summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--maintainers/maintainer-list.nix12
-rw-r--r--maintainers/scripts/luarocks-packages.csv2
-rwxr-xr-xmaintainers/scripts/update-luarocks-packages13
-rw-r--r--nixos/doc/manual/from_md/release-notes/rl-2205.section.xml32
-rw-r--r--nixos/doc/manual/release-notes/rl-2205.section.md14
-rw-r--r--nixos/modules/programs/zsh/zsh-autosuggestions.nix21
-rw-r--r--nixos/modules/services/cluster/k3s/default.nix6
-rw-r--r--nixos/modules/services/databases/redis.nix13
-rw-r--r--nixos/modules/services/misc/dendrite.nix94
-rw-r--r--nixos/modules/services/web-servers/nginx/default.nix3
-rw-r--r--pkgs/applications/audio/praat/default.nix4
-rwxr-xr-xpkgs/applications/editors/kakoune/plugins/update.py4
-rw-r--r--pkgs/applications/editors/leo-editor/default.nix4
-rw-r--r--pkgs/applications/editors/sigil/default.nix4
-rw-r--r--pkgs/applications/editors/vscode/extensions/default.nix17
-rw-r--r--pkgs/applications/graphics/avocode/default.nix4
-rw-r--r--pkgs/applications/graphics/weylus/default.nix91
-rw-r--r--pkgs/applications/misc/spicetify-cli/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/bombadillo/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/talosctl/default.nix14
-rw-r--r--pkgs/applications/networking/dnscontrol/default.nix6
-rw-r--r--pkgs/applications/networking/remote/freerdp/default.nix4
-rw-r--r--pkgs/applications/video/ffmpeg-normalize/default.nix4
-rw-r--r--pkgs/applications/video/losslesscut-bin/appimage.nix4
-rw-r--r--pkgs/applications/video/losslesscut-bin/default.nix10
-rw-r--r--pkgs/applications/video/losslesscut-bin/dmg.nix4
-rw-r--r--pkgs/applications/video/losslesscut-bin/windows.nix5
-rw-r--r--pkgs/applications/virtualization/colima/default.nix4
-rw-r--r--pkgs/applications/virtualization/x11docker/default.nix4
-rw-r--r--pkgs/applications/window-managers/sway/lock.nix9
-rw-r--r--pkgs/build-support/make-desktopitem/default.nix4
-rw-r--r--pkgs/data/documentation/zeal/default.nix4
-rw-r--r--pkgs/data/soundfonts/fluid/default.nix3
-rw-r--r--pkgs/data/soundfonts/ydp-grand/default.nix2
-rw-r--r--pkgs/data/themes/gnome-breeze/default.nix22
-rw-r--r--pkgs/desktops/cdesktopenv/default.nix4
-rw-r--r--pkgs/desktops/pantheon/apps/switchboard/wrapper.nix3
-rw-r--r--pkgs/desktops/pantheon/desktop/wingpanel/wrapper.nix3
-rw-r--r--pkgs/development/compilers/bs-platform/ocaml.nix2
-rw-r--r--pkgs/development/compilers/ios-cross-compile/9.2.nix2
-rw-r--r--pkgs/development/compilers/mit-scheme/default.nix3
-rw-r--r--pkgs/development/compilers/openjdk/jre.nix2
-rw-r--r--pkgs/development/compilers/osl/default.nix2
-rw-r--r--pkgs/development/compilers/rust/clippy.nix2
-rw-r--r--pkgs/development/compilers/scala/dotty.nix3
-rw-r--r--pkgs/development/compilers/swift/default.nix3
-rw-r--r--pkgs/development/compilers/urn/default.nix3
-rw-r--r--pkgs/development/interpreters/chibi/default.nix24
-rw-r--r--pkgs/development/interpreters/elixir/generic-builder.nix2
-rw-r--r--pkgs/development/interpreters/racket/minimal.nix5
-rw-r--r--pkgs/development/java-modules/m2install.nix6
-rw-r--r--pkgs/development/libraries/CGAL/4.nix2
-rw-r--r--pkgs/development/libraries/google-cloud-cpp/default.nix14
-rw-r--r--pkgs/development/libraries/google-cloud-cpp/skipped_tests.toml5
-rw-r--r--pkgs/development/libraries/liblouis/default.nix4
-rw-r--r--pkgs/development/lua-modules/generated-packages.nix10
-rw-r--r--pkgs/development/ocaml-modules/camomile/default.nix6
-rw-r--r--pkgs/development/python-modules/adafruit-platformdetect/default.nix4
-rw-r--r--pkgs/development/python-modules/bc-python-hcl2/default.nix20
-rw-r--r--pkgs/development/python-modules/google-cloud-access-context-manager/default.nix4
-rw-r--r--pkgs/development/python-modules/google-cloud-appengine-logging/default.nix8
-rw-r--r--pkgs/development/python-modules/google-cloud-automl/default.nix4
-rw-r--r--pkgs/development/python-modules/google-cloud-bigquery-datatransfer/default.nix22
-rw-r--r--pkgs/development/python-modules/google-cloud-bigtable/default.nix4
-rw-r--r--pkgs/development/python-modules/google-cloud-datacatalog/default.nix4
-rw-r--r--pkgs/development/python-modules/google-cloud-datastore/default.nix4
-rw-r--r--pkgs/development/python-modules/google-cloud-dlp/default.nix4
-rw-r--r--pkgs/development/python-modules/google-cloud-iam-logging/default.nix8
-rw-r--r--pkgs/development/python-modules/google-cloud-iam/default.nix4
-rw-r--r--pkgs/development/python-modules/google-cloud-iot/default.nix4
-rw-r--r--pkgs/development/python-modules/google-cloud-monitoring/default.nix4
-rw-r--r--pkgs/development/python-modules/google-cloud-redis/default.nix4
-rw-r--r--pkgs/development/python-modules/google-cloud-resource-manager/default.nix4
-rw-r--r--pkgs/development/python-modules/google-cloud-secret-manager/default.nix4
-rw-r--r--pkgs/development/python-modules/google-cloud-securitycenter/default.nix4
-rw-r--r--pkgs/development/python-modules/google-cloud-speech/default.nix4
-rw-r--r--pkgs/development/python-modules/google-cloud-videointelligence/default.nix4
-rw-r--r--pkgs/development/python-modules/google-cloud-vision/default.nix4
-rw-r--r--pkgs/development/python-modules/google-cloud-websecurityscanner/default.nix4
-rw-r--r--pkgs/development/python-modules/losant-rest/default.nix4
-rw-r--r--pkgs/development/python-modules/pycep-parser/default.nix58
-rw-r--r--pkgs/development/python-modules/pymc3/default.nix21
-rw-r--r--pkgs/development/python-modules/python-miio/default.nix8
-rw-r--r--pkgs/development/python-modules/theano-pymc/default.nix48
-rw-r--r--pkgs/development/tools/analysis/checkov/default.nix5
-rw-r--r--pkgs/development/tools/database/sqlfluff/default.nix4
-rw-r--r--pkgs/development/tools/rebazel/default.nix5
-rw-r--r--pkgs/misc/dxvk/darwin-dxvk-compat.patch35
-rw-r--r--pkgs/misc/dxvk/darwin-moltenvk-compat.patch59
-rw-r--r--pkgs/misc/dxvk/default.nix80
-rw-r--r--pkgs/misc/dxvk/dxvk.nix52
-rw-r--r--pkgs/misc/dxvk/mcfgthread.patch34
-rw-r--r--pkgs/servers/dendrite/default.nix6
-rw-r--r--pkgs/servers/home-assistant/component-packages.nix2
-rw-r--r--pkgs/servers/home-assistant/default.nix4
-rw-r--r--pkgs/servers/home-assistant/frontend.nix4
-rw-r--r--pkgs/servers/http/nginx/modules.nix1
-rw-r--r--pkgs/servers/maddy/default.nix6
-rw-r--r--pkgs/servers/monitoring/prometheus/gitlab-ci-pipelines-exporter.nix11
-rw-r--r--pkgs/tools/admin/exoscale-cli/default.nix4
-rw-r--r--pkgs/tools/backup/kopia/default.nix6
-rw-r--r--pkgs/tools/misc/birdfont/default.nix4
-rw-r--r--pkgs/tools/misc/goreleaser/default.nix6
-rw-r--r--pkgs/tools/misc/nautilus-open-any-terminal/default.nix4
-rw-r--r--pkgs/tools/misc/opentelemetry-collector/contrib.nix6
-rw-r--r--pkgs/tools/misc/opentelemetry-collector/default.nix6
-rw-r--r--pkgs/tools/networking/arping/default.nix27
-rw-r--r--pkgs/tools/networking/subfinder/default.nix6
-rw-r--r--pkgs/tools/security/authz0/default.nix25
-rw-r--r--pkgs/tools/security/cfripper/default.nix4
-rw-r--r--pkgs/tools/security/sequoia/default.nix15
-rw-r--r--pkgs/tools/security/sudo/default.nix4
-rw-r--r--pkgs/top-level/all-packages.nix13
-rw-r--r--pkgs/top-level/python-packages.nix4
114 files changed, 943 insertions, 327 deletions
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 44efa182da8..7dea8e39cc5 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -7747,6 +7747,12 @@
     githubId = 1187050;
     name = "Maximilian Huber";
   };
+  maximsmol = {
+    email = "maximsmol@gmail.com";
+    github = "maximsmol";
+    githubId = 1472826;
+    name = "Max Smolin";
+  };
   maxxk = {
     email = "maxim.krivchikov@gmail.com";
     github = "maxxk";
@@ -8816,6 +8822,12 @@
     githubId = 8214542;
     name = "Nicolò Balzarotti";
   };
+  nidabdella = {
+    name = "Mohamed Nidabdella";
+    email = "nidabdella.mohamed@gmail.com";
+    github = "nidabdella";
+    githubId = 8083813;
+  };
   NieDzejkob = {
     email = "kuba@kadziolka.net";
     github = "NieDzejkob";
diff --git a/maintainers/scripts/luarocks-packages.csv b/maintainers/scripts/luarocks-packages.csv
index 23303d22c47..d69546cdf07 100644
--- a/maintainers/scripts/luarocks-packages.csv
+++ b/maintainers/scripts/luarocks-packages.csv
@@ -68,7 +68,7 @@ luautf8,,,,,,pstn
 luazip,,,,,,
 lua-yajl,,,,,,pstn
 luuid,,,,,,
-luv,,,,1.42.0-0,,
+luv,,,,1.43.0-0,,
 lyaml,,,,,,lblasc
 markdown,,,,,,
 mediator_lua,,,,,,
diff --git a/maintainers/scripts/update-luarocks-packages b/maintainers/scripts/update-luarocks-packages
index c559d5699df..73a233c5f10 100755
--- a/maintainers/scripts/update-luarocks-packages
+++ b/maintainers/scripts/update-luarocks-packages
@@ -25,8 +25,8 @@ from pathlib import Path
 log = logging.getLogger()
 log.addHandler(logging.StreamHandler())
 
-ROOT = Path(os.path.dirname(os.path.abspath(inspect.getfile(inspect.currentframe())))).parent.parent
-from pluginupdate import Editor, update_plugins, PluginDesc, CleanEnvironment, LOG_LEVELS, Cache
+ROOT = Path(os.path.dirname(os.path.abspath(inspect.getfile(inspect.currentframe())))).parent.parent # type: ignore
+from pluginupdate import Editor, update_plugins, FetchConfig, CleanEnvironment
 
 PKG_LIST="maintainers/scripts/luarocks-packages.csv"
 TMP_FILE="$(mktemp)"
@@ -118,7 +118,7 @@ class LuaEditor(Editor):
     def attr_path(self):
         return "luaPackages"
 
-    def get_update(self, input_file: str, outfile: str, proc: int):
+    def get_update(self, input_file: str, outfile: str, config: FetchConfig):
         _prefetch = generate_pkg_nix
 
         def update() -> dict:
@@ -126,14 +126,14 @@ class LuaEditor(Editor):
             sorted_plugin_specs = sorted(plugin_specs, key=lambda v: v.name.lower())
 
             try:
-                pool = Pool(processes=proc)
+                pool = Pool(processes=config.proc)
                 results = pool.map(_prefetch, sorted_plugin_specs)
             finally:
                 pass
 
             self.generate_nix(results, outfile)
 
-            redirects = []
+            redirects = {}
             return redirects
 
         return update
@@ -181,11 +181,9 @@ def generate_pkg_nix(plug: LuaPlugin):
 
             cmd.append(plug.version)
 
-    #
     if plug.server != "src" and plug.server:
         cmd.append(f"--only-server={plug.server}")
 
-
     if plug.luaversion:
         with CleanEnvironment():
             local_pkgs = str(ROOT.resolve())
@@ -209,7 +207,6 @@ def main():
 
     parser = editor.create_parser()
     args = parser.parse_args()
-    log.setLevel(LOG_LEVELS[args.debug])
 
     update_plugins(editor, args)
 
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
index 4f4a5a3394e..0c10451add4 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@@ -366,6 +366,20 @@
       </listitem>
       <listitem>
         <para>
+          <literal>services.k3s.enable</literal> no longer implies
+          <literal>systemd.enableUnifiedCgroupHierarchy = false</literal>,
+          and will default to the <quote>systemd</quote> cgroup driver
+          when using <literal>services.k3s.docker = true</literal>. This
+          change may require a reboot to take effect, and k3s may not be
+          able to run if the boot cgroup hierarchy does not match its
+          configuration. The previous behavior may be retained by
+          explicitly setting
+          <literal>systemd.enableUnifiedCgroupHierarchy = false</literal>
+          in your configuration.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
           The DHCP server (<literal>services.dhcpd4</literal>,
           <literal>services.dhcpd6</literal>) has been hardened. The
           service is now using the systemd’s
@@ -754,6 +768,18 @@
       </listitem>
       <listitem>
         <para>
+          The <literal>dendrite</literal> package has been upgraded from
+          0.5.1 to
+          <link xlink:href="https://github.com/matrix-org/dendrite/releases/tag/v0.6.5">0.6.5</link>.
+          Instances configured with split sqlite databases, which has
+          been the default in NixOS, require merging of the federation
+          sender and signing key databases. See upstream
+          <link xlink:href="https://github.com/matrix-org/dendrite/releases/tag/v0.6.0">release
+          notes</link> on version 0.6.0 for details on database changes.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
           The existing <literal>pkgs.opentelemetry-collector</literal>
           has been moved to
           <literal>pkgs.opentelemetry-collector-contrib</literal> to
@@ -1070,6 +1096,12 @@
       </listitem>
       <listitem>
         <para>
+          <literal>programs.zsh.autosuggestions.strategy</literal> now
+          takes a list of strings instead of a string.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
           The <literal>services.unifi.openPorts</literal> option default
           value of <literal>true</literal> is now deprecated and will be
           changed to <literal>false</literal> in 22.11. Configurations
diff --git a/nixos/doc/manual/release-notes/rl-2205.section.md b/nixos/doc/manual/release-notes/rl-2205.section.md
index c4281561f16..b9402ba5f9d 100644
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@@ -121,6 +121,10 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - `services.kubernetes.scheduler.{port,address}` now set `--secure-port` and `--bind-address` instead of `--port` and `--address`, since the former have been deprecated and are no longer functional in kubernetes>=1.23. Ensure that you are not relying on the insecure behaviour before upgrading.
 
+- `services.k3s.enable` no longer implies `systemd.enableUnifiedCgroupHierarchy = false`, and will default to the 'systemd' cgroup driver when using `services.k3s.docker = true`.
+  This change may require a reboot to take effect, and k3s may not be able to run if the boot cgroup hierarchy does not match its configuration.
+  The previous behavior may be retained by explicitly setting `systemd.enableUnifiedCgroupHierarchy = false` in your configuration.
+
 - The DHCP server (`services.dhcpd4`, `services.dhcpd6`) has been hardened.
   The service is now using the systemd's `DynamicUser` mechanism to run as an unprivileged dynamically-allocated user with limited capabilities.
   The dhcpd state files are now always stored in `/var/lib/dhcpd{4,6}` and the `services.dhcpd4.stateDir` and `service.dhcpd6.stateDir` options have been removed.
@@ -289,6 +293,14 @@ In addition to numerous new and upgraded packages, this release has the followin
 
   This breaks back-compat so it's not possible to mix-and-match with previous versions of nixpkgs. In exchange, it now becomes possible to use the providers from [nixpkgs-terraform-providers-bin](https://github.com/numtide/nixpkgs-terraform-providers-bin) directly.
 
+- The `dendrite` package has been upgraded from 0.5.1 to
+  [0.6.5](https://github.com/matrix-org/dendrite/releases/tag/v0.6.5). Instances
+  configured with split sqlite databases, which has been the default
+  in NixOS, require merging of the federation sender and signing key
+  databases. See upstream [release
+  notes](https://github.com/matrix-org/dendrite/releases/tag/v0.6.0)
+  on version 0.6.0 for details on database changes.
+
 - The existing `pkgs.opentelemetry-collector` has been moved to
   `pkgs.opentelemetry-collector-contrib` to match the actual source being the
   "contrib" edition. `pkgs.opentelemetry-collector` is now the actual core
@@ -392,6 +404,8 @@ In addition to numerous new and upgraded packages, this release has the followin
   combined `influxdb2` package is still provided in this release for
   backwards compatibilty, but will be removed at a later date.
 
+- `programs.zsh.autosuggestions.strategy` now takes a list of strings instead of a string.
+
 - The `services.unifi.openPorts` option default value of `true` is now deprecated and will be changed to `false` in 22.11.
   Configurations using this default will print a warning when rebuilt.
 
diff --git a/nixos/modules/programs/zsh/zsh-autosuggestions.nix b/nixos/modules/programs/zsh/zsh-autosuggestions.nix
index fee324cc732..2e53e907d54 100644
--- a/nixos/modules/programs/zsh/zsh-autosuggestions.nix
+++ b/nixos/modules/programs/zsh/zsh-autosuggestions.nix
@@ -22,17 +22,18 @@ in
     };
 
     strategy = mkOption {
-      type = types.enum [ "history" "match_prev_cmd" ];
-      default = "history";
+      type = types.listOf (types.enum [ "history" "completion" "match_prev_cmd" ]);
+      default = [ "history" ];
       description = ''
-        Set ZSH_AUTOSUGGEST_STRATEGY to choose the strategy for generating suggestions.
-        There are currently two to choose from:
+        `ZSH_AUTOSUGGEST_STRATEGY` is an array that specifies how suggestions should be generated.
+        The strategies in the array are tried successively until a suggestion is found.
+        There are currently three built-in strategies to choose from:
 
-          * history: Chooses the most recent match.
-          * match_prev_cmd: Chooses the most recent match whose preceding history item matches
-            the most recently executed command (more info). Note that this strategy won't work as
-            expected with ZSH options that don't preserve the history order such as
-            HIST_IGNORE_ALL_DUPS or HIST_EXPIRE_DUPS_FIRST.
+        - `history`: Chooses the most recent match from history.
+        - `completion`: Chooses a suggestion based on what tab-completion would suggest. (requires `zpty` module)
+        - `match_prev_cmd`: Like `history`, but chooses the most recent match whose preceding history item matches
+            the most recently executed command. Note that this strategy won't work as expected with ZSH options that
+            don't preserve the history order such as `HIST_IGNORE_ALL_DUPS` or `HIST_EXPIRE_DUPS_FIRST`.
       '';
     };
 
@@ -62,7 +63,7 @@ in
       source ${pkgs.zsh-autosuggestions}/share/zsh-autosuggestions/zsh-autosuggestions.zsh
 
       export ZSH_AUTOSUGGEST_HIGHLIGHT_STYLE="${cfg.highlightStyle}"
-      export ZSH_AUTOSUGGEST_STRATEGY=("${cfg.strategy}")
+      export ZSH_AUTOSUGGEST_STRATEGY=(${concatStringsSep " " cfg.strategy})
       ${optionalString (!cfg.async) "unset ZSH_AUTOSUGGEST_USE_ASYNC"}
 
       ${concatStringsSep "\n" (mapAttrsToList (key: value: ''export ${key}="${value}"'') cfg.extraConfig)}
diff --git a/nixos/modules/services/cluster/k3s/default.nix b/nixos/modules/services/cluster/k3s/default.nix
index 50b6780bbe6..3a36cfa3f37 100644
--- a/nixos/modules/services/cluster/k3s/default.nix
+++ b/nixos/modules/services/cluster/k3s/default.nix
@@ -91,11 +91,6 @@ in
     virtualisation.docker = mkIf cfg.docker {
       enable = mkDefault true;
     };
-
-    # TODO: disable this once k3s supports cgroupsv2, either by docker
-    # supporting it, or their bundled containerd
-    systemd.enableUnifiedCgroupHierarchy = false;
-
     environment.systemPackages = [ config.services.k3s.package ];
 
     systemd.services.k3s = {
@@ -119,6 +114,7 @@ in
           [
             "${cfg.package}/bin/k3s ${cfg.role}"
           ] ++ (optional cfg.docker "--docker")
+          ++ (optional (cfg.docker && config.systemd.enableUnifiedCgroupHierarchy) "--kubelet-arg=cgroup-driver=systemd")
           ++ (optional cfg.disableAgent "--disable-agent")
           ++ (optional (cfg.serverAddr != "") "--server ${cfg.serverAddr}")
           ++ (optional (cfg.token != "") "--token ${cfg.token}")
diff --git a/nixos/modules/services/databases/redis.nix b/nixos/modules/services/databases/redis.nix
index e0269a962fd..a1bd73c9e37 100644
--- a/nixos/modules/services/databases/redis.nix
+++ b/nixos/modules/services/databases/redis.nix
@@ -81,7 +81,9 @@ in {
             user = mkOption {
               type = types.str;
               default = redisName name;
-              defaultText = "\"redis\" or \"redis-\${name}\" if name != \"\"";
+              defaultText = literalExpression ''
+                if name == "" then "redis" else "redis-''${name}"
+              '';
               description = "The username and groupname for redis-server.";
             };
 
@@ -105,8 +107,7 @@ in {
 
             bind = mkOption {
               type = with types; nullOr str;
-              default = if name == "" then "127.0.0.1" else null;
-              defaultText = literalExpression ''if name == "" then "127.0.0.1" else null'';
+              default = "127.0.0.1";
               description = ''
                 The IP interface to bind to.
                 <literal>null</literal> means "all interfaces".
@@ -117,7 +118,9 @@ in {
             unixSocket = mkOption {
               type = with types; nullOr path;
               default = "/run/${redisName name}/redis.sock";
-              defaultText = "\"/run/redis/redis.sock\" or \"/run/redis-\${name}/redis.sock\" if name != \"\"";
+              defaultText = literalExpression ''
+                if name == "" then "/run/redis/redis.sock" else "/run/redis-''${name}/redis.sock"
+              '';
               description = "The path to the socket to bind to.";
             };
 
@@ -370,7 +373,7 @@ in {
         ProtectKernelTunables = true;
         ProtectControlGroups = true;
         RestrictAddressFamilies =
-          optionals (conf.bind != null) ["AF_INET" "AF_INET6"] ++
+          optionals (conf.port != 0) ["AF_INET" "AF_INET6"] ++
           optional (conf.unixSocket != null) "AF_UNIX";
         RestrictNamespaces = true;
         LockPersonality = true;
diff --git a/nixos/modules/services/misc/dendrite.nix b/nixos/modules/services/misc/dendrite.nix
index c967fc3a362..b2885b09415 100644
--- a/nixos/modules/services/misc/dendrite.nix
+++ b/nixos/modules/services/misc/dendrite.nix
@@ -110,6 +110,15 @@ in
             '';
           };
         };
+        options.app_service_api.database = {
+          connection_string = lib.mkOption {
+            type = lib.types.str;
+            default = "file:federationapi.db";
+            description = ''
+              Database for the Appservice API.
+            '';
+          };
+        };
         options.client_api = {
           registration_disabled = lib.mkOption {
             type = lib.types.bool;
@@ -120,6 +129,91 @@ in
             '';
           };
         };
+        options.federation_api.database = {
+          connection_string = lib.mkOption {
+            type = lib.types.str;
+            default = "file:federationapi.db";
+            description = ''
+              Database for the Federation API.
+            '';
+          };
+        };
+        options.key_server.database = {
+          connection_string = lib.mkOption {
+            type = lib.types.str;
+            default = "file:keyserver.db";
+            description = ''
+              Database for the Key Server (for end-to-end encryption).
+            '';
+          };
+        };
+        options.media_api = {
+          database = {
+            connection_string = lib.mkOption {
+              type = lib.types.str;
+              default = "file:mediaapi.db";
+              description = ''
+                Database for the Media API.
+              '';
+            };
+          };
+          base_path = lib.mkOption {
+            type = lib.types.str;
+            default = "${workingDir}/media_store";
+            description = ''
+              Storage path for uploaded media.
+            '';
+          };
+        };
+        options.room_server.database = {
+          connection_string = lib.mkOption {
+            type = lib.types.str;
+            default = "file:roomserver.db";
+            description = ''
+              Database for the Room Server.
+            '';
+          };
+        };
+        options.sync_api.database = {
+          connection_string = lib.mkOption {
+            type = lib.types.str;
+            default = "file:syncserver.db";
+            description = ''
+              Database for the Sync API.
+            '';
+          };
+        };
+        options.user_api = {
+          account_database = {
+            connection_string = lib.mkOption {
+              type = lib.types.str;
+              default = "file:userapi_accounts.db";
+              description = ''
+                Database for the User API, accounts.
+              '';
+            };
+          };
+          device_database = {
+            connection_string = lib.mkOption {
+              type = lib.types.str;
+              default = "file:userapi_devices.db";
+              description = ''
+                Database for the User API, devices.
+              '';
+            };
+          };
+        };
+        options.mscs = {
+          database = {
+            connection_string = lib.mkOption {
+              type = lib.types.str;
+              default = "file:mscs.db";
+              description = ''
+                Database for exerimental MSC's.
+              '';
+            };
+          };
+        };
       };
       default = { };
       description = ''
diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index 7daf0f158b3..e046c28dd6b 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -924,7 +924,8 @@ in
         PrivateMounts = true;
         # System Call Filtering
         SystemCallArchitectures = "native";
-        SystemCallFilter = [ "~@cpu-emulation @debug @keyring @mount @obsolete @privileged @setuid" ] ++ optionals (cfg.package != pkgs.tengine) [ "~@ipc" ];
+        SystemCallFilter = [ "~@cpu-emulation @debug @keyring @mount @obsolete @privileged @setuid" ]
+          ++ optionals ((cfg.package != pkgs.tengine) && (!lib.any (mod: (mod.disableIPC or false)) cfg.package.modules)) [ "~@ipc" ];
       };
     };
 
diff --git a/pkgs/applications/audio/praat/default.nix b/pkgs/applications/audio/praat/default.nix
index 3ecfde7819f..b4f450b3101 100644
--- a/pkgs/applications/audio/praat/default.nix
+++ b/pkgs/applications/audio/praat/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "praat";
-  version = "6.2.07";
+  version = "6.2.09";
 
   src = fetchFromGitHub {
     owner = "praat";
     repo = "praat";
     rev = "v${version}";
-    sha256 = "sha256-MM8uC1+d1P7aZI460fCcHWtE7+xfJV1ZFj2cdp/b1rY=";
+    sha256 = "sha256-BhsbTFwxgWwMwe1ow0ppVsLjfMC7QMA/fq09Utwe+KA=";
   };
 
   configurePhase = ''
diff --git a/pkgs/applications/editors/kakoune/plugins/update.py b/pkgs/applications/editors/kakoune/plugins/update.py
index 9f5f64f9e5b..dd8765db28a 100755
--- a/pkgs/applications/editors/kakoune/plugins/update.py
+++ b/pkgs/applications/editors/kakoune/plugins/update.py
@@ -15,7 +15,7 @@ from typing import List, Tuple
 from pathlib import Path
 
 # Import plugin update library from maintainers/scripts/pluginupdate.py
-ROOT = Path(os.path.dirname(os.path.abspath(inspect.getfile(inspect.currentframe()))))
+ROOT = Path(os.path.dirname(os.path.abspath(inspect.getfile(inspect.currentframe())))) # type: ignore
 sys.path.insert(
     0, os.path.join(ROOT.parent.parent.parent.parent.parent, "maintainers", "scripts")
 )
@@ -42,7 +42,7 @@ HEADER = "# This file has been generated by ./pkgs/applications/editors/kakoune/
 class KakouneEditor(pluginupdate.Editor):
 
 
-    def generate_nix(plugins: List[Tuple[str, str, pluginupdate.Plugin]], outfile: str):
+    def generate_nix(self, plugins: List[Tuple[str, str, pluginupdate.Plugin]], outfile: str):
         sorted_plugins = sorted(plugins, key=lambda v: v[2].name.lower())
 
         with open(outfile, "w+") as f:
diff --git a/pkgs/applications/editors/leo-editor/default.nix b/pkgs/applications/editors/leo-editor/default.nix
index 4a5f464f4bc..efe431c3396 100644
--- a/pkgs/applications/editors/leo-editor/default.nix
+++ b/pkgs/applications/editors/leo-editor/default.nix
@@ -2,13 +2,13 @@
 
 mkDerivation rec {
   pname = "leo-editor";
-  version = "6.5";
+  version = "6.6-b2";
 
   src = fetchFromGitHub {
     owner = "leo-editor";
     repo = "leo-editor";
     rev = version;
-    sha256 = "sha256-f237oXhnu6OtGVhIFDswFwfjcLgYWvLNRtVW4SChFzU=";
+    sha256 = "sha256-oUOsAYcxknG+bao76bzPhStO1m08pMWTEEiG2rLkklA=";
   };
 
   dontBuild = true;
diff --git a/pkgs/applications/editors/sigil/default.nix b/pkgs/applications/editors/sigil/default.nix
index cd776fb6bfc..0da5a2c2550 100644
--- a/pkgs/applications/editors/sigil/default.nix
+++ b/pkgs/applications/editors/sigil/default.nix
@@ -6,13 +6,13 @@
 
 mkDerivation rec {
   pname = "sigil";
-  version = "1.9.0";
+  version = "1.9.1";
 
   src = fetchFromGitHub {
     repo = "Sigil";
     owner = "Sigil-Ebook";
     rev = version;
-    sha256 = "sha256-3rECGnb0kkQwzsMxLxgAp0QEoHFHv+qCjiCgzCZeUJw=";
+    sha256 = "sha256-PsHliyJu61QFTFZUgDtxguu18GBVTOGMW6pPYjHhvG0=";
   };
 
   pythonPath = with python3Packages; [ lxml ];
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 4b990fa3321..a9ed82015f0 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1787,6 +1787,23 @@ let
         };
       };
 
+      skellock.just = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "just";
+          publisher = "skellock";
+          version = "2.0.0";
+          sha256 = "sha256-FOp/dcW0+07rADEpUMzx+SGYjhvE4IhcCOqUQ38yCN4=";
+        };
+        meta = with lib; {
+          changelog = "https://github.com/skellock/vscode-just/blob/master/CHANGELOG.md";
+          description = "Provides syntax and recipe launcher for Just scripts";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=skellock.just";
+          homepage = "https://github.com/skellock/vscode-just";
+          license = licenses.mit;
+          maintainers = with maintainers; [ maximsmol ];
+        };
+      };
+
       skyapps.fish-vscode = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "fish-vscode";
diff --git a/pkgs/applications/graphics/avocode/default.nix b/pkgs/applications/graphics/avocode/default.nix
index 55080f333c2..4d2db993b8d 100644
--- a/pkgs/applications/graphics/avocode/default.nix
+++ b/pkgs/applications/graphics/avocode/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "avocode";
-  version = "4.15.5";
+  version = "4.15.6";
 
   src = fetchurl {
     url = "https://media.avocode.com/download/avocode-app/${version}/avocode-${version}-linux.zip";
-    sha256 = "sha256-vPS2hTaWjundVjtguy/1eH1qBaipN2Ij8PQODka+IGg=";
+    sha256 = "sha256-vNQT4jyMIIAk1pV3Hrp40nawFutWCv7xtwg2gU6ejy0=";
   };
 
   libPath = lib.makeLibraryPath (with xorg; [
diff --git a/pkgs/applications/graphics/weylus/default.nix b/pkgs/applications/graphics/weylus/default.nix
index 092366652d4..7965f824125 100644
--- a/pkgs/applications/graphics/weylus/default.nix
+++ b/pkgs/applications/graphics/weylus/default.nix
@@ -1,64 +1,80 @@
 { lib
-, dbus
 , stdenv
+, rustPlatform
+, fetchFromGitHub
+, dbus
+, ffmpeg
+, x264
+, libva
 , gst_all_1
 , xorg
 , libdrm
-, libva
-, fetchzip
-, copyDesktopItems
-, fontconfig
-, libpng
-, pipewire
-, makeWrapper
-, autoPatchelfHook
+, pkg-config
+, pango
+, cmake
+, autoconf
+, libtool
+, nodePackages
+, ApplicationServices
+, Carbon
+, Cocoa
+, VideoToolbox
 }:
 
-stdenv.mkDerivation rec {
+rustPlatform.buildRustPackage rec {
   pname = "weylus";
   version = "0.11.4";
 
-  src = fetchzip {
-    url = "https://github.com/H-M-H/Weylus/releases/download/v${version}/linux.zip";
-    sha256 = "sha256-EW3TdI4F4d4X/BeSqI05QtS77ym1U5jdswFfNtSFyFk=";
-    stripRoot = false;
+  src = fetchFromGitHub {
+    owner = "H-M-H";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0gq2czxvahww97j4i3k18np29zl6wx85f8253wn3ibqrpfnklz6l";
   };
 
-  installPhase = ''
-    runHook preInstall
-
-    install -Dm755 ./weylus $out/bin/weylus
-    copyDesktopItems ./weylus.desktop
-
-    runHook postInstall
-  '';
-
   buildInputs = [
-    libpng
+    ffmpeg
+    x264
+  ] ++ lib.optionals stdenv.isDarwin [
+    ApplicationServices
+    Carbon
+    Cocoa
+    VideoToolbox
+  ] ++ lib.optionals stdenv.isLinux [
     dbus
-    libdrm
-    fontconfig
     libva
     gst_all_1.gst-plugins-base
-    pipewire
-    # autoPatchelfHook complains if these are missing, even on wayland
+    xorg.libXext
     xorg.libXft
     xorg.libXinerama
     xorg.libXcursor
+    xorg.libXrender
+    xorg.libXfixes
+    xorg.libXtst
     xorg.libXrandr
     xorg.libXcomposite
-    xorg.libXtst
+    xorg.libXi
+    xorg.libXv
+    pango
+    libdrm
   ];
 
-  nativeBuildInputs = [ copyDesktopItems autoPatchelfHook makeWrapper ];
+  nativeBuildInputs = [
+    cmake
+    nodePackages.typescript
+  ] ++ lib.optionals stdenv.isLinux [
+    pkg-config
+    autoconf
+    libtool
+  ];
+
+  cargoSha256 = "1pigmch0sy9ipsafd83b8q54xwqjxdaif363n1q8n46arq4v81j0";
+
+  cargoBuildFlags = [ "--features=ffmpeg-system" ];
+  cargoTestFlags = [ "--features=ffmpeg-system" ];
 
-  postFixup = let
-    GST_PLUGIN_PATH = lib.makeSearchPathOutput  "lib" "lib/gstreamer-1.0" [
-      gst_all_1.gst-plugins-base
-      pipewire
-    ];
-  in ''
-    wrapProgram $out/bin/weylus --prefix GST_PLUGIN_PATH : ${GST_PLUGIN_PATH}
+  postInstall = ''
+    install -vDm755 weylus.desktop $out/share/applications/weylus.desktop
   '';
 
   meta = with lib; {
@@ -66,6 +82,5 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/H-M-H/Weylus";
     license = with licenses; [ agpl3Only ];
     maintainers = with maintainers; [ lom ];
-    platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/pkgs/applications/misc/spicetify-cli/default.nix b/pkgs/applications/misc/spicetify-cli/default.nix
index 7617984ac91..08a54f49584 100644
--- a/pkgs/applications/misc/spicetify-cli/default.nix
+++ b/pkgs/applications/misc/spicetify-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "spicetify-cli";
-  version = "2.9.1";
+  version = "2.9.2";
 
   src = fetchFromGitHub {
     owner = "khanhas";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Rs70LmJ/+pbISQpPuEYV2URFv7uf+jdTVQopUSKExSY=";
+    sha256 = "sha256-r6xm0Gq2QXWQEcYEu1n0y6S4r4odzYP8Srr0U+jZr6U=";
   };
 
   vendorSha256 = "sha256-g0RYIVIq4oMXdRZDBDnVYg7ombN5WEo/6O9hChQvOYs=";
diff --git a/pkgs/applications/networking/browsers/bombadillo/default.nix b/pkgs/applications/networking/browsers/bombadillo/default.nix
index b07c526c0d5..983f8ac1ee3 100644
--- a/pkgs/applications/networking/browsers/bombadillo/default.nix
+++ b/pkgs/applications/networking/browsers/bombadillo/default.nix
@@ -2,12 +2,12 @@
 
 buildGoModule rec {
   pname = "bombadillo";
-  version = "2.3.3";
+  version = "2.4.0";
 
   src = fetchgit {
     url = "https://tildegit.org/sloum/bombadillo.git";
     rev = version;
-    sha256 = "02w6h44sxzmk3bkdidl8xla0i9rwwpdqljnvcbydx5kyixycmg0q";
+    sha256 = "sha256-FjU9AyRAdGFr1bVpkmj5STkbzCXvpxOaOj7WNQJq7A0=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/applications/networking/cluster/talosctl/default.nix b/pkgs/applications/networking/cluster/talosctl/default.nix
index 8613abd9947..374d9c972c7 100644
--- a/pkgs/applications/networking/cluster/talosctl/default.nix
+++ b/pkgs/applications/networking/cluster/talosctl/default.nix
@@ -1,11 +1,11 @@
 { lib, buildGoModule, fetchFromGitHub, installShellFiles }:
 let
   # look for GO_LDFLAGS getting set in the Makefile
-  version = "0.14.2";
-  sha256 = "sha256-sQtry94T5cDO+836D/p/8ptQi3WYKDBLr1QZyEXdLQI=";
-  vendorSha256 = "sha256-cd2iNMxWmkSWqqkPLYocUG+fCUXoeUXEuGQxjUWQnXk=";
-  pkgsVersion = "0.9.0-4-gc875fbe";
-  extrasVersion = "0.7.0-2-gb4c9d21";
+  version = "0.14.3";
+  sha256 = "sha256-toEbWUZxnJkUe9jkZRdJrcPXu+CIh62fUKyX38OkXxU=";
+  vendorSha256 = "sha256-Pj1918TIOGfhkRiFEKkURL4xMFgWroiNsNU6yWzT8yk=";
+  pkgsVersion = "v0.9.0-6-gbfcc795";
+  extrasVersion = "v0.7.0-2-gb4c9d21";
 in
 buildGoModule rec {
   pname = "talosctl";
@@ -29,8 +29,8 @@ buildGoModule rec {
       "-X ${versionPkg}.Name=Talos"
       "-X ${versionPkg}.SHA=${src.rev}" # should be the hash, but as we build from tags, this needs to do
       "-X ${versionPkg}.Tag=${src.rev}"
-      "-X ${versionPkg}.PkgsVersion=v${pkgsVersion}" # PKGS
-      "-X ${versionPkg}.ExtrasVersion=v${extrasVersion}" # EXTRAS
+      "-X ${versionPkg}.PkgsVersion=${pkgsVersion}" # PKGS
+      "-X ${versionPkg}.ExtrasVersion=${extrasVersion}" # EXTRAS
       "-X ${imagesPkgs}.Username=talos-systems" # USERNAME
       "-X ${imagesPkgs}.Registry=ghcr.io" # REGISTRY
       "-X ${mgmtHelpersPkg}.ArtifactsPath=_out" # ARTIFACTS
diff --git a/pkgs/applications/networking/dnscontrol/default.nix b/pkgs/applications/networking/dnscontrol/default.nix
index 8b6a5e2cc25..c6ada11d356 100644
--- a/pkgs/applications/networking/dnscontrol/default.nix
+++ b/pkgs/applications/networking/dnscontrol/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "dnscontrol";
-  version = "3.14.0";
+  version = "3.15.0";
 
   src = fetchFromGitHub {
     owner = "StackExchange";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-4az63Ff4aUAFMZoQeHshS9TxA/BIyHFZ/svFgAsU6WU=";
+    sha256 = "sha256-znBvV6z5rMfLeyEBRmAtfwVw1is5jJlGPQplXqEGAAM=";
   };
 
-  vendorSha256 = "sha256-KbM2bKYnllxTw4B9W5E8iLZKvN/DJqBmWkXXLhEtsSQ=";
+  vendorSha256 = "sha256-S2og/isDy6Jvo9XgIV6XbgrmRJsLnePwh/gll/14Ds0=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/applications/networking/remote/freerdp/default.nix b/pkgs/applications/networking/remote/freerdp/default.nix
index 19e8d1eeba7..852fcf68987 100644
--- a/pkgs/applications/networking/remote/freerdp/default.nix
+++ b/pkgs/applications/networking/remote/freerdp/default.nix
@@ -52,13 +52,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "freerdp";
-  version = "2.6.0";
+  version = "2.6.1";
 
   src = fetchFromGitHub {
     owner = "FreeRDP";
     repo = "FreeRDP";
     rev = version;
-    sha256 = "sha256-gYHnorj2Up0aAVeltCCPOg/j3DY0ukWWNUU7uikvys0=";
+    sha256 = "sha256-+yKdB/glNf74drv9EvBwVMWrqr5ADBkSJVVDH+UKb2U=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/video/ffmpeg-normalize/default.nix b/pkgs/applications/video/ffmpeg-normalize/default.nix
index add2e525dc9..a2f802c6e87 100644
--- a/pkgs/applications/video/ffmpeg-normalize/default.nix
+++ b/pkgs/applications/video/ffmpeg-normalize/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonApplication rec {
   pname = "ffmpeg-normalize";
-  version = "1.22.7";
+  version = "1.22.8";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-yWn9SoVKnj9KtvBdI3k1a7fuKJmYeu9KrNyvPqw9SHU=";
+    sha256 = "sha256-vxiq6q8fPh8ZLKnxYdIN591UQW73FWsoke1PvKTkko8=";
   };
 
   propagatedBuildInputs = [ ffmpeg ffmpeg-progress-yield ];
diff --git a/pkgs/applications/video/losslesscut-bin/appimage.nix b/pkgs/applications/video/losslesscut-bin/appimage.nix
index d1f60c3dd2c..e6be6f54e1d 100644
--- a/pkgs/applications/video/losslesscut-bin/appimage.nix
+++ b/pkgs/applications/video/losslesscut-bin/appimage.nix
@@ -1,4 +1,4 @@
-{ appimageTools, lib, fetchurl, gtk3, gsettings-desktop-schemas, version }:
+{ appimageTools, lib, fetchurl, gtk3, gsettings-desktop-schemas, version, sha256 }:
 
 let
   pname = "losslesscut";
@@ -11,7 +11,7 @@ let
   src = fetchurl {
     url = "https://github.com/${owner}/${nameRepo}/releases/download/v${version}/${nameSource}";
     name = nameSource;
-    sha256 = "0aqz5ijl5japfzzbcdcd2mmihkb8b2fc2hs9kkm3211yb37c5ygv";
+    inherit sha256;
   };
   extracted = appimageTools.extractType2 {
     inherit name src;
diff --git a/pkgs/applications/video/losslesscut-bin/default.nix b/pkgs/applications/video/losslesscut-bin/default.nix
index 01f9c158062..be7786f9102 100644
--- a/pkgs/applications/video/losslesscut-bin/default.nix
+++ b/pkgs/applications/video/losslesscut-bin/default.nix
@@ -1,9 +1,9 @@
 { callPackage, stdenvNoCC, lib }:
 let
-  version = "3.33.1";
-  appimage = callPackage ./appimage.nix { inherit version; };
-  dmg = callPackage ./dmg.nix { inherit version; };
-  windows = callPackage ./windows.nix { inherit version; };
+  version = "3.43.0";
+  appimage = callPackage ./appimage.nix { inherit version; sha256 = "1xfr3i4gsi13wj374yr5idhgs0q71s4h33yxdr7b7xjdg2gb8lp1"; };
+  dmg = callPackage ./dmg.nix { inherit version; sha256 = "1axki47hrxx5m0hrmjpxcya091lahqfnh2pd3zhn5dd496slq8an"; };
+  windows = callPackage ./windows.nix { inherit version; sha256 = "1v00gym18hjxxm42dfqmw7vhwh8lgjz2jgv6fmg234npr3d43py5"; };
 in (
   if stdenvNoCC.isDarwin then dmg
   else if stdenvNoCC.isCygwin then windows
@@ -13,7 +13,7 @@ in (
   meta = with lib; {
     description = "The swiss army knife of lossless video/audio editing";
     homepage = "https://mifi.no/losslesscut/";
-    license = licenses.mit;
+    license = licenses.gpl2Only;
     maintainers = with maintainers; [ ShamrockLee ];
   } // oldAttrs.meta // {
     platforms =
diff --git a/pkgs/applications/video/losslesscut-bin/dmg.nix b/pkgs/applications/video/losslesscut-bin/dmg.nix
index 3d0bad19757..3cbd77198b9 100644
--- a/pkgs/applications/video/losslesscut-bin/dmg.nix
+++ b/pkgs/applications/video/losslesscut-bin/dmg.nix
@@ -1,4 +1,4 @@
-{ stdenvNoCC, lib, fetchurl, undmg, version }:
+{ stdenvNoCC, lib, fetchurl, undmg, version , sha256 }:
 
 let
   pname = "losslesscut";
@@ -10,7 +10,7 @@ let
   src = fetchurl {
     url = "https://github.com/${owner}/${nameRepo}/releases/download/v${version}/${nameSource}";
     name = nameSource;
-    sha256 = "0xa1avbwar7x7kv5yn2ldca4vj3nwaz0dhjm3bcdy59q914xn3dj";
+    inherit sha256;
   };
 in stdenvNoCC.mkDerivation {
   inherit pname version src;
diff --git a/pkgs/applications/video/losslesscut-bin/windows.nix b/pkgs/applications/video/losslesscut-bin/windows.nix
index fe5df9d6c90..0e6ed9b0412 100644
--- a/pkgs/applications/video/losslesscut-bin/windows.nix
+++ b/pkgs/applications/video/losslesscut-bin/windows.nix
@@ -3,6 +3,7 @@
 , fetchurl
 , unzip
 , version
+, sha256
 , useMklink ? false
 , customSymlinkCommand ? null
 }:
@@ -18,12 +19,12 @@ let
     else if useMklink then (targetPath: linkPath: "mklink ${targetPath} ${linkPath}")
     else (targetPath: linkPath: "ln -s ${targetPath} ${linkPath}");
 in stdenvNoCC.mkDerivation {
-  inherit pname version;
+  inherit pname version sha256;
 
   src = fetchurl {
     name = nameSource;
     url = "https://github.com/${owner}/${nameRepo}/releases/download/v${version}/${nameSource}";
-    sha256 = "1rq9frab0jl9y1mgmjhzsm734jvz0a646zq2wi5xzzspn4wikhvb";
+    inherit sha256;
   };
 
   nativeBuildInputs = [ unzip ];
diff --git a/pkgs/applications/virtualization/colima/default.nix b/pkgs/applications/virtualization/colima/default.nix
index e83fc4ef501..980955fcda6 100644
--- a/pkgs/applications/virtualization/colima/default.nix
+++ b/pkgs/applications/virtualization/colima/default.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "colima";
-  version = "0.3.3";
+  version = "0.3.4";
 
   src = fetchFromGitHub {
     owner = "abiosoft";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-nov+DIaeYaRJy7Cz1hcKJUA88IKlZ4z/tn4WASZjxLI=";
+    sha256 = "sha256-g7q2DmtyArtW7Ii2XF5umXQ0+BlCSa1Q7VNNuIuX65k=";
   };
 
   nativeBuildInputs = [ installShellFiles makeWrapper ];
diff --git a/pkgs/applications/virtualization/x11docker/default.nix b/pkgs/applications/virtualization/x11docker/default.nix
index 6ac7377122d..67345952655 100644
--- a/pkgs/applications/virtualization/x11docker/default.nix
+++ b/pkgs/applications/virtualization/x11docker/default.nix
@@ -1,12 +1,12 @@
 { lib, stdenv, fetchFromGitHub, makeWrapper, nx-libs, xorg, getopt, gnugrep, gawk, ps, mount, iproute2 }:
 stdenv.mkDerivation rec {
   pname = "x11docker";
-  version = "7.1.0";
+  version = "7.1.1";
   src = fetchFromGitHub {
     owner = "mviereck";
     repo = "x11docker";
     rev = "v${version}";
-    sha256 = "sha256-SBX50wQbNUvgmnO0B0iXiEXEmJrkVmtNqUUv0O6yRic=";
+    sha256 = "sha256-SUHWqcDL/oDljCpngkhUvzOvMIlZSc1p0j0wjupPBqw=";
   };
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/applications/window-managers/sway/lock.nix b/pkgs/applications/window-managers/sway/lock.nix
index 6dccedad827..b70160b1dbf 100644
--- a/pkgs/applications/window-managers/sway/lock.nix
+++ b/pkgs/applications/window-managers/sway/lock.nix
@@ -5,20 +5,15 @@
 
 stdenv.mkDerivation rec {
   pname = "swaylock";
-  version = "1.5";
+  version = "1.6";
 
   src = fetchFromGitHub {
     owner = "swaywm";
     repo = "swaylock";
     rev = version;
-    sha256 = "0r95p4w11dwm5ra614vddz83r8j7z6gd120z2vcchy7m9b0f15kf";
+    sha256 = "sha256-VVGgidmSQWKxZNx9Cd6z52apxpxVfmX3Ut/G9kzfDcY=";
   };
 
-  postPatch = ''
-    substituteInPlace meson.build \
-      --replace "version: '1.4'" "version: '${version}'"
-  '';
-
   nativeBuildInputs = [ meson ninja pkg-config scdoc wayland-scanner ];
   buildInputs = [ wayland wayland-protocols libxkbcommon cairo gdk-pixbuf pam ];
 
diff --git a/pkgs/build-support/make-desktopitem/default.nix b/pkgs/build-support/make-desktopitem/default.nix
index e0a57f4aa3f..31964953247 100644
--- a/pkgs/build-support/make-desktopitem/default.nix
+++ b/pkgs/build-support/make-desktopitem/default.nix
@@ -1,4 +1,4 @@
-{ lib, writeTextFile, desktop-file-utils }:
+{ lib, writeTextFile, buildPackages }:
 
 # All possible values as defined by the spec, version 1.4.
 # Please keep in spec order for easier maintenance.
@@ -119,5 +119,5 @@ writeTextFile {
   name = "${cleanName}.desktop";
   destination = "/share/applications/${cleanName}.desktop";
   text = builtins.concatStringsSep "\n" content;
-  checkPhase = "${desktop-file-utils}/bin/desktop-file-validate $target";
+  checkPhase = "${buildPackages.desktop-file-utils}/bin/desktop-file-validate $target";
 }
diff --git a/pkgs/data/documentation/zeal/default.nix b/pkgs/data/documentation/zeal/default.nix
index 8c806b87d4b..de3d7638eb9 100644
--- a/pkgs/data/documentation/zeal/default.nix
+++ b/pkgs/data/documentation/zeal/default.nix
@@ -9,8 +9,8 @@ mkDerivation rec {
   src = fetchFromGitHub {
     owner = "zealdocs";
     repo = "zeal";
-    rev = "1ce0e2e446232e7647c5588c1f603f1dd88e0f67";
-    sha256 = "0gj5qcm7ck8m5zfmiabay2f7wbxldmrkw8m3xi7v9i8y8hx0jkxr";
+    rev = "763edca12ccd6c67e51f10891d1ced8b2510904f";
+    sha256 = "sha256-1/wQXkRWvpRia8UDvvvmzHinPG8q2Tz9Uoeegej9uC8=";
   };
 
   # we only need this if we are using a version that hasn't been released. We
diff --git a/pkgs/data/soundfonts/fluid/default.nix b/pkgs/data/soundfonts/fluid/default.nix
index 1f84a6fd1ee..193c9a60b9f 100644
--- a/pkgs/data/soundfonts/fluid/default.nix
+++ b/pkgs/data/soundfonts/fluid/default.nix
@@ -1,7 +1,8 @@
 { lib, stdenv, fetchurl }:
 
 stdenv.mkDerivation {
-  name = "Fluid-3";
+  pname = "Fluid";
+  version = "3";
 
   src = fetchurl {
     url = "https://ftp.osuosl.org/pub/musescore/soundfont/fluid-soundfont.tar.gz";
diff --git a/pkgs/data/soundfonts/ydp-grand/default.nix b/pkgs/data/soundfonts/ydp-grand/default.nix
index 3b44b712139..635b445f611 100644
--- a/pkgs/data/soundfonts/ydp-grand/default.nix
+++ b/pkgs/data/soundfonts/ydp-grand/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchurl }:
 
 stdenv.mkDerivation {
-  name = "ydp-grand";
+  pname = "ydp-grand";
   version = "unstable-2016-08-04";
 
   src = fetchurl {
diff --git a/pkgs/data/themes/gnome-breeze/default.nix b/pkgs/data/themes/gnome-breeze/default.nix
index 09f9ecd197a..38733590a34 100644
--- a/pkgs/data/themes/gnome-breeze/default.nix
+++ b/pkgs/data/themes/gnome-breeze/default.nix
@@ -1,12 +1,16 @@
-{ lib, stdenv, fetchgit }:
+{ lib, stdenv, fetchFromGitHub }:
 
 stdenv.mkDerivation {
-  name = "gnome-breeze-20160526";
-  src = fetchgit {
-    url = "https://github.com/dirruk1/gnome-breeze";
-    sha256 = "0hkk0gqlnrs1m4rb5r84f5y96qfamrbiwm09z89yc32124x1a1lm";
+  pname = "gnome-breeze";
+  version = "unstable-2016-05-26";
+
+  src = fetchFromGitHub {
+    owner = "dirruk1";
+    repo = "gnome-breeze";
     rev = "49a5cd67a270e13a4c04a4b904f126ef728e9221";
+    sha256 = "sha256-lQYVOhFBDOYT+glUHleuymGTfHEE5bIyqUFnS/EDc0I=";
   };
+
   installPhase = ''
     mkdir -p $out/share/themes
     cp -r Breeze* $out/share/themes
@@ -14,12 +18,12 @@ stdenv.mkDerivation {
 
   preferLocalBuild = true;
 
-  meta = {
+  meta = with lib; {
     description = "A GTK theme built to match KDE's breeze theme";
     homepage = "https://github.com/dirruk1/gnome-breeze";
-    license = lib.licenses.lgpl2;
-    maintainers = with lib.maintainers; [ bennofs ];
-    platforms = lib.platforms.all;
+    license = licenses.lgpl2;
+    maintainers = with maintainers; [ bennofs ];
+    platforms = platforms.all;
     hydraPlatforms = [];
   };
 }
diff --git a/pkgs/desktops/cdesktopenv/default.nix b/pkgs/desktops/cdesktopenv/default.nix
index 71b661f1265..77650e71ebe 100644
--- a/pkgs/desktops/cdesktopenv/default.nix
+++ b/pkgs/desktops/cdesktopenv/default.nix
@@ -18,10 +18,10 @@ let
   };
 in stdenv.mkDerivation rec {
   version = "2.3.2";
-  name = "cde-${version}";
+  pname = "cde";
 
   src = fetchurl {
-    url = "mirror://sourceforge/cdesktopenv/${name}.tar.gz";
+    url = "mirror://sourceforge/cdesktopenv/cde-${version}.tar.gz";
     sha256 = "029rljhi5r483x8rzdpl8625z0wx8r7k2m0364nbw66h5pig9lbx";
   };
 
diff --git a/pkgs/desktops/pantheon/apps/switchboard/wrapper.nix b/pkgs/desktops/pantheon/apps/switchboard/wrapper.nix
index 7953105951c..e42df9bee06 100644
--- a/pkgs/desktops/pantheon/apps/switchboard/wrapper.nix
+++ b/pkgs/desktops/pantheon/apps/switchboard/wrapper.nix
@@ -19,7 +19,8 @@ let
   testingName = lib.optionalString (testName != null) "${testName}-";
 in
 stdenv.mkDerivation rec {
-  name = "${testingName}${switchboard.name}-with-plugs";
+  pname = "${testingName}${switchboard.pname}-with-plugs";
+  inherit (switchboard) version;
 
   src = null;
 
diff --git a/pkgs/desktops/pantheon/desktop/wingpanel/wrapper.nix b/pkgs/desktops/pantheon/desktop/wingpanel/wrapper.nix
index ca887d45dc3..89a359a4c9d 100644
--- a/pkgs/desktops/pantheon/desktop/wingpanel/wrapper.nix
+++ b/pkgs/desktops/pantheon/desktop/wingpanel/wrapper.nix
@@ -17,7 +17,8 @@ let
     else indicators ++ (lib.optionals useDefaultIndicators wingpanelIndicators);
 in
 stdenv.mkDerivation rec {
-  name = "${wingpanel.name}-with-indicators";
+  pname = "${wingpanel.pname}-with-indicators";
+  inherit (wingpanel) version;
 
   src = null;
 
diff --git a/pkgs/development/compilers/bs-platform/ocaml.nix b/pkgs/development/compilers/bs-platform/ocaml.nix
index d650d767a8d..05fb8b6b17e 100644
--- a/pkgs/development/compilers/bs-platform/ocaml.nix
+++ b/pkgs/development/compilers/bs-platform/ocaml.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, src, version }:
 stdenv.mkDerivation rec {
   inherit src version;
-  name = "ocaml-${version}+bs";
+  pname = "ocaml-bs";
   configurePhase = ''
     ./configure -prefix $out
   '';
diff --git a/pkgs/development/compilers/ios-cross-compile/9.2.nix b/pkgs/development/compilers/ios-cross-compile/9.2.nix
index 688ca15177a..ea1af60993f 100644
--- a/pkgs/development/compilers/ios-cross-compile/9.2.nix
+++ b/pkgs/development/compilers/ios-cross-compile/9.2.nix
@@ -4,7 +4,7 @@
   automake, autoconf, libtool, clangStdenv } :
 
 clangStdenv.mkDerivation rec {
-  name = "ios-cross-compile-${version}";
+  pname = "ios-cross-compile";
   version = "9.2";
   sdk = "iPhoneOS9.2.sdk";
   cctools_port = fetchFromGitHub {
diff --git a/pkgs/development/compilers/mit-scheme/default.nix b/pkgs/development/compilers/mit-scheme/default.nix
index c67f8d2f72f..75b3d1128e4 100644
--- a/pkgs/development/compilers/mit-scheme/default.nix
+++ b/pkgs/development/compilers/mit-scheme/default.nix
@@ -12,7 +12,8 @@ let
      "-x86-64";
 in
 stdenv.mkDerivation {
-  name = if enableX11 then "mit-scheme-x11-${version}" else "mit-scheme-${version}";
+  pname = "mit-scheme" + lib.optionalString enableX11 "-x11";
+  inherit version;
 
   # MIT/GNU Scheme is not bootstrappable, so it's recommended to compile from
   # the platform-specific tarballs, which contain pre-built binaries.  It
diff --git a/pkgs/development/compilers/openjdk/jre.nix b/pkgs/development/compilers/openjdk/jre.nix
index 78dec7885d9..02f6da928cd 100644
--- a/pkgs/development/compilers/openjdk/jre.nix
+++ b/pkgs/development/compilers/openjdk/jre.nix
@@ -7,7 +7,7 @@
 
 let
   jre = stdenv.mkDerivation {
-    name = "${jdk.name}-minimal-jre";
+    pname = "${jdk.pname}-minimal-jre";
     version = jdk.version;
 
     buildInputs = [ jdk ];
diff --git a/pkgs/development/compilers/osl/default.nix b/pkgs/development/compilers/osl/default.nix
index 736a9d3c34c..53b05c16d9a 100644
--- a/pkgs/development/compilers/osl/default.nix
+++ b/pkgs/development/compilers/osl/default.nix
@@ -7,7 +7,7 @@ let boost_static = boost165.override { enableStatic = true; };
 in clangStdenv.mkDerivation rec {
   # In theory this could use GCC + Clang rather than just Clang,
   # but https://github.com/NixOS/nixpkgs/issues/29877 stops this
-  name = "openshadinglanguage-${version}";
+  pname = "openshadinglanguage";
   version = "1.10.9";
 
   src = fetchFromGitHub {
diff --git a/pkgs/development/compilers/rust/clippy.nix b/pkgs/development/compilers/rust/clippy.nix
index a3597e9febf..23b8e7effe1 100644
--- a/pkgs/development/compilers/rust/clippy.nix
+++ b/pkgs/development/compilers/rust/clippy.nix
@@ -1,6 +1,6 @@
 { stdenv, lib, rustPlatform, rustc, Security, patchelf }:
 rustPlatform.buildRustPackage {
-  name = "clippy-${rustc.version}";
+  pname = "clippy";
   inherit (rustc) version src;
 
   # the rust source tarball already has all the dependencies vendored, no need to fetch them again
diff --git a/pkgs/development/compilers/scala/dotty.nix b/pkgs/development/compilers/scala/dotty.nix
index c99ed24c214..1cd187f2e54 100644
--- a/pkgs/development/compilers/scala/dotty.nix
+++ b/pkgs/development/compilers/scala/dotty.nix
@@ -7,7 +7,8 @@ let
 in
 
 stdenv.mkDerivation {
-  name = "dotty-${dotty-bare.version}";
+  pname = "dotty";
+  inherit (dotty-bare) version;
 
   dontUnpack = true;
 
diff --git a/pkgs/development/compilers/swift/default.nix b/pkgs/development/compilers/swift/default.nix
index e3a9aa2b486..f47d4cd818f 100644
--- a/pkgs/development/compilers/swift/default.nix
+++ b/pkgs/development/compilers/swift/default.nix
@@ -182,7 +182,8 @@ let
 
 in
 stdenv.mkDerivation {
-  name = "swift-${versions.swift}";
+  pname = "swift";
+  version = versions.swift;
 
   nativeBuildInputs = [
     autoconf
diff --git a/pkgs/development/compilers/urn/default.nix b/pkgs/development/compilers/urn/default.nix
index 7381e7c89fe..66f1bda6d5f 100644
--- a/pkgs/development/compilers/urn/default.nix
+++ b/pkgs/development/compilers/urn/default.nix
@@ -21,7 +21,8 @@ let
 in
 
 stdenv.mkDerivation {
-  name = "urn-${optionalString (extraLibraries != []) "with-libraries-"}${version}";
+  pname = "urn${optionalString (extraLibraries != []) "-with-libraries"}";
+  inherit version;
 
   src = fetchFromGitLab {
     owner = "urn";
diff --git a/pkgs/development/interpreters/chibi/default.nix b/pkgs/development/interpreters/chibi/default.nix
index c0ee8988c09..4a8b639071a 100644
--- a/pkgs/development/interpreters/chibi/default.nix
+++ b/pkgs/development/interpreters/chibi/default.nix
@@ -1,18 +1,8 @@
 { lib, stdenv, fetchFromGitHub, makeWrapper }:
-let
-  version = "0.10";
-  name = "chibi-scheme-${version}";
-in
-stdenv.mkDerivation {
-  inherit name;
 
-  meta = {
-    homepage = "https://github.com/ashinn/chibi-scheme";
-    description = "Small Footprint Scheme for use as a C Extension Language";
-    platforms = lib.platforms.all;
-    license = lib.licenses.bsd3;
-    maintainers = [ lib.maintainers.DerGuteMoritz ];
-  };
+stdenv.mkDerivation rec {
+  version = "0.10";
+  pname = "chibi-scheme";
 
   src = fetchFromGitHub {
     owner = "ashinn";
@@ -36,4 +26,12 @@ stdenv.mkDerivation {
         --replace "/usr/bin/env chibi-scheme" "$out/bin/chibi-scheme"
     done
   '';
+
+  meta = {
+    homepage = "https://github.com/ashinn/chibi-scheme";
+    description = "Small Footprint Scheme for use as a C Extension Language";
+    platforms = lib.platforms.all;
+    license = lib.licenses.bsd3;
+    maintainers = [ lib.maintainers.DerGuteMoritz ];
+  };
 }
diff --git a/pkgs/development/interpreters/elixir/generic-builder.nix b/pkgs/development/interpreters/elixir/generic-builder.nix
index 646fd70ff8f..5f08386c9f5 100644
--- a/pkgs/development/interpreters/elixir/generic-builder.nix
+++ b/pkgs/development/interpreters/elixir/generic-builder.nix
@@ -25,7 +25,7 @@ in
 assert versionAtLeast (getVersion erlang) minimumOTPVersion;
 
 stdenv.mkDerivation ({
-  name = "${baseName}-${version}";
+  pname = "${baseName}";
 
   inherit src version debugInfo;
 
diff --git a/pkgs/development/interpreters/racket/minimal.nix b/pkgs/development/interpreters/racket/minimal.nix
index e56945ed651..b73cdaff5d3 100644
--- a/pkgs/development/interpreters/racket/minimal.nix
+++ b/pkgs/development/interpreters/racket/minimal.nix
@@ -2,9 +2,10 @@
 }:
 
 racket.overrideAttrs (oldAttrs: rec {
-  name = "racket-minimal-${oldAttrs.version}";
+  pname = "racket-minimal";
+  version = oldAttrs.version;
   src = oldAttrs.src.override {
-    inherit name;
+    name = "${pname}-${version}";
     sha256 = "sha256-FZlUWvjtioe4S8gPetj7vdneVX6jEFguJo4j2wJsKAw=";
   };
 
diff --git a/pkgs/development/java-modules/m2install.nix b/pkgs/development/java-modules/m2install.nix
index d0a13f62520..f223e205220 100644
--- a/pkgs/development/java-modules/m2install.nix
+++ b/pkgs/development/java-modules/m2install.nix
@@ -2,15 +2,15 @@
 { version, artifactId, groupId, sha512, type ? "jar", suffix ? "" }:
 
 let
-  name = "${artifactId}-${version}";
   m2Path = "${builtins.replaceStrings ["."] ["/"] groupId}/${artifactId}/${version}";
-  m2File = "${name}${suffix}.${type}";
+  m2File = "${artifactId}-${version}${suffix}.${type}";
   src = fetchurl {
       inherit sha512;
       url = "mirror://maven/${m2Path}/${m2File}";
   };
 in stdenv.mkDerivation {
-  inherit name m2Path m2File src;
+  inherit version m2Path m2File src;
+  pname = artifactId;
 
   dontUnpack = true;
 
diff --git a/pkgs/development/libraries/CGAL/4.nix b/pkgs/development/libraries/CGAL/4.nix
index a1d3c183b8e..7380a85248f 100644
--- a/pkgs/development/libraries/CGAL/4.nix
+++ b/pkgs/development/libraries/CGAL/4.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   version = "4.14.2";
-  name = "cgal-" + version;
+  pname = "cgal";
 
   src = fetchFromGitHub {
     owner = "CGAL";
diff --git a/pkgs/development/libraries/google-cloud-cpp/default.nix b/pkgs/development/libraries/google-cloud-cpp/default.nix
index 870e919357e..8758daf9c3a 100644
--- a/pkgs/development/libraries/google-cloud-cpp/default.nix
+++ b/pkgs/development/libraries/google-cloud-cpp/default.nix
@@ -11,6 +11,7 @@
 , gtest
 , ninja
 , nlohmann_json
+, openssl
 , pkg-config
 , protobuf
   # default list of APIs: https://github.com/googleapis/google-cloud-cpp/blob/v1.32.1/CMakeLists.txt#L173
@@ -18,29 +19,29 @@
 , staticOnly ? stdenv.hostPlatform.isStatic
 }:
 let
-  googleapisRev = "ed739492993c4a99629b6430affdd6c0fb59d435";
+  googleapisRev = "d4f3468ef85278428005ed555b3a85db91551ee6";
   googleapis = fetchFromGitHub {
     owner = "googleapis";
     repo = "googleapis";
     rev = googleapisRev;
-    hash = "sha256:1xrnh77vb8hxmf1ywqsifzd39kylhbdyah0b0b9bm7nw0mnahssl";
+    hash = "sha256-sIQVFQhE3Ae6ia45apzdgtwzglMM4hFZ8efNAhMO5ZY=";
   };
   excludedTests = builtins.fromTOML (builtins.readFile ./skipped_tests.toml);
 in
 stdenv.mkDerivation rec {
   pname = "google-cloud-cpp";
-  version = "1.32.1";
+  version = "1.38.0";
 
   src = fetchFromGitHub {
     owner = "googleapis";
     repo = "google-cloud-cpp";
     rev = "v${version}";
-    sha256 = "0g720sni70nlncv4spm4rlfykdkpjnv81axfz2jd1arpdajm0mg9";
+    sha256 = "sha256-kobOkohWIDTQaaihhoh/25tZUNv+CjKFwj2xQqO52bA=";
   };
 
   postPatch = ''
     substituteInPlace external/googleapis/CMakeLists.txt \
-      --replace "https://github.com/googleapis/googleapis/archive/${googleapisRev}.tar.gz" "file://${googleapis}"
+      --replace "https://github.com/googleapis/googleapis/archive/\''${GOOGLE_CLOUD_CPP_GOOGLEAPIS_COMMIT_SHA}.tar.gz" "file://${googleapis}"
   '';
 
   nativeBuildInputs = [
@@ -48,7 +49,7 @@ stdenv.mkDerivation rec {
     ninja
     pkg-config
   ] ++ lib.optionals (!doInstallCheck) [
-    # enable these dependencies when doInstallCheck failse because we're
+    # enable these dependencies when doInstallCheck is false because we're
     # unconditionally building tests and benchmarks
     #
     # when doInstallCheck is true, these deps are added to installCheckInputs
@@ -63,6 +64,7 @@ stdenv.mkDerivation rec {
     curl
     grpc
     nlohmann_json
+    openssl
     protobuf
   ];
 
diff --git a/pkgs/development/libraries/google-cloud-cpp/skipped_tests.toml b/pkgs/development/libraries/google-cloud-cpp/skipped_tests.toml
index c2fb2a24483..8cbe766862b 100644
--- a/pkgs/development/libraries/google-cloud-cpp/skipped_tests.toml
+++ b/pkgs/development/libraries/google-cloud-cpp/skipped_tests.toml
@@ -1,6 +1,6 @@
 whole = [
   "bigquery_bigquery_read_integration_test",
-  "bigtable_admin_backup_integration_test",
+  "bigtable_admin_admin_iam_policy_integration_test",
   "bigtable_admin_iam_policy_integration_test",
   "bigtable_admin_integration_test",
   "bigtable_apply_read_latency_benchmark",
@@ -15,12 +15,15 @@ whole = [
   "bigtable_table_sample_rows_integration_test",
   "iam_iam_credentials_integration_test",
   "iam_iam_integration_test",
+  "logging_quickstart",
   "pubsub_endurance",
   "pubsub_schema_admin_integration_test",
   "pubsub_subscriber_integration_test",
   "pubsub_subscription_admin_integration_test",
   "pubsub_throughput",
   "pubsub_topic_admin_integration_test",
+  "rest_internal_internal_curl_rest_client_integration_test",
+  "rest_internal_internal_unified_rest_credentials_integration_test",
   "spanner_admin_backup_extra_integration_test",
   "spanner_admin_database_admin_integration_test",
   "spanner_admin_instance_admin_integration_test",
diff --git a/pkgs/development/libraries/liblouis/default.nix b/pkgs/development/libraries/liblouis/default.nix
index f61fb775fbd..893704ddb18 100644
--- a/pkgs/development/libraries/liblouis/default.nix
+++ b/pkgs/development/libraries/liblouis/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "liblouis";
-  version = "3.20.0";
+  version = "3.21.0";
 
   src = fetchFromGitHub {
     owner = "liblouis";
     repo = "liblouis";
     rev = "v${version}";
-    sha256 = "sha256-DuMVs9cC0VnZg3E9GtZB8LYkp3Ybfzlv8vd4d1Muwyc=";
+    sha256 = "sha256-Hfn0dfXihtUfO3R+qJaetrPwupcIwblvi1DQdHCF1s8=";
   };
 
   outputs = [ "out" "dev" "man" "info" "doc" ];
diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index c4442f1fd79..71d85a776bb 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -2033,14 +2033,14 @@ luv = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
 }:
 buildLuarocksPackage {
   pname = "luv";
-  version = "1.42.0-0";
+  version = "1.43.0-0";
   knownRockspec = (fetchurl {
-    url    = "https://luarocks.org/luv-1.42.0-0.rockspec";
-    sha256 = "0pr2gjjnm60w0csb0dacrjalan7ifsfw4lki4ykxx1f4m5snam09";
+    url    = "https://raw.githubusercontent.com/rocks-moonscript-org/moonrocks-mirror/master/luv-1.43.0-0.rockspec";
+    sha256 = "0z5a7yp20xbb3f9w73skm9fj89gxxqv72nrxjq3kycsc6c2v3m8f";
   }).outPath;
   src = fetchurl {
-    url    = "https://github.com/luvit/luv/releases/download/1.42.0-0/luv-1.42.0-0.tar.gz";
-    sha256 = "0dkzjkkm0h516ag6sfz5iji761y9slrcfw325f39zkda1sfql8mm";
+    url    = "https://github.com/luvit/luv/releases/download/1.43.0-0/luv-1.43.0-0.tar.gz";
+    sha256 = "1qlx1r79sfn8r20yx19bhdr0v58ykpwgwzy5vma9p2ngrlynyyjn";
   };
 
   disabled = with lua; (luaOlder "5.1");
diff --git a/pkgs/development/ocaml-modules/camomile/default.nix b/pkgs/development/ocaml-modules/camomile/default.nix
index a75f05b33f2..e5fe6702131 100644
--- a/pkgs/development/ocaml-modules/camomile/default.nix
+++ b/pkgs/development/ocaml-modules/camomile/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, buildDunePackage, cppo }:
+{ lib, fetchFromGitHub, buildDunePackage, ocaml, cppo }:
 
 buildDunePackage rec {
   pname = "camomile";
@@ -23,6 +23,10 @@ buildDunePackage rec {
     runHook postConfigure
   '';
 
+  postInstall = ''
+    echo "version = \"${version}\"" >> $out/lib/ocaml/${ocaml.version}/site-lib/camomile/META
+  '';
+
   meta = {
     inherit (src.meta) homepage;
     maintainers = [ lib.maintainers.vbgl ];
diff --git a/pkgs/development/python-modules/adafruit-platformdetect/default.nix b/pkgs/development/python-modules/adafruit-platformdetect/default.nix
index 1ae1a31fa3d..9ed55214b4c 100644
--- a/pkgs/development/python-modules/adafruit-platformdetect/default.nix
+++ b/pkgs/development/python-modules/adafruit-platformdetect/default.nix
@@ -6,13 +6,13 @@
 
 buildPythonPackage rec {
   pname = "adafruit-platformdetect";
-  version = "3.20.1";
+  version = "3.21.0";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "Adafruit-PlatformDetect";
     inherit version;
-    sha256 = "sha256-P5OWPsbRsTEMcvw7/uq0rj9p/4beVj/2OdWkllVMKMw=";
+    sha256 = "sha256-H65Ar/+9AwhKFNRK/SZyU8XzrMt3myjBo+YNJYtQ0b4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/bc-python-hcl2/default.nix b/pkgs/development/python-modules/bc-python-hcl2/default.nix
index 42203a43da4..78529e288ca 100644
--- a/pkgs/development/python-modules/bc-python-hcl2/default.nix
+++ b/pkgs/development/python-modules/bc-python-hcl2/default.nix
@@ -1,33 +1,21 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, lark
 , nose
 , pythonOlder
 }:
 
-let
-  lark-parser = buildPythonPackage rec {
-    pname = "lark-parser";
-    version = "0.10.1";
-
-    src = fetchPypi {
-      inherit pname version;
-      sha256 = "15jr4c1falvgkq664xdgamykk6waklh1psy8v3wlrg0v59hngws2";
-    };
-
-    doCheck = true;
-  };
-in
 buildPythonPackage rec {
   pname = "bc-python-hcl2";
-  version = "0.3.30";
+  version = "0.3.33";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-wfcTIPKbMPa7xpXzkFtxnxG2ZRFzTw35EP7f4zwHxcs=";
+    hash = "sha256-tdsw9gf64VGH9tRWgYZZq3FNa5B5JNhN3k6wUHrU5zY=";
   };
 
   # Nose is required during build process, so can not use `checkInputs`.
@@ -36,7 +24,7 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
-    lark-parser
+    lark
   ];
 
   # This fork of python-hcl2 doesn't ship tests
diff --git a/pkgs/development/python-modules/google-cloud-access-context-manager/default.nix b/pkgs/development/python-modules/google-cloud-access-context-manager/default.nix
index 05963856edc..5861c66ca58 100644
--- a/pkgs/development/python-modules/google-cloud-access-context-manager/default.nix
+++ b/pkgs/development/python-modules/google-cloud-access-context-manager/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-access-context-manager";
-  version = "0.1.9";
+  version = "0.1.10";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "249a1c1a858bb182b73749784457baacfcab8e7c13da5f3421109d5b8dace5b8";
+    sha256 = "sha256-/qQxNUVAHKZ5Go4GYpJ9ATi/EeseJPMyK5HsQCjtL0o=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-appengine-logging/default.nix b/pkgs/development/python-modules/google-cloud-appengine-logging/default.nix
index 67296f667ab..c6f17c8d8b0 100644
--- a/pkgs/development/python-modules/google-cloud-appengine-logging/default.nix
+++ b/pkgs/development/python-modules/google-cloud-appengine-logging/default.nix
@@ -7,15 +7,19 @@
 , proto-plus
 , pytest-asyncio
 , pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-appengine-logging";
-  version = "1.1.0";
+  version = "1.1.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "91fe9b0833f6e1a46293dcc0e483716372c9ff4a95ebe51276c5f0092cb9defd";
+    hash = "sha256-NhRQ7X17/Y79DvJT4haArrb23zzwV+XoJT9YUfjLvKc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-automl/default.nix b/pkgs/development/python-modules/google-cloud-automl/default.nix
index 03022877a24..be13251d2f4 100644
--- a/pkgs/development/python-modules/google-cloud-automl/default.nix
+++ b/pkgs/development/python-modules/google-cloud-automl/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-automl";
-  version = "2.7.1";
+  version = "2.7.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-NHjHzZm20jDdIg91Zr0ytM0V2sHAmZUF0hlD1C9DeSM=";
+    hash = "sha256-CUsLMX0zRONChgzejZnBztth5ORMZyb6rj6mok2pMMU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-bigquery-datatransfer/default.nix b/pkgs/development/python-modules/google-cloud-bigquery-datatransfer/default.nix
index 35c082e0563..2717af605ef 100644
--- a/pkgs/development/python-modules/google-cloud-bigquery-datatransfer/default.nix
+++ b/pkgs/development/python-modules/google-cloud-bigquery-datatransfer/default.nix
@@ -8,19 +8,33 @@
 , pytest-asyncio
 , pytz
 , mock
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-bigquery-datatransfer";
-  version = "3.6.0";
+  version = "3.6.1";
+  format = "setuptools";
 
+  disabled = pythonOlder "3.6";
+ 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-1syubhGCY8sYgV2mdneAV/8YOdplf5YZNEeZ0RAJC6E=";
+    hash = "sha256-hR5qHucBpq1LS9pIZeovcPMiVbw3dhSeeJxkYH8xuMk=";
   };
 
-  propagatedBuildInputs = [ google-api-core libcst proto-plus pytz ];
-  checkInputs = [ mock pytestCheckHook pytest-asyncio ];
+  propagatedBuildInputs = [
+    google-api-core
+    libcst
+    proto-plus
+    pytz
+  ];
+
+  checkInputs = [
+    mock
+    pytestCheckHook
+    pytest-asyncio
+  ];
 
   pythonImportsCheck = [
     "google.cloud.bigquery_datatransfer"
diff --git a/pkgs/development/python-modules/google-cloud-bigtable/default.nix b/pkgs/development/python-modules/google-cloud-bigtable/default.nix
index 779fbb4e6e5..9ffa885ab4a 100644
--- a/pkgs/development/python-modules/google-cloud-bigtable/default.nix
+++ b/pkgs/development/python-modules/google-cloud-bigtable/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-bigtable";
-  version = "2.6.0";
+  version = "2.7.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-z6qhLNPfZnFJE6CStAByqxHBv3Itfzn1FtxDE+JPci8=";
+    hash = "sha256-TUgC/6IZ9kNE5iDtbhKPHJqo3sv9W+nl7KcxuXfrbyM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-datacatalog/default.nix b/pkgs/development/python-modules/google-cloud-datacatalog/default.nix
index a095b9a04f1..c3e748810ee 100644
--- a/pkgs/development/python-modules/google-cloud-datacatalog/default.nix
+++ b/pkgs/development/python-modules/google-cloud-datacatalog/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-datacatalog";
-  version = "3.7.0";
+  version = "3.7.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-5ehghcpPZTlw8dOJ74pkB4k0g79wHLh+zj3fLCOR4Rc=";
+    hash = "sha256-99hJvY195iUjXOZEOwFQftDkfgtD5V8hSg5ZLWKyWZU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-datastore/default.nix b/pkgs/development/python-modules/google-cloud-datastore/default.nix
index 30cf1ae31a0..d2afea058d0 100644
--- a/pkgs/development/python-modules/google-cloud-datastore/default.nix
+++ b/pkgs/development/python-modules/google-cloud-datastore/default.nix
@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-datastore";
-  version = "2.5.0";
+  version = "2.5.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-4OwOEb+E+doiQ+gm3f4O+O88PXwFWINfTpRvOlzMuCA=";
+    sha256 = "sha256-1fpWovsg60uyAGps9QKXTdqV4WqZOOyeDFxX8YfgAMc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-dlp/default.nix b/pkgs/development/python-modules/google-cloud-dlp/default.nix
index 90e22985785..1961789e3b5 100644
--- a/pkgs/development/python-modules/google-cloud-dlp/default.nix
+++ b/pkgs/development/python-modules/google-cloud-dlp/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-dlp";
-  version = "3.6.1";
+  version = "3.6.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-zDGLdyBvm2haNaWRanHkRJZqHl+yvBuHRxCGqXYO7Ow=";
+    hash = "sha256-MMTeoyC30MW9NdrXLAqelIeeIdsdNi7u5zwVhLeeTyk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-iam-logging/default.nix b/pkgs/development/python-modules/google-cloud-iam-logging/default.nix
index 47ca59ab2a2..017634fd527 100644
--- a/pkgs/development/python-modules/google-cloud-iam-logging/default.nix
+++ b/pkgs/development/python-modules/google-cloud-iam-logging/default.nix
@@ -7,15 +7,19 @@
 , proto-plus
 , pytest-asyncio
 , pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-iam-logging";
-  version = "1.0.0";
+  version = "1.0.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "4ac688593279c48d7863f0a90457202ff9b235e3ee8862498e8a5b8f867cc137";
+    hash = "sha256-ZmoBaY0OM2pQcqasGCJQIeN6Rmbo4xlYK7LtH7SecgY=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-iam/default.nix b/pkgs/development/python-modules/google-cloud-iam/default.nix
index c0130e506a3..26c89af2add 100644
--- a/pkgs/development/python-modules/google-cloud-iam/default.nix
+++ b/pkgs/development/python-modules/google-cloud-iam/default.nix
@@ -12,12 +12,12 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-iam";
-  version = "2.6.0";
+  version = "2.6.1";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-iLfXzZ3LCNlkgsMilf8TW5ZXgdSBWRgJtuL8zIpUlns=";
+    sha256 = "sha256-c1XPE5PBDXRgpiKGBfAhHB6yTPyvby3aZ5nF40+qFiQ=";
   };
 
   propagatedBuildInputs = [ google-api-core libcst proto-plus ];
diff --git a/pkgs/development/python-modules/google-cloud-iot/default.nix b/pkgs/development/python-modules/google-cloud-iot/default.nix
index 063ba066602..24afcea7a73 100644
--- a/pkgs/development/python-modules/google-cloud-iot/default.nix
+++ b/pkgs/development/python-modules/google-cloud-iot/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-iot";
-  version = "2.4.0";
+  version = "2.4.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-5AOurJ/XIggFo3QZOQKiRNpbcHwdrIuMBbHeYDA001M=";
+    sha256 = "sha256-AjGoEAAI8aTACtcZp7zT5n9y6WCMc4GOfgUusUVXAVk=";
   };
 
   propagatedBuildInputs = [ grpc-google-iam-v1 google-api-core libcst proto-plus ];
diff --git a/pkgs/development/python-modules/google-cloud-monitoring/default.nix b/pkgs/development/python-modules/google-cloud-monitoring/default.nix
index 9a4a6a83d40..32572b0115e 100644
--- a/pkgs/development/python-modules/google-cloud-monitoring/default.nix
+++ b/pkgs/development/python-modules/google-cloud-monitoring/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-monitoring";
-  version = "2.9.0";
+  version = "2.9.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-6Xu07QBrVGQOwxi65KZaYFKF3DJ/1uc+zC+NUKqJeWM=";
+    hash = "sha256-FoB6SGDrVDHG60WeWmGwfVbSwt6xdq9da2QwSikpIlU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-redis/default.nix b/pkgs/development/python-modules/google-cloud-redis/default.nix
index ef76b378355..fc1ca312125 100644
--- a/pkgs/development/python-modules/google-cloud-redis/default.nix
+++ b/pkgs/development/python-modules/google-cloud-redis/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-redis";
-  version = "2.7.0";
+  version = "2.7.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-i3jgEaAJ0zEaJWtpzhOe23CtpUpt1ON4gXnVvSG8fTI=";
+    hash = "sha256-tz2upcRjgE6/4cB0riARwot3Vhw4QSKqqHTlJS3i7is=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-resource-manager/default.nix b/pkgs/development/python-modules/google-cloud-resource-manager/default.nix
index e35349d8e89..da5d110225e 100644
--- a/pkgs/development/python-modules/google-cloud-resource-manager/default.nix
+++ b/pkgs/development/python-modules/google-cloud-resource-manager/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-resource-manager";
-  version = "1.4.0";
+  version = "1.4.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-InkkAtqK5f1oqUK0Nsxc2PYt5JWBlB3ElGVNs5IJV/Q=";
+    hash = "sha256-NUqFkvIwfaqz3MZEUoLqO7hFCVwV5124+lA8LGzccl0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-secret-manager/default.nix b/pkgs/development/python-modules/google-cloud-secret-manager/default.nix
index 6782e30e784..e3c3e05ac18 100644
--- a/pkgs/development/python-modules/google-cloud-secret-manager/default.nix
+++ b/pkgs/development/python-modules/google-cloud-secret-manager/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-secret-manager";
-  version = "2.9.0";
+  version = "2.9.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-G2vyhj2pbNywGE2/QTyNviYQOcsAj4KR8vIcGhvM5e8=";
+    sha256 = "sha256-apn1ex/2VX18GHgN5+JYurzTKMqzPTNqTNOAI+DEBLw=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-securitycenter/default.nix b/pkgs/development/python-modules/google-cloud-securitycenter/default.nix
index d49eb3cf336..056c57ecd54 100644
--- a/pkgs/development/python-modules/google-cloud-securitycenter/default.nix
+++ b/pkgs/development/python-modules/google-cloud-securitycenter/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-securitycenter";
-  version = "1.9.0";
+  version = "1.10.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-qtaZs6mgcYeEEdf6KGQNx7c+RP8SqSNyTCZuhTVAq38=";
+    hash = "sha256-VaU6DRkq1pOESSOSynRRjaljp68C1X2H8anjHeHorbI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-speech/default.nix b/pkgs/development/python-modules/google-cloud-speech/default.nix
index 097da842100..e461b4cdcb5 100644
--- a/pkgs/development/python-modules/google-cloud-speech/default.nix
+++ b/pkgs/development/python-modules/google-cloud-speech/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-speech";
-  version = "2.13.0";
+  version = "2.13.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-NO2oxVszbm2KYiN2NCn3edIyBx+E++sttJTgZd/yXzQ=";
+    hash = "sha256-JxhIC4OMsXjdJYNDomEhmHPUCzveFS0oeDWsX/wd5zA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-videointelligence/default.nix b/pkgs/development/python-modules/google-cloud-videointelligence/default.nix
index 629220fe37a..58368693523 100644
--- a/pkgs/development/python-modules/google-cloud-videointelligence/default.nix
+++ b/pkgs/development/python-modules/google-cloud-videointelligence/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-videointelligence";
-  version = "2.6.0";
+  version = "2.6.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-blkNMdh9ehRM9sidgGajIkrHgrJCT96hzG3nVU0DBo4=";
+    sha256 = "sha256-p1HXFxURs0axONrqHahl/SPvWN2mhAhvJePFOwzRR4c=";
   };
 
   propagatedBuildInputs = [ google-api-core proto-plus ];
diff --git a/pkgs/development/python-modules/google-cloud-vision/default.nix b/pkgs/development/python-modules/google-cloud-vision/default.nix
index 312d8ec3b15..61c383dca6e 100644
--- a/pkgs/development/python-modules/google-cloud-vision/default.nix
+++ b/pkgs/development/python-modules/google-cloud-vision/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-vision";
-  version = "2.7.0";
+  version = "2.7.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-antpKF6egHtya4g9sKuQLQepz1QRLQ6LiCdpfYBsDh8=";
+    hash = "sha256-Ty80C73K3/TebsdSHinmp2y8TKgOftqT5PIDafq1GgM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-websecurityscanner/default.nix b/pkgs/development/python-modules/google-cloud-websecurityscanner/default.nix
index c7730e5138b..2ea8de6f139 100644
--- a/pkgs/development/python-modules/google-cloud-websecurityscanner/default.nix
+++ b/pkgs/development/python-modules/google-cloud-websecurityscanner/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-websecurityscanner";
-  version = "1.7.0";
+  version = "1.7.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-FBTJlr4mN5qW3BvA1l/glRaqdcJGFFjqPea3KQjwUqQ=";
+    sha256 = "sha256-yK4xEu9rfFkA6RDNDjul0V+Xjc8TehJ6f8lv1k2WULc=";
   };
 
   propagatedBuildInputs = [ google-api-core libcst proto-plus ];
diff --git a/pkgs/development/python-modules/losant-rest/default.nix b/pkgs/development/python-modules/losant-rest/default.nix
index 83ff792a62a..6dac34a9f7a 100644
--- a/pkgs/development/python-modules/losant-rest/default.nix
+++ b/pkgs/development/python-modules/losant-rest/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "losant-rest";
-  version = "1.15.2";
+  version = "1.16.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "Losant";
     repo = "losant-rest-python";
     rev = "v${version}";
-    sha256 = "sha256-JmLQ3Hj9WnL/XfMxDiVAizGFASWMwF36ohp8asErUMM=";
+    sha256 = "sha256-1beURMpQ2klwupcd4wJZud6MnAKzwXPvVlobk/eSvXo=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pycep-parser/default.nix b/pkgs/development/python-modules/pycep-parser/default.nix
new file mode 100644
index 00000000000..f286e6b45bd
--- /dev/null
+++ b/pkgs/development/python-modules/pycep-parser/default.nix
@@ -0,0 +1,58 @@
+{ lib
+, assertpy
+, buildPythonPackage
+, fetchFromGitHub
+, lark
+, poetry-core
+, pytestCheckHook
+, pythonOlder
+, regex
+, typing-extensions
+}:
+
+buildPythonPackage rec {
+  pname = "pycep-parser";
+  version = "0.3.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "gruebel";
+    repo = "pycep";
+    rev = version;
+    hash = "sha256-S4jBqMgyreWrEp1SuR8J5RVFc+i1O0xbfgux1UvFP5k=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    lark
+    regex
+    typing-extensions
+  ];
+
+  checkInputs = [
+    assertpy
+    pytestCheckHook
+  ];
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace 'version = "0.3.1-alpha.1"' 'version = "${version}"' \
+      --replace 'regex = "^2022.3.2"' 'regex = "*"'
+  '';
+
+  pythonImportsCheck = [
+    "pycep"
+  ];
+
+  meta = with lib; {
+    description = "Python based Bicep parser";
+    homepage = "https://github.com/gruebel/pycep";
+    license = with licenses; [ asl20 ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/pymc3/default.nix b/pkgs/development/python-modules/pymc3/default.nix
index 5cf2615ed03..7c1e46647e3 100644
--- a/pkgs/development/python-modules/pymc3/default.nix
+++ b/pkgs/development/python-modules/pymc3/default.nix
@@ -2,10 +2,11 @@
 , fetchPypi
 , buildPythonPackage
 , pythonOlder
-, Theano
+, theano-pymc
 , pandas
 , patsy
 , joblib
+, cachetools
 , tqdm
 , six
 , h5py
@@ -16,6 +17,8 @@
 , parameterized
 , fastprogress
 , typing-extensions
+, dill
+, semver
 }:
 
 buildPythonPackage rec {
@@ -34,7 +37,6 @@ buildPythonPackage rec {
   '';
 
   propagatedBuildInputs = [
-    Theano
     pandas
     patsy
     joblib
@@ -45,12 +47,10 @@ buildPythonPackage rec {
     packaging
     fastprogress
     typing-extensions
-  ];
-
-  checkInputs = [
-    pytest
-    nose
-    parameterized
+    dill
+    theano-pymc
+    cachetools
+    semver
   ];
 
   # The test suite is computationally intensive and test failures are not
@@ -67,9 +67,6 @@ buildPythonPackage rec {
     description = "Bayesian estimation, particularly using Markov chain Monte Carlo (MCMC)";
     homepage = "https://github.com/pymc-devs/pymc3";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ ilya-kolpakov ];
-    # several dependencies are not declared and in the end it requires theano-pymc3
-    # instead of Theano. The former is currently not packaged.
-    broken = true;
+    maintainers = with lib.maintainers; [ nidabdella ];
   };
 }
diff --git a/pkgs/development/python-modules/python-miio/default.nix b/pkgs/development/python-modules/python-miio/default.nix
index 4095ff9285c..c1391995dda 100644
--- a/pkgs/development/python-modules/python-miio/default.nix
+++ b/pkgs/development/python-modules/python-miio/default.nix
@@ -24,14 +24,14 @@
 
 buildPythonPackage rec {
   pname = "python-miio";
-  version = "0.5.10";
+  version = "0.5.11";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-6iV+uIdVi0Z3FeM9xnp1Ss3VzFVEOm7wykxjSTXUIGM=";
+    sha256 = "sha256-1hC7yE/hGLx9g3NXqU45yC/6dcW6/0oZwgYW5bj/37c=";
   };
 
   nativeBuildInputs = [
@@ -70,10 +70,6 @@ buildPythonPackage rec {
     "miio"
   ];
 
-  disabledTestPaths = [
-    "miio/tests/test_vacuums.py"
-  ];
-
   meta = with lib; {
     description = "Python library for interfacing with Xiaomi smart appliances";
     homepage = "https://github.com/rytilahti/python-miio";
diff --git a/pkgs/development/python-modules/theano-pymc/default.nix b/pkgs/development/python-modules/theano-pymc/default.nix
new file mode 100644
index 00000000000..ad0b93fe094
--- /dev/null
+++ b/pkgs/development/python-modules/theano-pymc/default.nix
@@ -0,0 +1,48 @@
+{ lib
+, fetchPypi
+, buildPythonPackage
+, pythonOlder
+, pandas
+, numpy
+, scipy
+, filelock
+, pytest
+, nose
+, parameterized
+}:
+
+buildPythonPackage rec {
+  pname = "theano-pymc";
+  version = "1.1.2";
+  disabled = pythonOlder "3.6";
+
+  src = fetchPypi {
+    pname = "Theano-PyMC";
+    inherit version;
+    sha256 = "5da6c2242ea72a991c8446d7fe7d35189ea346ef7d024c890397011114bf10fc";
+  };
+
+  # No need for coverage stats in Nix builds
+  postPatch = ''
+    substituteInPlace setup.py --replace ", 'pytest-cov'" ""
+  '';
+
+  propagatedBuildInputs = [
+    pandas
+    numpy
+    scipy
+    filelock
+  ];
+
+  # The test suite is computationally intensive and test failures are not
+  # indicative for package usability hence tests are disabled by default.
+  doCheck = false;
+  pythonImportsCheck = [ "theano" ];
+
+  meta = {
+    description = "PyMC theano fork";
+    homepage = "https://github.com/majidaldo/Theano-PyMC";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ nidabdella ];
+  };
+}
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index 8117b9ac049..2aa5e557b5c 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -32,13 +32,13 @@ with py.pkgs;
 
 buildPythonApplication rec {
   pname = "checkov";
-  version = "2.0.918";
+  version = "2.0.923";
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = pname;
     rev = version;
-    hash = "sha256-8nhz32ugnheBH1W3YKKmjRvjjx4WcpSyLwBS0STvsPM=";
+    hash = "sha256-EvT1nEE58gtlpRKEZkVaZ0mjABldmioW9u1foF8RCJI=";
   };
 
   nativeBuildInputs = with py.pkgs; [
@@ -71,6 +71,7 @@ buildPythonApplication rec {
     packaging
     policyuniverse
     prettytable
+    pycep-parser
     pyyaml
     semantic-version
     tabulate
diff --git a/pkgs/development/tools/database/sqlfluff/default.nix b/pkgs/development/tools/database/sqlfluff/default.nix
index 7c95565487d..82b7ea8ea95 100644
--- a/pkgs/development/tools/database/sqlfluff/default.nix
+++ b/pkgs/development/tools/database/sqlfluff/default.nix
@@ -5,13 +5,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "sqlfluff";
-  version = "0.10.1";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    hash = "sha256-ZgLg+pIdTBxMNXgFFL8jCbQa444pkgtnSx+QjMqQhag=";
+    hash = "sha256-Cem53w/pzSDTi9A9mh9VeLlRn1m6KhkxWaqJjEtfwUs=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/development/tools/rebazel/default.nix b/pkgs/development/tools/rebazel/default.nix
index 5dee0a1b9e8..c28701f96a2 100644
--- a/pkgs/development/tools/rebazel/default.nix
+++ b/pkgs/development/tools/rebazel/default.nix
@@ -1,4 +1,5 @@
-{ lib, rustPlatform, fetchFromGitHub }:
+{ lib, stdenv, rustPlatform, fetchFromGitHub, CoreServices }:
+
 rustPlatform.buildRustPackage rec {
   pname = "rebazel";
   version = "0.1.4";
@@ -12,6 +13,8 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "sha256-cBAm8LyNKEVJkhZJ+QZU5XtQutb1oNvad8xH70Bi2LM=";
 
+  buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];
+
   meta = with lib; {
     description = "tool for expediting bazel build workflows";
     homepage = "https://github.com/meetup/rebazel";
diff --git a/pkgs/misc/dxvk/darwin-dxvk-compat.patch b/pkgs/misc/dxvk/darwin-dxvk-compat.patch
new file mode 100644
index 00000000000..1c68659215f
--- /dev/null
+++ b/pkgs/misc/dxvk/darwin-dxvk-compat.patch
@@ -0,0 +1,35 @@
+Source: https://github.com/marzent/dxvk/commit/65247afe2de5dd6b555b8fdd46dddcdc6325e1d6
+---
+ src/d3d11/d3d11_device.cpp        |  12 +-
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/src/d3d11/d3d11_device.cpp b/src/d3d11/d3d11_device.cpp
+index 21f0d1b4a..5b1d05335 100644
+--- a/src/d3d11/d3d11_device.cpp
++++ b/src/d3d11/d3d11_device.cpp
+@@ -799,8 +799,12 @@ namespace dxvk {
+     InitReturnPtr(ppGeometryShader);
+     D3D11CommonShader module;
+ 
+-    if (!m_dxvkDevice->features().extTransformFeedback.transformFeedback)
+-      return DXGI_ERROR_INVALID_CALL;
++      if (!m_dxvkDevice->features().extTransformFeedback.transformFeedback) {
++          Logger::err(
++                   "D3D11: CreateGeometryShaderWithStreamOutput:"
++                   "\n  Transform feedback not supported by device");
++          return S_OK;
++      }
+ 
+     // Zero-init some counterss so that we can increment
+     // them while walking over the stream output entries
+@@ -1973,8 +1977,8 @@ namespace dxvk {
+       enabled.core.features.logicOp                               = supported.core.features.logicOp;
+       enabled.core.features.shaderImageGatherExtended             = VK_TRUE;
+       enabled.core.features.variableMultisampleRate               = supported.core.features.variableMultisampleRate;
+-      enabled.extTransformFeedback.transformFeedback              = VK_TRUE;
+-      enabled.extTransformFeedback.geometryStreams                = VK_TRUE;
++        enabled.extTransformFeedback.transformFeedback              = supported.extTransformFeedback.transformFeedback;
++        enabled.extTransformFeedback.geometryStreams                = supported.extTransformFeedback.geometryStreams;
+     }
+     
+     if (featureLevel >= D3D_FEATURE_LEVEL_10_1) {
diff --git a/pkgs/misc/dxvk/darwin-moltenvk-compat.patch b/pkgs/misc/dxvk/darwin-moltenvk-compat.patch
new file mode 100644
index 00000000000..7d16fdf7033
--- /dev/null
+++ b/pkgs/misc/dxvk/darwin-moltenvk-compat.patch
@@ -0,0 +1,59 @@
+Source: https://github.com/Gcenx/MoltenVK/commit/1f268bd45f6c928784d7cb90dedce382895f10ae
+
+Fake extensions for DXVK;
+- _features.geometryShader
+- _features.tessellationShader
+- _features.shaderCullDistance
+
+Enabled defaults;
+- MVK_ALLOW_METAL_FENCES=1
+- MVK_CONFIG_RESUME_LOST_DEVICE=1
+---
+ MoltenVK/MoltenVK/GPUObjects/MVKDevice.mm  | 3 +++
+ MoltenVK/MoltenVK/Utility/MVKEnvironment.h | 4 ++--
+ 2 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/MoltenVK/MoltenVK/GPUObjects/MVKDevice.mm b/MoltenVK/MoltenVK/GPUObjects/MVKDevice.mm
+index bc6d19df..e1959c6e 100644
+--- a/MoltenVK/MoltenVK/GPUObjects/MVKDevice.mm
++++ b/MoltenVK/MoltenVK/GPUObjects/MVKDevice.mm
+@@ -1656,6 +1656,8 @@
+     _features.robustBufferAccess = true;  // XXX Required by Vulkan spec
+     _features.fullDrawIndexUint32 = true;
+     _features.independentBlend = true;
++    _features.geometryShader = true;  // XXX Required by DXVK for D3D10
++    _features.tessellationShader = true;  // XXX Required by DXVK for D3D11
+     _features.sampleRateShading = true;
+     _features.depthBiasClamp = true;
+     _features.fillModeNonSolid = true;
+@@ -1669,6 +1671,7 @@
+     _features.shaderUniformBufferArrayDynamicIndexing = true;
+     _features.shaderStorageBufferArrayDynamicIndexing = true;
+     _features.shaderClipDistance = true;
++    _features.shaderCullDistance = true;  // XXX Required by DXVK for 10level9
+     _features.shaderInt16 = true;
+     _features.multiDrawIndirect = true;
+     _features.inheritedQueries = true;
+diff --git a/MoltenVK/MoltenVK/Utility/MVKEnvironment.h b/MoltenVK/MoltenVK/Utility/MVKEnvironment.h
+index 81d0defc..80c414d3 100644
+--- a/MoltenVK/MoltenVK/Utility/MVKEnvironment.h
++++ b/MoltenVK/MoltenVK/Utility/MVKEnvironment.h
+@@ -240,7 +240,7 @@ void mvkSetConfig(const MVKConfiguration& mvkConfig);
+ #   define MVK_ALLOW_METAL_EVENTS    1
+ #endif
+ #ifndef MVK_ALLOW_METAL_FENCES
+-#   define MVK_ALLOW_METAL_FENCES    0
++#   define MVK_ALLOW_METAL_FENCES    1 // XXX Required by DXVK for Apple/NVidia GPUs (better FPS than CPU Emulation)
+ #endif
+ 
+ /** Substitute Metal 2D textures for Vulkan 1D images. Enabled by default. */
+@@ -275,7 +275,7 @@ void mvkSetConfig(const MVKConfiguration& mvkConfig);
+ 
+ /** Resume MVKDevice VK_ERROR_DEVICE_LOST errors that do not cause MVKPhysicalDevice errors. Disabled by default. */
+ #ifndef MVK_CONFIG_RESUME_LOST_DEVICE
+-#   define MVK_CONFIG_RESUME_LOST_DEVICE    0
++#   define MVK_CONFIG_RESUME_LOST_DEVICE    1
+ #endif
+ 
+ /** Support Metal argument buffers. Disabled by default. */
+ 
\ No newline at end of file
diff --git a/pkgs/misc/dxvk/default.nix b/pkgs/misc/dxvk/default.nix
new file mode 100644
index 00000000000..61e2d78b45c
--- /dev/null
+++ b/pkgs/misc/dxvk/default.nix
@@ -0,0 +1,80 @@
+{ lib
+, pkgs
+, stdenv
+, fetchFromGitHub
+, pkgsCross
+}:
+
+let
+  # DXVK needs to be a separate derivation because it’s actually a set of DLLs for Windows that
+  # needs to be built with a cross-compiler.
+  dxvk32 = pkgsCross.mingw32.callPackage ./dxvk.nix { inherit (self) src version dxvkPatches; };
+  dxvk64 = pkgsCross.mingwW64.callPackage ./dxvk.nix { inherit (self) src version dxvkPatches; };
+
+  # Use the self pattern to support overriding `src` and `version` via `overrideAttrs`. A recursive
+  # attrset wouldn’t work.
+  self = stdenv.mkDerivation {
+    name = "dxvk";
+    version = "1.10";
+
+    src = fetchFromGitHub {
+      owner = "doitsujin";
+      repo = "dxvk";
+      rev = "v${self.version}";
+      hash = "sha256-/zH6vER/6s/d+Tt181UJOa97sqdkJyKGw6E36+1owzQ=";
+    };
+
+    # Patch DXVK to work with MoltenVK even though it doesn’t support some required features.
+    # Some games will work poorly (particularly Unreal Engine 4 games), but others work pretty well.
+    # Override this to patch DXVK itself (rather than the setup script).
+    dxvkPatches = lib.optional stdenv.isDarwin ./darwin-dxvk-compat.patch;
+
+    outputs = [ "out" "bin" "lib" ];
+
+    # Also copy `mcfgthread-12.dll` due to DXVK’s being built in a MinGW cross environment.
+    patches = [ ./mcfgthread.patch ];
+
+    dontConfigure = true;
+    dontBuild = true;
+
+    installPhase = ''
+      mkdir -p $out/bin $bin $lib
+      substitute setup_dxvk.sh $out/bin/setup_dxvk.sh \
+        --subst-var-by mcfgthreads32 "${pkgsCross.mingw32.windows.mcfgthreads}" \
+        --subst-var-by mcfgthreads64 "${pkgsCross.mingwW64.windows.mcfgthreads}" \
+        --replace 'basedir=$(dirname "$(readlink -f $0)")' "basedir=$bin"
+      chmod a+x $out/bin/setup_dxvk.sh
+      declare -A dxvks=( [x32]=${dxvk32} [x64]=${dxvk64} )
+      for arch in "''${!dxvks[@]}"; do
+        ln -s "''${dxvks[$arch]}/bin" $bin/$arch
+        ln -s "''${dxvks[$arch]}/lib" $lib/$arch
+      done
+    '';
+
+    # DXVK with MoltenVK requires a patched MoltenVK in addition to its own patches. Provide a
+    # convenience function to handle the necessary patching.
+    # Usage:
+    # let
+    #   patchedMoltenVK = dxvk.patchMoltenVK darwin.moltenvk;
+    # in
+    # wine64Packages.full.override { moltenvk = patchedMoltenVK; vkd3dSupport = false; }
+    passthru.patchMoltenVK = moltenvk:
+      moltenvk.overrideAttrs (old: {
+        patches = old.patches or [ ] ++ [
+          # Lie to DXVK about certain features that DXVK expects to be available and set defaults
+          # for better performance/compatability on certain hardware.
+          ./darwin-moltenvk-compat.patch
+        ];
+      });
+
+    meta = {
+      description = "A Vulkan-based translation layer for Direct3D 9/10/11";
+      homepage = "https://github.com/doitsujin/dxvk";
+      changelog = "https://github.com/doitsujin/dxvk/releases";
+      maintainers = [ lib.maintainers.reckenrode ];
+      license = lib.licenses.zlib;
+      platforms = lib.platforms.unix;
+    };
+  };
+in
+self
diff --git a/pkgs/misc/dxvk/dxvk.nix b/pkgs/misc/dxvk/dxvk.nix
new file mode 100644
index 00000000000..40b674df922
--- /dev/null
+++ b/pkgs/misc/dxvk/dxvk.nix
@@ -0,0 +1,52 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, glslang
+, meson
+, ninja
+, windows
+, src
+, version
+, dxvkPatches
+}:
+
+stdenv.mkDerivation {
+  pname = "dxvk";
+  inherit src version;
+
+  nativeBuildInputs = [ glslang meson ninja ];
+  buildInputs = [ windows.pthreads ];
+
+  patches = dxvkPatches;
+
+  # Replace use of DXVK’s threading classes with the ones from the C++ standard library, which uses
+  # mcfgthreads in nixpkgs.
+  postPatch = ''
+    for class in mutex recursive_mutex condition_variable; do
+      for file in $(grep -rl dxvk::$class *); do
+        if [ "$(basename "$file")" != "thread.h" ]; then
+          substituteInPlace "$file" --replace dxvk::$class std::$class
+        fi
+      done
+    done
+  '';
+
+  mesonFlags =
+    let
+      arch = if stdenv.is32bit then "32" else "64";
+    in
+    [
+      "--buildtype" "release"
+      "--cross-file" "build-win${arch}.txt"
+      "--prefix" "${placeholder "out"}"
+    ];
+
+  meta = {
+    description = "A Vulkan-based translation layer for Direct3D 9/10/11";
+    homepage = "https://github.com/doitsujin/dxvk";
+    changelog = "https://github.com/doitsujin/dxvk/releases";
+    maintainers = [ lib.maintainers.reckenrode ];
+    license = lib.licenses.zlib;
+    platforms = lib.platforms.windows;
+  };
+}
diff --git a/pkgs/misc/dxvk/mcfgthread.patch b/pkgs/misc/dxvk/mcfgthread.patch
new file mode 100644
index 00000000000..03707163017
--- /dev/null
+++ b/pkgs/misc/dxvk/mcfgthread.patch
@@ -0,0 +1,34 @@
+diff --git a/setup_dxvk.sh b/setup_dxvk.sh
+index 3e63ecf0..87c04f23 100755
+--- a/setup_dxvk.sh
++++ b/setup_dxvk.sh
+@@ -133,6 +133,8 @@
+         rm -v "${dstfile}"
+       fi
+       $file_cmd "${srcfile}" "${dstfile}"
++    elif [ "${4}" = "--force" ]; then
++      $file_cmd "${srcfile}" "${dstfile}"
+     else
+       echo "${dstfile}: File not found in wine prefix" >&2
+       return 1
+@@ -170,12 +172,12 @@
+ }
+ 
+ install() {
+-  installFile "$win64_sys_path" "$dxvk_lib64" "$1"
++  installFile "$win64_sys_path" "$dxvk_lib64" "$1" "${2-}"
+   inst64_ret="$?"
+ 
+   inst32_ret=-1
+   if $wow64; then
+-    installFile "$win32_sys_path" "$dxvk_lib32" "$1"
++    installFile "$win32_sys_path" "$dxvk_lib32" "$1" "${2-}"
+     inst32_ret="$?"
+   fi
+ 
+@@ -214,3 +216,5 @@
+ 
+ $action d3d10core
+ $action d3d11
++
++basedir="" dxvk_lib32=@mcfgthreads32@/bin dxvk_lib64=@mcfgthreads64@/bin $action mcfgthread-12 --force
diff --git a/pkgs/servers/dendrite/default.nix b/pkgs/servers/dendrite/default.nix
index 3d92b2cd4ba..b1c0f1424d9 100644
--- a/pkgs/servers/dendrite/default.nix
+++ b/pkgs/servers/dendrite/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "matrix-dendrite";
-  version = "0.5.1";
+  version = "0.6.5";
 
   src = fetchFromGitHub {
     owner = "matrix-org";
     repo = "dendrite";
     rev = "v${version}";
-    sha256 = "1HCVWSxXOR2syN+dLDSvrNzYHTj/vXZRHkXhU0f3m1k=";
+    sha256 = "jSn2awZsfsniSOTNkaEdQw/sZm7nUfiMntsxigy/51Y=";
   };
 
-  vendorSha256 = "sha256-RqEt0RAsKWKy6NvMzulqY56nZ7fIxgJkgN/WpEZ3F2I=";
+  vendorSha256 = "sha256-B4d3FGXy8TrED3oikTjETQso/AtEfIWWcdY6FykD/8A=";
 
   passthru.tests = {
     inherit (nixosTests) dendrite;
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 722ca4f6cad..f12dcb87fb2 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2022.3.2";
+  version = "2022.3.3";
   components = {
     "abode" = ps: with ps; [ abodepy ];
     "accuweather" = ps: with ps; [ accuweather ];
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 0f53e9722a9..2bb62161547 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -158,7 +158,7 @@ let
   extraPackagesFile = writeText "home-assistant-packages" (lib.concatMapStringsSep "\n" (pkg: pkg.pname) extraBuildInputs);
 
   # Don't forget to run parse-requirements.py after updating
-  hassVersion = "2022.3.2";
+  hassVersion = "2022.3.3";
 
 in python.pkgs.buildPythonApplication rec {
   pname = "homeassistant";
@@ -176,7 +176,7 @@ in python.pkgs.buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     rev = version;
-    hash = "sha256-oFFRqacLAAhiH+3HF/oZlkEJQ+pf7bZ0gOFyB92t9U4=";
+    hash = "sha256-qe9/VFcEBDfSa7AYrkmj1b6UGLHcm7CtLHiPwzZz8jg=";
   };
 
   # leave this in, so users don't have to constantly update their downstream patch handling
diff --git a/pkgs/servers/home-assistant/frontend.nix b/pkgs/servers/home-assistant/frontend.nix
index d65ee309d24..9bfa5cf2f37 100644
--- a/pkgs/servers/home-assistant/frontend.nix
+++ b/pkgs/servers/home-assistant/frontend.nix
@@ -4,7 +4,7 @@ buildPythonPackage rec {
   # the frontend version corresponding to a specific home-assistant version can be found here
   # https://github.com/home-assistant/home-assistant/blob/master/homeassistant/components/frontend/manifest.json
   pname = "home-assistant-frontend";
-  version = "20220301.0";
+  version = "20220301.1";
   format = "wheel";
 
   src = fetchPypi {
@@ -12,7 +12,7 @@ buildPythonPackage rec {
     pname = "home_assistant_frontend";
     dist = "py3";
     python = "py3";
-    sha256 = "sha256-Gshw8GIiZfFHmldvxBhUKZ5NFWuBIA6ug7m7eEfQ+ao=";
+    sha256 = "sha256-+S888lUHbWqEJQm5HvZqimTfqoDEHYRVAoGQ5UvU4u4=";
   };
 
   # there is nothing to strip in this package
diff --git a/pkgs/servers/http/nginx/modules.nix b/pkgs/servers/http/nginx/modules.nix
index b159cc00aaa..2b8e2ac7f79 100644
--- a/pkgs/servers/http/nginx/modules.nix
+++ b/pkgs/servers/http/nginx/modules.nix
@@ -256,6 +256,7 @@ in
       sha256 = "sha256-UXiitc3jZlgXlCsDPS+xEFLNRVgRbn8BCCXUEqAWlII=";
     };
     inputs = [ pkgs.curl pkgs.geoip pkgs.libmodsecurity pkgs.libxml2 pkgs.lmdb pkgs.yajl ];
+    disableIPC = true;
   };
 
   moreheaders = {
diff --git a/pkgs/servers/maddy/default.nix b/pkgs/servers/maddy/default.nix
index 598946037db..11da56c6eb9 100644
--- a/pkgs/servers/maddy/default.nix
+++ b/pkgs/servers/maddy/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "maddy";
-  version = "0.5.3";
+  version = "0.5.4";
 
   src = fetchFromGitHub {
     owner = "foxcpp";
     repo = "maddy";
     rev = "v${version}";
-    sha256 = "sha256-UB9Y2nNkiN0L3NIfUqnpaJJqNuAnCYIeEyS60TnnIRs=";
+    sha256 = "sha256-FWoPAb/aHaQLxT+UUUoViCmLvauVuAzUyOmRNB8F72U=";
   };
 
-  vendorSha256 = "sha256-lL9hlICc9t/2v6eawG8LU6hpAKpY7raTg5l1RagewPs=";
+  vendorSha256 = "sha256-rcHboPfs2mWg3sgsLmN1IPoppmuDcsx0bQICp6EzYsQ=";
 
   ldflags = [ "-s" "-w" "-X github.com/foxcpp/maddy.Version=${version}" ];
 
diff --git a/pkgs/servers/monitoring/prometheus/gitlab-ci-pipelines-exporter.nix b/pkgs/servers/monitoring/prometheus/gitlab-ci-pipelines-exporter.nix
index 840234a0307..1c24c065ed7 100644
--- a/pkgs/servers/monitoring/prometheus/gitlab-ci-pipelines-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/gitlab-ci-pipelines-exporter.nix
@@ -2,17 +2,22 @@
 
 buildGoModule rec {
   pname = "gitlab-ci-pipelines-exporter";
-  version = "0.4.9";
+  version = "0.5.3";
 
   src = fetchFromGitHub {
     owner = "mvisonneau";
     repo = pname;
     rev = "v${version}";
-    sha256 = "13zs8140n4z56i0xkl6jvvmwy80l07dxyb23wxzd5avbdm8knypz";
+    sha256 = "1i0ry93w2pk8m7i4fbdn1xvsmvjn83d6lr6l7yywid9d0kmkjz13";
   };
 
-  vendorSha256 = "1k620r3d1swhj7cfmqjh5n08da2a6w87fwrsajl0y324iyw2chsa";
+  subPackages = [ "cmd/${pname}" ];
 
+  ldflags = [
+    "-X main.version=v${version}"
+  ];
+
+  vendorSha256 = "UszZaxql5sO4DSDVD/UIjeeDojCQEPF+ATL7O9MaTG8=";
   doCheck = true;
 
   meta = with lib; {
diff --git a/pkgs/tools/admin/exoscale-cli/default.nix b/pkgs/tools/admin/exoscale-cli/default.nix
index ecab060ee97..529871683f6 100644
--- a/pkgs/tools/admin/exoscale-cli/default.nix
+++ b/pkgs/tools/admin/exoscale-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoPackage rec {
   pname = "exoscale-cli";
-  version = "1.50.0";
+  version = "1.51.1";
 
   src = fetchFromGitHub {
     owner  = "exoscale";
     repo   = "cli";
     rev    = "v${version}";
-    sha256 = "sha256-RpUnJzMnYIvPpJd6+IVpDxCS/FGM+PHXvbQPJQEoS8Y=";
+    sha256 = "sha256-NU4xJTW0KCi8PZAY4cRJijGHCZEn5Z41xNF7+iH01oo=";
   };
 
   goPackagePath = "github.com/exoscale/cli";
diff --git a/pkgs/tools/backup/kopia/default.nix b/pkgs/tools/backup/kopia/default.nix
index 1eac3f04325..09f17b9a2be 100644
--- a/pkgs/tools/backup/kopia/default.nix
+++ b/pkgs/tools/backup/kopia/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kopia";
-  version = "0.10.5";
+  version = "0.10.6";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-9H57NlvyEEOX2F3ooWWqDAo7MnS9J+XrYv/cIyNo6+Y=";
+    sha256 = "sha256-lyCTKjimVZkpXKVeDNn0e9E6FkDp7fUl3cYnn5W5A7o=";
   };
 
-  vendorSha256 = "sha256-c8WohMyaOicPq2q+DkgNBBulMEJCZFNFe+xECUEpelI=";
+  vendorSha256 = "sha256-p+hK662WoO98J/uE3B9X1GvpnyMGu21sAg8GcyTlWZM=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/misc/birdfont/default.nix b/pkgs/tools/misc/birdfont/default.nix
index a6c2ca77c5a..3ee53c0f592 100644
--- a/pkgs/tools/misc/birdfont/default.nix
+++ b/pkgs/tools/misc/birdfont/default.nix
@@ -4,11 +4,11 @@ gobject-introspection, gsettings-desktop-schemas, wrapGAppsHook }:
 
 stdenv.mkDerivation rec {
   pname = "birdfont";
-  version = "2.29.6";
+  version = "2.30.0";
 
   src = fetchurl {
     url = "https://birdfont.org/releases/${pname}-${version}.tar.xz";
-    sha256 = "sha256-INHLH3wv1Rr3RLECAN2CQvctIjWdksxdfVfBkWnx+Is=";
+    sha256 = "sha256-aIhJXmzLY2Sw9mFe2AmLkXb+YRnFu1pMnFeDF+zfHRE=";
   };
 
   nativeBuildInputs = [ python3 pkg-config vala gobject-introspection wrapGAppsHook ];
diff --git a/pkgs/tools/misc/goreleaser/default.nix b/pkgs/tools/misc/goreleaser/default.nix
index 6ba61207043..ec3f480ebf1 100644
--- a/pkgs/tools/misc/goreleaser/default.nix
+++ b/pkgs/tools/misc/goreleaser/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "goreleaser";
-  version = "1.5.0";
+  version = "1.6.1";
 
   src = fetchFromGitHub {
     owner = "goreleaser";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-H7LgADzES5Zi5+lcooix+WCjDxqkThIIGvwa8IiHDHo=";
+    sha256 = "sha256-MnsIm8E6CR5tEB6Oq35fJKQiPJfqP86/hp0t6lqJ0JE=";
   };
 
-  vendorSha256 = "sha256-4Hb+SmmPk4+c4QoOJADinKGD1xd0RYzn2wniuBxatAw=";
+  vendorSha256 = "sha256-Kwa2hzsuw3BNLubcqd7Vmpg49P78Yjt3LboLotoGWYM=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/misc/nautilus-open-any-terminal/default.nix b/pkgs/tools/misc/nautilus-open-any-terminal/default.nix
index 321b139ca15..c62bcbe0bc7 100644
--- a/pkgs/tools/misc/nautilus-open-any-terminal/default.nix
+++ b/pkgs/tools/misc/nautilus-open-any-terminal/default.nix
@@ -15,13 +15,13 @@
 
 python3.pkgs.buildPythonPackage rec {
   pname = "nautilus-open-any-terminal";
-  version = "0.2.15";
+  version = "0.2.16";
 
   src = fetchFromGitHub {
     owner = "Stunkymonkey";
     repo = pname;
     rev = version;
-    sha256 = "sha256-cc6Lh5XeAuU5Os4eJ0QcL6XJYB6DqxeUGaOf6m1OnpY=";
+    sha256 = "sha256-g5B+tp131vmjShBCGrKR5ZQCjtJY823/kPacZ0S9E80=";
   };
 
   patches = [ ./hardcode-gsettings.patch ];
diff --git a/pkgs/tools/misc/opentelemetry-collector/contrib.nix b/pkgs/tools/misc/opentelemetry-collector/contrib.nix
index 4bfc390335d..57a21a2822d 100644
--- a/pkgs/tools/misc/opentelemetry-collector/contrib.nix
+++ b/pkgs/tools/misc/opentelemetry-collector/contrib.nix
@@ -6,17 +6,17 @@
 
 buildGoModule rec {
   pname = "opentelemetry-collector-contrib";
-  version = "0.45.1";
+  version = "0.46.0";
 
   src = fetchFromGitHub {
     owner = "open-telemetry";
     repo = "opentelemetry-collector-contrib";
     rev = "v${version}";
-    sha256 = "sha256-HoDQK/WyvDQgYBr6WPJ+bZE3GTx74SGgSj1P6i8AfL0=";
+    sha256 = "sha256-VD/gN9lUwzhRTfr8rAQld+4sN+deYhUlNvCphtZncDU=";
   };
   # proxy vendor to avoid hash missmatches between linux and macOS
   proxyVendor = true;
-  vendorSha256 = "sha256-e33EV1DGpR3XL70sjfCSMeuOSyh334+AkHnE+vqHrh0=";
+  vendorSha256 = "sha256-ojNDDPCo6TGp8BYio/pYykXSLjC5Qplw0WFD9UIiYM4=";
 
   subPackages = [ "cmd/otelcontribcol" ];
 
diff --git a/pkgs/tools/misc/opentelemetry-collector/default.nix b/pkgs/tools/misc/opentelemetry-collector/default.nix
index 72aea5c44d9..851d4f2dc18 100644
--- a/pkgs/tools/misc/opentelemetry-collector/default.nix
+++ b/pkgs/tools/misc/opentelemetry-collector/default.nix
@@ -12,17 +12,17 @@ let
 in
 buildGoModule rec {
   pname = "opentelemetry-collector";
-  version = "0.45.0";
+  version = "0.46.0";
 
   src = fetchFromGitHub {
     owner = "open-telemetry";
     repo = "opentelemetry-collector";
     rev = "v${version}";
-    sha256 = "sha256-uwQR38L81galqrOEF2qWxKi1UelaUmpkeg0WbkcbYfs=";
+    sha256 = "sha256-ibaA9oCSsId9A4ul5sfM+L8ExBl+Wv7rhGnb6TZ4WJw=";
   };
   # there is a nested go.mod
   sourceRoot = "source/cmd/otelcorecol";
-  vendorSha256 = "sha256-wzGv46wcPjpxiQsiNZQGC4DMHcMrWOEmacC5E0F2YCs=";
+  vendorSha256 = "sha256-Okmsd/skfBmkyLv9oPFH0QvewFZFPpUH2ahWxHt7cy8=";
 
   preBuild = ''
     # set the build version, can't be done via ldflags
diff --git a/pkgs/tools/networking/arping/default.nix b/pkgs/tools/networking/arping/default.nix
index 54ea08ceaef..10765befd4d 100644
--- a/pkgs/tools/networking/arping/default.nix
+++ b/pkgs/tools/networking/arping/default.nix
@@ -1,25 +1,36 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, libnet, libpcap }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, autoreconfHook
+, libnet
+, libpcap
+}:
 
 stdenv.mkDerivation rec {
-  version = "2.22";
   pname = "arping";
-
-  buildInputs = [ libnet libpcap ];
+  version = "2.23";
 
   src = fetchFromGitHub {
     owner = "ThomasHabets";
     repo = pname;
     rev = "${pname}-${version}";
-    sha256 = "sha256-yFSLhhyz6i7xyJR8Ax8FnHFGNe/HE40YirkkeefBqC4=";
+    hash = "sha256-Yn0EFb23VJvcVluQhwGHg9cdnZ8LKlBEds7cq8Irftc=";
   };
 
-  nativeBuildInputs = [ autoreconfHook ];
+  nativeBuildInputs = [
+    autoreconfHook
+  ];
+
+  buildInputs = [
+    libnet
+    libpcap
+  ];
 
   meta = with lib; {
     description = "Broadcasts a who-has ARP packet on the network and prints answers";
     homepage = "https://github.com/ThomasHabets/arping";
-    license = with licenses; [ gpl2 ];
-    maintainers = [ maintainers.michalrus ];
+    license = with licenses; [ gpl2Plus ];
+    maintainers = with maintainers; [ michalrus ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/tools/networking/subfinder/default.nix b/pkgs/tools/networking/subfinder/default.nix
index d38200a53da..9f0dfe7c388 100644
--- a/pkgs/tools/networking/subfinder/default.nix
+++ b/pkgs/tools/networking/subfinder/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "subfinder";
-  version = "2.4.9";
+  version = "2.5.0";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-BtyPy6ow3flHl4jM9cfF+y3JCtLYx2c+a8f7ol3nQj4=";
+    sha256 = "sha256-RzZlr0mscJgOGWOn4RU9SOr/WkKOrY39cIUKFKxis6Y=";
   };
 
-  vendorSha256 = "sha256-lgbTfIsfYFSToCaDppMGaxfE1Bmk52eShQ+40g2VNw0=";
+  vendorSha256 = "sha256-P98giu0a5FLBsE87XVTurYNGnNk8JUfz1awY49OBj9M=";
 
   modRoot = "./v2";
 
diff --git a/pkgs/tools/security/authz0/default.nix b/pkgs/tools/security/authz0/default.nix
new file mode 100644
index 00000000000..850e6321300
--- /dev/null
+++ b/pkgs/tools/security/authz0/default.nix
@@ -0,0 +1,25 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "authz0";
+  version = "1.1.1";
+
+  src = fetchFromGitHub {
+    owner = "hahwul";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-8WtvUeHP7fJ1/G+UB1QLCSSNx7XA+vREcwJxoMeQsgM=";
+  };
+
+  vendorSha256 = "sha256-EQhvHu/LXZtVQ+MzjB96K0MUM4THiRDe1FkAATfGhdw=";
+
+  meta = with lib; {
+    description = "Automated authorization test tool";
+    homepage = "https://github.com/hahwul/authz0";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/tools/security/cfripper/default.nix b/pkgs/tools/security/cfripper/default.nix
index 28c692b5c17..39b0187c4a6 100644
--- a/pkgs/tools/security/cfripper/default.nix
+++ b/pkgs/tools/security/cfripper/default.nix
@@ -5,13 +5,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "cfripper";
-  version = "1.5.0";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "Skyscanner";
     repo = pname;
     rev = version;
-    hash = "sha256-nomNjt/BV/Tu/9w4IEu3tXWQw4/wLTc64khdnQeliH0=";
+    hash = "sha256-/qcpLCk1ZZMKxhqK6q6sSbRDjiF5GQmDJzvCaV2kAqQ=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/security/sequoia/default.nix b/pkgs/tools/security/sequoia/default.nix
index 18db48dfb24..324af6aa4c9 100644
--- a/pkgs/tools/security/sequoia/default.nix
+++ b/pkgs/tools/security/sequoia/default.nix
@@ -25,16 +25,16 @@ rustPlatform.buildRustPackage rec {
   pname = "sequoia";
   # Upstream has separate version numbering for the library and the CLI frontend.
   # This derivation provides the CLI frontend, and thus uses its version number.
-  version = "0.25.0";
+  version = "0.26.0";
 
   src = fetchFromGitLab {
     owner = "sequoia-pgp";
     repo = "sequoia";
     rev = "sq/v${version}";
-    sha256 = "13f582g10vba0cpbdmqkkfzgd5jgagb640jaz1w425wf5nbh6q50";
+    sha256 = "1rcbv1s7wpxhrzw082q6vfrq1ja2ssfxn53c90h8fh5wrj7ns751";
   };
 
-  cargoSha256 = "sha256-qIGP48uj2iQ6MVgy5anKI9QrX9vnuKh46Fmmcczda4w=";
+  cargoSha256 = "0f3b8rh4pl03n8j9ihazaak214sv1rsksbgrb1nfcy8sq2yqfj4g";
 
   nativeBuildInputs = [
     pkg-config
@@ -77,15 +77,6 @@ rustPlatform.buildRustPackage rec {
   # Sometimes, tests fail on CI (ofborg) & hydra without this
   CARGO_TEST_ARGS = "--workspace --exclude sequoia-store";
 
-  # Without this, the examples won't build
-  postPatch = ''
-    substituteInPlace openpgp-ffi/examples/Makefile \
-      --replace '-O0 -g -Wall -Werror' '-g'
-    substituteInPlace ffi/examples/Makefile \
-      --replace '-O0 -g -Wall -Werror' '-g'
-  '';
-
-
   preInstall = lib.optionalString pythonSupport ''
     export installFlags="PYTHONPATH=$PYTHONPATH:$out/${pythonPackages.python.sitePackages}"
   '' + lib.optionalString (!pythonSupport) ''
diff --git a/pkgs/tools/security/sudo/default.nix b/pkgs/tools/security/sudo/default.nix
index 7baf1cf6b81..5385a9aba35 100644
--- a/pkgs/tools/security/sudo/default.nix
+++ b/pkgs/tools/security/sudo/default.nix
@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation rec {
   pname = "sudo";
-  version = "1.9.9";
+  version = "1.9.10";
 
   src = fetchurl {
     url = "https://www.sudo.ws/dist/${pname}-${version}.tar.gz";
-    sha256 = "sha256-bW7oY6O8Jsh2YQk6dOxj4Q/QMc66cUZC0hY23+JePgA=";
+    sha256 = "sha256-RKFGEJjnx7jmrFl0mcJPsuQ3SMDBOai0lE5X0TSaZPQ=";
   };
 
   prePatch = ''
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index f48203741d5..57793651b10 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -208,8 +208,11 @@ with pkgs;
 
   appthreat-depscan = callPackage ../development/tools/appthreat-depscan { };
 
+
   authy = callPackage ../applications/misc/authy { };
 
+  authz0 = callPackage ../tools/security/authz0 { };
+
   avro-tools = callPackage ../development/tools/avro-tools { };
 
   bacnet-stack = callPackage ../tools/networking/bacnet-stack {};
@@ -1051,7 +1054,9 @@ with pkgs;
 
   weidu = callPackage ../tools/games/weidu { };
 
-  weylus = callPackage ../applications/graphics/weylus { };
+  weylus = callPackage ../applications/graphics/weylus  {
+    inherit (darwin.apple_sdk.frameworks) ApplicationServices Carbon Cocoa VideoToolbox;
+  };
 
   gfshare = callPackage ../tools/security/gfshare { };
 
@@ -14460,7 +14465,9 @@ with pkgs;
 
   bazelisk = callPackage ../development/tools/bazelisk { };
 
-  rebazel = callPackage ../development/tools/rebazel { };
+  rebazel = callPackage ../development/tools/rebazel {
+    inherit (darwin.apple_sdk.frameworks) CoreServices;
+  };
 
   buildBazelPackage = callPackage ../build-support/build-bazel-package { };
 
@@ -33099,6 +33106,8 @@ with pkgs;
 
   dump = callPackage ../tools/backup/dump { };
 
+  dxvk = callPackage ../misc/dxvk { };
+
   ecdsatool = callPackage ../tools/security/ecdsatool { };
 
   emulationstation = callPackage ../applications/emulators/emulationstation { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index fbdd25360e6..1802cbb5691 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6719,6 +6719,8 @@ in {
 
   pycec = callPackage ../development/python-modules/pycec { };
 
+  pycep-parser = callPackage ../development/python-modules/pycep-parser { };
+
   pycfdns = callPackage ../development/python-modules/pycfdns { };
 
   pycflow2dot = callPackage ../development/python-modules/pycflow2dot {
@@ -9902,6 +9904,8 @@ in {
 
   tgcrypto = callPackage ../development/python-modules/tgcrypto { };
 
+  theano-pymc = callPackage ../development/python-modules/theano-pymc { };
+
   Theano = callPackage ../development/python-modules/Theano rec {
     cudaSupport = pkgs.config.cudaSupport or false;
     cudnnSupport = cudaSupport;