Merge branch 'master' into staging-next

 Conflicts:
	pkgs/development/python-modules/gradient-utils/default.nix
	pkgs/development/python-modules/gradient/default.nix

84 files changed, 937 insertions, 394 deletions

diff --git a/doc/builders/special/mkshell.section.md b/doc/builders/special/mkshell.section.md
index 8a62c50e17d..73cc57f485b 100644
--- a/doc/builders/special/mkshell.section.md
+++ b/doc/builders/special/mkshell.section.md
@@ -1,17 +1,37 @@
 # pkgs.mkShell {#sec-pkgs-mkShell}
 
-`pkgs.mkShell` is a special kind of derivation that is only useful when using
-it combined with `nix-shell`. It will in fact fail to instantiate when invoked
-with `nix-build`.
+`pkgs.mkShell` is a specialized `stdenv.mkDerivation` that removes some
+repetition when using it with `nix-shell` (or `nix develop`).
 
 ## Usage {#sec-pkgs-mkShell-usage}
 
+Here is a common usage example:
+
 ```nix
 { pkgs ? import <nixpkgs> {} }:
 pkgs.mkShell {
-  # specify which packages to add to the shell environment
   packages = [ pkgs.gnumake ];
-  # add all the dependencies, of the given packages, to the shell environment
-  inputsFrom = with pkgs; [ hello gnutar ];
+
+  inputsFrom = [ pkgs.hello pkgs.gnutar ];
+
+  shellHook = ''
+    export DEBUG=1
+  '';
 }
 ```
+
+## Attributes
+
+* `name` (default: `nix-shell`). Set the name of the derivation.
+* `packages` (default: `[]`). Add executable packages to the `nix-shell` environment.
+* `inputsFrom` (default: `[]`). Add build dependencies of the listed derivations to the `nix-shell` environment.
+* `shellHook` (default: `""`). Bash statements that are executed by `nix-shell`.
+
+... all the attributes of `stdenv.mkDerivation`.
+
+## Building the shell
+
+This derivation output will contain a text file that contains a reference to
+all the build inputs. This is useful in CI where we want to make sure that
+every derivation, and its dependencies, build properly. Or when creating a GC
+root so that the build dependencies don't get garbage-collected.
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 48d8973e922..67930b4f276 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -3188,6 +3188,12 @@
     githubId = 24791219;
     name = "Jakob Neufeld";
   };
+  dsalaza4 = {
+    email = "podany270895@gmail.com";
+    github = "dsalaza4";
+    githubId = 11205987;
+    name = "Daniel Salazar";
+  };
   dschrempf = {
     name = "Dominik Schrempf";
     email = "dominik.schrempf@gmail.com";
@@ -6049,6 +6055,13 @@
     github = "k4leg";
     githubId = 39882583;
   };
+  k900 = {
+    name = "Ilya K.";
+    email = "me@0upti.me";
+    github = "K900";
+    githubId = 386765;
+    matrix = "@k900:0upti.me";
+  };
   kaction = {
     name = "Dmitry Bogatov";
     email = "KAction@disroot.org";
diff --git a/nixos/modules/installer/sd-card/sd-image-riscv64-qemu.nix b/nixos/modules/installer/sd-card/sd-image-riscv64-qemu.nix
new file mode 100644
index 00000000000..a3e30768da4
--- /dev/null
+++ b/nixos/modules/installer/sd-card/sd-image-riscv64-qemu.nix
@@ -0,0 +1,32 @@
+# To build, use:
+# nix-build nixos -I nixos-config=nixos/modules/installer/sd-card/sd-image-riscv64-qemu.nix -A config.system.build.sdImage
+{ config, lib, pkgs, ... }:
+
+{
+  imports = [
+    ../../profiles/base.nix
+    ./sd-image.nix
+  ];
+
+  boot.loader = {
+    grub.enable = false;
+    generic-extlinux-compatible = {
+      enable = true;
+
+      # Don't even specify FDTDIR - We do not have the correct DT
+      # The DTB is generated by QEMU at runtime
+      useGenerationDeviceTree = false;
+    };
+  };
+
+  boot.consoleLogLevel = lib.mkDefault 7;
+  boot.kernelParams = [ "console=tty0" "console=ttyS0,115200n8" ];
+
+  sdImage = {
+    populateFirmwareCommands = "";
+    populateRootCommands = ''
+      mkdir -p ./files/boot
+      ${config.boot.loader.generic-extlinux-compatible.populateCmd} -c ${config.system.build.toplevel} -d ./files/boot
+    '';
+  };
+}
diff --git a/nixos/modules/installer/sd-card/sd-image-x86_64.nix b/nixos/modules/installer/sd-card/sd-image-x86_64.nix
new file mode 100644
index 00000000000..b44c0a4eeca
--- /dev/null
+++ b/nixos/modules/installer/sd-card/sd-image-x86_64.nix
@@ -0,0 +1,27 @@
+# To build, use:
+# nix-build nixos -I nixos-config=nixos/modules/installer/sd-card/sd-image-x86_64.nix -A config.system.build.sdImage
+
+# This image is primarily used in NixOS tests (boot.nix) to test `boot.loader.generic-extlinux-compatible`.
+{ config, lib, pkgs, ... }:
+
+{
+  imports = [
+    ../../profiles/base.nix
+    ./sd-image.nix
+  ];
+
+  boot.loader = {
+    grub.enable = false;
+    generic-extlinux-compatible.enable = true;
+  };
+
+  boot.consoleLogLevel = lib.mkDefault 7;
+
+  sdImage = {
+    populateFirmwareCommands = "";
+    populateRootCommands = ''
+      mkdir -p ./files/boot
+      ${config.boot.loader.generic-extlinux-compatible.populateCmd} -c ${config.system.build.toplevel} -d ./files/boot
+    '';
+  };
+}
diff --git a/nixos/modules/installer/sd-card/sd-image.nix b/nixos/modules/installer/sd-card/sd-image.nix
index a964cf2d6f8..7560c682517 100644
--- a/nixos/modules/installer/sd-card/sd-image.nix
+++ b/nixos/modules/installer/sd-card/sd-image.nix
@@ -176,7 +176,7 @@ in
 
       nativeBuildInputs = [ dosfstools e2fsprogs mtools libfaketime util-linux zstd ];
 
-      inherit (config.sdImage) compressImage;
+      inherit (config.sdImage) imageName compressImage;
 
       buildCommand = ''
         mkdir -p $out/nix-support $out/sd-image
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 73a61c4ca0e..1ee4b4e88a9 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -364,6 +364,7 @@
   ./services/desktops/malcontent.nix
   ./services/desktops/pipewire/pipewire.nix
   ./services/desktops/pipewire/pipewire-media-session.nix
+  ./services/desktops/pipewire/wireplumber.nix
   ./services/desktops/gnome/at-spi2-core.nix
   ./services/desktops/gnome/chrome-gnome-shell.nix
   ./services/desktops/gnome/evolution-data-server.nix
diff --git a/nixos/modules/profiles/all-hardware.nix b/nixos/modules/profiles/all-hardware.nix
index 797fcddb8c9..25f68123a1d 100644
--- a/nixos/modules/profiles/all-hardware.nix
+++ b/nixos/modules/profiles/all-hardware.nix
@@ -44,12 +44,12 @@ in
       "ohci1394" "sbp2"
 
       # Virtio (QEMU, KVM etc.) support.
-      "virtio_net" "virtio_pci" "virtio_blk" "virtio_scsi" "virtio_balloon" "virtio_console"
+      "virtio_net" "virtio_pci" "virtio_mmio" "virtio_blk" "virtio_scsi" "virtio_balloon" "virtio_console"
 
       # VMware support.
       "mptspi" "vmxnet3" "vsock"
     ] ++ lib.optional platform.isx86 "vmw_balloon"
-    ++ lib.optionals (!platform.isAarch64 && !platform.isAarch32) [ # not sure where else they're missing
+    ++ lib.optionals (pkgs.stdenv.isi686 || pkgs.stdenv.isx86_64) [
       "vmw_vmci" "vmwgfx" "vmw_vsock_vmci_transport"
 
       # Hyper-V support.
diff --git a/nixos/modules/services/cluster/kubernetes/addon-manager.nix b/nixos/modules/services/cluster/kubernetes/addon-manager.nix
index 9159d5915eb..b677d900ff5 100644
--- a/nixos/modules/services/cluster/kubernetes/addon-manager.nix
+++ b/nixos/modules/services/cluster/kubernetes/addon-manager.nix
@@ -167,4 +167,5 @@ in
     };
   };
 
+  meta.buildDocsInSandbox = false;
 }
diff --git a/nixos/modules/services/cluster/kubernetes/addons/dns.nix b/nixos/modules/services/cluster/kubernetes/addons/dns.nix
index 10f45db7883..7bd4991f43f 100644
--- a/nixos/modules/services/cluster/kubernetes/addons/dns.nix
+++ b/nixos/modules/services/cluster/kubernetes/addons/dns.nix
@@ -363,4 +363,6 @@ in {
 
     services.kubernetes.kubelet.clusterDns = mkDefault cfg.clusterIp;
   };
+
+  meta.buildDocsInSandbox = false;
 }
diff --git a/nixos/modules/services/cluster/kubernetes/apiserver.nix b/nixos/modules/services/cluster/kubernetes/apiserver.nix
index 5b97c571d76..a192e93badc 100644
--- a/nixos/modules/services/cluster/kubernetes/apiserver.nix
+++ b/nixos/modules/services/cluster/kubernetes/apiserver.nix
@@ -496,4 +496,5 @@ in
 
   ];
 
+  meta.buildDocsInSandbox = false;
 }
diff --git a/nixos/modules/services/cluster/kubernetes/controller-manager.nix b/nixos/modules/services/cluster/kubernetes/controller-manager.nix
index 6d54659720c..7c317e94dee 100644
--- a/nixos/modules/services/cluster/kubernetes/controller-manager.nix
+++ b/nixos/modules/services/cluster/kubernetes/controller-manager.nix
@@ -6,7 +6,6 @@ let
   top = config.services.kubernetes;
   otop = options.services.kubernetes;
   cfg = top.controllerManager;
-  klib = options.services.kubernetes.lib.default;
 in
 {
   imports = [
@@ -57,7 +56,7 @@ in
       type = int;
     };
 
-    kubeconfig = klib.mkKubeConfigOptions "Kubernetes controller manager";
+    kubeconfig = top.lib.mkKubeConfigOptions "Kubernetes controller manager";
 
     leaderElect = mkOption {
       description = "Whether to start leader election before executing main loop.";
@@ -130,7 +129,7 @@ in
             "--cluster-cidr=${cfg.clusterCidr}"} \
           ${optionalString (cfg.featureGates != [])
             "--feature-gates=${concatMapStringsSep "," (feature: "${feature}=true") cfg.featureGates}"} \
-          --kubeconfig=${klib.mkKubeConfig "kube-controller-manager" cfg.kubeconfig} \
+          --kubeconfig=${top.lib.mkKubeConfig "kube-controller-manager" cfg.kubeconfig} \
           --leader-elect=${boolToString cfg.leaderElect} \
           ${optionalString (cfg.rootCaFile!=null)
             "--root-ca-file=${cfg.rootCaFile}"} \
@@ -157,7 +156,7 @@ in
       path = top.path;
     };
 
-    services.kubernetes.pki.certs = with klib; {
+    services.kubernetes.pki.certs = with top.lib; {
       controllerManager = mkCert {
         name = "kube-controller-manager";
         CN = "kube-controller-manager";
@@ -172,4 +171,6 @@ in
 
     services.kubernetes.controllerManager.kubeconfig.server = mkDefault top.apiserverAddress;
   };
+
+  meta.buildDocsInSandbox = false;
 }
diff --git a/nixos/modules/services/cluster/kubernetes/default.nix b/nixos/modules/services/cluster/kubernetes/default.nix
index 715c88ad88c..35ec99d83c8 100644
--- a/nixos/modules/services/cluster/kubernetes/default.nix
+++ b/nixos/modules/services/cluster/kubernetes/default.nix
@@ -26,10 +26,7 @@ let
 
       containerd.runtimes.runc = {
         runtime_type = "io.containerd.runc.v2";
-      };
-
-      containerd.runtimes."io.containerd.runc.v2".options = {
-        SystemdCgroup = true;
+        options.SystemdCgroup = true;
       };
     };
   };
@@ -193,8 +190,6 @@ in {
         inherit mkKubeConfigOptions;
       };
       type = types.attrs;
-      readOnly = true;
-      internal = true;
     };
 
     secretsPath = mkOption {
@@ -315,4 +310,6 @@ in {
                           else "${cfg.masterAddress}:${toString cfg.apiserver.securePort}"}");
     })
   ];
+
+  meta.buildDocsInSandbox = false;
 }
diff --git a/nixos/modules/services/cluster/kubernetes/flannel.nix b/nixos/modules/services/cluster/kubernetes/flannel.nix
index fecea7a15f3..cb81eaaf016 100644
--- a/nixos/modules/services/cluster/kubernetes/flannel.nix
+++ b/nixos/modules/services/cluster/kubernetes/flannel.nix
@@ -95,4 +95,6 @@ in
 
     };
   };
+
+  meta.buildDocsInSandbox = false;
 }
diff --git a/nixos/modules/services/cluster/kubernetes/kubelet.nix b/nixos/modules/services/cluster/kubernetes/kubelet.nix
index 2d58547ce4c..af3a5062feb 100644
--- a/nixos/modules/services/cluster/kubernetes/kubelet.nix
+++ b/nixos/modules/services/cluster/kubernetes/kubelet.nix
@@ -6,7 +6,6 @@ let
   top = config.services.kubernetes;
   otop = options.services.kubernetes;
   cfg = top.kubelet;
-  klib = options.services.kubernetes.lib.default;
 
   cniConfig =
     if cfg.cni.config != [] && cfg.cni.configDir != null then
@@ -28,7 +27,7 @@ let
     config.Cmd = ["/bin/pause"];
   };
 
-  kubeconfig = klib.mkKubeConfig "kubelet" cfg.kubeconfig;
+  kubeconfig = top.lib.mkKubeConfig "kubelet" cfg.kubeconfig;
 
   manifestPath = "kubernetes/manifests";
 
@@ -178,7 +177,7 @@ in
       type = str;
     };
 
-    kubeconfig = klib.mkKubeConfigOptions "Kubelet";
+    kubeconfig = top.lib.mkKubeConfigOptions "Kubelet";
 
     manifests = mkOption {
       description = "List of manifests to bootstrap with kubelet (only pods can be created as manifest entry)";
@@ -265,8 +264,6 @@ in
         "net.bridge.bridge-nf-call-ip6tables" = 1;
       };
 
-      systemd.enableUnifiedCgroupHierarchy = false; # true breaks node memory metrics
-
       systemd.services.kubelet = {
         description = "Kubernetes Kubelet Service";
         wantedBy = [ "kubernetes.target" ];
@@ -359,7 +356,7 @@ in
       services.kubernetes.kubelet.hostname = with config.networking;
         mkDefault (hostName + optionalString (domain != null) ".${domain}");
 
-      services.kubernetes.pki.certs = with klib; {
+      services.kubernetes.pki.certs = with top.lib; {
         kubelet = mkCert {
           name = "kubelet";
           CN = top.kubelet.hostname;
@@ -396,4 +393,6 @@ in
     })
 
   ];
+
+  meta.buildDocsInSandbox = false;
 }
diff --git a/nixos/modules/services/cluster/kubernetes/pki.nix b/nixos/modules/services/cluster/kubernetes/pki.nix
index 00d572a5098..88bde4e9155 100644
--- a/nixos/modules/services/cluster/kubernetes/pki.nix
+++ b/nixos/modules/services/cluster/kubernetes/pki.nix
@@ -1,11 +1,10 @@
-{ config, options, lib, pkgs, ... }:
+{ config, lib, pkgs, ... }:
 
 with lib;
 
 let
   top = config.services.kubernetes;
   cfg = top.pki;
-  klib = options.services.kubernetes.lib;
 
   csrCA = pkgs.writeText "kube-pki-cacert-csr.json" (builtins.toJSON {
     key = {
@@ -30,7 +29,7 @@ let
   cfsslAPITokenLength = 32;
 
   clusterAdminKubeconfig = with cfg.certs.clusterAdmin;
-    klib.mkKubeConfig "cluster-admin" {
+    top.lib.mkKubeConfig "cluster-admin" {
         server = top.apiserverAddress;
         certFile = cert;
         keyFile = key;
@@ -251,7 +250,7 @@ in
       # - it would be better with a more Nix-oriented way of managing addons
       systemd.services.kube-addon-manager = mkIf top.addonManager.enable (mkMerge [{
         environment.KUBECONFIG = with cfg.certs.addonManager;
-          klib.mkKubeConfig "addon-manager" {
+          top.lib.mkKubeConfig "addon-manager" {
             server = top.apiserverAddress;
             certFile = cert;
             keyFile = key;
@@ -344,7 +343,7 @@ in
       '';
 
       services.flannel = with cfg.certs.flannelClient; {
-        kubeconfig = klib.mkKubeConfig "flannel" {
+        kubeconfig = top.lib.mkKubeConfig "flannel" {
           server = top.apiserverAddress;
           certFile = cert;
           keyFile = key;
@@ -402,4 +401,6 @@ in
         };
       };
     });
+
+  meta.buildDocsInSandbox = false;
 }
diff --git a/nixos/modules/services/cluster/kubernetes/proxy.nix b/nixos/modules/services/cluster/kubernetes/proxy.nix
index 986301f6bd9..0fd98d1c157 100644
--- a/nixos/modules/services/cluster/kubernetes/proxy.nix
+++ b/nixos/modules/services/cluster/kubernetes/proxy.nix
@@ -6,7 +6,6 @@ let
   top = config.services.kubernetes;
   otop = options.services.kubernetes;
   cfg = top.proxy;
-  klib = options.services.kubernetes.lib.default;
 in
 {
   imports = [
@@ -44,7 +43,7 @@ in
       type = str;
     };
 
-    kubeconfig = klib.mkKubeConfigOptions "Kubernetes proxy";
+    kubeconfig = top.lib.mkKubeConfigOptions "Kubernetes proxy";
 
     verbosity = mkOption {
       description = ''
@@ -73,7 +72,7 @@ in
           ${optionalString (cfg.featureGates != [])
             "--feature-gates=${concatMapStringsSep "," (feature: "${feature}=true") cfg.featureGates}"} \
           --hostname-override=${cfg.hostname} \
-          --kubeconfig=${klib.mkKubeConfig "kube-proxy" cfg.kubeconfig} \
+          --kubeconfig=${top.lib.mkKubeConfig "kube-proxy" cfg.kubeconfig} \
           ${optionalString (cfg.verbosity != null) "--v=${toString cfg.verbosity}"} \
           ${cfg.extraOpts}
         '';
@@ -89,7 +88,7 @@ in
     services.kubernetes.proxy.hostname = with config.networking; mkDefault hostName;
 
     services.kubernetes.pki.certs = {
-      kubeProxyClient = klib.mkCert {
+      kubeProxyClient = top.lib.mkCert {
         name = "kube-proxy-client";
         CN = "system:kube-proxy";
         action = "systemctl restart kube-proxy.service";
@@ -98,4 +97,6 @@ in
 
     services.kubernetes.proxy.kubeconfig.server = mkDefault top.apiserverAddress;
   };
+
+  meta.buildDocsInSandbox = false;
 }
diff --git a/nixos/modules/services/cluster/kubernetes/scheduler.nix b/nixos/modules/services/cluster/kubernetes/scheduler.nix
index 442e3fe3a69..2a522f1db89 100644
--- a/nixos/modules/services/cluster/kubernetes/scheduler.nix
+++ b/nixos/modules/services/cluster/kubernetes/scheduler.nix
@@ -6,7 +6,6 @@ let
   top = config.services.kubernetes;
   otop = options.services.kubernetes;
   cfg = top.scheduler;
-  klib = options.services.kubernetes.lib.default;
 in
 {
   ###### interface
@@ -33,7 +32,7 @@ in
       type = listOf str;
     };
 
-    kubeconfig = klib.mkKubeConfigOptions "Kubernetes scheduler";
+    kubeconfig = top.lib.mkKubeConfigOptions "Kubernetes scheduler";
 
     leaderElect = mkOption {
       description = "Whether to start leader election before executing main loop.";
@@ -70,7 +69,7 @@ in
           --address=${cfg.address} \
           ${optionalString (cfg.featureGates != [])
             "--feature-gates=${concatMapStringsSep "," (feature: "${feature}=true") cfg.featureGates}"} \
-          --kubeconfig=${klib.mkKubeConfig "kube-scheduler" cfg.kubeconfig} \
+          --kubeconfig=${top.lib.mkKubeConfig "kube-scheduler" cfg.kubeconfig} \
           --leader-elect=${boolToString cfg.leaderElect} \
           --port=${toString cfg.port} \
           ${optionalString (cfg.verbosity != null) "--v=${toString cfg.verbosity}"} \
@@ -88,7 +87,7 @@ in
     };
 
     services.kubernetes.pki.certs = {
-      schedulerClient = klib.mkCert {
+      schedulerClient = top.lib.mkCert {
         name = "kube-scheduler-client";
         CN = "system:kube-scheduler";
         action = "systemctl restart kube-scheduler.service";
@@ -97,4 +96,6 @@ in
 
     services.kubernetes.scheduler.kubeconfig.server = mkDefault top.apiserverAddress;
   };
+
+  meta.buildDocsInSandbox = false;
 }
diff --git a/nixos/modules/services/desktops/gnome/gnome-settings-daemon.nix b/nixos/modules/services/desktops/gnome/gnome-settings-daemon.nix
index 05b5c86ddcb..9c68c9b76e9 100644
--- a/nixos/modules/services/desktops/gnome/gnome-settings-daemon.nix
+++ b/nixos/modules/services/desktops/gnome/gnome-settings-daemon.nix
@@ -57,26 +57,12 @@ in
       pkgs.gnome.gnome-settings-daemon
     ];
 
-    systemd.user.targets."gnome-session-initialized".wants = [
-      "gsd-color.target"
-      "gsd-datetime.target"
-      "gsd-keyboard.target"
-      "gsd-media-keys.target"
-      "gsd-print-notifications.target"
-      "gsd-rfkill.target"
-      "gsd-screensaver-proxy.target"
-      "gsd-sharing.target"
-      "gsd-smartcard.target"
-      "gsd-sound.target"
-      "gsd-wacom.target"
-      "gsd-wwan.target"
-      "gsd-a11y-settings.target"
-      "gsd-housekeeping.target"
-      "gsd-power.target"
+    systemd.user.targets."gnome-session-x11-services".wants = [
+      "org.gnome.SettingsDaemon.XSettings.service"
     ];
 
-    systemd.user.targets."gnome-session-x11-services".wants = [
-      "gsd-xsettings.target"
+    systemd.user.targets."gnome-session-x11-services-ready".wants = [
+      "org.gnome.SettingsDaemon.XSettings.service"
     ];
 
   };
diff --git a/nixos/modules/services/desktops/pipewire/wireplumber.nix b/nixos/modules/services/desktops/pipewire/wireplumber.nix
new file mode 100644
index 00000000000..ad96dc1f974
--- /dev/null
+++ b/nixos/modules/services/desktops/pipewire/wireplumber.nix
@@ -0,0 +1,41 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.pipewire.wireplumber;
+in
+{
+  meta.maintainers = [ lib.maintainers.k900 ];
+
+  options = {
+    services.pipewire.wireplumber = {
+      enable = lib.mkEnableOption "A modular session / policy manager for PipeWire";
+
+      package = lib.mkOption {
+        type = lib.types.package;
+        default = pkgs.wireplumber;
+        defaultText = lib.literalExpression "pkgs.wireplumber";
+        description = ''
+          The wireplumber derivation to use.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = !config.services.pipewire.media-session.enable;
+        message = "WirePlumber and pipewire-media-session can't be enabled at the same time.";
+      }
+    ];
+
+    environment.systemPackages = [ cfg.package ];
+    systemd.packages = [ cfg.package ];
+
+    systemd.services.wireplumber.enable = config.services.pipewire.systemWide;
+    systemd.user.services.wireplumber.enable = !config.services.pipewire.systemWide;
+
+    systemd.services.wireplumber.wantedBy = [ "pipewire.service" ];
+    systemd.user.services.wireplumber.wantedBy = [ "pipewire.service" ];
+  };
+}
diff --git a/nixos/modules/system/boot/loader/generic-extlinux-compatible/default.nix b/nixos/modules/system/boot/loader/generic-extlinux-compatible/default.nix
index bd508bbe8ea..545b594674f 100644
--- a/nixos/modules/system/boot/loader/generic-extlinux-compatible/default.nix
+++ b/nixos/modules/system/boot/loader/generic-extlinux-compatible/default.nix
@@ -30,6 +30,21 @@ in
         '';
       };
 
+      useGenerationDeviceTree = mkOption {
+        default = true;
+        type = types.bool;
+        description = ''
+          Whether to generate Device Tree-related directives in the
+          extlinux configuration.
+
+          When enabled, the bootloader will attempt to load the device
+          tree binaries from the generation's kernel.
+
+          Note that this affects all generations, regardless of the
+          setting value used in their configurations.
+        '';
+      };
+
       configurationLimit = mkOption {
         default = 20;
         example = 10;
@@ -54,7 +69,9 @@ in
   };
 
   config = let
-    builderArgs = "-g ${toString cfg.configurationLimit} -t ${timeoutStr}" + lib.optionalString (dtCfg.name != null) " -n ${dtCfg.name}";
+    builderArgs = "-g ${toString cfg.configurationLimit} -t ${timeoutStr}"
+      + lib.optionalString (dtCfg.name != null) " -n ${dtCfg.name}"
+      + lib.optionalString (!cfg.useGenerationDeviceTree) " -r";
   in
     mkIf cfg.enable {
       system.build.installBootLoader = "${builder} ${builderArgs} -c";
diff --git a/nixos/modules/system/boot/loader/generic-extlinux-compatible/extlinux-conf-builder.sh b/nixos/modules/system/boot/loader/generic-extlinux-compatible/extlinux-conf-builder.sh
index 5ffffb95edb..1a0da005029 100644
--- a/nixos/modules/system/boot/loader/generic-extlinux-compatible/extlinux-conf-builder.sh
+++ b/nixos/modules/system/boot/loader/generic-extlinux-compatible/extlinux-conf-builder.sh
@@ -6,7 +6,7 @@ export PATH=/empty
 for i in @path@; do PATH=$PATH:$i/bin; done
 
 usage() {
-    echo "usage: $0 -t <timeout> -c <path-to-default-configuration> [-d <boot-dir>] [-g <num-generations>] [-n <dtbName>]" >&2
+    echo "usage: $0 -t <timeout> -c <path-to-default-configuration> [-d <boot-dir>] [-g <num-generations>] [-n <dtbName>] [-r]" >&2
     exit 1
 }
 
@@ -15,7 +15,7 @@ default=                # Default configuration
 target=/boot            # Target directory
 numGenerations=0        # Number of other generations to include in the menu
 
-while getopts "t:c:d:g:n:" opt; do
+while getopts "t:c:d:g:n:r" opt; do
     case "$opt" in
         t) # U-Boot interprets '0' as infinite and negative as instant boot
             if [ "$OPTARG" -lt 0 ]; then
@@ -30,6 +30,7 @@ while getopts "t:c:d:g:n:" opt; do
         d) target="$OPTARG" ;;
         g) numGenerations="$OPTARG" ;;
         n) dtbName="$OPTARG" ;;
+        r) noDeviceTree=1 ;;
         \?) usage ;;
     esac
 done
@@ -96,6 +97,12 @@ addEntry() {
     fi
     echo "  LINUX ../nixos/$(basename $kernel)"
     echo "  INITRD ../nixos/$(basename $initrd)"
+    echo "  APPEND init=$path/init $extraParams"
+
+    if [ -n "$noDeviceTree" ]; then
+        return
+    fi
+
     if [ -d "$dtbDir" ]; then
         # if a dtbName was specified explicitly, use that, else use FDTDIR
         if [ -n "$dtbName" ]; then
@@ -109,7 +116,6 @@ addEntry() {
             exit 1
         fi
     fi
-    echo "  APPEND init=$path/init $extraParams"
 }
 
 tmpFile="$target/extlinux/extlinux.conf.tmp.$$"
diff --git a/nixos/tests/boot.nix b/nixos/tests/boot.nix
index 9945a1dcd62..cf556566713 100644
--- a/nixos/tests/boot.nix
+++ b/nixos/tests/boot.nix
@@ -12,12 +12,22 @@ let
   iso =
     (import ../lib/eval-config.nix {
       inherit system;
-      modules =
-        [ ../modules/installer/cd-dvd/installation-cd-minimal.nix
-          ../modules/testing/test-instrumentation.nix
-        ];
+      modules = [
+        ../modules/installer/cd-dvd/installation-cd-minimal.nix
+        ../modules/testing/test-instrumentation.nix
+      ];
     }).config.system.build.isoImage;
 
+  sd =
+    (import ../lib/eval-config.nix {
+      inherit system;
+      modules = [
+        ../modules/installer/sd-card/sd-image-x86_64.nix
+        ../modules/testing/test-instrumentation.nix
+        { sdImage.compressImage = false; }
+      ];
+    }).config.system.build.sdImage;
+
   pythonDict = params: "\n    {\n        ${concatStringsSep ",\n        " (mapAttrsToList (name: param: "\"${name}\": \"${param}\"") params)},\n    }\n";
 
   makeBootTest = name: extraConfig:
@@ -110,4 +120,30 @@ in {
     };
 
     biosNetboot = makeNetbootTest "bios" {};
+
+    ubootExtlinux = let
+      sdImage = "${sd}/sd-image/${sd.imageName}";
+      mutableImage = "/tmp/linked-image.qcow2";
+
+      machineConfig = pythonDict {
+        bios = "${pkgs.ubootQemuX86}/u-boot.rom";
+        qemuFlags = "-m 768 -machine type=pc,accel=tcg -drive file=${mutableImage},if=ide,format=qcow2";
+      };
+    in makeTest {
+      name = "boot-uboot-extlinux";
+      nodes = { };
+      testScript = ''
+        import os
+
+        # Create a mutable linked image backed by the read-only SD image
+        if os.system("qemu-img create -f qcow2 -F raw -b ${sdImage} ${mutableImage}") != 0:
+            raise RuntimeError("Could not create mutable linked image")
+
+        machine = create_machine(${machineConfig})
+        machine.start()
+        machine.wait_for_unit("multi-user.target")
+        machine.succeed("nix store verify -r --no-trust --option experimental-features nix-command /run/current-system")
+        machine.shutdown()
+      '';
+    };
 }
diff --git a/nixos/tests/kubernetes/base.nix b/nixos/tests/kubernetes/base.nix
index e1736f6fe17..f0c72084be5 100644
--- a/nixos/tests/kubernetes/base.nix
+++ b/nixos/tests/kubernetes/base.nix
@@ -60,13 +60,6 @@ let
                   advertiseAddress = master.ip;
                 };
                 masterAddress = "${masterName}.${config.networking.domain}";
-                # workaround for:
-                #   https://github.com/kubernetes/kubernetes/issues/102676
-                #   (workaround from) https://github.com/kubernetes/kubernetes/issues/95488
-                kubelet.extraOpts = ''\
-                  --cgroups-per-qos=false \
-                  --enforce-node-allocatable="" \
-                '';
               };
             }
             (optionalAttrs (any (role: role == "master") machine.roles) {
diff --git a/pkgs/applications/blockchains/go-ethereum/default.nix b/pkgs/applications/blockchains/go-ethereum/default.nix
index 05bed4fe2e1..a934589e687 100644
--- a/pkgs/applications/blockchains/go-ethereum/default.nix
+++ b/pkgs/applications/blockchains/go-ethereum/default.nix
@@ -9,16 +9,16 @@ let
 
 in buildGoModule rec {
   pname = "go-ethereum";
-  version = "1.10.14";
+  version = "1.10.15";
 
   src = fetchFromGitHub {
     owner = "ethereum";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-0DQrcei3FM+X4BYokou7dPNVCcJTbY05YsTvzdtsas8=";
+    sha256 = "0f6n9rg42ph47mvykc9f0lf99yzwqy4jm7mlzyks4l6i6fl1g3q1";
   };
 
-  vendorSha256 = "sha256-zQOpWtQrdn+E1tRWmtEScQ7DDMzNCSr5H+5YL+Z1vug=";
+  vendorSha256 = "1s5yfpk2yn7f3zwjl2fdrh6c63ki2b8rlmnlss27yxibsidaj0yd";
 
   doCheck = false;
 
diff --git a/pkgs/applications/graphics/feh/default.nix b/pkgs/applications/graphics/feh/default.nix
index c279ccf3df6..899495db931 100644
--- a/pkgs/applications/graphics/feh/default.nix
+++ b/pkgs/applications/graphics/feh/default.nix
@@ -7,11 +7,11 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "feh";
-  version = "3.7.2";
+  version = "3.8";
 
   src = fetchurl {
     url = "https://feh.finalrewind.org/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-hHGP0nIM9UDSRXaElP4OtOWY9Es54jJrrow2ioKcglg=";
+    sha256 = "1a9bsq5j9sl2drzkab0hdhnamalpaszw9mz2prz6scrr5dak8g3z";
   };
 
   outputs = [ "out" "man" "doc" ];
diff --git a/pkgs/applications/misc/obinskit/default.nix b/pkgs/applications/misc/obinskit/default.nix
index c7725fbcb2f..664b2bf03ac 100644
--- a/pkgs/applications/misc/obinskit/default.nix
+++ b/pkgs/applications/misc/obinskit/default.nix
@@ -4,7 +4,7 @@
 , libxkbcommon
 , systemd
 , xorg
-, electron_11
+, electron_13
 , makeWrapper
 , makeDesktopItem
 }:
@@ -17,15 +17,15 @@ let
     genericName = "Obinskit keyboard configurator";
     categories = "Utility";
   };
-  electron = electron_11;
+  electron = electron_13;
 in
 stdenv.mkDerivation rec {
   pname = "obinskit";
-  version = "1.1.8";
+  version = "1.2.11";
 
   src = fetchurl {
-    url = "http://releases.obins.net/occ/linux/tar/ObinsKit_${version}_x64.tar.gz";
-    sha256 = "MgasbgexOdscQrUte/6OzCSrc74RvaBq44oHplQA/Gc=";
+    url = "https://s3.hexcore.xyz/occ/linux/tar/ObinsKit_${version}_x64.tar.gz";
+    sha256 = "1kcn41wmwcx6q70spa9a1qh7wfrj1sk4v4i58lbnf9kc6vasw41a";
   };
 
   unpackPhase = "tar -xzf $src";
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.json b/pkgs/applications/networking/browsers/chromium/upstream-info.json
index 0d7b0f826c2..7c490e860d4 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@@ -45,19 +45,19 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "96.0.4664.110",
-    "sha256": "1s3ilq0ik36qgqp7l88gfd1yx97zscn8yr2kprsrjfp9q8lrva9n",
-    "sha256bin64": "17cyj1jx47fz6y26f196xhlngrw5gnjgcvapvgkgswlwd7y67jcb",
+    "version": "97.0.4692.71",
+    "sha256": "0z7ximvm4a78kxyp4j0i2jzklxazpw6jcqi9jkaf8bvq9ga8kqca",
+    "sha256bin64": "1z1d50i5pvqaw6hjdxwasbznzgqwrnd1z8jmy2x05b6i49vd7r9j",
     "deps": {
       "gn": {
-        "version": "2021-09-24",
+        "version": "2021-11-03",
         "url": "https://gn.googlesource.com/gn",
-        "rev": "0153d369bbccc908f4da4993b1ba82728055926a",
-        "sha256": "0y4414h8jqsbz5af6pn91c0vkfp4s281s85g992xfyl785c5zbsi"
+        "rev": "90294ccdcf9334ed25a76ac9b67689468e506342",
+        "sha256": "0n0jml8s00ayy186jzrf207hbz70pxiq426znxwxd4gjcp60scsa"
       },
       "ungoogled-patches": {
-        "rev": "96.0.4664.110-1",
-        "sha256": "098mfcd1lr2hhlic0i1l5gxsq71axvqnn4gayr4r9j6nbj9byf4h"
+        "rev": "97.0.4692.71-1",
+        "sha256": "0a1172kj93lg3ip4im1s5s7bdm2q41w4m6ylyxc92w29rbhbxjxp"
       }
     }
   }
diff --git a/pkgs/applications/networking/cluster/terraform-providers/default.nix b/pkgs/applications/networking/cluster/terraform-providers/default.nix
index 0b54b707161..67b7cc9cd7d 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/default.nix
@@ -3,6 +3,8 @@
 , fetchFromGitHub
 , callPackage
 , config
+
+, cdrtools # libvirt
 }:
 let
   list = lib.importJSON ./providers.json;
@@ -41,7 +43,9 @@ let
   special-providers = let archived = throw "the provider has been archived by upstream"; in {
     # Packages that don't fit the default model
     gandi = callPackage ./gandi { };
-    libvirt = callPackage ./libvirt { };
+    # mkisofs needed to create ISOs holding cloud-init data,
+    # and wrapped to terraform via deecb4c1aab780047d79978c636eeb879dd68630
+    libvirt = automated-providers.libvirt.overrideAttrs (_: { propagatedBuildInputs = [ cdrtools ]; });
     teleport = callPackage ./teleport { };
     vpsadmin = callPackage ./vpsadmin { };
   } // (lib.optionalAttrs (config.allowAliases or false) {
diff --git a/pkgs/applications/networking/cluster/terraform-providers/libvirt/default.nix b/pkgs/applications/networking/cluster/terraform-providers/libvirt/default.nix
deleted file mode 100644
index a2ea7e8008e..00000000000
--- a/pkgs/applications/networking/cluster/terraform-providers/libvirt/default.nix
+++ /dev/null
@@ -1,56 +0,0 @@
-{ buildGoModule, cdrtools, fetchFromGitHub, lib, libvirt, makeWrapper, pkg-config }:
-
-# USAGE:
-# install the following package globally or in nix-shell:
-#
-#   (terraform.withPlugins (p: [p.libvirt]))
-#
-# configuration.nix:
-#
-#   virtualisation.libvirtd.enable = true;
-#
-# pick an example from (i.e ubuntu):
-# https://github.com/dmacvicar/terraform-provider-libvirt/tree/main/examples
-
-let
-  sha256 = "sha256-1l+ARrXHxtSdnQfYV/6gw3BYHVH8NN4pi+Ttk1nwF88=";
-  vendorSha256 = "sha256-OJa8pQgf5PlECZZkFV9fyCOdh6CrregY1BWycx7JPFE=";
-  version = "0.6.12";
-in buildGoModule {
-  inherit version;
-  inherit vendorSha256;
-
-  pname = "terraform-provider-libvirt";
-
-  src = fetchFromGitHub {
-    inherit sha256;
-
-    owner = "dmacvicar";
-    repo = "terraform-provider-libvirt";
-    rev = "v${version}";
-  };
-
-  nativeBuildInputs = [ pkg-config makeWrapper ];
-
-  buildInputs = [ libvirt ];
-
-  # mkisofs needed to create ISOs holding cloud-init data,
-  # and wrapped to terraform via deecb4c1aab780047d79978c636eeb879dd68630
-  propagatedBuildInputs = [ cdrtools ];
-
-  # Terraform allow checking the provider versions, but this breaks
-  # if the versions are not provided via file paths.
-  postBuild = "mv $GOPATH/bin/terraform-provider-libvirt{,_v${version}}";
-
-  ldflags = [ "-X main.version=${version}" ];
-  passthru.provider-source-address = "registry.terraform.io/dmacvicar/libvirt";
-
-  doCheck = false;
-
-  meta = with lib; {
-    homepage = "https://github.com/dmacvicar/terraform-provider-libvirt";
-    description = "Terraform provider for libvirt";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ mic92 ];
-  };
-}
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 484625ff2d1..5ad5ae7d3cc 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -579,6 +579,15 @@
     "vendorSha256": "05gx87dwh49zc5mlqnzcqn46pjf9q4wsv9l15pjr3spczzi11cnz",
     "version": "2.2.0"
   },
+  "libvirt": {
+    "owner": "dmacvicar",
+    "provider-source-address": "registry.terraform.io/dmacvicar/libvirt",
+    "repo": "terraform-provider-libvirt",
+    "rev": "v0.6.12",
+    "sha256": "1kqpy1cr7vg4iclxwd7wa4fmhw63l3z5gn07knfx9in7nm380pyn",
+    "vendorSha256": "0l9wr4g77chmshcfibdbl23rs8y8bxgiar4n152gkr0z12jvr5iq",
+    "version": "0.6.12"
+  },
   "linode": {
     "owner": "linode",
     "provider-source-address": "registry.terraform.io/linode/linode",
diff --git a/pkgs/applications/office/timedoctor/default.nix b/pkgs/applications/office/timedoctor/default.nix
index 41273b7780e..ab2f8df7047 100644
--- a/pkgs/applications/office/timedoctor/default.nix
+++ b/pkgs/applications/office/timedoctor/default.nix
@@ -117,7 +117,7 @@ appimageTools.wrapType2 {
     description = "Employee time tracking software";
     homepage = "https://www.timedoctor.com";
     license = licenses.unfree;
-    maintainers = with maintainers; [ kamadorueda ];
+    maintainers = with maintainers; [ dsalaza4 ];
     platforms = [ "x86_64-linux" ];
     # gpgme for i686-linux failed to build.
     broken = true;
diff --git a/pkgs/applications/science/logic/lean/default.nix b/pkgs/applications/science/logic/lean/default.nix
index bb1463ad964..78c2a56dc16 100644
--- a/pkgs/applications/science/logic/lean/default.nix
+++ b/pkgs/applications/science/logic/lean/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "lean";
-  version = "3.36.0";
+  version = "3.37.0";
 
   src = fetchFromGitHub {
     owner  = "leanprover-community";
@@ -11,8 +11,8 @@ stdenv.mkDerivation rec {
     # from. this is then used to check whether an olean file should be
     # rebuilt. don't use a tag as rev because this will get replaced into
     # src/githash.h.in in preConfigure.
-    rev    = "e948149d3d1bbdb8eac9cd103d58626a59fae3b9";
-    sha256 = "1lcjif29lfj3myc6j63ifk8fdvylyv8g82g2dv0d85nz7mpbq47b";
+    rev    = "e69ab934262eb6f141344fdaec98ede68a9102b6";
+    sha256 = "19sigzbrdl90jqk7lvl3q8j6n4nnidzwp9zzmzgq3zxxgywa2ghp";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/science/math/gmsh/default.nix b/pkgs/applications/science/math/gmsh/default.nix
index 0a48d813e91..fe34a82679a 100644
--- a/pkgs/applications/science/math/gmsh/default.nix
+++ b/pkgs/applications/science/math/gmsh/default.nix
@@ -5,11 +5,11 @@ assert (!blas.isILP64) && (!lapack.isILP64);
 
 stdenv.mkDerivation rec {
   pname = "gmsh";
-  version = "4.9.0";
+  version = "4.9.2";
 
   src = fetchurl {
-    url = "http://gmsh.info/src/gmsh-${version}-source.tgz";
-    sha256 = "sha256-uO8TPJtm/+Et8XR+ctSs8Z8esenNlesPV3y8QIHZvqM=";
+    url = "https://gmsh.info/src/gmsh-${version}-source.tgz";
+    sha256 = "sha256-26KB4DNYT12gfi2Y1656PcSBcjyybCxye2X8ILMBYYw=";
   };
 
   buildInputs = [ blas lapack gmm fltk libjpeg zlib libGLU libGL
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "A three-dimensional finite element mesh generator";
-    homepage = "http://gmsh.info/";
+    homepage = "https://gmsh.info/";
     platforms = [ "x86_64-linux" ];
     license = lib.licenses.gpl2Plus;
   };
diff --git a/pkgs/applications/window-managers/dwm/default.nix b/pkgs/applications/window-managers/dwm/default.nix
index 6235c93a281..68e1467c5a8 100644
--- a/pkgs/applications/window-managers/dwm/default.nix
+++ b/pkgs/applications/window-managers/dwm/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "dwm";
-  version = "6.2";
+  version = "6.3";
 
   src = fetchurl {
     url = "https://dl.suckless.org/dwm/${pname}-${version}.tar.gz";
-    sha256 = "03hirnj8saxnsfqiszwl2ds7p0avg20izv9vdqyambks00p2x44p";
+    sha256 = "utqgKFKbH7of1/moTztk8xGQRmyFgBG1Pi97cMajB40=";
   };
 
   buildInputs = [ libX11 libXinerama libXft ];
diff --git a/pkgs/build-support/mkshell/default.nix b/pkgs/build-support/mkshell/default.nix
index 27ee7e32262..e7552f43484 100644
--- a/pkgs/build-support/mkshell/default.nix
+++ b/pkgs/build-support/mkshell/default.nix
@@ -1,9 +1,9 @@
-{ lib, stdenv }:
+{ lib, stdenv, buildEnv }:
 
 # A special kind of derivation that is only meant to be consumed by the
 # nix-shell.
-{
-  # a list of packages to add to the shell environment
+{ name ? "nix-shell"
+, # a list of packages to add to the shell environment
   packages ? [ ]
 , # propagate all the inputs from the given derivations
   inputsFrom ? [ ]
@@ -15,10 +15,11 @@
 }@attrs:
 let
   mergeInputs = name:
-    (attrs.${name} or []) ++
+    (attrs.${name} or [ ]) ++
     (lib.subtractLists inputsFrom (lib.flatten (lib.catAttrs name inputsFrom)));
 
   rest = builtins.removeAttrs attrs [
+    "name"
     "packages"
     "inputsFrom"
     "buildInputs"
@@ -30,8 +31,7 @@ let
 in
 
 stdenv.mkDerivation ({
-  name = "nix-shell";
-  phases = [ "nobuildPhase" ];
+  inherit name;
 
   buildInputs = mergeInputs "buildInputs";
   nativeBuildInputs = packages ++ (mergeInputs "nativeBuildInputs");
@@ -41,10 +41,15 @@ stdenv.mkDerivation ({
   shellHook = lib.concatStringsSep "\n" (lib.catAttrs "shellHook"
     (lib.reverseList inputsFrom ++ [ attrs ]));
 
-  nobuildPhase = ''
-    echo
-    echo "This derivation is not meant to be built, aborting";
-    echo
-    exit 1
+  phases = [ "buildPhase" ];
+
+  buildPhase = ''
+    echo "------------------------------------------------------------" >>$out
+    echo " WARNING: the existence of this path is not guaranteed." >>$out
+    echo " It is an internal implementation detail for pkgs.mkShell."   >>$out
+    echo "------------------------------------------------------------" >>$out
+    echo >> $out
+    # Record all build inputs as runtime dependencies
+    export >> $out
   '';
 } // rest)
diff --git a/pkgs/data/themes/graphite/default.nix b/pkgs/data/themes/graphite/default.nix
new file mode 100644
index 00000000000..42d4c5c7534
--- /dev/null
+++ b/pkgs/data/themes/graphite/default.nix
@@ -0,0 +1,87 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+, gnome-themes-extra
+, gtk-engine-murrine
+, jdupes
+, sassc
+, themeVariants ? [] # default: blue
+, colorVariants ? [] # default: all
+, sizeVariants ? [] # default: standard
+, tweaks ? []
+, wallpapers ? false
+}:
+
+let
+  pname = "graphite-gtk-theme";
+
+  throwIfNotSubList = name: given: valid:
+    let
+      unexpected = lib.subtractLists valid given;
+    in
+      lib.throwIfNot (unexpected == [])
+        "${name}: ${builtins.concatStringsSep ", " (builtins.map builtins.toString unexpected)} unexpected; valid ones: ${builtins.concatStringsSep ", " (builtins.map builtins.toString valid)}";
+
+in
+throwIfNotSubList "${pname}: theme variants" themeVariants [ "default" "purple" "pink" "red" "orange" "yellow" "green" "teal" "blue" "all" ]
+throwIfNotSubList "${pname}: color variants" colorVariants [ "standard" "light" "dark" ]
+throwIfNotSubList "${pname}: size variants" sizeVariants [ "standard" "compact" ]
+throwIfNotSubList "${pname}: tweaks" tweaks [ "nord" "black" "midblack" "rimless" "normal" ]
+
+stdenvNoCC.mkDerivation {
+  inherit pname;
+  version = "unstable-2022-01-04";
+
+  src = fetchFromGitHub {
+    owner = "vinceliuice";
+    repo = pname;
+    rev = "947cac4966377d8f5b5a4e2966ec2b9a6041d205";
+    sha256 = "11pl8hzk4fwniqdib0ffvjilpspr1n5pg1gw39kal13wxh4sdg28";
+  };
+
+  nativeBuildInputs = [
+    jdupes
+    sassc
+  ];
+
+  buildInputs = [
+    gnome-themes-extra
+  ];
+
+  propagatedUserEnvPkgs = [
+    gtk-engine-murrine
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    patchShebangs install.sh
+
+    name= ./install.sh \
+      ${lib.optionalString (themeVariants != []) "--theme " + builtins.toString themeVariants} \
+      ${lib.optionalString (colorVariants != []) "--color " + builtins.toString colorVariants} \
+      ${lib.optionalString (sizeVariants != []) "--size " + builtins.toString sizeVariants} \
+      ${lib.optionalString (tweaks != []) "--tweaks " + builtins.toString tweaks} \
+      --dest $out/share/themes
+
+    ${lib.optionalString wallpapers ''
+      mkdir -p $out/share/backgrounds
+      cp -a wallpaper/Graphite-normal/*.png $out/share/backgrounds/
+      ${lib.optionalString (builtins.elem "nord" tweaks) ''
+        cp -a wallpaper/Graphite-nord/*.png $out/share/backgrounds/
+      ''}
+    ''}
+
+    jdupes -L -r $out/share
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Flat Gtk+ theme based on Elegant Design";
+    homepage = "https://github.com/vinceliuice/Graphite-gtk-theme";
+    license = licenses.gpl3Only;
+    platforms = platforms.unix;
+    maintainers = [ maintainers.romildo ];
+  };
+}
diff --git a/pkgs/development/compilers/go/1.17.nix b/pkgs/development/compilers/go/1.17.nix
index e16e78d21a3..35c16f49f70 100644
--- a/pkgs/development/compilers/go/1.17.nix
+++ b/pkgs/development/compilers/go/1.17.nix
@@ -54,11 +54,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.17.5";
+  version = "1.17.6";
 
   src = fetchurl {
     url = "https://dl.google.com/go/go${version}.src.tar.gz";
-    sha256 = "sha256-Pe+5oJvtBCQDGV6HLcvIxvrhSFljMyJ5Zo7FLoCpWi0=";
+    sha256 = "sha256-TcG78/9h8MH/Kxk1Xm2IFRpwEmJopHx2FHdobvlHSMg=";
   };
 
   # perl is used for testing go vet
diff --git a/pkgs/development/libraries/lensfun/default.nix b/pkgs/development/libraries/lensfun/default.nix
index 23675c9f9f8..a889e5358a5 100644
--- a/pkgs/development/libraries/lensfun/default.nix
+++ b/pkgs/development/libraries/lensfun/default.nix
@@ -25,9 +25,9 @@ stdenv.mkDerivation {
   };
 
   # replace database with a more recent snapshot
-  postUnpack = ''
-    rm -R source/data/db
-    cp -R ${lensfunDatabase}/data/db source/data
+  prePatch = ''
+    rm -R ./data/db
+    cp -R ${lensfunDatabase}/data/db ./data
   '';
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/development/libraries/libcamera/default.nix b/pkgs/development/libraries/libcamera/default.nix
index 187e2cf908e..37acf1fc8f0 100644
--- a/pkgs/development/libraries/libcamera/default.nix
+++ b/pkgs/development/libraries/libcamera/default.nix
@@ -4,9 +4,11 @@
 , meson
 , ninja
 , pkg-config
+, makeFontsConf
 , boost
 , gnutls
 , openssl
+, libdrm
 , libevent
 , lttng-ust
 , gst_all_1
@@ -15,16 +17,17 @@
 , doxygen
 , python3
 , python3Packages
+, systemd # for libudev
 }:
 
 stdenv.mkDerivation {
   pname = "libcamera";
-  version = "unstable-2021-09-24";
+  version = "unstable-2022-01-03";
 
   src = fetchgit {
     url = "https://git.libcamera.org/libcamera/libcamera.git";
-    rev = "40f5fddca7f774944a53f58eeaebc4db79c373d8";
-    sha256 = "0jklgdv5ma4nszxibms5lkf5d2ips7ncynwa1flglrhl5bl4wkzz";
+    rev = "1db1e31e664c1f613dc964d8519fe75d67b154b6";
+    hash = "sha256-pXYPIU9xDWA870Gp1Jgizi5xnUHRvTqEq/ofFXdVZdg=";
   };
 
   postPatch = ''
@@ -44,6 +47,10 @@ stdenv.mkDerivation {
 
     # cam integration
     libevent
+    libdrm
+
+    # hotplugging
+    systemd
 
     # lttng tracing
     lttng-ust
@@ -65,11 +72,18 @@ stdenv.mkDerivation {
     openssl
   ];
 
-  mesonFlags = [ "-Dv4l2=true" "-Dqcam=disabled" ];
+  mesonFlags = [
+    "-Dv4l2=true"
+    "-Dqcam=disabled"
+    "-Dlc-compliance=disabled" # tries unconditionally to download gtest when enabled
+    ];
 
   # Fixes error on a deprecated declaration
   NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
 
+  # Silence fontconfig warnings about missing config
+  FONTCONFIG_FILE = makeFontsConf { fontDirectories = []; };
+
   meta = with lib; {
     description = "An open source camera stack and framework for Linux, Android, and ChromeOS";
     homepage = "https://libcamera.org";
diff --git a/pkgs/development/libraries/ncurses/default.nix b/pkgs/development/libraries/ncurses/default.nix
index b7ca4df8885..bdce5f48efd 100644
--- a/pkgs/development/libraries/ncurses/default.nix
+++ b/pkgs/development/libraries/ncurses/default.nix
@@ -1,15 +1,13 @@
-{ lib, stdenv, fetchurl, pkg-config
-
+{ lib
+, stdenv
+, fetchurl
+, buildPackages
+, pkg-config
 , abiVersion ? "6"
-, mouseSupport ? false
-, unicode ? true
 , enableStatic ? stdenv.hostPlatform.isStatic
-, enableShared ? !enableStatic
 , withCxx ? !stdenv.hostPlatform.useAndroidPrebuilt
-
-, gpm
-
-, buildPackages
+, mouseSupport ? false, gpm
+, unicodeSupport ? true
 }:
 
 stdenv.mkDerivation rec {
@@ -31,13 +29,13 @@ stdenv.mkDerivation rec {
   setOutputFlags = false; # some aren't supported
 
   configureFlags = [
-    (lib.withFeature enableShared "shared")
+    (lib.withFeature (!enableStatic) "shared")
     "--without-debug"
     "--enable-pc-files"
     "--enable-symlinks"
     "--with-manpage-format=normal"
     "--disable-stripping"
-  ] ++ lib.optional unicode "--enable-widec"
+  ] ++ lib.optional unicodeSupport "--enable-widec"
     ++ lib.optional (!withCxx) "--without-cxx"
     ++ lib.optional (abiVersion == "5") "--with-abi-version=5"
     ++ lib.optional stdenv.hostPlatform.isNetBSD "--enable-rpath"
@@ -49,12 +47,16 @@ stdenv.mkDerivation rec {
   # Only the C compiler, and explicitly not C++ compiler needs this flag on solaris:
   CFLAGS = lib.optionalString stdenv.isSunOS "-D_XOPEN_SOURCE_EXTENDED";
 
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
+  depsBuildBuild = [
+    buildPackages.stdenv.cc
+  ];
+
   nativeBuildInputs = [
     pkg-config
   ] ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
     buildPackages.ncurses
   ];
+
   buildInputs = lib.optional (mouseSupport && stdenv.isLinux) gpm;
 
   preConfigure = ''
@@ -147,31 +149,26 @@ stdenv.mkDerivation rec {
     rm "$out"/lib/*.a
   '';
 
-  meta = {
+  meta = with lib; {
+    homepage = "https://www.gnu.org/software/ncurses/";
     description = "Free software emulation of curses in SVR4 and more";
-
     longDescription = ''
-      The Ncurses (new curses) library is a free software emulation of
-      curses in System V Release 4.0, and more.  It uses Terminfo
-      format, supports pads and color and multiple highlights and
-      forms characters and function-key mapping, and has all the other
-      SYSV-curses enhancements over BSD Curses.
-
-      The ncurses code was developed under GNU/Linux.  It has been in
-      use for some time with OpenBSD as the system curses library, and
-      on FreeBSD and NetBSD as an external package.  It should port
-      easily to any ANSI/POSIX-conforming UNIX.  It has even been
-      ported to OS/2 Warp!
+      The Ncurses (new curses) library is a free software emulation of curses in
+      System V Release 4.0, and more. It uses Terminfo format, supports pads and
+      color and multiple highlights and forms characters and function-key
+      mapping, and has all the other SYSV-curses enhancements over BSD Curses.
+
+      The ncurses code was developed under GNU/Linux. It has been in use for
+      some time with OpenBSD as the system curses library, and on FreeBSD and
+      NetBSD as an external package. It should port easily to any
+      ANSI/POSIX-conforming UNIX. It has even been ported to OS/2 Warp!
     '';
-
-    homepage = "https://www.gnu.org/software/ncurses/";
-
-    license = lib.licenses.mit;
-    platforms = lib.platforms.all;
+    license = licenses.mit;
+    platforms = platforms.all;
   };
 
   passthru = {
     ldflags = "-lncurses";
-    inherit unicode abiVersion;
+    inherit unicodeSupport abiVersion;
   };
 }
diff --git a/pkgs/development/libraries/opencv/4.x.nix b/pkgs/development/libraries/opencv/4.x.nix
index 10459d959b2..0c6f9fb90c0 100644
--- a/pkgs/development/libraries/opencv/4.x.nix
+++ b/pkgs/development/libraries/opencv/4.x.nix
@@ -275,7 +275,12 @@ stdenv.mkDerivation {
   propagatedBuildInputs = lib.optional enablePython pythonPackages.numpy
     ++ lib.optionals enableCuda [ cudatoolkit nvidia-optical-flow-sdk ];
 
-  nativeBuildInputs = [ cmake pkg-config unzip ];
+  nativeBuildInputs = [ cmake pkg-config unzip ]
+  ++ lib.optionals enablePython [
+    pythonPackages.pip
+    pythonPackages.wheel
+    pythonPackages.setuptools
+  ];
 
   NIX_CFLAGS_COMPILE = lib.optionalString enableEXR "-I${ilmbase.dev}/include/OpenEXR";
 
@@ -333,6 +338,21 @@ stdenv.mkDerivation {
   postInstall = ''
     sed -i "s|{exec_prefix}/$out|{exec_prefix}|;s|{prefix}/$out|{prefix}|" \
       "$out/lib/pkgconfig/opencv4.pc"
+  ''
+  # install python distribution information, so other packages can `import opencv`
+  + lib.optionalString enablePython ''
+    pushd $NIX_BUILD_TOP/$sourceRoot/modules/python/package
+    python -m pip wheel --verbose --no-index --no-deps --no-clean --no-build-isolation --wheel-dir dist .
+
+    pushd dist
+    python -m pip install ./*.whl --no-index --no-warn-script-location --prefix="$out" --no-cache
+
+    # the cv2/__init__.py just tries to check provide "nice user feedback" if the installation is bad
+    # however, this also causes infinite recursion when used by other packages
+    rm -r $out/${pythonPackages.python.sitePackages}/cv2
+
+    popd
+    popd
   '';
 
   passthru = lib.optionalAttrs enablePython { pythonPath = [ ]; };
diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index b6d96492fce..f1159017de6 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -60,16 +60,12 @@
 }:
 
 let
-  fontsConf = makeFontsConf {
-    fontDirectories = [ ];
-  };
-
-  mesonEnable = b: if b then "enabled" else "disabled";
+  mesonEnableFeature = b: if b then "enabled" else "disabled";
   mesonList = l: "[" + lib.concatStringsSep "," l + "]";
 
   self = stdenv.mkDerivation rec {
     pname = "pipewire";
-    version = "0.3.42";
+    version = "0.3.43";
 
     outputs = [
       "out"
@@ -87,7 +83,7 @@ let
       owner = "pipewire";
       repo = "pipewire";
       rev = version;
-      sha256 = "sha256-Iyd5snOt+iCT7W0+FlfvhMUZo/gF+zr9JX4HIGVdHto=";
+      sha256 = "sha256-vjMA9dQvZe7dPbF9BNtCYf1V240RUBdtxeyqFjWA4j4=";
     };
 
     patches = [
@@ -103,15 +99,6 @@ let
       ./0090-pipewire-config-template-paths.patch
       # Place SPA data files in lib output to avoid dependency cycles
       ./0095-spa-data-dir.patch
-      # Fix attempt to put system service units into pkgs.systemd.
-      (fetchpatch {
-        url = "https://gitlab.freedesktop.org/pipewire/pipewire/-/commit/b666edde787b167c6e19b9356257d48007357acc.diff";
-        sha256 = "1pmnyyvrjykr46ld4a5frq3cc739f8h4jwvfj414lyx8c6ybm63s";
-      })
-      (fetchpatch {
-        url = "https://gitlab.freedesktop.org/pipewire/pipewire/-/commit/5054b48c9de655b4b48f7c801cb305d9eb122520.diff";
-        sha256 = "0myhb7h4g7x2nr08dpx8d7nqhsmzp90yanmkvm627r1xxnnr3ivn";
-      })
     ];
 
     nativeBuildInputs = [
@@ -159,33 +146,32 @@ let
       "-Dinstalled_test_prefix=${placeholder "installedTests"}"
       "-Dpipewire_pulse_prefix=${placeholder "pulse"}"
       "-Dlibjack-path=${placeholder "jack"}/lib"
-      "-Dlibcamera=${mesonEnable libcameraSupport}"
-      "-Droc=${mesonEnable rocSupport}"
-      "-Dlibpulse=${mesonEnable pulseTunnelSupport}"
-      "-Davahi=${mesonEnable zeroconfSupport}"
-      "-Dgstreamer=${mesonEnable gstreamerSupport}"
+      "-Dlibcamera=${mesonEnableFeature libcameraSupport}"
+      "-Droc=${mesonEnableFeature rocSupport}"
+      "-Dlibpulse=${mesonEnableFeature pulseTunnelSupport}"
+      "-Davahi=${mesonEnableFeature zeroconfSupport}"
+      "-Dgstreamer=${mesonEnableFeature gstreamerSupport}"
       "-Dsystemd-system-service=enabled"
-      "-Dffmpeg=${mesonEnable ffmpegSupport}"
-      "-Dbluez5=${mesonEnable bluezSupport}"
-      "-Dbluez5-backend-hsp-native=${mesonEnable nativeHspSupport}"
-      "-Dbluez5-backend-hfp-native=${mesonEnable nativeHfpSupport}"
-      "-Dbluez5-backend-ofono=${mesonEnable ofonoSupport}"
-      "-Dbluez5-backend-hsphfpd=${mesonEnable hsphfpdSupport}"
+      "-Dffmpeg=${mesonEnableFeature ffmpegSupport}"
+      "-Dbluez5=${mesonEnableFeature bluezSupport}"
+      "-Dbluez5-backend-hsp-native=${mesonEnableFeature nativeHspSupport}"
+      "-Dbluez5-backend-hfp-native=${mesonEnableFeature nativeHfpSupport}"
+      "-Dbluez5-backend-ofono=${mesonEnableFeature ofonoSupport}"
+      "-Dbluez5-backend-hsphfpd=${mesonEnableFeature hsphfpdSupport}"
       "-Dsysconfdir=/etc"
       "-Dpipewire_confdata_dir=${placeholder "lib"}/share/pipewire"
       "-Dsession-managers="
       "-Dvulkan=enabled"
     ];
 
-    FONTCONFIG_FILE = fontsConf; # Fontconfig error: Cannot load default config file
+    # Fontconfig error: Cannot load default config file
+    FONTCONFIG_FILE = makeFontsConf { fontDirectories = [ ]; };
 
     doCheck = true;
 
     postUnpack = ''
-      patchShebangs source/doc/strip-static.sh
       patchShebangs source/doc/input-filter.sh
       patchShebangs source/doc/input-filter-h.sh
-      patchShebangs source/spa/tests/gen-cpp-test.py
     '';
 
     postInstall = ''
diff --git a/pkgs/development/libraries/pipewire/wireplumber.nix b/pkgs/development/libraries/pipewire/wireplumber.nix
new file mode 100644
index 00000000000..eba1b210590
--- /dev/null
+++ b/pkgs/development/libraries/pipewire/wireplumber.nix
@@ -0,0 +1,82 @@
+{ lib
+, stdenv
+, fetchFromGitLab
+, nix-update-script
+, # base build deps
+  meson
+, pkg-config
+, ninja
+, # docs build deps
+  python3
+, doxygen
+, graphviz
+, # GI build deps
+  gobject-introspection
+, # runtime deps
+  glib
+, systemd
+, lua5_4
+, pipewire
+, # options
+  enableDocs ? true
+, enableGI ? stdenv.hostPlatform == stdenv.buildPlatform
+}:
+let
+  mesonEnableFeature = b: if b then "enabled" else "disabled";
+in
+stdenv.mkDerivation rec {
+  pname = "wireplumber";
+  version = "0.4.6";
+
+  outputs = [ "out" "dev" ] ++ lib.optional enableDocs "doc";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "pipewire";
+    repo = "wireplumber";
+    rev = version;
+    sha256 = "sha256-y+Gj9EZn67W3U81zXgp+6JAFxZSZTwwT0TB3Kueb/Tw=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    pkg-config
+    ninja
+  ] ++ lib.optionals enableDocs [
+    graphviz
+  ] ++ lib.optionals enableGI [
+    gobject-introspection
+  ] ++ lib.optionals (enableDocs || enableGI) [
+    doxygen
+    (python3.withPackages (ps: with ps;
+    lib.optionals enableDocs [ sphinx sphinx_rtd_theme breathe ] ++
+      lib.optionals enableGI [ lxml ]
+    ))
+  ];
+
+  buildInputs = [
+    glib
+    systemd
+    lua5_4
+    pipewire
+  ];
+
+  mesonFlags = [
+    "-Dsystem-lua=true"
+    "-Delogind=disabled"
+    "-Ddoc=${mesonEnableFeature enableDocs}"
+    "-Dintrospection=${mesonEnableFeature enableGI}"
+  ];
+
+  passthru.updateScript = nix-update-script {
+    attrPath = pname;
+  };
+
+  meta = with lib; {
+    description = "A modular session / policy manager for PipeWire";
+    homepage = "https://pipewire.org";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ k900 ];
+  };
+}
diff --git a/pkgs/development/python-modules/django-allauth/default.nix b/pkgs/development/python-modules/django-allauth/default.nix
index 143e76cf0d8..a68cfd6d9cd 100644
--- a/pkgs/development/python-modules/django-allauth/default.nix
+++ b/pkgs/development/python-modules/django-allauth/default.nix
@@ -3,14 +3,14 @@
 
 buildPythonPackage rec {
   pname = "django-allauth";
-  version = "0.40.0";
+  version = "0.47.0";
 
   # no tests on PyPI
   src = fetchFromGitHub {
     owner = "pennersr";
     repo = pname;
     rev = version;
-    sha256 = "10id4k01p1hg5agb8cmllg8mv4kc7ryl75br10idwxabqqp4vla1";
+    sha256 = "sha256-wKrsute6TCl331UrxNEBf/zTtGnyGHsOZQwdiicbg2o=";
   };
 
   propagatedBuildInputs = [ requests requests_oauthlib django python3-openid ];
diff --git a/pkgs/development/python-modules/django-oauth-toolkit/default.nix b/pkgs/development/python-modules/django-oauth-toolkit/default.nix
index e7cb4814cb4..6212c754f89 100644
--- a/pkgs/development/python-modules/django-oauth-toolkit/default.nix
+++ b/pkgs/development/python-modules/django-oauth-toolkit/default.nix
@@ -1,22 +1,58 @@
-{ lib, buildPythonPackage, fetchFromGitHub
-, django, requests, oauthlib
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+
+# propagates
+, django
+, jwcrypto
+, requests
+, oauthlib
+
+# tests
+, djangorestframework
+, pytest-django
+, pytest-xdist
+, pytest-mock
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "django-oauth-toolkit";
-  version = "1.2.0";
+  version = "1.6.1";
+  format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "jazzband";
     repo = pname;
     rev = version;
-    sha256 = "1zbksxrcxlqnapmlvx4rgvpqc4plgnq0xnf45cjwzwi1626zs8g6";
+    sha256 = "sha256-TOrFxQULwiuwpVFqRwRkfTW+GRudLNy6F/gIjUYjZhI=";
   };
 
-  propagatedBuildInputs = [ django requests oauthlib ];
+  postPatch = ''
+    sed -i '/cov/d' tox.ini
+  '';
+
+  propagatedBuildInputs = [
+    django
+    jwcrypto
+    oauthlib
+    requests
+  ];
+
+  DJANGO_SETTINGS_MODULE = "tests.settings";
+
+  checkInputs = [
+    djangorestframework
+    pytest-django
+    pytest-xdist
+    pytest-mock
+    pytestCheckHook
+  ];
 
-  # django.core.exceptions.ImproperlyConfigured: Requested setting OAUTH2_PROVIDER, but settings are not configured. You must either define the environment variable DJANGO_SETTINGS_MODULE or call settings.configure() before accessing settings
-  doCheck = false;
+  disabledTests = [
+    # Failed to get a valid response from authentication server. Status code: 404, Reason: Not Found.
+    "test_response_when_auth_server_response_return_404"
+  ];
 
   meta = with lib; {
     description = "OAuth2 goodies for the Djangonauts";
diff --git a/pkgs/development/python-modules/django_guardian/default.nix b/pkgs/development/python-modules/django_guardian/default.nix
index 9685e55bb1c..c7bda13dd9a 100644
--- a/pkgs/development/python-modules/django_guardian/default.nix
+++ b/pkgs/development/python-modules/django_guardian/default.nix
@@ -1,5 +1,5 @@
 { lib, buildPythonPackage, fetchPypi
-, django_environ, mock, django
+, django-environ, mock, django
 , pytest, pytest-runner, pytest-django
 }:
 buildPythonPackage rec {
@@ -11,7 +11,7 @@ buildPythonPackage rec {
     sha256 = "c58a68ae76922d33e6bdc0e69af1892097838de56e93e78a8361090bcd9f89a0";
   };
 
-  checkInputs = [ pytest pytest-runner pytest-django django_environ mock ];
+  checkInputs = [ pytest pytest-runner pytest-django django-environ mock ];
   propagatedBuildInputs = [ django ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/gql/default.nix b/pkgs/development/python-modules/gql/default.nix
new file mode 100644
index 00000000000..65e4bbde319
--- /dev/null
+++ b/pkgs/development/python-modules/gql/default.nix
@@ -0,0 +1,77 @@
+{ lib
+, aiofiles
+, aiohttp
+, botocore
+, buildPythonPackage
+, fetchFromGitHub
+, graphql-core
+, mock
+, parse
+, pytest-asyncio
+, pytestCheckHook
+, pythonOlder
+, requests
+, requests-toolbelt
+, urllib3
+, vcrpy
+, websockets
+, yarl
+}:
+
+buildPythonPackage rec {
+  pname = "gql";
+  version = "3.0.0rc0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "graphql-python";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-yr1DyMj/0C9XPTyGdbQbn7nMRKr4JwItFDsqvl/goqU=";
+  };
+
+  propagatedBuildInputs = [
+    aiohttp
+    botocore
+    graphql-core
+    requests
+    requests-toolbelt
+    urllib3
+    websockets
+    yarl
+  ];
+
+  checkInputs = [
+    aiofiles
+    mock
+    parse
+    pytest-asyncio
+    pytestCheckHook
+    vcrpy
+  ];
+
+  disabledTests = [
+    # Tests requires network access
+    "test_execute_result_error"
+    "test_http_transport"
+  ];
+
+  disabledTestPaths = [
+    # Exclude linter tests
+    "gql-checker/tests/test_flake8_linter.py"
+    "gql-checker/tests/test_pylama_linter.py"
+  ];
+
+  pythonImportsCheck = [
+    "gql"
+  ];
+
+  meta = with lib; {
+    description = "GraphQL client in Python";
+    homepage = "https://github.com/graphql-python/gql";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/gradient-utils/default.nix b/pkgs/development/python-modules/gradient-utils/default.nix
index 87002505c0e..e81d815e8c2 100644
--- a/pkgs/development/python-modules/gradient-utils/default.nix
+++ b/pkgs/development/python-modules/gradient-utils/default.nix
@@ -7,6 +7,7 @@
 , poetry-core
 , prometheus-client
 , pytestCheckHook
+, pythonOlder
 , requests
 }:
 
@@ -15,6 +16,8 @@ buildPythonPackage rec {
   version = "0.5.0";
   format = "pyproject";
 
+  disabled = pythonOlder "3.6";
+
   src = fetchFromGitHub {
     owner = "Paperspace";
     repo = pname;
@@ -22,15 +25,9 @@ buildPythonPackage rec {
     sha256 = "19plkgwwfs6298vjplgsvhirixi3jbngq5y07x9c0fjxk39fa2dk";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace 'numpy = "1.18.5"' 'numpy = "^1.18.5"' \
-      --replace 'hyperopt = "0.1.2"' 'hyperopt = ">=0.1.2"' \
-      --replace 'wheel = "^0.35.1"' 'wheel = "*"' \
-      --replace 'prometheus-client = ">=0.8,<0.10"' 'prometheus-client = "*"'
-  '';
-
-  nativeBuildInputs = [ poetry-core ];
+  nativeBuildInputs = [
+    poetry-core
+  ];
 
   propagatedBuildInputs = [
     hyperopt
@@ -44,20 +41,24 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace 'wheel = "^0.35.1"' 'wheel = "*"' \
+      --replace 'prometheus-client = ">=0.8,<0.10"' 'prometheus-client = "*"'
+  '';
+
   preCheck = ''
     export HOSTNAME=myhost-experimentId
   '';
 
-  disabledTests = [
-    "test_add_metrics_pushes_metrics" # requires a working prometheus push gateway
-  ];
-
   disabledTestPaths = [
-    # needs network access
+    # Requires a working Prometheus push gateway
     "tests/integration/test_metrics.py"
   ];
 
-  pythonImportsCheck = [ "gradient_utils" ];
+  pythonImportsCheck = [
+    "gradient_utils"
+  ];
 
   meta = with lib; {
     description = "Python utils and helpers library for Gradient";
diff --git a/pkgs/development/python-modules/gradient/default.nix b/pkgs/development/python-modules/gradient/default.nix
index ccde1a38ecc..026c61fc615 100644
--- a/pkgs/development/python-modules/gradient/default.nix
+++ b/pkgs/development/python-modules/gradient/default.nix
@@ -9,6 +9,7 @@
 , fetchPypi
 , gradient_statsd
 , gradient-utils
+, gql
 , halo
 , marshmallow
 , progressbar2
@@ -22,17 +23,19 @@
 
 buildPythonPackage rec {
   pname = "gradient";
-  version = "1.9.0";
+  version = "1.9.1";
+  format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "47be02511d7ea66a13559598851cb435d435fb3f7676f6de17292d06daad8947";
+    hash = "sha256-zimOh4bc9EQGpqMky/etwnAF04onJ2m/KAl29IaAeAY=";
   };
 
   postPatch = ''
     substituteInPlace setup.py \
       --replace 'attrs<=' 'attrs>=' \
       --replace 'colorama==' 'colorama>=' \
+      --replace 'gql[requests]==3.0.0a6' 'gql' \
       --replace 'PyYAML==' 'PyYAML>=' \
       --replace 'marshmallow<' 'marshmallow>=' \
       --replace 'websocket-client==' 'websocket-client>='
@@ -45,6 +48,7 @@ buildPythonPackage rec {
     click-didyoumean
     click-help-colors
     colorama
+    gql
     gradient_statsd
     gradient-utils
     halo
@@ -58,17 +62,20 @@ buildPythonPackage rec {
     websocket-client
   ];
 
-  # tries to use /homeless-shelter to mimic container usage, etc
+  # Tries to use /homeless-shelter to mimic container usage, etc
   doCheck = false;
 
+  # marshmallow.exceptions.StringNotCollectionError: "only" should be a collection of strings.
+  # Support for marshmallow > 3
+  # pythonImportsCheck = [
+  #   "gradient"
+  # ];
+
   meta = with lib; {
     description = "The command line interface for Gradient";
     homepage = "https://github.com/Paperspace/gradient-cli";
     license = licenses.isc;
     platforms = platforms.unix;
     maintainers = with maintainers; [ thoughtpolice ];
-    # There is no support for click > 8
-    # https://github.com/Paperspace/gradient-cli/issues/368
-    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/makefun/default.nix b/pkgs/development/python-modules/makefun/default.nix
index dbf4b8ffe46..1d4ae635800 100644
--- a/pkgs/development/python-modules/makefun/default.nix
+++ b/pkgs/development/python-modules/makefun/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "makefun";
-  version = "1.13.0";
+  version = "1.13.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2c673d2b4f0ef809347513cb45e3b23a04228588af7c9ac859e99247abac516a";
+    sha256 = "985bb8b670ffbbb95d2a8aa996d318e6e9a3f26fc6f3ef2da93ebdf8f9c616bf";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/oauthlib/default.nix b/pkgs/development/python-modules/oauthlib/default.nix
index 5c4cbc78adb..01e6ca29b5d 100644
--- a/pkgs/development/python-modules/oauthlib/default.nix
+++ b/pkgs/development/python-modules/oauthlib/default.nix
@@ -1,31 +1,40 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, mock
-, pytest
-, cryptography
+
+# propagates
 , blinker
+, cryptography
 , pyjwt
+
+# test
+, mock
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "oauthlib";
-  version = "unstable-2020-05-08";
+  version = "3.1.1";
+  format = "setuptools";
 
   # master supports pyjwt==1.7.1
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
-    rev = "46647402896db5f0d979eba9594623e889739060";
-    sha256 = "1wrdjdvlfcd74lckcgascnasrffg8sip0z673si4ag5kv4afiz3l";
+    rev = "v${version}";
+    hash = "sha256:1bgxpzh11i0x7h9py3a29cz5z714b3p498b62znnn5ciy0cr80sv";
   };
 
-  checkInputs = [ mock pytest ];
-  propagatedBuildInputs = [ cryptography blinker pyjwt ];
+  propagatedBuildInputs = [
+    blinker
+    cryptography
+    pyjwt
+  ];
 
-  checkPhase = ''
-    py.test tests/
-  '';
+  checkInputs = [
+    mock
+    pytestCheckHook
+  ];
 
   meta = with lib; {
     homepage = "https://github.com/idan/oauthlib";
diff --git a/pkgs/development/python-modules/pydub/default.nix b/pkgs/development/python-modules/pydub/default.nix
index 6b67814a222..3adf54281b7 100644
--- a/pkgs/development/python-modules/pydub/default.nix
+++ b/pkgs/development/python-modules/pydub/default.nix
@@ -1,8 +1,18 @@
-{ lib, stdenv, buildPythonPackage, fetchFromGitHub, scipy, ffmpeg-full }:
+{ lib
+, stdenv
+, buildPythonPackage
+, fetchFromGitHub
+
+# tests
+, ffmpeg-full
+, python
+}:
 
 buildPythonPackage rec {
   pname = "pydub";
   version = "0.25.1";
+  format = "setuptools";
+
   # pypi version doesn't include required data files for tests
   src = fetchFromGitHub {
     owner = "jiaaro";
@@ -11,23 +21,24 @@ buildPythonPackage rec {
     sha256 = "0xskllq66wqndjfmvp58k26cv3w480sqsil6ifwp4gghir7hqc8m";
   };
 
+  pythonImportsCheck = [
+    "pydub"
+    "pydub.audio_segment"
+    "pydub.playback"
+  ];
 
-  # disable a test that fails on aarch64 due to rounding errors
-  postPatch = lib.optionalString stdenv.isAarch64 ''
-    substituteInPlace test/test.py \
-      --replace "test_overlay_with_gain_change" "notest_overlay_with_gain_change"
-  '';
-
-  checkInputs = [ scipy ffmpeg-full ];
+  checkInputs = [
+    ffmpeg-full
+  ];
 
   checkPhase = ''
-    python test/test.py
+    ${python.interpreter} test/test.py
   '';
 
   meta = with lib; {
-    description = "Manipulate audio with a simple and easy high level interface.";
-    homepage    = "http://pydub.com/";
-    license     = licenses.mit;
-    platforms   = platforms.all;
+    description = "Manipulate audio with a simple and easy high level interface";
+    homepage = "http://pydub.com";
+    license = licenses.mit;
+    maintainers = with maintainers; [ hexa ];
   };
 }
diff --git a/pkgs/development/python-modules/pylgnetcast/default.nix b/pkgs/development/python-modules/pylgnetcast/default.nix
index cadb4bb8383..51e3dfdab28 100644
--- a/pkgs/development/python-modules/pylgnetcast/default.nix
+++ b/pkgs/development/python-modules/pylgnetcast/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "pylgnetcast";
-  version = "0.3.5";
+  version = "0.3.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "Drafteed";
     repo = "python-lgnetcast";
     rev = "v${version}";
-    sha256 = "11g7ya4ppqxjiv3fkz9mi6h1afw9icy6xyn4jzm63kjvxqhrwnw4";
+    sha256 = "0pmz52k2sfxj5x2wcwdjks2lqh1gb5zfrjgc6xij8jal4l9xd2dz";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pynetbox/default.nix b/pkgs/development/python-modules/pynetbox/default.nix
index eeb6ad01798..54fb270a176 100644
--- a/pkgs/development/python-modules/pynetbox/default.nix
+++ b/pkgs/development/python-modules/pynetbox/default.nix
@@ -10,13 +10,13 @@
 
 buildPythonPackage rec {
   pname = "pynetbox";
-  version = "6.4.1";
+  version = "6.5.0";
 
   src = fetchFromGitHub {
     owner = "netbox-community";
     repo = pname;
     rev = "v${version}";
-    sha256 = "08k2zxfz23gzbk49r3hmh6r3m5rgx1gk7w83qxi1v4gbm4wr0v9m";
+    sha256 = "1fk64bi7aswsmfqsciamml2wydgfg464h6i7479xfim4mwmkkik4";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/pytest-cases/default.nix b/pkgs/development/python-modules/pytest-cases/default.nix
index ccbf5401bd2..c3374032d33 100644
--- a/pkgs/development/python-modules/pytest-cases/default.nix
+++ b/pkgs/development/python-modules/pytest-cases/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "pytest-cases";
-  version = "3.6.7";
+  version = "3.6.8";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-ZUAXmIww/tdm7nDAj2VDXq0B6raHeDX1ywxnnv3EVIE=";
+    sha256 = "d423e87b30e1080cc162d86c72bfa35861cccfe3539125e81c68ba142ab974bc";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/kubepug/default.nix b/pkgs/development/tools/kubepug/default.nix
index 4795d35e7e6..d14ba450103 100644
--- a/pkgs/development/tools/kubepug/default.nix
+++ b/pkgs/development/tools/kubepug/default.nix
@@ -1,23 +1,25 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib, buildGo117Module, fetchFromGitHub }:
 
-buildGoModule rec {
+buildGo117Module rec {
   pname = "kubepug";
-  version = "1.2.2";
+  version = "1.3.2";
 
   src = fetchFromGitHub {
     owner = "rikatz";
     repo = "kubepug";
     rev = "v${version}";
-    sha256 = "sha256-jQ/LzwxYxfCKiu+2VhjQ3YWwLEqZkYrH7+olBOMUA1A=";
+    sha256 = "sha256-cjL718xTgtYev/lYL24vwZcB+joY3wIY4ixRCwAHQ4E=";
   };
 
-  vendorSha256 = "sha256-P5HoU9AAGFrSrp9iymjW+r8w5L90KUOrmaXM8p+Wn44=";
+  vendorSha256 = "0hynxj3q4aa1gx3w4ak56z6j5iplxi2hzqzsjkgz20fy34nfd41s";
 
   ldflags = [
     "-s" "-w" "-X=github.com/rikatz/kubepug/version.Version=${src.rev}"
   ];
 
-  subPackages = [ "cmd/kubepug.go" ];
+  patches = [
+    ./skip-external-network-tests.patch
+  ];
 
   meta = with lib; {
     description = "Checks a Kubernetes cluster for objects using deprecated API versions";
diff --git a/pkgs/development/tools/kubepug/skip-external-network-tests.patch b/pkgs/development/tools/kubepug/skip-external-network-tests.patch
new file mode 100644
index 00000000000..e24aa01ad17
--- /dev/null
+++ b/pkgs/development/tools/kubepug/skip-external-network-tests.patch
@@ -0,0 +1,12 @@
+diff --git a/pkg/utils/downloader_test.go b/pkg/utils/downloader_test.go
+index b227760..b72dee9 100644
+--- a/pkg/utils/downloader_test.go
++++ b/pkg/utils/downloader_test.go
+@@ -7,6 +7,7 @@ import (
+ )
+ 
+ func TestDownloadSwaggerFile(t *testing.T) {
++    t.Skipf("Nix sandbox does not have networking")
+ 	var tmpdir string
+ 	// Github actions does not have a temporary dir :/
+ 	tmpdir = os.Getenv("RUNNER_TEMP")
diff --git a/pkgs/development/tools/rust/cargo-llvm-lines/default.nix b/pkgs/development/tools/rust/cargo-llvm-lines/default.nix
index 1e10d9eddcf..7fc1da095e5 100644
--- a/pkgs/development/tools/rust/cargo-llvm-lines/default.nix
+++ b/pkgs/development/tools/rust/cargo-llvm-lines/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-llvm-lines";
-  version = "0.4.12";
+  version = "0.4.13";
 
   src = fetchFromGitHub {
     owner = "dtolnay";
     repo = pname;
     rev = version;
-    sha256 = "sha256-D4blt8kGD0mxysedRMZo/VNfwfYdJs8T2zoNjHRi0ng=";
+    sha256 = "sha256-sN0i2oo0XuxneIK/w+jpxkcdm2rtqhyH2Y3CMPnH+ro=";
   };
 
-  cargoSha256 = "sha256-H2APBu9oHmtRGSB+VQT9V5C36awPy8fi6A2Qf1RsIbU=";
+  cargoSha256 = "sha256-Gv7C4NFThNawhT+IYO0ZbpOh6w/yPeIJKZjzTyM/GJw=";
 
   meta = with lib; {
     description = "Count the number of lines of LLVM IR across all instantiations of a generic function";
diff --git a/pkgs/misc/uboot/default.nix b/pkgs/misc/uboot/default.nix
index 2d234aa9e00..dec567f1ccd 100644
--- a/pkgs/misc/uboot/default.nix
+++ b/pkgs/misc/uboot/default.nix
@@ -352,6 +352,26 @@ in {
     filesToInstall = ["u-boot.bin"];
   };
 
+  ubootQemuX86 = buildUBoot {
+    defconfig = "qemu-x86_defconfig";
+    extraConfig = ''
+      CONFIG_USB_UHCI_HCD=y
+      CONFIG_USB_EHCI_HCD=y
+      CONFIG_USB_EHCI_GENERIC=y
+      CONFIG_USB_XHCI_HCD=y
+    '';
+    extraPatches = [
+      # https://patchwork.ozlabs.org/project/uboot/list/?series=268007&state=%2A&archive=both
+      # Remove when upgrading to 2022.01
+      (fetchpatch {
+        url = "https://patchwork.ozlabs.org/series/268007/mbox/";
+        sha256 = "sha256-xn4Q959dgoB63zlmJepI41AXAf1kCycIGcmu4IIVjmE=";
+      })
+    ];
+    extraMeta.platforms = [ "i686-linux" "x86_64-linux" ];
+    filesToInstall = [ "u-boot.rom" ];
+  };
+
   ubootRaspberryPi = buildUBoot {
     defconfig = "rpi_defconfig";
     extraMeta.platforms = ["armv6l-linux"];
diff --git a/pkgs/misc/vscode-extensions/default.nix b/pkgs/misc/vscode-extensions/default.nix
index 4de0aa5ea7f..5832d46a041 100644
--- a/pkgs/misc/vscode-extensions/default.nix
+++ b/pkgs/misc/vscode-extensions/default.nix
@@ -1285,11 +1285,16 @@ let
         mktplcRef = {
           name = "color-highlight";
           publisher = "naumovs";
-          version = "2.3.0";
-          sha256 = "1syzf43ws343z911fnhrlbzbx70gdn930q67yqkf6g0mj8lf2za2";
+          version = "2.5.0";
+          sha256 = "sha256-dYMDV84LEGXUjt/fbsSy3BVM5SsBHcPaDDll8KjPIWY=";
         };
-        meta = {
-          license = lib.licenses.mit;
+        meta = with lib; {
+          changelog = "https://marketplace.visualstudio.com/items/naumovs.color-highlight/changelog";
+          description = "Highlight web colors in your editor";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=naumovs.color-highlight";
+          homepage = "https://github.com/enyancc/vscode-ext-color-highlight";
+          license = licenses.gpl3Only;
+          maintainers = with maintainers; [ datafoo ];
         };
       };
 
diff --git a/pkgs/misc/vscode-extensions/terraform/default.nix b/pkgs/misc/vscode-extensions/terraform/default.nix
index 3ab0f893c1a..5055029c43e 100644
--- a/pkgs/misc/vscode-extensions/terraform/default.nix
+++ b/pkgs/misc/vscode-extensions/terraform/default.nix
@@ -3,8 +3,8 @@ vscode-utils.buildVscodeMarketplaceExtension rec {
   mktplcRef = {
     name = "terraform";
     publisher = "hashicorp";
-    version = "2.17.0";
-    sha256 = "sha256-IZlw1lYibbBw3rcSiWEKP8rObxnMCE1ppogwmigNgwE=";
+    version = "2.18.0";
+    sha256 = "sha256-jQ4fwsAwuGDbfSb/qCV58ETtH+2e7zD/jGISGNYPxZk=";
   };
 
   patches = [ ./fix-terraform-ls.patch ];
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index 12e58150ee5..94cbf548cf2 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -2,22 +2,22 @@
     "4.14": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-4.14.260-hardened1.patch",
-            "sha256": "13r6lx3rcbaz2wvhwa950gsjharzq1n61bl9l3nm8v66j7gab3l0",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.260-hardened1/linux-hardened-4.14.260-hardened1.patch"
+            "name": "linux-hardened-4.14.261-hardened1.patch",
+            "sha256": "0m5bb9lpaxw1kq01s9hqsxkmmsyj4ag8s5swrgdca1cf6q84r7bb",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.261-hardened1/linux-hardened-4.14.261-hardened1.patch"
         },
-        "sha256": "1bylxn6hsq17cann2w02ggz6xz3b3synrapcwlwfcfydf71hzj9f",
-        "version": "4.14.260"
+        "sha256": "08s7idxpsjb29ccj0gkrj87xhbdqj9nc417qc7gd2kmbjd6amymz",
+        "version": "4.14.261"
     },
     "4.19": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-4.19.223-hardened1.patch",
-            "sha256": "1jrg8fkb8kc3m1zcgyw99mnmgvyxi3yp33x9jh1s4babxcr7w4g3",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.223-hardened1/linux-hardened-4.19.223-hardened1.patch"
+            "name": "linux-hardened-4.19.224-hardened1.patch",
+            "sha256": "0sma7hwznyf8h3fr7r63nbfb85120nz8xq95ynp6m0lxayj5alxs",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.224-hardened1/linux-hardened-4.19.224-hardened1.patch"
         },
-        "sha256": "1cnjk49g8sxsbzk375ji47lnx36drqh1x2pbfiqdwgrbjcb043sz",
-        "version": "4.19.223"
+        "sha256": "0c8h457n52qzpw4kgr16ndhsl35si99amc6fadb31fy32csgrk01",
+        "version": "4.19.224"
     },
     "5.10": {
         "patch": {
@@ -42,11 +42,11 @@
     "5.4": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.4.169-hardened1.patch",
-            "sha256": "19mghwh66rmbjd7i0hxhysabarpz8l4wadw8schwc8q9kxy33py4",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.169-hardened1/linux-hardened-5.4.169-hardened1.patch"
+            "name": "linux-hardened-5.4.170-hardened1.patch",
+            "sha256": "0sy1114vw8lrbf4a1p3skg67am1f9bvl15d81mplx2bd98cpx0y8",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.170-hardened1/linux-hardened-5.4.170-hardened1.patch"
         },
-        "sha256": "068sw1p50vcygi422bfjpahf2fxy3ifyp4ljnkwxbbvibzcq4hsm",
-        "version": "5.4.169"
+        "sha256": "0b1qdmp2q0lpngfvvnwb248cnqn9akk2z4xawrfwziszrzh797xh",
+        "version": "5.4.170"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index e6104c6ed0c..e664024aff8 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "4.14.260";
+  version = "4.14.261";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1bylxn6hsq17cann2w02ggz6xz3b3synrapcwlwfcfydf71hzj9f";
+    sha256 = "08s7idxpsjb29ccj0gkrj87xhbdqj9nc417qc7gd2kmbjd6amymz";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix
index d87a635c5ef..dab9b5e2ab9 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "4.19.223";
+  version = "4.19.224";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1cnjk49g8sxsbzk375ji47lnx36drqh1x2pbfiqdwgrbjcb043sz";
+    sha256 = "0c8h457n52qzpw4kgr16ndhsl35si99amc6fadb31fy32csgrk01";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index 4bc6ca32c16..7690c1f6a95 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,12 +1,12 @@
 { buildPackages, fetchurl, perl, buildLinux, nixosTests, stdenv, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.4.297";
+  version = "4.4.298";
   extraMeta.branch = "4.4";
   extraMeta.broken = stdenv.isAarch64;
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "116346nkbhaz8jc1118gh40y6pw1kq7c7hm74f8bjga1p0gjqn0c";
+    sha256 = "1q56ch8p53in5rl5i7mvsyf0jimchrh48w3l416x3yi0n5cyvjc6";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index eefe4fc7fb6..313568e799a 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,12 +1,12 @@
 { buildPackages, fetchurl, perl, buildLinux, nixosTests, stdenv, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.295";
+  version = "4.9.296";
   extraMeta.branch = "4.9";
   extraMeta.broken = stdenv.isAarch64;
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "095am71hl7qryrcn1blvxsq5zsy0gixmj7062p7vvz5ypcvqcd52";
+    sha256 = "1a5ws21dk5wp397zmd7msl4zbhzm2xxgbxd09wrdcwilpv4dnjzx";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.10.nix b/pkgs/os-specific/linux/kernel/linux-5.10.nix
index 7b38ba8b095..0d31047cc95 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.10.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.10.89";
+  version = "5.10.90";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0c5v8fsv9sazdmdw4m1canm54x2p8777yavxq2gcpw8q98d8n8cj";
+    sha256 = "0997ijkmvf9iz4hn8m8naiagphhyvl4r6qx4q3gxk8qlq1j44pll";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.15.nix b/pkgs/os-specific/linux/kernel/linux-5.15.nix
index f5f98e3317c..a8d4c43a107 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.15.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.15.12";
+  version = "5.15.13";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "182iwy2288layl2290cxla0k6y436lxlx43yaa8par325dviksbx";
+    sha256 = "0shmrx33crnhi0wr5v6ly85pza1mmdcm8arkrdzf6plz5xm1n4qa";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.4.nix b/pkgs/os-specific/linux/kernel/linux-5.4.nix
index d568a285381..c24b9778c59 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.4.169";
+  version = "5.4.170";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "068sw1p50vcygi422bfjpahf2fxy3ifyp4ljnkwxbbvibzcq4hsm";
+    sha256 = "0b1qdmp2q0lpngfvvnwb248cnqn9akk2z4xawrfwziszrzh797xh";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
index b9458b3947f..7f2811584cf 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "5.10.87-rt59"; # updated by ./update-rt.sh
+  version = "5.10.90-rt60"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -18,14 +18,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "0jz6xhph7x0x11cjmypaw5gh8z4d53dcgx2gmg7k6d06ydq8n4h3";
+    sha256 = "0997ijkmvf9iz4hn8m8naiagphhyvl4r6qx4q3gxk8qlq1j44pll";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "04sr3n3ilvqq0dl59l92qmn3p7fjlsxxvbs3qls7b4pncb2xyyj3";
+      sha256 = "0533s01ckjjw45b08zs9nhpszdcrqgfpwvnjs2dfjmc6yg9d13pi";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/pkgs/os-specific/linux/nixos-rebuild/default.nix b/pkgs/os-specific/linux/nixos-rebuild/default.nix
index b317c5a1fbf..08bba5a428d 100644
--- a/pkgs/os-specific/linux/nixos-rebuild/default.nix
+++ b/pkgs/os-specific/linux/nixos-rebuild/default.nix
@@ -3,7 +3,6 @@
 , coreutils
 , gnused
 , gnugrep
-, jq
 , nix
 , lib
 }:
@@ -19,5 +18,5 @@ substituteAll {
   nix_x86_64_linux = fallback.x86_64-linux;
   nix_i686_linux = fallback.i686-linux;
   nix_aarch64_linux = fallback.aarch64-linux;
-  path = lib.makeBinPath [ coreutils jq gnused gnugrep ];
+  path = lib.makeBinPath [ coreutils gnused gnugrep ];
 }
diff --git a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
index e5e40dca086..1de783a5593 100755
--- a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
+++ b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
@@ -343,11 +343,6 @@ if [[ -n $flake ]]; then
     fi
 fi
 
-# Resolve the flake.
-if [[ -n $flake ]]; then
-    flake=$(nix "${flakeFlags[@]}" flake metadata --json "${extraBuildFlags[@]}" "${lockFlags[@]}" -- "$flake" | jq -r .url)
-fi
-
 # Find configuration.nix and open editor instead of building.
 if [ "$action" = edit ]; then
     if [[ -z $flake ]]; then
diff --git a/pkgs/servers/etcd/default.nix b/pkgs/servers/etcd/3.3.nix
index 4dbe6932972..4dbe6932972 100644
--- a/pkgs/servers/etcd/default.nix
+++ b/pkgs/servers/etcd/3.3.nix
diff --git a/pkgs/servers/web-apps/wordpress/default.nix b/pkgs/servers/web-apps/wordpress/default.nix
index 32b63a25b0b..b3888b7b32a 100644
--- a/pkgs/servers/web-apps/wordpress/default.nix
+++ b/pkgs/servers/web-apps/wordpress/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "wordpress";
-  version = "5.8.2";
+  version = "5.8.3";
 
   src = fetchurl {
     url = "https://wordpress.org/${pname}-${version}.tar.gz";
-    sha256 = "sha256-o9KeTmZXTHtqa/Z2KOo1n6gVCFuna42dFrvf9OBC8v8=";
+    sha256 = "sha256-1OuhoP+QRZrbdThI/npWbOchLR3MnrH7+lFRf5oVPaU=";
   };
 
   installPhase = ''
diff --git a/pkgs/tools/misc/dialog/default.nix b/pkgs/tools/misc/dialog/default.nix
index e295f7c27ac..3cbea01be8a 100644
--- a/pkgs/tools/misc/dialog/default.nix
+++ b/pkgs/tools/misc/dialog/default.nix
@@ -8,7 +8,7 @@
 }:
 
 assert withLibrary -> libtool != null;
-assert unicodeSupport -> ncurses.unicode && ncurses != null;
+assert unicodeSupport -> ncurses.unicodeSupport && ncurses != null;
 
 stdenv.mkDerivation rec {
   pname = "dialog";
diff --git a/pkgs/tools/misc/spigot/default.nix b/pkgs/tools/misc/spigot/default.nix
index a088705036d..b2abec09741 100644
--- a/pkgs/tools/misc/spigot/default.nix
+++ b/pkgs/tools/misc/spigot/default.nix
@@ -1,36 +1,54 @@
 { lib
 , stdenv
-, buildPackages
-, fetchgit
-, autoreconfHook
+, fetchurl
+, cmake
 , gmp
-, ncurses
 , halibut
+, ncurses
 , perl
 }:
 
 stdenv.mkDerivation rec {
   pname = "spigot";
-  version = "20200901";
-  src = fetchgit {
-    url = "https://git.tartarus.org/simon/spigot.git";
-    rev = "9910e5bdc203bae6b7bbe1ed4a93f13755c1cae";
-    sha256 = "1az6v9gk0g2k197lr288nmr9jv20bvgc508vn9ic3v7mav7hf5bf";
+  version = "20210527";
+  srcVersion = "20210527.7dd3cfd";
+
+  src = fetchurl {
+    url = "https://www.chiark.greenend.org.uk/~sgtatham/spigot/${pname}-${srcVersion}.tar.gz";
+    hash = "sha256-EBS3lgfLtsyBQ8mzoJPyZhRBJNmkVSeF5XecGgcvqtw=";
   };
 
-  nativeBuildInputs = [ autoreconfHook halibut perl ];
+  nativeBuildInputs = [
+    cmake
+    halibut
+    perl
+  ];
 
-  configureFlags = [ "--with-gmp" ];
+  buildInputs = [
+    gmp
+    ncurses
+  ];
 
-  buildInputs = [ gmp ncurses ];
+  outputs = [ "out" "man" ];
 
   strictDeps = true;
 
+  doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    [ `$out/bin/spigot -b 10 -d 10 e` == "2.7182818284" ] || exit 1
+    [ `$out/bin/spigot -b 10 -d 10 pi` == "3.1415926535" ] || exit 1
+    [ `$out/bin/spigot -b 10 -d 10 sqrt\(2\)` == "1.4142135623" ] || exit 1
+
+    runHook postInstallCheck
+  '';
+
   meta = with lib; {
-    description = "A command-line exact real calculator";
     homepage = "https://www.chiark.greenend.org.uk/~sgtatham/spigot/";
-    license = lib.licenses.mit;
-    platforms = lib.platforms.all;
-    maintainers = with maintainers; [ mcbeth ];
+    description = "A command-line exact real calculator";
+    license = licenses.mit;
+    maintainers = with maintainers; [ AndersonTorres mcbeth ];
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/tools/security/exploitdb/default.nix b/pkgs/tools/security/exploitdb/default.nix
index a6d5a3855a8..6875c327dcc 100644
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2021-12-21";
+  version = "2022-01-06";
 
   src = fetchFromGitHub {
     owner = "offensive-security";
     repo = pname;
     rev = version;
-    sha256 = "sha256-HTs8dGDSYU/Ih/8CS+4C4AtERxQHwlmpfrA0YrrKoyY=";
+    sha256 = "sha256-SvzrUVuOzqcc4YzBYxuE8S0tFNb2Pr2FEj8KSpuKKGU=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/system/fio/default.nix b/pkgs/tools/system/fio/default.nix
index c15c623f374..859fbe72d63 100644
--- a/pkgs/tools/system/fio/default.nix
+++ b/pkgs/tools/system/fio/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ python3 zlib ]
     ++ lib.optional (!stdenv.isDarwin) libaio;
 
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper python3.pkgs.wrapPython ];
 
   strictDeps = true;
 
@@ -29,9 +29,14 @@ stdenv.mkDerivation rec {
     substituteInPlace tools/plot/fio2gnuplot --replace /usr/share/fio $out/share/fio
   '';
 
-  postInstall = lib.optionalString withGnuplot ''
-    wrapProgram $out/bin/fio2gnuplot \
-      --prefix PATH : ${lib.makeBinPath [ gnuplot ]}
+  pythonPath = [ python3.pkgs.six ];
+
+  makeWrapperArgs = lib.optional withGnuplot [
+    "--prefix PATH : ${lib.makeBinPath [ gnuplot ]}"
+  ];
+
+  postInstall = ''
+    wrapPythonProgramsIn "$out/bin" "$out $pythonPath"
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/system/netdata/default.nix b/pkgs/tools/system/netdata/default.nix
index 3c025247377..1b04abce0e0 100644
--- a/pkgs/tools/system/netdata/default.nix
+++ b/pkgs/tools/system/netdata/default.nix
@@ -16,14 +16,14 @@ with lib;
 let
   go-d-plugin = callPackage ./go.d.plugin.nix {};
 in stdenv.mkDerivation rec {
-  version = "1.31.0";
+  version = "1.32.1";
   pname = "netdata";
 
   src = fetchFromGitHub {
     owner = "netdata";
     repo = "netdata";
     rev = "v${version}";
-    sha256 = "0735cxmljrp8zlkcq7hcxizy4j4xiv7vf782zkz5chn06n38mcik";
+    sha256 = "sha256-DbuR3x7d6synJELOxI+frK4LY9zFgPKmY7hGY8B5z7o=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/tools/system/netdata/go.d.plugin.nix b/pkgs/tools/system/netdata/go.d.plugin.nix
index 53ab6d6982d..edbe39c09f5 100644
--- a/pkgs/tools/system/netdata/go.d.plugin.nix
+++ b/pkgs/tools/system/netdata/go.d.plugin.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "netdata-go.d.plugin";
-  version = "0.28.1";
+  version = "0.31.0";
 
   src = fetchFromGitHub {
     owner = "netdata";
     repo = "go.d.plugin";
     rev = "v${version}";
-    sha256 = "0i77nvqi3dcby0gr3b06bai170q2ibp5390qfjijrk1yqz6x6sd5";
+    sha256 = "sha256-wS8+C03K/qn8zKIAQvZ7nF7CmFfIvKU/dtm80bTeniM=";
   };
 
-  vendorSha256 = "1q8z4smaxzqd5iwvbnkkr33c3b94rjwa3xjirwlr595g0wn93wc7";
+  vendorSha256 = "sha256-17/f6tAxDD5TgjmwnqAlnQSxDhnFidjsN55/sUMDej8=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/system/netdata/no-files-in-etc-and-var.patch b/pkgs/tools/system/netdata/no-files-in-etc-and-var.patch
index 1d0c5cfba58..eb7b4f8bb60 100644
--- a/pkgs/tools/system/netdata/no-files-in-etc-and-var.patch
+++ b/pkgs/tools/system/netdata/no-files-in-etc-and-var.patch
@@ -25,10 +25,10 @@ index 03c7f0a94..01985db01 100644
  
  chartsconfigdir=$(libconfigdir)/charts.d
 diff --git a/collectors/ebpf.plugin/Makefile.am b/collectors/ebpf.plugin/Makefile.am
-index 18b1fc6c8..b4b0c7852 100644
+index 2d5f92a6b..8b11c7502 100644
 --- a/collectors/ebpf.plugin/Makefile.am
 +++ b/collectors/ebpf.plugin/Makefile.am
-@@ -13,7 +13,7 @@ SUFFIXES = .in
+@@ -9,7 +9,7 @@ SUFFIXES = .in
  userebpfconfigdir=$(configdir)/ebpf.d
  
  # Explicitly install directories to avoid permission issues due to umask
@@ -36,7 +36,7 @@ index 18b1fc6c8..b4b0c7852 100644
 +no-install-exec-local:
  	$(INSTALL) -d $(DESTDIR)$(userebpfconfigdir)
  
- dist_plugins_SCRIPTS = \
+ dist_noinst_DATA = \
 diff --git a/collectors/node.d.plugin/Makefile.am b/collectors/node.d.plugin/Makefile.am
 index c3142d433..95e324455 100644
 --- a/collectors/node.d.plugin/Makefile.am
@@ -75,7 +75,7 @@ index 71f2d468d..2c9ced2bf 100644
 +no-install-exec-local:
  	$(INSTALL) -d $(DESTDIR)$(userstatsdconfigdir)
 diff --git a/health/Makefile.am b/health/Makefile.am
-index b963ea0cd..6979e69bf 100644
+index 349b86d61..514f1874f 100644
 --- a/health/Makefile.am
 +++ b/health/Makefile.am
 @@ -19,7 +19,7 @@ dist_userhealthconfig_DATA = \
@@ -88,16 +88,28 @@ index b963ea0cd..6979e69bf 100644
  
  healthconfigdir=$(libconfigdir)/health.d
 diff --git a/system/Makefile.am b/system/Makefile.am
-index 5323738c9..06e1b6a73 100644
+index a88ccab65..bda6ee2b6 100644
 --- a/system/Makefile.am
 +++ b/system/Makefile.am
-@@ -20,11 +20,10 @@ include $(top_srcdir)/build/subst.inc
+@@ -3,7 +3,6 @@
+ 
+ MAINTAINERCLEANFILES = $(srcdir)/Makefile.in
+ CLEANFILES = \
+-    edit-config \
+     netdata-openrc \
+     netdata.logrotate \
+     netdata.service \
+@@ -20,15 +19,13 @@ include $(top_srcdir)/build/subst.inc
  SUFFIXES = .in
  
  dist_config_SCRIPTS = \
 -    edit-config \
      $(NULL)
  
+ dist_config_DATA = \
+-    .install-type \
+     $(NULL)
+ 
  # Explicitly install directories to avoid permission issues due to umask
 -install-exec-local:
 +no-install-exec-local:
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index a5784f3faa9..43ca345f0af 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -13762,6 +13762,7 @@ with pkgs;
   pipewire = callPackage ../development/libraries/pipewire {};
   pipewire-media-session = callPackage ../development/libraries/pipewire/media-session.nix {};
   pipewire_0_2 = callPackage ../development/libraries/pipewire/0.2.nix {};
+  wireplumber = callPackage ../development/libraries/pipewire/wireplumber.nix {};
 
   pyradio = callPackage ../applications/audio/pyradio {};
 
@@ -20936,7 +20937,8 @@ with pkgs;
     gn = gn1924;
   };
 
-  etcd = callPackage ../servers/etcd { };
+  etcd = etcd_3_3;
+  etcd_3_3 = callPackage ../servers/etcd/3.3.nix { };
   etcd_3_4 = callPackage ../servers/etcd/3.4.nix { };
 
   ejabberd = callPackage ../servers/xmpp/ejabberd { };
@@ -23045,6 +23047,7 @@ with pkgs;
     ubootQemuAarch64
     ubootQemuArm
     ubootQemuRiscv64Smode
+    ubootQemuX86
     ubootRaspberryPi
     ubootRaspberryPi2
     ubootRaspberryPi3_32bit
@@ -23447,6 +23450,8 @@ with pkgs;
 
   go-font = callPackage ../data/fonts/go-font { };
 
+  graphite-gtk-theme = callPackage ../data/themes/graphite { };
+
   greybird = callPackage ../data/themes/greybird { };
 
   gruvbox-dark-gtk = callPackage ../data/themes/gruvbox-dark-gtk { };
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index f131cfcb06e..1bccb391084 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -44,6 +44,7 @@ mapAliases ({
   diff_cover = diff-cover; # added 2021-07-02
   discogs_client = discogs-client; # added 2021-07-02
   djangorestframework-jwt = drf-jwt; # added 2021-07-20
+  django_environ = django-environ; # added 2021-12-25
   django_redis = django-redis; # added 2021-10-11
   django_taggit = django-taggit; # added 2021-10-11
   dns = dnspython; # added 2017-12-10
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index fef9e7b6a12..0be7fd20021 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2208,7 +2208,7 @@ in {
 
   django-dynamic-preferences = callPackage ../development/python-modules/django-dynamic-preferences { };
 
-  django_environ = callPackage ../development/python-modules/django_environ { };
+  django-environ = callPackage ../development/python-modules/django_environ { };
 
   django_extensions = callPackage ../development/python-modules/django-extensions { };
 
@@ -3429,6 +3429,8 @@ in {
 
   gpyopt = callPackage ../development/python-modules/gpyopt { };
 
+  gql = callPackage ../development/python-modules/gql { };
+
   gradient = callPackage ../development/python-modules/gradient { };
 
   gradient-utils = callPackage ../development/python-modules/gradient-utils { };