summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--maintainers/maintainer-list.nix7
-rw-r--r--nixos/doc/manual/from_md/release-notes/rl-2211.section.xml14
-rw-r--r--nixos/doc/manual/release-notes/rl-2211.section.md4
-rw-r--r--nixos/modules/module-list.nix1
-rw-r--r--nixos/modules/services/misc/nix-daemon.nix12
-rw-r--r--nixos/modules/services/web-apps/alps.nix96
-rw-r--r--nixos/modules/services/web-apps/wiki-js.nix2
-rw-r--r--pkgs/applications/audio/ncspot/default.nix6
-rw-r--r--pkgs/applications/audio/ymuse/default.nix9
-rw-r--r--pkgs/applications/blockchains/go-ethereum/default.nix6
-rw-r--r--pkgs/applications/blockchains/solana-validator/default.nix3
-rw-r--r--pkgs/applications/editors/emacs/elisp-packages/update-melpa.el4
-rw-r--r--pkgs/applications/editors/vscode/vscode.nix12
-rw-r--r--pkgs/applications/graphics/krita/default.nix4
-rw-r--r--pkgs/applications/misc/1password/default.nix10
-rw-r--r--pkgs/applications/misc/elfx86exts/default.nix6
-rw-r--r--pkgs/applications/misc/genact/default.nix23
-rw-r--r--pkgs/applications/misc/hugo/default.nix6
-rw-r--r--pkgs/applications/misc/latte-dock/default.nix2
-rw-r--r--pkgs/applications/misc/rofimoji/default.nix4
-rw-r--r--pkgs/applications/misc/slides/default.nix6
-rw-r--r--pkgs/applications/misc/solaar/default.nix6
-rw-r--r--pkgs/applications/misc/variety/default.nix5
-rw-r--r--pkgs/applications/networking/cluster/argocd/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/glooctl/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/kops/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/minikube/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/pinniped/default.nix13
-rw-r--r--pkgs/applications/networking/cluster/pluto/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/waypoint/default.nix6
-rw-r--r--pkgs/applications/networking/go-graft/default.nix4
-rw-r--r--pkgs/applications/networking/mumble/default.nix6
-rw-r--r--pkgs/applications/networking/seaweedfs/default.nix4
-rw-r--r--pkgs/applications/networking/shellhub-agent/default.nix6
-rw-r--r--pkgs/applications/science/electronics/nanovna-saver/default.nix4
-rw-r--r--pkgs/applications/science/logic/potassco/clingo.nix4
-rw-r--r--pkgs/applications/science/logic/why3/default.nix4
-rw-r--r--pkgs/applications/virtualization/ecs-agent/default.nix4
-rw-r--r--pkgs/build-support/rust/build-rust-package/default.nix5
-rwxr-xr-xpkgs/build-support/rust/fetch-cargo-tarball/cargo-vendor-normalise.py4
-rw-r--r--pkgs/build-support/rust/fetch-cargo-tarball/default.nix15
-rw-r--r--pkgs/data/misc/v2ray-geoip/default.nix6
-rw-r--r--pkgs/desktops/enlightenment/efl/default.nix4
-rw-r--r--pkgs/desktops/enlightenment/enlightenment/default.nix7
-rw-r--r--pkgs/desktops/xfce/panel-plugins/xfce4-pulseaudio-plugin/default.nix8
-rw-r--r--pkgs/development/compilers/gerbil/build.nix9
-rw-r--r--pkgs/development/compilers/mlkit/default.nix4
-rw-r--r--pkgs/development/interpreters/clojure/default.nix4
-rw-r--r--pkgs/development/interpreters/python-cosmopolitan/default.nix4
-rw-r--r--pkgs/development/interpreters/python-cosmopolitan/ioctl.patch12
-rw-r--r--pkgs/development/libraries/capstone/default.nix9
-rw-r--r--pkgs/development/libraries/cosmopolitan/default.nix22
-rw-r--r--pkgs/development/libraries/cosmopolitan/fix-paths.patch12
-rw-r--r--pkgs/development/libraries/ftgl/default.nix8
-rw-r--r--pkgs/development/libraries/intel-media-sdk/default.nix4
-rw-r--r--pkgs/development/libraries/jellyfin-ffmpeg/default.nix14
-rw-r--r--pkgs/development/libraries/libamqpcpp/default.nix4
-rw-r--r--pkgs/development/libraries/libgtkflow/default.nix4
-rw-r--r--pkgs/development/libraries/libime/default.nix14
-rw-r--r--pkgs/development/libraries/oneDNN/default.nix4
-rw-r--r--pkgs/development/libraries/opencolorio/default.nix10
-rw-r--r--pkgs/development/libraries/qt-6/fetch.sh2
-rw-r--r--pkgs/development/libraries/qt-6/srcs.nix256
-rw-r--r--pkgs/development/libraries/science/math/latte-integrale/default.nix41
-rw-r--r--pkgs/development/libraries/scope-lite/default.nix22
-rw-r--r--pkgs/development/libraries/stduuid/default.nix22
-rw-r--r--pkgs/development/libraries/vid-stab/default.nix8
-rw-r--r--pkgs/development/misc/resholve/resholve-utils.nix2
-rw-r--r--pkgs/development/python-modules/aiosmtplib/default.nix14
-rw-r--r--pkgs/development/python-modules/aioswitcher/default.nix4
-rw-r--r--pkgs/development/python-modules/appthreat-vulnerability-db/default.nix4
-rw-r--r--pkgs/development/python-modules/asysocks/default.nix4
-rwxr-xr-xpkgs/development/python-modules/atlassian-python-api/default.nix4
-rw-r--r--pkgs/development/python-modules/chess/default.nix4
-rw-r--r--pkgs/development/python-modules/cyclonedx-python-lib/default.nix14
-rw-r--r--pkgs/development/python-modules/dbus-python-client-gen/default.nix3
-rw-r--r--pkgs/development/python-modules/dbus-signature-pyparsing/default.nix2
-rw-r--r--pkgs/development/python-modules/fastcore/default.nix4
-rw-r--r--pkgs/development/python-modules/furo/default.nix11
-rw-r--r--pkgs/development/python-modules/hs-dbus-signature/default.nix2
-rw-r--r--pkgs/development/python-modules/httptools/default.nix4
-rw-r--r--pkgs/development/python-modules/immutables/default.nix6
-rw-r--r--pkgs/development/python-modules/into-dbus-python/default.nix3
-rw-r--r--pkgs/development/python-modules/json-stream/default.nix4
-rw-r--r--pkgs/development/python-modules/jwcrypto/default.nix4
-rw-r--r--pkgs/development/python-modules/korean-lunar-calendar/default.nix4
-rw-r--r--pkgs/development/python-modules/life360/default.nix4
-rw-r--r--pkgs/development/python-modules/motor/default.nix4
-rw-r--r--pkgs/development/python-modules/netcdf4/default.nix4
-rw-r--r--pkgs/development/python-modules/niaarm/default.nix50
-rw-r--r--pkgs/development/python-modules/pgcli/default.nix16
-rw-r--r--pkgs/development/python-modules/prometheus-flask-exporter/default.nix4
-rw-r--r--pkgs/development/python-modules/pysensibo/default.nix4
-rw-r--r--pkgs/development/python-modules/pytest-httpserver/default.nix4
-rw-r--r--pkgs/development/python-modules/qingping-ble/default.nix4
-rw-r--r--pkgs/development/python-modules/resampy/default.nix4
-rw-r--r--pkgs/development/python-modules/somajo/default.nix6
-rw-r--r--pkgs/development/python-modules/sqlalchemy-continuum/default.nix4
-rw-r--r--pkgs/development/python-modules/tilt-ble/default.nix4
-rw-r--r--pkgs/development/python-modules/zodbpickle/default.nix4
-rw-r--r--pkgs/development/r-modules/generic-builder.nix2
-rw-r--r--pkgs/development/tools/analysis/flow/default.nix4
-rw-r--r--pkgs/development/tools/analysis/rizin/default.nix18
-rw-r--r--pkgs/development/tools/analysis/tflint/default.nix6
-rw-r--r--pkgs/development/tools/bazel-gazelle/default.nix4
-rw-r--r--pkgs/development/tools/build-managers/mage/default.nix4
-rw-r--r--pkgs/development/tools/build-managers/meson/default.nix4
-rw-r--r--pkgs/development/tools/circup/default.nix4
-rw-r--r--pkgs/development/tools/cosmoc/default.nix9
-rw-r--r--pkgs/development/tools/cpm/default.nix4
-rw-r--r--pkgs/development/tools/ctlptl/default.nix4
-rw-r--r--pkgs/development/tools/datree/default.nix4
-rw-r--r--pkgs/development/tools/flyway/default.nix4
-rw-r--r--pkgs/development/tools/goda/default.nix4
-rw-r--r--pkgs/development/tools/kube-linter/default.nix1
-rw-r--r--pkgs/development/tools/misc/circleci-cli/default.nix4
-rw-r--r--pkgs/development/tools/oh-my-posh/default.nix4
-rw-r--r--pkgs/development/tools/okteto/default.nix4
-rw-r--r--pkgs/development/tools/pqrs/default.nix6
-rw-r--r--pkgs/development/tools/protoc-gen-validate/default.nix6
-rw-r--r--pkgs/development/tools/railway/default.nix4
-rw-r--r--pkgs/development/tools/rust/cargo-spellcheck/default.nix6
-rw-r--r--pkgs/development/tools/rust/cargo-udeps/default.nix6
-rw-r--r--pkgs/development/tools/selene/default.nix6
-rw-r--r--pkgs/development/tools/sumneko-lua-language-server/default.nix4
-rw-r--r--pkgs/development/web/deno/default.nix6
-rw-r--r--pkgs/games/legendary-gl/default.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.14.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.19.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.9.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-5.10.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-5.15.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-5.19.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-5.4.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-libre.nix4
-rw-r--r--pkgs/servers/alps/default.nix4
-rw-r--r--pkgs/servers/mautrix-signal/default.nix4
-rw-r--r--pkgs/servers/mautrix-whatsapp/default.nix6
-rw-r--r--pkgs/servers/monitoring/grafana/default.nix6
-rw-r--r--pkgs/servers/monitoring/sensu-go/default.nix6
-rw-r--r--pkgs/servers/nosql/immudb/default.nix64
-rw-r--r--pkgs/servers/tailscale/default.nix4
-rw-r--r--pkgs/servers/traefik/default.nix6
-rw-r--r--pkgs/servers/web-apps/wiki-js/default.nix4
-rw-r--r--pkgs/shells/xonsh/default.nix6
-rw-r--r--pkgs/tools/X11/ckbcomp/default.nix4
-rw-r--r--pkgs/tools/X11/xsecurelock/default.nix4
-rw-r--r--pkgs/tools/admin/syft/default.nix6
-rw-r--r--pkgs/tools/admin/trivy/default.nix6
-rw-r--r--pkgs/tools/compression/dtrx/default.nix4
-rw-r--r--pkgs/tools/filesystems/btrfs-progs/default.nix4
-rw-r--r--pkgs/tools/filesystems/stratis-cli/default.nix12
-rw-r--r--pkgs/tools/inputmethods/fcitx5/default.nix6
-rw-r--r--pkgs/tools/inputmethods/fcitx5/fcitx5-chinese-addons.nix4
-rw-r--r--pkgs/tools/inputmethods/fcitx5/fcitx5-gtk.nix4
-rw-r--r--pkgs/tools/misc/dotter/default.nix14
-rw-r--r--pkgs/tools/misc/elfcat/default.nix3
-rw-r--r--pkgs/tools/misc/exa/default.nix17
-rw-r--r--pkgs/tools/misc/macchina/default.nix6
-rw-r--r--pkgs/tools/misc/miniserve/default.nix6
-rw-r--r--pkgs/tools/misc/mongodb-compass/default.nix4
-rw-r--r--pkgs/tools/misc/mutagen-compose/default.nix6
-rw-r--r--pkgs/tools/misc/pspg/default.nix4
-rw-r--r--pkgs/tools/networking/netbird/default.nix4
-rw-r--r--pkgs/tools/networking/rathole/default.nix6
-rw-r--r--pkgs/tools/security/dalfox/default.nix6
-rw-r--r--pkgs/tools/security/exploitdb/default.nix4
-rw-r--r--pkgs/tools/security/gitls/default.nix6
-rw-r--r--pkgs/tools/security/nsjail/001-fix-bison-link-error.patch30
-rw-r--r--pkgs/tools/security/nsjail/default.nix18
-rw-r--r--pkgs/tools/security/rekor/default.nix6
-rw-r--r--pkgs/tools/security/sx-go/default.nix11
-rw-r--r--pkgs/tools/system/skeema/default.nix4
-rw-r--r--pkgs/tools/video/svt-av1/default.nix4
-rw-r--r--pkgs/tools/wayland/wayout/default.nix2
-rw-r--r--pkgs/top-level/all-packages.nix13
-rw-r--r--pkgs/top-level/python-packages.nix2
177 files changed, 1004 insertions, 582 deletions
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 4ad1b83c20c..79dacff88b1 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -8104,6 +8104,13 @@
     githubId = 109141;
     name = "Georges Dubus";
   };
+  madonius = {
+    email = "nixos@madoni.us";
+    github = "madonius";
+    githubId = 1246752;
+    name = "madonius";
+    matrix = "@madonius:entropia.de";
+  };
   Madouura = {
     email = "madouura@gmail.com";
     github = "Madouura";
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
index 93136198413..d721fb5dd83 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
@@ -125,6 +125,13 @@
       </listitem>
       <listitem>
         <para>
+          Perl has been updated to 5.36, and its core module
+          <literal>HTTP::Tiny</literal> was patched to verify SSL/TLS
+          certificates by default.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
           Cinnamon has been updated to 5.4. While at it, the cinnamon
           module now defaults to blueman as bluetooth manager and
           slick-greeter as lightdm greeter to match upstream.
@@ -227,6 +234,13 @@
       </listitem>
       <listitem>
         <para>
+          <link xlink:href="https://git.sr.ht/~migadu/alps">alps</link>,
+          a simple and extensible webmail. Available as
+          <link linkend="opt-services.alps.enable">services.alps</link>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
           <link xlink:href="https://netbird.io">netbird</link>, a zero
           configuration VPN. Available as
           <link xlink:href="options.html#opt-services.netbird.enable">services.netbird</link>.
diff --git a/nixos/doc/manual/release-notes/rl-2211.section.md b/nixos/doc/manual/release-notes/rl-2211.section.md
index ecebaae0d25..53f26c4ccc2 100644
--- a/nixos/doc/manual/release-notes/rl-2211.section.md
+++ b/nixos/doc/manual/release-notes/rl-2211.section.md
@@ -50,6 +50,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - PHP now defaults to PHP 8.1, updated from 8.0.
 
+- Perl has been updated to 5.36, and its core module `HTTP::Tiny` was patched to verify SSL/TLS certificates by default.
+
 - Cinnamon has been updated to 5.4. While at it, the cinnamon module now defaults to
   blueman as bluetooth manager and slick-greeter as lightdm greeter to match upstream.
 
@@ -83,6 +85,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [Outline](https://www.getoutline.com/), a wiki and knowledge base similar to Notion. Available as [services.outline](#opt-services.outline.enable).
 
+- [alps](https://git.sr.ht/~migadu/alps), a simple and extensible webmail. Available as [services.alps](#opt-services.alps.enable).
+
 - [netbird](https://netbird.io), a zero configuration VPN.
   Available as [services.netbird](options.html#opt-services.netbird.enable).
 
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index d5ab997bda3..998919f2a43 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1054,6 +1054,7 @@
   ./services/video/epgstation/default.nix
   ./services/video/mirakurun.nix
   ./services/video/replay-sorcery.nix
+  ./services/web-apps/alps.nix
   ./services/web-apps/atlassian/confluence.nix
   ./services/web-apps/atlassian/crowd.nix
   ./services/web-apps/atlassian/jira.nix
diff --git a/nixos/modules/services/misc/nix-daemon.nix b/nixos/modules/services/misc/nix-daemon.nix
index e8d2bccdbf9..bd599144895 100644
--- a/nixos/modules/services/misc/nix-daemon.nix
+++ b/nixos/modules/services/misc/nix-daemon.nix
@@ -227,6 +227,16 @@ in
                 The hostname of the build machine.
               '';
             };
+            protocol = mkOption {
+              type = types.enum [ "ssh" "ssh-ng" ];
+              default = "ssh";
+              example = "ssh-ng";
+              description = lib.mdDoc ''
+                The protocol used for communicating with the build machine.
+                Use `ssh-ng` if your remote builder and your
+                local Nix version support that improved protocol.
+              '';
+            };
             system = mkOption {
               type = types.nullOr types.str;
               default = null;
@@ -670,7 +680,7 @@ in
         concatMapStrings
           (machine:
             (concatStringsSep " " ([
-              "${optionalString (machine.sshUser != null) "${machine.sshUser}@"}${machine.hostName}"
+              "${machine.protocol}://${optionalString (machine.sshUser != null) "${machine.sshUser}@"}${machine.hostName}"
               (if machine.system != null then machine.system else if machine.systems != [ ] then concatStringsSep "," machine.systems else "-")
               (if machine.sshKey != null then machine.sshKey else "-")
               (toString machine.maxJobs)
diff --git a/nixos/modules/services/web-apps/alps.nix b/nixos/modules/services/web-apps/alps.nix
new file mode 100644
index 00000000000..b171729fd0a
--- /dev/null
+++ b/nixos/modules/services/web-apps/alps.nix
@@ -0,0 +1,96 @@
+{ lib, pkgs, config, ... }:
+
+with lib;
+
+let
+  cfg = config.services.alps;
+in {
+  options.services.alps = {
+    enable = mkEnableOption (lib.mdDoc "alps");
+
+    port = mkOption {
+      type = types.port;
+      default = 1323;
+      description = lib.mdDoc ''
+        TCP port the service should listen on.
+      '';
+    };
+
+    bindIP = mkOption {
+      default = "[::]";
+      type = types.str;
+      description = lib.mdDoc ''
+        The IP the service should listen on.
+      '';
+    };
+
+    theme = mkOption {
+      type = types.enum [ "alps" "sourcehut" ];
+      default = "sourcehut";
+      description = lib.mdDoc ''
+        The frontend's theme to use.
+      '';
+    };
+
+    imaps = {
+      port = mkOption {
+        type = types.port;
+        default = 993;
+        description = lib.mdDoc ''
+          The IMAPS server port.
+        '';
+      };
+
+      host = mkOption {
+        type = types.str;
+        default = "[::1]";
+        example = "mail.example.org";
+        description = lib.mdDoc ''
+          The IMAPS server address.
+        '';
+      };
+    };
+
+    smtps = {
+      port = mkOption {
+        type = types.port;
+        default = 445;
+        description = lib.mdDoc ''
+          The SMTPS server port.
+        '';
+      };
+
+      host = mkOption {
+        type = types.str;
+        default = cfg.imaps.host;
+        defaultText = "services.alps.imaps.host";
+        example = "mail.example.org";
+        description = lib.mdDoc ''
+          The SMTPS server address.
+        '';
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.alps = {
+      description = "alps is a simple and extensible webmail.";
+      documentation = [ "https://git.sr.ht/~migadu/alps" ];
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" "network-online.target" ];
+
+      serviceConfig = {
+        ExecStart = ''
+          ${pkgs.alps}/bin/alps \
+            -addr ${cfg.bindIP}:${toString cfg.port} \
+            -theme ${cfg.theme} \
+            imaps://${cfg.imaps.host}:${toString cfg.imaps.port} \
+            smpts://${cfg.smtps.host}:${toString cfg.smtps.port}
+        '';
+        StateDirectory = "alps";
+        WorkingDirectory = "/var/lib/alps";
+        DynamicUser = true;
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/web-apps/wiki-js.nix b/nixos/modules/services/web-apps/wiki-js.nix
index 9cdbe989a35..c5627a28b84 100644
--- a/nixos/modules/services/web-apps/wiki-js.nix
+++ b/nixos/modules/services/web-apps/wiki-js.nix
@@ -127,7 +127,7 @@ in {
         WorkingDirectory = "/var/lib/${cfg.stateDirectoryName}";
         DynamicUser = true;
         PrivateTmp = true;
-        ExecStart = "${pkgs.nodejs}/bin/node ${pkgs.wiki-js}/server";
+        ExecStart = "${pkgs.nodejs-16_x}/bin/node ${pkgs.wiki-js}/server";
       };
     };
   };
diff --git a/pkgs/applications/audio/ncspot/default.nix b/pkgs/applications/audio/ncspot/default.nix
index e0d50063926..3037bfcf808 100644
--- a/pkgs/applications/audio/ncspot/default.nix
+++ b/pkgs/applications/audio/ncspot/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ncspot";
-  version = "0.11.0";
+  version = "0.11.1";
 
   src = fetchFromGitHub {
     owner = "hrkfdn";
     repo = "ncspot";
     rev = "v${version}";
-    sha256 = "sha256-mtveGRwadcct9R8CxLWCvT9FamK2PnicpeSvL4iT4oE=";
+    sha256 = "sha256-q4jOfcU2sNKISgO9vX2Rao2JljiYzWwB3WWMIvy8rII=";
   };
 
-  cargoSha256 = "sha256-JqHJY91q2vm0x819zUkBBAObpnXN5aPde8m5UJ2NeNY=";
+  cargoSha256 = "sha256-f8yo60Gi2OdJMNxssMhladh82/ZeZ0ZWV7WmTcQ8jYo=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/applications/audio/ymuse/default.nix b/pkgs/applications/audio/ymuse/default.nix
index dc0fb16c452..e59d42e10b4 100644
--- a/pkgs/applications/audio/ymuse/default.nix
+++ b/pkgs/applications/audio/ymuse/default.nix
@@ -14,15 +14,15 @@
 
 buildGoModule rec {
   pname = "ymuse";
-  version = "0.20";
+  version = "0.21";
 
   src = fetchFromGitHub {
     owner = "yktoo";
     repo = "ymuse";
     rev = "v${version}";
-    sha256 = "sha256-wDQjNBxwxFVFdSswubp4AVD35aXKJ8i0ahk/tgRsDRc=";
+    sha256 = "sha256-3QgBbK7AK9/uQ6Z7DNIJxa1oXrxvvHDQ/Z2QOf7yfS4=";
   };
-  vendorSha256 = "sha256-Ap/nf0NT0VkP2k9U1HzEiptDfLjKkBopP5h0czP3vis=";
+  vendorSha256 = "sha256-7oYYZWpvWzeHlp6l9bLeHcLITLZPVY5eZdfHSE+ZHW8=";
 
   nativeBuildInputs = [
     pkg-config
@@ -39,7 +39,8 @@ buildGoModule rec {
   ];
 
   postInstall = ''
-    install -Dm644 ./resources/ymuse.desktop -t $out/share/applications
+    install -Dm644 ./resources/com.yktoo.ymuse.desktop -t $out/share/applications
+    install -Dm644 ./resources/metainfo/com.yktoo.ymuse.metainfo.xml -t $out/share/metainfo
     cp -r ./resources/icons $out/share
 
     app_id="ymuse"
diff --git a/pkgs/applications/blockchains/go-ethereum/default.nix b/pkgs/applications/blockchains/go-ethereum/default.nix
index fa1aca4360f..ca8f33bcd5c 100644
--- a/pkgs/applications/blockchains/go-ethereum/default.nix
+++ b/pkgs/applications/blockchains/go-ethereum/default.nix
@@ -9,13 +9,13 @@ let
 
 in buildGoModule rec {
   pname = "go-ethereum";
-  version = "1.10.23";
+  version = "1.10.25";
 
   src = fetchFromGitHub {
     owner = "ethereum";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-1fEmtbHKrjuyIVrGr/vTudZ99onkNjEMvyBJt4I8KK4=";
+    sha256 = "sha256-mnf0kMfQEEQMricZJfyF7ZB/2F1dyPBx9iT2v/rGh1U=";
   };
 
   vendorSha256 = "sha256-Dj+xN8lr98LJyYr2FwJ7yUIJkUeUrr1fkcbj4hShJI0=";
@@ -46,7 +46,7 @@ in buildGoModule rec {
     "cmd/utils"
   ];
 
-  # Following upstream: https://github.com/ethereum/go-ethereum/blob/v1.10.23/build/ci.go#L218
+  # Following upstream: https://github.com/ethereum/go-ethereum/blob/v1.10.25/build/ci.go#L218
   tags = [ "urfave_cli_no_docs" ];
 
   # Fix for usb-related segmentation faults on darwin
diff --git a/pkgs/applications/blockchains/solana-validator/default.nix b/pkgs/applications/blockchains/solana-validator/default.nix
index d9e159966a7..503d4b404e7 100644
--- a/pkgs/applications/blockchains/solana-validator/default.nix
+++ b/pkgs/applications/blockchains/solana-validator/default.nix
@@ -13,7 +13,6 @@
 , protobuf
 , clang
 , llvm
-, pkgconfig
 , openssl
 , libclang
 , rustfmt
@@ -74,7 +73,7 @@ rustPlatform.buildRustPackage rec {
     "-isystem ${libclang.lib}/lib/clang/${lib.getVersion clang}/include";
   LLVM_CONFIG_PATH = "${llvm}/bin/llvm-config";
 
-  nativeBuildInputs = [ clang llvm pkgconfig protobuf rustfmt perl ];
+  nativeBuildInputs = [ clang llvm pkg-config protobuf rustfmt perl ];
   buildInputs =
     [ openssl zlib libclang hidapi ] ++ (lib.optionals stdenv.isLinux [ udev ]);
   strictDeps = true;
diff --git a/pkgs/applications/editors/emacs/elisp-packages/update-melpa.el b/pkgs/applications/editors/emacs/elisp-packages/update-melpa.el
index c8c1bfee566..a900d1bedd3 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/update-melpa.el
+++ b/pkgs/applications/editors/emacs/elisp-packages/update-melpa.el
@@ -103,6 +103,10 @@ return Promise to resolve in that process."
                                                   (url-hexify-string repo)
                                                   "/repository/archive.tar.gz?ref="
                                                   commit)))
+            ("sourcehut" (list "nix-prefetch-url"
+                               "--unpack" (concat "https://git.sr.ht/~" repo "/archive/" commit ".tar.gz")))
+            ("codeberg" (list "nix-prefetch-url"
+                              "--unpack" (concat "https://codeberg.org/" repo "/archive/" commit ".tar.gz")))
             ("bitbucket" (list "nix-prefetch-hg"
                                (concat "https://bitbucket.com/" repo) commit))
             ("hg"        (list "nix-prefetch-hg"
diff --git a/pkgs/applications/editors/vscode/vscode.nix b/pkgs/applications/editors/vscode/vscode.nix
index a0ffaf348d0..1ae65c1cbf4 100644
--- a/pkgs/applications/editors/vscode/vscode.nix
+++ b/pkgs/applications/editors/vscode/vscode.nix
@@ -18,17 +18,17 @@ let
   archive_fmt = if stdenv.isDarwin then "zip" else "tar.gz";
 
   sha256 = {
-    x86_64-linux = "0cnrbjqcnkv7ybj9j7l0lcnfnxq18mddhdkj9797928q643bmj6z";
-    x86_64-darwin = "1d9gb3i2k0c9cn38igg1nm91bfqdi4xg29zlprqsqh98ijwqy25y";
-    aarch64-linux = "1jm8ll8f4m99ly53rv7000ng9a0l8jn4xpc6kfhmqdnf0jqfncsh";
-    aarch64-darwin = "1awmaxkr5nl513c50g6k4r2j3w8p2by1j9i3kw7vkmwn91bk24i4";
-    armv7l-linux = "1d2hl9jy1kfkzn4j7qkp3k8j1qc3r9rpqhvkfrr2axcqrahcrfsd";
+    x86_64-linux = "0ar8gpklaa0aa3k1934jyg2vh65hzncx0awl1f0wz8n4fjasfrpc";
+    x86_64-darwin = "0jkpzyg2pk2d88w2ffrp2lr0qadss7ccycx4vpmjmw62d3sap8n1";
+    aarch64-linux = "1g7lzqghagz63pljg4wy34z706j70vjmk49cl8v27jbnsgnva56a";
+    aarch64-darwin = "132ml95xlyv5c343bfv0gpgr8rmk85xspsy9baninlmhnmy7mivv";
+    armv7l-linux = "04anb6r7hkk3y3vahx32nxj5dz2i66rrnl0561xkcjr4cqvxykiw";
   }.${system} or throwSystem;
 in
   callPackage ./generic.nix rec {
     # Please backport all compatible updates to the stable release.
     # This is important for the extension ecosystem.
-    version = "1.71.0";
+    version = "1.71.2";
     pname = "vscode";
 
     executableName = "code" + lib.optionalString isInsiders "-insiders";
diff --git a/pkgs/applications/graphics/krita/default.nix b/pkgs/applications/graphics/krita/default.nix
index 6a7edb460ec..90d51827f14 100644
--- a/pkgs/applications/graphics/krita/default.nix
+++ b/pkgs/applications/graphics/krita/default.nix
@@ -1,7 +1,7 @@
 { callPackage, ... } @ args:
 
 callPackage ./generic.nix (args // {
-  version = "5.1.0";
+  version = "5.1.1";
   kde-channel = "stable";
-  sha256 = "sha256-mjs/WFhIC3CRvUhEmSbmE1OOqKTcBiSchg/+PaWs2II=";
+  sha256 = "sha256-Tdv4l6+nsYcTFpfRKiO6OYlGOAaLLq4Ss7Q0/kKtjiQ=";
 })
diff --git a/pkgs/applications/misc/1password/default.nix b/pkgs/applications/misc/1password/default.nix
index 8402e7147a6..d5b5c29c564 100644
--- a/pkgs/applications/misc/1password/default.nix
+++ b/pkgs/applications/misc/1password/default.nix
@@ -12,12 +12,12 @@ let
     if extension == "zip" then fetchzip args else fetchurl args;
 
   pname = "1password-cli";
-  version = "2.7.0";
+  version = "2.7.1";
   sources = rec {
-    aarch64-linux = fetch "linux_arm64" "sha256-6c8m+Gea52XpNrPtY7oi3gsALHwLiK5aD83rsJSp6x0=" "zip";
-    i686-linux = fetch "linux_386" "sha256-glcyQ1JWP7/cMpMY2/tTLnhPXy8nVmbzvIw4ZmP8SKg=" "zip";
-    x86_64-linux = fetch "linux_amd64" "sha256-CjHl3AzUaD7ESlXeFfreZgs5tc3C546GoEgkVJe+vv4=" "zip";
-    aarch64-darwin = fetch "apple_universal" "sha256-3HEvkGWqJQNloVpkMl64DIoee3e/sMGf+GpAmAnS1jI=" "pkg";
+    aarch64-linux = fetch "linux_arm64" "sha256-JEOvLga6o3QOPYyGJfvqWIYL00TaqjcFzSMKw1ZSxtM=" "zip";
+    i686-linux = fetch "linux_386" "sha256-Xd40mOsElbrGioPX0irz13jhiu8mZ2n6LmKrt4FyzDg=" "zip";
+    x86_64-linux = fetch "linux_amd64" "sha256-DZYSkgrIpH0cYpIllVWHIuUcNgNyeX09dZ1RgUudWP8=" "zip";
+    aarch64-darwin = fetch "apple_universal" "sha256-j+e9y1FQp30O5pFVLbbXhtrbyRjWZZPFhkFfNXDcCPs=" "pkg";
     x86_64-darwin = aarch64-darwin;
   };
   platforms = builtins.attrNames sources;
diff --git a/pkgs/applications/misc/elfx86exts/default.nix b/pkgs/applications/misc/elfx86exts/default.nix
index 91598db76d0..237b9708a9b 100644
--- a/pkgs/applications/misc/elfx86exts/default.nix
+++ b/pkgs/applications/misc/elfx86exts/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "elfx86exts";
-  version = "0.4.3";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "pkgw";
     repo = pname;
     rev = "${pname}@${version}";
-    sha256 = "1j9ca2lyxjsrf0rsfv83xi53vj6jz5nb76xibh367brcsc26mvd6";
+    sha256 = "sha256-SDBs5/jEvoKEVKCHQLz2z+CZSSmESP7LoIITRN4qJWA=";
   };
 
-  cargoSha256 = "0n3b9vdk5n32jmd7ks50d55z4dfahjincd2s1d8m9z17ip2qw2c4";
+  cargoSha256 = "sha256-fYtFRdH6U8uWshdD1Pb1baE8slo6qajx10tDK3Ukknw=";
 
   meta = with lib; {
     description = "Decode x86 binaries and print out which instruction set extensions they use.";
diff --git a/pkgs/applications/misc/genact/default.nix b/pkgs/applications/misc/genact/default.nix
index 97abbaca77a..c5d48ff454e 100644
--- a/pkgs/applications/misc/genact/default.nix
+++ b/pkgs/applications/misc/genact/default.nix
@@ -1,17 +1,32 @@
-{ lib, rustPlatform, fetchFromGitHub }:
+{ lib, rustPlatform, fetchFromGitHub, jq }:
 
 rustPlatform.buildRustPackage rec {
   pname = "genact";
-  version = "1.0.2";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "svenstaro";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-lZNVXBIYl9niqdwNcSzQwQTdxlA4kKQ/WrEt93cQDJU=";
+    sha256 = "sha256-Mw6mPOxiWnYu2QgqL4VccwwJhdxZ7zLJyX/oJWfGUhw=";
   };
 
-  cargoSha256 = "sha256-9IiA7KAaj9bLJ7QSB/ojLEiUVv0FGYsu9by4NSfMtiE=";
+  cargoSha256 = "sha256-ygQklcRjdffGl0s77MwKsyHVJWqWJZHq4SU38cSMVug=";
+
+  depsExtraArgs = {
+    nativeBuildInputs = [ jq ];
+    postBuild = ''
+      pushd $name/humansize
+
+      [ -d feature-tests ] && rm -r feature-tests
+
+      jq '.files |= with_entries(select(.key | startswith("feature-tests") | not))' \
+        -c .cargo-checksum.json > .cargo-checksum.json.new
+      mv .cargo-checksum.json{.new,}
+
+      popd
+    '';
+  };
 
   meta = with lib; {
     description = "A nonsense activity generator";
diff --git a/pkgs/applications/misc/hugo/default.nix b/pkgs/applications/misc/hugo/default.nix
index ef996754f19..0e176e1971e 100644
--- a/pkgs/applications/misc/hugo/default.nix
+++ b/pkgs/applications/misc/hugo/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "hugo";
-  version = "0.102.3";
+  version = "0.103.0";
 
   src = fetchFromGitHub {
     owner = "gohugoio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-qk5iv/oJ2Q8vR5jFl0gR7gA0H/3sHJOOlr8rwg7HjUY=";
+    sha256 = "sha256-X78wmxEjw2noOjOj3uujXZHsPOSdZJ4KPz4Ia5sOu3I=";
   };
 
-  vendorSha256 = "sha256-oWOu8vmxe0a/nIgkjpx7XrB49rjcuqnnpuOMtI9bLfY=";
+  vendorSha256 = "sha256-Y0+D5H7kWi+bacJm1pouYDPHnnSRPatOt6qPfkk92X4=";
 
   doCheck = false;
 
diff --git a/pkgs/applications/misc/latte-dock/default.nix b/pkgs/applications/misc/latte-dock/default.nix
index 6451a3efb70..695fe938a9e 100644
--- a/pkgs/applications/misc/latte-dock/default.nix
+++ b/pkgs/applications/misc/latte-dock/default.nix
@@ -29,7 +29,7 @@ mkDerivation rec {
     homepage = "https://github.com/psifidotos/Latte-Dock";
     license = licenses.gpl2;
     platforms = platforms.unix;
-    maintainers = [ maintainers.benley maintainers.ysndr ];
+    maintainers = [ maintainers.ysndr ];
   };
 
 
diff --git a/pkgs/applications/misc/rofimoji/default.nix b/pkgs/applications/misc/rofimoji/default.nix
index 44ce37c4564..45b12bab89e 100644
--- a/pkgs/applications/misc/rofimoji/default.nix
+++ b/pkgs/applications/misc/rofimoji/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonApplication rec {
   pname = "rofimoji";
-  version = "5.5.0";
+  version = "5.6.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "fdw";
     repo = "rofimoji";
     rev = "refs/tags/${version}";
-    sha256 = "sha256-rYqEeAoHCx0j83R1vmtj+CVuR0QFEd3e1c5O454mANM=";
+    sha256 = "sha256-6W/59DjxrgejHSkNxpruDAws812Vjyf+GePDPbXzVbc=";
   };
 
   # `rofi` and the `waylandSupport` and `x11Support` dependencies
diff --git a/pkgs/applications/misc/slides/default.nix b/pkgs/applications/misc/slides/default.nix
index aaac0c10657..cedd8701731 100644
--- a/pkgs/applications/misc/slides/default.nix
+++ b/pkgs/applications/misc/slides/default.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "slides";
-  version = "0.8.0";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "maaslalani";
     repo = "slides";
     rev = "v${version}";
-    sha256 = "sha256-Ca0/M4B6yAdV4hbJ95gH9MVZg3EFIY5bSMkkYy2+P+Q=";
+    sha256 = "sha256-K8VsqaNUPxh3/Yddy6DFiOyjRuZ6r6bU456Pm31A1og=";
   };
 
   checkInputs = [
@@ -21,7 +21,7 @@ buildGoModule rec {
     go
   ];
 
-  vendorSha256 = "sha256-pn7c/6RF/GpECQtaxsTau91T7pLg+ZAUBbnR7h8DfnY=";
+  vendorSha256 = "sha256-c3YCf22L5+rTmH5ePeJ0/goRj5rKY6v+Zon3183MhMY=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/applications/misc/solaar/default.nix b/pkgs/applications/misc/solaar/default.nix
index 3d750d8b0fd..6a40f13034e 100644
--- a/pkgs/applications/misc/solaar/default.nix
+++ b/pkgs/applications/misc/solaar/default.nix
@@ -14,13 +14,13 @@
 # instead of adding this to `services.udev.packages` on NixOS,
 python3Packages.buildPythonApplication rec {
   pname = "solaar";
-  version = "1.1.4";
+  version = "1.1.5";
 
   src = fetchFromGitHub {
     owner = "pwr-Solaar";
     repo = "Solaar";
-    rev = version;
-    hash = "sha256-nDfVF7g0M54DRpkH1rnZB8o+nCV4A6b1uKMOMRQ3GbI=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-wqSDSLzm2RYV7XZPX0GQDR+TUgj4hLJ9FpVP3DYN7To=";
   };
 
   outputs = [ "out" "udev" ];
diff --git a/pkgs/applications/misc/variety/default.nix b/pkgs/applications/misc/variety/default.nix
index 10b98e0642c..83c3fb69d19 100644
--- a/pkgs/applications/misc/variety/default.nix
+++ b/pkgs/applications/misc/variety/default.nix
@@ -15,6 +15,8 @@
 , feh
 , imagemagickSupport ? true
 , imagemagick
+, appindicatorSupport ? true
+, libayatana-appindicator-gtk3
 }:
 
 python3.pkgs.buildPythonApplication rec {
@@ -41,7 +43,8 @@ python3.pkgs.buildPythonApplication rec {
     hicolor-icon-theme
     libnotify
     librsvg
-  ];
+  ]
+  ++ lib.optional appindicatorSupport libayatana-appindicator-gtk3;
 
   propagatedBuildInputs = with python3.pkgs; [
     beautifulsoup4
diff --git a/pkgs/applications/networking/cluster/argocd/default.nix b/pkgs/applications/networking/cluster/argocd/default.nix
index 509ee0aedd0..84cc0ee0f09 100644
--- a/pkgs/applications/networking/cluster/argocd/default.nix
+++ b/pkgs/applications/networking/cluster/argocd/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "argocd";
-  version = "2.4.11";
+  version = "2.4.12";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo-cd";
     rev = "v${version}";
-    sha256 = "sha256-o4mDqLbGsrlpPNEBqsvIGpelL5IocHnFpRrvoLExGes=";
+    sha256 = "sha256-U3Qct7wL/oJDgU+PXL5UMMTsQo4maeKShDwU2crSWxk=";
   };
 
   vendorSha256 = "sha256-n6elT6ETOtbZsFqfwMo9d2qqamS8jdrROjFjStNkalc=";
diff --git a/pkgs/applications/networking/cluster/glooctl/default.nix b/pkgs/applications/networking/cluster/glooctl/default.nix
index bde95292141..fd12aa33190 100644
--- a/pkgs/applications/networking/cluster/glooctl/default.nix
+++ b/pkgs/applications/networking/cluster/glooctl/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "glooctl";
-  version = "1.12.17";
+  version = "1.12.18";
 
   src = fetchFromGitHub {
     owner = "solo-io";
     repo = "gloo";
     rev = "v${version}";
-    hash = "sha256-6lwjfJOW1T+pRU9nrZ9Pit0N0je+t829jeKmlDn9TgA=";
+    hash = "sha256-FzJxYbDo0bVMHLo3XBCciS/N4Jx87tDP8SQttWNqkUc=";
   };
 
   subPackages = [ "projects/gloo/cli/cmd" ];
diff --git a/pkgs/applications/networking/cluster/kops/default.nix b/pkgs/applications/networking/cluster/kops/default.nix
index d988e061f3a..a18e60f051b 100644
--- a/pkgs/applications/networking/cluster/kops/default.nix
+++ b/pkgs/applications/networking/cluster/kops/default.nix
@@ -62,8 +62,8 @@ rec {
   };
 
   kops_1_24 = mkKops rec {
-    version = "1.24.2";
-    sha256 = "sha256-QEoaSkJ3fzUr2Fr3M2EOd/3iwq1ZX2YHEez2i0kjRmY=";
+    version = "1.24.3";
+    sha256 = "sha256-o84060P2aHTIm61lSkz2/GqzYd2NYk1zKgGdNaHlWfA=";
     rev = "v${version}";
   };
 
diff --git a/pkgs/applications/networking/cluster/minikube/default.nix b/pkgs/applications/networking/cluster/minikube/default.nix
index 605160e3d5e..3b95b4e8cd9 100644
--- a/pkgs/applications/networking/cluster/minikube/default.nix
+++ b/pkgs/applications/networking/cluster/minikube/default.nix
@@ -12,9 +12,9 @@
 
 buildGoModule rec {
   pname = "minikube";
-  version = "1.26.1";
+  version = "1.27.0";
 
-  vendorSha256 = "sha256-aw2B5wdhEQiTDp/BpJdXzY3XBm3eXlSQt83j4RHhMg0=";
+  vendorSha256 = "sha256-wAjgeq//vRUDUyVNTsVIxLXhA6fzTrYvn4klAPAv7DE=";
 
   doCheck = false;
 
@@ -22,7 +22,7 @@ buildGoModule rec {
     owner = "kubernetes";
     repo = "minikube";
     rev = "v${version}";
-    sha256 = "sha256-08q/IdQEq1/KaIBN6ss8r1KbjSjZnhOW/BeaJ8BuYZM=";
+    sha256 = "sha256-Pn0F3363YJoOdWyoPy46HmIUwWr/I5TekalBp9hHg7I=";
   };
 
   nativeBuildInputs = [ installShellFiles pkg-config which makeWrapper ];
diff --git a/pkgs/applications/networking/cluster/pinniped/default.nix b/pkgs/applications/networking/cluster/pinniped/default.nix
index 9ee8109a94e..61bb2000e13 100644
--- a/pkgs/applications/networking/cluster/pinniped/default.nix
+++ b/pkgs/applications/networking/cluster/pinniped/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, buildGoModule }:
+{ lib, fetchFromGitHub, buildGoModule, installShellFiles }:
 
 buildGoModule rec{
   pname = "pinniped";
@@ -15,6 +15,17 @@ buildGoModule rec{
 
   vendorSha256 = "sha256-8ohyyciL1ORYOxPu64W0jXASTv+vVZR8StutzbF9N4Y=";
 
+  ldflags = [ "-s" "-w" ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    installShellCompletion --cmd pinniped \
+      --bash <($out/bin/pinniped completion bash) \
+      --fish <($out/bin/pinniped completion fish) \
+      --zsh <($out/bin/pinniped completion zsh)
+  '';
+
   meta = with lib; {
     description = "Tool to securely log in to your Kubernetes clusters";
     homepage = "https://pinniped.dev/";
diff --git a/pkgs/applications/networking/cluster/pluto/default.nix b/pkgs/applications/networking/cluster/pluto/default.nix
index e7e603c28c9..a88cda718d5 100644
--- a/pkgs/applications/networking/cluster/pluto/default.nix
+++ b/pkgs/applications/networking/cluster/pluto/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "pluto";
-  version = "5.10.6";
+  version = "5.10.7";
 
   src = fetchFromGitHub {
     owner = "FairwindsOps";
     repo = "pluto";
     rev = "v${version}";
-    sha256 = "sha256-FNt+e13IEpIWB6gBYWfwJ+Qu7W/cyHvV+XGNhn17rdg=";
+    sha256 = "sha256-AGzDs2KZt44uBJRBHvBL7nn5TpgWbcdLTEf9Vx9j89U=";
   };
 
-  vendorSha256 = "sha256-M/D7V6v4+BlROoxhT9URuj9EI6qXYG2VoXcCVN+j6aU=";
+  vendorSha256 = "sha256-cA5QxI1lLBdzPOj3pFqqHPfMwJQPPiyqQA4FLwetNUs=";
 
   ldflags = [
     "-w" "-s"
diff --git a/pkgs/applications/networking/cluster/waypoint/default.nix b/pkgs/applications/networking/cluster/waypoint/default.nix
index 8c056cdce01..685a422a174 100644
--- a/pkgs/applications/networking/cluster/waypoint/default.nix
+++ b/pkgs/applications/networking/cluster/waypoint/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "waypoint";
-  version = "0.9.1";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-wvbtiu4WeuiHtyLkhwAB20XvpvHvy24xPSH5Lxtpea8=";
+    sha256 = "sha256-vyPYKEmAc2kmcCGF28wMq7oZa4ZcSKp5SyCMounspQA=";
   };
 
-  vendorSha256 = "sha256-bDsmou4zmRz8DyENdteJ3MzhTpCgri4ISIgxi7fhQdc=";
+  vendorSha256 = "sha256-/WyqxK+FFSfR/Gyxy7K65KZDVfBM5Pp7WnoafF0AeQY=";
 
   nativeBuildInputs = [ go-bindata installShellFiles ];
 
diff --git a/pkgs/applications/networking/go-graft/default.nix b/pkgs/applications/networking/go-graft/default.nix
index 2c3bc3c6e8a..93d84928ab6 100644
--- a/pkgs/applications/networking/go-graft/default.nix
+++ b/pkgs/applications/networking/go-graft/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "go-graft";
-  version = "0.2.9";
+  version = "0.2.11";
 
   src = fetchFromGitHub {
     owner = "mzz2017";
     repo = "gg";
     rev = "v${version}";
-    sha256 = "sha256-lsxZBhXgLJIy39kaOj5cCQUgZEDhlylklOdD4qHXks0=";
+    sha256 = "sha256-RIHlAE+hsMXA/kWfazAmhsEi298tPY4Mt4RR6vmo1oQ=";
   };
 
   CGO_ENABLED = 0;
diff --git a/pkgs/applications/networking/mumble/default.nix b/pkgs/applications/networking/mumble/default.nix
index d3a02cacfb6..890930ba89a 100644
--- a/pkgs/applications/networking/mumble/default.nix
+++ b/pkgs/applications/networking/mumble/default.nix
@@ -98,14 +98,14 @@ let
   } source;
 
   source = rec {
-    version = "1.4.274";
+    version = "1.4.287";
 
     # Needs submodules
     src = fetchFromGitHub {
       owner = "mumble-voip";
       repo = "mumble";
-      rev = "cc73c7679b08158f91b02272efbb0e3e5dd9c9e4";
-      sha256 = "sha256-QXczSLDhWLE4CDvBJ7NtqfL52bZJDisFo04AMHnMuN8=";
+      rev = "5d808e287e99b402b724e411a7a0848e00956a24";
+      sha256 = "sha256-SYsGCuj3HeyAQRUecGLaRdJR9Rm7lbaM54spY/zx0jU=";
       fetchSubmodules = true;
     };
   };
diff --git a/pkgs/applications/networking/seaweedfs/default.nix b/pkgs/applications/networking/seaweedfs/default.nix
index cceca4f955c..8c87d0ed4c2 100644
--- a/pkgs/applications/networking/seaweedfs/default.nix
+++ b/pkgs/applications/networking/seaweedfs/default.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "seaweedfs";
-  version = "3.26";
+  version = "3.27";
 
   src = fetchFromGitHub {
     owner = "chrislusf";
     repo = "seaweedfs";
     rev = version;
-    sha256 = "sha256-ETpcBodT3zFwzc5tczgfw6pD3htb4xFzl0btkyODWk0=";
+    sha256 = "sha256-kvKUgw6A4UHOuDmKuOv+XS/0XiOf2ENWxl2WmJ4cVTE=";
   };
 
   vendorSha256 = "sha256-sgLHRDdi9gkcSzeBaDCxtbvWSzjTshb2WbmMyRepUKA=";
diff --git a/pkgs/applications/networking/shellhub-agent/default.nix b/pkgs/applications/networking/shellhub-agent/default.nix
index f702eb7bfd5..2cff80dd730 100644
--- a/pkgs/applications/networking/shellhub-agent/default.nix
+++ b/pkgs/applications/networking/shellhub-agent/default.nix
@@ -8,18 +8,18 @@
 
 buildGoModule rec {
   pname = "shellhub-agent";
-  version = "0.9.6";
+  version = "0.10.1";
 
   src = fetchFromGitHub {
     owner = "shellhub-io";
     repo = "shellhub";
     rev = "v${version}";
-    sha256 = "Ag1rwBWeVUBKxnsIGNDwz9UmHwpklwF6UjM8IPudZTs=";
+    sha256 = "jeZh1vPXUN/jcf306S6KdIeHygci+4+uky4MXQgRlpA=";
   };
 
   modRoot = "./agent";
 
-  vendorSha256 = "sha256-UDsgfsdq8DecyTAFrmWO09V3JIuTA5YLCEAei0tYRy4=";
+  vendorSha256 = "sha256-AqtDI1GFw4cduFdWRSh9lYe/OwvEdu5iB0+ud8QPgXM=";
 
   ldflags = [ "-s" "-w" "-X main.AgentVersion=v${version}" ];
 
diff --git a/pkgs/applications/science/electronics/nanovna-saver/default.nix b/pkgs/applications/science/electronics/nanovna-saver/default.nix
index 817a3b1c087..22950326e86 100644
--- a/pkgs/applications/science/electronics/nanovna-saver/default.nix
+++ b/pkgs/applications/science/electronics/nanovna-saver/default.nix
@@ -6,13 +6,13 @@
 }:
 python3.pkgs.buildPythonApplication rec {
   pname = "nanovna-saver";
-  version = "0.5.2";
+  version = "0.5.3";
 
   src = fetchFromGitHub {
     owner = "NanoVNA-Saver";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-PP4VHEp6NSSLsuYABr0/S3+YuhpAyvh/xGnQGyszCtM=";
+    sha256 = "sha256-wKKjMcOx7NS2VAIk3OTAj7KWE1+CeAzctdgdidT+HMA=";
   };
 
   nativeBuildInputs = [ wrapQtAppsHook ];
diff --git a/pkgs/applications/science/logic/potassco/clingo.nix b/pkgs/applications/science/logic/potassco/clingo.nix
index d46efe18c98..0065ff3ef25 100644
--- a/pkgs/applications/science/logic/potassco/clingo.nix
+++ b/pkgs/applications/science/logic/potassco/clingo.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "clingo";
-  version = "5.6.0";
+  version = "5.6.1";
 
   src = fetchFromGitHub {
     owner = "potassco";
     repo = "clingo";
     rev = "v${version}";
-    sha256 = "sha256-3qyQ7CnpELs6IsDxrW+IbV/TmlfYxP9VIVVjc7sM9fg=";
+    sha256 = "sha256-blr2GPa/ZwVfvot6wUcQmdN/mLEox6tjIWtr0geeoDI=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/science/logic/why3/default.nix b/pkgs/applications/science/logic/why3/default.nix
index ab5006e424e..11cd1918896 100644
--- a/pkgs/applications/science/logic/why3/default.nix
+++ b/pkgs/applications/science/logic/why3/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "why3";
-  version = "1.5.0";
+  version = "1.5.1";
 
   src = fetchurl {
     url = "https://why3.gitlabpages.inria.fr/releases/${pname}-${version}.tar.gz";
-    sha256 = "sha256:0qjh49pyqmg3xi09fn4lyzz23i6h18y9sgc8ayscvx3bwr3vcqhr";
+    sha256 = "sha256-vNR7WeiSvg+763GcovoZBFDfncekJMeqNegP4fVw06I=";
   };
 
   buildInputs = with ocamlPackages; [
diff --git a/pkgs/applications/virtualization/ecs-agent/default.nix b/pkgs/applications/virtualization/ecs-agent/default.nix
index ec5ad0f0c00..da77aaca0f2 100644
--- a/pkgs/applications/virtualization/ecs-agent/default.nix
+++ b/pkgs/applications/virtualization/ecs-agent/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname   = "amazon-ecs-agent";
-  version = "1.63.0";
+  version = "1.63.1";
 
   goPackagePath = "github.com/aws/${pname}";
   subPackages   = [ "agent" ];
@@ -11,7 +11,7 @@ buildGoPackage rec {
     rev    = "v${version}";
     owner  = "aws";
     repo   = pname;
-    sha256 = "sha256-SDDfwFnnoq2fCeg+wfJsczXb4dDChgyfsNrZkwGMHCc=";
+    sha256 = "sha256-wnDwLpCDeIC2D2X/pzC6ZsudJz58xLo1PQB+K6WNxBE=";
   };
 
   meta = with lib; {
diff --git a/pkgs/build-support/rust/build-rust-package/default.nix b/pkgs/build-support/rust/build-rust-package/default.nix
index 95b6f357e56..db0d2c53bb1 100644
--- a/pkgs/build-support/rust/build-rust-package/default.nix
+++ b/pkgs/build-support/rust/build-rust-package/default.nix
@@ -52,8 +52,9 @@
 , buildAndTestSubdir ? null
 , ... } @ args:
 
-assert cargoVendorDir == null && cargoLock == null -> !(args ? cargoSha256) && !(args ? cargoHash)
-  -> throw "cargoSha256, cargoHash, cargoVendorDir, or cargoLock must be set";
+assert cargoVendorDir == null && cargoLock == null
+    -> !(args ? cargoSha256 && args.cargoSha256 != null) && !(args ? cargoHash && args.cargoHash != null)
+    -> throw "cargoSha256, cargoHash, cargoVendorDir, or cargoLock must be set";
 assert buildType == "release" || buildType == "debug";
 
 let
diff --git a/pkgs/build-support/rust/fetch-cargo-tarball/cargo-vendor-normalise.py b/pkgs/build-support/rust/fetch-cargo-tarball/cargo-vendor-normalise.py
index 2d7a1895718..90933b089c9 100755
--- a/pkgs/build-support/rust/fetch-cargo-tarball/cargo-vendor-normalise.py
+++ b/pkgs/build-support/rust/fetch-cargo-tarball/cargo-vendor-normalise.py
@@ -13,7 +13,9 @@ def quote(s: str) -> str:
 def main() -> None:
     data = toml.load(sys.stdin)
 
-    assert list(data.keys()) == ["source"]
+    # There is no dependency to vendor in this project.
+    if not list(data.keys()) == ["source"]:
+        return
 
     # this value is non deterministic
     data["source"]["vendored-sources"]["directory"] = "@vendor@"
diff --git a/pkgs/build-support/rust/fetch-cargo-tarball/default.nix b/pkgs/build-support/rust/fetch-cargo-tarball/default.nix
index 2f1f3547dbb..6d6219078ba 100644
--- a/pkgs/build-support/rust/fetch-cargo-tarball/default.nix
+++ b/pkgs/build-support/rust/fetch-cargo-tarball/default.nix
@@ -58,10 +58,21 @@ in stdenv.mkDerivation ({
     export CARGO_HOME=$(mktemp -d cargo-home.XXX)
     CARGO_CONFIG=$(mktemp cargo-config.XXXX)
 
+    if [[ -n "$NIX_CRATES_INDEX" ]]; then
+    cat >$CARGO_HOME/config.toml <<EOF
+    [source.crates-io]
+    replace-with = 'mirror'
+    [source.mirror]
+    registry = "$NIX_CRATES_INDEX"
+    EOF
+    fi
+
     ${cargoUpdateHook}
 
-    cargo vendor $name | cargo-vendor-normalise > $CARGO_CONFIG
+    cargo vendor $name --respect-source-config | cargo-vendor-normalise > $CARGO_CONFIG
 
+    # Create an empty vendor directory when there is no dependency to vendor
+    mkdir -p $name
     # Add the Cargo.lock to allow hash invalidation
     cp Cargo.lock.orig $name/Cargo.lock
 
@@ -81,7 +92,7 @@ in stdenv.mkDerivation ({
 
   inherit (hash_) outputHashAlgo outputHash;
 
-  impureEnvVars = lib.fetchers.proxyImpureEnvVars;
+  impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [ "NIX_CRATES_INDEX" ];
 } // (builtins.removeAttrs args [
   "name" "sha256" "cargoUpdateHook" "nativeBuildInputs"
 ]))
diff --git a/pkgs/data/misc/v2ray-geoip/default.nix b/pkgs/data/misc/v2ray-geoip/default.nix
index 507f6059b76..f27c791d4cb 100644
--- a/pkgs/data/misc/v2ray-geoip/default.nix
+++ b/pkgs/data/misc/v2ray-geoip/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "v2ray-geoip";
-  version = "202209080101";
+  version = "202209150105";
 
   src = fetchFromGitHub {
     owner = "v2fly";
     repo = "geoip";
-    rev = "2e77e5d149f0a8f9c284333b206d0f017b0b66ef";
-    sha256 = "sha256-vkWRBSwLpCqZWMlfwOyPWn2MF+/lG+VXnSrDCSR+dak=";
+    rev = "6666b85fc48179414d59613cdfd6f83354f778bc";
+    sha256 = "sha256-iBQvfVvfTG8zQdoTGOFxME0tr/YWCVxjXFQhP/zmRVU=";
   };
 
   installPhase = ''
diff --git a/pkgs/desktops/enlightenment/efl/default.nix b/pkgs/desktops/enlightenment/efl/default.nix
index 7c0832a07f4..0c47eec55f0 100644
--- a/pkgs/desktops/enlightenment/efl/default.nix
+++ b/pkgs/desktops/enlightenment/efl/default.nix
@@ -56,11 +56,11 @@
 
 stdenv.mkDerivation rec {
   pname = "efl";
-  version = "1.26.2";
+  version = "1.26.3";
 
   src = fetchurl {
     url = "http://download.enlightenment.org/rel/libs/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "071h0pscbd8g341yy5rz9mk1xn8yhryldhl6mmr1y6lafaycyy99";
+    sha256 = "sha256-2fg6oP2TNPRN7rTklS3A5RRGg6+seG/uvOYDCVFhfRU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/enlightenment/enlightenment/default.nix b/pkgs/desktops/enlightenment/enlightenment/default.nix
index 3ce2592598f..52c4a0719d0 100644
--- a/pkgs/desktops/enlightenment/enlightenment/default.nix
+++ b/pkgs/desktops/enlightenment/enlightenment/default.nix
@@ -1,4 +1,5 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchurl
 , meson
 , ninja
@@ -21,11 +22,11 @@
 
 stdenv.mkDerivation rec {
   pname = "enlightenment";
-  version = "0.25.3";
+  version = "0.25.4";
 
   src = fetchurl {
     url = "http://download.enlightenment.org/rel/apps/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "1xngwixp0cckfq3jhrdmmk6zj67125amr7g6xwc6l89pnpmlkz9p";
+    sha256 = "sha256-VttdIGuCG5qIMdJucT5BCscLIlWm9D/N98Ae794jt6I=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-pulseaudio-plugin/default.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-pulseaudio-plugin/default.nix
index 7591ed1e0e5..320eb928052 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-pulseaudio-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-pulseaudio-plugin/default.nix
@@ -1,8 +1,6 @@
 { lib
 , mkXfceDerivation
 , automakeAddFlags
-, dbus-glib
-, dbus
 , exo
 , gtk3
 , libpulseaudio
@@ -18,15 +16,13 @@
 mkXfceDerivation {
   category = "panel-plugins";
   pname = "xfce4-pulseaudio-plugin";
-  version = "0.4.4";
-  sha256 = "sha256-arnHB9ziQm/vQk6hYHS+MKL5dJeEVxUX+SwjZ3/LcEQ=";
+  version = "0.4.5";
+  sha256 = "sha256-oRkvKSDEEepNwWIMDYLH/a034xxFhhOx+vp8O2UfTos=";
 
   nativeBuildInputs = [
     automakeAddFlags
   ];
 
-  NIX_CFLAGS_COMPILE = "-I${dbus-glib.dev}/include/dbus-1.0 -I${dbus.dev}/include/dbus-1.0";
-
   postPatch = ''
     substituteInPlace configure.ac.in --replace gio-2.0 gio-unix-2.0
   '';
diff --git a/pkgs/development/compilers/gerbil/build.nix b/pkgs/development/compilers/gerbil/build.nix
index 040f17ff285..3d2fd7551e6 100644
--- a/pkgs/development/compilers/gerbil/build.nix
+++ b/pkgs/development/compilers/gerbil/build.nix
@@ -21,15 +21,6 @@ stdenv.mkDerivation rec {
   buildInputs = [ gambit ]
     ++ buildInputs_libraries; # ++ buildInputs_staticLibraries;
 
-  # disable stackprotector on aarch64-darwin for now
-  # build error:
-  # ```
-  # /private/tmp/nix-build-gerbil-unstable-2020-11-05.drv-0/ccjyhWKi.s:326:15: error: index must be an integer in range [-256, 255].
-  #         ldr     x2, [x2, ___stack_chk_guard];momd
-  #                          ^
-  # ```
-  hardeningDisable = lib.optionals (gccStdenv.isAarch64 && gccStdenv.isDarwin) [ "stackprotector" ];
-
   NIX_CFLAGS_COMPILE = "-I${libmysqlclient}/include/mysql -L${libmysqlclient}/lib/mysql";
 
   postPatch = ''
diff --git a/pkgs/development/compilers/mlkit/default.nix b/pkgs/development/compilers/mlkit/default.nix
index eb286662972..9e462fac092 100644
--- a/pkgs/development/compilers/mlkit/default.nix
+++ b/pkgs/development/compilers/mlkit/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mlkit";
-  version = "4.6.1";
+  version = "4.7.1";
 
   src = fetchFromGitHub {
     owner = "melsman";
     repo = "mlkit";
     rev = "v${version}";
-    sha256 = "sha256-04G9G14fhEh8wwgqHwUR+sbYU3zaZcFV0q5SoAKcyjY=";
+    sha256 = "sha256-7fxyXibq17ikrqhqMj4pnLerBOvkY/7ses4Kjw2GdOY=";
   };
 
   nativeBuildInputs = [ autoreconfHook mlton ];
diff --git a/pkgs/development/interpreters/clojure/default.nix b/pkgs/development/interpreters/clojure/default.nix
index 49cba2ca621..27aefa9e284 100644
--- a/pkgs/development/interpreters/clojure/default.nix
+++ b/pkgs/development/interpreters/clojure/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "clojure";
-  version = "1.11.1.1149";
+  version = "1.11.1.1161";
 
   src = fetchurl {
     # https://clojure.org/releases/tools
     url = "https://download.clojure.org/install/clojure-tools-${version}.tar.gz";
-    sha256 = "sha256-IIhonPSwpADNAuv9DQIKrdsJcGAlX+6uHe+jvA6i3KQ=";
+    sha256 = "sha256-B+NSIS1lHLqtLImY2gRYwYTrilJrbmDUvqd2H8UunA4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/interpreters/python-cosmopolitan/default.nix b/pkgs/development/interpreters/python-cosmopolitan/default.nix
index 14459a24aac..a2a512b9cdf 100644
--- a/pkgs/development/interpreters/python-cosmopolitan/default.nix
+++ b/pkgs/development/interpreters/python-cosmopolitan/default.nix
@@ -6,10 +6,6 @@ stdenv.mkDerivation rec {
 
   src = cosmopolitan.dist;
 
-  patches = [
-    ./ioctl.patch        # required /dev/tty
-  ];
-
   nativeBuildInputs = [ bintools-unwrapped unzip ];
 
   # slashes are significant because upstream uses o/$(MODE)/foo.o
diff --git a/pkgs/development/interpreters/python-cosmopolitan/ioctl.patch b/pkgs/development/interpreters/python-cosmopolitan/ioctl.patch
deleted file mode 100644
index e6e7eb4fc7b..00000000000
--- a/pkgs/development/interpreters/python-cosmopolitan/ioctl.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/third_party/python/python.mk b/third_party/python/python.mk
-index f18c15060..b17455bca 100644
---- a/third_party/python/python.mk
-+++ b/third_party/python/python.mk
-@@ -1818,7 +1818,6 @@ THIRD_PARTY_PYTHON_PYTEST_PYMAINS =						\
- 	third_party/python/Lib/test/test_int_literal.py				\
- 	third_party/python/Lib/test/test_bisect.py				\
- 	third_party/python/Lib/test/test_pyexpat.py				\
--	third_party/python/Lib/test/test_ioctl.py				\
- 	third_party/python/Lib/test/test_getopt.py				\
- 	third_party/python/Lib/test/test_sort.py				\
- 	third_party/python/Lib/test/test_slice.py				\
diff --git a/pkgs/development/libraries/capstone/default.nix b/pkgs/development/libraries/capstone/default.nix
index 6f5a8e340ad..a2ace544b7c 100644
--- a/pkgs/development/libraries/capstone/default.nix
+++ b/pkgs/development/libraries/capstone/default.nix
@@ -1,4 +1,9 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, pkg-config
+, fixDarwinDylibNames
+}:
 
 stdenv.mkDerivation rec {
   pname = "capstone";
@@ -31,6 +36,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     pkg-config
+  ] ++ lib.optionals stdenv.isDarwin [
+    fixDarwinDylibNames
   ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/cosmopolitan/default.nix b/pkgs/development/libraries/cosmopolitan/default.nix
index f58e654cbfe..7522fe2ba2e 100644
--- a/pkgs/development/libraries/cosmopolitan/default.nix
+++ b/pkgs/development/libraries/cosmopolitan/default.nix
@@ -1,16 +1,21 @@
-{ lib, stdenv, fetchFromGitHub, unzip, bintools-unwrapped }:
+{ lib, stdenv, fetchFromGitHub, unzip, bintools-unwrapped, coreutils, substituteAll }:
 
 stdenv.mkDerivation rec {
   pname = "cosmopolitan";
-  version = "unstable-2022-03-22";
+  version = "2.0.1";
 
   src = fetchFromGitHub {
     owner = "jart";
-    repo = "cosmopolitan";
-    rev = "5022f9e9207ff2b79ddd6de6d792d3280e12fb3a";
-    sha256 = "sha256-UjL4wR5HhuXiQXg6Orcx2fKiVGRPMJk15P779BP1fRA=";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-EPye7IRMmYHF7XYdDaJdA8alCLiF7MOkU/fVAzZA794=";
   };
 
+  patches = [
+    # make sure tests set PATH correctly
+    (substituteAll { src = ./fix-paths.patch; inherit coreutils; })
+  ];
+
   nativeBuildInputs = [ bintools-unwrapped unzip ];
 
   outputs = [ "out" "dist" ];
@@ -24,11 +29,16 @@ stdenv.mkDerivation rec {
   dontConfigure = true;
   dontFixup = true;
 
+  preCheck = ''
+    # some syscall tests fail because we're in a sandbox
+    rm test/libc/calls/sched_setscheduler_test.c
+  '';
+
   installPhase = ''
     runHook preInstall
     mkdir -p $out/{include,lib}
     install o/cosmopolitan.h $out/include
-    install o/cosmopolitan.a o/libc/crt/crt.o o/ape/ape.{o,lds} $out/lib
+    install o/cosmopolitan.a o/libc/crt/crt.o o/ape/ape.{o,lds} o/ape/ape-no-modify-self.o $out/lib
 
     cp -RT . "$dist"
     runHook postInstall
diff --git a/pkgs/development/libraries/cosmopolitan/fix-paths.patch b/pkgs/development/libraries/cosmopolitan/fix-paths.patch
new file mode 100644
index 00000000000..85c59f3f12a
--- /dev/null
+++ b/pkgs/development/libraries/cosmopolitan/fix-paths.patch
@@ -0,0 +1,12 @@
+--- a/test/tool/plinko/plinko_test.c
++++ b/test/tool/plinko/plinko_test.c
+@@ -91,8 +91,8 @@ TEST(plinko, worksOrPrintsNiceError) {
+     sigaction(SIGQUIT, &savequit, 0);
+     sigaction(SIGPIPE, &savepipe, 0);
+     sigprocmask(SIG_SETMASK, &savemask, 0);
+     execve("bin/plinko.com", (char *const[]){"bin/plinko.com", 0},
+-           (char *const[]){0});
++           (char *const[]){"PATH=@coreutils@/bin", 0});
+     _exit(127);
+   }
+   close(pfds[0][0]);
diff --git a/pkgs/development/libraries/ftgl/default.nix b/pkgs/development/libraries/ftgl/default.nix
index 466ffcbb73a..46d6180eb1d 100644
--- a/pkgs/development/libraries/ftgl/default.nix
+++ b/pkgs/development/libraries/ftgl/default.nix
@@ -23,6 +23,14 @@ stdenv.mkDerivation rec {
     hash = "sha256-6TDNGoMeBLnucmHRgEDIVWcjlJb7N0sTluqBwRMMWn4=";
   };
 
+  # GL_DYLIB is hardcoded to an impure path
+  # /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGL.dylib
+  # and breaks build on recent macOS versions
+  postPatch = ''
+    substituteInPlace m4/gl.m4 \
+      --replace ' -dylib_file $GL_DYLIB: $GL_DYLIB' ""
+  '';
+
   nativeBuildInputs = [
     autoreconfHook
     doxygen
diff --git a/pkgs/development/libraries/intel-media-sdk/default.nix b/pkgs/development/libraries/intel-media-sdk/default.nix
index 5ec0eabf1fc..288f12ac1fc 100644
--- a/pkgs/development/libraries/intel-media-sdk/default.nix
+++ b/pkgs/development/libraries/intel-media-sdk/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-media-sdk";
-  version = "22.5.2";
+  version = "22.5.3";
 
   src = fetchFromGitHub {
     owner = "Intel-Media-SDK";
     repo = "MediaSDK";
     rev = "intel-mediasdk-${version}";
-    sha256 = "sha256-HBG1JsTwAbl7p42Crmx82M7VnIaLk0oBXc4SJoIdEIs=";
+    sha256 = "sha256-oWwES0XKjhVGPVsPo4t9WWorm+4J6lMPa+/pSY7r6I0=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/development/libraries/jellyfin-ffmpeg/default.nix b/pkgs/development/libraries/jellyfin-ffmpeg/default.nix
index bb95fa5606f..d24ca8de9f9 100644
--- a/pkgs/development/libraries/jellyfin-ffmpeg/default.nix
+++ b/pkgs/development/libraries/jellyfin-ffmpeg/default.nix
@@ -2,35 +2,25 @@
 , nv-codec-headers-11
 , fetchFromGitHub
 , lib
-, fetchpatch
 }:
 
 (ffmpeg_5-full.override {
   nv-codec-headers = nv-codec-headers-11;
 }).overrideAttrs (old: rec {
   pname = "jellyfin-ffmpeg";
-  version = "5.1-2";
+  version = "5.1.1-1";
 
   src = fetchFromGitHub {
     owner = "jellyfin";
     repo = "jellyfin-ffmpeg";
     rev = "v${version}";
-    sha256 = "sha256-lw2W65mbBhiSnegxLSRqDz2WMM82ght/KB4i+5BiL4o=";
+    sha256 = "sha256-WxUADm5z6SH6Xegi2dhhien5IBY/Y/ZZaXr7MdOvpYA=";
   };
 
   configureFlags = old.configureFlags ++ [
     "--disable-ptx-compression" # https://github.com/jellyfin/jellyfin/issues/7944#issuecomment-1156880067
   ];
 
-  patches = old.patches ++ [
-    # fixed in upstream ffmpeg 5.1.1 https://trac.ffmpeg.org/ticket/9841
-    (fetchpatch {
-      name = "rename-imf-fate-target.patch";
-      url = "https://github.com/FFmpeg/FFmpeg/commit/80d1b8938eb227f0e9efde91050836b1e9a051a9.patch";
-      sha256 = "sha256-weUbLKSQ9iRYSQ3hgXcVpo8jfKajpXK21qD1GrZYHYQ=";
-    })
-  ];
-
   postPatch = ''
     for file in $(cat debian/patches/series); do
       patch -p1 < debian/patches/$file
diff --git a/pkgs/development/libraries/libamqpcpp/default.nix b/pkgs/development/libraries/libamqpcpp/default.nix
index 2a1ea4f606d..4c42ea8e212 100644
--- a/pkgs/development/libraries/libamqpcpp/default.nix
+++ b/pkgs/development/libraries/libamqpcpp/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libamqpcpp";
-  version = "4.3.16";
+  version = "4.3.17";
 
   src = fetchFromGitHub {
     owner = "CopernicaMarketingSoftware";
     repo = "AMQP-CPP";
     rev = "v${version}";
-    sha256 = "sha256-aBLNdw9LhHFwnIt70vIYlX1/j2IUTmpm5Ub+ZImF8FI=";
+    sha256 = "sha256-DQzetwBpgXE1oG295DCc1m12LSbzRTD3khNbEe0O4Rg=";
   };
 
   buildInputs = [ openssl ];
diff --git a/pkgs/development/libraries/libgtkflow/default.nix b/pkgs/development/libraries/libgtkflow/default.nix
index 3e08f0dee77..78e43d56b9a 100644
--- a/pkgs/development/libraries/libgtkflow/default.nix
+++ b/pkgs/development/libraries/libgtkflow/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "libgtkflow";
-  version = "0.8.0";
+  version = "0.10.0";
 
   src = fetchFromGitea {
     domain = "notabug.org";
     owner = "grindhold";
     repo = pname;
     rev = version;
-    hash = "sha256:1m30rvj5hx3b4cj8lbzrxv4j8lp3hx4jlb8vpf4rh46vc1rdkxpz";
+    hash = "sha256-iTOoga94yjGTowQOM/EvHEDOO9Z3UutPGRgEoI1UWkI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libime/default.nix b/pkgs/development/libraries/libime/default.nix
index 85d5c30691c..d1f14664344 100644
--- a/pkgs/development/libraries/libime/default.nix
+++ b/pkgs/development/libraries/libime/default.nix
@@ -13,26 +13,26 @@ let
     url = "https://download.fcitx-im.org/data/table.tar.gz";
     sha256 = "1dw7mgbaidv3vqy0sh8dbfv8631d2zwv5mlb7npf69a1f8y0b5k1";
   };
-  arpaVer = "20220630";
+  arpaVer = "20220810";
   arpa = fetchurl {
     url = "https://download.fcitx-im.org/data/lm_sc.arpa-${arpaVer}.tar.xz";
-    sha256 = "sha256-jTsPqPoWuT0NRZDwLaBAKcJxNktZJcHJAoRcN0oqAL8=";
+    sha256 = "sha256-oRvJfSda2vGV+brIVDaK4GzbSg/h7s9Z21rlgGFdtPo=";
   };
-  dictVer = "20220706";
+  dictVer = "20220810";
   dict = fetchurl {
     url = "https://download.fcitx-im.org/data/dict-${dictVer}.tar.xz";
-    sha256 = "sha256-vNeR//eDr7QMHI6S2z+Dc0+Lk8nGriwV4eqHeLkHB3k=";
+    sha256 = "sha256-lxdS9BMYgAfo0ZFYwRuFyVXiXXsyHsInXEs69tioXSY=";
   };
 in
 stdenv.mkDerivation rec {
   pname = "libime";
-  version = "unstable-2022-07-11";
+  version = "1.0.14";
 
   src = fetchFromGitHub {
     owner = "fcitx";
     repo = "libime";
-    rev = "1adb14eb0617ef0eb0f07ad99684f43ca8a4395c";
-    sha256 = "sha256-UldswsnkMuJh2G/EdsFl4CS7Y2RSRAb1hYeWUA2MHPw=";
+    rev = version;
+    sha256 = "sha256-O89Op2dxuhGgCxuy2GLI0waCgDreJKNQ5tTvsx/0/fk=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/libraries/oneDNN/default.nix b/pkgs/development/libraries/oneDNN/default.nix
index 8137f2b55b3..7286a0913a9 100644
--- a/pkgs/development/libraries/oneDNN/default.nix
+++ b/pkgs/development/libraries/oneDNN/default.nix
@@ -5,13 +5,13 @@
 # https://github.com/oneapi-src/oneDNN#oneapi-deep-neural-network-library-onednn
 stdenv.mkDerivation rec {
   pname = "oneDNN";
-  version = "2.6.1";
+  version = "2.6.2";
 
   src = fetchFromGitHub {
     owner = "oneapi-src";
     repo = "oneDNN";
     rev = "v${version}";
-    sha256 = "sha256-cO8hT5ZrA9VegxOFH9fHm3YKK4A6XmaWIAfPTytNu6I=";
+    sha256 = "sha256-CJbgmarN30UtRSKd7I2UZgDTkyhwj7k+QAtYhRnFkXQ=";
   };
 
   outputs = [ "out" "dev" "doc" ];
diff --git a/pkgs/development/libraries/opencolorio/default.nix b/pkgs/development/libraries/opencolorio/default.nix
index 81ab688b643..dd6c31792b1 100644
--- a/pkgs/development/libraries/opencolorio/default.nix
+++ b/pkgs/development/libraries/opencolorio/default.nix
@@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchFromGitHub
+, fetchpatch
 , cmake
 , expat
 , libyamlcpp
@@ -35,6 +36,15 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-e1PpWjjfSjtgN9Rs/+lsA45Z9S4y4T6nqrJ02DZ4vjs=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "darwin-no-hidden-l.patch";
+      url = "https://github.com/AcademySoftwareFoundation/OpenColorIO/commit/48bab7c643ed8d108524d718e5038d836f906682.patch";
+      revert = true;
+      sha256 = "sha256-0DF+lwi2nfkUFG0wYvL3HYbhZS6SqGtPWoOabrFS1Eo=";
+    })
+  ];
+
   nativeBuildInputs = [ cmake ];
   buildInputs = [
     expat
diff --git a/pkgs/development/libraries/qt-6/fetch.sh b/pkgs/development/libraries/qt-6/fetch.sh
index 70c9cedb098..6849bfb40b8 100644
--- a/pkgs/development/libraries/qt-6/fetch.sh
+++ b/pkgs/development/libraries/qt-6/fetch.sh
@@ -1 +1 @@
-WGET_ARGS=( http://download.qt.io/official_releases/qt/6.3/6.3.1/submodules/ -A '*.tar.xz' )
+WGET_ARGS=( http://download.qt.io/official_releases/qt/6.3/6.3.2/submodules/ -A '*.tar.xz' )
diff --git a/pkgs/development/libraries/qt-6/srcs.nix b/pkgs/development/libraries/qt-6/srcs.nix
index 07bb7fd494f..d0ee4475b4f 100644
--- a/pkgs/development/libraries/qt-6/srcs.nix
+++ b/pkgs/development/libraries/qt-6/srcs.nix
@@ -4,259 +4,259 @@
 
 {
   qt3d = {
-    version = "6.3.1";
+    version = "6.3.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.3/6.3.1/submodules/qt3d-everywhere-src-6.3.1.tar.xz";
-      sha256 = "1zpdafqm82hd2bijw20hi1ng81xwihsn9mm7n5ns4gr5zdnvc6cr";
-      name = "qt3d-everywhere-src-6.3.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.3/6.3.2/submodules/qt3d-everywhere-src-6.3.2.tar.xz";
+      sha256 = "0gy73dlzj0hajxr0v68sljqvqclcryirm901icszg1mfvl4xw6zj";
+      name = "qt3d-everywhere-src-6.3.2.tar.xz";
     };
   };
   qt5compat = {
-    version = "6.3.1";
+    version = "6.3.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.3/6.3.1/submodules/qt5compat-everywhere-src-6.3.1.tar.xz";
-      sha256 = "1zbcaswpl79ixcxzj85qzjq73962s4c7316pibwfrskqswmwcgm4";
-      name = "qt5compat-everywhere-src-6.3.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.3/6.3.2/submodules/qt5compat-everywhere-src-6.3.2.tar.xz";
+      sha256 = "1k30hnwnlbay1hnkdavgf6plsdzrryzcqd2qz8x11r477w7sr8wi";
+      name = "qt5compat-everywhere-src-6.3.2.tar.xz";
     };
   };
   qtactiveqt = {
-    version = "6.3.1";
+    version = "6.3.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.3/6.3.1/submodules/qtactiveqt-everywhere-src-6.3.1.tar.xz";
-      sha256 = "0axygqjqny6vjwmc5swn80xrcs97bcjwgxsg81f35srxpn9lxdb4";
-      name = "qtactiveqt-everywhere-src-6.3.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.3/6.3.2/submodules/qtactiveqt-everywhere-src-6.3.2.tar.xz";
+      sha256 = "052mcwln989hp154kdrjxmif81glx4x3qcmnhss4n1ps4m28jw7w";
+      name = "qtactiveqt-everywhere-src-6.3.2.tar.xz";
     };
   };
   qtbase = {
-    version = "6.3.1";
+    version = "6.3.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.3/6.3.1/submodules/qtbase-everywhere-src-6.3.1.tar.xz";
-      sha256 = "00sfya41ihqb0zwg6wf1kiy02iymj6mk584hhk2c4s94khfl4r0a";
-      name = "qtbase-everywhere-src-6.3.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.3/6.3.2/submodules/qtbase-everywhere-src-6.3.2.tar.xz";
+      sha256 = "19m9r8sf9mvyrwipn44if3nhding4ljys2mwf04b7dkhz16vlabr";
+      name = "qtbase-everywhere-src-6.3.2.tar.xz";
     };
   };
   qtcharts = {
-    version = "6.3.1";
+    version = "6.3.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.3/6.3.1/submodules/qtcharts-everywhere-src-6.3.1.tar.xz";
-      sha256 = "1xvwsabyfln3sih9764xknl2s3w4w069k210kgbh94bj50iwqc7k";
-      name = "qtcharts-everywhere-src-6.3.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.3/6.3.2/submodules/qtcharts-everywhere-src-6.3.2.tar.xz";
+      sha256 = "1xpv7vijamm1iwx71wbyc7wqw9s35j1iz1ycp5c1a33hhq9lxa5a";
+      name = "qtcharts-everywhere-src-6.3.2.tar.xz";
     };
   };
   qtconnectivity = {
-    version = "6.3.1";
+    version = "6.3.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.3/6.3.1/submodules/qtconnectivity-everywhere-src-6.3.1.tar.xz";
-      sha256 = "1c4mnrl7fa8j8fmv5zbqak48nylhxpib7vmsbmmbqqcw19qy8p5j";
-      name = "qtconnectivity-everywhere-src-6.3.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.3/6.3.2/submodules/qtconnectivity-everywhere-src-6.3.2.tar.xz";
+      sha256 = "0n56z6vdf4pc4jqrimsl6gd30vgac2sirz7z2v29d71ca1n6ajg2";
+      name = "qtconnectivity-everywhere-src-6.3.2.tar.xz";
     };
   };
   qtdatavis3d = {
-    version = "6.3.1";
+    version = "6.3.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.3/6.3.1/submodules/qtdatavis3d-everywhere-src-6.3.1.tar.xz";
-      sha256 = "1wm8iigpml84zfkw3mb2kll0imszc2y19hkcfwq1wbr9w24xda43";
-      name = "qtdatavis3d-everywhere-src-6.3.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.3/6.3.2/submodules/qtdatavis3d-everywhere-src-6.3.2.tar.xz";
+      sha256 = "13xg4vs3wm47f3wbh56qnrd3wa130g0z4jhf494zd7y2n5vi4r7z";
+      name = "qtdatavis3d-everywhere-src-6.3.2.tar.xz";
     };
   };
   qtdeclarative = {
-    version = "6.3.1";
+    version = "6.3.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.3/6.3.1/submodules/qtdeclarative-everywhere-src-6.3.1.tar.xz";
-      sha256 = "1s268fha3650dn1lqxf8jfa07wxpw09f6p7rjyiwq3w24d0nkrq3";
-      name = "qtdeclarative-everywhere-src-6.3.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.3/6.3.2/submodules/qtdeclarative-everywhere-src-6.3.2.tar.xz";
+      sha256 = "1hbw63828pp8vm9b46i2pkcbcpr4mq9nblhmpwrw2pflq0fi24xq";
+      name = "qtdeclarative-everywhere-src-6.3.2.tar.xz";
     };
   };
   qtdoc = {
-    version = "6.3.1";
+    version = "6.3.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.3/6.3.1/submodules/qtdoc-everywhere-src-6.3.1.tar.xz";
-      sha256 = "1qvhv2b9c6mz7r3sdx0l81a2jr9qri17y1y8k3d6qh488fxqrk32";
-      name = "qtdoc-everywhere-src-6.3.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.3/6.3.2/submodules/qtdoc-everywhere-src-6.3.2.tar.xz";
+      sha256 = "001mf5vrgjz0hbi90qcp66lbs5hv3iickfv6780j2nsc94wjc5mp";
+      name = "qtdoc-everywhere-src-6.3.2.tar.xz";
     };
   };
   qtimageformats = {
-    version = "6.3.1";
+    version = "6.3.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.3/6.3.1/submodules/qtimageformats-everywhere-src-6.3.1.tar.xz";
-      sha256 = "0br1vqgx0hcc2nx32xviic94mvj6fbagrnzskdr7zdmvvyw140xd";
-      name = "qtimageformats-everywhere-src-6.3.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.3/6.3.2/submodules/qtimageformats-everywhere-src-6.3.2.tar.xz";
+      sha256 = "0fnfhlvd12v1gk81x5zhhrkmn6k80n3zfw5in0yrqxvcmr68mjqx";
+      name = "qtimageformats-everywhere-src-6.3.2.tar.xz";
     };
   };
   qtlanguageserver = {
-    version = "6.3.1";
+    version = "6.3.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.3/6.3.1/submodules/qtlanguageserver-everywhere-src-6.3.1.tar.xz";
-      sha256 = "1g2azb4mdzh5zp7xc57g8l2a8wfi44wfjm6js88q4mmchyj4f4br";
-      name = "qtlanguageserver-everywhere-src-6.3.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.3/6.3.2/submodules/qtlanguageserver-everywhere-src-6.3.2.tar.xz";
+      sha256 = "00ya6lqwv2dq2g86c53aafisp5vnkgamylslg5fqd8ym29g6wraj";
+      name = "qtlanguageserver-everywhere-src-6.3.2.tar.xz";
     };
   };
   qtlottie = {
-    version = "6.3.1";
+    version = "6.3.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.3/6.3.1/submodules/qtlottie-everywhere-src-6.3.1.tar.xz";
-      sha256 = "1x8wmc6gwmxk92zjcsrbhrbqbfvnk7302ggghld5wk8jk5lsf2vl";
-      name = "qtlottie-everywhere-src-6.3.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.3/6.3.2/submodules/qtlottie-everywhere-src-6.3.2.tar.xz";
+      sha256 = "1c092hmf114r8jfdhkhxnn3vywj93mg33whzav47gr9mbza44icq";
+      name = "qtlottie-everywhere-src-6.3.2.tar.xz";
     };
   };
   qtmultimedia = {
-    version = "6.3.1";
+    version = "6.3.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.3/6.3.1/submodules/qtmultimedia-everywhere-src-6.3.1.tar.xz";
-      sha256 = "0dkk3lmzi2fs13cnj8q1lpcs6gghj219826gkwnzyd6nmlm280vy";
-      name = "qtmultimedia-everywhere-src-6.3.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.3/6.3.2/submodules/qtmultimedia-everywhere-src-6.3.2.tar.xz";
+      sha256 = "0hqwq0ad6z8c5kyyvbaddj00mciijn2ns2r60jc3mqh98nm2js3z";
+      name = "qtmultimedia-everywhere-src-6.3.2.tar.xz";
     };
   };
   qtnetworkauth = {
-    version = "6.3.1";
+    version = "6.3.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.3/6.3.1/submodules/qtnetworkauth-everywhere-src-6.3.1.tar.xz";
-      sha256 = "0apvsb2ip1m3kw8vi9spvf6f6q72ys8vr40rpyysi7shsjwm83yn";
-      name = "qtnetworkauth-everywhere-src-6.3.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.3/6.3.2/submodules/qtnetworkauth-everywhere-src-6.3.2.tar.xz";
+      sha256 = "0mjnz87splyxq7jwydi5ws2aqb6j7czscrkns193w425x0dgy94l";
+      name = "qtnetworkauth-everywhere-src-6.3.2.tar.xz";
     };
   };
   qtpositioning = {
-    version = "6.3.1";
+    version = "6.3.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.3/6.3.1/submodules/qtpositioning-everywhere-src-6.3.1.tar.xz";
-      sha256 = "0v78wamvdw02kf9rq7m5v24q2g6jmgq4ch0fnfa014p1r978wy06";
-      name = "qtpositioning-everywhere-src-6.3.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.3/6.3.2/submodules/qtpositioning-everywhere-src-6.3.2.tar.xz";
+      sha256 = "0zh45lf164nzwl1hh96qm64nyw9wzzrnm5s7sx761glz54q6l5xz";
+      name = "qtpositioning-everywhere-src-6.3.2.tar.xz";
     };
   };
   qtquick3d = {
-    version = "6.3.1";
+    version = "6.3.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.3/6.3.1/submodules/qtquick3d-everywhere-src-6.3.1.tar.xz";
-      sha256 = "0mhj0r6081bjkq3fsr1vh43zn587v9m20mdpnc979h5q8zp6d9rg";
-      name = "qtquick3d-everywhere-src-6.3.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.3/6.3.2/submodules/qtquick3d-everywhere-src-6.3.2.tar.xz";
+      sha256 = "00wwla3crql4wwbaz116icgc4liszi497g692z8fxllvp4ysm80x";
+      name = "qtquick3d-everywhere-src-6.3.2.tar.xz";
     };
   };
   qtquicktimeline = {
-    version = "6.3.1";
+    version = "6.3.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.3/6.3.1/submodules/qtquicktimeline-everywhere-src-6.3.1.tar.xz";
-      sha256 = "1gpb51d8r707sr0dnvbz65d4zwisfdw40s10kximaxwfrvq3r8aq";
-      name = "qtquicktimeline-everywhere-src-6.3.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.3/6.3.2/submodules/qtquicktimeline-everywhere-src-6.3.2.tar.xz";
+      sha256 = "0njidyr7ahvrq1x1676v16qcp7lz2v2rhz0x3iw2mql90vrhk2h4";
+      name = "qtquicktimeline-everywhere-src-6.3.2.tar.xz";
     };
   };
   qtremoteobjects = {
-    version = "6.3.1";
+    version = "6.3.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.3/6.3.1/submodules/qtremoteobjects-everywhere-src-6.3.1.tar.xz";
-      sha256 = "19jcxxxj3q8vnf9cbgrp3q1pvgwsln8n16nk1gg822f6265h6vga";
-      name = "qtremoteobjects-everywhere-src-6.3.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.3/6.3.2/submodules/qtremoteobjects-everywhere-src-6.3.2.tar.xz";
+      sha256 = "099b3vchi458i4fci9kfwan871jplqlk5l8q78mfnh33g80qnasi";
+      name = "qtremoteobjects-everywhere-src-6.3.2.tar.xz";
     };
   };
   qtscxml = {
-    version = "6.3.1";
+    version = "6.3.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.3/6.3.1/submodules/qtscxml-everywhere-src-6.3.1.tar.xz";
-      sha256 = "06c6dwwx3z26k9ff6nqagg70lws4l1c6drz1yi4z1lb3c56ibg01";
-      name = "qtscxml-everywhere-src-6.3.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.3/6.3.2/submodules/qtscxml-everywhere-src-6.3.2.tar.xz";
+      sha256 = "1h90kiin6n4629nlzqkilhvn30q4ppr9kwbcxbsck4zss91yc6n5";
+      name = "qtscxml-everywhere-src-6.3.2.tar.xz";
     };
   };
   qtsensors = {
-    version = "6.3.1";
+    version = "6.3.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.3/6.3.1/submodules/qtsensors-everywhere-src-6.3.1.tar.xz";
-      sha256 = "1k301lgbiw3fiyryfr18k0dq89ls4xgs4n2pffs456msxmchn92b";
-      name = "qtsensors-everywhere-src-6.3.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.3/6.3.2/submodules/qtsensors-everywhere-src-6.3.2.tar.xz";
+      sha256 = "1r82rpn552737n04b0wvv8g9rzqxvsr1snd22bwfb4djjn5b47j5";
+      name = "qtsensors-everywhere-src-6.3.2.tar.xz";
     };
   };
   qtserialbus = {
-    version = "6.3.1";
+    version = "6.3.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.3/6.3.1/submodules/qtserialbus-everywhere-src-6.3.1.tar.xz";
-      sha256 = "1lkqv3r66fiddxbg0fv9w6l83adz3y8zq6i4pmd0hnxs0ivkz580";
-      name = "qtserialbus-everywhere-src-6.3.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.3/6.3.2/submodules/qtserialbus-everywhere-src-6.3.2.tar.xz";
+      sha256 = "04j5q2lwvbzp977zayj48ixwg4mkq0x58fk88l4kfkgy1xmrwgnh";
+      name = "qtserialbus-everywhere-src-6.3.2.tar.xz";
     };
   };
   qtserialport = {
-    version = "6.3.1";
+    version = "6.3.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.3/6.3.1/submodules/qtserialport-everywhere-src-6.3.1.tar.xz";
-      sha256 = "0vk17cjj9jpdkgd8qwb1x0lijg0p2jxdzx4d67hd57brcl7didjf";
-      name = "qtserialport-everywhere-src-6.3.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.3/6.3.2/submodules/qtserialport-everywhere-src-6.3.2.tar.xz";
+      sha256 = "0vsyqdibf8mn4481vb6sc4chgabbqzcxw1mxxm3kdik74cr0gln7";
+      name = "qtserialport-everywhere-src-6.3.2.tar.xz";
     };
   };
   qtshadertools = {
-    version = "6.3.1";
+    version = "6.3.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.3/6.3.1/submodules/qtshadertools-everywhere-src-6.3.1.tar.xz";
-      sha256 = "0nj35s2z5n438q7nqf6bnj3slwz2am3169ck1ixwqa0mjrv73dsr";
-      name = "qtshadertools-everywhere-src-6.3.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.3/6.3.2/submodules/qtshadertools-everywhere-src-6.3.2.tar.xz";
+      sha256 = "1bmkrpk414clx8pnyrdslqlsnfmsdldmwrdcqzz6rwi8ymk2ggpn";
+      name = "qtshadertools-everywhere-src-6.3.2.tar.xz";
     };
   };
   qtsvg = {
-    version = "6.3.1";
+    version = "6.3.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.3/6.3.1/submodules/qtsvg-everywhere-src-6.3.1.tar.xz";
-      sha256 = "1xvxz2jfpr1al85rhwss7ji5vkxa812d0b888hry5f7pwqcg86bv";
-      name = "qtsvg-everywhere-src-6.3.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.3/6.3.2/submodules/qtsvg-everywhere-src-6.3.2.tar.xz";
+      sha256 = "14i3f23k9k0731akpwa6zzhw5m3c0m2l5r7irvim4h4faah445ac";
+      name = "qtsvg-everywhere-src-6.3.2.tar.xz";
     };
   };
   qttools = {
-    version = "6.3.1";
+    version = "6.3.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.3/6.3.1/submodules/qttools-everywhere-src-6.3.1.tar.xz";
-      sha256 = "1h96w4bzkbd80vr7lh6hnypdlmbzc1y52c2zrqzvkgm3587pa4n4";
-      name = "qttools-everywhere-src-6.3.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.3/6.3.2/submodules/qttools-everywhere-src-6.3.2.tar.xz";
+      sha256 = "1lmfk5bhgg4daxkqrhmx4iyln7pyiz40c9cp6plyp35nz8ppvc75";
+      name = "qttools-everywhere-src-6.3.2.tar.xz";
     };
   };
   qttranslations = {
-    version = "6.3.1";
+    version = "6.3.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.3/6.3.1/submodules/qttranslations-everywhere-src-6.3.1.tar.xz";
-      sha256 = "15yvvxw1vngnjlly6cady05ljamg01qiaqn2vh0xkph855gdbgfp";
-      name = "qttranslations-everywhere-src-6.3.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.3/6.3.2/submodules/qttranslations-everywhere-src-6.3.2.tar.xz";
+      sha256 = "1h66n9cx4g65c9wrgp32h9gm3r47gyh1nrcn3ivbfbvngfawqxpg";
+      name = "qttranslations-everywhere-src-6.3.2.tar.xz";
     };
   };
   qtvirtualkeyboard = {
-    version = "6.3.1";
+    version = "6.3.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.3/6.3.1/submodules/qtvirtualkeyboard-everywhere-src-6.3.1.tar.xz";
-      sha256 = "1f62q0gkz21nraaspy1nrg2ygjih5qgq37qns06snnfq0jr8kq2z";
-      name = "qtvirtualkeyboard-everywhere-src-6.3.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.3/6.3.2/submodules/qtvirtualkeyboard-everywhere-src-6.3.2.tar.xz";
+      sha256 = "0czxh6wc1qgxns1qm6zcnck6i0nzaz3bzi3725qdw98738lyhvml";
+      name = "qtvirtualkeyboard-everywhere-src-6.3.2.tar.xz";
     };
   };
   qtwayland = {
-    version = "6.3.1";
+    version = "6.3.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.3/6.3.1/submodules/qtwayland-everywhere-src-6.3.1.tar.xz";
-      sha256 = "1w60p1did7awdlzq5k8vnq2ncpskb07cpvz31cbv99bjs6igw53g";
-      name = "qtwayland-everywhere-src-6.3.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.3/6.3.2/submodules/qtwayland-everywhere-src-6.3.2.tar.xz";
+      sha256 = "0rwiirkibgpvx05pg2842j4dcq9ckxmcqxhaf50xx2i55z64ll83";
+      name = "qtwayland-everywhere-src-6.3.2.tar.xz";
     };
   };
   qtwebchannel = {
-    version = "6.3.1";
+    version = "6.3.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.3/6.3.1/submodules/qtwebchannel-everywhere-src-6.3.1.tar.xz";
-      sha256 = "0s16zx3qn3byldvhmsnwijm8rmizk8vpqj7fnwhjg6c67z10m8ma";
-      name = "qtwebchannel-everywhere-src-6.3.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.3/6.3.2/submodules/qtwebchannel-everywhere-src-6.3.2.tar.xz";
+      sha256 = "0gqm09yqdq27kgb02idx5ycj14k5mjhh10ddp9jfs8lblimlgfni";
+      name = "qtwebchannel-everywhere-src-6.3.2.tar.xz";
     };
   };
   qtwebengine = {
-    version = "6.3.1";
+    version = "6.3.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.3/6.3.1/submodules/qtwebengine-everywhere-src-6.3.1.tar.xz";
-      sha256 = "0ivfsqd5c0cxsnssj6z37901cf6a47w50zaqgjiysvcm3ar36ymd";
-      name = "qtwebengine-everywhere-src-6.3.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.3/6.3.2/submodules/qtwebengine-everywhere-src-6.3.2.tar.xz";
+      sha256 = "09j4w9ax8242d1yx3hmic7jcwidwdrn8sp7k89hj4l0n8mzkkd35";
+      name = "qtwebengine-everywhere-src-6.3.2.tar.xz";
     };
   };
   qtwebsockets = {
-    version = "6.3.1";
+    version = "6.3.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.3/6.3.1/submodules/qtwebsockets-everywhere-src-6.3.1.tar.xz";
-      sha256 = "06hj0pkdzjicmbiinjp1dk1ziz8cb3fgcwy7a0dxxjvzr680v64z";
-      name = "qtwebsockets-everywhere-src-6.3.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.3/6.3.2/submodules/qtwebsockets-everywhere-src-6.3.2.tar.xz";
+      sha256 = "1smbvidaybphvsmaap9v1pbkibwmng11hb925g0ww4ghwzpxkb8q";
+      name = "qtwebsockets-everywhere-src-6.3.2.tar.xz";
     };
   };
   qtwebview = {
-    version = "6.3.1";
+    version = "6.3.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.3/6.3.1/submodules/qtwebview-everywhere-src-6.3.1.tar.xz";
-      sha256 = "0f4hx3rqwg5wqnw37nrhcvi2fxshgfx72xmdc416j4gxhra1i6xl";
-      name = "qtwebview-everywhere-src-6.3.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.3/6.3.2/submodules/qtwebview-everywhere-src-6.3.2.tar.xz";
+      sha256 = "06v69xl0fnbv4i1xbjaw7338iqyvim8d3q91qrrg7r2nqzjhiav7";
+      name = "qtwebview-everywhere-src-6.3.2.tar.xz";
     };
   };
 }
diff --git a/pkgs/development/libraries/science/math/latte-integrale/default.nix b/pkgs/development/libraries/science/math/latte-integrale/default.nix
new file mode 100644
index 00000000000..7eb485974ff
--- /dev/null
+++ b/pkgs/development/libraries/science/math/latte-integrale/default.nix
@@ -0,0 +1,41 @@
+{ lib
+, stdenv
+, fetchurl
+, fetchpatch
+, gmp
+, ntl
+, cddlib
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "latte-integrale";
+  version = "1.7.6";
+
+  src = fetchurl {
+    url = "https://github.com/latte-int/latte/releases/download/version_${lib.replaceStrings ["."] ["_"] finalAttrs.version}/latte-int-${finalAttrs.version}.tar.gz";
+    sha256 = "sha256-AGwQ6+XVv9ybFZy6YmSkQyhh/nY84F/oIWJKt9P8IXA=";
+  };
+
+  patches = [
+    # C++17 compat
+    (fetchpatch {
+      url = "https://github.com/latte-int/latte/commit/6dbf7f07d5c9e1f3afe793f782d191d4465088ae.patch";
+      excludes = [ "code/latte/sqlite/IntegrationDB.h" ];
+      sha256 = "sha256-i7c11y54OLuJ0m7PBnhEoAzJzxC842JU7A6TOtTz06k=";
+    })
+  ];
+
+  buildInputs = [
+    gmp
+    ntl
+    cddlib
+  ];
+
+  meta = {
+    description = "Software for counting lattice points and integration over convex polytopes";
+    homepage = "https://www.math.ucdavis.edu/~latte/";
+    license = lib.licenses.gpl2;
+    maintainers = with lib.maintainers; [ amesgen ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/development/libraries/scope-lite/default.nix b/pkgs/development/libraries/scope-lite/default.nix
new file mode 100644
index 00000000000..40cad6a5fc3
--- /dev/null
+++ b/pkgs/development/libraries/scope-lite/default.nix
@@ -0,0 +1,22 @@
+{ stdenv, cmake, fetchFromGitHub, lib }: let
+  version = "0.2.0";
+in stdenv.mkDerivation {
+  name = "scope-lite-${version}";
+
+  src = fetchFromGitHub {
+    owner = "martinmoene";
+    repo = "scope-lite";
+    rev = "v${version}";
+    hash = "sha256-/Vu3blgyEOQRFqhQjuT/6ukV0iWA0TdPrLnt2Z/gd6E=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  meta = {
+    description = "A migration path to C++ library extensions scope_exit, scope_fail, scope_success, unique_resource";
+    license = lib.licenses.boost;
+    maintainers = [ lib.maintainers.shlevy ];
+    homepage = "https://github.com/martinmoene/scope-lite";
+    platforms = lib.platforms.all;
+  };
+}
diff --git a/pkgs/development/libraries/stduuid/default.nix b/pkgs/development/libraries/stduuid/default.nix
new file mode 100644
index 00000000000..07e43bb952c
--- /dev/null
+++ b/pkgs/development/libraries/stduuid/default.nix
@@ -0,0 +1,22 @@
+{ stdenv, cmake, fetchFromGitHub, lib }: let
+  version = "1.2.2";
+in stdenv.mkDerivation {
+  name = "stduuid-${version}";
+
+  src = fetchFromGitHub {
+    owner = "mariusbancila";
+    repo = "stduuid";
+    rev = "v${version}";
+    hash = "sha256-itx1OF1gmEEMy2tJlkN5dpF6o0dlesecuHYfpJdhf7c=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  meta = {
+    description = "A C++17 cross-platform implementation for UUIDs";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.shlevy ];
+    homepage = "https://github.com/mariusbancila/stduuid";
+    platforms = lib.platforms.all;
+  };
+}
diff --git a/pkgs/development/libraries/vid-stab/default.nix b/pkgs/development/libraries/vid-stab/default.nix
index d224c2f3be5..a1eb5cf53e5 100644
--- a/pkgs/development/libraries/vid-stab/default.nix
+++ b/pkgs/development/libraries/vid-stab/default.nix
@@ -2,18 +2,18 @@
 
 stdenv.mkDerivation rec {
   pname = "vid.stab";
-  version = "1.1.0";
+  version = "unstable-2022-05-30";
 
   src = fetchFromGitHub {
     owner = "georgmartius";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "0a3frpm2kdbx7vszhg64p3alisag73bcspl7fp3a2f1kgq7rbh38";
+    rev = "90c76aca2cb06c3ff6f7476a7cd6851b39436656";
+    sha256 = "sha256-p1VRnkBeUpET3O2FmaJMyN5/EoSOQLdmRIVbzZcQaKY=";
   };
 
   nativeBuildInputs = [ cmake ];
 
-  buildInputs = lib.optionals stdenv.cc.isClang [ openmp ];
+  propagatedBuildInputs = lib.optionals stdenv.cc.isClang [ openmp ];
 
   meta = with lib; {
     description = "Video stabilization library";
diff --git a/pkgs/development/misc/resholve/resholve-utils.nix b/pkgs/development/misc/resholve/resholve-utils.nix
index 132f280a80e..26bf492d23a 100644
--- a/pkgs/development/misc/resholve/resholve-utils.nix
+++ b/pkgs/development/misc/resholve/resholve-utils.nix
@@ -185,6 +185,8 @@ rec {
       # retain a reference to the base
       passthru = unresholved.passthru // {
         unresholved = unresholved;
+        # fallback attr for update bot to query our src
+        originalSrc = unresholved.src;
       };
 
       # do these imply that we should use NoCC or something?
diff --git a/pkgs/development/python-modules/aiosmtplib/default.nix b/pkgs/development/python-modules/aiosmtplib/default.nix
index a3a2e8295a0..d54718d77ef 100644
--- a/pkgs/development/python-modules/aiosmtplib/default.nix
+++ b/pkgs/development/python-modules/aiosmtplib/default.nix
@@ -2,7 +2,6 @@
 , aiosmtpd
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
 , hypothesis
 , poetry-core
 , pytest-asyncio
@@ -12,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "aiosmtplib";
-  version = "1.1.6";
+  version = "1.1.7";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +20,7 @@ buildPythonPackage rec {
     owner = "cole";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-bo+u3I+ZX95UYkEam2TB6d6rvbYKa5Qu/9oNX5le478=";
+    hash = "sha256-ZVNYMVg2qeMoSojmPllvJLv2Xm5IYN9h5N13oHPFXSk=";
   };
 
   nativeBuildInputs = [
@@ -35,15 +34,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  patches = [
-    # Switch to poetry-core, https://github.com/cole/aiosmtplib/pull/183
-    (fetchpatch {
-      name = "switch-to-poetry-core.patch";
-      url = "https://github.com/cole/aiosmtplib/commit/3aba1c132d9454e05d4281f4c8aa618b4e1b783d.patch";
-      hash = "sha256-KlA46gD6swfJ/3OLO3xWZWa66Gx1/izmUMQ60PQy0po=";
-    })
-  ];
-
   pythonImportsCheck = [
     "aiosmtplib"
   ];
diff --git a/pkgs/development/python-modules/aioswitcher/default.nix b/pkgs/development/python-modules/aioswitcher/default.nix
index 5c88d8f8591..d5b1aa4287b 100644
--- a/pkgs/development/python-modules/aioswitcher/default.nix
+++ b/pkgs/development/python-modules/aioswitcher/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "aioswitcher";
-  version = "2.0.10";
+  version = "3.0.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "TomerFi";
     repo = pname;
     rev = "refs/tags/${version}";
-    sha256 = "sha256-Me0BvmCfj9bA7TXUHXLYe9a+d7nFnm7RpNVGtAzkBZM=";
+    sha256 = "sha256-zJS09YQRMv3B0daW0cgBRPoLQkPyGuBgMohf6E2yqaM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix b/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
index 47f667a4688..ac820337af0 100644
--- a/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
+++ b/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "appthreat-vulnerability-db";
-  version = "2.0.5";
+  version = "2.0.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "AppThreat";
     repo = "vulnerability-db";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-ThUkDCoRKefAqTmOxCk9W9LZlCqUU+jxF0egjthH4JI=";
+    sha256 = "sha256-tmvt5jqgfKxCW+/XvmSu7bTsT1Qk902c1qfR4IK66vg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/asysocks/default.nix b/pkgs/development/python-modules/asysocks/default.nix
index 55cc6619e63..e4f5f8758b1 100644
--- a/pkgs/development/python-modules/asysocks/default.nix
+++ b/pkgs/development/python-modules/asysocks/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "asysocks";
-  version = "0.2.1";
+  version = "0.2.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-j0UWCI6+x/CNjFSeXnXnqGtB5gQ6+SC6SJXPP2xlQVA=";
+    sha256 = "sha256-rhqML/w8Hp8xZogjc2ZD+Y9C9c/w1e4X7WNoFaLz9Ps=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/atlassian-python-api/default.nix b/pkgs/development/python-modules/atlassian-python-api/default.nix
index 31395ad7882..a0c00626162 100755
--- a/pkgs/development/python-modules/atlassian-python-api/default.nix
+++ b/pkgs/development/python-modules/atlassian-python-api/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "atlassian-python-api";
-  version = "3.28.0";
+  version = "3.28.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "atlassian-api";
     repo = pname;
     rev = "refs/tags/${version}";
-    sha256 = "sha256-a0c/IOy14Pq8IEUKNyOh0/Z/ERGfeeI5aXFL/WpLUxE=";
+    sha256 = "sha256-ZKRmjfH3s35DU1Mut63YuN6opKzg2gpyunWYjg/FbHA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/chess/default.nix b/pkgs/development/python-modules/chess/default.nix
index e4f9c7bfb02..eed651ee3ad 100644
--- a/pkgs/development/python-modules/chess/default.nix
+++ b/pkgs/development/python-modules/chess/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "chess";
-  version = "1.9.2";
+  version = "1.9.3";
 
   disabled = pythonOlder "3.7";
 
@@ -15,7 +15,7 @@ buildPythonPackage rec {
     owner = "niklasf";
     repo = "python-${pname}";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-RGAEkeE6YAik//yZt9mJdrFj4z0yxlHjZPLUaHd9yUQ=";
+    sha256 = "sha256-Qm6CNtie+oqZRCAs8qp8ythfs+OQvLZFK9YVLOuf918=";
   };
 
   pythonImportsCheck = [ "chess" ];
diff --git a/pkgs/development/python-modules/cyclonedx-python-lib/default.nix b/pkgs/development/python-modules/cyclonedx-python-lib/default.nix
index 731aef1c647..7704e7b8d5a 100644
--- a/pkgs/development/python-modules/cyclonedx-python-lib/default.nix
+++ b/pkgs/development/python-modules/cyclonedx-python-lib/default.nix
@@ -6,6 +6,7 @@
 , lxml
 , packageurl-python
 , poetry-core
+, pytestCheckHook
 , python
 , pythonOlder
 , requirements-parser
@@ -14,7 +15,6 @@
 , toml
 , types-setuptools
 , types-toml
-, unittestCheckHook
 , xmldiff
 }:
 
@@ -48,7 +48,7 @@ buildPythonPackage rec {
   ];
 
   checkInputs = [
-    unittestCheckHook
+    pytestCheckHook
     jsonschema
     lxml
     xmldiff
@@ -59,9 +59,17 @@ buildPythonPackage rec {
   ];
 
   preCheck = ''
-    rm tests/test_output_json.py
+    export PYTHONPATH=tests''${PYTHONPATH+:$PYTHONPATH}
   '';
 
+  pytestFlagsArray = [ "tests/" ];
+
+  disabledTests = [
+    # These tests require network access.
+    "test_bom_v1_3_with_metadata_component"
+    "test_bom_v1_4_with_metadata_component"
+  ];
+
   meta = with lib; {
     description = "Python library for generating CycloneDX SBOMs";
     homepage = "https://github.com/CycloneDX/cyclonedx-python-lib";
diff --git a/pkgs/development/python-modules/dbus-python-client-gen/default.nix b/pkgs/development/python-modules/dbus-python-client-gen/default.nix
index 100144c152e..02b973d145c 100644
--- a/pkgs/development/python-modules/dbus-python-client-gen/default.nix
+++ b/pkgs/development/python-modules/dbus-python-client-gen/default.nix
@@ -21,10 +21,13 @@ buildPythonPackage rec {
     into-dbus-python
     dbus-python
   ];
+
   checkInputs = [
     pytestCheckHook
   ];
 
+  pythonImportsCheck = [ "dbus_python_client_gen" ];
+
   meta = with lib; {
     description = "A Python library for generating dbus-python client code";
     homepage = "https://github.com/stratis-storage/dbus-python-client-gen";
diff --git a/pkgs/development/python-modules/dbus-signature-pyparsing/default.nix b/pkgs/development/python-modules/dbus-signature-pyparsing/default.nix
index 659fcc3ed59..8b0eb3f3cf9 100644
--- a/pkgs/development/python-modules/dbus-signature-pyparsing/default.nix
+++ b/pkgs/development/python-modules/dbus-signature-pyparsing/default.nix
@@ -25,6 +25,8 @@ buildPythonPackage rec {
     hs-dbus-signature
   ];
 
+  pythonImportsCheck = [ "dbus_signature_pyparsing" ];
+
   meta = with lib; {
     description = "A Parser for a D-Bus Signature";
     homepage = "https://github.com/stratis-storage/dbus-signature-pyparsing";
diff --git a/pkgs/development/python-modules/fastcore/default.nix b/pkgs/development/python-modules/fastcore/default.nix
index c8a6c42077f..1fd3af291fe 100644
--- a/pkgs/development/python-modules/fastcore/default.nix
+++ b/pkgs/development/python-modules/fastcore/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "fastcore";
-  version = "1.5.26";
+  version = "1.5.27";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "fastai";
     repo = pname;
     rev = "refs/tags/${version}";
-    sha256 = "sha256-WA6EgdyZ6zQGCzeQsHUD304WMCarjhGEpqXXBhBsxNw=";
+    sha256 = "sha256-LFkjxcotJoHIX0GdKKqUSFF4/HSWc/sLwb34iuBrQIg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/furo/default.nix b/pkgs/development/python-modules/furo/default.nix
index cd97c2b5697..e8797e8ab4d 100644
--- a/pkgs/development/python-modules/furo/default.nix
+++ b/pkgs/development/python-modules/furo/default.nix
@@ -9,15 +9,16 @@
 
 buildPythonPackage rec {
   pname = "furo";
-  version = "2022.6.21";
+  version = "2022.9.15";
   format = "wheel";
-  disable = pythonOlder "3.6";
+
+  disable = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version format;
     dist = "py3";
     python = "py3";
-    sha256 = "sha256-Bhto4yM0Xif8ugJM8zoed/Pf2NmYdBC+gidJpwbirdY=";
+    hash = "sha256-kSnerR916ftPpAdhLx1aDQMgdn5hVsklqv4282L5sRo=";
   };
 
   propagatedBuildInputs = [
@@ -37,7 +38,9 @@ buildPythonPackage rec {
     cd -
   '';
 
-  pythonImportsCheck = [ "furo" ];
+  pythonImportsCheck = [
+    "furo"
+  ];
 
   meta = with lib; {
     description = "A clean customizable documentation theme for Sphinx";
diff --git a/pkgs/development/python-modules/hs-dbus-signature/default.nix b/pkgs/development/python-modules/hs-dbus-signature/default.nix
index 7d071b75c3b..657a1d8b24a 100644
--- a/pkgs/development/python-modules/hs-dbus-signature/default.nix
+++ b/pkgs/development/python-modules/hs-dbus-signature/default.nix
@@ -19,6 +19,8 @@ buildPythonPackage rec {
     hypothesis
   ];
 
+  pythonImportsCheck = [ "hs_dbus_signature" ];
+
   meta = with lib; {
     description = "A Hypothesis Strategy for Generating Arbitrary DBus Signatures";
     homepage = "https://github.com/stratis-storage/hs-dbus-signature";
diff --git a/pkgs/development/python-modules/httptools/default.nix b/pkgs/development/python-modules/httptools/default.nix
index 963a9ff5ebf..67c284abc3c 100644
--- a/pkgs/development/python-modules/httptools/default.nix
+++ b/pkgs/development/python-modules/httptools/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "httptools";
-  version = "0.4.0";
+  version = "0.5.0";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-LJqTDDeLPRXWtpX7levP+BpzlbT5d1xPEKB2vrCywf8=";
+    sha256 = "sha256-KVh0hhwXP5EBlgu6MyQpu3ftTc2M31zumSLrAOT2vAk=";
   };
 
   # tests are not included in pypi tarball
diff --git a/pkgs/development/python-modules/immutables/default.nix b/pkgs/development/python-modules/immutables/default.nix
index 34a48ed2a1f..30646e28ca9 100644
--- a/pkgs/development/python-modules/immutables/default.nix
+++ b/pkgs/development/python-modules/immutables/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "immutables";
-  version = "0.18";
+  version = "0.19";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -17,8 +17,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "MagicStack";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-lXCoPTcpTOv9K0xCVjbrP3qlzP9tfk/e3Rk3oOmbS/Y=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-yW+pmAryBp6bvjolN91ACDkk5zxvKfu4nRLQSy71kqs=";
   };
 
   propagatedBuildInputs = lib.optionals (pythonOlder "3.8") [
diff --git a/pkgs/development/python-modules/into-dbus-python/default.nix b/pkgs/development/python-modules/into-dbus-python/default.nix
index 1d893cd6969..5ef92cf216a 100644
--- a/pkgs/development/python-modules/into-dbus-python/default.nix
+++ b/pkgs/development/python-modules/into-dbus-python/default.nix
@@ -23,12 +23,15 @@ buildPythonPackage rec {
     dbus-signature-pyparsing
     dbus-python
   ];
+
   checkInputs = [
     pytestCheckHook
     hypothesis
     hs-dbus-signature
   ];
 
+  pythonImportsCheck = [ "into_dbus_python" ];
+
   meta = with lib; {
     description = "A transformer to dbus-python types";
     homepage = "https://github.com/stratis-storage/into-dbus-python";
diff --git a/pkgs/development/python-modules/json-stream/default.nix b/pkgs/development/python-modules/json-stream/default.nix
index e6a8a68ddb9..15f6724af79 100644
--- a/pkgs/development/python-modules/json-stream/default.nix
+++ b/pkgs/development/python-modules/json-stream/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "json-stream";
-  version = "1.4.0";
+  version = "1.4.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ebB8l8H6yPLoCXmVOy60IijdBI61SEzJInC30aMe9Bk=";
+    hash = "sha256-zsjKOqkXy3Je7z8U4M016a4t2cWdUqL2tf27Dc8a/gw=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/jwcrypto/default.nix b/pkgs/development/python-modules/jwcrypto/default.nix
index ce035c1c64e..3ff7cb5f039 100644
--- a/pkgs/development/python-modules/jwcrypto/default.nix
+++ b/pkgs/development/python-modules/jwcrypto/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "jwcrypto";
-  version = "1.3.1";
+  version = "1.4.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-VLVRsRX/tNErHx7pO4uipxu4VWuj2F1i9wdUlhPah3w=";
+    hash = "sha256-gKNentGzssQ84D2SxdSObQtmR+KqJhjkljRIkj14o3s=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/korean-lunar-calendar/default.nix b/pkgs/development/python-modules/korean-lunar-calendar/default.nix
index a1b22a727ad..c4a1672dd5e 100644
--- a/pkgs/development/python-modules/korean-lunar-calendar/default.nix
+++ b/pkgs/development/python-modules/korean-lunar-calendar/default.nix
@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "korean-lunar-calendar";
-  version = "0.2.1";
+  version = "0.3.1";
 
   src = fetchPypi {
     inherit version;
     pname = "korean_lunar_calendar";
-    sha256 = "0p97r21298ipgvsqh978aq2n6cvybzp8bskcvj15mm1f76qm9khj";
+    sha256 = "sha256-6yxIUSSgYQFpJr3qbYnv35uf2/FttViVts8eW+wXuFc=";
   };
 
   # no real tests
diff --git a/pkgs/development/python-modules/life360/default.nix b/pkgs/development/python-modules/life360/default.nix
index 372d9b65336..15a0e9891aa 100644
--- a/pkgs/development/python-modules/life360/default.nix
+++ b/pkgs/development/python-modules/life360/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "life360";
-  version = "5.1.0";
+  version = "5.1.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "pnbruckner";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-/daZ/R3qhdPfvdGra0W0rEEXl6Bux5O8oTuEuCkO3bE=";
+    hash = "sha256-Fsv0lK0C9suVqgeaxKVuyAacHzHJJ1FHXzzy95RnhWw=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/motor/default.nix b/pkgs/development/python-modules/motor/default.nix
index 030b22a723e..06a17ffab15 100644
--- a/pkgs/development/python-modules/motor/default.nix
+++ b/pkgs/development/python-modules/motor/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "motor";
-  version = "3.0.0";
+  version = "3.1.0";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "mongodb";
     repo = pname;
     rev = "refs/tags/${version}";
-    sha256 = "sha256-xq3EpTncnMskn3aJdLAtD/kKhn/cS2nrLrVliyh2z28=";
+    sha256 = "sha256-Wc0C4sO33v/frBtZVV2u9ESunHKyJI+eQ59l72h2eFk=";
   };
 
   propagatedBuildInputs = [ pymongo ];
diff --git a/pkgs/development/python-modules/netcdf4/default.nix b/pkgs/development/python-modules/netcdf4/default.nix
index 4908e1eb8ae..f0606f76919 100644
--- a/pkgs/development/python-modules/netcdf4/default.nix
+++ b/pkgs/development/python-modules/netcdf4/default.nix
@@ -3,13 +3,13 @@
 }:
 buildPythonPackage rec {
   pname = "netCDF4";
-  version = "1.6.0";
+  version = "1.6.1";
 
   disabled = isPyPy;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-le+jc9mj4c0N9xk+duZoDZ7KKOYAl8qBOa/qikNGumM=";
+    sha256 = "sha256-uo3F1lKTqZ8a+4wqz1iNkD/f3BljpiVFtnf6JzQmKng=";
   };
 
   checkInputs = [ pytest ];
diff --git a/pkgs/development/python-modules/niaarm/default.nix b/pkgs/development/python-modules/niaarm/default.nix
new file mode 100644
index 00000000000..155fa2c78c0
--- /dev/null
+++ b/pkgs/development/python-modules/niaarm/default.nix
@@ -0,0 +1,50 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, niapy
+, nltk
+, pandas
+, poetry-core
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "NiaARM";
+  version = "0.2.0";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "firefly-cpp";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-tO/9dDgPPL5fkFm/U9AhyydXW+dtem+Q3H2uKPAXzno=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    niapy
+    nltk
+    pandas
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "niaarm"
+  ];
+
+  meta = with lib; {
+    description = "A minimalistic framework for Numerical Association Rule Mining";
+    homepage = "https://github.com/firefly-cpp/NiaARM";
+    license = licenses.mit;
+    maintainers = with maintainers; [ firefly-cpp ];
+  };
+}
diff --git a/pkgs/development/python-modules/pgcli/default.nix b/pkgs/development/python-modules/pgcli/default.nix
index bb369ffdc9d..0e193d4c5c6 100644
--- a/pkgs/development/python-modules/pgcli/default.nix
+++ b/pkgs/development/python-modules/pgcli/default.nix
@@ -1,11 +1,12 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , buildPythonPackage
 , fetchPypi
 , cli-helpers
 , click
 , configobj
 , prompt-toolkit
-, psycopg2
+, psycopg
 , pygments
 , sqlparse
 , pgspecial
@@ -21,24 +22,19 @@
 # integrating with ipython-sql
 buildPythonPackage rec {
   pname = "pgcli";
-  version = "3.4.1";
+  version = "3.5.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-8DkwGH4n1g32WMqKBPtgHsXXR2xzXysVQsat7Fysj+I=";
+    sha256 = "sha256-zESNlRWfwJA9NhgpkneKCW7aV1LWYNR2cTg8jiv2M/E=";
   };
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "pgspecial>=1.13.1,<2.0.0" "pgspecial>=1.13.1"
-  '';
-
   propagatedBuildInputs = [
     cli-helpers
     click
     configobj
     prompt-toolkit
-    psycopg2
+    psycopg
     pygments
     sqlparse
     pgspecial
diff --git a/pkgs/development/python-modules/prometheus-flask-exporter/default.nix b/pkgs/development/python-modules/prometheus-flask-exporter/default.nix
index 7abb9670ac8..09891d0d4bb 100644
--- a/pkgs/development/python-modules/prometheus-flask-exporter/default.nix
+++ b/pkgs/development/python-modules/prometheus-flask-exporter/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "prometheus-flask-exporter";
-  version = "0.18.1";
+  version = "0.20.3";
 
   src = fetchFromGitHub {
     owner = "rycus86";
     repo = "prometheus_flask_exporter";
     rev = version;
-    sha256 = "1dwisp681w0f6zf0000rxd3ksdb48zb9mr38qfdqk2ir24y8w370";
+    sha256 = "sha256-l9Iw9fvXQMXzq1y/4Dml8uLPJWyqX6SDIXptJVw3cVQ=";
   };
 
   propagatedBuildInputs = [ flask prometheus-client ];
diff --git a/pkgs/development/python-modules/pysensibo/default.nix b/pkgs/development/python-modules/pysensibo/default.nix
index 5bdf9979de9..136935b7ae9 100644
--- a/pkgs/development/python-modules/pysensibo/default.nix
+++ b/pkgs/development/python-modules/pysensibo/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "pysensibo";
-  version = "1.0.19";
+  version = "1.0.20";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "andrey-git";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-pqg+NsdbSyXgC+4/AtbI4BZ5h2pMhvvBdQI9lHj6HME=";
+    hash = "sha256-L2NP4XS+dPlBr2h8tsGoa4G7tI9yiI4fwrhvQaKkexk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pytest-httpserver/default.nix b/pkgs/development/python-modules/pytest-httpserver/default.nix
index 4b58c71cc65..cba9a9294e7 100644
--- a/pkgs/development/python-modules/pytest-httpserver/default.nix
+++ b/pkgs/development/python-modules/pytest-httpserver/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage rec {
   pname = "pytest-httpserver";
-  version = "1.0.5";
+  version = "1.0.6";
 
   src = fetchPypi {
     pname = "pytest_httpserver";
     inherit version;
-    sha256 = "sha256-rjKWYm0KEOg1qfQjxhtFQFR9WCQivgVMP8wIYmuqECQ=";
+    sha256 = "sha256-kEDQe/WaxF2N49sdRGj9LR1geXXk2kyHLswEAs2/ez4=";
   };
 
   propagatedBuildInputs = [ werkzeug ];
diff --git a/pkgs/development/python-modules/qingping-ble/default.nix b/pkgs/development/python-modules/qingping-ble/default.nix
index f7d40426d56..ca1aaa8e8c2 100644
--- a/pkgs/development/python-modules/qingping-ble/default.nix
+++ b/pkgs/development/python-modules/qingping-ble/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "qingping-ble";
-  version = "0.6.1";
+  version = "0.7.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "bluetooth-devices";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-0fa5KocDyy3JL7gohbbBghXwbCzbcjK4pVM+zckboHc=";
+    hash = "sha256-DBkwi++gmyd8/hAMSO+Ktsou1FtcbfoY8PR+c43MOXw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/resampy/default.nix b/pkgs/development/python-modules/resampy/default.nix
index f5d59d0fecf..190463f8f25 100644
--- a/pkgs/development/python-modules/resampy/default.nix
+++ b/pkgs/development/python-modules/resampy/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "resampy";
-  version = "0.4.1";
+  version = "0.4.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "bmcfee";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-8qhYhkTtq7DwEvw+B4Ul4SMAPxweTgDIOtebmElkcsg=";
+    hash = "sha256-t5I7NJmIeV0uucPyvR+UJ24NK7fIzYlNJ8bECkbvdjI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/somajo/default.nix b/pkgs/development/python-modules/somajo/default.nix
index a03052c7e42..507e75356be 100644
--- a/pkgs/development/python-modules/somajo/default.nix
+++ b/pkgs/development/python-modules/somajo/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "somajo";
-  version = "2.2.1";
+  version = "2.2.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -16,8 +16,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "tsproisl";
     repo = "SoMaJo";
-    rev = "v${version}";
-    sha256 = "sha256-M0WtONhsqmmK0PBB+Df4YrFpT+vfVidDkt80eBHOo04=";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-rzh+IASqs+uSgUq3BI9UdC4XRsozIGsaOt/LR+VhBxc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/sqlalchemy-continuum/default.nix b/pkgs/development/python-modules/sqlalchemy-continuum/default.nix
index d0970d4277d..a97f3e4ddbd 100644
--- a/pkgs/development/python-modules/sqlalchemy-continuum/default.nix
+++ b/pkgs/development/python-modules/sqlalchemy-continuum/default.nix
@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname = "SQLAlchemy-Continuum";
-  version = "1.3.12";
+  version = "1.3.13";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "rlHl59MAQhsicMtZQT9rv1iQrDyVYJlawtyhvFaAM7o=";
+    sha256 = "sha256-JTqlHQmaVH2qKz7CFyCqpous3ecOpoFrxVlzasbc21I=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/tilt-ble/default.nix b/pkgs/development/python-modules/tilt-ble/default.nix
index e7fd0e0368b..a663ba8429a 100644
--- a/pkgs/development/python-modules/tilt-ble/default.nix
+++ b/pkgs/development/python-modules/tilt-ble/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "tilt-ble";
-  version = "0.2.2";
+  version = "0.2.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-inr2cPl627w2klSqScMg3dvofIkX3hGb44+Go6ah/6I=";
+    hash = "sha256-PR+BA0wUljUeUYCTRMKxkG+kj6PfklksbO/k9L7sWdE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/zodbpickle/default.nix b/pkgs/development/python-modules/zodbpickle/default.nix
index de1f8dfd3aa..ae9e15ecb80 100644
--- a/pkgs/development/python-modules/zodbpickle/default.nix
+++ b/pkgs/development/python-modules/zodbpickle/default.nix
@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "zodbpickle";
-  version = "2.3";
+  version = "2.4";
   disabled = isPyPy; # https://github.com/zopefoundation/zodbpickle/issues/10
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-5MtccZcF6Lseju5Kok4gcaMJTs8ng9h0B6uCLxZto6I=";
+    sha256 = "sha256-vWzJIPKDO6bTWzvxwyaekhDr/AHs1/F2jCL2OqoHU60=";
   };
 
   # fails..
diff --git a/pkgs/development/r-modules/generic-builder.nix b/pkgs/development/r-modules/generic-builder.nix
index beb669d9893..880fff44ed6 100644
--- a/pkgs/development/r-modules/generic-builder.nix
+++ b/pkgs/development/r-modules/generic-builder.nix
@@ -10,8 +10,6 @@ stdenv.mkDerivation ({
   NIX_CFLAGS_COMPILE =
     lib.optionalString stdenv.isDarwin "-I${lib.getDev libcxx}/include/c++/v1";
 
-  hardeningDisable = lib.optionals (stdenv.isAarch64 && stdenv.isDarwin) [ "stackprotector" ];
-
   configurePhase = ''
     runHook preConfigure
     export R_LIBS_SITE="$R_LIBS_SITE''${R_LIBS_SITE:+:}$out/library"
diff --git a/pkgs/development/tools/analysis/flow/default.nix b/pkgs/development/tools/analysis/flow/default.nix
index 3d86d0294e1..b6107037434 100644
--- a/pkgs/development/tools/analysis/flow/default.nix
+++ b/pkgs/development/tools/analysis/flow/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "flow";
-  version = "0.186.0";
+  version = "0.187.0";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "flow";
     rev = "v${version}";
-    sha256 = "sha256-Bip56IgE+XtNSwUC09ANe9ClSg6vTQO60spt1ijvs68=";
+    sha256 = "sha256-G+Le/LtmO/kdA/0IDcmEoacCLhKg7sSRBxEsYQXAK1w=";
   };
 
   makeFlags = [ "FLOW_RELEASE=1" ];
diff --git a/pkgs/development/tools/analysis/rizin/default.nix b/pkgs/development/tools/analysis/rizin/default.nix
index c74b63404ab..5f14a4017c5 100644
--- a/pkgs/development/tools/analysis/rizin/default.nix
+++ b/pkgs/development/tools/analysis/rizin/default.nix
@@ -18,16 +18,15 @@
 , ninja
 , capstone
 , tree-sitter
-, python3
 }:
 
 stdenv.mkDerivation rec {
   pname = "rizin";
-  version = "0.4.0";
+  version = "0.4.1";
 
   src = fetchurl {
     url = "https://github.com/rizinorg/rizin/releases/download/v${version}/rizin-src-v${version}.tar.xz";
-    sha256 = "sha256-CeuoaE/oE89Cpxa1mobT1lr84BPX6LJ14UXoSdM2a1o=";
+    sha256 = "sha256-Zp2Va5l4IKNuQjzzXUgqqZhJJUuWWM72hERZkS39v7g=";
   };
 
   mesonFlags = [
@@ -41,7 +40,13 @@ stdenv.mkDerivation rec {
     "-Duse_sys_tree_sitter=enabled"
   ];
 
-  nativeBuildInputs = [ pkg-config meson ninja cmake (python3.withPackages (ps: [ ps.setuptools ])) ];
+  nativeBuildInputs = [
+    pkg-config
+    meson
+    meson.python3.pkgs.pyyaml
+    ninja
+    cmake
+  ];
 
   # meson's find_library seems to not use our compiler wrapper if static parameter
   # is either true/false... We work around by also providing LIBRARY_PATH
@@ -53,6 +58,9 @@ stdenv.mkDerivation rec {
       fi
     done
     export LIBRARY_PATH
+  '' + lib.optionalString stdenv.isDarwin ''
+    substituteInPlace binrz/rizin/macos_sign.sh \
+      --replace 'codesign' '# codesign'
   '';
 
   buildInputs = [
@@ -76,6 +84,6 @@ stdenv.mkDerivation rec {
     homepage = "https://rizin.re/";
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [ raskin makefu mic92 ];
-    platforms = with lib.platforms; linux;
+    platforms = with lib.platforms; unix;
   };
 }
diff --git a/pkgs/development/tools/analysis/tflint/default.nix b/pkgs/development/tools/analysis/tflint/default.nix
index 0c2cee6d31d..8f3333f8158 100644
--- a/pkgs/development/tools/analysis/tflint/default.nix
+++ b/pkgs/development/tools/analysis/tflint/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "tflint";
-  version = "0.40.0";
+  version = "0.40.1";
 
   src = fetchFromGitHub {
     owner = "terraform-linters";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-cJGzE+J3JLwH2NWl81kL7AfuYox2kKQvTFdAPUMneFY=";
+    sha256 = "sha256-Z9hkcJxNQnOjgoJ6K4ZklRwxzWZLE/PiKCEISkZqPHs=";
   };
 
-  vendorSha256 = "sha256-+2A/yB7yO8p2Q3ZhMv5TqpkBAu7KHq8PefXsIDM/XUg=";
+  vendorSha256 = "sha256-sOYQs1hhyX3cjvQ3EmVVSc5HWHnrRDO2VVlzIYi4JZI=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/bazel-gazelle/default.nix b/pkgs/development/tools/bazel-gazelle/default.nix
index 1c57aff18a8..6d94b768d09 100644
--- a/pkgs/development/tools/bazel-gazelle/default.nix
+++ b/pkgs/development/tools/bazel-gazelle/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "bazel-gazelle";
-  version = "0.26.0";
+  version = "0.27.0";
 
   src = fetchFromGitHub {
     owner = "bazelbuild";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-f+4XeH282VbasY6ShSNLsesn1OR8wb6kePU808UQWpw=";
+    sha256 = "sha256-V3XNh2Npxt941wvLICMGmEBsji/TNoDkWBC27EjLsKY=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/development/tools/build-managers/mage/default.nix b/pkgs/development/tools/build-managers/mage/default.nix
index 77141a69beb..d9664922867 100644
--- a/pkgs/development/tools/build-managers/mage/default.nix
+++ b/pkgs/development/tools/build-managers/mage/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "mage";
-  version = "1.13.0";
+  version = "1.14.0";
 
   src = fetchFromGitHub {
     owner = "magefile";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-+OhmV5+XNhJVCVYNKc6M5bNB4gyb/SV6bEohaZJXtLk=";
+    sha256 = "sha256-77RjA5gncKE3fhejlmA+Vkhud4nyaRZW84I3cYTk0Js=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/development/tools/build-managers/meson/default.nix b/pkgs/development/tools/build-managers/meson/default.nix
index 866fa303148..5107438fe91 100644
--- a/pkgs/development/tools/build-managers/meson/default.nix
+++ b/pkgs/development/tools/build-managers/meson/default.nix
@@ -103,6 +103,10 @@ python3.pkgs.buildPythonApplication rec {
     installShellCompletion --bash data/shell-completions/bash/meson
   '';
 
+  passthru = {
+    inherit python3;
+  };
+
   meta = with lib; {
     homepage = "https://mesonbuild.com";
     description = "An open source, fast and friendly build system made in Python";
diff --git a/pkgs/development/tools/circup/default.nix b/pkgs/development/tools/circup/default.nix
index 72874edd0c1..ccb7ef454aa 100644
--- a/pkgs/development/tools/circup/default.nix
+++ b/pkgs/development/tools/circup/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "circup";
-  version = "1.1.2";
+  version = "1.1.3";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "adafruit";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-zrpld0yexzoXJx4qqDPEMf58SN67SGoP3umNqqsFJgw=";
+    hash = "sha256-BCAsCwQCKMtmjISMVKDblRdev87K4EfX5D2Ot0L5PoQ=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/tools/cosmoc/default.nix b/pkgs/development/tools/cosmoc/default.nix
index f1e80d91df5..e64cf02e9f7 100644
--- a/pkgs/development/tools/cosmoc/default.nix
+++ b/pkgs/development/tools/cosmoc/default.nix
@@ -8,18 +8,19 @@ stdenv.mkDerivation {
   dontUnpack = true;
   dontBuild = true;
 
+  # compiler arguments based on upstream README.md
   installPhase = ''
     runHook preInstall
     mkdir -p $out/bin
     cat <<EOF >$out/bin/cosmoc
     #!${stdenv.shell}
     exec ${stdenv.cc}/bin/${stdenv.cc.targetPrefix}gcc \
-      -O -static -nostdlib -nostdinc -fno-pie -no-pie -mno-red-zone \
+      -Os -static -nostdlib -nostdinc -fno-pie -no-pie -mno-red-zone \
+      -fno-omit-frame-pointer -pg -mnop-mcount -mno-tls-direct-seg-refs \
       "\$@" \
-      -Wl,--gc-sections -Wl,-z,max-page-size=0x1000 \
-      -fuse-ld=bfd -Wl,-T,${cosmopolitan}/lib/ape.lds \
+      -fuse-ld=bfd -Wl,-T,${cosmopolitan}/lib/ape.lds -Wl,--gc-sections \
       -include ${cosmopolitan}/include/cosmopolitan.h \
-      ${cosmopolitan}/lib/{crt.o,ape.o,cosmopolitan.a}
+      ${cosmopolitan}/lib/{crt.o,ape-no-modify-self.o,cosmopolitan.a}
     EOF
     chmod +x $out/bin/cosmoc
     runHook postInstall
diff --git a/pkgs/development/tools/cpm/default.nix b/pkgs/development/tools/cpm/default.nix
index 37dc222707b..4221b688d53 100644
--- a/pkgs/development/tools/cpm/default.nix
+++ b/pkgs/development/tools/cpm/default.nix
@@ -5,11 +5,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "cpm";
-  version = "0.35.5";
+  version = "0.35.6";
 
   src = fetchurl {
     url = "https://github.com/cpm-cmake/CPM.cmake/releases/download/v${version}/CPM.cmake";
-    sha256 = "sha256-JWfIptbRExSQQvcxx2bS1k5cudPpQPdyj90aZdbcROk=";
+    sha256 = "sha256-a0fiqUtpxZrNpVZ0Aa/GesU+mpW/kM/U8el5LE2OyBU=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/development/tools/ctlptl/default.nix b/pkgs/development/tools/ctlptl/default.nix
index 4b0aa6b6bbc..972c4071679 100644
--- a/pkgs/development/tools/ctlptl/default.nix
+++ b/pkgs/development/tools/ctlptl/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "ctlptl";
-  version = "0.8.7";
+  version = "0.8.8";
 
   src = fetchFromGitHub {
     owner = "tilt-dev";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-cSgsEjOnaFUuf9Vf6UOCC7LsmVg47wEQKU0LxpngLYc=";
+    sha256 = "sha256-OuLA8Yq0ihvj4wCQxQ/GqN85KW8Cj5eTWN+UZ52T0DU=";
   };
 
   vendorSha256 = "sha256-M9B/rfMBjYJb9szmYPVZqURlcv62qHOLJ3ka0v++z0s=";
diff --git a/pkgs/development/tools/datree/default.nix b/pkgs/development/tools/datree/default.nix
index 9aaa787b3c2..85d530f9251 100644
--- a/pkgs/development/tools/datree/default.nix
+++ b/pkgs/development/tools/datree/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "datree";
-  version = "1.6.19";
+  version = "1.6.29";
 
   src = fetchFromGitHub {
     owner = "datreeio";
     repo = "datree";
     rev = version;
-    hash = "sha256-cR01/IzbrD2ergJUH3XSKTGLcDuzXuOoKEvnwD2K6hs=";
+    hash = "sha256-RFm7I9HTI3M0fdGOz4ZXHtQY4Pm86SOz9pcIQLqb7/U=";
   };
 
   vendorSha256 = "sha256-mEtnZO4AZEcnEHuiAWguT8VelD0yLj1rytl6gPkPKBg=";
diff --git a/pkgs/development/tools/flyway/default.nix b/pkgs/development/tools/flyway/default.nix
index 0208235de3a..fa4d9c94489 100644
--- a/pkgs/development/tools/flyway/default.nix
+++ b/pkgs/development/tools/flyway/default.nix
@@ -1,10 +1,10 @@
 { lib, stdenv, fetchurl, jre_headless, makeWrapper }:
 stdenv.mkDerivation rec{
   pname = "flyway";
-  version = "9.2.2";
+  version = "9.3.0";
   src = fetchurl {
     url = "mirror://maven/org/flywaydb/flyway-commandline/${version}/flyway-commandline-${version}.tar.gz";
-    sha256 = "sha256-aHsBey1WzmRhcrCeHeAeVuEvX4iaxbIb/C7N6tCOyuY=";
+    sha256 = "sha256-OnJu6gMznpzArm6KRf9ggnY+287tvrdddf9OvE5R9a8=";
   };
   nativeBuildInputs = [ makeWrapper ];
   dontBuild = true;
diff --git a/pkgs/development/tools/goda/default.nix b/pkgs/development/tools/goda/default.nix
index 43f78aa7069..0127773befe 100644
--- a/pkgs/development/tools/goda/default.nix
+++ b/pkgs/development/tools/goda/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "goda";
-  version = "0.5.1";
+  version = "0.5.2";
 
   src = fetchFromGitHub {
     owner = "loov";
     repo = "goda";
     rev = "v${version}";
-    sha256 = "sha256-tXXUDeqGjv6T2eI/VJ+kwPKJLT7D1nO9BaKN5FHS34I=";
+    sha256 = "sha256-gXpO0DvxghyJIIxjE/KGjF/uRQ5W3p5QhqtmzeDmAfA=";
   };
 
   vendorSha256 = "sha256-OyQEw6mRrRneo3T8wns0doU4lxJYEoilTd30xctLBJ4=";
diff --git a/pkgs/development/tools/kube-linter/default.nix b/pkgs/development/tools/kube-linter/default.nix
index 7a8a6be85cd..b96e618da23 100644
--- a/pkgs/development/tools/kube-linter/default.nix
+++ b/pkgs/development/tools/kube-linter/default.nix
@@ -34,6 +34,7 @@ buildGoModule rec {
   meta = with lib; {
     description = "A static analysis tool that checks Kubernetes YAML files and Helm charts";
     homepage = "https://kubelinter.io";
+    changelog   = "https://github.com/stackrox/kube-linter/releases/tag/${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ mtesseract stehessel ];
     platforms = platforms.all;
diff --git a/pkgs/development/tools/misc/circleci-cli/default.nix b/pkgs/development/tools/misc/circleci-cli/default.nix
index 81ad37d9391..4df111b7a8b 100644
--- a/pkgs/development/tools/misc/circleci-cli/default.nix
+++ b/pkgs/development/tools/misc/circleci-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "circleci-cli";
-  version = "0.1.21041";
+  version = "0.1.21091";
 
   src = fetchFromGitHub {
     owner = "CircleCI-Public";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-dc1dFJJ5mBolnzSYbTqUsoex1MfyYOXlv07OvIgtvSQ=";
+    sha256 = "sha256-k8NeqGlhxYLZ4KAuX7eyCi5dIjYIx2z8Xb2JJb2H5Y0=";
   };
 
   vendorSha256 = "sha256-jrAd1G/NCjXfaJmzOhMjMZfJoGHsQ1bi3HudBM0e8rE=";
diff --git a/pkgs/development/tools/oh-my-posh/default.nix b/pkgs/development/tools/oh-my-posh/default.nix
index e65566a6653..d7730945c0e 100644
--- a/pkgs/development/tools/oh-my-posh/default.nix
+++ b/pkgs/development/tools/oh-my-posh/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "oh-my-posh";
-  version = "9.3.0";
+  version = "9.3.1";
 
   src = fetchFromGitHub {
     owner = "jandedobbeleer";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-5VI7L6aGJcaqcNK0bNGv5Hb0YQxTfLFDcMmiWKTyzWA=";
+    sha256 = "sha256-dVHf6nm7IRMpZ8Tx4VxRfBb8HOEfWc/5LgWZQ5LDbuk=";
   };
 
   vendorSha256 = "sha256-A4+sshIzPla7udHfnMmbFqn+fW3SOCrI6g7tArzmh1E=";
diff --git a/pkgs/development/tools/okteto/default.nix b/pkgs/development/tools/okteto/default.nix
index 09328251711..efd8a077855 100644
--- a/pkgs/development/tools/okteto/default.nix
+++ b/pkgs/development/tools/okteto/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "okteto";
-  version = "2.6.0";
+  version = "2.7.0";
 
   src = fetchFromGitHub {
     owner = "okteto";
     repo = "okteto";
     rev = version;
-    sha256 = "sha256-leJvrbtKTtHins46YbPm7kTpcFTC5l2idOXEz+oPeZE=";
+    sha256 = "sha256-xAK2gxIMyiC3GEd4As5FrGQqa4f+FiQLZZs4VROSpgQ=";
   };
 
   vendorSha256 = "sha256-Na0t9uxmA7lIRTRp6I+eDHjUbo7YQzbMQfqDZd6T62k=";
diff --git a/pkgs/development/tools/pqrs/default.nix b/pkgs/development/tools/pqrs/default.nix
index 6753446e4f4..20ec174015b 100644
--- a/pkgs/development/tools/pqrs/default.nix
+++ b/pkgs/development/tools/pqrs/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "pqrs";
-  version = "0.2.1";
+  version = "0.2.2";
 
   src = fetchFromGitHub {
     owner = "manojkarthick";
     repo = "pqrs";
     rev = "v${version}";
-    sha256 = "sha256-/PNGqveN4BSkURFVUpNgHDcPtz9vFhzdY8UK00AMaks=";
+    sha256 = "sha256-fqxPQUcd8DG+UYJRWLDJ9RpRkCWutEXjc6J+w1qv8PQ=";
   };
 
-  cargoSha256 = "sha256-3mrNS0zNgsG7mX3RileFLi5iw3SrlEQC96FSANjpKT8=";
+  cargoSha256 = "sha256-/nfVu8eiQ8JAAUplSyA4eCQqZPCSrcxFzdc2gV95a2w=";
 
   meta = with lib; {
     description = "CLI tool to inspect Parquet files";
diff --git a/pkgs/development/tools/protoc-gen-validate/default.nix b/pkgs/development/tools/protoc-gen-validate/default.nix
index 9a77437a372..c91ce0f3379 100644
--- a/pkgs/development/tools/protoc-gen-validate/default.nix
+++ b/pkgs/development/tools/protoc-gen-validate/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "protoc-gen-validate";
-  version = "0.6.7";
+  version = "0.6.8";
 
   src = fetchFromGitHub {
     owner = "envoyproxy";
     repo = "protoc-gen-validate";
     rev = "v${version}";
-    sha256 = "sha256-ouo6raNbvQyuY4IY1JEN45Ss7zb3EoR/WIRzL7hXLNI=";
+    sha256 = "sha256-s66HfafyiAwr4tvWiPVj7ivWE9C03KTGgI/iu0LgNGk=";
   };
 
-  vendorSha256 = "sha256-HbUEhoB6PPHwN/xym6dTkS54+EqVU1n8EIym8W2wt3I=";
+  vendorSha256 = "sha256-vFi1DT7o2fyzxO/aZHtdsU1/G/sGmamqZPeql0vQVjs=";
 
   excludedPackages = [ "tests" ];
 
diff --git a/pkgs/development/tools/railway/default.nix b/pkgs/development/tools/railway/default.nix
index 202dda25ea2..7e42d4616bb 100644
--- a/pkgs/development/tools/railway/default.nix
+++ b/pkgs/development/tools/railway/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "railway";
-  version = "2.0.10";
+  version = "2.0.11";
 
   src = fetchFromGitHub {
     owner = "railwayapp";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-g/QBsWWVjhmn5slNav7j+vrzwf/0mMAERJaDLRrbxGI=";
+    sha256 = "sha256-A8bfs8GgpsuX3QlJsjUWhgh0zXX0+HULRBQSY+lkXuE=";
   };
 
   ldflags = [ "-s" "-w" ];
diff --git a/pkgs/development/tools/rust/cargo-spellcheck/default.nix b/pkgs/development/tools/rust/cargo-spellcheck/default.nix
index fd97d798c14..585833ef469 100644
--- a/pkgs/development/tools/rust/cargo-spellcheck/default.nix
+++ b/pkgs/development/tools/rust/cargo-spellcheck/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-spellcheck";
-  version = "0.12.1";
+  version = "0.12.2";
 
   src = fetchFromGitHub {
     owner = "drahnr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-PyNO+kBxTYeqXgZh1XhE18G9ZK7suo/acKSE57zCbcY=";
+    sha256 = "sha256-8HZBenv2bL6D8TXzjklEFUAnqk7LkYXjtEwxpTbbzr4=";
   };
 
-  cargoSha256 = "sha256-i6AvKF34Gh3QhwvYVd+QTYCPMW9D0/vhz7WoY5d4kHU=";
+  cargoSha256 = "sha256-zCk+b7jcR7yDpBUVfKXIozQkcsB+73HosdCmZW9abkA=";
 
   buildInputs = lib.optional stdenv.isDarwin Security;
 
diff --git a/pkgs/development/tools/rust/cargo-udeps/default.nix b/pkgs/development/tools/rust/cargo-udeps/default.nix
index d54e46adc5e..bb512e0eeff 100644
--- a/pkgs/development/tools/rust/cargo-udeps/default.nix
+++ b/pkgs/development/tools/rust/cargo-udeps/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-udeps";
-  version = "0.1.32";
+  version = "0.1.33";
 
   src = fetchFromGitHub {
     owner = "est31";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Ev7hLtE5/PqeM39nyWaMyIhFsEZnXbdyU8Q5PET98lQ=";
+    sha256 = "sha256-Fl/4RsWHjWYJ76mD59m9Gcs2hz7bwnd0YWpZnVgMKjg=";
   };
 
-  cargoSha256 = "sha256-3+6hZCYiyG6fgyJpjCcY1dzDK0kwVjsyckPIq/8Zfm0=";
+  cargoSha256 = "sha256-kQwg1R+rvg2Tw27pTkrOi5QpPF3Q1woPsjac9RDYCyg=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/development/tools/selene/default.nix b/pkgs/development/tools/selene/default.nix
index d9a2782f336..235689d97e2 100644
--- a/pkgs/development/tools/selene/default.nix
+++ b/pkgs/development/tools/selene/default.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "selene";
-  version = "0.20.0";
+  version = "0.21.0";
 
   src = fetchFromGitHub {
     owner = "kampfkarren";
     repo = pname;
     rev = version;
-    sha256 = "sha256-ScO2ih+Y8R1OrazSmLlz9QtTUjQ6tIPf5F5juj2nc7Y=";
+    sha256 = "sha256-iqPQD0oDPhhD7jgnbiJvUiaxj1YZeGkgQu6p1vr1Vlw=";
   };
 
-  cargoSha256 = "sha256-pJZrNjgtYjribIKo4DWR47dnyoSuy9sSRPd+ginDlOU=";
+  cargoSha256 = "sha256-gl4vgS/164eYP3MWRBaI3NrmlqbYZUHOwySUA7/42Qg=";
 
   nativeBuildInputs = lib.optional robloxSupport pkg-config;
 
diff --git a/pkgs/development/tools/sumneko-lua-language-server/default.nix b/pkgs/development/tools/sumneko-lua-language-server/default.nix
index 8faba993068..16295144772 100644
--- a/pkgs/development/tools/sumneko-lua-language-server/default.nix
+++ b/pkgs/development/tools/sumneko-lua-language-server/default.nix
@@ -4,13 +4,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "sumneko-lua-language-server";
-  version = "3.5.5";
+  version = "3.5.6";
 
   src = fetchFromGitHub {
     owner = "sumneko";
     repo = "lua-language-server";
     rev = version;
-    sha256 = "sha256-TSBV10QBD9TiQMsH800bSDbOzkD1orzHT4gLNWVE3Iw=";
+    sha256 = "sha256-S07/N6Cq/YG0kS2riPI8wy/fOxPHkMrGqpmUd+ymwJ0=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/web/deno/default.nix b/pkgs/development/web/deno/default.nix
index 185065d1a56..2792f732614 100644
--- a/pkgs/development/web/deno/default.nix
+++ b/pkgs/development/web/deno/default.nix
@@ -17,15 +17,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "deno";
-  version = "1.25.2";
+  version = "1.25.3";
 
   src = fetchFromGitHub {
     owner = "denoland";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-yi4isp5VuQnLq2KYyti6czlVhycmxOs0a9G6rzkCgqo=";
+    sha256 = "sha256-bKZ9/3f9YN24hV+U3d4PDKHMvNyD72qJpfqfAmgO0dk=";
   };
-  cargoSha256 = "sha256-fHOTL8qipOOjI91a73wMXUm0tD78O1eHhCAtRyClmWc=";
+  cargoSha256 = "sha256-Y/19wrY26rDuA6Pwlr2gjl1JupaJwaOhY0msq6nIyYc=";
 
   postPatch = ''
     # upstream uses lld on aarch64-darwin for faster builds
diff --git a/pkgs/games/legendary-gl/default.nix b/pkgs/games/legendary-gl/default.nix
index c04c90b9775..362788b441e 100644
--- a/pkgs/games/legendary-gl/default.nix
+++ b/pkgs/games/legendary-gl/default.nix
@@ -7,13 +7,13 @@
 
 buildPythonApplication rec {
   pname = "legendary-gl"; # Name in pypi
-  version = "0.20.28";
+  version = "0.20.29";
 
   src = fetchFromGitHub {
     owner = "derrod";
     repo = "legendary";
     rev = "refs/tags/${version}";
-    sha256 = "sha256-33EsxwwvgkN9U8kpYywV0wsRnLzjGv87zYJ9jSVi91c=";
+    sha256 = "sha256-yocGjPZzuLHvWQ1EuS+kMxb/6ikfPvKqFmvHK+SyE+E=";
   };
 
   propagatedBuildInputs = [ requests ];
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index 71eaa0b5c23..6aa7ede3f5f 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "4.14.292";
+  version = "4.14.293";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0zc97qy62dhc5xkjnvsfn4lpl4dgrj23hlxvxcr4cr8sj0hxzx3h";
+    sha256 = "047gl9nqrvpi9jaxlmhfnx848qvnrhf13710ka8fwn3lyv22k342";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix
index 8dac0b120a9..b05e16e9832 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "4.19.257";
+  version = "4.19.258";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0izaldl2l2zsshkd07qsnr9x6ikipmj5jp7lxr8dyz7kf2m17pga";
+    sha256 = "002sw8b272dzkp3vff0x89sbj5p3vrrikqygfdgrsxv7k3w4459x";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index c435a82c50d..38c7106dfa6 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,12 +1,12 @@
 { buildPackages, fetchurl, perl, buildLinux, nixosTests, stdenv, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.327";
+  version = "4.9.328";
   extraMeta.branch = "4.9";
   extraMeta.broken = stdenv.isAarch64;
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1lh63viynf9f7vl0a52mnal8jack9lbqfsfammwkxi3kafpw30r2";
+    sha256 = "1px2np3k796cjwq1sp9gfxyql6hqyqya82vq9cb5y0canq6fqmg8";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.10.nix b/pkgs/os-specific/linux/kernel/linux-5.10.nix
index f17beabecd6..34bea203c4e 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.10.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.10.142";
+  version = "5.10.143";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0s52vfvw5pgnq7gq9n66ib05ryhkxwv765f16862l5gykbdynirz";
+    sha256 = "14af0lsvgh1k0fh283d0nrm1pkrk2kaf2mz0ab59vlvjybg9wb7s";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.15.nix b/pkgs/os-specific/linux/kernel/linux-5.15.nix
index 9b98bb0e4cd..aa18ff18fd8 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.15.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.15.67";
+  version = "5.15.68";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0h7r2k59jsw8ykb2p7nxrpazbwx1n5p3nmfbbj1lhib91fldjiys";
+    sha256 = "0zlb44bwpc0hwfynzz5v5b3lkv4aha7w5737ns1qb8cvbk5v7fqp";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.19.nix b/pkgs/os-specific/linux/kernel/linux-5.19.nix
index a6fb0aa1f58..422afc2e545 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.19.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.19.8";
+  version = "5.19.9";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1kl7fifsa6vsm34xg3kd2svhx18n771hfj67nhwnlalmb9whhqv1";
+    sha256 = "0dvzjbyknzlx4ndz77fsm6v28fj2chxbq1z85fbc3bckcscbbm8a";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.4.nix b/pkgs/os-specific/linux/kernel/linux-5.4.nix
index f341bc77d43..09ac4bf3273 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.4.212";
+  version = "5.4.213";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1hngr4hsrcd6hmlyvc3msy5racniav2jagp5abmp7xsxv0yjxiq9";
+    sha256 = "1wdssqmac66zqsnq5lx2z8ampa0rd3qswg0gm1sh6n3y8xlf2z76";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-libre.nix b/pkgs/os-specific/linux/kernel/linux-libre.nix
index 6de38abd07f..f760c033683 100644
--- a/pkgs/os-specific/linux/kernel/linux-libre.nix
+++ b/pkgs/os-specific/linux/kernel/linux-libre.nix
@@ -1,8 +1,8 @@
 { stdenv, lib, fetchsvn, linux
 , scripts ? fetchsvn {
     url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/";
-    rev = "18904";
-    sha256 = "1l200abijg5y15h4vza86sirlcplm7iyhm3igdyxqj3s0169nck9";
+    rev = "18911";
+    sha256 = "1f5b936a7ayva2kyly3n71sg6cqdvcavcxbj3cy3imaj9247bx72";
   }
 , ...
 }:
diff --git a/pkgs/servers/alps/default.nix b/pkgs/servers/alps/default.nix
index 2a98b971708..a2f69473fba 100644
--- a/pkgs/servers/alps/default.nix
+++ b/pkgs/servers/alps/default.nix
@@ -14,6 +14,8 @@ buildGoModule rec {
   vendorSha256 = "sha256-cpY+lYM/nAX3nUaFknrRAavxDk8UDzJkoqFjJ1/KWeg=";
 
   ldflags = [
+    "-s"
+    "-w"
     "-X main.themesPath=${placeholder "out"}/share/alps/themes"
     "-X git.sr.ht/~migadu/alps.PluginDir=${placeholder "out"}/share/alps/plugins"
   ];
@@ -33,6 +35,6 @@ buildGoModule rec {
     description = "A simple and extensible webmail.";
     homepage = "https://git.sr.ht/~migadu/alps";
     license = licenses.mit;
-    maintainers = with maintainers; [ gordias booklearner ];
+    maintainers = with maintainers; [ gordias booklearner madonius ];
   };
 }
diff --git a/pkgs/servers/mautrix-signal/default.nix b/pkgs/servers/mautrix-signal/default.nix
index 4879e689951..056d2047f2d 100644
--- a/pkgs/servers/mautrix-signal/default.nix
+++ b/pkgs/servers/mautrix-signal/default.nix
@@ -47,8 +47,8 @@ python3.pkgs.buildPythonPackage rec {
     " > $out/bin/mautrix-signal
     chmod +x $out/bin/mautrix-signal
     wrapProgram $out/bin/mautrix-signal \
-      --set PATH ${python3}/bin \
-      --set PYTHONPATH "$PYTHONPATH"
+      --prefix PATH : "${python3}/bin" \
+      --prefix PYTHONPATH : "$PYTHONPATH"
   '';
 
   meta = with lib; {
diff --git a/pkgs/servers/mautrix-whatsapp/default.nix b/pkgs/servers/mautrix-whatsapp/default.nix
index c32e1ef450c..75d828ccf79 100644
--- a/pkgs/servers/mautrix-whatsapp/default.nix
+++ b/pkgs/servers/mautrix-whatsapp/default.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "mautrix-whatsapp";
-  version = "0.6.1";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "mautrix";
     repo = "whatsapp";
     rev = "v${version}";
-    sha256 = "1AcjcE57ttjypnLU/+qpPsvApiuJfSX0qbPEQKOWfIM=";
+    hash = "sha256-OUGFp25M8wn8eWMuQHDh8Zp67x+VHVbyvuBHq+UE+NY=";
   };
 
   buildInputs = [ olm ];
 
-  vendorSha256 = "4CA/kDGohoJfdiXALN8M8fuPHQUrU2REHqVI7kKMnoY=";
+  vendorSha256 = "sha256-9pOe7jHgyrFP1Sj8O1KEVxcEaUPEE0+41HUfQoPxa2E=";
 
   doCheck = false;
 
diff --git a/pkgs/servers/monitoring/grafana/default.nix b/pkgs/servers/monitoring/grafana/default.nix
index 45a3cbba163..8b927aaab70 100644
--- a/pkgs/servers/monitoring/grafana/default.nix
+++ b/pkgs/servers/monitoring/grafana/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "grafana";
-  version = "9.1.4";
+  version = "9.1.5";
 
   excludedPackages = [ "alert_webhook_listener" "clean-swagger" "release_publisher" "slow_proxy" "slow_proxy_mac" "macaron" "devenv" ];
 
@@ -10,12 +10,12 @@ buildGoModule rec {
     rev = "v${version}";
     owner = "grafana";
     repo = "grafana";
-    sha256 = "sha256-tMU8xfMbXdPpI8La036tzPozdUK7GsDGZklNetAZ3ho=";
+    sha256 = "sha256-R5gHd9lLXPV6Ck9mhPfdL41/O9ZN76wjBRDUBLtL2eA=";
   };
 
   srcStatic = fetchurl {
     url = "https://dl.grafana.com/oss/release/grafana-${version}.linux-amd64.tar.gz";
-    sha256 = "sha256-+9Y2ymdlDfSvAsbaFcaTRl7e9NiH2GpNHvZIgssi7/w=";
+    sha256 = "sha256-P+QkpyGRSuZX/OJo/CgMP9z1Rq7tJbWAZCMOwAuEFhc=";
   };
 
   vendorSha256 = "sha256-frY84+Tp9qVj9Xs9l0c0u1YyYywMbXO4KS0AF5mpnhQ=";
diff --git a/pkgs/servers/monitoring/sensu-go/default.nix b/pkgs/servers/monitoring/sensu-go/default.nix
index 76c56f4a4c1..c9661c79c0e 100644
--- a/pkgs/servers/monitoring/sensu-go/default.nix
+++ b/pkgs/servers/monitoring/sensu-go/default.nix
@@ -4,19 +4,19 @@ let
   generic = { subPackages, pname, postInstall ? "", mainProgram }:
     buildGoModule rec {
       inherit pname;
-      version = "6.8.0";
+      version = "6.8.1";
       shortRev = "3a1ac58"; # for internal version info
 
       src = fetchFromGitHub {
         owner = "sensu";
         repo = "sensu-go";
         rev = "v${version}";
-        sha256 = "sha256-T9SR3Ec7Q51Q2L/xJHx35eA0/KcFB3ZxqimIYKwAJLU=";
+        sha256 = "sha256-6kyT5atO9hqmrQnjhoLPDJEMueKYXawVvhxKMTEPJ6k=";
       };
 
       inherit subPackages postInstall;
 
-      vendorSha256 = "sha256-Y8gYh770p22O1ZLcqZi5NNKWOP4sXHSP3b0d4klrSHg=";
+      vendorSha256 = "sha256-yysRmhVUw1cYgYhWg74dv3+nmLBDx5ZiXuCba1e/CrI=";
 
       doCheck = false;
 
diff --git a/pkgs/servers/nosql/immudb/default.nix b/pkgs/servers/nosql/immudb/default.nix
new file mode 100644
index 00000000000..a2f56f4f45c
--- /dev/null
+++ b/pkgs/servers/nosql/immudb/default.nix
@@ -0,0 +1,64 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, fetchzip
+, installShellFiles
+}:
+
+let
+  webconsoleVersion = "1.0.17";
+  webconsoleDist = fetchzip {
+    url = "https://github.com/codenotary/immudb-webconsole/releases/download/v${webconsoleVersion}/immudb-webconsole.tar.gz";
+    sha256 = "sha256-hFSvPwSRXyrSBYktTOwIRa1+aH+mX/scDYDokvZuW1s=";
+  };
+in
+buildGoModule rec {
+  pname = "immudb";
+  version = "1.3.2";
+
+  src = fetchFromGitHub {
+    owner = "codenotary";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-lcKjeqZeTQQMhVjnWNP3c+HanI/eenfUbpZJAo5FEkM=";
+  };
+
+  preBuild = ''
+    mkdir -p webconsole/dist
+    cp -r ${webconsoleDist}/* ./webconsole/dist
+    go generate -tags webconsole ./webconsole
+  '';
+
+  proxyVendor = true; # check if this is needed anymore when updating
+
+  vendorSha256 = "sha256-gMpkV0XqY6wh7s0lndIdCoYlvVBrMk7/lvyDVqnJ66c=";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  tags = [ "webconsole" ];
+
+  ldflags = [ "-X github.com/codenotary/immudb/cmd/version.Version=${version}" ];
+
+  subPackages = [
+    "cmd/immudb"
+    "cmd/immuclient"
+    "cmd/immuadmin"
+  ];
+
+  postInstall = ''
+    mkdir -p share/completions
+    for executable in immudb immuclient immuadmin; do
+      for shell in bash fish zsh; do
+        $out/bin/$executable completion $shell > share/completions/$executable.$shell
+        installShellCompletion share/completions/$executable.$shell
+      done
+    done
+  '';
+
+  meta = with lib; {
+    description = "Immutable database based on zero trust, SQL and Key-Value, tamperproof, data change history";
+    homepage = "https://github.com/codenotary/immudb";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ dit7ya ];
+  };
+}
diff --git a/pkgs/servers/tailscale/default.nix b/pkgs/servers/tailscale/default.nix
index 91192ee371d..b36b5449cae 100644
--- a/pkgs/servers/tailscale/default.nix
+++ b/pkgs/servers/tailscale/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "tailscale";
-  version = "1.30.1";
+  version = "1.30.2";
 
   src = fetchFromGitHub {
     owner = "tailscale";
     repo = "tailscale";
     rev = "v${version}";
-    sha256 = "sha256-sR1DB8Hc/JkCFaoj9FRRJhTeUWWoGUee2kx0EreUbWE=";
+    sha256 = "sha256-xs3LhldFP4gB5ouW1q8eiCZ5nZD6j9QROm/s+qFMA88=";
   };
   vendorSha256 = "sha256-+7Cr7wmt4PheHJRAlyKhRd6QRIZBqrbVtn5I94h8lLo=";
 
diff --git a/pkgs/servers/traefik/default.nix b/pkgs/servers/traefik/default.nix
index f6c4cdaba04..9938a490ff5 100644
--- a/pkgs/servers/traefik/default.nix
+++ b/pkgs/servers/traefik/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "traefik";
-  version = "2.8.4";
+  version = "2.8.5";
 
   # Archive with static assets for webui
   src = fetchzip {
     url = "https://github.com/traefik/traefik/releases/download/v${version}/traefik-v${version}.src.tar.gz";
-    sha256 = "sha256-TzNjz1usnQ0CMu47i9pnCRR6N/d3ig2E0wVH3E8xJp0=";
+    sha256 = "sha256-qRnt2ZyGMwnbilaau66/SEJOSWkKyZf1L7CLWVHme5k=";
     stripRoot = false;
   };
 
-  vendorSha256 = "sha256-+jqMokDuvw5LTqBxJ/2VyoT3wkdBHewTrYsK/5Uv6js=";
+  vendorSha256 = "sha256-6gUnM+axlkzBwVx0OePTybPP1Fk+oqsFRED4+K9Weu4=";
 
   subPackages = [ "cmd/traefik" ];
 
diff --git a/pkgs/servers/web-apps/wiki-js/default.nix b/pkgs/servers/web-apps/wiki-js/default.nix
index 7f67ff07532..6e80e377017 100644
--- a/pkgs/servers/web-apps/wiki-js/default.nix
+++ b/pkgs/servers/web-apps/wiki-js/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "wiki-js";
-  version = "2.5.286";
+  version = "2.5.287";
 
   src = fetchurl {
     url = "https://github.com/Requarks/wiki/releases/download/v${version}/${pname}.tar.gz";
-    sha256 = "sha256-jxnWUSvTldaIX21PryZiR4UlWmxs03gcGohOmnyDGS8=";
+    sha256 = "sha256-6BtyDutVHFzOB1MXO2PIBbhyXveTa8M09m9qv+OKQ04=";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/shells/xonsh/default.nix b/pkgs/shells/xonsh/default.nix
index 6c7132b46c9..db9469cb7fd 100644
--- a/pkgs/shells/xonsh/default.nix
+++ b/pkgs/shells/xonsh/default.nix
@@ -8,14 +8,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "xonsh";
-  version = "0.13.1";
+  version = "0.13.3";
 
   # fetch from github because the pypi package ships incomplete tests
   src = fetchFromGitHub {
     owner = "xonsh";
     repo = "xonsh";
-    rev = version;
-    sha256 = "sha256-Q9FJXccpTW3nPUOCf5UD8ZWJW25QX8PNHHpsVYjesYE=";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-COm+MZUbiFTB5EaOB+1+lIef1IfhQ95Ya1MmnJXGu6A=";
   };
 
   LC_ALL = "en_US.UTF-8";
diff --git a/pkgs/tools/X11/ckbcomp/default.nix b/pkgs/tools/X11/ckbcomp/default.nix
index 0d1a35c0aaa..6481971ed0f 100644
--- a/pkgs/tools/X11/ckbcomp/default.nix
+++ b/pkgs/tools/X11/ckbcomp/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "ckbcomp";
-  version = "1.209";
+  version = "1.210";
 
   src = fetchFromGitLab {
     domain = "salsa.debian.org";
     owner = "installer-team";
     repo = "console-setup";
     rev = version;
-    sha256 = "sha256-fTAntT2XqerCwINHXLis1KE/8h4AzXo1zg3PzglTPTg=";
+    sha256 = "sha256-Np1u8oYIRwWlGpnpp5+VvYkZOkphv225p34og4O+HDE=";
   };
 
   buildInputs = [ perl ];
diff --git a/pkgs/tools/X11/xsecurelock/default.nix b/pkgs/tools/X11/xsecurelock/default.nix
index 9539a717e61..ab8bbf67ca6 100644
--- a/pkgs/tools/X11/xsecurelock/default.nix
+++ b/pkgs/tools/X11/xsecurelock/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xsecurelock";
-  version = "1.7.0";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "xsecurelock";
     rev = "v${version}";
-    sha256 = "020y2mi4sshc5dghcz37aj5wwizbg6712rzq2a72f8z8m7mnxr5y";
+    sha256 = "sha256-sK3KrtZzrV2jkQveZnSHDR5I4v7baL/sARje2mDpIMI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/admin/syft/default.nix b/pkgs/tools/admin/syft/default.nix
index a9faf35ec52..13f783dee06 100644
--- a/pkgs/tools/admin/syft/default.nix
+++ b/pkgs/tools/admin/syft/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "syft";
-  version = "0.55.0";
+  version = "0.56.0";
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-tzrWgmEMe7y6PQgtYiN12LGR24FuaEvzOBAfgbIOepo=";
+    sha256 = "sha256-UEkBhVUapfHYQAUaYWHEpGgXn39Vb3NscWxynpob2MM=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -20,7 +20,7 @@ buildGoModule rec {
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
-  vendorSha256 = "sha256-HaTUjNKAZNiVcM4tZJb0r9ezsvWTlOicPct/ZtpTz5Y=";
+  vendorSha256 = "sha256-MxaY11CfcLWonm4SXI0mjnq29h9Hz8PdiY8eFrn42a0=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/admin/trivy/default.nix b/pkgs/tools/admin/trivy/default.nix
index e2f0a4bdd3e..520294855c0 100644
--- a/pkgs/tools/admin/trivy/default.nix
+++ b/pkgs/tools/admin/trivy/default.nix
@@ -5,17 +5,17 @@
 
 buildGoModule rec {
   pname = "trivy";
-  version = "0.31.3";
+  version = "0.32.0";
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-e+H5FH9UU2zK4GmxN04T87GdZYRZDVtA0FNw6t4kjgQ=";
+    sha256 = "sha256-o4wmHPdNKFcgLPFYLluLLP9ReXt2vL1LHmUmhNl/5cE=";
   };
   # hash missmatch on across linux and darwin
   proxyVendor = true;
-  vendorSha256 = "sha256-QjJHmVqZTw5w1jR+EctS4VzeJMBpkCL3VGjeKeQmyPA=";
+  vendorSha256 = "sha256-QIJZwu+b8xkp3z7A+QESa3VdwEEtsWIDG2gdcCiFPh0=";
 
   excludedPackages = "misc";
 
diff --git a/pkgs/tools/compression/dtrx/default.nix b/pkgs/tools/compression/dtrx/default.nix
index 78c2a9f399c..c99d40cbc92 100644
--- a/pkgs/tools/compression/dtrx/default.nix
+++ b/pkgs/tools/compression/dtrx/default.nix
@@ -21,13 +21,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "dtrx";
-  version = "8.3.1";
+  version = "8.4.0";
 
   src = fetchFromGitHub {
     owner = "dtrx-py";
     repo = "dtrx";
     rev = "refs/tags/${version}";
-    sha256 = "sha256-a8ZHIPunWGwI992HfgdRvJGtDfYUP50kFt/ROAqDO7E=";
+    sha256 = "sha256-G+W0qY8s30cYSmOEy9Kkx+Wr48n7+6FuzL34GvwdKtg=";
   };
 
   postInstall =
diff --git a/pkgs/tools/filesystems/btrfs-progs/default.nix b/pkgs/tools/filesystems/btrfs-progs/default.nix
index 4dcf1a7a56c..608c318b10a 100644
--- a/pkgs/tools/filesystems/btrfs-progs/default.nix
+++ b/pkgs/tools/filesystems/btrfs-progs/default.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation rec {
   pname = "btrfs-progs";
-  version = "5.19";
+  version = "5.19.1";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/people/kdave/btrfs-progs/btrfs-progs-v${version}.tar.xz";
-    sha256 = "sha256-H7zwbksvgOehJ/1oftRiWlt0+mdP4hLINv9w4O38zPk=";
+    sha256 = "sha256-JkKeVANDzMf11LP49CuRZxMoDomMVHHacFAm720sEKY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/filesystems/stratis-cli/default.nix b/pkgs/tools/filesystems/stratis-cli/default.nix
index 813ecfa22c6..145d570b6a8 100644
--- a/pkgs/tools/filesystems/stratis-cli/default.nix
+++ b/pkgs/tools/filesystems/stratis-cli/default.nix
@@ -25,6 +25,18 @@ python3Packages.buildPythonApplication rec {
     packaging
   ];
 
+  checkInputs = with python3Packages; [
+    pytestCheckHook
+  ];
+
+  disabledTestPaths = [
+    # tests below require dbus daemon
+    "tests/whitebox/integration"
+    "tests/whitebox/monkey_patching"
+  ];
+
+  pythonImportsCheck = [ "stratis_cli" ];
+
   passthru.tests = nixosTests.stratis;
 
   meta = with lib; {
diff --git a/pkgs/tools/inputmethods/fcitx5/default.nix b/pkgs/tools/inputmethods/fcitx5/default.nix
index 9dfa5a702f2..de2c777a64a 100644
--- a/pkgs/tools/inputmethods/fcitx5/default.nix
+++ b/pkgs/tools/inputmethods/fcitx5/default.nix
@@ -41,17 +41,17 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "fcitx5";
-  version = "5.0.18";
+  version = "5.0.19";
 
   src = fetchFromGitHub {
     owner = "fcitx";
     repo = pname;
     rev = version;
-    sha256 = "sha256-ZhjNUWzi74lr8Wtf0f+VN1kc9C6q2TJ9ogXeu3NJKbI=";
+    sha256 = "sha256-hgg7Sbe5/tAWWq2to9PceBQeUdV3UWENFgvuY0qCksM=";
   };
 
   prePatch = ''
-    ln -s ${enDict} src/modules/spell/dict/$(stripHash ${enDict})
+    ln -s ${enDict} src/modules/spell/$(stripHash ${enDict})
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/inputmethods/fcitx5/fcitx5-chinese-addons.nix b/pkgs/tools/inputmethods/fcitx5/fcitx5-chinese-addons.nix
index 18da967c048..e4455fdb551 100644
--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-chinese-addons.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-chinese-addons.nix
@@ -31,13 +31,13 @@ in
 
 mkDerivation rec {
   pname = "fcitx5-chinese-addons";
-  version = "5.0.14";
+  version = "5.0.15";
 
   src = fetchFromGitHub {
     owner = "fcitx";
     repo = pname;
     rev = version;
-    sha256 = "sha256-ZIOPzRXW+aaVKDIBC3N04wx662r8WOa205CgTeYmudQ=";
+    sha256 = "sha256-9AGL0eAkaA2N/aE8VlgRCnW2lAl55SroBumeU5xkW5M=";
   };
 
   cmakeFlags = [
diff --git a/pkgs/tools/inputmethods/fcitx5/fcitx5-gtk.nix b/pkgs/tools/inputmethods/fcitx5/fcitx5-gtk.nix
index d71fca87ab2..43905dfac91 100644
--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-gtk.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-gtk.nix
@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fcitx5-gtk";
-  version = "5.0.17";
+  version = "5.0.18";
 
   src = fetchFromGitHub {
     owner = "fcitx";
     repo = pname;
     rev = version;
-    sha256 = "sha256-sAPbbMoZ4NGiE7lbtcdzQQsPib6i52JwWsLe+bmTshU=";
+    sha256 = "sha256-rQ2HLiI0dIerxRV+fbHpTJy4aGmFKmGd6YckKxXmp4s=";
   };
 
   cmakeFlags = [
diff --git a/pkgs/tools/misc/dotter/default.nix b/pkgs/tools/misc/dotter/default.nix
index 20699c52849..1b252da0d82 100644
--- a/pkgs/tools/misc/dotter/default.nix
+++ b/pkgs/tools/misc/dotter/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , fetchpatch
 , fetchFromGitHub
+, nix-update-script
 , rustPlatform
 , CoreServices
 , which
@@ -9,26 +10,31 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "dotter";
-  version = "0.12.13";
+  version = "0.12.14";
 
   src = fetchFromGitHub {
     owner = "SuperCuber";
     repo = "dotter";
     rev = "v${version}";
-    hash = "sha256-j3Dj43AbD0V5pZ6mM1uvPsqWAVJrmWyWvwC5NK1cRRY=";
+    hash = "sha256-GGbUpjAcihJLNNo0OtkRGQ2RcT/75vDABlHs7Atzo1s=";
   };
 
-  cargoHash = "sha256-HPs55JBbYObunU0cSm/7lsu/DOk4ne9Ea9MCRJ427zo=";
+  cargoHash = "sha256-uC0OwN73krM7QaQ4rtWV6IseKdZmiqrB8a6QGTs6fHE=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];
 
   checkInputs = [ which ];
 
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = pname;
+    };
+  };
+
   meta = with lib; {
     description = "A dotfile manager and templater written in rust 🦀";
     homepage = "https://github.com/SuperCuber/dotter";
     license = licenses.unlicense;
     maintainers = with maintainers; [ linsui ];
-    mainProgram = "dotter";
   };
 }
diff --git a/pkgs/tools/misc/elfcat/default.nix b/pkgs/tools/misc/elfcat/default.nix
index e2dec357d6d..359bd6d3ab9 100644
--- a/pkgs/tools/misc/elfcat/default.nix
+++ b/pkgs/tools/misc/elfcat/default.nix
@@ -11,8 +11,7 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-NzFKNCCPWBj/fhaEJF34nyeyvLMeQwIcQgTlYc6mgYo=";
   };
 
-  # There is no dependency to vendor in this project.
-  cargoLock.lockFile = ./Cargo.lock;
+  cargoHash = "sha256-Dc+SuLwbLFcNSr9RiNSc7dgisBOvOUEIDR8dFAkC/O0=";
 
   meta = with lib; {
     description = "ELF visualizer, generates HTML files from ELF binaries.";
diff --git a/pkgs/tools/misc/exa/default.nix b/pkgs/tools/misc/exa/default.nix
index 40fcc8b01c2..108155b6ad6 100644
--- a/pkgs/tools/misc/exa/default.nix
+++ b/pkgs/tools/misc/exa/default.nix
@@ -1,5 +1,15 @@
-{ lib, stdenv, fetchFromGitHub, rustPlatform, cmake, pandoc, pkg-config, zlib
-, Security, libiconv, installShellFiles
+{ lib
+, gitSupport ? true
+, stdenv
+, fetchFromGitHub
+, rustPlatform
+, cmake
+, pandoc
+, pkg-config
+, zlib
+, Security
+, libiconv
+, installShellFiles
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -26,6 +36,9 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [ zlib ]
     ++ lib.optionals stdenv.isDarwin [ libiconv Security ];
 
+  buildNoDefaultFeatures = true;
+  buildFeatures = lib.optional gitSupport "git";
+
   outputs = [ "out" "man" ];
 
   postInstall = ''
diff --git a/pkgs/tools/misc/macchina/default.nix b/pkgs/tools/misc/macchina/default.nix
index a38644f32df..b5f45e5c860 100644
--- a/pkgs/tools/misc/macchina/default.nix
+++ b/pkgs/tools/misc/macchina/default.nix
@@ -3,16 +3,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "macchina";
-  version = "6.0.6";
+  version = "6.1.2";
 
   src = fetchFromGitHub {
     owner = "Macchina-CLI";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-G95eQ5cIa5313k8YcuicbzPeq9VXVo2DgPMwfFMNXtk=";
+    sha256 = "sha256-zJr5RG1bbcKhPGygERSROC9JVfVigHauFzaqfY4KXC4=";
   };
 
-  cargoSha256 = "sha256-mkAklLtG/sB0eLla5cveMqyPXwMCE5ufer8qA5L9chg=";
+  cargoSha256 = "sha256-QwZWm50D3N4OES9ypnIQOxEPYcUXVUcwKQ0/SUy7jyI=";
 
   nativeBuildInputs = [ installShellFiles ];
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv Foundation ];
diff --git a/pkgs/tools/misc/miniserve/default.nix b/pkgs/tools/misc/miniserve/default.nix
index 2b410f9c3bb..3d4cccbb18e 100644
--- a/pkgs/tools/misc/miniserve/default.nix
+++ b/pkgs/tools/misc/miniserve/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "miniserve";
-  version = "0.20.0";
+  version = "0.21.0";
 
   src = fetchFromGitHub {
     owner = "svenstaro";
     repo = "miniserve";
     rev = "v${version}";
-    hash = "sha256-56XP8e05rdslkrjmHRuYszqcBFZ7xCuj74mfGS9jznQ=";
+    hash = "sha256-tps/TKkG2To80zokNoSHQQPrzZnoS+lBWks/PIV586Q=";
   };
 
-  cargoSha256 = "sha256-NZ2/N09LFAvXFGpJj4kx7jpt1G6akXsrVe6XqQPCN9g=";
+  cargoSha256 = "sha256-9xRxUnDEji5+3drHQtdK1ozW8nezushxZZAaUlp+jJQ=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/tools/misc/mongodb-compass/default.nix b/pkgs/tools/misc/mongodb-compass/default.nix
index b9e91d4e9ef..d946a191800 100644
--- a/pkgs/tools/misc/mongodb-compass/default.nix
+++ b/pkgs/tools/misc/mongodb-compass/default.nix
@@ -33,7 +33,7 @@ xorg,
 }:
 
 let
-  version = "1.33.0";
+  version = "1.33.1";
 
   rpath = lib.makeLibraryPath [
     alsa-lib
@@ -82,7 +82,7 @@ let
     if stdenv.hostPlatform.system == "x86_64-linux" then
       fetchurl {
         url = "https://downloads.mongodb.com/compass/mongodb-compass_${version}_amd64.deb";
-        sha256 = "sha256-P5QNSFaE04YP+zOPWKE5Rf6vffhcBwNdju7aTTnDbJ0=";
+        sha256 = "sha256-Db3Xv6kNAPWqeM+vZeG7GieweaThJO0CCuwm6/v4l2s=";
       }
     else
       throw "MongoDB compass is not supported on ${stdenv.hostPlatform.system}";
diff --git a/pkgs/tools/misc/mutagen-compose/default.nix b/pkgs/tools/misc/mutagen-compose/default.nix
index f9bf6c9a18e..c22d2450eea 100644
--- a/pkgs/tools/misc/mutagen-compose/default.nix
+++ b/pkgs/tools/misc/mutagen-compose/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "mutagen-compose";
-  version = "0.15.2";
+  version = "0.15.3";
 
   src = fetchFromGitHub {
     owner = "mutagen-io";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Ass6BXOevFuyT6eLZ8J5XRN44YAfBdoQ7N+/5152uR0=";
+    sha256 = "sha256-B7ZMECeNYIfFQ7+VM+tBLj6KLCxicNfopXzL7AtrSFc=";
   };
 
-  vendorSha256 = "sha256-rzMcUQvP27GBGohcWrSzu7fEP6lwEwgo3sWXuEeZES8=";
+  vendorSha256 = "sha256-AfOsnD3e2C2c/Qc26IlP9CeaoSAhP78Nupu245ma1Z0=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/misc/pspg/default.nix b/pkgs/tools/misc/pspg/default.nix
index abba7ca91ac..d10b30e9818 100644
--- a/pkgs/tools/misc/pspg/default.nix
+++ b/pkgs/tools/misc/pspg/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pspg";
-  version = "5.5.6";
+  version = "5.5.7";
 
   src = fetchFromGitHub {
     owner = "okbob";
     repo = pname;
     rev = version;
-    sha256 = "sha256-99EuWSNW9e5/GyiR3JwDNFTAOJpaGCJKmxt340bjPrA=";
+    sha256 = "sha256-kg3jV3TNG80oviy25U2tmShBACfpXDr4zuc/FD2E/Xo=";
   };
 
   nativeBuildInputs = [ pkg-config installShellFiles ];
diff --git a/pkgs/tools/networking/netbird/default.nix b/pkgs/tools/networking/netbird/default.nix
index b90e2b92169..60f9a19bd53 100644
--- a/pkgs/tools/networking/netbird/default.nix
+++ b/pkgs/tools/networking/netbird/default.nix
@@ -14,13 +14,13 @@ let
 in
 buildGoModule rec {
   pname = "netbird";
-  version = "0.9.1";
+  version = "0.9.3";
 
   src = fetchFromGitHub {
     owner = "netbirdio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ECQ9W4YJdqjFP/Fs2P/JlPLJntewi1kowzYyid7IQGc=";
+    sha256 = "sha256-lW5Xaf1d0udm8yLzGhmCmd13SYHdbIBi/bjuiRAdjRg=";
   };
 
   vendorSha256 = "sha256-qBglJ9PYUApyOrZhZRvyK3WMcZQglDHmsy3Qv5K1PqA=";
diff --git a/pkgs/tools/networking/rathole/default.nix b/pkgs/tools/networking/rathole/default.nix
index 74eb894f0d0..ceaf89ef92e 100644
--- a/pkgs/tools/networking/rathole/default.nix
+++ b/pkgs/tools/networking/rathole/default.nix
@@ -8,16 +8,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "rathole";
-  version = "0.4.3";
+  version = "0.4.4";
 
   src = fetchFromGitHub {
     owner = "rapiz1";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-gqWgx03mUk6+9K4Yw5PHEBwFxsOR+48wvngT+wQnN1k=";
+    sha256 = "sha256-qhkgXS+Rku9OcFgFbHfELcjQmIHNvi3sC4bh5LKYzJQ=";
   };
 
-  cargoSha256 = "sha256-dafOgZtiszkoi97PpAVMtdvJd5O3EK9hDVNLJ32FYzE=";
+  cargoSha256 = "sha256-3WY+VIRycqFmkVA+NdbU4glEkZecRM5eKI/reyNWVao=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/tools/security/dalfox/default.nix b/pkgs/tools/security/dalfox/default.nix
index 84eccdad312..5bdc036323b 100644
--- a/pkgs/tools/security/dalfox/default.nix
+++ b/pkgs/tools/security/dalfox/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "dalfox";
-  version = "2.7.5";
+  version = "2.8.1";
 
   src = fetchFromGitHub {
     owner = "hahwul";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-MCKXhDhpFLZTf0CYS3W4+4FykTuBu7q3Dy+R7RNp11s=";
+    sha256 = "sha256-JNEKFbhJlBUvAzqd1UODWv8HIo5LDVPvFfwmztsRW2o=";
   };
 
-  vendorSha256 = "sha256-GW2DgfHEKKWBfW5A7DYqhV2jP3FLDjzpYOMWSTNCN0Q=";
+  vendorSha256 = "sha256-PVtUC8UfUBGL7m1SsMK48Bcm9poCSFcPWJs1e+/UfSI=";
 
   meta = with lib; {
     description = "Tool for analysing parameter and XSS scanning";
diff --git a/pkgs/tools/security/exploitdb/default.nix b/pkgs/tools/security/exploitdb/default.nix
index e3a684ae744..836ebd553f9 100644
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2022-09-02";
+  version = "2022-09-16";
 
   src = fetchFromGitHub {
     owner = "offensive-security";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-gZdoaY3wm45DhM2jlKneOzMupmKsPbeOzHIBhmgDeV0=";
+    hash = "sha256-idQx5q5tO+jI3nb2LvFfAmd+nGbrBxWcn34daVZxWdE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/gitls/default.nix b/pkgs/tools/security/gitls/default.nix
index f6ef854ce81..4cda10b3805 100644
--- a/pkgs/tools/security/gitls/default.nix
+++ b/pkgs/tools/security/gitls/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "gitls";
-  version = "1.0.3";
+  version = "1.0.4";
 
   src = fetchFromGitHub {
     owner = "hahwul";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-snoWnq+xmaxWzFthhO/gOYQDUMbpIZR9VkqcPaHzS6g=";
+    hash = "sha256-kLkH/nNidd1QNPKvo7fxZwMhTgd4AVB8Ofw0Wo0z6c0=";
   };
 
-  vendorSha256 = "sha256-pQpattmS9VmO3ZIQUFn66az8GSmB4IvYhTTCFn6SUmo=";
+  vendorSha256 = null;
 
   passthru.tests.version = testers.testVersion {
     package = gitls;
diff --git a/pkgs/tools/security/nsjail/001-fix-bison-link-error.patch b/pkgs/tools/security/nsjail/001-fix-bison-link-error.patch
deleted file mode 100644
index 427cea5b02b..00000000000
--- a/pkgs/tools/security/nsjail/001-fix-bison-link-error.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From 8e309a0af0851ab54ca7c6d51b6f3d19ee42c8ee Mon Sep 17 00:00:00 2001
-From: Evangelos Foutras <evangelos@foutrelis.com>
-Date: Wed, 17 Mar 2021 16:36:40 +0200
-Subject: [PATCH] Replace YYUSE call with void cast in src/parser.y
-
-The YYUSE macro was renamed to YY_USE in bison 3.7.5; we might as well
-avoid using it altogether and cast the unused variable to void instead.
-
-Fixes the following linker error:
-
-/usr/bin/ld: kafel/libkafel.a(libkafel.o): in function `kafel_yyerror':
-arm_syscalls.c:(.text+0x6984): undefined reference to `YYUSE'
----
- src/parser.y | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/parser.y b/src/parser.y
-index e0f109c..0e01373 100644
---- a/kafel/src/parser.y
-+++ b/kafel/src/parser.y
-@@ -420,8 +420,8 @@ const_def
- 
- void yyerror(YYLTYPE * loc, struct kafel_ctxt* ctxt, yyscan_t scanner,
-              const char *msg) {
-+  (void)scanner; /* suppress unused-parameter warning */
-   if (!ctxt->lexical_error) {
--    YYUSE(scanner);
-     if (loc->filename != NULL) {
-       append_error(ctxt, "%s:%d:%d: %s", loc->filename, loc->first_line, loc->first_column, msg);
-     } else {
diff --git a/pkgs/tools/security/nsjail/default.nix b/pkgs/tools/security/nsjail/default.nix
index 568113368a0..c86fcb7ace5 100644
--- a/pkgs/tools/security/nsjail/default.nix
+++ b/pkgs/tools/security/nsjail/default.nix
@@ -1,36 +1,30 @@
 { lib, stdenv, fetchFromGitHub, autoconf, bison, flex, libtool, pkg-config, which
-, libnl, protobuf, protobufc, shadow
+, libnl, protobuf, protobufc, shadow, installShellFiles
 }:
 
 stdenv.mkDerivation rec {
   pname = "nsjail";
-  version = "3.0"; # Bumping? Remove the bison patch.
+  version = "3.1";
 
   src = fetchFromGitHub {
     owner           = "google";
     repo            = "nsjail";
     rev             = version;
     fetchSubmodules = true;
-    sha256          = "1w6x8xcrs0i1y3q41gyq8z3cq9x24qablklc4jiydf855lhqn4dh";
+    sha256          = "sha256-ICJpD7iCT7tLRX+52XvayOUuO1g0L0jQgk60S2zLz6c=";
   };
 
-  nativeBuildInputs = [ autoconf bison flex libtool pkg-config which ];
+  nativeBuildInputs = [ autoconf bison flex libtool pkg-config which installShellFiles ];
   buildInputs = [ libnl protobuf protobufc ];
   enableParallelBuilding = true;
 
-  patches = [
-    # To remove after bumping 3.0
-    ./001-fix-bison-link-error.patch
-  ];
-
   preBuild = ''
     makeFlagsArray+=(USER_DEFINES='-DNEWUIDMAP_PATH=${shadow}/bin/newuidmap -DNEWGIDMAP_PATH=${shadow}/bin/newgidmap')
   '';
 
   installPhase = ''
-    mkdir -p $out/bin $out/share/man/man1
-    install nsjail $out/bin/
-    install nsjail.1 $out/share/man/man1/
+    install -Dm755 nsjail "$out/bin/nsjail"
+    installManPage nsjail.1
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/security/rekor/default.nix b/pkgs/tools/security/rekor/default.nix
index 44b47dc6568..1b335c31b47 100644
--- a/pkgs/tools/security/rekor/default.nix
+++ b/pkgs/tools/security/rekor/default.nix
@@ -4,13 +4,13 @@ let
   generic = { pname, packageToBuild, description }:
     buildGoModule rec {
       inherit pname;
-      version = "0.11.0";
+      version = "0.12.0";
 
       src = fetchFromGitHub {
         owner = "sigstore";
         repo = "rekor";
         rev = "v${version}";
-        sha256 = "sha256-55socfx7qTQ3F5JcDgPTHQP+96X7lwFJ8IIz52hFxow=";
+        sha256 = "sha256-XMudPMCy9AKpqMmt+iH+xyB08s83B/Q0G8PC/4l7llo=";
         # populate values that require us to use git. By doing this in postFetch we
         # can delete .git afterwards and maintain better reproducibility of the src.
         leaveDotGit = true;
@@ -23,7 +23,7 @@ let
         '';
       };
 
-      vendorSha256 = "sha256-A3fG756BoUSJwxyGdfpJlbb+nVQgzo39mjT+QD4knlk=";
+      vendorSha256 = "sha256-cNe3lp866VTeL81FXKVG910ZmO2jrGIZowPRRMFc0bQ=";
 
       nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/security/sx-go/default.nix b/pkgs/tools/security/sx-go/default.nix
index 76ed8a7d55c..1df50838620 100644
--- a/pkgs/tools/security/sx-go/default.nix
+++ b/pkgs/tools/security/sx-go/default.nix
@@ -2,6 +2,7 @@
 , lib
 , buildGoModule
 , fetchFromGitHub
+, fetchpatch
 , libpcap
 }:
 
@@ -18,6 +19,15 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-TWRMNt6x8zuvhP1nz4R6IVCX+9HityvVpzxRhDiMyO4=";
 
+  patches = [
+    # Fix darwin builds: https://github.com/v-byte-cpu/sx/pull/120
+    (fetchpatch {
+      name = "non-linux-method-signature.patch";
+      url = "https://github.com/v-byte-cpu/sx/commit/56457bfaa49eb6fbb7a33d7092d9c636b9c85895.patch";
+      hash = "sha256-0lCu3tZ0fEiC7qWfk1APLVwwrK9eovbVa/yG7OuXEWQ=";
+    })
+  ];
+
   buildInputs = [
     libpcap
   ];
@@ -28,7 +38,6 @@ buildGoModule rec {
   '';
 
   meta = with lib; {
-    broken = stdenv.isDarwin;
     description = "Command-line network scanner";
     homepage = "https://github.com/v-byte-cpu/sx";
     license = licenses.mit;
diff --git a/pkgs/tools/system/skeema/default.nix b/pkgs/tools/system/skeema/default.nix
index 2bffcf20095..7ee2ff0bf71 100644
--- a/pkgs/tools/system/skeema/default.nix
+++ b/pkgs/tools/system/skeema/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "skeema";
-  version = "1.8.1";
+  version = "1.8.2";
 
   src = fetchFromGitHub {
     owner = "skeema";
     repo = "skeema";
     rev = "v${version}";
-    sha256 = "sha256-1XK4eXRVUkCPx5MULmHx5mwQ5P1aqZNtHNEqCBMK8NE=";
+    sha256 = "sha256-PyQ5nLoJl3N/ewmHTZZHRLj9WV3EsUjL6fyESc8POss=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/tools/video/svt-av1/default.nix b/pkgs/tools/video/svt-av1/default.nix
index 3d633c2da25..2a6d4e476ce 100644
--- a/pkgs/tools/video/svt-av1/default.nix
+++ b/pkgs/tools/video/svt-av1/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "svt-av1";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchFromGitLab {
     owner = "AOMediaCodec";
     repo = "SVT-AV1";
     rev = "v${version}";
-    sha256 = "sha256-mUWWYaExEd/WkIYb1d8AduioHBxGp4Nn7Trhe2vv6Z0=";
+    sha256 = "sha256-gK2Yabh9AwAX1AecOPGTOthE4ENCA4NIjwWNJNkXxJc=";
   };
 
   nativeBuildInputs = [ cmake nasm ];
diff --git a/pkgs/tools/wayland/wayout/default.nix b/pkgs/tools/wayland/wayout/default.nix
index bf949cfc054..041c3dfe8cc 100644
--- a/pkgs/tools/wayland/wayout/default.nix
+++ b/pkgs/tools/wayland/wayout/default.nix
@@ -22,7 +22,7 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://git.sr.ht/~shinyzenith/wayout";
     license = licenses.bsd2;
     maintainers = with maintainers; [ onny ];
-    broken = stdenv.isDarwin; # Build failed on Darwin
+    platforms = platforms.linux;
   };
 
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c30e5a9a8db..60b755cd537 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -18175,7 +18175,6 @@ with pkgs;
     libmfx = if stdenv.isDarwin then null else intel-media-sdk;
     libpulseaudio = if stdenv.isDarwin then null else libpulseaudio;
     samba = if stdenv.isDarwin then null else samba;
-    vid-stab = if stdenv.isDarwin then null else vid-stab;
     inherit (darwin.apple_sdk.frameworks)
       Cocoa CoreServices CoreAudio AVFoundation MediaToolbox
       VideoDecodeAcceleration;
@@ -21024,8 +21023,8 @@ with pkgs;
     openssl = openssl_1_1;
   };
 
-  opencolorio = callPackage ../development/libraries/opencolorio {
-    inherit (darwin.apple_sdk.frameworks) Carbon GLUT Cocoa;
+  opencolorio = darwin.apple_sdk_11_0.callPackage ../development/libraries/opencolorio {
+    inherit (darwin.apple_sdk_11_0.frameworks) Carbon GLUT Cocoa;
   };
   opencolorio_1 = callPackage ../development/libraries/opencolorio/1.x.nix { };
 
@@ -21563,6 +21562,8 @@ with pkgs;
     autoreconfHook = buildPackages.autoreconfHook269;
   };
 
+  scope-lite = callPackage ../development/libraries/scope-lite { };
+
   SDL_classic = callPackage ../development/libraries/SDL ({
     inherit (darwin.apple_sdk.frameworks) OpenGL CoreAudio CoreServices AudioUnit Kernel Cocoa GLUT;
   } // lib.optionalAttrs stdenv.hostPlatform.isAndroid {
@@ -21861,6 +21862,8 @@ with pkgs;
 
   stb = callPackage ../development/libraries/stb { };
 
+  stduuid = callPackage ../development/libraries/stduuid { };
+
   stegsolve = callPackage ../tools/graphics/stegsolve { };
 
   StormLib = callPackage ../development/libraries/StormLib { };
@@ -23465,6 +23468,8 @@ with pkgs;
   };
   percona-server = percona-server56;
 
+  immudb = callPackage ../servers/nosql/immudb { };
+
   influxdb = callPackage ../servers/nosql/influxdb {
     # pinned due to build failure or vendoring problems. When unpinning double check with: nix-build -A $name.go-modules --rebuild
     buildGoModule = buildGo117Module;
@@ -34683,6 +34688,8 @@ with pkgs;
 
   rankwidth = callPackage ../development/libraries/science/math/rankwidth { };
 
+  latte-integrale = callPackage ../development/libraries/science/math/latte-integrale { };
+
   lcalc = callPackage ../development/libraries/science/math/lcalc { };
 
   lrcalc = callPackage ../applications/science/math/lrcalc { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index d7e6e75901f..573c9e3bc44 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6105,6 +6105,8 @@ in {
     enablePython = true; # ... and its Python bindings
   })).python;
 
+  niaarm = callPackage ../development/python-modules/niaarm { };
+
   niapy = callPackage ../development/python-modules/niapy { };
 
   nibabel = callPackage ../development/python-modules/nibabel { };