Merge staging-next into staging

43 files changed, 423 insertions, 211 deletions

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 1388dc69886..57d5157bd68 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -7707,6 +7707,16 @@
     githubId = 279868;
     name = "Matti Kariluoma";
   };
+  matthewpi = {
+    email = "me+nix@matthewp.io";
+    github = "matthewpi";
+    githubId = 26559841;
+    name = "Matthew Penner";
+    keys = [{
+      longkeyid = "ed25519/0x31311906AD4CF6D6";
+      fingerprint = "5118 F1CC B7B0 6C17 4DD1  5267 3131 1906 AD4C F6D6";
+    }];
+  };
   maurer = {
     email = "matthew.r.maurer+nix@gmail.com";
     github = "maurer";
diff --git a/nixos/modules/services/misc/jellyfin.nix b/nixos/modules/services/misc/jellyfin.nix
index b9d54f27edc..64b74ddd708 100644
--- a/nixos/modules/services/misc/jellyfin.nix
+++ b/nixos/modules/services/misc/jellyfin.nix
@@ -73,7 +73,8 @@ in
         PrivateDevices = true;
         PrivateUsers = true;
 
-        ProtectClock = true;
+        # Disabled as it does not allow Jellyfin to interface with CUDA devices
+        # ProtectClock = true;
         ProtectControlGroups = true;
         ProtectHostname = true;
         ProtectKernelLogs = true;
@@ -84,7 +85,7 @@ in
 
         RestrictNamespaces = true;
         # AF_NETLINK needed because Jellyfin monitors the network connection
-        RestrictAddressFamilies = [ "AF_NETLINK" "AF_INET" "AF_INET6" ];
+        RestrictAddressFamilies = [ "AF_NETLINK" "AF_INET" "AF_INET6" "AF_UNIX" ];
         RestrictRealtime = true;
         RestrictSUIDSGID = true;
 
diff --git a/pkgs/applications/emulators/ryujinx/appdir.patch b/pkgs/applications/emulators/ryujinx/appdir.patch
new file mode 100644
index 00000000000..696077d29de
--- /dev/null
+++ b/pkgs/applications/emulators/ryujinx/appdir.patch
@@ -0,0 +1,23 @@
+diff --git a/Ryujinx.Common/ReleaseInformations.cs b/Ryujinx.Common/ReleaseInformations.cs
+index 35890406..cca77163 100644
+--- a/Ryujinx.Common/ReleaseInformations.cs
++++ b/Ryujinx.Common/ReleaseInformations.cs
+@@ -42,12 +42,14 @@ namespace Ryujinx.Common
+
+         public static string GetBaseApplicationDirectory()
+         {
+-            if (IsFlatHubBuild())
+-            {
++            //if (IsFlatHubBuild())
++            //{
++                // This needs to be a mutable path, while CurrentDomain.BaseDirectory refers to the nix store.
++                // AppDataManager.BaseDirPath refers to ".config/Ryujinx" on Linux.
+                 return AppDataManager.BaseDirPath;
+-            }
++            //}
+ 
+-            return AppDomain.CurrentDomain.BaseDirectory;
++            //return AppDomain.CurrentDomain.BaseDirectory;
+         }
+     }
+ }
diff --git a/pkgs/applications/emulators/ryujinx/default.nix b/pkgs/applications/emulators/ryujinx/default.nix
index 1a2d122e637..2ac16662b88 100644
--- a/pkgs/applications/emulators/ryujinx/default.nix
+++ b/pkgs/applications/emulators/ryujinx/default.nix
@@ -1,8 +1,6 @@
 { lib
 , buildDotnetModule
 , fetchFromGitHub
-, makeDesktopItem
-, copyDesktopItems
 , dotnetCorePackages
 , libX11
 , libgdiplus
@@ -19,13 +17,13 @@
 
 buildDotnetModule rec {
   pname = "ryujinx";
-  version = "1.1.54"; # Versioning is based off of the official github actions builds: https://github.com/Ryujinx/Ryujinx/actions/workflows/release.yml
+  version = "1.1.64"; # Based off of the official github actions builds: https://github.com/Ryujinx/Ryujinx/actions/workflows/release.yml
 
   src = fetchFromGitHub {
     owner = "Ryujinx";
     repo = "Ryujinx";
-    rev = "3705c206688c69d3348f5cec84dc480d8d7c578e";
-    sha256 = "1lhnr11x46yjpka865m0dzkbkdxmrrhjcpvq4ab4wll6j0ipy908";
+    rev = "54bfaa125d9b6ae1be53ec431d40326fba51d0de";
+    sha256 = "0p8wmnm8sjx7wqb5z62mp8c3cwrv241ji3fawj2qgqx3k9jlb31i";
   };
 
   dotnet-sdk = dotnetCorePackages.sdk_6_0;
@@ -41,7 +39,6 @@ buildDotnetModule rec {
   executables = [ "Ryujinx" ];
 
   nativeBuildInputs = [
-    copyDesktopItems
     wrapGAppsHook
   ];
 
@@ -54,7 +51,6 @@ buildDotnetModule rec {
     gtk3
     libX11
     libgdiplus
-    ffmpeg
     SDL2_mixer
     openal
     libsoundio
@@ -63,34 +59,31 @@ buildDotnetModule rec {
   ];
 
   patches = [
-    ./log.patch # Without this, Ryujinx attempts to write logs to the nix store. This patch makes it write to "~/.config/Ryujinx/Logs" on Linux.
+    ./appdir.patch # Ryujinx attempts to write to the nix store. This patch redirects it to "~/.config/Ryujinx" on Linux.
   ];
 
   preInstall = ''
-    # TODO: fix this hack https://github.com/Ryujinx/Ryujinx/issues/2349
-    mkdir -p $out/lib/sndio-6
-    ln -s ${sndio}/lib/libsndio.so $out/lib/sndio-6/libsndio.so.6
-
+    # Ryujinx tries to use ffmpeg from PATH
     makeWrapperArgs+=(
-      --suffix LD_LIBRARY_PATH : "$out/lib/sndio-6"
+      --suffix PATH : ${lib.makeBinPath [ ffmpeg ]}
     )
+  '';
+
+  preFixup = ''
+    mkdir -p $out/share/{applications,icons/hicolor/scalable/apps,mime/packages}
+    pushd ${src}/distribution/linux
+
+    install -D ./ryujinx.desktop $out/share/applications/ryujinx.desktop
+    install -D ./ryujinx-mime.xml $out/share/mime/packages/ryujinx-mime.xml
+    install -D ./ryujinx-logo.svg $out/share/icons/hicolor/scalable/apps/ryujinx.svg
 
-    for i in 16 32 48 64 96 128 256 512 1024; do
-      install -D ${src}/Ryujinx/Ui/Resources/Logo_Ryujinx.png $out/share/icons/hicolor/''${i}x$i/apps/ryujinx.png
-    done
+    substituteInPlace $out/share/applications/ryujinx.desktop --replace \
+      "Exec=Ryujinx" "Exec=$out/bin/Ryujinx"
+
+    popd
   '';
 
-  desktopItems = [
-    (makeDesktopItem {
-      desktopName = "Ryujinx";
-      name = "ryujinx";
-      exec = "Ryujinx";
-      icon = "ryujinx";
-      comment = meta.description;
-      type = "Application";
-      categories = [ "Game" ];
-    })
-  ];
+  passthru.updateScript = ./updater.sh;
 
   meta = with lib; {
     homepage = "https://ryujinx.org/";
@@ -108,5 +101,4 @@ buildDotnetModule rec {
     platforms = [ "x86_64-linux" ];
     mainProgram = "Ryujinx";
   };
-  passthru.updateScript = ./updater.sh;
 }
diff --git a/pkgs/applications/emulators/ryujinx/log.patch b/pkgs/applications/emulators/ryujinx/log.patch
deleted file mode 100644
index 57e96e5c25c..00000000000
--- a/pkgs/applications/emulators/ryujinx/log.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-diff --git a/Ryujinx/Configuration/LoggerModule.cs b/Ryujinx/Configuration/LoggerModule.cs
-index 44631ea0..534576bc 100644
---- a/Ryujinx/Configuration/LoggerModule.cs
-+++ b/Ryujinx/Configuration/LoggerModule.cs
-@@ -1,6 +1,7 @@
- using Ryujinx.Common;
- using Ryujinx.Common.Logging;
- using System;
-+using System.IO;
-
- namespace Ryujinx.Configuration
- {
-@@ -74,7 +75,7 @@ namespace Ryujinx.Configuration
-             if (e.NewValue)
-             {
-                 Logger.AddTarget(new AsyncLogTargetWrapper(
--                    new FileLogTarget(AppDomain.CurrentDomain.BaseDirectory, "file"),
-+                    new FileLogTarget(Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "Ryujinx"), "file"),
-                     1000,
-                     AsyncLogTargetOverflowAction.Block
-                 ));
diff --git a/pkgs/applications/emulators/ryujinx/updater.sh b/pkgs/applications/emulators/ryujinx/updater.sh
index 4b5fa4834fa..9c2f69e606c 100755
--- a/pkgs/applications/emulators/ryujinx/updater.sh
+++ b/pkgs/applications/emulators/ryujinx/updater.sh
@@ -1,6 +1,6 @@
 #! /usr/bin/env nix-shell
 #! nix-shell -i bash -p coreutils gnused curl common-updater-scripts nuget-to-nix nix-prefetch-git jq dotnet-sdk_6
-set -euxo pipefail
+set -euo pipefail
 cd "$(dirname "${BASH_SOURCE[0]}")"
 
 DEPS_FILE="$(realpath "./deps.nix")"
@@ -31,7 +31,7 @@ NEW_VERSION="${BASE_VERSION}.${PATCH_VERSION}"
 
 OLD_VERSION="$(sed -nE 's/\s*version = "(.*)".*/\1/p' ./default.nix)"
 
-echo "comparing versions $OLD_VERSION => $NEW_VERSION"
+echo "comparing versions $OLD_VERSION -> $NEW_VERSION"
 if [[ "$OLD_VERSION" == "$NEW_VERSION" ]]; then
     echo "Already up to date! Doing nothing"
     exit 0
@@ -42,6 +42,8 @@ SHA="$(nix-prefetch-git https://github.com/ryujinx/ryujinx --rev "$COMMIT" --qui
 cd ../../../..
 update-source-version ryujinx "$NEW_VERSION" "$SHA" --rev="$COMMIT"
 
+echo "building Nuget lockfile"
+
 STORE_SRC="$(nix-build . -A ryujinx.src --no-out-link)"
 SRC="$(mktemp -d /tmp/ryujinx-src.XXX)"
 cp -rT "$STORE_SRC" "$SRC"
diff --git a/pkgs/applications/graphics/hdrmerge/default.nix b/pkgs/applications/graphics/hdrmerge/default.nix
index 8f518c6c69b..b0e346331bc 100644
--- a/pkgs/applications/graphics/hdrmerge/default.nix
+++ b/pkgs/applications/graphics/hdrmerge/default.nix
@@ -55,17 +55,15 @@ mkDerivation rec {
       desktopName = "HDRMerge";
       comment = meta.description;
       icon = "hdrmerge";
-      exec = "@out@/bin/hdrmerge -F";
+      exec = "hdrmerge %F";
       categories = [ "Graphics" ];
       mimeTypes = [ "image/x-dcraw" "image/x-adobe-dng" ];
       terminal = false;
     })
   ];
 
-  postInstallPhase = ''
-    # Make a desktop item
-    mkdir -p $out/share/icons/ $out/share/applications/
-    cp ../data/images/logo.png $out/share/icons/hdrmerge.png
+  postInstall = ''
+    install -Dm444 ../data/images/icon.png $out/share/icons/hicolor/128x128/apps/hdrmerge.png
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/misc/sigi/default.nix b/pkgs/applications/misc/sigi/default.nix
index 731608db7da..674432e7a02 100644
--- a/pkgs/applications/misc/sigi/default.nix
+++ b/pkgs/applications/misc/sigi/default.nix
@@ -2,25 +2,30 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "sigi";
-  version = "3.0.0";
+  version = "3.0.2";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-1xZMj6NjwA9pVOEL4CDv4XHC3usu3WdjsLJuW3vgxc8=";
+    sha256 = "sha256-N+8DdokiYW5mHIQJisdTja8xMVGip37X6c/xBYnQaRU=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
 
+  # As part of its tests, sigi hard-codes a location to BATS based on git
+  # submodules. The tests are recommeded to skip for Linux packaging. They'll
+  # move to Rust after this issue: https://github.com/hiljusti/sigi/issues/19
+  checkFlags = [ "SKIP_BATS_TESTS=1" ];
+
   postInstall = ''
     installManPage sigi.1
   '';
 
-  cargoSha256 = "sha256-NUWm2GkK7bASo6bAOgQgHate45iDG5l3G/KhtLrjzQ8=";
+  cargoSha256 = "sha256-vO9ocTDcGt/T/sLCP+tCHXihV1H2liFDjI7OhhmPd3I=";
 
   passthru.tests.version = testVersion { package = sigi; };
 
   meta = with lib; {
-    description = "CLI tool for organization and planning";
+    description = "Organizing CLI for people who don't love organizing.";
     homepage = "https://github.com/hiljusti/sigi";
     license = licenses.gpl2;
     maintainers = with maintainers; [ hiljusti ];
diff --git a/pkgs/applications/misc/sway-launcher-desktop/default.nix b/pkgs/applications/misc/sway-launcher-desktop/default.nix
new file mode 100644
index 00000000000..fdae9753edb
--- /dev/null
+++ b/pkgs/applications/misc/sway-launcher-desktop/default.nix
@@ -0,0 +1,42 @@
+{ stdenv, lib, pkgs, fzf, gawk, fetchFromGitHub, makeWrapper }:
+
+stdenv.mkDerivation rec {
+  pname = "sway-launcher-desktop";
+  version = "1.5.4";
+
+  src = fetchFromGitHub {
+    owner = "Biont";
+    repo = "sway-launcher-desktop";
+    rev = "v${version}";
+    sha256 = "0i19igj30jyszqb63ibq0b0zxzvjw3z1zikn9pbk44ig1c0v61aa";
+  };
+
+  postPatch = ''
+    patchShebangs ${pname}.sh
+  '';
+
+  buildInputs = [ fzf gawk ];
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    install -d $out/bin
+    install ${pname}.sh $out/bin/${pname}
+    wrapProgram $out/bin/${pname} \
+      --prefix PATH : ${lib.makeBinPath [ gawk fzf ]}
+  '';
+
+  meta = with lib; {
+    description = "TUI Application launcher with Desktop Entry support.";
+    longDescription = ''
+      This is a TUI-based launcher menu made with bash and the amazing fzf.
+      Despite its name, it does not (read: no longer) depend on the Sway window manager
+      in any way and can be used with just about any WM.
+    '';
+    homepage = "https://github.com/Biont/sway-launcher-desktop";
+    changelog = "https://github.com/Biont/sway-launcher-desktop/releases/tag/v${version}";
+    license = licenses.gpl3;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.mrhedgehog ];
+    mainProgram = "${pname}";
+  };
+}
diff --git a/pkgs/applications/networking/cluster/driftctl/default.nix b/pkgs/applications/networking/cluster/driftctl/default.nix
index 725cd419d08..4c22b9adca5 100644
--- a/pkgs/applications/networking/cluster/driftctl/default.nix
+++ b/pkgs/applications/networking/cluster/driftctl/default.nix
@@ -1,56 +1,56 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
 
 buildGoModule rec {
   pname = "driftctl";
-  version = "0.20.0";
+  version = "0.23.0";
 
   src = fetchFromGitHub {
-    owner = "cloudskiff";
+    owner = "snyk";
     repo = "driftctl";
     rev = "v${version}";
-    sha256 = "sha256-8egkz1wXvdNoTkbhOdvoP4hrBPmuiUvd2QaD6tPH2xU=";
+    sha256 = "sha256-TUwTvCsWB+n+shVU1hTzLYROG9Wp4ySzJwAnappK7TY=";
   };
 
-  vendorSha256 = "sha256-lftOTcob8l9dUZkH2MMxzD6FZzLOR/PXEXFVdOaguK4=";
-
-  postUnpack = ''
-    # Without this, tests fail to locate aws/3.19.0.json
-    for prefix in /                        \
-                  /pkg                     \
-                  /pkg/analyser            \
-                  /pkg/alerter             \
-                  /pkg/remote              \
-                  /pkg/middlewares         \
-                  /pkg/cmd/scan/output     \
-                  /pkg/iac/terraform/state \
-                  /pkg/iac/supplier ; do
-      mkdir -p ./source/$prefix/github.com/cloudskiff
-      ln -sf $PWD/source ./source/$prefix/github.com/cloudskiff/driftctl
-    done
-
-    # Disable check for latest version and telemetry, which are opt-out.
-    # Making it out-in is quite a job, and why bother?
-    find -name '*.go' \
-      | xargs sed -i 's,https://2lvzgmrf2e.execute-api.eu-west-3.amazonaws.com/,https://0.0.0.0/,g'
-
-    # and remove corresponding flags from --help, so things look tidy.
-    find -name driftctl.go | \
-      xargs sed -i -e '/("no-version-check"/ d'  -e '/("disable-telemetry"/ d'
-
-    # Presumably it can be done with ldflags, but I failed to find incantation
-    # that would work, we here we go old-school.
-    find -name version.go | xargs sed -i -e 's/"dev"/"${version}"/'
-    find -name build.go | xargs sed -i -e 's/"dev"/"release"/'
-
-    # Fix the tests that checks for dev-dev.
-    find -name version_test.go | xargs sed -i -e 's/"dev-dev/"${version}/'
-    find -name driftctl_test.go | xargs sed -i -e 's/"dev-dev/"${version}/'
+  vendorSha256 = "sha256-I0OCRhUvuaF4k5qqPaV6R24mrd9AG5GgQCCF6yodK0E=";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/snyk/driftctl/pkg/version.version=v${version}"
+    "-X github.com/snyk/driftctl/build.env=release"
+    "-X github.com/snyk/driftctl/build.enableUsageReporting=false"
+  ];
+
+  postInstall = ''
+    installShellCompletion --cmd driftctl \
+      --bash <($out/bin/driftctl completion bash) \
+      --fish <($out/bin/driftctl completion fish) \
+      --zsh <($out/bin/driftctl completion zsh)
+  '';
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    $out/bin/driftctl --help
+    $out/bin/driftctl version | grep "v${version}"
+    # check there's no telemetry flag
+    $out/bin/driftctl --help | grep -vz "telemetry"
+
+    runHook postInstallCheck
   '';
 
   meta = with lib; {
-    description = "Tool to track infrastructure drift";
-    homepage = "https://github.com/cloudskiff/driftctl";
+    homepage = "https://driftctl.com/";
+    changelog = "https://github.com/snyk/driftctl/releases/tag/v${version}";
+    description = "Detect, track and alert on infrastructure drift";
+    longDescription = ''
+      driftctl is a free and open-source CLI that warns of infrastructure drift
+      and fills in the missing piece in your DevSecOps toolbox.
+    '';
     license = licenses.asl20;
-    maintainers = with maintainers; [ kaction ];
+    maintainers = with maintainers; [ kaction jk ];
   };
 }
diff --git a/pkgs/applications/networking/cluster/helm/default.nix b/pkgs/applications/networking/cluster/helm/default.nix
index 42d2e63eaac..408f1bd3ed8 100644
--- a/pkgs/applications/networking/cluster/helm/default.nix
+++ b/pkgs/applications/networking/cluster/helm/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "helm";
-  version = "3.8.0";
-  gitCommit = "d14138609b01886f544b2025f5000351c9eb092e";
+  version = "3.8.1";
+  gitCommit = "5cb9af4b1b271d11d7a97a71df3ac337dd94ad37";
 
   src = fetchFromGitHub {
     owner = "helm";
     repo = "helm";
     rev = "v${version}";
-    sha256 = "sha256-/vxf3YfBP1WHFpqll6iq4m+X4NA16qHnuGA0wvrVRsg=";
+    sha256 = "sha256-AjNrn46l9gVC7MtGF59QWv+l6qYn+jzopsZtM/2faXY=";
   };
-  vendorSha256 = "sha256-M7XId+2HIh1mFzU54qQZEisWdVq67RlGJjlw+2dpiDc=";
+  vendorSha256 = "sha256-ffbp7J8XDxo/s79pjoiDVbft0pr/lJpuJuKiMpQwkT0=";
 
   doCheck = false;
 
diff --git a/pkgs/applications/networking/cluster/tektoncd-cli/default.nix b/pkgs/applications/networking/cluster/tektoncd-cli/default.nix
index df6fd8c72c8..a7dffc131d8 100644
--- a/pkgs/applications/networking/cluster/tektoncd-cli/default.nix
+++ b/pkgs/applications/networking/cluster/tektoncd-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "tektoncd-cli";
-  version = "0.22.0";
+  version = "0.23.0";
 
   src = fetchFromGitHub {
     owner = "tektoncd";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-AmJN7hnYuhxYNG/qs7yv3phhffYKVaM8f7irhi9wRfA=";
+    sha256 = "sha256-rzKEjLjX2bPqgNGJYdyTuu15+9bq9WnsrJtsBzL/oOo=";
   };
 
   vendorSha256 = null;
@@ -52,10 +52,12 @@ buildGoModule rec {
   meta = with lib; {
     homepage = "https://tekton.dev";
     changelog = "https://github.com/tektoncd/cli/releases/tag/v${version}";
-    description = "Provides a CLI for interacting with Tekton";
+    description = "Provides a CLI for interacting with Tekton - tkn";
     longDescription = ''
-      The Tekton Pipelines cli project provides a CLI for interacting with Tekton!
-      For your convenience, it is recommended that you install the Tekton CLI, tkn, together with the core component of Tekton, Tekton Pipelines.
+      The Tekton Pipelines cli project provides a CLI for interacting with
+      Tekton! For your convenience, it is recommended that you install the
+      Tekton CLI, tkn, together with the core component of Tekton, Tekton
+      Pipelines.
     '';
     license = licenses.asl20;
     maintainers = with maintainers; [ jk mstrangfeld vdemeester ];
diff --git a/pkgs/applications/version-management/gitqlient/default.nix b/pkgs/applications/version-management/gitqlient/default.nix
new file mode 100644
index 00000000000..3737828ef72
--- /dev/null
+++ b/pkgs/applications/version-management/gitqlient/default.nix
@@ -0,0 +1,41 @@
+{ lib
+, mkDerivation
+, fetchFromGitHub
+, qmake
+, qtwebengine
+, gitUpdater
+}:
+
+mkDerivation rec {
+  pname = "gitqlient";
+  version = "1.4.3";
+
+  src = fetchFromGitHub {
+    owner = "francescmm";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "018jz6b28zwr205jmgw13ddlfvlhxqf0cw1pfjiwsi6i8gay7w6s";
+  };
+
+  nativeBuildInputs = [
+    qmake
+  ];
+
+  buildInputs = [
+    qtwebengine
+  ];
+
+  qmakeFlags = [
+    "GitQlient.pro"
+  ];
+
+  passthru.updateScript = gitUpdater { inherit pname version; };
+
+  meta = with lib; {
+    homepage = "https://github.com/francescmm/GitQlient";
+    description = "Multi-platform Git client written with Qt";
+    license = licenses.lgpl2Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ romildo ];
+  };
+}
diff --git a/pkgs/applications/video/kodi/unwrapped.nix b/pkgs/applications/video/kodi/unwrapped.nix
index 89eeed89048..18319468eae 100644
--- a/pkgs/applications/video/kodi/unwrapped.nix
+++ b/pkgs/applications/video/kodi/unwrapped.nix
@@ -38,24 +38,24 @@ assert usbSupport -> !udevSupport; # libusb-compat-0_1 won't be used if udev is
 assert gbmSupport || waylandSupport || x11Support;
 
 let
-  kodiReleaseDate = "20211024";
-  kodiVersion = "19.3";
+  kodiReleaseDate = "20220303";
+  kodiVersion = "19.4";
   rel = "Matrix";
 
   kodi_src = fetchFromGitHub {
     owner  = "xbmc";
     repo   = "xbmc";
     rev    = "${kodiVersion}-${rel}";
-    sha256 = "02bnknk87zzv9j6b6k9c0xx47q2gh399j6v25rm94g7rhzf8phbw";
+    sha256 = "sha256-XDtmY3KthiD91kvueQRSamBcdM7fBpRntmZX6KRsCzE=";
   };
 
   ffmpeg = stdenv.mkDerivation rec {
     pname = "kodi-ffmpeg";
-    version = "4.3.2";
+    version = "4.3.2"; # see https://github.com/xbmc/xbmc/blob/${kodiVersion}-${rel}/tools/depends/target/ffmpeg/FFMPEG-VERSION
     src = fetchFromGitHub {
       owner   = "xbmc";
       repo    = "FFmpeg";
-      rev     = "${version}-${rel}-${kodiVersion}";
+      rev     = "${version}-${rel}-19.2";
       sha256  = "14s215sgc93ds1mrdbkgb7fvy94lpgv2ldricyxzis0gbzqfgs4f";
     };
     preConfigure = ''
diff --git a/pkgs/data/icons/tela-circle-icon-theme/default.nix b/pkgs/data/icons/tela-circle-icon-theme/default.nix
index d19dcba69fd..dcff587dd35 100644
--- a/pkgs/data/icons/tela-circle-icon-theme/default.nix
+++ b/pkgs/data/icons/tela-circle-icon-theme/default.nix
@@ -4,6 +4,7 @@
 , gtk3
 , hicolor-icon-theme
 , jdupes
+, gitUpdater
 , allColorVariants ? false
 , circularFolder ? false
 , colorVariants ? [] # default is standard
@@ -16,13 +17,13 @@ lib.checkListOfEnum "${pname}: color variants" [ "standard" "black" "blue" "brow
 
 stdenvNoCC.mkDerivation rec {
   inherit pname;
-  version = "2022-02-08";
+  version = "2022-03-07";
 
   src = fetchFromGitHub {
     owner = "vinceliuice";
     repo = pname;
     rev = version;
-    sha256 = "08a1jhirvn2x9hhjr0lqqqayhsf446cddapprxpsnsn9q6x2j2gp";
+    sha256 = "vQeWGZmurvT/UQJ1dx6t+ZeKdJ1Oq9TdHBADw64x18g=";
   };
 
   nativeBuildInputs = [
@@ -50,16 +51,18 @@ stdenvNoCC.mkDerivation rec {
       ${lib.optionalString circularFolder "-c"} \
       ${if allColorVariants then "-a" else builtins.toString colorVariants}
 
-    jdupes -L -r $out/share/icons
+    jdupes --link-soft --recurse $out/share
 
     runHook postInstall
   '';
 
+  passthru.updateScript = gitUpdater {inherit pname version; };
+
   meta = with lib; {
     description = "Flat and colorful personality icon theme";
     homepage = "https://github.com/vinceliuice/Tela-circle-icon-theme";
     license = licenses.gpl3Only;
-    platforms = platforms.unix;
+    platforms = platforms.linux; # darwin use case-insensitive filesystems that cause hash mismatches
     maintainers = with maintainers; [ romildo ];
   };
 }
diff --git a/pkgs/data/themes/layan-kde/default.nix b/pkgs/data/themes/layan-kde/default.nix
new file mode 100644
index 00000000000..40cd6c055bf
--- /dev/null
+++ b/pkgs/data/themes/layan-kde/default.nix
@@ -0,0 +1,46 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, gitUpdater
+}:
+
+stdenv.mkDerivation rec {
+  pname = "layan-kde";
+  version = "2022-02-13";
+
+  src = fetchFromGitHub {
+    owner = "vinceliuice";
+    repo = pname;
+    rev = version;
+    sha256 = "09z90g13l26v23nwr8n5bapwldp3hhdrdikynvm4vvb7qsvb4vrp";
+  };
+
+  postPatch = ''
+    patchShebangs install.sh
+
+    substituteInPlace install.sh \
+      --replace '$HOME/.local' $out \
+      --replace '$HOME/.config' $out/share
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    name= ./install.sh --dest $out/share/themes
+
+    mkdir -p $out/share/sddm/themes
+    cp -a sddm/Layan* $out/share/sddm/themes/
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = gitUpdater {inherit pname version; };
+
+  meta = with lib; {
+    description = "A flat Design theme for KDE Plasma desktop";
+    homepage = "https://github.com/vinceliuice/Layan-kde";
+    license = licenses.gpl3Only;
+    platforms = platforms.all;
+    maintainers = [ maintainers.romildo ];
+  };
+}
diff --git a/pkgs/desktops/mate/mate-tweak/default.nix b/pkgs/desktops/mate/mate-tweak/default.nix
index e0fc06135e1..7874586ce8e 100644
--- a/pkgs/desktops/mate/mate-tweak/default.nix
+++ b/pkgs/desktops/mate/mate-tweak/default.nix
@@ -14,13 +14,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "mate-tweak";
-  version = "22.04.1";
+  version = "22.04.4";
 
   src = fetchFromGitHub {
     owner = "ubuntu-mate";
     repo = pname;
     rev = version;
-    sha256 = "FcXJc8tlpP9RCrO6EVGvHPFF6qXorImzi9UccgZU+co=";
+    sha256 = "ncBN1wjCcMtuasnXk7WMge+9MK7BMmTu89/R+hiY/Ks=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-cpufreq-plugin/default.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-cpufreq-plugin/default.nix
index 4743099506c..fb070ed3652 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-cpufreq-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-cpufreq-plugin/default.nix
@@ -3,8 +3,8 @@
 mkXfceDerivation {
   category = "panel-plugins";
   pname = "xfce4-cpufreq-plugin";
-  version = "1.2.6";
-  sha256 = "sha256-HS+9pBCHy0NmDVUwL8QFDPeVpKyKib8YCwV8fZDL5Uc=";
+  version = "1.2.7";
+  sha256 = "sha256-M+BehEYcHZlnuYwBlI7F0aPxPGwExTL5I9Jf6W5ugOY=";
 
   buildInputs = [ gtk3 libxfce4ui libxfce4util xfce4-panel xfconf ];
 
diff --git a/pkgs/development/ocaml-modules/index/default.nix b/pkgs/development/ocaml-modules/index/default.nix
index 34b2ee668ea..3dc4a9856f9 100644
--- a/pkgs/development/ocaml-modules/index/default.nix
+++ b/pkgs/development/ocaml-modules/index/default.nix
@@ -6,11 +6,11 @@
 
 buildDunePackage rec {
   pname = "index";
-  version = "1.5.0";
+  version = "1.6.0";
 
   src = fetchurl {
     url = "https://github.com/mirage/index/releases/download/${version}/index-${version}.tbz";
-    sha256 = "1q1lv960dk1br8nz8gkibdywl2wv64ywib7b9jn33f6mpb81qc9f";
+    sha256 = "sha256:150mcsh8vj2hapfnxbjmacanjy4avrv8yk1lyaxmqj3fpmn1y32y";
   };
 
   minimalOCamlVersion = "4.08";
diff --git a/pkgs/development/python-modules/azure-storage-blob/default.nix b/pkgs/development/python-modules/azure-storage-blob/default.nix
index 8d3bb5aca3e..669ab37e4db 100644
--- a/pkgs/development/python-modules/azure-storage-blob/default.nix
+++ b/pkgs/development/python-modules/azure-storage-blob/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "azure-storage-blob";
-  version = "12.9.0";
+  version = "12.10.0";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "cff66a115c73c90e496c8c8b3026898a3ce64100840276e9245434e28a864225";
+    sha256 = "sha256-PH3CyT5/8qcxrNZqNqHwpiZgcrQVTeukiU2riRKF6jo=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/azure-storage-file-share/default.nix b/pkgs/development/python-modules/azure-storage-file-share/default.nix
index 421b46a9948..c7c59fd2b9f 100644
--- a/pkgs/development/python-modules/azure-storage-file-share/default.nix
+++ b/pkgs/development/python-modules/azure-storage-file-share/default.nix
@@ -11,13 +11,13 @@
 
 buildPythonPackage rec {
   pname = "azure-storage-file-share";
-  version = "12.6.0";
+  version = "12.7.0";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "7eb0cde00fbbb6b780da8bdd81312ab79de706c4a2601e4eded1bc430da680a8";
+    sha256 = "sha256-kYNugiWNlXEgryKLwrzytca/W+2481RqqUCbdJWrqDI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-pubsub/default.nix b/pkgs/development/python-modules/google-cloud-pubsub/default.nix
index 20ae2baed59..5f9fdb2833d 100644
--- a/pkgs/development/python-modules/google-cloud-pubsub/default.nix
+++ b/pkgs/development/python-modules/google-cloud-pubsub/default.nix
@@ -14,12 +14,12 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-pubsub";
-  version = "2.10.0";
+  version = "2.11.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-ldnzEeinr2kJ8q52lq5uMKpnXwTvHQII1oUegogR8OA=";
+    sha256 = "sha256-btPJ2X+I0f8C3YDB9bZwPv7HWnqsq9koWsT+CyK1AgM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/hahomematic/default.nix b/pkgs/development/python-modules/hahomematic/default.nix
index c9a398db26a..515d6ed8d95 100644
--- a/pkgs/development/python-modules/hahomematic/default.nix
+++ b/pkgs/development/python-modules/hahomematic/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "hahomematic";
-  version = "0.36.2";
+  version = "0.36.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "danielperna84";
     repo = pname;
     rev = version;
-    sha256 = "sha256-nGM0EY/KcRAl9jwZCNzcSapH7TJSkpJuKF2IfHXUO7M=";
+    sha256 = "sha256-S5KWyW7aeR2qdBzXQ4ka2nuxGPt69LHyq2CUdRPG9ig=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/psygnal/default.nix b/pkgs/development/python-modules/psygnal/default.nix
index 94cfaaa78c5..4e05dd51b05 100644
--- a/pkgs/development/python-modules/psygnal/default.nix
+++ b/pkgs/development/python-modules/psygnal/default.nix
@@ -13,12 +13,12 @@
 }: buildPythonPackage rec
 {
   pname = "psygnal";
-  version = "0.3.0";
+  version = "0.3.3";
   src = fetchFromGitHub {
     owner = "tlambert03";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-vrGym/V0cSGIjBWMWpDrPBijEOFayK1vdR02gsWzRvo=";
+    sha256 = "sha256-BQmcA1gD2i4sxROH+a7gStcNK1mXYVerIZ2y6gn8vI8=";
   };
   buildInputs = [ setuptools-scm ];
   propagatedBuildInputs = [ typing-extensions ];
diff --git a/pkgs/development/python-modules/pytenable/default.nix b/pkgs/development/python-modules/pytenable/default.nix
index e4417139bfa..843f140ce75 100644
--- a/pkgs/development/python-modules/pytenable/default.nix
+++ b/pkgs/development/python-modules/pytenable/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "pytenable";
-  version = "1.4.3";
+  version = "1.4.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "tenable";
     repo = "pyTenable";
     rev = version;
-    hash = "sha256-p9d3wZkOMhNQWJN6tCNUlW15A3irU8QN/nm7PLGTE/M=";
+    hash = "sha256-qp+e40z24RIOV5RfSw/nI/y1Z3972nCLN8DgQyLbDOc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/soundfile/default.nix b/pkgs/development/python-modules/soundfile/default.nix
index 9a1d614062b..c1b68e61088 100644
--- a/pkgs/development/python-modules/soundfile/default.nix
+++ b/pkgs/development/python-modules/soundfile/default.nix
@@ -1,7 +1,8 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, pytest
+, fetchpatch
+, pytestCheckHook
 , numpy
 , libsndfile
 , cffi
@@ -12,6 +13,8 @@
 buildPythonPackage rec {
   pname = "soundfile";
   version = "0.10.3.post1";
+  # https://github.com/bastibe/python-soundfile/issues/157
+  disabled = isPyPy || stdenv.isi686;
 
   src = fetchPypi {
     pname = "SoundFile";
@@ -19,22 +22,30 @@ buildPythonPackage rec {
     sha256 = "0yqhrfz7xkvqrwdxdx2ydy4h467sk7z3gf984y1x2cq7cm1gy329";
   };
 
-    checkInputs = [ pytest ];
-    propagatedBuildInputs = [ numpy libsndfile cffi ];
-    propagatedNativeBuildInputs = [ cffi ];
+  patches = [
+    # Fix build on macOS arm64, https://github.com/bastibe/python-soundfile/pull/332
+    (fetchpatch {
+      url = "https://github.com/bastibe/python-soundfile/commit/e554e9ce8bed96207d587e6aa661e4b08f1c6a79.patch";
+      sha256 = "sha256-vu/7s5q4I3yBnoNHmmFmcXvOLFcPwY9ri9ri6cKLDwU=";
+    })
+  ];
 
-    meta = {
-      description = "An audio library based on libsndfile, CFFI and NumPy";
-      license = lib.licenses.bsd3;
-      homepage = "https://github.com/bastibe/PySoundFile";
-      maintainers = with lib.maintainers; [ fridh ];
-    };
+  postPatch = ''
+    substituteInPlace soundfile.py --replace "_find_library('sndfile')" "'${libsndfile.out}/lib/libsndfile${stdenv.hostPlatform.extensions.sharedLibrary}'"
+  '';
 
-    postPatch = ''
-      substituteInPlace soundfile.py --replace "_find_library('sndfile')" "'${libsndfile.out}/lib/libsndfile${stdenv.hostPlatform.extensions.sharedLibrary}'"
-    '';
+  checkInputs = [ pytestCheckHook ];
+  propagatedBuildInputs = [ numpy libsndfile cffi ];
+  propagatedNativeBuildInputs = [ cffi ];
 
-    # https://github.com/bastibe/PySoundFile/issues/157
-    disabled = isPyPy ||  stdenv.isi686;
+  # Test fails on aarch64-darwin with `MemoryError`, 53 failed, 31 errors, see
+  # https://github.com/bastibe/python-soundfile/issues/331
+  doCheck = stdenv.system != "aarch64-darwin";
 
+  meta = {
+    description = "An audio library based on libsndfile, CFFI and NumPy";
+    license = lib.licenses.bsd3;
+    homepage = "https://github.com/bastibe/python-soundfile";
+    maintainers = with lib.maintainers; [ fridh ];
+  };
 }
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index 07a562a786c..f7618cee56c 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -32,13 +32,13 @@ with py.pkgs;
 
 buildPythonApplication rec {
   pname = "checkov";
-  version = "2.0.927";
+  version = "2.0.931";
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = pname;
     rev = version;
-    hash = "sha256-g/aJT1ZbD7wrsb4M3tvGmhWbElmnZbQkP0I0KV7J80c=";
+    hash = "sha256-y38oyQVHEi/bXcntxDU0AsOog6Sq/TPvF/NfJjybXiE=";
   };
 
   nativeBuildInputs = with py.pkgs; [
diff --git a/pkgs/development/tools/jless/default.nix b/pkgs/development/tools/jless/default.nix
index f18f3f556c5..558c9e019e1 100644
--- a/pkgs/development/tools/jless/default.nix
+++ b/pkgs/development/tools/jless/default.nix
@@ -1,21 +1,27 @@
-{ lib, fetchFromGitHub, rustPlatform }:
+{ lib, fetchFromGitHub, rustPlatform, stdenv, python3, AppKit, libxcb }:
 
 rustPlatform.buildRustPackage rec {
   pname = "jless";
-  version = "0.7.2";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "PaulJuliusMartinez";
     repo = "jless";
     rev = "v${version}";
-    sha256 = "sha256-IK+EllkctdhIYuzj7eLjadxKoutICPeSXAjLMFiRjmo=";
+    sha256 = "sha256-NB/s29M46mVhTsJWFYnBgJjSjUVbfdmuz69VdpVuR7c=";
   };
 
-  cargoSha256 = "sha256-CAyKWwtMq5UOODVRrpVHrhlep2wqG434dMGeYV2FSZY=";
+  cargoSha256 = "sha256-cPj9cTRhWK/YU8Cae63p4Vm5ohB1IfGL5fu7yyFGSXA=";
+
+  nativeBuildInputs = lib.optionals stdenv.isLinux [ python3 ];
+
+  buildInputs = [ ]
+    ++ lib.optionals stdenv.isDarwin [ AppKit ]
+    ++ lib.optionals stdenv.isLinux [ libxcb ];
 
   meta = with lib; {
     description = "A command-line pager for JSON data";
-    homepage = "https://github.com/PaulJuliusMartinez/jless";
+    homepage = "https://jless.io";
     license = licenses.mit;
     maintainers = with maintainers; [ jfchevrette zowoq ];
   };
diff --git a/pkgs/development/tools/packer/default.nix b/pkgs/development/tools/packer/default.nix
index 0b3b15d85bf..d42bb9e2860 100644
--- a/pkgs/development/tools/packer/default.nix
+++ b/pkgs/development/tools/packer/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "packer";
-  version = "1.7.10";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = "packer";
     rev = "v${version}";
-    sha256 = "sha256-KkdkLos55n+IE9oIZPADIcSgrE6kn0rDWzEkwoYfoFw=";
+    sha256 = "sha256-rvOfDMALzZx8LfChgB3nC4GCTlSET43SkhW1EkA59zo=";
   };
 
-  vendorSha256 = "sha256-oSIwp8t+US8yNziuq0BR8BsVR1/e0jkxE4QuiqyheQQ=";
+  vendorSha256 = "sha256-ZQ+7F49VnpPtxWlZVBez2mpVCx8gIPEDKBD5qM9NcMo=";
 
   subPackages = [ "." ];
 
@@ -32,7 +32,7 @@ buildGoModule rec {
     description = "A tool for creating identical machine images for multiple platforms from a single source configuration";
     homepage    = "https://www.packer.io";
     license     = licenses.mpl20;
-    maintainers = with maintainers; [ cstrahan zimbatm ma27 ];
+    maintainers = with maintainers; [ cstrahan zimbatm ma27 techknowlogick ];
     changelog   = "https://github.com/hashicorp/packer/blob/v${version}/CHANGELOG.md";
     platforms   = platforms.unix;
   };
diff --git a/pkgs/development/tools/protoc-gen-validate/default.nix b/pkgs/development/tools/protoc-gen-validate/default.nix
new file mode 100644
index 00000000000..9a77437a372
--- /dev/null
+++ b/pkgs/development/tools/protoc-gen-validate/default.nix
@@ -0,0 +1,24 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "protoc-gen-validate";
+  version = "0.6.7";
+
+  src = fetchFromGitHub {
+    owner = "envoyproxy";
+    repo = "protoc-gen-validate";
+    rev = "v${version}";
+    sha256 = "sha256-ouo6raNbvQyuY4IY1JEN45Ss7zb3EoR/WIRzL7hXLNI=";
+  };
+
+  vendorSha256 = "sha256-HbUEhoB6PPHwN/xym6dTkS54+EqVU1n8EIym8W2wt3I=";
+
+  excludedPackages = [ "tests" ];
+
+  meta = with lib; {
+    description = "Protobuf plugin for generating polyglot message validators";
+    homepage = "https://github.com/envoyproxy/protoc-gen-validate";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ matthewpi ];
+  };
+}
diff --git a/pkgs/development/tools/sumneko-lua-language-server/default.nix b/pkgs/development/tools/sumneko-lua-language-server/default.nix
index 4ec62ed4d29..88fa62903dd 100644
--- a/pkgs/development/tools/sumneko-lua-language-server/default.nix
+++ b/pkgs/development/tools/sumneko-lua-language-server/default.nix
@@ -4,13 +4,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "sumneko-lua-language-server";
-  version = "2.6.4";
+  version = "2.6.7";
 
   src = fetchFromGitHub {
     owner = "sumneko";
     repo = "lua-language-server";
     rev = version;
-    sha256 = "sha256-oUIgEWLcpEZHtL1wvTAezLtz2PecddtwhzbLhGqso/k=";
+    sha256 = "sha256-m9vtopRjxT9Re8pDdzfFUpg3zYAFE8zqFemgaNAbsvM=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/tools/yq-go/default.nix b/pkgs/development/tools/yq-go/default.nix
index bfe18fc4758..e8cd2a134fd 100644
--- a/pkgs/development/tools/yq-go/default.nix
+++ b/pkgs/development/tools/yq-go/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "yq-go";
-  version = "4.21.1";
+  version = "4.22.1";
 
   src = fetchFromGitHub {
     owner = "mikefarah";
     repo = "yq";
     rev = "v${version}";
-    sha256 = "sha256-283xe7FVHYSsRl4cZD7WDzIW1gqNAFsNrWYJkthZheU=";
+    sha256 = "sha256-+yVf9pSK2cH/d5fdaGSBrjce8vVqE9XMpZSI8s4xoJI=";
   };
 
   vendorSha256 = "sha256-F11FnDYJ59aKrdRXDPpKlhX52yQXdaN1sblSkVI2j9w=";
diff --git a/pkgs/games/factorio/versions.json b/pkgs/games/factorio/versions.json
index 663dffe2498..3c083c555d2 100644
--- a/pkgs/games/factorio/versions.json
+++ b/pkgs/games/factorio/versions.json
@@ -2,12 +2,12 @@
   "x86_64-linux": {
     "alpha": {
       "experimental": {
-        "name": "factorio_alpha_x64-1.1.53.tar.xz",
+        "name": "factorio_alpha_x64-1.1.56.tar.xz",
         "needsAuth": true,
-        "sha256": "1l5sk9rhf4pq9l87w5sv4a1ikqx8rpby5hf4xn7sdsm9mshd3wyw",
+        "sha256": "1i9mcq8m48ar0b3x53zgi5x9rsaddmlm2wqaphyf81xampl7ivcx",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/1.1.53/alpha/linux64",
-        "version": "1.1.53"
+        "url": "https://factorio.com/get-download/1.1.56/alpha/linux64",
+        "version": "1.1.56"
       },
       "stable": {
         "name": "factorio_alpha_x64-1.1.53.tar.xz",
@@ -20,12 +20,12 @@
     },
     "demo": {
       "experimental": {
-        "name": "factorio_demo_x64-1.1.53.tar.xz",
+        "name": "factorio_demo_x64-1.1.56.tar.xz",
         "needsAuth": false,
-        "sha256": "0m3mk296w4azma2v5z6pay1caqql2jfnlcyyd120laxl4rdg2k76",
+        "sha256": "0g1gphysh79h1frcjpfd5i3fpi05y8mq9gwmgnmalmr56w5n4qlz",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/1.1.53/demo/linux64",
-        "version": "1.1.53"
+        "url": "https://factorio.com/get-download/1.1.56/demo/linux64",
+        "version": "1.1.56"
       },
       "stable": {
         "name": "factorio_demo_x64-1.1.53.tar.xz",
@@ -38,12 +38,12 @@
     },
     "headless": {
       "experimental": {
-        "name": "factorio_headless_x64-1.1.53.tar.xz",
+        "name": "factorio_headless_x64-1.1.56.tar.xz",
         "needsAuth": false,
-        "sha256": "18ra52h32nhdqxz6vagp9nw3an5pgamariy0ny050xr2xpidw3v1",
+        "sha256": "174fvi9slpdp3y8j46w0w0ays7i7gy98il74xx5wxh7s94zb1b68",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/1.1.53/headless/linux64",
-        "version": "1.1.53"
+        "url": "https://factorio.com/get-download/1.1.56/headless/linux64",
+        "version": "1.1.56"
       },
       "stable": {
         "name": "factorio_headless_x64-1.1.53.tar.xz",
diff --git a/pkgs/os-specific/darwin/sketchybar/default.nix b/pkgs/os-specific/darwin/sketchybar/default.nix
index be44db38fe1..cc5c4ae2045 100644
--- a/pkgs/os-specific/darwin/sketchybar/default.nix
+++ b/pkgs/os-specific/darwin/sketchybar/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, Carbon, Cocoa, SkyLight }:
+{ lib, stdenv, fetchFromGitHub, memstreamHook, Carbon, Cocoa, SkyLight }:
 
 let
   inherit (stdenv.hostPlatform) system;
@@ -10,20 +10,17 @@ in
 
 stdenv.mkDerivation rec {
   pname = "sketchybar";
-  version = "2.4.3";
+  version = "2.5.0";
 
   src = fetchFromGitHub {
     owner = "FelixKratz";
     repo = "SketchyBar";
     rev = "v${version}";
-    sha256 = "1370xjl8sas5nghxgjxmc1zgskf28g40pv7nxgh37scjwdrkrrvb";
+    sha256 = "sha256-ucTyJhRhSVyE4E/x6PtFz7nHRUg6cKKVOrRpPs39iO8=";
   };
 
-  buildInputs = [ Carbon Cocoa SkyLight ];
-
-  postPatch = ''
-    sed -i -e '/^#include <malloc\/_malloc.h>/d' src/*.[ch] src/*/*.[ch]
-  '';
+  buildInputs = [ Carbon Cocoa SkyLight ]
+    ++ lib.optionals (stdenv.system == "x86_64-darwin") [ memstreamHook ];
 
   makeFlags = [
     target
diff --git a/pkgs/servers/dex/default.nix b/pkgs/servers/dex/default.nix
index 16dc5f8bafd..c93f7316301 100644
--- a/pkgs/servers/dex/default.nix
+++ b/pkgs/servers/dex/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "dex";
-  version = "2.30.0";
+  version = "2.31.0";
 
   src = fetchFromGitHub {
     owner = "dexidp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Z/X9Db57eNUJdjzLCJNIW3lCRw05JP2TQ43PqKO6CiI=";
+    sha256 = "sha256-tr7rs2ymHpMEtNwvLhgEzp94wO/k/oY814NS0N4ONsg=";
   };
 
-  vendorSha256 = "sha256-ksN/1boBQVhevlDseVZsGUWL+Bwy4AMgGNdOPgsNNxk=";
+  vendorSha256 = "sha256-l+/qjYokg5zHAFkKxtkdX49HqVW6kfz7OHqs6SRKDYg=";
 
   subPackages = [
     "cmd/dex"
diff --git a/pkgs/servers/http/nginx/quic.nix b/pkgs/servers/http/nginx/quic.nix
index f0a7a367555..4db1b19644c 100644
--- a/pkgs/servers/http/nginx/quic.nix
+++ b/pkgs/servers/http/nginx/quic.nix
@@ -6,8 +6,8 @@
 callPackage ./generic.nix args {
   src = fetchhg {
     url = "https://hg.nginx.org/nginx-quic";
-    rev = "6f8253673669"; # branch=quic
-    sha256 = "sha256:0zl4rws07vr8z7ml7sqlb70v3cx1cms7iablndqd38iqcx0bvjrq";
+    rev = "55b38514729b"; # branch=quic
+    sha256 = "sha256-EJ3Fuxb4Z43I5eSb3mzzIOBfppAZ4Adv1yVZWbVCv0A=";
   };
 
   preConfigure = ''
@@ -19,5 +19,5 @@ callPackage ./generic.nix args {
     "--with-stream_quic_module"
   ];
 
-  version = "1.21.5-quic";
+  version = "1.21.7-quic";
 }
diff --git a/pkgs/shells/fish/plugins/default.nix b/pkgs/shells/fish/plugins/default.nix
index ab244d282ec..98b41f6cc18 100644
--- a/pkgs/shells/fish/plugins/default.nix
+++ b/pkgs/shells/fish/plugins/default.nix
@@ -19,6 +19,8 @@ lib.makeScope newScope (self: with self; {
 
   fzf-fish = callPackage ./fzf-fish.nix { };
 
+  hydro = callPackage ./hydro.nix { };
+
   pisces = callPackage ./pisces.nix { };
 
   pure = callPackage ./pure.nix { };
diff --git a/pkgs/shells/fish/plugins/hydro.nix b/pkgs/shells/fish/plugins/hydro.nix
new file mode 100644
index 00000000000..efc85cfcd0b
--- /dev/null
+++ b/pkgs/shells/fish/plugins/hydro.nix
@@ -0,0 +1,20 @@
+{ lib, buildFishPlugin, fetchFromGitHub }:
+
+buildFishPlugin rec {
+  pname = "hydro";
+  version = "d4875065ceea226f58ead97dd9b2417937344d6e";
+
+  src = fetchFromGitHub {
+    owner = "jorgebucaran";
+    repo = "hydro";
+    rev = version;
+    sha256 = "sha256-nXeDnqqOuZyrqGTPEQtYlFvrFvy1bZVMF4CA37b0lsE=";
+  };
+
+  meta = with lib; {
+    description = "Ultra-pure, lag-free prompt with async Git status.";
+    homepage = "https://github.com/jorgebucaran/hydro`";
+    license = licenses.mit;
+    maintainers = with maintainers; [ mrhedgehog ];
+  };
+}
diff --git a/pkgs/tools/misc/plantuml/default.nix b/pkgs/tools/misc/plantuml/default.nix
index 42b673e5b18..8c4fa097ea4 100644
--- a/pkgs/tools/misc/plantuml/default.nix
+++ b/pkgs/tools/misc/plantuml/default.nix
@@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl, makeWrapper, jre, graphviz }:
 
 stdenv.mkDerivation rec {
-  version = "1.2022.1";
+  version = "1.2022.2";
   pname = "plantuml";
 
   src = fetchurl {
     url = "mirror://sourceforge/project/plantuml/${version}/plantuml.${version}.jar";
-    sha256 = "sha256-oEOhf7nLVGJqoK/pyTWzF+s3OYsGcEy5pIj8obSrkRY=";
+    sha256 = "sha256-4LPR8gdpfebq5U/umxcFfqe7i6qJHLqhOAu7DfYzTY8=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/misc/yt-dlp/default.nix b/pkgs/tools/misc/yt-dlp/default.nix
index b73b41acd88..89ca84395d5 100644
--- a/pkgs/tools/misc/yt-dlp/default.nix
+++ b/pkgs/tools/misc/yt-dlp/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, brotli
 , ffmpeg
 , rtmpdump
 , phantomjs2
@@ -11,7 +12,6 @@
 , ffmpegSupport ? true
 , rtmpSupport ? true
 , phantomjsSupport ? false
-, hlsEncryptedSupport ? true
 , withAlias ? false # Provides bin/youtube-dl for backcompat
 }:
 
@@ -20,16 +20,15 @@ buildPythonPackage rec {
   # The websites yt-dlp deals with are a very moving target. That means that
   # downloads break constantly. Because of that, updates should always be backported
   # to the latest stable release.
-  version = "2022.2.4";
+  version = "2022.3.8.2";
 
   src = fetchPypi {
     inherit pname;
     version = builtins.replaceStrings [ ".0" ] [ "." ] version;
-    sha256 = "sha256-gbUO18+c/MBC2PWhrS0c17E8SLNsB/rxiAaW6sCn3bU=";
+    sha256 = "sha256-aFRleMGObOh0ULU3adXVt/WiPlIJeEl222x8y/eVSyE=";
   };
 
-  propagatedBuildInputs = [ websockets mutagen ]
-    ++ lib.optional hlsEncryptedSupport pycryptodomex;
+  propagatedBuildInputs = [ brotli mutagen pycryptodomex websockets ];
 
   # Ensure these utilities are available in $PATH:
   # - ffmpeg: post-processing & transcoding support
@@ -52,7 +51,7 @@ buildPythonPackage rec {
   doCheck = false;
 
   postInstall = lib.optionalString withAlias ''
-      ln -s "$out/bin/yt-dlp" "$out/bin/youtube-dl"
+    ln -s "$out/bin/yt-dlp" "$out/bin/youtube-dl"
   '';
 
   meta = with lib; {
@@ -68,6 +67,6 @@ buildPythonPackage rec {
       you can modify it, redistribute it or use it however you like.
     '';
     license = licenses.unlicense;
-    maintainers = with maintainers; [ mkg20001 ];
+    maintainers = with maintainers; [ mkg20001 SuperSandro2000 ];
   };
 }
diff --git a/pkgs/tools/security/exploitdb/default.nix b/pkgs/tools/security/exploitdb/default.nix
index db0c7f435ac..14b7d7efab2 100644
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@@ -2,14 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2022-03-08";
+  version = "2022-03-10";
 
   src = fetchFromGitHub {
     owner = "offensive-security";
     repo = pname;
     rev = version;
-    sha256 = "sha256-XgInxwJfT0a5t3H5p9Q7KBUvfDRf5cOY6uAbXTJxuaY=";
-
+    sha256 = "sha256-zKFkPRmA2Hl/NksJTf76RcPr1nvaLdZu2fyBp5PcZ0Y=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index ec218e2fba0..fea1b617a7d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -395,6 +395,8 @@ with pkgs;
 
   protoc-gen-twirp_typescript = callPackage ../development/tools/protoc-gen-twirp_typescript { };
 
+  protoc-gen-validate = callPackage ../development/tools/protoc-gen-validate { };
+
   proton-caller = callPackage ../applications/emulators/proton-caller { };
 
   ptags = callPackage ../development/tools/misc/ptags { };
@@ -6004,6 +6006,8 @@ with pkgs;
 
   gitaly = callPackage ../applications/version-management/gitlab/gitaly { };
 
+  gitqlient = libsForQt5.callPackage ../applications/version-management/gitqlient { };
+
   gitstats = callPackage ../applications/version-management/gitstats { };
 
   gitstatus = callPackage ../applications/version-management/git-and-tools/gitstatus { };
@@ -6886,7 +6890,9 @@ with pkgs;
 
   jl = haskellPackages.callPackage ../development/tools/jl { };
 
-  jless = callPackage ../development/tools/jless { };
+  jless = callPackage ../development/tools/jless {
+    inherit (darwin.apple_sdk.frameworks) AppKit;
+  };
 
   jmespath = callPackage ../development/tools/jmespath { };
 
@@ -8722,7 +8728,7 @@ with pkgs;
 
   p7zip = callPackage ../tools/archivers/p7zip { };
 
-  packagekit = callPackage ../tools/package-management/packagekit { };
+  packagekit = callPackage ../tools/package-management/packagekit { nix = nixVersions.nix_2_6; };
 
   packetdrill = callPackage ../tools/networking/packetdrill { };
 
@@ -23856,6 +23862,8 @@ with pkgs;
 
   layan-gtk-theme = callPackage ../data/themes/layan-gtk-theme { };
 
+  layan-kde = callPackage ../data/themes/layan-kde { };
+
   lato = callPackage ../data/fonts/lato {};
 
   league-of-moveable-type = callPackage ../data/fonts/league-of-moveable-type {};
@@ -28878,6 +28886,8 @@ with pkgs;
 
   styx = callPackage ../applications/misc/styx { };
 
+  sway-launcher-desktop = callPackage ../applications/misc/sway-launcher-desktop { };
+
   tecoc = callPackage ../applications/editors/tecoc { };
 
   viber = callPackage ../applications/networking/instant-messengers/viber { };
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index d6745c559e1..943ad79cc28 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -17611,8 +17611,8 @@ let
     pname = "PDF-API2";
     version = "2.042";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/S/SS/SSIMMS/PDF-API2-2.038.tar.gz";
-      sha256 = "dEfEdJsCp4T1JdPH7OmdNLChBHXbZQlvYxZ0jdL5vQk=";
+      url = "mirror://cpan/authors/id/S/SS/SSIMMS/PDF-API2-2.042.tar.gz";
+      sha256 = "0p9wsnn60mcxr4032ahai0d56x8gw76ydym2l4qxq086a10jk6db";
     };
     buildInputs = [ TestException TestMemoryCycle ];
     propagatedBuildInputs = [ FontTTF ];