Merge staging-next into staging

95 files changed, 1458 insertions, 594 deletions

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index acc04a533f6..e776ef0d0c0 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -845,6 +845,16 @@
     githubId = 11699655;
     name = "Stanislas Lange";
   };
+  AngryAnt = {
+    name = "Emil Johansen";
+    email = "git@eej.dk";
+    matrix = "@angryant:envs.net";
+    github = "AngryAnt";
+    githubId = 102513;
+    keys = [{
+      fingerprint = "B7B7 582E 564E 789B FCB8  71AB 0C6D FE2F B234 534A";
+    }];
+  };
   anhdle14 = {
     name = "Le Anh Duc";
     email = "anhdle14@icloud.com";
@@ -14720,4 +14730,10 @@
     github = "dfithian";
     githubId = 8409320;
   };
+  nikstur = {
+    email = "nikstur@outlook.com";
+    name = "nikstur";
+    github = "nikstur";
+    githubId = 61635709;
+  };
 }
diff --git a/nixos/modules/installer/tools/nixos-generate-config.pl b/nixos/modules/installer/tools/nixos-generate-config.pl
index 0e6320e4695..212b2b3cd23 100644
--- a/nixos/modules/installer/tools/nixos-generate-config.pl
+++ b/nixos/modules/installer/tools/nixos-generate-config.pl
@@ -85,7 +85,7 @@ sub debug {
 
 
 # nixpkgs.system
-my ($status, @systemLines) = runCommand("nix-instantiate --impure --eval --expr builtins.currentSystem");
+my ($status, @systemLines) = runCommand("@nixInstantiate@ --impure --eval --expr builtins.currentSystem");
 if ($status != 0 || join("", @systemLines) =~ /error/) {
     die "Failed to retrieve current system type from nix.\n";
 }
diff --git a/nixos/modules/installer/tools/tools.nix b/nixos/modules/installer/tools/tools.nix
index 04be272742c..8719a509d64 100644
--- a/nixos/modules/installer/tools/tools.nix
+++ b/nixos/modules/installer/tools/tools.nix
@@ -34,6 +34,7 @@ let
     name = "nixos-generate-config";
     src = ./nixos-generate-config.pl;
     perl = "${pkgs.perl.withPackages (p: [ p.FileSlurp ])}/bin/perl";
+    nixInstantiate = "${pkgs.nix}/bin/nix-instantiate";
     detectvirt = "${config.systemd.package}/bin/systemd-detect-virt";
     btrfs = "${pkgs.btrfs-progs}/bin/btrfs";
     inherit (config.system.nixos-generate-config) configuration desktopConfiguration;
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 82c0b5d74de..3010a213705 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1088,6 +1088,7 @@
   ./services/web-apps/nifi.nix
   ./services/web-apps/node-red.nix
   ./services/web-apps/phylactery.nix
+  ./services/web-apps/onlyoffice.nix
   ./services/web-apps/pict-rs.nix
   ./services/web-apps/peertube.nix
   ./services/web-apps/plantuml-server.nix
diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix
index ce18af9fbc9..a80312367d8 100644
--- a/nixos/modules/security/pam.nix
+++ b/nixos/modules/security/pam.nix
@@ -611,7 +611,6 @@ let
             session optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so
           '' +
           optionalString cfg.pamMount ''
-            session [success=1 default=ignore] ${pkgs.pam}/lib/security/pam_succeed_if.so service = systemd-user quiet
             session optional ${pkgs.pam_mount}/lib/security/pam_mount.so disable_interactive
           '' +
           optionalString use_ldap ''
diff --git a/nixos/modules/services/databases/openldap.nix b/nixos/modules/services/databases/openldap.nix
index 5006a3065e9..a6a43e8dab9 100644
--- a/nixos/modules/services/databases/openldap.nix
+++ b/nixos/modules/services/databases/openldap.nix
@@ -227,7 +227,7 @@ in {
     };
   };
 
-  meta.maintainers = with lib.maintainers; [ mic92 kwohlfahrt ];
+  meta.maintainers = with lib.maintainers; [ kwohlfahrt ];
 
   config = let
     dbSettings = mapAttrs' (name: { attrs, ... }: nameValuePair attrs.olcSuffix attrs)
diff --git a/nixos/modules/services/web-apps/lemmy.nix b/nixos/modules/services/web-apps/lemmy.nix
index 7cd2357c455..15e616c5d5e 100644
--- a/nixos/modules/services/web-apps/lemmy.nix
+++ b/nixos/modules/services/web-apps/lemmy.nix
@@ -164,7 +164,7 @@ in
 
         wantedBy = [ "multi-user.target" ];
 
-        after = [ "pict-rs.service " ] ++ lib.optionals cfg.settings.database.createLocally [ "lemmy-postgresql.service" ];
+        after = [ "pict-rs.service" ] ++ lib.optionals cfg.settings.database.createLocally [ "lemmy-postgresql.service" ];
 
         requires = lib.optionals cfg.settings.database.createLocally [ "lemmy-postgresql.service" ];
 
diff --git a/nixos/modules/services/web-apps/onlyoffice.nix b/nixos/modules/services/web-apps/onlyoffice.nix
new file mode 100644
index 00000000000..ce6a3e835e3
--- /dev/null
+++ b/nixos/modules/services/web-apps/onlyoffice.nix
@@ -0,0 +1,288 @@
+{ lib, config, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.onlyoffice;
+in
+{
+  options.services.onlyoffice = {
+    enable = mkEnableOption "OnlyOffice DocumentServer";
+
+    enableExampleServer = mkEnableOption "OnlyOffice example server";
+
+    hostname = mkOption {
+      type = types.str;
+      default = "localhost";
+      description = "FQDN for the onlyoffice instance.";
+    };
+
+    jwtSecretFile = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = ''
+        Path to a file that contains the secret to sign web requests using JSON Web Tokens.
+        If left at the default value null signing is disabled.
+      '';
+    };
+
+    package = mkOption {
+      type = types.package;
+      default = pkgs.onlyoffice-documentserver;
+      defaultText = "pkgs.onlyoffice-documentserver";
+      description = "Which package to use for the OnlyOffice instance.";
+    };
+
+    port = mkOption {
+      type = types.port;
+      default = 8000;
+      description = "Port the OnlyOffice DocumentServer should listens on.";
+    };
+
+    examplePort = mkOption {
+      type = types.port;
+      default = null;
+      description = "Port the OnlyOffice Example server should listens on.";
+    };
+
+    postgresHost = mkOption {
+      type = types.str;
+      default = "/run/postgresql";
+      description = "The Postgresql hostname or socket path OnlyOffice should connect to.";
+    };
+
+    postgresName = mkOption {
+      type = types.str;
+      default = "onlyoffice";
+      description = "The name of databse OnlyOffice should user.";
+    };
+
+    postgresPasswordFile = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = ''
+        Path to a file that contains the password OnlyOffice should use to connect to Postgresql.
+        Unused when using socket authentication.
+      '';
+    };
+
+    postgresUser = mkOption {
+      type = types.str;
+      default = "onlyoffice";
+      description = ''
+        The username OnlyOffice should use to connect to Postgresql.
+        Unused when using socket authentication.
+      '';
+    };
+
+    rabbitmqUrl = mkOption {
+      type = types.str;
+      default = "amqp://guest:guest@localhost:5672";
+      description = "The Rabbitmq in amqp URI style OnlyOffice should connect to.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services = {
+      nginx = {
+        enable = mkDefault true;
+        # misses text/csv, font/ttf, application/x-font-ttf, application/rtf, application/wasm
+        recommendedGzipSettings = mkDefault true;
+        recommendedProxySettings = mkDefault true;
+
+        upstreams = {
+          # /etc/nginx/includes/http-common.conf
+          onlyoffice-docservice = {
+            servers = { "localhost:${toString cfg.port}" = { }; };
+          };
+          onlyoffice-example = lib.mkIf cfg.enableExampleServer {
+            servers = { "localhost:${toString cfg.examplePort}" = { }; };
+          };
+        };
+
+        virtualHosts.${cfg.hostname} = {
+          locations = {
+            # /etc/nginx/includes/ds-docservice.conf
+            "~ ^(\/[\d]+\.[\d]+\.[\d]+[\.|-][\d]+)?\/(web-apps\/apps\/api\/documents\/api\.js)$".extraConfig = ''
+              expires -1;
+              alias ${cfg.package}/var/www/onlyoffice/documentserver/$2;
+            '';
+            "~ ^(\/[\d]+\.[\d]+\.[\d]+[\.|-][\d]+)?\/(web-apps)(\/.*\.json)$".extraConfig = ''
+              expires 365d;
+              error_log /dev/null crit;
+              alias ${cfg.package}/var/www/onlyoffice/documentserver/$2$3;
+            '';
+            "~ ^(\/[\d]+\.[\d]+\.[\d]+[\.|-][\d]+)?\/(sdkjs-plugins)(\/.*\.json)$".extraConfig = ''
+              expires 365d;
+              error_log /dev/null crit;
+              alias ${cfg.package}/var/www/onlyoffice/documentserver/$2$3;
+            '';
+            "~ ^(\/[\d]+\.[\d]+\.[\d]+[\.|-][\d]+)?\/(web-apps|sdkjs|sdkjs-plugins|fonts)(\/.*)$".extraConfig = ''
+              expires 365d;
+              alias ${cfg.package}/var/www/onlyoffice/documentserver/$2$3;
+            '';
+            "~* ^(\/cache\/files.*)(\/.*)".extraConfig = ''
+              alias /var/lib/onlyoffice/documentserver/App_Data$1;
+              add_header Content-Disposition "attachment; filename*=UTF-8''$arg_filename";
+
+              set $secret_string verysecretstring;
+              secure_link $arg_md5,$arg_expires;
+              secure_link_md5 "$secure_link_expires$uri$secret_string";
+
+              if ($secure_link = "") {
+                return 403;
+              }
+
+              if ($secure_link = "0") {
+                return 410;
+              }
+            '';
+            "~* ^(\/[\d]+\.[\d]+\.[\d]+[\.|-][\d]+)?\/(internal)(\/.*)$".extraConfig = ''
+              allow 127.0.0.1;
+              deny all;
+              proxy_pass http://onlyoffice-docservice/$2$3;
+            '';
+            "~* ^(\/[\d]+\.[\d]+\.[\d]+[\.|-][\d]+)?\/(info)(\/.*)$".extraConfig = ''
+              allow 127.0.0.1;
+              deny all;
+              proxy_pass http://onlyoffice-docservice/$2$3;
+            '';
+            "/".extraConfig = ''
+              proxy_pass http://onlyoffice-docservice;
+            '';
+            "~ ^(\/[\d]+\.[\d]+\.[\d]+[\.|-][\d]+)?(\/doc\/.*)".extraConfig = ''
+              proxy_pass http://onlyoffice-docservice$2;
+              proxy_http_version 1.1;
+            '';
+            "/${cfg.package.version}/".extraConfig = ''
+              proxy_pass http://onlyoffice-docservice/;
+            '';
+            "~ ^(\/[\d]+\.[\d]+\.[\d]+[\.|-][\d]+)?\/(dictionaries)(\/.*)$".extraConfig = ''
+              expires 365d;
+              alias ${cfg.package}/var/www/onlyoffice/documentserver/$2$3;
+            '';
+            # /etc/nginx/includes/ds-example.conf
+            "~ ^(\/welcome\/.*)$".extraConfig = ''
+              expires 365d;
+              alias ${cfg.package}/var/www/onlyoffice/documentserver-example$1;
+              index docker.html;
+            '';
+            "/example/".extraConfig = lib.mkIf cfg.enableExampleServer ''
+              proxy_pass http://onlyoffice-example/;
+              proxy_set_header X-Forwarded-Path /example;
+            '';
+          };
+          extraConfig = ''
+            rewrite ^/$ /welcome/ redirect;
+            rewrite ^\/OfficeWeb(\/apps\/.*)$ /${cfg.package.version}/web-apps$1 redirect;
+            rewrite ^(\/web-apps\/apps\/(?!api\/).*)$ /${cfg.package.version}$1 redirect;
+
+            # based on https://github.com/ONLYOFFICE/document-server-package/blob/master/common/documentserver/nginx/includes/http-common.conf.m4#L29-L34
+            # without variable indirection and correct variable names
+            proxy_set_header Host $host;
+            proxy_set_header X-Forwarded-Host $host;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            # required for CSP to take effect
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            # required for websocket
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+          '';
+        };
+      };
+
+      rabbitmq.enable = lib.mkDefault true;
+
+      postgresql = {
+        enable = lib.mkDefault true;
+        ensureDatabases = [ "onlyoffice" ];
+        ensureUsers = [{
+          name = "onlyoffice";
+          ensurePermissions = { "DATABASE \"onlyoffice\"" = "ALL PRIVILEGES"; };
+        }];
+      };
+    };
+
+    systemd.services = {
+      onlyoffice-converter = {
+        description = "onlyoffice converter";
+        after = [ "network.target" "onlyoffice-docservice.service" "postgresql.service" ];
+        requires = [ "network.target" "onlyoffice-docservice.service" "postgresql.service" ];
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          ExecStart = "${cfg.package.fhs}/bin/onlyoffice-wrapper FileConverter/converter /run/onlyoffice/config";
+          Group = "onlyoffice";
+          Restart = "always";
+          RuntimeDirectory = "onlyoffice";
+          StateDirectory = "onlyoffice";
+          Type = "simple";
+          User = "onlyoffice";
+        };
+      };
+
+      onlyoffice-docservice =
+        let
+          onlyoffice-prestart = pkgs.writeShellScript "onlyoffice-prestart" ''
+            PATH=$PATH:${lib.makeBinPath (with pkgs; [ jq moreutils config.services.postgresql.package ])}
+            umask 077
+            mkdir -p /run/onlyoffice/config/ /var/lib/onlyoffice/documentserver/sdkjs/{slide/themes,common}/ /var/lib/onlyoffice/documentserver/{fonts,server/FileConverter/bin}/
+            cp -r ${cfg.package}/etc/onlyoffice/documentserver/* /run/onlyoffice/config/
+            chmod u+w /run/onlyoffice/config/default.json
+
+            cp /run/onlyoffice/config/default.json{,.orig}
+
+            # for a mapping of environment variables from the docker container to json options see
+            # https://github.com/ONLYOFFICE/Docker-DocumentServer/blob/master/run-document-server.sh
+            jq '
+              .services.CoAuthoring.server.port = ${toString cfg.port} |
+              .services.CoAuthoring.sql.dbHost = "${cfg.postgresHost}" |
+              .services.CoAuthoring.sql.dbName = "${cfg.postgresName}" |
+            ${lib.optionalString (cfg.postgresPasswordFile != null) ''
+              .services.CoAuthoring.sql.dbPass = "'"$(cat ${cfg.postgresPasswordFile})"'" |
+            ''}
+              .services.CoAuthoring.sql.dbUser = "${cfg.postgresUser}" |
+            ${lib.optionalString (cfg.jwtSecretFile != null) ''
+              .services.CoAuthoring.token.enable.browser = true |
+              .services.CoAuthoring.token.enable.request.inbox = true |
+              .services.CoAuthoring.token.enable.request.outbox = true |
+              .services.CoAuthoring.secret.inbox.string = "'"$(cat ${cfg.jwtSecretFile})"'" |
+              .services.CoAuthoring.secret.outbox.string = "'"$(cat ${cfg.jwtSecretFile})"'" |
+              .services.CoAuthoring.secret.session.string = "'"$(cat ${cfg.jwtSecretFile})"'" |
+            ''}
+              .rabbitmq.url = "${cfg.rabbitmqUrl}"
+              ' /run/onlyoffice/config/default.json | sponge /run/onlyoffice/config/default.json
+
+            if ! psql -d onlyoffice -c "SELECT 'task_result'::regclass;" >/dev/null; then
+              psql -f ${cfg.package}/var/www/onlyoffice/documentserver/server/schema/postgresql/createdb.sql
+            fi
+          '';
+        in
+        {
+          description = "onlyoffice documentserver";
+          after = [ "network.target" "postgresql.service" ];
+          requires = [ "postgresql.service" ];
+          wantedBy = [ "multi-user.target" ];
+          serviceConfig = {
+            ExecStart = "${cfg.package.fhs}/bin/onlyoffice-wrapper DocService/docservice /run/onlyoffice/config";
+            ExecStartPre = onlyoffice-prestart;
+            Group = "onlyoffice";
+            Restart = "always";
+            RuntimeDirectory = "onlyoffice";
+            StateDirectory = "onlyoffice";
+            Type = "simple";
+            User = "onlyoffice";
+          };
+        };
+    };
+
+    users.users = {
+      onlyoffice = {
+        description = "OnlyOffice Service";
+        group = "onlyoffice";
+        isSystemUser = true;
+      };
+    };
+
+    users.groups.onlyoffice = { };
+  };
+}
diff --git a/nixos/modules/system/boot/systemd/user.nix b/nixos/modules/system/boot/systemd/user.nix
index 0b1e6277c2f..edfff5abaa9 100644
--- a/nixos/modules/system/boot/systemd/user.nix
+++ b/nixos/modules/system/boot/systemd/user.nix
@@ -145,6 +145,10 @@ in {
       { # Ensure that pam_systemd gets included. This is special-cased
         # in systemd to provide XDG_RUNTIME_DIR.
         startSession = true;
+        # Disable pam_mount in systemd-user to prevent it from being called
+        # multiple times during login, because it will prevent pam_mount from
+        # unmounting the previously mounted volumes.
+        pamMount = false;
       };
 
     # Some overrides to upstream units.
diff --git a/pkgs/applications/audio/musikcube/0001-apple-cmake.patch b/pkgs/applications/audio/musikcube/0001-apple-cmake.patch
deleted file mode 100644
index 3c4630af4aa..00000000000
--- a/pkgs/applications/audio/musikcube/0001-apple-cmake.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-diff --git a/src/musikcube/CMakeLists.txt b/src/musikcube/CMakeLists.txt
-index f42748aa..ae339946 100644
---- a/src/musikcube/CMakeLists.txt
-+++ b/src/musikcube/CMakeLists.txt
-@@ -98,9 +98,6 @@ else()
- endif()
- 
- if (APPLE)
--    message(STATUS "[ncurses] detected Darwin, linking statically")
--    set(CURSES_LIBRARY_NAME "lib${CURSES_LIBRARY_NAME}.a")
--    set(PANEL_LIBRARY_NAME "lib${PANEL_LIBRARY_NAME}.a")
- else()
-     message(STATUS "[ncurses] not Darwin! will attempt to link against libtinfo")
-     find_library(LIBTINFO NAMES tinfo)
diff --git a/pkgs/applications/audio/musikcube/default.nix b/pkgs/applications/audio/musikcube/default.nix
index 0894a6410d8..273b62401e8 100644
--- a/pkgs/applications/audio/musikcube/default.nix
+++ b/pkgs/applications/audio/musikcube/default.nix
@@ -9,6 +9,8 @@
 , lame
 , libev
 , libmicrohttpd
+, libopenmpt
+, mpg123
 , ncurses
 , lib
 , stdenv
@@ -25,25 +27,25 @@
 
 stdenv.mkDerivation rec {
   pname = "musikcube";
-  version = "0.97.0";
+  version = "0.98.0";
 
   src = fetchFromGitHub {
     owner = "clangen";
     repo = pname;
     rev = version;
-    sha256 = "sha256-W9Ng1kqai5qhaDs5KWg/1sOTIAalBXLng1MG8sl/ZOg=";
+    sha256 = "sha256-bnwOxEcvRXWPuqtkv8YlpclvH/6ZtQvyvHy4mqJCwik=";
   };
 
-  patches = [
-    # Fix pending upstream inclusion for ncurses-6.3 support:
-    #  https://github.com/clangen/musikcube/pull/474
-    (fetchpatch {
-      name = "ncurses-6.3.patch";
-      url = "https://github.com/clangen/musikcube/commit/1240720e27232fdb199a4da93ca6705864442026.patch";
-      sha256 = "0bhjgwnj6d24wb1m9xz1vi1k9xk27arba1absjbcimggn54pinid";
-    })
-    ./0001-apple-cmake.patch
-  ];
+  patches = []
+    ++ lib.optionals stdenv.isDarwin [
+      # Fix pending upstream inclusion for Darwin nixpkgs builds:
+      # https://github.com/clangen/musikcube/pull/531
+      (fetchpatch {
+        name = "darwin-build.patch";
+        url = "https://github.com/clangen/musikcube/commit/9077bb9fa6ddfe93ebb14bb8feebc8a0ef9b7ee4.patch";
+        sha256 = "sha256-Am9AGKDGMN5z+JJFJKdsBLrHf2neHFovgF/8I5EXLDA=";
+      })
+    ];
 
   nativeBuildInputs = [
     cmake
@@ -58,6 +60,8 @@ stdenv.mkDerivation rec {
     lame
     libev
     libmicrohttpd
+    libopenmpt
+    mpg123
     ncurses
     taglib
   ] ++ lib.optionals systemdSupport [
diff --git a/pkgs/applications/audio/surge/default.nix b/pkgs/applications/audio/surge/default.nix
index 849b07d67e1..f1d8600ed01 100644
--- a/pkgs/applications/audio/surge/default.nix
+++ b/pkgs/applications/audio/surge/default.nix
@@ -1,6 +1,22 @@
-{ stdenv, lib, fetchurl, fetchFromGitHub, cmake, git, pkg-config, python3
-, cairo, libsndfile, libxcb, libxkbcommon, xcbutil, xcbutilcursor, xcbutilkeysyms, zenity
-, curl, rsync
+{ stdenv
+, lib
+, fetchurl
+, fetchpatch
+, fetchFromGitHub
+, cmake
+, git
+, pkg-config
+, python3
+, cairo
+, libsndfile
+, libxcb
+, libxkbcommon
+, xcbutil
+, xcbutilcursor
+, xcbutilkeysyms
+, zenity
+, curl
+, rsync
 }:
 
 stdenv.mkDerivation rec {
@@ -21,12 +37,43 @@ stdenv.mkDerivation rec {
     rev = "afc591cc06d9adc3dc8dc515a55c66873fa10296";
     sha256 = "1wqv86l70nwlrb10n47rib80f47a96j9qqg8w5dv46ys1sq2nz7z";
   };
-  nativeBuildInputs = [ cmake git pkg-config python3 ];
-  buildInputs = [ cairo libsndfile libxcb libxkbcommon xcbutil xcbutilcursor xcbutilkeysyms zenity curl rsync ];
+
+  patches = [
+    # Fix build error due to newer glibc version by upgrading lib "catch 2"
+    # Issue: https://github.com/surge-synthesizer/surge/pull/4843
+    # Patch: https://github.com/surge-synthesizer/surge/pull/4845
+    (fetchpatch {
+      url = "https://github.com/surge-synthesizer/surge/commit/7a552038bab4b000d188ae425aa97963dc91db17.patch";
+      sha256 = "sha256-5Flf0uJqEK6e+sadB+vr6phdvvdZYXcFFfm4ywhAeW0=";
+      name = "glibc_build_fix.patch";
+    })
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    git
+    pkg-config
+    python3
+  ];
+
+  buildInputs = [
+    cairo
+    libsndfile
+    libxcb
+    libxkbcommon
+    xcbutil
+    xcbutilcursor
+    xcbutilkeysyms
+    zenity
+    curl
+    rsync
+  ];
 
   postPatch = ''
-    substituteInPlace src/common/SurgeStorage.cpp --replace "/usr/share/Surge" "$out/share/surge"
-    substituteInPlace src/linux/UserInteractionsLinux.cpp --replace '"zenity' '"${zenity}/bin/zenity'
+    substituteInPlace src/common/SurgeStorage.cpp \
+      --replace "/usr/share/Surge" "$out/share/surge"
+    substituteInPlace src/linux/UserInteractionsLinux.cpp \
+      --replace '"zenity' '"${zenity}/bin/zenity'
     patchShebangs scripts/linux/
     cp -r $extraContent/Skins/ resources/data/skins
   '';
@@ -38,6 +85,7 @@ stdenv.mkDerivation rec {
   '';
 
   doInstallCheck = true;
+
   installCheckPhase = ''
     export HOME=$(mktemp -d)
     export SURGE_DISABLE_NETWORK_TESTS=TRUE
@@ -45,7 +93,10 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    description = "LV2 & VST3 synthesizer plug-in (previously released as Vember Audio Surge)";
+    description = ''
+      LV2 & VST3 synthesizer plug-in (previously released as Vember Audio
+      Surge)
+    '';
     homepage = "https://surge-synthesizer.github.io";
     license = licenses.gpl3;
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/blockchains/framesh/default.nix b/pkgs/applications/blockchains/framesh/default.nix
index 2acc88fc93e..098d56ec4a7 100644
--- a/pkgs/applications/blockchains/framesh/default.nix
+++ b/pkgs/applications/blockchains/framesh/default.nix
@@ -2,10 +2,10 @@
 
 let
   pname = "framesh";
-  version = "0.5.0-beta.20";
+  version = "0.5.0-beta.21";
   src = fetchurl {
     url = "https://github.com/floating/frame/releases/download/v${version}/Frame-${version}.AppImage";
-    sha256 = "sha256-4PU3f5e9NJYnP49nVtCjbGXxWJDCJIArzuaLsWB3Cx0=";
+    sha256 = "sha256-rWZ7oC74qrylNPIfBzHnNMcsYjccGL2zeXFab9OwBNA=";
   };
 
   appimageContents = appimageTools.extractType2 {
diff --git a/pkgs/applications/editors/nvpy/default.nix b/pkgs/applications/editors/nvpy/default.nix
index 99e49925767..cc5f60984c9 100644
--- a/pkgs/applications/editors/nvpy/default.nix
+++ b/pkgs/applications/editors/nvpy/default.nix
@@ -3,14 +3,14 @@
 let
   pythonPackages = python3Packages;
 in pythonPackages.buildPythonApplication rec {
-  version = "2.1.0";
+  version = "2.2.0";
   pname = "nvpy";
 
   src = fetchFromGitHub {
     owner = "cpbotha";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "02njvybd8yaqdnc5ghwrm8225z57gg4w7rhmx3w5jqzh16ld4mhh";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-eWvD1k0wbzo0G46/LEOlHl1wLvc4JHLL1fg6wuCHiQY=";
   };
 
 
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 73eea5bd34e..f86b4372fc0 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -4286,7 +4286,7 @@ final: prev:
     pname = "marks.nvim";
     version = "2022-05-13";
     src = fetchFromGitHub {
-      owner = "chentau";
+      owner = "chentoast";
       repo = "marks.nvim";
       rev = "56cfa45f9c20373ed90bc4271eae17ee0d452bae";
       sha256 = "0qc452ikyrrx28by0awm9jggv05zcph95kygjya1085g9win87l4";
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 26666c83595..844740160e4 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -358,7 +358,7 @@ https://github.com/alvarosevilla95/luatab.nvim/,,
 https://github.com/rktjmp/lush.nvim/,,
 https://github.com/mkasa/lushtags/,,
 https://github.com/iamcco/markdown-preview.nvim/,,
-https://github.com/chentau/marks.nvim/,,
+https://github.com/chentoast/marks.nvim/,,
 https://github.com/vim-scripts/matchit.zip/,,
 https://github.com/marko-cerovac/material.nvim/,,
 https://github.com/vim-scripts/mayansmoke/,,
diff --git a/pkgs/applications/graphics/hydrus/default.nix b/pkgs/applications/graphics/hydrus/default.nix
index d44ef1f9cf5..698872f4a8f 100644
--- a/pkgs/applications/graphics/hydrus/default.nix
+++ b/pkgs/applications/graphics/hydrus/default.nix
@@ -10,14 +10,14 @@
 
 python3Packages.buildPythonPackage rec {
   pname = "hydrus";
-  version = "491";
+  version = "492";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "hydrusnetwork";
     repo = "hydrus";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-ceKawn2jyfZPP4HzhkB1jIQoStCPRO/Ni/+Ys1R2FJQ=";
+    sha256 = "sha256-KtuHPKVwk6nRQ5lqHxRgm7k7DfcGeRAzR/kkHVMizDM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/graphics/jpegoptim/default.nix b/pkgs/applications/graphics/jpegoptim/default.nix
index 6095d81c528..95ea902b5e6 100644
--- a/pkgs/applications/graphics/jpegoptim/default.nix
+++ b/pkgs/applications/graphics/jpegoptim/default.nix
@@ -1,12 +1,14 @@
-{ lib, stdenv, fetchurl, libjpeg }:
+{ lib, stdenv, fetchFromGitHub, libjpeg }:
 
 stdenv.mkDerivation rec {
-  version = "1.4.6";
+  version = "1.4.7";
   pname = "jpegoptim";
 
-  src = fetchurl {
-    url = "https://www.kokkonen.net/tjko/src/${pname}-${version}.tar.gz";
-    sha256 = "1dss7907fclfl8zsw0bl4qcw0hhz6fqgi3867w0jyfm3q9jfpcc8";
+  src = fetchFromGitHub {
+    owner = "tjko";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-qae3OEG4CC/OGkmNdHrXFUv9CkoaB1ZJnFHX3RFoxhk=";
   };
 
   # There are no checks, it seems.
@@ -17,7 +19,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Optimize JPEG files";
     homepage = "https://www.kokkonen.net/tjko/projects.html";
-    license = licenses.gpl2;
+    license = licenses.gpl3Plus;
     maintainers = [ maintainers.aristid ];
     platforms = platforms.all;
   };
diff --git a/pkgs/applications/misc/avalonia-ilspy/default.nix b/pkgs/applications/misc/avalonia-ilspy/default.nix
new file mode 100644
index 00000000000..7defa48a8f6
--- /dev/null
+++ b/pkgs/applications/misc/avalonia-ilspy/default.nix
@@ -0,0 +1,99 @@
+{ lib
+, stdenv
+, fetchzip
+, unzip
+, autoPatchelfHook
+, makeWrapper
+, makeDesktopItem
+, copyDesktopItems
+, lttng-ust
+, libkrb5
+, zlib
+, fontconfig
+, openssl_1_1
+, libX11
+, libICE
+, libSM
+, icu
+}:
+
+stdenv.mkDerivation rec {
+  pname = "avalonia-ilspy";
+  version = "7.2-rc";
+
+  src = fetchzip {
+    url = "https://github.com/icsharpcode/AvaloniaILSpy/releases/download/v${version}/Linux.x64.Release.zip";
+    sha256 = "1crf0ng4l6x70wjlz3r6qw8l166gd52ys11j7ilb4nyy3mkjxk11";
+  };
+
+  nativeBuildInputs = [
+    unzip
+    autoPatchelfHook
+    makeWrapper
+    copyDesktopItems
+  ];
+
+  buildInputs = [
+    stdenv.cc.cc.lib
+    lttng-ust
+    libkrb5
+    zlib
+    fontconfig
+  ];
+
+  libraryPath = lib.makeLibraryPath [
+    openssl_1_1
+    libX11
+    libICE
+    libSM
+    icu
+  ];
+
+  unpackPhase = ''
+    unzip -qq $src/ILSpy-linux-x64-Release.zip
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin $out/lib $out/share/icons/hicolor/scalable/apps
+    cp -r artifacts/linux-x64/* $out/lib
+    ln -s $out/lib/Images/ILSpy.png $out/share/icons/hicolor/scalable/apps/ILSpy.png
+
+    chmod +x $out/lib/ILSpy
+    wrapProgram $out/lib/ILSpy --prefix LD_LIBRARY_PATH : ${libraryPath}
+    mv $out/lib/ILSpy $out/bin
+
+    runHook postInstall
+  '';
+
+  # dotnet runtime requirements
+  preFixup = ''
+    patchelf --replace-needed liblttng-ust.so.0 liblttng-ust.so $out/lib/libcoreclrtraceptprovider.so
+  '';
+  dontStrip = true;
+
+  desktopItem = makeDesktopItem {
+    name = "ILSpy";
+    desktopName = "ILSpy";
+    exec = "ILSpy";
+    icon = "ILSpy";
+    comment = ".NET assembly browser and decompiler";
+    categories = [
+      "Development"
+    ];
+    keywords = [
+      ".net"
+      "il"
+      "assembly"
+    ];
+  };
+
+  meta = with lib; {
+    description = ".NET assembly browser and decompiler";
+    homepage = "https://github.com/icsharpcode/AvaloniaILSpy";
+    license = licenses.mit;
+    platforms = [ "x86_64-linux" ];
+    maintainers = with lib.maintainers; [ AngryAnt ];
+  };
+}
diff --git a/pkgs/applications/misc/binocle/default.nix b/pkgs/applications/misc/binocle/default.nix
index ccb748fe3a6..6a999790635 100644
--- a/pkgs/applications/misc/binocle/default.nix
+++ b/pkgs/applications/misc/binocle/default.nix
@@ -3,6 +3,13 @@
 , rustPlatform
 , fetchFromGitHub
 , makeWrapper
+, AppKit
+, CoreFoundation
+, CoreGraphics
+, CoreVideo
+, Foundation
+, Metal
+, QuartzCore
 , xorg
 , vulkan-loader
 }:
@@ -24,7 +31,11 @@ rustPlatform.buildRustPackage rec {
     makeWrapper
   ];
 
-  postInstall = ''
+  buildInputs = lib.optionals stdenv.isDarwin [
+    AppKit CoreFoundation CoreGraphics CoreVideo Foundation Metal QuartzCore
+  ];
+
+  postInstall = lib.optionalString (!stdenv.isDarwin) ''
     wrapProgram $out/bin/binocle \
       --suffix LD_LIBRARY_PATH : ${lib.makeLibraryPath (with xorg; [ libX11 libXcursor libXi libXrandr ] ++ [ vulkan-loader ])}
   '';
@@ -34,6 +45,5 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/sharkdp/binocle";
     license = with licenses; [ asl20 /* or */ mit ];
     maintainers = with maintainers; [ SuperSandro2000 ];
-    broken = stdenv.isDarwin;
   };
 }
diff --git a/pkgs/applications/misc/dialect/default.nix b/pkgs/applications/misc/dialect/default.nix
index a4f9d94d9ec..6e504ab7173 100644
--- a/pkgs/applications/misc/dialect/default.nix
+++ b/pkgs/applications/misc/dialect/default.nix
@@ -18,7 +18,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "dialect";
-  version = "2.0.1";
+  version = "2.0.2";
 
   format = "other";
 
@@ -27,7 +27,7 @@ python3.pkgs.buildPythonApplication rec {
     repo = pname;
     rev = version;
     fetchSubmodules = true;
-    hash = "sha256-Ke23QnvKpmyuaqkiBQL1cUa0T7lSfYPLFi6wa9G8LYk=";
+    hash = "sha256-55vqxS0ySV8lItxLl1J+wLvPtmR87HzGfAiOKuhigFA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/logseq/default.nix b/pkgs/applications/misc/logseq/default.nix
index 36b06219a23..86d181ba5a5 100644
--- a/pkgs/applications/misc/logseq/default.nix
+++ b/pkgs/applications/misc/logseq/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "logseq";
-  version = "0.7.7";
+  version = "0.7.8";
 
   src = fetchurl {
     url = "https://github.com/logseq/logseq/releases/download/${version}/logseq-linux-x64-${version}.AppImage";
-    sha256 = "sha256-FRhtB7l40nNy8YTocXShbvhGudFWOrzpXsfe4yFY4us=";
+    sha256 = "sha256-5NEx4OEISa7q0tp6v4AWK9eMn58dje7non653iJhipE=";
     name = "${pname}-${version}.AppImage";
   };
 
diff --git a/pkgs/applications/misc/tut/default.nix b/pkgs/applications/misc/tut/default.nix
index 8fa43da8098..9bc97edfe48 100644
--- a/pkgs/applications/misc/tut/default.nix
+++ b/pkgs/applications/misc/tut/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "tut";
-  version = "1.0.13";
+  version = "1.0.14";
 
   src = fetchFromGitHub {
     owner = "RasmusLindroth";
     repo = pname;
     rev = version;
-    sha256 = "sha256-EORvIqA2bsmNUY1euUBmEYNMU02nW0doRDmTQjt15Os=";
+    sha256 = "sha256-2zlCO73UBT2E94+AvDdqACotWFna6G1P+Q9VrOKxK+c=";
   };
 
   vendorSha256 = "sha256-ilq1sfFY6WuNACryDGjkpF5eUTan8Y6Yt26vot9XR54=";
diff --git a/pkgs/applications/networking/browsers/brave/default.nix b/pkgs/applications/networking/browsers/brave/default.nix
index bc707dfb993..8af5e984c02 100644
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@@ -90,11 +90,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "brave";
-  version = "1.41.96";
+  version = "1.41.99";
 
   src = fetchurl {
     url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    sha256 = "sha256-sPIzQkaa6PGxwLkCHYz2GdSDns5x/Q2YwWcXBWBx+Fo=";
+    sha256 = "sha256-SGh2yp6sYtamIZc5YvBwkoAQxYw0Y9KZyVLI/EGS0dg=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/applications/networking/sync/onedrive/default.nix b/pkgs/applications/networking/sync/onedrive/default.nix
index 7b6316631e8..d2c6620b8d6 100644
--- a/pkgs/applications/networking/sync/onedrive/default.nix
+++ b/pkgs/applications/networking/sync/onedrive/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "onedrive";
-  version = "2.4.19";
+  version = "2.4.20";
 
   src = fetchFromGitHub {
     owner = "abraunegg";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-7kX7gC/1jSZGgV3ZhfebMIn/Y5gXkz22GDP2zpiwUZ4=";
+    hash = "sha256-2sDs4AhiyccVpnfCGPBL+QifQGStbrzSUIL547kh2ko=";
   };
 
   nativeBuildInputs = [ autoreconfHook ldc installShellFiles pkg-config ];
diff --git a/pkgs/applications/office/zk/default.nix b/pkgs/applications/office/zk/default.nix
index f6b9f1393ea..23b1977308c 100644
--- a/pkgs/applications/office/zk/default.nix
+++ b/pkgs/applications/office/zk/default.nix
@@ -2,26 +2,24 @@
 
 buildGoModule rec {
   pname = "zk";
-  version = "0.9.0";
+  version = "0.11.1";
 
   src = fetchFromGitHub {
     owner = "mickael-menu";
     repo = "zk";
     rev = "v${version}";
-    sha256 = "sha256-AXKIi70evf581lMwfbfxm8hFCzsnhKRQgnIEZQFS75A=";
+    sha256 = "sha256-30Vw6RGREg/ULS+eNExulHNOsOssMjXE+/tuRBQ17kI=";
   };
 
-  vendorSha256 = "sha256-m7QGv8Vx776TsN7QHXtO+yl3U1D573UMZVyg1B4UeIk=";
+  vendorSha256 = "sha256-11GzI3aEhKKTiULoWq9uIc66E3YCrW/HJQUYXRhCaek=";
 
   doCheck = false;
 
-  buildInputs = [ icu ];
-
   CGO_ENABLED = 1;
 
   ldflags = [ "-s" "-w" "-X=main.Build=${version}" ];
 
-  tags = [ "fts5" "icu" ];
+  tags = [ "fts5" ];
 
   meta = with lib; {
     maintainers = with maintainers; [ pinpox ];
diff --git a/pkgs/applications/version-management/git-and-tools/hub/default.nix b/pkgs/applications/version-management/git-and-tools/hub/default.nix
index 9d63642dcb3..cb75ec82646 100644
--- a/pkgs/applications/version-management/git-and-tools/hub/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/hub/default.nix
@@ -1,47 +1,65 @@
-{ lib, buildGoPackage, fetchFromGitHub, git, groff, installShellFiles, unixtools, nixosTests }:
+{ lib
+, buildGoModule
+, fetchpatch
+, fetchFromGitHub
+, git
+, groff
+, installShellFiles
+, makeWrapper
+, unixtools
+, nixosTests
+}:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "hub";
-  version = "2.14.2";
-
-  goPackagePath = "github.com/github/hub";
-
-  # Only needed to build the man-pages
-  excludedPackages = [ "github.com/github/hub/md2roff-bin" ];
+  version = "unstable-2022-04-04";
 
   src = fetchFromGitHub {
     owner = "github";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "1qjab3dpia1jdlszz3xxix76lqrm4zbmqzd9ymld7h06awzsg2vh";
+    rev = "363513a0f822a8bde5b620e5de183702280d4ace";
+    sha256 = "sha256-jipZHmGtPTsztTeVZofaMReU4AEU9k6mdw9YC4KKB1Q=";
   };
 
-  nativeBuildInputs = [ groff installShellFiles unixtools.col ];
-
   postPatch = ''
-    patchShebangs .
-    substituteInPlace git/git.go --replace "cmd.New(\"git\")" "cmd.New(\"${git}/bin/git\")"
-    substituteInPlace commands/args.go --replace "Executable:  \"git\"" "Executable:  \"${git}/bin/git\""
+    patchShebangs script/
   '';
 
+  vendorSha256 = "sha256-wQH8V9jRgh45JGs4IfYS1GtmCIYdo93JG1UjJ0BGxXk=";
+
+  # Only needed to build the man-pages
+  excludedPackages = [ "github.com/github/hub/md2roff-bin" ];
+
+  nativeBuildInputs = [
+    groff
+    installShellFiles
+    makeWrapper
+    unixtools.col
+  ];
+
   postInstall = ''
-    cd go/src/${goPackagePath}
-    installShellCompletion --zsh --name _hub etc/hub.zsh_completion
-    installShellCompletion --bash --name hub etc/hub.bash_completion.sh
-    installShellCompletion --fish --name hub.fish etc/hub.fish_completion
+    installShellCompletion --cmd hub \
+      --bash etc/hub.bash_completion.sh \
+      --fish etc/hub.fish_completion \
+      --zsh etc/hub.zsh_completion
 
-    LC_ALL=C.UTF8 \
-    make man-pages
+    LC_ALL=C.UTF8 make man-pages
     installManPage share/man/man[1-9]/*.[1-9]
+
+    wrapProgram $out/bin/hub \
+      --suffix PATH : ${lib.makeBinPath [ git ]}
   '';
 
+  checkInputs = [
+    git
+  ];
+
   passthru.tests = { inherit (nixosTests) hub; };
 
   meta = with lib; {
     description = "Command-line wrapper for git that makes you better at GitHub";
-    license = licenses.mit;
     homepage = "https://hub.github.com/";
+    license = licenses.mit;
     maintainers = with maintainers; [ globin ];
-    platforms = with platforms; unix;
   };
 }
diff --git a/pkgs/applications/virtualization/docker/compose.nix b/pkgs/applications/virtualization/docker/compose.nix
index 583a3e50a1f..f95568f918f 100644
--- a/pkgs/applications/virtualization/docker/compose.nix
+++ b/pkgs/applications/virtualization/docker/compose.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "docker-compose";
-  version = "2.6.1";
+  version = "2.7.0";
 
   src = fetchFromGitHub {
     owner = "docker";
     repo = "compose";
     rev = "v${version}";
-    sha256 = "sha256-D3+qDWxg3e5/3UIMz8FZDuxmQHmTv0NJVT/otGYedtw=";
+    sha256 = "sha256-cx2Qn5NHQgs2iJ1SDyTdptHSyPUhx4SpCTfvjUwldfI=";
   };
 
-  vendorSha256 = "sha256-WxLQfu65Gr+ao/pM8B2uiS88sNT72Klhz7ZIrEadW5g=";
+  vendorSha256 = "sha256-8CvtqnXSKoK/SA0tc/0Duv3pmYT69/3a/HFvAr4KNJo=";
 
   ldflags = [ "-X github.com/docker/compose/v2/internal.Version=${version}" "-s" "-w" ];
 
diff --git a/pkgs/data/fonts/corefonts/default.nix b/pkgs/data/fonts/corefonts/default.nix
index 4b4772699cd..db6ac715829 100644
--- a/pkgs/data/fonts/corefonts/default.nix
+++ b/pkgs/data/fonts/corefonts/default.nix
@@ -1,29 +1,26 @@
 { lib, stdenv, fetchurl, cabextract }:
 
 let
-
   fonts = [
-    {name = "andale";  sha256 = "0w7927hlwayqf3vvanf8f3qp2g1i404jzqvhp1z3mp0sjm1gw905";}
-    {name = "arial";   sha256 = "1xkqyivbyb3z9dcalzidf8m4npzfpls2g0kldyn8g73f2i6plac5";}
-    {name = "arialb";  sha256 = "1a60zqrg63kjnykh5hz7dbpzvx7lyivn3vbrp7jyv9d1nvzz09d4";}
-    {name = "comic";   sha256 = "0ki0rljjc1pxkbsxg515fwx15yc95bdyaksa3pjd89nyxzzg6vcw";}
-    {name = "courie";  sha256 = "111k3waxki9yyxpjwl2qrdkswvsd2dmvhbjmmrwyipam2s31sldv";}
-    {name = "georgi";  sha256 = "0083jcpd837j2c06kp1q8glfjn9k7z6vg3wi137savk0lv6psb1c";}
-    {name = "impact";  sha256 = "1yyc5z7zmm3s418hmrkmc8znc55afsrz5dgxblpn9n81fhxyyqb0";}
-    {name = "times";   sha256 = "1aq7z3l46vwgqljvq9zfgkii6aivy00z1529qbjkspggqrg5jmnv";}
-    {name = "trebuc";  sha256 = "1jfsgz80pvyqvpfpaiz5pd8zwlcn67rg2jgynjwf22sip2dhssas";}
-    {name = "webdin";  sha256 = "0nnp2znmnmx87ijq9zma0vl0hd46npx38p0cc6lgp00hpid5nnb4";}
-    {name = "verdan";  sha256 = "15mdbbfqbyp25a6ynik3rck3m3mg44plwrj79rwncc9nbqjn3jy1";}
-    {name = "wd97vwr"; sha256 = "1lmkh3zb6xv47k0z2mcwk3vk8jff9m845c9igxm14bbvs6k2c4gn";}
+    { name = "andale";  sha256 = "0w7927hlwayqf3vvanf8f3qp2g1i404jzqvhp1z3mp0sjm1gw905"; }
+    { name = "arial";   sha256 = "1xkqyivbyb3z9dcalzidf8m4npzfpls2g0kldyn8g73f2i6plac5"; }
+    { name = "arialb";  sha256 = "1a60zqrg63kjnykh5hz7dbpzvx7lyivn3vbrp7jyv9d1nvzz09d4"; }
+    { name = "comic";   sha256 = "0ki0rljjc1pxkbsxg515fwx15yc95bdyaksa3pjd89nyxzzg6vcw"; }
+    { name = "courie";  sha256 = "111k3waxki9yyxpjwl2qrdkswvsd2dmvhbjmmrwyipam2s31sldv"; }
+    { name = "georgi";  sha256 = "0083jcpd837j2c06kp1q8glfjn9k7z6vg3wi137savk0lv6psb1c"; }
+    { name = "impact";  sha256 = "1yyc5z7zmm3s418hmrkmc8znc55afsrz5dgxblpn9n81fhxyyqb0"; }
+    { name = "times";   sha256 = "1aq7z3l46vwgqljvq9zfgkii6aivy00z1529qbjkspggqrg5jmnv"; }
+    { name = "trebuc";  sha256 = "1jfsgz80pvyqvpfpaiz5pd8zwlcn67rg2jgynjwf22sip2dhssas"; }
+    { name = "webdin";  sha256 = "0nnp2znmnmx87ijq9zma0vl0hd46npx38p0cc6lgp00hpid5nnb4"; }
+    { name = "verdan";  sha256 = "15mdbbfqbyp25a6ynik3rck3m3mg44plwrj79rwncc9nbqjn3jy1"; }
+    { name = "wd97vwr"; sha256 = "1lmkh3zb6xv47k0z2mcwk3vk8jff9m845c9igxm14bbvs6k2c4gn"; }
   ];
 
   eula = fetchurl {
     url = "http://corefonts.sourceforge.net/eula.htm";
     sha256 = "1aqbcnl032g2hd7iy56cs022g47scb0jxxp3mm206x1yqc90vs1c";
   };
-
 in
-
 stdenv.mkDerivation {
   pname = "corefonts";
   version = "1";
@@ -33,22 +30,53 @@ stdenv.mkDerivation {
     inherit sha256;
   }) fonts;
 
-  nativeBuildInputs = [cabextract];
+  nativeBuildInputs = [ cabextract ];
 
   buildCommand = ''
     for i in $exes; do
-        cabextract --lowercase $i
+      cabextract --lowercase $i
     done
-
     cabextract --lowercase viewer1.cab
 
+    # rename to more standard names
+    mv andalemo.ttf  Andale_Mono.ttf
+    mv ariblk.ttf    Arial_Black.ttf
+    mv arial.ttf     Arial.ttf
+    mv arialbd.ttf   Arial_Bold.ttf
+    mv arialbi.ttf   Arial_Bold_Italic.ttf
+    mv ariali.ttf    Arial_Italic.ttf
+    mv comic.ttf     Comic_Sans_MS.ttf
+    mv comicbd.ttf   Comic_Sans_MS_Bold.ttf
+    mv cour.ttf      Courier_New.ttf
+    mv courbd.ttf    Courier_New_Bold.ttf
+    mv couri.ttf     Courier_New_Italic.ttf
+    mv courbi.ttf    Courier_New_Bold_Italic.ttf
+    mv georgia.ttf   Georgia.ttf
+    mv georgiab.ttf  Georgia_Bold.ttf
+    mv georgiai.ttf  Georgia_Italic.ttf
+    mv georgiaz.ttf  Georgia_Bold_Italic.ttf
+    mv impact.ttf    Impact.ttf
+    mv tahoma.ttf    Tahoma.ttf
+    mv times.ttf     Times_New_Roman.ttf
+    mv timesbd.ttf   Times_New_Roman_Bold.ttf
+    mv timesbi.ttf   Times_New_Roman_Bold_Italic.ttf
+    mv timesi.ttf    Times_New_Roman_Italic.ttf
+    mv trebuc.ttf    Trebuchet_MS.ttf
+    mv trebucbd.ttf  Trebuchet_MS_Bold.ttf
+    mv trebucit.ttf  Trebuchet_MS_Italic.ttf
+    mv trebucbi.ttf  Trebuchet_MS_Italic.ttf
+    mv verdana.ttf   Verdana.ttf
+    mv verdanab.ttf  Verdana_Bold.ttf
+    mv verdanai.ttf  Verdana_Italic.ttf
+    mv verdanaz.ttf  Verdana_Bold_Italic.ttf
+    mv webdings.ttf  Webdings.ttf
+
     install -m444 -Dt $out/share/fonts/truetype *.ttf
 
     # Also put the EULA there to be on the safe side.
     cp ${eula} $out/share/fonts/truetype/eula.html
 
-    # Set up no-op font configs to override any aliases set up by
-    # other packages.
+    # Set up no-op font configs to override any aliases set up by other packages.
     mkdir -p $out/etc/fonts/conf.d
     for name in Andale-Mono Arial-Black Arial Comic-Sans-MS \
                 Courier-New Georgia Impact Times-New-Roman \
@@ -58,10 +86,6 @@ stdenv.mkDerivation {
     done
   '';
 
-  outputHashAlgo = "sha256";
-  outputHashMode = "recursive";
-  outputHash = "089d2m9bvaacj36qdq77pcazji0sbbr796shic3k52cpxkjnzbwh";
-
   meta = with lib; {
     homepage = "http://corefonts.sourceforge.net/";
     description = "Microsoft's TrueType core fonts for the Web";
diff --git a/pkgs/data/icons/qogir-icon-theme/default.nix b/pkgs/data/icons/qogir-icon-theme/default.nix
index 24ad687834e..e2f3e6cb3bb 100644
--- a/pkgs/data/icons/qogir-icon-theme/default.nix
+++ b/pkgs/data/icons/qogir-icon-theme/default.nix
@@ -1,20 +1,30 @@
 { lib
 , stdenvNoCC
 , fetchFromGitHub
+, gitUpdater
 , gtk3
 , hicolor-icon-theme
 , jdupes
+, colorVariants ? [] # default is all
+, themeVariants ? [] # default is all
 }:
 
-stdenvNoCC.mkDerivation rec {
+let
   pname = "qogir-icon-theme";
-  version = "2022-01-12";
+
+in
+lib.checkListOfEnum "${pname}: color variants" [ "default" "dark" "all" ] colorVariants
+lib.checkListOfEnum "${pname}: theme variants" [ "default" "manjaro" "ubuntu" "all" ] themeVariants
+
+stdenvNoCC.mkDerivation rec {
+  inherit pname;
+  version = "2022-07-20";
 
   src = fetchFromGitHub {
     owner = "vinceliuice";
     repo = pname;
     rev = version;
-    sha256 = "1daayxsqh7di3bvfnl39h1arsj1fypd3ba30mas6dl1d0qy17z1p";
+    sha256 = "sha256-I+eojCTR3fXcp7v5Bdie9vstmJja9HB71aQSF5jLDD4=";
   };
 
   nativeBuildInputs = [ gtk3 jdupes ];
@@ -27,15 +37,27 @@ stdenvNoCC.mkDerivation rec {
   dontPatchELF = true;
   dontRewriteSymlinks = true;
 
+  postPatch = ''
+    patchShebangs install.sh
+  '';
+
   installPhase = ''
     runHook preInstall
-    patchShebangs install.sh
+
     mkdir -p $out/share/icons
-    name= ./install.sh -d $out/share/icons
-    jdupes -L -r $out/share/icons
+
+    name= ./install.sh \
+      ${lib.optionalString (themeVariants != []) ("--theme " + builtins.toString themeVariants)} \
+      ${lib.optionalString (colorVariants != []) ("--color " + builtins.toString colorVariants)} \
+      --dest $out/share/icons
+
+    jdupes --quiet --link-soft --recurse $out/share
+
     runHook postInstall
   '';
 
+  passthru.updateScript = gitUpdater { inherit pname version; };
+
   meta = with lib; {
     description = "Flat colorful design icon theme";
     homepage = "https://github.com/vinceliuice/Qogir-icon-theme";
diff --git a/pkgs/data/themes/colloid-gtk-theme/default.nix b/pkgs/data/themes/colloid-gtk-theme/default.nix
new file mode 100644
index 00000000000..dabe19d68d7
--- /dev/null
+++ b/pkgs/data/themes/colloid-gtk-theme/default.nix
@@ -0,0 +1,76 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+, gitUpdater
+, gnome-themes-extra
+, gtk-engine-murrine
+, jdupes
+, sassc
+, themeVariants ? [] # default: blue
+, colorVariants ? [] # default: all
+, sizeVariants ? [] # default: standard
+, tweaks ? []
+}:
+
+let
+  pname = "colloid-gtk-theme";
+
+in
+lib.checkListOfEnum "${pname}: theme variants" [ "default" "purple" "pink" "red" "orange" "yellow" "green" "teal" "grey" "all" ] themeVariants
+lib.checkListOfEnum "${pname}: color variants" [ "standard" "light" "dark" ] colorVariants
+lib.checkListOfEnum "${pname}: size variants" [ "standard" "compact" ] sizeVariants
+lib.checkListOfEnum "${pname}: tweaks" [ "nord" "black" "dracula" "rimless" "normal" ] tweaks
+
+stdenvNoCC.mkDerivation rec {
+  inherit pname;
+  version = "2022-07-18";
+
+  src = fetchFromGitHub {
+    owner = "vinceliuice";
+    repo = pname;
+    rev = version;
+    hash = "sha256-dWYRTwfQRMBdg+htxpWatF325rToaovF/43LxX6I1GI=";
+  };
+
+  nativeBuildInputs = [
+    jdupes
+    sassc
+  ];
+
+  buildInputs = [
+    gnome-themes-extra
+  ];
+
+  propagatedUserEnvPkgs = [
+    gtk-engine-murrine
+  ];
+
+  postPatch = ''
+    patchShebangs install.sh clean-old-theme.sh
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    name= HOME="$TMPDIR" ./install.sh \
+      ${lib.optionalString (themeVariants != []) "--theme " + builtins.toString themeVariants} \
+      ${lib.optionalString (colorVariants != []) "--color " + builtins.toString colorVariants} \
+      ${lib.optionalString (sizeVariants != []) "--size " + builtins.toString sizeVariants} \
+      ${lib.optionalString (tweaks != []) "--tweaks " + builtins.toString tweaks} \
+      --dest $out/share/themes
+
+    jdupes --link-soft --recurse $out/share
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = gitUpdater { inherit pname version; };
+
+  meta = with lib; {
+    description = "A modern and clean Gtk theme";
+    homepage = "https://github.com/vinceliuice/Colloid-gtk-theme";
+    license = licenses.gpl3Only;
+    platforms = platforms.unix;
+    maintainers = [ maintainers.romildo ];
+  };
+}
diff --git a/pkgs/data/themes/qogir-kde/default.nix b/pkgs/data/themes/qogir-kde/default.nix
new file mode 100644
index 00000000000..30ef4ed82d3
--- /dev/null
+++ b/pkgs/data/themes/qogir-kde/default.nix
@@ -0,0 +1,48 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+, gitUpdater
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "qogir-kde";
+  version = "unstable-2022-07-08";
+
+  src = fetchFromGitHub {
+    owner = "vinceliuice";
+    repo = pname;
+    rev = "f240eae10978c7fee518f7a8be1c41a21a9d5c2e";
+    hash = "sha256-AV60IQWwgvLwDO3ylILwx1DkKadwo4isn3JX3WpKoxQ=";
+  };
+
+  postPatch = ''
+    patchShebangs install.sh
+
+    substituteInPlace install.sh \
+      --replace '$HOME/.local' $out \
+      --replace '$HOME/.config' $out/share
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/plasma/plasmoids
+
+    name= HOME="$TMPDIR" ./install.sh --dest $out/share/themes
+
+    mkdir -p $out/share/sddm/themes
+    cp -a sddm/Qogir $out/share/sddm/themes/
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = gitUpdater { inherit pname version; };
+
+  meta = with lib; {
+    description = "A flat Design theme for KDE Plasma desktop";
+    homepage = "https://github.com/vinceliuice/Qogir-kde";
+    license = licenses.gpl3Only;
+    platforms = platforms.all;
+    maintainers = [ maintainers.romildo ];
+  };
+}
diff --git a/pkgs/desktops/xfce/applications/catfish/default.nix b/pkgs/desktops/xfce/applications/catfish/default.nix
index 7d5ef0a288c..d58ae684fcb 100644
--- a/pkgs/desktops/xfce/applications/catfish/default.nix
+++ b/pkgs/desktops/xfce/applications/catfish/default.nix
@@ -1,15 +1,29 @@
-{ lib, fetchurl, file, which, intltool, gobject-introspection,
-  findutils, xdg-utils, dconf, gtk3, python3Packages, xfconf,
-  wrapGAppsHook
+{ lib
+, fetchFromGitLab
+, gitUpdater
+, file
+, which
+, intltool
+, gobject-introspection
+, findutils
+, xdg-utils
+, dconf
+, gtk3
+, python3Packages
+, xfconf
+, wrapGAppsHook
 }:
 
 python3Packages.buildPythonApplication rec {
   pname = "catfish";
-  version = "4.16.3";
+  version = "4.16.4";
 
-  src = fetchurl {
-    url = "https://archive.xfce.org/src/apps/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-6amaYtEJgTkVCN1D88v6LVCmm9a30e7vfTC6TGc9z9o=";
+  src = fetchFromGitLab {
+    domain = "gitlab.xfce.org";
+    owner = "apps";
+    repo = pname;
+    rev = "${pname}-${version}";
+    sha256 = "sha256-hdrEFdBa/4i/PF7VyEI7ObiJXLIRW+RFSe8yGnUpqRc=";
   };
 
   nativeBuildInputs = [
@@ -51,6 +65,11 @@ python3Packages.buildPythonApplication rec {
   # Disable check because there is no test in the source distribution
   doCheck = false;
 
+  passthru.updateScript = gitUpdater {
+    inherit pname version;
+    rev-prefix = "${pname}-";
+  };
+
   meta = with lib; {
     homepage = "https://docs.xfce.org/apps/catfish/start";
     description = "Handy file search tool";
diff --git a/pkgs/development/libraries/gobject-introspection/wrapper.nix b/pkgs/development/libraries/gobject-introspection/wrapper.nix
index 87ed44f9db1..9e8f20ce146 100644
--- a/pkgs/development/libraries/gobject-introspection/wrapper.nix
+++ b/pkgs/development/libraries/gobject-introspection/wrapper.nix
@@ -1,13 +1,22 @@
 { lib
 , stdenv
 , buildPackages
-, gobject-introspection-unwrapped
 , targetPackages
-}:
+, gobject-introspection-unwrapped
+, ...
+}@_args:
 
 # to build, run
 # `nix build ".#pkgsCross.aarch64-multiplatform.buildPackages.gobject-introspection"`
-gobject-introspection-unwrapped.overrideAttrs (previousAttrs: {
+
+let
+  # ensure that `.override` works when gobject-introspection == gobject-introspection-wrapped
+  args = builtins.removeAttrs _args [ "buildPackages" "targetPackages" "gobject-introspection-unwrapped" ];
+  # passing this stdenv to `targetPackages...` breaks due to splicing not working in `.override``
+  argsForTarget = builtins.removeAttrs args [ "stdenv" ];
+in
+
+(gobject-introspection-unwrapped.override args).overrideAttrs (previousAttrs: {
   pname = "gobject-introspection-wrapped";
   # failure in e.g. pkgsCross.aarch64-multiplatform.polkit
   # subprocess.CalledProcessError: Command '['/nix/store/...-prelink-unstable-2019-06-24/bin/prelink-rtld', '/build/source/build/tmp-introspectzp2ldkyk/PolkitAgent-1.0']' returned non-zero exit status 127.
@@ -21,7 +30,7 @@ gobject-introspection-unwrapped.overrideAttrs (previousAttrs: {
       export emulator=${lib.escapeShellArg (stdenv.targetPlatform.emulator buildPackages)}
       export buildprelink="${buildPackages.prelink}/bin/prelink-rtld"
 
-      export targetgir="${lib.getDev targetPackages.gobject-introspection-unwrapped}"
+      export targetgir="${lib.getDev (targetPackages.gobject-introspection-unwrapped.override argsForTarget)}"
 
       substituteAll "${./wrappers/g-ir-compiler.sh}" "$dev/bin/g-ir-compiler"
       substituteAll "${./wrappers/g-ir-scanner.sh}" "$dev/bin/g-ir-scanner"
diff --git a/pkgs/development/libraries/intel-gmmlib/default.nix b/pkgs/development/libraries/intel-gmmlib/default.nix
index c16d3afded2..d3b2cf3992c 100644
--- a/pkgs/development/libraries/intel-gmmlib/default.nix
+++ b/pkgs/development/libraries/intel-gmmlib/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-gmmlib";
-  version = "22.1.5";
+  version = "22.1.7";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "gmmlib";
     rev = "intel-gmmlib-${version}";
-    sha256 = "sha256-A7XZXkYBsFa8NMQA7EBnvEReSTorAGgoow08bMZ+WkQ=";
+    sha256 = "sha256-HRN4SSjP8h8nnCisysDM9V17012ECLz2GgdUok1AV24=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/libplacebo/default.nix b/pkgs/development/libraries/libplacebo/default.nix
index 807b69f17f2..73d97a47655 100644
--- a/pkgs/development/libraries/libplacebo/default.nix
+++ b/pkgs/development/libraries/libplacebo/default.nix
@@ -50,6 +50,8 @@ stdenv.mkDerivation rec {
     "-Dvulkan-registry=${vulkan-headers}/share/vulkan/registry/vk.xml"
     "-Ddemos=false" # Don't build and install the demo programs
     "-Dd3d11=disabled" # Disable the Direct3D 11 based renderer
+  ] ++ lib.optionals stdenv.isDarwin [
+    "-Dunwind=disabled" # libplacebo doesn’t build with `darwin.libunwind`
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/physics/herwig/default.nix b/pkgs/development/libraries/physics/herwig/default.nix
index 1c3bfaa2064..569f8d80e54 100644
--- a/pkgs/development/libraries/physics/herwig/default.nix
+++ b/pkgs/development/libraries/physics/herwig/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "herwig";
-  version = "7.2.2";
+  version = "7.2.3";
 
   src = fetchurl {
     url = "https://www.hepforge.org/archive/herwig/Herwig-${version}.tar.bz2";
-    sha256 = "10y3fb33zsinr0z3hzap9rsbcqhy1yjqnv4b4vz21g7mdlw6pq2k";
+    hash = "sha256-VZmJk3mwGwnjMaJCbXjTm39uwSbbJUPp00Cu/mqlD4Q=";
   };
 
   nativeBuildInputs = [ autoconf automake libtool gfortran ];
@@ -17,6 +17,10 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     patchShebangs ./
+
+    # Fix failing "make install" being unable to find HwEvtGenInterface.so
+    substituteInPlace src/defaults/decayers.in.in \
+      --replace "read EvtGenDecayer.in" ""
   '';
 
   configureFlags = [
diff --git a/pkgs/development/libraries/physics/thepeg/default.nix b/pkgs/development/libraries/physics/thepeg/default.nix
index ed92889b5b2..adef606be54 100644
--- a/pkgs/development/libraries/physics/thepeg/default.nix
+++ b/pkgs/development/libraries/physics/thepeg/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "thepeg";
-  version = "2.2.2";
+  version = "2.2.3";
 
   src = fetchurl {
     url = "https://www.hepforge.org/archive/thepeg/ThePEG-${version}.tar.bz2";
-    sha256 = "0gif4vb9lw2px2qdywqm7x0frbv0h5gq9lq36c50f2hv77a5bgwp";
+    hash = "sha256-8hRzGXp2H8MpF7CKjSTSv6+T/1fzRB/WBdqZrJ3l1Qs=";
   };
 
   buildInputs = [ boost fastjet gsl hepmc2 lhapdf rivet zlib ];
diff --git a/pkgs/development/python-modules/afsapi/default.nix b/pkgs/development/python-modules/afsapi/default.nix
index 4df1dba8dd1..323c0a22531 100644
--- a/pkgs/development/python-modules/afsapi/default.nix
+++ b/pkgs/development/python-modules/afsapi/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "afsapi";
-  version = "0.2.6";
+  version = "0.2.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "wlcrs";
     repo = "python-afsapi";
     rev = "refs/tags/${version}";
-    hash = "sha256-SPHED/zbrjULtJFz1x+0kq+lDrLeuol+1rOH2/xWEnI=";
+    hash = "sha256-TTZk/8mfG5lBr8SyMbqSaYDskWKnUlMkAUp94DXPCKo=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/debugpy/default.nix b/pkgs/development/python-modules/debugpy/default.nix
index 5be044690e0..e492677d138 100644
--- a/pkgs/development/python-modules/debugpy/default.nix
+++ b/pkgs/development/python-modules/debugpy/default.nix
@@ -1,8 +1,10 @@
 { lib
 , stdenv
 , buildPythonPackage
+, pythonOlder
 , fetchFromGitHub
 , substituteAll
+, fetchpatch
 , gdb
 , django
 , flask
@@ -12,8 +14,6 @@
 , pytest-xdist
 , pytestCheckHook
 , requests
-, isPy3k
-, pythonAtLeast
 }:
 
 buildPythonPackage rec {
@@ -21,11 +21,13 @@ buildPythonPackage rec {
   version = "1.6.2";
   format = "setuptools";
 
+  disabled = pythonOlder "3.7";
+
   src = fetchFromGitHub {
     owner = "Microsoft";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-jcokiAZ2WwyIvsXNIUzvMIrRttR76RwDSE7gk0xHExc=";
+    hash = "sha256-jcokiAZ2WwyIvsXNIUzvMIrRttR76RwDSE7gk0xHExc=";
   };
 
   patches = [
@@ -50,6 +52,13 @@ buildPythonPackage rec {
     # To avoid this issue, debugpy should be installed using python.withPackages:
     # python.withPackages (ps: with ps; [ debugpy ])
     ./fix-test-pythonpath.patch
+
+    # Fix compiling attach library from source
+    # https://github.com/microsoft/debugpy/pull/978
+    (fetchpatch {
+      url = "https://github.com/microsoft/debugpy/commit/08b3b13cba9035f4ab3308153aef26e3cc9275f9.patch";
+      sha256 = "sha256-8E+Y40mYQou9T1ozWslEK2XNQtuy5+MBvPvDLt4eQak=";
+    })
   ];
 
   # Remove pre-compiled "attach" libraries and recompile for host platform
@@ -59,17 +68,15 @@ buildPythonPackage rec {
     cd src/debugpy/_vendored/pydevd/pydevd_attach_to_process
     rm *.so *.dylib *.dll *.exe *.pdb
     ${stdenv.cc}/bin/c++ linux_and_mac/attach.cpp -Ilinux_and_mac -fPIC -nostartfiles ${{
-      "x86_64-linux"   = "-shared -m64 -o attach_linux_amd64.so";
-      "i686-linux"     = "-shared -m32 -o attach_linux_x86.so";
+      "x86_64-linux"   = "-shared -o attach_linux_amd64.so";
+      "i686-linux"     = "-shared -o attach_linux_x86.so";
       "aarch64-linux"  = "-shared -o attach_linux_arm64.so";
-      "x86_64-darwin"  = "-std=c++11 -lc -D_REENTRANT -dynamiclib -arch x86_64 -o attach_x86_64.dylib";
-      "i686-darwin"    = "-std=c++11 -lc -D_REENTRANT -dynamiclib -arch i386 -o attach_x86.dylib";
-      "aarch64-darwin" = "-std=c++11 -lc -D_REENTRANT -dynamiclib -arch arm64 -o attach_arm64.dylib";
+      "x86_64-darwin"  = "-std=c++11 -lc -D_REENTRANT -dynamiclib -o attach_x86_64.dylib";
+      "i686-darwin"    = "-std=c++11 -lc -D_REENTRANT -dynamiclib -o attach_x86.dylib";
+      "aarch64-darwin" = "-std=c++11 -lc -D_REENTRANT -dynamiclib -o attach_arm64.dylib";
     }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}")}
   )'';
 
-  doCheck = isPy3k;
-
   checkInputs = [
     django
     flask
@@ -86,16 +93,8 @@ buildPythonPackage rec {
     "--timeout=0"
   ];
 
-  disabledTests = lib.optionals (pythonAtLeast "3.10") [
-    "test_flask_breakpoint_multiproc"
-    "test_subprocess[program-launch-None]"
-    "test_systemexit[0-zero-uncaught-raised-launch(integratedTerminal)-module]"
-    "test_systemexit[0-zero-uncaught--attach_pid-program]"
-    "test_success_exitcodes[-break_on_system_exit_zero-0-attach_listen(cli)-module]"
-    "test_success_exitcodes[--0-attach_connect(api)-program]"
-    "test_run[code-attach_connect(api)]"
-    "test_subprocess[program-launch-None]"
-  ];
+  # Fixes hanging tests on Darwin
+  __darwinAllowLocalNetworking = true;
 
   pythonImportsCheck = [
     "debugpy"
diff --git a/pkgs/development/python-modules/debugpy/fix-test-pythonpath.patch b/pkgs/development/python-modules/debugpy/fix-test-pythonpath.patch
index 537531cd974..0f51106988d 100644
--- a/pkgs/development/python-modules/debugpy/fix-test-pythonpath.patch
+++ b/pkgs/development/python-modules/debugpy/fix-test-pythonpath.patch
@@ -1,8 +1,8 @@
 diff --git a/tests/debug/session.py b/tests/debug/session.py
-index 101492fc..4ee7cfbe 100644
+index af242877..30b21a1e 100644
 --- a/tests/debug/session.py
 +++ b/tests/debug/session.py
-@@ -630,6 +630,7 @@ class Session(object):
+@@ -622,6 +622,7 @@ class Session(object):
          if "PYTHONPATH" in self.config.env:
              # If specified, launcher will use it in lieu of PYTHONPATH it inherited
              # from the adapter when spawning debuggee, so we need to adjust again.
diff --git a/pkgs/development/python-modules/debugpy/hardcode-gdb.patch b/pkgs/development/python-modules/debugpy/hardcode-gdb.patch
index 09851260233..ad40a504c9d 100644
--- a/pkgs/development/python-modules/debugpy/hardcode-gdb.patch
+++ b/pkgs/development/python-modules/debugpy/hardcode-gdb.patch
@@ -1,5 +1,5 @@
 diff --git a/src/debugpy/_vendored/pydevd/pydevd_attach_to_process/add_code_to_python_process.py b/src/debugpy/_vendored/pydevd/pydevd_attach_to_process/add_code_to_python_process.py
-index 3c0e1b94..e995a20f 100644
+index 462feae9..eb2aa945 100644
 --- a/src/debugpy/_vendored/pydevd/pydevd_attach_to_process/add_code_to_python_process.py
 +++ b/src/debugpy/_vendored/pydevd/pydevd_attach_to_process/add_code_to_python_process.py
 @@ -399,7 +399,7 @@ def run_python_code_linux(pid, python_code, connect_debugger_tracing=False, show
diff --git a/pkgs/development/python-modules/debugpy/hardcode-version.patch b/pkgs/development/python-modules/debugpy/hardcode-version.patch
index 7d3fd5abfc2..440513e26c1 100644
--- a/pkgs/development/python-modules/debugpy/hardcode-version.patch
+++ b/pkgs/development/python-modules/debugpy/hardcode-version.patch
@@ -1,5 +1,5 @@
 diff --git a/setup.py b/setup.py
-index e7487100..10d36520 100644
+index 5fc40070..775a08ec 100644
 --- a/setup.py
 +++ b/setup.py
 @@ -12,7 +12,6 @@ import sys
@@ -26,24 +26,22 @@ index e7487100..10d36520 100644
          description="An implementation of the Debug Adapter Protocol for Python",  # noqa
          long_description=long_description,
          long_description_content_type="text/markdown",
-diff --git a/src/debugpy/__init__.py b/src/debugpy/__init__.py
-index baa5a7c5..53553272 100644
---- a/src/debugpy/__init__.py
-+++ b/src/debugpy/__init__.py
-@@ -27,7 +27,6 @@ __all__ = [
- import codecs
- import os
+diff --git a/src/debugpy/public_api.py b/src/debugpy/public_api.py
+index 3c800898..27743245 100644
+--- a/src/debugpy/public_api.py
++++ b/src/debugpy/public_api.py
+@@ -7,8 +7,6 @@ from __future__ import annotations
+ import functools
+ import typing
  
 -from debugpy import _version
- from debugpy.common import compat
+-
  
+ # Expose debugpy.server API from subpackage, but do not actually import it unless
+ # and until a member is invoked - we don't want the server package loaded in the
+@@ -182,4 +180,4 @@ def trace_this_thread(__should_trace: bool):
+     """
  
-@@ -204,7 +203,7 @@ def trace_this_thread(should_trace):
-     return api.trace_this_thread(should_trace)
  
- 
--__version__ = _version.get_versions()["version"]
-+__version__ = "@version@"
- 
- # Force absolute path on Python 2.
- __file__ = os.path.abspath(__file__)
+-__version__: str = _version.get_versions()["version"]
++__version__: str = "@version@"
diff --git a/pkgs/development/python-modules/eventlet/default.nix b/pkgs/development/python-modules/eventlet/default.nix
index ff1d618ddb0..446f825fd3b 100644
--- a/pkgs/development/python-modules/eventlet/default.nix
+++ b/pkgs/development/python-modules/eventlet/default.nix
@@ -8,7 +8,6 @@
 , monotonic
 , six
 , nose
-, pyopenssl
 , iana-etc
 , pytestCheckHook
 , libredirect
@@ -29,9 +28,8 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     dnspython
     greenlet
-    pyopenssl
     six
-  ] ++ lib.optional (pythonOlder "3.5") [
+  ] ++ lib.optionals (pythonOlder "3.5") [
     monotonic
   ];
 
diff --git a/pkgs/development/python-modules/plantuml/default.nix b/pkgs/development/python-modules/plantuml/default.nix
new file mode 100644
index 00000000000..f887453bd68
--- /dev/null
+++ b/pkgs/development/python-modules/plantuml/default.nix
@@ -0,0 +1,36 @@
+{ buildPythonPackage
+, fetchFromGitHub
+, lib
+  # Runtime dependencies
+, httplib2
+, six
+}:
+
+buildPythonPackage {
+  pname = "plantuml";
+  version = "0.3.0";
+
+  src = fetchFromGitHub {
+    owner = "dougn";
+    repo = "python-plantuml";
+    rev = "93e1aac25b17d896b0d05d0a1aa352c7bd11dd31";
+    sha256 = "sha256-aPXPqoKlu8VLi0Jn84brG7v3qM9L18Ut4sabYYGb3qQ=";
+  };
+
+  propagatedBuildInputs = [
+    httplib2
+    six
+  ];
+
+  # Project does not contain a test suite
+  doCheck = false;
+
+  pythonImportsCheck = [ "plantuml" ];
+
+  meta = with lib; {
+    description = "Python interface to a plantuml web service instead of having to run java locally";
+    homepage = "https://github.com/dougn/python-plantuml";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ nikstur ];
+  };
+}
diff --git a/pkgs/development/python-modules/snowflake-sqlalchemy/default.nix b/pkgs/development/python-modules/snowflake-sqlalchemy/default.nix
index b2b6f92a01a..6d30f143ce2 100644
--- a/pkgs/development/python-modules/snowflake-sqlalchemy/default.nix
+++ b/pkgs/development/python-modules/snowflake-sqlalchemy/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "snowflake-sqlalchemy";
-  version = "1.3.4";
+  version = "1.4.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-nXTPnWChj/rIMmPoVZr1AhY7tHVRygmpNmh1oGR6W4A=";
+    sha256 = "sha256-9IooTfzXRmOE22huBSduM4kX8ltI6F50nvkUnXRkAFo=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/twisted/default.nix b/pkgs/development/python-modules/twisted/default.nix
index ceaadd74ee6..7779f053137 100644
--- a/pkgs/development/python-modules/twisted/default.nix
+++ b/pkgs/development/python-modules/twisted/default.nix
@@ -104,6 +104,9 @@ buildPythonPackage rec {
     # twisted.python.runtime.platform.supportsINotify() == False
     substituteInPlace src/twisted/python/_inotify.py --replace \
       "ctypes.util.find_library(\"c\")" "'${stdenv.cc.libc}/lib/libc.so.6'"
+  '' + lib.optionalString (stdenv.isAarch64 && stdenv.isDarwin) ''
+    echo 'AbortConnectionTests_AsyncioSelectorReactorTests.test_fullWriteBufferAfterByteExchange.skip = "Timeout after 120 seconds"' >> src/twisted/internet/test/test_tcp.py
+    echo 'AbortConnectionTests_AsyncioSelectorReactorTests.test_resumeProducingAbort.skip = "Timeout after 120 seconds"' >> src/twisted/internet/test/test_tcp.py
   '';
 
   # Generate Twisted's plug-in cache. Twisted users must do it as well. See
diff --git a/pkgs/development/tools/dive/default.nix b/pkgs/development/tools/dive/default.nix
index d6217671b0c..0d19a1071dc 100644
--- a/pkgs/development/tools/dive/default.nix
+++ b/pkgs/development/tools/dive/default.nix
@@ -1,4 +1,13 @@
-{ lib, stdenv, buildGoModule, fetchFromGitHub, pkg-config, btrfs-progs, gpgme, lvm2 }:
+{ lib
+, stdenv
+, buildGoModule
+, fetchFromGitHub
+, fetchpatch
+, pkg-config
+, btrfs-progs
+, gpgme
+, lvm2
+}:
 
 buildGoModule rec {
   pname = "dive";
@@ -11,7 +20,14 @@ buildGoModule rec {
     sha256 = "sha256-1pmw8pUlek5FlI1oAuvLSqDow7hw5rw86DRDZ7pFAmA=";
   };
 
-  vendorSha256 = "sha256-0gJ3dAPoilh3IWkuesy8geNsuI1T0DN64XvInc9LvlM=";
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/wagoodman/dive/commit/fe9411c414418d839a8638bb9a12ccfc892b5845.patch";
+      sha256 = "sha256-c0TcUQ87CeOiXHoTQ3z/04i72aDr403DL7fIbXTJ9cY=";
+    })
+  ];
+
+  vendorSha256 = "sha256-YPkEei7d7mXP+5FhooNoMDARQLosH2fdSaLXGZ5C27o=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/development/tools/ijq/default.nix b/pkgs/development/tools/ijq/default.nix
index 528294ac4e1..a51518968d2 100644
--- a/pkgs/development/tools/ijq/default.nix
+++ b/pkgs/development/tools/ijq/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "ijq";
-  version = "0.3.8";
+  version = "0.4.0";
 
   src = fetchFromSourcehut {
     owner = "~gpanders";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-N4wrm0nUmQ0NTsLkomJrcSiYJWgFUEh1/yn3pagM9vI=";
+    sha256 = "sha256-EQfCEdQIrjg38JjjePNDNWKi0cFezjYvIGVJajbf9jw=";
   };
 
   vendorSha256 = "sha256-DX8m5FsqMZnzk1wgJA/ESZl0QeDv3p9huF4h1HY9DIA=";
diff --git a/pkgs/development/tools/millet/default.nix b/pkgs/development/tools/millet/default.nix
index 7d95607b618..57dee681094 100644
--- a/pkgs/development/tools/millet/default.nix
+++ b/pkgs/development/tools/millet/default.nix
@@ -1,22 +1,17 @@
-{ lib, rustPlatform, fetchFromGitHub, rustfmt }:
+{ lib, rustPlatform, fetchFromGitHub }:
 
 rustPlatform.buildRustPackage rec {
   pname = "millet";
-  version = "0.2.5";
+  version = "0.2.7";
 
   src = fetchFromGitHub {
     owner = "azdavis";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-HnVvq6Tb0yDvoa0KxZHZG0Tm0CWYWsn9unj0v0zYuTw=";
+    sha256 = "sha256-+4lMRd4pzbkRDct5kz17MB9drN6sEtYLk29d6TlubLk=";
   };
 
-  cargoSha256 = "sha256-cbp4eAcqKuUKKqmlS2Azo5NRHDy+F4LNwcrwbFj+Z5g=";
-
-  nativeBuildInputs = [
-    # Required for `syntax-gen` crate https://github.com/azdavis/language-util/blob/8ec2dc509c88951102ad3e751820443059a363af/crates/syntax-gen/src/util.rs#L37
-    rustfmt
-  ];
+  cargoSha256 = "sha256-MoXKNUgNeg2AG7G78wnZvLXADhCsK/WB5WiT5lTSmIQ=";
 
   cargoBuildFlags = [ "--package" "lang-srv" ];
 
diff --git a/pkgs/development/tools/misc/drush/default.nix b/pkgs/development/tools/misc/drush/default.nix
index 8cafab36f2a..c06a566fb59 100644
--- a/pkgs/development/tools/misc/drush/default.nix
+++ b/pkgs/development/tools/misc/drush/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "drush";
-  version = "8.4.10";
+  version = "8.4.11";
 
   src = fetchurl {
     url = "https://github.com/drush-ops/drush/releases/download/${version}/drush.phar";
-    sha256 = "sha256-yXSoTDFLsjDiYkRfrIxv2WTVdHzgxZRvtn3Pht5XF4k=";
+    sha256 = "sha256-4DD16PQHGZzAGwmm/WNeZ/dDKnlQslcb35AkpiJs5tQ=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/development/tools/misc/netcoredbg/default.nix b/pkgs/development/tools/misc/netcoredbg/default.nix
index c57b421dbef..d736e4a1d29 100644
--- a/pkgs/development/tools/misc/netcoredbg/default.nix
+++ b/pkgs/development/tools/misc/netcoredbg/default.nix
@@ -30,7 +30,9 @@ let
     hardeningDisable = [ "strictoverflow" ];
 
     preConfigure = ''
+      export DOTNET_SYSTEM_GLOBALIZATION_INVARIANT=1
       dotnetVersion="$(${dotnet-sdk}/bin/dotnet --list-runtimes | grep -Po '^Microsoft.NETCore.App \K.*?(?= )')"
+
       cmakeFlagsArray+=(
         "-DDBGSHIM_RUNTIME_DIR=${dotnet-sdk}/shared/Microsoft.NETCore.App/$dotnetVersion"
       )
diff --git a/pkgs/development/tools/misc/polylith/default.nix b/pkgs/development/tools/misc/polylith/default.nix
index a48f629ad63..3d28ffa5238 100644
--- a/pkgs/development/tools/misc/polylith/default.nix
+++ b/pkgs/development/tools/misc/polylith/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "polylith";
-  version = "0.2.13-alpha";
+  version = "0.2.14-alpha";
 
   src = fetchurl {
     url = "https://github.com/polyfy/polylith/releases/download/v${version}/poly-${version}.jar";
-    sha256 = "sha256-iLN92qurc8+D0pt7Hwag+TFGoeFl9DvEeS67sKmmoSI=";
+    sha256 = "sha256-0yJLSveKd49nBnCtBVfwcACXfIH43ZgqTLoo2aLPE2g=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/development/tools/okteto/default.nix b/pkgs/development/tools/okteto/default.nix
index ec4974876cb..1e9ae945200 100644
--- a/pkgs/development/tools/okteto/default.nix
+++ b/pkgs/development/tools/okteto/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "okteto";
-  version = "2.4.0";
+  version = "2.5.0";
 
   src = fetchFromGitHub {
     owner = "okteto";
     repo = "okteto";
     rev = version;
-    sha256 = "sha256-+shhY7/chtq4xPwYSlcVgL/RGMNA0ahTCqT9pVQqpG4=";
+    sha256 = "sha256-jcGnkLut8MlMqdWQxj/M6vQgIf3e7qFv8dJ1j6bEqj8=";
   };
 
   vendorSha256 = "sha256-W1/QBMnMdZWokWSFmHhPqmOu827bpGXS8+GFp5Iu9Ig=";
diff --git a/pkgs/development/tools/stylua/default.nix b/pkgs/development/tools/stylua/default.nix
index 3bba34c531e..60d37177682 100644
--- a/pkgs/development/tools/stylua/default.nix
+++ b/pkgs/development/tools/stylua/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "stylua";
-  version = "0.14.0";
+  version = "0.14.1";
 
   src = fetchFromGitHub {
     owner = "johnnymorganz";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-G7fCLkvpO5GHqWCfy2m3GxSgDSHCcYOaXyPDtdmdSY0=";
+    sha256 = "sha256-SoO5xujSPe+6TOBvPt09sm77cRUU4s9nYjR1EOpcTBY=";
   };
 
-  cargoSha256 = "sha256-MqRoGuRMEgOYvL2VI324EXZjrPVCbCE/c7aVEXr0xmw=";
+  cargoSha256 = "sha256-L8nGAT7HoI67kxX+vf++iQ0NzY4hNW/H32LL6WZSJM4=";
 
   buildFeatures = lib.optional lua52Support "lua52"
     ++ lib.optional luauSupport "luau";
diff --git a/pkgs/development/web/nodejs/v16.nix b/pkgs/development/web/nodejs/v16.nix
index 2f044b44f21..89b6c3e4363 100644
--- a/pkgs/development/web/nodejs/v16.nix
+++ b/pkgs/development/web/nodejs/v16.nix
@@ -1,4 +1,4 @@
-{ callPackage, openssl, python3, enableNpm ? true }:
+{ callPackage, openssl, python3, fetchpatch, enableNpm ? true }:
 
 let
   buildNodejs = callPackage ./nodejs.nix {
@@ -8,9 +8,17 @@ let
 in
   buildNodejs {
     inherit enableNpm;
-    version = "16.15.0"; # Do not upgrade until #176127 is solved
-    sha256 = "sha256-oPgS78Q/eDIeygiVeWCkj15r+XAE1QWMjdOwPGRupPc=";
+    version = "16.16.0";
+    sha256 = "sha256-FFFR7/Oyql6+czhACcUicag3QK5oepPJjGKM19UnNus=";
     patches = [
       ./disable-darwin-v8-system-instrumentation.patch
+      # Fix npm silently fail without a HOME directory https://github.com/npm/cli/issues/4996
+      (fetchpatch {
+        url = "https://github.com/npm/cli/commit/9905d0e24c162c3f6cc006fa86b4c9d0205a4c6f.patch";
+        sha256 = "sha256-RlabXWtjzTZ5OgrGf4pFkolonvTDIPlzPY1QcYDd28E=";
+        includes = [ "deps/npm/lib/npm.js" "deps/npm/lib/utils/log-file.js" ];
+        stripLen = 1;
+        extraPrefix = "deps/npm/";
+      })
     ];
   }
diff --git a/pkgs/games/oh-my-git/default.nix b/pkgs/games/oh-my-git/default.nix
index 0da53bbf9aa..cd4fd216eaa 100644
--- a/pkgs/games/oh-my-git/default.nix
+++ b/pkgs/games/oh-my-git/default.nix
@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation rec {
   pname = "oh-my-git";
-  version = "0.6.4";
+  version = "0.6.5";
 
   src = fetchFromGitHub {
     owner = "git-learning-game";
     repo = "oh-my-git";
     rev = version;
-    sha256 = "sha256-GQLHyBUXF+yqEZ/LYutAn6TBCXFX8ViOaERQEm2J6CY=";
+    sha256 = "sha256-XqxliMVU55D5JSt7Yo5btvZnnTlagSukyhXv6Akgklo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/darwin/moltenvk/MoltenVK.xcodeproj.patch b/pkgs/os-specific/darwin/moltenvk/MoltenVK.xcodeproj.patch
index abbb3b8fb0e..e4b03dfe0cc 100644
--- a/pkgs/os-specific/darwin/moltenvk/MoltenVK.xcodeproj.patch
+++ b/pkgs/os-specific/darwin/moltenvk/MoltenVK.xcodeproj.patch
@@ -86,61 +86,3 @@ index c23afce4..12ac12f4 100644
  /* Begin XCBuildConfiguration section */
  		2FEA0AB824902F9F00EEF3AD /* Debug */ = {
  			isa = XCBuildConfiguration;
-@@ -1586,11 +1544,12 @@
- 				GCC_WARN_UNUSED_VARIABLE = YES;
- 				GENERATE_MASTER_OBJECT_FILE = YES;
- 				HEADER_SEARCH_PATHS = (
--					"\"$(SRCROOT)/include\"",
--					"\"$(SRCROOT)/../MoltenVKShaderConverter\"",
--					"\"$(SRCROOT)/../MoltenVKShaderConverter/SPIRV-Cross\"",
--					"\"$(SRCROOT)/../External/cereal/include\"",
--					"\"${BUILT_PRODUCTS_DIR}\"",
-+					"@@sourceRoot@@/outputs/include",
-+					"@@sourceRoot@@/outputs/include/simd_workaround",
-+					"@@sourceRoot@@/MoltenVKShaderConverter",
-+					"@@cereal@@/include",
-+					"@@spirv-cross@@/include/spirv_cross",
-+					"@@vulkan-headers@@/include",
- 				);
- 				IPHONEOS_DEPLOYMENT_TARGET = 9.0;
- 				MACH_O_TYPE = staticlib;
-@@ -1600,6 +1559,10 @@
- 				MVK_SKIP_DYLIB = "";
- 				"MVK_SKIP_DYLIB[sdk=appletvsimulator*]" = YES;
- 				"MVK_SKIP_DYLIB[sdk=iphonesimulator*]" = YES;
-+				OTHER_CFLAGS = (
-+					"-isystem",
-+					"@@libcxx@@/include/c++/v1",
-+				);
- 				PRELINK_LIBS = "${CONFIGURATION_BUILD_DIR}/libMoltenVKShaderConverter.a";
- 				PRODUCT_NAME = MoltenVK;
- 				SKIP_INSTALL = YES;
-@@ -1658,11 +1621,12 @@
- 				GCC_WARN_UNUSED_VARIABLE = YES;
- 				GENERATE_MASTER_OBJECT_FILE = YES;
- 				HEADER_SEARCH_PATHS = (
--					"\"$(SRCROOT)/include\"",
--					"\"$(SRCROOT)/../MoltenVKShaderConverter\"",
--					"\"$(SRCROOT)/../MoltenVKShaderConverter/SPIRV-Cross\"",
--					"\"$(SRCROOT)/../External/cereal/include\"",
--					"\"${BUILT_PRODUCTS_DIR}\"",
-+					"@@sourceRoot@@/outputs/include",
-+					"@@sourceRoot@@/outputs/include/simd_workaround",
-+					"@@sourceRoot@@/MoltenVKShaderConverter",
-+					"@@cereal@@/include",
-+					"@@spirv-cross@@/include/spirv_cross",
-+					"@@vulkan-headers@@/include",
- 				);
- 				IPHONEOS_DEPLOYMENT_TARGET = 9.0;
- 				MACH_O_TYPE = staticlib;
-@@ -1672,6 +1636,10 @@
- 				MVK_SKIP_DYLIB = "";
- 				"MVK_SKIP_DYLIB[sdk=appletvsimulator*]" = YES;
- 				"MVK_SKIP_DYLIB[sdk=iphonesimulator*]" = YES;
-+				OTHER_CFLAGS = (
-+					"-isystem",
-+					"@@libcxx@@/include/c++/v1",
-+				);
- 				PRELINK_LIBS = "${CONFIGURATION_BUILD_DIR}/libMoltenVKShaderConverter.a";
- 				PRODUCT_NAME = MoltenVK;
- 				SKIP_INSTALL = YES;
diff --git a/pkgs/os-specific/darwin/moltenvk/MoltenVKShaderConverter.xcodeproj.patch b/pkgs/os-specific/darwin/moltenvk/MoltenVKShaderConverter.xcodeproj.patch
index 7a7ec7afa2e..ecc5242684d 100644
--- a/pkgs/os-specific/darwin/moltenvk/MoltenVKShaderConverter.xcodeproj.patch
+++ b/pkgs/os-specific/darwin/moltenvk/MoltenVKShaderConverter.xcodeproj.patch
@@ -82,99 +82,3 @@ index c7842b63..d55f73ed 100644
  			productReference = A93903C71C57E9ED00FE90DC /* libMoltenVKShaderConverter.a */;
  			productType = "com.apple.product-type.library.static";
  		};
-@@ -536,6 +518,17 @@
- 				OTHER_LDFLAGS = (
- 					"-ObjC",
- 					"-w",
-+					"-lMachineIndependent",
-+					"-lGenericCodeGen",
-+					"-lOGLCompiler",
-+					"-lglslang",
-+					"-lOSDependent",
-+					"-lSPIRV",
-+					"-lSPIRV-Tools",
-+					"-lSPIRV-Tools-opt",
-+					"-lspirv-cross-msl",
-+					"-lspirv-cross-core",
-+					"-lspirv-cross-glsl",
- 				);
- 				SDKROOT = macosx;
- 			};
-@@ -548,6 +541,17 @@
- 				OTHER_LDFLAGS = (
- 					"-ObjC",
- 					"-w",
-+					"-lMachineIndependent",
-+					"-lGenericCodeGen",
-+					"-lOGLCompiler",
-+					"-lglslang",
-+					"-lOSDependent",
-+					"-lSPIRV",
-+					"-lSPIRV-Tools",
-+					"-lSPIRV-Tools-opt",
-+					"-lspirv-cross-msl",
-+					"-lspirv-cross-core",
-+					"-lspirv-cross-glsl",
- 				);
- 				SDKROOT = macosx;
- 			};
-@@ -624,15 +628,24 @@
- 				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
- 				GCC_WARN_UNUSED_FUNCTION = YES;
- 				HEADER_SEARCH_PATHS = (
--					"$(inherited)",
--					"\"$(SRCROOT)\"",
--					"\"$(SRCROOT)/SPIRV-Cross\"",
--					"\"$(SRCROOT)/glslang\"",
--					"\"$(SRCROOT)/glslang/External/spirv-tools/include\"",
-+					"@@sourceRoot@@/Common",
-+					"@@glslang@@/include",
-+					"@@spirv-cross@@/include/spirv_cross",
-+					"@@spirv-tools@@/include",
-+					"@@spirv-headers@@/include/spirv/unified1/",
- 				);
- 				IPHONEOS_DEPLOYMENT_TARGET = 9.0;
-+				LIBRARY_SEARCH_PATHS = (
-+					"@@glslang@@/lib",
-+					"@@spirv-cross@@/lib",
-+					"@@spirv-tools@@/lib",
-+				);
- 				MACH_O_TYPE = staticlib;
- 				MACOSX_DEPLOYMENT_TARGET = 10.11;
-+				OTHER_CFLAGS = (
-+					"-isystem",
-+					"@@libcxx@@/include/c++/v1",
-+				);
- 				PRODUCT_NAME = MoltenVKShaderConverter;
- 				SKIP_INSTALL = YES;
- 				TVOS_DEPLOYMENT_TARGET = 9.0;
-@@ -683,15 +696,24 @@
- 				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
- 				GCC_WARN_UNUSED_FUNCTION = YES;
- 				HEADER_SEARCH_PATHS = (
--					"$(inherited)",
--					"\"$(SRCROOT)\"",
--					"\"$(SRCROOT)/SPIRV-Cross\"",
--					"\"$(SRCROOT)/glslang\"",
--					"\"$(SRCROOT)/glslang/External/spirv-tools/include\"",
-+					"@@sourceRoot@@/Common",
-+					"@@glslang@@/include",
-+					"@@spirv-cross@@/include/spirv_cross",
-+					"@@spirv-tools@@/include",
-+					"@@spirv-headers@@/include/spirv/unified1/",
- 				);
- 				IPHONEOS_DEPLOYMENT_TARGET = 9.0;
-+				LIBRARY_SEARCH_PATHS = (
-+					"@@glslang@@/lib",
-+					"@@spirv-cross@@/lib",
-+					"@@spirv-tools@@/lib",
-+				);
- 				MACH_O_TYPE = staticlib;
- 				MACOSX_DEPLOYMENT_TARGET = 10.11;
-+				OTHER_CFLAGS = (
-+					"-isystem",
-+					"@@libcxx@@/include/c++/v1",
-+				);
- 				PRODUCT_NAME = MoltenVKShaderConverter;
- 				SKIP_INSTALL = YES;
- 				TVOS_DEPLOYMENT_TARGET = 9.0;
diff --git a/pkgs/os-specific/darwin/moltenvk/createDylib.patch b/pkgs/os-specific/darwin/moltenvk/createDylib.patch
deleted file mode 100644
index b4a990cd989..00000000000
--- a/pkgs/os-specific/darwin/moltenvk/createDylib.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/Scripts/create_dylib.sh b/Scripts/create_dylib.sh
-index 5ba75f67..a0405067 100755
---- a/Scripts/create_dylib.sh
-+++ b/Scripts/create_dylib.sh
-@@ -57,6 +57,8 @@ ${MVK_SAN} \
- -framework Metal ${MVK_IOSURFACE_FWK} -framework ${MVK_UX_FWK} -framework QuartzCore -framework CoreGraphics ${MVK_IOKIT_FWK} -framework Foundation \
- --library-directory ${MVK_USR_LIB_DIR} \
- -o "${MVK_BUILT_PROD_DIR}/dynamic/${MVK_DYLIB_NAME}" \
-+-L@@sourceRoot@@/outputs/lib -L@@glslang@@/lib -L@@spirv-tools@@/lib -L@@spirv-cross@@/lib \
-+-lobjc -lMoltenVKShaderConverter -lGenericCodeGen -lMachineIndependent -lOGLCompiler -lOSDependent -lSPIRV -lSPIRV-Tools -lSPIRV-Tools-opt -lspirv-cross-core -lspirv-cross-glsl -lspirv-cross-msl -lspirv-cross-reflect \
- -force_load "${MVK_BUILT_PROD_DIR}/lib${PRODUCT_NAME}.a"
-
- if test "$CONFIGURATION" = Debug; then
diff --git a/pkgs/os-specific/darwin/moltenvk/default.nix b/pkgs/os-specific/darwin/moltenvk/default.nix
index 0b3946a3f4b..1d8f89deff1 100644
--- a/pkgs/os-specific/darwin/moltenvk/default.nix
+++ b/pkgs/os-specific/darwin/moltenvk/default.nix
@@ -1,42 +1,34 @@
 { lib
+, overrideCC
 , stdenv
-, stdenvNoCC
 , fetchurl
 , fetchFromGitHub
 , cctools
 , sigtool
 , cereal
+, libcxx
 , glslang
 , spirv-cross
 , spirv-headers
 , spirv-tools
 , vulkan-headers
+, xcbuild
 , AppKit
 , Foundation
+, Libsystem
+, MacOSX-SDK
 , Metal
 , QuartzCore
 }:
 
-# Even though the derivation is currently impure, it is written to build successfully using
-# `xcbuild`.  Once the SDK on x86_64-darwin is updated, it should be possible to switch from being
-# an impure derivation.
-#
-# The `sandboxProfile` was copied from the iTerm2 derivation.  In order to build you at least need
-# the `sandbox` option set to `relaxed` or `false`.  Xcode should be available in the default
-# location.
-let
-  libcxx.dev = "/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr";
-in
-stdenvNoCC.mkDerivation (finalAttrs: {
+stdenv.mkDerivation (finalAttrs: {
   pname = "MoltenVK";
-  version = "1.1.9";
+  version = "1.1.10";
 
-  buildInputs = [
-    AppKit
-    Foundation
-    Metal
-    QuartzCore
-  ];
+  buildInputs = [ AppKit Foundation Metal QuartzCore cereal ]
+    ++ lib.attrValues finalAttrs.passthru;
+
+  nativeBuildInputs = [ cctools sigtool xcbuild ];
 
   outputs = [ "out" "bin" "dev" ];
 
@@ -47,47 +39,42 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       src = fetchFromGitHub {
         owner = "KhronosGroup";
         repo = "glslang";
-        rev = "9bb8cfffb0eed010e07132282c41d73064a7a609";
-        hash = "sha256-YLn/Mxuk6mXPGtBBgfwky5Nl1TCAW6i2g+AZLzqVz+A=";
+        rev = "adbf0d3106b26daa237b10b9bf72b1af7c31092d";
+        hash = "sha256-sjidkiPtRADhyOEKDb2cHCBXnFjLwk2F5Lppv5/fwNQ=";
       };
-    })).override {
-      inherit (finalAttrs.passthru) spirv-headers spirv-tools;
-    };
+    })).override { inherit (finalAttrs.passthru) spirv-headers spirv-tools; };
     spirv-cross = spirv-cross.overrideAttrs (old: {
-      cmakeFlags = (old.cmakeFlags or [ ]) ++ [
-        "-DSPIRV_CROSS_NAMESPACE_OVERRIDE=MVK_spirv_cross"
-      ];
+      cmakeFlags = (old.cmakeFlags or [ ])
+        ++ [ "-DSPIRV_CROSS_NAMESPACE_OVERRIDE=MVK_spirv_cross" ];
       src = fetchFromGitHub {
         owner = "KhronosGroup";
         repo = "SPIRV-Cross";
-        rev = "0d4ce028bf8b8a94d325dc1e1c20446153ba19c4";
-        hash = "sha256-OluTxOEfDIGMdrXhvIifjpMgZBvyh9ofLKxKt0dX5ZU=";
+        rev = "50b4d5389b6a06f86fb63a2848e1a7da6d9755ca";
+        hash = "sha256-SsupPHJ3VHxJhEAUl3EeQwN4texYhdDjxTnGD+bkNAw=";
       };
     });
     spirv-headers = spirv-headers.overrideAttrs (_: {
       src = fetchFromGitHub {
         owner = "KhronosGroup";
         repo = "spirv-headers";
-        rev = "4995a2f2723c401eb0ea3e10c81298906bf1422b";
-        hash = "sha256-LkIrTFWYvZffLVJJW3152um5LTEsMJEDEsIhBAdhBlk=";
+        rev = "5a121866927a16ab9d49bed4788b532c7fcea766";
+        hash = "sha256-X4GuFesX015mrzutguhZLrIGlllCgAZ+DUBGSADt8xU=";
       };
     });
     spirv-tools = (spirv-tools.overrideAttrs (old: {
       src = fetchFromGitHub {
         owner = "KhronosGroup";
         repo = "spirv-tools";
-        rev = "eed5c76a57bb965f2e1b56d1dc40b50910b5ec1d";
-        hash = "sha256-2Mr3HbhRslLpRfwHascl7e/UoPijhrij9Bjg3aCiqBM=";
+        rev = "b930e734ea198b7aabbbf04ee1562cf6f57962f0";
+        hash = "sha256-NWpFSRoxtYWi+hLUt9gpw0YScM3shcUwv9yUmbivRb0=";
       };
-    })).override {
-      inherit (finalAttrs.passthru) spirv-headers;
-    };
+    })).override { inherit (finalAttrs.passthru) spirv-headers; };
     vulkan-headers = vulkan-headers.overrideAttrs (old: {
       src = fetchFromGitHub {
         owner = "KhronosGroup";
         repo = "Vulkan-Headers";
-        rev = "76f00ef6cbb1886eb1162d1fa39bee8b51e22ee8";
-        hash = "sha256-FqrcFHsUS8e4ZgZpxVc8nNZWdNltniFmMjyyWVoNc7w=";
+        rev = "3ef4c97fd6ea001d75a8e9da408ee473c180e456";
+        hash = "sha256-jHzW3m9smuzEGbZrSyBI74K9rFozxiG3M5Xql/WOw7U=";
       };
     });
   };
@@ -96,92 +83,99 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     owner = "KhronosGroup";
     repo = "MoltenVK";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-5ie1IGzZqaYbciFnrBJ1/9V0LEuz7JsEOFXXkG3hJzg=";
+    hash = "sha256-LZvCCP2yelTaWcNt+WvG+RZnVLHRgMDTlNWwRIey7ZM=";
   };
 
   patches = [
-    # Specify the libraries to link directly since XCFrameworks are not being used.
-    ./createDylib.patch
-    # Move `mvkGitRevDerived.h` to a stable location
-    ./gitRevHeaderStability.patch
     # Fix the Xcode projects to play nicely with `xcbuild`.
     ./MoltenVKShaderConverter.xcodeproj.patch
     ./MoltenVK.xcodeproj.patch
   ];
 
   postPatch = ''
-    substituteInPlace MoltenVKShaderConverter/MoltenVKShaderConverter.xcodeproj/project.pbxproj \
-      --replace @@sourceRoot@@ $(pwd) \
-      --replace @@libcxx@@ "${libcxx.dev}" \
-      --replace @@glslang@@ "${finalAttrs.passthru.glslang}" \
-      --replace @@spirv-cross@@ "${finalAttrs.passthru.spirv-cross}" \
-      --replace @@spirv-tools@@ "${finalAttrs.passthru.glslang.spirv-tools}" \
-      --replace @@spirv-headers@@ "${finalAttrs.passthru.glslang.spirv-headers}"
-    substituteInPlace MoltenVK/MoltenVK.xcodeproj/project.pbxproj \
-      --replace @@sourceRoot@@ $(pwd) \
-      --replace @@libcxx@@ "${libcxx.dev}" \
-      --replace @@cereal@@ "${cereal}" \
-      --replace @@spirv-cross@@ "${finalAttrs.passthru.spirv-cross}" \
-      --replace @@vulkan-headers@@ "${finalAttrs.passthru.vulkan-headers}"
-    substituteInPlace Scripts/create_dylib.sh \
-      --replace @@sourceRoot@@ $(pwd) \
-      --replace @@glslang@@ "${finalAttrs.passthru.glslang}" \
-      --replace @@spirv-tools@@ "${finalAttrs.passthru.glslang.spirv-tools}" \
-      --replace @@spirv-cross@@ "${finalAttrs.passthru.spirv-cross}"
+    # Move `mvkGitRevDerived.h` to a stable location
     substituteInPlace Scripts/gen_moltenvk_rev_hdr.sh \
-      --replace @@sourceRoot@@ $(pwd) \
+      --replace '$'''{BUILT_PRODUCTS_DIR}' "$NIX_BUILD_TOP/$sourceRoot/build/include" \
       --replace '$(git rev-parse HEAD)' ${finalAttrs.src.rev}
+    # Adding all of `usr/include` from the SDK results in header conflicts with `libcxx.dev`.
+    # Work around it by symlinking just the SIMD stuff needed by MoltenVK.
+    mkdir -p build/include
+    ln -s "${MacOSX-SDK}/usr/include/simd" "build/include"
   '';
 
   dontConfigure = true;
 
+  NIX_CFLAGS_COMPILE = [
+    "-isystem ${lib.getDev libcxx}/include/c++/v1"
+    "-I${finalAttrs.passthru.spirv-cross}/include/spirv_cross"
+    "-I${finalAttrs.passthru.spirv-headers}/include/spirv/unified1/"
+  ];
+
   buildPhase = ''
+    NIX_CFLAGS_COMPILE+=" \
+      -I$NIX_BUILD_TOP/$sourceRoot/build/include \
+      -I$NIX_BUILD_TOP/$sourceRoot/Common"
+    NIX_LDFLAGS+=" -L$NIX_BUILD_TOP/$sourceRoot/build/lib"
+
     # Build each project on its own because `xcbuild` fails to build `MoltenVKPackaging.xcodeproj`.
-    derived_data_path=$(pwd)/DerivedData
+    build=$NIX_BUILD_TOP/$sourceRoot/build
+    mkdir -p "$build/bin" "$build/lib"
+
+    NIX_LDFLAGS+=" \
+      -lMachineIndependent \
+      -lGenericCodeGen \
+      -lOGLCompiler \
+      -lglslang \
+      -lOSDependent \
+      -lSPIRV \
+      -lSPIRV-Tools \
+      -lSPIRV-Tools-opt \
+      -lspirv-cross-msl \
+      -lspirv-cross-core \
+      -lspirv-cross-glsl"
+
     pushd MoltenVKShaderConverter
-      /usr/bin/xcodebuild build \
-        -jobs $NIX_BUILD_CORES \
-        -derivedDataPath "$derived_data_path" \
-        -configuration Release \
-        -project MoltenVKShaderConverter.xcodeproj \
-        -scheme MoltenVKShaderConverter \
-        -arch ${stdenv.targetPlatform.darwinArch}
-    popd
-    mkdir -p outputs/bin outputs/lib
-    declare -A outputs=( [MoltenVKShaderConverter]=bin [libMoltenVKShaderConverter.a]=lib )
-    for output in "''${!outputs[@]}"; do
-      cp DerivedData/Build/Products/Release/$output "outputs/''${outputs[$output]}/$output"
+    xcodebuild build \
+      -jobs $NIX_BUILD_CORES \
+      -configuration Release \
+      -project MoltenVKShaderConverter.xcodeproj \
+      -scheme MoltenVKShaderConverter \
+      -arch ${stdenv.targetPlatform.darwinArch}
+    declare -A products=( [MoltenVKShaderConverter]=bin [libMoltenVKShaderConverter.a]=lib )
+    for product in "''${!products[@]}"; do
+      cp MoltenVKShaderConverter-*/Build/Products/Release/$product "$build/''${products[$product]}/$product"
     done
+    popd
+
+    NIX_LDFLAGS+=" \
+      -lobjc \
+      -lMoltenVKShaderConverter \
+      -lspirv-cross-reflect"
 
     pushd MoltenVK
-      /usr/bin/xcodebuild build \
-        -jobs $NIX_BUILD_CORES \
-        -derivedDataPath "$derived_data_path" \
-        -configuration Release \
-        -project MoltenVK.xcodeproj \
-        -scheme MoltenVK-macOS \
-        -arch ${stdenv.targetPlatform.darwinArch}
+    xcodebuild build \
+      -jobs $NIX_BUILD_CORES \
+      -configuration Release \
+      -project MoltenVK.xcodeproj \
+      -scheme MoltenVK-macOS \
+      -arch ${stdenv.targetPlatform.darwinArch}
+    cp MoltenVK-*/Build/Products/Release/dynamic/libMoltenVK.dylib "$build/lib/libMoltenVK.dylib"
     popd
-    cp DerivedData/Build/Products/Release/dynamic/libMoltenVK.dylib outputs/lib/libMoltenVK.dylib
   '';
 
   installPhase = ''
     mkdir -p "$out/lib" "$out/share/vulkan/icd.d" "$bin/bin" "$dev/include/MoltenVK"
-    cp outputs/bin/MoltenVKShaderConverter "$bin/bin/"
-    cp outputs/lib/libMoltenVK.dylib "$out/lib/"
+    cp build/bin/MoltenVKShaderConverter "$bin/bin/"
+    cp build/lib/libMoltenVK.dylib "$out/lib/"
     cp MoltenVK/MoltenVK/API/* "$dev/include/MoltenVK"
-    ${cctools}/bin/install_name_tool -id "$out/lib/libMoltenVK.dylib" "$out/lib/libMoltenVK.dylib"
-    # FIXME: https://github.com/NixOS/nixpkgs/issues/148189
-    /usr/bin/codesign -s - -f "$out/lib/libMoltenVK.dylib"
     install -m644 MoltenVK/icd/MoltenVK_icd.json "$out/share/vulkan/icd.d/MoltenVK_icd.json"
     substituteInPlace $out/share/vulkan/icd.d/MoltenVK_icd.json \
       --replace ./libMoltenVK.dylib "$out/lib/libMoltenVK.dylib"
   '';
 
-  sandboxProfile = ''
-    (allow file-read* file-write* process-exec mach-lookup)
-    ; block homebrew dependencies
-    (deny file-read* file-write* process-exec mach-lookup (subpath "/usr/local") (with no-log))
+  postFixup = ''
+    install_name_tool -id "$out/lib/libMoltenVK.dylib" "$out/lib/libMoltenVK.dylib"
+    codesign -s - -f "$out/lib/libMoltenVK.dylib"
   '';
 
   meta = {
@@ -189,7 +183,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     homepage = "https://github.com/KhronosGroup/MoltenVK";
     changelog = "https://github.com/KhronosGroup/MoltenVK/releases";
     maintainers = [ lib.maintainers.reckenrode ];
-    hydraPlatforms = [ ]; # Prevent building on Hydra until MoltenVK no longer requires Xcode.
     license = lib.licenses.asl20;
     platforms = lib.platforms.darwin;
   };
diff --git a/pkgs/os-specific/darwin/moltenvk/gitRevHeaderStability.patch b/pkgs/os-specific/darwin/moltenvk/gitRevHeaderStability.patch
deleted file mode 100644
index e28b9ee70b6..00000000000
--- a/pkgs/os-specific/darwin/moltenvk/gitRevHeaderStability.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-diff --git a/Scripts/gen_moltenvk_rev_hdr.sh b/Scripts/gen_moltenvk_rev_hdr.sh
-index c49ea4e6..9b7d13d1 100755
---- a/Scripts/gen_moltenvk_rev_hdr.sh
-+++ b/Scripts/gen_moltenvk_rev_hdr.sh
-@@ -2,7 +2,7 @@
-
- # Record the MoltenVK GIT revision as a derived header file suitable for including in a build
- MVK_GIT_REV=$(git rev-parse HEAD)
--MVK_HDR_FILE="${BUILT_PRODUCTS_DIR}/mvkGitRevDerived.h"
-+MVK_HDR_FILE="@@sourceRoot@@/outputs/include/mvkGitRevDerived.h"
-+mkdir -p $(dirname ${MVK_HDR_FILE})
- echo "// Auto-generated by MoltenVK" > "${MVK_HDR_FILE}"
- echo "static const char* mvkRevString = \"${MVK_GIT_REV}\";" >> "${MVK_HDR_FILE}"
--
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index 0e00eac0bac..e8721c9eed0 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -22,41 +22,41 @@
     "5.10": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.10.130-hardened1.patch",
-            "sha256": "13wf4khc1nqljrvmc283145j6wxcd22qvqg8gwrjndqxlb5qb5bl",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.130-hardened1/linux-hardened-5.10.130-hardened1.patch"
+            "name": "linux-hardened-5.10.131-hardened1.patch",
+            "sha256": "00px04xyr8hz73rm0adc0x9fifwcyh2bh0rg0vqc1yjva4kl639d",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.131-hardened1/linux-hardened-5.10.131-hardened1.patch"
         },
-        "sha256": "0b4nm96yvkb9r5rkwlq9vsmllzqvvffdnpyl8dvrgqm8a7caci71",
-        "version": "5.10.130"
+        "sha256": "1ki11mvl3dky7iih90znr47vr66dxnlwrqwg2jkk1hqn5i243i4b",
+        "version": "5.10.131"
     },
     "5.15": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.15.54-hardened1.patch",
-            "sha256": "1zk6lgm9hg4m7pp16l8dhdv4pf0c1x94sfaah1ppjlq8i64704hd",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.54-hardened1/linux-hardened-5.15.54-hardened1.patch"
+            "name": "linux-hardened-5.15.55-hardened1.patch",
+            "sha256": "1nqf97la1sryis600pac0hnivahbhzq1k5q73wg9nmzrc0qjz5w0",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.55-hardened1/linux-hardened-5.15.55-hardened1.patch"
         },
-        "sha256": "0kffavh9mbycqljacmvjd04nfrl4r4v8i0zgvq49qgm7n25m8ksr",
-        "version": "5.15.54"
+        "sha256": "1k7x7fp675wglfd357n7hjidnm3j8zj3gcymyazg6fkcid8bvxhy",
+        "version": "5.15.55"
     },
     "5.18": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.18.11-hardened1.patch",
-            "sha256": "19g8w933srq3p3zsi38j26cda5a43lzkhhla4pcbd54kmvwjyyjl",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.18.11-hardened1/linux-hardened-5.18.11-hardened1.patch"
+            "name": "linux-hardened-5.18.12-hardened1.patch",
+            "sha256": "07wap8qjjn21pxd04ll88kw6cq681ila46ji7i4jbad2dp3p5pcl",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.18.12-hardened1/linux-hardened-5.18.12-hardened1.patch"
         },
-        "sha256": "1bqm32nqas1dvcx5b0qh3cshh3gcmpl8wbkn4adhgxw2lxa8w3g2",
-        "version": "5.18.11"
+        "sha256": "09wmgfrnv1df6jg9v3svwhvnxl0j6h4f240p903xlmgj884lvds0",
+        "version": "5.18.12"
     },
     "5.4": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.4.205-hardened1.patch",
-            "sha256": "074jyvxmk8fhskndxhc80ibprnh1h2f5z16i7b2pp3723dlm5p5l",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.205-hardened1/linux-hardened-5.4.205-hardened1.patch"
+            "name": "linux-hardened-5.4.206-hardened1.patch",
+            "sha256": "0m4jcyvjqfki0asxapn4q9qgyfxw8k6yqcyw899zss8584zqa6i2",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.206-hardened1/linux-hardened-5.4.206-hardened1.patch"
         },
-        "sha256": "1m8ms5nizw3iimhw61kr11a09b6h8cfi8az3wwg4mcpb0k58lqrp",
-        "version": "5.4.205"
+        "sha256": "1asvc7y1f938icspxx39n6y6r0w9mp0k9vik84rsx1hzzv0db41c",
+        "version": "5.4.206"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index 8220a15234b..6de2a35fd47 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "4.14.288";
+  version = "4.14.289";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0yyzxyz66mfngx3ll3pl43413xb67iyxddzh3lpzqcfg7d0rxfwz";
+    sha256 = "1v24mv49skgijcbafgai0glrzwiv2j1hndkz7v6ygc18jxh5fqg6";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix
index c3906f10ebe..c9f0431244d 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "4.19.252";
+  version = "4.19.253";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0ac7k6x9h8gqi37n8d4fyi52h4cmzyy8f5vfv1aiihww4kvzca7v";
+    sha256 = "1jc2j0wskgr1bdzpz6sn2bvafpviiin6mwr93yykcczzfjijr8yz";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index ea492828232..c8e16830f4e 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,12 +1,12 @@
 { buildPackages, fetchurl, perl, buildLinux, nixosTests, stdenv, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.323";
+  version = "4.9.324";
   extraMeta.branch = "4.9";
   extraMeta.broken = stdenv.isAarch64;
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1h96ai9w5q2axhliw85aymdsg8py9y6gl8big5r2gwkbls6h7pa3";
+    sha256 = "0g51vfp0g3py82l3q66p7nvl03h6l1nlny18gangji75a3c39yh4";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.10.nix b/pkgs/os-specific/linux/kernel/linux-5.10.nix
index 495a6ff8b52..93b11cc7890 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.10.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.10.131";
+  version = "5.10.132";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1ki11mvl3dky7iih90znr47vr66dxnlwrqwg2jkk1hqn5i243i4b";
+    sha256 = "0aps3kglzw480ps9agw1k3zn8ipibwkrx13kzijfl7g0xqqsj1bx";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.15.nix b/pkgs/os-specific/linux/kernel/linux-5.15.nix
index 9735868b141..f286e1bfea0 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.15.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.15.55";
+  version = "5.15.56";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1k7x7fp675wglfd357n7hjidnm3j8zj3gcymyazg6fkcid8bvxhy";
+    sha256 = "08w2kgc0v0ld7nxbary7d9fr2vxrsmqby7l4fhf7njgi6wsbp9p9";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.18.nix b/pkgs/os-specific/linux/kernel/linux-5.18.nix
index 2ad48c7afc1..f8844461d79 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.18.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.18.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.18.12";
+  version = "5.18.13";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "09wmgfrnv1df6jg9v3svwhvnxl0j6h4f240p903xlmgj884lvds0";
+    sha256 = "1nkb4wl2v2pflqnfgmas1pmkr8wm14lm1c8py9sa5k1gwvzil3j3";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.4.nix b/pkgs/os-specific/linux/kernel/linux-5.4.nix
index 5fd398d111b..bcd502f7915 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.4.206";
+  version = "5.4.207";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1asvc7y1f938icspxx39n6y6r0w9mp0k9vik84rsx1hzzv0db41c";
+    sha256 = "1wwpd26qhv6i00p0yxjisns6qiz9bfrxvn1xb4ylwr8ls7zyx78v";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
index 0754ff335ba..0ed4c48047a 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.15-rc6";
+  version = "5.19-rc5";
   extraMeta.branch = lib.versions.majorMinor version;
 
   # modDirVersion needs to be x.y.z, will always add .0
@@ -11,7 +11,7 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    sha256 = "1lp3jqwsbd97k3bx4crs8rc2wssyaf0v8x4kl4zv7g7ww2kkg2ii";
+    sha256 = "sha256-eqBbQBZaqexgx6m3jAoU/0HWAdHbAuT3slZWMZhrht0=";
   };
 
   # Should the testing kernels ever be built on Hydra?
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 910541f0ba6..acf965d9950 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -114,7 +114,8 @@ let
       patches =
         map (p: p.patch) kernelPatches
         # Required for deterministic builds along with some postPatch magic.
-        ++ optional (lib.versionAtLeast version "4.13") ./randstruct-provide-seed.patch
+        ++ optional (lib.versionAtLeast version "4.13" && lib.versionOlder version "5.19") ./randstruct-provide-seed.patch
+        ++ optional (lib.versionAtLeast version "5.19") ./randstruct-provide-seed-5.19.patch
         # Fixes determinism by normalizing metadata for the archive of kheaders
         ++ optional (lib.versionAtLeast version "5.2" && lib.versionOlder version "5.4") ./gen-kheaders-metadata.patch;
 
diff --git a/pkgs/os-specific/linux/kernel/randstruct-provide-seed-5.19.patch b/pkgs/os-specific/linux/kernel/randstruct-provide-seed-5.19.patch
new file mode 100644
index 00000000000..5ca897a76bf
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/randstruct-provide-seed-5.19.patch
@@ -0,0 +1,13 @@
+diff --git a/scripts/gen-randstruct-seed.sh b/scripts/gen-randstruct-seed.sh
+index 61017b36c464..7bb494dd2e18 100755
+--- a/scripts/gen-randstruct-seed.sh
++++ b/scripts/gen-randstruct-seed.sh
+@@ -1,7 +1,7 @@
+ #!/bin/sh
+ # SPDX-License-Identifier: GPL-2.0
+ 
+-SEED=$(od -A n -t x8 -N 32 /dev/urandom | tr -d ' \n')
++SEED="NIXOS_RANDSTRUCT_SEED"
+ echo "$SEED" > "$1"
+ HASH=$(echo -n "$SEED" | sha256sum | cut -d" " -f1)
+ echo "#define RANDSTRUCT_HASHED_SEED \"$HASH\"" > "$2"
diff --git a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
index 95004f44794..b85f002e7b8 100755
--- a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
+++ b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
@@ -254,7 +254,7 @@ nixBuild() {
 
 nixFlakeBuild() {
     logVerbose "Building in flake mode."
-    if [[ -z "$buildHost" && -z "$targetHost" && "$action" != switch && "$action" != boot ]]
+    if [[ -z "$buildHost" && -z "$targetHost" && "$action" != switch && "$action" != boot && "$action" != test && "$action" != dry-activate ]]
     then
         runCmd nix "${flakeFlags[@]}" build "$@"
         readlink -f ./result
diff --git a/pkgs/servers/onlyoffice-documentserver/default.nix b/pkgs/servers/onlyoffice-documentserver/default.nix
new file mode 100644
index 00000000000..703eaecf601
--- /dev/null
+++ b/pkgs/servers/onlyoffice-documentserver/default.nix
@@ -0,0 +1,152 @@
+{ lib
+, stdenv
+, buildFHSUserEnvBubblewrap
+, corefonts
+, dejavu_fonts
+, dpkg
+, fetchurl
+, gcc-unwrapped
+, liberation_ttf_v1
+, writeScript
+, xorg
+}:
+
+let
+  # var/www/onlyoffice/documentserver/server/DocService/docservice
+  onlyoffice-documentserver = stdenv.mkDerivation rec {
+    pname = "onlyoffice-documentserver";
+    version = "7.1.1-23";
+
+    src = fetchurl {
+      url = "https://github.com/ONLYOFFICE/DocumentServer/releases/download/v${lib.concatStringsSep "." (lib.take 3 (lib.splitVersion version))}/onlyoffice-documentserver_amd64.deb";
+      sha256 = "sha256-hmQx8htSjFszdSAzJgiU7Lo6ebF7TVRfK8rJbJDhX5Q=";
+    };
+
+    preferLocalBuild = true;
+
+    unpackCmd = "dpkg -x $curSrc source";
+
+    nativeBuildInputs = [
+      dpkg
+    ];
+
+    installPhase = ''
+      # replace dangling symlinks which are not copied into fhs with actually files
+      rm lib/*.so*
+      for file in var/www/onlyoffice/documentserver/server/FileConverter/bin/*.so* ; do
+        ln -rs "$file" lib/$(basename "$file")
+      done
+
+      # NixOS uses systemd, not supervisor
+      rm -rf etc/supervisor
+
+      install -Dm755 usr/bin/documentserver-prepare4shutdown.sh -t $out/bin
+      # maintainer scripts which expect supervisorctl, try to write into the nix store or are handled by nixos modules
+      rm -rf usr/bin
+
+      # .deb default documentation
+      rm -rf usr/share
+
+      # required for bwrap --bind
+      mkdir -p var/lib/onlyoffice/ var/www/onlyoffice/documentserver/fonts/
+
+      mv * $out/
+    '';
+
+    # stripping self extracting javascript binaries likely breaks them
+    dontStrip = true;
+
+    passthru = {
+      fhs = buildFHSUserEnvBubblewrap {
+        name = "onlyoffice-wrapper";
+
+        targetPkgs = pkgs: [
+          gcc-unwrapped.lib
+          onlyoffice-documentserver
+
+          # fonts
+          corefonts
+          dejavu_fonts
+          liberation_ttf_v1
+        ];
+
+        extraBwrapArgs = [
+          "--bind var/lib/onlyoffice/ var/lib/onlyoffice/"
+          "--bind var/lib/onlyoffice/documentserver/sdkjs/common/ var/www/onlyoffice/documentserver/sdkjs/common/"
+          "--bind var/lib/onlyoffice/documentserver/sdkjs/slide/themes/ var/www/onlyoffice/documentserver/sdkjs/slide/themes/"
+          "--bind var/lib/onlyoffice/documentserver/fonts/ var/www/onlyoffice/documentserver/fonts/"
+          "--bind var/lib/onlyoffice/documentserver/server/FileConverter/bin/ var/www/onlyoffice/documentserver/server/FileConverter/bin/"
+        ];
+
+        runScript = writeScript "onlyoffice-documentserver-run-script" ''
+          export NODE_CONFIG_DIR=$2
+          export NODE_DISABLE_COLORS=1
+          export NODE_ENV=production-linux
+
+          if [[ $1 == DocService/docservice ]]; then
+            mkdir -p var/www/onlyoffice/documentserver/sdkjs/slide/themes/
+            # symlinking themes/src breaks discovery in allfontsgen
+            rm -rf var/www/onlyoffice/documentserver/sdkjs/slide/themes/src
+            cp -r ${onlyoffice-documentserver}/var/www/onlyoffice/documentserver/sdkjs/slide/themes/src var/www/onlyoffice/documentserver/sdkjs/slide/themes/
+            chmod -R u+w var/www/onlyoffice/documentserver/sdkjs/slide/themes/
+
+            # onlyoffice places generated files in those directores
+            rm -rf var/www/onlyoffice/documentserver/sdkjs/common/*
+            ${xorg.lndir}/bin/lndir -silent ${onlyoffice-documentserver}/var/www/onlyoffice/documentserver/sdkjs/common/ var/www/onlyoffice/documentserver/sdkjs/common/
+            rm -rf var/www/onlyoffice/documentserver/server/FileConverter/bin/*
+            ${xorg.lndir}/bin/lndir -silent ${onlyoffice-documentserver}/var/www/onlyoffice/documentserver/server/FileConverter/bin/ var/www/onlyoffice/documentserver/server/FileConverter/bin/
+
+            # https://github.com/ONLYOFFICE/document-server-package/blob/master/common/documentserver/bin/documentserver-generate-allfonts.sh.m4
+            echo -n Generating AllFonts.js, please wait...
+            "var/www/onlyoffice/documentserver/server/tools/allfontsgen"\
+              --input="${onlyoffice-documentserver}/var/www/onlyoffice/documentserver/core-fonts"\
+              --allfonts-web="var/www/onlyoffice/documentserver/sdkjs/common/AllFonts.js"\
+              --allfonts="var/www/onlyoffice/documentserver/server/FileConverter/bin/AllFonts.js"\
+              --images="var/www/onlyoffice/documentserver/sdkjs/common/Images"\
+              --selection="var/www/onlyoffice/documentserver/server/FileConverter/bin/font_selection.bin"\
+              --output-web="var/www/onlyoffice/documentserver/fonts"\
+              --use-system="true"
+            echo Done
+
+            echo -n Generating presentation themes, please wait...
+            "var/www/onlyoffice/documentserver/server/tools/allthemesgen"\
+              --converter-dir="var/www/onlyoffice/documentserver/server/FileConverter/bin"\
+              --src="var/www/onlyoffice/documentserver/sdkjs/slide/themes"\
+              --output="var/www/onlyoffice/documentserver/sdkjs/common/Images"
+
+            "var/www/onlyoffice/documentserver/server/tools/allthemesgen"\
+              --converter-dir="var/www/onlyoffice/documentserver/server/FileConverter/bin"\
+              --src="var/www/onlyoffice/documentserver/sdkjs/slide/themes"\
+              --output="var/www/onlyoffice/documentserver/sdkjs/common/Images"\
+              --postfix="ios"\
+              --params="280,224"
+
+            "var/www/onlyoffice/documentserver/server/tools/allthemesgen"\
+              --converter-dir="var/www/onlyoffice/documentserver/server/FileConverter/bin"\
+              --src="var/www/onlyoffice/documentserver/sdkjs/slide/themes"\
+              --output="var/www/onlyoffice/documentserver/sdkjs/common/Images"\
+              --postfix="android"\
+              --params="280,224"
+            echo Done
+          fi
+
+          exec var/www/onlyoffice/documentserver/server/$1
+        '';
+      };
+    };
+
+    meta = with lib; {
+      description = "ONLYOFFICE Document Server is an online office suite comprising viewers and editors";
+      longDescription = ''
+        ONLYOFFICE Document Server is an online office suite comprising viewers and editors for texts, spreadsheets and presentations,
+        fully compatible with Office Open XML formats: .docx, .xlsx, .pptx and enabling collaborative editing in real time.
+      '';
+      homepage = "ONLYOFFICE Document Server is an online office suite comprising viewers and editors";
+      license = licenses.agpl3;
+      platforms = [ "x86_64-linux" ];
+      sourceProvenance = sourceTypes.binaryNativeCode;
+      maintainers = with maintainers; [ SuperSandro2000 ];
+    };
+  };
+in
+onlyoffice-documentserver
diff --git a/pkgs/servers/tailscale/default.nix b/pkgs/servers/tailscale/default.nix
index 5678502454a..ee17c110e1a 100644
--- a/pkgs/servers/tailscale/default.nix
+++ b/pkgs/servers/tailscale/default.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "tailscale";
-  version = "1.26.2";
+  version = "1.28.0";
 
   src = fetchFromGitHub {
     owner = "tailscale";
     repo = "tailscale";
     rev = "v${version}";
-    sha256 = "sha256:0axcqkqrj4l8c63fd316hp0wlndrbry9x3wml7ssah491f4f3g9w";
+    sha256 = "sha256-6h9LAtaDIwQb+oU4zNABJeBOMaiKqWvhxsFbwEQNC4o=";
   };
-  vendorSha256 = "sha256:0b04ihp5ds8vcqv78kjdz5ffn91yid0pn0aq54jawdd4cfb6bmji";
+  vendorSha256 = "sha256-W5QiHhdSP5xPIJWs8LMl+EGu/AE9/aFD2sOZOnDL0yo=";
 
   nativeBuildInputs = lib.optionals stdenv.isLinux [ makeWrapper ];
 
diff --git a/pkgs/servers/web-apps/mediawiki/default.nix b/pkgs/servers/web-apps/mediawiki/default.nix
index 2339c170f16..b34e246fbe2 100644
--- a/pkgs/servers/web-apps/mediawiki/default.nix
+++ b/pkgs/servers/web-apps/mediawiki/default.nix
@@ -2,24 +2,24 @@
 
 stdenv.mkDerivation rec {
   pname = "mediawiki";
-  version = "1.37.2";
+  version = "1.38.1";
 
-  src = with lib; fetchurl {
-    url = "https://releases.wikimedia.org/mediawiki/${versions.majorMinor version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-WD8HS8r87BfaUBQqVvW7/eXDNml31h2RLX5W/Mo72hs=";
+  src = fetchurl {
+    url = "https://releases.wikimedia.org/mediawiki/${lib.versions.majorMinor version}/mediawiki-${version}.tar.gz";
+    sha256 = "sha256-EXNlUloN7xsgnKUIV9ZXNrYlRbh3p1NIpXqF0SZDezE=";
   };
 
-  prePatch = ''
+  postPatch = ''
     sed -i 's|$vars = Installer::getExistingLocalSettings();|$vars = null;|' includes/installer/CliInstaller.php
   '';
 
-  phpConfig = writeText "LocalSettings.php" ''
-  <?php
-    return require(getenv('MEDIAWIKI_CONFIG'));
-  ?>
-  '';
-
-  installPhase = ''
+  installPhase = let
+    phpConfig = writeText "LocalSettings.php" ''
+      <?php
+        return require(getenv('MEDIAWIKI_CONFIG'));
+      ?>
+    '';
+  in ''
     runHook preInstall
 
     mkdir -p $out/share/mediawiki
@@ -34,6 +34,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Plus;
     homepage = "https://www.mediawiki.org/";
     platforms = platforms.all;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ ] ++ teams.c3d2.members;
   };
 }
diff --git a/pkgs/tools/graphics/amber/default.nix b/pkgs/tools/graphics/amber/default.nix
index 4e1948ce87f..c6b4a2c2229 100644
--- a/pkgs/tools/graphics/amber/default.nix
+++ b/pkgs/tools/graphics/amber/default.nix
@@ -2,6 +2,7 @@
 , fetchFromGitHub
 , cmake
 , pkg-config
+, cctools
 , python3
 , vulkan-headers
 , vulkan-loader
@@ -63,6 +64,8 @@ stdenv.mkDerivation rec {
     cmake
     pkg-config
     python3
+  ] ++ lib.optionals stdenv.isDarwin [
+    cctools
   ];
 
   # Tests are disabled so we do not have to pull in googletest and more dependencies
diff --git a/pkgs/tools/graphics/mangohud/default.nix b/pkgs/tools/graphics/mangohud/default.nix
index cdbe39ee38c..e62cfa6b8a8 100644
--- a/pkgs/tools/graphics/mangohud/default.nix
+++ b/pkgs/tools/graphics/mangohud/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , fetchurl
 , substituteAll
 , coreutils
@@ -27,7 +28,12 @@
 , libXNVCtrl
 , wayland
 , spdlog
+, glew
+, glfw
+, nlohmann_json
+, xorg
 , addOpenGLRunpath
+, gamescopeSupport ? true # build mangoapp and mangohudctl
 }:
 
 let
@@ -86,6 +92,12 @@ in stdenv.mkDerivation rec {
       libdbus = dbus.lib;
       inherit hwdata libX11;
     })
+
+    (fetchpatch {
+      name = "allow-system-nlohmann-json.patch";
+      url = "https://github.com/flightlessmango/MangoHud/commit/e1ffa0f85820abea44639438fca2152290c87ee8.patch";
+      sha256 = "sha256-CaJb0RpXmNGCBidMXM39VJVLIXb6NbN5HXWkH/5Sfvo=";
+    })
   ] ++ lib.optional (stdenv.hostPlatform.system == "x86_64-linux") [
     # Support 32bit OpenGL applications by appending the mangohud32
     # lib path to LD_LIBRARY_PATH.
@@ -105,6 +117,10 @@ in stdenv.mkDerivation rec {
     "-Dvulkan_datadir=${vulkan-headers}/share"
     "-Dwith_wayland=enabled"
     "-Duse_system_spdlog=enabled"
+  ] ++ lib.optionals gamescopeSupport [
+    "-Dmangoapp_layer=true"
+    "-Dmangoapp=true"
+    "-Dmangohudctl=true"
   ];
 
   nativeBuildInputs = [
@@ -125,6 +141,12 @@ in stdenv.mkDerivation rec {
     libXNVCtrl
     wayland
     spdlog
+  ] ++ lib.optionals gamescopeSupport [
+    glew
+    glfw
+    nlohmann_json
+    vulkan-headers
+    xorg.libXrandr
   ];
 
   # Support 32bit Vulkan applications by linking in 32bit Vulkan layer
@@ -140,6 +162,12 @@ in stdenv.mkDerivation rec {
     wrapProgram "$out/bin/mangohud" \
       --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ addOpenGLRunpath.driverLink ]} \
       --prefix XDG_DATA_DIRS : "$out/share"
+  '' + lib.optionalString (gamescopeSupport) ''
+    if [[ -e "$out/bin/mangoapp" ]]; then
+      wrapProgram "$out/bin/mangoapp" \
+        --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ addOpenGLRunpath.driverLink ]} \
+        --prefix XDG_DATA_DIRS : "$out/share"
+    fi
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/graphics/pdftoipe/default.nix b/pkgs/tools/graphics/pdftoipe/default.nix
index 950e82e3865..763a1366801 100644
--- a/pkgs/tools/graphics/pdftoipe/default.nix
+++ b/pkgs/tools/graphics/pdftoipe/default.nix
@@ -3,6 +3,7 @@
 , fetchFromGitHub
 , pkg-config
 , poppler
+, fetchpatch
 }:
 
 stdenv.mkDerivation rec {
@@ -15,6 +16,18 @@ stdenv.mkDerivation rec {
     rev = "v${version}";
     sha256 = "jlrjrjzZQo79CKMySayhCm1dqLh89wOQuXrXa2aqc0k=";
   };
+
+  patches = [
+    # Fix build with poppler > 22.03.0
+    # https://github.com/otfried/ipe-tools/pull/48
+    (fetchpatch {
+      url = "https://github.com/otfried/ipe-tools/commit/14335180432152ad094300d0afd00d8e390469b2.patch";
+      sha256 = "sha256-V3FmwG3bR6io/smxjasFJ5K0/u8RSFfdUX41ClGXhFc=";
+      stripLen = 1;
+      name = "poppler_fix_build.patch";
+    })
+  ];
+
   sourceRoot = "source/pdftoipe";
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/tools/graphics/realesrgan-ncnn-vulkan/default.nix b/pkgs/tools/graphics/realesrgan-ncnn-vulkan/default.nix
index d66a06b7eed..b41f2cc49d4 100644
--- a/pkgs/tools/graphics/realesrgan-ncnn-vulkan/default.nix
+++ b/pkgs/tools/graphics/realesrgan-ncnn-vulkan/default.nix
@@ -44,7 +44,8 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [ cmake ];
-  buildInputs = [ vulkan-headers vulkan-loader glslang libgcc libwebp ncnn ];
+  buildInputs = [ vulkan-headers vulkan-loader glslang libwebp ncnn ]
+    ++ lib.optional (!stdenv.isDarwin) libgcc;
 
   postPatch = ''
     substituteInPlace main.cpp --replace REPLACE_MODELS $out/share/models
diff --git a/pkgs/tools/graphics/wgpu-utils/default.nix b/pkgs/tools/graphics/wgpu-utils/default.nix
index 737f7132212..ab5eac27315 100644
--- a/pkgs/tools/graphics/wgpu-utils/default.nix
+++ b/pkgs/tools/graphics/wgpu-utils/default.nix
@@ -1,4 +1,4 @@
-{ lib, rustPlatform, fetchFromGitHub, pkg-config, makeWrapper, vulkan-loader }:
+{ lib, stdenv, rustPlatform, fetchFromGitHub, pkg-config, makeWrapper, vulkan-loader, QuartzCore }:
 
 rustPlatform.buildRustPackage rec {
   pname = "wgpu-utils";
@@ -18,6 +18,8 @@ rustPlatform.buildRustPackage rec {
     makeWrapper
   ];
 
+  buildInputs = lib.optional stdenv.isDarwin QuartzCore;
+
   # Tests fail, as the Nix sandbox doesn't provide an appropriate adapter (e.g. Vulkan).
   doCheck = false;
 
diff --git a/pkgs/tools/misc/eget/default.nix b/pkgs/tools/misc/eget/default.nix
new file mode 100644
index 00000000000..f9337c580ed
--- /dev/null
+++ b/pkgs/tools/misc/eget/default.nix
@@ -0,0 +1,48 @@
+{ lib
+, fetchFromGitHub
+, buildGoModule
+, pandoc
+, installShellFiles
+, nix-update-script
+, testers
+, eget
+}:
+
+buildGoModule rec {
+  pname = "eget";
+  version = "1.1.0";
+
+  src = fetchFromGitHub {
+    owner = "zyedidia";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-+sl98pOc3YSy7LnEWsoPQwUtmY/pgMKOX73glzu+3MM=";
+  };
+
+  vendorSha256 = "sha256-axJqi41Fj+MJnaLzSOnSws9/c/0dSkUAtaWkVXNmFxI=";
+
+  ldflags = [ "-s" "-w" "-X main.Version=v${version}" ];
+
+  nativeBuildInputs = [ pandoc installShellFiles ];
+
+  postInstall = ''
+    pandoc man/eget.md -s -t man -o eget.1
+    installManPage eget.1
+  '';
+
+  passthru = {
+    updateScript = nix-update-script { attrPath = pname; };
+    tests.version = testers.testVersion {
+      package = eget;
+      command = "eget -v";
+      version = "v${version}";
+    };
+  };
+
+  meta = with lib; {
+    description = "Easily install prebuilt binaries from GitHub";
+    homepage = "https://github.com/zyedidia/eget";
+    license = licenses.mit;
+    maintainers = with maintainers; [ zendo ];
+  };
+}
diff --git a/pkgs/tools/misc/ncdu_2/default.nix b/pkgs/tools/misc/ncdu/1.nix
index 0cfb78bcf0b..d1c185c0f23 100644
--- a/pkgs/tools/misc/ncdu_2/default.nix
+++ b/pkgs/tools/misc/ncdu/1.nix
@@ -1,24 +1,16 @@
-{ lib, stdenv, fetchurl, zig, ncurses }:
+{ lib, stdenv, fetchurl, ncurses }:
 
 stdenv.mkDerivation rec {
   pname = "ncdu";
-  version = "2.1.2";
+  version = "1.17";
 
   src = fetchurl {
     url = "https://dev.yorhel.nl/download/${pname}-${version}.tar.gz";
-    sha256 = "sha256-ng1u8DYYo8MWcmv0khe37+Rc7HWLLJF86JLe10Myxtw=";
+    sha256 = "sha256-gQdFqO0as3iMh9OupMwaFO327iJvdkvMOD4CS6Vq2/E=";
   };
 
-  XDG_CACHE_HOME="Cache"; # FIXME This should be set in stdenv
-
-  nativeBuildInputs = [
-    zig
-  ];
-
   buildInputs = [ ncurses ];
 
-  PREFIX = placeholder "out";
-
   meta = with lib; {
     description = "Disk usage analyzer with an ncurses interface";
     homepage = "https://dev.yorhel.nl/ncdu";
diff --git a/pkgs/tools/misc/ncdu/default.nix b/pkgs/tools/misc/ncdu/default.nix
index d1c185c0f23..0cfb78bcf0b 100644
--- a/pkgs/tools/misc/ncdu/default.nix
+++ b/pkgs/tools/misc/ncdu/default.nix
@@ -1,16 +1,24 @@
-{ lib, stdenv, fetchurl, ncurses }:
+{ lib, stdenv, fetchurl, zig, ncurses }:
 
 stdenv.mkDerivation rec {
   pname = "ncdu";
-  version = "1.17";
+  version = "2.1.2";
 
   src = fetchurl {
     url = "https://dev.yorhel.nl/download/${pname}-${version}.tar.gz";
-    sha256 = "sha256-gQdFqO0as3iMh9OupMwaFO327iJvdkvMOD4CS6Vq2/E=";
+    sha256 = "sha256-ng1u8DYYo8MWcmv0khe37+Rc7HWLLJF86JLe10Myxtw=";
   };
 
+  XDG_CACHE_HOME="Cache"; # FIXME This should be set in stdenv
+
+  nativeBuildInputs = [
+    zig
+  ];
+
   buildInputs = [ ncurses ];
 
+  PREFIX = placeholder "out";
+
   meta = with lib; {
     description = "Disk usage analyzer with an ncurses interface";
     homepage = "https://dev.yorhel.nl/ncdu";
diff --git a/pkgs/tools/misc/noti/default.nix b/pkgs/tools/misc/noti/default.nix
index c964a8872f8..ac3ff7a59b7 100644
--- a/pkgs/tools/misc/noti/default.nix
+++ b/pkgs/tools/misc/noti/default.nix
@@ -1,7 +1,13 @@
-{ stdenv, lib, buildGoPackage, fetchFromGitHub
-, Cocoa ? null }:
-
-buildGoPackage rec {
+{ stdenv
+, lib
+, buildGoModule
+, fetchFromGitHub
+, fetchurl
+, Cocoa
+, installShellFiles
+}:
+
+buildGoModule rec {
   pname = "noti";
   version = "3.5.0";
 
@@ -12,17 +18,29 @@ buildGoPackage rec {
     sha256 = "12r9wawwl6x0rfv1kahwkamfa0pjq24z60az9pn9nsi2z1rrlwkd";
   };
 
-  buildInputs = lib.optional stdenv.isDarwin Cocoa;
+  patches = [
+    # update golang.org/x/sys to fix building on aarch64-darwin
+    # using fetchurl because fetchpatch breaks the patch
+    (fetchurl {
+      url = "https://github.com/variadico/noti/commit/a90bccfdb2e6a0adc2e92f9a4e7be64133832ba9.patch";
+      sha256 = "sha256-vSAwuAR9absMSFqGOlzmRZoOGC/jpkmh8CMCVjeleUo=";
+    })
+  ];
 
-  goPackagePath = "github.com/variadico/noti";
+  vendorSha256 = null;
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  buildInputs = lib.optional stdenv.isDarwin Cocoa;
 
   ldflags = [
-    "-X ${goPackagePath}/internal/command.Version=${version}"
+    "-s"
+    "-w"
+    "-X github.com/variadico/noti/internal/command.Version=${version}"
   ];
 
   postInstall = ''
-    install -Dm444 -t $out/share/man/man1 $src/docs/man/*.1
-    install -Dm444 -t $out/share/man/man5 $src/docs/man/*.5
+    installManPage docs/man/*
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/misc/sta/default.nix b/pkgs/tools/misc/sta/default.nix
index 6056fcfa49c..696b79447a7 100644
--- a/pkgs/tools/misc/sta/default.nix
+++ b/pkgs/tools/misc/sta/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation {
   pname = "sta";
-  version = "unstable-2020-05-10";
+  version = "unstable-2021-11-30";
 
   src = fetchFromGitHub {
     owner = "simonccarter";
     repo = "sta";
-    rev = "566e3a77b103aa27a5f77ada8e068edf700f26ef";
-    sha256 = "1v20di90ckl405rj5pn6lxlpxh2m2b3y9h2snjvk0k9sihk7w7d5";
+    rev = "94559e3dfa97d415e3f37b1180b57c17c7222b4f";
+    sha256 = "sha256-AiygCfBze7J1Emy6mc27Dim34eLR7VId9wodUZapIL4=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/tools/misc/yubikey-manager-qt/default.nix b/pkgs/tools/misc/yubikey-manager-qt/default.nix
index 0a5ccda2ced..a193075633d 100644
--- a/pkgs/tools/misc/yubikey-manager-qt/default.nix
+++ b/pkgs/tools/misc/yubikey-manager-qt/default.nix
@@ -1,6 +1,7 @@
 { lib
 , mkDerivation
 , fetchurl
+, imagemagick
 , pcsclite
 , pyotherside
 , python3
@@ -24,6 +25,7 @@ mkDerivation rec {
   nativeBuildInputs = [
     python3.pkgs.wrapPython
     qmake
+    imagemagick
   ];
 
   postPatch = ''
@@ -43,10 +45,25 @@ mkDerivation rec {
   ];
 
   postInstall = ''
-    install -Dt $out/share/applications resources/ykman-gui.desktop
-    install -Dt $out/share/ykman-gui/icons resources/icons/*.{icns,ico,png,xpm}
-    substituteInPlace $out/share/applications/ykman-gui.desktop \
-      --replace 'Exec=ykman-gui' "Exec=$out/bin/ykman-gui"
+    # Desktop files
+    install -D -m0644 resources/ykman-gui.desktop "$out/share/applications/ykman-gui.desktop"
+    substituteInPlace "$out/share/applications/ykman-gui.desktop" \
+      --replace Exec=ykman-gui "Exec=$out/bin/ykman-gui"
+
+    # Icons
+    install -Dt $out/share/ykman-gui/icons resources/icons/*.{icns,ico}
+    install -D -m0644 resources/icons/ykman.png "$out/share/icons/hicolor/128x128/apps/ykman.png"
+    ln -s -- "$out/share/icons/hicolor/128x128/apps/ykman.png" "$out/share/icons/hicolor/128x128/apps/ykman-gui.png"
+    for SIZE in 16 24 32 48 64 96; do
+      # set modify/create for reproducible builds
+      convert -scale ''${SIZE} +set date:create +set date:modify \
+        resources/icons/ykman.png ykman.png
+
+      imageFolder="$out/share/icons/hicolor/''${SIZE}x''${SIZE}/apps"
+      install -D -m0644 ykman.png "$imageFolder/ykman.png"
+      ln -s -- "$imageFolder/ykman.png" "$imageFolder/ykman-gui.png"
+    done
+    unset SIZE imageFolder
   '';
 
   qtWrapperArgs = [
diff --git a/pkgs/tools/security/beyond-identity/default.nix b/pkgs/tools/security/beyond-identity/default.nix
index 15a8ab3882c..eec53d3bf97 100644
--- a/pkgs/tools/security/beyond-identity/default.nix
+++ b/pkgs/tools/security/beyond-identity/default.nix
@@ -5,7 +5,7 @@
 
 let
   pname = "beyond-identity";
-  version = "2.49.0-0";
+  version = "2.60.0-0";
   libPath = lib.makeLibraryPath ([ glib glibc openssl tpm2-tss gtk3 gnome.gnome-keyring polkit polkit_gnome ]);
   meta = with lib; {
     description = "Passwordless MFA identities for workforces, customers, and developers";
@@ -22,7 +22,7 @@ let
 
     src = fetchurl {
       url = "https://packages.beyondidentity.com/public/linux-authenticator/deb/ubuntu/pool/focal/main/b/be/${pname}_${version}/${pname}_${version}_amd64.deb";
-      sha512 = "sha512-+9vwH1r5WW+MqyiwsAFInboaM7o2dc7zvRaKwHC/o2LOBugvUHmUzmZ6uSHilc9zQ5FcHUIIglhkASbFtsvPeA==";
+      sha512 = "sha512-JrHLf7KkJVbJLxx54OTvOSaIzY3+hjX+bpkeBHKX23YriCJssUUvEP6vlbI4r6gjMMFMhW92k0iikAgD1Tr4ug==";
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/tools/security/exploitdb/default.nix b/pkgs/tools/security/exploitdb/default.nix
index 2325374d961..e9c419809ea 100644
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2022-07-12";
+  version = "2022-07-22";
 
   src = fetchFromGitHub {
     owner = "offensive-security";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-fnhiLB5Ga2yWhj0/w94d9gl874ekPJBwiIgK8DapN+w=";
+    hash = "sha256-36zfLPXAeYVJQ448E5xuwrNR4cb7xpjwqOQY/WcteQ0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/jadx/default.nix b/pkgs/tools/security/jadx/default.nix
index 21a0a3c6124..903dfa090f5 100644
--- a/pkgs/tools/security/jadx/default.nix
+++ b/pkgs/tools/security/jadx/default.nix
@@ -2,13 +2,13 @@
 
 let
   pname = "jadx";
-  version = "1.4.2";
+  version = "1.4.3";
 
   src = fetchFromGitHub {
     owner = "skylot";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-WSQyym9RMrCiWlb2O4Cd7/ra2UNTL8XsaSNnSTAmhjs=";
+    hash = "sha256-5Cx5rwXUNnVSbLjkpB6qeudRHI4RVzl6T4zo7Dg9geo=";
   };
 
   deps = stdenv.mkDerivation {
@@ -40,7 +40,7 @@ let
     '';
 
     outputHashMode = "recursive";
-    outputHash = "sha256-LCF03nTC7T2YxlLIWO3zgrbJVTCQOU8Who9NIqvicb4=";
+    outputHash = "sha256-Q7eGZQJZObLyZlp8JyodA3gEAgfh7ub+BNQh/LEm2Nk=";
   };
 in stdenv.mkDerivation {
   inherit pname version src;
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index c8f4cdde0da..90cd965a4b1 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -919,6 +919,7 @@ mapAliases ({
 
   ### N ###
 
+  ncdu_2 = ncdu; # Added 2022-07-22
   nccl = throw "nccl has been renamed to cudaPackages.nccl"; # Added 2022-04-04
   nccl_cudatoolkit_10 = throw "nccl_cudatoolkit_10 has been renamed to cudaPackages_10.nccl"; # Added 2022-04-04
   nccl_cudatoolkit_11 = throw "nccl_cudatoolkit_11 has been renamed to cudaPackages_11.nccl"; # Added 2022-04-04
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 4b7fdff197b..4eef51c847a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2050,7 +2050,9 @@ with pkgs;
 
   betterdiscord-installer = callPackage ../tools/misc/betterdiscord-installer { };
 
-  binocle = callPackage ../applications/misc/binocle { };
+  binocle = callPackage ../applications/misc/binocle {
+    inherit (darwin.apple_sdk.frameworks) AppKit CoreFoundation CoreGraphics CoreVideo Foundation Metal QuartzCore;
+  };
 
   bitwise = callPackage ../tools/misc/bitwise { };
 
@@ -2490,7 +2492,9 @@ with pkgs;
 
   gtklp = callPackage ../tools/misc/gtklp { };
 
-  google-amber = callPackage ../tools/graphics/amber { };
+  google-amber = callPackage ../tools/graphics/amber {
+    inherit (darwin) cctools;
+  };
 
   hakrawler = callPackage ../tools/security/hakrawler { };
 
@@ -4252,7 +4256,6 @@ with pkgs;
 
   noti = callPackage ../tools/misc/noti {
     inherit (darwin.apple_sdk.frameworks) Cocoa;
-    buildGoPackage = buildGo117Package;
   };
 
   notify = callPackage ../tools/misc/notify { };
@@ -5808,6 +5811,8 @@ with pkgs;
 
   efivar = callPackage ../tools/system/efivar { };
 
+  eget = callPackage ../tools/misc/eget { };
+
   evemu = callPackage ../tools/system/evemu { };
 
   # The latest version used by elasticsearch, logstash, kibana and the the beats from elastic.
@@ -12007,7 +12012,9 @@ with pkgs;
     });
   };
 
-  wgpu-utils = callPackage ../tools/graphics/wgpu-utils { };
+  wgpu-utils = callPackage ../tools/graphics/wgpu-utils {
+    inherit (darwin.apple_sdk.frameworks) QuartzCore;
+  };
 
   wg-bond = callPackage ../applications/networking/wg-bond { };
 
@@ -15749,9 +15756,7 @@ with pkgs;
       binutils = binutils;
     };
 
-  dive = callPackage ../development/tools/dive {
-    buildGoModule = buildGo117Module;
-  };
+  dive = callPackage ../development/tools/dive { };
 
   doclifter = callPackage ../development/tools/misc/doclifter { };
 
@@ -22545,6 +22550,8 @@ with pkgs;
 
   oauth2-proxy = callPackage ../servers/oauth2-proxy { };
 
+  onlyoffice-documentserver = callPackage ../servers/onlyoffice-documentserver { };
+
   openbgpd = callPackage ../servers/openbgpd { };
 
   openafs_1_8 = callPackage ../servers/openafs/1.8 { tsmbac = null; ncurses = null; };
@@ -24659,6 +24666,8 @@ with pkgs;
 
   cnstrokeorder = callPackage ../data/fonts/cnstrokeorder {};
 
+  colloid-gtk-theme = callPackage ../data/themes/colloid-gtk-theme { };
+
   comfortaa = callPackage ../data/fonts/comfortaa {};
 
   comic-mono = callPackage ../data/fonts/comic-mono { };
@@ -25282,6 +25291,8 @@ with pkgs;
 
   qogir-icon-theme = callPackage ../data/icons/qogir-icon-theme { };
 
+  qogir-kde = callPackage ../data/themes/qogir-kde { };
+
   qogir-theme = callPackage ../data/themes/qogir { };
 
   quintom-cursor-theme = callPackage ../data/icons/quintom-cursor-theme { };
@@ -27897,6 +27908,8 @@ with pkgs;
     texinfo = texinfo6_7; # Uses @setcontentsaftertitlepage, removed in 6.8.
   };
 
+  avalonia-ilspy = callPackage ../applications/misc/avalonia-ilspy { };
+
   imag = callPackage ../applications/misc/imag {
     inherit (darwin.apple_sdk.frameworks) Security;
   };
@@ -29266,7 +29279,7 @@ with pkgs;
   netcoredbg = callPackage ../development/tools/misc/netcoredbg { };
 
   ncdu = callPackage ../tools/misc/ncdu { };
-  ncdu_2 = callPackage ../tools/misc/ncdu_2 { };
+  ncdu_1 = callPackage ../tools/misc/ncdu/1.nix { };
 
   ncdc = callPackage ../applications/networking/p2p/ncdc { };
 
diff --git a/pkgs/top-level/darwin-packages.nix b/pkgs/top-level/darwin-packages.nix
index 47dd47aedea..27023a991c9 100644
--- a/pkgs/top-level/darwin-packages.nix
+++ b/pkgs/top-level/darwin-packages.nix
@@ -148,7 +148,11 @@ impure-cmds // appleSourcePackages // chooseLibs // {
 
   lsusb = callPackage ../os-specific/darwin/lsusb { };
 
-  moltenvk = callPackage ../os-specific/darwin/moltenvk { };
+  moltenvk = pkgs.darwin.apple_sdk_11_0.callPackage ../os-specific/darwin/moltenvk {
+    inherit (apple_sdk_11_0.frameworks) AppKit Foundation Metal QuartzCore;
+    inherit (apple_sdk_11_0) MacOSX-SDK Libsystem;
+    inherit (pkgs.darwin) cctools sigtool;
+  };
 
   opencflite = callPackage ../os-specific/darwin/opencflite { };
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 4f461c44076..48929f73c96 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6757,6 +6757,8 @@ in {
 
   plaid-python = callPackage ../development/python-modules/plaid-python { };
 
+  plantuml = callPackage ../development/python-modules/plantuml { };
+
   plaster = callPackage ../development/python-modules/plaster { };
 
   plaster-pastedeploy = callPackage ../development/python-modules/plaster-pastedeploy { };