Merge master into staging-next

43 files changed, 601 insertions, 131 deletions

diff --git a/doc/languages-frameworks/go.section.md b/doc/languages-frameworks/go.section.md
index 7cbf51c8e37..5f1838cd6fc 100644
--- a/doc/languages-frameworks/go.section.md
+++ b/doc/languages-frameworks/go.section.md
@@ -34,7 +34,6 @@ pet = buildGoModule rec {
     homepage = "https://github.com/knqyf263/pet";
     license = licenses.mit;
     maintainers = with maintainers; [ kalbasit ];
-    platforms = platforms.linux ++ platforms.darwin;
   };
 }
 ```
diff --git a/nixos/modules/hardware/onlykey/onlykey.udev b/nixos/modules/hardware/onlykey/onlykey.udev
index 61e3ee4e882..9c8873aafc9 100644
--- a/nixos/modules/hardware/onlykey/onlykey.udev
+++ b/nixos/modules/hardware/onlykey/onlykey.udev
@@ -14,5 +14,5 @@ KERNEL=="ttyACM*", ATTRS{idVendor}=="1d50", ATTRS{idProduct}=="60fc", MODE:="066
 #
 ATTRS{idVendor}=="16c0", ATTRS{idProduct}=="04[789B]?", ENV{ID_MM_DEVICE_IGNORE}="1"
 ATTRS{idVendor}=="16c0", ATTRS{idProduct}=="04[789A]?", ENV{MTP_NO_PROBE}="1"
-SUBSYSTEMS=="usb", ATTRS{idVendor}=="16c0", ATTRS{idProduct}=="04[789ABCD]?", GROUP+="plugdev"
-KERNEL=="ttyACM*", ATTRS{idVendor}=="16c0", ATTRS{idProduct}=="04[789B]?", GROUP+="plugdev"
+SUBSYSTEMS=="usb", ATTRS{idVendor}=="16c0", ATTRS{idProduct}=="04[789ABCD]?", GROUP="plugdev"
+KERNEL=="ttyACM*", ATTRS{idVendor}=="16c0", ATTRS{idProduct}=="04[789B]?", GROUP="plugdev"
diff --git a/nixos/modules/misc/ids.nix b/nixos/modules/misc/ids.nix
index d7fc9ca87d4..61e7a6a8fc3 100644
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@@ -352,6 +352,7 @@ in
       moonraker = 320;
       distcc = 321;
       webdav = 322;
+      pipewire = 323;
 
       # When adding a uid, make sure it doesn't match an existing gid. And don't use uids above 399!
 
@@ -658,6 +659,7 @@ in
       moonraker = 320;
       distcc = 321;
       webdav = 322;
+      pipewire = 323;
 
       # When adding a gid, make sure it doesn't match an existing
       # uid. Users and groups with the same name should have equal
diff --git a/nixos/modules/services/desktops/pipewire/pipewire-media-session.nix b/nixos/modules/services/desktops/pipewire/pipewire-media-session.nix
index 803438b6f7e..f7a03a4a3ea 100644
--- a/nixos/modules/services/desktops/pipewire/pipewire-media-session.nix
+++ b/nixos/modules/services/desktops/pipewire/pipewire-media-session.nix
@@ -96,6 +96,12 @@ in {
   config = mkIf cfg.enable {
     environment.systemPackages = [ cfg.package ];
     systemd.packages = [ cfg.package ];
+
+    # Enable either system or user units.
+    systemd.services.pipewire-media-session.enable = config.services.pipewire.systemWide;
+    systemd.user.services.pipewire-media-session.enable = !config.services.pipewire.systemWide;
+
+    systemd.services.pipewire-media-session.wantedBy = [ "pipewire.service" ];
     systemd.user.services.pipewire-media-session.wantedBy = [ "pipewire.service" ];
 
     environment.etc."pipewire/media-session.d/media-session.conf" = {
diff --git a/nixos/modules/services/desktops/pipewire/pipewire.nix b/nixos/modules/services/desktops/pipewire/pipewire.nix
index 372b4785f18..c3cfd46e61c 100644
--- a/nixos/modules/services/desktops/pipewire/pipewire.nix
+++ b/nixos/modules/services/desktops/pipewire/pipewire.nix
@@ -125,6 +125,22 @@ in {
       pulse = {
         enable = mkEnableOption "PulseAudio server emulation";
       };
+
+      systemWide = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = ''
+          If true, a system-wide PipeWire service and socket is enabled
+          allowing all users in the "pipewire" group to use it simultaneously.
+          If false, then user units are used instead, restricting access to
+          only one user.
+
+          Enabling system-wide PipeWire is however not recommended and disabled
+          by default according to
+          https://github.com/PipeWire/pipewire/blob/master/NEWS
+        '';
+      };
+
     };
   };
 
@@ -150,9 +166,20 @@ in {
 
     # PipeWire depends on DBUS but doesn't list it. Without this booting
     # into a terminal results in the service crashing with an error.
+    systemd.services.pipewire.bindsTo = [ "dbus.service" ];
+    systemd.user.services.pipewire.bindsTo = [ "dbus.service" ];
+
+    # Enable either system or user units.  Note that for pipewire-pulse there
+    # are only user units, which work in both cases.
+    systemd.sockets.pipewire.enable = cfg.systemWide;
+    systemd.services.pipewire.enable = cfg.systemWide;
+    systemd.user.sockets.pipewire.enable = !cfg.systemWide;
+    systemd.user.services.pipewire.enable = !cfg.systemWide;
+
+    systemd.sockets.pipewire.wantedBy = lib.mkIf cfg.socketActivation [ "sockets.target" ];
     systemd.user.sockets.pipewire.wantedBy = lib.mkIf cfg.socketActivation [ "sockets.target" ];
     systemd.user.sockets.pipewire-pulse.wantedBy = lib.mkIf (cfg.socketActivation && cfg.pulse.enable) ["sockets.target"];
-    systemd.user.services.pipewire.bindsTo = [ "dbus.service" ];
+
     services.udev.packages = [ cfg.package ];
 
     # If any paths are updated here they must also be updated in the package test.
@@ -196,7 +223,22 @@ in {
     environment.sessionVariables.LD_LIBRARY_PATH =
       lib.optional cfg.jack.enable "${cfg.package.jack}/lib";
 
+    users = lib.mkIf cfg.systemWide {
+      users.pipewire = {
+        uid = config.ids.uids.pipewire;
+        group = "pipewire";
+        extraGroups = [
+          "audio"
+          "video"
+        ] ++ lib.optional config.security.rtkit.enable "rtkit";
+        description = "Pipewire system service user";
+        isSystemUser = true;
+      };
+      groups.pipewire.gid = config.ids.gids.pipewire;
+    };
+
     # https://gitlab.freedesktop.org/pipewire/pipewire/-/issues/464#note_723554
+    systemd.services.pipewire.environment."PIPEWIRE_LINK_PASSIVE" = "1";
     systemd.user.services.pipewire.environment."PIPEWIRE_LINK_PASSIVE" = "1";
   };
 }
diff --git a/nixos/modules/services/networking/tinc.nix b/nixos/modules/services/networking/tinc.nix
index 9db433fa073..31731b60d48 100644
--- a/nixos/modules/services/networking/tinc.nix
+++ b/nixos/modules/services/networking/tinc.nix
@@ -435,5 +435,5 @@ in
     );
   };
 
-  meta.maintainers = with maintainers; [ minijackson ];
+  meta.maintainers = with maintainers; [ minijackson mic92 ];
 }
diff --git a/nixos/modules/services/x11/desktop-managers/enlightenment.nix b/nixos/modules/services/x11/desktop-managers/enlightenment.nix
index e3d876e82fd..d1513a596b9 100644
--- a/nixos/modules/services/x11/desktop-managers/enlightenment.nix
+++ b/nixos/modules/services/x11/desktop-managers/enlightenment.nix
@@ -36,6 +36,7 @@ in
       enlightenment.econnman
       enlightenment.efl
       enlightenment.enlightenment
+      enlightenment.ecrire
       enlightenment.ephoto
       enlightenment.rage
       enlightenment.terminology
diff --git a/pkgs/applications/graphics/opentoonz/default.nix b/pkgs/applications/graphics/opentoonz/default.nix
index 14a130d7f41..7fd9606f3ab 100644
--- a/pkgs/applications/graphics/opentoonz/default.nix
+++ b/pkgs/applications/graphics/opentoonz/default.nix
@@ -1,6 +1,6 @@
 { boost, cmake, fetchFromGitHub, freeglut, freetype, glew, libjpeg, libmypaint
-, libpng, libtiff, libusb1, lz4, xz, lzo, openblas, pkg-config, qtbase
-, qtmultimedia, qtscript, lib, stdenv, superlu, wrapQtAppsHook, }:
+, libpng, libtiff, libusb1, lz4, xz, lzo, openblas, opencv, pkg-config, qtbase
+, qtmultimedia, qtscript, qtserialport, lib, stdenv, superlu, wrapQtAppsHook, }:
 let source = import ./source.nix { inherit fetchFromGitHub; };
 in stdenv.mkDerivation rec {
   inherit (source) src;
@@ -24,9 +24,11 @@ in stdenv.mkDerivation rec {
     xz
     lzo
     openblas
+    opencv
     qtbase
     qtmultimedia
     qtscript
+    qtserialport
     superlu
   ];
 
diff --git a/pkgs/applications/graphics/opentoonz/libtiff.nix b/pkgs/applications/graphics/opentoonz/libtiff.nix
index 6663c47553e..43ba1592ccc 100644
--- a/pkgs/applications/graphics/opentoonz/libtiff.nix
+++ b/pkgs/applications/graphics/opentoonz/libtiff.nix
@@ -2,20 +2,55 @@
 # opentoonz requires its own modified version of libtiff.  We still build it as
 # a separate package
 #  1. For visibility for tools like vulnix, and
-#  2. To avoid a diamond-dependency problem with qt linking the normal libtiff
-#     and opentoonz linking qt and this modified libtiff, we build a qt against
-#     this modified libtiff as well.
+#  2. To avoid a diamond-dependency problem with opencv linking the normal libtiff
+#     and opentoonz linking opencv and this modified libtiff, we build an opencv
+#     against this modified libtiff as well.
+#
+# We use a separate mkDerivation rather than a minimal libtiff.overrideAttrs
+# because the main libtiff builds with cmake and this version of libtiff was
+# forked before libtiff gained CMake build capability (added in libtiff-4.0.5).
+
+{ lib, fetchFromGitHub, stdenv, pkg-config, zlib, libjpeg, xz, libtiff, }:
 
-{ fetchFromGitHub, libtiff }:
 let source = import ./source.nix { inherit fetchFromGitHub; };
-in libtiff.overrideAttrs (old: {
-  inherit (source) src;
+
+in stdenv.mkDerivation {
+  pname = "libtiff";
   version = source.versions.libtiff + "-opentoonz";
-  postUnpack = (old.postUnpack or "") + ''
+
+  inherit (source) src;
+  outputs = [ "bin" "dev" "out" "man" "doc" ];
+
+  nativeBuildInputs = [ pkg-config ];
+  propagatedBuildInputs = [ zlib libjpeg xz ];
+
+  postUnpack = ''
     sourceRoot="$sourceRoot/thirdparty/tiff-${source.versions.libtiff}"
   '';
+
   # opentoonz uses internal libtiff headers
-  postInstall = (old.postInstall or "") + ''
+  postInstall = ''
     cp libtiff/{tif_config,tif_dir,tiffiop}.h $dev/include
   '';
-})
+
+  meta = libtiff.meta // {
+    knownVulnerabilities = [''
+      Do not open untrusted files with Opentoonz:
+      Opentoonz uses an old custom fork of tibtiff from 2012 that is known to
+      be affected by at least these 50 vulnerabilities:
+        CVE-2012-4564 CVE-2013-4232 CVE-2013-4243 CVE-2013-4244 CVE-2014-8127
+        CVE-2014-8128 CVE-2014-8129 CVE-2014-8130 CVE-2014-9330 CVE-2015-1547
+        CVE-2015-8781 CVE-2015-8782 CVE-2015-8783 CVE-2015-8784 CVE-2015-8870
+        CVE-2016-3620 CVE-2016-3621 CVE-2016-3623 CVE-2016-3624 CVE-2016-3625
+        CVE-2016-3631 CVE-2016-3632 CVE-2016-3633 CVE-2016-3634 CVE-2016-3658
+        CVE-2016-3945 CVE-2016-3990 CVE-2016-3991 CVE-2016-5102 CVE-2016-5314
+        CVE-2016-5315 CVE-2016-5316 CVE-2016-5318 CVE-2016-5319 CVE-2016-5321
+        CVE-2016-5322 CVE-2016-5323 CVE-2016-6223 CVE-2016-9453 CVE-2016-9532
+        CVE-2017-9935 CVE-2017-9937 CVE-2018-10963 CVE-2018-5360
+        CVE-2019-14973 CVE-2019-17546 CVE-2020-35521 CVE-2020-35522
+        CVE-2020-35523 CVE-2020-35524
+      More info at https://github.com/opentoonz/opentoonz/issues/4193
+    ''];
+    maintainers = with lib.maintainers; [ chkno ];
+  };
+}
diff --git a/pkgs/applications/graphics/opentoonz/source.nix b/pkgs/applications/graphics/opentoonz/source.nix
index 7378d2f5f96..27a4b8c0b0d 100644
--- a/pkgs/applications/graphics/opentoonz/source.nix
+++ b/pkgs/applications/graphics/opentoonz/source.nix
@@ -3,14 +3,14 @@
 
 { fetchFromGitHub, }: rec {
   versions = {
-    opentoonz = "1.4.0";
-    libtiff = "4.0.3";
+    opentoonz = "1.5.0";
+    libtiff = "4.0.3";  # The version in thirdparty/tiff-*
   };
 
   src = fetchFromGitHub {
     owner = "opentoonz";
     repo = "opentoonz";
     rev = "v${versions.opentoonz}";
-    sha256 = "0vgclx2yydsm5i2smff3fj8m750nhf35wfhva37kywgws01s189b";
+    sha256 = "1rw30ksw3zjph1cwxkfvqj0330v8wd4333gn0fdf3cln1w0549lk";
   };
 }
diff --git a/pkgs/applications/misc/udevil/default.nix b/pkgs/applications/misc/udevil/default.nix
index 9d1df5245ed..536d800001b 100644
--- a/pkgs/applications/misc/udevil/default.nix
+++ b/pkgs/applications/misc/udevil/default.nix
@@ -1,4 +1,13 @@
-{ lib, stdenv, fetchFromGitHub, intltool, glib, pkg-config, udev, util-linux, acl }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, acl
+, glib
+, intltool
+, pkg-config
+, udev
+, util-linux
+}:
 
 stdenv.mkDerivation rec {
   pname = "udevil";
@@ -13,32 +22,41 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ intltool glib udev ];
+  buildInputs = [
+    glib
+    intltool
+    udev
+  ];
 
-  configurePhase = ''
+  preConfigure = ''
     substituteInPlace src/Makefile.in --replace "-o root -g root" ""
     # do not set setuid bit in nix store
     substituteInPlace src/Makefile.in --replace 4755 0755
-    ./configure \
-      --prefix=$out \
-      --with-mount-prog=${util-linux}/bin/mount \
-      --with-umount-prog=${util-linux}/bin/umount \
-      --with-losetup-prog=${util-linux}/bin/losetup \
-      --with-setfacl-prog=${acl.bin}/bin/setfacl \
-      --sysconfdir=$prefix/etc
   '';
 
+  configureFlags = [
+    "--with-mount-prog=${util-linux}/bin/mount"
+    "--with-umount-prog=${util-linux}/bin/umount"
+    "--with-losetup-prog=${util-linux}/bin/losetup"
+    "--with-setfacl-prog=${acl.bin}/bin/setfacl"
+    "--sysconfdir=${placeholder "out"}/etc"
+  ];
+
   postInstall = ''
     substituteInPlace $out/lib/systemd/system/devmon@.service \
       --replace /usr/bin/devmon "$out/bin/devmon"
   '';
 
-  patches = [ ./device-info-sys-stat.patch ];
+  patches = [
+    # sys/stat.h header missing on src/device-info.h
+    ./device-info-sys-stat.patch
+  ];
 
   meta = with lib; {
-    description = "A command line Linux program which mounts and unmounts removable devices without a password, shows device info, and monitors device changes";
     homepage = "https://ignorantguru.github.io/udevil/";
-    platforms = platforms.linux;
+    description = "Mount without password";
     license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ AndersonTorres ];
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/applications/misc/udiskie/default.nix b/pkgs/applications/misc/udiskie/default.nix
index 7563fa0ca3d..fb9c7021b15 100644
--- a/pkgs/applications/misc/udiskie/default.nix
+++ b/pkgs/applications/misc/udiskie/default.nix
@@ -1,7 +1,7 @@
 { lib
 , fetchFromGitHub
-, asciidoc-full
 , buildPythonApplication
+, asciidoc-full
 , docopt
 , gettext
 , gobject-introspection
@@ -19,15 +19,17 @@
 
 buildPythonApplication rec {
   pname = "udiskie";
-  version = "2.3.3";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "coldfix";
     repo = "udiskie";
     rev = "v${version}";
-    hash = "sha256-OeNAcL7jd8GiPVUGxWwX4N/G/jzxfyifaoSD/hXXwyM=";
+    hash = "sha256-T4kMPMXfehZT7P+TOd1llR2TbHPA/quNL545xxlmJfE=";
   };
 
+  outputs = [ "out" "man" ];
+
   nativeBuildInputs = [
     asciidoc-full # Man page
     gettext
@@ -40,7 +42,7 @@ buildPythonApplication rec {
     gtk3
     libappindicator-gtk3
     libnotify
-    librsvg # Because it uses SVG icons
+    librsvg # SVG icons
     udisks2
   ];
 
@@ -50,11 +52,13 @@ buildPythonApplication rec {
     pyyaml
   ];
 
-  postBuild = "make -C doc";
+  postBuild = ''
+    make -C doc
+  '';
 
   postInstall = ''
-    mkdir -p $out/share/man/man8
-    cp -v doc/udiskie.8 $out/share/man/man8/
+    mkdir -p $man/share/man/man8
+    cp -v doc/udiskie.8 $man/share/man/man8/
   '';
 
   checkInputs = [
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index 7edec1f5a62..b4fdf61d166 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -161,6 +161,18 @@ let
       ./patches/no-build-timestamps.patch
       # For bundling Widevine (DRM), might be replaceable via bundle_widevine_cdm=true in gnFlags:
       ./patches/widevine-79.patch
+    ] ++ lib.optionals (versionRange "98" "99") [
+      # A critical Ozone/Wayland fix:
+      (githubPatch {
+        # [linux/wayland] Fixed terminate caused by binding to wrong version.
+        commit = "dd4c3ddadbb9869f59cee201a38e9ca3b9154f4d";
+        sha256 = "sha256-FH7lBQTruMzkBT2XQ+kgADmJA0AxJfaV/gvtoqfQ4a4=";
+      })
+      (githubPatch {
+        # [linux/wayland] Fixed terminate caused by binding to wrong version. (fixup)
+        commit = "a84b79daa8897b822336b8f348ef4daaae07af37";
+        sha256 = "sha256-2x6/rGGzTC6lKLMkVyD9RNCTsMVrtRQyr/NjSpaj2is=";
+      })
     ];
 
     postPatch = ''
diff --git a/pkgs/applications/networking/cluster/terraform-providers/default.nix b/pkgs/applications/networking/cluster/terraform-providers/default.nix
index f15104e3d38..0b54b707161 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/default.nix
@@ -13,6 +13,10 @@ let
       inherit (data) vendorSha256 version;
       subPackages = [ "." ];
       doCheck = false;
+      # https://github.com/hashicorp/terraform-provider-scaffolding/blob/a8ac8375a7082befe55b71c8cbb048493dd220c2/.goreleaser.yml
+      # goreleaser (used for builds distributed via terraform registry) requires that CGO is disabled
+      CGO_ENABLED = 0;
+      ldflags = [ "-s" "-w" "-X main.version=${data.version}" "-X main.commit=${data.rev}" ];
       src = fetchFromGitHub {
         inherit (data) owner repo rev sha256;
       };
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index f9dc7056eba..484625ff2d1 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -652,6 +652,15 @@
     "vendorSha256": null,
     "version": "3.2.1"
   },
+  "minio": {
+    "owner": "aminueza",
+    "provider-source-address": "registry.terraform.io/aminueza/minio",
+    "repo": "terraform-provider-minio",
+    "rev": "v1.2.0",
+    "sha256": "07f7kflmy0n8vbcxs2f62iqwm8fw8r97vgwwp38hmz3f1bix42qn",
+    "vendorSha256": "sha256-fBn0AfgdiFQ065SwqwMQeCuvJdkscc5QYsMMc/+p4V0=",
+    "version": "1.2.0"
+  },
   "mongodbatlas": {
     "owner": "mongodb",
     "provider-source-address": "registry.terraform.io/mongodb/mongodbatlas",
diff --git a/pkgs/applications/window-managers/berry/default.nix b/pkgs/applications/window-managers/berry/default.nix
index b2d28ca55f2..23aa8ff8201 100644
--- a/pkgs/applications/window-managers/berry/default.nix
+++ b/pkgs/applications/window-managers/berry/default.nix
@@ -1,24 +1,35 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
+, copyDesktopItems
+, fontconfig
+, freetype
 , libX11
 , libXext
 , libXft
 , libXinerama
-, fontconfig
-, freetype
+, makeDesktopItem
+, pkg-config
+, which
 }:
 
 stdenv.mkDerivation rec {
   pname = "berry";
-  version = "0.1.7";
+  version = "0.1.9";
 
   src = fetchFromGitHub {
     owner = "JLErvin";
     repo = pname;
     rev = version;
-    sha256 = "sha256-2kFVOE5l1KQvDb5KDL7y0p4M7awJLrxJF871cyc0YZ8=";
+    hash = "sha256-E1kjqSv2eylJ/9EGcxQrJ2P7VaehyUiirk0TxlPWSnM=";
   };
 
+  nativeBuildInputs = [
+    copyDesktopItems
+    pkg-config
+    which
+  ];
+
   buildInputs =[
     libX11
     libXext
@@ -28,16 +39,21 @@ stdenv.mkDerivation rec {
     freetype
   ];
 
-  preBuild = ''
-    makeFlagsArray+=( PREFIX="${placeholder "out"}"
-                      X11INC="${libX11.dev}/include"
-                      X11LIB="${libX11}/lib"
-                      XINERAMALIBS="-lXinerama"
-                      XINERAMAFLAGS="-DXINERAMA"
-                      FREETYPELIBS="-lfontconfig -lXft"
-                      FREETYPEINC="${freetype.dev}/include/freetype2" )
+  preConfigure = ''
+    patchShebangs configure
   '';
 
+  desktopItems = [
+    (makeDesktopItem {
+      name = pname;
+      exec = "berry";
+      comment = meta.description;
+      desktopName = "Berry Window Manager";
+      genericName = "Berry Window Manager";
+      categories = "Utility;";
+    })
+  ];
+
   meta = with lib; {
     description = "A healthy, bite-sized window manager";
     longDescription = ''
@@ -59,3 +75,5 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
   };
 }
+# TODO: report upstream that `which` is not POSIX; the `command` shell builtin
+# should be used instead
diff --git a/pkgs/applications/window-managers/pekwm/default.nix b/pkgs/applications/window-managers/pekwm/default.nix
index faa6f18564b..6f1a37f9379 100644
--- a/pkgs/applications/window-managers/pekwm/default.nix
+++ b/pkgs/applications/window-managers/pekwm/default.nix
@@ -1,6 +1,10 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
-, pkg-config
+, awk
+, grep
+, sed
+, runtimeShell
 , cmake
 , libXext
 , libXft
@@ -9,20 +13,32 @@
 , libXrandr
 , libjpeg
 , libpng
+, pkg-config
 }:
 
 stdenv.mkDerivation rec {
   pname = "pekwm";
-  version = "0.1.18";
+  version = "0.2.1";
 
   src = fetchFromGitHub {
     owner = "pekdon";
     repo = "pekwm";
     rev = "release-${version}";
-    sha256 = "sha256-R1XDEk097ycMI3R4SjUEJv37CiMaDCQMvg7N8haN0MM=";
+    hash= "sha256-voHPstdcd4CHnAdD3PMxca0A6MyMYJi8Ik0UlFB0vG0=";
   };
 
-  nativeBuildInputs = [ pkg-config cmake ];
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  cmakeFlags = [
+    "-DAWK=${awk}/bin/awk"
+    "-DGREP=${grep}/bin/grep"
+    "-DSED=${sed}/bin/sed"
+    "-DSH=${runtimeShell}"
+  ];
+
   buildInputs = [
     libXext
     libXft
@@ -34,24 +50,23 @@ stdenv.mkDerivation rec {
   ];
 
   meta = with lib; {
+    homepage = "https://www.pekwm.se/";
     description = "A lightweight window manager";
     longDescription = ''
-      pekwm is a window manager that once upon a time was based on the
-      aewm++ window manager, but it has evolved enough that it no
-      longer resembles aewm++ at all. It has a much expanded
-      feature-set, including window grouping (similar to ion, pwm, or
-      fluxbox), autoproperties, xinerama, keygrabber that supports
-      keychains, and much more.
-      - Lightweight and Unobtrusive, a window manager shouldn't be
-        noticed.
+      pekwm is a window manager that once upon a time was based on the aewm++
+      window manager, but it has evolved enough that it no longer resembles
+      aewm++ at all. It has a much expanded feature-set, including window
+      grouping (similar to ion, pwm, or fluxbox), autoproperties, xinerama,
+      keygrabber that supports keychains, and much more.
+
+      - Lightweight and Unobtrusive, a window manager shouldn't be noticed.
       - Very configurable, we all work and think in different ways.
-      - Automatic properties, for all the lazy people, make things
-        appear as they should when starting applications.
+      - Automatic properties, for all the lazy people, make things appear as
+        they should when starting applications.
       - Chainable Keygrabber, usability for everyone.
     '';
-      homepage = "https://www.pekwm.se/";
-      license = licenses.gpl2Plus;
-      maintainers = [ maintainers.AndersonTorres ];
-      platforms = platforms.linux;
+    license = licenses.gpl2Plus;
+    maintainers = [ maintainers.AndersonTorres ];
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/desktops/enlightenment/default.nix b/pkgs/desktops/enlightenment/default.nix
index 80b4eb58ab5..34b0ae86e4e 100644
--- a/pkgs/desktops/enlightenment/default.nix
+++ b/pkgs/desktops/enlightenment/default.nix
@@ -8,8 +8,9 @@
 
   #### APPLICATIONS
   econnman = callPackage ./econnman { };
+  ecrire = callPackage ./ecrire { };
+  ephoto = callPackage ./ephoto { };
   evisum = callPackage ./evisum { };
-  terminology = callPackage ./terminology { };
   rage = callPackage ./rage { };
-  ephoto = callPackage ./ephoto { };
+  terminology = callPackage ./terminology { };
 }
diff --git a/pkgs/desktops/enlightenment/ecrire/default.nix b/pkgs/desktops/enlightenment/ecrire/default.nix
new file mode 100644
index 00000000000..d152c943d58
--- /dev/null
+++ b/pkgs/desktops/enlightenment/ecrire/default.nix
@@ -0,0 +1,36 @@
+{ lib
+, stdenv
+, fetchurl
+, meson
+, ninja
+, pkg-config
+, efl
+}:
+
+stdenv.mkDerivation rec {
+  pname = "ecrire";
+  version = "0.2.0";
+
+  src = fetchurl {
+    url = "http://download.enlightenment.org/rel/apps/${pname}/${pname}-${version}.tar.xz";
+    sha256 = "1pszk583rzclfqy3dyjh1m9pz1hnr84vqz8vw9kngcnmj23mjr6r";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [
+    efl
+  ];
+
+  meta = with lib; {
+    description = "EFL simple text editor";
+    homepage = "https://www.enlightenment.org/";
+    license = licenses.gpl3Only;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ romildo ];
+  };
+}
diff --git a/pkgs/development/embedded/rshell/default.nix b/pkgs/development/embedded/rshell/default.nix
index bcda3c02dd6..a537af3692b 100644
--- a/pkgs/development/embedded/rshell/default.nix
+++ b/pkgs/development/embedded/rshell/default.nix
@@ -1,15 +1,26 @@
-{ lib, buildPythonApplication, fetchPypi, pyserial, pyudev }:
+{ lib
+, buildPythonApplication
+, fetchPypi
+, pyserial
+, pyudev
+, pythonOlder
+}:
 
 buildPythonApplication rec {
   pname = "rshell";
-  version = "0.0.30";
+  version = "0.0.31";
+
+  disabled = pythonOlder "3.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d2002d40d735204037d6142a6c2d51beecc763c124faaf759cabf7acd945be95";
+    sha256 = "7942b758a9ae5c6ff46516b0317f437dfce9f0721f3a3b635ebd501c9cd38fb9";
   };
 
-  propagatedBuildInputs = [ pyserial pyudev ];
+  propagatedBuildInputs = [
+    pyserial
+    pyudev
+  ];
 
   meta = with lib; {
     homepage = "https://github.com/dhylands/rshell";
diff --git a/pkgs/development/interpreters/clojure/default.nix b/pkgs/development/interpreters/clojure/default.nix
index 9fba39d70c7..45dc35681c3 100644
--- a/pkgs/development/interpreters/clojure/default.nix
+++ b/pkgs/development/interpreters/clojure/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "clojure";
-  version = "1.10.3.1053";
+  version = "1.10.3.1058";
 
   src = fetchurl {
     # https://clojure.org/releases/tools
     url = "https://download.clojure.org/install/clojure-tools-${version}.tar.gz";
-    sha256 = "p91+Ylx8HQL/o3Pq4Pd1c9GAMiOXvJSw+09LGYLj5Wo=";
+    sha256 = "guIQjiWyulITZZSjt/kCtU5qo4FG/2IK2rwBI6Ttfe0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libbaseencode/default.nix b/pkgs/development/libraries/libbaseencode/default.nix
index c40f9bafb47..b72f5ca1dbf 100644
--- a/pkgs/development/libraries/libbaseencode/default.nix
+++ b/pkgs/development/libraries/libbaseencode/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libbaseencode";
-  version = "1.0.11";
+  version = "1.0.12";
 
   src = fetchFromGitHub {
     owner = "paolostivanin";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1f52yh052z8k90d1ag6nk01p1gf4i1zxp1daw8mashs8avqr2m7g";
+    sha256 = "sha256-TKmM2BPzas9qbWI8n63lfR8OvsSj+BKC12NXpfe9aow=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/libcotp/default.nix b/pkgs/development/libraries/libcotp/default.nix
index 986890102dc..bd555bdbc36 100644
--- a/pkgs/development/libraries/libcotp/default.nix
+++ b/pkgs/development/libraries/libcotp/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libcotp";
-  version = "1.2.3";
+  version = "1.2.4";
 
   src = fetchFromGitHub {
     owner = "paolostivanin";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1qq4shwiz1if9vys052dnsbm4dfw1ynlj6nsb0v4zjly3ndspfsk";
+    sha256 = "sha256-PN0kd0CP2zrkuPTdaS3TdsdEl+Gy6CecrDSh0Bd7mRk=";
   };
 
   buildInputs = [ libbaseencode libgcrypt ];
diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index c00e297b68a..b6d96492fce 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -2,6 +2,7 @@
 , lib
 , buildPackages
 , fetchFromGitLab
+, fetchpatch
 , removeReferencesTo
 , python3
 , meson
@@ -102,6 +103,15 @@ let
       ./0090-pipewire-config-template-paths.patch
       # Place SPA data files in lib output to avoid dependency cycles
       ./0095-spa-data-dir.patch
+      # Fix attempt to put system service units into pkgs.systemd.
+      (fetchpatch {
+        url = "https://gitlab.freedesktop.org/pipewire/pipewire/-/commit/b666edde787b167c6e19b9356257d48007357acc.diff";
+        sha256 = "1pmnyyvrjykr46ld4a5frq3cc739f8h4jwvfj414lyx8c6ybm63s";
+      })
+      (fetchpatch {
+        url = "https://gitlab.freedesktop.org/pipewire/pipewire/-/commit/5054b48c9de655b4b48f7c801cb305d9eb122520.diff";
+        sha256 = "0myhb7h4g7x2nr08dpx8d7nqhsmzp90yanmkvm627r1xxnnr3ivn";
+      })
     ];
 
     nativeBuildInputs = [
@@ -154,6 +164,7 @@ let
       "-Dlibpulse=${mesonEnable pulseTunnelSupport}"
       "-Davahi=${mesonEnable zeroconfSupport}"
       "-Dgstreamer=${mesonEnable gstreamerSupport}"
+      "-Dsystemd-system-service=enabled"
       "-Dffmpeg=${mesonEnable ffmpegSupport}"
       "-Dbluez5=${mesonEnable bluezSupport}"
       "-Dbluez5-backend-hsp-native=${mesonEnable nativeHspSupport}"
diff --git a/pkgs/development/libraries/pipewire/media-session.nix b/pkgs/development/libraries/pipewire/media-session.nix
index 47cb3b41595..19940d8d747 100644
--- a/pkgs/development/libraries/pipewire/media-session.nix
+++ b/pkgs/development/libraries/pipewire/media-session.nix
@@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchFromGitLab
+, fetchpatch
 , meson
 , ninja
 , pkg-config
@@ -30,6 +31,19 @@ let
       sha256 = "sha256-e537gTkiNYMz2YJrOff/MXYWVDgHZDkqkSn8Qh+7Wr4=";
     };
 
+    patches = [
+      # Fix `ERROR: Tried to access unknown option "session-managers".`
+      (fetchpatch {
+        url = "https://gitlab.freedesktop.org/pipewire/media-session/-/commit/dfa740175c83e1cd0d815ad423f90872de566437.diff";
+        sha256 = "01rfwq8ipm8wyv98rxal1s5zrkf0pn9hgrngiq2wdbwj6vjdnr1h";
+      })
+      # Fix attempt to put system service units into pkgs.systemd.
+      (fetchpatch {
+        url = "https://gitlab.freedesktop.org/pipewire/media-session/-/commit/2ff6b0baec7325dde229013b9d37c93f8bc7edee.diff";
+        sha256 = "18gg7ca04ihl4ylnw78wdyrbvg66m8w43gg0wp258x4nv95gpps2";
+      })
+    ];
+
     nativeBuildInputs = [
       doxygen
       graphviz
@@ -48,6 +62,7 @@ let
 
     mesonFlags = [
       "-Ddocs=enabled"
+      "-Dsystemd-system-service=enabled"
       # We generate these empty files from the nixos module, don't bother installing them
       "-Dwith-module-sets=[]"
     ];
diff --git a/pkgs/development/python-modules/dm-haiku/default.nix b/pkgs/development/python-modules/dm-haiku/default.nix
new file mode 100644
index 00000000000..5468776c72d
--- /dev/null
+++ b/pkgs/development/python-modules/dm-haiku/default.nix
@@ -0,0 +1,59 @@
+{ buildPythonPackage
+, chex
+, cloudpickle
+, dill
+, dm-tree
+, fetchFromGitHub
+, jmp
+, lib
+, pytestCheckHook
+, tabulate
+, tensorflow
+}:
+
+buildPythonPackage rec {
+  pname = "dm-haiku";
+  version = "0.0.5";
+
+  src = fetchFromGitHub {
+    owner = "deepmind";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1mdqjcka0m1div63ngba8w8z94id4c1h8xqmnq1xpmgkc79224wa";
+  };
+
+  propagatedBuildInputs = [
+    jmp
+    tabulate
+  ];
+
+  checkInputs = [
+    chex
+    cloudpickle
+    dm-tree
+    pytestCheckHook
+    tensorflow
+  ];
+
+  pythonImportsCheck = [
+    "haiku"
+  ];
+
+  disabledTestPaths = [
+    # These tests require `bsuite` which isn't packaged in `nixpkgs`.
+    "examples/impala_lite_test.py"
+    "examples/impala/actor_test.py"
+    "examples/impala/learner_test.py"
+    # This test breaks on multiple cases with TF-related errors,
+    # likely that's the reason the upstream uses TF-nightly for tests?
+    # `nixpkgs` doesn't have the corresponding TF version packaged.
+    "haiku/_src/integration/jax2tf_test.py"
+  ];
+
+  meta = with lib; {
+    description = "Haiku is a simple neural network library for JAX developed by some of the authors of Sonnet.";
+    homepage = "https://github.com/deepmind/dm-haiku";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ ndl ];
+  };
+}
diff --git a/pkgs/development/python-modules/dulwich/default.nix b/pkgs/development/python-modules/dulwich/default.nix
index a0c7706c2ff..74595943a40 100644
--- a/pkgs/development/python-modules/dulwich/default.nix
+++ b/pkgs/development/python-modules/dulwich/default.nix
@@ -12,15 +12,19 @@
 , mock
 , pkgs
 , urllib3
+, pythonOlder
 }:
 
 buildPythonPackage rec {
-  version = "0.20.26";
+  version = "0.20.27";
   pname = "dulwich";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-OKpQ+FnI6lMHGgScPx1cxU99xgpBNqGrYxdWp59lgrU=";
+    hash = "sha256-9dP6dlmRTnorh4NahWZsdwHTdR+IFVFlPUzSVgsqEk4=";
   };
 
   LC_ALL = "en_US.UTF-8";
@@ -43,7 +47,9 @@ buildPythonPackage rec {
 
   doCheck = !stdenv.isDarwin;
 
-  pythonImportsCheck = [ "dulwich" ];
+  pythonImportsCheck = [
+    "dulwich"
+  ];
 
   meta = with lib; {
     description = "Simple Python implementation of the Git file formats and protocols";
diff --git a/pkgs/development/python-modules/genanki/default.nix b/pkgs/development/python-modules/genanki/default.nix
index 7b37be48f10..3989cf6f72c 100644
--- a/pkgs/development/python-modules/genanki/default.nix
+++ b/pkgs/development/python-modules/genanki/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "genanki";
-  version = "0.12.0";
+  version = "0.13.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f787ac440ff37a3ef3389030e992e3527f000f7a69498f797033ccfad07ebe62";
+    sha256 = "bfacdcadd7903ed6afce6168e1977e473b431677b358f8fd42e80b48cedd19ab";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/json-schema-for-humans/default.nix b/pkgs/development/python-modules/json-schema-for-humans/default.nix
index 5f2c5ac7fdd..f9452a25b7a 100644
--- a/pkgs/development/python-modules/json-schema-for-humans/default.nix
+++ b/pkgs/development/python-modules/json-schema-for-humans/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "json-schema-for-humans";
-  version = "0.39.3";
+  version = "0.39.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "coveooss";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-rg50AE30R1OErtOKppnkhg8MTuhEY6gdBgc7ipEkONA=";
+    sha256 = "sha256-gaholnLO5oIQaXgliuvlU2MfpjiCMgAPplOPgvMYim8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/oocsi/default.nix b/pkgs/development/python-modules/oocsi/default.nix
index 2f0ae510d01..c558ebcc1a6 100644
--- a/pkgs/development/python-modules/oocsi/default.nix
+++ b/pkgs/development/python-modules/oocsi/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "oocsi";
-  version = "0.4.2";
+  version = "0.4.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "020xfjvcgicj81zl3z9wnb2f9bha75bjw512b0cc38w66bniinjq";
+    sha256 = "sha256-AgDBsPoi0aQ6uglc7Zl4gxVmeyDCysoef5vZpxgwE/Q=";
   };
 
   # Tests are not shipped
diff --git a/pkgs/development/python-modules/pydmd/default.nix b/pkgs/development/python-modules/pydmd/default.nix
index dd166b78f86..f80f9003478 100644
--- a/pkgs/development/python-modules/pydmd/default.nix
+++ b/pkgs/development/python-modules/pydmd/default.nix
@@ -1,18 +1,21 @@
 { lib
 , stdenv
-, python
-, fetchFromGitHub
 , buildPythonPackage
+, fetchFromGitHub
 , future
+, matplotlib
 , numpy
+, pytestCheckHook
+, pythonOlder
 , scipy
-, matplotlib
-, nose
 }:
 
 buildPythonPackage rec {
   pname = "pydmd";
   version = "0.4";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "mathLab";
@@ -21,19 +24,31 @@ buildPythonPackage rec {
     sha256 = "1qwa3dyrrm20x0pzr7rklcw7433fd822n4m8bbbdd7z83xh6xm8g";
   };
 
-  propagatedBuildInputs = [ future numpy scipy matplotlib ];
-  checkInputs = [ nose ];
+  propagatedBuildInputs = [
+    future
+    matplotlib
+    numpy
+    scipy
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  disabledTestPaths = [
+    # Those tests take over 1.5 h on hydra. Also, an error and two failures
+    "tests/test_spdmd.py"
+  ];
 
-  checkPhase = ''
-    ${python.interpreter} test.py
-  '';
-  pythonImportsCheck = [ "pydmd" ];
+  pythonImportsCheck = [
+    "pydmd"
+  ];
 
-  meta = {
+  meta = with lib; {
     description = "Python Dynamic Mode Decomposition";
     homepage = "https://mathlab.github.io/PyDMD/";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ yl3dy ];
+    license = licenses.mit;
+    maintainers = with maintainers; [ yl3dy ];
     broken = stdenv.hostPlatform.isAarch64;
   };
 }
diff --git a/pkgs/development/python-modules/vt-py/default.nix b/pkgs/development/python-modules/vt-py/default.nix
index 28bd53a6047..e584b3de3e2 100644
--- a/pkgs/development/python-modules/vt-py/default.nix
+++ b/pkgs/development/python-modules/vt-py/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "vt-py";
-  version = "0.12.0";
+  version = "0.13.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "VirusTotal";
     repo = pname;
     rev = version;
-    sha256 = "1yjrhwy2m819yda70ir6h7jsndradaw9a4pxjl8ys8p909vljvgx";
+    sha256 = "sha256-yf1p56+mGVzG4HBlbIp/HvNSYJGQufzYjmPrtITaV5o=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index 38921d25fe0..6283e7d33e8 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -46,13 +46,13 @@ with py.pkgs;
 
 buildPythonApplication rec {
   pname = "checkov";
-  version = "2.0.702";
+  version = "2.0.706";
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = pname;
     rev = version;
-    sha256 = "sha256-6FaJkGQpjTNW73D39KD9qMw97znt9B1vzdlJPvqI7Vo=";
+    sha256 = "sha256-j9exVvGY3A23sTY5y4daWlZr7awkY1tQhTDykW9tsJU=";
   };
 
   nativeBuildInputs = with py.pkgs; [
diff --git a/pkgs/development/tools/build-managers/meson/0.60/default.nix b/pkgs/development/tools/build-managers/meson/0.60/default.nix
index 79870cd4d12..a5efccfac9c 100644
--- a/pkgs/development/tools/build-managers/meson/0.60/default.nix
+++ b/pkgs/development/tools/build-managers/meson/0.60/default.nix
@@ -9,11 +9,11 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "meson";
-  version = "0.60.2";
+  version = "0.60.3";
 
   src = python3.pkgs.fetchPypi {
     inherit pname version;
-    hash = "sha256-ZOaWhWW/G4FS9PnWyoFU77nhTKqaq/eyLnHmxdBT6SE=";
+    hash = "sha256-h8pfqTWKAYZFKTkr1k4CcVjrlK/KfHdmsYZu8n7MuY4=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/cocogitto/default.nix b/pkgs/development/tools/cocogitto/default.nix
new file mode 100644
index 00000000000..dc5b875ac0c
--- /dev/null
+++ b/pkgs/development/tools/cocogitto/default.nix
@@ -0,0 +1,42 @@
+{ lib, rustPlatform, fetchFromGitHub, installShellFiles, stdenv, Security, makeWrapper, git }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cocogitto";
+  version = "4.0.1";
+
+  src = fetchFromGitHub {
+    owner = "oknozor";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-uSKzHo1lEBiXsi1rOKvfD2zVlkAUVZ5k0y8iiTXYE2A=";
+  };
+
+  cargoSha256 = "sha256-gss3+XXyM//zER3gnN9qemIWaVDfs/f4gljmukMxoq0=";
+
+  # Test depend on git configuration that would likly exist in a normal user enviroment
+  # and might be failing to create the test repository it works in.
+  doCheck = false;
+
+  nativeBuildInputs = [ installShellFiles makeWrapper ];
+
+  buildInputs = lib.optional stdenv.isDarwin Security;
+
+  postInstall = ''
+    installShellCompletion --cmd cog \
+      --bash <($out/bin/cog generate-completions bash) \
+      --fish <($out/bin/cog generate-completions fish) \
+      --zsh  <($out/bin/cog generate-completions zsh)
+
+    wrapProgram $out/bin/cog \
+      --prefix PATH : "${lib.makeBinPath [ git ]}"
+    wrapProgram $out/bin/coco \
+      --prefix PATH : "${lib.makeBinPath [ git ]}"
+  '';
+
+  meta = with lib; {
+    description = "A set of cli tools for the conventional commit and semver specifications";
+    homepage = "https://github.com/oknozor/cocogitto";
+    license = licenses.mit;
+    maintainers = with maintainers; [ travisdavis-ops ];
+  };
+}
diff --git a/pkgs/misc/emulators/ppsspp/default.nix b/pkgs/misc/emulators/ppsspp/default.nix
index 124b8cb8e69..b84d18a4e7a 100644
--- a/pkgs/misc/emulators/ppsspp/default.nix
+++ b/pkgs/misc/emulators/ppsspp/default.nix
@@ -1,6 +1,5 @@
 { mkDerivation
 , fetchFromGitHub
-, fetchpatch
 , SDL2
 , cmake
 , ffmpeg
@@ -17,25 +16,16 @@
 
 mkDerivation rec {
   pname = "ppsspp";
-  version = "1.11";
+  version = "1.12.3";
 
   src = fetchFromGitHub {
     owner = "hrydgard";
     repo = pname;
     rev = "v${version}";
     fetchSubmodules = true;
-    sha256 = "sha256-vfp/vacIItlPP5dR7jzDT7oOUNFnjvvdR46yi79EJKU=";
+    sha256 = "sha256-S16rTB0svksW5MwrPV/+qpTK4uKZ7mFcmbOyEmMmzhY=";
   };
 
-  patches = [
-     # fix compability with ffmpeg 4.4, remove on next release after 1.11
-    (fetchpatch {
-      name = "fix_ffmpeg_4.4.patch";
-      url = "https://patch-diff.githubusercontent.com/raw/hrydgard/ppsspp/pull/14176.patch";
-      sha256 = "sha256-ecDoOydaLfL6+eFpahcO1TnRl866mZZVHlr6Qrib1mo=";
-    })
-  ];
-
   postPatch = ''
     substituteInPlace git-version.cmake --replace unknown ${src.rev}
     substituteInPlace UI/NativeApp.cpp --replace /usr/share $out/share
diff --git a/pkgs/misc/ite-backlight/default.nix b/pkgs/misc/ite-backlight/default.nix
new file mode 100644
index 00000000000..033ff0f2055
--- /dev/null
+++ b/pkgs/misc/ite-backlight/default.nix
@@ -0,0 +1,47 @@
+{ lib
+, pkgs
+, stdenv
+, ninja
+, libusb1
+, meson
+, boost
+, fetchFromGitHub
+, pkg-config
+, microsoft_gsl
+}:
+
+stdenv.mkDerivation rec {
+  pname = "ite-backlight";
+  version = "1.1";
+
+  src = fetchFromGitHub {
+    owner = "hexagonal-sun";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1hany4bn93mac9qyz97r1l858d48zdvvmn3mabzr3441ivqr9j0a";
+  };
+
+  nativeBuildInputs = [
+    ninja
+    pkg-config
+    meson
+    microsoft_gsl
+  ];
+
+  buildInputs = [
+    boost
+    libusb1
+  ];
+
+  meta = with lib; {
+    description = "Commands to control ite-backlight devices";
+    longDescription = ''
+      This project aims to provide a set of simple utilities for controlling ITE 8291
+      keyboard backlight controllers.
+    '';
+    license = with licenses; [ mit ];
+    homepage = "https://github.com/hexagonal-sun/ite-backlight";
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ hexagonal-sun ];
+  };
+}
diff --git a/pkgs/misc/vim-plugins/generated.nix b/pkgs/misc/vim-plugins/generated.nix
index 1d6954da571..4c050b5e3bc 100644
--- a/pkgs/misc/vim-plugins/generated.nix
+++ b/pkgs/misc/vim-plugins/generated.nix
@@ -2577,6 +2577,18 @@ final: prev:
     meta.homepage = "https://github.com/edwinb/idris2-vim/";
   };
 
+  impatient-nvim = buildVimPluginFrom2Nix {
+    pname = "impatient.nvim";
+    version = "2021-12-26";
+    src = fetchFromGitHub {
+      owner = "lewis6991";
+      repo = "impatient.nvim";
+      rev = "3ea9abedb6941995b05fdad654d9cfd51c38a31f";
+      sha256 = "06b8h3g77wrjxvhapkvx149pha29a0zcq28bj2pcvh7686cysz9k";
+    };
+    meta.homepage = "https://github.com/lewis6991/impatient.nvim/";
+  };
+
   Improved-AnsiEsc = buildVimPluginFrom2Nix {
     pname = "Improved-AnsiEsc";
     version = "2015-08-26";
@@ -3226,6 +3238,18 @@ final: prev:
     meta.homepage = "https://github.com/glepnir/lspsaga.nvim/";
   };
 
+  lua-dev-nvim = buildVimPluginFrom2Nix {
+    pname = "lua-dev.nvim";
+    version = "2021-12-31";
+    src = fetchFromGitHub {
+      owner = "folke";
+      repo = "lua-dev.nvim";
+      rev = "03a44ec6a54b0a025a633978e8541584a02e46d9";
+      sha256 = "1id96h1kl299mlgqqby4kcnsb6nz51r5i4vyfdcnpla27w0pr6pd";
+    };
+    meta.homepage = "https://github.com/folke/lua-dev.nvim/";
+  };
+
   lualine-lsp-progress = buildVimPluginFrom2Nix {
     pname = "lualine-lsp-progress";
     version = "2021-10-23";
@@ -6147,6 +6171,18 @@ final: prev:
     meta.homepage = "https://github.com/nvim-telescope/telescope-dap.nvim/";
   };
 
+  telescope-file-browser-nvim = buildVimPluginFrom2Nix {
+    pname = "telescope-file-browser.nvim";
+    version = "2021-12-29";
+    src = fetchFromGitHub {
+      owner = "nvim-telescope";
+      repo = "telescope-file-browser.nvim";
+      rev = "52170a89ea52a7a3b6131d19348642dbb60e5a84";
+      sha256 = "1vfd9i96dy1mjhd86xcx8b2wg2sk063h3il2ngymdil55iv1x4yc";
+    };
+    meta.homepage = "https://github.com/nvim-telescope/telescope-file-browser.nvim/";
+  };
+
   telescope-frecency-nvim = buildVimPluginFrom2Nix {
     pname = "telescope-frecency.nvim";
     version = "2021-12-06";
@@ -6196,6 +6232,18 @@ final: prev:
     meta.homepage = "https://github.com/nvim-telescope/telescope-fzy-native.nvim/";
   };
 
+  telescope-github-nvim = buildVimPluginFrom2Nix {
+    pname = "telescope-github.nvim";
+    version = "2021-08-25";
+    src = fetchFromGitHub {
+      owner = "nvim-telescope";
+      repo = "telescope-github.nvim";
+      rev = "004a224de1770bf8b2d7b147359a127dc323c8e6";
+      sha256 = "0jizqlasmnsyfcjd9fqdc0zf6xfpbfrwcdywpvn52x5cdrjascp7";
+    };
+    meta.homepage = "https://github.com/nvim-telescope/telescope-github.nvim/";
+  };
+
   telescope-lsp-handlers-nvim = buildVimPluginFrom2Nix {
     pname = "telescope-lsp-handlers.nvim";
     version = "2021-09-07";
diff --git a/pkgs/misc/vim-plugins/vim-plugin-names b/pkgs/misc/vim-plugins/vim-plugin-names
index d539a925184..c705dfa2c72 100644
--- a/pkgs/misc/vim-plugins/vim-plugin-names
+++ b/pkgs/misc/vim-plugins/vim-plugin-names
@@ -169,6 +169,7 @@ fisadev/vim-isort
 flazz/vim-colorschemes
 floobits/floobits-neovim
 folke/lsp-colors.nvim
+folke/lua-dev.nvim
 folke/todo-comments.nvim
 folke/tokyonight.nvim
 folke/trouble.nvim
@@ -393,6 +394,7 @@ ledger/vim-ledger
 lepture/vim-jinja
 lervag/vimtex
 lewis6991/gitsigns.nvim
+lewis6991/impatient.nvim
 lf-lang/lingua-franca.vim
 lfe-support/vim-lfe
 lfilho/cosco.vim
@@ -560,10 +562,12 @@ nvim-orgmode/orgmode
 nvim-pack/nvim-spectre
 nvim-telescope/telescope-cheat.nvim
 nvim-telescope/telescope-dap.nvim
+nvim-telescope/telescope-file-browser.nvim
 nvim-telescope/telescope-frecency.nvim
 nvim-telescope/telescope-fzf-native.nvim
 nvim-telescope/telescope-fzf-writer.nvim
 nvim-telescope/telescope-fzy-native.nvim
+nvim-telescope/telescope-github.nvim
 nvim-telescope/telescope-project.nvim
 nvim-telescope/telescope-symbols.nvim
 nvim-telescope/telescope-z.nvim
diff --git a/pkgs/tools/misc/grc/default.nix b/pkgs/tools/misc/grc/default.nix
index bb44c800a31..7692c49fa69 100644
--- a/pkgs/tools/misc/grc/default.nix
+++ b/pkgs/tools/misc/grc/default.nix
@@ -1,4 +1,7 @@
-{ lib, fetchFromGitHub, buildPythonApplication }:
+{ lib
+, fetchFromGitHub
+, buildPythonApplication
+}:
 
 buildPythonApplication rec {
   pname = "grc";
@@ -27,7 +30,7 @@ buildPythonApplication rec {
   '';
 
   meta = with lib; {
-    homepage = "http://korpus.juls.savba.sk/~garabik/software/grc.html";
+    homepage = "http://kassiopeia.juls.savba.sk/~garabik/software/grc.html";
     description = "A generic text colouriser";
     longDescription = ''
       Generic Colouriser is yet another colouriser (written in Python) for
diff --git a/pkgs/tools/misc/markdown-anki-decks/default.nix b/pkgs/tools/misc/markdown-anki-decks/default.nix
index 01a6d293322..62c8ca86e6f 100644
--- a/pkgs/tools/misc/markdown-anki-decks/default.nix
+++ b/pkgs/tools/misc/markdown-anki-decks/default.nix
@@ -31,7 +31,7 @@ python3.pkgs.buildPythonApplication rec {
     # No API changes.
     substituteInPlace pyproject.toml \
       --replace 'python-frontmatter = "^0.5.0"' 'python-frontmatter = "^1.0.0"' \
-      --replace 'genanki = "^0.10.1"' 'genanki = "^0.11.0"' \
+      --replace 'genanki = "^0.10.1"' 'genanki = "*"' \
       --replace 'typer = "^0.3.2"' 'typer = "^0.4.0"'
   '';
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c75ff02bb90..e883a2f2846 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -277,6 +277,10 @@ with pkgs;
 
   cm256cc = callPackage ../development/libraries/cm256cc {  };
 
+  cocogitto = callPackage ../development/tools/cocogitto {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
+
   conftest = callPackage ../development/tools/conftest { };
 
   corgi = callPackage ../development/tools/corgi { };
@@ -6686,6 +6690,8 @@ with pkgs;
 
   itm-tools = callPackage ../development/tools/misc/itm-tools { };
 
+  ite-backlight = callPackage ../misc/ite-backlight { };
+
   iwgtk = callPackage ../tools/networking/iwgtk { };
 
   ix = callPackage ../tools/misc/ix { };
@@ -27738,9 +27744,12 @@ with pkgs;
 
   opentimestamps-client = python3Packages.callPackage ../tools/misc/opentimestamps-client {};
 
-  opentoonz = (qt514.overrideScope' (_: _: {
-    libtiff = callPackage ../applications/graphics/opentoonz/libtiff.nix { };
-  })).callPackage ../applications/graphics/opentoonz { };
+  opentoonz = let
+    opentoonz-libtiff = callPackage ../applications/graphics/opentoonz/libtiff.nix { };
+  in qt5.callPackage ../applications/graphics/opentoonz {
+    libtiff = opentoonz-libtiff;
+    opencv = opencv.override { libtiff = opentoonz-libtiff; };
+  };
 
   opentabletdriver = callPackage ../tools/X11/opentabletdriver { };
 
@@ -27848,7 +27857,11 @@ with pkgs;
 
   pdfslicer = callPackage ../applications/misc/pdfslicer { };
 
-  pekwm = callPackage ../applications/window-managers/pekwm { };
+  pekwm = callPackage ../applications/window-managers/pekwm {
+    awk = gawk;
+    grep = gnugrep;
+    sed = gnused;
+  };
 
   pencil = callPackage ../applications/graphics/pencil {
   };
@@ -28379,7 +28392,7 @@ with pkgs;
 
   udevil = callPackage ../applications/misc/udevil {};
 
-  udiskie = python3Packages.callPackage ../applications/misc/udiskie { };
+  udiskie = python3.pkgs.callPackage ../applications/misc/udiskie { };
 
   sacc = callPackage ../applications/networking/gopher/sacc { };
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 83d2c50f1c6..4c3eb66839c 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2327,6 +2327,8 @@ in {
 
   dmenu-python = callPackage ../development/python-modules/dmenu { };
 
+  dm-haiku = callPackage ../development/python-modules/dm-haiku { };
+
   dm-sonnet = callPackage ../development/python-modules/dm-sonnet { };
 
   dm-tree = callPackage ../development/python-modules/dm-tree { };