
-                    #   testScript -->
-                    #   nodes -->
-                    #   toplevel -->
-                    #   additionalPaths -->
-                    #   hasContext testScript' -->
-                    #   testScript (ad infinitum)
-                    # If we don't need to build an image, we can break this
-                    # cycle by short-circuiting when useNixStoreImage is false.
-                    (config.virtualisation.useNixStoreImage && builtins.hasContext testScript')
-                    (pkgs.writeStringReferencesToFile testScript');
-
-                # Ensure we do not use aliases. Ideally this is only set
-                # when the test framework is used by Nixpkgs NixOS tests.
-                nixpkgs.config.allowAliases = false;
-              }
-            )];
-          };
-        in
-          lib.warnIf (t?machine) "In test `${name}': The `machine' attribute in NixOS tests (pkgs.nixosTest / make-test-python.nix / testing-python.nix / makeTest) is deprecated. Please use the equivalent `nodes.machine'."
-          build-vms.buildVirtualNetwork (
-              nodes // lib.optionalAttrs (machine != null) { inherit machine; }
-          );
-
-      driver = setupDriverForTest {
-        inherit testScript enableOCR skipTypeCheck skipLint passthru extraPythonPackages;
-        testName = name;
-        qemu_pkg = pkgs.qemu_test;
-        nodes = mkNodes pkgs.qemu_test;
-      };
-      driverInteractive = setupDriverForTest {
-        inherit testScript enableOCR skipTypeCheck skipLint passthru extraPythonPackages;
-        testName = name;
-        qemu_pkg = pkgs.qemu;
-        nodes = mkNodes pkgs.qemu;
-        interactive = true;
+      runTest {
+        imports = [
+          { _file = "makeTest parameters"; config = t; }
+          {
+            defaults = {
+              _file = "makeTest: extraConfigurations";
+              imports = extraConfigurations;
+            };
+          }
+        ];
       };
 
-      test = lib.addMetaAttrs meta (runTests { inherit driver pos driverInteractive; });
-
-    in
-      test // {
-        inherit test driver driverInteractive;
-        inherit (driver) nodes;
-      };
-
-  abortForFunction = functionName: abort ''The ${functionName} function was
-    removed because it is not an essential part of the NixOS testing
-    infrastructure. It had no usage in NixOS or Nixpkgs and it had no designated
-    maintainer. You are free to reintroduce it by documenting it in the manual
-    and adding yourself as maintainer. It was removed in
-    https://github.com/NixOS/nixpkgs/pull/137013
-  '';
-
-  runInMachine = abortForFunction "runInMachine";
-
-  runInMachineWithX = abortForFunction "runInMachineWithX";
-
   simpleTest = as: (makeTest as).test;
 
 }
diff --git a/nixos/lib/testing/call-test.nix b/nixos/lib/testing/call-test.nix
new file mode 100644
index 00000000000..3e137e78cd4
--- /dev/null
+++ b/nixos/lib/testing/call-test.nix
@@ -0,0 +1,16 @@
+{ config, lib, ... }:
+let
+  inherit (lib) mkOption types;
+in
+{
+  options = {
+    callTest = mkOption {
+      internal = true;
+      type = types.functionTo types.raw;
+    };
+    result = mkOption {
+      internal = true;
+      default = config;
+    };
+  };
+}
diff --git a/nixos/lib/testing/default.nix b/nixos/lib/testing/default.nix
new file mode 100644
index 00000000000..676d52f5c3f
--- /dev/null
+++ b/nixos/lib/testing/default.nix
@@ -0,0 +1,24 @@
+{ lib }:
+let
+
+  evalTest = module: lib.evalModules { modules = testModules ++ [ module ]; };
+  runTest = module: (evalTest module).config.result;
+
+  testModules = [
+    ./call-test.nix
+    ./driver.nix
+    ./interactive.nix
+    ./legacy.nix
+    ./meta.nix
+    ./name.nix
+    ./network.nix
+    ./nodes.nix
+    ./pkgs.nix
+    ./run.nix
+    ./testScript.nix
+  ];
+
+in
+{
+  inherit evalTest runTest testModules;
+}
diff --git a/nixos/lib/testing/driver.nix b/nixos/lib/testing/driver.nix
new file mode 100644
index 00000000000..04e99f9e21d
--- /dev/null
+++ b/nixos/lib/testing/driver.nix
@@ -0,0 +1,188 @@
+{ config, lib, hostPkgs, ... }:
+let
+  inherit (lib) mkOption types literalMD mdDoc;
+
+  # Reifies and correctly wraps the python test driver for
+  # the respective qemu version and with or without ocr support
+  testDriver = hostPkgs.callPackage ../test-driver {
+    inherit (config) enableOCR extraPythonPackages;
+    qemu_pkg = config.qemu.package;
+    imagemagick_light = hostPkgs.imagemagick_light.override { inherit (hostPkgs) libtiff; };
+    tesseract4 = hostPkgs.tesseract4.override { enableLanguages = [ "eng" ]; };
+  };
+
+
+  vlans = map (m: m.virtualisation.vlans) (lib.attrValues config.nodes);
+  vms = map (m: m.system.build.vm) (lib.attrValues config.nodes);
+
+  nodeHostNames =
+    let
+      nodesList = map (c: c.system.name) (lib.attrValues config.nodes);
+    in
+    nodesList ++ lib.optional (lib.length nodesList == 1 && !lib.elem "machine" nodesList) "machine";
+
+  # TODO: This is an implementation error and needs fixing
+  # the testing famework cannot legitimately restrict hostnames further
+  # beyond RFC1035
+  invalidNodeNames = lib.filter
+    (node: builtins.match "^[A-z_]([A-z0-9_]+)?$" node == null)
+    nodeHostNames;
+
+  uniqueVlans = lib.unique (builtins.concatLists vlans);
+  vlanNames = map (i: "vlan${toString i}: VLan;") uniqueVlans;
+  machineNames = map (name: "${name}: Machine;") nodeHostNames;
+
+  withChecks =
+    if lib.length invalidNodeNames > 0 then
+      throw ''
+        Cannot create machines out of (${lib.concatStringsSep ", " invalidNodeNames})!
+        All machines are referenced as python variables in the testing framework which will break the
+        script when special characters are used.
+
+        This is an IMPLEMENTATION ERROR and needs to be fixed. Meanwhile,
+        please stick to alphanumeric chars and underscores as separation.
+      ''
+    else
+      lib.warnIf config.skipLint "Linting is disabled";
+
+  driver =
+    hostPkgs.runCommand "nixos-test-driver-${config.name}"
+      {
+        # inherit testName; TODO (roberth): need this?
+        nativeBuildInputs = [
+          hostPkgs.makeWrapper
+        ] ++ lib.optionals (!config.skipTypeCheck) [ hostPkgs.mypy ];
+        buildInputs = [ testDriver ];
+        testScript = config.testScriptString;
+        preferLocalBuild = true;
+        passthru = config.passthru;
+        meta = config.meta // {
+          mainProgram = "nixos-test-driver";
+        };
+      }
+      ''
+        mkdir -p $out/bin
+
+        vmStartScripts=($(for i in ${toString vms}; do echo $i/bin/run-*-vm; done))
+
+        ${lib.optionalString (!config.skipTypeCheck) ''
+          # prepend type hints so the test script can be type checked with mypy
+          cat "${../test-script-prepend.py}" >> testScriptWithTypes
+          echo "${builtins.toString machineNames}" >> testScriptWithTypes
+          echo "${builtins.toString vlanNames}" >> testScriptWithTypes
+          echo -n "$testScript" >> testScriptWithTypes
+
+          cat -n testScriptWithTypes
+
+          mypy  --no-implicit-optional \
+                --pretty \
+                --no-color-output \
+                testScriptWithTypes
+        ''}
+
+        echo -n "$testScript" >> $out/test-script
+
+        ln -s ${testDriver}/bin/nixos-test-driver $out/bin/nixos-test-driver
+
+        ${testDriver}/bin/generate-driver-symbols
+        ${lib.optionalString (!config.skipLint) ''
+          PYFLAKES_BUILTINS="$(
+            echo -n ${lib.escapeShellArg (lib.concatStringsSep "," nodeHostNames)},
+            < ${lib.escapeShellArg "driver-symbols"}
+          )" ${hostPkgs.python3Packages.pyflakes}/bin/pyflakes $out/test-script
+        ''}
+
+        # set defaults through environment
+        # see: ./test-driver/test-driver.py argparse implementation
+        wrapProgram $out/bin/nixos-test-driver \
+          --set startScripts "''${vmStartScripts[*]}" \
+          --set testScript "$out/test-script" \
+          --set vlans '${toString vlans}' \
+          ${lib.escapeShellArgs (lib.concatMap (arg: ["--add-flags" arg]) config.extraDriverArgs)}
+      '';
+
+in
+{
+  options = {
+
+    driver = mkOption {
+      description = mdDoc "Package containing a script that runs the test.";
+      type = types.package;
+      defaultText = literalMD "set by the test framework";
+    };
+
+    hostPkgs = mkOption {
+      description = mdDoc "Nixpkgs attrset used outside the nodes.";
+      type = types.raw;
+      example = lib.literalExpression ''
+        import nixpkgs { inherit system config overlays; }
+      '';
+    };
+
+    qemu.package = mkOption {
+      description = mdDoc "Which qemu package to use for the virtualisation of [{option}`nodes`](#opt-nodes).";
+      type = types.package;
+      default = hostPkgs.qemu_test;
+      defaultText = "hostPkgs.qemu_test";
+    };
+
+    enableOCR = mkOption {
+      description = mdDoc ''
+        Whether to enable Optical Character Recognition functionality for
+        testing graphical programs. See [Machine objects](`ssec-machine-objects`).
+      '';
+      type = types.bool;
+      default = false;
+    };
+
+    extraPythonPackages = mkOption {
+      description = mdDoc ''
+        Python packages to add to the test driver.
+
+        The argument is a Python package set, similar to `pkgs.pythonPackages`.
+      '';
+      example = lib.literalExpression ''
+        p: [ p.numpy ]
+      '';
+      type = types.functionTo (types.listOf types.package);
+      default = ps: [ ];
+    };
+
+    extraDriverArgs = mkOption {
+      description = mdDoc ''
+        Extra arguments to pass to the test driver.
+
+        They become part of [{option}`driver`](#opt-driver) via `wrapProgram`.
+      '';
+      type = types.listOf types.str;
+      default = [];
+    };
+
+    skipLint = mkOption {
+      type = types.bool;
+      default = false;
+      description = mdDoc ''
+        Do not run the linters. This may speed up your iteration cycle, but it is not something you should commit.
+      '';
+    };
+
+    skipTypeCheck = mkOption {
+      type = types.bool;
+      default = false;
+      description = mdDoc ''
+        Disable type checking. This must not be enabled for new NixOS tests.
+
+        This may speed up your iteration cycle, unless you're working on the [{option}`testScript`](#opt-testScript).
+      '';
+    };
+  };
+
+  config = {
+    _module.args.hostPkgs = config.hostPkgs;
+
+    driver = withChecks driver;
+
+    # make available on the test runner
+    passthru.driver = config.driver;
+  };
+}
diff --git a/nixos/lib/testing/interactive.nix b/nixos/lib/testing/interactive.nix
new file mode 100644
index 00000000000..317ed424188
--- /dev/null
+++ b/nixos/lib/testing/interactive.nix
@@ -0,0 +1,45 @@
+{ config, lib, moduleType, hostPkgs, ... }:
+let
+  inherit (lib) mkOption types mdDoc;
+in
+{
+  options = {
+    interactive = mkOption {
+      description = mdDoc ''
+        Tests [can be run interactively](#sec-running-nixos-tests-interactively)
+        using the program in the test derivation's `.driverInteractive` attribute.
+
+        When they are, the configuration will include anything set in this submodule.
+
+        You can set any top-level test option here.
+
+        Example test module:
+
+        ```nix
+        { config, lib, ... }: {
+
+          nodes.rabbitmq = {
+            services.rabbitmq.enable = true;
+          };
+
+          # When running interactively ...
+          interactive.nodes.rabbitmq = {
+            # ... enable the web ui.
+            services.rabbitmq.managementPlugin.enable = true;
+          };
+        }
+        ```
+
+        For details, see the section about [running tests interactively](#sec-running-nixos-tests-interactively).
+      '';
+      type = moduleType;
+      visible = "shallow";
+    };
+  };
+
+  config = {
+    interactive.qemu.package = hostPkgs.qemu;
+    interactive.extraDriverArgs = [ "--interactive" ];
+    passthru.driverInteractive = config.interactive.driver;
+  };
+}
diff --git a/nixos/lib/testing/legacy.nix b/nixos/lib/testing/legacy.nix
new file mode 100644
index 00000000000..868b8b65b17
--- /dev/null
+++ b/nixos/lib/testing/legacy.nix
@@ -0,0 +1,25 @@
+{ config, options, lib, ... }:
+let
+  inherit (lib) mkIf mkOption types;
+in
+{
+  # This needs options.warnings, which we don't have (yet?).
+  # imports = [
+  #   (lib.mkRenamedOptionModule [ "machine" ] [ "nodes" "machine" ])
+  # ];
+
+  options = {
+    machine = mkOption {
+      internal = true;
+      type = types.raw;
+    };
+  };
+
+  config = {
+    nodes = mkIf options.machine.isDefined (
+      lib.warn
+        "In test `${config.name}': The `machine' attribute in NixOS tests (pkgs.nixosTest / make-test-python.nix / testing-python.nix / makeTest) is deprecated. Please set the equivalent `nodes.machine'."
+        { inherit (config) machine; }
+    );
+  };
+}
diff --git a/nixos/lib/testing/meta.nix b/nixos/lib/testing/meta.nix
new file mode 100644
index 00000000000..4d8b0e0f1c4
--- /dev/null
+++ b/nixos/lib/testing/meta.nix
@@ -0,0 +1,42 @@
+{ lib, ... }:
+let
+  inherit (lib) types mkOption mdDoc;
+in
+{
+  options = {
+    meta = lib.mkOption {
+      description = mdDoc ''
+        The [`meta`](https://nixos.org/manual/nixpkgs/stable/#chap-meta) attributes that will be set on the returned derivations.
+
+        Not all [`meta`](https://nixos.org/manual/nixpkgs/stable/#chap-meta) attributes are supported, but more can be added as desired.
+      '';
+      apply = lib.filterAttrs (k: v: v != null);
+      type = types.submodule {
+        options = {
+          maintainers = lib.mkOption {
+            type = types.listOf types.raw;
+            default = [];
+            description = mdDoc ''
+              The [list of maintainers](https://nixos.org/manual/nixpkgs/stable/#var-meta-maintainers) for this test.
+            '';
+          };
+          timeout = lib.mkOption {
+            type = types.nullOr types.int;
+            default = null; # NOTE: null values are filtered out by `meta`.
+            description = mdDoc ''
+              The [{option}`test`](#opt-test)'s [`meta.timeout`](https://nixos.org/manual/nixpkgs/stable/#var-meta-timeout) in seconds.
+            '';
+          };
+          broken = lib.mkOption {
+            type = types.bool;
+            default = false;
+            description = mdDoc ''
+              Sets the [`meta.broken`](https://nixos.org/manual/nixpkgs/stable/#var-meta-broken) attribute on the [{option}`test`](#opt-test) derivation.
+            '';
+          };
+        };
+      };
+      default = {};
+    };
+  };
+}
diff --git a/nixos/lib/testing/name.nix b/nixos/lib/testing/name.nix
new file mode 100644
index 00000000000..a54622e139b
--- /dev/null
+++ b/nixos/lib/testing/name.nix
@@ -0,0 +1,14 @@
+{ lib, ... }:
+let
+  inherit (lib) mkOption types mdDoc;
+in
+{
+  options.name = mkOption {
+    description = mdDoc ''
+      The name of the test.
+
+      This is used in the derivation names of the [{option}`driver`](#opt-driver) and [{option}`test`](#opt-test) runner.
+    '';
+    type = types.str;
+  };
+}
diff --git a/nixos/lib/testing/network.nix b/nixos/lib/testing/network.nix
new file mode 100644
index 00000000000..04ea9a2bc9f
--- /dev/null
+++ b/nixos/lib/testing/network.nix
@@ -0,0 +1,117 @@
+{ lib, nodes, ... }:
+
+let
+  inherit (lib)
+    attrNames concatMap concatMapStrings flip forEach head
+    listToAttrs mkDefault mkOption nameValuePair optionalString
+    range types zipListsWith zipLists
+    mdDoc
+    ;
+
+  nodeNumbers =
+    listToAttrs
+      (zipListsWith
+        nameValuePair
+        (attrNames nodes)
+        (range 1 254)
+      );
+
+  networkModule = { config, nodes, pkgs, ... }:
+    let
+      interfacesNumbered = zipLists config.virtualisation.vlans (range 1 255);
+      interfaces = forEach interfacesNumbered ({ fst, snd }:
+        nameValuePair "eth${toString snd}" {
+          ipv4.addresses =
+            [{
+              address = "192.168.${toString fst}.${toString config.virtualisation.test.nodeNumber}";
+              prefixLength = 24;
+            }];
+        });
+
+      networkConfig =
+        {
+          networking.hostName = mkDefault config.virtualisation.test.nodeName;
+
+          networking.interfaces = listToAttrs interfaces;
+
+          networking.primaryIPAddress =
+            optionalString (interfaces != [ ]) (head (head interfaces).value.ipv4.addresses).address;
+
+          # Put the IP addresses of all VMs in this machine's
+          # /etc/hosts file.  If a machine has multiple
+          # interfaces, use the IP address corresponding to
+          # the first interface (i.e. the first network in its
+          # virtualisation.vlans option).
+          networking.extraHosts = flip concatMapStrings (attrNames nodes)
+            (m':
+              let config = nodes.${m'}; in
+              optionalString (config.networking.primaryIPAddress != "")
+                ("${config.networking.primaryIPAddress} " +
+                  optionalString (config.networking.domain != null)
+                    "${config.networking.hostName}.${config.networking.domain} " +
+                  "${config.networking.hostName}\n"));
+
+          virtualisation.qemu.options =
+            let qemu-common = import ../qemu-common.nix { inherit lib pkgs; };
+            in
+            flip concatMap interfacesNumbered
+              ({ fst, snd }: qemu-common.qemuNICFlags snd fst config.virtualisation.test.nodeNumber);
+        };
+
+    in
+    {
+      key = "ip-address";
+      config = networkConfig // {
+        # Expose the networkConfig items for tests like nixops
+        # that need to recreate the network config.
+        system.build.networkConfig = networkConfig;
+      };
+    };
+
+  nodeNumberModule = (regular@{ config, name, ... }: {
+    options = {
+      virtualisation.test.nodeName = mkOption {
+        internal = true;
+        default = name;
+        # We need to force this in specilisations, otherwise it'd be
+        # readOnly = true;
+        description = mdDoc ''
+          The `name` in `nodes.<name>`; stable across `specialisations`.
+        '';
+      };
+      virtualisation.test.nodeNumber = mkOption {
+        internal = true;
+        type = types.int;
+        readOnly = true;
+        default = nodeNumbers.${config.virtualisation.test.nodeName};
+        description = mdDoc ''
+          A unique number assigned for each node in `nodes`.
+        '';
+      };
+
+      # specialisations override the `name` module argument,
+      # so we push the real `virtualisation.test.nodeName`.
+      specialisation = mkOption {
+        type = types.attrsOf (types.submodule {
+          options.configuration = mkOption {
+            type = types.submoduleWith {
+              modules = [
+                {
+                  config.virtualisation.test.nodeName =
+                    # assert regular.config.virtualisation.test.nodeName != "configuration";
+                    regular.config.virtualisation.test.nodeName;
+                }
+              ];
+            };
+          };
+        });
+      };
+    };
+  });
+
+in
+{
+  config = {
+    extraBaseModules = { imports = [ networkModule nodeNumberModule ]; };
+  };
+}
diff --git a/nixos/lib/testing/nixos-test-base.nix b/nixos/lib/testing/nixos-test-base.nix
new file mode 100644
index 00000000000..59e6e384336
--- /dev/null
+++ b/nixos/lib/testing/nixos-test-base.nix
@@ -0,0 +1,23 @@
+# A module containing the base imports and overrides that
+# are always applied in NixOS VM tests, unconditionally,
+# even in `inheritParentConfig = false` specialisations.
+{ lib, ... }:
+let
+  inherit (lib) mkForce;
+in
+{
+  imports = [
+    ../../modules/virtualisation/qemu-vm.nix
+    ../../modules/testing/test-instrumentation.nix # !!! should only get added for automated test runs
+    { key = "no-manual"; documentation.nixos.enable = false; }
+    {
+      key = "no-revision";
+      # Make the revision metadata constant, in order to avoid needless retesting.
+      # The human version (e.g. 21.05-pre) is left as is, because it is useful
+      # for external modules that test with e.g. testers.nixosTest and rely on that
+      # version number.
+      config.system.nixos.revision = mkForce "constant-nixos-revision";
+    }
+
+  ];
+}
diff --git a/nixos/lib/testing/nodes.nix b/nixos/lib/testing/nodes.nix
new file mode 100644
index 00000000000..765af2878df
--- /dev/null
+++ b/nixos/lib/testing/nodes.nix
@@ -0,0 +1,112 @@
+testModuleArgs@{ config, lib, hostPkgs, nodes, ... }:
+
+let
+  inherit (lib) mkOption mkForce optional types mapAttrs mkDefault mdDoc;
+
+  system = hostPkgs.stdenv.hostPlatform.system;
+
+  baseOS =
+    import ../eval-config.nix {
+      inherit system;
+      inherit (config.node) specialArgs;
+      modules = [ config.defaults ];
+      baseModules = (import ../../modules/module-list.nix) ++
+        [
+          ./nixos-test-base.nix
+          { key = "nodes"; _module.args.nodes = config.nodesCompat; }
+          ({ config, ... }:
+            {
+              virtualisation.qemu.package = testModuleArgs.config.qemu.package;
+
+              # Ensure we do not use aliases. Ideally this is only set
+              # when the test framework is used by Nixpkgs NixOS tests.
+              nixpkgs.config.allowAliases = false;
+            })
+          testModuleArgs.config.extraBaseModules
+        ] ++ optional config.minimal ../../modules/testing/minimal-kernel.nix;
+    };
+
+
+in
+
+{
+
+  options = {
+    node.type = mkOption {
+      type = types.raw;
+      default = baseOS.type;
+      internal = true;
+    };
+
+    nodes = mkOption {
+      type = types.lazyAttrsOf config.node.type;
+      visible = "shallow";
+      description = mdDoc ''
+        An attribute set of NixOS configuration modules.
+
+        The configurations are augmented by the [`defaults`](#opt-defaults) option.
+
+        They are assigned network addresses according to the `nixos/lib/testing/network.nix` module.
+
+        A few special options are available, that aren't in a plain NixOS configuration. See [Configuring the nodes](#sec-nixos-test-nodes)
+      '';
+    };
+
+    defaults = mkOption {
+      description = mdDoc ''
+        NixOS configuration that is applied to all [{option}`nodes`](#opt-nodes).
+      '';
+      type = types.deferredModule;
+      default = { };
+    };
+
+    extraBaseModules = mkOption {
+      description = mdDoc ''
+        NixOS configuration that, like [{option}`defaults`](#opt-defaults), is applied to all [{option}`nodes`](#opt-nodes) and can not be undone with [`specialisation.<name>.inheritParentConfig`](https://search.nixos.org/options?show=specialisation.%3Cname%3E.inheritParentConfig&from=0&size=50&sort=relevance&type=packages&query=specialisation).
+      '';
+      type = types.deferredModule;
+      default = { };
+    };
+
+    node.specialArgs = mkOption {
+      type = types.lazyAttrsOf types.raw;
+      default = { };
+      description = mdDoc ''
+        An attribute set of arbitrary values that will be made available as module arguments during the resolution of module `imports`.
+
+        Note that it is not possible to override these from within the NixOS configurations. If you argument is not relevant to `imports`, consider setting {option}`defaults._module.args.<name>` instead.
+      '';
+    };
+
+    minimal = mkOption {
+      type = types.bool;
+      default = false;
+      description = mdDoc ''
+        Enable to configure all [{option}`nodes`](#opt-nodes) to run with a minimal kernel.
+      '';
+    };
+
+    nodesCompat = mkOption {
+      internal = true;
+      description = mdDoc ''
+        Basically `_module.args.nodes`, but with backcompat and warnings added.
+
+        This will go away.
+      '';
+    };
+  };
+
+  config = {
+    _module.args.nodes = config.nodesCompat;
+    nodesCompat =
+      mapAttrs
+        (name: config: config // {
+          config = lib.warn
+            "Module argument `nodes.${name}.config` is deprecated. Use `nodes.${name}` instead."
+            config;
+        })
+        config.nodes;
+
+    passthru.nodes = config.nodesCompat;
+  };
+}
diff --git a/nixos/lib/testing/pkgs.nix b/nixos/lib/testing/pkgs.nix
new file mode 100644
index 00000000000..22dd586868e
--- /dev/null
+++ b/nixos/lib/testing/pkgs.nix
@@ -0,0 +1,11 @@
+{ config, lib, hostPkgs, ... }:
+{
+  config = {
+    # default pkgs for use in VMs
+    _module.args.pkgs = hostPkgs;
+
+    defaults = {
+      # TODO: a module to set a shared pkgs, if options.nixpkgs.* is untouched by user (highestPrio) */
+    };
+  };
+}
diff --git a/nixos/lib/testing/run.nix b/nixos/lib/testing/run.nix
new file mode 100644
index 00000000000..0cd07d8afd2
--- /dev/null
+++ b/nixos/lib/testing/run.nix
@@ -0,0 +1,57 @@
+{ config, hostPkgs, lib, ... }:
+let
+  inherit (lib) types mkOption mdDoc;
+in
+{
+  options = {
+    passthru = mkOption {
+      type = types.lazyAttrsOf types.raw;
+      description = mdDoc ''
+        Attributes to add to the returned derivations,
+        which are not necessarily part of the build.
+
+        This is a bit like doing `drv // { myAttr = true; }` (which would be lost by `overrideAttrs`).
+        It does not change the actual derivation, but adds the attribute nonetheless, so that
+        consumers of what would be `drv` have more information.
+      '';
+    };
+
+    test = mkOption {
+      type = types.package;
+      # TODO: can the interactive driver be configured to access the network?
+      description = mdDoc ''
+        Derivation that runs the test as its "build" process.
+
+        This implies that NixOS tests run isolated from the network, making them
+        more dependable.
+      '';
+    };
+  };
+
+  config = {
+    test = lib.lazyDerivation { # lazyDerivation improves performance when only passthru items and/or meta are used.
+      derivation = hostPkgs.stdenv.mkDerivation {
+        name = "vm-test-run-${config.name}";
+
+        requiredSystemFeatures = [ "kvm" "nixos-test" ];
+
+        buildCommand = ''
+          mkdir -p $out
+
+          # effectively mute the XMLLogger
+          export LOGFILE=/dev/null
+
+          ${config.driver}/bin/nixos-test-driver -o $out
+        '';
+
+        passthru = config.passthru;
+
+        meta = config.meta;
+      };
+      inherit (config) passthru meta;
+    };
+
+    # useful for inspection (debugging / exploration)
+    passthru.config = config;
+  };
+}
diff --git a/nixos/lib/testing/testScript.nix b/nixos/lib/testing/testScript.nix
new file mode 100644
index 00000000000..5d4181c5f5d
--- /dev/null
+++ b/nixos/lib/testing/testScript.nix
@@ -0,0 +1,84 @@
+testModuleArgs@{ config, lib, hostPkgs, nodes, moduleType, ... }:
+let
+  inherit (lib) mkOption types mdDoc;
+  inherit (types) either str functionTo;
+in
+{
+  options = {
+    testScript = mkOption {
+      type = either str (functionTo str);
+      description = ''
+        A series of python declarations and statements that you write to perform
+        the test.
+      '';
+    };
+    testScriptString = mkOption {
+      type = str;
+      readOnly = true;
+      internal = true;
+    };
+
+    includeTestScriptReferences = mkOption {
+      type = types.bool;
+      default = true;
+      internal = true;
+    };
+    withoutTestScriptReferences = mkOption {
+      type = moduleType;
+      description = mdDoc ''
+        A parallel universe where the testScript is invalid and has no references.
+      '';
+      internal = true;
+      visible = false;
+    };
+  };
+  config = {
+    withoutTestScriptReferences.includeTestScriptReferences = false;
+    withoutTestScriptReferences.testScript = lib.mkForce "testscript omitted";
+
+    testScriptString =
+      if lib.isFunction config.testScript
+      then
+        config.testScript
+          {
+            nodes =
+              lib.mapAttrs
+                (k: v:
+                  if v.virtualisation.useNixStoreImage
+                  then
+                  # prevent infinite recursion when testScript would
+                  # reference v's toplevel
+                    config.withoutTestScriptReferences.nodesCompat.${k}
+                  else
+                  # reuse memoized config
+                    v
+                )
+                config.nodesCompat;
+          }
+      else config.testScript;
+
+    defaults = { config, name, ... }: {
+      # Make sure all derivations referenced by the test
+      # script are available on the nodes. When the store is
+      # accessed through 9p, this isn't important, since
+      # everything in the store is available to the guest,
+      # but when building a root image it is, as all paths
+      # that should be available to the guest has to be
+      # copied to the image.
+      virtualisation.additionalPaths =
+        lib.optional
+          # A testScript may evaluate nodes, which has caused
+          # infinite recursions. The demand cycle involves:
+          #   testScript -->
+          #   nodes -->
+          #   toplevel -->
+          #   additionalPaths -->
+          #   hasContext testScript' -->
+          #   testScript (ad infinitum)
+          # If we don't need to build an image, we can break this
+          # cycle by short-circuiting when useNixStoreImage is false.
+          (config.virtualisation.useNixStoreImage && builtins.hasContext testModuleArgs.config.testScriptString && testModuleArgs.config.includeTestScriptReferences)
+          (hostPkgs.writeStringReferencesToFile testModuleArgs.config.testScriptString);
+    };
+  };
+}
diff --git a/nixos/modules/installer/tools/nixos-build-vms/build-vms.nix b/nixos/modules/installer/tools/nixos-build-vms/build-vms.nix
index b4a94f62ad9..ced344bce23 100644
--- a/nixos/modules/installer/tools/nixos-build-vms/build-vms.nix
+++ b/nixos/modules/installer/tools/nixos-build-vms/build-vms.nix
@@ -15,7 +15,7 @@ let
     inherit system pkgs;
   };
 
-  interactiveDriver = (testing.makeTest { inherit nodes; testScript = "start_all(); join_all();"; }).driverInteractive;
+  interactiveDriver = (testing.makeTest { inherit nodes; name = "network"; testScript = "start_all(); join_all();"; }).driverInteractive;
 in
 
 
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 50446e3ee59..9f3cad39786 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1236,6 +1236,7 @@
   ./system/boot/systemd/journald.nix
   ./system/boot/systemd/logind.nix
   ./system/boot/systemd/nspawn.nix
+  ./system/boot/systemd/oomd.nix
   ./system/boot/systemd/shutdown.nix
   ./system/boot/systemd/tmpfiles.nix
   ./system/boot/systemd/user.nix
diff --git a/nixos/modules/services/misc/klipper.nix b/nixos/modules/services/misc/klipper.nix
index 9b2f585d3ff..a2158e9461b 100644
--- a/nixos/modules/services/misc/klipper.nix
+++ b/nixos/modules/services/misc/klipper.nix
@@ -35,6 +35,30 @@ in
         description = lib.mdDoc "Path of the API socket to create.";
       };
 
+      mutableConfig = mkOption {
+        type = types.bool;
+        default = false;
+        example = true;
+        description = lib.mdDoc ''
+          Whether to copy the config to a mutable directory instead of using the one directly from the nix store.
+          This will only copy the config if the file at `services.klipper.mutableConfigPath` doesn't exist.
+        '';
+      };
+
+      mutableConfigFolder = mkOption {
+        type = types.path;
+        default = "/var/lib/klipper";
+        description = lib.mdDoc "Path to mutable Klipper config file.";
+      };
+
+      configFile = mkOption {
+        type = types.nullOr types.path;
+        default = null;
+        description = lib.mdDoc ''
+          Path to default Klipper config.
+        '';
+      };
+
       octoprintIntegration = mkOption {
         type = types.bool;
         default = false;
@@ -62,8 +86,8 @@ in
       };
 
       settings = mkOption {
-        type = format.type;
-        default = { };
+        type = types.nullOr format.type;
+        default = null;
         description = lib.mdDoc ''
           Configuration for Klipper. See the [documentation](https://www.klipper3d.org/Overview.html#configuration-and-tuning-guides)
           for supported values.
@@ -80,6 +104,10 @@ in
                 building of firmware and addition of klipper-flash tools for manual flashing.
                 This will add `klipper-flash-$mcu` scripts to your environment which can be called to flash the firmware.
               '');
+              serial = mkOption {
+                type = types.nullOr path;
+                description = lib.mdDoc "Path to serial port this printer is connected to. Leave `null` to derive it from `service.klipper.settings`.";
+              };
               configFile = mkOption {
                 type = path;
                 description = lib.mdDoc "Path to firmware config which is generated using `klipper-genconf`";
@@ -95,19 +123,25 @@ in
     assertions = [
       {
         assertion = cfg.octoprintIntegration -> config.services.octoprint.enable;
-        message = "Option klipper.octoprintIntegration requires Octoprint to be enabled on this system. Please enable services.octoprint to use it.";
+        message = "Option services.klipper.octoprintIntegration requires Octoprint to be enabled on this system. Please enable services.octoprint to use it.";
       }
       {
         assertion = cfg.user != null -> cfg.group != null;
-        message = "Option klipper.group is not set when a user is specified.";
+        message = "Option services.klipper.group is not set when services.klipper.user is specified.";
+      }
+      {
+        assertion = cfg.settings != null -> foldl (a: b: a && b) true (mapAttrsToList (mcu: _: mcu != null -> (hasAttrByPath [ "${mcu}" "serial" ] cfg.settings)) cfg.firmwares);
+        message = "Option services.klipper.settings.$mcu.serial must be set when settings.klipper.firmware.$mcu is specified";
       }
       {
-        assertion = foldl (a: b: a && b) true (mapAttrsToList (mcu: _: mcu != null -> (hasAttrByPath [ "${mcu}" "serial" ] cfg.settings)) cfg.firmwares);
-        message = "Option klipper.settings.$mcu.serial must be set when klipper.firmware.$mcu is specified";
+        assertion = (cfg.configFile != null) != (cfg.settings != null);
+        message = "You need to either specify services.klipper.settings or services.klipper.defaultConfig.";
       }
     ];
 
-    environment.etc."klipper.cfg".source = format.generate "klipper.cfg" cfg.settings;
+    environment.etc = mkIf (!cfg.mutableConfig) {
+      "klipper.cfg".source = if cfg.settings != null then format.generate "klipper.cfg" cfg.settings else cfg.configFile;
+    };
 
     services.klipper = mkIf cfg.octoprintIntegration {
       user = config.services.octoprint.user;
@@ -118,15 +152,34 @@ in
       let
         klippyArgs = "--input-tty=${cfg.inputTTY}"
           + optionalString (cfg.apiSocket != null) " --api-server=${cfg.apiSocket}";
+        printerConfigPath =
+          if cfg.mutableConfig
+          then cfg.mutableConfigFolder + "/printer.cfg"
+          else "/etc/klipper.cfg";
+        printerConfigFile =
+          if cfg.settings != null
+          then format.generate "klipper.cfg" cfg.settings
+          else cfg.configFile;
       in
       {
         description = "Klipper 3D Printer Firmware";
         wantedBy = [ "multi-user.target" ];
         after = [ "network.target" ];
+        preStart = ''
+          mkdir -p ${cfg.mutableConfigFolder}
+          ${lib.optionalString (cfg.mutableConfig) ''
+            [ -e ${printerConfigPath} ] || {
+              cp ${printerConfigFile} ${printerConfigPath}
+              chmod +w ${printerConfigPath}
+            }
+          ''}
+          mkdir -p ${cfg.mutableConfigFolder}/gcodes
+        '';
 
         serviceConfig = {
-          ExecStart = "${cfg.package}/lib/klipper/klippy.py ${klippyArgs} /etc/klipper.cfg";
+          ExecStart = "${cfg.package}/lib/klipper/klippy.py ${klippyArgs} ${printerConfigPath}";
           RuntimeDirectory = "klipper";
+          StateDirectory = "klipper";
           SupplementaryGroups = [ "dialout" ];
           WorkingDirectory = "${cfg.package}/lib";
           OOMScoreAdjust = "-999";
@@ -134,6 +187,7 @@ in
           CPUSchedulingPriority = 99;
           IOSchedulingClass = "realtime";
           IOSchedulingPriority = 0;
+          UMask = "0002";
         } // (if cfg.user != null then {
           Group = cfg.group;
           User = cfg.user;
@@ -146,8 +200,9 @@ in
     environment.systemPackages =
       with pkgs;
       let
+        default = a: b: if a != null then a else b;
         firmwares = filterAttrs (n: v: v!= null) (mapAttrs
-          (mcu: { enable, configFile }: if enable then pkgs.klipper-firmware.override {
+          (mcu: { enable, configFile, serial }: if enable then pkgs.klipper-firmware.override {
             mcu = lib.strings.sanitizeDerivationName mcu;
             firmwareConfig = configFile;
           } else null)
@@ -156,11 +211,14 @@ in
           (mcu: firmware: pkgs.klipper-flash.override {
             mcu = lib.strings.sanitizeDerivationName mcu;
             klipper-firmware = firmware;
-            flashDevice = cfg.settings."${mcu}".serial;
+            flashDevice = default cfg.firmwares."${mcu}".serial cfg.settings."${mcu}".serial;
             firmwareConfig = cfg.firmwares."${mcu}".configFile;
           })
           firmwares;
       in
       [ klipper-genconf ] ++ firmwareFlasher ++ attrValues firmwares;
   };
+  meta.maintainers = [
+    maintainers.cab404
+  ];
 }
diff --git a/nixos/modules/services/web-servers/caddy/default.nix b/nixos/modules/services/web-servers/caddy/default.nix
index e364cb33be3..e1456091717 100644
--- a/nixos/modules/services/web-servers/caddy/default.nix
+++ b/nixos/modules/services/web-servers/caddy/default.nix
@@ -26,7 +26,7 @@ let
 
   configFile =
     let
-      Caddyfile = pkgs.writeText "Caddyfile" ''
+      Caddyfile = pkgs.writeTextDir "Caddyfile" ''
         {
           ${cfg.globalConfig}
         }
@@ -34,10 +34,11 @@ let
       '';
 
       Caddyfile-formatted = pkgs.runCommand "Caddyfile-formatted" { nativeBuildInputs = [ cfg.package ]; } ''
-        ${cfg.package}/bin/caddy fmt ${Caddyfile} > $out
+        mkdir -p $out
+        ${cfg.package}/bin/caddy fmt ${Caddyfile}/Caddyfile > $out/Caddyfile
       '';
     in
-      if pkgs.stdenv.buildPlatform == pkgs.stdenv.hostPlatform then Caddyfile-formatted else Caddyfile;
+      "${if pkgs.stdenv.buildPlatform == pkgs.stdenv.hostPlatform then Caddyfile-formatted else Caddyfile}/Caddyfile";
 
   acmeHosts = unique (catAttrs "useACMEHost" acmeVHosts);
 
@@ -142,7 +143,7 @@ in
       default = configFile;
       defaultText = "A Caddyfile automatically generated by values from services.caddy.*";
       example = literalExpression ''
-        pkgs.writeText "Caddyfile" '''
+        pkgs.writeTextDir "Caddyfile" '''
           example.com
 
           root * /var/www/wordpress
@@ -157,17 +158,24 @@ in
     };
 
     adapter = mkOption {
-      default = "caddyfile";
-      example = "nginx";
-      type = types.str;
+      default = null;
+      example = literalExpression "nginx";
+      type = with types; nullOr str;
       description = lib.mdDoc ''
         Name of the config adapter to use.
         See <https://caddyserver.com/docs/config-adapters>
         for the full list.
 
+        If `null` is specified, the `--adapter` argument is omitted when
+        starting or restarting Caddy. Notably, this allows specification of a
+        configuration file in Caddy's native JSON format, as long as the
+        filename does not start with `Caddyfile` (in which case the `caddyfile`
+        adapter is implicitly enabled). See
+        <https://caddyserver.com/docs/command-line#caddy-run> for details.
+
         ::: {.note}
-        Any value other than `caddyfile` is only valid when
-        providing your own {option}`configFile`.
+        Any value other than `null` or `caddyfile` is only valid when providing
+        your own `configFile`.
         :::
       '';
     };
@@ -264,8 +272,8 @@ in
   config = mkIf cfg.enable {
 
     assertions = [
-      { assertion = cfg.adapter != "caddyfile" -> cfg.configFile != configFile;
-        message = "Any value other than 'caddyfile' is only valid when providing your own `services.caddy.configFile`";
+      { assertion = cfg.configFile == configFile -> cfg.adapter == "caddyfile" || cfg.adapter == null;
+        message = "To specify an adapter other than 'caddyfile' please provide your own configuration via `services.caddy.configFile`";
       }
     ] ++ map (name: mkCertOwnershipAssertion {
       inherit (cfg) group user;
@@ -295,10 +303,9 @@ in
       serviceConfig = {
         # https://www.freedesktop.org/software/systemd/man/systemd.service.html#ExecStart=
         # If the empty string is assigned to this option, the list of commands to start is reset, prior assignments of this option will have no effect.
-        ExecStart = [ "" "${cfg.package}/bin/caddy run --config ${cfg.configFile} --adapter ${cfg.adapter} ${optionalString cfg.resume "--resume"}" ];
-        ExecReload = [ "" "${cfg.package}/bin/caddy reload --config ${cfg.configFile} --adapter ${cfg.adapter} --force" ];
-
-        ExecStartPre = "${cfg.package}/bin/caddy validate --config ${cfg.configFile} --adapter ${cfg.adapter}";
+        ExecStart = [ "" ''${cfg.package}/bin/caddy run --config ${cfg.configFile} ${optionalString (cfg.adapter != null) "--adapter ${cfg.adapter}"} ${optionalString cfg.resume "--resume"}'' ];
+        ExecReload = [ "" ''${cfg.package}/bin/caddy reload --config ${cfg.configFile} ${optionalString (cfg.adapter != null) "--adapter ${cfg.adapter}"} --force'' ];
+        ExecStartPre = ''${cfg.package}/bin/caddy validate --config ${cfg.configFile} ${optionalString (cfg.adapter != null) "--adapter ${cfg.adapter}"}'';
         User = cfg.user;
         Group = cfg.group;
         ReadWriteDirectories = cfg.dataDir;
diff --git a/nixos/modules/system/boot/systemd/oomd.nix b/nixos/modules/system/boot/systemd/oomd.nix
new file mode 100644
index 00000000000..fad755e278c
--- /dev/null
+++ b/nixos/modules/system/boot/systemd/oomd.nix
@@ -0,0 +1,57 @@
+{ config, lib, ... }: let
+
+  cfg = config.systemd.oomd;
+
+in {
+  options.systemd.oomd = {
+    enable = lib.mkEnableOption (lib.mdDoc "the `systemd-oomd` OOM killer") // { default = true; };
+
+    # Fedora enables the first and third option by default. See the 10-oomd-* files here:
+    # https://src.fedoraproject.org/rpms/systemd/tree/acb90c49c42276b06375a66c73673ac351025597
+    enableRootSlice = lib.mkEnableOption (lib.mdDoc "oomd on the root slice (`-.slice`)");
+    enableSystemSlice = lib.mkEnableOption (lib.mdDoc "oomd on the system slice (`system.slice`)");
+    enableUserServices = lib.mkEnableOption (lib.mdDoc "oomd on all user services (`user@.service`)");
+
+    extraConfig = lib.mkOption {
+      type = with lib.types; attrsOf (oneOf [ str int bool ]);
+      default = {};
+      example = lib.literalExpression ''{ DefaultMemoryPressureDurationSec = "20s"; }'';
+      description = lib.mdDoc ''
+        Extra config options for `systemd-oomd`. See {command}`man oomd.conf`
+        for available options.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.additionalUpstreamSystemUnits = [
+      "systemd-oomd.service"
+      "systemd-oomd.socket"
+    ];
+    systemd.services.systemd-oomd.wantedBy = [ "multi-user.target" ];
+
+    environment.etc."systemd/oomd.conf".text = lib.generators.toINI {} {
+      OOM = cfg.extraConfig;
+    };
+
+    systemd.oomd.extraConfig.DefaultMemoryPressureDurationSec = lib.mkDefault "20s"; # Fedora default
+
+    users.users.systemd-oom = {
+      description = "systemd-oomd service user";
+      group = "systemd-oom";
+      isSystemUser = true;
+    };
+    users.groups.systemd-oom = { };
+
+    systemd.slices."-".sliceConfig = lib.mkIf cfg.enableRootSlice {
+      ManagedOOMSwap = "kill";
+    };
+    systemd.slices."system".sliceConfig = lib.mkIf cfg.enableSystemSlice {
+      ManagedOOMSwap = "kill";
+    };
+    systemd.services."user@".serviceConfig = lib.mkIf cfg.enableUserServices {
+      ManagedOOMMemoryPressure = "kill";
+      ManagedOOMMemoryPressureLimit = "50%";
+    };
+  };
+}
diff --git a/nixos/release.nix b/nixos/release.nix
index f70b02c4292..4f27e5dbb21 100644
--- a/nixos/release.nix
+++ b/nixos/release.nix
@@ -22,8 +22,8 @@ let
     import ./tests/all-tests.nix {
       inherit system;
       pkgs = import ./.. { inherit system; };
-      callTest = t: {
-        ${system} = hydraJob t.test;
+      callTest = config: {
+        ${system} = hydraJob config.test;
       };
     } // {
       # for typechecking of the scripts and evaluation of
@@ -32,8 +32,8 @@ let
         import ./tests/all-tests.nix {
         inherit system;
         pkgs = import ./.. { inherit system; };
-        callTest = t: {
-          ${system} = hydraJob t.test.driver;
+        callTest = config: {
+          ${system} = hydraJob config.driver;
         };
       };
     };
diff --git a/nixos/tests/3proxy.nix b/nixos/tests/3proxy.nix
index 8127438fabd..647d9d57c7f 100644
--- a/nixos/tests/3proxy.nix
+++ b/nixos/tests/3proxy.nix
@@ -1,6 +1,6 @@
-import ./make-test-python.nix ({ pkgs, ...} : {
+{ lib, pkgs, ... }: {
   name = "3proxy";
-  meta = with pkgs.lib.maintainers; {
+  meta = with lib.maintainers; {
     maintainers = [ misuzu ];
   };
 
@@ -92,7 +92,7 @@ import ./make-test-python.nix ({ pkgs, ...} : {
       networking.firewall.allowedTCPPorts = [ 3128 9999 ];
     };
 
-    peer3 = { lib, ... }: {
+    peer3 = { lib, pkgs, ... }: {
       networking.useDHCP = false;
       networking.interfaces.eth1 = {
         ipv4.addresses = [
@@ -186,4 +186,4 @@ import ./make-test-python.nix ({ pkgs, ...} : {
         "${pkgs.wget}/bin/wget -e use_proxy=yes -e http_proxy=http://192.168.0.4:3128 -S -O /dev/null http://127.0.0.1:9999"
     )
   '';
-})
+}
diff --git a/nixos/tests/acme.nix b/nixos/tests/acme.nix
index c07f99c5db3..d3a436080eb 100644
--- a/nixos/tests/acme.nix
+++ b/nixos/tests/acme.nix
@@ -1,7 +1,7 @@
-import ./make-test-python.nix ({ pkgs, lib, ... }: let
+{ pkgs, lib, ... }: let
   commonConfig = ./common/acme/client;
 
-  dnsServerIP = nodes: nodes.dnsserver.config.networking.primaryIPAddress;
+  dnsServerIP = nodes: nodes.dnsserver.networking.primaryIPAddress;
 
   dnsScript = nodes: let
     dnsAddress = dnsServerIP nodes;
@@ -153,7 +153,7 @@ in {
         description = "Pebble ACME challenge test server";
         wantedBy = [ "network.target" ];
         serviceConfig = {
-          ExecStart = "${pkgs.pebble}/bin/pebble-challtestsrv -dns01 ':53' -defaultIPv6 '' -defaultIPv4 '${nodes.webserver.config.networking.primaryIPAddress}'";
+          ExecStart = "${pkgs.pebble}/bin/pebble-challtestsrv -dns01 ':53' -defaultIPv6 '' -defaultIPv4 '${nodes.webserver.networking.primaryIPAddress}'";
           # Required to bind on privileged ports.
           AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
         };
@@ -175,7 +175,7 @@ in {
       specialisation = {
         # First derivation used to test general ACME features
         general.configuration = { ... }: let
-          caDomain = nodes.acme.config.test-support.acme.caDomain;
+          caDomain = nodes.acme.test-support.acme.caDomain;
           email = config.security.acme.defaults.email;
           # Exit 99 to make it easier to track if this is the reason a renew failed
           accountCreateTester = ''
@@ -316,7 +316,7 @@ in {
 
   testScript = { nodes, ... }:
     let
-      caDomain = nodes.acme.config.test-support.acme.caDomain;
+      caDomain = nodes.acme.test-support.acme.caDomain;
       newServerSystem = nodes.webserver.config.system.build.toplevel;
       switchToNewServer = "${newServerSystem}/bin/switch-to-configuration test";
     in
@@ -438,7 +438,7 @@ in {
       client.wait_for_unit("default.target")
 
       client.succeed(
-          'curl --data \'{"host": "${caDomain}", "addresses": ["${nodes.acme.config.networking.primaryIPAddress}"]}\' http://${dnsServerIP nodes}:8055/add-a'
+          'curl --data \'{"host": "${caDomain}", "addresses": ["${nodes.acme.networking.primaryIPAddress}"]}\' http://${dnsServerIP nodes}:8055/add-a'
       )
 
       acme.wait_for_unit("network-online.target")
@@ -594,4 +594,4 @@ in {
               wait_for_server()
               check_connection_key_bits(client, test_domain, "384")
     '';
-})
+}
diff --git a/nixos/tests/adguardhome.nix b/nixos/tests/adguardhome.nix
index ddbe8ff9c11..1a220f99699 100644
--- a/nixos/tests/adguardhome.nix
+++ b/nixos/tests/adguardhome.nix
@@ -1,4 +1,4 @@
-import ./make-test-python.nix {
+{
   name = "adguardhome";
 
   nodes = {
diff --git a/nixos/tests/aesmd.nix b/nixos/tests/aesmd.nix
index 9f07426be8d..5da661afd54 100644
--- a/nixos/tests/aesmd.nix
+++ b/nixos/tests/aesmd.nix
@@ -1,4 +1,4 @@
-import ./make-test-python.nix ({ pkgs, lib, ... }: {
+{ pkgs, lib, ... }: {
   name = "aesmd";
   meta = {
     maintainers = with lib.maintainers; [ veehaitch ];
@@ -59,4 +59,4 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
 
       assert aesmd_config == "whitelist url = http://nixos.org\nproxy type = direct\ndefault quoting type = ecdsa_256\n", "aesmd.conf differs"
   '';
-})
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 6d90d0112a0..403ddd4cd1c 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1,4 +1,11 @@
-{ system, pkgs, callTest }:
+{ system,
+  pkgs,
+
+  # Projects the test configuration into a the desired value; usually
+  # the test runner: `config: config.test`.
+  callTest,
+
+}:
 # The return value of this function will be an attrset with arbitrary depth and
 # the `anything` returned by callTest at its test leafs.
 # The tests not supported by `system` will be replaced with `{}`, so that
@@ -11,9 +18,18 @@ with pkgs.lib;
 
 let
   discoverTests = val:
-    if !isAttrs val then val
-    else if hasAttr "test" val then callTest val
-    else mapAttrs (n: s: discoverTests s) val;
+    if isAttrs val
+    then
+      if hasAttr "test" val then callTest val
+      else mapAttrs (n: s: discoverTests s) val
+    else if isFunction val
+      then
+        # Tests based on make-test-python.nix will return the second lambda
+        # in that file, which are then forwarded to the test definition
+        # following the `import make-test-python.nix` expression
+        # (if it is a function).
+        discoverTests (val { inherit system pkgs; })
+      else val;
   handleTest = path: args:
     discoverTests (import path ({ inherit system pkgs; } // args));
   handleTestOn = systems: path: args:
@@ -27,12 +43,34 @@ let
   };
   evalMinimalConfig = module: nixosLib.evalModules { modules = [ module ]; };
 
+  inherit
+    (rec {
+      doRunTest = arg: (import ../lib/testing-python.nix { inherit system pkgs; }).runTest {
+        imports = [ arg { inherit callTest; } ];
+      };
+      findTests = tree:
+        if tree?recurseForDerivations && tree.recurseForDerivations
+        then
+          mapAttrs
+            (k: findTests)
+            (builtins.removeAttrs tree ["recurseForDerivations"])
+        else callTest tree;
+
+      runTest = arg: let r = doRunTest arg; in findTests r;
+      runTestOn = systems: arg:
+        if elem system systems then runTest arg
+        else {};
+    })
+    runTest
+    runTestOn
+    ;
+
 in {
-  _3proxy = handleTest ./3proxy.nix {};
-  acme = handleTest ./acme.nix {};
-  adguardhome = handleTest ./adguardhome.nix {};
-  aesmd = handleTest ./aesmd.nix {};
-  agate = handleTest ./web-servers/agate.nix {};
+  _3proxy = runTest ./3proxy.nix;
+  acme = runTest ./acme.nix;
+  adguardhome = runTest ./adguardhome.nix;
+  aesmd = runTest ./aesmd.nix;
+  agate = runTest ./web-servers/agate.nix;
   agda = handleTest ./agda.nix {};
   airsonic = handleTest ./airsonic.nix {};
   allTerminfo = handleTest ./all-terminfo.nix {};
@@ -568,6 +606,7 @@ in {
   systemd-networkd-ipv6-prefix-delegation = handleTest ./systemd-networkd-ipv6-prefix-delegation.nix {};
   systemd-networkd-vrf = handleTest ./systemd-networkd-vrf.nix {};
   systemd-nspawn = handleTest ./systemd-nspawn.nix {};
+  systemd-oomd = handleTest ./systemd-oomd.nix {};
   systemd-shutdown = handleTest ./systemd-shutdown.nix {};
   systemd-timesyncd = handleTest ./systemd-timesyncd.nix {};
   systemd-misc = handleTest ./systemd-misc.nix {};
diff --git a/nixos/tests/common/acme/client/default.nix b/nixos/tests/common/acme/client/default.nix
index 9dbe345e7a0..503e610d1ac 100644
--- a/nixos/tests/common/acme/client/default.nix
+++ b/nixos/tests/common/acme/client/default.nix
@@ -1,7 +1,7 @@
 { lib, nodes, pkgs, ... }:
 let
-  caCert = nodes.acme.config.test-support.acme.caCert;
-  caDomain = nodes.acme.config.test-support.acme.caDomain;
+  caCert = nodes.acme.test-support.acme.caCert;
+  caDomain = nodes.acme.test-support.acme.caDomain;
 
 in {
   security.acme = {
diff --git a/nixos/tests/common/acme/server/default.nix b/nixos/tests/common/acme/server/default.nix
index fa1b9b545d0..b81f860125c 100644
--- a/nixos/tests/common/acme/server/default.nix
+++ b/nixos/tests/common/acme/server/default.nix
@@ -18,10 +18,10 @@
 #
 #   example = { nodes, ... }: {
 #     networking.nameservers = [
-#       nodes.acme.config.networking.primaryIPAddress
+#       nodes.acme.networking.primaryIPAddress
 #     ];
 #     security.pki.certificateFiles = [
-#       nodes.acme.config.test-support.acme.caCert
+#       nodes.acme.test-support.acme.caCert
 #     ];
 #   };
 # }
@@ -36,7 +36,7 @@
 #   acme = { nodes, lib, ... }: {
 #     imports = [ ./common/acme/server ];
 #     networking.nameservers = lib.mkForce [
-#       nodes.myresolver.config.networking.primaryIPAddress
+#       nodes.myresolver.networking.primaryIPAddress
 #     ];
 #   };
 #
diff --git a/nixos/tests/corerad.nix b/nixos/tests/corerad.nix
index 638010f92f4..b6f5d7fc6f7 100644
--- a/nixos/tests/corerad.nix
+++ b/nixos/tests/corerad.nix
@@ -1,5 +1,6 @@
 import ./make-test-python.nix (
   {
+    name = "corerad";
     nodes = {
       router = {config, pkgs, ...}: {
         config = {
diff --git a/nixos/tests/cri-o.nix b/nixos/tests/cri-o.nix
index d3a8713d6a9..08e1e8f36b0 100644
--- a/nixos/tests/cri-o.nix
+++ b/nixos/tests/cri-o.nix
@@ -1,7 +1,7 @@
 # This test runs CRI-O and verifies via critest
 import ./make-test-python.nix ({ pkgs, ... }: {
   name = "cri-o";
-  meta.maintainers = with pkgs.lib.maintainers; teams.podman.members;
+  meta.maintainers = with pkgs.lib; teams.podman.members;
 
   nodes = {
     crio = {
diff --git a/nixos/tests/ghostunnel.nix b/nixos/tests/ghostunnel.nix
index 8bea6485402..91a7b7085f6 100644
--- a/nixos/tests/ghostunnel.nix
+++ b/nixos/tests/ghostunnel.nix
@@ -1,4 +1,5 @@
 import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "ghostunnel";
   nodes = {
     backend = { pkgs, ... }: {
       services.nginx.enable = true;
diff --git a/nixos/tests/installed-tests/default.nix b/nixos/tests/installed-tests/default.nix
index 3bb678d3678..b2c1b43f90e 100644
--- a/nixos/tests/installed-tests/default.nix
+++ b/nixos/tests/installed-tests/default.nix
@@ -40,7 +40,7 @@ let
           name = tested.name;
 
           meta = {
-            maintainers = tested.meta.maintainers;
+            maintainers = tested.meta.maintainers or [];
           };
 
           nodes.machine = { ... }: {
diff --git a/nixos/tests/installer.nix b/nixos/tests/installer.nix
index 8bef4fad3dd..d9f64a781c5 100644
--- a/nixos/tests/installer.nix
+++ b/nixos/tests/installer.nix
@@ -324,6 +324,9 @@ let
             desktop-file-utils
             docbook5
             docbook_xsl_ns
+            (docbook-xsl-ns.override {
+              withManOptDedupPatch = true;
+            })
             kmod.dev
             libarchive.dev
             libxml2.bin
@@ -333,6 +336,13 @@ let
             perlPackages.ListCompare
             perlPackages.XMLLibXML
             python3Minimal
+            # make-options-doc/default.nix
+            (let
+                self = (pkgs.python3Minimal.override {
+                  inherit self;
+                  includeSiteCustomize = true;
+                });
+              in self.withPackages (p: [ p.mistune ]))
             shared-mime-info
             sudo
             texinfo
diff --git a/nixos/tests/lorri/default.nix b/nixos/tests/lorri/default.nix
index 209b87f9f26..a4bdc92490c 100644
--- a/nixos/tests/lorri/default.nix
+++ b/nixos/tests/lorri/default.nix
@@ -1,4 +1,6 @@
 import ../make-test-python.nix {
+  name = "lorri";
+
   nodes.machine = { pkgs, ... }: {
     imports = [ ../../modules/profiles/minimal.nix ];
     environment.systemPackages = [ pkgs.lorri ];
diff --git a/nixos/tests/matomo.nix b/nixos/tests/matomo.nix
index 526a24fc4db..0e09ad295f9 100644
--- a/nixos/tests/matomo.nix
+++ b/nixos/tests/matomo.nix
@@ -7,6 +7,8 @@ with pkgs.lib;
 let
   matomoTest = package:
   makeTest {
+    name = "matomo";
+
     nodes.machine = { config, pkgs, ... }: {
       services.matomo = {
         package = package;
diff --git a/nixos/tests/matrix/conduit.nix b/nixos/tests/matrix/conduit.nix
index 780837f962f..2b81c23598e 100644
--- a/nixos/tests/matrix/conduit.nix
+++ b/nixos/tests/matrix/conduit.nix
@@ -3,6 +3,8 @@ import ../make-test-python.nix ({ pkgs, ... }:
     name = "conduit";
   in
   {
+    name = "matrix-conduit";
+
     nodes = {
       conduit = args: {
         services.matrix-conduit = {
diff --git a/nixos/tests/nixops/default.nix b/nixos/tests/nixops/default.nix
index 227b3881507..b77ac247639 100644
--- a/nixos/tests/nixops/default.nix
+++ b/nixos/tests/nixops/default.nix
@@ -19,6 +19,7 @@ let
   });
 
   testLegacyNetwork = { nixopsPkg }: pkgs.nixosTest ({
+    name = "nixops-legacy-network";
     nodes = {
       deployer = { config, lib, nodes, pkgs, ... }: {
         imports = [ ../../modules/installer/cd-dvd/channel.nix ];
diff --git a/nixos/tests/pam/pam-file-contents.nix b/nixos/tests/pam/pam-file-contents.nix
index 86c61003aeb..2bafd90618e 100644
--- a/nixos/tests/pam/pam-file-contents.nix
+++ b/nixos/tests/pam/pam-file-contents.nix
@@ -2,6 +2,7 @@ let
   name = "pam";
 in
 import ../make-test-python.nix ({ pkgs, ... }: {
+  name = "pam-file-contents";
 
   nodes.machine = { ... }: {
     imports = [ ../../modules/profiles/minimal.nix ];
diff --git a/nixos/tests/pppd.nix b/nixos/tests/pppd.nix
index bda0aa75bb5..e714a6c21a6 100644
--- a/nixos/tests/pppd.nix
+++ b/nixos/tests/pppd.nix
@@ -5,6 +5,8 @@ import ./make-test-python.nix (
       mode = "0640";
     };
   in {
+    name = "pppd";
+
     nodes = {
       server = {config, pkgs, ...}: {
         config = {
diff --git a/nixos/tests/rabbitmq.nix b/nixos/tests/rabbitmq.nix
index f8e8e61c47d..040679e68d9 100644
--- a/nixos/tests/rabbitmq.nix
+++ b/nixos/tests/rabbitmq.nix
@@ -1,6 +1,12 @@
 # This test runs rabbitmq and checks if rabbitmq is up and running.
 
-import ./make-test-python.nix ({ pkgs, ... }: {
+import ./make-test-python.nix ({ pkgs, ... }:
+let
+  # in real life, you would keep this out of your repo and deploy it to a safe
+  # location using safe means.
+  configKeyPath = pkgs.writeText "fake-config-key" "hOjWzSEn2Z7cHzKOcf6i183O2NdjurSuoMDIIv01";
+in
+{
   name = "rabbitmq";
   meta = with pkgs.lib.maintainers; {
     maintainers = [ eelco offline ];
@@ -10,6 +16,29 @@ import ./make-test-python.nix ({ pkgs, ... }: {
     services.rabbitmq = {
       enable = true;
       managementPlugin.enable = true;
+
+      # To encrypt:
+      # rabbitmqctl --quiet encode --cipher blowfish_cfb64 --hash sha256 \
+      #   --iterations 10000 '<<"dJT8isYu6t0Xb6u56rPglSj1vK51SlNVlXfwsRxw">>' \
+      #   "hOjWzSEn2Z7cHzKOcf6i183O2NdjurSuoMDIIv01" ;
+      config = ''
+        [ { rabbit
+          , [ {default_user, <<"alice">>}
+            , { default_pass
+              , {encrypted,<<"oKKxyTze9PYmsEfl6FG1MxIUhxY7WPQL7HBoMPRC/1ZOdOZbtr9+DxjWW3e1D5SL48n3D9QOsGD0cOgYG7Qdvb7Txrepw8w=">>}
+              }
+            , {config_entry_decoder
+              , [ {passphrase, {file, <<"${configKeyPath}">>}}
+                , {cipher, blowfish_cfb64}
+                , {hash, sha256}
+                , {iterations, 10000}
+                ]
+              }
+            % , {rabbitmq_management, [{path_prefix, "/_queues"}]}
+            ]
+          }
+        ].
+      '';
     };
     # Ensure there is sufficient extra disk space for rabbitmq to be happy
     virtualisation.diskSize = 1024;
@@ -23,5 +52,10 @@ import ./make-test-python.nix ({ pkgs, ... }: {
         'su -s ${pkgs.runtimeShell} rabbitmq -c "rabbitmqctl status"'
     )
     machine.wait_for_open_port(15672)
+
+    # The password is the plaintext that was encrypted with rabbitmqctl encode above.
+    machine.wait_until_succeeds(
+        '${pkgs.rabbitmq-java-client}/bin/PerfTest --time 10 --uri amqp://alice:dJT8isYu6t0Xb6u56rPglSj1vK51SlNVlXfwsRxw@localhost'
+    )
   '';
 })
diff --git a/nixos/tests/systemd-oomd.nix b/nixos/tests/systemd-oomd.nix
new file mode 100644
index 00000000000..f0b5a5f8e01
--- /dev/null
+++ b/nixos/tests/systemd-oomd.nix
@@ -0,0 +1,37 @@
+import ./make-test-python.nix ({ pkgs, ... }:
+
+{
+  name = "systemd-oomd";
+
+  nodes.machine = { pkgs, ... }: {
+    systemd.oomd.extraConfig.DefaultMemoryPressureDurationSec = "1s"; # makes the test faster
+    # Kill cgroups when more than 1% pressure is encountered
+    systemd.slices."-".sliceConfig = {
+      ManagedOOMMemoryPressure = "kill";
+      ManagedOOMMemoryPressureLimit = "1%";
+    };
+    # A service to bring the system under memory pressure
+    systemd.services.testservice = {
+      serviceConfig.ExecStart = "${pkgs.coreutils}/bin/tail /dev/zero";
+    };
+    # Do not kill the backdoor
+    systemd.services.backdoor.serviceConfig.ManagedOOMMemoryPressure = "auto";
+
+    virtualisation.memorySize = 1024;
+  };
+
+  testScript = ''
+    # Start the system
+    machine.wait_for_unit("multi-user.target")
+    machine.succeed("oomctl")
+
+    # Bring the system into memory pressure
+    machine.succeed("echo 0 > /proc/sys/vm/panic_on_oom")  # NixOS tests kill the VM when the OOM killer is invoked - override this
+    machine.succeed("systemctl start testservice")
+
+    # Wait for oomd to kill something
+    # Matches these lines:
+    # systemd-oomd[508]: Killed /system.slice/systemd-udevd.service due to memory pressure for / being 3.26% > 1.00% for > 1s with reclaim activity
+    machine.wait_until_succeeds("journalctl -b | grep -q 'due to memory pressure for'")
+  '';
+})
diff --git a/nixos/tests/thelounge.nix b/nixos/tests/thelounge.nix
index e9b85685bf2..8d5a37d46c4 100644
--- a/nixos/tests/thelounge.nix
+++ b/nixos/tests/thelounge.nix
@@ -1,4 +1,6 @@
 import ./make-test-python.nix {
+  name = "thelounge";
+
   nodes = {
     private = { config, pkgs, ... }: {
       services.thelounge = {
diff --git a/nixos/tests/web-servers/agate.nix b/nixos/tests/web-servers/agate.nix
index e364e134cfd..e8d789a9ca4 100644
--- a/nixos/tests/web-servers/agate.nix
+++ b/nixos/tests/web-servers/agate.nix
@@ -1,29 +1,27 @@
-import ../make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "agate";
-    meta = with lib.maintainers; { maintainers = [ jk ]; };
+{ pkgs, lib, ... }:
+{
+  name = "agate";
+  meta = with lib.maintainers; { maintainers = [ jk ]; };
 
-    nodes = {
-      geminiserver = { pkgs, ... }: {
-        services.agate = {
-          enable = true;
-          hostnames = [ "localhost" ];
-          contentDir = pkgs.writeTextDir "index.gmi" ''
-            # Hello NixOS!
-          '';
-        };
+  nodes = {
+    geminiserver = { pkgs, ... }: {
+      services.agate = {
+        enable = true;
+        hostnames = [ "localhost" ];
+        contentDir = pkgs.writeTextDir "index.gmi" ''
+          # Hello NixOS!
+        '';
       };
     };
+  };
 
-    testScript = { nodes, ... }: ''
-      geminiserver.wait_for_unit("agate")
-      geminiserver.wait_for_open_port(1965)
+  testScript = { nodes, ... }: ''
+    geminiserver.wait_for_unit("agate")
+    geminiserver.wait_for_open_port(1965)
 
-      with subtest("check is serving over gemini"):
-        response = geminiserver.succeed("${pkgs.gmni}/bin/gmni -j once -i -N gemini://localhost:1965")
-        print(response)
-        assert "Hello NixOS!" in response
-    '';
-  }
-)
+    with subtest("check is serving over gemini"):
+      response = geminiserver.succeed("${pkgs.gmni}/bin/gmni -j once -i -N gemini://localhost:1965")
+      print(response)
+      assert "Hello NixOS!" in response
+  '';
+}
diff --git a/nixos/tests/zrepl.nix b/nixos/tests/zrepl.nix
index 85dd834a6aa..0ed73fea34b 100644
--- a/nixos/tests/zrepl.nix
+++ b/nixos/tests/zrepl.nix
@@ -1,5 +1,7 @@
 import ./make-test-python.nix (
   {
+    name = "zrepl";
+
     nodes.host = {config, pkgs, ...}: {
       config = {
         # Prerequisites for ZFS and tests.
diff --git a/pkgs/applications/audio/bitwig-studio/bitwig-studio4.nix b/pkgs/applications/audio/bitwig-studio/bitwig-studio4.nix
index 401b759016a..4752ca174f1 100644
--- a/pkgs/applications/audio/bitwig-studio/bitwig-studio4.nix
+++ b/pkgs/applications/audio/bitwig-studio/bitwig-studio4.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bitwig-studio";
-  version = "4.3.4";
+  version = "4.3.8";
 
   src = fetchurl {
     url = "https://downloads.bitwig.com/stable/${version}/${pname}-${version}.deb";
-    sha256 = "sha256-2CCxpQPZB5F5jwJCux1OqGuxCuFZus5vlCrmStmI0F8=";
+    sha256 = "sha256-mJIzlY1m/r56e7iw5Hm+u2EbpHn5JqOMaRjpbCe8HHw=";
   };
 
   nativeBuildInputs = [ dpkg makeWrapper wrapGAppsHook ];
diff --git a/pkgs/applications/audio/pyradio/default.nix b/pkgs/applications/audio/pyradio/default.nix
index ba9320037e4..ef31c2a6ee9 100644
--- a/pkgs/applications/audio/pyradio/default.nix
+++ b/pkgs/applications/audio/pyradio/default.nix
@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "pyradio";
-  version = "0.8.9.27";
+  version = "0.8.9.28";
 
   src = fetchFromGitHub {
     owner = "coderholic";
     repo = pname;
     rev = "refs/tags/${version}";
-    sha256 = "sha256-KqSpyDiRhp7DdbFsPor+munMQg+0vv0qF2VI3gkR04Y=";
+    sha256 = "sha256-0j0AQZk+WEkcRTL/peAxzRw23gThlGtMnqoms2aUCrc=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/applications/audio/qpwgraph/default.nix b/pkgs/applications/audio/qpwgraph/default.nix
index f09de4001b1..e9b6e76368e 100644
--- a/pkgs/applications/audio/qpwgraph/default.nix
+++ b/pkgs/applications/audio/qpwgraph/default.nix
@@ -5,14 +5,14 @@
 
 mkDerivation rec {
   pname = "qpwgraph";
-  version = "0.3.5";
+  version = "0.3.6";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "rncbc";
     repo = "qpwgraph";
     rev = "v${version}";
-    sha256 = "sha256-ZpVQjlqz1aPpf04qHMsN06s1n5msf32oB7cJYZf6xAU=";
+    sha256 = "sha256-uN3SAmpurINV+7vw51fWdwnuW2yBxnedY6BXdwn/S2s=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/applications/editors/pixelorama/default.nix b/pkgs/applications/editors/pixelorama/default.nix
index 4c95a93a140..20dcd766b17 100644
--- a/pkgs/applications/editors/pixelorama/default.nix
+++ b/pkgs/applications/editors/pixelorama/default.nix
@@ -9,13 +9,13 @@ let
     else throw "unsupported platform";
 in stdenv.mkDerivation rec {
   pname = "pixelorama";
-  version = "0.10.2";
+  version = "0.10.3";
 
   src = fetchFromGitHub {
     owner = "Orama-Interactive";
     repo = "Pixelorama";
     rev = "v${version}";
-    sha256 = "sha256-IqOBZGo0M8JfREpCv14AvRub6yVTpKfAd5JCNqCVolQ=";
+    sha256 = "sha256-RFE7K8NMl0COzFEhUqWhhYd5MGBsCDJf0T5daPu/4DI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/graphics/gscan2pdf/default.nix b/pkgs/applications/graphics/gscan2pdf/default.nix
index 214688b56f8..fc686ad1f21 100644
--- a/pkgs/applications/graphics/gscan2pdf/default.nix
+++ b/pkgs/applications/graphics/gscan2pdf/default.nix
@@ -10,13 +10,17 @@ with lib;
 
 perlPackages.buildPerlPackage rec {
   pname = "gscan2pdf";
-  version = "2.12.6";
+  version = "2.12.8";
 
   src = fetchurl {
     url = "mirror://sourceforge/gscan2pdf/gscan2pdf-${version}.tar.xz";
-    sha256 = "sha256-9ntpUEM3buT3EhneXz9G8bibvzOnEK6Xt0jJcTvLKT0=";
+    hash = "sha256-dmN2fMBDZqgvdHQryQgjmBHeH/h2dihRH8LkflFYzTk=";
   };
 
+  patches = [
+    ./ffmpeg5-compat.patch
+  ];
+
   nativeBuildInputs = [ wrapGAppsHook ];
 
   buildInputs =
diff --git a/pkgs/applications/graphics/gscan2pdf/ffmpeg5-compat.patch b/pkgs/applications/graphics/gscan2pdf/ffmpeg5-compat.patch
new file mode 100644
index 00000000000..ff522735fe3
--- /dev/null
+++ b/pkgs/applications/graphics/gscan2pdf/ffmpeg5-compat.patch
@@ -0,0 +1,15 @@
+--- a/t/351_unpaper.t
++++ b/t/351_unpaper.t
+@@ -88,8 +88,10 @@
+ 
+                         # if we use unlike, we no longer
+                         # know how many tests there will be
+-                        if ( $msg !~
+-/(deprecated|Encoder did not produce proper pts, making some up)/
++                        if ( $msg !~ /( deprecated |
++                            \Qdoes not contain an image sequence pattern\E |
++                            \QEncoder did not produce proper pts, making some up\E |
++                            \Quse the -update option\E )/x
+                           )
+                         {
+                             fail 'no warnings';
diff --git a/pkgs/applications/misc/cubiomes-viewer/default.nix b/pkgs/applications/misc/cubiomes-viewer/default.nix
index 19dac91c307..2243a8d0937 100644
--- a/pkgs/applications/misc/cubiomes-viewer/default.nix
+++ b/pkgs/applications/misc/cubiomes-viewer/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cubiomes-viewer";
-  version = "2.3.3";
+  version = "2.4.1";
 
   src = fetchFromGitHub {
     owner = "Cubitect";
     repo = pname;
     rev = version;
-    sha256 = "sha256-QNNKfL2pLdOqbjd6t7SLaLcHmyEmmB7vFvj1g6FSTBo=";
+    sha256 = "sha256-vneX3Wo1DUK1WIwBP3nMUDV26EN2A7XIqMcTZQ4UI4A=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/misc/electrum/default.nix b/pkgs/applications/misc/electrum/default.nix
index 01e872dd882..46ea57c6193 100644
--- a/pkgs/applications/misc/electrum/default.nix
+++ b/pkgs/applications/misc/electrum/default.nix
@@ -20,7 +20,7 @@
 }:
 
 let
-  version = "4.3.1";
+  version = "4.3.2";
 
   libsecp256k1_name =
     if stdenv.isLinux then "libsecp256k1.so.0"
@@ -37,7 +37,7 @@ let
     owner = "spesmilo";
     repo = "electrum";
     rev = version;
-    sha256 = "wYblwD+ej65TVkYS7u5MiB37Ka8jENI3aoHi64xAFtU=";
+    sha256 = "sha256-z2/UamKmBq/5a0PTbHdAqGK617Lc8xRhHRpbCc7jeZo=";
 
     postFetch = ''
       mv $out ./all
@@ -53,7 +53,7 @@ python3.pkgs.buildPythonApplication {
 
   src = fetchurl {
     url = "https://download.electrum.org/${version}/Electrum-${version}.tar.gz";
-    sha256 = "pAhsHKIMCB3OutJTrgGNT9PKfTcXcgxUj/x16uBK2Is=";
+    sha256 = "sha256-vTZArTwbKcf6/vPQOvjubPecsg+h+QlZ6rdbl6qNfs0=";
   };
 
   postUnpack = ''
diff --git a/pkgs/applications/misc/geoipupdate/default.nix b/pkgs/applications/misc/geoipupdate/default.nix
index 26d729fe8a7..c2f025d20ae 100644
--- a/pkgs/applications/misc/geoipupdate/default.nix
+++ b/pkgs/applications/misc/geoipupdate/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "geoipupdate";
-  version = "4.9.0";
+  version = "4.10.0";
 
   src = fetchFromGitHub {
     owner = "maxmind";
     repo = "geoipupdate";
     rev = "v${version}";
-    sha256 = "sha256-AqA0hzZGn5XU2Pyoj1vaP+ht7r3dpDhuang4KCXaSgs=";
+    sha256 = "sha256-Djr0IjRxf4kKOsL0KMTAkRjW/zo0+r63TBCjet2ZhNw=";
   };
 
-  vendorSha256 = "sha256-S+CnIPoyGM7dEQICOIlAWBIC24Fyt7q+OY382evDgQc=";
+  vendorSha256 = "sha256-upyblOmT1UC1epOI5H92G/nzcCuGNyh3dbIApUg2Idk=";
 
   ldflags = [ "-X main.version=${version}" ];
 
diff --git a/pkgs/applications/misc/minigalaxy/default.nix b/pkgs/applications/misc/minigalaxy/default.nix
index 6604368b7d7..c33e0d6a576 100644
--- a/pkgs/applications/misc/minigalaxy/default.nix
+++ b/pkgs/applications/misc/minigalaxy/default.nix
@@ -16,13 +16,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "minigalaxy";
-  version = "1.2.1";
+  version = "1.2.2";
 
   src = fetchFromGitHub {
     owner = "sharkwouter";
     repo = pname;
     rev = "refs/tags/${version}";
-    sha256 = "sha256-KTbur9UhV08Wy3Eg/UboG0fZ/6nzNABAildnhe64FEs=";
+    sha256 = "sha256-bpNtdMYBl2dJ4PQsxkhm/Y+3A0dD/Y2XC0VaUYyRhvM=";
   };
 
   checkPhase = ''
diff --git a/pkgs/applications/networking/appgate-sdp/default.nix b/pkgs/applications/networking/appgate-sdp/default.nix
index a5bc03596d4..b93fcc1903b 100644
--- a/pkgs/applications/networking/appgate-sdp/default.nix
+++ b/pkgs/applications/networking/appgate-sdp/default.nix
@@ -87,11 +87,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "appgate-sdp";
-  version = "6.0.1";
+  version = "6.0.2";
 
   src = fetchurl {
     url = "https://bin.appgate-sdp.com/${versions.majorMinor version}/client/appgate-sdp_${version}_amd64.deb";
-    sha256 = "sha256-dVVOUdGJDmStS1ZXqPOFpeWhLgimv4lHBS/OOEDrtM0=";
+    sha256 = "sha256-ut5a/tpWEQX1Jug9IZksnxbQ/rs2pGNh8zBb2a43KUE=";
   };
 
   # just patch interpreter
diff --git a/pkgs/applications/networking/cluster/kyverno/default.nix b/pkgs/applications/networking/cluster/kyverno/default.nix
index f240550d115..d00b1b38b2e 100644
--- a/pkgs/applications/networking/cluster/kyverno/default.nix
+++ b/pkgs/applications/networking/cluster/kyverno/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "kyverno";
-  version = "1.7.3";
+  version = "1.7.4";
 
   src = fetchFromGitHub {
     owner = "kyverno";
     repo = "kyverno";
     rev = "v${version}";
-    sha256 = "sha256-lxfDbsBldMuF++Bb7rXsz+etLC78nTmWAaGbs6mcnBo=";
+    sha256 = "sha256-EzPd4D+pK9mFSoJx9gEWEw9izXum2NgACiBuQ6uTYGo=";
   };
 
   ldflags = [
diff --git a/pkgs/applications/networking/cluster/roxctl/default.nix b/pkgs/applications/networking/cluster/roxctl/default.nix
index 44e96e8c486..ed1f510ca0b 100644
--- a/pkgs/applications/networking/cluster/roxctl/default.nix
+++ b/pkgs/applications/networking/cluster/roxctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "roxctl";
-  version = "3.71.0";
+  version = "3.72.0";
 
   src = fetchFromGitHub {
     owner = "stackrox";
     repo = "stackrox";
     rev = version;
-    sha256 = "sha256-svoSc9cT12nPYbyYz+Uv2edJAt/dJjcqe3E6cKII0KY=";
+    sha256 = "sha256-KsG6L3tQFuA0oTbzgLTChrBIe4a77bygJSIne/D4qiI=";
   };
 
-  vendorSha256 = "sha256-zz8v9HkJPnk4QDRa9eVgI5uvqQLhemq8vOZ0qc9u8es=";
+  vendorSha256 = "sha256-FmpnRgU3w2zthgUJuAG5AqLl2UxMb0yywN5Sk9WoWBI=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/applications/networking/cluster/velero/default.nix b/pkgs/applications/networking/cluster/velero/default.nix
index e587a671368..49d9700feac 100644
--- a/pkgs/applications/networking/cluster/velero/default.nix
+++ b/pkgs/applications/networking/cluster/velero/default.nix
@@ -2,14 +2,14 @@
 
 buildGoModule rec {
   pname = "velero";
-  version = "1.9.1";
+  version = "1.9.2";
 
 
   src = fetchFromGitHub {
     owner = "vmware-tanzu";
     repo = "velero";
     rev = "v${version}";
-    sha256 = "sha256-zGk5Bo1n2VV33wzozgYWbrwd/D3lcSWsqb+s3U3kmus=";
+    sha256 = "sha256-xhsHFb3X1oM68xnYiVEa0eZr7VFdUCkNzeyvci6wb9g=";
   };
 
   ldflags = [
diff --git a/pkgs/applications/networking/cluster/werf/default.nix b/pkgs/applications/networking/cluster/werf/default.nix
index 47553f953db..6c057133217 100644
--- a/pkgs/applications/networking/cluster/werf/default.nix
+++ b/pkgs/applications/networking/cluster/werf/default.nix
@@ -10,13 +10,13 @@
 
 buildGoModule rec {
   pname = "werf";
-  version = "1.2.174";
+  version = "1.2.175";
 
   src = fetchFromGitHub {
     owner = "werf";
     repo = "werf";
     rev = "v${version}";
-    hash = "sha256-8TuAreXWKCXThyiWwiSi5kDVHJKeMB8lpltWbVqGY34=";
+    hash = "sha256-p60+IBy9f31BfmKdYlaHPO93mpIpWeOrDa6vFYrL1eQ=";
   };
 
   vendorHash = "sha256-NHRPl38/R7yS8Hht118mBc+OBPwfYiHOaGIwryNK8Mo=";
diff --git a/pkgs/applications/networking/instant-messengers/alfaview/default.nix b/pkgs/applications/networking/instant-messengers/alfaview/default.nix
index e4813cbbf34..b8995aa8759 100644
--- a/pkgs/applications/networking/instant-messengers/alfaview/default.nix
+++ b/pkgs/applications/networking/instant-messengers/alfaview/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "alfaview";
-  version = "8.52.0";
+  version = "8.53.1";
 
   src = fetchurl {
     url = "https://production-alfaview-assets.alfaview.com/stable/linux/${pname}_${version}.deb";
-    sha256 = "sha256-Taw/qMrqgxFWmRTSed8xINDBGTWx7kteN637Fjrzn44=";
+    sha256 = "sha256-nohChte0jtqIlDulxUi+S04unR4xqeg8DCuYfHwMzP4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/instant-messengers/element/pin.json b/pkgs/applications/networking/instant-messengers/element/pin.json
index 6896b1b41f5..d77b9958fc3 100644
--- a/pkgs/applications/networking/instant-messengers/element/pin.json
+++ b/pkgs/applications/networking/instant-messengers/element/pin.json
@@ -1,7 +1,7 @@
 {
-  "version": "1.11.5",
-  "desktopSrcHash": "JbkB+J2KgHcT8rYv8ovC1r325U5NIHo8Wkh0BogLB+w=",
-  "desktopYarnHash": "1bfpd4a0xrlhm7zq2xz5f184mfp6w4glgyfm4r0y3bi06i4my8vc",
-  "webSrcHash": "XOFgJGnQ85bvkqnwke5Hww658bpBXkUspk46cqvf5AY=",
-  "webYarnHash": "0ab49y2xj8cy4ibcckvd6xhhvkv3fa8kwwlmhxvas2racx51wfnh"
+  "version": "1.11.7",
+  "desktopSrcHash": "0UwcA+i4vmtrmF50O+8Bfzc9n5i1O+/iQYHG3lLerUY=",
+  "desktopYarnHash": "105xj2xwc9g8cfiby0x93gy8w8w5c76mzzxck5mgvawcc6qpvmrc",
+  "webSrcHash": "nJo60QJWhmkyrkHo3VpNspoPvmq+lpRwhNelieqrzto=",
+  "webYarnHash": "1lar5bqkl1d33625phz91r9yxn5hxpf2wg850xzym58kcsdyp1ci"
 }
diff --git a/pkgs/applications/networking/ipfs-cluster/default.nix b/pkgs/applications/networking/ipfs-cluster/default.nix
index 49483ff7eb8..43bc47b17af 100644
--- a/pkgs/applications/networking/ipfs-cluster/default.nix
+++ b/pkgs/applications/networking/ipfs-cluster/default.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "ipfs-cluster";
-  version = "1.0.2";
+  version = "1.0.4";
 
-  vendorSha256 = "sha256-4pCJnQ/X5bvlgyHcRVZ8LyOexaKmz+1xAntMpZCpvd0=";
+  vendorSha256 = "sha256-krjTtH8C1SGhaKMCtsbA2S9ognImof6mwD+vJ/qbyrM=";
 
   src = fetchFromGitHub {
     owner = "ipfs-cluster";
     repo = "ipfs-cluster";
     rev = "v${version}";
-    sha256 = "sha256-Mbq4NzMNIGGFOWuHlToGmel/Oa/K6xzpZTVuXnKHq1M=";
+    sha256 = "sha256-LdcCGUbrS6te03y8R7XJJOcG1j6uU0v8uEMeUHLeidg=";
   };
 
   meta = with lib; {
diff --git a/pkgs/applications/office/paperless-ngx/default.nix b/pkgs/applications/office/paperless-ngx/default.nix
index a6fa092918b..d3faa478e49 100644
--- a/pkgs/applications/office/paperless-ngx/default.nix
+++ b/pkgs/applications/office/paperless-ngx/default.nix
@@ -8,7 +8,7 @@
 , optipng
 , pngquant
 , qpdf
-, tesseract4
+, tesseract5
 , unpaper
 , liberation_ttf
 , fetchFromGitHub
@@ -55,7 +55,7 @@ let
     optipng
     pngquant
     qpdf
-    tesseract4
+    tesseract5
     unpaper
   ];
 in
diff --git a/pkgs/applications/science/astronomy/siril/default.nix b/pkgs/applications/science/astronomy/siril/default.nix
index a9980afdc44..7e59c2865e5 100644
--- a/pkgs/applications/science/astronomy/siril/default.nix
+++ b/pkgs/applications/science/astronomy/siril/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "siril";
-  version = "1.0.3";
+  version = "1.0.5";
 
   src = fetchFromGitLab {
     owner = "free-astro";
     repo = pname;
     rev = version;
-    sha256 = "sha256-Y5ED2LuNapaq+FkKg3m8t4sgoh2TGXO1VX0p5gwlJjQ=";
+    sha256 = "sha256-1NPMTHPbYKPmaG+xRyKFU4/4Iio2ptn+HOvnsg4hoFE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/science/biology/delly/default.nix b/pkgs/applications/science/biology/delly/default.nix
index ee4a8f29944..f758e411679 100644
--- a/pkgs/applications/science/biology/delly/default.nix
+++ b/pkgs/applications/science/biology/delly/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "delly";
-  version = "1.1.3";
+  version = "1.1.5";
 
   src = fetchFromGitHub {
       owner = "dellytools";
       repo = pname;
       rev = "v${version}";
-      sha256 = "sha256-fGwSRYpvGYyYvRvP1ljs3mhXRpONzO5/QVegjqMsOdk=";
+      sha256 = "sha256-K75tpbW1h84gzZ+s5jMzmFItfBi6rjkAhzks9F0gYpA=";
   };
 
   buildInputs = [ zlib htslib bzip2 xz ncurses boost ];
diff --git a/pkgs/applications/window-managers/dwm/dwm-status.nix b/pkgs/applications/window-managers/dwm/dwm-status.nix
index 1b83e28309e..a1b790b33da 100644
--- a/pkgs/applications/window-managers/dwm/dwm-status.nix
+++ b/pkgs/applications/window-managers/dwm/dwm-status.nix
@@ -9,19 +9,19 @@ in
 
 rustPlatform.buildRustPackage rec {
   pname = "dwm-status";
-  version = "1.7.3";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "Gerschtli";
     repo = pname;
     rev = version;
-    sha256 = "sha256-dkVo9NpGt3G6by9Of1kOlXaZn7xsVSvfNXq7KPO6HE4=";
+    sha256 = "sha256-BCnEnBB0OCUwvhh4XEI2eOzfy34VHNFzbqqW26X6If0=";
   };
 
   nativeBuildInputs = [ makeWrapper pkg-config ];
   buildInputs = [ dbus gdk-pixbuf libnotify xorg.libX11 ];
 
-  cargoSha256 = "sha256-QPnr7dUsq/RzuNLpbTRQbGB3zU6lNuPPPM9FmH4ydzY=";
+  cargoSha256 = "sha256-ylB0XGmIPW7Dbc6eDS8FZsq1AOOqntx1byaH3XIal0I=";
 
   postInstall = lib.optionalString (bins != [])  ''
     wrapProgram $out/bin/dwm-status --prefix "PATH" : "${lib.makeBinPath bins}"
diff --git a/pkgs/common-updater/scripts/update-source-version b/pkgs/common-updater/scripts/update-source-version
index 12a63fa9260..75ad6e7a5cf 100755
--- a/pkgs/common-updater/scripts/update-source-version
+++ b/pkgs/common-updater/scripts/update-source-version
@@ -237,9 +237,13 @@ fi
 if [[ -z "$newHash" ]]; then
     nix-build $systemArg --no-out-link -A "$attr.$sourceKey" 2>"$attr.fetchlog" >/dev/null || true
     # FIXME: use nix-build --hash here once https://github.com/NixOS/nix/issues/1172 is fixed
-    newHash=$(sed '1,/hash mismatch in fixed-output derivation/d' "$attr.fetchlog" | grep --perl-regexp --only-matching 'got: +.+[:-]\K.+')
+    newHash=$(
+        sed '1,/hash mismatch in fixed-output derivation/d' "$attr.fetchlog" \
+        | grep --perl-regexp --only-matching 'got: +.+[:-]\K.+' \
+        || true # handled below
+    )
 
-    if [[ -n "$sri" ]]; then
+    if [[ -n "$newHash" && -n "$sri" ]]; then
         # nix-build preserves the hashing scheme so we can just convert the result to SRI using the old type
         newHash="$(nix --extra-experimental-features nix-command hash to-sri --type "$oldHashAlgo" "$newHash" 2>/dev/null \
             || nix to-sri --type "$oldHashAlgo" "$newHash" 2>/dev/null)" \
diff --git a/pkgs/data/misc/hackage/pin.json b/pkgs/data/misc/hackage/pin.json
index d24661ecd03..b6342141f38 100644
--- a/pkgs/data/misc/hackage/pin.json
+++ b/pkgs/data/misc/hackage/pin.json
@@ -1,6 +1,6 @@
 {
-  "commit": "12bd870a1ed095ff74dbe08ef4d5d930821e878d",
-  "url": "https://github.com/commercialhaskell/all-cabal-hashes/archive/12bd870a1ed095ff74dbe08ef4d5d930821e878d.tar.gz",
-  "sha256": "196pl60xyv4ij1nxz4hv5fhmliisb5dmxl8w1jfl07z22cpd92p5",
-  "msg": "Update from Hackage at 2022-09-21T15:25:15Z"
+  "commit": "2712aaf8b4e5941ccc467326be418c19f4192703",
+  "url": "https://github.com/commercialhaskell/all-cabal-hashes/archive/2712aaf8b4e5941ccc467326be418c19f4192703.tar.gz",
+  "sha256": "0gsy99iqazv1cg0vznvdzf8q3zm5flv5645jx3q78fmq1rdzqwny",
+  "msg": "Update from Hackage at 2022-09-25T05:09:53Z"
 }
diff --git a/pkgs/desktops/gnome/update.nix b/pkgs/desktops/gnome/update.nix
index f5db71174ad..e945e005d48 100644
--- a/pkgs/desktops/gnome/update.nix
+++ b/pkgs/desktops/gnome/update.nix
@@ -12,7 +12,13 @@ let
       minorAvailable = builtins.length versionComponents > 1 && builtins.match "[0-9]+" minorVersion != null;
       nextMinor = builtins.fromJSON minorVersion + 1;
       upperBound = "${lib.versions.major packageVersion}.${builtins.toString nextMinor}";
-    in lib.optionals (freeze && minorAvailable) [ upperBound ];
+    in
+    if builtins.isBool freeze then
+      lib.optionals (freeze && minorAvailable) [ upperBound ]
+    else if builtins.isString freeze then
+      [ freeze ]
+    else
+      throw "“freeze” argument needs to be either a boolean, or a version string.";
   updateScript = writeScript "gnome-update-script" ''
     #!${bash}/bin/bash
     set -o errexit
diff --git a/pkgs/development/compilers/ghc/9.2.2-binary.nix b/pkgs/development/compilers/ghc/9.2.4-binary.nix
index 53b56b04479..4cd22a358e1 100644
--- a/pkgs/development/compilers/ghc/9.2.2-binary.nix
+++ b/pkgs/development/compilers/ghc/9.2.4-binary.nix
@@ -19,8 +19,8 @@ assert stdenv.targetPlatform == stdenv.hostPlatform;
 let
   downloadsUrl = "https://downloads.haskell.org/ghc";
 
-  # Copy sha256 from https://downloads.haskell.org/~ghc/9.2.2/SHA256SUMS
-  version = "9.2.2";
+  # Copy sha256 from https://downloads.haskell.org/~ghc/9.2.4/SHA256SUMS
+  version = "9.2.4";
 
   # Information about available bindists that we use in the build.
   #
@@ -46,7 +46,7 @@ let
         variantSuffix = "";
         src = {
           url = "${downloadsUrl}/${version}/ghc-${version}-i386-deb9-linux.tar.xz";
-          sha256 = "24234486ed4508161c6f88f4750a36d38b135b0c6e5fe78efe2d85c612ecaf9e";
+          sha256 = "5dc1eb9c65f01b1e5c5693af72af07a4e9e75c6920e620fd598daeefa804487a";
         };
         exePathForLibraryCheck = "ghc/stage2/build/tmp/ghc-stage2";
         archSpecificLibraries = [
@@ -61,19 +61,7 @@ let
         variantSuffix = "";
         src = {
           url = "${downloadsUrl}/${version}/ghc-${version}-x86_64-deb10-linux.tar.xz";
-          sha256 = "fb61dea556a2023dc2d50ee61a22144bb23e4229a378e533065124c218f40cfc";
-        };
-        exePathForLibraryCheck = "ghc/stage2/build/tmp/ghc-stage2";
-        archSpecificLibraries = [
-          { nixPackage = gmp; fileToCheckFor = null; }
-          { nixPackage = ncurses6; fileToCheckFor = "libtinfo.so.6"; }
-        ];
-      };
-      armv7l-linux = {
-        variantSuffix = "";
-        src = {
-          url = "${downloadsUrl}/${version}/ghc-${version}-armv7-deb10-linux.tar.xz";
-          sha256 = "ce5a7c3beb19d8c13a9e60bd39d3ba8ef0060b954ea42eb23f1ef8d077fa9e8b";
+          sha256 = "a77a91a39d9b0167124b7e97648b2b52973ae0978cb259e0d44f0752a75037cb";
         };
         exePathForLibraryCheck = "ghc/stage2/build/tmp/ghc-stage2";
         archSpecificLibraries = [
@@ -85,7 +73,7 @@ let
         variantSuffix = "";
         src = {
           url = "${downloadsUrl}/${version}/ghc-${version}-aarch64-deb10-linux.tar.xz";
-          sha256 = "f3621ccba7ae48fcd67a9505f61bb5ccfb05c4cbfecd5a6ea65fe3f150af0e98";
+          sha256 = "fc7dbc6bae36ea5ac30b7e9a263b7e5be3b45b0eb3e893ad0bc2c950a61f14ec";
         };
         exePathForLibraryCheck = "ghc/stage2/build/tmp/ghc-stage2";
         archSpecificLibraries = [
@@ -98,7 +86,7 @@ let
         variantSuffix = "";
         src = {
           url = "${downloadsUrl}/${version}/ghc-${version}-x86_64-apple-darwin.tar.xz";
-          sha256 = "934abbd6083d3aeb5ff081955682d7711d9e79db57b1613eb229c325dd06f83f";
+          sha256 = "f2e8366fd3754dd9388510792aba2d2abecb1c2f7f1e5555f6065c3c5e2ffec4";
         };
         exePathForLibraryCheck = null; # we don't have a library check for darwin yet
         archSpecificLibraries = [
@@ -111,7 +99,7 @@ let
         variantSuffix = "";
         src = {
           url = "${downloadsUrl}/${version}/ghc-${version}-aarch64-apple-darwin.tar.xz";
-          sha256 = "d1f04f7cc062ed134f863305c67dfe2c42df46ed658dd34f9dd552186f194e5c";
+          sha256 = "8cf8408544a1a43adf1bbbb0dd6b074efadffc68bfa1a792947c52e825171224";
         };
         exePathForLibraryCheck = null; # we don't have a library check for darwin yet
         archSpecificLibraries = [
@@ -127,7 +115,7 @@ let
         variantSuffix = "-musl";
         src = {
           url = "${downloadsUrl}/${version}/ghc-${version}-x86_64-alpine3.12-linux-gmp.tar.xz";
-          sha256 = "624523826e24eae33c03490267cddecc1d80c047f2a3f4b03580f1040112d5c0";
+          sha256 = "026348947d30a156b84de5d6afeaa48fdcb2795b47954cd8341db00d3263a481";
         };
         isStatic = true;
         # We can't check the RPATH for statically linked executable
diff --git a/pkgs/development/embedded/stm8/stm8flash/default.nix b/pkgs/development/embedded/stm8/stm8flash/default.nix
new file mode 100644
index 00000000000..eaf1a19c91b
--- /dev/null
+++ b/pkgs/development/embedded/stm8/stm8flash/default.nix
@@ -0,0 +1,34 @@
+{ lib, stdenv, fetchFromGitHub, libusb1, pkg-config }:
+
+stdenv.mkDerivation rec {
+  pname = "stm8flash";
+  version = "2022-03-27";
+
+  src = fetchFromGitHub {
+    owner = "vdudouyt";
+    repo = "stm8flash";
+    rev = "23305ce5adbb509c5cb668df31b0fd6c8759639c";
+    sha256 = "sha256-fFoC2EKSmYyW2lqrdAh5A2WEtUMCenKse2ySJdNHu6w=";
+  };
+
+  strictDeps = true;
+  enableParallelBuilding = true;
+
+  # NOTE: _FORTIFY_SOURCE requires compiling with optimization (-O)
+  NIX_CFLAGS_COMPILE = "-O";
+
+  preBuild = ''
+    export DESTDIR=$out;
+  '';
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ libusb1 ];
+
+  meta = with lib; {
+    homepage = "https://github.com/vdudouyt/stm8flash";
+    description = "A tool for flashing STM8 MCUs via ST-LINK (V1 and V2)";
+    maintainers = with maintainers; [ pkharvey ];
+    license = licenses.gpl2;
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix
index f7041b8222b..d83d6fd30cc 100644
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@@ -121,6 +121,9 @@ self: super: {
     postPatch = "sed -i s/home/tmp/ test/Spec.hs";
   }) super.shell-conduit;
 
+  # https://github.com/cachix/cachix/pull/451
+  cachix = appendPatch ./patches/cachix.patch super.cachix;
+
   # https://github.com/froozen/kademlia/issues/2
   kademlia = dontCheck super.kademlia;
 
diff --git a/pkgs/development/haskell-modules/configuration-hackage2nix/broken.yaml b/pkgs/development/haskell-modules/configuration-hackage2nix/broken.yaml
index d152dec5e27..19ce347c467 100644
--- a/pkgs/development/haskell-modules/configuration-hackage2nix/broken.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix/broken.yaml
@@ -454,6 +454,7 @@ broken-packages:
   - BPS
   - braid
   - brain-bleep
+  - brassica
   - Bravo
   - brians-brain
   - brick-dropdownmenu
@@ -3944,7 +3945,6 @@ broken-packages:
   - polysemy-mocks
   - polysemy-readline
   - polysemy-scoped-fs
-  - polysemy-zoo
   - polytypeable
   - pomaps
   - pomohoro
@@ -3959,6 +3959,8 @@ broken-packages:
   - portager
   - porte
   - PortFusion
+  - portray-pretty
+  - portray-prettyprinter
   - positron
   - posix-acl
   - posix-api
@@ -4216,6 +4218,7 @@ broken-packages:
   - reanimate-svg
   - reasonable-lens
   - reason-export
+  - rec-def
   - record
   - record-encode
   - record-impl
@@ -4357,6 +4360,7 @@ broken-packages:
   - rivet-simple-deploy
   - RJson
   - Rlang-QQ
+  - rle
   - rlglue
   - RLP
   - rl-satton
@@ -4525,6 +4529,7 @@ broken-packages:
   - servant-namedargs
   - servant-nix
   - servant-pandoc
+  - servant-polysemy
   - servant-pool
   - servant-proto-lens
   - servant-purescript
@@ -4649,6 +4654,7 @@ broken-packages:
   - singnal
   - singular-factory
   - sink
+  - sint
   - sitepipe
   - sixfiguregroup
   - sized-grid
@@ -5055,6 +5061,7 @@ broken-packages:
   - tempodb
   - temporal-csound
   - tempus
+  - ten
   - tensor
   - tensorflow
   - tensorflow-opgen
@@ -5202,6 +5209,7 @@ broken-packages:
   - tomato-rubato-openal
   - toml
   - toml-parser
+  - toml-reader-parse
   - tonalude
   - tonaparser
   - toodles
diff --git a/pkgs/development/haskell-modules/configuration-hackage2nix/stackage.yaml b/pkgs/development/haskell-modules/configuration-hackage2nix/stackage.yaml
index d15dbb313b0..40512dd991f 100644
--- a/pkgs/development/haskell-modules/configuration-hackage2nix/stackage.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix/stackage.yaml
@@ -1,4 +1,4 @@
-# Stackage LTS 19.24
+# Stackage LTS 19.25
 # This file is auto-generated by
 # maintainers/scripts/haskell/update-stackage.sh
 default-package-overrides:
@@ -352,7 +352,7 @@ default-package-overrides:
   - clumpiness ==0.17.0.2
   - ClustalParser ==1.3.0
   - cmark ==0.6
-  - cmark-gfm ==0.2.3
+  - cmark-gfm ==0.2.4
   - cmark-lucid ==0.1.0.0
   - cmdargs ==0.10.21
   - codec-beam ==0.2.0
@@ -408,7 +408,7 @@ default-package-overrides:
   - conferer-aeson ==1.1.0.2
   - conferer-warp ==1.1.0.0
   - ConfigFile ==1.1.4
-  - config-ini ==0.2.4.0
+  - config-ini ==0.2.5.0
   - configuration-tools ==0.6.1
   - configurator ==0.3.0.0
   - configurator-export ==0.1.0.1
@@ -622,7 +622,7 @@ default-package-overrides:
   - drifter ==0.3.0
   - drifter-postgresql ==0.2.1
   - drifter-sqlite ==0.1.0.0
-  - dsp ==0.2.5.1
+  - dsp ==0.2.5.2
   - dual ==0.1.1.1
   - dual-tree ==0.2.3.1
   - dublincore-xml-conduit ==0.1.0.2
@@ -708,7 +708,7 @@ default-package-overrides:
   - exomizer ==1.0.0
   - experimenter ==0.1.0.12
   - expiring-cache-map ==0.0.6.1
-  - explainable-predicates ==0.1.2.2
+  - explainable-predicates ==0.1.2.3
   - explicit-exception ==0.1.10
   - exp-pairs ==0.2.1.0
   - express ==1.0.10
@@ -846,7 +846,7 @@ default-package-overrides:
   - genvalidity-bytestring ==1.0.0.0
   - genvalidity-containers ==1.0.0.0
   - genvalidity-criterion ==1.0.0.0
-  - genvalidity-hspec ==1.0.0.1
+  - genvalidity-hspec ==1.0.0.2
   - genvalidity-hspec-aeson ==1.0.0.0
   - genvalidity-hspec-binary ==1.0.0.0
   - genvalidity-hspec-cereal ==1.0.0.0
@@ -2135,8 +2135,8 @@ default-package-overrides:
   - search-algorithms ==0.3.2
   - secp256k1-haskell ==0.6.1
   - securemem ==0.1.10
-  - selda ==0.5.1.0
-  - selda-sqlite ==0.1.7.1
+  - selda ==0.5.2.0
+  - selda-sqlite ==0.1.7.2
   - selections ==0.3.0.0
   - selective ==0.5
   - semialign ==1.2.0.1
@@ -2360,7 +2360,7 @@ default-package-overrides:
   - string-conversions ==0.4.0.1
   - string-interpolate ==0.3.1.2
   - string-qq ==0.0.4
-  - string-random ==0.1.4.2
+  - string-random ==0.1.4.3
   - stringsearch ==0.3.6.6
   - string-transform ==1.1.1
   - stripe-concepts ==1.0.3.1
@@ -2510,7 +2510,7 @@ default-package-overrides:
   - through-text ==0.1.0.0
   - th-strict-compat ==0.1.0.1
   - th-test-utils ==1.1.1
-  - th-utilities ==0.2.4.3
+  - th-utilities ==0.2.5.0
   - tidal ==1.7.10
   - tile ==0.3.0.0
   - time-compat ==1.9.6.1
@@ -2841,7 +2841,7 @@ with-compiler: ghc-9.0.2
   - yesod-bin ==1.6.2.2
   - yesod-core ==1.6.24.0
   - yesod-eventsource ==1.6.0.1
-  - yesod-form ==1.7.0
+  - yesod-form ==1.7.2
   - yesod-form-bootstrap4 ==3.0.1
   - yesod-gitrepo ==0.3.0
   - yesod-gitrev ==0.2.2
@@ -2854,7 +2854,7 @@ with-compiler: ghc-9.0.2
   - yesod-routes-flow ==3.0.0.2
   - yesod-sitemap ==1.6.0
   - yesod-static ==1.6.1.0
-  - yesod-test ==1.6.14
+  - yesod-test ==1.6.15
   - yesod-websockets ==0.3.0.3
   - yes-precure5-command ==5.5.3
   - yi-rope ==0.11
diff --git a/pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml b/pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml
index 329f9eb7514..2a6c9d5dabe 100644
--- a/pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml
@@ -1168,6 +1168,7 @@ dont-distribute-packages:
  - dep-t-advice
  - dep-t-dynamic
  - dep-t-value
+ - dependent-literals
  - dependent-literals-plugin
  - dependent-state
  - depends
@@ -1201,7 +1202,6 @@ dont-distribute-packages:
  - direct-rocksdb
  - directory-contents
  - dirfiles
- - disco
  - discogs-haskell
  - discord-gateway
  - discord-hs
@@ -1283,6 +1283,7 @@ dont-distribute-packages:
  - edge
  - edges
  - editable
+ - edits
  - effective-aspects-mzv
  - eflint
  - egison
@@ -1413,6 +1414,7 @@ dont-distribute-packages:
  - filepath-io-access
  - filesystem-abstractions
  - filesystem-enumerator
+ - fin-int
  - find-clumpiness
  - findhttp
  - finitary-derive
@@ -2024,6 +2026,7 @@ dont-distribute-packages:
  - hedgehog-gen-json
  - hedis-pile
  - heist-aeson
+ - heist-extra
  - helic
  - helics
  - helics-wai
@@ -2564,6 +2567,7 @@ dont-distribute-packages:
  - ltext
  - luachunk
  - lucid-colonnade
+ - lucid2-htmx
  - lucienne
  - luhn
  - lui
@@ -2992,9 +2996,7 @@ dont-distribute-packages:
  - poke
  - polh-lexicon
  - polydata
- - polysemy-RandomFu
  - polysemy-http
- - polysemy-optics
  - polyseq
  - polytypeable-utils
  - pomodoro
@@ -3003,6 +3005,8 @@ dont-distribute-packages:
  - porcupine-core
  - porcupine-http
  - porcupine-s3
+ - portray-diff-hunit
+ - portray-diff-quickcheck
  - ports
  - poseidon
  - poseidon-postgis
@@ -3390,7 +3394,6 @@ dont-distribute-packages:
  - servant-matrix-param
  - servant-oauth2
  - servant-oauth2-examples
- - servant-polysemy
  - servant-postgresql
  - servant-pushbullet-client
  - servant-rate-limit
@@ -3675,10 +3678,11 @@ dont-distribute-packages:
  - tdlib
  - tdlib-gen
  - tdlib-types
- - techlab
  - telega
  - telegram-bot
  - telegram-raw-api
+ - ten-lens
+ - ten-unordered-containers
  - tensorflow-core-ops
  - tensorflow-logging
  - tensorflow-ops
diff --git a/pkgs/development/haskell-modules/configuration-nix.nix b/pkgs/development/haskell-modules/configuration-nix.nix
index 6e341278b6e..dc25fdb6c3a 100644
--- a/pkgs/development/haskell-modules/configuration-nix.nix
+++ b/pkgs/development/haskell-modules/configuration-nix.nix
@@ -154,11 +154,18 @@ self: super: builtins.intersectAttrs super {
   # Add necessary reference to gtk3 package
   gi-dbusmenugtk3 = addPkgconfigDepend pkgs.gtk3 super.gi-dbusmenugtk3;
 
-  hs-mesos = overrideCabal (drv: {
-    # Pass _only_ mesos; the correct protobuf is propagated.
-    extraLibraries = [ pkgs.mesos ];
-    preConfigure = "sed -i -e /extra-lib-dirs/d -e 's|, /usr/include, /usr/local/include/mesos||' hs-mesos.cabal";
-  }) super.hs-mesos;
+  # Doesn't declare boost dependency
+  nix-serve-ng = overrideSrc {
+    src = assert super.nix-serve-ng.version == "1.0.0";
+      # Workaround missing files in sdist
+      # https://github.com/aristanetworks/nix-serve-ng/issues/10
+      pkgs.fetchFromGitHub {
+        repo = "nix-serve-ng";
+        owner = "aristanetworks";
+        rev = "433f70f4daae156b84853f5aaa11987aa5ce7277";
+        sha256 = "0mqp67z5mi8rsjahdh395n7ppf0b65k8rd3pvnl281g02rbr69y2";
+      };
+  } (addPkgconfigDepend pkgs.boost.dev super.nix-serve-ng);
 
   # These packages try to access the network.
   amqp = dontCheck super.amqp;
@@ -949,6 +956,19 @@ self: super: builtins.intersectAttrs super {
     '';
   }) super.fourmolu_0_8_2_0;
 
+  # Test suite needs to execute 'disco' binary
+  disco = overrideCabal (drv: {
+    preCheck = drv.preCheck or "" + ''
+      export PATH="$PWD/dist/build/disco:$PATH"
+    '';
+    testFlags = drv.testFlags or [] ++ [
+      # Needs network access
+      "-p" "!/oeis/"
+    ];
+    # disco-examples needs network access
+    testTarget = "disco-tests";
+  }) super.disco;
+
   # Apply a patch which hardcodes the store path of graphviz instead of using
   # whatever graphviz is in PATH.
   graphviz = overrideCabal (drv: {
diff --git a/pkgs/development/haskell-modules/hackage-packages.nix b/pkgs/development/haskell-modules/hackage-packages.nix
index b364787e620..63331bf7949 100644
--- a/pkgs/development/haskell-modules/hackage-packages.nix
+++ b/pkgs/development/haskell-modules/hackage-packages.nix
@@ -12,6 +12,8 @@ self: {
        pname = "2captcha";
        version = "0.1.0.0";
        sha256 = "1876bdriagjfp4dyhhkpjrwa8kycvwa0zrdihw5q7dj5msmnxsrc";
+       revision = "2";
+       editedCabalFile = "1bqa1a49v1xbkl4p4q34wxk3a4pw5nkr6vb1s1lrdmdnkbf77y6v";
        libraryHaskellDepends = [
          aeson base bytestring clock exceptions http-client lens lens-aeson
          parsec text wreq
@@ -16925,17 +16927,15 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
-  "PyF_0_11_0_0" = callPackage
+  "PyF_0_11_1_0" = callPackage
     ({ mkDerivation, base, bytestring, deepseq, filepath, ghc, ghc-boot
      , hspec, HUnit, mtl, parsec, process, template-haskell, temporary
      , text, time
      }:
      mkDerivation {
        pname = "PyF";
-       version = "0.11.0.0";
-       sha256 = "0c5dahiad6rnr1v6s8mijyw9z5xhiip5ycrlwphq1wzm6prmx6ma";
-       revision = "1";
-       editedCabalFile = "091gbpmwhzvkmsk1kpsczwqb02vyw3603mqxflrajg9h2idgsdkd";
+       version = "0.11.1.0";
+       sha256 = "07qwws303g4yzs01qi4r2nqjyp5sk2naiqb4qh9kirp54fn53m4g";
        libraryHaskellDepends = [
          base bytestring ghc ghc-boot mtl parsec template-haskell text time
        ];
@@ -21570,8 +21570,8 @@ self: {
     ({ mkDerivation, base, bytestring, transformers, vector, vulkan }:
      mkDerivation {
        pname = "VulkanMemoryAllocator";
-       version = "0.10.1";
-       sha256 = "0h9d6dnph9mbjyb6r77scy98j564i92nvipdrl4r5rhlni8hdj4p";
+       version = "0.10.2";
+       sha256 = "122r9za1vlgkm03lbq8yvpngacinick88vs9dpizd80rb2z4dy6k";
        libraryHaskellDepends = [
          base bytestring transformers vector vulkan
        ];
@@ -43052,8 +43052,8 @@ self: {
     ({ mkDerivation, base, bytestring, cborg, serialise }:
      mkDerivation {
        pname = "binary-serialise-cbor";
-       version = "0.2.1.0";
-       sha256 = "0qdbz2qvvqiaqp859fn00470gzxpvw8k3v0wqclgqps3zj9g9854";
+       version = "0.2.2.0";
+       sha256 = "16yhimka17dza5nda62927k5x66c0yrsxzz92kya3gicd6vaga2g";
        libraryHaskellDepends = [ base bytestring cborg serialise ];
        description = "Yet Another Binary Serialisation Library (compatibility shim)";
        license = lib.licenses.bsd3;
@@ -48190,6 +48190,39 @@ self: {
        mainProgram = "brainheck";
      }) {};
 
+  "brassica" = callPackage
+    ({ mkDerivation, base, bytestring, conduit, containers, criterion
+     , deepseq, file-embed, megaparsec, mtl, optparse-applicative
+     , parser-combinators, split, tasty, tasty-golden, text
+     , transformers, utf8-string
+     }:
+     mkDerivation {
+       pname = "brassica";
+       version = "0.0.3";
+       sha256 = "1anqswy00v2kg3l5n9m5cydpbhar7jqlj5ixki8k99ids0w1fws9";
+       revision = "1";
+       editedCabalFile = "0avv063fz3l71j241fvlvf26gv78n02fb6w61vd31aial073bwdc";
+       isLibrary = true;
+       isExecutable = true;
+       libraryHaskellDepends = [
+         base containers deepseq megaparsec mtl parser-combinators split
+         transformers
+       ];
+       executableHaskellDepends = [
+         base bytestring conduit optparse-applicative text
+       ];
+       testHaskellDepends = [
+         base bytestring conduit tasty tasty-golden text transformers
+         utf8-string
+       ];
+       benchmarkHaskellDepends = [ base criterion file-embed text ];
+       description = "Featureful sound change applier";
+       license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
+       mainProgram = "brassica";
+       broken = true;
+     }) {};
+
   "break" = callPackage
     ({ mkDerivation, base, mtl, transformers }:
      mkDerivation {
@@ -52331,7 +52364,7 @@ self: {
        mainProgram = "cabal-plan";
      }) {};
 
-  "cabal-plan_0_7_2_2" = callPackage
+  "cabal-plan_0_7_2_3" = callPackage
     ({ mkDerivation, aeson, ansi-terminal, async, base, base-compat
      , base16-bytestring, bytestring, containers, directory, filepath
      , mtl, optics-core, optparse-applicative, parsec, process
@@ -52340,8 +52373,8 @@ self: {
      }:
      mkDerivation {
        pname = "cabal-plan";
-       version = "0.7.2.2";
-       sha256 = "0ld2hgyyx64ns9cfxp1blb3azkv951qrcpx878hdvx2cdllgyy31";
+       version = "0.7.2.3";
+       sha256 = "0zrk1hai7j0kk7l3nv1ca6srzz36dv1rmvzw7zby945nam7030k2";
        configureFlags = [ "-fexe" ];
        isLibrary = true;
        isExecutable = true;
@@ -53104,35 +53137,36 @@ self: {
   "cachix" = callPackage
     ({ mkDerivation, aeson, async, base, base64-bytestring, bytestring
      , cachix-api, concurrent-extra, conduit, conduit-extra, containers
-     , cookie, cryptonite, dhall, directory, ed25519, extra, filepath
-     , fsnotify, hercules-ci-cnix-store, here, hspec, hspec-discover
-     , http-client, http-client-tls, http-conduit, http-types
-     , inline-c-cpp, katip, lukko, lzma-conduit, megaparsec, memory
-     , mmorph, netrc, nix, optparse-applicative, pretty-terminal
-     , process, protolude, resourcet, retry, safe-exceptions, servant
-     , servant-auth, servant-auth-client, servant-client
-     , servant-client-core, servant-conduit, stm, stm-chans, stm-conduit
-     , systemd, temporary, text, time, unix, unordered-containers
-     , uri-bytestring, uuid, vector, versions, websockets, wuss
+     , cookie, cryptonite, dhall, directory, ed25519, either, extra
+     , filepath, fsnotify, hercules-ci-cnix-store, here, hspec
+     , hspec-discover, http-client, http-client-tls, http-conduit
+     , http-types, inline-c-cpp, katip, lukko, lzma-conduit, megaparsec
+     , memory, mmorph, netrc, nix, optparse-applicative, pretty-terminal
+     , prettyprinter, process, protolude, resourcet, retry
+     , safe-exceptions, servant, servant-auth, servant-auth-client
+     , servant-client, servant-client-core, servant-conduit, stm
+     , stm-chans, stm-conduit, systemd, temporary, text, time, unix
+     , unordered-containers, uri-bytestring, uuid, vector, versions
+     , websockets, wuss
      }:
      mkDerivation {
        pname = "cachix";
-       version = "1.0.0";
-       sha256 = "0gj5phmvcy6q6nd50yl9sg77aqb1nwm5z74lvijpb27cz453b8i1";
+       version = "1.0.1";
+       sha256 = "0jgs43h6pmyyq3r1sc7d27zsdxr5fbimgdvl8r8l1fdw1nlb322q";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
          aeson async base base64-bytestring bytestring cachix-api
          concurrent-extra conduit conduit-extra containers cookie cryptonite
-         dhall directory ed25519 extra filepath fsnotify
+         dhall directory ed25519 either extra filepath fsnotify
          hercules-ci-cnix-store here http-client http-client-tls
          http-conduit http-types inline-c-cpp katip lukko lzma-conduit
          megaparsec memory mmorph netrc optparse-applicative pretty-terminal
-         process protolude resourcet retry safe-exceptions servant
-         servant-auth servant-auth-client servant-client servant-client-core
-         servant-conduit stm stm-conduit systemd temporary text time unix
-         unordered-containers uri-bytestring uuid vector versions websockets
-         wuss
+         prettyprinter process protolude resourcet retry safe-exceptions
+         servant servant-auth servant-auth-client servant-client
+         servant-client-core servant-conduit stm stm-conduit systemd
+         temporary text time unix unordered-containers uri-bytestring uuid
+         vector versions websockets wuss
        ];
        libraryPkgconfigDepends = [ nix ];
        executableHaskellDepends = [
@@ -53160,8 +53194,8 @@ self: {
      }:
      mkDerivation {
        pname = "cachix-api";
-       version = "1.0.0";
-       sha256 = "1fx3d32y6xhc4djkdwssn7v44fm4wq5r23gjghddd0bd6z1rbrss";
+       version = "1.0.1";
+       sha256 = "1bv4pbzqzkfll8zm9qdrwbpj80jgdk5n0jby52j8szkvbj4rd357";
        libraryHaskellDepends = [
          aeson async base base16-bytestring bytestring conduit cookie
          cryptonite deepseq deriving-aeson exceptions http-api-data
@@ -54253,6 +54287,8 @@ self: {
        pname = "captcha-2captcha";
        version = "0.1.0.0";
        sha256 = "19r7977vkbyd6if9bvh9m2vv2wmhynly6qzsq7ndckn4yw4xc5wx";
+       revision = "1";
+       editedCabalFile = "16rvzkg7wy82crgmlz68y9gljp5vv1dldwp3gdn61y95cmi9pybi";
        libraryHaskellDepends = [
          aeson base bytestring captcha-core errors extra http-client lens
          lens-aeson mtl o-clock string-conversions string-interpolate text
@@ -54278,6 +54314,8 @@ self: {
        pname = "captcha-capmonster";
        version = "0.1.0.0";
        sha256 = "0ps7dwbkafi92a408c0fcc15vjp8b2gf400ijbx4vz5vm0s9dzvl";
+       revision = "1";
+       editedCabalFile = "14dl2762c0n4h3492252l3y3gyw9ds44hhw2123hlaq542apqvff";
        libraryHaskellDepends = [
          aeson aeson-qq base bytestring captcha-core errors extra
          http-client lens lens-aeson mtl o-clock string-interpolate text
@@ -54302,6 +54340,8 @@ self: {
        pname = "captcha-core";
        version = "0.1.0.1";
        sha256 = "1qalmxbmpyr28v9683q7yqk8xky34ksgqxr6qgn7v8y1c0a4jlqd";
+       revision = "1";
+       editedCabalFile = "0vzk01va3h5vmshqicb7ngqky6759lzvfcx740qifi38rnvwmmdq";
        libraryHaskellDepends = [
          aeson base bytestring cookie data-default-extra lens mtl o-clock
          string-conversions text unliftio wreq
@@ -55768,6 +55808,31 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
+  "cborg_0_2_8_0" = callPackage
+    ({ mkDerivation, aeson, array, base, base-orphans
+     , base16-bytestring, base64-bytestring, bytestring, containers
+     , deepseq, ghc-bignum, ghc-prim, half, primitive, QuickCheck
+     , random, scientific, tasty, tasty-hunit, tasty-quickcheck, text
+     , vector
+     }:
+     mkDerivation {
+       pname = "cborg";
+       version = "0.2.8.0";
+       sha256 = "07mh5bk61k5dz2x5g7fqw2cv7bjzs7v65yxvzkq7mdbkq8kwhn9f";
+       libraryHaskellDepends = [
+         array base bytestring containers deepseq ghc-bignum ghc-prim half
+         primitive text
+       ];
+       testHaskellDepends = [
+         aeson array base base-orphans base16-bytestring base64-bytestring
+         bytestring deepseq half QuickCheck random scientific tasty
+         tasty-hunit tasty-quickcheck text vector
+       ];
+       description = "Concise Binary Object Representation (CBOR)";
+       license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "cborg-json" = callPackage
     ({ mkDerivation, aeson, aeson-pretty, base, bytestring, cborg
      , criterion, deepseq, directory, process, scientific, text
@@ -55789,6 +55854,28 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
+  "cborg-json_0_2_5_0" = callPackage
+    ({ mkDerivation, aeson, aeson-pretty, base, bytestring, cborg
+     , criterion, deepseq, directory, process, scientific, text
+     , unordered-containers, vector, zlib
+     }:
+     mkDerivation {
+       pname = "cborg-json";
+       version = "0.2.5.0";
+       sha256 = "1m3w0yyp6xb07fx04g5c52pb0b46vpkgpi32w1c8bz867x2p7hsq";
+       libraryHaskellDepends = [
+         aeson aeson-pretty base cborg scientific text unordered-containers
+         vector
+       ];
+       benchmarkHaskellDepends = [
+         aeson base bytestring cborg criterion deepseq directory process
+         zlib
+       ];
+       description = "A library for encoding JSON as CBOR";
+       license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "ccast" = callPackage
     ({ mkDerivation, base, template-haskell }:
      mkDerivation {
@@ -60990,8 +61077,8 @@ self: {
      }:
      mkDerivation {
        pname = "cmark-gfm";
-       version = "0.2.3";
-       sha256 = "0krf1991bny99raw3961wp6hqdi0xmzcz18yisfp172kvd4cx33q";
+       version = "0.2.4";
+       sha256 = "1nkmlq015a8cyhcp669h8cd720n24j26v8w8rb04980z8h5z4ymp";
        libraryHaskellDepends = [ base bytestring text ];
        testHaskellDepends = [ base HUnit text ];
        benchmarkHaskellDepends = [
@@ -63354,8 +63441,8 @@ self: {
        pname = "commutative-semigroups";
        version = "0.1.0.0";
        sha256 = "06063ayahakj0wdwwzqwbb61cxjrrkpayzmvbvf7pcdsgyn427b6";
-       revision = "1";
-       editedCabalFile = "107qs0srrd88n5hz1v2fwapsr36zr5lnz04lxsicj1mq7ss54zm3";
+       revision = "2";
+       editedCabalFile = "0pa5rwafvcf38bfw7fxg420gd68x3p3xh8apih0ni2wv9h9wc8vz";
        libraryHaskellDepends = [ base containers ];
        description = "Commutative semigroups";
        license = lib.licenses.bsd3;
@@ -66186,26 +66273,6 @@ self: {
      }:
      mkDerivation {
        pname = "config-ini";
-       version = "0.2.4.0";
-       sha256 = "0dfm4xb1sd713rcqzplzdgw68fyhj24i6lj8j3q8kldpmkl98lbf";
-       revision = "2";
-       editedCabalFile = "0iwraaa0y1b3xdsg760j1wpylkqshky0k2djcg0k4s97lrwqpbcz";
-       libraryHaskellDepends = [
-         base containers megaparsec text transformers unordered-containers
-       ];
-       testHaskellDepends = [
-         base containers directory hedgehog ini text unordered-containers
-       ];
-       description = "A library for simple INI-based configuration files";
-       license = lib.licenses.bsd3;
-     }) {};
-
-  "config-ini_0_2_5_0" = callPackage
-    ({ mkDerivation, base, containers, directory, hedgehog, ini
-     , megaparsec, text, transformers, unordered-containers
-     }:
-     mkDerivation {
-       pname = "config-ini";
        version = "0.2.5.0";
        sha256 = "07vgpydzd44ayhq9c3q1335vphw384z8baf0wd0mnarr48yfaz3g";
        libraryHaskellDepends = [
@@ -66216,7 +66283,6 @@ self: {
        ];
        description = "A library for simple INI-based configuration files";
        license = lib.licenses.bsd3;
-       hydraPlatforms = lib.platforms.none;
      }) {};
 
   "config-manager" = callPackage
@@ -67015,6 +67081,8 @@ self: {
        pname = "constraints-extras";
        version = "0.3.2.1";
        sha256 = "0w2wwqsgxqkn8byivrgcsi6fh1kxbivqarmdnpxyh1a1cg373xfp";
+       revision = "1";
+       editedCabalFile = "1smha6ljia9bfgdy1h0lkgi9464rwa9lnw7rqfi1c23pzyiw13lh";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [ base constraints template-haskell ];
@@ -77841,6 +77909,7 @@ self: {
        ];
        description = "Library for dependent-literals-plugin";
        license = lib.licenses.asl20;
+       hydraPlatforms = lib.platforms.none;
      }) {};
 
   "dependent-literals-plugin" = callPackage
@@ -79960,8 +80029,8 @@ self: {
        pname = "diagrams-builder";
        version = "0.8.0.5";
        sha256 = "0dz617kfkvjf3f2zbphkdx1scglcjj162qsfk9xj7slbapnj918m";
-       revision = "4";
-       editedCabalFile = "0ni9kbzcazr0wcgzp6r19n0hd36sd29nrwj5af1sf4a1mbs4jwqf";
+       revision = "5";
+       editedCabalFile = "0h1wk2b256fv9h5h2r43rqia6n4i3fapsizflrhw2bfyqf0kw736";
        configureFlags = [ "-fcairo" "-fps" "-frasterific" "-fsvg" ];
        isLibrary = true;
        isExecutable = true;
@@ -81879,7 +81948,6 @@ self: {
        ];
        description = "Functional programming language for teaching discrete math";
        license = lib.licenses.bsd3;
-       hydraPlatforms = lib.platforms.none;
        mainProgram = "disco";
      }) {};
 
@@ -81947,6 +82015,8 @@ self: {
        pname = "discord-haskell";
        version = "1.15.3";
        sha256 = "1lgw0p7lzjz3mj49i45h4s0h5skjhjn3wmv79gv4wz9sxn9gp7bi";
+       revision = "1";
+       editedCabalFile = "0ajrdam5xdkkij8qm9qxlb5hl82qzmrlib3sxicdifn8kzxqvkdb";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -85993,20 +86063,6 @@ self: {
     ({ mkDerivation, array, base, containers, QuickCheck, random }:
      mkDerivation {
        pname = "dsp";
-       version = "0.2.5.1";
-       sha256 = "03mhqqnjqjhklmlim6cljq5ik0l4h6lgqffw2i2clqgwj64ky5nf";
-       isLibrary = true;
-       isExecutable = true;
-       libraryHaskellDepends = [ array base containers random ];
-       testHaskellDepends = [ array base containers QuickCheck ];
-       description = "Haskell Digital Signal Processing";
-       license = lib.licenses.gpl2Only;
-     }) {};
-
-  "dsp_0_2_5_2" = callPackage
-    ({ mkDerivation, array, base, containers, QuickCheck, random }:
-     mkDerivation {
-       pname = "dsp";
        version = "0.2.5.2";
        sha256 = "0inar9c0n4x0li9c7krr17qv7zc49162wchhyn6ix7adni8j92z0";
        isLibrary = true;
@@ -86015,7 +86071,6 @@ self: {
        testHaskellDepends = [ array base containers QuickCheck ];
        description = "Haskell Digital Signal Processing";
        license = lib.licenses.gpl2Only;
-       hydraPlatforms = lib.platforms.none;
      }) {};
 
   "dstring" = callPackage
@@ -88121,6 +88176,28 @@ self: {
        mainProgram = "editpipe";
      }) {};
 
+  "edits" = callPackage
+    ({ mkDerivation, base, containers, hedgehog, matrix, primitive
+     , protolude, registry-hedgehog, tasty, tasty-discover
+     , tasty-hedgehog, text, vector
+     }:
+     mkDerivation {
+       pname = "edits";
+       version = "0.1.1.0";
+       sha256 = "1labg64a8v72zwi2g5mzbs2b47vvk5kagnyi583r2i490v9l826w";
+       libraryHaskellDepends = [
+         base containers matrix primitive protolude text vector
+       ];
+       testHaskellDepends = [
+         base containers hedgehog matrix primitive protolude
+         registry-hedgehog tasty tasty-discover tasty-hedgehog text vector
+       ];
+       testToolDepends = [ tasty-discover ];
+       description = "show the differences between 2 pieces of Text using the Levenshtein distance";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "effect-handlers" = callPackage
     ({ mkDerivation, base, criterion, free, hspec, hspec-discover
      , HUnit, kan-extensions, mtl, QuickCheck
@@ -94301,8 +94378,8 @@ self: {
      }:
      mkDerivation {
        pname = "exon";
-       version = "1.0.0.2";
-       sha256 = "04b418sxvj2pgjrq7nsz2hd30p5gimxg1csd8yj1xkmv2fjai1zl";
+       version = "1.0.1.0";
+       sha256 = "17yfbj1hc2vm1vgsz3nngj06i67w6m0nzq1hm40n4q9w9fzaspvv";
        libraryHaskellDepends = [
          base flatparse generics-sop ghc-hs-meta incipit-base
          template-haskell type-errors-pretty
@@ -94536,26 +94613,6 @@ self: {
      }:
      mkDerivation {
        pname = "explainable-predicates";
-       version = "0.1.2.2";
-       sha256 = "16aajh4b6pg94y14581ppqlwhkb3qgz1d87zz6zjy7kbg8acrffa";
-       libraryHaskellDepends = [
-         array base HUnit mono-traversable QuickCheck regex-tdfa syb
-         template-haskell
-       ];
-       testHaskellDepends = [
-         base doctest-exitcode-stdio doctest-lib hspec
-       ];
-       description = "Predicates that can explain themselves";
-       license = lib.licenses.bsd3;
-     }) {};
-
-  "explainable-predicates_0_1_2_3" = callPackage
-    ({ mkDerivation, array, base, doctest-exitcode-stdio, doctest-lib
-     , hspec, HUnit, mono-traversable, QuickCheck, regex-tdfa, syb
-     , template-haskell
-     }:
-     mkDerivation {
-       pname = "explainable-predicates";
        version = "0.1.2.3";
        sha256 = "1ch86wb7bz9ydvrbdd2arskaj5pdc2x9vby4pbvnwv1r4d8n40la";
        libraryHaskellDepends = [
@@ -94567,7 +94624,6 @@ self: {
        ];
        description = "Predicates that can explain themselves";
        license = lib.licenses.bsd3;
-       hydraPlatforms = lib.platforms.none;
      }) {};
 
   "explicit-constraint-lens" = callPackage
@@ -97751,6 +97807,24 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
+  "fgl_5_8_0_0" = callPackage
+    ({ mkDerivation, array, base, containers, deepseq, hspec
+     , microbench, QuickCheck, transformers
+     }:
+     mkDerivation {
+       pname = "fgl";
+       version = "5.8.0.0";
+       sha256 = "02cdigf5m3520vh30lld0j5d4al7nmsa4m9v9bjw1fprfaac03nn";
+       libraryHaskellDepends = [
+         array base containers deepseq transformers
+       ];
+       testHaskellDepends = [ base containers hspec QuickCheck ];
+       benchmarkHaskellDepends = [ base deepseq microbench ];
+       description = "Martin Erwig's Functional Graph Library";
+       license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "fgl-arbitrary" = callPackage
     ({ mkDerivation, base, containers, fgl, hspec, QuickCheck }:
      mkDerivation {
@@ -98501,6 +98575,7 @@ self: {
        ];
        description = "Finite sets of static size";
        license = lib.licenses.asl20;
+       hydraPlatforms = lib.platforms.none;
      }) {};
 
   "final" = callPackage
@@ -101434,8 +101509,8 @@ self: {
      }:
      mkDerivation {
        pname = "foreign";
-       version = "0.1.1.0";
-       sha256 = "0r9lag2d7hki1ciah4hzf4gdsxdlskjzkcafp6h99ifhb63m55i3";
+       version = "0.1.2.0";
+       sha256 = "0pmwf96miai50q7vbwjdm5rz2cljpmp115hp3blv2l596mdjrvc0";
        libraryHaskellDepends = [
          base bytestring ghc-prim primitive primitive-unlifted
        ];
@@ -103786,28 +103861,30 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
-  "fsnotify_0_4_0_0" = callPackage
+  "fsnotify_0_4_0_1" = callPackage
     ({ mkDerivation, async, base, bytestring, containers, directory
-     , exceptions, filepath, hinotify, hspec, hspec-core
-     , hspec-expectations, HUnit, monad-control, random, retry
-     , safe-exceptions, temporary, text, time, unix, unix-compat
+     , exceptions, filepath, hinotify, monad-control, random, retry
+     , safe-exceptions, sandwich, temporary, text, time, unix
+     , unix-compat, unliftio
      }:
      mkDerivation {
        pname = "fsnotify";
-       version = "0.4.0.0";
-       sha256 = "033qwa71spjz3klqmsdzi85fjb0ps9l5v1vl5zylz5jarh41z66y";
+       version = "0.4.0.1";
+       sha256 = "02gnbwxgs5b4rnqpgprvqxw9d2vw2yi276dn6ync3czrxyqliz78";
+       isLibrary = true;
+       isExecutable = true;
        libraryHaskellDepends = [
          async base bytestring containers directory filepath hinotify
          monad-control safe-exceptions text time unix unix-compat
        ];
-       testHaskellDepends = [
-         async base directory exceptions filepath hspec hspec-core
-         hspec-expectations HUnit random retry safe-exceptions temporary
-         unix-compat
+       executableHaskellDepends = [
+         async base directory exceptions filepath random retry
+         safe-exceptions sandwich temporary unix-compat unliftio
        ];
        description = "Cross platform library for file change notification";
        license = lib.licenses.bsd3;
        hydraPlatforms = lib.platforms.none;
+       mainProgram = "tests";
      }) {};
 
   "fsnotify-conduit" = callPackage
@@ -105061,8 +105138,8 @@ self: {
     ({ mkDerivation, base, directory, raw-strings-qq, split }:
      mkDerivation {
        pname = "futhask";
-       version = "0.1.0";
-       sha256 = "11cgnalnywm0xrjhzygd9vvff8yd46s886ljvdbmpl01py97kpwx";
+       version = "0.2.0";
+       sha256 = "1x3f4qsh0hnrzgdfl7zgd5n8k01x0vrvb8v3vjp3yar60v4dhdsg";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [ base directory raw-strings-qq split ];
@@ -105200,6 +105277,21 @@ self: {
        license = lib.licenses.mit;
      }) {};
 
+  "fuzzy-time_0_2_0_2" = callPackage
+    ({ mkDerivation, base, containers, deepseq, megaparsec, text, time
+     , validity, validity-time
+     }:
+     mkDerivation {
+       pname = "fuzzy-time";
+       version = "0.2.0.2";
+       sha256 = "0r0fmkh33v65h000y9bwr7fjd1a50m8pgrsvmwf6g52f33i7ds7h";
+       libraryHaskellDepends = [
+         base containers deepseq megaparsec text time validity validity-time
+       ];
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "fuzzy-time-gen" = callPackage
     ({ mkDerivation, base, containers, criterion, fuzzy-time
      , genvalidity, genvalidity-criterion, genvalidity-hspec
@@ -105208,8 +105300,8 @@ self: {
      }:
      mkDerivation {
        pname = "fuzzy-time-gen";
-       version = "0.2.0.0";
-       sha256 = "0lcs0kgm935rizvsy2p8v8g1kjsjishd9l7jzgl45vlwbs5g863l";
+       version = "0.2.0.1";
+       sha256 = "100j98l32hgdm1ib22x1gnkjmnzmyih0ggsqmj8dihm8gqp9z094";
        libraryHaskellDepends = [
          base containers fuzzy-time genvalidity genvalidity-time megaparsec
          QuickCheck time
@@ -107812,25 +107904,6 @@ self: {
      }:
      mkDerivation {
        pname = "genvalidity-hspec";
-       version = "1.0.0.1";
-       sha256 = "1l5iwzdidlir92zanr9672954dxcp4cg8pl5rb4x10vzg5y0s369";
-       libraryHaskellDepends = [
-         base genvalidity genvalidity-property hspec hspec-core QuickCheck
-         transformers validity
-       ];
-       testHaskellDepends = [
-         base genvalidity hspec hspec-core QuickCheck
-       ];
-       description = "Standard spec's for GenValidity instances";
-       license = lib.licenses.mit;
-     }) {};
-
-  "genvalidity-hspec_1_0_0_2" = callPackage
-    ({ mkDerivation, base, genvalidity, genvalidity-property, hspec
-     , hspec-core, QuickCheck, transformers, validity
-     }:
-     mkDerivation {
-       pname = "genvalidity-hspec";
        version = "1.0.0.2";
        sha256 = "00sv0mzlvny5ch7c9fnd19szqd0pjrkvi080x1i62qa5fdzs5yc4";
        libraryHaskellDepends = [
@@ -107842,7 +107915,6 @@ self: {
        ];
        description = "Standard spec's for GenValidity instances";
        license = lib.licenses.mit;
-       hydraPlatforms = lib.platforms.none;
      }) {};
 
   "genvalidity-hspec-aeson" = callPackage
@@ -118291,8 +118363,8 @@ self: {
      }:
      mkDerivation {
        pname = "google-server-api";
-       version = "0.4.0.2";
-       sha256 = "0wnfn75z5k9lh8h38ya52dc4rjjxzpybj0sayjz6ax1xxiaz3d90";
+       version = "0.4.1.0";
+       sha256 = "1l0cgj8z210a9b4xa4y6rvnfgmxzj2pjpk0r6hxkb2qwjkrnbs8h";
        libraryHaskellDepends = [
          aeson aeson-casing base base64-bytestring bytestring HsOpenSSL
          http-api-data http-client http-client-tls http-media mime-mail
@@ -121835,8 +121907,8 @@ self: {
      }:
      mkDerivation {
        pname = "h-gpgme";
-       version = "0.6.0.0";
-       sha256 = "13v9xalqaag87jviw4dlnm9yajpjfzxsimcdpnhbccz55qgchc65";
+       version = "0.6.1.0";
+       sha256 = "0q80q7dx1nsgsy486g4k66kz83k0bsimz4bn3l5c2qwl1wvrm4c8";
        libraryHaskellDepends = [
          base bindings-gpgme bytestring data-default email-validate time
          transformers unix
@@ -123614,6 +123686,8 @@ self: {
        pname = "haddock-library";
        version = "1.11.0";
        sha256 = "02m2pr1jyn0k86bjqksn2vrpyv0y40sj3rq5svcs5c3qlg4mw1vw";
+       revision = "1";
+       editedCabalFile = "0mqwr0vbpj9zw7f1p5kdd7hsr76gs1ijmh8h9hak47nphffi1fxv";
        libraryHaskellDepends = [ base containers parsec text ];
        testHaskellDepends = [
          base base-compat containers deepseq directory filepath hspec
@@ -135288,6 +135362,23 @@ self: {
        broken = true;
      }) {};
 
+  "heist-extra" = callPackage
+    ({ mkDerivation, base, data-default, filepath, heist-emanote
+     , map-syntax, mtl, pandoc-types, relude, xmlhtml
+     }:
+     mkDerivation {
+       pname = "heist-extra";
+       version = "0.1.0.0";
+       sha256 = "175bch1045r69xqzaxh3fhlii2yn5wcwpifk0m5qw9520pbrg4rs";
+       libraryHaskellDepends = [
+         base data-default filepath heist-emanote map-syntax mtl
+         pandoc-types relude xmlhtml
+       ];
+       description = "Extra heist functionality";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "helf" = callPackage
     ({ mkDerivation, alex, array, base, containers, happy, mtl, pretty
      , QuickCheck, transformers
@@ -137502,10 +137593,8 @@ self: {
     ({ mkDerivation, base, ghc-bignum, ghc-prim, QuickCheck }:
      mkDerivation {
        pname = "hgmp";
-       version = "0.1.2";
-       sha256 = "1sqnywh4h1nklcpci60n427m1kahkza1vy1j60jmq3lnlrbgzfzk";
-       revision = "1";
-       editedCabalFile = "0h9nrcrjbzjygcy1f4ws2gpjqqsy4l2zpv1fkxxi4flqj9yjl4i5";
+       version = "0.1.2.1";
+       sha256 = "08w0b6yla086vk802xqcqslpkqpjx2h2hc6l3jyymms77qyn70f6";
        libraryHaskellDepends = [ base ghc-bignum ghc-prim ];
        testHaskellDepends = [ base QuickCheck ];
        description = "Haskell interface to GMP";
@@ -145045,7 +145134,7 @@ self: {
        broken = true;
      }) {inherit (pkgs) postgresql;};
 
-  "hpqtypes_1_10_0_0" = callPackage
+  "hpqtypes_1_10_0_1" = callPackage
     ({ mkDerivation, aeson, async, base, bytestring, Cabal, containers
      , directory, exceptions, filepath, HUnit, lifted-base
      , monad-control, mtl, postgresql, QuickCheck, random, resource-pool
@@ -145055,8 +145144,8 @@ self: {
      }:
      mkDerivation {
        pname = "hpqtypes";
-       version = "1.10.0.0";
-       sha256 = "082hn1g2ilia146rkczia0b37n628wa6xi28w75ikxpwpnkmz422";
+       version = "1.10.0.1";
+       sha256 = "19lakc0m4fgv36kiw9ziyr3abq6jrb6rij443s7a2n3xfrjwy0b8";
        setupHaskellDepends = [ base Cabal directory filepath ];
        libraryHaskellDepends = [
          aeson async base bytestring containers exceptions lifted-base
@@ -148899,6 +148988,23 @@ self: {
        hydraPlatforms = lib.platforms.none;
      }) {};
 
+  "hslua-cli" = callPackage
+    ({ mkDerivation, base, bytestring, hslua-core, hslua-marshalling
+     , lua, text
+     }:
+     mkDerivation {
+       pname = "hslua-cli";
+       version = "1.0.0";
+       sha256 = "1db2fglg6i0pqx1n0sdrsf4p9h1sdmfswqmsrspif2jhkipbh64m";
+       isLibrary = true;
+       isExecutable = true;
+       libraryHaskellDepends = [
+         base bytestring hslua-core hslua-marshalling lua text
+       ];
+       description = "Command-line interface for Lua";
+       license = lib.licenses.mit;
+     }) {};
+
   "hslua-core" = callPackage
     ({ mkDerivation, base, bytestring, exceptions, lua, lua-arbitrary
      , mtl, QuickCheck, quickcheck-instances, tasty, tasty-hunit
@@ -150228,6 +150334,22 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
+  "hspec-need-env_0_1_0_10" = callPackage
+    ({ mkDerivation, base, hspec, hspec-core, hspec-discover
+     , hspec-expectations, setenv, transformers
+     }:
+     mkDerivation {
+       pname = "hspec-need-env";
+       version = "0.1.0.10";
+       sha256 = "13ms7ifdszwgmvvv1lbyqs53l86li0k639f3f9blfkz3lk3qx2kn";
+       libraryHaskellDepends = [ base hspec-core hspec-expectations ];
+       testHaskellDepends = [ base hspec hspec-core setenv transformers ];
+       testToolDepends = [ hspec-discover ];
+       description = "Read environment variables for hspec tests";
+       license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "hspec-parsec" = callPackage
     ({ mkDerivation, base, hspec, hspec-expectations, parsec }:
      mkDerivation {
@@ -171273,10 +171395,8 @@ self: {
      }:
      mkDerivation {
        pname = "lambdabot-telegram-plugins";
-       version = "0.2.0";
-       sha256 = "1fm4amq0a0aqi2mvd0sxj5r3jziy98i2kj7qqin2q6rq0didh0y5";
-       revision = "1";
-       editedCabalFile = "0ag8pbnz4q9gpdd20axmz90ww260gh7i266pgfylqslz1dlmvirz";
+       version = "0.2.1";
+       sha256 = "1r0qr28n2lz4nxbvnv3iyc221b8b1w92m23mcahh95agvkjxk6ys";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -176078,12 +176198,12 @@ self: {
        license = lib.licenses.bsd3;
      }) {ffi = null; inherit (pkgs) libffi;};
 
-  "libffi_0_2" = callPackage
+  "libffi_0_2_1" = callPackage
     ({ mkDerivation, base, bytestring }:
      mkDerivation {
        pname = "libffi";
-       version = "0.2";
-       sha256 = "08pp09cjygvc0ddm7gdrrk0hpcy3bsnp8g7z9cyix2ckdg43rldq";
+       version = "0.2.1";
+       sha256 = "1w9ssmjx521f4lmaynmh1zargl2zmfvvpq2bldsvnwldfdgikbkn";
        libraryHaskellDepends = [ base bytestring ];
        description = "A binding to libffi";
        license = lib.licenses.bsd3;
@@ -182806,6 +182926,19 @@ self: {
        broken = true;
      }) {};
 
+  "lucid2-htmx" = callPackage
+    ({ mkDerivation, base, hspec, HUnit, lucid2, text }:
+     mkDerivation {
+       pname = "lucid2-htmx";
+       version = "0.1.0.8";
+       sha256 = "07q9bqdfkk173nz6ddsnmg9ilnhs5kxngza52laiiipn432z4aw9";
+       libraryHaskellDepends = [ base lucid2 text ];
+       testHaskellDepends = [ base hspec HUnit lucid2 text ];
+       description = "Use htmx in your lucid templates";
+       license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "lucienne" = callPackage
     ({ mkDerivation, base, base64-bytestring, blaze-html, bson
      , bytestring, compact-string-fix, feed, happstack, happstack-server
@@ -184923,8 +185056,8 @@ self: {
      }:
      mkDerivation {
        pname = "mandulia";
-       version = "0.7";
-       sha256 = "1wrpzai3482c9g7zfacmjszi6h073ip00fbq17nyc22z2zw4908s";
+       version = "0.8.0.1";
+       sha256 = "1iknqhdqsyahdybcngy239lkvvpw6v8ciby42db21vx1npdzl8xn";
        isLibrary = false;
        isExecutable = true;
        enableSeparateDataOutput = true;
@@ -190280,6 +190413,8 @@ self: {
        pname = "minizinc-process";
        version = "0.1.4.1";
        sha256 = "0sihpmjzda7kph8mds4p4fn4pgbiay6v680pcqv2d116a5di2c5g";
+       revision = "1";
+       editedCabalFile = "09h0brd6zhfdz8y780xiqxzs78fcclwljh9r2xiw60wcigasa15j";
        libraryHaskellDepends = [
          aeson attoparsec base bytestring containers directory hashable
          process process-extras template-haskell text
@@ -193912,6 +194047,8 @@ self: {
        pname = "monoid-subclasses";
        version = "1.1.3";
        sha256 = "1nglki10rlpi872p55pa8g809q5sna7yzh3zw4rqfhq89kb15wcv";
+       revision = "1";
+       editedCabalFile = "0y8sw3zsmz5ssn2gl2fsqg44n7xf3xsf6vhrzwnkbaa97hj76nh2";
        libraryHaskellDepends = [
          base bytestring containers primes text vector
        ];
@@ -197938,6 +198075,26 @@ self: {
        license = lib.licenses.mit;
      }) {};
 
+  "mutable-containers_0_3_4_1" = callPackage
+    ({ mkDerivation, base, containers, gauge, ghc-prim, hspec
+     , mono-traversable, primitive, QuickCheck, vector
+     }:
+     mkDerivation {
+       pname = "mutable-containers";
+       version = "0.3.4.1";
+       sha256 = "1krndid8s8x0gklrzjaqfas1gl31qbhizpnidfa0ibclkk39whkr";
+       libraryHaskellDepends = [
+         base containers ghc-prim mono-traversable primitive vector
+       ];
+       testHaskellDepends = [
+         base containers hspec primitive QuickCheck vector
+       ];
+       benchmarkHaskellDepends = [ base containers gauge vector ];
+       description = "Abstactions and concrete implementations of mutable containers";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "mutable-iter" = callPackage
     ({ mkDerivation, base, iteratee, MonadCatchIO-transformers
      , transformers, vector
@@ -200165,8 +200322,8 @@ self: {
      }:
      mkDerivation {
        pname = "net-mqtt";
-       version = "0.8.2.3";
-       sha256 = "0z75is6s7flxhcw4bqc0zzm81swvcq1yxcczw2dph93n4wbgsz90";
+       version = "0.8.2.4";
+       sha256 = "03w0086kn9zgsry8gm1ij7n5m3fqq7xfas4ma1fviqsx7w8wdc3r";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -203068,6 +203225,32 @@ self: {
        maintainers = [ lib.maintainers.peti ];
      }) {inherit (pkgs) nix;};
 
+  "nix-serve-ng" = callPackage
+    ({ mkDerivation, async, base, base16, base32, bytestring, charset
+     , http-client, http-types, managed, megaparsec, mtl, network, nix
+     , optparse-applicative, tasty-bench, temporary, text, turtle
+     , vector, wai, wai-extra, warp, warp-tls
+     }:
+     mkDerivation {
+       pname = "nix-serve-ng";
+       version = "1.0.0";
+       sha256 = "0dvy1xjrxh69kl9jlka750v2981mcrv5xvxqmjng1ms0vi1grz0n";
+       isLibrary = false;
+       isExecutable = true;
+       executableHaskellDepends = [
+         base base16 base32 bytestring charset http-types managed megaparsec
+         mtl network optparse-applicative vector wai wai-extra warp warp-tls
+       ];
+       executablePkgconfigDepends = [ nix ];
+       benchmarkHaskellDepends = [
+         async base bytestring http-client tasty-bench temporary text turtle
+         vector
+       ];
+       description = "A drop-in replacement for nix-serve that's faster and more stable";
+       license = lib.licenses.bsd3;
+       mainProgram = "nix-serve";
+     }) {inherit (pkgs) nix;};
+
   "nix-thunk" = callPackage
     ({ mkDerivation, aeson, aeson-pretty, base, bytestring, cli-extras
      , cli-git, cli-nix, containers, cryptonite, data-default, directory
@@ -222535,7 +222718,6 @@ self: {
        testToolDepends = [ hspec-discover ];
        description = "Experimental, RandomFu effect and interpreters for polysemy";
        license = lib.licenses.bsd3;
-       hydraPlatforms = lib.platforms.none;
      }) {};
 
   "polysemy-check" = callPackage
@@ -222887,7 +223069,6 @@ self: {
        libraryHaskellDepends = [ base optics polysemy polysemy-zoo ];
        description = "Optics for Polysemy";
        license = lib.licenses.bsd2;
-       hydraPlatforms = lib.platforms.none;
      }) {};
 
   "polysemy-path" = callPackage
@@ -223211,8 +223392,6 @@ self: {
        testToolDepends = [ hspec-discover ];
        description = "Experimental, user-contributed effects and interpreters for polysemy";
        license = lib.licenses.bsd3;
-       hydraPlatforms = lib.platforms.none;
-       broken = true;
      }) {};
 
   "polyseq" = callPackage
@@ -223863,19 +224042,19 @@ self: {
      }) {};
 
   "portray" = callPackage
-    ({ mkDerivation, base, containers, HUnit, test-framework
-     , test-framework-hunit, text, wrapped
+    ({ mkDerivation, base, bytestring, containers, HUnit
+     , test-framework, test-framework-hunit, text, wrapped
      }:
      mkDerivation {
        pname = "portray";
-       version = "0.2.0";
-       sha256 = "1kzzvwqphlg1dmd486ijkv6vsqmxnp8h05mwc8590yjxdln5vzdw";
-       revision = "3";
-       editedCabalFile = "0zszhxd9f51wb15rw5rvz6cb20kbf2f8r8xn2dksm5mdnyiv3pgz";
-       libraryHaskellDepends = [ base containers text wrapped ];
+       version = "0.3.0";
+       sha256 = "059lyc5p7726y9yj7c3by854czhbiwspgrgiqa6qp22pfbx2ycqn";
+       libraryHaskellDepends = [
+         base bytestring containers text wrapped
+       ];
        testHaskellDepends = [
-         base containers HUnit test-framework test-framework-hunit text
-         wrapped
+         base bytestring containers HUnit test-framework
+         test-framework-hunit text wrapped
        ];
        description = "Rendering to pseudo-Haskell syntax";
        license = lib.licenses.asl20;
@@ -223885,10 +224064,8 @@ self: {
     ({ mkDerivation, base, containers, dlist, portray, text, wrapped }:
      mkDerivation {
        pname = "portray-diff";
-       version = "0.1.0.1";
-       sha256 = "1da884cj865q6g1bd1fhcazyl1nzxb0pk2nvhcpp4iqkjvhyd8hw";
-       revision = "3";
-       editedCabalFile = "1wikgdbb1bngppqq8n4pgfqaf040rpfn5hdzspcycc8i7z8gi5mw";
+       version = "0.1.1";
+       sha256 = "1z09bs62hh9hsf88qkbsqp3ydxr66jdpbp9s8c7d142vcinmi3wm";
        libraryHaskellDepends = [
          base containers dlist portray text wrapped
        ];
@@ -223910,6 +224087,7 @@ self: {
        ];
        description = "HUnit assertions based on portray-diff";
        license = lib.licenses.asl20;
+       hydraPlatforms = lib.platforms.none;
      }) {};
 
   "portray-diff-quickcheck" = callPackage
@@ -223925,6 +224103,7 @@ self: {
        ];
        description = "QuickCheck tests with portray-diff";
        license = lib.licenses.asl20;
+       hydraPlatforms = lib.platforms.none;
      }) {};
 
   "portray-pretty" = callPackage
@@ -223944,6 +224123,8 @@ self: {
        ];
        description = "Portray backend for pretty";
        license = lib.licenses.asl20;
+       hydraPlatforms = lib.platforms.none;
+       broken = true;
      }) {};
 
   "portray-prettyprinter" = callPackage
@@ -223968,6 +224149,8 @@ self: {
        ];
        description = "Portray backend for prettyprinter";
        license = lib.licenses.asl20;
+       hydraPlatforms = lib.platforms.none;
+       broken = true;
      }) {};
 
   "ports" = callPackage
@@ -236902,17 +237085,17 @@ self: {
      }:
      mkDerivation {
        pname = "rec-def";
-       version = "0.1";
-       sha256 = "1ki145p9cb8dks2vxlwinma8h3kifx5ikyjsfcabv1dg6qrp77vj";
-       revision = "1";
-       editedCabalFile = "1q1ajjy26gqgbhgjazzg0j74rk1lcy1vfax3rjnxdc7qsj5bv95g";
+       version = "0.2";
+       sha256 = "0dfw86ws00gsdnzb238pmr4i2lyfp405lp70nbak45qq2cbz0zj8";
        libraryHaskellDepends = [ base containers ];
        testHaskellDepends = [
          base concurrency containers dejafu doctest QuickCheck random tasty
          tasty-dejafu template-haskell
        ];
-       description = "Recusively defined values";
+       description = "Recursively defined values";
        license = lib.licenses.bsd2;
+       hydraPlatforms = lib.platforms.none;
+       broken = true;
      }) {};
 
   "rec-smallarray" = callPackage
@@ -244165,6 +244348,8 @@ self: {
        ];
        description = "A data type of run-length-encoded lists";
        license = lib.licenses.asl20;
+       hydraPlatforms = lib.platforms.none;
+       broken = true;
      }) {};
 
   "rlglue" = callPackage
@@ -250937,24 +251122,6 @@ self: {
      }:
      mkDerivation {
        pname = "selda";
-       version = "0.5.1.0";
-       sha256 = "1gd7fdgqw6q507wn7h1pln9wb7kh65vd7iv0s1ydg54r36qdlrgl";
-       revision = "1";
-       editedCabalFile = "0sdzfgsmgw20idxnvvf4sbp8bkl3n7qa7qkphv63pfmqvzyplkwg";
-       libraryHaskellDepends = [
-         base bytestring containers exceptions mtl random text time
-         uuid-types
-       ];
-       description = "Multi-backend, high-level EDSL for interacting with SQL databases";
-       license = lib.licenses.mit;
-     }) {};
-
-  "selda_0_5_2_0" = callPackage
-    ({ mkDerivation, base, bytestring, containers, exceptions, mtl
-     , random, text, time, uuid-types
-     }:
-     mkDerivation {
-       pname = "selda";
        version = "0.5.2.0";
        sha256 = "1n0zkd80a9z83q5nld0gyg2p25nfy4rjkihql88binhknhk3hkgk";
        libraryHaskellDepends = [
@@ -250963,7 +251130,6 @@ self: {
        ];
        description = "Multi-backend, high-level EDSL for interacting with SQL databases";
        license = lib.licenses.mit;
-       hydraPlatforms = lib.platforms.none;
      }) {};
 
   "selda-json" = callPackage
@@ -251002,24 +251168,6 @@ self: {
      }:
      mkDerivation {
        pname = "selda-sqlite";
-       version = "0.1.7.1";
-       sha256 = "1a1rik32h8ijd98v98db1il10ap76rqdwmjwhj0hc0h77mm6qdfb";
-       revision = "1";
-       editedCabalFile = "05zdf07fizf97yby0ld4qkd5padxg9fhmpfiiii4jl7xklccnl6p";
-       libraryHaskellDepends = [
-         base bytestring direct-sqlite directory exceptions selda text time
-         uuid-types
-       ];
-       description = "SQLite backend for the Selda database EDSL";
-       license = lib.licenses.mit;
-     }) {};
-
-  "selda-sqlite_0_1_7_2" = callPackage
-    ({ mkDerivation, base, bytestring, direct-sqlite, directory
-     , exceptions, selda, text, time, uuid-types
-     }:
-     mkDerivation {
-       pname = "selda-sqlite";
        version = "0.1.7.2";
        sha256 = "1cldk804vv82dp3hyxcddzy3plijgkmjz3ykrjzy7afqni97yc4y";
        libraryHaskellDepends = [
@@ -251028,7 +251176,6 @@ self: {
        ];
        description = "SQLite backend for the Selda database EDSL";
        license = lib.licenses.mit;
-       hydraPlatforms = lib.platforms.none;
      }) {};
 
   "select" = callPackage
@@ -252131,6 +252278,37 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
+  "serialise_0_2_6_0" = callPackage
+    ({ mkDerivation, aeson, array, base, binary, bytestring, cborg
+     , cereal, cereal-vector, containers, criterion, deepseq, directory
+     , fail, filepath, ghc-prim, half, hashable, pretty, primitive
+     , QuickCheck, quickcheck-instances, semigroups, store, strict, tar
+     , tasty, tasty-hunit, tasty-quickcheck, text, these, time
+     , unordered-containers, vector, zlib
+     }:
+     mkDerivation {
+       pname = "serialise";
+       version = "0.2.6.0";
+       sha256 = "05m5h5vfjp4wvh6y7j2f3d4c3l6gxww2n1v38vqrjacpw641izwk";
+       libraryHaskellDepends = [
+         array base bytestring cborg containers ghc-prim half hashable
+         primitive strict text these time unordered-containers vector
+       ];
+       testHaskellDepends = [
+         base bytestring cborg containers directory filepath primitive
+         QuickCheck quickcheck-instances tasty tasty-hunit tasty-quickcheck
+         text time unordered-containers vector
+       ];
+       benchmarkHaskellDepends = [
+         aeson array base binary bytestring cborg cereal cereal-vector
+         containers criterion deepseq directory fail filepath ghc-prim half
+         pretty semigroups store tar text time vector zlib
+       ];
+       description = "A binary serialisation library for Haskell values";
+       license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "serialise-uuid" = callPackage
     ({ mkDerivation, base, bytestring, cborg, serialise, tasty
      , tasty-hunit, tasty-quickcheck, uuid-types
@@ -254069,6 +254247,7 @@ self: {
        description = "Utilities for using servant in a polysemy stack";
        license = lib.licenses.bsd3;
        hydraPlatforms = lib.platforms.none;
+       broken = true;
      }) {};
 
   "servant-pool" = callPackage
@@ -254443,8 +254622,8 @@ self: {
     ({ mkDerivation, base, Cabal, directory, exceptions, filepath }:
      mkDerivation {
        pname = "servant-serf";
-       version = "0.3.1.1";
-       sha256 = "1092b8xsdkqmaii0dxyn0dshj01crilmnp83qczxvy426dik4zww";
+       version = "0.3.1.2";
+       sha256 = "12qyg3bj4f8y4f3z0p3dxh4ms8xdv6226120xsdd6jkbxynmap01";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -259989,6 +260168,8 @@ self: {
        ];
        description = "Nat singletons represented by Int";
        license = lib.licenses.asl20;
+       hydraPlatforms = lib.platforms.none;
+       broken = true;
      }) {};
 
   "siphash" = callPackage
@@ -262122,12 +262303,12 @@ self: {
      }:
      mkDerivation {
        pname = "smtpbz";
-       version = "1.0.0";
-       sha256 = "1xn66l3bifrd6y12rssgsj4dihy325c9lbxl20ms49rnkcnwzwfq";
+       version = "1.0.1";
+       sha256 = "1zxcr4md1r9dlg14a3b6ywqnir6jx95qsffwv2f08k2mkifm82w3";
        libraryHaskellDepends = [
          aeson base bytestring http-conduit http-types text
        ];
-       description = "This is smtpbz";
+       description = "Unofficial API client for smtp.bz";
        license = lib.licenses.bsd2;
      }) {};
 
@@ -267345,8 +267526,8 @@ self: {
        pname = "stack";
        version = "2.9.1";
        sha256 = "01020dx89m07qmjs58vs2kidhkzq3106md08w6c65bzxvlf6kcwk";
-       revision = "1";
-       editedCabalFile = "06xrw6k1vqkvgmb4cvxqmh756n7h9vynbb3smicb1149czrlwkv2";
+       revision = "2";
+       editedCabalFile = "14k4b8cn52bdl4n181afq8zqycl8nb4mv8vsg636c6b4s9yc053w";
        configureFlags = [
          "-fdisable-git-info" "-fhide-dependency-versions"
          "-fsupported-build"
@@ -271767,30 +271948,6 @@ self: {
      }:
      mkDerivation {
        pname = "string-random";
-       version = "0.1.4.2";
-       sha256 = "0rqh0cwywlzg4xyb1s80mghl3kq3sngg8xjbh4g9x4p8fc6maiw9";
-       isLibrary = true;
-       isExecutable = true;
-       libraryHaskellDepends = [
-         attoparsec base containers random text transformers
-       ];
-       executableHaskellDepends = [ base optparse-applicative text ];
-       testHaskellDepends = [
-         base bytestring pcre-heavy QuickCheck tasty tasty-hunit
-         tasty-quickcheck text
-       ];
-       description = "A library for generating random string from a regular experession";
-       license = lib.licenses.bsd3;
-       mainProgram = "hstrrand";
-     }) {};
-
-  "string-random_0_1_4_3" = callPackage
-    ({ mkDerivation, attoparsec, base, bytestring, containers
-     , optparse-applicative, pcre-heavy, QuickCheck, random, tasty
-     , tasty-hunit, tasty-quickcheck, text, transformers
-     }:
-     mkDerivation {
-       pname = "string-random";
        version = "0.1.4.3";
        sha256 = "1ddy6fbkwk0nwq4anq6nsbggrlamn5d3kz2q4iy7744igasij97g";
        isLibrary = true;
@@ -271805,7 +271962,6 @@ self: {
        ];
        description = "A library for generating random string from a regular experession";
        license = lib.licenses.bsd3;
-       hydraPlatforms = lib.platforms.none;
        mainProgram = "hstrrand";
      }) {};
 
@@ -273933,8 +274089,8 @@ self: {
     ({ mkDerivation, base, blaze-markup, blaze-svg, directory, text }:
      mkDerivation {
        pname = "svg-icons";
-       version = "1.0.0.0";
-       sha256 = "1ddq3im8z4jqpxxk3qqa30372ybvp8capmxbi3xx5ik5vjrcp0cv";
+       version = "2.0.1.0";
+       sha256 = "10a5bcbm28fnkrr6cfzfqwsm8lz8rpwdbsgbr8w40bwdgn8v5r06";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -279332,7 +279488,6 @@ self: {
        ];
        description = "Bleeding edge prelude";
        license = lib.licenses.mit;
-       hydraPlatforms = lib.platforms.none;
      }) {};
 
   "technique" = callPackage
@@ -279511,26 +279666,27 @@ self: {
        license = lib.licenses.bsd3;
      }) {};
 
-  "telegram-bot-simple_0_5_2" = callPackage
+  "telegram-bot-simple_0_6" = callPackage
     ({ mkDerivation, aeson, aeson-pretty, base, bytestring, cron
      , filepath, hashable, http-api-data, http-client, http-client-tls
      , monad-control, mtl, pretty-show, profunctors, servant
      , servant-client, servant-multipart-api, servant-multipart-client
-     , split, stm, template-haskell, text, time, transformers
-     , unordered-containers
+     , servant-server, split, stm, template-haskell, text, time
+     , transformers, unordered-containers, warp, warp-tls
      }:
      mkDerivation {
        pname = "telegram-bot-simple";
-       version = "0.5.2";
-       sha256 = "1fkpgdyrfa1ckaljmchha89mpqrkdwwj0pvcwvn38jg3y523n6k9";
+       version = "0.6";
+       sha256 = "1f4nfh32v5l60p2bqifg5dl311p86lis51na7hri074w0p3kg6ki";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
          aeson aeson-pretty base bytestring cron filepath hashable
          http-api-data http-client http-client-tls monad-control mtl
          pretty-show profunctors servant servant-client
-         servant-multipart-api servant-multipart-client split stm
-         template-haskell text time transformers unordered-containers
+         servant-multipart-api servant-multipart-client servant-server split
+         stm template-haskell text time transformers unordered-containers
+         warp warp-tls
        ];
        description = "Easy to use library for building Telegram bots";
        license = lib.licenses.bsd3;
@@ -280129,6 +280285,8 @@ self: {
        ];
        description = "Functors et al. over arity-1 type constructors";
        license = lib.licenses.asl20;
+       hydraPlatforms = lib.platforms.none;
+       broken = true;
      }) {};
 
   "ten-lens" = callPackage
@@ -280142,6 +280300,7 @@ self: {
        libraryHaskellDepends = [ base lens profunctors some ten ];
        description = "Lenses for the types in the ten package";
        license = lib.licenses.asl20;
+       hydraPlatforms = lib.platforms.none;
      }) {};
 
   "ten-unordered-containers" = callPackage
@@ -280167,6 +280326,7 @@ self: {
        ];
        description = "Higher-kinded hash containers";
        license = lib.licenses.asl20;
+       hydraPlatforms = lib.platforms.none;
      }) {};
 
   "tensor" = callPackage
@@ -283576,27 +283736,6 @@ self: {
      }:
      mkDerivation {
        pname = "th-utilities";
-       version = "0.2.4.3";
-       sha256 = "1krvn3xp7zicp6wqcgmgbgl2a894n677vxi6vhcna16cx03smic9";
-       libraryHaskellDepends = [
-         base bytestring containers directory filepath primitive syb
-         template-haskell text th-abstraction th-orphans
-       ];
-       testHaskellDepends = [
-         base bytestring containers directory filepath hspec primitive syb
-         template-haskell text th-abstraction th-orphans vector
-       ];
-       description = "Collection of useful functions for use with Template Haskell";
-       license = lib.licenses.mit;
-     }) {};
-
-  "th-utilities_0_2_5_0" = callPackage
-    ({ mkDerivation, base, bytestring, containers, directory, filepath
-     , hspec, primitive, syb, template-haskell, text, th-abstraction
-     , th-orphans, vector
-     }:
-     mkDerivation {
-       pname = "th-utilities";
        version = "0.2.5.0";
        sha256 = "1qcp3f9q4b9p372vdngy7bzcxp9b669vddpijg4j5vz04njl41sa";
        libraryHaskellDepends = [
@@ -283609,7 +283748,6 @@ self: {
        ];
        description = "Collection of useful functions for use with Template Haskell";
        license = lib.licenses.mit;
-       hydraPlatforms = lib.platforms.none;
      }) {};
 
   "thank-you-stars" = callPackage
@@ -283802,6 +283940,8 @@ self: {
        pname = "these-skinny";
        version = "0.7.5";
        sha256 = "1nbcfkjs7cn3gnyypxdf1gxm52gzqc3lqygdl8qrfgdk7cck6sbj";
+       revision = "1";
+       editedCabalFile = "1paqqcdbqr91gvvs0anq30pkdd37g70ql4v11lszl6dzjl6yy3d5";
        libraryHaskellDepends = [ base deepseq ghc-prim ];
        description = "A fork of the 'these' package without the dependency bloat";
        license = lib.licenses.bsd3;
@@ -284915,8 +285055,8 @@ self: {
     ({ mkDerivation, base, time }:
      mkDerivation {
        pname = "time-domain";
-       version = "0.1.0.0";
-       sha256 = "1gmz0l9nf185cl43qfdcsb15hgfkk6wprrfc5q93l82kgdc30bj4";
+       version = "0.1.0.1";
+       sha256 = "012dgd2265c6w6j9015js9ag8430xnwkd1vl1mkiv3wwg98svvrq";
        libraryHaskellDepends = [ base time ];
        description = "A library for time domains and durations";
        license = lib.licenses.mit;
@@ -287181,8 +287321,8 @@ self: {
        pname = "toml-reader";
        version = "0.1.0.0";
        sha256 = "06gxp8pzh8cdrifg5n0mhlnrslrx7k235sz2ldpy60x7vz7qywv9";
-       revision = "1";
-       editedCabalFile = "16qfl1bz7c8a34xvs5fzs5r421309xpw9gfsiv2szivd5hcp9f9r";
+       revision = "2";
+       editedCabalFile = "0ga0nc2n3irk0iy7ih90vww1cyaydn5sz7bpk7bz21ncny3g9fyg";
        libraryHaskellDepends = [
          base containers deepseq megaparsec parser-combinators text time
        ];
@@ -287196,19 +287336,25 @@ self: {
 
   "toml-reader-parse" = callPackage
     ({ mkDerivation, base, comonad, containers, deepseq, dlist, mtl
-     , prettyprinter, prettyprinter-combinators, text, time, toml-reader
-     , vector
+     , optparse-applicative, prettyprinter, prettyprinter-combinators
+     , tasty, tasty-hunit, text, time, toml-reader, vector
      }:
      mkDerivation {
        pname = "toml-reader-parse";
-       version = "0.1.0.0";
-       sha256 = "1ddwk29isiq190fd025laq0g8js7ifcngph9acy8zlmppp3685w7";
+       version = "0.1.1.0";
+       sha256 = "1ah47icy8lnpnmhpsmyp9pvp8f134pzzi6cvv5vpnw2r5szr9vly";
        libraryHaskellDepends = [
          base comonad containers deepseq dlist mtl prettyprinter
          prettyprinter-combinators text time toml-reader vector
        ];
+       testHaskellDepends = [
+         base optparse-applicative prettyprinter prettyprinter-combinators
+         tasty tasty-hunit text toml-reader
+       ];
        description = "Alternative parser for TOML values produced by the toml-reader package";
        license = lib.licenses.asl20;
+       hydraPlatforms = lib.platforms.none;
+       broken = true;
      }) {};
 
   "tomland" = callPackage
@@ -293054,6 +293200,26 @@ self: {
        license = lib.licenses.asl20;
      }) {};
 
+  "tzdata_0_2_20220923_0" = callPackage
+    ({ mkDerivation, base, bytestring, containers, deepseq, HUnit
+     , tasty, tasty-hunit, tasty-th, unix, vector
+     }:
+     mkDerivation {
+       pname = "tzdata";
+       version = "0.2.20220923.0";
+       sha256 = "0wzk15hlrjpdqh796h1v120223kn1327qr0rzp13ak0y5hm1fqrw";
+       enableSeparateDataOutput = true;
+       libraryHaskellDepends = [
+         base bytestring containers deepseq vector
+       ];
+       testHaskellDepends = [
+         base bytestring HUnit tasty tasty-hunit tasty-th unix
+       ];
+       description = "Time zone database (as files and as a module)";
+       license = lib.licenses.asl20;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "tztime" = callPackage
     ({ mkDerivation, base, deepseq, directory, doctest-parallel
      , filepath, mtl, safe-exceptions, tasty, tasty-discover
@@ -301237,8 +301403,8 @@ self: {
      }:
      mkDerivation {
        pname = "vulkan";
-       version = "3.21.1";
-       sha256 = "06yh0iw0yhs7kdgra3s39cl7fyvl2ys81ihw48k9jpravaal31xl";
+       version = "3.22";
+       sha256 = "074qg7r78p427gar1zqx98r7ypy3b0r9flvpsqpm27w1d7rlxl21";
        libraryHaskellDepends = [ base bytestring transformers vector ];
        libraryPkgconfigDepends = [ vulkan ];
        testHaskellDepends = [
@@ -301272,8 +301438,8 @@ self: {
      }:
      mkDerivation {
        pname = "vulkan-utils";
-       version = "0.5.8.1";
-       sha256 = "185ln34gv8p6iwifhjfzkvxbcnbb7zkkf3phlfm6hk7kykgdypvy";
+       version = "0.5.9";
+       sha256 = "114kx06i58d6pzgd86qxqih7nv845nvf04isl83xbfzij4bf1p06";
        setupHaskellDepends = [ base Cabal cabal-doctest ];
        libraryHaskellDepends = [
          base bytestring containers dependent-map dependent-sum extra
@@ -304700,25 +304866,25 @@ self: {
 
   "webby" = callPackage
     ({ mkDerivation, aeson, base, binary, bytestring, formatting
-     , http-api-data, http-types, relude, resourcet, tasty, tasty-hunit
-     , tasty-quickcheck, text, unliftio, unliftio-core
+     , http-api-data, http-types, mime-types, relude, resourcet, tasty
+     , tasty-hunit, tasty-quickcheck, text, unliftio, unliftio-core
      , unordered-containers, wai
      }:
      mkDerivation {
        pname = "webby";
-       version = "1.0.2";
-       sha256 = "17mx6xwrb49rqx55ccg1wx3ysjpfbvii8kwrmd4nd9wisslldiv6";
+       version = "1.1.0";
+       sha256 = "1nrk40blzmzv3drgja76bq6czlayqan4rl3wgkd7mlkbkvdplmxj";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
          aeson base binary bytestring formatting http-api-data http-types
-         relude resourcet text unliftio unliftio-core unordered-containers
-         wai
+         mime-types relude resourcet text unliftio unliftio-core
+         unordered-containers wai
        ];
        testHaskellDepends = [
          aeson base binary bytestring formatting http-api-data http-types
-         relude resourcet tasty tasty-hunit tasty-quickcheck text unliftio
-         unliftio-core unordered-containers wai
+         mime-types relude resourcet tasty tasty-hunit tasty-quickcheck text
+         unliftio unliftio-core unordered-containers wai
        ];
        description = "A super-simple web server framework";
        license = lib.licenses.asl20;
@@ -308709,8 +308875,8 @@ self: {
      }:
      mkDerivation {
        pname = "xcffib";
-       version = "0.11.1";
-       sha256 = "18xwliqcba0ia4p64gxiqd0pvkg3r3ylsmn3mywa5p43x1dji481";
+       version = "0.12.0";
+       sha256 = "0vgxicqhzvhnbi6mn2bjw56pnvnqd4d49hn5q1fpjhjbpxxz5vgi";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -314483,8 +314649,8 @@ self: {
      }:
      mkDerivation {
        pname = "yesod-test";
-       version = "1.6.14";
-       sha256 = "1sb50n9x5xsisad6czxx1gazrjak9hj6mcpv3q147yhpgfnpay9k";
+       version = "1.6.15";
+       sha256 = "16q4f1l3m4l8iy5vmaa8c0vm2iiqhpghf3kykymlh41xy96mqpn3";
        libraryHaskellDepends = [
          aeson attoparsec base blaze-builder blaze-html blaze-markup
          bytestring case-insensitive conduit containers cookie hspec-core
diff --git a/pkgs/development/haskell-modules/patches/cachix.patch b/pkgs/development/haskell-modules/patches/cachix.patch
new file mode 100755
index 00000000000..21f1496933a
--- /dev/null
+++ b/pkgs/development/haskell-modules/patches/cachix.patch
@@ -0,0 +1,10 @@
+--- a/src/Cachix/Client/OptionsParser.hs
++++ b/src/Cachix/Client/OptionsParser.hs
+@@ -15,7 +15,7 @@
+ import qualified Cachix.Client.URI as URI
+ import qualified Cachix.Deploy.OptionsParser as DeployOptions
+ import Options.Applicative
+-import Protolude hiding (toS)
++import Protolude hiding (option, toS)
+ import Protolude.Conv
+ import qualified URI.ByteString as URI
diff --git a/pkgs/development/libraries/gensio/default.nix b/pkgs/development/libraries/gensio/default.nix
index 48e2d4fd8fb..2ae3d8d93b0 100644
--- a/pkgs/development/libraries/gensio/default.nix
+++ b/pkgs/development/libraries/gensio/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gensio";
-  version = "2.3.7";
+  version = "2.5.5";
 
   src = fetchFromGitHub {
     owner = "cminyard";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-g1o/udsIFLJ+gunvI2QtsnksPaa946jWKkcdmdGmQ/k=";
+    sha256 = "sha256-K2A61OflKdVVzdV8qH5x/ggZKa4i8yvs5bdPoOwmm7A=";
   };
 
   passthru = {
diff --git a/pkgs/development/libraries/libgweather/default.nix b/pkgs/development/libraries/libgweather/default.nix
index e9a4eb2a4ea..77a4b936ae5 100644
--- a/pkgs/development/libraries/libgweather/default.nix
+++ b/pkgs/development/libraries/libgweather/default.nix
@@ -89,6 +89,8 @@ stdenv.mkDerivation rec {
     updateScript = gnome.updateScript {
       packageName = pname;
       versionPolicy = "odd-unstable";
+      # Version 40.alpha preceded version 4.0.
+      freeze = "40.alpha";
     };
   };
 
diff --git a/pkgs/development/libraries/onnxruntime/default.nix b/pkgs/development/libraries/onnxruntime/default.nix
index 77730cb8820..e297f835f32 100644
--- a/pkgs/development/libraries/onnxruntime/default.nix
+++ b/pkgs/development/libraries/onnxruntime/default.nix
@@ -5,7 +5,7 @@
 , fetchurl
 , pkg-config
 , cmake
-, python3
+, python3Packages
 , libpng
 , zlib
 , eigen
@@ -15,6 +15,9 @@
 , boost
 , oneDNN
 , gtest
+, pythonSupport ? true
+, nsync
+, flatbuffers
 }:
 
 let
@@ -49,9 +52,13 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     cmake
     pkg-config
-    python3
+    python3Packages.python
     gtest
-  ];
+  ] ++ lib.optionals pythonSupport (with python3Packages; [
+    setuptools
+    wheel
+    pip
+  ]);
 
   buildInputs = [
     libpng
@@ -61,10 +68,16 @@ stdenv.mkDerivation rec {
     nlohmann_json
     boost
     oneDNN
-  ];
+  ] ++ lib.optionals pythonSupport ([
+    flatbuffers
+    nsync
+  ] ++ (with python3Packages; [
+    numpy
+    pybind11
+  ]));
 
   # TODO: build server, and move .so's to lib output
-  outputs = [ "out" "dev" ];
+  outputs = [ "out" "dev" ] ++ lib.optionals pythonSupport [ "python" ];
 
   enableParallelBuilding = true;
 
@@ -79,6 +92,8 @@ stdenv.mkDerivation rec {
     "-Donnxruntime_USE_MPI=ON"
     "-Deigen_SOURCE_PATH=${eigen.src}"
     "-Donnxruntime_USE_DNNL=YES"
+  ] ++ lib.optionals pythonSupport [
+    "-Donnxruntime_ENABLE_PYTHON=ON"
   ];
 
   doCheck = true;
@@ -91,12 +106,18 @@ stdenv.mkDerivation rec {
       --replace '$'{prefix}/@CMAKE_INSTALL_ @CMAKE_INSTALL_
   '';
 
+  postBuild = lib.optionalString pythonSupport ''
+    ${python3Packages.python.interpreter} ../setup.py bdist_wheel
+  '';
+
   postInstall = ''
     # perform parts of `tools/ci_build/github/linux/copy_strip_binary.sh`
     install -m644 -Dt $out/include \
       ../include/onnxruntime/core/framework/provider_options.h \
       ../include/onnxruntime/core/providers/cpu/cpu_provider_factory.h \
       ../include/onnxruntime/core/session/onnxruntime_*.h
+  '' + lib.optionalString pythonSupport ''
+    pip install dist/*.whl --no-index --no-warn-script-location --prefix="$python" --no-cache --no-deps
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/ailment/default.nix b/pkgs/development/python-modules/ailment/default.nix
index d16bc429ecb..49f3b39b737 100644
--- a/pkgs/development/python-modules/ailment/default.nix
+++ b/pkgs/development/python-modules/ailment/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "ailment";
-  version = "9.2.19";
+  version = "9.2.20";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-nm8vumylqNefSN+RE/3nUB+fzwznnkefDlXeQGQdfEw=";
+    hash = "sha256-dfogVQZ6RP1GyuoiTEC/VLancb+ZmdM1xPSngLbcmYs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/aiopyarr/default.nix b/pkgs/development/python-modules/aiopyarr/default.nix
index a2e66b42af7..e9dec57f4d1 100644
--- a/pkgs/development/python-modules/aiopyarr/default.nix
+++ b/pkgs/development/python-modules/aiopyarr/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "aiopyarr";
-  version = "22.7.0";
+  version = "22.9.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "tkdrob";
     repo = pname;
     rev = version;
-    hash = "sha256-ALFaWy/wY8PTuMixHEWaXXmKNSLf9Cm2pgffVHnAWLg=";
+    hash = "sha256-nJjqpk4GcgXJhFZd4E3vSmyNP+RkOASEd4Ipemx6cAc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/angr/default.nix b/pkgs/development/python-modules/angr/default.nix
index c57ec4de6e1..9a841aae8fd 100644
--- a/pkgs/development/python-modules/angr/default.nix
+++ b/pkgs/development/python-modules/angr/default.nix
@@ -46,7 +46,7 @@ in
 
 buildPythonPackage rec {
   pname = "angr";
-  version = "9.2.19";
+  version = "9.2.20";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -55,7 +55,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-3hgEWmP8uwSGE5gh5HAs7xMJnnzY1hlwE8UqW/dzk7c=";
+    hash = "sha256-MQT9iebGVGM89QybQ/GcjfPHrp0ZeNsjYrXV9ITNSsM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/archinfo/default.nix b/pkgs/development/python-modules/archinfo/default.nix
index 7a2cecdb2d0..0488e7e0fd9 100644
--- a/pkgs/development/python-modules/archinfo/default.nix
+++ b/pkgs/development/python-modules/archinfo/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "archinfo";
-  version = "9.2.19";
+  version = "9.2.20";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-zfDOIkXwt393tu9QPXz/ADyIK3mJCQ6oSgKcaMipHLg=";
+    hash = "sha256-JitAp536AM0EnE+LWlKceoYIk/gYxnbOUPtX7CK5SiM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/claripy/default.nix b/pkgs/development/python-modules/claripy/default.nix
index edcb1c03b5d..9286c28f4e5 100644
--- a/pkgs/development/python-modules/claripy/default.nix
+++ b/pkgs/development/python-modules/claripy/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "claripy";
-  version = "9.2.19";
+  version = "9.2.20";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-amCt7ccAKXNicCHvhu0pLUKXPlkrD8UpLO94D78OGAk=";
+    hash = "sha256-G4Tes9X7dz+bBTJCdbr3o4nTlN2c4Ixtl6iwZv0XYvA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/cle/default.nix b/pkgs/development/python-modules/cle/default.nix
index 6a012de87df..9976093489b 100644
--- a/pkgs/development/python-modules/cle/default.nix
+++ b/pkgs/development/python-modules/cle/default.nix
@@ -16,7 +16,7 @@
 
 let
   # The binaries are following the argr projects release cycle
-  version = "9.2.19";
+  version = "9.2.20";
 
   # Binary files from https://github.com/angr/binaries (only used for testing and only here)
   binaries = fetchFromGitHub {
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-uwCSgq7l5VByN1YPuqdnvj2ImV/rb8Xn7dz1p7EvrdQ=";
+    hash = "sha256-ORNlmdkAlMj1CaWj5pDve0yJe3TEv9IfKOwqRd+gVH4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/dbus-fast/default.nix b/pkgs/development/python-modules/dbus-fast/default.nix
index 5187c53683c..24723fdafad 100644
--- a/pkgs/development/python-modules/dbus-fast/default.nix
+++ b/pkgs/development/python-modules/dbus-fast/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "dbus-fast";
-  version = "1.15.1";
+  version = "1.17.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Uq+f0l9/W6PjP9MczF3VJNJicDgOnMrfXpOkHp7frVY=";
+    hash = "sha256-HbjeO+imWocc5bL62gdWHf8kBR6HNWwEu+KqO4ldHe4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/dnslib/default.nix b/pkgs/development/python-modules/dnslib/default.nix
index 2d70c00579e..11f387d2469 100644
--- a/pkgs/development/python-modules/dnslib/default.nix
+++ b/pkgs/development/python-modules/dnslib/default.nix
@@ -1,20 +1,34 @@
-{ lib, python, buildPythonPackage, fetchPypi }:
+{ lib
+, python
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+}:
 
 buildPythonPackage rec {
   pname = "dnslib";
-  version = "0.9.21";
+  version = "0.9.22";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-IXabARWP5wvokSF1Q0nyg13M3yHVwBHOyfoopI+lVdQ=";
+    hash = "sha256-EK/JT2pfHLiziCTgQuJeVBTh+q7f05s0iujZdyKSGoY=";
   };
 
-  checkPhase = "VERSIONS=${python.interpreter} ./run_tests.sh";
+  checkPhase = ''
+    VERSIONS=${python.interpreter} ./run_tests.sh
+  '';
+
+  pythonImportsCheck = [
+    "dnslib"
+  ];
 
   meta = with lib; {
     description = "Simple library to encode/decode DNS wire-format packets";
+    homepage = "https://github.com/paulc/dnslib";
     license = licenses.bsd2;
-    homepage = "https://bitbucket.org/paulc/dnslib/";
     maintainers = with maintainers; [ delroth ];
   };
 }
diff --git a/pkgs/development/python-modules/emcee/default.nix b/pkgs/development/python-modules/emcee/default.nix
index c79adccc41f..80e0e7daf86 100644
--- a/pkgs/development/python-modules/emcee/default.nix
+++ b/pkgs/development/python-modules/emcee/default.nix
@@ -4,17 +4,21 @@
 , numpy
 , pytestCheckHook
 , setuptools-scm
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "emcee";
-  version = "3.1.2";
+  version = "3.1.3";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "dfm";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-MguhnLLo1zeNuMca8vWpxwysh9YJDD+IzvGQDbScK2M=";
+    hash = "sha256-HAuwWFNL63BlvHomQx+hWw4et7kRYd3zhH2FAj632Lg=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -31,7 +35,9 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  pythonImportsCheck = [ "emcee" ];
+  pythonImportsCheck = [
+    "emcee"
+  ];
 
   meta = with lib; {
     description = "Kick ass affine-invariant ensemble MCMC sampling";
diff --git a/pkgs/development/python-modules/google-cloud-spanner/default.nix b/pkgs/development/python-modules/google-cloud-spanner/default.nix
index 2b31f280621..eddd412a4c6 100644
--- a/pkgs/development/python-modules/google-cloud-spanner/default.nix
+++ b/pkgs/development/python-modules/google-cloud-spanner/default.nix
@@ -10,15 +10,19 @@
 , pytestCheckHook
 , pytest-asyncio
 , sqlparse
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-spanner";
-  version = "3.21.0";
+  version = "3.22.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-47fR2Pwwl9HJ5pIqf8H0QjmrVYy5NgN5sdk3nH4yf/Q=";
+    hash = "sha256-3EZMUyF9Se+DD3EK0/srYODRJo8OQkAr5RilTbMTHIo=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/hass-nabucasa/default.nix b/pkgs/development/python-modules/hass-nabucasa/default.nix
index e23aa5b9fa7..a1c07368c0d 100644
--- a/pkgs/development/python-modules/hass-nabucasa/default.nix
+++ b/pkgs/development/python-modules/hass-nabucasa/default.nix
@@ -15,13 +15,13 @@
 
 buildPythonPackage rec {
   pname = "hass-nabucasa";
-  version = "0.55.0";
+  version = "0.56.0";
 
   src = fetchFromGitHub {
     owner = "nabucasa";
     repo = pname;
     rev = version;
-    sha256 = "sha256-3r955nZu/nNHnFQJy8bSswtd4N0JxGZA8RLU0CXZT7o=";
+    sha256 = "sha256-IgDOugHr4fCD9o3QQY5w/ibjak/d56R31KgQAbjUkkI=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/hmmlearn/default.nix b/pkgs/development/python-modules/hmmlearn/default.nix
index 8c699af9752..ea39c432456 100644
--- a/pkgs/development/python-modules/hmmlearn/default.nix
+++ b/pkgs/development/python-modules/hmmlearn/default.nix
@@ -1,27 +1,55 @@
-{ lib, fetchurl, buildPythonPackage
-, numpy, scikit-learn, pybind11, setuptools-scm, cython
-, pytestCheckHook }:
+{ lib
+, fetchurl
+, buildPythonPackage
+, numpy
+, scikit-learn
+, pybind11
+, setuptools-scm
+, cython
+, pytestCheckHook
+, pythonOlder
+}:
 
 buildPythonPackage rec {
   pname = "hmmlearn";
-  version = "0.2.7";
+  version = "0.2.8";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchurl {
     url = "mirror://pypi/h/hmmlearn/${pname}-${version}.tar.gz";
-    sha256 = "sha256-a0snIPJ6912pNnq02Q3LAPONozFo322Rf57F3mZw9uE=";
+    hash = "sha256-aWkx49zmgBzJt4xin1QwYd1+tnpxFVsD0bOeoXKipfk=";
   };
 
-  buildInputs = [ setuptools-scm cython pybind11 ];
-  propagatedBuildInputs = [ numpy scikit-learn ];
-  checkInputs = [ pytestCheckHook ];
+  buildInputs = [
+    setuptools-scm
+    cython
+    pybind11
+  ];
+
+  propagatedBuildInputs = [
+    numpy
+    scikit-learn
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "hmmlearn"
+  ];
 
-  pythonImportsCheck = [ "hmmlearn" ];
-  pytestFlagsArray = [ "--pyargs" "hmmlearn" ];
+  pytestFlagsArray = [
+    "--pyargs"
+    "hmmlearn"
+  ];
 
   meta = with lib; {
     description = "Hidden Markov Models in Python with scikit-learn like API";
-    homepage    = "https://github.com/hmmlearn/hmmlearn";
-    license     = licenses.bsd3;
+    homepage = "https://github.com/hmmlearn/hmmlearn";
+    license = licenses.bsd3;
     maintainers = with maintainers; [ abbradar ];
   };
 }
diff --git a/pkgs/development/python-modules/iminuit/default.nix b/pkgs/development/python-modules/iminuit/default.nix
index 246f04618f2..19c38ac3fbc 100644
--- a/pkgs/development/python-modules/iminuit/default.nix
+++ b/pkgs/development/python-modules/iminuit/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "iminuit";
-  version = "2.16.0";
+  version = "2.17.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ECSlGdvI/VLV/So3ef1IWwm8J8QFVt74tvkWlUIxmdY=";
+    hash = "sha256-dfSoorrSH9p7a9Qt98oEEg+yRjbr+bVm0lmybyBEsdA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/jarowinkler/default.nix b/pkgs/development/python-modules/jarowinkler/default.nix
index 03e32e56af3..b71187c9fea 100644
--- a/pkgs/development/python-modules/jarowinkler/default.nix
+++ b/pkgs/development/python-modules/jarowinkler/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "jarowinkler";
-  version = "1.2.2";
+  version = "1.2.3";
 
   disabled = pythonOlder "3.6";
 
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "maxbachmann";
     repo = "JaroWinkler";
     rev = "refs/tags/v${version}";
-    hash = "sha256-1jImgRvGQ2x3Swkq43gq0IhgZTzIBtedoqN11hvDGns=";
+    hash = "sha256-j+ZabVsiVitNkTPhGjDg72XogjvPaL453lTW45ITm90=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/jc/default.nix b/pkgs/development/python-modules/jc/default.nix
index 7cce5dca7aa..f0c808459d2 100644
--- a/pkgs/development/python-modules/jc/default.nix
+++ b/pkgs/development/python-modules/jc/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "jc";
-  version = "1.21.2";
+  version = "1.22.0";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "kellyjonbrazil";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-gzxN2ZbnZw7EE5oVeSpugzl/paAbyKKQlxVs/8n3Hzw=";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-cRa52rFZlSH0D5u9L7NcWbQGCNdOlRE2koRi8VgVpAo=";
   };
 
   propagatedBuildInputs = [ ruamel-yaml xmltodict pygments ];
diff --git a/pkgs/development/python-modules/jellyfin-apiclient-python/default.nix b/pkgs/development/python-modules/jellyfin-apiclient-python/default.nix
index be848b65282..4413f081a63 100644
--- a/pkgs/development/python-modules/jellyfin-apiclient-python/default.nix
+++ b/pkgs/development/python-modules/jellyfin-apiclient-python/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "jellyfin-apiclient-python";
-  version = "1.9.1";
+  version = "1.9.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-fS+NQUTKNxHuE+qsV91mpTlYt7DfXQVsA9ybfLlHYtc=";
+    hash = "sha256-vMzZeoiWli3HjM8Dqr5RhNfR7gcjPqoXG3b/aNNlx2Q=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/jupyter_server/default.nix b/pkgs/development/python-modules/jupyter_server/default.nix
index 657e7a9ce30..f031528db3e 100644
--- a/pkgs/development/python-modules/jupyter_server/default.nix
+++ b/pkgs/development/python-modules/jupyter_server/default.nix
@@ -30,12 +30,12 @@
 
 buildPythonPackage rec {
   pname = "jupyter_server";
-  version = "1.18.1";
+  version = "1.19.1";
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-K3L8WVvMrikiYKrYFXoOrY2ixwPsauG7ezbbrQ4mfqc=";
+    sha256 = "sha256-0cw1lpRYSXQrw+7fBpn+61CtbGBF6+8CqSmLfxPCfp8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/limnoria/default.nix b/pkgs/development/python-modules/limnoria/default.nix
index 7f95f4ae138..2acb735052b 100644
--- a/pkgs/development/python-modules/limnoria/default.nix
+++ b/pkgs/development/python-modules/limnoria/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "limnoria";
-  version = "2022.8.7";
+  version = "2022.9.20";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-TRTqhWQSVhjJkd9FLJk1lDwdzyzkeih9zHPSOvTf2oQ=";
+    hash = "sha256-db+JKQXDffMm5dcyMVtYNj1YFKHSlvYAoyZi86tqoiA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/oci/default.nix b/pkgs/development/python-modules/oci/default.nix
index c81821b9eb1..3377d44ae93 100644
--- a/pkgs/development/python-modules/oci/default.nix
+++ b/pkgs/development/python-modules/oci/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "oci";
-  version = "2.83.0";
+  version = "2.84.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "oracle";
     repo = "oci-python-sdk";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Wwq2o4A8UK4Gj5PvqQqQLYpCLRHTkhS4eygToTAIOwU=";
+    hash = "sha256-nG8bml9mTlKz48PhQjrLmAYYznb1qlrEI+XgvpM9zlk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/ocrmypdf/default.nix b/pkgs/development/python-modules/ocrmypdf/default.nix
index 0acaf784206..77dee64bb45 100644
--- a/pkgs/development/python-modules/ocrmypdf/default.nix
+++ b/pkgs/development/python-modules/ocrmypdf/default.nix
@@ -19,7 +19,7 @@
 , setuptools-scm
 , setuptools-scm-git-archive
 , substituteAll
-, tesseract4
+, tesseract
 , tqdm
 , unpaper
 , installShellFiles
@@ -50,7 +50,7 @@ buildPythonPackage rec {
       gs = "${lib.getBin ghostscript}/bin/gs";
       jbig2 = "${lib.getBin jbig2enc}/bin/jbig2";
       pngquant = "${lib.getBin pngquant}/bin/pngquant";
-      tesseract = "${lib.getBin tesseract4}/bin/tesseract";
+      tesseract = "${lib.getBin tesseract}/bin/tesseract";
       unpaper = "${lib.getBin unpaper}/bin/unpaper";
     })
   ];
diff --git a/pkgs/development/python-modules/onnxconverter-common/default.nix b/pkgs/development/python-modules/onnxconverter-common/default.nix
new file mode 100644
index 00000000000..89fefb38dee
--- /dev/null
+++ b/pkgs/development/python-modules/onnxconverter-common/default.nix
@@ -0,0 +1,48 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, numpy
+, packaging
+, protobuf
+, onnx
+, unittestCheckHook
+, onnxruntime
+}:
+
+buildPythonPackage {
+  pname = "onnxconverter-common";
+  version = "1.12.2"; # Upstream no longer seems to push tags
+
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "microsoft";
+    repo = "onnxconverter-common";
+    rev = "814cdf494d987900d30b16971c0e8334aaca9ae6";
+    hash = "sha256-XA/kl8aT1wLthl1bMihtv/1ELOW1sGO/It5XfJtD+sY=";
+  };
+
+  propagatedBuildInputs = [
+    numpy
+    packaging # undeclared dependency
+    protobuf
+    onnx
+  ];
+
+  checkInputs = [
+    onnxruntime
+    unittestCheckHook
+  ];
+
+  unittestFlagsArray = [ "-s" "tests" ];
+
+  # Failing tests
+  # https://github.com/microsoft/onnxconverter-common/issues/242
+  doCheck = false;
+
+  meta = {
+    description = "ONNX Converter and Optimization Tools";
+    maintainers = with lib.maintainers; [ fridh ];
+    license = with lib.licenses; [ mit ];
+  };
+}
diff --git a/pkgs/development/python-modules/pontos/default.nix b/pkgs/development/python-modules/pontos/default.nix
index c2e6bd2842e..358af52ef70 100644
--- a/pkgs/development/python-modules/pontos/default.nix
+++ b/pkgs/development/python-modules/pontos/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "pontos";
-  version = "22.9.1";
+  version = "22.9.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "greenbone";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-W0WubsulnMtNbW/KP1Sp1ChEb3ie1s+Oxu23jpnB/Nc=";
+    hash = "sha256-YqOeeivOscH1YtYXu348ozY25vHFkD9q1OFJ/jfZJLk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/psd-tools/default.nix b/pkgs/development/python-modules/psd-tools/default.nix
index a4be2b11d5e..96be2af48b1 100644
--- a/pkgs/development/python-modules/psd-tools/default.nix
+++ b/pkgs/development/python-modules/psd-tools/default.nix
@@ -14,13 +14,13 @@
 
 buildPythonPackage rec {
   pname = "psd-tools";
-  version = "1.9.22";
+  version = "1.9.23";
 
   src = fetchFromGitHub {
     owner = "psd-tools";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-T3/KLirU69Mdu7pQ6NFEVzhesaYhYsdK6DjTJQivPBQ=";
+    sha256 = "sha256-pJUf5rE5QMnfNytU1P0Zbj1iztrK5xrX4CJ/WvIG8mY=";
   };
 
   nativeBuildInputs = [ cython ];
diff --git a/pkgs/development/python-modules/pulumi-aws/default.nix b/pkgs/development/python-modules/pulumi-aws/default.nix
index e6aaa0cd202..11b58e65d0e 100644
--- a/pkgs/development/python-modules/pulumi-aws/default.nix
+++ b/pkgs/development/python-modules/pulumi-aws/default.nix
@@ -12,7 +12,7 @@
 buildPythonPackage rec {
   pname = "pulumi-aws";
   # Version is independant of pulumi's.
-  version = "5.14.0";
+  version = "5.16.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "pulumi";
     repo = "pulumi-aws";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ZdmPpjuc9z76wnNImX9BhNNAFDw1EDEZV8IAm01hfss=";
+    hash = "sha256-SyRSRcKCIIaoyLdWYfFERjRp3pyXHGn35WXMqjOe3DY=";
   };
 
   sourceRoot = "${src.name}/sdk/python";
diff --git a/pkgs/development/python-modules/pyfuse3/default.nix b/pkgs/development/python-modules/pyfuse3/default.nix
index 07ba27c0ef7..e7b545d2a5e 100644
--- a/pkgs/development/python-modules/pyfuse3/default.nix
+++ b/pkgs/development/python-modules/pyfuse3/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "pyfuse3";
-  version = "3.2.1";
+  version = "3.2.2";
 
   disabled = pythonOlder "3.5";
 
@@ -23,8 +23,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "libfuse";
     repo = "pyfuse3";
-    rev = "release-${version}";
-    hash = "sha256-JGbp2bSI/Rvyys1xMd2o34KlqqBsV6B9LhuuNopayYA=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-Y9Haz3MMhTXkvYFOGNWJnoGNnvoK6wiQ+s3AwJhBD8Q=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pytest-testmon/default.nix b/pkgs/development/python-modules/pytest-testmon/default.nix
index 5d6117d35e2..4e3001ea623 100644
--- a/pkgs/development/python-modules/pytest-testmon/default.nix
+++ b/pkgs/development/python-modules/pytest-testmon/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "pytest-testmon";
-  version = "1.3.6";
+  version = "1.3.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-KcDVOKAuQ5iVKgK3o1Vnc+LUVsI1izTnkOmByiyCJ1E=";
+    hash = "sha256-tjdu4mEslRl7QGnNGg7ATaQCipwF5/XSpFPq3E3A/Vo=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/python-gitlab/default.nix b/pkgs/development/python-modules/python-gitlab/default.nix
index eb431698973..09dade7107a 100644
--- a/pkgs/development/python-modules/python-gitlab/default.nix
+++ b/pkgs/development/python-modules/python-gitlab/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "python-gitlab";
-  version = "3.9.0";
+  version = "3.10.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-X8Xoj4HzZuEYUcuLS5pbgnSRziC6dYVEa3TJsJdya6M=";
+    sha256 = "sha256-FJMKFv3X829nuTc+fU1HIOjjdIAAKDgCidszBun3RhQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/python-gvm/default.nix b/pkgs/development/python-modules/python-gvm/default.nix
index cc3d8667073..0a7af2f40d8 100644
--- a/pkgs/development/python-modules/python-gvm/default.nix
+++ b/pkgs/development/python-modules/python-gvm/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "python-gvm";
-  version = "22.7.0";
+  version = "22.9.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "greenbone";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-0dshBFcZ0DLa6SXxzWyfzmgPPxTIiKq00OKCJfk0vKY=";
+    sha256 = "sha256-V9xfPYwDDoCGJPstzYsC/ikUp45uiaZE0Bg4i9tRNhU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pyvex/default.nix b/pkgs/development/python-modules/pyvex/default.nix
index ec1adcb5227..0328328b825 100644
--- a/pkgs/development/python-modules/pyvex/default.nix
+++ b/pkgs/development/python-modules/pyvex/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "pyvex";
-  version = "9.2.19";
+  version = "9.2.20";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-f/Oc5IOVkOqCkpWnNclQ8eC4YZU9Iz/q4kfcTkP5x0o=";
+    hash = "sha256-qMWJk+vq8JyHjkEScpnlfRG7NzmyH6VyoZLNMAz6BWI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pyvo/default.nix b/pkgs/development/python-modules/pyvo/default.nix
index c04c70ebc60..35da20d648d 100644
--- a/pkgs/development/python-modules/pyvo/default.nix
+++ b/pkgs/development/python-modules/pyvo/default.nix
@@ -13,13 +13,13 @@
 
 buildPythonPackage rec {
   pname = "pyvo";
-  version = "1.3";
+  version = "1.4";
 
   disabled = pythonOlder "3.8"; # according to setup.cfg
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "846a54a05a8ddb47a8c2cc3077434779b0e4ccc1b74a7a5408593cb673307d67";
+    sha256 = "sha256-R2ttLoFd6Ic0KZl49dzN5NtWAqPpXRaeki6X8CRGsCw=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/skein/default.nix b/pkgs/development/python-modules/skein/default.nix
index 493528be497..5b486e0163c 100644
--- a/pkgs/development/python-modules/skein/default.nix
+++ b/pkgs/development/python-modules/skein/default.nix
@@ -17,10 +17,11 @@ buildPythonPackage rec {
   version = "0.8.2";
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-nXTqsJNX/LwAglPcPZkmdYPfF+vDLN+nNdZaDFTrHzE=";
+    hash = "sha256-nXTqsJNX/LwAglPcPZkmdYPfF+vDLN+nNdZaDFTrHzE=";
   };
+
   # Update this hash if bumping versions
-  jarHash = "sha256-UGiEoTZ17IhLG72FZ18Zb+Ej4T8z9rMIMDUxzSZGZyY=";
+  jarHash = "sha256-x2KH6tnoG7sogtjrJvUaxy0PCEA8q/zneuI969oBOKo=";
   skeinJar = callPackage ./skeinjar.nix { inherit pname version jarHash; };
 
   propagatedBuildInputs = [ cryptography grpcio pyyaml ];
diff --git a/pkgs/development/python-modules/skein/skeinjar.nix b/pkgs/development/python-modules/skein/skeinjar.nix
index d559f237bf7..1cec80fa933 100644
--- a/pkgs/development/python-modules/skein/skeinjar.nix
+++ b/pkgs/development/python-modules/skein/skeinjar.nix
@@ -6,6 +6,8 @@ stdenv.mkDerivation rec {
   src = fetchPypi {
     inherit pname version;
     format = "wheel";
+    python = "py3";
+    dist = "py3";
     hash = jarHash;
   };
 
@@ -15,6 +17,6 @@ stdenv.mkDerivation rec {
 
   installPhase = ''
     unzip ${src}
-    mv ./skein/java/skein.jar $out
+    install -D ./skein/java/skein.jar $out
   '';
 }
diff --git a/pkgs/development/python-modules/skl2onnx/default.nix b/pkgs/development/python-modules/skl2onnx/default.nix
new file mode 100644
index 00000000000..4e8f9586311
--- /dev/null
+++ b/pkgs/development/python-modules/skl2onnx/default.nix
@@ -0,0 +1,49 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, numpy
+, scipy
+, protobuf
+, onnx
+, scikit-learn
+, onnxconverter-common
+, onnxruntime
+, pandas
+, unittestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "skl2onnx";
+  version = "1.13";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-XzUva5uFX/rGMFpwfwLH1Db0Nok47pBJCSqVo1ZcJz0=";
+  };
+
+  propagatedBuildInputs = [
+    numpy
+    scipy
+    protobuf
+    onnx
+    scikit-learn
+    onnxconverter-common
+  ];
+
+  checkInputs = [
+    onnxruntime
+    pandas
+    unittestCheckHook
+  ];
+
+  unittestFlagsArray = [ "-s" "tests" ];
+
+  # Core dump
+  doCheck = false;
+
+  meta = {
+    description = "Convert scikit-learn models to ONNX";
+    maintainers = with lib.maintainers; [ fridh ];
+    license = with lib.licenses; [ asl20 ];
+  };
+}
diff --git a/pkgs/development/python-modules/tesserocr/default.nix b/pkgs/development/python-modules/tesserocr/default.nix
index 0b21e17f96b..c8e1d2e64f9 100644
--- a/pkgs/development/python-modules/tesserocr/default.nix
+++ b/pkgs/development/python-modules/tesserocr/default.nix
@@ -1,14 +1,18 @@
-{
-  buildPythonPackage,
-  fetchPypi,
-  lib,
-  # build dependencies
-  cython,
-  leptonica,
-  pkg-config,
-  tesseract,
-  # extra python packages
-  pillow
+{ buildPythonPackage
+, fetchPypi
+, lib
+
+# build dependencies
+, cython
+, leptonica
+, pkg-config
+, tesseract
+
+# propagates
+, pillow
+
+# tests
+, unittestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -20,11 +24,30 @@ buildPythonPackage rec {
     sha256 = "1bmj76gi8401lcqdaaznfmz9yf11myy1bzivqwwq08z3dwzxswck";
   };
 
-  nativeBuildInputs = [ cython pkg-config ];
-  buildInputs = [ leptonica tesseract ];
-  propagatedBuildInputs = [ pillow ];
+  nativeBuildInputs = [
+    cython
+    pkg-config
+  ];
+
+  buildInputs = [
+    leptonica
+    tesseract
+  ];
+
+  propagatedBuildInputs = [
+    pillow
+  ];
+
+  pythonImportsCheck = [
+    "tesserocr"
+  ];
+
+  checkInputs = [
+    unittestCheckHook
+  ];
 
   meta = with lib; {
+    changelog = "https://github.com/sirfz/tesserocr/releases/tag/v${version}";
     description = "A simple, Pillow-friendly, wrapper around the tesseract-ocr API for Optical Character Recognition (OCR)";
     homepage = "https://github.com/sirfz/tesserocr";
     license = licenses.mit;
diff --git a/pkgs/development/python-modules/testcontainers/default.nix b/pkgs/development/python-modules/testcontainers/default.nix
index 65c8ed8bf46..20c52fd686a 100644
--- a/pkgs/development/python-modules/testcontainers/default.nix
+++ b/pkgs/development/python-modules/testcontainers/default.nix
@@ -7,13 +7,13 @@
 
 buildPythonPackage rec {
   pname = "testcontainers";
-  version = "3.5.0";
+  version = "3.7.0";
 
   src = fetchFromGitHub {
     owner = "testcontainers";
     repo = "testcontainers-python";
     rev = "v${version}";
-    sha256 = "sha256-uB3MbRVQzbUdZRxkGl635O+K17bkHIGY2JbU8R23Kt0=";
+    sha256 = "sha256-t6W5A877bSPcbKVzCLEhjPzOPwF8ZTGjlvnwt1CwWCE=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/yalexs/default.nix b/pkgs/development/python-modules/yalexs/default.nix
index 8a320eb103a..638e5002885 100644
--- a/pkgs/development/python-modules/yalexs/default.nix
+++ b/pkgs/development/python-modules/yalexs/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "yalexs";
-  version = "1.2.1";
+  version = "1.2.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "bdraco";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-7+4Icg3E6xrWmxObNzNuDc+MXJ9rnbgBHMK4uPBJeuY=";
+    sha256 = "sha256-O7a94UC7AB7MiTTpf68PWfim9anfYEWbvgsQsTV74VA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/database/pg_activity/default.nix b/pkgs/development/tools/database/pg_activity/default.nix
index f7e034a9a77..399c8801f77 100644
--- a/pkgs/development/tools/database/pg_activity/default.nix
+++ b/pkgs/development/tools/database/pg_activity/default.nix
@@ -2,14 +2,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "pg_activity";
-  version = "3.0.0";
+  version = "3.0.1";
   disabled = python3Packages.pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "dalibo";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-MJZS5+i3s5fTFcgw5zt3GeJKKZ/GS66scuUAW9Fu73A=";
+    sha256 = "sha256-YsHY2Hvr1aDKA+YOftc7iUi1qXDv6HW+jQtTQgQ5+M4=";
   };
 
   propagatedBuildInputs = with python3Packages; [
diff --git a/pkgs/development/tools/database/sqlfluff/default.nix b/pkgs/development/tools/database/sqlfluff/default.nix
index 9bd6dfd75c9..e4f4676f155 100644
--- a/pkgs/development/tools/database/sqlfluff/default.nix
+++ b/pkgs/development/tools/database/sqlfluff/default.nix
@@ -5,13 +5,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "sqlfluff";
-  version = "1.3.1";
+  version = "1.3.2";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-IUHV08X6U5GHuKsFh6yYetKX+nRf7C6PIXb+b7AD9po=";
+    hash = "sha256-mwGDSppOcpvwPtMNzElZtwYigIHhw3GUnza4ZXCCEvc=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/development/tools/mold/default.nix b/pkgs/development/tools/mold/default.nix
index 1d4a64d4467..d23a3790f12 100644
--- a/pkgs/development/tools/mold/default.nix
+++ b/pkgs/development/tools/mold/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mold";
-  version = "1.4.2";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "rui314";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-omi4vx8KDpgZ/y3MvE5c/9MxSLXIA4IHJAMue3XpfD8=";
+    hash = "sha256-mCuKNVWjll9+xYPR6DnwkzPxbn4gR+x+DaCCTI9BXiE=";
   };
 
   nativeBuildInputs = [ cmake ninja ];
diff --git a/pkgs/development/tools/pgloader/default.nix b/pkgs/development/tools/pgloader/default.nix
index 339009a50eb..c86c3eb0870 100644
--- a/pkgs/development/tools/pgloader/default.nix
+++ b/pkgs/development/tools/pgloader/default.nix
@@ -1,11 +1,11 @@
 { lib, stdenv, fetchurl, makeWrapper, sbcl_2_2_6, sqlite, freetds, libzip, curl, git, cacert, openssl }:
 stdenv.mkDerivation rec {
   pname = "pgloader";
-  version = "3.6.7";
+  version = "3.6.8";
 
   src = fetchurl {
-    url = "https://github.com/dimitri/pgloader/releases/download/v3.6.7/pgloader-bundle-3.6.7.tgz";
-    sha256 = "sha256-JfF2el0vJjDAyB2l3H4dLgEIgnmXlrCUVYKDpj2jM1Y=";
+    url = "https://github.com/dimitri/pgloader/releases/download/v3.6.8/pgloader-bundle-3.6.8.tgz";
+    sha256 = "sha256-h5vB+KOapbXsSVNIVWEsaanyczaCfl81+SXdiNmNboE=";
   };
 
   nativeBuildInputs = [ git makeWrapper ];
diff --git a/pkgs/os-specific/linux/cpuid/default.nix b/pkgs/os-specific/linux/cpuid/default.nix
index abe6f44f31a..73e38d885e7 100644
--- a/pkgs/os-specific/linux/cpuid/default.nix
+++ b/pkgs/os-specific/linux/cpuid/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "cpuid";
-  version = "20220812";
+  version = "20220927";
 
   src = fetchurl {
     url = "http://etallen.com/cpuid/${pname}-${version}.src.tar.gz";
-    sha256 = "sha256-O/aPuX2UcU+QdjzK2BDfjcX3/pwfmjZSQ2SR/XVBWr8=";
+    sha256 = "sha256-sykaiTRIJgKGgaIoBgUpIMDzSY0Jn/3OP2P1Z6HqQOw=";
   };
 
   # For pod2man during the build process.
diff --git a/pkgs/servers/amqp/rabbitmq-server/default.nix b/pkgs/servers/amqp/rabbitmq-server/default.nix
index 77e5cdaa4e6..b38a3147b58 100644
--- a/pkgs/servers/amqp/rabbitmq-server/default.nix
+++ b/pkgs/servers/amqp/rabbitmq-server/default.nix
@@ -25,6 +25,17 @@
 , nixosTests
 }:
 
+let
+  runtimePath = lib.makeBinPath ([
+    erlang
+    getconf # for getting memory limits
+    socat
+    procps
+    gnused
+    coreutils # used by helper scripts
+  ] ++ lib.optionals stdenv.isLinux [ systemd ]); # for systemd unit activation check
+in
+
 stdenv.mkDerivation rec {
   pname = "rabbitmq-server";
   version = "3.10.8";
@@ -48,15 +59,6 @@ stdenv.mkDerivation rec {
     export LANG=C.UTF-8 # fix elixir locale warning
   '';
 
-  runtimePath = lib.makeBinPath ([
-    erlang
-    getconf # for getting memory limits
-    socat
-    procps
-    gnused
-    coreutils # used by helper scripts
-  ] ++ lib.optionals stdenv.isLinux [ systemd ]); # for systemd unit activation check
-
   postInstall = ''
     # rabbitmq-env calls to sed/coreutils, so provide everything early
     sed -i $out/sbin/rabbitmq-env -e '2s|^|PATH=${runtimePath}\''${PATH:+:}\$PATH/\n|'
diff --git a/pkgs/servers/bloat/default.nix b/pkgs/servers/bloat/default.nix
index 2d0dbde74d5..f9239dbb180 100644
--- a/pkgs/servers/bloat/default.nix
+++ b/pkgs/servers/bloat/default.nix
@@ -6,12 +6,12 @@
 
 buildGoModule {
   pname = "bloat";
-  version = "unstable-2022-05-10";
+  version = "unstable-2022-09-23";
 
   src = fetchgit {
     url = "git://git.freesoftwareextremist.com/bloat";
-    rev = "1661219ab6e3c12b29d676d57ce452feb81d0dd9";
-    sha256 = "sha256-Vb0WTRYPv0+g0by+h09sDDMVCjRYF28PwbXJNkdX6NA=";
+    rev = "68698a9e1afce43ef807d6b5f892ca1c0f905b8a";
+    sha256 = "sha256-gxSHxMdiIWsJb/qM3W7Eon/ST15l2wkJqyjxEU8RlCQ=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/servers/monitoring/mimir/default.nix b/pkgs/servers/monitoring/mimir/default.nix
index 6e161b44b73..3a499716a88 100644
--- a/pkgs/servers/monitoring/mimir/default.nix
+++ b/pkgs/servers/monitoring/mimir/default.nix
@@ -1,13 +1,13 @@
 { lib, buildGoModule, fetchFromGitHub, nixosTests }:
 buildGoModule rec {
   pname = "mimir";
-  version = "2.3.0";
+  version = "2.3.1";
 
   src = fetchFromGitHub {
     rev = "${pname}-${version}";
     owner = "grafana";
     repo = pname;
-    sha256 = "sha256-lLrDgt4WYxyMkwjS8TLTy1agPAo/Z0BtqY9hIYSDyGI=";
+    sha256 = "sha256-2Gg2SYH2cqSKXePEfUAwW4AXpiMGso3FeGTmHRNxtaU=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/servers/monitoring/nagios/plugins/check_ssl_cert.nix b/pkgs/servers/monitoring/nagios/plugins/check_ssl_cert.nix
index e248e3fbbd1..7fd79a6e6f8 100644
--- a/pkgs/servers/monitoring/nagios/plugins/check_ssl_cert.nix
+++ b/pkgs/servers/monitoring/nagios/plugins/check_ssl_cert.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "check_ssl_cert";
-  version = "2.48.0";
+  version = "2.49.0";
 
   src = fetchFromGitHub {
     owner = "matteocorti";
     repo = "check_ssl_cert";
     rev = "v${version}";
-    hash = "sha256-uaDeg7Dph99NWN0pKHrffBYOOzN8/1fW2YBEE8vnYMs=";
+    hash = "sha256-V6NahQvHrDna7II6GbUadiq5IBrEVTW2EQ6+FxV5zQQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/pocketbase/default.nix b/pkgs/servers/pocketbase/default.nix
index d3da831851d..14c88e9d04f 100644
--- a/pkgs/servers/pocketbase/default.nix
+++ b/pkgs/servers/pocketbase/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "pocketbase";
-  version = "0.7.5";
+  version = "0.7.6";
 
   src = fetchFromGitHub {
     owner = "pocketbase";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-4UTAY7yGMYM84NNjzhnXNjPGyO2hOoINE925M4LLgJk=";
+    sha256 = "sha256-03CvpAATd8HSKaMY17Sl7v08xzTxrQsoBchkYZ5pz14=";
   };
 
-  vendorSha256 = "sha256-Ty06TegTT4BILgH0MpnxINxBQMW0zi0ItptHmDqKW1k=";
+  vendorSha256 = "sha256-i3CRba2HA7dOEh4PU1rNZUl05pZqIm946lIjP7ZcFEc=";
 
   # This is the released subpackage from upstream repo
   subPackages = [ "examples/base" ];
diff --git a/pkgs/servers/radarr/default.nix b/pkgs/servers/radarr/default.nix
index ceb6d270d13..9f5541adff4 100644
--- a/pkgs/servers/radarr/default.nix
+++ b/pkgs/servers/radarr/default.nix
@@ -9,14 +9,14 @@ let
   }."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
   hash = {
-    x64-linux_hash = "sha256-3oxCBg+lxN8eGaS1kmIK0kL2qUNOLHhLnkMPmPlZcyw=";
-    arm64-linux_hash = "sha256-OaCI2neL8bMFf/QuZEZXKuZgJBnUT+Q2XMChfSqF5Bc=";
-    x64-osx_hash = "sha256-vv3ds5BE2PDA94Hkr//MB0a7CF3dnk7r7wYF9SAzL48=";
+    x64-linux_hash = "sha256-kdY0RiZWrPCaXDGWhnJY2jGOO9h0WNRnT+CQ11l4How=";
+    arm64-linux_hash = "sha256-gG7r4G6iHLZPkjR43uD6s3b3mitTT2yfGxYdwPlI8D0=";
+    x64-osx_hash = "sha256-guqmzEMRytN2IJ907KW+rZq9cHT6oC3GyHzTyVyFU0w=";
   }."${arch}-${os}_hash";
 
 in stdenv.mkDerivation rec {
   pname = "radarr";
-  version = "4.1.0.6175";
+  version = "4.2.4.6635";
 
   src = fetchurl {
     url = "https://github.com/Radarr/Radarr/releases/download/v${version}/Radarr.master.${version}.${os}-core-${arch}.tar.gz";
diff --git a/pkgs/stdenv/generic/check-meta.nix b/pkgs/stdenv/generic/check-meta.nix
index 85a9c9c4d41..7b06692ac8c 100644
--- a/pkgs/stdenv/generic/check-meta.nix
+++ b/pkgs/stdenv/generic/check-meta.nix
@@ -285,6 +285,10 @@ let
     });
     timeout = int;
 
+    # Needed for Hydra to expose channel tarballs:
+    # https://github.com/NixOS/hydra/blob/53335323ae79ca1a42643f58e520b376898ce641/doc/manual/src/jobs.md#meta-fields
+    isHydraChannel = bool;
+
     # Weirder stuff that doesn't appear in the documentation?
     maxSilent = int;
     knownVulnerabilities = listOf str;
diff --git a/pkgs/tools/admin/boulder/default.nix b/pkgs/tools/admin/boulder/default.nix
index 1b6f85b3abc..83a209d6630 100644
--- a/pkgs/tools/admin/boulder/default.nix
+++ b/pkgs/tools/admin/boulder/default.nix
@@ -7,7 +7,7 @@
 
 buildGoModule rec {
   pname = "boulder";
-  version = "2022-09-19";
+  version = "2022-09-26";
 
   src = fetchFromGitHub {
     owner = "letsencrypt";
@@ -19,7 +19,7 @@ buildGoModule rec {
       git rev-parse --short=8 HEAD 2>/dev/null >$out/COMMIT
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
-    hash = "sha256-hiE6Cdpn/NVLAsTxw3EaIzbwRSpG/yYCsAAeBDCG6m8=";
+    hash = "sha256-/JOUBgTDb4wCathg3nnOnnXh+Q/Zpeegg5MuPOaHowE=";
   };
 
   vendorHash = null;
diff --git a/pkgs/tools/filesystems/gcsfuse/default.nix b/pkgs/tools/filesystems/gcsfuse/default.nix
index 4f1f4bfb8ea..3086a8c0a6e 100644
--- a/pkgs/tools/filesystems/gcsfuse/default.nix
+++ b/pkgs/tools/filesystems/gcsfuse/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "gcsfuse";
-  version = "0.41.6";
+  version = "0.41.7";
 
   src = fetchFromGitHub {
     owner = "googlecloudplatform";
     repo = "gcsfuse";
     rev = "v${version}";
-    sha256 = "sha256-yJVeR2e1i7f1LDhm415ukuC2OZRy1jS+/5oQ+fhhj8Q=";
+    sha256 = "sha256-hqT1X78g1Mg7xWHrVTwN41P+wgkrjfYrX2vHmwxZoCQ=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/tools/graphics/unpaper/default.nix b/pkgs/tools/graphics/unpaper/default.nix
index 9b8542a86bb..72c63d6cfd2 100644
--- a/pkgs/tools/graphics/unpaper/default.nix
+++ b/pkgs/tools/graphics/unpaper/default.nix
@@ -1,16 +1,52 @@
-{ lib, stdenv, fetchurl, buildPackages, pkg-config, ffmpeg_4 }:
+{ lib
+, stdenv
+, fetchurl
+
+# build
+, meson
+, ninja
+, pkg-config
+
+# docs
+, sphinx
+
+# runtime
+, buildPackages
+, ffmpeg_5
+
+# tests
+, nixosTests
+}:
 
 stdenv.mkDerivation rec {
   pname = "unpaper";
-  version = "6.1";
+  version = "7.0.0";
 
   src = fetchurl {
     url = "https://www.flameeyes.eu/files/${pname}-${version}.tar.xz";
-    sha256 = "0c5rbkxbmy9k8vxjh4cv0bgnqd3wqc99yzw215vkyjslvbsq8z13";
+    hash = "sha256-JXX7vybCJxnRy4grWWAsmQDH90cRisEwiD9jQZvkaoA=";
   };
 
-  nativeBuildInputs = [ pkg-config buildPackages.libxslt.bin ];
-  buildInputs = [ ffmpeg_4 ];
+  outputs = [
+    "out"
+    "man"
+  ];
+
+  nativeBuildInputs = [
+    buildPackages.libxslt.bin
+    meson
+    ninja
+    pkg-config
+    sphinx
+  ];
+
+  buildInputs = [
+    ffmpeg_5
+  ];
+
+  passthru.tests = {
+    inherit (nixosTests) paperless;
+  };
 
   meta = with lib; {
     homepage = "https://www.flameeyes.eu/projects/unpaper";
diff --git a/pkgs/tools/misc/asciinema-agg/default.nix b/pkgs/tools/misc/asciinema-agg/default.nix
new file mode 100644
index 00000000000..685afc2d66a
--- /dev/null
+++ b/pkgs/tools/misc/asciinema-agg/default.nix
@@ -0,0 +1,26 @@
+{ lib, rustPlatform, fetchFromGitHub, stdenv, Security }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "agg";
+  version = "1.3.0";
+
+  src = fetchFromGitHub {
+    owner = "asciinema";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "15j7smkjv2z9vd7drdq83g40j986ny39ai6y9rnai3iljsycyvgs";
+  };
+
+  cargoSha256 = "sha256-ORSYIRcvnKFkJxEjiTUSa1gkfmiQs3EAVOpXePVgBPQ=";
+
+  buildInputs = lib.optionals stdenv.isDarwin [
+    Security
+  ];
+
+  meta = with lib; {
+    description = "A command-line tool for generating animated GIF files from asciicast v2 files produced by asciinema terminal recorder";
+    homepage = "https://github.com/asciinema/agg";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ figsoda ];
+  };
+}
diff --git a/pkgs/tools/misc/octosql/default.nix b/pkgs/tools/misc/octosql/default.nix
index 8a31ab58fa8..2dbe6c7eb98 100644
--- a/pkgs/tools/misc/octosql/default.nix
+++ b/pkgs/tools/misc/octosql/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "octosql";
-  version = "0.9.3";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner  = "cube2222";
     repo   = pname;
     rev    = "v${version}";
-    sha256 = "sha256-Y6kKYW79415nCJkcIKQjcBQiFZrRCJ8If65lV9wmNFA=";
+    sha256 = "sha256-qeF34GBR/OtvWBN5mcLMJGzOI/3DzbScJVM0pvlTvyw=";
   };
 
   vendorSha256 = "sha256-ukNjLk1tTdw0bwXaYAEDuHfzxHuAX1xyqRqC6wmW/H4=";
diff --git a/pkgs/tools/networking/netbird/default.nix b/pkgs/tools/networking/netbird/default.nix
index 902b33e70e9..f9bff389805 100644
--- a/pkgs/tools/networking/netbird/default.nix
+++ b/pkgs/tools/networking/netbird/default.nix
@@ -14,13 +14,13 @@ let
 in
 buildGoModule rec {
   pname = "netbird";
-  version = "0.9.4";
+  version = "0.9.6";
 
   src = fetchFromGitHub {
     owner = "netbirdio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-x5TJChvpeiAPye9YkIMJYumvCUHULUVjC371ZoaHkUM=";
+    sha256 = "sha256-VNKVl1C14iZROl3JFHY7+8EYbgZTuoz5rVOOBqkmmo0=";
   };
 
   vendorSha256 = "sha256-VyYw8Hp2qWoRBeOFsgtxmvFN2cYzuDeYmWAwC/+vjI0=";
diff --git a/pkgs/tools/networking/snowflake/default.nix b/pkgs/tools/networking/snowflake/default.nix
index 5f42f912548..5118186c4de 100644
--- a/pkgs/tools/networking/snowflake/default.nix
+++ b/pkgs/tools/networking/snowflake/default.nix
@@ -2,12 +2,12 @@
 
 buildGoModule rec {
   pname = "snowflake";
-  version = "2.3.0";
+  version = "2.3.1";
 
   src = fetchgit {
     url = "https://git.torproject.org/pluggable-transports/${pname}";
     rev = "v${version}";
-    sha256 = "sha256-LQ9QIdj3id6bEzAItMGc3pJFylNP4har79VKUa9qo20=";
+    sha256 = "sha256-4/ZTLyST73krOL87am28TM+1mktchpoCSaASMqQl5e8=";
   };
 
   vendorSha256 = "sha256-a2Ng+D1I0v5odChM6XVVnNwea/0SOTOmdm2dqKaSU3s=";
diff --git a/pkgs/tools/networking/xxh/default.nix b/pkgs/tools/networking/xxh/default.nix
index 98632f5e2a0..c033c81afc0 100644
--- a/pkgs/tools/networking/xxh/default.nix
+++ b/pkgs/tools/networking/xxh/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonApplication rec{
   pname = "xxh";
-  version = "0.8.10";
+  version = "0.8.11";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -18,8 +18,8 @@ buildPythonApplication rec{
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
-    rev = version;
-    hash = "sha256-2RMzgIAhM//XReCFBGlTlXn9j4WQiM/k2pLxP2iPUy8=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-xZVQamTEQpwxKZxOOhQyaDP4fX2dAI1CTNL94tHuGIw=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/tools/security/cloudfox/default.nix b/pkgs/tools/security/cloudfox/default.nix
new file mode 100644
index 00000000000..b4781ba7c0b
--- /dev/null
+++ b/pkgs/tools/security/cloudfox/default.nix
@@ -0,0 +1,28 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "cloudfox";
+  version = "1.7.1";
+
+  src = fetchFromGitHub {
+    owner = "BishopFox";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-JwSXm75CC1GBbQ7kZJXyDXf2997owRaGcB2m7q+BrEs=";
+  };
+
+  vendorSha256 = "sha256-KrJR5YZxP6psHphY0BhYFu14PaDi5k1ngFfYPSzOYK4=";
+
+  # Some tests are failing because of wrong filename/path
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Tool for situational awareness of cloud penetration tests";
+    homepage = "https://github.com/BishopFox/cloudfox";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/tools/security/iaito/default.nix b/pkgs/tools/security/iaito/default.nix
index d8bfc9e4747..cd45f9a58b6 100644
--- a/pkgs/tools/security/iaito/default.nix
+++ b/pkgs/tools/security/iaito/default.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "iaito";
-  version = "5.7.2";
+  version = "5.7.4";
 
   src = fetchFromGitHub {
     owner = "radareorg";
     repo = pname;
     rev = version;
-    sha256 = "sha256-5/G5wfdc6aua90XLP3B7Ruy8F3NTXzWfQE6yVDZ0rX8=";
+    sha256 = "sha256-T9+YQQDcXHFogD7FVkippsde7+0bKodwwABCqrKjcH4=";
   };
 
   nativeBuildInputs = [ meson ninja pkg-config python3 qttools wrapQtAppsHook ];
diff --git a/pkgs/tools/system/gdu/default.nix b/pkgs/tools/system/gdu/default.nix
index 21052ecf663..b55d8636158 100644
--- a/pkgs/tools/system/gdu/default.nix
+++ b/pkgs/tools/system/gdu/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "gdu";
-  version = "5.18.1";
+  version = "5.19.0";
 
   src = fetchFromGitHub {
     owner = "dundee";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Bz7oiW8UEnin3Wd8nYrqk5WI7EbRHSCsoxpuWXzHK5c=";
+    sha256 = "sha256-876O7LdKqmg3oWNoboGId5jcdiGND1HyIMefy1uYu/g=";
   };
 
-  vendorSha256 = "sha256-rppVLeX1VDOW+eUHSM77DgY2KjOrUHdyqGWRAYRIbUE=";
+  vendorSha256 = "sha256-UP6IdJLc93gRP4vwKKOJl3sNt4sOFeYXjvwk8QM+D48=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/wayland/kanshi/default.nix b/pkgs/tools/wayland/kanshi/default.nix
index 0b906f0aa98..f372ee5dae7 100644
--- a/pkgs/tools/wayland/kanshi/default.nix
+++ b/pkgs/tools/wayland/kanshi/default.nix
@@ -1,23 +1,24 @@
 { lib
 , stdenv
-, fetchFromGitHub
+, fetchFromSourcehut
 , meson
 , ninja
 , pkg-config
 , scdoc
 , wayland
 , wayland-scanner
+, libvarlink
 }:
 
 stdenv.mkDerivation rec {
   pname = "kanshi";
-  version = "1.2.0";
+  version = "1.3.0";
 
-  src = fetchFromGitHub {
-    owner = "emersion";
+  src = fetchFromSourcehut {
+    owner = "~emersion";
     repo = "kanshi";
     rev = "v${version}";
-    sha256 = "sha256-RVMeS2qEjTYK6r7IwMeFSqfRpKR8di2eQXhewfhTnYI=";
+    sha256 = "kqTRJhLd9vLGAPO5U5cWeZgzWzne+0Cr4TIS0ciZSGk=";
   };
 
   strictDeps = true;
@@ -25,10 +26,10 @@ stdenv.mkDerivation rec {
     pkg-config
   ];
   nativeBuildInputs = [ meson ninja pkg-config scdoc wayland-scanner ];
-  buildInputs = [ wayland ];
+  buildInputs = [ wayland libvarlink ];
 
   meta = with lib; {
-    homepage = "https://github.com/emersion/kanshi";
+    homepage = "https://sr.ht/~emersion/kanshi";
     description = "Dynamic display configuration tool";
     longDescription = ''
       kanshi allows you to define output profiles that are automatically enabled
@@ -39,7 +40,7 @@ stdenv.mkDerivation rec {
       wlr-output-management protocol.
     '';
     license = licenses.mit;
-    maintainers = with maintainers; [ balsoft ];
+    maintainers = with maintainers; [ balsoft danielbarter ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index b1b034d5887..f4e36332fdf 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -140,14 +140,14 @@ with pkgs;
   nixosTests = import ../../nixos/tests/all-tests.nix {
     inherit pkgs;
     system = stdenv.hostPlatform.system;
-    callTest = t: t.test;
+    callTest = config: config.test;
   } // {
     # for typechecking of the scripts and evaluation of
     # the nodes, without running VMs.
     allDrivers = import ../../nixos/tests/all-tests.nix {
       inherit pkgs;
       system = stdenv.hostPlatform.system;
-      callTest = t: t.test.driver;
+      callTest = config: config.test.driver;
     };
   };
 
@@ -2092,6 +2092,10 @@ with pkgs;
 
   asciinema = callPackage ../tools/misc/asciinema {};
 
+  asciinema-agg = callPackage ../tools/misc/asciinema-agg {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
+
   asciinema-scenario = callPackage ../tools/misc/asciinema-scenario {};
 
   asciiquarium = callPackage ../applications/misc/asciiquarium {};
@@ -2366,6 +2370,8 @@ with pkgs;
 
   cloud-sql-proxy = callPackage ../tools/misc/cloud-sql-proxy { };
 
+  cloudfox = callPackage ../tools/security/cloudfox { };
+
   cloudsmith-cli = callPackage ../development/tools/cloudsmith-cli { };
 
   codeql = callPackage ../development/tools/analysis/codeql { };
@@ -7800,7 +7806,9 @@ with pkgs;
   ipfs = callPackage ../applications/networking/ipfs {
     openssl = openssl_1_1;
   };
-  ipfs-cluster = callPackage ../applications/networking/ipfs-cluster { };
+  ipfs-cluster = callPackage ../applications/networking/ipfs-cluster {
+    buildGoModule = buildGo119Module;
+  };
 
   ipfs-migrator-all-fs-repo-migrations = callPackage ../applications/networking/ipfs-migrator/all-migrations.nix { };
   ipfs-migrator-unwrapped = callPackage ../applications/networking/ipfs-migrator/unwrapped.nix { };
@@ -17330,6 +17338,8 @@ with pkgs;
 
   stm32flash = callPackage ../development/embedded/stm32/stm32flash { };
 
+  stm8flash = callPackage ../development/embedded/stm8/stm8flash { };
+
   strace = callPackage ../development/tools/misc/strace { };
 
   stylua = callPackage ../development/tools/stylua { };
@@ -23793,6 +23803,7 @@ with pkgs;
   rabbitmq-server = callPackage ../servers/amqp/rabbitmq-server {
     inherit (darwin.apple_sdk.frameworks) AppKit Carbon Cocoa;
     elixir = elixir_1_12;
+    erlang = erlang.override { opensslPackage = openssl_1_1; };
   };
 
   radicale2 = callPackage ../servers/radicale/2.x.nix { };
diff --git a/pkgs/top-level/haskell-packages.nix b/pkgs/top-level/haskell-packages.nix
index 8d512968a85..44ffc7335c3 100644
--- a/pkgs/top-level/haskell-packages.nix
+++ b/pkgs/top-level/haskell-packages.nix
@@ -8,8 +8,8 @@ let
     "ghc8102BinaryMinimal"
     "ghc8107Binary"
     "ghc8107BinaryMinimal"
-    "ghc922Binary"
-    "ghc922BinaryMinimal"
+    "ghc924Binary"
+    "ghc924BinaryMinimal"
     "ghcjs"
     "ghcjs810"
     "integer-simple"
@@ -86,10 +86,10 @@ in {
       minimal = true;
     };
 
-    ghc922Binary = callPackage ../development/compilers/ghc/9.2.2-binary.nix {
+    ghc924Binary = callPackage ../development/compilers/ghc/9.2.4-binary.nix {
       llvmPackages = pkgs.llvmPackages_12;
     };
-    ghc922BinaryMinimal = callPackage ../development/compilers/ghc/9.2.2-binary.nix {
+    ghc924BinaryMinimal = callPackage ../development/compilers/ghc/9.2.4-binary.nix {
       llvmPackages = pkgs.llvmPackages_12;
       minimal = true;
     };
@@ -192,12 +192,15 @@ in {
     ghc94 = ghc942;
     ghcHEAD = callPackage ../development/compilers/ghc/head.nix {
       bootPkgs =
-        if stdenv.isAarch64 || stdenv.isAarch32 then
-          packages.ghc922BinaryMinimal
+        # For GHC 9.2.3 and 9.2.4 no armv7l bindists are available.
+        if stdenv.hostPlatform.isAarch32 then
+          packages.ghc924
         else if stdenv.hostPlatform.isPower64 && stdenv.hostPlatform.isLittleEndian then
           packages.ghc924
+        else if stdenv.isAarch64 then
+          packages.ghc924BinaryMinimal
         else
-          packages.ghc922Binary;
+          packages.ghc924Binary;
       inherit (buildPackages.python3Packages) sphinx;
       # Need to use apple's patched xattr until
       # https://github.com/xattr/xattr/issues/44 and
@@ -272,15 +275,15 @@ in {
       compilerConfig = callPackage ../development/haskell-modules/configuration-ghc-8.10.x.nix { };
       packageSetConfig = bootstrapPackageSet;
     };
-    ghc922Binary = callPackage ../development/haskell-modules {
-      buildHaskellPackages = bh.packages.ghc922Binary;
-      ghc = bh.compiler.ghc922Binary;
+    ghc924Binary = callPackage ../development/haskell-modules {
+      buildHaskellPackages = bh.packages.ghc924Binary;
+      ghc = bh.compiler.ghc924Binary;
       compilerConfig = callPackage ../development/haskell-modules/configuration-ghc-9.2.x.nix { };
       packageSetConfig = bootstrapPackageSet;
     };
-    ghc922BinaryMinimal = callPackage ../development/haskell-modules {
-      buildHaskellPackages = bh.packages.ghc922BinaryMinimal;
-      ghc = bh.compiler.ghc922BinaryMinimal;
+    ghc924BinaryMinimal = callPackage ../development/haskell-modules {
+      buildHaskellPackages = bh.packages.ghc924BinaryMinimal;
+      ghc = bh.compiler.ghc924BinaryMinimal;
       compilerConfig = callPackage ../development/haskell-modules/configuration-ghc-9.2.x.nix { };
       packageSetConfig = bootstrapPackageSet;
     };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 01bf51a6de3..a372504ebba 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6353,7 +6353,9 @@ in {
 
   ocifs = callPackage ../development/python-modules/ocifs { };
 
-  ocrmypdf = callPackage ../development/python-modules/ocrmypdf { };
+  ocrmypdf = callPackage ../development/python-modules/ocrmypdf {
+    tesseract = pkgs.tesseract5;
+  };
 
   od = callPackage ../development/python-modules/od { };
 
@@ -6395,6 +6397,13 @@ in {
 
   onnx = callPackage ../development/python-modules/onnx { };
 
+  onnxconverter-common = callPackage ../development/python-modules/onnxconverter-common { };
+
+  onnxruntime = (toPythonModule (pkgs.onnxruntime.override {
+    python3Packages = self;
+    pythonSupport = true;
+  })).python;
+
   onvif-zeep-async = callPackage ../development/python-modules/onvif-zeep-async { };
 
   oocsi = callPackage ../development/python-modules/oocsi { };
@@ -10179,6 +10188,8 @@ in {
 
   skidl = callPackage ../development/python-modules/skidl { };
 
+  skl2onnx = callPackage ../development/python-modules/skl2onnx { };
+
   sklearn-deap = callPackage ../development/python-modules/sklearn-deap { };
 
   skodaconnect = callPackage ../development/python-modules/skodaconnect { };