summary refs log tree commit diff
diff options
context:
space:
mode:
authorVladimír Čunát <v@cunat.cz>2022-12-09 10:27:46 +0100
committerVladimír Čunát <v@cunat.cz>2022-12-09 10:27:46 +0100
commit9c497bb8d6015ee01fd78001539d73c3caa42eae (patch)
tree96062a61d173626b1337ecef982421e81ae8d29a
parent1f4a528dc10a88466f5b15198cf3be139b847e7e (diff)
parent63c06ac400aa4d06fee7f32cb2504486862f2ff4 (diff)
downloadnixpkgs-9c497bb8d6015ee01fd78001539d73c3caa42eae.tar
nixpkgs-9c497bb8d6015ee01fd78001539d73c3caa42eae.tar.gz
nixpkgs-9c497bb8d6015ee01fd78001539d73c3caa42eae.tar.bz2
nixpkgs-9c497bb8d6015ee01fd78001539d73c3caa42eae.tar.lz
nixpkgs-9c497bb8d6015ee01fd78001539d73c3caa42eae.tar.xz
nixpkgs-9c497bb8d6015ee01fd78001539d73c3caa42eae.tar.zst
nixpkgs-9c497bb8d6015ee01fd78001539d73c3caa42eae.zip
Merge branch 'staging-next' into staging
-rw-r--r--.mailmap13
-rw-r--r--doc/builders/images/dockertools.section.md4
-rw-r--r--doc/languages-frameworks/cuelang.section.md93
-rw-r--r--doc/languages-frameworks/go.section.md8
-rw-r--r--doc/languages-frameworks/index.xml1
-rw-r--r--lib/default.nix1
-rw-r--r--lib/generators.nix40
-rw-r--r--lib/options.nix21
-rw-r--r--lib/strings.nix65
-rw-r--r--lib/tests/misc.nix20
-rw-r--r--maintainers/maintainer-list.nix6
-rw-r--r--maintainers/scripts/update-luarocks-shell.nix2
-rw-r--r--maintainers/team-list.nix12
-rw-r--r--nixos/doc/manual/from_md/release-notes/rl-2111.section.xml8
-rw-r--r--nixos/doc/manual/from_md/release-notes/rl-2305.section.xml18
-rw-r--r--nixos/doc/manual/release-notes/rl-2111.section.md2
-rw-r--r--nixos/doc/manual/release-notes/rl-2305.section.md7
-rw-r--r--nixos/lib/make-options-doc/default.nix29
-rw-r--r--nixos/lib/make-options-doc/generateAsciiDoc.py37
-rw-r--r--nixos/lib/make-options-doc/generateCommonMark.py27
-rw-r--r--nixos/lib/make-options-doc/generateDoc.py108
-rw-r--r--nixos/lib/make-options-doc/options-to-docbook.xsl82
-rw-r--r--nixos/modules/config/krb5/default.nix4
-rw-r--r--nixos/modules/config/no-x-libs.nix1
-rw-r--r--nixos/modules/installer/tools/nix-fallback-paths.nix10
-rw-r--r--nixos/modules/misc/documentation.nix11
-rw-r--r--nixos/modules/module-list.nix4
-rw-r--r--nixos/modules/programs/bash/blesh.nix16
-rw-r--r--nixos/modules/programs/htop.nix2
-rw-r--r--nixos/modules/programs/weylus.nix2
-rw-r--r--nixos/modules/services/audio/icecast.nix2
-rw-r--r--nixos/modules/services/audio/liquidsoap.nix12
-rw-r--r--nixos/modules/services/audio/mpd.nix2
-rw-r--r--nixos/modules/services/backup/borgbackup.xml2
-rw-r--r--nixos/modules/services/cluster/kubernetes/kubelet.nix4
-rw-r--r--nixos/modules/services/cluster/kubernetes/scheduler.nix2
-rw-r--r--nixos/modules/services/continuous-integration/buildbot/master.nix2
-rw-r--r--nixos/modules/services/databases/cassandra.nix31
-rw-r--r--nixos/modules/services/databases/clickhouse.nix2
-rw-r--r--nixos/modules/services/databases/mysql.nix10
-rw-r--r--nixos/modules/services/databases/openldap.nix2
-rw-r--r--nixos/modules/services/development/jupyter/default.nix2
-rw-r--r--nixos/modules/services/games/asf.nix8
-rw-r--r--nixos/modules/services/games/terraria.nix2
-rw-r--r--nixos/modules/services/hardware/argonone.nix2
-rw-r--r--nixos/modules/services/hardware/bluetooth.nix6
-rw-r--r--nixos/modules/services/hardware/joycond.nix2
-rw-r--r--nixos/modules/services/hardware/supergfxd.nix6
-rw-r--r--nixos/modules/services/home-automation/home-assistant.nix4
-rw-r--r--nixos/modules/services/matrix/conduit.nix3
-rw-r--r--nixos/modules/services/matrix/synapse.nix1
-rw-r--r--nixos/modules/services/misc/autorandr.nix4
-rw-r--r--nixos/modules/services/misc/gitlab.nix4
-rw-r--r--nixos/modules/services/misc/heisenbridge.nix3
-rw-r--r--nixos/modules/services/misc/libreddit.nix9
-rw-r--r--nixos/modules/services/misc/portunus.nix4
-rw-r--r--nixos/modules/services/misc/ripple-data-api.nix6
-rw-r--r--nixos/modules/services/misc/sourcehut/default.nix2
-rw-r--r--nixos/modules/services/monitoring/grafana-agent.nix26
-rw-r--r--nixos/modules/services/monitoring/graphite.nix2
-rw-r--r--nixos/modules/services/monitoring/kapacitor.nix2
-rw-r--r--nixos/modules/services/monitoring/prometheus/alertmanager.nix2
-rw-r--r--nixos/modules/services/monitoring/prometheus/exporters/smartctl.nix32
-rw-r--r--nixos/modules/services/monitoring/uptime-kuma.nix3
-rw-r--r--nixos/modules/services/monitoring/zabbix-proxy.nix2
-rw-r--r--nixos/modules/services/network-filesystems/tahoe.nix6
-rw-r--r--nixos/modules/services/networking/ddclient.nix2
-rw-r--r--nixos/modules/services/networking/dnsmasq.nix86
-rw-r--r--nixos/modules/services/networking/ergochat.nix4
-rw-r--r--nixos/modules/services/networking/morty.nix2
-rw-r--r--nixos/modules/services/networking/multipath.nix2
-rw-r--r--nixos/modules/services/networking/nomad.nix2
-rw-r--r--nixos/modules/services/networking/nsd.nix4
-rw-r--r--nixos/modules/services/networking/nylon.nix2
-rw-r--r--nixos/modules/services/networking/pdns-recursor.nix4
-rw-r--r--nixos/modules/services/networking/redsocks.nix2
-rw-r--r--nixos/modules/services/networking/sabnzbd.nix2
-rw-r--r--nixos/modules/services/networking/twingate.nix28
-rw-r--r--nixos/modules/services/networking/znc/options.nix4
-rw-r--r--nixos/modules/services/printing/ipp-usb.nix63
-rw-r--r--nixos/modules/services/search/elasticsearch-curator.nix2
-rw-r--r--nixos/modules/services/search/elasticsearch.nix2
-rw-r--r--nixos/modules/services/search/meilisearch.nix2
-rw-r--r--nixos/modules/services/security/opensnitch.nix2
-rw-r--r--nixos/modules/services/system/kerberos/mit.nix2
-rw-r--r--nixos/modules/services/web-apps/code-server.nix2
-rw-r--r--nixos/modules/services/web-apps/hedgedoc.nix2
-rw-r--r--nixos/modules/services/web-apps/invidious.nix2
-rw-r--r--nixos/modules/services/web-apps/limesurvey.nix2
-rw-r--r--nixos/modules/services/web-apps/mastodon.nix10
-rw-r--r--nixos/modules/services/web-apps/mattermost.nix4
-rw-r--r--nixos/modules/services/web-apps/moodle.nix2
-rw-r--r--nixos/modules/services/web-apps/onlyoffice.nix2
-rw-r--r--nixos/modules/services/web-apps/peering-manager.nix265
-rw-r--r--nixos/modules/services/web-apps/zabbix.nix4
-rw-r--r--nixos/modules/services/web-servers/lighttpd/default.nix2
-rw-r--r--nixos/modules/services/web-servers/nginx/vhost-options.nix2
-rw-r--r--nixos/modules/services/x11/desktop-managers/cinnamon.nix4
-rw-r--r--nixos/modules/system/activation/test.nix27
-rw-r--r--nixos/modules/system/activation/top-level.nix32
-rw-r--r--nixos/modules/virtualisation/qemu-vm.nix9
-rw-r--r--nixos/tests/all-tests.nix3
-rw-r--r--nixos/tests/bazarr.nix1
-rw-r--r--nixos/tests/dnscrypt-proxy2.nix2
-rw-r--r--nixos/tests/docker-tools.nix14
-rw-r--r--nixos/tests/kerberos/mit.nix2
-rw-r--r--nixos/tests/krb5/example-config.nix2
-rw-r--r--nixos/tests/kubernetes/dns.nix2
-rw-r--r--nixos/tests/prometheus-exporters.nix7
-rw-r--r--nixos/tests/schleuder.nix4
-rw-r--r--nixos/tests/web-apps/peering-manager.nix40
-rw-r--r--pkgs/applications/audio/audacity/default.nix4
-rw-r--r--pkgs/applications/audio/cardinal/default.nix4
-rw-r--r--pkgs/applications/audio/mmtc/default.nix6
-rw-r--r--pkgs/applications/audio/praat/default.nix4
-rw-r--r--pkgs/applications/audio/pt2-clone/default.nix4
-rw-r--r--pkgs/applications/audio/sooperlooper/default.nix4
-rw-r--r--pkgs/applications/audio/soundux/default.nix142
-rw-r--r--pkgs/applications/audio/spek/default.nix4
-rw-r--r--pkgs/applications/backup/deja-dup/default.nix4
-rw-r--r--pkgs/applications/backup/unifi-protect-backup/default.nix8
-rw-r--r--pkgs/applications/blockchains/electrs/default.nix3
-rw-r--r--pkgs/applications/blockchains/ledger-live-desktop/default.nix4
-rw-r--r--pkgs/applications/blockchains/lighthouse/default.nix13
-rw-r--r--pkgs/applications/blockchains/lndhub-go/default.nix6
-rw-r--r--pkgs/applications/blockchains/nearcore/default.nix10
-rw-r--r--pkgs/applications/blockchains/polkadot/default.nix3
-rw-r--r--pkgs/applications/blockchains/snarkos/default.nix4
-rw-r--r--pkgs/applications/blockchains/solana-validator/default.nix7
-rw-r--r--pkgs/applications/blockchains/teos/default.nix9
-rw-r--r--pkgs/applications/editors/emacs/elisp-packages/manual-packages/tsc/default.nix6
-rw-r--r--pkgs/applications/editors/gnome-builder/default.nix4
-rw-r--r--pkgs/applications/editors/helix/default.nix6
-rw-r--r--pkgs/applications/editors/jove/default.nix25
-rw-r--r--pkgs/applications/editors/kakoune/plugins/update-shell.nix2
-rw-r--r--pkgs/applications/editors/neovim/default.nix13
-rw-r--r--pkgs/applications/editors/tiled/default.nix60
-rw-r--r--pkgs/applications/editors/vim/macvim.nix33
-rw-r--r--pkgs/applications/editors/vim/plugins/generated.nix558
-rw-r--r--pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix85
-rw-r--r--pkgs/applications/editors/vim/plugins/update-shell.nix2
-rw-r--r--pkgs/applications/editors/vim/plugins/vim-utils.nix12
-rw-r--r--pkgs/applications/editors/vscode/extensions/default.nix12
-rw-r--r--pkgs/applications/editors/zee/default.nix9
-rw-r--r--pkgs/applications/editors/zee/update-ropey-for-rust-1.65.diff28
-rw-r--r--pkgs/applications/emulators/dolphin-emu/default.nix8
-rw-r--r--pkgs/applications/emulators/dolphin-emu/master.nix4
-rw-r--r--pkgs/applications/emulators/dolphin-emu/primehack.nix4
-rw-r--r--pkgs/applications/emulators/mame/001-use-absolute-paths.diff (renamed from pkgs/applications/emulators/mame/emuopts.patch)16
-rw-r--r--pkgs/applications/emulators/mame/default.nix77
-rw-r--r--pkgs/applications/graphics/ImageMagick/6.x.nix6
-rw-r--r--pkgs/applications/graphics/ImageMagick/default.nix4
-rw-r--r--pkgs/applications/graphics/digikam/default.nix4
-rw-r--r--pkgs/applications/graphics/drawio/default.nix4
-rw-r--r--pkgs/applications/graphics/freecad/default.nix4
-rw-r--r--pkgs/applications/graphics/rnote/default.nix9
-rw-r--r--pkgs/applications/misc/1password/default.nix10
-rw-r--r--pkgs/applications/misc/authenticator/default.nix4
-rw-r--r--pkgs/applications/misc/clipcat/default.nix5
-rw-r--r--pkgs/applications/misc/hugo/default.nix6
-rw-r--r--pkgs/applications/misc/imag/default.nix4
-rw-r--r--pkgs/applications/misc/latte-dock/default.nix2
-rw-r--r--pkgs/applications/misc/lenmus/default.nix4
-rw-r--r--pkgs/applications/misc/lutris/fhsenv.nix2
-rw-r--r--pkgs/applications/misc/mediainfo-gui/default.nix4
-rw-r--r--pkgs/applications/misc/openrgb/default.nix4
-rw-r--r--pkgs/applications/misc/oxker/default.nix6
-rw-r--r--pkgs/applications/misc/pwsafe/default.nix4
-rw-r--r--pkgs/applications/misc/tippecanoe/default.nix4
-rw-r--r--pkgs/applications/misc/tut/default.nix6
-rw-r--r--pkgs/applications/misc/xplr/default.nix6
-rw-r--r--pkgs/applications/networking/browsers/chromium/upstream-info.json14
-rw-r--r--pkgs/applications/networking/browsers/dillo/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/dillong/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/offpunk/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/vivaldi/default.nix7
-rw-r--r--pkgs/applications/networking/cluster/argocd/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/kyverno/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/ssm-agent/default.nix7
-rw-r--r--pkgs/applications/networking/cluster/terraform-compliance/default.nix58
-rw-r--r--pkgs/applications/networking/cluster/terraform-providers/providers.json122
-rw-r--r--pkgs/applications/networking/cluster/terragrunt/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/velero/default.nix6
-rw-r--r--pkgs/applications/networking/flexget/default.nix4
-rw-r--r--pkgs/applications/networking/ftp/filezilla/default.nix7
-rw-r--r--pkgs/applications/networking/instant-messengers/signal-desktop/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/slack/default.nix12
-rw-r--r--pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix91
-rw-r--r--pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix4
-rw-r--r--pkgs/applications/networking/irc/senpai/default.nix8
-rw-r--r--pkgs/applications/networking/mailreaders/evolution/evolution-ews/default.nix4
-rw-r--r--pkgs/applications/networking/mailreaders/evolution/evolution/default.nix4
-rw-r--r--pkgs/applications/networking/remote/freerdp/default.nix2
-rw-r--r--pkgs/applications/networking/sniffers/kismet/default.nix24
-rw-r--r--pkgs/applications/networking/soulseek/nicotine-plus/default.nix4
-rw-r--r--pkgs/applications/networking/syncthing/default.nix6
-rw-r--r--pkgs/applications/networking/twingate/default.nix51
-rw-r--r--pkgs/applications/networking/yaup/default.nix47
-rw-r--r--pkgs/applications/office/libreoffice/default.nix4
-rw-r--r--pkgs/applications/office/portfolio/default.nix4
-rw-r--r--pkgs/applications/office/trilium/default.nix11
-rw-r--r--pkgs/applications/office/zk/default.nix4
-rw-r--r--pkgs/applications/radio/chirp/default.nix37
-rw-r--r--pkgs/applications/radio/freedv/default.nix4
-rw-r--r--pkgs/applications/science/astronomy/phd2/default.nix4
-rw-r--r--pkgs/applications/science/biology/ecopcr/default.nix14
-rw-r--r--pkgs/applications/science/logic/isabelle/default.nix39
-rwxr-xr-xpkgs/applications/science/machine-learning/streamlit/default.nix20
-rw-r--r--pkgs/applications/science/misc/snakemake/default.nix2
-rw-r--r--pkgs/applications/version-management/git-and-tools/git-annex-remote-googledrive/default.nix21
-rw-r--r--pkgs/applications/version-management/git-and-tools/git-privacy/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/git-repo-updater/default.nix16
-rw-r--r--pkgs/applications/version-management/git-and-tools/git-up/default.nix16
-rw-r--r--pkgs/applications/version-management/git-and-tools/gitmux/default.nix35
-rw-r--r--pkgs/applications/version-management/git-and-tools/glab/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/lefthook/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/legit/default.nix7
-rw-r--r--pkgs/applications/version-management/jujutsu/default.nix6
-rw-r--r--pkgs/applications/version-management/rapidsvn/default.nix4
-rw-r--r--pkgs/applications/version-management/tailor/default.nix40
-rw-r--r--pkgs/applications/video/dvdstyler/default.nix4
-rw-r--r--pkgs/applications/video/mpv/default.nix77
-rw-r--r--pkgs/applications/virtualization/containerd/default.nix4
-rw-r--r--pkgs/applications/virtualization/docker/default.nix2
-rw-r--r--pkgs/applications/virtualization/pods/default.nix8
-rw-r--r--pkgs/applications/window-managers/icewm/default.nix4
-rw-r--r--pkgs/build-support/docker/default.nix16
-rw-r--r--pkgs/build-support/docker/examples.nix17
-rw-r--r--pkgs/build-support/mkshell/default.nix15
-rw-r--r--pkgs/build-support/rust/build-rust-crate/configure-crate.nix5
-rw-r--r--pkgs/build-support/rust/build-rust-crate/lib.sh6
-rw-r--r--pkgs/data/fonts/amiri/default.nix5
-rw-r--r--pkgs/data/fonts/carlito/default.nix21
-rw-r--r--pkgs/data/fonts/lexend/default.nix10
-rw-r--r--pkgs/data/fonts/material-design-icons/default.nix18
-rw-r--r--pkgs/data/icons/simp1e-cursors/default.nix42
-rw-r--r--pkgs/data/misc/v2ray-geoip/default.nix6
-rw-r--r--pkgs/desktops/cinnamon/mint-artwork/default.nix6
-rw-r--r--pkgs/desktops/gnome/apps/gedit/default.nix4
-rw-r--r--pkgs/desktops/gnome/apps/gnome-characters/default.nix4
-rw-r--r--pkgs/desktops/gnome/apps/gnome-maps/default.nix4
-rw-r--r--pkgs/desktops/gnome/core/evolution-data-server/default.nix4
-rw-r--r--pkgs/desktops/gnome/core/evolution-data-server/hardcode-gsettings.patch4
-rw-r--r--pkgs/desktops/gnome/core/gnome-initial-setup/default.nix4
-rw-r--r--pkgs/desktops/gnome/core/gnome-remote-desktop/default.nix4
-rw-r--r--pkgs/desktops/gnome/core/gnome-shell/default.nix4
-rw-r--r--pkgs/desktops/gnome/core/gnome-software/default.nix4
-rw-r--r--pkgs/desktops/gnome/core/gucharmap/default.nix8
-rw-r--r--pkgs/desktops/gnome/core/mutter/default.nix11
-rw-r--r--pkgs/desktops/gnome/core/nautilus/default.nix16
-rw-r--r--pkgs/desktops/pantheon/apps/elementary-calculator/default.nix4
-rw-r--r--pkgs/desktops/pantheon/apps/elementary-camera/default.nix4
-rw-r--r--pkgs/desktops/pantheon/apps/elementary-feedback/default.nix4
-rw-r--r--pkgs/desktops/pantheon/apps/elementary-feedback/fix-metadata-path.patch27
-rw-r--r--pkgs/development/androidndk-pkgs/androidndk-pkgs.nix19
-rw-r--r--pkgs/development/compilers/chicken/4/chicken.nix1
-rw-r--r--pkgs/development/compilers/cmdstan/default.nix33
-rw-r--r--pkgs/development/compilers/go/1.18.nix4
-rw-r--r--pkgs/development/compilers/haxe/default.nix4
-rw-r--r--pkgs/development/compilers/julia/1.8.nix4
-rw-r--r--pkgs/development/compilers/neko/default.nix4
-rw-r--r--pkgs/development/compilers/openjdk/11.nix3
-rw-r--r--pkgs/development/compilers/openjdk/12.nix3
-rw-r--r--pkgs/development/compilers/openjdk/13.nix3
-rw-r--r--pkgs/development/compilers/openjdk/14.nix3
-rw-r--r--pkgs/development/compilers/openjdk/openjfx/11.nix37
-rw-r--r--pkgs/development/compilers/openjdk/openjfx/15.nix3
-rw-r--r--pkgs/development/embedded/jtag-remote-server/default.nix6
-rw-r--r--pkgs/development/embedded/nmrpflash/default.nix4
-rw-r--r--pkgs/development/interpreters/hashlink/default.nix4
-rw-r--r--pkgs/development/interpreters/php/8.2.nix10
-rw-r--r--pkgs/development/interpreters/python/cpython/default.nix10
-rw-r--r--pkgs/development/interpreters/python/default.nix12
-rw-r--r--pkgs/development/interpreters/wasmtime/default.nix6
-rw-r--r--pkgs/development/libraries/amtk/default.nix4
-rw-r--r--pkgs/development/libraries/arrow-cpp/default.nix3
-rw-r--r--pkgs/development/libraries/audio/suil/default.nix12
-rw-r--r--pkgs/development/libraries/aws-c-s3/default.nix4
-rw-r--r--pkgs/development/libraries/bctoolbox/default.nix4
-rw-r--r--pkgs/development/libraries/belle-sip/default.nix4
-rw-r--r--pkgs/development/libraries/fancypp/default.nix31
-rw-r--r--pkgs/development/libraries/fox/clang.patch13
-rw-r--r--pkgs/development/libraries/fox/default.nix18
-rw-r--r--pkgs/development/libraries/google-cloud-cpp/default.nix21
-rw-r--r--pkgs/development/libraries/google-cloud-cpp/skipped_tests.toml8
-rw-r--r--pkgs/development/libraries/grpc/default.nix36
-rw-r--r--pkgs/development/libraries/gssdp/1.6.nix6
-rw-r--r--pkgs/development/libraries/gtk-frdp/default.nix2
-rw-r--r--pkgs/development/libraries/gupnp/1.6.nix4
-rw-r--r--pkgs/development/libraries/httplib/default.nix31
-rw-r--r--pkgs/development/libraries/liblouis/default.nix4
-rw-r--r--pkgs/development/libraries/libnfs/default.nix19
-rw-r--r--pkgs/development/libraries/libplctag/default.nix4
-rw-r--r--pkgs/development/libraries/libredwg/default.nix33
-rw-r--r--pkgs/development/libraries/libshumate/default.nix4
-rw-r--r--pkgs/development/libraries/mbedtls/2.nix6
-rw-r--r--pkgs/development/libraries/mbedtls/3.nix6
-rw-r--r--pkgs/development/libraries/mbedtls/generic.nix (renamed from pkgs/development/libraries/mbedtls/default.nix)20
-rw-r--r--pkgs/development/libraries/mdds/default.nix17
-rw-r--r--pkgs/development/libraries/mm-common/default.nix4
-rw-r--r--pkgs/development/libraries/mysocketw/default.nix6
-rw-r--r--pkgs/development/libraries/ntirpc/default.nix4
-rw-r--r--pkgs/development/libraries/ogre/default.nix127
-rw-r--r--pkgs/development/libraries/openscenegraph/default.nix4
-rw-r--r--pkgs/development/libraries/openssl/default.nix22
-rw-r--r--pkgs/development/libraries/proj/default.nix4
-rw-r--r--pkgs/development/libraries/qt-6/modules/qtbase.nix2
-rw-r--r--pkgs/development/libraries/qt-6/modules/qtwayland.nix3
-rw-r--r--pkgs/development/libraries/s2n-tls/default.nix4
-rw-r--r--pkgs/development/libraries/semver-cpp/default.nix31
-rw-r--r--pkgs/development/libraries/smokegen/default.nix20
-rw-r--r--pkgs/development/libraries/smokeqt/default.nix18
-rw-r--r--pkgs/development/libraries/tracker-miners/default.nix4
-rw-r--r--pkgs/development/libraries/vapoursynth/default.nix4
-rw-r--r--pkgs/development/libraries/vte/default.nix4
-rw-r--r--pkgs/development/libraries/wolfssl/default.nix2
-rw-r--r--pkgs/development/libraries/wxwidgets/wxGTK30.nix10
-rw-r--r--pkgs/development/libraries/xdg-desktop-portal-gtk/default.nix4
-rw-r--r--pkgs/development/libraries/yojimbo/default.nix4
-rw-r--r--pkgs/development/mobile/androidenv/compose-android-packages.nix6
-rw-r--r--pkgs/development/node-packages/overrides.nix4
-rw-r--r--pkgs/development/ocaml-modules/camlzip/default.nix21
-rw-r--r--pkgs/development/ocaml-modules/gen_js_api/default.nix1
-rw-r--r--pkgs/development/ocaml-modules/gen_js_api/ojs.nix1
-rw-r--r--pkgs/development/ocaml-modules/janestreet/0.14.nix4
-rw-r--r--pkgs/development/ocaml-modules/janestreet/0.15.nix14
-rw-r--r--pkgs/development/ocaml-modules/lambda-term/default.nix2
-rw-r--r--pkgs/development/ocaml-modules/ocsigen-toolkit/default.nix6
-rw-r--r--pkgs/development/python-modules/GitPython/hardcode-git-path.patch13
-rw-r--r--pkgs/development/python-modules/ailment/default.nix4
-rw-r--r--pkgs/development/python-modules/aiogithubapi/default.nix7
-rw-r--r--pkgs/development/python-modules/aiohomekit/default.nix4
-rw-r--r--pkgs/development/python-modules/aioshelly/default.nix10
-rw-r--r--pkgs/development/python-modules/aiosmb/default.nix5
-rw-r--r--pkgs/development/python-modules/aioswitcher/default.nix5
-rw-r--r--pkgs/development/python-modules/aiounifi/default.nix4
-rw-r--r--pkgs/development/python-modules/angr/default.nix8
-rw-r--r--pkgs/development/python-modules/apache-airflow/default.nix4
-rw-r--r--pkgs/development/python-modules/archinfo/default.nix4
-rw-r--r--pkgs/development/python-modules/asysocks/default.nix5
-rw-r--r--pkgs/development/python-modules/azure-storage-queue/default.nix7
-rw-r--r--pkgs/development/python-modules/bandit/default.nix41
-rw-r--r--pkgs/development/python-modules/bellows/default.nix4
-rw-r--r--pkgs/development/python-modules/bleak-retry-connector/default.nix6
-rw-r--r--pkgs/development/python-modules/bluetooth-adapters/default.nix10
-rw-r--r--pkgs/development/python-modules/bluetooth-auto-recovery/default.nix4
-rw-r--r--pkgs/development/python-modules/btrfsutil/default.nix26
-rw-r--r--pkgs/development/python-modules/bundlewrap/default.nix2
-rw-r--r--pkgs/development/python-modules/cccolutils/default.nix42
-rw-r--r--pkgs/development/python-modules/chat-downloader/default.nix4
-rw-r--r--pkgs/development/python-modules/claripy/default.nix4
-rw-r--r--pkgs/development/python-modules/cle/default.nix4
-rw-r--r--pkgs/development/python-modules/cryptolyzer/default.nix26
-rw-r--r--pkgs/development/python-modules/cryptoparser/default.nix11
-rw-r--r--pkgs/development/python-modules/cvelib/default.nix4
-rw-r--r--pkgs/development/python-modules/dateparser/default.nix4
-rw-r--r--pkgs/development/python-modules/db-dtypes/default.nix5
-rw-r--r--pkgs/development/python-modules/django/4.nix5
-rw-r--r--pkgs/development/python-modules/docstring-to-markdown/default.nix11
-rw-r--r--pkgs/development/python-modules/flake8-bugbear/default.nix4
-rw-r--r--pkgs/development/python-modules/furo/default.nix5
-rw-r--r--pkgs/development/python-modules/gamble/default.nix9
-rw-r--r--pkgs/development/python-modules/gcal-sync/default.nix4
-rw-r--r--pkgs/development/python-modules/git-sweep/default.nix19
-rw-r--r--pkgs/development/python-modules/gitpython/default.nix (renamed from pkgs/development/python-modules/GitPython/default.nix)31
-rw-r--r--pkgs/development/python-modules/google-cloud-bigtable/default.nix5
-rw-r--r--pkgs/development/python-modules/google-cloud-logging/default.nix5
-rw-r--r--pkgs/development/python-modules/google-cloud-spanner/default.nix5
-rw-r--r--pkgs/development/python-modules/greeclimate/default.nix4
-rw-r--r--pkgs/development/python-modules/gsd/default.nix5
-rw-r--r--pkgs/development/python-modules/gspread/default.nix5
-rw-r--r--pkgs/development/python-modules/gssapi/default.nix6
-rw-r--r--pkgs/development/python-modules/hass-nabucasa/default.nix5
-rw-r--r--pkgs/development/python-modules/home-assistant-bluetooth/default.nix8
-rw-r--r--pkgs/development/python-modules/homematicip/default.nix4
-rw-r--r--pkgs/development/python-modules/ical/default.nix4
-rw-r--r--pkgs/development/python-modules/intellifire4py/default.nix7
-rw-r--r--pkgs/development/python-modules/json-schema-for-humans/default.nix7
-rw-r--r--pkgs/development/python-modules/jupyterlab_server/default.nix2
-rw-r--r--pkgs/development/python-modules/jupytext/default.nix6
-rw-r--r--pkgs/development/python-modules/k5test/default.nix6
-rw-r--r--pkgs/development/python-modules/k5test/fix-paths.patch36
-rw-r--r--pkgs/development/python-modules/knack/default.nix13
-rw-r--r--pkgs/development/python-modules/losant-rest/default.nix4
-rw-r--r--pkgs/development/python-modules/mac-vendor-lookup/default.nix4
-rw-r--r--pkgs/development/python-modules/mathlibtools/default.nix4
-rw-r--r--pkgs/development/python-modules/metakernel/default.nix6
-rw-r--r--pkgs/development/python-modules/mitmproxy/default.nix29
-rw-r--r--pkgs/development/python-modules/mlflow/default.nix5
-rw-r--r--pkgs/development/python-modules/mypy-boto3-builder/default.nix4
-rw-r--r--pkgs/development/python-modules/mypy-boto3-s3/default.nix8
-rw-r--r--pkgs/development/python-modules/nbdime/default.nix20
-rw-r--r--pkgs/development/python-modules/nettigo-air-monitor/default.nix8
-rw-r--r--pkgs/development/python-modules/nextdns/default.nix5
-rw-r--r--pkgs/development/python-modules/opentimestamps/default.nix5
-rw-r--r--pkgs/development/python-modules/passlib/default.nix6
-rw-r--r--pkgs/development/python-modules/pip-requirements-parser/default.nix5
-rw-r--r--pkgs/development/python-modules/pontos/default.nix4
-rw-r--r--pkgs/development/python-modules/protobuf/default.nix2
-rw-r--r--pkgs/development/python-modules/psrpcore/default.nix7
-rw-r--r--pkgs/development/python-modules/ptpython/default.nix4
-rw-r--r--pkgs/development/python-modules/pulumi-aws/default.nix4
-rw-r--r--pkgs/development/python-modules/py-desmume/default.nix56
-rw-r--r--pkgs/development/python-modules/pycryptodome/default.nix8
-rw-r--r--pkgs/development/python-modules/pylint/default.nix4
-rw-r--r--pkgs/development/python-modules/pyrainbird/default.nix7
-rw-r--r--pkgs/development/python-modules/pyrisco/default.nix13
-rw-r--r--pkgs/development/python-modules/pyshark/default.nix2
-rw-r--r--pkgs/development/python-modules/pytest-random-order/default.nix4
-rw-r--r--pkgs/development/python-modules/python-arango/default.nix138
-rw-r--r--pkgs/development/python-modules/python-glanceclient/default.nix4
-rw-r--r--pkgs/development/python-modules/python-lsp-server/default.nix2
-rw-r--r--pkgs/development/python-modules/python-manilaclient/default.nix5
-rw-r--r--pkgs/development/python-modules/python-novaclient/default.nix4
-rw-r--r--pkgs/development/python-modules/pytibber/default.nix4
-rw-r--r--pkgs/development/python-modules/pyunifiprotect/default.nix4
-rw-r--r--pkgs/development/python-modules/pyvesync/default.nix5
-rw-r--r--pkgs/development/python-modules/pyvex/default.nix4
-rw-r--r--pkgs/development/python-modules/qcengine/default.nix4
-rw-r--r--pkgs/development/python-modules/rich-click/default.nix18
-rw-r--r--pkgs/development/python-modules/rstcheck-core/default.nix13
-rw-r--r--pkgs/development/python-modules/rstcheck/default.nix13
-rw-r--r--pkgs/development/python-modules/ruuvitag-ble/default.nix57
-rw-r--r--pkgs/development/python-modules/scmrepo/default.nix4
-rw-r--r--pkgs/development/python-modules/sense-energy/default.nix8
-rw-r--r--pkgs/development/python-modules/simplisafe-python/default.nix4
-rw-r--r--pkgs/development/python-modules/strenum/default.nix7
-rw-r--r--pkgs/development/python-modules/stytra/default.nix71
-rw-r--r--pkgs/development/python-modules/subarulink/default.nix7
-rw-r--r--pkgs/development/python-modules/tern/default.nix29
-rw-r--r--pkgs/development/python-modules/tilequant/default.nix33
-rw-r--r--pkgs/development/python-modules/versionfinder/default.nix5
-rw-r--r--pkgs/development/python-modules/wandb/default.nix4
-rw-r--r--pkgs/development/python-modules/wxPython/4.0.nix5
-rw-r--r--pkgs/development/python-modules/xiaomi-ble/default.nix7
-rw-r--r--pkgs/development/python-modules/xknx/default.nix4
-rw-r--r--pkgs/development/python-modules/zamg/default.nix5
-rw-r--r--pkgs/development/python-modules/zha-quirks/default.nix4
-rw-r--r--pkgs/development/python-modules/zigpy-deconz/default.nix4
-rw-r--r--pkgs/development/python-modules/zigpy-znp/default.nix4
-rw-r--r--pkgs/development/python-modules/zigpy/default.nix4
-rw-r--r--pkgs/development/python-modules/zwave-js-server-python/default.nix4
-rw-r--r--pkgs/development/python2-modules/TurboCheetah/default.nix26
-rw-r--r--pkgs/development/python2-modules/cheetah/default.nix33
-rw-r--r--pkgs/development/python2-modules/construct/default.nix39
-rw-r--r--pkgs/development/python2-modules/httpretty/default.nix52
-rw-r--r--pkgs/development/python2-modules/markdown/default.nix33
-rw-r--r--pkgs/development/python2-modules/mutagen/default.nix34
-rw-r--r--pkgs/development/python2-modules/numpy/default.nix99
-rw-r--r--pkgs/development/python2-modules/numpy/numpy-distutils-C++.patch30
-rw-r--r--pkgs/development/python2-modules/pillow/default.nix47
-rw-r--r--pkgs/development/python2-modules/pillow/generic.nix77
-rw-r--r--pkgs/development/python2-modules/prettytable/default.nix37
-rw-r--r--pkgs/development/python2-modules/pyyaml/default.nix38
-rw-r--r--pkgs/development/python2-modules/qpid-python/default.nix26
-rw-r--r--pkgs/development/r-modules/default.nix6
-rw-r--r--pkgs/development/tools/agda-pkg/default.nix6
-rw-r--r--pkgs/development/tools/analysis/checkov/default.nix2
-rw-r--r--pkgs/development/tools/analysis/cvehound/default.nix2
-rw-r--r--pkgs/development/tools/analysis/smatch/default.nix6
-rw-r--r--pkgs/development/tools/ansible-language-server/default.nix3
-rw-r--r--pkgs/development/tools/bbin/default.nix44
-rw-r--r--pkgs/development/tools/build-managers/muon/default.nix13
-rw-r--r--pkgs/development/tools/buildpack/default.nix6
-rw-r--r--pkgs/development/tools/castxml/default.nix4
-rw-r--r--pkgs/development/tools/coder/default.nix10
-rw-r--r--pkgs/development/tools/continuous-integration/github-runner/default.nix8
-rw-r--r--pkgs/development/tools/cue/validator.nix17
-rw-r--r--pkgs/development/tools/ddosify/default.nix4
-rw-r--r--pkgs/development/tools/esbuild/default.nix4
-rw-r--r--pkgs/development/tools/fdroidserver/default.nix18
-rw-r--r--pkgs/development/tools/fnm/default.nix6
-rw-r--r--pkgs/development/tools/go-mockery/default.nix4
-rw-r--r--pkgs/development/tools/go-task/default.nix4
-rw-r--r--pkgs/development/tools/godot/4/default.nix2
-rw-r--r--pkgs/development/tools/hcloud/default.nix4
-rw-r--r--pkgs/development/tools/misc/circleci-cli/default.nix4
-rw-r--r--pkgs/development/tools/misc/svls/default.nix6
-rw-r--r--pkgs/development/tools/misc/terraform-ls/default.nix6
-rw-r--r--pkgs/development/tools/ocaml/js_of_ocaml/compiler.nix6
-rw-r--r--pkgs/development/tools/ocaml/js_of_ocaml/default.nix3
-rw-r--r--pkgs/development/tools/ocaml/js_of_ocaml/lwt.nix3
-rw-r--r--pkgs/development/tools/ocaml/js_of_ocaml/ppx.nix3
-rw-r--r--pkgs/development/tools/ocaml/js_of_ocaml/ppx_deriving_json.nix3
-rw-r--r--pkgs/development/tools/open-policy-agent/default.nix4
-rw-r--r--pkgs/development/tools/pip-audit/default.nix4
-rw-r--r--pkgs/development/tools/poetry2nix/poetry2nix/default.nix12
-rw-r--r--pkgs/development/tools/poetry2nix/poetry2nix/overrides/build-systems.json96
-rw-r--r--pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix20
-rw-r--r--pkgs/development/tools/protoc-gen-validate/default.nix6
-rw-r--r--pkgs/development/tools/refurb/default.nix6
-rw-r--r--pkgs/development/tools/ruff/default.nix6
-rw-r--r--pkgs/development/tools/rust/cargo-about/default.nix6
-rw-r--r--pkgs/development/tools/rust/cargo-about/zstd-pkg-config.patch21
-rw-r--r--pkgs/development/tools/rust/cargo-modules/default.nix21
-rw-r--r--pkgs/development/tools/rust/cargo-public-api/default.nix6
-rw-r--r--pkgs/development/tools/rust/cargo-update/default.nix6
-rw-r--r--pkgs/development/tools/rust/rust-analyzer/default.nix6
-rw-r--r--pkgs/development/tools/rust/sqlx-cli/default.nix24
-rw-r--r--pkgs/development/tools/selene/default.nix6
-rw-r--r--pkgs/development/tools/stylua/default.nix6
-rw-r--r--pkgs/development/tools/tarmac/default.nix45
-rw-r--r--pkgs/development/tools/wxformbuilder/default.nix1
-rw-r--r--pkgs/development/tools/ytt/default.nix4
-rw-r--r--pkgs/games/btanks/default.nix26
-rw-r--r--pkgs/games/heroic/fhsenv.nix10
-rw-r--r--pkgs/games/megaglest/default.nix6
-rw-r--r--pkgs/games/opendungeons/default.nix5
-rw-r--r--pkgs/games/portmod/default.nix35
-rw-r--r--pkgs/games/quakespasm/vulkan.nix4
-rw-r--r--pkgs/games/rigsofrods/default.nix4
-rw-r--r--pkgs/games/tennix/default.nix21
-rw-r--r--pkgs/os-specific/linux/intel-compute-runtime/default.nix4
-rw-r--r--pkgs/os-specific/linux/ipp-usb/default.nix42
-rw-r--r--pkgs/os-specific/linux/kernel/common-config.nix5
-rw-r--r--pkgs/os-specific/linux/kernel/hardened/config.nix20
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.14.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.19.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-5.10.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-5.15.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-5.4.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-6.0.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-testing.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/manual-config.nix9
-rw-r--r--pkgs/os-specific/linux/systemd/default.nix21
-rw-r--r--pkgs/os-specific/linux/wireguard/default.nix2
-rw-r--r--pkgs/servers/bazarr/default.nix4
-rw-r--r--pkgs/servers/dns/knot-dns/default.nix6
-rw-r--r--pkgs/servers/home-assistant/component-packages.nix365
-rw-r--r--pkgs/servers/home-assistant/default.nix80
-rw-r--r--pkgs/servers/home-assistant/frontend.nix4
-rw-r--r--pkgs/servers/home-assistant/tests.nix8
-rw-r--r--pkgs/servers/home-automation/evcc/default.nix8
-rw-r--r--pkgs/servers/http/dufs/default.nix5
-rw-r--r--pkgs/servers/http/hiawatha/default.nix4
-rw-r--r--pkgs/servers/invidious/versions.json6
-rw-r--r--pkgs/servers/klipper/klipper-firmware.nix4
-rw-r--r--pkgs/servers/libreddit/default.nix2
-rw-r--r--pkgs/servers/matrix-synapse/default.nix6
-rw-r--r--pkgs/servers/monitoring/do-agent/default.nix4
-rw-r--r--pkgs/servers/monitoring/nagios/plugins/check_ssl_cert.nix4
-rw-r--r--pkgs/servers/monitoring/prometheus/smartctl-exporter/default.nix29
-rw-r--r--pkgs/servers/monitoring/sensu-go/default.nix4
-rw-r--r--pkgs/servers/monitoring/telegraf/default.nix6
-rw-r--r--pkgs/servers/monitoring/uptime-kuma/default.nix6
-rw-r--r--pkgs/servers/nfs-ganesha/default.nix10
-rw-r--r--pkgs/servers/nosql/cassandra/4.json4
-rw-r--r--pkgs/servers/nosql/cassandra/4.nix8
-rw-r--r--pkgs/servers/nosql/ferretdb/default.nix6
-rw-r--r--pkgs/servers/nosql/mongodb/mongodb.nix4
-rw-r--r--pkgs/servers/openafs/1.8/default.nix6
-rw-r--r--pkgs/servers/photoprism/default.nix2
-rw-r--r--pkgs/servers/pocketbase/default.nix6
-rw-r--r--pkgs/servers/pulseaudio/default.nix4
-rw-r--r--pkgs/servers/search/elasticsearch/6.x.nix2
-rw-r--r--pkgs/servers/search/zinc/default.nix56
-rw-r--r--pkgs/servers/snappymail/default.nix4
-rw-r--r--pkgs/servers/tailscale/default.nix6
-rw-r--r--pkgs/servers/traefik/default.nix6
-rw-r--r--pkgs/servers/web-apps/invoiceplane/default.nix4
-rw-r--r--pkgs/servers/web-apps/peering-manager/default.nix100
-rw-r--r--pkgs/servers/web-apps/peering-manager/redis-unix-sock.patch47
-rw-r--r--pkgs/shells/bash/blesh/default.nix53
-rw-r--r--pkgs/shells/nushell/default.nix6
-rw-r--r--pkgs/shells/zsh/default.nix2
-rw-r--r--pkgs/test/cue/default.nix24
-rw-r--r--pkgs/test/default.nix2
-rw-r--r--pkgs/tools/X11/bumblebee/default.nix8
-rw-r--r--pkgs/tools/admin/awscli2/default.nix3
-rw-r--r--pkgs/tools/admin/scaleway-cli/default.nix6
-rw-r--r--pkgs/tools/admin/syft/default.nix6
-rw-r--r--pkgs/tools/backup/dar/default.nix4
-rw-r--r--pkgs/tools/backup/ugarit-manifest-maker/default.nix1
-rw-r--r--pkgs/tools/backup/ugarit/default.nix1
-rw-r--r--pkgs/tools/cd-dvd/ventoy-bin/default.nix14
-rw-r--r--pkgs/tools/filesystems/btrfs-progs/default.nix16
-rw-r--r--pkgs/tools/filesystems/dislocker/default.nix4
-rw-r--r--pkgs/tools/filesystems/stratisd/default.nix6
-rw-r--r--pkgs/tools/graphics/oxipng/default.nix6
-rw-r--r--pkgs/tools/graphics/zbar/default.nix5
-rw-r--r--pkgs/tools/misc/fd/default.nix5
-rw-r--r--pkgs/tools/misc/flexoptix-app/default.nix4
-rw-r--r--pkgs/tools/misc/hexyl/default.nix12
-rw-r--r--pkgs/tools/misc/lemmy-help/default.nix8
-rw-r--r--pkgs/tools/misc/mcfly/default.nix2
-rw-r--r--pkgs/tools/misc/opentimestamps-client/default.nix31
-rw-r--r--pkgs/tools/misc/opentsdb/default.nix4
-rw-r--r--pkgs/tools/misc/page/default.nix6
-rw-r--r--pkgs/tools/misc/plocate/default.nix14
-rw-r--r--pkgs/tools/misc/pmbootstrap/default.nix11
-rw-r--r--pkgs/tools/misc/popsicle/default.nix69
-rw-r--r--pkgs/tools/misc/pspg/default.nix4
-rw-r--r--pkgs/tools/misc/tbls/default.nix4
-rw-r--r--pkgs/tools/misc/tio/default.nix4
-rw-r--r--pkgs/tools/misc/topgrade/default.nix6
-rw-r--r--pkgs/tools/misc/tz/default.nix6
-rw-r--r--pkgs/tools/misc/wwcd/default.nix3
-rw-r--r--pkgs/tools/networking/aardvark-dns/default.nix6
-rw-r--r--pkgs/tools/networking/clash/default.nix6
-rw-r--r--pkgs/tools/networking/croc/default.nix6
-rw-r--r--pkgs/tools/networking/httplz/default.nix10
-rw-r--r--pkgs/tools/networking/linkchecker/default.nix57
-rw-r--r--pkgs/tools/networking/mu/default.nix4
-rw-r--r--pkgs/tools/networking/netavark/default.nix10
-rw-r--r--pkgs/tools/networking/netbird/default.nix4
-rw-r--r--pkgs/tools/networking/networkmanager/libnma/default.nix8
-rw-r--r--pkgs/tools/networking/p2p/amule/default.nix4
-rw-r--r--pkgs/tools/networking/shadowsocks-libev/default.nix4
-rw-r--r--pkgs/tools/package-management/nix/default.nix10
-rw-r--r--pkgs/tools/security/clairvoyance/default.nix6
-rw-r--r--pkgs/tools/security/crowdsec/default.nix4
-rw-r--r--pkgs/tools/security/nuclei/default.nix7
-rw-r--r--pkgs/tools/security/pinentry/default.nix35
-rw-r--r--pkgs/tools/security/teler/default.nix11
-rw-r--r--pkgs/tools/security/tpm2-tools/default.nix4
-rw-r--r--pkgs/tools/security/trufflehog/default.nix17
-rw-r--r--pkgs/tools/security/uncover/default.nix7
-rw-r--r--pkgs/tools/security/vaultwarden/vault.nix4
-rw-r--r--pkgs/tools/system/automatic-timezoned/default.nix6
-rw-r--r--pkgs/tools/system/plan9port/default.nix8
-rw-r--r--pkgs/tools/text/d2/default.nix12
-rw-r--r--pkgs/tools/text/poedit/default.nix4
-rw-r--r--pkgs/tools/text/transifex-client/default.nix15
-rw-r--r--pkgs/tools/wayland/slurp/default.nix27
-rw-r--r--pkgs/tools/wayland/waynergy/default.nix6
-rw-r--r--pkgs/top-level/aliases.nix4
-rw-r--r--pkgs/top-level/all-packages.nix136
-rw-r--r--pkgs/top-level/perl-packages.nix18
-rw-r--r--pkgs/top-level/python-aliases.nix1
-rw-r--r--pkgs/top-level/python-packages.nix23
-rw-r--r--pkgs/top-level/python2-packages.nix25
631 files changed, 5653 insertions, 3441 deletions
diff --git a/.mailmap b/.mailmap
index d3858d78dde..d2bf6d0e476 100644
--- a/.mailmap
+++ b/.mailmap
@@ -1,3 +1,14 @@
+ajs124 <git@ajs124.de> <ajs124@users.noreply.github.com>
+Anderson Torres <torres.anderson.85@protonmail.com>
 Daniel Løvbrøtte Olsen <me@dandellion.xyz> <daniel.olsen99@gmail.com>
+Fabian Affolter <mail@fabian-affolter.ch> <fabian@affolter-engineering.ch>
+Janne Heß <janne@hess.ooo> <dasJ@users.noreply.github.com>
+Jörg Thalheim <joerg@thalheim.io> <Mic92@users.noreply.github.com>
+Martin Weinelt <hexa@darmstadt.ccc.de> <mweinelt@users.noreply.github.com>
 R. RyanTM <ryantm-bot@ryantm.com>
-Sandro <sandro.jaeckel@gmail.com>
+Robert Hensing <robert@roberthensing.nl> <roberth@users.noreply.github.com>
+Sandro Jäckel <sandro.jaeckel@gmail.com>
+Sandro Jäckel <sandro.jaeckel@gmail.com> <sandro.jaeckel@sap.com>
+superherointj <5861043+superherointj@users.noreply.github.com>
+Vladimír Čunát <v@cunat.cz> <vcunat@gmail.com>
+Vladimír Čunát <v@cunat.cz> <vladimir.cunat@nic.cz>
diff --git a/doc/builders/images/dockertools.section.md b/doc/builders/images/dockertools.section.md
index 6203b3786bf..dfc012b80c5 100644
--- a/doc/builders/images/dockertools.section.md
+++ b/doc/builders/images/dockertools.section.md
@@ -62,6 +62,8 @@ The above example will build a Docker image `redis/latest` from the given base i
 
 - `config` is used to specify the configuration of the containers that will be started off the built image in Docker. The available options are listed in the [Docker Image Specification v1.2.0](https://github.com/moby/moby/blob/master/image/spec/v1.2.md#image-json-field-descriptions).
 
+- `architecture` is _optional_ and used to specify the image architecture, this is useful for multi-architecture builds that don't need cross compiling. If not specified it will default to `hostPlatform`.
+
 - `diskSize` is used to specify the disk size of the VM used to build the image in megabytes. By default it's 1024 MiB.
 
 - `buildVMMemorySize` is used to specify the memory size of the VM to build the image in megabytes. By default it's 512 MiB.
@@ -141,6 +143,8 @@ Create a Docker image with many of the store paths being on their own layer to i
 
 `config` _optional_
 
+`architecture` is _optional_ and used to specify the image architecture, this is useful for multi-architecture builds that don't need cross compiling. If not specified it will default to `hostPlatform`.
+
 : Run-time configuration of the container. A full list of the options are available at in the [Docker Image Specification v1.2.0](https://github.com/moby/moby/blob/master/image/spec/v1.2.md#image-json-field-descriptions).
 
     *Default:* `{}`
diff --git a/doc/languages-frameworks/cuelang.section.md b/doc/languages-frameworks/cuelang.section.md
new file mode 100644
index 00000000000..93c94027ae2
--- /dev/null
+++ b/doc/languages-frameworks/cuelang.section.md
@@ -0,0 +1,93 @@
+# Cue (Cuelang) {#cuelang}
+
+[Cuelang](https://cuelang.org/) is a language to:
+
+- describe schemas and validate backward-compatibility
+- generate code and schemas in various formats (e.g. JSON Schema, OpenAPI)
+- do configuration akin to [Dhall Lang](https://dhall-lang.org/)
+- perform data validation
+
+## Cuelang schema quick start
+
+Cuelang schemas are similar to JSON, here is a quick cheatsheet:
+
+- Default types includes: `null`, `string`, `bool`, `bytes`, `number`, `int`, `float`, lists as `[...T]` where `T` is a type.
+- All structures, defined by: `myStructName: { <fields> }` are **open** -- they accept fields which are not specified.
+- Closed structures can be built by doing `myStructName: close({ <fields> })` -- they are strict in what they accept.
+- `#X` are **definitions**, referenced definitions are **recursively closed**, i.e. all its children structures are **closed**.
+- `&` operator is the [unification operator](https://cuelang.org/docs/references/spec/#unification) (similar to a type-level merging operator), `|` is the [disjunction operator](https://cuelang.org/docs/references/spec/#disjunction) (similar to a type-level union operator).
+- Values **are** types, i.e. `myStruct: { a: 3 }` is a valid type definition that only allows `3` as value.
+
+- Read <https://cuelang.org/docs/concepts/logic/> to learn more about the semantics.
+- Read <https://cuelang.org/docs/references/spec/> to learn about the language specification.
+
+## `writeCueValidator`
+
+Nixpkgs provides a `pkgs.writeCueValidator` helper, which will write a validation script based on the provided Cuelang schema.
+
+Here is an example:
+```
+pkgs.writeCueValidator
+  (pkgs.writeText "schema.cue" ''
+    #Def1: {
+      field1: string
+    }
+  '')
+  { document = "#Def1"; }
+```
+
+- The first parameter is the Cue schema file.
+- The second paramter is an options parameter, currently, only: `document` can be passed.
+
+`document` : match your input data against this fragment of structure or definition, e.g. you may use the same schema file but differents documents based on the data you are validating.
+
+Another example, given the following `validator.nix` :
+```
+{ pkgs ? import <nixpkgs> {} }:
+let
+  genericValidator = version:
+  pkgs.writeCueValidator
+    (pkgs.writeText "schema.cue" ''
+      #Version1: {
+        field1: string
+      }
+      #Version2: #Version1 & {
+        field1: "unused"
+      }''
+    )
+    { document = "#Version${toString version}"; };
+in
+{
+  validateV1 = genericValidator 1;
+  validateV2 = genericValidator 2;
+}
+```
+
+The result is a script that will validate the file you pass as the first argument against the schema you provided `writeCueValidator`.
+
+It can be any format that `cue vet` supports, i.e. YAML or JSON for example.
+
+Here is an example, named `example.json`, given the following JSON:
+```
+{ "field1": "abc" }
+```
+
+You can run the result script (named `validate`) as the following:
+
+```console
+$ nix-build validator.nix
+$ ./result example.json
+$ ./result-2 example.json
+field1: conflicting values "unused" and "abc":
+    ./example.json:1:13
+    ../../../../../../nix/store/v64dzx3vr3glpk0cq4hzmh450lrwh6sg-schema.cue:5:11
+$ sed -i 's/"abc"/3/' example.json
+$ ./result example.json
+field1: conflicting values 3 and string (mismatched types int and string):
+    ./example.json:1:13
+    ../../../../../../nix/store/v64dzx3vr3glpk0cq4hzmh450lrwh6sg-schema.cue:5:11
+```
+
+**Known limitations**
+
+* The script will enforce **concrete** values and will not accept lossy transformations (strictness). You can add these options if you need them.
diff --git a/doc/languages-frameworks/go.section.md b/doc/languages-frameworks/go.section.md
index 42acab817b6..523f5b26ec7 100644
--- a/doc/languages-frameworks/go.section.md
+++ b/doc/languages-frameworks/go.section.md
@@ -11,7 +11,13 @@ The function `buildGoModule` builds Go programs managed with Go modules. It buil
 
 In the following is an example expression using `buildGoModule`, the following arguments are of special significance to the function:
 
-- `vendorHash`: is the hash of the output of the intermediate fetcher derivation. `vendorHash` can also take `null` as an input. When `null` is used as a value, rather than fetching the dependencies and vendoring them, we use the vendoring included within the source repo. If you'd like to not have to update this field on dependency changes, run `go mod vendor` in your source repo and set `vendorHash = null;`
+- `vendorHash`: is the hash of the output of the intermediate fetcher derivation.
+
+  `vendorHash` can also be set to `null`.
+  In that case, rather than fetching the dependencies and vendoring them, the dependencies vendored in the source repo will be used.
+
+  To avoid updating this field when dependencies change, run `go mod vendor` in your source repo and set `vendorHash = null;`  
+  To obtain the actual hash, set `vendorHash = lib.fakeSha256;` and run the build ([more details here](#sec-source-hashes)).
 - `proxyVendor`: Fetches (go mod download) and proxies the vendor directory. This is useful if your code depends on c code and go mod tidy does not include the needed sources to build or if any dependency has case-insensitive conflicts which will produce platform dependant `vendorHash` checksums.
 
 ```nix
diff --git a/doc/languages-frameworks/index.xml b/doc/languages-frameworks/index.xml
index 3d5b2f73897..7df241436ff 100644
--- a/doc/languages-frameworks/index.xml
+++ b/doc/languages-frameworks/index.xml
@@ -13,6 +13,7 @@
  <xi:include href="coq.section.xml" />
  <xi:include href="crystal.section.xml" />
  <xi:include href="cuda.section.xml" />
+ <xi:include href="cuelang.section.xml" />
  <xi:include href="dhall.section.xml" />
  <xi:include href="dotnet.section.xml" />
  <xi:include href="emscripten.section.xml" />
diff --git a/lib/default.nix b/lib/default.nix
index cc4bedc5869..68e5b8dea1e 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -101,6 +101,7 @@ let
       upperChars toLower toUpper addContextFrom splitString
       removePrefix removeSuffix versionOlder versionAtLeast
       getName getVersion
+      mesonOption mesonBool mesonEnable
       nameFromURL enableFeature enableFeatureAs withFeature
       withFeatureAs fixedWidthString fixedWidthNumber isStorePath
       toInt toIntBase10 readPathsFromFile fileContents;
diff --git a/lib/generators.nix b/lib/generators.nix
index b77cca75010..c0fe69389e0 100644
--- a/lib/generators.nix
+++ b/lib/generators.nix
@@ -278,8 +278,11 @@ rec {
         mapAny 0;
 
   /* Pretty print a value, akin to `builtins.trace`.
-    * Should probably be a builtin as well.
-    */
+   * Should probably be a builtin as well.
+   * The pretty-printed string should be suitable for rendering default values
+   * in the NixOS manual. In particular, it should be as close to a valid Nix expression
+   * as possible.
+   */
   toPretty = {
     /* If this option is true, attrsets like { __pretty = fn; val = …; }
        will use fn to convert val to a pretty printed representation.
@@ -294,20 +297,25 @@ rec {
             introSpace = if multiline then "\n${indent}  " else " ";
             outroSpace = if multiline then "\n${indent}" else " ";
     in if   isInt      v then toString v
-    else if isFloat    v then "~${toString v}"
+    # toString loses precision on floats, so we use toJSON instead. This isn't perfect
+    # as the resulting string may not parse back as a float (e.g. 42, 1e-06), but for
+    # pretty-printing purposes this is acceptable.
+    else if isFloat    v then builtins.toJSON v
     else if isString   v then
       let
-        # Separate a string into its lines
-        newlineSplits = filter (v: ! isList v) (builtins.split "\n" v);
-        # For a '' string terminated by a \n, which happens when the closing '' is on a new line
-        multilineResult = "''" + introSpace + concatStringsSep introSpace (lib.init newlineSplits) + outroSpace + "''";
-        # For a '' string not terminated by a \n, which happens when the closing '' is not on a new line
-        multilineResult' = "''" + introSpace + concatStringsSep introSpace newlineSplits + "''";
-        # For single lines, replace all newlines with their escaped representation
-        singlelineResult = "\"" + libStr.escape [ "\"" ] (concatStringsSep "\\n" newlineSplits) + "\"";
-      in if multiline && length newlineSplits > 1 then
-        if lib.last newlineSplits == "" then multilineResult else multilineResult'
-      else singlelineResult
+        lines = filter (v: ! isList v) (builtins.split "\n" v);
+        escapeSingleline = libStr.escape [ "\\" "\"" "\${" ];
+        escapeMultiline = libStr.replaceStrings [ "\${" "''" ] [ "''\${" "'''" ];
+        singlelineResult = "\"" + concatStringsSep "\\n" (map escapeSingleline lines) + "\"";
+        multilineResult = let
+          escapedLines = map escapeMultiline lines;
+          # The last line gets a special treatment: if it's empty, '' is on its own line at the "outer"
+          # indentation level. Otherwise, '' is appended to the last line.
+          lastLine = lib.last escapedLines;
+        in "''" + introSpace + concatStringsSep introSpace (lib.init escapedLines)
+                + (if lastLine == "" then outroSpace else introSpace + lastLine) + "''";
+      in
+        if multiline && length lines > 1 then multilineResult else singlelineResult
     else if true  ==   v then "true"
     else if false ==   v then "false"
     else if null  ==   v then "null"
@@ -326,11 +334,11 @@ rec {
                          else "<function, args: {${showFnas}}>"
     else if isAttrs    v then
       # apply pretty values if allowed
-      if attrNames v == [ "__pretty" "val" ] && allowPrettyValues
+      if allowPrettyValues && v ? __pretty && v ? val
          then v.__pretty v.val
       else if v == {} then "{ }"
       else if v ? type && v.type == "derivation" then
-        "<derivation ${v.drvPath or "???"}>"
+        "<derivation ${v.name or "???"}>"
       else "{" + introSpace
           + libStr.concatStringsSep introSpace (libAttr.mapAttrsToList
               (name: value:
diff --git a/lib/options.nix b/lib/options.nix
index c80256c0e65..b13687576e8 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -218,7 +218,7 @@ rec {
   # the set generated with filterOptionSets.
   optionAttrSetToDocList = optionAttrSetToDocList' [];
 
-  optionAttrSetToDocList' = prefix: options:
+  optionAttrSetToDocList' = _: options:
     concatMap (opt:
       let
         docOption = rec {
@@ -234,9 +234,8 @@ rec {
           readOnly = opt.readOnly or false;
           type = opt.type.description or "unspecified";
         }
-        // optionalAttrs (opt ? example) { example = scrubOptionValue opt.example; }
-        // optionalAttrs (opt ? default) { default = scrubOptionValue opt.default; }
-        // optionalAttrs (opt ? defaultText) { default = opt.defaultText; }
+        // optionalAttrs (opt ? example) { example = renderOptionValue opt.example; }
+        // optionalAttrs (opt ? default) { default = renderOptionValue (opt.defaultText or opt.default); }
         // optionalAttrs (opt ? relatedPackages && opt.relatedPackages != null) { inherit (opt) relatedPackages; };
 
         subOptions =
@@ -256,6 +255,9 @@ rec {
      efficient: the XML representation of derivations is very large
      (on the order of megabytes) and is not actually used by the
      manual generator.
+
+     This function was made obsolete by renderOptionValue and is kept for
+     compatibility with out-of-tree code.
   */
   scrubOptionValue = x:
     if isDerivation x then
@@ -265,6 +267,17 @@ rec {
     else x;
 
 
+  /* Ensures that the given option value (default or example) is a `_type`d string
+     by rendering Nix values to `literalExpression`s.
+  */
+  renderOptionValue = v:
+    if v ? _type && v ? text then v
+    else literalExpression (lib.generators.toPretty {
+      multiline = true;
+      allowPrettyValues = true;
+    } v);
+
+
   /* For use in the `defaultText` and `example` option attributes. Causes the
      given string to be rendered verbatim in the documentation as Nix code. This
      is necessary for complex values, e.g. functions, or values that depend on
diff --git a/lib/strings.nix b/lib/strings.nix
index b5f5a4d9060..9a4f29380d0 100644
--- a/lib/strings.nix
+++ b/lib/strings.nix
@@ -510,7 +510,7 @@ rec {
   toUpper = replaceChars lowerChars upperChars;
 
   /* Appends string context from another string.  This is an implementation
-     detail of Nix.
+     detail of Nix and should be used carefully.
 
      Strings in Nix carry an invisible `context` which is a list of strings
      representing store paths.  If the string is later used in a derivation
@@ -533,13 +533,11 @@ rec {
        splitString "/" "/usr/local/bin"
        => [ "" "usr" "local" "bin" ]
   */
-  splitString = _sep: _s:
+  splitString = sep: s:
     let
-      sep = builtins.unsafeDiscardStringContext _sep;
-      s = builtins.unsafeDiscardStringContext _s;
-      splits = builtins.filter builtins.isString (builtins.split (escapeRegex sep) s);
+      splits = builtins.filter builtins.isString (builtins.split (escapeRegex (toString sep)) (toString s));
     in
-      map (v: addContextFrom _sep (addContextFrom _s v)) splits;
+      map (addContextFrom s) splits;
 
   /* Return a string without the specified prefix, if the prefix matches.
 
@@ -661,6 +659,61 @@ rec {
       name = head (splitString sep filename);
     in assert name != filename; name;
 
+  /* Create a -D<feature>=<value> string that can be passed to typical Meson
+     invocations.
+
+    Type: mesonOption :: string -> string -> string
+
+     @param feature The feature to be set
+     @param value The desired value
+
+     Example:
+       mesonOption "engine" "opengl"
+       => "-Dengine=opengl"
+  */
+  mesonOption = feature: value:
+    assert (lib.isString feature);
+    assert (lib.isString value);
+    "-D${feature}=${value}";
+
+  /* Create a -D<condition>={true,false} string that can be passed to typical
+     Meson invocations.
+
+    Type: mesonBool :: string -> bool -> string
+
+     @param condition The condition to be made true or false
+     @param flag The controlling flag of the condition
+
+     Example:
+       mesonBool "hardened" true
+       => "-Dhardened=true"
+       mesonBool "static" false
+       => "-Dstatic=false"
+  */
+  mesonBool = condition: flag:
+    assert (lib.isString condition);
+    assert (lib.isBool flag);
+    mesonOption condition (lib.boolToString flag);
+
+  /* Create a -D<feature>={enabled,disabled} string that can be passed to
+     typical Meson invocations.
+
+    Type: mesonEnable :: string -> bool -> string
+
+     @param feature The feature to be enabled or disabled
+     @param flag The controlling flag
+
+     Example:
+       mesonEnable "docs" true
+       => "-Ddocs=enabled"
+       mesonEnable "savage" false
+       => "-Dsavage=disabled"
+  */
+  mesonEnable = feature: flag:
+    assert (lib.isString feature);
+    assert (lib.isBool flag);
+    mesonOption feature (if flag then "enabled" else "disabled");
+
   /* Create an --{enable,disable}-<feat> string that can be passed to
      standard GNU Autoconf scripts.
 
diff --git a/lib/tests/misc.nix b/lib/tests/misc.nix
index b73da4f1010..648c05ab357 100644
--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@@ -727,7 +727,7 @@ runTests {
       float = 0.1337;
       bool = true;
       emptystring = "";
-      string = ''fno"rd'';
+      string = "fn\${o}\"r\\d";
       newlinestring = "\n";
       path = /. + "/foo";
       null_ = null;
@@ -735,16 +735,16 @@ runTests {
       functionArgs = { arg ? 4, foo }: arg;
       list = [ 3 4 function [ false ] ];
       emptylist = [];
-      attrs = { foo = null; "foo bar" = "baz"; };
+      attrs = { foo = null; "foo b/ar" = "baz"; };
       emptyattrs = {};
       drv = deriv;
     };
     expected = rec {
       int = "42";
-      float = "~0.133700";
+      float = "0.1337";
       bool = "true";
       emptystring = ''""'';
-      string = ''"fno\"rd"'';
+      string = ''"fn\''${o}\"r\\d"'';
       newlinestring = "\"\\n\"";
       path = "/foo";
       null_ = "null";
@@ -752,9 +752,9 @@ runTests {
       functionArgs = "<function, args: {arg?, foo}>";
       list = "[ 3 4 ${function} [ false ] ]";
       emptylist = "[ ]";
-      attrs = "{ foo = null; \"foo bar\" = \"baz\"; }";
+      attrs = "{ foo = null; \"foo b/ar\" = \"baz\"; }";
       emptyattrs = "{ }";
-      drv = "<derivation ${deriv.drvPath}>";
+      drv = "<derivation ${deriv.name}>";
     };
   };
 
@@ -799,8 +799,8 @@ runTests {
       newlinestring = "\n";
       multilinestring = ''
         hello
-        there
-        test
+        ''${there}
+        te'''st
       '';
       multilinestring' = ''
         hello
@@ -827,8 +827,8 @@ runTests {
       multilinestring = ''
         '''
           hello
-          there
-          test
+          '''''${there}
+          te''''st
         ''''';
       multilinestring' = ''
         '''
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index a66d32294f7..21e53a2ecc9 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -14127,6 +14127,12 @@
     githubId = 8794235;
     name = "Tom Siewert";
   };
+  tonyshkurenko = {
+    email = "support@twingate.com";
+    github = "tonyshkurenko";
+    githubId = 8597964;
+    name = "Anton Shkurenko";
+  };
   toonn = {
     email = "nixpkgs@toonn.io";
     matrix = "@toonn:matrix.org";
diff --git a/maintainers/scripts/update-luarocks-shell.nix b/maintainers/scripts/update-luarocks-shell.nix
index a58674fca8d..346b0319b08 100644
--- a/maintainers/scripts/update-luarocks-shell.nix
+++ b/maintainers/scripts/update-luarocks-shell.nix
@@ -2,7 +2,7 @@
 }:
 with nixpkgs;
 let
-  pyEnv = python3.withPackages(ps: [ ps.GitPython ]);
+  pyEnv = python3.withPackages(ps: [ ps.gitpython ]);
 in
 mkShell {
   packages = [
diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index c75f9aa7177..5e5a61875db 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -506,6 +506,18 @@ with lib.maintainers; {
     enableFeatureFreezePing = true;
   };
 
+  node = {
+    members = [
+      lilyinstarlight
+      marsam
+      winter
+      yuka
+    ];
+    scope = "Maintain Node.js runtimes and build tooling.";
+    shortName = "Node.js";
+    enableFeatureFreezePing = true;
+  };
+
   numtide = {
     members = [
       mic92
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
index 688f0f47676..9b6e755fd47 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
@@ -561,6 +561,14 @@
           <link xlink:href="options.html#opt-services.prometheus.exporters.smartctl.enable">services.prometheus.exporters.smartctl</link>.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <link xlink:href="https://docs.twingate.com/docs/linux">twingate</link>,
+          a high performance, easy to use zero trust solution that
+          enables access to private resources from any device with
+          better security than a VPN.
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
   <section xml:id="sec-release-21.11-incompatibilities">
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
index 914be23576e..cc330e2f887 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
@@ -22,7 +22,14 @@
   </section>
   <section xml:id="sec-release-23.05-new-services">
     <title>New Services</title>
-    <itemizedlist spacing="compact">
+    <itemizedlist>
+      <listitem>
+        <para>
+          <link xlink:href="https://github.com/akinomyoga/ble.sh">blesh</link>,
+          a line editor written in pure bash. Available as
+          <link linkend="opt-programs.bash.blesh.enable">programs.bash.blesh</link>.
+        </para>
+      </listitem>
       <listitem>
         <para>
           <link xlink:href="https://github.com/junegunn/fzf">fzf</link>,
@@ -170,6 +177,15 @@
       </listitem>
       <listitem>
         <para>
+          The <literal>dnsmasq</literal> service now takes configuration
+          via the <literal>services.dnsmasq.settings</literal> attribute
+          set. The option
+          <literal>services.dnsmasq.extraConfig</literal> will be
+          deprecated when NixOS 22.11 reaches end of life.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
           A new <literal>virtualisation.rosetta</literal> module was
           added to allow running <literal>x86_64</literal> binaries
           through
diff --git a/nixos/doc/manual/release-notes/rl-2111.section.md b/nixos/doc/manual/release-notes/rl-2111.section.md
index 1ff2e826c60..fc4b44957c3 100644
--- a/nixos/doc/manual/release-notes/rl-2111.section.md
+++ b/nixos/doc/manual/release-notes/rl-2111.section.md
@@ -164,6 +164,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [smartctl_exporter](https://github.com/prometheus-community/smartctl_exporter), a Prometheus exporter for [S.M.A.R.T.](https://en.wikipedia.org/wiki/S.M.A.R.T.) data. Available as [services.prometheus.exporters.smartctl](options.html#opt-services.prometheus.exporters.smartctl.enable).
 
+- [twingate](https://docs.twingate.com/docs/linux), a high performance, easy to use zero trust solution that enables access to private resources from any device with better security than a VPN.
+
 ## Backward Incompatibilities {#sec-release-21.11-incompatibilities}
 
 - The NixOS VM test framework, `pkgs.nixosTest`/`make-test-python.nix` (`pkgs.testers.nixosTest` since 22.05), now requires detaching commands such as `succeed("foo &")` and `succeed("foo | xclip -i")` to close stdout.
diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md
index 3640cf8e963..886db43c68e 100644
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -14,6 +14,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
+- [blesh](https://github.com/akinomyoga/ble.sh), a line editor written in pure bash. Available as [programs.bash.blesh](#opt-programs.bash.blesh.enable).
+
 - [fzf](https://github.com/junegunn/fzf), a command line fuzzyfinder. Available as [programs.fzf](#opt-programs.fzf.fuzzyCompletion).
 
 ## Backward Incompatibilities {#sec-release-23.05-incompatibilities}
@@ -51,6 +53,11 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - `services.mastodon` gained a tootctl wrapped named `mastodon-tootctl` similar to `nextcloud-occ` which can be executed from any user and switches to the configured mastodon user with sudo and sources the environment variables.
 
+- The `dnsmasq` service now takes configuration via the
+  `services.dnsmasq.settings` attribute set. The option
+  `services.dnsmasq.extraConfig` will be deprecated when NixOS 22.11 reaches
+  end of life.
+
 - A new `virtualisation.rosetta` module was added to allow running `x86_64` binaries through [Rosetta](https://developer.apple.com/documentation/apple-silicon/about-the-rosetta-translation-environment) inside virtualised NixOS guests on Apple silicon. This feature works by default with the [UTM](https://docs.getutm.app/) virtualisation [package](https://search.nixos.org/packages?channel=unstable&show=utm&from=0&size=1&sort=relevance&type=packages&query=utm).
 
 - Resilio sync secret keys can now be provided using a secrets file at runtime, preventing these secrets from ending up in the Nix store.
diff --git a/nixos/lib/make-options-doc/default.nix b/nixos/lib/make-options-doc/default.nix
index e097aa5eebd..dea3eec5bd6 100644
--- a/nixos/lib/make-options-doc/default.nix
+++ b/nixos/lib/make-options-doc/default.nix
@@ -26,7 +26,7 @@
   # If you include more than one option list into a document, you need to
   # provide different ids.
 , variablelistId ? "configuration-variable-list"
-  # Strig to prefix to the option XML/HTML id attributes.
+  # String to prefix to the option XML/HTML id attributes.
 , optionIdPrefix ? "opt-"
 , revision ? "" # Specify revision for the options
 # a set of options the docs we are generating will be merged into, as if by recursiveUpdate.
@@ -45,28 +45,11 @@
 }:
 
 let
-  # Make a value safe for JSON. Functions are replaced by the string "<function>",
-  # derivations are replaced with an attrset
-  # { _type = "derivation"; name = <name of that derivation>; }.
-  # We need to handle derivations specially because consumers want to know about them,
-  # but we can't easily use the type,name subset of keys (since type is often used as
-  # a module option and might cause confusion). Use _type,name instead to the same
-  # effect, since _type is already used by the module system.
-  substSpecial = x:
-    if lib.isDerivation x then { _type = "derivation"; name = x.name; }
-    else if builtins.isAttrs x then lib.mapAttrs (name: substSpecial) x
-    else if builtins.isList x then map substSpecial x
-    else if lib.isFunction x then "<function>"
-    else x;
-
   rawOpts = lib.optionAttrSetToDocList options;
   transformedOpts = map transformOptions rawOpts;
   filteredOpts = lib.filter (opt: opt.visible && !opt.internal) transformedOpts;
   optionsList = lib.flip map filteredOpts
    (opt: opt
-    // lib.optionalAttrs (opt ? example) { example = substSpecial opt.example; }
-    // lib.optionalAttrs (opt ? default) { default = substSpecial opt.default; }
-    // lib.optionalAttrs (opt ? type) { type = substSpecial opt.type; }
     // lib.optionalAttrs (opt ? relatedPackages && opt.relatedPackages != []) { relatedPackages = genRelatedPackages opt.relatedPackages opt.name; }
    );
 
@@ -111,14 +94,16 @@ in rec {
   inherit optionsNix;
 
   optionsAsciiDoc = pkgs.runCommand "options.adoc" {} ''
-    ${pkgs.python3Minimal}/bin/python ${./generateAsciiDoc.py} \
-      < ${optionsJSON}/share/doc/nixos/options.json \
+    ${pkgs.python3Minimal}/bin/python ${./generateDoc.py} \
+      --format asciidoc \
+      ${optionsJSON}/share/doc/nixos/options.json \
       > $out
   '';
 
   optionsCommonMark = pkgs.runCommand "options.md" {} ''
-    ${pkgs.python3Minimal}/bin/python ${./generateCommonMark.py} \
-      < ${optionsJSON}/share/doc/nixos/options.json \
+    ${pkgs.python3Minimal}/bin/python ${./generateDoc.py} \
+      --format commonmark \
+      ${optionsJSON}/share/doc/nixos/options.json \
       > $out
   '';
 
diff --git a/nixos/lib/make-options-doc/generateAsciiDoc.py b/nixos/lib/make-options-doc/generateAsciiDoc.py
deleted file mode 100644
index 48eadd248c5..00000000000
--- a/nixos/lib/make-options-doc/generateAsciiDoc.py
+++ /dev/null
@@ -1,37 +0,0 @@
-import json
-import sys
-
-options = json.load(sys.stdin)
-# TODO: declarations: link to github
-for (name, value) in options.items():
-    print(f'== {name}')
-    print()
-    print(value['description'])
-    print()
-    print('[discrete]')
-    print('=== details')
-    print()
-    print(f'Type:: {value["type"]}')
-    if 'default' in value:
-        print('Default::')
-        print('+')
-        print('----')
-        print(json.dumps(value['default'], ensure_ascii=False, separators=(',', ':')))
-        print('----')
-        print()
-    else:
-        print('No Default:: {blank}')
-    if value['readOnly']:
-        print('Read Only:: {blank}')
-    else:
-        print()
-    if 'example' in value:
-        print('Example::')
-        print('+')
-        print('----')
-        print(json.dumps(value['example'], ensure_ascii=False, separators=(',', ':')))
-        print('----')
-        print()
-    else:
-        print('No Example:: {blank}')
-    print()
diff --git a/nixos/lib/make-options-doc/generateCommonMark.py b/nixos/lib/make-options-doc/generateCommonMark.py
deleted file mode 100644
index bf487bd89c3..00000000000
--- a/nixos/lib/make-options-doc/generateCommonMark.py
+++ /dev/null
@@ -1,27 +0,0 @@
-import json
-import sys
-
-options = json.load(sys.stdin)
-for (name, value) in options.items():
-    print('##', name.replace('<', '&lt;').replace('>', '&gt;'))
-    print(value['description'])
-    print()
-    if 'type' in value:
-        print('*_Type_*:')
-        print(value['type'])
-        print()
-    print()
-    if 'default' in value:
-        print('*_Default_*')
-        print('```')
-        print(json.dumps(value['default'], ensure_ascii=False, separators=(',', ':')))
-        print('```')
-    print()
-    print()
-    if 'example' in value:
-        print('*_Example_*')
-        print('```')
-        print(json.dumps(value['example'], ensure_ascii=False, separators=(',', ':')))
-        print('```')
-    print()
-    print()
diff --git a/nixos/lib/make-options-doc/generateDoc.py b/nixos/lib/make-options-doc/generateDoc.py
new file mode 100644
index 00000000000..1fe4eb0253a
--- /dev/null
+++ b/nixos/lib/make-options-doc/generateDoc.py
@@ -0,0 +1,108 @@
+import argparse
+import json
+import sys
+
+formats = ['commonmark', 'asciidoc']
+
+parser = argparse.ArgumentParser(
+    description = 'Generate documentation for a set of JSON-formatted NixOS options'
+)
+parser.add_argument(
+    'nix_options_path',
+    help = 'a path to a JSON file containing the NixOS options'
+)
+parser.add_argument(
+    '-f',
+    '--format',
+    choices = formats,
+    required = True,
+    help = f'the documentation format to generate'
+)
+
+args = parser.parse_args()
+
+# Pretty-print certain Nix types, like literal expressions.
+def render_types(obj):
+    if '_type' not in obj: return obj
+
+    _type = obj['_type']
+    if _type == 'literalExpression' or _type == 'literalDocBook':
+        return obj['text']
+
+    if _type == 'derivation':
+        return obj['name']
+
+    raise Exception(f'Unexpected type `{_type}` in {json.dumps(obj)}')
+
+def generate_commonmark(options):
+    for (name, value) in options.items():
+        print('##', name.replace('<', '&lt;').replace('>', '&gt;'))
+        print(value['description'])
+        print()
+        if 'type' in value:
+            print('*_Type_*')
+            print ('```')
+            print(value['type'])
+            print ('```')
+        print()
+        print()
+        if 'default' in value:
+            print('*_Default_*')
+            print('```')
+            print(json.dumps(value['default'], ensure_ascii=False, separators=(',', ':')))
+            print('```')
+        print()
+        print()
+        if 'example' in value:
+            print('*_Example_*')
+            print('```')
+            print(json.dumps(value['example'], ensure_ascii=False, separators=(',', ':')))
+            print('```')
+        print()
+        print()
+
+# TODO: declarations: link to github
+def generate_asciidoc(options):
+    for (name, value) in options.items():
+        print(f'== {name}')
+        print()
+        print(value['description'])
+        print()
+        print('[discrete]')
+        print('=== details')
+        print()
+        print(f'Type:: {value["type"]}')
+        if 'default' in value:
+            print('Default::')
+            print('+')
+            print('----')
+            print(json.dumps(value['default'], ensure_ascii=False, separators=(',', ':')))
+            print('----')
+            print()
+        else:
+            print('No Default:: {blank}')
+        if value['readOnly']:
+            print('Read Only:: {blank}')
+        else:
+            print()
+        if 'example' in value:
+            print('Example::')
+            print('+')
+            print('----')
+            print(json.dumps(value['example'], ensure_ascii=False, separators=(',', ':')))
+            print('----')
+            print()
+        else:
+            print('No Example:: {blank}')
+        print()
+
+with open(args.nix_options_path) as nix_options_json:
+    options = json.load(nix_options_json, object_hook=render_types)
+
+    if args.format == 'commonmark':
+        generate_commonmark(options)
+    elif args.format == 'asciidoc':
+        generate_asciidoc(options)
+    else:
+        raise Exception(f'Unsupported documentation format `--format {args.format}`')
+
diff --git a/nixos/lib/make-options-doc/options-to-docbook.xsl b/nixos/lib/make-options-doc/options-to-docbook.xsl
index 0fe14a6d2d1..ac49659c681 100644
--- a/nixos/lib/make-options-doc/options-to-docbook.xsl
+++ b/nixos/lib/make-options-doc/options-to-docbook.xsl
@@ -138,82 +138,6 @@
   </xsl:template>
 
 
-  <xsl:template match="string[contains(@value, '&#010;')]" mode="top">
-    <programlisting>
-      <xsl:text>''&#010;</xsl:text>
-      <xsl:value-of select='str:replace(str:replace(@value, "&apos;&apos;", "&apos;&apos;&apos;"), "${", "&apos;&apos;${")' />
-      <xsl:text>''</xsl:text>
-    </programlisting>
-  </xsl:template>
-
-
-  <xsl:template match="*" mode="top">
-    <literal><xsl:apply-templates select="." /></literal>
-  </xsl:template>
-
-
-  <xsl:template match="null">
-    <xsl:text>null</xsl:text>
-  </xsl:template>
-
-
-  <xsl:template match="string">
-    <xsl:choose>
-      <xsl:when test="(contains(@value, '&quot;') or contains(@value, '\')) and not(contains(@value, '&#010;'))">
-        <xsl:text>''</xsl:text><xsl:value-of select='str:replace(str:replace(@value, "&apos;&apos;", "&apos;&apos;&apos;"), "${", "&apos;&apos;${")' /><xsl:text>''</xsl:text>
-      </xsl:when>
-      <xsl:otherwise>
-        <xsl:text>"</xsl:text><xsl:value-of select="str:replace(str:replace(str:replace(str:replace(@value, '\', '\\'), '&quot;', '\&quot;'), '&#010;', '\n'), '${', '\${')" /><xsl:text>"</xsl:text>
-      </xsl:otherwise>
-    </xsl:choose>
-  </xsl:template>
-
-
-  <xsl:template match="int">
-    <xsl:value-of select="@value" />
-  </xsl:template>
-
-
-  <xsl:template match="bool[@value = 'true']">
-    <xsl:text>true</xsl:text>
-  </xsl:template>
-
-
-  <xsl:template match="bool[@value = 'false']">
-    <xsl:text>false</xsl:text>
-  </xsl:template>
-
-
-  <xsl:template match="list">
-    [
-    <xsl:for-each select="*">
-      <xsl:apply-templates select="." />
-      <xsl:text> </xsl:text>
-    </xsl:for-each>
-    ]
-  </xsl:template>
-
-
-  <xsl:template match="attrs[attr[@name = '_type' and string[@value = 'literalExpression']]]">
-    <xsl:value-of select="attr[@name = 'text']/string/@value" />
-  </xsl:template>
-
-
-  <xsl:template match="attrs">
-    {
-    <xsl:for-each select="attr">
-      <xsl:value-of select="@name" />
-      <xsl:text> = </xsl:text>
-      <xsl:apply-templates select="*" /><xsl:text>; </xsl:text>
-    </xsl:for-each>
-    }
-  </xsl:template>
-
-
-  <xsl:template match="attrs[attr[@name = '_type' and string[@value = 'derivation']]]">
-    <replaceable>(build of <xsl:value-of select="attr[@name = 'name']/string/@value" />)</replaceable>
-  </xsl:template>
-
   <xsl:template match="attr[@name = 'declarations' or @name = 'definitions']">
     <simplelist>
       <!--
@@ -275,10 +199,4 @@
     </simplelist>
   </xsl:template>
 
-
-  <xsl:template match="function">
-    <xsl:text>λ</xsl:text>
-  </xsl:template>
-
-
 </xsl:stylesheet>
diff --git a/nixos/modules/config/krb5/default.nix b/nixos/modules/config/krb5/default.nix
index e3e0fadf096..df7a3f48236 100644
--- a/nixos/modules/config/krb5/default.nix
+++ b/nixos/modules/config/krb5/default.nix
@@ -82,8 +82,8 @@ in {
 
       kerberos = mkOption {
         type = types.package;
-        default = pkgs.krb5Full;
-        defaultText = literalExpression "pkgs.krb5Full";
+        default = pkgs.krb5;
+        defaultText = literalExpression "pkgs.krb5";
         example = literalExpression "pkgs.heimdal";
         description = lib.mdDoc ''
           The Kerberos implementation that will be present in
diff --git a/nixos/modules/config/no-x-libs.nix b/nixos/modules/config/no-x-libs.nix
index eeb61289c44..3efadea8235 100644
--- a/nixos/modules/config/no-x-libs.nix
+++ b/nixos/modules/config/no-x-libs.nix
@@ -43,6 +43,7 @@ with lib;
       networkmanager-openvpn = super.networkmanager-openvpn.override { withGnome = false; };
       networkmanager-sstp = super.networkmanager-vpnc.override { withGnome = false; };
       networkmanager-vpnc = super.networkmanager-vpnc.override { withGnome = false; };
+      pinentry = super.pinentry.override { enabledFlavors = [ "curses" "tty" "emacs" ]; withLibsecret = false; };
       qemu = super.qemu.override { gtkSupport = false; spiceSupport = false; sdlSupport = false; };
       qrencode = super.qrencode.overrideAttrs (_: { doCheck = false; });
       zbar = super.zbar.override { enableVideo = false; withXorg = false; };
diff --git a/nixos/modules/installer/tools/nix-fallback-paths.nix b/nixos/modules/installer/tools/nix-fallback-paths.nix
index 675674cf5b4..3eca901bdbf 100644
--- a/nixos/modules/installer/tools/nix-fallback-paths.nix
+++ b/nixos/modules/installer/tools/nix-fallback-paths.nix
@@ -1,7 +1,7 @@
 {
-  x86_64-linux = "/nix/store/xdlpraypxdimjyfrr4k06narrv8nmfgh-nix-2.11.1";
-  i686-linux = "/nix/store/acghbpn3aaj2q64mz3ljipsgf9d9qxlp-nix-2.11.1";
-  aarch64-linux = "/nix/store/0lrf6danhdqjsrhala134ak8vn0b9ghj-nix-2.11.1";
-  x86_64-darwin = "/nix/store/60sx4c6xflgqk11gvijwzlsczbxgxgwh-nix-2.11.1";
-  aarch64-darwin = "/nix/store/dmk5m3nlqp1awaqrp1f06qhhkh3l102n-nix-2.11.1";
+  x86_64-linux = "/nix/store/h88w1442c7hzkbw8sgpcsbqp4lhz6l5p-nix-2.12.0";
+  i686-linux = "/nix/store/j23527l1c3hfx17nssc0v53sq6c741zs-nix-2.12.0";
+  aarch64-linux = "/nix/store/zgzmdymyh934y3r4vqh8z337ba4cwsjb-nix-2.12.0";
+  x86_64-darwin = "/nix/store/wnlrzllazdyg1nrw9na497p4w0m7i7mm-nix-2.12.0";
+  aarch64-darwin = "/nix/store/7n5yamgzg5dpp5vb6ipdqgfh6cf30wmn-nix-2.12.0";
 }
diff --git a/nixos/modules/misc/documentation.nix b/nixos/modules/misc/documentation.nix
index aa6e40f4370..64a8f7846b4 100644
--- a/nixos/modules/misc/documentation.nix
+++ b/nixos/modules/misc/documentation.nix
@@ -48,10 +48,15 @@ let
         };
         scrubDerivations = namePrefix: pkgSet: mapAttrs
           (name: value:
-            let wholeName = "${namePrefix}.${name}"; in
-            if isAttrs value then
+            let
+              wholeName = "${namePrefix}.${name}";
+              guard = lib.warn "Attempt to evaluate package ${wholeName} in option documentation; this is not supported and will eventually be an error. Use `mkPackageOption` or `literalExpression` instead.";
+            in if isAttrs value then
               scrubDerivations wholeName value
-              // (optionalAttrs (isDerivation value) { outPath = "\${${wholeName}}"; })
+              // optionalAttrs (isDerivation value) {
+                outPath = guard "\${${wholeName}}";
+                drvPath = guard drvPath;
+              }
             else value
           )
           pkgSet;
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 9faa58409b1..24dd30e1575 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -135,6 +135,7 @@
   ./programs/bandwhich.nix
   ./programs/bash/bash.nix
   ./programs/bash/bash-completion.nix
+  ./programs/bash/blesh.nix
   ./programs/bash/ls-colors.nix
   ./programs/bash/undistract-me.nix
   ./programs/bash-my-aws.nix
@@ -988,6 +989,7 @@
   ./services/networking/tox-node.nix
   ./services/networking/toxvpn.nix
   ./services/networking/tvheadend.nix
+  ./services/networking/twingate.nix
   ./services/networking/ucarp.nix
   ./services/networking/unbound.nix
   ./services/networking/unifi.nix
@@ -1015,6 +1017,7 @@
   ./services/networking/zerotierone.nix
   ./services/networking/znc/default.nix
   ./services/printing/cupsd.nix
+  ./services/printing/ipp-usb.nix
   ./services/scheduling/atd.nix
   ./services/scheduling/cron.nix
   ./services/scheduling/fcron.nix
@@ -1139,6 +1142,7 @@
   ./services/web-apps/onlyoffice.nix
   ./services/web-apps/pict-rs.nix
   ./services/web-apps/peertube.nix
+  ./services/web-apps/peering-manager.nix
   ./services/web-apps/plantuml-server.nix
   ./services/web-apps/plausible.nix
   ./services/web-apps/pgpkeyserver-lite.nix
diff --git a/nixos/modules/programs/bash/blesh.nix b/nixos/modules/programs/bash/blesh.nix
new file mode 100644
index 00000000000..8fa51bef774
--- /dev/null
+++ b/nixos/modules/programs/bash/blesh.nix
@@ -0,0 +1,16 @@
+{ lib, config, pkgs, ... }:
+with lib;
+let
+  cfg = config.programs.bash.blesh;
+in {
+  options = {
+    programs.bash.blesh.enable = mkEnableOption (mdDoc "blesh");
+  };
+
+  config = mkIf cfg.enable {
+    programs.bash.interactiveShellInit = mkBefore ''
+      source ${pkgs.blesh}/share/blesh/ble.sh
+    '';
+  };
+  meta.maintainers = with maintainers; [ laalsaas ];
+}
diff --git a/nixos/modules/programs/htop.nix b/nixos/modules/programs/htop.nix
index 521287f9352..2682ced490c 100644
--- a/nixos/modules/programs/htop.nix
+++ b/nixos/modules/programs/htop.nix
@@ -20,7 +20,7 @@ in
     package = mkOption {
       type = types.package;
       default = pkgs.htop;
-      defaultText = "pkgs.htop";
+      defaultText = lib.literalExpression "pkgs.htop";
       description = lib.mdDoc ''
         The htop package that should be used.
       '';
diff --git a/nixos/modules/programs/weylus.nix b/nixos/modules/programs/weylus.nix
index eab8afdf2cc..a5775f3b981 100644
--- a/nixos/modules/programs/weylus.nix
+++ b/nixos/modules/programs/weylus.nix
@@ -29,7 +29,7 @@ in
     package = mkOption {
       type = package;
       default = pkgs.weylus;
-      defaultText = "pkgs.weylus";
+      defaultText = lib.literalExpression "pkgs.weylus";
       description = lib.mdDoc "Weylus package to install.";
     };
   };
diff --git a/nixos/modules/services/audio/icecast.nix b/nixos/modules/services/audio/icecast.nix
index 759f1ab0db9..f71a13b9626 100644
--- a/nixos/modules/services/audio/icecast.nix
+++ b/nixos/modules/services/audio/icecast.nix
@@ -74,7 +74,7 @@ in {
 
       listen = {
         port = mkOption {
-          type = types.int;
+          type = types.port;
           description = lib.mdDoc "TCP port that will be used to accept client connections.";
           default = 8000;
         };
diff --git a/nixos/modules/services/audio/liquidsoap.nix b/nixos/modules/services/audio/liquidsoap.nix
index c313104c460..5c10d13af5f 100644
--- a/nixos/modules/services/audio/liquidsoap.nix
+++ b/nixos/modules/services/audio/liquidsoap.nix
@@ -38,11 +38,13 @@ in
 
       default = {};
 
-      example = {
-        myStream1 = "/etc/liquidsoap/myStream1.liq";
-        myStream2 = literalExpression "./myStream2.liq";
-        myStream3 = "out(playlist(\"/srv/music/\"))";
-      };
+      example = literalExpression ''
+        {
+          myStream1 = "/etc/liquidsoap/myStream1.liq";
+          myStream2 = ./myStream2.liq;
+          myStream3 = "out(playlist(\"/srv/music/\"))";
+        }
+      '';
 
       type = types.attrsOf (types.either types.path types.str);
     };
diff --git a/nixos/modules/services/audio/mpd.nix b/nixos/modules/services/audio/mpd.nix
index bbfccec98c4..ba1e4716c9b 100644
--- a/nixos/modules/services/audio/mpd.nix
+++ b/nixos/modules/services/audio/mpd.nix
@@ -142,7 +142,7 @@ in {
         };
 
         port = mkOption {
-          type = types.int;
+          type = types.port;
           default = 6600;
           description = lib.mdDoc ''
             This setting is the TCP port that is desired for the daemon to get assigned
diff --git a/nixos/modules/services/backup/borgbackup.xml b/nixos/modules/services/backup/borgbackup.xml
index 8f623c93656..f38064f8677 100644
--- a/nixos/modules/services/backup/borgbackup.xml
+++ b/nixos/modules/services/backup/borgbackup.xml
@@ -179,7 +179,7 @@ sudo borg init --encryption=repokey-blake2  \
           mode = "repokey-blake2";
           passCommand = "cat /run/keys/borgbackup_passphrase";
         };
-        BORG_RSH = "ssh -i /run/keys/id_ed25519_borgbase";
+        environment = { BORG_RSH = "ssh -i /run/keys/id_ed25519_borgbase"; };
         compression = "auto,lzma";
         startAt = "daily";
     };
diff --git a/nixos/modules/services/cluster/kubernetes/kubelet.nix b/nixos/modules/services/cluster/kubernetes/kubelet.nix
index 0898fee9bdb..3ede1cb80e8 100644
--- a/nixos/modules/services/cluster/kubernetes/kubelet.nix
+++ b/nixos/modules/services/cluster/kubernetes/kubelet.nix
@@ -171,7 +171,7 @@ in
       port = mkOption {
         description = lib.mdDoc "Kubernetes kubelet healthz port.";
         default = 10248;
-        type = int;
+        type = port;
       };
     };
 
@@ -204,7 +204,7 @@ in
     port = mkOption {
       description = lib.mdDoc "Kubernetes kubelet info server listening port.";
       default = 10250;
-      type = int;
+      type = port;
     };
 
     seedDockerImages = mkOption {
diff --git a/nixos/modules/services/cluster/kubernetes/scheduler.nix b/nixos/modules/services/cluster/kubernetes/scheduler.nix
index 2eada43eb4e..f31a92f3684 100644
--- a/nixos/modules/services/cluster/kubernetes/scheduler.nix
+++ b/nixos/modules/services/cluster/kubernetes/scheduler.nix
@@ -43,7 +43,7 @@ in
     port = mkOption {
       description = lib.mdDoc "Kubernetes scheduler listening port.";
       default = 10251;
-      type = int;
+      type = port;
     };
 
     verbosity = mkOption {
diff --git a/nixos/modules/services/continuous-integration/buildbot/master.nix b/nixos/modules/services/continuous-integration/buildbot/master.nix
index d00e0ba3956..680b21dbf21 100644
--- a/nixos/modules/services/continuous-integration/buildbot/master.nix
+++ b/nixos/modules/services/continuous-integration/buildbot/master.nix
@@ -206,7 +206,7 @@ in {
 
       port = mkOption {
         default = 8010;
-        type = types.int;
+        type = types.port;
         description = lib.mdDoc "Specifies port number on which the buildbot HTTP interface listens.";
       };
 
diff --git a/nixos/modules/services/databases/cassandra.nix b/nixos/modules/services/databases/cassandra.nix
index 7556dbfc7b8..e26acb88d8c 100644
--- a/nixos/modules/services/databases/cassandra.nix
+++ b/nixos/modules/services/databases/cassandra.nix
@@ -19,6 +19,10 @@ let
 
   cfg = config.services.cassandra;
 
+  atLeast3 = versionAtLeast cfg.package.version "3";
+  atLeast3_11 = versionAtLeast cfg.package.version "3.11";
+  atLeast4 = versionAtLeast cfg.package.version "4";
+
   defaultUser = "cassandra";
 
   cassandraConfig = flip recursiveUpdate cfg.extraConfig (
@@ -39,7 +43,7 @@ let
           parameters = [{ seeds = concatStringsSep "," cfg.seedAddresses; }];
         }
       ];
-    } // optionalAttrs (versionAtLeast cfg.package.version "3") {
+    } // optionalAttrs atLeast3 {
       hints_directory = "${cfg.homeDir}/hints";
     }
   );
@@ -62,7 +66,7 @@ let
     cassandraLogbackConfig = pkgs.writeText "logback.xml" cfg.logbackConfig;
 
     passAsFile = [ "extraEnvSh" ];
-    inherit (cfg) extraEnvSh;
+    inherit (cfg) extraEnvSh package;
 
     buildCommand = ''
       mkdir -p "$out"
@@ -80,6 +84,10 @@ let
 
       # Delete default password file
       sed -i '/-Dcom.sun.management.jmxremote.password.file=\/etc\/cassandra\/jmxremote.password/d' "$out/cassandra-env.sh"
+
+      ${lib.optionalString atLeast4 ''
+        cp $package/conf/jvm*.options $out/
+      ''}
     '';
   };
 
@@ -95,8 +103,20 @@ let
       "-Dcom.sun.management.jmxremote.password.file=${cfg.jmxRolesFile}"
     ] ++ optionals cfg.remoteJmx [
       "-Djava.rmi.server.hostname=${cfg.rpcAddress}"
+    ] ++ optionals atLeast4 [
+      # Historically, we don't use a log dir, whereas the upstream scripts do
+      # expect this. We override those by providing our own -Xlog:gc flag.
+      "-Xlog:gc=warning,heap*=warning,age*=warning,safepoint=warning,promotion*=warning"
     ];
 
+  commonEnv = {
+    # Sufficient for cassandra 2.x, 3.x
+    CASSANDRA_CONF = "${cassandraEtc}";
+
+    # Required since cassandra 4
+    CASSANDRA_LOGBACK_CONF = "${cassandraEtc}/logback.xml";
+  };
+
 in
 {
   options.services.cassandra = {
@@ -435,7 +455,7 @@ in
     jmxRolesFile = mkOption {
       type = types.nullOr types.path;
       default =
-        if versionAtLeast cfg.package.version "3.11"
+        if atLeast3_11
         then pkgs.writeText "jmx-roles-file" defaultJmxRolesFile
         else null;
       defaultText = literalMD ''generated configuration file if version is at least 3.11, otherwise `null`'';
@@ -486,8 +506,7 @@ in
     systemd.services.cassandra = {
       description = "Apache Cassandra service";
       after = [ "network.target" ];
-      environment = {
-        CASSANDRA_CONF = "${cassandraEtc}";
+      environment = commonEnv // {
         JVM_OPTS = builtins.concatStringsSep " " fullJvmOptions;
         MAX_HEAP_SIZE = toString cfg.maxHeapSize;
         HEAP_NEWSIZE = toString cfg.heapNewSize;
@@ -508,6 +527,7 @@ in
       description = "Perform a full repair on this Cassandra node";
       after = [ "cassandra.service" ];
       requires = [ "cassandra.service" ];
+      environment = commonEnv;
       serviceConfig = {
         User = cfg.user;
         Group = cfg.group;
@@ -536,6 +556,7 @@ in
       description = "Perform an incremental repair on this cassandra node.";
       after = [ "cassandra.service" ];
       requires = [ "cassandra.service" ];
+      environment = commonEnv;
       serviceConfig = {
         User = cfg.user;
         Group = cfg.group;
diff --git a/nixos/modules/services/databases/clickhouse.nix b/nixos/modules/services/databases/clickhouse.nix
index 96607d9a783..04dd20b5f14 100644
--- a/nixos/modules/services/databases/clickhouse.nix
+++ b/nixos/modules/services/databases/clickhouse.nix
@@ -16,7 +16,7 @@ with lib;
       package = mkOption {
         type = types.package;
         default = pkgs.clickhouse;
-        defaultText = "pkgs.clickhouse";
+        defaultText = lib.literalExpression "pkgs.clickhouse";
         description = lib.mdDoc ''
           ClickHouse package to use.
         '';
diff --git a/nixos/modules/services/databases/mysql.nix b/nixos/modules/services/databases/mysql.nix
index ec4524e9061..128bb086217 100644
--- a/nixos/modules/services/databases/mysql.nix
+++ b/nixos/modules/services/databases/mysql.nix
@@ -160,10 +160,12 @@ in
           List of database names and their initial schemas that should be used to create databases on the first startup
           of MySQL. The schema attribute is optional: If not specified, an empty database is created.
         '';
-        example = [
-          { name = "foodatabase"; schema = literalExpression "./foodatabase.sql"; }
-          { name = "bardatabase"; }
-        ];
+        example = literalExpression ''
+          [
+            { name = "foodatabase"; schema = ./foodatabase.sql; }
+            { name = "bardatabase"; }
+          ]
+        '';
       };
 
       initialScript = mkOption {
diff --git a/nixos/modules/services/databases/openldap.nix b/nixos/modules/services/databases/openldap.nix
index 7a59de372f2..cba3442023c 100644
--- a/nixos/modules/services/databases/openldap.nix
+++ b/nixos/modules/services/databases/openldap.nix
@@ -16,7 +16,7 @@ let
       # systemd/systemd#19604
       description = ''
         LDAP value - either a string, or an attrset containing
-        <literal>path</literal> or <literal>base64</literal> for included
+        `path` or `base64` for included
         values or base-64 encoded values respectively.
       '';
       check = x: lib.isString x || (lib.isAttrs x && (x ? path || x ? base64));
diff --git a/nixos/modules/services/development/jupyter/default.nix b/nixos/modules/services/development/jupyter/default.nix
index c3ef040ebe6..9f791084446 100644
--- a/nixos/modules/services/development/jupyter/default.nix
+++ b/nixos/modules/services/development/jupyter/default.nix
@@ -57,7 +57,7 @@ in {
     };
 
     port = mkOption {
-      type = types.int;
+      type = types.port;
       default = 8888;
       description = lib.mdDoc ''
         Port number Jupyter will be listening on.
diff --git a/nixos/modules/services/games/asf.nix b/nixos/modules/services/games/asf.nix
index 10847e8f11f..d3f7883421c 100644
--- a/nixos/modules/services/games/asf.nix
+++ b/nixos/modules/services/games/asf.nix
@@ -43,12 +43,14 @@ in
     web-ui = mkOption {
       type = types.submodule {
         options = {
-          enable = mkEnableOption
-            (lib.mdDoc "Wheter to start the web-ui. This is the preferred way of configuring things such as the steam guard token");
+          enable = mkEnableOption "" // {
+            description = lib.mdDoc "Whether to start the web-ui. This is the preferred way of configuring things such as the steam guard token.";
+          };
 
           package = mkOption {
             type = types.package;
             default = pkgs.ArchiSteamFarm.ui;
+            defaultText = lib.literalExpression "pkgs.ArchiSteamFarm.ui";
             description =
               lib.mdDoc "Web-UI package to use. Contents must be in lib/dist.";
           };
@@ -56,7 +58,6 @@ in
       };
       default = {
         enable = true;
-        package = pkgs.ArchiSteamFarm.ui;
       };
       example = {
         enable = false;
@@ -67,6 +68,7 @@ in
     package = mkOption {
       type = types.package;
       default = pkgs.ArchiSteamFarm;
+      defaultText = lib.literalExpression "pkgs.ArchiSteamFarm";
       description =
         lib.mdDoc "Package to use. Should always be the latest version, for security reasons, since this module uses very new features and to not get out of sync with the Steam API.";
     };
diff --git a/nixos/modules/services/games/terraria.nix b/nixos/modules/services/games/terraria.nix
index 571bcde2c5b..ccdd779165b 100644
--- a/nixos/modules/services/games/terraria.nix
+++ b/nixos/modules/services/games/terraria.nix
@@ -116,7 +116,7 @@ in
       openFirewall = mkOption {
         type = types.bool;
         default = false;
-        description = lib.mdDoc "Wheter to open ports in the firewall";
+        description = lib.mdDoc "Whether to open ports in the firewall";
       };
 
       dataDir = mkOption {
diff --git a/nixos/modules/services/hardware/argonone.nix b/nixos/modules/services/hardware/argonone.nix
index dc90e09e985..e67c2625062 100644
--- a/nixos/modules/services/hardware/argonone.nix
+++ b/nixos/modules/services/hardware/argonone.nix
@@ -9,7 +9,7 @@ in
     package = lib.mkOption {
       type = lib.types.package;
       default = pkgs.argononed;
-      defaultText = "pkgs.argononed";
+      defaultText = lib.literalExpression "pkgs.argononed";
       description = lib.mdDoc ''
         The package implementing the Argon One driver
       '';
diff --git a/nixos/modules/services/hardware/bluetooth.nix b/nixos/modules/services/hardware/bluetooth.nix
index 8b90c1913bc..6453e6968dc 100644
--- a/nixos/modules/services/hardware/bluetooth.nix
+++ b/nixos/modules/services/hardware/bluetooth.nix
@@ -50,14 +50,8 @@ in
         type = types.package;
         default = pkgs.bluez;
         defaultText = literalExpression "pkgs.bluez";
-        example = literalExpression "pkgs.bluezFull";
         description = lib.mdDoc ''
           Which BlueZ package to use.
-
-          ::: {.note}
-          Use the `pkgs.bluezFull` package to enable all
-          bluez plugins.
-          :::
         '';
       };
 
diff --git a/nixos/modules/services/hardware/joycond.nix b/nixos/modules/services/hardware/joycond.nix
index f4da00762a4..1af18b3b63d 100644
--- a/nixos/modules/services/hardware/joycond.nix
+++ b/nixos/modules/services/hardware/joycond.nix
@@ -14,7 +14,7 @@ with lib;
     package = mkOption {
       type = types.package;
       default = pkgs.joycond;
-      defaultText = "pkgs.joycond";
+      defaultText = lib.literalExpression "pkgs.joycond";
       description = lib.mdDoc ''
         The joycond package to use.
       '';
diff --git a/nixos/modules/services/hardware/supergfxd.nix b/nixos/modules/services/hardware/supergfxd.nix
index abb6bedb98f..5cc07e02f31 100644
--- a/nixos/modules/services/hardware/supergfxd.nix
+++ b/nixos/modules/services/hardware/supergfxd.nix
@@ -2,7 +2,7 @@
 
 let
   cfg = config.services.supergfxd;
-  ini = pkgs.formats.ini { };
+  json = pkgs.formats.json { };
 in
 {
   options = {
@@ -10,7 +10,7 @@ in
       enable = lib.mkEnableOption (lib.mdDoc "Enable the supergfxd service");
 
       settings = lib.mkOption {
-        type = lib.types.nullOr ini.type;
+        type = lib.types.nullOr json.type;
         default = null;
         description = lib.mdDoc ''
           The content of /etc/supergfxd.conf.
@@ -23,7 +23,7 @@ in
   config = lib.mkIf cfg.enable {
     environment.systemPackages = [ pkgs.supergfxctl ];
 
-    environment.etc."supergfxd.conf" = lib.mkIf (cfg.settings != null) (ini.generate "supergfxd.conf" cfg.settings);
+    environment.etc."supergfxd.conf".source = lib.mkIf (cfg.settings != null) (json.generate "supergfxd.conf" cfg.settings);
 
     services.dbus.enable = true;
 
diff --git a/nixos/modules/services/home-automation/home-assistant.nix b/nixos/modules/services/home-automation/home-assistant.nix
index 2962e52c08b..fa06e5391bb 100644
--- a/nixos/modules/services/home-automation/home-assistant.nix
+++ b/nixos/modules/services/home-automation/home-assistant.nix
@@ -435,6 +435,7 @@ in {
           "august"
           "august_ble"
           "airthings_ble"
+          "aranet"
           "bluemaestro"
           "bluetooth"
           "bluetooth_le_tracker"
@@ -453,8 +454,11 @@ in {
           "moat"
           "oralb"
           "qingping"
+          "ruuvitag_ble"
+          "sensirion_ble"
           "sensorpro"
           "sensorpush"
+          "shelly"
           "snooz"
           "switchbot"
           "thermobeacon"
diff --git a/nixos/modules/services/matrix/conduit.nix b/nixos/modules/services/matrix/conduit.nix
index 812d463e9e8..c8d89ed33f5 100644
--- a/nixos/modules/services/matrix/conduit.nix
+++ b/nixos/modules/services/matrix/conduit.nix
@@ -23,8 +23,7 @@ in
       package = mkOption {
         type = types.package;
         default = pkgs.matrix-conduit;
-        defaultText = "pkgs.matrix-conduit";
-        example = "pkgs.matrix-conduit";
+        defaultText = lib.literalExpression "pkgs.matrix-conduit";
         description = lib.mdDoc ''
           Package of the conduit matrix server to use.
         '';
diff --git a/nixos/modules/services/matrix/synapse.nix b/nixos/modules/services/matrix/synapse.nix
index 86662055222..a80d4cabfec 100644
--- a/nixos/modules/services/matrix/synapse.nix
+++ b/nixos/modules/services/matrix/synapse.nix
@@ -286,6 +286,7 @@ in {
             log_config = mkOption {
               type = types.path;
               default = ./synapse-log_config.yaml;
+              defaultText = lib.literalExpression "nixos/modules/services/matrix/synapse-log_config.yaml";
               description = lib.mdDoc ''
                 The file that holds the logging configuration.
               '';
diff --git a/nixos/modules/services/misc/autorandr.nix b/nixos/modules/services/misc/autorandr.nix
index 365fdd5fcc3..072064143db 100644
--- a/nixos/modules/services/misc/autorandr.nix
+++ b/nixos/modules/services/misc/autorandr.nix
@@ -258,7 +258,7 @@ in {
         type = hooksModule;
         description = lib.mdDoc "Global hook scripts";
         default = { };
-        example = ''
+        example = literalExpression ''
           {
             postswitch = {
               "notify-i3" = "''${pkgs.i3}/bin/i3-msg restart";
@@ -279,7 +279,7 @@ in {
                     exit 1
                 esac
                 echo "Xft.dpi: $DPI" | ''${pkgs.xorg.xrdb}/bin/xrdb -merge
-              '''
+              ''';
             };
           }
         '';
diff --git a/nixos/modules/services/misc/gitlab.nix b/nixos/modules/services/misc/gitlab.nix
index e206d5bb7c6..e7c707228f1 100644
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@@ -560,7 +560,7 @@ in {
           description = lib.mdDoc "GitLab container registry host name.";
         };
         port = mkOption {
-          type = types.int;
+          type = types.port;
           default = 4567;
           description = lib.mdDoc "GitLab container registry port.";
         };
@@ -613,7 +613,7 @@ in {
         };
 
         port = mkOption {
-          type = types.int;
+          type = types.port;
           default = 25;
           description = lib.mdDoc "Port of the SMTP server for GitLab.";
         };
diff --git a/nixos/modules/services/misc/heisenbridge.nix b/nixos/modules/services/misc/heisenbridge.nix
index 13ba362b33d..d07e0e42046 100644
--- a/nixos/modules/services/misc/heisenbridge.nix
+++ b/nixos/modules/services/misc/heisenbridge.nix
@@ -28,8 +28,7 @@ in
     package = mkOption {
       type = types.package;
       default = pkgs.heisenbridge;
-      defaultText = "pkgs.heisenbridge";
-      example = "pkgs.heisenbridge.override { … = …; }";
+      defaultText = lib.literalExpression "pkgs.heisenbridge";
       description = lib.mdDoc ''
         Package of the application to run, exposed for overriding purposes.
       '';
diff --git a/nixos/modules/services/misc/libreddit.nix b/nixos/modules/services/misc/libreddit.nix
index c961d13da47..fd58928d282 100644
--- a/nixos/modules/services/misc/libreddit.nix
+++ b/nixos/modules/services/misc/libreddit.nix
@@ -15,6 +15,13 @@ in
     services.libreddit = {
       enable = mkEnableOption (lib.mdDoc "Private front-end for Reddit");
 
+      package = mkOption {
+        type = types.package;
+        default = pkgs.libreddit;
+        defaultText = literalExpression "pkgs.libreddit";
+        description = lib.mdDoc "Libreddit package to use.";
+      };
+
       address = mkOption {
         default = "0.0.0.0";
         example = "127.0.0.1";
@@ -45,7 +52,7 @@ in
         after = [ "network.target" ];
         serviceConfig = {
           DynamicUser = true;
-          ExecStart = "${pkgs.libreddit}/bin/libreddit ${args}";
+          ExecStart = "${cfg.package}/bin/libreddit ${args}";
           AmbientCapabilities = lib.mkIf (cfg.port < 1024) [ "CAP_NET_BIND_SERVICE" ];
           Restart = "on-failure";
           RestartSec = "2s";
diff --git a/nixos/modules/services/misc/portunus.nix b/nixos/modules/services/misc/portunus.nix
index 0b283ea27d8..1dae605e46f 100644
--- a/nixos/modules/services/misc/portunus.nix
+++ b/nixos/modules/services/misc/portunus.nix
@@ -29,7 +29,7 @@ in
     package = mkOption {
       type = types.package;
       default = pkgs.portunus;
-      defaultText = "pkgs.portunus";
+      defaultText = lib.literalExpression "pkgs.portunus";
       description = lib.mdDoc "The Portunus package to use.";
     };
 
@@ -108,7 +108,7 @@ in
       package = mkOption {
         type = types.package;
         default = pkgs.openldap;
-        defaultText = "pkgs.openldap";
+        defaultText = lib.literalExpression "pkgs.openldap";
         description = lib.mdDoc "The OpenLDAP package to use.";
       };
 
diff --git a/nixos/modules/services/misc/ripple-data-api.nix b/nixos/modules/services/misc/ripple-data-api.nix
index 2663d734980..30623a32133 100644
--- a/nixos/modules/services/misc/ripple-data-api.nix
+++ b/nixos/modules/services/misc/ripple-data-api.nix
@@ -40,7 +40,7 @@ in {
       port = mkOption {
         description = lib.mdDoc "Ripple data api port";
         default = 5993;
-        type = types.int;
+        type = types.port;
       };
 
       importMode = mkOption {
@@ -77,7 +77,7 @@ in {
         port = mkOption {
           description = lib.mdDoc "Ripple data api redis port.";
           default = 5984;
-          type = types.int;
+          type = types.port;
         };
       };
 
@@ -91,7 +91,7 @@ in {
         port = mkOption {
           description = lib.mdDoc "Ripple data api couchdb port.";
           default = 5984;
-          type = types.int;
+          type = types.port;
         };
 
         db = mkOption {
diff --git a/nixos/modules/services/misc/sourcehut/default.nix b/nixos/modules/services/misc/sourcehut/default.nix
index aaa7bb05754..7dd254e3492 100644
--- a/nixos/modules/services/misc/sourcehut/default.nix
+++ b/nixos/modules/services/misc/sourcehut/default.nix
@@ -505,7 +505,7 @@ in
             description = lib.mdDoc "Origin URL for API, 100 more than web.";
             type = types.str;
             default = "http://${cfg.listenAddress}:${toString (cfg.meta.port + 100)}";
-            defaultText = ''http://<xref linkend="opt-services.sourcehut.listenAddress"/>:''${toString (<xref linkend="opt-services.sourcehut.meta.port"/> + 100)}'';
+            defaultText = lib.literalMD ''`"http://''${`[](#opt-services.sourcehut.listenAddress)`}:''${toString (`[](#opt-services.sourcehut.meta.port)` + 100)}"`'';
           };
           webhooks = mkOption {
             description = lib.mdDoc "The Redis connection used for the webhooks worker.";
diff --git a/nixos/modules/services/monitoring/grafana-agent.nix b/nixos/modules/services/monitoring/grafana-agent.nix
index ecb39a924f5..270d888afb7 100644
--- a/nixos/modules/services/monitoring/grafana-agent.nix
+++ b/nixos/modules/services/monitoring/grafana-agent.nix
@@ -16,7 +16,7 @@ in
     package = mkOption {
       type = types.package;
       default = pkgs.grafana-agent;
-      defaultText = "pkgs.grafana-agent";
+      defaultText = lib.literalExpression "pkgs.grafana-agent";
       description = lib.mdDoc "The grafana-agent package to use.";
     };
 
@@ -49,17 +49,19 @@ in
       };
 
       default = { };
-      defaultText = ''
-        metrics = {
-          wal_directory = "\''${STATE_DIRECTORY}";
-          global.scrape_interval = "5s";
-        };
-        integrations = {
-          agent.enabled = true;
-          agent.scrape_integration = true;
-          node_exporter.enabled = true;
-          replace_instance_label = true;
-        };
+      defaultText = lib.literalExpression ''
+        {
+          metrics = {
+            wal_directory = "\''${STATE_DIRECTORY}";
+            global.scrape_interval = "5s";
+          };
+          integrations = {
+            agent.enabled = true;
+            agent.scrape_integration = true;
+            node_exporter.enabled = true;
+            replace_instance_label = true;
+          };
+        }
       '';
       example = {
         metrics.global.remote_write = [{
diff --git a/nixos/modules/services/monitoring/graphite.nix b/nixos/modules/services/monitoring/graphite.nix
index 017e8a1ba47..8d92e60d3ba 100644
--- a/nixos/modules/services/monitoring/graphite.nix
+++ b/nixos/modules/services/monitoring/graphite.nix
@@ -225,7 +225,7 @@ in {
       port = mkOption {
         description = lib.mdDoc "Seyren listening port.";
         default = 8081;
-        type = types.int;
+        type = types.port;
       };
 
       seyrenUrl = mkOption {
diff --git a/nixos/modules/services/monitoring/kapacitor.nix b/nixos/modules/services/monitoring/kapacitor.nix
index 61529c2e452..727b694047b 100644
--- a/nixos/modules/services/monitoring/kapacitor.nix
+++ b/nixos/modules/services/monitoring/kapacitor.nix
@@ -66,7 +66,7 @@ in
     };
 
     port = mkOption {
-      type = types.int;
+      type = types.port;
       default = 9092;
       description = lib.mdDoc "Port of Kapacitor";
     };
diff --git a/nixos/modules/services/monitoring/prometheus/alertmanager.nix b/nixos/modules/services/monitoring/prometheus/alertmanager.nix
index ee2533ef121..8706a18a184 100644
--- a/nixos/modules/services/monitoring/prometheus/alertmanager.nix
+++ b/nixos/modules/services/monitoring/prometheus/alertmanager.nix
@@ -107,7 +107,7 @@ in {
       };
 
       port = mkOption {
-        type = types.int;
+        type = types.port;
         default = 9093;
         description = lib.mdDoc ''
           Port to listen on for the web interface and API.
diff --git a/nixos/modules/services/monitoring/prometheus/exporters/smartctl.nix b/nixos/modules/services/monitoring/prometheus/exporters/smartctl.nix
index df424ede606..0c5648c1414 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters/smartctl.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/smartctl.nix
@@ -4,16 +4,12 @@ with lib;
 
 let
   cfg = config.services.prometheus.exporters.smartctl;
-  format = pkgs.formats.yaml {};
-  configFile = format.generate "smartctl-exporter.yml" {
-    smartctl_exporter = {
-      bind_to = "${cfg.listenAddress}:${toString cfg.port}";
-      url_path = "/metrics";
-      smartctl_location = "${pkgs.smartmontools}/bin/smartctl";
-      collect_not_more_than_period = cfg.maxInterval;
-      devices = cfg.devices;
-    };
-  };
+  args = concatStrings [
+    "--web.listen-address=\"${cfg.listenAddress}:${toString cfg.port}\" "
+    "--smartctl.path=\"${pkgs.smartmontools}/bin/smartctl\" "
+    "--smartctl.interval=\"${cfg.maxInterval}\" "
+    "${concatMapStringsSep " " (device: "--smartctl.device=${device}") cfg.devices}"
+  ];
 in {
   port = 9633;
 
@@ -50,17 +46,13 @@ in {
         "CAP_SYS_ADMIN"
       ];
       DevicePolicy = "closed";
-      DeviceAllow = lib.mkOverride 50 (
-        if cfg.devices != [] then
-          cfg.devices
-        else [
-          "block-blkext rw"
-          "block-sd rw"
-          "char-nvme rw"
-        ]
-      );
+      DeviceAllow = lib.mkOverride 50 [
+        "block-blkext rw"
+        "block-sd rw"
+        "char-nvme rw"
+      ];
       ExecStart = ''
-        ${pkgs.prometheus-smartctl-exporter}/bin/smartctl_exporter -config ${configFile}
+        ${pkgs.prometheus-smartctl-exporter}/bin/smartctl_exporter ${args}
       '';
       PrivateDevices = lib.mkForce false;
       ProtectProc = "invisible";
diff --git a/nixos/modules/services/monitoring/uptime-kuma.nix b/nixos/modules/services/monitoring/uptime-kuma.nix
index 3a6091de679..b6dc993e6a0 100644
--- a/nixos/modules/services/monitoring/uptime-kuma.nix
+++ b/nixos/modules/services/monitoring/uptime-kuma.nix
@@ -13,9 +13,8 @@ in
 
       package = mkOption {
         type = types.package;
-        example = literalExpression "pkgs.uptime-kuma";
         default = pkgs.uptime-kuma;
-        defaultText = "pkgs.uptime-kuma";
+        defaultText = literalExpression "pkgs.uptime-kuma";
         description = lib.mdDoc "Uptime Kuma package to use.";
       };
 
diff --git a/nixos/modules/services/monitoring/zabbix-proxy.nix b/nixos/modules/services/monitoring/zabbix-proxy.nix
index e7e353f3660..85da416ba6c 100644
--- a/nixos/modules/services/monitoring/zabbix-proxy.nix
+++ b/nixos/modules/services/monitoring/zabbix-proxy.nix
@@ -102,7 +102,7 @@ in
         };
 
         port = mkOption {
-          type = types.int;
+          type = types.port;
           default = if cfg.database.type == "mysql" then mysql.port else pgsql.port;
           defaultText = literalExpression ''
             if config.${opt.database.type} == "mysql"
diff --git a/nixos/modules/services/network-filesystems/tahoe.nix b/nixos/modules/services/network-filesystems/tahoe.nix
index 4213f437f4b..14c0a3d4725 100644
--- a/nixos/modules/services/network-filesystems/tahoe.nix
+++ b/nixos/modules/services/network-filesystems/tahoe.nix
@@ -18,7 +18,7 @@ in
             };
             tub.port = mkOption {
               default = 3458;
-              type = types.int;
+              type = types.port;
               description = lib.mdDoc ''
                 The port on which the introducer will listen.
               '';
@@ -58,7 +58,7 @@ in
             };
             tub.port = mkOption {
               default = 3457;
-              type = types.int;
+              type = types.port;
               description = lib.mdDoc ''
                 The port on which the tub will listen.
 
@@ -80,7 +80,7 @@ in
             };
             web.port = mkOption {
               default = 3456;
-              type = types.int;
+              type = types.port;
               description = lib.mdDoc ''
                 The port on which the Web server will listen.
 
diff --git a/nixos/modules/services/networking/ddclient.nix b/nixos/modules/services/networking/ddclient.nix
index 5c32817979a..4d843641f58 100644
--- a/nixos/modules/services/networking/ddclient.nix
+++ b/nixos/modules/services/networking/ddclient.nix
@@ -71,7 +71,7 @@ with lib;
       package = mkOption {
         type = package;
         default = pkgs.ddclient;
-        defaultText = "pkgs.ddclient";
+        defaultText = lib.literalExpression "pkgs.ddclient";
         description = lib.mdDoc ''
           The ddclient executable package run by the service.
         '';
diff --git a/nixos/modules/services/networking/dnsmasq.nix b/nixos/modules/services/networking/dnsmasq.nix
index cfc37b74b9a..4886654e8c0 100644
--- a/nixos/modules/services/networking/dnsmasq.nix
+++ b/nixos/modules/services/networking/dnsmasq.nix
@@ -7,15 +7,27 @@ let
   dnsmasq = pkgs.dnsmasq;
   stateDir = "/var/lib/dnsmasq";
 
+  # True values are just put as `name` instead of `name=true`, and false values
+  # are turned to comments (false values are expected to be overrides e.g.
+  # mkForce)
+  formatKeyValue =
+    name: value:
+    if value == true
+    then name
+    else if value == false
+    then "# setting `${name}` explicitly set to false"
+    else generators.mkKeyValueDefault { } "=" name value;
+
+  settingsFormat = pkgs.formats.keyValue {
+    mkKeyValue = formatKeyValue;
+    listsAsDuplicateKeys = true;
+  };
+
+  # Because formats.generate is outputting a file, we use of conf-file. Once
+  # `extraConfig` is deprecated we can just use
+  # `dnsmasqConf = format.generate "dnsmasq.conf" cfg.settings`
   dnsmasqConf = pkgs.writeText "dnsmasq.conf" ''
-    dhcp-leasefile=${stateDir}/dnsmasq.leases
-    ${optionalString cfg.resolveLocalQueries ''
-      conf-file=/etc/dnsmasq-conf.conf
-      resolv-file=/etc/dnsmasq-resolv.conf
-    ''}
-    ${flip concatMapStrings cfg.servers (server: ''
-      server=${server}
-    '')}
+    conf-file=${settingsFormat.generate "dnsmasq.conf" cfg.settings}
     ${cfg.extraConfig}
   '';
 
@@ -23,6 +35,10 @@ in
 
 {
 
+  imports = [
+    (mkRenamedOptionModule [ "services" "dnsmasq" "servers" ] [ "services" "dnsmasq" "settings" "server" ])
+  ];
+
   ###### interface
 
   options = {
@@ -46,15 +62,6 @@ in
         '';
       };
 
-      servers = mkOption {
-        type = types.listOf types.str;
-        default = [];
-        example = [ "8.8.8.8" "8.8.4.4" ];
-        description = lib.mdDoc ''
-          The DNS servers which dnsmasq should query.
-        '';
-      };
-
       alwaysKeepRunning = mkOption {
         type = types.bool;
         default = false;
@@ -63,12 +70,49 @@ in
         '';
       };
 
+      settings = mkOption {
+        type = types.submodule {
+
+          freeformType = settingsFormat.type;
+
+          options.server = mkOption {
+            type = types.listOf types.str;
+            default = [ ];
+            example = [ "8.8.8.8" "8.8.4.4" ];
+            description = lib.mdDoc ''
+              The DNS servers which dnsmasq should query.
+            '';
+          };
+
+        };
+        default = { };
+        description = lib.mdDoc ''
+          Configuration of dnsmasq. Lists get added one value per line (empty
+          lists and false values don't get added, though false values get
+          turned to comments). Gets merged with
+
+              {
+                dhcp-leasefile = "${stateDir}/dnsmasq.leases";
+                conf-file = optional cfg.resolveLocalQueries "/etc/dnsmasq-conf.conf";
+                resolv-file = optional cfg.resolveLocalQueries "/etc/dnsmasq-resolv.conf";
+              }
+        '';
+        example = literalExpression ''
+          {
+            domain-needed = true;
+            dhcp-range = [ "192.168.0.2,192.168.0.254" ];
+          }
+        '';
+      };
+
       extraConfig = mkOption {
         type = types.lines;
         default = "";
         description = lib.mdDoc ''
           Extra configuration directives that should be added to
           `dnsmasq.conf`.
+
+          This option is deprecated, please use {option}`settings` instead.
         '';
       };
 
@@ -81,6 +125,14 @@ in
 
   config = mkIf cfg.enable {
 
+    warnings = lib.optional (cfg.extraConfig != "") "Text based config is deprecated, dnsmasq now supports `services.dnsmasq.settings` for an attribute-set based config";
+
+    services.dnsmasq.settings = {
+      dhcp-leasefile = mkDefault "${stateDir}/dnsmasq.leases";
+      conf-file = mkDefault (optional cfg.resolveLocalQueries "/etc/dnsmasq-conf.conf");
+      resolv-file = mkDefault (optional cfg.resolveLocalQueries "/etc/dnsmasq-resolv.conf");
+    };
+
     networking.nameservers =
       optional cfg.resolveLocalQueries "127.0.0.1";
 
diff --git a/nixos/modules/services/networking/ergochat.nix b/nixos/modules/services/networking/ergochat.nix
index 1a70b1f8613..a003512677e 100644
--- a/nixos/modules/services/networking/ergochat.nix
+++ b/nixos/modules/services/networking/ergochat.nix
@@ -17,10 +17,10 @@ in {
       configFile = lib.mkOption {
         type = lib.types.path;
         default = (pkgs.formats.yaml {}).generate "ergo.conf" cfg.settings;
-        defaultText = "generated config file from <literal>.settings</literal>";
+        defaultText = lib.literalMD "generated config file from `settings`";
         description = lib.mdDoc ''
           Path to configuration file.
-          Setting this will skip any configuration done via `.settings`
+          Setting this will skip any configuration done via `settings`
         '';
       };
 
diff --git a/nixos/modules/services/networking/morty.nix b/nixos/modules/services/networking/morty.nix
index 4b20c34cfc9..72514764a7c 100644
--- a/nixos/modules/services/networking/morty.nix
+++ b/nixos/modules/services/networking/morty.nix
@@ -50,7 +50,7 @@ in
       };
 
       port = mkOption {
-        type = types.int;
+        type = types.port;
         default = 3000;
         description = lib.mdDoc "Listing port";
       };
diff --git a/nixos/modules/services/networking/multipath.nix b/nixos/modules/services/networking/multipath.nix
index cb6b6db272c..54ee2a01568 100644
--- a/nixos/modules/services/networking/multipath.nix
+++ b/nixos/modules/services/networking/multipath.nix
@@ -28,7 +28,7 @@ in {
       type = package;
       description = lib.mdDoc "multipath-tools package to use";
       default = pkgs.multipath-tools;
-      defaultText = "pkgs.multipath-tools";
+      defaultText = lib.literalExpression "pkgs.multipath-tools";
     };
 
     devices = mkOption {
diff --git a/nixos/modules/services/networking/nomad.nix b/nixos/modules/services/networking/nomad.nix
index 5e5d9469efc..890ee0b7d8d 100644
--- a/nixos/modules/services/networking/nomad.nix
+++ b/nixos/modules/services/networking/nomad.nix
@@ -67,7 +67,7 @@ in
           Additional plugins dir used to configure nomad.
         '';
         example = literalExpression ''
-          [ "<pluginDir>" "pkgs.<plugins-name>"]
+          [ "<pluginDir>" pkgs.<plugins-name> ]
         '';
       };
 
diff --git a/nixos/modules/services/networking/nsd.nix b/nixos/modules/services/networking/nsd.nix
index 57da208bd7a..0ded9265209 100644
--- a/nixos/modules/services/networking/nsd.nix
+++ b/nixos/modules/services/networking/nsd.nix
@@ -588,7 +588,7 @@ in
     };
 
     port = mkOption {
-      type = types.int;
+      type = types.port;
       default = 53;
       description = lib.mdDoc ''
         Port the service should bind do.
@@ -825,7 +825,7 @@ in
       };
 
       port = mkOption {
-        type = types.int;
+        type = types.port;
         default = 8952;
         description = lib.mdDoc ''
           Port number for remote control operations (uses TLS over TCP).
diff --git a/nixos/modules/services/networking/nylon.nix b/nixos/modules/services/networking/nylon.nix
index 6ed832b6fa1..401dbe97c52 100644
--- a/nixos/modules/services/networking/nylon.nix
+++ b/nixos/modules/services/networking/nylon.nix
@@ -81,7 +81,7 @@ let
       };
 
       port = mkOption {
-        type = types.int;
+        type = types.port;
         default = 1080;
         description = lib.mdDoc ''
           What port to listen for client requests, default is 1080.
diff --git a/nixos/modules/services/networking/pdns-recursor.nix b/nixos/modules/services/networking/pdns-recursor.nix
index 473c2a1f1fb..2f07cefc736 100644
--- a/nixos/modules/services/networking/pdns-recursor.nix
+++ b/nixos/modules/services/networking/pdns-recursor.nix
@@ -38,7 +38,7 @@ in {
     };
 
     dns.port = mkOption {
-      type = types.int;
+      type = types.port;
       default = 53;
       description = lib.mdDoc ''
         Port number Recursor DNS server will bind to.
@@ -67,7 +67,7 @@ in {
     };
 
     api.port = mkOption {
-      type = types.int;
+      type = types.port;
       default = 8082;
       description = lib.mdDoc ''
         Port number Recursor REST API server will bind to.
diff --git a/nixos/modules/services/networking/redsocks.nix b/nixos/modules/services/networking/redsocks.nix
index 85ae3125ded..45feb1313c9 100644
--- a/nixos/modules/services/networking/redsocks.nix
+++ b/nixos/modules/services/networking/redsocks.nix
@@ -81,7 +81,7 @@ in
           };
 
           port = mkOption {
-            type = types.int;
+            type = types.port;
             default = 12345;
             description = lib.mdDoc "Port on which redsocks should listen.";
           };
diff --git a/nixos/modules/services/networking/sabnzbd.nix b/nixos/modules/services/networking/sabnzbd.nix
index 8486be1bc66..8f3545df899 100644
--- a/nixos/modules/services/networking/sabnzbd.nix
+++ b/nixos/modules/services/networking/sabnzbd.nix
@@ -20,7 +20,7 @@ in
       package = mkOption {
         type = types.package;
         default = pkgs.sabnzbd;
-        defaultText = "pkgs.sabnzbd";
+        defaultText = lib.literalExpression "pkgs.sabnzbd";
         description = lib.mdDoc "The sabnzbd executable package run by the service.";
       };
 
diff --git a/nixos/modules/services/networking/twingate.nix b/nixos/modules/services/networking/twingate.nix
new file mode 100644
index 00000000000..17140bffd21
--- /dev/null
+++ b/nixos/modules/services/networking/twingate.nix
@@ -0,0 +1,28 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.twingate;
+
+in {
+
+  options.services.twingate = {
+    enable = mkEnableOption (lib.mdDoc "Twingate Client daemon");
+  };
+
+  config = mkIf cfg.enable {
+
+    networking.firewall.checkReversePath = lib.mkDefault false;
+    networking.networkmanager.enable = true;
+
+    environment.systemPackages = [ pkgs.twingate ]; # for the CLI
+    systemd.packages = [ pkgs.twingate ];
+
+    systemd.services.twingate.preStart = ''
+      cp -r -n ${pkgs.twingate}/etc/twingate/. /etc/twingate/
+    '';
+
+    systemd.services.twingate.wantedBy = [ "multi-user.target" ];
+  };
+}
diff --git a/nixos/modules/services/networking/znc/options.nix b/nixos/modules/services/networking/znc/options.nix
index ce8e7a89a4d..bd67ec86d51 100644
--- a/nixos/modules/services/networking/znc/options.nix
+++ b/nixos/modules/services/networking/znc/options.nix
@@ -18,7 +18,7 @@ let
       };
 
       port = mkOption {
-        type = types.ints.u16;
+        type = types.port;
         default = 6697;
         description = lib.mdDoc ''
           IRC server port.
@@ -188,7 +188,7 @@ in
 
         port = mkOption {
           default = 5000;
-          type = types.int;
+          type = types.port;
           description = lib.mdDoc ''
             Specifies the port on which to listen.
           '';
diff --git a/nixos/modules/services/printing/ipp-usb.nix b/nixos/modules/services/printing/ipp-usb.nix
new file mode 100644
index 00000000000..0425eb91373
--- /dev/null
+++ b/nixos/modules/services/printing/ipp-usb.nix
@@ -0,0 +1,63 @@
+{ config, lib, pkgs, ... }: {
+  options = {
+    services.ipp-usb = {
+      enable = lib.mkEnableOption (lib.mdDoc "ipp-usb, a daemon to turn an USB printer/scanner supporting IPP everywhere (aka AirPrint, WSD, AirScan) into a locally accessible network printer/scanner");
+    };
+  };
+  config = lib.mkIf config.services.ipp-usb.enable {
+    systemd.services.ipp-usb = {
+      description = "Daemon for IPP over USB printer support";
+      after = [ "cups.service" "avahi-deamon.service" ];
+      wants = [ "avahi-daemon.service" ];
+      serviceConfig = {
+        ExecStart = [ "${pkgs.ipp-usb}/bin/ipp-usb" ];
+        Type = "simple";
+        Restart = "on-failure";
+        StateDirectory = "ipp-usb";
+        LogsDirectory = "ipp-usb";
+
+        # hardening.
+        ProtectHome = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProtectControlGroups = true;
+        MemoryDenyWriteExecute = true;
+        # breaks the daemon, presumably because it messes with DeviceAllow
+        ProtectClock = false;
+        ProtectKernelTunables = true;
+        ProtectKernelLogs = true;
+        ProtectSystem = "strict";
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        PrivateMounts = true;
+        ProtectHostname = true;
+        ProtectKernelModules = true;
+        RemoveIPC = true;
+        RestrictNamespaces = true;
+        AmbientCapabilities = "";
+        CapabilityBoundingSet = "";
+        NoNewPrivileges = true;
+        RestrictAddressFamilies = [ "AF_UNIX" "AF_NETLINK" "AF_INET" "AF_INET6" ];
+        ProtectProc = "noaccess";
+      };
+    };
+
+    # starts the systemd service
+    services.udev.packages = [ pkgs.ipp-usb ];
+    services.avahi = {
+      enable = true;
+      publish = {
+        enable = true;
+        userServices = true;
+      };
+    };
+    # enable printing and scanning by default, but not required.
+    services.printing.enable = lib.mkDefault true;
+    hardware.sane.enable = lib.mkDefault true;
+    # so that sane discovers scanners
+    hardware.sane.extraBackends = [ pkgs.sane-airscan ];
+  };
+}
+
+
diff --git a/nixos/modules/services/search/elasticsearch-curator.nix b/nixos/modules/services/search/elasticsearch-curator.nix
index f073ec7cf2b..0a21d705ef8 100644
--- a/nixos/modules/services/search/elasticsearch-curator.nix
+++ b/nixos/modules/services/search/elasticsearch-curator.nix
@@ -50,7 +50,7 @@ in {
     };
     port = mkOption {
       description = lib.mdDoc "the port that elasticsearch is listening on";
-      type = types.int;
+      type = types.port;
       default = 9200;
     };
     actionYAML = mkOption {
diff --git a/nixos/modules/services/search/elasticsearch.nix b/nixos/modules/services/search/elasticsearch.nix
index 4a9dd50310e..fa1627566eb 100644
--- a/nixos/modules/services/search/elasticsearch.nix
+++ b/nixos/modules/services/search/elasticsearch.nix
@@ -66,7 +66,7 @@ in
     port = mkOption {
       description = lib.mdDoc "Elasticsearch port to listen for HTTP traffic.";
       default = 9200;
-      type = types.int;
+      type = types.port;
     };
 
     tcp_port = mkOption {
diff --git a/nixos/modules/services/search/meilisearch.nix b/nixos/modules/services/search/meilisearch.nix
index 9262b927cba..3983b1b2c92 100644
--- a/nixos/modules/services/search/meilisearch.nix
+++ b/nixos/modules/services/search/meilisearch.nix
@@ -21,7 +21,7 @@ in
     package = mkOption {
       description = lib.mdDoc "The package to use for meilisearch. Use this if you require specific features to be enabled. The default package has no features.";
       default = pkgs.meilisearch;
-      defaultText = "pkgs.meilisearch";
+      defaultText = lib.literalExpression "pkgs.meilisearch";
       type = types.package;
     };
 
diff --git a/nixos/modules/services/security/opensnitch.nix b/nixos/modules/services/security/opensnitch.nix
index 8f1407b555f..98695b1ef06 100644
--- a/nixos/modules/services/security/opensnitch.nix
+++ b/nixos/modules/services/security/opensnitch.nix
@@ -91,7 +91,7 @@ in {
             InterceptUnknown = mkOption {
               type = types.bool;
               description = mdDoc ''
-                Wheter to intercept spare connections.
+                Whether to intercept spare connections.
               '';
             };
 
diff --git a/nixos/modules/services/system/kerberos/mit.nix b/nixos/modules/services/system/kerberos/mit.nix
index 25d7d51e808..11200014045 100644
--- a/nixos/modules/services/system/kerberos/mit.nix
+++ b/nixos/modules/services/system/kerberos/mit.nix
@@ -33,7 +33,7 @@ let
 in
 
 {
-  config = mkIf (cfg.enable && kerberos == pkgs.krb5Full) {
+  config = mkIf (cfg.enable && kerberos == pkgs.krb5) {
     systemd.services.kadmind = {
       description = "Kerberos Administration Daemon";
       wantedBy = [ "multi-user.target" ];
diff --git a/nixos/modules/services/web-apps/code-server.nix b/nixos/modules/services/web-apps/code-server.nix
index 0d6b6c529b6..24e34e0c583 100644
--- a/nixos/modules/services/web-apps/code-server.nix
+++ b/nixos/modules/services/web-apps/code-server.nix
@@ -15,7 +15,7 @@ in {
 
       package = mkOption {
         default = pkgs.code-server;
-        defaultText = "pkgs.code-server";
+        defaultText = lib.literalExpression "pkgs.code-server";
         description = lib.mdDoc "Which code-server derivation to use.";
         type = types.package;
       };
diff --git a/nixos/modules/services/web-apps/hedgedoc.nix b/nixos/modules/services/web-apps/hedgedoc.nix
index ea27eb7ba39..a623e45691d 100644
--- a/nixos/modules/services/web-apps/hedgedoc.nix
+++ b/nixos/modules/services/web-apps/hedgedoc.nix
@@ -449,7 +449,7 @@ in
               '';
             };
             port = mkOption {
-              type = types.int;
+              type = types.port;
               default = 9000;
               description = lib.mdDoc ''
                 Minio listen port.
diff --git a/nixos/modules/services/web-apps/invidious.nix b/nixos/modules/services/web-apps/invidious.nix
index e106478628f..a153aa3fb0c 100644
--- a/nixos/modules/services/web-apps/invidious.nix
+++ b/nixos/modules/services/web-apps/invidious.nix
@@ -151,7 +151,7 @@ in
     package = lib.mkOption {
       type = types.package;
       default = pkgs.invidious;
-      defaultText = "pkgs.invidious";
+      defaultText = lib.literalExpression "pkgs.invidious";
       description = lib.mdDoc "The Invidious package to use.";
     };
 
diff --git a/nixos/modules/services/web-apps/limesurvey.nix b/nixos/modules/services/web-apps/limesurvey.nix
index f6a1b559524..7093d1de0da 100644
--- a/nixos/modules/services/web-apps/limesurvey.nix
+++ b/nixos/modules/services/web-apps/limesurvey.nix
@@ -49,7 +49,7 @@ in
       };
 
       port = mkOption {
-        type = types.int;
+        type = types.port;
         default = if cfg.database.type == "pgsql" then 5442 else 3306;
         defaultText = literalExpression "3306";
         description = lib.mdDoc "Database host port.";
diff --git a/nixos/modules/services/web-apps/mastodon.nix b/nixos/modules/services/web-apps/mastodon.nix
index 8122c244949..35b96734be7 100644
--- a/nixos/modules/services/web-apps/mastodon.nix
+++ b/nixos/modules/services/web-apps/mastodon.nix
@@ -546,7 +546,7 @@ in {
       environment = env;
       serviceConfig = {
         Type = "oneshot";
-        EnvironmentFile = "/var/lib/mastodon/.secrets_env";
+        EnvironmentFile = [ "/var/lib/mastodon/.secrets_env" ];
         WorkingDirectory = cfg.package;
         # System Call Filtering
         SystemCallFilter = [ ("~" + lib.concatStringsSep " " (systemCallsList ++ [ "@resources" ])) "@chown" "pipe" "pipe2" ];
@@ -574,7 +574,7 @@ in {
         ExecStart = "${cfg.package}/run-streaming.sh";
         Restart = "always";
         RestartSec = 20;
-        EnvironmentFile = "/var/lib/mastodon/.secrets_env";
+        EnvironmentFile = [ "/var/lib/mastodon/.secrets_env" ];
         WorkingDirectory = cfg.package;
         # Runtime directory and mode
         RuntimeDirectory = "mastodon-streaming";
@@ -601,7 +601,7 @@ in {
         ExecStart = "${cfg.package}/bin/puma -C config/puma.rb";
         Restart = "always";
         RestartSec = 20;
-        EnvironmentFile = "/var/lib/mastodon/.secrets_env";
+        EnvironmentFile = [ "/var/lib/mastodon/.secrets_env" ];
         WorkingDirectory = cfg.package;
         # Runtime directory and mode
         RuntimeDirectory = "mastodon-web";
@@ -629,7 +629,7 @@ in {
         ExecStart = "${cfg.package}/bin/sidekiq -c ${toString cfg.sidekiqThreads} -r ${cfg.package}";
         Restart = "always";
         RestartSec = 20;
-        EnvironmentFile = "/var/lib/mastodon/.secrets_env";
+        EnvironmentFile = [ "/var/lib/mastodon/.secrets_env" ];
         WorkingDirectory = cfg.package;
         # System Call Filtering
         SystemCallFilter = [ ("~" + lib.concatStringsSep " " systemCallsList) "@chown" "pipe" "pipe2" ];
@@ -642,7 +642,7 @@ in {
       environment = env;
       serviceConfig = {
         Type = "oneshot";
-        EnvironmentFile = "/var/lib/mastodon/.secrets_env";
+        EnvironmentFile = [ "/var/lib/mastodon/.secrets_env" ];
       } // cfgService;
       script = let
         olderThanDays = toString cfg.mediaAutoRemove.olderThanDays;
diff --git a/nixos/modules/services/web-apps/mattermost.nix b/nixos/modules/services/web-apps/mattermost.nix
index 71292c47d63..99042821f5e 100644
--- a/nixos/modules/services/web-apps/mattermost.nix
+++ b/nixos/modules/services/web-apps/mattermost.nix
@@ -106,7 +106,7 @@ in
       package = mkOption {
         type = types.package;
         default = pkgs.mattermost;
-        defaultText = "pkgs.mattermost";
+        defaultText = lib.literalExpression "pkgs.mattermost";
         description = lib.mdDoc "Mattermost derivation to use.";
       };
 
@@ -238,7 +238,7 @@ in
         package = mkOption {
           type = types.package;
           default = pkgs.matterircd;
-          defaultText = "pkgs.matterircd";
+          defaultText = lib.literalExpression "pkgs.matterircd";
           description = lib.mdDoc "matterircd derivation to use.";
         };
         parameters = mkOption {
diff --git a/nixos/modules/services/web-apps/moodle.nix b/nixos/modules/services/web-apps/moodle.nix
index dc434d0fc80..5f8d9c5b15f 100644
--- a/nixos/modules/services/web-apps/moodle.nix
+++ b/nixos/modules/services/web-apps/moodle.nix
@@ -96,7 +96,7 @@ in
       };
 
       port = mkOption {
-        type = types.int;
+        type = types.port;
         description = lib.mdDoc "Database host port.";
         default = {
           mysql = 3306;
diff --git a/nixos/modules/services/web-apps/onlyoffice.nix b/nixos/modules/services/web-apps/onlyoffice.nix
index db4a9582794..1478e8da87a 100644
--- a/nixos/modules/services/web-apps/onlyoffice.nix
+++ b/nixos/modules/services/web-apps/onlyoffice.nix
@@ -29,7 +29,7 @@ in
     package = mkOption {
       type = types.package;
       default = pkgs.onlyoffice-documentserver;
-      defaultText = "pkgs.onlyoffice-documentserver";
+      defaultText = lib.literalExpression "pkgs.onlyoffice-documentserver";
       description = lib.mdDoc "Which package to use for the OnlyOffice instance.";
     };
 
diff --git a/nixos/modules/services/web-apps/peering-manager.nix b/nixos/modules/services/web-apps/peering-manager.nix
new file mode 100644
index 00000000000..0db2e8e4aed
--- /dev/null
+++ b/nixos/modules/services/web-apps/peering-manager.nix
@@ -0,0 +1,265 @@
+{ config, lib, pkgs, buildEnv, ... }:
+
+with lib;
+
+let
+  cfg = config.services.peering-manager;
+  configFile = pkgs.writeTextFile {
+    name = "configuration.py";
+    text = ''
+      ALLOWED_HOSTS = ['*']
+      DATABASE = {
+        'NAME': 'peering-manager',
+        'USER': 'peering-manager',
+        'HOST': '/run/postgresql',
+      }
+
+      # Redis database settings. Redis is used for caching and for queuing background tasks such as webhook events. A separate
+      # configuration exists for each. Full connection details are required in both sections, and it is strongly recommended
+      # to use two separate database IDs.
+      REDIS = {
+        'tasks': {
+          'UNIX_SOCKET_PATH': '${config.services.redis.servers.peering-manager.unixSocket}',
+          'DATABASE': 0,
+        },
+        'caching': {
+          'UNIX_SOCKET_PATH': '${config.services.redis.servers.peering-manager.unixSocket}',
+          'DATABASE': 1,
+        }
+      }
+
+      with open("${cfg.secretKeyFile}", "r") as file:
+        SECRET_KEY = file.readline()
+    '' + lib.optionalString (cfg.peeringdbApiKeyFile != null) ''
+      with open("${cfg.peeringdbApiKeyFile}", "r") as file:
+        PEERINGDB_API_KEY = file.readline()
+    '' + ''
+
+      ${cfg.extraConfig}
+    '';
+  };
+  pkg = (pkgs.peering-manager.overrideAttrs (old: {
+    postInstall = ''
+      ln -s ${configFile} $out/opt/peering-manager/peering_manager/configuration.py
+    '' + optionalString cfg.enableLdap ''
+      ln -s ${cfg.ldapConfigPath} $out/opt/peering-manager/peering_manager/ldap_config.py
+    '';
+  })).override {
+    inherit (cfg) plugins;
+  };
+  peeringManagerManageScript = with pkgs; (writeScriptBin "peering-manager-manage" ''
+    #!${stdenv.shell}
+    export PYTHONPATH=${pkg.pythonPath}
+    sudo -u peering-manager ${pkg}/bin/peering-manager "$@"
+  '');
+
+in {
+  options.services.peering-manager = {
+    enable = mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = lib.mdDoc ''
+        Enable Peering Manager.
+
+        This module requires a reverse proxy that serves `/static` separately.
+        See this [example](https://github.com/peering-manager-community/peering-manager/blob/develop/contrib/nginx.conf/) on how to configure this.
+      '';
+    };
+
+    listenAddress = mkOption {
+      type = types.str;
+      default = "[::1]";
+      description = lib.mdDoc ''
+        Address the server will listen on.
+      '';
+    };
+
+    port = mkOption {
+      type = types.port;
+      default = 8001;
+      description = lib.mdDoc ''
+        Port the server will listen on.
+      '';
+    };
+
+    plugins = mkOption {
+      type = types.functionTo (types.listOf types.package);
+      default = _: [];
+      defaultText = literalExpression ''
+        python3Packages: with python3Packages; [];
+      '';
+      description = lib.mdDoc ''
+        List of plugin packages to install.
+      '';
+    };
+
+    secretKeyFile = mkOption {
+      type = types.path;
+      description = lib.mdDoc ''
+        Path to a file containing the secret key.
+      '';
+    };
+
+    peeringdbApiKeyFile = mkOption {
+      type = with types; nullOr path;
+      default = null;
+      description = lib.mdDoc ''
+        Path to a file containing the PeeringDB API key.
+      '';
+    };
+
+    extraConfig = mkOption {
+      type = types.lines;
+      default = "";
+      description = lib.mdDoc ''
+        Additional lines of configuration appended to the `configuration.py`.
+        See the [documentation](https://peering-manager.readthedocs.io/en/stable/configuration/optional-settings/) for more possible options.
+      '';
+    };
+
+    enableLdap = mkOption {
+      type = types.bool;
+      default = false;
+      description = lib.mdDoc ''
+        Enable LDAP-Authentication for Peering Manager.
+
+        This requires a configuration file being pass through `ldapConfigPath`.
+      '';
+    };
+
+    ldapConfigPath = mkOption {
+      type = types.path;
+      description = lib.mdDoc ''
+        Path to the Configuration-File for LDAP-Authentification, will be loaded as `ldap_config.py`.
+        See the [documentation](https://peering-manager.readthedocs.io/en/stable/setup/6-ldap/#configuration) for possible options.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.peering-manager.plugins = mkIf cfg.enableLdap (ps: [ ps.django-auth-ldap ]);
+
+    system.build.peeringManagerPkg = pkg;
+
+    services.redis.servers.peering-manager.enable = true;
+
+    services.postgresql = {
+      enable = true;
+      ensureDatabases = [ "peering-manager" ];
+      ensureUsers = [
+        {
+          name = "peering-manager";
+          ensurePermissions = {
+            "DATABASE \"peering-manager\"" = "ALL PRIVILEGES";
+          };
+        }
+      ];
+    };
+
+    environment.systemPackages = [ peeringManagerManageScript ];
+
+    systemd.targets.peering-manager = {
+      description = "Target for all Peering Manager services";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network-online.target" "redis-peering-manager.service" ];
+    };
+
+    systemd.services = let
+      defaultServiceConfig = {
+        WorkingDirectory = "/var/lib/peering-manager";
+        User = "peering-manager";
+        Group = "peering-manager";
+        StateDirectory = "peering-manager";
+        StateDirectoryMode = "0750";
+        Restart = "on-failure";
+      };
+    in {
+      peering-manager-migration = {
+        description = "Peering Manager migrations";
+        wantedBy = [ "peering-manager.target" ];
+
+        environment = {
+          PYTHONPATH = pkg.pythonPath;
+        };
+
+        serviceConfig = defaultServiceConfig // {
+          Type = "oneshot";
+          ExecStart = ''
+            ${pkg}/bin/peering-manager migrate
+          '';
+        };
+      };
+
+      peering-manager = {
+        description = "Peering Manager WSGI Service";
+        wantedBy = [ "peering-manager.target" ];
+        after = [ "peering-manager-migration.service" ];
+
+        preStart = ''
+          ${pkg}/bin/peering-manager remove_stale_contenttypes --no-input
+        '';
+
+        environment = {
+          PYTHONPATH = pkg.pythonPath;
+        };
+
+        serviceConfig = defaultServiceConfig // {
+          ExecStart = ''
+            ${pkg.python.pkgs.gunicorn}/bin/gunicorn peering_manager.wsgi \
+              --bind ${cfg.listenAddress}:${toString cfg.port} \
+              --pythonpath ${pkg}/opt/peering-manager
+          '';
+        };
+      };
+
+      peering-manager-rq = {
+        description = "Peering Manager Request Queue Worker";
+        wantedBy = [ "peering-manager.target" ];
+        after = [ "peering-manager.service" ];
+
+        environment = {
+          PYTHONPATH = pkg.pythonPath;
+        };
+
+        serviceConfig = defaultServiceConfig // {
+          ExecStart = ''
+            ${pkg}/bin/peering-manager rqworker high default low
+          '';
+        };
+      };
+
+      peering-manager-housekeeping = {
+        description = "Peering Manager housekeeping job";
+        after = [ "peering-manager.service" ];
+
+        environment = {
+          PYTHONPATH = pkg.pythonPath;
+        };
+
+        serviceConfig = defaultServiceConfig // {
+          Type = "oneshot";
+          ExecStart = ''
+            ${pkg}/bin/peering-manager housekeeping
+          '';
+        };
+      };
+    };
+
+    systemd.timers.peering-manager-housekeeping = {
+      description = "Run Peering Manager housekeeping job";
+      wantedBy = [ "timers.target" ];
+
+      timerConfig = {
+        OnCalendar = "daily";
+      };
+    };
+
+    users.users.peering-manager = {
+      home = "/var/lib/peering-manager";
+      isSystemUser = true;
+      group = "peering-manager";
+    };
+    users.groups.peering-manager = {};
+    users.groups."${config.services.redis.servers.peering-manager.user}".members = [ "peering-manager" ];
+  };
+}
diff --git a/nixos/modules/services/web-apps/zabbix.nix b/nixos/modules/services/web-apps/zabbix.nix
index 0e43922f35d..2cea7e7cea7 100644
--- a/nixos/modules/services/web-apps/zabbix.nix
+++ b/nixos/modules/services/web-apps/zabbix.nix
@@ -51,7 +51,7 @@ in
 
       server = {
         port = mkOption {
-          type = types.int;
+          type = types.port;
           description = lib.mdDoc "The port of the Zabbix server to connect to.";
           default = 10051;
         };
@@ -78,7 +78,7 @@ in
         };
 
         port = mkOption {
-          type = types.int;
+          type = types.port;
           default =
             if cfg.database.type == "mysql" then config.services.mysql.port
             else if cfg.database.type == "pgsql" then config.services.postgresql.port
diff --git a/nixos/modules/services/web-servers/lighttpd/default.nix b/nixos/modules/services/web-servers/lighttpd/default.nix
index ec847495d74..811afe8e0af 100644
--- a/nixos/modules/services/web-servers/lighttpd/default.nix
+++ b/nixos/modules/services/web-servers/lighttpd/default.nix
@@ -137,7 +137,7 @@ in
 
       package = mkOption {
         default = pkgs.lighttpd;
-        defaultText = "pkgs.lighttpd";
+        defaultText = lib.literalExpression "pkgs.lighttpd";
         type = types.package;
         description = lib.mdDoc ''
           lighttpd package to use.
diff --git a/nixos/modules/services/web-servers/nginx/vhost-options.nix b/nixos/modules/services/web-servers/nginx/vhost-options.nix
index e3d4afc074c..2bdc046c0d8 100644
--- a/nixos/modules/services/web-servers/nginx/vhost-options.nix
+++ b/nixos/modules/services/web-servers/nginx/vhost-options.nix
@@ -29,7 +29,7 @@ with lib;
     listen = mkOption {
       type = with types; listOf (submodule { options = {
         addr = mkOption { type = str;  description = lib.mdDoc "IP address.";  };
-        port = mkOption { type = int;  description = lib.mdDoc "Port number."; default = 80; };
+        port = mkOption { type = port;  description = lib.mdDoc "Port number."; default = 80; };
         ssl  = mkOption { type = bool; description = lib.mdDoc "Enable SSL.";  default = false; };
         extraParameters = mkOption { type = listOf str; description = lib.mdDoc "Extra parameters of this listen directive."; default = []; example = [ "backlog=1024" "deferred" ]; };
       }; });
diff --git a/nixos/modules/services/x11/desktop-managers/cinnamon.nix b/nixos/modules/services/x11/desktop-managers/cinnamon.nix
index 8e6a44428fc..aaad1de5f87 100644
--- a/nixos/modules/services/x11/desktop-managers/cinnamon.nix
+++ b/nixos/modules/services/x11/desktop-managers/cinnamon.nix
@@ -67,11 +67,11 @@ in
 
         # Taken from mint-artwork.gschema.override
         theme = mkIf (notExcluded pkgs.cinnamon.mint-themes) {
-          name = mkDefault "Mint-X";
+          name = mkDefault "Mint-Y-Aqua";
           package = mkDefault pkgs.cinnamon.mint-themes;
         };
         iconTheme = mkIf (notExcluded pkgs.cinnamon.mint-x-icons) {
-          name = mkDefault "Mint-X-Dark";
+          name = mkDefault "Mint-Y-Aqua";
           package = mkDefault pkgs.cinnamon.mint-x-icons;
         };
         cursorTheme = mkIf (notExcluded pkgs.cinnamon.mint-cursor-themes) {
diff --git a/nixos/modules/system/activation/test.nix b/nixos/modules/system/activation/test.nix
new file mode 100644
index 00000000000..8cf000451c6
--- /dev/null
+++ b/nixos/modules/system/activation/test.nix
@@ -0,0 +1,27 @@
+{ lib
+, nixos
+, expect
+, testers
+}:
+let
+  node-forbiddenDependencies-fail = nixos ({ ... }: {
+    system.forbiddenDependenciesRegex = "-dev$";
+    environment.etc."dev-dependency" = {
+      text = "${expect.dev}";
+    };
+    documentation.enable = false;
+    fileSystems."/".device = "ignore-root-device";
+    boot.loader.grub.enable = false;
+  });
+  node-forbiddenDependencies-succeed = nixos ({ ... }: {
+    system.forbiddenDependenciesRegex = "-dev$";
+    system.extraDependencies = [ expect.dev ];
+    documentation.enable = false;
+    fileSystems."/".device = "ignore-root-device";
+    boot.loader.grub.enable = false;
+  });
+in
+lib.recurseIntoAttrs {
+  test-forbiddenDependencies-fail = testers.testBuildFailure node-forbiddenDependencies-fail.config.system.build.toplevel;
+  test-forbiddenDependencies-succeed = node-forbiddenDependencies-succeed.config.system.build.toplevel;
+}
diff --git a/nixos/modules/system/activation/top-level.nix b/nixos/modules/system/activation/top-level.nix
index 55ff98db538..64e97b510b0 100644
--- a/nixos/modules/system/activation/top-level.nix
+++ b/nixos/modules/system/activation/top-level.nix
@@ -77,7 +77,7 @@ let
 
       ${config.system.systemBuilderCommands}
 
-      echo -n "${toString config.system.extraDependencies}" > $out/extra-dependencies
+      echo -n "$extraDependencies" > $out/extra-dependencies
 
       ${config.system.extraSystemBuilderCmds}
     '';
@@ -105,6 +105,8 @@ let
     dryActivationScript = config.system.dryActivationScript;
     nixosLabel = config.system.nixos.label;
 
+    inherit (config.system) extraDependencies;
+
     # Needed by switch-to-configuration.
     perl = pkgs.perl.withPackages (p: with p; [ ConfigIniFiles FileSlurp ]);
   } // config.system.systemBuilderArgs);
@@ -223,6 +225,16 @@ in
       '';
     };
 
+    system.forbiddenDependenciesRegex = mkOption {
+      default = "";
+      example = "-dev$";
+      type = types.str;
+      description = lib.mdDoc ''
+        A POSIX Extended Regular Expression that matches store paths that
+        should not appear in the system closure, with the exception of {option}`system.extraDependencies`, which is not checked.
+      '';
+    };
+
     system.extraSystemBuilderCmds = mkOption {
       type = types.lines;
       internal = true;
@@ -298,8 +310,26 @@ in
         config.system.copySystemConfiguration
         ''ln -s '${import ../../../lib/from-env.nix "NIXOS_CONFIG" <nixos-config>}' \
             "$out/configuration.nix"
+        '' +
+      optionalString
+        (config.system.forbiddenDependenciesRegex != "")
+        ''
+          if [[ $forbiddenDependenciesRegex != "" && -n $closureInfo ]]; then
+            if forbiddenPaths="$(grep -E -- "$forbiddenDependenciesRegex" $closureInfo/store-paths)"; then
+              echo -e "System closure $out contains the following disallowed paths:\n$forbiddenPaths"
+              exit 1
+            fi
+          fi
         '';
 
+    system.systemBuilderArgs = lib.optionalAttrs (config.system.forbiddenDependenciesRegex != "") {
+      inherit (config.system) forbiddenDependenciesRegex;
+      closureInfo = pkgs.closureInfo { rootPaths = [
+        # override to avoid  infinite recursion (and to allow using extraDependencies to add forbidden dependencies)
+        (config.system.build.toplevel.overrideAttrs (_: { extraDependencies = []; closureInfo = null; }))
+      ]; };
+    };
+
     system.build.toplevel = system;
 
   };
diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix
index eae898a08a6..1b3c0e23f97 100644
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@@ -580,7 +580,7 @@ in
     virtualisation.host.pkgs = mkOption {
       type = options.nixpkgs.pkgs.type;
       default = pkgs;
-      defaultText = "pkgs";
+      defaultText = literalExpression "pkgs";
       example = literalExpression ''
         import pkgs.path { system = "x86_64-darwin"; }
       '';
@@ -595,7 +595,8 @@ in
         mkOption {
           type = types.package;
           default = cfg.host.pkgs.qemu_kvm;
-          example = "pkgs.qemu_test";
+          defaultText = literalExpression "config.virtualisation.host.pkgs.qemu_kvm";
+          example = literalExpression "pkgs.qemu_test";
           description = lib.mdDoc "QEMU package to use.";
         };
 
@@ -721,7 +722,7 @@ in
       firmware = mkOption {
         type = types.path;
         default = pkgs.OVMF.firmware;
-        defaultText = "pkgs.OVMF.firmware";
+        defaultText = literalExpression "pkgs.OVMF.firmware";
         description =
           lib.mdDoc ''
             Firmware binary for EFI implementation, defaults to OVMF.
@@ -731,7 +732,7 @@ in
       variables = mkOption {
         type = types.path;
         default = pkgs.OVMF.variables;
-        defaultText = "pkgs.OVMF.variables";
+        defaultText = literalExpression "pkgs.OVMF.variables";
         description =
           lib.mdDoc ''
             Platform-specific flash binary for EFI variables, implementation-dependent to the EFI firmware.
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 895cbe4290d..b372ae20480 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -113,6 +113,7 @@ in {
   calibre-web = handleTest ./calibre-web.nix {};
   cassandra_3_0 = handleTest ./cassandra.nix { testPackage = pkgs.cassandra_3_0; };
   cassandra_3_11 = handleTest ./cassandra.nix { testPackage = pkgs.cassandra_3_11; };
+  cassandra_4 = handleTest ./cassandra.nix { testPackage = pkgs.cassandra_4; };
   ceph-multi-node = handleTestOn ["x86_64-linux"] ./ceph-multi-node.nix {};
   ceph-single-node = handleTestOn ["x86_64-linux"] ./ceph-single-node.nix {};
   ceph-single-node-bluestore = handleTestOn ["x86_64-linux"] ./ceph-single-node-bluestore.nix {};
@@ -193,6 +194,7 @@ in {
   ergo = handleTest ./ergo.nix {};
   ergochat = handleTest ./ergochat.nix {};
   etc = pkgs.callPackage ../modules/system/etc/test.nix { inherit evalMinimalConfig; };
+  activation = pkgs.callPackage ../modules/system/activation/test.nix { };
   etcd = handleTestOn ["x86_64-linux"] ./etcd.nix {};
   etcd-cluster = handleTestOn ["x86_64-linux"] ./etcd-cluster.nix {};
   etebase-server = handleTest ./etebase-server.nix {};
@@ -488,6 +490,7 @@ in {
   parsedmarc = handleTest ./parsedmarc {};
   pdns-recursor = handleTest ./pdns-recursor.nix {};
   peerflix = handleTest ./peerflix.nix {};
+  peering-manager = handleTest ./web-apps/peering-manager.nix {};
   peertube = handleTestOn ["x86_64-linux"] ./web-apps/peertube.nix {};
   pgadmin4 = handleTest ./pgadmin4.nix {};
   pgadmin4-standalone = handleTest ./pgadmin4-standalone.nix {};
diff --git a/nixos/tests/bazarr.nix b/nixos/tests/bazarr.nix
index 2e49c958dd0..e59833e5e94 100644
--- a/nixos/tests/bazarr.nix
+++ b/nixos/tests/bazarr.nix
@@ -16,7 +16,6 @@ in
         enable = true;
         listenPort = port;
       };
-      nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) ["unrar"];
     };
 
   testScript = ''
diff --git a/nixos/tests/dnscrypt-proxy2.nix b/nixos/tests/dnscrypt-proxy2.nix
index 4435d77bbf3..a75a745d355 100644
--- a/nixos/tests/dnscrypt-proxy2.nix
+++ b/nixos/tests/dnscrypt-proxy2.nix
@@ -26,7 +26,7 @@ in {
       };
 
       services.dnsmasq.enable = true;
-      services.dnsmasq.servers = [ "127.0.0.1#${toString localProxyPort}" ];
+      services.dnsmasq.settings.server = [ "127.0.0.1#${toString localProxyPort}" ];
     };
   };
 
diff --git a/nixos/tests/docker-tools.nix b/nixos/tests/docker-tools.nix
index e76a4613192..98704ecb2fb 100644
--- a/nixos/tests/docker-tools.nix
+++ b/nixos/tests/docker-tools.nix
@@ -419,6 +419,20 @@ import ./make-test-python.nix ({ pkgs, ... }: {
             "docker rmi layered-image-with-path",
         )
 
+    with subtest("Ensure correct architecture is present in manifests."):
+        docker.succeed("""
+            docker load --input='${examples.build-image-with-architecture}'
+            docker inspect build-image-with-architecture \
+              | ${pkgs.jq}/bin/jq -er '.[] | select(.Architecture=="arm64").Architecture'
+            docker rmi build-image-with-architecture
+        """)
+        docker.succeed("""
+            ${examples.layered-image-with-architecture} | docker load
+            docker inspect layered-image-with-architecture \
+              | ${pkgs.jq}/bin/jq -er '.[] | select(.Architecture=="arm64").Architecture'
+            docker rmi layered-image-with-architecture
+        """)
+
     with subtest("etc"):
         docker.succeed("${examples.etc} | docker load")
         docker.succeed("docker run --rm etc | grep localhost")
diff --git a/nixos/tests/kerberos/mit.nix b/nixos/tests/kerberos/mit.nix
index b475b7e4c92..7e427ffef0b 100644
--- a/nixos/tests/kerberos/mit.nix
+++ b/nixos/tests/kerberos/mit.nix
@@ -9,7 +9,7 @@ import ../make-test-python.nix ({pkgs, ...}: {
     };
     krb5 = {
       enable = true;
-      kerberos = pkgs.krb5Full;
+      kerberos = pkgs.krb5;
       libdefaults = {
         default_realm = "FOO.BAR";
       };
diff --git a/nixos/tests/krb5/example-config.nix b/nixos/tests/krb5/example-config.nix
index 1125b02f01c..9a5c3b2af24 100644
--- a/nixos/tests/krb5/example-config.nix
+++ b/nixos/tests/krb5/example-config.nix
@@ -11,7 +11,7 @@ import ../make-test-python.nix ({ pkgs, ...} : {
     { pkgs, ... }: {
       krb5 = {
         enable = true;
-        kerberos = pkgs.krb5Full;
+        kerberos = pkgs.krb5;
         libdefaults = {
           default_realm = "ATHENA.MIT.EDU";
         };
diff --git a/nixos/tests/kubernetes/dns.nix b/nixos/tests/kubernetes/dns.nix
index 6299b7ff988..1b7145eb5d5 100644
--- a/nixos/tests/kubernetes/dns.nix
+++ b/nixos/tests/kubernetes/dns.nix
@@ -69,7 +69,7 @@ let
   extraConfiguration = { config, pkgs, lib, ... }: {
     environment.systemPackages = [ pkgs.bind.host ];
     services.dnsmasq.enable = true;
-    services.dnsmasq.servers = [
+    services.dnsmasq.settings.server = [
       "/cluster.local/${config.services.kubernetes.addons.dns.clusterIp}#53"
     ];
   };
diff --git a/nixos/tests/prometheus-exporters.nix b/nixos/tests/prometheus-exporters.nix
index cdf666378fa..8b40d7e41c0 100644
--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@@ -1086,13 +1086,8 @@ let
         ];
       };
       exporterTest = ''
-        wait_for_unit("prometheus-smartctl-exporter.service")
-        wait_for_open_port(9633)
         wait_until_succeeds(
-          "curl -sSf 'localhost:9633/metrics'"
-        )
-        wait_until_succeeds(
-            'journalctl -eu prometheus-smartctl-exporter.service -o cat | grep "/dev/vda: Unable to detect device type"'
+            'journalctl -eu prometheus-smartctl-exporter.service -o cat | grep "Device unavailable"'
         )
       '';
     };
diff --git a/nixos/tests/schleuder.nix b/nixos/tests/schleuder.nix
index a9e4cc325bc..e57ef66bb8f 100644
--- a/nixos/tests/schleuder.nix
+++ b/nixos/tests/schleuder.nix
@@ -82,9 +82,7 @@ import ./make-test-python.nix {
     # Since we don't have internet here, use dnsmasq to provide MX records from /etc/hosts
     services.dnsmasq = {
       enable = true;
-      extraConfig = ''
-        selfmx
-      '';
+      settings.selfmx = true;
     };
 
     networking.extraHosts = ''
diff --git a/nixos/tests/web-apps/peering-manager.nix b/nixos/tests/web-apps/peering-manager.nix
new file mode 100644
index 00000000000..56b7eebfadf
--- /dev/null
+++ b/nixos/tests/web-apps/peering-manager.nix
@@ -0,0 +1,40 @@
+import ../make-test-python.nix ({ lib, pkgs, ... }: {
+  name = "peering-manager";
+
+  meta = with lib.maintainers; {
+    maintainers = [ yuka ];
+  };
+
+  nodes.machine = { ... }: {
+    services.peering-manager = {
+      enable = true;
+      secretKeyFile = pkgs.writeText "secret" ''
+        abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
+      '';
+    };
+  };
+
+  testScript = { nodes }: ''
+    machine.start()
+    machine.wait_for_unit("peering-manager.target")
+    machine.wait_until_succeeds("journalctl --since -1m --unit peering-manager --grep Listening")
+
+    print(machine.succeed(
+        "curl -sSfL http://[::1]:8001"
+    ))
+    with subtest("Home screen loads"):
+        machine.succeed(
+            "curl -sSfL http://[::1]:8001 | grep '<title>Home - Peering Manager</title>'"
+        )
+    with subtest("checks succeed"):
+        machine.succeed(
+            "systemctl stop peering-manager peering-manager-rq"
+        )
+        machine.succeed(
+            "sudo -u postgres psql -c 'ALTER USER \"peering-manager\" WITH SUPERUSER;'"
+        )
+        machine.succeed(
+            "cd ${nodes.machine.config.system.build.peeringManagerPkg}/opt/peering-manager ; peering-manager-manage test --no-input"
+        )
+  '';
+})
diff --git a/pkgs/applications/audio/audacity/default.nix b/pkgs/applications/audio/audacity/default.nix
index c12cc30df26..7acf919ea5e 100644
--- a/pkgs/applications/audio/audacity/default.nix
+++ b/pkgs/applications/audio/audacity/default.nix
@@ -67,7 +67,7 @@
 let
   inherit (lib) optionals;
   pname = "audacity";
-  version = "3.2.1";
+  version = "3.2.2";
 in
 stdenv.mkDerivation rec {
   inherit pname version;
@@ -76,7 +76,7 @@ stdenv.mkDerivation rec {
     owner = pname;
     repo = pname;
     rev = "Audacity-${version}";
-    sha256 = "sha256-7rfttp9LnfM2LBT5seupPyDckS7LEzWDZoqtLsGgqgI=";
+    sha256 = "sha256-vDkIBsXINo7g8lbDfXYTaz2AB6HWPc5resITllVNd6o=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/audio/cardinal/default.nix b/pkgs/applications/audio/cardinal/default.nix
index e1f6d25c2d7..f1487312684 100644
--- a/pkgs/applications/audio/cardinal/default.nix
+++ b/pkgs/applications/audio/cardinal/default.nix
@@ -21,12 +21,12 @@
 
 stdenv.mkDerivation rec {
   pname = "cardinal";
-  version = "22.10";
+  version = "22.11";
 
   src = fetchurl {
     url =
       "https://github.com/DISTRHO/Cardinal/releases/download/${version}/cardinal+deps-${version}.tar.xz";
-    sha256 = "sha256-qr6akeSN0y6cDVZ8Y6SNuJ8OnAuwrlJL1pqhPPJ+/EQ=";
+    sha256 = "sha256-xYQi209whY5/lN+6Fp7PTp7JSzL6RS6VL+Exst7RrS0=";
   };
 
   prePatch = ''
diff --git a/pkgs/applications/audio/mmtc/default.nix b/pkgs/applications/audio/mmtc/default.nix
index db6e0d27be7..5a229f0ae34 100644
--- a/pkgs/applications/audio/mmtc/default.nix
+++ b/pkgs/applications/audio/mmtc/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mmtc";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "figsoda";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-fWd349IDlN6XNv7MrqJeLwkmevZoKXLSz8a09YWsNcI=";
+    sha256 = "sha256-7jQwa4BfyI1CPnMt1YEP9rE6cok90FbEJpyLAPFuxtE=";
   };
 
-  cargoSha256 = "sha256-WrEC3zWwY1plOn8DrspbJFI3R/fE6yDQT2u2lVubbQU=";
+  cargoSha256 = "sha256-f18aXs8PyA0IaGnPG568ZB/oPsAO+U44WsoDNEgKKXk=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/applications/audio/praat/default.nix b/pkgs/applications/audio/praat/default.nix
index b41913c4b91..9ef53b980b9 100644
--- a/pkgs/applications/audio/praat/default.nix
+++ b/pkgs/applications/audio/praat/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "praat";
-  version = "6.3.01";
+  version = "6.3.02";
 
   src = fetchFromGitHub {
     owner = "praat";
     repo = "praat";
     rev = "v${version}";
-    sha256 = "sha256-BgfVbD/xQ3IaTMJhac6eSnbZQdBTDdqboruxSbKvbyE=";
+    sha256 = "sha256-sn/GWCw1bxtFjUUKkrPZVOe5qRQ5ATyII52CPHmlB3g=";
   };
 
   configurePhase = ''
diff --git a/pkgs/applications/audio/pt2-clone/default.nix b/pkgs/applications/audio/pt2-clone/default.nix
index bbabcb45187..77695f96896 100644
--- a/pkgs/applications/audio/pt2-clone/default.nix
+++ b/pkgs/applications/audio/pt2-clone/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pt2-clone";
-  version = "1.53.1";
+  version = "1.54";
 
   src = fetchFromGitHub {
     owner = "8bitbubsy";
     repo = "pt2-clone";
     rev = "v${version}";
-    sha256 = "sha256-7qBvv4D86uX8oqqJ+UDI+fbaG5g1+Zg1otuU9lqyTdo=";
+    sha256 = "sha256-d/BUt6jqJmw2MnerbvvhuUWpTHgQr47XuSoFDXo7GEQ=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/audio/sooperlooper/default.nix b/pkgs/applications/audio/sooperlooper/default.nix
index a05a0174afc..63cb7398201 100644
--- a/pkgs/applications/audio/sooperlooper/default.nix
+++ b/pkgs/applications/audio/sooperlooper/default.nix
@@ -9,7 +9,7 @@
 , libxml2
 , libjack2
 , libsndfile
-, wxGTK30-gtk3
+, wxGTK30
 , libsigcxx
 , libsamplerate
 , rubberband
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
     libxml2
     libjack2
     libsndfile
-    wxGTK30-gtk3
+    wxGTK30
     libsigcxx
     libsamplerate
     rubberband
diff --git a/pkgs/applications/audio/soundux/default.nix b/pkgs/applications/audio/soundux/default.nix
new file mode 100644
index 00000000000..f6616e58353
--- /dev/null
+++ b/pkgs/applications/audio/soundux/default.nix
@@ -0,0 +1,142 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, pkg-config
+, makeBinaryWrapper
+, pipewire
+, libpulseaudio
+, libappindicator
+, libstartup_notification
+, openssl
+, libwnck
+, pcre
+, util-linux
+, libselinux
+, libsepol
+, libthai
+, libdatrie
+, xorg
+, libxkbcommon
+, libepoxy
+, dbus
+, at-spi2-core
+, nlohmann_json
+, fancypp
+, httplib
+, semver-cpp
+, webkitgtk
+, yt-dlp
+, ffmpeg
+, lsb-release
+}:
+
+stdenv.mkDerivation rec {
+  pname = "soundux";
+  version = "0.2.7";
+
+  src = fetchFromGitHub {
+    owner = "Soundux";
+    repo = "Soundux";
+    rev = version;
+    sha256 = "sha256-aSCsg6nJt6F+6O7UeXnvYva0vllTfsxK/cjaeOhObZY=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    makeBinaryWrapper
+  ];
+
+  buildInputs = [
+    pipewire
+    libpulseaudio
+    libappindicator
+    openssl
+    libwnck
+    pcre
+    util-linux
+    libselinux
+    libsepol
+    libthai
+    libdatrie
+    xorg.libXdmcp
+    xorg.libXtst
+    xorg.libXres
+    libxkbcommon
+    libepoxy
+    dbus
+    at-spi2-core
+    nlohmann_json
+    fancypp
+    httplib
+    semver-cpp
+    libstartup_notification
+    webkitgtk
+    yt-dlp
+    ffmpeg
+  ];
+
+  postPatch = ''
+    # cannot be overwritten with variables
+    substituteInPlace CMakeLists.txt \
+      --replace "set(CMAKE_INSTALL_PREFIX \"/opt/soundux\" CACHE PATH \"Install path prefix, prepended onto install directories.\" FORCE)" "" \
+      --replace "/usr/share" "$out/usr/share"
+    substituteInPlace src/ui/impl/webview/webview.cpp \
+      --replace "/usr/share/pixmaps/soundux.png" "$out/share/pixmaps/soundux.png"
+  '';
+
+  # We need to append /opt to our CMAKE_INSTALL_PREFIX
+  dontAddPrefix = true;
+
+  preConfigure = ''
+    # This needs to be set in preConfigure to access the $prefix variable
+    export cmakeFlags="-DCMAKE_INSTALL_PREFIX=$prefix/opt $cmakeFlags"
+
+    # Replace some fetched submodules with symlinks nix packages.
+    rm -rf \
+      lib/json \
+      lib/fancypp \
+      lib/lib-httplib \
+      lib/semver
+
+    ln -s ${nlohmann_json} lib/json
+    ln -s ${fancypp} lib/fancypp
+    ln -s ${httplib} lib/lib-httplib
+    ln -s ${semver-cpp} lib/semver
+  '';
+
+  # Somehow some of the install destination paths in the build system still
+  # gets transformed to point to /var/empty/share, even though they are at least
+  # relative to the nix output directory with our earlier patching.
+  postInstall = ''
+    mv "$out/var/empty/share" "$out"
+    rm -rf "$out/var"
+    mkdir "$out/bin"
+    ln -s "$out/opt/soundux" "$out/bin"
+    substituteInPlace "$out/share/applications/soundux.desktop" \
+      --replace "/opt/soundux/soundux" "soundux"
+  '';
+
+  postFixup = let
+    rpaths = lib.makeLibraryPath [libwnck pipewire libpulseaudio];
+  in ''
+    # Wnck, PipeWire, and PulseAudio are dlopen-ed by Soundux, so they do
+    # not end up on the RPATH during the build process.
+    patchelf --add-rpath "${rpaths}" "$out/opt/soundux-${version}"
+
+    # Work around upstream bug https://github.com/Soundux/Soundux/issues/435
+    wrapProgram "$out/bin/soundux" \
+      --set WEBKIT_DISABLE_COMPOSITING_MODE 1 \
+      --prefix PATH : ${lib.makeBinPath [ yt-dlp ffmpeg lsb-release ]} \
+  '';
+
+  meta = with lib; {
+    description = "A cross-platform soundboard.";
+    homepage = "https://soundux.rocks/";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ aidalgol ];
+  };
+}
diff --git a/pkgs/applications/audio/spek/default.nix b/pkgs/applications/audio/spek/default.nix
index 1a73b8adea7..74c53f96efd 100644
--- a/pkgs/applications/audio/spek/default.nix
+++ b/pkgs/applications/audio/spek/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, intltool, pkg-config, ffmpeg, wxGTK30-gtk3, wrapGAppsHook }:
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, intltool, pkg-config, ffmpeg, wxGTK30, gtk3, wrapGAppsHook }:
 
 stdenv.mkDerivation rec {
   pname = "spek";
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook intltool pkg-config wrapGAppsHook ];
 
-  buildInputs = [ ffmpeg wxGTK30-gtk3 wxGTK30-gtk3.gtk ];
+  buildInputs = [ ffmpeg wxGTK30 gtk3 ];
 
   meta = with lib; {
     description = "Analyse your audio files by showing their spectrogram";
diff --git a/pkgs/applications/backup/deja-dup/default.nix b/pkgs/applications/backup/deja-dup/default.nix
index 9055b46284c..afe3cde3a59 100644
--- a/pkgs/applications/backup/deja-dup/default.nix
+++ b/pkgs/applications/backup/deja-dup/default.nix
@@ -22,14 +22,14 @@
 
 stdenv.mkDerivation rec {
   pname = "deja-dup";
-  version = "43.4";
+  version = "44.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = pname;
     rev = version;
-    sha256 = "sha256-8eqrBQrMvS4cta5RP0ibo4Zc3B8hlkftxaRyvb6JuEY=";
+    sha256 = "sha256-dIH6VPgzJxvXEUtPAYQzpQ8I9R9MwsfeylV25ASfW/k=";
   };
 
   patches = [
diff --git a/pkgs/applications/backup/unifi-protect-backup/default.nix b/pkgs/applications/backup/unifi-protect-backup/default.nix
index dbfff51d8fd..b3d5acb8562 100644
--- a/pkgs/applications/backup/unifi-protect-backup/default.nix
+++ b/pkgs/applications/backup/unifi-protect-backup/default.nix
@@ -2,7 +2,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "unifi-protect-backup";
-  version = "0.7.4";
+  version = "0.8.3";
 
   format = "pyproject";
 
@@ -10,12 +10,14 @@ python3.pkgs.buildPythonApplication rec {
     owner = "ep1cman";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-4Kpz89yqKmxHmnaPYpvJ2hx46yfcaCYjOioyya+38vE=";
+    hash = "sha256-3iOaJZAvkhjiWLKI1m2hmVkWLaNtq74nQZYIm/XCgeA=";
   };
 
   preBuild = ''
     sed -i 's_click = "8.0.1"_click = "^8"_' pyproject.toml
     sed -i 's_pyunifiprotect = .*_pyunifiprotect = "*"_' pyproject.toml
+    sed -i 's_aiorun = .*_aiorun = "*"_' pyproject.toml
+    sed -i '/pylint/d' pyproject.toml
   '';
 
   nativeBuildInputs = with python3.pkgs; [
@@ -24,6 +26,8 @@ python3.pkgs.buildPythonApplication rec {
 
   propagatedBuildInputs = with python3.pkgs; [
     aiocron
+    aiorun
+    aiosqlite
     click
     pyunifiprotect
   ];
diff --git a/pkgs/applications/blockchains/electrs/default.nix b/pkgs/applications/blockchains/electrs/default.nix
index 35470a7b854..0bc5c7baa41 100644
--- a/pkgs/applications/blockchains/electrs/default.nix
+++ b/pkgs/applications/blockchains/electrs/default.nix
@@ -24,8 +24,7 @@ rustPlatform.buildRustPackage rec {
   cargoHash = "sha256-p4t+G13XaCl7+IbX5YyBFF0PmARbw4XlRvnA0PRcjvQ=";
 
   # needed for librocksdb-sys
-  nativeBuildInputs = [ llvmPackages.clang ];
-  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
+  nativeBuildInputs = [ rustPlatform.bindgenHook ];
 
   # link rocksdb dynamically
   ROCKSDB_INCLUDE_DIR = "${rocksdb}/include";
diff --git a/pkgs/applications/blockchains/ledger-live-desktop/default.nix b/pkgs/applications/blockchains/ledger-live-desktop/default.nix
index 4f6ae53ec78..3bed576e5db 100644
--- a/pkgs/applications/blockchains/ledger-live-desktop/default.nix
+++ b/pkgs/applications/blockchains/ledger-live-desktop/default.nix
@@ -2,11 +2,11 @@
 
 let
   pname = "ledger-live-desktop";
-  version = "2.49.2";
+  version = "2.50.0";
 
   src = fetchurl {
     url = "https://download.live.ledger.com/${pname}-${version}-linux-x86_64.AppImage";
-    hash = "sha256-8KGZRTJu3uGFyf4vogoC9kDrKegD8Op4Z7gqQK+UFl8=";
+    hash = "sha256-Xh0UwE2rgFmUI4mx/PHqhRkgw51/CuNPxrsxI9al2E8=";
   };
 
   appimageContents = appimageTools.extractType2 {
diff --git a/pkgs/applications/blockchains/lighthouse/default.nix b/pkgs/applications/blockchains/lighthouse/default.nix
index c778ce3f757..8b54cc09315 100644
--- a/pkgs/applications/blockchains/lighthouse/default.nix
+++ b/pkgs/applications/blockchains/lighthouse/default.nix
@@ -10,6 +10,7 @@
 , protobuf
 , rustPlatform
 , Security
+, CoreFoundation
 , stdenv
 , testers
 , unzip
@@ -17,7 +18,7 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "lighthouse";
-  version = "3.2.1";
+  version = "3.3.0";
 
   # lighthouse/common/deposit_contract/build.rs
   depositContractSpecVersion = "0.12.1";
@@ -27,21 +28,21 @@ rustPlatform.buildRustPackage rec {
     owner = "sigp";
     repo = "lighthouse";
     rev = "v${version}";
-    sha256 = "sha256-Aqc3kk1rquhLKNZDlEun4bQpKI4Nsk7+Wr7E2IkJQEs=";
+    hash = "sha256-py64CWY3k5Z2mm9WduJ4Fh7lQ8b3sF6iIFsYYjndU5I=";
   };
 
-  cargoSha256 = "sha256-wGEk7OfEmyeRW65kq5stvKCdnCjfssyXUmNWGkGq42M=";
+  cargoHash = "sha256-0gWTniLkhuPpgdUkE6gpF9uHYT6BeWWgH6Mu7KpFx9w=";
 
   buildFeatures = [ "modern" "gnosis" ];
 
-  nativeBuildInputs = [ clang cmake perl protobuf ];
+  nativeBuildInputs = [ rustPlatform.bindgenHook cmake perl protobuf ];
 
   buildInputs = lib.optionals stdenv.isDarwin [
     Security
+  ] ++ lib.optionals (stdenv.isDarwin && stdenv.isx86_64) [
+    CoreFoundation
   ];
 
-  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
-
   depositContractSpec = fetchurl {
     url = "https://raw.githubusercontent.com/ethereum/eth2.0-specs/v${depositContractSpecVersion}/deposit_contract/contracts/validator_registration.json";
     hash = "sha256-ZslAe1wkmkg8Tua/AmmEfBmjqMVcGIiYHwi+WssEwa8=";
diff --git a/pkgs/applications/blockchains/lndhub-go/default.nix b/pkgs/applications/blockchains/lndhub-go/default.nix
index a563703c6bc..74f0d4f9f7b 100644
--- a/pkgs/applications/blockchains/lndhub-go/default.nix
+++ b/pkgs/applications/blockchains/lndhub-go/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "lndhub-go";
-  version = "0.10.0";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "getAlby";
     repo = "lndhub.go";
     rev = "${version}";
-    sha256 = "sha256-f/CkmO0KHupmi4XZDWRbvesLnYIxT6DlThgX3S/kdJ8=";
+    sha256 = "sha256-UGrIj/0ysU4i6PQVkuIeyGdKNCMa9LxikaIPhSKGvaQ=";
   };
 
-  vendorSha256 = "sha256-SWQudULFRMrKmxY6ZgH0NL8d6UPxowQnovhRx+209D4=";
+  vendorSha256 = "sha256-AiRbUSgMoU8nTzis/7H9HRW2/xZxXFf39JipRbukeiA=";
 
   doCheck = false; # tests require networking
 
diff --git a/pkgs/applications/blockchains/nearcore/default.nix b/pkgs/applications/blockchains/nearcore/default.nix
index e484538f416..a929406cee9 100644
--- a/pkgs/applications/blockchains/nearcore/default.nix
+++ b/pkgs/applications/blockchains/nearcore/default.nix
@@ -4,7 +4,7 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "nearcore";
-  version = "1.29.2";
+  version = "1.29.3";
 
   # https://github.com/near/nearcore/tags
   src = fetchFromGitHub {
@@ -13,10 +13,10 @@ rustPlatform.buildRustPackage rec {
     # there is also a branch for this version number, so we need to be explicit
     rev = "refs/tags/${version}";
 
-    sha256 = "sha256-dVju9emwTqNQCYST4HuwSWdafM0yxVS3JXXJqCdFEpc=";
+    sha256 = "sha256-Qbpp+ITWVFbigWLdSDHAo5JhHejEN2FknRIjcpcS2wY=";
   };
 
-  cargoSha256 = "sha256-k/JzKbWn5M+H6w1UEv2APzZNBZOBYZY09keyCrXaGCM=";
+  cargoSha256 = "sha256-GSgzJNpVGxbvGF6AtFQxGyev/9c8Roav1HBz0SCQyvw=";
   cargoPatches = [ ./0001-make-near-test-contracts-optional.patch ];
 
   postPatch = ''
@@ -42,14 +42,12 @@ rustPlatform.buildRustPackage rec {
   nativeBuildInputs = [
     pkg-config
     protobuf
+    rustPlatform.bindgenHook
   ];
 
   # fat LTO requires ~3.4GB RAM
   requiredSystemFeatures = [ "big-parallel" ];
 
-  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
-  BINDGEN_EXTRA_CLANG_ARGS = "-isystem ${llvmPackages.libclang.lib}/lib/clang/${lib.getVersion llvmPackages.clang}/include";
-
   meta = with lib; {
     description = "Reference client for NEAR Protocol";
     homepage = "https://github.com/near/nearcore";
diff --git a/pkgs/applications/blockchains/polkadot/default.nix b/pkgs/applications/blockchains/polkadot/default.nix
index 443fe36143c..596130337c7 100644
--- a/pkgs/applications/blockchains/polkadot/default.nix
+++ b/pkgs/applications/blockchains/polkadot/default.nix
@@ -36,14 +36,13 @@ rustPlatform.buildRustPackage rec {
 
   buildInputs = lib.optionals stdenv.isDarwin [ Security ];
 
-  nativeBuildInputs = [ clang ];
+  nativeBuildInputs = [ rustPlatform.bindgenHook ];
 
   preBuild = ''
     export SUBSTRATE_CLI_GIT_COMMIT_HASH=$(cat .git_commit)
     rm .git_commit
   '';
 
-  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
   PROTOC = "${protobuf}/bin/protoc";
 
   # NOTE: We don't build the WASM runtimes since this would require a more
diff --git a/pkgs/applications/blockchains/snarkos/default.nix b/pkgs/applications/blockchains/snarkos/default.nix
index 82c3555f64d..fe8b24b6ca2 100644
--- a/pkgs/applications/blockchains/snarkos/default.nix
+++ b/pkgs/applications/blockchains/snarkos/default.nix
@@ -23,15 +23,13 @@ rustPlatform.buildRustPackage rec {
 
   # buildAndTestSubdir = "cli";
 
-  nativeBuildInputs = lib.optionals stdenv.isLinux [ pkg-config llvmPackages.clang ];
+  nativeBuildInputs = lib.optionals stdenv.isLinux [ pkg-config rustPlatform.bindgenHook ];
 
   # Needed to get openssl-sys to use pkg-config.
   OPENSSL_NO_VENDOR = 1;
   OPENSSL_LIB_DIR = "${lib.getLib openssl}/lib";
   OPENSSL_DIR="${lib.getDev openssl}";
 
-  LIBCLANG_PATH="${llvmPackages.libclang.lib}/lib";
-
   # TODO check why rust compilation fails by including the rocksdb from nixpkgs
   # Used by build.rs in the rocksdb-sys crate. If we don't set these, it would
   # try to build RocksDB from source.
diff --git a/pkgs/applications/blockchains/solana-validator/default.nix b/pkgs/applications/blockchains/solana-validator/default.nix
index 503d4b404e7..bb35f7be388 100644
--- a/pkgs/applications/blockchains/solana-validator/default.nix
+++ b/pkgs/applications/blockchains/solana-validator/default.nix
@@ -68,12 +68,9 @@ rustPlatform.buildRustPackage rec {
   cargoBuildFlags = builtins.map (n: "--bin=${n}") solanaPkgs;
 
   # weird errors. see https://github.com/NixOS/nixpkgs/issues/52447#issuecomment-852079285
-  LIBCLANG_PATH = "${libclang.lib}/lib";
-  BINDGEN_EXTRA_CLANG_ARGS =
-    "-isystem ${libclang.lib}/lib/clang/${lib.getVersion clang}/include";
-  LLVM_CONFIG_PATH = "${llvm}/bin/llvm-config";
+  # LLVM_CONFIG_PATH = "${llvm}/bin/llvm-config";
 
-  nativeBuildInputs = [ clang llvm pkg-config protobuf rustfmt perl ];
+  nativeBuildInputs = [ pkg-config protobuf rustfmt perl rustPlatform.bindgenHook ];
   buildInputs =
     [ openssl zlib libclang hidapi ] ++ (lib.optionals stdenv.isLinux [ udev ]);
   strictDeps = true;
diff --git a/pkgs/applications/blockchains/teos/default.nix b/pkgs/applications/blockchains/teos/default.nix
index 197246770d0..b1fb1a77c1d 100644
--- a/pkgs/applications/blockchains/teos/default.nix
+++ b/pkgs/applications/blockchains/teos/default.nix
@@ -38,11 +38,8 @@ let
     perl  # used by openssl-sys to configure
     protobuf
     rustfmt
-    llvmPackages.clang
+    rustPlatform.bindgenHook
   ];
-
-
-  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
 in
 {
   teos = rustPlatform.buildRustPackage {
@@ -50,7 +47,7 @@ in
     cargoSha256 = "sha256-7VYYYSMJ2JP1KuA8sD0X3wInubH/jbA/sgzsTsomyEc=";
     buildAndTestSubdir = "teos";
 
-    inherit version src cargoPatches buildInputs nativeBuildInputs LIBCLANG_PATH;
+    inherit version src cargoPatches buildInputs nativeBuildInputs;
 
     meta = common.meta // {
       description = "A Lightning watchtower compliant with BOLT13, written in Rust";
@@ -66,7 +63,7 @@ in
     cargoSha256 = "sha256-xL+DiEfgBYJQ1UJm7LAr1/f34pkU8FRl4Seic8MFAlM=";
     buildAndTestSubdir = "watchtower-plugin";
 
-    inherit version src cargoPatches buildInputs nativeBuildInputs LIBCLANG_PATH;
+    inherit version src cargoPatches buildInputs nativeBuildInputs;
 
     meta = common.meta // {
       description = "A Lightning watchtower plugin for clightning";
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/tsc/default.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/tsc/default.nix
index a9462298979..9825ed0834a 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/tsc/default.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/tsc/default.nix
@@ -43,13 +43,9 @@ let
 
     pname = "tsc-dyn";
 
-    nativeBuildInputs = [ clang ];
+    nativeBuildInputs = [ rustPlatform.bindgenHook ];
     sourceRoot = "source/core";
 
-    configurePhase = ''
-      export LIBCLANG_PATH="${llvmPackages.libclang.lib}/lib"
-    '';
-
     postInstall = ''
       LIB=($out/lib/libtsc_dyn.*)
       TSC_PATH=$out/share/emacs/site-lisp/elpa/tsc-${version}
diff --git a/pkgs/applications/editors/gnome-builder/default.nix b/pkgs/applications/editors/gnome-builder/default.nix
index e7a018b26c6..634fd79282d 100644
--- a/pkgs/applications/editors/gnome-builder/default.nix
+++ b/pkgs/applications/editors/gnome-builder/default.nix
@@ -41,13 +41,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-builder";
-  version = "43.2";
+  version = "43.4";
 
   outputs = [ "out" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "dzIhF6ERsnR7zOitYFeKZ5wgIeSGkRz29OY0FjKKuzM=";
+    sha256 = "Hg1tZ4RcGb7J463VlpX5pTHXKg5UKyA6zJD7OBInwrw=";
   };
 
   patches = [
diff --git a/pkgs/applications/editors/helix/default.nix b/pkgs/applications/editors/helix/default.nix
index d3d0c7c2f93..55135c255bf 100644
--- a/pkgs/applications/editors/helix/default.nix
+++ b/pkgs/applications/editors/helix/default.nix
@@ -2,17 +2,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "helix";
-  version = "22.08.1";
+  version = "22.12";
 
   # This release tarball includes source code for the tree-sitter grammars,
   # which is not ordinarily part of the repository.
   src = fetchzip {
     url = "https://github.com/helix-editor/helix/releases/download/${version}/helix-${version}-source.tar.xz";
-    sha256 = "sha256-pqAhUxKeFN7eebVdNN3Ge38sA30SUSu4Xn4HDZAjjyY=";
+    sha256 = "sha256-En6SOyAPNPPzDGdm2XTjbGG0NQFGBVzjjoyCbdnHFao=";
     stripRoot = false;
   };
 
-  cargoSha256 = "sha256-idItRkymr+cxk3zv2mPBR/frCGvzEUdSAhY7gghfR3M=";
+  cargoSha256 = "sha256-oSS0LkLg2JSRLYoF0+FVQzFUJtFuVKtU2MWYenmFC0s=";
 
   nativeBuildInputs = [ installShellFiles makeWrapper ];
 
diff --git a/pkgs/applications/editors/jove/default.nix b/pkgs/applications/editors/jove/default.nix
index 2fd28714481..01a428a9fd6 100644
--- a/pkgs/applications/editors/jove/default.nix
+++ b/pkgs/applications/editors/jove/default.nix
@@ -1,21 +1,24 @@
-{ lib, stdenv, fetchFromGitHub
+{ lib
+, stdenv
+, fetchFromGitHub
 , groff
-, ncurses
 , makeWrapper
-} :
+, ncurses
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "jove";
-  version = "4.17.4.6";
+  version = "4.17.4.7";
 
   src = fetchFromGitHub {
     owner = "jonmacs";
     repo = "jove";
-    rev = version;
-    sha256 = "sha256-UCjqF0i43TSvtG5uxb2SA/F9oGBeo/WdEVJlrSSHV8g=";
+    rev = finalAttrs.version;
+    sha256 = "sha256-a8amp8JAI25XIeL8MzvJEAvv6B0oIaQvUOQlAaS3PeI=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
+
   buildInputs = [
     groff
     ncurses
@@ -34,11 +37,13 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    description = "Jonathan's Own Version of Emacs";
     homepage = "https://github.com/jonmacs/jove";
+    description = "Jonathan's Own Version of Emacs";
+    changelog = "https://github.com/jonmacs/jove/releases/tag/${finalAttrs.version}";
     license = licenses.bsd2;
     maintainers = with maintainers; [ AndersonTorres ];
     platforms = platforms.unix;
-    broken = stdenv.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/trunk/jove.x86_64-darwin
+    # never built on Hydra: https://hydra.nixos.org/job/nixpkgs/trunk/jove.x86_64-darwin
+    broken = stdenv.isDarwin;
   };
-}
+})
diff --git a/pkgs/applications/editors/kakoune/plugins/update-shell.nix b/pkgs/applications/editors/kakoune/plugins/update-shell.nix
index ca83f09c715..b323574169a 100644
--- a/pkgs/applications/editors/kakoune/plugins/update-shell.nix
+++ b/pkgs/applications/editors/kakoune/plugins/update-shell.nix
@@ -2,7 +2,7 @@
 
 with pkgs;
 let
-  pyEnv = python3.withPackages (ps: [ ps.GitPython ]);
+  pyEnv = python3.withPackages (ps: [ ps.gitpython ]);
 in
 
 mkShell {
diff --git a/pkgs/applications/editors/neovim/default.nix b/pkgs/applications/editors/neovim/default.nix
index 0a3b5ca421d..98859ec2ef3 100644
--- a/pkgs/applications/editors/neovim/default.nix
+++ b/pkgs/applications/editors/neovim/default.nix
@@ -12,12 +12,10 @@
 , nodejs ? null, fish ? null, python3 ? null
 }:
 
-with lib;
-
 let
   neovimLuaEnv = lua.withPackages(ps:
     (with ps; [ lpeg luabitop mpack ]
-    ++ optionals doCheck [
+    ++ lib.optionals doCheck [
         nvim-client luv coxpcall busted luafilesystem penlight inspect
       ]
     ));
@@ -61,8 +59,8 @@ in
       neovimLuaEnv
       tree-sitter
       unibilium
-    ] ++ optionals stdenv.isDarwin [ libiconv CoreServices ]
-      ++ optionals doCheck [ glibcLocales procps ]
+    ] ++ lib.optionals stdenv.isDarwin [ libiconv CoreServices ]
+      ++ lib.optionals doCheck [ glibcLocales procps ]
     ;
 
     inherit doCheck;
@@ -86,7 +84,6 @@ in
       pyEnv      # for src/clint.py
     ];
 
-
     # nvim --version output retains compilation flags and references to build tools
     postPatch = ''
       substituteInPlace src/nvim/version.c --replace NVIM_VERSION_CFLAGS "";
@@ -101,7 +98,7 @@ in
       # third-party/CMakeLists.txt is not read at all.
       "-DUSE_BUNDLED=OFF"
     ]
-    ++ optional (!lua.pkgs.isLuaJIT) "-DPREFER_LUA=ON"
+    ++ lib.optional (!lua.pkgs.isLuaJIT) "-DPREFER_LUA=ON"
     ;
 
     preConfigure = lib.optionalString stdenv.isDarwin ''
@@ -112,7 +109,7 @@ in
       export VIMRUNTIME=$PWD/runtime
     '';
 
-    meta = {
+    meta = with lib; {
       description = "Vim text editor fork focused on extensibility and agility";
       longDescription = ''
         Neovim is a project that seeks to aggressively refactor Vim in order to:
diff --git a/pkgs/applications/editors/tiled/default.nix b/pkgs/applications/editors/tiled/default.nix
index 7be6d489710..03c6d19b80c 100644
--- a/pkgs/applications/editors/tiled/default.nix
+++ b/pkgs/applications/editors/tiled/default.nix
@@ -1,19 +1,65 @@
-{ lib, mkDerivation, fetchFromGitHub, pkg-config, qmake
-, python3, qtbase, qttools }:
+{ lib
+, stdenv
+, env
+, fetchFromGitHub
+, pkg-config
+, qbs
+, wrapQtAppsHook
+, qtbase
+, qtdeclarative
+, qttools
+, qtsvg
+, zlib
+, libGL
+}:
 
-mkDerivation rec {
+let
+  qtEnv = env "tiled-qt-env" [ qtbase qtdeclarative qtsvg qttools ];
+in
+
+stdenv.mkDerivation rec {
   pname = "tiled";
-  version = "1.8.4";
+  version = "1.9.2";
 
   src = fetchFromGitHub {
     owner = "bjorn";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-QYA2krbwH807BkzVST+/+sjSR6So/aGY/YenEjYxE48=";
+    sha256 = "sha256-026OO7r8n1BUapUtKRHvqKdSZiClTQIiYfajiC2TAcQ=";
   };
 
-  nativeBuildInputs = [ pkg-config qmake ];
-  buildInputs = [ python3 qtbase qttools ];
+  nativeBuildInputs = [ pkg-config qbs wrapQtAppsHook ];
+  buildInputs = [ qtEnv zlib libGL ];
+
+  outputs = [ "out" "dev" ];
+
+  strictDeps = true;
+
+  configurePhase = ''
+    runHook preConfigure
+
+    qbs setup-qt --settings-dir . ${qtEnv}/bin/qmake qtenv
+    qbs config --settings-dir . defaultProfile qtenv
+    qbs resolve --settings-dir . config:release qbs.installPrefix:/ projects.Tiled.installHeaders:true
+
+    runHook postConfigure
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    qbs build --settings-dir . config:release
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    qbs install --settings-dir . --install-root $out config:release
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     description = "Free, easy to use and flexible tile map editor";
diff --git a/pkgs/applications/editors/vim/macvim.nix b/pkgs/applications/editors/vim/macvim.nix
index 806e2f9d4fd..f5b79ecdb01 100644
--- a/pkgs/applications/editors/vim/macvim.nix
+++ b/pkgs/applications/editors/vim/macvim.nix
@@ -1,19 +1,20 @@
-{ lib, stdenv, fetchFromGitHub, runCommand, ncurses, gettext
-, pkg-config, cscope, ruby, tcl, perl, luajit
+{ lib
+, stdenv
+, fetchFromGitHub
+, runCommand
+, ncurses
+, gettext
+, pkg-config
+, cscope
+, ruby
+, tcl
+, perl
+, luajit
 , darwin
-
-, usePython27 ? false
-, python27 ? null, python37 ? null
+, python37
 }:
 
 let
-  python = if usePython27
-           then { pkg = python27; name = "python"; }
-           else { pkg = python37; name = "python3"; };
-in
-assert python.pkg != null;
-
-let
   # Building requires a few system tools to be in PATH.
   # Some of these we could patch into the relevant source files (such as xcodebuild and
   # qlmanage) but some are used by Xcode itself and we have no choice but to put them in PATH.
@@ -40,7 +41,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ pkg-config buildSymlinks ];
   buildInputs = [
-    gettext ncurses cscope luajit ruby tcl perl python.pkg
+    gettext ncurses cscope luajit ruby tcl perl python37
   ];
 
   patches = [ ./macvim.patch ];
@@ -53,14 +54,14 @@ stdenv.mkDerivation {
       "--enable-multibyte"
       "--enable-nls"
       "--enable-luainterp=dynamic"
-      "--enable-${python.name}interp=dynamic"
+      "--enable-python3interp=dynamic"
       "--enable-perlinterp=dynamic"
       "--enable-rubyinterp=dynamic"
       "--enable-tclinterp=yes"
       "--without-local-dir"
       "--with-luajit"
       "--with-lua-prefix=${luajit}"
-      "--with-${python.name}-command=${python.pkg}/bin/${python.name}"
+      "--with-python3-command=${python37}/bin/python3"
       "--with-ruby-command=${ruby}/bin/ruby"
       "--with-tclsh=${tcl}/bin/tclsh"
       "--with-tlib=ncurses"
@@ -158,7 +159,7 @@ stdenv.mkDerivation {
     libperl=$(dirname $(find ${perl} -name "libperl.dylib"))
     install_name_tool -add_rpath ${luajit}/lib $exe
     install_name_tool -add_rpath ${tcl}/lib $exe
-    install_name_tool -add_rpath ${python.pkg}/lib $exe
+    install_name_tool -add_rpath ${python37}/lib $exe
     install_name_tool -add_rpath $libperl $exe
     install_name_tool -add_rpath ${ruby}/lib $exe
 
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 0e7f5ecb3ed..6188496a80b 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -161,12 +161,12 @@ final: prev:
 
   LeaderF = buildVimPluginFrom2Nix {
     pname = "LeaderF";
-    version = "2022-10-13";
+    version = "2022-12-06";
     src = fetchFromGitHub {
       owner = "Yggdroot";
       repo = "LeaderF";
-      rev = "ebb1f3a20b83a950938c59200434a4e66b69612d";
-      sha256 = "0f25qsfpk5m92cc70pjjsbh1ph11aybw2rfraxwdrcywwdr61w7w";
+      rev = "1326f60715adf6c434c0a6287e071af02d13dc26";
+      sha256 = "1zk7xy8fm5hqvbcn3jcpw7x0l4vcjx7zi09a04xvds1jf09s8l6g";
     };
     meta.homepage = "https://github.com/Yggdroot/LeaderF/";
   };
@@ -281,12 +281,12 @@ final: prev:
 
   SchemaStore-nvim = buildVimPluginFrom2Nix {
     pname = "SchemaStore.nvim";
-    version = "2022-11-30";
+    version = "2022-12-06";
     src = fetchFromGitHub {
       owner = "b0o";
       repo = "SchemaStore.nvim";
-      rev = "39260e77f7471da2a14182f83ac58e1d2b1ff5be";
-      sha256 = "07jqpm7vhm10pjni0i4q0bjzf5mahi9rvz698cj66idzkmz2i89k";
+      rev = "cb67722e14fbfafd2ba3913bd9850005816ccccf";
+      sha256 = "1afsd603v2v68d7cwp9vhjbdy5b89jwrkrra284akc1gmzkbck3d";
     };
     meta.homepage = "https://github.com/b0o/SchemaStore.nvim/";
   };
@@ -486,12 +486,12 @@ final: prev:
 
   aerial-nvim = buildVimPluginFrom2Nix {
     pname = "aerial.nvim";
-    version = "2022-11-29";
+    version = "2022-12-01";
     src = fetchFromGitHub {
       owner = "stevearc";
       repo = "aerial.nvim";
-      rev = "38c6fe1c199b8f35918f7efc09cae3f8af56fd68";
-      sha256 = "0p5b05psbhm5aig4106vc6cd795zqwnc0blnngi3jb1snvzb22a5";
+      rev = "50d28ad4e3e1ff89b5fc1bff985760c19c2fa782";
+      sha256 = "1m8wix6myx572d13qbn3g77az9zwbiszcldjk1nqq3isz2ix2b8n";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/stevearc/aerial.nvim/";
@@ -535,12 +535,12 @@ final: prev:
 
   ale = buildVimPluginFrom2Nix {
     pname = "ale";
-    version = "2022-11-25";
+    version = "2022-12-06";
     src = fetchFromGitHub {
       owner = "dense-analysis";
       repo = "ale";
-      rev = "5ce2bf84ca00cee8f375f108952789302980ae57";
-      sha256 = "0494g5nd7289zvmk5k0x7wh1psiwdx3vnhzjz7sf3rcxi8nifc7g";
+      rev = "42a17dec166783dc50b7105a0837f715fe9bd432";
+      sha256 = "1l8g4aiyxw207nrrb0vjbyqc1n91smxv5g8n8m0hd6wlw0fia1ls";
     };
     meta.homepage = "https://github.com/dense-analysis/ale/";
   };
@@ -703,12 +703,12 @@ final: prev:
 
   aurora = buildVimPluginFrom2Nix {
     pname = "aurora";
-    version = "2022-11-15";
+    version = "2022-12-02";
     src = fetchFromGitHub {
       owner = "ray-x";
       repo = "aurora";
-      rev = "87ecb98982f11bb62a61a2ed4d46676c72918a4d";
-      sha256 = "147yd7v21y8b59wj89zc103q1lp8dzmkyciby2nn8qb1kzvwvh0g";
+      rev = "40e5b7d38b08b32a872986959cfad79b2ac00f12";
+      sha256 = "0xc6h7kpwjg3nmxlpzg1q2kbr396kq1wirgrrb8lfg6bywr8iari";
     };
     meta.homepage = "https://github.com/ray-x/aurora/";
   };
@@ -799,24 +799,24 @@ final: prev:
 
   barbar-nvim = buildVimPluginFrom2Nix {
     pname = "barbar.nvim";
-    version = "2022-11-21";
+    version = "2022-12-03";
     src = fetchFromGitHub {
       owner = "romgrk";
       repo = "barbar.nvim";
-      rev = "9347ed838e0bfd8993d29eac1294f82b8e04c0c3";
-      sha256 = "0iyxsvp2n2achwc8pxwb554wkv5dhsnblgydrh8wwkdld6116sva";
+      rev = "e5f1393350cf842389be289c03885b92ab29ffb3";
+      sha256 = "1dkbplm6h7gmf4w7gjs823qjczvvmlqqpnljlb91mglqpcd7wc87";
     };
     meta.homepage = "https://github.com/romgrk/barbar.nvim/";
   };
 
   barbecue-nvim = buildVimPluginFrom2Nix {
     pname = "barbecue.nvim";
-    version = "2022-11-30";
+    version = "2022-12-05";
     src = fetchFromGitHub {
       owner = "utilyre";
       repo = "barbecue.nvim";
-      rev = "2a8bff5c47ae7ef3ee2d362634be2d143948dc38";
-      sha256 = "0ncqyb5a5mxhzj3mpsn11342mbl0m54jfqga90ds5430d02mm6fb";
+      rev = "2f242375df96e8a82089d4424e5db0d237c5ae46";
+      sha256 = "14gbx10gpng0n2bb3x7lbzx9n3vdw900yw19fa8qf9mlvi36gpxx";
     };
     meta.homepage = "https://github.com/utilyre/barbecue.nvim/";
   };
@@ -919,12 +919,12 @@ final: prev:
 
   bufdelete-nvim = buildVimPluginFrom2Nix {
     pname = "bufdelete.nvim";
-    version = "2022-11-16";
+    version = "2022-12-04";
     src = fetchFromGitHub {
       owner = "famiu";
       repo = "bufdelete.nvim";
-      rev = "3ebf4a98c380ec27b3066eaa5f1fdda332df1a9d";
-      sha256 = "1cnlhl7kin27v57l2v4yn9v4kvdb9lp4h20ipyw3jh7r13p3y8gv";
+      rev = "f79e9d186b42fba5f1b1362006e7c70240db97a4";
+      sha256 = "08avd9icr7jclljlkzg8q74c95g0knzhxkldgfg9kl298h7qc521";
     };
     meta.homepage = "https://github.com/famiu/bufdelete.nvim/";
   };
@@ -979,12 +979,12 @@ final: prev:
 
   calendar-vim = buildVimPluginFrom2Nix {
     pname = "calendar.vim";
-    version = "2022-10-27";
+    version = "2022-12-05";
     src = fetchFromGitHub {
       owner = "itchyny";
       repo = "calendar.vim";
-      rev = "e4b6212f028f4293f965ed7d83e21516fe9d94c1";
-      sha256 = "10dblr72w8zjckjz8ikpfh0f06ljm07aby27m6cbgjyf0qmsyjjv";
+      rev = "8eee411e280277cd186a3fea0debe754132b5b7b";
+      sha256 = "0haf5ls2y7p6b6nc7b9wlr47h7wbxnk8v6m2mpgvdmbrqylwp9zp";
     };
     meta.homepage = "https://github.com/itchyny/calendar.vim/";
   };
@@ -1195,12 +1195,12 @@ final: prev:
 
   cmp-conjure = buildVimPluginFrom2Nix {
     pname = "cmp-conjure";
-    version = "2021-10-09";
+    version = "2022-12-05";
     src = fetchFromGitHub {
       owner = "PaterJason";
       repo = "cmp-conjure";
-      rev = "ca39e595a0a64150a3fbad340635b0179fe275ec";
-      sha256 = "08vpd8ibz9472iblw0qc64phvwvkm0byrkvw9b9lq0jcsmw2sgs5";
+      rev = "d76e1fe5d724afe604dfa7b4b5ba93f3d3730617";
+      sha256 = "026kmjrhfwqllr8qh0z4jgdl2fcxy4cqf33yy4lnalkgvapnja5s";
     };
     meta.homepage = "https://github.com/PaterJason/cmp-conjure/";
   };
@@ -1735,12 +1735,12 @@ final: prev:
 
   coc-nvim = buildVimPluginFrom2Nix {
     pname = "coc.nvim";
-    version = "2022-11-30";
+    version = "2022-12-06";
     src = fetchFromGitHub {
       owner = "neoclide";
       repo = "coc.nvim";
-      rev = "2c4d06e9fc712b259ae2320020818fbf4c533273";
-      sha256 = "0b5fq7p5ddydxk1zy1s2b93x019n5mxn7vma3ij4ry9lhc1sqxi3";
+      rev = "6adfb13aa16733aa5ede483f428750ce03954c4d";
+      sha256 = "02nchj8kb038x75p7p4kvlpvvhfnc51v88ymffpjszplxmih5znn";
     };
     meta.homepage = "https://github.com/neoclide/coc.nvim/";
   };
@@ -1759,12 +1759,12 @@ final: prev:
 
   codi-vim = buildVimPluginFrom2Nix {
     pname = "codi.vim";
-    version = "2022-08-16";
+    version = "2022-12-02";
     src = fetchFromGitHub {
       owner = "metakirby5";
       repo = "codi.vim";
-      rev = "28983696f59f47221380b4f7d78237dc04f9c62f";
-      sha256 = "11di3w5gvw6a0npjj6y4n7ajra0xzv20nmz7rvq4aw78cvgrxa6a";
+      rev = "6537ba677a0c7c6c796b195f29077b57fad33716";
+      sha256 = "01rk4i212zcas64hk3d2a15qvn8rxwlkghzci2cd1n79ywj0q9xd";
     };
     meta.homepage = "https://github.com/metakirby5/codi.vim/";
   };
@@ -1807,12 +1807,12 @@ final: prev:
 
   command-t = buildVimPluginFrom2Nix {
     pname = "command-t";
-    version = "2022-10-21";
+    version = "2022-12-01";
     src = fetchFromGitHub {
       owner = "wincent";
       repo = "command-t";
-      rev = "491ffa37ea7033850998d7f0ef04387c063ed2f6";
-      sha256 = "19pdrway7zx0rd9w96i8dl84v5m2ac8ag1c0qg3dny9c6ain2bjv";
+      rev = "429b6b7b77764f5a660bd1d0c356029e32d71062";
+      sha256 = "0d6854rm5q782hvapais9lnhrblmr9vvwanhc6jqa42g7946d61p";
     };
     meta.homepage = "https://github.com/wincent/command-t/";
   };
@@ -2011,36 +2011,36 @@ final: prev:
 
   copilot-vim = buildVimPluginFrom2Nix {
     pname = "copilot.vim";
-    version = "2022-11-09";
+    version = "2022-12-06";
     src = fetchFromGitHub {
       owner = "github";
       repo = "copilot.vim";
-      rev = "5a411d19ce7334ab10ba12516743fc25dad363fa";
-      sha256 = "1v72i3f1w7q481grffm2grb9m11qiazs85xq3j89yiqh6jvvpvzh";
+      rev = "2f4f9259a5c0f927b31c4256cd3e4d7c6df87662";
+      sha256 = "0sl6n0hi3y7hw7yyd4p93dpqxq8vvgl4h89640579k28hms22i45";
     };
     meta.homepage = "https://github.com/github/copilot.vim/";
   };
 
   coq-artifacts = buildVimPluginFrom2Nix {
     pname = "coq.artifacts";
-    version = "2022-12-01";
+    version = "2022-12-07";
     src = fetchFromGitHub {
       owner = "ms-jpq";
       repo = "coq.artifacts";
-      rev = "eea760e43c5800bbcb8d6053f5502ada3774b860";
-      sha256 = "0n853wbpg02lw41lzs3c8yyq7ag363li0sslgrmli5h3fsd8d3j4";
+      rev = "295c64b9f9084a78db4eee7450483ce3caf541e0";
+      sha256 = "1ga254s56gbyyywwif4lhfgak3w5gam5ldry33d8h7nqfrvbmmdr";
     };
     meta.homepage = "https://github.com/ms-jpq/coq.artifacts/";
   };
 
   coq-thirdparty = buildVimPluginFrom2Nix {
     pname = "coq.thirdparty";
-    version = "2022-12-01";
+    version = "2022-12-07";
     src = fetchFromGitHub {
       owner = "ms-jpq";
       repo = "coq.thirdparty";
-      rev = "ed621364ec22289e912f680b9e5adc17be5af817";
-      sha256 = "1xwnv4agszdqj7izspgzy8qsyhdzg8ydamrpn51611aafxzz74vm";
+      rev = "b601b48b9a12ab4cd5baedc633f88b48a74100c5";
+      sha256 = "0m93y7m159plhwwrsdqr7d651fzbp0z3p49g9l4v199kvsq0x50a";
     };
     meta.homepage = "https://github.com/ms-jpq/coq.thirdparty/";
   };
@@ -2059,12 +2059,12 @@ final: prev:
 
   coq_nvim = buildVimPluginFrom2Nix {
     pname = "coq_nvim";
-    version = "2022-12-01";
+    version = "2022-12-07";
     src = fetchFromGitHub {
       owner = "ms-jpq";
       repo = "coq_nvim";
-      rev = "61ba300a71bf274af5c7a5069ab102729af79297";
-      sha256 = "0718b7fpl10hpsaw09c4ylkxw8dflb0s2b449q8b8dcwqpgssm51";
+      rev = "fd9c9eb2361f327969368f8eeadd063e5a7d5abe";
+      sha256 = "070a632szjhb342jz41gg7lhw4m11wi5n33f1z8mhc976yy53cas";
     };
     meta.homepage = "https://github.com/ms-jpq/coq_nvim/";
   };
@@ -2589,12 +2589,12 @@ final: prev:
 
   diffview-nvim = buildVimPluginFrom2Nix {
     pname = "diffview.nvim";
-    version = "2022-11-29";
+    version = "2022-12-06";
     src = fetchFromGitHub {
       owner = "sindrets";
       repo = "diffview.nvim";
-      rev = "6a82dfcb59f0af1e814f34bf8344d68afe8618ec";
-      sha256 = "1yggvdb0mzcimpv83jbrvyvp1m6k31i67dq05grwq879dr05igm9";
+      rev = "e37b2d9aaba408954d0e894e27e6f4dbf939ef95";
+      sha256 = "0a9m0ymjj6y1nmpf0yxzvqnz1j2ppwis43a26iqr94i4n5kva393";
     };
     meta.homepage = "https://github.com/sindrets/diffview.nvim/";
   };
@@ -2613,36 +2613,36 @@ final: prev:
 
   doki-theme-vim = buildVimPluginFrom2Nix {
     pname = "doki-theme-vim";
-    version = "2022-11-16";
+    version = "2022-12-06";
     src = fetchFromGitHub {
       owner = "doki-theme";
       repo = "doki-theme-vim";
-      rev = "2d1345239ae7327339bcbd645425ec993bc855d1";
-      sha256 = "1p2vjxry2bf9avxnf3hfbvxz8h37gh9rsdw4km3v42aphk49lvr0";
+      rev = "a83452264666eeb966b7fd5f48ddf15b8ca05450";
+      sha256 = "1v84dz04xbwwhh61fvpmfvydpvj5wkqskml908rgjzmk6y3hp8wq";
     };
     meta.homepage = "https://github.com/doki-theme/doki-theme-vim/";
   };
 
   dracula-nvim = buildVimPluginFrom2Nix {
     pname = "dracula.nvim";
-    version = "2022-11-29";
+    version = "2022-12-06";
     src = fetchFromGitHub {
       owner = "Mofiqul";
       repo = "dracula.nvim";
-      rev = "3023bc68d286676115b660142fe126fc5a4374ae";
-      sha256 = "1c7swpgbwss6f39c28p4gh5di153k7x3ycpkpx99qn8pjg27cfiv";
+      rev = "7645a4de7d60a31ff75ddda52f224889ee4cc3f5";
+      sha256 = "0nc4pzwa6nzk5nc5h6qx9srawq5vb0nl2f7dhkcrwv2k4mci3b56";
     };
     meta.homepage = "https://github.com/Mofiqul/dracula.nvim/";
   };
 
   dressing-nvim = buildVimPluginFrom2Nix {
     pname = "dressing.nvim";
-    version = "2022-11-18";
+    version = "2022-12-05";
     src = fetchFromGitHub {
       owner = "stevearc";
       repo = "dressing.nvim";
-      rev = "7894d5bc504deacf37f0a479a53fa4746fe30a45";
-      sha256 = "1jw8y86lq7k9d1ss4dg3ch1ij8c3b196g8giz881jipdkjy9q7w1";
+      rev = "ed44aa798ab07dc298f43f35c8e0c93a1b335abb";
+      sha256 = "0di5cwq25in8q9vj8ww8blrvf76hsm5qd1bac67blx3z8qsdpb16";
     };
     meta.homepage = "https://github.com/stevearc/dressing.nvim/";
   };
@@ -2747,12 +2747,12 @@ final: prev:
 
   everforest = buildVimPluginFrom2Nix {
     pname = "everforest";
-    version = "2022-11-21";
+    version = "2022-12-07";
     src = fetchFromGitHub {
       owner = "sainnhe";
       repo = "everforest";
-      rev = "d855af543410c4047fc03798f5d58ddd07abcf2d";
-      sha256 = "0sjy8gpmcfs2byj23bnscfjawabdbkj5nqk0mkhax3p1kcvcm1fx";
+      rev = "bed286c9f787a2b6f49edaa47bc286ff93a304b5";
+      sha256 = "1987f2nm1rg5ig5qbi1nfsmm2iamypbimhw38m7ammv1wda840fx";
     };
     meta.homepage = "https://github.com/sainnhe/everforest/";
   };
@@ -2807,12 +2807,12 @@ final: prev:
 
   feline-nvim = buildVimPluginFrom2Nix {
     pname = "feline.nvim";
-    version = "2022-11-16";
+    version = "2022-12-04";
     src = fetchFromGitHub {
       owner = "feline-nvim";
       repo = "feline.nvim";
-      rev = "6d4e3f934bffaa1893a690cd9b8f8b584ef0a7ea";
-      sha256 = "10bwbw2fhmyhscm135jd4qc091xzqb155y2bbn7ms35jrwvaz0z4";
+      rev = "573e6d1e213de976256c84e1cb2f55665549b828";
+      sha256 = "0m54mdxkpx4ds7clydiclq8m41vcf1sg6689r3kyp3q537kmc9k1";
     };
     meta.homepage = "https://github.com/feline-nvim/feline.nvim/";
   };
@@ -2976,12 +2976,12 @@ final: prev:
 
   friendly-snippets = buildVimPluginFrom2Nix {
     pname = "friendly-snippets";
-    version = "2022-11-30";
+    version = "2022-12-05";
     src = fetchFromGitHub {
       owner = "rafamadriz";
       repo = "friendly-snippets";
-      rev = "b4f857a1d94d05e747951b1e8cb1a6c567396898";
-      sha256 = "1z4nkk846dh3c8rj7dliw42vz6fwhj7rf1gwjwa4s7nk8f6xq545";
+      rev = "9b3e497cf0c3abcf73d791968a9768a22405fa13";
+      sha256 = "14j3w7aqnz62fxkrhyklbip9qpdj0cmfxj3japvxbjksh7iba35b";
     };
     meta.homepage = "https://github.com/rafamadriz/friendly-snippets/";
   };
@@ -3132,12 +3132,12 @@ final: prev:
 
   gentoo-syntax = buildVimPluginFrom2Nix {
     pname = "gentoo-syntax";
-    version = "2022-07-13";
+    version = "2022-12-04";
     src = fetchFromGitHub {
       owner = "gentoo";
       repo = "gentoo-syntax";
-      rev = "3bc67579b990d53cdcf2ba9b016995b41d2b26a3";
-      sha256 = "1przyjqp6pjgbmiwx378k5dx5p1j18c5f89zqjihr52q0p7x90f0";
+      rev = "526aeb1acda9504a4293b2a221700f6441211a7d";
+      sha256 = "0nzsn79m3xk338gikz0qk7lqriia0fjfxbw3k9aj5h3kqxw7qgmw";
     };
     meta.homepage = "https://github.com/gentoo/gentoo-syntax/";
   };
@@ -3396,12 +3396,12 @@ final: prev:
 
   gruvbox-nvim = buildVimPluginFrom2Nix {
     pname = "gruvbox.nvim";
-    version = "2022-11-28";
+    version = "2022-12-06";
     src = fetchFromGitHub {
       owner = "ellisonleao";
       repo = "gruvbox.nvim";
-      rev = "02a9182c66a8347d8328a32d58535dfb9785f6aa";
-      sha256 = "0dwi86i6bzzbhblr8whb2bnkra4lv5zm0xvyfjn1s0qj5gs3ammw";
+      rev = "d2efdea91ec79e480e51d5149d58daa328633c43";
+      sha256 = "1nqx2g2z1gbg907n7vhcgak4bd0qz7na5pl8i3jyk5cc22z0mzfc";
     };
     meta.homepage = "https://github.com/ellisonleao/gruvbox.nvim/";
   };
@@ -3467,12 +3467,12 @@ final: prev:
 
   haskell-tools-nvim = buildVimPluginFrom2Nix {
     pname = "haskell-tools.nvim";
-    version = "2022-11-29";
+    version = "2022-12-06";
     src = fetchFromGitHub {
       owner = "MrcJkb";
       repo = "haskell-tools.nvim";
-      rev = "9aa1de666b94ba31a3527f3316a202542bc528c9";
-      sha256 = "1c54bk8125a5bjra58h2fkpmcv7p1kgpjdq62rkdhl7ygqvp59r5";
+      rev = "d21677e8901577b52b37dadec03030c4e5f4cd53";
+      sha256 = "1jlr8yp5vkx3vs5i3cprmhljsnrq54ssj1nqcjgmmak2brhlgrjz";
     };
     meta.homepage = "https://github.com/MrcJkb/haskell-tools.nvim/";
   };
@@ -3586,12 +3586,12 @@ final: prev:
 
   hotpot-nvim = buildVimPluginFrom2Nix {
     pname = "hotpot.nvim";
-    version = "2022-11-12";
+    version = "2022-12-02";
     src = fetchFromGitHub {
       owner = "rktjmp";
       repo = "hotpot.nvim";
-      rev = "562e3e0e04c092c43a9cddffae4c9a748afb186f";
-      sha256 = "0gvr9fwbc22m2rfwz3ficlrk5yk0q4zaaplma4l5zarrxswv9csb";
+      rev = "1002bcdea7af06c5a7bfce0536d96bc4b03ab42e";
+      sha256 = "0cbw07w65kmp1w2l2k4vbnv10vhpj30ija14mdn8mfbqwbp8pb2j";
     };
     meta.homepage = "https://github.com/rktjmp/hotpot.nvim/";
   };
@@ -4007,12 +4007,12 @@ final: prev:
 
   lean-nvim = buildVimPluginFrom2Nix {
     pname = "lean.nvim";
-    version = "2022-11-30";
+    version = "2022-12-04";
     src = fetchFromGitHub {
       owner = "Julian";
       repo = "lean.nvim";
-      rev = "9fad72569b54f067b6ad0bdafd47ce7b23578b79";
-      sha256 = "1cvj59v267av6lh2wzpmqd05pa7fjvfprbs2r7gql6gr992x2s59";
+      rev = "25cfbde4c5c01133ec36fbc0fd44d9c7cf99e397";
+      sha256 = "02d43j8v5lnwg48x11nzdh270fhia1flbqv682ss391zcl0z2h7q";
     };
     meta.homepage = "https://github.com/Julian/lean.nvim/";
   };
@@ -4043,24 +4043,24 @@ final: prev:
 
   leap-nvim = buildVimPluginFrom2Nix {
     pname = "leap.nvim";
-    version = "2022-11-28";
+    version = "2022-12-05";
     src = fetchFromGitHub {
       owner = "ggandor";
       repo = "leap.nvim";
-      rev = "f7391b5fe9771d788816383ee3c75e0be92022af";
-      sha256 = "1xxlpz6y66h8xs8bfl0bq46gkhvdi275vsmrwbac1lwk76v9b8kq";
+      rev = "f28b1e7c1eee525adb17c24de3cc15a7fa1a6ef9";
+      sha256 = "0b311535cvqybg4m517wm7xpjrc0shi3za56c0v5zs6sjnm0n2vs";
     };
     meta.homepage = "https://github.com/ggandor/leap.nvim/";
   };
 
   legendary-nvim = buildVimPluginFrom2Nix {
     pname = "legendary.nvim";
-    version = "2022-11-17";
+    version = "2022-12-07";
     src = fetchFromGitHub {
       owner = "mrjones2014";
       repo = "legendary.nvim";
-      rev = "3b643d7bb4a521e0c9f0fcd00f299b1432441eb8";
-      sha256 = "1mq7c382bzd8kwqlx2lljqkd96cr0yz9zha2zyg6vz4l60aa53h3";
+      rev = "78cc8984cd5f3afb71f8f053f0a1d4708069f2c8";
+      sha256 = "08n243nz39sw6c6ihaz9x64ws1vlj7pp180lrhl3ifqgnaj1ymfb";
     };
     meta.homepage = "https://github.com/mrjones2014/legendary.nvim/";
   };
@@ -4343,24 +4343,24 @@ final: prev:
 
   lsp-inlayhints-nvim = buildVimPluginFrom2Nix {
     pname = "lsp-inlayhints.nvim";
-    version = "2022-10-11";
+    version = "2022-12-05";
     src = fetchFromGitHub {
       owner = "lvimuser";
       repo = "lsp-inlayhints.nvim";
-      rev = "439b4811276a149e3fccb226cc9a43ff2fb0e33b";
-      sha256 = "08yhjc5zqvjv8m254d7vrhz3nhm8dr4xckhmd9q0sazp8pjd5b8h";
+      rev = "a28c51a6362e3faa17f67749436cb5c8b55dcc6d";
+      sha256 = "1hvn8y1mqd853aa2dm7156g4fvwq21qmmkicsl50czq4mf9vgvd1";
     };
     meta.homepage = "https://github.com/lvimuser/lsp-inlayhints.nvim/";
   };
 
   lsp-overloads-nvim = buildVimPluginFrom2Nix {
     pname = "lsp-overloads.nvim";
-    version = "2022-10-21";
+    version = "2022-12-04";
     src = fetchFromGitHub {
       owner = "Issafalcon";
       repo = "lsp-overloads.nvim";
-      rev = "2d8671d6787045bed518dce9c2f82a0ece76ed66";
-      sha256 = "1v873y2b52v2sa09ans6rs3f5kylb6izx2ffd9wpdg5y8i9s83s1";
+      rev = "12f5468781d2d1d3feb6ad7459de764fc33898fe";
+      sha256 = "1lxsg05qv87v2imhsfwa9mqfib4332cvhflivpzkamg1acs6bc9j";
     };
     meta.homepage = "https://github.com/Issafalcon/lsp-overloads.nvim/";
   };
@@ -4414,12 +4414,12 @@ final: prev:
 
   lsp_signature-nvim = buildVimPluginFrom2Nix {
     pname = "lsp_signature.nvim";
-    version = "2022-11-30";
+    version = "2022-12-04";
     src = fetchFromGitHub {
       owner = "ray-x";
       repo = "lsp_signature.nvim";
-      rev = "2f3e5745ee7a0610ffde2b4331460151d4707724";
-      sha256 = "0c0ap6xkncbsvy08897ah4sw4f6s99q9m5jp0i3a0akvw3zpn21n";
+      rev = "9a7e5a093a58b2eefcf77f4a84b8d8c274725d0f";
+      sha256 = "0pmghzzqjm5bvcmaqfq65rabc0p0n6fc5x3j682glm0fjrnlgzj9";
     };
     meta.homepage = "https://github.com/ray-x/lsp_signature.nvim/";
   };
@@ -4450,12 +4450,12 @@ final: prev:
 
   lspsaga-nvim = buildVimPluginFrom2Nix {
     pname = "lspsaga.nvim";
-    version = "2022-08-20";
+    version = "2022-12-06";
     src = fetchFromGitHub {
       owner = "kkharji";
       repo = "lspsaga.nvim";
-      rev = "9ec569a49aa7ff265764081acff9e5da839c13fe";
-      sha256 = "1h4r63na7n18pnfbl0n3x7pkfm1pd01zz2h0py6pxd1az6il9dng";
+      rev = "5faeec9f2508d2d49a66c0ac0d191096b4e3fa81";
+      sha256 = "1bw71db69na2sriv9q167z9bgkir4nwny1bdfv9z606bmng4hhzc";
     };
     meta.homepage = "https://github.com/kkharji/lspsaga.nvim/";
   };
@@ -4486,12 +4486,12 @@ final: prev:
 
   luasnip = buildVimPluginFrom2Nix {
     pname = "luasnip";
-    version = "2022-11-27";
+    version = "2022-12-05";
     src = fetchFromGitHub {
       owner = "l3mon4d3";
       repo = "luasnip";
-      rev = "3fa5c8d938e4ed9dcfd3e07d13b587cba4f87e7d";
-      sha256 = "0pf4z4c4iaqzh40gsc4gs55kl6821sjhyp0x8pjahl2spqxm3nn3";
+      rev = "5ce70a08442e97ac55ce14e71dd7d151ea5f4d8e";
+      sha256 = "1fncj4l72pwhwx9drqplm432zjg76y4clyw2kdpivs6nvghisjfv";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/l3mon4d3/luasnip/";
@@ -4607,12 +4607,12 @@ final: prev:
 
   mini-nvim = buildVimPluginFrom2Nix {
     pname = "mini.nvim";
-    version = "2022-11-22";
+    version = "2022-12-02";
     src = fetchFromGitHub {
       owner = "echasnovski";
       repo = "mini.nvim";
-      rev = "d00abe8169993b95f52ff64fbfe685f353fd1c4f";
-      sha256 = "1vq968253hj82bix9gs7r48dxzfhsrjdlx0ssmbv97g96qd46ai7";
+      rev = "6402c79d73c07ad19374dc7b4f9d4bdfc2f57f42";
+      sha256 = "0iqc4l9qdr1y3nbkzijcp2c1in8r1ybqvbjl9p92x6zdvmxff2jr";
     };
     meta.homepage = "https://github.com/echasnovski/mini.nvim/";
   };
@@ -4967,12 +4967,12 @@ final: prev:
 
   neoconf-nvim = buildVimPluginFrom2Nix {
     pname = "neoconf.nvim";
-    version = "2022-11-30";
+    version = "2022-12-07";
     src = fetchFromGitHub {
       owner = "folke";
       repo = "neoconf.nvim";
-      rev = "681e89d58d46a7c63ee091fee32220373dda1072";
-      sha256 = "000inylrbyyfc1lg1ajmi1rb2jrcisglgc44gk3cf9iv7v1515dd";
+      rev = "a292a8a4927278c4c9e7653cf0a37cd40c17d0fb";
+      sha256 = "1j2n4k02b5648ayarqdcw312ynd9j50gm3l5ish6fav6k4ipngq6";
     };
     meta.homepage = "https://github.com/folke/neoconf.nvim/";
   };
@@ -4991,36 +4991,36 @@ final: prev:
 
   neodev-nvim = buildVimPluginFrom2Nix {
     pname = "neodev.nvim";
-    version = "2022-11-29";
+    version = "2022-12-07";
     src = fetchFromGitHub {
       owner = "folke";
       repo = "neodev.nvim";
-      rev = "dbed20332724909b26b5b1a083303654a6c15c20";
-      sha256 = "1v5x0g49wpfm9qnqdyj27m2bnx7jr2j6hq91fhkqyy13y76qjq2w";
+      rev = "f353ec5ac10a9e581c92dc0f937025c54e216022";
+      sha256 = "1wmy5hncm1lz5r99vcspg95435yyg0jdzm2kjca79nsmqp613ffl";
     };
     meta.homepage = "https://github.com/folke/neodev.nvim/";
   };
 
   neoformat = buildVimPluginFrom2Nix {
     pname = "neoformat";
-    version = "2022-11-24";
+    version = "2022-12-06";
     src = fetchFromGitHub {
       owner = "sbdchd";
       repo = "neoformat";
-      rev = "a09d6ed9eacd0b81c0f8641757e60f7bb0e27f6e";
-      sha256 = "1pqz1bz5nwdrm4x0p38xhabyb089spvp5khhl154k5mi6fsws219";
+      rev = "902f674b9e8a703fad9dafdda9d8f7c88ecf689f";
+      sha256 = "12zxmyhk06xiyr5sahqip9pf6f5zyvr46yb6a4ayzdk81k8wmdky";
     };
     meta.homepage = "https://github.com/sbdchd/neoformat/";
   };
 
   neogit = buildVimPluginFrom2Nix {
     pname = "neogit";
-    version = "2022-11-28";
+    version = "2022-12-06";
     src = fetchFromGitHub {
       owner = "TimUntersberger";
       repo = "neogit";
-      rev = "74e14e3c885f0caf64004d1c1e75dcbef96e10e5";
-      sha256 = "1sdv73v5wzqvfbmrlj6vmwpvgyy9afw6nji5nc1wmhw74cwq2r3a";
+      rev = "19bc8377e61482f36703a3e1651aef206af88086";
+      sha256 = "0599ljv4f8vsk3h4rpisqj69c4sgjw51rpv8nz7s9nbn43crcqy1";
     };
     meta.homepage = "https://github.com/TimUntersberger/neogit/";
   };
@@ -5075,12 +5075,12 @@ final: prev:
 
   neorg = buildVimPluginFrom2Nix {
     pname = "neorg";
-    version = "2022-11-29";
+    version = "2022-12-05";
     src = fetchFromGitHub {
       owner = "nvim-neorg";
       repo = "neorg";
-      rev = "5a536bc033d2ac1ef49ec4c875fd9811cceccb68";
-      sha256 = "08gx5y34abpfmcmhhlmb44hi380cfyapbki32pv9xspq56ng8xpn";
+      rev = "a79bf5969e27a3f1f1478c9b05c187815f2b2390";
+      sha256 = "1a8w2f5s50j4zzwkshxmj48lch7vd680hmmq3scl4q0knvjdyd9h";
     };
     meta.homepage = "https://github.com/nvim-neorg/neorg/";
   };
@@ -5135,12 +5135,12 @@ final: prev:
 
   neotest = buildVimPluginFrom2Nix {
     pname = "neotest";
-    version = "2022-12-01";
+    version = "2022-12-05";
     src = fetchFromGitHub {
       owner = "nvim-neotest";
       repo = "neotest";
-      rev = "a2559f07be901638d555c0d29d8ea22c81553653";
-      sha256 = "177pf0ywxqmxr7472yvrmk579k5vgh5770d1j00r1d3k8yjsnqp4";
+      rev = "d9bd5b05983ccfa349ff2692a5adb17b227088b5";
+      sha256 = "05iqzzmxvzb0s6v68pl2wjc643bwhd1mc3r2mrywkj99n8k6mn3k";
     };
     meta.homepage = "https://github.com/nvim-neotest/neotest/";
   };
@@ -5267,24 +5267,24 @@ final: prev:
 
   nginx-vim = buildVimPluginFrom2Nix {
     pname = "nginx.vim";
-    version = "2021-10-03";
+    version = "2022-12-01";
     src = fetchFromGitHub {
       owner = "chr4";
       repo = "nginx.vim";
-      rev = "ceeab164880ad90e73ab1be31dc3932777b9ef20";
-      sha256 = "178rd4zi8lspsq7qy5ag5gnqr87hivv92pcgqszbriqkga30srpc";
+      rev = "fdebcbfbefdf26f73cd31ec849df784075dbd21f";
+      sha256 = "0zgr4zvhxl3myx9a8pypxbv3f6i7xygzdd4cfi80c4nm3j83j1hk";
     };
     meta.homepage = "https://github.com/chr4/nginx.vim/";
   };
 
   nightfox-nvim = buildVimPluginFrom2Nix {
     pname = "nightfox.nvim";
-    version = "2022-11-28";
+    version = "2022-12-06";
     src = fetchFromGitHub {
       owner = "EdenEast";
       repo = "nightfox.nvim";
-      rev = "dce9cddbccc479dad170270d18f2057a637a0297";
-      sha256 = "0fkgp5hd0wgcpr0pnpk8m1k3xf08p0mfahkch41z16mlach8gjwn";
+      rev = "0903c4886535d97e6e62f710ab97119d2e09aa0b";
+      sha256 = "1s9rrqii367bgi31gnir8vnjhw5wvnxlsyzv6q9myix5zjq5kkml";
     };
     meta.homepage = "https://github.com/EdenEast/nightfox.nvim/";
   };
@@ -5327,12 +5327,12 @@ final: prev:
 
   noice-nvim = buildVimPluginFrom2Nix {
     pname = "noice.nvim";
-    version = "2022-11-29";
+    version = "2022-12-03";
     src = fetchFromGitHub {
       owner = "folke";
       repo = "noice.nvim";
-      rev = "5ca31af06078d6188de7db1369c2b40d1b606d58";
-      sha256 = "1a3n5341fcvjlkp3lv5x50a81z30zaxxw427dvkpjb7bp93rb8h4";
+      rev = "e013b6ebbad0fab34013be6f073da38c53c9e1dc";
+      sha256 = "1pxnj2m7v8m943xs24hspggwhwyv0nla96d38mh1r8bllhh367k8";
     };
     meta.homepage = "https://github.com/folke/noice.nvim/";
   };
@@ -5399,12 +5399,12 @@ final: prev:
 
   null-ls-nvim = buildVimPluginFrom2Nix {
     pname = "null-ls.nvim";
-    version = "2022-11-30";
+    version = "2022-12-05";
     src = fetchFromGitHub {
       owner = "jose-elias-alvarez";
       repo = "null-ls.nvim";
-      rev = "d4254b19e914e6278582d4555c57eb3d2abd9590";
-      sha256 = "03f7m0v5mgpwwvy1qgijiiyvrfzk5n75a1nj5snl0vl8ivancmcs";
+      rev = "b3d2ebdb75cf1fa4290822b43dc31f61bd0023f8";
+      sha256 = "01ri9sk5p67lkv1jf6zia8l87prrsccyz2862pk7brsmyaja22kw";
     };
     meta.homepage = "https://github.com/jose-elias-alvarez/null-ls.nvim/";
   };
@@ -5447,12 +5447,12 @@ final: prev:
 
   nvim-autopairs = buildVimPluginFrom2Nix {
     pname = "nvim-autopairs";
-    version = "2022-11-28";
+    version = "2022-12-07";
     src = fetchFromGitHub {
       owner = "windwp";
       repo = "nvim-autopairs";
-      rev = "99f696339266c22e7313d6a85a95bd538c3fc226";
-      sha256 = "1pv3hfaxd7yifx0n9643wcb9skrqrkzx5x545x944y23xvwvv9di";
+      rev = "9fa996123031b4cad100bd5afad04384a622c8a7";
+      sha256 = "0js7snmg9223d54iayadlm3bjn54fs3mzqck26cpn4fa5m1nc295";
     };
     meta.homepage = "https://github.com/windwp/nvim-autopairs/";
   };
@@ -5483,12 +5483,12 @@ final: prev:
 
   nvim-bqf = buildVimPluginFrom2Nix {
     pname = "nvim-bqf";
-    version = "2022-11-22";
+    version = "2022-12-05";
     src = fetchFromGitHub {
       owner = "kevinhwang91";
       repo = "nvim-bqf";
-      rev = "448fa92e7f3838e3b5adbce58b55c5f97a6d2cec";
-      sha256 = "0b5byaa8l3yhxhcivp62mpcnwr8ix7k98w68ifhlh5ynfk20zf1j";
+      rev = "3389264042e4590ed32ce26d7e47b17ec4e6e6d5";
+      sha256 = "0l9fcy2ic5n7krngrz0cv8darb2kv3whhv2lvf312cx9xmjspq2f";
     };
     meta.homepage = "https://github.com/kevinhwang91/nvim-bqf/";
   };
@@ -5627,12 +5627,12 @@ final: prev:
 
   nvim-dap = buildVimPluginFrom2Nix {
     pname = "nvim-dap";
-    version = "2022-11-28";
+    version = "2022-12-01";
     src = fetchFromGitHub {
       owner = "mfussenegger";
       repo = "nvim-dap";
-      rev = "f0573ea26f29702ad9aa1546e102adb2f5b7ac3a";
-      sha256 = "0d5ng7ffamh24bacyr4xgw393cm55x62f3m9cly8rzd38y7glpvi";
+      rev = "8f396b7836b9bbda9edd9f655f12ca377ae97676";
+      sha256 = "0jbl9ima5q5f0rcjac8p35by96wha3ph2518d1mjbliawfdl23p1";
     };
     meta.homepage = "https://github.com/mfussenegger/nvim-dap/";
   };
@@ -5759,24 +5759,24 @@ final: prev:
 
   nvim-highlite = buildVimPluginFrom2Nix {
     pname = "nvim-highlite";
-    version = "2022-11-22";
+    version = "2022-12-03";
     src = fetchFromGitHub {
       owner = "Iron-E";
       repo = "nvim-highlite";
-      rev = "56887173181ea0915a9931960899d023ea0ae66c";
-      sha256 = "132m5p9jkbj324qjjv0d7kgil3jlacz2lqrh0ygsa6hmyyq5gkay";
+      rev = "bc4f02545a0ee3b474e30d6654efe41f5a0a1cb5";
+      sha256 = "0v0yva74h1gk8piwil0pg5r5w663psrkg42y1sgpbla70i7j12ff";
     };
     meta.homepage = "https://github.com/Iron-E/nvim-highlite/";
   };
 
   nvim-hlslens = buildVimPluginFrom2Nix {
     pname = "nvim-hlslens";
-    version = "2022-11-30";
+    version = "2022-12-04";
     src = fetchFromGitHub {
       owner = "kevinhwang91";
       repo = "nvim-hlslens";
-      rev = "cad6ce2e0d4f9c26467712791a70fae9d0b0b6cf";
-      sha256 = "122dkvvs7cgmba8l09vhnc6laabyv4qakm3931f4kscn6lb4kyzm";
+      rev = "7fb804f504fd0935d65246a1d5ddea73d9ceefc9";
+      sha256 = "1fsqpd3idfqf5r95m2w32ajvldvha3844hl1x4hnwmwn26jn3iib";
     };
     meta.homepage = "https://github.com/kevinhwang91/nvim-hlslens/";
   };
@@ -5795,12 +5795,12 @@ final: prev:
 
   nvim-jdtls = buildVimPluginFrom2Nix {
     pname = "nvim-jdtls";
-    version = "2022-11-30";
+    version = "2022-12-05";
     src = fetchFromGitHub {
       owner = "mfussenegger";
       repo = "nvim-jdtls";
-      rev = "4ea8e66d61c9a7e40c40f4cc6051ebfbf4ce0d38";
-      sha256 = "0wbfy0p7n7s8zp154p06n3nmqc5vxrmzz6abasvlisd8s2khk3g1";
+      rev = "82e9feb6eb6000cea42b4cddf5b31daf624173bb";
+      sha256 = "1f7akw10npsvabgprg4vm23nqxiy679rp2cbyfywkis2hjb4mraw";
     };
     meta.homepage = "https://github.com/mfussenegger/nvim-jdtls/";
   };
@@ -5855,12 +5855,12 @@ final: prev:
 
   nvim-lint = buildVimPluginFrom2Nix {
     pname = "nvim-lint";
-    version = "2022-11-29";
+    version = "2022-12-05";
     src = fetchFromGitHub {
       owner = "mfussenegger";
       repo = "nvim-lint";
-      rev = "2ef3b269546d751e4fc8c673ffddd6216421f4a1";
-      sha256 = "03vdbxqa6z8471l0s65xa55n5hf1c1s59zvx1rn1kgy4h070022w";
+      rev = "46e14866fd2876a18772f913c6c14f5545c6034a";
+      sha256 = "16gnlbghywq6ksfmbzfgl9mj4d9gywdqkj8i4jsgl6h4qkvp4hb3";
     };
     meta.homepage = "https://github.com/mfussenegger/nvim-lint/";
   };
@@ -5879,12 +5879,12 @@ final: prev:
 
   nvim-lspconfig = buildVimPluginFrom2Nix {
     pname = "nvim-lspconfig";
-    version = "2022-12-01";
+    version = "2022-12-07";
     src = fetchFromGitHub {
       owner = "neovim";
       repo = "nvim-lspconfig";
-      rev = "5e0bd39476d4e224dfe5ea6a6624ea3bb467a8bb";
-      sha256 = "11lsa35v6qb1mvnac94i3acc428r6s2zk88i6qp3xz25slmd5773";
+      rev = "c7206327096bedf2e213788a60624a84b3b7552d";
+      sha256 = "1f310ng3i69mlp429fcq65fqrfigdpmnsixq91qyan964cn1b13r";
     };
     meta.homepage = "https://github.com/neovim/nvim-lspconfig/";
   };
@@ -5987,12 +5987,12 @@ final: prev:
 
   nvim-notify = buildVimPluginFrom2Nix {
     pname = "nvim-notify";
-    version = "2022-11-28";
+    version = "2022-12-06";
     src = fetchFromGitHub {
       owner = "rcarriga";
       repo = "nvim-notify";
-      rev = "859056ff7aec327255578c7a98ef02d0cd829f65";
-      sha256 = "01sas5rv0j6rsjml9ibi9ygzpihdn6g8vz5rpwv4grkh0n844jkh";
+      rev = "b005821516f1f37801a73067afd1cef2dbc4dfe8";
+      sha256 = "06y5akjhrnnsdkjxbcci7fxar8qj37qsl5i18xyx4lzzslxf7nvy";
     };
     meta.homepage = "https://github.com/rcarriga/nvim-notify/";
   };
@@ -6023,36 +6023,36 @@ final: prev:
 
   nvim-scrollbar = buildVimPluginFrom2Nix {
     pname = "nvim-scrollbar";
-    version = "2022-11-21";
+    version = "2022-12-07";
     src = fetchFromGitHub {
       owner = "petertriho";
       repo = "nvim-scrollbar";
-      rev = "2cb0a0b36a45118e075699bb3a884ab819a85256";
-      sha256 = "0hmx3fic2cds609a9f4ik79kb9i6hqs9ir1h6x1kamn4fgm4fqcq";
+      rev = "779cf6f5e7ebcd78acf37dff35a240e03f616357";
+      sha256 = "0hz9y3q84azi3grzac7i6dazv982g7di7limd1qajx8x3hbbfvyx";
     };
     meta.homepage = "https://github.com/petertriho/nvim-scrollbar/";
   };
 
   nvim-scrollview = buildVimPluginFrom2Nix {
     pname = "nvim-scrollview";
-    version = "2022-11-18";
+    version = "2022-12-04";
     src = fetchFromGitHub {
       owner = "dstein64";
       repo = "nvim-scrollview";
-      rev = "b10165f3727f519566d69382c4a4830f16375910";
-      sha256 = "0ha1hdrw5cakgxnp0n5dzn0w7kbyxfw0y396rndp70mcqanqg34r";
+      rev = "f51cd5543c9369dc76a226a1b16068abaf604876";
+      sha256 = "1ss4s4m3aqxrqawvlsf6qvg1nk36l3y5vyldm1hzvqa5f6bcm8dv";
     };
     meta.homepage = "https://github.com/dstein64/nvim-scrollview/";
   };
 
   nvim-snippy = buildVimPluginFrom2Nix {
     pname = "nvim-snippy";
-    version = "2022-11-24";
+    version = "2022-12-07";
     src = fetchFromGitHub {
       owner = "dcampos";
       repo = "nvim-snippy";
-      rev = "7b98712fdebda8d20375359622e2cb2795f774d8";
-      sha256 = "131ji85a14cd7f5gx41q76b2n1gvjbj0whlizpk3c62kz44mpgdp";
+      rev = "47def62945611212a242657cc414dac91ca0453a";
+      sha256 = "112h9rrfknqb2z0ph0x4fv3pplwrkp1sn1x2saw3bb8r7fjiqzr4";
     };
     meta.homepage = "https://github.com/dcampos/nvim-snippy/";
   };
@@ -6071,12 +6071,12 @@ final: prev:
 
   nvim-spectre = buildVimPluginFrom2Nix {
     pname = "nvim-spectre";
-    version = "2022-10-20";
+    version = "2022-12-07";
     src = fetchFromGitHub {
       owner = "nvim-pack";
       repo = "nvim-spectre";
-      rev = "e27cf9f4506e39ba11a162c6c4aa8e5ff8f296f1";
-      sha256 = "0f3sy23jac31fgrcbphhdkl6y8iwi79i9c8yi8gsz3m6a3czhkpw";
+      rev = "c332c9c0574a531392818baf4020b86ba5575942";
+      sha256 = "0xkf01sr7pkm26xq8spns8765gpj7ibpdp4cx9klw6a9fx8sir9q";
     };
     meta.homepage = "https://github.com/nvim-pack/nvim-spectre/";
   };
@@ -6107,24 +6107,24 @@ final: prev:
 
   nvim-tree-lua = buildVimPluginFrom2Nix {
     pname = "nvim-tree.lua";
-    version = "2022-11-29";
+    version = "2022-12-03";
     src = fetchFromGitHub {
       owner = "nvim-tree";
       repo = "nvim-tree.lua";
-      rev = "829e9f68e10a998198e17bf5b348a6947f9d3c2e";
-      sha256 = "1xwm3qcba6a2mxmpcdi81c29y3kxw2srm5yi9jvmzpml6zbwqmqp";
+      rev = "f8489c992998e1e1b45aec65bdb9615e5cd59a61";
+      sha256 = "0md5xavzksj4lh1vbd24zq29bwgcb7057dw31invc7adm7sfh1wr";
     };
     meta.homepage = "https://github.com/nvim-tree/nvim-tree.lua/";
   };
 
   nvim-treesitter = buildVimPluginFrom2Nix {
     pname = "nvim-treesitter";
-    version = "2022-12-01";
+    version = "2022-12-07";
     src = fetchFromGitHub {
       owner = "nvim-treesitter";
       repo = "nvim-treesitter";
-      rev = "768532453ac30cbf792b492248a6c3be19b80af1";
-      sha256 = "18lamsy039c90ycxh2gz1qi2ba4npkm1j4q2ibyzljml8kznhzg6";
+      rev = "440401c506ec9b87cd3824ad17631115ab860cc5";
+      sha256 = "1xyb73vavp38mr7lvjbwd9hmqlc4bw41g1wg0fs8fflabjy3bals";
     };
     meta.homepage = "https://github.com/nvim-treesitter/nvim-treesitter/";
   };
@@ -6443,12 +6443,12 @@ final: prev:
 
   packer-nvim = buildVimPluginFrom2Nix {
     pname = "packer.nvim";
-    version = "2022-11-29";
+    version = "2022-12-07";
     src = fetchFromGitHub {
       owner = "wbthomason";
       repo = "packer.nvim";
-      rev = "dcd2f380bb49ec2dfe208f186236dd366434a4d5";
-      sha256 = "01rrangp7lwz75cqqaqfxdzd6j3jq64g816j3bk9p6fqag9pripi";
+      rev = "64ae65fea395d8dc461e3884688f340dd43950ba";
+      sha256 = "106yxm2gi86w8d1k96fr3wfiqnz8z6kkg1c58fvm9izl82anmbxd";
     };
     meta.homepage = "https://github.com/wbthomason/packer.nvim/";
   };
@@ -6672,12 +6672,12 @@ final: prev:
 
   purescript-vim = buildVimPluginFrom2Nix {
     pname = "purescript-vim";
-    version = "2022-06-15";
+    version = "2022-12-07";
     src = fetchFromGitHub {
       owner = "purescript-contrib";
       repo = "purescript-vim";
-      rev = "af5fae0b43241e9fc3e0442782272728844bec3f";
-      sha256 = "05v81i4ialja4wq3rp1fy09zjh7rvwb6pjhig7zg9pfddd015pki";
+      rev = "7af25a840d38dc6767c85edd1f35c1f835618071";
+      sha256 = "1aw0bd0cx76ldm5nx17lqsxshlaiw8v9j0rwf1mlbz5k40c5v2w9";
     };
     meta.homepage = "https://github.com/purescript-contrib/purescript-vim/";
   };
@@ -6853,12 +6853,12 @@ final: prev:
 
   registers-nvim = buildVimPluginFrom2Nix {
     pname = "registers.nvim";
-    version = "2022-11-10";
+    version = "2022-12-03";
     src = fetchFromGitHub {
       owner = "tversteeg";
       repo = "registers.nvim";
-      rev = "2c4f82a8a68b7d3cee7bd345669f2f50bdc6f889";
-      sha256 = "1g6jnql1jrdkw6ckb6q1fivcxjkksdqpcy8najxmmw9lv4sksh4k";
+      rev = "76bf496da0c5e2c71820d93319e468b84b689be4";
+      sha256 = "1sn39ia2n951rj52c596q1sbmzb23224c3zvrmzzrb2ifbfj3f7f";
     };
     meta.homepage = "https://github.com/tversteeg/registers.nvim/";
   };
@@ -7383,12 +7383,12 @@ final: prev:
 
   ssr-nvim = buildVimPluginFrom2Nix {
     pname = "ssr.nvim";
-    version = "2022-11-29";
+    version = "2022-12-04";
     src = fetchFromGitHub {
       owner = "cshuaimin";
       repo = "ssr.nvim";
-      rev = "4304933853e66060ec03048b2ce3853c39c3886a";
-      sha256 = "03yz00x2wqb0b23ddawsciy52ac9q9gz6h3668l9b2srggphnxy2";
+      rev = "6238c102d16779aaa505a16200ac50a01c16b5ef";
+      sha256 = "0w0yljwf5l19sczb8qrzkhl61w7xhyapj8v182c7h60k7nis1qqx";
     };
     meta.homepage = "https://github.com/cshuaimin/ssr.nvim/";
   };
@@ -7600,12 +7600,12 @@ final: prev:
 
   tabnine-vim = buildVimPluginFrom2Nix {
     pname = "tabnine-vim";
-    version = "2022-02-25";
+    version = "2022-12-05";
     src = fetchFromGitHub {
       owner = "codota";
       repo = "tabnine-vim";
-      rev = "e27face391a4d9a3e43ff251010f77deddf0c88d";
-      sha256 = "1y5haygvixnav9cck49yvvm14afyy5gyq8rwiybqvkd6vfxlv99f";
+      rev = "35f1661297b4bf8b12324c8d29442b36a5ef64d2";
+      sha256 = "1snrjrd0ri5d3kkdv81gvbsv6nccjxqh6zpwkzbz9nh7nhb7dmy2";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/codota/tabnine-vim/";
@@ -7709,12 +7709,12 @@ final: prev:
 
   tcomment_vim = buildVimPluginFrom2Nix {
     pname = "tcomment_vim";
-    version = "2022-07-22";
+    version = "2022-12-02";
     src = fetchFromGitHub {
       owner = "tomtom";
       repo = "tcomment_vim";
-      rev = "e77e1bf61b4f1ddc7b13c6160b7389df42aba24d";
-      sha256 = "00cvap0qp016x09h4wkk6d0b9px7q8dplj8fj5c7j95r15k6z2r7";
+      rev = "ced243a049bb6839ff057741de731418879e97e8";
+      sha256 = "1q2q2q8rpd8fzf4sa14mjg42m1d97cqxz82xk4vgg3ml3ffgcsly";
     };
     meta.homepage = "https://github.com/tomtom/tcomment_vim/";
   };
@@ -7757,24 +7757,24 @@ final: prev:
 
   telescope-dap-nvim = buildVimPluginFrom2Nix {
     pname = "telescope-dap.nvim";
-    version = "2021-03-26";
+    version = "2022-12-02";
     src = fetchFromGitHub {
       owner = "nvim-telescope";
       repo = "telescope-dap.nvim";
-      rev = "b4134fff5cbaf3b876e6011212ed60646e56f060";
-      sha256 = "1fcpw42bwl5iych3hxrrl08s5hm6r6k0qx2savw853f3ff982s38";
+      rev = "313d2ea12ae59a1ca51b62bf01fc941a983d9c9c";
+      sha256 = "0dkmmg30bxpbz990wgpndfhzql2015knrlmnscgz4cwyd39wwgpm";
     };
     meta.homepage = "https://github.com/nvim-telescope/telescope-dap.nvim/";
   };
 
   telescope-file-browser-nvim = buildVimPluginFrom2Nix {
     pname = "telescope-file-browser.nvim";
-    version = "2022-11-30";
+    version = "2022-12-04";
     src = fetchFromGitHub {
       owner = "nvim-telescope";
       repo = "telescope-file-browser.nvim";
-      rev = "8646e46b8545b9234e87083d124c0a4e4ed47735";
-      sha256 = "01q34wrk00yxy4jcr666qmkdkpfib80rjbn921dkqqv2d1nalx9b";
+      rev = "cad567e11131a01f2934930c1efc8b1b09a0dc56";
+      sha256 = "0d0l47dmvsba5z8dnywmc55s964wzz3f202amxj5msh9jj051ry3";
     };
     meta.homepage = "https://github.com/nvim-telescope/telescope-file-browser.nvim/";
   };
@@ -7793,12 +7793,12 @@ final: prev:
 
   telescope-fzf-native-nvim = buildVimPluginFrom2Nix {
     pname = "telescope-fzf-native.nvim";
-    version = "2022-11-30";
+    version = "2022-12-02";
     src = fetchFromGitHub {
       owner = "nvim-telescope";
       repo = "telescope-fzf-native.nvim";
-      rev = "7447fe780fed23402a3e0c3a227b549d7506ed38";
-      sha256 = "101zcy6fjrpv19cghg464wrizh82b0ny7pc1mmqsfqw48hl37hwn";
+      rev = "ae9d95da9ff5669eb8e35f758fbf385b3e2fb7cf";
+      sha256 = "1appy9vk69wbm1zzgxhpi42y401rkdbkbl4qpiagnqbwkz2wc6i0";
     };
     meta.homepage = "https://github.com/nvim-telescope/telescope-fzf-native.nvim/";
   };
@@ -7974,12 +7974,12 @@ final: prev:
 
   telescope-nvim = buildVimPluginFrom2Nix {
     pname = "telescope.nvim";
-    version = "2022-11-28";
+    version = "2022-12-02";
     src = fetchFromGitHub {
       owner = "nvim-telescope";
       repo = "telescope.nvim";
-      rev = "3c2e5fb23e9f6ca1aa682ae16bac3319bfe03e38";
-      sha256 = "08r7cjmkqw2pzagyhyv185b86pqrvwk2y6b7g6sjbv3izp4q3krk";
+      rev = "cabf991b1d3996fa6f3232327fc649bbdf676496";
+      sha256 = "04h9hsy6az1hm0bcg8vf8vsj9hqbf0fi3q5fksdjpqpcf2m04j75";
     };
     meta.homepage = "https://github.com/nvim-telescope/telescope.nvim/";
   };
@@ -8203,12 +8203,12 @@ final: prev:
 
   tokyonight-nvim = buildVimPluginFrom2Nix {
     pname = "tokyonight.nvim";
-    version = "2022-11-29";
+    version = "2022-12-06";
     src = fetchFromGitHub {
       owner = "folke";
       repo = "tokyonight.nvim";
-      rev = "58008d1ff7c1105ef702ac5460cb06bdccf278a6";
-      sha256 = "16s593j8ikisnf8xhqqrbpadwlf8sxx3fwcnjjjh6wns6gcmkrry";
+      rev = "0f7b6a5b6cf232f34cb8f51123a084a6eee96b89";
+      sha256 = "0h7msjgg5zg0zza8fasb2km3pcijlb5w69hlb3vfxxb33kjv8104";
     };
     meta.homepage = "https://github.com/folke/tokyonight.nvim/";
   };
@@ -8239,12 +8239,12 @@ final: prev:
 
   treesj = buildVimPluginFrom2Nix {
     pname = "treesj";
-    version = "2022-12-01";
+    version = "2022-12-02";
     src = fetchFromGitHub {
       owner = "Wansmer";
       repo = "treesj";
-      rev = "da296173b61330aebfd16129a5bf1263700014f1";
-      sha256 = "1wbbxdf2k1vfrnfllms0g5mnsf5bhsipacfwa546sfnc41j360v9";
+      rev = "43604d7e1504571c768024e90907dc7b581456a4";
+      sha256 = "0k9swbihxjynzkhfg5dgnkm5ajzaq75py4lpxfiql54pvbbllcb5";
     };
     meta.homepage = "https://github.com/Wansmer/treesj/";
   };
@@ -8395,12 +8395,12 @@ final: prev:
 
   urlview-nvim = buildVimPluginFrom2Nix {
     pname = "urlview.nvim";
-    version = "2022-11-17";
+    version = "2022-12-06";
     src = fetchFromGitHub {
       owner = "axieax";
       repo = "urlview.nvim";
-      rev = "f8d30320ca277956852fda6db082e231153b8618";
-      sha256 = "0y6vqv83f075a3728jrzrzx11wf8a1p3l6rn2irwgxd037b1ql7z";
+      rev = "53c53bce3bffa96be2b5f855d7ffb1d1f208eee5";
+      sha256 = "1hdx4k9wcn3j9zyaw0d4fg83w7phn59hh7zblqhzd8z61h8kfdpa";
     };
     meta.homepage = "https://github.com/axieax/urlview.nvim/";
   };
@@ -8803,12 +8803,12 @@ final: prev:
 
   vim-airline = buildVimPluginFrom2Nix {
     pname = "vim-airline";
-    version = "2022-11-28";
+    version = "2022-12-07";
     src = fetchFromGitHub {
       owner = "vim-airline";
       repo = "vim-airline";
-      rev = "25d53a80f4d68932de4b10fc31aa9a393e19b41e";
-      sha256 = "169gxfb6lfd29ln0qwx6kch2ndik8bmj7npq9wpblpczg3g5sn4j";
+      rev = "5f5e00faad728f12f9ca9d9200208d8a39fd60f4";
+      sha256 = "0z3rkdf0k95789x5yqrvkq2jfnl8hc1h4pxbfnhy9hc1l0kxhc9n";
     };
     meta.homepage = "https://github.com/vim-airline/vim-airline/";
   };
@@ -9199,12 +9199,12 @@ final: prev:
 
   vim-clap = buildVimPluginFrom2Nix {
     pname = "vim-clap";
-    version = "2022-11-26";
+    version = "2022-12-03";
     src = fetchFromGitHub {
       owner = "liuchengxu";
       repo = "vim-clap";
-      rev = "aca487d01058c36c245cf35d30913cfb7311eebb";
-      sha256 = "1q4nsjzq7cirqbg5kwc3pww4mqai5i53fq9p8cqw0pyi1vzhvc90";
+      rev = "ea90c8cf804feea294bae47423a15b733a74b5b7";
+      sha256 = "1v6f5ra84sdhrsbqp5vjyhlcjxnykmasbghni600l6ygzlgd2saq";
     };
     meta.homepage = "https://github.com/liuchengxu/vim-clap/";
   };
@@ -9271,12 +9271,12 @@ final: prev:
 
   vim-codefmt = buildVimPluginFrom2Nix {
     pname = "vim-codefmt";
-    version = "2022-11-28";
+    version = "2022-12-04";
     src = fetchFromGitHub {
       owner = "google";
       repo = "vim-codefmt";
-      rev = "0fbe1b695676039b56dd09dcf66dcd23c2a92a47";
-      sha256 = "1j0nfhd7nhr0xynvajf85vg27c5rf2xzsmp7gdswx6nvbwgxni8q";
+      rev = "b97c8fcdaed5c3915e49f70f7fa7aa148d528428";
+      sha256 = "1j3g4rcjy5fr7pbm45bkzsq0kppvrp54wd6dsdzxwd2y1nkrm82l";
     };
     meta.homepage = "https://github.com/google/vim-codefmt/";
   };
@@ -9463,12 +9463,12 @@ final: prev:
 
   vim-dadbod = buildVimPluginFrom2Nix {
     pname = "vim-dadbod";
-    version = "2022-10-29";
+    version = "2022-12-03";
     src = fetchFromGitHub {
       owner = "tpope";
       repo = "vim-dadbod";
-      rev = "87785156a7919f51409f3e6656ea2b3a9e0e8e97";
-      sha256 = "0rbrp8cnkngfnvfvrfv2nfs3c7ryyv9zs738xay15nmcgif4by1s";
+      rev = "c8034ea7160c0fa9351f9f07f964bb335cdd6187";
+      sha256 = "1kbll59gzcrawwgfiv63psciab330id3jc19kmbl3dvbs3m9if8q";
     };
     meta.homepage = "https://github.com/tpope/vim-dadbod/";
   };
@@ -9991,12 +9991,12 @@ final: prev:
 
   vim-fugitive = buildVimPluginFrom2Nix {
     pname = "vim-fugitive";
-    version = "2022-11-23";
+    version = "2022-12-02";
     src = fetchFromGitHub {
       owner = "tpope";
       repo = "vim-fugitive";
-      rev = "49cc58573e746d02024110d9af99e95994ea4b72";
-      sha256 = "09lnf0r3szzqc9ykyq5w1bgx528k0jnhhlwyzcricmrlls67pnsc";
+      rev = "5b0b138483de17a8fd8dfcec0b491782c8fbf102";
+      sha256 = "1nlr50kv90rafy85cr2k2n7pmr5mvmvqiza7qnk0rzlccdada6ry";
     };
     meta.homepage = "https://github.com/tpope/vim-fugitive/";
   };
@@ -10869,12 +10869,12 @@ final: prev:
 
   vim-lsp = buildVimPluginFrom2Nix {
     pname = "vim-lsp";
-    version = "2022-11-10";
+    version = "2022-12-03";
     src = fetchFromGitHub {
       owner = "prabirshrestha";
       repo = "vim-lsp";
-      rev = "e42203b4f0e46a927dd17b28f142fa91661d7163";
-      sha256 = "12v2mh049b037b70q5cpkz0dgqi07hsz4sx2ywvqvwmykv5lrpcv";
+      rev = "0a8d2dfaedf1e51859317f675cefe8403041e76a";
+      sha256 = "03yipczl11q76db7s1a11nmn3k6rw066y4x5jzracfny9f63miw3";
     };
     meta.homepage = "https://github.com/prabirshrestha/vim-lsp/";
   };
@@ -10978,12 +10978,12 @@ final: prev:
 
   vim-matchup = buildVimPluginFrom2Nix {
     pname = "vim-matchup";
-    version = "2022-11-13";
+    version = "2022-12-04";
     src = fetchFromGitHub {
       owner = "andymass";
       repo = "vim-matchup";
-      rev = "55e3330436784fb8ccc35a5cfeb13e48bab9dcd2";
-      sha256 = "170ic9lp566x1l0brj2gj2zpbz5wl57df9wbi3zixm3agj56gnh6";
+      rev = "db5120dd9887c988de7cd973ddb951e465d413e5";
+      sha256 = "047l43z9ak7xrl4p8p8rw5wjakg95b6y2labfp16qq139g3bib0w";
     };
     meta.homepage = "https://github.com/andymass/vim-matchup/";
   };
@@ -11254,12 +11254,12 @@ final: prev:
 
   vim-obsession = buildVimPluginFrom2Nix {
     pname = "vim-obsession";
-    version = "2022-04-05";
+    version = "2022-12-02";
     src = fetchFromGitHub {
       owner = "tpope";
       repo = "vim-obsession";
-      rev = "7d39576149d17bde3c096fd57e3a2cdae65deaf5";
-      sha256 = "0g716c3dvd7068lfgcbxlzn86529kji4zms5n2xgrn3h0vn722zz";
+      rev = "fe9d3e1a9a50171e7d316a52e1e56d868e4c1fe5";
+      sha256 = "0x60j6bq9aql9fqq704cg8bc930c7n1jiaczwsn6slwa55c03zmr";
     };
     meta.homepage = "https://github.com/tpope/vim-obsession/";
   };
@@ -11998,12 +11998,12 @@ final: prev:
 
   vim-sensible = buildVimPluginFrom2Nix {
     pname = "vim-sensible";
-    version = "2022-08-26";
+    version = "2022-12-03";
     src = fetchFromGitHub {
       owner = "tpope";
       repo = "vim-sensible";
-      rev = "8985da7669bbd73afce85ef0e4a3e1ce2e488595";
-      sha256 = "15pvhbk7hkf3z7zsv1bqizqmiw75nvckf3j6njckj5ijx6kzjsnj";
+      rev = "1be4e4e5409caccddf5c2f1bbfa16519f4c93de0";
+      sha256 = "1l2ax16r0bqxzdmgpz4rlx7zj0g4d8d696ibdzwmr0q6nbkpy4w5";
     };
     meta.homepage = "https://github.com/tpope/vim-sensible/";
   };
@@ -12575,12 +12575,12 @@ final: prev:
 
   vim-tmux-navigator = buildVimPluginFrom2Nix {
     pname = "vim-tmux-navigator";
-    version = "2022-11-13";
+    version = "2022-12-04";
     src = fetchFromGitHub {
       owner = "christoomey";
       repo = "vim-tmux-navigator";
-      rev = "c2dab181185101070b0ad6c33451f4e2f56a446a";
-      sha256 = "15581nighr1a82gkn0blkx75l6bz0vfq573nf626dw1qa652nipz";
+      rev = "a40cc7a52787e06fd57650e09be490432e3d4717";
+      sha256 = "0l98v8lbadz32z7i1d1n0b1ggpvbsc71ni3lqm9hd2xhx9rixps1";
     };
     meta.homepage = "https://github.com/christoomey/vim-tmux-navigator/";
   };
@@ -12851,12 +12851,12 @@ final: prev:
 
   vim-wayland-clipboard = buildVimPluginFrom2Nix {
     pname = "vim-wayland-clipboard";
-    version = "2022-11-20";
+    version = "2022-12-07";
     src = fetchFromGitHub {
       owner = "jasonccox";
       repo = "vim-wayland-clipboard";
-      rev = "1d938c6062ccd1d7fe1fcc658f36503e3283c5f6";
-      sha256 = "1dgpgaq0hby85zvcl8vm3jfrpbx1dyx1xrd5i9kd3g64nngbblrv";
+      rev = "c16b7cfed0c4ec22cc6a7f67dfbdd4d8c4ab1848";
+      sha256 = "1l9wcgsj8wrmhcxkw4s82i68954060xafb7jkym3519bx4kq4jxi";
     };
     meta.homepage = "https://github.com/jasonccox/vim-wayland-clipboard/";
   };
@@ -12923,12 +12923,12 @@ final: prev:
 
   vim-xkbswitch = buildVimPluginFrom2Nix {
     pname = "vim-xkbswitch";
-    version = "2022-11-14";
+    version = "2022-12-07";
     src = fetchFromGitHub {
       owner = "lyokha";
       repo = "vim-xkbswitch";
-      rev = "9ac90d328f7863039c6edff0b4b8081349a378e8";
-      sha256 = "1j5vmavmgwvwrarc768x1p5ng4bjyb3fdm118z019r0zpcdknpgx";
+      rev = "e64864ec2e01ba554c6ee5396e4e77f732433738";
+      sha256 = "0sg4ynwr5mw0qpgnvl752d9yslvd8rxl6swz61gnzgg8j3fyhk5f";
     };
     meta.homepage = "https://github.com/lyokha/vim-xkbswitch/";
   };
@@ -13128,12 +13128,12 @@ final: prev:
 
   vimtex = buildVimPluginFrom2Nix {
     pname = "vimtex";
-    version = "2022-11-27";
+    version = "2022-12-06";
     src = fetchFromGitHub {
       owner = "lervag";
       repo = "vimtex";
-      rev = "01333a47ebe70eac21e4b0016b04e031b9cf7b17";
-      sha256 = "0vrmh4ccarz11a2904y3m1n1gp4zl00k5n8jc5231bhv8psdnlj7";
+      rev = "7a887028e91b12268fe812028621152dba549b3c";
+      sha256 = "0q6qf5572b6v4k4xnf5ra5brkpjclh8r34rrhpidc3xkdmgifyg4";
     };
     meta.homepage = "https://github.com/lervag/vimtex/";
   };
@@ -13152,12 +13152,12 @@ final: prev:
 
   vimwiki = buildVimPluginFrom2Nix {
     pname = "vimwiki";
-    version = "2022-03-10";
+    version = "2022-12-05";
     src = fetchFromGitHub {
       owner = "vimwiki";
       repo = "vimwiki";
-      rev = "63af6e72dd3fa840bffb3ebcb8c96970c02e0913";
-      sha256 = "1cvi3bb9kqfwjh3d4biwxgavankj2ljiyss36q8z96czzaz2w40v";
+      rev = "fea8bee382b2051b0137fd2cacf0862823ee69b3";
+      sha256 = "1iwwy7ay01jkxgq83frr1xq0y3jvvs86paa43mn1ky6gk3q57s80";
     };
     meta.homepage = "https://github.com/vimwiki/vimwiki/";
   };
@@ -13465,12 +13465,12 @@ final: prev:
 
   zk-nvim = buildVimPluginFrom2Nix {
     pname = "zk-nvim";
-    version = "2022-11-13";
+    version = "2022-12-04";
     src = fetchFromGitHub {
       owner = "mickael-menu";
       repo = "zk-nvim";
-      rev = "1d2ebc679eeea8bfddc908e31bbe9e8b0928ef21";
-      sha256 = "0inbay3sn8f78wvf1pl785nl0pdiv6m4604d3zh8a27myhw6lr2b";
+      rev = "60478c653aa5fbeac3035b71f5800c5c7a2f5361";
+      sha256 = "0jkmdr7db8rs3cv9xziy58sx4fikxjz1wyaag4g1r7l5mwsf9zrh";
     };
     meta.homepage = "https://github.com/mickael-menu/zk-nvim/";
   };
@@ -13501,12 +13501,12 @@ final: prev:
 
   catppuccin-nvim = buildVimPluginFrom2Nix {
     pname = "catppuccin-nvim";
-    version = "2022-12-01";
+    version = "2022-12-06";
     src = fetchFromGitHub {
       owner = "catppuccin";
       repo = "nvim";
-      rev = "4d2ed20bda0c07e9473c374826721ac16154698b";
-      sha256 = "0xdxfpqlm68s6629h8j3pmpw4p7kfnsxlvbk5k3ii6f2yw0b8fd4";
+      rev = "08ef4cb230a16c5f6b8f33ef1bf0c5b3e192905a";
+      sha256 = "1xzh1ql0iix33ixkdcrvf80xa9c995b6gq2ag0k9q4ikvmid5lx2";
     };
     meta.homepage = "https://github.com/catppuccin/nvim/";
   };
@@ -13525,12 +13525,12 @@ final: prev:
 
   chad = buildVimPluginFrom2Nix {
     pname = "chad";
-    version = "2022-12-01";
+    version = "2022-12-07";
     src = fetchFromGitHub {
       owner = "ms-jpq";
       repo = "chadtree";
-      rev = "4c95882b5e3d67bf31f2b7ea996e0251966e43eb";
-      sha256 = "002r53w9rq13lca4sw34631b526h2wvaf5x9l87kqq0ddm2nwslh";
+      rev = "b0e0b05e5aa8156fe9c8f3a3a3804a434394ab65";
+      sha256 = "1kakayg4v5fdi1hs1zyv6f9hd9im0f36z4f4bk1yszsgycrcyl1z";
     };
     meta.homepage = "https://github.com/ms-jpq/chadtree/";
   };
@@ -13597,12 +13597,12 @@ final: prev:
 
   rose-pine = buildVimPluginFrom2Nix {
     pname = "rose-pine";
-    version = "2022-11-20";
+    version = "2022-12-03";
     src = fetchFromGitHub {
       owner = "rose-pine";
       repo = "neovim";
-      rev = "77b86d932746179a50246692612e889d1cdd72da";
-      sha256 = "11j9nv2n2lgqk5dap89i8irsbwb2l8arilnhv4p5bzi3zv43vy3n";
+      rev = "7610f245821e98232e7ee8dcbf3364725807187d";
+      sha256 = "1050yycxlinnj0fcpwvb18b6i1ahkm3mwc56qmkspj1glhk64cs9";
     };
     meta.homepage = "https://github.com/rose-pine/neovim/";
   };
diff --git a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
index 56c9bf21300..1b3a191a9da 100644
--- a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
@@ -115,23 +115,23 @@
   };
   clojure = buildGrammar {
     language = "clojure";
-    version = "087bac7";
+    version = "8c23e0e";
     source = fetchFromGitHub {
       owner = "sogaiu";
       repo = "tree-sitter-clojure";
-      rev = "087bac78c53fe1387756cd5b8e68a69b3f6d7244";
-      hash = "sha256-KiuSAchtqlVlwyBL4rU+p0fPjm52DrNDPq2ETVXOHQU=";
+      rev = "8c23e0ec078af461ccad43fffbbfc204aa6bc238";
+      hash = "sha256-rbR5/f9Cznl4AFybmpKgEcjKBw4GrUVP67tf4UT6/ZE=";
     };
     meta.homepage = "https://github.com/sogaiu/tree-sitter-clojure";
   };
   cmake = buildGrammar {
     language = "cmake";
-    version = "6e51463";
+    version = "a322653";
     source = fetchFromGitHub {
       owner = "uyha";
       repo = "tree-sitter-cmake";
-      rev = "6e51463ef3052dd3b328322c22172eda093727ad";
-      hash = "sha256-2xJaDgrCJQ2obGYvhsHk2/2p8lFNwuScjbjdxJihh5I=";
+      rev = "a32265307aa2d31941056d69e8b6633e61750b2f";
+      hash = "sha256-LBd3SMem1dxZr/dOdJdEFTQxI6d+H8uYE46yN02E/6Y=";
     };
     meta.homepage = "https://github.com/uyha/tree-sitter-cmake";
   };
@@ -249,12 +249,12 @@
   };
   dockerfile = buildGrammar {
     language = "dockerfile";
-    version = "f913be9";
+    version = "09e316d";
     source = fetchFromGitHub {
       owner = "camdencheek";
       repo = "tree-sitter-dockerfile";
-      rev = "f913be9bb8689af22114605012693146fbe9ddaa";
-      hash = "sha256-EoZDjUyL4dEwE6E9r9KruQ8Kb83bAyyFq7a/NFBdZjU=";
+      rev = "09e316dba307b869831e9399b11a83bbf0f2a24b";
+      hash = "sha256-FffwAt9FJurxFJajLTsQe5tLeZty3nSbXBRkgdjNOJ4=";
     };
     meta.homepage = "https://github.com/camdencheek/tree-sitter-dockerfile";
   };
@@ -371,12 +371,12 @@
   };
   foam = buildGrammar {
     language = "foam";
-    version = "fdb7f14";
+    version = "c238f4a";
     source = fetchFromGitHub {
       owner = "FoamScience";
       repo = "tree-sitter-foam";
-      rev = "fdb7f14b885abfc4df57728c9b2a2f2ad24d3cb7";
-      hash = "sha256-E5Fr8185ypZbkaGIDE9lhQ0Vf1Dphx7n5suNkK0AFHU=";
+      rev = "c238f4af9a5723a212cf1a4c9b31dd5c1d5270a2";
+      hash = "sha256-GCVV7kj+5S12jedyMajw2OcFOJ0Wz8hiDCImh/G1ngg=";
     };
     meta.homepage = "https://github.com/FoamScience/tree-sitter-foam";
   };
@@ -437,12 +437,12 @@
   };
   gitcommit = buildGrammar {
     language = "gitcommit";
-    version = "d3c15bd";
+    version = "f838621";
     source = fetchFromGitHub {
       owner = "gbprod";
       repo = "tree-sitter-gitcommit";
-      rev = "d3c15bdf0165c89872cc1345c5f8815be3cad9cc";
-      hash = "sha256-3ufluVDeCXLksgj68f7MfK+3QrtvLDoc9Xhbh7xz+t0=";
+      rev = "f838621d00831967a39ac8293cd3c23b0f49252e";
+      hash = "sha256-9OulAtUDMP1jKYPOFBfctBVX2TWktkmwPtE3sCh1qD8=";
     };
     meta.homepage = "https://github.com/gbprod/tree-sitter-gitcommit";
   };
@@ -493,12 +493,12 @@
   };
   go = buildGrammar {
     language = "go";
-    version = "05900fa";
+    version = "e34b8a4";
     source = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-go";
-      rev = "05900faa3cdb5d2d8c8bd5e77ee698487e0a8611";
-      hash = "sha256-f885YTswEDH/QfRPUxcLp/1E2zXLKl25R9IyTGKb1eM=";
+      rev = "e34b8a418c33bba8bdf3375e8e55903dff7c68b9";
+      hash = "sha256-Bfp2XsT83x+VPMPB5rHAbSpEkHD7lG0iDq2Yt63Ug8I=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-go";
   };
@@ -571,12 +571,12 @@
   };
   hcl = buildGrammar {
     language = "hcl";
-    version = "45ce22c";
+    version = "0ff887f";
     source = fetchFromGitHub {
       owner = "MichaHoffmann";
       repo = "tree-sitter-hcl";
-      rev = "45ce22c16ec924e34517cf785e23c07952e45893";
-      hash = "sha256-SczU8y70mdqDl2iVKTfD8Taq580x31xMswUhoU48yfE=";
+      rev = "0ff887f2a60a147452d52db060de6b42f42f1441";
+      hash = "sha256-L4B2qtGqrtyLHyUMx1p0t4aKncm72dUE+e19Fv5iqUA=";
     };
     meta.homepage = "https://github.com/MichaHoffmann/tree-sitter-hcl";
   };
@@ -747,12 +747,12 @@
   };
   julia = buildGrammar {
     language = "julia";
-    version = "6287135";
+    version = "91ba1c3";
     source = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-julia";
-      rev = "628713553c42f30595a3b0085bb587e9359b986a";
-      hash = "sha256-vB9HnWQ+659Itu8cvd0meLbbLzn62/dDroA3vB7ZtIs=";
+      rev = "91ba1c3c9b50f388d4b67518c04bc9a003ed3475";
+      hash = "sha256-NLUVDfZUjvTnbYwxwij+f9WL7qhduEGrfAUKvEZh/QU=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-julia";
   };
@@ -780,12 +780,12 @@
   };
   latex = buildGrammar {
     language = "latex";
-    version = "8c75e93";
+    version = "1ec3941";
     source = fetchFromGitHub {
       owner = "latex-lsp";
       repo = "tree-sitter-latex";
-      rev = "8c75e93cd08ccb7ce1ccab22c1fbd6360e3bcea6";
-      hash = "sha256-zkp4De2eBoOsPZRHHT3mIPVWFPYboTvn6AQ4AkwXhFE=";
+      rev = "1ec3941b971dccfa36cb1cd6221a2e4a1cd3e250";
+      hash = "sha256-m/6GWV797gaJnWVU07RvHjfAeRzGT9GZH3M9HkcjUq0=";
     };
     meta.homepage = "https://github.com/latex-lsp/tree-sitter-latex";
   };
@@ -1137,12 +1137,12 @@
   };
   racket = buildGrammar {
     language = "racket";
-    version = "09cb27a";
+    version = "dc9c334";
     source = fetchFromGitHub {
       owner = "6cdh";
       repo = "tree-sitter-racket";
-      rev = "09cb27a06415bce529a26774a842f5a80d50d362";
-      hash = "sha256-+chEzpHh4eBTEpx2+sFXDMco18zNPFUu5HMQ3dB+LwI=";
+      rev = "dc9c33451fefc2d84d226e55c828adc8a66f2e37";
+      hash = "sha256-ie64no94TtAWsSYaBXmic4oyRAA01fMl97+JWcFU1E8=";
     };
     meta.homepage = "https://github.com/6cdh/tree-sitter-racket";
   };
@@ -1214,12 +1214,12 @@
   };
   rust = buildGrammar {
     language = "rust";
-    version = "0431a2c";
+    version = "f7fb205";
     source = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-rust";
-      rev = "0431a2c60828731f27491ee9fdefe25e250ce9c9";
-      hash = "sha256-DnUq8TwLGPtN1GXw0AV2t+tj7UKrU4kU32rjGoCHMpE=";
+      rev = "f7fb205c424b0962de59b26b931fe484e1262b35";
+      hash = "sha256-Onk8i2vGHySsjg/O3OZvl7OlDpg3b5/7481f+jJMPCU=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-rust";
   };
@@ -1291,13 +1291,14 @@
   };
   sql = buildGrammar {
     language = "sql";
-    version = "41f1de2";
+    version = "54b363b";
     source = fetchFromGitHub {
       owner = "derekstride";
       repo = "tree-sitter-sql";
-      rev = "41f1de238b7b4a8cc9e118759881aad8585d36ad";
-      hash = "sha256-LORSWO5Ui/Nq1SReERSWZ+BEtxKEJ545LPpA6HbY8Z4=";
+      rev = "54b363b87c22787f9dcfabb5d8aa221cb65ace42";
+      hash = "sha256-ku4t3IyPNIIXVt3RvUoCG+TUbe62m7EFtXLUiAPb+pQ=";
     };
+    generate = true;
     meta.homepage = "https://github.com/derekstride/tree-sitter-sql";
   };
   supercollider = buildGrammar {
@@ -1414,12 +1415,12 @@
   };
   tsx = buildGrammar {
     language = "tsx";
-    version = "0ae3828";
+    version = "faad909";
     source = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-typescript";
-      rev = "0ae382803abce0807e90f498105c713b9233e0b2";
-      hash = "sha256-we8jkX8Nl9+eGw8c6ZmH5hW7yfzFaNhQ+WDzRvMMx9A=";
+      rev = "faad9094f4061a43d4e9005439e9e85c6541ebe7";
+      hash = "sha256-8W/YX2EP3brbDsURZ8YI04KqgLOK6QqXaiFikpwrTV0=";
     };
     location = "tsx";
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-typescript";
@@ -1448,12 +1449,12 @@
   };
   typescript = buildGrammar {
     language = "typescript";
-    version = "0ae3828";
+    version = "faad909";
     source = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-typescript";
-      rev = "0ae382803abce0807e90f498105c713b9233e0b2";
-      hash = "sha256-we8jkX8Nl9+eGw8c6ZmH5hW7yfzFaNhQ+WDzRvMMx9A=";
+      rev = "faad9094f4061a43d4e9005439e9e85c6541ebe7";
+      hash = "sha256-8W/YX2EP3brbDsURZ8YI04KqgLOK6QqXaiFikpwrTV0=";
     };
     location = "typescript";
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-typescript";
diff --git a/pkgs/applications/editors/vim/plugins/update-shell.nix b/pkgs/applications/editors/vim/plugins/update-shell.nix
index 52a9e741af2..eae7db7f53e 100644
--- a/pkgs/applications/editors/vim/plugins/update-shell.nix
+++ b/pkgs/applications/editors/vim/plugins/update-shell.nix
@@ -3,7 +3,7 @@
 # Ideally, pkgs points to default.nix file of Nixpkgs official tree
 with pkgs;
 let
-  pyEnv = python3.withPackages (ps: [ ps.GitPython ]);
+  pyEnv = python3.withPackages (ps: [ ps.gitpython ]);
 in
 
 mkShell {
diff --git a/pkgs/applications/editors/vim/plugins/vim-utils.nix b/pkgs/applications/editors/vim/plugins/vim-utils.nix
index 09c5527cd0e..f0e4e8e982e 100644
--- a/pkgs/applications/editors/vim/plugins/vim-utils.nix
+++ b/pkgs/applications/editors/vim/plugins/vim-utils.nix
@@ -1,8 +1,6 @@
 # tests available at pkgs/test/vim
-{ lib, stdenv, vim, vimPlugins, vim_configurable, buildEnv, writeText
+{ lib, stdenv, vim, vimPlugins, buildEnv, writeText
 , runCommand, makeWrapper
-, nix-prefetch-hg, nix-prefetch-git
-, fetchFromGitHub, runtimeShell
 , python3
 , callPackage, makeSetupHook
 , linkFarm
@@ -186,9 +184,9 @@ let
       depsOfOptionalPlugins = lib.subtractLists opt (findDependenciesRecursively opt);
       startWithDeps = findDependenciesRecursively start;
       allPlugins = lib.unique (startWithDeps ++ depsOfOptionalPlugins);
-      python3Env = python3.withPackages (ps:
-        lib.flatten (builtins.map (plugin: (plugin.python3Dependencies or (_: [])) ps) allPlugins)
-      );
+      allPython3Dependencies = ps:
+        lib.flatten (builtins.map (plugin: (plugin.python3Dependencies or (_: [])) ps) allPlugins);
+      python3Env = python3.withPackages allPython3Dependencies;
 
       packdirStart = vimFarm "pack/${packageName}/start" "packdir-start" allPlugins;
       packdirOpt = vimFarm "pack/${packageName}/opt" "packdir-opt" opt;
@@ -201,7 +199,7 @@ let
         ln -s ${python3Env}/${python3Env.sitePackages} $out/pack/${packageName}/start/__python3_dependencies/python3
       '';
     in
-      [ packdirStart packdirOpt python3link ];
+      [ packdirStart packdirOpt ] ++ lib.optional (allPython3Dependencies python3.pkgs != []) python3link;
   in
     buildEnv {
       name = "vim-pack-dir";
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 36ce6758aed..834386997e3 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -891,8 +891,8 @@ let
         mktplcRef = {
           name = "gitlens";
           publisher = "eamodio";
-          version = "2022.11.2204";
-          sha256 = "0npr9fymfjnrq7xvfj6fdc04lysz28qncf9r8syv0w9873f3695h";
+          version = "2022.12.604";
+          sha256 = "sha256-yfqGITviASp5ZDEJA+zyVz1LpPWV4FM/4fU4eq52Xng=";
         };
         meta = with lib; {
           changelog = "https://marketplace.visualstudio.com/items/eamodio.gitlens/changelog";
@@ -1468,8 +1468,8 @@ let
         mktplcRef = {
           name = "latex-workshop";
           publisher = "James-Yu";
-          version = "9.1.0";
-          sha256 = "sha256-a/v8/5ztB9DXqYpGWMYSRIwZIj1D+iebG35fO0yDjQQ=";
+          version = "9.1.1";
+          sha256 = "sha256-Xt/z5r9R090Z9nP1v7k+jYm9EOcjy0GfYiYpc7jNid4=";
         };
         meta = with lib; {
           changelog = "https://marketplace.visualstudio.com/items/James-Yu.latex-workshop/changelog";
@@ -2544,8 +2544,8 @@ let
         mktplcRef = {
           name = "code-spell-checker";
           publisher = "streetsidesoftware";
-          version = "2.11.1";
-          sha256 = "sha256-o6Se+xpqwrdJIMnVE/HaDGIoDqZkeX0nTGHa8GjaqVQ=";
+          version = "2.12.0";
+          sha256 = "sha256-Dhd0QVWdCCvdGKuu8OB4KrBS0XUHWLzRSyreAf7sGLU=";
         };
         meta = with lib; {
           changelog = "https://marketplace.visualstudio.com/items/streetsidesoftware.code-spell-checker/changelog";
diff --git a/pkgs/applications/editors/zee/default.nix b/pkgs/applications/editors/zee/default.nix
index 9442044a169..8de11fd5d59 100644
--- a/pkgs/applications/editors/zee/default.nix
+++ b/pkgs/applications/editors/zee/default.nix
@@ -1,4 +1,4 @@
-{ lib, rustPlatform, fetchFromGitHub, pkg-config, openssl, stdenv, Security }:
+{ lib, rustPlatform, fetchFromGitHub, fetchpatch, pkg-config, openssl, stdenv, Security }:
 
 rustPlatform.buildRustPackage rec {
   pname = "zee";
@@ -11,6 +11,11 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-/9SogKOaXdFDB+e0//lrenTTbfmXqNFGr23L+6Pnm8w=";
   };
 
+  cargoPatches = [
+    # fixed upstream but unreleased
+    ./update-ropey-for-rust-1.65.diff
+  ];
+
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [ openssl ] ++ lib.optional stdenv.isDarwin Security;
@@ -20,7 +25,7 @@ rustPlatform.buildRustPackage rec {
   # see https://github.com/zee-editor/zee#syntax-highlighting
   ZEE_DISABLE_GRAMMAR_BUILD=1;
 
-  cargoSha256 = "sha256-mbqI1csnU95VWgax4GjIxB+nhMtmpaeJ8QQ3qb0hY4c=";
+  cargoHash = "sha256-fBBjtjM7AnyAL6EOFstL4h6yS+UoLgxck6Mc0tJcXaI=";
 
   meta = with lib; {
     description = "A modern text editor for the terminal written in Rust";
diff --git a/pkgs/applications/editors/zee/update-ropey-for-rust-1.65.diff b/pkgs/applications/editors/zee/update-ropey-for-rust-1.65.diff
new file mode 100644
index 00000000000..edc3f6baa4b
--- /dev/null
+++ b/pkgs/applications/editors/zee/update-ropey-for-rust-1.65.diff
@@ -0,0 +1,28 @@
+diff --git a/Cargo.lock b/Cargo.lock
+index 7159c28..0fa43c2 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -1248,9 +1248,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "ropey"
+-version = "1.4.1"
++version = "1.5.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "fa0dd9b26e2a102b33d400b7b7d196c81a4014eb96eda90b1c5b48d7215d9633"
++checksum = "bbd22239fafefc42138ca5da064f3c17726a80d2379d817a3521240e78dd0064"
+ dependencies = [
+  "smallvec",
+  "str_indices",
+@@ -1408,9 +1408,9 @@ checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
+ 
+ [[package]]
+ name = "str_indices"
+-version = "0.3.2"
++version = "0.4.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "adfad63a1b47951101cd667a85b2959a62910cf03f814fff25df89c460b873f8"
++checksum = "9d9199fa80c817e074620be84374a520062ebac833f358d74b37060ce4a0f2c0"
+ 
+ [[package]]
+ name = "strsim"
diff --git a/pkgs/applications/emulators/dolphin-emu/default.nix b/pkgs/applications/emulators/dolphin-emu/default.nix
index 5eec3c865df..ad9c470bf42 100644
--- a/pkgs/applications/emulators/dolphin-emu/default.nix
+++ b/pkgs/applications/emulators/dolphin-emu/default.nix
@@ -21,10 +21,10 @@
 , fetchFromGitHub
 , libusb1
 , libevdev
-, wxGTK30-gtk3
+, wxGTK30
 , soundtouch
 , miniupnpc
-, mbedtls
+, mbedtls_2
 , curl
 , lzo
 , sfml
@@ -101,10 +101,10 @@ stdenv.mkDerivation rec {
     portaudio
     libusb1
     libpulseaudio
-    wxGTK30-gtk3
+    wxGTK30
     soundtouch
     miniupnpc
-    mbedtls
+    mbedtls_2
     curl
     lzo
     sfml
diff --git a/pkgs/applications/emulators/dolphin-emu/master.nix b/pkgs/applications/emulators/dolphin-emu/master.nix
index eee0213ea12..17a3049ea4f 100644
--- a/pkgs/applications/emulators/dolphin-emu/master.nix
+++ b/pkgs/applications/emulators/dolphin-emu/master.nix
@@ -20,7 +20,7 @@
 , alsa-lib
 , miniupnpc
 , enet
-, mbedtls
+, mbedtls_2
 , soundtouch
 , sfml
 , xz
@@ -90,7 +90,7 @@ stdenv.mkDerivation rec {
     hidapi
     miniupnpc
     enet
-    mbedtls
+    mbedtls_2
     soundtouch
     sfml
     xz
diff --git a/pkgs/applications/emulators/dolphin-emu/primehack.nix b/pkgs/applications/emulators/dolphin-emu/primehack.nix
index 93ed03097be..73a4485af26 100644
--- a/pkgs/applications/emulators/dolphin-emu/primehack.nix
+++ b/pkgs/applications/emulators/dolphin-emu/primehack.nix
@@ -29,7 +29,7 @@
 , alsa-lib
 , miniupnpc
 , enet
-, mbedtls
+, mbedtls_2
 , soundtouch
 , sfml
 , fmt
@@ -87,7 +87,7 @@ stdenv.mkDerivation rec {
     hidapi
     miniupnpc
     enet
-    mbedtls
+    mbedtls_2
     soundtouch
     sfml
     fmt
diff --git a/pkgs/applications/emulators/mame/emuopts.patch b/pkgs/applications/emulators/mame/001-use-absolute-paths.diff
index 233d64eb15d..35ed10d1817 100644
--- a/pkgs/applications/emulators/mame/emuopts.patch
+++ b/pkgs/applications/emulators/mame/001-use-absolute-paths.diff
@@ -10,18 +10,18 @@
 -	{ OPTION_CTRLRPATH,                                  "ctrlr",     core_options::option_type::STRING,     "path to controller definitions" },
 -	{ OPTION_INIPATH,                                    ".;ini;ini/presets",     core_options::option_type::STRING,     "path to ini files" },
 -	{ OPTION_FONTPATH,                                   ".",         core_options::option_type::STRING,     "path to font files" },
-+	{ OPTION_HASHPATH ";hash_directory;hash",            "hash;@mame@/hash",      core_options::option_type::STRING,     "path to software definition files" },
-+	{ OPTION_SAMPLEPATH ";sp",                           "samples;@mame@/samples",   core_options::option_type::STRING,     "path to audio sample sets" },
-+	{ OPTION_ARTPATH,                                    "artwork;@mame@/artwork",   core_options::option_type::STRING,     "path to artwork files" },
-+	{ OPTION_CTRLRPATH,                                  "ctrlr;@mame@/ctrlr",     core_options::option_type::STRING,     "path to controller definitions" },
-+	{ OPTION_INIPATH,                                    ".;ini;ini/presets;@mame@/ini/presets",     core_options::option_type::STRING,     "path to ini files" },
-+	{ OPTION_FONTPATH,                                   ".;@mame@",         core_options::option_type::STRING,     "path to font files" },
++	{ OPTION_HASHPATH ";hash_directory;hash",            "hash;@mamePath@/hash",      core_options::option_type::STRING,     "path to software definition files" },
++	{ OPTION_SAMPLEPATH ";sp",                           "samples;@mamePath@/samples",   core_options::option_type::STRING,     "path to audio sample sets" },
++	{ OPTION_ARTPATH,                                    "artwork;@mamePath@/artwork",   core_options::option_type::STRING,     "path to artwork files" },
++	{ OPTION_CTRLRPATH,                                  "ctrlr;@mamePath@/ctrlr",     core_options::option_type::STRING,     "path to controller definitions" },
++	{ OPTION_INIPATH,                                    ".;ini;ini/presets;@mamePath@/ini/presets",     core_options::option_type::STRING,     "path to ini files" },
++	{ OPTION_FONTPATH,                                   ".;@mamePath@",         core_options::option_type::STRING,     "path to font files" },
  	{ OPTION_CHEATPATH,                                  "cheat",     core_options::option_type::STRING,     "path to cheat files" },
  	{ OPTION_CROSSHAIRPATH,                              "crosshair", core_options::option_type::STRING,     "path to crosshair files" },
 -	{ OPTION_PLUGINSPATH,                                "plugins",   core_options::option_type::STRING,     "path to plugin files" },
 -	{ OPTION_LANGUAGEPATH,                               "language",  core_options::option_type::STRING,     "path to UI translation files" },
-+	{ OPTION_PLUGINSPATH,                                "plugins;@mame@/plugins",   core_options::option_type::STRING,     "path to plugin files" },
-+	{ OPTION_LANGUAGEPATH,                               "language;@mame@/language",  core_options::option_type::STRING,     "path to UI translation files" },
++	{ OPTION_PLUGINSPATH,                                "plugins;@mamePath@/plugins",   core_options::option_type::STRING,     "path to plugin files" },
++	{ OPTION_LANGUAGEPATH,                               "language;@mamePath@/language",  core_options::option_type::STRING,     "path to UI translation files" },
  	{ OPTION_SWPATH,                                     "software",  core_options::option_type::STRING,     "path to loose software" },
  
  	// output directory options
diff --git a/pkgs/applications/emulators/mame/default.nix b/pkgs/applications/emulators/mame/default.nix
index a5b104d31ab..760b9e63d28 100644
--- a/pkgs/applications/emulators/mame/default.nix
+++ b/pkgs/applications/emulators/mame/default.nix
@@ -1,24 +1,24 @@
 { lib
 , stdenv
+, fetchFromGitHub
 , alsa-lib
+, SDL2
+, SDL2_ttf
 , copyDesktopItems
-, CoreAudioKit
 , expat
-, fetchFromGitHub
-, fetchurl
 , flac
 , fontconfig
-, ForceFeedback
 , glm
 , installShellFiles
+, libXi
+, libXinerama
 , libjpeg
 , libpcap
 , libpulseaudio
-, libXi
-, libXinerama
 , lua5_3
 , makeDesktopItem
 , makeWrapper
+, papirus-icon-theme
 , pkg-config
 , portaudio
 , portmidi
@@ -26,31 +26,26 @@
 , python3
 , qtbase
 , rapidjson
-, SDL2
-, SDL2_ttf
 , sqlite
 , utf8proc
 , which
 , writeScript
 , zlib
+, darwin
 }:
 
 let
-  # Get icon from Arch Linux package
-  icon = fetchurl {
-    url = "https://raw.githubusercontent.com/archlinux/svntogit-community/614b24ef3856cb52b5cafc386b0f77923cbc9156/trunk/mame.svg";
-    sha256 = "sha256-F8RCyTPXZBdeTOHeUKgMDC3dXXM8rwnDzV5rppesQ/Q=";
-  };
-  dest = "$out/opt/mame";
+  inherit (darwin.apple_sdk.frameworks) CoreAudioKit ForceFeedback;
 in
 stdenv.mkDerivation rec {
   pname = "mame";
   version = "0.250";
+  srcVersion = builtins.replaceStrings [ "." ] [ "" ] version;
 
   src = fetchFromGitHub {
     owner = "mamedev";
     repo = "mame";
-    rev = "mame${builtins.replaceStrings [ "." ] [ "" ] version}";
+    rev = "mame${srcVersion}";
     sha256 = "sha256-jexs/1ovRk9Is5orD7hT9fN+dYm+WA+57aZ6JH7zjL4=";
   };
 
@@ -109,15 +104,17 @@ stdenv.mkDerivation rec {
   ];
 
   patches = [
-    # by default MAME assumes that paths with stock resources
-    # are relative and that you run MAME changing to
-    # install directory, so we add absolute paths here
-    ./emuopts.patch
+    # by default MAME assumes that paths with stock resources are relative and
+    # that you run MAME changing to install directory, so we add absolute paths
+    # here
+    ./001-use-absolute-paths.diff
   ];
 
+  # Since the bug described in https://github.com/NixOS/nixpkgs/issues/135438,
+  # it is not possible to use substituteAll
   postPatch = ''
     substituteInPlace src/emu/emuopts.cpp \
-      --subst-var-by mame ${dest}
+      --subst-var-by mamePath "$out/opt/mame"
   '';
 
   desktopItems = [
@@ -134,23 +131,26 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  installPhase = ''
+  # TODO: copy shaders from src/osd/modules/opengl/shader/glsl*.*h
+  # to the final package after we figure out how they work
+  installPhase = let
+    icon = "${papirus-icon-theme}/share/icons/Papirus/32x32/apps/mame.svg";
+  in ''
     runHook preInstall
 
     # mame
-    mkdir -p ${dest}
+    mkdir -p $out/opt/mame
 
     install -Dm755 mame -t $out/bin
     install -Dm644 ${icon} $out/share/icons/hicolor/scalable/apps/mame.svg
     installManPage docs/man/*.1 docs/man/*.6
-    cp -ar {artwork,bgfx,plugins,language,ctrlr,keymaps,hash} ${dest}
-    # TODO: copy shaders from src/osd/modules/opengl/shader/glsl*.*h
-    # to the final package after we figure out how they work
+    cp -ar {artwork,bgfx,plugins,language,ctrlr,keymaps,hash} $out/opt/mame
 
     # mame-tools
-    for _i in castool chdman floptool imgtool jedutil ldresample ldverify nltool nlwav pngcmp regrep romcmp \
-              split srcclean testkeys unidasm; do
-      install -Dm755 $_i -t $tools/bin
+    for _tool in castool chdman floptool imgtool jedutil ldresample ldverify \
+                 nltool nlwav pngcmp regrep romcmp split srcclean testkeys \
+                 unidasm; do
+       install -Dm755 $_tool -t $tools/bin
     done
     mv $tools/bin/{,mame-}split
 
@@ -176,11 +176,26 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    broken = stdenv.isDarwin;
-    description = "Is a multi-purpose emulation framework";
     homepage = "https://www.mamedev.org/";
+    description = "A multi-purpose emulation framework";
+    longDescription = ''
+      MAME's purpose is to preserve decades of software history. As electronic
+      technology continues to rush forward, MAME prevents this important
+      "vintage" software from being lost and forgotten. This is achieved by
+      documenting the hardware and how it functions. The source code to MAME
+      serves as this documentation. The fact that the software is usable serves
+      primarily to validate the accuracy of the documentation (how else can you
+      prove that you have recreated the hardware faithfully?). Over time, MAME
+      (originally stood for Multiple Arcade Machine Emulator) absorbed the
+      sister-project MESS (Multi Emulator Super System), so MAME now documents a
+      wide variety of (mostly vintage) computers, video game consoles and
+      calculators, in addition to the arcade video games that were its initial
+      focus.
+    '';
+    changelog = "https://github.com/mamedev/mame/releases/download/mame${srcVersion}/whatsnew_${srcVersion}.txt";
     license = with licenses; [ bsd3 gpl2Plus ];
-    platforms = platforms.unix;
     maintainers = with maintainers; [ thiagokokada ];
+    platforms = platforms.unix;
+    broken = stdenv.isDarwin;
   };
 }
diff --git a/pkgs/applications/graphics/ImageMagick/6.x.nix b/pkgs/applications/graphics/ImageMagick/6.x.nix
index d0b76706dc9..e09de1b2502 100644
--- a/pkgs/applications/graphics/ImageMagick/6.x.nix
+++ b/pkgs/applications/graphics/ImageMagick/6.x.nix
@@ -35,13 +35,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "imagemagick";
-  version = "6.9.12-26";
+  version = "6.9.12-68";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick6";
     rev = version;
-    sha256 = "sha256-oNorY/93jk1v5BS1T3wqctXuzV4o8JlyZtHnsNYmO4U=";
+    sha256 = "sha256-slQcA0cblxtG/1DiJx5swUh7Kfwgz5HG70eqJFLaQJI=";
   };
 
   outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big
@@ -91,7 +91,7 @@ stdenv.mkDerivation rec {
     ++ lib.optional libXtSupport libXt
     ++ lib.optional libwebpSupport libwebp;
 
-  doCheck = false; # fails 6 out of 76 tests
+  doCheck = false; # fails 2 out of 76 tests
 
   postInstall = ''
     (cd "$dev/include" && ln -s ImageMagick* ImageMagick)
diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
index 44397108f24..5de210fcad2 100644
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -46,13 +46,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "imagemagick";
-  version = "7.1.0-52";
+  version = "7.1.0-53";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     rev = version;
-    hash = "sha256-GV71O4cHUKJ7+6u4T+vdaFz5q2SpZVDCfEAbfz0s6f4=";
+    hash = "sha256-U111mor498zAyoYKqCerb9cnxUUOlXKYPfaIzKxZiUM=";
   };
 
   outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big
diff --git a/pkgs/applications/graphics/digikam/default.nix b/pkgs/applications/graphics/digikam/default.nix
index f08e49283c1..19d0f5242e0 100644
--- a/pkgs/applications/graphics/digikam/default.nix
+++ b/pkgs/applications/graphics/digikam/default.nix
@@ -56,11 +56,11 @@
 
 mkDerivation rec {
   pname   = "digikam";
-  version = "7.8.0";
+  version = "7.9.0";
 
   src = fetchurl {
     url = "mirror://kde/stable/${pname}/${version}/digiKam-${version}.tar.xz";
-    sha256 = "sha256-sIV3sLFe+ZhDaVcIqiwOmNVHMD2Fvio7OZBUhPLKts4=";
+    sha256 = "sha256-w7gKvAkNo8u8QuZ6QDCA1/X+CnyYaYc1vaVWxgMUurQ=";
   };
 
   nativeBuildInputs = [ cmake doxygen extra-cmake-modules kdoctools wrapGAppsHook ];
diff --git a/pkgs/applications/graphics/drawio/default.nix b/pkgs/applications/graphics/drawio/default.nix
index e755b708a06..513822b4e74 100644
--- a/pkgs/applications/graphics/drawio/default.nix
+++ b/pkgs/applications/graphics/drawio/default.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "drawio";
-  version = "20.3.0";
+  version = "20.6.1";
 
   src = fetchurl {
     url = "https://github.com/jgraph/drawio-desktop/releases/download/v${version}/drawio-x86_64-${version}.rpm";
-    sha256 = "bfcd363f549ce8dc13ae2287cec5099e4bf1d0d4b6f8deef40a81279f78817e1";
+    sha256 = "8d1e3d44e53e62dd6dc7f231af5b682c9ff0e798a6480528444ba52cce02b4c9";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/graphics/freecad/default.nix b/pkgs/applications/graphics/freecad/default.nix
index 3794f7cf84f..bcc504effec 100644
--- a/pkgs/applications/graphics/freecad/default.nix
+++ b/pkgs/applications/graphics/freecad/default.nix
@@ -4,7 +4,7 @@
 , fetchFromGitHub
 , cmake
 , ninja
-, GitPython
+, gitpython
 , boost
 , coin3d
 , eigen
@@ -68,7 +68,7 @@ mkDerivation rec {
   ];
 
   buildInputs = [
-    GitPython # for addon manager
+    gitpython # for addon manager
     boost
     coin3d
     eigen
diff --git a/pkgs/applications/graphics/rnote/default.nix b/pkgs/applications/graphics/rnote/default.nix
index eb0eaaeda95..560c5c6a492 100644
--- a/pkgs/applications/graphics/rnote/default.nix
+++ b/pkgs/applications/graphics/rnote/default.nix
@@ -6,7 +6,6 @@
 , clang
 , cmake
 , desktop-file-utils
-, gio-sharp
 , glib
 , gstreamer
 , gtk4
@@ -24,20 +23,20 @@
 
 stdenv.mkDerivation rec {
   pname = "rnote";
-  version = "0.5.7";
+  version = "0.5.9";
 
   src = fetchFromGitHub {
     owner = "flxzt";
     repo = "rnote";
     rev = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-w4y+t8idcaNwvC2Wp9SRjcd4m23Zt+yHG2fjOA2rBU8=";
+    hash = "sha256-Sy8EHl4UuDMwRAKDkl7njD9GSzKpy1Cfsgw53On+nxo=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-Hybbbokru4vz5ly3oZuNGdBa+lYbhdYjESUpRxIUqJc=";
+    hash = "sha256-Pe4lNcvJNELAitaGY56EUJ8iN7Dkh8DoUpA/t+aRuqk=";
   };
 
   nativeBuildInputs = [
@@ -60,7 +59,6 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     alsa-lib
-    gio-sharp
     glib
     gstreamer
     gtk4
@@ -81,6 +79,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     homepage = "https://github.com/flxzt/rnote";
+    changelog = "https://github.com/flxzt/rnote/releases/tag/${src.rev}";
     description = "Simple drawing application to create handwritten notes";
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ dotlambda yrd ];
diff --git a/pkgs/applications/misc/1password/default.nix b/pkgs/applications/misc/1password/default.nix
index e744388b864..5498651cfe8 100644
--- a/pkgs/applications/misc/1password/default.nix
+++ b/pkgs/applications/misc/1password/default.nix
@@ -12,12 +12,12 @@ let
     if extension == "zip" then fetchzip args else fetchurl args;
 
   pname = "1password-cli";
-  version = "2.7.3";
+  version = "2.9.1";
   sources = rec {
-    aarch64-linux = fetch "linux_arm64" "sha256-FxApOWyExyfuRFQhxAVBWZGqQNmarBFBRB4jqsreWL0=" "zip";
-    i686-linux = fetch "linux_386" "sha256-Ta6mdmcsKnNRMz9vwEadZ/xXVBran5BIJQngzNz3PUs=" "zip";
-    x86_64-linux = fetch "linux_amd64" "sha256-Lvxnp5KmkIj9jnaWg02a27eRYIx7WTNSLx+RJ04Vt+g=" "zip";
-    aarch64-darwin = fetch "apple_universal" "sha256-6qrNgb5ae+qqlNsNDLbKNeWj0o/SRs+2G/4DfK5Wnhg=" "pkg";
+    aarch64-linux = fetch "linux_arm64" "sha256-sFh3jIGknR7RA3/pckvBkFvVoxYfXqYuyUJuc/AfecU=" "zip";
+    i686-linux = fetch "linux_386" "sha256-JbBjAdGRtpwkk1svoyNw22BGbslwD8ZuNJRihUoFMP4=" "zip";
+    x86_64-linux = fetch "linux_amd64" "sha256-yUo8LhT9iTl1z5+Cs9/E/YPMrnnimhFK9A1b1og0TSA=" "zip";
+    aarch64-darwin = fetch "apple_universal" "sha256-IFaLcMXOLc0oZIWVOaDuyUmUxJc+Keeg77RR/SlCGxI=" "pkg";
     x86_64-darwin = aarch64-darwin;
   };
   platforms = builtins.attrNames sources;
diff --git a/pkgs/applications/misc/authenticator/default.nix b/pkgs/applications/misc/authenticator/default.nix
index cdf6ca3e6f8..735355107ef 100644
--- a/pkgs/applications/misc/authenticator/default.nix
+++ b/pkgs/applications/misc/authenticator/default.nix
@@ -42,7 +42,6 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     appstream-glib
-    clang
     desktop-file-utils
     meson
     ninja
@@ -52,6 +51,7 @@ stdenv.mkDerivation rec {
     cargoSetupHook
     rust.cargo
     rust.rustc
+    bindgenHook
   ]);
 
   buildInputs = [
@@ -69,8 +69,6 @@ stdenv.mkDerivation rec {
     zbar
   ];
 
-  LIBCLANG_PATH = "${lib.getLib libclang}/lib";
-
   meta = {
     description = "Two-factor authentication code generator for GNOME";
     homepage = "https://gitlab.gnome.org/World/Authenticator";
diff --git a/pkgs/applications/misc/clipcat/default.nix b/pkgs/applications/misc/clipcat/default.nix
index 38c0c103943..be197e81937 100644
--- a/pkgs/applications/misc/clipcat/default.nix
+++ b/pkgs/applications/misc/clipcat/default.nix
@@ -14,8 +14,6 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "1n4il3l59m2a6ca54vfaivzg25abf8s4w5kpd5q51p13624iz0kb";
 
-  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
-
   # needed for internal protobuf c wrapper library
   PROTOC = "${protobuf}/bin/protoc";
   PROTOC_INCLUDE = "${protobuf}/include";
@@ -23,8 +21,7 @@ rustPlatform.buildRustPackage rec {
   nativeBuildInputs = [
     pkg-config
 
-    clang
-    llvmPackages.libclang
+    rustPlatform.bindgenHook
 
     rustfmt
     protobuf
diff --git a/pkgs/applications/misc/hugo/default.nix b/pkgs/applications/misc/hugo/default.nix
index bfe38027589..a92a6801ba9 100644
--- a/pkgs/applications/misc/hugo/default.nix
+++ b/pkgs/applications/misc/hugo/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "hugo";
-  version = "0.107.0";
+  version = "0.108.0";
 
   src = fetchFromGitHub {
     owner = "gohugoio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-8Ru1T6GSz5TfMxFvUU2QgpiWNLJK+ky723qc3flrDIw=";
+    sha256 = "sha256-MbpBGqu7IwQCf9DjSfIDi25ZGJYTI6xxSk9wPWxychw=";
   };
 
-  vendorSha256 = "sha256-92QLkSUrwMEZ/8pIeOj4KKtC47oN+ITxJnpp7Fb0Z10=";
+  vendorSha256 = "sha256-qFqSpQExz4u1ngjpt2Li6dk/qz4DCKEY9IcFFCna5is=";
 
   doCheck = false;
 
diff --git a/pkgs/applications/misc/imag/default.nix b/pkgs/applications/misc/imag/default.nix
index b637cd077d7..acc03f59a70 100644
--- a/pkgs/applications/misc/imag/default.nix
+++ b/pkgs/applications/misc/imag/default.nix
@@ -21,13 +21,11 @@ rustPlatform.buildRustPackage rec {
     sha256 = "0f9915f083z5qqcxyavj0w6m973c8m1x7kfb89pah5agryy5mkaq";
   };
 
-  nativeBuildInputs = [ installShellFiles pkg-config ];
+  nativeBuildInputs = [ installShellFiles pkg-config rustPlatform.bindgenHook ];
   buildInputs = [ openssl ]
     ++ lib.optional stdenv.isDarwin Security;
   checkInputs = [ gitMinimal util-linuxMinimal ];
 
-  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
-
   cargoSha256 = "1vnrc72g2271i2p847z30kplxmdpi60n3dzpw0s7dahg33g14ai6";
 
   checkPhase = ''
diff --git a/pkgs/applications/misc/latte-dock/default.nix b/pkgs/applications/misc/latte-dock/default.nix
index 7e48781f5c4..f232400fbfb 100644
--- a/pkgs/applications/misc/latte-dock/default.nix
+++ b/pkgs/applications/misc/latte-dock/default.nix
@@ -22,7 +22,7 @@ mkDerivation rec {
     ./0001-Disable-autostart.patch
   ];
 
-  fixupPhase = ''
+  postInstall = ''
     mkdir -p $out/etc/xdg/autostart
     cp $out/share/applications/org.kde.latte-dock.desktop $out/etc/xdg/autostart
   '';
diff --git a/pkgs/applications/misc/lenmus/default.nix b/pkgs/applications/misc/lenmus/default.nix
index f50dd23ff01..023045d6791 100644
--- a/pkgs/applications/misc/lenmus/default.nix
+++ b/pkgs/applications/misc/lenmus/default.nix
@@ -11,7 +11,7 @@
 , libpng
 , pngpp
 , zlib
-, wxGTK30-gtk3
+, wxGTK30
 , wxsqlite3
 }:
 
@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
     libpng
     pngpp
     zlib
-    wxGTK30-gtk3
+    wxGTK30
     wxsqlite3
   ];
 
diff --git a/pkgs/applications/misc/lutris/fhsenv.nix b/pkgs/applications/misc/lutris/fhsenv.nix
index b4b2b2e2ac5..075755bf217 100644
--- a/pkgs/applications/misc/lutris/fhsenv.nix
+++ b/pkgs/applications/misc/lutris/fhsenv.nix
@@ -30,7 +30,7 @@ in buildFHSUserEnv {
     # DGen // TODO: libarchive is broken
 
     # Dolphin
-    bluez ffmpeg gettext portaudio wxGTK30-gtk3 miniupnpc mbedtls lzo sfml gsm
+    bluez ffmpeg gettext portaudio wxGTK30 miniupnpc mbedtls_2 lzo sfml gsm
     wavpack orc nettle gmp pcre vulkan-loader
 
     # DOSBox
diff --git a/pkgs/applications/misc/mediainfo-gui/default.nix b/pkgs/applications/misc/mediainfo-gui/default.nix
index a15733dd526..b3ca8032b19 100644
--- a/pkgs/applications/misc/mediainfo-gui/default.nix
+++ b/pkgs/applications/misc/mediainfo-gui/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, autoreconfHook, pkg-config, libmediainfo, wxGTK30-gtk3
+{ lib, stdenv, fetchurl, autoreconfHook, pkg-config, libmediainfo, wxGTK30
 , desktop-file-utils, libSM, imagemagick }:
 
 stdenv.mkDerivation rec {
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
-  buildInputs = [ libmediainfo wxGTK30-gtk3 desktop-file-utils libSM imagemagick ];
+  buildInputs = [ libmediainfo wxGTK30 desktop-file-utils libSM imagemagick ];
 
   sourceRoot = "./MediaInfo/Project/GNU/GUI/";
 
diff --git a/pkgs/applications/misc/openrgb/default.nix b/pkgs/applications/misc/openrgb/default.nix
index 6de5736e9ac..ab8415a1882 100644
--- a/pkgs/applications/misc/openrgb/default.nix
+++ b/pkgs/applications/misc/openrgb/default.nix
@@ -1,4 +1,4 @@
-{ lib, mkDerivation, fetchFromGitLab, qmake, libusb1, hidapi, pkg-config, coreutils, mbedtls }:
+{ lib, mkDerivation, fetchFromGitLab, qmake, libusb1, hidapi, pkg-config, coreutils, mbedtls_2 }:
 
 mkDerivation rec {
   pname = "openrgb";
@@ -12,7 +12,7 @@ mkDerivation rec {
   };
 
   nativeBuildInputs = [ qmake pkg-config ];
-  buildInputs = [ libusb1 hidapi mbedtls ];
+  buildInputs = [ libusb1 hidapi mbedtls_2 ];
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/applications/misc/oxker/default.nix b/pkgs/applications/misc/oxker/default.nix
index 50d0e5a012b..0647ba26dc0 100644
--- a/pkgs/applications/misc/oxker/default.nix
+++ b/pkgs/applications/misc/oxker/default.nix
@@ -2,14 +2,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "oxker";
-  version = "0.1.7";
+  version = "0.1.9";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-kMomzIViN7ooBsjUfCIk0XRi4WtXtiaHWHT2pECx//k=";
+    sha256 = "sha256-3J3Xe9LT4bHatU/wWsF0Gq9gGRcSdCzyQnIIfLXE8KA=";
   };
 
-  cargoSha256 = "sha256-ASBu4p8+/Donmynnyryktc6dXA3yiOb9w5XpmN4PotY=";
+  cargoSha256 = "sha256-TWpshqvWMRk2A6RvjWWQc7Nu6tOrctUBZmzyjEFKPRw=";
 
   meta = with lib; {
     description = "A simple tui to view & control docker containers";
diff --git a/pkgs/applications/misc/pwsafe/default.nix b/pkgs/applications/misc/pwsafe/default.nix
index 75f09742c1e..8f8aef6c8cf 100644
--- a/pkgs/applications/misc/pwsafe/default.nix
+++ b/pkgs/applications/misc/pwsafe/default.nix
@@ -6,7 +6,7 @@
 , zip
 , gettext
 , perl
-, wxGTK30-gtk3
+, wxGTK30
 , libXext
 , libXi
 , libXt
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
     libXi
     libXt
     libXtst
-    wxGTK30-gtk3
+    wxGTK30
     curl
     qrencode
     libuuid
diff --git a/pkgs/applications/misc/tippecanoe/default.nix b/pkgs/applications/misc/tippecanoe/default.nix
index 4d0936c0b43..a11e1c51741 100644
--- a/pkgs/applications/misc/tippecanoe/default.nix
+++ b/pkgs/applications/misc/tippecanoe/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tippecanoe";
-  version = "2.13.1";
+  version = "2.15.0";
 
   src = fetchFromGitHub {
     owner = "felt";
     repo = "tippecanoe";
     rev = finalAttrs.version;
-    hash = "sha256-cDNaZ3ZYCUWg30Td1hlzzaB46tI7cFZLvgwCAZN72QI=";
+    hash = "sha256-InKVwB031BLOngcLAa1zRbgoswUb4z5I0FPNMZk9KVI=";
   };
 
   buildInputs = [ sqlite zlib ];
diff --git a/pkgs/applications/misc/tut/default.nix b/pkgs/applications/misc/tut/default.nix
index 1e7c61dca2b..b33182dc68a 100644
--- a/pkgs/applications/misc/tut/default.nix
+++ b/pkgs/applications/misc/tut/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "tut";
-  version = "1.0.23";
+  version = "1.0.24";
 
   src = fetchFromGitHub {
     owner = "RasmusLindroth";
     repo = pname;
     rev = version;
-    sha256 = "sha256-nFN0F80QZh3SALtG3xe6mH0zbhcLSRtmcHosD6aPvrE=";
+    sha256 = "sha256-UkgZOBNEeeYkcdp8beePrFmFLa7UWGbQ4dynl8QwnK8=";
   };
 
-  vendorSha256 = "sha256-Y5nHADLKCaqHIje7vMS3mAwiGx4tHixBzYZM+iHEZb8=";
+  vendorSha256 = "sha256-af+uO3NEkMt+aZoOa8NWccgtLD0Kggr2ZZwfIxoP3EU=";
 
   meta = with lib; {
     description = "A TUI for Mastodon with vim inspired keys";
diff --git a/pkgs/applications/misc/xplr/default.nix b/pkgs/applications/misc/xplr/default.nix
index 772d479ff78..678b8968aae 100644
--- a/pkgs/applications/misc/xplr/default.nix
+++ b/pkgs/applications/misc/xplr/default.nix
@@ -2,18 +2,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "xplr";
-  version = "0.20.0";
+  version = "0.20.1";
 
   src = fetchFromGitHub {
     owner = "sayanarijit";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-TH5ksbEVBlOPmqQOtRmoHTDBRkj/KaMsM+Xc7e2ObzY=";
+    sha256 = "sha256-b3TdhziXPytHitilMBkr6OGaI+CBI3w4qcTIkQtOAjs=";
   };
 
   buildInputs = lib.optional stdenv.isDarwin libiconv;
 
-  cargoSha256 = "sha256-RcH1J5I9FPQ/Npq4I5lcOsZHzvKyYhxmqOIEYcBXqU0=";
+  cargoSha256 = "sha256-pdXLuogkz5q4+B/y/alA900OHVGBT8W6BR7I2aH8IaA=";
 
   meta = with lib; {
     description = "A hackable, minimal, fast TUI file explorer";
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.json b/pkgs/applications/networking/browsers/chromium/upstream-info.json
index 5c9c3ae7270..72dd05fdc1d 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@@ -1,8 +1,8 @@
 {
   "stable": {
-    "version": "108.0.5359.94",
-    "sha256": "1zmndi4q9x8fyixwl1mp5qyf883x9xafq7ipzf9vk9d8h62521q6",
-    "sha256bin64": "03s85hf4vxpil27c1kkdicihb42diyyxwfcjji0bq950nl8vpx2d",
+    "version": "108.0.5359.98",
+    "sha256": "07jnhd5y7k4zp2ipz052isw7llagxn8l8rbz8x3jkjz3f5wi7dk0",
+    "sha256bin64": "1hx49932g8abnb5f3a4ly7kjbrkh5bs040dh96zpxvfqx7dn6vrs",
     "deps": {
       "gn": {
         "version": "2022-10-05",
@@ -45,8 +45,8 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "108.0.5359.95",
-    "sha256": "1b3r2yl8qkp8k0kq5yi0a1xsmglniqn3v318fhx0k12cagrgbd5b",
+    "version": "108.0.5359.99",
+    "sha256": "0v5ynal3s28s4f9s4s95hblnjxiy6498qmk04s0vf2ixqwi7rivn",
     "sha256bin64": null,
     "deps": {
       "gn": {
@@ -56,8 +56,8 @@
         "sha256": "1rhadb6qk867jafr85x2m3asis3jv7x06blhmad2d296p26d5w6x"
       },
       "ungoogled-patches": {
-        "rev": "108.0.5359.95-1",
-        "sha256": "0fl95hw6ll0g4lrccfxhhnkz3plqm003z09dz8dr6ycx5x3vqk0b"
+        "rev": "108.0.5359.99-1",
+        "sha256": "0qibibgi54mdwmmcmz613qk9mgjczspvq09bz5m0wpkxbx7hla0i"
       }
     }
   }
diff --git a/pkgs/applications/networking/browsers/dillo/default.nix b/pkgs/applications/networking/browsers/dillo/default.nix
index 9c409c29818..aff0042ded3 100644
--- a/pkgs/applications/networking/browsers/dillo/default.nix
+++ b/pkgs/applications/networking/browsers/dillo/default.nix
@@ -8,7 +8,7 @@
 , libXinerama
 , libjpeg
 , libpng
-, mbedtls
+, mbedtls_2
 , openssl
 , perl
 , pkg-config
@@ -38,7 +38,7 @@ stdenv.mkDerivation {
     libXinerama
     libjpeg
     libpng
-    mbedtls
+    mbedtls_2
     openssl
     perl
   ];
diff --git a/pkgs/applications/networking/browsers/dillong/default.nix b/pkgs/applications/networking/browsers/dillong/default.nix
index 2d12134caad..7fc7cc07121 100644
--- a/pkgs/applications/networking/browsers/dillong/default.nix
+++ b/pkgs/applications/networking/browsers/dillong/default.nix
@@ -5,7 +5,7 @@
 , pkg-config
 , which
 , fltk
-, mbedtls
+, mbedtls_2
 }:
 
 stdenv.mkDerivation {
@@ -27,7 +27,7 @@ stdenv.mkDerivation {
 
   buildInputs = [
     fltk
-    mbedtls
+    mbedtls_2
   ];
 
   # The start_page and home settings refer to /usr.
diff --git a/pkgs/applications/networking/browsers/offpunk/default.nix b/pkgs/applications/networking/browsers/offpunk/default.nix
index 98a5b1cf50f..82ba0cab8e2 100644
--- a/pkgs/applications/networking/browsers/offpunk/default.nix
+++ b/pkgs/applications/networking/browsers/offpunk/default.nix
@@ -31,14 +31,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "offpunk";
-  version = "1.6";
+  version = "1.7.1";
 
   src = fetchFromGitea {
     domain = "notabug.org";
     owner = "ploum";
     repo = "offpunk";
     rev = "v${finalAttrs.version}";
-    sha256 = "1pfafb96xk7vis26zhfq254waz1ic9p0zdkxwpqs84p3vsmny775";
+    sha256 = "1y1xb1ccsprl0xkn4hlh09j8y5xpdn6r860xlrmk12wfk2xrfbfy";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/networking/browsers/vivaldi/default.nix b/pkgs/applications/networking/browsers/vivaldi/default.nix
index 53c01b977e4..435b5c4fe5d 100644
--- a/pkgs/applications/networking/browsers/vivaldi/default.nix
+++ b/pkgs/applications/networking/browsers/vivaldi/default.nix
@@ -11,6 +11,7 @@
 , isSnapshot ? false
 , proprietaryCodecs ? false, vivaldi-ffmpeg-codecs ? null
 , enableWidevine ? false, vivaldi-widevine ? null
+, forceDarkMode ? false
 , commandLineArgs ? ""
 , pulseSupport ? stdenv.isLinux, libpulseaudio
 }:
@@ -20,11 +21,11 @@ let
   vivaldiName = if isSnapshot then "vivaldi-snapshot" else "vivaldi";
 in stdenv.mkDerivation rec {
   pname = "vivaldi";
-  version = "5.4.2753.47";
+  version = "5.6.2867.36";
 
   src = fetchurl {
     url = "https://downloads.vivaldi.com/${branch}/vivaldi-${branch}_${version}-1_amd64.deb";
-    sha256 = "1p155mcrmfz395yajxa6fqjk1paac216kim26i3r56wah5329gmr";
+    sha256 = "sha256-dTXppRn/bl+HYVzqyrKBXb2YAaw0lRJkwAeukalv3a4=d";
   };
 
   unpackPhase = ''
@@ -79,7 +80,7 @@ in stdenv.mkDerivation rec {
     substituteInPlace "$out"/share/applications/*.desktop \
       --replace /usr/bin/${vivaldiName} "$out"/bin/vivaldi
     substituteInPlace "$out"/share/applications/*.desktop \
-      --replace vivaldi-stable vivaldi
+      --replace vivaldi-stable "vivaldi ${lib.optionalString forceDarkMode "--force-dark-mode"}"
     local d
     for d in 16 22 24 32 48 64 128 256; do
       mkdir -p "$out"/share/icons/hicolor/''${d}x''${d}/apps
diff --git a/pkgs/applications/networking/cluster/argocd/default.nix b/pkgs/applications/networking/cluster/argocd/default.nix
index d6ca151e7a6..3fce464f444 100644
--- a/pkgs/applications/networking/cluster/argocd/default.nix
+++ b/pkgs/applications/networking/cluster/argocd/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "argocd";
-  version = "2.5.3";
+  version = "2.5.4";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo-cd";
     rev = "v${version}";
-    sha256 = "sha256-cL1QV0D8m8rqSDuQgsYBPY7n5K2dy9s9c8VRx65+SV0=";
+    sha256 = "sha256-Wwm9YN/gPsb4AU+JFUDrJQbuK5AEqzX5/D64/6tOtkw=";
   };
 
   proxyVendor = true; # darwin/linux hash mismatch
diff --git a/pkgs/applications/networking/cluster/kyverno/default.nix b/pkgs/applications/networking/cluster/kyverno/default.nix
index b1d486c5180..ebaca441c33 100644
--- a/pkgs/applications/networking/cluster/kyverno/default.nix
+++ b/pkgs/applications/networking/cluster/kyverno/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "kyverno";
-  version = "1.8.2";
+  version = "1.8.3";
 
   src = fetchFromGitHub {
     owner = "kyverno";
     repo = "kyverno";
     rev = "v${version}";
-    sha256 = "sha256-U0VcLxI5hSVqU9N+99/qOjueKi6EdVMT2dTyZUSpNXw=";
+    sha256 = "sha256-AsUgjGoDoT/GN+Z2tXd0KjVFcVI1KF3nVRsLDWkY9HM=";
   };
 
   ldflags = [
diff --git a/pkgs/applications/networking/cluster/ssm-agent/default.nix b/pkgs/applications/networking/cluster/ssm-agent/default.nix
index 86b48633c25..baf85847875 100644
--- a/pkgs/applications/networking/cluster/ssm-agent/default.nix
+++ b/pkgs/applications/networking/cluster/ssm-agent/default.nix
@@ -3,6 +3,7 @@
 , buildGoPackage
 , makeWrapper
 , fetchFromGitHub
+, fetchpatch
 , coreutils
 , nettools
 , dmidecode
@@ -47,6 +48,12 @@ buildGoPackage rec {
     # They used constants from another package that I couldn't figure
     # out how to resolve, so hardcoded the constants.
     ./0002-version-gen-don-t-use-unnecessary-constants.patch
+
+    (fetchpatch {
+      name = "CVE-2022-29527.patch";
+      url = "https://github.com/aws/amazon-ssm-agent/commit/0fe8ae99b2ff25649c7b86d3bc05fc037400aca7.patch";
+      sha256 = "sha256-5g14CxhsHLIgs1Vkfw8FCKEJ4AebNqZKf3ZzoAN/T9U=";
+    })
   ];
 
   preConfigure = ''
diff --git a/pkgs/applications/networking/cluster/terraform-compliance/default.nix b/pkgs/applications/networking/cluster/terraform-compliance/default.nix
index e60c4f14e30..590abb80ace 100644
--- a/pkgs/applications/networking/cluster/terraform-compliance/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-compliance/default.nix
@@ -1,47 +1,31 @@
 { lib
-, GitPython
-, buildPythonApplication
-, emoji
 , fetchFromGitHub
-, filetype
-, ipython
-, junit-xml
-, lxml
-, mock
-, netaddr
-, pytestCheckHook
-, radish-bdd
-, semver
+, python3
 }:
 
-buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "terraform-compliance";
-  version = "1.2.11";
+  version = "1.3.34";
+  format = "setuptools";
 
-  # No tests in Pypi package
   src = fetchFromGitHub {
-    owner = "eerkunt";
-    repo = pname;
-    rev = version;
-    sha256 = "161mszmxqp3wypnda48ama2mmq8yjilkxahwc1mxjwzy1n19sn7v";
+    owner = "terraform-compliance";
+    repo = "cli";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-1TFLpBwkpMMdiJJfVvDXlJg4SXWQ8VV605wMFGU+InQ=";
   };
 
   postPatch = ''
     substituteInPlace setup.py \
-      --replace "IPython==7.16.1" "IPython"
+      --replace "IPython==7.16.1" "IPython" \
+      --replace "diskcache==5.1.0" "diskcache>=5.1.0"
   '';
 
-  checkInputs = [ pytestCheckHook ];
-
-  disabledTests = [
-    "test_which_success"
-    "test_readable_plan_file_is_not_json"
-  ];
-
-  propagatedBuildInputs = [
-    GitPython
+  propagatedBuildInputs = with python3.pkgs; [
+    diskcache
     emoji
     filetype
+    gitpython
     ipython
     junit-xml
     lxml
@@ -51,9 +35,23 @@ buildPythonApplication rec {
     semver
   ];
 
+  checkInputs = with python3.pkgs; [
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    "test_which_success"
+    "test_readable_plan_file_is_not_json"
+  ];
+
+  pythonImportsCheck = [
+    "terraform_compliance"
+  ];
+
   meta = with lib; {
     description = "BDD test framework for terraform";
-    homepage = "https://github.com/eerkunt/terraform-compliance";
+    homepage = "https://github.com/terraform-compliance/cli";
+    changelog = "https://github.com/terraform-compliance/cli/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ kalbasit ];
   };
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 54a3a16e6d1..6fc1405b706 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -48,11 +48,11 @@
     "vendorHash": "sha256-byReViTX0KRFVgWMkte00CDB/3Mw8Ov5GyD48sENmIA="
   },
   "alicloud": {
-    "hash": "sha256-YdXnw0j2PSuT2BoQQUxyomH+dycjy6Fed7+xVuOwJhk=",
+    "hash": "sha256-4f29+7irL+6uNTEFnUu46LGz4aBDwortClCZ0+EDZ4Q=",
     "homepage": "https://registry.terraform.io/providers/aliyun/alicloud",
     "owner": "aliyun",
     "repo": "terraform-provider-alicloud",
-    "rev": "v1.193.0",
+    "rev": "v1.193.1",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -112,13 +112,13 @@
     "vendorHash": null
   },
   "aws": {
-    "hash": "sha256-g38aJ8JN/0PZ0ArSti1/5nzflIlkz/qhn5Qz4yXCie8=",
+    "hash": "sha256-5eqUaO8XRPh2wkltGu7D3GToNAq1zSpQ1LS/h0W/CQA=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/aws",
     "owner": "hashicorp",
     "repo": "terraform-provider-aws",
-    "rev": "v4.45.0",
+    "rev": "v4.46.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-C3wr/3huORBacbe0+Z0qqH+iSaJCxQwLq9wqLSirDiM="
+    "vendorHash": "sha256-xo9Z50jK8dWxQ8DeGLjB8ppnGuUmGlQLhzRHpKs8hYg="
   },
   "azuread": {
     "hash": "sha256-itaFeOEnoTIJfACvJZCIe9RWNVgewdVFZzXUK7yGglQ=",
@@ -167,20 +167,20 @@
     "vendorHash": null
   },
   "bitbucket": {
-    "hash": "sha256-eU8vA2fxtdsObgh2dTExGLzzBnfSc2DSGdFHrLXR3SA=",
+    "hash": "sha256-tT5JSiUPeezQFn4tnKrsUxfm/llaBk8R2eOGqGIbEH4=",
     "homepage": "https://registry.terraform.io/providers/DrFaust92/bitbucket",
     "owner": "DrFaust92",
     "repo": "terraform-provider-bitbucket",
-    "rev": "v2.22.0",
+    "rev": "v2.23.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-Qkla3OEcyiMn6eqBj+4LB8JwpIwceLAASI1qvOcUBD0="
+    "vendorHash": "sha256-CFRZSdQnbhV7n10r2R1+cGxn7nKD+GvXWf85rYFRPVI="
   },
   "brightbox": {
-    "hash": "sha256-l4gN7gxLMTuUMjf50Hc2Els5pJ4BId1QlRAhykseK7c=",
+    "hash": "sha256-F/AQq45ADM0+PbFpMPtpMvbYw8F41GDBzk7LoY/L/Qg=",
     "homepage": "https://registry.terraform.io/providers/brightbox/brightbox",
     "owner": "brightbox",
     "repo": "terraform-provider-brightbox",
-    "rev": "v3.0.5",
+    "rev": "v3.0.6",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-ZT+SOHn/8aoZLXUau9toc3NtQNaXfttM0agIw8T28tk="
   },
@@ -213,13 +213,13 @@
     "vendorHash": null
   },
   "cloudamqp": {
-    "hash": "sha256-EtFGqYNfyDbS4f1tjRTKcrQNFqEZmmILeuEOpwkx6/4=",
+    "hash": "sha256-ocwPi39Wn+nHtkRshqFKkCknFCKgmrxSMy1SJFd7ni8=",
     "homepage": "https://registry.terraform.io/providers/cloudamqp/cloudamqp",
     "owner": "cloudamqp",
     "repo": "terraform-provider-cloudamqp",
-    "rev": "v1.20.0",
+    "rev": "v1.20.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-fDYkeUOW9wuypAJR1YFEQp8KhtTfMr8NZeT7TMYXEmU="
+    "vendorHash": "sha256-pnQHWSXI3rqYv0EeG9rGINtInSgQ/NSMMYiPrXRMUuM="
   },
   "cloudflare": {
     "hash": "sha256-1Ak5NPaOSqF0mJU2/CnssQjz7ekyVE/kqDOS5rYSN10=",
@@ -349,11 +349,11 @@
     "vendorHash": "sha256-EaWVf8GmNsabpfeOEzRjKPubCyEReGjdzRy7Ohb4mno="
   },
   "elasticsearch": {
-    "hash": "sha256-+cktPArBOysc4V+uR3KWsVlxtxSIbuVMCmPSU21xF/U=",
+    "hash": "sha256-a6kHN3w0sQCP+0+ZtFwcg9erfVBYkhNo+yOrnwweGWo=",
     "homepage": "https://registry.terraform.io/providers/phillbaker/elasticsearch",
     "owner": "phillbaker",
     "repo": "terraform-provider-elasticsearch",
-    "rev": "v2.0.6",
+    "rev": "v2.0.7",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-oVTanZpCWs05HwyIKW2ajiBPz1HXOFzBAt5Us+EtTRw="
   },
@@ -386,11 +386,11 @@
     "vendorHash": "sha256-0t+2ixMSsgDK9zzst3s0YWdnS6p7jO0stHnaKio5lvY="
   },
   "fastly": {
-    "hash": "sha256-X2T/t3uDY1jDPhx7IZOwVLx1o4pse5/0T+nrJtRB1Lk=",
+    "hash": "sha256-AlEO9isKHdOxhI7M7Egxv7lmrQ066s2zcIz9fm5dobM=",
     "homepage": "https://registry.terraform.io/providers/fastly/fastly",
     "owner": "fastly",
     "repo": "terraform-provider-fastly",
-    "rev": "v3.0.2",
+    "rev": "v3.0.3",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -442,24 +442,24 @@
     "vendorHash": "sha256-QAFx/Ew86T4LWJ6ZtJTUWwR5rGunWj0E5Vzt++BN9ks="
   },
   "google": {
-    "hash": "sha256-e2jVnL13j4iSb288CB/H6G3vR58bjwi+2ZHzve1tuUo=",
+    "hash": "sha256-VqQK6NifhilmnJL5L4EHmmeFWZPBmQhoUl3mz8igSck=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google",
     "owner": "hashicorp",
     "proxyVendor": true,
     "repo": "terraform-provider-google",
-    "rev": "v4.44.1",
+    "rev": "v4.45.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-X5wjho+hotqi9aZ5ABv3RY0xJj1HFH7IN/HLPKIxi2c="
+    "vendorHash": "sha256-nwA+OD0gtnV5di43wgH1OZp/RngLvnVRAuKQxsxnlLw="
   },
   "google-beta": {
-    "hash": "sha256-ejMWZTSrkGMAKr02TIg0yngzpqEVL8y56JSoQrCJ7lA=",
+    "hash": "sha256-/fdgwdIIFHLEMeqsWashkQJlIoFU86ZmsbA4pX18FhE=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
     "owner": "hashicorp",
     "proxyVendor": true,
     "repo": "terraform-provider-google-beta",
-    "rev": "v4.44.1",
+    "rev": "v4.45.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-X5wjho+hotqi9aZ5ABv3RY0xJj1HFH7IN/HLPKIxi2c="
+    "vendorHash": "sha256-nwA+OD0gtnV5di43wgH1OZp/RngLvnVRAuKQxsxnlLw="
   },
   "googleworkspace": {
     "hash": "sha256-dedYnsKHizxJZibuvJOMbJoux0W6zgKaK5fxIofKqCY=",
@@ -507,11 +507,11 @@
     "vendorHash": null
   },
   "heroku": {
-    "hash": "sha256-NabwjOTbBRlDNFBpCshxZMO9E958tfAIPPuyArvacFI=",
+    "hash": "sha256-GmrzvE1Wc1dQSlEL4mLYHIkAVxKwElx2fCWkrnZra18=",
     "homepage": "https://registry.terraform.io/providers/heroku/heroku",
     "owner": "heroku",
     "repo": "terraform-provider-heroku",
-    "rev": "v5.1.6",
+    "rev": "v5.1.8",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -589,22 +589,22 @@
     "vendorHash": null
   },
   "infoblox": {
-    "hash": "sha256-VquTyQxbVFPImZCwthwf8hJPlUxAxhmed/r1V+qm/ak=",
+    "hash": "sha256-bLZK2lZqnpiE5vsJAAiGw4BrBzVWGyg5VZq/Ngr8VlA=",
     "homepage": "https://registry.terraform.io/providers/infobloxopen/infoblox",
     "owner": "infobloxopen",
     "repo": "terraform-provider-infoblox",
-    "rev": "v2.1.0",
+    "rev": "v2.2.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
   "kafka": {
-    "hash": "sha256-bKbY2cOIORy3D9yCBqVuKUZb650sx+87d4wtUB3dPdg=",
+    "hash": "sha256-p8KT6K9fcd0OFy+NoZyZzQxG13fIiyMJg2yNPKIWH60=",
     "homepage": "https://registry.terraform.io/providers/Mongey/kafka",
     "owner": "Mongey",
     "repo": "terraform-provider-kafka",
-    "rev": "v0.5.1",
+    "rev": "v0.5.2",
     "spdx": "MIT",
-    "vendorHash": "sha256-03QV6C2DEN5xwMwABwSvv5Ts6pTHQDBP2zUUqIcOtVQ="
+    "vendorHash": "sha256-RzC8j+Toub7kiOKW6IppjwyJ0vGEJ0YHb8YXrWFkZW4="
   },
   "kafka-connect": {
     "hash": "sha256-PiSVfzNPEXAgONb/eaVAN4yPudn5glcHL0BLqE5PWsw=",
@@ -643,11 +643,11 @@
     "vendorHash": "sha256-lXQHo66b9X0jZhoF+5Ix5qewQGyI82VPJ7gGzc2CHao="
   },
   "kubernetes": {
-    "hash": "sha256-hWFC8VBbM3BRGrX1Y45Znd/W3klYy/7aS7JbbKN7EUg=",
+    "hash": "sha256-aKGcKmnlYxNS7SrFW2SouRQUXYy339qHrDtQMXGD4DE=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/kubernetes",
     "owner": "hashicorp",
     "repo": "terraform-provider-kubernetes",
-    "rev": "v2.16.0",
+    "rev": "v2.16.1",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -743,13 +743,13 @@
     "vendorHash": "sha256-VxISNcWEnBAa+8WsmqxcT+DPF74X8rLlvdSNJtx0++I="
   },
   "mongodbatlas": {
-    "hash": "sha256-rHT/x3Wpd7b4u7v1/g6DY85TwRkf5A7KaOiqoWeN05Y=",
+    "hash": "sha256-QMwsVD1RZwL9DPF0gnio4quqUa1b4G0SK73yd6BYnG4=",
     "homepage": "https://registry.terraform.io/providers/mongodb/mongodbatlas",
     "owner": "mongodb",
     "repo": "terraform-provider-mongodbatlas",
-    "rev": "v1.6.0",
+    "rev": "v1.6.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-dFlDUJGVTWQwXXGaWeG07kKyXcWWzuyqYlPm11yaCqI="
+    "vendorHash": "sha256-WO8B5tiDYQTbKbqWfjjgyMLCmclhE0r2XNRTQ2uyu7s="
   },
   "namecheap": {
     "hash": "sha256-cms8YUL+SjTeYyIOQibksi8ZHEBYq2JlgTEpOO1uMZE=",
@@ -770,13 +770,13 @@
     "vendorHash": null
   },
   "newrelic": {
-    "hash": "sha256-wTQmqe7oicD7MOZdKgRHlz4Vs8dQqEUjnrKU/1pldRI=",
+    "hash": "sha256-nN4KXXSYp4HWxImfgd/C/ykQi02EIpq4mb20EpKboaE=",
     "homepage": "https://registry.terraform.io/providers/newrelic/newrelic",
     "owner": "newrelic",
     "repo": "terraform-provider-newrelic",
-    "rev": "v3.8.0",
+    "rev": "v3.9.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-CIiRPwzlx5WWyRmg2tXEB+yp05ZbN5mLBGuFxm0h//4="
+    "vendorHash": "sha256-WuGf6gMOOCTwUTzbinyT7yNM3S8ddHY5aS5VTAEf5Js="
   },
   "nomad": {
     "hash": "sha256-oHY+jM4JQgLlE1wd+/H9H8H2g0e9ZuxI6OMlz3Izfjg=",
@@ -816,11 +816,11 @@
     "vendorHash": "sha256-LRIfxQGwG988HE5fftGl6JmBG7tTknvmgpm4Fu1NbWI="
   },
   "oci": {
-    "hash": "sha256-t8GrhKnKredpbRmx/MAA4tx0kV0yZoFNnacKsp0Htro=",
+    "hash": "sha256-DGkjk9siXkknuNxWcUnDfR56xPYFS111J8QcAgj0cPU=",
     "homepage": "https://registry.terraform.io/providers/oracle/oci",
     "owner": "oracle",
     "repo": "terraform-provider-oci",
-    "rev": "v4.100.0",
+    "rev": "v4.101.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -843,13 +843,13 @@
     "vendorHash": null
   },
   "opennebula": {
-    "hash": "sha256-jm7k0k28TSfnUA6P2RjSfF36o/nznvDWcDmJz/MAMXU=",
+    "hash": "sha256-+EbEVwgo2HWmVhff7u5ohSJW8wuxK1kvWfvRWRwIP4o=",
     "homepage": "https://registry.terraform.io/providers/OpenNebula/opennebula",
     "owner": "OpenNebula",
     "repo": "terraform-provider-opennebula",
-    "rev": "v1.0.2",
+    "rev": "v1.1.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-tkb+P+eTid5dgCw6bErr7i0F+E8UCt/HyFA2e3y0XT0="
+    "vendorHash": "sha256-zKtBDnvlQHe+q0OZUMUGu1gNsx2wIrIoArtJrt0VaBk="
   },
   "openstack": {
     "hash": "sha256-k5UyK9jmjZzHw8AwmDRtyCyJgILAcCK+nN+hklJ9VFw=",
@@ -861,13 +861,13 @@
     "vendorHash": "sha256-hHwFm+gSMjN4YQEFd/dd50G0uZsxzqi21tHDf4mPBLY="
   },
   "opentelekomcloud": {
-    "hash": "sha256-H1X+wWxdP7MwUtUaQiw0usOO6jwAAVLYMoG5Ut2OcqM=",
+    "hash": "sha256-vmsnpu4FThMY0OfCAj0DnI4fpOwVGvJXpQ3u+kAieFc=",
     "homepage": "https://registry.terraform.io/providers/opentelekomcloud/opentelekomcloud",
     "owner": "opentelekomcloud",
     "repo": "terraform-provider-opentelekomcloud",
-    "rev": "v1.31.9",
+    "rev": "v1.32.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-n7Ez596JnRwsKYPuR8lCLo6ez/TFch2kMgoScg7pPUI="
+    "vendorHash": "sha256-TCeAqQLdeCS3NPDAppinRv4qBPBWtG/qAUKc+4acqEE="
   },
   "opsgenie": {
     "hash": "sha256-6lbJyBppfRqqmYpPgyzUTvnvHPSWjE3SJULqliZ2iUI=",
@@ -879,11 +879,11 @@
     "vendorHash": null
   },
   "ovh": {
-    "hash": "sha256-6lBhEmeAvTv8xRMi5ZabcJg/59xJ9o4/MaAJP+H7pqk=",
+    "hash": "sha256-G1YRp6ScdlPnV8cCC05TKToJk+iLx2l28x7Lv4GS2/k=",
     "homepage": "https://registry.terraform.io/providers/ovh/ovh",
     "owner": "ovh",
     "repo": "terraform-provider-ovh",
-    "rev": "v0.23.0",
+    "rev": "v0.24.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -969,13 +969,13 @@
     "vendorHash": null
   },
   "scaleway": {
-    "hash": "sha256-0NQRAv05GuVRAkZd580TINEur/G+c0jUmMtyMv05+PY=",
+    "hash": "sha256-2991jDjOlyJuVcgzTmfKfMt4NfLc1QP7TY9mw+5Z5aM=",
     "homepage": "https://registry.terraform.io/providers/scaleway/scaleway",
     "owner": "scaleway",
     "repo": "terraform-provider-scaleway",
-    "rev": "v2.7.1",
+    "rev": "v2.8.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-XlEvaXd+mAvbFeQmTOE+bFsYok/Ke1mVwIUY3VY8zDI="
+    "vendorHash": "sha256-YlZSM3duS2QEZo5j+WvCw5KFPbY+NadYonylpB8Zw+o="
   },
   "secret": {
     "hash": "sha256-MmAnA/4SAPqLY/gYcJSTnEttQTsDd2kEdkQjQj6Bb+A=",
@@ -1032,13 +1032,13 @@
     "vendorHash": null
   },
   "snowflake": {
-    "hash": "sha256-V2N9Lq425fdjlJ+lCVQzMAYfEiS2/Oqevz1dIve//FA=",
+    "hash": "sha256-folCDzwXDfWGVxqX+wMBtRqUXdecYL0Rj7XYzb5QBvA=",
     "homepage": "https://registry.terraform.io/providers/Snowflake-Labs/snowflake",
     "owner": "Snowflake-Labs",
     "repo": "terraform-provider-snowflake",
-    "rev": "v0.52.0",
+    "rev": "v0.53.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-n6ov9eTlNF/jNDTDOZuuqyFfuv8lDZHKP/5jhFauwY8="
+    "vendorHash": "sha256-5sqPDUNg1uH3LAMnvQ4YAm5LDdcywQHp1DVKYLFZG7Q="
   },
   "sops": {
     "hash": "sha256-6FuThi6iuuUGcMhswAk3Z6Lxth/2nuI57A02Xu2s+/U=",
@@ -1095,22 +1095,22 @@
     "vendorHash": "sha256-2wPmLpjhG6QgG+BUCO0oIzHjBOWIOYuptgdtSIm9TZw="
   },
   "tencentcloud": {
-    "hash": "sha256-beoS4io1KffsMCvYHwpWzo6NNwdi7JyPBBi/BwGFU9Y=",
+    "hash": "sha256-jel9zn2i/xt7Up4o8Tf5S5Z63zRbQszt9IY5xjcQhLo=",
     "homepage": "https://registry.terraform.io/providers/tencentcloudstack/tencentcloud",
     "owner": "tencentcloudstack",
     "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.79.0",
+    "rev": "v1.79.1",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
   "tfe": {
-    "hash": "sha256-ikuLRGm9Z+tt0Zsx7DYKNBrS08rW4DOvVWYpl3wvaeU=",
+    "hash": "sha256-y9v+13/u91tpRwyI/oLHsd7oUUj0OGFJkqzbk2z8MxU=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/tfe",
     "owner": "hashicorp",
     "repo": "terraform-provider-tfe",
-    "rev": "v0.39.0",
+    "rev": "v0.40.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-Ws9IzlZQDDAdQ4JJ326jHXUe9oQphBXb/ZNO7Kl/A1w="
+    "vendorHash": "sha256-Z2pIUAe2Beq5Hi7HBxNenFEtAFhJFMPi3k2qiifN+Jg="
   },
   "thunder": {
     "hash": "sha256-fXvwBOIW3/76V3O9t25wff0oGViqSaSB2VgMdItXyn4=",
@@ -1232,11 +1232,11 @@
     "vendorHash": "sha256-160GDEQfymeCJpjYOoWP5sGQ0PJHw9kKPaefmbF5Ig4="
   },
   "vultr": {
-    "hash": "sha256-6NiVW6kqUCeit6Dc9GbP4mV03UJkqo+UwHsDE4xMwzQ=",
+    "hash": "sha256-DfiJgN1R7qW3c13hBabsMizY3mYamIq8AGms1q9kdVU=",
     "homepage": "https://registry.terraform.io/providers/vultr/vultr",
     "owner": "vultr",
     "repo": "terraform-provider-vultr",
-    "rev": "v2.11.4",
+    "rev": "v2.12.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
diff --git a/pkgs/applications/networking/cluster/terragrunt/default.nix b/pkgs/applications/networking/cluster/terragrunt/default.nix
index b15f60afe01..437f5813a3a 100644
--- a/pkgs/applications/networking/cluster/terragrunt/default.nix
+++ b/pkgs/applications/networking/cluster/terragrunt/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "terragrunt";
-  version = "0.41.0";
+  version = "0.42.3";
 
   src = fetchFromGitHub {
     owner = "gruntwork-io";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-1if7Z+4Lr5eevf1NUJn//pcVU3Ts/FznDd/604aJO/c=";
+    sha256 = "sha256-CK2+leFJuNQqX1t34LLTJ6eVEUFdZSb/0E3XTf3S9gQ=";
   };
 
   vendorSha256 = "sha256-Qc0FnNxyErtieVvEj/eKPW5PpvYFwiYtv+ReJTVFAPA=";
diff --git a/pkgs/applications/networking/cluster/velero/default.nix b/pkgs/applications/networking/cluster/velero/default.nix
index 8bb4dc5ad80..bc4f1959eaa 100644
--- a/pkgs/applications/networking/cluster/velero/default.nix
+++ b/pkgs/applications/networking/cluster/velero/default.nix
@@ -2,14 +2,14 @@
 
 buildGoModule rec {
   pname = "velero";
-  version = "1.9.3";
+  version = "1.10.0";
 
 
   src = fetchFromGitHub {
     owner = "vmware-tanzu";
     repo = "velero";
     rev = "v${version}";
-    sha256 = "sha256-UN1nxzcoaUrqmFAJ6LQ+Ro6Ywn/mG7J+MEJIUbpBiK4=";
+    sha256 = "sha256-PBCTVws5N42q68rKcMLW7GgZvdsQgmdlsKMpJ5bCF00=";
   };
 
   ldflags = [
@@ -20,7 +20,7 @@ buildGoModule rec {
     "-X github.com/vmware-tanzu/velero/pkg/buildinfo.GitSHA=none"
   ];
 
-  vendorSha256 = "sha256-QSR8nSKSKaFyFC6yik3f44mdNvSBgE4bFIGttuJ5oRM=";
+  vendorSha256 = "sha256-5Po8TRCE6VP+RcaIJImYjElTMHHS/2JwbrHreeWLxio=";
 
   excludedPackages = [ "issue-template-gen" "release-tools" "v1" "velero-restic-restore-helper" ];
 
diff --git a/pkgs/applications/networking/flexget/default.nix b/pkgs/applications/networking/flexget/default.nix
index 90193971cd7..30d6666c05d 100644
--- a/pkgs/applications/networking/flexget/default.nix
+++ b/pkgs/applications/networking/flexget/default.nix
@@ -5,7 +5,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "flexget";
-  version = "3.5.6";
+  version = "3.5.9";
   format = "pyproject";
 
   # Fetch from GitHub in order to use `requirements.in`
@@ -13,7 +13,7 @@ python3Packages.buildPythonApplication rec {
     owner = "flexget";
     repo = "flexget";
     rev = "refs/tags/v${version}";
-    hash = "sha256-MO/BwlgSAt9rZC+kELdjJm6F15MJJPpvn412CndvqXk=";
+    hash = "sha256-oxWN+gFjy/Kf447SBiD7oUTA9+JhmtQ2oaAMQESsGUs=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/networking/ftp/filezilla/default.nix b/pkgs/applications/networking/ftp/filezilla/default.nix
index 5a4585135f0..49f2aaa37e9 100644
--- a/pkgs/applications/networking/ftp/filezilla/default.nix
+++ b/pkgs/applications/networking/ftp/filezilla/default.nix
@@ -12,7 +12,8 @@
 , sqlite
 , tinyxml
 , wrapGAppsHook
-, wxGTK30-gtk3
+, wxGTK30
+, gtk3
 , xdg-utils
 }:
 
@@ -42,8 +43,8 @@ stdenv.mkDerivation rec {
     pugixml
     sqlite
     tinyxml
-    wxGTK30-gtk3
-    wxGTK30-gtk3.gtk
+    wxGTK30
+    gtk3
     xdg-utils
   ];
 
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
index a71cad3224a..cb7801d3896 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@@ -9,7 +9,7 @@
 
 stdenv.mkDerivation rec {
   pname = "signal-desktop";
-  version = "6.0.0"; # Please backport all updates to the stable channel.
+  version = "6.0.1"; # Please backport all updates to the stable channel.
   # All releases have a limited lifetime and "expire" 90 days after the release.
   # When releases "expire" the application becomes unusable until an update is
   # applied. The expiration date for the current release can be extracted with:
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "sha256-aJLsRxxpLWKl0Y/91uR56nIUUOALd572LtXpqXGTXSg=";
+    sha256 = "sha256-7Cojhz3wBPd/13uVg2MgJXvR9QMPZcwBibk/sCrRMAE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/instant-messengers/slack/default.nix b/pkgs/applications/networking/instant-messengers/slack/default.nix
index 325d5330d62..7e3dd42b578 100644
--- a/pkgs/applications/networking/instant-messengers/slack/default.nix
+++ b/pkgs/applications/networking/instant-messengers/slack/default.nix
@@ -44,14 +44,14 @@ let
 
   pname = "slack";
 
-  x86_64-darwin-version = "4.28.182";
-  x86_64-darwin-sha256 = "0x0zc45k0jh0hivgjymcxnnwc2lwyfq68rw39lbxp4i1ir2sbnxg";
+  x86_64-darwin-version = "4.29.149";
+  x86_64-darwin-sha256 = "sha256-E0YnOPnaWFe17gCpFywxu5uHs1pEktA1tUu4QqvKhYw=";
 
-  x86_64-linux-version = "4.28.184";
-  x86_64-linux-sha256 = "sha256-qAc9rHJbM7lmqNxOcOSnqnuib5zJ0Ry3hAGri8DKIlo=";
+  x86_64-linux-version = "4.29.149";
+  x86_64-linux-sha256 = "sha256-ulXIGLp2ql47ZS6IeaMuqye39deDtukOB1dxy5BNCwI=";
 
-  aarch64-darwin-version = "4.28.182";
-  aarch64-darwin-sha256 = "0bc8lhmpm0310gh1w9xkb8i1cpldchm4b4mzsr9h0mhvljxmvlyf";
+  aarch64-darwin-version = "4.29.149";
+  aarch64-darwin-sha256 = "sha256-Nn+dFD3H/By+aBPLDxnPneNXuFl+tHdLhxJXeYBMORg=";
 
   version = {
     x86_64-darwin = x86_64-darwin-version;
diff --git a/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix b/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
new file mode 100644
index 00000000000..3a6c97073ab
--- /dev/null
+++ b/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
@@ -0,0 +1,91 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, makeWrapper
+, makeDesktopItem
+, copyDesktopItems
+, fixup_yarn_lock
+, yarn
+, nodejs
+, fetchYarnDeps
+, electron
+}:
+
+stdenv.mkDerivation rec {
+  pname = "teams-for-linux";
+  version = "1.0.45";
+
+  src = fetchFromGitHub {
+    owner = "IsmaelMartinez";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-Q6DFegFrLUW/YiRyYJI4ITVVyMC5IkazlzhdR8203cY=";
+  };
+
+  offlineCache = fetchYarnDeps {
+    yarnLock = src + "/yarn.lock";
+    sha256 = "sha256-jaAieO5q+tNfWN7Rp6ueasl45cfp9W1QxPdqIeCnVkE=";
+  };
+
+  nativeBuildInputs = [ yarn fixup_yarn_lock nodejs copyDesktopItems makeWrapper ];
+
+  configurePhase = ''
+    runHook preConfigure
+
+    export HOME=$(mktemp -d)
+    yarn config --offline set yarn-offline-mirror $offlineCache
+    fixup_yarn_lock yarn.lock
+    yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
+    patchShebangs node_modules/
+
+    runHook postConfigure
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    yarn --offline electron-builder \
+      --dir --linux ${if stdenv.hostPlatform.isAarch64 then "--arm64" else "--x64"} \
+      -c.electronDist=${electron}/lib/electron \
+      -c.electronVersion=${electron.version}
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/{applications,teams-for-linux}
+    cp dist/linux-${lib.optionalString stdenv.hostPlatform.isAarch64 "arm64-"}unpacked/resources/app.asar $out/share/teams-for-linux/
+
+    pushd build/icons
+    for image in *png; do
+      mkdir -p $out/share/icons/hicolor/''${image%.png}/apps
+      cp -r $image $out/share/icons/hicolor/''${image%.png}/apps/teams-for-linux.png
+    done
+    popd
+
+    makeWrapper '${electron}/bin/electron' "$out/bin/teams-for-linux" \
+      --add-flags "$out/share/teams-for-linux/app.asar" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
+
+    runHook postInstall
+  '';
+
+  desktopItems = [(makeDesktopItem {
+    name = pname;
+    exec = pname;
+    icon = pname;
+    desktopName = "Microsoft Teams for Linux";
+    comment = meta.description;
+    categories = [ "Network" "InstantMessaging" "Chat" ];
+  })];
+
+  meta = with lib; {
+    description = "Unofficial Microsoft Teams client for Linux";
+    homepage = "https://github.com/IsmaelMartinez/teams-for-linux";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ muscaln ];
+    platforms = [ "x86_64-linux" "aarch64-linux" ];
+  };
+}
diff --git a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
index ca89b0d5fcf..1df0aee8421 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
@@ -75,7 +75,7 @@ let
 in
 env.mkDerivation rec {
   pname = "telegram-desktop";
-  version = "4.3.4";
+  version = "4.4.1";
   # Note: Update via pkgs/applications/networking/instant-messengers/telegram/tdesktop/update.py
 
   # Telegram-Desktop with submodules
@@ -84,7 +84,7 @@ env.mkDerivation rec {
     repo = "tdesktop";
     rev = "v${version}";
     fetchSubmodules = true;
-    sha256 = "0x18m48k6abpbfgavjad5sg3mf3j0kfmyayyvkqxr31viw8kq6m5";
+    sha256 = "0c30kxgp48ha1xv3l59ry21n2c536ax8a15cfk2n1r5n1ns2pfq0";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/networking/irc/senpai/default.nix b/pkgs/applications/networking/irc/senpai/default.nix
index 0721d720cc7..28d51650b26 100644
--- a/pkgs/applications/networking/irc/senpai/default.nix
+++ b/pkgs/applications/networking/irc/senpai/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "senpai";
-  version = "unstable-2022-11-15";
+  version = "unstable-2022-12-02";
 
   src = fetchFromSourcehut {
     owner = "~taiite";
     repo = "senpai";
-    rev = "cb0ba0669522ecf8ab0b0c3ccd0f14827eb65832";
-    sha256 = "sha256-Ny7TAKdh7RFGlrMRVIyCFFLqOanNWK+qGBbh+dVngMs=";
+    rev = "870e2e51feb2186bcb4c719e17967eb1311678a3";
+    sha256 = "sha256-YWEgA1KAa1cj2YaqOXVVBw70gSxK7WEMNDyGJOFq4DQ=";
   };
 
-  vendorSha256 = "sha256-dCADJ+k2vWLpgN251/gEyAg6WhPGK2DEWRaAHSHp1aM=";
+  vendorSha256 = "sha256-+78Ln8179MfDKSfT/jnN9Y5CIbpdq28XMDHsIu+4f4c=";
 
   subPackages = [
     "cmd/senpai"
diff --git a/pkgs/applications/networking/mailreaders/evolution/evolution-ews/default.nix b/pkgs/applications/networking/mailreaders/evolution/evolution-ews/default.nix
index 51e1c2e52c8..ba5f5d10226 100644
--- a/pkgs/applications/networking/mailreaders/evolution/evolution-ews/default.nix
+++ b/pkgs/applications/networking/mailreaders/evolution/evolution-ews/default.nix
@@ -21,11 +21,11 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution-ews";
-  version = "3.46.1";
+  version = "3.46.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "p5Jp7wnoqAuo8My8ZDMl0rsFc0158G8x8lAehWfLjb0=";
+    sha256 = "6spQz4oq6sFT2bCmaixVJDbTw1wM3LQFmg3E1trZ30E=";
   };
 
   patches = [
diff --git a/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix b/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix
index 1e61c5ffc88..0c7f5a41753 100644
--- a/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix
+++ b/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix
@@ -44,11 +44,11 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution";
-  version = "3.46.1";
+  version = "3.46.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "GshFg+0sr4l7B06Z+TVCrRRG//Cs+rhtXmeeAzrgLIY=";
+    sha256 = "cks7uFOapRxpJsPxfTO7zjWpnBbqY7gJCzRsWr9ol30=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/remote/freerdp/default.nix b/pkgs/applications/networking/remote/freerdp/default.nix
index d072a03c0b4..58c22375af4 100644
--- a/pkgs/applications/networking/remote/freerdp/default.nix
+++ b/pkgs/applications/networking/remote/freerdp/default.nix
@@ -156,7 +156,7 @@ stdenv.mkDerivation rec {
     WITH_X11 = true;
   };
 
-  NIX_CFLAGS_COMPILE = lib.optional stdenv.isDarwin [
+  NIX_CFLAGS_COMPILE = lib.optionals stdenv.isDarwin [
     "-DTARGET_OS_IPHONE=0"
     "-DTARGET_OS_WATCH=0"
     "-include AudioToolbox/AudioToolbox.h"
diff --git a/pkgs/applications/networking/sniffers/kismet/default.nix b/pkgs/applications/networking/sniffers/kismet/default.nix
index 1e4bb853742..b0feaf38ecc 100644
--- a/pkgs/applications/networking/sniffers/kismet/default.nix
+++ b/pkgs/applications/networking/sniffers/kismet/default.nix
@@ -71,25 +71,27 @@ stdenv.mkDerivation rec {
   ] ++ lib.optionals withNetworkManager [
     networkmanager
     glib
-  ] ++ lib.optional withSensors [
+  ] ++ lib.optionals withSensors [
     lm_sensors
   ];
 
   propagatedBuildInputs = [
-  ] ++ lib.optional withPython (python3.withPackages (ps: [
-    ps.numpy
-    ps.protobuf
-    ps.pyserial
-    ps.setuptools
-    ps.websockets
-  ]));
+  ] ++ lib.optionals withPython [
+    (python3.withPackages (ps: [
+      ps.numpy
+      ps.protobuf
+      ps.pyserial
+      ps.setuptools
+      ps.websockets
+    ]))
+  ];
 
   configureFlags = [
-  ] ++ lib.optional (!withNetworkManager) [
+  ] ++ lib.optionals (!withNetworkManager) [
     "--disable-libnm"
-  ] ++ lib.optional (!withPython) [
+  ] ++ lib.optionals (!withPython) [
     "--disable-python-tools"
-  ] ++ lib.optional (!withSensors) [
+  ] ++ lib.optionals (!withSensors) [
     "--disable-lmsensors"
   ];
 
diff --git a/pkgs/applications/networking/soulseek/nicotine-plus/default.nix b/pkgs/applications/networking/soulseek/nicotine-plus/default.nix
index 2f0ee430b4f..02a7fe0622f 100644
--- a/pkgs/applications/networking/soulseek/nicotine-plus/default.nix
+++ b/pkgs/applications/networking/soulseek/nicotine-plus/default.nix
@@ -11,13 +11,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "nicotine-plus";
-  version = "3.2.6";
+  version = "3.2.7";
 
   src = fetchFromGitHub {
     owner = "nicotine-plus";
     repo = "nicotine-plus";
     rev = "refs/tags/${version}";
-    sha256 = "sha256-ELpM5hnyHsqTqB0R1JPcbxkw9XR19CnasIYXJCbKBho=";
+    sha256 = "sha256-MPhMKbDBKZAF5fktzA6bZBlVkyDrBnhEFhRWkRbXP/A=";
   };
 
   nativeBuildInputs = [ gettext wrapGAppsHook gobject-introspection ];
diff --git a/pkgs/applications/networking/syncthing/default.nix b/pkgs/applications/networking/syncthing/default.nix
index 4bfe3efec12..297520dcb92 100644
--- a/pkgs/applications/networking/syncthing/default.nix
+++ b/pkgs/applications/networking/syncthing/default.nix
@@ -4,16 +4,16 @@ let
   common = { stname, target, postInstall ? "" }:
     buildGoModule rec {
       pname = stname;
-      version = "1.22.1";
+      version = "1.22.2";
 
       src = fetchFromGitHub {
         owner = "syncthing";
         repo = "syncthing";
         rev = "v${version}";
-        hash = "sha256-XndTMPO1lN6bsjeHbvrZ+i4VwaKoUOcWOfbVQ2E7/eo=";
+        hash = "sha256-t1JIkUjSEshSm3Zi5Ck8IOmTv2tC0dUYyJvlKua/BcI=";
       };
 
-      vendorSha256 = "sha256-ZxA05K5zKmQIm2R525DNXpGXqwM33j3PCuPN5d2qcj8=";
+      vendorSha256 = "sha256-UdzWD8I8ulPBXdF5wZQ7hQoVO9Bnj18Gw5t4wqolSPA=";
 
       doCheck = false;
 
diff --git a/pkgs/applications/networking/twingate/default.nix b/pkgs/applications/networking/twingate/default.nix
new file mode 100644
index 00000000000..33e0820bec9
--- /dev/null
+++ b/pkgs/applications/networking/twingate/default.nix
@@ -0,0 +1,51 @@
+{ autoPatchelfHook
+, curl
+, dpkg
+, dbus
+, fetchurl
+, lib
+, libnl
+, udev
+, cryptsetup
+, stdenv
+}:
+
+stdenv.mkDerivation rec {
+  pname = "twingate";
+  version = "1.0.60";
+
+  src = fetchurl {
+    url = "https://binaries.twingate.com/client/linux/DEB/${version}/twingate-amd64.deb";
+    sha256 = "b308c422af8a33ecd58e21a10a72c353351a189df67006e38d1ec029a93d5678";
+  };
+
+  buildInputs = [ dbus curl libnl udev cryptsetup ];
+  nativeBuildInputs = [ dpkg autoPatchelfHook ];
+
+  unpackCmd = "mkdir root ; dpkg-deb -x $curSrc root";
+
+  postPatch = ''
+    while read file; do
+      substituteInPlace "$file" \
+        --replace "/usr/bin" "$out/bin" \
+        --replace "/usr/sbin" "$out/bin"
+    done < <(find etc usr/lib usr/share -type f)
+  '';
+
+  installPhase = ''
+    mkdir $out
+    mv etc $out/
+    mv usr/bin $out/bin
+    mv usr/sbin/* $out/bin
+    mv usr/lib $out/lib
+    mv usr/share $out/share
+  '';
+
+  meta = with lib; {
+    description = "Twingate Client";
+    homepage = "https://twingate.com";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ tonyshkurenko ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/applications/networking/yaup/default.nix b/pkgs/applications/networking/yaup/default.nix
new file mode 100644
index 00000000000..5894e758e9d
--- /dev/null
+++ b/pkgs/applications/networking/yaup/default.nix
@@ -0,0 +1,47 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, intltool
+, pkg-config
+, wrapGAppsHook
+, gtk3
+, miniupnpc
+}:
+
+stdenv.mkDerivation rec {
+  pname = "yaup";
+  version = "unstable-2019-10-16";
+
+  src = fetchFromGitHub {
+    owner = "Holarse-Linuxgaming";
+    repo = "yaup";
+    rev = "7ee3fdbd8c1ecf0a0e6469c47560e26082808250";
+    hash = "sha256-RWnNjpgXRYncz9ID8zirENffy1UsfHD1H6Mmd8DKN4k=";
+  };
+
+  nativeBuildInputs = [
+    intltool
+    pkg-config
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    gtk3
+    miniupnpc
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/Holarse-Linuxgaming/yaup";
+    description = "Yet Another UPnP Portmapper";
+    longDescription = ''
+      Portmapping made easy.
+      Portforward your incoming traffic to a specified local ip.
+      Mostly used for IPv4.
+    '';
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ fgaz ];
+    platforms = platforms.all;
+    # ld: unknown option: --export-dynamic
+    broken = stdenv.isDarwin;
+  };
+}
diff --git a/pkgs/applications/office/libreoffice/default.nix b/pkgs/applications/office/libreoffice/default.nix
index e88ae758d2a..cc40237d155 100644
--- a/pkgs/applications/office/libreoffice/default.nix
+++ b/pkgs/applications/office/libreoffice/default.nix
@@ -119,7 +119,7 @@ let
     flatten flip
     concatMapStrings concatStringsSep
     getDev getLib
-    optional optionals optionalString;
+    optionals optionalString;
 
   jre' = jre17_minimal.override {
     modules = [ "java.base" "java.desktop" "java.logging" "java.sql" ];
@@ -195,7 +195,7 @@ in
     tar -xf ${srcs.translations}
   '';
 
-  patches = optional (variant == "still") [ ./skip-failed-test-with-icu70.patch ./gpgme-1.18.patch ]
+  patches = optionals (variant == "still") [ ./skip-failed-test-with-icu70.patch ./gpgme-1.18.patch ]
   ;
 
   ### QT/KDE
diff --git a/pkgs/applications/office/portfolio/default.nix b/pkgs/applications/office/portfolio/default.nix
index 030d5cdb7eb..6e5941bd3ee 100644
--- a/pkgs/applications/office/portfolio/default.nix
+++ b/pkgs/applications/office/portfolio/default.nix
@@ -27,11 +27,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "PortfolioPerformance";
-  version = "0.59.4";
+  version = "0.59.5";
 
   src = fetchurl {
     url = "https://github.com/buchen/portfolio/releases/download/${version}/PortfolioPerformance-${version}-linux.gtk.x86_64.tar.gz";
-    sha256 = "sha256-Yjp69p1UCLkGgTm8jn/sJfh2dYSKVbHdi1OLIYeB18w=";
+    sha256 = "sha256-6AEc9wc3/8AubPvqq8s9R1RnO+P8+92UsNEt6AdQv+w=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/office/trilium/default.nix b/pkgs/applications/office/trilium/default.nix
index 0ac2f4eac13..73d595cf699 100644
--- a/pkgs/applications/office/trilium/default.nix
+++ b/pkgs/applications/office/trilium/default.nix
@@ -10,13 +10,13 @@ let
     maintainers = with maintainers; [ fliegendewurst ];
   };
 
-  version = "0.56.2";
+  version = "0.57.3";
 
   desktopSource.url = "https://github.com/zadam/trilium/releases/download/v${version}/trilium-linux-x64-${version}.tar.xz";
-  desktopSource.sha256 = "1rqfkbxgcd32kpi6xfd590nivd1ga0d0kf5zvffyypyy28q95pyz";
+  desktopSource.sha256 = "0ch2l0raysdzkm131rq3xgsk52f9h2f1nx1zjc0zzlvs4qz657l3";
 
   serverSource.url = "https://github.com/zadam/trilium/releases/download/v${version}/trilium-linux-x64-server-${version}.tar.xz";
-  serverSource.sha256 = "1pyi2b649n2rihr4dcz8brfkqrbvssbzhr3dnmyrhrp3qdyxamb6";
+  serverSource.sha256 = "0666pm2pzh1srzpdvs36nw1w2yp4k67k3idz6pyargziqh9pkyqf";
 
 in {
 
@@ -49,6 +49,11 @@ in {
       })
     ];
 
+    # Remove trilium-portable.sh, so trilium knows it is packaged making it stop auto generating a desktop item on launch
+    postPatch = ''
+      rm ./trilium-portable.sh
+    '';
+
     installPhase = ''
       runHook preInstall
       mkdir -p $out/bin
diff --git a/pkgs/applications/office/zk/default.nix b/pkgs/applications/office/zk/default.nix
index 23b1977308c..a6e1909a288 100644
--- a/pkgs/applications/office/zk/default.nix
+++ b/pkgs/applications/office/zk/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "zk";
-  version = "0.11.1";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "mickael-menu";
     repo = "zk";
     rev = "v${version}";
-    sha256 = "sha256-30Vw6RGREg/ULS+eNExulHNOsOssMjXE+/tuRBQ17kI=";
+    sha256 = "sha256-F56jbYVbKegy38MIaEZvmeqp++bz37wFnHswkXt45t0=";
   };
 
   vendorSha256 = "sha256-11GzI3aEhKKTiULoWq9uIc66E3YCrW/HJQUYXRhCaek=";
diff --git a/pkgs/applications/radio/chirp/default.nix b/pkgs/applications/radio/chirp/default.nix
index 95d33d6f1ee..e73f438f76b 100644
--- a/pkgs/applications/radio/chirp/default.nix
+++ b/pkgs/applications/radio/chirp/default.nix
@@ -1,24 +1,39 @@
 { lib
-, fetchurl
-, python2
+, fetchFromGitHub
+, python3
+, unstableGitUpdater
 }:
-python2.pkgs.buildPythonApplication rec {
-  pname = "chirp-daily";
-  version = "20220823";
 
-  src = fetchurl {
-    url = "https://trac.chirp.danplanet.com/chirp_daily/daily-${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-V+8HQAYU2XjOYeku0XEHqkY4m0XjiUBxM61QcupnlVM=";
+python3.pkgs.buildPythonApplication rec {
+  pname = "chirp";
+  version = "unstable-2022-12-07";
+
+  src = fetchFromGitHub {
+    owner = "kk7ds";
+    repo = "chirp";
+    rev = "dc0c98d22423b496faf0a86296a6ec0bb3b3e11a";
+    hash = "sha256-z0xD11CB7Vt8k0dPXE+E5ZD9XAFwWNxjnUs25/Gd7zI=";
   };
 
-  propagatedBuildInputs = with python2.pkgs; [
-    pygtk pyserial libxml2 future
+  propagatedBuildInputs = with python3.pkgs; [
+    future
+    pyserial
+    requests
+    six
+    wxPython_4_2
   ];
 
+  # "running build_ext" fails with no output
+  doCheck = false;
+
+  passthru.updateScript = unstableGitUpdater {
+    branch = "py3";
+  };
+
   meta = with lib; {
     description = "A free, open-source tool for programming your amateur radio";
     homepage = "https://chirp.danplanet.com/";
-    license = licenses.gpl3;
+    license = licenses.gpl3Plus;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/applications/radio/freedv/default.nix b/pkgs/applications/radio/freedv/default.nix
index b648c04577e..c7877f96e84 100644
--- a/pkgs/applications/radio/freedv/default.nix
+++ b/pkgs/applications/radio/freedv/default.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "freedv";
-  version = "1.8.4";
+  version = "1.8.5";
 
   src = fetchFromGitHub {
     owner = "drowe67";
     repo = "freedv-gui";
     rev = "v${version}";
-    hash = "sha256-X/jL6q2yLNtRq7Xg9JeXu1zXD0KCs59D1poA9hM3Ndo=";
+    hash = "sha256-BkxEg4vQ943QyDo9V1hG2XimguGn8XpO9aIz5si0PKU=";
   };
 
   postPatch = lib.optionalString stdenv.isDarwin ''
diff --git a/pkgs/applications/science/astronomy/phd2/default.nix b/pkgs/applications/science/astronomy/phd2/default.nix
index 52049302a27..dc84dcfd98d 100644
--- a/pkgs/applications/science/astronomy/phd2/default.nix
+++ b/pkgs/applications/science/astronomy/phd2/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, cmake, gtk3, wxGTK30-gtk3
+{ lib, stdenv, fetchFromGitHub, pkg-config, cmake, gtk3, wxGTK30
 , curl, gettext, glib, indi-full, libnova, wrapGAppsHook }:
 
 stdenv.mkDerivation rec {
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     gtk3
-    wxGTK30-gtk3
+    wxGTK30
     curl
     gettext
     glib
diff --git a/pkgs/applications/science/biology/ecopcr/default.nix b/pkgs/applications/science/biology/ecopcr/default.nix
index 4a6b093e1d0..c5ab32a6883 100644
--- a/pkgs/applications/science/biology/ecopcr/default.nix
+++ b/pkgs/applications/science/biology/ecopcr/default.nix
@@ -1,17 +1,19 @@
-{ lib, stdenv, fetchurl, gcc, zlib, python27 }:
+{ lib, stdenv, fetchurl, gcc, zlib, python3 }:
 
 stdenv.mkDerivation rec {
   pname = "ecopcr";
-  version = "0.8.0";
+  version = "1.0.1";
 
   src = fetchurl {
-    url = "https://git.metabarcoding.org/obitools/ecopcr/uploads/6f37991b325c8c171df7e79e6ae8d080/ecopcr-${version}.tar.gz";
-    sha256 = "10c58hj25z78jh0g3zcbx4890yd2qrvaaanyx8mn9p49mmyf5pk6";
+    url = "https://git.metabarcoding.org/obitools/ecopcr/-/archive/ecopcr_v${version}/ecopcr-ecopcr_v${version}.tar.gz";
+    hash = "sha256-ssvWpi7HuuRRAkpqqrX3ijLuBqM3QsrmrG+t7/m6fZA=";
   };
 
-  sourceRoot = "ecoPCR/src";
+  buildInputs = [ gcc python3 zlib ];
 
-  buildInputs = [ gcc python27 zlib ];
+  preConfigure = ''
+    cd src
+  '';
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/applications/science/logic/isabelle/default.nix b/pkgs/applications/science/logic/isabelle/default.nix
index 1bb7ede6da7..d2326d2d4d0 100644
--- a/pkgs/applications/science/logic/isabelle/default.nix
+++ b/pkgs/applications/science/logic/isabelle/default.nix
@@ -6,7 +6,6 @@
 , java
 , scala_3
 , polyml
-, z3
 , veriT
 , vampire
 , eprover-ho
@@ -15,7 +14,6 @@
 , perl
 , makeDesktopItem
 , isabelle-components
-, isabelle
 , symlinkJoin
 , fetchhg
 }:
@@ -46,7 +44,7 @@ let
       cp libsha1.so $out/lib/
     '';
   };
-in stdenv.mkDerivation rec {
+in stdenv.mkDerivation (finalAttrs: rec {
   pname = "isabelle";
   version = "2022";
 
@@ -68,25 +66,22 @@ in stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ java ];
 
-  buildInputs = [ polyml z3 veriT vampire eprover-ho nettools ]
+  buildInputs = [ polyml veriT vampire eprover-ho nettools ]
     ++ lib.optionals (!stdenv.isDarwin) [ java ];
 
-  sourceRoot = dirname;
+  sourceRoot = "${dirname}${lib.optionalString stdenv.isDarwin ".app"}";
+
+  doCheck = true;
+  checkPhase = "bin/isabelle build -v HOL-SMT_Examples";
 
   postUnpack = lib.optionalString stdenv.isDarwin ''
-    mv $sourceRoot.app $sourceRoot
+    mv $sourceRoot ${dirname}
+    sourceRoot=${dirname}
   '';
 
   postPatch = ''
     patchShebangs lib/Tools/ bin/
 
-    cat >contrib/z3*/etc/settings <<EOF
-      Z3_HOME=${z3}
-      Z3_VERSION=${z3.version}
-      Z3_SOLVER=${z3}/bin/z3
-      Z3_INSTALLED=yes
-    EOF
-
     cat >contrib/verit-*/etc/settings <<EOF
       ISABELLE_VERIT=${veriT}/bin/veriT
     EOF
@@ -122,7 +117,7 @@ in stdenv.mkDerivation rec {
 
     echo ISABELLE_LINE_EDITOR=${rlwrap}/bin/rlwrap >>etc/settings
 
-    for comp in contrib/jdk* contrib/polyml-* contrib/z3-* contrib/verit-* contrib/vampire-* contrib/e-*; do
+    for comp in contrib/jdk* contrib/polyml-* contrib/verit-* contrib/vampire-* contrib/e-*; do
       rm -rf $comp/x86*
     done
 
@@ -143,15 +138,14 @@ in stdenv.mkDerivation rec {
       --replace 'ISABELLE_APPLE_PLATFORM64=arm64-darwin' ""
   '' + lib.optionalString stdenv.isLinux ''
     arch=${if stdenv.hostPlatform.system == "x86_64-linux" then "x86_64-linux" else "x86-linux"}
-    for f in contrib/*/$arch/{bash_process,epclextract,nunchaku,SPASS,zipperposition}; do
-      patchelf --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) "$f"
-    done
-    for f in contrib/*/platform_$arch/{bash_process,epclextract,nunchaku,SPASS,zipperposition}; do
+    for f in contrib/*/$arch/{z3,epclextract,nunchaku,SPASS,zipperposition}; do
       patchelf --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) "$f"
     done
+    patchelf --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) contrib/bash_process-*/platform_$arch/bash_process
     for d in contrib/kodkodi-*/jni/$arch; do
       patchelf --set-rpath "${lib.concatStringsSep ":" [ "${java}/lib/openjdk/lib/server" "${stdenv.cc.cc.lib}/lib" ]}" $d/*.so
     done
+    patchelf --set-rpath "${stdenv.cc.cc.lib}/lib" contrib/z3-*/$arch/z3
   '';
 
   buildPhase = ''
@@ -219,14 +213,15 @@ in stdenv.mkDerivation rec {
     maintainers = [ maintainers.jwiegley maintainers.jvanbruegge ];
     platforms = platforms.unix;
   };
-} // {
-  withComponents = f:
+
+  passthru.withComponents = f:
     let
+      isabelle = finalAttrs.finalPackage;
       base = "$out/${isabelle.dirname}";
       components = f isabelle-components;
     in symlinkJoin {
       name = "isabelle-with-components-${isabelle.version}";
-      paths = [ isabelle ] ++ components;
+      paths = [ isabelle ] ++ (builtins.map (c: c.override { inherit isabelle; }) components);
 
       postBuild = ''
         rm $out/bin/*
@@ -244,4 +239,4 @@ in stdenv.mkDerivation rec {
         echo contrib/${c.pname}-${c.version} >> ${base}/etc/components
       '') components;
     };
-}
+})
diff --git a/pkgs/applications/science/machine-learning/streamlit/default.nix b/pkgs/applications/science/machine-learning/streamlit/default.nix
index 90830ae9ffc..189c4cf97d3 100755
--- a/pkgs/applications/science/machine-learning/streamlit/default.nix
+++ b/pkgs/applications/science/machine-learning/streamlit/default.nix
@@ -1,21 +1,18 @@
-{
-  # Nix
-  lib
-, buildPythonApplication
-, fetchPypi
-, # Build inputs
-  altair
+{ lib
+, altair
 , blinker
-, click
+, buildPythonApplication
 , cachetools
-, GitPython
+, click
+, fetchPypi
+, gitpython
 , importlib-metadata
 , jinja2
 , pillow
+, protobuf3
 , pyarrow
 , pydeck
 , pympler
-, protobuf3
 , requests
 , rich
 , semver
@@ -25,7 +22,6 @@
 , tzlocal
 , validators
 , watchdog
-,
 }:
 
 buildPythonApplication rec {
@@ -43,7 +39,7 @@ buildPythonApplication rec {
     blinker
     cachetools
     click
-    GitPython
+    gitpython
     importlib-metadata
     jinja2
     pillow
diff --git a/pkgs/applications/science/misc/snakemake/default.nix b/pkgs/applications/science/misc/snakemake/default.nix
index 956b98ffd5f..89b174515c4 100644
--- a/pkgs/applications/science/misc/snakemake/default.nix
+++ b/pkgs/applications/science/misc/snakemake/default.nix
@@ -22,7 +22,7 @@ python3.pkgs.buildPythonApplication rec {
     datrie
     docutils
     filelock
-    GitPython
+    gitpython
     jinja2
     jsonschema
     nbformat
diff --git a/pkgs/applications/version-management/git-and-tools/git-annex-remote-googledrive/default.nix b/pkgs/applications/version-management/git-and-tools/git-annex-remote-googledrive/default.nix
index 66dc5ece90a..16c5b49406f 100644
--- a/pkgs/applications/version-management/git-and-tools/git-annex-remote-googledrive/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-annex-remote-googledrive/default.nix
@@ -1,29 +1,38 @@
 { lib
-, buildPythonApplication
-, fetchPypi
 , annexremote
+, buildPythonApplication
 , drivelib
-, GitPython
-, tenacity
+, fetchPypi
+, gitpython
 , humanfriendly
+, tenacity
 }:
 
 buildPythonApplication rec {
   pname = "git-annex-remote-googledrive";
   version = "1.3.2";
+  format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
     sha256 = "0rwjcdvfgzdlfgrn1rrqwwwiqqzyh114qddrbfwd46ld5spry6r1";
   };
 
-  propagatedBuildInputs = [ annexremote drivelib GitPython tenacity humanfriendly ];
+  propagatedBuildInputs = [
+    annexremote
+    drivelib
+    gitpython
+    tenacity
+    humanfriendly
+  ];
 
   # while git-annex does come with a testremote command that *could* be used,
   # testing this special remote obviously depends on authenticating with google
   doCheck = false;
 
-  pythonImportsCheck = [ "git_annex_remote_googledrive" ];
+  pythonImportsCheck = [
+    "git_annex_remote_googledrive"
+  ];
 
   meta = with lib; {
     description = "A git-annex special remote for Google Drive";
diff --git a/pkgs/applications/version-management/git-and-tools/git-privacy/default.nix b/pkgs/applications/version-management/git-and-tools/git-privacy/default.nix
index c1765417438..d162f9ce20b 100644
--- a/pkgs/applications/version-management/git-and-tools/git-privacy/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-privacy/default.nix
@@ -9,8 +9,6 @@ python3.pkgs.buildPythonApplication rec {
   version = "2.1.0";
   format = "setuptools";
 
-  disabled = python3.pythonOlder "3.6";
-
   src = fetchFromGitHub {
     owner = "EMPRI-DEVOPS";
     repo = pname;
@@ -21,7 +19,7 @@ python3.pkgs.buildPythonApplication rec {
   propagatedBuildInputs = with python3.pkgs; [
     click
     git-filter-repo
-    GitPython
+    gitpython
     pynacl
     setuptools
   ];
diff --git a/pkgs/applications/version-management/git-and-tools/git-repo-updater/default.nix b/pkgs/applications/version-management/git-and-tools/git-repo-updater/default.nix
index d78972aa07b..ebea57c1552 100644
--- a/pkgs/applications/version-management/git-and-tools/git-repo-updater/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-repo-updater/default.nix
@@ -1,5 +1,9 @@
-{ lib, buildPythonApplication, fetchPypi
-, colorama, GitPython }:
+{ lib
+, buildPythonApplication
+, colorama
+, fetchPypi
+, gitpython
+}:
 
 buildPythonApplication rec {
   pname = "gitup";
@@ -10,7 +14,10 @@ buildPythonApplication rec {
     sha256 = "1pa612rcc94nc461zs9sag9p46sycc214622b06gdn35rmwp0y2g";
   };
 
-  propagatedBuildInputs = [ colorama GitPython ];
+  propagatedBuildInputs = [
+    colorama
+    gitpython
+  ];
 
   # no tests
   doCheck = false;
@@ -19,7 +26,6 @@ buildPythonApplication rec {
     description = "Easily update multiple Git repositories at once";
     homepage = "https://github.com/earwig/git-repo-updater";
     license = licenses.mit;
-    maintainers = [ maintainers.bdesham ];
-    platforms = platforms.all;
+    maintainers = with maintainers; [bdesham ];
   };
 }
diff --git a/pkgs/applications/version-management/git-and-tools/git-up/default.nix b/pkgs/applications/version-management/git-and-tools/git-up/default.nix
index 0a366827e40..71ae40e25d3 100644
--- a/pkgs/applications/version-management/git-and-tools/git-up/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-up/default.nix
@@ -1,4 +1,7 @@
-{ lib, pythonPackages, git }:
+{ lib
+, pythonPackages
+, git
+}:
 
 pythonPackages.buildPythonApplication rec {
   pname = "git-up";
@@ -10,7 +13,16 @@ pythonPackages.buildPythonApplication rec {
   };
 
   # git should be on path for tool to work correctly
-  propagatedBuildInputs = [ git ] ++ (with pythonPackages; [ click colorama docopt GitPython six termcolor ]);
+  propagatedBuildInputs = [
+    git
+  ] ++ (with pythonPackages; [
+    click
+    colorama
+    docopt
+    gitpython
+    six
+    termcolor
+  ]);
 
   checkInputs = [ git pythonPackages.nose ]; # git needs to be on path
   # 1. git fails to run as it cannot detect the email address, so we set it
diff --git a/pkgs/applications/version-management/git-and-tools/gitmux/default.nix b/pkgs/applications/version-management/git-and-tools/gitmux/default.nix
new file mode 100644
index 00000000000..7e66985bb88
--- /dev/null
+++ b/pkgs/applications/version-management/git-and-tools/gitmux/default.nix
@@ -0,0 +1,35 @@
+{ fetchFromGitHub, buildGoModule, lib, testers, gitmux }:
+
+buildGoModule rec {
+  pname = "gitmux";
+  version = "0.7.10";
+
+  src = fetchFromGitHub {
+    owner = "arl";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-kBrE3jU7N8+kdT4tqC6gIGPz3soagStzLy5Iz4vNFI0=";
+  };
+
+  vendorSha256 = "sha256-V6xe+19NiHYIIN4rgkyzdP4eGnRXo0aW4fVbdlIcvig=";
+
+  # GitHub source does contain a regression test for the module
+  # but it requires networking as it git clones a repo from github
+  doCheck = false;
+
+  ldflags = [ "-X main.version=${version}" ];
+
+  passthru.tests.version = testers.testVersion {
+    package = gitmux;
+    command = "gitmux -V";
+  };
+
+  subPackages = [ "." ];
+
+  meta = with lib; {
+    description = "Git in your tmux status bar";
+    homepage = "https://github.com/arl/gitmux";
+    license = licenses.mit;
+    maintainers = with maintainers; [ nialov ];
+  };
+}
diff --git a/pkgs/applications/version-management/git-and-tools/glab/default.nix b/pkgs/applications/version-management/git-and-tools/glab/default.nix
index 6bfc8df1313..9d6bbbd13f6 100644
--- a/pkgs/applications/version-management/git-and-tools/glab/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/glab/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "glab";
-  version = "1.23.0";
+  version = "1.24.1";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-NHBLaUEWurWnwbLiEsi3/pHqxKcgjjx+oRAGZXxni/Q=";
+    sha256 = "sha256-CUchYPMBTINkMJg8TC8rKMVkrcj/Gy+ZxV7jbtMFvpg=";
   };
 
   vendorSha256 = "sha256-NuK63ibb1t+HnSR/gCFS7HWVtfGLazVx2M+qxRNCR1I=";
diff --git a/pkgs/applications/version-management/git-and-tools/lefthook/default.nix b/pkgs/applications/version-management/git-and-tools/lefthook/default.nix
index e73d4de6dc4..38d6d740c83 100644
--- a/pkgs/applications/version-management/git-and-tools/lefthook/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/lefthook/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "lefthook";
-  version = "1.2.3";
+  version = "1.2.4";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "evilmartians";
     repo = "lefthook";
-    sha256 = "sha256-tns/JUOYlgG+oiFACnXlCwHBF4enctV4GPlpEZCM/nM=";
+    sha256 = "sha256-Z6j/Y8b9lq2nYS5Ki8iJoDsG3l5M6RylfDqQL7WrwNg=";
   };
 
   vendorSha256 = "sha256-sBcgt2YsV9RQhSjPN6N54tRk7nNvcOVhPEsEP+0Dtco=";
diff --git a/pkgs/applications/version-management/git-and-tools/legit/default.nix b/pkgs/applications/version-management/git-and-tools/legit/default.nix
index df286652711..33efad77f90 100644
--- a/pkgs/applications/version-management/git-and-tools/legit/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/legit/default.nix
@@ -1,8 +1,11 @@
-{ lib, python3Packages }:
+{ lib
+, python3Packages
+}:
 
 python3Packages.buildPythonApplication rec {
   pname = "legit";
   version = "1.2.0";
+
   src = python3Packages.fetchPypi {
     inherit pname version;
     sha256 = "0ngh3ar6v15516f52j21k6qz7hykmxfjadhb2rakvl27b5xvjy1c";
@@ -12,7 +15,7 @@ python3Packages.buildPythonApplication rec {
     click
     clint
     crayons
-    GitPython
+    gitpython
     six
   ];
 
diff --git a/pkgs/applications/version-management/jujutsu/default.nix b/pkgs/applications/version-management/jujutsu/default.nix
index e9b9d02ca6c..19eb42c3cef 100644
--- a/pkgs/applications/version-management/jujutsu/default.nix
+++ b/pkgs/applications/version-management/jujutsu/default.nix
@@ -15,16 +15,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "jujutsu";
-  version = "0.5.1";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "martinvonz";
     repo = "jj";
     rev = "v${version}";
-    sha256 = "sha256-ITYpdCUh+WzP2RrAkSep3DsQ7dztvOMuwESKimn8JBQ=";
+    sha256 = "sha256-xS4uktydrvkeTsR9QGT9gYdhFh92XdpoG0TrDt7IPdc=";
   };
 
-  cargoSha256 = "sha256-eH8/R4dwQ08Q7Dyw8CnE+DGjneAmtTdsRben2cxpG8Q=";
+  cargoSha256 = "sha256-VM+Oq0nf4pMK3nbPbHbl7E2qgUnGlu7kf2p47d8cm1c=";
 
   # Needed to get openssl-sys to use pkg-config.
   OPENSSL_NO_VENDOR = 1;
diff --git a/pkgs/applications/version-management/rapidsvn/default.nix b/pkgs/applications/version-management/rapidsvn/default.nix
index 4bede0ac82b..0027af3defe 100644
--- a/pkgs/applications/version-management/rapidsvn/default.nix
+++ b/pkgs/applications/version-management/rapidsvn/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, wxGTK30-gtk3, subversion, apr, aprutil, python3, fetchpatch }:
+{ lib, stdenv, fetchurl, wxGTK30, subversion, apr, aprutil, python3, fetchpatch }:
 
 stdenv.mkDerivation rec {
   pname = "rapidsvn";
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "1bmcqjc12k5w0z40k7fkk8iysqv4fw33i80gvcmbakby3d4d4i4p";
   };
 
-  buildInputs = [ wxGTK30-gtk3 subversion apr aprutil python3 ];
+  buildInputs = [ wxGTK30 subversion apr aprutil python3 ];
 
   NIX_CFLAGS_COMPILE = [ "-std=c++14" ];
 
diff --git a/pkgs/applications/version-management/tailor/default.nix b/pkgs/applications/version-management/tailor/default.nix
index e3b5891720f..bd824a71633 100644
--- a/pkgs/applications/version-management/tailor/default.nix
+++ b/pkgs/applications/version-management/tailor/default.nix
@@ -1,19 +1,37 @@
-{ fetchurl, pypy2Packages }:
+{ lib
+, python3
+, fetchurl
+}:
 
-pypy2Packages.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "tailor";
-  version = "0.9.35";
+  version = "0.9.37";
 
   src = fetchurl {
-    urls = [
-      "http://darcs.arstecnica.it/tailor/tailor-${version}.tar.gz"
-      "https://src.fedoraproject.org/repo/pkgs/tailor/tailor-${version}.tar.gz/58a6bc1c1d922b0b1e4579c6440448d1/tailor-${version}.tar.gz"
-    ];
-    sha256 = "061acapxxn5ab3ipb5nd3nm8pk2xj67bi83jrfd6lqq3273fmdjh";
+    url = "https://gitlab.com/ports1/tailor/-/archive/0.937/tailor-0.937.tar.gz";
+    hash = "sha256-Bdf8ZCRsbCsFz1GRxyQxxndXSsm8oOL2738m9UxOTVc=";
   };
 
-  meta = {
-    description = "Version control tools integration tool";
+  propagatedBuildInputs = with python3.pkgs; [
+    future
+  ];
+
+  # AssertionError: Tailor Darcs repository not found!
+  doCheck = false;
+
+  meta = with lib; {
+    description = "A tool to migrate changesets between various kinds of version control system.";
+    longDescription = ''
+      With its ability to "translate the history" from one VCS kind to another,
+      this tool makes it easier to keep the upstream changes merged in
+      a own branch of a product.
+
+      Tailor is able to fetch the history from Arch, Bazaar, CVS, Darcs, Monotone,
+      Perforce or Subversion and rewrite it over Aegis, Bazaar, CVS, Darcs, Git,
+      Mercurial, Monotone and Subversion.
+    '';
+    homepage = "https://gitlab.com/ports1/tailor";
+    license = licenses.gpl1Plus;
+    platforms = platforms.unix;
   };
 }
-
diff --git a/pkgs/applications/video/dvdstyler/default.nix b/pkgs/applications/video/dvdstyler/default.nix
index 8d42c2b2bfd..cd369145833 100644
--- a/pkgs/applications/video/dvdstyler/default.nix
+++ b/pkgs/applications/video/dvdstyler/default.nix
@@ -17,7 +17,7 @@
 , libjpeg
 , pkg-config
 , wrapGAppsHook
-, wxGTK30-gtk3 # crash with wxGTK30 with GTK2 compat
+, wxGTK30 # crash with wxGTK30 with GTK2 compat
 , wxSVG
 , xine-ui
 , xmlto
@@ -62,7 +62,7 @@ in stdenv.mkDerivation rec {
     libexif
     libjpeg
     wxSVG
-    wxGTK30-gtk3
+    wxGTK30
     xine-ui
  ]
   ++ optionals dvdisasterSupport [ dvdisaster ]
diff --git a/pkgs/applications/video/mpv/default.nix b/pkgs/applications/video/mpv/default.nix
index 05ec95d006b..da5e6366fb6 100644
--- a/pkgs/applications/video/mpv/default.nix
+++ b/pkgs/applications/video/mpv/default.nix
@@ -4,11 +4,10 @@
 , fetchFromGitHub
 , addOpenGLRunpath
 , docutils
-, perl
+, meson
+, ninja
 , pkg-config
 , python3
-, wafHook
-, which
 , ffmpeg
 , freefont_ttf
 , freetype
@@ -19,6 +18,7 @@
 , libuchardet
 , libiconv
 , CoreFoundation, Cocoa, CoreAudio, MediaPlayer
+, xcbuild
 
 , waylandSupport ? stdenv.isLinux
   , wayland
@@ -97,42 +97,38 @@ in stdenv.mkDerivation rec {
     patchShebangs version.* ./TOOLS/
   '';
 
-  NIX_LDFLAGS = lib.optionalString x11Support "-lX11 -lXext "
-    + lib.optionalString stdenv.isDarwin "-framework CoreFoundation";
-
-  # These flags are not supported and cause the build
-  # to fail, even when cross compilation itself works.
-  dontAddWafCrossFlags = true;
-
-  wafConfigureFlags = [
-    "--enable-libmpv-shared"
-    "--enable-manpage-build"
-    "--disable-libmpv-static"
-    "--disable-static-build"
-    "--disable-build-date" # Purity
-    (lib.enableFeature archiveSupport  "libarchive")
-    (lib.enableFeature cddaSupport     "cdda")
-    (lib.enableFeature dvdnavSupport   "dvdnav")
-    (lib.enableFeature javascriptSupport "javascript")
-    (lib.enableFeature openalSupport   "openal")
-    (lib.enableFeature sdl2Support     "sdl2")
-    (lib.enableFeature sixelSupport    "sixel")
-    (lib.enableFeature vaapiSupport    "vaapi")
-    (lib.enableFeature waylandSupport  "wayland")
-    (lib.enableFeature dvbinSupport  "dvbin")
-  ] # Disable whilst Swift isn't supported
-    ++ lib.optional (!swiftSupport) "--disable-macos-cocoa-cb";
+  NIX_LDFLAGS = lib.optionalString x11Support "-lX11 -lXext ";
+
+  mesonFlags = let
+    inherit (lib) mesonOption mesonBool mesonEnable;
+  in [
+    (mesonOption "default_library" "shared")
+    (mesonBool "libmpv" true)
+    (mesonEnable "libarchive" archiveSupport)
+    (mesonEnable "manpage-build" true)
+    (mesonEnable "cdda" cddaSupport)
+    (mesonEnable "dvbin" dvbinSupport)
+    (mesonEnable "dvdnav" dvdnavSupport)
+    (mesonEnable "openal" openalSupport)
+    (mesonEnable "sdl2" sdl2Support)
+    # Disable whilst Swift isn't supported
+    (mesonEnable "swift-build" swiftSupport)
+    (mesonEnable "macos-cocoa-cb" swiftSupport)
+  ];
+
+  mesonAutoFeatures = "auto";
 
   nativeBuildInputs = [
     addOpenGLRunpath
     docutils # for rst2man
-    perl
+    meson
+    ninja
     pkg-config
     python3
-    wafHook
-    which
-  ] ++ lib.optionals swiftSupport [ swift ]
-    ++ lib.optionals waylandSupport [ wayland-scanner ];
+  ]
+  ++ lib.optionals stdenv.isDarwin [ xcbuild.xcrun ]
+  ++ lib.optionals swiftSupport [ swift ]
+  ++ lib.optionals waylandSupport [ wayland-scanner ];
 
   buildInputs = [
     ffmpeg
@@ -175,10 +171,10 @@ in stdenv.mkDerivation rec {
     ++ lib.optionals stdenv.isDarwin    [ libiconv ]
     ++ lib.optionals stdenv.isDarwin    [ CoreFoundation Cocoa CoreAudio MediaPlayer ];
 
-  enableParallelBuilding = true;
-
   postBuild = lib.optionalString stdenv.isDarwin ''
+    pushd .. # Must be run from the source dir because it uses relative paths
     python3 TOOLS/osxbundle.py -s build/mpv
+    popd
   '';
 
   postInstall = ''
@@ -186,16 +182,13 @@ in stdenv.mkDerivation rec {
     mkdir -p $out/share/mpv
     ln -s ${freefont_ttf}/share/fonts/truetype/FreeSans.ttf $out/share/mpv/subfont.ttf
 
-    cp TOOLS/mpv_identify.sh $out/bin
-    cp TOOLS/umpv $out/bin
+    cp ../TOOLS/mpv_identify.sh $out/bin
+    cp ../TOOLS/umpv $out/bin
     cp $out/share/applications/mpv.desktop $out/share/applications/umpv.desktop
     sed -i '/Icon=/ ! s/mpv/umpv/g' $out/share/applications/umpv.desktop
-
-    substituteInPlace $out/lib/pkgconfig/mpv.pc \
-      --replace "$out/include" "$dev/include"
   '' + lib.optionalString stdenv.isDarwin ''
     mkdir -p $out/Applications
-    cp -r build/mpv.app $out/Applications
+    cp -r mpv.app $out/Applications
   '';
 
   # Set RUNPATH so that libcuda in /run/opengl-driver(-32)/lib can be found.
@@ -227,6 +220,6 @@ in stdenv.mkDerivation rec {
     '';
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ AndersonTorres fpletz globin ma27 tadeokondrak ];
-    platforms = platforms.darwin ++ platforms.linux;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/applications/virtualization/containerd/default.nix b/pkgs/applications/virtualization/containerd/default.nix
index 7a99bfd0ecc..c84ba7a6c46 100644
--- a/pkgs/applications/virtualization/containerd/default.nix
+++ b/pkgs/applications/virtualization/containerd/default.nix
@@ -10,13 +10,13 @@
 
 buildGoModule rec {
   pname = "containerd";
-  version = "1.6.10";
+  version = "1.6.12";
 
   src = fetchFromGitHub {
     owner = "containerd";
     repo = "containerd";
     rev = "v${version}";
-    sha256 = "sha256-kz2UuWzVK5lu/d6K0LHauu2yhBF6Hl83P/a/HCCSObc=";
+    sha256 = "sha256-02eg2RNEim47Q3TyTLYc0IdaBJcOf89qTab8GV8fDgA=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index c8d3de79f15..fff9200285a 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -48,7 +48,7 @@ rec {
       };
 
       buildInputs = oldAttrs.buildInputs
-        ++ lib.optional withSeccomp [ libseccomp ];
+        ++ lib.optionals withSeccomp [ libseccomp ];
     });
 
     docker-tini = tini.overrideAttrs (oldAttrs: {
diff --git a/pkgs/applications/virtualization/pods/default.nix b/pkgs/applications/virtualization/pods/default.nix
index 70219f99538..614f2591b51 100644
--- a/pkgs/applications/virtualization/pods/default.nix
+++ b/pkgs/applications/virtualization/pods/default.nix
@@ -12,23 +12,24 @@
 , gtksourceview5
 , libadwaita
 , libpanel
+, vte-gtk4
 }:
 
 stdenv.mkDerivation rec {
   pname = "pods";
-  version = "1.0.0-beta.8";
+  version = "1.0.0-beta.9";
 
   src = fetchFromGitHub {
     owner = "marhkb";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-WLjXeTtg5DlZbENWYC6lHj6ccU1HGLN+v7xl5sXXvE0=";
+    sha256 = "sha256-cW6n00EPe7eFuqT2Vk27Ax0fxjz9kWSlYuS2oIj0mXY=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    sha256 = "sha256-/Z0vp9Fn49+PhXwtt4Z0on4CghU1Hnu4gWcjzAWeCFk=";
+    sha256 = "sha256-y0njqlzAx1M7iC8bZrKlKACSiYnSRaHOrcAxs3bFF30=";
   };
 
   nativeBuildInputs = [
@@ -49,6 +50,7 @@ stdenv.mkDerivation rec {
     gtksourceview5
     libadwaita
     libpanel
+    vte-gtk4
   ];
 
   meta = with lib; {
diff --git a/pkgs/applications/window-managers/icewm/default.nix b/pkgs/applications/window-managers/icewm/default.nix
index 07c45bbcc69..fe0c275b72e 100644
--- a/pkgs/applications/window-managers/icewm/default.nix
+++ b/pkgs/applications/window-managers/icewm/default.nix
@@ -41,13 +41,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "icewm";
-  version = "3.2.2";
+  version = "3.2.3";
 
   src = fetchFromGitHub {
     owner = "ice-wm";
     repo = "icewm";
     rev = finalAttrs.version;
-    hash = "sha256-tVbBV3eaZ9MUXlzriiOeEuzojI3GHNaXRBjdsQjXrzw=";
+    hash = "sha256-cG+I7WMWboMNH6A0eKFI3evN16C5EGE127q+a/PBR5E=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/build-support/docker/default.nix b/pkgs/build-support/docker/default.nix
index c6ab4589aef..48c780e2dbe 100644
--- a/pkgs/build-support/docker/default.nix
+++ b/pkgs/build-support/docker/default.nix
@@ -74,7 +74,7 @@ let
   # Reference: https://github.com/opencontainers/image-spec/blob/master/config.md#properties
   # For the mapping from Nixpkgs system parameters to GOARCH, we can reuse the
   # mapping from the go package.
-  defaultArch = go.GOARCH;
+  defaultArchitecture = go.GOARCH;
 
 in
 rec {
@@ -101,8 +101,8 @@ rec {
     , imageDigest
     , sha256
     , os ? "linux"
-    , arch ? defaultArch
-
+    , # Image architecture, defaults to the architecture of the `hostPlatform` when unset
+      arch ? defaultArchitecture
       # This is used to set name to the pulled image
     , finalImageName ? imageName
       # This used to set a tag to the pulled image
@@ -514,6 +514,8 @@ rec {
       keepContentsDirlinks ? false
     , # Docker config; e.g. what command to run on the container.
       config ? null
+    , # Image architecture, defaults to the architecture of the `hostPlatform` when unset
+      architecture ? defaultArchitecture
     , # Optional bash script to run on the files prior to fixturizing the layer.
       extraCommands ? ""
     , uid ? 0
@@ -546,8 +548,7 @@ rec {
       baseJson =
         let
           pure = writeText "${baseName}-config.json" (builtins.toJSON {
-            inherit created config;
-            architecture = defaultArch;
+            inherit created config architecture;
             preferLocalBuild = true;
             os = "linux";
           });
@@ -838,6 +839,8 @@ rec {
       contents ? [ ]
     , # Docker config; e.g. what command to run on the container.
       config ? { }
+    , # Image architecture, defaults to the architecture of the `hostPlatform` when unset
+      architecture ? defaultArchitecture
     , # Time of creation of the image. Passing "now" will make the
       # created date be the time of building.
       created ? "1970-01-01T00:00:01Z"
@@ -869,8 +872,7 @@ rec {
 
         streamScript = writePython3 "stream" { } ./stream_layered_image.py;
         baseJson = writeText "${baseName}-base.json" (builtins.toJSON {
-          inherit config;
-          architecture = defaultArch;
+          inherit config architecture;
           os = "linux";
         });
 
diff --git a/pkgs/build-support/docker/examples.nix b/pkgs/build-support/docker/examples.nix
index 71c3574963c..5784e650dc2 100644
--- a/pkgs/build-support/docker/examples.nix
+++ b/pkgs/build-support/docker/examples.nix
@@ -92,7 +92,7 @@ rec {
     ];
 
     extraCommands = ''
-      mkdir -p tmp
+      mkdir -p tmp/nginx_client_body
 
       # nginx still tries to read this directory even if error_log
       # directive is specifying another file :/
@@ -700,6 +700,21 @@ rec {
     contents = [ pkgs.bashInteractive ./test-dummy ];
   };
 
+  build-image-with-architecture = buildImage {
+    name = "build-image-with-architecture";
+    tag = "latest";
+    architecture = "arm64";
+    # Not recommended. Use `buildEnv` between copy and packages to avoid file duplication.
+    copyToRoot = [ pkgs.bashInteractive ./test-dummy ];
+  };
+
+  layered-image-with-architecture = pkgs.dockerTools.streamLayeredImage {
+    name = "layered-image-with-architecture";
+    tag = "latest";
+    architecture = "arm64";
+    contents = [ pkgs.bashInteractive ./test-dummy ];
+  };
+
   # ensure that caCertificates builds
   image-with-certs = buildImage {
     name = "image-with-certs";
diff --git a/pkgs/build-support/mkshell/default.nix b/pkgs/build-support/mkshell/default.nix
index e7552f43484..39b02a47141 100644
--- a/pkgs/build-support/mkshell/default.nix
+++ b/pkgs/build-support/mkshell/default.nix
@@ -44,12 +44,13 @@ stdenv.mkDerivation ({
   phases = [ "buildPhase" ];
 
   buildPhase = ''
-    echo "------------------------------------------------------------" >>$out
-    echo " WARNING: the existence of this path is not guaranteed." >>$out
-    echo " It is an internal implementation detail for pkgs.mkShell."   >>$out
-    echo "------------------------------------------------------------" >>$out
-    echo >> $out
-    # Record all build inputs as runtime dependencies
-    export >> $out
+    { echo "------------------------------------------------------------";
+      echo " WARNING: the existence of this path is not guaranteed.";
+      echo " It is an internal implementation detail for pkgs.mkShell.";
+      echo "------------------------------------------------------------";
+      echo;
+      # Record all build inputs as runtime dependencies
+      export;
+    } >> "$out"
   '';
 } // rest)
diff --git a/pkgs/build-support/rust/build-rust-crate/configure-crate.nix b/pkgs/build-support/rust/build-rust-crate/configure-crate.nix
index 473a91f9ce0..ea150c2fe85 100644
--- a/pkgs/build-support/rust/build-rust-crate/configure-crate.nix
+++ b/pkgs/build-support/rust/build-rust-crate/configure-crate.nix
@@ -186,7 +186,10 @@ in ''
      set +e
      EXTRA_BUILD=$(sed -n "s/^cargo:rustc-flags=\(.*\)/\1/p" target/build/${crateName}.opt | tr '\n' ' ' | sort -u)
      EXTRA_FEATURES=$(sed -n "s/^cargo:rustc-cfg=\(.*\)/--cfg \1/p" target/build/${crateName}.opt | tr '\n' ' ')
-     EXTRA_LINK=$(sed -n "s/^cargo:rustc-link-lib=\(.*\)/\1/p" target/build/${crateName}.opt | tr '\n' ' ')
+     EXTRA_LINK_ARGS=$(sed -n "s/^cargo:rustc-link-arg=\(.*\)/-C link-arg=\1/p" target/build/${crateName}.opt | tr '\n' ' ')
+     EXTRA_LINK_ARGS_BINS=$(sed -n "s/^cargo:rustc-link-arg-bins=\(.*\)/-C link-arg=\1/p" target/build/${crateName}.opt | tr '\n' ' ')
+     EXTRA_LINK_ARGS_LIB=$(sed -n "s/^cargo:rustc-link-arg-lib=\(.*\)/-C link-arg=\1/p" target/build/${crateName}.opt | tr '\n' ' ')
+     EXTRA_LINK_LIBS=$(sed -n "s/^cargo:rustc-link-lib=\(.*\)/\1/p" target/build/${crateName}.opt | tr '\n' ' ')
      EXTRA_LINK_SEARCH=$(sed -n "s/^cargo:rustc-link-search=\(.*\)/\1/p" target/build/${crateName}.opt | tr '\n' ' ' | sort -u)
 
      # We want to read part of every line that has cargo:rustc-env= prefix and
diff --git a/pkgs/build-support/rust/build-rust-crate/lib.sh b/pkgs/build-support/rust/build-rust-crate/lib.sh
index 39f7d53f6f7..7f98701b540 100644
--- a/pkgs/build-support/rust/build-rust-crate/lib.sh
+++ b/pkgs/build-support/rust/build-rust-crate/lib.sh
@@ -17,6 +17,8 @@ build_lib() {
     -L dependency=target/deps \
     --cap-lints allow \
     $LINK \
+    $EXTRA_LINK_ARGS \
+    $EXTRA_LINK_ARGS_LIB \
     $LIB_RUSTC_OPTS \
     $BUILD_OUT_DIR \
     $EXTRA_BUILD \
@@ -47,6 +49,8 @@ build_bin() {
     --out-dir target/bin \
     -L dependency=target/deps \
     $LINK \
+    $EXTRA_LINK_ARGS \
+    $EXTRA_LINK_ARGS_BINS \
     $EXTRA_LIB \
     --cap-lints allow \
     $BUILD_OUT_DIR \
@@ -94,7 +98,7 @@ setup_link_paths() {
        done
      fi
   done
-  echo "$EXTRA_LINK" | while read i; do
+  echo "$EXTRA_LINK_LIBS" | while read i; do
      if [[ ! -z "$i" ]]; then
        for library in $i; do
          echo "-l $library" >> target/link
diff --git a/pkgs/data/fonts/amiri/default.nix b/pkgs/data/fonts/amiri/default.nix
index 2c9acc39171..87185e8469f 100644
--- a/pkgs/data/fonts/amiri/default.nix
+++ b/pkgs/data/fonts/amiri/default.nix
@@ -1,17 +1,16 @@
 { lib, fetchzip }:
 
 let
-  version = "0.900";
+  version = "1.000";
 
 in fetchzip rec {
   name = "Amiri-${version}";
 
   url = "https://github.com/alif-type/amiri/releases/download/${version}/${name}.zip";
 
-  sha256 = "sha256-FjuzWW9xVWDOxHBwYL4pmopQVc9KYHGHhye5tPdw68s=";
+  sha256 = "sha256-hG6m/zsGoGF5/xhHz9EHVL9Sg9dlQqfXpQ/lqNyI1vU=";
 
   postFetch = ''
-    rm -rf $out/otf
     mkdir -p $out/share/fonts/truetype
     mv $out/*.ttf $out/share/fonts/truetype/
     mkdir -p $out/share/doc/${name}
diff --git a/pkgs/data/fonts/carlito/default.nix b/pkgs/data/fonts/carlito/default.nix
index 1de2e9afc0f..0ecd3f85c69 100644
--- a/pkgs/data/fonts/carlito/default.nix
+++ b/pkgs/data/fonts/carlito/default.nix
@@ -1,22 +1,21 @@
-{ lib, fetchzip }:
+{ lib, fetchzip, stdenvNoCC }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "carlito";
   version = "20130920";
-in fetchzip {
-  name = "carlito-${version}";
 
-  url = "https://commondatastorage.googleapis.com/chromeos-localmirror/distfiles/crosextrafonts-carlito-${version}.tar.gz";
+  src = fetchzip {
+    url = "https://commondatastorage.googleapis.com/chromeos-localmirror/distfiles/crosextrafonts-carlito-${version}.tar.gz";
+    sha256 = "sha256-OGDO5WoF7OmiRdLRRrIXMzg276Pgeq1L3Offcl0W2jg=";
+  };
 
-  postFetch = ''
-    tar -xzvf $downloadedFile --strip-components=1
+  installPhase = ''
     mkdir -p $out/etc/fonts/conf.d
     mkdir -p $out/share/fonts/truetype
-    cp -v *.ttf $out/share/fonts/truetype
+    cp -v $src/*.ttf $out/share/fonts/truetype
     cp -v ${./calibri-alias.conf} $out/etc/fonts/conf.d/30-calibri.conf
   '';
 
-  sha256 = "0d72zy6kdmxgpi63r3yvi3jh1hb7lvlgv8hgd4ag0x10dz18mbzv";
-
   meta = with lib; {
     # This font doesn't appear to have any official web site but this
     # one provides some good information and samples.
@@ -25,7 +24,7 @@ in fetchzip {
     longDescription = ''
       Carlito is a free font that is metric-compatible with the
       Microsoft Calibri font. The font is designed by Łukasz Dziedzic
-      of the tyPoland foundry and based his Lato font.
+      of the tyPoland foundry and based upon his Lato font.
     '';
     license = licenses.ofl;
     platforms = platforms.all;
diff --git a/pkgs/data/fonts/lexend/default.nix b/pkgs/data/fonts/lexend/default.nix
index 3efb1886b17..9bb00bf1059 100644
--- a/pkgs/data/fonts/lexend/default.nix
+++ b/pkgs/data/fonts/lexend/default.nix
@@ -5,13 +5,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "lexend";
-  version = "0.pre+date=2022-01-27";
+  version = "0.pre+date=2022-09-22";
 
   src = fetchFromGitHub {
     owner = "googlefonts";
     repo = pname;
-    rev = "57e6c14e2a9b457e8376044a31525c2100297e9c";
-    sha256 = "sha256-+tPggQIO50a8kOSnOVN/MR9ZwX5xZqYVNZO79eog9QA=";
+    rev = "cd26b9c2538d758138c20c3d2f10362ed613854b";
+    sha256 = "ZKogntyJ/44GBZmFwbtw5Ujw5Gnvv0tVB59ciKqR4c8=";
   };
 
   installPhase = ''
@@ -19,8 +19,8 @@ stdenvNoCC.mkDerivation rec {
 
     cd fonts
     for f in *; do
-      mkdir -p $out/share/fonts/truetype/lexend/$f
-      install $f/ttf/* $out/share/fonts/truetype/lexend/$f/
+      install -D -t $out/share/fonts/truetype/lexend/$f $f/ttf/*
+      install -D -t $out/share/fonts/variable/lexend/$f $f/variable/*
     done
 
     runHook postInstall
diff --git a/pkgs/data/fonts/material-design-icons/default.nix b/pkgs/data/fonts/material-design-icons/default.nix
index 80c887f5891..82f422146ac 100644
--- a/pkgs/data/fonts/material-design-icons/default.nix
+++ b/pkgs/data/fonts/material-design-icons/default.nix
@@ -1,7 +1,7 @@
 { lib, fetchFromGitHub }:
 
 let
-  version = "6.6.96";
+  version = "7.0.96";
 in fetchFromGitHub {
   name = "material-design-icons-${version}";
   owner  = "Templarian";
@@ -9,17 +9,19 @@ in fetchFromGitHub {
   rev    = "v${version}";
 
   postFetch = ''
-    tar xf $downloadedFile --strip=1
     mkdir -p $out/share/fonts/{eot,truetype,woff,woff2}
-    cp fonts/*.eot $out/share/fonts/eot/
-    cp fonts/*.ttf $out/share/fonts/truetype/
-    cp fonts/*.woff $out/share/fonts/woff/
-    cp fonts/*.woff2 $out/share/fonts/woff2/
+    mv $out/fonts/*.eot $out/share/fonts/eot/
+    mv $out/fonts/*.ttf $out/share/fonts/truetype/
+    mv $out/fonts/*.woff $out/share/fonts/woff/
+    mv $out/fonts/*.woff2 $out/share/fonts/woff2/
+    shopt -s extglob dotglob
+    rm -rf $out/!(share)
+    shopt -u extglob dotglob
   '';
-  sha256 = "sha256-rfDb9meTF0Y0kiCQd11SgnntQnw34Ti/IXn35xaPO1M=";
+  sha256 = "sha256-l60LRXLwLh+7Ls3kMTJ5eDTVpVMcqtshMv/ehIk8fCk=";
 
   meta = with lib; {
-    description = "4600+ Material Design Icons from the Community";
+    description = "7000+ Material Design Icons from the Community";
     longDescription = ''
       Material Design Icons' growing icon collection allows designers and
       developers targeting various platforms to download icons in the format,
diff --git a/pkgs/data/icons/simp1e-cursors/default.nix b/pkgs/data/icons/simp1e-cursors/default.nix
new file mode 100644
index 00000000000..962f4ea2618
--- /dev/null
+++ b/pkgs/data/icons/simp1e-cursors/default.nix
@@ -0,0 +1,42 @@
+{ lib, stdenvNoCC, fetchFromGitLab, python3, librsvg, xcursorgen }:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "simp1e-cursors";
+  version = "20221103.2";
+
+  src = fetchFromGitLab {
+    owner = "cursors";
+    repo = "simp1e";
+    rev = version;
+    sha256 = "sha256-3DCF6TwxWwYK5pF2Ykr3OwF76H7J03vLNZch/XoZZZk=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    (python3.withPackages (ps: with ps; [ pillow ]))
+    librsvg
+    xcursorgen
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+    patchShebangs ./build.sh ./cursor-generator
+    HOME=$TMP ./build.sh
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    install -dm 755 $out/share/icons
+    cp -r built_themes/* $out/share/icons/
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "An aesthetic cursor theme for Linux desktops";
+    homepage = "https://gitlab.com/cursors/simp1e";
+    license = licenses.gpl3;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ natto1784 ];
+  };
+}
diff --git a/pkgs/data/misc/v2ray-geoip/default.nix b/pkgs/data/misc/v2ray-geoip/default.nix
index a92bfec486c..bbd994d6136 100644
--- a/pkgs/data/misc/v2ray-geoip/default.nix
+++ b/pkgs/data/misc/v2ray-geoip/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "v2ray-geoip";
-  version = "202211240054";
+  version = "202212010055";
 
   src = fetchFromGitHub {
     owner = "v2fly";
     repo = "geoip";
-    rev = "1887d855ed4b4b92999d3afecf71f43358029369";
-    sha256 = "sha256-WozqLA/akUF7T0LyR/nQkTxuZPNCpYarOQG5zQwGAMk=";
+    rev = "350625ecfeec1300d541cc618fddb1922d5d2365";
+    sha256 = "sha256-EnqINoG6nB1m1K7mp0UBW3K2MDuaE7Z84wfCJBFwweU=";
   };
 
   installPhase = ''
diff --git a/pkgs/desktops/cinnamon/mint-artwork/default.nix b/pkgs/desktops/cinnamon/mint-artwork/default.nix
index fab1c48578f..490c4fa068f 100644
--- a/pkgs/desktops/cinnamon/mint-artwork/default.nix
+++ b/pkgs/desktops/cinnamon/mint-artwork/default.nix
@@ -7,14 +7,14 @@
 
 stdenv.mkDerivation rec {
   pname = "mint-artwork";
-  version = "1.7.2";
+  version = "1.7.3";
 
   src = fetchurl {
     urls = [
       "http://packages.linuxmint.com/pool/main/m/mint-artwork/mint-artwork_${version}.tar.xz"
-      "https://web.archive.org/web/20221203023403/http://packages.linuxmint.com/pool/main/m/mint-artwork/mint-artwork_${version}.tar.xz"
+      "https://web.archive.org/web/20221206154838/http://packages.linuxmint.com/pool/main/m/mint-artwork/mint-artwork_${version}.tar.xz"
     ];
-    hash = "sha256-I8gLWwwuXZkgc5zZ9QVkSarugcNWLFIz2mU1d4QqJRU=";
+    hash = "sha256-lusYlmTL71VTGSJFssuIZVu7xJMuZQ7wj2rMtO1lhZ8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/gnome/apps/gedit/default.nix b/pkgs/desktops/gnome/apps/gedit/default.nix
index 7ab30f8aafe..d7895df784b 100644
--- a/pkgs/desktops/gnome/apps/gedit/default.nix
+++ b/pkgs/desktops/gnome/apps/gedit/default.nix
@@ -28,13 +28,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gedit";
-  version = "43.1";
+  version = "43.2";
 
   outputs = [ "out" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gedit/${lib.versions.major version}/gedit-${version}.tar.xz";
-    sha256 = "mDg7Sv0/0eoYzcdP7G4SjneFgvOyP1NgGRQT//jw5qY=";
+    sha256 = "+VDS01xZS7bI28n1RAytd4jKCoaI4rB4Rvg96aTj/CU=";
   };
 
   patches = [
diff --git a/pkgs/desktops/gnome/apps/gnome-characters/default.nix b/pkgs/desktops/gnome/apps/gnome-characters/default.nix
index 9dc7d113571..5617272acc3 100644
--- a/pkgs/desktops/gnome/apps/gnome-characters/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-characters/default.nix
@@ -23,11 +23,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-characters";
-  version = "43.0";
+  version = "43.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-characters/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "poW5y/k1Re05EWjEHJ2L+DeFq7+0iWdYJ+5zQkcbqsg=";
+    sha256 = "sj4V2VCXizY8gaRyYe4aO0fbPGaX7haf8hPuplcqeEE=";
   };
 
   patches = [
diff --git a/pkgs/desktops/gnome/apps/gnome-maps/default.nix b/pkgs/desktops/gnome/apps/gnome-maps/default.nix
index 99d4d27ef66..dea63dd14d0 100644
--- a/pkgs/desktops/gnome/apps/gnome-maps/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-maps/default.nix
@@ -28,11 +28,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-maps";
-  version = "43.1";
+  version = "43.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-H3UaNb1YmteT9bFBNfKT5OxtSywwcz/sdgxofY8UMSY=";
+    sha256 = "sha256-wCIdJQvkXqNulxrmO/3pcaRhRclnscZZ6WxbBypxVR0=";
   };
 
   doCheck = true;
diff --git a/pkgs/desktops/gnome/core/evolution-data-server/default.nix b/pkgs/desktops/gnome/core/evolution-data-server/default.nix
index 726333d1f74..3b0a5caa59f 100644
--- a/pkgs/desktops/gnome/core/evolution-data-server/default.nix
+++ b/pkgs/desktops/gnome/core/evolution-data-server/default.nix
@@ -49,13 +49,13 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution-data-server";
-  version = "3.46.1";
+  version = "3.46.2";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution-data-server/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "xV5yz/QZC0LmPdbqvG3OSKGh95BAUx8a9tUcHvpKpus=";
+    sha256 = "+b1SAIt+U12BaSDPzscKDlViveKK9x+ZbiA/9qhuRuA=";
   };
 
   patches = [
diff --git a/pkgs/desktops/gnome/core/evolution-data-server/hardcode-gsettings.patch b/pkgs/desktops/gnome/core/evolution-data-server/hardcode-gsettings.patch
index 20a94cc7079..1774717affe 100644
--- a/pkgs/desktops/gnome/core/evolution-data-server/hardcode-gsettings.patch
+++ b/pkgs/desktops/gnome/core/evolution-data-server/hardcode-gsettings.patch
@@ -298,10 +298,10 @@ index e61160c..b6553a4 100644
  		G_CALLBACK (mi_user_headers_settings_changed_cb), NULL);
  	G_UNLOCK (mi_user_headers);
 diff --git a/src/camel/providers/imapx/camel-imapx-server.c b/src/camel/providers/imapx/camel-imapx-server.c
-index e5645e2..96a1ce3 100644
+index 611d5c8..4790fca 100644
 --- a/src/camel/providers/imapx/camel-imapx-server.c
 +++ b/src/camel/providers/imapx/camel-imapx-server.c
-@@ -5573,7 +5573,18 @@ camel_imapx_server_skip_old_flags_update (CamelStore *store)
+@@ -5593,7 +5593,18 @@ camel_imapx_server_skip_old_flags_update (CamelStore *store)
  	if (!skip_old_flags_update) {
  		GSettings *eds_settings;
  
diff --git a/pkgs/desktops/gnome/core/gnome-initial-setup/default.nix b/pkgs/desktops/gnome/core/gnome-initial-setup/default.nix
index f1d63a78df1..0bfa9226e0d 100644
--- a/pkgs/desktops/gnome/core/gnome-initial-setup/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-initial-setup/default.nix
@@ -38,11 +38,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-initial-setup";
-  version = "43.1";
+  version = "43.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "gQTnBD75uY4rULKrOP2gX9BDf4xVVp+haDC3vle+DfY=";
+    sha256 = "I9eWOlTUlZRQTQ6s2FCWyvtfhvHnSljgQGdbbnmK5pg=";
   };
 
   patches = [
diff --git a/pkgs/desktops/gnome/core/gnome-remote-desktop/default.nix b/pkgs/desktops/gnome/core/gnome-remote-desktop/default.nix
index daf0e8f4fcd..251d0af37f8 100644
--- a/pkgs/desktops/gnome/core/gnome-remote-desktop/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-remote-desktop/default.nix
@@ -30,11 +30,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-remote-desktop";
-  version = "43.1";
+  version = "43.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    hash = "sha256-vYR8PKdzYJlTNEYs1GnkWhJHnxHAxI6WUCjtXLgHpbI=";
+    hash = "sha256-hKn9Zam62M73NIL9otIKzRIvC4Uhsd6GyUE4ibn6l3E=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/gnome/core/gnome-shell/default.nix b/pkgs/desktops/gnome/core/gnome-shell/default.nix
index b71b9c02d90..c13ed844c28 100644
--- a/pkgs/desktops/gnome/core/gnome-shell/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-shell/default.nix
@@ -68,13 +68,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "gnome-shell";
-  version = "43.1";
+  version = "43.2";
 
   outputs = [ "out" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-shell/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "3wREdl3vG9Cv7pYX0rWRm8ebTbhufnV6wOH3N0jsG9w=";
+    sha256 = "52/UvpNCQQ7p+9zday2Bxv8GDnyMxaDxyuanq6JdGGA=";
   };
 
   patches = [
diff --git a/pkgs/desktops/gnome/core/gnome-software/default.nix b/pkgs/desktops/gnome/core/gnome-software/default.nix
index e971d5ce929..ee15653d125 100644
--- a/pkgs/desktops/gnome/core/gnome-software/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-software/default.nix
@@ -45,11 +45,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gnome-software";
-  version = "43.1";
+  version = "43.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-software/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "wmdWie53vhHY/waq+kFsTK/EjTgRVTpz7PdkvWr/RHA=";
+    sha256 = "Iqp/CjF8dw9ouJfp5RKyy+2xgbaV/9sLZY2Zu9ZPNo0=";
   };
 
   patches = [
diff --git a/pkgs/desktops/gnome/core/gucharmap/default.nix b/pkgs/desktops/gnome/core/gucharmap/default.nix
index a98d9f2ceea..c822605cf3e 100644
--- a/pkgs/desktops/gnome/core/gucharmap/default.nix
+++ b/pkgs/desktops/gnome/core/gucharmap/default.nix
@@ -45,7 +45,7 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "gucharmap";
-  version = "15.0.1";
+  version = "15.0.2";
 
   outputs = [ "out" "lib" "dev" "devdoc" ];
 
@@ -54,7 +54,7 @@ in stdenv.mkDerivation rec {
     owner = "GNOME";
     repo = "gucharmap";
     rev = version;
-    sha256 = "sha256-uVXWgnNpPcky9N3FXkDu5oaqaEALECooFnf43Ed+zTY=";
+    sha256 = "sha256-QoHLMq3U/BvpCFKttxLo0qs2xmZ/pCqPjsgq/MMWNbo=";
   };
 
   nativeBuildInputs = [
@@ -90,7 +90,9 @@ in stdenv.mkDerivation rec {
   doCheck = true;
 
   postPatch = ''
-    patchShebangs data/meson_desktopfile.py gucharmap/gen-guch-unicode-tables.pl gucharmap/meson_compileschemas.py
+    patchShebangs \
+      data/meson_desktopfile.py \
+      gucharmap/gen-guch-unicode-tables.pl
   '';
 
   passthru = {
diff --git a/pkgs/desktops/gnome/core/mutter/default.nix b/pkgs/desktops/gnome/core/mutter/default.nix
index 3cba6b652cc..48320f7100b 100644
--- a/pkgs/desktops/gnome/core/mutter/default.nix
+++ b/pkgs/desktops/gnome/core/mutter/default.nix
@@ -49,13 +49,13 @@
 
 let self = stdenv.mkDerivation rec {
   pname = "mutter";
-  version = "43.1";
+  version = "43.2";
 
   outputs = [ "out" "dev" "man" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/mutter/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "8vCLJSeDlIpezILwDp6TWmHrv4VkhEvdkniKtEqngmQ=";
+    sha256 = "/S63B63DM8wnevhoXlzzkTXhxNeYofnQXojkU9w+u4Q=";
   };
 
   patches = [
@@ -75,13 +75,6 @@ let self = stdenv.mkDerivation rec {
       sha256 = "NYoKCRh5o1Q15c11a79Hk5tGKq/jOa+e6GpgBjPEepo=";
       revert = true;
     })
-
-    # Backport edge resistance fix (should be part of 43.2)
-    # https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/2687
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/mutter/-/commit/accf532a29ea9a1d70880dfaa1834050aa3ae7be.patch";
-      sha256 = "XAHcPGQFWfZujlqO/cvUryojPCMBBSxeIG06BesDQQw=";
-    })
   ];
 
   mesonFlags = [
diff --git a/pkgs/desktops/gnome/core/nautilus/default.nix b/pkgs/desktops/gnome/core/nautilus/default.nix
index 48cc47b5d8e..2b277f42d49 100644
--- a/pkgs/desktops/gnome/core/nautilus/default.nix
+++ b/pkgs/desktops/gnome/core/nautilus/default.nix
@@ -1,6 +1,5 @@
 { lib
 , stdenv
-, fetchpatch
 , fetchurl
 , meson
 , ninja
@@ -39,27 +38,16 @@
 
 stdenv.mkDerivation rec {
   pname = "nautilus";
-  version = "43.0";
+  version = "43.1";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "PPVPrAqKvuCQ4VVBf3sW9j6grAwmTvT1RXSvNFgBqRE=";
+    sha256 = "DaEAPAzaCKwFRqTBQ+06FpfjaCPGD6c/TS9Np3I7zK8=";
   };
 
   patches = [
-    # Switch to GTK 4 settings schema to avoid crash when GTK 3 did not manage to contaminate environment.
-    # https://gitlab.gnome.org/GNOME/nautilus/-/merge_requests/1013
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/nautilus/-/commit/96d542a0d84da4ad6915a7727642490a5c433d4a.patch";
-      sha256 = "BO/0ifRwSTDe7RV+DI3CPZg+UQezk0tbM+UidgoJRQM=";
-    })
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/nautilus/-/commit/52b4daf4396fd3b21755b3a0d1fbf85c3831c6b1.patch";
-      sha256 = "+8KCw2HZUi9UgOEUBNp4kbwqOI1qz6i0Q/wvzqTb8OA=";
-    })
-
     # Allow changing extension directory using environment variable.
     ./extension_dir.patch
 
diff --git a/pkgs/desktops/pantheon/apps/elementary-calculator/default.nix b/pkgs/desktops/pantheon/apps/elementary-calculator/default.nix
index 17b241e7a9c..ac133fa54d3 100644
--- a/pkgs/desktops/pantheon/apps/elementary-calculator/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-calculator/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "elementary-calculator";
-  version = "2.0.0";
+  version = "2.0.1";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = "calculator";
     rev = version;
-    sha256 = "sha256-NE7x5vSfwakwJJe2VGRFiYc7GCB1M6xU5945EC6Em34=";
+    sha256 = "sha256-7aKJDlpODIysrHtqtD5wfd+dULFpD+LfWsjzg3OAxkY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/pantheon/apps/elementary-camera/default.nix b/pkgs/desktops/pantheon/apps/elementary-camera/default.nix
index 9682f17a816..b967341c468 100644
--- a/pkgs/desktops/pantheon/apps/elementary-camera/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-camera/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "elementary-camera";
-  version = "6.2.0";
+  version = "6.2.1";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = "camera";
     rev = version;
-    sha256 = "sha256-866Iky0GKQv2yUJVNY1McgXGeup5WqONN3gvoOlilGU=";
+    sha256 = "sha256-ijzEMGXoH0gACem/3JaC/aOIaOQgP7Y7n48NgoDMKBk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/pantheon/apps/elementary-feedback/default.nix b/pkgs/desktops/pantheon/apps/elementary-feedback/default.nix
index 6c6113e6be9..532159cd706 100644
--- a/pkgs/desktops/pantheon/apps/elementary-feedback/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-feedback/default.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "elementary-feedback";
-  version = "6.1.1";
+  version = "6.1.2";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = "feedback";
     rev = version;
-    sha256 = "sha256-YLYHaFQAAeSt25xHF7xDJWhw+rbH9SpzoRoXaYP42jg=";
+    sha256 = "sha256-vZTc6n7SHtHTCmC/RsCibVHcj67ksbghDosHBZfOIHM=";
   };
 
   patches = [
diff --git a/pkgs/desktops/pantheon/apps/elementary-feedback/fix-metadata-path.patch b/pkgs/desktops/pantheon/apps/elementary-feedback/fix-metadata-path.patch
index 20676937e0a..cc56b7e0d03 100644
--- a/pkgs/desktops/pantheon/apps/elementary-feedback/fix-metadata-path.patch
+++ b/pkgs/desktops/pantheon/apps/elementary-feedback/fix-metadata-path.patch
@@ -1,17 +1,20 @@
 diff --git a/src/MainWindow.vala b/src/MainWindow.vala
-index 6fee9d3..b0eb28c 100644
+index 14b0701..13638a5 100644
 --- a/src/MainWindow.vala
 +++ b/src/MainWindow.vala
-@@ -89,6 +89,12 @@ public class Feedback.MainWindow : Gtk.ApplicationWindow {
+@@ -82,6 +82,7 @@ public class Feedback.MainWindow : Gtk.ApplicationWindow {
+             AppStream.PoolFlags.LOAD_FLATPAK |
+             AppStream.PoolFlags.RESOLVE_ADDONS
+         );
++        appstream_pool.add_extra_data_location ("/run/current-system/sw/share/metainfo/", AppStream.FormatStyle.METAINFO);
+ #else
+         appstream_pool.clear_metadata_locations ();
+         // flatpak's appstream files exists only inside they sandbox
+@@ -89,6 +90,7 @@ public class Feedback.MainWindow : Gtk.ApplicationWindow {
+         foreach (var app in app_entries) {
+             appstream_pool.add_metadata_location (appdata_dir.printf (app));
+         }
++        appstream_pool.add_metadata_location ("/run/current-system/sw/share/metainfo/");
  #endif
-             }
  
-+#if HAS_APPSTREAM_0_15
-+            appstream_pool.add_extra_data_location ("/run/current-system/sw/share/metainfo/", AppStream.FormatStyle.METAINFO);
-+#else
-+            appstream_pool.add_metadata_location ("/run/current-system/sw/share/metainfo/");
-+#endif
-+
-             // flatpak's appstream files exists only inside they sandbox
-             unowned var appdata_dir = "/var/lib/flatpak/app/%s/current/active/files/share/appdata";
-             foreach (var app in app_entries) {
+         try {
diff --git a/pkgs/development/androidndk-pkgs/androidndk-pkgs.nix b/pkgs/development/androidndk-pkgs/androidndk-pkgs.nix
index 2d561962041..5c04ca4a50f 100644
--- a/pkgs/development/androidndk-pkgs/androidndk-pkgs.nix
+++ b/pkgs/development/androidndk-pkgs/androidndk-pkgs.nix
@@ -49,17 +49,18 @@ let
   # targetInfo.triple is what Google thinks the toolchain should be, this is a little
   # different from what we use. We make it four parts to conform with the existing
   # standard more properly.
-  targetConfig = lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform) (stdenv.targetPlatform.config);
+  targetPrefix = lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform) (stdenv.targetPlatform.config + "-");
 in
 
 rec {
   # Misc tools
   binaries = stdenv.mkDerivation {
-    pname = "${targetConfig}-ndk-toolchain";
+    pname = "${targetPrefix}ndk-toolchain";
     inherit (androidndk) version;
     nativeBuildInputs = [ makeWrapper autoPatchelfHook ];
     propagatedBuildInputs = [ androidndk ];
     passthru = {
+      inherit targetPrefix;
       isClang = true; # clang based cc, but bintools ld
     };
     dontUnpack = true;
@@ -91,23 +92,23 @@ rec {
       ln -s $out/toolchain/bin $out/bin
       ln -s $out/toolchain/${targetInfo.triple}/bin/* $out/bin/
       for f in $out/bin/${targetInfo.triple}-*; do
-        ln -s $f ''${f/${targetInfo.triple}-/${targetConfig}-}
+        ln -s $f ''${f/${targetInfo.triple}-/${targetPrefix}}
       done
       for f in $(find $out/toolchain -type d -name ${targetInfo.triple}); do
-        ln -s $f ''${f/${targetInfo.triple}/${targetConfig}}
+        ln -s $f ''${f/${targetInfo.triple}/${targetPrefix}}
       done
 
-      rm -f $out/bin/${targetConfig}-ld
-      ln -s $out/bin/lld $out/bin/${targetConfig}-ld
+      rm -f $out/bin/${targetPrefix}ld
+      ln -s $out/bin/lld $out/bin/${targetPrefix}ld
 
       (cd $out/bin;
         for tool in llvm-*; do
-          ln -sf $tool ${targetConfig}-$(echo $tool | sed 's/llvm-//')
+          ln -sf $tool ${targetPrefix}$(echo $tool | sed 's/llvm-//')
           ln -sf $tool $(echo $tool | sed 's/llvm-//')
         done)
 
       # handle last, as llvm-as is for llvm bytecode
-      ln -sf $out/bin/${targetInfo.triple}-as $out/bin/${targetConfig}-as
+      ln -sf $out/bin/${targetInfo.triple}-as $out/bin/${targetPrefix}as
       ln -sf $out/bin/${targetInfo.triple}-as $out/bin/as
 
       patchShebangs $out/bin
@@ -131,7 +132,7 @@ rec {
       # Android needs executables linked with -pie since version 5.0
       # Use -fPIC for compilation, and link with -pie if no -shared flag used in ldflags
       echo "-target ${targetInfo.triple} -fPIC" >> $out/nix-support/cc-cflags
-      echo "-z,noexecstack -z,relro -z,now" >> $out/nix-support/cc-ldflags
+      echo "-z,noexecstack -z,relro -z,now -z,muldefs" >> $out/nix-support/cc-ldflags
       echo 'if [[ ! " $@ " =~ " -shared " ]]; then NIX_LDFLAGS_${suffixSalt}+=" -pie"; fi' >> $out/nix-support/add-flags.sh
       echo "-Xclang -mnoexecstack" >> $out/nix-support/cc-cxxflags
       if [ ${targetInfo.triple} == arm-linux-androideabi ]; then
diff --git a/pkgs/development/compilers/chicken/4/chicken.nix b/pkgs/development/compilers/chicken/4/chicken.nix
index 47625a4d5de..f33e594b7e2 100644
--- a/pkgs/development/compilers/chicken/4/chicken.nix
+++ b/pkgs/development/compilers/chicken/4/chicken.nix
@@ -31,6 +31,7 @@ stdenv.mkDerivation {
   ] ++ (lib.optionals stdenv.isDarwin [
     "XCODE_TOOL_PATH=${darwin.binutils.bintools}/bin"
     "C_COMPILER=$(CC)"
+    "POSTINSTALL_PROGRAM=install_name_tool"
   ]);
 
   # We need a bootstrap-chicken to regenerate the c-files after
diff --git a/pkgs/development/compilers/cmdstan/default.nix b/pkgs/development/compilers/cmdstan/default.nix
index 6aa30a584a8..c82fc654b47 100644
--- a/pkgs/development/compilers/cmdstan/default.nix
+++ b/pkgs/development/compilers/cmdstan/default.nix
@@ -1,14 +1,25 @@
 { lib, stdenv, fetchurl, python3, runtimeShell }:
 
-stdenv.mkDerivation rec {
-  pname = "cmdstan";
-  version = "2.31.0";
-
+let
+  # FIXME: remove conditional on future release
+  version = if stdenv.isx86_64 then "2.31.0" else "2.30.1";
   # includes stanc binaries needed to build cmdstand
-  src = fetchurl {
-    url = "https://github.com/stan-dev/cmdstan/releases/download/v${version}/cmdstan-${version}.tar.gz";
-    sha256 = "sha256-BMqRRWIC/Z7It2qkESJd9L3ycyxvA6NHiWbAvzVMzIQ=";
+  srcs = rec {
+    aarch64-linux = fetchurl {
+      url = "https://github.com/stan-dev/cmdstan/releases/download/v${version}/cmdstan-${version}-linux-arm64.tar.gz";
+      sha256 = "sha256-oj/7JHT4LZcRAHiA2KbM6pZbOe6C98Ff//cNsG9DIm8=";
+    };
+    x86_64-darwin = fetchurl {
+      url = "https://github.com/stan-dev/cmdstan/releases/download/v${version}/cmdstan-${version}.tar.gz";
+      sha256 = "sha256-BMqRRWIC/Z7It2qkESJd9L3ycyxvA6NHiWbAvzVMzIQ=";
+    };
+    x86_64-linux = x86_64-darwin;
   };
+  src = srcs.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+in
+stdenv.mkDerivation rec {
+  pname = "cmdstan";
+  inherit version src;
 
   buildFlags = [ "build" ];
   enableParallelBuilding = true;
@@ -22,6 +33,9 @@ stdenv.mkDerivation rec {
     substituteInPlace stan/lib/stan_math/make/libraries \
       --replace "/usr/bin/env bash" "bash"
     patchShebangs .
+  '' + lib.optionalString stdenv.isAarch64 ''
+    sed -z -i "s/TEST(CommandStansummary, check_console_output).*TEST(CommandStansummary, check_csv_output)/TEST(CommandStansummary, check_csv_output)/" \
+      src/test/interface/stansummary_test.cpp
   '';
 
   checkPhase = ''
@@ -41,10 +55,9 @@ stdenv.mkDerivation rec {
   '';
 
   # Hack to ensure that patchelf --shrink-rpath get rids of a $TMPDIR reference.
-  preFixup = "rm -rf $(pwd)";
+  preFixup = "rm -rf stan";
 
   meta = {
-    broken = stdenv.isLinux && stdenv.isAarch64;
     description = "Command-line interface to Stan";
     longDescription = ''
       Stan is a probabilistic programming language implementing full Bayesian
@@ -54,6 +67,6 @@ stdenv.mkDerivation rec {
     '';
     homepage = "https://mc-stan.org/interfaces/cmdstan.html";
     license = lib.licenses.bsd3;
-    platforms = lib.platforms.all;
+    platforms = [ "aarch64-linux" "x86_64-darwin" "x86_64-linux" ];
   };
 }
diff --git a/pkgs/development/compilers/go/1.18.nix b/pkgs/development/compilers/go/1.18.nix
index 7f6e2ce6ace..1bad4bba76e 100644
--- a/pkgs/development/compilers/go/1.18.nix
+++ b/pkgs/development/compilers/go/1.18.nix
@@ -45,11 +45,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.18.8";
+  version = "1.18.9";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${version}.src.tar.gz";
-    sha256 = "sha256-H3mAIwUBVHnnfYxkFTC8VOyZRlfVxSceAXLrcRg0ahI=";
+    sha256 = "sha256-++fwm5aso9tvrq8YDai7Yyho7ASXMeNV/2FpUZfA4+o=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/compilers/haxe/default.nix b/pkgs/development/compilers/haxe/default.nix
index 7a6c019c16d..58370c1a15a 100644
--- a/pkgs/development/compilers/haxe/default.nix
+++ b/pkgs/development/compilers/haxe/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, coreutils, ocaml-ng, zlib, pcre, neko, mbedtls, Security }:
+{ lib, stdenv, fetchFromGitHub, coreutils, ocaml-ng, zlib, pcre, neko, mbedtls_2, Security }:
 
 let
   ocamlDependencies = version:
@@ -42,7 +42,7 @@ let
       inherit version;
 
       buildInputs = [ zlib pcre neko ]
-        ++ lib.optional (lib.versionAtLeast version "4.1") mbedtls
+        ++ lib.optional (lib.versionAtLeast version "4.1") mbedtls_2
         ++ lib.optional (lib.versionAtLeast version "4.1" && stdenv.isDarwin) Security
         ++ ocamlDependencies version;
 
diff --git a/pkgs/development/compilers/julia/1.8.nix b/pkgs/development/compilers/julia/1.8.nix
index 1c614103bde..f975b39773d 100644
--- a/pkgs/development/compilers/julia/1.8.nix
+++ b/pkgs/development/compilers/julia/1.8.nix
@@ -15,7 +15,7 @@
 , libgit2
 , curl
 , nghttp2
-, mbedtls
+, mbedtls_2
 , libssh2
 , gmp
 , mpfr
@@ -80,7 +80,7 @@ stdenv.mkDerivation rec {
     libgit2
     curl
     nghttp2
-    mbedtls
+    mbedtls_2
     libssh2
     gmp
     mpfr
diff --git a/pkgs/development/compilers/neko/default.nix b/pkgs/development/compilers/neko/default.nix
index 96bf06e41ea..40e39d411d6 100644
--- a/pkgs/development/compilers/neko/default.nix
+++ b/pkgs/development/compilers/neko/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, fetchpatch, boehmgc, zlib, sqlite, pcre, cmake, pkg-config
-, git, apacheHttpd, apr, aprutil, libmysqlclient, mbedtls, openssl, pkgs, gtk2, libpthreadstubs
+, git, apacheHttpd, apr, aprutil, libmysqlclient, mbedtls_2, openssl, pkgs, gtk2, libpthreadstubs
 }:
 
 stdenv.mkDerivation rec {
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake pkg-config git ];
   buildInputs =
     [ boehmgc zlib sqlite pcre apacheHttpd apr aprutil
-      libmysqlclient mbedtls openssl libpthreadstubs ]
+      libmysqlclient mbedtls_2 openssl libpthreadstubs ]
       ++ lib.optional stdenv.isLinux gtk2
       ++ lib.optionals stdenv.isDarwin [ pkgs.darwin.apple_sdk.frameworks.Security
                                                 pkgs.darwin.apple_sdk.frameworks.Carbon];
diff --git a/pkgs/development/compilers/openjdk/11.nix b/pkgs/development/compilers/openjdk/11.nix
index 95abb373272..820469ab8f1 100644
--- a/pkgs/development/compilers/openjdk/11.nix
+++ b/pkgs/development/compilers/openjdk/11.nix
@@ -4,8 +4,7 @@
 , libXcursor, libXrandr, fontconfig, openjdk11-bootstrap
 , setJavaClassPath
 , headless ? false
-# disabled by default since openjfx11 depends on python2 (EOL)
-, enableJavaFX ? false, openjfx
+, enableJavaFX ? openjfx.meta.available, openjfx
 , enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
 }:
 
diff --git a/pkgs/development/compilers/openjdk/12.nix b/pkgs/development/compilers/openjdk/12.nix
index 60100a5ecc1..a8de9fe43ff 100644
--- a/pkgs/development/compilers/openjdk/12.nix
+++ b/pkgs/development/compilers/openjdk/12.nix
@@ -4,8 +4,7 @@
 , libXcursor, libXrandr, fontconfig, openjdk11, fetchpatch
 , setJavaClassPath
 , headless ? false
-# disabled by default since openjfx11 depends on python2 (EOL)
-, enableJavaFX ? false, openjfx
+, enableJavaFX ? openjfx.meta.available, openjfx
 , enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
 }:
 
diff --git a/pkgs/development/compilers/openjdk/13.nix b/pkgs/development/compilers/openjdk/13.nix
index 68a0a9fa700..5b7e87b0ef3 100644
--- a/pkgs/development/compilers/openjdk/13.nix
+++ b/pkgs/development/compilers/openjdk/13.nix
@@ -4,8 +4,7 @@
 , libXcursor, libXrandr, fontconfig, openjdk13-bootstrap, fetchpatch
 , setJavaClassPath
 , headless ? false
-# disabled by default since openjfx11 depends on python2 (EOL)
-, enableJavaFX ? false, openjfx
+, enableJavaFX ? openjfx.meta.available, openjfx
 , enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
 }:
 
diff --git a/pkgs/development/compilers/openjdk/14.nix b/pkgs/development/compilers/openjdk/14.nix
index 37c3a6a3de3..1381b0995a7 100644
--- a/pkgs/development/compilers/openjdk/14.nix
+++ b/pkgs/development/compilers/openjdk/14.nix
@@ -4,8 +4,7 @@
 , libXcursor, libXrandr, fontconfig, openjdk14-bootstrap
 , setJavaClassPath
 , headless ? false
-# disabled by default since openjfx11 depends on python2 (EOL)
-, enableJavaFX ? false, openjfx
+, enableJavaFX ? openjfx.meta.available, openjfx
 , enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
 }:
 
diff --git a/pkgs/development/compilers/openjdk/openjfx/11.nix b/pkgs/development/compilers/openjdk/openjfx/11.nix
index f67c1828913..1bbb4e42dbc 100644
--- a/pkgs/development/compilers/openjdk/openjfx/11.nix
+++ b/pkgs/development/compilers/openjdk/openjfx/11.nix
@@ -1,26 +1,36 @@
 { stdenv, lib, fetchurl, writeText, gradle_4, pkg-config, perl, cmake
-, gperf, gtk2, gtk3, libXtst, libXxf86vm, glib, alsa-lib, ffmpeg_4-headless, python2, ruby
+, gperf, gtk2, gtk3, libXtst, libXxf86vm, glib, alsa-lib, ffmpeg_4-headless, python3, ruby
 , openjdk11-bootstrap }:
 
 let
   major = "11";
-  update = ".0.3";
+  update = ".0.11";
   build = "1";
   repover = "${major}${update}+${build}";
   gradle_ = (gradle_4.override {
     java = openjdk11-bootstrap;
   });
 
+  NIX_CFLAGS_COMPILE = [
+    # avoids errors about deprecation of GTypeDebugFlags, GTimeVal, etc.
+    "-DGLIB_DISABLE_DEPRECATION_WARNINGS"
+    # glib-2.62 deprecations
+    # -fcommon: gstreamer workaround for -fno-common toolchains:
+    #   ld: gsttypefindelement.o:(.bss._gst_disable_registry_cache+0x0): multiple definition of
+    #     `_gst_disable_registry_cache'; gst.o:(.bss._gst_disable_registry_cache+0x0): first defined here
+    "-fcommon"
+  ];
+
   makePackage = args: stdenv.mkDerivation ({
     version = "${major}${update}-${build}";
 
     src = fetchurl {
-      url = "https://hg.openjdk.java.net/openjfx/${major}/rt/archive/${repover}.tar.gz";
-      sha256 = "1h7qsylr7rnwnbimqjyn3whszp9kv4h3gpicsrb3mradxc9yv194";
+      url = "https://hg.openjdk.java.net/openjfx/${major}-dev/rt/archive/${repover}.tar.gz";
+      sha256 = "sha256-mbEALUxuwbtlGeZ2Xsm3m3aNDdthLYWd6QHmdkAILxc=";
     };
 
     buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4-headless ];
-    nativeBuildInputs = [ gradle_ perl pkg-config cmake gperf python2 ruby ];
+    nativeBuildInputs = [ gradle_ perl pkg-config cmake gperf python3 ruby ];
 
     dontUseCmakeConfigure = true;
 
@@ -34,8 +44,7 @@ let
       JDK_HOME = ${openjdk11-bootstrap.home}
     '' + args.gradleProperties or "");
 
-    #avoids errors about deprecation of GTypeDebugFlags, GTimeVal, etc.
-    NIX_CFLAGS_COMPILE = [ "-DGLIB_DISABLE_DEPRECATION_WARNINGS" ];
+    inherit NIX_CFLAGS_COMPILE;
 
     buildPhase = ''
       runHook preBuild
@@ -67,8 +76,7 @@ let
     outputHashMode = "recursive";
     # Downloaded AWT jars differ by platform.
     outputHash = {
-      i686-linux = "0mjlyf6jvbis7nrm5d394sjv4hjw6k3753hr1nwdxk8skwc3ry08";
-      x86_64-linux = "0d4msxswdav1xsfkpr0qd3xgqkcbxzf47v1zdy5jmg5w4bs6a78a";
+      x86_64-linux = "sha256-syceJMUEknBDCHK8eGs6rUU3IQn+HnQfURfCrDxYPa8=";
     }.${stdenv.system} or (throw "Unsupported platform");
   };
 
@@ -91,11 +99,7 @@ in makePackage {
     cp -r build/modular-sdk $out
   '';
 
-  # glib-2.62 deprecations
-  # -fcommon: gstreamer workaround for -fno-common toolchains:
-  #   ld: gsttypefindelement.o:(.bss._gst_disable_registry_cache+0x0): multiple definition of
-  #     `_gst_disable_registry_cache'; gst.o:(.bss._gst_disable_registry_cache+0x0): first defined here
-  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS -fcommon";
+  inherit NIX_CFLAGS_COMPILE;
 
   stripDebugList = [ "." ];
 
@@ -105,6 +109,9 @@ in makePackage {
       new_refs="$(patchelf --print-rpath "$lib" | sed -E 's,:?${openjdk11-bootstrap}[^:]*,,')"
       patchelf --set-rpath "$new_refs" "$lib"
     done
+
+    # Remove licenses, otherwise they may conflict with the ones included in the openjdk
+    rm -rf $out/modules_legal/*
   '';
 
   disallowedReferences = [ openjdk11-bootstrap ];
@@ -119,6 +126,6 @@ in makePackage {
     license = licenses.gpl2;
     description = "The next-generation Java client toolkit";
     maintainers = with maintainers; [ abbradar ];
-    platforms = [ "i686-linux" "x86_64-linux" ];
+    platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/pkgs/development/compilers/openjdk/openjfx/15.nix b/pkgs/development/compilers/openjdk/openjfx/15.nix
index 4ffe8abd47b..d2903c685a9 100644
--- a/pkgs/development/compilers/openjdk/openjfx/15.nix
+++ b/pkgs/development/compilers/openjdk/openjfx/15.nix
@@ -72,7 +72,6 @@ let
     # Downloaded AWT jars differ by platform.
     outputHash = {
       x86_64-linux = "0hmyr5nnjgwyw3fcwqf0crqg9lny27jfirycg3xmkzbcrwqd6qkw";
-      i686-linux = "0hx69p2z96p7jbyq4r20jykkb8gx6r8q2cj7m30pldlsw3650bqx";
     }.${stdenv.system} or (throw "Unsupported platform");
   };
 
@@ -121,6 +120,6 @@ in makePackage {
     license = licenses.gpl2;
     description = "The next-generation Java client toolkit";
     maintainers = with maintainers; [ abbradar ];
-    platforms = [ "i686-linux" "x86_64-linux" ];
+    platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/pkgs/development/embedded/jtag-remote-server/default.nix b/pkgs/development/embedded/jtag-remote-server/default.nix
index bcfba506a00..4a2c9c3df3d 100644
--- a/pkgs/development/embedded/jtag-remote-server/default.nix
+++ b/pkgs/development/embedded/jtag-remote-server/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "jtag-remote-server";
-  version = "unstable-2022-06-09";
+  version = "1.2";
 
   src = fetchFromGitHub {
     owner = "jiegec";
     repo = pname;
-    rev = "917d8d298423ba1aa6e75aa92e009b7f27f74a57";
-    hash = "sha256-Jy0OyRgn9SYpjP3HYWPvRirfxXk4/vMYvZuI3XpPtBw=";
+    rev = "v${version}";
+    hash = "sha256-qtgO0BO2hvWi/E2RzGTTuQynKbh7/OLeoLcm60dqro8=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/development/embedded/nmrpflash/default.nix b/pkgs/development/embedded/nmrpflash/default.nix
index a05170b1bd8..76c8902f590 100644
--- a/pkgs/development/embedded/nmrpflash/default.nix
+++ b/pkgs/development/embedded/nmrpflash/default.nix
@@ -9,13 +9,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "nmrpflash";
-  version = "0.9.18.2";
+  version = "0.9.19";
 
   src = fetchFromGitHub {
     owner  = "jclehner";
     repo   = "nmrpflash";
     rev    = "v${version}";
-    sha256 = "sha256-hKE9FEBkbN39zBRSoy3Ntq/fziizskJXNBcwQZX9igE=";
+    sha256 = "sha256-bXxJiIbMk8JG0nbWOgINUAb8zaGBN3XUdA3JZev4Igs=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/development/interpreters/hashlink/default.nix b/pkgs/development/interpreters/hashlink/default.nix
index 1af48cba55a..e24742ac136 100644
--- a/pkgs/development/interpreters/hashlink/default.nix
+++ b/pkgs/development/interpreters/hashlink/default.nix
@@ -7,7 +7,7 @@
 , libjpeg_turbo
 , libuv
 , libvorbis
-, mbedtls
+, mbedtls_2
 , openal
 , pcre
 , SDL2
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
     libpng
     libuv
     libvorbis
-    mbedtls
+    mbedtls_2
     openal
     pcre
     SDL2
diff --git a/pkgs/development/interpreters/php/8.2.nix b/pkgs/development/interpreters/php/8.2.nix
index 6ea49852a40..1ac48d7f057 100644
--- a/pkgs/development/interpreters/php/8.2.nix
+++ b/pkgs/development/interpreters/php/8.2.nix
@@ -1,17 +1,9 @@
 { callPackage, lib, stdenv, fetchurl, ... }@_args:
 
 let
-  hash = "sha256-MSBENMUl+F5k9manZvYjRDY3YWsYToZSQU9hmhJ8Xvc=";
-
   base = callPackage ./generic.nix (_args // {
     version = "8.2.0";
-    phpAttrsOverrides = attrs: attrs // {
-      src = fetchurl {
-        url = "https://downloads.php.net/~pierrick/php-8.2.0RC7.tar.xz";
-        inherit hash;
-      };
-    };
-    inherit hash;
+    hash = "sha256-G/T8pmP5PZ4LSQm9bq4Fg6HOOD5/Bd8Sbyjycvof1Ro=";
   });
 
 in
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index fb6bffd2594..5dca71f7eef 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -486,7 +486,15 @@ in with passthru; stdenv.mkDerivation {
   enableParallelBuilding = true;
 
   meta = {
-    homepage = "http://python.org";
+    homepage = "https://www.python.org";
+    changelog = let
+      majorMinor = lib.versions.majorMinor version;
+      dashedVersion = lib.replaceStrings [ "." "a" ] [ "-" "-alpha-" ] version;
+    in
+      if sourceVersion.suffix == "" then
+        "https://docs.python.org/release/${version}/whatsnew/changelog.html"
+      else
+        "https://docs.python.org/${majorMinor}/whatsnew/changelog.html#python-${dashedVersion}";
     description = "A high-level dynamically-typed programming language";
     longDescription = ''
       Python is a remarkably powerful dynamic programming language that
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index 307b2521b75..18282bc6d26 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -156,10 +156,10 @@ in {
     sourceVersion = {
       major = "3";
       minor = "7";
-      patch = "15";
+      patch = "16";
       suffix = "";
     };
-    sha256 = "sha256-WRFHWgesK1PXRuiKBxavbStHNJQZGRNuoNM/ucdblxQ=";
+    sha256 = "sha256-gzjwwiIthH6QTJVTaRVdwb7u7YBujV7wSwDvR4cji/0=";
     inherit (darwin) configd;
     inherit passthruFun;
   };
@@ -169,10 +169,10 @@ in {
     sourceVersion = {
       major = "3";
       minor = "8";
-      patch = "15";
+      patch = "16";
       suffix = "";
     };
-    sha256 = "sha256-URT8eRiipeIOtarGlrMMNvQSxu8ksT9cnrngVpgtlVA=";
+    sha256 = "sha256-2F27N3QTJHPYCB3LFY80oQzK16kLlsflDqS7YfXORWI=";
     inherit (darwin) configd;
     inherit passthruFun;
   };
@@ -194,10 +194,10 @@ in {
     sourceVersion = {
       major = "3";
       minor = "11";
-      patch = "0";
+      patch = "1";
       suffix = "";
     };
-    sha256 = "sha256-pX3ILXc1hhe6ZbmEHO4eO0QfOGw3id3AZ27KB38pUcM=";
+    sha256 = "sha256-hYeRkvLP/VbLFsCSkFlJ6/Pl45S392RyNSljeQHftY8=";
     inherit (darwin) configd;
     inherit passthruFun;
   };
diff --git a/pkgs/development/interpreters/wasmtime/default.nix b/pkgs/development/interpreters/wasmtime/default.nix
index 4feefd2be02..dc9e93b0450 100644
--- a/pkgs/development/interpreters/wasmtime/default.nix
+++ b/pkgs/development/interpreters/wasmtime/default.nix
@@ -2,17 +2,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wasmtime";
-  version = "3.0.0";
+  version = "3.0.1";
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-DDgt7NjTNiqSq8+yC7bjlpKvWt36ybRCGByx07N4hC8=";
+    sha256 = "sha256-DJEX/BoiabAQKRKyXuefCoJouFKZ3sAnCQDsHmNC/t8=";
     fetchSubmodules = true;
   };
 
-  cargoSha256 = "sha256-xYOSMWPGLI6xnYhAZDM+MvD/zI0hsoqie86SUGn2EDI=";
+  cargoSha256 = "sha256-L+VozBK1RJGg2F51Aeau8jH1XM5IfR7qkhb7iXmQXE4=";
 
   cargoBuildFlags = [
     "--package wasmtime-cli"
diff --git a/pkgs/development/libraries/amtk/default.nix b/pkgs/development/libraries/amtk/default.nix
index 0dff9031353..74f83a30a50 100644
--- a/pkgs/development/libraries/amtk/default.nix
+++ b/pkgs/development/libraries/amtk/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "amtk";
-  version = "5.6.0";
+  version = "5.6.1";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "89uHl0Qqm4UGKs0LPheskSWgtIfhQhbQmwOwiEGCDrk=";
+    sha256 = "1QEVuFyHKqwpaTS17nJqP6FWxvWtltJ+Dt0Kpa0XMig=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/arrow-cpp/default.nix b/pkgs/development/libraries/arrow-cpp/default.nix
index 2ce613c7853..81e5763aa3e 100644
--- a/pkgs/development/libraries/arrow-cpp/default.nix
+++ b/pkgs/development/libraries/arrow-cpp/default.nix
@@ -205,7 +205,8 @@ stdenv.mkDerivation rec {
   ] ++ lib.optionals stdenv.isDarwin [
     "-DCMAKE_INSTALL_RPATH=@loader_path/../lib" # needed for tools executables
   ] ++ lib.optional (!stdenv.isx86_64) "-DARROW_USE_SIMD=OFF"
-  ++ lib.optional enableS3 "-DAWSSDK_CORE_HEADER_FILE=${aws-sdk-cpp}/include/aws/core/Aws.h";
+  ++ lib.optional enableS3 "-DAWSSDK_CORE_HEADER_FILE=${aws-sdk-cpp}/include/aws/core/Aws.h"
+  ++ lib.optionals enableGcs [ "-DCMAKE_CXX_STANDARD=17" ];
 
   doInstallCheck = true;
   ARROW_TEST_DATA = lib.optionalString doInstallCheck "${arrow-testing}/data";
diff --git a/pkgs/development/libraries/audio/suil/default.nix b/pkgs/development/libraries/audio/suil/default.nix
index ac10472e014..3dc3bb5dacd 100644
--- a/pkgs/development/libraries/audio/suil/default.nix
+++ b/pkgs/development/libraries/audio/suil/default.nix
@@ -1,16 +1,11 @@
 { stdenv, lib, fetchurl, gtk2, lv2, pkg-config, python3, serd, sord, sratom
 , wafHook
-, withQt4 ? true, qt4 ? null
-, withQt5 ? false, qt5 ? null }:
-
-# I haven't found an XOR operator in nix...
-assert withQt4 || withQt5;
-assert !(withQt4 && withQt5);
+, withQt5 ? true, qt5 ? null
+}:
 
 stdenv.mkDerivation rec {
   pname = "suil";
   version = "0.10.6";
-  name = "${pname}-qt${if withQt4 then "4" else "5"}-${version}";
 
   src = fetchurl {
     url = "https://download.drobilla.net/${pname}-${version}.tar.bz2";
@@ -19,8 +14,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config wafHook python3 ];
   buildInputs = [ gtk2 lv2 serd sord sratom ]
-    ++ (lib.optionals withQt4 [ qt4 ])
-    ++ (lib.optionals withQt5 (with qt5; [ qtbase qttools ]));
+    ++ lib.optionals withQt5 (with qt5; [ qtbase qttools ]);
 
   dontWrapQtApps = true;
 
diff --git a/pkgs/development/libraries/aws-c-s3/default.nix b/pkgs/development/libraries/aws-c-s3/default.nix
index 0692c5ef7ab..19ad8053c19 100644
--- a/pkgs/development/libraries/aws-c-s3/default.nix
+++ b/pkgs/development/libraries/aws-c-s3/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-s3";
-  version = "0.1.51";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-s3";
     rev = "v${version}";
-    sha256 = "sha256-10SDOl0XoALdSxJWHDLDkvX7rArUQKXjjXfAECFy/Vw=";
+    sha256 = "sha256-tFweXB610Ua8+x05rg+rOqh9QPhXjpvvzGf8EVVIHks=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/bctoolbox/default.nix b/pkgs/development/libraries/bctoolbox/default.nix
index 6c1c2cdefb9..2bc457cac18 100644
--- a/pkgs/development/libraries/bctoolbox/default.nix
+++ b/pkgs/development/libraries/bctoolbox/default.nix
@@ -2,7 +2,7 @@
 , cmake
 , bc-decaf
 , fetchFromGitLab
-, mbedtls
+, mbedtls_2
 , lib
 , stdenv
 }:
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     # Vendored by BC
     bc-decaf
 
-    mbedtls
+    mbedtls_2
   ];
 
   src = fetchFromGitLab {
diff --git a/pkgs/development/libraries/belle-sip/default.nix b/pkgs/development/libraries/belle-sip/default.nix
index 22817feaded..187264caed1 100644
--- a/pkgs/development/libraries/belle-sip/default.nix
+++ b/pkgs/development/libraries/belle-sip/default.nix
@@ -4,7 +4,7 @@
 , fetchFromGitLab
 , lib
 , libantlr3c
-, mbedtls
+, mbedtls_2
 , stdenv
 , zlib
 }:
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
     "-Wno-error=stringop-overflow"
   ];
 
-  propagatedBuildInputs = [ libantlr3c mbedtls bctoolbox belr ];
+  propagatedBuildInputs = [ libantlr3c mbedtls_2 bctoolbox belr ];
 
   meta = with lib; {
     homepage = "https://linphone.org/technical-corner/belle-sip";
diff --git a/pkgs/development/libraries/fancypp/default.nix b/pkgs/development/libraries/fancypp/default.nix
new file mode 100644
index 00000000000..f93ab77c63d
--- /dev/null
+++ b/pkgs/development/libraries/fancypp/default.nix
@@ -0,0 +1,31 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "fancypp";
+  version = "unstable-2021-04-08";
+
+  src = fetchFromGitHub {
+    owner = "Curve";
+    repo = "fancypp";
+    rev = "ede7f712a08f7c66ff4a5590ad94a477c48850a5";
+    sha256 = "sha256-E2JsQnvrqrZFYo+xBJr7xDCoPnRQftqUjjBpZzFvIic=";
+  };
+
+  # Header-only library.
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir "$out"
+    cp -r include "$out"
+  '';
+
+  meta = with lib; {
+    description = "Tiny C++ Library for terminal colors and more!";
+    homepage = "https://github.com/Curve/fancypp";
+    maintainers = with maintainers; [ aidalgol ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/development/libraries/fox/clang.patch b/pkgs/development/libraries/fox/clang.patch
deleted file mode 100644
index 0ca2ebf0d8d..00000000000
--- a/pkgs/development/libraries/fox/clang.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/src/FXReactor.cpp b/src/FXReactor.cpp
-index 1ecdb45..9058a30 100644
---- a/src/FXReactor.cpp
-+++ b/src/FXReactor.cpp
-@@ -452,7 +452,7 @@ FXint FXReactor::processActiveHandles(FXTime block,FXuint flags){
-     }
- 
-   // Normal case
--  if(0<=hand){
-+  if(0==hand){
- 
-     // Any handles active?
-     if(0<nhand){
diff --git a/pkgs/development/libraries/fox/default.nix b/pkgs/development/libraries/fox/default.nix
index 2eda944048a..49526b99c53 100644
--- a/pkgs/development/libraries/fox/default.nix
+++ b/pkgs/development/libraries/fox/default.nix
@@ -1,30 +1,31 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
 , libpng
 , libjpeg
 , libtiff
 , zlib
 , bzip2
+, libGL
+, libGLU
 , libXcursor
 , libXext
 , libXrandr
 , libXft
-, CoreServices ? null
+, CoreServices
 }:
 
 stdenv.mkDerivation rec {
   pname = "fox";
-  version = "1.7.9";
+  version = "1.7.81";
 
   src = fetchurl {
-    url = "ftp://ftp.fox-toolkit.org/pub/${pname}-${version}.tar.gz";
-    sha256 = "1jb9368xsin3ppdf6979n5s7in3s9klbxqbwcp0z8misjixl7nzg";
+    url = "http://fox-toolkit.org/ftp/${pname}-${version}.tar.gz";
+    sha256 = "sha256-bu+IEqNkv9OAf96dPYre3CP759pjalVIbYyc3QSQW2w=";
   };
 
-  patches = [ ./clang.patch ];
-
-  buildInputs = [ libpng libjpeg libtiff zlib bzip2 libXcursor libXext libXrandr libXft ]
+  buildInputs = [ libpng libjpeg libtiff zlib bzip2 libGL libGLU libXcursor libXext libXrandr libXft ]
     ++ lib.optional stdenv.isDarwin CoreServices;
 
   doCheck = true;
@@ -42,9 +43,8 @@ stdenv.mkDerivation rec {
       Current aims are to make FOX completely platform independent, and thus programs written against the FOX library will be only a compile away from running on a variety of platforms.
     '';
     homepage = "http://fox-toolkit.org";
-    license = licenses.lgpl3;
+    license = licenses.lgpl3Plus;
     maintainers = [];
-    broken = stdenv.isDarwin && stdenv.isAarch64;
     platforms = platforms.all;
   };
 }
diff --git a/pkgs/development/libraries/google-cloud-cpp/default.nix b/pkgs/development/libraries/google-cloud-cpp/default.nix
index fb2929a72f1..3ffaedb6b72 100644
--- a/pkgs/development/libraries/google-cloud-cpp/default.nix
+++ b/pkgs/development/libraries/google-cloud-cpp/default.nix
@@ -18,37 +18,31 @@
 , staticOnly ? stdenv.hostPlatform.isStatic
 }:
 let
-  googleapisRev = "d4f3468ef85278428005ed555b3a85db91551ee6";
+  googleapisRev = "13d5b3f3f9412f38427c8ad48068f04ad1ee9808";
   googleapis = fetchFromGitHub {
+    name = "googleapis-src";
     owner = "googleapis";
     repo = "googleapis";
     rev = googleapisRev;
-    hash = "sha256-sIQVFQhE3Ae6ia45apzdgtwzglMM4hFZ8efNAhMO5ZY=";
+    hash = "sha256-SiU7N1EQ/7LWhUwgf4c0CBfUzNGiLe4sSbbJmJF3sao=";
   };
   excludedTests = builtins.fromTOML (builtins.readFile ./skipped_tests.toml);
 in
 stdenv.mkDerivation rec {
   pname = "google-cloud-cpp";
-  version = "1.38.0";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "googleapis";
     repo = "google-cloud-cpp";
     rev = "v${version}";
-    sha256 = "sha256-kobOkohWIDTQaaihhoh/25tZUNv+CjKFwj2xQqO52bA=";
+    sha256 = "sha256-o8aURM8fvxn0FZjuqJGclq9Brss8LOFZzD0FV2j/lUc=";
   };
 
   postPatch = ''
     substituteInPlace external/googleapis/CMakeLists.txt \
-      --replace "https://github.com/googleapis/googleapis/archive/\''${GOOGLE_CLOUD_CPP_GOOGLEAPIS_COMMIT_SHA}.tar.gz" "file://${googleapis}"
-
-    # https://github.com/googleapis/google-cloud-cpp/issues/8992
-    for file in external/googleapis/config.pc.in google/cloud/{,*/}config.pc.in; do
-      substituteInPlace "$file" \
-        --replace '$'{prefix}/@CMAKE_INSTALL_LIBDIR@ @CMAKE_INSTALL_FULL_LIBDIR@ \
-        --replace '$'{prefix}/@CMAKE_INSTALL_INCLUDEDIR@ @CMAKE_INSTALL_FULL_INCLUDEDIR@ \
-        --replace '$'{prefix}/@CMAKE_INSTALL_BINDIR@ @CMAKE_INSTALL_FULL_BINDIR@
-    done
+      --replace "https://github.com/googleapis/googleapis/archive/\''${_GOOGLE_CLOUD_CPP_GOOGLEAPIS_COMMIT_SHA}.tar.gz" "file://${googleapis}"
+    sed -i '/https:\/\/storage.googleapis.com\/cloud-cpp-community-archive\/com_google_googleapis/d' external/googleapis/CMakeLists.txt
   '';
 
   nativeBuildInputs = [
@@ -123,6 +117,7 @@ stdenv.mkDerivation rec {
     # this adds a good chunk of time to the build
     "-DBUILD_TESTING:BOOL=ON"
     "-DGOOGLE_CLOUD_CPP_ENABLE_EXAMPLES:BOOL=OFF"
+    "-DCMAKE_CXX_STANDARD=17"
   ] ++ lib.optionals (apis != [ "*" ]) [
     "-DGOOGLE_CLOUD_CPP_ENABLE=${lib.concatStringsSep ";" apis}"
   ];
diff --git a/pkgs/development/libraries/google-cloud-cpp/skipped_tests.toml b/pkgs/development/libraries/google-cloud-cpp/skipped_tests.toml
index 8cbe766862b..71529bfb455 100644
--- a/pkgs/development/libraries/google-cloud-cpp/skipped_tests.toml
+++ b/pkgs/development/libraries/google-cloud-cpp/skipped_tests.toml
@@ -13,6 +13,7 @@ whole = [
   "bigtable_read_sync_vs_async_benchmark",
   "bigtable_scan_throughput_benchmark",
   "bigtable_table_sample_rows_integration_test",
+  "common_grpc_utils_internal_grpc_impersonate_service_account_integration_test",
   "iam_iam_credentials_integration_test",
   "iam_iam_integration_test",
   "logging_quickstart",
@@ -48,6 +49,7 @@ whole = [
   "storage_curl_request_integration_test",
   "storage_curl_resumable_upload_session_integration_test",
   "storage_curl_sign_blob_integration_test",
+  "storage_decompressive_transcoding_integration_test",
   "storage_grpc_integration_test",
   "storage_key_file_integration_test",
   "storage_minimal_iam_credentials_rest_integration_test",
@@ -84,13 +86,13 @@ whole = [
   "storage_throughput_experiment_test",
   "storage_tracing_integration_test",
   "storage_unified_credentials_integration_test",
-  "common_grpc_utils_internal_grpc_impersonate_service_account_integration_test"
 ]
 cases = [
   "BackupExtraIntegrationTest.CreateBackupWithExpiredVersionTime",
   "BackupExtraIntegrationTest.BackupWithExpiredVersionTime",
   "BackupExtraIntegrationTest.BackupWithFutureVersionTime",
   "BackupExtraIntegrationTest.CreateBackupWithFutureVersionTime",
+  "BlockingPublisherIntegrationTest.Basic",
   "DatabaseAdminClientTest.CreateWithEncryptionKey",
   "DatabaseAdminClientTest.CreateWithNonexistentEncryptionKey",
   "DatabaseAdminClientTest.DatabaseBasicCRUD",
@@ -98,12 +100,16 @@ cases = [
   "DatabaseAdminClientTest.VersionRetentionPeriodCreateFailure",
   "DatabaseAdminClientTest.VersionRetentionPeriodUpdate",
   "DatabaseAdminClientTest.VersionRetentionPeriodUpdateFailure",
+  "ErrorParsingIntegrationTest.FailureContainsErrorInfo",
+  "GrpcServiceAccountIntegrationTest.GetServiceAccount",
+  "GrpcBucketMetadataIntegrationTest.ObjectMetadataCRUD",
   "InstanceAdminClientTest.InstanceConfig",
   "InstanceAdminClientTest.InstanceIam",
   "InstanceAdminClientTest.InstanceReadOperations",
   "LoggingIntegrationTest.ListMonitoredResourceDescriptors",
   "LoggingIntegrationTest.WriteLogEntries",
   "ObjectFileMultiThreadedTest.Download",
+  "ObjectReadLargeIntegrationTest.LimitedMemoryGrowth",
   "SubscriberIntegrationTest.FireAndForget",
   "SubscriberIntegrationTest.PublishOrdered",
   "SubscriberIntegrationTest.PublishPullAck",
diff --git a/pkgs/development/libraries/grpc/default.nix b/pkgs/development/libraries/grpc/default.nix
index 56f3cf0e7ab..744f9652378 100644
--- a/pkgs/development/libraries/grpc/default.nix
+++ b/pkgs/development/libraries/grpc/default.nix
@@ -54,22 +54,26 @@ stdenv.mkDerivation rec {
   buildInputs = [ openssl protobuf ]
     ++ lib.optionals stdenv.isLinux [ libnsl ];
 
-  cmakeFlags = [
-    "-DgRPC_ZLIB_PROVIDER=package"
-    "-DgRPC_CARES_PROVIDER=package"
-    "-DgRPC_RE2_PROVIDER=package"
-    "-DgRPC_SSL_PROVIDER=package"
-    "-DgRPC_PROTOBUF_PROVIDER=package"
-    "-DgRPC_ABSL_PROVIDER=package"
-    "-DBUILD_SHARED_LIBS=ON"
-  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
-    "-D_gRPC_PROTOBUF_PROTOC_EXECUTABLE=${buildPackages.protobuf}/bin/protoc"
-  ] ++ lib.optionals ((stdenv.hostPlatform.useLLVM or false) && lib.versionOlder stdenv.cc.cc.version "11.0") [
-    # Needs to be compiled with -std=c++11 for clang < 11. Interestingly this is
-    # only an issue with the useLLVM stdenv, not the darwin stdenv…
-    # https://github.com/grpc/grpc/issues/26473#issuecomment-860885484
-    "-DCMAKE_CXX_STANDARD=11"
-  ];
+  cmakeFlags =
+    let
+      # Needs to be compiled with -std=c++11 for clang < 11. Interestingly this is
+      # only an issue with the useLLVM stdenv, not the darwin stdenv…
+      # https://github.com/grpc/grpc/issues/26473#issuecomment-860885484
+      useLLVMAndOldCC = (stdenv.hostPlatform.useLLVM or false) && lib.versionOlder stdenv.cc.cc.version "11.0";
+      cxxStandard = if useLLVMAndOldCC then "11" else "17";
+    in
+    [
+      "-DgRPC_ZLIB_PROVIDER=package"
+      "-DgRPC_CARES_PROVIDER=package"
+      "-DgRPC_RE2_PROVIDER=package"
+      "-DgRPC_SSL_PROVIDER=package"
+      "-DgRPC_PROTOBUF_PROVIDER=package"
+      "-DgRPC_ABSL_PROVIDER=package"
+      "-DBUILD_SHARED_LIBS=ON"
+      "-DCMAKE_CXX_STANDARD=${cxxStandard}"
+    ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+      "-D_gRPC_PROTOBUF_PROTOC_EXECUTABLE=${buildPackages.protobuf}/bin/protoc"
+    ];
 
   # CMake creates a build directory by default, this conflicts with the
   # basel BUILD file on case-insensitive filesystems.
diff --git a/pkgs/development/libraries/gssdp/1.6.nix b/pkgs/development/libraries/gssdp/1.6.nix
index 19c46d4776c..80b518ab27b 100644
--- a/pkgs/development/libraries/gssdp/1.6.nix
+++ b/pkgs/development/libraries/gssdp/1.6.nix
@@ -6,6 +6,7 @@
 , pkg-config
 , gobject-introspection
 , vala
+, pandoc
 , gi-docgen
 , python3
 , libsoup_3
@@ -16,14 +17,14 @@
 
 stdenv.mkDerivation rec {
   pname = "gssdp";
-  version = "1.6.1";
+  version = "1.6.2";
 
   outputs = [ "out" "dev" ]
     ++ lib.optionals (stdenv.buildPlatform == stdenv.hostPlatform) [ "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gssdp/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0r4KbiWREJpuQlhRFhpKU7xUtPBqAhTHlwVmMpvVYzA=";
+    sha256 = "QQs3be7O2YNrV/SI+ABS/koU+J4HWxzszyjlH0kPn7k=";
   };
 
   nativeBuildInputs = [
@@ -32,6 +33,7 @@ stdenv.mkDerivation rec {
     pkg-config
     gobject-introspection
     vala
+    pandoc
     gi-docgen
     python3
   ];
diff --git a/pkgs/development/libraries/gtk-frdp/default.nix b/pkgs/development/libraries/gtk-frdp/default.nix
index a76805d8d1f..acd2cae6abf 100644
--- a/pkgs/development/libraries/gtk-frdp/default.nix
+++ b/pkgs/development/libraries/gtk-frdp/default.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
     };
   };
 
-  NIX_CFLAGS_COMPILE = lib.optional stdenv.isDarwin [
+  NIX_CFLAGS_COMPILE = lib.optionals stdenv.isDarwin [
     "-DTARGET_OS_IPHONE=0"
     "-DTARGET_OS_WATCH=0"
   ];
diff --git a/pkgs/development/libraries/gupnp/1.6.nix b/pkgs/development/libraries/gupnp/1.6.nix
index 0e4afedc369..fc9fc1da08b 100644
--- a/pkgs/development/libraries/gupnp/1.6.nix
+++ b/pkgs/development/libraries/gupnp/1.6.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gupnp";
-  version = "1.6.1";
+  version = "1.6.2";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gupnp/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-hTgUUtKvlbjhSyTUqYljPQ2DzYjRJy8nzLJBbMyDbUc=";
+    sha256 = "sha256-6QBZzIOAXa2T6DvkflOVjwdHHMRk+UQ5HntcgqpRoY8=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/development/libraries/httplib/default.nix b/pkgs/development/libraries/httplib/default.nix
new file mode 100644
index 00000000000..19618613ee1
--- /dev/null
+++ b/pkgs/development/libraries/httplib/default.nix
@@ -0,0 +1,31 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "httplib";
+  version = "0.11.1";
+
+  src = fetchFromGitHub {
+    owner = "yhirose";
+    repo = "cpp-httplib";
+    rev = "v${version}";
+    sha256 = "sha256-rsElqtoRz/sOXpAsfSJbMlwIKdaGJkSZfKHzB/wMhY8=";
+  };
+
+  # Header-only library.
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir -p "$out/include"
+    cp -r httplib.h "$out/include"
+  '';
+
+  meta = with lib; {
+    description = "A C++ header-only HTTP/HTTPS server and client library";
+    homepage = "https://github.com/yhirose/cpp-httplib";
+    maintainers = with maintainers; [ aidalgol ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/development/libraries/liblouis/default.nix b/pkgs/development/libraries/liblouis/default.nix
index 33ec04734f5..da724aaac9b 100644
--- a/pkgs/development/libraries/liblouis/default.nix
+++ b/pkgs/development/libraries/liblouis/default.nix
@@ -13,7 +13,7 @@
 
 stdenv.mkDerivation rec {
   pname = "liblouis";
-  version = "3.23.0";
+  version = "3.24.0";
 
   outputs = [ "out" "dev" "info" "doc" ]
     # configure: WARNING: cannot generate manual pages while cross compiling
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     owner = "liblouis";
     repo = "liblouis";
     rev = "v${version}";
-    sha256 = "sha256-jXNhHzydWaMhFbEKoFHyZ77GCvAqxyT3P0xIAgFlTzY=";
+    sha256 = "sha256-QSrCQhP3t+WPyBQPLJbZEaDCjXD8Lo6IAGKHsbL2S1o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libnfs/default.nix b/pkgs/development/libraries/libnfs/default.nix
index cbfc06bc81c..d9beee7933f 100644
--- a/pkgs/development/libraries/libnfs/default.nix
+++ b/pkgs/development/libraries/libnfs/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, autoreconfHook }:
 
 stdenv.mkDerivation rec {
   pname = "libnfs";
@@ -13,7 +13,22 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=tautological-compare";
+  patches = [
+    # Fixes 100% CPU usage in multi-threaded mode
+    (fetchpatch {
+      url = "https://github.com/sahlberg/libnfs/commit/34d6fe37e986da5b0ced86cd028a88e482537d5a.patch";
+      sha256 = "sha256-i7mi+TVdkLb4MztT5Ic/Q8XBIWk9lo8v5bNjHOr6LaI=";
+    })
+    # Fixes deprecation warnings on macOS
+    (fetchpatch {
+      url = "https://github.com/sahlberg/libnfs/commit/f6631c54a7b0385988f11357bf96728a6d7345b9.patch";
+      sha256 = "sha256-xLRZ9J1vr04n//gNv9ljUBt5LHUGBRRVIXJCMlFbHFI=";
+    })
+  ];
+
+  configureFlags = [
+    "--enable-pthread"
+  ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/libplctag/default.nix b/pkgs/development/libraries/libplctag/default.nix
index df209993bb1..de71d021d01 100644
--- a/pkgs/development/libraries/libplctag/default.nix
+++ b/pkgs/development/libraries/libplctag/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libplctag";
-  version = "2.5.4";
+  version = "2.5.5";
 
   src = fetchFromGitHub {
     owner = "libplctag";
     repo = "libplctag";
     rev = "v${version}";
-    sha256 = "sha256-RQlT+G0aSHHETyJaWKhGFdBLSv0qoZsavggv/ubeSQA=";
+    sha256 = "sha256-eWtQaYUWZNQYQOUXnbUfjrtpoO6CnNJ8WjlowA49sG0=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/libredwg/default.nix b/pkgs/development/libraries/libredwg/default.nix
index ad7a7e5473e..a3b43e9377e 100644
--- a/pkgs/development/libraries/libredwg/default.nix
+++ b/pkgs/development/libraries/libredwg/default.nix
@@ -1,21 +1,46 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, texinfo, pcre2
-, enablePython ? false, python ? null, swig, libxml2, ncurses
+{ lib
+, stdenv
+, fetchFromGitHub
+, autoreconfHook
+, writeShellScript
+, pkg-config
+, texinfo
+, pcre2
+, swig
+, libxml2
+, ncurses
+, enablePython ? false
+, python ? null
 }:
 let
   isPython3 = enablePython && python.pythonAtLeast "3";
 in
 stdenv.mkDerivation rec {
   pname = "libredwg";
-  version = "0.12.4";
+  version = "0.12.5";
 
   src = fetchFromGitHub {
     owner = "LibreDWG";
     repo = pname;
     rev = version;
-    sha256 = "sha256-CZZ5/uCls2tY3PKmD+hBBvp7d7KX8nZuCPf03sa4iXc=";
+    sha256 = "sha256-s9aiOKSM7+3LJNE+jRrEMcL1QKRWrlTKbwO7oL9VhuE=";
     fetchSubmodules = true;
   };
 
+  postPatch = let
+    printVersion = writeShellScript "print-version" ''
+      echo ${lib.escapeShellArg version}
+    '';
+  in ''
+    # avoid git dependency
+    cp ${printVersion} build-aux/git-version-gen
+  '';
+
+  preConfigure = lib.optionalString (stdenv.isDarwin && enablePython) ''
+    # prevent configure picking up stack_size from distutils.sysconfig
+    export PYTHON_EXTRA_LDFLAGS=" "
+  '';
+
   nativeBuildInputs = [ autoreconfHook pkg-config texinfo ]
     ++ lib.optional enablePython swig;
 
diff --git a/pkgs/development/libraries/libshumate/default.nix b/pkgs/development/libraries/libshumate/default.nix
index ef56f936dcc..2d7e6c5fb7a 100644
--- a/pkgs/development/libraries/libshumate/default.nix
+++ b/pkgs/development/libraries/libshumate/default.nix
@@ -18,7 +18,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libshumate";
-  version = "1.0.2";
+  version = "1.0.3";
 
   outputs = [ "out" "dev" "devdoc" ];
   outputBin = "devdoc"; # demo app
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     owner = "GNOME";
     repo = "libshumate";
     rev = version;
-    sha256 = "zmPsWdTbM+T50X0BsVTn1Aw/5N6sL5hIQiRG5WSG1eg=";
+    sha256 = "gT6jpFN0mkSdDs+8GQa0qKuL5KLzxanBMGwA4EATW7Y=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/mbedtls/2.nix b/pkgs/development/libraries/mbedtls/2.nix
new file mode 100644
index 00000000000..ba1f520b08c
--- /dev/null
+++ b/pkgs/development/libraries/mbedtls/2.nix
@@ -0,0 +1,6 @@
+{ callPackage }:
+
+callPackage ./generic.nix {
+  version = "2.28.1";
+  hash = "sha256-brbZB3fINDeVWXf50ct4bxYkoBVyD6bBBijZyFQSnyw=";
+}
diff --git a/pkgs/development/libraries/mbedtls/3.nix b/pkgs/development/libraries/mbedtls/3.nix
new file mode 100644
index 00000000000..d6f53feb086
--- /dev/null
+++ b/pkgs/development/libraries/mbedtls/3.nix
@@ -0,0 +1,6 @@
+{ callPackage }:
+
+callPackage ./generic.nix {
+  version = "3.2.1";
+  hash = "sha256-+M36NvFe4gw2PRbld/2JV3yBGrqK6soWcmrSEkUNcrc=";
+}
diff --git a/pkgs/development/libraries/mbedtls/default.nix b/pkgs/development/libraries/mbedtls/generic.nix
index 2bd924d870c..bb87c6dbc8a 100644
--- a/pkgs/development/libraries/mbedtls/default.nix
+++ b/pkgs/development/libraries/mbedtls/generic.nix
@@ -1,4 +1,7 @@
-{ lib, stdenv
+{ lib
+, stdenv
+, version
+, hash
 , fetchFromGitHub
 
 , cmake
@@ -11,17 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mbedtls";
-  # Auto updates are disabled due to repology listing dev releases as release
-  # versions. See
-  #  * https://github.com/NixOS/nixpkgs/pull/119838#issuecomment-822100428
-  #  * https://github.com/NixOS/nixpkgs/commit/0ee02a9d42b5fe1825b0f7cee7a9986bb4ba975d
-  version = "2.28.1"; # nixpkgs-update: no auto update
+  inherit version;
 
   src = fetchFromGitHub {
-    owner = "ARMmbed";
+    owner = "Mbed-TLS";
     repo = "mbedtls";
     rev = "${pname}-${version}";
-    sha256 = "sha256-brbZB3fINDeVWXf50ct4bxYkoBVyD6bBBijZyFQSnyw=";
+    inherit hash;
   };
 
   nativeBuildInputs = [ cmake ninja perl python3 ];
@@ -40,10 +39,11 @@ stdenv.mkDerivation rec {
   ];
 
   meta = with lib; {
-    homepage = "https://tls.mbed.org/";
+    homepage = "https://www.trustedfirmware.org/projects/mbed-tls/";
+    changelog = "https://github.com/Mbed-TLS/mbedtls/blob/${pname}-${version}/ChangeLog";
     description = "Portable cryptographic and TLS library, formerly known as PolarSSL";
     license = licenses.asl20;
     platforms = platforms.all;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ raphaelr ];
   };
 }
diff --git a/pkgs/development/libraries/mdds/default.nix b/pkgs/development/libraries/mdds/default.nix
index 8ca137e6611..d85e24f9078 100644
--- a/pkgs/development/libraries/mdds/default.nix
+++ b/pkgs/development/libraries/mdds/default.nix
@@ -1,12 +1,14 @@
-{ lib, stdenv, fetchurl, boost, llvmPackages }:
+{ lib, stdenv, fetchFromGitLab, autoreconfHook, boost, llvmPackages }:
 
 stdenv.mkDerivation rec {
   pname = "mdds";
   version = "2.0.2";
 
-  src = fetchurl {
-    url = "https://kohei.us/files/${pname}/src/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-EyEfLy44fvO3TXOh3O5Soa1c4G34+OZkdnnfknijEWo=";
+  src = fetchFromGitLab {
+    owner = "mdds";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-jCzF0REocpnP56LfY42zlGTXyKyz4GPovDshhrh4jyo=";
   };
 
   postInstall = ''
@@ -14,14 +16,17 @@ stdenv.mkDerivation rec {
     cp "$out/share/pkgconfig/"* "$out/lib/pkgconfig"
   '';
 
+  nativeBuildInputs = [ autoreconfHook ];
+
   buildInputs = lib.optionals stdenv.cc.isClang [ llvmPackages.openmp ];
 
   checkInputs = [ boost ];
 
   meta = with lib; {
-    homepage = "https://gitlab.com/mdds/mdds";
     description = "A collection of multi-dimensional data structure and indexing algorithm";
-    platforms = platforms.all;
+    homepage = "https://gitlab.com/mdds/mdds";
+    maintainers = [];
     license = licenses.mit;
+    platforms = platforms.all;
   };
 }
diff --git a/pkgs/development/libraries/mm-common/default.nix b/pkgs/development/libraries/mm-common/default.nix
index e1eaa1d924b..225ce967080 100644
--- a/pkgs/development/libraries/mm-common/default.nix
+++ b/pkgs/development/libraries/mm-common/default.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mm-common";
-  version = "1.0.4";
+  version = "1.0.5";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "6VTAm0MJp++T4TtpJgrNxXOMkHR36zgbeLseQU7m29g=";
+    sha256 = "cFxtKfQRaim95ONs/BsEbJK274xtrk6uyFAYdH5tpao=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/mysocketw/default.nix b/pkgs/development/libraries/mysocketw/default.nix
index 5ee10c854a5..880f5d50a04 100644
--- a/pkgs/development/libraries/mysocketw/default.nix
+++ b/pkgs/development/libraries/mysocketw/default.nix
@@ -49,15 +49,11 @@ stdenv.mkDerivation rec {
     printf %s 'https://AnotherFoxGuy.com/CMakeCM::modules/JoinPaths.cmake.1' > JoinPaths.cmake.whence
   )'';
 
-  postPatch = lib.optionalString stdenv.isDarwin ''
-    substituteInPlace src/Makefile \
-        --replace -Wl,-soname, -Wl,-install_name,$out/lib/
-  '';
-
   meta = with lib; {
     description = "Cross platform (Linux/FreeBSD/Unix/Win32) streaming socket C++";
     homepage = "https://github.com/RigsOfRods/socketw";
     license = licenses.lgpl21Plus;
     maintainers = with maintainers; [ ];
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/ntirpc/default.nix b/pkgs/development/libraries/ntirpc/default.nix
index 95003a0b00e..66002df4905 100644
--- a/pkgs/development/libraries/ntirpc/default.nix
+++ b/pkgs/development/libraries/ntirpc/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ntirpc";
-  version = "4.1";
+  version = "4.2";
 
   src = fetchFromGitHub {
     owner = "nfs-ganesha";
     repo = "ntirpc";
     rev = "v${version}";
-    sha256 = "sha256-RTuWj795YrXVo3TIiEr3Dy/QmSL5Ch0VVc4gRlDhNTM=";
+    sha256 = "sha256-rVv5TLxirtmoRJl0+RupbkvzChuSMSGi3NTa0dchZSU=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/ogre/default.nix b/pkgs/development/libraries/ogre/default.nix
index 2017d5435ea..34cb8d21f83 100644
--- a/pkgs/development/libraries/ogre/default.nix
+++ b/pkgs/development/libraries/ogre/default.nix
@@ -1,29 +1,34 @@
-{ fetchFromGitHub
+{ lib
 , stdenv
-, lib
+, fetchFromGitHub
 , cmake
-, libGLU
-, libGL
-, freetype
+, pkg-config
+, unzip
+, SDL2
+, boost
 , freeimage
-, zziplib
-, xorgproto
-, libXrandr
-, libXaw
-, freeglut
-, libXt
+, freetype
 , libpng
-, boost
 , ois
+, pugixml
+, zziplib
+  # linux
+, freeglut
+, libGL
+, libGLU
+, libICE
+, libSM
 , libX11
+, libXaw
 , libXmu
-, libSM
-, pkg-config
-, libXxf86vm
-, libICE
-, unzip
+, libXrandr
 , libXrender
-, SDL2
+, libXt
+, libXxf86vm
+, xorgproto
+  # darwin
+, Cocoa
+  # optional
 , withNvidiaCg ? false
 , nvidia_cg_toolkit
 , withSamples ? false
@@ -31,59 +36,63 @@
 
 stdenv.mkDerivation rec {
   pname = "ogre";
-  version = "1.12.1";
+  version = "13.5.3";
 
   src = fetchFromGitHub {
     owner = "OGRECave";
     repo = "ogre";
     rev = "v${version}";
-    sha256 = "sha256-FHW0+DZhw6MLlhjh4DRYhA+6vBBXMN9K6GEVoR6P5kM=";
+    sha256 = "sha256-fjgMAuIA7rm3Gt2z//kPkc7LOcfddoFgY38B7bs6zZo=";
   };
 
-  # fix for ARM. sys/sysctl.h has moved in later glibcs, and
-  # https://github.com/OGRECave/ogre-next/issues/132 suggests it isn't
-  # needed anyway.
-  postPatch = ''
-    substituteInPlace OgreMain/src/OgrePlatformInformation.cpp \
-      --replace '#include <sys/sysctl.h>' ""
-  '';
-
-  cmakeFlags = [ "-DOGRE_BUILD_DEPENDENCIES=OFF" "-DOGRE_BUILD_SAMPLES=${toString withSamples}" ]
-    ++ map (x: "-DOGRE_BUILD_PLUGIN_${x}=on")
-    ([ "BSP" "OCTREE" "PCZ" "PFX" ] ++ lib.optional withNvidiaCg "CG")
-    ++ map (x: "-DOGRE_BUILD_RENDERSYSTEM_${x}=on") [ "GL" ];
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    unzip
+  ];
 
+  buildInputs = [
+    SDL2
+    boost
+    freeimage
+    freetype
+    libpng
+    ois
+    pugixml
+    zziplib
+  ] ++ lib.optionals stdenv.isLinux [
+    freeglut
+    libGL
+    libGLU
+    libICE
+    libSM
+    libX11
+    libXaw
+    libXmu
+    libXrandr
+    libXrender
+    libXt
+    libXxf86vm
+    xorgproto
+  ] ++ lib.optionals stdenv.isDarwin [
+    Cocoa
+  ] ++ lib.optionals withNvidiaCg [
+    nvidia_cg_toolkit
+  ];
 
-  nativeBuildInputs = [ cmake unzip pkg-config ];
-  buildInputs =
-    [
-      libGLU
-      libGL
-      freetype
-      freeimage
-      zziplib
-      xorgproto
-      libXrandr
-      libXaw
-      freeglut
-      libXt
-      libpng
-      boost
-      ois
-      libX11
-      libXmu
-      libSM
-      libXxf86vm
-      libICE
-      libXrender
-      SDL2
-    ] ++ lib.optional withNvidiaCg nvidia_cg_toolkit;
+  cmakeFlags = [
+    "-DOGRE_BUILD_COMPONENT_OVERLAY_IMGUI=FALSE"
+    "-DOGRE_BUILD_DEPENDENCIES=OFF"
+    "-DOGRE_BUILD_SAMPLES=${toString withSamples}"
+  ] ++ lib.optionals stdenv.isDarwin [
+    "-DOGRE_BUILD_LIBS_AS_FRAMEWORKS=FALSE"
+  ];
 
   meta = {
-    description = "A 3D engine";
+    description = "3D Object-Oriented Graphics Rendering Engine";
     homepage = "https://www.ogre3d.org/";
-    maintainers = [ lib.maintainers.raskin ];
-    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ raskin wegank ];
+    platforms = lib.platforms.unix;
     license = lib.licenses.mit;
   };
 }
diff --git a/pkgs/development/libraries/openscenegraph/default.nix b/pkgs/development/libraries/openscenegraph/default.nix
index 885fbb058bd..3a6a7b57c40 100644
--- a/pkgs/development/libraries/openscenegraph/default.nix
+++ b/pkgs/development/libraries/openscenegraph/default.nix
@@ -23,7 +23,7 @@
   sdlSupport ? false, SDL2,
   restSupport ? false, asio,
   withApps ? false,
-  withExamples ? false, fltk, wxGTK30-gtk3,
+  withExamples ? false, fltk, wxGTK30,
 }:
 
 stdenv.mkDerivation rec {
@@ -61,7 +61,7 @@ stdenv.mkDerivation rec {
     ++ lib.optional luaSupport lua
     ++ lib.optional sdlSupport SDL2
     ++ lib.optional restSupport asio
-    ++ lib.optionals withExamples [ fltk wxGTK30-gtk3 ]
+    ++ lib.optionals withExamples [ fltk wxGTK30 ]
     ++ lib.optionals stdenv.isDarwin [ AGL Carbon Cocoa Foundation ]
     ++ lib.optional (restSupport || colladaSupport) boost
   ;
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 61f758b7c4a..45a34971c8f 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -87,28 +87,24 @@ let
         x86_64-linux = "./Configure linux-x86_64";
         x86_64-solaris = "./Configure solaris64-x86_64-gcc";
         riscv64-linux = "./Configure linux64-riscv64";
-        mipsel-linux = "./Configure linux-mips32";
-        mips64el-linux =
-          if stdenv.hostPlatform.isMips64n64
-          then "./Configure linux64-mips64"
-          else if stdenv.hostPlatform.isMips64n32
-          then "./Configure linux-mips64"
-          else throw "unsupported ABI for ${stdenv.hostPlatform.system}";
       }.${stdenv.hostPlatform.system} or (
         if stdenv.hostPlatform == stdenv.buildPlatform
           then "./config"
-        else if stdenv.hostPlatform.isBSD && stdenv.hostPlatform.isx86_64
-          then "./Configure BSD-x86_64"
-        else if stdenv.hostPlatform.isBSD && stdenv.hostPlatform.isx86_32
-          then "./Configure BSD-x86" + lib.optionalString (stdenv.hostPlatform.parsed.kernel.execFormat.name == "elf") "-elf"
         else if stdenv.hostPlatform.isBSD
-          then "./Configure BSD-generic${toString stdenv.hostPlatform.parsed.cpu.bits}"
+          then if stdenv.hostPlatform.isx86_64 then "./Configure BSD-x86_64"
+          else if stdenv.hostPlatform.isx86_32
+            then "./Configure BSD-x86" + lib.optionalString (stdenv.hostPlatform.parsed.kernel.execFormat.name == "elf") "-elf"
+          else "./Configure BSD-generic${toString stdenv.hostPlatform.parsed.cpu.bits}"
         else if stdenv.hostPlatform.isMinGW
           then "./Configure mingw${lib.optionalString
                                      (stdenv.hostPlatform.parsed.cpu.bits != 32)
                                      (toString stdenv.hostPlatform.parsed.cpu.bits)}"
         else if stdenv.hostPlatform.isLinux
-          then "./Configure linux-generic${toString stdenv.hostPlatform.parsed.cpu.bits}"
+          then if stdenv.hostPlatform.isx86_64 then "./Configure linux-x86_64"
+          else if stdenv.hostPlatform.isMips32 then "./Configure linux-mips32"
+          else if stdenv.hostPlatform.isMips64n32 then "./Configure linux-mips64"
+          else if stdenv.hostPlatform.isMips64n64 then "./Configure linux64-mips64"
+          else "./Configure linux-generic${toString stdenv.hostPlatform.parsed.cpu.bits}"
         else if stdenv.hostPlatform.isiOS
           then "./Configure ios${toString stdenv.hostPlatform.parsed.cpu.bits}-cross"
         else
diff --git a/pkgs/development/libraries/proj/default.nix b/pkgs/development/libraries/proj/default.nix
index 2e1000ef5e6..87736e1ebc7 100644
--- a/pkgs/development/libraries/proj/default.nix
+++ b/pkgs/development/libraries/proj/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "proj";
-  version = "9.1.0";
+  version = "9.1.1";
 
   src = fetchFromGitHub {
     owner = "OSGeo";
     repo = "PROJ";
     rev = version;
-    hash = "sha256-Upsp72RorV+5PFPHOK3zCJgVTRZ6fSVVFRope8Bp8/M=";
+    hash = "sha256-yw7eSm64qFFt9egJWKVyVo0e7xQRSmfUY7pk6Cwvwdk=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/qt-6/modules/qtbase.nix b/pkgs/development/libraries/qt-6/modules/qtbase.nix
index e1675e029fc..d396e18aad2 100644
--- a/pkgs/development/libraries/qt-6/modules/qtbase.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtbase.nix
@@ -18,7 +18,6 @@
 , ccache
 , xmlstarlet
 , libproxy
-, xlibsWrapper
 , xorg
 , zstd
 , double-conversion
@@ -129,7 +128,6 @@ stdenv.mkDerivation rec {
     unixODBCDrivers.sqlite
     unixODBCDrivers.mariadb
   ] ++ lib.optionals stdenv.isLinux [
-    xlibsWrapper
     util-linux
     systemd
     mtdev
diff --git a/pkgs/development/libraries/qt-6/modules/qtwayland.nix b/pkgs/development/libraries/qt-6/modules/qtwayland.nix
index 3ac23d28a79..e28cdb438e5 100644
--- a/pkgs/development/libraries/qt-6/modules/qtwayland.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtwayland.nix
@@ -4,13 +4,12 @@
 , qtdeclarative
 , wayland
 , pkg-config
-, xlibsWrapper
 , libdrm
 }:
 
 qtModule {
   pname = "qtwayland";
   qtInputs = [ qtbase qtdeclarative ];
-  buildInputs = [ wayland xlibsWrapper libdrm ];
+  buildInputs = [ wayland libdrm ];
   nativeBuildInputs = [ pkg-config ];
 }
diff --git a/pkgs/development/libraries/s2n-tls/default.nix b/pkgs/development/libraries/s2n-tls/default.nix
index d22f59271fe..451e856c4e0 100644
--- a/pkgs/development/libraries/s2n-tls/default.nix
+++ b/pkgs/development/libraries/s2n-tls/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "s2n-tls";
-  version = "1.3.28";
+  version = "1.3.29";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-RkOP+et8wFb44NLqkizXB68U0NRKKvhDl4PyQWz2m6A=";
+    sha256 = "sha256-MKrZP81PrpOsVhS+kAjcd1Eumhq7F4HWWbFnypZttuY=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/semver-cpp/default.nix b/pkgs/development/libraries/semver-cpp/default.nix
new file mode 100644
index 00000000000..966f170eaad
--- /dev/null
+++ b/pkgs/development/libraries/semver-cpp/default.nix
@@ -0,0 +1,31 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "semver-cpp";
+  version = "0.3.0";
+
+  src = fetchFromGitHub {
+    owner = "Neargye";
+    repo = "semver";
+    rev = "v${version}";
+    sha256 = "sha256-nRWmY/GJtSkPJIW7i7/eIr/YtfyvYhJVZBRIDXUC7xg=";
+  };
+
+  # Header-only library.
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir "$out"
+    cp -r include "$out"
+  '';
+
+  meta = with lib; {
+    description = "Semantic Versioning for modern C++";
+    homepage = "https://github.com/Neargye/semver";
+    maintainers = with maintainers; [ aidalgol ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/development/libraries/smokegen/default.nix b/pkgs/development/libraries/smokegen/default.nix
index 643ae1064db..2a93965aeb3 100644
--- a/pkgs/development/libraries/smokegen/default.nix
+++ b/pkgs/development/libraries/smokegen/default.nix
@@ -1,16 +1,18 @@
-{ pkgs, lib, ... }:
+{ stdenv, lib, cmake, qt4, fetchzip }:
 
-pkgs.stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "smokegen";
-  version = "v4.14.3";
-  src = pkgs.fetchzip {
-    url = "https://invent.kde.org/unmaintained/${pname}/-/archive/${version}/${pname}-${version}.tar.gz";
+  version = "4.14.3";
+
+  src = fetchzip {
+    url = "https://invent.kde.org/unmaintained/${pname}/-/archive/v${version}/${pname}-v${version}.tar.gz";
     hash = "sha256-finsoruPeJZLawIjNUJ25Pq54eaCByfALVraNQJPk7c=";
   };
-  buildInputs = [ pkgs.cmake pkgs.qt4 ];
-  buildPhase = ''
-      cmake .
-    '';
+
+  strictDeps = true;
+  nativeBuildInputs = [ cmake qt4 ];
+  buildInputs = [ qt4 ];
+
   meta = with lib; {
     description = "A general purpose C++ parser with a plugin infrastructure";
     homepage = "https://invent.kde.org/unmaintained/smokegen";
diff --git a/pkgs/development/libraries/smokeqt/default.nix b/pkgs/development/libraries/smokeqt/default.nix
index 145a9f243bb..1c427b8abb7 100644
--- a/pkgs/development/libraries/smokeqt/default.nix
+++ b/pkgs/development/libraries/smokeqt/default.nix
@@ -1,16 +1,22 @@
-{ pkgs, lib, ... }:
+{ stdenv, lib, cmake, qt4, smokegen, fetchzip }:
 
-pkgs.stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "smokeqt";
-  version = "v4.14.3";
-  src = pkgs.fetchzip {
-    url = "https://invent.kde.org/unmaintained/${pname}/-/archive/${version}/${pname}-${version}.tar.gz";
+  version = "4.14.3";
+
+  src = fetchzip {
+    url = "https://invent.kde.org/unmaintained/${pname}/-/archive/v${version}/${pname}-v${version}.tar.gz";
     hash = "sha256-8FiEGF8gduVw5I/bi2wExGUWmjIjYEhWpjpXKJGBNMg=";
   };
+
+  strictDeps = true;
+  nativeBuildInputs = [ cmake smokegen ];
+  buildInputs = [ qt4 ];
+
   cmakeFlags = [
     "-DCMAKE_CXX_STANDARD=98"
   ];
-  buildInputs = [ pkgs.cmake pkgs.qt4 pkgs.smokegen ];
+
   meta = with lib; {
     description = "Bindings for the Qt libraries";
     homepage = "https://invent.kde.org/unmaintained/smokeqt";
diff --git a/pkgs/development/libraries/tracker-miners/default.nix b/pkgs/development/libraries/tracker-miners/default.nix
index 55793719dd8..32225a7bb0d 100644
--- a/pkgs/development/libraries/tracker-miners/default.nix
+++ b/pkgs/development/libraries/tracker-miners/default.nix
@@ -46,11 +46,11 @@
 
 stdenv.mkDerivation rec {
   pname = "tracker-miners";
-  version = "3.4.1";
+  version = "3.4.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "L84OyF+3YXyLKIfCJ5d0DV3shOwDbbdNbCCLurXFjCQ=";
+    sha256 = "EB42CPHCi/7YriVSL3pyC1WfiJp24oCvvlCk2LBk+Sw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/vapoursynth/default.nix b/pkgs/development/libraries/vapoursynth/default.nix
index 0aa6fc39baa..3a88e3bd04b 100644
--- a/pkgs/development/libraries/vapoursynth/default.nix
+++ b/pkgs/development/libraries/vapoursynth/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vapoursynth";
-  version = "60";
+  version = "61";
 
   src = fetchFromGitHub {
     owner  = "vapoursynth";
     repo   = "vapoursynth";
     rev    = "R${version}";
-    sha256 = "sha256-E1uHNcGxBrwg00tNnY3qH6BpvXtBEGkX7QFy0aMLSnA=";
+    sha256 = "sha256-JJWq706GLywUO5voYKzxcOvMWF4/NXEbqOrj5uG4DWw=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/vte/default.nix b/pkgs/development/libraries/vte/default.nix
index 07ec683bf05..f87557ac462 100644
--- a/pkgs/development/libraries/vte/default.nix
+++ b/pkgs/development/libraries/vte/default.nix
@@ -30,13 +30,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vte";
-  version = "0.70.1";
+  version = "0.70.2";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-H0YBy/6lMCuWkCIIyPGF5bGLJZtTWLyTzzkr9ZhxxbY=";
+    sha256 = "sha256-TRW0OA3j9WTVfqvQBjicQHxwXfWwxwAw/cwklxozTYA=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/wolfssl/default.nix b/pkgs/development/libraries/wolfssl/default.nix
index 580af7235e0..e61a6f6c393 100644
--- a/pkgs/development/libraries/wolfssl/default.nix
+++ b/pkgs/development/libraries/wolfssl/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
     owner = "wolfSSL";
     repo = "wolfssl";
     rev = "v${version}-stable";
-    hash = "sha256-d8DDyEsK35WK7c0udZI5HxQLO+mbod8hlbSoa3IWWS0=";
+    hash = "sha256-36L7kZ9Dqp3pDjodqELBdSBFwrf+GnRP7KNFYrRUCuU=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/wxwidgets/wxGTK30.nix b/pkgs/development/libraries/wxwidgets/wxGTK30.nix
index 3b848f788c1..b60e1f486dc 100644
--- a/pkgs/development/libraries/wxwidgets/wxGTK30.nix
+++ b/pkgs/development/libraries/wxwidgets/wxGTK30.nix
@@ -3,8 +3,6 @@
 , expat
 , fetchFromGitHub
 , gst_all_1
-, withGtk2 ? true
-, gtk2
 , gtk3
 , libGL
 , libGLU
@@ -34,11 +32,6 @@
 , WebKit
 }:
 
-assert withGtk2 -> (!withWebKit);
-
-let
-  gtk = if withGtk2 then gtk2 else gtk3;
-in
 stdenv.mkDerivation rec {
   pname = "wxwidgets";
   version = "3.0.5.1";
@@ -60,7 +53,7 @@ stdenv.mkDerivation rec {
     libjpeg_turbo
     zlib
   ] ++ lib.optionals stdenv.isLinux [
-    gtk
+    gtk3
     libSM
     libXinerama
     libXxf86vm
@@ -148,7 +141,6 @@ stdenv.mkDerivation rec {
   };
 
   passthru = {
-    inherit gtk;
     inherit compat26 compat28 unicode;
   };
 }
diff --git a/pkgs/development/libraries/xdg-desktop-portal-gtk/default.nix b/pkgs/development/libraries/xdg-desktop-portal-gtk/default.nix
index e54f764f9a5..903de4d9a23 100644
--- a/pkgs/development/libraries/xdg-desktop-portal-gtk/default.nix
+++ b/pkgs/development/libraries/xdg-desktop-portal-gtk/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xdg-desktop-portal-gtk";
-  version = "1.14.0";
+  version = "1.14.1";
 
   src = fetchFromGitHub {
     owner = "flatpak";
     repo = pname;
     rev = version;
-    sha256 = "I9xQgiE3lNb2vRodO5R1y40lqoOKzALskrVePidant4=";
+    sha256 = "8eyWeoiJ3b/GlqGVfmkf2/uS7FnOpRNgbfxwWjclw8w=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/yojimbo/default.nix b/pkgs/development/libraries/yojimbo/default.nix
index b72820c77a6..d8c29e56aaa 100644
--- a/pkgs/development/libraries/yojimbo/default.nix
+++ b/pkgs/development/libraries/yojimbo/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, premake5, doxygen, libsodium, mbedtls }:
+{ lib, stdenv, fetchFromGitHub, premake5, doxygen, libsodium, mbedtls_2 }:
 
 stdenv.mkDerivation {
   pname = "yojimbo";
@@ -13,7 +13,7 @@ stdenv.mkDerivation {
   };
 
   nativeBuildInputs = [ premake5 doxygen ];
-  propagatedBuildInputs = [ libsodium mbedtls ];
+  propagatedBuildInputs = [ libsodium mbedtls_2 ];
 
   postBuild = ''
     premake5 docs
diff --git a/pkgs/development/mobile/androidenv/compose-android-packages.nix b/pkgs/development/mobile/androidenv/compose-android-packages.nix
index 217922886df..e379c12f971 100644
--- a/pkgs/development/mobile/androidenv/compose-android-packages.nix
+++ b/pkgs/development/mobile/androidenv/compose-android-packages.nix
@@ -312,6 +312,12 @@ rec {
           ln -s $i $out/bin
       done
 
+      # the emulator auto-linked from platform-tools does not find its local qemu, while this one does
+      ${lib.optionalString includeEmulator ''
+        rm $out/bin/emulator
+        ln -s $out/libexec/android-sdk/emulator/emulator $out/bin
+      ''}
+
       # Write licenses
       mkdir -p licenses
       ${lib.concatMapStrings (licenseName:
diff --git a/pkgs/development/node-packages/overrides.nix b/pkgs/development/node-packages/overrides.nix
index 1ef63d3f6b9..4e5b04e6240 100644
--- a/pkgs/development/node-packages/overrides.nix
+++ b/pkgs/development/node-packages/overrides.nix
@@ -135,10 +135,6 @@ final: prev: {
     meta = oldAttrs.meta // { broken = since "12"; };
   });
 
-  deltachat-desktop = prev."deltachat-desktop-../../applications/networking/instant-messengers/deltachat-desktop".override (oldAttrs: {
-    meta = oldAttrs.meta // { broken = true; }; # use the top-level package instead
-  });
-
   eask = prev."@emacs-eask/cli".override {
     name = "eask";
   };
diff --git a/pkgs/development/ocaml-modules/camlzip/default.nix b/pkgs/development/ocaml-modules/camlzip/default.nix
index caf3e7a63f0..761453739e2 100644
--- a/pkgs/development/ocaml-modules/camlzip/default.nix
+++ b/pkgs/development/ocaml-modules/camlzip/default.nix
@@ -1,17 +1,24 @@
 {lib, stdenv, fetchurl, zlib, ocaml, findlib}:
 
 let
-  param =
-    if lib.versionAtLeast ocaml.version "4.02"
-    then {
-      version = "1.10";
-      url = "https://github.com/xavierleroy/camlzip/archive/rel110.tar.gz";
-      sha256 = "X0YcczaQ3lFeJEiTIgjSSZ1zi32KFMtmZsP0FFpyfbI=";
+  common = {
       patches = [];
       postPatchInit = ''
         cp META-zip META-camlzip
         echo 'directory="../zip"' >> META-camlzip
       '';
+  };
+  param =
+    if lib.versionAtLeast ocaml.version "4.07"
+    then common // {
+      version = "1.11";
+      url = "https://github.com/xavierleroy/camlzip/archive/rel111.tar.gz";
+      sha256 = "sha256-/7vF3j4cE9wOWScjdtIy0u3pGzJ1UQY9R/3bdPHV7Tc=";
+    } else if lib.versionAtLeast ocaml.version "4.02"
+    then common // {
+      version = "1.10";
+      url = "https://github.com/xavierleroy/camlzip/archive/rel110.tar.gz";
+      sha256 = "X0YcczaQ3lFeJEiTIgjSSZ1zi32KFMtmZsP0FFpyfbI=";
     } else {
       version = "1.05";
       download_id = "1037";
@@ -25,7 +32,7 @@ let
 in
 
 stdenv.mkDerivation {
-  pname = "camlzip";
+  pname = "ocaml${ocaml.version}-camlzip";
   version = param.version;
 
   src = fetchurl {
diff --git a/pkgs/development/ocaml-modules/gen_js_api/default.nix b/pkgs/development/ocaml-modules/gen_js_api/default.nix
index 4baa21c57cf..39f325b5fe7 100644
--- a/pkgs/development/ocaml-modules/gen_js_api/default.nix
+++ b/pkgs/development/ocaml-modules/gen_js_api/default.nix
@@ -10,6 +10,7 @@
 buildDunePackage rec {
   pname = "gen_js_api";
   version = "1.1.1";
+  duneVersion = "3";
 
   src = fetchFromGitHub {
     owner = "LexiFi";
diff --git a/pkgs/development/ocaml-modules/gen_js_api/ojs.nix b/pkgs/development/ocaml-modules/gen_js_api/ojs.nix
index 381fda7acd9..0cfe8f4bbfc 100644
--- a/pkgs/development/ocaml-modules/gen_js_api/ojs.nix
+++ b/pkgs/development/ocaml-modules/gen_js_api/ojs.nix
@@ -7,6 +7,7 @@ buildDunePackage rec {
   pname = "ojs";
 
   inherit (gen_js_api) version src;
+  duneVersion = "3";
 
   propagatedBuildInputs = [ js_of_ocaml-compiler ];
 
diff --git a/pkgs/development/ocaml-modules/janestreet/0.14.nix b/pkgs/development/ocaml-modules/janestreet/0.14.nix
index 67d0e6c7896..8a640437bca 100644
--- a/pkgs/development/ocaml-modules/janestreet/0.14.nix
+++ b/pkgs/development/ocaml-modules/janestreet/0.14.nix
@@ -84,6 +84,7 @@ with self;
 
   async_js = janePackage {
     pname = "async_js";
+    duneVersion = "3";
     hash = "0rld8792lfwbinn9rhrgacivz49vppgy29smpqnvpga89wchjv0v";
     meta.description = "A small library that provide Async support for JavaScript platforms";
     buildInputs = [ js_of_ocaml-ppx ];
@@ -190,6 +191,7 @@ with self;
 
   bonsai = janePackage {
     pname = "bonsai";
+    duneVersion = "3";
     hash = "0k4grabwqc9sy4shzp77bgfvyajvvc0l8qq89ia7cvlwvly7gv6a";
     meta.description = "A library for building dynamic webapps, using Js_of_ocaml";
     buildInputs = [ ppx_pattern_bind ];
@@ -309,6 +311,7 @@ with self;
 
   incr_dom = janePackage {
     pname = "incr_dom";
+    duneVersion = "3";
     hash = "0mi98cwi4npdh5vvcz0pb4sbb9j9dydl52s51rswwc3kn8mipxfx";
     meta.description = "A library for building dynamic webapps, using Js_of_ocaml";
     buildInputs = [ js_of_ocaml-ppx ];
@@ -877,6 +880,7 @@ with self;
 
   virtual_dom = janePackage {
     pname = "virtual_dom";
+    duneVersion = "3";
     hash = "0vcydxx0jhbd5hbriahgp947mc7n3xymyrsfny1c4adk6aaq3c5w";
     meta.description = "OCaml bindings for the virtual-dom library";
     buildInputs = [ js_of_ocaml-ppx ];
diff --git a/pkgs/development/ocaml-modules/janestreet/0.15.nix b/pkgs/development/ocaml-modules/janestreet/0.15.nix
index 5ced2323ea7..676bea0e47f 100644
--- a/pkgs/development/ocaml-modules/janestreet/0.15.nix
+++ b/pkgs/development/ocaml-modules/janestreet/0.15.nix
@@ -87,6 +87,7 @@ with self;
 
   async_js = janePackage {
     pname = "async_js";
+    duneVersion = "3";
     hash = "184j077bz686k5lrqswircnrdqldb316ngpzq7xri1pcsl39sy3q";
     meta.description = "A small library that provide Async support for JavaScript platforms";
     buildInputs = [ js_of_ocaml-ppx ];
@@ -207,6 +208,7 @@ with self;
 
   bonsai = janePackage {
     pname = "bonsai";
+    duneVersion = "3";
     hash = "150zx2g1dmhyrxwqq8j7f2m3hjpmk5bk182ihx2gdbarhw1ainpm";
     meta.description = "A library for building dynamic webapps, using Js_of_ocaml";
     buildInputs = [ ppx_pattern_bind ];
@@ -281,7 +283,8 @@ with self;
 
   core_unix = janePackage {
     pname = "core_unix";
-    hash = "1xzxqzg23in5ivz0v3qshzpr4w92laayscqj9im7jylh2ar1xi0a";
+    version = "0.15.2";
+    hash = "sha256-9f2PiLo+4Bjnfvh3scvIiPHj0wPZozmMMiCTe7vC1EA=";
     meta.description = "Unix-specific portions of Core";
     buildInputs = [ jst-config ];
     propagatedBuildInputs = [ core_kernel expect_test_helpers_core ocaml_intrinsics ppx_jane timezone spawn ];
@@ -292,7 +295,8 @@ with self;
 
   csvfields = janePackage {
     pname = "csvfields";
-    hash = "0z47pq17bw776hzvk48ypbd92ps9vlvl86mnhw3j6cqx4ahbjik3";
+    version = "0.15.1";
+    hash = "sha256-bBupsarwjte2NCncNDFSkrrmMR3EYPn+D7xI9zQOhFA=";
     propagatedBuildInputs = [ core num ];
     meta.description = "Runtime support for ppx_xml_conv and ppx_csv_conv";
   };
@@ -382,6 +386,7 @@ with self;
 
   incr_dom = janePackage {
     pname = "incr_dom";
+    duneVersion = "3";
     hash = "1sija9w2im8vdp61h387w0mww9hh7jgkgsjcccps4lbv936ac7c1";
     meta.description = "A library for building dynamic webapps, using Js_of_ocaml";
     buildInputs = [ js_of_ocaml-ppx ];
@@ -570,6 +575,7 @@ with self;
 
   ppx_css = janePackage {
     pname = "ppx_css";
+    duneVersion = "3";
     hash = "09dpmj3f3m3z1ji9hq775iqr3cfmv5gh7q9zlblizj4wx4y0ibyi";
     meta.description = "A ppx that takes in css strings and produces a module for accessing the unique names defined within";
     propagatedBuildInputs = [ core_kernel ppxlib js_of_ocaml js_of_ocaml-ppx sedlex ];
@@ -900,7 +906,8 @@ with self;
 
   sexp_pretty = janePackage {
     pname = "sexp_pretty";
-    hash = "1p1jspwjvrhm8li22xl0n8wngs12d9g7nc1svk6xc32jralnxblg";
+    version = "0.15.1";
+    hash = "sha256-UJEO2P4C7ZaD110MEfkG4FXfGDVAAW2TAK489faV6SM=";
     minimumOCamlVersion = "4.07";
     meta.description = "S-expression pretty-printer";
     propagatedBuildInputs = [ ppx_base re sexplib ];
@@ -1045,6 +1052,7 @@ with self;
     hash = "15xia9v4ighzm0gv3vbqk9nvg47cvzqmfnl2zr67yxv4b98kyzv3";
     meta.description = "OCaml bindings for the virtual-dom library";
     buildInputs = [ js_of_ocaml-ppx ];
+    duneVersion = "3";
     propagatedBuildInputs = [ core_kernel gen_js_api js_of_ocaml lambdasoup tyxml ];
   };
 
diff --git a/pkgs/development/ocaml-modules/lambda-term/default.nix b/pkgs/development/ocaml-modules/lambda-term/default.nix
index 239cbca4298..c073ddf39cd 100644
--- a/pkgs/development/ocaml-modules/lambda-term/default.nix
+++ b/pkgs/development/ocaml-modules/lambda-term/default.nix
@@ -26,7 +26,7 @@ buildDunePackage rec {
   };
 
   propagatedBuildInputs = [ zed lwt_log lwt_react mew_vi ]
-    ++ lib.optional (lib.versionAtLeast version "3.3.1") [ uucp logs ] ;
+    ++ lib.optionals (lib.versionAtLeast version "3.3.1") [ uucp logs ] ;
 
   meta = {
     description = "Terminal manipulation library for OCaml";
diff --git a/pkgs/development/ocaml-modules/ocsigen-toolkit/default.nix b/pkgs/development/ocaml-modules/ocsigen-toolkit/default.nix
index 60a07d30d05..aaa68c21446 100644
--- a/pkgs/development/ocaml-modules/ocsigen-toolkit/default.nix
+++ b/pkgs/development/ocaml-modules/ocsigen-toolkit/default.nix
@@ -10,6 +10,12 @@ stdenv.mkDerivation rec {
  propagatedBuildInputs = [ calendar js_of_ocaml-ppx_deriving_json eliom ];
  nativeBuildInputs = [ ocaml findlib opaline eliom ];
 
+ # Remove widgets not compatible with jsoo 4.1.0
+ # https://github.com/ocsigen/ocsigen-toolkit/issues/221
+ preConfigure = ''
+   rm src/widgets/ot_{carousel,drawer,swipe,tongue}.eliom{,i}
+ '';
+
   strictDeps = true;
 
  installPhase = ''
diff --git a/pkgs/development/python-modules/GitPython/hardcode-git-path.patch b/pkgs/development/python-modules/GitPython/hardcode-git-path.patch
deleted file mode 100644
index 93747995992..00000000000
--- a/pkgs/development/python-modules/GitPython/hardcode-git-path.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/git/cmd.py b/git/cmd.py
-index a4faefe..51ad442 100644
---- a/git/cmd.py
-+++ b/git/cmd.py
-@@ -175,7 +175,7 @@ class Git(LazyMixin):
- 
-     # CONFIGURATION
- 
--    git_exec_name = "git"           # default that should work on linux and windows
-+    git_exec_name = "@git@/bin/git"
- 
-     # Enables debugging of GitPython's git commands
-     GIT_PYTHON_TRACE = os.environ.get("GIT_PYTHON_TRACE", False)
diff --git a/pkgs/development/python-modules/ailment/default.nix b/pkgs/development/python-modules/ailment/default.nix
index 6253c43d60c..5333d2e29fa 100644
--- a/pkgs/development/python-modules/ailment/default.nix
+++ b/pkgs/development/python-modules/ailment/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "ailment";
-  version = "9.2.27";
+  version = "9.2.28";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-siODqRqji2u+EJag/wTXCZG4LATNxggpMtqMHZAfQ9o=";
+    hash = "sha256-6+3lZygQEezEbGIMbB6NINjVDkgt5sYO2FV5wpienuY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/aiogithubapi/default.nix b/pkgs/development/python-modules/aiogithubapi/default.nix
index 051913ccce5..283fd87c55f 100644
--- a/pkgs/development/python-modules/aiogithubapi/default.nix
+++ b/pkgs/development/python-modules/aiogithubapi/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "aiogithubapi";
-  version = "22.10.1";
+  version = "22.12.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -21,8 +21,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "ludeeus";
     repo = pname;
-    rev = version;
-    hash = "sha256-ceBuqaMqqL6qwN52765MG4sLt+08hx2G9rUVNC7x6ik=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-j7ikJS6lcqr7K4fU/EL43lFlWtGvPT4V9JC2Iqhi0ec=";
   };
 
   postPatch = ''
@@ -60,6 +60,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python client for the GitHub API";
     homepage = "https://github.com/ludeeus/aiogithubapi";
+    changelog = "https://github.com/ludeeus/aiogithubapi/releases/tag/${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/aiohomekit/default.nix b/pkgs/development/python-modules/aiohomekit/default.nix
index a4e39cb98aa..40d9003a7ba 100644
--- a/pkgs/development/python-modules/aiohomekit/default.nix
+++ b/pkgs/development/python-modules/aiohomekit/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "aiohomekit";
-  version = "2.3.5";
+  version = "2.4.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "Jc2k";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-rZagtP0DwYr6+eQOEaLXRnZUnhKXcWbn6wOJPAA6WVM=";
+    hash = "sha256-xgk42/g5mRQiTjYuUnXCfLnQm6DNIJsvMbBOhr2NncQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/aioshelly/default.nix b/pkgs/development/python-modules/aioshelly/default.nix
index c4881dcdd56..b3cb92b95fe 100644
--- a/pkgs/development/python-modules/aioshelly/default.nix
+++ b/pkgs/development/python-modules/aioshelly/default.nix
@@ -1,14 +1,15 @@
 { lib
 , aiohttp
+, bluetooth-data-tools
 , buildPythonPackage
 , fetchFromGitHub
-, netifaces
+, orjson
 , pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "aioshelly";
-  version = "4.1.2";
+  version = "5.1.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -17,12 +18,13 @@ buildPythonPackage rec {
     owner = "home-assistant-libs";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-0BxbcWA2Kdk1xTSKN/dH9LJc3yI60kmyMCrK77tqyNE=";
+    hash = "sha256-jhoPgwydB/DZx7hC16XgM0UBhmByVZRT5b7BDETA+FY=";
   };
 
   propagatedBuildInputs = [
     aiohttp
-    netifaces
+    bluetooth-data-tools
+    orjson
   ];
 
   # Project has no test
diff --git a/pkgs/development/python-modules/aiosmb/default.nix b/pkgs/development/python-modules/aiosmb/default.nix
index 70737dcca79..97cbd60db1a 100644
--- a/pkgs/development/python-modules/aiosmb/default.nix
+++ b/pkgs/development/python-modules/aiosmb/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "aiosmb";
-  version = "0.4.3";
+  version = "0.4.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-jJVXGBK8wWXEGvCzOTicHUh9jH35d1ARIxkLwn/ctjM=";
+    hash = "sha256-IGIEmM9eZ5T+op3ctGr72oy/cU48+OHaFJaZ8DRTY38=";
   };
 
   propagatedBuildInputs = [
@@ -49,6 +49,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python SMB library";
     homepage = "https://github.com/skelsec/aiosmb";
+    changelog = "https://github.com/skelsec/aiosmb/releases/tag/${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/aioswitcher/default.nix b/pkgs/development/python-modules/aioswitcher/default.nix
index 5a671bce26c..4106049be0b 100644
--- a/pkgs/development/python-modules/aioswitcher/default.nix
+++ b/pkgs/development/python-modules/aioswitcher/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "aioswitcher";
-  version = "3.2.0";
+  version = "3.2.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "TomerFi";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-Vob5p0+SlZR2eHj5Br2pWp3FCxW+zgY6crh8jrkreT0=";
+    hash = "sha256-k3xmW8aMBz6dbWuLnd6tw2BFoTuD80fpY7q2NfYqMlw=";
   };
 
   nativeBuildInputs = [
@@ -60,6 +60,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python module to interact with Switcher water heater";
     homepage = "https://github.com/TomerFi/aioswitcher";
+    changelog = "https://github.com/TomerFi/aioswitcher/releases/tag/${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/aiounifi/default.nix b/pkgs/development/python-modules/aiounifi/default.nix
index b75b9ac3181..2ac587ddff3 100644
--- a/pkgs/development/python-modules/aiounifi/default.nix
+++ b/pkgs/development/python-modules/aiounifi/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "aiounifi";
-  version = "41";
+  version = "42";
 
   disabled = pythonOlder "3.9";
 
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "Kane610";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-rBluo4080m9jFnquXaQY/Cntp7wHToY16aNFhzrQJs8=";
+    hash = "sha256-vScAWEjdzXSy1gktz+Tfhx13S6OeXZbwZgoS6D1BBtk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/angr/default.nix b/pkgs/development/python-modules/angr/default.nix
index f592ba98e39..6f3319e8375 100644
--- a/pkgs/development/python-modules/angr/default.nix
+++ b/pkgs/development/python-modules/angr/default.nix
@@ -11,7 +11,7 @@
 , cppheaderparser
 , dpkt
 , fetchFromGitHub
-, GitPython
+, gitpython
 , itanium-demangler
 , mulpyplexer
 , nampa
@@ -31,7 +31,7 @@
 
 buildPythonPackage rec {
   pname = "angr";
-  version = "9.2.27";
+  version = "9.2.28";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -40,7 +40,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-ttq9V+Bhmbeit3OBUquIlLW7HQeCe2+KE/QkuvLJMjE=";
+    hash = "sha256-16/hocVfd2RI8qQ9Qt7EM/gGfyGpWabyZhtfwOscqQY=";
   };
 
   propagatedBuildInputs = [
@@ -53,7 +53,7 @@ buildPythonPackage rec {
     cle
     cppheaderparser
     dpkt
-    GitPython
+    gitpython
     itanium-demangler
     mulpyplexer
     nampa
diff --git a/pkgs/development/python-modules/apache-airflow/default.nix b/pkgs/development/python-modules/apache-airflow/default.nix
index a916ac01144..cbedbeb70dc 100644
--- a/pkgs/development/python-modules/apache-airflow/default.nix
+++ b/pkgs/development/python-modules/apache-airflow/default.nix
@@ -24,7 +24,7 @@
 , flask-caching
 , flask-session
 , flask-wtf
-, GitPython
+, gitpython
 , graphviz
 , gunicorn
 , httpx
@@ -160,7 +160,7 @@ buildPythonPackage rec {
     flask-session
     flask-wtf
     flask-login
-    GitPython
+    gitpython
     graphviz
     gunicorn
     httpx
diff --git a/pkgs/development/python-modules/archinfo/default.nix b/pkgs/development/python-modules/archinfo/default.nix
index 7081f426c66..0c81edc1cc2 100644
--- a/pkgs/development/python-modules/archinfo/default.nix
+++ b/pkgs/development/python-modules/archinfo/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "archinfo";
-  version = "9.2.27";
+  version = "9.2.28";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-dzD73jmbeQQY/IjF6XRdOcDIhR2lzeA2XQdipssiT00=";
+    hash = "sha256-LUrLO9BFbpB2p6PtTZPdpLsGHPh088aPHIyoxgv4dGg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/asysocks/default.nix b/pkgs/development/python-modules/asysocks/default.nix
index e4f5f8758b1..863a2fd5417 100644
--- a/pkgs/development/python-modules/asysocks/default.nix
+++ b/pkgs/development/python-modules/asysocks/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "asysocks";
-  version = "0.2.2";
+  version = "0.2.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-rhqML/w8Hp8xZogjc2ZD+Y9C9c/w1e4X7WNoFaLz9Ps=";
+    hash = "sha256-JHGkQmxt/29GRnVS/GLU1g5Yc+q6voKNOh3n3LfcfcY=";
   };
 
   propagatedBuildInputs = [
@@ -31,6 +31,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python Socks4/5 client and server library";
     homepage = "https://github.com/skelsec/asysocks";
+    changelog = "https://github.com/skelsec/asysocks/releases/tag/${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/azure-storage-queue/default.nix b/pkgs/development/python-modules/azure-storage-queue/default.nix
index 515b3f398df..aa69731809b 100644
--- a/pkgs/development/python-modules/azure-storage-queue/default.nix
+++ b/pkgs/development/python-modules/azure-storage-queue/default.nix
@@ -3,20 +3,23 @@
 , fetchPypi
 , azure-common
 , azure-storage-common
+, msrest
 }:
 
 buildPythonPackage rec {
   pname = "azure-storage-queue";
-  version = "2.1.0";
+  version = "12.5.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "14e82d3691f1bbd23f2aff143a6c17af3c297164f6e597d223b65a67051ba278";
+    sha256 = "sha256-OzdEJK9y0y2v+Lr5tkYwB0w6iz/VMypFIWs7yWvHsXI=";
+    extension = "zip";
   };
 
   propagatedBuildInputs = [
     azure-common
     azure-storage-common
+    msrest
   ];
 
   # has no tests
diff --git a/pkgs/development/python-modules/bandit/default.nix b/pkgs/development/python-modules/bandit/default.nix
index cf1bbd9c54a..73de9a4688d 100644
--- a/pkgs/development/python-modules/bandit/default.nix
+++ b/pkgs/development/python-modules/bandit/default.nix
@@ -1,31 +1,35 @@
-{ buildPythonPackage
+{ lib
+, buildPythonPackage
 , fetchPypi
-, lib
 , isPy3k
-
-# pythonPackages
-, GitPython
+, pythonOlder
+, gitpython
 , pbr
 , pyyaml
-, six
+, rich
 , stevedore
 }:
 
 buildPythonPackage rec {
   pname = "bandit";
   version = "1.7.4";
-  disabled = !isPy3k;
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-LWOoxXNBe64ziWLUubBvvGCA907NlVoJKEnh5lxxe9I=";
+    hash = "sha256-LWOoxXNBe64ziWLUubBvvGCA907NlVoJKEnh5lxxe9I=";
   };
 
-  propagatedBuildInputs = [
-    GitPython
+  nativeBuildInputs = [
     pbr
+  ];
+
+  propagatedBuildInputs = [
+    gitpython
     pyyaml
-    six
+    rich
     stevedore
   ];
 
@@ -33,12 +37,15 @@ buildPythonPackage rec {
   #   and this requires Network Connectivity
   doCheck = false;
 
-  meta = {
+  pythonImportsCheck = [
+    "bandit"
+  ];
+
+  meta = with lib; {
     description = "Security oriented static analyser for python code";
-    homepage = "https://bandit.readthedocs.io/en/latest/";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [
-      kamadorueda
-    ];
+    homepage = "https://bandit.readthedocs.io/";
+    changelog = "https://github.com/PyCQA/bandit/releases/tag/${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ kamadorueda ];
   };
 }
diff --git a/pkgs/development/python-modules/bellows/default.nix b/pkgs/development/python-modules/bellows/default.nix
index 1125e45e628..041af30ddfd 100644
--- a/pkgs/development/python-modules/bellows/default.nix
+++ b/pkgs/development/python-modules/bellows/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "bellows";
-  version = "0.34.4";
+  version = "0.34.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "zigpy";
     repo = "bellows";
     rev = "refs/tags/${version}";
-    hash = "sha256-JUI2jUUc2i+/6mRYNhmuAOmAS4nCzMZwyM8ug0pOFfc=";
+    hash = "sha256-GJG3rmJoBxDrqzsNY2r1cEywRfB4tlLn2DDsaDEI3Bo=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/bleak-retry-connector/default.nix b/pkgs/development/python-modules/bleak-retry-connector/default.nix
index b040ef83d9d..6961a9c9322 100644
--- a/pkgs/development/python-modules/bleak-retry-connector/default.nix
+++ b/pkgs/development/python-modules/bleak-retry-connector/default.nix
@@ -1,6 +1,7 @@
 { lib
 , async-timeout
 , bleak
+, bluetooth-adapters
 , dbus-fast
 , buildPythonPackage
 , fetchFromGitHub
@@ -12,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "bleak-retry-connector";
-  version = "2.9.0";
+  version = "2.10.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +22,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-U9Urxu7BdTTecONcb2d6jg9oE6fmdNMEVSayLNQiyvY=";
+    hash = "sha256-QAQQ53T3MTNNaK0rzsBb2F1/qMvMHtr6/+3k1CAKXi0=";
   };
 
   postPatch = ''
@@ -36,6 +37,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     async-timeout
     bleak
+    bluetooth-adapters
     dbus-fast
   ];
 
diff --git a/pkgs/development/python-modules/bluetooth-adapters/default.nix b/pkgs/development/python-modules/bluetooth-adapters/default.nix
index b696b6b9369..6e750422120 100644
--- a/pkgs/development/python-modules/bluetooth-adapters/default.nix
+++ b/pkgs/development/python-modules/bluetooth-adapters/default.nix
@@ -3,18 +3,21 @@
 , pythonOlder
 , fetchFromGitHub
 , poetry-core
+, aiohttp
 , async-timeout
 , bleak
 , dbus-fast
+, mac-vendor-lookup
 , myst-parser
 , pytestCheckHook
 , sphinxHook
 , sphinx-rtd-theme
+, usb-devices
 }:
 
 buildPythonPackage rec {
   pname = "bluetooth-adapters";
-  version = "0.8.0";
+  version = "0.12.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -23,7 +26,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-K5EeDcGcjrZYQTbuYAzT7XhcAqpYW1w/jP5T0cOPsVU=";
+    hash = "sha256-meBCjWKAIN6sNrBp/Riptu9igvVwIPf0G2x+Z3Kqkts=";
   };
 
   postPatch = ''
@@ -44,9 +47,12 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
+    aiohttp
     async-timeout
     bleak
     dbus-fast
+    mac-vendor-lookup
+    usb-devices
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/bluetooth-auto-recovery/default.nix b/pkgs/development/python-modules/bluetooth-auto-recovery/default.nix
index a4353a19204..3a673c9c264 100644
--- a/pkgs/development/python-modules/bluetooth-auto-recovery/default.nix
+++ b/pkgs/development/python-modules/bluetooth-auto-recovery/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "bluetooth-auto-recovery";
-  version = "0.5.1";
+  version = "0.5.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-LvLav3OCud1EZe3JXvjbuuKU9xtd6ywrx6pZLLP0N/A=";
+    hash = "sha256-C3CO4nqKVTjD07QturJNeg0GLx2N9cbsBatXcehJLRs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/btrfsutil/default.nix b/pkgs/development/python-modules/btrfsutil/default.nix
new file mode 100644
index 00000000000..d529ec09c70
--- /dev/null
+++ b/pkgs/development/python-modules/btrfsutil/default.nix
@@ -0,0 +1,26 @@
+{ lib
+, buildPythonPackage
+, btrfs-progs
+}:
+buildPythonPackage {
+  pname = "btrfsutil";
+  inherit (btrfs-progs) version src;
+  format = "setuptools";
+
+  buildInputs = [ btrfs-progs ];
+
+  preConfigure = ''
+    cd libbtrfsutil/python
+  '';
+
+  # No tests
+  doCheck = false;
+  pythonImportsCheck = [ "btrfsutil" ];
+
+  meta = with lib; {
+    description = "Library for managing Btrfs filesystems";
+    homepage = "https://btrfs.wiki.kernel.org/";
+    license = licenses.lgpl21Plus;
+    maintainers = with maintainers; [ raskin lopsided98 ];
+  };
+}
diff --git a/pkgs/development/python-modules/bundlewrap/default.nix b/pkgs/development/python-modules/bundlewrap/default.nix
index e4eae0d3fe7..75e3cd4f4b3 100644
--- a/pkgs/development/python-modules/bundlewrap/default.nix
+++ b/pkgs/development/python-modules/bundlewrap/default.nix
@@ -32,7 +32,7 @@ buildPythonPackage rec {
   nativeBuildInputs = [ setuptools ];
   propagatedBuildInputs = [
     cryptography jinja2 Mako passlib pyyaml requests tomlkit librouteros
-  ] ++ lib.optional (pythonOlder "3.11") [ rtoml ];
+  ] ++ lib.optionals (pythonOlder "3.11") [ rtoml ];
 
   pythonImportsCheck = [ "bundlewrap" ];
 
diff --git a/pkgs/development/python-modules/cccolutils/default.nix b/pkgs/development/python-modules/cccolutils/default.nix
index e231624e40f..2e3e1778d17 100644
--- a/pkgs/development/python-modules/cccolutils/default.nix
+++ b/pkgs/development/python-modules/cccolutils/default.nix
@@ -1,23 +1,49 @@
-{ lib, buildPythonPackage, fetchPypi, isPy3k, krb5Full, nose, GitPython, mock, git }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, git
+, gitpython
+, krb5
+, mock
+, pytestCheckHook
+, pythonOlder
+}:
 
 buildPythonPackage rec {
-  pname = "CCColUtils";
+  pname = "cccolutils";
   version = "1.5";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    inherit pname version;
-    sha256 = "1gwcq4xan9as1j3q9k2zqrywxp46qx0ljwxbck9id2fvilds6ck3";
+    pname = "CCColUtils";
+    inherit version;
+    hash = "sha256-YzKjG43biRbTZKtzSUHHhtzOfcZfzISHDFolqzrBjL8=";
   };
 
-  buildInputs = [ krb5Full ];
-  propagatedBuildInputs = [ nose GitPython mock git ];
+  buildInputs = [
+    krb5
+  ];
+
+  propagatedBuildInputs = [
+    git
+    gitpython
+    mock
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
 
-  doCheck = isPy3k; # needs unpackaged module to run tests on python2
+  pythonImportsCheck = [
+    "cccolutils"
+  ];
 
   meta = with lib; {
     description = "Python Kerberos 5 Credential Cache Collection Utilities";
     homepage = "https://pagure.io/cccolutils";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     maintainers = with maintainers; [ disassembler ];
   };
 }
diff --git a/pkgs/development/python-modules/chat-downloader/default.nix b/pkgs/development/python-modules/chat-downloader/default.nix
index 5b8a75c7c12..741ed379136 100644
--- a/pkgs/development/python-modules/chat-downloader/default.nix
+++ b/pkgs/development/python-modules/chat-downloader/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "chat-downloader";
-  version = "0.2.2";
+  version = "0.2.3";
   format = "setuptools";
 
   src = fetchPypi {
     inherit version pname;
-    sha256 = "f095cd90c312eecec647de2ff49f3ef4cfc30e3935731d21315380f331bdd095";
+    sha256 = "e19f961480b14b55d03d4d4aaa766d46131bdf2ea8a79b47d20037dfd980201a";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/claripy/default.nix b/pkgs/development/python-modules/claripy/default.nix
index 9afd28132e1..5ccf2e25743 100644
--- a/pkgs/development/python-modules/claripy/default.nix
+++ b/pkgs/development/python-modules/claripy/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "claripy";
-  version = "9.2.27";
+  version = "9.2.28";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-7tn/OdPNUnbF2T0wASCBfuTZ0zI1j8GY5kh0QwbzS+8=";
+    hash = "sha256-CGYX8IzVBqhF0IenTFKtx79J81X6UGkvm/XvFovnHYE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/cle/default.nix b/pkgs/development/python-modules/cle/default.nix
index 88d472a9de7..1a8a3f2b871 100644
--- a/pkgs/development/python-modules/cle/default.nix
+++ b/pkgs/development/python-modules/cle/default.nix
@@ -16,7 +16,7 @@
 
 let
   # The binaries are following the argr projects release cycle
-  version = "9.2.27";
+  version = "9.2.28";
 
   # Binary files from https://github.com/angr/binaries (only used for testing and only here)
   binaries = fetchFromGitHub {
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-PP8TdAiyqdcgJNz5jYjAFcuv42ca0zfLwL289XKDqk4=";
+    hash = "sha256-t3TO1rHf5iA+9WW3Adi37fL7XjRUZFPowUWchX9eEVI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/cryptolyzer/default.nix b/pkgs/development/python-modules/cryptolyzer/default.nix
index 2fd90b23bee..5928a9b90ec 100644
--- a/pkgs/development/python-modules/cryptolyzer/default.nix
+++ b/pkgs/development/python-modules/cryptolyzer/default.nix
@@ -1,22 +1,26 @@
 { lib
+, attrs
 , buildPythonPackage
-, fetchPypi
 , certvalidator
-, attrs
-, six
-, urllib3
 , cryptoparser
+, fetchPypi
+, pythonOlder
 , requests
+, six
+, urllib3
 }:
 
 buildPythonPackage rec {
   pname = "cryptolyzer";
-  version = "0.8.1";
+  version = "0.8.2";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "CryptoLyzer";
     inherit version;
-    sha256 = "sha256-FbxSjKxhzlpj3IezuLCQvoeZMG1q+OE/yn5vB/XE1rI=";
+    hash = "sha256-Bo8w9ijJu9IWdgr8OQws2iErzmuxUhs9YE6NAydPYgM=";
   };
 
   propagatedBuildInputs = [
@@ -28,13 +32,17 @@ buildPythonPackage rec {
     requests
   ];
 
-  doCheck = false; # Tests require networking
+  # Tests require networking
+  doCheck = false;
 
-  pythonImportsCheck = [ "cryptolyzer" ];
+  pythonImportsCheck = [
+    "cryptolyzer"
+  ];
 
   meta = with lib; {
-    description = "Fast and flexible cryptographic protocol analyzer";
+    description = "Cryptographic protocol analyzer";
     homepage = "https://gitlab.com/coroner/cryptolyzer";
+    changelog = "https://gitlab.com/coroner/cryptolyzer/-/blob/v${version}/CHANGELOG.md";
     license = licenses.mpl20;
     maintainers = with maintainers; [ kranzes ];
   };
diff --git a/pkgs/development/python-modules/cryptoparser/default.nix b/pkgs/development/python-modules/cryptoparser/default.nix
index cfac7f20376..c4771b39499 100644
--- a/pkgs/development/python-modules/cryptoparser/default.nix
+++ b/pkgs/development/python-modules/cryptoparser/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "cryptoparser";
-  version = "0.8.0";
+  version = "0.8.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-kJg8d1PoGIC0feefbJM8oyXcRyMGdg1wWkQUl/nSNCo=";
+    hash = "sha256-eLQNqeCUnjcxWbazhWHtqJJgvPUMH42fboU5y2ZMy44=";
   };
 
   propagatedBuildInputs = [
@@ -23,11 +23,14 @@ buildPythonPackage rec {
     python-dateutil
   ];
 
-  pythonImportsCheck = [ "cryptoparser" ];
+  pythonImportsCheck = [
+    "cryptoparser"
+  ];
 
   meta = with lib; {
-    description = "Fast and flexible security protocol parser and generator";
+    description = "Security protocol parser and generator";
     homepage = "https://gitlab.com/coroner/cryptoparser";
+    changelog = "https://gitlab.com/coroner/cryptoparser/-/blob/v${version}/CHANGELOG.md";
     license = licenses.mpl20;
     maintainers = with maintainers; [ kranzes ];
   };
diff --git a/pkgs/development/python-modules/cvelib/default.nix b/pkgs/development/python-modules/cvelib/default.nix
index 49b5c759069..8bdcb400b96 100644
--- a/pkgs/development/python-modules/cvelib/default.nix
+++ b/pkgs/development/python-modules/cvelib/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "cvelib";
-  version = "1.1.0";
+  version = "1.2.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "RedHatProductSecurity";
     repo = "cvelib";
     rev = "tags/${version}";
-    hash = "sha256-MZzCTUleEddIlZBRhxD8ZgaWAOFcpa5hvNuIjrBJRzk=";
+    hash = "sha256-8qlXwEbgLRZ1qYtBJ1c0nv6qfIOW5zAK9eOS+n+afWQ=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = "v${version}";
diff --git a/pkgs/development/python-modules/dateparser/default.nix b/pkgs/development/python-modules/dateparser/default.nix
index 7db2e1d15b7..950afaabb8d 100644
--- a/pkgs/development/python-modules/dateparser/default.nix
+++ b/pkgs/development/python-modules/dateparser/default.nix
@@ -13,7 +13,7 @@
 , langdetect
 , parameterized
 , pytestCheckHook
-, GitPython
+, gitpython
 , parsel
 , requests
 , ruamel-yaml
@@ -50,7 +50,7 @@ buildPythonPackage rec {
   checkInputs = [
     parameterized
     pytestCheckHook
-    GitPython
+    gitpython
     parsel
     requests
     ruamel-yaml
diff --git a/pkgs/development/python-modules/db-dtypes/default.nix b/pkgs/development/python-modules/db-dtypes/default.nix
index 8efa6983150..db9d6bde161 100644
--- a/pkgs/development/python-modules/db-dtypes/default.nix
+++ b/pkgs/development/python-modules/db-dtypes/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "db-dtypes";
-  version = "1.0.4";
+  version = "1.0.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "googleapis";
     repo = "python-db-dtypes-pandas";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ilcVog6mhF83GVa68BppUzvKNRPdSDXla2MU6M2EzLg=";
+    hash = "sha256-RlSze0e2NNHJ6kAbj9TX58MaEPutyjcLXIOYjpugO6o=";
   };
 
   propagatedBuildInputs = [
@@ -41,6 +41,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Pandas Data Types for SQL systems (BigQuery, Spanner)";
     homepage = "https://github.com/googleapis/python-db-dtypes-pandas";
+    changelog = "https://github.com/googleapis/python-db-dtypes-pandas/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/django/4.nix b/pkgs/development/python-modules/django/4.nix
index 935abb99c8d..cb6f40e422c 100644
--- a/pkgs/development/python-modules/django/4.nix
+++ b/pkgs/development/python-modules/django/4.nix
@@ -43,14 +43,14 @@
 
 buildPythonPackage rec {
   pname = "Django";
-  version = "4.1.3";
+  version = "4.1.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Z4u/yGBOskbtVOIGPwdl8TsyGlBSa9yMsflD7af6MfE=";
+    hash = "sha256-04pOEI0jhsuWN9pmqC3I0HM8rt5Mg8Sv29p4r0IUIRs=";
   };
 
   patches = [
@@ -113,6 +113,7 @@ buildPythonPackage rec {
   '';
 
   meta = with lib; {
+    changelog = "https://docs.djangoproject.com/en/${lib.versions.majorMinor version}/releases/${version}/";
     description = "A high-level Python Web framework that encourages rapid development and clean, pragmatic design.";
     homepage = "https://www.djangoproject.com";
     license = licenses.bsd3;
diff --git a/pkgs/development/python-modules/docstring-to-markdown/default.nix b/pkgs/development/python-modules/docstring-to-markdown/default.nix
index 432f77220ad..9a17d19a9d1 100644
--- a/pkgs/development/python-modules/docstring-to-markdown/default.nix
+++ b/pkgs/development/python-modules/docstring-to-markdown/default.nix
@@ -2,17 +2,21 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "docstring-to-markdown";
-  version = "0.10";
+  version = "0.11";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "python-lsp";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "0rflkbms94wkcypjcnz30bc4w4iww91h7sqq3j2b6ypzl4g48csa";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-4Jl1XJpxwbxGWxdF4bOerjHyzHCIHtrydklwwk1WGs4=";
   };
 
   patches = [
@@ -31,6 +35,7 @@ buildPythonPackage rec {
   meta = with lib; {
     homepage = "https://github.com/python-lsp/docstring-to-markdown";
     description = "On the fly conversion of Python docstrings to markdown";
+    changelog = "https://github.com/python-lsp/docstring-to-markdown/releases/tag/v${version}";
     license = licenses.lgpl2Plus;
     maintainers = with maintainers; [ doronbehar ];
   };
diff --git a/pkgs/development/python-modules/flake8-bugbear/default.nix b/pkgs/development/python-modules/flake8-bugbear/default.nix
index d80b703522d..d1abca2b6e5 100644
--- a/pkgs/development/python-modules/flake8-bugbear/default.nix
+++ b/pkgs/development/python-modules/flake8-bugbear/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "flake8-bugbear";
-  version = "22.10.27";
+  version = "22.12.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "PyCQA";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-pzVzCEkndbesX3tzuuPqtpEmCd5/bSuQmJ2J2IPFRMk=";
+    hash = "sha256-/XV0dwCkp1kOrXepEaPPEWefBphGB6rQPeTWmo3cHPY=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/furo/default.nix b/pkgs/development/python-modules/furo/default.nix
index 7ee4c0999b4..14401f7e53f 100644
--- a/pkgs/development/python-modules/furo/default.nix
+++ b/pkgs/development/python-modules/furo/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "furo";
-  version = "2022.9.29";
+  version = "2022.12.7";
   format = "wheel";
 
   disable = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     inherit pname version format;
     dist = "py3";
     python = "py3";
-    hash = "sha256-VZ7heZnA9ScoSB3PaxsM+Ml0PmjF46GMtFp5knR4aak=";
+    hash = "sha256-fLdsEqJe9l24WrB0PfkHVz0DAnozYx8X0mflmOuxkfc=";
   };
 
   propagatedBuildInputs = [
@@ -45,6 +45,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "A clean customizable documentation theme for Sphinx";
     homepage = "https://github.com/pradyunsg/furo";
+    changelog = "https://github.com/pradyunsg/furo/blob/${version}/docs/changelog.md";
     license = licenses.mit;
     maintainers = with maintainers; [ Luflosi ];
   };
diff --git a/pkgs/development/python-modules/gamble/default.nix b/pkgs/development/python-modules/gamble/default.nix
index 0df84510efd..3b62893e149 100644
--- a/pkgs/development/python-modules/gamble/default.nix
+++ b/pkgs/development/python-modules/gamble/default.nix
@@ -7,12 +7,14 @@
 
 buildPythonPackage rec {
   pname = "gamble";
-  version = "0.10";
-  disabled = pythonOlder "3.6";
+  version = "0.11";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1lb5x076blnnz2hj7k92pyq0drbjwsls6pmnabpvyvs4ddhz5w9w";
+    hash = "sha256-zsEBqhKidgO1e0lpKhw+LY75I2Df+IefNLaSkBBFKFU=";
   };
 
   checkInputs = [
@@ -26,6 +28,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Collection of gambling classes/tools";
     homepage = "https://github.com/jpetrucciani/gamble";
+    changelog = "https://github.com/jpetrucciani/gamble/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ jpetrucciani ];
   };
diff --git a/pkgs/development/python-modules/gcal-sync/default.nix b/pkgs/development/python-modules/gcal-sync/default.nix
index 5e4b40e612b..110b04f658d 100644
--- a/pkgs/development/python-modules/gcal-sync/default.nix
+++ b/pkgs/development/python-modules/gcal-sync/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "gcal-sync";
-  version = "4.0.3";
+  version = "4.0.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "allenporter";
     repo = "gcal_sync";
     rev = "refs/tags/${version}";
-    hash = "sha256-FDxyuSR0Ekal/3+OhR3Z0pkiWYMToeCcfwBQp3bjnyw=";
+    hash = "sha256-g0hnwUX33qZ36JgKx3KHP3BciYujQ+Eahe6bF3m87FM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/git-sweep/default.nix b/pkgs/development/python-modules/git-sweep/default.nix
index 2d7da28535c..0f223b03760 100644
--- a/pkgs/development/python-modules/git-sweep/default.nix
+++ b/pkgs/development/python-modules/git-sweep/default.nix
@@ -1,24 +1,32 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, GitPython
+, gitpython
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "git-sweep";
   version = "0.1.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1csp0zd049d643d409rfivbswwzrayb4i6gkypp5mc27fb1z2afd";
+    hash = "sha256-zSnxw3JHsFru9fOZSJZX+XOu144uJ0DaIKYlAtoHV7M=";
   };
 
-  propagatedBuildInputs = [ GitPython ];
+  propagatedBuildInputs = [
+    gitpython
+  ];
 
-  # no tests
+  # Module has no tests
   doCheck = false;
 
-  pythonImportsCheck = [ "gitsweep" ];
+  pythonImportsCheck = [
+    "gitsweep"
+  ];
 
   meta = with lib; {
     description = "A command-line tool that helps you clean up Git branches";
@@ -26,5 +34,4 @@ buildPythonPackage rec {
     license = licenses.mit;
     maintainers = with maintainers; [ pSub ];
   };
-
 }
diff --git a/pkgs/development/python-modules/GitPython/default.nix b/pkgs/development/python-modules/gitpython/default.nix
index 8d89c1af8d0..e577a1e508a 100644
--- a/pkgs/development/python-modules/GitPython/default.nix
+++ b/pkgs/development/python-modules/gitpython/default.nix
@@ -1,44 +1,47 @@
 { lib
 , buildPythonPackage
+, ddt
 , fetchFromGitHub
-, substituteAll
-, git
 , gitdb
-, ddt
+, pkgs
 , pythonOlder
+, substituteAll
 , typing-extensions
 }:
 
 buildPythonPackage rec {
   pname = "gitpython";
-  version = "3.1.27";
+  version = "3.1.29";
+  format = "setuptools";
+
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "gitpython-developers";
     repo = "GitPython";
     rev = version;
-    sha256 = "sha256-RA+6JFXHUQoXGErV8+aYuJPsfXzNSZK3kTm6eMbQIss=";
+    hash = "sha256-RNDBoGWnkirPZjxn5oqH3zwYqVFLedNrSRpZOHU0j+w=";
   };
 
-  patches = [
-    (substituteAll {
-      src = ./hardcode-git-path.patch;
-      inherit git;
-    })
-  ];
-
   propagatedBuildInputs = [
-    gitdb
     ddt
+    gitdb
+    pkgs.gitMinimal
   ] ++ lib.optionals (pythonOlder "3.10") [
     typing-extensions
   ];
 
+  postPatch = ''
+    substituteInPlace git/cmd.py \
+      --replace 'git_exec_name = "git"' 'git_exec_name = "${pkgs.gitMinimal}/bin/git"'
+  '';
+
   # Tests require a git repo
   doCheck = false;
 
-  pythonImportsCheck = [ "git" ];
+  pythonImportsCheck = [
+    "git"
+  ];
 
   meta = with lib; {
     description = "Python Git Library";
diff --git a/pkgs/development/python-modules/google-cloud-bigtable/default.nix b/pkgs/development/python-modules/google-cloud-bigtable/default.nix
index b45eb0ce120..9b785a61c90 100644
--- a/pkgs/development/python-modules/google-cloud-bigtable/default.nix
+++ b/pkgs/development/python-modules/google-cloud-bigtable/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-bigtable";
-  version = "2.13.2";
+  version = "2.14.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-a0R8CefN6gtIYqtNdCW9QKJulsbDnH6dFuUfTp8jUnA=";
+    hash = "sha256-hJgEFRr65eGuV0xx/4leyBZzdd9jt/SEKm3MApzHCGA=";
   };
 
   propagatedBuildInputs = [
@@ -54,6 +54,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Google Cloud Bigtable API client library";
     homepage = "https://github.com/googleapis/python-bigtable";
+    changelog = "https://github.com/googleapis/python-bigtable/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ costrouc ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-logging/default.nix b/pkgs/development/python-modules/google-cloud-logging/default.nix
index 7fbc6ad0bb5..2fb93c8a73d 100644
--- a/pkgs/development/python-modules/google-cloud-logging/default.nix
+++ b/pkgs/development/python-modules/google-cloud-logging/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-logging";
-  version = "3.3.0";
+  version = "3.3.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-qr2RiIFl1njOOhoblub93foMQ63xpgp9Wj5p0SoLoHw=";
+    hash = "sha256-bxFBWi6cx7TeeofMP59XVRX9aDpCP2N5lAkUpWYW1wU=";
   };
 
   propagatedBuildInputs = [
@@ -68,6 +68,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Stackdriver Logging API client library";
     homepage = "https://github.com/googleapis/python-logging";
+    changelog = "https://github.com/googleapis/python-logging/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-spanner/default.nix b/pkgs/development/python-modules/google-cloud-spanner/default.nix
index 8272416b29f..2704b357004 100644
--- a/pkgs/development/python-modules/google-cloud-spanner/default.nix
+++ b/pkgs/development/python-modules/google-cloud-spanner/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-spanner";
-  version = "3.23.0";
+  version = "3.24.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-1RHzpCRYU2dUxZLa+zzopHd+xfnq7eWF6HDIkVk+2NY=";
+    hash = "sha256-Ko/9gfcR7BBX+U60vlWgdh4d1xptUJRRyWmAGq6a4/E=";
   };
 
   propagatedBuildInputs = [
@@ -69,6 +69,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Cloud Spanner API client library";
     homepage = "https://github.com/googleapis/python-spanner";
+    changelog = "https://github.com/googleapis/python-spanner/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/greeclimate/default.nix b/pkgs/development/python-modules/greeclimate/default.nix
index c2da89dc6c4..2059d7c092f 100644
--- a/pkgs/development/python-modules/greeclimate/default.nix
+++ b/pkgs/development/python-modules/greeclimate/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "greeclimate";
-  version = "1.3.0";
+  version = "1.4.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "cmroche";
     repo = "greeclimate";
     rev = "refs/tags/v${version}";
-    hash = "sha256-4kR3Hc5M4FDG/WFtIW20a9d0vwLzmqtrlhd+teMiejA=";
+    hash = "sha256-UBkfe4d+K+730TbvModZF1ET7uxMpQGxOkq0PF/WiWc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/gsd/default.nix b/pkgs/development/python-modules/gsd/default.nix
index ab64a78c103..a2543ae227b 100644
--- a/pkgs/development/python-modules/gsd/default.nix
+++ b/pkgs/development/python-modules/gsd/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "gsd";
-  version = "2.6.1";
+  version = "2.7.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "glotzerlab";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-vQutfkSilfgRHuu/THWMG6bmkT1eKlAAniQM4DP8mqI=";
+    hash = "sha256-drzmlHfU2ut3o7JASvFbEcf6OVtWa8kAyzpeDV5iGlc=";
   };
 
   nativeBuildInputs = [
@@ -49,6 +49,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "General simulation data file format";
     homepage = "https://github.com/glotzerlab/gsd";
+    changelog = "https://github.com/glotzerlab/gsd/blob/v${version}/CHANGELOG.rst";
     license = licenses.bsd2;
     maintainers = with maintainers; [ costrouc ];
   };
diff --git a/pkgs/development/python-modules/gspread/default.nix b/pkgs/development/python-modules/gspread/default.nix
index 35133847139..c38746299c5 100644
--- a/pkgs/development/python-modules/gspread/default.nix
+++ b/pkgs/development/python-modules/gspread/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "gspread";
-  version = "5.7.1";
+  version = "5.7.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-XznXohg0O2UU8G4iUODEE+tOgU3eaqv0hdrLaqMcqrA=";
+    hash = "sha256-znb5wWuIzLeSNQFCIkpZr6jmn3Rj89NBcUjL6JLvx8s=";
   };
 
   propagatedBuildInputs = [
@@ -35,6 +35,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Google Spreadsheets client library";
     homepage = "https://github.com/burnash/gspread";
+    changelog = "https://github.com/burnash/gspread/blob/v${version}/HISTORY.rst";
     license = licenses.mit;
     maintainers = with maintainers; [ ];
   };
diff --git a/pkgs/development/python-modules/gssapi/default.nix b/pkgs/development/python-modules/gssapi/default.nix
index f703820a4f5..16c6eb513c6 100644
--- a/pkgs/development/python-modules/gssapi/default.nix
+++ b/pkgs/development/python-modules/gssapi/default.nix
@@ -6,7 +6,7 @@
 , six
 , decorator
 , nose
-, krb5Full
+, krb5
 , GSS
 , parameterized
 , shouldbe
@@ -30,12 +30,12 @@ buildPythonPackage rec {
   # It's used to locate headers
   postPatch = ''
     substituteInPlace setup.py \
-      --replace 'get_output(f"{kc} gssapi --prefix")' '"${lib.getDev krb5Full}"'
+      --replace 'get_output(f"{kc} gssapi --prefix")' '"${lib.getDev krb5}"'
   '';
 
   nativeBuildInputs = [
     cython
-    krb5Full
+    krb5
   ];
 
   propagatedBuildInputs =  [
diff --git a/pkgs/development/python-modules/hass-nabucasa/default.nix b/pkgs/development/python-modules/hass-nabucasa/default.nix
index a1c07368c0d..375e975d969 100644
--- a/pkgs/development/python-modules/hass-nabucasa/default.nix
+++ b/pkgs/development/python-modules/hass-nabucasa/default.nix
@@ -15,19 +15,18 @@
 
 buildPythonPackage rec {
   pname = "hass-nabucasa";
-  version = "0.56.0";
+  version = "0.61.0";
 
   src = fetchFromGitHub {
     owner = "nabucasa";
     repo = pname;
     rev = version;
-    sha256 = "sha256-IgDOugHr4fCD9o3QQY5w/ibjak/d56R31KgQAbjUkkI=";
+    sha256 = "sha256-KG2eCwGZWVtepJQdsSwFziWsT1AbV6rYWRIO/I/CR8g=";
   };
 
   postPatch = ''
     substituteInPlace setup.py \
       --replace "acme==" "acme>=" \
-      --replace "cryptography>=2.8,<38.0" "cryptography" \
       --replace "pycognito==" "pycognito>=" \
       --replace "snitun==" "snitun>=" \
   '';
diff --git a/pkgs/development/python-modules/home-assistant-bluetooth/default.nix b/pkgs/development/python-modules/home-assistant-bluetooth/default.nix
index 4b0a9b660cf..68261007b7c 100644
--- a/pkgs/development/python-modules/home-assistant-bluetooth/default.nix
+++ b/pkgs/development/python-modules/home-assistant-bluetooth/default.nix
@@ -2,14 +2,16 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pythonOlder
+, cython
 , poetry-core
+, setuptools
 , bleak
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "home-assistant-bluetooth";
-  version = "1.6.0";
+  version = "1.8.1";
   format = "pyproject";
   disabled = pythonOlder "3.9";
 
@@ -17,7 +19,7 @@ buildPythonPackage rec {
     owner = "home-assistant-libs";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-6w940Yn0WgVC0Rn9OX40+6hO4maPSC7VrT3ARD8CIjQ=";
+    hash = "sha256-oOrsZmAXLYsJ19DrQ70O0RpeSz8Jn8oD41Tsc5DVUng=";
   };
 
   postPatch = ''
@@ -26,7 +28,9 @@ buildPythonPackage rec {
   '';
 
   nativeBuildInputs = [
+    cython
     poetry-core
+    setuptools
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/homematicip/default.nix b/pkgs/development/python-modules/homematicip/default.nix
index 50819a3c344..3f983681316 100644
--- a/pkgs/development/python-modules/homematicip/default.nix
+++ b/pkgs/development/python-modules/homematicip/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "homematicip";
-  version = "1.0.12";
+  version = "1.0.13";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "hahn-th";
     repo = "homematicip-rest-api";
     rev = "refs/tags/${version}";
-    hash = "sha256-gad+sg5MZvAzy1xE+xF/4GdLClB5EiyPH39nIlhO7IQ=";
+    hash = "sha256-bNVvQbwtef7Q0OBtR/8vsDDPkgGQgzdBC3QyoxLW3Wo=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/ical/default.nix b/pkgs/development/python-modules/ical/default.nix
index f11dd0e8764..9c12520e971 100644
--- a/pkgs/development/python-modules/ical/default.nix
+++ b/pkgs/development/python-modules/ical/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "ical";
-  version = "4.1.2";
+  version = "4.2.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "allenporter";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-kbPiyHu8k0cIkeX1XF2p5yQwiDvEWJhclENQly5QJa0=";
+    hash = "sha256-YvBcfrZiHTornCEAFhNLN/siNvl119pD+o+0yNsRBA8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/intellifire4py/default.nix b/pkgs/development/python-modules/intellifire4py/default.nix
index f0b702b1b51..f17af2b24fa 100644
--- a/pkgs/development/python-modules/intellifire4py/default.nix
+++ b/pkgs/development/python-modules/intellifire4py/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "intellifire4py";
-  version = "2.2.1";
+  version = "2.2.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -21,8 +21,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "jeeftor";
     repo = pname;
-    rev = version;
-    hash = "sha256-dn5814eRZ9456Fn7blf1UzXPii4dXu3sjoXBV7CmwSs=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-iqlKfpnETLqQwy5sNcK2x/TgmuN2hCfYoHEFK2WWVXI=";
   };
 
   propagatedBuildInputs = [
@@ -50,6 +50,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Module to read Intellifire fireplace status data";
     homepage = "https://github.com/jeeftor/intellifire4py";
+    changelog = "https://github.com/jeeftor/intellifire4py/blob/${version}/CHANGELOG";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/json-schema-for-humans/default.nix b/pkgs/development/python-modules/json-schema-for-humans/default.nix
index f420aefd7df..47cd5fed605 100644
--- a/pkgs/development/python-modules/json-schema-for-humans/default.nix
+++ b/pkgs/development/python-modules/json-schema-for-humans/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "json-schema-for-humans";
-  version = "0.42.1";
+  version = "0.44";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -26,8 +26,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "coveooss";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-WVLIx85ivHz5b6C1AfgMAApngeFCuWwWhaBWNcfOvXA=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-LsZPf5PVXPSyHNgfBdjH4hG4OFIdSprO5uj3saPDqzo=";
   };
 
   postPatch = ''
@@ -70,6 +70,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Quickly generate HTML documentation from a JSON schema";
     homepage = "https://github.com/coveooss/json-schema-for-humans";
+    changelog = "https://github.com/coveooss/json-schema-for-humans/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ astro ];
   };
diff --git a/pkgs/development/python-modules/jupyterlab_server/default.nix b/pkgs/development/python-modules/jupyterlab_server/default.nix
index c7a294eef44..cc709c4f47a 100644
--- a/pkgs/development/python-modules/jupyterlab_server/default.nix
+++ b/pkgs/development/python-modules/jupyterlab_server/default.nix
@@ -40,7 +40,7 @@ buildPythonPackage rec {
     babel
     jupyter_server
     tomli
-  ] ++ lib.optional (pythonOlder "3.10") [
+  ] ++ lib.optionals (pythonOlder "3.10") [
     importlib-metadata
   ];
 
diff --git a/pkgs/development/python-modules/jupytext/default.nix b/pkgs/development/python-modules/jupytext/default.nix
index dabbe303e16..dc5b56c3c01 100644
--- a/pkgs/development/python-modules/jupytext/default.nix
+++ b/pkgs/development/python-modules/jupytext/default.nix
@@ -3,7 +3,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , fetchpatch
-, GitPython
+, gitpython
 , isort
 , jupyter-client
 , jupyter-packaging
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "mwouts";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-DDF4aTLkhEl4xViYh/E0/y6swcwZ9KbeS0qKm+HdFz8=";
+    hash = "sha256-DDF4aTLkhEl4xViYh/E0/y6swcwZ9KbeS0qKm+HdFz8=";
   };
 
   patches = [
@@ -53,7 +53,7 @@ buildPythonPackage rec {
   ];
 
   checkInputs = [
-    GitPython
+    gitpython
     isort
     jupyter-client
     notebook
diff --git a/pkgs/development/python-modules/k5test/default.nix b/pkgs/development/python-modules/k5test/default.nix
index 6123f4d410f..6c2e8466a1d 100644
--- a/pkgs/development/python-modules/k5test/default.nix
+++ b/pkgs/development/python-modules/k5test/default.nix
@@ -3,7 +3,7 @@
 , buildPythonPackage
 , fetchPypi
 , substituteAll
-, krb5Full
+, krb5
 , findutils
 , which
 , pythonOlder
@@ -23,9 +23,9 @@ buildPythonPackage rec {
   patches = [
     (substituteAll {
       src = ./fix-paths.patch;
-      inherit findutils krb5Full;
+      inherit findutils krb5;
       # krb5-config is in dev output
-      krb5FullDev = krb5Full.dev;
+      krb5Dev = krb5.dev;
       which = "${which}/bin/which";
     })
   ];
diff --git a/pkgs/development/python-modules/k5test/fix-paths.patch b/pkgs/development/python-modules/k5test/fix-paths.patch
index dc6caf81580..c455ecf00ef 100644
--- a/pkgs/development/python-modules/k5test/fix-paths.patch
+++ b/pkgs/development/python-modules/k5test/fix-paths.patch
@@ -7,13 +7,13 @@ index e289fac..e2f486a 100644
      # if there was no LD_LIBRARY_PATH, or the above failed
      if _PLUGIN_DIR is None:
 -        lib_dir = os.path.join(get_output('krb5-config --prefix'), 'lib64')
-+        lib_dir = os.path.join(get_output('@krb5FullDev@/bin/krb5-config --prefix'), 'lib64')
++        lib_dir = os.path.join(get_output('@krb5Dev@/bin/krb5-config --prefix'), 'lib64')
          _PLUGIN_DIR = _decide_plugin_dir(_find_plugin_dirs_installed(lib_dir))
  
      # /usr/lib64 seems only to be distinct on Fedora/RHEL/Centos family
      if _PLUGIN_DIR is None:
 -        lib_dir = os.path.join(get_output('krb5-config --prefix'), 'lib')
-+        lib_dir = os.path.join(get_output('@krb5FullDev@/bin/krb5-config --prefix'), 'lib')
++        lib_dir = os.path.join(get_output('@krb5Dev@/bin/krb5-config --prefix'), 'lib')
          _PLUGIN_DIR = _decide_plugin_dir(_find_plugin_dirs_installed(lib_dir))
  
      if _PLUGIN_DIR is not None:
@@ -53,7 +53,7 @@ index 161e5ad..9f50049 100644
          if provider_cls == K5Realm:
              krb5_config = _discover_path('krb5-config',
 -                                         '/usr/bin/krb5-config', kwargs)
-+                                         '@krb5Full@/bin/krb5-config', kwargs)
++                                         '@krb5@/bin/krb5-config', kwargs)
  
              try:
                  krb5_version = subprocess.check_output(
@@ -62,7 +62,7 @@ index 161e5ad..9f50049 100644
                  if 'heimdal' in krb5_version.lower() or (
                          sys.platform == 'darwin' and
 -                        krb5_config == '/usr/bin/krb5-config'):
-+                        krb5_config == '@krb5Full@/bin/krb5-config'):
++                        krb5_config == '@krb5@/bin/krb5-config'):
                      provider_cls = HeimdalRealm
                  else:
                      provider_cls = MITRealm
@@ -78,14 +78,14 @@ index 161e5ad..9f50049 100644
 -            ('kprop', 'kprop', '/usr/sbin/kprop'),
 -            ('_kinit', 'kinit', '/usr/bin/kinit'),
 -            ('_klist', 'klist', '/usr/bin/klist'),
-+            ('kdb5_util', 'kdb5_util', '@krb5Full@/bin/kdb5_util'),
-+            ('krb5kdc', 'krb5kdc', '@krb5Full@/bin/kdb5kdc'),
-+            ('kadmin', 'kadmin', '@krb5Full@/bin/admin'),
-+            ('kadmin_local', 'kadmin.local', '@krb5Full@/bin/kadmin.local'),
-+            ('kadmind', 'kadmind', '@krb5Full@/bin/kadmind'),
-+            ('kprop', 'kprop', '@krb5Full@/bin/kprop'),
-+            ('_kinit', 'kinit', '@krb5Full@/bin/kinit'),
-+            ('_klist', 'klist', '@krb5Full@/bin/klist'),
++            ('kdb5_util', 'kdb5_util', '@krb5@/bin/kdb5_util'),
++            ('krb5kdc', 'krb5kdc', '@krb5@/bin/kdb5kdc'),
++            ('kadmin', 'kadmin', '@krb5@/bin/admin'),
++            ('kadmin_local', 'kadmin.local', '@krb5@/bin/kadmin.local'),
++            ('kadmind', 'kadmind', '@krb5@/bin/kadmind'),
++            ('kprop', 'kprop', '@krb5@/bin/kprop'),
++            ('_kinit', 'kinit', '@krb5@/bin/kinit'),
++            ('_klist', 'klist', '@krb5@/bin/klist'),
          ]
  
      @property
@@ -95,15 +95,15 @@ index 161e5ad..9f50049 100644
              ('krb5kdc', 'kdc', os.path.join(base, 'kdc')),
 -            ('kadmin', 'kadmin', '/usr/bin/kadmin'),
 -            ('kadmin_local', 'kadmin', '/usr/bin/kadmin'),
-+            ('kadmin', 'kadmin', '@krb5Full@/bin/kadmin'),
-+            ('kadmin_local', 'kadmin', '@krb5Full@/bin/kadmin'),
++            ('kadmin', 'kadmin', '@krb5@/bin/kadmin'),
++            ('kadmin_local', 'kadmin', '@krb5@/bin/kadmin'),
              ('kadmind', 'kadmind', os.path.join(base, 'kadmind')),
 -            ('_kinit', 'kinit', '/usr/bin/kinit'),
 -            ('_klist', 'klist', '/usr/bin/klist'),
 -            ('_ktutil', 'ktutil', '/usr/bin/ktutil'),
-+            ('_kinit', 'kinit', '@krb5Full@/bin/kinit'),
-+            ('_klist', 'klist', '@krb5Full@/bin/klist'),
-+            ('_ktutil', 'ktutil', '@krb5Full@/bin/ktutil'),
++            ('_kinit', 'kinit', '@krb5@/bin/kinit'),
++            ('_klist', 'klist', '@krb5@/bin/klist'),
++            ('_ktutil', 'ktutil', '@krb5@/bin/ktutil'),
          ]
  
      @property
@@ -116,7 +116,7 @@ index 3c64b9e..59da1ab 100644
      global _KRB_VERSION
      if _KRB_VERSION is None:
 -        _KRB_VERSION = _utils.get_output("krb5-config --version")
-+        _KRB_VERSION = _utils.get_output("@krb5FullDev@/bin/krb5-config --version")
++        _KRB_VERSION = _utils.get_output("@krb5Dev@/bin/krb5-config --version")
          _KRB_VERSION = _KRB_VERSION.split(' ')[-1].split('.')
  
      def make_ext_test(func):
diff --git a/pkgs/development/python-modules/knack/default.nix b/pkgs/development/python-modules/knack/default.nix
index 2e3808db856..c858dcde661 100644
--- a/pkgs/development/python-modules/knack/default.nix
+++ b/pkgs/development/python-modules/knack/default.nix
@@ -11,15 +11,19 @@
 , mock
 , vcrpy
 , pytest
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "knack";
-  version = "0.10.0";
+  version = "0.10.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-ExkPqV1MIbzgS0vuItak4/sZqTtpmbHRBL0CxHZwbCg=";
+    hash = "sha256-xXKBKCl+bSaXkQhc+Wwv/fzvWM+DxjSly5LrA7KSmDg=";
   };
 
   propagatedBuildInputs = [
@@ -42,9 +46,14 @@ buildPythonPackage rec {
     HOME=$TMPDIR pytest .
   '';
 
+  pythonImportsCheck = [
+    "knack"
+  ];
+
   meta = with lib; {
     homepage = "https://github.com/microsoft/knack";
     description = "A Command-Line Interface framework";
+    changelog = "https://github.com/microsoft/knack/blob/v${version}/HISTORY.rst";
     platforms = platforms.all;
     license = licenses.mit;
     maintainers = with maintainers; [ jonringer ];
diff --git a/pkgs/development/python-modules/losant-rest/default.nix b/pkgs/development/python-modules/losant-rest/default.nix
index 0e80ef1da88..0054d891636 100644
--- a/pkgs/development/python-modules/losant-rest/default.nix
+++ b/pkgs/development/python-modules/losant-rest/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "losant-rest";
-  version = "1.16.6";
+  version = "1.17.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "Losant";
     repo = "losant-rest-python";
     rev = "v${version}";
-    sha256 = "sha256-x8a2W64zLDi8r7d8B7GYCwWtSAB3BH+Sprbw+Xr7mH4=";
+    hash = "sha256-nR7ZKKpqiCrQbXsS+znmNht1OvcYL6hSQxHMcJ+/yKA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/mac-vendor-lookup/default.nix b/pkgs/development/python-modules/mac-vendor-lookup/default.nix
index 2c0a7d4f724..d4a1be562f9 100644
--- a/pkgs/development/python-modules/mac-vendor-lookup/default.nix
+++ b/pkgs/development/python-modules/mac-vendor-lookup/default.nix
@@ -13,8 +13,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "bauerj";
     repo = "mac_vendor_lookup";
-    rev = "5b57faac0c5a701a7e18085e331853397b68c07c";
-    hash = "sha256-F/aiMs+J4bAesr6mKy+tYVjAjZ3l9vyHxV7zaaB6KbA=";
+    rev = "90dbea48f8a9d567b5f9039ebd151ddfe7d12a19";
+    hash = "sha256-mPPJDrWdyvkTdb4WfeTNYwuC+Ek9vH7ORKRTREg+vK8=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/mathlibtools/default.nix b/pkgs/development/python-modules/mathlibtools/default.nix
index f913beb07ef..02a6b5348ed 100644
--- a/pkgs/development/python-modules/mathlibtools/default.nix
+++ b/pkgs/development/python-modules/mathlibtools/default.nix
@@ -3,7 +3,7 @@
 , buildPythonPackage
 , click
 , fetchPypi
-, GitPython
+, gitpython
 , networkx
 , pydot
 , PyGithub
@@ -28,7 +28,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     atomicwrites
     click
-    GitPython
+    gitpython
     networkx
     pydot
     PyGithub
diff --git a/pkgs/development/python-modules/metakernel/default.nix b/pkgs/development/python-modules/metakernel/default.nix
index 5cc40f4a6ca..bb3d4b917f1 100644
--- a/pkgs/development/python-modules/metakernel/default.nix
+++ b/pkgs/development/python-modules/metakernel/default.nix
@@ -1,18 +1,24 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, hatchling
 , ipykernel
 }:
 
 buildPythonPackage rec {
   pname = "metakernel";
   version = "0.29.2";
+  format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
     sha256 = "sha256-A++uLR4hhOQYmA6o9wBTejFju3CpbK0hwIs7XFscddQ=";
   };
 
+  nativeBuildInputs = [
+    hatchling
+  ];
+
   propagatedBuildInputs = [ ipykernel ];
 
   # Tests hang, so disable
diff --git a/pkgs/development/python-modules/mitmproxy/default.nix b/pkgs/development/python-modules/mitmproxy/default.nix
index 4b4cf1315b5..b85000fe05c 100644
--- a/pkgs/development/python-modules/mitmproxy/default.nix
+++ b/pkgs/development/python-modules/mitmproxy/default.nix
@@ -1,6 +1,5 @@
 { lib
 , fetchFromGitHub
-, fetchpatch
 , buildPythonPackage
 , pythonOlder
   # Mitmproxy requirements
@@ -8,7 +7,6 @@
 , blinker
 , brotli
 , certifi
-, click
 , cryptography
 , flask
 , h11
@@ -16,6 +14,7 @@
 , hyperframe
 , kaitaistruct
 , ldap3
+, mitmproxy-wireguard
 , msgpack
 , passlib
 , protobuf
@@ -42,24 +41,16 @@
 
 buildPythonPackage rec {
   pname = "mitmproxy";
-  version = "8.1.1";
-  disabled = pythonOlder "3.8";
+  version = "9.0.1";
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
+    owner = "mitmproxy";
+    repo = "mitmproxy";
     rev = "refs/tags/v${version}";
     sha256 = "sha256-nW/WfiY6uF67qNa95tvNvSv/alP2WmzTk34LEBma/04=";
   };
 
-  patches = [
-    # Fix onboarding addon tests failing with Flask >= v2.2
-    (fetchpatch {
-      url = "https://github.com/mitmproxy/mitmproxy/commit/bc370276a19c1d1039e7a45ecdc23c362626c81a.patch";
-      hash = "sha256-Cp7RnYpZEuRhlWYOk8BOnAKBAUa7Vy296UmQi3/ufes=";
-    })
-  ];
-
   propagatedBuildInputs = [
     setuptools
     # setup.py
@@ -67,7 +58,6 @@ buildPythonPackage rec {
     blinker
     brotli
     certifi
-    click
     cryptography
     flask
     h11
@@ -75,11 +65,12 @@ buildPythonPackage rec {
     hyperframe
     kaitaistruct
     ldap3
+    mitmproxy-wireguard
     msgpack
     passlib
     protobuf
-    publicsuffix2
     pyopenssl
+    publicsuffix2
     pyparsing
     pyperclip
     ruamel-yaml
@@ -120,6 +111,12 @@ buildPythonPackage rec {
     # ValueError: Exceeds the limit (4300) for integer string conversion
     "test_roundtrip_big_integer"
   ];
+
+  disabledTestPaths = [
+    # teardown of half the tests broken
+    "test/mitmproxy/addons/test_onboarding.py"
+  ];
+
   dontUsePytestXdist = true;
 
   pythonImportsCheck = [ "mitmproxy" ];
diff --git a/pkgs/development/python-modules/mlflow/default.nix b/pkgs/development/python-modules/mlflow/default.nix
index cc5abbdd3d2..375c56b6885 100644
--- a/pkgs/development/python-modules/mlflow/default.nix
+++ b/pkgs/development/python-modules/mlflow/default.nix
@@ -9,7 +9,7 @@
 , fetchpatch
 , fetchPypi
 , flask
-, GitPython
+, gitpython
 , gorilla
 , gunicorn
 , importlib-metadata
@@ -50,7 +50,7 @@ buildPythonPackage rec {
     docker
     entrypoints
     flask
-    GitPython
+    gitpython
     gorilla
     gunicorn
     importlib-metadata
@@ -81,6 +81,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Open source platform for the machine learning lifecycle";
     homepage = "https://github.com/mlflow/mlflow";
+    changelog = "https://github.com/mlflow/mlflow/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ tbenst ];
   };
diff --git a/pkgs/development/python-modules/mypy-boto3-builder/default.nix b/pkgs/development/python-modules/mypy-boto3-builder/default.nix
index 00be47cf820..9ae495cf55e 100644
--- a/pkgs/development/python-modules/mypy-boto3-builder/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3-builder/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "mypy-boto3-builder";
-  version = "7.11.11";
+  version = "7.12.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.10";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "youtype";
     repo = "mypy_boto3_builder";
     rev = "refs/tags/${version}";
-    hash = "sha256-4iyh/oXuYsdtqEf1Dh4Z3y8AHWiS1TmimO5HUwsHrHA=";
+    hash = "sha256-YmWQZvSABE0IKvISJWeB0rYryZ9FNTCgS7/lE2/sO04=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/mypy-boto3-s3/default.nix b/pkgs/development/python-modules/mypy-boto3-s3/default.nix
index eb36da387f6..6825978f19f 100644
--- a/pkgs/development/python-modules/mypy-boto3-s3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3-s3/default.nix
@@ -11,7 +11,7 @@ buildPythonPackage rec {
   version = "1.26.0.post1";
   format = "setuptools";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
@@ -31,9 +31,9 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
-    description = "Type annotations for boto3";
-    homepage = "https://vemel.github.io/boto3_stubs_docs/mypy_boto3_s3/";
-    license = with licenses; [ bsd3 ];
+    description = "Type annotations for boto3.s3";
+    homepage = "https://github.com/youtype/mypy_boto3_builder";
+    license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/nbdime/default.nix b/pkgs/development/python-modules/nbdime/default.nix
index da00ff3702d..78cb915b29e 100644
--- a/pkgs/development/python-modules/nbdime/default.nix
+++ b/pkgs/development/python-modules/nbdime/default.nix
@@ -1,7 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, isPy3k
+, pythonOlder
 , hypothesis
 , setuptools-scm
 , six
@@ -19,7 +19,7 @@
 , pygments
 , tornado
 , requests
-, GitPython
+, gitpython
 , jupyter-server-mathjax
 , notebook
 , jinja2
@@ -28,14 +28,18 @@
 buildPythonPackage rec {
   pname = "nbdime";
   version = "3.1.1";
-  disabled = !isPy3k;
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "67767320e971374f701a175aa59abd3a554723039d39fae908e72d16330d648b";
+    hash = "sha256-Z3ZzIOlxN09wGhdapZq9OlVHIwOdOfrpCOctFjMNZIs=";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
 
   propagatedBuildInputs = [
     attrs
@@ -48,7 +52,7 @@ buildPythonPackage rec {
     pygments
     tornado
     requests
-    GitPython
+    gitpython
     notebook
     jinja2
   ];
@@ -78,6 +82,10 @@ buildPythonPackage rec {
 
   __darwinAllowLocalNetworking = true;
 
+  pythonImportsCheck = [
+    "nbdime"
+  ];
+
   meta = with lib; {
     homepage = "https://github.com/jupyter/nbdime";
     description = "Tools for diffing and merging of Jupyter notebooks.";
diff --git a/pkgs/development/python-modules/nettigo-air-monitor/default.nix b/pkgs/development/python-modules/nettigo-air-monitor/default.nix
index 3ae81a4afed..de424d8afdf 100644
--- a/pkgs/development/python-modules/nettigo-air-monitor/default.nix
+++ b/pkgs/development/python-modules/nettigo-air-monitor/default.nix
@@ -5,6 +5,7 @@
 , dacite
 , fetchFromGitHub
 , aqipy-atmotech
+, orjson
 , pytest-asyncio
 , pytest-error-for-skips
 , pytestCheckHook
@@ -13,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "nettigo-air-monitor";
-  version = "1.4.2";
+  version = "1.5.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -22,13 +23,14 @@ buildPythonPackage rec {
     owner = "bieniu";
     repo = pname;
     rev = version;
-    hash = "sha256-UbknJ+dX+4kzfe6/gg/Nj1Ay8YXtIRj203B6NkhGVys=";
+    hash = "sha256-84cd869k+JZZpjBBoHH2AyIo8ixJzVgpLLRBV4cMNKA=";
   };
 
   propagatedBuildInputs = [
     aiohttp
-    dacite
     aqipy-atmotech
+    dacite
+    orjson
   ];
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/nextdns/default.nix b/pkgs/development/python-modules/nextdns/default.nix
index a0aac69df9e..41b22ee2170 100644
--- a/pkgs/development/python-modules/nextdns/default.nix
+++ b/pkgs/development/python-modules/nextdns/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "nextdns";
-  version = "1.1.1";
+  version = "1.2.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "bieniu";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-hMTafmG3mk6jyrqxI7L/rQxKGpgNgEZ+b6d6/yISCng=";
+    hash = "sha256-F6vTOwE8WdcELH+W7VuRbGDLD+7+a09iai/TDMBfv4s=";
   };
 
   propagatedBuildInputs = [
@@ -41,6 +41,7 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/bieniu/nextdns/releases/tag/${version}";
     description = "Module for the NextDNS API";
     homepage = "https://github.com/bieniu/nextdns";
     license = licenses.asl20;
diff --git a/pkgs/development/python-modules/opentimestamps/default.nix b/pkgs/development/python-modules/opentimestamps/default.nix
index e253c0b5c9b..e5d37fcfba8 100644
--- a/pkgs/development/python-modules/opentimestamps/default.nix
+++ b/pkgs/development/python-modules/opentimestamps/default.nix
@@ -3,7 +3,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , git
-, GitPython
+, gitpython
 , pycryptodomex
 , pytestCheckHook
 , pythonOlder
@@ -25,7 +25,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     bitcoinlib
-    GitPython
+    gitpython
     pycryptodomex
   ];
 
@@ -46,6 +46,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Create and verify OpenTimestamps proofs";
     homepage = "https://github.com/opentimestamps/python-opentimestamps";
+    changelog = "https://github.com/opentimestamps/python-opentimestamps/releases/tag/python-opentimestamps-v${version}";
     license = licenses.lgpl3Plus;
     maintainers = with maintainers; [ erikarvstedt ];
   };
diff --git a/pkgs/development/python-modules/passlib/default.nix b/pkgs/development/python-modules/passlib/default.nix
index 72892a10953..2f9e2d0c4b0 100644
--- a/pkgs/development/python-modules/passlib/default.nix
+++ b/pkgs/development/python-modules/passlib/default.nix
@@ -32,9 +32,9 @@ buildPythonPackage rec {
   disabledTests = [
     # timming sensitive
     "test_dummy_verify"
-  ]
-  # These tests fail because they don't expect support for algorithms provided through libxcrypt
-  ++ lib.optionals stdenv.isDarwin [
+    "test_encrypt_cost_timing"
+  ] ++ lib.optionals stdenv.isDarwin [
+    # These tests fail because they don't expect support for algorithms provided through libxcrypt
     "test_82_crypt_support"
   ];
 
diff --git a/pkgs/development/python-modules/pip-requirements-parser/default.nix b/pkgs/development/python-modules/pip-requirements-parser/default.nix
index 0693fbf4fde..fd1b95c4822 100644
--- a/pkgs/development/python-modules/pip-requirements-parser/default.nix
+++ b/pkgs/development/python-modules/pip-requirements-parser/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "pip-requirements-parser";
-  version = "31.2.0";
+  version = "32.0.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "nexB";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-i4hw3tS4i2ek2JzcDiGo5aFFJ9J2JJ9MB5vxDhOilb0=";
+    hash = "sha256-Wu4C93PWujygKIzXqUjCmKWcllr+hkuvnqDuw6/D9Do=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -44,6 +44,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Module to parse pip requirements";
     homepage = "https://github.com/nexB/pip-requirements-parser";
+    changelog = "https://github.com/nexB/pip-requirements-parser/blob/v${version}/CHANGELOG.rst";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/pontos/default.nix b/pkgs/development/python-modules/pontos/default.nix
index 4d207628cf8..59980857560 100644
--- a/pkgs/development/python-modules/pontos/default.nix
+++ b/pkgs/development/python-modules/pontos/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "pontos";
-  version = "22.11.0";
+  version = "22.12.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "greenbone";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-WGtHMQ+8hACt8SMyO0zO80ASlfykJfHQOtNwyk1fsFE=";
+    hash = "sha256-8enSKOVEkYPI/2d2nzDkf1GO15kpMI6xDktroK9Ti2s=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/protobuf/default.nix b/pkgs/development/python-modules/protobuf/default.nix
index 4061edfc5ae..cd1fb4806f1 100644
--- a/pkgs/development/python-modules/protobuf/default.nix
+++ b/pkgs/development/python-modules/protobuf/default.nix
@@ -37,7 +37,7 @@ buildPythonPackage {
     buildPackages."protobuf${lib.versions.major protobuf.version}_${lib.versions.minor protobuf.version}"
   ];
 
-  setupPyGlobalFlags = "--cpp_implementation";
+  setupPyGlobalFlags = [ "--cpp_implementation" ];
 
   pythonImportsCheck = [
     "google.protobuf"
diff --git a/pkgs/development/python-modules/psrpcore/default.nix b/pkgs/development/python-modules/psrpcore/default.nix
index 41c514d2ca6..09c624bbdc1 100644
--- a/pkgs/development/python-modules/psrpcore/default.nix
+++ b/pkgs/development/python-modules/psrpcore/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "psrpcore";
-  version = "0.1.2";
+  version = "0.2.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -17,8 +17,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "jborean93";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-f1NGE+wSgi8yqBicZZRfUqzinsqazuIaoAje2y+dK1w=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-uX99BsQn1Ckl+2Lt4I0EMZLTKeDrX0mtSc9w5aFpvxQ=";
   };
 
   propagatedBuildInputs = [
@@ -38,6 +38,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for the PowerShell Remoting Protocol (PSRP)";
     homepage = "https://github.com/jborean93/psrpcore";
+    changelog = "https://github.com/jborean93/psrpcore/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/ptpython/default.nix b/pkgs/development/python-modules/ptpython/default.nix
index af07f013ee0..c78aacc8d5a 100644
--- a/pkgs/development/python-modules/ptpython/default.nix
+++ b/pkgs/development/python-modules/ptpython/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "ptpython";
-  version = "3.0.21";
+  version = "3.0.22";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-pXuZUurEoSVApN+0zNSiQ0A+zrJ7DRMkW15BRMhzHTI=";
+    hash = "sha256-wJezJEBgFKAFxrCfSTu73eVx5BI2CvK6FVGHOhDDbPg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pulumi-aws/default.nix b/pkgs/development/python-modules/pulumi-aws/default.nix
index b397d4cf59f..7ff24f974ee 100644
--- a/pkgs/development/python-modules/pulumi-aws/default.nix
+++ b/pkgs/development/python-modules/pulumi-aws/default.nix
@@ -12,7 +12,7 @@
 buildPythonPackage rec {
   pname = "pulumi-aws";
   # Version is independant of pulumi's.
-  version = "5.21.1";
+  version = "5.23.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "pulumi";
     repo = "pulumi-aws";
     rev = "refs/tags/v${version}";
-    hash = "sha256-b/X+UHJnGCzE3AR+spXJWv/NVq5BVvNlzEyHpqDhquY=";
+    hash = "sha256-YT667WBOnObGpagml9xAj6N+Kdhq3rhx0XspJJXhrUE=";
   };
 
   sourceRoot = "${src.name}/sdk/python";
diff --git a/pkgs/development/python-modules/py-desmume/default.nix b/pkgs/development/python-modules/py-desmume/default.nix
index 0c700151f69..30631de36e5 100644
--- a/pkgs/development/python-modules/py-desmume/default.nix
+++ b/pkgs/development/python-modules/py-desmume/default.nix
@@ -1,32 +1,68 @@
-{ lib, buildPythonPackage, fetchFromGitHub, GitPython
-, libpcap, meson, ninja, pillow, pkg-config, pygobject3, SDL2
-, alsa-lib, soundtouch, openal
+{ lib
+, alsa-lib
+, buildPythonPackage
+, fetchFromGitHub
+, gitpython
+, libpcap
+, meson
+, ninja
+, openal
+, pillow
+, pkg-config
+, pygobject3
+, pythonOlder
+, SDL2
+, soundtouch
 }:
 
 buildPythonPackage rec {
   pname = "py-desmume";
   version = "0.0.4.post2";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "SkyTemple";
     repo = pname;
     rev = version;
-    sha256 = "sha256-a819+K/Ovnz53ViDKpUGGjeblWvrAO5ozt/tizdLKCY=";
+    hash = "sha256-a819+K/Ovnz53ViDKpUGGjeblWvrAO5ozt/tizdLKCY=";
     fetchSubmodules = true;
   };
 
-  buildInputs = [ GitPython libpcap SDL2 alsa-lib soundtouch openal ];
-  nativeBuildInputs = [ meson ninja pkg-config ];
-  propagatedBuildInputs = [ pillow pygobject3 ];
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [
+    alsa-lib
+    gitpython
+    libpcap
+    openal
+    SDL2
+    soundtouch
+  ];
+
+  propagatedBuildInputs = [
+    pillow
+    pygobject3
+  ];
 
-  hardeningDisable = [ "format" ];
+  hardeningDisable = [
+    "format"
+  ];
 
   doCheck = false; # there are no tests
-  pythonImportsCheck = [ "desmume" ];
+
+  pythonImportsCheck = [
+    "desmume"
+  ];
 
   meta = with lib; {
-    homepage = "https://github.com/SkyTemple/py-desmume";
     description = "Python library to interface with DeSmuME, the Nintendo DS emulator";
+    homepage = "https://github.com/SkyTemple/py-desmume";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ xfix ];
   };
diff --git a/pkgs/development/python-modules/pycryptodome/default.nix b/pkgs/development/python-modules/pycryptodome/default.nix
index 41d7dc1d151..1d3d3d0d9e0 100644
--- a/pkgs/development/python-modules/pycryptodome/default.nix
+++ b/pkgs/development/python-modules/pycryptodome/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , callPackage
 , fetchFromGitHub
+, fetchpatch
 , gmp
 }:
 
@@ -20,6 +21,13 @@ buildPythonPackage rec {
     hash = "sha256-8EAgeAU3HQiPrMKOtoVQQLbgq47cbveU2eQYp15XS/U=";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/Legrandin/pycryptodome/commit/1c043abb089ddbc2fc43d1c169672688ccc64c64.patch";
+      sha256 = "sha256-QklwOlFpQNAH0CpR06fWSZqx8C97RV8BRsKbp2j8js8=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace lib/Crypto/Math/_IntegerGMP.py \
       --replace 'load_lib("gmp"' 'load_lib("${gmp}/lib/libgmp.so.10"'
diff --git a/pkgs/development/python-modules/pylint/default.nix b/pkgs/development/python-modules/pylint/default.nix
index 6c98fdf83a1..a8a0229f862 100644
--- a/pkgs/development/python-modules/pylint/default.nix
+++ b/pkgs/development/python-modules/pylint/default.nix
@@ -15,7 +15,7 @@
 , tomli
 , tomlkit
 , typing-extensions
-, GitPython
+, gitpython
 , pytest-timeout
 , pytest-xdist
 , pytestCheckHook
@@ -73,7 +73,7 @@ buildPythonPackage rec {
   '';
 
   checkInputs = [
-    GitPython
+    gitpython
     # https://github.com/PyCQA/pylint/blob/main/requirements_test_min.txt
     pytest-timeout
     pytest-xdist
diff --git a/pkgs/development/python-modules/pyrainbird/default.nix b/pkgs/development/python-modules/pyrainbird/default.nix
index 5035f7c1a36..5461dc44523 100644
--- a/pkgs/development/python-modules/pyrainbird/default.nix
+++ b/pkgs/development/python-modules/pyrainbird/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "pyrainbird";
-  version = "0.6.2";
+  version = "0.6.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -22,12 +22,15 @@ buildPythonPackage rec {
     owner = "jbarrancos";
     repo = pname;
     rev = version;
-    hash = "sha256-MikJDW5Fo2DNpn9/Hyc1ecIIMEwE8GD5LKpka2t7aCk=";
+    hash = "sha256-yGUBCs1IxbGKBo21gExFIqDawM2EHlO+jiRqonEUnPk=";
   };
 
   postPatch = ''
     substituteInPlace pytest.ini \
       --replace "--cov=pyrainbird --cov-report=term-missing" ""
+
+    substituteInPlace setup.cfg \
+      --replace "pycryptodome>=3.16.0" "pycryptodome"
   '';
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyrisco/default.nix b/pkgs/development/python-modules/pyrisco/default.nix
index 5ce800af4d2..72fc5ab0a20 100644
--- a/pkgs/development/python-modules/pyrisco/default.nix
+++ b/pkgs/development/python-modules/pyrisco/default.nix
@@ -7,21 +7,26 @@
 
 buildPythonPackage rec {
   pname = "pyrisco";
-  version = "0.5.6";
+  version = "0.5.7";
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "OnFreund";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-jhThPU4wlujZVC9v/8JSRFxC0LlJedFevOENdRHidV8=";
+    hash = "sha256-ySFHB+PZmjsqKJQrfFoupylowsOiV5B2feHX7nF8dUA=";
   };
 
-  propagatedBuildInputs = [ aiohttp ];
+  propagatedBuildInputs = [
+    aiohttp
+  ];
 
   # Project has no tests
   doCheck = false;
-  pythonImportsCheck = [ "pyrisco" ];
+
+  pythonImportsCheck = [
+    "pyrisco"
+  ];
 
   meta = with lib; {
     description = "Python interface to Risco alarm systems through Risco Cloud";
diff --git a/pkgs/development/python-modules/pyshark/default.nix b/pkgs/development/python-modules/pyshark/default.nix
index c7b469dbf76..b33a1bd9f38 100644
--- a/pkgs/development/python-modules/pyshark/default.nix
+++ b/pkgs/development/python-modules/pyshark/default.nix
@@ -35,7 +35,7 @@ buildPythonPackage rec {
   ];
 
   # `stripLen` does not seem to work here
-  patchFlags = "-p2";
+  patchFlags = [ "-p2" ];
 
   sourceRoot = "${src.name}/src";
 
diff --git a/pkgs/development/python-modules/pytest-random-order/default.nix b/pkgs/development/python-modules/pytest-random-order/default.nix
index d95af8651f3..223024fe645 100644
--- a/pkgs/development/python-modules/pytest-random-order/default.nix
+++ b/pkgs/development/python-modules/pytest-random-order/default.nix
@@ -6,12 +6,12 @@
 }:
 
 buildPythonPackage rec {
-  version = "1.0.4";
+  version = "1.1.0";
   pname = "pytest-random-order";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "6b2159342a4c8c10855bc4fc6d65ee890fc614cb2b4ff688979b008a82a0ff52";
+    sha256 = "sha256-2+beu5NTp6+YTMnt2+s1d91Nu8wVKaeePSH2jtm0VgU=";
   };
 
   disabled = pythonOlder "3.5";
diff --git a/pkgs/development/python-modules/python-arango/default.nix b/pkgs/development/python-modules/python-arango/default.nix
new file mode 100644
index 00000000000..ba44e94b9a3
--- /dev/null
+++ b/pkgs/development/python-modules/python-arango/default.nix
@@ -0,0 +1,138 @@
+{ lib
+, arangodb
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, pytestCheckHook
+, pyjwt
+, pytest
+, mock
+, requests
+, requests-toolbelt
+}:
+
+let
+  testDBOpts = {
+    host = "127.0.0.1";
+    port = "8529";
+    password = "test";
+    secret = "secret";
+  };
+in
+
+buildPythonPackage rec {
+  pname = "python-arango";
+  version = "7.5.3";
+  disabled = pythonOlder "3.7";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "ArangoDB-Community";
+    repo = "python-arango";
+    rev = version;
+    sha256 = "0qb2yp05z8dmgsyyxqrl3q0a60jaiih96zhxmqrn2yf7as45n07j";
+  };
+
+  propagatedBuildInputs = [
+    requests
+    requests-toolbelt
+    pyjwt
+  ];
+
+  checkInputs = [
+    arangodb
+    mock
+    pytestCheckHook
+  ];
+
+  # arangodb is compiled only for particular target architectures
+  # (i.e. "haswell"). Thus, these tests may not pass reproducibly,
+  # failing with: `166: Illegal instruction` if not run on arangodb's
+  # specified architecture.
+  #
+  # nonetheless, the client library should remain in nixpkgs - since
+  # the client library will talk to arangodb across the network and
+  # architecture issues will be irrelevant.
+  doCheck = false;
+
+  preCheck = lib.optionalString doCheck ''
+    # Start test DB
+    mkdir -p .nix-test/{data,work}
+
+    ICU_DATA=${arangodb}/share/arangodb3 \
+    GLIBCXX_FORCE_NEW=1 \
+    TZ=UTC \
+    TZ_DATA=${arangodb}/share/arangodb3/tzdata \
+    ARANGO_ROOT_PASSWORD=${testDBOpts.password} \
+    ${arangodb}/bin/arangod \
+      --server.uid=$(id -u) \
+      --server.gid=$(id -g) \
+      --server.authentication=true \
+      --server.endpoint=http+tcp://${testDBOpts.host}:${testDBOpts.port} \
+      --server.descriptors-minimum=4096 \
+      --server.jwt-secret=${testDBOpts.secret} \
+      --javascript.app-path=.nix-test/app \
+      --log.file=.nix-test/log \
+      --database.directory=.nix-test/data \
+      --foxx.api=false &
+  '';
+
+  pytestFlagsArray = [
+    "--host"
+    testDBOpts.host
+    "--port"
+    testDBOpts.port
+    "--passwd"
+    testDBOpts.password
+    "--secret"
+    testDBOpts.secret
+  ];
+
+  disabledTests = [
+    # AssertionError geo-related - try enabling later
+    "test_document_find_in_box"
+
+    # maybe arangod misconfig - try enabling later
+    # arango.exceptions.JWTAuthError: [HTTP 401][ERR 401] Wrong credentials
+    "test_auth_jwt"
+
+    # ValueError - try enabling later
+    # maybe missed 3.9.3->3.10.0 changes
+    # most caused by key change: isNewlyCreated->new
+    "test_add_hash_index"
+    "test_add_skiplist_index"
+    "test_add_persistent_index"
+    "test_add_ttl_index"
+    "test_delete_index"
+    "test_pregel_management"
+
+    # formatting error - try enabling later
+    # maybe missed 3.9.3->3.10.0 changes
+    # caused by: body["computedValues"] = None
+    "test_permission_management"
+    "test_collection_misc_methods"
+    "test_collection_management"
+    "test_replication_inventory"
+
+    # want outgoing network to update foxx apis
+    # so foxx.api disabled in arangod startup
+    "test_foxx_service_management_file"
+    "test_foxx_service_management_json"
+    "test_foxx_config_management"
+    "test_foxx_dependency_management"
+    "test_foxx_development_toggle"
+    "test_foxx_misc_functions"
+
+    # no replication configured via arangod invocation
+    "test_replication_applier"
+  ];
+
+  pythonImportsCheck = [ "arango" ];
+
+  meta = with lib; {
+    description = "Python Driver for ArangoDB";
+    homepage = "https://github.com/ArangoDB-Community/python-arango";
+    license = licenses.mit;
+    maintainers = [ maintainers.jsoo1 ];
+  };
+}
diff --git a/pkgs/development/python-modules/python-glanceclient/default.nix b/pkgs/development/python-modules/python-glanceclient/default.nix
index 390aad8b55c..560e0db1424 100644
--- a/pkgs/development/python-modules/python-glanceclient/default.nix
+++ b/pkgs/development/python-modules/python-glanceclient/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "python-glanceclient";
-  version = "4.1.0";
+  version = "4.2.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-fknYBKZzCA6sThugNQT5+p+/hqv8vW6M2LMMpbT+7rY=";
+    hash = "sha256-+CmOh9Dr6Gx8MLkR1u/YNpScOxIO7OUIbJAio+omOpg=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/python-lsp-server/default.nix b/pkgs/development/python-modules/python-lsp-server/default.nix
index 4c9cf5003cc..62e6ce951bd 100644
--- a/pkgs/development/python-modules/python-lsp-server/default.nix
+++ b/pkgs/development/python-modules/python-lsp-server/default.nix
@@ -133,7 +133,7 @@ buildPythonPackage rec {
     # https://github.com/python-lsp/python-lsp-server/issues/243
     "test_numpy_completions"
     "test_workspace_loads_pycodestyle_config"
-  ] ++ lib.optional (stdenv.isDarwin && stdenv.isAarch64) [
+  ] ++ lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [
     # pyqt5 is broken on aarch64-darwin
     "test_pyqt_completion"
   ];
diff --git a/pkgs/development/python-modules/python-manilaclient/default.nix b/pkgs/development/python-modules/python-manilaclient/default.nix
index 301ce42f0c7..4e10af5b40d 100644
--- a/pkgs/development/python-modules/python-manilaclient/default.nix
+++ b/pkgs/development/python-modules/python-manilaclient/default.nix
@@ -18,17 +18,16 @@
 , python-keystoneclient
 , debtcollector
 , callPackage
-, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "python-manilaclient";
-  version = "4.1.0";
+  version = "4.2.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-yoyQyhyqRQZ8yyn3sv94JqkVZQMybwxLGFForZowr3o=";
+    hash = "sha256-Hf/U3LFcIsT00lIzvvZaowfMth/zj5WY6UAxYWjC1JA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/python-novaclient/default.nix b/pkgs/development/python-modules/python-novaclient/default.nix
index 5ae75098ddd..62adeb1fe75 100644
--- a/pkgs/development/python-modules/python-novaclient/default.nix
+++ b/pkgs/development/python-modules/python-novaclient/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "python-novaclient";
-  version = "18.1.0";
+  version = "18.2.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-eCBVnRZfGk2BDn2nyV+IQl2L5JX20aPG9CA7isGH4lQ=";
+    hash = "sha256-GFu/LK+189dh8nLj4YSnAMx7pc99UWGQZb5/XEtbfPQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pytibber/default.nix b/pkgs/development/python-modules/pytibber/default.nix
index 2f7614e5bb5..a4047483eb6 100644
--- a/pkgs/development/python-modules/pytibber/default.nix
+++ b/pkgs/development/python-modules/pytibber/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "pytibber";
-  version = "0.26.3";
+  version = "0.26.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "Danielhiversen";
     repo = "pyTibber";
     rev = "refs/tags/${version}";
-    hash = "sha256-4yDV6tH1XSWZfcjCJ/3r4hl1n4Sbgc3x7YPE6GOfA3Y=";
+    hash = "sha256-R++vsJ2CJwPxG/32qam/LRj7GUj3obh9z20xXNMAnQ4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyunifiprotect/default.nix b/pkgs/development/python-modules/pyunifiprotect/default.nix
index af7c4b1cc52..9cf53fb9e21 100644
--- a/pkgs/development/python-modules/pyunifiprotect/default.nix
+++ b/pkgs/development/python-modules/pyunifiprotect/default.nix
@@ -29,7 +29,7 @@
 
 buildPythonPackage rec {
   pname = "pyunifiprotect";
-  version = "4.5.1";
+  version = "4.5.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     owner = "briis";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-7LgAK0AzQ7uoVW7fXwoU512iI5LG0BL8N0R9f7AjFN4=";
+    hash = "sha256-xYDt/vvzI7qIK/8XE6mhcI5GPDKyHRj73Lagn0QOOz0=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pyvesync/default.nix b/pkgs/development/python-modules/pyvesync/default.nix
index 19d8fee57ef..25e075b3180 100644
--- a/pkgs/development/python-modules/pyvesync/default.nix
+++ b/pkgs/development/python-modules/pyvesync/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "pyvesync";
-  version = "2.0.4";
+  version = "2.1.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-1Svz/9ZS5ynr88/We1fa+H1IGdC5ljUa4M5O8X+muX4=";
+    sha256 = "sha256-ulYOzCIpHkL/2nQExomoV4mLkU6e0ns4MHxEbjCPGrQ=";
   };
 
   propagatedBuildInputs = [
@@ -31,6 +31,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python library to manage Etekcity Devices and Levoit Air Purifier";
     homepage = "https://github.com/webdjoe/pyvesync";
+    changelog = "https://github.com/webdjoe/pyvesync/releases/tag/${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/pyvex/default.nix b/pkgs/development/python-modules/pyvex/default.nix
index 88670ec9f7a..b928c2a4549 100644
--- a/pkgs/development/python-modules/pyvex/default.nix
+++ b/pkgs/development/python-modules/pyvex/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "pyvex";
-  version = "9.2.27";
+  version = "9.2.28";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-r46rTS9MOMUUWRwGF3pohV+1bPL03VmoILEjEKfr04o=";
+    hash = "sha256-fDsJqilxIt/LApXVrTm3JyOrZ6BR0+IbnFux/huF2ZU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/qcengine/default.nix b/pkgs/development/python-modules/qcengine/default.nix
index af842c6c955..e275e430317 100644
--- a/pkgs/development/python-modules/qcengine/default.nix
+++ b/pkgs/development/python-modules/qcengine/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "qcengine";
-  version = "0.24.1";
+  version = "0.26.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-KUOGbGQd1ffXNkQiW8yeUxValCOAfd8nBv9nnk9giVU=";
+    hash = "sha256-jBA3exH/qzEaKZeumvgKD0tKnDptZdlv1KykyUHs8Bg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/rich-click/default.nix b/pkgs/development/python-modules/rich-click/default.nix
index 4b6f8b4874c..104e5bfb829 100644
--- a/pkgs/development/python-modules/rich-click/default.nix
+++ b/pkgs/development/python-modules/rich-click/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "rich-click";
-  version = "1.5.2";
+  version = "1.6.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -17,8 +17,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "ewels";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-eW5CR7ReVsFLJ09F4EUQbvFB+GdlnTay0bX4NNLQ0xo=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-l8tMyxSkh4eckD21NofK9FBgeGKAqZB0J3B98HpWZ0s=";
   };
 
   propagatedBuildInputs = [
@@ -26,17 +26,6 @@ buildPythonPackage rec {
     rich
   ];
 
-  passthru.optional-dependencies = {
-    typer = [
-      typer
-    ];
-  };
-
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "typer>=0.4,<0.6" "typer>=0.4"
-  '';
-
   # Module has no test
   doCheck = false;
 
@@ -47,6 +36,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Module to format click help output nicely with rich";
     homepage = "https://github.com/ewels/rich-click";
+    changelog = "https://github.com/ewels/rich-click/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/rstcheck-core/default.nix b/pkgs/development/python-modules/rstcheck-core/default.nix
index b296f5dc168..31938569ca5 100644
--- a/pkgs/development/python-modules/rstcheck-core/default.nix
+++ b/pkgs/development/python-modules/rstcheck-core/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "rstcheck-core";
-  version = "1.0.2";
+  version = "1.0.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -23,8 +23,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "rstcheck";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-XNr+prK9VDP66ZaFvh3Qrx+eJs6mnVO8lvoMC/qrCLs=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-9U+GhkwBr+f3yEe7McOxqPRUuTp9vP+3WT5wZ92n32w=";
   };
 
   nativeBuildInputs = [
@@ -45,12 +45,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace 'types-docutils = ">=0.18, <0.19"' 'types-docutils = ">=0.18"' \
-      --replace 'docutils = ">=0.7, <0.19"' 'docutils = ">=0.7"'
-  '';
-
   pythonImportsCheck = [
     "rstcheck_core"
   ];
@@ -58,6 +52,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for checking syntax of reStructuredText";
     homepage = "https://github.com/rstcheck/rstcheck-core";
+    changelog = "https://github.com/rstcheck/rstcheck-core/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/rstcheck/default.nix b/pkgs/development/python-modules/rstcheck/default.nix
index a3789b97088..2f2ee962e89 100644
--- a/pkgs/development/python-modules/rstcheck/default.nix
+++ b/pkgs/development/python-modules/rstcheck/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "rstcheck";
-  version = "6.1.0";
+  version = "6.1.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -23,8 +23,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "rstcheck";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-dw/KggiZpKaFZMcTIaSBUhR4oQsZI3iSmEj9Sy80wTs=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-6TpDzk0GjIn9AnWadwHoYRc3SNi9nBAM7GyKm338wH8=";
   };
 
   nativeBuildInputs = [
@@ -47,12 +47,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace 'docutils = ">=0.7, <0.19"' 'docutils = ">=0.7"' \
-      --replace 'types-docutils = ">=0.18, <0.19"' 'types-docutils = ">=0.18"'
-  '';
-
   pythonImportsCheck = [
     "rstcheck"
   ];
@@ -65,6 +59,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Checks syntax of reStructuredText and code blocks nested within it";
     homepage = "https://github.com/myint/rstcheck";
+    changelog = "https://github.com/rstcheck/rstcheck/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ staccato ];
   };
diff --git a/pkgs/development/python-modules/ruuvitag-ble/default.nix b/pkgs/development/python-modules/ruuvitag-ble/default.nix
new file mode 100644
index 00000000000..dd8c338fd31
--- /dev/null
+++ b/pkgs/development/python-modules/ruuvitag-ble/default.nix
@@ -0,0 +1,57 @@
+{ lib
+, bluetooth-data-tools
+, bluetooth-sensor-state-data
+, buildPythonPackage
+, fetchFromGitHub
+, hatchling
+, home-assistant-bluetooth
+, pytestCheckHook
+, pythonOlder
+, sensor-state-data
+}:
+
+buildPythonPackage rec {
+  pname = "ruuvitag-ble";
+  version = "0.1.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.9";
+
+  src = fetchFromGitHub {
+    owner = "Bluetooth-Devices";
+    repo = pname;
+    rev = "refs/tags/v${version}";
+    hash = "sha256-WkPYlEkUH1xvGjBVr6JkLx5CfIPvAa9vX50OjCOmTME=";
+  };
+
+  nativeBuildInputs = [
+    hatchling
+  ];
+
+  propagatedBuildInputs = [
+    bluetooth-data-tools
+    bluetooth-sensor-state-data
+    home-assistant-bluetooth
+    sensor-state-data
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace " --cov=ruuvitag_ble --cov-report=term-missing:skip-covered" ""
+  '';
+
+  pythonImportsCheck = [
+    "ruuvitag_ble"
+  ];
+
+  meta = with lib; {
+    description = "Library for Ruuvitag BLE devices";
+    homepage = "https://github.com/Bluetooth-Devices/ruuvitag-ble";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/scmrepo/default.nix b/pkgs/development/python-modules/scmrepo/default.nix
index 4c3dffd0f80..873073e105c 100644
--- a/pkgs/development/python-modules/scmrepo/default.nix
+++ b/pkgs/development/python-modules/scmrepo/default.nix
@@ -5,7 +5,7 @@
 , fetchFromGitHub
 , fsspec
 , funcy
-, GitPython
+, gitpython
 , pathspec
 , pygit2
 , pygtrie
@@ -42,7 +42,7 @@ buildPythonPackage rec {
     dulwich
     fsspec
     funcy
-    GitPython
+    gitpython
     pathspec
     pygit2
     pygtrie
diff --git a/pkgs/development/python-modules/sense-energy/default.nix b/pkgs/development/python-modules/sense-energy/default.nix
index b3f2d695570..22e7b4897e0 100644
--- a/pkgs/development/python-modules/sense-energy/default.nix
+++ b/pkgs/development/python-modules/sense-energy/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "sense-energy";
-  version = "0.10.4";
+  version = "0.11.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,9 +19,13 @@ buildPythonPackage rec {
     owner = "scottbonline";
     repo = "sense";
     rev = version;
-    hash = "sha256-yflI17lLZMXXB0ye+jz3VWWMdZtcBTwbg8deA4ENmWw=";
+    hash = "sha256-QX8CPf3o0IaAhjWYeUjDoAgktNrh/sSRjFhOweAxxco=";
   };
 
+  postPatch = ''
+    sed -i '/download_url/d' setup.py
+  '';
+
   propagatedBuildInputs = [
     aiohttp
     requests
diff --git a/pkgs/development/python-modules/simplisafe-python/default.nix b/pkgs/development/python-modules/simplisafe-python/default.nix
index 97b844613b1..90df4d2847c 100644
--- a/pkgs/development/python-modules/simplisafe-python/default.nix
+++ b/pkgs/development/python-modules/simplisafe-python/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "simplisafe-python";
-  version = "2022.11.2";
+  version = "2022.12.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "bachya";
     repo = pname;
     rev = "refs/tags/${version}";
-    sha256 = "sha256-fGCYsuhqPs3ZYInx6Z3iRb4dtjoA7mJKpBDVx+6d/qA=";
+    hash = "sha256-oajFn/aMZvDpagLKadQ0Ez1uJhfUaJK4Rv6IUq3lRVE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/strenum/default.nix b/pkgs/development/python-modules/strenum/default.nix
index d73b60906cc..563f20f6f7d 100644
--- a/pkgs/development/python-modules/strenum/default.nix
+++ b/pkgs/development/python-modules/strenum/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "strenum";
-  version = "0.4.8";
+  version = "0.4.9";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -15,8 +15,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "irgeek";
     repo = "StrEnum";
-    rev = "v${version}";
-    hash = "sha256-S64YfF+cbefXRWoeJK99ZPTiO9DUcDaT77hVQd7pKDk=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-tElXpwyjrgTw9eHqGPgXakY+G9JXkBQYG7jSZSjv6P0=";
   };
 
   postPatch = ''
@@ -37,6 +37,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "MOdule for enum that inherits from str";
     homepage = "https://github.com/irgeek/StrEnum";
+    changelog = "https://github.com/irgeek/StrEnum/releases/tag/v${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/stytra/default.nix b/pkgs/development/python-modules/stytra/default.nix
index fba544789a8..6923fe36c8a 100644
--- a/pkgs/development/python-modules/stytra/default.nix
+++ b/pkgs/development/python-modules/stytra/default.nix
@@ -1,36 +1,41 @@
-{ lib, buildPythonPackage, fetchPypi, isPy3k
-, opencv3
-, pyqt5
-, pyqtgraph
-, numpy
-, scipy
-, numba
-, pandas
-, tables
-, git
-, scikitimage
-, matplotlib
-, qdarkstyle
-, GitPython
+{ lib
 , anytree
-, pims
+, arrayqueues
+, av
+, buildPythonPackage
+, colorspacious
+, fetchPypi
+, flammkuchen
+, git
+, gitpython
 , imageio
 , imageio-ffmpeg
-, av
+, lightparam
+, matplotlib
 , nose
-, pytestCheckHook
+, numba
+, numpy
+, opencv3
+, pandas
+, pims
+, pyqt5
+, pyqtgraph
 , pyserial
-, arrayqueues
-, colorspacious
+, pytestCheckHook
+, pythonOlder
+, qdarkstyle
 , qimage2ndarray
-, flammkuchen
-, lightparam
+, scikitimage
+, scipy
+, tables
 }:
 
 buildPythonPackage rec {
   pname = "stytra";
   version = "0.8.34";
-  disabled = !isPy3k;
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
@@ -42,12 +47,6 @@ buildPythonPackage rec {
     rm stytra/tests/test_z_experiments.py
   '';
 
-  checkInputs = [
-    nose
-    pytestCheckHook
-    pyserial
-  ];
-
   propagatedBuildInputs = [
     opencv3
     pyqt5
@@ -61,7 +60,7 @@ buildPythonPackage rec {
     scikitimage
     matplotlib
     qdarkstyle
-    GitPython
+    gitpython
     anytree
     qimage2ndarray
     flammkuchen
@@ -74,10 +73,16 @@ buildPythonPackage rec {
     av
   ];
 
-  meta = {
-    homepage = "https://github.com/portugueslab/stytra";
+  checkInputs = [
+    nose
+    pytestCheckHook
+    pyserial
+  ];
+
+  meta = with lib; {
     description = "A modular package to control stimulation and track behaviour";
-    license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [ tbenst ];
+    homepage = "https://github.com/portugueslab/stytra";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ tbenst ];
   };
 }
diff --git a/pkgs/development/python-modules/subarulink/default.nix b/pkgs/development/python-modules/subarulink/default.nix
index bf975f5e848..a8e00cace53 100644
--- a/pkgs/development/python-modules/subarulink/default.nix
+++ b/pkgs/development/python-modules/subarulink/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "subarulink";
-  version = "0.6.1";
+  version = "0.7.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,8 +20,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "G-Two";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-esZ+nIHIXKfilb8dBFbAbQQFI6fFRUcoFVCPdnqGXYw=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-igfC/Hi/cbNnHmrzgWQnhJ9cdWHPI0fIqPIYeIZuxgU=";
   };
 
   propagatedBuildInputs = [
@@ -54,6 +54,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python module for interacting with STARLINK-enabled vehicle";
     homepage = "https://github.com/G-Two/subarulink";
+    changelog = "https://github.com/G-Two/subarulink/releases/tag/v${version}";
     license = with licenses; [ asl20 ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/tern/default.nix b/pkgs/development/python-modules/tern/default.nix
index 63573314950..4769dc64e7a 100644
--- a/pkgs/development/python-modules/tern/default.nix
+++ b/pkgs/development/python-modules/tern/default.nix
@@ -1,28 +1,32 @@
 { lib
 , buildPythonPackage
-, fetchPypi
-, pyyaml
+, debian-inspector
 , docker
 , dockerfile-parse
-, requests
-, stevedore
-, pbr
-, debian-inspector
-, license-expression
-, regex
-, GitPython
-, prettytable
+, fetchPypi
+, gitpython
 , idna
+, license-expression
 , packageurl-python
+, pbr
+, prettytable
+, pythonOlder
+, pyyaml
+, regex
+, requests
+, stevedore
 }:
 
 buildPythonPackage rec {
   pname = "tern";
   version = "2.10.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-MMsq8/Obe3ogQSjiP8EebYseUJGcchMOczUrxE9jht4=";
+    hash = "sha256-MMsq8/Obe3ogQSjiP8EebYseUJGcchMOczUrxE9jht4=";
   };
 
   preBuild = ''
@@ -42,7 +46,7 @@ buildPythonPackage rec {
     stevedore
     debian-inspector
     regex
-    GitPython
+    gitpython
     prettytable
     idna
     packageurl-python
@@ -58,6 +62,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "A software composition analysis tool and Python library that generates a Software Bill of Materials for container images and Dockerfiles";
     homepage = "https://github.com/tern-tools/tern";
+    changelog = "https://github.com/tern-tools/tern/releases/tag/v${version}";
     license = licenses.bsd2;
     maintainers = teams.determinatesystems.members;
   };
diff --git a/pkgs/development/python-modules/tilequant/default.nix b/pkgs/development/python-modules/tilequant/default.nix
index 90caab8ebef..a72802e2c7b 100644
--- a/pkgs/development/python-modules/tilequant/default.nix
+++ b/pkgs/development/python-modules/tilequant/default.nix
@@ -1,4 +1,13 @@
-{ lib, buildPythonPackage, fetchFromGitHub, GitPython, click, ordered-set, pillow, sortedcollections }:
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, gitpython
+, click
+, ordered-set
+, pythonOlder
+, pillow
+, sortedcollections
+}:
 
 let
   aikku93-tilequant = fetchFromGitHub {
@@ -11,6 +20,9 @@ in
 buildPythonPackage rec {
   pname = "tilequant";
   version = "0.4.0.post0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "SkyTemple";
@@ -23,15 +35,26 @@ buildPythonPackage rec {
     cp -R --no-preserve=mode ${aikku93-tilequant} __aikku93_tilequant
   '';
 
-  buildInputs = [ GitPython ];
-  propagatedBuildInputs = [ click ordered-set pillow sortedcollections ];
+  buildInputs = [
+    gitpython
+  ];
+
+  propagatedBuildInputs = [
+    click
+    ordered-set
+    pillow
+    sortedcollections
+  ];
 
   doCheck = false; # there are no tests
-  pythonImportsCheck = [ "skytemple_tilequant" ];
+
+  pythonImportsCheck = [
+    "skytemple_tilequant"
+  ];
 
   meta = with lib; {
-    homepage = "https://github.com/SkyTemple/tilequant";
     description = "Tool for quantizing image colors using tile-based palette restrictions";
+    homepage = "https://github.com/SkyTemple/tilequant";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ xfix ];
   };
diff --git a/pkgs/development/python-modules/versionfinder/default.nix b/pkgs/development/python-modules/versionfinder/default.nix
index 951ae8d9874..5ca8d764990 100644
--- a/pkgs/development/python-modules/versionfinder/default.nix
+++ b/pkgs/development/python-modules/versionfinder/default.nix
@@ -2,7 +2,7 @@
 , backoff
 , buildPythonPackage
 , fetchFromGitHub
-, GitPython
+, gitpython
 , pytestCheckHook
 , pythonOlder
 , requests
@@ -23,7 +23,7 @@ buildPythonPackage rec {
   };
 
   propagatedBuildInputs = [
-    GitPython
+    gitpython
     backoff
   ];
 
@@ -49,6 +49,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Find the version of another package, whether installed via pip, setuptools or git";
     homepage = "https://github.com/jantman/versionfinder";
+    changelog = "https://github.com/jantman/versionfinder/blob/${version}/CHANGES.rst";
     license = licenses.agpl3Plus;
     maintainers = with maintainers; [ zakame ];
   };
diff --git a/pkgs/development/python-modules/wandb/default.nix b/pkgs/development/python-modules/wandb/default.nix
index f9e862c0fbb..ad1ac6da5dd 100644
--- a/pkgs/development/python-modules/wandb/default.nix
+++ b/pkgs/development/python-modules/wandb/default.nix
@@ -8,7 +8,7 @@
 , fetchFromGitHub
 , flask
 , git
-, GitPython
+, gitpython
 , jsonref
 , jsonschema
 , matplotlib
@@ -67,7 +67,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     click
     docker_pycreds
-    GitPython
+    gitpython
     pathtools
     promise
     protobuf
diff --git a/pkgs/development/python-modules/wxPython/4.0.nix b/pkgs/development/python-modules/wxPython/4.0.nix
index d9fead66e35..380fefbc4cd 100644
--- a/pkgs/development/python-modules/wxPython/4.0.nix
+++ b/pkgs/development/python-modules/wxPython/4.0.nix
@@ -12,6 +12,7 @@
 , ncurses
 , libintl
 , wxGTK
+, gtk3
 , IOKit
 , Carbon
 , Cocoa
@@ -42,7 +43,7 @@ buildPythonPackage rec {
   then
     [ AudioToolbox Carbon Cocoa CoreFoundation IOKit OpenGL ]
   else
-    [ wxGTK.gtk ]
+    [ gtk3 ]
   );
 
   propagatedBuildInputs = [
@@ -58,7 +59,7 @@ buildPythonPackage rec {
       --replace 'cairoLib = None' 'cairoLib = ctypes.CDLL("${cairo}/lib/libcairo.so")'
     substituteInPlace wx/lib/wxcairo/wx_pycairo.py \
       --replace '_dlls = dict()' '_dlls = {k: ctypes.CDLL(v) for k, v in [
-        ("gdk",        "${wxGTK.gtk}/lib/libgtk-x11-2.0.so"),
+        ("gdk",        "${gtk3}/lib/libgtk-x11-2.0.so"),
         ("pangocairo", "${pango.out}/lib/libpangocairo-1.0.so"),
         ("appsvc",     None)
       ]}'
diff --git a/pkgs/development/python-modules/xiaomi-ble/default.nix b/pkgs/development/python-modules/xiaomi-ble/default.nix
index 676afd2a44d..8aa63e8f394 100644
--- a/pkgs/development/python-modules/xiaomi-ble/default.nix
+++ b/pkgs/development/python-modules/xiaomi-ble/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "xiaomi-ble";
-  version = "0.11.0";
+  version = "0.12.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -22,8 +22,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "Bluetooth-Devices";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-qAqXg+skA7FfAjRXljt1UpyOcC3KYghc+5wjiRzlyyg=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-MwKhoerfloFT5/x1darfMP/qF5sEy6LiKEogINIUq0c=";
   };
 
   nativeBuildInputs = [
@@ -55,6 +55,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for Xiaomi BLE devices";
     homepage = "https://github.com/Bluetooth-Devices/xiaomi-ble";
+    changelog = "https://github.com/Bluetooth-Devices/xiaomi-ble/releases/tag/v${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/xknx/default.nix b/pkgs/development/python-modules/xknx/default.nix
index 7b22508e2a2..2f3a3768331 100644
--- a/pkgs/development/python-modules/xknx/default.nix
+++ b/pkgs/development/python-modules/xknx/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "xknx";
-  version = "1.2.1";
+  version = "2.1.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "XKNX";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-5uRPMu9qZ0ofMdgk8d1IpKjHjnEP+zhWs+EDQx9wk6U=";
+    hash = "sha256-a8hC63G+FZBe6yePgrmzRsRTzpHWS+tBQmVUS/uHfzI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/zamg/default.nix b/pkgs/development/python-modules/zamg/default.nix
index 11066aa2633..e24e712e7c0 100644
--- a/pkgs/development/python-modules/zamg/default.nix
+++ b/pkgs/development/python-modules/zamg/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "zamg";
-  version = "0.1.2";
+  version = "0.2.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "killer0071234";
     repo = "python-zamg";
     rev = "refs/tags/v${version}";
-    hash = "sha256-R3byV8llg7X+KYuYTsEtdLSFfLsPD4tyqAaU0CifDks=";
+    hash = "sha256-mql3r1TdVHwpJi54TMj6kfP3uZO2maa5dynUL4fOiNY=";
   };
 
   postPatch = ''
@@ -44,6 +44,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library to read weather data from ZAMG Austria";
     homepage = "https://github.com/killer0071234/python-zamg";
+    changelog = "https://github.com/killer0071234/python-zamg/releases/tag/v${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/zha-quirks/default.nix b/pkgs/development/python-modules/zha-quirks/default.nix
index 86059d60b0c..73ed507444b 100644
--- a/pkgs/development/python-modules/zha-quirks/default.nix
+++ b/pkgs/development/python-modules/zha-quirks/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "zha-quirks";
-  version = "0.0.87";
+  version = "0.0.88";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "zigpy";
     repo = "zha-device-handlers";
     rev = "refs/tags/${version}";
-    hash = "sha256-MX+UWS1h2HMIhyrhtn/tzti2w9RBHptVE3klATIXvAM=";
+    hash = "sha256-GjKYa8wgNugGC4IZJfMLVJnlPAgBmTLd8Wwy6e4g/+U=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/zigpy-deconz/default.nix b/pkgs/development/python-modules/zigpy-deconz/default.nix
index babfcf54c04..5671a7c1225 100644
--- a/pkgs/development/python-modules/zigpy-deconz/default.nix
+++ b/pkgs/development/python-modules/zigpy-deconz/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "zigpy-deconz";
-  version = "0.19.1";
+  version = "0.19.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "zigpy";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-qbzHG6qoTAm773HAoAjmmanqVtuIDR72ECQH+N+iw3o=";
+    hash = "sha256-Eu+6I904vwPewQesYtn8cWXoo36fQpa1Bw660tnV+Lw=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/zigpy-znp/default.nix b/pkgs/development/python-modules/zigpy-znp/default.nix
index 083805f8e7e..b545752b4ef 100644
--- a/pkgs/development/python-modules/zigpy-znp/default.nix
+++ b/pkgs/development/python-modules/zigpy-znp/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "zigpy-znp";
-  version = "0.9.1";
+  version = "0.9.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "zigpy";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-32QSFBzYg+E++5euCWKgbF3/uLEn1uObenmR/Wv9XZc=";
+    sha256 = "sha256-orJDOnkZH9siDg8H8M8C0UTxJfWPTB+gBNtUM6s4F94=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/zigpy/default.nix b/pkgs/development/python-modules/zigpy/default.nix
index 9b5bd33f85e..5fd59516d49 100644
--- a/pkgs/development/python-modules/zigpy/default.nix
+++ b/pkgs/development/python-modules/zigpy/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "zigpy";
-  version = "0.51.6";
+  version = "0.52.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "zigpy";
     repo = "zigpy";
     rev = "refs/tags/${version}";
-    hash = "sha256-keQFFWPl2SCy1cyvbqDrA9/Yude8bf0qNiyEbFjFv/o=";
+    hash = "sha256-axk6C8RLuoKWUdJ3sOklWqnlYTWKTaQh51eWZm2Dy+0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/zwave-js-server-python/default.nix b/pkgs/development/python-modules/zwave-js-server-python/default.nix
index dcbeca33f82..42aaaa4d13e 100644
--- a/pkgs/development/python-modules/zwave-js-server-python/default.nix
+++ b/pkgs/development/python-modules/zwave-js-server-python/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "zwave-js-server-python";
-  version = "0.43.0";
+  version = "0.43.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "home-assistant-libs";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-qzAM3vcVySJB6OfOHKXYYXDR+xOSbGpyH7b9TaYkOLM=";
+    hash = "sha256-qnGMUY7c2jqLQbVybVdu9vWcPMFoxCnCCTBhWP+AXE0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python2-modules/TurboCheetah/default.nix b/pkgs/development/python2-modules/TurboCheetah/default.nix
deleted file mode 100644
index 717b2b5f278..00000000000
--- a/pkgs/development/python2-modules/TurboCheetah/default.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, cheetah
-, nose
-}:
-
-buildPythonPackage rec {
-  pname = "TurboCheetah";
-  version = "1.0";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "9e4c7ecb0d061bfb58281363ee1b09337083f013a8b4d0355326a5d8668f450c";
-  };
-
-  propagatedBuildInputs = [ cheetah ];
-
-  checkInputs = [ nose ];
-
-  meta = {
-    description = "TurboGears plugin to support use of Cheetah templates";
-    homepage = "http://docs.turbogears.org/TurboCheetah";
-    license = lib.licenses.mit;
-  };
-}
diff --git a/pkgs/development/python2-modules/cheetah/default.nix b/pkgs/development/python2-modules/cheetah/default.nix
deleted file mode 100644
index 1cee46fa725..00000000000
--- a/pkgs/development/python2-modules/cheetah/default.nix
+++ /dev/null
@@ -1,33 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, markdown
-, isPy3k
-, TurboCheetah
-}:
-
-buildPythonPackage rec {
-  pname = "cheetah";
-  version = "2.4.4";
-
-  disabled = isPy3k;
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "be308229f0c1e5e5af4f27d7ee06d90bb19e6af3059794e5fd536a6f29a9b550";
-  };
-
-  propagatedBuildInputs = [ markdown ];
-
-  doCheck = false; # Circular dependency
-
-  checkInputs = [
-    TurboCheetah
-  ];
-
-  meta = {
-    homepage = "http://www.cheetahtemplate.org/";
-    description = "A template engine and code generation tool";
-    license = lib.licenses.mit;
-  };
-}
diff --git a/pkgs/development/python2-modules/construct/default.nix b/pkgs/development/python2-modules/construct/default.nix
deleted file mode 100644
index 5bbbd150145..00000000000
--- a/pkgs/development/python2-modules/construct/default.nix
+++ /dev/null
@@ -1,39 +0,0 @@
-{ lib, stdenv, buildPythonPackage, fetchFromGitHub
-, pytestCheckHook, pytest-benchmark, enum34, numpy, arrow, ruamel-yaml
-}:
-
-buildPythonPackage rec {
-  pname   = "construct";
-  version = "2.10.54";
-
-  # no tests in PyPI tarball
-  src = fetchFromGitHub {
-    owner  = pname;
-    repo   = pname;
-    rev    = "v${version}";
-    sha256 = "1mqspsn6bf3ibvih1zna2glkg8iw7vy5zg9gzg0d1m8zcndk2c48";
-  };
-
-  checkInputs = [ pytestCheckHook enum34 numpy ];
-
-  # these have dependencies that are broken on Python 2
-  disabledTestPaths = [
-    "tests/gallery/test_gallery.py"
-    "tests/test_benchmarks.py"
-    "tests/test_compiler.py"
-  ];
-
-  disabledTests = [
-    "test_benchmarks"
-    "test_timestamp"
-  ] ++ lib.optionals stdenv.isDarwin [
-    "test_multiprocessing"
-  ];
-
-  meta = with lib; {
-    description = "Powerful declarative parser (and builder) for binary data";
-    homepage = "https://construct.readthedocs.org/";
-    license = licenses.mit;
-    maintainers = with maintainers; [ dotlambda ];
-  };
-}
diff --git a/pkgs/development/python2-modules/httpretty/default.nix b/pkgs/development/python2-modules/httpretty/default.nix
deleted file mode 100644
index 92ed5c6616e..00000000000
--- a/pkgs/development/python2-modules/httpretty/default.nix
+++ /dev/null
@@ -1,52 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, tornado
-, requests
-, httplib2
-, sure
-, nose
-, nose-exclude
-, coverage
-, rednose
-, nose-randomly
-, six
-, mock
-}:
-
-buildPythonPackage rec {
-  pname = "httpretty";
-  version = "0.9.7";
-
-  # drop this for version > 0.9.7
-  # Flaky tests: https://github.com/gabrielfalcao/HTTPretty/pull/394
-  doCheck = lib.versionAtLeast version "0.9.8";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "66216f26b9d2c52e81808f3e674a6fb65d4bf719721394a1a9be926177e55fbe";
-  };
-
-  propagatedBuildInputs = [ six ];
-
-  checkInputs = [ nose sure coverage mock rednose
-    # Following not declared in setup.py
-    nose-randomly requests tornado httplib2 nose-exclude
-  ];
-
-  __darwinAllowLocalNetworking = true;
-
-  # Those flaky tests are failing intermittently on all platforms
-  NOSE_EXCLUDE = lib.concatStringsSep "," [
-    "tests.functional.test_httplib2.test_callback_response"
-    "tests.functional.test_requests.test_streaming_responses"
-    "tests.functional.test_httplib2.test_callback_response"
-    "tests.functional.test_requests.test_httpretty_should_allow_adding_and_overwritting_by_kwargs_u2"
-  ];
-
-  meta = with lib; {
-    homepage = "https://httpretty.readthedocs.org/";
-    description = "HTTP client request mocking tool";
-    license = licenses.mit;
-  };
-}
diff --git a/pkgs/development/python2-modules/markdown/default.nix b/pkgs/development/python2-modules/markdown/default.nix
deleted file mode 100644
index 13ed2f1744a..00000000000
--- a/pkgs/development/python2-modules/markdown/default.nix
+++ /dev/null
@@ -1,33 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, setuptools
-, nose
-, pyyaml
-, pythonOlder
-, importlib-metadata
-}:
-
-buildPythonPackage rec {
-  pname = "Markdown";
-  version = "3.1.1";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "2e50876bcdd74517e7b71f3e7a76102050edec255b3983403f1a63e7c8a41e7a";
-  };
-
-  propagatedBuildInputs = [
-    setuptools
-  ] ++ lib.optionals (pythonOlder "3.8") [
-    importlib-metadata
-  ];
-
-  checkInputs = [ nose pyyaml ];
-
-  meta = {
-    description = "A Python implementation of John Gruber's Markdown with Extension support";
-    homepage = "https://github.com/Python-Markdown/markdown";
-    license = lib.licenses.bsd3;
-  };
-}
diff --git a/pkgs/development/python2-modules/mutagen/default.nix b/pkgs/development/python2-modules/mutagen/default.nix
deleted file mode 100644
index 7f2e9f452b4..00000000000
--- a/pkgs/development/python2-modules/mutagen/default.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, hypothesis
-, pycodestyle
-, pyflakes
-, pytest
-, setuptools
-, pkgs
-}:
-
-buildPythonPackage rec {
-  pname = "mutagen";
-  version = "1.43.1";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "d873baeb7815311d3420aab0a1d83f050f628228cbc2d6045a14a16460411bc9";
-  };
-
-  propagatedBuildInputs = [ setuptools ];
-  checkInputs = [
-    pkgs.faad2 pkgs.flac pkgs.vorbis-tools pkgs.liboggz
-    pkgs.glibcLocales pycodestyle pyflakes pytest hypothesis
-  ];
-  LC_ALL = "en_US.UTF-8";
-
-  meta = with lib; {
-    description = "Python multimedia tagging library";
-    homepage = "https://mutagen.readthedocs.io";
-    license = licenses.lgpl2Plus;
-    platforms = platforms.all;
-  };
-}
diff --git a/pkgs/development/python2-modules/numpy/default.nix b/pkgs/development/python2-modules/numpy/default.nix
deleted file mode 100644
index 0bb01ef6812..00000000000
--- a/pkgs/development/python2-modules/numpy/default.nix
+++ /dev/null
@@ -1,99 +0,0 @@
-{ lib
-, fetchPypi
-, python
-, buildPythonPackage
-, gfortran
-, pytest
-, blas
-, lapack
-, writeTextFile
-, isPyPy
-, cython
-, setuptools
- }:
-
-assert (!blas.isILP64) && (!lapack.isILP64);
-
-let
-  cfg = writeTextFile {
-    name = "site.cfg";
-    text = (lib.generators.toINI {} {
-      ${blas.implementation} = {
-        include_dirs = "${lib.getDev blas}/include:${lib.getDev lapack}/include";
-        library_dirs = "${blas}/lib:${lapack}/lib";
-        runtime_library_dirs = "${blas}/lib:${lapack}/lib";
-        libraries = "lapack,lapacke,blas,cblas";
-      };
-      lapack = {
-        include_dirs = "${lib.getDev lapack}/include";
-        library_dirs = "${lapack}/lib";
-        runtime_library_dirs = "${lapack}/lib";
-      };
-      blas = {
-        include_dirs = "${lib.getDev blas}/include";
-        library_dirs = "${blas}/lib";
-        runtime_library_dirs = "${blas}/lib";
-      };
-    });
-  };
-in buildPythonPackage rec {
-  pname = "numpy";
-  version = "1.16.6";
-  format = "pyproject";
-
-  src = fetchPypi {
-    inherit pname version;
-    extension = "zip";
-    sha256 = "e5cf3fdf13401885e8eea8170624ec96225e2174eb0c611c6f26dd33b489e3ff";
-  };
-
-  nativeBuildInputs = [ gfortran pytest cython setuptools ];
-  buildInputs = [ blas lapack ];
-
-  patches = lib.optionals python.hasDistutilsCxxPatch [
-    # We patch cpython/distutils to fix https://bugs.python.org/issue1222585
-    # Patching of numpy.distutils is needed to prevent it from undoing the
-    # patch to distutils.
-    ./numpy-distutils-C++.patch
-  ];
-
-  preConfigure = ''
-    sed -i 's/-faltivec//' numpy/distutils/system_info.py
-    export NPY_NUM_BUILD_JOBS=$NIX_BUILD_CORES
-    export OMP_NUM_THREADS=$((NIX_BUILD_CORES > 64 ? 64 : NIX_BUILD_CORES))
-  '';
-
-  preBuild = ''
-    ln -s ${cfg} site.cfg
-  '';
-
-  enableParallelBuilding = true;
-
-  doCheck = !isPyPy; # numpy 1.16+ hits a bug in pypy's ctypes, using either numpy or pypy HEAD fixes this (https://github.com/numpy/numpy/issues/13807)
-
-  checkPhase = ''
-    runHook preCheck
-    pushd "$out"
-    ${python.interpreter} -c 'import numpy; numpy.test("fast", verbose=10)'
-    popd
-    runHook postCheck
-  '';
-
-  passthru = {
-    # just for backwards compatibility
-    blas = blas.provider;
-    blasImplementation = blas.implementation;
-    inherit cfg;
-  };
-
-  # Disable test
-  # - test_large_file_support: takes a long time and can cause the machine to run out of disk space
-  NOSE_EXCLUDE="test_large_file_support";
-
-  meta = {
-    description = "Scientific tools for Python";
-    homepage = "https://numpy.org/";
-    license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ fridh ];
-  };
-}
diff --git a/pkgs/development/python2-modules/numpy/numpy-distutils-C++.patch b/pkgs/development/python2-modules/numpy/numpy-distutils-C++.patch
deleted file mode 100644
index b2626ea26e5..00000000000
--- a/pkgs/development/python2-modules/numpy/numpy-distutils-C++.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-diff --git a/numpy/distutils/unixccompiler.py b/numpy/distutils/unixccompiler.py
---- a/numpy/distutils/unixccompiler.py
-+++ b/numpy/distutils/unixccompiler.py
-@@ -44,8 +44,6 @@ def UnixCCompiler__compile(self, obj, src, ext, cc_args, extra_postargs, pp_opts
-         if opt not in llink_s:
-             self.linker_so = llink_s.split() + opt.split()
- 
--    display = '%s: %s' % (os.path.basename(self.compiler_so[0]), src)
--
-     # gcc style automatic dependencies, outputs a makefile (-MF) that lists
-     # all headers needed by a c file as a side effect of compilation (-MMD)
-     if getattr(self, '_auto_depends', False):
-@@ -54,8 +52,15 @@ def UnixCCompiler__compile(self, obj, src, ext, cc_args, extra_postargs, pp_opts
-         deps = []
- 
-     try:
--        self.spawn(self.compiler_so + cc_args + [src, '-o', obj] + deps +
--                   extra_postargs, display = display)
-+        if self.detect_language(src) == 'c++':
-+            display = '%s: %s' % (os.path.basename(self.compiler_so_cxx[0]), src)
-+            self.spawn(self.compiler_so_cxx + cc_args + [src, '-o', obj] + deps +
-+                       extra_postargs, display = display)
-+        else:
-+            display = '%s: %s' % (os.path.basename(self.compiler_so[0]), src)
-+            self.spawn(self.compiler_so + cc_args + [src, '-o', obj] + deps +
-+                       extra_postargs, display = display)
-+
-     except DistutilsExecError:
-         msg = str(get_exception())
-         raise CompileError(msg)
diff --git a/pkgs/development/python2-modules/pillow/default.nix b/pkgs/development/python2-modules/pillow/default.nix
deleted file mode 100644
index 61242c894a8..00000000000
--- a/pkgs/development/python2-modules/pillow/default.nix
+++ /dev/null
@@ -1,47 +0,0 @@
-{ lib, stdenv, buildPythonPackage, fetchPypi, isPyPy, isPy3k
-, olefile, freetype, libjpeg, zlib, libtiff, libwebp, tcl, lcms2, tk, libX11
-, openjpeg, libimagequant, pyroma, numpy, pytestCheckHook
-}@args:
-
-import ./generic.nix (rec {
-  pname = "Pillow";
-  version = "6.2.2";
-
-  disabled = !isPy3k;
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "0l5rv8jkdrb5q846v60v03mcq64yrhklidjkgwv6s1pda71g17yv";
-  };
-
-  meta = with lib; {
-    homepage = "https://python-pillow.org/";
-    description = "The friendly PIL fork (Python Imaging Library)";
-    longDescription = ''
-      The Python Imaging Library (PIL) adds image processing
-      capabilities to your Python interpreter.  This library
-      supports many file formats, and provides powerful image
-      processing and graphics capabilities.
-    '';
-    license = "http://www.pythonware.com/products/pil/license.htm";
-    maintainers = with maintainers; [ goibhniu prikhi SuperSandro2000 ];
-    knownVulnerabilities = [
-      "CVE-2020-10177"
-      "CVE-2020-10378"
-      "CVE-2020-10379"
-      "CVE-2020-10994"
-      "CVE-2020-11538"
-      "CVE-2020-35653"
-      "CVE-2020-35654"
-      "CVE-2020-35655"
-      "CVE-2021-25289"
-      "CVE-2021-25290"
-      "CVE-2021-25291"
-      "CVE-2021-25292"
-      "CVE-2021-25293"
-      "CVE-2021-27921"
-      "CVE-2021-27922"
-      "CVE-2021-27923"
-    ];
-  };
-} // args )
diff --git a/pkgs/development/python2-modules/pillow/generic.nix b/pkgs/development/python2-modules/pillow/generic.nix
deleted file mode 100644
index 3e33f1a8aa0..00000000000
--- a/pkgs/development/python2-modules/pillow/generic.nix
+++ /dev/null
@@ -1,77 +0,0 @@
-{ pname
-, version
-, disabled
-, src
-, meta
-, ...
-}@args:
-
-with args;
-
-buildPythonPackage rec {
-  inherit pname version src meta;
-
-  # Disable imagefont tests, because they don't work well with infinality:
-  # https://github.com/python-pillow/Pillow/issues/1259
-  postPatch = ''
-    rm Tests/test_imagefont.py
-  '';
-
-  # Disable darwin tests which require executables: `iconutil` and `screencapture`
-  disabledTests = lib.optionals stdenv.isDarwin [
-    "test_grab"
-    "test_grabclipboard"
-    "test_save"
-
-    # pillow-simd
-    "test_roundtrip"
-    "test_basic"
-  ] ++ lib.optionals (lib.versions.major version == "6") [
-    # RuntimeError: Error setting from dictionary
-    "test_custom_metadata"
-  ];
-
-  propagatedBuildInputs = [ olefile ]
-    ++ lib.optionals (lib.versionAtLeast version "8.2.0") [ defusedxml ];
-
-  checkInputs = [ pytestCheckHook pyroma numpy ];
-
-  buildInputs = [ freetype libjpeg openjpeg libimagequant zlib libtiff libwebp tcl lcms2 ]
-    ++ lib.optionals (lib.versionAtLeast version "7.1.0") [ libxcb ]
-    ++ lib.optionals (isPyPy) [ tk libX11 ];
-
-  # NOTE: we use LCMS_ROOT as WEBP root since there is not other setting for webp.
-  # NOTE: The Pillow install script will, by default, add paths like /usr/lib
-  # and /usr/include to the search paths. This can break things when building
-  # on a non-NixOS system that has some libraries installed that are not
-  # installed in Nix (for example, Arch Linux has jpeg2000 but Nix doesn't
-  # build Pillow with this support). We patch the `disable_platform_guessing`
-  # setting here, instead of passing the `--disable-platform-guessing`
-  # command-line option, since the command-line option doesn't work when we run
-  # tests.
-  preConfigure = let
-    libinclude' = pkg: ''"${pkg.out}/lib", "${pkg.out}/include"'';
-    libinclude = pkg: ''"${pkg.out}/lib", "${pkg.dev}/include"'';
-  in ''
-    sed -i "setup.py" \
-        -e 's|^FREETYPE_ROOT =.*$|FREETYPE_ROOT = ${libinclude freetype}|g ;
-            s|^JPEG_ROOT =.*$|JPEG_ROOT = ${libinclude libjpeg}|g ;
-            s|^JPEG2K_ROOT =.*$|JPEG2K_ROOT = ${libinclude openjpeg}|g ;
-            s|^IMAGEQUANT_ROOT =.*$|IMAGEQUANT_ROOT = ${libinclude' libimagequant}|g ;
-            s|^ZLIB_ROOT =.*$|ZLIB_ROOT = ${libinclude zlib}|g ;
-            s|^LCMS_ROOT =.*$|LCMS_ROOT = ${libinclude lcms2}|g ;
-            s|^TIFF_ROOT =.*$|TIFF_ROOT = ${libinclude libtiff}|g ;
-            s|^TCL_ROOT=.*$|TCL_ROOT = ${libinclude' tcl}|g ;
-            s|self\.disable_platform_guessing = None|self.disable_platform_guessing = True|g ;'
-    export LDFLAGS="$LDFLAGS -L${libwebp}/lib"
-    export CFLAGS="$CFLAGS -I${libwebp}/include"
-  '' + lib.optionalString (lib.versionAtLeast version "7.1.0") ''
-    export LDFLAGS="$LDFLAGS -L${libxcb}/lib"
-    export CFLAGS="$CFLAGS -I${libxcb.dev}/include"
-  '' + lib.optionalString stdenv.isDarwin ''
-    # Remove impurities
-    substituteInPlace setup.py \
-      --replace '"/Library/Frameworks",' "" \
-      --replace '"/System/Library/Frameworks"' ""
-  '';
-}
diff --git a/pkgs/development/python2-modules/prettytable/default.nix b/pkgs/development/python2-modules/prettytable/default.nix
deleted file mode 100644
index 8191e9b5f57..00000000000
--- a/pkgs/development/python2-modules/prettytable/default.nix
+++ /dev/null
@@ -1,37 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, glibcLocales
-, setuptools-scm
-, wcwidth
-}:
-
-buildPythonPackage rec {
-  pname = "prettytable";
-  version = "1.0.1";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "0wcpp1nkicrswb353yn6xd2x535cpif62nw5rgz33c1wj0wzbdvb";
-  };
-
-  nativeBuildInputs = [ setuptools-scm ];
-  buildInputs = [ glibcLocales ];
-
-  propagatedBuildInputs = [ wcwidth ];
-
-  preCheck = ''
-    export LANG="en_US.UTF-8"
-  '';
-
-  # no test no longer available in pypi package
-  doCheck = false;
-  pythonImportsCheck = [ "prettytable" ];
-
-  meta = with lib; {
-    description = "Simple Python library for easily displaying tabular data in a visually appealing ASCII table format";
-    homepage = "http://code.google.com/p/prettytable/";
-    license = licenses.bsd3;
-  };
-
-}
diff --git a/pkgs/development/python2-modules/pyyaml/default.nix b/pkgs/development/python2-modules/pyyaml/default.nix
deleted file mode 100644
index 3edfae90e66..00000000000
--- a/pkgs/development/python2-modules/pyyaml/default.nix
+++ /dev/null
@@ -1,38 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, cython
-, libyaml
-, isPy27
-, python
-}:
-
-buildPythonPackage rec {
-  pname = "PyYAML";
-  version = "5.4.1.1";
-
-  src = fetchFromGitHub {
-    owner = "yaml";
-    repo = "pyyaml";
-    rev = version;
-    sha256 = "1v386gzdvsjg0mgix6v03rd0cgs9dl81qvn3m547849jm8r41dx8";
-  };
-
-  nativeBuildInputs = [ cython ];
-
-  buildInputs = [ libyaml ];
-
-  checkPhase = ''
-    runHook preCheck
-    PYTHONPATH=""tests/lib":$PYTHONPATH" ${python.interpreter} -m test_all
-    runHook postCheck
-  '';
-
-  pythonImportsCheck = [ "yaml" ];
-
-  meta = with lib; {
-    description = "The next generation YAML parser and emitter for Python";
-    homepage = "https://github.com/yaml/pyyaml";
-    license = licenses.mit;
-  };
-}
diff --git a/pkgs/development/python2-modules/qpid-python/default.nix b/pkgs/development/python2-modules/qpid-python/default.nix
deleted file mode 100644
index e22b3215e81..00000000000
--- a/pkgs/development/python2-modules/qpid-python/default.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchurl
-, isPy3k
-}:
-
-buildPythonPackage rec {
-  pname = "qpid-python";
-  version = "0.32";
-  disabled = isPy3k;
-
-  src = fetchurl {
-    url = "http://www.us.apache.org/dist/qpid/${version}/${pname}-${version}.tar.gz";
-    sha256 = "09hdfjgk8z4s3dr8ym2r6xn97j1f9mkb2743pr6zd0bnj01vhsv4";
-  };
-
-  # needs a broker running and then ./qpid-python-test
-  doCheck = false;
-
-  meta = with lib; {
-    homepage = "https://qpid.apache.org/";
-    description = "Python client implementation and AMQP conformance tests for Apache Qpid";
-    license = licenses.asl20;
-  };
-
-}
diff --git a/pkgs/development/r-modules/default.nix b/pkgs/development/r-modules/default.nix
index f5bed2e3f5b..22941031515 100644
--- a/pkgs/development/r-modules/default.nix
+++ b/pkgs/development/r-modules/default.nix
@@ -321,13 +321,13 @@ let
     Biostrings = [ pkgs.zlib ];
     bnpmr = [ pkgs.gsl ];
     cairoDevice = [ pkgs.gtk2.dev ];
-    Cairo = with pkgs; [ libtiff libjpeg cairo.dev xlibsWrapper fontconfig.lib ];
+    Cairo = with pkgs; [ libtiff libjpeg cairo.dev xorg.libXt.dev fontconfig.lib ];
     Cardinal = [ pkgs.which ];
     chebpol = [ pkgs.fftw.dev ];
     ChemmineOB = with pkgs; [ openbabel pkg-config ];
     curl = [ pkgs.curl.dev ];
     data_table = [ pkgs.zlib.dev ] ++ lib.optional stdenv.isDarwin pkgs.llvmPackages.openmp;
-    devEMF = with pkgs; [ xorg.libXft.dev xlibsWrapper ];
+    devEMF = with pkgs; [ xorg.libXft.dev ];
     diversitree = with pkgs; [ gsl fftw ];
     exactextractr = [ pkgs.geos ];
     EMCluster = [ pkgs.lapack ];
@@ -346,7 +346,7 @@ let
     haven = with pkgs; [ libiconv zlib.dev ];
     h5vc = [ pkgs.zlib.dev ];
     HiCseg = [ pkgs.gsl ];
-    imager = [ pkgs.xlibsWrapper ];
+    imager = [ pkgs.xorg.libX11.dev ];
     iBMQ = [ pkgs.gsl ];
     igraph = with pkgs; [ gmp libxml2.dev ];
     JavaGD = [ pkgs.jdk ];
diff --git a/pkgs/development/tools/agda-pkg/default.nix b/pkgs/development/tools/agda-pkg/default.nix
index 7c4ddb8a688..498b38ec7af 100644
--- a/pkgs/development/tools/agda-pkg/default.nix
+++ b/pkgs/development/tools/agda-pkg/default.nix
@@ -1,4 +1,6 @@
-{ lib, python3Packages }:
+{ lib
+, python3Packages
+}:
 
 with python3Packages;
 
@@ -22,7 +24,7 @@ buildPythonApplication rec {
 
   propagatedBuildInputs = [
     click
-    GitPython
+    gitpython
     pony
     whoosh
     natsort
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index 105080ce223..2db9533590a 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -70,7 +70,7 @@ buildPythonApplication rec {
     dockerfile-parse
     dpath
     flake8
-    GitPython
+    gitpython
     jmespath
     jsonpath-ng
     jsonschema
diff --git a/pkgs/development/tools/analysis/cvehound/default.nix b/pkgs/development/tools/analysis/cvehound/default.nix
index 12d36dc6089..5bd6cdc0069 100644
--- a/pkgs/development/tools/analysis/cvehound/default.nix
+++ b/pkgs/development/tools/analysis/cvehound/default.nix
@@ -27,7 +27,7 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   checkInputs = with python3.pkgs; [
-    GitPython
+    gitpython
     psutil
     pytestCheckHook
   ];
diff --git a/pkgs/development/tools/analysis/smatch/default.nix b/pkgs/development/tools/analysis/smatch/default.nix
index ff746209106..2100b72c987 100644
--- a/pkgs/development/tools/analysis/smatch/default.nix
+++ b/pkgs/development/tools/analysis/smatch/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "smatch";
-  version = "1.72";
+  version = "1.73";
 
   src = fetchFromGitHub {
     owner = "error27";
     repo = "smatch";
     rev = version;
-    sha256 = "sha256-XVW4sAgIxaJjAk75bp/O286uddIfgfKtIA2LniUGWBM=";
+    sha256 = "sha256-Pv3bd2cjnQKnhH7TrkYWfDEeaq6u/q/iK1ZErzn6bME=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "A semantic analysis tool for C";
-    homepage = "http://smatch.sourceforge.net/";
+    homepage = "https://sparse.docs.kernel.org/";
     maintainers = with maintainers; [ marsam ];
     license = licenses.gpl2Plus;
     platforms = platforms.all;
diff --git a/pkgs/development/tools/ansible-language-server/default.nix b/pkgs/development/tools/ansible-language-server/default.nix
index be4bba8c265..8d9b1f0ca50 100644
--- a/pkgs/development/tools/ansible-language-server/default.nix
+++ b/pkgs/development/tools/ansible-language-server/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildNpmPackage
 , fetchFromGitHub
+, nix-update-script
 }:
 
 buildNpmPackage rec {
@@ -29,7 +30,7 @@ buildNpmPackage rec {
     sed -i '/"prepack"/d' package.json
   '';
 
-  passthru.updateScript = {
+  passthru.updateScript = nix-update-script {
     attrPath = pname;
   };
 
diff --git a/pkgs/development/tools/bbin/default.nix b/pkgs/development/tools/bbin/default.nix
new file mode 100644
index 00000000000..55e152e22ab
--- /dev/null
+++ b/pkgs/development/tools/bbin/default.nix
@@ -0,0 +1,44 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+, makeWrapper
+, babashka
+, graalvm17-ce
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "bbin";
+  version = "0.1.4";
+
+  src = fetchFromGitHub {
+    owner = "babashka";
+    repo = "bbin";
+    rev = "v${version}";
+    sha256 = "sha256-Oo6YF+uxcUG26Pz1X5uzPE/Hsx0UToOErZ2oUiKuZyI=";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D bbin $out/bin/bbin
+    mkdir -p $out/share
+    cp -r docs $out/share/docs
+    wrapProgram $out/bin/bbin \
+      --prefix PATH : "${lib.makeBinPath [ babashka graalvm17-ce ]}"
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/babashka/bbin";
+    description = "Install any Babashka script or project with one command";
+    license = licenses.mit;
+    inherit (babashka.meta) platforms;
+    maintainers = with maintainers; [ sohalt ];
+  };
+}
diff --git a/pkgs/development/tools/build-managers/muon/default.nix b/pkgs/development/tools/build-managers/muon/default.nix
index b94a376ebb3..69320cc217e 100644
--- a/pkgs/development/tools/build-managers/muon/default.nix
+++ b/pkgs/development/tools/build-managers/muon/default.nix
@@ -81,14 +81,13 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   buildPhase = let
-    muonFeatureFlag = feature: flag:
-      "-D${feature}=${if flag then "enabled" else "disabled"}";
-    muonConditionFlag = condition: flag:
-      "-D${condition}=${lib.boolToString flag}";
+    muonBool = lib.mesonBool;
+    muonEnable = lib.mesonEnable;
+
     cmdlineForMuon = lib.concatStringsSep " " [
-      (muonConditionFlag "static" stdenv.targetPlatform.isStatic)
-      (muonFeatureFlag "docs" buildDocs)
-      (muonFeatureFlag "samurai" embedSamurai)
+      (muonBool "static" stdenv.targetPlatform.isStatic)
+      (muonEnable "docs" buildDocs)
+      (muonEnable "samurai" embedSamurai)
     ];
     cmdlineForSamu = "-j$NIX_BUILD_CORES";
   in ''
diff --git a/pkgs/development/tools/buildpack/default.nix b/pkgs/development/tools/buildpack/default.nix
index db5898a6059..c8a74bd0308 100644
--- a/pkgs/development/tools/buildpack/default.nix
+++ b/pkgs/development/tools/buildpack/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "pack";
-  version = "0.27.0";
+  version = "0.28.0";
 
   src = fetchFromGitHub {
     owner = "buildpacks";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-b1lqgY6pu4yt3yY2UupG7PQUkgotK0VDffCW/0thxoo=";
+    sha256 = "sha256-FKnOqK3qmzWEmf+92up8ApeotyQyZpbmLDY72U3+mY8=";
   };
 
-  vendorSha256 = "sha256-JqSk4w0chtWNYDQXo8oh5spAxor2kixo3fZcpV4LJ+8=";
+  vendorSha256 = "sha256-dYa6OuC2ingAh2VOzyGR4lK1GbTJ/l9iKXYWqRJmByc=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/castxml/default.nix b/pkgs/development/tools/castxml/default.nix
index 5e3801628e7..a944550f079 100644
--- a/pkgs/development/tools/castxml/default.nix
+++ b/pkgs/development/tools/castxml/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "castxml";
-  version = "0.4.8";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "CastXML";
     repo = "CastXML";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-9IdQWNbk28OdpxVU1t4d1sGvjc62GeWUueYGDKRfOy4=";
+    hash = "sha256-NJ6DIZWab9KayFALHON9GfYg6sQOf71SbtfV+3TYKLQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/coder/default.nix b/pkgs/development/tools/coder/default.nix
index 080e73ab268..6cc572b87bc 100644
--- a/pkgs/development/tools/coder/default.nix
+++ b/pkgs/development/tools/coder/default.nix
@@ -5,19 +5,19 @@
 }:
 buildGoModule rec {
   pname = "coder";
-  version = "0.12.5";
+  version = "0.13.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-tPpWj2MV2LLIOGq+RTpHpLozgqv7gBgYD3jjehRXOvk=";
+    hash = "sha256-85eH3gKn1khMiksA/kL+fHt1WiaOzVntYCiL1PR/0Cg=";
   };
 
   # integration tests require network access
   doCheck = false;
 
-  vendorHash = "sha256-3SStGCDpo+AS4PM9mbXM0EjsJ/3CVFQyb/NRK9RSZ3A=";
+  vendorHash = "sha256-tdqqGM2b8un4BFtvRJsmiIGdb1AOKP8XxcgGg2DilXA=";
 
   nativeBuildInputs = [ installShellFiles ];
 
@@ -29,9 +29,9 @@ buildGoModule rec {
   '';
 
   meta = with lib; {
-    description = "Remote development environments on your infrastructure provisioned with Terraform";
+    description = "Provision software development environments via Terraform on Linux, macOS, Windows, X86, ARM, and of course, Kubernetes";
     homepage = "https://coder.com";
     license = licenses.agpl3;
-    maintainers = with maintainers; [ urandom ];
+    maintainers = with maintainers; [ ghuntley urandom ];
   };
 }
diff --git a/pkgs/development/tools/continuous-integration/github-runner/default.nix b/pkgs/development/tools/continuous-integration/github-runner/default.nix
index 84c9c926849..9947f12e523 100644
--- a/pkgs/development/tools/continuous-integration/github-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/github-runner/default.nix
@@ -7,6 +7,7 @@
 , fetchFromGitHub
 , fetchurl
 , git
+, glibc
 , icu
 , libkrb5
 , lib
@@ -259,7 +260,12 @@ stdenv.mkDerivation rec {
     substituteInPlace $out/lib/run.sh    --replace '"$DIR"/bin' '"$DIR"/lib'
     substituteInPlace $out/lib/config.sh --replace './bin' $out'/lib' \
       --replace 'source ./env.sh' $out/bin/env.sh
-
+  '' + lib.optionalString stdenv.isLinux ''
+    # Make binary paths absolute
+    substituteInPlace $out/lib/config.sh \
+      --replace 'ldd' '${glibc}/bin/ldd' \
+      --replace '/sbin/ldconfig' '${glibc}/bin/ldconfig'
+  '' + ''
     # Remove uneeded copy for run-helper template
     substituteInPlace $out/lib/run.sh --replace 'cp -f "$DIR"/run-helper.sh.template "$DIR"/run-helper.sh' ' '
     substituteInPlace $out/lib/run-helper.sh --replace '"$DIR"/bin/' '"$DIR"/'
diff --git a/pkgs/development/tools/cue/validator.nix b/pkgs/development/tools/cue/validator.nix
new file mode 100644
index 00000000000..cddc3fe342b
--- /dev/null
+++ b/pkgs/development/tools/cue/validator.nix
@@ -0,0 +1,17 @@
+{ cue, writeShellScript, lib }:
+# `document` must be a fragment of definition or structure that the input data will be matched against.
+# `document` must exist in the Cue schema file provided (`cueSchemaFile`).
+# The result is a script that can be used to validate the input data (JSON/YAML and more can be supported depending on Cue)
+# against the fragment described by `document` or the whole definition.
+# The script will be strict and enforce concrete values, i.e. partial documents are not supported.
+cueSchemaFile: { document ? null }:
+  writeShellScript "validate-using-cue"
+  ''${cue}/bin/cue \
+      --all-errors \
+      --strict \
+      vet \
+      --concrete \
+      "$1" \
+      ${cueSchemaFile} \
+      ${lib.optionalString (document != null) "-d \"${document}\""}
+  ''
diff --git a/pkgs/development/tools/ddosify/default.nix b/pkgs/development/tools/ddosify/default.nix
index 0cefbfc9281..b13b396cbf3 100644
--- a/pkgs/development/tools/ddosify/default.nix
+++ b/pkgs/development/tools/ddosify/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "ddosify";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-8sqOhhuneLFxhmZjoMYYfWw9wv55zWzw3QQEZW+hxBU=";
+    sha256 = "sha256-CUCIY3tDkmNPnHFgfjWa5wVFvaSWV9DAyPFx3+dHxZQ=";
   };
 
   vendorSha256 = "sha256-mq82KNa01gHvW+RUREra+ysaJ1YWIwX0v/uYMxmFN4M=";
diff --git a/pkgs/development/tools/esbuild/default.nix b/pkgs/development/tools/esbuild/default.nix
index df4729eeb81..afb3b1c17e0 100644
--- a/pkgs/development/tools/esbuild/default.nix
+++ b/pkgs/development/tools/esbuild/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "esbuild";
-  version = "0.15.18";
+  version = "0.16.1";
 
   src = fetchFromGitHub {
     owner = "evanw";
     repo = "esbuild";
     rev = "v${version}";
-    sha256 = "sha256-b9R1ML+pgRg9j2yrkQmBulPuLHYLUQvW+WTyR/Cq6zE=";
+    sha256 = "sha256-5b9uJfIGWDQi5exPVCgK/9wrozptX1FebPMrWJ0v4TM=";
   };
 
   vendorSha256 = "sha256-+BfxCyg0KkDQpHt/wycy/8CTG6YBA/VJvJFhhzUnSiQ=";
diff --git a/pkgs/development/tools/fdroidserver/default.nix b/pkgs/development/tools/fdroidserver/default.nix
index 69c4e990780..07448b21bb8 100644
--- a/pkgs/development/tools/fdroidserver/default.nix
+++ b/pkgs/development/tools/fdroidserver/default.nix
@@ -1,12 +1,12 @@
-{ fetchFromGitLab
+{ lib
+, fetchFromGitLab
 , python
-, lib
 , apksigner
 }:
 
 python.pkgs.buildPythonApplication rec {
-  version = "2.1.1";
   pname = "fdroidserver";
+  version = "2.1.1";
 
   src = fetchFromGitLab {
     owner = "fdroid";
@@ -16,24 +16,28 @@ python.pkgs.buildPythonApplication rec {
   };
 
   postPatch = ''
-    substituteInPlace fdroidserver/common.py --replace "FDROID_PATH = os.path.realpath(os.path.join(os.path.dirname(__file__), '..'))" "FDROID_PATH = '$out/bin'"
+    substituteInPlace fdroidserver/common.py \
+      --replace "FDROID_PATH = os.path.realpath(os.path.join(os.path.dirname(__file__), '..'))" "FDROID_PATH = '$out/bin'"
   '';
 
   preConfigure = ''
     ${python.interpreter} setup.py compile_catalog
   '';
+
   postInstall = ''
     patchShebangs gradlew-fdroid
     install -m 0755 gradlew-fdroid $out/bin
   '';
 
-  buildInputs = [ python.pkgs.babel ];
+  buildInputs = with python.pkgs; [
+    babel
+  ];
 
   propagatedBuildInputs = with python.pkgs; [
     androguard
     clint
     defusedxml
-    GitPython
+    gitpython
     libcloud
     mwclient
     paramiko
@@ -59,7 +63,7 @@ python.pkgs.buildPythonApplication rec {
     homepage = "https://f-droid.org";
     description = "Server and tools for F-Droid, the Free Software repository system for Android";
     license = licenses.agpl3;
-    maintainers = [ lib.maintainers.obfusk ];
+    maintainers = with maintainers; [ obfusk ];
   };
 
 }
diff --git a/pkgs/development/tools/fnm/default.nix b/pkgs/development/tools/fnm/default.nix
index b6d1688e5e6..6509f371e4f 100644
--- a/pkgs/development/tools/fnm/default.nix
+++ b/pkgs/development/tools/fnm/default.nix
@@ -10,20 +10,20 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "fnm";
-  version = "1.32.0";
+  version = "1.33.1";
 
   src = fetchFromGitHub {
     owner = "Schniz";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ttprb8w4EWq2F8TbeUt+rCc0paxLXkEzISnAskIstmo=";
+    sha256 = "sha256-dwnPFbgfrc+1qF3u5Nm1KQu84UWK6H6VerSUaQacbRs=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
 
   buildInputs = lib.optionals stdenv.isDarwin [ DiskArbitration Foundation Security ];
 
-  cargoSha256 = "sha256-6nw7q/XQ3EOaXmyiqJJjLSX4W9Mn9W5nfl8shUttBx0=";
+  cargoSha256 = "sha256-T88C5oYyVfepUw0cdNRhEwrvEI0t1gw/5qZL1E46pkY=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/go-mockery/default.nix b/pkgs/development/tools/go-mockery/default.nix
index a1b406ff866..3b7911c20fe 100644
--- a/pkgs/development/tools/go-mockery/default.nix
+++ b/pkgs/development/tools/go-mockery/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "go-mockery";
-  version = "2.14.1";
+  version = "2.15.0";
 
   src = fetchFromGitHub {
     owner = "vektra";
     repo = "mockery";
     rev = "v${version}";
-    sha256 = "sha256-FgDjuiBFzOaT8GlJYI7xNfxC9uhyZtBAIBFXZgW0BDU=";
+    sha256 = "sha256-RowVdrpUQdoxgJCrg9rzaF/7ZA09SKzjsVrzQb5wzR8=";
   };
 
   preCheck = ''
diff --git a/pkgs/development/tools/go-task/default.nix b/pkgs/development/tools/go-task/default.nix
index c428c8160ec..c9d15f02012 100644
--- a/pkgs/development/tools/go-task/default.nix
+++ b/pkgs/development/tools/go-task/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "go-task";
-  version = "3.18.0";
+  version = "3.19.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = "task";
     rev = "v${version}";
-    sha256 = "sha256-b5YNiMnk1tBk7kO4YWAU8cyg5oHhKu95ogTtZ3N/6IY=";
+    sha256 = "sha256-UsMUBdhoWl2e4i3m7Tu4R3qULRf85V4Uw/52xMMyWio=";
   };
 
   vendorSha256 = "sha256-+DmnYd415FWgbY+gkDVWjnvbjTppfFV5NMpIE3Mm124=";
diff --git a/pkgs/development/tools/godot/4/default.nix b/pkgs/development/tools/godot/4/default.nix
index 177e2448cc3..13ccfcc8096 100644
--- a/pkgs/development/tools/godot/4/default.nix
+++ b/pkgs/development/tools/godot/4/default.nix
@@ -91,7 +91,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  sconsFlags = "platform=linuxbsd target=editor production=true";
+  sconsFlags = [ "platform=linuxbsd target=editor production=true" ];
   preConfigure = ''
     sconsFlags+=" ${
       lib.concatStringsSep " "
diff --git a/pkgs/development/tools/hcloud/default.nix b/pkgs/development/tools/hcloud/default.nix
index 6aa8cd74f1f..758a4c1fbaa 100644
--- a/pkgs/development/tools/hcloud/default.nix
+++ b/pkgs/development/tools/hcloud/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "hcloud";
-  version = "1.31.0";
+  version = "1.31.1";
 
   src = fetchFromGitHub {
     owner = "hetznercloud";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-AYxuH0R8vS7vBcEca1xM/0F70x5Zr+NUmcfRrRjb6cs=";
+    sha256 = "sha256-GyUobaU8ZJG/LrMM2LevBBhZN70grx6iJIMRxBRMqBg=";
   };
 
   vendorSha256 = "sha256-sSsu8p9dHLzJRWSLQHQNMmoziOrlDL4BoLIcBo2REbQ=";
diff --git a/pkgs/development/tools/misc/circleci-cli/default.nix b/pkgs/development/tools/misc/circleci-cli/default.nix
index c70569fd751..c4e0a47257e 100644
--- a/pkgs/development/tools/misc/circleci-cli/default.nix
+++ b/pkgs/development/tools/misc/circleci-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "circleci-cli";
-  version = "0.1.22675";
+  version = "0.1.22770";
 
   src = fetchFromGitHub {
     owner = "CircleCI-Public";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-yCjCsUxl2IUIsiHBlqdNLtjbr+wNn6BpssD3+EHsHKA=";
+    sha256 = "sha256-3IQSI2cG+wEH7IgV8nEWvQRdfsSap8wQCniMWL/khOg=";
   };
 
   vendorSha256 = "sha256-tTG2i6ZEck0arKfCiFK7pGg9SE4n7FrF16US67Wj1gY=";
diff --git a/pkgs/development/tools/misc/svls/default.nix b/pkgs/development/tools/misc/svls/default.nix
index e5a26b75aa0..5b5b87b0392 100644
--- a/pkgs/development/tools/misc/svls/default.nix
+++ b/pkgs/development/tools/misc/svls/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "svls";
-  version = "0.2.5";
+  version = "0.2.6";
 
   src = fetchFromGitHub {
     owner = "dalance";
     repo = "svls";
     rev = "v${version}";
-    sha256 = "sha256-SeVLQ05vPywSOnOEhJhQXYhdptmIhvYbbf9SX5eVzik=";
+    sha256 = "sha256-1qYTYAXNMM3umRFpWoij8VU3rhBI4QWePa5Uaz2Y4Ik=";
   };
 
-  cargoSha256 = "sha256-jp84LqFuK6Du2mWmgvadD7p8n/zcLKAKBOMQiERTKBI=";
+  cargoSha256 = "sha256-il7n8uxeXPKCBpRv3rqZZzqWjfpy558YNKBs9qOJ2oI=";
 
   meta = with lib; {
     description = "SystemVerilog language server";
diff --git a/pkgs/development/tools/misc/terraform-ls/default.nix b/pkgs/development/tools/misc/terraform-ls/default.nix
index 0148cbb7f97..175f2b016e3 100644
--- a/pkgs/development/tools/misc/terraform-ls/default.nix
+++ b/pkgs/development/tools/misc/terraform-ls/default.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "terraform-ls";
-  version = "0.30.0";
+  version = "0.30.1";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-CyWOXyJ9c7gf+WznU1SLX7tEM1f95015w9ePVwZ7GJU=";
+    sha256 = "sha256-enPnj4/p83hQkVv821MGyGipgEmVo12IZzy/3y8UprQ=";
   };
-  vendorSha256 = "sha256-UYFw9srf4FcF2XGIfsJQsRapEwcOHql59rKeKUnXPLo=";
+  vendorSha256 = "sha256-U3zslBDVz5nvhNgcn5L84hSUolf7XFCuh7zMZxyW/gQ=";
 
   ldflags = [ "-s" "-w" "-X main.version=v${version}" "-X main.prerelease=" ];
 
diff --git a/pkgs/development/tools/ocaml/js_of_ocaml/compiler.nix b/pkgs/development/tools/ocaml/js_of_ocaml/compiler.nix
index 64313112f43..cec91a02f20 100644
--- a/pkgs/development/tools/ocaml/js_of_ocaml/compiler.nix
+++ b/pkgs/development/tools/ocaml/js_of_ocaml/compiler.nix
@@ -5,12 +5,12 @@
 
 buildDunePackage rec {
   pname = "js_of_ocaml-compiler";
-  version = "4.0.0";
-  useDune2 = true;
+  version = "4.1.0";
+  duneVersion = "3";
 
   src = fetchurl {
     url = "https://github.com/ocsigen/js_of_ocaml/releases/download/${version}/js_of_ocaml-${version}.tbz";
-    sha256 = "sha256:0pj9jjrmi0xxrzmygv4b5whsibw1jxy3wgibmws85x5jwlczh0nz";
+    sha256 = "sha256-kXk/KaWvPeq6P301zqsR5znP4KXMMFVvYgFGGm1CNu8=";
   };
 
   nativeBuildInputs = [ menhir ];
diff --git a/pkgs/development/tools/ocaml/js_of_ocaml/default.nix b/pkgs/development/tools/ocaml/js_of_ocaml/default.nix
index 679fd9ab9de..9a86e52c65a 100644
--- a/pkgs/development/tools/ocaml/js_of_ocaml/default.nix
+++ b/pkgs/development/tools/ocaml/js_of_ocaml/default.nix
@@ -5,7 +5,8 @@
 buildDunePackage {
   pname = "js_of_ocaml";
 
-  inherit (js_of_ocaml-compiler) version src useDune2;
+  inherit (js_of_ocaml-compiler) version src;
+  duneVersion = "3";
 
   buildInputs = [ ppxlib ];
 
diff --git a/pkgs/development/tools/ocaml/js_of_ocaml/lwt.nix b/pkgs/development/tools/ocaml/js_of_ocaml/lwt.nix
index 8cdb7224d89..741dd1f6acd 100644
--- a/pkgs/development/tools/ocaml/js_of_ocaml/lwt.nix
+++ b/pkgs/development/tools/ocaml/js_of_ocaml/lwt.nix
@@ -5,7 +5,8 @@
 buildDunePackage {
   pname = "js_of_ocaml-lwt";
 
-  inherit (js_of_ocaml-compiler) version src useDune2;
+  inherit (js_of_ocaml-compiler) version src;
+  duneVersion = "3";
 
   buildInputs = [ js_of_ocaml-ppx ];
 
diff --git a/pkgs/development/tools/ocaml/js_of_ocaml/ppx.nix b/pkgs/development/tools/ocaml/js_of_ocaml/ppx.nix
index 535fe6dae79..8c473d90996 100644
--- a/pkgs/development/tools/ocaml/js_of_ocaml/ppx.nix
+++ b/pkgs/development/tools/ocaml/js_of_ocaml/ppx.nix
@@ -6,7 +6,8 @@
 buildDunePackage {
   pname = "js_of_ocaml-ppx";
 
-  inherit (js_of_ocaml-compiler) version src useDune2;
+  inherit (js_of_ocaml-compiler) version src;
+  duneVersion = "3";
 
   buildInputs = [ js_of_ocaml ];
   propagatedBuildInputs = [ ppxlib ];
diff --git a/pkgs/development/tools/ocaml/js_of_ocaml/ppx_deriving_json.nix b/pkgs/development/tools/ocaml/js_of_ocaml/ppx_deriving_json.nix
index 5256cd4037f..0bb0674d322 100644
--- a/pkgs/development/tools/ocaml/js_of_ocaml/ppx_deriving_json.nix
+++ b/pkgs/development/tools/ocaml/js_of_ocaml/ppx_deriving_json.nix
@@ -5,7 +5,8 @@
 buildDunePackage {
   pname = "js_of_ocaml-ppx_deriving_json";
 
-  inherit (js_of_ocaml-compiler) version src useDune2;
+  inherit (js_of_ocaml-compiler) version src;
+  duneVersion = "3";
 
   propagatedBuildInputs = [ js_of_ocaml ppxlib ];
 
diff --git a/pkgs/development/tools/open-policy-agent/default.nix b/pkgs/development/tools/open-policy-agent/default.nix
index b7f94177c58..3631c0e9e7f 100644
--- a/pkgs/development/tools/open-policy-agent/default.nix
+++ b/pkgs/development/tools/open-policy-agent/default.nix
@@ -11,13 +11,13 @@ assert enableWasmEval && stdenv.isDarwin -> builtins.throw "building with wasm o
 
 buildGoModule rec {
   pname = "open-policy-agent";
-  version = "0.45.0";
+  version = "0.47.0";
 
   src = fetchFromGitHub {
     owner = "open-policy-agent";
     repo = "opa";
     rev = "v${version}";
-    sha256 = "sha256-7w5HOZr1cei7AvMdHdVzjB3ZQGWCOgm/g9UhuO3vSJI=";
+    sha256 = "sha256-aN/3xJFAc4r1nXF01tz4G4lP1KEQZQ3y+QuJ+wToD6M=";
   };
   vendorSha256 = null;
 
diff --git a/pkgs/development/tools/pip-audit/default.nix b/pkgs/development/tools/pip-audit/default.nix
index c734cfd3c0f..cf9c2cf585c 100644
--- a/pkgs/development/tools/pip-audit/default.nix
+++ b/pkgs/development/tools/pip-audit/default.nix
@@ -25,14 +25,14 @@ with py.pkgs;
 
 buildPythonApplication rec {
   pname = "pip-audit";
-  version = "2.4.7";
+  version = "2.4.8";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "trailofbits";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-LiL1TtMKypI8tVa0uZm1sCudCbw+pnTo/Z/J/PL2+44=";
+    hash = "sha256-j5B/aDDVV/Wb71nVwc4CUxS8AY05AI+n042Q/yNAl0c=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/default.nix b/pkgs/development/tools/poetry2nix/poetry2nix/default.nix
index 4b10b3f8dd9..6dad28bbdc0 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/default.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/default.nix
@@ -5,7 +5,7 @@
 }:
 let
   # Poetry2nix version
-  version = "1.37.0";
+  version = "1.38.0";
 
   inherit (poetryLib) isCompatible readTOML normalizePackageName normalizePackageSet;
 
@@ -221,6 +221,16 @@ lib.makeScope pkgs.newScope (self: {
         getFunctorFn
         (
           [
+            # Remove Python packages aliases with non-normalized names to avoid issues with infinite recursion (issue #750).
+            (self: super: lib.attrsets.mapAttrs
+              (
+                name: value:
+                  if lib.isDerivation value && self.hasPythonModule value && (normalizePackageName name) != name
+                  then null
+                  else value
+              )
+              super)
+
             (
               self: super:
                 {
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/overrides/build-systems.json b/pkgs/development/tools/poetry2nix/poetry2nix/overrides/build-systems.json
index b0607e26160..a2c30400a60 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/overrides/build-systems.json
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/overrides/build-systems.json
@@ -1204,6 +1204,9 @@
   "autobahn": [
     "setuptools"
   ],
+  "autoflake": [
+    "hatchling"
+  ],
   "autograd": [
     "setuptools"
   ],
@@ -1262,6 +1265,27 @@
     "poetry-core",
     "setuptools"
   ],
+  "aws-cdk-asset-awscli-v1": [
+    "setuptools"
+  ],
+  "aws-cdk-asset-kubectl-v20": [
+    "setuptools"
+  ],
+  "aws-cdk-asset-node-proxy-agent": [
+    "setuptools"
+  ],
+  "aws-cdk-asset-node-proxy-agent-v5": [
+    "setuptools"
+  ],
+  "aws-cdk-aws-batch-alpha": [
+    "setuptools"
+  ],
+  "aws-cdk-aws-lambda-python-alpha": [
+    "setuptools"
+  ],
+  "aws-cdk-lib": [
+    "setuptools"
+  ],
   "aws-error-utils": [
     "poetry"
   ],
@@ -1280,6 +1304,9 @@
   "awscli-cwlogs": [
     "setuptools"
   ],
+  "awscli-local": [
+    "setuptools"
+  ],
   "awscrt": [
     "setuptools"
   ],
@@ -2995,6 +3022,9 @@
   "construct": [
     "setuptools"
   ],
+  "constructs": [
+    "setuptools"
+  ],
   "consul": [
     "setuptools"
   ],
@@ -3707,6 +3737,9 @@
   "django-4": [
     "setuptools"
   ],
+  "django-admin-sortable2": [
+    "setuptools"
+  ],
   "django-allauth": [
     "setuptools"
   ],
@@ -3763,6 +3796,9 @@
   "django-cors-headers": [
     "setuptools"
   ],
+  "django-countries": [
+    "setuptools"
+  ],
   "django-crispy-forms": [
     "setuptools"
   ],
@@ -3850,6 +3886,9 @@
   "django-modelcluster": [
     "setuptools"
   ],
+  "django-modeltranslation": [
+    "setuptools"
+  ],
   "django-mptt": [
     "setuptools"
   ],
@@ -4706,6 +4745,9 @@
   "fabric": [
     "setuptools"
   ],
+  "fabric2": [
+    "setuptools"
+  ],
   "fabulous": [
     "setuptools"
   ],
@@ -7168,6 +7210,9 @@
     "pbr",
     "setuptools"
   ],
+  "jsii": [
+    "setuptools"
+  ],
   "jsmin": [
     "setuptools"
   ],
@@ -8882,6 +8927,15 @@
   "mypy-boto3-sqs": [
     "setuptools"
   ],
+  "mypy-boto3-ssm": [
+    "setuptools"
+  ],
+  "mypy-boto3-stepfunctions": [
+    "setuptools"
+  ],
+  "mypy-boto3-sts": [
+    "setuptools"
+  ],
   "mypy-extensions": [
     "setuptools"
   ],
@@ -8983,7 +9037,11 @@
     "setuptools"
   ],
   "nbclient": [
-    "setuptools"
+    "setuptools",
+    {
+      "buildSystem": "hatchling",
+      "from": "0.7.1"
+    }
   ],
   "nbconflux": [
     "setuptools"
@@ -9521,6 +9579,9 @@
   "openapi-core": [
     "setuptools"
   ],
+  "openapi-python-client": [
+    "poetry-core"
+  ],
   "openapi-schema-validator": [
     "poetry-core",
     "setuptools"
@@ -12038,7 +12099,8 @@
     "setuptools"
   ],
   "pymssql": [
-    "cython"
+    "cython",
+    "setuptools"
   ],
   "pymsteams": [
     "setuptools"
@@ -12771,6 +12833,9 @@
   "pyssim": [
     "setuptools"
   ],
+  "pystac": [
+    "setuptools"
+  ],
   "pystache": [
     "setuptools"
   ],
@@ -12932,6 +12997,9 @@
     "setuptools",
     "setuptools-scm"
   ],
+  "pytest-docker": [
+    "setuptools"
+  ],
   "pytest-doctestplus": [
     "setuptools",
     "setuptools-scm"
@@ -13640,6 +13708,9 @@
   "python-uinput": [
     "setuptools"
   ],
+  "python-ulid": [
+    "setuptools"
+  ],
   "python-unshare": [
     "setuptools"
   ],
@@ -15995,6 +16066,9 @@
   "streamlabswater": [
     "setuptools"
   ],
+  "streamlink": [
+    "setuptools"
+  ],
   "streamz": [
     "setuptools"
   ],
@@ -16702,6 +16776,9 @@
   "tornado": [
     "setuptools"
   ],
+  "tornado-utils": [
+    "setuptools"
+  ],
   "torpy": [
     "setuptools"
   ],
@@ -16982,6 +17059,9 @@
     "flit-core",
     "setuptools"
   ],
+  "types-aioboto3": [
+    "setuptools"
+  ],
   "types-aiobotocore": [
     "setuptools"
   ],
@@ -16994,6 +17074,9 @@
   "types-aiobotocore-elbv2": [
     "setuptools"
   ],
+  "types-aiobotocore-resourcegroupstaggingapi": [
+    "setuptools"
+  ],
   "types-aiobotocore-ssm": [
     "setuptools"
   ],
@@ -17039,9 +17122,15 @@
   "types-markdown": [
     "setuptools"
   ],
+  "types-pkg-resources": [
+    "setuptools"
+  ],
   "types-protobuf": [
     "setuptools"
   ],
+  "types-python-dateutil": [
+    "setuptools"
+  ],
   "types-pytz": [
     "setuptools"
   ],
@@ -17060,6 +17149,9 @@
   "types-setuptools": [
     "setuptools"
   ],
+  "types-six": [
+    "setuptools"
+  ],
   "types-tabulate": [
     "setuptools"
   ],
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix b/pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix
index a1909523082..6a140ca2528 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix
@@ -59,9 +59,6 @@ let
 
 in
 lib.composeManyExtensions [
-  # normalize all the names
-  (self: super: poetryLib.normalizePackageSet super)
-
   # NixOps
   (self: super:
     lib.mapAttrs (_: v: addBuildSystem { inherit self; drv = v; attr = "poetry"; }) (lib.filterAttrs (n: _: lib.strings.hasPrefix "nixops" n) super)
@@ -400,7 +397,7 @@ lib.composeManyExtensions [
           (
             old: {
               nativeBuildInputs = (old.nativeBuildInputs or [ ])
-                ++ lib.optional (lib.versionAtLeast old.version "3.4") [ self.setuptools-rust ]
+                ++ lib.optionals (lib.versionAtLeast old.version "3.4") [ self.setuptools-rust ]
                 ++ lib.optional (!self.isPyPy) pyBuildPackages.cffi
                 ++ lib.optional (lib.versionAtLeast old.version "3.5" && !isWheel)
                 (with pkgs.rustPlatform; [ cargoSetupHook rust.cargo rust.rustc ]);
@@ -639,6 +636,7 @@ lib.composeManyExtensions [
 
       fiona = super.fiona.overridePythonAttrs (
         old: {
+          format = "setuptools";
           buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.gdal ];
           nativeBuildInputs = [
             pkgs.gdal # for gdal-config
@@ -1080,9 +1078,9 @@ lib.composeManyExtensions [
 
           buildInputs = old.buildInputs or [ ] ++ [
             pkgs.which
-          ] ++ lib.optional enableGhostscript [
+          ] ++ lib.optionals enableGhostscript [
             pkgs.ghostscript
-          ] ++ lib.optional stdenv.isDarwin [
+          ] ++ lib.optionals stdenv.isDarwin [
             Cocoa
           ];
 
@@ -1099,7 +1097,7 @@ lib.composeManyExtensions [
 
           nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [
             pkg-config
-          ] ++ lib.optional (lib.versionAtLeast super.matplotlib.version "3.5.0") [
+          ] ++ lib.optionals (lib.versionAtLeast super.matplotlib.version "3.5.0") [
             self.setuptools-scm
             self.setuptools-scm-git-archive
           ];
@@ -1395,6 +1393,7 @@ lib.composeManyExtensions [
             "3.7.9" = "sha256-QHzAhjHgm4XLxY2zUdnIsd/WWMI7dJLQQAvTXC+2asQ=";
             "3.8.0" = "sha256-8k0DetamwLqkdcg8V/D2J5ja6IJSLi50CE+ZjFa7Hdc=";
             "3.8.1" = "sha256-QXguyDxQHW9Fd3Nhmi5JzSxZQuk3HGPhhh/RGuOTZNY=";
+            "3.8.3" = "sha256-oSZO4cN1sJKd0T7pYrKG63is8AZMKaLRZqj5UCVY/14=";
           }.${version} or (
             lib.warn "Unknown orjson version: '${version}'. Please update getCargoHash." lib.fakeHash
           );
@@ -1771,7 +1770,7 @@ lib.composeManyExtensions [
 
       pymssql = super.pymssql.overridePythonAttrs (old: {
         buildInputs = (old.buildInputs or [ ])
-          ++ [ pkgs.openssl ];
+          ++ [ pkgs.openssl pkgs.libkrb5 ];
         propagatedBuildInputs = (old.propagatedBuildInputs or [ ])
           ++ [ pkgs.freetds ];
       });
@@ -2112,8 +2111,8 @@ lib.composeManyExtensions [
         if old.format != "wheel" then {
           nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++
             [ pkgs.gfortran ] ++
-            lib.optional (lib.versionAtLeast super.scipy.version "1.7.0") [ self.pythran ] ++
-            lib.optional (lib.versionAtLeast super.scipy.version "1.9.0") [ self.meson-python pkg-config ];
+            lib.optionals (lib.versionAtLeast super.scipy.version "1.7.0") [ self.pythran ] ++
+            lib.optionals (lib.versionAtLeast super.scipy.version "1.9.0") [ self.meson-python pkg-config ];
           propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ self.pybind11 ];
           setupPyBuildFlags = [ "--fcompiler='gnu95'" ];
           enableParallelBuilding = true;
@@ -2399,6 +2398,7 @@ lib.composeManyExtensions [
         let
           # Watchfiles does not include Cargo.lock in tarball released on PyPi for versions up to 0.17.0
           getRepoHash = version: {
+            "0.18.1" = "sha256-XEhu6M1hFi3/gAKZcei7KJSrIhhlZhlvZvbfyA6VLR4=";
             "0.18.0" = "sha256-biGGn0YAUbSO1hCJ4kU0ZWlqlXl/HRrBS3iIA3myRI8=";
             "0.17.0" = "1swpf265h9qq30cx55iy6jjirba3wml16wzb68k527ynrxr7hvqx";
             "0.16.1" = "1ss6gzcr6js2d2sddgz1p52gyiwpqmgrxm8r6wim7gnm4wvhav8a";
diff --git a/pkgs/development/tools/protoc-gen-validate/default.nix b/pkgs/development/tools/protoc-gen-validate/default.nix
index b06f345d71f..13b61e1d694 100644
--- a/pkgs/development/tools/protoc-gen-validate/default.nix
+++ b/pkgs/development/tools/protoc-gen-validate/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "protoc-gen-validate";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "bufbuild";
     repo = "protoc-gen-validate";
     rev = "v${version}";
-    sha256 = "sha256-k8FUdQDgtR6g/LRCT45RYVUImEKCneQh9BG6P4y1SME=";
+    sha256 = "sha256-5Vr7qE6AFesvBkOpgStxI26m8rbQ8pXOXvNxbcX/ilc=";
   };
 
-  vendorSha256 = "sha256-ZchgruaQOokgCh+6qkVr/d+PVflh/lKd10Ty+bMBEH0=";
+  vendorSha256 = "sha256-D8ITrzEwas/UElfsXBG2BfHGFcFsxzWFar2ehgLwy5U=";
 
   excludedPackages = [ "tests" ];
 
diff --git a/pkgs/development/tools/refurb/default.nix b/pkgs/development/tools/refurb/default.nix
index 1ecfd6e2bfe..89fc4e87438 100644
--- a/pkgs/development/tools/refurb/default.nix
+++ b/pkgs/development/tools/refurb/default.nix
@@ -5,14 +5,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "refurb";
-  version = "1.7.0";
+  version = "1.8.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "dosisod";
     repo = "refurb";
-    rev = "v${version}";
-    hash = "sha256-JA/kU+2cpNKY2umA3NXwsqbfOMv9t6I7GlMYhiA6GTg";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-dpPPhA5bVLiG9DsJ3RnO9RpCd0j4u5f//x/OTdlC+GQ=";
   };
 
   nativeBuildInputs = with python3Packages; [
diff --git a/pkgs/development/tools/ruff/default.nix b/pkgs/development/tools/ruff/default.nix
index dcf13834a51..6bff31436ac 100644
--- a/pkgs/development/tools/ruff/default.nix
+++ b/pkgs/development/tools/ruff/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ruff";
-  version = "0.0.132";
+  version = "0.0.169";
 
   src = fetchFromGitHub {
     owner = "charliermarsh";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-0UcZBGD1l2hP8VH0tdNKY/SiXVTPLL0/eZpOwYnUgPs=";
+    sha256 = "sha256-YPVI1SaaLSqrpTu/uFTSyWbPVSDeADNVv2OfgR9K4qI=";
   };
 
-  cargoSha256 = "sha256-DlSSzFf2AludfAKrXSsI/V0K2ZjCy/ehZd3ULe3fjK4=";
+  cargoSha256 = "sha256-bP6gn/UIv1reytd8atNdoXZxsFFJCt+axl3UiCayERo=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     CoreServices
diff --git a/pkgs/development/tools/rust/cargo-about/default.nix b/pkgs/development/tools/rust/cargo-about/default.nix
index 4229f762bbc..88b99889f1b 100644
--- a/pkgs/development/tools/rust/cargo-about/default.nix
+++ b/pkgs/development/tools/rust/cargo-about/default.nix
@@ -9,13 +9,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-about";
-  version = "0.5.1";
+  version = "0.5.2";
 
   src = fetchFromGitHub {
     owner = "EmbarkStudios";
     repo = "cargo-about";
     rev = version;
-    sha256 = "sha256-T8Hhody0jMmZb6/xMkSvKCv4STZPbcrf/UB3APspYDM=";
+    sha256 = "sha256-8476jJK1oiXVX9G09NSL+xvXZdZ+h7grCHC6R0XXewo=";
   };
 
   cargoPatches = [
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage rec {
     ./zstd-pkg-config.patch
   ];
 
-  cargoSha256 = "sha256-2Reqj+WP6OoaB/3Z5llZP4c5ToVmMNX0Fe0IqDwcg2E=";
+  cargoSha256 = "sha256-EFpkBWQSWYyMrUa9Dh+n9kDNmXL/2yuEmFN3DcPeE7U=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/development/tools/rust/cargo-about/zstd-pkg-config.patch b/pkgs/development/tools/rust/cargo-about/zstd-pkg-config.patch
index e084538ca92..ea8b67085fd 100644
--- a/pkgs/development/tools/rust/cargo-about/zstd-pkg-config.patch
+++ b/pkgs/development/tools/rust/cargo-about/zstd-pkg-config.patch
@@ -1,6 +1,6 @@
 --- a/Cargo.lock
 +++ b/Cargo.lock
-@@ -183,6 +183,7 @@ dependencies = [
+@@ -207,6 +207,7 @@ dependencies = [
   "toml_edit",
   "twox-hash",
   "url",
@@ -8,32 +8,33 @@
  ]
  
  [[package]]
-@@ -1039,6 +1040,12 @@ version = "0.1.0"
+@@ -1093,6 +1094,12 @@ version = "0.1.0"
  source = "registry+https://github.com/rust-lang/crates.io-index"
  checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
  
 +[[package]]
 +name = "pkg-config"
-+version = "0.3.22"
++version = "0.3.26"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "12295df4f294471248581bc09bef3c38a5e46f1e36d6a37353621a0c6c357e1f"
++checksum = "6ac9a59f73473f1b8d852421e59e64809f025994837ef743615c6d0c5b305160"
 +
  [[package]]
  name = "ppv-lite86"
- version = "0.2.15"
-@@ -1902,4 +1909,5 @@ checksum = "2141bed8922b427761470e6bbfeff255da94fa20b0bbeab0d9297fcaf71e3aa7"
+ version = "0.2.16"
+@@ -2045,4 +2052,5 @@ checksum = "2141bed8922b427761470e6bbfeff255da94fa20b0bbeab0d9297fcaf71e3aa7"
  dependencies = [
   "cc",
   "libc",
 + "pkg-config",
  ]
-diff --git a/Cargo.toml b/Cargo.toml
-index bf2a896..35cbf7c 100644
 --- a/Cargo.toml
 +++ b/Cargo.toml
-@@ -80,3 +80,5 @@ toml_edit = "0.9"
+@@ -80,6 +80,8 @@ toml_edit = "0.15"
  twox-hash = "1.6"
  # Url parsing
  url = "2.2"
-+
++# Use pkg-config feature of zstd
 +zstd = { version = "*", features = ["pkg-config"] }
+ 
+ [dev-dependencies]
+ # Filesystems - Filesystem fixtures and assertions for testing
diff --git a/pkgs/development/tools/rust/cargo-modules/default.nix b/pkgs/development/tools/rust/cargo-modules/default.nix
index b6a6c2f5353..99d3eb61e43 100644
--- a/pkgs/development/tools/rust/cargo-modules/default.nix
+++ b/pkgs/development/tools/rust/cargo-modules/default.nix
@@ -1,27 +1,26 @@
-{ lib, rustPlatform, fetchCrate, stdenv, CoreFoundation, CoreServices }:
+{ lib, rustPlatform, fetchFromGitHub, stdenv, darwin }:
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-modules";
-  version = "0.5.14";
+  version = "0.7.0";
 
-  src = fetchCrate {
-    inherit pname version;
-    sha256 = "sha256-urbyWNbmj2qEO4JJ/waRXGRJ9L5KgwsRB5Wh9yib8zc=";
+  src = fetchFromGitHub {
+    owner = "regexident";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-IBvSuyr3ERfPIivw6sEJSRta07Awmwd47cV1iKmvt8A=";
   };
 
-  cargoSha256 = "sha256-3OxO+j5UuPEg9xNmN+kIqpdq6fVnFpgx5xCaMNue52g=";
+  cargoSha256 = "sha256-zX3lBNQVWBrVQh+02TDUqU7Xmbd7hBOzJxD7cSNTNR0=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
-    CoreFoundation
-    CoreServices
+    darwin.apple_sdk.frameworks.CoreServices
   ];
 
-  # the crate version doesn't include all the files required to run tests
-  doCheck = false;
-
   meta = with lib; {
     description = "A cargo plugin for showing a tree-like overview of a crate's modules";
     homepage = "https://github.com/regexident/cargo-modules";
+    changelog = "https://github.com/regexident/cargo-modules/blob/${version}/CHANGELOG.md";
     license = with licenses; [ mpl20 ];
     maintainers = with maintainers; [ figsoda rvarago ];
   };
diff --git a/pkgs/development/tools/rust/cargo-public-api/default.nix b/pkgs/development/tools/rust/cargo-public-api/default.nix
index 4bc23ae141d..d5627993e29 100644
--- a/pkgs/development/tools/rust/cargo-public-api/default.nix
+++ b/pkgs/development/tools/rust/cargo-public-api/default.nix
@@ -8,14 +8,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-public-api";
-  version = "0.24.0";
+  version = "0.24.1";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-6PAOyZmaqsHHyzS9sI591tnAi3/kwRlQR4K4iZJmR5Q=";
+    sha256 = "sha256-xXwJ6MXnSgqIQ5IuqfDm/TUXgkppKCPG3TB7veza/H8=";
   };
 
-  cargoSha256 = "sha256-wWSVpWmD1ZItXgH5q0u16oBQ+d4wKjg+pvt/ZlgiWBg=";
+  cargoSha256 = "sha256-1sSvK8oZspIxDcMAl2MyAQzuijAxj1kpiZf1QwwyYDs=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/development/tools/rust/cargo-update/default.nix b/pkgs/development/tools/rust/cargo-update/default.nix
index 30aa56aa29f..61dc0d655fb 100644
--- a/pkgs/development/tools/rust/cargo-update/default.nix
+++ b/pkgs/development/tools/rust/cargo-update/default.nix
@@ -15,14 +15,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-update";
-  version = "11.1.0";
+  version = "11.1.1";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-WQUWAE8PR3FxTmWxoXmi6nsiyfbmLaIzOBJhC/8QYQw=";
+    sha256 = "sha256-ml+LqfnDld+I3G6+LaPJOeZa+swCtuu0ndW0yJraSxs=";
   };
 
-  cargoSha256 = "sha256-GirS6Tu5gkNPVGAKzfFkyi3tTlu3RRzp/PWHhPbmKdI=";
+  cargoSha256 = "sha256-0exatgmksg07KQO/3s9BD4uIZRHwjytQPtaRv+JydPc=";
 
   nativeBuildInputs = [ cmake installShellFiles pkg-config ronn ];
 
diff --git a/pkgs/development/tools/rust/rust-analyzer/default.nix b/pkgs/development/tools/rust/rust-analyzer/default.nix
index f9ec10f3430..8021ab2e631 100644
--- a/pkgs/development/tools/rust/rust-analyzer/default.nix
+++ b/pkgs/development/tools/rust/rust-analyzer/default.nix
@@ -12,14 +12,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rust-analyzer-unwrapped";
-  version = "2022-10-31";
-  cargoSha256 = "sha256-yehukhYwNhFqHUYmIe0P/LPgRHvyj1/DFCl2yzBkB8Q=";
+  version = "2022-12-05";
+  cargoSha256 = "sha256-lD52qI6LX5ORBWknCC4gAWQG8FPlNhOj6xQo1eXpO30=";
 
   src = fetchFromGitHub {
     owner = "rust-lang";
     repo = "rust-analyzer";
     rev = version;
-    sha256 = "sha256-D0YwkSqwtD08twtCtN5q0a8S0Y26kgDWg1ruRNEQEOw=";
+    sha256 = "sha256-2Syd2jVpY0UIfsYlmzvWICZTDVRG4UchcbRlNhuJSpM=";
   };
 
   cargoBuildFlags = [ "--bin" "rust-analyzer" "--bin" "rust-analyzer-proc-macro-srv" ];
diff --git a/pkgs/development/tools/rust/sqlx-cli/default.nix b/pkgs/development/tools/rust/sqlx-cli/default.nix
index df451e86348..7883e8841b0 100644
--- a/pkgs/development/tools/rust/sqlx-cli/default.nix
+++ b/pkgs/development/tools/rust/sqlx-cli/default.nix
@@ -1,4 +1,17 @@
-{ stdenv, lib, rustPlatform, fetchFromGitHub, pkg-config, openssl, SystemConfiguration, CoreFoundation, Security, libiconv, testers, sqlx-cli }:
+{ stdenv
+, lib
+, rustPlatform
+, fetchFromGitHub
+, fetchpatch
+, pkg-config
+, openssl
+, SystemConfiguration
+, CoreFoundation
+, Security
+, libiconv
+, testers
+, sqlx-cli
+}:
 
 rustPlatform.buildRustPackage rec {
   pname = "sqlx-cli";
@@ -11,6 +24,15 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-pQlrKjhOJfjNEmLxqnFmmBY1naheZUsaq2tGdLKGxjg=";
   };
 
+  patches = [
+    # https://github.com/launchbadge/sqlx/pull/2228
+    (fetchpatch {
+      name = "fix-rust-1.65-compile.patch";
+      url = "https://github.com/launchbadge/sqlx/commit/2fdf85b212332647dc4ac47e087df946151feedf.patch";
+      hash = "sha256-5BCuIwmECe9qQrdYll7T+UOGwuTBolWEhKNE7GcZqJw=";
+    })
+  ];
+
   cargoSha256 = "sha256-AbA8L7rkyZfKW0vvjyrcW5eU6jGD+zAqIcEUOJmeqJs=";
 
   doCheck = false;
diff --git a/pkgs/development/tools/selene/default.nix b/pkgs/development/tools/selene/default.nix
index 27f61f4e702..ec780ccef05 100644
--- a/pkgs/development/tools/selene/default.nix
+++ b/pkgs/development/tools/selene/default.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "selene";
-  version = "0.22.0";
+  version = "0.23.0";
 
   src = fetchFromGitHub {
     owner = "kampfkarren";
     repo = pname;
     rev = version;
-    sha256 = "sha256-6DbWz4u4mbW/aSDpaLxP4bG14gHxMGc4A8zMTVH/vj0=";
+    sha256 = "sha256-z1jefnWtaV97kq7CpfKsnFOgLHXDBonsmZTfUKJ4VIM=";
   };
 
-  cargoSha256 = "sha256-6dYXGxDNiLzpyZCmF2OJl2HAFyzJeAeQpEfaIZBBJD8=";
+  cargoSha256 = "sha256-TjkileWGB7ocBJPGh2Bm1ucigwL4j/uXgIOAonPHjbA=";
 
   nativeBuildInputs = lib.optional robloxSupport pkg-config;
 
diff --git a/pkgs/development/tools/stylua/default.nix b/pkgs/development/tools/stylua/default.nix
index 871fbb64b7f..f83535a10e4 100644
--- a/pkgs/development/tools/stylua/default.nix
+++ b/pkgs/development/tools/stylua/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "stylua";
-  version = "0.15.2";
+  version = "0.15.3";
 
   src = fetchFromGitHub {
     owner = "johnnymorganz";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-cMT6+U9tfucPE5IkHjsWlzcD+nLQC24fqTyOhsTwFqk=";
+    sha256 = "sha256-EVsgiG16R4wh4Dh10rv7/H+VDONaVPWOfRNStrw8aso=";
   };
 
-  cargoSha256 = "sha256-H8oD769xdsXIJWqfFCL76MIKrKkHUSTzzciuHJBdjyI=";
+  cargoSha256 = "sha256-fDh6TchwQO+FvyPJzrso1Ls9ZIKMHDdFBTzf6AuvGqs=";
 
   # remove cargo config so it can find the linker on aarch64-unknown-linux-gnu
   postPatch = ''
diff --git a/pkgs/development/tools/tarmac/default.nix b/pkgs/development/tools/tarmac/default.nix
new file mode 100644
index 00000000000..15e5ecfe10a
--- /dev/null
+++ b/pkgs/development/tools/tarmac/default.nix
@@ -0,0 +1,45 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, rustPlatform
+, pkg-config
+, openssl_1_1
+, Security
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "tarmac";
+  version = "0.7.0";
+
+  src = fetchFromGitHub {
+    owner = "Roblox";
+    repo = "tarmac";
+    rev = "v${version}";
+    sha256 = "sha256-O6qrAzGiAxiE56kpuvH/jDKHRXxHZ2SlDL5nwOOd4EU=";
+  };
+
+  cargoSha256 = "sha256-QnpowYv/TBXjPHK8z6KAzN3gSsfNOf9POybqsyugeWc=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl_1_1
+  ] ++ lib.optionals stdenv.isDarwin [
+    Security
+  ];
+
+  meta = with lib; {
+    description = "Resource compiler and asset manager for Roblox";
+    longDescription = ''
+      Tarmac is a resource compiler and asset manager for Roblox projects.
+      It helps enable hermetic place builds when used with tools like Rojo.
+    '';
+    homepage = "https://github.com/Roblox/tarmac";
+    downloadPage = "https://github.com/Roblox/tarmac/releases/tag/v${version}";
+    changelog = "https://github.com/Roblox/tarmac/raw/v${version}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ wackbyte ];
+  };
+}
diff --git a/pkgs/development/tools/wxformbuilder/default.nix b/pkgs/development/tools/wxformbuilder/default.nix
index b8db2d4aac4..9e4d2caabc3 100644
--- a/pkgs/development/tools/wxformbuilder/default.nix
+++ b/pkgs/development/tools/wxformbuilder/default.nix
@@ -52,5 +52,6 @@ stdenv.mkDerivation {
     homepage = "https://github.com/wxFormBuilder/wxFormBuilder";
     license = licenses.gpl2Only;
     maintainers = with maintainers; [ matthuszagh wegank ];
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/tools/ytt/default.nix b/pkgs/development/tools/ytt/default.nix
index a26e71522e5..8e33b84b364 100644
--- a/pkgs/development/tools/ytt/default.nix
+++ b/pkgs/development/tools/ytt/default.nix
@@ -1,13 +1,13 @@
 { lib, buildGoModule, fetchFromGitHub }:
 buildGoModule rec {
   pname = "ytt";
-  version = "0.44.0";
+  version = "0.44.1";
 
   src = fetchFromGitHub {
     owner = "vmware-tanzu";
     repo = "carvel-ytt";
     rev = "v${version}";
-    sha256 = "sha256-mhfRrmZkeQWbYlgDEsjiUSOALXc6tI8eK81rjLYSXwk=";
+    sha256 = "sha256-3uyMwW8v2rPguXbPKy8IyQxroNaNS6rrXEcgRP91fdU=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/games/btanks/default.nix b/pkgs/games/btanks/default.nix
index 202bab0df66..cec88ab51bd 100644
--- a/pkgs/games/btanks/default.nix
+++ b/pkgs/games/btanks/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch, sconsPackages, pkg-config, SDL, libGL, zlib, smpeg
+{ lib, stdenv, fetchurl, fetchpatch, scons, pkg-config, SDL, libGL, zlib, smpeg
 , SDL_image, libvorbis, expat, zip, lua }:
 
 stdenv.mkDerivation rec {
@@ -7,10 +7,10 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "0ha35kxc8xlbg74wsrbapfgxvcrwy6psjkqi7c6adxs55dmcxliz";
+    hash = "sha256-P9LOaitF96YMOxFPqa/xPLPdn7tqZc3JeYt2xPosQ0E=";
   };
 
-  nativeBuildInputs = [ sconsPackages.scons_3_0_1 pkg-config ];
+  nativeBuildInputs = [ scons pkg-config ];
 
   buildInputs = [ SDL libGL zlib smpeg SDL_image libvorbis expat zip lua ];
 
@@ -20,17 +20,25 @@ stdenv.mkDerivation rec {
 
   patches = [
     (fetchpatch {
-      url = "https://aur.archlinux.org/cgit/aur.git/plain/lua52.patch?h=btanks";
-      sha256 = "0ip563kz6lhwiims5djrxq3mvb7jx9yzkpsqxxhbi9n6qzz7y2az";
       name = "lua52.patch";
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/lua52.patch?h=btanks&id=cd0e016963238f16209baa2da658aa3fad36e33d";
+      hash = "sha256-Xwl//sfGprhg71jf+X3q8qxdB+5ZtqJrjBxS8+cw5UY=";
     })
     (fetchpatch {
-      url = "https://salsa.debian.org/games-team/btanks/raw/master/debian/patches/gcc-4.7.patch";
-      sha256 = "1dxlk1xh69gj10sqcsyckiakb8an3h41206wby4z44mpmvxc7pi4";
+      url = "https://salsa.debian.org/games-team/btanks/-/raw/debian/0.9.8083-9/debian/patches/gcc-4.7.patch";
+      hash = "sha256-JN7D+q63EvKJX9wAEQgcVqE1VZzMa4Y1CPIlA3uYtLc=";
     })
     (fetchpatch {
-      url = "https://salsa.debian.org/games-team/btanks/raw/master/debian/patches/pow10f.patch";
-      sha256 = "1h45790v2dpdbccfn6lwfgl8782q54i14cz9gpipkaghcka4y0g9";
+      url = "https://salsa.debian.org/games-team/btanks/-/raw/debian/0.9.8083-9/debian/patches/pow10f.patch";
+      hash = "sha256-6QFP1GTwqXnjfekzEiIpWKCD6HOcGusYW+02sUE6hcA=";
+    })
+    (fetchpatch {
+      url = "https://salsa.debian.org/games-team/btanks/-/raw/debian/0.9.8083-9/debian/patches/python3.patch";
+      hash = "sha256-JpK409Myi8mxQaunmLFKKh1NKvKLXpNHHsDvRee8OoQ=";
+    })
+    (fetchpatch {
+      url = "https://salsa.debian.org/games-team/btanks/-/raw/debian/0.9.8083-9/debian/patches/scons.patch";
+      hash = "sha256-JCvBY2fOV8Sc/mpvEsJQv1wKcS1dHqYxvRk6I9p7ZKc=";
     })
   ];
 
diff --git a/pkgs/games/heroic/fhsenv.nix b/pkgs/games/heroic/fhsenv.nix
index 75012f405f8..d3625ad129b 100644
--- a/pkgs/games/heroic/fhsenv.nix
+++ b/pkgs/games/heroic/fhsenv.nix
@@ -12,6 +12,7 @@ buildFHSUserEnv {
 
   targetPkgs = pkgs: with pkgs; [
     heroic-unwrapped
+    gamemode
     curl
     gawk
     gnome.zenity
@@ -49,21 +50,27 @@ buildFHSUserEnv {
     ];
   in pkgs: with pkgs; [
     alsa-lib
+    alsa-plugins
     bash
+    cabextract
     cairo
     coreutils
     cups
     dbus
+    freealut
     freetype
     fribidi
     giflib
     glib
     gnutls
+    gst_all_1.gst-plugins-base
     gtk3
     lcms2
     libevdev
+    libgcrypt
     libGLU
     libglvnd
+    libgpg-error
     libjpeg
     libkrb5
     libmpeg2
@@ -83,16 +90,19 @@ buildFHSUserEnv {
     libxkbcommon
     libxml2
     mpg123
+    ncurses
     ocl-icd
     openldap
     pipewire
     samba4
     sane-backends
     SDL2
+    sqlite
     udev
     udev
     unixODBC
     util-linux
+    v4l-utils
     vulkan-loader
     wayland
     zlib
diff --git a/pkgs/games/megaglest/default.nix b/pkgs/games/megaglest/default.nix
index 21ee6fa3744..e8558af0732 100644
--- a/pkgs/games/megaglest/default.nix
+++ b/pkgs/games/megaglest/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, cmake, pkg-config, git, curl, SDL2, xercesc, openal, lua, libvlc
-, libjpeg, wxGTK30-gtk3, cppunit, ftgl, glew, libogg, libvorbis, buildEnv, libpng
+, libjpeg, wxGTK30, cppunit, ftgl, glew, libogg, libvorbis, buildEnv, libpng
 , fontconfig, freetype, xorg, makeWrapper, bash, which, gnome, libGLU, glib
 , fetchFromGitHub, fetchpatch
 }:
@@ -9,7 +9,7 @@ let
     name = "megaglest-lib-env";
     paths = [ SDL2 xorg.libSM xorg.libICE xorg.libX11 xorg.libXext
       xercesc openal libvorbis lua libjpeg libpng curl fontconfig ftgl freetype
-      stdenv.cc.cc glew libGLU wxGTK30-gtk3 ];
+      stdenv.cc.cc glew libGLU wxGTK30 ];
   };
   path-env = buildEnv {
     name = "megaglest-path-env";
@@ -38,7 +38,7 @@ stdenv.mkDerivation {
   ];
 
   nativeBuildInputs = [ cmake pkg-config makeWrapper git ];
-  buildInputs = [ curl SDL2 xercesc openal lua libpng libjpeg libvlc wxGTK30-gtk3
+  buildInputs = [ curl SDL2 xercesc openal lua libpng libjpeg libvlc wxGTK30
     glib cppunit fontconfig freetype ftgl glew libogg libvorbis libGLU ];
 
   cmakeFlags = [
diff --git a/pkgs/games/opendungeons/default.nix b/pkgs/games/opendungeons/default.nix
index 9afcbd89878..61f8aad304c 100644
--- a/pkgs/games/opendungeons/default.nix
+++ b/pkgs/games/opendungeons/default.nix
@@ -16,6 +16,11 @@ stdenv.mkDerivation rec {
     ./fix_link_date_time.patch
   ];
 
+  # source/utils/StackTraceUnix.cpp:122:2: error: #error Unsupported architecture.
+  postPatch = lib.optionalString (!stdenv.isx86_64) ''
+    cp source/utils/StackTrace{Stub,Unix}.cpp
+  '';
+
   nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [ ogre cegui boost sfml openal ois ];
 
diff --git a/pkgs/games/portmod/default.nix b/pkgs/games/portmod/default.nix
index 27e00a74648..3ae372a0a8c 100644
--- a/pkgs/games/portmod/default.nix
+++ b/pkgs/games/portmod/default.nix
@@ -1,6 +1,21 @@
-{ lib, callPackage, python3Packages, fetchFromGitLab, cacert
-, rustPlatform, bubblewrap, git, perlPackages, imagemagick, fetchurl, fetchzip
-, jre, makeWrapper, tr-patcher, tes3cmd, openmw }:
+{ lib
+, bubblewrap
+, cacert
+, callPackage
+, fetchFromGitLab
+, fetchurl
+, fetchzip
+, git
+, imagemagick
+, jre
+, makeWrapper
+, openmw
+, perlPackages
+, python3Packages
+, rustPlatform
+, tes3cmd
+, tr-patcher
+}:
 
 let
   version = "2.1.0";
@@ -9,7 +24,7 @@ let
     owner = "portmod";
     repo = "Portmod";
     rev = "v${version}";
-    sha256 = "sha256-b/ENApFovMPNUMbJhwY+TZCnSzpr1e/IKJ/5XAGTQjE=";
+    hash = "sha256-b/ENApFovMPNUMbJhwY+TZCnSzpr1e/IKJ/5XAGTQjE=";
   };
 
   portmod-rust = rustPlatform.buildRustPackage rec {
@@ -18,7 +33,9 @@ let
 
     cargoHash = "sha256-3EfMMpSWSYsB3nXaoGGDuKQ9duyCKzbrT6oeATnzqLE=";
 
-    nativeBuildInputs = [ python3Packages.python ];
+    nativeBuildInputs = [
+      python3Packages.python
+    ];
 
     doCheck = false;
   };
@@ -56,7 +73,7 @@ python3Packages.buildPythonApplication rec {
     colorama
     restrictedpython
     appdirs
-    GitPython
+    gitpython
     progressbar2
     python-sat
     redbaron
@@ -94,10 +111,10 @@ python3Packages.buildPythonApplication rec {
       "--prefix" "PATH" ":" "${lib.makeBinPath bin-programs }")
   '';
 
-  meta = {
+  meta = with lib; {
     description = "mod manager for openMW based on portage";
     homepage = "https://gitlab.com/portmod/portmod";
-    license = lib.licenses.gpl3;
-    maintainers = with lib.maintainers; [ marius851000 ];
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ marius851000 ];
   };
 }
diff --git a/pkgs/games/quakespasm/vulkan.nix b/pkgs/games/quakespasm/vulkan.nix
index bfd9691fe14..cc6793d2c05 100644
--- a/pkgs/games/quakespasm/vulkan.nix
+++ b/pkgs/games/quakespasm/vulkan.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vkquake";
-  version = "1.20.3";
+  version = "1.22.1";
 
   src = fetchFromGitHub {
     owner = "Novum";
     repo = "vkQuake";
     rev = version;
-    sha256 = "sha256-ocxXkayWujqAFV5N67VfmzJOUbjCPBZut9zmwNRYDeI=";
+    sha256 = "sha256-v0KLYAI9X1JYN7v8vpoAMWEHVMXytX72lOnJl2gJako=";
   };
 
   sourceRoot = "source/Quake";
diff --git a/pkgs/games/rigsofrods/default.nix b/pkgs/games/rigsofrods/default.nix
index 1e1b8130e37..c3bf4498fa4 100644
--- a/pkgs/games/rigsofrods/default.nix
+++ b/pkgs/games/rigsofrods/default.nix
@@ -1,4 +1,4 @@
-{ fetchFromGitHub, lib, stdenv, wxGTK30-gtk3, freeimage, cmake, zziplib, libGLU, libGL, boost,
+{ fetchFromGitHub, lib, stdenv, wxGTK30, freeimage, cmake, zziplib, libGLU, libGL, boost,
   pkg-config, libuuid, openal, ogre, ois, curl, gtk3, mygui, unzip,
   angelscript, ogrepaged, mysocketw, libxcb
   }:
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
   '';
 
   nativeBuildInputs = [ cmake pkg-config unzip ];
-  buildInputs = [ wxGTK30-gtk3 freeimage zziplib libGLU libGL boost
+  buildInputs = [ wxGTK30 freeimage zziplib libGLU libGL boost
     libuuid openal ogre ois curl gtk3 mygui angelscript
     ogrepaged mysocketw libxcb ];
 
diff --git a/pkgs/games/tennix/default.nix b/pkgs/games/tennix/default.nix
index 809ed7a146d..e5b2b358f32 100644
--- a/pkgs/games/tennix/default.nix
+++ b/pkgs/games/tennix/default.nix
@@ -1,20 +1,21 @@
-{lib, stdenv, fetchurl, SDL, SDL_mixer, SDL_image, SDL_ttf, SDL_net, python2 } :
+{ lib, stdenv, fetchgit, which, SDL, SDL_mixer, SDL_image, SDL_ttf, SDL_net, python3 } :
 
 stdenv.mkDerivation rec {
   pname = "tennix";
-  version = "1.1";
-  src = fetchurl {
-    url = "https://icculus.org/tennix/downloads/tennix-${version}.tar.gz";
-    sha256 = "0np5kw1y7i0z0dsqx4r2nvmq86qj8hv3mmgavm3hxraqnds5z8cm";
+  version = "1.3.1";
+
+  src = fetchgit {
+    url = "git://repo.or.cz/tennix.git";
+    rev = "refs/tags/tennix-${version}";
+    sha256 = "sha256-U5+S1jEeg+7gdM1++dln6ePTqxZu2Zt0oUrH3DIlkgk=";
   };
 
-  buildInputs = [ python2 SDL SDL_mixer SDL_image SDL_ttf SDL_net ];
+  nativeBuildInputs = [ which ];
 
-  patches = [ ./fix_FTBFS.patch ];
+  buildInputs = [ python3 SDL SDL_mixer SDL_image SDL_ttf SDL_net ];
 
-  preConfigure = ''
-    makeFlags="PREFIX=$out"
-    installFlags="PREFIX=$out install"
+  configurePhase = ''
+    ./configure --prefix $out
   '';
 
   meta = with lib; {
diff --git a/pkgs/os-specific/linux/intel-compute-runtime/default.nix b/pkgs/os-specific/linux/intel-compute-runtime/default.nix
index d97dbf0eb26..d2d7c6218ae 100644
--- a/pkgs/os-specific/linux/intel-compute-runtime/default.nix
+++ b/pkgs/os-specific/linux/intel-compute-runtime/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-compute-runtime";
-  version = "22.43.24558";
+  version = "22.43.24595.35";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "compute-runtime";
     rev = version;
-    sha256 = "sha256-/hiDJLtEOLbnFjT697yLie5E7819fZM3xricPwe4xN0=";
+    sha256 = "sha256-CWiWkv3CmHhXAk2M92voeQ06ximSOnT9hgIA4rIxWmM=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/os-specific/linux/ipp-usb/default.nix b/pkgs/os-specific/linux/ipp-usb/default.nix
new file mode 100644
index 00000000000..0e79b89cfa3
--- /dev/null
+++ b/pkgs/os-specific/linux/ipp-usb/default.nix
@@ -0,0 +1,42 @@
+{ buildGoModule, avahi, libusb1, pkg-config, lib, fetchFromGitHub, ronn }:
+buildGoModule rec {
+  pname = "ipp-usb";
+  version = "0.9.23";
+
+  src = fetchFromGitHub {
+    owner = "openprinting";
+    repo = "ipp-usb";
+    rev = version;
+    sha256 = "sha256-sbPQWKqkTaD3kLNs0noVIzAN9cwDEaULsqO7SMQH2Jo=";
+  };
+
+  postPatch = ''
+    # rebuild with patched paths
+    rm ipp-usb.8
+    substituteInPlace Makefile --replace "install: all" "install: man"
+    substituteInPlace systemd-udev/ipp-usb.service --replace "/sbin" "$out/bin"
+    for i in Makefile paths.go ipp-usb.8.md; do
+      substituteInPlace $i --replace "/usr" "$out"
+      substituteInPlace $i --replace "/var/ipp-usb" "/var/lib/ipp-usb"
+    done
+  '';
+
+  nativeBuildInputs = [ pkg-config ronn ];
+  buildInputs = [ libusb1 avahi ];
+
+  vendorSha256 = "sha256-KwW6KgopjF4tVo8eB4OtpXF5R8jfrJ9nibNmaN8U4l8=";
+
+  postInstall = ''
+    # to accomodate the makefile
+    cp $out/bin/ipp-usb .
+    make install DESTDIR=$out
+  '';
+
+  meta = {
+    description = "Daemon to use the IPP everywhere protocol with USB printers";
+    homepage = "https://github.com/OpenPrinting/ipp-usb";
+    maintainers = [ lib.maintainers.symphorien ];
+    platforms = lib.platforms.linux;
+    license = lib.licenses.bsd2;
+  };
+}
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 5e6fea31f86..5ac3a827f68 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -390,7 +390,7 @@ let
 
       TMPFS           = yes;
       TMPFS_POSIX_ACL = yes;
-      FS_ENCRYPTION   = if (versionAtLeast version "5.1") then yes else whenAtLeast "4.9" (option module);
+      FS_ENCRYPTION   = if (versionAtLeast version "5.1") then yes else option module;
 
       EXT2_FS_XATTR     = yes;
       EXT2_FS_POSIX_ACL = yes;
@@ -637,7 +637,6 @@ let
     media = {
       MEDIA_DIGITAL_TV_SUPPORT = yes;
       MEDIA_CAMERA_SUPPORT     = yes;
-      MEDIA_RC_SUPPORT         = whenOlder "4.14" yes;
       MEDIA_CONTROLLER         = yes;
       MEDIA_PCI_SUPPORT        = yes;
       MEDIA_USB_SUPPORT        = yes;
@@ -717,7 +716,7 @@ let
       LOCK_TORTURE_TEST        = option no;
       MTD_TESTS                = option no;
       NOTIFIER_ERROR_INJECTION = option no;
-      RCU_PERF_TEST            = whenBetween "4.13" "5.9" no;
+      RCU_PERF_TEST            = whenOlder "5.9" no;
       RCU_SCALE_TEST           = whenAtLeast "5.10" no;
       RCU_TORTURE_TEST         = option no;
       TEST_ASYNC_DRIVER_PROBE  = option no;
diff --git a/pkgs/os-specific/linux/kernel/hardened/config.nix b/pkgs/os-specific/linux/kernel/hardened/config.nix
index c90027f3eb1..198cd868164 100644
--- a/pkgs/os-specific/linux/kernel/hardened/config.nix
+++ b/pkgs/os-specific/linux/kernel/hardened/config.nix
@@ -21,10 +21,6 @@ assert (stdenv.hostPlatform.isx86_64 -> versions.majorMinor version != "5.4");
   # Report BUG() conditions and kill the offending process.
   BUG = yes;
 
-  # Safer page access permissions (wrt. code injection).  Default on >=4.11.
-  DEBUG_RODATA          = whenOlder "4.11" yes;
-  DEBUG_SET_MODULE_RONX = whenOlder "4.11" yes;
-
   # Mark LSM hooks read-only after init.  SECURITY_WRITABLE_HOOKS n
   # conflicts with SECURITY_SELINUX_DISABLE y; disabling the latter
   # implicitly marks LSM hooks read-only after init.
@@ -33,10 +29,10 @@ assert (stdenv.hostPlatform.isx86_64 -> versions.majorMinor version != "5.4");
   #
   # We set SECURITY_WRITABLE_HOOKS n primarily for documentation purposes; the
   # config builder fails to detect that it has indeed been unset.
-  SECURITY_SELINUX_DISABLE = whenAtLeast "4.12" no;
-  SECURITY_WRITABLE_HOOKS  = whenAtLeast "4.12" (option no);
+  SECURITY_SELINUX_DISABLE = no;
+  SECURITY_WRITABLE_HOOKS  = option no;
 
-  STRICT_KERNEL_RWX = whenAtLeast "4.11" yes;
+  STRICT_KERNEL_RWX = yes;
 
   # Perform additional validation of commonly targeted structures.
   DEBUG_CREDENTIALS     = yes;
@@ -46,7 +42,7 @@ assert (stdenv.hostPlatform.isx86_64 -> versions.majorMinor version != "5.4");
   DEBUG_SG              = yes;
   SCHED_STACK_END_CHECK = yes;
 
-  REFCOUNT_FULL = whenBetween "4.13" "5.5" yes;
+  REFCOUNT_FULL = whenOlder "5.5" yes;
 
   # Randomize page allocator when page_alloc.shuffle=1
   SHUFFLE_PAGE_ALLOCATOR = whenAtLeast "5.2" yes;
@@ -69,11 +65,11 @@ assert (stdenv.hostPlatform.isx86_64 -> versions.majorMinor version != "5.4");
   # Gather additional entropy at boot time for systems that may not have appropriate entropy sources.
   GCC_PLUGIN_LATENT_ENTROPY = yes;
 
-  GCC_PLUGIN_STRUCTLEAK = whenAtLeast "4.11" yes; # A port of the PaX structleak plugin
-  GCC_PLUGIN_STRUCTLEAK_BYREF_ALL = whenAtLeast "4.14" yes; # Also cover structs passed by address
+  GCC_PLUGIN_STRUCTLEAK = yes; # A port of the PaX structleak plugin
+  GCC_PLUGIN_STRUCTLEAK_BYREF_ALL = yes; # Also cover structs passed by address
   GCC_PLUGIN_STACKLEAK = whenAtLeast "4.20" yes; # A port of the PaX stackleak plugin
-  GCC_PLUGIN_RANDSTRUCT = whenBetween "4.13" "5.19" yes; # A port of the PaX randstruct plugin
-  GCC_PLUGIN_RANDSTRUCT_PERFORMANCE = whenBetween "4.13" "5.19" yes;
+  GCC_PLUGIN_RANDSTRUCT = whenOlder "5.19" yes; # A port of the PaX randstruct plugin
+  GCC_PLUGIN_RANDSTRUCT_PERFORMANCE = whenOlder "5.19" yes;
 
   # Same as GCC_PLUGIN_RANDSTRUCT*, but has been renamed to `RANDSTRUCT*` in 5.19.
   RANDSTRUCT = whenAtLeast "5.19" yes;
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index 676302eb1e0..31f2e25c8f6 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "4.14.300";
+  version = "4.14.301";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "047vmh09icm45g7mnmdvyj9cam7747bcpah1s7n9dm5i2j2f906y";
+    sha256 = "16zrpfadsnznpl37crbq5g1hz1ch0zfp2a75yzlqy2fs0f7fxlmc";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix
index 734fa93fa20..167f7cd8479 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "4.19.267";
+  version = "4.19.268";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "035yxx13jz5f5ig2r6ybzgivm8vjafgnvjws0jfzha4w6klf7r9l";
+    sha256 = "0kr0di4gr6p57c8h6ybcli01kazq235npbh6qrpx0hpmqcdcx6r1";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.10.nix b/pkgs/os-specific/linux/kernel/linux-5.10.nix
index 8be0db43fb0..3b56aa0c8e1 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.10.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.10.157";
+  version = "5.10.158";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0zrjdmaj3sx0w7397glaiq6w9wwdj7lpff77a09kzmbyfz0dfk7w";
+    sha256 = "1rq7lyp41fydybs53rcdjhiy271arh95xch16s5s3jhhanxj82hy";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.15.nix b/pkgs/os-specific/linux/kernel/linux-5.15.nix
index f0e341f540a..5892aead900 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.15.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.15.81";
+  version = "5.15.82";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1awny3lgfkh5n2gdksajbyzips8kawz6rkr0p5inwkbmppg5r24g";
+    sha256 = "0r8v7113favmch2x6br7jk6idihza99l9qyd7ik99i5sg6xzdvpw";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.4.nix b/pkgs/os-specific/linux/kernel/linux-5.4.nix
index d4f06b7b2f8..8d874fc7269 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.4.225";
+  version = "5.4.226";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1ak0qlxzfylgvkldh2whq4mzynh1rymhnnc1yif9a5s3f7v9dxar";
+    sha256 = "0i4s1hl5q0ax55z7m5krzyw1zj9v03q8jcfksknb6qrg3lm5a7qc";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-6.0.nix b/pkgs/os-specific/linux/kernel/linux-6.0.nix
index 0815279fb4f..e882de626a1 100644
--- a/pkgs/os-specific/linux/kernel/linux-6.0.nix
+++ b/pkgs/os-specific/linux/kernel/linux-6.0.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.0.11";
+  version = "6.0.12";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "0qn7m74wfixqk832j2yvgf2lq4vi55agm5gk9ziy2wa9wqqn3bib";
+    sha256 = "00ag63lnxw2gijw3b6v29lhrlv480m12954q5zh4jawlz3nk1dw9";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
index 2e07f957efe..76db1b11bbd 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.1-rc3";
+  version = "6.1-rc8";
   extraMeta.branch = lib.versions.majorMinor version;
 
   # modDirVersion needs to be x.y.z, will always add .0
@@ -11,7 +11,7 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    hash = "sha256-qz863wvIe/JJjqSYoxxbt+2xTqgNNZJpAfWr8nG8wKk=";
+    hash = "sha256-YQYxNWZ7HmF3z5M88S8I8tjOaglNYWFtCGlGbDttx64=";
   };
 
   # Should the testing kernels ever be built on Hydra?
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index d046c8c7d19..edfd1f7dbc2 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -55,8 +55,7 @@ let
     hasAttr getAttr optional optionals optionalString optionalAttrs maintainers platforms;
 
   # Dependencies that are required to build kernel modules
-  moduleBuildDependencies = [ perl ]
-    ++ optional (lib.versionAtLeast version "4.14") libelf
+  moduleBuildDependencies = [ perl libelf ]
     ++ optional (lib.versionAtLeast version "5.13") zstd;
 
   drvAttrs = config_: kernelConf: kernelPatches: configfile:
@@ -100,7 +99,7 @@ let
       patches =
         map (p: p.patch) kernelPatches
         # Required for deterministic builds along with some postPatch magic.
-        ++ optional (lib.versionAtLeast version "4.13" && lib.versionOlder version "5.19") ./randstruct-provide-seed.patch
+        ++ optional (lib.versionOlder version "5.19") ./randstruct-provide-seed.patch
         ++ optional (lib.versionAtLeast version "5.19") ./randstruct-provide-seed-5.19.patch
         # Fixes determinism by normalizing metadata for the archive of kheaders
         ++ optional (lib.versionAtLeast version "5.2" && lib.versionOlder version "5.4") ./gen-kheaders-metadata.patch;
@@ -353,7 +352,7 @@ let
     };
 in
 
-assert (lib.versionAtLeast version "4.14" && lib.versionOlder version "5.8") -> libelf != null;
+assert lib.versionOlder version "5.8" -> libelf != null;
 assert lib.versionAtLeast version "5.8" -> elfutils != null;
 
 stdenv.mkDerivation ((drvAttrs config stdenv.hostPlatform.linux-kernel kernelPatches configfile) // {
@@ -365,7 +364,7 @@ stdenv.mkDerivation ((drvAttrs config stdenv.hostPlatform.linux-kernel kernelPat
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [ perl bc nettools openssl rsync gmp libmpc mpfr zstd python3Minimal ]
       ++ optional  (stdenv.hostPlatform.linux-kernel.target == "uImage") buildPackages.ubootTools
-      ++ optional  (lib.versionAtLeast version "4.14" && lib.versionOlder version "5.8") libelf
+      ++ optional  (lib.versionOlder version "5.8") libelf
       # Removed util-linuxMinimal since it should not be a dependency.
       ++ optionals (lib.versionAtLeast version "4.16") [ bison flex ]
       ++ optionals (lib.versionAtLeast version "5.2")  [ cpio pahole zlib ]
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 7c57d9edf60..0178cd7d6d4 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -6,6 +6,7 @@
 , fetchFromGitHub
 , fetchpatch
 , fetchzip
+, applyPatches
 , buildPackages
 , makeBinaryWrapper
 , ninja
@@ -79,7 +80,7 @@
 , withCoredump ? true
 , withCryptsetup ? true
 , withDocumentation ? true
-, withEfi ? stdenv.hostPlatform.isEfi
+, withEfi ? stdenv.hostPlatform.isEfi && !stdenv.hostPlatform.isMusl
 , withFido2 ? true
 , withHomed ? false
 , withHostnamed ? true
@@ -169,10 +170,20 @@ stdenv.mkDerivation {
   ] ++ lib.optional stdenv.hostPlatform.isMusl (
     let
       oe-core = fetchzip {
-        url = "https://git.openembedded.org/openembedded-core/snapshot/openembedded-core-86a33f98a7c0d6f2c2b51d02ba9e01b63062cf98.tar.bz2";
-        sha256 = "081j01sw21hl405l7g9z4bavvq0q0k4g80365677m0ykhiqlx3am";
+        url = "https://git.openembedded.org/openembedded-core/snapshot/openembedded-core-d43ec090ceb2bf0016a065103a4c34d0c43cb906.tar.gz";
+        sha256 = "sha256-e5rHmz0uyNgJwrAj96VGWWu9YHhZtJXoDpCtj17eC5w=";
       };
-      musl-patches = oe-core + "/meta/recipes-core/systemd/systemd";
+      oe-core-patched = applyPatches {
+        src = oe-core;
+        patches = [
+          (fetchpatch {
+            url = "https://lore.kernel.org/all/20221109002306.853567-1-raj.khem@gmail.com/raw";
+            includes = [ "meta/recipes-core/systemd/systemd/*" ];
+            sha256 = "sha256-aPJjN4vesZwFzgY4Nb6uaIuHz/quH1HccSVEof32IOU=";
+          })
+        ];
+      };
+      musl-patches = oe-core-patched + "/meta/recipes-core/systemd/systemd";
     in
     [
       (musl-patches + "/0003-missing_type.h-add-comparison_fn_t.patch")
@@ -194,6 +205,8 @@ stdenv.mkDerivation {
       (musl-patches + "/0001-pass-correct-parameters-to-getdents64.patch")
       (musl-patches + "/0002-Add-sys-stat.h-for-S_IFDIR.patch")
       (musl-patches + "/0001-Adjust-for-musl-headers.patch")
+      (musl-patches + "/0001-networkd-ipv4acd.c-Use-net-if.h-for-getting-IFF_LOOP.patch")
+      (musl-patches + "/0001-test-compile-test-utmp.c-only-if-UTMP-is-enabled.patch")
     ]
   );
 
diff --git a/pkgs/os-specific/linux/wireguard/default.nix b/pkgs/os-specific/linux/wireguard/default.nix
index 244092441b2..8d8342cce98 100644
--- a/pkgs/os-specific/linux/wireguard/default.nix
+++ b/pkgs/os-specific/linux/wireguard/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   buildFlags = [ "module" ];
   makeFlags = [
     "ARCH=${stdenv.hostPlatform.linuxArch}"
-  ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
   ];
 
diff --git a/pkgs/servers/bazarr/default.nix b/pkgs/servers/bazarr/default.nix
index 71f2272e3b5..3463e3688c0 100644
--- a/pkgs/servers/bazarr/default.nix
+++ b/pkgs/servers/bazarr/default.nix
@@ -1,9 +1,9 @@
-{ stdenv, lib, fetchurl, makeWrapper, unzip, python3, unrar, ffmpeg, nixosTests }:
+{ stdenv, lib, fetchurl, makeWrapper, unzip, python3, unar, ffmpeg, nixosTests }:
 
 let
   runtimeProgDeps = [
     ffmpeg
-    unrar
+    unar
   ];
 in
 stdenv.mkDerivation rec {
diff --git a/pkgs/servers/dns/knot-dns/default.nix b/pkgs/servers/dns/knot-dns/default.nix
index eaa1d065858..29a296dcef6 100644
--- a/pkgs/servers/dns/knot-dns/default.nix
+++ b/pkgs/servers/dns/knot-dns/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl, pkg-config, gnutls, liburcu, lmdb, libcap_ng, libidn2, libunistring
 , systemd, nettle, libedit, zlib, libiconv, libintl, libmaxminddb, libbpf, nghttp2, libmnl
-, ngtcp2-gnutls
+, ngtcp2-gnutls, xdp-tools
 , autoreconfHook
 , nixosTests, knot-resolver, knot-dns, runCommandLocal
 }:
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
     # TODO: add dnstap support?
   ] ++ lib.optionals stdenv.isLinux [
     libcap_ng systemd
-    libbpf libmnl # XDP support (it's Linux kernel API)
+    xdp-tools libbpf libmnl # XDP support (it's Linux kernel API)
   ] ++ lib.optional stdenv.isDarwin zlib; # perhaps due to gnutls
 
   enableParallelBuilding = true;
@@ -66,7 +66,7 @@ stdenv.mkDerivation rec {
     deps = runCommandLocal "knot-deps-test"
       { nativeBuildInputs = [ (lib.getBin stdenv.cc.libc) ]; }
       ''
-        for libname in libngtcp2 libbpf; do
+        for libname in libngtcp2 libxdp libbpf; do
           echo "Checking for $libname:"
           ldd '${knot-dns.bin}/bin/knotd' | grep -F "$libname"
           echo "OK"
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index a4b2f5c14cd..8f635e6d066 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2022.11.5";
+  version = "2022.12.0";
   components = {
     "3_day_blinds" = ps: with ps; [
     ];
@@ -50,6 +50,9 @@
     "airnow" = ps: with ps; [
       pyairnow
     ];
+    "airq" = ps: with ps; [
+      aioairq
+    ];
     "airthings" = ps: with ps; [
       airthings-cloud
     ];
@@ -60,9 +63,11 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       pyserial
       pyudev
@@ -151,12 +156,16 @@
     ];
     "apple_tv" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       ifaddr
       pyatv
+      sqlalchemy
       zeroconf
     ];
     "application_credentials" = ps: with ps; [
       aiohttp-cors
+      fnvhash
+      sqlalchemy
     ];
     "apprise" = ps: with ps; [
       apprise
@@ -170,6 +179,22 @@
     ];
     "aquostv" = ps: with ps; [
     ]; # missing inputs: sharp_aquos_rc
+    "aranet" = ps: with ps; [
+      aiohttp-cors
+      bleak-retry-connector
+      bleak
+      bluetooth-adapters
+      bluetooth-auto-recovery
+      bluetooth-data-tools
+      dbus-fast
+      fnvhash
+      home-assistant-frontend
+      janus
+      pillow
+      pyserial
+      pyudev
+      sqlalchemy
+    ]; # missing inputs: aranet4
     "arcam_fmj" = ps: with ps; [
       arcam-fmj
     ];
@@ -183,6 +208,7 @@
     ];
     "arwn" = ps: with ps; [
       aiohttp-cors
+      janus
       paho-mqtt
     ];
     "aseko_pool_live" = ps: with ps; [
@@ -207,20 +233,8 @@
       pyatome
     ];
     "august" = ps: with ps; [
-      aiohttp-cors
-      bleak-retry-connector
-      bleak
-      bluetooth-adapters
-      bluetooth-auto-recovery
-      dbus-fast
-      fnvhash
-      home-assistant-frontend
-      pillow
-      pyserial
-      pyudev
-      sqlalchemy
-      yalexs-ble
       yalexs
+      yalexs-ble
     ];
     "august_ble" = ps: with ps; [
     ];
@@ -254,6 +268,7 @@
     "axis" = ps: with ps; [
       aiohttp-cors
       axis
+      janus
       paho-mqtt
     ];
     "azure_devops" = ps: with ps; [
@@ -267,7 +282,9 @@
     ];
     "backup" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       securetar
+      sqlalchemy
     ];
     "baf" = ps: with ps; [
     ]; # missing inputs: aiobafi6
@@ -317,9 +334,11 @@
       bluemaestro-ble
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       pyserial
       pyudev
@@ -336,9 +355,11 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       pyserial
       pyudev
@@ -350,9 +371,11 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       pyserial
       pyudev
@@ -371,9 +394,13 @@
     "bosch_shc" = ps: with ps; [
       aiohttp-cors
       boschshcpy
+      fnvhash
       ifaddr
+      sqlalchemy
       zeroconf
     ];
+    "brandt" = ps: with ps; [
+    ];
     "braviatv" = ps: with ps; [
       pybravia
     ];
@@ -408,10 +435,12 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       bthome-ble
       dbus-fast
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       pyserial
       pyudev
@@ -443,6 +472,7 @@
     "cast" = ps: with ps; [
       pyturbojpeg
       aiohttp-cors
+      fnvhash
       hass-nabucasa
       ifaddr
       mutagen
@@ -450,6 +480,7 @@
       plexauth
       plexwebsocket
       PyChromecast
+      sqlalchemy
       zeroconf
     ];
     "cert_expiry" = ps: with ps; [
@@ -544,8 +575,10 @@
       crownstone-cloud
       crownstone-sse
       crownstone-uart
+      fnvhash
       pyserial
       pyudev
+      sqlalchemy
     ];
     "cups" = ps: with ps; [
       pycups
@@ -589,11 +622,13 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       hass-nabucasa
       home-assistant-frontend
       ifaddr
+      janus
       pillow
       psutil-home-assistant
       pyserial
@@ -634,7 +669,9 @@
     "devolo_home_control" = ps: with ps; [
       aiohttp-cors
       devolo-home-control-api
+      fnvhash
       ifaddr
+      sqlalchemy
       zeroconf
     ];
     "devolo_home_network" = ps: with ps; [
@@ -671,8 +708,10 @@
     ];
     "discovery" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       ifaddr
       netdisco
+      sqlalchemy
       zeroconf
     ];
     "dlib_face_detect" = ps: with ps; [
@@ -686,13 +725,17 @@
     "dlna_dmr" = ps: with ps; [
       aiohttp-cors
       async-upnp-client
+      fnvhash
       ifaddr
+      sqlalchemy
       zeroconf
     ];
     "dlna_dms" = ps: with ps; [
       aiohttp-cors
       async-upnp-client
+      fnvhash
       ifaddr
+      sqlalchemy
       zeroconf
     ];
     "dnsip" = ps: with ps; [
@@ -720,6 +763,7 @@
     ];
     "dsmr_reader" = ps: with ps; [
       aiohttp-cors
+      janus
       paho-mqtt
     ];
     "dte_energy_bridge" = ps: with ps; [
@@ -788,7 +832,9 @@
     "elkm1" = ps: with ps; [
       aiohttp-cors
       elkm1-lib
+      fnvhash
       ifaddr
+      sqlalchemy
     ];
     "elmax" = ps: with ps; [
       elmax-api
@@ -808,7 +854,9 @@
     ];
     "emulated_hue" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       ifaddr
+      sqlalchemy
     ];
     "emulated_kasa" = ps: with ps; [
       sense-energy
@@ -816,7 +864,9 @@
     "emulated_roku" = ps: with ps; [
       aiohttp-cors
       emulated-roku
+      fnvhash
       ifaddr
+      sqlalchemy
     ];
     "energy" = ps: with ps; [
       aiohttp-cors
@@ -855,10 +905,12 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       construct
       dbus-fast
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       pyserial
       pyudev
@@ -874,10 +926,12 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
       ifaddr
+      janus
       pillow
       pyserial
       pyudev
@@ -940,6 +994,7 @@
     ];
     "file_upload" = ps: with ps; [
       aiohttp-cors
+      janus
     ];
     "filesize" = ps: with ps; [
     ];
@@ -972,10 +1027,12 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fjaraskupan
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       pyserial
       pyudev
@@ -1011,7 +1068,9 @@
     "flux_led" = ps: with ps; [
       aiohttp-cors
       flux-led
+      fnvhash
       ifaddr
+      sqlalchemy
     ];
     "folder" = ps: with ps; [
     ];
@@ -1026,7 +1085,9 @@
     ];
     "forked_daapd" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       spotipy
+      sqlalchemy
     ]; # missing inputs: pyforked-daapd pylibrespot-java
     "fortios" = ps: with ps; [
       fortiosapi
@@ -1049,8 +1110,10 @@
     ];
     "fritz" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       fritzconnection
       ifaddr
+      sqlalchemy
       xmltodict
     ];
     "fritzbox" = ps: with ps; [
@@ -1066,6 +1129,7 @@
       aiohttp-cors
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       sqlalchemy
     ];
@@ -1114,7 +1178,9 @@
     ];
     "geocaching" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       geocachingapi
+      sqlalchemy
     ];
     "geofency" = ps: with ps; [
       aiohttp-cors
@@ -1152,8 +1218,10 @@
     ];
     "google" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       gcal-sync
       oauth2client
+      sqlalchemy
     ];
     "google_assistant" = ps: with ps; [
       pyturbojpeg
@@ -1172,7 +1240,9 @@
     ];
     "google_sheets" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       gspread
+      sqlalchemy
     ];
     "google_translate" = ps: with ps; [
       gtts
@@ -1188,10 +1258,12 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       govee-ble
       home-assistant-frontend
+      janus
       pillow
       pyserial
       pyudev
@@ -1207,8 +1279,10 @@
     ];
     "gree" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       greeclimate
       ifaddr
+      sqlalchemy
     ];
     "greeneye_monitor" = ps: with ps; [
       greeneye-monitor
@@ -1231,13 +1305,11 @@
     "habitica" = ps: with ps; [
       habitipy
     ];
-    "hangouts" = ps: with ps; [
-      hangups
-    ];
     "hardkernel" = ps: with ps; [
       aiohttp-cors
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       psutil-home-assistant
       sqlalchemy
@@ -1255,6 +1327,7 @@
       aiohttp-cors
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       sqlalchemy
     ];
@@ -1275,7 +1348,8 @@
       pyheos
     ];
     "here_travel_time" = ps: with ps; [
-      herepy
+    ]; # missing inputs: here_routing here_transit
+    "hexaom" = ps: with ps; [
     ];
     "hi_kumo" = ps: with ps; [
     ];
@@ -1306,7 +1380,9 @@
     ];
     "home_connect" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       homeconnect
+      sqlalchemy
     ];
     "home_plus_control" = ps: with ps; [
       aiohttp-cors
@@ -1316,19 +1392,67 @@
     ];
     "homeassistant_alerts" = ps: with ps; [
     ];
+    "homeassistant_hardware" = ps: with ps; [
+      aiohttp-cors
+      bellows
+      fnvhash
+      home-assistant-frontend
+      ifaddr
+      janus
+      pillow
+      pyserial-asyncio
+      pyserial
+      pyudev
+      sqlalchemy
+      zeroconf
+      zha-quirks
+      zigpy-deconz
+      zigpy-xbee
+      zigpy-zigate
+      zigpy-znp
+      zigpy
+    ];
     "homeassistant_sky_connect" = ps: with ps; [
       aiohttp-cors
+      bellows
+      fnvhash
+      home-assistant-frontend
+      ifaddr
+      janus
+      pillow
       psutil-home-assistant
+      pyserial-asyncio
       pyserial
       pyudev
+      sqlalchemy
+      zeroconf
+      zha-quirks
+      zigpy-deconz
+      zigpy-xbee
+      zigpy-zigate
+      zigpy-znp
+      zigpy
     ];
     "homeassistant_yellow" = ps: with ps; [
       aiohttp-cors
+      bellows
       fnvhash
       home-assistant-frontend
+      ifaddr
+      janus
       pillow
       psutil-home-assistant
+      pyserial-asyncio
+      pyserial
+      pyudev
       sqlalchemy
+      zeroconf
+      zha-quirks
+      zigpy-deconz
+      zigpy-xbee
+      zigpy-zigate
+      zigpy-znp
+      zigpy
     ];
     "homekit" = ps: with ps; [
       pyqrcode
@@ -1339,6 +1463,7 @@
       hap-python
       ha-ffmpeg
       ifaddr
+      sqlalchemy
       zeroconf
     ];
     "homekit_controller" = ps: with ps; [
@@ -1348,10 +1473,12 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
       ifaddr
+      janus
       pillow
       pyserial
       pyudev
@@ -1427,10 +1554,12 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
       ibeacon-ble
+      janus
       pillow
       pyserial
       pyudev
@@ -1479,10 +1608,12 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
       inkbird-ble
+      janus
       pillow
       pyserial
       pyudev
@@ -1507,6 +1638,7 @@
       fnvhash
       home-assistant-frontend
       insteon-frontend-home-assistant
+      janus
       pillow
       pyinsteon
       pyserial
@@ -1528,7 +1660,9 @@
     ];
     "ios" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       ifaddr
+      sqlalchemy
       zeroconf
     ];
     "iotawatt" = ps: with ps; [
@@ -1600,9 +1734,11 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
+      janus
       kegtron-ble
       pillow
       pyserial
@@ -1622,9 +1758,11 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       pyserial
       pyudev
@@ -1669,8 +1807,15 @@
     "lametric" = ps: with ps; [
       aiohttp-cors
       demetriek
+      fnvhash
+      sqlalchemy
     ];
     "landisgyr_heat_meter" = ps: with ps; [
+      aiohttp-cors
+      fnvhash
+      pyserial
+      pyudev
+      sqlalchemy
       ultraheat-api
     ];
     "lannouncer" = ps: with ps; [
@@ -1693,9 +1838,11 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
+      janus
       led-ble
       pillow
       pyserial
@@ -1721,7 +1868,9 @@
       aiolifx
       aiolifx-effects
       aiolifx-themes
+      fnvhash
       ifaddr
+      sqlalchemy
     ];
     "lifx_cloud" = ps: with ps; [
     ];
@@ -1748,13 +1897,20 @@
     "litterrobot" = ps: with ps; [
       pylitterbot
     ];
+    "livisi" = ps: with ps; [
+    ]; # missing inputs: aiolivisi
     "llamalab_automate" = ps: with ps; [
     ];
+    "local_calendar" = ps: with ps; [
+      ical
+    ];
     "local_file" = ps: with ps; [
     ];
     "local_ip" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       ifaddr
+      sqlalchemy
     ];
     "locative" = ps: with ps; [
       aiohttp-cors
@@ -1765,6 +1921,7 @@
       aiohttp-cors
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       sqlalchemy
     ];
@@ -1808,6 +1965,8 @@
     "lyric" = ps: with ps; [
       aiohttp-cors
       aiolyric
+      fnvhash
+      sqlalchemy
     ];
     "magicseaweed" = ps: with ps; [
     ]; # missing inputs: magicseaweed
@@ -1822,12 +1981,14 @@
     ];
     "manual_mqtt" = ps: with ps; [
       aiohttp-cors
+      janus
       paho-mqtt
     ];
     "map" = ps: with ps; [
       aiohttp-cors
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       sqlalchemy
     ];
@@ -1843,6 +2004,11 @@
     "matrix" = ps: with ps; [
       matrix-client
     ];
+    "matter" = ps: with ps; [
+      aiohttp-cors
+      fnvhash
+      sqlalchemy
+    ]; # missing inputs: python-matter-server
     "maxcube" = ps: with ps; [
       maxcube-api
     ];
@@ -1876,9 +2042,11 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       pyserial
       pyudev
@@ -1953,9 +2121,11 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
+      janus
       moat-ble
       pillow
       pyserial
@@ -1966,8 +2136,10 @@
       pynacl
       pyturbojpeg
       aiohttp-cors
+      fnvhash
       hass-nabucasa
       pillow
+      sqlalchemy
     ];
     "mochad" = ps: with ps; [
     ]; # missing inputs: pymochad
@@ -1976,9 +2148,11 @@
     ];
     "modem_callerid" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       phone-modem
       pyserial
       pyudev
+      sqlalchemy
     ];
     "modern_forms" = ps: with ps; [
       aiomodernforms
@@ -1993,8 +2167,10 @@
     ];
     "motion_blinds" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       ifaddr
       motionblinds
+      sqlalchemy
     ];
     "motioneye" = ps: with ps; [
       aiohttp-cors
@@ -2005,22 +2181,27 @@
     ];
     "mqtt" = ps: with ps; [
       aiohttp-cors
+      janus
       paho-mqtt
     ];
     "mqtt_eventstream" = ps: with ps; [
       aiohttp-cors
+      janus
       paho-mqtt
     ];
     "mqtt_json" = ps: with ps; [
       aiohttp-cors
+      janus
       paho-mqtt
     ];
     "mqtt_room" = ps: with ps; [
       aiohttp-cors
+      janus
       paho-mqtt
     ];
     "mqtt_statestream" = ps: with ps; [
       aiohttp-cors
+      janus
       paho-mqtt
     ];
     "msteams" = ps: with ps; [
@@ -2039,6 +2220,7 @@
       aiohttp-cors
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       sqlalchemy
     ];
@@ -2049,6 +2231,7 @@
     ];
     "mysensors" = ps: with ps; [
       aiohttp-cors
+      janus
       paho-mqtt
       pymysensors
     ];
@@ -2073,7 +2256,9 @@
     ];
     "neato" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       pybotvac
+      sqlalchemy
     ];
     "nederlandse_spoorwegen" = ps: with ps; [
       nsapi
@@ -2083,15 +2268,19 @@
     ];
     "nest" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       google-nest-sdm
       ha-ffmpeg
       python-nest
+      sqlalchemy
     ];
     "netatmo" = ps: with ps; [
       pyturbojpeg
       aiohttp-cors
+      fnvhash
       hass-nabucasa
       pyatmo
+      sqlalchemy
     ];
     "netdata" = ps: with ps; [
       netdata
@@ -2107,7 +2296,9 @@
     ]; # missing inputs: pynetio
     "network" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       ifaddr
+      sqlalchemy
     ];
     "neurio_energy" = ps: with ps; [
     ]; # missing inputs: neurio
@@ -2129,7 +2320,6 @@
     ]; # missing inputs: notifications-android-tv
     "nibe_heatpump" = ps: with ps; [
       nibe
-      tenacity
     ];
     "nightscout" = ps: with ps; [
       py-nightscout
@@ -2148,10 +2338,12 @@
     ];
     "nmap_tracker" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       getmac
       ifaddr
       mac-vendor-lookup
       netmap
+      sqlalchemy
     ];
     "nmbs" = ps: with ps; [
     ]; # missing inputs: pyrail
@@ -2225,6 +2417,7 @@
       aiohttp-cors
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       sqlalchemy
     ];
@@ -2299,9 +2492,11 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
+      janus
       oralb-ble
       pillow
       pyserial
@@ -2329,6 +2524,7 @@
       pyturbojpeg
       aiohttp-cors
       hass-nabucasa
+      janus
       paho-mqtt
     ];
     "p1_monitor" = ps: with ps; [
@@ -2347,6 +2543,7 @@
       aiohttp-cors
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       sqlalchemy
     ];
@@ -2354,6 +2551,7 @@
       aiohttp-cors
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       sqlalchemy
     ];
@@ -2492,9 +2690,11 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       pyserial
       pyudev
@@ -2556,6 +2756,7 @@
       aiohttp-cors
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       psutil-home-assistant
       sqlalchemy
@@ -2674,6 +2875,22 @@
     ]; # missing inputs: russound_rio
     "russound_rnet" = ps: with ps; [
     ]; # missing inputs: russound
+    "ruuvitag_ble" = ps: with ps; [
+      aiohttp-cors
+      bleak-retry-connector
+      bleak
+      bluetooth-adapters
+      bluetooth-auto-recovery
+      bluetooth-data-tools
+      dbus-fast
+      fnvhash
+      home-assistant-frontend
+      janus
+      pillow
+      pyserial
+      pyudev
+      sqlalchemy
+    ]; # missing inputs: ruuvitag-ble
     "sabnzbd" = ps: with ps; [
       pysabnzbd
     ];
@@ -2683,6 +2900,7 @@
       fnvhash
       hass-nabucasa
       home-assistant-frontend
+      janus
       pillow
       sqlalchemy
     ];
@@ -2692,10 +2910,12 @@
     "samsungtv" = ps: with ps; [
       aiohttp-cors
       async-upnp-client
+      fnvhash
       getmac
       ifaddr
       samsungctl
       samsungtvws
+      sqlalchemy
       wakeonlan
       zeroconf
     ]
@@ -2727,6 +2947,8 @@
     ]; # missing inputs: scsgate
     "search" = ps: with ps; [
       aiohttp-cors
+      fnvhash
+      sqlalchemy
     ];
     "season" = ps: with ps; [
       ephem
@@ -2745,6 +2967,22 @@
     "sensibo" = ps: with ps; [
       pysensibo
     ];
+    "sensirion_ble" = ps: with ps; [
+      aiohttp-cors
+      bleak-retry-connector
+      bleak
+      bluetooth-adapters
+      bluetooth-auto-recovery
+      bluetooth-data-tools
+      dbus-fast
+      fnvhash
+      home-assistant-frontend
+      janus
+      pillow
+      pyserial
+      pyudev
+      sqlalchemy
+    ]; # missing inputs: sensirion-ble
     "sensor" = ps: with ps; [
       fnvhash
       sqlalchemy
@@ -2757,9 +2995,11 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       pyserial
       pyudev
@@ -2772,9 +3012,11 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       pyserial
       pyudev
@@ -2787,6 +3029,8 @@
     "senz" = ps: with ps; [
       aiohttp-cors
       aiosenz
+      fnvhash
+      sqlalchemy
     ];
     "serial" = ps: with ps; [
       pyserial-asyncio
@@ -2810,6 +3054,19 @@
     "shelly" = ps: with ps; [
       aiohttp-cors
       aioshelly
+      bleak-retry-connector
+      bleak
+      bluetooth-adapters
+      bluetooth-auto-recovery
+      bluetooth-data-tools
+      dbus-fast
+      fnvhash
+      home-assistant-frontend
+      janus
+      pillow
+      pyserial
+      pyudev
+      sqlalchemy
     ];
     "shiftr" = ps: with ps; [
       paho-mqtt
@@ -2839,6 +3096,8 @@
     ];
     "simply_automated" = ps: with ps; [
     ];
+    "simu" = ps: with ps; [
+    ];
     "simulated" = ps: with ps; [
     ];
     "sinch" = ps: with ps; [
@@ -2911,6 +3170,7 @@
     ];
     "snips" = ps: with ps; [
       aiohttp-cors
+      janus
       paho-mqtt
     ];
     "snmp" = ps: with ps; [
@@ -2922,9 +3182,11 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       pyserial
       pysnooz
@@ -2960,12 +3222,14 @@
     "sonos" = ps: with ps; [
       aiohttp-cors
       async-upnp-client
+      fnvhash
       ifaddr
       plexapi
       plexauth
       plexwebsocket
       soco
       spotipy
+      sqlalchemy
       zeroconf
     ];
     "sony_projector" = ps: with ps; [
@@ -2990,7 +3254,9 @@
     ]; # missing inputs: hass_splunk
     "spotify" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       spotipy
+      sqlalchemy
     ];
     "sql" = ps: with ps; [
       sqlalchemy
@@ -3004,7 +3270,9 @@
     "ssdp" = ps: with ps; [
       aiohttp-cors
       async-upnp-client
+      fnvhash
       ifaddr
+      sqlalchemy
       zeroconf
     ];
     "starline" = ps: with ps; [
@@ -3029,7 +3297,9 @@
       aiohttp-cors
       aiosteamist
       discovery30303
+      fnvhash
       ifaddr
+      sqlalchemy
     ];
     "stiebel_eltron" = ps: with ps; [
       pymodbus
@@ -3041,6 +3311,7 @@
       pyturbojpeg
       aiohttp-cors
       av
+      numpy
     ];
     "streamlabswater" = ps: with ps; [
       streamlabswater
@@ -3084,9 +3355,11 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       pyserial
       pyudev
@@ -3117,7 +3390,9 @@
     ];
     "system_bridge" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       ifaddr
+      sqlalchemy
       zeroconf
     ]; # missing inputs: systembridgeconnector
     "system_health" = ps: with ps; [
@@ -3147,6 +3422,7 @@
     "tasmota" = ps: with ps; [
       aiohttp-cors
       hatasmota
+      janus
       paho-mqtt
     ];
     "tautulli" = ps: with ps; [
@@ -3188,6 +3464,8 @@
     "tesla_wall_connector" = ps: with ps; [
       tesla-wall-connector
     ];
+    "text" = ps: with ps; [
+    ];
     "tfiac" = ps: with ps; [
     ]; # missing inputs: pytfiac
     "thermobeacon" = ps: with ps; [
@@ -3196,9 +3474,11 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       pyserial
       pyudev
@@ -3213,9 +3493,11 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       pyserial
       pyudev
@@ -3251,9 +3533,11 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       pyserial
       pyudev
@@ -3296,8 +3580,10 @@
     ]; # missing inputs: pytouchline
     "tplink" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       ifaddr
       python-kasa
+      sqlalchemy
     ];
     "tplink_lte" = ps: with ps; [
     ]; # missing inputs: tp-connected
@@ -3367,6 +3653,8 @@
     "twitter" = ps: with ps; [
       twitterapi
     ];
+    "ubiwizz" = ps: with ps; [
+    ];
     "ubus" = ps: with ps; [
       openwrt-ubus-rpc
     ];
@@ -3409,8 +3697,10 @@
     "upnp" = ps: with ps; [
       aiohttp-cors
       async-upnp-client
+      fnvhash
       getmac
       ifaddr
+      sqlalchemy
       zeroconf
     ];
     "uprise_smart_shades" = ps: with ps; [
@@ -3422,8 +3712,10 @@
     ];
     "usb" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       pyserial
       pyudev
+      sqlalchemy
     ];
     "usgs_earthquakes_feed" = ps: with ps; [
       aio-geojson-usgs-earthquakes
@@ -3443,8 +3735,10 @@
     ]; # missing inputs: vtjp
     "velbus" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       pyserial
       pyudev
+      sqlalchemy
       velbus-aio
     ];
     "velux" = ps: with ps; [
@@ -3542,6 +3836,8 @@
     ];
     "websocket_api" = ps: with ps; [
       aiohttp-cors
+      fnvhash
+      sqlalchemy
     ];
     "wemo" = ps: with ps; [
       pywemo
@@ -3562,12 +3858,16 @@
     ]; # missing inputs: wirelesstagpy
     "withings" = ps: with ps; [
       aiohttp-cors
+      fnvhash
+      sqlalchemy
       withings-api
     ];
     "wiz" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       ifaddr
       pywizlight
+      sqlalchemy
     ];
     "wled" = ps: with ps; [
       wled
@@ -3592,6 +3892,8 @@
     ];
     "xbox" = ps: with ps; [
       aiohttp-cors
+      fnvhash
+      sqlalchemy
       xbox-webapi
     ];
     "xbox_live" = ps: with ps; [
@@ -3606,8 +3908,10 @@
     "xiaomi_aqara" = ps: with ps; [
       pyxiaomigateway
       aiohttp-cors
+      fnvhash
       ifaddr
       netdisco
+      sqlalchemy
       zeroconf
     ];
     "xiaomi_ble" = ps: with ps; [
@@ -3616,9 +3920,11 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       pyserial
       pyudev
@@ -3647,9 +3953,11 @@
       bleak
       bluetooth-adapters
       bluetooth-auto-recovery
+      bluetooth-data-tools
       dbus-fast
       fnvhash
       home-assistant-frontend
+      janus
       pillow
       pyserial
       pyudev
@@ -3663,7 +3971,9 @@
       aiohttp-cors
       aiomusiccast
       async-upnp-client
+      fnvhash
       ifaddr
+      sqlalchemy
       zeroconf
     ];
     "yandex_transport" = ps: with ps; [
@@ -3674,7 +3984,9 @@
     "yeelight" = ps: with ps; [
       aiohttp-cors
       async-upnp-client
+      fnvhash
       ifaddr
+      sqlalchemy
       yeelight
       zeroconf
     ];
@@ -3686,6 +3998,8 @@
     ];
     "yolink" = ps: with ps; [
       aiohttp-cors
+      fnvhash
+      sqlalchemy
       yolink-api
     ];
     "youless" = ps: with ps; [
@@ -3702,7 +4016,9 @@
     ]; # missing inputs: zengge
     "zeroconf" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       ifaddr
+      sqlalchemy
       zeroconf
     ];
     "zerproc" = ps: with ps; [
@@ -3717,6 +4033,7 @@
       fnvhash
       home-assistant-frontend
       ifaddr
+      janus
       pillow
       pyserial-asyncio
       pyserial
@@ -3743,13 +4060,17 @@
     ];
     "zwave_js" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       pyserial
       pyudev
+      sqlalchemy
       zwave-js-server-python
     ];
     "zwave_me" = ps: with ps; [
       aiohttp-cors
+      fnvhash
       ifaddr
+      sqlalchemy
       url-normalize
       zeroconf
       zwave-me-ws
@@ -3768,6 +4089,7 @@
     "air_quality"
     "airly"
     "airnow"
+    "airq"
     "airthings"
     "airthings_ble"
     "airtouch4"
@@ -3982,7 +4304,6 @@
     "growatt_server"
     "guardian"
     "habitica"
-    "hangouts"
     "hardkernel"
     "hardware"
     "harmony"
@@ -3990,7 +4311,6 @@
     "hddtemp"
     "hdmi_cec"
     "heos"
-    "here_travel_time"
     "hisense_aehw4a1"
     "history"
     "history_stats"
@@ -4000,6 +4320,7 @@
     "home_plus_control"
     "homeassistant"
     "homeassistant_alerts"
+    "homeassistant_hardware"
     "homeassistant_sky_connect"
     "homeassistant_yellow"
     "homekit"
@@ -4074,6 +4395,7 @@
     "lifx"
     "light"
     "litterrobot"
+    "local_calendar"
     "local_file"
     "local_ip"
     "locative"
@@ -4343,6 +4665,7 @@
     "tellduslive"
     "template"
     "tesla_wall_connector"
+    "text"
     "thermobeacon"
     "thermopro"
     "threshold"
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index d2cdd24d4f2..9ef56600414 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -41,16 +41,6 @@ let
         };
       });
 
-      arcam-fmj = super.arcam-fmj.overridePythonAttrs (old: rec {
-        disabledTestPaths = [
-          # incompatible with pytest-aiohttp 0.3.0
-          # see https://github.com/elupus/arcam_fmj/pull/12
-          "tests/test_fake.py"
-          "tests/test_standard.py"
-          "tests/test_utils.py"
-        ];
-      });
-
       caldav = super.caldav.overridePythonAttrs (old: rec {
         version = "0.9.1";
         src = fetchFromGitHub {
@@ -88,62 +78,6 @@ let
         };
       });
 
-      nibe = super.nibe.overridePythonAttrs (oldAttrs: rec {
-        version = "0.5.0";
-        src = fetchFromGitHub {
-          owner = "yozik04";
-          repo = "nibe";
-          rev = "refs/tags/${version}";
-          hash = "sha256-DguGWNJfc5DfbcKMX2eMM2U1WyVPcdtv2BmpVloOFSU=";
-        };
-      });
-
-      # pytest-aiohttp>0.3.0 breaks home-assistant tests
-      pytest-aiohttp = super.pytest-aiohttp.overridePythonAttrs (oldAttrs: rec {
-        version = "0.3.0";
-        src = self.fetchPypi {
-          inherit version;
-          pname = "pytest-aiohttp";
-          hash = "sha256-ySmFQzljeXc3WDhwO2L+9jUoWYvAqdRRY566lfSqpE8=";
-        };
-        propagatedBuildInputs = with self; [ aiohttp pytest ];
-        doCheck = false;
-        patches = [];
-      });
-      aioecowitt = super.aioecowitt.overridePythonAttrs (oldAttrs: {
-        doCheck = false; # requires aiohttp>=1.0.0
-      });
-      aiohomekit = super.aiohomekit.overridePythonAttrs (oldAttrs: {
-        doCheck = false; # requires aiohttp>=1.0.0
-      });
-      aioopenexchangerates = super.aioopenexchangerates.overridePythonAttrs (oldAttrs: {
-        doCheck = false; # requires aiohttp>=1.0.0
-      });
-      gcal-sync = super.gcal-sync.overridePythonAttrs (oldAttrs: {
-        doCheck = false; # requires aiohttp>=1.0.0
-      });
-      hass-nabucasa = super.hass-nabucasa.overridePythonAttrs (oldAttrs: {
-        doCheck = false; # requires aiohttp>=1.0.0
-      });
-      pylitterbot = super.pylitterbot.overridePythonAttrs (oldAttrs: {
-        doCheck = false; # requires pytest-aiohttp>=1.0.0
-      });
-      pynws = super.pynws.overridePythonAttrs (oldAttrs: {
-        doCheck = false; # requires pytest-aiohttp>=1.0.0
-      });
-      pytomorrowio = super.pytomorrowio.overridePythonAttrs (oldAttrs: {
-        doCheck = false; # requires pytest-aiohttp>=1.0.0
-      });
-      rtsp-to-webrtc = super.rtsp-to-webrtc.overridePythonAttrs (oldAttrs: {
-        doCheck = false; # requires pytest-aiohttp>=1.0.0
-      });
-      snitun = super.snitun.overridePythonAttrs (oldAttrs: {
-        doCheck = false; # requires aiohttp>=1.0.0
-      });
-      zwave-js-server-python = super.zwave-js-server-python.overridePythonAttrs (oldAttrs: {
-        doCheck = false; # requires aiohttp>=1.0.0
-      });
-
       # Pinned due to API changes in 0.1.0
       poolsense = super.poolsense.overridePythonAttrs (oldAttrs: rec {
         version = "0.0.8";
@@ -165,16 +99,6 @@ let
         };
       });
 
-      pydaikin = super.pydaikin.overridePythonAttrs (oldAttrs: rec {
-        disabledTests = [
-          "test_power_sensors"
-        ];
-      });
-
-      pydeconz = super.pydeconz.overridePythonAttrs (oldAttrs: rec {
-        doCheck = false; # requires pytest-aiohttp>=1.0.0
-      });
-
       python-slugify = super.python-slugify.overridePythonAttrs (oldAttrs: rec {
         pname = "python-slugify";
         version = "4.0.1";
@@ -264,7 +188,7 @@ let
   extraPackagesFile = writeText "home-assistant-packages" (lib.concatMapStringsSep "\n" (pkg: pkg.pname) extraBuildInputs);
 
   # Don't forget to run parse-requirements.py after updating
-  hassVersion = "2022.11.5";
+  hassVersion = "2022.12.0";
 
 in python.pkgs.buildPythonApplication rec {
   pname = "homeassistant";
@@ -282,7 +206,7 @@ in python.pkgs.buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     rev = version;
-    hash = "sha256-5QV9k3aMMhkB5ZVNOzkwAcA2qTLT7HBays8BoRyshVo=";
+    hash = "sha256-EucTvr/XISdRIpbNkLZjSAHubIbEE3VvMf2y5XE7/n8=";
   };
 
   # leave this in, so users don't have to constantly update their downstream patch handling
diff --git a/pkgs/servers/home-assistant/frontend.nix b/pkgs/servers/home-assistant/frontend.nix
index dd6831b196f..b8bdb7e84da 100644
--- a/pkgs/servers/home-assistant/frontend.nix
+++ b/pkgs/servers/home-assistant/frontend.nix
@@ -4,7 +4,7 @@ buildPythonPackage rec {
   # the frontend version corresponding to a specific home-assistant version can be found here
   # https://github.com/home-assistant/home-assistant/blob/master/homeassistant/components/frontend/manifest.json
   pname = "home-assistant-frontend";
-  version = "20221108.0";
+  version = "20221207.0";
   format = "wheel";
 
   src = fetchPypi {
@@ -12,7 +12,7 @@ buildPythonPackage rec {
     pname = "home_assistant_frontend";
     dist = "py3";
     python = "py3";
-    sha256 = "sha256-jwDKWDI5fhrQNtEqMMWQZJFjjJYSqjNZFOVRsQvI9pY=";
+    hash = "sha256-8sLk9cWbsEkPf3sL0UWhrlxLOUABXKqDrKZfE0HVDjw=";
   };
 
   # there is nothing to strip in this package
diff --git a/pkgs/servers/home-assistant/tests.nix b/pkgs/servers/home-assistant/tests.nix
index 1651e302664..cbcd0847b79 100644
--- a/pkgs/servers/home-assistant/tests.nix
+++ b/pkgs/servers/home-assistant/tests.nix
@@ -14,12 +14,14 @@ let
     generic = [ av ];
     google_translate = [ mutagen ];
     google_sheets = [ oauth2client ];
-    homeassistant_sky_connect = [ bellows zha-quirks zigpy-deconz zigpy-xbee zigpy-zigate zigpy-znp ];
+    hassio = [ bellows zha-quirks zigpy-deconz zigpy-xbee zigpy-zigate zigpy-znp ];
+    homeassistant_sky_connect = [ bellows zha-quirks zigpy-deconz zigpy-xbee zigpy-zigate zigpy-znp zwave-js-server-python ];
     homeassistant_yellow = [ bellows zha-quirks zigpy-deconz zigpy-xbee zigpy-zigate zigpy-znp ];
     lovelace = [ PyChromecast ];
     nest = [ av ];
     onboarding = [ pymetno radios rpi-bad-power ];
     raspberry_pi = [ rpi-bad-power ];
+    shelly = [ pyswitchbot ];
     tilt_ble = [ govee-ble ibeacon-ble ];
     tomorrowio = [ pyclimacell ];
     version = [ aioaseko ];
@@ -70,6 +72,10 @@ let
       # aioserial mock produces wrong state
       "--deselect tests/components/modem_callerid/test_init.py::test_setup_entry"
     ];
+    unifiprotect = [
+      # "TypeError: object Mock can't be used in 'await' expression
+      "--deselect tests/components/unifiprotect/test_repairs.py::test_ea_warning_fix"
+    ];
     skybell = [
       # Sandbox network limitations: Cannot connect to host cloud.myskybell.com:443
       "--deselect tests/components/skybell/test_config_flow.py::test_flow_user_unknown_error"
diff --git a/pkgs/servers/home-automation/evcc/default.nix b/pkgs/servers/home-automation/evcc/default.nix
index bd611627908..70af6e4530e 100644
--- a/pkgs/servers/home-automation/evcc/default.nix
+++ b/pkgs/servers/home-automation/evcc/default.nix
@@ -16,20 +16,20 @@
 
 buildGoModule rec {
   pname = "evcc";
-  version = "0.108.3";
+  version = "0.109.2";
 
   src = fetchFromGitHub {
     owner = "evcc-io";
     repo = pname;
     rev = version;
-    hash = "sha256-jBUKMsSpcMoW4v9S5pCpojoYzFASj8hmWPzUcqL3doQ=";
+    hash = "sha256-/Mklf+F9OHq56Qj/kn8JpRAgWwCZqwsH9EwrBFdi/mQ=";
   };
 
-  vendorHash = "sha256-10W1BNHcdP77m7lJ/mc+jQeUigoUid3K0wI4bUm5y+s=";
+  vendorHash = "sha256-H3ACmang+DPOCnccHLG6YzKvi7Rf5k8RkJDD1CgGBrw=";
 
   npmDeps = fetchNpmDeps {
     inherit src;
-    hash = "sha256-+l5LuxJAjrTvOL5XEQ4OIktdupSpn6IqrNX5x4MRmNw=";
+    hash = "sha256-oxoENlZNThW1PrwcGwiNP5Q7BZyhhtuCwXFey0t3Kz8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/http/dufs/default.nix b/pkgs/servers/http/dufs/default.nix
index e162a42863a..af02b719961 100644
--- a/pkgs/servers/http/dufs/default.nix
+++ b/pkgs/servers/http/dufs/default.nix
@@ -23,6 +23,11 @@ rustPlatform.buildRustPackage rec {
     Security
   ];
 
+  checkFlags = [
+    # tests depend on network interface, may fail with virtual IPs.
+    "--skip=validate_printed_urls"
+  ];
+
   meta = with lib; {
     description = "A file server that supports static serving, uploading, searching, accessing control, webdav";
     homepage = "https://github.com/sigoden/dufs";
diff --git a/pkgs/servers/http/hiawatha/default.nix b/pkgs/servers/http/hiawatha/default.nix
index 2ab0b12c483..d92d5d51a4f 100644
--- a/pkgs/servers/http/hiawatha/default.nix
+++ b/pkgs/servers/http/hiawatha/default.nix
@@ -3,7 +3,7 @@
 
 , cmake
 , ninja
-, mbedtls
+, mbedtls_2
 , libxcrypt
 
 , enableCache     ? true     # Internal cache support.
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ cmake ninja ];
-  buildInputs = [ mbedtls libxcrypt ] ++ lib.optionals enableXslt [ libxslt libxml2 ];
+  buildInputs = [ mbedtls_2 libxcrypt ] ++ lib.optionals enableXslt [ libxslt libxml2 ];
 
   prePatch = ''
     substituteInPlace CMakeLists.txt --replace SETUID ""
diff --git a/pkgs/servers/invidious/versions.json b/pkgs/servers/invidious/versions.json
index b7d890a83a0..615517b0b19 100644
--- a/pkgs/servers/invidious/versions.json
+++ b/pkgs/servers/invidious/versions.json
@@ -4,9 +4,9 @@
     "sha256": "sha256-EU6T9yQCdOLx98Io8o01rEsgxDFF/Xoy42LgPopD2/A="
   },
   "invidious": {
-    "rev": "516efd2df3f7d242c2d1df416053b4991a554116",
-    "sha256": "sha256-4Rd8SZv2c61ROBPjOEMbVTZ8aFjerPROfU9iRt1KOg4=",
-    "version": "unstable-2022-11-17"
+    "rev": "5160d8bae39dc5cc5d51abee90571a03c08d0f2b",
+    "sha256": "sha256-cM/5xnzO5wyzudXHeud9k3M5BsralRUgO4vSoebYRZ8=",
+    "version": "unstable-2022-11-22"
   },
   "lsquic": {
     "sha256": "sha256-hG8cUvhbCNeMOsKkaJlgGpzUrIx47E/WhmPIdI5F3qM=",
diff --git a/pkgs/servers/klipper/klipper-firmware.nix b/pkgs/servers/klipper/klipper-firmware.nix
index 3d37f91b11f..4c9e4e29354 100644
--- a/pkgs/servers/klipper/klipper-firmware.nix
+++ b/pkgs/servers/klipper/klipper-firmware.nix
@@ -5,7 +5,7 @@
 , bintools-unwrapped
 , libffi
 , libusb1
-, wxGTK30-gtk3
+, wxGTK30
 , python3
 , gcc-arm-embedded
 , klipper
@@ -28,7 +28,7 @@
     avrdude
     stm32flash
     pkg-config
-    wxGTK30-gtk3 # Required for bossac
+    wxGTK30 # Required for bossac
   ];
 
   preBuild = "cp ${firmwareConfig} ./.config";
diff --git a/pkgs/servers/libreddit/default.nix b/pkgs/servers/libreddit/default.nix
index 0209102eb8d..2aa7159a5f9 100644
--- a/pkgs/servers/libreddit/default.nix
+++ b/pkgs/servers/libreddit/default.nix
@@ -19,7 +19,7 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "sha256-uIr8aUDErHVUKML2l6nITSBpOxqg3h1Md0948BxvutI=";
 
-  buildInputs = lib.optional stdenv.isDarwin [
+  buildInputs = lib.optionals stdenv.isDarwin [
     Security
   ];
 
diff --git a/pkgs/servers/matrix-synapse/default.nix b/pkgs/servers/matrix-synapse/default.nix
index 27c2fe3069b..b7a7c85bfc2 100644
--- a/pkgs/servers/matrix-synapse/default.nix
+++ b/pkgs/servers/matrix-synapse/default.nix
@@ -11,20 +11,20 @@ in
 with python3.pkgs;
 buildPythonApplication rec {
   pname = "matrix-synapse";
-  version = "1.72.0";
+  version = "1.73.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "matrix-org";
     repo = "synapse";
     rev = "v${version}";
-    hash = "sha256-LkzUrEXC+jonkEpAGIEDQhAKisrKNQB8/elchN/4YMU=";
+    hash = "sha256-Er5a+0Qyvm5V1ObWjDQ8fs+r/XB+4aRItJMqaz1VSqk=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-AuQURcVaIoOYG9jh6QhPpXB0akASVWMYe4fA/376cwo=";
+    hash = "sha256-yU72e8OBnUtNdUI/crX7v2KRYHHHOY4Ga9CI3PJwais=";
   };
 
   postPatch = ''
diff --git a/pkgs/servers/monitoring/do-agent/default.nix b/pkgs/servers/monitoring/do-agent/default.nix
index 2508e135431..1aa13080391 100644
--- a/pkgs/servers/monitoring/do-agent/default.nix
+++ b/pkgs/servers/monitoring/do-agent/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "do-agent";
-  version = "3.15.1";
+  version = "3.15.2";
 
   src = fetchFromGitHub {
     owner = "digitalocean";
     repo = "do-agent";
     rev = version;
-    sha256 = "sha256-a3/zwBxxTdcDQkvKb/Fj1M2U1qhKRXg7dtRzEgkKCu0=";
+    sha256 = "sha256-YK4k2iSKrRVraUjbUCYxNjH+CGn6eASsEKIU5QsfcNM=";
   };
 
   ldflags = [
diff --git a/pkgs/servers/monitoring/nagios/plugins/check_ssl_cert.nix b/pkgs/servers/monitoring/nagios/plugins/check_ssl_cert.nix
index 2442735ffc4..bd1a5f2758a 100644
--- a/pkgs/servers/monitoring/nagios/plugins/check_ssl_cert.nix
+++ b/pkgs/servers/monitoring/nagios/plugins/check_ssl_cert.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "check_ssl_cert";
-  version = "2.56.0";
+  version = "2.57.0";
 
   src = fetchFromGitHub {
     owner = "matteocorti";
     repo = "check_ssl_cert";
     rev = "v${version}";
-    hash = "sha256-2Ch5XnHs2PIsmI6JKYQPsDqcUSgWE5+u3vHqAW/SB8E=";
+    hash = "sha256-N+VkdVeJ6UdRPFUFmIpZoL/Mc8MkTd+hAPjha5pimt8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/monitoring/prometheus/smartctl-exporter/default.nix b/pkgs/servers/monitoring/prometheus/smartctl-exporter/default.nix
index 21ccb8178c3..df21ef09f9f 100644
--- a/pkgs/servers/monitoring/prometheus/smartctl-exporter/default.nix
+++ b/pkgs/servers/monitoring/prometheus/smartctl-exporter/default.nix
@@ -1,42 +1,33 @@
 { lib
 , fetchFromGitHub
-, fetchpatch
 , buildGoModule
+, nixosTests
 }:
 
 buildGoModule rec {
   pname = "smartctl_exporter";
-  version = "unstable-2020-11-14";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "prometheus-community";
     repo = pname;
-    rev = "e27581d56ad80340fb076d3ce22cef337ed76679";
-    sha256 = "sha256-iWaFDjVLBIAA9zGe0utbuvmEdA3R5lge0iCh3j2JfE8=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-fc1NZ5QwzR/jJkeaDm5PMT4wBFFlqZOXKTJMBJWKJJ8=";
   };
 
-  patches = [
-    # Fixes out of range panic (https://github.com/prometheus-community/smartctl_exporter/issues/19)
-    (fetchpatch {
-      url = "https://github.com/prometheus-community/smartctl_exporter/commit/15575301a8e2fe5802a8c066c6fa9765d50b8cfa.patch";
-      sha256 = "sha256-HLUrGXNz3uKpuQBUgQBSw6EGbGl23hQnimTGl64M5bQ=";
-    })
-    # Fix validation on empty smartctl response (https://github.com/prometheus-community/smartctl_exporter/pull/31)
-    (fetchpatch {
-      url = "https://github.com/prometheus-community/smartctl_exporter/commit/744b4e5f6a46e029d31d5aa46642e85f429c2cfa.patch";
-      sha256 = "sha256-MgLtYR1SpM6XrZQQ3AgQRmNF3OnaBCqXMJRV9BOzKPc=";
-    })
-    # Fixes missing metrics if outside of query interval (https://github.com/prometheus-community/smartctl_exporter/pull/18)
-    ./0001-Return-the-cached-value-if-it-s-not-time-to-scan-aga.patch
+  vendorSha256 = "sha256-lQKuT5dzjDHFpRSmcXpKD1RJDlEv+0kcxENkv3mT4FU=";
+
+  ldflags = [
+    "-X github.com/prometheus/common/version.Version=${version}"
   ];
 
-  vendorSha256 = "1xhrzkfm2p20k7prgdfax4408g4qpa4wbxigmcmfz7kjg2zi88ld";
+  passthru.tests = { inherit (nixosTests.prometheus-exporters) smartctl; };
 
   meta = with lib; {
     description = "Export smartctl statistics for Prometheus";
     homepage = "https://github.com/prometheus-community/smartctl_exporter";
     license = licenses.lgpl3;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ hexa ];
+    maintainers = with maintainers; [ hexa Frostman ];
   };
 }
diff --git a/pkgs/servers/monitoring/sensu-go/default.nix b/pkgs/servers/monitoring/sensu-go/default.nix
index 68a8a0cf4cf..68ecb29169f 100644
--- a/pkgs/servers/monitoring/sensu-go/default.nix
+++ b/pkgs/servers/monitoring/sensu-go/default.nix
@@ -4,14 +4,14 @@ let
   generic = { subPackages, pname, postInstall ? "", mainProgram }:
     buildGoModule rec {
       inherit pname;
-      version = "6.9.0";
+      version = "6.9.1";
       shortRev = "3a1ac58"; # for internal version info
 
       src = fetchFromGitHub {
         owner = "sensu";
         repo = "sensu-go";
         rev = "v${version}";
-        sha256 = "sha256-H6mpry6uJtMVJmsdLgka7X/IzMP1dbp+hOl3pGVWUAE=";
+        sha256 = "sha256-vw5A5Cg4envrDfLsdauSONgd6rPZSu5wPiPOoNIcS9w=";
       };
 
       inherit subPackages postInstall;
diff --git a/pkgs/servers/monitoring/telegraf/default.nix b/pkgs/servers/monitoring/telegraf/default.nix
index 464e04a2925..715e8da0b75 100644
--- a/pkgs/servers/monitoring/telegraf/default.nix
+++ b/pkgs/servers/monitoring/telegraf/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "telegraf";
-  version = "1.24.3";
+  version = "1.24.4";
 
   excludedPackages = "test";
 
@@ -12,10 +12,10 @@ buildGoModule rec {
     owner = "influxdata";
     repo = "telegraf";
     rev = "v${version}";
-    sha256 = "sha256-3KQJRapgl36+QwWHjh+nri3FcFtXhre7l3XN8Oj9t+0=";
+    sha256 = "sha256-GlbkCT85gbQehN2SgWY0WNSQ1FbpgZKBpqm6ImlWASk=";
   };
 
-  vendorSha256 = "sha256-0PQYnJKDR/CtZviy0FXvVja7fvcvY+BH8zQXiGdKqRg=";
+  vendorSha256 = "sha256-sBCUs9m04bdkeAIRCJ2Esw68JJIsyVNcoZ3W1WrNKJ4=";
   proxyVendor = true;
 
   ldflags = [
diff --git a/pkgs/servers/monitoring/uptime-kuma/default.nix b/pkgs/servers/monitoring/uptime-kuma/default.nix
index 45d9e2c19f3..515e4e2edaf 100644
--- a/pkgs/servers/monitoring/uptime-kuma/default.nix
+++ b/pkgs/servers/monitoring/uptime-kuma/default.nix
@@ -1,4 +1,4 @@
-{ pkgs, lib, stdenv, fetchFromGitHub, fetchzip, substituteAll, nixosTests, iputils }:
+{ pkgs, lib, stdenv, fetchFromGitHub, fetchzip, nixosTests, iputils, nodejs, makeWrapper }:
 let
   deps = import ./composition.nix { inherit pkgs; };
 in
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
       --replace "/sbin/ping" "${iputils}/bin/ping"
   '';
 
-  buildInputs = [ pkgs.makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     mkdir -p $out/share/
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   postFixup = ''
-    makeWrapper ${pkgs.nodejs}/bin/node $out/bin/uptime-kuma-server \
+    makeWrapper ${nodejs}/bin/node $out/bin/uptime-kuma-server \
       --add-flags $out/share/server/server.js \
       --chdir $out/share/
   '';
diff --git a/pkgs/servers/nfs-ganesha/default.nix b/pkgs/servers/nfs-ganesha/default.nix
index a434b48388a..2ac109cb0da 100644
--- a/pkgs/servers/nfs-ganesha/default.nix
+++ b/pkgs/servers/nfs-ganesha/default.nix
@@ -5,18 +5,22 @@
 
 stdenv.mkDerivation rec {
   pname = "nfs-ganesha";
-  version = "4.1";
+  version = "4.2";
 
   src = fetchFromGitHub {
     owner = "nfs-ganesha";
     repo = "nfs-ganesha";
     rev = "V${version}";
-    sha256 = "sha256-M7lQkO36I4Cwxs49XdxsUVVI2/Nz7fhU36j9fxUuMfM=";
+    sha256 = "sha256-9Hn1teHo5sHJLYQYM+nAIwq7Gckxl1TCTk/GxLME1qo=";
   };
 
   preConfigure = "cd src";
 
-  cmakeFlags = [ "-DUSE_SYSTEM_NTIRPC=ON" ];
+  cmakeFlags = [
+    "-DUSE_SYSTEM_NTIRPC=ON"
+    "-DSYSSTATEDIR=/var"
+    "-DENABLE_VFS_POSIX_ACL=ON"
+  ];
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/servers/nosql/cassandra/4.json b/pkgs/servers/nosql/cassandra/4.json
new file mode 100644
index 00000000000..fd0a4be8f49
--- /dev/null
+++ b/pkgs/servers/nosql/cassandra/4.json
@@ -0,0 +1,4 @@
+{
+  "version": "4.0.7",
+  "sha256": "03k7mvm5im4lahl8wfafk5ljxd95b6zsmskip4kcpzqi6naf6s4s"
+}
diff --git a/pkgs/servers/nosql/cassandra/4.nix b/pkgs/servers/nosql/cassandra/4.nix
new file mode 100644
index 00000000000..0a96e257903
--- /dev/null
+++ b/pkgs/servers/nosql/cassandra/4.nix
@@ -0,0 +1,8 @@
+# GENERATED BY update.sh
+{ callPackage, ... } @ args:
+callPackage ./generic.nix (
+  args
+  // builtins.fromJSON (builtins.readFile ./4.json)
+  // {
+    generation = "4";
+  })
diff --git a/pkgs/servers/nosql/ferretdb/default.nix b/pkgs/servers/nosql/ferretdb/default.nix
index f8281eefb00..56a8ba6630d 100644
--- a/pkgs/servers/nosql/ferretdb/default.nix
+++ b/pkgs/servers/nosql/ferretdb/default.nix
@@ -5,20 +5,20 @@
 
 buildGoModule rec {
   pname = "ferretdb";
-  version = "0.6.2";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "FerretDB";
     repo = "FerretDB";
     rev = "v${version}";
-    sha256 = "sha256-wjqTYrAVrUl+i+2glSUW1xS/qjvTqRXYu4s3F5Wi0Sc=";
+    sha256 = "sha256-BjGK1HvAFBs82bDyI6A7QsJcIaEjEKCw3dyiSqaS2tA=";
   };
 
   postPatch = ''
     echo ${version} > internal/util/version/gen/version.txt
   '';
 
-  vendorSha256 = "sha256-wjlGAhut9/jZ2GmKg7XmenphkgxWn0VbuvYEtORpbtw=";
+  vendorSha256 = "sha256-xmUSjkl41jwC/vaUcqZBvLo2wWp8XlXjzzemN5Ja2gg=";
 
   CGO_ENABLED = 0;
 
diff --git a/pkgs/servers/nosql/mongodb/mongodb.nix b/pkgs/servers/nosql/mongodb/mongodb.nix
index 88dcfdcb708..f0039a509c1 100644
--- a/pkgs/servers/nosql/mongodb/mongodb.nix
+++ b/pkgs/servers/nosql/mongodb/mongodb.nix
@@ -63,9 +63,9 @@ let
 
     } else rec {
       python = scons.python.withPackages (ps: with ps; [
-        pyyaml
+        setuptools
         typing
-        cheetah
+        cheetah3
       ]);
 
       scons = sconsPackages.scons_3_1_2;
diff --git a/pkgs/servers/openafs/1.8/default.nix b/pkgs/servers/openafs/1.8/default.nix
index fb6dcdeecde..d6e2f20ecdb 100644
--- a/pkgs/servers/openafs/1.8/default.nix
+++ b/pkgs/servers/openafs/1.8/default.nix
@@ -18,7 +18,7 @@
 , withDevdoc ? false
 , doxygen
 , dblatex # Extra developer documentation
-, withNcurses
+, withNcurses ? false
 , ncurses # Extra ncurses utilities. Needed for debugging and monitoring.
 , withTsm ? false
 , tsm-client # Tivoli Storage Manager Backup Client from IBM
@@ -45,7 +45,7 @@ stdenv.mkDerivation {
     bison
   ] ++ optionals withDevdoc [ doxygen dblatex ];
 
-  buildInputs = [ libkrb5 ncurses ];
+  buildInputs = [ libkrb5 ] ++ optional withNcurses ncurses;
 
   patches = [ ./bosserver.patch ./cross-build.patch ]
     ++ optional withTsm ./tsmbac.patch;
@@ -84,7 +84,7 @@ stdenv.mkDerivation {
       "--disable-fuse-client"
       "--with-docbook-stylesheets=${docbook_xsl}/share/xml/docbook-xsl"
       ${optionalString withTsm "--enable-tivoli-tsm"}
-      ${optionalString withNcurses "--disable-gtx"}
+      ${optionalString (!withNcurses) "--disable-gtx"}
       "--disable-linux-d_splice-alias-extra-iput"
     )
   '' + optionalString withTsm ''
diff --git a/pkgs/servers/photoprism/default.nix b/pkgs/servers/photoprism/default.nix
index 678f30c372d..a33d3d18300 100644
--- a/pkgs/servers/photoprism/default.nix
+++ b/pkgs/servers/photoprism/default.nix
@@ -42,7 +42,7 @@ in
 stdenv.mkDerivation {
   inherit pname version;
 
-  buildInputs = [
+  nativeBuildInputs = [
     makeWrapper
   ];
 
diff --git a/pkgs/servers/pocketbase/default.nix b/pkgs/servers/pocketbase/default.nix
index a96431cc312..4cc6369b7eb 100644
--- a/pkgs/servers/pocketbase/default.nix
+++ b/pkgs/servers/pocketbase/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "pocketbase";
-  version = "0.8.0";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "pocketbase";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-z7Vs+Z34r5g62X9DnEVkqTrr+V2bWwkfMXitNz+pVN8=";
+    sha256 = "sha256-eWYx45k18HDcXkgfKl9G4Q1h/BcCy+NDVhh5ndoW+Fk=";
   };
 
-  vendorSha256 = "sha256-Ya+D15eAJ7qgEQoM2LcN2VEmmyp4cuS6/wCOEGdrgA8=";
+  vendorSha256 = "sha256-+wPcCF5AZ1HzNH1egCiK4eUQ0UmPPJzKB45lk7SOuCI=";
 
   # This is the released subpackage from upstream repo
   subPackages = [ "examples/base" ];
diff --git a/pkgs/servers/pulseaudio/default.nix b/pkgs/servers/pulseaudio/default.nix
index 056710a588f..11c56b92541 100644
--- a/pkgs/servers/pulseaudio/default.nix
+++ b/pkgs/servers/pulseaudio/default.nix
@@ -48,9 +48,9 @@ stdenv.mkDerivation rec {
     # Install sysconfdir files inside of the nix store,
     # but use a conventional runtime sysconfdir outside the store
     ./add-option-for-installation-sysconfdir.patch
-    # https://gitlab.freedesktop.org/pulseaudio/pulseaudio/-/merge_requests/654
+    # https://gitlab.freedesktop.org/pulseaudio/pulseaudio/-/merge_requests/654 (merged)
     ./0001-Make-gio-2.0-optional-16.patch
-    # TODO (not sent upstream)
+    # https://gitlab.freedesktop.org/pulseaudio/pulseaudio/-/merge_requests/746 (merged)
     ./0002-Ignore-SCM_CREDS-on-darwin.patch
     ./0003-Ignore-HAVE_CPUID_H-on-aarch64-darwin.patch
     ./0004-Prefer-HAVE_CLOCK_GETTIME-on-darwin.patch
diff --git a/pkgs/servers/search/elasticsearch/6.x.nix b/pkgs/servers/search/elasticsearch/6.x.nix
index f14138ca089..87750f196f3 100644
--- a/pkgs/servers/search/elasticsearch/6.x.nix
+++ b/pkgs/servers/search/elasticsearch/6.x.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation (rec {
 
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [ jre_headless util-linux ]
-             ++ optional enableUnfree [ zlib libxcrypt ];
+             ++ optionals enableUnfree [ zlib libxcrypt ];
 
   installPhase = ''
     mkdir -p $out
diff --git a/pkgs/servers/search/zinc/default.nix b/pkgs/servers/search/zinc/default.nix
new file mode 100644
index 00000000000..c9a7a256d76
--- /dev/null
+++ b/pkgs/servers/search/zinc/default.nix
@@ -0,0 +1,56 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, buildNpmPackage
+}:
+let
+  version = "0.3.5";
+  src = fetchFromGitHub {
+    owner = "zinclabs";
+    repo = "zinc";
+    rev = "v${version}";
+    sha256 = "sha256-qu3foI5Rnt2sf+B+roJOwUNvOfawKmcKq7UrmviQsHA=";
+  };
+
+  webui = buildNpmPackage {
+    inherit src version;
+    pname = "zinc-ui";
+
+    sourceRoot = "source/web";
+
+    npmDepsHash = "sha256-Ao/kDryui4thurqap/d/+82z058HoF2ZJSVKQqVwfVg=";
+
+    CYPRESS_INSTALL_BINARY = 0; # cypress tries to download binaries otherwise
+
+    installPhase = ''
+      mkdir -p $out/share
+      mv dist $out/share/zinc-ui
+    '';
+  };
+in
+buildGoModule rec {
+  pname = "zinc";
+  inherit src version;
+
+  preBuild = ''
+    cp -r ${webui}/share/zinc-ui web/dist
+  '';
+
+  vendorSha256 = "sha256-akjb0cxHbITKS26c+7lVSHWO/KRoQVVKzAOra+tdAD8=";
+  subPackages = [ "cmd/zinc" ];
+
+  CGO_ENABLED = 0;
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/zinclabs/zinc/pkg/meta.Version=${version}"
+  ];
+
+  meta = with lib; {
+    description = "A lightweight alternative to elasticsearch that requires minimal resources, written in Go";
+    homepage = "https://github.com/zinclabs/zinc";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ dit7ya ];
+  };
+}
diff --git a/pkgs/servers/snappymail/default.nix b/pkgs/servers/snappymail/default.nix
index f9ac080a7fd..7da5c489ded 100644
--- a/pkgs/servers/snappymail/default.nix
+++ b/pkgs/servers/snappymail/default.nix
@@ -2,11 +2,11 @@
 , dataPath ? "/var/lib/snappymail" }:
 stdenv.mkDerivation rec {
   pname = "snappymail";
-  version = "2.22.4";
+  version = "2.22.6";
 
   src = fetchurl {
     url = "https://github.com/the-djmaze/snappymail/releases/download/v${version}/snappymail-${version}.tar.gz";
-    sha256 = "sha256-SMuposSGpmJgfAXYu3YhYJWN7zxyxtAAuRI1IBibq5c=";
+    sha256 = "sha256-B3ojd6Xd5qk6KL5JAnrp52XeW0xJ7z9VJQRPjVmPgv0=";
   };
 
   sourceRoot = "snappymail";
diff --git a/pkgs/servers/tailscale/default.nix b/pkgs/servers/tailscale/default.nix
index 3cd302c6bf7..6b2710b7ba2 100644
--- a/pkgs/servers/tailscale/default.nix
+++ b/pkgs/servers/tailscale/default.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "tailscale";
-  version = "1.32.3";
+  version = "1.34.0";
 
   src = fetchFromGitHub {
     owner = "tailscale";
     repo = "tailscale";
     rev = "v${version}";
-    sha256 = "sha256-mM9+qumB7pbP1LIN3ZJRNYHywwASKL4jmsmz5jQGRtg=";
+    sha256 = "sha256-ngcFoEDec/6I9gWpJ767ju2OvZfS4RhlSbK//xXIFxs=";
   };
-  vendorSha256 = "sha256-VW6FvbgLcokVGunTCHUXKuH5+O6T55hGIP2g5kFfBsE=";
+  vendorSha256 = "sha256-nSllDi6G4QAGyuoGduDhI0vaVuN2//eg+gXRSZ3ERiQ=";
 
   nativeBuildInputs = lib.optionals stdenv.isLinux [ makeWrapper ];
 
diff --git a/pkgs/servers/traefik/default.nix b/pkgs/servers/traefik/default.nix
index 5f064beaab9..60eb9a22a82 100644
--- a/pkgs/servers/traefik/default.nix
+++ b/pkgs/servers/traefik/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "traefik";
-  version = "2.9.5";
+  version = "2.9.6";
 
   # Archive with static assets for webui
   src = fetchzip {
     url = "https://github.com/traefik/traefik/releases/download/v${version}/traefik-v${version}.src.tar.gz";
-    sha256 = "sha256-o8SFR6xPh6oc6vr9xhSyOnkJTxFv142BovmvAURY3SY=";
+    sha256 = "sha256-T1yJT45bCjGizS6bqkzc6EF9uhJ3dhXsSc5X3di6SJ4=";
     stripRoot = false;
   };
 
-  vendorSha256 = "sha256-/+cyh0hFPc+Mu1tmlLDU/v0w6N1czqLVDBbEJT907wE=";
+  vendorSha256 = "sha256-g/UL+cUenWW94afWIGFU2fBSpo48YcUIUaX/1M5vhNk=";
 
   subPackages = [ "cmd/traefik" ];
 
diff --git a/pkgs/servers/web-apps/invoiceplane/default.nix b/pkgs/servers/web-apps/invoiceplane/default.nix
index a091a10d889..ebf40fe3cee 100644
--- a/pkgs/servers/web-apps/invoiceplane/default.nix
+++ b/pkgs/servers/web-apps/invoiceplane/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "invoiceplane";
-  version = "1.6-beta-3";
+  version = "1.6.0";
 
   src = fetchurl {
     url = "https://github.com/InvoicePlane/InvoicePlane/releases/download/v${version}/v${version}.zip";
-    sha256 = "sha256-sw5LaU3v4MIdX99WGKOaerVc9m3d8aQVuvrLn7KvcKE=";
+    sha256 = "sha256-EwhOwUoOy3LNZTDgp9kvR/0OsO2TDpWkdT0fd7u0Ns8=";
   };
 
   nativeBuildInputs = [ unzip ];
diff --git a/pkgs/servers/web-apps/peering-manager/default.nix b/pkgs/servers/web-apps/peering-manager/default.nix
new file mode 100644
index 00000000000..dd60980e329
--- /dev/null
+++ b/pkgs/servers/web-apps/peering-manager/default.nix
@@ -0,0 +1,100 @@
+{ python3
+, fetchFromGitHub
+, fetchpatch
+, nixosTests
+
+, plugins ? ps: []
+}:
+
+let
+  py = python3.override {
+    packageOverrides = final: prev: {
+      django = final.django_4;
+      drf-nested-routers = prev.drf-nested-routers.overridePythonAttrs (oldAttrs: {
+        patches = [
+          # all for django 4 compat
+          (fetchpatch {
+            url = "https://github.com/alanjds/drf-nested-routers/commit/59764cc356f7f593422b26845a9dfac0ad196120.diff";
+            hash = "sha256-mq3vLHzQlGl2EReJ5mVVQMMcYgGIVt/T+qi1STtQ0aI=";
+          })
+          (fetchpatch {
+            url = "https://github.com/alanjds/drf-nested-routers/commit/723a5729dd2ffcb66fe315f229789ca454986fa4.diff";
+            hash = "sha256-UCbBjwlidqsJ9vEEWlGzfqqMOr0xuB2TAaUxHsLzFfU=";
+          })
+          (fetchpatch {
+            url = "https://github.com/alanjds/drf-nested-routers/commit/38e49eb73759bc7dcaaa9166169590f5315e1278.diff";
+            hash = "sha256-IW4BLhHHhXDUZqHaXg46qWoQ89pMXv0ZxKjOCTnDcI0=";
+          })
+        ];
+      });
+    };
+  };
+
+in py.pkgs.buildPythonApplication rec {
+  pname = "peering-manager";
+  version = "1.7.3";
+
+  src = fetchFromGitHub {
+    owner = pname;
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-vrRMdqEpsps4ZKgunMhznJr/TQ9+WVMNYFu76ZU7iMI=";
+  };
+
+  patches = [
+    ./redis-unix-sock.patch
+  ];
+
+  format = "other";
+
+  propagatedBuildInputs = with py.pkgs; [
+    django
+    djangorestframework
+    django-cacheops
+    django-debug-toolbar
+    django-filter
+    django-postgresql-netfields
+    django-prometheus
+    django-rq
+    django-tables2
+    django-taggit
+    drf-spectacular
+    jinja2
+    markdown
+    napalm
+    packaging
+    psycopg2
+    pynetbox
+    pyyaml
+    requests
+    tzdata
+  ] ++ plugins py.pkgs;
+
+  buildPhase = ''
+    runHook preBuild
+    cp peering_manager/configuration{.example,}.py
+    python3 manage.py collectstatic --no-input
+    rm -f peering_manager/configuration.py
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/opt/peering-manager
+    cp -r . $out/opt/peering-manager
+    chmod +x $out/opt/peering-manager/manage.py
+    makeWrapper $out/opt/peering-manager/manage.py $out/bin/peering-manager \
+      --prefix PYTHONPATH : "$PYTHONPATH"
+    runHook postInstall
+  '';
+
+  passthru = {
+    # PYTHONPATH of all dependencies used by the package
+    python = py;
+    pythonPath = py.pkgs.makePythonPath propagatedBuildInputs;
+
+    tests = {
+      inherit (nixosTests) peering-manager;
+    };
+  };
+}
diff --git a/pkgs/servers/web-apps/peering-manager/redis-unix-sock.patch b/pkgs/servers/web-apps/peering-manager/redis-unix-sock.patch
new file mode 100644
index 00000000000..5db0d0dd012
--- /dev/null
+++ b/pkgs/servers/web-apps/peering-manager/redis-unix-sock.patch
@@ -0,0 +1,47 @@
+commit 1e64a7f6ca456249305f6a3c90f9acf84af194db
+Author: Yureka <yuka@yuka.dev>
+Date:   Tue Nov 29 14:03:08 2022 +0100
+
+    support unix sockets for redis connections
+
+diff --git a/peering_manager/settings.py b/peering_manager/settings.py
+index 739d6ff..b5edf4d 100644
+--- a/peering_manager/settings.py
++++ b/peering_manager/settings.py
+@@ -270,6 +270,7 @@ TASKS_REDIS_PASSWORD = TASKS_REDIS.get("PASSWORD", "")
+ TASKS_REDIS_DATABASE = TASKS_REDIS.get("DATABASE", 0)
+ TASKS_REDIS_DEFAULT_TIMEOUT = TASKS_REDIS.get("DEFAULT_TIMEOUT", 300)
+ TASKS_REDIS_SSL = TASKS_REDIS.get("SSL", False)
++TASKS_REDIS_UNIX_SOCKET_PATH = TASKS_REDIS.get("UNIX_SOCKET_PATH", "")
+ if "DEFAULT_TIMEOUT" in TASKS_REDIS:
+     warnings.warn(
+         "DEFAULT_TIMEOUT is no longer supported under REDIS configuration. Set RQ_DEFAULT_TIMEOUT instead."
+@@ -294,6 +295,7 @@ CACHING_REDIS_PASSWORD = CACHING_REDIS.get("PASSWORD", "")
+ CACHING_REDIS_DATABASE = CACHING_REDIS.get("DATABASE", 0)
+ CACHING_REDIS_DEFAULT_TIMEOUT = CACHING_REDIS.get("DEFAULT_TIMEOUT", 300)
+ CACHING_REDIS_SSL = CACHING_REDIS.get("SSL", False)
++CACHING_REDIS_UNIX_SOCKET_PATH = CACHING_REDIS.get("UNIX_SOCKET_PATH", "")
+ 
+ if CACHING_REDIS_USING_SENTINEL:
+     CACHEOPS_SENTINEL = {
+@@ -301,6 +303,8 @@ if CACHING_REDIS_USING_SENTINEL:
+         "service_name": CACHING_REDIS_SENTINEL_SERVICE,
+         "db": CACHING_REDIS_DATABASE,
+     }
++elif CACHING_REDIS_UNIX_SOCKET_PATH != "":
++    CACHEOPS_REDIS = f"unix://{CACHING_REDIS_UNIX_SOCKET_PATH}?db={CACHING_REDIS_DATABASE}"
+ else:
+     REDIS_CACHE_CON_STRING = "rediss://" if CACHING_REDIS_SSL else "redis://"
+     if CACHING_REDIS_PASSWORD:
+@@ -334,6 +338,11 @@ if TASKS_REDIS_USING_SENTINEL:
+         "SOCKET_TIMEOUT": None,
+         "CONNECTION_KWARGS": {"socket_connect_timeout": TASKS_REDIS_DEFAULT_TIMEOUT},
+     }
++elif TASKS_REDIS_UNIX_SOCKET_PATH != "":
++    RQ_PARAMS = {
++        "UNIX_SOCKET_PATH": TASKS_REDIS_UNIX_SOCKET_PATH,
++        "DB": TASKS_REDIS_DATABASE,
++    }
+ else:
+     RQ_PARAMS = {
+         "HOST": TASKS_REDIS_HOST,
diff --git a/pkgs/shells/bash/blesh/default.nix b/pkgs/shells/bash/blesh/default.nix
index f342f408540..26ff975dae3 100644
--- a/pkgs/shells/bash/blesh/default.nix
+++ b/pkgs/shells/bash/blesh/default.nix
@@ -1,51 +1,54 @@
 { lib
 , stdenvNoCC
-, fetchFromGitHub
-, git
+, fetchzip
+, runtimeShell
 , bashInteractive
 , glibcLocales
-, runtimeShell
 }:
 
 stdenvNoCC.mkDerivation rec {
   name = "blesh";
-  version = "unstable-2022-07-24";
-
-  src = fetchFromGitHub {
-    owner = "akinomyoga";
-    repo = "ble.sh";
-    rev = "0b95d5d900b79a63e7f0834da5aa7276b8332a44";
-    hash = "sha256-s/RQKcAFcCUB3Xd/4uOsIgigOE0lCCeVC9K3dfnP/EQ=";
-    fetchSubmodules = true;
-    leaveDotGit = true;
+  version = "unstable-2022-07-29";
+
+  src = fetchzip {
+    url = "https://github.com/akinomyoga/ble.sh/releases/download/nightly/ble-nightly-20220729+a22e145.tar.xz";
+    sha256 = "088jv02y40pjcfzgrbx8n6aksznfh6zl0j5siwfw3pmwn3i16njw";
   };
 
-  nativeBuildInputs = [ git ];
+  dontBuild = true;
 
   doCheck = true;
   checkInputs = [ bashInteractive glibcLocales ];
   preCheck = "export LC_ALL=en_US.UTF-8";
 
-  installFlags = [ "INSDIR=$(out)/share" ];
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out/share/blesh/lib"
+
+    cat <<EOF >"$out/share/blesh/lib/_package.sh"
+    _ble_base_package_type=nix
+
+    function ble/base/package:nix/update {
+      echo "Ble.sh is installed by Nix. You can update it there." >&2
+      return 1
+    }
+    EOF
+
+    cp -rv $src/* $out/share/blesh
+
+    runHook postInstall
+  '';
+
   postInstall = ''
     mkdir -p "$out/bin"
     cat <<EOF >"$out/bin/blesh-share"
     #!${runtimeShell}
     # Run this script to find the ble.sh shared folder
     # where all the shell scripts are living.
-    echo "$out/share/ble.sh"
+    echo "$out/share/blesh"
     EOF
     chmod +x "$out/bin/blesh-share"
-
-    mkdir -p "$out/share/lib"
-    cat <<EOF >"$out/share/lib/_package.sh"
-    _ble_base_package_type=nix
-
-    function ble/base/package:nix/update {
-      echo "Ble.sh is installed by Nix. You can update it there." >/dev/stderr
-      return 1
-    }
-    EOF
   '';
 
   meta = with lib; {
diff --git a/pkgs/shells/nushell/default.nix b/pkgs/shells/nushell/default.nix
index 432cbfe9ac9..8c33839a83c 100644
--- a/pkgs/shells/nushell/default.nix
+++ b/pkgs/shells/nushell/default.nix
@@ -24,16 +24,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nushell";
-  version = "0.72.0";
+  version = "0.72.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "sha256-CWFG3ltSWwUPz+cVXUL0RaDxmm1A3Ie0BUBFFZfR9Mc=";
+    sha256 = "sha256-OVJr+usN+47yBHFAy94rIVlU2F+Klo6xdrV2MwUoKUE=";
   };
 
-  cargoSha256 = "sha256-VgE14440BumaL/wZz1ONjIK1nsJWaPlvy7M0R+ojb9A=";
+  cargoSha256 = "sha256-v6mPr+gOT64rKYuog+hS7/AqUZDailoOBXX3Sfeo+sk=";
 
   # enable pkg-config feature of zstd
   cargoPatches = [ ./zstd-pkg-config.patch ];
diff --git a/pkgs/shells/zsh/default.nix b/pkgs/shells/zsh/default.nix
index 782c2fb2bea..5a003b889a0 100644
--- a/pkgs/shells/zsh/default.nix
+++ b/pkgs/shells/zsh/default.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation {
     "--enable-pcre"
     "--enable-zprofile=${placeholder "out"}/etc/zprofile"
     "--disable-site-fndir"
-  ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform && !stdenv.hostPlatform.isStatic) [
+  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform && !stdenv.hostPlatform.isStatic) [
     # Also see: https://github.com/buildroot/buildroot/commit/2f32e668aa880c2d4a2cce6c789b7ca7ed6221ba
     "zsh_cv_shared_environ=yes"
     "zsh_cv_shared_tgetent=yes"
diff --git a/pkgs/test/cue/default.nix b/pkgs/test/cue/default.nix
new file mode 100644
index 00000000000..2cc8bf34bb0
--- /dev/null
+++ b/pkgs/test/cue/default.nix
@@ -0,0 +1,24 @@
+{ writeCueValidator, runCommand, writeText, ... }:
+
+let
+  validator = writeCueValidator
+    (writeText "schema.cue" ''
+      #Def1: {
+        field1: string
+      }
+    '')
+    { document = "#Def1"; };
+in runCommand "cue-validation" {} ''
+  cat > valid.json <<EOF
+  { "field1": "abc" }
+  EOF
+  cat > invalid.json <<EOF
+  { "field2": "abc" }
+  EOF
+  ${validator} valid.json
+  if ${validator} invalid.json; then
+    echo "this example should fail"
+    exit 1
+  fi
+  touch $out
+''
diff --git a/pkgs/test/default.nix b/pkgs/test/default.nix
index 3a39d247c8f..e72afbb3998 100644
--- a/pkgs/test/default.nix
+++ b/pkgs/test/default.nix
@@ -77,6 +77,8 @@ with pkgs;
 
   dhall = callPackage ./dhall { };
 
+  cue-validation = callPackage ./cue {};
+
   coq = callPackage ./coq {};
 
   makeWrapper = callPackage ./make-wrapper { };
diff --git a/pkgs/tools/X11/bumblebee/default.nix b/pkgs/tools/X11/bumblebee/default.nix
index 914972d91aa..0415489bd76 100644
--- a/pkgs/tools/X11/bumblebee/default.nix
+++ b/pkgs/tools/X11/bumblebee/default.nix
@@ -52,6 +52,10 @@ let
     url = "https://github.com/Bumblebee-Project/Bumblebee/commit/deceb14cdf2c90ff64ebd1010a674305464587da.patch";
     sha256 = "00c05i5lxz7vdbv445ncxac490vbl5g9w3vy3gd71qw1f0si8vwh";
   };
+  gcc10Patch = fetchpatch {
+    url = "https://github.com/Bumblebee-Project/Bumblebee/commit/f94a118a88cd76e2dbea33d735bd53cf54b486a1.patch";
+    hash = "sha256-3b5tLoMrGYSdg9Hz5bh0c44VIrbSZrY56JpWEyU/Pik=";
+  };
 
 in stdenv.mkDerivation rec {
   pname = "bumblebee";
@@ -67,6 +71,7 @@ in stdenv.mkDerivation rec {
 
     modprobePatch
     libkmodPatch
+    gcc10Patch
   ];
 
   # By default we don't want to use a display device
@@ -137,8 +142,5 @@ in stdenv.mkDerivation rec {
     license = licenses.gpl3;
     maintainers = with maintainers; [ abbradar ];
     platforms = platforms.linux;
-    # linking fails with multiple error of type:
-    # multiple definition of `bb_pm_method_string'; src/module.o:(.bss+0x0): first defined here
-    broken = true; # Added 03-08-2022
   };
 }
diff --git a/pkgs/tools/admin/awscli2/default.nix b/pkgs/tools/admin/awscli2/default.nix
index 2b82570431e..4431283f40d 100644
--- a/pkgs/tools/admin/awscli2/default.nix
+++ b/pkgs/tools/admin/awscli2/default.nix
@@ -78,7 +78,8 @@ with py.pkgs; buildPythonApplication rec {
       --replace "colorama>=0.2.5,<0.4.4" "colorama" \
       --replace "distro>=1.5.0,<1.6.0" "distro" \
       --replace "docutils>=0.10,<0.16" "docutils" \
-      --replace "wcwidth<0.2.0" "wcwidth"
+      --replace "wcwidth<0.2.0" "wcwidth" \
+      --replace "cryptography>=3.3.2,<=38.0.1" "cryptography>=3.3.2,<=38.0.3"
   '';
 
   postInstall = ''
diff --git a/pkgs/tools/admin/scaleway-cli/default.nix b/pkgs/tools/admin/scaleway-cli/default.nix
index 6e38400677a..6169f22eb12 100644
--- a/pkgs/tools/admin/scaleway-cli/default.nix
+++ b/pkgs/tools/admin/scaleway-cli/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "scaleway-cli";
-  version = "2.6.2";
+  version = "2.7.0";
 
   src = fetchFromGitHub {
     owner = "scaleway";
     repo = "scaleway-cli";
     rev = "v${version}";
-    sha256 = "sha256-WEEmU0YslQcjleM6jFLXNxogkXlRAUjkj0q+saugPYA=";
+    sha256 = "sha256-DWr5I6xMESRWhQCgDY/xJsSw0XhlNSJiVsHNvL+xmH4=";
   };
 
-  vendorSha256 = "sha256-1YXw6b8xUa2yEfMURetImg2TnFTDUsiQi441pX/O57M=";
+  vendorSha256 = "sha256-1Ke01pc+RyqxCuD1SGypTSKCFnnHazz6IaybL0TylhA=";
 
   ldflags = [
     "-w"
diff --git a/pkgs/tools/admin/syft/default.nix b/pkgs/tools/admin/syft/default.nix
index 855061ef3e2..d882890bba7 100644
--- a/pkgs/tools/admin/syft/default.nix
+++ b/pkgs/tools/admin/syft/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "syft";
-  version = "0.62.2";
+  version = "0.62.3";
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-n3ZkSsyaNreIohCrGYQUnRAnher1VqbV8vQKA20bnPs=";
+    sha256 = "sha256-rDj/yerLY7EN/jeAh/xaUX04LqGqijajSZLFhjiyuSg=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -22,7 +22,7 @@ buildGoModule rec {
   };
   # hash mismatch with darwin
   proxyVendor = true;
-  vendorSha256 = "sha256-FJtyCUzp/osfXtNRWH/gK7PGoe4gd23YxBxbF4o1qos=";
+  vendorSha256 = "sha256-MUNXMdzLVgbFtVo1CRCnZfpZl8Ze2R98mx7Y9QreLRw=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/backup/dar/default.nix b/pkgs/tools/backup/dar/default.nix
index c697bb4f20f..f17a805531c 100644
--- a/pkgs/tools/backup/dar/default.nix
+++ b/pkgs/tools/backup/dar/default.nix
@@ -28,12 +28,12 @@ let
 in
 
 stdenv.mkDerivation rec {
-  version = "2.7.7";
+  version = "2.7.8";
   pname = "dar";
 
   src = fetchzip {
     url = "mirror://sourceforge/dar/${pname}-${version}.tar.gz";
-    sha256 = "sha256-643hU28Vl0QaqdKoKdQ1Z/j5drE59/jw5xkVO/g+MSw=";
+    sha256 = "sha256-W/6kSkIaeHumE2yGGbU4Z2lk1d2toQ1AM012TUI1EZw=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/tools/backup/ugarit-manifest-maker/default.nix b/pkgs/tools/backup/ugarit-manifest-maker/default.nix
index 980aaa05ec3..8c37a7b72ac 100644
--- a/pkgs/tools/backup/ugarit-manifest-maker/default.nix
+++ b/pkgs/tools/backup/ugarit-manifest-maker/default.nix
@@ -27,6 +27,5 @@ in with pkgs; eggDerivation rec {
     license = licenses.bsd3;
     maintainers = [ maintainers.ebzzry ];
     platforms = platforms.unix;
-    broken = stdenv.isDarwin && stdenv.isAarch64;
   };
 }
diff --git a/pkgs/tools/backup/ugarit/default.nix b/pkgs/tools/backup/ugarit/default.nix
index 9000ff54f67..39c11cc0c91 100644
--- a/pkgs/tools/backup/ugarit/default.nix
+++ b/pkgs/tools/backup/ugarit/default.nix
@@ -37,6 +37,5 @@ in with pkgs; eggDerivation rec {
     license = licenses.bsd3;
     maintainers = [ maintainers.ebzzry ];
     platforms = platforms.unix;
-    broken = stdenv.isDarwin && stdenv.isAarch64;
   };
 }
diff --git a/pkgs/tools/cd-dvd/ventoy-bin/default.nix b/pkgs/tools/cd-dvd/ventoy-bin/default.nix
index 8f1571d1aee..a9f853cc7fe 100644
--- a/pkgs/tools/cd-dvd/ventoy-bin/default.nix
+++ b/pkgs/tools/cd-dvd/ventoy-bin/default.nix
@@ -51,13 +51,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "ventoy-bin";
-  version = "1.0.82";
+  version = "1.0.84";
 
   src = let
     inherit (finalAttrs) version;
   in fetchurl {
     url = "https://github.com/ventoy/Ventoy/releases/download/v${version}/ventoy-${version}-linux.tar.gz";
-    hash = "sha256-NN36gg2rUZgAxyMoYhMc7IbWgQLrPvuWERDF7JVsFfw=";
+    hash = "sha256-ygIAw270Px5nRrSrsD3yLBRFBKGwzdxXzQ6udS9g2ZI=";
   };
 
   patches = [
@@ -120,11 +120,11 @@ stdenv.mkDerivation (finalAttrs: {
   installPhase = ''
     runHook preInstall
 
-    # Setup variables.
+    # Setup variables
     local VENTOY_PATH="$out"/share/ventoy
     local ARCH='${arch}'
 
-    # Prepare.
+    # Prepare
     cd tool/"$ARCH"
     rm ash* hexdump* mkexfatfs* mount.exfat-fuse* xzcat*
     for archive in *.xz; do
@@ -144,11 +144,11 @@ stdenv.mkDerivation (finalAttrs: {
     rm README
     rm tool/"$ARCH"/Ventoy2Disk.gtk2 || true  # For aarch64 and mips64el.
 
-    # Copy from "$src" to "$out".
+    # Copy from "$src" to "$out"
     mkdir -p "$out"/bin "$VENTOY_PATH"
     cp -r . "$VENTOY_PATH"
 
-    # Fill bin dir.
+    # Fill bin dir
     for f in Ventoy2Disk.sh_ventoy VentoyWeb.sh_ventoy-web \
              CreatePersistentImg.sh_ventoy-persistent \
              ExtendPersistentImg.sh_ventoy-extend-persistent \
@@ -184,9 +184,9 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   meta = with lib; {
+    homepage = "https://www.ventoy.net";
     description = "A New Bootable USB Solution";
     longDescription = ''
-    homepage = "https://www.ventoy.net";
       Ventoy is an open source tool to create bootable USB drive for
       ISO/WIM/IMG/VHD(x)/EFI files.  With ventoy, you don't need to format the
       disk over and over, you just need to copy the ISO/WIM/IMG/VHD(x)/EFI files
diff --git a/pkgs/tools/filesystems/btrfs-progs/default.nix b/pkgs/tools/filesystems/btrfs-progs/default.nix
index ee1bea9c29e..e01ee2a8cf4 100644
--- a/pkgs/tools/filesystems/btrfs-progs/default.nix
+++ b/pkgs/tools/filesystems/btrfs-progs/default.nix
@@ -1,11 +1,10 @@
 { lib, stdenv, fetchurl
-, pkg-config, python3, sphinx
+, pkg-config, sphinx
 , zstd
 , acl, attr, e2fsprogs, libuuid, lzo, udev, zlib
 , runCommand, btrfs-progs
 , gitUpdater
 , udevSupport ? true
-, enablePython ? true
 }:
 
 stdenv.mkDerivation rec {
@@ -19,13 +18,11 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     pkg-config
-  ] ++ lib.optionals enablePython [
-    python3 python3.pkgs.setuptools
   ] ++ [
     sphinx
   ];
 
-  buildInputs = [ acl attr e2fsprogs libuuid lzo python3 udev zlib zstd ];
+  buildInputs = [ acl attr e2fsprogs libuuid lzo udev zlib zstd ];
 
   # gcc bug with -O1 on ARM with gcc 4.8
   # This should be fine on all platforms so apply universally
@@ -35,18 +32,17 @@ stdenv.mkDerivation rec {
     install -v -m 444 -D btrfs-completion $out/share/bash-completion/completions/btrfs
   '';
 
-  configureFlags = lib.optionals stdenv.hostPlatform.isMusl [
-    "--disable-backtrace"
-  ] ++ lib.optionals (!enablePython) [
+  configureFlags = [
+    # Built separately, see python3Packages.btrfsutil
     "--disable-python"
+  ] ++ lib.optionals stdenv.hostPlatform.isMusl [
+    "--disable-backtrace"
   ] ++ lib.optionals (!udevSupport) [
     "--disable-libudev"
   ];
 
   makeFlags = [ "udevruledir=$(out)/lib/udev/rules.d" ];
 
-  installFlags = lib.optionals enablePython [ "install_python" ];
-
   enableParallelBuilding = true;
 
   passthru.tests = {
diff --git a/pkgs/tools/filesystems/dislocker/default.nix b/pkgs/tools/filesystems/dislocker/default.nix
index 10559985f86..396f8142ba9 100644
--- a/pkgs/tools/filesystems/dislocker/default.nix
+++ b/pkgs/tools/filesystems/dislocker/default.nix
@@ -3,7 +3,7 @@
 , fetchpatch
 , cmake
 , pkg-config
-, mbedtls
+, mbedtls_2
 , fuse
 }:
 
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [ cmake pkg-config ];
-  buildInputs = [ fuse mbedtls ];
+  buildInputs = [ fuse mbedtls_2 ];
 
   meta = with lib; {
     description = "Read BitLocker encrypted partitions in Linux";
diff --git a/pkgs/tools/filesystems/stratisd/default.nix b/pkgs/tools/filesystems/stratisd/default.nix
index 0594d1c3065..b4405f81fb6 100644
--- a/pkgs/tools/filesystems/stratisd/default.nix
+++ b/pkgs/tools/filesystems/stratisd/default.nix
@@ -24,18 +24,18 @@
 
 stdenv.mkDerivation rec {
   pname = "stratisd";
-  version = "3.4.1";
+  version = "3.4.2";
 
   src = fetchFromGitHub {
     owner = "stratis-storage";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-NM6+1Etf7pOOSKNuxGIUlAbtZwixof7wNgkPoMwPn7w=";
+    hash = "sha256-Ui0L03KLePqLvxWaJm+qGQ8q+S8Sz0jwtLhIORNWeAk=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
-    hash = "sha256-anxDfls5MTfvklIDst+Ocduzc8ds5pD3WDaDUtF6R+g=";
+    hash = "sha256-o4MKnJycyzlFfE1YyByyjn/XENheLw4tdVXtgzVxDJM=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/graphics/oxipng/default.nix b/pkgs/tools/graphics/oxipng/default.nix
index 27268bead2a..57c7a35e0b9 100644
--- a/pkgs/tools/graphics/oxipng/default.nix
+++ b/pkgs/tools/graphics/oxipng/default.nix
@@ -1,15 +1,15 @@
 { lib, stdenv, fetchCrate, rustPlatform }:
 
 rustPlatform.buildRustPackage rec {
-  version = "6.0.1";
+  version = "7.0.0";
   pname = "oxipng";
 
   src = fetchCrate {
     inherit version pname;
-    sha256 = "sha256-YH4sIEOTPBbzsEMvHyphOsf12ZZRKsRPMlZ4emMMTrw=";
+    hash = "sha256-egAt2XypPFxsOuo8RsIXTmFdmBUe+eZh3p3vlnnx8wo=";
   };
 
-  cargoSha256 = "sha256-c7uEb64epjzU3pmHRr69FoxFGCN+1WVMLm8LsBwQ50o=";
+  cargoHash = "sha256-GbJU31UBdRai2JLEdx9sPh6rJWnU4RlDL8DooI9MCUg=";
 
   doCheck = !stdenv.isAarch64 && !stdenv.isDarwin;
 
diff --git a/pkgs/tools/graphics/zbar/default.nix b/pkgs/tools/graphics/zbar/default.nix
index 4e850e4fe6c..9bf4a281e06 100644
--- a/pkgs/tools/graphics/zbar/default.nix
+++ b/pkgs/tools/graphics/zbar/default.nix
@@ -22,6 +22,8 @@
   # see https://github.com/mchehab/zbar/issues/104
 , enableDbus ? false
 , libintl
+, libiconv
+, Foundation
 }:
 
 stdenv.mkDerivation rec {
@@ -50,6 +52,9 @@ stdenv.mkDerivation rec {
   buildInputs = [
     imagemagickBig
     libintl
+  ] ++ lib.optionals stdenv.isDarwin [
+    libiconv
+    Foundation
   ] ++ lib.optionals enableDbus [
     dbus
   ] ++ lib.optionals withXorg [
diff --git a/pkgs/tools/misc/fd/default.nix b/pkgs/tools/misc/fd/default.nix
index 6dd0e7a6e7c..2795210101c 100644
--- a/pkgs/tools/misc/fd/default.nix
+++ b/pkgs/tools/misc/fd/default.nix
@@ -7,7 +7,10 @@ rustPlatform.buildRustPackage rec {
   src = fetchFromGitHub {
     owner = "sharkdp";
     repo = "fd";
-    rev = "v${version}";
+    # On the next release, go back to `rev = "v${version}";`
+    # The 8.5.3 release appears to have been mysteriously re-tagged:
+    # https://github.com/sharkdp/fd/issues/1184
+    rev = "f6e74407e80a5563a9e4d0530371aed281e05838";
     sha256 = "sha256-7QQHLw+isXtr1FDQr4aiUhvOjJUPbaxFGDwukiWBG9g=";
   };
 
diff --git a/pkgs/tools/misc/flexoptix-app/default.nix b/pkgs/tools/misc/flexoptix-app/default.nix
index b86a6a992e1..b7318c119da 100644
--- a/pkgs/tools/misc/flexoptix-app/default.nix
+++ b/pkgs/tools/misc/flexoptix-app/default.nix
@@ -1,11 +1,11 @@
 { lib, appimageTools, fetchurl, nodePackages }: let
   pname = "flexoptix-app";
-  version = "5.13.0";
+  version = "5.13.1";
 
   src = fetchurl {
     name = "${pname}-${version}.AppImage";
     url = "https://flexbox.reconfigure.me/download/electron/linux/x64/FLEXOPTIX%20App.${version}.AppImage";
-    hash = "sha256-PUGxrGHjebCxtN7Q0N/crqOHTeunWqy3wmWTGqCFYTw=";
+    hash = "sha256-+rHktjZd6P4JGYRhEXdZYVI64XMYc7cBGojAQNd8Mq8=";
   };
 
   udevRules = fetchurl {
diff --git a/pkgs/tools/misc/hexyl/default.nix b/pkgs/tools/misc/hexyl/default.nix
index 07c3d54d310..c1832acb11c 100644
--- a/pkgs/tools/misc/hexyl/default.nix
+++ b/pkgs/tools/misc/hexyl/default.nix
@@ -1,20 +1,19 @@
-{ lib, fetchFromGitHub, rustPlatform }:
+{ lib, rustPlatform, fetchFromGitHub }:
 
 rustPlatform.buildRustPackage rec {
   pname = "hexyl";
-  version = "0.11.0";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "sharkdp";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Y/zEJx+tUYCA/Clvwvnsy7L3whIXT7e5bgluhrOOPjM=";
+    hash = "sha256-vh3U4JhjlqA8i6vlOF4dhhinhD/rMWLYRx5wx5bdrGw=";
   };
 
-  cargoHash = "sha256-NpEwuVz0tFkbUZQ4W+ojeD3omEXZ7YRqDmy/zLe5Z1o=";
+  cargoHash = "sha256-lsRwzD+4p9ijTjMLvoFxFEkvUhioUab5oVe+EZJCEwc=";
 
   meta = with lib; {
-    changelog = "https://github.com/sharkdp/hexyl/releases/tag/v${version}";
     description = "A command-line hex viewer";
     longDescription = ''
       `hexyl` is a simple hex viewer for the terminal. It uses a colored
@@ -23,7 +22,8 @@ rustPlatform.buildRustPackage rec {
       characters and non-ASCII).
     '';
     homepage = "https://github.com/sharkdp/hexyl";
+    changelog = "https://github.com/sharkdp/hexyl/blob/v${version}/CHANGELOG.md";
     license = with licenses; [ asl20 /* or */ mit ];
-    maintainers = with maintainers; [ dywedir SuperSandro2000 ];
+    maintainers = with maintainers; [ dywedir figsoda SuperSandro2000 ];
   };
 }
diff --git a/pkgs/tools/misc/lemmy-help/default.nix b/pkgs/tools/misc/lemmy-help/default.nix
index 1bc07257a2f..1d5415a79d1 100644
--- a/pkgs/tools/misc/lemmy-help/default.nix
+++ b/pkgs/tools/misc/lemmy-help/default.nix
@@ -2,18 +2,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "lemmy-help";
-  version = "0.9.0";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "numToStr";
     repo = "lemmy-help";
     rev = "v${version}";
-    sha256 = "sha256-VY8sGxS8wwrezTe4ht9xdr4iE2n9fNSNhfCeGDJL5Lo=";
+    sha256 = "sha256-gsYVrqPcabLCMYN3Gmr6CXTCKKFAy2rDCxmcRwR1Iic=";
   };
 
   buildFeatures = [ "cli" ];
 
-  cargoSha256 = "sha256-yj14kg41EqOco0gx79n8xhf8cyotZ1Mxj2AbNV9TImU=";
+  cargoSha256 = "sha256-iyMEzxCTxJ/CP3UEnLc4SN5zhIjCLGUl4OOk0u0bCJc=";
 
   meta = with lib; {
     description = "A CLI for generating vim help docs from emmylua comments";
@@ -21,6 +21,8 @@ rustPlatform.buildRustPackage rec {
       `lemmy-help` is an emmylua parser as well as a CLI which takes that parsed tree and converts it into vim help docs.
     '';
     homepage = "https://github.com/numToStr/lemmy-help";
+    changelog = "https://github.com/numToStr/lemmy-help/releases/tag/v${version}";
     license = with licenses; [ mit ];
+    maintainers = with maintainers; [ figsoda ];
   };
 }
diff --git a/pkgs/tools/misc/mcfly/default.nix b/pkgs/tools/misc/mcfly/default.nix
index bdefd4a1b2d..79c9238b9e2 100644
--- a/pkgs/tools/misc/mcfly/default.nix
+++ b/pkgs/tools/misc/mcfly/default.nix
@@ -21,7 +21,7 @@ rustPlatform.buildRustPackage rec {
 
   meta = with lib; {
     homepage = "https://github.com/cantino/mcfly";
-    description = "An upgraded ctrl-r for Bash whose history results make sense for what you're working on right now";
+    description = "An upgraded ctrl-r where history results make sense for what you're working on right now";
     changelog = "https://github.com/cantino/mcfly/raw/v${version}/CHANGELOG.txt";
     license = licenses.mit;
     maintainers = [ maintainers.melkor333 ];
diff --git a/pkgs/tools/misc/opentimestamps-client/default.nix b/pkgs/tools/misc/opentimestamps-client/default.nix
index 6c17cf62a64..93c10530697 100644
--- a/pkgs/tools/misc/opentimestamps-client/default.nix
+++ b/pkgs/tools/misc/opentimestamps-client/default.nix
@@ -1,27 +1,40 @@
-{ lib, buildPythonApplication, fetchFromGitHub, isPy3k
-, opentimestamps, appdirs, GitPython, pysocks, fetchpatch, git
+{ lib
+, fetchFromGitHub
+, python3
 }:
 
-buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "opentimestamps-client";
   version = "0.7.1";
-  disabled = (!isPy3k);
+  format = "setuptools";
 
-  # We can't use the pypi source because it doesn't include README.md which is
-  # needed in setup.py
   src = fetchFromGitHub {
     owner = "opentimestamps";
     repo = "opentimestamps-client";
     rev = "refs/tags/opentimestamps-client-v${version}";
-    sha256 = "sha256-0dWaXetRlF1MveBdJ0sAdqJ5HCdn08gkbX+nen/ygsQ=";
+    hash = "sha256-0dWaXetRlF1MveBdJ0sAdqJ5HCdn08gkbX+nen/ygsQ=";
   };
 
-  propagatedBuildInputs = [ opentimestamps appdirs GitPython pysocks ];
+  propagatedBuildInputs = with python3.pkgs; [
+    appdirs
+    gitpython
+    opentimestamps
+    pysocks
+  ];
+
+  checkInputs = with python3.pkgs; [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "otsclient"
+  ];
 
   meta = with lib; {
     description = "Command-line tool to create and verify OpenTimestamps proofs";
     homepage = "https://github.com/opentimestamps/opentimestamps-client";
-    license = licenses.lgpl3;
+    changelog = "https://github.com/opentimestamps/opentimestamps-client/releases/tag/opentimestamps-client-v${version}";
+    license = licenses.lgpl3Only;
     maintainers = with maintainers; [ erikarvstedt ];
   };
 }
diff --git a/pkgs/tools/misc/opentsdb/default.nix b/pkgs/tools/misc/opentsdb/default.nix
index 18ba5f4b5fc..0429e854338 100644
--- a/pkgs/tools/misc/opentsdb/default.nix
+++ b/pkgs/tools/misc/opentsdb/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, autoconf, automake, curl, fetchurl, fetchpatch, jdk8, makeWrapper, nettools
-, python2, git
+, python3, git
 }:
 
 let jdk = jdk8; jre = jdk8.jre; in
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [ makeWrapper autoconf automake ];
-  buildInputs = [ curl jdk nettools python2 git ];
+  buildInputs = [ curl jdk nettools python3 git ];
 
   preConfigure = ''
     patchShebangs ./build-aux/
diff --git a/pkgs/tools/misc/page/default.nix b/pkgs/tools/misc/page/default.nix
index c096d96d17a..61edaef5f2b 100644
--- a/pkgs/tools/misc/page/default.nix
+++ b/pkgs/tools/misc/page/default.nix
@@ -2,13 +2,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "page";
-  version = "4.1.0";
+  version = "4.3.0";
 
   src = fetchFromGitHub {
     owner = "I60R";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-w/6uCzBRXsmq7Khe+8ysfgBoxnWBLyRMyb43sCxNYMA=";
+    sha256 = "sha256-ywOT/R6YYK5MOfiCxJDw7grQqUj7NvOv7ulNp6EdK/E=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
@@ -19,7 +19,7 @@ rustPlatform.buildRustPackage rec {
     installShellCompletion --zsh $completions_dir/_page
   '';
 
-  cargoSha256 = "sha256-xHGlJxUpmqR+WoKURpRAJAhmmKXIO0SWg9VLFiinKfo=";
+  cargoSha256 = "sha256-UGPgqmoCqyeqCZS3YlwNAXrJl42nR/Cz+83Jkz5rSrw=";
 
   meta = with lib; {
     description = "Use neovim as pager";
diff --git a/pkgs/tools/misc/plocate/default.nix b/pkgs/tools/misc/plocate/default.nix
index 468b2ca7842..f767d31f6b9 100644
--- a/pkgs/tools/misc/plocate/default.nix
+++ b/pkgs/tools/misc/plocate/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , lib
 , fetchgit
+, fetchpatch
 , pkg-config
 , meson
 , ninja
@@ -14,14 +15,23 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "plocate";
-  version = "1.1.16";
+  version = "1.1.17";
 
   src = fetchgit {
     url = "https://git.sesse.net/plocate";
     rev = version;
-    sha256 = "sha256-rwvzDr3leve8BQ30+c3l1+q/7+u7FhPQ7iFcvbx/HjM=";
+    sha256 = "sha256-EcWzvbY8ey5asEJxUeSl10ozApgg+wL5o8NCNw7/W7k=";
   };
 
+  patches = [
+    # fix redefinition error
+    (fetchpatch {
+      url = "https://git.sesse.net/?p=plocate;a=patch;h=0125004cd28c5f9124632b594e51dde73af1691c";
+      revert = true;
+      sha256 = "sha256-1TDpxIdpDZQ0IZ/wGG91RVZDrpMpWkvhRF8oE0CJWIY=";
+    })
+  ];
+
   postPatch = ''
     sed -i meson.build \
       -e '/mkdir\.sh/d'
diff --git a/pkgs/tools/misc/pmbootstrap/default.nix b/pkgs/tools/misc/pmbootstrap/default.nix
index aa6c8ebae2e..fe2eb882c13 100644
--- a/pkgs/tools/misc/pmbootstrap/default.nix
+++ b/pkgs/tools/misc/pmbootstrap/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonApplication rec {
   pname = "pmbootstrap";
-  version = "1.50.0";
+  version = "1.50.1";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-UtXUq+B3EMHS3CTqfzbyQK0gHgrFwcwQ6zTzw/EwIuA=";
+    hash = "sha256-2S3I3J3wmRkVSUshyQCUTuYgHLsDMnXZQHt7KySBzIY=";
   };
 
   repo = fetchFromGitLab {
@@ -15,11 +15,14 @@ buildPythonApplication rec {
     owner = "postmarketOS";
     repo = pname;
     rev = version;
-    hash = "sha256-wuNsmc7FBk05VgH+E4uwMJeZRTlqAUe6kLvHqCLAwEY=";
+    hash = "sha256-UkgCNob4nazFO8xXyosV+11Sj4yveYBfgh7aw+/6Rlg=";
   };
 
   pmb_test = "${repo}/test";
 
+  # Tests depend on sudo
+  doCheck = stdenv.isLinux;
+
   checkInputs = [ pytestCheckHook git openssl ps sudo ];
 
   # Add test dependency in PATH
@@ -93,7 +96,5 @@ buildPythonApplication rec {
     homepage = "https://gitlab.com/postmarketOS/pmbootstrap";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ onny ];
-    # https://github.com/NixOS/nixpkgs/pull/146576#issuecomment-974267651
-    broken = stdenv.isDarwin && stdenv.isAarch64;
   };
 }
diff --git a/pkgs/tools/misc/popsicle/default.nix b/pkgs/tools/misc/popsicle/default.nix
index bae9465c7cb..3caba8f2cfc 100644
--- a/pkgs/tools/misc/popsicle/default.nix
+++ b/pkgs/tools/misc/popsicle/default.nix
@@ -1,73 +1,54 @@
-{ stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
-, rustc
-, cargo
 , rustPlatform
-, pkg-config
-, dbus
 , glib
-, cairo
-, pango
-, atk
-, lib
+, pkg-config
 , gdk-pixbuf
 , gtk3
+, wrapGAppsHook
 }:
 
-rustPlatform.buildRustPackage.override { stdenv = stdenv; } rec {
+stdenv.mkDerivation rec {
   pname = "popsicle";
-  version = "unstable-2021-12-20";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = pname;
-    rev = "b02ebf5f2e6c18777453ca9a144d69689a6fa901";
-    sha256 = "03ilhvnr4mwy7b8bipp616h16m2ilxzxz2zjpkzy3afwvh9bz1mx";
+    rev = version;
+    sha256 = "sha256-NqzuZmVabQ5WHOlBEsJhL/5Yet3TMSuo/gofSabCjTY=";
   };
 
-  cargoSha256 = "1c54wxyrfxk5chnjhxw6vaznm7ff9dkx1rxlgp417jfygiwijjs4";
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    sha256 = "sha256-k2M1c9kk1blE0ZKjstDQANdbUzI4oS1Ho5P+sR4cRtg=";
+  };
 
-  nativeBuildInputs = [ gtk3 pkg-config ];
+  nativeBuildInputs = [
+    glib
+    pkg-config
+    rustPlatform.cargoSetupHook
+    rustPlatform.rust.cargo
+    rustPlatform.rust.rustc
+    wrapGAppsHook
+  ];
 
   buildInputs = [
-    gtk3
-    dbus
-    glib
-    cairo
-    pango
-    atk
     gdk-pixbuf
+    gtk3
   ];
 
-  # Use the stdenv default phases (./configure; make) instead of the
-  # ones from buildRustPackage.
-  configurePhase = "configurePhase";
-  buildPhase = "buildPhase";
-  checkPhase = "checkPhase";
-  installPhase = "installPhase";
-
-  postPatch = ''
-    # Have to do this here instead of in preConfigure because
-    # cargoDepsCopy gets unset after postPatch.
-    configureFlagsArray+=("RUST_VENDORED_SOURCES=$cargoDepsCopy")
-  '';
-
   makeFlags = [
-    "PREFIX=${placeholder "out"}"
-    "DESTDIR=${placeholder "out"}"
+    "prefix=$(out)"
   ];
 
-  postInstall = ''
-    # install man page, icon, etc...
-    mv $out/usr/local/* $out
-    rm -rf $out/usr
-  '';
-
   meta = with lib; {
     description = "Multiple USB File Flasher";
     homepage = "https://github.com/pop-os/popsicle";
-    maintainers = with maintainers; [ _13r0ck ];
+    changelog = "https://github.com/pop-os/popsicle/releases/tag/${version}";
+    maintainers = with maintainers; [ _13r0ck figsoda ];
     license = licenses.mit;
-    platforms = [ "aarch64-linux" "x86_64-linux" ];
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/tools/misc/pspg/default.nix b/pkgs/tools/misc/pspg/default.nix
index 575ae895ea7..ffd467f0839 100644
--- a/pkgs/tools/misc/pspg/default.nix
+++ b/pkgs/tools/misc/pspg/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pspg";
-  version = "5.6.0";
+  version = "5.6.4";
 
   src = fetchFromGitHub {
     owner = "okbob";
     repo = pname;
     rev = version;
-    sha256 = "sha256-3vCOrNzVFH2xx9egBx86MnOOEl6ZpAc+lYVu8vkHTJc=";
+    sha256 = "sha256-89dW4XILS+nlGgRRePyrSFVb1QR5KQL5OmHJAeyjrZw=";
   };
 
   nativeBuildInputs = [ pkg-config installShellFiles ];
diff --git a/pkgs/tools/misc/tbls/default.nix b/pkgs/tools/misc/tbls/default.nix
index fff80b4fc1a..78f5c2fb8f0 100644
--- a/pkgs/tools/misc/tbls/default.nix
+++ b/pkgs/tools/misc/tbls/default.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "tbls";
-  version = "1.56.8";
+  version = "1.56.9";
 
   src = fetchFromGitHub {
     owner = "k1LoW";
     repo = "tbls";
     rev = "v${version}";
-    hash = "sha256-ARqWLm2EEqeV3/VxjSRTXoXywrmQLLGxHab4H6+JMpg=";
+    hash = "sha256-mZUmQoGfTc8nwzcAMIewB7usO5vfBZNCtZEOfYkYgvY=";
   };
 
   vendorHash = "sha256-pmnSeQHZEtsshldfq6D/r5pMYA5ivMWkzjOq2/WseYU=";
diff --git a/pkgs/tools/misc/tio/default.nix b/pkgs/tools/misc/tio/default.nix
index cacc770052f..71346581442 100644
--- a/pkgs/tools/misc/tio/default.nix
+++ b/pkgs/tools/misc/tio/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tio";
-  version = "2.3";
+  version = "2.4";
 
   src = fetchFromGitHub {
     owner = "tio";
     repo = "tio";
     rev = "v${version}";
-    hash = "sha256-BjA9Zl6JcgDxTj4KPiWItSq9XuX9FJkpZnhdMBGZQpQ=";
+    hash = "sha256-cRwjg0+p+1u+tdG+skqGWzxwM375P4aUsF4JVGgCXOI=";
   };
 
   nativeBuildInputs = [ meson ninja pkg-config inih bash-completion ];
diff --git a/pkgs/tools/misc/topgrade/default.nix b/pkgs/tools/misc/topgrade/default.nix
index b393269127f..3b8677273d7 100644
--- a/pkgs/tools/misc/topgrade/default.nix
+++ b/pkgs/tools/misc/topgrade/default.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "topgrade";
-  version = "10.2.1";
+  version = "10.2.2";
 
   src = fetchFromGitHub {
     owner = "topgrade-rs";
     repo = "topgrade";
     rev = "v${version}";
-    sha256 = "sha256-ljjbTqFhDDHqyA+UzqxICAM9YI1U0fI6J864o9ee6kg=";
+    sha256 = "sha256-TDuTrtVqEy0g13zdWHz2+cQhMEMSbvameBkJUcyTfGw=";
   };
 
-  cargoSha256 = "sha256-PezSEd2/98us2KPNPTmVIuPlWcRIWF7TUuT/m4df1Fs=";
+  cargoSha256 = "sha256-4uq4lksfgTI+x7E/p27gs0Zh0NQq3kIBB9KVD2tvmtQ=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/misc/tz/default.nix b/pkgs/tools/misc/tz/default.nix
index 30e2fa3ece2..9027ef20bc7 100644
--- a/pkgs/tools/misc/tz/default.nix
+++ b/pkgs/tools/misc/tz/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "tz";
-  version = "0.6.1";
+  version = "0.6.2";
 
   src = fetchFromGitHub {
     owner = "oz";
     repo = "tz";
     rev = "v${version}";
-    sha256 = "sha256-D0rakLZ+swrDwBMcr+EJPgaYsQTWob50QteW1PoIdNk=";
+    sha256 = "sha256-fl+Q6HNMSIo6E5SMBkTr6/hJN9akfJRBwSPaq7FcYDY=";
   };
 
-  vendorSha256 = "sha256-PGsj7pLtd+xpy9Dhv6qJX5sHin4YAOdXaYj4QCSFte4=";
+  vendorSha256 = "sha256-lcCra4LyebkmelvBs0Dd2mn6R64Q5MaUWc5AP8V9pec=";
 
   meta = with lib; {
     description = "A time zone helper";
diff --git a/pkgs/tools/misc/wwcd/default.nix b/pkgs/tools/misc/wwcd/default.nix
index d18c72a25ee..41c66d945f4 100644
--- a/pkgs/tools/misc/wwcd/default.nix
+++ b/pkgs/tools/misc/wwcd/default.nix
@@ -17,11 +17,12 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-laf1DEtdEs7q+rtp5Y5rb+7AGsKUv5T413CFWJiURWw=";
   };
 
-  autoreconfFlags = "-if";
   nativeBuildInputs = [
     autoreconfHook pkg-config check
   ];
 
+  autoreconfFlags = [ "-if" ];
+
   meta = with lib; {
     description = "What would cron do? Read crontab entries from stdin and print time of next execution(s)";
     homepage = "https://git.sr.ht/~bitfehler/wwcd";
diff --git a/pkgs/tools/networking/aardvark-dns/default.nix b/pkgs/tools/networking/aardvark-dns/default.nix
index 546d22fe46a..fdf76d459a2 100644
--- a/pkgs/tools/networking/aardvark-dns/default.nix
+++ b/pkgs/tools/networking/aardvark-dns/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "aardvark-dns";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-wlaOgWptD4qdaSRg6NNkQNARHMZe3z3QVoXjp133guQ=";
+    sha256 = "sha256-tQTa/iIo7kpcQq1p2romoOG2qNOiSDH7DHx3iZYLY8w=";
   };
 
-  cargoHash = "sha256-BnIGoLIuV/uDaskMA8CeVX2McAHJPT+gchZsS0bQxjI=";
+  cargoHash = "sha256-naWkSXQHfImd6R+RHKkmTe8UiqxknZEFYoJ0g/URCVY=";
 
   meta = with lib; {
     description = "Authoritative dns server for A/AAAA container records";
diff --git a/pkgs/tools/networking/clash/default.nix b/pkgs/tools/networking/clash/default.nix
index 5013ad60caf..e5594d2e0c4 100644
--- a/pkgs/tools/networking/clash/default.nix
+++ b/pkgs/tools/networking/clash/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "clash";
-  version = "1.11.4";
+  version = "1.12.0";
 
   src = fetchFromGitHub {
     owner = "Dreamacro";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-NLGX72eZCfyh6y3mud/btMh15rNXnss7S0P7ujCX1ms=";
+    sha256 = "sha256-SE+nZIatvwyc6JubMb7YUlNiJv+LYtJjFMlKEoJzEn8=";
   };
 
-  vendorSha256 = "sha256-zaWN/zI4WhHnEK12k1tWZ/qjLGvaZbJ4WfEvCZJ0+ms=";
+  vendorSha256 = "sha256-ikcGZ1Gfxb4zBkav8MDi3+xNbvhqHIk6NhLfI2ne3ns=";
 
   # Do not build testing suit
   excludedPackages = [ "./test" ];
diff --git a/pkgs/tools/networking/croc/default.nix b/pkgs/tools/networking/croc/default.nix
index cc9099877c1..77d8de4294b 100644
--- a/pkgs/tools/networking/croc/default.nix
+++ b/pkgs/tools/networking/croc/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "croc";
-  version = "9.6.1";
+  version = "9.6.2";
 
   src = fetchFromGitHub {
     owner = "schollz";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-4yikcuAhrVzWYsNOI546tA94Eho7QDCyBCmpaQ2tLW8=";
+    sha256 = "sha256-MaIvxO2bvLGrZmBLXZk2vgW1NtyoVKRxXEZALEwI/lY=";
   };
 
-  vendorSha256 = "sha256-i/80caEjr5kZAK30sXF9dKh+jAi3msntfB/BUqpGuRY=";
+  vendorSha256 = "sha256-X+DxN0DAyZ/z8YRRjuezegcPHa6SJ3/XXPYP+1Apmjw=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/tools/networking/httplz/default.nix b/pkgs/tools/networking/httplz/default.nix
index f02623329c3..d3279214997 100644
--- a/pkgs/tools/networking/httplz/default.nix
+++ b/pkgs/tools/networking/httplz/default.nix
@@ -1,6 +1,7 @@
 { lib
 , rustPlatform
 , fetchCrate
+, fetchpatch
 , installShellFiles
 , makeWrapper
 , pkg-config
@@ -21,6 +22,15 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-+nCqMTLrBYNQvoKo1PzkyzRCkKdlE88+NYoJcIlAJts=";
   };
 
+  patches = [
+    # https://github.com/thecoshman/http/pull/151
+    (fetchpatch {
+      name = "fix-rust-1.65-compile.patch";
+      url = "https://github.com/thecoshman/http/commit/6e4c8e97cce09d0d18d4936f90aa643659d813fc.patch";
+      hash = "sha256-mXclXfp2Nzq6Pr9VFmxiOzECGZEQRNOAcXoKhiOyuFs=";
+    })
+  ];
+
   cargoSha256 = "sha256-odiVIfNJPpagoASnYvdOosHXa37gbQM8Zmvtnao0pAs=";
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/networking/linkchecker/default.nix b/pkgs/tools/networking/linkchecker/default.nix
index 1facde5bc79..b7ae9f00996 100644
--- a/pkgs/tools/networking/linkchecker/default.nix
+++ b/pkgs/tools/networking/linkchecker/default.nix
@@ -1,28 +1,29 @@
-{ stdenv, lib, fetchFromGitHub, python3Packages, gettext }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, python3
+, gettext
+}:
 
-let
-  pypkgs = python3Packages;
-
-in
-pypkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "linkchecker";
-  version = "10.2.0";
+  version = "10.2.1";
   format = "pyproject";
 
-  disabled = pypkgs.pythonOlder "3.7";
-
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
-    rev = "v" + version;
-    hash = "sha256-wMiKS14fX5mkY1OwxQPFKm7i4WMFQKg3tdZZqD0g0Rw=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-z7Qp74cai8GfsxB4n9dSCWQepp0/4PimFiRJQBaVSoo=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
 
-  nativeBuildInputs = [ gettext ];
+  nativeBuildInputs = [
+    gettext
+  ];
 
-  propagatedBuildInputs = with pypkgs; [
+  propagatedBuildInputs = with python3.pkgs; [
     argcomplete
     beautifulsoup4
     configargparse
@@ -33,24 +34,32 @@ pypkgs.buildPythonApplication rec {
     requests
   ];
 
-  checkInputs = with pypkgs; [
+  checkInputs = with python3.pkgs; [
     parameterized
-    pytest
+    pytestCheckHook
   ];
 
-  # test_timeit2 is flakey, and depends sleep being precise to the milisecond
-  checkPhase = lib.optionalString stdenv.isDarwin ''
-    # network tests fails on darwin
-    rm tests/test_network.py tests/checker/test_http*.py tests/checker/test_content_allows_robots.py tests/checker/test_noproxy.py
-  '' + ''
-    pytest --ignore=tests/checker/{test_telnet,telnetserver}.py \
-      -k 'not TestLoginUrl and not test_timeit2'
-  '';
+  disabledTests = [
+    # test_timeit2 is flakey, and depends sleep being precise to the milisecond
+    "TestLoginUrl"
+    "test_timeit2"
+  ];
+
+  disabledTestPaths = [
+    "tests/checker/telnetserver.py"
+    "tests/checker/test_telnet.py"
+  ] ++ lib.optionals stdenv.isDarwin [
+    "tests/checker/test_content_allows_robots.py"
+    "tests/checker/test_http*.py"
+    "tests/checker/test_noproxy.py"
+    "tests/test_network.py"
+  ];
 
   meta = with lib; {
     description = "Check websites for broken links";
     homepage = "https://linkcheck.github.io/linkchecker/";
-    license = licenses.gpl2;
+    changelog = "https://github.com/linkchecker/linkchecker/releases/tag/v${version}";
+    license = licenses.gpl2Plus;
     maintainers = with maintainers; [ peterhoeg tweber ];
   };
 }
diff --git a/pkgs/tools/networking/mu/default.nix b/pkgs/tools/networking/mu/default.nix
index 0544b6d1ec1..8c09f1e430f 100644
--- a/pkgs/tools/networking/mu/default.nix
+++ b/pkgs/tools/networking/mu/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mu";
-  version = "1.8.11";
+  version = "1.8.13";
 
   src = fetchFromGitHub {
     owner = "djcb";
     repo = "mu";
     rev = "v${version}";
-    hash = "sha256-IEfwAAUqEGtN4vww0pfW7iuIY/U3eqzC+MJsqtossCw=";
+    hash = "sha256-uXrJOBF3X8UF1ktTfAoYgzc0QBLvyzzGQVJVfs8tjng=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/networking/netavark/default.nix b/pkgs/tools/networking/netavark/default.nix
index 0bfe7f974e8..fbd0a8119c5 100644
--- a/pkgs/tools/networking/netavark/default.nix
+++ b/pkgs/tools/networking/netavark/default.nix
@@ -7,22 +7,22 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "netavark";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-5LczayUgIJ2mcSiHKadegzTM8PvejAD0lhUlXO4Js30=";
+    sha256 = "sha256-nG+HTwF3v8FUK2SE+I312Ec5y6YPShS9si9Pc2SG1jc=";
   };
 
-  cargoHash = "sha256-gBdhdJD5EkkYNdpTNq+spySaoWnWViy9+bXTL7ps4PE=";
+  cargoHash = "sha256-szIG1udBCZj18sN3IiQtOuR8qw/xWhTMgb/n4lyTwvs=";
 
   nativeBuildInputs = [ installShellFiles mandown ];
 
   postBuild = ''
-    make -C docs
-    installManPage docs/*.1
+    make -C docs netavark.1
+    installManPage docs/netavark.1
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/networking/netbird/default.nix b/pkgs/tools/networking/netbird/default.nix
index 7997962f3b9..80897a13679 100644
--- a/pkgs/tools/networking/netbird/default.nix
+++ b/pkgs/tools/networking/netbird/default.nix
@@ -14,13 +14,13 @@ let
 in
 buildGoModule rec {
   pname = "netbird";
-  version = "0.11.1";
+  version = "0.11.4";
 
   src = fetchFromGitHub {
     owner = "netbirdio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-9dp/OMHIA1qYM4XLWOTPmlUm6+7EOE9PFsIa8IcZ/8M=";
+    sha256 = "sha256-2luUuCRcFkoUqPCXHBn1g4T6TxmSzzhDESlFSetowsA=";
   };
 
   vendorSha256 = "sha256-TfHBvcG3e+yjifPVo0ZgcvLvD16fni4m71nCr4cCBD4=";
diff --git a/pkgs/tools/networking/networkmanager/libnma/default.nix b/pkgs/tools/networking/networkmanager/libnma/default.nix
index 5db28c427d1..3b5f8bba148 100644
--- a/pkgs/tools/networking/networkmanager/libnma/default.nix
+++ b/pkgs/tools/networking/networkmanager/libnma/default.nix
@@ -19,7 +19,7 @@
 , withGtk4 ? false
 , gtk4
 , withGnome ? true
-, gcr
+, gcr_4
 , glib
 , substituteAll
 , lib
@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libnma";
-  version = "1.10.2";
+  version = "1.10.4";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "T8PZxAS3sTMD2TlPlpYcUpjXGvqfH6evXk8PboQqCUA=";
+    sha256 = "eecw3aGfmzSIb0BkqhcPGiMmsIMp1lXYC2fpBsf3i3w=";
   };
 
   patches = [
@@ -65,7 +65,7 @@ stdenv.mkDerivation rec {
     gtk4
   ] ++ lib.optionals withGnome [
     # advanced certificate chooser
-    gcr
+    gcr_4
   ];
 
   mesonFlags = [
diff --git a/pkgs/tools/networking/p2p/amule/default.nix b/pkgs/tools/networking/p2p/amule/default.nix
index 7538bb94126..8cd0f7935ec 100644
--- a/pkgs/tools/networking/p2p/amule/default.nix
+++ b/pkgs/tools/networking/p2p/amule/default.nix
@@ -7,7 +7,7 @@
 , lib
 , cmake
 , zlib
-, wxGTK30-gtk3 # WxGTK 3.0 must be used because aMule does not yet work well with 3.1
+, wxGTK30 # WxGTK 3.0 must be used because aMule does not yet work well with 3.1
 , perl
 , cryptopp
 , libupnp
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     zlib
-    wxGTK30-gtk3
+    wxGTK30
     perl
     cryptopp.dev
     libupnp
diff --git a/pkgs/tools/networking/shadowsocks-libev/default.nix b/pkgs/tools/networking/shadowsocks-libev/default.nix
index 6018e77e5e4..4b268213c94 100644
--- a/pkgs/tools/networking/shadowsocks-libev/default.nix
+++ b/pkgs/tools/networking/shadowsocks-libev/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, cmake
-, libsodium, mbedtls, libev, c-ares, pcre
+, libsodium, mbedtls_2, libev, c-ares, pcre
 , asciidoc, xmlto, docbook_xml_dtd_45, docbook_xsl, libxslt
 }:
 
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     fetchSubmodules = true;
   };
 
-  buildInputs = [ libsodium mbedtls libev c-ares pcre ];
+  buildInputs = [ libsodium mbedtls_2 libev c-ares pcre ];
   nativeBuildInputs = [ cmake asciidoc xmlto docbook_xml_dtd_45
                         docbook_xsl libxslt ];
 
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index e6ee3ffe1d8..a6bf0a585fb 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -119,7 +119,15 @@ in lib.makeExtensible (self: {
     ];
   };
 
-  stable = self.nix_2_11;
+  nix_2_12 = common {
+    version = "2.12.0";
+    sha256 = "sha256-sQ9C101CL/eVN5JgH91ozHFWU4+bXr8/Fi/8NQk6xRI=";
+    patches = [
+      ./patches/flaky-tests.patch
+    ];
+  };
+
+  stable = self.nix_2_12;
 
   unstable = self.stable;
 })
diff --git a/pkgs/tools/security/clairvoyance/default.nix b/pkgs/tools/security/clairvoyance/default.nix
index 6d4fc13ed46..fd7942bdd5d 100644
--- a/pkgs/tools/security/clairvoyance/default.nix
+++ b/pkgs/tools/security/clairvoyance/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "clairvoyance";
-  version = "2.0.4";
+  version = "2.0.6";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "nikitastupin";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-b69a3UTRt5axTSjLcEYkqGe7bFlQKCiMzoNtw91HCyI=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-Jsb/UjqAppAUz9AGgON6AyVgUdOY6aswjQ9EL939Kro=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/security/crowdsec/default.nix b/pkgs/tools/security/crowdsec/default.nix
index ce76c5d9b45..55107d62710 100644
--- a/pkgs/tools/security/crowdsec/default.nix
+++ b/pkgs/tools/security/crowdsec/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "crowdsec";
-  version = "1.4.2";
+  version = "1.4.3";
 
   src = fetchFromGitHub {
     owner = "crowdsecurity";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-hL3+hTOuwcbxiVZeq9oZjfKI1TJJt64g+74NolA3Drc=";
+    hash = "sha256-joLnKWKJR4XSoGTTx5xIKB8OH3EwSJbjEArYsPaVAOk=";
   };
 
   vendorHash = "sha256-FPsoufB9UDgBDIE3yUq4doBse3qgjP19ussYnMAxntk=";
diff --git a/pkgs/tools/security/nuclei/default.nix b/pkgs/tools/security/nuclei/default.nix
index 3d2d909a399..b8ffc2f6ba6 100644
--- a/pkgs/tools/security/nuclei/default.nix
+++ b/pkgs/tools/security/nuclei/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "nuclei";
-  version = "2.7.9";
+  version = "2.8.1";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-cAXIb8C14cpBKLpvQfJT2JbSy7Jf3SL4XyXVISoI8vE=";
+    hash = "sha256-4qymEc2uYLi+6YDMbW6aUbe3RgOMaj6DT+6EfK3JaKk=";
   };
 
-  vendorSha256 = "sha256-qIEKGnFURtfh8CdHSbAtEaQRrsjfpvwyK+uPmYNXpiA=";
+  vendorHash = "sha256-BW3IaF8etjUklX7RpxVWQoTIXSmu+qT7xyQrPKjTbD4=";
 
   modRoot = "./v2";
   subPackages = [
@@ -34,6 +34,7 @@ buildGoModule rec {
       CVEs across targets that are known and easily detectable.
     '';
     homepage = "https://github.com/projectdiscovery/nuclei";
+    changelog = "https://github.com/projectdiscovery/nuclei/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/tools/security/pinentry/default.nix b/pkgs/tools/security/pinentry/default.nix
index 68e72171eca..61f84e5d76e 100644
--- a/pkgs/tools/security/pinentry/default.nix
+++ b/pkgs/tools/security/pinentry/default.nix
@@ -1,14 +1,13 @@
 { fetchurl, mkDerivation, fetchpatch, stdenv, lib, pkg-config, autoreconfHook, wrapGAppsHook
 , libgpg-error, libassuan, qtbase, wrapQtAppsHook
-, ncurses, gtk2, gcr, libcap, libsecret
+, ncurses, gtk2, gcr, libcap
+, withLibsecret ? true, libsecret
 , enabledFlavors ? [ "curses" "tty" "gtk2" "emacs" ]
   ++ lib.optionals stdenv.isLinux [ "gnome3" ]
   ++ lib.optionals (!stdenv.isDarwin) [ "qt" ]
 }:
 
-with lib;
-
-assert isList enabledFlavors && enabledFlavors != [];
+assert lib.isList enabledFlavors && enabledFlavors != [];
 
 let
   pinentryMkDerivation =
@@ -18,11 +17,10 @@ let
 
   enableFeaturePinentry = f:
     let
-      info = flavorInfo.${f};
       flag = flavorInfo.${f}.flag or null;
     in
-      optionalString (flag != null)
-        (enableFeature (elem f enabledFlavors) ("pinentry-" + flag));
+      lib.optionalString (flag != null)
+        (lib.enableFeature (lib.elem f enabledFlavors) ("pinentry-" + flag));
 
   flavorInfo = {
     curses = { bin = "curses"; flag = "curses"; buildInputs = [ ncurses ]; };
@@ -45,17 +43,18 @@ pinentryMkDerivation rec {
   };
 
   nativeBuildInputs = [ pkg-config autoreconfHook ]
-    ++ concatMap(f: flavorInfo.${f}.nativeBuildInputs or []) enabledFlavors;
-  buildInputs = [ libgpg-error libassuan libsecret ]
+    ++ lib.concatMap(f: flavorInfo.${f}.nativeBuildInputs or []) enabledFlavors;
+  buildInputs = [ libgpg-error libassuan ]
+    ++ lib.optional withLibsecret libsecret
     ++ lib.optional (!stdenv.isDarwin) libcap
-    ++ concatMap(f: flavorInfo.${f}.buildInputs or []) enabledFlavors;
+    ++ lib.concatMap(f: flavorInfo.${f}.buildInputs or []) enabledFlavors;
 
   dontWrapGApps = true;
   dontWrapQtApps = true;
 
   patches = [
     ./autoconf-ar.patch
-  ] ++ optionals (elem "gtk2" enabledFlavors) [
+  ] ++ lib.optionals (lib.elem "gtk2" enabledFlavors) [
     (fetchpatch {
       url = "https://salsa.debian.org/debian/pinentry/raw/debian/1.1.0-1/debian/patches/0007-gtk2-When-X11-input-grabbing-fails-try-again-over-0..patch";
       sha256 = "15r1axby3fdlzz9wg5zx7miv7gqx2jy4immaw4xmmw5skiifnhfd";
@@ -63,23 +62,23 @@ pinentryMkDerivation rec {
   ];
 
   configureFlags = [
-    (withFeature   (libcap != null)    "libcap")
-    (enableFeature (libsecret != null) "libsecret")
-  ] ++ (map enableFeaturePinentry (attrNames flavorInfo));
+    (lib.withFeature   (libcap != null) "libcap")
+    (lib.enableFeature withLibsecret    "libsecret")
+  ] ++ (map enableFeaturePinentry (lib.attrNames flavorInfo));
 
   postInstall =
-    concatStrings (flip map enabledFlavors (f:
+    lib.concatStrings (lib.flip map enabledFlavors (f:
       let
         binary = "pinentry-" + flavorInfo.${f}.bin;
       in ''
         moveToOutput bin/${binary} ${placeholder f}
         ln -sf ${placeholder f}/bin/${binary} ${placeholder f}/bin/pinentry
-      '' + optionalString (f == "gnome3") ''
+      '' + lib.optionalString (f == "gnome3") ''
         wrapGApp ${placeholder f}/bin/${binary}
-      '' + optionalString (f == "qt") ''
+      '' + lib.optionalString (f == "qt") ''
         wrapQtApp ${placeholder f}/bin/${binary}
       '')) + ''
-      ln -sf ${placeholder (head enabledFlavors)}/bin/pinentry-${flavorInfo.${head enabledFlavors}.bin} $out/bin/pinentry
+      ln -sf ${placeholder (lib.head enabledFlavors)}/bin/pinentry-${flavorInfo.${lib.head enabledFlavors}.bin} $out/bin/pinentry
     '';
 
   outputs = [ "out" ] ++ enabledFlavors;
diff --git a/pkgs/tools/security/teler/default.nix b/pkgs/tools/security/teler/default.nix
index ffcab3a4187..1a66d7aea0d 100644
--- a/pkgs/tools/security/teler/default.nix
+++ b/pkgs/tools/security/teler/default.nix
@@ -5,19 +5,21 @@
 
 buildGoModule rec {
   pname = "teler";
-  version = "1.2.2";
+  version = "2.0.0-dev.2";
 
   src = fetchFromGitHub {
     owner = "kitabisa";
     repo = "teler";
     rev = "v${version}";
-    sha256 = "sha256-i4106PtoCJt5CY9ahczZYe9GufBkaZS+9Peh0IY9r1M=";
+    hash = "sha256-GlpQBmJ7HSKPFieM7E5NOnqGlUjQv9Ywe6XF5QIi+c4=";
   };
 
-  vendorSha256 = "sha256-TQjwPem+RMuoF5T02CL/CTvBS6W7Q786gTvYUFIvxjE=";
+  vendorHash = "sha256-g2YBMyLDGQZKxDBcZ1mca16jxODnJzcmMfFivBn6SdE=";
 
   ldflags = [
-    "-s" "-w" "-X ktbs.dev/teler/common.Version=${version}"
+    "-s"
+    "-w"
+    "-X ktbs.dev/teler/common.Version=${version}"
   ];
 
   # test require internet access
@@ -31,6 +33,7 @@ buildGoModule rec {
       we collect and provide by the community.
     '';
     homepage = "https://github.com/kitabisa/teler";
+    changelog = "https://github.com/kitabisa/teler/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/tools/security/tpm2-tools/default.nix b/pkgs/tools/security/tpm2-tools/default.nix
index 63b2f911a53..a7147911a86 100644
--- a/pkgs/tools/security/tpm2-tools/default.nix
+++ b/pkgs/tools/security/tpm2-tools/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "tpm2-tools";
-  version = "5.3";
+  version = "5.4";
 
   src = fetchurl {
     url = "https://github.com/tpm2-software/${pname}/releases/download/${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-584v0271zb14ctgjpELodUpPDKfFS2DvzbdcEqH5j48=";
+    sha256 = "sha256-9jVx0j7dltAkoiRTJry5o2+sLPia71psBaOwhS0pLJk=";
   };
 
   nativeBuildInputs = [ pandoc pkg-config makeWrapper ];
diff --git a/pkgs/tools/security/trufflehog/default.nix b/pkgs/tools/security/trufflehog/default.nix
index 57f49988e75..27574241576 100644
--- a/pkgs/tools/security/trufflehog/default.nix
+++ b/pkgs/tools/security/trufflehog/default.nix
@@ -1,4 +1,6 @@
-{ lib, python3Packages }:
+{ lib
+, python3Packages
+}:
 
 let
   truffleHogRegexes = python3Packages.buildPythonPackage rec {
@@ -16,7 +18,7 @@ in
 
     src = python3Packages.fetchPypi {
       inherit pname version;
-      sha256 = "sha256-fw0JyM2iqQrkL4FAXllEozJdkKWELS3eAURx5NZcceQ=";
+      hash = "sha256-fw0JyM2iqQrkL4FAXllEozJdkKWELS3eAURx5NZcceQ=";
     };
 
     # Relax overly restricted version constraint
@@ -24,15 +26,18 @@ in
       substituteInPlace setup.py --replace "GitPython ==" "GitPython >= "
     '';
 
-    propagatedBuildInputs = [ python3Packages.GitPython truffleHogRegexes ];
+    propagatedBuildInputs = [
+      python3Packages.gitpython
+      truffleHogRegexes
+    ];
 
     # Test cases run git clone and require network access
     doCheck = false;
 
-    meta = {
+    meta = with lib; {
       homepage = "https://github.com/dxa4481/truffleHog";
       description = "Searches through git repositories for high entropy strings and secrets, digging deep into commit history";
-      license = with lib.licenses; [ gpl2 ];
-      maintainers = with lib.maintainers; [ bhipple ];
+      license = with licenses; [ gpl2 ];
+      maintainers = with maintainers; [ bhipple ];
     };
   }
diff --git a/pkgs/tools/security/uncover/default.nix b/pkgs/tools/security/uncover/default.nix
index 177e46b423a..fdfa3c10805 100644
--- a/pkgs/tools/security/uncover/default.nix
+++ b/pkgs/tools/security/uncover/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "uncover";
-  version = "0.0.9";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-bYSqfxjJGue+7gPr8XgkcPF7UUuKWmLuQO07KCJp4jY=";
+    hash = "sha256-N2560u3rkLhB9wL48hLzrw8NksXruGQuvjQGvVFOxsk=";
   };
 
-  vendorSha256 = "sha256-FG0pqzSoqT/KjTOjXidAGjSABMFWgChJJYOhBfyzM7w=";
+  vendorSha256 = "sha256-71tXOm444xmRuOkw7Sa1T0afrZowvhreiwIxwlAeK6A=";
 
   meta = with lib; {
     description = "API wrapper to search for exposed hosts";
@@ -25,6 +25,7 @@ buildGoModule rec {
       Currently, it supports shodan,shodan-internetdb, censys, and fofa search API.
     '';
     homepage = "https://github.com/projectdiscovery/uncover";
+    changelog = "https://github.com/projectdiscovery/uncover/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/tools/security/vaultwarden/vault.nix b/pkgs/tools/security/vaultwarden/vault.nix
index 4353303a916..0a80c107953 100644
--- a/pkgs/tools/security/vaultwarden/vault.nix
+++ b/pkgs/tools/security/vaultwarden/vault.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "vaultwarden-vault";
-  version = "2022.6.2";
+  version = "2022.11.1";
 
   src = fetchurl {
     url = "https://github.com/dani-garcia/bw_web_builds/releases/download/v${version}/bw_web_v${version}.tar.gz";
-    sha256 = "sha256-IG/eCBTUa7eKeaelqxCWO+rrXJUuBanhsYwklftxdOE=";
+    sha256 = "sha256-nd32Q0uTsnrdVPDe1Yglvkg2QcwgLR+x0dFvKSD8o8I=";
   };
 
   buildCommand = ''
diff --git a/pkgs/tools/system/automatic-timezoned/default.nix b/pkgs/tools/system/automatic-timezoned/default.nix
index ee235fe695a..cc32210b3dd 100644
--- a/pkgs/tools/system/automatic-timezoned/default.nix
+++ b/pkgs/tools/system/automatic-timezoned/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "automatic-timezoned";
-  version = "1.0.45";
+  version = "1.0.49";
 
   src = fetchFromGitHub {
     owner = "maxbrunet";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Q/FekjyEgeZAhX4Ni8XcBPSto/UwXU4TD9b3yrBNIZ4=";
+    sha256 = "sha256-Y4QKTO85f8RHJp0tn4+/EF7uL0j2UPprDUhNaNhTfM4=";
   };
 
-  cargoSha256 = "sha256-gvJRN9YGaY1mfBn8gopTW8p+7AE7JI/A/1rixWVX2tU=";
+  cargoSha256 = "sha256-JJcmQBK39ld0pDDnrpJVJzn5fHmR5A7+NLDB+h3JHlo=";
 
   meta = with lib; {
     description = "Automatically update system timezone based on location";
diff --git a/pkgs/tools/system/plan9port/default.nix b/pkgs/tools/system/plan9port/default.nix
index 3e52d10a240..b4a277eeec4 100644
--- a/pkgs/tools/system/plan9port/default.nix
+++ b/pkgs/tools/system/plan9port/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "plan9port";
-  version = "2021-10-19";
+  version = "2022-09-12";
 
   src = fetchFromGitHub {
     owner = "9fans";
     repo = pname;
-    rev = "d0d440860f2000a1560abb3f593cdc325fcead4c";
-    hash = "sha256-2aYXqPGwrReyFPrLDtEjgQd/RJjpOfI3ge/tDocYpRQ=";
+    rev = "ffbdd1aa20c8a20a8e9dcd3cec644b6dfa3c6acb";
+    hash = "sha256-Lq5B4VYUetkHwhFX2EaLr33wR1aLIiVn8OBobxjFt7I=";
   };
 
   postPatch = ''
@@ -67,7 +67,7 @@ stdenv.mkDerivation rec {
 
   buildPhase = ''
     runHook preBuild
-    ./INSTALL -b
+    PLAN9_TARGET=$out/plan9 ./INSTALL -b
     runHook postBuild
   '';
 
diff --git a/pkgs/tools/text/d2/default.nix b/pkgs/tools/text/d2/default.nix
index 3d7774c029a..6fa5e64e302 100644
--- a/pkgs/tools/text/d2/default.nix
+++ b/pkgs/tools/text/d2/default.nix
@@ -2,20 +2,22 @@
 , buildGoModule
 , fetchFromGitHub
 , installShellFiles
+, testers
+, d2
 }:
 
 buildGoModule rec {
   pname = "d2";
-  version = "0.0.13";
+  version = "0.1.0";
 
   src = fetchFromGitHub {
     owner = "terrastruct";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-2abGQmgwqxWFk7NScdgfEjRYZF2rw8kxTKRwcl2LRg0=";
+    hash = "sha256-QRgHmQOrw1ZdZffjVnqY3epNkVvCNtR06fyQgKVXoRk=";
   };
 
-  vendorSha256 = "sha256-/BEl4UqOL4Ux7I2eubNH2YGGl4DxntpI5WN9ggvYu80=";
+  vendorHash = "sha256-SO3ZeAJu4XOPDlJ2gUSYFPNG8RcOHfCsn2RKPT+FZy4=";
 
   ldflags = [
     "-s"
@@ -29,7 +31,9 @@ buildGoModule rec {
     installManPage ci/release/template/man/d2.1
   '';
 
-  subPackages = [ "cmd/d2" ];
+  subPackages = [ "." ];
+
+  passthru.tests.version = testers.testVersion { package = d2; };
 
   meta = with lib; {
     description = "A modern diagram scripting language that turns text to diagrams";
diff --git a/pkgs/tools/text/poedit/default.nix b/pkgs/tools/text/poedit/default.nix
index 1a9f33438c8..37fc346eb0a 100644
--- a/pkgs/tools/text/poedit/default.nix
+++ b/pkgs/tools/text/poedit/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, autoconf, automake, libtool, gettext, pkg-config, wxGTK30-gtk3,
+{ lib, stdenv, fetchFromGitHub, autoconf, automake, libtool, gettext, pkg-config, wxGTK30,
   boost, icu, lucenepp, asciidoc, libxslt, xmlto, gtk3, gtkspell3, pugixml,
   nlohmann_json, hicolor-icon-theme, wrapGAppsHook }:
 
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoconf automake asciidoc wrapGAppsHook
     libxslt xmlto boost libtool pkg-config ];
 
-  buildInputs = [ lucenepp nlohmann_json wxGTK30-gtk3 icu pugixml gtk3 gtkspell3 hicolor-icon-theme ];
+  buildInputs = [ lucenepp nlohmann_json wxGTK30 icu pugixml gtk3 gtkspell3 hicolor-icon-theme ];
 
   propagatedBuildInputs = [ gettext ];
 
diff --git a/pkgs/tools/text/transifex-client/default.nix b/pkgs/tools/text/transifex-client/default.nix
index ae23e577559..07a49c3d450 100644
--- a/pkgs/tools/text/transifex-client/default.nix
+++ b/pkgs/tools/text/transifex-client/default.nix
@@ -6,7 +6,7 @@
 , urllib3
 , six
 , setuptools
-, GitPython
+, gitpython
 , pythonRelaxDepsHook
 }:
 
@@ -20,11 +20,16 @@ buildPythonApplication rec {
   };
 
   # https://github.com/transifex/transifex-client/issues/323
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
-  pythonRelaxDeps = [ "python-slugify" ];
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "python-slugify"
+  ];
 
   propagatedBuildInputs = [
-    GitPython
+    gitpython
     python-slugify
     requests
     setuptools
@@ -36,9 +41,9 @@ buildPythonApplication rec {
   doCheck = false;
 
   meta = with lib; {
+    description = "Transifex translation service client";
     homepage = "https://www.transifex.com/";
     license = licenses.gpl2Only;
-    description = "Transifex translation service client";
     maintainers = with maintainers; [ sikmir ];
   };
 }
diff --git a/pkgs/tools/wayland/slurp/default.nix b/pkgs/tools/wayland/slurp/default.nix
index 87238a50f56..17b2bb3521b 100644
--- a/pkgs/tools/wayland/slurp/default.nix
+++ b/pkgs/tools/wayland/slurp/default.nix
@@ -1,29 +1,29 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, cairo
+, libxkbcommon
 , meson
 , ninja
 , pkg-config
-, cairo
-, libxkbcommon
+, scdoc
 , wayland
 , wayland-protocols
 , wayland-scanner
-, buildDocs ? true, scdoc
+, buildDocs ? true
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "slurp";
-  version = "1.3.2";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "emersion";
     repo = "slurp";
-    rev = "v${version}";
-    sha256 = "sha256-5ZB34rqLyZmfjT/clxNRDmF0qgITFZ5xt/gIEXQzvQE=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-jUuY2wuN00libHDaJEmrvQAb1o989Ly3nLyKHV0jz8Q=";
   };
 
-  strictDeps = true;
   nativeBuildInputs = [
     meson
     ninja
@@ -38,13 +38,16 @@ stdenv.mkDerivation rec {
     wayland-protocols
   ];
 
-  mesonFlags = lib.optional buildDocs "-Dman-pages=enabled";
+  strictDeps = true;
+
+  mesonFlags = [ (lib.mesonEnable "man-pages" buildDocs) ];
 
   meta = with lib; {
-    description = "Select a region in a Wayland compositor";
     homepage = "https://github.com/emersion/slurp";
+    description = "Select a region in a Wayland compositor";
+    changelog = "https://github.com/emersion/slurp/releases/tag/v${finalAttrs.version}";
     license = licenses.mit;
     maintainers = with maintainers; [ buffet ];
-    platforms = platforms.linux;
+    inherit (wayland.meta) platforms;
   };
-}
+})
diff --git a/pkgs/tools/wayland/waynergy/default.nix b/pkgs/tools/wayland/waynergy/default.nix
index 36ad2fd19b4..fce7ac6605a 100644
--- a/pkgs/tools/wayland/waynergy/default.nix
+++ b/pkgs/tools/wayland/waynergy/default.nix
@@ -15,18 +15,18 @@
 }:
 stdenv.mkDerivation rec {
   pname = "waynergy";
-  version = "0.0.14";
+  version = "0.0.15";
 
   src = fetchFromGitHub {
     owner = "r-c-f";
     repo = "waynergy";
     rev = "v${version}";
-    hash = "sha256-LtLZDYZGoKNPRZeceMf/ndbO1QfMLkfxHeAo1YNjmm4=";
+    hash = "sha256-pk1U3svy9r7O9ivFjBNXsaOmgc+nv2QTuwwHejB7B4Q=";
   };
 
   depsBuildBuild = [ pkg-config ];
-  buildInputs = [ libdrm wayland wayland-protocols wl-clipboard libxkbcommon cmake libressl ];
   nativeBuildInputs = [ meson ninja ];
+  buildInputs = [ libdrm wayland wayland-protocols wl-clipboard libxkbcommon libressl ];
 
   postPatch = ''
     substituteInPlace waynergy.desktop --replace "Exec=/usr/bin/waynergy" "Exec=$out/bin/waynergy"
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 48c591de599..990d6837488 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -729,6 +729,7 @@ mapAliases ({
   kodiPlainWayland = kodi-wayland;
   kodiPlugins = kodiPackages; # Added 2021-03-09;
   kramdown-rfc2629 = rubyPackages.kramdown-rfc2629; # Added 2021-03-23
+  krb5Full = krb5;
   krename-qt5 = throw "'krename-qt5' has been renamed to/replaced by 'krename'"; # Converted to throw 2022-02-22
   krita-beta = krita; # moved from top-level 2021-12-23
   kube-aws = throw "kube-aws is deprecated and archived by upstream"; # Added 2022-04-05
@@ -749,6 +750,7 @@ mapAliases ({
   libayatana-appindicator-gtk3 = libayatana-appindicator; # Added 2022-10-18
   libbencodetools = bencodetools; # Added 2022-07-30
   libbluedevil = throw "'libbluedevil' (Qt4) is unmaintained and unused since 'kde4.bluedevil's removal in 2017"; # Added 2022-06-14
+  libbpf_1 = libbpf; # Added 2022-12-06
   libcanberra_gtk2 = throw "'libcanberra_gtk2' has been renamed to/replaced by 'libcanberra-gtk2'"; # Converted to throw 2022-02-22
   libcanberra_gtk3 = throw "'libcanberra_gtk3' has been renamed to/replaced by 'libcanberra-gtk3'"; # Converted to throw 2022-02-22
   libcap_manpages = throw "'libcap_manpages' has been renamed to/replaced by 'libcap.doc'"; # Converted to throw 2022-02-22
@@ -1594,6 +1596,8 @@ mapAliases ({
   wxGTK = throw "wxGTK28 has been removed from nixpkgs as it has reached end of life"; # Added 2022-11-04
   wxGTK28 = throw "wxGTK28 has been removed from nixpkgs as it has reached end of life"; # Added 2022-11-04
   wxGTK29 = throw "wxGTK29 has been removed from nixpkgs as it has reached end of life"; # Added 2022-11-04
+  wxGTK30-gtk2 = throw "'wxGTK30-gtk2' has been removed from nixpkgs as it depends on deprecated GTK2"; # Added 2022-12-03
+  wxGTK30-gtk3 = throw "'wxGTK30-gtk3' has been renamed to/replaced by 'wxGTK30'"; # Added 2022-12-03
   wxGTK31-gtk2 = throw "'wxGTK31-gtk2' has been removed from nixpkgs as it depends on deprecated GTK2"; # Added 2022-10-27
   wxGTK31-gtk3 = throw "'wxGTK31-gtk3' has been renamed to/replaced by 'wxGTK31'"; # Added 2022-10-27
   wxmupen64plus = throw "wxmupen64plus was removed because the upstream disappeared"; # Added 2022-01-31
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 1f350f68d89..c0aa65cf219 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1640,7 +1640,7 @@ with pkgs;
     fetchPypi
     annexremote
     drivelib
-    GitPython
+    gitpython
     tenacity
     humanfriendly;
   };
@@ -1827,6 +1827,8 @@ with pkgs;
 
   gitls = callPackage ../applications/version-management/git-and-tools/gitls { };
 
+  gitmux = callPackage ../applications/version-management/git-and-tools/gitmux { };
+
   gitnuro = callPackage ../applications/version-management/git-and-tools/gitnuro { };
 
   gitsign = callPackage ../applications/version-management/git-and-tools/gitsign { };
@@ -2024,11 +2026,11 @@ with pkgs;
 
   maiko = callPackage ../applications/emulators/maiko { };
 
-  mame = libsForQt5.callPackage ../applications/emulators/mame {
-    inherit (darwin.apple_sdk.frameworks) CoreAudioKit ForceFeedback;
-  };
+  mame = libsForQt5.callPackage ../applications/emulators/mame { };
 
-  mame-tools = (lib.getOutput "tools" mame);
+  mame-tools = lib.addMetaAttrs {
+    description = mame.meta.description + " (tools only)";
+  } (lib.getOutput "tools" mame);
 
   mednafen = callPackage ../applications/emulators/mednafen {
     inherit (darwin) libiconv;
@@ -2065,7 +2067,7 @@ with pkgs;
   pcem = callPackage ../applications/emulators/pcem { };
 
   pcsx2 = callPackage ../applications/emulators/pcsx2 {
-    wxGTK = wxGTK30-gtk3;
+    wxGTK = wxGTK30;
   };
 
   pcsxr = callPackage ../applications/emulators/pcsxr { };
@@ -2788,9 +2790,7 @@ with pkgs;
 
   bcachefs-tools = callPackage ../tools/filesystems/bcachefs-tools { };
 
-  bisq-desktop = callPackage ../applications/blockchains/bisq-desktop {
-    openjdk11 = openjdk11.override { enableJavaFX = true; };
-  };
+  bisq-desktop = callPackage ../applications/blockchains/bisq-desktop { };
 
   bic = callPackage ../development/interpreters/bic { };
 
@@ -2932,6 +2932,8 @@ with pkgs;
     buildGoModule = buildGo118Module; # tests fail with 1.19
   };
 
+  writeCueValidator = callPackage ../development/tools/cue/validator.nix { };
+
   cuelsp = callPackage ../development/tools/cuelsp {};
 
   cyclone-scheme = callPackage ../development/interpreters/cyclone { };
@@ -3190,6 +3192,8 @@ with pkgs;
 
   ipgrep = callPackage ../tools/networking/ipgrep { };
 
+  ipp-usb = callPackage ../os-specific/linux/ipp-usb { };
+
   itch = callPackage ../games/itch {};
 
   itd = callPackage ../applications/misc/itd { };
@@ -5974,6 +5978,8 @@ with pkgs;
 
   artim-dark = callPackage ../data/themes/artim-dark {};
 
+  bbin = callPackage ../development/tools/bbin {};
+
   bore = callPackage ../tools/networking/bore {
     inherit (darwin) Libsystem;
     inherit (darwin.apple_sdk.frameworks) SystemConfiguration;
@@ -7173,7 +7179,6 @@ with pkgs;
   fortune = callPackage ../tools/misc/fortune { };
 
   fox = callPackage ../development/libraries/fox {
-    libpng = libpng12;
     inherit (darwin.apple_sdk.frameworks) CoreServices;
   };
 
@@ -7587,9 +7592,7 @@ with pkgs;
 
   google-guest-oslogin = callPackage ../tools/virtualization/google-guest-oslogin { };
 
-  google-cloud-cpp = callPackage ../development/libraries/google-cloud-cpp {
-    openssl = openssl_1_1;
-  };
+  google-cloud-cpp = callPackage ../development/libraries/google-cloud-cpp { };
 
   google-java-format = callPackage ../development/tools/google-java-format { };
 
@@ -10695,7 +10698,7 @@ with pkgs;
   pod2mdoc = callPackage ../tools/misc/pod2mdoc { };
 
   poedit = callPackage ../tools/text/poedit {
-    wxGTK30-gtk3 = wxGTK30-gtk3.override { withWebKit = true; };
+    wxGTK30 = wxGTK30.override { withWebKit = true; };
   };
 
   polaris = callPackage ../servers/polaris { };
@@ -11719,6 +11722,7 @@ with pkgs;
 
   suricata = callPackage ../applications/networking/ids/suricata {
     python = python3;
+    libbpf = libbpf_0;
   };
 
   sof-firmware = callPackage ../os-specific/linux/firmware/sof-firmware { };
@@ -12343,9 +12347,7 @@ with pkgs;
 
   tracebox = callPackage ../tools/networking/tracebox { stdenv = gcc10StdenvCompat; };
 
-  tracee = callPackage ../tools/security/tracee {
-    libbpf = libbpf_1; # keep inline with their submodule
-  };
+  tracee = callPackage ../tools/security/tracee { };
 
   tracefilegen = callPackage ../development/tools/analysis/garcosim/tracefilegen { };
 
@@ -13309,6 +13311,7 @@ with pkgs;
   zbackup = callPackage ../tools/backup/zbackup {};
 
   zbar = libsForQt5.callPackage ../tools/graphics/zbar {
+    inherit (darwin.apple_sdk.frameworks) Foundation;
     autoreconfHook = buildPackages.autoreconfHook269;
   };
 
@@ -13362,6 +13365,8 @@ with pkgs;
 
   zip = callPackage ../tools/archivers/zip { };
 
+  zinc = callPackage ../servers/search/zinc { };
+
   zkfuse = callPackage ../tools/filesystems/zkfuse { };
 
   zpaq = callPackage ../tools/archivers/zpaq { };
@@ -15319,9 +15324,7 @@ with pkgs;
   cargo-make = callPackage ../development/tools/rust/cargo-make {
     inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration;
   };
-  cargo-modules = callPackage ../development/tools/rust/cargo-modules {
-    inherit (darwin.apple_sdk.frameworks) CoreFoundation CoreServices;
-  };
+  cargo-modules = callPackage ../development/tools/rust/cargo-modules { };
   cargo-msrv = callPackage ../development/tools/rust/cargo-msrv {
     inherit (darwin.apple_sdk.frameworks) Security;
   };
@@ -16734,7 +16737,7 @@ with pkgs;
   bloop = callPackage ../development/tools/build-managers/bloop { };
 
   bossa = callPackage ../development/embedded/bossa {
-    wxGTK = wxGTK30-gtk3;
+    wxGTK = wxGTK30;
   };
 
   bossa-arduino = callPackage ../development/embedded/bossa/arduino.nix { };
@@ -16776,10 +16779,8 @@ with pkgs;
 
   bump = callPackage ../development/tools/github/bump { };
 
-  libbpf_1 = callPackage ../os-specific/linux/libbpf { };
+  libbpf = callPackage ../os-specific/linux/libbpf { };
   libbpf_0 = callPackage ../os-specific/linux/libbpf/0.x.nix { };
-  # until more issues are fixed default to libbpf 0.x
-  libbpf = libbpf_0;
 
   bundlewrap = with python3.pkgs; toPythonApplication bundlewrap;
 
@@ -16787,12 +16788,10 @@ with pkgs;
 
   bcc = callPackage ../os-specific/linux/bcc {
     python = python3;
-    libbpf = libbpf_1;
     llvmPackages = llvmPackages_14;
   };
 
   bpftrace = callPackage ../os-specific/linux/bpftrace {
-    libbpf = libbpf_1;
     llvmPackages = llvmPackages_14;
   };
 
@@ -17701,9 +17700,7 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) Security;
   };
 
-  pahole = callPackage ../development/tools/misc/pahole {
-    libbpf = libbpf_1;
-  };
+  pahole = callPackage ../development/tools/misc/pahole { };
 
   panopticon = callPackage ../development/tools/analysis/panopticon {};
 
@@ -18100,6 +18097,10 @@ with pkgs;
 
   taoup = callPackage ../tools/misc/taoup { };
 
+  tarmac = callPackage ../development/tools/tarmac {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
+
   tcptrack = callPackage ../development/tools/misc/tcptrack { };
 
   teensyduino = arduino-core.override { withGui = true; withTeensyduino = true; };
@@ -18947,6 +18948,8 @@ with pkgs;
   factor-lang-scope = callPackage ../development/compilers/factor-lang/scope.nix { };
   factor-lang = factor-lang-scope.interpreter;
 
+  fancypp = callPackage ../development/libraries/fancypp { };
+
   far2l = callPackage ../applications/misc/far2l {
     stdenv = if stdenv.cc.isClang then llvmPackages.stdenv else stdenv;
     inherit (darwin.apple_sdk.frameworks) IOKit Carbon Cocoa AudioToolbox OpenGL;
@@ -19249,6 +19252,8 @@ with pkgs;
 
   graphinder = callPackage ../tools/security/graphinder { };
 
+  httplib = callPackage ../development/libraries/httplib { };
+
   icon-lang = callPackage ../development/interpreters/icon-lang { };
 
   libgit2 = callPackage ../development/libraries/libgit2 {
@@ -19470,9 +19475,9 @@ with pkgs;
   grilo-plugins = callPackage ../development/libraries/grilo-plugins { };
 
   grpc = callPackage ../development/libraries/grpc {
-    # grpc builds with c++14 so abseil must also be built that way
+    # grpc builds with c++17 so abseil must also be built that way
     abseil-cpp = abseil-cpp_202206.override {
-      cxxStandard = "14";
+      cxxStandard = "17";
     };
   };
 
@@ -19989,7 +19994,6 @@ with pkgs;
   krb5 = callPackage ../development/libraries/kerberos/krb5.nix {
     inherit (buildPackages.darwin) bootstrap_cmds;
   };
-  krb5Full = krb5;
   libkrb5 = krb5.override { type = "lib"; };
 
   kronosnet = callPackage ../development/libraries/kronosnet { };
@@ -21478,7 +21482,8 @@ with pkgs;
 
   maxflow = callPackage ../development/libraries/maxflow { };
 
-  mbedtls = callPackage ../development/libraries/mbedtls { };
+  mbedtls_2 = callPackage ../development/libraries/mbedtls/2.nix { };
+  mbedtls = callPackage ../development/libraries/mbedtls/3.nix { };
 
   mdctags = callPackage ../development/tools/misc/mdctags { };
 
@@ -21794,11 +21799,15 @@ with pkgs;
 
   ode = callPackage ../development/libraries/ode { };
 
-  ogre = callPackage ../development/libraries/ogre {};
+  ogre = callPackage ../development/libraries/ogre {
+    inherit (darwin.apple_sdk.frameworks) Cocoa;
+  };
   ogre1_9 = callPackage ../development/libraries/ogre/1.9.x.nix {};
   ogre1_10 = callPackage ../development/libraries/ogre/1.10.x.nix {};
 
-  ogrepaged = callPackage ../development/libraries/ogrepaged { };
+  ogrepaged = callPackage ../development/libraries/ogrepaged {
+    ogre = ogre1_9;
+  };
 
   olm = callPackage ../development/libraries/olm { };
 
@@ -22475,6 +22484,8 @@ with pkgs;
 
   seasocks = callPackage ../development/libraries/seasocks { };
 
+  semver-cpp = callPackage ../development/libraries/semver-cpp { };
+
   serd = callPackage ../development/libraries/serd {};
 
   serf = callPackage ../development/libraries/serf {
@@ -22778,15 +22789,6 @@ with pkgs;
 
   suil = callPackage ../development/libraries/audio/suil { };
 
-  suil-qt5 = suil.override {
-    withQt4 = false;
-    withQt5 = true;
-  };
-  suil-qt4 = suil.override {
-    withQt4 = true;
-    withQt5 = false;
-  };
-
   sundials = callPackage ../development/libraries/sundials {
     python = python3;
   };
@@ -23121,12 +23123,9 @@ with pkgs;
   };
 
   wxGTK30 = callPackage ../development/libraries/wxwidgets/wxGTK30.nix {
-    withGtk2 = true;
     inherit (darwin.stubs) setfile;
     inherit (darwin.apple_sdk.frameworks) AGL Carbon Cocoa Kernel QTKit AVFoundation AVKit WebKit;
   };
-  wxGTK30-gtk2 = wxGTK30.override { withGtk2 = true; };
-  wxGTK30-gtk3 = wxGTK30.override { withGtk2 = false; };
 
   wxmac = callPackage ../development/libraries/wxwidgets/wxmac30.nix {
     inherit (darwin.stubs) derez rez setfile;
@@ -23144,7 +23143,7 @@ with pkgs;
   };
 
   wxSVG = callPackage ../development/libraries/wxSVG {
-    wxGTK = wxGTK30-gtk3;
+    wxGTK = wxGTK30;
     inherit (darwin.apple_sdk.frameworks) Cocoa;
   };
 
@@ -23611,6 +23610,11 @@ with pkgs;
   cassandra_3_11 = callPackage ../servers/nosql/cassandra/3.11.nix {
     jre = jre8; # TODO: remove override https://github.com/NixOS/nixpkgs/pull/89731
   };
+  cassandra_4 = callPackage ../servers/nosql/cassandra/4.nix {
+    # Effective Cassandra 4.0.2 there is full Java 11 support
+    #  -- https://cassandra.apache.org/doc/latest/cassandra/new/java11.html
+    jre = pkgs.jdk11_headless;
+  };
   cassandra = cassandra_3_11;
 
   cassandra-cpp-driver = callPackage ../development/libraries/cassandra-cpp-driver/default.nix { };
@@ -23742,6 +23746,8 @@ with pkgs;
 
   hyp = callPackage ../servers/http/hyp { };
 
+  peering-manager = callPackage ../servers/web-apps/peering-manager { };
+
   podgrab = callPackage ../servers/misc/podgrab { };
 
   portunus = callPackage ../servers/portunus { };
@@ -24221,6 +24227,10 @@ with pkgs;
     boost = boost172;
   };
 
+  soundux = callPackage ../applications/audio/soundux {
+    yt-dlp = yt-dlp.override { withAlias = true; };
+  };
+
   tomcat_connectors = callPackage ../servers/http/apache-modules/tomcat-connectors { };
 
   tomcat-native = callPackage ../servers/http/tomcat/tomcat-native.nix { };
@@ -25685,9 +25695,7 @@ with pkgs;
 
   go-migrate = callPackage ../development/tools/go-migrate { };
 
-  go-mockery = callPackage ../development/tools/go-mockery {
-    buildGoModule = buildGo118Module; # tests fail with 1.19
-  };
+  go-mockery = callPackage ../development/tools/go-mockery { };
 
   gomacro = callPackage ../development/tools/gomacro { };
 
@@ -25963,7 +25971,6 @@ with pkgs;
       enableMinimal = true;
       guiSupport = false;
     };
-    libbpf = libbpf_1;
   };
   systemdMinimal = systemd.override {
     pname = "systemd-minimal";
@@ -26041,6 +26048,8 @@ with pkgs;
 
   twa = callPackage ../tools/networking/twa { };
 
+  twingate = callPackage ../applications/networking/twingate { };
+
   # Upstream U-Boots:
   inherit (callPackage ../misc/uboot {})
     buildUBoot
@@ -27004,6 +27013,8 @@ with pkgs;
 
   sierra-breeze-enhanced = libsForQt5.callPackage ../data/themes/kwin-decorations/sierra-breeze-enhanced { };
 
+  simp1e-cursors = callPackage ../data/icons/simp1e-cursors { };
+
   sjasmplus = callPackage ../development/compilers/sjasmplus { };
 
   skeu = callPackage ../data/themes/skeu { };
@@ -27536,7 +27547,6 @@ with pkgs;
 
   audacity = callPackage ../applications/audio/audacity {
     inherit (darwin.apple_sdk.frameworks) AppKit AudioToolbox AudioUnit Carbon CoreAudio CoreAudioKit CoreServices;
-    suil = suil-qt5;
   };
 
   audio-recorder = callPackage ../applications/audio/audio-recorder { };
@@ -28924,7 +28934,7 @@ with pkgs;
   freecad = libsForQt5.callPackage ../applications/graphics/freecad {
     boost = python3Packages.boost;
     inherit (python3Packages)
-      GitPython
+      gitpython
       matplotlib
       pivy
       ply
@@ -31718,7 +31728,7 @@ with pkgs;
   radioboat = callPackage ../applications/audio/radioboat { };
 
   radiotray-ng = callPackage ../applications/audio/radiotray-ng {
-    wxGTK = wxGTK30-gtk3;
+    wxGTK = wxGTK30;
   };
 
   raiseorlaunch = callPackage ../applications/misc/raiseorlaunch {};
@@ -32320,6 +32330,8 @@ with pkgs;
 
   teams = callPackage ../applications/networking/instant-messengers/teams { };
 
+  teams-for-linux = callPackage ../applications/networking/instant-messengers/teams-for-linux { };
+
   teamspeak_client = libsForQt5.callPackage ../applications/networking/instant-messengers/teamspeak/client.nix { };
   teamspeak5_client = callPackage ../applications/networking/instant-messengers/teamspeak/client5.nix { };
   teamspeak_server = callPackage ../applications/networking/instant-messengers/teamspeak/server.nix { };
@@ -33414,6 +33426,8 @@ with pkgs;
 
   yate = callPackage ../applications/misc/yate { };
 
+  yaup = callPackage ../applications/networking/yaup { };
+
   ydiff = with python3.pkgs; toPythonApplication ydiff;
 
   ydict = callPackage ../applications/misc/ydict {};
@@ -35911,14 +35925,6 @@ with pkgs;
     });
 
     java = openjdk17;
-    z3 = z3_4_4_0.overrideAttrs (_: {
-      src = fetchFromGitHub {
-        owner = "Z3Prover";
-        repo = "z3";
-        rev = "0482e7fe727c75e259ac55a932b28cf1842c530e";
-        sha256 = "1m53avlljxqd2p8w266ksmjywjycsd23h224yn786qsnf36dr63x";
-      };
-    });
   };
   isabelle-components = recurseIntoAttrs (callPackage ../applications/science/logic/isabelle/components { });
 
@@ -36779,8 +36785,8 @@ with pkgs;
 
   lguf-brightness = callPackage ../misc/lguf-brightness { };
 
-  lighthouse = callPackage ../applications/blockchains/lighthouse {
-    inherit (darwin.apple_sdk.frameworks) Security;
+  lighthouse = darwin.apple_sdk_11_0.callPackage ../applications/blockchains/lighthouse {
+    inherit (darwin.apple_sdk_11_0.frameworks) CoreFoundation Security;
   };
 
   lilypond = callPackage ../misc/lilypond { guile = guile_1_8; };
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index e0cecf43d26..c9879db7165 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -389,7 +389,7 @@ let
       substituteInPlace Build.PL \
         --replace "gtk+-2.0" "gtk+-3.0"
     '';
-    propagatedBuildInputs = [ pkgs.pkg-config pkgs.gtk3 pkgs.wxGTK30-gtk3 ModulePluggable ];
+    propagatedBuildInputs = [ pkgs.pkg-config pkgs.gtk3 pkgs.wxGTK30 ModulePluggable ];
     buildInputs = [ LWPProtocolHttps ];
     meta = {
       description = "Building, finding and using wxWidgets binaries";
@@ -1207,15 +1207,15 @@ let
       url = "mirror://cpan/authors/id/S/SJ/SJQUINNEY/Authen-Krb5-Admin-0.17.tar.gz";
       hash = "sha256-XdScrNmD79YajD8aVlcbtzeF6xVZCLXXvsl+7XjfDFQ=";
     };
-    propagatedBuildInputs = [ pkgs.krb5Full.dev AuthenKrb5 ];
+    propagatedBuildInputs = [ pkgs.krb5.dev AuthenKrb5 ];
     # The following ENV variables are required by Makefile.PL to find
-    # programs in krb5Full.dev. It is not enough to just specify the
-    # path to krb5-config as this tool returns the prefix of krb5Full,
+    # programs in krb5.dev. It is not enough to just specify the
+    # path to krb5-config as this tool returns the prefix of krb5,
     # which implies a working value for KRB5_LIBDIR, but not the others.
     perlPreHook = ''
-      export KRB5_CONFTOOL=${pkgs.krb5Full.dev}/bin/krb5-config
-      export KRB5_BINDIR=${pkgs.krb5Full.dev}/bin
-      export KRB5_INCDIR=${pkgs.krb5Full.dev}/include
+      export KRB5_CONFTOOL=${pkgs.krb5.dev}/bin/krb5-config
+      export KRB5_BINDIR=${pkgs.krb5.dev}/bin
+      export KRB5_INCDIR=${pkgs.krb5.dev}/include
     '';
     # Tests require working Kerberos infrastructure so replace with a
     # simple attempt to exercise the module.
@@ -10529,8 +10529,8 @@ let
       url = "mirror://cpan/authors/id/A/AG/AGROLMS/GSSAPI-0.28.tar.gz";
       hash = "sha256-fY8se2F2L7TsctLsKBKQ8vh/nH0pgnPaRSVDKmXncNY=";
     };
-    propagatedBuildInputs = [ pkgs.krb5Full.dev ];
-    makeMakerFlags = [ "--gssapiimpl" "${pkgs.krb5Full.dev}" ];
+    propagatedBuildInputs = [ pkgs.krb5.dev ];
+    makeMakerFlags = [ "--gssapiimpl" "${pkgs.krb5.dev}" ];
     meta = {
       description = "Perl extension providing access to the GSSAPIv2 library";
       license = with lib.licenses; [ artistic1 gpl1Plus ];
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index ed90d54f263..e338c261597 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -87,6 +87,7 @@ mapAliases ({
   garminconnect-ha = garminconnect; # added 2022-02-05
   gigalixir = throw "gigalixir has been promoted to a top-level attribute"; # Added 2022-10-02
   gitdb2 = throw "gitdb2 has been deprecated, use gitdb instead."; # added 2020-03-14
+  GitPython = gitpython; # added 2022-10-28
   glances = throw "glances has moved to pkgs.glances"; # added 2020-20-28
   google_api_python_client = google-api-python-client; # added 2021-03-19
   googleapis_common_protos = googleapis-common-protos; # added 2021-03-19
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index a4d9a873707..0530337d0a6 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1426,7 +1426,7 @@ self: super: with self; {
 
   btrfs = callPackage ../development/python-modules/btrfs { };
 
-  btrfsutil = toPythonModule (pkgs.btrfs-progs.override { python3 = self.python; });
+  btrfsutil = callPackage ../development/python-modules/btrfsutil { };
 
   btsocket = callPackage ../development/python-modules/btsocket { };
 
@@ -3726,18 +3726,19 @@ self: super: with self; {
 
   git-filter-repo = callPackage ../development/python-modules/git-filter-repo { };
 
-  gitdb = callPackage ../development/python-modules/gitdb { };
+  git-revise = callPackage ../development/python-modules/git-revise { };
 
-  github3_py = callPackage ../development/python-modules/github3_py { };
+  git-sweep = callPackage ../development/python-modules/git-sweep { };
+
+  gitdb = callPackage ../development/python-modules/gitdb { };
 
   github-to-sqlite = callPackage ../development/python-modules/github-to-sqlite { };
 
   github-webhook = callPackage ../development/python-modules/github-webhook { };
-  GitPython = callPackage ../development/python-modules/GitPython { };
 
-  git-revise = callPackage ../development/python-modules/git-revise { };
+  github3_py = callPackage ../development/python-modules/github3_py { };
 
-  git-sweep = callPackage ../development/python-modules/git-sweep { };
+  gitpython = callPackage ../development/python-modules/gitpython { };
 
   glad =  callPackage ../development/python-modules/glad { };
 
@@ -4035,7 +4036,7 @@ self: super: with self; {
   gspread = callPackage ../development/python-modules/gspread { };
 
   gssapi = callPackage ../development/python-modules/gssapi {
-    inherit (pkgs) krb5Full;
+    inherit (pkgs) krb5;
     inherit (pkgs.darwin.apple_sdk.frameworks) GSS;
   };
 
@@ -4929,7 +4930,7 @@ self: super: with self; {
   jxmlease = callPackage ../development/python-modules/jxmlease { };
 
   k5test = callPackage ../development/python-modules/k5test {
-    inherit (pkgs) krb5Full findutils which;
+    inherit (pkgs) krb5 findutils which;
   };
 
   kaa-base = callPackage ../development/python-modules/kaa-base { };
@@ -8967,6 +8968,8 @@ self: super: with self; {
 
   python3-openid = callPackage ../development/python-modules/python3-openid { };
 
+  python-arango = callPackage ../development/python-modules/python-arango { };
+
   python-awair = callPackage ../development/python-modules/python-awair { };
 
   python3-saml = callPackage ../development/python-modules/python3-saml { };
@@ -9948,6 +9951,8 @@ self: super: with self; {
 
   runway-python = callPackage ../development/python-modules/runway-python { };
 
+  ruuvitag-ble = callPackage ../development/python-modules/ruuvitag-ble { };
+
   ruyaml = callPackage ../development/python-modules/ruyaml { };
 
   rx = callPackage ../development/python-modules/rx { };
@@ -12029,7 +12034,7 @@ self: super: with self; {
 
   wxPython_4_0 = callPackage ../development/python-modules/wxPython/4.0.nix {
     inherit (pkgs.darwin.apple_sdk.frameworks) AudioToolbox Carbon Cocoa CoreFoundation IOKit OpenGL;
-    wxGTK = pkgs.wxGTK30-gtk3.override {
+    wxGTK = pkgs.wxGTK30.override {
       withWebKit = true;
     };
   };
diff --git a/pkgs/top-level/python2-packages.nix b/pkgs/top-level/python2-packages.nix
index 3d970d8bc4b..534f9fa0490 100644
--- a/pkgs/top-level/python2-packages.nix
+++ b/pkgs/top-level/python2-packages.nix
@@ -19,12 +19,8 @@ with self; with super; {
 
   chardet = callPackage ../development/python2-modules/chardet { };
 
-  cheetah = callPackage ../development/python2-modules/cheetah { };
-
   configparser = callPackage ../development/python2-modules/configparser { };
 
-  construct = callPackage ../development/python2-modules/construct { };
-
   contextlib2 = callPackage ../development/python2-modules/contextlib2 { };
 
   coverage = callPackage ../development/python2-modules/coverage { };
@@ -39,8 +35,6 @@ with self; with super; {
 
   gtkme = callPackage ../development/python2-modules/gtkme { };
 
-  httpretty = callPackage ../development/python2-modules/httpretty { };
-
   hypothesis = callPackage ../development/python2-modules/hypothesis { };
 
   idna = callPackage ../development/python2-modules/idna { };
@@ -53,31 +47,18 @@ with self; with super; {
     inherit (pkgs) marisa;
   };
 
-  markdown = callPackage ../development/python2-modules/markdown { };
-
   markupsafe = callPackage ../development/python2-modules/markupsafe { };
 
   mock = callPackage ../development/python2-modules/mock { };
 
   more-itertools = callPackage ../development/python2-modules/more-itertools { };
 
-  mutagen = callPackage ../development/python2-modules/mutagen { };
-
-  numpy = callPackage ../development/python2-modules/numpy { };
-
   packaging = callPackage ../development/python2-modules/packaging { };
 
-  pillow = callPackage ../development/python2-modules/pillow {
-    inherit (pkgs) freetype libjpeg zlib libtiff libwebp tcl lcms2 tk;
-    inherit (pkgs.xorg) libX11;
-  };
-
   pip = callPackage ../development/python2-modules/pip { };
 
   pluggy = callPackage ../development/python2-modules/pluggy { };
 
-  prettytable = callPackage ../development/python2-modules/prettytable { };
-
   protobuf = callPackage ../development/python2-modules/protobuf {
     disabled = isPyPy;
     protobuf = pkgs.protobuf3_17; # last version compatible with Python 2
@@ -115,10 +96,6 @@ with self; with super; {
 
   pytest-xdist = callPackage ../development/python2-modules/pytest-xdist { };
 
-  pyyaml = callPackage ../development/python2-modules/pyyaml { };
-
-  qpid-python = callPackage ../development/python2-modules/qpid-python { };
-
   recoll = disabled super.recoll;
 
   rivet = disabled super.rivet;
@@ -139,8 +116,6 @@ with self; with super; {
 
   sphinx = callPackage ../development/python2-modules/sphinx { };
 
-  TurboCheetah = callPackage ../development/python2-modules/TurboCheetah { };
-
   typing = callPackage ../development/python2-modules/typing { };
 
   zeek = disabled super.zeek;