summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--doc/using/overlays.chapter.md20
-rw-r--r--maintainers/maintainer-list.nix6
-rw-r--r--nixos/doc/manual/from_md/release-notes/rl-2205.section.xml92
-rw-r--r--nixos/doc/manual/release-notes/rl-2205.section.md24
-rw-r--r--nixos/modules/misc/version.nix6
-rw-r--r--nixos/modules/module-list.nix2
-rw-r--r--nixos/modules/services/cluster/corosync/default.nix112
-rw-r--r--nixos/modules/services/cluster/hadoop/conf.nix22
-rw-r--r--nixos/modules/services/cluster/hadoop/default.nix97
-rw-r--r--nixos/modules/services/cluster/hadoop/hdfs.nix295
-rw-r--r--nixos/modules/services/cluster/hadoop/yarn.nix98
-rw-r--r--nixos/modules/services/cluster/pacemaker/default.nix52
-rw-r--r--nixos/modules/services/web-apps/nextcloud.nix11
-rw-r--r--nixos/tests/all-tests.nix9
-rw-r--r--nixos/tests/hadoop/default.nix7
-rw-r--r--nixos/tests/hadoop/hadoop.nix273
-rw-r--r--nixos/tests/hadoop/hdfs.nix61
-rw-r--r--nixos/tests/hadoop/yarn.nix34
-rw-r--r--nixos/tests/nextcloud/default.nix2
-rw-r--r--nixos/tests/pacemaker.nix110
-rw-r--r--pkgs/applications/audio/furnace/default.nix99
-rw-r--r--pkgs/applications/audio/mopidy/ytmusic.nix13
-rw-r--r--pkgs/applications/editors/ed/default.nix4
-rw-r--r--pkgs/applications/editors/vim/common.nix4
-rw-r--r--pkgs/applications/editors/vscode/extensions/default.nix24
-rw-r--r--pkgs/applications/misc/mob/default.nix4
-rw-r--r--pkgs/applications/misc/stork/default.nix6
-rw-r--r--pkgs/applications/networking/browsers/brave/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/chromium/upstream-info.json14
-rw-r--r--pkgs/applications/networking/browsers/firefox/packages.nix4
-rw-r--r--pkgs/applications/networking/browsers/opera/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/argo/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/fluxcd/default.nix8
-rw-r--r--pkgs/applications/networking/cluster/hadoop/default.nix65
-rw-r--r--pkgs/applications/networking/cluster/qbec/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/spark/default.nix55
-rw-r--r--pkgs/applications/networking/cluster/tfswitch/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/tgswitch/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/werf/default.nix6
-rw-r--r--pkgs/applications/networking/instant-messengers/alfaview/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/cinny/default.nix4
-rw-r--r--pkgs/applications/networking/mailreaders/himalaya/default.nix12
-rw-r--r--pkgs/applications/networking/remote/remmina/default.nix4
-rw-r--r--pkgs/applications/office/paperless-ng/default.nix4
-rw-r--r--pkgs/applications/science/astronomy/phd2/default.nix4
-rw-r--r--pkgs/applications/science/astronomy/siril/default.nix4
-rw-r--r--pkgs/applications/science/computer-architecture/qtrvsim/default.nix4
-rw-r--r--pkgs/applications/science/math/sage/patches/no-cython-sources-in-tracebacks-on-ipython8.patch52
-rw-r--r--pkgs/applications/science/math/sage/sage-src.nix16
-rw-r--r--pkgs/applications/terminal-emulators/xterm/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/gh/default.nix6
-rw-r--r--pkgs/applications/video/mpv/scripts/vr-reversal.nix35
-rw-r--r--pkgs/applications/video/smplayer/default.nix8
-rw-r--r--pkgs/applications/virtualization/lima/default.nix6
-rw-r--r--pkgs/build-support/alternatives/blas/default.nix31
-rw-r--r--pkgs/build-support/alternatives/lapack/default.nix29
-rw-r--r--pkgs/build-support/cc-wrapper/add-flags.sh18
-rw-r--r--pkgs/build-support/setup-hooks/auto-patchelf.py329
-rw-r--r--pkgs/build-support/setup-hooks/auto-patchelf.sh331
-rw-r--r--pkgs/build-support/setup-hooks/make-wrapper.sh18
-rwxr-xr-xpkgs/data/fonts/vazir-fonts/default.nix4
-rw-r--r--pkgs/data/icons/kora-icon-theme/default.nix4
-rw-r--r--pkgs/data/misc/tzdata/default.nix3
-rw-r--r--pkgs/desktops/plasma-5/fetch.sh2
-rw-r--r--pkgs/desktops/plasma-5/kdecoration.nix4
-rw-r--r--pkgs/desktops/plasma-5/kwin/0001-NixOS-Unwrap-executable-name-for-.desktop-search.patch8
-rw-r--r--pkgs/desktops/plasma-5/libksysguard/0001-qdiriterator-follow-symlinks.patch5
-rw-r--r--pkgs/desktops/plasma-5/plasma-workspace/0001-startkde.patch41
-rw-r--r--pkgs/desktops/plasma-5/plasma-workspace/0002-absolute-wallpaper-install-dir.patch4
-rw-r--r--pkgs/desktops/plasma-5/srcs.nix432
-rw-r--r--pkgs/development/compilers/4th/001-install-manual-fixup.diff12
-rw-r--r--pkgs/development/compilers/4th/default.nix17
-rw-r--r--pkgs/development/compilers/go/1.16.nix1
-rw-r--r--pkgs/development/compilers/go/1.17.nix1
-rw-r--r--pkgs/development/compilers/go/1.18.nix4
-rw-r--r--pkgs/development/compilers/llvm/13/clang/add-nostdlibinc-flag.patch18
-rw-r--r--pkgs/development/compilers/llvm/13/clang/default.nix5
-rw-r--r--pkgs/development/compilers/llvm/13/default.nix4
-rw-r--r--pkgs/development/compilers/open-watcom/v2.nix6
-rw-r--r--pkgs/development/compilers/qbe/default.nix6
-rw-r--r--pkgs/development/compilers/vala/default.nix4
-rw-r--r--pkgs/development/dotnet-modules/python-language-server/default.nix6
-rw-r--r--pkgs/development/interpreters/python/cpython/default.nix3
-rw-r--r--pkgs/development/libraries/SDL2/Fix-build-against-wayland-1.20.patch43
-rw-r--r--pkgs/development/libraries/SDL2/default.nix115
-rw-r--r--pkgs/development/libraries/SDL2/find-headers.patch46
-rw-r--r--pkgs/development/libraries/aws-checksums/default.nix4
-rw-r--r--pkgs/development/libraries/boost/generic.nix9
-rw-r--r--pkgs/development/libraries/clearsilver/default.nix44
-rw-r--r--pkgs/development/libraries/expat/default.nix4
-rw-r--r--pkgs/development/libraries/gd/default.nix12
-rw-r--r--pkgs/development/libraries/gdbm/default.nix4
-rw-r--r--pkgs/development/libraries/glib/default.nix4
-rw-r--r--pkgs/development/libraries/glibc/2.33-master.patch.gzbin147266 -> 155232 bytes
-rw-r--r--pkgs/development/libraries/glibc/common.nix4
-rw-r--r--pkgs/development/libraries/gnu-config/default.nix2
-rw-r--r--pkgs/development/libraries/gpgme/default.nix76
-rw-r--r--pkgs/development/libraries/gpgme/python-310-detection-without-distutils.patch273
-rw-r--r--pkgs/development/libraries/gpgme/python-find-version-string-above-310.patch373
-rw-r--r--pkgs/development/libraries/gpgme/test_t-edit-sign.diff125
-rw-r--r--pkgs/development/libraries/harfbuzz/default.nix4
-rw-r--r--pkgs/development/libraries/kde-frameworks/fetch.sh2
-rw-r--r--pkgs/development/libraries/kde-frameworks/kdesu/kdesu-search-for-wrapped-daemon-first.patch6
-rw-r--r--pkgs/development/libraries/kde-frameworks/srcs.nix664
-rw-r--r--pkgs/development/libraries/lcms2/default.nix4
-rw-r--r--pkgs/development/libraries/libaom/default.nix4
-rw-r--r--pkgs/development/libraries/libarchive-qt/default.nix9
-rw-r--r--pkgs/development/libraries/libarchive/default.nix4
-rw-r--r--pkgs/development/libraries/libbsd/default.nix6
-rw-r--r--pkgs/development/libraries/libclc/default.nix3
-rw-r--r--pkgs/development/libraries/libdrm/default.nix4
-rw-r--r--pkgs/development/libraries/libgbinder/default.nix4
-rw-r--r--pkgs/development/libraries/libgee/default.nix4
-rw-r--r--pkgs/development/libraries/libnbd/default.nix9
-rw-r--r--pkgs/development/libraries/libnfs/default.nix4
-rw-r--r--pkgs/development/libraries/libpng/default.nix2
-rw-r--r--pkgs/development/libraries/libqmi/default.nix4
-rw-r--r--pkgs/development/libraries/librsvg/default.nix4
-rw-r--r--pkgs/development/libraries/libsigsegv/default.nix4
-rw-r--r--pkgs/development/libraries/libtiff/default.nix16
-rw-r--r--pkgs/development/libraries/libwacom/default.nix4
-rw-r--r--pkgs/development/libraries/libxkbcommon/default.nix4
-rw-r--r--pkgs/development/libraries/libxml2/default.nix122
-rw-r--r--pkgs/development/libraries/libxslt/default.nix59
-rw-r--r--pkgs/development/libraries/mesa/default.nix9
-rw-r--r--pkgs/development/libraries/ncurses/default.nix2
-rw-r--r--pkgs/development/libraries/neon/default.nix4
-rw-r--r--pkgs/development/libraries/nettle/generic.nix4
-rw-r--r--pkgs/development/libraries/nss/default.nix4
-rw-r--r--pkgs/development/libraries/opendht/default.nix4
-rw-r--r--pkgs/development/libraries/openh264/default.nix4
-rw-r--r--pkgs/development/libraries/openssl/default.nix8
-rw-r--r--pkgs/development/libraries/pango/default.nix4
-rw-r--r--pkgs/development/libraries/pipewire/default.nix3
-rw-r--r--pkgs/development/libraries/plasma-wayland-protocols/default.nix4
-rw-r--r--pkgs/development/libraries/polkit/default.nix6
-rw-r--r--pkgs/development/libraries/protolock/default.nix6
-rw-r--r--pkgs/development/libraries/qt-5/5.15/srcs-generated.json40
-rw-r--r--pkgs/development/libraries/readline/readline-8.1-patches.nix2
l---------pkgs/development/libraries/readline/update-patch-set.sh1
-rw-r--r--pkgs/development/libraries/science/math/amd-blis/default.nix2
-rw-r--r--pkgs/development/libraries/science/math/amd-libflame/default.nix6
-rw-r--r--pkgs/development/libraries/science/math/blas/default.nix63
-rw-r--r--pkgs/development/libraries/science/math/liblapack/default.nix18
-rw-r--r--pkgs/development/libraries/science/math/openblas/default.nix4
-rw-r--r--pkgs/development/libraries/speex/default.nix10
-rw-r--r--pkgs/development/libraries/tk/generic.nix3
-rw-r--r--pkgs/development/libraries/wxwidgets/3.1/default.nix138
-rw-r--r--pkgs/development/libraries/wxwidgets/wxGTK28.nix (renamed from pkgs/development/libraries/wxwidgets/2.8/default.nix)0
-rw-r--r--pkgs/development/libraries/wxwidgets/wxGTK29.nix (renamed from pkgs/development/libraries/wxwidgets/2.9/default.nix)2
-rw-r--r--pkgs/development/libraries/wxwidgets/wxGTK30.nix (renamed from pkgs/development/libraries/wxwidgets/3.0/default.nix)10
-rw-r--r--pkgs/development/libraries/wxwidgets/wxGTK31.nix149
-rw-r--r--pkgs/development/libraries/wxwidgets/wxmac30.nix (renamed from pkgs/development/libraries/wxwidgets/3.0/mac.nix)0
-rw-r--r--pkgs/development/libraries/xdg-dbus-proxy/default.nix4
-rw-r--r--pkgs/development/node-packages/default.nix2
-rw-r--r--pkgs/development/python-modules/adafruit-platformdetect/default.nix4
-rw-r--r--pkgs/development/python-modules/aiohttp/default.nix5
-rw-r--r--pkgs/development/python-modules/aiosignal/default.nix5
-rw-r--r--pkgs/development/python-modules/androidtv/default.nix4
-rw-r--r--pkgs/development/python-modules/async_generator/default.nix20
-rw-r--r--pkgs/development/python-modules/awscrt/default.nix4
-rw-r--r--pkgs/development/python-modules/azure-mgmt-monitor/default.nix18
-rw-r--r--pkgs/development/python-modules/black/default.nix20
-rw-r--r--pkgs/development/python-modules/bumps/default.nix33
-rw-r--r--pkgs/development/python-modules/cchardet/default.nix6
-rw-r--r--pkgs/development/python-modules/charset-normalizer/default.nix4
-rw-r--r--pkgs/development/python-modules/check-manifest/default.nix22
-rw-r--r--pkgs/development/python-modules/cloudscraper/default.nix16
-rw-r--r--pkgs/development/python-modules/django-picklefield/default.nix18
-rw-r--r--pkgs/development/python-modules/django/2.nix5
-rw-r--r--pkgs/development/python-modules/django/3.nix5
-rw-r--r--pkgs/development/python-modules/docx2txt/default.nix26
-rw-r--r--pkgs/development/python-modules/env-canada/default.nix4
-rw-r--r--pkgs/development/python-modules/eventlet/default.nix2
-rw-r--r--pkgs/development/python-modules/frozenlist/default.nix12
-rw-r--r--pkgs/development/python-modules/google-cloud-redis/default.nix4
-rw-r--r--pkgs/development/python-modules/google-cloud-storage/default.nix8
-rw-r--r--pkgs/development/python-modules/importlib-metadata/default.nix6
-rw-r--r--pkgs/development/python-modules/iniconfig/default.nix6
-rw-r--r--pkgs/development/python-modules/intellifire4py/default.nix4
-rw-r--r--pkgs/development/python-modules/ipython/default.nix13
-rw-r--r--pkgs/development/python-modules/jedi/default.nix6
-rw-r--r--pkgs/development/python-modules/mdformat/default.nix4
-rw-r--r--pkgs/development/python-modules/meshtastic/default.nix4
-rw-r--r--pkgs/development/python-modules/moto/default.nix2
-rw-r--r--pkgs/development/python-modules/nassl/default.nix91
-rw-r--r--pkgs/development/python-modules/neo4j-driver/default.nix4
-rw-r--r--pkgs/development/python-modules/pbr/default.nix4
-rw-r--r--pkgs/development/python-modules/pbr/tests.nix4
-rw-r--r--pkgs/development/python-modules/pillow/default.nix4
-rw-r--r--pkgs/development/python-modules/platformdirs/default.nix4
-rw-r--r--pkgs/development/python-modules/proxmoxer/default.nix4
-rw-r--r--pkgs/development/python-modules/pyaussiebb/default.nix6
-rw-r--r--pkgs/development/python-modules/pycep-parser/default.nix6
-rw-r--r--pkgs/development/python-modules/pycryptodome/default.nix5
-rw-r--r--pkgs/development/python-modules/pycryptodomex/default.nix5
-rw-r--r--pkgs/development/python-modules/pyinfra/default.nix60
-rw-r--r--pkgs/development/python-modules/pykrakenapi/default.nix4
-rw-r--r--pkgs/development/python-modules/pyopenssl/default.nix108
-rw-r--r--pkgs/development/python-modules/pysigma-backend-splunk/default.nix4
-rw-r--r--pkgs/development/python-modules/pysigma-pipeline-crowdstrike/default.nix4
-rw-r--r--pkgs/development/python-modules/pysigma-pipeline-sysmon/default.nix4
-rw-r--r--pkgs/development/python-modules/pysigma/default.nix18
-rw-r--r--pkgs/development/python-modules/pytest-aiohttp/default.nix39
-rw-r--r--pkgs/development/python-modules/pytest-asyncio/default.nix11
-rw-r--r--pkgs/development/python-modules/pytest-json-report/default.nix8
-rw-r--r--pkgs/development/python-modules/pytest-mock/default.nix11
-rw-r--r--pkgs/development/python-modules/python-box/default.nix10
-rw-r--r--pkgs/development/python-modules/python-http-client/default.nix4
-rw-r--r--pkgs/development/python-modules/pyyaml/default.nix2
-rw-r--r--pkgs/development/python-modules/qcengine/default.nix4
-rw-r--r--pkgs/development/python-modules/readme_renderer/default.nix4
-rw-r--r--pkgs/development/python-modules/regex/default.nix15
-rw-r--r--pkgs/development/python-modules/responses/default.nix6
-rw-r--r--pkgs/development/python-modules/ruamel-yaml/default.nix4
-rw-r--r--pkgs/development/python-modules/samsungtvws/default.nix4
-rw-r--r--pkgs/development/python-modules/semantic-version/default.nix31
-rw-r--r--pkgs/development/python-modules/snitun/default.nix2
-rw-r--r--pkgs/development/python-modules/soco/default.nix4
-rw-r--r--pkgs/development/python-modules/sslyze/default.nix4
-rw-r--r--pkgs/development/python-modules/stack-data/default.nix6
-rw-r--r--pkgs/development/python-modules/tls-parser/default.nix16
-rw-r--r--pkgs/development/python-modules/twentemilieu/default.nix4
-rw-r--r--pkgs/development/python-modules/typed-ast/default.nix4
-rw-r--r--pkgs/development/python-modules/vt-py/default.nix4
-rw-r--r--pkgs/development/python-modules/xmltodict/default.nix12
-rw-r--r--pkgs/development/tools/analysis/checkov/default.nix5
-rw-r--r--pkgs/development/tools/build-managers/bazel/bazel-remote/default.nix6
-rw-r--r--pkgs/development/tools/database/prisma-engines/default.nix6
-rw-r--r--pkgs/development/tools/doctl/default.nix4
-rw-r--r--pkgs/development/tools/jp/default.nix16
-rw-r--r--pkgs/development/tools/k6/default.nix4
-rw-r--r--pkgs/development/tools/kcli/default.nix2
-rw-r--r--pkgs/development/tools/misc/autoconf/2.13.nix3
-rw-r--r--pkgs/development/tools/misc/ctags/default.nix6
-rw-r--r--pkgs/development/tools/misc/gdb/default.nix4
-rw-r--r--pkgs/development/tools/misc/help2man/default.nix4
-rw-r--r--pkgs/development/tools/parsing/flex/default.nix4
-rw-r--r--pkgs/development/tools/rust/cargo-crev/default.nix6
-rw-r--r--pkgs/development/tools/shellharden/default.nix6
-rw-r--r--pkgs/development/tools/stylua/default.nix6
-rw-r--r--pkgs/development/tools/symfony-cli/default.nix4
-rw-r--r--pkgs/development/web/nodejs/setup-hook.sh2
-rw-r--r--pkgs/misc/cups/default.nix4
-rw-r--r--pkgs/misc/logging/pacemaker/default.nix102
-rw-r--r--pkgs/misc/openrussian-cli/default.nix15
-rw-r--r--pkgs/misc/screensavers/xlockmore/default.nix4
-rw-r--r--pkgs/os-specific/linux/audit/default.nix12
-rw-r--r--pkgs/os-specific/linux/bluez/default.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/common-config.nix10
-rw-r--r--pkgs/os-specific/linux/libpsm2/default.nix4
-rw-r--r--pkgs/os-specific/linux/lvm2/2_03.nix4
-rw-r--r--pkgs/os-specific/linux/lvm2/common.nix3
-rw-r--r--pkgs/os-specific/linux/ocf-resource-agents/default.nix7
-rw-r--r--pkgs/os-specific/linux/oci-seccomp-bpf-hook/default.nix4
-rw-r--r--pkgs/os-specific/linux/tuigreet/default.nix2
-rw-r--r--pkgs/os-specific/linux/udisks/2-default.nix4
-rw-r--r--pkgs/os-specific/linux/udisks/fix-paths.patch37
-rw-r--r--pkgs/os-specific/linux/util-linux/default.nix4
-rw-r--r--pkgs/os-specific/linux/v4l-utils/default.nix12
-rw-r--r--pkgs/servers/corosync/default.nix10
-rw-r--r--pkgs/servers/dns/coredns/default.nix11
-rw-r--r--pkgs/servers/home-assistant/default.nix8
-rw-r--r--pkgs/servers/http/apache-httpd/2.4.nix10
-rw-r--r--pkgs/servers/nextcloud/default.nix17
-rw-r--r--pkgs/servers/piping-server-rust/default.nix6
-rw-r--r--pkgs/servers/sabnzbd/default.nix4
-rw-r--r--pkgs/servers/sql/postgresql/default.nix20
-rw-r--r--pkgs/shells/bash/bash-5.1-patches.nix4
-rw-r--r--pkgs/shells/fish/default.nix10
-rw-r--r--pkgs/shells/fish/tests-pcre2-update.patch7
-rw-r--r--pkgs/shells/hilbish/default.nix4
-rw-r--r--pkgs/test/make-wrapper/default.nix3
-rw-r--r--pkgs/tools/admin/berglas/default.nix33
-rw-r--r--pkgs/tools/admin/exoscale-cli/default.nix4
-rw-r--r--pkgs/tools/admin/fits-cloudctl/default.nix4
-rw-r--r--pkgs/tools/admin/syft/default.nix6
-rw-r--r--pkgs/tools/admin/trivy/default.nix6
-rw-r--r--pkgs/tools/archivers/p7zip/default.nix35
-rwxr-xr-xpkgs/tools/archivers/p7zip/update.sh47
-rw-r--r--pkgs/tools/backup/btrbk/default.nix4
-rw-r--r--pkgs/tools/filesystems/btrfs-progs/default.nix4
-rw-r--r--pkgs/tools/misc/findutils/default.nix4
-rw-r--r--pkgs/tools/misc/license-generator/default.nix20
-rw-r--r--pkgs/tools/misc/man-db/default.nix4
-rw-r--r--pkgs/tools/misc/plantuml-server/default.nix63
-rw-r--r--pkgs/tools/misc/up/default.nix2
-rw-r--r--pkgs/tools/misc/youtube-dl/default.nix10
-rw-r--r--pkgs/tools/networking/frp/default.nix6
-rw-r--r--pkgs/tools/networking/hey/default.nix2
-rw-r--r--pkgs/tools/networking/pirate-get/default.nix4
-rw-r--r--pkgs/tools/networking/tcpdump/default.nix1
-rw-r--r--pkgs/tools/package-management/disnix/disnixos/default.nix4
-rw-r--r--pkgs/tools/package-management/disnix/dysnomia/default.nix6
-rw-r--r--pkgs/tools/security/amber/default.nix6
-rw-r--r--pkgs/tools/security/cariddi/default.nix6
-rw-r--r--pkgs/tools/security/cfripper/default.nix4
-rw-r--r--pkgs/tools/security/exploitdb/default.nix4
-rw-r--r--pkgs/tools/security/gnupg/23.nix16
-rw-r--r--pkgs/tools/security/grype/default.nix6
-rw-r--r--pkgs/tools/security/libtpms/default.nix4
-rw-r--r--pkgs/tools/security/sigma-cli/default.nix4
-rw-r--r--pkgs/tools/security/step-ca/default.nix6
-rw-r--r--pkgs/tools/system/syslog-ng/default.nix4
-rw-r--r--pkgs/tools/text/difftastic/default.nix6
-rw-r--r--pkgs/top-level/aliases.nix1
-rw-r--r--pkgs/top-level/all-packages.nix87
-rw-r--r--pkgs/top-level/python-aliases.nix1
-rw-r--r--pkgs/top-level/python-packages.nix42
309 files changed, 4648 insertions, 2880 deletions
diff --git a/doc/using/overlays.chapter.md b/doc/using/overlays.chapter.md
index df152bc14e7..a51aa9ee8fc 100644
--- a/doc/using/overlays.chapter.md
+++ b/doc/using/overlays.chapter.md
@@ -77,7 +77,7 @@ In Nixpkgs, we have multiple implementations of the BLAS/LAPACK numerical linear
 
     The Nixpkgs attribute is `openblas` for ILP64 (integer width = 64 bits) and `openblasCompat` for LP64 (integer width = 32 bits).  `openblasCompat` is the default.
 
--   [LAPACK reference](http://www.netlib.org/lapack/) (also provides BLAS)
+-   [LAPACK reference](http://www.netlib.org/lapack/) (also provides BLAS and CBLAS)
 
     The Nixpkgs attribute is `lapack-reference`.
 
@@ -117,7 +117,23 @@ $ LD_LIBRARY_PATH=$(nix-build -A mkl)/lib${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH n
 
 Intel MKL requires an `openmp` implementation when running with multiple processors. By default, `mkl` will use Intel's `iomp` implementation if no other is specified, but this is a runtime-only dependency and binary compatible with the LLVM implementation. To use that one instead, Intel recommends users set it with `LD_PRELOAD`. Note that `mkl` is only available on `x86_64-linux` and `x86_64-darwin`. Moreover, Hydra is not building and distributing pre-compiled binaries using it.
 
-For BLAS/LAPACK switching to work correctly, all packages must depend on `blas` or `lapack`. This ensures that only one BLAS/LAPACK library is used at one time. There are two versions of BLAS/LAPACK currently in the wild, `LP64` (integer size = 32 bits) and `ILP64` (integer size = 64 bits). Some software needs special flags or patches to work with `ILP64`. You can check if `ILP64` is used in Nixpkgs with `blas.isILP64` and `lapack.isILP64`. Some software does NOT work with `ILP64`, and derivations need to specify an assertion to prevent this. You can prevent `ILP64` from being used with the following:
+To override `blas` and `lapack` with its reference implementations (i.e. for development purposes), one can use the following overlay:
+
+```nix
+self: super:
+
+{
+  blas = super.blas.override {
+    blasProvider = self.lapack-reference;
+  };
+
+  lapack = super.lapack.override {
+    lapackProvider = self.lapack-reference;
+  };
+}
+```
+
+For BLAS/LAPACK switching to work correctly, all packages must depend on `blas` or `lapack`. This ensures that only one BLAS/LAPACK library is used at one time. There are two versions of BLAS/LAPACK currently in the wild, `LP64` (integer size = 32 bits) and `ILP64` (integer size = 64 bits). The attributes `blas` and `lapack` are `LP64` by default. Their `ILP64` version are provided through the attributes `blas-ilp64` and `lapack-ilp64`. Some software needs special flags or patches to work with `ILP64`. You can check if `ILP64` is used in Nixpkgs with `blas.isILP64` and `lapack.isILP64`. Some software does NOT work with `ILP64`, and derivations need to specify an assertion to prevent this. You can prevent `ILP64` from being used with the following:
 
 ```nix
 { stdenv, blas, lapack, ... }:
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 99b64520ffa..c16ca81e262 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -7241,6 +7241,12 @@
     githubId = 918448;
     name = "Anthony Lodi";
   };
+  loicreynier = {
+    email = "loic@loireynier.fr";
+    github = "loicreynier";
+    githubId = 88983487;
+    name = "Loïc Reynier";
+  };
   lopsided98 = {
     email = "benwolsieffer@gmail.com";
     github = "lopsided98";
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
index 396de8cd77c..41b99c59054 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@@ -306,6 +306,12 @@
           with many features.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <link xlink:href="https://clusterlabs.org/pacemaker/">pacemaker</link>
+          cluster resource manager
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
   <section xml:id="sec-release-22.05-incompatibilities">
@@ -565,6 +571,25 @@
       </listitem>
       <listitem>
         <para>
+          Services in the <literal>hadoop</literal> module previously
+          set <literal>openFirewall</literal> to true by default. This
+          has now been changed to false. Node definitions for multi-node
+          clusters would need <literal>openFirewall = true;</literal> to
+          be added to to hadoop services when upgrading from NixOS
+          21.11.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>services.hadoop.yarn.nodemanager</literal> now uses
+          cgroup-based CPU limit enforcement by default. Additionally,
+          the option <literal>useCGroups</literal> was added to
+          nodemanagers as an easy way to switch back to the old
+          behavior.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
           The <literal>wafHook</literal> hook now honors
           <literal>NIX_BUILD_CORES</literal> when
           <literal>enableParallelBuilding</literal> is not set
@@ -1169,6 +1194,33 @@
       </listitem>
       <listitem>
         <para>
+          Some improvements have been made to the
+          <literal>hadoop</literal> module:
+        </para>
+        <itemizedlist spacing="compact">
+          <listitem>
+            <para>
+              A <literal>gatewayRole</literal> option has been added,
+              for deploying hadoop cluster configuration files to a node
+              that does not have any active services
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              Support for older versions of hadoop have been added to
+              the module
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              Overriding and extending site XML files has been made
+              easier
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
+      <listitem>
+        <para>
           If you are using Wayland you can choose to use the Ozone
           Wayland support in Chrome and several Electron apps by setting
           the environment variable <literal>NIXOS_OZONE_WL=1</literal>
@@ -1450,6 +1502,46 @@
           desktop environments as needed.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          The <literal>hadoop</literal> package has added support for
+          <literal>aarch64-linux</literal> and
+          <literal>aarch64-darwin</literal> as of 3.3.1
+          (<link xlink:href="https://github.com/NixOS/nixpkgs/pull/158613">#158613</link>).
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>R</literal> package now builds again on
+          <literal>aarch64-darwin</literal>
+          (<link xlink:href="https://github.com/NixOS/nixpkgs/pull/158992">#158992</link>).
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>spark3</literal> package has been updated from
+          3.1.2 to 3.2.1
+          (<link xlink:href="https://github.com/NixOS/nixpkgs/pull/160075">#160075</link>):
+        </para>
+        <itemizedlist spacing="compact">
+          <listitem>
+            <para>
+              Testing has been enabled for
+              <literal>aarch64-linux</literal> in addition to
+              <literal>x86_64-linux</literal>.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              The <literal>spark3</literal> package is now usable on
+              <literal>aarch64-darwin</literal> as a result of
+              <link xlink:href="https://github.com/NixOS/nixpkgs/pull/158613">#158613</link>
+              and
+              <link xlink:href="https://github.com/NixOS/nixpkgs/pull/158992">#158992</link>.
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
     </itemizedlist>
   </section>
 </section>
diff --git a/nixos/doc/manual/release-notes/rl-2205.section.md b/nixos/doc/manual/release-notes/rl-2205.section.md
index 2f730de737c..3c4652ae5c4 100644
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@@ -87,6 +87,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [blocky](https://0xerr0r.github.io/blocky/), fast and lightweight DNS proxy as ad-blocker for local network with many features.
 
+- [pacemaker](https://clusterlabs.org/pacemaker/) cluster resource manager
+
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
 ## Backward Incompatibilities {#sec-release-22.05-incompatibilities}
@@ -242,6 +244,14 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - The MoinMoin wiki engine (`services.moinmoin`) has been removed, because Python 2 is being retired from nixpkgs.
 
+- Services in the `hadoop` module previously set `openFirewall` to true by default.
+  This has now been changed to false. Node definitions for multi-node clusters would need
+  `openFirewall = true;` to be added to to hadoop services when upgrading from NixOS 21.11.
+
+- `services.hadoop.yarn.nodemanager` now uses cgroup-based CPU limit enforcement by default.
+  Additionally, the option `useCGroups` was added to nodemanagers as an easy way to switch
+  back to the old behavior.
+
 - The `wafHook` hook now honors `NIX_BUILD_CORES` when `enableParallelBuilding` is not set explicitly. Packages can restore the old behaviour by setting `enableParallelBuilding=false`.
 
 - `pkgs.claws-mail-gtk2`, representing Claws Mail's older release version three, was removed in order to get rid of Python 2.
@@ -434,6 +444,11 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - The `writers.writePyPy2`/`writers.writePyPy3` and corresponding `writers.writePyPy2Bin`/`writers.writePyPy3Bin` convenience functions to create executable Python 2/3 scripts using the PyPy interpreter were added.
 
+- Some improvements have been made to the `hadoop` module:
+  - A `gatewayRole` option has been added, for deploying hadoop cluster configuration files to a node that does not have any active services
+  - Support for older versions of hadoop have been added to the module
+  - Overriding and extending site XML files has been made easier
+
 - If you are using Wayland you can choose to use the Ozone Wayland support
   in Chrome and several Electron apps by setting the environment variable
   `NIXOS_OZONE_WL=1` (for example via
@@ -535,4 +550,13 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - The polkit service, available at `security.polkit.enable`, is now disabled by default. It will automatically be enabled through services and desktop environments as needed.
 
+- The `hadoop` package has added support for `aarch64-linux` and `aarch64-darwin` as of 3.3.1 ([#158613](https://github.com/NixOS/nixpkgs/pull/158613)).
+
+- The `R` package now builds again on `aarch64-darwin` ([#158992](https://github.com/NixOS/nixpkgs/pull/158992)).
+
+- The `spark3` package has been updated from 3.1.2 to 3.2.1 ([#160075](https://github.com/NixOS/nixpkgs/pull/160075)):
+
+  - Testing has been enabled for `aarch64-linux` in addition to `x86_64-linux`.
+  - The `spark3` package is now usable on `aarch64-darwin` as a result of [#158613](https://github.com/NixOS/nixpkgs/pull/158613) and [#158992](https://github.com/NixOS/nixpkgs/pull/158992).
+
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
diff --git a/nixos/modules/misc/version.nix b/nixos/modules/misc/version.nix
index 6c072021ed8..d825f4beb30 100644
--- a/nixos/modules/misc/version.nix
+++ b/nixos/modules/misc/version.nix
@@ -8,8 +8,12 @@ let
     concatStringsSep mapAttrsToList toLower
     literalExpression mkRenamedOptionModule mkDefault mkOption trivial types;
 
+  needsEscaping = s: null != builtins.match "[a-zA-Z0-9]+" s;
+  escapeIfNeccessary = s: if needsEscaping s then s else ''"${lib.escape [ "\$" "\"" "\\" "\`" ] s}"'';
   attrsToText = attrs:
-    concatStringsSep "\n" (mapAttrsToList (n: v: ''${n}="${toString v}"'') attrs);
+    concatStringsSep "\n" (
+      mapAttrsToList (n: v: ''${n}=${escapeIfNeccessary (toString v)}'') attrs
+    );
 
 in
 {
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 13703968167..68f9c6c1227 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -302,6 +302,7 @@
   ./services/backup/znapzend.nix
   ./services/blockchain/ethereum/geth.nix
   ./services/backup/zrepl.nix
+  ./services/cluster/corosync/default.nix
   ./services/cluster/hadoop/default.nix
   ./services/cluster/k3s/default.nix
   ./services/cluster/kubernetes/addons/dns.nix
@@ -314,6 +315,7 @@
   ./services/cluster/kubernetes/pki.nix
   ./services/cluster/kubernetes/proxy.nix
   ./services/cluster/kubernetes/scheduler.nix
+  ./services/cluster/pacemaker/default.nix
   ./services/cluster/spark/default.nix
   ./services/computing/boinc/client.nix
   ./services/computing/foldingathome/client.nix
diff --git a/nixos/modules/services/cluster/corosync/default.nix b/nixos/modules/services/cluster/corosync/default.nix
new file mode 100644
index 00000000000..b4144917fee
--- /dev/null
+++ b/nixos/modules/services/cluster/corosync/default.nix
@@ -0,0 +1,112 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+let
+  cfg = config.services.corosync;
+in
+{
+  # interface
+  options.services.corosync = {
+    enable = mkEnableOption "corosync";
+
+    package = mkOption {
+      type = types.package;
+      default = pkgs.corosync;
+      defaultText = literalExpression "pkgs.corosync";
+      description = "Package that should be used for corosync.";
+    };
+
+    clusterName = mkOption {
+      type = types.str;
+      default = "nixcluster";
+      description = "Name of the corosync cluster.";
+    };
+
+    extraOptions = mkOption {
+      type = with types; listOf str;
+      default = [];
+      description = "Additional options with which to start corosync.";
+    };
+
+    nodelist = mkOption {
+      description = "Corosync nodelist: all cluster members.";
+      default = [];
+      type = with types; listOf (submodule {
+        options = {
+          nodeid = mkOption {
+            type = int;
+            description = "Node ID number";
+          };
+          name = mkOption {
+            type = str;
+            description = "Node name";
+          };
+          ring_addrs = mkOption {
+            type = listOf str;
+            description = "List of addresses, one for each ring.";
+          };
+        };
+      });
+    };
+  };
+
+  # implementation
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+
+    environment.etc."corosync/corosync.conf".text = ''
+      totem {
+        version: 2
+        secauth: on
+        cluster_name: ${cfg.clusterName}
+        transport: knet
+      }
+
+      nodelist {
+        ${concatMapStrings ({ nodeid, name, ring_addrs }: ''
+          node {
+            nodeid: ${toString nodeid}
+            name: ${name}
+            ${concatStrings (imap0 (i: addr: ''
+              ring${toString i}_addr: ${addr}
+            '') ring_addrs)}
+          }
+        '') cfg.nodelist}
+      }
+
+      quorum {
+        # only corosync_votequorum is supported
+        provider: corosync_votequorum
+        wait_for_all: 0
+        ${optionalString (builtins.length cfg.nodelist < 3) ''
+          two_node: 1
+        ''}
+      }
+
+      logging {
+        to_syslog: yes
+      }
+    '';
+
+    environment.etc."corosync/uidgid.d/root".text = ''
+      # allow pacemaker connection by root
+      uidgid {
+        uid: 0
+        gid: 0
+      }
+    '';
+
+    systemd.packages = [ cfg.package ];
+    systemd.services.corosync = {
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        StateDirectory = "corosync";
+        StateDirectoryMode = "0700";
+      };
+    };
+
+    environment.etc."sysconfig/corosync".text = lib.optionalString (cfg.extraOptions != []) ''
+      COROSYNC_OPTIONS="${lib.escapeShellArgs cfg.extraOptions}"
+    '';
+  };
+}
diff --git a/nixos/modules/services/cluster/hadoop/conf.nix b/nixos/modules/services/cluster/hadoop/conf.nix
index 0caec5cfc20..e3c26a0d550 100644
--- a/nixos/modules/services/cluster/hadoop/conf.nix
+++ b/nixos/modules/services/cluster/hadoop/conf.nix
@@ -1,6 +1,6 @@
 { cfg, pkgs, lib }:
 let
-  propertyXml = name: value: ''
+  propertyXml = name: value: lib.optionalString (value != null) ''
     <property>
       <name>${name}</name>
       <value>${builtins.toString value}</value>
@@ -29,16 +29,16 @@ let
     export HADOOP_LOG_DIR=/tmp/hadoop/$USER
   '';
 in
-pkgs.runCommand "hadoop-conf" {} ''
+pkgs.runCommand "hadoop-conf" {} (with cfg; ''
   mkdir -p $out/
-  cp ${siteXml "core-site.xml" cfg.coreSite}/* $out/
-  cp ${siteXml "hdfs-site.xml" cfg.hdfsSite}/* $out/
-  cp ${siteXml "mapred-site.xml" cfg.mapredSite}/* $out/
-  cp ${siteXml "yarn-site.xml" cfg.yarnSite}/* $out/
-  cp ${siteXml "httpfs-site.xml" cfg.httpfsSite}/* $out/
-  cp ${cfgFile "container-executor.cfg" cfg.containerExecutorCfg}/* $out/
+  cp ${siteXml "core-site.xml" (coreSite // coreSiteInternal)}/* $out/
+  cp ${siteXml "hdfs-site.xml" (hdfsSiteDefault // hdfsSite // hdfsSiteInternal)}/* $out/
+  cp ${siteXml "mapred-site.xml" (mapredSiteDefault // mapredSite)}/* $out/
+  cp ${siteXml "yarn-site.xml" (yarnSiteDefault // yarnSite // yarnSiteInternal)}/* $out/
+  cp ${siteXml "httpfs-site.xml" httpfsSite}/* $out/
+  cp ${cfgFile "container-executor.cfg" containerExecutorCfg}/* $out/
   cp ${pkgs.writeTextDir "hadoop-user-functions.sh" userFunctions}/* $out/
   cp ${pkgs.writeTextDir "hadoop-env.sh" hadoopEnv}/* $out/
-  cp ${cfg.log4jProperties} $out/log4j.properties
-  ${lib.concatMapStringsSep "\n" (dir: "cp -r ${dir}/* $out/") cfg.extraConfDirs}
-''
+  cp ${log4jProperties} $out/log4j.properties
+  ${lib.concatMapStringsSep "\n" (dir: "cp -r ${dir}/* $out/") extraConfDirs}
+'')
diff --git a/nixos/modules/services/cluster/hadoop/default.nix b/nixos/modules/services/cluster/hadoop/default.nix
index a1a95fe31ca..a4fdea81037 100644
--- a/nixos/modules/services/cluster/hadoop/default.nix
+++ b/nixos/modules/services/cluster/hadoop/default.nix
@@ -21,24 +21,50 @@ with lib;
         <link xlink:href="https://hadoop.apache.org/docs/current/hadoop-project-dist/hadoop-common/core-default.xml"/>
       '';
     };
+    coreSiteInternal = mkOption {
+      default = {};
+      type = types.attrsOf types.anything;
+      internal = true;
+      description = ''
+        Internal option to add configs to core-site.xml based on module options
+      '';
+    };
 
-    hdfsSite = mkOption {
+    hdfsSiteDefault = mkOption {
       default = {
         "dfs.namenode.rpc-bind-host" = "0.0.0.0";
+        "dfs.namenode.http-address" = "0.0.0.0:9870";
+        "dfs.namenode.servicerpc-bind-host" = "0.0.0.0";
+        "dfs.namenode.http-bind-host" = "0.0.0.0";
       };
       type = types.attrsOf types.anything;
+      description = ''
+        Default options for hdfs-site.xml
+      '';
+    };
+    hdfsSite = mkOption {
+      default = {};
+      type = types.attrsOf types.anything;
       example = literalExpression ''
         {
           "dfs.nameservices" = "namenode1";
         }
       '';
       description = ''
-        Hadoop hdfs-site.xml definition
+        Additional options and overrides for hdfs-site.xml
         <link xlink:href="https://hadoop.apache.org/docs/current/hadoop-project-dist/hadoop-hdfs/hdfs-default.xml"/>
       '';
     };
+    hdfsSiteInternal = mkOption {
+      default = {};
+      type = types.attrsOf types.anything;
+      internal = true;
+      description = ''
+        Internal option to add configs to hdfs-site.xml based on module options
+      '';
+    };
 
-    mapredSite = mkOption {
+    mapredSiteDefault = mkOption {
       default = {
         "mapreduce.framework.name" = "yarn";
         "yarn.app.mapreduce.am.env" = "HADOOP_MAPRED_HOME=${cfg.package}/lib/${cfg.package.untarDir}";
@@ -54,18 +80,25 @@ with lib;
         }
       '';
       type = types.attrsOf types.anything;
+      description = ''
+        Default options for mapred-site.xml
+      '';
+    };
+    mapredSite = mkOption {
+      default = {};
+      type = types.attrsOf types.anything;
       example = literalExpression ''
-        options.services.hadoop.mapredSite.default // {
+        {
           "mapreduce.map.java.opts" = "-Xmx900m -XX:+UseParallelGC";
         }
       '';
       description = ''
-        Hadoop mapred-site.xml definition
+        Additional options and overrides for mapred-site.xml
         <link xlink:href="https://hadoop.apache.org/docs/current/hadoop-mapreduce-client/hadoop-mapreduce-client-core/mapred-default.xml"/>
       '';
     };
 
-    yarnSite = mkOption {
+    yarnSiteDefault = mkOption {
       default = {
         "yarn.nodemanager.admin-env" = "PATH=$PATH";
         "yarn.nodemanager.aux-services" = "mapreduce_shuffle";
@@ -77,19 +110,34 @@ with lib;
         "yarn.nodemanager.linux-container-executor.path" = "/run/wrappers/yarn-nodemanager/bin/container-executor";
         "yarn.nodemanager.log-dirs" = "/var/log/hadoop/yarn/nodemanager";
         "yarn.resourcemanager.bind-host" = "0.0.0.0";
-        "yarn.resourcemanager.scheduler.class" = "org.apache.hadoop.yarn.server.resourcemanager.scheduler.fifo.FifoScheduler";
+        "yarn.resourcemanager.scheduler.class" = "org.apache.hadoop.yarn.server.resourcemanager.scheduler.fair.FairScheduler";
       };
       type = types.attrsOf types.anything;
+      description = ''
+        Default options for yarn-site.xml
+      '';
+    };
+    yarnSite = mkOption {
+      default = {};
+      type = types.attrsOf types.anything;
       example = literalExpression ''
-        options.services.hadoop.yarnSite.default // {
+        {
           "yarn.resourcemanager.hostname" = "''${config.networking.hostName}";
         }
       '';
       description = ''
-        Hadoop yarn-site.xml definition
+        Additional options and overrides for yarn-site.xml
         <link xlink:href="https://hadoop.apache.org/docs/current/hadoop-yarn/hadoop-yarn-common/yarn-default.xml"/>
       '';
     };
+    yarnSiteInternal = mkOption {
+      default = {};
+      type = types.attrsOf types.anything;
+      internal = true;
+      description = ''
+        Internal option to add configs to yarn-site.xml based on module options
+      '';
+    };
 
     httpfsSite = mkOption {
       default = { };
@@ -123,6 +171,7 @@ with lib;
         "yarn.nodemanager.linux-container-executor.group"="hadoop";
         "min.user.id"=1000;
         "feature.terminal.enabled"=1;
+        "feature.mount-cgroup.enabled" = 1;
       };
       type = types.attrsOf types.anything;
       example = literalExpression ''
@@ -148,6 +197,8 @@ with lib;
       description = "Directories containing additional config files to be added to HADOOP_CONF_DIR";
     };
 
+    gatewayRole.enable = mkEnableOption "gateway role for deploying hadoop configs";
+
     package = mkOption {
       type = types.package;
       default = pkgs.hadoop;
@@ -157,20 +208,16 @@ with lib;
   };
 
 
-  config = mkMerge [
-    (mkIf (builtins.hasAttr "yarn" config.users.users ||
-           builtins.hasAttr "hdfs" config.users.users ||
-           builtins.hasAttr "httpfs" config.users.users) {
-      users.groups.hadoop = {
-        gid = config.ids.gids.hadoop;
-      };
-      environment = {
-        systemPackages = [ cfg.package ];
-        etc."hadoop-conf".source = let
-          hadoopConf = "${import ./conf.nix { inherit cfg pkgs lib; }}/";
-        in "${hadoopConf}";
-      };
-    })
-
-  ];
+  config = mkIf cfg.gatewayRole.enable {
+    users.groups.hadoop = {
+      gid = config.ids.gids.hadoop;
+    };
+    environment = {
+      systemPackages = [ cfg.package ];
+      etc."hadoop-conf".source = let
+        hadoopConf = "${import ./conf.nix { inherit cfg pkgs lib; }}/";
+      in "${hadoopConf}";
+      variables.HADOOP_CONF_DIR = "/etc/hadoop-conf/";
+    };
+  };
 }
diff --git a/nixos/modules/services/cluster/hadoop/hdfs.nix b/nixos/modules/services/cluster/hadoop/hdfs.nix
index be667aa82d8..325a002ad32 100644
--- a/nixos/modules/services/cluster/hadoop/hdfs.nix
+++ b/nixos/modules/services/cluster/hadoop/hdfs.nix
@@ -1,191 +1,191 @@
-{ config, lib, pkgs, ...}:
+{ config, lib, pkgs, ... }:
 with lib;
 let
   cfg = config.services.hadoop;
+
+  # Config files for hadoop services
   hadoopConf = "${import ./conf.nix { inherit cfg pkgs lib; }}/";
-  restartIfChanged  = mkOption {
-    type = types.bool;
-    description = ''
-      Automatically restart the service on config change.
-      This can be set to false to defer restarts on clusters running critical applications.
-      Please consider the security implications of inadvertently running an older version,
-      and the possibility of unexpected behavior caused by inconsistent versions across a cluster when disabling this option.
-    '';
-    default = false;
-  };
+
+  # Generator for HDFS service options
+  hadoopServiceOption = { serviceName, firewallOption ? true, extraOpts ? null }: {
+    enable = mkEnableOption serviceName;
+    restartIfChanged = mkOption {
+      type = types.bool;
+      description = ''
+        Automatically restart the service on config change.
+        This can be set to false to defer restarts on clusters running critical applications.
+        Please consider the security implications of inadvertently running an older version,
+        and the possibility of unexpected behavior caused by inconsistent versions across a cluster when disabling this option.
+      '';
+      default = false;
+    };
+    extraFlags = mkOption{
+      type = with types; listOf str;
+      default = [];
+      description = "Extra command line flags to pass to ${serviceName}";
+      example = [
+        "-Dcom.sun.management.jmxremote"
+        "-Dcom.sun.management.jmxremote.port=8010"
+      ];
+    };
+    extraEnv = mkOption{
+      type = with types; attrsOf str;
+      default = {};
+      description = "Extra environment variables for ${serviceName}";
+    };
+  } // (optionalAttrs firewallOption {
+    openFirewall = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Open firewall ports for ${serviceName}.";
+    };
+  }) // (optionalAttrs (extraOpts != null) extraOpts);
+
+  # Generator for HDFS service configs
+  hadoopServiceConfig =
+    { name
+    , serviceOptions ? cfg.hdfs."${toLower name}"
+    , description ? "Hadoop HDFS ${name}"
+    , User ? "hdfs"
+    , allowedTCPPorts ? [ ]
+    , preStart ? ""
+    , environment ? { }
+    , extraConfig ? { }
+    }: (
+
+      mkIf serviceOptions.enable ( mkMerge [{
+        systemd.services."hdfs-${toLower name}" = {
+          inherit description preStart;
+          environment = environment // serviceOptions.extraEnv;
+          wantedBy = [ "multi-user.target" ];
+          inherit (serviceOptions) restartIfChanged;
+          serviceConfig = {
+            inherit User;
+            SyslogIdentifier = "hdfs-${toLower name}";
+            ExecStart = "${cfg.package}/bin/hdfs --config ${hadoopConf} ${toLower name} ${escapeShellArgs serviceOptions.extraFlags}";
+            Restart = "always";
+          };
+        };
+
+        services.hadoop.gatewayRole.enable = true;
+
+        networking.firewall.allowedTCPPorts = mkIf
+          ((builtins.hasAttr "openFirewall" serviceOptions) && serviceOptions.openFirewall)
+          allowedTCPPorts;
+      } extraConfig])
+    );
+
 in
 {
   options.services.hadoop.hdfs = {
-    namenode = {
-      enable = mkEnableOption "Whether to run the HDFS NameNode";
+
+    namenode = hadoopServiceOption { serviceName = "HDFS NameNode"; } // {
       formatOnInit = mkOption {
         type = types.bool;
         default = false;
         description = ''
-          Format HDFS namenode on first start. This is useful for quickly spinning up ephemeral HDFS clusters with a single namenode.
-          For HA clusters, initialization involves multiple steps across multiple nodes. Follow [this guide](https://hadoop.apache.org/docs/stable/hadoop-project-dist/hadoop-hdfs/HDFSHighAvailabilityWithQJM.html)
-          to initialize an HA cluster manually.
-        '';
-      };
-      inherit restartIfChanged;
-      openFirewall = mkOption {
-        type = types.bool;
-        default = true;
-        description = ''
-          Open firewall ports for namenode
-        '';
-      };
-    };
-    datanode = {
-      enable = mkEnableOption "Whether to run the HDFS DataNode";
-      inherit restartIfChanged;
-      openFirewall = mkOption {
-        type = types.bool;
-        default = true;
-        description = ''
-          Open firewall ports for datanode
+          Format HDFS namenode on first start. This is useful for quickly spinning up
+          ephemeral HDFS clusters with a single namenode.
+          For HA clusters, initialization involves multiple steps across multiple nodes.
+          Follow this guide to initialize an HA cluster manually:
+          <link xlink:href="https://hadoop.apache.org/docs/stable/hadoop-project-dist/hadoop-hdfs/HDFSHighAvailabilityWithQJM.html"/>
         '';
       };
     };
-    journalnode = {
-      enable = mkEnableOption "Whether to run the HDFS JournalNode";
-      inherit restartIfChanged;
-      openFirewall = mkOption {
-        type = types.bool;
-        default = true;
-        description = ''
-          Open firewall ports for journalnode
-        '';
+
+    datanode = hadoopServiceOption { serviceName = "HDFS DataNode"; } // {
+      dataDirs = mkOption {
+        default = null;
+        description = "Tier and path definitions for datanode storage.";
+        type = with types; nullOr (listOf (submodule {
+          options = {
+            type = mkOption {
+              type = enum [ "SSD" "DISK" "ARCHIVE" "RAM_DISK" ];
+              description = ''
+                Storage types ([SSD]/[DISK]/[ARCHIVE]/[RAM_DISK]) for HDFS storage policies.
+              '';
+            };
+            path = mkOption {
+              type = path;
+              example = [ "/var/lib/hadoop/hdfs/dn" ];
+              description = "Determines where on the local filesystem a data node should store its blocks.";
+            };
+          };
+        }));
       };
     };
-    zkfc = {
-      enable = mkEnableOption "Whether to run the HDFS ZooKeeper failover controller";
-      inherit restartIfChanged;
+
+    journalnode = hadoopServiceOption { serviceName = "HDFS JournalNode"; };
+
+    zkfc = hadoopServiceOption {
+      serviceName = "HDFS ZooKeeper failover controller";
+      firewallOption = false;
     };
-    httpfs = {
-      enable = mkEnableOption "Whether to run the HDFS HTTPfs server";
+
+    httpfs = hadoopServiceOption { serviceName = "HDFS JournalNode"; } // {
       tempPath = mkOption {
         type = types.path;
         default = "/tmp/hadoop/httpfs";
-        description = ''
-          HTTPFS_TEMP path used by HTTPFS
-        '';
-      };
-      inherit restartIfChanged;
-      openFirewall = mkOption {
-        type = types.bool;
-        default = true;
-        description = ''
-          Open firewall ports for HTTPFS
-        '';
+        description = "HTTPFS_TEMP path used by HTTPFS";
       };
     };
+
   };
 
   config = mkMerge [
-    (mkIf cfg.hdfs.namenode.enable {
-      systemd.services.hdfs-namenode = {
-        description = "Hadoop HDFS NameNode";
-        wantedBy = [ "multi-user.target" ];
-        inherit (cfg.hdfs.namenode) restartIfChanged;
-
-        preStart = (mkIf cfg.hdfs.namenode.formatOnInit ''
-          ${cfg.package}/bin/hdfs --config ${hadoopConf} namenode -format -nonInteractive || true
-        '');
-
-        serviceConfig = {
-          User = "hdfs";
-          SyslogIdentifier = "hdfs-namenode";
-          ExecStart = "${cfg.package}/bin/hdfs --config ${hadoopConf} namenode";
-          Restart = "always";
-        };
-      };
-
-      networking.firewall.allowedTCPPorts = (mkIf cfg.hdfs.namenode.openFirewall [
+    (hadoopServiceConfig {
+      name = "NameNode";
+      allowedTCPPorts = [
         9870 # namenode.http-address
         8020 # namenode.rpc-address
-        8022 # namenode. servicerpc-address
-      ]);
+        8022 # namenode.servicerpc-address
+        8019 # dfs.ha.zkfc.port
+      ];
+      preStart = (mkIf cfg.hdfs.namenode.formatOnInit
+        "${cfg.package}/bin/hdfs --config ${hadoopConf} namenode -format -nonInteractive || true"
+      );
     })
-    (mkIf cfg.hdfs.datanode.enable {
-      systemd.services.hdfs-datanode = {
-        description = "Hadoop HDFS DataNode";
-        wantedBy = [ "multi-user.target" ];
-        inherit (cfg.hdfs.datanode) restartIfChanged;
-
-        serviceConfig = {
-          User = "hdfs";
-          SyslogIdentifier = "hdfs-datanode";
-          ExecStart = "${cfg.package}/bin/hdfs --config ${hadoopConf} datanode";
-          Restart = "always";
-        };
-      };
 
-      networking.firewall.allowedTCPPorts = (mkIf cfg.hdfs.datanode.openFirewall [
+    (hadoopServiceConfig {
+      name = "DataNode";
+      # port numbers for datanode changed between hadoop 2 and 3
+      allowedTCPPorts = if versionAtLeast cfg.package.version "3" then [
         9864 # datanode.http.address
         9866 # datanode.address
         9867 # datanode.ipc.address
-      ]);
+      ] else [
+        50075 # datanode.http.address
+        50010 # datanode.address
+        50020 # datanode.ipc.address
+      ];
+      extraConfig.services.hadoop.hdfsSiteInternal."dfs.datanode.data.dir" = let d = cfg.hdfs.datanode.dataDirs; in
+        if (d!= null) then (concatMapStringsSep "," (x: "["+x.type+"]file://"+x.path) cfg.hdfs.datanode.dataDirs) else d;
     })
-    (mkIf cfg.hdfs.journalnode.enable {
-      systemd.services.hdfs-journalnode = {
-        description = "Hadoop HDFS JournalNode";
-        wantedBy = [ "multi-user.target" ];
-        inherit (cfg.hdfs.journalnode) restartIfChanged;
-
-        serviceConfig = {
-          User = "hdfs";
-          SyslogIdentifier = "hdfs-journalnode";
-          ExecStart = "${cfg.package}/bin/hdfs --config ${hadoopConf} journalnode";
-          Restart = "always";
-        };
-      };
 
-      networking.firewall.allowedTCPPorts = (mkIf cfg.hdfs.journalnode.openFirewall [
+    (hadoopServiceConfig {
+      name = "JournalNode";
+      allowedTCPPorts = [
         8480 # dfs.journalnode.http-address
         8485 # dfs.journalnode.rpc-address
-      ]);
+      ];
     })
-    (mkIf cfg.hdfs.zkfc.enable {
-      systemd.services.hdfs-zkfc = {
-        description = "Hadoop HDFS ZooKeeper failover controller";
-        wantedBy = [ "multi-user.target" ];
-        inherit (cfg.hdfs.zkfc) restartIfChanged;
-
-        serviceConfig = {
-          User = "hdfs";
-          SyslogIdentifier = "hdfs-zkfc";
-          ExecStart = "${cfg.package}/bin/hdfs --config ${hadoopConf} zkfc";
-          Restart = "always";
-        };
-      };
-    })
-    (mkIf cfg.hdfs.httpfs.enable {
-      systemd.services.hdfs-httpfs = {
-        description = "Hadoop httpfs";
-        wantedBy = [ "multi-user.target" ];
-        inherit (cfg.hdfs.httpfs) restartIfChanged;
-
-        environment.HTTPFS_TEMP = cfg.hdfs.httpfs.tempPath;
 
-        preStart = ''
-          mkdir -p $HTTPFS_TEMP
-        '';
+    (hadoopServiceConfig {
+      name = "zkfc";
+      description = "Hadoop HDFS ZooKeeper failover controller";
+    })
 
-        serviceConfig = {
-          User = "httpfs";
-          SyslogIdentifier = "hdfs-httpfs";
-          ExecStart = "${cfg.package}/bin/hdfs --config ${hadoopConf} httpfs";
-          Restart = "always";
-        };
-      };
-      networking.firewall.allowedTCPPorts = (mkIf cfg.hdfs.httpfs.openFirewall [
+    (hadoopServiceConfig {
+      name = "HTTPFS";
+      environment.HTTPFS_TEMP = cfg.hdfs.httpfs.tempPath;
+      preStart = "mkdir -p $HTTPFS_TEMP";
+      User = "httpfs";
+      allowedTCPPorts = [
         14000 # httpfs.http.port
-      ]);
+      ];
     })
-    (mkIf (
-        cfg.hdfs.namenode.enable || cfg.hdfs.datanode.enable || cfg.hdfs.journalnode.enable || cfg.hdfs.zkfc.enable
-    ) {
+
+    (mkIf cfg.gatewayRole.enable {
       users.users.hdfs = {
         description = "Hadoop HDFS user";
         group = "hadoop";
@@ -199,5 +199,6 @@ in
         isSystemUser = true;
       };
     })
+
   ];
 }
diff --git a/nixos/modules/services/cluster/hadoop/yarn.nix b/nixos/modules/services/cluster/hadoop/yarn.nix
index 37c26ea10f7..74e16bdec68 100644
--- a/nixos/modules/services/cluster/hadoop/yarn.nix
+++ b/nixos/modules/services/cluster/hadoop/yarn.nix
@@ -13,23 +13,77 @@ let
     '';
     default = false;
   };
+  extraFlags = mkOption{
+    type = with types; listOf str;
+    default = [];
+    description = "Extra command line flags to pass to the service";
+    example = [
+      "-Dcom.sun.management.jmxremote"
+      "-Dcom.sun.management.jmxremote.port=8010"
+    ];
+  };
+  extraEnv = mkOption{
+    type = with types; attrsOf str;
+    default = {};
+    description = "Extra environment variables";
+  };
 in
 {
   options.services.hadoop.yarn = {
     resourcemanager = {
-      enable = mkEnableOption "Whether to run the Hadoop YARN ResourceManager";
-      inherit restartIfChanged;
+      enable = mkEnableOption "Hadoop YARN ResourceManager";
+      inherit restartIfChanged extraFlags extraEnv;
+
       openFirewall = mkOption {
         type = types.bool;
-        default = true;
+        default = false;
         description = ''
           Open firewall ports for resourcemanager
         '';
       };
     };
     nodemanager = {
-      enable = mkEnableOption "Whether to run the Hadoop YARN NodeManager";
-      inherit restartIfChanged;
+      enable = mkEnableOption "Hadoop YARN NodeManager";
+      inherit restartIfChanged extraFlags extraEnv;
+
+      resource = {
+        cpuVCores = mkOption {
+          description = "Number of vcores that can be allocated for containers.";
+          type = with types; nullOr ints.positive;
+          default = null;
+        };
+        maximumAllocationVCores = mkOption {
+          description = "The maximum virtual CPU cores any container can be allocated.";
+          type = with types; nullOr ints.positive;
+          default = null;
+        };
+        memoryMB = mkOption {
+          description = "Amount of physical memory, in MB, that can be allocated for containers.";
+          type = with types; nullOr ints.positive;
+          default = null;
+        };
+        maximumAllocationMB = mkOption {
+          description = "The maximum physical memory any container can be allocated.";
+          type = with types; nullOr ints.positive;
+          default = null;
+        };
+      };
+
+      useCGroups = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Use cgroups to enforce resource limits on containers
+        '';
+      };
+
+      localDir = mkOption {
+        description = "List of directories to store localized files in.";
+        type = with types; nullOr (listOf path);
+        example = [ "/var/lib/hadoop/yarn/nm" ];
+        default = null;
+      };
+
       addBinBash = mkOption {
         type = types.bool;
         default = true;
@@ -39,7 +93,7 @@ in
       };
       openFirewall = mkOption {
         type = types.bool;
-        default = true;
+        default = false;
         description = ''
           Open firewall ports for nodemanager.
           Because containers can listen on any ephemeral port, TCP ports 1024–65535 will be opened.
@@ -49,10 +103,7 @@ in
   };
 
   config = mkMerge [
-    (mkIf (
-        cfg.yarn.resourcemanager.enable || cfg.yarn.nodemanager.enable
-    ) {
-
+    (mkIf cfg.gatewayRole.enable {
       users.users.yarn = {
         description = "Hadoop YARN user";
         group = "hadoop";
@@ -65,15 +116,19 @@ in
         description = "Hadoop YARN ResourceManager";
         wantedBy = [ "multi-user.target" ];
         inherit (cfg.yarn.resourcemanager) restartIfChanged;
+        environment = cfg.yarn.resourcemanager.extraEnv;
 
         serviceConfig = {
           User = "yarn";
           SyslogIdentifier = "yarn-resourcemanager";
           ExecStart = "${cfg.package}/bin/yarn --config ${hadoopConf} " +
-                      " resourcemanager";
+                      " resourcemanager ${escapeShellArgs cfg.yarn.resourcemanager.extraFlags}";
           Restart = "always";
         };
       };
+
+      services.hadoop.gatewayRole.enable = true;
+
       networking.firewall.allowedTCPPorts = (mkIf cfg.yarn.resourcemanager.openFirewall [
         8088 # resourcemanager.webapp.address
         8030 # resourcemanager.scheduler.address
@@ -94,6 +149,7 @@ in
         description = "Hadoop YARN NodeManager";
         wantedBy = [ "multi-user.target" ];
         inherit (cfg.yarn.nodemanager) restartIfChanged;
+        environment = cfg.yarn.nodemanager.extraEnv;
 
         preStart = ''
           # create log dir
@@ -101,8 +157,9 @@ in
           chown yarn:hadoop /var/log/hadoop/yarn/nodemanager
 
           # set up setuid container executor binary
+          umount /run/wrappers/yarn-nodemanager/cgroup/cpu || true
           rm -rf /run/wrappers/yarn-nodemanager/ || true
-          mkdir -p /run/wrappers/yarn-nodemanager/{bin,etc/hadoop}
+          mkdir -p /run/wrappers/yarn-nodemanager/{bin,etc/hadoop,cgroup/cpu}
           cp ${cfg.package}/lib/${cfg.package.untarDir}/bin/container-executor /run/wrappers/yarn-nodemanager/bin/
           chgrp hadoop /run/wrappers/yarn-nodemanager/bin/container-executor
           chmod 6050 /run/wrappers/yarn-nodemanager/bin/container-executor
@@ -114,11 +171,26 @@ in
           SyslogIdentifier = "yarn-nodemanager";
           PermissionsStartOnly = true;
           ExecStart = "${cfg.package}/bin/yarn --config ${hadoopConf} " +
-                      " nodemanager";
+                      " nodemanager ${escapeShellArgs cfg.yarn.nodemanager.extraFlags}";
           Restart = "always";
         };
       };
 
+      services.hadoop.gatewayRole.enable = true;
+
+      services.hadoop.yarnSiteInternal = with cfg.yarn.nodemanager; {
+        "yarn.nodemanager.local-dirs" = localDir;
+        "yarn.scheduler.maximum-allocation-vcores" = resource.maximumAllocationVCores;
+        "yarn.scheduler.maximum-allocation-mb" = resource.maximumAllocationMB;
+        "yarn.nodemanager.resource.cpu-vcores" = resource.cpuVCores;
+        "yarn.nodemanager.resource.memory-mb" = resource.memoryMB;
+      } // mkIf useCGroups {
+        "yarn.nodemanager.linux-container-executor.cgroups.hierarchy" = "/hadoop-yarn";
+        "yarn.nodemanager.linux-container-executor.resources-handler.class" = "org.apache.hadoop.yarn.server.nodemanager.util.CgroupsLCEResourcesHandler";
+        "yarn.nodemanager.linux-container-executor.cgroups.mount" = "true";
+        "yarn.nodemanager.linux-container-executor.cgroups.mount-path" = "/run/wrappers/yarn-nodemanager/cgroup";
+      };
+
       networking.firewall.allowedTCPPortRanges = [
         (mkIf (cfg.yarn.nodemanager.openFirewall) {from = 1024; to = 65535;})
       ];
diff --git a/nixos/modules/services/cluster/pacemaker/default.nix b/nixos/modules/services/cluster/pacemaker/default.nix
new file mode 100644
index 00000000000..7eeadffcc58
--- /dev/null
+++ b/nixos/modules/services/cluster/pacemaker/default.nix
@@ -0,0 +1,52 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+let
+  cfg = config.services.pacemaker;
+in
+{
+  # interface
+  options.services.pacemaker = {
+    enable = mkEnableOption "pacemaker";
+
+    package = mkOption {
+      type = types.package;
+      default = pkgs.pacemaker;
+      defaultText = literalExpression "pkgs.pacemaker";
+      description = "Package that should be used for pacemaker.";
+    };
+  };
+
+  # implementation
+  config = mkIf cfg.enable {
+    assertions = [ {
+      assertion = config.services.corosync.enable;
+      message = ''
+        Enabling services.pacemaker requires a services.corosync configuration.
+      '';
+    } ];
+
+    environment.systemPackages = [ cfg.package ];
+
+    # required by pacemaker
+    users.users.hacluster = {
+      isSystemUser = true;
+      group = "pacemaker";
+      home = "/var/lib/pacemaker";
+    };
+    users.groups.pacemaker = {};
+
+    systemd.tmpfiles.rules = [
+      "d /var/log/pacemaker 0700 hacluster pacemaker -"
+    ];
+
+    systemd.packages = [ cfg.package ];
+    systemd.services.pacemaker = {
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        StateDirectory = "pacemaker";
+        StateDirectoryMode = "0700";
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/web-apps/nextcloud.nix b/nixos/modules/services/web-apps/nextcloud.nix
index 141ab98e29b..b32220a5e57 100644
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@@ -153,7 +153,7 @@ in {
     package = mkOption {
       type = types.package;
       description = "Which package to use for the Nextcloud instance.";
-      relatedPackages = [ "nextcloud21" "nextcloud22" "nextcloud23" ];
+      relatedPackages = [ "nextcloud22" "nextcloud23" ];
     };
     phpPackage = mkOption {
       type = types.package;
@@ -571,15 +571,6 @@ in {
               nextcloud defined in an overlay, please set `services.nextcloud.package` to
               `pkgs.nextcloud`.
             ''
-          # 21.03 will not be an official release - it was instead 21.05.
-          # This versionOlder statement remains set to 21.03 for backwards compatibility.
-          # See https://github.com/NixOS/nixpkgs/pull/108899 and
-          # https://github.com/NixOS/rfcs/blob/master/rfcs/0080-nixos-release-schedule.md.
-          # FIXME(@Ma27) remove this else-if as soon as 21.05 is EOL! This is only here
-          # to ensure that users who are on Nextcloud 19 with a stateVersion <21.05 with
-          # no explicit services.nextcloud.package don't upgrade to v21 by accident (
-          # nextcloud20 throws an eval-error because it's dropped).
-          else if versionOlder stateVersion "21.03" then nextcloud20
           else if versionOlder stateVersion "21.11" then nextcloud21
           else if versionOlder stateVersion "22.05" then nextcloud22
           else nextcloud23
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 98ca2e08108..b2b35119ce3 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -189,9 +189,9 @@ in
   grocy = handleTest ./grocy.nix {};
   grub = handleTest ./grub.nix {};
   gvisor = handleTest ./gvisor.nix {};
-  hadoop.all = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./hadoop/hadoop.nix {};
-  hadoop.hdfs = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./hadoop/hdfs.nix {};
-  hadoop.yarn = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./hadoop/yarn.nix {};
+  hadoop = import ./hadoop { inherit handleTestOn; package=pkgs.hadoop; };
+  hadoop_3_2 = import ./hadoop { inherit handleTestOn; package=pkgs.hadoop_3_2; };
+  hadoop2 = import ./hadoop { inherit handleTestOn; package=pkgs.hadoop2; };
   haka = handleTest ./haka.nix {};
   haproxy = handleTest ./haproxy.nix {};
   hardened = handleTest ./hardened.nix {};
@@ -384,6 +384,7 @@ in
   os-prober = handleTestOn ["x86_64-linux"] ./os-prober.nix {};
   osrm-backend = handleTest ./osrm-backend.nix {};
   overlayfs = handleTest ./overlayfs.nix {};
+  pacemaker = handleTest ./pacemaker.nix {};
   packagekit = handleTest ./packagekit.nix {};
   pam-file-contents = handleTest ./pam/pam-file-contents.nix {};
   pam-oath-login = handleTest ./pam/pam-oath-login.nix {};
@@ -484,7 +485,7 @@ in
   sonarr = handleTest ./sonarr.nix {};
   sourcehut = handleTest ./sourcehut.nix {};
   spacecookie = handleTest ./spacecookie.nix {};
-  spark = handleTestOn ["x86_64-linux"] ./spark {};
+  spark = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./spark {};
   sslh = handleTest ./sslh.nix {};
   sssd = handleTestOn ["x86_64-linux"] ./sssd.nix {};
   sssd-ldap = handleTestOn ["x86_64-linux"] ./sssd-ldap.nix {};
diff --git a/nixos/tests/hadoop/default.nix b/nixos/tests/hadoop/default.nix
new file mode 100644
index 00000000000..d2a97cbeffb
--- /dev/null
+++ b/nixos/tests/hadoop/default.nix
@@ -0,0 +1,7 @@
+{ handleTestOn, package, ... }:
+
+{
+  all = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./hadoop.nix { inherit package; };
+  hdfs = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./hdfs.nix { inherit package; };
+  yarn = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./yarn.nix { inherit package; };
+}
diff --git a/nixos/tests/hadoop/hadoop.nix b/nixos/tests/hadoop/hadoop.nix
index 48737debab5..b132f4fa58b 100644
--- a/nixos/tests/hadoop/hadoop.nix
+++ b/nixos/tests/hadoop/hadoop.nix
@@ -1,121 +1,148 @@
 # This test is very comprehensive. It tests whether all hadoop services work well with each other.
 # Run this when updating the Hadoop package or making significant changes to the hadoop module.
 # For a more basic test, see hdfs.nix and yarn.nix
-import ../make-test-python.nix ({pkgs, ...}: {
-
-  nodes = let
-    package = pkgs.hadoop;
-    coreSite = {
-      "fs.defaultFS" = "hdfs://ns1";
-    };
-    hdfsSite = {
-      "dfs.namenode.rpc-bind-host" = "0.0.0.0";
-      "dfs.namenode.http-bind-host" = "0.0.0.0";
-      "dfs.namenode.servicerpc-bind-host" = "0.0.0.0";
-
-      # HA Quorum Journal Manager configuration
-      "dfs.nameservices" = "ns1";
-      "dfs.ha.namenodes.ns1" = "nn1,nn2";
-      "dfs.namenode.shared.edits.dir.ns1.nn1" = "qjournal://jn1:8485;jn2:8485;jn3:8485/ns1";
-      "dfs.namenode.shared.edits.dir.ns1.nn2" = "qjournal://jn1:8485;jn2:8485;jn3:8485/ns1";
-      "dfs.namenode.rpc-address.ns1.nn1" = "nn1:8020";
-      "dfs.namenode.rpc-address.ns1.nn2" = "nn2:8020";
-      "dfs.namenode.servicerpc-address.ns1.nn1" = "nn1:8022";
-      "dfs.namenode.servicerpc-address.ns1.nn2" = "nn2:8022";
-      "dfs.namenode.http-address.ns1.nn1" = "nn1:9870";
-      "dfs.namenode.http-address.ns1.nn2" = "nn2:9870";
-
-      # Automatic failover configuration
-      "dfs.client.failover.proxy.provider.ns1" = "org.apache.hadoop.hdfs.server.namenode.ha.ConfiguredFailoverProxyProvider";
-      "dfs.ha.automatic-failover.enabled.ns1" = "true";
-      "dfs.ha.fencing.methods" = "shell(true)";
-      "ha.zookeeper.quorum" = "zk1:2181";
-    };
-    yarnSiteHA = {
-      "yarn.resourcemanager.zk-address" = "zk1:2181";
-      "yarn.resourcemanager.ha.enabled" = "true";
-      "yarn.resourcemanager.ha.rm-ids" = "rm1,rm2";
-      "yarn.resourcemanager.hostname.rm1" = "rm1";
-      "yarn.resourcemanager.hostname.rm2" = "rm2";
-      "yarn.resourcemanager.ha.automatic-failover.enabled" = "true";
-      "yarn.resourcemanager.cluster-id" = "cluster1";
-      # yarn.resourcemanager.webapp.address needs to be defined even though yarn.resourcemanager.hostname is set. This shouldn't be necessary, but there's a bug in
-      # hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-web-proxy/src/main/java/org/apache/hadoop/yarn/server/webproxy/amfilter/AmFilterInitializer.java:70
-      # that causes AM containers to fail otherwise.
-      "yarn.resourcemanager.webapp.address.rm1" = "rm1:8088";
-      "yarn.resourcemanager.webapp.address.rm2" = "rm2:8088";
-    };
-  in {
-    zk1 = { ... }: {
-      services.zookeeper.enable = true;
-      networking.firewall.allowedTCPPorts = [ 2181 ];
-    };
-
-    # HDFS cluster
-    nn1 = {pkgs, options, ...}: {
-      services.hadoop = {
-        inherit package coreSite hdfsSite;
-        hdfs.namenode.enable = true;
-        hdfs.zkfc.enable = true;
+import ../make-test-python.nix ({ package, ... }: {
+  name = "hadoop-combined";
+
+  nodes =
+    let
+      coreSite = {
+        "fs.defaultFS" = "hdfs://ns1";
+      };
+      hdfsSite = {
+        # HA Quorum Journal Manager configuration
+        "dfs.nameservices" = "ns1";
+        "dfs.ha.namenodes.ns1" = "nn1,nn2";
+        "dfs.namenode.shared.edits.dir.ns1" = "qjournal://jn1:8485;jn2:8485;jn3:8485/ns1";
+        "dfs.namenode.rpc-address.ns1.nn1" = "nn1:8020";
+        "dfs.namenode.rpc-address.ns1.nn2" = "nn2:8020";
+        "dfs.namenode.servicerpc-address.ns1.nn1" = "nn1:8022";
+        "dfs.namenode.servicerpc-address.ns1.nn2" = "nn2:8022";
+        "dfs.namenode.http-address.ns1.nn1" = "nn1:9870";
+        "dfs.namenode.http-address.ns1.nn2" = "nn2:9870";
+
+        # Automatic failover configuration
+        "dfs.client.failover.proxy.provider.ns1" = "org.apache.hadoop.hdfs.server.namenode.ha.ConfiguredFailoverProxyProvider";
+        "dfs.ha.automatic-failover.enabled.ns1" = "true";
+        "dfs.ha.fencing.methods" = "shell(true)";
+        "ha.zookeeper.quorum" = "zk1:2181";
+      };
+      yarnSite = {
+        "yarn.resourcemanager.zk-address" = "zk1:2181";
+        "yarn.resourcemanager.ha.enabled" = "true";
+        "yarn.resourcemanager.ha.rm-ids" = "rm1,rm2";
+        "yarn.resourcemanager.hostname.rm1" = "rm1";
+        "yarn.resourcemanager.hostname.rm2" = "rm2";
+        "yarn.resourcemanager.ha.automatic-failover.enabled" = "true";
+        "yarn.resourcemanager.cluster-id" = "cluster1";
+        # yarn.resourcemanager.webapp.address needs to be defined even though yarn.resourcemanager.hostname is set. This shouldn't be necessary, but there's a bug in
+        # hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-web-proxy/src/main/java/org/apache/hadoop/yarn/server/webproxy/amfilter/AmFilterInitializer.java:70
+        # that causes AM containers to fail otherwise.
+        "yarn.resourcemanager.webapp.address.rm1" = "rm1:8088";
+        "yarn.resourcemanager.webapp.address.rm2" = "rm2:8088";
+      };
+    in
+    {
+      zk1 = { ... }: {
+        services.zookeeper.enable = true;
+        networking.firewall.allowedTCPPorts = [ 2181 ];
       };
-    };
-    nn2 = {pkgs, options, ...}: {
-      services.hadoop = {
-        inherit package coreSite hdfsSite;
-        hdfs.namenode.enable = true;
-        hdfs.zkfc.enable = true;
+
+      # HDFS cluster
+      nn1 = { ... }: {
+        services.hadoop = {
+          inherit package coreSite hdfsSite;
+          hdfs.namenode = {
+            enable = true;
+            openFirewall = true;
+          };
+          hdfs.zkfc.enable = true;
+        };
+      };
+      nn2 = { ... }: {
+        services.hadoop = {
+          inherit package coreSite hdfsSite;
+          hdfs.namenode = {
+            enable = true;
+            openFirewall = true;
+          };
+          hdfs.zkfc.enable = true;
+        };
       };
-    };
 
-    jn1 = {pkgs, options, ...}: {
-      services.hadoop = {
-        inherit package coreSite hdfsSite;
-        hdfs.journalnode.enable = true;
+      jn1 = { ... }: {
+        services.hadoop = {
+          inherit package coreSite hdfsSite;
+          hdfs.journalnode = {
+            enable = true;
+            openFirewall = true;
+          };
+        };
       };
-    };
-    jn2 = {pkgs, options, ...}: {
-      services.hadoop = {
-        inherit package coreSite hdfsSite;
-        hdfs.journalnode.enable = true;
+      jn2 = { ... }: {
+        services.hadoop = {
+          inherit package coreSite hdfsSite;
+          hdfs.journalnode = {
+            enable = true;
+            openFirewall = true;
+          };
+        };
       };
-    };
-    jn3 = {pkgs, options, ...}: {
-      services.hadoop = {
-        inherit package coreSite hdfsSite;
-        hdfs.journalnode.enable = true;
+      jn3 = { ... }: {
+        services.hadoop = {
+          inherit package coreSite hdfsSite;
+          hdfs.journalnode = {
+            enable = true;
+            openFirewall = true;
+          };
+        };
+      };
+
+      dn1 = { ... }: {
+        services.hadoop = {
+          inherit package coreSite hdfsSite;
+          hdfs.datanode = {
+            enable = true;
+            openFirewall = true;
+          };
+        };
       };
-    };
 
-    dn1 = {pkgs, options, ...}: {
-      services.hadoop = {
-        inherit package coreSite hdfsSite;
-        hdfs.datanode.enable = true;
+      # YARN cluster
+      rm1 = { options, ... }: {
+        services.hadoop = {
+          inherit package coreSite hdfsSite yarnSite;
+          yarn.resourcemanager = {
+            enable = true;
+            openFirewall = true;
+          };
+        };
       };
-    };
-
-    # YARN cluster
-    rm1 = {pkgs, options, ...}: {
-      services.hadoop = {
-        inherit package coreSite hdfsSite;
-        yarnSite = options.services.hadoop.yarnSite.default // yarnSiteHA;
-        yarn.resourcemanager.enable = true;
+      rm2 = { options, ... }: {
+        services.hadoop = {
+          inherit package coreSite hdfsSite yarnSite;
+          yarn.resourcemanager = {
+            enable = true;
+            openFirewall = true;
+          };
+        };
       };
-    };
-    rm2 = {pkgs, options, ...}: {
-      services.hadoop = {
-        inherit package coreSite hdfsSite;
-        yarnSite = options.services.hadoop.yarnSite.default // yarnSiteHA;
-        yarn.resourcemanager.enable = true;
+      nm1 = { options, ... }: {
+        virtualisation.memorySize = 2048;
+        services.hadoop = {
+          inherit package coreSite hdfsSite yarnSite;
+          yarn.nodemanager = {
+            enable = true;
+            openFirewall = true;
+          };
+        };
       };
-    };
-    nm1 = {pkgs, options, ...}: {
-      virtualisation.memorySize = 2048;
-      services.hadoop = {
-        inherit package coreSite hdfsSite;
-        yarnSite = options.services.hadoop.yarnSite.default // yarnSiteHA;
-        yarn.nodemanager.enable = true;
+      client = { options, ... }: {
+        services.hadoop = {
+          gatewayRole.enable = true;
+          inherit package coreSite hdfsSite yarnSite;
+        };
       };
-    };
   };
 
   testScript = ''
@@ -173,26 +200,26 @@ import ../make-test-python.nix ({pkgs, ...}: {
     # DN should have started by now, but confirm anyway
     dn1.wait_for_unit("hdfs-datanode")
     # Print states of namenodes
-    dn1.succeed("sudo -u hdfs hdfs haadmin -getAllServiceState | systemd-cat")
+    client.succeed("sudo -u hdfs hdfs haadmin -getAllServiceState | systemd-cat")
     # Wait for cluster to exit safemode
-    dn1.succeed("sudo -u hdfs hdfs dfsadmin -safemode wait")
-    dn1.succeed("sudo -u hdfs hdfs haadmin -getAllServiceState | systemd-cat")
+    client.succeed("sudo -u hdfs hdfs dfsadmin -safemode wait")
+    client.succeed("sudo -u hdfs hdfs haadmin -getAllServiceState | systemd-cat")
     # test R/W
-    dn1.succeed("echo testfilecontents | sudo -u hdfs hdfs dfs -put - /testfile")
-    assert "testfilecontents" in dn1.succeed("sudo -u hdfs hdfs dfs -cat /testfile")
+    client.succeed("echo testfilecontents | sudo -u hdfs hdfs dfs -put - /testfile")
+    assert "testfilecontents" in client.succeed("sudo -u hdfs hdfs dfs -cat /testfile")
 
     # Test NN failover
     nn1.succeed("systemctl stop hdfs-namenode")
-    assert "active" in dn1.succeed("sudo -u hdfs hdfs haadmin -getAllServiceState")
-    dn1.succeed("sudo -u hdfs hdfs haadmin -getAllServiceState | systemd-cat")
-    assert "testfilecontents" in dn1.succeed("sudo -u hdfs hdfs dfs -cat /testfile")
+    assert "active" in client.succeed("sudo -u hdfs hdfs haadmin -getAllServiceState")
+    client.succeed("sudo -u hdfs hdfs haadmin -getAllServiceState | systemd-cat")
+    assert "testfilecontents" in client.succeed("sudo -u hdfs hdfs dfs -cat /testfile")
 
     nn1.succeed("systemctl start hdfs-namenode")
     nn1.wait_for_open_port(9870)
     nn1.wait_for_open_port(8022)
     nn1.wait_for_open_port(8020)
-    assert "standby" in dn1.succeed("sudo -u hdfs hdfs haadmin -getAllServiceState")
-    dn1.succeed("sudo -u hdfs hdfs haadmin -getAllServiceState | systemd-cat")
+    assert "standby" in client.succeed("sudo -u hdfs hdfs haadmin -getAllServiceState")
+    client.succeed("sudo -u hdfs hdfs haadmin -getAllServiceState | systemd-cat")
 
     #### YARN tests ####
 
@@ -208,21 +235,21 @@ import ../make-test-python.nix ({pkgs, ...}: {
     nm1.wait_for_unit("yarn-nodemanager")
     nm1.wait_for_open_port(8042)
     nm1.wait_for_open_port(8040)
-    nm1.wait_until_succeeds("yarn node -list | grep Nodes:1")
-    nm1.succeed("sudo -u yarn yarn rmadmin -getAllServiceState | systemd-cat")
-    nm1.succeed("sudo -u yarn yarn node -list | systemd-cat")
+    client.wait_until_succeeds("yarn node -list | grep Nodes:1")
+    client.succeed("sudo -u yarn yarn rmadmin -getAllServiceState | systemd-cat")
+    client.succeed("sudo -u yarn yarn node -list | systemd-cat")
 
     # Test RM failover
     rm1.succeed("systemctl stop yarn-resourcemanager")
-    assert "standby" not in nm1.succeed("sudo -u yarn yarn rmadmin -getAllServiceState")
-    nm1.succeed("sudo -u yarn yarn rmadmin -getAllServiceState | systemd-cat")
+    assert "standby" not in client.succeed("sudo -u yarn yarn rmadmin -getAllServiceState")
+    client.succeed("sudo -u yarn yarn rmadmin -getAllServiceState | systemd-cat")
     rm1.succeed("systemctl start yarn-resourcemanager")
     rm1.wait_for_unit("yarn-resourcemanager")
     rm1.wait_for_open_port(8088)
-    assert "standby" in nm1.succeed("sudo -u yarn yarn rmadmin -getAllServiceState")
-    nm1.succeed("sudo -u yarn yarn rmadmin -getAllServiceState | systemd-cat")
+    assert "standby" in client.succeed("sudo -u yarn yarn rmadmin -getAllServiceState")
+    client.succeed("sudo -u yarn yarn rmadmin -getAllServiceState | systemd-cat")
 
-    assert "Estimated value of Pi is" in nm1.succeed("HADOOP_USER_NAME=hdfs yarn jar $(readlink $(which yarn) | sed -r 's~bin/yarn~lib/hadoop-*/share/hadoop/mapreduce/hadoop-mapreduce-examples-*.jar~g') pi 2 10")
-    assert "SUCCEEDED" in nm1.succeed("yarn application -list -appStates FINISHED")
+    assert "Estimated value of Pi is" in client.succeed("HADOOP_USER_NAME=hdfs yarn jar $(readlink $(which yarn) | sed -r 's~bin/yarn~lib/hadoop-*/share/hadoop/mapreduce/hadoop-mapreduce-examples-*.jar~g') pi 2 10")
+    assert "SUCCEEDED" in client.succeed("yarn application -list -appStates FINISHED")
   '';
 })
diff --git a/nixos/tests/hadoop/hdfs.nix b/nixos/tests/hadoop/hdfs.nix
index b63cbf48032..9415500463d 100644
--- a/nixos/tests/hadoop/hdfs.nix
+++ b/nixos/tests/hadoop/hdfs.nix
@@ -1,32 +1,46 @@
 # Test a minimal HDFS cluster with no HA
-import ../make-test-python.nix ({...}: {
-  nodes = {
-    namenode = {pkgs, ...}: {
+import ../make-test-python.nix ({ package, lib, ... }:
+with lib;
+{
+  name = "hadoop-hdfs";
+
+  nodes = let
+    coreSite = {
+      "fs.defaultFS" = "hdfs://namenode:8020";
+      "hadoop.proxyuser.httpfs.groups" = "*";
+      "hadoop.proxyuser.httpfs.hosts" = "*";
+    };
+    in {
+    namenode = { pkgs, ... }: {
       services.hadoop = {
-        package = pkgs.hadoop;
+        inherit package;
         hdfs = {
           namenode = {
             enable = true;
+            openFirewall = true;
             formatOnInit = true;
           };
-          httpfs.enable = true;
-        };
-        coreSite = {
-          "fs.defaultFS" = "hdfs://namenode:8020";
-          "hadoop.proxyuser.httpfs.groups" = "*";
-          "hadoop.proxyuser.httpfs.hosts" = "*";
+          httpfs = {
+            # The NixOS hadoop module only support webHDFS on 3.3 and newer
+            enable = mkIf (versionAtLeast package.version "3.3") true;
+            openFirewall = true;
+          };
         };
+        inherit coreSite;
       };
     };
-    datanode = {pkgs, ...}: {
+    datanode = { pkgs, ... }: {
       services.hadoop = {
-        package = pkgs.hadoop;
-        hdfs.datanode.enable = true;
-        coreSite = {
-          "fs.defaultFS" = "hdfs://namenode:8020";
-          "hadoop.proxyuser.httpfs.groups" = "*";
-          "hadoop.proxyuser.httpfs.hosts" = "*";
+        inherit package;
+        hdfs.datanode = {
+          enable = true;
+          openFirewall = true;
+          dataDirs = [{
+            type = "DISK";
+            path = "/tmp/dn1";
+          }];
         };
+        inherit coreSite;
       };
     };
   };
@@ -37,21 +51,32 @@ import ../make-test-python.nix ({...}: {
     namenode.wait_for_unit("hdfs-namenode")
     namenode.wait_for_unit("network.target")
     namenode.wait_for_open_port(8020)
+    namenode.succeed("ss -tulpne | systemd-cat")
+    namenode.succeed("cat /etc/hadoop*/hdfs-site.xml | systemd-cat")
     namenode.wait_for_open_port(9870)
 
     datanode.wait_for_unit("hdfs-datanode")
     datanode.wait_for_unit("network.target")
+  '' + ( if versionAtLeast package.version "3" then ''
     datanode.wait_for_open_port(9864)
     datanode.wait_for_open_port(9866)
     datanode.wait_for_open_port(9867)
 
-    namenode.succeed("curl -f http://namenode:9870")
     datanode.succeed("curl -f http://datanode:9864")
+  '' else ''
+    datanode.wait_for_open_port(50075)
+    datanode.wait_for_open_port(50010)
+    datanode.wait_for_open_port(50020)
+
+    datanode.succeed("curl -f http://datanode:50075")
+  '' ) + ''
+    namenode.succeed("curl -f http://namenode:9870")
 
     datanode.succeed("sudo -u hdfs hdfs dfsadmin -safemode wait")
     datanode.succeed("echo testfilecontents | sudo -u hdfs hdfs dfs -put - /testfile")
     assert "testfilecontents" in datanode.succeed("sudo -u hdfs hdfs dfs -cat /testfile")
 
+  '' + optionalString ( versionAtLeast package.version "3.3" ) ''
     namenode.wait_for_unit("hdfs-httpfs")
     namenode.wait_for_open_port(14000)
     assert "testfilecontents" in datanode.succeed("curl -f \"http://namenode:14000/webhdfs/v1/testfile?user.name=hdfs&op=OPEN\" 2>&1")
diff --git a/nixos/tests/hadoop/yarn.nix b/nixos/tests/hadoop/yarn.nix
index 09bdb35791c..1bf8e3831f6 100644
--- a/nixos/tests/hadoop/yarn.nix
+++ b/nixos/tests/hadoop/yarn.nix
@@ -1,22 +1,30 @@
 # This only tests if YARN is able to start its services
-import ../make-test-python.nix ({...}: {
+import ../make-test-python.nix ({ package, ... }: {
+  name = "hadoop-yarn";
+
   nodes = {
-    resourcemanager = {pkgs, ...}: {
-      services.hadoop.package = pkgs.hadoop;
-      services.hadoop.yarn.resourcemanager.enable = true;
-      services.hadoop.yarnSite = {
-        "yarn.resourcemanager.scheduler.class" = "org.apache.hadoop.yarn.server.resourcemanager.scheduler.fifo.FifoScheduler";
+    resourcemanager = { ... }: {
+      services.hadoop = {
+        inherit package;
+        yarn.resourcemanager = {
+          enable = true;
+          openFirewall = true;
+        };
       };
     };
-    nodemanager = {pkgs, ...}: {
-      services.hadoop.package = pkgs.hadoop;
-      services.hadoop.yarn.nodemanager.enable = true;
-      services.hadoop.yarnSite = {
-        "yarn.resourcemanager.hostname" = "resourcemanager";
-        "yarn.nodemanager.log-dirs" = "/tmp/userlogs";
+    nodemanager = { options, lib, ... }: {
+      services.hadoop = {
+        inherit package;
+        yarn.nodemanager = {
+          enable = true;
+          openFirewall = true;
+        };
+        yarnSite = options.services.hadoop.yarnSite.default // {
+          "yarn.resourcemanager.hostname" = "resourcemanager";
+          "yarn.nodemanager.log-dirs" = "/tmp/userlogs";
+        };
       };
     };
-
   };
 
   testScript = ''
diff --git a/nixos/tests/nextcloud/default.nix b/nixos/tests/nextcloud/default.nix
index 34d3c345354..b7b1c5c6600 100644
--- a/nixos/tests/nextcloud/default.nix
+++ b/nixos/tests/nextcloud/default.nix
@@ -18,4 +18,4 @@ foldl
     };
   })
 { }
-  [ 21 22 23 ]
+  [ 22 23 ]
diff --git a/nixos/tests/pacemaker.nix b/nixos/tests/pacemaker.nix
new file mode 100644
index 00000000000..68455761495
--- /dev/null
+++ b/nixos/tests/pacemaker.nix
@@ -0,0 +1,110 @@
+import ./make-test-python.nix  ({ pkgs, lib, ... }: rec {
+  name = "pacemaker";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ astro ];
+  };
+
+  nodes =
+    let
+      node = i: {
+        networking.interfaces.eth1.ipv4.addresses = [ {
+          address = "192.168.0.${toString i}";
+          prefixLength = 24;
+        } ];
+
+        services.corosync = {
+          enable = true;
+          clusterName = "zentralwerk-network";
+          nodelist = lib.imap (i: name: {
+            nodeid = i;
+            inherit name;
+            ring_addrs = [
+              (builtins.head nodes.${name}.networking.interfaces.eth1.ipv4.addresses).address
+            ];
+          }) (builtins.attrNames nodes);
+        };
+        environment.etc."corosync/authkey" = {
+          source = builtins.toFile "authkey"
+            # minimum length: 128 bytes
+            "testtesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttest";
+          mode = "0400";
+        };
+
+        services.pacemaker.enable = true;
+
+        # used for pacemaker resource
+        systemd.services.ha-cat = {
+          description = "Highly available netcat";
+          serviceConfig.ExecStart = "${pkgs.netcat}/bin/nc -l discard";
+        };
+      };
+    in {
+      node1 = node 1;
+      node2 = node 2;
+      node3 = node 3;
+    };
+
+  # sets up pacemaker with resources configuration, then crashes a
+  # node and waits for service restart on another node
+  testScript =
+    let
+      resources = builtins.toFile "cib-resources.xml" ''
+        <resources>
+          <primitive id="cat" class="systemd" type="ha-cat">
+            <operations>
+              <op id="stop-cat" name="start" interval="0" timeout="1s"/>
+              <op id="start-cat" name="start" interval="0" timeout="1s"/>
+              <op id="monitor-cat" name="monitor" interval="1s" timeout="1s"/>
+            </operations>
+          </primitive>
+        </resources>
+      '';
+    in ''
+      import re
+      import time
+
+      start_all()
+
+      ${lib.concatMapStrings (node: ''
+        ${node}.wait_until_succeeds("corosync-quorumtool")
+        ${node}.wait_for_unit("pacemaker.service")
+      '') (builtins.attrNames nodes)}
+
+      # No STONITH device
+      node1.succeed("crm_attribute -t crm_config -n stonith-enabled -v false")
+      # Configure the cat resource
+      node1.succeed("cibadmin --replace --scope resources --xml-file ${resources}")
+
+      # wait until the service is started
+      while True:
+        output = node1.succeed("crm_resource -r cat --locate")
+        match = re.search("is running on: (.+)", output)
+        if match:
+          for machine in machines:
+            if machine.name == match.group(1):
+              current_node = machine
+          break
+        time.sleep(1)
+
+      current_node.log("Service running here!")
+      current_node.crash()
+
+      # pick another node that's still up
+      for machine in machines:
+        if machine.booted:
+          check_node = machine
+      # find where the service has been started next
+      while True:
+        output = check_node.succeed("crm_resource -r cat --locate")
+        match = re.search("is running on: (.+)", output)
+        # output will remain the old current_node until the crash is detected by pacemaker
+        if match and match.group(1) != current_node.name:
+          for machine in machines:
+            if machine.name == match.group(1):
+              next_node = machine
+          break
+        time.sleep(1)
+
+      next_node.log("Service migrated here!")
+  '';
+})
diff --git a/pkgs/applications/audio/furnace/default.nix b/pkgs/applications/audio/furnace/default.nix
new file mode 100644
index 00000000000..e7794175ac9
--- /dev/null
+++ b/pkgs/applications/audio/furnace/default.nix
@@ -0,0 +1,99 @@
+{ stdenv
+, lib
+, nix-update-script
+, fetchFromGitHub
+, fetchpatch
+, cmake
+, pkg-config
+, makeWrapper
+, fmt_8
+, libsndfile
+, SDL2
+, zlib
+, withJACK ? stdenv.hostPlatform.isUnix
+, libjack2
+, withGUI ? true
+, Cocoa
+}:
+
+stdenv.mkDerivation rec {
+  pname = "furnace";
+  version = "0.5.6";
+
+  src = fetchFromGitHub {
+    owner = "tildearrow";
+    repo = "furnace";
+    rev = "v${version}";
+    fetchSubmodules = true;
+    sha256 = "sha256-BcaPQuDFkAaxFQKwoI6xdSWcyHo5VsqZcwf++JISqRs=";
+  };
+
+  patches = [
+    (fetchpatch {
+      name = "0001-furnace-fix-wrong-include-path.patch";
+      url = "https://github.com/tildearrow/furnace/commit/456db22f9d9f0ed40d74fe50dde492e69e901fcc.patch";
+      sha256 = "17ikb1z9ldm7kdj00m4swsrq1qx94vlzhc6h020x3ryzwnglc8d3";
+    })
+  ];
+
+  postPatch = ''
+    # rtmidi is not used yet
+    sed -i -e '/add_subdirectory(extern\/rtmidi/d' -e '/DEPENDENCIES_LIBRARIES rtmidi/d' CMakeLists.txt
+  '';
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    makeWrapper
+  ];
+
+  buildInputs = [
+    fmt_8
+    libsndfile
+    SDL2
+    zlib
+  ] ++ lib.optionals withJACK [
+    libjack2
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    Cocoa
+  ];
+
+  cmakeFlags = [
+    "-DBUILD_GUI=${if withGUI then "ON" else "OFF"}"
+    "-DSYSTEM_FMT=ON"
+    "-DSYSTEM_LIBSNDFILE=ON"
+    "-DSYSTEM_ZLIB=ON"
+    "-DSYSTEM_SDL2=ON"
+    "-DWITH_JACK=${if withJACK then "ON" else "OFF"}"
+    "-DWARNINGS_ARE_ERRORS=ON"
+  ];
+
+  postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    # Normal CMake install phase on Darwin only installs the binary, the user is expected to use CPack to build a
+    # bundle. That adds alot of overhead for not much benefit (CPack is currently abit broken, and needs impure access
+    # to /usr/bin/hdiutil). So we'll manually assemble & install everything instead.
+
+    mkdir -p $out/{Applications/Furnace.app/Contents/{MacOS,Resources},share/{,doc,licenses}/furnace}
+    mv $out/{bin,Applications/Furnace.app/Contents/MacOS}/furnace
+    makeWrapper $out/{Applications/Furnace.app/Contents/MacOS,bin}/furnace
+
+    install -m644 {../res,$out/Applications/Furnace.app/Contents}/Info.plist
+    install -m644 ../res/icon.icns $out/Applications/Furnace.app/Contents/Resources/Furnace.icns
+    install -m644 {..,$out/share/licenses/furnace}/LICENSE
+    cp -r ../papers $out/share/doc/furnace/
+    cp -r ../demos $out/share/furnace/
+  '';
+
+  passthru.updateScript = nix-update-script {
+    attrPath = pname;
+  };
+
+  meta = with lib; {
+    description = "Multi-system chiptune tracker compatible with DefleMask modules";
+    homepage = "https://github.com/tildearrow/furnace";
+    license = with licenses; [ gpl2Plus ];
+    maintainers = with maintainers; [ OPNA2608 ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/applications/audio/mopidy/ytmusic.nix b/pkgs/applications/audio/mopidy/ytmusic.nix
index 92b75414785..9f393a0e752 100644
--- a/pkgs/applications/audio/mopidy/ytmusic.nix
+++ b/pkgs/applications/audio/mopidy/ytmusic.nix
@@ -2,24 +2,33 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "mopidy-ytmusic";
-  version = "0.3.2";
+  version = "0.3.5";
 
   src = python3Packages.fetchPypi {
     inherit version;
     pname = "Mopidy-YTMusic";
-    sha256 = "sha256-BZtW+qHsTnOMj+jdAFI8ZMwGxJc9lNosgPJZGbt4JgU=";
+    sha256 = "0pncyxfqxvznb9y4ksndbny1yf5mxh4089ak0yz86dp2qi5j99iv";
   };
 
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace 'ytmusicapi>=0.20.0,<0.21.0' 'ytmusicapi>=0.20.0'
+  '';
+
   propagatedBuildInputs = [
     mopidy
     python3Packages.ytmusicapi
     python3Packages.pytube
   ];
 
+  pythonImportsCheck = [ "mopidy_ytmusic" ];
+
+  # has no tests
   doCheck = false;
 
   meta = with lib; {
     description = "Mopidy extension for playing music from YouTube Music";
+    homepage = "https://github.com/OzymandiasTheGreat/mopidy-ytmusic";
     license = licenses.asl20;
     maintainers = [ maintainers.nickhu ];
   };
diff --git a/pkgs/applications/editors/ed/default.nix b/pkgs/applications/editors/ed/default.nix
index a6ab483a7b0..f5ed28cedf6 100644
--- a/pkgs/applications/editors/ed/default.nix
+++ b/pkgs/applications/editors/ed/default.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (rec {
   pname = "ed";
-  version = "1.17";
+  version = "1.18";
 
   src = fetchurl {
     url = "mirror://gnu/ed/${pname}-${version}.tar.lz";
-    sha256 = "0m2yrkfjjraakxr98nsiakqrn351h99n706x9asgmdi57j43kpki";
+    sha256 = "sha256-rKjvrZgAxYdySiC5eqj8R+a1pH34Fgb+q6gxsHRGK08=";
   };
 
   nativeBuildInputs = [ lzip ];
diff --git a/pkgs/applications/editors/vim/common.nix b/pkgs/applications/editors/vim/common.nix
index 0cb09814c0f..13c5c49db48 100644
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "8.2.4227";
+  version = "8.2.4350";
 
   src = fetchFromGitHub {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    sha256 = "sha256-Xj4ymkrWY5GWpQhEDYtPtaRovBa6j19dW9GWg9WSdig=";
+    sha256 = "sha256-+fCyLZi9+9r7tYoRQsVESkcoHHtM7vrVuOGdJi/9iF0=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index e9054f944e7..d157c1e2ee9 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1374,6 +1374,18 @@ let
         };
       };
 
+      marp-team.marp-vscode = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "marp-vscode";
+          publisher = "marp-team";
+          version = "1.5.0";
+          sha256 = "0wqsj8rp58vl3nafkjvyw394h5j4jd7d24ra6hkvfpnlzrgv4yhs";
+        };
+        meta = {
+          license = lib.licenses.mit;
+        };
+      };
+
       mikestead.dotenv = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "dotenv";
@@ -1679,6 +1691,18 @@ let
         };
       };
 
+      richie5um2.snake-trail = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "snake-trail";
+          publisher = "richie5um2";
+          version = "0.6.0";
+          sha256 = "0wkpq9f48hplrgabb0v1ij6fc4sb8h4a93dagw4biprhnnm3qx49";
+        };
+        meta = with lib; {
+          license = licenses.mit;
+        };
+      };
+
       ritwickdey.liveserver = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "liveserver";
diff --git a/pkgs/applications/misc/mob/default.nix b/pkgs/applications/misc/mob/default.nix
index f6490906b55..2b9c847bac8 100644
--- a/pkgs/applications/misc/mob/default.nix
+++ b/pkgs/applications/misc/mob/default.nix
@@ -1,8 +1,8 @@
 { lib
 , buildGoPackage
 , fetchFromGitHub
-
-, withSpeech ? true
+, stdenv
+, withSpeech ? !stdenv.isDarwin
 , makeWrapper
 , espeak-ng
 }:
diff --git a/pkgs/applications/misc/stork/default.nix b/pkgs/applications/misc/stork/default.nix
index 11face45145..48e2859fa84 100644
--- a/pkgs/applications/misc/stork/default.nix
+++ b/pkgs/applications/misc/stork/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "stork";
-  version = "1.4.0";
+  version = "1.4.1";
 
   src = fetchFromGitHub {
     owner = "jameslittle230";
     repo = "stork";
     rev = "v${version}";
-    sha256 = "sha256-9fylJcUuModemkBRnXeFfB1b+CD9IvTxW+CnlqaUb60=";
+    sha256 = "sha256-aBsxRLUufVUauySCxZKk/ZfcU/5KR7jOHmnx6mHmsFs=";
   };
 
-  cargoSha256 = "sha256-j7OXl66xuTuP6hWJs+xHrwtaBGAYt02OESCN6FH3KX0=";
+  cargoSha256 = "sha256-oNoWGdXYfp47IpqU1twbORPOYrHjArNf43Zyeyat4Xs=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/applications/networking/browsers/brave/default.nix b/pkgs/applications/networking/browsers/brave/default.nix
index f5965767cd8..fedb366c555 100644
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@@ -91,11 +91,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "brave";
-  version = "1.36.111";
+  version = "1.36.112";
 
   src = fetchurl {
     url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    sha256 = "bXZsUqLaP43wJV3Cehgblw1G179HgGhToSL36v5QseA=";
+    sha256 = "AottJZ+WEc47Y47XefVdN0AW6PO18CR77QGGwLuKOso=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.json b/pkgs/applications/networking/browsers/chromium/upstream-info.json
index 8385ac2e009..4de0ecc5377 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@@ -1,8 +1,8 @@
 {
   "stable": {
-    "version": "99.0.4844.51",
-    "sha256": "1qxsn8zvvvsnn0k7nn606rhaial8ikrlfh175msqpp50xibjxicp",
-    "sha256bin64": "04kqfppa88g2q54vp53avyyhqzrxljz49p4wqk76kq7fz2rm94x1",
+    "version": "99.0.4844.74",
+    "sha256": "165vzxv3xi4r9ia3qnqsr4p9ai0344w1pnq03c6jdq7x613lcprd",
+    "sha256bin64": "1xzr7qv4rcardl3apr8w22dn81lzqkklhp26qqlbdcylacqqji04",
     "deps": {
       "gn": {
         "version": "2022-01-10",
@@ -12,10 +12,10 @@
       }
     },
     "chromedriver": {
-      "version": "99.0.4844.35",
-      "sha256_linux": "1q10mn34s03zy0nqcgrjd7ry53g4paxpwcki1bgicpcrwnjlzc3y",
-      "sha256_darwin": "0mcfry8vqqc8n1sgyn2azr8pc4lgjnkpnhz0ggjqm12njq0lfjfx",
-      "sha256_darwin_aarch64": "19wpqd5mq2vrgma899vbbdqhg660x47v4ppbz1r8dcg5r5y93x3s"
+      "version": "99.0.4844.51",
+      "sha256_linux": "1r5wbcfbj9s216jyjasmiscsrsix9ap3pplp12rznrwn4898p51y",
+      "sha256_darwin": "1nak8p5hdrw94lx73m9c110zrwag4qr6487dhplm3qfrnrkdh8wp",
+      "sha256_darwin_aarch64": "0hkcx6a8bcjlbmp6z3ld23mi1kpyjn2g7m3ns9qw6ns4x3rn5i3r"
     }
   },
   "beta": {
diff --git a/pkgs/applications/networking/browsers/firefox/packages.nix b/pkgs/applications/networking/browsers/firefox/packages.nix
index 2da3783c358..f5a156943c7 100644
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@@ -7,10 +7,10 @@ in
 rec {
   firefox = common rec {
     pname = "firefox";
-    version = "97.0.2";
+    version = "98.0.1";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "efbf33723f5979025454b6cc183927afb4bc72a51c00b5d45940122da596b8ac99080f3a6a59f5dd85a725e356349ec57e7eba1c36cdab7d55a28b04895d274c";
+      sha512 = "1434ff775e6cdc6d9a75fa0e6d07a4680ada86ecfd7b65208c597ed765e847d900b68df355e6bea6461f6d86ee7a8b2ce3117f23826ad144bd87dfe64ee39b42";
     };
 
     meta = {
diff --git a/pkgs/applications/networking/browsers/opera/default.nix b/pkgs/applications/networking/browsers/opera/default.nix
index 69ee0444c3d..bd7d42777f5 100644
--- a/pkgs/applications/networking/browsers/opera/default.nix
+++ b/pkgs/applications/networking/browsers/opera/default.nix
@@ -50,11 +50,11 @@ let
 in stdenv.mkDerivation rec {
 
   pname = "opera";
-  version = "84.0.4316.21";
+  version = "84.0.4316.31";
 
   src = fetchurl {
     url = "${mirror}/${version}/linux/${pname}-stable_${version}_amd64.deb";
-    sha256 = "sha256-CEKUd2QlZQJbpBO1t4oKmyd+uhPiCOY+eXtSrZf75e4=";
+    sha256 = "sha256-ypSnarhtJNQn3yOtydjmf6WmHAYbOfMg3xatCxTfIMY=";
   };
 
   unpackCmd = "${dpkg}/bin/dpkg-deb -x $curSrc .";
diff --git a/pkgs/applications/networking/cluster/argo/default.nix b/pkgs/applications/networking/cluster/argo/default.nix
index 07817e3ab0a..503952fa59a 100644
--- a/pkgs/applications/networking/cluster/argo/default.nix
+++ b/pkgs/applications/networking/cluster/argo/default.nix
@@ -19,16 +19,16 @@ let
 in
 buildGoModule rec {
   pname = "argo";
-  version = "3.2.9";
+  version = "3.3.0";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo";
     rev = "v${version}";
-    sha256 = "sha256-lZ6FjWXhVc51BlioDSryeYe5aZeUhMMEde+kk2SwV20=";
+    sha256 = "sha256-BDHbbb3WqQvRJB1A4NInfvujjB3r/AMmVvos8i/CnyU=";
   };
 
-  vendorSha256 = "sha256-hxSr0sNlz93JxOxnE2SnR6/OgCGK8DrJZxqQtSxfbj8=";
+  vendorSha256 = "sha256-YeSeaYOkNRjQgxsK9G7iPbVpfrPs4HRRFwfoUDxoCm0=";
 
   doCheck = false;
 
diff --git a/pkgs/applications/networking/cluster/fluxcd/default.nix b/pkgs/applications/networking/cluster/fluxcd/default.nix
index a583bf30895..d5762d938a3 100644
--- a/pkgs/applications/networking/cluster/fluxcd/default.nix
+++ b/pkgs/applications/networking/cluster/fluxcd/default.nix
@@ -1,9 +1,9 @@
 { lib, buildGoModule, fetchFromGitHub, fetchzip, installShellFiles }:
 
 let
-  version = "0.27.3";
-  sha256 = "08ax1033456hfm5qz0r671xm5ig0047nqp7xffyn9za498bm4i5q";
-  manifestsSha256 = "165kspq10nvlihcb1460qmbw5r1mlzs5gliw01qa4mymvzmlggk7";
+  version = "0.27.4";
+  sha256 = "06951i332gr17nsbns8mh4kcjilqfw5w95shaznpaksx93f554g0";
+  manifestsSha256 = "0fvzh7j3vi5hw8jbw2gisjnn53bffwnp7zm3dwcbv3svwpw7823d";
 
   manifests = fetchzip {
     url =
@@ -23,7 +23,7 @@ in buildGoModule rec {
     inherit sha256;
   };
 
-  vendorSha256 = "sha256-ENSfec7iSKOkILgVCVnORpAia4D+vBjQAUXDA7EIvVQ=";
+  vendorSha256 = "sha256-7sHLXjyYMWSFckDPeVGJYK+nwhbRpD76tV334PCVYwA=";
 
   postUnpack = ''
     cp -r ${manifests} source/cmd/flux/manifests
diff --git a/pkgs/applications/networking/cluster/hadoop/default.nix b/pkgs/applications/networking/cluster/hadoop/default.nix
index 6a48cc8ada8..adb46540cba 100644
--- a/pkgs/applications/networking/cluster/hadoop/default.nix
+++ b/pkgs/applications/networking/cluster/hadoop/default.nix
@@ -15,6 +15,8 @@
 , zlib
 , zstd
 , openssl
+, glibc
+, nixosTests
 }:
 
 with lib;
@@ -22,7 +24,7 @@ with lib;
 assert elem stdenv.system [ "x86_64-linux" "x86_64-darwin" "aarch64-linux" "aarch64-darwin" ];
 
 let
-  common = { pname, version, untarDir ? "${pname}-${version}", sha256, jdk, openssl ? null, nativeLibs ? [ ], libPatches ? "" }:
+  common = { pname, version, untarDir ? "${pname}-${version}", sha256, jdk, openssl ? null, nativeLibs ? [ ], libPatches ? "", tests }:
     stdenv.mkDerivation rec {
       inherit pname version jdk libPatches untarDir openssl;
       src = fetchurl {
@@ -38,7 +40,10 @@ let
       installPhase = ''
         mkdir -p $out/{lib/${untarDir}/conf,bin,lib}
         mv * $out/lib/${untarDir}
-
+      '' + optionalString stdenv.isLinux ''
+        # All versions need container-executor, but some versions can't use autoPatchelf because of broken SSL versions
+        patchelf --set-interpreter ${glibc.out}/lib64/ld-linux-x86-64.so.2 $out/lib/${untarDir}/bin/container-executor
+      '' + ''
         for n in $(find $out/lib/${untarDir}/bin -type f ! -name "*.*"); do
           makeWrapper "$n" "$out/bin/$(basename $n)"\
             --set-default JAVA_HOME ${jdk.home}\
@@ -49,6 +54,8 @@ let
         done
       '' + libPatches;
 
+      passthru = { inherit tests; };
+
       meta = {
         homepage = "https://hadoop.apache.org/";
         description = "Framework for distributed processing of large data sets across clusters of computers";
@@ -73,30 +80,34 @@ in
 {
   # Different version of hadoop support different java runtime versions
   # https://cwiki.apache.org/confluence/display/HADOOP/Hadoop+Java+Versions
-  hadoop_3_3 =
-    common
-      (rec {
-        pname = "hadoop";
-        version = "3.3.1";
-        untarDir = "${pname}-${version}";
-        sha256 = rec {
-          x86_64-linux = "1b3v16ihysqaxw8za1r5jlnphy8dwhivdx2d0z64309w57ihlxxd";
-          x86_64-darwin = x86_64-linux;
-          aarch64-linux = "00ln18vpi07jq2slk3kplyhcj8ad41n0yl880q5cihilk7daclxz";
-          aarch64-darwin = aarch64-linux;
-        };
-
-        inherit openssl;
-        nativeLibs = [ stdenv.cc.cc.lib protobuf3_7 zlib snappy ];
-        libPatches = ''
-          ln -s ${getLib cyrus_sasl}/lib/libsasl2.so $out/lib/${untarDir}/lib/native/libsasl2.so.2
-          ln -s ${getLib openssl}/lib/libcrypto.so $out/lib/${untarDir}/lib/native/
-          ln -s ${getLib zlib}/lib/libz.so.1 $out/lib/${untarDir}/lib/native/
-          ln -s ${getLib zstd}/lib/libzstd.so.1 $out/lib/${untarDir}/lib/native/
-          ln -s ${getLib bzip2}/lib/libbz2.so.1 $out/lib/${untarDir}/lib/native/
-        '' + optionalString stdenv.isLinux "patchelf --add-rpath ${jdk.home}/lib/server $out/lib/${untarDir}/lib/native/libnativetask.so.1.0.0";
-        jdk = jdk11_headless;
-      });
+  hadoop_3_3 = common rec {
+    pname = "hadoop";
+    version = "3.3.1";
+    untarDir = "${pname}-${version}";
+    sha256 = rec {
+      x86_64-linux = "1b3v16ihysqaxw8za1r5jlnphy8dwhivdx2d0z64309w57ihlxxd";
+      x86_64-darwin = x86_64-linux;
+      aarch64-linux = "00ln18vpi07jq2slk3kplyhcj8ad41n0yl880q5cihilk7daclxz";
+      aarch64-darwin = aarch64-linux;
+    };
+    jdk = jdk11_headless;
+    inherit openssl;
+    # TODO: Package and add Intel Storage Acceleration Library
+    nativeLibs = [ stdenv.cc.cc.lib protobuf3_7 zlib snappy ];
+    libPatches = ''
+      ln -s ${getLib cyrus_sasl}/lib/libsasl2.so $out/lib/${untarDir}/lib/native/libsasl2.so.2
+      ln -s ${getLib openssl}/lib/libcrypto.so $out/lib/${untarDir}/lib/native/
+      ln -s ${getLib zlib}/lib/libz.so.1 $out/lib/${untarDir}/lib/native/
+      ln -s ${getLib zstd}/lib/libzstd.so.1 $out/lib/${untarDir}/lib/native/
+      ln -s ${getLib bzip2}/lib/libbz2.so.1 $out/lib/${untarDir}/lib/native/
+    '' + optionalString stdenv.isLinux ''
+      # libjvm.so for Java >=11
+      patchelf --add-rpath ${jdk.home}/lib/server $out/lib/${untarDir}/lib/native/libnativetask.so.1.0.0
+      # Java 8 has libjvm.so at a different path
+      patchelf --add-rpath ${jdk.home}/jre/lib/amd64/server $out/lib/${untarDir}/lib/native/libnativetask.so.1.0.0
+    '';
+    tests = nixosTests.hadoop;
+  };
   hadoop_3_2 = common rec {
     pname = "hadoop";
     version = "3.2.2";
@@ -104,11 +115,13 @@ in
     jdk = jdk8_headless;
     # not using native libs because of broken openssl_1_0_2 dependency
     # can be manually overriden
+    tests = nixosTests.hadoop_3_2;
   };
   hadoop2 = common rec {
     pname = "hadoop";
     version = "2.10.1";
     sha256.x86_64-linux = "1w31x4bk9f2swnx8qxx0cgwfg8vbpm6cy5lvfnbbpl3rsjhmyg97";
     jdk = jdk8_headless;
+    tests = nixosTests.hadoop2;
   };
 }
diff --git a/pkgs/applications/networking/cluster/qbec/default.nix b/pkgs/applications/networking/cluster/qbec/default.nix
index 3d34a65e292..8dcb08247e3 100644
--- a/pkgs/applications/networking/cluster/qbec/default.nix
+++ b/pkgs/applications/networking/cluster/qbec/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "qbec";
-  version = "0.15.1";
+  version = "0.15.2";
 
   src = fetchFromGitHub {
     owner = "splunk";
     repo = "qbec";
     rev = "v${version}";
-    sha256 = "sha256-cXU+LnOCsGg+iwH5c7cKVi2Htw45AGxyjJFKXKbTkUo=";
+    sha256 = "sha256-js/UjnNYRW7s3b4TeprhmBe4cDLDYDrMeLtpASI9aN4=";
   };
 
-  vendorSha256 = "sha256-CiVAzFN/ygIiyhZKYtJ197TZO3ppL/emWSj4hAlIanc=";
+  vendorSha256 = "sha256-oEbKk9cMbI0ZWXrfM8Y19OF/A75mwHl0C/PJx0oTOBo=";
 
   doCheck = false;
 
diff --git a/pkgs/applications/networking/cluster/spark/default.nix b/pkgs/applications/networking/cluster/spark/default.nix
index 7876eb1c752..7770f98afe5 100644
--- a/pkgs/applications/networking/cluster/spark/default.nix
+++ b/pkgs/applications/networking/cluster/spark/default.nix
@@ -1,13 +1,26 @@
-{ lib, stdenv, fetchzip, makeWrapper, jdk8, python3Packages, extraPythonPackages ? [], coreutils, hadoop
-, RSupport? true, R
+{ lib
+, stdenv
+, fetchzip
+, makeWrapper
+, jdk8
+, python3Packages
+, extraPythonPackages ? [ ]
+, coreutils
+, hadoop
+, RSupport ? true
+, R
 }:
 
 with lib;
 
 let
-  spark = { pname, version, src }:
+  spark = { pname, version, sha256 }:
     stdenv.mkDerivation rec {
-      inherit pname version src;
+      inherit pname version;
+      src = fetchzip {
+        url = "mirror://apache/spark/${pname}-${version}/${pname}-${version}-bin-without-hadoop.tgz";
+        sha256 = sha256;
+      };
       nativeBuildInputs = [ makeWrapper ];
       buildInputs = [ jdk8 python3Packages.python ]
         ++ extraPythonPackages
@@ -45,31 +58,29 @@ let
       '';
 
       meta = {
-        description      = "Apache Spark is a fast and general engine for large-scale data processing";
-        homepage         = "https://spark.apache.org/";
-        license          = lib.licenses.asl20;
-        platforms        = lib.platforms.all;
-        maintainers      = with maintainers; [ thoughtpolice offline kamilchm illustris ];
+        description = "Apache Spark is a fast and general engine for large-scale data processing";
+        homepage = "https://spark.apache.org/";
+        license = lib.licenses.asl20;
+        platforms = lib.platforms.all;
+        maintainers = with maintainers; [ thoughtpolice offline kamilchm illustris ];
         repositories.git = "git://git.apache.org/spark.git";
       };
     };
-in {
-  spark3 = spark rec {
+in
+{
+  spark_3_2 = spark rec {
+    pname = "spark";
+    version = "3.2.1";
+    sha256 = "0kxdqczwmj6pray0h8h1qhygni9m82jzznw5fbv9hrxrkq1v182d";
+  };
+  spark_3_1 = spark rec {
     pname = "spark";
     version = "3.1.2";
-
-    src = fetchzip {
-      url    = "mirror://apache/spark/${pname}-${version}/${pname}-${version}-bin-without-hadoop.tgz";
-      sha256 = "1bgh2y6jm7wqy6yc40rx68xkki31i3jiri2yixb1bm0i9pvsj9yf";
-    };
+    sha256 = "1bgh2y6jm7wqy6yc40rx68xkki31i3jiri2yixb1bm0i9pvsj9yf";
   };
-  spark2 = spark rec {
+  spark_2_4 = spark rec {
     pname = "spark";
     version = "2.4.8";
-
-    src = fetchzip {
-      url    = "mirror://apache/spark/${pname}-${version}/${pname}-${version}-bin-without-hadoop.tgz";
-      sha256 = "1mkyq0gz9fiav25vr0dba5ivp0wh0mh7kswwnx8pvsmb6wbwyfxv";
-    };
+    sha256 = "1mkyq0gz9fiav25vr0dba5ivp0wh0mh7kswwnx8pvsmb6wbwyfxv";
   };
 }
diff --git a/pkgs/applications/networking/cluster/tfswitch/default.nix b/pkgs/applications/networking/cluster/tfswitch/default.nix
index f8473481cc0..3e872c27142 100644
--- a/pkgs/applications/networking/cluster/tfswitch/default.nix
+++ b/pkgs/applications/networking/cluster/tfswitch/default.nix
@@ -1,16 +1,16 @@
 { buildGoModule, lib, fetchFromGitHub }:
 buildGoModule rec {
   pname = "tfswitch";
-  version = "0.13.1201";
+  version = "0.13.1218";
 
   src = fetchFromGitHub {
     owner = "warrensbox";
     repo = "terraform-switcher";
     rev = version;
-    sha256 = "sha256-gJa8oVdgerDi0GdTSNus5rHLsFuzg8ZqVeKTMuPXu0o=";
+    sha256 = "sha256-RJdbNXO+6TqFLapWiZ1UeXGS5522ykQvhhNDEHPr8xE=";
   };
 
-  vendorSha256 = "sha256-z3UDrwlMHFFH56U3oylSWE3wqWOCA4RI2smafHHwYkQ=";
+  vendorSha256 = "sha256-Xqgki072Iy+snRriPVJ9oaDNJ/LiKL+AuU+eVw0zlDU=";
 
   # Disable tests since it requires network access and relies on the
   # presence of release.hashicorp.com
diff --git a/pkgs/applications/networking/cluster/tgswitch/default.nix b/pkgs/applications/networking/cluster/tgswitch/default.nix
index 560e593ba19..5f669a6b9d8 100644
--- a/pkgs/applications/networking/cluster/tgswitch/default.nix
+++ b/pkgs/applications/networking/cluster/tgswitch/default.nix
@@ -1,13 +1,13 @@
 { buildGoPackage, lib, fetchFromGitHub }:
 buildGoPackage rec {
   pname = "tgswitch";
-  version = "0.5.382";
+  version = "0.5.389";
 
   src = fetchFromGitHub {
     owner = "warrensbox";
     repo = "tgswitch";
     rev = version;
-    sha256 = "sha256-DbPf1o1XlXLpuYSrNMRwHRqi/urQhSfzPW5BPIvZC/Y=";
+    sha256 = "sha256-6hErfI7LEJFgOoJR8IF9jTSBwqbQYeGiwdeJShqxVQ0=";
   };
 
   goPackagePath = "github.com/warrensbox/tgswitch";
diff --git a/pkgs/applications/networking/cluster/werf/default.nix b/pkgs/applications/networking/cluster/werf/default.nix
index f8dcbc0183a..0b8650f3f7d 100644
--- a/pkgs/applications/networking/cluster/werf/default.nix
+++ b/pkgs/applications/networking/cluster/werf/default.nix
@@ -11,15 +11,15 @@
 
 buildGoModule rec {
   pname = "werf";
-  version = "1.2.73";
+  version = "1.2.74";
 
   src = fetchFromGitHub {
     owner = "werf";
     repo = "werf";
     rev = "v${version}";
-    sha256 = "sha256-E16p40Pmr9o2946XlO3TUE/xUueG0NBWux23MgAVLlI=";
+    sha256 = "sha256-Mfgvl6ljmYn9Vu/tWS0JAuH1pzQZ4zoD5+5ejUJF/Lg=";
   };
-  vendorSha256 = "sha256-NHeUj1JWRqElY2BpQ+7ANqwlOYQ5H2R00LGqktcsoF4=";
+  vendorSha256 = "sha256-MsIbuwsb0sKEh3Z7ArtG/8SWFPaXLu+TGNruhsHhtb4=";
   proxyVendor = true;
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/applications/networking/instant-messengers/alfaview/default.nix b/pkgs/applications/networking/instant-messengers/alfaview/default.nix
index 764ba6a0d79..ebed984c4d5 100644
--- a/pkgs/applications/networking/instant-messengers/alfaview/default.nix
+++ b/pkgs/applications/networking/instant-messengers/alfaview/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "alfaview";
-  version = "8.37.0";
+  version = "8.40.0";
 
   src = fetchurl {
     url = "https://production-alfaview-assets.alfaview.com/stable/linux/${pname}_${version}.deb";
-    sha256 = "sha256-hU4tqDu95ej8ChiWJq3ZPhEwxBcmTQkA/n///pPVa5U=";
+    sha256 = "sha256-meiIDIG7OXxF2aclHA/8FN8aSz5KWJliDbm2p/flD4k=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/instant-messengers/cinny/default.nix b/pkgs/applications/networking/instant-messengers/cinny/default.nix
index 1e2dc88a4d5..1ca42b15417 100644
--- a/pkgs/applications/networking/instant-messengers/cinny/default.nix
+++ b/pkgs/applications/networking/instant-messengers/cinny/default.nix
@@ -4,11 +4,11 @@ let
   configOverrides = writeText "cinny-config-overrides.json" (builtins.toJSON conf);
 in stdenv.mkDerivation rec {
   pname = "cinny";
-  version = "1.8.0";
+  version = "1.8.1";
 
   src = fetchurl {
     url = "https://github.com/ajbura/cinny/releases/download/v${version}/cinny-v${version}.tar.gz";
-    sha256 = "0pbapzl3pfx87ns4vp7088kkhl34c0ihbq90r3d0iz6sa16mcs79";
+    sha256 = "13jd7hihkw3nlcj0m157z6qix61v6zjs52h5zmw2agm47qmv0w6z";
   };
 
   installPhase = ''
diff --git a/pkgs/applications/networking/mailreaders/himalaya/default.nix b/pkgs/applications/networking/mailreaders/himalaya/default.nix
index 1c2d4110086..27779c96983 100644
--- a/pkgs/applications/networking/mailreaders/himalaya/default.nix
+++ b/pkgs/applications/networking/mailreaders/himalaya/default.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "himalaya";
-  version = "0.5.8";
+  version = "0.5.9";
 
   src = fetchFromGitHub {
     owner = "soywod";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Ejaspj0YpkGmfO1omOhx8ZDg77J7NqC32mw5Cd3K1FM=";
+    sha256 = "sha256-g+ySsHnJ4FpmJLEjlutuiJmMkKI3Jb+HkWi1WBIo1aw=";
   };
 
-  cargoSha256 = "sha256-xce2iHrqTxIirrut4dN7526pjE4T+ruaDS44jr+KeGs=";
+  cargoSha256 = "sha256-NkkONl57zSilElVAOXUBxWnims4+EIVkkTdExbeBAaQ=";
 
   nativeBuildInputs = lib.optionals enableCompletions [ installShellFiles ]
     ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [ pkg-config ];
@@ -34,6 +34,8 @@ rustPlatform.buildRustPackage rec {
       openssl
     ];
 
+  # flag added because without end-to-end testing is ran which requires
+  # additional tooling and servers to test
   cargoTestFlags = [ "--lib" ];
 
   postInstall = lib.optionalString enableCompletions ''
@@ -45,10 +47,10 @@ rustPlatform.buildRustPackage rec {
   '';
 
   meta = with lib; {
-    description = "CLI email client written in Rust";
+    description = "Command-line interface for email management";
     homepage = "https://github.com/soywod/himalaya";
     changelog = "https://github.com/soywod/himalaya/blob/v${version}/CHANGELOG.md";
     license = licenses.bsdOriginal;
-    maintainers = with maintainers; [ yanganto ];
+    maintainers = with maintainers; [ toastal yanganto ];
   };
 }
diff --git a/pkgs/applications/networking/remote/remmina/default.nix b/pkgs/applications/networking/remote/remmina/default.nix
index 29d80c25ef5..9721c6b9ba4 100644
--- a/pkgs/applications/networking/remote/remmina/default.nix
+++ b/pkgs/applications/networking/remote/remmina/default.nix
@@ -15,13 +15,13 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "remmina";
-  version = "1.4.24";
+  version = "1.4.25";
 
   src = fetchFromGitLab {
     owner  = "Remmina";
     repo   = "Remmina";
     rev    = "v${version}";
-    sha256 = "sha256-rcxgr3HVOWA3mTfX8tka9bPGDRDtKhBRsfQ3hv9XHf0=";
+    sha256 = "sha256-1val/KCClEtw1prVWuXJe8DmmQ7e7oqwAfAnT9G9iHI=";
   };
 
   nativeBuildInputs = [ cmake ninja pkg-config wrapGAppsHook ];
diff --git a/pkgs/applications/office/paperless-ng/default.nix b/pkgs/applications/office/paperless-ng/default.nix
index e3ca9af422c..ab140f90ced 100644
--- a/pkgs/applications/office/paperless-ng/default.nix
+++ b/pkgs/applications/office/paperless-ng/default.nix
@@ -18,10 +18,6 @@ let
   py = python3.override {
     packageOverrides = self: super: {
       django = super.django_3;
-      django-picklefield = super.django-picklefield.overrideAttrs (oldAttrs: {
-        # Checks do not pass with django 3
-        doInstallCheck = false;
-      });
       # Avoid warning in django-q versions > 1.3.4
       # https://github.com/jonaswinkler/paperless-ng/issues/857
       # https://github.com/Koed00/django-q/issues/526
diff --git a/pkgs/applications/science/astronomy/phd2/default.nix b/pkgs/applications/science/astronomy/phd2/default.nix
index 543e6820a76..52049302a27 100644
--- a/pkgs/applications/science/astronomy/phd2/default.nix
+++ b/pkgs/applications/science/astronomy/phd2/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "phd2";
-  version = "2.6.10";
+  version = "2.6.11";
 
   src = fetchFromGitHub {
     owner = "OpenPHDGuiding";
     repo = "phd2";
     rev = "v${version}";
-    sha256 = "sha256-2ZiPjhlguWXFcC53xG1aqAode7twtoHWszFUMQkK5xU=";
+    sha256 = "sha256-iautgHOVzdLWYGOVu3wHBDt30uCbaP58mDz/l7buB1k=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/science/astronomy/siril/default.nix b/pkgs/applications/science/astronomy/siril/default.nix
index b50cb4b71d0..4a51e88dc3b 100644
--- a/pkgs/applications/science/astronomy/siril/default.nix
+++ b/pkgs/applications/science/astronomy/siril/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "siril";
-  version = "0.99.10.1";
+  version = "1.0.0";
 
   src = fetchFromGitLab {
     owner = "free-astro";
     repo = pname;
     rev = version;
-    sha256 = "sha256-gqV+pJNaU+GnYiUo/imofgNdeM+AtDg/pSH7aoqhkYA=";
+    sha256 = "sha256-yqWFEa1fnSwl0ecN9hMI13QCfj0f69CFqTJlEAhTpJI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/science/computer-architecture/qtrvsim/default.nix b/pkgs/applications/science/computer-architecture/qtrvsim/default.nix
index 24d9f642ec5..fc840fe45fb 100644
--- a/pkgs/applications/science/computer-architecture/qtrvsim/default.nix
+++ b/pkgs/applications/science/computer-architecture/qtrvsim/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "QtRVSim";
-  version = "0.9.1";
+  version = "0.9.2";
 
   src = fetchFromGitHub {
     owner = "cvut";
     repo = "qtrvsim";
     rev = "refs/tags/v${version}";
-    sha256 = "AOksVS0drIBnK4RCxZw40yVxf4E8GjG9kU0rIZsY9gA=";
+    sha256 = "B1l+ysrodeDbxYfdLLMF8yk4/uPXTcDrTaMtYm89HuU=";
   };
 
   nativeBuildInputs = [ cmake wrapQtAppsHook ];
diff --git a/pkgs/applications/science/math/sage/patches/no-cython-sources-in-tracebacks-on-ipython8.patch b/pkgs/applications/science/math/sage/patches/no-cython-sources-in-tracebacks-on-ipython8.patch
deleted file mode 100644
index 871e494c362..00000000000
--- a/pkgs/applications/science/math/sage/patches/no-cython-sources-in-tracebacks-on-ipython8.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-diff --git a/src/sage/repl/interface_magic.py b/src/sage/repl/interface_magic.py
-index 8a455b69b0..a93e1c9e04 100644
---- a/src/sage/repl/interface_magic.py
-+++ b/src/sage/repl/interface_magic.py
-@@ -260,7 +260,7 @@ class InterfaceMagic(object):
-             2
-             120
-             sage: shell.run_cell('%%gap foo\n1+1;\n')
--            ...File "<string>", line unknown
-+            ...File...<string>...
-             SyntaxError: Interface magics have no options, got "foo"
-             <BLANKLINE>
-             sage: shell.run_cell('%%gap?')
-diff --git a/src/sage/repl/interpreter.py b/src/sage/repl/interpreter.py
-index 71dbe429fd..36b1d986d6 100644
---- a/src/sage/repl/interpreter.py
-+++ b/src/sage/repl/interpreter.py
-@@ -70,25 +70,6 @@ that shell.  The bulk of this functionality is provided through
- 
- TESTS:
- 
--Check that Cython source code appears in tracebacks::
--
--    sage: from sage.repl.interpreter import get_test_shell
--    sage: shell = get_test_shell()
--    sage: print("dummy line"); shell.run_cell('1/0') # see #25320 for the reason of the `...` and the dummy line in this test
--    dummy line
--    ...
--    ZeroDivisionError...Traceback (most recent call last)
--    <ipython-input-...> in <module>...
--    ----> 1 Integer(1)/Integer(0)
--    .../sage/rings/integer.pyx in sage.rings.integer.Integer...div...
--    ...
--    -> ...                  raise ZeroDivisionError("rational division by zero")
--       ....:            x = <Rational> Rational.__new__(Rational)
--       ....:            mpq_div_zz(x.value, ....value, (<Integer>right).value)
--    <BLANKLINE>
--    ZeroDivisionError: rational division by zero
--    sage: shell.quit()
--
- Test prompt transformer::
- 
-     sage: from sage.repl.interpreter import SagePromptTransformer
-@@ -423,7 +404,7 @@ def SagePreparseTransformer(lines):
-         sage: from sage.repl.interpreter import get_test_shell
-         sage: shell = get_test_shell()
-         sage: shell.run_cell(bad_syntax)
--          File "<string>", line unknown
-+          File...<string>...
-         SyntaxError: Mismatched ']'
-         <BLANKLINE>
-         sage: shell.quit()
diff --git a/pkgs/applications/science/math/sage/sage-src.nix b/pkgs/applications/science/math/sage/sage-src.nix
index bae33802d30..22e3a288b7d 100644
--- a/pkgs/applications/science/math/sage/sage-src.nix
+++ b/pkgs/applications/science/math/sage/sage-src.nix
@@ -119,15 +119,13 @@ stdenv.mkDerivation rec {
     # https://trac.sagemath.org/ticket/32959
     ./patches/linbox-1.7-upgrade.patch
 
-    # To emit better tracebacks, IPython 8 parses Python files using the ast
-    # module (via the stack_data package). Since Cython is a superset of Python,
-    # this results in no Cython code being printed in tracebacks. Fixing this
-    # properly is tracked in https://github.com/alexmojaki/stack_data/issues/21,
-    # but for now we just disable the corresponding test. An alternative would
-    # be to revert IPython's IPython/core/ultratb.py, but this would need to be
-    # Sage-specific (since it would worsen tracebacks for pure Python code).
-    # Sage tracks this at https://trac.sagemath.org/ticket/33170
-    ./patches/no-cython-sources-in-tracebacks-on-ipython8.patch
+    # https://trac.sagemath.org/ticket/33170
+    (fetchSageDiff {
+      base = "9.5.rc1";
+      name = "ipython-8-update.patch";
+      rev = "a90a314616d86d6be9c0d5233f0d36c4bfe06231";
+      sha256 = "sha256-pXdtokTo84xNCnV+HyAKEzG562z8FjzJ7hczOja0dRw=";
+    })
 
     # https://trac.sagemath.org/ticket/32968
     (fetchSageDiff {
diff --git a/pkgs/applications/terminal-emulators/xterm/default.nix b/pkgs/applications/terminal-emulators/xterm/default.nix
index 0f9bc33a907..3530b2d1d2f 100644
--- a/pkgs/applications/terminal-emulators/xterm/default.nix
+++ b/pkgs/applications/terminal-emulators/xterm/default.nix
@@ -4,14 +4,14 @@
 
 stdenv.mkDerivation rec {
   pname = "xterm";
-  version = "371";
+  version = "372";
 
   src = fetchurl {
     urls = [
       "ftp://ftp.invisible-island.net/xterm/${pname}-${version}.tgz"
       "https://invisible-mirror.net/archives/xterm/${pname}-${version}.tgz"
     ];
-    sha256 = "MviIJ3sZ4o68CjESv/AAYHwHvtBnnKoL7rs2+crUhPU=";
+    sha256 = "xtCBJ8skCcOgS8rlWbcCUZbtdwu3vyZjCry0XZX2CrE=";
   };
 
   strictDeps = true;
diff --git a/pkgs/applications/version-management/git-and-tools/gh/default.nix b/pkgs/applications/version-management/git-and-tools/gh/default.nix
index 5d96929282f..36b813f547e 100644
--- a/pkgs/applications/version-management/git-and-tools/gh/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/gh/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "gh";
-  version = "2.5.2";
+  version = "2.6.0";
 
   src = fetchFromGitHub {
     owner = "cli";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-60XEc0V8stbl+JozTqu8yO37K1NXX/X2xFkcO9p/QNY=";
+    sha256 = "sha256-NvVm/deO4LSIl5TSziqsrGt9atCXjt4UZ/VJfmX3i4c=";
   };
 
-  vendorSha256 = "sha256-aMD4a+jwCINcHV/z5UyTF+o3BzN9wviz+kLwDys9/BI=";
+  vendorSha256 = "sha256-pBjg6WyD61+Bl3ttcpl/b9XoWBCi7cDvE8NPaZGu7Aw=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/applications/video/mpv/scripts/vr-reversal.nix b/pkgs/applications/video/mpv/scripts/vr-reversal.nix
new file mode 100644
index 00000000000..4c4aacef31d
--- /dev/null
+++ b/pkgs/applications/video/mpv/scripts/vr-reversal.nix
@@ -0,0 +1,35 @@
+{ lib, stdenvNoCC, fetchFromGitHub, ffmpeg }:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "vr-reversal";
+  version = "1.1";
+
+  src = fetchFromGitHub {
+    owner = "dfaker";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1wn2ngcvn7wcsl3kmj782x5q9130qw951lj6ilrkafp6q6zscpqr";
+  };
+
+  dontBuild = true;
+
+  # reset_rot is only available in ffmpeg 5.0, see 5bcc61ce87922ecccaaa0bd303a7e195929859a8
+  postPatch = lib.optionalString (lib.versionOlder ffmpeg.version "5.0") ''
+    substituteInPlace 360plugin.lua --replace ":reset_rot=1:" ":"
+  '';
+
+  installPhase = ''
+    mkdir -p $out/share/mpv/scripts
+    cp -r 360plugin.lua $out/share/mpv/scripts/
+  '';
+
+  passthru.scriptName = "360plugin.lua";
+
+  meta = with lib; {
+    description = "Script for mpv to play VR video with optional saving of head tracking data.";
+    homepage = "https://github.com/dfaker/VR-reversal";
+    license = licenses.unlicense;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ schnusch ];
+  };
+}
diff --git a/pkgs/applications/video/smplayer/default.nix b/pkgs/applications/video/smplayer/default.nix
index 6d4e0f18d6f..eecb3a6b974 100644
--- a/pkgs/applications/video/smplayer/default.nix
+++ b/pkgs/applications/video/smplayer/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "smplayer";
-  version = "21.10.0";
+  version = "22.2.0";
 
   src = fetchFromGitHub {
     owner = "smplayer-dev";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-p6036c8KX3GCINmkjHZlDLgHhLKri+t2WNWzP4KsSI8=";
+    hash = "sha256-7DMvIqW3vzjVzJPyjbXuHHcf1T6EFcf/a/mVYqa3XS8=";
   };
 
   nativeBuildInputs = [
@@ -22,7 +22,9 @@ stdenv.mkDerivation rec {
     wrapQtAppsHook
   ];
 
-  buildInputs = [ qtscript ];
+  buildInputs = [
+    qtscript
+  ];
 
   dontUseQmakeConfigure = true;
 
diff --git a/pkgs/applications/virtualization/lima/default.nix b/pkgs/applications/virtualization/lima/default.nix
index 7feea9b4a34..68e902253ed 100644
--- a/pkgs/applications/virtualization/lima/default.nix
+++ b/pkgs/applications/virtualization/lima/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "lima";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "lima-vm";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-jbWz4HVYR3OEze2fFgG6Tg4p50IL0NStmaa8+GUPkNw=";
+    sha256 = "sha256-Y15oYAdq+bsG2qD/ZTqXHgkelAdQF4SnOE79gDhlNGE=";
   };
 
-  vendorSha256 = "sha256-RX8HfeDVvLUX4Ez2ma04gTl+8+lM7WGNSpmFNnf+5Xs=";
+  vendorSha256 = "sha256-66CcLWG45vZwM2LVc1xsjJYyxefGEBW4fY3wo1ESQUM=";
 
   nativeBuildInputs = [ makeWrapper installShellFiles ];
 
diff --git a/pkgs/build-support/alternatives/blas/default.nix b/pkgs/build-support/alternatives/blas/default.nix
index 8917784bc6c..7186675a5c6 100644
--- a/pkgs/build-support/alternatives/blas/default.nix
+++ b/pkgs/build-support/alternatives/blas/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv
-, lapack-reference, openblasCompat, openblas
+, lapack-reference, openblas
 , isILP64 ? false
-, blasProvider ? if isILP64 then openblas else openblasCompat }:
+, blasProvider ? openblas }:
 
 let
   blasFortranSymbols = [
@@ -32,10 +32,13 @@ let
 
 
   blasImplementation = lib.getName blasProvider;
+  blasProvider' = if blasImplementation == "mkl"
+                  then blasProvider
+                  else blasProvider.override { blas64 = isILP64; };
 
 in
 
-assert isILP64 -> (blasImplementation == "openblas" && blasProvider.blas64) || blasImplementation == "mkl";
+assert isILP64 -> blasImplementation == "mkl" || blasProvider'.blas64;
 
 stdenv.mkDerivation {
   pname = "blas";
@@ -43,13 +46,13 @@ stdenv.mkDerivation {
 
   outputs = [ "out" "dev" ];
 
-  meta = (blasProvider.meta or {}) // {
+  meta = (blasProvider'.meta or {}) // {
     description = "${lib.getName blasProvider} with just the BLAS C and FORTRAN ABI";
   };
 
   passthru = {
     inherit isILP64;
-    provider = blasProvider;
+    provider = blasProvider';
     implementation = blasImplementation;
   };
 
@@ -62,10 +65,10 @@ stdenv.mkDerivation {
   installPhase = (''
   mkdir -p $out/lib $dev/include $dev/lib/pkgconfig
 
-  libblas="${lib.getLib blasProvider}/lib/libblas${canonicalExtension}"
+  libblas="${lib.getLib blasProvider'}/lib/libblas${canonicalExtension}"
 
   if ! [ -e "$libblas" ]; then
-    echo "$libblas does not exist, ${blasProvider.name} does not provide libblas."
+    echo "$libblas does not exist, ${blasProvider'.name} does not provide libblas."
     exit 1
   fi
 
@@ -79,11 +82,11 @@ stdenv.mkDerivation {
 
 '' + (if stdenv.hostPlatform.parsed.kernel.execFormat.name == "elf" then ''
   patchelf --set-soname libblas${canonicalExtension} $out/lib/libblas${canonicalExtension}
-  patchelf --set-rpath "$(patchelf --print-rpath $out/lib/libblas${canonicalExtension}):${lib.getLib blasProvider}/lib" $out/lib/libblas${canonicalExtension}
+  patchelf --set-rpath "$(patchelf --print-rpath $out/lib/libblas${canonicalExtension}):${lib.getLib blasProvider'}/lib" $out/lib/libblas${canonicalExtension}
 '' else if stdenv.hostPlatform.isDarwin then ''
   install_name_tool \
     -id $out/lib/libblas${canonicalExtension} \
-    -add_rpath ${lib.getLib blasProvider}/lib \
+    -add_rpath ${lib.getLib blasProvider'}/lib \
     $out/lib/libblas${canonicalExtension}
 '' else "") + ''
 
@@ -99,10 +102,10 @@ Libs: -L$out/lib -lblas
 Cflags: -I$dev/include
 EOF
 
-  libcblas="${lib.getLib blasProvider}/lib/libcblas${canonicalExtension}"
+  libcblas="${lib.getLib blasProvider'}/lib/libcblas${canonicalExtension}"
 
   if ! [ -e "$libcblas" ]; then
-    echo "$libcblas does not exist, ${blasProvider.name} does not provide libcblas."
+    echo "$libcblas does not exist, ${blasProvider'.name} does not provide libcblas."
     exit 1
   fi
 
@@ -111,11 +114,11 @@ EOF
 
 '' + (if stdenv.hostPlatform.parsed.kernel.execFormat.name == "elf" then ''
   patchelf --set-soname libcblas${canonicalExtension} $out/lib/libcblas${canonicalExtension}
-  patchelf --set-rpath "$(patchelf --print-rpath $out/lib/libcblas${canonicalExtension}):${lib.getLib blasProvider}/lib" $out/lib/libcblas${canonicalExtension}
+  patchelf --set-rpath "$(patchelf --print-rpath $out/lib/libcblas${canonicalExtension}):${lib.getLib blasProvider'}/lib" $out/lib/libcblas${canonicalExtension}
 '' else if stdenv.hostPlatform.isDarwin then ''
   install_name_tool \
     -id $out/lib/libcblas${canonicalExtension} \
-    -add_rpath ${lib.getLib blasProvider}/lib \
+    -add_rpath ${lib.getLib blasProvider'}/lib \
     $out/lib/libcblas${canonicalExtension}
 '' else "") + ''
   if [ "$out/lib/libcblas${canonicalExtension}" != "$out/lib/libcblas${stdenv.hostPlatform.extensions.sharedLibrary}" ]; then
@@ -135,6 +138,6 @@ EOF
   mkdir -p $out/nix-support
   echo 'export MKL_INTERFACE_LAYER=${lib.optionalString isILP64 "I"}LP64,GNU' > $out/nix-support/setup-hook
   ln -s $out/lib/libblas${canonicalExtension} $out/lib/libmkl_rt${stdenv.hostPlatform.extensions.sharedLibrary}
-  ln -sf ${blasProvider}/include/* $dev/include
+  ln -sf ${blasProvider'}/include/* $dev/include
 '');
 }
diff --git a/pkgs/build-support/alternatives/lapack/default.nix b/pkgs/build-support/alternatives/lapack/default.nix
index 61da183c835..80fb7be8c1e 100644
--- a/pkgs/build-support/alternatives/lapack/default.nix
+++ b/pkgs/build-support/alternatives/lapack/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv
-, lapack-reference, openblasCompat, openblas
+, lapack-reference, openblas
 , isILP64 ? false
-, lapackProvider ? if isILP64 then openblas else openblasCompat }:
+, lapackProvider ? openblas }:
 
 let
 
@@ -11,10 +11,13 @@ let
                        else stdenv.hostPlatform.extensions.sharedLibrary;
 
   lapackImplementation = lib.getName lapackProvider;
+  lapackProvider' = if lapackImplementation == "mkl"
+                  then lapackProvider
+                  else lapackProvider.override { blas64 = isILP64; };
 
 in
 
-assert isILP64 -> (lapackImplementation == "openblas" && lapackProvider.blas64) || lapackImplementation == "mkl";
+assert isILP64 -> lapackImplementation == "mkl" || lapackProvider'.blas64;
 
 stdenv.mkDerivation {
   pname = "lapack";
@@ -22,13 +25,13 @@ stdenv.mkDerivation {
 
   outputs = [ "out" "dev" ];
 
-  meta = (lapackProvider.meta or {}) // {
-    description = "${lib.getName lapackProvider} with just the LAPACK C and FORTRAN ABI";
+  meta = (lapackProvider'.meta or {}) // {
+    description = "${lib.getName lapackProvider'} with just the LAPACK C and FORTRAN ABI";
   };
 
   passthru = {
     inherit isILP64;
-    provider = lapackProvider;
+    provider = lapackProvider';
     implementation = lapackImplementation;
   };
 
@@ -41,10 +44,10 @@ stdenv.mkDerivation {
   installPhase = (''
   mkdir -p $out/lib $dev/include $dev/lib/pkgconfig
 
-  liblapack="${lib.getLib lapackProvider}/lib/liblapack${canonicalExtension}"
+  liblapack="${lib.getLib lapackProvider'}/lib/liblapack${canonicalExtension}"
 
   if ! [ -e "$liblapack" ]; then
-    echo "$liblapack does not exist, ${lapackProvider.name} does not provide liblapack."
+    echo "$liblapack does not exist, ${lapackProvider'.name} does not provide liblapack."
     exit 1
   fi
 
@@ -53,7 +56,7 @@ stdenv.mkDerivation {
 
 '' + (if stdenv.hostPlatform.parsed.kernel.execFormat.name == "elf" then ''
   patchelf --set-soname liblapack${canonicalExtension} $out/lib/liblapack${canonicalExtension}
-  patchelf --set-rpath "$(patchelf --print-rpath $out/lib/liblapack${canonicalExtension}):${lapackProvider}/lib" $out/lib/liblapack${canonicalExtension}
+  patchelf --set-rpath "$(patchelf --print-rpath $out/lib/liblapack${canonicalExtension}):${lapackProvider'}/lib" $out/lib/liblapack${canonicalExtension}
 '' else "") + ''
 
   if [ "$out/lib/liblapack${canonicalExtension}" != "$out/lib/liblapack${stdenv.hostPlatform.extensions.sharedLibrary}" ]; then
@@ -70,10 +73,10 @@ Cflags: -I$dev/include
 Libs: -L$out/lib -llapack
 EOF
 
-  liblapacke="${lib.getLib lapackProvider}/lib/liblapacke${canonicalExtension}"
+  liblapacke="${lib.getLib lapackProvider'}/lib/liblapacke${canonicalExtension}"
 
   if ! [ -e "$liblapacke" ]; then
-    echo "$liblapacke does not exist, ${lapackProvider.name} does not provide liblapacke."
+    echo "$liblapacke does not exist, ${lapackProvider'.name} does not provide liblapacke."
     exit 1
   fi
 
@@ -82,7 +85,7 @@ EOF
 
 '' + (if stdenv.hostPlatform.parsed.kernel.execFormat.name == "elf" then ''
   patchelf --set-soname liblapacke${canonicalExtension} $out/lib/liblapacke${canonicalExtension}
-  patchelf --set-rpath "$(patchelf --print-rpath $out/lib/liblapacke${canonicalExtension}):${lib.getLib lapackProvider}/lib" $out/lib/liblapacke${canonicalExtension}
+  patchelf --set-rpath "$(patchelf --print-rpath $out/lib/liblapacke${canonicalExtension}):${lib.getLib lapackProvider'}/lib" $out/lib/liblapacke${canonicalExtension}
 '' else "") + ''
 
   if [ -f "$out/lib/liblapacke.so.3" ]; then
@@ -102,6 +105,6 @@ EOF
   mkdir -p $out/nix-support
   echo 'export MKL_INTERFACE_LAYER=${lib.optionalString isILP64 "I"}LP64,GNU' > $out/nix-support/setup-hook
   ln -s $out/lib/liblapack${canonicalExtension} $out/lib/libmkl_rt${stdenv.hostPlatform.extensions.sharedLibrary}
-  ln -sf ${lapackProvider}/include/* $dev/include
+  ln -sf ${lapackProvider'}/include/* $dev/include
 '');
 }
diff --git a/pkgs/build-support/cc-wrapper/add-flags.sh b/pkgs/build-support/cc-wrapper/add-flags.sh
index a6e991914e6..c59118d6c09 100644
--- a/pkgs/build-support/cc-wrapper/add-flags.sh
+++ b/pkgs/build-support/cc-wrapper/add-flags.sh
@@ -33,6 +33,20 @@ NIX_CFLAGS_COMPILE_@suffixSalt@="-B@out@/bin/ $NIX_CFLAGS_COMPILE_@suffixSalt@"
 # Export and assign separately in order that a failing $(..) will fail
 # the script.
 
+# Currently bootstrap-tools does not split glibc, and gcc files into
+# separate directories. As a workaround we want resulting cflags to be
+# ordered as: crt1-cflags libc-cflags cc-cflags. Otherwise we mix crt/libc.so
+# from different libc as seen in
+#   https://github.com/NixOS/nixpkgs/issues/158042
+#
+# Note that below has reverse ordering as we prepend flags one-by-one.
+# Once bootstrap-tools is split into different directories we can stop
+# relying on flag ordering below.
+
+if [ -e @out@/nix-support/cc-cflags ]; then
+    NIX_CFLAGS_COMPILE_@suffixSalt@="$(< @out@/nix-support/cc-cflags) $NIX_CFLAGS_COMPILE_@suffixSalt@"
+fi
+
 if [[ "$cInclude" = 1 ]] && [ -e @out@/nix-support/libc-cflags ]; then
     NIX_CFLAGS_COMPILE_@suffixSalt@="$(< @out@/nix-support/libc-cflags) $NIX_CFLAGS_COMPILE_@suffixSalt@"
 fi
@@ -49,10 +63,6 @@ if [ -e @out@/nix-support/libcxx-ldflags ]; then
     NIX_CXXSTDLIB_LINK_@suffixSalt@+=" $(< @out@/nix-support/libcxx-ldflags)"
 fi
 
-if [ -e @out@/nix-support/cc-cflags ]; then
-    NIX_CFLAGS_COMPILE_@suffixSalt@="$(< @out@/nix-support/cc-cflags) $NIX_CFLAGS_COMPILE_@suffixSalt@"
-fi
-
 if [ -e @out@/nix-support/gnat-cflags ]; then
     NIX_GNATFLAGS_COMPILE_@suffixSalt@="$(< @out@/nix-support/gnat-cflags) $NIX_GNATFLAGS_COMPILE_@suffixSalt@"
 fi
diff --git a/pkgs/build-support/setup-hooks/auto-patchelf.py b/pkgs/build-support/setup-hooks/auto-patchelf.py
new file mode 100644
index 00000000000..26fd623e3da
--- /dev/null
+++ b/pkgs/build-support/setup-hooks/auto-patchelf.py
@@ -0,0 +1,329 @@
+#!/usr/bin/env python3
+
+from collections import defaultdict
+from contextlib import contextmanager
+from dataclasses import dataclass
+from elftools.common.exceptions import ELFError # type: ignore
+from elftools.elf.dynamic import DynamicSection # type: ignore
+from elftools.elf.elffile import ELFFile # type: ignore
+from elftools.elf.enums import ENUM_E_TYPE, ENUM_EI_OSABI # type: ignore
+from itertools import chain
+from pathlib import Path, PurePath
+
+from typing import Tuple, Optional, Iterator, List, DefaultDict, Set
+
+import argparse
+import os
+import pprint
+import subprocess
+import sys
+
+
+
+@contextmanager
+def open_elf(path: Path) -> Iterator[ELFFile]:
+    with path.open('rb') as stream:
+        yield ELFFile(stream)
+
+
+def is_static_executable(elf: ELFFile) -> bool:
+    # Statically linked executables have an ELF type of EXEC but no INTERP.
+    return (elf.header["e_type"] == 'ET_EXEC'
+            and not elf.get_section_by_name(".interp"))
+
+
+def is_dynamic_executable(elf: ELFFile) -> bool:
+    # We do not require an ELF type of EXEC. This also catches
+    # position-independent executables, as they typically have an INTERP
+    # section but their ELF type is DYN.
+    return bool(elf.get_section_by_name(".interp"))
+
+
+def get_dependencies(elf: ELFFile) -> List[str]:
+    dependencies = []
+    # This convoluted code is here on purpose. For some reason, using
+    # elf.get_section_by_name(".dynamic") does not always return an
+    # instance of DynamicSection, but that is required to call iter_tags
+    for section in elf.iter_sections():
+        if isinstance(section, DynamicSection):
+            for tag in section.iter_tags('DT_NEEDED'):
+                dependencies.append(tag.needed)
+            break # There is only one dynamic section
+
+    return dependencies
+
+
+def get_rpath(elf: ELFFile) -> List[str]:
+    # This convoluted code is here on purpose. For some reason, using
+    # elf.get_section_by_name(".dynamic") does not always return an
+    # instance of DynamicSection, but that is required to call iter_tags
+    for section in elf.iter_sections():
+        if isinstance(section, DynamicSection):
+            for tag in section.iter_tags('DT_RUNPATH'):
+                return tag.runpath.split(':')
+
+            for tag in section.iter_tags('DT_RPATH'):
+                return tag.rpath.split(':')
+
+            break # There is only one dynamic section
+
+    return []
+
+
+def get_arch(elf: ELFFile) -> str:
+    return elf.get_machine_arch()
+
+
+def get_osabi(elf: ELFFile) -> str:
+    return elf.header["e_ident"]["EI_OSABI"]
+
+
+def osabi_are_compatible(wanted: str, got: str) -> bool:
+    """
+    Tests whether two OS ABIs are compatible, taking into account the
+    generally accepted compatibility of SVR4 ABI with other ABIs.
+    """
+    if not wanted or not got:
+        # One of the types couldn't be detected, so as a fallback we'll
+        # assume they're compatible.
+        return True
+
+    # Generally speaking, the base ABI (0x00), which is represented by
+    # readelf(1) as "UNIX - System V", indicates broad compatibility
+    # with other ABIs.
+    #
+    # TODO: This isn't always true. For example, some OSes embed ABI
+    # compatibility into SHT_NOTE sections like .note.tag and
+    # .note.ABI-tag.  It would be prudent to add these to the detection
+    # logic to produce better ABI information.
+    if wanted == 'ELFOSABI_SYSV':
+        return True
+
+    # Similarly here, we should be able to link against a superset of
+    # features, so even if the target has another ABI, this should be
+    # fine.
+    if got == 'ELFOSABI_SYSV':
+        return True
+
+    # Otherwise, we simply return whether the ABIs are identical.
+    return wanted == got
+
+
+def glob(path: Path, pattern: str, recursive: bool) -> Iterator[Path]:
+    return path.rglob(pattern) if recursive else path.glob(pattern)
+
+
+cached_paths: Set[Path] = set()
+soname_cache: DefaultDict[Tuple[str, str], List[Tuple[Path, str]]] = defaultdict(list)
+
+
+def populate_cache(initial: List[Path], recursive: bool =False) -> None:
+    lib_dirs = list(initial)
+
+    while lib_dirs:
+        lib_dir = lib_dirs.pop(0)
+
+        if lib_dir in cached_paths:
+            continue
+
+        cached_paths.add(lib_dir)
+
+        for path in glob(lib_dir, "*.so*", recursive):
+            if not path.is_file():
+                continue
+
+            resolved = path.resolve()
+            try:
+                with open_elf(path) as elf:
+                    osabi = get_osabi(elf)
+                    arch = get_arch(elf)
+                    rpath = [Path(p) for p in get_rpath(elf)
+                                     if p and '$ORIGIN' not in p]
+                    lib_dirs += rpath
+                    soname_cache[(path.name, arch)].append((resolved.parent, osabi))
+
+            except ELFError:
+                # Not an ELF file in the right format
+                pass
+
+
+def find_dependency(soname: str, soarch: str, soabi: str) -> Optional[Path]:
+    for lib, libabi in soname_cache[(soname, soarch)]:
+        if osabi_are_compatible(soabi, libabi):
+            return lib
+    return None
+
+
+@dataclass
+class Dependency:
+    file: Path              # The file that contains the dependency
+    name: Path              # The name of the dependency
+    found: bool = False     # Whether it was found somewhere
+
+
+def auto_patchelf_file(path: Path, runtime_deps: list[Path]) -> list[Dependency]:
+    try:
+        with open_elf(path) as elf:
+
+            if is_static_executable(elf):
+                # No point patching these
+                print(f"skipping {path} because it is statically linked")
+                return []
+
+            if elf.num_segments() == 0:
+                # no segment (e.g. object file)
+                print(f"skipping {path} because it contains no segment")
+                return []
+
+            file_arch = get_arch(elf)
+            if interpreter_arch != file_arch:
+                # Our target architecture is different than this file's
+                # architecture, so skip it.
+                print(f"skipping {path} because its architecture ({file_arch})"
+                      f" differs from target ({interpreter_arch})")
+                return []
+
+            file_osabi = get_osabi(elf)
+            if not osabi_are_compatible(interpreter_osabi, file_osabi):
+                print(f"skipping {path} because its OS ABI ({file_osabi}) is"
+                      f" not compatible with target ({interpreter_osabi})")
+                return []
+
+            file_is_dynamic_executable = is_dynamic_executable(elf)
+
+            file_dependencies = map(Path, get_dependencies(elf))
+
+    except ELFError:
+        return []
+
+    rpath = []
+    if file_is_dynamic_executable:
+        print("setting interpreter of", path)
+        subprocess.run(
+                ["patchelf", "--set-interpreter", interpreter_path.as_posix(), path.as_posix()],
+                check=True)
+        rpath += runtime_deps
+
+    print("searching for dependencies of", path)
+    dependencies = []
+    # Be sure to get the output of all missing dependencies instead of
+    # failing at the first one, because it's more useful when working
+    # on a new package where you don't yet know the dependencies.
+    for dep in file_dependencies:
+        if dep.is_absolute() and dep.is_file():
+            # This is an absolute path. If it exists, just use it.
+            # Otherwise, we probably want this to produce an error when
+            # checked (because just updating the rpath won't satisfy
+            # it).
+            continue
+        elif (libc_lib / dep).is_file():
+            # This library exists in libc, and will be correctly
+            # resolved by the linker.
+            continue
+
+        if found_dependency := find_dependency(dep.name, file_arch, file_osabi):
+            rpath.append(found_dependency)
+            dependencies.append(Dependency(path, dep, True))
+            print(f"    {dep} -> found: {found_dependency}")
+        else:
+            dependencies.append(Dependency(path, dep, False))
+            print(f"    {dep} -> not found!")
+
+    # Dedup the rpath
+    rpath_str = ":".join(dict.fromkeys(map(Path.as_posix, rpath)))
+
+    if rpath:
+        print("setting RPATH to:", rpath_str)
+        subprocess.run(
+                ["patchelf", "--set-rpath", rpath_str, path.as_posix()],
+                check=True)
+
+    return dependencies
+
+
+def auto_patchelf(
+        paths_to_patch: List[Path],
+        lib_dirs: List[Path],
+        runtime_deps: List[Path],
+        recursive: bool =True,
+        ignore_missing: bool =False) -> None:
+
+    if not paths_to_patch:
+        sys.exit("No paths to patch, stopping.")
+
+    # Add all shared objects of the current output path to the cache,
+    # before lib_dirs, so that they are chosen first in find_dependency.
+    populate_cache(paths_to_patch, recursive)
+    populate_cache(lib_dirs)
+
+    dependencies = []
+    for path in chain.from_iterable(glob(p, '*', recursive) for p in paths_to_patch):
+        if not path.is_symlink() and path.is_file():
+            dependencies += auto_patchelf_file(path, runtime_deps)
+
+    missing = [dep for dep in dependencies if not dep.found]
+
+    # Print a summary of the missing dependencies at the end
+    for dep in missing:
+        print(f"auto-patchelf could not satisfy dependency {dep.name} wanted by {dep.file}")
+
+    if missing and not ignore_missing:
+        sys.exit('auto-patchelf failed to find all the required dependencies.\n'
+                 'Add the missing dependencies to --libs or use --ignore-missing.')
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(
+        prog="auto-patchelf",
+        description='auto-patchelf tries as hard as possible to patch the'
+                    ' provided binary files by looking for compatible'
+                    'libraries in the provided paths.')
+    parser.add_argument(
+        "--ignore-missing",
+        action="store_true",
+        help="Do not fail when some dependencies are not found.")
+    parser.add_argument(
+        "--no-recurse",
+        dest="recursive",
+        action="store_false",
+        help="Patch only the provided paths, and ignore their children")
+    parser.add_argument(
+        "--paths", nargs="*", type=Path,
+        help="Paths whose content needs to be patched.")
+    parser.add_argument(
+        "--libs", nargs="*", type=Path,
+        help="Paths where libraries are searched for.")
+    parser.add_argument(
+        "--runtime-dependencies", nargs="*", type=Path,
+        help="Paths to prepend to the runtime path of executable binaries.")
+
+    print("automatically fixing dependencies for ELF files")
+    args = parser.parse_args()
+    pprint.pprint(vars(args))
+
+    auto_patchelf(
+        args.paths,
+        args.libs,
+        args.runtime_dependencies,
+        args.recursive,
+        args.ignore_missing)
+
+
+interpreter_path: Path  = None # type: ignore
+interpreter_osabi: str  = None # type: ignore
+interpreter_arch: str   = None # type: ignore
+libc_lib: Path          = None # type: ignore
+
+if __name__ == "__main__":
+    nix_support = Path(os.environ['NIX_BINTOOLS']) / 'nix-support'
+    interpreter_path = Path((nix_support / 'dynamic-linker').read_text().strip())
+    libc_lib = Path((nix_support / 'orig-libc').read_text().strip()) / 'lib'
+
+    with open_elf(interpreter_path) as interpreter:
+        interpreter_osabi = get_osabi(interpreter)
+        interpreter_arch = get_arch(interpreter)
+
+    if interpreter_arch and interpreter_osabi and interpreter_path and libc_lib:
+        main()
+    else:
+        sys.exit("Failed to parse dynamic linker (ld) properties.")
diff --git a/pkgs/build-support/setup-hooks/auto-patchelf.sh b/pkgs/build-support/setup-hooks/auto-patchelf.sh
index 4b3a1c5c390..9822674196a 100644
--- a/pkgs/build-support/setup-hooks/auto-patchelf.sh
+++ b/pkgs/build-support/setup-hooks/auto-patchelf.sh
@@ -1,289 +1,21 @@
 #!/usr/bin/env bash
 
 declare -a autoPatchelfLibs
-declare -Ag autoPatchelfFailedDeps
+declare -a extraAutoPatchelfLibs
 
 gatherLibraries() {
     autoPatchelfLibs+=("$1/lib")
 }
 
-# wrapper around patchelf to raise proper error messages
-# containing the tried file name and command
-runPatchelf() {
-  patchelf "$@" || (echo "Command failed: patchelf $*" && exit 1)
-}
-
 # shellcheck disable=SC2154
 # (targetOffset is referenced but not assigned.)
 addEnvHooks "$targetOffset" gatherLibraries
 
-isExecutable() {
-    # For dynamically linked ELF files it would be enough to check just for the
-    # INTERP section. However, we won't catch statically linked executables as
-    # they only have an ELF type of EXEC but no INTERP.
-    #
-    # So what we do here is just check whether *either* the ELF type is EXEC
-    # *or* there is an INTERP section. This also catches position-independent
-    # executables, as they typically have an INTERP section but their ELF type
-    # is DYN.
-    isExeResult="$(LANG=C $READELF -h -l "$1" 2> /dev/null \
-        | grep '^ *Type: *EXEC\>\|^ *INTERP\>')"
-    # not using grep -q, because it can cause Broken pipe
-    # https://unix.stackexchange.com/questions/305547/broken-pipe-when-grepping-output-but-only-with-i-flag
-    [ -n "$isExeResult" ]
-}
-
-# We cache dependencies so that we don't need to search through all of them on
-# every consecutive call to findDependency.
-declare -Ag autoPatchelfCachedDepsAssoc
-declare -ag autoPatchelfCachedDeps
-
-addToDepCache() {
-    if [[ ${autoPatchelfCachedDepsAssoc[$1]+f} ]]; then return; fi
-
-    # store deps in an assoc. array for efficient lookups
-    # otherwise findDependency would have quadratic complexity
-    autoPatchelfCachedDepsAssoc["$1"]=""
-
-    # also store deps in normal array to maintain their order
-    autoPatchelfCachedDeps+=("$1")
-}
-
-declare -gi depCacheInitialised=0
-declare -gi doneRecursiveSearch=0
-declare -g foundDependency
-
-getDepsFromElfBinary() {
-    # NOTE: This does not use runPatchelf because it may encounter non-ELF
-    # files. Caller is expected to check the return code if needed.
-    patchelf --print-needed "$1" 2> /dev/null
-}
-
-getRpathFromElfBinary() {
-    # NOTE: This does not use runPatchelf because it may encounter non-ELF
-    # files. Caller is expected to check the return code if needed.
-    local rpath
-    IFS=':' read -ra rpath < <(patchelf --print-rpath "$1" 2> /dev/null) || return $?
-
-    printf "%s\n" "${rpath[@]}"
-}
-
-populateCacheForDep() {
-    local so="$1"
-    local rpath found
-    rpath="$(getRpathFromElfBinary "$so")" || return 1
-
-    for found in $(getDepsFromElfBinary "$so"); do
-        local rpathElem
-        for rpathElem in $rpath; do
-            # Ignore empty element or $ORIGIN magic variable which should be
-            # deterministically resolved by adding this package's library
-            # files early anyway.
-            #
-            # shellcheck disable=SC2016
-            # (Expressions don't expand in single quotes, use double quotes for
-            # that.)
-            if [[ -z "$rpathElem" || "$rpathElem" == *'$ORIGIN'* ]]; then
-                continue
-            fi
-
-            local soname="${found%.so*}"
-            local foundso=
-            for foundso in "$rpathElem/$soname".so*; do
-                addToDepCache "$foundso"
-            done
-
-            # Found in this element of the rpath, no need to check others.
-            if [ -n "$foundso" ]; then
-                break
-            fi
-        done
-    done
-
-    # Not found in any rpath element.
-    return 1
-}
-
-populateCacheWithRecursiveDeps() {
-    # Dependencies may add more to the end of this array, so we use a counter
-    # with while instead of a regular for loop here.
-    local -i i=0
-    while [ $i -lt ${#autoPatchelfCachedDeps[@]} ]; do
-        populateCacheForDep "${autoPatchelfCachedDeps[$i]}"
-        i=$i+1
-    done
-}
-
-getBinArch() {
-    $OBJDUMP -f "$1" 2> /dev/null | sed -ne 's/^architecture: *\([^,]\+\).*/\1/p'
-}
-
-# Returns the specific OS ABI for an ELF file in the format produced by
-# readelf(1), like "UNIX - System V" or "UNIX - GNU".
-getBinOsabi() {
-    $READELF -h "$1" 2> /dev/null | sed -ne 's/^[ \t]*OS\/ABI:[ \t]*\(.*\)/\1/p'
-}
-
-# Tests whether two OS ABIs are compatible, taking into account the generally
-# accepted compatibility of SVR4 ABI with other ABIs.
-areBinOsabisCompatible() {
-    local wanted="$1"
-    local got="$2"
-
-    if [[ -z "$wanted" || -z "$got" ]]; then
-        # One of the types couldn't be detected, so as a fallback we'll assume
-        # they're compatible.
-        return 0
-    fi
-
-    # Generally speaking, the base ABI (0x00), which is represented by
-    # readelf(1) as "UNIX - System V", indicates broad compatibility with other
-    # ABIs.
-    #
-    # TODO: This isn't always true. For example, some OSes embed ABI
-    # compatibility into SHT_NOTE sections like .note.tag and .note.ABI-tag.
-    # It would be prudent to add these to the detection logic to produce better
-    # ABI information.
-    if [[ "$wanted" == "UNIX - System V" ]]; then
-        return 0
-    fi
-
-    # Similarly here, we should be able to link against a superset of features,
-    # so even if the target has another ABI, this should be fine.
-    if [[ "$got" == "UNIX - System V" ]]; then
-        return 0
-    fi
-
-    # Otherwise, we simply return whether the ABIs are identical.
-    if [[ "$wanted" == "$got" ]]; then
-        return 0
-    fi
-
-    return 1
-}
-
-# NOTE: If you want to use this function outside of the autoPatchelf function,
-# keep in mind that the dependency cache is only valid inside the subshell
-# spawned by the autoPatchelf function, so invoking this directly will possibly
-# rebuild the dependency cache. See the autoPatchelf function below for more
-# information.
-findDependency() {
-    local filename="$1"
-    local arch="$2"
-    local osabi="$3"
-    local lib dep
-
-    if [ $depCacheInitialised -eq 0 ]; then
-        for lib in "${autoPatchelfLibs[@]}"; do
-            for so in "$lib/"*.so*; do addToDepCache "$so"; done
-        done
-        depCacheInitialised=1
-    fi
-
-    for dep in "${autoPatchelfCachedDeps[@]}"; do
-        if [ "$filename" = "${dep##*/}" ]; then
-            if [ "$(getBinArch "$dep")" = "$arch" ] && areBinOsabisCompatible "$osabi" "$(getBinOsabi "$dep")"; then
-                foundDependency="$dep"
-                return 0
-            fi
-        fi
-    done
-
-    # Populate the dependency cache with recursive dependencies *only* if we
-    # didn't find the right dependency so far and afterwards run findDependency
-    # again, but this time with $doneRecursiveSearch set to 1 so that it won't
-    # recurse again (and thus infinitely).
-    if [ $doneRecursiveSearch -eq 0 ]; then
-        populateCacheWithRecursiveDeps
-        doneRecursiveSearch=1
-        findDependency "$filename" "$arch" || return 1
-        return 0
-    fi
-    return 1
-}
-
-autoPatchelfFile() {
-    local dep rpath="" toPatch="$1"
-
-    local interpreter
-    interpreter="$(< "$NIX_BINTOOLS/nix-support/dynamic-linker")"
-
-    local interpreterArch interpreterOsabi toPatchArch toPatchOsabi
-    interpreterArch="$(getBinArch "$interpreter")"
-    interpreterOsabi="$(getBinOsabi "$interpreter")"
-    toPatchArch="$(getBinArch "$toPatch")"
-    toPatchOsabi="$(getBinOsabi "$toPatch")"
-
-    if [ "$interpreterArch" != "$toPatchArch" ]; then
-        # Our target architecture is different than this file's architecture,
-        # so skip it.
-        echo "skipping $toPatch because its architecture ($toPatchArch) differs from target ($interpreterArch)" >&2
-        return 0
-    elif ! areBinOsabisCompatible "$interpreterOsabi" "$toPatchOsabi"; then
-        echo "skipping $toPatch because its OS ABI ($toPatchOsabi) is not compatible with target ($interpreterOsabi)" >&2
-        return 0
-    fi
-
-    if isExecutable "$toPatch"; then
-        runPatchelf --set-interpreter "$interpreter" "$toPatch"
-        # shellcheck disable=SC2154
-        # (runtimeDependencies is referenced but not assigned.)
-        if [ -n "$runtimeDependencies" ]; then
-            for dep in $runtimeDependencies; do
-                rpath="$rpath${rpath:+:}$dep/lib"
-            done
-        fi
-    fi
-
-    local libcLib
-    libcLib="$(< "$NIX_BINTOOLS/nix-support/orig-libc")/lib"
-
-    echo "searching for dependencies of $toPatch" >&2
-
-    local missing
-    missing="$(getDepsFromElfBinary "$toPatch")" || return 0
-
-    # This ensures that we get the output of all missing dependencies instead
-    # of failing at the first one, because it's more useful when working on a
-    # new package where you don't yet know its dependencies.
-
-    for dep in $missing; do
-        if [[ "$dep" == /* ]]; then
-            # This is an absolute path. If it exists, just use it. Otherwise,
-            # we probably want this to produce an error when checked (because
-            # just updating the rpath won't satisfy it).
-            if [ -f "$dep" ]; then
-                continue
-            fi
-        elif [ -f "$libcLib/$dep" ]; then
-            # This library exists in libc, and will be correctly resolved by
-            # the linker.
-            continue
-        fi
-
-        echo -n "  $dep -> " >&2
-        if findDependency "$dep" "$toPatchArch" "$toPatchOsabi"; then
-            rpath="$rpath${rpath:+:}${foundDependency%/*}"
-            echo "found: $foundDependency" >&2
-        else
-            echo "not found!" >&2
-            autoPatchelfFailedDeps["$dep"]="$toPatch"
-        fi
-    done
-
-    if [ -n "$rpath" ]; then
-        echo "setting RPATH to: $rpath" >&2
-        runPatchelf --set-rpath "$rpath" "$toPatch"
-    fi
-}
-
 # Can be used to manually add additional directories with shared object files
 # to be included for the next autoPatchelf invocation.
 addAutoPatchelfSearchPath() {
     local -a findOpts=()
 
-    # XXX: Somewhat similar to the one in the autoPatchelf function, maybe make
-    #      it DRY someday...
     while [ $# -gt 0 ]; do
         case "$1" in
             --) shift; break;;
@@ -296,15 +28,19 @@ addAutoPatchelfSearchPath() {
         esac
     done
 
-    while IFS= read -r -d '' file; do
-        addToDepCache "$file"
+    local dir=
+    while IFS= read -r -d '' dir; do
+        extraAutoPatchelfLibs+=("$dir")
     done <  <(find "$@" "${findOpts[@]}" \! -type d \
-            \( -name '*.so' -o -name '*.so.*' \) -print0)
+            \( -name '*.so' -o -name '*.so.*' \) -print0 \
+            | sed -z 's#/[^/]*$##' \
+            | uniq -z
+        )
 }
 
+
 autoPatchelf() {
     local norecurse=
-
     while [ $# -gt 0 ]; do
         case "$1" in
             --) shift; break;;
@@ -317,47 +53,14 @@ autoPatchelf() {
         esac
     done
 
-    if [ $# -eq 0 ]; then
-        echo "autoPatchelf: No paths to patch specified." >&2
-        return 1
-    fi
-
-    echo "automatically fixing dependencies for ELF files" >&2
-
-    # Add all shared objects of the current output path to the start of
-    # autoPatchelfCachedDeps so that it's chosen first in findDependency.
-    addAutoPatchelfSearchPath ${norecurse:+--no-recurse} -- "$@"
-
-    while IFS= read -r -d $'\0' file; do
-      isELF "$file" || continue
-      segmentHeaders="$(LANG=C $READELF -l "$file")"
-      # Skip if the ELF file doesn't have segment headers (eg. object files).
-      # not using grep -q, because it can cause Broken pipe
-      grep -q '^Program Headers:' <<<"$segmentHeaders" || continue
-      if isExecutable "$file"; then
-          # Skip if the executable is statically linked.
-          grep -q "^ *INTERP\\>" <<<"$segmentHeaders" || continue
-      fi
-      # Jump file if patchelf is unable to parse it
-      # Some programs contain binary blobs for testing,
-      # which are identified as ELF but fail to be parsed by patchelf
-      patchelf "$file" || continue
-      autoPatchelfFile "$file"
-    done < <(find "$@" ${norecurse:+-maxdepth 1} -type f -print0)
-
-    # fail if any dependencies were not found and
-    # autoPatchelfIgnoreMissingDeps is not set
-    local depsMissing=0
-    for failedDep in "${!autoPatchelfFailedDeps[@]}"; do
-      echo "autoPatchelfHook could not satisfy dependency $failedDep wanted by ${autoPatchelfFailedDeps[$failedDep]}"
-      depsMissing=1
-    done
-    # shellcheck disable=SC2154
-    # (autoPatchelfIgnoreMissingDeps is referenced but not assigned.)
-    if [[ $depsMissing == 1 && -z "$autoPatchelfIgnoreMissingDeps" ]]; then
-      echo "Add the missing dependencies to the build inputs or set autoPatchelfIgnoreMissingDeps=true"
-      exit 1
-    fi
+    local runtimeDependenciesArray=($runtimeDependencies)
+    @pythonInterpreter@ @autoPatchelfScript@                            \
+        ${norecurse:+--no-recurse}                                      \
+        ${autoPatchelfIgnoreMissingDeps:+--ignore-missing}              \
+        --paths "$@"                                                    \
+        --libs "${autoPatchelfLibs[@]}"                                 \
+               "${extraAutoPatchelfLibs[@]}"                            \
+        --runtime-dependencies "${runtimeDependenciesArray[@]/%//lib}"
 }
 
 # XXX: This should ultimately use fixupOutputHooks but we currently don't have
diff --git a/pkgs/build-support/setup-hooks/make-wrapper.sh b/pkgs/build-support/setup-hooks/make-wrapper.sh
index 604096135c2..fa606583289 100644
--- a/pkgs/build-support/setup-hooks/make-wrapper.sh
+++ b/pkgs/build-support/setup-hooks/make-wrapper.sh
@@ -51,7 +51,19 @@ makeWrapper() {
         local varName="$2"    # name of list variable to add to
         local separator="$3"  # character used to separate elements of list
         local value="$4"      # one value, or multiple values separated by `separator`, to add to list
-        if test -n "$value"; then
+
+        # Disable file globbing, since bash will otherwise try to find
+        # filenames matching the the value to be prefixed/suffixed if
+        # it contains characters considered wildcards, such as `?` and
+        # `*`. We want the value as is, except we also want to split
+        # it on on the separator; hence we can't quote it.
+        local reenableGlob=0
+        if [[ ! -o noglob ]]; then
+            reenableGlob=1
+        fi
+        set -o noglob
+
+        if [[ -n "$value" ]]; then
             local old_ifs=$IFS
             IFS=$separator
 
@@ -86,6 +98,10 @@ makeWrapper() {
             done
             IFS=$old_ifs
         fi
+
+        if (( reenableGlob )); then
+            set +o noglob
+        fi
     }
 
     mkdir -p "$(dirname "$wrapper")"
diff --git a/pkgs/data/fonts/vazir-fonts/default.nix b/pkgs/data/fonts/vazir-fonts/default.nix
index b2c4f1faa3c..b8885298c08 100755
--- a/pkgs/data/fonts/vazir-fonts/default.nix
+++ b/pkgs/data/fonts/vazir-fonts/default.nix
@@ -2,7 +2,7 @@
 
 let
   pname = "vazir-fonts";
-  version = "30.1.0";
+  version = "32.0.0";
 in fetchFromGitHub {
   name = "${pname}-${version}";
 
@@ -14,7 +14,7 @@ in fetchFromGitHub {
     tar xf $downloadedFile --strip=1
     find . -name '*.ttf' -exec install -m444 -Dt $out/share/fonts/truetype {} \;
   '';
-  sha256 = "sha256-J1l6rBFgaXFtGnK0pH7GbaYTt5TI/OevjZrXmaEgkB4=";
+  sha256 = "sha256-Uy8hgBtCcTLwXu9FkLN1WavUfP74Jf53ChxVGS3UBVM=";
 
   meta = with lib; {
     homepage = "https://github.com/rastikerdar/vazir-font";
diff --git a/pkgs/data/icons/kora-icon-theme/default.nix b/pkgs/data/icons/kora-icon-theme/default.nix
index 8df63a75ad8..01572e79761 100644
--- a/pkgs/data/icons/kora-icon-theme/default.nix
+++ b/pkgs/data/icons/kora-icon-theme/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec  {
   pname = "kora-icon-theme";
-  version = "1.5.0";
+  version = "1.5.1";
 
   src = fetchFromGitHub  {
     owner = "bikass";
     repo = "kora";
     rev = "v${version}";
-    sha256 = "sha256-kUgNj7KuxsQ/BvQ0ORl3xzEm9gv69+2PS0Bgv8i/S9U=";
+    sha256 = "sha256-3TKjd2Lblb+/zFq7rkdgnD1dJU3kis7QZi7Ui74IWzA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/data/misc/tzdata/default.nix b/pkgs/data/misc/tzdata/default.nix
index 52662b190a7..78c93b05033 100644
--- a/pkgs/data/misc/tzdata/default.nix
+++ b/pkgs/data/misc/tzdata/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     "BINDIR=$(bin)/bin"
     "ZICDIR=$(bin)/bin"
     "ETCDIR=$(TMPDIR)/etc"
-    "TZDEFAULT=$(TMPDIR)/etc"
+    "TZDEFAULT=tzdefault-to-remove"
     "LIBDIR=$(dev)/lib"
     "MANDIR=$(man)/share/man"
     "AWK=awk"
@@ -54,6 +54,7 @@ stdenv.mkDerivation rec {
   postInstall =
     ''
       rm $out/share/zoneinfo-posix
+      rm $out/share/zoneinfo/tzdefault-to-remove
       mkdir $out/share/zoneinfo/posix
       ( cd $out/share/zoneinfo/posix; ln -s ../* .; rm posix )
       mv $out/share/zoneinfo-leaps $out/share/zoneinfo/right
diff --git a/pkgs/desktops/plasma-5/fetch.sh b/pkgs/desktops/plasma-5/fetch.sh
index b0e706602b6..44b96e8beb9 100644
--- a/pkgs/desktops/plasma-5/fetch.sh
+++ b/pkgs/desktops/plasma-5/fetch.sh
@@ -1 +1 @@
-WGET_ARGS=( https://download.kde.org/stable/plasma/5.23.5/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.kde.org/stable/plasma/5.24.0/ -A '*.tar.xz' )
diff --git a/pkgs/desktops/plasma-5/kdecoration.nix b/pkgs/desktops/plasma-5/kdecoration.nix
index 1427997ee84..86d146c8b41 100644
--- a/pkgs/desktops/plasma-5/kdecoration.nix
+++ b/pkgs/desktops/plasma-5/kdecoration.nix
@@ -1,8 +1,8 @@
-{ mkDerivation, lib, extra-cmake-modules, qtbase, ki18n }:
+{ mkDerivation, lib, extra-cmake-modules, qtbase, ki18n, kcoreaddons }:
 
 mkDerivation {
   pname = "kdecoration";
   nativeBuildInputs = [ extra-cmake-modules ];
-  buildInputs = [ qtbase ki18n ];
+  buildInputs = [ qtbase ki18n kcoreaddons ];
   outputs = [ "out" "dev" ];
 }
diff --git a/pkgs/desktops/plasma-5/kwin/0001-NixOS-Unwrap-executable-name-for-.desktop-search.patch b/pkgs/desktops/plasma-5/kwin/0001-NixOS-Unwrap-executable-name-for-.desktop-search.patch
index e6ab62caf71..9bade4eab6a 100644
--- a/pkgs/desktops/plasma-5/kwin/0001-NixOS-Unwrap-executable-name-for-.desktop-search.patch
+++ b/pkgs/desktops/plasma-5/kwin/0001-NixOS-Unwrap-executable-name-for-.desktop-search.patch
@@ -63,11 +63,11 @@ index 0000000..726065d
 +
 +}// namespace
 +
-+#endif // SERVICE_UTILS_H
-diff --git a/src/service_utils.h b/src/service_utils.h
++#endif // NIXOS_UTILS_H
+diff --git a/src/utils/serviceutils.h b/src/utils/serviceutils.h
 index 8a70c1f..475b15d 100644
---- a/src/service_utils.h
-+++ b/src/service_utils.h
+--- a/src/utils/serviceutils.h
++++ b/src/utils/serviceutils.h
 @@ -19,6 +19,7 @@
  #include <QLoggingCategory>
  //KF
diff --git a/pkgs/desktops/plasma-5/libksysguard/0001-qdiriterator-follow-symlinks.patch b/pkgs/desktops/plasma-5/libksysguard/0001-qdiriterator-follow-symlinks.patch
index cda82e08442..ec4a34037dc 100644
--- a/pkgs/desktops/plasma-5/libksysguard/0001-qdiriterator-follow-symlinks.patch
+++ b/pkgs/desktops/plasma-5/libksysguard/0001-qdiriterator-follow-symlinks.patch
@@ -11,11 +11,10 @@ diff --git a/processui/scripting.cpp b/processui/scripting.cpp
 index efed8ff..841761a 100644
 --- a/processui/scripting.cpp
 +++ b/processui/scripting.cpp
-@@ -167,7 +167,7 @@ void Scripting::loadContextMenu() {
-     QStringList scripts;
+@@ -293,7 +293,7 @@ void Scripting::loadContextMenu()
      const QStringList dirs =
          QStandardPaths::locateAll(QStandardPaths::GenericDataLocation, QStringLiteral("ksysguard/scripts/"), QStandardPaths::LocateDirectory);
-     Q_FOREACH (const QString &dir, dirs) {
+     for (const QString &dir : dirs) {
 -        QDirIterator it(dir, QStringList() << QStringLiteral("*.desktop"), QDir::NoFilter, QDirIterator::Subdirectories);
 +        QDirIterator it(dir, QStringList() << QStringLiteral("*.desktop"), QDir::NoFilter, QDirIterator::Subdirectories | QDirIterator::FollowSymlinks);
          while (it.hasNext()) {
diff --git a/pkgs/desktops/plasma-5/plasma-workspace/0001-startkde.patch b/pkgs/desktops/plasma-5/plasma-workspace/0001-startkde.patch
index 508d3949884..e00d8b4a5c9 100644
--- a/pkgs/desktops/plasma-5/plasma-workspace/0001-startkde.patch
+++ b/pkgs/desktops/plasma-5/plasma-workspace/0001-startkde.patch
@@ -14,33 +14,33 @@ diff --git a/startkde/plasma-session/startup.cpp b/startkde/plasma-session/start
 index 270744053..356160e96 100644
 --- a/startkde/plasma-session/startup.cpp
 +++ b/startkde/plasma-session/startup.cpp
-@@ -143,7 +143,7 @@ Startup::Startup(QObject *parent)
-     const AutoStart autostart;
+@@ -179,7 +179,7 @@ Startup::Startup(QObject *parent)
+     }
  
      // Keep for KF5; remove in KF6 (KInit will be gone then)
 -    QProcess::execute(QStringLiteral(CMAKE_INSTALL_FULL_LIBEXECDIR_KF5 "/start_kdeinit_wrapper"), QStringList());
 +    QProcess::execute(QStringLiteral(NIXPKGS_START_KDEINIT_WRAPPER), QStringList());
  
-     KJob *windowManagerJob = nullptr;
-     if (qEnvironmentVariable("XDG_SESSION_TYPE") != QLatin1String("wayland")) {
-diff --git a/startkde/startplasma-waylandsession.cpp b/startkde/startplasma-waylandsession.cpp
+     KJob *phase1 = nullptr;
+     m_lock.reset(new QEventLoopLocker);
+diff --git a/startkde/startplasma-wayland.cpp b/startkde/startplasma-wayland.cpp
 index 3a054a04f..b2e7ab3fb 100644
---- a/startkde/startplasma-waylandsession.cpp
-+++ b/startkde/startplasma-waylandsession.cpp
-@@ -33,7 +33,7 @@ int main(int argc, char **argv)
-     out << "startplasma-waylandsession: Shutting down...\n";
+--- a/startkde/startplasma-wayland.cpp
++++ b/startkde/startplasma-wayland.cpp
+@@ -91,7 +91,7 @@ int main(int argc, char **argv)
+     out << "startplasma-wayland: Shutting down...\n";
  
      // Keep for KF5; remove in KF6 (KInit will be gone then)
 -    runSync(QStringLiteral("kdeinit5_shutdown"), {});
 +    runSync(QStringLiteral(NIXPKGS_KDEINIT5_SHUTDOWN), {});
  
-     out << "startplasma-waylandsession: Done.\n";
- 
+     out << "startplasmacompositor: Shutting down...\n";
+     cleanupPlasmaEnvironment(oldSystemdEnvironment);
 diff --git a/startkde/startplasma-x11.cpp b/startkde/startplasma-x11.cpp
 index d6b2c5439..534eeb0e5 100644
 --- a/startkde/startplasma-x11.cpp
 +++ b/startkde/startplasma-x11.cpp
-@@ -90,7 +90,7 @@ int main(int argc, char **argv)
+@@ -89,7 +89,7 @@ int main(int argc, char **argv)
      out << "startkde: Shutting down...\n";
  
      // Keep for KF5; remove in KF6 (KInit will be gone then)
@@ -53,7 +53,7 @@ diff --git a/startkde/startplasma.cpp b/startkde/startplasma.cpp
 index 008fdfcaf..72468f21c 100644
 --- a/startkde/startplasma.cpp
 +++ b/startkde/startplasma.cpp
-@@ -39,7 +39,7 @@ QTextStream out(stderr);
+@@ -50,7 +50,7 @@ QTextStream out(stderr);
  void messageBox(const QString &text)
  {
      out << text;
@@ -62,7 +62,7 @@ index 008fdfcaf..72468f21c 100644
  }
  
  QStringList allServices(const QLatin1String &prefix)
-@@ -340,7 +340,7 @@ void setupX11()
+@@ -412,7 +412,7 @@ void setupX11()
      //     If the user has overwritten fonts, the cursor font may be different now
      //     so don't move this up.
  
@@ -70,17 +70,8 @@ index 008fdfcaf..72468f21c 100644
 +    runSync(QStringLiteral(NIXPKGS_XSETROOT), {QStringLiteral("-cursor_name"), QStringLiteral("left_ptr")});
  }
  
- void cleanupPlasmaEnvironment(const std::optional<QStringList> &oldSystemdEnvironment)
-@@ -403,7 +403,7 @@ void setupFontDpi()
-     // TODO port to c++?
-     const QByteArray input = "Xft.dpi: " + QByteArray::number(fontsCfg.readEntry("forceFontDPI", 0));
-     QProcess p;
--    p.start(QStringLiteral("xrdb"), {QStringLiteral("-quiet"), QStringLiteral("-merge"), QStringLiteral("-nocpp")});
-+    p.start(QStringLiteral(NIXPKGS_XRDB), {QStringLiteral("-quiet"), QStringLiteral("-merge"), QStringLiteral("-nocpp")});
-     p.setProcessChannelMode(QProcess::ForwardedChannels);
-     p.write(input);
-     p.closeWriteChannel();
-@@ -425,7 +425,7 @@ QProcess *setupKSplash()
+ void cleanupPlasmaEnvironment(const std::optional<QProcessEnvironment> &oldSystemdEnvironment)
+@@ -500,7 +500,7 @@ QProcess *setupKSplash()
          KConfigGroup ksplashCfg = cfg.group("KSplash");
          if (ksplashCfg.readEntry("Engine", QStringLiteral("KSplashQML")) == QLatin1String("KSplashQML")) {
              p = new QProcess;
diff --git a/pkgs/desktops/plasma-5/plasma-workspace/0002-absolute-wallpaper-install-dir.patch b/pkgs/desktops/plasma-5/plasma-workspace/0002-absolute-wallpaper-install-dir.patch
index 633551f6e3c..211316e2473 100644
--- a/pkgs/desktops/plasma-5/plasma-workspace/0002-absolute-wallpaper-install-dir.patch
+++ b/pkgs/desktops/plasma-5/plasma-workspace/0002-absolute-wallpaper-install-dir.patch
@@ -15,8 +15,8 @@ index a560da3..f723c1e 100644
  type=image
  color=#1d99f3
  fontSize=10
--background=${KDE_INSTALL_FULL_WALLPAPERDIR}/Next/contents/images/5120x2880.png
-+background=${NIXPKGS_BREEZE_WALLPAPERS}/Next/contents/images/5120x2880.png
+-background=${KDE_INSTALL_FULL_WALLPAPERDIR}/Next/contents/images/5120x2880.jpg
++background=${NIXPKGS_BREEZE_WALLPAPERS}/Next/contents/images/5120x2880.jpg
  needsFullUserModel=false
 -- 
 2.30.0
diff --git a/pkgs/desktops/plasma-5/srcs.nix b/pkgs/desktops/plasma-5/srcs.nix
index 9de087f10e8..c5da337d10d 100644
--- a/pkgs/desktops/plasma-5/srcs.nix
+++ b/pkgs/desktops/plasma-5/srcs.nix
@@ -4,427 +4,435 @@
 
 {
   bluedevil = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/bluedevil-5.23.5.tar.xz";
-      sha256 = "1nbnmfdaisqngygyz1478fswsm1xp28v9l78xlw70yvvyjk2kc6v";
-      name = "bluedevil-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/bluedevil-5.24.0.tar.xz";
+      sha256 = "128br83hkxxrb6wca3d1racygdnfgk3r5md1gcjvgwb0gpy6bnzp";
+      name = "bluedevil-5.24.0.tar.xz";
     };
   };
   breeze = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/breeze-5.23.5.tar.xz";
-      sha256 = "1pyw7rhzkbd9kwsm8l7iz867jhwlbmkarc5iihg0bkbcg1ds18ic";
-      name = "breeze-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/breeze-5.24.0.tar.xz";
+      sha256 = "08b3hihz98z7kdybb0y1b74q1dn511ga81qqqxzlfirgpp8c9f9q";
+      name = "breeze-5.24.0.tar.xz";
     };
   };
   breeze-grub = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/breeze-grub-5.23.5.tar.xz";
-      sha256 = "12rm9a3vrmb3sm04l2c4vcj8psfyjxplp9wgh87q3k1rcyqz7fqk";
-      name = "breeze-grub-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/breeze-grub-5.24.0.tar.xz";
+      sha256 = "0p0pzmsd6scssyxcm9n58mp7fc9vz1lg4n7c1ch4bqragih1gnlr";
+      name = "breeze-grub-5.24.0.tar.xz";
     };
   };
   breeze-gtk = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/breeze-gtk-5.23.5.tar.xz";
-      sha256 = "1ynbvfgy2nlxg5svjqazj70m7py58ixxa7xyj13dcj6i2ikbcjld";
-      name = "breeze-gtk-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/breeze-gtk-5.24.0.tar.xz";
+      sha256 = "090cczxc1ciic6wghz3p21gpfdwnc8pjcvq6wn7bfkp1i3r5mihp";
+      name = "breeze-gtk-5.24.0.tar.xz";
     };
   };
   breeze-plymouth = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/breeze-plymouth-5.23.5.tar.xz";
-      sha256 = "1sllcrhz8hniqkgybk5bbb36fzjcdp5drjbf7v7jn4ih4wvybwmk";
-      name = "breeze-plymouth-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/breeze-plymouth-5.24.0.tar.xz";
+      sha256 = "1qqpwgp1yy3p1s0z21xwds6wx4z8daibkgk1bynj73cx7a2wch9g";
+      name = "breeze-plymouth-5.24.0.tar.xz";
     };
   };
   discover = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/discover-5.23.5.tar.xz";
-      sha256 = "1kzp7jpw2kgml2yc3cx9n5syln3kyd9fxa5klh3sa1xn6bz9f8zr";
-      name = "discover-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/discover-5.24.0.tar.xz";
+      sha256 = "0dbfvqana31wqharsbyb8rcrw1w6l9x1g6p02aqwiph0inkrz20q";
+      name = "discover-5.24.0.tar.xz";
     };
   };
   drkonqi = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/drkonqi-5.23.5.tar.xz";
-      sha256 = "08jjh52r6dmgp7dyxjxvavb4cxhmvzirwdn7hnmfhdbwkm09fqm5";
-      name = "drkonqi-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/drkonqi-5.24.0.tar.xz";
+      sha256 = "1ismgg7rcxijkprn4sci15wn4w2gmdn0fdbgvzxdcrqaf4g6qc3s";
+      name = "drkonqi-5.24.0.tar.xz";
     };
   };
   kactivitymanagerd = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/kactivitymanagerd-5.23.5.tar.xz";
-      sha256 = "09v6pia34a694g0amj0miqi0j42yqvhfcv6yr9zfix4gf1qcdidn";
-      name = "kactivitymanagerd-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/kactivitymanagerd-5.24.0.tar.xz";
+      sha256 = "12dvgm3ilyqlxzm8209b7g42nfk0ahfzizs3pbmi18zapjszcsps";
+      name = "kactivitymanagerd-5.24.0.tar.xz";
     };
   };
   kde-cli-tools = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/kde-cli-tools-5.23.5.tar.xz";
-      sha256 = "1203z87i4dmhq1vlrfj4kiw157i5zkccd2bwc7p7qwhgbddaw5jd";
-      name = "kde-cli-tools-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/kde-cli-tools-5.24.0.tar.xz";
+      sha256 = "0l8a4ysz1cqwdh3c20q51qamwh58vvs8yzb5jdvbp8bahsyyc4mr";
+      name = "kde-cli-tools-5.24.0.tar.xz";
     };
   };
   kde-gtk-config = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/kde-gtk-config-5.23.5.tar.xz";
-      sha256 = "14qqxy2vz9004kfam9biv6q0601sn9yhrkx0i8y0958a58s5z3hp";
-      name = "kde-gtk-config-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/kde-gtk-config-5.24.0.tar.xz";
+      sha256 = "024pglycz2kbp9npnvbx5qpkz9381wyyp6xkalqynzr9gy58syrx";
+      name = "kde-gtk-config-5.24.0.tar.xz";
     };
   };
   kdecoration = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/kdecoration-5.23.5.tar.xz";
-      sha256 = "1kqj8l95wy46kfsw3f1crxwba9zwdlbgi7345mamhyks74wj1628";
-      name = "kdecoration-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/kdecoration-5.24.0.tar.xz";
+      sha256 = "0xl8892w49z11k9mxgh7lp8a4l1x8wldmaij82kd1vnh9sxvb3f3";
+      name = "kdecoration-5.24.0.tar.xz";
     };
   };
   kdeplasma-addons = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/kdeplasma-addons-5.23.5.tar.xz";
-      sha256 = "0cq0g8nqrkwv12010rsrmzqvxsa5arjpa87gvws8pah3v9k1xnkq";
-      name = "kdeplasma-addons-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/kdeplasma-addons-5.24.0.tar.xz";
+      sha256 = "0q8yf0gz4gjn1kyf545i8fpsn2dpy48qhjpm8ssp3ywv6s2abjxn";
+      name = "kdeplasma-addons-5.24.0.tar.xz";
     };
   };
   kgamma5 = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/kgamma5-5.23.5.tar.xz";
-      sha256 = "17j0kv00ibs2g9jxfvflk965221iznm0ydgj3i05i6j2bd8301zn";
-      name = "kgamma5-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/kgamma5-5.24.0.tar.xz";
+      sha256 = "07w7l25snpi98j5bxg3zri5lsymabnli6h9d5w0qx0c19wzjwayl";
+      name = "kgamma5-5.24.0.tar.xz";
     };
   };
   khotkeys = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/khotkeys-5.23.5.tar.xz";
-      sha256 = "13562p0bv0jkamx9q07wi5vs78bdrhd0h3qg5rxajc5s36gyh63a";
-      name = "khotkeys-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/khotkeys-5.24.0.tar.xz";
+      sha256 = "0gjdwdzg5vybalima8jnwrprqj0rnxmzds0x8w707nb9ypz4k7k6";
+      name = "khotkeys-5.24.0.tar.xz";
     };
   };
   kinfocenter = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/kinfocenter-5.23.5.tar.xz";
-      sha256 = "0f7ik3gg1pimjlc94dp6psk0sha8k7pinx50nvmgsglap4k1xbk7";
-      name = "kinfocenter-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/kinfocenter-5.24.0.tar.xz";
+      sha256 = "09fq69q4300ppi1y9pp8s4h1bbai1p5qsz384bb445pjvwsyn6nf";
+      name = "kinfocenter-5.24.0.tar.xz";
     };
   };
   kmenuedit = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/kmenuedit-5.23.5.tar.xz";
-      sha256 = "0k3dbip98zwia6m8nlgiw4mz09pkw7bik4cn3j73v2x3n7y3c542";
-      name = "kmenuedit-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/kmenuedit-5.24.0.tar.xz";
+      sha256 = "0bjiqdw4wqi5vpkn98wjjz23x6k47lvxac8nyxs8ddd9i8mlklij";
+      name = "kmenuedit-5.24.0.tar.xz";
     };
   };
   kscreen = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/kscreen-5.23.5.tar.xz";
-      sha256 = "0j5rgzj132j7qy1pgi12mhihf1a89a3xh8j5f7dp5s1f8kyjq0yi";
-      name = "kscreen-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/kscreen-5.24.0.tar.xz";
+      sha256 = "19kqvvgj209ri035ldzn1k5l36l54rvagsnfzhw61v8rd9r6r02x";
+      name = "kscreen-5.24.0.tar.xz";
     };
   };
   kscreenlocker = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/kscreenlocker-5.23.5.tar.xz";
-      sha256 = "07vhwvcyz9ynjzh44zny1f6di2knzy3fkiji3bhrki8p3zc9vjpm";
-      name = "kscreenlocker-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/kscreenlocker-5.24.0.tar.xz";
+      sha256 = "0d827h5br27sdd925brljb1mwnkzj739g5q0k8xkw9f9q9bxk8l8";
+      name = "kscreenlocker-5.24.0.tar.xz";
     };
   };
   ksshaskpass = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/ksshaskpass-5.23.5.tar.xz";
-      sha256 = "0p8aka60mc8p96v3bx954jy99n9lf0a4b09sig307clwinfr23if";
-      name = "ksshaskpass-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/ksshaskpass-5.24.0.tar.xz";
+      sha256 = "1xiw25imhmkcikp746q9s393djmkdpkh9jb7h1diwwhambnimy6d";
+      name = "ksshaskpass-5.24.0.tar.xz";
     };
   };
   ksystemstats = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/ksystemstats-5.23.5.tar.xz";
-      sha256 = "1xmr0yk5xynja6z7xc6l1zd529q5si5qs71f72dba2zna22hb7hb";
-      name = "ksystemstats-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/ksystemstats-5.24.0.tar.xz";
+      sha256 = "1182dfcg1av9329g9p9ll64yiwyxm46kczakxb3vj4d2ajaclzm1";
+      name = "ksystemstats-5.24.0.tar.xz";
     };
   };
   kwallet-pam = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/kwallet-pam-5.23.5.tar.xz";
-      sha256 = "1cha41wiqsfgyrqb8di5qnnz0mnvmchprxay48czrn3r5mz49pw9";
-      name = "kwallet-pam-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/kwallet-pam-5.24.0.tar.xz";
+      sha256 = "0jzi2rcwxxjp3lg8cywp96ysnwm51a0m9pdwk8z7n3v1ncr2p38q";
+      name = "kwallet-pam-5.24.0.tar.xz";
     };
   };
   kwayland-integration = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/kwayland-integration-5.23.5.tar.xz";
-      sha256 = "0gs68v4rriknn59fv0yjcgrmcryv7wxgskswdgi1xx18v0rlc4ag";
-      name = "kwayland-integration-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/kwayland-integration-5.24.0.tar.xz";
+      sha256 = "1yq9cjb8xcvqr747p5hm8xxg4rn6mahchd5c2camv3qrjbqm8ll6";
+      name = "kwayland-integration-5.24.0.tar.xz";
     };
   };
   kwayland-server = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/kwayland-server-5.23.5.tar.xz";
-      sha256 = "0b8c1mkh36cgxhx18v9j23n9gnvzy22x50gpiw3dbkjzsmr1n7by";
-      name = "kwayland-server-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/kwayland-server-5.24.0.tar.xz";
+      sha256 = "1zbi4c14zvjwkxxqlg80mv749ybnkmcdvn72irmrzbbf4g1z7k32";
+      name = "kwayland-server-5.24.0.tar.xz";
     };
   };
   kwin = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/kwin-5.23.5.tar.xz";
-      sha256 = "00azqmdgkh72bg4d8868cin984vxxk6s6pk5x4dfvlaknzlyfjgp";
-      name = "kwin-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/kwin-5.24.0.tar.xz";
+      sha256 = "19q5pphqnr1xc1c4z0sd3yr60jsiq190llwllfmlj4acjlbcbbn6";
+      name = "kwin-5.24.0.tar.xz";
     };
   };
   kwrited = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/kwrited-5.23.5.tar.xz";
-      sha256 = "0aj911kfzd100jq1k1sg7i1nhiixnl7qiphc2bczn47f1jj64iqv";
-      name = "kwrited-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/kwrited-5.24.0.tar.xz";
+      sha256 = "018wvkkqzg4qyjd0w1h2d3ms72ghlq8mg79rrsj518l7hhlv6rsg";
+      name = "kwrited-5.24.0.tar.xz";
     };
   };
   layer-shell-qt = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/layer-shell-qt-5.23.5.tar.xz";
-      sha256 = "1ah66z9hiricw6h3j7x2k7d49y7g4l2s9w2658wjrava2qng9bsr";
-      name = "layer-shell-qt-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/layer-shell-qt-5.24.0.tar.xz";
+      sha256 = "0y3z2xr9vpxnm84gs1zpa1apma341wza7pjcpwibaqd6aiz9vpqv";
+      name = "layer-shell-qt-5.24.0.tar.xz";
     };
   };
   libkscreen = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/libkscreen-5.23.5.tar.xz";
-      sha256 = "08wgg96clp685fl5lflrfd4kmf5c2p5ms7n1q2izvg0n6qr37m1i";
-      name = "libkscreen-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/libkscreen-5.24.0.tar.xz";
+      sha256 = "0h6sycib940gbw2rf6ax3v7mg77pzga36xzwzbyz9h49fba3dpjk";
+      name = "libkscreen-5.24.0.tar.xz";
     };
   };
   libksysguard = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/libksysguard-5.23.5.tar.xz";
-      sha256 = "1gy1grkkz7vwglby52vv4gr8zbzsv8rbvwbp6rqvvhmqg7ascc1h";
-      name = "libksysguard-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/libksysguard-5.24.0.tar.xz";
+      sha256 = "1f0hwk2kzmgpjxmsjfd4g25sr91qyazp4hysyfjdhrrs2ajdkm0b";
+      name = "libksysguard-5.24.0.tar.xz";
     };
   };
   milou = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/milou-5.23.5.tar.xz";
-      sha256 = "05bc6hc5pn5rz4zp6b2akjdbssv7xppvzsw3pidkqb8pincl01gh";
-      name = "milou-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/milou-5.24.0.tar.xz";
+      sha256 = "0sxsisrzfancxwk8lsxhj2b85sgjdb9gzy4l0nax4fp942ygiirs";
+      name = "milou-5.24.0.tar.xz";
     };
   };
   oxygen = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/oxygen-5.23.5.tar.xz";
-      sha256 = "1vvy9yqllqq9dx2riwv4bmxfq13wph5wagy84f1hhl7zxnbcyv0c";
-      name = "oxygen-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/oxygen-5.24.0.tar.xz";
+      sha256 = "0ym74q29c2f32l1xm3kd0s2p7zzbg6a96g7d39fkp5paxicx5fb7";
+      name = "oxygen-5.24.0.tar.xz";
     };
   };
   plasma-browser-integration = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/plasma-browser-integration-5.23.5.tar.xz";
-      sha256 = "0jw9jircgbilig4pryyjxhby8qc7nag9a1s5nk1zdsnlaqr08jyp";
-      name = "plasma-browser-integration-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/plasma-browser-integration-5.24.0.tar.xz";
+      sha256 = "1gp9m7drwxflb0ms0vbvk7qydm1bghhzalc00lpcjh4nrf0bgh33";
+      name = "plasma-browser-integration-5.24.0.tar.xz";
     };
   };
   plasma-desktop = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/plasma-desktop-5.23.5.tar.xz";
-      sha256 = "0ym8cssw351ygw2vy27cyxql05y0gaflnqnq4fwkdgidldvmi45k";
-      name = "plasma-desktop-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/plasma-desktop-5.24.0.tar.xz";
+      sha256 = "1brnm6yivjy2piy88ncmclv4g2rxkaiyi923c557dmiipah2bx7z";
+      name = "plasma-desktop-5.24.0.tar.xz";
     };
   };
   plasma-disks = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/plasma-disks-5.23.5.tar.xz";
-      sha256 = "0197zyj5p7j8y80g0vvf5d9bq86qxkhwpa9dzb5l3is50y8lkj6p";
-      name = "plasma-disks-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/plasma-disks-5.24.0.tar.xz";
+      sha256 = "1c3pwnyhdmj7grk3gjh4kw5437m5cxhp70qsbhnfsaacps3mdv5d";
+      name = "plasma-disks-5.24.0.tar.xz";
     };
   };
   plasma-firewall = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/plasma-firewall-5.23.5.tar.xz";
-      sha256 = "0fhycjrb89blh6wf24rvq7bafqqrxj37ir0daj5jlph9f1w4laq0";
-      name = "plasma-firewall-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/plasma-firewall-5.24.0.tar.xz";
+      sha256 = "1jjw414547qksjxg2x5n666iq6qildbn9k9c8hqipmwnlkprpbb1";
+      name = "plasma-firewall-5.24.0.tar.xz";
     };
   };
   plasma-integration = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/plasma-integration-5.23.5.tar.xz";
-      sha256 = "03c0cqvr5cdpvxgm145sqpbbr8wv0qv4pqjl69v3bs010pd755lg";
-      name = "plasma-integration-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/plasma-integration-5.24.0.tar.xz";
+      sha256 = "17dqf6j1za3q8hzk7jfc5wc7s4kr28slrkq5iqvzqgyqjqy3z7rv";
+      name = "plasma-integration-5.24.0.tar.xz";
+    };
+  };
+  plasma-mobile = {
+    version = "5.24.0";
+    src = fetchurl {
+      url = "${mirror}/stable/plasma/5.24.0/plasma-mobile-5.24.0.tar.xz";
+      sha256 = "0g9mbb8dzqcngc1sq43knwyc3kr81w3vl359wyrgvnr8r1qikv2z";
+      name = "plasma-mobile-5.24.0.tar.xz";
     };
   };
   plasma-nano = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/plasma-nano-5.23.5.tar.xz";
-      sha256 = "1yh67bh1smk7zx35hd72pafjbjdv7wwwhm76ga5sj251m61ncxim";
-      name = "plasma-nano-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/plasma-nano-5.24.0.tar.xz";
+      sha256 = "0i8lsp83g2i3c88djkmxawwbwa6lr0w89lzxj73fr6az6vdcrypj";
+      name = "plasma-nano-5.24.0.tar.xz";
     };
   };
   plasma-nm = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/plasma-nm-5.23.5.tar.xz";
-      sha256 = "14sknzy4v4xx1ihjn1s6x0lv5difnp4gi24zsdqvnkxkmxzhcij3";
-      name = "plasma-nm-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/plasma-nm-5.24.0.tar.xz";
+      sha256 = "17pmyklmr46qg21w4ql9q5nhfdjw1xmmv1qz7lyhlww7qa6mz1ny";
+      name = "plasma-nm-5.24.0.tar.xz";
     };
   };
   plasma-pa = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/plasma-pa-5.23.5.tar.xz";
-      sha256 = "1pcnf59qj7rgmcbc5xhad5zl487r48i2kyp6nc3yrlgj1xcfpfxg";
-      name = "plasma-pa-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/plasma-pa-5.24.0.tar.xz";
+      sha256 = "19n2plbk455qwgq0lcpb7rj2ck78ck64fpvlldmh53j9vxyzcasl";
+      name = "plasma-pa-5.24.0.tar.xz";
     };
   };
   plasma-phone-components = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/plasma-phone-components-5.23.5.tar.xz";
-      sha256 = "08c03pycvv7ald21d8ckxpv6d25qlxs28gjm99hdn6x8m74j7frn";
-      name = "plasma-phone-components-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/plasma-phone-components-5.24.0.tar.xz";
+      sha256 = "0g9mbb8dzqcngc1sq43knwyc3kr81w3vl359wyrgvnr8r1qikv2z";
+      name = "plasma-phone-components-5.24.0.tar.xz";
     };
   };
   plasma-sdk = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/plasma-sdk-5.23.5.tar.xz";
-      sha256 = "1s0l09lgqipks0w0jplaaipcs4a1ny4iclkz9hkfx4xjgcvk5m2j";
-      name = "plasma-sdk-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/plasma-sdk-5.24.0.tar.xz";
+      sha256 = "16fn98rv4qaci3b5whzjs6csbbxyrnmnr9gngn5dirdpla8cffld";
+      name = "plasma-sdk-5.24.0.tar.xz";
     };
   };
   plasma-systemmonitor = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/plasma-systemmonitor-5.23.5.tar.xz";
-      sha256 = "1snzabxgja9rsk000h97qjadb9fs8zdbqpr4zqa9sk0jjgm011lf";
-      name = "plasma-systemmonitor-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/plasma-systemmonitor-5.24.0.tar.xz";
+      sha256 = "0zkvbgwm2rpyisbx72a75ywy45d2primjjpnmw76x6924j8sp7pd";
+      name = "plasma-systemmonitor-5.24.0.tar.xz";
     };
   };
   plasma-tests = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/plasma-tests-5.23.5.tar.xz";
-      sha256 = "125b0sf7h0ibjl7msw1sc3cccms8nrrkx6cgwd46a9xi5svrsfg2";
-      name = "plasma-tests-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/plasma-tests-5.24.0.tar.xz";
+      sha256 = "1q95mrrb0p9ah4dg3bhkc9yh2ydasdmyd87jclraybcsfl6fi9kf";
+      name = "plasma-tests-5.24.0.tar.xz";
     };
   };
   plasma-thunderbolt = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/plasma-thunderbolt-5.23.5.tar.xz";
-      sha256 = "1ich92w479llvq1vjlfyvxh3dvqc4pgycfi97hz4sfhn7dnaw3vr";
-      name = "plasma-thunderbolt-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/plasma-thunderbolt-5.24.0.tar.xz";
+      sha256 = "1vsb3wf2sgbfbm2wk8kj18qhv4z9l4yzxaf8g30zpz4d1sva7jdc";
+      name = "plasma-thunderbolt-5.24.0.tar.xz";
     };
   };
   plasma-vault = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/plasma-vault-5.23.5.tar.xz";
-      sha256 = "1gf531q29qnvvsdxqgb1zyxwh5ck25kb0h1kk0d95pjkkylgyv0d";
-      name = "plasma-vault-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/plasma-vault-5.24.0.tar.xz";
+      sha256 = "1vk38iarhsr6rdrmhbcyjziw3dn8yjmgyn4dy2xdr0l4yqpq7qzz";
+      name = "plasma-vault-5.24.0.tar.xz";
     };
   };
   plasma-workspace = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/plasma-workspace-5.23.5.tar.xz";
-      sha256 = "0x950nb56xmmdf7hfpbrd9hvgq1a8vca0x8g1qsvrjhh5ymydgif";
-      name = "plasma-workspace-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/plasma-workspace-5.24.0.tar.xz";
+      sha256 = "0jnksl2i2viw5aaqv38b371z4lxrxah6p1bjp40a1zfa68vr8dz3";
+      name = "plasma-workspace-5.24.0.tar.xz";
     };
   };
   plasma-workspace-wallpapers = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/plasma-workspace-wallpapers-5.23.5.tar.xz";
-      sha256 = "0nr631yz8v671a87vh9f2a5kfjhn4f9147b339p09fwgfpx06vfx";
-      name = "plasma-workspace-wallpapers-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/plasma-workspace-wallpapers-5.24.0.tar.xz";
+      sha256 = "0329ks3q32nb9k3dxddlmxccjilgyxx5jplwbpln5b0p4plkn77k";
+      name = "plasma-workspace-wallpapers-5.24.0.tar.xz";
     };
   };
   plymouth-kcm = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/plymouth-kcm-5.23.5.tar.xz";
-      sha256 = "0ynyqfm6az8yj3d30yxza5mjcsgfw6mmdkcgr3v95r6db112hqbx";
-      name = "plymouth-kcm-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/plymouth-kcm-5.24.0.tar.xz";
+      sha256 = "1pcvfrv8vmk43s14209iv8gngi3al9g4za74yz2l79nxscyppzh5";
+      name = "plymouth-kcm-5.24.0.tar.xz";
     };
   };
   polkit-kde-agent = {
-    version = "1-5.23.5";
+    version = "1-5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/polkit-kde-agent-1-5.23.5.tar.xz";
-      sha256 = "1wgpgbq987qa6fdayw4155fwym6rcn2z7w66s8faqv94x78njzln";
-      name = "polkit-kde-agent-1-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/polkit-kde-agent-1-5.24.0.tar.xz";
+      sha256 = "1qayxff5hl8qr9p5bsfrq0cz3x1jlwc8f0nx66rkbngphdm7085n";
+      name = "polkit-kde-agent-1-5.24.0.tar.xz";
     };
   };
   powerdevil = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/powerdevil-5.23.5.tar.xz";
-      sha256 = "1lxjqd4w3jvnffcn9751j9k1fzsyasd1z8b1gm2iaf38iys21116";
-      name = "powerdevil-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/powerdevil-5.24.0.tar.xz";
+      sha256 = "06mrahlrqibvgfhcxywh72h6jblqq6sjsxqjzbq7zbq61vgc3jg3";
+      name = "powerdevil-5.24.0.tar.xz";
     };
   };
   qqc2-breeze-style = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/qqc2-breeze-style-5.23.5.tar.xz";
-      sha256 = "15i9h2md54a1h7isvma4x9pni3iy0bk84z8ibn3a36ydimyq5hra";
-      name = "qqc2-breeze-style-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/qqc2-breeze-style-5.24.0.tar.xz";
+      sha256 = "11kwrqsq5i1y1kvhg75hvax7bz122cjdsvb66f6hvni09yfcgyci";
+      name = "qqc2-breeze-style-5.24.0.tar.xz";
     };
   };
   sddm-kcm = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/sddm-kcm-5.23.5.tar.xz";
-      sha256 = "0csj1gml8w29dzv62zpbia9g10qz5k1nzv1yywsvay1q8rbqccxv";
-      name = "sddm-kcm-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/sddm-kcm-5.24.0.tar.xz";
+      sha256 = "011b68vca8nnmj9rxlyl5gl3xrrbysmcrx8szyfhha0wl9rgy2hx";
+      name = "sddm-kcm-5.24.0.tar.xz";
     };
   };
   systemsettings = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/systemsettings-5.23.5.tar.xz";
-      sha256 = "0shsqancxbxy6f4fd9m2a30x7gnjmd6gb8kq4nhlj6rramcwn3jh";
-      name = "systemsettings-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/systemsettings-5.24.0.tar.xz";
+      sha256 = "1jx1kllfd5561fq11d90r7m68736rsdlyzb109yq8awdwrl1vkp3";
+      name = "systemsettings-5.24.0.tar.xz";
     };
   };
   xdg-desktop-portal-kde = {
-    version = "5.23.5";
+    version = "5.24.0";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.23.5/xdg-desktop-portal-kde-5.23.5.tar.xz";
-      sha256 = "09s3fpjdrnxqvnyxmxva0rx612d6pxv28qqvm00hzrb23nxz6qgb";
-      name = "xdg-desktop-portal-kde-5.23.5.tar.xz";
+      url = "${mirror}/stable/plasma/5.24.0/xdg-desktop-portal-kde-5.24.0.tar.xz";
+      sha256 = "0f5wv4557avzcn7gf2hjqpn2p9r0d16k1iqcijzcfdmnvh2cp69d";
+      name = "xdg-desktop-portal-kde-5.24.0.tar.xz";
     };
   };
 }
diff --git a/pkgs/development/compilers/4th/001-install-manual-fixup.diff b/pkgs/development/compilers/4th/001-install-manual-fixup.diff
new file mode 100644
index 00000000000..6002e7a0d99
--- /dev/null
+++ b/pkgs/development/compilers/4th/001-install-manual-fixup.diff
@@ -0,0 +1,12 @@
+diff -Naur 4th-3.64.0-old/sources/Makefile 4th-3.64.0-new/sources/Makefile
+--- 4th-3.64.0-old/sources/Makefile	2022-03-15 12:37:45.925122854 -0300
++++ 4th-3.64.0-new/sources/Makefile	2022-03-15 12:38:50.987870211 -0300
+@@ -125,7 +125,7 @@
+ 
+ install: mostlyinstall
+ 	install -Dm644 ../documentation/4th.1 $(MANDIR)/man1/4th.1
+-	install -Dm644 ../documentation/4tHmanual.txt $(DOCDIR)/4th/
++	install -Dm644 ../documentation/4tHmanual.pdf $(DOCDIR)/4th/
+ 
+ uninstall:
+ 	-rm -f $(LIBRARIES)/lib4th.{a,so*}
diff --git a/pkgs/development/compilers/4th/default.nix b/pkgs/development/compilers/4th/default.nix
index a8923879c06..d76a5cc733c 100644
--- a/pkgs/development/compilers/4th/default.nix
+++ b/pkgs/development/compilers/4th/default.nix
@@ -2,13 +2,18 @@
 
 stdenv.mkDerivation rec {
   pname = "4th";
-  version = "3.62.5";
+  version = "3.64.0";
 
   src = fetchurl {
     url = "https://sourceforge.net/projects/forth-4th/files/${pname}-${version}/${pname}-${version}-unix.tar.gz";
-    sha256 = "sha256-+CL33Yz7CxdEpi1lPG7+kzV4rheJ7GCgiFCaOLyktPw=";
+    hash = "sha256-wJBekjFsFRIkhY/P/yHBQ8he+k+fGyrePGTP2Yjgpqg=";
   };
 
+  patches = [
+    # Fix install manual; report this patch to upstream
+    ./001-install-manual-fixup.diff
+  ];
+
   dontConfigure = true;
 
   makeFlags = [
@@ -31,9 +36,11 @@ stdenv.mkDerivation rec {
   ];
 
   meta = with lib; {
-    description = "A portable Forth compiler";
     homepage = "https://thebeez.home.xs4all.nl/4tH/index.html";
-    license = licenses.lgpl3;
-    platforms = platforms.all;
+    description = "A portable Forth compiler";
+    license = licenses.lgpl3Plus;
+    maintainers = with maintainers; [ AndersonTorres ];
+    platforms = platforms.unix;
   };
 }
+# TODO: set Makefile according to platform
diff --git a/pkgs/development/compilers/go/1.16.nix b/pkgs/development/compilers/go/1.16.nix
index c30abc44fe2..872ade45946 100644
--- a/pkgs/development/compilers/go/1.16.nix
+++ b/pkgs/development/compilers/go/1.16.nix
@@ -168,6 +168,7 @@ stdenv.mkDerivation rec {
     ./creds-test.patch
     ./go-1.9-skip-flaky-19608.patch
     ./go-1.9-skip-flaky-20072.patch
+    ./skip-chown-tests-1.16.patch
     ./skip-external-network-tests-1.16.patch
     ./skip-nohup-tests.patch
     ./skip-cgo-tests-1.15.patch
diff --git a/pkgs/development/compilers/go/1.17.nix b/pkgs/development/compilers/go/1.17.nix
index 4b2a3d39a98..a7259358749 100644
--- a/pkgs/development/compilers/go/1.17.nix
+++ b/pkgs/development/compilers/go/1.17.nix
@@ -168,6 +168,7 @@ stdenv.mkDerivation rec {
     ./creds-test.patch
     ./go-1.9-skip-flaky-19608.patch
     ./go-1.9-skip-flaky-20072.patch
+    ./skip-chown-tests-1.16.patch
     ./skip-external-network-tests-1.16.patch
     ./skip-nohup-tests.patch
     ./skip-cgo-tests-1.15.patch
diff --git a/pkgs/development/compilers/go/1.18.nix b/pkgs/development/compilers/go/1.18.nix
index 17c31051999..23e9f70d4da 100644
--- a/pkgs/development/compilers/go/1.18.nix
+++ b/pkgs/development/compilers/go/1.18.nix
@@ -54,11 +54,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.18rc1";
+  version = "1.18";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${version}.src.tar.gz";
-    sha256 = "sha256-XOx6ZlMAj6hfiCGzNmXeN74om3oC8X829wWojEOYC7g=";
+    sha256 = "sha256-OPQj20zINIg/K1I0QoL6ejn7uTZQ3GKhH98L5kCb2tY=";
   };
 
   # perl is used for testing go vet
diff --git a/pkgs/development/compilers/llvm/13/clang/add-nostdlibinc-flag.patch b/pkgs/development/compilers/llvm/13/clang/add-nostdlibinc-flag.patch
new file mode 100644
index 00000000000..8007ba05f6e
--- /dev/null
+++ b/pkgs/development/compilers/llvm/13/clang/add-nostdlibinc-flag.patch
@@ -0,0 +1,18 @@
+diff --git a/lib/Driver/Driver.cpp b/lib/Driver/Driver.cpp
+index 94a7553e273b..8a1d455950b2 100644
+--- a/lib/Driver/Driver.cpp
++++ b/lib/Driver/Driver.cpp
+@@ -412,6 +412,13 @@ DerivedArgList *Driver::TranslateInputArgs(const InputArgList &Args) const {
+   }
+ #endif
+ 
++  {
++    Arg *A = DAL->MakeFlagArg(/*BaseArg=*/nullptr,
++                              Opts.getOption(options::OPT_nostdlibinc));
++    A->claim();
++    DAL->append(A);
++  }
++
+   return DAL;
+ }
+ 
diff --git a/pkgs/development/compilers/llvm/13/clang/default.nix b/pkgs/development/compilers/llvm/13/clang/default.nix
index 6c227f1ae72..62b9e0470a6 100644
--- a/pkgs/development/compilers/llvm/13/clang/default.nix
+++ b/pkgs/development/compilers/llvm/13/clang/default.nix
@@ -42,6 +42,7 @@ let
       # mis-compilation in firefox.
       # See: https://bugzilla.mozilla.org/show_bug.cgi?id=1741454
       ./revert-malloc-alignment-assumption.patch
+      ./add-nostdlibinc-flag.patch
       (substituteAll {
         src = ../../clang-11-12-LLVMgold-path.patch;
         libllvmLibdir = "${libllvm.lib}/lib";
@@ -51,10 +52,6 @@ let
     postPatch = ''
       (cd tools && ln -s ../../clang-tools-extra extra)
 
-      sed -i -e 's/DriverArgs.hasArg(options::OPT_nostdlibinc)/true/' \
-             -e 's/Args.hasArg(options::OPT_nostdlibinc)/true/' \
-             lib/Driver/ToolChains/*.cpp
-
       # Patch for standalone doc building
       sed -i '1s,^,find_package(Sphinx REQUIRED)\n,' docs/CMakeLists.txt
     '' + lib.optionalString stdenv.hostPlatform.isMusl ''
diff --git a/pkgs/development/compilers/llvm/13/default.nix b/pkgs/development/compilers/llvm/13/default.nix
index be5e9404cdd..874be111ade 100644
--- a/pkgs/development/compilers/llvm/13/default.nix
+++ b/pkgs/development/compilers/llvm/13/default.nix
@@ -18,7 +18,7 @@
 }:
 
 let
-  release_version = "13.0.0";
+  release_version = "13.0.1";
   candidate = ""; # empty or "rcN"
   dash-candidate = lib.optionalString (candidate != "") "-${candidate}";
   rev = ""; # When using a Git commit
@@ -30,7 +30,7 @@ let
     owner = "llvm";
     repo = "llvm-project";
     rev = if rev != "" then rev else "llvmorg-${version}";
-    sha256 = "0cjl0vssi4y2g4nfr710fb6cdhxmn5r0vis15sf088zsc5zydfhw";
+    sha256 = "06dv6h5dmvzdxbif2s8njki6h32796v368dyb5945x8gjj72xh7k";
   };
 
   llvm_meta = {
diff --git a/pkgs/development/compilers/open-watcom/v2.nix b/pkgs/development/compilers/open-watcom/v2.nix
index b521aaef106..dc2af6e7835 100644
--- a/pkgs/development/compilers/open-watcom/v2.nix
+++ b/pkgs/development/compilers/open-watcom/v2.nix
@@ -12,14 +12,14 @@
 
 stdenv.mkDerivation rec {
   pname = "open-watcom-v2";
-  version = "unstable-2022-02-22";
+  version = "unstable-2022-03-14";
   name = "${pname}-unwrapped-${version}";
 
   src = fetchFromGitHub {
     owner = "open-watcom";
     repo = "open-watcom-v2";
-    rev = "9e25b3d6b8066f09b4f7131a31de1cf2af691e9a";
-    sha256 = "1w336070kmhc6cmn2aqr8vm0fmw3yza2n0w4asvs2kqxjgmbn6i2";
+    rev = "22627ccc1bd3de70aff9ac056e0dc9ecf7f7b6ec";
+    sha256 = "khy/fhmQjTGKfx6iOUBt+ySwpEx0df/7meyNvBnJAPY=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/compilers/qbe/default.nix b/pkgs/development/compilers/qbe/default.nix
index 52397f78b8a..ee057f26c42 100644
--- a/pkgs/development/compilers/qbe/default.nix
+++ b/pkgs/development/compilers/qbe/default.nix
@@ -6,12 +6,12 @@
 
 stdenv.mkDerivation rec {
   pname = "qbe";
-  version = "unstable-2021-12-05";
+  version = "unstable-2022-03-11";
 
   src = fetchgit {
     url = "git://c9x.me/qbe.git";
-    rev = "367c8215d99054892740ad74c690b106c45ebf60";
-    sha256 = "sha256-xhTEiFR1RXMHtxmXlRof3O8monXEjstyWP3GClZmMuU=";
+    rev = "c7842d84da65bcaf2d3c82aa69fb3ec930c7369f";
+    sha256 = "sha256-fbxeoMJcVltrIGRLdJtxWykGIop8DVzpfrBatXniDPk=";
   };
 
   makeFlags = [ "PREFIX=$(out)" ];
diff --git a/pkgs/development/compilers/vala/default.nix b/pkgs/development/compilers/vala/default.nix
index 1dc910c6222..72512a1202f 100644
--- a/pkgs/development/compilers/vala/default.nix
+++ b/pkgs/development/compilers/vala/default.nix
@@ -90,8 +90,8 @@ in rec {
   };
 
   vala_0_54 = generic {
-    version = "0.54.6";
-    sha256 = "SdYNlqP99sQoc5dEK8bW2Vv0CqffZ47kkSjEsRum5Gk=";
+    version = "0.54.7";
+    sha256 = "Ygecof8C5dF65yqppa3GGuav3P67DZ8GBjo2776soMc=";
   };
 
   vala = vala_0_54;
diff --git a/pkgs/development/dotnet-modules/python-language-server/default.nix b/pkgs/development/dotnet-modules/python-language-server/default.nix
index 420475806a0..a433840b7bc 100644
--- a/pkgs/development/dotnet-modules/python-language-server/default.nix
+++ b/pkgs/development/dotnet-modules/python-language-server/default.nix
@@ -10,13 +10,13 @@
 
 buildDotnetModule rec {
   pname = "python-language-server";
-  version = "2021-09-08";
+  version = "2022-02-18";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "python-language-server";
-    rev = "26ea18997f45f7d7bc5a3c5a9efc723a8dbb02fa";
-    sha256 = "1m8pf9k20wy4fzv27v3bswvc8s01ag6ka2qm9nn6bgq0s0lq78mh";
+    rev = "52c1afd34b5acb0b44597bb8681232876fe94084";
+    sha256 = "05s8mwi3dqzjghgpr1mfs1b7cgrq818bbj1v7aly6axc8c2n4gny";
   };
 
   projectFile = "src/LanguageServer/Impl/Microsoft.Python.LanguageServer.csproj";
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index 1bcbd2bb4b5..02ecf8d25b1 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -191,7 +191,6 @@ in with passthru; stdenv.mkDerivation {
 
   prePatch = optionalString stdenv.isDarwin ''
     substituteInPlace configure --replace '`/usr/bin/arch`' '"i386"'
-    substituteInPlace configure --replace '-Wl,-stack_size,1000000' ' '
   '' + optionalString (pythonOlder "3.9" && stdenv.isDarwin && x11Support) ''
     # Broken on >= 3.9; replaced with ./3.9/darwin-tcl-tk.patch
     substituteInPlace setup.py --replace /Library/Frameworks /no-such-path
@@ -342,8 +341,6 @@ in with passthru; stdenv.mkDerivation {
       substituteInPlace ./setup.py --replace $i /no-such-path
     done
   '' + optionalString stdenv.isDarwin ''
-    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -msse2"
-    export MACOSX_DEPLOYMENT_TARGET=10.6
     # Override the auto-detection in setup.py, which assumes a universal build
     export PYTHON_DECIMAL_WITH_MACHINE=${if stdenv.isAarch64 then "uint128" else "x64"}
   '' + optionalString (isPy3k && pythonOlder "3.7") ''
diff --git a/pkgs/development/libraries/SDL2/Fix-build-against-wayland-1.20.patch b/pkgs/development/libraries/SDL2/Fix-build-against-wayland-1.20.patch
deleted file mode 100644
index 1be600bedb3..00000000000
--- a/pkgs/development/libraries/SDL2/Fix-build-against-wayland-1.20.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From a31d1f1683ef2e9c063c3fa1db79d111cca99414 Mon Sep 17 00:00:00 2001
-From: David Redondo <kde@david-redondo.de>
-Date: Fri, 10 Dec 2021 16:22:34 +0100
-Subject: [PATCH] Fix build against wayland 1.20
-
-Fixes #5088
-
-(cherry picked from commit e2ade2bfc46d915cd306c63c830b81d800b2575f)
----
- src/video/wayland/SDL_waylanddyn.h | 2 ++
- src/video/wayland/SDL_waylandsym.h | 4 ++++
- 2 files changed, 6 insertions(+)
-
-diff --git a/src/video/wayland/SDL_waylanddyn.h b/src/video/wayland/SDL_waylanddyn.h
-index 485a9c19f..37070e946 100644
---- a/src/video/wayland/SDL_waylanddyn.h
-+++ b/src/video/wayland/SDL_waylanddyn.h
-@@ -81,6 +81,8 @@ void SDL_WAYLAND_UnloadSymbols(void);
- #define wl_proxy_add_listener (*WAYLAND_wl_proxy_add_listener)
- #define wl_proxy_marshal_constructor (*WAYLAND_wl_proxy_marshal_constructor)
- #define wl_proxy_marshal_constructor_versioned (*WAYLAND_wl_proxy_marshal_constructor_versioned)
-+#define wl_proxy_marshal_flags (*WAYLAND_wl_proxy_marshal_flags)
-+#define wl_proxy_marshal_array_flags (*WAYLAND_wl_proxy_marshal_array_flags)
-
- #define wl_seat_interface (*WAYLAND_wl_seat_interface)
- #define wl_surface_interface (*WAYLAND_wl_surface_interface)
-diff --git a/src/video/wayland/SDL_waylandsym.h b/src/video/wayland/SDL_waylandsym.h
-index c4c189d3c..789f49e27 100644
---- a/src/video/wayland/SDL_waylandsym.h
-+++ b/src/video/wayland/SDL_waylandsym.h
-@@ -71,6 +71,10 @@ SDL_WAYLAND_SYM(struct wl_proxy *, wl_proxy_marshal_constructor, (struct wl_prox
- SDL_WAYLAND_MODULE(WAYLAND_CLIENT_1_10)
- SDL_WAYLAND_SYM(struct wl_proxy *, wl_proxy_marshal_constructor_versioned, (struct wl_proxy *proxy, uint32_t opcode, const struct wl_interface *interface, uint32_t version, ...))
-
-+SDL_WAYLAND_MODULE(WAYLAND_CLIENT_1_20)
-+SDL_WAYLAND_SYM(struct wl_proxy*, wl_proxy_marshal_flags, (struct wl_proxy *proxy, uint32_t opcode, const struct wl_interface *interfac, uint32_t version, uint32_t flags, ...))
-+SDL_WAYLAND_SYM(struct wl_proxy*, wl_proxy_marshal_array_flags, (struct wl_proxy *proxy, uint32_t opcode, const struct wl_interface *interface, uint32_t version,  uint32_t flags, union wl_argument *args))
-+
- SDL_WAYLAND_INTERFACE(wl_seat_interface)
- SDL_WAYLAND_INTERFACE(wl_surface_interface)
- SDL_WAYLAND_INTERFACE(wl_shm_pool_interface)
---
-2.33.1
diff --git a/pkgs/development/libraries/SDL2/default.nix b/pkgs/development/libraries/SDL2/default.nix
index 95022211d2f..d1086de3718 100644
--- a/pkgs/development/libraries/SDL2/default.nix
+++ b/pkgs/development/libraries/SDL2/default.nix
@@ -1,20 +1,50 @@
-{ lib, stdenv, config, fetchurl, pkg-config
+{ lib
+, stdenv
+, config
+, fetchurl
+, pkg-config
 , libGLSupported ? lib.elem stdenv.hostPlatform.system lib.platforms.mesaPlatforms
-, openglSupport ? libGLSupported, libGL
-, alsaSupport ? stdenv.isLinux && !stdenv.hostPlatform.isAndroid, alsa-lib
+, openglSupport ? libGLSupported
+, libGL
+, alsaSupport ? stdenv.isLinux && !stdenv.hostPlatform.isAndroid
+, alsa-lib
 , x11Support ? !stdenv.targetPlatform.isWindows && !stdenv.hostPlatform.isAndroid
-, libX11, xorgproto, libICE, libXi, libXScrnSaver, libXcursor
-, libXinerama, libXext, libXxf86vm, libXrandr
+, libX11
+, xorgproto
+, libICE
+, libXi
+, libXScrnSaver
+, libXcursor
+, libXinerama
+, libXext
+, libXxf86vm
+, libXrandr
 , waylandSupport ? stdenv.isLinux && !stdenv.hostPlatform.isAndroid
-, wayland, wayland-protocols, libxkbcommon
-, dbusSupport ? stdenv.isLinux && !stdenv.hostPlatform.isAndroid, dbus
-, udevSupport ? false, udev
-, ibusSupport ? false, ibus
-, fcitxSupport ? false, fcitx
+, wayland
+, wayland-protocols
+, libxkbcommon
+, dbusSupport ? stdenv.isLinux && !stdenv.hostPlatform.isAndroid
+, dbus
+, udevSupport ? false
+, udev
+, ibusSupport ? false
+, ibus
+, fcitxSupport ? false
+, fcitx
+, libdecorSupport ? stdenv.isLinux && !stdenv.hostPlatform.isAndroid
+, libdecor
+, pipewireSupport ? stdenv.isLinux && !stdenv.hostPlatform.isAndroid
+, pipewire # NOTE: must be built with SDL2 without pipewire support
 , pulseaudioSupport ? config.pulseaudio or stdenv.isLinux && !stdenv.hostPlatform.isAndroid
 , libpulseaudio
-, AudioUnit, Cocoa, CoreAudio, CoreServices, ForceFeedback, OpenGL
-, audiofile, libiconv
+, AudioUnit
+, Cocoa
+, CoreAudio
+, CoreServices
+, ForceFeedback
+, OpenGL
+, audiofile
+, libiconv
 , withStatic ? false
 }:
 
@@ -25,32 +55,16 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "SDL2";
-  version = "2.0.14";
+  version = "2.0.20";
 
   src = fetchurl {
     url = "https://www.libsdl.org/release/${pname}-${version}.tar.gz";
-    sha256 = "1g1jahknv5r4yhh1xq5sf0md20ybdw1zh1i15lry26sq39bmn8fq";
+    sha256 = "sha256-xWq6HXtbDn6Znkp2mMcLY6M5T/lwS19uHFfgwW8E3QY=";
   };
   dontDisableStatic = withStatic;
   outputs = [ "out" "dev" ];
   outputBin = "dev"; # sdl-config
 
-  patches = [
-    ./find-headers.patch
-    # To fix the build with wayland 1.20.0:
-    ./Fix-build-against-wayland-1.20.patch
-  ];
-
-  # Fix with mesa 19.2: https://bugzilla.libsdl.org/show_bug.cgi?id=4797
-  postPatch = ''
-    substituteInPlace include/SDL_opengl_glext.h \
-      --replace "typedef ptrdiff_t GLsizeiptr;" "typedef signed long int khronos_ssize_t; typedef khronos_ssize_t GLsizeiptr;" \
-      --replace "typedef ptrdiff_t GLintptr;" "typedef signed long int khronos_intptr_t; typedef khronos_intptr_t GLintptr;"
-
-    substituteInPlace configure \
-      --replace 'WAYLAND_SCANNER=`$PKG_CONFIG --variable=wayland_scanner wayland-scanner`' 'WAYLAND_SCANNER=`pkg-config --variable=wayland_scanner wayland-scanner`'
-  '';
-
   depsBuildBuild = [ pkg-config ];
 
   nativeBuildInputs = [ pkg-config ] ++ optionals waylandSupport [ wayland ];
@@ -63,18 +77,19 @@ stdenv.mkDerivation rec {
     # Propagated for #include <X11/Xlib.h> and <X11/Xatom.h> in SDL_syswm.h.
     ++ optionals x11Support [ libX11 xorgproto ];
 
-  dlopenBuildInputs = [ ]
-    ++ optionals  alsaSupport [ alsa-lib audiofile ]
-    ++ optional  dbusSupport dbus
-    ++ optional  pulseaudioSupport libpulseaudio
-    ++ optional  udevSupport udev
+  dlopenBuildInputs = optionals alsaSupport [ alsa-lib audiofile ]
+    ++ optional dbusSupport dbus
+    ++ optional libdecorSupport libdecor
+    ++ optional pipewireSupport pipewire
+    ++ optional pulseaudioSupport libpulseaudio
+    ++ optional udevSupport udev
     ++ optionals waylandSupport [ wayland wayland-protocols libxkbcommon ]
     ++ optionals x11Support [ libICE libXi libXScrnSaver libXcursor libXinerama libXext libXrandr libXxf86vm ];
 
   buildInputs = [ libiconv ]
     ++ dlopenBuildInputs
-    ++ optional  ibusSupport ibus
-    ++ optional  fcitxSupport fcitx
+    ++ optional ibusSupport ibus
+    ++ optional fcitxSupport fcitx
     ++ optionals stdenv.isDarwin [ AudioUnit Cocoa CoreAudio CoreServices ForceFeedback OpenGL ];
 
   enableParallelBuilding = true;
@@ -82,9 +97,9 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--disable-oss"
   ] ++ optional (!x11Support) "--without-x"
-    ++ optional alsaSupport "--with-alsa-prefix=${alsa-lib.out}/lib"
-    ++ optional stdenv.targetPlatform.isWindows "--disable-video-opengles"
-    ++ optional stdenv.isDarwin "--disable-sdltest";
+  ++ optional alsaSupport "--with-alsa-prefix=${alsa-lib.out}/lib"
+  ++ optional stdenv.targetPlatform.isWindows "--disable-video-opengles"
+  ++ optional stdenv.isDarwin "--disable-sdltest";
 
   # We remove libtool .la files when static libs are requested,
   # because they make the builds of downstream libs like `SDL_tff`
@@ -117,15 +132,17 @@ stdenv.mkDerivation rec {
   #
   # You can grep SDL sources with `grep -rE 'SDL_(NAME|.*_SYM)'` to
   # list the symbols used in this way.
-  postFixup = let
-    rpath = makeLibraryPath (dlopenPropagatedBuildInputs ++ dlopenBuildInputs);
-  in optionalString (stdenv.hostPlatform.extensions.sharedLibrary == ".so") ''
-    for lib in $out/lib/*.so* ; do
-      if ! [[ -L "$lib" ]]; then
-        patchelf --set-rpath "$(patchelf --print-rpath $lib):${rpath}" "$lib"
-      fi
-    done
-  '';
+  postFixup =
+    let
+      rpath = makeLibraryPath (dlopenPropagatedBuildInputs ++ dlopenBuildInputs);
+    in
+    optionalString (stdenv.hostPlatform.extensions.sharedLibrary == ".so") ''
+      for lib in $out/lib/*.so* ; do
+        if ! [[ -L "$lib" ]]; then
+          patchelf --set-rpath "$(patchelf --print-rpath $lib):${rpath}" "$lib"
+        fi
+      done
+    '';
 
   setupHook = ./setup-hook.sh;
 
diff --git a/pkgs/development/libraries/SDL2/find-headers.patch b/pkgs/development/libraries/SDL2/find-headers.patch
deleted file mode 100644
index a2e0c483703..00000000000
--- a/pkgs/development/libraries/SDL2/find-headers.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-diff -ru3 SDL2-2.0.14/sdl2-config.cmake.in SDL2-2.0.14-new/sdl2-config.cmake.in
---- SDL2-2.0.14/sdl2-config.cmake.in	2020-12-21 18:44:36.000000000 +0100
-+++ SDL2-2.0.14-new/sdl2-config.cmake.in	2021-01-16 23:53:40.721121792 +0100
-@@ -6,7 +6,8 @@
- set(SDL2_PREFIX "@prefix@")
- set(SDL2_EXEC_PREFIX "@prefix@")
- set(SDL2_LIBDIR "@libdir@")
--set(SDL2_INCLUDE_DIRS "@includedir@/SDL2")
-+set(SDL2_INCLUDE_DIRS "@includedir@/SDL2" $ENV{SDL2_PATH})
-+separate_arguments(SDL2_INCLUDE_DIRS)
- set(SDL2_LIBRARIES "-L${SDL2_LIBDIR} @SDL_RLD_FLAGS@ @SDL_LIBS@")
- string(STRIP "${SDL2_LIBRARIES}" SDL2_LIBRARIES)
- 
-@@ -20,14 +21,14 @@
- 
-   add_library(SDL2::SDL2 SHARED IMPORTED)
-   set_target_properties(SDL2::SDL2 PROPERTIES
--    INTERFACE_INCLUDE_DIRECTORIES "@includedir@/SDL2"
-+    INTERFACE_INCLUDE_DIRECTORIES "${SDL2_INCLUDE_DIRS}"
-     IMPORTED_LINK_INTERFACE_LANGUAGES "C"
-     IMPORTED_LOCATION "@libdir@/${CMAKE_SHARED_LIBRARY_PREFIX}SDL2${CMAKE_SHARED_LIBRARY_SUFFIX}"
-     INTERFACE_LINK_LIBRARIES "${SDL2_EXTRA_LINK_FLAGS}")
- 
-   add_library(SDL2::SDL2-static STATIC IMPORTED)
-   set_target_properties(SDL2::SDL2-static PROPERTIES
--    INTERFACE_INCLUDE_DIRECTORIES "@includedir@/SDL2"
-+    INTERFACE_INCLUDE_DIRECTORIES "${SDL2_INCLUDE_DIRS}"
-     IMPORTED_LINK_INTERFACE_LANGUAGES "C"
-     IMPORTED_LOCATION "@libdir@/${CMAKE_STATIC_LIBRARY_PREFIX}SDL2${CMAKE_STATIC_LIBRARY_SUFFIX}"
-     INTERFACE_LINK_LIBRARIES "${SDL2_EXTRA_LINK_FLAGS_STATIC}")
-diff -ru3 SDL2-2.0.14/sdl2-config.in SDL2-2.0.14-new/sdl2-config.in
---- SDL2-2.0.14/sdl2-config.in	2020-12-21 18:44:36.000000000 +0100
-+++ SDL2-2.0.14-new/sdl2-config.in	2021-01-16 23:57:11.940353171 +0100
-@@ -42,7 +42,11 @@
-       echo @SDL_VERSION@
-       ;;
-     --cflags)
--      echo -I@includedir@/SDL2 @SDL_CFLAGS@
-+      SDL_CFLAGS=""
-+      for i in @includedir@/SDL2 $SDL2_PATH; do
-+        SDL_CFLAGS="$SDL_CFLAGS -I$i"
-+      done
-+      echo $SDL_CFLAGS @SDL_CFLAGS@
-       ;;
- @ENABLE_SHARED_TRUE@    --libs)
- @ENABLE_SHARED_TRUE@      echo -L@libdir@ @SDL_RLD_FLAGS@ @SDL_LIBS@
diff --git a/pkgs/development/libraries/aws-checksums/default.nix b/pkgs/development/libraries/aws-checksums/default.nix
index 9042dc56154..058e4ea6a5f 100644
--- a/pkgs/development/libraries/aws-checksums/default.nix
+++ b/pkgs/development/libraries/aws-checksums/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-checksums";
-  version = "0.1.11";
+  version = "0.1.12";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-fXu7GI2UR9QiBGP2n2pEFRjz9ZwA+BAK9zxhNnoYWt4=";
+    sha256 = "sha256-k3hIGk92HncRAktpuvNcZnaBZiLj63/wQBz2WScUjhQ=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/boost/generic.nix b/pkgs/development/libraries/boost/generic.nix
index 49069303570..bad87fba8c6 100644
--- a/pkgs/development/libraries/boost/generic.nix
+++ b/pkgs/development/libraries/boost/generic.nix
@@ -127,7 +127,14 @@ stdenv.mkDerivation {
     extraPrefix = "libs/context/";
   })
   ++ optional (and (versionAtLeast version "1.70") (!versionAtLeast version "1.73")) ./cmake-paths.patch
-  ++ optional (versionAtLeast version "1.73") ./cmake-paths-173.patch;
+  ++ optional (versionAtLeast version "1.73") ./cmake-paths-173.patch
+  ++ optional (version == "1.77.0") (fetchpatch {
+    url = "https://github.com/boostorg/math/commit/7d482f6ebc356e6ec455ccb5f51a23971bf6ce5b.patch";
+    sha256 = "sha256-KlmIbixcds6GyKYt1fx5BxDIrU7msrgDdYo9Va/KJR4=";
+    stripLen = 2;
+    extraPrefix = "";
+    includes = [ "boost/math/special_functions/detail/bernoulli_details.hpp" ];
+  });
 
   meta = {
     homepage = "http://boost.org/";
diff --git a/pkgs/development/libraries/clearsilver/default.nix b/pkgs/development/libraries/clearsilver/default.nix
deleted file mode 100644
index 1a3e261c60e..00000000000
--- a/pkgs/development/libraries/clearsilver/default.nix
+++ /dev/null
@@ -1,44 +0,0 @@
-{ lib, stdenv, fetchurl, fetchpatch, python2 }:
-
-stdenv.mkDerivation rec {
-  pname = "clearsilver";
-  version = "0.10.5";
-
-  src = fetchurl {
-    url = "http://www.clearsilver.net/downloads/clearsilver-${version}.tar.gz";
-    sha256 = "1046m1dpq3nkgxbis2dr2x7hynmy51n64465q78d7pdgvqwa178y";
-  };
-
-  PYTHON_SITE = "${placeholder "out"}/${python2.sitePackages}";
-
-  configureFlags = [
-    "--with-python=${python2.interpreter}"
-    "--disable-apache"
-    "--disable-perl"
-    "--disable-ruby"
-    "--disable-java"
-    "--disable-csharp"
-  ];
-
-  preInstall = ''
-    mkdir -p $out
-    mkdir -p $out/${python2.sitePackages}
-  '';
-
-  patches = [
-    (fetchpatch {
-      url = "https://sources.debian.net/data/main/c/clearsilver/0.10.5-1.6/debian/patches/clang-gcc5.patch";
-      sha256 = "0d44v9jx0b6k8nvrhknd958i9rs59kdh73z0lb4f1mzi8if16c38";
-    })
-    (fetchpatch {
-      url = "https://sources.debian.net/data/main/c/clearsilver/0.10.5-1.6/debian/patches/CVE-2011-4357.diff";
-      sha256 = "1lfncavxdqckrz03gv97lcliygbpi9lnih944vmdbn9zw6fwcipi";
-    })
-  ];
-
-  meta = with lib; {
-    description = "Fast, powerful, and language-neutral HTML template system";
-    homepage = "http://www.clearsilver.net/";
-    license = licenses.free;
-  };
-}
diff --git a/pkgs/development/libraries/expat/default.nix b/pkgs/development/libraries/expat/default.nix
index 9e913fdf52b..ac54ced75b1 100644
--- a/pkgs/development/libraries/expat/default.nix
+++ b/pkgs/development/libraries/expat/default.nix
@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "expat";
-  version = "2.4.4";
+  version = "2.4.6";
 
   src = fetchurl {
     url = "https://github.com/libexpat/libexpat/releases/download/R_${lib.replaceStrings ["."] ["_"] version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-tdJdbjczUcLtGbVitHMtAdJYmsjI6eeWLY3xIHzDEbg=";
+    sha256 = "sha256-3lV5S3qbwhSFL9wHW+quzYVO/hNhWX5iaO6HlGlRKJs=";
   };
 
   outputs = [ "out" "dev" ]; # TODO: fix referrers
diff --git a/pkgs/development/libraries/gd/default.nix b/pkgs/development/libraries/gd/default.nix
index cd971b291b9..7ea8ce6d29b 100644
--- a/pkgs/development/libraries/gd/default.nix
+++ b/pkgs/development/libraries/gd/default.nix
@@ -5,10 +5,11 @@
 , pkg-config
 , zlib
 , libpng
-, libjpeg ? null
-, libwebp ? null
-, libtiff ? null
-, libXpm ? null
+, libjpeg
+, libwebp
+, libtiff
+, libXpm
+, libavif
 , fontconfig
 , freetype
 }:
@@ -41,8 +42,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoconf automake pkg-config ];
 
-  buildInputs = [ zlib fontconfig freetype ];
-  propagatedBuildInputs = [ libpng libjpeg libwebp libtiff libXpm ];
+  buildInputs = [ zlib fontconfig freetype libpng libjpeg libwebp libtiff libXpm libavif ];
 
   outputs = [ "bin" "dev" "out" ];
 
diff --git a/pkgs/development/libraries/gdbm/default.nix b/pkgs/development/libraries/gdbm/default.nix
index 83df37f236b..e1a3def0ba4 100644
--- a/pkgs/development/libraries/gdbm/default.nix
+++ b/pkgs/development/libraries/gdbm/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gdbm";
-  version = "1.20";
+  version = "1.23";
 
   src = fetchurl {
     url = "mirror://gnu/gdbm/${pname}-${version}.tar.gz";
-    sha256 = "sha256-OurAVkizSCoQotqYa586OAoprWUL6AuYF6Q1+4EUopI=";
+    sha256 = "sha256-dLEIHSH/8TrkvXwW5dblBKTCb3zeHcoNljpIQXS7ys0=";
   };
 
   doCheck = true; # not cross;
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index 30f43c00a05..c98058768b2 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -45,11 +45,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "glib";
-  version = "2.70.2";
+  version = "2.70.3";
 
   src = fetchurl {
     url = "mirror://gnome/sources/glib/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "BVFFnIXNPaPVjdyQFv0ovlr1A/XhYVpxultRKslFgG8=";
+    sha256 = "Iz+khBweGeOW23YH1Y9rdbozE8UL8Pzgey41MtXrfUY=";
   };
 
   patches = optionals stdenv.isDarwin [
diff --git a/pkgs/development/libraries/glibc/2.33-master.patch.gz b/pkgs/development/libraries/glibc/2.33-master.patch.gz
index 49ffd4a7441..777e94e2b2e 100644
--- a/pkgs/development/libraries/glibc/2.33-master.patch.gz
+++ b/pkgs/development/libraries/glibc/2.33-master.patch.gz
Binary files differdiff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index 9a84a5f8167..ffec9972d28 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -44,7 +44,7 @@
 
 let
   version = "2.33";
-  patchSuffix = "-108";
+  patchSuffix = "-117";
   sha256 = "sha256-LiVWAA4QXb1X8Layoy/yzxc73k8Nhd/8z9i35RoGd/8=";
 in
 
@@ -63,7 +63,7 @@ stdenv.mkDerivation ({
     [
       /* No tarballs for stable upstream branch, only https://sourceware.org/git/glibc.git and using git would complicate bootstrapping.
           $ git fetch --all -p && git checkout origin/release/2.33/master && git describe
-          glibc-2.33-108-g3e2a15c666
+          glibc-2.33-117-g55446dd8a2
           $ git show --minimal --reverse glibc-2.33.. | gzip -9n --rsyncable - > 2.33-master.patch.gz
 
          To compare the archive contents zdiff can be used.
diff --git a/pkgs/development/libraries/gnu-config/default.nix b/pkgs/development/libraries/gnu-config/default.nix
index a08997ea2cd..0b765019992 100644
--- a/pkgs/development/libraries/gnu-config/default.nix
+++ b/pkgs/development/libraries/gnu-config/default.nix
@@ -20,6 +20,8 @@ in stdenv.mkDerivation {
     mkdir -p $out
     cp ${configGuess} $out/config.guess
     cp ${configSub} $out/config.sub
+
+    chmod +x $out/config.*
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/gpgme/default.nix b/pkgs/development/libraries/gpgme/default.nix
index 263807c2fc1..75b13b6b7ef 100644
--- a/pkgs/development/libraries/gpgme/default.nix
+++ b/pkgs/development/libraries/gpgme/default.nix
@@ -1,28 +1,37 @@
-{ lib, stdenv, fetchurl, fetchpatch
-, autoreconfHook, libgpg-error, gnupg, pkg-config, glib, pth, libassuan
-, file, which, ncurses
+{ lib
+, stdenv
+, fetchurl
+, fetchpatch
+, autoreconfHook
+, libgpg-error
+, gnupg
+, pkg-config
+, glib
+, pth
+, libassuan
+, file
+, which
+, ncurses
 , texinfo
 , buildPackages
 , qtbase ? null
-, pythonSupport ? false, swig2 ? null, python ? null
+, pythonSupport ? false
+, swig2 ? null
+, python ? null
 }:
-
 let
   inherit (stdenv.hostPlatform) system;
 in
-
 stdenv.mkDerivation rec {
   pname = "gpgme";
-  version = "1.16.0";
+  version = "1.17.0";
 
   src = fetchurl {
     url = "mirror://gnupg/gpgme/${pname}-${version}.tar.bz2";
-    sha256 = "1l4yw9fqc1blvx1sq1jnfvp1jijla3ca2jw90p4x9m8hvfpc933c";
+    sha256 = "1xb9k88rrafdi0n95nzx0d6bz7hcn9b44hciqbigrqkvxc6gblsf";
   };
 
   patches = [
-    # probably included in > 1.16.0
-    ./test_t-edit-sign.diff
     # https://dev.gnupg.org/rMc4cf527ea227edb468a84bf9b8ce996807bd6992
     ./fix_gpg_list_keys.diff
     # https://lists.gnupg.org/pipermail/gnupg-devel/2020-April/034591.html
@@ -31,22 +40,48 @@ stdenv.mkDerivation rec {
       url = "https://lists.gnupg.org/pipermail/gnupg-devel/attachments/20200415/f7be62d1/attachment.obj";
       sha256 = "00d4sxq63601lzdp2ha1i8fvybh7dzih4531jh8bx07fab3sw65g";
     })
+    # Support Python 3.10 version detection without distutils, https://dev.gnupg.org/D545
+    ./python-310-detection-without-distutils.patch
+    # Find correct version string for Python >= 3.10, https://dev.gnupg.org/D546
+    ./python-find-version-string-above-310.patch
     # Disable python tests on Darwin as they use gpg (see configureFlags below)
   ] ++ lib.optional stdenv.isDarwin ./disable-python-tests.patch
-  # Fix _AC_UNDECLARED_WARNING for autoconf≥2.70. See https://lists.gnupg.org/pipermail/gnupg-devel/2020-November/034643.html
+  # Fix _AC_UNDECLARED_WARNING for autoconf>=2.70
+  # See https://lists.gnupg.org/pipermail/gnupg-devel/2020-November/034643.html
   ++ lib.optional stdenv.cc.isClang ./fix-clang-autoconf-undeclared-warning.patch;
 
   outputs = [ "out" "dev" "info" ];
+
   outputBin = "dev"; # gpgme-config; not so sure about gpgme-tool
 
-  propagatedBuildInputs =
-    [ libgpg-error glib libassuan pth ]
-    ++ lib.optional (qtbase != null) qtbase;
+  nativeBuildInputs = [
+    autoreconfHook
+    gnupg
+    pkg-config
+    texinfo
+  ] ++ lib.optionals pythonSupport [
+    ncurses
+    python
+    swig2
+    which
+  ];
 
-  nativeBuildInputs = [ pkg-config gnupg texinfo autoreconfHook ]
-  ++ lib.optionals pythonSupport [ python swig2 which ncurses ];
+  propagatedBuildInputs = [
+    glib
+    libassuan
+    libgpg-error
+    pth
+  ] ++ lib.optionals (qtbase != null) [
+    qtbase
+  ];
 
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
+  checkInputs = [
+    which
+  ];
+
+  depsBuildBuild = [
+    buildPackages.stdenv.cc
+  ];
 
   dontWrapQtApps = true;
 
@@ -59,16 +94,15 @@ stdenv.mkDerivation rec {
   # which has a path length limit. Nix on darwin is using a build directory
   # that already has quite a long path and the resulting socket path doesn't
   # fit in the limit. https://github.com/NixOS/nix/pull/1085
-    ++ lib.optionals stdenv.isDarwin [ "--disable-gpg-test" ];
+  ++ lib.optionals stdenv.isDarwin [ "--disable-gpg-test" ];
 
   NIX_CFLAGS_COMPILE = toString (
     # qgpgme uses Q_ASSERT which retains build inputs at runtime unless
     # debugging is disabled
     lib.optional (qtbase != null) "-DQT_NO_DEBUG"
     # https://www.gnupg.org/documentation/manuals/gpgme/Largefile-Support-_0028LFS_0029.html
-    ++ lib.optional (system == "i686-linux") "-D_FILE_OFFSET_BITS=64");
-
-  checkInputs = [ which ];
+    ++ lib.optional (system == "i686-linux") "-D_FILE_OFFSET_BITS=64"
+  );
 
   doCheck = true;
 
diff --git a/pkgs/development/libraries/gpgme/python-310-detection-without-distutils.patch b/pkgs/development/libraries/gpgme/python-310-detection-without-distutils.patch
new file mode 100644
index 00000000000..e0eea9ff042
--- /dev/null
+++ b/pkgs/development/libraries/gpgme/python-310-detection-without-distutils.patch
@@ -0,0 +1,273 @@
+diff --git a/m4/ax_python_devel.m4 b/m4/ax_python_devel.m4
+--- a/m4/ax_python_devel.m4
++++ b/m4/ax_python_devel.m4
+@@ -1,5 +1,5 @@
+ # ===========================================================================
+-#      https://www.gnu.org/software/autoconf-archive/ax_python_devel.html
++#     https://www.gnu.org/software/autoconf-archive/ax_python_devel.html
+ # ===========================================================================
+ #
+ # SYNOPSIS
+@@ -12,8 +12,8 @@
+ #   in your configure.ac.
+ #
+ #   This macro checks for Python and tries to get the include path to
+-#   'Python.h'. It provides the $(PYTHON_CPPFLAGS) and $(PYTHON_LDFLAGS)
+-#   output variables. It also exports $(PYTHON_EXTRA_LIBS) and
++#   'Python.h'. It provides the $(PYTHON_CPPFLAGS) and $(PYTHON_LIBS) output
++#   variables. It also exports $(PYTHON_EXTRA_LIBS) and
+ #   $(PYTHON_EXTRA_LDFLAGS) for embedding Python in your code.
+ #
+ #   You can search for some particular version of Python by passing a
+@@ -67,7 +67,7 @@
+ #   modified version of the Autoconf Macro, you may extend this special
+ #   exception to the GPL to apply to your modified version as well.
+ 
+-#serial 17
++#serial 23
+ 
+ AU_ALIAS([AC_PYTHON_DEVEL], [AX_PYTHON_DEVEL])
+ AC_DEFUN([AX_PYTHON_DEVEL],[
+@@ -99,7 +99,7 @@
+ This version of the AC@&t@_PYTHON_DEVEL macro
+ doesn't work properly with versions of Python before
+ 2.1.0. You may need to re-run configure, setting the
+-variables PYTHON_CPPFLAGS, PYTHON_LDFLAGS, PYTHON_SITE_PKG,
++variables PYTHON_CPPFLAGS, PYTHON_LIBS, PYTHON_SITE_PKG,
+ PYTHON_EXTRA_LIBS and PYTHON_EXTRA_LDFLAGS by hand.
+ Moreover, to disable this check, set PYTHON_NOVERSIONCHECK
+ to something else than an empty string.
+@@ -135,16 +135,25 @@
+ 	#
+ 	# Check if you have distutils, else fail
+ 	#
+-	AC_MSG_CHECKING([for the distutils Python package])
+-	ac_distutils_result=`$PYTHON -c "import distutils" 2>&1`
+-	if test -z "$ac_distutils_result"; then
++	AC_MSG_CHECKING([for the sysconfig Python package])
++	ac_sysconfig_result=`$PYTHON -c "import sysconfig" 2>&1`
++	if test $? -eq 0; then
+ 		AC_MSG_RESULT([yes])
++		IMPORT_SYSCONFIG="import sysconfig"
+ 	else
+ 		AC_MSG_RESULT([no])
+-		AC_MSG_ERROR([cannot import Python module "distutils".
++
++		AC_MSG_CHECKING([for the distutils Python package])
++		ac_sysconfig_result=`$PYTHON -c "from distutils import sysconfig" 2>&1`
++		if test $? -eq 0; then
++			AC_MSG_RESULT([yes])
++			IMPORT_SYSCONFIG="from distutils import sysconfig"
++		else
++			AC_MSG_ERROR([cannot import Python module "distutils".
+ Please check your Python installation. The error was:
+-$ac_distutils_result])
+-		PYTHON_VERSION=""
++$ac_sysconfig_result])
++			PYTHON_VERSION=""
++		fi
+ 	fi
+ 
+ 	#
+@@ -152,10 +161,19 @@
+ 	#
+ 	AC_MSG_CHECKING([for Python include path])
+ 	if test -z "$PYTHON_CPPFLAGS"; then
+-		python_path=`$PYTHON -c "import distutils.sysconfig; \
+-			print (distutils.sysconfig.get_python_inc ());"`
+-		plat_python_path=`$PYTHON -c "import distutils.sysconfig; \
+-			print (distutils.sysconfig.get_python_inc (plat_specific=1));"`
++		if test "$IMPORT_SYSCONFIG" = "import sysconfig"; then
++			# sysconfig module has different functions
++			python_path=`$PYTHON -c "$IMPORT_SYSCONFIG; \
++				print (sysconfig.get_path ('include'));"`
++			plat_python_path=`$PYTHON -c "$IMPORT_SYSCONFIG; \
++				print (sysconfig.get_path ('platinclude'));"`
++		else
++			# old distutils way
++			python_path=`$PYTHON -c "$IMPORT_SYSCONFIG; \
++				print (sysconfig.get_python_inc ());"`
++			plat_python_path=`$PYTHON -c "$IMPORT_SYSCONFIG; \
++				print (sysconfig.get_python_inc (plat_specific=1));"`
++		fi
+ 		if test -n "${python_path}"; then
+ 			if test "${plat_python_path}" != "${python_path}"; then
+ 				python_path="-I$python_path -I$plat_python_path"
+@@ -172,14 +190,14 @@
+ 	# Check for Python library path
+ 	#
+ 	AC_MSG_CHECKING([for Python library path])
+-	if test -z "$PYTHON_LDFLAGS"; then
++	if test -z "$PYTHON_LIBS"; then
+ 		# (makes two attempts to ensure we've got a version number
+ 		# from the interpreter)
+ 		ac_python_version=`cat<<EOD | $PYTHON -
+ 
+ # join all versioning strings, on some systems
+ # major/minor numbers could be in different list elements
+-from distutils.sysconfig import *
++from sysconfig import *
+ e = get_config_var('VERSION')
+ if e is not None:
+ 	print(e)
+@@ -197,7 +215,7 @@
+ 		# Make the versioning information available to the compiler
+ 
+ 		# JW: We don't need it and it interferes with the hack
+-		# to detect multiple Pyhton versions
++		# to detect multiple Python versions
+ 		#AC_DEFINE_UNQUOTED([HAVE_PYTHON], ["$ac_python_version"],
+                 #                  [If available, contains the Python version number currently in use.])
+ 
+@@ -205,8 +223,8 @@
+ 		ac_python_libdir=`cat<<EOD | $PYTHON -
+ 
+ # There should be only one
+-import distutils.sysconfig
+-e = distutils.sysconfig.get_config_var('LIBDIR')
++$IMPORT_SYSCONFIG
++e = sysconfig.get_config_var('LIBDIR')
+ if e is not None:
+ 	print (e)
+ EOD`
+@@ -214,8 +232,8 @@
+ 		# Now, for the library:
+ 		ac_python_library=`cat<<EOD | $PYTHON -
+ 
+-import distutils.sysconfig
+-c = distutils.sysconfig.get_config_vars()
++$IMPORT_SYSCONFIG
++c = sysconfig.get_config_vars()
+ if 'LDVERSION' in c:
+ 	print ('python'+c[['LDVERSION']])
+ else:
+@@ -230,44 +248,67 @@
+ 		then
+ 			# use the official shared library
+ 			ac_python_library=`echo "$ac_python_library" | sed "s/^lib//"`
+-			PYTHON_LDFLAGS="-L$ac_python_libdir -l$ac_python_library"
++			PYTHON_LIBS="-L$ac_python_libdir -l$ac_python_library"
+ 		else
+ 			# old way: use libpython from python_configdir
+ 			ac_python_libdir=`$PYTHON -c \
+-			  "from distutils.sysconfig import get_python_lib as f; \
++			  "from sysconfig import get_python_lib as f; \
+ 			  import os; \
+ 			  print (os.path.join(f(plat_specific=1, standard_lib=1), 'config'));"`
+-			PYTHON_LDFLAGS="-L$ac_python_libdir -lpython$ac_python_version"
++			PYTHON_LIBS="-L$ac_python_libdir -lpython$ac_python_version"
+ 		fi
+ 
+-		if test -z "PYTHON_LDFLAGS"; then
++		if test -z "PYTHON_LIBS"; then
+ 			AC_MSG_ERROR([
+   Cannot determine location of your Python DSO. Please check it was installed with
+-  dynamic libraries enabled, or try setting PYTHON_LDFLAGS by hand.
++  dynamic libraries enabled, or try setting PYTHON_LIBS by hand.
+ 			])
+ 		fi
+ 	fi
+-	AC_MSG_RESULT([$PYTHON_LDFLAGS])
+-	AC_SUBST([PYTHON_LDFLAGS])
++	AC_MSG_RESULT([$PYTHON_LIBS])
++	AC_SUBST([PYTHON_LIBS])
+ 
+ 	#
+ 	# Check for site packages
+ 	#
+ 	AC_MSG_CHECKING([for Python site-packages path])
+ 	if test -z "$PYTHON_SITE_PKG"; then
+-		PYTHON_SITE_PKG=`$PYTHON -c "import distutils.sysconfig; \
+-			print (distutils.sysconfig.get_python_lib(0,0));"`
++		if test "$IMPORT_SYSCONFIG" = "import sysconfig"; then
++			PYTHON_SITE_PKG=`$PYTHON -c "$IMPORT_SYSCONFIG; \
++				print (sysconfig.get_path('purelib'));"`
++		else
++			# distutils.sysconfig way
++			PYTHON_SITE_PKG=`$PYTHON -c "$IMPORT_SYSCONFIG; \
++				print (sysconfig.get_python_lib(0,0));"`
++		fi
+ 	fi
+ 	AC_MSG_RESULT([$PYTHON_SITE_PKG])
+ 	AC_SUBST([PYTHON_SITE_PKG])
+ 
++	#
++	# Check for platform-specific site packages
++	#
++	AC_MSG_CHECKING([for Python platform specific site-packages path])
++	if test -z "$PYTHON_SITE_PKG"; then
++		if test "$IMPORT_SYSCONFIG" = "import sysconfig"; then
++			PYTHON_PLATFORM_SITE_PKG=`$PYTHON -c "$IMPORT_SYSCONFIG; \
++				print (sysconfig.get_path('platlib'));"`
++		else
++			# distutils.sysconfig way
++			PYTHON_PLATFORM_SITE_PKG=`$PYTHON -c "$IMPORT_SYSCONFIG; \
++				print (sysconfig.get_python_lib(1,0));"`
++		fi
++	fi
++	AC_MSG_RESULT([$PYTHON_PLATFORM_SITE_PKG])
++	AC_SUBST([PYTHON_PLATFORM_SITE_PKG])
++
+ 	#
+ 	# libraries which must be linked in when embedding
+ 	#
+ 	AC_MSG_CHECKING(python extra libraries)
+ 	if test -z "$PYTHON_EXTRA_LIBS"; then
+-	   PYTHON_EXTRA_LIBS=`$PYTHON -c "import distutils.sysconfig; \
+-                conf = distutils.sysconfig.get_config_var; \
++	   PYTHON_EXTRA_LIBS=`$PYTHON -c "$IMPORT_SYSCONFIG; \
++                conf = sysconfig.get_config_var; \
+                 print (conf('LIBS') + ' ' + conf('SYSLIBS'))"`
+ 	fi
+ 	AC_MSG_RESULT([$PYTHON_EXTRA_LIBS])
+@@ -278,8 +319,8 @@
+ 	#
+ 	AC_MSG_CHECKING(python extra linking flags)
+ 	if test -z "$PYTHON_EXTRA_LDFLAGS"; then
+-		PYTHON_EXTRA_LDFLAGS=`$PYTHON -c "import distutils.sysconfig; \
+-			conf = distutils.sysconfig.get_config_var; \
++		PYTHON_EXTRA_LDFLAGS=`$PYTHON -c "$IMPORT_SYSCONFIG; \
++			conf = sysconfig.get_config_var; \
+ 			print (conf('LINKFORSHARED'))"`
+ 	fi
+ 	AC_MSG_RESULT([$PYTHON_EXTRA_LDFLAGS])
+@@ -291,8 +332,10 @@
+ 	AC_MSG_CHECKING([consistency of all components of python development environment])
+ 	# save current global flags
+ 	ac_save_LIBS="$LIBS"
++	ac_save_LDFLAGS="$LDFLAGS"
+ 	ac_save_CPPFLAGS="$CPPFLAGS"
+-	LIBS="$ac_save_LIBS $PYTHON_LDFLAGS $PYTHON_EXTRA_LDFLAGS $PYTHON_EXTRA_LIBS"
++	LIBS="$ac_save_LIBS $PYTHON_LIBS $PYTHON_EXTRA_LIBS $PYTHON_EXTRA_LIBS"
++	LDFLAGS="$ac_save_LDFLAGS $PYTHON_EXTRA_LDFLAGS"
+ 	CPPFLAGS="$ac_save_CPPFLAGS $PYTHON_CPPFLAGS"
+ 	AC_LANG_PUSH([C])
+ 	AC_LINK_IFELSE([
+@@ -303,15 +346,17 @@
+ 	# turn back to default flags
+ 	CPPFLAGS="$ac_save_CPPFLAGS"
+ 	LIBS="$ac_save_LIBS"
++	LDFLAGS="$ac_save_LDFLAGS"
+ 
+ 	AC_MSG_RESULT([$pythonexists])
+ 
+         if test ! "x$pythonexists" = "xyes"; then
++        # gpgme: only warn here, no error, as we are looking for multiple versions
+ 	   AC_MSG_WARN([
+   Could not link test program to Python. Maybe the main Python library has been
+   installed in some non-standard library path. If so, pass it to configure,
+-  via the LDFLAGS environment variable.
+-  Example: ./configure LDFLAGS="-L/usr/non-standard-path/python/lib"
++  via the LIBS environment variable.
++  Example: ./configure LIBS="-L/usr/non-standard-path/python/lib"
+   ============================================================================
+    You probably have to install the development version of the Python package
+    for your distribution.  The exact name of this package varies among them.
+@@ -323,4 +368,4 @@
+ 	#
+ 	# all done!
+ 	#
+-])
++])
+\ No newline at end of file
+
diff --git a/pkgs/development/libraries/gpgme/python-find-version-string-above-310.patch b/pkgs/development/libraries/gpgme/python-find-version-string-above-310.patch
new file mode 100644
index 00000000000..3d8191c9929
--- /dev/null
+++ b/pkgs/development/libraries/gpgme/python-find-version-string-above-310.patch
@@ -0,0 +1,373 @@
+diff --git a/configure.ac b/configure.ac
+--- a/configure.ac
++++ b/configure.ac
+@@ -425,11 +425,12 @@
+ 	if test "$found_py" = "1" -o "$found_py3" = "1"; then
+ 	  # Reset everything, so that we can look for another Python.
+           m4_foreach([mym4pythonver],
+-                     [[2.7],[3.4],[3.5],[3.6],[3.7],[3.8],[3.9],[all]],
++                     [[2.7],[3.4],[3.5],[3.6],[3.7],[3.8],[3.9],[3.10],[all]],
+            [unset PYTHON
+ 	    unset PYTHON_VERSION
+ 	    unset PYTHON_CPPFLAGS
+ 	    unset PYTHON_LDFLAGS
++	    unset PYTHON_LIBS
+ 	    unset PYTHON_SITE_PKG
+ 	    unset PYTHON_EXTRA_LIBS
+ 	    unset PYTHON_EXTRA_LDFLAGS
+diff --git a/m4/python.m4 b/m4/python.m4
+--- a/m4/python.m4
++++ b/m4/python.m4
+@@ -1,10 +1,10 @@
+ ## ------------------------                                 -*- Autoconf -*-
+ ## Python file handling
+ ## From Andrew Dalke
+-## Updated by James Henstridge
++## Updated by James Henstridge and other contributors.
+ ## Updated by Werner Koch 2018-10-17
+-## ---------------------------------
+-# Copyright (C) 1999-2017 Free Software Foundation, Inc.
++## ------------------------
++# Copyright (C) 1999-2021 Free Software Foundation, Inc.
+ #
+ # This file is free software; the Free Software Foundation
+ # gives unlimited permission to copy and/or distribute it,
+@@ -36,13 +36,12 @@
+ # numbers and dots only.
+ AC_DEFUN([AM_PATH_PYTHON],
+  [
+-  dnl Find a Python interpreter.  Python versions prior to 2.0 are not
+-  dnl supported. (2.0 was released on October 16, 2000).  Python 3.0
+-  dnl through to Python 3.9 are also not supported.
++  dnl Find a Python interpreter.  Python versions prior to 2.7 are not
++  dnl supported. Python 3.0 through to Python 3.3 are also not supported.
+   m4_define_default([_AM_PYTHON_INTERPRETER_LIST],
+ [python2 python2.7 dnl
+  python dnl
+- python3 python3.9 python3.8 python3.7 python3.6 python3.5 python3.4
++ python3 python3.10 python3.9 python3.8 python3.7 python3.6 python3.5 python3.4
+  ])
+ 
+   AC_ARG_VAR([PYTHON], [the Python interpreter])
+@@ -85,34 +84,141 @@
+   ])
+ 
+   if test "$PYTHON" = :; then
+-  dnl Run any user-specified action, or abort.
++    dnl Run any user-specified action, or abort.
+     m4_default([$3], [AC_MSG_ERROR([no suitable Python interpreter found])])
+   else
+ 
+-  dnl Query Python for its version number.  Getting [:3] seems to be
+-  dnl the best way to do this; it's what "site.py" does in the standard
+-  dnl library.
+-
++  dnl Query Python for its version number.  Although site.py simply uses
++  dnl sys.version[:3], printing that failed with Python 3.10, since the
++  dnl trailing zero was eliminated. So now we output just the major
++  dnl and minor version numbers, as numbers. Apparently the tertiary
++  dnl version is not of interest.
++  dnl
+   AC_CACHE_CHECK([for $am_display_PYTHON version], [am_cv_python_version],
+-    [am_cv_python_version=`$PYTHON -c "import sys; sys.stdout.write(sys.version[[:3]])"`])
++    [am_cv_python_version=`$PYTHON -c "import sys; print ('%u.%u' % sys.version_info[[:2]])"`])
+   AC_SUBST([PYTHON_VERSION], [$am_cv_python_version])
+ 
+-  dnl Use the values of $prefix and $exec_prefix for the corresponding
+-  dnl values of PYTHON_PREFIX and PYTHON_EXEC_PREFIX.  These are made
+-  dnl distinct variables so they can be overridden if need be.  However,
+-  dnl general consensus is that you shouldn't need this ability.
+-
+-  AC_SUBST([PYTHON_PREFIX], ['${prefix}'])
+-  AC_SUBST([PYTHON_EXEC_PREFIX], ['${exec_prefix}'])
+-
+-  dnl At times (like when building shared libraries) you may want
++  dnl At times, e.g., when building shared libraries, you may want
+   dnl to know which OS platform Python thinks this is.
+-
++  dnl
+   AC_CACHE_CHECK([for $am_display_PYTHON platform], [am_cv_python_platform],
+     [am_cv_python_platform=`$PYTHON -c "import sys; sys.stdout.write(sys.platform)"`])
+   AC_SUBST([PYTHON_PLATFORM], [$am_cv_python_platform])
+ 
+-  # Just factor out some code duplication.
++  dnl emacs-page
++  dnl If --with-python-sys-prefix is given, use the values of sys.prefix
++  dnl and sys.exec_prefix for the corresponding values of PYTHON_PREFIX
++  dnl and PYTHON_EXEC_PREFIX. Otherwise, use the GNU ${prefix} and
++  dnl ${exec_prefix} variables.
++  dnl
++  dnl The two are made distinct variables so they can be overridden if
++  dnl need be, although general consensus is that you shouldn't need
++  dnl this separation.
++  dnl
++  dnl Also allow directly setting the prefixes via configure options,
++  dnl overriding any default.
++  dnl
++  if test "x$prefix" = xNONE; then
++    am__usable_prefix=$ac_default_prefix
++  else
++    am__usable_prefix=$prefix
++  fi
++
++  # Allow user to request using sys.* values from Python,
++  # instead of the GNU $prefix values.
++  AC_ARG_WITH([python-sys-prefix],
++  [AS_HELP_STRING([--with-python-sys-prefix],
++                  [use Python's sys.prefix and sys.exec_prefix values])],
++  [am_use_python_sys=:],
++  [am_use_python_sys=false])
++
++  # Allow user to override whatever the default Python prefix is.
++  AC_ARG_WITH([python_prefix],
++  [AS_HELP_STRING([--with-python_prefix],
++                  [override the default PYTHON_PREFIX])],
++  [am_python_prefix_subst=$withval
++   am_cv_python_prefix=$withval
++   AC_MSG_CHECKING([for explicit $am_display_PYTHON prefix])
++   AC_MSG_RESULT([$am_cv_python_prefix])],
++  [
++   if $am_use_python_sys; then
++     # using python sys.prefix value, not GNU
++     AC_CACHE_CHECK([for python default $am_display_PYTHON prefix],
++     [am_cv_python_prefix],
++     [am_cv_python_prefix=`$PYTHON -c "import sys; sys.stdout.write(sys.prefix)"`])
++
++     dnl If sys.prefix is a subdir of $prefix, replace the literal value of
++     dnl $prefix with a variable reference so it can be overridden.
++     case $am_cv_python_prefix in
++     $am__usable_prefix*)
++       am__strip_prefix=`echo "$am__usable_prefix" | sed 's|.|.|g'`
++       am_python_prefix_subst=`echo "$am_cv_python_prefix" | sed "s,^$am__strip_prefix,\\${prefix},"`
++       ;;
++     *)
++       am_python_prefix_subst=$am_cv_python_prefix
++       ;;
++     esac
++   else # using GNU prefix value, not python sys.prefix
++     am_python_prefix_subst='${prefix}'
++     am_python_prefix=$am_python_prefix_subst
++     AC_MSG_CHECKING([for GNU default $am_display_PYTHON prefix])
++     AC_MSG_RESULT([$am_python_prefix])
++   fi])
++  # Substituting python_prefix_subst value.
++  AC_SUBST([PYTHON_PREFIX], [$am_python_prefix_subst])
++
++  # emacs-page Now do it all over again for Python exec_prefix, but with yet
++  # another conditional: fall back to regular prefix if that was specified.
++  AC_ARG_WITH([python_exec_prefix],
++  [AS_HELP_STRING([--with-python_exec_prefix],
++                  [override the default PYTHON_EXEC_PREFIX])],
++  [am_python_exec_prefix_subst=$withval
++   am_cv_python_exec_prefix=$withval
++   AC_MSG_CHECKING([for explicit $am_display_PYTHON exec_prefix])
++   AC_MSG_RESULT([$am_cv_python_exec_prefix])],
++  [
++   # no explicit --with-python_exec_prefix, but if
++   # --with-python_prefix was given, use its value for python_exec_prefix too.
++   AS_IF([test -n "$with_python_prefix"],
++   [am_python_exec_prefix_subst=$with_python_prefix
++    am_cv_python_exec_prefix=$with_python_prefix
++    AC_MSG_CHECKING([for python_prefix-given $am_display_PYTHON exec_prefix])
++    AC_MSG_RESULT([$am_cv_python_exec_prefix])],
++   [
++    # Set am__usable_exec_prefix whether using GNU or Python values,
++    # since we use that variable for pyexecdir.
++    if test "x$exec_prefix" = xNONE; then
++      am__usable_exec_prefix=$am__usable_prefix
++    else
++      am__usable_exec_prefix=$exec_prefix
++    fi
++    #
++    if $am_use_python_sys; then # using python sys.exec_prefix, not GNU
++      AC_CACHE_CHECK([for python default $am_display_PYTHON exec_prefix],
++      [am_cv_python_exec_prefix],
++      [am_cv_python_exec_prefix=`$PYTHON -c "import sys; sys.stdout.write(sys.exec_prefix)"`])
++      dnl If sys.exec_prefix is a subdir of $exec_prefix, replace the
++      dnl literal value of $exec_prefix with a variable reference so it can
++      dnl be overridden.
++      case $am_cv_python_exec_prefix in
++      $am__usable_exec_prefix*)
++        am__strip_prefix=`echo "$am__usable_exec_prefix" | sed 's|.|.|g'`
++        am_python_exec_prefix_subst=`echo "$am_cv_python_exec_prefix" | sed "s,^$am__strip_prefix,\\${exec_prefix},"`
++        ;;
++      *)
++        am_python_exec_prefix_subst=$am_cv_python_exec_prefix
++        ;;
++     esac
++   else # using GNU $exec_prefix, not python sys.exec_prefix
++     am_python_exec_prefix_subst='${exec_prefix}'
++     am_python_exec_prefix=$am_python_exec_prefix_subst
++     AC_MSG_CHECKING([for GNU default $am_display_PYTHON exec_prefix])
++     AC_MSG_RESULT([$am_python_exec_prefix])
++   fi])])
++  # Substituting python_exec_prefix_subst.
++  AC_SUBST([PYTHON_EXEC_PREFIX], [$am_python_exec_prefix_subst])
++
++  # Factor out some code duplication into this shell variable.
+   am_python_setup_sysconfig="\
+ import sys
+ # Prefer sysconfig over distutils.sysconfig, for better compatibility
+@@ -132,96 +238,95 @@
+ except ImportError:
+     pass"
+ 
+-  dnl Set up 4 directories:
++  dnl emacs-page Set up 4 directories:
+ 
+-  dnl pythondir -- where to install python scripts.  This is the
+-  dnl   site-packages directory, not the python standard library
+-  dnl   directory like in previous automake betas.  This behavior
+-  dnl   is more consistent with lispdir.m4 for example.
++  dnl 1. pythondir: where to install python scripts.  This is the
++  dnl    site-packages directory, not the python standard library
++  dnl    directory like in previous automake betas.  This behavior
++  dnl    is more consistent with lispdir.m4 for example.
+   dnl Query distutils for this directory.
+-  AC_CACHE_CHECK([for $am_display_PYTHON script directory],
+-    [am_cv_python_pythondir],
+-    [if test "x$prefix" = xNONE
+-     then
+-       am_py_prefix=$ac_default_prefix
+-     else
+-       am_py_prefix=$prefix
+-     fi
+-     am_cv_python_pythondir=`$PYTHON -c "
++  dnl
++  AC_CACHE_CHECK([for $am_display_PYTHON script directory (pythondir)],
++  [am_cv_python_pythondir],
++  [if test "x$am_cv_python_prefix" = x; then
++     am_py_prefix=$am__usable_prefix
++   else
++     am_py_prefix=$am_cv_python_prefix
++   fi
++   am_cv_python_pythondir=`$PYTHON -c "
+ $am_python_setup_sysconfig
+ if can_use_sysconfig:
+-    sitedir = sysconfig.get_path('purelib', vars={'base':'$am_py_prefix'})
++  sitedir = sysconfig.get_path('purelib', vars={'base':'$am_py_prefix'})
+ else:
+-    from distutils import sysconfig
+-    sitedir = sysconfig.get_python_lib(0, 0, prefix='$am_py_prefix')
++  from distutils import sysconfig
++  sitedir = sysconfig.get_python_lib(0, 0, prefix='$am_py_prefix')
+ sys.stdout.write(sitedir)"`
+-     case $am_cv_python_pythondir in
+-     $am_py_prefix*)
+-       am__strip_prefix=`echo "$am_py_prefix" | sed 's|.|.|g'`
+-       am_cv_python_pythondir=`echo "$am_cv_python_pythondir" | sed "s,^$am__strip_prefix,$PYTHON_PREFIX,"`
+-       ;;
+-     *)
+-       case $am_py_prefix in
+-         /usr|/System*) ;;
+-         *)
+-	  am_cv_python_pythondir=$PYTHON_PREFIX/lib/python$PYTHON_VERSION/site-packages
+-	  ;;
+-       esac
+-       ;;
++   #
++   case $am_cv_python_pythondir in
++   $am_py_prefix*)
++     am__strip_prefix=`echo "$am_py_prefix" | sed 's|.|.|g'`
++     am_cv_python_pythondir=`echo "$am_cv_python_pythondir" | sed "s,^$am__strip_prefix,\\${PYTHON_PREFIX},"`
++     ;;
++   *)
++     case $am_py_prefix in
++       /usr|/System*) ;;
++       *) am_cv_python_pythondir="\${PYTHON_PREFIX}/lib/python$PYTHON_VERSION/site-packages"
++          ;;
+      esac
+-    ])
++     ;;
++   esac
++  ])
+   AC_SUBST([pythondir], [$am_cv_python_pythondir])
+ 
+-  dnl pkgpythondir -- $PACKAGE directory under pythondir.  Was
+-  dnl   PYTHON_SITE_PACKAGE in previous betas, but this naming is
+-  dnl   more consistent with the rest of automake.
+-
++  dnl 2. pkgpythondir: $PACKAGE directory under pythondir.  Was
++  dnl    PYTHON_SITE_PACKAGE in previous betas, but this naming is
++  dnl    more consistent with the rest of automake.
++  dnl
+   AC_SUBST([pkgpythondir], [\${pythondir}/$PACKAGE])
+ 
+-  dnl pyexecdir -- directory for installing python extension modules
+-  dnl   (shared libraries)
++  dnl 3. pyexecdir: directory for installing python extension modules
++  dnl    (shared libraries).
+   dnl Query distutils for this directory.
+-  AC_CACHE_CHECK([for $am_display_PYTHON extension module directory],
+-    [am_cv_python_pyexecdir],
+-    [if test "x$exec_prefix" = xNONE
+-     then
+-       am_py_exec_prefix=$am_py_prefix
+-     else
+-       am_py_exec_prefix=$exec_prefix
+-     fi
+-     am_cv_python_pyexecdir=`$PYTHON -c "
++  dnl
++  AC_CACHE_CHECK([for $am_display_PYTHON extension module directory (pyexecdir)],
++  [am_cv_python_pyexecdir],
++  [if test "x$am_cv_python_exec_prefix" = x; then
++     am_py_exec_prefix=$am__usable_exec_prefix
++   else
++     am_py_exec_prefix=$am_cv_python_exec_prefix
++   fi
++   am_cv_python_pyexecdir=`$PYTHON -c "
+ $am_python_setup_sysconfig
+ if can_use_sysconfig:
+-    sitedir = sysconfig.get_path('platlib', vars={'platbase':'$am_py_prefix'})
++  sitedir = sysconfig.get_path('platlib', vars={'platbase':'$am_py_exec_prefix'})
+ else:
+-    from distutils import sysconfig
+-    sitedir = sysconfig.get_python_lib(1, 0, prefix='$am_py_prefix')
++  from distutils import sysconfig
++  sitedir = sysconfig.get_python_lib(1, 0, prefix='$am_py_exec_prefix')
+ sys.stdout.write(sitedir)"`
+-     case $am_cv_python_pyexecdir in
+-     $am_py_exec_prefix*)
+-       am__strip_prefix=`echo "$am_py_exec_prefix" | sed 's|.|.|g'`
+-       am_cv_python_pyexecdir=`echo "$am_cv_python_pyexecdir" | sed "s,^$am__strip_prefix,$PYTHON_EXEC_PREFIX,"`
+-       ;;
+-     *)
+-       case $am_py_exec_prefix in
+-         /usr|/System*) ;;
+-         *)
+-	   am_cv_python_pyexecdir=$PYTHON_EXEC_PREFIX/lib/python$PYTHON_VERSION/site-packages
+-	   ;;
+-       esac
+-       ;;
++   #
++   case $am_cv_python_pyexecdir in
++   $am_py_exec_prefix*)
++     am__strip_prefix=`echo "$am_py_exec_prefix" | sed 's|.|.|g'`
++     am_cv_python_pyexecdir=`echo "$am_cv_python_pyexecdir" | sed "s,^$am__strip_prefix,\\${PYTHON_EXEC_PREFIX},"`
++     ;;
++   *)
++     case $am_py_exec_prefix in
++       /usr|/System*) ;;
++       *) am_cv_python_pyexecdir="\${PYTHON_EXEC_PREFIX}/lib/python$PYTHON_VERSION/site-packages"
++          ;;
+      esac
+-    ])
++     ;;
++   esac
++  ])
+   AC_SUBST([pyexecdir], [$am_cv_python_pyexecdir])
+ 
+-  dnl pkgpyexecdir -- $(pyexecdir)/$(PACKAGE)
+-
++  dnl 4. pkgpyexecdir: $(pyexecdir)/$(PACKAGE)
++  dnl
+   AC_SUBST([pkgpyexecdir], [\${pyexecdir}/$PACKAGE])
+ 
+   dnl Run any user-specified action.
+   $2
+   fi
+-
+ ])
+ 
+ 
+
diff --git a/pkgs/development/libraries/gpgme/test_t-edit-sign.diff b/pkgs/development/libraries/gpgme/test_t-edit-sign.diff
deleted file mode 100644
index 55075b9eb12..00000000000
--- a/pkgs/development/libraries/gpgme/test_t-edit-sign.diff
+++ /dev/null
@@ -1,125 +0,0 @@
-From 81a33ea5e1b86d586b956e893a5b25c4cd41c969 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Ingo=20Kl=C3=B6cker?= <dev@ingo-kloecker.de>
-Date: Sat, 26 Jun 2021 18:02:47 +0200
-Subject: [PATCH] core: Fix use-after-free issue in test
-
-* tests/gpg/t-edit-sign.c (sign_key, verify_key_signature): New.
-(main): Factored out signing and verifying the result.
---
-
-Factoring the two steps of the test into different functions fixes the
-use-after-free issue that was caused by accidentaly using a variable
-of the first step in the second step.
-
-GnuPG-bug-id: 5509
----
- tests/gpg/t-edit-sign.c | 54 ++++++++++++++++++++++++++++-------------
- 1 file changed, 37 insertions(+), 17 deletions(-)
-
-diff --git a/tests/gpg/t-edit-sign.c b/tests/gpg/t-edit-sign.c
-index 2f983622..e0494c54 100644
---- a/tests/gpg/t-edit-sign.c
-+++ b/tests/gpg/t-edit-sign.c
-@@ -107,31 +107,19 @@ interact_fnc (void *opaque, const char *status, const char *args, int fd)
- }
- 
- 
--int
--main (int argc, char **argv)
-+void
-+sign_key (const char *key_fpr, const char *signer_fpr)
- {
-   gpgme_ctx_t ctx;
-   gpgme_error_t err;
-   gpgme_data_t out = NULL;
--  const char *signer_fpr = "A0FF4590BB6122EDEF6E3C542D727CC768697734"; /* Alpha Test */
-   gpgme_key_t signing_key = NULL;
--  const char *key_fpr = "D695676BDCEDCC2CDD6152BCFE180B1DA9E3B0B2"; /* Bravo Test */
-   gpgme_key_t key = NULL;
--  gpgme_key_t signed_key = NULL;
--  gpgme_user_id_t signed_uid = NULL;
--  gpgme_key_sig_t key_sig = NULL;
-   char *agent_info;
--  int mode;
--
--  (void)argc;
--  (void)argv;
--
--  init_gpgme (GPGME_PROTOCOL_OpenPGP);
- 
-   err = gpgme_new (&ctx);
-   fail_if_err (err);
- 
--  /* Sign the key */
-   agent_info = getenv("GPG_AGENT_INFO");
-   if (!(agent_info && strchr (agent_info, ':')))
-     gpgme_set_passphrase_cb (ctx, passphrase_cb, 0);
-@@ -159,8 +147,23 @@ main (int argc, char **argv)
-   gpgme_data_release (out);
-   gpgme_key_unref (key);
-   gpgme_key_unref (signing_key);
-+  gpgme_release (ctx);
-+}
-+
-+
-+void
-+verify_key_signature (const char *key_fpr, const char *signer_keyid)
-+{
-+  gpgme_ctx_t ctx;
-+  gpgme_error_t err;
-+  gpgme_key_t signed_key = NULL;
-+  gpgme_user_id_t signed_uid = NULL;
-+  gpgme_key_sig_t key_sig = NULL;
-+  int mode;
-+
-+  err = gpgme_new (&ctx);
-+  fail_if_err (err);
- 
--  /* Verify the key signature */
-   mode  = gpgme_get_keylist_mode (ctx);
-   mode |= GPGME_KEYLIST_MODE_SIGS;
-   err = gpgme_set_keylist_mode (ctx, mode);
-@@ -168,7 +171,7 @@ main (int argc, char **argv)
-   err = gpgme_get_key (ctx, key_fpr, &signed_key, 0);
-   fail_if_err (err);
- 
--  signed_uid = key->uids;
-+  signed_uid = signed_key->uids;
-   if (!signed_uid)
-     {
-       fprintf (stderr, "Signed key has no user IDs\n");
-@@ -180,7 +183,7 @@ main (int argc, char **argv)
-       exit (1);
-     }
-   key_sig = signed_uid->signatures->next;
--  if (strcmp ("2D727CC768697734", key_sig->keyid))
-+  if (strcmp (signer_keyid, key_sig->keyid))
-     {
-       fprintf (stderr, "Unexpected key ID in second user ID sig: %s\n",
-                 key_sig->keyid);
-@@ -196,6 +199,23 @@ main (int argc, char **argv)
- 
-   gpgme_key_unref (signed_key);
-   gpgme_release (ctx);
-+}
-+
-+
-+int
-+main (int argc, char **argv)
-+{
-+  const char *signer_fpr = "A0FF4590BB6122EDEF6E3C542D727CC768697734"; /* Alpha Test */
-+  const char *signer_keyid = signer_fpr + strlen(signer_fpr) - 16;
-+  const char *key_fpr = "D695676BDCEDCC2CDD6152BCFE180B1DA9E3B0B2"; /* Bravo Test */
-+
-+  (void)argc;
-+  (void)argv;
-+
-+  init_gpgme (GPGME_PROTOCOL_OpenPGP);
-+
-+  sign_key (key_fpr, signer_fpr);
-+  verify_key_signature (key_fpr, signer_keyid);
- 
-   return 0;
- }
--- 
-2.32.0
diff --git a/pkgs/development/libraries/harfbuzz/default.nix b/pkgs/development/libraries/harfbuzz/default.nix
index 1e36f1e7f0f..e47b18252e9 100644
--- a/pkgs/development/libraries/harfbuzz/default.nix
+++ b/pkgs/development/libraries/harfbuzz/default.nix
@@ -24,7 +24,7 @@
 }:
 
 let
-  version = "3.2.0";
+  version = "3.3.2";
   inherit (lib) optional optionals optionalString;
   mesonFeatureFlag = opt: b:
     "-D${opt}=${if b then "enabled" else "disabled"}";
@@ -39,7 +39,7 @@ stdenv.mkDerivation {
     owner = "harfbuzz";
     repo = "harfbuzz";
     rev = version;
-    sha256 = "sha256-iNYp/hyJTaaF6e09YpUL7ktBhq2wRN9zKiEH59WLbYU=";
+    sha256 = "sha256-UbYqV7Ch9ugTIwSsCpjnS8H7tcv4P3OVpFDFDZtQCk0=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/kde-frameworks/fetch.sh b/pkgs/development/libraries/kde-frameworks/fetch.sh
index 50204bc0ec0..cb4e4cc2629 100644
--- a/pkgs/development/libraries/kde-frameworks/fetch.sh
+++ b/pkgs/development/libraries/kde-frameworks/fetch.sh
@@ -1 +1 @@
-WGET_ARGS=( https://download.kde.org/stable/frameworks/5.90/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.kde.org/stable/frameworks/5.91/ -A '*.tar.xz' )
diff --git a/pkgs/development/libraries/kde-frameworks/kdesu/kdesu-search-for-wrapped-daemon-first.patch b/pkgs/development/libraries/kde-frameworks/kdesu/kdesu-search-for-wrapped-daemon-first.patch
index 07da70092dc..1379707f02f 100644
--- a/pkgs/development/libraries/kde-frameworks/kdesu/kdesu-search-for-wrapped-daemon-first.patch
+++ b/pkgs/development/libraries/kde-frameworks/kdesu/kdesu-search-for-wrapped-daemon-first.patch
@@ -13,18 +13,18 @@ diff --git a/src/client.cpp b/src/client.cpp
 index 44fbacd..6b5abf5 100644
 --- a/src/client.cpp
 +++ b/src/client.cpp
-@@ -378,11 +378,14 @@ int KDEsuClient::stopServer()
+@@ -384,11 +384,14 @@ int KDEsuClient::stopServer()
  
  static QString findDaemon()
  {
--    QString daemon = QFile::decodeName(KDE_INSTALL_FULL_LIBEXECDIR_KF5 "/kdesud");
+-    QString daemon = QFile::decodeName(KDE_INSTALL_FULL_LIBEXECDIR_KF "/kdesud");
 -    if (!QFile::exists(daemon)) { // if not in libexec, find it in PATH
 -        daemon = QStandardPaths::findExecutable(QStringLiteral("kdesud"));
 -        if (daemon.isEmpty()) {
 -            qCWarning(KSU_LOG) << "kdesud daemon not found.";
 +    QString daemon = QFile::decodeName("/run/wrappers/bin/kdesud");
 +    if (!QFile::exists(daemon)) { // if not in wrappers
-+        daemon = QFile::decodeName(KDE_INSTALL_FULL_LIBEXECDIR_KF5 "/kdesud");
++        daemon = QFile::decodeName(KDE_INSTALL_FULL_LIBEXECDIR_KF "/kdesud");
 +        if (!QFile::exists(daemon)) { // if not in libexec, find it in PATH
 +            daemon = QStandardPaths::findExecutable(QStringLiteral("kdesud"));
 +            if (daemon.isEmpty()) {
diff --git a/pkgs/development/libraries/kde-frameworks/srcs.nix b/pkgs/development/libraries/kde-frameworks/srcs.nix
index 1ffc5df68c3..2b3983a892c 100644
--- a/pkgs/development/libraries/kde-frameworks/srcs.nix
+++ b/pkgs/development/libraries/kde-frameworks/srcs.nix
@@ -4,667 +4,667 @@
 
 {
   attica = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/attica-5.90.0.tar.xz";
-      sha256 = "0zs37qyh9biafk76ps2xfc41hbd1n4dq42qqqcvbqcrwfgqz2wlk";
-      name = "attica-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/attica-5.91.0.tar.xz";
+      sha256 = "0svvy7qflidwxns12y2lra54gg6lhglcddzmrw7ccvbdyqcy2pn0";
+      name = "attica-5.91.0.tar.xz";
     };
   };
   baloo = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/baloo-5.90.0.tar.xz";
-      sha256 = "1nnfys8dyiivd2if81qrgrmpprfni77an9l3wff0l5k85ac86i56";
-      name = "baloo-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/baloo-5.91.0.tar.xz";
+      sha256 = "1cqjbaiwqba707xaz9zsrdz9cms2mdrhv6jpwsq8q7f4g4rxcx3m";
+      name = "baloo-5.91.0.tar.xz";
     };
   };
   bluez-qt = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/bluez-qt-5.90.0.tar.xz";
-      sha256 = "056i5ndrg5fqm1bx49a0plfhlladphha128wi766zdhcm6np11z3";
-      name = "bluez-qt-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/bluez-qt-5.91.0.tar.xz";
+      sha256 = "0p37jrmppwahh4vaq3wkw6xn0ms8dxcxpfd4glzjlnw426zrwnjr";
+      name = "bluez-qt-5.91.0.tar.xz";
     };
   };
   breeze-icons = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/breeze-icons-5.90.0.tar.xz";
-      sha256 = "06dfh571rf8gp4gnnqn13xqgc1bpc4ycn6bmxf38x53fxxfl3fnn";
-      name = "breeze-icons-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/breeze-icons-5.91.0.tar.xz";
+      sha256 = "0aj24gn48c17n9jzrj0az04ph4hpx7zf2rj4vgwl19iip69vfzf1";
+      name = "breeze-icons-5.91.0.tar.xz";
     };
   };
   extra-cmake-modules = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/extra-cmake-modules-5.90.0.tar.xz";
-      sha256 = "1c5wza7srib3mdkf29ygmyj5b6jq322s6h7k5hlljqm5xhy7q07k";
-      name = "extra-cmake-modules-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/extra-cmake-modules-5.91.0.tar.xz";
+      sha256 = "0k65rvxh926ya6qahzk2ns7g1fya1429648mlx7iipxa61g8h5wp";
+      name = "extra-cmake-modules-5.91.0.tar.xz";
     };
   };
   frameworkintegration = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/frameworkintegration-5.90.0.tar.xz";
-      sha256 = "1v7vlq2gk7j5b6gzbawgnpii7csh2zclp5v24qhx4qrmpfssylan";
-      name = "frameworkintegration-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/frameworkintegration-5.91.0.tar.xz";
+      sha256 = "1176ql8f96ap4gzjaj8vm4cr6f2rsx9z93gpc4hx4jcqjhxqrg3z";
+      name = "frameworkintegration-5.91.0.tar.xz";
     };
   };
   kactivities = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kactivities-5.90.0.tar.xz";
-      sha256 = "0wf7nnf3bjz2iq2wqxnyay1100ks0zscsh7sa8xfcijrl7pp305w";
-      name = "kactivities-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kactivities-5.91.0.tar.xz";
+      sha256 = "03y4hx7jgrhac12ys8pm22h0f49kms8b71gck4xv577p3ywi3j60";
+      name = "kactivities-5.91.0.tar.xz";
     };
   };
   kactivities-stats = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kactivities-stats-5.90.0.tar.xz";
-      sha256 = "0qamy8xggjlnm8pkv6vxbaagcp1hg9vgi2ws2yb9xpqk8mdlfbvp";
-      name = "kactivities-stats-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kactivities-stats-5.91.0.tar.xz";
+      sha256 = "0864qfljh20723djfzdv8h6nipw01825lhiknyqz17aj2x2ymzcq";
+      name = "kactivities-stats-5.91.0.tar.xz";
     };
   };
   kapidox = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kapidox-5.90.0.tar.xz";
-      sha256 = "16jl519sx7pirjp5x57x5gbgv477457063rrbwpvyf2ldb6lc29p";
-      name = "kapidox-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kapidox-5.91.0.tar.xz";
+      sha256 = "1xxpl8rn49d2cr7ld94j3wsg21019l2kq14p5bvilisnj3salka3";
+      name = "kapidox-5.91.0.tar.xz";
     };
   };
   karchive = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/karchive-5.90.0.tar.xz";
-      sha256 = "0411rpgr9dy0zf9mmhj7n7ax0afrn7zvkpzpnjvpvvqsrfkz7qm6";
-      name = "karchive-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/karchive-5.91.0.tar.xz";
+      sha256 = "1kjc47zzdd9jhcmynq6zw6y6zaj2c1i8pxvszx3d9x5asaz2qq53";
+      name = "karchive-5.91.0.tar.xz";
     };
   };
   kauth = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kauth-5.90.0.tar.xz";
-      sha256 = "1g4i1prspcczpx25wvd8lgdk8c3my7kp3wv489gvcci40rl5z913";
-      name = "kauth-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kauth-5.91.0.tar.xz";
+      sha256 = "001svdyvs8qc6h8zkb9x072npkz6xabz6j0djjb380gl9h9wnrgq";
+      name = "kauth-5.91.0.tar.xz";
     };
   };
   kbookmarks = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kbookmarks-5.90.0.tar.xz";
-      sha256 = "1svc1i9zxbxf65crfhnv6sz5gknb7x87lzjd8cn11y5lwnsw36kx";
-      name = "kbookmarks-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kbookmarks-5.91.0.tar.xz";
+      sha256 = "0iqfngsvpbgxk6h8l68idcp97df28sa2zwj707zs0mf2bl9k68m4";
+      name = "kbookmarks-5.91.0.tar.xz";
     };
   };
   kcalendarcore = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kcalendarcore-5.90.0.tar.xz";
-      sha256 = "0qbds2ysjv9rqwpvrhisvdd6wyhq5qwhbw5xcbj7ndxwpf8lpa8w";
-      name = "kcalendarcore-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kcalendarcore-5.91.0.tar.xz";
+      sha256 = "0gkn0mzk3za86pjrpi8gd9d71bfv0ihzkgn8yy1ik3dw1rf9gxip";
+      name = "kcalendarcore-5.91.0.tar.xz";
     };
   };
   kcmutils = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kcmutils-5.90.0.tar.xz";
-      sha256 = "04crq3j48xwlvp047p3waqrv1gg5sv1950jh02w85q00yjjh0qxk";
-      name = "kcmutils-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kcmutils-5.91.0.tar.xz";
+      sha256 = "009r9r7fz1588g2cnqw585d2fz170x8j8bip1zqr7i4jl21ms68s";
+      name = "kcmutils-5.91.0.tar.xz";
     };
   };
   kcodecs = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kcodecs-5.90.0.tar.xz";
-      sha256 = "0kwqyhjs63pqslqcmv3sngyqvl6ah8iaa6nn045sb8a58xb09inh";
-      name = "kcodecs-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kcodecs-5.91.0.tar.xz";
+      sha256 = "0qkwvbp4vp3w57f3fyjknxd66qac77hl77mf042c7jxjl5vq7h1y";
+      name = "kcodecs-5.91.0.tar.xz";
     };
   };
   kcompletion = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kcompletion-5.90.0.tar.xz";
-      sha256 = "0hd3nsixibw5z846mpib2lap3ar65rqvasifdnlmqsrvxfmw0ggk";
-      name = "kcompletion-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kcompletion-5.91.0.tar.xz";
+      sha256 = "1l6z85a4rh3vrf4x5g3pqvp0q36gwmw0fbp9ny1iaqyy21dlh8i4";
+      name = "kcompletion-5.91.0.tar.xz";
     };
   };
   kconfig = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kconfig-5.90.0.tar.xz";
-      sha256 = "0yqs3ydxzhhb7rrl01swjc9xw8j1bs3n204bf9slb2bs7lfz56rn";
-      name = "kconfig-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kconfig-5.91.0.tar.xz";
+      sha256 = "0axdnqipa8xgx864zylxllnzchlp50q59bbfw3c98svvvkm3yg56";
+      name = "kconfig-5.91.0.tar.xz";
     };
   };
   kconfigwidgets = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kconfigwidgets-5.90.0.tar.xz";
-      sha256 = "1sm1x64x2v3xfcz9ia6qk8d8y1q02fggrc2q0yy5ag5xh1yr9zwq";
-      name = "kconfigwidgets-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kconfigwidgets-5.91.0.tar.xz";
+      sha256 = "01mvv01hv64wadjh8xk3hhp1vbs04cvbrjpfl1g9cv2sa6hr7102";
+      name = "kconfigwidgets-5.91.0.tar.xz";
     };
   };
   kcontacts = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kcontacts-5.90.0.tar.xz";
-      sha256 = "0vv2136da5a6lwdj2x38jx2qwrk96hgn8iwaad4yynvc2csx6dim";
-      name = "kcontacts-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kcontacts-5.91.0.tar.xz";
+      sha256 = "1c839c9rvys3jwmi3fzw06r1nhgvrb4z8sdh8gda0w03vqh7h1hv";
+      name = "kcontacts-5.91.0.tar.xz";
     };
   };
   kcoreaddons = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kcoreaddons-5.90.0.tar.xz";
-      sha256 = "02m4h4r0kdy94zq8c6d2fhnd8qwrp4a0v5i4wf6khk4yf4fqy5kf";
-      name = "kcoreaddons-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kcoreaddons-5.91.0.tar.xz";
+      sha256 = "16vimllvcs6rnb1ccbv9zg8hxbzacisgrlffyvwm608f4q1xmqyz";
+      name = "kcoreaddons-5.91.0.tar.xz";
     };
   };
   kcrash = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kcrash-5.90.0.tar.xz";
-      sha256 = "0634jqzbvr8xkv53n2q3fcqlkcmq843w7g455v3swnlaqi92l04f";
-      name = "kcrash-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kcrash-5.91.0.tar.xz";
+      sha256 = "0gdknmp5a36ipvzms4jhxywyxpjh0vy26861c54jfsk13yircjal";
+      name = "kcrash-5.91.0.tar.xz";
     };
   };
   kdav = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kdav-5.90.0.tar.xz";
-      sha256 = "0181ray8vigmwlamx4j5dinw10al0g4l965kyx4wjq9k59nxxgbi";
-      name = "kdav-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kdav-5.91.0.tar.xz";
+      sha256 = "026w3bk2lmc7lqzra8w9jq8i2l1hvqsxz36r1jzj9p01skhdm32v";
+      name = "kdav-5.91.0.tar.xz";
     };
   };
   kdbusaddons = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kdbusaddons-5.90.0.tar.xz";
-      sha256 = "0g609bymfixwaic30y7i0q96anf7pi3galipmjbbfg85ghj9rsa4";
-      name = "kdbusaddons-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kdbusaddons-5.91.0.tar.xz";
+      sha256 = "18qhpj0s4abypkb8ix2d84wv1kqv6qxyblninn2f9hjkl2dnlwis";
+      name = "kdbusaddons-5.91.0.tar.xz";
     };
   };
   kdeclarative = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kdeclarative-5.90.0.tar.xz";
-      sha256 = "1z7zyj6pw2ym3izi19kpgy12mqpar6mbdbsn6jpxy36l6m3jld1y";
-      name = "kdeclarative-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kdeclarative-5.91.0.tar.xz";
+      sha256 = "183df5c0xyjqsip0izqvvk4wy2bjb973900s1wqsldhhvc7gpf7z";
+      name = "kdeclarative-5.91.0.tar.xz";
     };
   };
   kded = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kded-5.90.0.tar.xz";
-      sha256 = "094g6p87nd5cxcars71315w6zrxjgiw2080p6cf6g72ww54k7sps";
-      name = "kded-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kded-5.91.0.tar.xz";
+      sha256 = "1zi0sixlzaxvw4lfil2r36i3xrav3vfwxp2r1lp4n65dpl7nv7p5";
+      name = "kded-5.91.0.tar.xz";
     };
   };
   kdelibs4support = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/portingAids/kdelibs4support-5.90.0.tar.xz";
-      sha256 = "0zxc11jbg06qz79ljrd6wl36jp73hafcmbk29d0hcvxnkscg3k29";
-      name = "kdelibs4support-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/portingAids/kdelibs4support-5.91.0.tar.xz";
+      sha256 = "1373fi9vi7ki8frr0lsw6yp335i95v8yq2j41s7ip003dpy4hr2g";
+      name = "kdelibs4support-5.91.0.tar.xz";
     };
   };
   kdesignerplugin = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/portingAids/kdesignerplugin-5.90.0.tar.xz";
-      sha256 = "18gsy8f32hjadzjnavi3dsknc6hflcnfpr0107lwfc735fd2x2iq";
-      name = "kdesignerplugin-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/portingAids/kdesignerplugin-5.91.0.tar.xz";
+      sha256 = "07lvvryc3k418hd0j7ddlqhid26c51isa8mvk7g6gd0v2x3gp76q";
+      name = "kdesignerplugin-5.91.0.tar.xz";
     };
   };
   kdesu = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kdesu-5.90.0.tar.xz";
-      sha256 = "1q8k2q7c41fzw9gwx9nq4zjpjdwvh29zyh3zd0w3r2kxf6vhf1wp";
-      name = "kdesu-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kdesu-5.91.0.tar.xz";
+      sha256 = "1wj099w810dabqn43pqis4sism3zwq3d1qa9mvcdyjafqbl7xnjm";
+      name = "kdesu-5.91.0.tar.xz";
     };
   };
   kdewebkit = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/portingAids/kdewebkit-5.90.0.tar.xz";
-      sha256 = "19dqlxy2sl822aldqy1jj7fvxabmg97a0av7d5ayzhnbhhy5izx1";
-      name = "kdewebkit-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/portingAids/kdewebkit-5.91.0.tar.xz";
+      sha256 = "1mln0w1dzrbpm373vfpcyss4xxnrfgwh9nhzr8wmzs8965bn3wqq";
+      name = "kdewebkit-5.91.0.tar.xz";
     };
   };
   kdnssd = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kdnssd-5.90.0.tar.xz";
-      sha256 = "17szlqsafz6p4h7s9wascaggn5909c1ig452wy6y4z4402s2lsrr";
-      name = "kdnssd-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kdnssd-5.91.0.tar.xz";
+      sha256 = "1smzwh7lvz8g7vydxnd2kkh0ymg7yp6akc7k2vg8q65pa6pxqn3g";
+      name = "kdnssd-5.91.0.tar.xz";
     };
   };
   kdoctools = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kdoctools-5.90.0.tar.xz";
-      sha256 = "1l2a9mlcm8np3s8myq0hj08l82284r90yhx3z2gn7h68b8fzyx0s";
-      name = "kdoctools-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kdoctools-5.91.0.tar.xz";
+      sha256 = "02lr4l4n5gnv7ffzml8lbrdwgfpq6m7ayhz3bdqqijdfvw6h283n";
+      name = "kdoctools-5.91.0.tar.xz";
     };
   };
   kemoticons = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kemoticons-5.90.0.tar.xz";
-      sha256 = "08mgk56dafj3q9gs69qcx17qfc45s8ifkjrpzg44p8zs0q51q6cb";
-      name = "kemoticons-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kemoticons-5.91.0.tar.xz";
+      sha256 = "1jznkiq87rkndv10xs6974b5k0v82ly32agy5acxc2xy9wq7la0h";
+      name = "kemoticons-5.91.0.tar.xz";
     };
   };
   kfilemetadata = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kfilemetadata-5.90.0.tar.xz";
-      sha256 = "18y4bn6hz8xa68m0nxv88a1f3xkkks7c7pbiqb1vkrp9bbh52yax";
-      name = "kfilemetadata-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kfilemetadata-5.91.0.tar.xz";
+      sha256 = "1z030irzcvmjq329nwfk3h8cd51dwy9mppnwbgcd0lw6y3bka0rq";
+      name = "kfilemetadata-5.91.0.tar.xz";
     };
   };
   kglobalaccel = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kglobalaccel-5.90.0.tar.xz";
-      sha256 = "04qd1fcc22x70jacqzrv44q1jg5ldzynlfpw5cg2679409r0wnxw";
-      name = "kglobalaccel-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kglobalaccel-5.91.0.tar.xz";
+      sha256 = "09wscg6f19sh314ywpxp47pdr1xf1wzpjchg9rcjg207zrfhqqf0";
+      name = "kglobalaccel-5.91.0.tar.xz";
     };
   };
   kguiaddons = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kguiaddons-5.90.0.tar.xz";
-      sha256 = "0m9l8xyc7xyj29fzxwp8ahr2l1rzs5rw1c26x446kb7smxvy8awx";
-      name = "kguiaddons-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kguiaddons-5.91.0.tar.xz";
+      sha256 = "0gn8lvpm4i11s5vavlpm162bizjkmh5cb4dhj3p34dlp4vcc4mky";
+      name = "kguiaddons-5.91.0.tar.xz";
     };
   };
   kholidays = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kholidays-5.90.0.tar.xz";
-      sha256 = "1p1kgy110ijk5a3ix4g9y1i7w0gsnzf82jdkwbdza95vibm82iz8";
-      name = "kholidays-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kholidays-5.91.0.tar.xz";
+      sha256 = "165vfmi5y8l00ng494469w5s1gjnf9zkggqrzmq65dfkdis3amdm";
+      name = "kholidays-5.91.0.tar.xz";
     };
   };
   khtml = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/portingAids/khtml-5.90.0.tar.xz";
-      sha256 = "1bi839x4dhlkqxmv98pq01725b8i8szdxf9b1hf1jv37fk468mja";
-      name = "khtml-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/portingAids/khtml-5.91.0.tar.xz";
+      sha256 = "1ldkk1f954mmgz30vqa895z1nw2jaknnb53lsd5vqxzxi3cmc054";
+      name = "khtml-5.91.0.tar.xz";
     };
   };
   ki18n = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/ki18n-5.90.0.tar.xz";
-      sha256 = "13k8kbkmgdywclcdbfj5ri3gmdblv8yzalmvqd0hn7sym6pkdqfw";
-      name = "ki18n-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/ki18n-5.91.0.tar.xz";
+      sha256 = "11gdd2gvzsz3r8zvqbxxwbpwjvjwnzzhzyrd4spbpdy0w7j8n6ly";
+      name = "ki18n-5.91.0.tar.xz";
     };
   };
   kiconthemes = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kiconthemes-5.90.0.tar.xz";
-      sha256 = "0w3wi4xy1yy2s1a927cj4my63q0fqhw06ghy9zjw830m31xwpx1k";
-      name = "kiconthemes-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kiconthemes-5.91.0.tar.xz";
+      sha256 = "1khh4ngivwdj9rxxcpx08ka8anskc9i1z9n2zijp4m5ix8mmj3c2";
+      name = "kiconthemes-5.91.0.tar.xz";
     };
   };
   kidletime = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kidletime-5.90.0.tar.xz";
-      sha256 = "1xzwmk0aqv1lcdi51nl1k0lyiinnqxwla6w0xxmsh6193qa3fpvq";
-      name = "kidletime-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kidletime-5.91.0.tar.xz";
+      sha256 = "12qmiwc8p3izj1y5h0rndj2s496ckm1p85dv4g51zbpg7m8a48qv";
+      name = "kidletime-5.91.0.tar.xz";
     };
   };
   kimageformats = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kimageformats-5.90.0.tar.xz";
-      sha256 = "0r3ihkly0hf20aqbn7b9171mzqjna078rksdp96z6f7f1qy99v1v";
-      name = "kimageformats-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kimageformats-5.91.0.tar.xz";
+      sha256 = "0df8in33xwajqay487w0hjfsplz8y51w9sjb75na7yqsn75p38xb";
+      name = "kimageformats-5.91.0.tar.xz";
     };
   };
   kinit = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kinit-5.90.0.tar.xz";
-      sha256 = "0z65hfhj68ahjm558p2pj7dlrczcww8f2xyw9f44w10bp3p5hf1a";
-      name = "kinit-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kinit-5.91.0.tar.xz";
+      sha256 = "1y62k24mwzbg4gchvjb8wn6ygq57wc72clb3jgyipw034czdihvi";
+      name = "kinit-5.91.0.tar.xz";
     };
   };
   kio = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kio-5.90.0.tar.xz";
-      sha256 = "0ds6465fyzjj2azwdghrkxr9wvih0m96lv4kp6syqwii8nv2w7rs";
-      name = "kio-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kio-5.91.0.tar.xz";
+      sha256 = "14v28qilb5ayv9shw86hb88k60nr4bbd2pa4vwsqij9xkwlympgj";
+      name = "kio-5.91.0.tar.xz";
     };
   };
   kirigami2 = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kirigami2-5.90.0.tar.xz";
-      sha256 = "0r48n11pv3yqsf11phl19cs52ph5ldabrfmq3xmsvxsknm6c4f9b";
-      name = "kirigami2-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kirigami2-5.91.0.tar.xz";
+      sha256 = "0ifljwa6hli2rndfadpzs30dpwc99nnvcm3yi9j5dim2bdf6glwc";
+      name = "kirigami2-5.91.0.tar.xz";
     };
   };
   kitemmodels = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kitemmodels-5.90.0.tar.xz";
-      sha256 = "0f7zlif7kskbwpw8yrzlfyl954b623icdd9qn0algjcc2i9gqbzi";
-      name = "kitemmodels-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kitemmodels-5.91.0.tar.xz";
+      sha256 = "189kgrw2vjr9067mqr4f2sv06xmnjaapry0bf8s41v6r9v7py708";
+      name = "kitemmodels-5.91.0.tar.xz";
     };
   };
   kitemviews = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kitemviews-5.90.0.tar.xz";
-      sha256 = "10s285vxaaxjcy3am4bvch5wd7wv64wwcjvj7lqk2866aql9hmzp";
-      name = "kitemviews-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kitemviews-5.91.0.tar.xz";
+      sha256 = "16cm4zmv1ngrsmy6k0ybv5wxd0g8cc8zwq6ab7jvs7a04sykv238";
+      name = "kitemviews-5.91.0.tar.xz";
     };
   };
   kjobwidgets = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kjobwidgets-5.90.0.tar.xz";
-      sha256 = "1jv3c68mlsxhnd6jgqw5d4qqd66jf8bh6zbcs6bq0bad52ad2r8d";
-      name = "kjobwidgets-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kjobwidgets-5.91.0.tar.xz";
+      sha256 = "14pkyd6j78kignr62xfkvpyi2fwvzcvcsdnn23h8jxkhwm2ri42v";
+      name = "kjobwidgets-5.91.0.tar.xz";
     };
   };
   kjs = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/portingAids/kjs-5.90.0.tar.xz";
-      sha256 = "1z5d1ixzvaq6x9x0jhmh5bdrdqpsl1x7mh3s8wnycfxwmln6bawv";
-      name = "kjs-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/portingAids/kjs-5.91.0.tar.xz";
+      sha256 = "0jbwlnmf8whzgjkrbnsvdsnn3kv0h44ghf63m2qcgg2l9wb0j8rj";
+      name = "kjs-5.91.0.tar.xz";
     };
   };
   kjsembed = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/portingAids/kjsembed-5.90.0.tar.xz";
-      sha256 = "0ydrsg7z1b5hkskjvkb0b9lhx60aqcby2alhfbmkac197sf2frn4";
-      name = "kjsembed-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/portingAids/kjsembed-5.91.0.tar.xz";
+      sha256 = "124y7518jhjg3y2x7bcyl6b3c0bfxfbgd2sz6dwk45y4byx7rl60";
+      name = "kjsembed-5.91.0.tar.xz";
     };
   };
   kmediaplayer = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/portingAids/kmediaplayer-5.90.0.tar.xz";
-      sha256 = "010m5qrn41hcxsmxsq72m83qxikfvn3mgibkgy4bn2x8kxibzmlq";
-      name = "kmediaplayer-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/portingAids/kmediaplayer-5.91.0.tar.xz";
+      sha256 = "0rn9azrj8k1m67y9ni0f3nwl9ldf1ksiqv6dgnzrx6xh0rxfm2h1";
+      name = "kmediaplayer-5.91.0.tar.xz";
     };
   };
   knewstuff = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/knewstuff-5.90.0.tar.xz";
-      sha256 = "0q30p7z5zg3p24gp8q83i7my5bg4yfcdwsblmhl230kih8aap2cg";
-      name = "knewstuff-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/knewstuff-5.91.0.tar.xz";
+      sha256 = "0akaxi9klmpwn4pyr6ys5sxcapdspldq1f64im7vd6byzqrgpnax";
+      name = "knewstuff-5.91.0.tar.xz";
     };
   };
   knotifications = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/knotifications-5.90.0.tar.xz";
-      sha256 = "15qb3jh5y1z84dp6wddwid4bk3ks05knkxlwv79hb9cdj8m4m7gi";
-      name = "knotifications-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/knotifications-5.91.0.tar.xz";
+      sha256 = "1207rimq8si1zxnn827631a1hskrd3m3ilgaj3wj859qrbkqmxzm";
+      name = "knotifications-5.91.0.tar.xz";
     };
   };
   knotifyconfig = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/knotifyconfig-5.90.0.tar.xz";
-      sha256 = "1qss40sr7az9x4yvl59mblzzgjm3hd8nvxgqmqlylargvggw496c";
-      name = "knotifyconfig-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/knotifyconfig-5.91.0.tar.xz";
+      sha256 = "07m5mphd8mrak5sdqlldbcd51946v49xpcwi9fhn7w0kx29hknyf";
+      name = "knotifyconfig-5.91.0.tar.xz";
     };
   };
   kpackage = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kpackage-5.90.0.tar.xz";
-      sha256 = "1rig9aws8530sav0pmginqmdcrnz10qjbxfc5lw6mmb3sfig53z0";
-      name = "kpackage-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kpackage-5.91.0.tar.xz";
+      sha256 = "12w8lfwifa107wlrld3zz774hczn9mkib6wqxw24yxxmzfw9lc2i";
+      name = "kpackage-5.91.0.tar.xz";
     };
   };
   kparts = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kparts-5.90.0.tar.xz";
-      sha256 = "1x8kxd8kgzabd9dyqx2yx1qrrzl1mms4hm3lyg3f1nxki7xl6ra2";
-      name = "kparts-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kparts-5.91.0.tar.xz";
+      sha256 = "10ni6b114acjnmrahvvqw75iqkc10ii97y3z7lirj2727a3qmzzj";
+      name = "kparts-5.91.0.tar.xz";
     };
   };
   kpeople = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kpeople-5.90.0.tar.xz";
-      sha256 = "1632k365bn9n3n8babq620v0px2hmapk8fprx28xpfp27zakhfgw";
-      name = "kpeople-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kpeople-5.91.0.tar.xz";
+      sha256 = "09l2q8cg9p8g7zkd1mjx6x08bqkr4ykxjibskc184asff7v47gvp";
+      name = "kpeople-5.91.0.tar.xz";
     };
   };
   kplotting = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kplotting-5.90.0.tar.xz";
-      sha256 = "0i5ganvpzkpkd2p1avw0fpbp3mgbbifg8mmpvdf28ayh75dvrh9y";
-      name = "kplotting-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kplotting-5.91.0.tar.xz";
+      sha256 = "0rgmmliw9cfi0j2miszqz2kphqm04r5nfs8dqq6pnvclk1k9kss6";
+      name = "kplotting-5.91.0.tar.xz";
     };
   };
   kpty = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kpty-5.90.0.tar.xz";
-      sha256 = "1p5ny9ry0wwwprhpj9s9xg96h9476rldly7mawvfp5q3ihys8c4a";
-      name = "kpty-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kpty-5.91.0.tar.xz";
+      sha256 = "1yy1k96kikvvnlyd00krc08ifiqbrz0x5vwv3pgdbpnwgl8p580d";
+      name = "kpty-5.91.0.tar.xz";
     };
   };
   kquickcharts = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kquickcharts-5.90.0.tar.xz";
-      sha256 = "1vf9vwrb03z6f19xyc1dc50s3kz21s4mkrv85mmyia0by4qvq5fi";
-      name = "kquickcharts-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kquickcharts-5.91.0.tar.xz";
+      sha256 = "1ghiymm257b8xgmkibb7s7bwb28x3zhnrgrrsya47q5njb87h0ck";
+      name = "kquickcharts-5.91.0.tar.xz";
     };
   };
   kross = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/portingAids/kross-5.90.0.tar.xz";
-      sha256 = "1gs7h03j753pq78q0fmajgd5pw8j3mc105rsph1c22l23vccya3z";
-      name = "kross-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/portingAids/kross-5.91.0.tar.xz";
+      sha256 = "06f8220jmvjsfbzjkr2ybwicwjffbi3yw9sr3bcyrilchrrpgqal";
+      name = "kross-5.91.0.tar.xz";
     };
   };
   krunner = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/krunner-5.90.0.tar.xz";
-      sha256 = "1q3hsml5274v8dy8rnqpnwxliad2q7a8mbs8k6kpqzih9z94crgi";
-      name = "krunner-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/krunner-5.91.0.tar.xz";
+      sha256 = "17iaw55rkzyfpgkbw2an6pa4wid79b0dnb3310vfaq0xkm0gjxq6";
+      name = "krunner-5.91.0.tar.xz";
     };
   };
   kservice = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kservice-5.90.0.tar.xz";
-      sha256 = "121y8bbq3m4pv5m9pj753v2nk914216a86ksmdqbgffw217qckdd";
-      name = "kservice-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kservice-5.91.0.tar.xz";
+      sha256 = "0m4j7djiyapi1hm23lz9nd238rrlldxlggzkqq056z486v2137bp";
+      name = "kservice-5.91.0.tar.xz";
     };
   };
   ktexteditor = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/ktexteditor-5.90.0.tar.xz";
-      sha256 = "1g1dky9bgr2zjr0rw9c730shz588ykyw7qw3sgf0dr3sh8aq222n";
-      name = "ktexteditor-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/ktexteditor-5.91.0.tar.xz";
+      sha256 = "1bkz6v1y5vyxav398a6224ldqa9pqhbad3vmhxrjb2hxcbha2cpm";
+      name = "ktexteditor-5.91.0.tar.xz";
     };
   };
   ktextwidgets = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/ktextwidgets-5.90.0.tar.xz";
-      sha256 = "02g85zahh6hfsw3fcac7hp8kv4d1ha2asmmhnknqd054yl0adxjg";
-      name = "ktextwidgets-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/ktextwidgets-5.91.0.tar.xz";
+      sha256 = "0xmzrak5mwg1l4v38g14i7j1yr3j6sj13q2iqa433hs5agl6l6n4";
+      name = "ktextwidgets-5.91.0.tar.xz";
     };
   };
   kunitconversion = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kunitconversion-5.90.0.tar.xz";
-      sha256 = "1vrvbsd8limfsmgjcv5kvzyf7g62rv1a0rvbdyq15z23zf4rsmf3";
-      name = "kunitconversion-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kunitconversion-5.91.0.tar.xz";
+      sha256 = "0n2v0f08s71z2imhn41jkm2knjvk7bkwmcz70gs8h97ykrj6niap";
+      name = "kunitconversion-5.91.0.tar.xz";
     };
   };
   kwallet = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kwallet-5.90.0.tar.xz";
-      sha256 = "06ffg84jvrc8xhymg1g5j311vq3ajfqg3arx2cxa98aqld213akl";
-      name = "kwallet-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kwallet-5.91.0.tar.xz";
+      sha256 = "1z1qb6a2b5rqj7js88ms8n67fbs885pw6djbf1l86na2zhf0adip";
+      name = "kwallet-5.91.0.tar.xz";
     };
   };
   kwayland = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kwayland-5.90.0.tar.xz";
-      sha256 = "0n7f4rx695q889j8g4sdpdi3jhk29z8zc4wrk5srs2diqi4y0qqi";
-      name = "kwayland-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kwayland-5.91.0.tar.xz";
+      sha256 = "1a03ckacp39lpsqyykkm6lxajxm71s6ifpzgj8q0a37v75jzmz9y";
+      name = "kwayland-5.91.0.tar.xz";
     };
   };
   kwidgetsaddons = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kwidgetsaddons-5.90.0.tar.xz";
-      sha256 = "1c17iq0q2w80p7v7k32db0pc5sbzqhvh0w5d145a1nkgr3nbnk6a";
-      name = "kwidgetsaddons-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kwidgetsaddons-5.91.0.tar.xz";
+      sha256 = "03pj98sgybkcz487vr774x05w46imnipq2794nkv426nnhyxrd73";
+      name = "kwidgetsaddons-5.91.0.tar.xz";
     };
   };
   kwindowsystem = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kwindowsystem-5.90.0.tar.xz";
-      sha256 = "0fj7a86dk833ld76c3b1s4ri47bhpvjsi6ryfgdv5q7h2fwh6ia5";
-      name = "kwindowsystem-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kwindowsystem-5.91.0.tar.xz";
+      sha256 = "1yy02fvfabrsvdpmrkdnjdsdd3d2crxavsl47si6ry8fdxb90y95";
+      name = "kwindowsystem-5.91.0.tar.xz";
     };
   };
   kxmlgui = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/kxmlgui-5.90.0.tar.xz";
-      sha256 = "1q8v1wrx67c37jnd874ilkk8kfk3zvf3f86qg51k16ml0nrwjysg";
-      name = "kxmlgui-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/kxmlgui-5.91.0.tar.xz";
+      sha256 = "1qww2isx99lx0mn1dv0vzrvmr2xdp8zgikyvgw1wf8hfay3v2s1g";
+      name = "kxmlgui-5.91.0.tar.xz";
     };
   };
   kxmlrpcclient = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/portingAids/kxmlrpcclient-5.90.0.tar.xz";
-      sha256 = "0mq2wgi4qnvscjdkis7jhs004k3s1b3wg0vijjai7xzy772kvclc";
-      name = "kxmlrpcclient-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/portingAids/kxmlrpcclient-5.91.0.tar.xz";
+      sha256 = "1bnymf5wq4apjsgshvbhcggdw7jc0yxv4jag3k19ff9820lskhph";
+      name = "kxmlrpcclient-5.91.0.tar.xz";
     };
   };
   modemmanager-qt = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/modemmanager-qt-5.90.0.tar.xz";
-      sha256 = "08nlvg5lwvl3rspi848gp2b2b5pki6sy8c3ww9nn4afy4lk7p609";
-      name = "modemmanager-qt-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/modemmanager-qt-5.91.0.tar.xz";
+      sha256 = "15l46lkh8nkal1nai494dabaysy581jzi8nwrv4kjvc6qwc3yrx2";
+      name = "modemmanager-qt-5.91.0.tar.xz";
     };
   };
   networkmanager-qt = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/networkmanager-qt-5.90.0.tar.xz";
-      sha256 = "0i9wvrxbkbil21zndiq4cmnldbqsrdp9gnhmp2ns78xdih8wysa7";
-      name = "networkmanager-qt-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/networkmanager-qt-5.91.0.tar.xz";
+      sha256 = "0f27qin2ks3q7rin53sk9vjjnadjnax99d9k245sjr6fjpczy81f";
+      name = "networkmanager-qt-5.91.0.tar.xz";
     };
   };
   oxygen-icons5 = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/oxygen-icons5-5.90.0.tar.xz";
-      sha256 = "1izfh6cxivmwiymy7lwbmf9j1hxy2skv6z1lbjr0c4snmx6pqx1g";
-      name = "oxygen-icons5-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/oxygen-icons5-5.91.0.tar.xz";
+      sha256 = "0j3j2lyxr2iz68vasvpjqkix4bnnj6wc4sr97i6x6z06zq0kawai";
+      name = "oxygen-icons5-5.91.0.tar.xz";
     };
   };
   plasma-framework = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/plasma-framework-5.90.0.tar.xz";
-      sha256 = "1msqjnwvb815kii0rjhn1lvsnvq5wr8iprdjzsviw67va6gaz4p1";
-      name = "plasma-framework-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/plasma-framework-5.91.0.tar.xz";
+      sha256 = "0ydhhpnwf7lfl3kdjsw92mgsza5gy292f7v6kyby4ygjnir1hizl";
+      name = "plasma-framework-5.91.0.tar.xz";
     };
   };
   prison = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/prison-5.90.0.tar.xz";
-      sha256 = "0z2k2hyjj86va5rqgd8qrvhflfppcl2d3f9smxb5w9pp19ashvyk";
-      name = "prison-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/prison-5.91.0.tar.xz";
+      sha256 = "0k1zp3jzh8gjsji6wh5g8k41zdl8s1vd58ipm0lxy670a71wcqcg";
+      name = "prison-5.91.0.tar.xz";
     };
   };
   purpose = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/purpose-5.90.0.tar.xz";
-      sha256 = "182196hj3mdy1k7wfgadfxy7m1kbqzk6kksn7yd681h2gpky82l1";
-      name = "purpose-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/purpose-5.91.0.tar.xz";
+      sha256 = "1z6wpz7d9byx4n5zx6chmyy9k1jkmghdgahsvkqsc33z6hnh2b4m";
+      name = "purpose-5.91.0.tar.xz";
     };
   };
   qqc2-desktop-style = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/qqc2-desktop-style-5.90.0.tar.xz";
-      sha256 = "05g1rydx0innmiz28mslix4bjsrhsnci227gadngzijncp2v288r";
-      name = "qqc2-desktop-style-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/qqc2-desktop-style-5.91.0.tar.xz";
+      sha256 = "0rd9rvffhif8yckwr7axjcv5iqn5b0jdviij7f9y8vjpkzyjvm8i";
+      name = "qqc2-desktop-style-5.91.0.tar.xz";
     };
   };
   solid = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/solid-5.90.0.tar.xz";
-      sha256 = "10hk4mh426dhi7is5hxa1varn15ijzra5a420zk297pzkphvx0ip";
-      name = "solid-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/solid-5.91.0.tar.xz";
+      sha256 = "1a4k0amyg8mvfr2ld7v8zyphhxv33yybh55vqcshwv4a0jm1wmjg";
+      name = "solid-5.91.0.tar.xz";
     };
   };
   sonnet = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/sonnet-5.90.0.tar.xz";
-      sha256 = "0d4xxm9vw1rc2mypv4z0yihcn679sab0afxr2kbzq01wr6p759y7";
-      name = "sonnet-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/sonnet-5.91.0.tar.xz";
+      sha256 = "067xj5mllpzl0gnxxljhfi9y4xdgrpqbckm7pykczzqrklrrx8dx";
+      name = "sonnet-5.91.0.tar.xz";
     };
   };
   syndication = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/syndication-5.90.0.tar.xz";
-      sha256 = "0a9j443w42jwvlzjh5mfxn25kwjrz1ya6sgy0c4y3n5xbg031zmx";
-      name = "syndication-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/syndication-5.91.0.tar.xz";
+      sha256 = "1f2kb6mh1xc1k1bn536lq9gq0j2lb65qw4vpp4ixynlfij4zq1gy";
+      name = "syndication-5.91.0.tar.xz";
     };
   };
   syntax-highlighting = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/syntax-highlighting-5.90.0.tar.xz";
-      sha256 = "19mckdfdxb5i26y75cgmda91s864jbh1wmf98bv8xa1iqxwkwj5z";
-      name = "syntax-highlighting-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/syntax-highlighting-5.91.0.tar.xz";
+      sha256 = "0fprqi2z8issh3jkql6labszkwd3cpvd6qadsg9fi46vfjr4a2ip";
+      name = "syntax-highlighting-5.91.0.tar.xz";
     };
   };
   threadweaver = {
-    version = "5.90.0";
+    version = "5.91.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.90/threadweaver-5.90.0.tar.xz";
-      sha256 = "1frhzlzmnrp5y3lrl0ahzxh8syj4vlkjvaypsmbm2bkkn4akizg3";
-      name = "threadweaver-5.90.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.91/threadweaver-5.91.0.tar.xz";
+      sha256 = "1900kqglkwzkjc24mvl0j7jf7xcx6cr6b1g78s5b5m18rw050j12";
+      name = "threadweaver-5.91.0.tar.xz";
     };
   };
 }
diff --git a/pkgs/development/libraries/lcms2/default.nix b/pkgs/development/libraries/lcms2/default.nix
index b600a2ca4c3..14579bc5915 100644
--- a/pkgs/development/libraries/lcms2/default.nix
+++ b/pkgs/development/libraries/lcms2/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "lcms2";
-  version = "2.12";
+  version = "2.13.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/lcms/${pname}-${version}.tar.gz";
-    sha256 = "sha256-GGY5hehkEARVrD5QdiXEOMNxA1TYXly7fNQEPhH+EPU=";
+    sha256 = "sha256-1HPnlueyfFrwG9bRVS1CtFtDRX5xgs6ZA/OLt0ggO4g=";
   };
 
   outputs = [ "bin" "dev" "out" ];
diff --git a/pkgs/development/libraries/libaom/default.nix b/pkgs/development/libraries/libaom/default.nix
index 82e44033313..3a3866911b8 100644
--- a/pkgs/development/libraries/libaom/default.nix
+++ b/pkgs/development/libraries/libaom/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libaom";
-  version = "3.2.0";
+  version = "3.3.0";
 
   src = fetchzip {
     url = "https://aomedia.googlesource.com/aom/+archive/v${version}.tar.gz";
-    sha256 = "0fmnbzpl481i7kchx4hbvb507r5pfgyrzfrlrs7jk3bicycm75qv";
+    sha256 = "sha256-g6QkKLrk+SH1s5fRmseAQMmM6y4QwmKmVDPxdbqGmwg=";
     stripRoot = false;
   };
 
diff --git a/pkgs/development/libraries/libarchive-qt/default.nix b/pkgs/development/libraries/libarchive-qt/default.nix
index 62b425bba05..ae74fd3028a 100644
--- a/pkgs/development/libraries/libarchive-qt/default.nix
+++ b/pkgs/development/libraries/libarchive-qt/default.nix
@@ -1,19 +1,20 @@
-{ mkDerivation, lib, fetchFromGitLab, libarchive, xz, zlib, bzip2, cmake, ninja }:
+{ mkDerivation, lib, fetchFromGitLab, libarchive, xz, zlib, bzip2, meson, pkg-config, ninja }:
 
 mkDerivation rec {
   pname = "libarchive-qt";
-  version = "2.0.6";
+  version = "2.0.7";
 
   src = fetchFromGitLab {
     owner = "marcusbritanicus";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Z+2zjQolV1Ncr6v9r7fGrc/fEMt0iMtGwv9eZ2Tu2cA=";
+    sha256 = "sha256-KRywB+Op44N00q9tgO2WNCliRgUDRvrCms1O8JYt62o=";
   };
 
   nativeBuildInputs = [
-    cmake
+    meson
     ninja
+    pkg-config
   ];
 
   buildInputs = [
diff --git a/pkgs/development/libraries/libarchive/default.nix b/pkgs/development/libraries/libarchive/default.nix
index 2a1d53e6ee0..1cc6fe6f521 100644
--- a/pkgs/development/libraries/libarchive/default.nix
+++ b/pkgs/development/libraries/libarchive/default.nix
@@ -12,13 +12,13 @@ assert xarSupport -> libxml2 != null;
 
 stdenv.mkDerivation rec {
   pname = "libarchive";
-  version = "3.5.2";
+  version = "3.6.0";
 
   src = fetchFromGitHub {
     owner = "libarchive";
     repo = "libarchive";
     rev = "v${version}";
-    sha256 = "sha256-H00UJ+ON1kBc19BgWBBKmO8f23oAg2mk7o9hhDhn50Q=";
+    sha256 = "sha256-u6Zeu9yTjhx5U7KZVUkuuUsQPjWN71mE5egG4T+FGfY=";
   };
 
   outputs = [ "out" "lib" "dev" ];
diff --git a/pkgs/development/libraries/libbsd/default.nix b/pkgs/development/libraries/libbsd/default.nix
index 745b34226e2..8c8e47b98a4 100644
--- a/pkgs/development/libraries/libbsd/default.nix
+++ b/pkgs/development/libraries/libbsd/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libbsd";
-  version = "0.11.3";
+  version = "0.11.5";
 
   src = fetchurl {
     url = "https://libbsd.freedesktop.org/releases/${pname}-${version}.tar.xz";
-    sha256 = "18a2bcl9z0zyxhrm1lfv4yhhz0589s6jz0s78apaq78mhj0wz5gz";
+    sha256 = "sha256-GpyVJSVjXBu2dwyyLpabk42Oap15EjYrmO6DcFmbDv0=";
   };
 
   outputs = [ "out" "dev" "man" ];
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Common functions found on BSD systems";
     homepage = "https://libbsd.freedesktop.org/";
-    license = licenses.bsd3;
+    license = with licenses; [ beerware bsd2 bsd3 bsdOriginal isc mit ];
     platforms = platforms.linux ++ platforms.darwin;
     maintainers = with maintainers; [ matthewbauer ];
   };
diff --git a/pkgs/development/libraries/libclc/default.nix b/pkgs/development/libraries/libclc/default.nix
index fdcc2ae0081..c634892944c 100644
--- a/pkgs/development/libraries/libclc/default.nix
+++ b/pkgs/development/libraries/libclc/default.nix
@@ -27,6 +27,9 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake ninja python3 ];
   buildInputs = [ llvm clang-unwrapped ];
   strictDeps = true;
+  cmakeFlags = [
+    "-DCMAKE_INSTALL_INCLUDEDIR=include"
+  ];
 
   meta = with lib; {
     homepage = "http://libclc.llvm.org/";
diff --git a/pkgs/development/libraries/libdrm/default.nix b/pkgs/development/libraries/libdrm/default.nix
index 731039e26a0..e08a4673248 100644
--- a/pkgs/development/libraries/libdrm/default.nix
+++ b/pkgs/development/libraries/libdrm/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libdrm";
-  version = "2.4.109";
+  version = "2.4.110";
 
   src = fetchurl {
     url = "https://dri.freedesktop.org/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "09kzrdsd14zr0i3izvi5mck4vqccl3c9hr84r9i4is0zikh554v2";
+    sha256 = "0dwpry9m5l27dlhq48j4bsiqwm0247cxdqwv3b7ddmkynk2f9kpf";
   };
 
   outputs = [ "out" "dev" "bin" ];
diff --git a/pkgs/development/libraries/libgbinder/default.nix b/pkgs/development/libraries/libgbinder/default.nix
index f2ecf94053b..e5a3b79ba77 100644
--- a/pkgs/development/libraries/libgbinder/default.nix
+++ b/pkgs/development/libraries/libgbinder/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libgbinder";
-  version = "1.1.16";
+  version = "1.1.19";
 
   src = fetchFromGitHub {
     owner = "mer-hybris";
     repo = pname;
     rev = version;
-    sha256 = "sha256-g+3yRRiTv2l7ZpJc5a6tOPsErKjdALomAWmYHErdfIQ=";
+    sha256 = "sha256-HTmNoTGyFtOXRy7Y/ZnEgTa2GW6/+TeZxZo7c7ksNtc=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/libgee/default.nix b/pkgs/development/libraries/libgee/default.nix
index 1a40d1f17b4..b34790d59c7 100644
--- a/pkgs/development/libraries/libgee/default.nix
+++ b/pkgs/development/libraries/libgee/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libgee";
-  version = "0.20.4";
+  version = "0.20.5";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "03nyf8n7i7f67fsh220g52slmihdk1lv4iwspm7xmkgrj3rink2j";
+    sha256 = "MYY6iVfVpyf5BnSVyr8KCIn6XT1EYm5UCUMxGI1cFRg=";
   };
 
   doCheck = true;
diff --git a/pkgs/development/libraries/libnbd/default.nix b/pkgs/development/libraries/libnbd/default.nix
index 3988a79c325..ba21e2206a8 100644
--- a/pkgs/development/libraries/libnbd/default.nix
+++ b/pkgs/development/libraries/libnbd/default.nix
@@ -6,16 +6,17 @@
 , perl
 , libxml2
 , fuse
+, fuse3
 , gnutls
 }:
 
 stdenv.mkDerivation rec {
   pname = "libnbd";
-  version = "1.9.5";
+  version = "1.12.2";
 
   src = fetchurl {
-    url = "https://download.libguestfs.org/libnbd/${lib.versions.majorMinor version}-development/${pname}-${version}.tar.gz";
-    hash = "sha256-BnMoxIiuwhqcwVr3AwAIFgZPcFsIg55N66ZwWMTUnCw=";
+    url = "https://download.libguestfs.org/libnbd/${lib.versions.majorMinor version}-stable/${pname}-${version}.tar.gz";
+    hash = "sha256-57veJapt72LkP02wO4c1nDdHmnodqfT+rKPNDeTGQPM=";
   };
 
   nativeBuildInputs = [
@@ -26,6 +27,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     fuse
+    fuse3
     gnutls
     libxml2
   ];
@@ -55,7 +57,6 @@ stdenv.mkDerivation rec {
     platforms = with platforms; linux;
   };
 }
-# TODO: NBD URI support apparently is not enabled
 # TODO: package the 1.6-stable version too
 # TODO: git version needs ocaml
 # TODO: bindings for go, ocaml and python
diff --git a/pkgs/development/libraries/libnfs/default.nix b/pkgs/development/libraries/libnfs/default.nix
index 4e12553b00b..dd442b2cd4b 100644
--- a/pkgs/development/libraries/libnfs/default.nix
+++ b/pkgs/development/libraries/libnfs/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libnfs";
-  version = "4.0.0";
+  version = "5.0.1";
 
   src = fetchFromGitHub {
     owner = "sahlberg";
     repo = "libnfs";
     rev = "libnfs-${version}";
-    sha256 = "0i27wd4zvhjz7620q043p4d4mkx8zv2yz9adm1byin47dynahyda";
+    sha256 = "sha256-5jyY7hqEhBPiQ8pNd+mRTEc4brht4ID7PoV7O2RFNQA=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/development/libraries/libpng/default.nix b/pkgs/development/libraries/libpng/default.nix
index aeb3fcba06f..2293dfc00a0 100644
--- a/pkgs/development/libraries/libpng/default.nix
+++ b/pkgs/development/libraries/libpng/default.nix
@@ -11,7 +11,7 @@ let
   whenPatched = lib.optionalString apngSupport;
 
 in stdenv.mkDerivation rec {
-  name = "libpng" + whenPatched "-apng" + "-${version}";
+  pname = "libpng" + whenPatched "-apng";
   version = "1.6.37";
 
   src = fetchurl {
diff --git a/pkgs/development/libraries/libqmi/default.nix b/pkgs/development/libraries/libqmi/default.nix
index c3c9bf6947e..0906d7b967c 100644
--- a/pkgs/development/libraries/libqmi/default.nix
+++ b/pkgs/development/libraries/libqmi/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libqmi";
-  version = "1.30.2";
+  version = "1.30.4";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/libqmi/${pname}-${version}.tar.xz";
-    sha256 = "sha256-vgHs4OosIZTL6ldEv1qvBsBLpft+x4h6ExFsdtEU/t0=";
+    sha256 = "sha256-ANfaMKT40RhfN8uiic+vHfzQSljy921qz99bhTEtbtY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/librsvg/default.nix b/pkgs/development/libraries/librsvg/default.nix
index 1de6090b146..81cad37351a 100644
--- a/pkgs/development/libraries/librsvg/default.nix
+++ b/pkgs/development/libraries/librsvg/default.nix
@@ -25,13 +25,13 @@
 
 stdenv.mkDerivation rec {
   pname = "librsvg";
-  version = "2.52.5";
+  version = "2.52.6";
 
   outputs = [ "out" "dev" "installedTests" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "QHy7q1GBN+oYo/MiC+oYD77nXz5b1roQp6hiwab3TYI=";
+    sha256 = "o/k5oeajpgQIJEYy0DI/jDsg60t7AAU24uW9k7jv+q0=";
   };
 
   cargoVendorDir = "vendor";
diff --git a/pkgs/development/libraries/libsigsegv/default.nix b/pkgs/development/libraries/libsigsegv/default.nix
index bc36a12eea8..84c2f19e5e2 100644
--- a/pkgs/development/libraries/libsigsegv/default.nix
+++ b/pkgs/development/libraries/libsigsegv/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libsigsegv";
-  version = "2.13";
+  version = "2.14";
 
   src = fetchurl {
     url = "mirror://gnu/libsigsegv/libsigsegv-${version}.tar.gz";
-    sha256 = "sha256-vnjuQXawX3x1/wMpjYSHTbkPS2ydVQPw2hIms6PEgRk=";
+    sha256 = "sha256-zaw5QYAzZM+BqQhJm+t5wgDq1gtrW0DK0ST9HgbKopU=";
   };
 
   patches = if enableSigbusFix then [ ./sigbus_fix.patch ] else null;
diff --git a/pkgs/development/libraries/libtiff/default.nix b/pkgs/development/libraries/libtiff/default.nix
index 5f34a80d253..1371345ddd7 100644
--- a/pkgs/development/libraries/libtiff/default.nix
+++ b/pkgs/development/libraries/libtiff/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv
 , fetchurl
+, fetchpatch
 
 , autoreconfHook
 , pkg-config
@@ -27,6 +28,21 @@ stdenv.mkDerivation rec {
     # libc++abi 11 has an `#include <version>`, this picks up files name
     # `version` in the project's include paths
     ./rename-version.patch
+    (fetchpatch {
+      name = "CVE-2022-22844.patch";
+      url = "https://gitlab.com/libtiff/libtiff/-/commit/03047a26952a82daaa0792957ce211e0aa51bc64.patch";
+      sha256 = "0cfih55f5qpc84mvlwsffik80bgz6drkflkhrdyqq8m84jw3mbwb";
+    })
+    (fetchpatch {
+      name = "CVE-2022-0561.patch";
+      url = "https://gitlab.com/libtiff/libtiff/-/commit/eecb0712f4c3a5b449f70c57988260a667ddbdef.patch";
+      sha256 = "0m57fdxyvhhr9cc260lvkkn2g4zr4n4v9nricc6lf9h6diagd7mk";
+    })
+    (fetchpatch {
+      name = "CVE-2022-0562.patch";
+      url = "https://gitlab.com/libtiff/libtiff/-/commit/561599c99f987dc32ae110370cfdd7df7975586b.patch";
+      sha256 = "0ycirjjc1vigj03kwjb92n6jszsl9p17ccw5hry7lli9gxyyr0an";
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/development/libraries/libwacom/default.nix b/pkgs/development/libraries/libwacom/default.nix
index 2f9afff56d8..1517cf97078 100644
--- a/pkgs/development/libraries/libwacom/default.nix
+++ b/pkgs/development/libraries/libwacom/default.nix
@@ -12,7 +12,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libwacom";
-  version = "1.99.1";
+  version = "2.0.0";
 
   outputs = [ "out" "dev" ];
 
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     owner = "linuxwacom";
     repo = "libwacom";
     rev = "libwacom-${version}";
-    sha256 = "sha256-WGW/4m+BTe6dEigUcuUIZjoTeamInW6zrtrlaqKM6Js=";
+    sha256 = "sha256-k8pEgEu+oWNa0rI47osVPKaZGxgwX/ENaz9jPrQXy0E=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libxkbcommon/default.nix b/pkgs/development/libraries/libxkbcommon/default.nix
index 25d2d89add0..7bcc62af6ec 100644
--- a/pkgs/development/libraries/libxkbcommon/default.nix
+++ b/pkgs/development/libraries/libxkbcommon/default.nix
@@ -21,11 +21,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libxkbcommon";
-  version = "1.3.1";
+  version = "1.4.0";
 
   src = fetchurl {
     url = "https://xkbcommon.org/download/${pname}-${version}.tar.xz";
-    sha256 = "0d4jzq0zv1xmng0z0q5lb4rz03ikgxdwi68k3r70ac16gb911ixk";
+    sha256 = "0ca00awfzvxiznvd4mgwgxyqxiwvi07j5xxmg5z0l47rcd9fqv0h";
   };
 
   outputs = [ "out" "dev" "doc" ];
diff --git a/pkgs/development/libraries/libxml2/default.nix b/pkgs/development/libraries/libxml2/default.nix
index bc11c9cfea1..3b7cae36a0e 100644
--- a/pkgs/development/libraries/libxml2/default.nix
+++ b/pkgs/development/libraries/libxml2/default.nix
@@ -1,20 +1,37 @@
-{ stdenv, lib, fetchurl, fetchpatch
-, zlib, xz, libintl, python, gettext, ncurses, findXMLCatalogs
+{ stdenv
+, lib
+, fetchurl
+, zlib
+, pkg-config
+, autoreconfHook
+, xz
+, libintl
+, python
+, gettext
+, ncurses
+, findXMLCatalogs
 , libiconv
 , pythonSupport ? enableShared && stdenv.buildPlatform == stdenv.hostPlatform
-, icuSupport ? false, icu ? null
+, icuSupport ? false
+, icu
 , enableShared ? stdenv.hostPlatform.libc != "msvcrt" && !stdenv.hostPlatform.isStatic
 , enableStatic ? !enableShared
+, gnome
 }:
 
 stdenv.mkDerivation rec {
   pname = "libxml2";
-  version = "2.9.12";
+  version = "2.9.13";
+
+  outputs = [ "bin" "dev" "out" "man" "doc" ]
+    ++ lib.optional pythonSupport "py"
+    ++ lib.optional (enableStatic && enableShared) "static";
 
   src = fetchurl {
-    url = "http://xmlsoft.org/sources/${pname}-${version}.tar.gz";
-    sha256 = "14hxwzmf5xqppx77z7i0ni9lpzg1a84dqpf8j8l1fvy570g6imn8";
+    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    sha256 = "J2EwYC0S/khOzANEfuXnWdBGVVj7yda9FE43RTBuvw4=";
   };
+
   patches = [
     # Upstream bugs:
     #   https://bugzilla.gnome.org/show_bug.cgi?id=789714
@@ -28,62 +45,65 @@ stdenv.mkDerivation rec {
     #   https://github.com/NixOS/nixpkgs/pull/63174
     #   https://github.com/NixOS/nixpkgs/pull/72342
     ./utf8-xmlErrorFuncHandler.patch
-
-    # Work around lxml API misuse.
-    # https://gitlab.gnome.org/GNOME/libxml2/issues/255
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/libxml2/commit/85b1792e37b131e7a51af98a37f92472e8de5f3f.patch";
-      sha256 = "epqlNs2S0Zczox3KyCB6R2aJKh87lXydlZ0x6tLHweE=";
-    })
   ];
 
-  outputs = [ "bin" "dev" "out" "man" "doc" ]
-    ++ lib.optional pythonSupport "py"
-    ++ lib.optional (enableStatic && enableShared) "static";
-
   strictDeps = true;
 
-  buildInputs = lib.optional pythonSupport python
-    ++ lib.optional (pythonSupport && python?isPy2 && python.isPy2) gettext
-    ++ lib.optional (pythonSupport && python?isPy3 && python.isPy3) ncurses
-    ++ lib.optional (stdenv.isDarwin &&
-                     pythonSupport && python?isPy2 && python.isPy2) libintl
+  nativeBuildInputs = [
+    pkg-config
+    autoreconfHook
+  ];
+
+  buildInputs = lib.optionals pythonSupport [
+    python
+  ] ++ lib.optionals (pythonSupport && python?isPy2 && python.isPy2) [
+    gettext
+  ] ++ lib.optionals (pythonSupport && python?isPy3 && python.isPy3) [
+    ncurses
+  ] ++ lib.optionals (stdenv.isDarwin && pythonSupport && python?isPy2 && python.isPy2) [
+    libintl
+  ] ++ lib.optionals stdenv.isFreeBSD [
     # Libxml2 has an optional dependency on liblzma.  However, on impure
     # platforms, it may end up using that from /usr/lib, and thus lack a
     # RUNPATH for that, leading to undefined references for its users.
-    ++ lib.optional stdenv.isFreeBSD xz;
+    xz
+  ];
 
-  propagatedBuildInputs = [ zlib findXMLCatalogs ]
-    ++ lib.optional stdenv.isDarwin libiconv
-    ++ lib.optional icuSupport icu;
+  propagatedBuildInputs = [
+    zlib
+    findXMLCatalogs
+  ] ++ lib.optionals stdenv.isDarwin [
+    libiconv
+  ] ++ lib.optionals icuSupport [
+    icu
+  ];
 
   configureFlags = [
-    "--exec_prefix=$dev"
+    "--exec-prefix=${placeholder "dev"}"
     (lib.enableFeature enableStatic "static")
     (lib.enableFeature enableShared "shared")
     (lib.withFeature icuSupport "icu")
     (lib.withFeatureAs pythonSupport "python" python)
   ];
 
-  preConfigure = lib.optionalString (lib.versionAtLeast stdenv.hostPlatform.darwinMinVersion "11") ''
-    MACOSX_DEPLOYMENT_TARGET=10.16
-  '';
+  installFlags = lib.optionals pythonSupport [
+    "pythondir=\"${placeholder "py"}/${python.sitePackages}\""
+  ];
 
   enableParallelBuilding = true;
 
-  # disable test that's problematic with newer pythons: see
-  # https://mail.gnome.org/archives/xml/2017-August/msg00014.html
-  preCheck = lib.optionalString (pythonSupport && !(python?pythonOlder && python.pythonOlder "3.5")) ''
-    echo "" > python/tests/tstLastError.py
-  '';
-
-  doCheck = (stdenv.hostPlatform == stdenv.buildPlatform) && !stdenv.isDarwin &&
+  doCheck =
+    (stdenv.hostPlatform == stdenv.buildPlatform) &&
+    !stdenv.isDarwin &&
     stdenv.hostPlatform.libc != "musl";
 
-  preInstall = lib.optionalString pythonSupport
-    ''substituteInPlace python/libxml2mod.la --replace "${python}" "$py"'';
-  installFlags = lib.optional pythonSupport
-    "pythondir=\"${placeholder "py"}/lib/${python.libPrefix}/site-packages\"";
+  preConfigure = lib.optionalString (lib.versionAtLeast stdenv.hostPlatform.darwinMinVersion "11") ''
+    MACOSX_DEPLOYMENT_TARGET=10.16
+  '';
+
+  preInstall = lib.optionalString pythonSupport ''
+    substituteInPlace python/libxml2mod.la --replace "$dev/${python.sitePackages}" "$py/${python.sitePackages}"
+  '';
 
   postFixup = ''
     moveToOutput bin/xml2-config "$dev"
@@ -93,13 +113,21 @@ stdenv.mkDerivation rec {
     moveToOutput lib/libxml2.a "$static"
   '';
 
-  passthru = { inherit version; pythonSupport = pythonSupport; };
+  passthru = {
+    inherit version;
+    pythonSupport = pythonSupport;
+
+    updateScript = gnome.updateScript {
+      packageName = pname;
+      versionPolicy = "none";
+    };
+  };
 
-  meta = {
+  meta = with lib; {
     homepage = "http://xmlsoft.org/";
-    description = "An XML parsing library for C";
-    license = lib.licenses.mit;
-    platforms = lib.platforms.all;
-    maintainers = [ lib.maintainers.eelco ];
+    description = "XML parsing library for C";
+    license = licenses.mit;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ eelco jtojnar ];
   };
 }
diff --git a/pkgs/development/libraries/libxslt/default.nix b/pkgs/development/libraries/libxslt/default.nix
index 3993b3f73e1..ac4dd749233 100644
--- a/pkgs/development/libraries/libxslt/default.nix
+++ b/pkgs/development/libraries/libxslt/default.nix
@@ -1,38 +1,60 @@
-{ lib, stdenv, fetchurl
+{ lib
+, stdenv
+, fetchurl
 , pkg-config
-, libxml2, findXMLCatalogs, gettext, python, libgcrypt
+, autoreconfHook
+, libxml2
+, findXMLCatalogs
+, gettext
+, python
+, ncurses
+, libgcrypt
 , cryptoSupport ? false
 , pythonSupport ? stdenv.buildPlatform == stdenv.hostPlatform
+, gnome
 }:
 
 stdenv.mkDerivation rec {
   pname = "libxslt";
-  version = "1.1.34";
+  version = "1.1.35";
+
+  outputs = [ "bin" "dev" "out" "man" "doc" ] ++ lib.optional pythonSupport "py";
 
   src = fetchurl {
-    url = "http://xmlsoft.org/sources/${pname}-${version}.tar.gz";
-    sha256 = "0zrzz6kjdyavspzik6fbkpvfpbd25r2qg6py5nnjaabrsr3bvccq";
+    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    sha256 = "gkfzPpqHLGrIWapFAYvExNALl+L+rJ7rwQyTzh803Xk=";
   };
 
-  outputs = [ "bin" "dev" "out" "man" "doc" ] ++ lib.optional pythonSupport "py";
-
   nativeBuildInputs = [
     pkg-config
+    autoreconfHook
   ];
 
-  buildInputs = [ libxml2.dev ]
-    ++ lib.optional stdenv.isDarwin gettext
-    ++ lib.optionals pythonSupport [ libxml2.py python ]
-    ++ lib.optionals cryptoSupport [ libgcrypt ];
+  buildInputs = [
+    libxml2.dev
+  ] ++ lib.optional stdenv.isDarwin [
+    gettext
+  ] ++ lib.optionals pythonSupport [
+    libxml2.py
+    python
+    ncurses
+  ] ++ lib.optionals cryptoSupport [
+    libgcrypt
+  ];
 
-  propagatedBuildInputs = [ findXMLCatalogs ];
+  propagatedBuildInputs = [
+    findXMLCatalogs
+  ];
 
   configureFlags = [
     "--without-debug"
     "--without-mem-debug"
     "--without-debugger"
-  ] ++ lib.optional pythonSupport "--with-python=${python}"
-    ++ lib.optional (!cryptoSupport) "--without-crypto";
+  ] ++ lib.optionals pythonSupport [
+    "--with-python=${python}"
+  ] ++ lib.optionals (!cryptoSupport) [
+    "--without-crypto"
+  ];
 
   postFixup = ''
     moveToOutput bin/xslt-config "$dev"
@@ -46,6 +68,11 @@ stdenv.mkDerivation rec {
 
   passthru = {
     inherit pythonSupport;
+
+    updateScript = gnome.updateScript {
+      packageName = pname;
+      versionPolicy = "none";
+    };
   };
 
   meta = with lib; {
@@ -53,7 +80,7 @@ stdenv.mkDerivation rec {
     description = "A C library and tools to do XSL transformations";
     license = licenses.mit;
     platforms = platforms.all;
-    maintainers = [ maintainers.eelco ];
-    broken = !(pythonSupport -> libxml2.pythonSupport); # see #73102 for why this is not an assert
+    maintainers = with maintainers; [ eelco jtojnar ];
+    broken = pythonSupport && !libxml2.pythonSupport; # see #73102 for why this is not an assert
   };
 }
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 1fb573931b6..23163763ed9 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -33,7 +33,7 @@ with lib;
 let
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
-  version = "21.3.5";
+  version = "21.3.7";
   branch  = versions.major version;
 
 self = stdenv.mkDerivation {
@@ -47,18 +47,13 @@ self = stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
     ];
-    sha256 = "0k2ary16ixsrp65m2n5djpr51nbwdgzpv81pfrnqbvk44jfjlfyr";
+    sha256 = "0ggw3s514z6szasbiy4dv5mdi689121yy2xly2g21gv1mavrvyml";
   };
 
   # TODO:
   #  revive ./dricore-gallium.patch when it gets ported (from Ubuntu), as it saved
   #  ~35 MB in $drivers; watch https://launchpad.net/ubuntu/+source/mesa/+changelog
   patches = [
-    # To fix flickering on Intel GPUs (iris), see https://github.com/NixOS/nixpkgs/issues/153377:
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/mesa/mesa/-/commit/07dc3d4238e57901ccf98e0b506d9aad2c86b9d9.diff";
-      sha256 = "sha256-3fa1qHJes3x1/iXsxfjgy9HnEGlOyFtJatSkU1a3XDI=";
-    })
     # fixes pkgsMusl.mesa build
     ./musl.patch
     (fetchpatch {
diff --git a/pkgs/development/libraries/ncurses/default.nix b/pkgs/development/libraries/ncurses/default.nix
index efab246bb1f..2740b95986c 100644
--- a/pkgs/development/libraries/ncurses/default.nix
+++ b/pkgs/development/libraries/ncurses/default.nix
@@ -13,7 +13,7 @@
 stdenv.mkDerivation rec {
   # Note the revision needs to be adjusted.
   version = "6.3";
-  name = "ncurses-${version}" + lib.optionalString (abiVersion == "5") "-abi5-compat";
+  pname = "ncurses" + lib.optionalString (abiVersion == "5") "-abi5-compat";
 
   # We cannot use fetchFromGitHub (which calls fetchzip)
   # because we need to be able to use fetchurlBoot.
diff --git a/pkgs/development/libraries/neon/default.nix b/pkgs/development/libraries/neon/default.nix
index a39ece28aae..1521c1a6389 100644
--- a/pkgs/development/libraries/neon/default.nix
+++ b/pkgs/development/libraries/neon/default.nix
@@ -14,12 +14,12 @@ let
 in
 
 stdenv.mkDerivation rec {
-  version = "0.31.2";
+  version = "0.32.2";
   pname = "neon";
 
   src = fetchurl {
     url = "https://notroj.github.io/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "0y46dbhiblcvg8k41bdydr3fivghwk73z040ki5825d24ynf67ng";
+    sha256 = "sha256-mGVmRoxilfxdD7FBpZgeMcn4LuOOk4N0q+2Ece8vsoY=";
   };
 
   patches = optionals stdenv.isDarwin [ ./darwin-fix-configure.patch ];
diff --git a/pkgs/development/libraries/nettle/generic.nix b/pkgs/development/libraries/nettle/generic.nix
index 348faf56b56..44afdf45513 100644
--- a/pkgs/development/libraries/nettle/generic.nix
+++ b/pkgs/development/libraries/nettle/generic.nix
@@ -5,9 +5,9 @@
 }:
 
 stdenv.mkDerivation {
-  name = "nettle-${version}";
+  pname = "nettle";
 
-  inherit src;
+  inherit version src;
 
   outputs = [ "out" "dev" ];
   outputBin = "dev";
diff --git a/pkgs/development/libraries/nss/default.nix b/pkgs/development/libraries/nss/default.nix
index e92b3dec07b..d17f4c4a783 100644
--- a/pkgs/development/libraries/nss/default.nix
+++ b/pkgs/development/libraries/nss/default.nix
@@ -27,7 +27,7 @@ let
   #       It will rebuild itself using the version of this package (NSS) and if
   #       an update is required do the required changes to the expression.
   #       Example: nix-shell ./maintainers/scripts/update.nix --argstr package cacert
-  version = "3.74";
+  version = "3.75";
 
 in
 stdenv.mkDerivation rec {
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://mozilla/security/nss/releases/NSS_${lib.replaceStrings [ "." ] [ "_" ] version}_RTM/src/${pname}-${version}.tar.gz";
-    sha256 = "0mnhdkm4galhpvfz4rv0918jwmjlwkvcvb1f5va8f3zlz48qi4l8";
+    sha256 = "10l5qn68gly2l4ifv0v6by1qc8nsmhra08nm9m7n913jh83iamzx";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
diff --git a/pkgs/development/libraries/opendht/default.nix b/pkgs/development/libraries/opendht/default.nix
index fa9fc1f87ee..2cd76a7ca78 100644
--- a/pkgs/development/libraries/opendht/default.nix
+++ b/pkgs/development/libraries/opendht/default.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "opendht";
-  version = "2.3.2";
+  version = "2.3.5";
 
   src = fetchFromGitHub {
     owner = "savoirfairelinux";
     repo = "opendht";
     rev = version;
-    sha256 = "sha256-LevS9euBAFkI1ll79uqmVaRR/6FH6Z4cypHqvCIWxgU=";
+    sha256 = "sha256-GGaq8ziOCUDMxILq2QYUkSP4usBjbufbHwQF4Pr6hHw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/openh264/default.nix b/pkgs/development/libraries/openh264/default.nix
index 93fc495d385..42ae370cd90 100644
--- a/pkgs/development/libraries/openh264/default.nix
+++ b/pkgs/development/libraries/openh264/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openh264";
-  version = "2.1.1";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "cisco";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0ffav46pz3sbj92nipd62z03fibyqgclfq9w8lgr80s6za6zdk5s";
+    sha256 = "sha256-l64xP39Uaislqh4D7oSxJiQGhXkklol4LgS9BVPbaGk=";
   };
 
   nativeBuildInputs = [ nasm ];
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 390227cfe95..33ddbf7018c 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -186,8 +186,8 @@ in {
   };
 
   openssl_1_1 = common rec {
-    version = "1.1.1m";
-    sha256 = "sha256-+JGZvosjykX8fLnx2NPuZzEjGChq0DD1MWrKZGLbbJY=";
+    version = "1.1.1n";
+    sha256 = "sha256-QNzrUaT2pSdb3g5r8g70uRv8Mu1XwFUuLo4VRjNysXo=";
     patches = [
       ./1.1/nix-ssl-cert-file.patch
 
@@ -201,8 +201,8 @@ in {
   };
 
   openssl_3_0 = common {
-    version = "3.0.1";
-    sha256 = "sha256-wxGthTNTvOeW7a0BqGLFCopYf2Ln4hAO9GWrU+ybBtE=";
+    version = "3.0.2";
+    sha256 = "sha256-mOkczq1NR1auPJzeXgkZGo5YbZ9NUIOOfsCdZBHf22M=";
     patches = [
       ./3.0/nix-ssl-cert-file.patch
 
diff --git a/pkgs/development/libraries/pango/default.nix b/pkgs/development/libraries/pango/default.nix
index 964a3640871..3033b7df4e3 100644
--- a/pkgs/development/libraries/pango/default.nix
+++ b/pkgs/development/libraries/pango/default.nix
@@ -24,14 +24,14 @@
 
 stdenv.mkDerivation rec {
   pname = "pango";
-  version = "1.50.3";
+  version = "1.50.4";
 
   outputs = [ "bin" "out" "dev" ]
     ++ lib.optionals withDocs [ "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "St0F7fUcH7N1oczedJiRQSDiPLKA3XOVsa60QfGDikw=";
+    sha256 = "9K1j6H3CsUUwBUKk+wBNB6n5GzQVL64N2+UOzdhRwWI=";
   };
 
   strictDeps = !withIntrospection;
diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index d4dc4302139..d37e0a05086 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -20,7 +20,6 @@
 , udev
 , libva
 , libsndfile
-, SDL2
 , vulkan-headers
 , vulkan-loader
 , webrtc-audio-processing
@@ -129,7 +128,6 @@ let
       vulkan-headers
       vulkan-loader
       webrtc-audio-processing
-      SDL2
       systemd
     ] ++ lib.optionals gstreamerSupport [ gst_all_1.gst-plugins-base gst_all_1.gstreamer ]
     ++ lib.optionals libcameraSupport [ libcamera libdrm ]
@@ -169,6 +167,7 @@ let
       "-Dsession-managers="
       "-Dvulkan=enabled"
       "-Dx11=${mesonEnableFeature x11Support}"
+      "-Dsdl2=disabled" # required only to build examples, causes dependency loop
     ];
 
     # Fontconfig error: Cannot load default config file
diff --git a/pkgs/development/libraries/plasma-wayland-protocols/default.nix b/pkgs/development/libraries/plasma-wayland-protocols/default.nix
index fe148368b49..082702ec46f 100644
--- a/pkgs/development/libraries/plasma-wayland-protocols/default.nix
+++ b/pkgs/development/libraries/plasma-wayland-protocols/default.nix
@@ -7,11 +7,11 @@
 
 mkDerivation rec {
   pname = "plasma-wayland-protocols";
-  version = "1.5.0";
+  version = "1.6.0";
 
   src = fetchurl {
     url = "mirror://kde/stable/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-zMn8INehMO2/sjPDOxMldArAGyZAqjelxUTtv7oYqDM=";
+    sha256 = "sha256-t0/6yWnvBn5HGA50imejoYFrcVf/TqYg7UQy9Ztw8B8=";
   };
 
   nativeBuildInputs = [ extra-cmake-modules ];
diff --git a/pkgs/development/libraries/polkit/default.nix b/pkgs/development/libraries/polkit/default.nix
index 3a3199cbd7a..72907f7aedc 100644
--- a/pkgs/development/libraries/polkit/default.nix
+++ b/pkgs/development/libraries/polkit/default.nix
@@ -65,6 +65,12 @@ stdenv.mkDerivation rec {
       url = "https://gitlab.freedesktop.org/polkit/polkit/-/commit/a2bf5c9c83b6ae46cbd5c779d3055bff81ded683.patch";
       sha256 = "162jkpg2myq0rb0s5k3nfr4pqwv9im13jf6vzj8p5l39nazg5i4s";
     })
+    # File descriptor leak allows an unprivileged user to cause a crash (CVE-2021-4115)
+    (fetchpatch {
+      name = "CVE-2021-4115.patch";
+      url = "https://src.fedoraproject.org/rpms/polkit/raw/0a203bd46a1e2ec8cc4b3626840e2ea9d0d13a9a/f/CVE-2021-4115.patch";
+      sha256 = "sha256-BivHVVpYB4Ies1YbBDyKwUmNlqq2D1MpMipH9/dZM54=";
+    })
   ] ++ lib.optionals stdenv.hostPlatform.isMusl [
     # Make netgroup support optional (musl does not have it)
     # Upstream MR: https://gitlab.freedesktop.org/polkit/polkit/merge_requests/10
diff --git a/pkgs/development/libraries/protolock/default.nix b/pkgs/development/libraries/protolock/default.nix
index e364b907794..ef6338207e3 100644
--- a/pkgs/development/libraries/protolock/default.nix
+++ b/pkgs/development/libraries/protolock/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "protolock";
-  version = "0.15.2";
+  version = "0.16.0";
 
   src = fetchFromGitHub {
     owner = "nilslice";
     repo = "protolock";
     rev = "v${version}";
-    sha256 = "sha256-cKrG8f8cabuGDN1gmBYleXcBqeJksdREiEy63UK/6J0=";
+    sha256 = "sha256-vWwRZVArmlTIGwD4zV3dEHN2kkoeCZuNIvjCBVAviPo=";
   };
 
-  vendorSha256 = "sha256-2XbBiiiPvZCnlKUzGDLFnxA34N/LmHoPbvRKZckmhx4=";
+  vendorSha256 = "sha256-kgSJUSjY8kgrGCNDPgw1WA8KwAqI5koJQ0IcE+tC5nk=";
 
   doCheck = false;
 
diff --git a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
index 76c4237dcaf..8bf6386c4c6 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
+++ b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
@@ -1,8 +1,8 @@
 {
   "qt3d": {
     "url": "https://invent.kde.org/qt/qt/qt3d.git",
-    "rev": "7edec6e014de27b9dd03f63875c471aac606a918",
-    "sha256": "0qv4vhciigqd8bnqzrs7y71ls7jx1p9cal2rh78m42qgskk1ci59"
+    "rev": "dba14d48611b9e9d59576172658779ab4a39b416",
+    "sha256": "1w2m1rm6mhj9qbanak36rqvc30x495zvj7mh2syy1yd29by0g5i8"
   },
   "qtactiveqt": {
     "url": "https://invent.kde.org/qt/qt/qtactiveqt.git",
@@ -16,8 +16,8 @@
   },
   "qtbase": {
     "url": "https://invent.kde.org/qt/qt/qtbase.git",
-    "rev": "c9fde86b0a2440133bc08f4811b6ca793be47f0a",
-    "sha256": "1fqhdkv3sp3nbzqi2a5wvxn5d4v0xcrq2bl609bdyj4nx367a8wp"
+    "rev": "d16bf02a11953dcac01dca73e6f3778f293adefe",
+    "sha256": "0rpyd5r60707lzfmfi3y501c7is1gzhh30bframsy8bwglck2hjj"
   },
   "qtcharts": {
     "url": "https://invent.kde.org/qt/qt/qtcharts.git",
@@ -26,8 +26,8 @@
   },
   "qtconnectivity": {
     "url": "https://invent.kde.org/qt/qt/qtconnectivity.git",
-    "rev": "69a87a9b831e36a578594a0a13130c384ad03121",
-    "sha256": "0ph07rdf9qfxnw3z2nqbmh6na65z0p2snmlzdw80amd7s0g255kw"
+    "rev": "5e9ca5d36d65dadb98ef90013a1dcf15fbd7ae26",
+    "sha256": "1lpiq3svlnj8f8apd12if11sng7k0l8y6vhr317srzz4dd77cfry"
   },
   "qtdatavis3d": {
     "url": "https://invent.kde.org/qt/qt/qtdatavis3d.git",
@@ -36,8 +36,8 @@
   },
   "qtdeclarative": {
     "url": "https://invent.kde.org/qt/qt/qtdeclarative.git",
-    "rev": "55324650f9e759a43dce927f823c9858574106c3",
-    "sha256": "0cxz4pqvb8l0wqpc4hr0xmc72csqf7dpbbzdqgil9nyyg21ihkz0"
+    "rev": "1d49a5b678957adde7e2db23a485a3f48157bc8f",
+    "sha256": "1wdpgh23mdn0nny9c837iyg9kszc3m4cdmaanf8glymkzn0rkd8w"
   },
   "qtdoc": {
     "url": "https://invent.kde.org/qt/qt/qtdoc.git",
@@ -101,8 +101,8 @@
   },
   "qtquickcontrols2": {
     "url": "https://invent.kde.org/qt/qt/qtquickcontrols2.git",
-    "rev": "be66bf9a5618c745d2a6ee2262967af6307b3b07",
-    "sha256": "11h3f3rb2kqgsw7njzhjwazw1k03v12i83irjndylafiaqw6c6ks"
+    "rev": "d8d6b14b9907adbc6ce307d52be34aaa761a58fa",
+    "sha256": "15c7nrvvn7qc3l7kdbl5wdpazqwv8zvg1aij2jvcrhbymn0zl3mc"
   },
   "qtquicktimeline": {
     "url": "https://invent.kde.org/qt/qt/qtquicktimeline.git",
@@ -146,8 +146,8 @@
   },
   "qtsvg": {
     "url": "https://invent.kde.org/qt/qt/qtsvg.git",
-    "rev": "24128cdf8bef53eddf31a5709bbbc46293006b1c",
-    "sha256": "0vinjcbq4saxhlmvb5i93bzgg30qc3j8r2qfwrzaxc4vmfhfgi56"
+    "rev": "728012f7762ecd5762d493f8796907c6456f31e7",
+    "sha256": "1ldizgybl4fp95xlzf103hqmsqdmr3jbx048jyxcb5gjd3pbwh7p"
   },
   "qttools": {
     "url": "https://invent.kde.org/qt/qt/qttools.git",
@@ -161,18 +161,18 @@
   },
   "qtvirtualkeyboard": {
     "url": "https://invent.kde.org/qt/qt/qtvirtualkeyboard.git",
-    "rev": "353b75b2e34bdae901625bbddf5c5e3f3e6c0de5",
-    "sha256": "12nv773zc05yrbai1z6i481yinih0kxcjzgm9pa0580qz69gd9a5"
+    "rev": "98d1fd864cbb6c7c012c4139118808af110fb8f0",
+    "sha256": "07xjmhca7z5bva03zk73d948qz0a3wnn4kvyy6j4cnp3w5giz5kc"
   },
   "qtwayland": {
     "url": "https://invent.kde.org/qt/qt/qtwayland.git",
-    "rev": "992833ca741efe8f533c61abfaf129a1d8bfcfee",
-    "sha256": "1w8mq38k6s0fncqv113bw1pc7g10ysfmsbyg23hxh9fr5q4ia4q7"
+    "rev": "214f7ab9d3384a4123f14d9f6cd0205cf0aaa794",
+    "sha256": "1qd64w5c16gmpgi936dfjc0pn1a1rbs752k8lfqv2xwysx7qkqwi"
   },
   "qtwebchannel": {
     "url": "https://invent.kde.org/qt/qt/qtwebchannel.git",
-    "rev": "47be9a51b01d9fd9e7f6dca81e98d4eedcec6d38",
-    "sha256": "167rp43c86xr4grzxs4bl46y6sf1q9xa0641mgp4r94g2ipxyc1d"
+    "rev": "fa8b07105b5e274daaa8adcc129fa4aa0447f9f7",
+    "sha256": "0mggqa8kixknbm1p5i5lkrmkj1na3b2xflj011dkjbj8wb78i42n"
   },
   "qtwebglplugin": {
     "url": "https://invent.kde.org/qt/qt/qtwebglplugin.git",
@@ -181,8 +181,8 @@
   },
   "qtwebsockets": {
     "url": "https://invent.kde.org/qt/qt/qtwebsockets.git",
-    "rev": "e7883bc64440b1ff4666272ac6eb710ee4bc221b",
-    "sha256": "1rj99y1f0wn6g1m2k53xkni5v79zgq25yv8b9wx2bz0n2r9iasca"
+    "rev": "b13b56904b76e96ea52d0efe56395acc94b17d96",
+    "sha256": "047asrq7c44v7cn2d7c5zba47qzpsb6nidba77i2xn7gqlfv6z3b"
   },
   "qtwebview": {
     "url": "https://invent.kde.org/qt/qt/qtwebview.git",
diff --git a/pkgs/development/libraries/readline/readline-8.1-patches.nix b/pkgs/development/libraries/readline/readline-8.1-patches.nix
index b8019fb3350..b2aaadf0e9b 100644
--- a/pkgs/development/libraries/readline/readline-8.1-patches.nix
+++ b/pkgs/development/libraries/readline/readline-8.1-patches.nix
@@ -1,4 +1,6 @@
 # Automatically generated by `update-patch-set.sh'; do not edit.
 
 patch: [
+(patch "001" "0i4ikdqgcjnb40y2ss3lm09rq56zih5rzma3bib50dk3d1d4cak8")
+(patch "002" "1p15sfx5xg5k4lam12lyd0givk7dfjddqpnb1jdp3c4clray0nz5")
 ]
diff --git a/pkgs/development/libraries/readline/update-patch-set.sh b/pkgs/development/libraries/readline/update-patch-set.sh
new file mode 120000
index 00000000000..d4f5cd2f312
--- /dev/null
+++ b/pkgs/development/libraries/readline/update-patch-set.sh
@@ -0,0 +1 @@
+../../../shells/bash/update-patch-set.sh
\ No newline at end of file
diff --git a/pkgs/development/libraries/science/math/amd-blis/default.nix b/pkgs/development/libraries/science/math/amd-blis/default.nix
index cba9c28164a..f0408730282 100644
--- a/pkgs/development/libraries/science/math/amd-blis/default.nix
+++ b/pkgs/development/libraries/science/math/amd-blis/default.nix
@@ -64,7 +64,7 @@ in stdenv.mkDerivation rec {
     description = "BLAS-compatible library optimized for AMD CPUs";
     homepage = "https://developer.amd.com/amd-aocl/blas-library/";
     license = licenses.bsd3;
-    maintainers = [ ];
+    maintainers = [ maintainers.markuskowa ];
     platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/pkgs/development/libraries/science/math/amd-libflame/default.nix b/pkgs/development/libraries/science/math/amd-libflame/default.nix
index b28fa43a226..a5b65737941 100644
--- a/pkgs/development/libraries/science/math/amd-libflame/default.nix
+++ b/pkgs/development/libraries/science/math/amd-libflame/default.nix
@@ -6,8 +6,12 @@
 , amd-blis
 
 , withOpenMP ? true
+, blas64 ? false
 }:
 
+# right now only LP64 is supported
+assert !blas64;
+
 stdenv.mkDerivation rec {
   pname = "amd-libflame";
   version = "3.0";
@@ -26,6 +30,8 @@ stdenv.mkDerivation rec {
     ./add-lapacke.diff
   ];
 
+  passthru = { inherit blas64; };
+
   nativeBuildInputs = [ gfortran python3 ];
 
   buildInputs = [ amd-blis ];
diff --git a/pkgs/development/libraries/science/math/blas/default.nix b/pkgs/development/libraries/science/math/blas/default.nix
index cfdc102e044..acb737836c0 100644
--- a/pkgs/development/libraries/science/math/blas/default.nix
+++ b/pkgs/development/libraries/science/math/blas/default.nix
@@ -1,4 +1,7 @@
-{ lib, stdenv, fetchurl, gfortran }:
+{ lib, stdenv, fetchurl, cmake, gfortran
+# Wether to build with ILP64 interface
+, blas64 ? false
+}:
 
 stdenv.mkDerivation rec {
   pname = "blas";
@@ -9,50 +12,19 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-LjYNmcm9yEB6YYiMQKqFP7QhlCDruCZNtIbLiGBGirM=";
   };
 
-  nativeBuildInputs = [ gfortran ];
+  passthru = { inherit blas64; };
 
-  configurePhase = ''
-    echo >make.inc  "SHELL = ${stdenv.shell}"
-    echo >>make.inc "PLAT = _LINUX"
-    echo >>make.inc "FORTRAN = gfortran"
-    echo >>make.inc "OPTS = -O2 -fPIC"
-    echo >>make.inc "DRVOPTS = $$(OPTS)"
-    echo >>make.inc "NOOPT = -O0 -fPIC"
-    echo >>make.inc "LOADER = gfortran"
-    echo >>make.inc "LOADOPTS ="
-    echo >>make.inc "AR = gfortran"
-    echo >>make.inc "ARFLAGS = -shared -o"
-    echo >>make.inc "RANLIB = echo"
-    echo >>make.inc "BLASLIB = libblas.so.${version}"
-  '';
+  nativeBuildInputs = [ cmake gfortran ];
 
-  buildPhase = ''
-    make
-    echo >>make.inc "ARFLAGS = "
-    echo >>make.inc "BLASLIB = libblas.a"
-    echo >>make.inc "AR = ar rcs"
-    echo >>make.inc "RANLIB = ranlib"
-    make
-  '';
+  cmakeFlags = [ "-DBUILD_SHARED_LIBS=ON" ]
+    ++ lib.optional blas64 "-DBUILD_INDEX64=ON";
 
-  installPhase =
-    # FreeBSD's stdenv doesn't use Coreutils.
-    let dashD = if stdenv.isFreeBSD then "" else "-D"; in
-    (lib.optionalString stdenv.isFreeBSD "mkdir -p $out/lib ;")
-    + ''
-    install ${dashD} -m755 libblas.a "$out/lib/libblas.a"
-    install ${dashD} -m755 libblas.so.${version} "$out/lib/libblas.so.${version}"
-    ln -s libblas.so.${version} "$out/lib/libblas.so.3"
-    ln -s libblas.so.${version} "$out/lib/libblas.so"
-    # Write pkg-config alias.
-    # See also openblas/default.nix
-    mkdir $out/lib/pkgconfig
-    cat <<EOF > $out/lib/pkgconfig/blas.pc
-Name: blas
-Version: ${version}
-Description: blas provided by the BLAS package.
-Libs: -L$out/lib -lblas
-EOF
+  postInstall = let
+    canonicalExtension = if stdenv.hostPlatform.isLinux
+                       then "${stdenv.hostPlatform.extensions.sharedLibrary}.${lib.versions.major version}"
+                       else stdenv.hostPlatform.extensions.sharedLibrary;
+  in lib.optionalString blas64 ''
+    ln -s $out/lib/libblas64${canonicalExtension} $out/lib/libblas${canonicalExtension}
   '';
 
   preFixup = lib.optionalString stdenv.isDarwin ''
@@ -62,10 +34,11 @@ EOF
     done
   '';
 
-  meta = {
+  meta = with lib; {
     description = "Basic Linear Algebra Subprograms";
-    license = lib.licenses.publicDomain;
+    license = licenses.publicDomain;
+    maintainers = [ maintainers.markuskowa ];
     homepage = "http://www.netlib.org/blas/";
-    platforms = lib.platforms.unix;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/science/math/liblapack/default.nix b/pkgs/development/libraries/science/math/liblapack/default.nix
index f2a50cb2d3d..9f481961e5b 100644
--- a/pkgs/development/libraries/science/math/liblapack/default.nix
+++ b/pkgs/development/libraries/science/math/liblapack/default.nix
@@ -5,6 +5,8 @@
 , gfortran
 , cmake
 , shared ? true
+# Compile with ILP64 interface
+, blas64 ? false
 }:
 
 stdenv.mkDerivation rec {
@@ -36,7 +38,19 @@ stdenv.mkDerivation rec {
     "-DLAPACKE=ON"
     "-DCBLAS=ON"
     "-DBUILD_TESTING=ON"
-  ] ++ lib.optional shared "-DBUILD_SHARED_LIBS=ON";
+  ] ++ lib.optional shared "-DBUILD_SHARED_LIBS=ON"
+    ++ lib.optional blas64 "-DBUILD_INDEX64=ON";
+
+  passthru = { inherit blas64; };
+
+  postInstall =  let
+    canonicalExtension = if stdenv.hostPlatform.isLinux
+                       then "${stdenv.hostPlatform.extensions.sharedLibrary}.${lib.versions.major version}"
+                       else stdenv.hostPlatform.extensions.sharedLibrary;
+  in lib.optionalString blas64 ''
+    ln -s $out/lib/liblapack64${canonicalExtension} $out/lib/liblapack${canonicalExtension}
+    ln -s $out/lib/liblapacke64${canonicalExtension} $out/lib/liblapacke${canonicalExtension}
+  '';
 
   doCheck = true;
 
@@ -63,7 +77,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Linear Algebra PACKage";
     homepage = "http://www.netlib.org/lapack/";
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ markuskowa ];
     license = licenses.bsd3;
     platforms = platforms.all;
   };
diff --git a/pkgs/development/libraries/science/math/openblas/default.nix b/pkgs/development/libraries/science/math/openblas/default.nix
index d61b6ee3acb..8e5d7180115 100644
--- a/pkgs/development/libraries/science/math/openblas/default.nix
+++ b/pkgs/development/libraries/science/math/openblas/default.nix
@@ -129,7 +129,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "openblas";
-  version = "0.3.19";
+  version = "0.3.20";
 
   outputs = [ "out" "dev" ];
 
@@ -137,7 +137,7 @@ stdenv.mkDerivation rec {
     owner = "xianyi";
     repo = "OpenBLAS";
     rev = "v${version}";
-    sha256 = "sha256-EqA6oFM2theuvvuDOWeOx0Bv6AEFffmpWHJBzp23br0=";
+    sha256 = "sha256-FLPVcepf7tv/es+4kur9Op7o3iVAAayuYN4hY/P4mmQ=";
   };
 
   inherit blas64;
diff --git a/pkgs/development/libraries/speex/default.nix b/pkgs/development/libraries/speex/default.nix
index a7d4aa97074..5509be7822d 100644
--- a/pkgs/development/libraries/speex/default.nix
+++ b/pkgs/development/libraries/speex/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, autoreconfHook, pkg-config, fftw, speexdsp }:
+{ lib, stdenv, fetchurl, fetchpatch, autoreconfHook, pkg-config, fftw, speexdsp }:
 
 stdenv.mkDerivation rec {
   pname = "speex";
@@ -13,6 +13,14 @@ stdenv.mkDerivation rec {
     sed -i '/AC_CONFIG_MACRO_DIR/i PKG_PROG_PKG_CONFIG' configure.ac
   '';
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2020-23903.patch";
+      url = "https://github.com/xiph/speex/commit/870ff845b32f314aec0036641ffe18aba4916887.patch";
+      sha256 = "sha256-uEMDhDTw/LIWNPPCXW6kF+udBmNO88G/jJTojAA9fs8=";
+    })
+  ];
+
   outputs = [ "out" "dev" "doc" ];
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
diff --git a/pkgs/development/libraries/tk/generic.nix b/pkgs/development/libraries/tk/generic.nix
index 6aa67bf274d..fd4f3dea375 100644
--- a/pkgs/development/libraries/tk/generic.nix
+++ b/pkgs/development/libraries/tk/generic.nix
@@ -3,7 +3,8 @@
 , ... }:
 
 tcl.mkTclDerivation {
-  name = "tk-${tcl.version}";
+  pname = "tk";
+  version = tcl.version;
 
   inherit src patches;
 
diff --git a/pkgs/development/libraries/wxwidgets/3.1/default.nix b/pkgs/development/libraries/wxwidgets/3.1/default.nix
deleted file mode 100644
index cab0197c939..00000000000
--- a/pkgs/development/libraries/wxwidgets/3.1/default.nix
+++ /dev/null
@@ -1,138 +0,0 @@
-{ lib, stdenv
-, fetchFromGitHub
-, fetchurl
-, pkg-config
-, libXinerama
-, libSM
-, libXxf86vm
-, libXtst
-, gtk2
-, GConf ? null
-, gtk3
-, xorgproto
-, gst_all_1
-, setfile
-, libGLSupported ? lib.elem stdenv.hostPlatform.system lib.platforms.mesaPlatforms
-, withMesa ? libGLSupported
-, libGLU ? null
-, libGL ? null
-, compat28 ? false
-, compat30 ? true
-, unicode ? true
-, withGtk2 ? true
-, withWebKit ? false
-, webkitgtk ? null
-, AGL ? null
-, Carbon ? null
-, Cocoa ? null
-, Kernel ? null
-, QTKit ? null
-}:
-
-with lib;
-
-assert withMesa -> libGLU != null && libGL != null;
-assert withWebKit -> webkitgtk != null;
-
-assert assertMsg (withGtk2 -> withWebKit == false) "wxGTK31: You cannot enable withWebKit when using withGtk2.";
-
-stdenv.mkDerivation rec {
-  version = "3.1.4";
-  pname = "wxwidgets";
-
-  src = fetchFromGitHub {
-    owner = "wxWidgets";
-    repo = "wxWidgets";
-    rev = "v${version}";
-    sha256 = "1fwzrk6w5k0vs8kqdq5lpzdbp5c09hx740wg6mi6vgmc1r67dv67";
-    fetchSubmodules = true;
-  };
-
-  buildInputs = [
-    libXinerama
-    libSM
-    libXxf86vm
-    libXtst
-    xorgproto
-    gst_all_1.gstreamer
-    gst_all_1.gst-plugins-base
-  ] ++ optionals withGtk2 [ gtk2 GConf ]
-  ++ optional (!withGtk2) gtk3
-  ++ optional withMesa libGLU
-  ++ optional withWebKit webkitgtk
-  ++ optionals stdenv.isDarwin [ setfile Carbon Cocoa Kernel QTKit ];
-
-  nativeBuildInputs = [ pkg-config ];
-
-  propagatedBuildInputs = optional stdenv.isDarwin AGL;
-
-  patches = [
-    (fetchurl {
-      # https://trac.wxwidgets.org/ticket/17942
-      url = "https://trac.wxwidgets.org/raw-attachment/ticket/17942/"
-        + "fix_assertion_using_hide_in_destroy.diff";
-      sha256 = "009y3dav79wiig789vkkc07g1qdqprg1544lih79199kb1h64lvy";
-    })
-  ];
-
-  configureFlags =
-    [
-      "--disable-precomp-headers"
-      "--enable-mediactrl"
-      (if compat28 then "--enable-compat28" else "--disable-compat28")
-      (if compat30 then "--enable-compat30" else "--disable-compat30")
-    ]
-    ++ optional unicode "--enable-unicode"
-    ++ optional withMesa "--with-opengl"
-    ++ optionals stdenv.isDarwin
-      # allow building on 64-bit
-      [ "--with-cocoa" "--enable-universal-binaries" "--with-macosx-version-min=10.7" ]
-    ++ optionals withWebKit
-      [ "--enable-webview" "--enable-webviewwebkit" ];
-
-  SEARCH_LIB = "${libGLU.out}/lib ${libGL.out}/lib ";
-
-  preConfigure = "
-    substituteInPlace configure --replace 'SEARCH_INCLUDE=' 'DUMMY_SEARCH_INCLUDE='
-    substituteInPlace configure --replace 'SEARCH_LIB=' 'DUMMY_SEARCH_LIB='
-    substituteInPlace configure --replace /usr /no-such-path
-  " + optionalString stdenv.isDarwin ''
-    substituteInPlace configure --replace \
-      'ac_cv_prog_SETFILE="/Developer/Tools/SetFile"' \
-      'ac_cv_prog_SETFILE="${setfile}/bin/SetFile"'
-    substituteInPlace configure --replace \
-      "-framework System" \
-      -lSystem
-  '';
-
-  postInstall = "
-    (cd $out/include && ln -s wx-*/* .)
-  ";
-
-  passthru = {
-    inherit compat28 compat30 unicode;
-    gtk = if withGtk2 then gtk2 else gtk3;
-  };
-
-  enableParallelBuilding = true;
-
-  meta = {
-    platforms = with platforms; darwin ++ linux;
-    license = licenses.wxWindows;
-    homepage = "https://www.wxwidgets.org/";
-    description = "A C++ library that lets developers create applications for Windows, macOS, Linux and other platforms with a single code base";
-    longDescription = ''
-      WxWidgets gives you a single, easy-to-use API for
-      writing GUI applications on multiple platforms that still utilize the
-      native platform's controls and utilities. Link with the appropriate library
-      for your platform and compiler, and your application will adopt the look
-      and feel appropriate to that platform. On top of great GUI functionality,
-      wxWidgets gives you: online help, network programming, streams, clipboard
-      and drag and drop, multithreading, image loading and saving in a variety of
-      popular formats, database support, HTML viewing and printing, and much
-      more.
-    '';
-    badPlatforms = [ "x86_64-darwin" ];
-    maintainers = with maintainers; [ tfmoraes ];
-  };
-}
diff --git a/pkgs/development/libraries/wxwidgets/2.8/default.nix b/pkgs/development/libraries/wxwidgets/wxGTK28.nix
index 19a57d68e15..19a57d68e15 100644
--- a/pkgs/development/libraries/wxwidgets/2.8/default.nix
+++ b/pkgs/development/libraries/wxwidgets/wxGTK28.nix
diff --git a/pkgs/development/libraries/wxwidgets/2.9/default.nix b/pkgs/development/libraries/wxwidgets/wxGTK29.nix
index 34d76e53ff6..d5bef77202f 100644
--- a/pkgs/development/libraries/wxwidgets/2.9/default.nix
+++ b/pkgs/development/libraries/wxwidgets/wxGTK29.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
 
   patches = [
     # https://github.com/wxWidgets/wxWidgets/issues/17942
-    ../patches/0001-fix-assertion-using-hide-in-destroy.patch
+    ./patches/0001-fix-assertion-using-hide-in-destroy.patch
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/wxwidgets/3.0/default.nix b/pkgs/development/libraries/wxwidgets/wxGTK30.nix
index 628d8bd0237..11545330387 100644
--- a/pkgs/development/libraries/wxwidgets/3.0/default.nix
+++ b/pkgs/development/libraries/wxwidgets/wxGTK30.nix
@@ -12,8 +12,8 @@
 , pkg-config
 , xorgproto
 , withMesa ? lib.elem stdenv.hostPlatform.system lib.platforms.mesaPlatforms
-, compat24 ? false
-, compat26 ? true
+, compat26 ? false
+, compat28 ? true
 , unicode ? true
 , withGtk2 ? true
 , withWebKit ? false, webkitgtk
@@ -69,14 +69,14 @@ stdenv.mkDerivation rec {
 
   patches = [
     # https://github.com/wxWidgets/wxWidgets/issues/17942
-    ../patches/0001-fix-assertion-using-hide-in-destroy.patch
+    ./patches/0001-fix-assertion-using-hide-in-destroy.patch
   ];
 
   configureFlags = [
     "--disable-precomp-headers"
     "--enable-mediactrl"
-    (if compat24 then "--enable-compat24" else "--disable-compat24")
     (if compat26 then "--enable-compat26" else "--disable-compat26")
+    (if compat28 then "--enable-compat28" else "--disable-compat28")
   ]
   ++ lib.optional unicode "--enable-unicode"
   ++ lib.optional withMesa "--with-opengl"
@@ -136,6 +136,6 @@ stdenv.mkDerivation rec {
 
   passthru = {
     inherit gtk;
-    inherit compat24 compat26 unicode;
+    inherit compat26 compat28 unicode;
   };
 }
diff --git a/pkgs/development/libraries/wxwidgets/wxGTK31.nix b/pkgs/development/libraries/wxwidgets/wxGTK31.nix
new file mode 100644
index 00000000000..c262232f30d
--- /dev/null
+++ b/pkgs/development/libraries/wxwidgets/wxGTK31.nix
@@ -0,0 +1,149 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchurl
+, gnome2
+, gst_all_1
+, gtk2
+, gtk3
+, libGL
+, libGLU
+, libSM
+, libXinerama
+, libXtst
+, libXxf86vm
+, pkg-config
+, xorgproto
+, compat28 ? false
+, compat30 ? true
+, unicode ? true
+, withGtk2 ? true
+, withMesa ? lib.elem stdenv.hostPlatform.system lib.platforms.mesaPlatforms
+, withWebKit ? false, webkitgtk
+, darwin
+}:
+
+assert withMesa -> libGLU != null && libGL != null;
+assert withWebKit -> webkitgtk != null;
+
+assert withGtk2 -> (!withWebKit);
+
+let
+  inherit (darwin.stubs) setfile;
+  inherit (darwin.apple_sdk.frameworks) AGL Carbon Cocoa Kernel QTKit;
+  inherit (gnome2) GConf;
+  inherit (gst_all_1) gst-plugins-base gstreamer;
+  gtk = if withGtk2 then gtk2 else gtk3;
+in
+stdenv.mkDerivation rec {
+  pname = "wxwidgets";
+  version = "3.1.5";
+
+  src = fetchFromGitHub {
+    owner = "wxWidgets";
+    repo = "wxWidgets";
+    rev = "v${version}";
+    hash = "sha256-2zMvcva0GUDmSYK0Wk3/2Y6R3F7MgdqGBrOhmWgVA6g=";
+    fetchSubmodules = true;
+  };
+
+  patches = [
+    # https://github.com/wxWidgets/wxWidgets/issues/17942
+    ./patches/0001-fix-assertion-using-hide-in-destroy.patch
+  ];
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    gst-plugins-base
+    gstreamer
+    gtk
+    libSM
+    libXinerama
+    libXtst
+    libXxf86vm
+    xorgproto
+  ]
+  ++ lib.optionals withGtk2 [
+    GConf
+  ]
+  ++ lib.optional withMesa libGLU
+  ++ lib.optional withWebKit webkitgtk
+  ++ lib.optionals stdenv.isDarwin [
+    Carbon
+    Cocoa
+    Kernel
+    QTKit
+    setfile
+  ];
+
+  propagatedBuildInputs = lib.optional stdenv.isDarwin AGL;
+
+  configureFlags = [
+    "--disable-precomp-headers"
+    "--enable-mediactrl"
+    (if compat28 then "--enable-compat28" else "--disable-compat28")
+    (if compat30 then "--enable-compat30" else "--disable-compat30")
+  ]
+  ++ lib.optional unicode "--enable-unicode"
+  ++ lib.optional withMesa "--with-opengl"
+  ++ lib.optionals stdenv.isDarwin [
+    # allow building on 64-bit
+    "--enable-universal-binaries"
+    "--with-cocoa"
+    "--with-macosx-version-min=10.7"
+  ]
+  ++ lib.optionals withWebKit [
+    "--enable-webview"
+    "--enable-webviewwebkit"
+  ];
+
+  SEARCH_LIB = "${libGLU.out}/lib ${libGL.out}/lib ";
+
+  preConfigure = ''
+    substituteInPlace configure --replace \
+      'SEARCH_INCLUDE=' 'DUMMY_SEARCH_INCLUDE='
+    substituteInPlace configure --replace \
+      'SEARCH_LIB=' 'DUMMY_SEARCH_LIB='
+    substituteInPlace configure --replace \
+      /usr /no-such-path
+  '' + lib.optionalString stdenv.isDarwin ''
+    substituteInPlace configure --replace \
+      'ac_cv_prog_SETFILE="/Developer/Tools/SetFile"' \
+      'ac_cv_prog_SETFILE="${setfile}/bin/SetFile"'
+    substituteInPlace configure --replace \
+      "-framework System" "-lSystem"
+  '';
+
+  postInstall = "
+    pushd $out/include
+    ln -s wx-*/* .
+    popd
+  ";
+
+  enableParallelBuilding = true;
+
+  meta = with lib; {
+    homepage = "https://www.wxwidgets.org/";
+    description = "A Cross-Platform C++ GUI Library";
+    longDescription = ''
+      wxWidgets gives you a single, easy-to-use API for writing GUI applications
+      on multiple platforms that still utilize the native platform's controls
+      and utilities. Link with the appropriate library for your platform and
+      compiler, and your application will adopt the look and feel appropriate to
+      that platform. On top of great GUI functionality, wxWidgets gives you:
+      online help, network programming, streams, clipboard and drag and drop,
+      multithreading, image loading and saving in a variety of popular formats,
+      database support, HTML viewing and printing, and much more.
+    '';
+    license = licenses.wxWindows;
+    maintainers = with maintainers; [ AndersonTorres tfmoraes ];
+    platforms = platforms.unix;
+    badPlatforms = platforms.darwin; # ofBorg is failing, don't know if internal
+  };
+
+  passthru = {
+    inherit gtk;
+    inherit compat28 compat30 unicode;
+  };
+}
diff --git a/pkgs/development/libraries/wxwidgets/3.0/mac.nix b/pkgs/development/libraries/wxwidgets/wxmac30.nix
index e1f732929ce..e1f732929ce 100644
--- a/pkgs/development/libraries/wxwidgets/3.0/mac.nix
+++ b/pkgs/development/libraries/wxwidgets/wxmac30.nix
diff --git a/pkgs/development/libraries/xdg-dbus-proxy/default.nix b/pkgs/development/libraries/xdg-dbus-proxy/default.nix
index 21d6b6fa73e..95373934a47 100644
--- a/pkgs/development/libraries/xdg-dbus-proxy/default.nix
+++ b/pkgs/development/libraries/xdg-dbus-proxy/default.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation rec {
   pname = "xdg-dbus-proxy";
-  version = "0.1.2";
+  version = "0.1.3";
 
   src = fetchurl {
     url = "https://github.com/flatpak/xdg-dbus-proxy/releases/download/${version}/${pname}-${version}.tar.xz";
-    sha256 = "03sj1h0c2l08xa8phw013fnxr4fgav7l2mkjhzf9xk3dykwxcj8p";
+    sha256 = "sha256-A7XSjKh5JT3bvOMQmJCb7MoUleqBGmN3pJLijxbAm5s=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/node-packages/default.nix b/pkgs/development/node-packages/default.nix
index c950ce9e5e9..b308f6128c2 100644
--- a/pkgs/development/node-packages/default.nix
+++ b/pkgs/development/node-packages/default.nix
@@ -359,7 +359,7 @@ let
 
       src = fetchurl {
         url = "https://registry.npmjs.org/prisma/-/prisma-${version}.tgz";
-        sha512 = "sha512-dAld12vtwdz9Rz01nOjmnXe+vHana5PSog8t0XGgLemKsUVsaupYpr74AHaS3s78SaTS5s2HOghnJF+jn91ZrA==";
+        sha512 = "sha512-8SdsLPhKR3mOfoo2o73h9mNn3v5kA/RqGA26Sv6qDS78Eh2uepPqt5e8/nwj5EOblYm5HEGuitaXQrOCLb6uTw==";
       };
       postInstall = with pkgs; ''
         wrapProgram "$out/bin/prisma" \
diff --git a/pkgs/development/python-modules/adafruit-platformdetect/default.nix b/pkgs/development/python-modules/adafruit-platformdetect/default.nix
index 9ed55214b4c..787122157a4 100644
--- a/pkgs/development/python-modules/adafruit-platformdetect/default.nix
+++ b/pkgs/development/python-modules/adafruit-platformdetect/default.nix
@@ -6,13 +6,13 @@
 
 buildPythonPackage rec {
   pname = "adafruit-platformdetect";
-  version = "3.21.0";
+  version = "3.21.1";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "Adafruit-PlatformDetect";
     inherit version;
-    sha256 = "sha256-H65Ar/+9AwhKFNRK/SZyU8XzrMt3myjBo+YNJYtQ0b4=";
+    sha256 = "sha256-gVJUjxsl1rxvboL53186r63yp0k4FtTSgKJuqPzE2Q0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/aiohttp/default.nix b/pkgs/development/python-modules/aiohttp/default.nix
index f96fa882038..f6d9b5d97ec 100644
--- a/pkgs/development/python-modules/aiohttp/default.nix
+++ b/pkgs/development/python-modules/aiohttp/default.nix
@@ -92,7 +92,10 @@ buildPythonPackage rec {
   # Probably because we run `python -m pytest` instead of `pytest` in the hook.
   preCheck = ''
     cd tests
-  '';
+  '' + lib.optionalString stdenv.isDarwin ''
+    # Work around "OSError: AF_UNIX path too long"
+    export TMPDIR="/tmp"
+   '';
 
   meta = with lib; {
     description = "Asynchronous HTTP Client/Server for Python and asyncio";
diff --git a/pkgs/development/python-modules/aiosignal/default.nix b/pkgs/development/python-modules/aiosignal/default.nix
index 1fd619a846a..9d815dfac05 100644
--- a/pkgs/development/python-modules/aiosignal/default.nix
+++ b/pkgs/development/python-modules/aiosignal/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "aiosignal";
-  version = "1.2.0"; # re-enable tests after 1.2.0
+  version = "1.2.0";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     frozenlist
   ];
 
-  # not compatible w ith latest asyncio
-  doCheck = false;
   checkInputs = [
     pytest-asyncio
     pytestCheckHook
@@ -32,6 +30,7 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace pytest.ini \
+      --replace "filterwarnings = error" "" \
       --replace "--cov=aiosignal" ""
   '';
 
diff --git a/pkgs/development/python-modules/androidtv/default.nix b/pkgs/development/python-modules/androidtv/default.nix
index d09daa273b8..80f726bdc18 100644
--- a/pkgs/development/python-modules/androidtv/default.nix
+++ b/pkgs/development/python-modules/androidtv/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "androidtv";
-  version = "0.0.64";
+  version = "0.0.65";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "JeffLIrion";
     repo = "python-androidtv";
     rev = "v${version}";
-    hash = "sha256-CJJ+mWAX9XG1/E2PljUZ8oz/la3hYXF1tMfuKt0Zvjw=";
+    hash = "sha256-bhXmPplRT9gzeD/GdD2HxN+Z4vvaiaxBwkqSml9SJUs=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/async_generator/default.nix b/pkgs/development/python-modules/async_generator/default.nix
index fb7dec6d6ed..6f6da10a87f 100644
--- a/pkgs/development/python-modules/async_generator/default.nix
+++ b/pkgs/development/python-modules/async_generator/default.nix
@@ -1,4 +1,10 @@
-{ lib, buildPythonPackage, fetchPypi, pythonOlder, isPy35, pytest, pytest-asyncio }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+, pytest-asyncio
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "async-generator";
@@ -12,17 +18,17 @@ buildPythonPackage rec {
     sha256 = "6ebb3d106c12920aaae42ccb6f787ef5eefdcdd166ea3d628fa8476abe712144";
   };
 
-  # no longer compatible with pytest-asyncio
-  doCheck = false;
-  checkInputs = [ pytest pytest-asyncio ];
+  checkInputs = [
+    pytest-asyncio
+    pytestCheckHook
+  ];
 
-  checkPhase = ''
-    pytest -W error -ra -v --pyargs async_generator
-  '';
+  pythonImportsCheck = [ "async_generator" ];
 
   meta = with lib; {
     description = "Async generators and context managers for Python 3.5+";
     homepage = "https://github.com/python-trio/async_generator";
     license = with licenses; [ mit asl20 ];
+    maintainers = with maintainers; [ dotlambda ];
   };
 }
diff --git a/pkgs/development/python-modules/awscrt/default.nix b/pkgs/development/python-modules/awscrt/default.nix
index 6bc4c63aefb..fa00971ff25 100644
--- a/pkgs/development/python-modules/awscrt/default.nix
+++ b/pkgs/development/python-modules/awscrt/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "awscrt";
-  version = "0.13.3";
+  version = "0.13.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-1GaKDpOGX/YbM4rByTw0nYgwHYFvOLHZ0GRvanX3vAU=";
+    hash = "sha256-dUNljMKsbl6eByhEYivWgRJczTBw3N1RVl8r3e898mg=";
   };
 
   buildInputs = lib.optionals stdenv.isDarwin [
diff --git a/pkgs/development/python-modules/azure-mgmt-monitor/default.nix b/pkgs/development/python-modules/azure-mgmt-monitor/default.nix
index fae47547cc7..66818ce5b05 100644
--- a/pkgs/development/python-modules/azure-mgmt-monitor/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-monitor/default.nix
@@ -1,22 +1,24 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, isPy3k
+, pythonOlder
 , msrest
 , msrestazure
 , azure-common
 , azure-mgmt-core
-, azure-mgmt-nspkg
 }:
 
 buildPythonPackage rec {
   pname = "azure-mgmt-monitor";
-  version = "3.0.0";
+  version = "3.1.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "91ddb7333bf2b9541a53864cc8d2501e3694a03a9c0e41cbfae3348558675ce6";
+    hash = "sha256-ROcUAm0KgIjO2A2XBpS00IeEPgd8x4cjoMfn6X9C+Gw=";
   };
 
   propagatedBuildInputs = [
@@ -24,13 +26,13 @@ buildPythonPackage rec {
     msrestazure
     azure-common
     azure-mgmt-core
-  ] ++ lib.optionals (!isPy3k) [
-    azure-mgmt-nspkg
   ];
 
-  pythonNamespaces = [ "azure.mgmt" ];
+  pythonNamespaces = [
+    "azure.mgmt"
+  ];
 
-  # has no tests
+  # Module has no tests
   doCheck = false;
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/black/default.nix b/pkgs/development/python-modules/black/default.nix
index 13f05fa6136..064fe8187ed 100644
--- a/pkgs/development/python-modules/black/default.nix
+++ b/pkgs/development/python-modules/black/default.nix
@@ -1,8 +1,12 @@
-{ stdenv, lib
-, buildPythonPackage, fetchPypi, pythonOlder, setuptools-scm, pytestCheckHook
+{ stdenv
+, lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+, setuptools-scm
+, pytestCheckHook
 , aiohttp
 , aiohttp-cors
-, attrs
 , click
 , colorama
 , dataclasses
@@ -19,13 +23,13 @@
 
 buildPythonPackage rec {
   pname = "black";
-  version = "21.12b0";
+  version = "22.1.0";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-d7gPaTpWni5SeVhFljTxjfmwuiYluk4MLV2lvkLm8rM=";
+    hash = "sha256-p8AZLTVjX2/BF0vldct5FekuXdYp7nn9rw3PpBqAr7U=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
@@ -61,17 +65,15 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     aiohttp
     aiohttp-cors
-    attrs
     click
     colorama
     mypy-extensions
     pathspec
     platformdirs
     tomli
-    typed-ast # required for tests and python2 extra
     uvloop
-  ] ++ lib.optional (pythonOlder "3.7") dataclasses
-    ++ lib.optional (pythonOlder "3.8") typing-extensions;
+  ] ++ lib.optional (pythonOlder "3.8") typed-ast
+  ++ lib.optional (pythonOlder "3.10") typing-extensions;
 
   meta = with lib; {
     description = "The uncompromising Python code formatter";
diff --git a/pkgs/development/python-modules/bumps/default.nix b/pkgs/development/python-modules/bumps/default.nix
index 6e0637d2a6b..d1926c9631a 100644
--- a/pkgs/development/python-modules/bumps/default.nix
+++ b/pkgs/development/python-modules/bumps/default.nix
@@ -1,24 +1,37 @@
-{ lib, buildPythonPackage, fetchPypi, six}:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+, six
+}:
 
 buildPythonPackage rec {
   pname = "bumps";
-  version = "0.8.1";
+  version = "0.9.0";
+  format = "setuptools";
 
-  propagatedBuildInputs = [six];
-
-  # Bumps does not provide its own tests.py, so the test
-  # always fails
-  doCheck = false;
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f4f2ee712a1e468a2ce5c0a32f67739a83331f0cb7b9c50b9e7510daefc12169";
+    hash = "sha256-BY9kg0ksKfrpQgsl1aDDJJ+zKJmURqwTtKxlITxse+o=";
   };
 
+  propagatedBuildInputs = [
+    six
+  ];
+
+  # Module has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "bumps"
+  ];
+
   meta = with lib; {
-    homepage = "https://www.reflectometry.org/danse/software.html";
     description = "Data fitting with bayesian uncertainty analysis";
-    maintainers = with maintainers; [ rprospero ];
+    homepage = "https://bumps.readthedocs.io/";
     license = licenses.publicDomain;
+    maintainers = with maintainers; [ rprospero ];
   };
 }
diff --git a/pkgs/development/python-modules/cchardet/default.nix b/pkgs/development/python-modules/cchardet/default.nix
index e1c27d9e4fb..587d0d1f6c1 100644
--- a/pkgs/development/python-modules/cchardet/default.nix
+++ b/pkgs/development/python-modules/cchardet/default.nix
@@ -1,4 +1,5 @@
 { lib
+, stdenv
 , buildPythonPackage
 , fetchPypi
 , python
@@ -20,9 +21,14 @@ buildPythonPackage rec {
 
   checkInputs = [ nose ];
 
+  # on non x86-64 some charsets are identified as their superset, so we skip these tests (last checked with version 2.1.7)
   preCheck = ''
     cp -R src/tests $TMPDIR
     pushd $TMPDIR
+  '' + lib.optionalString (stdenv.hostPlatform.system != "x86_64-linux") ''
+    rm $TMPDIR/tests/testdata/th/tis-620.txt  # identified as iso-8859-11, which is fine for all practical purposes
+    rm $TMPDIR/tests/testdata/ga/iso-8859-1.txt  # identified as windows-1252, which is fine for all practical purposes
+    rm $TMPDIR/tests/testdata/fi/iso-8859-1.txt  # identified as windows-1252, which is fine for all practical purposes
   '';
 
   checkPhase = ''
diff --git a/pkgs/development/python-modules/charset-normalizer/default.nix b/pkgs/development/python-modules/charset-normalizer/default.nix
index ba7dd1db3b9..d406ea15fbd 100644
--- a/pkgs/development/python-modules/charset-normalizer/default.nix
+++ b/pkgs/development/python-modules/charset-normalizer/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "charset-normalizer";
-  version = "2.0.10";
+  version = "2.0.12";
   format = "setuptools";
 
   disabled = pythonOlder "3.5";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "Ousret";
     repo = "charset_normalizer";
     rev = version;
-    hash = "sha256-QsUqrC2oycvyCbOzGmHahgNi40YZ0sujb3Cj8EnsGS8=";
+    hash = "sha256-d5vWnZtFR669l1Meg4ZSsYIyBlJZya7SpXJMx2AP8NU=";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/check-manifest/default.nix b/pkgs/development/python-modules/check-manifest/default.nix
index 608f3a0cac6..d55f5155b45 100644
--- a/pkgs/development/python-modules/check-manifest/default.nix
+++ b/pkgs/development/python-modules/check-manifest/default.nix
@@ -8,22 +8,21 @@
 , pep517
 , pytestCheckHook
 , toml
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "check-manifest";
   version = "0.47";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "56dadd260a9c7d550b159796d2894b6d0bcc176a94cbc426d9bb93e5e48d12ce";
+    hash = "sha256-VtrdJgqcfVULFZeW0olLbQvMF2qUy8Qm2buT5eSNEs4=";
   };
 
-  # Test requires filesystem access
-  postPatch = ''
-    substituteInPlace tests.py --replace "test_build_sdist" "no_test_build_sdist"
-  '';
-
   propagatedBuildInputs = [
     build
     pep517
@@ -37,11 +36,18 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  pythonImportsCheck = [ "check_manifest" ];
+  disabledTests = [
+    # Test wants to setup a venv
+    "test_build_sdist_pep517_isolated"
+  ];
+
+  pythonImportsCheck = [
+    "check_manifest"
+  ];
 
   meta = with lib; {
-    homepage = "https://github.com/mgedmin/check-manifest";
     description = "Check MANIFEST.in in a Python source package for completeness";
+    homepage = "https://github.com/mgedmin/check-manifest";
     license = licenses.mit;
     maintainers = with maintainers; [ lewo ];
   };
diff --git a/pkgs/development/python-modules/cloudscraper/default.nix b/pkgs/development/python-modules/cloudscraper/default.nix
index cd11aa03f86..6f693f369cd 100644
--- a/pkgs/development/python-modules/cloudscraper/default.nix
+++ b/pkgs/development/python-modules/cloudscraper/default.nix
@@ -1,6 +1,6 @@
 { lib
 , buildPythonPackage
-, isPy3k
+, pythonOlder
 , fetchPypi
 , requests
 , requests-toolbelt
@@ -9,12 +9,14 @@
 
 buildPythonPackage rec {
   pname = "cloudscraper";
-  version = "1.2.58";
-  disabled = !isPy3k;
+  version = "1.2.60";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1wnzv2k8cm8q1x18r4zg8pcnpm4gsdp82hywwjimp2v2qll918nx";
+    hash = "sha256-DTQTsv/59895UTsMmqxYtSfFosUWPRx8wMT4zKHQ9Oc=";
   };
 
   propagatedBuildInputs = [
@@ -27,10 +29,12 @@ buildPythonPackage rec {
   # nixpkgs yet, and also aren't included in the PyPI bundle.  TODO.
   doCheck = false;
 
-  pythonImportsCheck = [ "cloudscraper" ];
+  pythonImportsCheck = [
+    "cloudscraper"
+  ];
 
   meta = with lib; {
-    description = "A Python module to bypass Cloudflare's anti-bot page";
+    description = "Python module to bypass Cloudflare's anti-bot page";
     homepage = "https://github.com/venomous/cloudscraper";
     license = licenses.mit;
     maintainers = with maintainers; [ kini ];
diff --git a/pkgs/development/python-modules/django-picklefield/default.nix b/pkgs/development/python-modules/django-picklefield/default.nix
index 4710de2c7ec..b1dab2e73c9 100644
--- a/pkgs/development/python-modules/django-picklefield/default.nix
+++ b/pkgs/development/python-modules/django-picklefield/default.nix
@@ -1,8 +1,9 @@
-{ lib, buildPythonPackage, fetchFromGitHub, django, pytest, pytest-django }:
+{ lib, buildPythonPackage, fetchFromGitHub, django, pytest, pytest-django, python }:
 
 buildPythonPackage rec {
   pname = "django-picklefield";
   version = "3.0.1";
+  format = "setuptools";
 
   # The PyPi source doesn't contain tests
   src = fetchFromGitHub {
@@ -14,17 +15,20 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ django ];
 
-  checkInputs = [ pytest pytest-django ];
+  # Tests are failing with Django 3.2
+  # https://github.com/gintas/django-picklefield/issues/58
+  doCheck = false;
 
   checkPhase = ''
-    PYTHONPATH="$(pwd):$PYTHONPATH" \
-    DJANGO_SETTINGS_MODULE=tests.settings \
-      pytest tests/tests.py
+    runHook preCheck
+    ${python.interpreter} -m django test --settings=tests.settings
+    runHook postCheck
   '';
 
-  meta = {
+  meta = with lib; {
     description = "A pickled object field for Django";
     homepage = "https://github.com/gintas/django-picklefield";
-    license = lib.licenses.mit;
+    license = licenses.mit;
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/django/2.nix b/pkgs/development/python-modules/django/2.nix
index c4df27beaaa..727bf304fdb 100644
--- a/pkgs/development/python-modules/django/2.nix
+++ b/pkgs/development/python-modules/django/2.nix
@@ -5,13 +5,14 @@
 }:
 
 buildPythonPackage rec {
-  pname = "Django";
+  pname = "django";
   version = "2.2.27";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "Django";
+    inherit version;
     sha256 = "sha256-HuNwRrC/K2HoOzoB0GcyNRbsO28rF81JsTJt1LqdyRM=";
   };
 
diff --git a/pkgs/development/python-modules/django/3.nix b/pkgs/development/python-modules/django/3.nix
index 3ed7024c349..1538b8a82b4 100644
--- a/pkgs/development/python-modules/django/3.nix
+++ b/pkgs/development/python-modules/django/3.nix
@@ -12,13 +12,14 @@
 }:
 
 buildPythonPackage rec {
-  pname = "Django";
+  pname = "django";
   version = "3.2.12";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "Django";
+    inherit version;
     sha256 = "sha256-l3Lmk1cD5Z6ZOWCDLWamFM8CM6HFEjvGIk7MataeQeI=";
   };
 
diff --git a/pkgs/development/python-modules/docx2txt/default.nix b/pkgs/development/python-modules/docx2txt/default.nix
new file mode 100644
index 00000000000..6b3c2777d78
--- /dev/null
+++ b/pkgs/development/python-modules/docx2txt/default.nix
@@ -0,0 +1,26 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+}:
+
+buildPythonPackage rec {
+  pname = "docx2txt";
+  version = "0.8";
+  format = "setuptools";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-LAbZjXz+LTlH5XYKV9kk4/8HdFs3nIc3cjki5wCSNuU=";
+  };
+
+  pythonImportsCheck = [
+    "docx2txt"
+  ];
+
+  meta = with lib; {
+    description = "A pure python-based utility to extract text and images from docx files";
+    homepage = "https://github.com/ankushshah89/python-docx2txt";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ilkecan ];
+  };
+}
diff --git a/pkgs/development/python-modules/env-canada/default.nix b/pkgs/development/python-modules/env-canada/default.nix
index 32b3098ffc7..18047eb719a 100644
--- a/pkgs/development/python-modules/env-canada/default.nix
+++ b/pkgs/development/python-modules/env-canada/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "env-canada";
-  version = "0.5.20";
+  version = "0.5.21";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "michaeldavie";
     repo = "env_canada";
     rev = "v${version}";
-    sha256 = "sha256-gYl5+rtOzci3nhgP74VM37tNk9pPWgcNBfcSSG1fSJs=";
+    sha256 = "sha256-jildWpYWll5j7siYhNECMBjz9bF41xFA6NyydWNdgQE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/eventlet/default.nix b/pkgs/development/python-modules/eventlet/default.nix
index 7c8f520647e..096279b3453 100644
--- a/pkgs/development/python-modules/eventlet/default.nix
+++ b/pkgs/development/python-modules/eventlet/default.nix
@@ -57,6 +57,8 @@ buildPythonPackage rec {
     "test_hosts_no_network"
     "test_leakage_from_tracebacks"
     "test_patcher_existing_locks_locked"
+    # broken with pyopenssl 22.0.0
+    "test_sendall_timeout"
   ];
 
   disabledTestPaths = [
diff --git a/pkgs/development/python-modules/frozenlist/default.nix b/pkgs/development/python-modules/frozenlist/default.nix
index 34660645b59..1bc295fbe33 100644
--- a/pkgs/development/python-modules/frozenlist/default.nix
+++ b/pkgs/development/python-modules/frozenlist/default.nix
@@ -8,14 +8,16 @@
 
 buildPythonPackage rec {
   pname = "frozenlist";
-  version = "1.2.0";
-  disabled = pythonOlder "3.6";
+  version = "1.3.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "aio-libs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-rTbekdceC5QK0aiySi/4QUwaEoDfTlLrx2t6Kb9bH7U=";
+    hash = "sha256-cHKqkvsBUN7If+8swbd6aafFrSgnop3YlweBLPOHzyU=";
   };
 
   nativeBuildInputs = [
@@ -35,7 +37,9 @@ buildPythonPackage rec {
     cython frozenlist/_frozenlist.pyx
   '';
 
-  pythonImportsCheck = [ "frozenlist" ];
+  pythonImportsCheck = [
+    "frozenlist"
+  ];
 
   meta = with lib; {
     description = "Python module for list-like structure";
diff --git a/pkgs/development/python-modules/google-cloud-redis/default.nix b/pkgs/development/python-modules/google-cloud-redis/default.nix
index fc1ca312125..ab432454bba 100644
--- a/pkgs/development/python-modules/google-cloud-redis/default.nix
+++ b/pkgs/development/python-modules/google-cloud-redis/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-redis";
-  version = "2.7.1";
+  version = "2.8.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-tz2upcRjgE6/4cB0riARwot3Vhw4QSKqqHTlJS3i7is=";
+    hash = "sha256-7L3SjViQmzTp//5LWWG9VG+TQuPay70KZdUuzhy7HS0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-storage/default.nix b/pkgs/development/python-modules/google-cloud-storage/default.nix
index bce21410209..629c323506b 100644
--- a/pkgs/development/python-modules/google-cloud-storage/default.nix
+++ b/pkgs/development/python-modules/google-cloud-storage/default.nix
@@ -9,15 +9,19 @@
 , google-cloud-testutils
 , google-resumable-media
 , mock
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-storage";
-  version = "2.2.0";
+  version = "2.2.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-01mWgBE11R20m7j3p+Kc7cwlqotDXu0MTA7y+e5W0dk=";
+    hash = "sha256-AkT0YScQy17ERfxndDh1ZOI/mCM2P7QIsock4hAkAbc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/importlib-metadata/default.nix b/pkgs/development/python-modules/importlib-metadata/default.nix
index 13b26e337ac..3917742a55a 100644
--- a/pkgs/development/python-modules/importlib-metadata/default.nix
+++ b/pkgs/development/python-modules/importlib-metadata/default.nix
@@ -10,15 +10,15 @@
 
 buildPythonPackage rec {
   pname = "importlib-metadata";
-  version = "4.10.1";
-  format = "setuptools";
+  version = "4.11.0";
+  format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "importlib_metadata";
     inherit version;
-    hash = "sha256-lR8NiltyYOnbXkHUKShbX0UekoR58Z2AgYh4Un026V4=";
+    hash = "sha256-nl5VO7uhhDy0oAgjAUuQdha+Ru5QPSuboAHSFKjaIY8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/iniconfig/default.nix b/pkgs/development/python-modules/iniconfig/default.nix
index 90761f76f9d..a8a4a611fee 100644
--- a/pkgs/development/python-modules/iniconfig/default.nix
+++ b/pkgs/development/python-modules/iniconfig/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchPypi }:
+{ lib, buildPythonPackage, fetchPypi, setuptools-scm }:
 
 buildPythonPackage rec {
   pname = "iniconfig";
@@ -9,12 +9,14 @@ buildPythonPackage rec {
     sha256 = "bc3af051d7d14b2ee5ef9969666def0cd1a000e121eaea580d4a313df4b37f32";
   };
 
+  nativeBuildInputs = [ setuptools-scm ];
+
   doCheck = false; # avoid circular import with pytest
   pythonImportsCheck = [ "iniconfig" ];
 
   meta = with lib; {
     description = "brain-dead simple parsing of ini files";
-    homepage = "https://github.com/RonnyPfannschmidt/iniconfig";
+    homepage = "https://github.com/pytest-dev/iniconfig";
     license = licenses.mit;
     maintainers = with maintainers; [ jonringer ];
   };
diff --git a/pkgs/development/python-modules/intellifire4py/default.nix b/pkgs/development/python-modules/intellifire4py/default.nix
index 329d7a77dfd..39fcec9af12 100644
--- a/pkgs/development/python-modules/intellifire4py/default.nix
+++ b/pkgs/development/python-modules/intellifire4py/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "intellifire4py";
-  version = "1.0.0";
+  version = "1.0.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "jeeftor";
     repo = pname;
     rev = version;
-    hash = "sha256-lQV5KpASbrz+wCi9x/0rNYrQE+dLCZzsNBFhYAQvPH4=";
+    hash = "sha256-hKe9sDn5t2qQ0THqFQypAGgr7cJXaZs8562NpPR/iJU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/ipython/default.nix b/pkgs/development/python-modules/ipython/default.nix
index 432f83e75cc..c1c0b049dc8 100644
--- a/pkgs/development/python-modules/ipython/default.nix
+++ b/pkgs/development/python-modules/ipython/default.nix
@@ -26,7 +26,7 @@
 , testpath
 }:
 
-buildPythonPackage (rec {
+buildPythonPackage rec {
   pname = "ipython";
   version = "8.0.1";
   format = "pyproject";
@@ -76,14 +76,15 @@ buildPythonPackage (rec {
     testpath
   ];
 
+  disabledTests = lib.optionals (stdenv.isDarwin) [
+    # FileNotFoundError: [Errno 2] No such file or directory: 'pbpaste'
+    "test_clipboard_get"
+  ];
+
   meta = with lib; {
     description = "IPython: Productive Interactive Computing";
     homepage = "http://ipython.org/";
     license = licenses.bsd3;
     maintainers = with maintainers; [ bjornfor fridh ];
   };
-} // lib.optionalAttrs stdenv.isDarwin {
-  disabledTests = [
-    "test_clipboard_get" # uses pbpaste
-  ];
-})
+}
diff --git a/pkgs/development/python-modules/jedi/default.nix b/pkgs/development/python-modules/jedi/default.nix
index d9884ab3d9f..f271920706f 100644
--- a/pkgs/development/python-modules/jedi/default.nix
+++ b/pkgs/development/python-modules/jedi/default.nix
@@ -3,9 +3,7 @@
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
-, colorama
 , django
-, docopt
 , pytestCheckHook
 , parso
 }:
@@ -26,9 +24,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [ parso ];
 
   checkInputs = [
-    colorama
     django
-    docopt
     pytestCheckHook
   ];
 
@@ -50,7 +46,7 @@ buildPythonPackage rec {
   meta = with lib; {
     homepage = "https://github.com/davidhalter/jedi";
     description = "An autocompletion tool for Python that can be used for text editors";
-    license = licenses.lgpl3Plus;
+    license = licenses.mit;
     maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/mdformat/default.nix b/pkgs/development/python-modules/mdformat/default.nix
index 1ab425ade55..23bef4bda40 100644
--- a/pkgs/development/python-modules/mdformat/default.nix
+++ b/pkgs/development/python-modules/mdformat/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "mdformat";
-  version = "0.7.13";
+  version = "0.7.14";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "executablebooks";
     repo = pname;
     rev = version;
-    sha256 = "sha256-9ssDe7Wjuwuq2j7xwRyLqKouqeIt6NCUbEXjPdu2VZ8=";
+    sha256 = "sha256-bImBW6r8g/4MQ9yNrBBhk7AGqKRXFyAew6HHEmqelxw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/meshtastic/default.nix b/pkgs/development/python-modules/meshtastic/default.nix
index 9a7c834c0ef..1972ae0ff5d 100644
--- a/pkgs/development/python-modules/meshtastic/default.nix
+++ b/pkgs/development/python-modules/meshtastic/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "meshtastic";
-  version = "1.2.90";
+  version = "1.2.92";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "meshtastic";
     repo = "Meshtastic-python";
     rev = version;
-    sha256 = "sha256-n/M1Q6YS3EkUcn45ffiTy0wuj9yKf6qBLLfD2XJkhHU=";
+    sha256 = "sha256-tK711Lewr5Zc6dy/cDe9UEnq9zOEvuJg4mZyO3zBLR0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/moto/default.nix b/pkgs/development/python-modules/moto/default.nix
index a998e7b74b4..1d9d0774379 100644
--- a/pkgs/development/python-modules/moto/default.nix
+++ b/pkgs/development/python-modules/moto/default.nix
@@ -264,6 +264,8 @@ buildPythonPackage rec {
     "test_state_machine_creation_fails_with_invalid_names"
     # needs graphql
     "test_get_schema_creation_status"
+    # only appears in aarch64 currently, but best to be safe
+    "test_state_machine_list_executions_with_filter"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/nassl/default.nix b/pkgs/development/python-modules/nassl/default.nix
index b9e19439251..3e159dfe7ce 100644
--- a/pkgs/development/python-modules/nassl/default.nix
+++ b/pkgs/development/python-modules/nassl/default.nix
@@ -9,6 +9,7 @@
 , tls-parser
 , cacert
 , pytestCheckHook
+, pythonAtLeast
 , pythonOlder
 }:
 
@@ -50,9 +51,11 @@ let
         "enable-tls1_3"
         "no-async"
       ];
-      patches = builtins.filter (
-        p: (builtins.baseNameOf (toString p)) != "macos-yosemite-compat.patch"
-      ) oldAttrs.patches;
+      patches = builtins.filter
+        (
+          p: (builtins.baseNameOf (toString p)) != "macos-yosemite-compat.patch"
+        )
+        oldAttrs.patches;
       buildInputs = oldAttrs.buildInputs ++ [ zlibStatic cacert ];
       meta = oldAttrs.meta // {
         knownVulnerabilities = [
@@ -76,9 +79,11 @@ let
         sha256 = "1zqb1rff1wikc62a7vj5qxd1k191m8qif5d05mwdxz2wnzywlg72";
       };
       configureFlags = oldAttrs.configureFlags ++ nasslOpensslFlagsCommon;
-      patches = builtins.filter (
-        p: (builtins.baseNameOf (toString p)) == "darwin64-arm64.patch"
-      ) oldAttrs.patches;
+      patches = builtins.filter
+        (
+          p: (builtins.baseNameOf (toString p)) == "darwin64-arm64.patch"
+        )
+        oldAttrs.patches;
       buildInputs = oldAttrs.buildInputs ++ [ zlibStatic ];
       # openssl_1_0_2 needs `withDocs = false`
       outputs = lib.remove "doc" oldAttrs.outputs;
@@ -87,42 +92,54 @@ let
 in
 buildPythonPackage rec {
   pname = "nassl";
-  version = "4.0.1";
+  version = "4.0.2";
+  format = "setuptools";
+
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "nabla-c0d3";
     repo = pname;
     rev = version;
-    hash = "sha256-QzO7ABh2weBO6NVFIj7kZpS8ashbDGompuvdKteJeUc=";
+    hash = "sha256-lLyHXLmBVvT+LgsKBU8DcUXd0qaLSrwvXxFnIB9CHcU=";
   };
 
-  postPatch = let
-    legacyOpenSSLVersion = lib.replaceStrings ["."] ["_"] opensslLegacyStatic.version;
-    modernOpenSSLVersion = lib.replaceStrings ["."] ["_"] opensslStatic.version;
-    zlibVersion = zlibStatic.version;
-  in ''
-    mkdir -p deps/openssl-OpenSSL_${legacyOpenSSLVersion}/
-    cp ${opensslLegacyStatic.out}/lib/libssl.a \
-      ${opensslLegacyStatic.out}/lib/libcrypto.a \
-      deps/openssl-OpenSSL_${legacyOpenSSLVersion}/
-    ln -s ${opensslLegacyStatic.out.dev}/include deps/openssl-OpenSSL_${legacyOpenSSLVersion}/include
-    ln -s ${opensslLegacyStatic.bin}/bin deps/openssl-OpenSSL_${legacyOpenSSLVersion}/apps
+  postPatch =
+    let
+      legacyOpenSSLVersion = lib.replaceStrings [ "." ] [ "_" ] opensslLegacyStatic.version;
+      modernOpenSSLVersion = lib.replaceStrings [ "." ] [ "_" ] opensslStatic.version;
+      zlibVersion = zlibStatic.version;
+    in
+    ''
+      mkdir -p deps/openssl-OpenSSL_${legacyOpenSSLVersion}/
+      cp ${opensslLegacyStatic.out}/lib/libssl.a \
+        ${opensslLegacyStatic.out}/lib/libcrypto.a \
+        deps/openssl-OpenSSL_${legacyOpenSSLVersion}/
+      ln -s ${opensslLegacyStatic.out.dev}/include deps/openssl-OpenSSL_${legacyOpenSSLVersion}/include
+      ln -s ${opensslLegacyStatic.bin}/bin deps/openssl-OpenSSL_${legacyOpenSSLVersion}/apps
 
-    mkdir -p deps/openssl-OpenSSL_${modernOpenSSLVersion}/
-    cp ${opensslStatic.out}/lib/libssl.a \
-      ${opensslStatic.out}/lib/libcrypto.a \
-      deps/openssl-OpenSSL_${modernOpenSSLVersion}/
-    ln -s ${opensslStatic.out.dev}/include deps/openssl-OpenSSL_${modernOpenSSLVersion}/include
-    ln -s ${opensslStatic.bin}/bin deps/openssl-OpenSSL_${modernOpenSSLVersion}/apps
+      mkdir -p deps/openssl-OpenSSL_${modernOpenSSLVersion}/
+      cp ${opensslStatic.out}/lib/libssl.a \
+        ${opensslStatic.out}/lib/libcrypto.a \
+        deps/openssl-OpenSSL_${modernOpenSSLVersion}/
+      ln -s ${opensslStatic.out.dev}/include deps/openssl-OpenSSL_${modernOpenSSLVersion}/include
+      ln -s ${opensslStatic.bin}/bin deps/openssl-OpenSSL_${modernOpenSSLVersion}/apps
 
-    mkdir -p deps/zlib-${zlibVersion}/
-    cp ${zlibStatic.out}/lib/libz.a deps/zlib-${zlibVersion}/
-  '';
+      mkdir -p deps/zlib-${zlibVersion}/
+      cp ${zlibStatic.out}/lib/libz.a deps/zlib-${zlibVersion}/
+    '';
 
-  propagatedBuildInputs = [ tls-parser ];
+  nativeBuildInputs = [
+    invoke
+  ];
+
+  propagatedBuildInputs = [
+    tls-parser
+  ];
 
-  nativeBuildInputs = [ invoke ];
+  checkInputs = [
+    pytestCheckHook
+  ];
 
   buildPhase = ''
     invoke build.nassl
@@ -131,19 +148,23 @@ buildPythonPackage rec {
 
   doCheck = true;
 
-  pythonImportsCheck = [ "nassl" ];
-
-  checkInputs = [ pytestCheckHook ];
+  pythonImportsCheck = [
+    "nassl"
+  ];
 
   disabledTests = [
     "Online"
+  ] ++ lib.optionals (pythonAtLeast "3.10") [
+    "test_write_bad"
+    "test_client_authentication_no_certificate_supplied"
+    "test_client_authentication_succeeds"
   ];
 
   meta = with lib; {
+    description = "Low-level OpenSSL wrapper for Python";
     homepage = "https://github.com/nabla-c0d3/nassl";
-    description = "Low-level OpenSSL wrapper for Python 3.7+";
-    platforms = with platforms; linux ++ darwin;
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ veehaitch ];
+    platforms = with platforms; linux ++ darwin;
   };
 }
diff --git a/pkgs/development/python-modules/neo4j-driver/default.nix b/pkgs/development/python-modules/neo4j-driver/default.nix
index 6b81af0c294..63a2efafbd6 100644
--- a/pkgs/development/python-modules/neo4j-driver/default.nix
+++ b/pkgs/development/python-modules/neo4j-driver/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "neo4j-driver";
-  version = "4.4.1";
+  version = "4.4.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "neo4j";
     repo = "neo4j-python-driver";
     rev = version;
-    sha256 = "sha256-aGOqD6mmd3dulQ/SdaDPDZhkCwXdYCucHw+CrkJf1M0=";
+    sha256 = "sha256-rYedmxQvT+RjVdbDckLv00J4YuEQtMuIc8Q5FGWr3Rw=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pbr/default.nix b/pkgs/development/python-modules/pbr/default.nix
index 8775faa53c2..7a03226b4dd 100644
--- a/pkgs/development/python-modules/pbr/default.nix
+++ b/pkgs/development/python-modules/pbr/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "pbr";
-  version = "5.8.0";
+  version = "5.8.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "672d8ebee84921862110f23fcec2acea191ef58543d34dfe9ef3d9f13c31cddf";
+    sha256 = "sha256-ZrxaNJEvQIuzklvyEjHLb1kgYme39j81A++GXBopLiU=";
   };
 
   propagatedBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/pbr/tests.nix b/pkgs/development/python-modules/pbr/tests.nix
index b31334589f5..aacb726d6a1 100644
--- a/pkgs/development/python-modules/pbr/tests.nix
+++ b/pkgs/development/python-modules/pbr/tests.nix
@@ -1,8 +1,8 @@
 { buildPythonPackage
+, build
 , git
 , gnupg
 , pbr
-, mock
 , sphinx
 , stestr
 , testresources
@@ -27,9 +27,9 @@ buildPythonPackage rec {
 
   checkInputs = [
     pbr
+    build
     git
     gnupg
-    mock
     sphinx
     stestr
     testresources
diff --git a/pkgs/development/python-modules/pillow/default.nix b/pkgs/development/python-modules/pillow/default.nix
index c1df3ce2751..8aa1ad1f4c4 100644
--- a/pkgs/development/python-modules/pillow/default.nix
+++ b/pkgs/development/python-modules/pillow/default.nix
@@ -7,13 +7,13 @@
 
 import ./generic.nix (rec {
   pname = "Pillow";
-  version = "9.0.0";
+  version = "9.0.1";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0gjry0yqryd2678sm47jhdnbghzxn5wk8pgyaqwr4qi7x5ijjvpf";
+    sha256 = "bIvII4p9/a96dfXsWmY/QXP4w2flo5+H5yBJXh7tdfo=";
   };
 
   passthru.tests = {
diff --git a/pkgs/development/python-modules/platformdirs/default.nix b/pkgs/development/python-modules/platformdirs/default.nix
index f2e86599148..2be8928f630 100644
--- a/pkgs/development/python-modules/platformdirs/default.nix
+++ b/pkgs/development/python-modules/platformdirs/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "platformdirs";
-  version = "2.4.1";
+  version = "2.5.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "sha256-Ce1dwE2g/7o91NPkmlM0uv0eMB7WzFCExV/8ZCAn22Y=";
+    sha256 = "sha256-fppwtY8VX8IQ96H930xItO7mS8LlxxHgBcKlwIL5P2E=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/proxmoxer/default.nix b/pkgs/development/python-modules/proxmoxer/default.nix
index 125984554a0..33b233bd609 100644
--- a/pkgs/development/python-modules/proxmoxer/default.nix
+++ b/pkgs/development/python-modules/proxmoxer/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "proxmoxer";
-  version = "1.2.0";
+  version = "1.3.0";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "sha256-ElHocXrazwK+b5vdjYSJAYB4ajs2n+V8koj4QKkdDMQ=";
+    sha256 = "sha256-3EpId20WVVjXA/wxwy1peyHPcXdiT3fprABkcNBpZtE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyaussiebb/default.nix b/pkgs/development/python-modules/pyaussiebb/default.nix
index 63edd6e60f8..9788860cdd6 100644
--- a/pkgs/development/python-modules/pyaussiebb/default.nix
+++ b/pkgs/development/python-modules/pyaussiebb/default.nix
@@ -3,6 +3,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , loguru
+, pydantic
 , poetry-core
 , pythonOlder
 , requests
@@ -10,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pyaussiebb";
-  version = "0.0.11";
+  version = "0.0.12";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -19,7 +20,7 @@ buildPythonPackage rec {
     owner = "yaleman";
     repo = "aussiebb";
     rev = "v${version}";
-    hash = "sha256-aL+n2ut7n6UUyymMEHoFMhRvK9iFRRunYE9ZirKFXhc=";
+    hash = "sha256-4B+eq863G+iVl8UnxDumPVpkj9W8kX5LK0wo4QIYo4w=";
   };
 
   nativeBuildInputs = [
@@ -30,6 +31,7 @@ buildPythonPackage rec {
     aiohttp
     requests
     loguru
+    pydantic
   ];
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pycep-parser/default.nix b/pkgs/development/python-modules/pycep-parser/default.nix
index f286e6b45bd..d76f72630a6 100644
--- a/pkgs/development/python-modules/pycep-parser/default.nix
+++ b/pkgs/development/python-modules/pycep-parser/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "pycep-parser";
-  version = "0.3.1";
+  version = "0.3.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "gruebel";
     repo = "pycep";
     rev = version;
-    hash = "sha256-S4jBqMgyreWrEp1SuR8J5RVFc+i1O0xbfgux1UvFP5k=";
+    hash = "sha256-ud26xJQWdu7wtv75/K16HSSw0MvaSr3H1hDZBPjSzYE=";
   };
 
   nativeBuildInputs = [
@@ -41,7 +41,7 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace 'version = "0.3.1-alpha.1"' 'version = "${version}"' \
+      --replace 'version = "0.3.2-alpha.4"' 'version = "${version}"' \
       --replace 'regex = "^2022.3.2"' 'regex = "*"'
   '';
 
diff --git a/pkgs/development/python-modules/pycryptodome/default.nix b/pkgs/development/python-modules/pycryptodome/default.nix
index 44e7ed0ad4a..e3e4e6c3a03 100644
--- a/pkgs/development/python-modules/pycryptodome/default.nix
+++ b/pkgs/development/python-modules/pycryptodome/default.nix
@@ -6,13 +6,12 @@
 
 buildPythonPackage rec {
   pname = "pycryptodome";
-  version = "3.12.0";
+  version = "3.14.1";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Esc0OuxaOz31xHJlKBsSthHybsk2e2EpGZ1n2lS3aME=";
-    extension = "zip";
+    hash = "sha256-4E5Ap/jBZpGVU2o3l53YfaLDLb3HPW/jXwB3sMF8gDs=";
   };
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/pycryptodomex/default.nix b/pkgs/development/python-modules/pycryptodomex/default.nix
index c9f622d6c69..934c021ed90 100644
--- a/pkgs/development/python-modules/pycryptodomex/default.nix
+++ b/pkgs/development/python-modules/pycryptodomex/default.nix
@@ -6,13 +6,12 @@
 
 buildPythonPackage rec {
   pname = "pycryptodomex";
-  version = "3.12.0";
+  version = "3.14.1";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ki6drAFm5GF+XHmA0s/2kSputctcE+fs4iJDhlC9f2Y=";
-    extension = "zip";
+    hash = "sha256-LOdu0Agf1qyMdO3HW50U7KIGQXOveYQ8JPpiVzJjwfI=";
   };
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/pyinfra/default.nix b/pkgs/development/python-modules/pyinfra/default.nix
new file mode 100644
index 00000000000..ce489127946
--- /dev/null
+++ b/pkgs/development/python-modules/pyinfra/default.nix
@@ -0,0 +1,60 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+, gevent
+, click
+, colorama
+, configparser
+, distro
+, jinja2
+, paramiko
+, python-dateutil
+, pywinrm
+, setuptools
+, six
+}:
+
+buildPythonPackage rec {
+  pname = "pyinfra";
+  version = "1.7";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-r+7ka3WKE6uHP//p1N71hgTGit7Eo3x9INpbKPYbFMI=";
+  };
+
+  propagatedBuildInputs = [
+    click
+    colorama
+    configparser
+    distro
+    gevent
+    jinja2
+    paramiko
+    python-dateutil
+    pywinrm
+    setuptools
+    six
+  ];
+
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "pyinfra"
+  ];
+
+  meta = with lib; {
+    description = "Python-based infrastructure automation";
+    longDescription = ''
+      pyinfra automates/provisions/manages/deploys infrastructure. It can be used for
+      ad-hoc command execution, service deployment, configuration management and more.
+    '';
+    homepage = "https://github.com/Fizzadar/pyinfra";
+    maintainers = with maintainers; [ totoroot ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/development/python-modules/pykrakenapi/default.nix b/pkgs/development/python-modules/pykrakenapi/default.nix
index 41efa9a54d2..a064390b1ce 100644
--- a/pkgs/development/python-modules/pykrakenapi/default.nix
+++ b/pkgs/development/python-modules/pykrakenapi/default.nix
@@ -7,13 +7,13 @@
 
 buildPythonPackage rec {
   pname = "pykrakenapi";
-  version = "0.2.4";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "dominiktraxl";
     repo = "pykrakenapi";
     rev = "v${version}";
-    hash = "sha256-i2r6t+JcL6INI8Y26gvVvNjv6XxMj4G+pF9Xf/hsx1A=";
+    hash = "sha256-ZhP4TEWFEGIqI/nk2It1IVFKrX4HKP+dWxu+gLJNIeg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyopenssl/default.nix b/pkgs/development/python-modules/pyopenssl/default.nix
index 16bfddc8340..e4655082af9 100644
--- a/pkgs/development/python-modules/pyopenssl/default.nix
+++ b/pkgs/development/python-modules/pyopenssl/default.nix
@@ -6,17 +6,50 @@
 , cryptography
 , pyasn1
 , idna
-, pytest
+, pytestCheckHook
 , pretend
 , flaky
 , glibcLocales
 , six
 }:
 
-let
-  # https://github.com/pyca/pyopenssl/issues/791
-  # These tests, we disable in the case that libressl is passed in as openssl.
-  failingLibresslTests = [
+buildPythonPackage rec {
+  pname = "pyopenssl";
+  version = "22.0.0";
+
+  src = fetchPypi {
+    pname = "pyOpenSSL";
+    inherit version;
+    sha256 = "sha256-ZgsbFCWqxKG+odlBaKhdmfCzFEyGndQ5DSdinQCH8b8=";
+  };
+
+  outputs = [ "out" "dev" ];
+
+  # Seems to fail unpredictably on Darwin. See https://hydra.nixos.org/build/49877419/nixlog/1
+  # for one example, but I've also seen ContextTests.test_set_verify_callback_exception fail.
+  doCheck = !stdenv.isDarwin;
+
+  nativeBuildInputs = [ openssl ];
+  propagatedBuildInputs = [ cryptography pyasn1 idna six ];
+
+  checkInputs = [ pytestCheckHook pretend flaky glibcLocales ];
+
+  preCheck = ''
+    export LANG="en_US.UTF-8"
+  '';
+
+  disabledTests = [
+    # https://github.com/pyca/pyopenssl/issues/692
+    # These tests, we disable always.
+    "test_set_default_verify_paths"
+    "test_fallback_default_verify_paths"
+    # https://github.com/pyca/pyopenssl/issues/768
+    "test_wantWriteError"
+    # https://github.com/pyca/pyopenssl/issues/1043
+    "test_alpn_call_failure"
+  ] ++ lib.optionals (lib.hasPrefix "libressl" openssl.meta.name) [
+    # https://github.com/pyca/pyopenssl/issues/791
+    # These tests, we disable in the case that libressl is passed in as openssl.
     "test_op_no_compression"
     "test_npn_advertise_error"
     "test_npn_select_error"
@@ -29,66 +62,21 @@ let
     "test_verify_with_revoked"
     "test_set_notAfter"
     "test_set_notBefore"
-  ];
-
-  # these tests are extremely tightly wed to the exact output of the openssl cli tool,
-  # including exact punctuation.
-  failingOpenSSL_1_1Tests = [
+  ] ++ lib.optionals (lib.versionAtLeast (lib.getVersion openssl.name) "1.1") [
+    # these tests are extremely tightly wed to the exact output of the openssl cli tool, including exact punctuation.
     "test_dump_certificate"
     "test_dump_privatekey_text"
     "test_dump_certificate_request"
     "test_export_text"
-  ];
-
-  disabledTests = [
-    # https://github.com/pyca/pyopenssl/issues/692
-    # These tests, we disable always.
-    "test_set_default_verify_paths"
-    "test_fallback_default_verify_paths"
-    # https://github.com/pyca/pyopenssl/issues/768
-    "test_wantWriteError"
-    # https://github.com/pyca/pyopenssl/issues/1043
-    "test_alpn_call_failure"
-  ] ++ (
-    lib.optionals (lib.hasPrefix "libressl" openssl.meta.name) failingLibresslTests
-  ) ++ (
-    lib.optionals (lib.versionAtLeast (lib.getVersion openssl.name) "1.1") failingOpenSSL_1_1Tests
-  ) ++ (
+  ] ++ lib.optionals stdenv.is32bit [
     # https://github.com/pyca/pyopenssl/issues/974
-    lib.optionals stdenv.is32bit [ "test_verify_with_time" ]
-  );
-
-  # Compose the final string expression, including the "-k" and the single quotes.
-  testExpression = lib.optionalString (disabledTests != [])
-    "-k 'not ${lib.concatStringsSep " and not " disabledTests}'";
-
-in
-
-buildPythonPackage rec {
-  pname = "pyopenssl";
-  version = "21.0.0";
+    "test_verify_with_time"
+  ];
 
-  src = fetchPypi {
-    pname = "pyOpenSSL";
-    inherit version;
-    sha256 = "5e2d8c5e46d0d865ae933bef5230090bdaf5506281e9eec60fa250ee80600cb3";
+  meta = with lib; {
+    description = "Python wrapper around the OpenSSL library";
+    homepage = "https://github.com/pyca/pyopenssl";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ SuperSandro2000 ];
   };
-
-  outputs = [ "out" "dev" ];
-
-  checkPhase = ''
-    runHook preCheck
-    export LANG="en_US.UTF-8"
-    py.test tests ${testExpression}
-    runHook postCheck
-  '';
-
-  # Seems to fail unpredictably on Darwin. See https://hydra.nixos.org/build/49877419/nixlog/1
-  # for one example, but I've also seen ContextTests.test_set_verify_callback_exception fail.
-  doCheck = !stdenv.isDarwin;
-
-  nativeBuildInputs = [ openssl ];
-  propagatedBuildInputs = [ cryptography pyasn1 idna six ];
-
-  checkInputs = [ pytest pretend flaky glibcLocales ];
 }
diff --git a/pkgs/development/python-modules/pysigma-backend-splunk/default.nix b/pkgs/development/python-modules/pysigma-backend-splunk/default.nix
index f3b122b4eca..97d5bd84f66 100644
--- a/pkgs/development/python-modules/pysigma-backend-splunk/default.nix
+++ b/pkgs/development/python-modules/pysigma-backend-splunk/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "pysigma-backend-splunk";
-  version = "0.1.1";
+  version = "0.1.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "SigmaHQ";
     repo = "pySigma-backend-splunk";
     rev = "v${version}";
-    hash = "sha256-AGT+7BKtINe2ukmomYyoUa5PHYAH1N0tUTtbyjMD+kw=";
+    hash = "sha256-jKvGBUO55DtF6bpgEL82XB5Ba+kmqJsCqUdzftcpSJ0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pysigma-pipeline-crowdstrike/default.nix b/pkgs/development/python-modules/pysigma-pipeline-crowdstrike/default.nix
index 22f589d3b14..2d2aadb9eae 100644
--- a/pkgs/development/python-modules/pysigma-pipeline-crowdstrike/default.nix
+++ b/pkgs/development/python-modules/pysigma-pipeline-crowdstrike/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "pysigma-pipeline-crowdstrike";
-  version = "0.1.3";
+  version = "0.1.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "SigmaHQ";
     repo = "pySigma-pipeline-crowdstrike";
     rev = "v${version}";
-    hash = "sha256-JNJHKydMzKreN+6liLlGMT1CFBUr/IX8Ah+exddKR3g=";
+    hash = "sha256-Riu2u1IouS1BMtXauXrNMIl06TU11pHdC0jjlOiR71s=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pysigma-pipeline-sysmon/default.nix b/pkgs/development/python-modules/pysigma-pipeline-sysmon/default.nix
index e784ac1eca1..02a12f93f7b 100644
--- a/pkgs/development/python-modules/pysigma-pipeline-sysmon/default.nix
+++ b/pkgs/development/python-modules/pysigma-pipeline-sysmon/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "pysigma-pipeline-sysmon";
-  version = "0.1.1";
+  version = "0.1.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "SigmaHQ";
     repo = "pySigma-pipeline-sysmon";
     rev = "v${version}";
-    hash = "sha256-BBJt2SAbnPEzIwJ+tXW4NmA4Nrb/glIaPlnmYHLoMD0=";
+    hash = "sha256-Y9X9/ynrfs4gVTLl7pOvK3TH2Eh2vNF1S6Cnt3tByJM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pysigma/default.nix b/pkgs/development/python-modules/pysigma/default.nix
index 39ab5c9918b..89bea0d0dc9 100644
--- a/pkgs/development/python-modules/pysigma/default.nix
+++ b/pkgs/development/python-modules/pysigma/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pysigma";
-  version = "0.3.2";
+  version = "0.4.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "SigmaHQ";
     repo = "pySigma";
     rev = "v${version}";
-    hash = "sha256-V/E2rZqVrk0kIvk+hPhNcAifhMM/rN3mk3pB+CGd43w=";
+    hash = "sha256-egyzeniid2PZZQ6hsd44W+YURI8uGaXvDMuhNIXUqO0=";
   };
 
   nativeBuildInputs = [
@@ -36,21 +36,9 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  patches = [
-    # Switch to poetry-core, https://github.com/SigmaHQ/pySigma/pull/31
-    (fetchpatch {
-      name = "switch-to-poetry-core.patch";
-      url = "https://github.com/SigmaHQ/pySigma/commit/b7a852d18852007da90c2ec35bff347c97b36f07.patch";
-      sha256 = "sha256-zgg8Bsc37W2uuQluFpIZT4jHCQaitY2ZgS93Wk6Hxt0=";
-    })
-  ];
-
   postPatch = ''
-    # https://github.com/SigmaHQ/pySigma/issues/32
-    # https://github.com/SigmaHQ/pySigma/issues/33
     substituteInPlace pyproject.toml \
-      --replace 'pyparsing = "^2.4.7"' 'pyparsing = "*"' \
-      --replace 'pyyaml = "^5.3.1"' 'pyyaml = "*"'
+      --replace 'pyparsing = "^3.0.7"' 'pyparsing = "*"' \
   '';
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/pytest-aiohttp/default.nix b/pkgs/development/python-modules/pytest-aiohttp/default.nix
index 4e45477c8ca..794bbce74e0 100644
--- a/pkgs/development/python-modules/pytest-aiohttp/default.nix
+++ b/pkgs/development/python-modules/pytest-aiohttp/default.nix
@@ -1,20 +1,45 @@
-{ lib, buildPythonPackage, fetchPypi, pytest, aiohttp }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, fetchpatch
+, setuptools-scm
+, aiohttp
+, pytest
+, pytest-asyncio
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "pytest-aiohttp";
-  version = "0.3.0";
+  version = "1.0.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0kx4mbs9bflycd8x9af0idcjhdgnzri3nw1qb0vpfyb3751qaaf9";
+    hash = "sha256-DI/rSNyOuAhw4rFTrK9iu7zCB5d+vLdDZf/P4WrcnxU=";
   };
 
-  buildInputs = [ pytest ];
+  patches = [
+    # https://github.com/aio-libs/pytest-aiohttp/pull/26
+    (fetchpatch {
+      name = "fix-tests-with-pytest-asyncio-0.18.0.patch";
+      url = "https://github.com/aio-libs/pytest-aiohttp/commit/97152c2dfdd368f799ec6bcb5fc315736a726f53.patch";
+      hash = "sha256-g7MTyCKUHnufOfrbhVV58WtfbGt1uXx8F7U9U+EaXfg=";
+    })
+  ];
 
-  propagatedBuildInputs = [ aiohttp ];
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
 
-  # There are no tests
-  doCheck = false;
+  propagatedBuildInputs = [
+    aiohttp
+    pytest
+    pytest-asyncio
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
 
   meta = with lib; {
     homepage = "https://github.com/aio-libs/pytest-aiohttp/";
diff --git a/pkgs/development/python-modules/pytest-asyncio/default.nix b/pkgs/development/python-modules/pytest-asyncio/default.nix
index 6401e1ce2c9..b8d3dffa3b0 100644
--- a/pkgs/development/python-modules/pytest-asyncio/default.nix
+++ b/pkgs/development/python-modules/pytest-asyncio/default.nix
@@ -11,16 +11,16 @@
 
 buildPythonPackage rec {
   pname = "pytest-asyncio";
-  version = "0.17.2";
+  version = "0.18.0";
   format = "setuptools";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "pytest-dev";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-4wDXvO6pDK0dQLnyfJTTa+GXf9Qtsi6ywYDUIdhkgGo=";
+    hash = "sha256-PE66ogjfzj6cW3+UD5nZHSt6zg7b+j6Q4ACznE4j0j8=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -36,6 +36,7 @@ buildPythonPackage rec {
   checkInputs = [
     flaky
     hypothesis
+    flaky
     pytestCheckHook
   ];
 
@@ -44,9 +45,9 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
-    description = "library for testing asyncio code with pytest";
+    description = "Library for testing asyncio code with pytest";
     homepage = "https://github.com/pytest-dev/pytest-asyncio";
     license = licenses.asl20;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ dotlambda ];
   };
 }
diff --git a/pkgs/development/python-modules/pytest-json-report/default.nix b/pkgs/development/python-modules/pytest-json-report/default.nix
index 2b89fe71592..95a0bcb325f 100644
--- a/pkgs/development/python-modules/pytest-json-report/default.nix
+++ b/pkgs/development/python-modules/pytest-json-report/default.nix
@@ -5,17 +5,21 @@
 , pytest-metadata
 , pytest-xdist
 , pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "pytest-json-report";
-  version = "1.4.1";
+  version = "1.5.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "numirias";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-OS9ASUp9iJ12Ovr931RQU/DHEAXqbgcRMCBP4h+GAhk=";
+    hash = "sha256-hMB/atDuo7CjwhHFUOxVfgJ7Qp4AA9J428iv7hyQFcs=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/pytest-mock/default.nix b/pkgs/development/python-modules/pytest-mock/default.nix
index 7f07ed2b6dd..94db409be91 100644
--- a/pkgs/development/python-modules/pytest-mock/default.nix
+++ b/pkgs/development/python-modules/pytest-mock/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, pytest
 , pytest-asyncio
 , pytestCheckHook
 , setuptools-scm
@@ -8,15 +9,19 @@
 
 buildPythonPackage rec {
   pname = "pytest-mock";
-  version = "3.6.1";
+  version = "3.7.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "40217a058c52a63f1042f0784f62009e976ba824c418cced42e88d5f40ab0e62";
+    hash = "sha256-URK9ksyfGG7pbhqS78hJaepJSTnDrq05xQ9CHEzGlTQ=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
 
+  propagatedBuildInputs = [
+    pytest
+  ];
+
   checkInputs = [
     pytest-asyncio
     pytestCheckHook
@@ -34,6 +39,6 @@ buildPythonPackage rec {
     description = "Thin-wrapper around the mock package for easier use with pytest";
     homepage = "https://github.com/pytest-dev/pytest-mock";
     license = with licenses; [ mit ];
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ dotlambda ];
   };
 }
diff --git a/pkgs/development/python-modules/python-box/default.nix b/pkgs/development/python-modules/python-box/default.nix
index 0edf2b69580..52e17faa5cc 100644
--- a/pkgs/development/python-modules/python-box/default.nix
+++ b/pkgs/development/python-modules/python-box/default.nix
@@ -11,14 +11,16 @@
 
 buildPythonPackage rec {
   pname = "python-box";
-  version = "5.4.1";
+  version = "6.0.0";
+  format = "setuptools";
+
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "cdgriffith";
     repo = "Box";
     rev = version;
-    sha256 = "sha256-SkteajcWG7rBFMm6Xp6QCfkZfwthRituGL/RtICbtYk=";
+    hash = "sha256-YOYcI+OAuTumNtTylUc6dSY9shOE6eTr8M3rVbcy5hs=";
   };
 
   propagatedBuildInputs = [
@@ -32,7 +34,9 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  pythonImportsCheck = [ "box" ];
+  pythonImportsCheck = [
+    "box"
+  ];
 
   meta = with lib; {
     description = "Python dictionaries with advanced dot notation access";
diff --git a/pkgs/development/python-modules/python-http-client/default.nix b/pkgs/development/python-modules/python-http-client/default.nix
index aa2c4d020e5..78a3b018c7e 100644
--- a/pkgs/development/python-modules/python-http-client/default.nix
+++ b/pkgs/development/python-modules/python-http-client/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "python_http_client";
-  version = "3.3.6";
+  version = "3.3.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "sendgrid";
     repo = "python-http-client";
     rev = version;
-    sha256 = "sha256-Xchf/jVkQ7SYOzI9f81iS/G72k//6wkl2bMvHprOP9Y=";
+    sha256 = "sha256-8Qs5Jw0LMV2UucLnlFKJQ2PUhYaQx6uJdIV/4gaPH3w=";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/pyyaml/default.nix b/pkgs/development/python-modules/pyyaml/default.nix
index 2c0e893b9c5..10f78ab5e14 100644
--- a/pkgs/development/python-modules/pyyaml/default.nix
+++ b/pkgs/development/python-modules/pyyaml/default.nix
@@ -8,7 +8,7 @@
 }:
 
 buildPythonPackage rec {
-  pname = "PyYAML";
+  pname = "pyyaml";
   version = "6.0";
 
   disabled = pythonOlder "3.6";
diff --git a/pkgs/development/python-modules/qcengine/default.nix b/pkgs/development/python-modules/qcengine/default.nix
index ea5325ea660..795b8460b5d 100644
--- a/pkgs/development/python-modules/qcengine/default.nix
+++ b/pkgs/development/python-modules/qcengine/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "qcengine";
-  version = "0.22.0";
+  version = "0.23.0";
 
   checkInputs = [ pytestCheckHook ];
 
@@ -25,7 +25,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "685a08247b561ed1c7a7b42e68293f90b412e83556626304a3f826a15be51308";
+    sha256 = "sha256-gDn0Nu6ALTr3KyZnYDSA6RE3S5JQj562FP2RI9U3Gxs=";
   };
 
   doCheck = true;
diff --git a/pkgs/development/python-modules/readme_renderer/default.nix b/pkgs/development/python-modules/readme_renderer/default.nix
index b7709da9dca..122c4fdf665 100644
--- a/pkgs/development/python-modules/readme_renderer/default.nix
+++ b/pkgs/development/python-modules/readme_renderer/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "readme-renderer";
-  version = "33.0";
+  version = "34.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "readme_renderer";
     inherit version;
-    sha256 = "sha256-47U7yEvWrwVOTMH+NWfcGuGfVUE0IhBDo/jGdOIiCds=";
+    sha256 = "sha256-37TRfyFwbRRfdHPgthyiRbpY6BDPmyIJpII5Z3+C5bA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/regex/default.nix b/pkgs/development/python-modules/regex/default.nix
index b96c7ca8995..86e591eaf14 100644
--- a/pkgs/development/python-modules/regex/default.nix
+++ b/pkgs/development/python-modules/regex/default.nix
@@ -2,25 +2,28 @@
 , buildPythonPackage
 , fetchPypi
 , python
-, isPy27
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "regex";
-  version = "2021.11.10";
+  version = "2022.1.18";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-80HuLfCZm/33qV5EgHXv/g2yEqWTh94acGkOSssD1MY=";
+    hash = "sha256-l/MtwDqAVKTEpatddh7Uhh6CiywgD+vU5GhXBppIORY=";
   };
 
-  # Sources for different Python releases are located in same folder
   checkPhase = ''
-    rm -r ${if !isPy27 then "regex_2" else "regex_3"}
     ${python.interpreter} -m unittest
   '';
 
-  pythonImportsCheck = [ "regex" ];
+  pythonImportsCheck = [
+    "regex"
+  ];
 
   meta = with lib; {
     description = "Alternative regular expression module, to replace re";
diff --git a/pkgs/development/python-modules/responses/default.nix b/pkgs/development/python-modules/responses/default.nix
index 86e37419c72..95861bda181 100644
--- a/pkgs/development/python-modules/responses/default.nix
+++ b/pkgs/development/python-modules/responses/default.nix
@@ -5,25 +5,23 @@
 , pytestCheckHook
 , pythonOlder
 , requests
-, six
 , urllib3
 }:
 
 buildPythonPackage rec {
   pname = "responses";
-  version = "0.17.0";
+  version = "0.18.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-7GdeCA0Gv40fteWmih5c0N9GsJx4IwMV9lCvXkA2vsc=";
+    hash = "sha256-OAytTBwdyULl6KjqrgtNTt9wj08BDbi3vPr60fzSVP8=";
   };
 
   propagatedBuildInputs = [
     requests
-    six
     urllib3
   ];
 
diff --git a/pkgs/development/python-modules/ruamel-yaml/default.nix b/pkgs/development/python-modules/ruamel-yaml/default.nix
index 79f21ba6aab..31d76d78ac7 100644
--- a/pkgs/development/python-modules/ruamel-yaml/default.nix
+++ b/pkgs/development/python-modules/ruamel-yaml/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "ruamel-yaml";
-  version = "0.17.20";
+  version = "0.17.21";
 
   src = fetchPypi {
     pname = "ruamel.yaml";
     inherit version;
-    sha256 = "sha256-S4ozwe+ytEOpP8qvz6TS5EX46MKcUo2fXNr7fMnkAEw=";
+    sha256 = "sha256-i3zml6LyEnUqNcGsQURx3BbEJMlXO+SSa1b/P10jt68=";
   };
 
   # Tests use relative paths
diff --git a/pkgs/development/python-modules/samsungtvws/default.nix b/pkgs/development/python-modules/samsungtvws/default.nix
index b4bebb79a0f..bed661ce200 100644
--- a/pkgs/development/python-modules/samsungtvws/default.nix
+++ b/pkgs/development/python-modules/samsungtvws/default.nix
@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "samsungtvws";
-  version = "2.3.0";
+  version = "2.4.0";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-2ly9lbnIHGHB55ml10jKE7dC5LdN1ToGW4GqfxTC5kI=";
+    sha256 = "sha256-LbNHaSbNCwoffox6B8kEUzxjkSJotB+P1bw3wbU7DZk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/semantic-version/default.nix b/pkgs/development/python-modules/semantic-version/default.nix
index e939142fd82..d3ca4459619 100644
--- a/pkgs/development/python-modules/semantic-version/default.nix
+++ b/pkgs/development/python-modules/semantic-version/default.nix
@@ -1,20 +1,35 @@
-{ lib, fetchPypi, buildPythonPackage }:
+{ lib
+, fetchPypi
+, buildPythonPackage
+, pythonOlder
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
-  pname = "semantic_version";
-  version = "2.8.5";
+  pname = "semantic-version";
+  version = "2.9.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    inherit pname version;
-    sha256 = "d2cb2de0558762934679b9a104e82eca7af448c9f4974d1f3eeccff651df8a54";
+    pname = "semantic_version";
+    inherit version;
+    sha256 = "sha256-q/VIc1U+Xgem/U1fZTt4H1rkEpekk2ZrWdzyFABqErI=";
   };
 
-  # ModuleNotFoundError: No module named 'tests'
-  doCheck = false;
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "semantic_version"
+  ];
 
   meta = with lib; {
     description = "A library implementing the 'SemVer' scheme";
-    license = licenses.bsdOriginal;
+    homepage = "https://github.com/rbarrois/python-semanticversion/";
+    license = licenses.bsd2;
     maintainers = with maintainers; [ layus makefu ];
   };
 }
diff --git a/pkgs/development/python-modules/snitun/default.nix b/pkgs/development/python-modules/snitun/default.nix
index d1645e1fbe7..1b7bd7341eb 100644
--- a/pkgs/development/python-modules/snitun/default.nix
+++ b/pkgs/development/python-modules/snitun/default.nix
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "NabuCasa";
     repo = pname;
     rev = version;
-    sha256 = "sha256-Ehafb35H462Ffn6omGh/MDJKQX5qJJZeiIBO3n0IGlA=";
+    hash = "sha256-Ehafb35H462Ffn6omGh/MDJKQX5qJJZeiIBO3n0IGlA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/soco/default.nix b/pkgs/development/python-modules/soco/default.nix
index e79a38d8cf5..50a134df2d2 100644
--- a/pkgs/development/python-modules/soco/default.nix
+++ b/pkgs/development/python-modules/soco/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "soco";
-  version = "0.26.4";
+  version = "0.27.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "SoCo";
     repo = "SoCo";
     rev = "v${version}";
-    hash = "sha256-DoONq6Iqi8t47jtqggKYMHSNJAf/Kha3tszR6mYeB9Y=";
+    hash = "sha256-8U7wfxqen+hgK8j9ooPHCAKvd9kSZicToTyP7XzQFrg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/sslyze/default.nix b/pkgs/development/python-modules/sslyze/default.nix
index f76ba96a5b8..bc3e2c238c9 100644
--- a/pkgs/development/python-modules/sslyze/default.nix
+++ b/pkgs/development/python-modules/sslyze/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "sslyze";
-  version = "5.0.2";
+  version = "5.0.3";
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "nabla-c0d3";
     repo = pname;
     rev = version;
-    hash = "sha256-8xtnE5oFxH3wo2Smt65/xGDHxivexN6ggUpyUg42Cjk=";
+    hash = "sha256-d465WJIDsgNAPe8KW5v2KDSgzMH7OPLSiFfFH9n+jiA=";
   };
 
   patchPhase = ''
diff --git a/pkgs/development/python-modules/stack-data/default.nix b/pkgs/development/python-modules/stack-data/default.nix
index cbbd3a878d7..eb9879a4bf0 100644
--- a/pkgs/development/python-modules/stack-data/default.nix
+++ b/pkgs/development/python-modules/stack-data/default.nix
@@ -1,5 +1,6 @@
 { asttokens
 , buildPythonPackage
+, cython
 , executing
 , fetchFromGitHub
 , git
@@ -15,13 +16,13 @@
 
 buildPythonPackage rec {
   pname = "stack-data";
-  version = "0.1.0";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "alexmojaki";
     repo = "stack_data";
     rev = "v${version}";
-    sha256 = "sha256-dRIRDMq0tc1QuBHvppPwJA5PVGHyVRhoBlX5BsdDzec=";
+    sha256 = "sha256-brXFrk1UU5hxCVeRvGK7wzRA0Hoj9fgqoxTIwInPrEc=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -39,6 +40,7 @@ buildPythonPackage rec {
   ];
 
   checkInputs = [
+    cython
     littleutils
     pygments
     pytestCheckHook
diff --git a/pkgs/development/python-modules/tls-parser/default.nix b/pkgs/development/python-modules/tls-parser/default.nix
index ad35fe50128..a886e116e45 100644
--- a/pkgs/development/python-modules/tls-parser/default.nix
+++ b/pkgs/development/python-modules/tls-parser/default.nix
@@ -7,23 +7,29 @@
 
 buildPythonPackage rec {
   pname = "tls-parser";
-  version = "1.2.2";
+  version = "2.0.0";
+  format = "setuptools";
+
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "nabla-c0d3";
     repo = "tls_parser";
     rev = version;
-    sha256 = "12qj3vg02r5a51w6gbgb1gcxicqc10lbbsdi57jkkfvbqiindbd0";
+    hash = "sha256-A1lYRe1sHDoOFdF20DP+xRMcPBWzokIXFphIpaBmwBc=";
   };
 
-  checkInputs = [ pytestCheckHook ];
+  checkInputs = [
+    pytestCheckHook
+  ];
 
-  pythonImportsCheck = [ "tls_parser" ];
+  pythonImportsCheck = [
+    "tls_parser"
+  ];
 
   meta = with lib; {
-    homepage = "https://github.com/nabla-c0d3/tls_parser";
     description = "Small library to parse TLS records";
+    homepage = "https://github.com/nabla-c0d3/tls_parser";
     platforms = with platforms; linux ++ darwin;
     license = licenses.mit;
     maintainers = with maintainers; [ veehaitch ];
diff --git a/pkgs/development/python-modules/twentemilieu/default.nix b/pkgs/development/python-modules/twentemilieu/default.nix
index 425b7eddfe9..382e90e14c8 100644
--- a/pkgs/development/python-modules/twentemilieu/default.nix
+++ b/pkgs/development/python-modules/twentemilieu/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "twentemilieu";
-  version = "0.5.0";
+  version = "0.6.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "frenck";
     repo = "python-twentemilieu";
     rev = "v${version}";
-    sha256 = "sha256-7HQ0+h8oiyY+TacQdX84K0r994rH0AMZAvZz8PUvQl0=";
+    sha256 = "sha256-UE7fhbSThXmMns1XfUUQqw0wn5/w/x+UncansIBiank=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/typed-ast/default.nix b/pkgs/development/python-modules/typed-ast/default.nix
index c4977ab0829..87116017063 100644
--- a/pkgs/development/python-modules/typed-ast/default.nix
+++ b/pkgs/development/python-modules/typed-ast/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "typed-ast";
-  version = "1.5.1";
+  version = "1.5.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "python";
     repo = "typed_ast";
     rev = version;
-    hash = "sha256-qfXMT+rSf/WcWHpkg4VZXZMYj/5IKQWAKRsxQ0TRzPU=";
+    hash = "sha256-Ul1FIS1a1f8l3tX+m8Bj/LsLQW1sXJv6XzEZ9zh8rfI=";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/vt-py/default.nix b/pkgs/development/python-modules/vt-py/default.nix
index 13eeb86be8d..8228047d9ce 100644
--- a/pkgs/development/python-modules/vt-py/default.nix
+++ b/pkgs/development/python-modules/vt-py/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "vt-py";
-  version = "0.13.2";
+  version = "0.14.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "VirusTotal";
     repo = pname;
     rev = version;
-    sha256 = "sha256-ULzMz81s/C5wjIUtZ+Rz5o1Uump1FV0rTcNW9keERDk=";
+    sha256 = "sha256-901VW56vr6ysMlzspgVbPMLnDIpJRgSEOEQ8ohHp+mc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/xmltodict/default.nix b/pkgs/development/python-modules/xmltodict/default.nix
index 790aaec3ce3..13cc5b89c2a 100644
--- a/pkgs/development/python-modules/xmltodict/default.nix
+++ b/pkgs/development/python-modules/xmltodict/default.nix
@@ -2,7 +2,7 @@
 , buildPythonPackage
 , fetchPypi
 , coverage
-, nose
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -14,11 +14,13 @@ buildPythonPackage rec {
     sha256 = "50d8c638ed7ecb88d90561beedbf720c9b4e851a9fa6c47ebd64e99d166d8a21";
   };
 
-  checkInputs = [ coverage nose ];
+  checkInputs = [ coverage pytestCheckHook ];
 
-  checkPhase = ''
-    nosetests
-  '';
+  disabledTests = [
+    # incompatibilities with security fixes: https://github.com/martinblech/xmltodict/issues/289
+    "test_namespace_collapse"
+    "test_namespace_support"
+  ];
 
   meta = {
     description = "Makes working with XML feel like you are working with JSON";
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index 58fed0070d0..f2f9ec46b6e 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -32,13 +32,13 @@ with py.pkgs;
 
 buildPythonApplication rec {
   pname = "checkov";
-  version = "2.0.954";
+  version = "2.0.962";
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = pname;
     rev = version;
-    hash = "sha256-gCUciYTEL+4Pt9vAGbun0WFQWneOhDDXh7Dn9+sZbWw=";
+    hash = "sha256-hpoOOU1Z8xVqoJJdGcSoWujm3amiPkZ1Qjiqh66J+ZM=";
   };
 
   nativeBuildInputs = with py.pkgs; [
@@ -53,6 +53,7 @@ buildPythonApplication rec {
     bc-python-hcl2
     boto3
     cachetools
+    charset-normalizer
     cloudsplaining
     colorama
     configargparse
diff --git a/pkgs/development/tools/build-managers/bazel/bazel-remote/default.nix b/pkgs/development/tools/build-managers/bazel/bazel-remote/default.nix
index 44e8b9e4414..a53bdd4b0c8 100644
--- a/pkgs/development/tools/build-managers/bazel/bazel-remote/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel-remote/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "bazel-remote";
-  version = "2.3.4";
+  version = "2.3.5";
 
   src = fetchFromGitHub {
     owner = "buchgr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ijR3RjGzm0HtVp5lSKGJemCGkRzhgQqaDOgg+MjDB1c=";
+    sha256 = "sha256-8tT00ppqBGLw2h+RxaiD7r3XYzyvXOHj1U8V5H/ftyQ=";
   };
 
-  vendorSha256 = "sha256-NmTdS5xgv0o7AT4lBJk472Lq1e73EcrcfnI8RIxKEoc=";
+  vendorSha256 = "sha256-wXgW7HigMIeUZAcZpm5TH9thfCHmpz+M42toWHgwIYo=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/database/prisma-engines/default.nix b/pkgs/development/tools/database/prisma-engines/default.nix
index 48456166b92..18614291d58 100644
--- a/pkgs/development/tools/database/prisma-engines/default.nix
+++ b/pkgs/development/tools/database/prisma-engines/default.nix
@@ -10,19 +10,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "prisma-engines";
-  version = "3.10.0";
+  version = "3.11.0";
 
   src = fetchFromGitHub {
     owner = "prisma";
     repo = "prisma-engines";
     rev = version;
-    sha256 = "sha256-0m0RjIasEGB9QxZc7wKCMLnxHXkSlvCDA2QWa87mRRs=";
+    sha256 = "sha256-z7ebwidY+p350XaGeyohoSHWc2DhfzpRxsRDLON1BuA=";
   };
 
   # Use system openssl.
   OPENSSL_NO_VENDOR = 1;
 
-  cargoSha256 = "sha256-KNQa+wLLl4abz48QKYkWu7A+FTGIyB+1EWAnLuWpJwc=";
+  cargoSha256 = "sha256-PQdLoNJL9szPzPtFRznWS0lngTvtWK+Ko2rp4JWH9dQ=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/development/tools/doctl/default.nix b/pkgs/development/tools/doctl/default.nix
index 3bcd0d6777d..0e88e1c4926 100644
--- a/pkgs/development/tools/doctl/default.nix
+++ b/pkgs/development/tools/doctl/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "doctl";
-  version = "1.70.0";
+  version = "1.71.0";
 
   vendorSha256 = null;
 
@@ -31,7 +31,7 @@ buildGoModule rec {
     owner = "digitalocean";
     repo = "doctl";
     rev = "v${version}";
-    sha256 = "sha256-oLcWVUP9A/tcJYKiaBrqAdyNKESaVFOaNiG/fAVQb2c=";
+    sha256 = "sha256-cj2+DmJyLa6kFkH9JflaR3yFFXBaVZHO6czJGLEH7L0=";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/tools/jp/default.nix b/pkgs/development/tools/jp/default.nix
index f1f5b37c10d..ba78a4ce6bc 100644
--- a/pkgs/development/tools/jp/default.nix
+++ b/pkgs/development/tools/jp/default.nix
@@ -1,18 +1,18 @@
-{ lib, buildGoPackage, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "jp";
-  version = "0.1.3";
-  rev = version;
-
-  goPackagePath = "github.com/jmespath/jp";
+  version = "0.2.1";
 
   src = fetchFromGitHub {
-    inherit rev;
+    rev = version;
     owner = "jmespath";
     repo = "jp";
-    sha256 = "0fdbnihbd0kq56am3bmh2zrfk4fqjslcbm48malbgmpqw3a5nvpi";
+    hash = "sha256-a3WvLAdUZk+Y+L+opPDMBvdN5x5B6nAi/lL8JHJG/gY=";
   };
+
+  vendorSha256 = "sha256-K6ZNtART7tcVBH5myV6vKrKWfnwK8yTa6/KK4QLyr00=";
+
   meta = with lib; {
     description = "A command line interface to the JMESPath expression language for JSON";
     homepage = "https://github.com/jmespath/jp";
diff --git a/pkgs/development/tools/k6/default.nix b/pkgs/development/tools/k6/default.nix
index d50062e4bdb..66ff4a8b2df 100644
--- a/pkgs/development/tools/k6/default.nix
+++ b/pkgs/development/tools/k6/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "k6";
-  version = "0.36.0";
+  version = "0.37.0";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-yWEh0sPMGe6mNcLKhbmJEUCHzZKFGMcTRNQrHgiQ+BQ=";
+    sha256 = "sha256-5pxOg+pwa2VrEWinDadx2ZFYXiQgochbU4bCkJEezQw=";
   };
 
   subPackages = [ "./" ];
diff --git a/pkgs/development/tools/kcli/default.nix b/pkgs/development/tools/kcli/default.nix
index 8f0aecba34d..fc604a68cee 100644
--- a/pkgs/development/tools/kcli/default.nix
+++ b/pkgs/development/tools/kcli/default.nix
@@ -13,8 +13,6 @@ buildGoModule rec {
 
   vendorSha256 = "0zj2hls8m0l9xsfv680wiwq1g2qjdjslv2yx3yd4rzxdsv2wz09a";
 
-  doCheck = false;
-
   subPackages = [ "." ];
 
   meta = with lib; {
diff --git a/pkgs/development/tools/misc/autoconf/2.13.nix b/pkgs/development/tools/misc/autoconf/2.13.nix
index dc36028332f..4ff990ca0ed 100644
--- a/pkgs/development/tools/misc/autoconf/2.13.nix
+++ b/pkgs/development/tools/misc/autoconf/2.13.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, m4, perl, xz }:
+{ lib, stdenv, fetchurl, m4, perl }:
 
 stdenv.mkDerivation rec {
   pname = "autoconf";
@@ -9,7 +9,6 @@ stdenv.mkDerivation rec {
     sha256 = "07krzl4czczdsgzrrw9fiqx35xcf32naf751khg821g5pqv12qgh";
   };
 
-  nativebuildInputs = [ xz ];
   buildInputs = [ m4 perl ];
 
   doCheck = true;
diff --git a/pkgs/development/tools/misc/ctags/default.nix b/pkgs/development/tools/misc/ctags/default.nix
index fde7307b27d..dc6ee481523 100644
--- a/pkgs/development/tools/misc/ctags/default.nix
+++ b/pkgs/development/tools/misc/ctags/default.nix
@@ -1,12 +1,12 @@
 { lib, stdenv, fetchsvn, autoreconfHook }:
 
 stdenv.mkDerivation rec {
-  name = "ctags-${revision}";
-  revision = "816";
+  pname = "ctags";
+  version = "816";
 
   src = fetchsvn {
     url = "https://svn.code.sf.net/p/ctags/code/trunk";
-    rev = revision;
+    rev = version;
     sha256 = "0jmbkrmscbl64j71qffcc39x005jrmphx8kirs1g2ws44wil39hf";
   };
 
diff --git a/pkgs/development/tools/misc/gdb/default.nix b/pkgs/development/tools/misc/gdb/default.nix
index c173b96f6eb..5bb5bc0652f 100644
--- a/pkgs/development/tools/misc/gdb/default.nix
+++ b/pkgs/development/tools/misc/gdb/default.nix
@@ -27,11 +27,11 @@ assert pythonSupport -> python3 != null;
 
 stdenv.mkDerivation rec {
   pname = targetPrefix + basename;
-  version = "11.1";
+  version = "11.2";
 
   src = fetchurl {
     url = "mirror://gnu/gdb/${basename}-${version}.tar.xz";
-    sha256 = "151z6d0265hv9cgx9zqqa4bd6vbp20hrljhd6bxl7lr0gd0crkyc";
+    hash = "sha256-FJfDanGIG4ZxqahKDuQPqreIyjDXuhnYRjw8x4cVLjI=";
   };
 
   postPatch = if stdenv.isDarwin then ''
diff --git a/pkgs/development/tools/misc/help2man/default.nix b/pkgs/development/tools/misc/help2man/default.nix
index 4521eee95a2..f7d1667dfa2 100644
--- a/pkgs/development/tools/misc/help2man/default.nix
+++ b/pkgs/development/tools/misc/help2man/default.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "help2man";
-  version = "1.48.5";
+  version = "1.49.1";
 
   src = fetchurl {
     url = "mirror://gnu/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-ZznkyqQuau0zmb5Dh8p5OZZAlnM06RcohjuOqpIlgr4=";
+    sha256 = "sha256-/ZmmZOxL6ahqDdiXGZifFPNnqcB5110OHXHhinu1GwM=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/tools/parsing/flex/default.nix b/pkgs/development/tools/parsing/flex/default.nix
index 58f0bb54fb1..8991c1419f2 100644
--- a/pkgs/development/tools/parsing/flex/default.nix
+++ b/pkgs/development/tools/parsing/flex/default.nix
@@ -47,6 +47,10 @@ stdenv.mkDerivation rec {
 
   dontDisableStatic = stdenv.buildPlatform != stdenv.hostPlatform;
 
+  postInstall = ''
+    ln -s $out/bin/flex $out/bin/lex
+  '';
+
   meta = with lib; {
     homepage = "https://github.com/westes/flex";
     description = "A fast lexical analyser generator";
diff --git a/pkgs/development/tools/rust/cargo-crev/default.nix b/pkgs/development/tools/rust/cargo-crev/default.nix
index 9fc89ece06d..90ea1658271 100644
--- a/pkgs/development/tools/rust/cargo-crev/default.nix
+++ b/pkgs/development/tools/rust/cargo-crev/default.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-crev";
-  version = "0.23.0";
+  version = "0.23.1";
 
   src = fetchFromGitHub {
     owner = "crev-dev";
     repo = "cargo-crev";
     rev = "v${version}";
-    sha256 = "sha256-iqFE3sz7cIFcd9zCFjU1PjMWVmxCRcdiiGAbirWUWMA=";
+    sha256 = "sha256-XzjZEVyPVn+7VrjG4QsqVBFmuGC1TWTWLEoqFcwQhaI=";
   };
 
-  cargoSha256 = "sha256-qlqW5phw7QI5KT2uUamQFEYHZd4uzYaUuvZTG3KhrOU=";
+  cargoSha256 = "sha256-p87ZnOxaF9ytSUxp0P3QE3K1/jo7hz/N7BH1f2Lc0I0=";
 
   preCheck = ''
     export HOME=$(mktemp -d)
diff --git a/pkgs/development/tools/shellharden/default.nix b/pkgs/development/tools/shellharden/default.nix
index d444a3685c5..ee56e58f6ca 100644
--- a/pkgs/development/tools/shellharden/default.nix
+++ b/pkgs/development/tools/shellharden/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "shellharden";
-  version = "4.1.3";
+  version = "4.2.0";
 
   src = fetchFromGitHub {
     owner = "anordal";
     repo = pname;
     rev = "v${version}";
-    sha256 = "04pgmkaqjb1lmlwjjipcrqh9qcyjjkr39vi3h5fl9sr71c8g7dnd";
+    sha256 = "081b51h88hhyzn9vb9pcszz1wfdj73xwsyfn2ygz708kabzqpvdl";
   };
 
-  cargoSha256 = "0bjqgw49msl288yfa7bl31bfa9kdy4zh1q3j0lyw4vvkv2r14pf5";
+  cargoSha256 = "1gwlmds417szwvywvm19wv60a83inp52sf46sd05x5vahb8gv8hg";
 
   postPatch = "patchShebangs moduletests/run";
 
diff --git a/pkgs/development/tools/stylua/default.nix b/pkgs/development/tools/stylua/default.nix
index 1b25634502a..e21f058b8a0 100644
--- a/pkgs/development/tools/stylua/default.nix
+++ b/pkgs/development/tools/stylua/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "stylua";
-  version = "0.12.4";
+  version = "0.12.5";
 
   src = fetchFromGitHub {
     owner = "johnnymorganz";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-BPLN7/LaVDtCOJBgIJVbnENUyFtacRsK3JxDupytzOA=";
+    sha256 = "sha256-4tQQTTAdIAhlkBJevwwwGXOKd6bJJOyG4nlbCv7909Y=";
   };
 
-  cargoSha256 = "sha256-MZsFbFQp5Rw20pXzvTFNhMiVx/TJZ63/2rU7vj7IcqQ=";
+  cargoSha256 = "sha256-DGe2lB8xZgY9ikTsIHDOdHzTyHfDaSlmy8FU/S9FDCI=";
 
   buildFeatures = lib.optional lua52Support "lua52"
     ++ lib.optional luauSupport "luau";
diff --git a/pkgs/development/tools/symfony-cli/default.nix b/pkgs/development/tools/symfony-cli/default.nix
index d87ecddbf89..ebb07ec2b49 100644
--- a/pkgs/development/tools/symfony-cli/default.nix
+++ b/pkgs/development/tools/symfony-cli/default.nix
@@ -2,14 +2,14 @@
 
 buildGoModule rec {
   pname = "symfony-cli";
-  version = "5.4.1";
+  version = "5.4.2";
   vendorSha256 = "sha256-MlsgII1QybyW+B7DGbSyn7VQ36n29yOC0pZnaemEHO8=";
 
   src = fetchFromGitHub {
     owner = "symfony-cli";
     repo = "symfony-cli";
     rev = "v${version}";
-    sha256 = "sha256-92Pth+IrILWkcP4mm3IcSN4+zs7TNg4CPGT2liop7/I=";
+    sha256 = "sha256-Ci523YoocpCexbXMg3PjQ/x8z/STWt+nro64l+ckKzM=";
   };
 
   # Tests requires network access
diff --git a/pkgs/development/web/nodejs/setup-hook.sh b/pkgs/development/web/nodejs/setup-hook.sh
index 18368588c2a..878e0693a1e 100644
--- a/pkgs/development/web/nodejs/setup-hook.sh
+++ b/pkgs/development/web/nodejs/setup-hook.sh
@@ -1,5 +1,5 @@
 addNodePath () {
-    addToSearchPath NODE_PATH $1/lib/node_modules
+    addToSearchPath NODE_PATH "$1/lib/node_modules"
 }
 
 addEnvHooks "$hostOffset" addNodePath
diff --git a/pkgs/misc/cups/default.nix b/pkgs/misc/cups/default.nix
index 2d0129e21c5..af43c55072c 100644
--- a/pkgs/misc/cups/default.nix
+++ b/pkgs/misc/cups/default.nix
@@ -26,14 +26,14 @@ stdenv.mkDerivation rec {
   pname = "cups";
 
   # After 2.2.6, CUPS requires headers only available in macOS 10.12+
-  version = if stdenv.isDarwin then "2.2.6" else "2.4.0";
+  version = if stdenv.isDarwin then "2.2.6" else "2.4.1";
 
   src = fetchurl (if stdenv.isDarwin then {
     url = "https://github.com/apple/cups/releases/download/v${version}/cups-${version}-source.tar.gz";
     sha256 = "16qn41b84xz6khrr2pa2wdwlqxr29rrrkjfi618gbgdkq9w5ff20";
   } else {
     url = "https://github.com/OpenPrinting/cups/releases/download/v${version}/cups-${version}-source.tar.gz";
-    sha256 = "1pm6lf08z8vgs62g5b5rjw32qy3vr0q3sgidpg2lfs6a530wxgls";
+    sha256 = "sha256-xzOfdfjU8t7FDGczQaRfwGtohbttQ2bWv1mk5sEK4Xg=";
   });
 
   outputs = [ "out" "lib" "dev" "man" ];
diff --git a/pkgs/misc/logging/pacemaker/default.nix b/pkgs/misc/logging/pacemaker/default.nix
new file mode 100644
index 00000000000..07194380d4a
--- /dev/null
+++ b/pkgs/misc/logging/pacemaker/default.nix
@@ -0,0 +1,102 @@
+{ lib
+, stdenv
+, autoconf
+, automake
+, bash
+, bzip2
+, corosync
+, dbus
+, fetchFromGitHub
+, glib
+, gnutls
+, libqb
+, libtool
+, libuuid
+, libxml2
+, libxslt
+, pam
+, pkg-config
+, python3
+, nixosTests
+
+# Pacemaker is compiled twice, once with forOCF = true to extract its
+# OCF definitions for use in the ocf-resource-agents derivation, then
+# again with forOCF = false, where the ocf-resource-agents is provided
+# as the OCF_ROOT.
+, forOCF ? false
+, ocf-resource-agents
+} :
+
+stdenv.mkDerivation rec {
+  pname = "pacemaker";
+  version = "2.1.2";
+
+  src = fetchFromGitHub {
+    owner = "ClusterLabs";
+    repo = pname;
+    rev = "Pacemaker-${version}";
+    sha256 = "1w7vq3lmgcz38pfww9vccm142vjsjqz3qc9nnk09ynkx4agqhxdg";
+  };
+
+  nativeBuildInputs = [
+    autoconf
+    automake
+    libtool
+    pkg-config
+  ];
+
+  buildInputs = [
+    bash
+    bzip2
+    corosync
+    dbus.dev
+    glib
+    gnutls
+    libqb
+    libuuid
+    libxml2.dev
+    libxslt.dev
+    pam
+    python3
+  ];
+
+  preConfigure = ''
+    ./autogen.sh --prefix="$out"
+  '';
+  configureFlags = [
+    "--exec-prefix=${placeholder "out"}"
+    "--sysconfdir=/etc"
+    "--localstatedir=/var"
+    "--with-initdir=/etc/systemd/system"
+    "--with-systemdsystemunitdir=/etc/systemd/system"
+    "--with-corosync"
+    # allows Type=notify in the systemd service
+    "--enable-systemd"
+  ] ++ lib.optional (!forOCF) "--with-ocfdir=${ocf-resource-agents}/usr/lib/ocf";
+
+  installFlags = [ "DESTDIR=${placeholder "out"}" ];
+
+  NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isGNU [
+    "-Wno-error=strict-prototypes"
+  ];
+
+  enableParallelBuilding = true;
+
+  postInstall = ''
+    # pacemaker's install linking requires a weirdly nested hierarchy
+    mv $out$out/* $out
+    rm -r $out/nix
+  '';
+
+  passthru.tests = {
+    inherit (nixosTests) pacemaker;
+  };
+
+  meta = with lib; {
+    homepage = "https://clusterlabs.org/pacemaker/";
+    description = "Pacemaker is an open source, high availability resource manager suitable for both small and large clusters.";
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ ryantm astro ];
+  };
+}
diff --git a/pkgs/misc/openrussian-cli/default.nix b/pkgs/misc/openrussian-cli/default.nix
index 24c0b6bece7..4f30fd91896 100644
--- a/pkgs/misc/openrussian-cli/default.nix
+++ b/pkgs/misc/openrussian-cli/default.nix
@@ -1,6 +1,9 @@
 { stdenv, lib, fetchFromGitHub, gnumake, pkg-config, wget, unzip, gawk
-, sqlite, which, luaPackages, installShellFiles, makeWrapper
+, sqlite, which, lua, installShellFiles, makeWrapper
 }:
+let
+  luaEnv = lua.withPackages(p: with p; [ luasql-sqlite3 luautf8 ]);
+in
 stdenv.mkDerivation rec {
   pname   = "openrussian-cli";
   version = "1.0.0";
@@ -16,11 +19,11 @@ stdenv.mkDerivation rec {
     gnumake pkg-config wget unzip gawk sqlite which installShellFiles makeWrapper
   ];
 
-  buildInputs = with luaPackages; [ lua luasql-sqlite3 luautf8 ];
+  buildInputs = [ luaEnv ];
 
   makeFlags = [
-    "LUA=${luaPackages.lua}/bin/lua"
-    "LUAC=${luaPackages.lua}/bin/luac"
+    "LUA=${luaEnv}/bin/lua"
+    "LUAC=${luaEnv}/bin/luac"
   ];
 
   dontConfigure = true;
@@ -34,8 +37,8 @@ stdenv.mkDerivation rec {
     cp openrussian $out/bin
 
     wrapProgram $out/bin/openrussian \
-      --prefix LUA_PATH ';' "$LUA_PATH" \
-      --prefix LUA_CPATH ';' "$LUA_CPATH"
+      --prefix LUA_PATH ';' '${lua.pkgs.lib.genLuaPathAbsStr luaEnv}' \
+      --prefix LUA_CPATH ';' '${lua.pkgs.lib.genLuaCPathAbsStr luaEnv}'
 
     runHook postInstall
   '';
diff --git a/pkgs/misc/screensavers/xlockmore/default.nix b/pkgs/misc/screensavers/xlockmore/default.nix
index 8d6b5eba5bf..ac739d6a0db 100644
--- a/pkgs/misc/screensavers/xlockmore/default.nix
+++ b/pkgs/misc/screensavers/xlockmore/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "xlockmore";
-  version = "5.68";
+  version = "5.69";
 
   src = fetchurl {
     url = "http://sillycycle.com/xlock/xlockmore-${version}.tar.xz";
-    sha256 = "sha256-MHMf3LID8W61wcQ8BdQuRSrQ60VVyXxVVmpuyxh3zW4=";
+    sha256 = "sha256-6pJlTAASJoSHZaJRpzvLxHPM7xe3IcwY1TYfWdvW07k=";
     curlOpts = "--user-agent 'Mozilla/5.0'";
   };
 
diff --git a/pkgs/os-specific/linux/audit/default.nix b/pkgs/os-specific/linux/audit/default.nix
index 9fd24eea6d9..de71b7d8c3e 100644
--- a/pkgs/os-specific/linux/audit/default.nix
+++ b/pkgs/os-specific/linux/audit/default.nix
@@ -3,11 +3,10 @@
   runCommand,
   autoreconfHook,
   autoconf, automake, libtool,
-  enablePython ? false, python ? null,
+  enablePython ? true, python3, swig,
+  linuxHeaders ? stdenv.cc.libc.linuxHeaders
 }:
 
-assert enablePython -> python != null;
-
 stdenv.mkDerivation rec {
   pname = "audit";
   version = "2.8.5"; # at the next release, remove the patches below!
@@ -21,7 +20,7 @@ stdenv.mkDerivation rec {
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [ autoreconfHook ];
-  buildInputs = lib.optional enablePython python;
+  buildInputs = lib.optionals enablePython [ python3 swig ];
 
   configureFlags = [
     # z/OS plugin is not useful on Linux,
@@ -69,8 +68,11 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  prePatch = ''
+  postPatch = ''
     sed -i 's,#include <sys/poll.h>,#include <poll.h>\n#include <limits.h>,' audisp/audispd.c
+    substituteInPlace bindings/swig/src/auditswig.i \
+      --replace "/usr/include/linux/audit.h" \
+                "${linuxHeaders}/include/linux/audit.h"
   ''
   # According to https://stackoverflow.com/questions/13089166
   # --whole-archive linker flag is required to be sure that linker
diff --git a/pkgs/os-specific/linux/bluez/default.nix b/pkgs/os-specific/linux/bluez/default.nix
index 5e81cf6b2c1..fb75b99f03d 100644
--- a/pkgs/os-specific/linux/bluez/default.nix
+++ b/pkgs/os-specific/linux/bluez/default.nix
@@ -22,11 +22,11 @@
   ];
 in stdenv.mkDerivation rec {
   pname = "bluez";
-  version = "5.62";
+  version = "5.63";
 
   src = fetchurl {
     url = "mirror://kernel/linux/bluetooth/${pname}-${version}.tar.xz";
-    sha256 = "sha256-OAkKW3UOF/wI0+UheO2NMlTF9L0sSIMNXBlVuI47wMI=";
+    sha256 = "sha256-k0nhHoFguz1yCDXScSUNinQk02kPUonm22/gfMZsbXY=";
   };
 
   buildInputs = [
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 671fdef2f5d..068aedf3121 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -218,6 +218,11 @@ let
       # Kernel TLS
       TLS         = whenAtLeast "4.13" module;
       TLS_DEVICE  = whenAtLeast "4.18" yes;
+
+      # infiniband
+      INFINIBAND = module;
+      INFINIBAND_IPOIB = module;
+      INFINIBAND_IPOIB_CM = yes;
     };
 
     wireless = {
@@ -719,7 +724,12 @@ let
 
       HID_ACRUX_FF       = yes;
       DRAGONRISE_FF      = yes;
+      GREENASIA_FF       = yes;
       HOLTEK_FF          = yes;
+      JOYSTICK_PSXPAD_SPI_FF = whenAtLeast "4.14" yes;
+      LOGIG940_FF        = yes;
+      NINTENDO_FF        = whenAtLeast "5.16" yes;
+      PLAYSTATION_FF     = whenAtLeast "5.12" yes;
       SONY_FF            = yes;
       SMARTJOYPLUS_FF    = yes;
       THRUSTMASTER_FF    = yes;
diff --git a/pkgs/os-specific/linux/libpsm2/default.nix b/pkgs/os-specific/linux/libpsm2/default.nix
index aeb261aaaca..070a18f6984 100644
--- a/pkgs/os-specific/linux/libpsm2/default.nix
+++ b/pkgs/os-specific/linux/libpsm2/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libpsm2";
-  version = "11.2.203";
+  version = "11.2.206";
 
   preConfigure= ''
     export UDEVDIR=$out/etc/udev
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     owner = "intel";
     repo = "opa-psm2";
     rev = "PSM2_${version}";
-    sha256 = "sha256-W5Mg5ATUARMFAy1VVpMKPar0VpbKfrkxa6bDhqVYpoc=";
+    sha256 = "sha256-HsM2OaoX+SdbIednX1MWw1M4kkkPwUs5Dm32q2H7Mg4=";
   };
 
   postInstall = ''
diff --git a/pkgs/os-specific/linux/lvm2/2_03.nix b/pkgs/os-specific/linux/lvm2/2_03.nix
index 555ff6b0dc1..73f1e9fbdee 100644
--- a/pkgs/os-specific/linux/lvm2/2_03.nix
+++ b/pkgs/os-specific/linux/lvm2/2_03.nix
@@ -1,4 +1,4 @@
 import ./common.nix {
-  version = "2.03.14";
-  sha256 = "0p5077h3z7mrr0b49ikmhlhrs4v4qb530raypk3y72ja125bqqsa";
+  version = "2.03.15";
+  sha256 = "17n9xl01by7dcbjwjnr6b4rrkp2frz8hwnjl59svsyp13sjq6llk";
 }
diff --git a/pkgs/os-specific/linux/lvm2/common.nix b/pkgs/os-specific/linux/lvm2/common.nix
index 0749292531b..0f2e6efe3a2 100644
--- a/pkgs/os-specific/linux/lvm2/common.nix
+++ b/pkgs/os-specific/linux/lvm2/common.nix
@@ -63,6 +63,7 @@ stdenv.mkDerivation rec {
   preConfigure = ''
     sed -i /DEFAULT_SYS_DIR/d Makefile.in
     sed -i /DEFAULT_PROFILE_DIR/d conf/Makefile.in
+  '' + lib.optionalString (lib.versionOlder version "2.03.15") ''
     substituteInPlace scripts/lvm2_activation_generator_systemd_red_hat.c \
       --replace /usr/bin/udevadm /run/current-system/systemd/bin/udevadm
     # https://github.com/lvmteam/lvm2/issues/36
@@ -82,7 +83,7 @@ stdenv.mkDerivation rec {
     sed -i 's|^#define LVM_CONFIGURE_LINE.*$|#define LVM_CONFIGURE_LINE "<removed>"|g' ./include/configure.h
   '';
 
-  patches = [
+  patches = lib.optionals (lib.versionOlder version "2.03.15") [
     # Musl fixes from Alpine.
     ./fix-stdio-usage.patch
     (fetchpatch {
diff --git a/pkgs/os-specific/linux/ocf-resource-agents/default.nix b/pkgs/os-specific/linux/ocf-resource-agents/default.nix
index 9c9557c7be8..8d7f2b52714 100644
--- a/pkgs/os-specific/linux/ocf-resource-agents/default.nix
+++ b/pkgs/os-specific/linux/ocf-resource-agents/default.nix
@@ -1,3 +1,5 @@
+# This combines together OCF definitions from other derivations.
+# https://github.com/ClusterLabs/resource-agents/blob/master/doc/dev-guides/ra-dev-guide.asc
 { stdenv
 , lib
 , runCommand
@@ -8,12 +10,16 @@
 , python3
 , glib
 , drbd
+, pacemaker
 }:
 
 let
   drbdForOCF = drbd.override {
     forOCF = true;
   };
+  pacemakerForOCF = pacemaker.override {
+    forOCF = true;
+  };
 
   resource-agentsForOCF = stdenv.mkDerivation rec {
     pname = "resource-agents";
@@ -53,4 +59,5 @@ runCommand "ocf-resource-agents" {} ''
   mkdir -p $out/usr/lib/ocf
   ${lndir}/bin/lndir -silent "${resource-agentsForOCF}/lib/ocf/" $out/usr/lib/ocf
   ${lndir}/bin/lndir -silent "${drbdForOCF}/usr/lib/ocf/" $out/usr/lib/ocf
+  ${lndir}/bin/lndir -silent "${pacemakerForOCF}/usr/lib/ocf/" $out/usr/lib/ocf
 ''
diff --git a/pkgs/os-specific/linux/oci-seccomp-bpf-hook/default.nix b/pkgs/os-specific/linux/oci-seccomp-bpf-hook/default.nix
index 511dd162785..1952d31b024 100644
--- a/pkgs/os-specific/linux/oci-seccomp-bpf-hook/default.nix
+++ b/pkgs/os-specific/linux/oci-seccomp-bpf-hook/default.nix
@@ -10,12 +10,12 @@
 
 buildGoModule rec {
   pname = "oci-seccomp-bpf-hook";
-  version = "1.2.3";
+  version = "1.2.5";
   src = fetchFromGitHub {
     owner = "containers";
     repo = "oci-seccomp-bpf-hook";
     rev = "v${version}";
-    sha256 = "sha256-EKD6tkdQCPlVlb9ScvRwDxYAtbbv9PIqBHH6SvtPDsE=";
+    sha256 = "sha256-PU7WX5RAV6wWVRsqq6MdEjr00AtlTT4cSacRaxrEF2s=";
   };
   vendorSha256 = null;
 
diff --git a/pkgs/os-specific/linux/tuigreet/default.nix b/pkgs/os-specific/linux/tuigreet/default.nix
index 581b89fb1c6..95de5b8c8d9 100644
--- a/pkgs/os-specific/linux/tuigreet/default.nix
+++ b/pkgs/os-specific/linux/tuigreet/default.nix
@@ -17,7 +17,7 @@ rustPlatform.buildRustPackage rec {
   cargoSha256 = "sha256-H5xqk7Yd3M8sFGHlmhAS0fhh3eM4dkvkNQGVxRSXUJs=";
 
   meta = with lib; {
-    description = "Graphical console greter for greetd";
+    description = "Graphical console greeter for greetd";
     homepage = "https://github.com/apognu/tuigreet";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ luc65r ivar ];
diff --git a/pkgs/os-specific/linux/udisks/2-default.nix b/pkgs/os-specific/linux/udisks/2-default.nix
index fd321d90cb2..427e19ac921 100644
--- a/pkgs/os-specific/linux/udisks/2-default.nix
+++ b/pkgs/os-specific/linux/udisks/2-default.nix
@@ -25,9 +25,11 @@ stdenv.mkDerivation rec {
       blkid = "${util-linux}/bin/blkid";
       false = "${coreutils}/bin/false";
       mdadm = "${mdadm}/bin/mdadm";
+      mkswap = "${util-linux}/bin/mkswap";
       sed = "${gnused}/bin/sed";
       sh = "${bash}/bin/sh";
       sleep = "${coreutils}/bin/sleep";
+      swapon = "${util-linux}/bin/swapon";
       true = "${coreutils}/bin/true";
     })
     (substituteAll {
@@ -77,7 +79,7 @@ stdenv.mkDerivation rec {
     description = "A daemon, tools and libraries to access and manipulate disks, storage devices and technologies";
     homepage = "https://www.freedesktop.org/wiki/Software/udisks/";
     license = with licenses; [ lgpl2Plus gpl2Plus ]; # lgpl2Plus for the library, gpl2Plus for the tools & daemon
-    maintainers = with maintainers; [ johnazoidberg ];
+    maintainers = teams.freedesktop.members ++ (with maintainers; [ johnazoidberg ]);
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/udisks/fix-paths.patch b/pkgs/os-specific/linux/udisks/fix-paths.patch
index 215df565ecc..30bc08da8cf 100644
--- a/pkgs/os-specific/linux/udisks/fix-paths.patch
+++ b/pkgs/os-specific/linux/udisks/fix-paths.patch
@@ -1,17 +1,5 @@
-diff --git a/Makefile.am b/Makefile.am
-index 56922b79..697f8c6e 100644
---- a/Makefile.am
-+++ b/Makefile.am
-@@ -1,6 +1,6 @@
- ## Process this file with automake to produce Makefile.in
- 
--SHELL = @BASH@
-+SHELL = @bash@
- .SHELLFLAGS = -o pipefail -c
- 
- PYTHON ?= python3
 diff --git a/data/80-udisks2.rules b/data/80-udisks2.rules
-index 39bfa28b..ee1ca90a 100644
+index ca802cce..bfd1c29e 100644
 --- a/data/80-udisks2.rules
 +++ b/data/80-udisks2.rules
 @@ -17,9 +17,9 @@ ENV{DM_UDEV_DISABLE_OTHER_RULES_FLAG}=="?*", GOTO="udisks_probe_end"
@@ -66,9 +54,27 @@ index e7df4ed2..ab4356d9 100644
  # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  #
 diff --git a/src/tests/integration-test b/src/tests/integration-test
-index 4499a6a9..8b711f95 100755
+index 07e4e029..3bd8ec51 100755
 --- a/src/tests/integration-test
 +++ b/src/tests/integration-test
+@@ -299,7 +299,7 @@ class UDisksTestCase(unittest.TestCase):
+         if not device:
+             device = cls.devname(partition)
+         result = {}
+-        cmd = subprocess.Popen(['blkid', '-p', '-o', 'udev', device], stdout=subprocess.PIPE)
++        cmd = subprocess.Popen(['@blkid@', '-p', '-o', 'udev', device], stdout=subprocess.PIPE)
+         for l in cmd.stdout:
+             (key, value) = l.decode('UTF-8').split('=', 1)
+             result[key] = value.strip()
+@@ -437,7 +437,7 @@ class UDisksTestCase(unittest.TestCase):
+                 f.write('KERNEL=="sr*", ENV{DISK_EJECT_REQUEST}!="?*", '
+                         'ATTRS{model}=="scsi_debug*", '
+                         'ENV{ID_CDROM_MEDIA}=="?*", '
+-                        'IMPORT{program}="/sbin/blkid -o udev -p -u noraid $tempnode"\n')
++                        'IMPORT{program}="@blkid@ -o udev -p -u noraid $tempnode"\n')
+             # reload udev
+             subprocess.call('sync; pkill --signal HUP udevd || '
+                             'pkill --signal HUP systemd-udevd',
 @@ -1142,7 +1142,7 @@ class FS(UDisksTestCase):
          self.assertFalse(os.access(f, os.X_OK))
  
@@ -150,6 +156,3 @@ index 3ddbdf2c..a87f960a 100644
    udisks_spawned_job_start (job);
    g_object_unref (job);
  }
--- 
-2.33.1
-
diff --git a/pkgs/os-specific/linux/util-linux/default.nix b/pkgs/os-specific/linux/util-linux/default.nix
index 8485565e0a8..bedd2417e7e 100644
--- a/pkgs/os-specific/linux/util-linux/default.nix
+++ b/pkgs/os-specific/linux/util-linux/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "util-linux";
-  version = "2.37.3";
+  version = "2.37.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/util-linux/v${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-WQxZLljNa/OFGctGevBc5qGrGAQOPjQY8kvPsvVfl3Y=";
+    sha256 = "sha256-Y05pFq2RM2bDU2tkaOeER2lUm5mnsr+AMU3nirVlW4M=";
   };
 
   patches = [
diff --git a/pkgs/os-specific/linux/v4l-utils/default.nix b/pkgs/os-specific/linux/v4l-utils/default.nix
index 90a052fdef9..3fdd9e791bd 100644
--- a/pkgs/os-specific/linux/v4l-utils/default.nix
+++ b/pkgs/os-specific/linux/v4l-utils/default.nix
@@ -12,11 +12,11 @@ let
 # we need to use stdenv.mkDerivation in order not to pollute the libv4l’s closure with Qt
 in stdenv.mkDerivation rec {
   pname = "v4l-utils";
-  version = "1.20.0";
+  version = "1.22.1";
 
   src = fetchurl {
     url = "https://linuxtv.org/downloads/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "1xr66y6w422hil6s7n8d61a2vhwh4im8l267amf41jvw7xqihqcm";
+    hash = "sha256-Zcb76DCkTKEFxEOwJxgsGyyQU6kdHnKthJ36s4i5TjE=";
   };
 
   outputs = [ "out" ] ++ lib.optional withUtils "lib" ++ [ "dev" ];
@@ -40,14 +40,16 @@ in stdenv.mkDerivation rec {
   propagatedBuildInputs = [ libjpeg ];
 
   postPatch = ''
-    patchShebangs utils/cec-ctl/msg2ctl.pl
-    patchShebangs utils/libcecutil/cec-gen.pl
+    patchShebangs utils/
   '';
 
+  enableParallelBuilding = true;
+
   meta = with lib; {
     description = "V4L utils and libv4l, provide common image formats regardless of the v4l device";
     homepage = "https://linuxtv.org/projects.php";
-    license = licenses.lgpl21Plus;
+    changelog = "https://git.linuxtv.org/v4l-utils.git/plain/ChangeLog?h=v4l-utils-${version}";
+    license = with licenses; [ lgpl21Plus gpl2Plus ];
     maintainers = with maintainers; [ codyopel ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/servers/corosync/default.nix b/pkgs/servers/corosync/default.nix
index df73fb9f48e..4df8a547dff 100644
--- a/pkgs/servers/corosync/default.nix
+++ b/pkgs/servers/corosync/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, makeWrapper, pkg-config, kronosnet, nss, nspr, libqb
-, dbus, rdma-core, libstatgrab, net-snmp
+, systemd, dbus, rdma-core, libstatgrab, net-snmp
 , enableDbus ? false
 , enableInfiniBandRdma ? false
 , enableMonitoring ? false
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ makeWrapper pkg-config ];
 
   buildInputs = [
-    kronosnet nss nspr libqb
+    kronosnet nss nspr libqb systemd.dev
   ] ++ optional enableDbus dbus
     ++ optional enableInfiniBandRdma rdma-core
     ++ optional enableMonitoring libstatgrab
@@ -32,6 +32,8 @@ stdenv.mkDerivation rec {
     "--with-logdir=/var/log/corosync"
     "--enable-watchdog"
     "--enable-qdevices"
+    # allows Type=notify in the systemd service
+    "--enable-systemd"
   ] ++ optional enableDbus "--enable-dbus"
     ++ optional enableInfiniBandRdma "--enable-rdma"
     ++ optional enableMonitoring "--enable-monitoring"
@@ -63,6 +65,10 @@ stdenv.mkDerivation rec {
       --prefix PATH ":" "$out/sbin:${libqb}/sbin"
   '';
 
+  passthru.tests = {
+    inherit (nixosTests) pacemaker;
+  };
+
   meta = {
     homepage = "http://corosync.org/";
     description = "A Group Communication System with features for implementing high availability within applications";
diff --git a/pkgs/servers/dns/coredns/default.nix b/pkgs/servers/dns/coredns/default.nix
index 7e6347e9ba3..5c20134180f 100644
--- a/pkgs/servers/dns/coredns/default.nix
+++ b/pkgs/servers/dns/coredns/default.nix
@@ -13,12 +13,19 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-Vxs+k4WF55xwjgdlW/1NM4NWnYqj2EOLOONflj+BoY4=";
 
-  doCheck = false;
+  postPatch = ''
+    substituteInPlace test/file_cname_proxy_test.go \
+      --replace "TestZoneExternalCNAMELookupWithProxy" \
+                "SkipZoneExternalCNAMELookupWithProxy"
+
+    substituteInPlace test/readme_test.go \
+      --replace "TestReadme" "SkipReadme"
+  '';
 
   meta = with lib; {
     homepage = "https://coredns.io";
     description = "A DNS server that runs middleware";
     license = licenses.asl20;
-    maintainers = with maintainers; [ rushmorem rtreffer deltaevo ];
+    maintainers = with maintainers; [ rushmorem rtreffer deltaevo superherointj ];
   };
 }
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 98b6dff3681..9e7fc76e4e3 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -37,8 +37,11 @@ let
         version = "0.3.0";
         src = oldAttrs.src.override {
           inherit version;
-          sha256 = "0kx4mbs9bflycd8x9af0idcjhdgnzri3nw1qb0vpfyb3751qaaf9";
+          hash = "sha256-ySmFQzljeXc3WDhwO2L+9jUoWYvAqdRRY566lfSqpE8=";
         };
+        propagatedBuildInputs = with python3.pkgs; [ aiohttp pytest ];
+        doCheck = false;
+        patches = [];
       });
       aiohomekit = super.aiohomekit.overridePythonAttrs (oldAttrs: {
         doCheck = false; # requires aiohttp>=1.0.0
@@ -46,6 +49,9 @@ let
       hass-nabucasa = super.hass-nabucasa.overridePythonAttrs (oldAttrs: {
         doCheck = false; # requires aiohttp>=1.0.0
       });
+      snitun = super.snitun.overridePythonAttrs (oldAttrs: {
+        doCheck = false; # requires aiohttp>=1.0.0
+      });
       zwave-js-server-python = super.zwave-js-server-python.overridePythonAttrs (oldAttrs: {
         doCheck = false; # requires aiohttp>=1.0.0
       });
diff --git a/pkgs/servers/http/apache-httpd/2.4.nix b/pkgs/servers/http/apache-httpd/2.4.nix
index 56d66a2e99c..d72dcb9170b 100644
--- a/pkgs/servers/http/apache-httpd/2.4.nix
+++ b/pkgs/servers/http/apache-httpd/2.4.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, perl, zlib, apr, aprutil, pcre, libiconv, lynx
+{ lib, stdenv, fetchurl, perl, zlib, apr, aprutil, pcre2, libiconv, lynx, which
 , nixosTests
 , proxySupport ? true
 , sslSupport ? true, openssl
@@ -11,17 +11,19 @@
 
 stdenv.mkDerivation rec {
   pname = "apache-httpd";
-  version = "2.4.52";
+  version = "2.4.53";
 
   src = fetchurl {
     url = "mirror://apache/httpd/httpd-${version}.tar.bz2";
-    sha256 = "sha256-ASf33El+mYPpxRR0vtdeRWB/L4cKdnWobckK9tVy9ck=";
+    sha256 = "sha256-0LvREhpXtfKm/5LXuW+AUMWkXT8U2xGPZJedUlhY22M=";
   };
 
   # FIXME: -dev depends on -doc
   outputs = [ "out" "dev" "man" "doc" ];
   setOutputFlags = false; # it would move $out/modules, etc.
 
+  nativeBuildInputs = [ which ];
+
   buildInputs = [ perl ] ++
     lib.optional brotliSupport brotli ++
     lib.optional sslSupport openssl ++
@@ -42,7 +44,7 @@ stdenv.mkDerivation rec {
     "--with-apr=${apr.dev}"
     "--with-apr-util=${aprutil.dev}"
     "--with-z=${zlib.dev}"
-    "--with-pcre=${pcre.dev}"
+    "--with-pcre=${pcre2.dev}/bin/pcre2-config"
     "--disable-maintainer-mode"
     "--disable-debugger-mode"
     "--enable-mods-shared=all"
diff --git a/pkgs/servers/nextcloud/default.nix b/pkgs/servers/nextcloud/default.nix
index 735bfdeafb1..d9a4465a10a 100644
--- a/pkgs/servers/nextcloud/default.nix
+++ b/pkgs/servers/nextcloud/default.nix
@@ -33,23 +33,18 @@ let
     };
   };
 in {
-  nextcloud20 = throw ''
-    Nextcloud v20 has been removed from `nixpkgs` as the support for it was dropped
-    by upstream in 2021-10. Please upgrade to at least Nextcloud v21 by declaring
+  nextcloud21 = throw ''
+    Nextcloud v21 has been removed from `nixpkgs` as the support for it was dropped
+    by upstream in 2022-02. Please upgrade to at least Nextcloud v22 by declaring
 
-        services.nextcloud.package = pkgs.nextcloud21;
+        services.nextcloud.package = pkgs.nextcloud22;
 
     in your NixOS config.
 
-    WARNING: if you were on Nextcloud 19 on NixOS 21.05 you have to upgrade to Nextcloud 20
-    first on 21.05 because Nextcloud doesn't support upgrades accross multiple major versions!
+    WARNING: if you were on Nextcloud 20 on NixOS 21.11 you have to upgrade to Nextcloud 21
+    first on 21.11 because Nextcloud doesn't support upgrades accross multiple major versions!
   '';
 
-  nextcloud21 = generic {
-    version = "21.0.9";
-    sha256 = "sha256-p6bvgTXmmjGN3TRQpG88f3YPksh0QzWG9j9KnEjcrqE=";
-  };
-
   nextcloud22 = generic {
     version = "22.2.5";
     sha256 = "sha256-gb5N0u5tu4/nI2xIpjXwm2hiSDCrBhIDyN6gKGOsdS8=";
diff --git a/pkgs/servers/piping-server-rust/default.nix b/pkgs/servers/piping-server-rust/default.nix
index 7cf9442f13b..8885179de4d 100644
--- a/pkgs/servers/piping-server-rust/default.nix
+++ b/pkgs/servers/piping-server-rust/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "piping-server-rust";
-  version = "0.12.0";
+  version = "0.12.1";
 
   src = fetchFromGitHub {
     owner = "nwtgck";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-eDO2y/4660IAcD9vf1Vt6t3nv3Rc+zCRRFBbW/FeKIw=";
+    sha256 = "sha256-L15ofIM5a/qoJHGXmkuTsmQLLmERG/PxAJ4+z1nn7w4=";
   };
 
-  cargoSha256 = "sha256-U68R543l28osPe0DjuERqB/G6ur/BZDpWMZIO9RObaM=";
+  cargoSha256 = "sha256-CcIM7T7P4LbPxPK1ZqoJRP0IsLMEwMZg9DcuRu0aJHM=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ CoreServices Security ];
 
diff --git a/pkgs/servers/sabnzbd/default.nix b/pkgs/servers/sabnzbd/default.nix
index 2dc2d76c891..764c61356f3 100644
--- a/pkgs/servers/sabnzbd/default.nix
+++ b/pkgs/servers/sabnzbd/default.nix
@@ -24,14 +24,14 @@ let
   ]);
   path = lib.makeBinPath [ par2cmdline unrar unzip p7zip ];
 in stdenv.mkDerivation rec {
-  version = "3.5.1";
+  version = "3.5.2";
   pname = "sabnzbd";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "sha256-/HakjY0/oGq3lt0kM5p9n3sZ4g/UDtUNyXNpl9zTFl8=";
+    sha256 = "sha256-dGmZxnrxuUj6HwFI5QkSy9FnGYQpsNPFbUKXoJWpDfM=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index 0af47ccca83..0998ddb573d 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -202,9 +202,9 @@ let
 in self: {
 
   postgresql_10 = self.callPackage generic {
-    version = "10.19";
+    version = "10.20";
     psqlSchema = "10.0"; # should be 10, but changing it is invasive
-    sha256 = "sha256-brgwtCi2DoSuh+IENrzmecTZ0CAr567A5BsMZ9kTQjk=";
+    sha256 = "sha256-h94W1ZvP5C+mBcMSxZvl4pToo+astlXdetR8u5MKZZ8=";
     this = self.postgresql_10;
     thisAttr = "postgresql_10";
     inherit self;
@@ -212,36 +212,36 @@ in self: {
   };
 
   postgresql_11 = self.callPackage generic {
-    version = "11.14";
+    version = "11.15";
     psqlSchema = "11.1"; # should be 11, but changing it is invasive
-    sha256 = "sha256-llx/S+lvtk+VgYUsWMTwXDgS1K2CPA8+K9/nd8Fi+Zk=";
+    sha256 = "sha256-yPWOjr1PRWf0+boQMus+meAlHYfL4+VktIVZDjeoeeM=";
     this = self.postgresql_11;
     thisAttr = "postgresql_11";
     inherit self;
   };
 
   postgresql_12 = self.callPackage generic {
-    version = "12.9";
+    version = "12.10";
     psqlSchema = "12";
-    sha256 = "sha256-if2i3jPtBKmFSOQ/PuXxW4gr4XUF1jH+DdGlQKK1bc4=";
+    sha256 = "sha256-g90ZLmA0lRGSuahtwZzzcXqLghIOLxGgo2cjyCDSslc=";
     this = self.postgresql_12;
     thisAttr = "postgresql_12";
     inherit self;
   };
 
   postgresql_13 = self.callPackage generic {
-    version = "13.5";
+    version = "13.6";
     psqlSchema = "13";
-    sha256 = "sha256-m4EGelXtuqvEGKrO9FfdhHdkKCdJlWCwBhWm6mwT9rM=";
+    sha256 = "sha256-uvx/o9nU2o/nG4TGO6i9/oCSk1wwwKqFwkssCFCPZ/w=";
     this = self.postgresql_13;
     thisAttr = "postgresql_13";
     inherit self;
   };
 
   postgresql_14 = self.callPackage generic {
-    version = "14.1";
+    version = "14.2";
     psqlSchema = "14";
-    sha256 = "sha256-TTwQHqeuOJgvBr3HN1i1Nyf7ZALs2TggBvpezHwspB8=";
+    sha256 = "sha256-LPeLLkaJEvgQHWldtTQM8xPC6faKYS+3FCdSToyal3o=";
     this = self.postgresql_14;
     thisAttr = "postgresql_14";
     inherit self;
diff --git a/pkgs/shells/bash/bash-5.1-patches.nix b/pkgs/shells/bash/bash-5.1-patches.nix
index e6e9461bcbe..41eb9271058 100644
--- a/pkgs/shells/bash/bash-5.1-patches.nix
+++ b/pkgs/shells/bash/bash-5.1-patches.nix
@@ -13,4 +13,8 @@ patch: [
 (patch "010" "0amfmvbzsand7bdypylkjdpcp88fa3cplfshn7vyzv2ff2rdgj52")
 (patch "011" "0yq24abb4fzfxqnwl20b330sxl9lr9ds0nc4yi30f81l94b1y6aq")
 (patch "012" "165bff97ffih49vfs4mkr5w3z5gn1w6zfyrf773iajkw6v48kw8h")
+(patch "013" "1bfmgv3lagbk3aq9a831d29xv7jz4sjq7jhn9hq89limyinvdb67")
+(patch "014" "1l43dw4kpddn7l41i8wmj406z9abxky1wb3rk8krcys33g4f0kka")
+(patch "015" "1w40vzadzx019v0zhs4q6yqycrk04x1k8xs6qb73vk7ny4p6jdqv")
+(patch "016" "0krqqljz4bkp9wrdnwfx51bxkb8rkwf8ivc93as1znx5fr7i96c8")
 ]
diff --git a/pkgs/shells/fish/default.nix b/pkgs/shells/fish/default.nix
index 622521781c1..e320b920cfa 100644
--- a/pkgs/shells/fish/default.nix
+++ b/pkgs/shells/fish/default.nix
@@ -134,7 +134,7 @@ let
 
   fish = stdenv.mkDerivation rec {
     pname = "fish";
-    version = "3.3.1";
+    version = "3.4.0";
 
     src = fetchurl {
       # There are differences between the release tarball and the tarball GitHub
@@ -144,11 +144,9 @@ let
       # --version`), as well as the local documentation for all builtins (and
       # maybe other things).
       url = "https://github.com/fish-shell/fish-shell/releases/download/${version}/${pname}-${version}.tar.xz";
-      sha256 = "sha256-tbTuGlJpdiy76ZOkvWUH5nXkEAzpu+hCFKXusrGfrok=";
+      sha256 = "sha256-tbSKuEhrGe9xajL39GuIuepTVhVfDpZ+6Z9Ak2RUE8U=";
     };
 
-    patches = [ ./tests-pcre2-update.patch ]; # should be included in >= 3.4
-
     # Fix FHS paths in tests
     postPatch = ''
       # src/fish_tests.cpp
@@ -182,6 +180,10 @@ let
       rm tests/pexpects/exit.py
       rm tests/pexpects/job_summary.py
       rm tests/pexpects/signals.py
+    '' + lib.optionalString (stdenv.isLinux && stdenv.isAarch64) ''
+      # pexpect tests are flaky on aarch64-linux
+      # See https://github.com/fish-shell/fish-shell/issues/8789
+      rm tests/pexpects/exit_handlers.py
     '';
 
     nativeBuildInputs = [
diff --git a/pkgs/shells/fish/tests-pcre2-update.patch b/pkgs/shells/fish/tests-pcre2-update.patch
deleted file mode 100644
index 5e0c327c540..00000000000
--- a/pkgs/shells/fish/tests-pcre2-update.patch
+++ /dev/null
@@ -1,7 +0,0 @@
-Adapted formating to 3.3.1 from
-https://github.com/fish-shell/fish-shell/commit/ec8844d834cc9fe626e9fc326c6f5410341d532a
---- a/src/fish_tests.cpp
-+++ b/src/fish_tests.cpp
-@@ -5726,2 +5725,0 @@
--        {{L"string", L"match", L"-r", L"(?=ab\\K)", L"ab", 0}, STATUS_CMD_OK, L"\n"},
--        {{L"string", L"match", L"-r", L"(?=ab\\K)..(?=cd\\K)", L"abcd", 0}, STATUS_CMD_OK, L"\n"},
diff --git a/pkgs/shells/hilbish/default.nix b/pkgs/shells/hilbish/default.nix
index 08ee5d664fa..c3f5d3516cb 100644
--- a/pkgs/shells/hilbish/default.nix
+++ b/pkgs/shells/hilbish/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "hilbish";
-  version = "1.0.2";
+  version = "1.0.4";
 
   src = fetchFromGitHub {
     owner = "Rosettea";
     repo = "Hilbish";
     rev = "v${version}";
-    sha256 = "sha256-BsN2v6OEWOtk8ENKr5G+lSmNIUA89VfpO+QQoBizx9g=";
+    sha256 = "sha256-JVAyE6iSfRres2YalQF3CWK5Jtn5HoW6p6RHVbwzoVQ=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/test/make-wrapper/default.nix b/pkgs/test/make-wrapper/default.nix
index 6e70945ee19..62ccd272adf 100644
--- a/pkgs/test/make-wrapper/default.nix
+++ b/pkgs/test/make-wrapper/default.nix
@@ -64,6 +64,7 @@ runCommand "make-wrapper-test"
     (mkWrapperBinary { name = "test-run-and-set"; args = [ "--run" "export VAR=foo" "--set" "VAR" "bar" ]; })
     (mkWrapperBinary { name = "test-args"; args = [ "--add-flags" "abc" ]; wrapped = wrappedBinaryArgs; })
     (mkWrapperBinary { name = "test-prefix"; args = [ "--prefix" "VAR" ":" "abc" ]; })
+    (mkWrapperBinary { name = "test-prefix-noglob"; args = [ "--prefix" "VAR" ":" "./*" ]; })
     (mkWrapperBinary { name = "test-suffix"; args = [ "--suffix" "VAR" ":" "abc" ]; })
     (mkWrapperBinary { name = "test-prefix-and-suffix"; args = [ "--prefix" "VAR" ":" "foo" "--suffix" "VAR" ":" "bar" ]; })
     (mkWrapperBinary { name = "test-prefix-multi"; args = [ "--prefix" "VAR" ":" "abc:foo:foo" ]; })
@@ -112,6 +113,8 @@ runCommand "make-wrapper-test"
     # Only append the value once when given multiple times in a parameter
     # to makeWrapper
     + mkTest "test-prefix" "VAR=abc"
+    # --prefix doesn't expand globs
+    + mkTest "VAR=f?oo test-prefix-noglob" "VAR=./*:f?oo"
 
 
     # --suffix works
diff --git a/pkgs/tools/admin/berglas/default.nix b/pkgs/tools/admin/berglas/default.nix
index 8a6bb559041..bf86a5c02ec 100644
--- a/pkgs/tools/admin/berglas/default.nix
+++ b/pkgs/tools/admin/berglas/default.nix
@@ -1,19 +1,44 @@
 { lib, buildGoModule, fetchFromGitHub }:
 
+let
+  skipTests = {
+    access = "Access";
+    create = "Create";
+    delete = "Delete";
+    list = "List";
+    read = "Read";
+    replace = "Replace";
+    resolver = "Resolve";
+    revoke = "Revoke";
+    update = "Update";
+  };
+
+  skipTestsCommand =
+    builtins.foldl' (acc: goFileName:
+      let testName = builtins.getAttr goFileName skipTests; in
+      ''
+        ${acc}
+        substituteInPlace pkg/berglas/${goFileName}_test.go \
+          --replace "TestClient_${testName}_storage" "SkipClient_${testName}_storage" \
+          --replace "TestClient_${testName}_secretManager" "SkipClient_${testName}_secretManager"
+      ''
+    ) "" (builtins.attrNames skipTests);
+in
+
 buildGoModule rec {
   pname = "berglas";
-  version = "0.5.1";
+  version = "0.6.2";
 
   src = fetchFromGitHub {
     owner = "GoogleCloudPlatform";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0y393g36h35zzqyf5b10j6qq2jhvz83j17cmasnv6wbyrb3vnn0n";
+    sha256 = "sha256-aLsrrK+z080qn7L2zggA8yD+QqLaSRJLTjWQnFKFogQ=";
   };
 
-  vendorSha256 = null;
+  vendorSha256 = "sha256-HjZT0jezJzoEvXuzrjoTv/zSex+xDuGoP1h82CIlX14=";
 
-  doCheck = false;
+  postPatch = skipTestsCommand;
 
   meta = with lib; {
     description = "A tool for managing secrets on Google Cloud";
diff --git a/pkgs/tools/admin/exoscale-cli/default.nix b/pkgs/tools/admin/exoscale-cli/default.nix
index 529871683f6..6cb52ccd135 100644
--- a/pkgs/tools/admin/exoscale-cli/default.nix
+++ b/pkgs/tools/admin/exoscale-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoPackage rec {
   pname = "exoscale-cli";
-  version = "1.51.1";
+  version = "1.51.2";
 
   src = fetchFromGitHub {
     owner  = "exoscale";
     repo   = "cli";
     rev    = "v${version}";
-    sha256 = "sha256-NU4xJTW0KCi8PZAY4cRJijGHCZEn5Z41xNF7+iH01oo=";
+    sha256 = "sha256-Nx9lASZOEetkADVEs2JxPRi9SCrb4SLnEpLpzcpp/Is=";
   };
 
   goPackagePath = "github.com/exoscale/cli";
diff --git a/pkgs/tools/admin/fits-cloudctl/default.nix b/pkgs/tools/admin/fits-cloudctl/default.nix
index b506d1d678f..f53315613e7 100644
--- a/pkgs/tools/admin/fits-cloudctl/default.nix
+++ b/pkgs/tools/admin/fits-cloudctl/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "fits-cloudctl";
-  version = "0.10.11";
+  version = "0.10.12";
 
   src = fetchFromGitHub {
     owner = "fi-ts";
     repo = "cloudctl";
     rev = "v${version}";
-    sha256 = "sha256-hGKnQk2OPpHsjbRh/xx3MidbUMio6tYn+oJB0t1a/yM=";
+    sha256 = "sha256-nFxudeJJ5BkfZxSnRquyATHyHwI+7xwfQxiY8cedtis=";
   };
 
   vendorSha256 = "sha256-f35Asf9l6ZfixpjMGzesTsxmANreilMxH2CULMH3b2o=";
diff --git a/pkgs/tools/admin/syft/default.nix b/pkgs/tools/admin/syft/default.nix
index d4d5ee7348b..43d9a628787 100644
--- a/pkgs/tools/admin/syft/default.nix
+++ b/pkgs/tools/admin/syft/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "syft";
-  version = "0.41.1";
+  version = "0.41.4";
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-6ltEC9LCuE4Rj4TlBwsDI45L92XMuCbEuMDkOk8OkZo=";
+    sha256 = "sha256-QRT5wvud9VMtXQ8QPC7joIMq7kYYlfVUSgzqMFW5LIE=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -22,7 +22,7 @@ buildGoModule rec {
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
-  vendorSha256 = "sha256-13PcAQlHPaQ1n7OiRSEW5H3rDXgUAmKAQGqQM31iyR8=";
+  vendorSha256 = "sha256-9/Mtjqny68HN4FItT2+yoknzdHBAS1aQL0VkTdm6624=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/admin/trivy/default.nix b/pkgs/tools/admin/trivy/default.nix
index 00fa4cc6d65..c0e021cfa32 100644
--- a/pkgs/tools/admin/trivy/default.nix
+++ b/pkgs/tools/admin/trivy/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "trivy";
-  version = "0.24.2";
+  version = "0.24.3";
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-xMLSou+8kIQVEJlkA7ygv623hvETcEAdyFPR3HJr5ZQ=";
+    sha256 = "sha256-8ozoSorVoYt5C4F2FgEwGYQErBVnoTt2FhxiC3/SGsA=";
   };
 
-  vendorSha256 = "sha256-qRkxDvrqMVOsz5r3m3I+E0HAVoUwFykkfGzTz9Qc/S4=";
+  vendorSha256 = "sha256-HM4SxCvvHz7MZsHa8+Orx1KKCRhyZH28JlN9wW+/xIw=";
 
   excludedPackages = "misc";
 
diff --git a/pkgs/tools/archivers/p7zip/default.nix b/pkgs/tools/archivers/p7zip/default.nix
index 7f892a44da5..5e92553b636 100644
--- a/pkgs/tools/archivers/p7zip/default.nix
+++ b/pkgs/tools/archivers/p7zip/default.nix
@@ -8,7 +8,18 @@ stdenv.mkDerivation rec {
     owner  = "jinfeihan57";
     repo   = pname;
     rev    = "v${version}";
-    sha256 = "sha256-19F4hPV0nKVuFZNbOcXrcA1uW6Y3HQolaHVIYXGmh18=";
+    sha256 = {
+      free = "sha256-DrBuf2VPdcprHI6pMSmL7psm2ofOrUf0Oj0qwMjXzkk=";
+      unfree = "sha256-19F4hPV0nKVuFZNbOcXrcA1uW6Y3HQolaHVIYXGmh18=";
+    }.${if enableUnfree then "unfree" else "free"};
+    # remove the unRAR related code from the src drv
+    # > the license requires that you agree to these use restrictions,
+    # > or you must remove the software (source and binary) from your hard disks
+    # https://fedoraproject.org/wiki/Licensing:Unrar
+    extraPostFetch = lib.optionalString (!enableUnfree) ''
+      rm -r $out/CPP/7zip/Compress/Rar*
+      find $out -name makefile'*' -exec sed -i '/Rar/d' {} +
+    '';
   };
 
   # Default makefile is full of impurities on Darwin. The patch doesn't hurt Linux so I'm leaving it unconditional
@@ -25,11 +36,6 @@ stdenv.mkDerivation rec {
     substituteInPlace makefile.machine \
       --replace 'CC=gcc'  'CC=${stdenv.cc.targetPrefix}gcc' \
       --replace 'CXX=g++' 'CXX=${stdenv.cc.targetPrefix}g++'
-  '' + lib.optionalString (!enableUnfree) ''
-    # Remove non-free RAR source code
-    # (see DOC/License.txt, https://fedoraproject.org/wiki/Licensing:Unrar)
-    rm -r CPP/7zip/Compress/Rar*
-    find . -name makefile'*' -exec sed -i '/Rar/d' {} +
   '';
 
   makeFlags = [ "DEST_HOME=${placeholder "out"}" ];
@@ -46,13 +52,20 @@ stdenv.mkDerivation rec {
 
   NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=c++11-narrowing";
 
-  meta = {
+  passthru.updateScript = ./update.sh;
+
+  meta = with lib; {
     homepage = "https://github.com/jinfeihan57/p7zip";
     description = "A new p7zip fork with additional codecs and improvements (forked from https://sourceforge.net/projects/p7zip/)";
-    platforms = lib.platforms.unix;
-    maintainers = [ lib.maintainers.raskin ];
+    license = with licenses;
+      # p7zip code is largely lgpl2Plus
+      # CPP/7zip/Compress/LzfseDecoder.cpp is bsd3
+      [ lgpl2Plus /* and */ bsd3 ] ++
+      # and CPP/7zip/Compress/Rar* are unfree with the unRAR license restriction
+      # the unRAR compression code is disabled by default
+      lib.optionals enableUnfree [ unfree ];
+    maintainers = with maintainers; [ raskin jk ];
+    platforms = platforms.unix;
     mainProgram = "7z";
-    # RAR code is under non-free UnRAR license, but we remove it
-    license = if enableUnfree then lib.licenses.unfree else lib.licenses.lgpl2Plus;
   };
 }
diff --git a/pkgs/tools/archivers/p7zip/update.sh b/pkgs/tools/archivers/p7zip/update.sh
new file mode 100755
index 00000000000..0d4b91e56e8
--- /dev/null
+++ b/pkgs/tools/archivers/p7zip/update.sh
@@ -0,0 +1,47 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -i bash -p coreutils gnused curl jq
+set -euo pipefail
+cd "$(dirname "${BASH_SOURCE[0]}")"
+
+DRV_DIR="$PWD"
+
+OLD_VERSION="$(sed -nE 's/\s*version = "(.*)".*/\1/p' ./default.nix)"
+
+NEW_VERSION="$(curl https://api.github.com/repos/jinfeihan57/p7zip/releases/latest | jq .tag_name -r | tr -d 'v')"
+
+echo "comparing versions $OLD_VERSION => $NEW_VERSION"
+if [[ "$OLD_VERSION" == "$NEW_VERSION" ]]; then
+    echo "Already up to date! Doing nothing"
+    exit 0
+fi
+
+NIXPKGS_ROOT="$(realpath "$DRV_DIR/../../../..")"
+
+echo "getting free source hash"
+OLD_FREE_HASH="$(nix-instantiate --eval --strict -E "with import $NIXPKGS_ROOT {}; p7zip.src.drvAttrs.outputHash" | tr -d '"')"
+echo "getting unfree source hash"
+OLD_UNFREE_HASH="$(nix-instantiate --eval --strict -E "with import $NIXPKGS_ROOT {}; (p7zip.override { enableUnfree = true; }).src.drvAttrs.outputHash" | tr -d '"')"
+
+
+NEW_FREE_HASH=$(nix-prefetch -f "$NIXPKGS_ROOT" -E "p7zip.src" --rev "v$NEW_VERSION")
+
+NEW_UNFREE_OUT=$(nix-prefetch -f "$NIXPKGS_ROOT" -E "(p7zip.override { enableUnfree = true; }).src" --rev "v$NEW_VERSION" --output raw --print-path)
+# first line of raw output is the hash
+NEW_UNFREE_HASH="$(echo "$NEW_UNFREE_OUT" | sed -n 1p)"
+# second line of raw output is the src path
+NEW_UNFREE_SRC="$(echo "$NEW_UNFREE_OUT" | sed -n 2p)"
+# make sure to nuke the unfree src from the updater's machine
+# > the license requires that you agree to these use restrictions, or you must remove the software (source and binary) from your hard disks
+# https://fedoraproject.org/wiki/Licensing:Unrar
+nix-store --delete "$NEW_UNFREE_SRC"
+
+
+echo "updating version"
+sed -i "s/version = \"$OLD_VERSION\";/version = \"$NEW_VERSION\";/" "$DRV_DIR/default.nix"
+
+echo "updating free hash"
+sed -i "s@free = \"$OLD_FREE_HASH\";@free = \"$NEW_FREE_HASH\";@" "$DRV_DIR/default.nix"
+echo "updating unfree hash"
+sed -i "s@unfree = \"$OLD_UNFREE_HASH\";@unfree = \"$NEW_UNFREE_HASH\";@" "$DRV_DIR/default.nix"
+
+echo "done"
diff --git a/pkgs/tools/backup/btrbk/default.nix b/pkgs/tools/backup/btrbk/default.nix
index b04263a7168..d9f336c86d4 100644
--- a/pkgs/tools/backup/btrbk/default.nix
+++ b/pkgs/tools/backup/btrbk/default.nix
@@ -18,11 +18,11 @@
 
 stdenv.mkDerivation rec {
   pname = "btrbk";
-  version = "0.32.0";
+  version = "0.32.1";
 
   src = fetchurl {
     url = "https://digint.ch/download/btrbk/releases/${pname}-${version}.tar.xz";
-    sha256 = "HmvNtIgFfeaiFuSRobWlcJqusPSYtqAqx+79+CeNVDQ=";
+    sha256 = "flQf1KTybPImDoD+iNe+P+u1rOiYxXjQoltuGPWuX3g=";
   };
 
   nativeBuildInputs = [ asciidoctor makeWrapper ];
diff --git a/pkgs/tools/filesystems/btrfs-progs/default.nix b/pkgs/tools/filesystems/btrfs-progs/default.nix
index 28733f8ed77..c51cc12da36 100644
--- a/pkgs/tools/filesystems/btrfs-progs/default.nix
+++ b/pkgs/tools/filesystems/btrfs-progs/default.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "btrfs-progs";
-  version = "5.16";
+  version = "5.16.1";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/people/kdave/btrfs-progs/btrfs-progs-v${version}.tar.xz";
-    sha256 = "0cqqlcq9bywfi3cpg5ivxiv7p9v6z1r6k4nnmin24mj1kp8krarq";
+    sha256 = "sha256-PaTaU2HPhr3dqA7bTE8w6gdstOvsKZBPoIr8kw754ag=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/misc/findutils/default.nix b/pkgs/tools/misc/findutils/default.nix
index 8c8b8c7b2b4..3746c4b4657 100644
--- a/pkgs/tools/misc/findutils/default.nix
+++ b/pkgs/tools/misc/findutils/default.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "findutils";
-  version = "4.8.0";
+  version = "4.9.0";
 
   src = fetchurl {
     url = "mirror://gnu/findutils/${pname}-${version}.tar.xz";
-    sha256 = "0r3i72hnw0a30khlczi9k2c51aamaj6kfmp5mk3844nrjxz7n4jp";
+    sha256 = "sha256-or+4wJ1DZ3DtxZ9Q+kg+eFsWGjt7nVR1c8sIBl/UYv4=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/misc/license-generator/default.nix b/pkgs/tools/misc/license-generator/default.nix
new file mode 100644
index 00000000000..b880c66f971
--- /dev/null
+++ b/pkgs/tools/misc/license-generator/default.nix
@@ -0,0 +1,20 @@
+{ lib, fetchCrate, rustPlatform }:
+
+rustPlatform.buildRustPackage rec {
+    pname = "license-generator";
+    version = "0.8.1";
+
+    src = fetchCrate {
+      inherit pname version;
+      sha256 = "sha256-ZVhsbaJJ9WBcQPx2yikIAQJeBXwC6ZAJkfCRmokNV3I=";
+    };
+
+    cargoSha256 = "sha256-Yh9q/aYHXUF2eIFpJ7ccgeyIO5mQMgRDCNr+ZyS166Y=";
+
+    meta = with lib; {
+      description = "Command-line tool for generating license files";
+      homepage = "https://github.com/azu/license-generator";
+      license = licenses.mit;
+      maintainers = with maintainers; [ loicreynier ];
+    };
+}
diff --git a/pkgs/tools/misc/man-db/default.nix b/pkgs/tools/misc/man-db/default.nix
index d495c912f59..7263e4de336 100644
--- a/pkgs/tools/misc/man-db/default.nix
+++ b/pkgs/tools/misc/man-db/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "man-db";
-  version = "2.9.4";
+  version = "2.10.1";
 
   src = fetchurl {
     url = "mirror://savannah/man-db/man-db-${version}.tar.xz";
-    sha256 = "sha256-tmyZ7frRatkoyIn4fPdjgCY8FgkyPCgLOp5pY/2xZ1Y=";
+    sha256 = "sha256-L/2PLoASL+cuYMdAyFHmo+FcmnkhGF60dSwcZygkvtY=";
   };
 
   outputs = [ "out" "doc" ];
diff --git a/pkgs/tools/misc/plantuml-server/default.nix b/pkgs/tools/misc/plantuml-server/default.nix
index 8b6c52446aa..8be9c0eecee 100644
--- a/pkgs/tools/misc/plantuml-server/default.nix
+++ b/pkgs/tools/misc/plantuml-server/default.nix
@@ -1,69 +1,20 @@
-{ lib, stdenv, fetchFromGitHub, maven, jdk17_headless }:
+{ lib, stdenv, fetchurl }:
 
 let
   version = "1.2022.2";
-
-  src = fetchFromGitHub {
-    owner = "plantuml";
-    repo = "plantuml-server";
-    rev = "v${version}";
-    sha256 = "sha256-55IBhulFo42jscBFrHM39qA0GRgKBoYNye4q9QkmjsM=";
-  };
-
-  # perform fake build to make a fixed-output derivation out of the files downloaded from maven central
-  deps = stdenv.mkDerivation {
-    name = "plantuml-server-${version}-deps";
-    inherit src;
-    nativeBuildInputs = [ jdk17_headless maven ];
-    buildPhase = ''
-      runHook preBuild
-
-      while mvn package -Dmaven.repo.local=$out/.m2; [ $? = 1 ]; do
-        echo "timeout, restart maven to continue downloading"
-      done
-
-      runHook postBuild
-    '';
-    # keep only *.{pom,jar,sha1,nbm} and delete all ephemeral files with lastModified timestamps inside
-    installPhase = ''
-      find $out/.m2 -type f -regex '.+\(\.lastUpdated\|resolver-status\.properties\|_remote\.repositories\)' -delete
-    '';
-    outputHashAlgo = "sha256";
-    outputHashMode = "recursive";
-    outputHash = "sha256-AheCBX5jFzDHqTI2pCWBIiDESEKMClXlvWIcFvu0goA=";
-  };
 in
-
 stdenv.mkDerivation rec {
   pname = "plantuml-server";
   inherit version;
-  inherit src;
-
-  nativeBuildInputs = [ jdk17_headless maven ];
-
-  buildPhase = ''
-    runHook preBuild
-
-    # maven can output reproducible files after setting project.build.outputTimestamp property
-    # see https://maven.apache.org/guides/mini/guide-reproducible-builds.html#how-do-i-configure-my-maven-build
-    # 'maven.repo.local' must be writable so copy it out of nix store
-    cp -R $src repo
-    chmod +w -R repo
-    cd repo
-    mvn package --offline \
-      -Dproject.build.outputTimestamp=0 \
-      -Dmaven.repo.local=$(cp -dpR ${deps}/.m2 ./ && chmod +w -R .m2 && pwd)/.m2
-
-    runHook postBuild
-  '';
+  src = fetchurl {
+    url = "https://github.com/plantuml/plantuml-server/releases/download/v${version}/plantuml-v${version}.war";
+    sha256 = "sha256-h4ulXzZ5L+VPhk2CnZQNxfnEJzWT3B9TNvDEWt4o9Hk=";
+  };
 
+  dontUnpack = true;
   installPhase = ''
-    runHook preInstall
-
     mkdir -p "$out/webapps"
-    cp "target/plantuml.war" "$out/webapps/plantuml.war"
-
-    runHook postInstall
+    cp "$src" "$out/webapps/plantuml.war"
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/misc/up/default.nix b/pkgs/tools/misc/up/default.nix
index 47c504cd1a7..7737c67faa2 100644
--- a/pkgs/tools/misc/up/default.nix
+++ b/pkgs/tools/misc/up/default.nix
@@ -13,8 +13,6 @@ buildGoModule rec {
 
   vendorSha256 = "1q8wfsfl3rz698ck5q5s5z6iw9k134fxxvwipcp2b052n998rcrx";
 
-  doCheck = false;
-
   meta = with lib; {
     description = "Ultimate Plumber is a tool for writing Linux pipes with instant live preview";
     homepage = "https://github.com/akavel/up";
diff --git a/pkgs/tools/misc/youtube-dl/default.nix b/pkgs/tools/misc/youtube-dl/default.nix
index 4673ab41654..6b15488f5c6 100644
--- a/pkgs/tools/misc/youtube-dl/default.nix
+++ b/pkgs/tools/misc/youtube-dl/default.nix
@@ -70,13 +70,13 @@ buildPythonPackage rec {
     homepage = "https://ytdl-org.github.io/youtube-dl/";
     description = "Command-line tool to download videos from YouTube.com and other sites";
     longDescription = ''
-      youtube-dl is a small, Python-based command-line program
-      to download videos from YouTube.com and a few more sites.
-      youtube-dl is released to the public domain, which means
-      you can modify it, redistribute it or use it however you like.
+      youtube-dl is a small, Python-based command-line program to download
+      videos from YouTube.com and a few more sites.  youtube-dl is released to
+      the public domain, which means you can modify it, redistribute it or use
+      it however you like.
     '';
     license = licenses.publicDomain;
+    maintainers = with maintainers; [ bluescreen303 fpletz ma27 ];
     platforms = with platforms; linux ++ darwin;
-    maintainers = with maintainers; [ bluescreen303 AndersonTorres fpletz ma27 ];
   };
 }
diff --git a/pkgs/tools/networking/frp/default.nix b/pkgs/tools/networking/frp/default.nix
index 1ef3c13172b..e7d2752a94f 100644
--- a/pkgs/tools/networking/frp/default.nix
+++ b/pkgs/tools/networking/frp/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "frp";
-  version = "0.39.1";
+  version = "0.40.0";
 
   src = fetchFromGitHub {
     owner = "fatedier";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-tqdrYrIWbmRn+5iAZKd9GlcmFNQnh3yNxZ95As7+v5Q=";
+    sha256 = "sha256-W+88Fq9oYDBLCNp+6rc9jACJzky7FCZg/xLDowGGdm0=";
   };
 
-  vendorSha256 = "sha256-NPnchl+N6DeqMhsOIw2MYD/i2IZzHS9ZqbUOeulgb90=";
+  vendorSha256 = "sha256-iBjMFOERWQ1aPn+2gEoI9og2ov2LlBVV1sLAZlvqZPM=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/networking/hey/default.nix b/pkgs/tools/networking/hey/default.nix
index edf91dd311d..d59e58981e7 100644
--- a/pkgs/tools/networking/hey/default.nix
+++ b/pkgs/tools/networking/hey/default.nix
@@ -13,8 +13,6 @@ buildGoModule rec {
 
   vendorSha256 = null;
 
-  doCheck = false;
-
   meta = with lib; {
     description = "HTTP load generator, ApacheBench (ab) replacement";
     homepage = "https://github.com/rakyll/hey";
diff --git a/pkgs/tools/networking/pirate-get/default.nix b/pkgs/tools/networking/pirate-get/default.nix
index 112b78dcae8..9b5846d6f76 100644
--- a/pkgs/tools/networking/pirate-get/default.nix
+++ b/pkgs/tools/networking/pirate-get/default.nix
@@ -4,11 +4,11 @@ with python3Packages;
 
 buildPythonApplication rec {
   pname = "pirate-get";
-  version = "0.4.1";
+  version = "0.4.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0pr703fwinr2f4rba86zp57mpf5j2jgvp5n50rc5vy5g7yfwsddm";
+    sha256 = "sha256-VtnVyJqrdGXTqcyzpHCOMUI9G7/BkXzihDrBrsxl7Eg=";
   };
 
   propagatedBuildInputs = [ colorama veryprettytable pyperclip ];
diff --git a/pkgs/tools/networking/tcpdump/default.nix b/pkgs/tools/networking/tcpdump/default.nix
index cdb33ab1f1a..6726e5b751a 100644
--- a/pkgs/tools/networking/tcpdump/default.nix
+++ b/pkgs/tools/networking/tcpdump/default.nix
@@ -27,6 +27,5 @@ stdenv.mkDerivation rec {
     license = licenses.bsd3;
     maintainers = with maintainers; [ globin ];
     platforms = platforms.unix;
-    badPlatforms = platforms.darwin;
   };
 }
diff --git a/pkgs/tools/package-management/disnix/disnixos/default.nix b/pkgs/tools/package-management/disnix/disnixos/default.nix
index 35541fa36ac..05a9e45c956 100644
--- a/pkgs/tools/package-management/disnix/disnixos/default.nix
+++ b/pkgs/tools/package-management/disnix/disnixos/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "disnixos";
-  version = "0.9.2";
+  version = "0.9.3";
 
   src = fetchurl {
     url = "https://github.com/svanderburg/disnixos/releases/download/${pname}-${version}/${pname}-${version}.tar.gz";
-    sha256 = "0zcghb9nm911bfwpzcgj4ga2cndxbzp5pmrxff711qydrwgy7sg7";
+    sha256 = "0nm7g184xh6xzjz4a40a7kgfnpmq043x6v0cynpffa6wd9jv89s9";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/tools/package-management/disnix/dysnomia/default.nix b/pkgs/tools/package-management/disnix/dysnomia/default.nix
index 678f0a9be8b..f07aade89ca 100644
--- a/pkgs/tools/package-management/disnix/dysnomia/default.nix
+++ b/pkgs/tools/package-management/disnix/dysnomia/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchurl, netcat
 
 # Optional packages
-, systemd ? null, ejabberd ? null, mysql ? null, postgresql ? null, subversion ? null
+, systemd ? null, ejabberd ? null, mariadb ? null, postgresql ? null, subversion ? null
 , mongodb ? null, mongodb-tools ? null, influxdb ? null, supervisor ? null, docker ? null
 , nginx ? null, s6-rc ? null, xinetd ? null
 
@@ -26,7 +26,7 @@
 , getopt
 }:
 
-assert enableMySQLDatabase -> mysql != null;
+assert enableMySQLDatabase -> mariadb != null;
 assert enablePostgreSQLDatabase -> postgresql != null;
 assert enableSubversionRepository -> subversion != null;
 assert enableEjabberdDump -> ejabberd != null;
@@ -68,7 +68,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ getopt netcat ]
     ++ lib.optional stdenv.isLinux systemd
     ++ lib.optional enableEjabberdDump ejabberd
-    ++ lib.optional enableMySQLDatabase mysql.out
+    ++ lib.optional enableMySQLDatabase mariadb.out
     ++ lib.optional enablePostgreSQLDatabase postgresql
     ++ lib.optional enableSubversionRepository subversion
     ++ lib.optionals enableMongoDatabase [ mongodb mongodb-tools ]
diff --git a/pkgs/tools/security/amber/default.nix b/pkgs/tools/security/amber/default.nix
index 5fb88ca9921..c2196cea686 100644
--- a/pkgs/tools/security/amber/default.nix
+++ b/pkgs/tools/security/amber/default.nix
@@ -3,16 +3,16 @@
 rustPlatform.buildRustPackage rec {
   # Renaming it to amber-secret because another package named amber exists
   pname = "amber-secret";
-  version = "0.1.2";
+  version = "0.1.3";
 
   src = fetchFromGitHub {
     owner = "fpco";
     repo = "amber";
     rev = "v${version}";
-    sha256 = "sha256-+vipQl/HWoYnOPkQLjeIedpnnqPVYaUWhks9eCgMOxQ=";
+    sha256 = "sha256-kPDNTwsfI+8nOgsLv2aONrLGSRZhw5YzNntJ2tbE0oI=";
   };
 
-  cargoSha256 = "sha256-xWEQvCyd8auE0q9rBt9iDgU8Dscf4pq/gsAINH2eQY4=";
+  cargoSha256 = "sha256-fTdTgbeOQXEpLHq9tHiPLkttvaxS/WJ86h3jRdrfbJM=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ Security ];
 
diff --git a/pkgs/tools/security/cariddi/default.nix b/pkgs/tools/security/cariddi/default.nix
index 9f29826808d..74e9b05b237 100644
--- a/pkgs/tools/security/cariddi/default.nix
+++ b/pkgs/tools/security/cariddi/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "cariddi";
-  version = "1.1.5";
+  version = "1.1.6";
 
   src = fetchFromGitHub {
     owner = "edoardottt";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-PXQljC9rwlxXQ96fII3EjD4NXu61EMkYvMWqkcJZ4vU=";
+    sha256 = "sha256-/ez2biYU8NnVny8v5Mu9pLq0oqzcIenpyEb3qkPd9v8=";
   };
 
-  vendorSha256 = "sha256-zNUdglsfy6lEV54afCAoigxa3rR0qf/e3+B4PvVRIa4=";
+  vendorSha256 = "sha256-zJ39tAq+ooROMHG1vC2m2rbq+wttxqYxAd2hLg5GtJM=";
 
   meta = with lib; {
     description = "Crawler for URLs and endpoints";
diff --git a/pkgs/tools/security/cfripper/default.nix b/pkgs/tools/security/cfripper/default.nix
index 39b0187c4a6..822566b8d04 100644
--- a/pkgs/tools/security/cfripper/default.nix
+++ b/pkgs/tools/security/cfripper/default.nix
@@ -5,13 +5,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "cfripper";
-  version = "1.5.1";
+  version = "1.5.2";
 
   src = fetchFromGitHub {
     owner = "Skyscanner";
     repo = pname;
     rev = version;
-    hash = "sha256-/qcpLCk1ZZMKxhqK6q6sSbRDjiF5GQmDJzvCaV2kAqQ=";
+    hash = "sha256-tl0g08nnY1CZ4SNcMFPARIRquiO9SCen9VWeNalLHds=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/security/exploitdb/default.nix b/pkgs/tools/security/exploitdb/default.nix
index a50588fc1f8..4338576c75e 100644
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2022-03-11";
+  version = "2022-03-15";
 
   src = fetchFromGitHub {
     owner = "offensive-security";
     repo = pname;
     rev = version;
-    sha256 = "sha256-dW4cLm//4wROsizRQ59sqEGPRZ26yIU5I7mdPEYC3YU=";
+    sha256 = "sha256-whV7zg7njGGjUpxsXZiNwVfHgrlop2RLZnCsBWQ+HkY=";
 
   };
 
diff --git a/pkgs/tools/security/gnupg/23.nix b/pkgs/tools/security/gnupg/23.nix
index ef7a5cf85e7..e80804cd002 100644
--- a/pkgs/tools/security/gnupg/23.nix
+++ b/pkgs/tools/security/gnupg/23.nix
@@ -15,11 +15,11 @@ assert guiSupport -> pinentry != null && enableMinimal == false;
 
 stdenv.mkDerivation rec {
   pname = "gnupg";
-  version = "2.3.3";
+  version = "2.3.4";
 
   src = fetchurl {
     url = "mirror://gnupg/gnupg/${pname}-${version}.tar.bz2";
-    sha256 = "0dz9x0r5021bhk1kjh29m1q13xbslwb8yn9qzcp7b9m1lrnvi2ap";
+    sha256 = "sha256-80aOyvsdf5rXtR/R23rr8XzridLvqKBc8vObTUBUAq4=";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
@@ -34,19 +34,9 @@ stdenv.mkDerivation rec {
     ./tests-add-test-cases-for-import-without-uid.patch
     ./allow-import-of-previously-known-keys-even-without-UI.patch
     ./accept-subkeys-with-a-good-revocation-but-no-self-sig.patch
-  ] ++ lib.optional stdenv.isDarwin [
-    # Remove an innocent warning printed on systems without procfs
-    # https://dev.gnupg.org/T5656
-    (fetchpatch {
-      url = "https://raw.githubusercontent.com/Homebrew/formula-patches/890be5f6af88e7913d177af87a50129049e681bb/gnupg/2.3.3-proc-error.patch";
-      sha256 = "sha256-oiTa7Nf+AEmhZ683CJEaCb559PXJ6RpSSgRLpxz4CKU=";
-    })
   ];
   postPatch = ''
-    sed -i 's,hkps://hkps.pool.sks-keyservers.net,hkps://keys.openpgp.org,g' configure doc/dirmngr.texi doc/gnupg.info-1
-    # Fix broken SOURCE_DATE_EPOCH usage - remove on the next upstream update
-    sed -i 's/$SOURCE_DATE_EPOCH/''${SOURCE_DATE_EPOCH}/' doc/Makefile.am
-    sed -i 's/$SOURCE_DATE_EPOCH/''${SOURCE_DATE_EPOCH}/' doc/Makefile.in
+    sed -i 's,\(hkps\|https\)://keyserver.ubuntu.com,hkps://keys.openpgp.org,g' configure configure.ac doc/dirmngr.texi doc/gnupg.info-1
   '' + lib.optionalString (stdenv.isLinux && pcsclite != null) ''
     sed -i 's,"libpcsclite\.so[^"]*","${lib.getLib pcsclite}/lib/libpcsclite.so",g' scd/scdaemon.c
   '';
diff --git a/pkgs/tools/security/grype/default.nix b/pkgs/tools/security/grype/default.nix
index cc35a24151a..377bed93054 100644
--- a/pkgs/tools/security/grype/default.nix
+++ b/pkgs/tools/security/grype/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "grype";
-  version = "0.33.1";
+  version = "0.34.1";
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-5QjyGIpxnrwTnEmi0D16vPKodg3+SKiINFONwU2OzC0=";
+    sha256 = "sha256-Xr3ws6qmfL25Kml7Klw095N9MNrm6a8lBtOWiucnzXE=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -27,7 +27,7 @@ buildGoModule rec {
     '';
   };
 
-  vendorSha256 = "sha256-CPMfQv9oiLbIMkZe/t482LzssoNTcNVJdr2o2wJecSA=";
+  vendorSha256 = "sha256-fuOAfLESs/97aQUkIy6DkmYFyvKKCHazgt1WnE8GeH8=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/tools/security/libtpms/default.nix b/pkgs/tools/security/libtpms/default.nix
index d93f0135c20..2042ec30fff 100644
--- a/pkgs/tools/security/libtpms/default.nix
+++ b/pkgs/tools/security/libtpms/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libtpms";
-  version = "0.9.2";
+  version = "0.9.3";
 
   src = fetchFromGitHub {
     owner = "stefanberger";
     repo = "libtpms";
     rev = "v${version}";
-    sha256 = "sha256-sfAmyx9MgzCVA1Da7hl6/sKxhS9ptaNLeSB8wmJIKDs=";
+    sha256 = "sha256-ih154MtLWBUdo7+ugu6tg5O/XSjlgFC00wgWC71VeaE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/sigma-cli/default.nix b/pkgs/tools/security/sigma-cli/default.nix
index 3bf4e788912..5a6a3ab9ef5 100644
--- a/pkgs/tools/security/sigma-cli/default.nix
+++ b/pkgs/tools/security/sigma-cli/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "sigma-cli";
-  version = "0.3.0";
+  version = "0.3.2";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "SigmaHQ";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Nfd78Y35naDTzwodcdvJr/02CptcHxS717VGsR/QOuI=";
+    hash = "sha256-We6vJXLIxGe//78pgJFrihFJHl0gRd02I53hoYWcao0=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/security/step-ca/default.nix b/pkgs/tools/security/step-ca/default.nix
index 97a42646312..b650b93f411 100644
--- a/pkgs/tools/security/step-ca/default.nix
+++ b/pkgs/tools/security/step-ca/default.nix
@@ -12,16 +12,16 @@
 
 buildGoModule rec {
   pname = "step-ca";
-  version = "0.18.1";
+  version = "0.18.2";
 
   src = fetchFromGitHub {
     owner = "smallstep";
     repo = "certificates";
     rev = "v${version}";
-    sha256 = "sha256-oebmJ+xrJTV5gXH3U1lWCSQMHiVnUTa0ZTp39sVB7KM=";
+    sha256 = "sha256-BhPup3q2muYGWzAa/9b4vnIjBces4GhUHZ/mg4CWMRc=";
   };
 
-  vendorSha256 = "sha256-IJXJS+Z93Hw1I1CAeRv4mq8as9DKebqNFa0IMgZ+Kic=";
+  vendorSha256 = "sha256-oVaziWZGslZCVqkEXL32XvOVU54VOf41Qg+VoVWo7x0=";
 
   ldflags = [ "-buildid=" ];
 
diff --git a/pkgs/tools/system/syslog-ng/default.nix b/pkgs/tools/system/syslog-ng/default.nix
index 5d7fd2b1b6d..6948728f16b 100644
--- a/pkgs/tools/system/syslog-ng/default.nix
+++ b/pkgs/tools/system/syslog-ng/default.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "syslog-ng";
-  version = "3.35.1";
+  version = "3.36.1";
 
   src = fetchurl {
     url = "https://github.com/${pname}/${pname}/releases/download/${pname}-${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-HQI4sGs+WYfIWeW1Kezuc491us/wSxSTmLH+jLsSHlM=";
+    sha256 = "sha256-kKJcl2f+dJ21DxGN38kuxxOZdj0uzVrU8R/17qBJ5gs=";
   };
 
   nativeBuildInputs = [ pkg-config which ];
diff --git a/pkgs/tools/text/difftastic/default.nix b/pkgs/tools/text/difftastic/default.nix
index 729a0900f85..14c95bd2f3b 100644
--- a/pkgs/tools/text/difftastic/default.nix
+++ b/pkgs/tools/text/difftastic/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "difftastic";
-  version = "0.19.0";
+  version = "0.22.0";
 
   src = fetchFromGitHub {
     owner = "wilfred";
     repo = pname;
     rev = version;
-    sha256 = "sha256-pZyQnPIdyS8XkzP9KwGKRjF21YWGgCVNeQSie9g5NcE=";
+    sha256 = "sha256-VV4nCR+BGly+EdCkyI4KeS0Zmn6NkfRsMs//0Sj3E20=";
   };
 
-  cargoSha256 = "sha256-VXbCrhoGF6bCzQ02Y1LQkbEVrmIfDIKFWF9vx43tt94=";
+  cargoSha256 = "sha256-MyCi5PuUs9MJArDFaBgjjBInYJAS/SAPe1iNTs9feLY=";
 
   meta = with lib; {
     description = "A syntax-aware diff";
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index f4bb9c1ebc6..923dfe7b47d 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -168,6 +168,7 @@ mapAliases ({
   claws-mail-gtk2 = throw "claws-mail-gtk2 was removed to get rid of Python 2, please use claws-mail"; # Added 2021-12-05
   claws-mail-gtk3 = claws-mail; # Added 2021-07-10
   clawsMail = throw "'clawsMail' has been renamed to/replaced by 'claws-mail'"; # Converted to throw 2022-02-22
+  clearsilver = throw "clearsilver has been removed: abandoned by upstream"; # Added 2022-03-15
   clutter_gtk = throw "'clutter_gtk' has been renamed to/replaced by 'clutter-gtk'"; # Converted to throw 2022-02-22
   cmakeWithQt4Gui = throw "cmakeWithQt4Gui has been removed in favor of cmakeWithGui (Qt 5)"; # Added 2021-05
   codimd = hedgedoc; # Added 2020-11-29
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0d71f7594c9..2a479b5622c 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -147,9 +147,14 @@ with pkgs;
 
   autorestic = callPackage ../tools/backup/autorestic { };
 
-  autoPatchelfHook = makeSetupHook
-    { name = "auto-patchelf-hook"; deps = [ bintools ]; }
-    ../build-support/setup-hooks/auto-patchelf.sh;
+  autoPatchelfHook = makeSetupHook {
+    name = "auto-patchelf-hook";
+    deps = [ bintools ];
+    substitutions = {
+      pythonInterpreter = "${python3.withPackages (ps: [ ps.pyelftools ])}/bin/python";
+      autoPatchelfScript = ../build-support/setup-hooks/auto-patchelf.py;
+    };
+  } ../build-support/setup-hooks/auto-patchelf.sh;
 
   appflowy = callPackage ../applications/office/appflowy { };
 
@@ -1084,6 +1089,8 @@ with pkgs;
 
   ksnip = libsForQt5.callPackage ../tools/misc/ksnip { };
 
+  license-generator = callPackage ../tools/misc/license-generator { };
+
   linux-router = callPackage ../tools/networking/linux-router { };
 
   linux-router-without-wifi = linux-router.override { useWifiDependencies = false; };
@@ -8233,7 +8240,7 @@ with pkgs;
   grocy = callPackage ../servers/grocy { };
 
   inherit (callPackage ../servers/nextcloud {})
-    nextcloud20 nextcloud21 nextcloud22 nextcloud23;
+    nextcloud21 nextcloud22 nextcloud23;
 
   nextcloud-client = libsForQt5.callPackage ../applications/networking/nextcloud-client { };
 
@@ -8593,7 +8600,7 @@ with pkgs;
   openrgb = libsForQt5.callPackage ../applications/misc/openrgb { };
 
   openrussian-cli = callPackage ../misc/openrussian-cli {
-    luaPackages = lua53Packages;
+    lua = lua5_3;
   };
 
   opensbi = callPackage ../misc/opensbi { };
@@ -9189,6 +9196,8 @@ with pkgs;
 
   pydf = callPackage ../applications/misc/pydf { };
 
+  pyinfra = with python3Packages; toPythonApplication pyinfra;
+
   pympress = callPackage ../applications/office/pympress { };
 
   pyspread = libsForQt5.callPackage ../applications/office/pyspread { };
@@ -14059,8 +14068,18 @@ with pkgs;
 
   pipenv = callPackage ../development/tools/pipenv {};
 
-  pipewire = callPackage ../development/libraries/pipewire {};
+  pipewire = callPackage ../development/libraries/pipewire {
+    # ffmpeg depends on SDL2 which depends on pipewire by default.
+    # Break the cycle by disabling pipewire support in our ffmpeg.
+    ffmpeg = ffmpeg.override {
+      SDL2 = SDL2.override {
+        pipewireSupport = false;
+      };
+    };
+  };
+
   pipewire-media-session = callPackage ../development/libraries/pipewire/media-session.nix {};
+
   pipewire_0_2 = callPackage ../development/libraries/pipewire/0.2.nix {};
   wireplumber = callPackage ../development/libraries/pipewire/wireplumber.nix {};
 
@@ -14144,8 +14163,11 @@ with pkgs;
   self = pkgsi686Linux.callPackage ../development/interpreters/self { };
 
   inherit (callPackages ../applications/networking/cluster/spark { })
-    spark3
-    spark2;
+    spark_3_2
+    spark_3_1
+    spark_2_4;
+  spark3 = spark_3_2;
+  spark2 = spark_2_4;
   spark = spark3;
 
   sparkleshare = callPackage ../applications/version-management/sparkleshare { };
@@ -16352,8 +16374,6 @@ with pkgs;
 
   classads = callPackage ../development/libraries/classads { };
 
-  clearsilver = callPackage ../development/libraries/clearsilver { };
-
   clfft = callPackage ../development/libraries/clfft { };
 
   clipp  = callPackage ../development/libraries/clipp { };
@@ -19549,6 +19569,8 @@ with pkgs;
   osinfo-db = callPackage ../data/misc/osinfo-db { };
   osinfo-db-tools = callPackage ../tools/misc/osinfo-db-tools { };
 
+  pacemaker = callPackage ../misc/logging/pacemaker { };
+
   p11-kit = callPackage ../development/libraries/p11-kit { };
 
   paperkey = callPackage ../tools/security/paperkey { };
@@ -20632,41 +20654,27 @@ with pkgs;
   wxformbuilder = callPackage ../development/tools/wxformbuilder { };
 
   wxGTK = wxGTK28;
-  wxGTK30 = wxGTK30-gtk2;
-  wxGTK31 = wxGTK31-gtk2;
 
-  wxGTK28 = callPackage ../development/libraries/wxwidgets/2.8 { };
+  wxGTK28 = callPackage ../development/libraries/wxwidgets/wxGTK28.nix { };
 
-  wxGTK29 = callPackage ../development/libraries/wxwidgets/2.9 {
+  wxGTK29 = callPackage ../development/libraries/wxwidgets/wxGTK29.nix {
     inherit (darwin.stubs) setfile;
     inherit (darwin.apple_sdk.frameworks) AGL Carbon Cocoa Kernel QuickTime;
   };
 
-  wxGTK30-gtk2 = callPackage ../development/libraries/wxwidgets/3.0 {
-    withGtk2 = true;
-    inherit (darwin.stubs) setfile;
-    inherit (darwin.apple_sdk.frameworks) AGL Carbon Cocoa Kernel QTKit;
-  };
-
-  wxGTK30-gtk3 = callPackage ../development/libraries/wxwidgets/3.0 {
-    withGtk2 = false;
-    inherit (darwin.stubs) setfile;
-    inherit (darwin.apple_sdk.frameworks) AGL Carbon Cocoa Kernel QTKit;
-  };
-
-  wxGTK31-gtk2 = callPackage ../development/libraries/wxwidgets/3.1 {
+  wxGTK30 = callPackage ../development/libraries/wxwidgets/wxGTK30.nix {
     withGtk2 = true;
     inherit (darwin.stubs) setfile;
     inherit (darwin.apple_sdk.frameworks) AGL Carbon Cocoa Kernel QTKit;
   };
+  wxGTK30-gtk2 = wxGTK30.override { withGtk2 = true; };
+  wxGTK30-gtk3 = wxGTK30.override { withGtk2 = false; };
 
-  wxGTK31-gtk3 = callPackage ../development/libraries/wxwidgets/3.1 {
-    withGtk2 = false;
-    inherit (darwin.stubs) setfile;
-    inherit (darwin.apple_sdk.frameworks) AGL Carbon Cocoa Kernel QTKit;
-  };
+  wxmac = callPackage ../development/libraries/wxwidgets/wxmac30.nix { };
 
-  wxmac = callPackage ../development/libraries/wxwidgets/3.0/mac.nix { };
+  wxGTK31 = callPackage ../development/libraries/wxwidgets/wxGTK31.nix { };
+  wxGTK31-gtk2 = wxGTK31.override { withGtk2 = true; };
+  wxGTK31-gtk3 = wxGTK31.override { withGtk2 = false; };
 
   wxSVG = callPackage ../development/libraries/wxSVG {
     wxGTK = wxGTK30-gtk3;
@@ -25492,6 +25500,10 @@ with pkgs;
 
   fnott = callPackage ../applications/misc/fnott { };
 
+  furnace = callPackage ../applications/audio/furnace {
+    inherit (darwin.apple_sdk.frameworks) Cocoa;
+  };
+
   gg-scm = callPackage ../applications/version-management/git-and-tools/gg { };
 
   gigalixir = with python3Packages; toPythonApplication gigalixir;
@@ -27693,6 +27705,7 @@ with pkgs;
     simple-mpv-webui = callPackage ../applications/video/mpv/scripts/simple-mpv-webui.nix {};
     sponsorblock = callPackage ../applications/video/mpv/scripts/sponsorblock.nix {};
     thumbnail = callPackage ../applications/video/mpv/scripts/thumbnail.nix { };
+    vr-reversal = callPackage ../applications/video/mpv/scripts/vr-reversal.nix {};
     youtube-quality = callPackage ../applications/video/mpv/scripts/youtube-quality.nix { };
     cutter = callPackage ../applications/video/mpv/scripts/cutter.nix { };
   };
@@ -32246,6 +32259,8 @@ with pkgs;
 
   blas = callPackage ../build-support/alternatives/blas { };
 
+  blas-ilp64 = blas.override { isILP64 = true; };
+
   blas-reference = callPackage ../development/libraries/science/math/blas { };
 
   bonmin = callPackage ../development/libraries/science/math/bonmin { };
@@ -32270,6 +32285,8 @@ with pkgs;
 
   lapack = callPackage ../build-support/alternatives/lapack { };
 
+  lapack-ilp64 = lapack.override { isILP64 = true; };
+
   lapack-reference = callPackage ../development/libraries/science/math/liblapack { };
   liblapack = lapack-reference;
 
@@ -33722,7 +33739,9 @@ with pkgs;
 
   disnixos = callPackage ../tools/package-management/disnix/disnixos { };
 
-  DisnixWebService = callPackage ../tools/package-management/disnix/DisnixWebService { };
+  DisnixWebService = callPackage ../tools/package-management/disnix/DisnixWebService {
+    jdk = jdk8;
+  };
 
   i3a = callPackage ../misc/i3a { };
 
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 2ac1f83917a..4718d942d8e 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -85,6 +85,7 @@ mapAliases ({
   pylibgen = throw "pylibgen is unmaintained upstreamed, and removed from nixpkgs"; # added 2020-06-20
   pymssql = throw "pymssql has been abandoned upstream."; # added 2020-05-04
   pysmart-smartx = pysmart; # added 2021-10-22
+  pytest_6 = pytest; # added 2022-02-10
   pytestcov = pytest-cov; # added 2021-01-04
   pytest-pep8 = pytestpep8; # added 2021-01-04
   pytestpep8 = throw "pytestpep8 was removed because it is abandoned and no longer compatible with pytest v6.0"; # added 2020-12-10
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 25bab7f31af..720f463312f 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -135,16 +135,6 @@ in {
     venvShellHook
     wheelUnpackHook;
 
-  # Not all packages are compatible with the latest pytest yet.
-  # We need to override the hook to select an older pytest, however,
-  # it should not override the version of pytest that is used for say
-  # Python 2. This is an ugly hack that is needed now because the hook
-  # propagates the package.
-  pytestCheckHook_6_1 = if isPy3k then
-    self.pytestCheckHook.override { pytest = self.pytest_6_1; }
-  else
-    self.pytestCheckHook;
-
   # helpers
 
   # We use build packages because we are making a setup hook to be used as a
@@ -2220,7 +2210,7 @@ in {
 
   distutils_extra = callPackage ../development/python-modules/distutils_extra { };
 
-  django = self.django_2;
+  django = self.django_3;
 
   # Current LTS
   django_2 = callPackage ../development/python-modules/django/2.nix { };
@@ -2438,6 +2428,8 @@ in {
 
   docx2python = callPackage ../development/python-modules/docx2python { };
 
+  docx2txt = callPackage ../development/python-modules/docx2txt { };
+
   dodgy = callPackage ../development/python-modules/dodgy { };
 
   dogpile-cache = callPackage ../development/python-modules/dogpile-cache { };
@@ -7785,28 +7777,12 @@ in {
 
   pytesseract = callPackage ../development/python-modules/pytesseract { };
 
-  pytest = self.pytest_6;
-
-  pytest_6 =
-    callPackage ../development/python-modules/pytest {
-      # hypothesis tests require pytest that causes dependency cycle
-      hypothesis = self.hypothesis.override {
-        doCheck = false;
-      };
+  pytest = callPackage ../development/python-modules/pytest {
+    # hypothesis tests require pytest that causes dependency cycle
+    hypothesis = self.hypothesis.override {
+      doCheck = false;
     };
-
-  pytest_6_1 = self.pytest_6.overridePythonAttrs (oldAttrs: rec {
-    version = "6.1.2";
-    src = oldAttrs.src.override {
-      inherit version;
-      sha256 = "c0a7e94a8cdbc5422a51ccdad8e6f1024795939cc89159a0ae7f0b316ad3823e";
-    };
-
-    postPatch = ''
-      substituteInPlace setup.cfg \
-        --replace "pluggy>=0.12,<1.0" "pluggy>=0.12,<2.0"
-    '';
-  });
+  };
 
   pytest-aio = callPackage ../development/python-modules/pytest-aio { };
 
@@ -8305,6 +8281,8 @@ in {
 
   pyeverlights = callPackage ../development/python-modules/pyeverlights { };
 
+  pyinfra = callPackage ../development/python-modules/pyinfra { };
+
   pytibber = callPackage ../development/python-modules/pytibber { };
 
   pytile = callPackage ../development/python-modules/pytile { };