Merge master into staging-next

64 files changed, 890 insertions, 500 deletions

diff --git a/nixos/doc/manual/development/writing-nixos-tests.section.md b/nixos/doc/manual/development/writing-nixos-tests.section.md
index a8c54aa6676..d9749d37da7 100644
--- a/nixos/doc/manual/development/writing-nixos-tests.section.md
+++ b/nixos/doc/manual/development/writing-nixos-tests.section.md
@@ -162,7 +162,9 @@ The following methods are available on machine objects:
     If the command detaches, it must close stdout, as `execute` will wait
     for this to consume all output reliably. This can be achieved by
     redirecting stdout to stderr `>&2`, to `/dev/console`, `/dev/null` or
-    a file.
+    a file. Examples of detaching commands are `sleep 365d &`, where the
+    shell forks a new process that can write to stdout and `xclip -i`, where
+    the `xclip` command itself forks without closing stdout.
     Takes an optional parameter `check_return` that defaults to `True`.
     Setting this parameter to `False` will not check for the return code
     and return -1 instead. This can be used for commands that shut down
@@ -183,7 +185,8 @@ The following methods are available on machine objects:
 
     -   Dereferencing unset variables fail the command.
 
-    -   It will wait for stdout to be closed. See `execute`.
+    -   It will wait for stdout to be closed. See `execute` for the
+        implications.
 
 `fail`
 
diff --git a/nixos/doc/manual/from_md/development/writing-nixos-tests.section.xml b/nixos/doc/manual/from_md/development/writing-nixos-tests.section.xml
index e0fd90f2bac..0d523681b63 100644
--- a/nixos/doc/manual/from_md/development/writing-nixos-tests.section.xml
+++ b/nixos/doc/manual/from_md/development/writing-nixos-tests.section.xml
@@ -271,8 +271,13 @@ start_all()
           for this to consume all output reliably. This can be achieved
           by redirecting stdout to stderr <literal>&gt;&amp;2</literal>,
           to <literal>/dev/console</literal>,
-          <literal>/dev/null</literal> or a file. Takes an optional
-          parameter <literal>check_return</literal> that defaults to
+          <literal>/dev/null</literal> or a file. Examples of detaching
+          commands are <literal>sleep 365d &amp;</literal>, where the
+          shell forks a new process that can write to stdout and
+          <literal>xclip -i</literal>, where the
+          <literal>xclip</literal> command itself forks without closing
+          stdout. Takes an optional parameter
+          <literal>check_return</literal> that defaults to
           <literal>True</literal>. Setting this parameter to
           <literal>False</literal> will not check for the return code
           and return -1 instead. This can be used for commands that shut
@@ -314,7 +319,7 @@ start_all()
           <listitem>
             <para>
               It will wait for stdout to be closed. See
-              <literal>execute</literal>.
+              <literal>execute</literal> for the implications.
             </para>
           </listitem>
         </itemizedlist>
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
index 52b57596d54..eb14b22b22d 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
@@ -450,9 +450,10 @@
         <para>
           The NixOS VM test framework,
           <literal>pkgs.nixosTest</literal>/<literal>make-test-python.nix</literal>,
-          now requires non-terminating commands such as
-          <literal>succeed(&quot;foo &amp;&quot;)</literal> to close
-          stdout. This can be done with a redirect such as
+          now requires detaching commands such as
+          <literal>succeed(&quot;foo &amp;&quot;)</literal> and
+          <literal>succeed(&quot;foo | xclip -i&quot;)</literal> to
+          close stdout. This can be done with a redirect such as
           <literal>succeed(&quot;foo &gt;&amp;2 &amp;&quot;)</literal>.
           This breaking change was necessitated by a race condition
           causing tests to fail or hang. It applies to all methods that
@@ -1858,6 +1859,14 @@ Superuser created successfully.
           </listitem>
         </itemizedlist>
       </listitem>
+      <listitem>
+        <para>
+          <literal>security.pam.services.&lt;name&gt;.makeHomeDir</literal>
+          now uses <literal>umask=0077</literal> instead of
+          <literal>umask=0022</literal> when creating the home
+          directory.
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
 </section>
diff --git a/nixos/doc/manual/release-notes/rl-2111.section.md b/nixos/doc/manual/release-notes/rl-2111.section.md
index 1d567ff7f12..1fe2ae10f58 100644
--- a/nixos/doc/manual/release-notes/rl-2111.section.md
+++ b/nixos/doc/manual/release-notes/rl-2111.section.md
@@ -133,7 +133,7 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 ## Backward Incompatibilities {#sec-release-21.11-incompatibilities}
 
-- The NixOS VM test framework, `pkgs.nixosTest`/`make-test-python.nix`, now requires non-terminating commands such as `succeed("foo &")` to close stdout.
+- The NixOS VM test framework, `pkgs.nixosTest`/`make-test-python.nix`, now requires detaching commands such as `succeed("foo &")` and `succeed("foo | xclip -i")` to close stdout.
   This can be done with a redirect such as `succeed("foo >&2 &")`. This breaking change was necessitated by a race condition causing tests to fail or hang.
   It applies to all methods that invoke commands on the nodes, including `execute`, `succeed`, `fail`, `wait_until_succeeds`, `wait_until_fails`.
 
@@ -516,3 +516,5 @@ In addition to numerous new and upgraded packages, this release has the followin
   - The `services.unifi.dataDir` option is removed and the data is now always located under `/var/lib/unifi/data`. This is done to make better use of systemd state direcotiry and thus making the service restart more reliable.
   - The unifi logs can now be found under: `/var/log/unifi` instead of `/var/lib/unifi/logs`.
   - The unifi run directory can now be found under: `/run/unifi` instead of `/var/lib/unifi/run`.
+
+- `security.pam.services.<name>.makeHomeDir` now uses `umask=0077` instead of `umask=0022` when creating the home directory.
diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix
index 1174d36c1d2..40df6c67ef8 100644
--- a/nixos/modules/security/pam.nix
+++ b/nixos/modules/security/pam.nix
@@ -529,7 +529,7 @@ let
                 ${optionalString (cfg.ttyAudit.disablePattern != null) "disable=${cfg.ttyAudit.disablePattern}"}
               "}
           ${optionalString cfg.makeHomeDir
-              "session required ${pkgs.pam}/lib/security/pam_mkhomedir.so silent skel=${config.security.pam.makeHomeDir.skelDirectory} umask=0022"}
+              "session required ${pkgs.pam}/lib/security/pam_mkhomedir.so silent skel=${config.security.pam.makeHomeDir.skelDirectory} umask=0077"}
           ${optionalString cfg.updateWtmp
               "session required ${pkgs.pam}/lib/security/pam_lastlog.so silent"}
           ${optionalString config.security.pam.enableEcryptfs
diff --git a/nixos/modules/services/networking/ddclient.nix b/nixos/modules/services/networking/ddclient.nix
index 833b0cbcdcf..fd9c216b060 100644
--- a/nixos/modules/services/networking/ddclient.nix
+++ b/nixos/modules/services/networking/ddclient.nix
@@ -28,6 +28,16 @@ let
   '';
   configFile = if (cfg.configFile != null) then cfg.configFile else configFile';
 
+  preStart = ''
+    install ${configFile} /run/${RuntimeDirectory}/ddclient.conf
+    ${lib.optionalString (cfg.configFile == null) (if (cfg.passwordFile != null) then ''
+      password=$(head -n 1 ${cfg.passwordFile})
+      sed -i "s/^password=$/password=$password/" /run/${RuntimeDirectory}/ddclient.conf
+    '' else ''
+      sed -i '/^password=$/d' /run/${RuntimeDirectory}/ddclient.conf
+    '')}
+  '';
+
 in
 
 with lib;
@@ -57,6 +67,15 @@ with lib;
         '';
       };
 
+      package = mkOption {
+        type = package;
+        default = pkgs.ddclient;
+        defaultText = "pkgs.ddclient";
+        description = ''
+          The ddclient executable package run by the service.
+        '';
+      };
+
       domains = mkOption {
         default = [ "" ];
         type = listOf str;
@@ -195,20 +214,13 @@ with lib;
 
       serviceConfig = {
         DynamicUser = true;
+        RuntimeDirectoryMode = "0700";
         inherit RuntimeDirectory;
         inherit StateDirectory;
         Type = "oneshot";
-        ExecStart = "${lib.getBin pkgs.ddclient}/bin/ddclient -file /run/${RuntimeDirectory}/ddclient.conf";
-      };
-      preStart = ''
-        install -m 600 ${configFile} /run/${RuntimeDirectory}/ddclient.conf
-        ${optionalString (cfg.configFile == null) (if (cfg.passwordFile != null) then ''
-          password=$(head -n 1 ${cfg.passwordFile})
-          sed -i "s/^password=$/password=$password/" /run/${RuntimeDirectory}/ddclient.conf
-        '' else ''
-          sed -i '/^password=$/d' /run/${RuntimeDirectory}/ddclient.conf
-        '')}
-      '';
+        ExecStartPre = "!${pkgs.writeShellScript "ddclient-prestart" preStart}";
+        ExecStart = "${lib.getBin cfg.package}/bin/ddclient -file /run/${RuntimeDirectory}/ddclient.conf";
+      };
     };
 
     systemd.timers.ddclient = {
diff --git a/nixos/modules/services/web-apps/mastodon.nix b/nixos/modules/services/web-apps/mastodon.nix
index 2458cb3b594..7910f398048 100644
--- a/nixos/modules/services/web-apps/mastodon.nix
+++ b/nixos/modules/services/web-apps/mastodon.nix
@@ -38,7 +38,7 @@ let
   // (if cfg.smtp.authenticate then { SMTP_LOGIN  = cfg.smtp.user; } else {})
   // cfg.extraConfig;
 
-  systemCallsList = [ "@clock" "@cpu-emulation" "@debug" "@keyring" "@module" "@mount" "@obsolete" "@raw-io" "@reboot" "@setuid" "@swap" ];
+  systemCallsList = [ "@cpu-emulation" "@debug" "@keyring" "@ipc" "@mount" "@obsolete" "@privileged" "@setuid" ];
 
   cfgService = {
     # User and group
@@ -50,6 +50,9 @@ let
     # Logs directory and mode
     LogsDirectory = "mastodon";
     LogsDirectoryMode = "0750";
+    # Proc filesystem
+    ProcSubset = "pid";
+    ProtectProc = "invisible";
     # Access write directories
     UMask = "0027";
     # Capabilities
@@ -74,6 +77,7 @@ let
     MemoryDenyWriteExecute = false;
     RestrictRealtime = true;
     RestrictSUIDSGID = true;
+    RemoveIPC = true;
     PrivateMounts = true;
     # System Call Filtering
     SystemCallArchitectures = "native";
@@ -464,7 +468,7 @@ in {
         Type = "oneshot";
         WorkingDirectory = cfg.package;
         # System Call Filtering
-        SystemCallFilter = "~" + lib.concatStringsSep " " (systemCallsList ++ [ "@resources" ]);
+        SystemCallFilter = [ ("~" + lib.concatStringsSep " " (systemCallsList ++ [ "@resources" ])) "@chown" "pipe" "pipe2" ];
       } // cfgService;
 
       after = [ "network.target" ];
@@ -491,7 +495,7 @@ in {
         EnvironmentFile = "/var/lib/mastodon/.secrets_env";
         WorkingDirectory = cfg.package;
         # System Call Filtering
-        SystemCallFilter = "~" + lib.concatStringsSep " " (systemCallsList ++ [ "@resources" ]);
+        SystemCallFilter = [ ("~" + lib.concatStringsSep " " (systemCallsList ++ [ "@resources" ])) "@chown" "pipe" "pipe2" ];
       } // cfgService;
       after = [ "mastodon-init-dirs.service" "network.target" ] ++ (if databaseActuallyCreateLocally then [ "postgresql.service" ] else []);
       wantedBy = [ "multi-user.target" ];
@@ -517,7 +521,7 @@ in {
         RuntimeDirectory = "mastodon-streaming";
         RuntimeDirectoryMode = "0750";
         # System Call Filtering
-        SystemCallFilter = "~" + lib.concatStringsSep " " (systemCallsList ++ [ "@privileged" "@resources" ]);
+        SystemCallFilter = [ ("~" + lib.concatStringsSep " " (systemCallsList ++ [ "@memlock" "@resources" ])) "pipe" "pipe2" ];
       } // cfgService;
     };
 
@@ -541,7 +545,7 @@ in {
         RuntimeDirectory = "mastodon-web";
         RuntimeDirectoryMode = "0750";
         # System Call Filtering
-        SystemCallFilter = "~" + lib.concatStringsSep " " (systemCallsList ++ [ "@resources" ]);
+        SystemCallFilter = [ ("~" + lib.concatStringsSep " " (systemCallsList ++ [ "@resources" ])) "@chown" "pipe" "pipe2" ];
       } // cfgService;
       path = with pkgs; [ file imagemagick ffmpeg ];
     };
@@ -563,7 +567,7 @@ in {
         EnvironmentFile = "/var/lib/mastodon/.secrets_env";
         WorkingDirectory = cfg.package;
         # System Call Filtering
-        SystemCallFilter = "~" + lib.concatStringsSep " " systemCallsList;
+        SystemCallFilter = [ ("~" + lib.concatStringsSep " " systemCallsList) "@chown" "pipe" "pipe2" ];
       } // cfgService;
       path = with pkgs; [ file imagemagick ffmpeg ];
     };
diff --git a/nixos/modules/services/x11/desktop-managers/plasma5.nix b/nixos/modules/services/x11/desktop-managers/plasma5.nix
index 52b641e23bd..8a1793484e2 100644
--- a/nixos/modules/services/x11/desktop-managers/plasma5.nix
+++ b/nixos/modules/services/x11/desktop-managers/plasma5.nix
@@ -189,6 +189,10 @@ in
       ];
 
       services.xserver.displayManager.sessionPackages = [ pkgs.libsForQt5.plasma5.plasma-workspace ];
+      # Default to be `plasma` (X11) instead of `plasmawayland`, since plasma wayland currently has
+      # many tiny bugs.
+      # See: https://github.com/NixOS/nixpkgs/issues/143272
+      services.xserver.displayManager.defaultSession = mkDefault "plasma";
 
       security.wrappers = {
         kcheckpass = {
diff --git a/nixos/modules/services/x11/display-managers/default.nix b/nixos/modules/services/x11/display-managers/default.nix
index d910ac566d8..bdc46faa7fd 100644
--- a/nixos/modules/services/x11/display-managers/default.nix
+++ b/nixos/modules/services/x11/display-managers/default.nix
@@ -280,7 +280,7 @@ in
             null;
         example = "gnome";
         description = ''
-          Graphical session to pre-select in the session chooser (only effective for GDM and LightDM).
+          Graphical session to pre-select in the session chooser (only effective for GDM, LightDM and SDDM).
 
           On GDM, LightDM and SDDM, it will also be used as a session for auto-login.
         '';
diff --git a/nixos/modules/services/x11/display-managers/sddm.nix b/nixos/modules/services/x11/display-managers/sddm.nix
index 5a4fad9c4cb..529a086381f 100644
--- a/nixos/modules/services/x11/display-managers/sddm.nix
+++ b/nixos/modules/services/x11/display-managers/sddm.nix
@@ -30,6 +30,9 @@ let
       HaltCommand = "/run/current-system/systemd/bin/systemctl poweroff";
       RebootCommand = "/run/current-system/systemd/bin/systemctl reboot";
       Numlock = if cfg.autoNumlock then "on" else "none"; # on, off none
+
+      # Implementation is done via pkgs/applications/display-managers/sddm/sddm-default-session.patch
+      DefaultSession = optionalString (dmcfg.defaultSession != null) "${dmcfg.defaultSession}.desktop";
     };
 
     Theme = {
diff --git a/nixos/tests/chromium.nix b/nixos/tests/chromium.nix
index 1df4def6637..8965646bc5d 100644
--- a/nixos/tests/chromium.nix
+++ b/nixos/tests/chromium.nix
@@ -215,7 +215,7 @@ mapAttrs (channel: chromiumPkg: makeTest rec {
 
         clipboard = machine.succeed(
             ru(
-                "echo void | ${pkgs.xclip}/bin/xclip -i"
+                "echo void | ${pkgs.xclip}/bin/xclip -i >&2"
             )
         )
         machine.succeed(
diff --git a/nixos/tests/seafile.nix b/nixos/tests/seafile.nix
index 17862cff189..70b9ba55457 100644
--- a/nixos/tests/seafile.nix
+++ b/nixos/tests/seafile.nix
@@ -6,7 +6,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
     };
   in {
     name = "seafile";
-    meta = with pkgs.stdenv.lib.maintainers; {
+    meta = with pkgs.lib.maintainers; {
       maintainers = [ kampfschlaefer schmittlauch ];
     };
 
diff --git a/nixos/tests/systemd-boot.nix b/nixos/tests/systemd-boot.nix
index ae3727afaf6..a6742606dbe 100644
--- a/nixos/tests/systemd-boot.nix
+++ b/nixos/tests/systemd-boot.nix
@@ -42,7 +42,7 @@ in
   # Check that specialisations create corresponding boot entries.
   specialisation = makeTest {
     name = "systemd-boot-specialisation";
-    meta.maintainers = with pkgs.stdenv.lib.maintainers; [ lukegb ];
+    meta.maintainers = with pkgs.lib.maintainers; [ lukegb ];
 
     machine = { pkgs, lib, ... }: {
       imports = [ common ];
diff --git a/pkgs/applications/display-managers/sddm/default.nix b/pkgs/applications/display-managers/sddm/default.nix
index 091498fae00..c75aba9d261 100644
--- a/pkgs/applications/display-managers/sddm/default.nix
+++ b/pkgs/applications/display-managers/sddm/default.nix
@@ -19,6 +19,7 @@ in mkDerivation {
 
   patches = [
     ./sddm-ignore-config-mtime.patch
+    ./sddm-default-session.patch
     # Load `/etc/profile` for `environment.variables` with zsh default shell.
     # See: https://github.com/sddm/sddm/pull/1382
     (fetchpatch {
diff --git a/pkgs/applications/display-managers/sddm/sddm-default-session.patch b/pkgs/applications/display-managers/sddm/sddm-default-session.patch
new file mode 100644
index 00000000000..455ebbd4157
--- /dev/null
+++ b/pkgs/applications/display-managers/sddm/sddm-default-session.patch
@@ -0,0 +1,71 @@
+diff --git a/src/common/Configuration.h b/src/common/Configuration.h
+index cf44a62..7bb9c03 100644
+--- a/src/common/Configuration.h
++++ b/src/common/Configuration.h
+@@ -44,6 +44,7 @@ namespace SDDM {
+                                                                                                    "NOTE: Currently ignored if autologin is enabled."));
+         Entry(InputMethod,         QString,     QStringLiteral("qtvirtualkeyboard"),                   _S("Input method module"));
+         Entry(Namespaces,          QStringList, QStringList(),                                  _S("Comma-separated list of Linux namespaces for user session to enter"));
++        Entry(DefaultSession,      QString,     QString(),                                      _S("System-wide default session"));
+         //  Name   Entries (but it's a regular class again)
+         Section(Theme,
+             Entry(ThemeDir,            QString,     _S(DATA_INSTALL_DIR "/themes"),             _S("Theme directory path"));
+diff --git a/src/greeter/SessionModel.cpp b/src/greeter/SessionModel.cpp
+index 1953c76..54fe2f2 100644
+--- a/src/greeter/SessionModel.cpp
++++ b/src/greeter/SessionModel.cpp
+@@ -43,6 +43,7 @@ namespace SDDM {
+         beginResetModel();
+         populate(Session::WaylandSession, mainConfig.Wayland.SessionDir.get());
+         populate(Session::X11Session, mainConfig.X11.SessionDir.get());
++        selectDefaultSession();
+         endResetModel();
+ 
+         // refresh everytime a file is changed, added or removed
+@@ -52,6 +53,7 @@ namespace SDDM {
+             d->sessions.clear();
+             populate(Session::WaylandSession, mainConfig.Wayland.SessionDir.get());
+             populate(Session::X11Session, mainConfig.X11.SessionDir.get());
++            selectDefaultSession();
+             endResetModel();
+         });
+         watcher->addPath(mainConfig.Wayland.SessionDir.get());
+@@ -149,11 +151,25 @@ namespace SDDM {
+             else
+                 delete si;
+         }
++    }
++
++    void SessionModel::selectDefaultSession() {
++        d->lastIndex = 0;
++
+         // find out index of the last session
+         for (int i = 0; i < d->sessions.size(); ++i) {
+             if (d->sessions.at(i)->fileName() == stateConfig.Last.Session.get()) {
+                 d->lastIndex = i;
+-                break;
++                return;
++            }
++        }
++
++        // Otherwise, fallback to system-wide default session.
++        auto defaultSession = mainConfig.DefaultSession.get();
++        for (int i = 0; i < d->sessions.size(); ++i) {
++            if (QFileInfo(d->sessions.at(i)->fileName()).fileName() == defaultSession) {
++                d->lastIndex = i;
++                return;
+             }
+         }
+     }
+diff --git a/src/greeter/SessionModel.h b/src/greeter/SessionModel.h
+index 2e2efa9..a93315c 100644
+--- a/src/greeter/SessionModel.h
++++ b/src/greeter/SessionModel.h
+@@ -58,6 +58,7 @@ namespace SDDM {
+         SessionModelPrivate *d { nullptr };
+ 
+         void populate(Session::Type type, const QString &path);
++        void selectDefaultSession();
+     };
+ }
+ 
diff --git a/pkgs/applications/misc/koreader/default.nix b/pkgs/applications/misc/koreader/default.nix
index af66e2282b4..3d11162241e 100644
--- a/pkgs/applications/misc/koreader/default.nix
+++ b/pkgs/applications/misc/koreader/default.nix
@@ -13,12 +13,12 @@
 let font-droid = nerdfonts.override { fonts = [ "DroidSansMono" ]; };
 in stdenv.mkDerivation rec {
   pname = "koreader";
-  version = "2021.09";
+  version = "2021.10.1";
 
   src = fetchurl {
     url =
       "https://github.com/koreader/koreader/releases/download/v${version}/koreader-${version}-amd64.deb";
-    sha256 = "1q2mbmczx2y5ylriq4k3lbjlpw4pwfq2vvcx06ymax31fsrvix84";
+    sha256 = "sha256-UpDwexBfjlne/uNMTtNjIyZb3TDMYFeDvtwtTFARovw=";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/applications/misc/pipr/default.nix b/pkgs/applications/misc/pipr/default.nix
index 96627f5cccb..2f5ba3e6d9c 100644
--- a/pkgs/applications/misc/pipr/default.nix
+++ b/pkgs/applications/misc/pipr/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "pipr";
-  version = "0.0.15";
+  version = "0.0.16";
 
   src = fetchFromGitHub {
     owner = "ElKowar";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1pbj198nqi27kavz9bm31a3h7h70by6l00046x09yf9n8qjpp01w";
+    sha256 = "sha256-6jtUNhib6iveuZ7qUKK7AllyMKFpZ8OUUaIieFqseY8=";
   };
 
-  cargoSha256 = "05ryaxi479fxzdcl51r1xlqbiasfzxcxgvl4wnxync8qi8q2yqk0";
+  cargoSha256 = "sha256-SLOiX8z8LuQ9VA/lg0lOhqs85MGs0vmeP74cS6sgghI=";
 
   nativeBuildInputs = [ makeWrapper ];
   postFixup = ''
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.json b/pkgs/applications/networking/browsers/chromium/upstream-info.json
index acc11144def..d10615fdec2 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@@ -18,9 +18,9 @@
     }
   },
   "beta": {
-    "version": "96.0.4664.27",
-    "sha256": "1ym9llqmkhlnrmawc0dcnzkvr714kykvdcldkar5yqp0x46k7bi6",
-    "sha256bin64": "1x4y589qmiz0zgkpv17phcl8h5c7qankpfvv6c42w5bysx6mn1f7",
+    "version": "96.0.4664.35",
+    "sha256": "047zc1hl5iwhrgnypl7r5ga2cx1yz26lf1x5cnvdqmarmmkq380m",
+    "sha256bin64": "1cw89fafxxhr85x4vzhxv3jkmqfnxjisc7gj9v8y2ixqpn190hjl",
     "deps": {
       "gn": {
         "version": "2021-09-24",
@@ -31,15 +31,15 @@
     }
   },
   "dev": {
-    "version": "97.0.4682.3",
-    "sha256": "1z2d3r3d4g3ng1p73s243jllvvfkh085vvqz0vaa6pv7c9631pn4",
-    "sha256bin64": "0xravg4jjbwj7vifabz94mfammv0zx754hpa6kynjaqzvlxbax2a",
+    "version": "97.0.4688.2",
+    "sha256": "0a5i64gxb24z5mfvmf50g4fafvqqbj7k5077arnhwzp3xiznld88",
+    "sha256bin64": "0l70qlna8x05rrlcfgv2xyl8g5nlmd42i8n0yc9dw3mwq8m4c4db",
     "deps": {
       "gn": {
-        "version": "2021-10-08",
+        "version": "2021-10-30",
         "url": "https://gn.googlesource.com/gn",
-        "rev": "693f9fb87e4febdd4299db9f73d8d2c958e63148",
-        "sha256": "1qfjj2mdpflry4f9fkagvb76zwfibys4nqz9lddy1zh5nnbd9mff"
+        "rev": "8926696a4186279489cc2b8d768533e61bba73d7",
+        "sha256": "1084lnyb0a1khbgjvak05fcx6jy973wqvsf77n0alxjys18sg2yk"
       }
     }
   },
diff --git a/pkgs/applications/networking/cluster/nixops/poetry-git-overlay.nix b/pkgs/applications/networking/cluster/nixops/poetry-git-overlay.nix
index 75b9471c9e0..b542a1eff95 100644
--- a/pkgs/applications/networking/cluster/nixops/poetry-git-overlay.nix
+++ b/pkgs/applications/networking/cluster/nixops/poetry-git-overlay.nix
@@ -15,8 +15,8 @@ self: super: {
     _: {
       src = pkgs.fetchgit {
         url = "https://github.com/NixOS/nixops-aws.git";
-        rev = "371aedeb7fd53b8978a60dd7c37d3a6c38101c48";
-        sha256 = "15jz9x3ra3hsh6xj4cbri1fvvjk2rplnnhnccz7qc6f176b5r01j";
+        rev = "44f774272bd522cc7e87074c056f2225f771ded0";
+        sha256 = "0x9pv186nkcfisr1c1nxw8gpazkrg546dfl95140rif0xzw3pizx";
       };
     }
   );
diff --git a/pkgs/applications/networking/cluster/nixops/poetry.lock b/pkgs/applications/networking/cluster/nixops/poetry.lock
index 87d8fce2f23..642b063368c 100644
--- a/pkgs/applications/networking/cluster/nixops/poetry.lock
+++ b/pkgs/applications/networking/cluster/nixops/poetry.lock
@@ -38,14 +38,14 @@ python-versions = "*"
 
 [[package]]
 name = "boto3"
-version = "1.18.64"
+version = "1.19.9"
 description = "The AWS SDK for Python"
 category = "main"
 optional = false
 python-versions = ">= 3.6"
 
 [package.dependencies]
-botocore = ">=1.21.64,<1.22.0"
+botocore = ">=1.22.9,<1.23.0"
 jmespath = ">=0.7.1,<1.0.0"
 s3transfer = ">=0.5.0,<0.6.0"
 
@@ -54,7 +54,7 @@ crt = ["botocore[crt] (>=1.21.0,<2.0a0)"]
 
 [[package]]
 name = "botocore"
-version = "1.21.64"
+version = "1.22.9"
 description = "Low-level, data-driven core of boto 3."
 category = "main"
 optional = false
@@ -173,7 +173,7 @@ python-versions = ">=2.6, !=3.0.*, !=3.1.*, !=3.2.*"
 
 [[package]]
 name = "libvirt-python"
-version = "7.8.0"
+version = "7.9.0"
 description = "The libvirt virtualization API python binding"
 category = "main"
 optional = false
@@ -228,7 +228,7 @@ typing-extensions = "^3.7.4"
 type = "git"
 url = "https://github.com/NixOS/nixops-aws.git"
 reference = "master"
-resolved_reference = "371aedeb7fd53b8978a60dd7c37d3a6c38101c48"
+resolved_reference = "44f774272bd522cc7e87074c056f2225f771ded0"
 
 [[package]]
 name = "nixops-encrypted-links"
@@ -344,14 +344,14 @@ resolved_reference = "81a1c2ef424dcf596a97b2e46a58ca73a1dd1ff8"
 
 [[package]]
 name = "packaging"
-version = "21.0"
+version = "21.2"
 description = "Core utilities for Python packages"
 category = "dev"
 optional = false
 python-versions = ">=3.6"
 
 [package.dependencies]
-pyparsing = ">=2.0.2"
+pyparsing = ">=2.0.2,<3"
 
 [[package]]
 name = "pluggy"
@@ -621,12 +621,12 @@ boto = [
     {file = "boto-2.49.0.tar.gz", hash = "sha256:ea0d3b40a2d852767be77ca343b58a9e3a4b00d9db440efb8da74b4e58025e5a"},
 ]
 boto3 = [
-    {file = "boto3-1.18.64-py3-none-any.whl", hash = "sha256:b4d6299dd16a3042b7750cde00fe38d57fd59d3ce242308ba8488618ca931694"},
-    {file = "boto3-1.18.64.tar.gz", hash = "sha256:9223b433b0d3b74f2b9574fb3c384048998343ccd6b608044318a7f9b904f661"},
+    {file = "boto3-1.19.9-py3-none-any.whl", hash = "sha256:efa4aea4d30e93f8913a5731ab4de7b6d2020ee77cdde7e61bfae56670da1a14"},
+    {file = "boto3-1.19.9.tar.gz", hash = "sha256:2fe4edec0e02705059e6baac52e29f97fae6086bf8b817e6ca0e49b48c0fbbf2"},
 ]
 botocore = [
-    {file = "botocore-1.21.64-py3-none-any.whl", hash = "sha256:d57287377e4c7c7d7bf6c5fa39e02994de1d99fced9492a58a00e5a54bae1cca"},
-    {file = "botocore-1.21.64.tar.gz", hash = "sha256:0a30dca4dad7d43fd856e671ace95f9afc4726caa1e22f0ae11b654fc76e0c7d"},
+    {file = "botocore-1.22.9-py3-none-any.whl", hash = "sha256:612d26b58f790d267cc7714e82262104b681db799655b6dd6b64fcd9caf08bef"},
+    {file = "botocore-1.22.9.tar.gz", hash = "sha256:7b59367bace96595e9feeed9765c7178278c55531b2b9e07b7618911e9f0a00b"},
 ]
 certifi = [
     {file = "certifi-2021.10.8-py2.py3-none-any.whl", hash = "sha256:d62a0163eb4c2344ac042ab2bdf75399a71a2d8c7d47eac2e2ee91b9d6339569"},
@@ -699,6 +699,8 @@ cryptography = [
     {file = "cryptography-3.4.8-cp36-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:34dae04a0dce5730d8eb7894eab617d8a70d0c97da76b905de9efb7128ad7085"},
     {file = "cryptography-3.4.8-cp36-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:1eb7bb0df6f6f583dd8e054689def236255161ebbcf62b226454ab9ec663746b"},
     {file = "cryptography-3.4.8-cp36-abi3-manylinux_2_24_x86_64.whl", hash = "sha256:9965c46c674ba8cc572bc09a03f4c649292ee73e1b683adb1ce81e82e9a6a0fb"},
+    {file = "cryptography-3.4.8-cp36-abi3-musllinux_1_1_aarch64.whl", hash = "sha256:3c4129fc3fdc0fa8e40861b5ac0c673315b3c902bbdc05fc176764815b43dd1d"},
+    {file = "cryptography-3.4.8-cp36-abi3-musllinux_1_1_x86_64.whl", hash = "sha256:695104a9223a7239d155d7627ad912953b540929ef97ae0c34c7b8bf30857e89"},
     {file = "cryptography-3.4.8-cp36-abi3-win32.whl", hash = "sha256:21ca464b3a4b8d8e86ba0ee5045e103a1fcfac3b39319727bc0fc58c09c6aff7"},
     {file = "cryptography-3.4.8-cp36-abi3-win_amd64.whl", hash = "sha256:3520667fda779eb788ea00080124875be18f2d8f0848ec00733c0ec3bb8219fc"},
     {file = "cryptography-3.4.8-pp36-pypy36_pp73-manylinux_2_12_x86_64.manylinux2010_x86_64.whl", hash = "sha256:d2a6e5ef66503da51d2110edf6c403dc6b494cc0082f85db12f54e9c5d4c3ec5"},
@@ -732,15 +734,31 @@ jmespath = [
     {file = "jmespath-0.10.0.tar.gz", hash = "sha256:b85d0567b8666149a93172712e68920734333c0ce7e89b78b3e987f71e5ed4f9"},
 ]
 libvirt-python = [
-    {file = "libvirt-python-7.8.0.tar.gz", hash = "sha256:9d07416d66805bf1a17f34491b3ced2ac6c42b6a012ddf9177e0e3ae1b103fd5"},
+    {file = "libvirt-python-7.9.0.tar.gz", hash = "sha256:8535cffa5fbf05185648f9f57a2f71899c3bc12c897d320351c53725a48e5359"},
 ]
 markupsafe = [
+    {file = "MarkupSafe-2.0.1-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:d8446c54dc28c01e5a2dbac5a25f071f6653e6e40f3a8818e8b45d790fe6ef53"},
+    {file = "MarkupSafe-2.0.1-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:36bc903cbb393720fad60fc28c10de6acf10dc6cc883f3e24ee4012371399a38"},
+    {file = "MarkupSafe-2.0.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:2d7d807855b419fc2ed3e631034685db6079889a1f01d5d9dac950f764da3dad"},
+    {file = "MarkupSafe-2.0.1-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.manylinux_2_12_i686.manylinux2010_i686.whl", hash = "sha256:add36cb2dbb8b736611303cd3bfcee00afd96471b09cda130da3581cbdc56a6d"},
+    {file = "MarkupSafe-2.0.1-cp310-cp310-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_12_x86_64.manylinux2010_x86_64.whl", hash = "sha256:168cd0a3642de83558a5153c8bd34f175a9a6e7f6dc6384b9655d2697312a646"},
+    {file = "MarkupSafe-2.0.1-cp310-cp310-musllinux_1_1_aarch64.whl", hash = "sha256:4dc8f9fb58f7364b63fd9f85013b780ef83c11857ae79f2feda41e270468dd9b"},
+    {file = "MarkupSafe-2.0.1-cp310-cp310-musllinux_1_1_i686.whl", hash = "sha256:20dca64a3ef2d6e4d5d615a3fd418ad3bde77a47ec8a23d984a12b5b4c74491a"},
+    {file = "MarkupSafe-2.0.1-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:cdfba22ea2f0029c9261a4bd07e830a8da012291fbe44dc794e488b6c9bb353a"},
+    {file = "MarkupSafe-2.0.1-cp310-cp310-win32.whl", hash = "sha256:99df47edb6bda1249d3e80fdabb1dab8c08ef3975f69aed437cb69d0a5de1e28"},
+    {file = "MarkupSafe-2.0.1-cp310-cp310-win_amd64.whl", hash = "sha256:e0f138900af21926a02425cf736db95be9f4af72ba1bb21453432a07f6082134"},
     {file = "MarkupSafe-2.0.1-cp36-cp36m-macosx_10_9_x86_64.whl", hash = "sha256:f9081981fe268bd86831e5c75f7de206ef275defcb82bc70740ae6dc507aee51"},
     {file = "MarkupSafe-2.0.1-cp36-cp36m-manylinux1_i686.whl", hash = "sha256:0955295dd5eec6cb6cc2fe1698f4c6d84af2e92de33fbcac4111913cd100a6ff"},
     {file = "MarkupSafe-2.0.1-cp36-cp36m-manylinux1_x86_64.whl", hash = "sha256:0446679737af14f45767963a1a9ef7620189912317d095f2d9ffa183a4d25d2b"},
     {file = "MarkupSafe-2.0.1-cp36-cp36m-manylinux2010_i686.whl", hash = "sha256:f826e31d18b516f653fe296d967d700fddad5901ae07c622bb3705955e1faa94"},
     {file = "MarkupSafe-2.0.1-cp36-cp36m-manylinux2010_x86_64.whl", hash = "sha256:fa130dd50c57d53368c9d59395cb5526eda596d3ffe36666cd81a44d56e48872"},
     {file = "MarkupSafe-2.0.1-cp36-cp36m-manylinux2014_aarch64.whl", hash = "sha256:905fec760bd2fa1388bb5b489ee8ee5f7291d692638ea5f67982d968366bef9f"},
+    {file = "MarkupSafe-2.0.1-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:bf5d821ffabf0ef3533c39c518f3357b171a1651c1ff6827325e4489b0e46c3c"},
+    {file = "MarkupSafe-2.0.1-cp36-cp36m-manylinux_2_5_i686.manylinux1_i686.manylinux_2_12_i686.manylinux2010_i686.whl", hash = "sha256:0d4b31cc67ab36e3392bbf3862cfbadac3db12bdd8b02a2731f509ed5b829724"},
+    {file = "MarkupSafe-2.0.1-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_12_x86_64.manylinux2010_x86_64.whl", hash = "sha256:baa1a4e8f868845af802979fcdbf0bb11f94f1cb7ced4c4b8a351bb60d108145"},
+    {file = "MarkupSafe-2.0.1-cp36-cp36m-musllinux_1_1_aarch64.whl", hash = "sha256:deb993cacb280823246a026e3b2d81c493c53de6acfd5e6bfe31ab3402bb37dd"},
+    {file = "MarkupSafe-2.0.1-cp36-cp36m-musllinux_1_1_i686.whl", hash = "sha256:63f3268ba69ace99cab4e3e3b5840b03340efed0948ab8f78d2fd87ee5442a4f"},
+    {file = "MarkupSafe-2.0.1-cp36-cp36m-musllinux_1_1_x86_64.whl", hash = "sha256:8d206346619592c6200148b01a2142798c989edcb9c896f9ac9722a99d4e77e6"},
     {file = "MarkupSafe-2.0.1-cp36-cp36m-win32.whl", hash = "sha256:6c4ca60fa24e85fe25b912b01e62cb969d69a23a5d5867682dd3e80b5b02581d"},
     {file = "MarkupSafe-2.0.1-cp36-cp36m-win_amd64.whl", hash = "sha256:b2f4bf27480f5e5e8ce285a8c8fd176c0b03e93dcc6646477d4630e83440c6a9"},
     {file = "MarkupSafe-2.0.1-cp37-cp37m-macosx_10_9_x86_64.whl", hash = "sha256:0717a7390a68be14b8c793ba258e075c6f4ca819f15edfc2a3a027c823718567"},
@@ -749,14 +767,27 @@ markupsafe = [
     {file = "MarkupSafe-2.0.1-cp37-cp37m-manylinux2010_i686.whl", hash = "sha256:d7f9850398e85aba693bb640262d3611788b1f29a79f0c93c565694658f4071f"},
     {file = "MarkupSafe-2.0.1-cp37-cp37m-manylinux2010_x86_64.whl", hash = "sha256:6a7fae0dd14cf60ad5ff42baa2e95727c3d81ded453457771d02b7d2b3f9c0c2"},
     {file = "MarkupSafe-2.0.1-cp37-cp37m-manylinux2014_aarch64.whl", hash = "sha256:b7f2d075102dc8c794cbde1947378051c4e5180d52d276987b8d28a3bd58c17d"},
+    {file = "MarkupSafe-2.0.1-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:e9936f0b261d4df76ad22f8fee3ae83b60d7c3e871292cd42f40b81b70afae85"},
+    {file = "MarkupSafe-2.0.1-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.manylinux_2_12_i686.manylinux2010_i686.whl", hash = "sha256:2a7d351cbd8cfeb19ca00de495e224dea7e7d919659c2841bbb7f420ad03e2d6"},
+    {file = "MarkupSafe-2.0.1-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_12_x86_64.manylinux2010_x86_64.whl", hash = "sha256:60bf42e36abfaf9aff1f50f52644b336d4f0a3fd6d8a60ca0d054ac9f713a864"},
+    {file = "MarkupSafe-2.0.1-cp37-cp37m-musllinux_1_1_aarch64.whl", hash = "sha256:d6c7ebd4e944c85e2c3421e612a7057a2f48d478d79e61800d81468a8d842207"},
+    {file = "MarkupSafe-2.0.1-cp37-cp37m-musllinux_1_1_i686.whl", hash = "sha256:f0567c4dc99f264f49fe27da5f735f414c4e7e7dd850cfd8e69f0862d7c74ea9"},
+    {file = "MarkupSafe-2.0.1-cp37-cp37m-musllinux_1_1_x86_64.whl", hash = "sha256:89c687013cb1cd489a0f0ac24febe8c7a666e6e221b783e53ac50ebf68e45d86"},
     {file = "MarkupSafe-2.0.1-cp37-cp37m-win32.whl", hash = "sha256:a30e67a65b53ea0a5e62fe23682cfe22712e01f453b95233b25502f7c61cb415"},
     {file = "MarkupSafe-2.0.1-cp37-cp37m-win_amd64.whl", hash = "sha256:611d1ad9a4288cf3e3c16014564df047fe08410e628f89805e475368bd304914"},
+    {file = "MarkupSafe-2.0.1-cp38-cp38-macosx_10_9_universal2.whl", hash = "sha256:5bb28c636d87e840583ee3adeb78172efc47c8b26127267f54a9c0ec251d41a9"},
     {file = "MarkupSafe-2.0.1-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:be98f628055368795d818ebf93da628541e10b75b41c559fdf36d104c5787066"},
     {file = "MarkupSafe-2.0.1-cp38-cp38-manylinux1_i686.whl", hash = "sha256:1d609f577dc6e1aa17d746f8bd3c31aa4d258f4070d61b2aa5c4166c1539de35"},
     {file = "MarkupSafe-2.0.1-cp38-cp38-manylinux1_x86_64.whl", hash = "sha256:7d91275b0245b1da4d4cfa07e0faedd5b0812efc15b702576d103293e252af1b"},
     {file = "MarkupSafe-2.0.1-cp38-cp38-manylinux2010_i686.whl", hash = "sha256:01a9b8ea66f1658938f65b93a85ebe8bc016e6769611be228d797c9d998dd298"},
     {file = "MarkupSafe-2.0.1-cp38-cp38-manylinux2010_x86_64.whl", hash = "sha256:47ab1e7b91c098ab893b828deafa1203de86d0bc6ab587b160f78fe6c4011f75"},
     {file = "MarkupSafe-2.0.1-cp38-cp38-manylinux2014_aarch64.whl", hash = "sha256:97383d78eb34da7e1fa37dd273c20ad4320929af65d156e35a5e2d89566d9dfb"},
+    {file = "MarkupSafe-2.0.1-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:6fcf051089389abe060c9cd7caa212c707e58153afa2c649f00346ce6d260f1b"},
+    {file = "MarkupSafe-2.0.1-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.manylinux_2_12_i686.manylinux2010_i686.whl", hash = "sha256:5855f8438a7d1d458206a2466bf82b0f104a3724bf96a1c781ab731e4201731a"},
+    {file = "MarkupSafe-2.0.1-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_12_x86_64.manylinux2010_x86_64.whl", hash = "sha256:3dd007d54ee88b46be476e293f48c85048603f5f516008bee124ddd891398ed6"},
+    {file = "MarkupSafe-2.0.1-cp38-cp38-musllinux_1_1_aarch64.whl", hash = "sha256:aca6377c0cb8a8253e493c6b451565ac77e98c2951c45f913e0b52facdcff83f"},
+    {file = "MarkupSafe-2.0.1-cp38-cp38-musllinux_1_1_i686.whl", hash = "sha256:04635854b943835a6ea959e948d19dcd311762c5c0c6e1f0e16ee57022669194"},
+    {file = "MarkupSafe-2.0.1-cp38-cp38-musllinux_1_1_x86_64.whl", hash = "sha256:6300b8454aa6930a24b9618fbb54b5a68135092bc666f7b06901f897fa5c2fee"},
     {file = "MarkupSafe-2.0.1-cp38-cp38-win32.whl", hash = "sha256:023cb26ec21ece8dc3907c0e8320058b2e0cb3c55cf9564da612bc325bed5e64"},
     {file = "MarkupSafe-2.0.1-cp38-cp38-win_amd64.whl", hash = "sha256:984d76483eb32f1bcb536dc27e4ad56bba4baa70be32fa87152832cdd9db0833"},
     {file = "MarkupSafe-2.0.1-cp39-cp39-macosx_10_9_universal2.whl", hash = "sha256:2ef54abee730b502252bcdf31b10dacb0a416229b72c18b19e24a4509f273d26"},
@@ -766,6 +797,12 @@ markupsafe = [
     {file = "MarkupSafe-2.0.1-cp39-cp39-manylinux2010_i686.whl", hash = "sha256:4efca8f86c54b22348a5467704e3fec767b2db12fc39c6d963168ab1d3fc9135"},
     {file = "MarkupSafe-2.0.1-cp39-cp39-manylinux2010_x86_64.whl", hash = "sha256:ab3ef638ace319fa26553db0624c4699e31a28bb2a835c5faca8f8acf6a5a902"},
     {file = "MarkupSafe-2.0.1-cp39-cp39-manylinux2014_aarch64.whl", hash = "sha256:f8ba0e8349a38d3001fae7eadded3f6606f0da5d748ee53cc1dab1d6527b9509"},
+    {file = "MarkupSafe-2.0.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:c47adbc92fc1bb2b3274c4b3a43ae0e4573d9fbff4f54cd484555edbf030baf1"},
+    {file = "MarkupSafe-2.0.1-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.manylinux_2_12_i686.manylinux2010_i686.whl", hash = "sha256:37205cac2a79194e3750b0af2a5720d95f786a55ce7df90c3af697bfa100eaac"},
+    {file = "MarkupSafe-2.0.1-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_12_x86_64.manylinux2010_x86_64.whl", hash = "sha256:1f2ade76b9903f39aa442b4aadd2177decb66525062db244b35d71d0ee8599b6"},
+    {file = "MarkupSafe-2.0.1-cp39-cp39-musllinux_1_1_aarch64.whl", hash = "sha256:4296f2b1ce8c86a6aea78613c34bb1a672ea0e3de9c6ba08a960efe0b0a09047"},
+    {file = "MarkupSafe-2.0.1-cp39-cp39-musllinux_1_1_i686.whl", hash = "sha256:9f02365d4e99430a12647f09b6cc8bab61a6564363f313126f775eb4f6ef798e"},
+    {file = "MarkupSafe-2.0.1-cp39-cp39-musllinux_1_1_x86_64.whl", hash = "sha256:5b6d930f030f8ed98e3e6c98ffa0652bdb82601e7a016ec2ab5d7ff23baa78d1"},
     {file = "MarkupSafe-2.0.1-cp39-cp39-win32.whl", hash = "sha256:10f82115e21dc0dfec9ab5c0223652f7197feb168c940f3ef61563fc2d6beb74"},
     {file = "MarkupSafe-2.0.1-cp39-cp39-win_amd64.whl", hash = "sha256:693ce3f9e70a6cf7d2fb9e6c9d8b204b6b39897a2c4a1aa65728d5ac97dcc1d8"},
     {file = "MarkupSafe-2.0.1.tar.gz", hash = "sha256:594c67807fb16238b30c44bdf74f36c02cdf22d1c8cda91ef8a0ed8dabf5620a"},
@@ -779,8 +816,8 @@ nixops-virtd = []
 nixopsvbox = []
 nixos-modules-contrib = []
 packaging = [
-    {file = "packaging-21.0-py3-none-any.whl", hash = "sha256:c86254f9220d55e31cc94d69bade760f0847da8000def4dfe1c6b872fd14ff14"},
-    {file = "packaging-21.0.tar.gz", hash = "sha256:7dc96269f53a4ccec5c0670940a4281106dd0bb343f47b7471f779df49c2fbe7"},
+    {file = "packaging-21.2-py3-none-any.whl", hash = "sha256:14317396d1e8cdb122989b916fa2c7e9ca8e2be9e8060a6eff75b6b7b4d8a7e0"},
+    {file = "packaging-21.2.tar.gz", hash = "sha256:096d689d78ca690e4cd8a89568ba06d07ca097e3306a4381635073ca91479966"},
 ]
 pluggy = [
     {file = "pluggy-0.13.1-py2.py3-none-any.whl", hash = "sha256:966c145cd83c96502c3c3868f50408687b38434af77734af1e9ca461a4081d2d"},
diff --git a/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-lurch/default.nix b/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-lurch/default.nix
index 2170aac16e0..c0497ed86ce 100644
--- a/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-lurch/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-lurch/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "purple-lurch";
-  version = "0.6.7";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "gkdr";
     repo = "lurch";
     rev = "v${version}";
-    sha256 = "029jjqinsfhpv0zgji3sv1cyk54fn9qp176fwy97d1clf0vflxrz";
+    sha256 = "sha256-yyzotKL1Z4B2BxloJndJKemONMPLG9pVDVe2K5AL05g=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/networking/mullvad-vpn/default.nix b/pkgs/applications/networking/mullvad-vpn/default.nix
index 4a5b5708aac..e03d6fa23f5 100644
--- a/pkgs/applications/networking/mullvad-vpn/default.nix
+++ b/pkgs/applications/networking/mullvad-vpn/default.nix
@@ -72,7 +72,7 @@ stdenv.mkDerivation rec {
     mv usr/bin/* $out/bin
     mv opt/Mullvad\ VPN/* $out/share/mullvad
 
-    sed -i 's|\/opt\/Mullvad.*VPN|env MULLVAD_DISABLE_UPDATE_NOTIFICATION=1 '$out'/bin|g' $out/share/applications/mullvad-vpn.desktop
+    sed -i 's|"\/opt\/Mullvad.*VPN|env MULLVAD_DISABLE_UPDATE_NOTIFICATION=1 "'$out'/bin|g' $out/share/applications/mullvad-vpn.desktop
 
     ln -s $out/share/mullvad/mullvad-{gui,vpn} $out/bin/
     ln -s $out/share/mullvad/resources/mullvad-daemon $out/bin/mullvad-daemon
diff --git a/pkgs/applications/networking/nextdns/default.nix b/pkgs/applications/networking/nextdns/default.nix
index 561a1c77b1c..ae7eb49a1c6 100644
--- a/pkgs/applications/networking/nextdns/default.nix
+++ b/pkgs/applications/networking/nextdns/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "nextdns";
-  version = "1.37.2";
+  version = "1.37.3";
 
   src = fetchFromGitHub {
     owner = "nextdns";
     repo = "nextdns";
     rev = "v${version}";
-    sha256 = "sha256-R0n/wRCaQ8WvQer3bBLUmOdIojtfjXU0bs0pTn7L0lc=";
+    sha256 = "sha256-BCDVn4JaRYIexI7NrRDchUl9u4AEJa+An9ItYYJDs3A=";
   };
 
   vendorSha256 = "sha256-YZm+DUrH+1xdJrGjmlajbcsnqVODVbZKivVjmqZ2e48=";
diff --git a/pkgs/applications/video/openshot-qt/default.nix b/pkgs/applications/video/openshot-qt/default.nix
index ac396f4be80..bb6bfa637ce 100644
--- a/pkgs/applications/video/openshot-qt/default.nix
+++ b/pkgs/applications/video/openshot-qt/default.nix
@@ -1,7 +1,14 @@
-{ lib, stdenv, mkDerivationWith, fetchFromGitHub, fetchpatch
-, doxygen, python3Packages, libopenshot
-, wrapGAppsHook, gtk3
-, qtsvg }:
+{ lib
+, stdenv
+, mkDerivationWith
+, fetchFromGitHub
+, doxygen
+, gtk3
+, libopenshot
+, python3Packages
+, qtsvg
+, wrapGAppsHook
+}:
 
 mkDerivationWith python3Packages.buildPythonApplication rec {
   pname = "openshot-qt";
@@ -14,11 +21,23 @@ mkDerivationWith python3Packages.buildPythonApplication rec {
     sha256 = "0pa8iwl217503bjlqg2zlrw5lxyq5hvxrf5apxrh3843hj1w1myv";
   };
 
-  nativeBuildInputs = [ doxygen wrapGAppsHook ];
+  nativeBuildInputs = [
+    doxygen
+    wrapGAppsHook
+  ];
 
-  buildInputs = [ gtk3 ];
+  buildInputs = [
+    gtk3
+  ];
 
-  propagatedBuildInputs = with python3Packages; [ libopenshot pyqt5_with_qtwebkit requests sip_4 httplib2 pyzmq ];
+  propagatedBuildInputs = with python3Packages; [
+    httplib2
+    libopenshot
+    pyqt5_with_qtwebkit
+    pyzmq
+    requests
+    sip_4
+  ];
 
   dontWrapGApps = true;
   dontWrapQtApps = true;
@@ -56,4 +75,9 @@ mkDerivationWith python3Packages.buildPythonApplication rec {
     maintainers = with maintainers; [ AndersonTorres ];
     platforms = with platforms; unix;
   };
+
+  passthru = {
+    inherit libopenshot;
+    inherit (libopenshot) libopenshot-audio;
+  };
 }
diff --git a/pkgs/applications/video/openshot-qt/libopenshot-audio.nix b/pkgs/applications/video/openshot-qt/libopenshot-audio.nix
index c3bcc09cd3f..c5a33af4437 100644
--- a/pkgs/applications/video/openshot-qt/libopenshot-audio.nix
+++ b/pkgs/applications/video/openshot-qt/libopenshot-audio.nix
@@ -1,34 +1,58 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, cmake, doxygen
-, alsa-lib, libX11, libXft, libXrandr, libXinerama, libXext, libXcursor
-, zlib, AGL, Cocoa, Foundation
+{ lib
+, stdenv
+, fetchFromGitHub
+, alsa-lib
+, cmake
+, doxygen
+, libX11
+, libXcursor
+, libXext
+, libXft
+, libXinerama
+, libXrandr
+, pkg-config
+, zlib
+, AGL
+, Cocoa
+, Foundation
 }:
 
-with lib;
 stdenv.mkDerivation rec {
   pname = "libopenshot-audio";
-  version = "0.2.0";
+  version = "0.2.2";
 
   src = fetchFromGitHub {
     owner = "OpenShot";
     repo = "libopenshot-audio";
     rev = "v${version}";
-    sha256 = "13if0m5mvlqly8gmbhschzb9papkgp3yqivklhb949dhy16m8zgf";
+    sha256 = "sha256-XtwTZsj/L/sw/28E7Qr5UyghGlBFFXvbmZLGXBB8vg0=";
   };
 
-  nativeBuildInputs =
-  [ pkg-config cmake doxygen ];
+  nativeBuildInputs = [
+    cmake
+    doxygen
+    pkg-config
+  ];
 
-  buildInputs =
-    optionals stdenv.isLinux [ alsa-lib ]
-    ++ (if stdenv.isDarwin then
-          [ zlib AGL Cocoa Foundation ]
-        else
-          [ libX11 libXft libXrandr libXinerama libXext libXcursor ])
-  ;
+  buildInputs = lib.optionals stdenv.isLinux [
+    alsa-lib
+  ] ++ (if stdenv.isDarwin then [
+      AGL
+      Cocoa
+      Foundation
+      zlib
+    ] else [
+      libX11
+      libXcursor
+      libXext
+      libXft
+      libXinerama
+      libXrandr
+    ]);
 
   doCheck = false;
 
-  meta = {
+  meta = with lib; {
     homepage = "http://openshot.org/";
     description = "High-quality sound editing library";
     longDescription = ''
diff --git a/pkgs/applications/video/openshot-qt/libopenshot.nix b/pkgs/applications/video/openshot-qt/libopenshot.nix
index 246c3d5cab8..8a98010ef64 100644
--- a/pkgs/applications/video/openshot-qt/libopenshot.nix
+++ b/pkgs/applications/video/openshot-qt/libopenshot.nix
@@ -1,56 +1,69 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch
-, pkg-config, cmake, doxygen
-, libopenshot-audio, imagemagick, ffmpeg
-, swig, python3, jsoncpp
-, cppzmq, zeromq
-, qtbase, qtmultimedia
+{ lib
+, stdenv
+, fetchFromGitHub
+, alsa-lib
+, cmake
+, cppzmq
+, doxygen
+, ffmpeg
+, imagemagick
+, jsoncpp
+, libopenshot-audio
 , llvmPackages
+, pkg-config
+, python3
+, qtbase
+, qtmultimedia
+, swig
+, zeromq
 }:
 
-with lib;
 stdenv.mkDerivation rec {
   pname = "libopenshot";
-  version = "0.2.5";
+  version = "0.2.7";
 
   src = fetchFromGitHub {
     owner = "OpenShot";
     repo = "libopenshot";
     rev = "v${version}";
-    sha256 = "1mxjkgjmjzgf628y3rscc6rqf55hxgjpmvwxlncfk1216i5xskwp";
+    sha256 = "sha256-aF8wrPxFIjCy5gw72e/WyL/Wcx9tUGDkrqHS+ZDVK0U=";
   };
 
-  patches = [
-    # Fix build with GCC 10.
-    (fetchpatch {
-      name = "fix-build-with-gcc-10.patch";
-      url = "https://github.com/OpenShot/libopenshot/commit/13290364e7bea54164ab83d973951f2898ad9e23.diff";
-      sha256 = "0i7rpdsr8y9dphil8yq75qbh20vfqjc2hp5ahv0ws58z9wj6ngnz";
-    })
-  ];
-
   postPatch = ''
     sed -i 's/{UNITTEST++_INCLUDE_DIR}/ENV{UNITTEST++_INCLUDE_DIR}/g' tests/CMakeLists.txt
-    sed -i 's/{_REL_PYTHON_MODULE_PATH}/ENV{_REL_PYTHON_MODULE_PATH}/g' src/bindings/python/CMakeLists.txt
+    sed -i 's/{_REL_PYTHON_MODULE_PATH}/ENV{_REL_PYTHON_MODULE_PATH}/g' bindings/python/CMakeLists.txt
     export _REL_PYTHON_MODULE_PATH=$(toPythonPath $out)
   '';
 
-  nativeBuildInputs = [ pkg-config cmake doxygen swig ];
+  nativeBuildInputs = [
+    alsa-lib
+    cmake
+    doxygen
+    pkg-config
+    swig
+  ];
 
-  buildInputs =
-  [ imagemagick ffmpeg python3 jsoncpp
-    cppzmq zeromq qtbase qtmultimedia ]
-    ++ optional stdenv.isDarwin llvmPackages.openmp
-  ;
+  buildInputs = [
+    cppzmq
+    ffmpeg
+    imagemagick
+    jsoncpp
+    libopenshot-audio
+    python3
+    qtbase
+    qtmultimedia
+    zeromq
+  ] ++ lib.optionals stdenv.isDarwin [
+    llvmPackages.openmp
+  ];
 
   dontWrapQtApps = true;
 
-  LIBOPENSHOT_AUDIO_DIR = libopenshot-audio;
-
   doCheck = false;
 
   cmakeFlags = [ "-DENABLE_RUBY=OFF" ];
 
-  meta = {
+  meta = with lib; {
     homepage = "http://openshot.org/";
     description = "Free, open-source video editor library";
     longDescription = ''
@@ -58,8 +71,12 @@ stdenv.mkDerivation rec {
       delivering high quality video editing, animation, and playback solutions
       to the world. API currently supports C++, Python, and Ruby.
     '';
-    license = with licenses; gpl3Plus;
+    license = licenses.gpl3Plus;
     maintainers = with maintainers; [ AndersonTorres ];
-    platforms = with platforms; unix;
+    platforms = platforms.unix;
+  };
+
+  passthru = {
+    inherit libopenshot-audio;
   };
 }
diff --git a/pkgs/build-support/libredirect/default.nix b/pkgs/build-support/libredirect/default.nix
index 42525ec98a7..f87c6d23dd7 100644
--- a/pkgs/build-support/libredirect/default.nix
+++ b/pkgs/build-support/libredirect/default.nix
@@ -38,11 +38,11 @@ stdenv.mkDerivation rec {
 
     install -vD "$libName" "$out/lib/$libName"
 
+    # Provide a setup hook that injects our library into every process.
     mkdir -p "$hook/nix-support"
     cat <<SETUP_HOOK > "$hook/nix-support/setup-hook"
     ${if stdenv.isDarwin then ''
     export DYLD_INSERT_LIBRARIES="$out/lib/$libName"
-    export DYLD_FORCE_FLAT_NAMESPACE=1
     '' else ''
     export LD_PRELOAD="$out/lib/$libName"
     ''}
diff --git a/pkgs/build-support/libredirect/libredirect.c b/pkgs/build-support/libredirect/libredirect.c
index c7058ce123c..7dac4684722 100644
--- a/pkgs/build-support/libredirect/libredirect.c
+++ b/pkgs/build-support/libredirect/libredirect.c
@@ -2,6 +2,7 @@
 #include <stdio.h>
 #include <stdarg.h>
 #include <stdlib.h>
+#include <unistd.h>
 #include <dlfcn.h>
 #include <sys/types.h>
 #include <sys/stat.h>
@@ -13,6 +14,22 @@
 
 #define MAX_REDIRECTS 128
 
+#ifdef __APPLE__
+  struct dyld_interpose {
+    const void * replacement;
+    const void * replacee;
+  };
+  #define WRAPPER(ret, name) static ret _libredirect_wrapper_##name
+  #define LOOKUP_REAL(name) &name
+  #define WRAPPER_DEF(name) \
+    __attribute__((used)) static struct dyld_interpose _libredirect_interpose_##name \
+      __attribute__((section("__DATA,__interpose"))) = { &_libredirect_wrapper_##name, &name };
+#else
+  #define WRAPPER(ret, name) ret name
+  #define LOOKUP_REAL(name) dlsym(RTLD_NEXT, #name)
+  #define WRAPPER_DEF(name)
+#endif
+
 static int nrRedirects = 0;
 static char * from[MAX_REDIRECTS];
 static char * to[MAX_REDIRECTS];
@@ -80,9 +97,9 @@ static int open_needs_mode(int flags)
    it contains only what we needed for programs in Nixpkgs. Just add
    more functions as needed. */
 
-int open(const char * path, int flags, ...)
+WRAPPER(int, open)(const char * path, int flags, ...)
 {
-    int (*open_real) (const char *, int, mode_t) = dlsym(RTLD_NEXT, "open");
+    int (*open_real) (const char *, int, mode_t) = LOOKUP_REAL(open);
     mode_t mode = 0;
     if (open_needs_mode(flags)) {
         va_list ap;
@@ -93,10 +110,12 @@ int open(const char * path, int flags, ...)
     char buf[PATH_MAX];
     return open_real(rewrite(path, buf), flags, mode);
 }
+WRAPPER_DEF(open)
 
-int open64(const char * path, int flags, ...)
+#ifndef __APPLE__
+WRAPPER(int, open64)(const char * path, int flags, ...)
 {
-    int (*open64_real) (const char *, int, mode_t) = dlsym(RTLD_NEXT, "open64");
+    int (*open64_real) (const char *, int, mode_t) = LOOKUP_REAL(open64);
     mode_t mode = 0;
     if (open_needs_mode(flags)) {
         va_list ap;
@@ -107,10 +126,12 @@ int open64(const char * path, int flags, ...)
     char buf[PATH_MAX];
     return open64_real(rewrite(path, buf), flags, mode);
 }
+WRAPPER_DEF(open64)
+#endif
 
-int openat(int dirfd, const char * path, int flags, ...)
+WRAPPER(int, openat)(int dirfd, const char * path, int flags, ...)
 {
-    int (*openat_real) (int, const char *, int, mode_t) = dlsym(RTLD_NEXT, "openat");
+    int (*openat_real) (int, const char *, int, mode_t) = LOOKUP_REAL(openat);
     mode_t mode = 0;
     if (open_needs_mode(flags)) {
         va_list ap;
@@ -121,57 +142,73 @@ int openat(int dirfd, const char * path, int flags, ...)
     char buf[PATH_MAX];
     return openat_real(dirfd, rewrite(path, buf), flags, mode);
 }
+WRAPPER_DEF(openat)
 
-FILE * fopen(const char * path, const char * mode)
+WRAPPER(FILE *, fopen)(const char * path, const char * mode)
 {
-    FILE * (*fopen_real) (const char *, const char *) = dlsym(RTLD_NEXT, "fopen");
+    FILE * (*fopen_real) (const char *, const char *) = LOOKUP_REAL(fopen);
     char buf[PATH_MAX];
     return fopen_real(rewrite(path, buf), mode);
 }
+WRAPPER_DEF(fopen)
 
-FILE * __nss_files_fopen(const char * path)
+#ifndef __APPLE__
+WRAPPER(FILE *, __nss_files_fopen)(const char * path)
 {
-    FILE * (*__nss_files_fopen_real) (const char *) = dlsym(RTLD_NEXT, "__nss_files_fopen");
+    FILE * (*__nss_files_fopen_real) (const char *) = LOOKUP_REAL(__nss_files_fopen);
     char buf[PATH_MAX];
     return __nss_files_fopen_real(rewrite(path, buf));
 }
+WRAPPER_DEF(__nss_files_fopen)
+#endif
 
-FILE * fopen64(const char * path, const char * mode)
+#ifndef __APPLE__
+WRAPPER(FILE *, fopen64)(const char * path, const char * mode)
 {
-    FILE * (*fopen64_real) (const char *, const char *) = dlsym(RTLD_NEXT, "fopen64");
+    FILE * (*fopen64_real) (const char *, const char *) = LOOKUP_REAL(fopen64);
     char buf[PATH_MAX];
     return fopen64_real(rewrite(path, buf), mode);
 }
+WRAPPER_DEF(fopen64)
+#endif
 
-int __xstat(int ver, const char * path, struct stat * st)
+#ifndef __APPLE__
+WRAPPER(int, __xstat)(int ver, const char * path, struct stat * st)
 {
-    int (*__xstat_real) (int ver, const char *, struct stat *) = dlsym(RTLD_NEXT, "__xstat");
+    int (*__xstat_real) (int ver, const char *, struct stat *) = LOOKUP_REAL(__xstat);
     char buf[PATH_MAX];
     return __xstat_real(ver, rewrite(path, buf), st);
 }
+WRAPPER_DEF(__xstat)
+#endif
 
-int __xstat64(int ver, const char * path, struct stat64 * st)
+#ifndef __APPLE__
+WRAPPER(int, __xstat64)(int ver, const char * path, struct stat64 * st)
 {
-    int (*__xstat64_real) (int ver, const char *, struct stat64 *) = dlsym(RTLD_NEXT, "__xstat64");
+    int (*__xstat64_real) (int ver, const char *, struct stat64 *) = LOOKUP_REAL(__xstat64);
     char buf[PATH_MAX];
     return __xstat64_real(ver, rewrite(path, buf), st);
 }
+WRAPPER_DEF(__xstat64)
+#endif
 
-int stat(const char * path, struct stat * st)
+WRAPPER(int, stat)(const char * path, struct stat * st)
 {
-    int (*__stat_real) (const char *, struct stat *) = dlsym(RTLD_NEXT, "stat");
+    int (*__stat_real) (const char *, struct stat *) = LOOKUP_REAL(stat);
     char buf[PATH_MAX];
     return __stat_real(rewrite(path, buf), st);
 }
+WRAPPER_DEF(stat)
 
-int access(const char * path, int mode)
+WRAPPER(int, access)(const char * path, int mode)
 {
-    int (*access_real) (const char *, int mode) = dlsym(RTLD_NEXT, "access");
+    int (*access_real) (const char *, int mode) = LOOKUP_REAL(access);
     char buf[PATH_MAX];
     return access_real(rewrite(path, buf), mode);
 }
+WRAPPER_DEF(access)
 
-int posix_spawn(pid_t * pid, const char * path,
+WRAPPER(int, posix_spawn)(pid_t * pid, const char * path,
     const posix_spawn_file_actions_t * file_actions,
     const posix_spawnattr_t * attrp,
     char * const argv[], char * const envp[])
@@ -179,12 +216,13 @@ int posix_spawn(pid_t * pid, const char * path,
     int (*posix_spawn_real) (pid_t *, const char *,
         const posix_spawn_file_actions_t *,
         const posix_spawnattr_t *,
-        char * const argv[], char * const envp[]) = dlsym(RTLD_NEXT, "posix_spawn");
+        char * const argv[], char * const envp[]) = LOOKUP_REAL(posix_spawn);
     char buf[PATH_MAX];
     return posix_spawn_real(pid, rewrite(path, buf), file_actions, attrp, argv, envp);
 }
+WRAPPER_DEF(posix_spawn)
 
-int posix_spawnp(pid_t * pid, const char * file,
+WRAPPER(int, posix_spawnp)(pid_t * pid, const char * file,
     const posix_spawn_file_actions_t * file_actions,
     const posix_spawnattr_t * attrp,
     char * const argv[], char * const envp[])
@@ -192,43 +230,48 @@ int posix_spawnp(pid_t * pid, const char * file,
     int (*posix_spawnp_real) (pid_t *, const char *,
         const posix_spawn_file_actions_t *,
         const posix_spawnattr_t *,
-        char * const argv[], char * const envp[]) = dlsym(RTLD_NEXT, "posix_spawnp");
+        char * const argv[], char * const envp[]) = LOOKUP_REAL(posix_spawnp);
     char buf[PATH_MAX];
     return posix_spawnp_real(pid, rewrite(file, buf), file_actions, attrp, argv, envp);
 }
+WRAPPER_DEF(posix_spawnp)
 
-int execv(const char * path, char * const argv[])
+WRAPPER(int, execv)(const char * path, char * const argv[])
 {
-    int (*execv_real) (const char * path, char * const argv[]) = dlsym(RTLD_NEXT, "execv");
+    int (*execv_real) (const char * path, char * const argv[]) = LOOKUP_REAL(execv);
     char buf[PATH_MAX];
     return execv_real(rewrite(path, buf), argv);
 }
+WRAPPER_DEF(execv)
 
-int execvp(const char * path, char * const argv[])
+WRAPPER(int, execvp)(const char * path, char * const argv[])
 {
-    int (*_execvp) (const char *, char * const argv[]) = dlsym(RTLD_NEXT, "execvp");
+    int (*_execvp) (const char *, char * const argv[]) = LOOKUP_REAL(execvp);
     char buf[PATH_MAX];
     return _execvp(rewrite(path, buf), argv);
 }
+WRAPPER_DEF(execvp)
 
-int execve(const char * path, char * const argv[], char * const envp[])
+WRAPPER(int, execve)(const char * path, char * const argv[], char * const envp[])
 {
-    int (*_execve) (const char *, char * const argv[], char * const envp[]) = dlsym(RTLD_NEXT, "execve");
+    int (*_execve) (const char *, char * const argv[], char * const envp[]) = LOOKUP_REAL(execve);
     char buf[PATH_MAX];
     return _execve(rewrite(path, buf), argv, envp);
 }
+WRAPPER_DEF(execve)
 
-DIR * opendir(const char * path)
+WRAPPER(DIR *, opendir)(const char * path)
 {
     char buf[PATH_MAX];
-    DIR * (*_opendir) (const char*) = dlsym(RTLD_NEXT, "opendir");
+    DIR * (*_opendir) (const char*) = LOOKUP_REAL(opendir);
 
     return _opendir(rewrite(path, buf));
 }
+WRAPPER_DEF(opendir)
 
 #define SYSTEM_CMD_MAX 512
 
-char *replace_substring(char * source, char * buf, char * replace_string, char * start_ptr, char * suffix_ptr) {
+static char * replace_substring(char * source, char * buf, char * replace_string, char * start_ptr, char * suffix_ptr) {
     char head[SYSTEM_CMD_MAX] = {0};
     strncpy(head, source, start_ptr - source);
 
@@ -241,7 +284,7 @@ char *replace_substring(char * source, char * buf, char * replace_string, char *
     return buf;
 }
 
-char *replace_string(char * buf, char * from, char * to) {
+static char * replace_string(char * buf, char * from, char * to) {
     int num_matches = 0;
     char * matches[SYSTEM_CMD_MAX];
     int from_len = strlen(from);
@@ -264,32 +307,48 @@ char *replace_string(char * buf, char * from, char * to) {
     return buf;
 }
 
-void rewriteSystemCall(const char * command, char * buf) {
-    strcpy(buf, command);
+static void rewriteSystemCall(const char * command, char * buf) {
+    char * p = buf;
+
+    #ifdef __APPLE__
+    // The dyld environment variable is not inherited by the subprocess spawned
+    // by system(), so this hack redefines it.
+    Dl_info info;
+    dladdr(&rewriteSystemCall, &info);
+    p = stpcpy(p, "export DYLD_INSERT_LIBRARIES=");
+    p = stpcpy(p, info.dli_fname);
+    p = stpcpy(p, ";");
+    #endif
+
+    stpcpy(p, command);
+
     for (int n = 0; n < nrRedirects; ++n) {
        replace_string(buf, from[n], to[n]);
     }
 }
 
-int system(const char *command)
+WRAPPER(int, system)(const char *command)
 {
-    int (*_system) (const char*) = dlsym(RTLD_NEXT, "system");
+    int (*_system) (const char*) = LOOKUP_REAL(system);
 
     char newCommand[SYSTEM_CMD_MAX];
     rewriteSystemCall(command, newCommand);
     return _system(newCommand);
 }
+WRAPPER_DEF(system)
 
-int mkdir(const char *path, mode_t mode)
+WRAPPER(int, mkdir)(const char *path, mode_t mode)
 {
-    int (*mkdir_real) (const char *path, mode_t mode) = dlsym(RTLD_NEXT, "mkdir");
+    int (*mkdir_real) (const char *path, mode_t mode) = LOOKUP_REAL(mkdir);
     char buf[PATH_MAX];
     return mkdir_real(rewrite(path, buf), mode);
 }
+WRAPPER_DEF(mkdir)
 
-int mkdirat(int dirfd, const char *path, mode_t mode)
+WRAPPER(int, mkdirat)(int dirfd, const char *path, mode_t mode)
 {
-    int (*mkdirat_real) (int dirfd, const char *path, mode_t mode) = dlsym(RTLD_NEXT, "mkdirat");
+    int (*mkdirat_real) (int dirfd, const char *path, mode_t mode) = LOOKUP_REAL(mkdirat);
     char buf[PATH_MAX];
     return mkdirat_real(dirfd, rewrite(path, buf), mode);
 }
+WRAPPER_DEF(mkdirat)
diff --git a/pkgs/data/icons/tela-icon-theme/default.nix b/pkgs/data/icons/tela-icon-theme/default.nix
index 31745f9b2f1..69f0337fcaa 100644
--- a/pkgs/data/icons/tela-icon-theme/default.nix
+++ b/pkgs/data/icons/tela-icon-theme/default.nix
@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "tela-icon-theme";
-  version = "2021-10-08";
+  version = "2021-11-05";
 
   src = fetchFromGitHub {
     owner = "vinceliuice";
     repo = pname;
     rev = version;
-    sha256 = "sha256-4h6c7asjUC7pqi4GkxCN13LOpVVbjBdvjUMN7sXAlNE=";
+    sha256 = "sha256-mvkgHBdZm6vF+/DS3CRLl1m14U0Lj4Xtz4J/vpJUTQM=";
   };
 
   nativeBuildInputs = [ gtk3 jdupes ];
diff --git a/pkgs/desktops/plasma-5/fetch.sh b/pkgs/desktops/plasma-5/fetch.sh
index b69eba34b15..d6b54869122 100644
--- a/pkgs/desktops/plasma-5/fetch.sh
+++ b/pkgs/desktops/plasma-5/fetch.sh
@@ -1 +1 @@
-WGET_ARGS=( https://download.kde.org/stable/plasma/5.23.1/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.kde.org/stable/plasma/5.23.2/ -A '*.tar.xz' )
diff --git a/pkgs/desktops/plasma-5/plasma-vault/encfs-path.patch b/pkgs/desktops/plasma-5/plasma-vault/0001-encfs-path.patch
index 14f593ea60a..a5e9d8c531e 100644
--- a/pkgs/desktops/plasma-5/plasma-vault/encfs-path.patch
+++ b/pkgs/desktops/plasma-5/plasma-vault/0001-encfs-path.patch
@@ -1,19 +1,31 @@
+From fef6bfe87db4411e3dda2f96741cd8204fe41d85 Mon Sep 17 00:00:00 2001
+From: Thomas Tuegel <ttuegel@mailbox.org>
+Date: Tue, 2 Nov 2021 05:57:50 -0500
+Subject: [PATCH 1/3] encfs path
+
+---
+ kded/engine/backends/encfs/encfsbackend.cpp | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
 diff --git a/kded/engine/backends/encfs/encfsbackend.cpp b/kded/engine/backends/encfs/encfsbackend.cpp
-index 628af7b..6edd38e 100644
+index 2d15fa2..3f49867 100644
 --- a/kded/engine/backends/encfs/encfsbackend.cpp
 +++ b/kded/engine/backends/encfs/encfsbackend.cpp
-@@ -100,12 +100,12 @@ QProcess *EncFsBackend::encfs(const QStringList &arguments) const
+@@ -101,12 +101,12 @@ QProcess *EncFsBackend::encfs(const QStringList &arguments) const
      auto config = KSharedConfig::openConfig(PLASMAVAULT_CONFIG_FILE);
      KConfigGroup backendConfig(config, "EncfsBackend");
-
+ 
 -    return process("encfs", arguments + backendConfig.readEntry("extraMountOptions", QStringList{}), {});
 +    return process(NIXPKGS_ENCFS, arguments + backendConfig.readEntry("extraMountOptions", QStringList{}), {});
  }
-
+ 
  QProcess *EncFsBackend::encfsctl(const QStringList &arguments) const
  {
 -    return process("encfsctl", arguments, {});
 +    return process(NIXPKGS_ENCFSCTL, arguments, {});
  }
-
+ 
  } // namespace PlasmaVault
+-- 
+2.33.1
+
diff --git a/pkgs/desktops/plasma-5/plasma-vault/0002-cryfs-path.patch b/pkgs/desktops/plasma-5/plasma-vault/0002-cryfs-path.patch
new file mode 100644
index 00000000000..4c7567b1507
--- /dev/null
+++ b/pkgs/desktops/plasma-5/plasma-vault/0002-cryfs-path.patch
@@ -0,0 +1,25 @@
+From a89a0d3f9088d272c01ccb9b730d1dbb500f9cb8 Mon Sep 17 00:00:00 2001
+From: Thomas Tuegel <ttuegel@mailbox.org>
+Date: Tue, 2 Nov 2021 05:59:34 -0500
+Subject: [PATCH 2/3] cryfs path
+
+---
+ kded/engine/backends/cryfs/cryfsbackend.cpp | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kded/engine/backends/cryfs/cryfsbackend.cpp b/kded/engine/backends/cryfs/cryfsbackend.cpp
+index 64138b6..1a9fde2 100644
+--- a/kded/engine/backends/cryfs/cryfsbackend.cpp
++++ b/kded/engine/backends/cryfs/cryfsbackend.cpp
+@@ -207,7 +207,7 @@ QProcess *CryFsBackend::cryfs(const QStringList &arguments) const
+     auto config = KSharedConfig::openConfig(PLASMAVAULT_CONFIG_FILE);
+     KConfigGroup backendConfig(config, "CryfsBackend");
+ 
+-    return process("cryfs", arguments + backendConfig.readEntry("extraMountOptions", QStringList{}), {{"CRYFS_FRONTEND", "noninteractive"}});
++    return process(NIXPKGS_CRYFS, arguments + backendConfig.readEntry("extraMountOptions", QStringList{}), {{"CRYFS_FRONTEND", "noninteractive"}});
+ }
+ 
+ } // namespace PlasmaVault
+-- 
+2.33.1
+
diff --git a/pkgs/desktops/plasma-5/plasma-vault/0003-fusermount-path.patch b/pkgs/desktops/plasma-5/plasma-vault/0003-fusermount-path.patch
new file mode 100644
index 00000000000..0d4481c7054
--- /dev/null
+++ b/pkgs/desktops/plasma-5/plasma-vault/0003-fusermount-path.patch
@@ -0,0 +1,25 @@
+From 63571e28c65935f32567c0b179a096d62726b778 Mon Sep 17 00:00:00 2001
+From: Thomas Tuegel <ttuegel@mailbox.org>
+Date: Tue, 2 Nov 2021 06:00:32 -0500
+Subject: [PATCH 3/3] fusermount path
+
+---
+ kded/engine/fusebackend_p.cpp | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kded/engine/fusebackend_p.cpp b/kded/engine/fusebackend_p.cpp
+index 91f3523..1c19d88 100644
+--- a/kded/engine/fusebackend_p.cpp
++++ b/kded/engine/fusebackend_p.cpp
+@@ -86,7 +86,7 @@ QProcess *FuseBackend::process(const QString &executable, const QStringList &arg
+ 
+ QProcess *FuseBackend::fusermount(const QStringList &arguments) const
+ {
+-    return process("fusermount", arguments, {});
++    return process(NIXPKGS_FUSERMOUNT, arguments, {});
+ }
+ 
+ FutureResult<> FuseBackend::initialize(const QString &name, const Device &device, const MountPoint &mountPoint, const Vault::Payload &payload)
+-- 
+2.33.1
+
diff --git a/pkgs/desktops/plasma-5/plasma-vault/cryfs-path.patch b/pkgs/desktops/plasma-5/plasma-vault/cryfs-path.patch
deleted file mode 100644
index 6bab35fe4a9..00000000000
--- a/pkgs/desktops/plasma-5/plasma-vault/cryfs-path.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/kded/engine/backends/cryfs/cryfsbackend.cpp b/kded/engine/backends/cryfs/cryfsbackend.cpp
-index 58a6929..7212980 100644
---- a/kded/engine/backends/cryfs/cryfsbackend.cpp
-+++ b/kded/engine/backends/cryfs/cryfsbackend.cpp
-@@ -241,7 +241,7 @@ QProcess *CryFsBackend::cryfs(const QStringList &arguments) const
-     auto config = KSharedConfig::openConfig(PLASMAVAULT_CONFIG_FILE);
-     KConfigGroup backendConfig(config, "CryfsBackend");
- 
--    return process("cryfs",
-+    return process(NIXPKGS_CRYFS,
-                    arguments + backendConfig.readEntry("extraMountOptions", QStringList{}),
-                    { { "CRYFS_FRONTEND", "noninteractive" } });
- }
diff --git a/pkgs/desktops/plasma-5/plasma-vault/default.nix b/pkgs/desktops/plasma-5/plasma-vault/default.nix
index e016944be45..453ba2b107a 100644
--- a/pkgs/desktops/plasma-5/plasma-vault/default.nix
+++ b/pkgs/desktops/plasma-5/plasma-vault/default.nix
@@ -18,9 +18,9 @@ mkDerivation {
   nativeBuildInputs = [ extra-cmake-modules ];
 
   patches = [
-    ./encfs-path.patch
-    ./cryfs-path.patch
-    ./fusermount-path.patch
+    ./0001-encfs-path.patch
+    ./0002-cryfs-path.patch
+    ./0003-fusermount-path.patch
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/plasma-5/plasma-vault/fusermount-path.patch b/pkgs/desktops/plasma-5/plasma-vault/fusermount-path.patch
deleted file mode 100644
index b2a7866531b..00000000000
--- a/pkgs/desktops/plasma-5/plasma-vault/fusermount-path.patch
+++ /dev/null
@@ -1,18 +0,0 @@
-diff --git a/kded/engine/fusebackend_p.cpp b/kded/engine/fusebackend_p.cpp
-index d07e313..ea7d81c 100644
---- a/kded/engine/fusebackend_p.cpp
-+++ b/kded/engine/fusebackend_p.cpp
-@@ -106,7 +106,7 @@ QProcess *FuseBackend::process(const QString &executable,
- 
- QProcess *FuseBackend::fusermount(const QStringList &arguments) const
- {
--    return process("fusermount", arguments, {});
-+    return process(NIXPKGS_FUSERMOUNT, arguments, {});
- }
- 
- 
-@@ -279,4 +279,3 @@ bool FuseBackend::isOpened(const MountPoint &mountPoint) const
- }
- 
- } // namespace PlasmaVault
--
diff --git a/pkgs/desktops/plasma-5/plasma-workspace/default.nix b/pkgs/desktops/plasma-5/plasma-workspace/default.nix
index f44becda902..927ca7debc2 100644
--- a/pkgs/desktops/plasma-5/plasma-workspace/default.nix
+++ b/pkgs/desktops/plasma-5/plasma-workspace/default.nix
@@ -1,5 +1,5 @@
 {
-  mkDerivation, lib, fetchpatch,
+  mkDerivation, lib,
 
   extra-cmake-modules, kdoctools,
 
@@ -53,12 +53,6 @@ mkDerivation {
     ./0001-startkde.patch
     ./0002-absolute-wallpaper-install-dir.patch
     ./0003-startkde-unit-detection.patch
-    # Included in 5.23.2
-    (fetchpatch {
-      name = "ignore-placeholder-screens";
-      url = "https://invent.kde.org/plasma/plasma-workspace/-/merge_requests/1125.patch";
-      sha256 = "sha256-lvcAxb301lQbfEKPcxMlfap9g7TjHOk50ZYX91RC7gY=";
-    })
   ];
 
   # QT_INSTALL_BINS refers to qtbase, and qdbus is in qttools
diff --git a/pkgs/desktops/plasma-5/srcs.nix b/pkgs/desktops/plasma-5/srcs.nix
index d3df742f999..9e45140d2b6 100644
--- a/pkgs/desktops/plasma-5/srcs.nix
+++ b/pkgs/desktops/plasma-5/srcs.nix
@@ -4,427 +4,427 @@
 
 {
   bluedevil = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/bluedevil-5.23.1.tar.xz";
-      sha256 = "1fxl1v27jk1hnxn7s9cqnw1h0pcghpyr2kxbqlx6fhnk0gp44gra";
-      name = "bluedevil-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/bluedevil-5.23.2.tar.xz";
+      sha256 = "0whg8d95vm6zc4vzdlffyvm5kqhi5b501z3749zx743jx8r125nb";
+      name = "bluedevil-5.23.2.tar.xz";
     };
   };
   breeze = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/breeze-5.23.1.tar.xz";
-      sha256 = "108l31v692f0yp1chbgw7nfjxs9qqyxm491zwg5p1n27jdgxq4dc";
-      name = "breeze-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/breeze-5.23.2.tar.xz";
+      sha256 = "1b2n0wcwfp96k76cmm8llr6cvdxvpb6h17r0r4rnl4ypg36i03sb";
+      name = "breeze-5.23.2.tar.xz";
     };
   };
   breeze-grub = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/breeze-grub-5.23.1.tar.xz";
-      sha256 = "1qmixw5q8i1inx65yn84sc44rbllffmjpzbbrxhjxazfa90kjh63";
-      name = "breeze-grub-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/breeze-grub-5.23.2.tar.xz";
+      sha256 = "0zbych6hyfxjc4rl0m9nij6vgyg66s4b51vm5rjd9p0s6zhipzrl";
+      name = "breeze-grub-5.23.2.tar.xz";
     };
   };
   breeze-gtk = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/breeze-gtk-5.23.1.tar.xz";
-      sha256 = "11yjanh6m52sv717bma5m7is8mmz8raqf3i7xjgd9kiafdbp6rjh";
-      name = "breeze-gtk-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/breeze-gtk-5.23.2.tar.xz";
+      sha256 = "1ays2z6gmy1yx4ka5fjcmymlvq67p2wjwijciw4ambx1bxz6s5ci";
+      name = "breeze-gtk-5.23.2.tar.xz";
     };
   };
   breeze-plymouth = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/breeze-plymouth-5.23.1.tar.xz";
-      sha256 = "0f4lxp4h2aji2gnrbplvs2xmwca0zcq3z1dm4fa31qy7ipr0b9qw";
-      name = "breeze-plymouth-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/breeze-plymouth-5.23.2.tar.xz";
+      sha256 = "1lpri3rnfip9a24wrdm5b959l9lqkgk48l5ngisfly3619jz5aml";
+      name = "breeze-plymouth-5.23.2.tar.xz";
     };
   };
   discover = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/discover-5.23.1.tar.xz";
-      sha256 = "0wgfws2m5x2bgqcx8h50jhvgj98pmyywr5h3f560mxwd3admq9a4";
-      name = "discover-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/discover-5.23.2.tar.xz";
+      sha256 = "0560qrq6c7hd29cjhxvl9qyn4a97vzp5hwgdlbzmrw6kcyjy83cy";
+      name = "discover-5.23.2.tar.xz";
     };
   };
   drkonqi = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/drkonqi-5.23.1.tar.xz";
-      sha256 = "19fksscf29lw4dvdf4s8z97q60yn77w35qmz298myw0n6cd9n1vk";
-      name = "drkonqi-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/drkonqi-5.23.2.tar.xz";
+      sha256 = "0ilg9x2ipncsbjms2l97dd0vdnay4jpsrbvamvfavdffqvzibd9f";
+      name = "drkonqi-5.23.2.tar.xz";
     };
   };
   kactivitymanagerd = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/kactivitymanagerd-5.23.1.tar.xz";
-      sha256 = "02gaky1ibzfkv5gx6hpwksm06jb025k9hb7lqrbp5wbn2j5m3g7a";
-      name = "kactivitymanagerd-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/kactivitymanagerd-5.23.2.tar.xz";
+      sha256 = "1y4bmwwakz9k9rkqslh1n9cnn4jvmrdc0hd760fqsf80z1v7k2dh";
+      name = "kactivitymanagerd-5.23.2.tar.xz";
     };
   };
   kde-cli-tools = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/kde-cli-tools-5.23.1.tar.xz";
-      sha256 = "1qm7s2zdvq4i8lry736npwfy95xkrhwi6zhmqlb5j21y9g2hh6ns";
-      name = "kde-cli-tools-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/kde-cli-tools-5.23.2.tar.xz";
+      sha256 = "1zphp97g3mpz86h00d1blkj568dwfdgvl4jqx81v1s6p7dcr1wl7";
+      name = "kde-cli-tools-5.23.2.tar.xz";
     };
   };
   kdecoration = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/kdecoration-5.23.1.tar.xz";
-      sha256 = "09y3n2ifdkcpp21b15pw2k8jfqhwp19rwqyl31il5js36ymsx1qm";
-      name = "kdecoration-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/kdecoration-5.23.2.tar.xz";
+      sha256 = "0p36grnjfnl71kqqrkvr18pr72mia81x8rnvnzb3r5abc5kbna6k";
+      name = "kdecoration-5.23.2.tar.xz";
     };
   };
   kde-gtk-config = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/kde-gtk-config-5.23.1.tar.xz";
-      sha256 = "0g2p6rnc6qij4mrbz955gpjsda6ck3g0y68rkkkm4849j72pinbx";
-      name = "kde-gtk-config-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/kde-gtk-config-5.23.2.tar.xz";
+      sha256 = "0bwwlqnzdn2w9dsx64hlmy1rgc69549c89lqj0yj858prncb82d6";
+      name = "kde-gtk-config-5.23.2.tar.xz";
     };
   };
   kdeplasma-addons = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/kdeplasma-addons-5.23.1.tar.xz";
-      sha256 = "126rrj22431i1immbrvagndi36bfapxcyjrhy6q7qxlg8lwmmvl4";
-      name = "kdeplasma-addons-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/kdeplasma-addons-5.23.2.tar.xz";
+      sha256 = "0jqbhkmq2w2q6my1vhw07j6lqxmcpb5cn5vaz7pl4ax8rqiy5i76";
+      name = "kdeplasma-addons-5.23.2.tar.xz";
     };
   };
   kgamma5 = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/kgamma5-5.23.1.tar.xz";
-      sha256 = "11d5qdhgxn51q7fs0jmaswxm68wygk7b38kj0f1h665fsc56sxfg";
-      name = "kgamma5-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/kgamma5-5.23.2.tar.xz";
+      sha256 = "168pc6rnxbmwrkpsghfaqjvza0m3cnvzcvlr860lkp91vqqq32b6";
+      name = "kgamma5-5.23.2.tar.xz";
     };
   };
   khotkeys = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/khotkeys-5.23.1.tar.xz";
-      sha256 = "0kz8pgwrcrsqf6zsb3zyx7a4g43svdm7iq6jm9p0ncfjnrl0ks6s";
-      name = "khotkeys-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/khotkeys-5.23.2.tar.xz";
+      sha256 = "1pd2p46cc955z1s34jccqw81ps07nl4q4s4qzra0i831j7xsa9ib";
+      name = "khotkeys-5.23.2.tar.xz";
     };
   };
   kinfocenter = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/kinfocenter-5.23.1.tar.xz";
-      sha256 = "01690mvak6i7c17ksfar8793c33y7x391pw5bfa0ggm428k8jbz1";
-      name = "kinfocenter-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/kinfocenter-5.23.2.tar.xz";
+      sha256 = "0bgdgd0n68fb5kaqdqyng9fvf3mjparrnjdp246i68kkclci5nym";
+      name = "kinfocenter-5.23.2.tar.xz";
     };
   };
   kmenuedit = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/kmenuedit-5.23.1.tar.xz";
-      sha256 = "124imx7afbihdp3d10yap6ww9404b63va35h4hfsr5dglfmjfhpk";
-      name = "kmenuedit-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/kmenuedit-5.23.2.tar.xz";
+      sha256 = "1jr25zdplndjhw8qb6c2xf255v73c85pcy7ps7x80g0y34pz2h1x";
+      name = "kmenuedit-5.23.2.tar.xz";
     };
   };
   kscreen = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/kscreen-5.23.1.tar.xz";
-      sha256 = "1j8z8dgp7l0iccyblnq5mf6xysaa17z0ljw9zwvq8ir57cnky55g";
-      name = "kscreen-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/kscreen-5.23.2.tar.xz";
+      sha256 = "1wc0ydyi5vbm3mpjqrkcxjz22gsz2xzw3xw48161z9aikfhhn44v";
+      name = "kscreen-5.23.2.tar.xz";
     };
   };
   kscreenlocker = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/kscreenlocker-5.23.1.tar.xz";
-      sha256 = "0qxmmchl73s9ci0b8by5j6ik8aikwd1xcxyfxhp3fhav519i7i50";
-      name = "kscreenlocker-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/kscreenlocker-5.23.2.tar.xz";
+      sha256 = "1yfqj5g7zvayah53pz0bgmmz8q8hd2rmk5ndzacfl7qrz3dxq2g6";
+      name = "kscreenlocker-5.23.2.tar.xz";
     };
   };
   ksshaskpass = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/ksshaskpass-5.23.1.tar.xz";
-      sha256 = "0azb195s2f068k2vj9piby36lh786gvkzvnnajzs74pmqpl8kay1";
-      name = "ksshaskpass-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/ksshaskpass-5.23.2.tar.xz";
+      sha256 = "1icb5z7hnyrhh29krp5pgxm214w4lkq4k29laa8a1jryp3igqm1l";
+      name = "ksshaskpass-5.23.2.tar.xz";
     };
   };
   ksystemstats = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/ksystemstats-5.23.1.tar.xz";
-      sha256 = "0zkag07lhrz5d7bwhl4lyj2cxh0is9z8z9lavl1dmwfnjs86a0z6";
-      name = "ksystemstats-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/ksystemstats-5.23.2.tar.xz";
+      sha256 = "0m1ijvqr5b09b4hmr81hi5wvf8d79vg36hkmq9r2digr76pf1ni4";
+      name = "ksystemstats-5.23.2.tar.xz";
     };
   };
   kwallet-pam = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/kwallet-pam-5.23.1.tar.xz";
-      sha256 = "02jycjh7l437f2r9a2861yd8j7ayy0f63qkda67703p4va412rk3";
-      name = "kwallet-pam-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/kwallet-pam-5.23.2.tar.xz";
+      sha256 = "105dpcb6zskqkbnhd5sl4igb0r87dza383m0qqffqfriwvjf9v6z";
+      name = "kwallet-pam-5.23.2.tar.xz";
     };
   };
   kwayland-integration = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/kwayland-integration-5.23.1.tar.xz";
-      sha256 = "0shdq4wrb2p7agc1ds6vm49g75bsizsmlwdikq5sqpgzbgv10dgp";
-      name = "kwayland-integration-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/kwayland-integration-5.23.2.tar.xz";
+      sha256 = "0fchl5bjyn9vkj2rzqhlg3jzi2gp993l3c6skviyfqkvp3fq91bl";
+      name = "kwayland-integration-5.23.2.tar.xz";
     };
   };
   kwayland-server = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/kwayland-server-5.23.1.tar.xz";
-      sha256 = "0mwxllkqgmvr7lq0kkikndn68y6mxl9hmfm8kjmnq95zq5nimbgb";
-      name = "kwayland-server-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/kwayland-server-5.23.2.tar.xz";
+      sha256 = "03cc0hm99gyr07kbk6vkqxs3nngsnl51smbpwg5rb3lycij38f1j";
+      name = "kwayland-server-5.23.2.tar.xz";
     };
   };
   kwin = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/kwin-5.23.1.tar.xz";
-      sha256 = "0ccbb41xsa257vabd17m3fx9h760izizgy9xrg9mpg5shjmxff2q";
-      name = "kwin-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/kwin-5.23.2.tar.xz";
+      sha256 = "1fpq3r93lk0wmzckd8jkw4fcdggl75mjyj59j9ivijnb8an7vfpz";
+      name = "kwin-5.23.2.tar.xz";
     };
   };
   kwrited = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/kwrited-5.23.1.tar.xz";
-      sha256 = "16sg4mffwhpx5c2dp6zki9128zjpkcyjlm8nd8jdkcdq5ww4f4pk";
-      name = "kwrited-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/kwrited-5.23.2.tar.xz";
+      sha256 = "1czaq3gzyb5v153626rxb54512nkhlpsypf4aghdr9c32n12vgd4";
+      name = "kwrited-5.23.2.tar.xz";
     };
   };
   layer-shell-qt = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/layer-shell-qt-5.23.1.tar.xz";
-      sha256 = "02lyzc93ymz5jr05sy5pf1aqyx098q3jhzxk28k6fslzxq327767";
-      name = "layer-shell-qt-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/layer-shell-qt-5.23.2.tar.xz";
+      sha256 = "0pw9k1g7g5fjq6hkmri546pph1rycyay97gvw8ngzx67v0n9phlg";
+      name = "layer-shell-qt-5.23.2.tar.xz";
     };
   };
   libkscreen = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/libkscreen-5.23.1.tar.xz";
-      sha256 = "0hyh0j95i0xrbh07770axby3lqhmiclzxwx1bplmnpayymwdac1r";
-      name = "libkscreen-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/libkscreen-5.23.2.tar.xz";
+      sha256 = "1shlw9wa01ilfhh57i6752mm62qjhj0w0q5qz6kvga3gmzmwp6sf";
+      name = "libkscreen-5.23.2.tar.xz";
     };
   };
   libksysguard = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/libksysguard-5.23.1.tar.xz";
-      sha256 = "12c1qy736036rfvk42pnb0z32sjqfk4x4069v7iycy4nd91xyg88";
-      name = "libksysguard-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/libksysguard-5.23.2.tar.xz";
+      sha256 = "1knbik3r2bv11vzc17k9971bgrd7dsk9d7j4s5323schymmbzypq";
+      name = "libksysguard-5.23.2.tar.xz";
     };
   };
   milou = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/milou-5.23.1.tar.xz";
-      sha256 = "047z4dklk7hixk6m0xw2y2mhrdzmczz1ikhzvxnxhgmghm3w14cg";
-      name = "milou-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/milou-5.23.2.tar.xz";
+      sha256 = "0nshc6bbbjyrs2sah1q0y5msrdhhrzz24fbgqvh871csb9lh3idz";
+      name = "milou-5.23.2.tar.xz";
     };
   };
   oxygen = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/oxygen-5.23.1.tar.xz";
-      sha256 = "0dxj1fr8p6dnlqwr5bs3f8s1g12vndapc8b07h6hzhcwi26wm81f";
-      name = "oxygen-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/oxygen-5.23.2.tar.xz";
+      sha256 = "1k2bibgwdzwad87xyr31231b5jfk2m2x348layz41f3zl33mj1cp";
+      name = "oxygen-5.23.2.tar.xz";
     };
   };
   plasma-browser-integration = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/plasma-browser-integration-5.23.1.tar.xz";
-      sha256 = "1yaayy60dgj652rjzhh659anspw4cf7rqgmzdw471nzds3zpfr6x";
-      name = "plasma-browser-integration-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/plasma-browser-integration-5.23.2.tar.xz";
+      sha256 = "08zf8qjcq538fg7zpw73qdcvp4a88vxvvm297y7gch37h9nrbmgg";
+      name = "plasma-browser-integration-5.23.2.tar.xz";
     };
   };
   plasma-desktop = {
-    version = "5.23.1";
+    version = "5.23.2.1";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/plasma-desktop-5.23.1.tar.xz";
-      sha256 = "102fkhmh33xw7w2sq20d5v4576apyqp9dwh8v3nwd8vfjbq6lv7f";
-      name = "plasma-desktop-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/plasma-desktop-5.23.2.1.tar.xz";
+      sha256 = "0d2r6bxj04078acdlv6dzvy4jamcj1d49bafa4430hcqrxjy8scg";
+      name = "plasma-desktop-5.23.2.1.tar.xz";
     };
   };
   plasma-disks = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/plasma-disks-5.23.1.tar.xz";
-      sha256 = "11cssgdz4h9ln4738gphg544f9jmzmzax3chq1pp7dzk8cgh4fxq";
-      name = "plasma-disks-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/plasma-disks-5.23.2.tar.xz";
+      sha256 = "0phv135v4jav17nb2f7cwvmcxk6sqr582jvw1y34vfphjgg8z3kw";
+      name = "plasma-disks-5.23.2.tar.xz";
     };
   };
   plasma-firewall = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/plasma-firewall-5.23.1.tar.xz";
-      sha256 = "066b36kxycffwmhgls51q8hpww06j2v2hcc9z4bzmix7jhpzkk0w";
-      name = "plasma-firewall-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/plasma-firewall-5.23.2.tar.xz";
+      sha256 = "1h0zjzx7anhsbpx64q6pg3nh3w329nap3d1sqz5jg2iishql8jnz";
+      name = "plasma-firewall-5.23.2.tar.xz";
     };
   };
   plasma-integration = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/plasma-integration-5.23.1.tar.xz";
-      sha256 = "0wfbvp6r6nh7x8q4ddhf19bnkvlcspcxy2hjsb2nnr0nvs3k8aya";
-      name = "plasma-integration-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/plasma-integration-5.23.2.tar.xz";
+      sha256 = "116hnkfwh4q1ssmayqjx1slam3fmhmdqwd89bc5rzhw0amf1vvy8";
+      name = "plasma-integration-5.23.2.tar.xz";
     };
   };
   plasma-nano = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/plasma-nano-5.23.1.tar.xz";
-      sha256 = "1ybd12jkw3sbcqzv8pqmkrvww1l73igb907zv457ha5rwy9hi60a";
-      name = "plasma-nano-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/plasma-nano-5.23.2.tar.xz";
+      sha256 = "110d5qwlfg6jngxf19kqgzj0j8izqyqid0pvd10dwahp7sbsrq3q";
+      name = "plasma-nano-5.23.2.tar.xz";
     };
   };
   plasma-nm = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/plasma-nm-5.23.1.tar.xz";
-      sha256 = "0qsh5wrk97i9nxpp3la6fp6fvrk0f0gxh71nrzr0c9bc7307imfi";
-      name = "plasma-nm-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/plasma-nm-5.23.2.tar.xz";
+      sha256 = "0pphzdm5ccl045jvzp83lrcscrhrng12a7sl3mjqa1ghzfbyg2x0";
+      name = "plasma-nm-5.23.2.tar.xz";
     };
   };
   plasma-pa = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/plasma-pa-5.23.1.tar.xz";
-      sha256 = "0zm5clsj9lfdv0v80g7bzb2cldcghaqn0d9nwywwrpmclmqik7x7";
-      name = "plasma-pa-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/plasma-pa-5.23.2.tar.xz";
+      sha256 = "05f3hfvp387l968w1h8mwydzvm4kdvyyz1zvphpws8x2izwgjksn";
+      name = "plasma-pa-5.23.2.tar.xz";
     };
   };
   plasma-phone-components = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/plasma-phone-components-5.23.1.tar.xz";
-      sha256 = "174wvb5jrzsfmn09q4qspf3rdi5nr6faf2n1zc9p1dkwn67pkml2";
-      name = "plasma-phone-components-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/plasma-phone-components-5.23.2.tar.xz";
+      sha256 = "1rfkxs3v37768fw51wm850smj75c3bcyl3xxl256kqm9rcb4n1gk";
+      name = "plasma-phone-components-5.23.2.tar.xz";
     };
   };
   plasma-sdk = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/plasma-sdk-5.23.1.tar.xz";
-      sha256 = "1sqywr9d6ghyyff713z1v45207ivddda5hxd7dzpxaf36nb3imq0";
-      name = "plasma-sdk-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/plasma-sdk-5.23.2.tar.xz";
+      sha256 = "043qpvx6kwzpm80cqvr40y5dhw45ivb5qzc902jfc1288l3qgh1s";
+      name = "plasma-sdk-5.23.2.tar.xz";
     };
   };
   plasma-systemmonitor = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/plasma-systemmonitor-5.23.1.tar.xz";
-      sha256 = "1kqrkjz8iks5h737a6hpbb104gbaxangrwlzjfgi2h280j2288f8";
-      name = "plasma-systemmonitor-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/plasma-systemmonitor-5.23.2.tar.xz";
+      sha256 = "0nsva84h46kx7hyv3qz2jmqgiw9mdglyxlhz3x1ywl0m4g91mgq7";
+      name = "plasma-systemmonitor-5.23.2.tar.xz";
     };
   };
   plasma-tests = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/plasma-tests-5.23.1.tar.xz";
-      sha256 = "1cnn9s9cw6p5aidbsj7ysarcp9jdlxpa54zm0gy9cxp5jbz4hypm";
-      name = "plasma-tests-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/plasma-tests-5.23.2.tar.xz";
+      sha256 = "0b8mb39vgxlrrsllyq8x83ny4i302w0hs9dgbjg909fmwddlz3k3";
+      name = "plasma-tests-5.23.2.tar.xz";
     };
   };
   plasma-thunderbolt = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/plasma-thunderbolt-5.23.1.tar.xz";
-      sha256 = "138irsg1mqq31i9rn0ddrhbjym23c1r1w5y1mhrvaqwxqqd5yp0a";
-      name = "plasma-thunderbolt-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/plasma-thunderbolt-5.23.2.tar.xz";
+      sha256 = "13h5ai0bq3nafsaa2bmgdsy10ychlqm8rnvfqypkx9y52jy9jcwc";
+      name = "plasma-thunderbolt-5.23.2.tar.xz";
     };
   };
   plasma-vault = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/plasma-vault-5.23.1.tar.xz";
-      sha256 = "0kwcbdm48pg907sah734xnknsa8azlpasxnj9xnagqi91kly5ay5";
-      name = "plasma-vault-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/plasma-vault-5.23.2.tar.xz";
+      sha256 = "0d9iynky3fxsd6lr7db51aynjz7yz51n21brgwghld4dyfyh0hsf";
+      name = "plasma-vault-5.23.2.tar.xz";
     };
   };
   plasma-workspace = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/plasma-workspace-5.23.1.tar.xz";
-      sha256 = "1bggh6xrlcxa5yh5398a2bhrgqnzv6hw6ifwws7wrkdkazw7kygv";
-      name = "plasma-workspace-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/plasma-workspace-5.23.2.tar.xz";
+      sha256 = "0wivjcl5s6llsq8vhi2qiw6gj0a6vppaqvmd1qihpsxgrb763lnv";
+      name = "plasma-workspace-5.23.2.tar.xz";
     };
   };
   plasma-workspace-wallpapers = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/plasma-workspace-wallpapers-5.23.1.tar.xz";
-      sha256 = "1aplxn4kd48rc5p7x5218iscwlp2sr2sh5qyyl43z28fns0bh9pv";
-      name = "plasma-workspace-wallpapers-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/plasma-workspace-wallpapers-5.23.2.tar.xz";
+      sha256 = "00aam10k8zmlzw0v9jv5k0gwcjizrvpcyd3nx8m3zyiv6b2jw1g9";
+      name = "plasma-workspace-wallpapers-5.23.2.tar.xz";
     };
   };
   plymouth-kcm = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/plymouth-kcm-5.23.1.tar.xz";
-      sha256 = "1fdsw7mfcfa90598981w2yb23nbwjqh9ncr8y0ab0l3i0qf8c727";
-      name = "plymouth-kcm-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/plymouth-kcm-5.23.2.tar.xz";
+      sha256 = "1qgg2d5lrnv5g42ikjnyby3lkxm6iaa1kxw13sdzyv5s6234q7qp";
+      name = "plymouth-kcm-5.23.2.tar.xz";
     };
   };
   polkit-kde-agent = {
-    version = "1-5.23.1";
+    version = "1-5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/polkit-kde-agent-1-5.23.1.tar.xz";
-      sha256 = "0agmrd64jpvkiy4636hyi7cv9wrj7w6krqihz3d6fm84gqiifrj1";
-      name = "polkit-kde-agent-1-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/polkit-kde-agent-1-5.23.2.tar.xz";
+      sha256 = "1fldyflcpwhjym9z3rsi90mfjan15w28gwd1s53kiy2fzvmvj0a0";
+      name = "polkit-kde-agent-1-5.23.2.tar.xz";
     };
   };
   powerdevil = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/powerdevil-5.23.1.tar.xz";
-      sha256 = "15n0xm2yzwinjs33iwgg3jln7ddrc3rvj4m97ya3j16bsqw5j6kj";
-      name = "powerdevil-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/powerdevil-5.23.2.tar.xz";
+      sha256 = "0f6nhla8gsxil4i0f6np9vjs7f4hgikfw0m6zwp67qqlh9n83mxi";
+      name = "powerdevil-5.23.2.tar.xz";
     };
   };
   qqc2-breeze-style = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/qqc2-breeze-style-5.23.1.tar.xz";
-      sha256 = "087mqgs9gdrwykqncvm0vvwhrnl77qilp89gmcgkr44kdsnp5682";
-      name = "qqc2-breeze-style-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/qqc2-breeze-style-5.23.2.tar.xz";
+      sha256 = "09bpvydpinqhc5vrx92fzw9ga6xynpvzxhwrq95dwdp3801kwkgy";
+      name = "qqc2-breeze-style-5.23.2.tar.xz";
     };
   };
   sddm-kcm = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/sddm-kcm-5.23.1.tar.xz";
-      sha256 = "0i40yj686dfrvkd78msczzh9ffslccnjgmwps29rz1fr8kvjj9mp";
-      name = "sddm-kcm-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/sddm-kcm-5.23.2.tar.xz";
+      sha256 = "0xq9qyy56vhrwa0m4yvhp0all8m13jzhyhflc2y0d82cb4sn10yh";
+      name = "sddm-kcm-5.23.2.tar.xz";
     };
   };
   systemsettings = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/systemsettings-5.23.1.tar.xz";
-      sha256 = "0m3fvxr9l1whdgkd9i3wc2gw6yb12di59ihkdxnbbir5j4qm3m3w";
-      name = "systemsettings-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/systemsettings-5.23.2.tar.xz";
+      sha256 = "0vr22bj0nwp55qximbdn47y4208nhybqiz8pc6fqr2hdg9582s8i";
+      name = "systemsettings-5.23.2.tar.xz";
     };
   };
   xdg-desktop-portal-kde = {
-    version = "5.23.1";
+    version = "5.23.2";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.1/xdg-desktop-portal-kde-5.23.1.tar.xz";
-      sha256 = "1bpjq6nd7yc3az9zl13jq088jp2zbdgzqdaxl69wszzaq324qrpp";
-      name = "xdg-desktop-portal-kde-5.23.1.tar.xz";
+      url = "${mirror}/stable/plasma/5.23.2/xdg-desktop-portal-kde-5.23.2.tar.xz";
+      sha256 = "0ji02bscvdjcifibrjx5mk1ga91892hj3f6jcyiycd2xj4sqbcnf";
+      name = "xdg-desktop-portal-kde-5.23.2.tar.xz";
     };
   };
 }
diff --git a/pkgs/development/libraries/arrow-cpp/default.nix b/pkgs/development/libraries/arrow-cpp/default.nix
index fbf84f34ca5..1ede4ced507 100644
--- a/pkgs/development/libraries/arrow-cpp/default.nix
+++ b/pkgs/development/libraries/arrow-cpp/default.nix
@@ -171,11 +171,18 @@ stdenv.mkDerivation rec {
         "TestFilterKernelWithNumeric/7.CompareArrayAndFilterRandomNumeric"
         "TestCompareKernel.PrimitiveRandomTests"
       ] ++ lib.optionals enableS3 [
+        "S3OptionsTest.FromUri"
+        "S3RegionResolutionTest.NonExistentBucket"
         "S3RegionResolutionTest.PublicBucket"
         "S3RegionResolutionTest.RestrictedBucket"
-        "S3RegionResolutionTest.NonExistentBucket"
-        "S3OptionsTest.FromUri"
         "TestMinioServer.Connect"
+        "TestS3FS.OpenOutputStreamBackgroundWrites"
+        "TestS3FS.OpenOutputStreamDestructorBackgroundWrites"
+        "TestS3FS.OpenOutputStreamDestructorSyncWrite"
+        "TestS3FS.OpenOutputStreamDestructorSyncWrites"
+        "TestS3FS.OpenOutputStreamMetadata"
+        "TestS3FS.OpenOutputStreamSyncWrites"
+        "TestS3FSGeneric.*"
       ];
     in
     lib.optionalString doInstallCheck "-${builtins.concatStringsSep ":" filteredTests}";
diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index 064c2532472..91281f9cd24 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -288,9 +288,4 @@ stdenv.mkDerivation ({
 
 // lib.optionalAttrs (stdenv.hostPlatform != stdenv.buildPlatform) {
   preInstall = null; # clobber the native hook
-
-  # To avoid a dependency on the build system 'bash'.
-  preFixup = ''
-    rm -f $bin/bin/{ldd,tzselect,catchsegv,xtrace}
-  '';
 })
diff --git a/pkgs/development/libraries/libvirt/default.nix b/pkgs/development/libraries/libvirt/default.nix
index 8c1de7820b0..040ba8eb850 100644
--- a/pkgs/development/libraries/libvirt/default.nix
+++ b/pkgs/development/libraries/libvirt/default.nix
@@ -70,14 +70,14 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "libvirt";
-  version = "7.8.0";
+  version = "7.9.0";
 
   src =
     if buildFromTarball then
       fetchurl
         {
           url = "https://libvirt.org/sources/${pname}-${version}.tar.xz";
-          sha256 = "sha256-pyfNCke/ok+n3ih00j86n58Czra0m6FSiPbZoJixmSE=";
+          sha256 = "sha256-gpzytfV0J5xA8ERuEWiBXT82uJcQVgJjyiznAlb3Low=";
         }
     else
       fetchFromGitLab
@@ -85,7 +85,7 @@ stdenv.mkDerivation rec {
           owner = pname;
           repo = pname;
           rev = "v${version}";
-          sha256 = "sha256-/tSMJFgLPAiQXcZ2qZLM4XZqf96NtW3+zwKyrwGho2s=";
+          sha256 = "sha256-Ua6+EKLES3385fqhH2+qwnwE+X/nmWqIBxCXXE3SVhs=";
           fetchSubmodules = true;
         };
 
diff --git a/pkgs/development/libraries/simgear/default.nix b/pkgs/development/libraries/simgear/default.nix
index 6167d63544f..3ce41e3193c 100644
--- a/pkgs/development/libraries/simgear/default.nix
+++ b/pkgs/development/libraries/simgear/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Simulation construction toolkit";
-    homepage = "https://gitorious.org/fg/simgear";
+    homepage = "https://wiki.flightgear.org/SimGear";
     maintainers = with maintainers; [ raskin ];
     platforms = platforms.linux;
     license = licenses.lgpl2;
diff --git a/pkgs/development/lua-modules/overrides.nix b/pkgs/development/lua-modules/overrides.nix
index f01fb7df117..9190f1fff86 100644
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@@ -88,7 +88,7 @@ with prev;
     ];
   });
 
-  ljsyscall = prev.ljsyscall.overrideAttrs(oa: rec {
+  ljsyscall = prev.lib.overrideLuarocks prev.ljsyscall (drv: rec {
     version = "unstable-20180515";
     # package hasn't seen any release for a long time
     src = pkgs.fetchFromGitHub {
diff --git a/pkgs/development/python-modules/ansible-runner/default.nix b/pkgs/development/python-modules/ansible-runner/default.nix
index 9dc8eadb777..a23f668529d 100644
--- a/pkgs/development/python-modules/ansible-runner/default.nix
+++ b/pkgs/development/python-modules/ansible-runner/default.nix
@@ -8,20 +8,33 @@
 , six
 , stdenv
 , ansible
-, pytest
 , mock
+, openssh
+, pytest-mock
+, pytest-timeout
+, pytest-xdist
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "ansible-runner";
-  version = "2.0.2";
+  version = "2.0.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c02b690803ec0be4453411c53743cd3fdca1dfc66dfa075794e14e717c5b61b3";
+    sha256 = "15j0ljgw1rjxq4xiywxxxnxj4r6vwk8dwljkdsjmq3qmwgifcswg";
   };
 
-  checkInputs = [ pytest mock ];
+  checkInputs = [
+    ansible # required to place ansible CLI onto the PATH in tests
+    pytestCheckHook
+    pytest-mock
+    pytest-timeout
+    pytest-xdist
+    mock
+    openssh
+  ];
+
   propagatedBuildInputs = [
     ansible
     psutil
@@ -31,14 +44,31 @@ buildPythonPackage rec {
     six
   ];
 
-  # test_process_isolation_settings is currently broken on Darwin Catalina
-  # https://github.com/ansible/ansible-runner/issues/413
-  checkPhase = ''
-    HOME=$TMPDIR pytest \
-      --ignore test/unit/test_runner.py \
-      -k "not prepare ${lib.optionalString stdenv.isDarwin "and not process_isolation_settings"}"
+  preCheck = ''
+    export HOME=$(mktemp -d)
   '';
 
+  disabledTests = [
+    "test_callback_plugin_task_args_leak" # requires internet
+    "test_env_accuracy"
+    "test_large_stdout_blob" # times out on slower hardware
+  ]
+    # test_process_isolation_settings is currently broken on Darwin Catalina
+    # https://github.com/ansible/ansible-runner/issues/413
+  ++ lib.optional stdenv.isDarwin "process_isolation_settings";
+
+  disabledTestPaths = [
+    # these tests unset PATH and then run executables like `bash` (see https://github.com/ansible/ansible-runner/pull/918)
+    "test/integration/test_runner.py"
+    "test/unit/test_runner.py"
+  ]
+  ++ lib.optionals stdenv.isDarwin [
+    # integration tests on Darwin are not regularly passing in ansible-runner's own CI
+    "test/integration"
+    # these tests write to `/tmp` which is not writable on Darwin
+    "test/unit/config/test__base.py"
+  ];
+
   meta = with lib; {
     description = "Helps when interfacing with Ansible";
     homepage = "https://github.com/ansible/ansible-runner";
diff --git a/pkgs/development/python-modules/aws-sam-translator/default.nix b/pkgs/development/python-modules/aws-sam-translator/default.nix
index 9807c6581c5..d8c1419b0c5 100644
--- a/pkgs/development/python-modules/aws-sam-translator/default.nix
+++ b/pkgs/development/python-modules/aws-sam-translator/default.nix
@@ -14,13 +14,13 @@
 
 buildPythonPackage rec {
   pname = "aws-sam-translator";
-  version = "1.39.0";
+  version = "1.40.0";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "serverless-application-model";
     rev = "v${version}";
-    sha256 = "1a9m7zyqc414adw1i0sr2n9nlnmry0gi1ah1qna3yv9dx4ql9v9c";
+    sha256 = "sha256-jVJVoS7rc1RebBvihzmv6LvufMf/VvXOwj0TYkXBdmo=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/devtools/default.nix b/pkgs/development/python-modules/devtools/default.nix
index fdb240dde84..98f446315d9 100644
--- a/pkgs/development/python-modules/devtools/default.nix
+++ b/pkgs/development/python-modules/devtools/default.nix
@@ -1,9 +1,19 @@
-{ buildPythonPackage, pythonOlder, fetchFromGitHub, lib, pygments
-, pytestCheckHook, pytest-mock }:
+{ lib
+, asttokens
+, buildPythonPackage
+, executing
+, fetchFromGitHub
+, pygments
+, pytest-mock
+, pytestCheckHook
+, pythonOlder
+}:
 
 buildPythonPackage rec {
   pname = "devtools";
   version = "0.8.0";
+  format = "setuptools";
+
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
@@ -13,11 +23,25 @@ buildPythonPackage rec {
     sha256 = "0yavcbxzxi1nfa1k326gsl03y8sadi5z5acamwd8b1bsiv15p757";
   };
 
-  propagatedBuildInputs = [ pygments ];
+  propagatedBuildInputs = [
+    asttokens
+    executing
+    pygments
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+    pytest-mock
+  ];
 
-  checkInputs = [ pytestCheckHook pytest-mock ];
+  disabledTests = [
+    # Test for Windows32
+    "test_print_subprocess"
+  ];
 
-  pythonImportsCheck = [ "devtools" ];
+  pythonImportsCheck = [
+    "devtools"
+  ];
 
   meta = with lib; {
     description = "Python's missing debug print command and other development tools";
diff --git a/pkgs/development/python-modules/executing/default.nix b/pkgs/development/python-modules/executing/default.nix
index 8ab6994ac41..1a6664df671 100644
--- a/pkgs/development/python-modules/executing/default.nix
+++ b/pkgs/development/python-modules/executing/default.nix
@@ -1,19 +1,20 @@
 { lib
+, asttokens
 , buildPythonPackage
 , fetchFromGitHub
 , setuptools-scm
-, asttokens
 }:
 
 buildPythonPackage rec {
   pname = "executing";
-  version = "0.5.4";
+  version = "0.8.2";
+  format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "alexmojaki";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1hqx94h6l2wg9sljiaajfay2nr62sqa819w3bxrz8cdki1abdygv";
+    sha256 = "sha256-CDZQ9DONn7M+2/GtmM2G6nQPpI9dOd0ca+2F1PGRwO4=";
   };
 
   nativeBuildInputs = [
@@ -26,7 +27,13 @@ buildPythonPackage rec {
 
   # Tests appear to run fine (Ran 22 tests in 4.076s) with setuptoolsCheckPhase
   # but crash with pytestCheckHook
-  checkInputs = [ asttokens ];
+  checkInputs = [
+    asttokens
+  ];
+
+  pythonImportsCheck = [
+    "executing"
+  ];
 
   meta = with lib; {
     description = "Get information about what a frame is currently doing, particularly the AST node being executed";
diff --git a/pkgs/development/python-modules/libvirt/default.nix b/pkgs/development/python-modules/libvirt/default.nix
index 4572aee08b3..c2c0469aa81 100644
--- a/pkgs/development/python-modules/libvirt/default.nix
+++ b/pkgs/development/python-modules/libvirt/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "libvirt";
-  version = "7.8.0";
+  version = "7.9.0";
 
   src = assert version == libvirt.version; fetchFromGitLab {
     owner = "libvirt";
     repo = "libvirt-python";
     rev = "v${version}";
-    sha256 = "sha256-GuV++CFkywW0LGconyahfBGY+jjFA27Qu9JGIFt4bus=";
+    sha256 = "sha256-cfCyQ3KTv0lYTZMriUhm6psBAcJJIcmR/M9V/lrLmVE=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/development/tools/aws-sam-cli/default.nix b/pkgs/development/tools/aws-sam-cli/default.nix
index c370cddbe43..7b050040029 100644
--- a/pkgs/development/tools/aws-sam-cli/default.nix
+++ b/pkgs/development/tools/aws-sam-cli/default.nix
@@ -5,11 +5,11 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "aws-sam-cli";
-  version = "1.29.0";
+  version = "1.35.0";
 
   src = python3.pkgs.fetchPypi {
     inherit pname version;
-    sha256 = "sha256-JXphjERqY5Vj8j2F4Z7FrFJJEpBgK/5236pYfQRVdco=";
+    sha256 = "sha256-ojJoC8UuZDVm6CDmYbPoO0e+1QAYa0UcekYEd/MGFRM=";
   };
 
   # Tests are not included in the PyPI package
@@ -30,6 +30,8 @@ python3.pkgs.buildPythonApplication rec {
     serverlessrepo
     tomlkit
     watchdog
+    typing-extensions
+    regex
   ];
 
   postFixup = if enableTelemetry then "echo aws-sam-cli TELEMETRY IS ENABLED" else ''
@@ -42,10 +44,14 @@ python3.pkgs.buildPythonApplication rec {
     substituteInPlace requirements/base.txt \
       --replace "click~=7.1" "click~=8.0" \
       --replace "Flask~=1.1.2" "Flask~=2.0" \
-      --replace "dateparser~=0.7" "dateparser>=0.7" \
+      --replace "dateparser~=1.0" "dateparser>=0.7" \
       --replace "docker~=4.2.0" "docker>=4.2.0" \
       --replace "requests==" "requests #" \
-      --replace "watchdog==" "watchdog #"
+      --replace "watchdog==" "watchdog #" \
+      --replace "aws_lambda_builders==" "aws-lambda-builders #" \
+      --replace "typing_extensions==" "typing-extensions #" \
+      --replace "regex==" "regex #" \
+      --replace "tzlocal==3.0" "tzlocal==2.*"
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/tools/database/litestream/default.nix b/pkgs/development/tools/database/litestream/default.nix
index 3f70f39da95..7468aa55d61 100644
--- a/pkgs/development/tools/database/litestream/default.nix
+++ b/pkgs/development/tools/database/litestream/default.nix
@@ -4,13 +4,13 @@
 }:
 buildGoModule rec {
   pname = "litestream";
-  version = "0.3.5";
+  version = "0.3.6";
 
   src = fetchFromGitHub {
     owner = "benbjohnson";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-OQ8j0FOUWU5TfCl4AZpmX5tuhtHAbrhvzT6ve6AJNn0=";
+    sha256 = "sha256-A1okmeX3njyRXFKcXJPSV7Hg8Q/P7WqpGz2HThDdUQo=";
   };
 
   ldflags = [
diff --git a/pkgs/development/tools/git-aggregator/default.nix b/pkgs/development/tools/git-aggregator/default.nix
index a6599c667c8..9b2465366f6 100644
--- a/pkgs/development/tools/git-aggregator/default.nix
+++ b/pkgs/development/tools/git-aggregator/default.nix
@@ -1,17 +1,18 @@
-{ git, lib, python3Packages }:
+{ lib, git, python3Packages }:
 
 python3Packages.buildPythonApplication rec {
   pname = "git-aggregator";
-  version = "1.8.1";
+  version = "2.1.0";
 
   src = python3Packages.fetchPypi {
     inherit pname version;
-    hash = "sha256-LLsyhyhPmOOvPzwEEJwkhrDfBMFueA7kuDlnrqwr08k=";
+    sha256 = "sha256-79xNPzYP1j71sU5wZM5e2xTqQExqQEdxXPxbk4T/Scw=";
   };
 
   nativeBuildInputs = with python3Packages; [
     setuptools-scm
   ];
+
   propagatedBuildInputs = with python3Packages; [
     argcomplete
     colorama
@@ -25,13 +26,15 @@ python3Packages.buildPythonApplication rec {
   ];
 
   preCheck = ''
-    export HOME=`mktemp -d`
+    export HOME="$(mktemp -d)"
     git config --global user.name John
     git config --global user.email john@localhost
+    git config --global init.defaultBranch master
+    git config --global pull.rebase false
   '';
 
   meta = with lib; {
-    description = "Manage the aggregation of git branches from different remotes to build a consolidated one.";
+    description = "Manage the aggregation of git branches from different remotes to build a consolidated one";
     homepage = "https://github.com/acsone/git-aggregator";
     license = licenses.agpl3Plus;
     maintainers = with maintainers; [ lourkeur ];
diff --git a/pkgs/games/flightgear/default.nix b/pkgs/games/flightgear/default.nix
index bfbb705da38..6f4a57587de 100644
--- a/pkgs/games/flightgear/default.nix
+++ b/pkgs/games/flightgear/default.nix
@@ -6,7 +6,7 @@
 }:
 
 let
-  version = "2020.3.8";
+  version = "2020.3.11";
   shortVersion = builtins.substring 0 6 version;
   data = stdenv.mkDerivation rec {
     pname = "flightgear-data";
@@ -14,7 +14,7 @@ let
 
     src = fetchurl {
       url = "mirror://sourceforge/flightgear/release-${shortVersion}/FlightGear-${version}-data.txz";
-      sha256 = "sha256-/KFumHRkmRvsU/L1i11jG/KbqobnOEP7l4lyPMKHycA=";
+      sha256 = "sha256-Ej8VGywPQiDw3VXodcpXpOw4qU9x+MBMWMrqwHfitVg=";
     };
 
     dontUnpack = true;
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://sourceforge/flightgear/release-${shortVersion}/${pname}-${version}.tar.bz2";
-    sha256 = "XXDqhZ9nR+FwQ3LauZe8iGxOjlyDXDrEtj61BQGVDYc=";
+    sha256 = "sha256-/icGx3B+pzq8URR3PeRfKYYasPj1NWVq8EKO0EnKSpc=";
   };
 
   # Of all the files in the source and data archives, there doesn't seem to be
diff --git a/pkgs/misc/wiki-tui/default.nix b/pkgs/misc/wiki-tui/default.nix
index b07dd8c731b..168aff9a6cb 100644
--- a/pkgs/misc/wiki-tui/default.nix
+++ b/pkgs/misc/wiki-tui/default.nix
@@ -1,19 +1,25 @@
-{ lib, rustPlatform, fetchCrate, ncurses, openssl, pkg-config }:
+{ lib, rustPlatform, fetchFromGitHub, ncurses, openssl, pkg-config, stdenv, nix-update-script, Security }:
 
 rustPlatform.buildRustPackage rec {
   pname = "wiki-tui";
-  version = "0.3.4";
+  version = "0.4.1";
 
-  src = fetchCrate {
-    inherit pname version;
-    sha256 = "sha256-H+C1AbZ2zUhw6TNlSPaNaNuY5iNf39JW4q2g6uolevM=";
+  src = fetchFromGitHub {
+    owner = "Builditluc";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-aCfYb5UvlWbBvBlwNjVIbOJlEV2b3+FD0qKO+9h5Nos=";
   };
 
-  buildInputs = [ ncurses openssl ];
+  buildInputs = [ ncurses openssl ] ++ lib.optional stdenv.isDarwin Security;
 
   nativeBuildInputs = [ pkg-config ];
 
-  cargoSha256 = "sha256-PIt592nGtNEREQMukqRl/6KSJ/P32fWucHEMyOOc7BA=";
+  cargoSha256 = "sha256-dD8iC/b6KwElmq0RNdnHHC/jMWh7Q0/kMM+/zityHqQ=";
+
+  passthru.updateScript = nix-update-script {
+    attrPath = pname;
+  };
 
   meta = with lib; {
     description = "A simple and easy to use Wikipedia Text User Interface";
diff --git a/pkgs/servers/owncast/default.nix b/pkgs/servers/owncast/default.nix
index 65fa8a0f22e..68591f45823 100644
--- a/pkgs/servers/owncast/default.nix
+++ b/pkgs/servers/owncast/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "owncast";
-  version = "0.0.9";
+  version = "0.0.10";
 
   src = fetchFromGitHub {
     owner = "owncast";
     repo = "owncast";
     rev = "v${version}";
-    sha256 = "sha256-pJb11ifaiamp7P7d/xCwDKfOFufLmDDroUJPnWlTOkI=";
+    sha256 = "sha256-OcolQ4KnZbSgS1dpphbCML40jlheKAxbac7rjRul6Oc=";
   };
 
   vendorSha256 = "sha256-NARHYeOVT7sxfL1BdJc/CPCgHNZzjWE7kACJvrEC71Y=";
diff --git a/pkgs/tools/backup/partclone/default.nix b/pkgs/tools/backup/partclone/default.nix
index 06c20747157..4686fcd3e64 100644
--- a/pkgs/tools/backup/partclone/default.nix
+++ b/pkgs/tools/backup/partclone/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "partclone";
-  version = "0.3.17";
+  version = "0.3.18";
 
   src = fetchFromGitHub {
     owner = "Thomas-Tsai";
     repo = "partclone";
     rev = version;
-    sha256 = "sha256-tMdBo26JvHxbVI/Y2KDMejH+YT4IVx2H/y36u9ss0C8=";
+    sha256 = "sha256-cSxQJmuKm54AzIQbsEZhv/I8hfpaGroszdWqbRb3Ht4=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
diff --git a/pkgs/tools/compression/crabz/default.nix b/pkgs/tools/compression/crabz/default.nix
index ab5cc94b43a..5eafb3f5614 100644
--- a/pkgs/tools/compression/crabz/default.nix
+++ b/pkgs/tools/compression/crabz/default.nix
@@ -29,6 +29,15 @@ rustPlatform.buildRustPackage rec {
     Security
   ];
 
+  # link System as a dylib instead of a framework on macos
+  postPatch = lib.optionalString stdenv.isDarwin ''
+    core_affinity=../$(stripHash $cargoDeps)/core_affinity
+    oldHash=$(sha256sum $core_affinity/src/lib.rs | cut -d " " -f 1)
+    substituteInPlace $core_affinity/src/lib.rs --replace framework dylib
+    substituteInPlace $core_affinity/.cargo-checksum.json \
+      --replace $oldHash $(sha256sum $core_affinity/src/lib.rs | cut -d " " -f 1)
+  '';
+
   meta = with lib; {
     description = "A cross platform, fast, compression and decompression tool";
     homepage = "https://github.com/sstadick/crabz";
diff --git a/pkgs/tools/misc/fzf/default.nix b/pkgs/tools/misc/fzf/default.nix
index e56a61338aa..b82232a6b96 100644
--- a/pkgs/tools/misc/fzf/default.nix
+++ b/pkgs/tools/misc/fzf/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "fzf";
-  version = "0.27.3";
+  version = "0.28.0";
 
   src = fetchFromGitHub {
     owner = "junegunn";
     repo = pname;
     rev = version;
-    sha256 = "sha256-uVGU8tOHHJYBoWTwx9ilnOKo49R0QHdCABKfGoL7Dkk=";
+    sha256 = "sha256-28Lu/WYIJWdLmSKX6C3w6F5NXXynPVwmmdH8PcDwC+Y=";
   };
 
   vendorSha256 = "sha256-omvCzM5kH3nAE57S33NV0OFRJmU+Ty7hhriaG/Dc0o0=";
diff --git a/pkgs/tools/networking/vpnc/default.nix b/pkgs/tools/networking/vpnc/default.nix
index 6928bacd6ce..d5fa25b0e44 100644
--- a/pkgs/tools/networking/vpnc/default.nix
+++ b/pkgs/tools/networking/vpnc/default.nix
@@ -33,9 +33,6 @@ stdenv.mkDerivation {
 
     substituteInPlace "config.c" \
       --replace "/etc/vpnc/vpnc-script" "$out/etc/vpnc/vpnc-script"
-
-    substituteInPlace "pcf2vpnc" \
-      --replace "/usr/bin/perl" "${perl}/bin/perl"
   '';
 
   postInstall = ''
diff --git a/pkgs/tools/nix/statix/default.nix b/pkgs/tools/nix/statix/default.nix
index 1a1f5c4a243..3e56fa4fb60 100644
--- a/pkgs/tools/nix/statix/default.nix
+++ b/pkgs/tools/nix/statix/default.nix
@@ -4,16 +4,16 @@ rustPlatform.buildRustPackage rec {
   pname = "statix";
   # also update version of the vim plugin in pkgs/misc/vim-plugins/overrides.nix
   # the version can be found in flake.nix of the source code
-  version = "0.3.6";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "nerdypepper";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-fsEqPr+qtLNmTtxUxjcVDPoG7fjqFImnVHwscy2IBkE=";
+    sha256 = "sha256-wqkhtAOO6pKLjUUnDbVFwzm6mbXhP/4iJU7ZKtDKrE8=";
   };
 
-  cargoSha256 = "sha256-7fSJhRqZh7lUIe8vVzIVx+1phd+Am+GNzKN62NSuOYs=";
+  cargoSha256 = "sha256-e20POz9ZvuT0S+YG+9x7hcudhXQpOR4rVSFJbz76OI0=";
 
   cargoBuildFlags = lib.optionals withJson [ "--features" "json" ];
 
diff --git a/pkgs/tools/package-management/nvd/default.nix b/pkgs/tools/package-management/nvd/default.nix
index 1218ac01f9a..2a00acff690 100644
--- a/pkgs/tools/package-management/nvd/default.nix
+++ b/pkgs/tools/package-management/nvd/default.nix
@@ -2,13 +2,15 @@
 
 stdenv.mkDerivation rec {
   pname = "nvd";
-  version = "0.1.1";
+  version = "0.1.2";
 
   src = fetchFromGitLab {
     owner = "khumba";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "0accq0cw6qsxin1fb2bp2ijgjf9akb9qlivkykpfsgnk5qjafv2n";
+    # There is a 0.1.2 release but no tag yet
+    # https://gitlab.com/khumba/nvd/-/issues/7
+    rev = "13d3ab1255e0de03693cecb7da9764c9afd5d472";
+    sha256 = "1537s7j0m0hkahf0s1ai7bm94xj9fz6b9x78py0dn3cgnl9bfzla";
   };
 
   buildInputs = [ python3 ];
diff --git a/pkgs/tools/security/passff-host/default.nix b/pkgs/tools/security/passff-host/default.nix
index fb348800f5a..87b349c63a4 100644
--- a/pkgs/tools/security/passff-host/default.nix
+++ b/pkgs/tools/security/passff-host/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "passff-host";
-  version = "1.2.1";
+  version = "1.2.2";
 
   src = fetchFromGitHub {
     owner = "passff";
     repo = pname;
     rev = version;
-    sha256 = "0ydfwvhgnw5c3ydx2gn5d7ys9g7cxlck57vfddpv6ix890v21451";
+    sha256 = "sha256-9q4onU/e/pzLp5lGQjf/ScOOCVMiMQRaLGEm8K8flX4=";
   };
 
   buildInputs = [ python3 ];
diff --git a/pkgs/tools/wayland/wlogout/default.nix b/pkgs/tools/wayland/wlogout/default.nix
index 2625405808c..d9d44212601 100644
--- a/pkgs/tools/wayland/wlogout/default.nix
+++ b/pkgs/tools/wayland/wlogout/default.nix
@@ -9,6 +9,7 @@
 , libxkbcommon
 , wayland
 , wayland-protocols
+, gtk-layer-shell
 }:
 
 stdenv.mkDerivation rec {
@@ -28,6 +29,7 @@ stdenv.mkDerivation rec {
     libxkbcommon
     wayland
     wayland-protocols
+    gtk-layer-shell
   ];
 
   postPatch = ''
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index dc9ebf76fa5..ab56e97fc02 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -33022,7 +33022,9 @@ with pkgs;
 
   wiki-js = callPackage ../servers/web-apps/wiki-js { };
 
-  wiki-tui = callPackage ../misc/wiki-tui { };
+  wiki-tui = callPackage ../misc/wiki-tui {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   winePackagesFor = wineBuild: lib.makeExtensible (self: with self; {
     callPackage = newScope self;
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 6129719d049..62d76ed46bc 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -20631,12 +20631,12 @@ let
 
   SysVirt = buildPerlModule rec {
     pname = "Sys-Virt";
-    version = "7.8.0";
+    version = "7.9.0";
     src = fetchFromGitLab {
       owner = "libvirt";
       repo = "libvirt-perl";
-      rev = "v7.8.0";
-      sha256 = "sha256-D/sVIKMWy3WnDM97+ofG3ClgGhJJuK2a6NJLC03S4LI=";
+      rev = "v7.9.0";
+      sha256 = "sha256-QxY6TRVQWrN689CD76CQZeyXsDVWxk24N1v67DCvmDo=";
     };
     nativeBuildInputs = [ pkgs.pkg-config ];
     buildInputs = [ pkgs.libvirt CPANChanges TestPod TestPodCoverage XMLXPath ];