summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--doc/builders/fetchers.chapter.md4
-rw-r--r--doc/languages-frameworks/texlive.section.md2
-rw-r--r--lib/default.nix5
-rw-r--r--lib/modules.nix6
-rw-r--r--lib/trivial.nix19
-rw-r--r--nixos/lib/testing-python.nix30
-rw-r--r--nixos/modules/installer/tools/tools.nix2
-rw-r--r--nixos/modules/module-list.nix1
-rw-r--r--nixos/modules/services/misc/moonraker.nix40
-rw-r--r--nixos/modules/services/misc/nix-gc.nix10
-rw-r--r--nixos/modules/services/misc/nix-optimise.nix10
-rw-r--r--nixos/modules/services/networking/https-dns-proxy.nix128
-rw-r--r--nixos/modules/services/system/earlyoom.nix98
-rw-r--r--nixos/modules/tasks/network-interfaces-scripted.nix2
-rw-r--r--nixos/modules/tasks/network-interfaces-systemd.nix2
-rw-r--r--nixos/modules/tasks/network-interfaces.nix11
-rw-r--r--nixos/modules/virtualisation/qemu-vm.nix2
-rw-r--r--nixos/tests/all-tests.nix2
-rw-r--r--nixos/tests/boot.nix1
-rw-r--r--nixos/tests/caddy.nix6
-rw-r--r--nixos/tests/ceph-multi-node.nix2
-rw-r--r--nixos/tests/chromium.nix38
-rw-r--r--nixos/tests/cri-o.nix2
-rw-r--r--nixos/tests/earlyoom.nix16
-rw-r--r--nixos/tests/gitolite-fcgiwrap.nix2
-rw-r--r--nixos/tests/jitsi-meet.nix4
-rw-r--r--nixos/tests/misc.nix6
-rw-r--r--nixos/tests/moonraker.nix45
-rw-r--r--nixos/tests/networking.nix12
-rw-r--r--nixos/tests/rstudio-server.nix6
-rw-r--r--nixos/tests/step-ca.nix4
-rw-r--r--nixos/tests/tor.nix25
-rw-r--r--nixos/tests/without-nix.nix21
-rw-r--r--pkgs/applications/audio/magnetophonDSP/faustCompressors/default.nix2
-rw-r--r--pkgs/applications/audio/sound-juicer/default.nix10
-rw-r--r--pkgs/applications/emulators/ryujinx/default.nix6
-rw-r--r--pkgs/applications/graphics/xournal/default.nix6
-rw-r--r--pkgs/applications/misc/gosmore/default.nix6
-rw-r--r--pkgs/applications/misc/lighthouse/default.nix4
-rw-r--r--pkgs/applications/misc/mucommander/default.nix8
-rw-r--r--pkgs/applications/misc/obsidian/default.nix3
-rw-r--r--pkgs/applications/misc/pdfdiff/default.nix8
-rw-r--r--pkgs/applications/misc/pdfpc/default.nix7
-rw-r--r--pkgs/applications/misc/qmetro/default.nix5
-rw-r--r--pkgs/applications/misc/sleepyhead/default.nix6
-rw-r--r--pkgs/applications/misc/slmenu/default.nix31
-rw-r--r--pkgs/applications/misc/tuhi/default.nix6
-rw-r--r--pkgs/applications/misc/urlview/default.nix10
-rw-r--r--pkgs/applications/misc/xmr-stak/default.nix2
-rw-r--r--pkgs/applications/misc/zscroll/default.nix6
-rw-r--r--pkgs/applications/networking/browsers/firefox-bin/default.nix2
-rw-r--r--pkgs/applications/networking/browsers/firefox/common.nix374
-rw-r--r--pkgs/applications/networking/browsers/firefox/librewolf/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/firefox/wrapper.nix31
-rw-r--r--pkgs/applications/networking/cluster/cmctl/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/werf/default.nix6
-rw-r--r--pkgs/applications/networking/instant-messengers/fractal/default.nix13
-rw-r--r--pkgs/applications/networking/instant-messengers/signal-desktop/default.nix4
-rw-r--r--pkgs/applications/networking/mailreaders/thunderbird/packages.nix2
-rw-r--r--pkgs/applications/networking/p2p/frostwire/default.nix12
-rw-r--r--pkgs/applications/networking/remote/vmware-horizon-client/default.nix3
-rw-r--r--pkgs/applications/office/jameica/default.nix12
-rw-r--r--pkgs/applications/radio/rtl-ais/default.nix2
-rw-r--r--pkgs/applications/radio/sdrplay/default.nix2
-rw-r--r--pkgs/applications/radio/soapysdrplay/default.nix4
-rw-r--r--pkgs/applications/radio/soundmodem/default.nix6
-rw-r--r--pkgs/applications/science/biology/ncbi-tools/default.nix6
-rw-r--r--pkgs/applications/science/chemistry/marvin/default.nix4
-rw-r--r--pkgs/applications/science/electronics/xcircuit/default.nix12
-rw-r--r--pkgs/applications/science/logic/coq/default.nix1
-rw-r--r--pkgs/applications/science/logic/z3/4.4.0.nix2
-rw-r--r--pkgs/applications/science/math/fricas/default.nix9
-rw-r--r--pkgs/applications/science/math/scilab-bin/default.nix37
-rw-r--r--pkgs/applications/science/misc/fityk/default.nix7
-rw-r--r--pkgs/applications/terminal-emulators/rxvt-unicode-plugins/urxvt-font-size/default.nix2
-rw-r--r--pkgs/applications/terminal-emulators/termonad/default.nix3
-rw-r--r--pkgs/applications/version-management/git-and-tools/bfg-repo-cleaner/default.nix82
-rw-r--r--pkgs/applications/version-management/git-and-tools/git-secret/default.nix9
-rw-r--r--pkgs/applications/video/p2pvc/default.nix3
-rw-r--r--pkgs/applications/virtualization/OVMF/default.nix3
-rw-r--r--pkgs/applications/virtualization/containerd/default.nix4
-rw-r--r--pkgs/applications/virtualization/crun/default.nix4
-rw-r--r--pkgs/applications/virtualization/docker/default.nix8
-rw-r--r--pkgs/applications/virtualization/docker/gc.nix6
-rw-r--r--pkgs/applications/virtualization/docker/proxy.nix6
-rw-r--r--pkgs/applications/virtualization/gvisor/containerd-shim.nix4
-rw-r--r--pkgs/applications/virtualization/gvisor/default.nix2
-rw-r--r--pkgs/applications/virtualization/qemu/utils.nix4
-rw-r--r--pkgs/applications/virtualization/virt-viewer/default.nix5
-rw-r--r--pkgs/applications/window-managers/clfswm/default.nix5
-rw-r--r--pkgs/applications/window-managers/taffybar/default.nix3
-rw-r--r--pkgs/applications/window-managers/xmonad/wrapper.nix3
-rw-r--r--pkgs/data/documentation/std-man-pages/default.nix7
-rw-r--r--pkgs/data/fonts/sarasa-gothic/default.nix4
-rw-r--r--pkgs/data/icons/faba-icon-theme/default.nix5
-rw-r--r--pkgs/data/icons/tango-icon-theme/default.nix5
-rw-r--r--pkgs/data/misc/brise/default.nix3
-rw-r--r--pkgs/data/misc/miscfiles/default.nix5
-rw-r--r--pkgs/data/misc/shared-desktop-ontologies/default.nix5
-rw-r--r--pkgs/data/themes/dracula-theme/default.nix2
-rw-r--r--pkgs/desktops/gnome/apps/gnome-notes/default.nix13
-rw-r--r--pkgs/desktops/gnome/core/gnome-dictionary/default.nix63
-rw-r--r--pkgs/desktops/gnome/core/gucharmap/default.nix8
-rw-r--r--pkgs/desktops/gnome/games/gnome-mahjongg/default.nix44
-rw-r--r--pkgs/desktops/gnome/games/gnome-tetravex/default.nix53
-rw-r--r--pkgs/desktops/gnome/games/hitori/default.nix13
-rw-r--r--pkgs/desktops/gnome/misc/gitg/default.nix10
-rw-r--r--pkgs/development/compilers/openjdk/8.nix81
-rw-r--r--pkgs/development/coq-modules/VST/default.nix1
-rw-r--r--pkgs/development/coq-modules/compcert/default.nix5
-rw-r--r--pkgs/development/interpreters/php/8.0.nix4
-rw-r--r--pkgs/development/interpreters/php/8.1.nix4
-rw-r--r--pkgs/development/libraries/bctoolbox/default.nix4
-rw-r--r--pkgs/development/libraries/cglm/default.nix4
-rw-r--r--pkgs/development/libraries/gcr/default.nix11
-rw-r--r--pkgs/development/libraries/libtoxcore/default.nix4
-rw-r--r--pkgs/development/ocaml-modules/biniou/1.0.nix2
-rw-r--r--pkgs/development/ocaml-modules/csv/1.5.nix8
-rw-r--r--pkgs/development/ocaml-modules/magick/default.nix34
-rw-r--r--pkgs/development/ocaml-modules/ocaml-libvirt/default.nix3
-rw-r--r--pkgs/development/python-modules/ansible-runner/default.nix4
-rw-r--r--pkgs/development/python-modules/auth0-python/default.nix4
-rw-r--r--pkgs/development/python-modules/azure-mgmt-applicationinsights/default.nix4
-rw-r--r--pkgs/development/python-modules/azure-mgmt-resource/default.nix4
-rw-r--r--pkgs/development/python-modules/bidict/default.nix4
-rw-r--r--pkgs/development/python-modules/blis/default.nix4
-rw-r--r--pkgs/development/python-modules/coqui-trainer/default.nix21
-rw-r--r--pkgs/development/python-modules/datasette/default.nix4
-rw-r--r--pkgs/development/python-modules/evdev/default.nix4
-rw-r--r--pkgs/development/python-modules/fakeredis/default.nix23
-rw-r--r--pkgs/development/python-modules/flake8-bugbear/default.nix4
-rw-r--r--pkgs/development/python-modules/gaphas/default.nix4
-rw-r--r--pkgs/development/python-modules/google-cloud-container/default.nix21
-rw-r--r--pkgs/development/python-modules/hahomematic/default.nix4
-rw-r--r--pkgs/development/python-modules/jdatetime/default.nix4
-rw-r--r--pkgs/development/python-modules/mkdocs-material/default.nix4
-rw-r--r--pkgs/development/python-modules/motionblinds/default.nix4
-rw-r--r--pkgs/development/python-modules/ndspy/default.nix40
-rw-r--r--pkgs/development/python-modules/ocrmypdf/default.nix6
-rw-r--r--pkgs/development/python-modules/pdfminer_six/default.nix6
-rw-r--r--pkgs/development/python-modules/pdfx/default.nix3
-rw-r--r--pkgs/development/python-modules/preprocess-cancellation/default.nix31
-rw-r--r--pkgs/development/python-modules/pulsectl/default.nix4
-rw-r--r--pkgs/development/python-modules/py-synologydsm-api/default.nix4
-rw-r--r--pkgs/development/python-modules/pyaussiebb/default.nix4
-rw-r--r--pkgs/development/python-modules/pygame/default.nix1
-rw-r--r--pkgs/development/python-modules/pypandoc/default.nix4
-rw-r--r--pkgs/development/python-modules/pysigma-backend-splunk/default.nix4
-rw-r--r--pkgs/development/python-modules/pysigma/default.nix4
-rw-r--r--pkgs/development/python-modules/pytorch/bin.nix5
-rw-r--r--pkgs/development/python-modules/pytorch/binary-hashes.nix65
-rwxr-xr-xpkgs/development/python-modules/pytorch/prefetch.sh17
-rw-r--r--pkgs/development/python-modules/pyudev/default.nix4
-rw-r--r--pkgs/development/python-modules/samsungtvws/default.nix4
-rw-r--r--pkgs/development/python-modules/scancode-toolkit/default.nix1
-rw-r--r--pkgs/development/python-modules/sense-energy/default.nix4
-rw-r--r--pkgs/development/python-modules/teslajsonpy/default.nix4
-rw-r--r--pkgs/development/python-modules/torchaudio/bin.nix8
-rw-r--r--pkgs/development/python-modules/torchaudio/binary-hashes.nix60
-rwxr-xr-xpkgs/development/python-modules/torchaudio/prefetch.sh17
-rw-r--r--pkgs/development/python-modules/torchvision/bin.nix5
-rw-r--r--pkgs/development/python-modules/torchvision/binary-hashes.nix60
-rwxr-xr-xpkgs/development/python-modules/torchvision/prefetch.sh17
-rw-r--r--pkgs/development/python-modules/yamale/default.nix4
-rw-r--r--pkgs/development/tools/analysis/checkov/default.nix4
-rw-r--r--pkgs/development/tools/analysis/tfsec/default.nix6
-rw-r--r--pkgs/development/tools/continuous-integration/gitlab-runner/default.nix4
-rw-r--r--pkgs/development/tools/efm-langserver/default.nix6
-rw-r--r--pkgs/development/tools/glade/default.nix20
-rw-r--r--pkgs/development/tools/ocaml/cppo/default.nix2
-rw-r--r--pkgs/development/tools/wrangler/default.nix6
-rw-r--r--pkgs/development/tools/yarn2nix-moretea/yarn2nix/default.nix12
-rw-r--r--pkgs/development/web/grails/default.nix4
-rw-r--r--pkgs/misc/cups/drivers/mfcl2750dw/default.nix93
-rw-r--r--pkgs/os-specific/linux/earlyoom/default.nix6
-rw-r--r--pkgs/os-specific/linux/kernel/common-config.nix1
-rw-r--r--pkgs/os-specific/linux/projecteur/default.nix32
-rw-r--r--pkgs/servers/dns/https-dns-proxy/default.nix6
-rw-r--r--pkgs/servers/icingaweb2/default.nix4
-rw-r--r--pkgs/servers/icingaweb2/ipl.nix4
-rw-r--r--pkgs/servers/keycloak/default.nix8
-rw-r--r--pkgs/servers/klipper/default.nix5
-rw-r--r--pkgs/servers/minio/default.nix6
-rw-r--r--pkgs/servers/monitoring/prometheus/blackbox-exporter.nix6
-rw-r--r--pkgs/servers/monitoring/prometheus/node-exporter.nix12
-rw-r--r--pkgs/servers/monitoring/prometheus/node-exporter/node-exporter-darwin.patch17
-rw-r--r--pkgs/servers/moonraker/default.nix20
-rw-r--r--pkgs/servers/varnish/default.nix15
-rw-r--r--pkgs/servers/varnish/packages.nix6
-rw-r--r--pkgs/shells/zsh/oh-my-zsh/default.nix6
-rw-r--r--pkgs/test/nixos-functions/default.nix6
-rw-r--r--pkgs/tools/audio/tts/default.nix2
-rw-r--r--pkgs/tools/misc/nix-direnv/default.nix4
-rw-r--r--pkgs/tools/misc/remind/default.nix4
-rw-r--r--pkgs/tools/networking/aardvark-dns/default.nix16
-rw-r--r--pkgs/tools/networking/drill/default.nix3
-rw-r--r--pkgs/tools/networking/lychee/default.nix6
-rw-r--r--pkgs/tools/networking/mqttui/default.nix6
-rw-r--r--pkgs/tools/networking/netavark/default.nix19
-rw-r--r--pkgs/tools/networking/tuntox/default.nix3
-rw-r--r--pkgs/tools/security/gitleaks/default.nix6
-rw-r--r--pkgs/tools/security/grype/default.nix4
-rw-r--r--pkgs/tools/security/sigma-cli/default.nix4
-rw-r--r--pkgs/tools/system/ctop/default.nix8
-rw-r--r--pkgs/tools/system/nats-top/default.nix6
-rw-r--r--pkgs/tools/text/gnused/422.nix35
-rw-r--r--pkgs/top-level/aliases.nix1
-rw-r--r--pkgs/top-level/all-packages.nix34
-rw-r--r--pkgs/top-level/ocaml-packages.nix2
-rw-r--r--pkgs/top-level/python-packages.nix4
210 files changed, 1789 insertions, 1012 deletions
diff --git a/doc/builders/fetchers.chapter.md b/doc/builders/fetchers.chapter.md
index 28388ba685d..d9f22b06282 100644
--- a/doc/builders/fetchers.chapter.md
+++ b/doc/builders/fetchers.chapter.md
@@ -72,6 +72,10 @@ Used with Mercurial. Expects `url`, `rev`, and `sha256`.
 
 A number of fetcher functions wrap part of `fetchurl` and `fetchzip`. They are mainly convenience functions intended for commonly used destinations of source code in Nixpkgs. These wrapper fetchers are listed below.
 
+## `fetchFromGitea` {#fetchfromgitea}
+
+`fetchFromGitea` expects five arguments. `domain` is the gitea server name. `owner` is a string corresponding to the Gitea user or organization that controls this repository. `repo` corresponds to the name of the software repository. These are located at the top of every Gitea HTML page as `owner`/`repo`. `rev` corresponds to the Git commit hash or tag (e.g `v1.0`) that will be downloaded from Git. Finally, `sha256` corresponds to the hash of the extracted directory. Again, other hash algorithms are also available but `sha256` is currently preferred.
+
 ## `fetchFromGitHub` {#fetchfromgithub}
 
 `fetchFromGitHub` expects four arguments. `owner` is a string corresponding to the GitHub user or organization that controls this repository. `repo` corresponds to the name of the software repository. These are located at the top of every GitHub HTML page as `owner`/`repo`. `rev` corresponds to the Git commit hash or tag (e.g `v1.0`) that will be downloaded from Git. Finally, `sha256` corresponds to the hash of the extracted directory. Again, other hash algorithms are also available but `sha256` is currently preferred.
diff --git a/doc/languages-frameworks/texlive.section.md b/doc/languages-frameworks/texlive.section.md
index 6b505cefcc9..060f5c647c2 100644
--- a/doc/languages-frameworks/texlive.section.md
+++ b/doc/languages-frameworks/texlive.section.md
@@ -6,7 +6,7 @@ Since release 15.09 there is a new TeX Live packaging that lives entirely under
 
 - For basic usage just pull `texlive.combined.scheme-basic` for an environment with basic LaTeX support.
 
-- It typically won't work to use separately installed packages together. Instead, you can build a custom set of packages like this:
+- It typically won't work to use separately installed packages together. Instead, you can build a custom set of packages like this. Most CTAN packages should be available:
 
   ```nix
   texlive.combine {
diff --git a/lib/default.nix b/lib/default.nix
index 6f7930c5343..0e94e821bea 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -68,7 +68,8 @@ let
       bitNot boolToString mergeAttrs flip mapNullable inNixShell isFloat min max
       importJSON importTOML warn warnIf throwIfNot checkListOfEnum
       info showWarnings nixpkgsVersion version isInOldestRelease
-      mod compare splitByAndCompare functionArgs setFunctionArgs isFunction
+      mod compare splitByAndCompare
+      functionArgs setFunctionArgs isFunction toFunction
       toHexString toBaseDigits;
     inherit (self.fixedPoints) fix fix' converge extends composeExtensions
       composeManyExtensions makeExtensible makeExtensibleWithCustomName;
@@ -113,7 +114,7 @@ let
       commitIdFromGitRepo cleanSourceWith pathHasContext
       canCleanSource pathIsRegularFile pathIsGitRepo;
     inherit (self.modules) evalModules setDefaultModuleLocation
-      unifyModuleSyntax applyIfFunction mergeModules
+      unifyModuleSyntax applyModuleArgsIfFunction mergeModules
       mergeModules' mergeOptionDecls evalOptionValue mergeDefinitions
       pushDownProperties dischargeProperties filterOverrides
       sortProperties fixupOptionType mkIf mkAssert mkMerge mkOverride
diff --git a/lib/modules.nix b/lib/modules.nix
index 9bb8bfbbdf1..35c93d22baf 100644
--- a/lib/modules.nix
+++ b/lib/modules.nix
@@ -282,11 +282,11 @@ rec {
       # Like unifyModuleSyntax, but also imports paths and calls functions if necessary
       loadModule = args: fallbackFile: fallbackKey: m:
         if isFunction m || isAttrs m then
-          unifyModuleSyntax fallbackFile fallbackKey (applyIfFunction fallbackKey m args)
+          unifyModuleSyntax fallbackFile fallbackKey (applyModuleArgsIfFunction fallbackKey m args)
         else if isList m then
           let defs = [{ file = fallbackFile; value = m; }]; in
           throw "Module imports can't be nested lists. Perhaps you meant to remove one level of lists? Definitions: ${showDefs defs}"
-        else unifyModuleSyntax (toString m) (toString m) (applyIfFunction (toString m) (import m) args);
+        else unifyModuleSyntax (toString m) (toString m) (applyModuleArgsIfFunction (toString m) (import m) args);
 
       /*
       Collects all modules recursively into the form
@@ -383,7 +383,7 @@ rec {
         config = addFreeformType (addMeta (removeAttrs m ["_file" "key" "disabledModules" "require" "imports" "freeformType"]));
       };
 
-  applyIfFunction = key: f: args@{ config, options, lib, ... }: if isFunction f then
+  applyModuleArgsIfFunction = key: f: args@{ config, options, lib, ... }: if isFunction f then
     let
       # Module arguments are resolved in a strict manner when attribute set
       # deconstruction is used.  As the arguments are now defined with the
diff --git a/lib/trivial.nix b/lib/trivial.nix
index 543680a1080..18616a189c2 100644
--- a/lib/trivial.nix
+++ b/lib/trivial.nix
@@ -441,6 +441,25 @@ rec {
   isFunction = f: builtins.isFunction f ||
     (f ? __functor && isFunction (f.__functor f));
 
+  /*
+    Turns any non-callable values into constant functions.
+    Returns callable values as is.
+
+    Example:
+
+      nix-repl> lib.toFunction 1 2
+      1
+
+      nix-repl> lib.toFunction (x: x + 1) 2
+      3
+  */
+  toFunction =
+    # Any value
+    v:
+    if isFunction v
+    then v
+    else k: v;
+
   /* Convert the given positive integer to a string of its hexadecimal
      representation. For example:
 
diff --git a/nixos/lib/testing-python.nix b/nixos/lib/testing-python.nix
index 0d3c3a89e78..facc7a253a7 100644
--- a/nixos/lib/testing-python.nix
+++ b/nixos/lib/testing-python.nix
@@ -146,26 +146,28 @@ rec {
 
   # Make a full-blown test
   makeTest =
-    { testScript
+    { machine ? null
+    , nodes ? {}
+    , testScript
     , enableOCR ? false
     , name ? "unnamed"
       # Skip linting (mainly intended for faster dev cycles)
     , skipLint ? false
     , passthru ? {}
+    , meta ? {}
     , # For meta.position
       pos ? # position used in error messages and for meta.position
-        (if t.meta.description or null != null
-          then builtins.unsafeGetAttrPos "description" t.meta
+        (if meta.description or null != null
+          then builtins.unsafeGetAttrPos "description" meta
           else builtins.unsafeGetAttrPos "testScript" t)
-    , ...
     } @ t:
     let
-      nodes = qemu_pkg:
+      mkNodes = qemu_pkg:
         let
           testScript' =
             # Call the test script with the computed nodes.
             if lib.isFunction testScript
-            then testScript { nodes = nodes qemu_pkg; }
+            then testScript { nodes = mkNodes qemu_pkg; }
             else testScript;
 
           build-vms = import ./build-vms.nix {
@@ -205,33 +207,29 @@ rec {
           };
         in
           build-vms.buildVirtualNetwork (
-              t.nodes or (if t ? machine then { machine = t.machine; } else { })
+              nodes // lib.optionalAttrs (machine != null) { inherit machine; }
           );
 
       driver = setupDriverForTest {
         inherit testScript enableOCR skipLint passthru;
         testName = name;
         qemu_pkg = pkgs.qemu_test;
-        nodes = nodes pkgs.qemu_test;
+        nodes = mkNodes pkgs.qemu_test;
       };
       driverInteractive = setupDriverForTest {
         inherit testScript enableOCR skipLint passthru;
         testName = name;
         qemu_pkg = pkgs.qemu;
-        nodes = nodes pkgs.qemu;
+        nodes = mkNodes pkgs.qemu;
         interactive = true;
       };
 
-      test =
-        let
-          passMeta = drv: drv // lib.optionalAttrs (t ? meta) {
-            meta = (drv.meta or { }) // t.meta;
-          };
-        in passMeta (runTests { inherit driver pos driverInteractive; });
+      test = lib.addMetaAttrs meta (runTests { inherit driver pos driverInteractive; });
 
     in
       test // {
-        inherit test driver driverInteractive nodes;
+        inherit test driver driverInteractive;
+        inherit (driver) nodes;
       };
 
   abortForFunction = functionName: abort ''The ${functionName} function was
diff --git a/nixos/modules/installer/tools/tools.nix b/nixos/modules/installer/tools/tools.nix
index 71aaf7f253d..2e088b97771 100644
--- a/nixos/modules/installer/tools/tools.nix
+++ b/nixos/modules/installer/tools/tools.nix
@@ -117,7 +117,7 @@ in
     '';
   };
 
-  config = lib.mkIf (!config.system.disableInstallerTools) {
+  config = lib.mkIf (config.nix.enable && !config.system.disableInstallerTools) {
 
     system.nixos-generate-config.configuration = mkDefault ''
       # Edit this configuration file to define what should be installed on
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index e80c6cf90f5..93172aa0824 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -777,6 +777,7 @@
   ./services/networking/headscale.nix
   ./services/networking/hostapd.nix
   ./services/networking/htpdate.nix
+  ./services/networking/https-dns-proxy.nix
   ./services/networking/hylafax/default.nix
   ./services/networking/i2pd.nix
   ./services/networking/i2p.nix
diff --git a/nixos/modules/services/misc/moonraker.nix b/nixos/modules/services/misc/moonraker.nix
index ae57aaa6d47..b75227effa0 100644
--- a/nixos/modules/services/misc/moonraker.nix
+++ b/nixos/modules/services/misc/moonraker.nix
@@ -79,6 +79,19 @@ in {
           for supported values.
         '';
       };
+
+      allowSystemControl = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to allow Moonraker to perform system-level operations.
+
+          Moonraker exposes APIs to perform system-level operations, such as
+          reboot, shutdown, and management of systemd units. See the
+          <link xlink:href="https://moonraker.readthedocs.io/en/latest/web_api/#machine-commands">documentation</link>
+          for details on what clients are able to do.
+        '';
+      };
     };
   };
 
@@ -86,6 +99,13 @@ in {
     warnings = optional (cfg.settings ? update_manager)
       ''Enabling update_manager is not supported on NixOS and will lead to non-removable warnings in some clients.'';
 
+    assertions = [
+      {
+        assertion = cfg.allowSystemControl -> config.security.polkit.enable;
+        message = "services.moonraker.allowSystemControl requires polkit to be enabled (security.polkit.enable).";
+      }
+    ];
+
     users.users = optionalAttrs (cfg.user == "moonraker") {
       moonraker = {
         group = cfg.group;
@@ -128,11 +148,31 @@ in {
         exec ${pkg}/bin/moonraker -c ${cfg.configDir}/moonraker-temp.cfg
       '';
 
+      # Needs `ip` command
+      path = [ pkgs.iproute2 ];
+
       serviceConfig = {
         WorkingDirectory = cfg.stateDir;
         Group = cfg.group;
         User = cfg.user;
       };
     };
+
+    security.polkit.extraConfig = lib.optionalString cfg.allowSystemControl ''
+      // nixos/moonraker: Allow Moonraker to perform system-level operations
+      //
+      // This was enabled via services.moonraker.allowSystemControl.
+      polkit.addRule(function(action, subject) {
+        if ((action.id == "org.freedesktop.systemd1.manage-units" ||
+             action.id == "org.freedesktop.login1.power-off" ||
+             action.id == "org.freedesktop.login1.power-off-multiple-sessions" ||
+             action.id == "org.freedesktop.login1.reboot" ||
+             action.id == "org.freedesktop.login1.reboot-multiple-sessions" ||
+             action.id.startsWith("org.freedesktop.packagekit.")) &&
+             subject.user == "${cfg.user}") {
+          return polkit.Result.YES;
+        }
+      });
+    '';
   };
 }
diff --git a/nixos/modules/services/misc/nix-gc.nix b/nixos/modules/services/misc/nix-gc.nix
index a7a6a3b5964..b4b4b55a6c8 100644
--- a/nixos/modules/services/misc/nix-gc.nix
+++ b/nixos/modules/services/misc/nix-gc.nix
@@ -81,8 +81,14 @@ in
   ###### implementation
 
   config = {
-
-    systemd.services.nix-gc = {
+    assertions = [
+      {
+        assertion = cfg.automatic -> config.nix.enable;
+        message = ''nix.gc.automatic requires nix.enable'';
+      }
+    ];
+
+    systemd.services.nix-gc = lib.mkIf config.nix.enable {
       description = "Nix Garbage Collector";
       script = "exec ${config.nix.package.out}/bin/nix-collect-garbage ${cfg.options}";
       startAt = optional cfg.automatic cfg.dates;
diff --git a/nixos/modules/services/misc/nix-optimise.nix b/nixos/modules/services/misc/nix-optimise.nix
index e02026d5f76..acf8177b146 100644
--- a/nixos/modules/services/misc/nix-optimise.nix
+++ b/nixos/modules/services/misc/nix-optimise.nix
@@ -37,8 +37,14 @@ in
   ###### implementation
 
   config = {
-
-    systemd.services.nix-optimise =
+    assertions = [
+      {
+        assertion = cfg.automatic -> config.nix.enable;
+        message = ''nix.optimise.automatic requires nix.enable'';
+      }
+    ];
+
+    systemd.services.nix-optimise = lib.mkIf config.nix.enable
       { description = "Nix Store Optimiser";
         # No point this if the nix daemon (and thus the nix store) is outside
         unitConfig.ConditionPathIsReadWrite = "/nix/var/nix/daemon-socket";
diff --git a/nixos/modules/services/networking/https-dns-proxy.nix b/nixos/modules/services/networking/https-dns-proxy.nix
new file mode 100644
index 00000000000..85d6c362b46
--- /dev/null
+++ b/nixos/modules/services/networking/https-dns-proxy.nix
@@ -0,0 +1,128 @@
+{ config, lib, pkgs, ... }:
+
+let
+  inherit (lib)
+    concatStringsSep
+    mkEnableOption mkIf mkOption types;
+
+  cfg = config.services.https-dns-proxy;
+
+  providers = {
+    cloudflare = {
+      ips = [ "1.1.1.1" "1.0.0.1" ];
+      url = "https://cloudflare-dns.com/dns-query";
+    };
+    google = {
+      ips = [ "8.8.8.8" "8.8.4.4" ];
+      url = "https://dns.google/dns-query";
+    };
+    quad9 = {
+      ips = [ "9.9.9.9" "149.112.112.112" ];
+      url = "https://dns.quad9.net/dns-query";
+    };
+  };
+
+  defaultProvider = "quad9";
+
+  providerCfg =
+    let
+      isCustom = cfg.provider.kind == "custom";
+    in
+    lib.concatStringsSep " " [
+      "-b"
+      (concatStringsSep "," (if isCustom then cfg.provider.ips else providers."${cfg.provider.kind}".ips))
+      "-r"
+      (if isCustom then cfg.provider.url else providers."${cfg.provider.kind}".url)
+    ];
+
+in
+{
+  meta.maintainers = with lib.maintainers; [ peterhoeg ];
+
+  ###### interface
+
+  options.services.https-dns-proxy = {
+    enable = mkEnableOption "https-dns-proxy daemon";
+
+    address = mkOption {
+      description = "The address on which to listen";
+      type = types.str;
+      default = "127.0.0.1";
+    };
+
+    port = mkOption {
+      description = "The port on which to listen";
+      type = types.port;
+      default = 5053;
+    };
+
+    provider = {
+      kind = mkOption {
+        description = ''
+          The upstream provider to use or custom in case you do not trust any of
+          the predefined providers or just want to use your own.
+
+          The default is ${defaultProvider} and there are privacy and security trade-offs
+          when using any upstream provider. Please consider that before using any
+          of them.
+
+          If you pick a custom provider, you will need to provide the bootstrap
+          IP addresses as well as the resolver https URL.
+        '';
+        type = types.enum ((builtins.attrNames providers) ++ [ "custom" ]);
+        default = defaultProvider;
+      };
+
+      ips = mkOption {
+        description = "The custom provider IPs";
+        type = types.listOf types.str;
+      };
+
+      url = mkOption {
+        description = "The custom provider URL";
+        type = types.str;
+      };
+    };
+
+    preferIPv4 = mkOption {
+      description = ''
+        https_dns_proxy will by default use IPv6 and fail if it is not available.
+        To play it safe, we choose IPv4.
+      '';
+      type = types.bool;
+      default = true;
+    };
+
+    extraArgs = mkOption {
+      description = "Additional arguments to pass to the process.";
+      type = types.listOf types.str;
+      default = [ "-v" ];
+    };
+  };
+
+  ###### implementation
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.https-dns-proxy = {
+      description = "DNS to DNS over HTTPS (DoH) proxy";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = rec {
+        Type = "exec";
+        DynamicUser = true;
+        ExecStart = lib.concatStringsSep " " (
+          [
+            "${pkgs.https-dns-proxy}/bin/https_dns_proxy"
+            "-a ${toString cfg.address}"
+            "-p ${toString cfg.port}"
+            "-l -"
+            providerCfg
+          ]
+          ++ lib.optional cfg.preferIPv4 "-4"
+          ++ cfg.extraArgs
+        );
+        Restart = "on-failure";
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/system/earlyoom.nix b/nixos/modules/services/system/earlyoom.nix
index ddd5bcebcdd..62935855989 100644
--- a/nixos/modules/services/system/earlyoom.nix
+++ b/nixos/modules/services/system/earlyoom.nix
@@ -5,8 +5,8 @@ let
 
   inherit (lib)
     mkDefault mkEnableOption mkIf mkOption types
-    mkRemovedOptionModule
-    concatStringsSep optional;
+    mkRemovedOptionModule literalExpression
+    escapeShellArg concatStringsSep optional optionalString;
 
 in
 {
@@ -17,10 +17,26 @@ in
       type = types.ints.between 1 100;
       default = 10;
       description = ''
-        Minimum of availabe memory (in percent).
-        If the free memory falls below this threshold and the analog is true for
-        <option>services.earlyoom.freeSwapThreshold</option>
-        the killing begins.
+        Minimum available memory (in percent).
+
+        If the available memory falls below this threshold (and the analog is true for
+        <option>freeSwapThreshold</option>) the killing begins.
+        SIGTERM is sent first to the process that uses the most memory; then, if the available
+        memory falls below <option>freeMemKillThreshold</option> (and the analog is true for
+        <option>freeSwapKillThreshold</option>), SIGKILL is sent.
+
+        See <link xlink:href="https://github.com/rfjakob/earlyoom#command-line-options">README</link> for details.
+      '';
+    };
+
+    freeMemKillThreshold = mkOption {
+      type = types.nullOr (types.ints.between 1 100);
+      default = null;
+      description = ''
+        Minimum available memory (in percent) before sending SIGKILL.
+        If unset, this defaults to half of <option>freeMemThreshold</option>.
+
+        See the description of <xref linkend="opt-services.earlyoom.freeMemThreshold"/>.
       '';
     };
 
@@ -28,19 +44,20 @@ in
       type = types.ints.between 1 100;
       default = 10;
       description = ''
-        Minimum of availabe swap space (in percent).
-        If the available swap space falls below this threshold and the analog
-        is true for <option>services.earlyoom.freeMemThreshold</option>
-        the killing begins.
+        Minimum free swap space (in percent) before sending SIGTERM.
+
+        See the description of <xref linkend="opt-services.earlyoom.freeMemThreshold"/>.
       '';
     };
 
-    # TODO: remove or warn after 1.7 (https://github.com/rfjakob/earlyoom/commit/7ebc4554)
-    ignoreOOMScoreAdjust = mkOption {
-      type = types.bool;
-      default = false;
+    freeSwapKillThreshold = mkOption {
+      type = types.nullOr (types.ints.between 1 100);
+      default = null;
       description = ''
-        Ignore oom_score_adjust values of processes.
+        Minimum free swap space (in percent) before sending SIGKILL.
+        If unset, this defaults to half of <option>freeSwapThreshold</option>.
+
+        See the description of <xref linkend="opt-services.earlyoom.freeMemThreshold"/>.
       '';
     };
 
@@ -63,12 +80,43 @@ in
         local user to DoS your session by spamming notifications.
 
         To actually see the notifications in your GUI session, you need to have
-        <literal>systembus-notify</literal> running as your user which this
-        option handles.
+        <literal>systembus-notify</literal> running as your user, which this
+        option handles by enabling <option>services.systembus-notify</option>.
 
         See <link xlink:href="https://github.com/rfjakob/earlyoom#notifications">README</link> for details.
       '';
     };
+
+    killHook = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      example = literalExpression ''
+        pkgs.writeShellScript "earlyoom-kill-hook" '''
+          echo "Process $EARLYOOM_NAME ($EARLYOOM_PID) was killed" >> /path/to/log
+        '''
+      '';
+      description = ''
+        An absolute path to an executable to be run for each process killed.
+        Some environment variables are available, see
+        <link xlink:href="https://github.com/rfjakob/earlyoom#notifications">README</link> and
+        <link xlink:href="https://github.com/rfjakob/earlyoom/blob/master/MANPAGE.md#-n-pathtoscript">the man page</link>
+        for details.
+      '';
+    };
+
+    reportInterval = mkOption {
+      type = types.int;
+      default = 3600;
+      example = 0;
+      description = "Interval (in seconds) at which a memory report is printed (set to 0 to disable).";
+    };
+
+    extraArgs = mkOption {
+      type = types.listOf types.str;
+      default = [];
+      example = [ "-g" "--prefer '(^|/)(java|chromium)$'" ];
+      description = "Extra command-line arguments to be passed to earlyoom.";
+    };
   };
 
   imports = [
@@ -76,7 +124,11 @@ in
       This option is deprecated and ignored by earlyoom since 1.2.
     '')
     (mkRemovedOptionModule [ "services" "earlyoom" "notificationsCommand" ] ''
-      This option is deprecated and ignored by earlyoom since 1.6.
+      This option was removed in earlyoom 1.6, but was reimplemented in 1.7
+      and is available as the new option `services.earlyoom.killHook`.
+    '')
+    (mkRemovedOptionModule [ "services" "earlyoom" "ignoreOOMScoreAdjust" ] ''
+      This option is deprecated and ignored by earlyoom since 1.7.
     '')
   ];
 
@@ -91,12 +143,16 @@ in
         StandardError = "journal";
         ExecStart = concatStringsSep " " ([
           "${pkgs.earlyoom}/bin/earlyoom"
-          "-m ${toString cfg.freeMemThreshold}"
-          "-s ${toString cfg.freeSwapThreshold}"
+          ("-m ${toString cfg.freeMemThreshold}"
+            + optionalString (cfg.freeMemKillThreshold != null) ",${toString cfg.freeMemKillThreshold}")
+          ("-s ${toString cfg.freeSwapThreshold}"
+            + optionalString (cfg.freeSwapKillThreshold != null) ",${toString cfg.freeSwapKillThreshold}")
+          "-r ${toString cfg.reportInterval}"
         ]
-        ++ optional cfg.ignoreOOMScoreAdjust "-i"
         ++ optional cfg.enableDebugInfo "-d"
         ++ optional cfg.enableNotifications "-n"
+        ++ optional (cfg.killHook != null) "-N ${escapeShellArg cfg.killHook}"
+        ++ cfg.extraArgs
         );
       };
     };
diff --git a/nixos/modules/tasks/network-interfaces-scripted.nix b/nixos/modules/tasks/network-interfaces-scripted.nix
index 19f2be2c4a2..b0f160c1dbf 100644
--- a/nixos/modules/tasks/network-interfaces-scripted.nix
+++ b/nixos/modules/tasks/network-interfaces-scripted.nix
@@ -535,6 +535,7 @@ let
         createGreDevice = n: v: nameValuePair "${n}-netdev"
           (let
             deps = deviceDependency v.dev;
+            ttlarg = if lib.hasPrefix "ip6" v.type then "hoplimit" else "ttl";
           in
           { description = "GRE Tunnel Interface ${n}";
             wantedBy = [ "network-setup.service" (subsystemDevice n) ];
@@ -551,6 +552,7 @@ let
               ip link add name "${n}" type ${v.type} \
                 ${optionalString (v.remote != null) "remote \"${v.remote}\""} \
                 ${optionalString (v.local != null) "local \"${v.local}\""} \
+                ${optionalString (v.ttl != null) "${ttlarg} ${toString v.ttl}"} \
                 ${optionalString (v.dev != null) "dev \"${v.dev}\""}
               ip link set "${n}" up
             '';
diff --git a/nixos/modules/tasks/network-interfaces-systemd.nix b/nixos/modules/tasks/network-interfaces-systemd.nix
index 8a5e1b5af11..8654539b662 100644
--- a/nixos/modules/tasks/network-interfaces-systemd.nix
+++ b/nixos/modules/tasks/network-interfaces-systemd.nix
@@ -318,6 +318,8 @@ in
               Remote = gre.remote;
             }) // (optionalAttrs (gre.local != null) {
               Local = gre.local;
+            }) // (optionalAttrs (gre.ttl != null) {
+              TTL = gre.ttl;
             });
         };
         networks = mkIf (gre.dev != null) {
diff --git a/nixos/modules/tasks/network-interfaces.nix b/nixos/modules/tasks/network-interfaces.nix
index 01980b80f1c..60b5a48b2e6 100644
--- a/nixos/modules/tasks/network-interfaces.nix
+++ b/nixos/modules/tasks/network-interfaces.nix
@@ -1020,12 +1020,14 @@ in
             local = "10.0.0.22";
             dev = "enp4s0f0";
             type = "tap";
+            ttl = 255;
           };
           gre6Tunnel = {
             remote = "fd7a:5634::1";
             local = "fd7a:5634::2";
             dev = "enp4s0f0";
             type = "tun6";
+            ttl = 255;
           };
         }
       '';
@@ -1063,6 +1065,15 @@ in
             '';
           };
 
+          ttl = mkOption {
+            type = types.nullOr types.int;
+            default = null;
+            example = 255;
+            description = ''
+              The time-to-live/hoplimit of the connection to the remote tunnel endpoint.
+            '';
+          };
+
           type = mkOption {
             type = with types; enum [ "tun" "tap" "tun6" "tap6" ];
             default = "tap";
diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix
index 51438935894..dacbb64a2da 100644
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@@ -796,7 +796,7 @@ in
     # allow `system.build.toplevel' to be included.  (If we had a direct
     # reference to ${regInfo} here, then we would get a cyclic
     # dependency.)
-    boot.postBootCommands =
+    boot.postBootCommands = lib.mkIf config.nix.enable
       ''
         if [[ "$(cat /proc/cmdline)" =~ regInfo=([^ ]*) ]]; then
           ${config.nix.package.out}/bin/nix-store --load-db < ''${BASH_REMATCH[1]}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index b6311f856fa..47587b1b30c 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -132,6 +132,7 @@ in
   domination = handleTest ./domination.nix {};
   dovecot = handleTest ./dovecot.nix {};
   drbd = handleTest ./drbd.nix {};
+  earlyoom = handleTestOn ["x86_64-linux"] ./earlyoom.nix {};
   ec2-config = (handleTestOn ["x86_64-linux"] ./ec2.nix {}).boot-ec2-config or {};
   ec2-nixops = (handleTestOn ["x86_64-linux"] ./ec2.nix {}).boot-ec2-nixops or {};
   ecryptfs = handleTest ./ecryptfs.nix {};
@@ -308,6 +309,7 @@ in
   molly-brown = handleTest ./molly-brown.nix {};
   mongodb = handleTest ./mongodb.nix {};
   moodle = handleTest ./moodle.nix {};
+  moonraker = handleTest ./moonraker.nix {};
   morty = handleTest ./morty.nix {};
   mosquitto = handleTest ./mosquitto.nix {};
   moosefs = handleTest ./moosefs.nix {};
diff --git a/nixos/tests/boot.nix b/nixos/tests/boot.nix
index cf556566713..ec2a9f6527c 100644
--- a/nixos/tests/boot.nix
+++ b/nixos/tests/boot.nix
@@ -38,7 +38,6 @@ let
       } // extraConfig);
     in
       makeTest {
-        inherit iso;
         name = "boot-" + name;
         nodes = { };
         testScript =
diff --git a/nixos/tests/caddy.nix b/nixos/tests/caddy.nix
index 0902904b208..16436ab5280 100644
--- a/nixos/tests/caddy.nix
+++ b/nixos/tests/caddy.nix
@@ -7,7 +7,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
   nodes = {
     webserver = { pkgs, lib, ... }: {
       services.caddy.enable = true;
-      services.caddy.config = ''
+      services.caddy.extraConfig = ''
         http://localhost {
           encode gzip
 
@@ -22,7 +22,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
       '';
 
       specialisation.etag.configuration = {
-        services.caddy.config = lib.mkForce ''
+        services.caddy.extraConfig = lib.mkForce ''
           http://localhost {
             encode gzip
 
@@ -38,7 +38,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
       };
 
       specialisation.config-reload.configuration = {
-        services.caddy.config = ''
+        services.caddy.extraConfig = ''
           http://localhost:8080 {
           }
         '';
diff --git a/nixos/tests/ceph-multi-node.nix b/nixos/tests/ceph-multi-node.nix
index 29e7c279d69..556546beee7 100644
--- a/nixos/tests/ceph-multi-node.nix
+++ b/nixos/tests/ceph-multi-node.nix
@@ -48,7 +48,7 @@ let
       sudo
       ceph
       xfsprogs
-      netcat-openbsd
+      libressl.nc
     ];
 
     boot.kernelModules = [ "xfs" ];
diff --git a/nixos/tests/chromium.nix b/nixos/tests/chromium.nix
index 8965646bc5d..3815dca7622 100644
--- a/nixos/tests/chromium.nix
+++ b/nixos/tests/chromium.nix
@@ -15,26 +15,9 @@
 with import ../lib/testing-python.nix { inherit system pkgs; };
 with pkgs.lib;
 
-mapAttrs (channel: chromiumPkg: makeTest rec {
-  name = "chromium-${channel}";
-  meta = {
-    maintainers = with maintainers; [ aszlig primeos ];
-    # https://github.com/NixOS/hydra/issues/591#issuecomment-435125621
-    inherit (chromiumPkg.meta) timeout;
-  };
-
-  enableOCR = true;
-
+let
   user = "alice";
 
-  machine.imports = [ ./common/user-account.nix ./common/x11.nix ];
-  machine.virtualisation.memorySize = 2047;
-  machine.test-support.displayManager.auto.user = user;
-  machine.environment = {
-    systemPackages = [ chromiumPkg ];
-    variables."XAUTHORITY" = "/home/alice/.Xauthority";
-  };
-
   startupHTML = pkgs.writeText "chromium-startup.html" ''
     <!DOCTYPE html>
     <html>
@@ -50,6 +33,25 @@ mapAttrs (channel: chromiumPkg: makeTest rec {
     </body>
     </html>
   '';
+in
+
+mapAttrs (channel: chromiumPkg: makeTest {
+  name = "chromium-${channel}";
+  meta = {
+    maintainers = with maintainers; [ aszlig primeos ];
+    # https://github.com/NixOS/hydra/issues/591#issuecomment-435125621
+    inherit (chromiumPkg.meta) timeout;
+  };
+
+  enableOCR = true;
+
+  machine.imports = [ ./common/user-account.nix ./common/x11.nix ];
+  machine.virtualisation.memorySize = 2047;
+  machine.test-support.displayManager.auto.user = user;
+  machine.environment = {
+    systemPackages = [ chromiumPkg ];
+    variables."XAUTHORITY" = "/home/alice/.Xauthority";
+  };
 
   testScript = let
     xdo = name: text: let
diff --git a/nixos/tests/cri-o.nix b/nixos/tests/cri-o.nix
index 91d46657f24..d3a8713d6a9 100644
--- a/nixos/tests/cri-o.nix
+++ b/nixos/tests/cri-o.nix
@@ -1,7 +1,7 @@
 # This test runs CRI-O and verifies via critest
 import ./make-test-python.nix ({ pkgs, ... }: {
   name = "cri-o";
-  maintainers = with pkgs.lib.maintainers; teams.podman.members;
+  meta.maintainers = with pkgs.lib.maintainers; teams.podman.members;
 
   nodes = {
     crio = {
diff --git a/nixos/tests/earlyoom.nix b/nixos/tests/earlyoom.nix
new file mode 100644
index 00000000000..75bdf56899b
--- /dev/null
+++ b/nixos/tests/earlyoom.nix
@@ -0,0 +1,16 @@
+import ./make-test-python.nix ({ lib, ... }: {
+  name = "earlyoom";
+  meta = {
+    maintainers = with lib.maintainers; [ ncfavier ];
+  };
+
+  machine = {
+    services.earlyoom = {
+      enable = true;
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("earlyoom.service")
+  '';
+})
diff --git a/nixos/tests/gitolite-fcgiwrap.nix b/nixos/tests/gitolite-fcgiwrap.nix
index 38f8d5c883f..abf1db37003 100644
--- a/nixos/tests/gitolite-fcgiwrap.nix
+++ b/nixos/tests/gitolite-fcgiwrap.nix
@@ -20,7 +20,7 @@ import ./make-test-python.nix (
         nodes = {
 
           server =
-            { ... }:
+            { config, ... }:
               {
                 networking.firewall.allowedTCPPorts = [ 80 ];
 
diff --git a/nixos/tests/jitsi-meet.nix b/nixos/tests/jitsi-meet.nix
index d95f7c2ea9e..41d53bc7380 100644
--- a/nixos/tests/jitsi-meet.nix
+++ b/nixos/tests/jitsi-meet.nix
@@ -21,9 +21,9 @@ import ./make-test-python.nix ({ pkgs, ... }: {
         forceSSL = true;
       };
 
-      security.acme.email = "me@example.org";
       security.acme.acceptTerms = true;
-      security.acme.server = "https://example.com"; # self-signed only
+      security.acme.defaults.email = "me@example.org";
+      security.acme.defaults.server = "https://example.com"; # self-signed only
     };
   };
 
diff --git a/nixos/tests/misc.nix b/nixos/tests/misc.nix
index 0587912c9a2..02513c4726c 100644
--- a/nixos/tests/misc.nix
+++ b/nixos/tests/misc.nix
@@ -1,13 +1,13 @@
 # Miscellaneous small tests that don't warrant their own VM run.
 
-import ./make-test-python.nix ({ pkgs, ...} : rec {
+import ./make-test-python.nix ({ pkgs, ...} : let
+  foo = pkgs.writeText "foo" "Hello World";
+in {
   name = "misc";
   meta = with pkgs.lib.maintainers; {
     maintainers = [ eelco ];
   };
 
-  foo = pkgs.writeText "foo" "Hello World";
-
   machine =
     { lib, ... }:
     with lib;
diff --git a/nixos/tests/moonraker.nix b/nixos/tests/moonraker.nix
new file mode 100644
index 00000000000..b0a93a4a608
--- /dev/null
+++ b/nixos/tests/moonraker.nix
@@ -0,0 +1,45 @@
+import ./make-test-python.nix ({ pkgs, ...} : {
+  name = "moonraker";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ zhaofengli ];
+  };
+
+  nodes = {
+    printer = { config, pkgs, ... }: {
+      security.polkit.enable = true;
+
+      services.moonraker = {
+        enable = true;
+        allowSystemControl = true;
+
+        settings = {
+          authorization = {
+            trusted_clients = [ "127.0.0.0/8" "::1/128" ];
+          };
+        };
+      };
+
+      services.klipper = {
+        enable = true;
+
+        user = "moonraker";
+        group = "moonraker";
+
+        # No mcu configured so won't even enter `ready` state
+        settings = {};
+      };
+    };
+  };
+
+  testScript = ''
+    printer.start()
+
+    printer.wait_for_unit("klipper.service")
+    printer.wait_for_unit("moonraker.service")
+    printer.wait_until_succeeds("curl http://localhost:7125/printer/info | grep -v 'Not Found' >&2", timeout=30)
+
+    with subtest("Check that we can perform system-level operations"):
+        printer.succeed("curl -X POST http://localhost:7125/machine/services/stop?service=klipper | grep ok >&2")
+        printer.wait_until_succeeds("systemctl --no-pager show klipper.service | grep ActiveState=inactive", timeout=10)
+  '';
+})
diff --git a/nixos/tests/networking.nix b/nixos/tests/networking.nix
index b763cbd4665..dc7938a436a 100644
--- a/nixos/tests/networking.nix
+++ b/nixos/tests/networking.nix
@@ -514,12 +514,14 @@ let
                   local = "192.168.2.1";
                   remote = "192.168.2.2";
                   dev = "eth2";
+                  ttl = 225;
                   type = "tap";
                 };
                 gre6Tunnel = {
                   local = "fd00:1234:5678:4::1";
                   remote = "fd00:1234:5678:4::2";
                   dev = "eth3";
+                  ttl = 255;
                   type = "tun6";
                 };
               };
@@ -548,12 +550,14 @@ let
                   local = "192.168.2.2";
                   remote = "192.168.2.1";
                   dev = "eth1";
+                  ttl = 225;
                   type = "tap";
                 };
                 gre6Tunnel = {
                   local = "fd00:1234:5678:4::2";
                   remote = "fd00:1234:5678:4::1";
                   dev = "eth3";
+                  ttl = 255;
                   type = "tun6";
                 };
               };
@@ -573,6 +577,7 @@ let
         ];
       testScript = { ... }:
         ''
+          import json
           start_all()
 
           with subtest("Wait for networking to be configured"):
@@ -591,6 +596,13 @@ let
               client1.wait_until_succeeds("ping -c 1 fc00::2")
 
               client2.wait_until_succeeds("ping -c 1 fc00::1")
+
+          with subtest("Test GRE tunnel TTL"):
+              links = json.loads(client1.succeed("ip -details -json link show greTunnel"))
+              assert links[0]['linkinfo']['info_data']['ttl'] == 225, "ttl not set for greTunnel"
+
+              links = json.loads(client2.succeed("ip -details -json link show gre6Tunnel"))
+              assert links[0]['linkinfo']['info_data']['ttl'] == 255, "ttl not set for gre6Tunnel"
         '';
     };
     vlan = let
diff --git a/nixos/tests/rstudio-server.nix b/nixos/tests/rstudio-server.nix
index c7ac7670fbd..dd5fe3e5b44 100644
--- a/nixos/tests/rstudio-server.nix
+++ b/nixos/tests/rstudio-server.nix
@@ -14,12 +14,6 @@ import ./make-test-python.nix ({ pkgs, ... }:
       };
     };
 
-    users.testuser = {
-      uid = 1000;
-      group = "testgroup";
-    };
-    groups.testgroup.gid = 1000;
-
     testScript = ''
       machine.wait_for_unit("rstudio-server.service")
       machine.succeed("curl -f -vvv -s http://127.0.0.1:8787")
diff --git a/nixos/tests/step-ca.nix b/nixos/tests/step-ca.nix
index b22bcb060f2..f21bd536626 100644
--- a/nixos/tests/step-ca.nix
+++ b/nixos/tests/step-ca.nix
@@ -42,8 +42,8 @@ import ./make-test-python.nix ({ pkgs, ... }:
 
         caclient =
           { config, pkgs, ... }: {
-            security.acme.server = "https://caserver:8443/acme/acme/directory";
-            security.acme.email = "root@example.org";
+            security.acme.defaults.server = "https://caserver:8443/acme/acme/directory";
+            security.acme.defaults.email = "root@example.org";
             security.acme.acceptTerms = true;
 
             security.pki.certificateFiles = [ "${test-certificates}/root_ca.crt" ];
diff --git a/nixos/tests/tor.nix b/nixos/tests/tor.nix
index c061f59226c..71ec9df4641 100644
--- a/nixos/tests/tor.nix
+++ b/nixos/tests/tor.nix
@@ -1,24 +1,19 @@
 import ./make-test-python.nix ({ lib, ... }: with lib;
 
-rec {
+{
   name = "tor";
   meta.maintainers = with maintainers; [ joachifm ];
 
-  common =
-    { ... }:
-    { boot.kernelParams = [ "audit=0" "apparmor=0" "quiet" ];
-      networking.firewall.enable = false;
-      networking.useDHCP = false;
-    };
+  nodes.client = { pkgs, ... }: {
+    boot.kernelParams = [ "audit=0" "apparmor=0" "quiet" ];
+    networking.firewall.enable = false;
+    networking.useDHCP = false;
 
-  nodes.client =
-    { pkgs, ... }:
-    { imports = [ common ];
-      environment.systemPackages = with pkgs; [ netcat ];
-      services.tor.enable = true;
-      services.tor.client.enable = true;
-      services.tor.settings.ControlPort = 9051;
-    };
+    environment.systemPackages = with pkgs; [ netcat ];
+    services.tor.enable = true;
+    services.tor.client.enable = true;
+    services.tor.settings.ControlPort = 9051;
+  };
 
   testScript = ''
     client.wait_for_unit("tor.service")
diff --git a/nixos/tests/without-nix.nix b/nixos/tests/without-nix.nix
index 2fc00b04144..b21e9f2844f 100644
--- a/nixos/tests/without-nix.nix
+++ b/nixos/tests/without-nix.nix
@@ -4,14 +4,23 @@ import ./make-test-python.nix ({ lib, ... }: {
     maintainers = [ ericson2314 ];
   };
 
-  nixpkgs.overlays = [
-    (self: super: {
-      nix = throw "don't want to use this";
-    })
-  ];
-
   nodes.machine = { ... }: {
     nix.enable = false;
+    nixpkgs.overlays = [
+      (self: super: {
+        nix = throw "don't want to use pkgs.nix";
+        nixVersions = lib.mapAttrs (k: throw "don't want to use pkgs.nixVersions.${k}") super.nixVersions;
+        # aliases, some deprecated
+        nix_2_3 = throw "don't want to use pkgs.nix_2_3";
+        nix_2_4 = throw "don't want to use pkgs.nix_2_4";
+        nix_2_5 = throw "don't want to use pkgs.nix_2_5";
+        nix_2_6 = throw "don't want to use pkgs.nix_2_6";
+        nixFlakes = throw "don't want to use pkgs.nixFlakes";
+        nixStable = throw "don't want to use pkgs.nixStable";
+        nixUnstable = throw "don't want to use pkgs.nixUnstable";
+        nixStatic = throw "don't want to use pkgs.nixStatic";
+      })
+    ];
   };
 
   testScript = ''
diff --git a/pkgs/applications/audio/magnetophonDSP/faustCompressors/default.nix b/pkgs/applications/audio/magnetophonDSP/faustCompressors/default.nix
index 7ea5fa753c8..fd55bae6fd6 100644
--- a/pkgs/applications/audio/magnetophonDSP/faustCompressors/default.nix
+++ b/pkgs/applications/audio/magnetophonDSP/faustCompressors/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub, faust2jaqt, faust2lv2 }:
 stdenv.mkDerivation rec {
-  name = "faustCompressors-v${version}";
+  pname = "faustCompressors";
   version = "1.2";
 
   src = fetchFromGitHub {
diff --git a/pkgs/applications/audio/sound-juicer/default.nix b/pkgs/applications/audio/sound-juicer/default.nix
index c03b48c436b..f162dcd045d 100644
--- a/pkgs/applications/audio/sound-juicer/default.nix
+++ b/pkgs/applications/audio/sound-juicer/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
 , meson
 , ninja
 , pkg-config
@@ -28,6 +29,15 @@ stdenv.mkDerivation rec {
     sha256 = "08d5d81rz9sj3m5paw8fwbgxmhlbr7bcjdzpmzj832qvg8smydxf";
   };
 
+  patches = [
+    # Fix build with meson 0.61
+    # data/meson.build:2:5: ERROR: Function does not take positional arguments.
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/sound-juicer/-/commit/9f97ca1faca396099f52264a9729aa355f8d122e.patch";
+      sha256 = "8JllVSQgI7KiBI5WP6QtXRiggYuD89NSJJp1hP4Dbao=";
+    })
+  ];
+
   nativeBuildInputs = [
     meson
     ninja
diff --git a/pkgs/applications/emulators/ryujinx/default.nix b/pkgs/applications/emulators/ryujinx/default.nix
index d2c2cf03683..7a4f4351dc9 100644
--- a/pkgs/applications/emulators/ryujinx/default.nix
+++ b/pkgs/applications/emulators/ryujinx/default.nix
@@ -17,13 +17,13 @@
 
 buildDotnetModule rec {
   pname = "ryujinx";
-  version = "1.1.76"; # Based off of the official github actions builds: https://github.com/Ryujinx/Ryujinx/actions/workflows/release.yml
+  version = "1.1.77"; # Based off of the official github actions builds: https://github.com/Ryujinx/Ryujinx/actions/workflows/release.yml
 
   src = fetchFromGitHub {
     owner = "Ryujinx";
     repo = "Ryujinx";
-    rev = "e2ffa5a125fcbe8a25c73d8e04c08c08ef378860";
-    sha256 = "1rmiyjqwlsbzh9q7d12n72ka9adaby2rfcbn75sf47p5857yi3p9";
+    rev = "df70442c46e7ee133b1fb79dc23ddd134e618085";
+    sha256 = "1m9msp7kxsj7251l2yjcfzrb4k1lisk9sip7acm22pxmi1a7gw73";
   };
 
   dotnet-sdk = dotnetCorePackages.sdk_6_0;
diff --git a/pkgs/applications/graphics/xournal/default.nix b/pkgs/applications/graphics/xournal/default.nix
index f8312723875..47a47ae4f25 100644
--- a/pkgs/applications/graphics/xournal/default.nix
+++ b/pkgs/applications/graphics/xournal/default.nix
@@ -10,9 +10,9 @@ in
 
 stdenv.mkDerivation rec {
   version = "0.4.8.2016";
-  name = "xournal-" + version;
+  pname = "xournal";
   src = fetchurl {
-    url = "mirror://sourceforge/xournal/${name}.tar.gz";
+    url = "mirror://sourceforge/xournal/xournal-${version}.tar.gz";
     sha256 = "09i88v3wacmx7f96dmq0l3afpyv95lh6jrx16xzm0jd1szdrhn5j";
   };
 
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     + lib.optionalString (!isGdkQuartzBackend) " -lX11";
 
   desktopItem = makeDesktopItem {
-    name = name;
+    name = "xournal-${version}";
     exec = "xournal";
     icon = "xournal";
     desktopName = "Xournal";
diff --git a/pkgs/applications/misc/gosmore/default.nix b/pkgs/applications/misc/gosmore/default.nix
index 854fec8642a..bd87e7b4aeb 100644
--- a/pkgs/applications/misc/gosmore/default.nix
+++ b/pkgs/applications/misc/gosmore/default.nix
@@ -1,10 +1,8 @@
 { lib, stdenv, fetchsvn, libxml2, gtk2, curl, pkg-config } :
 
-let
+stdenv.mkDerivation rec {
+  pname = "gosmore";
   version = "31801";
-in
-stdenv.mkDerivation {
-  name = "gosmore-r${version}";
   # the gosmore svn repository does not lock revision numbers of its externals
   # so we explicitly disable them to avoid breaking the hash
   # especially as the externals appear to be unused
diff --git a/pkgs/applications/misc/lighthouse/default.nix b/pkgs/applications/misc/lighthouse/default.nix
index e9aa79dcdd8..01ffb7a9ffe 100644
--- a/pkgs/applications/misc/lighthouse/default.nix
+++ b/pkgs/applications/misc/lighthouse/default.nix
@@ -3,8 +3,8 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "lighthouse-${date}";
-  date = "2016-07-20";
+  pname = "lighthouse";
+  version = "unstable-2016-07-20";
 
   src = fetchFromGitHub {
     owner = "emgram769";
diff --git a/pkgs/applications/misc/mucommander/default.nix b/pkgs/applications/misc/mucommander/default.nix
index 648b4951504..681e2d3eb4e 100644
--- a/pkgs/applications/misc/mucommander/default.nix
+++ b/pkgs/applications/misc/mucommander/default.nix
@@ -2,7 +2,6 @@
 
 let
   version = "0.9.3-3";
-  name = "mucommander-${version}";
 
   src = fetchFromGitHub {
     owner = "mucommander";
@@ -34,8 +33,8 @@ let
 
   # fake build to pre-download deps into fixed-output derivation
   deps = stdenv.mkDerivation {
-    name = "${name}-deps";
-    inherit src postPatch;
+    pname = "mucommander-deps";
+    inherit version src postPatch;
     nativeBuildInputs = [ gradle_6 perl ];
     buildPhase = ''
       export GRADLE_USER_HOME=$(mktemp -d)
@@ -53,7 +52,8 @@ let
   };
 
 in stdenv.mkDerivation {
-  inherit name src postPatch;
+  pname = "mucommander";
+  inherit version src postPatch;
   nativeBuildInputs = [ gradle_6 perl makeWrapper ];
 
   buildPhase = ''
diff --git a/pkgs/applications/misc/obsidian/default.nix b/pkgs/applications/misc/obsidian/default.nix
index 67a0939ddab..813ef5a8577 100644
--- a/pkgs/applications/misc/obsidian/default.nix
+++ b/pkgs/applications/misc/obsidian/default.nix
@@ -49,8 +49,9 @@ let
       desktopName = "Obsidian";
       comment = "Knowledge base";
       icon = "obsidian";
-      exec = "obsidian";
+      exec = "obsidian %u";
       categories = [ "Office" ];
+      mimeTypes = [ "x-scheme-handler/obsidian" ];
     };
 
     inherit pname version src;
diff --git a/pkgs/applications/misc/pdfdiff/default.nix b/pkgs/applications/misc/pdfdiff/default.nix
index 20a95338497..e21b06bf25c 100644
--- a/pkgs/applications/misc/pdfdiff/default.nix
+++ b/pkgs/applications/misc/pdfdiff/default.nix
@@ -1,9 +1,7 @@
 { lib, python2Packages, fetchurl, xpdf }:
-let
-  py = python2Packages;
-in
-py.buildPythonApplication rec {
-  name = "pdfdiff-${version}";
+
+python2Packages.buildPythonApplication rec {
+  pname = "pdfdiff";
   version = "0.92";
 
   src = fetchurl {
diff --git a/pkgs/applications/misc/pdfpc/default.nix b/pkgs/applications/misc/pdfpc/default.nix
index ec78c43dbe0..9bf5907a23b 100644
--- a/pkgs/applications/misc/pdfpc/default.nix
+++ b/pkgs/applications/misc/pdfpc/default.nix
@@ -3,13 +3,12 @@
 , webkitgtk, discount, json-glib }:
 
 stdenv.mkDerivation rec {
-  name = "${product}-${version}";
-  product = "pdfpc";
+  pname = "pdfpc";
   version = "4.5.0";
 
   src = fetchFromGitHub {
-    repo = product;
-    owner = product;
+    repo = "pdfpc";
+    owner = "pdfpc";
     rev = "v${version}";
     sha256 = "0bmy51w6ypz927hxwp5g7wapqvzqmsi3w32rch6i3f94kg1152ck";
   };
diff --git a/pkgs/applications/misc/qmetro/default.nix b/pkgs/applications/misc/qmetro/default.nix
index 70c41ff3142..2678f744f8e 100644
--- a/pkgs/applications/misc/qmetro/default.nix
+++ b/pkgs/applications/misc/qmetro/default.nix
@@ -1,12 +1,11 @@
 { lib, stdenv, fetchurl, qmake4Hook, unzip, qt4 }:
 
 stdenv.mkDerivation rec {
-  name = "${project}-${version}";
-  project = "qmetro";
+  pname = "qmetro";
   version = "0.7.1";
 
   src = fetchurl {
-    url = "mirror://sourceforge/${project}/${name}.zip";
+    url = "mirror://sourceforge/qmetro/qmetro-${version}.zip";
     sha256 = "1zdj87lzcr43gr2h05g17z31pd22n5kxdwbvx7rx656rmhv0sjq5";
   };
 
diff --git a/pkgs/applications/misc/sleepyhead/default.nix b/pkgs/applications/misc/sleepyhead/default.nix
index 94c47c23afe..63a45758d93 100644
--- a/pkgs/applications/misc/sleepyhead/default.nix
+++ b/pkgs/applications/misc/sleepyhead/default.nix
@@ -1,10 +1,8 @@
 { lib, stdenv, mkDerivation, fetchgit, zlib, libGLU, libX11, qtbase, qtwebkit, qtserialport, wrapQtAppsHook }:
 
-let
-  name = "sleepyhead-${version}";
+mkDerivation {
+  pname = "sleepyhead";
   version = "1.0.0-beta-git";
-in mkDerivation {
-  inherit name;
 
   src = fetchgit {
     url = "https://gitlab.com/sleepyhead/sleepyhead-code.git";
diff --git a/pkgs/applications/misc/slmenu/default.nix b/pkgs/applications/misc/slmenu/default.nix
index 16145a915fe..80aedd57418 100644
--- a/pkgs/applications/misc/slmenu/default.nix
+++ b/pkgs/applications/misc/slmenu/default.nix
@@ -1,30 +1,19 @@
 {lib, stdenv, fetchhg}:
-let
-  s =
-  rec {
-    baseName = "slmenu";
-    version = "hg-${date}";
-    date = "2012-02-01";
-    name = "${baseName}-${version}";
+
+stdenv.mkDerivation {
+  pname = "slmenu";
+  version = "hg-2012-02-01";
+
+  src = fetchhg {
     url = "https://bitbucket.org/rafaelgg/slmenu/";
     rev = "7e74fa5db73e8b018da48d50dbbaf11cb5c62d13";
     sha256 = "0zb7mm8344d3xmvrl62psazcabfk75pp083jqkmywdsrikgjagv6";
   };
-  buildInputs = [
-  ];
-in
-stdenv.mkDerivation {
-  inherit (s) name version;
-  inherit buildInputs;
-  src = fetchhg {
-    inherit (s) url sha256;
-  };
   makeFlags = [ "PREFIX=$(out)" ];
-  meta = {
-    inherit (s) version;
+  meta = with lib; {
     description = "A console dmenu-like tool";
-    license = lib.licenses.mit;
-    maintainers = [lib.maintainers.raskin];
-    platforms = lib.platforms.linux;
+    license = licenses.mit;
+    maintainers = with maintainers; [ raskin ];
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/applications/misc/tuhi/default.nix b/pkgs/applications/misc/tuhi/default.nix
index 4bd0c914d3a..bf939cfa175 100644
--- a/pkgs/applications/misc/tuhi/default.nix
+++ b/pkgs/applications/misc/tuhi/default.nix
@@ -13,15 +13,15 @@
 }:
 
 python3Packages.buildPythonApplication rec {
-  name = "tuhi";
+  pname = "tuhi";
   version = "0.5";
 
   format = "other";
 
   src = fetchFromGitHub {
     owner = "tuhiproject";
-    repo = name;
-    rev = "${version}";
+    repo = "tuhi";
+    rev = version;
     sha256 = "17kggm9c423vj7irxx248fjc8sxvkp9w1mgawlx1snrii817p3db";
   };
 
diff --git a/pkgs/applications/misc/urlview/default.nix b/pkgs/applications/misc/urlview/default.nix
index 0374fb91844..2eca4cfccb3 100644
--- a/pkgs/applications/misc/urlview/default.nix
+++ b/pkgs/applications/misc/urlview/default.nix
@@ -1,15 +1,15 @@
 { lib, stdenv, fetchurl, ncurses, autoreconfHook }:
 
 stdenv.mkDerivation rec {
-  version    = "0.9";
+  pname = "urlview";
+  _version    = "0.9";
   patchLevel = "19";
-
-  name = "urlview-${version}-${patchLevel}";
+  version = "${_version}-${patchLevel}";
 
   urlBase = "mirror://debian/pool/main/u/urlview/";
 
   src = fetchurl {
-    url = urlBase + "urlview_${version}.orig.tar.gz";
+    url = urlBase + "urlview_${_version}.orig.tar.gz";
     sha256 = "746ff540ccf601645f500ee7743f443caf987d6380e61e5249fc15f7a455ed42";
   };
 
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
   '';
 
   debianPatches = fetchurl {
-    url = urlBase + "urlview_${version}-${patchLevel}.diff.gz";
+    url = urlBase + "urlview_${_version}-${patchLevel}.diff.gz";
     sha256 = "056883c17756f849fb9235596d274fbc5bc0d944fcc072bdbb13d1e828301585";
   };
 
diff --git a/pkgs/applications/misc/xmr-stak/default.nix b/pkgs/applications/misc/xmr-stak/default.nix
index cb4233be8ec..91c8c69fe93 100644
--- a/pkgs/applications/misc/xmr-stak/default.nix
+++ b/pkgs/applications/misc/xmr-stak/default.nix
@@ -11,7 +11,7 @@ let
 in
 
 stdenv'.mkDerivation rec {
-  name = "xmr-stak-${version}";
+  pname = "xmr-stak";
   version = "2.10.8";
 
   src = fetchFromGitHub {
diff --git a/pkgs/applications/misc/zscroll/default.nix b/pkgs/applications/misc/zscroll/default.nix
index 3acac8b3c68..d3424938dd9 100644
--- a/pkgs/applications/misc/zscroll/default.nix
+++ b/pkgs/applications/misc/zscroll/default.nix
@@ -1,9 +1,9 @@
 { lib, python3, python3Packages, fetchFromGitHub }:
 
-let version = "1.0"; in
+python3Packages.buildPythonApplication rec {
+  pname = "zscroll";
+  version = "1.0";
 
-python3Packages.buildPythonApplication {
-  name = "zscroll-${version}";
   # don't prefix with python version
   namePrefix = "";
 
diff --git a/pkgs/applications/networking/browsers/firefox-bin/default.nix b/pkgs/applications/networking/browsers/firefox-bin/default.nix
index 50cc5718290..a71cb84a05c 100644
--- a/pkgs/applications/networking/browsers/firefox-bin/default.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/default.nix
@@ -188,7 +188,7 @@ stdenv.mkDerivation {
       ln -s ${policiesJson} "$out/lib/firefox-bin-${version}/distribution/policies.json";
     '';
 
-  passthru.applicationName = "firefox";
+  passthru.binaryName = "firefox";
   passthru.libName = "firefox-bin-${version}";
   passthru.execdir = "/bin";
   passthru.ffmpegSupport = true;
diff --git a/pkgs/applications/networking/browsers/firefox/common.nix b/pkgs/applications/networking/browsers/firefox/common.nix
index 019c623e100..64cba1b52a6 100644
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@@ -1,37 +1,91 @@
-{ pname, version, meta, updateScript ? null
-, binaryName ? "firefox", application ? "browser"
-, src, unpackPhase ? null, patches ? []
-, extraNativeBuildInputs ? [], extraConfigureFlags ? [], extraMakeFlags ? [], tests ? []
-, extraPostPatch ? "", extraPassthru ? {} }:
-
-{ lib, stdenv, pkg-config, pango, perl, python3, zip
-, libjpeg, zlib, dbus, dbus-glib, bzip2, xorg
-, freetype, fontconfig, file, nspr, nss
-, yasm, libGLU, libGL, sqlite, unzip, makeWrapper
-, hunspell, libevent, libstartup_notification
-, libvpx
-, icu70, libpng, glib, pciutils
-, autoconf213, which, gnused, rustPackages, rustPlatform
-, rust-cbindgen, nodejs, nasm, fetchpatch
+{ pname
+, version
+, meta
+, updateScript ? null
+, binaryName ? "firefox"
+, application ? "browser"
+, src
+, unpackPhase ? null
+, extraPatches ? []
+, extraPostPatch ? ""
+, extraNativeBuildInputs ? []
+, extraConfigureFlags ? []
+, extraBuildInputs ? []
+, extraMakeFlags ? []
+, extraPassthru ? {}
+, tests ? []
+}:
+
+
+{ lib
+, stdenv
+, fetchpatch
+
+# build time
+, autoconf
+, cargo
+, gnused
+, makeWrapper
+, nodejs
+, perl
+, pkg-config
+, pkgsCross # wasm32 rlbox
+, python3
+, runCommand
+, rustc
+, rust-cbindgen
+, rustPlatform
+, unzip
+, which
+, wrapGAppsHook
+
+# runtime
+, bzip2
+, dbus
+, dbus-glib
+, file
+, fontconfig
+, freetype
+, glib
 , gnum4
-, gtk3, wrapGAppsHook
-, pkgsCross
+, gtk3
+, icu
+, libGL
+, libGLU
+, libevent
+, libffi
+, libjpeg
+, libpng
+, libstartup_notification
+, libvpx
+, libwebp
+, nasm
+, nspr
+, nss
+, pango
+, xorg
+, zip
+, zlib
+
+# optionals
+
+## debugging
+
 , debugBuild ? false
-, runCommand
 
-### optionals
+# On 32bit platforms, we disable adding "-g" for easier linking.
+, enableDebugSymbols ? !stdenv.is32bit
 
 ## optional libraries
 
 , alsaSupport ? stdenv.isLinux, alsa-lib
-, pulseaudioSupport ? stdenv.isLinux, libpulseaudio
 , ffmpegSupport ? true
-, waylandSupport ? true, libxkbcommon, libdrm
-, ltoSupport ? (stdenv.isLinux && stdenv.is64bit), overrideCC, buildPackages
 , gssSupport ? true, libkrb5
-, pipewireSupport ? waylandSupport && webrtcSupport, pipewire
-# Jemalloc could reduce memory consumption.
 , jemallocSupport ? true, jemalloc
+, ltoSupport ? (stdenv.isLinux && stdenv.is64bit), overrideCC, buildPackages
+, pipewireSupport ? waylandSupport && webrtcSupport
+, pulseaudioSupport ? stdenv.isLinux, libpulseaudio
+, waylandSupport ? true, libxkbcommon, libdrm
 
 ## privacy-related options
 
@@ -40,22 +94,16 @@
 # WARNING: NEVER set any of the options below to `true` by default.
 # Set to `!privacySupport` or `false`.
 
-# webrtcSupport breaks the aarch64 build on version >= 60, fixed in 63.
-# https://bugzilla.mozilla.org/show_bug.cgi?id=1434589
-, webrtcSupport ? !privacySupport
 , geolocationSupport ? !privacySupport
 , googleAPISupport ? geolocationSupport
-, crashreporterSupport ? false
-
-, safeBrowsingSupport ? false
-, drmSupport ? false
-
-# macOS dependencies
-, xcbuild, CoreMedia, ExceptionHandling, Kerberos, AVFoundation, MediaToolbox
-, CoreLocation, Foundation, AddressBook, libobjc, cups, rsync
+, webrtcSupport ? !privacySupport
 
 ## other
 
+, crashreporterSupport ? false
+, drmSupport ? false
+, safeBrowsingSupport ? false
+
 # As stated by Sylvestre Ledru (@sylvestre) on Nov 22, 2017 at
 # https://github.com/NixOS/nixpkgs/issues/31843#issuecomment-346372756 we
 # have permission to use the official firefox branding.
@@ -75,38 +123,16 @@
 # > the experience of Firefox users, you won't have any issues using the
 # > official branding.
 , enableOfficialBranding ? true
-
-# On 32bit platforms, we disable adding "-g" for easier linking.
-, enableDebugSymbols ? !stdenv.is32bit
 }:
 
 assert stdenv.cc.libc or null != null;
 assert pipewireSupport -> !waylandSupport || !webrtcSupport -> throw "pipewireSupport requires both wayland and webrtc support.";
-assert ltoSupport -> stdenv.isDarwin -> throw "LTO is broken on Darwin (see PR#19312).";
 
 let
   flag = tf: x: [(if tf then "--enable-${x}" else "--disable-${x}")];
 
-  default-toolkit = if stdenv.isDarwin then "cairo-cocoa"
-                    else "cairo-gtk3${lib.optionalString waylandSupport "-wayland"}";
-
-  binaryNameCapitalized = lib.toUpper (lib.substring 0 1 binaryName) + lib.substring 1 (-1) binaryName;
-
-  applicationName = if stdenv.isDarwin then binaryNameCapitalized else binaryName;
-
-  execdir = if stdenv.isDarwin
-            then "/Applications/${binaryNameCapitalized}.app/Contents/MacOS"
-            else "/bin";
-
-  inherit (rustPackages) rustc cargo;
-
-  # Darwin's stdenv provides the default llvmPackages version, match that since
-  # clang LTO on Darwin is broken so the stdenv is not being changed.
-  # Target the LLVM version that rustc -Vv reports it is built with for LTO.
-  llvmPackages0 =
-    if stdenv.isDarwin
-      then buildPackages.llvmPackages
-    else rustc.llvmPackages;
+  # Target the LLVM version that rustc is built with for LTO.
+  llvmPackages0 = rustc.llvmPackages;
 
   # Force the use of lld and other llvm tools for LTO
   llvmPackages = llvmPackages0.override {
@@ -114,14 +140,12 @@ let
     bootBintools = null;
   };
 
-  # When LTO for Darwin is fixed, the following will need updating as lld
-  # doesn't work on it. For now it is fine since ltoSupport implies no Darwin.
   buildStdenv = if ltoSupport
-                # LTO requires LLVM bintools including ld.lld and llvm-ar.
-                then overrideCC llvmPackages.stdenv (llvmPackages.stdenv.cc.override {
-                  inherit (llvmPackages) bintools;
-                })
-                else stdenv;
+    # LTO requires LLVM bintools including ld.lld and llvm-ar.
+    then overrideCC llvmPackages.stdenv (llvmPackages.stdenv.cc.override {
+      inherit (llvmPackages) bintools;
+    })
+    else stdenv;
 
   # Compile the wasm32 sysroot to build the RLBox Sandbox
   # https://hacks.mozilla.org/2021/12/webassembly-and-back-again-fine-grained-sandboxing-in-firefox-95/
@@ -141,97 +165,70 @@ buildStdenv.mkDerivation ({
   inherit src unpackPhase meta;
 
   patches = [
-  ] ++
-  lib.optional (lib.versionAtLeast version "86") ./env_var_for_system_dir-ff86.patch ++
-  lib.optional (lib.versionAtLeast version "90" && lib.versionOlder version "95") ./no-buildconfig-ffx90.patch ++
-  lib.optional (lib.versionAtLeast version "96") ./no-buildconfig-ffx96.patch ++
+  ]
+  ++ lib.optional (lib.versionAtLeast version "86") ./env_var_for_system_dir-ff86.patch
+  ++ lib.optional (lib.versionAtLeast version "90" && lib.versionOlder version "95") ./no-buildconfig-ffx90.patch
+  ++ lib.optional (lib.versionAtLeast version "96") ./no-buildconfig-ffx96.patch
+  ++ extraPatches;
 
-  patches;
+  postPatch = ''
+    rm -rf obj-x86_64-pc-linux-gnu
+    patchShebangs mach
+  ''
+  + extraPostPatch;
 
   # Ignore trivial whitespace changes in patches, this fixes compatibility of
   # ./env_var_for_system_dir.patch with Firefox >=65 without having to track
   # two patches.
   patchFlags = [ "-p1" "-l" ];
 
-  buildInputs = [
-    gnum4 gtk3 perl zip libjpeg zlib bzip2
-    dbus dbus-glib pango freetype fontconfig xorg.libXi xorg.libXcursor
-    xorg.libX11 xorg.libXrender xorg.libXft xorg.libXt file
-    xorg.pixman yasm libGLU libGL
-    xorg.xorgproto
-    xorg.libXdamage
-    xorg.libXext
-    xorg.libXtst
-    libevent libstartup_notification /* cairo */
-    libpng glib
-    nasm icu70 libvpx
-    # >= 66 requires nasm for the AV1 lib dav1d
-    # yasm can potentially be removed in future versions
-    # https://bugzilla.mozilla.org/show_bug.cgi?id=1501796
-    # https://groups.google.com/forum/#!msg/mozilla.dev.platform/o-8levmLU80/SM_zQvfzCQAJ
-    nspr nss
+  nativeBuildInputs = [
+    autoconf
+    cargo
+    gnused
+    llvmPackages.llvm # llvm-objdump
+    makeWrapper
+    nodejs
+    perl
+    pkg-config
+    python3
+    rust-cbindgen
+    rustPlatform.bindgenHook
+    rustc
+    unzip
+    which
+    wrapGAppsHook
   ]
-  ++ lib.optional  alsaSupport alsa-lib
-  ++ lib.optional  pulseaudioSupport libpulseaudio # only headers are needed
-  ++ lib.optional  gssSupport libkrb5
-  ++ lib.optionals waylandSupport [ libxkbcommon libdrm ]
-  ++ lib.optional  pipewireSupport pipewire
-  ++ lib.optional  jemallocSupport jemalloc
-  ++ lib.optionals buildStdenv.isDarwin [ CoreMedia ExceptionHandling Kerberos
-                                          AVFoundation MediaToolbox CoreLocation
-                                          Foundation libobjc AddressBook cups ];
-
-  MACH_USE_SYSTEM_PYTHON = "1";
-
-  postPatch = ''
-    rm -rf obj-x86_64-pc-linux-gnu
-    substituteInPlace toolkit/xre/glxtest.cpp \
-      --replace 'dlopen("libpci.so' 'dlopen("${pciutils}/lib/libpci.so'
-
-    patchShebangs mach
-  '' + extraPostPatch;
-
-  nativeBuildInputs =
-    [
-      autoconf213
-      cargo
-      gnused
-      llvmPackages.llvm # llvm-objdump
-      makeWrapper
-      nodejs
-      perl
-      pkg-config
-      python3
-      rust-cbindgen
-      rustc
-      which
-      unzip
-      wrapGAppsHook
-      rustPlatform.bindgenHook
-    ]
-    ++ lib.optionals buildStdenv.isDarwin [ xcbuild rsync ]
-    ++ extraNativeBuildInputs;
+  ++ extraNativeBuildInputs;
 
-  separateDebugInfo = enableDebugSymbols;
   setOutputFlags = false; # `./mach configure` doesn't understand `--*dir=` flags.
 
   preConfigure = ''
     # remove distributed configuration files
-    rm -f configure
-    rm -f js/src/configure
-    rm -f .mozconfig*
-    # this will run autoconf213
+    rm -f configure js/src/configure .mozconfig*
+
+    # Runs autoconf through ./mach configure in configurePhase
     configureScript="$(realpath ./mach) configure"
+
+    # Set predictable directories for build and state
+    export MOZ_OBJDIR=$(pwd)/mozobj
     export MOZBUILD_STATE_PATH=$(pwd)/mozbuild
 
     # Set consistent remoting name to ensure wmclass matches with desktop file
     export MOZ_APP_REMOTINGNAME="${binaryName}"
 
-  '' + (lib.optionalString (lib.versionAtLeast version "95.0") ''
+    # Use our own python
+    export MACH_USE_SYSTEM_PYTHON=1
+
+    # AS=as in the environment causes build failure
+    # https://bugzilla.mozilla.org/show_bug.cgi?id=1497286
+    unset AS
+
+  '' + lib.optionalString (lib.versionAtLeast version "95.0") ''
     # RBox WASM Sandboxing
     export WASM_CC=${pkgsCross.wasi32.stdenv.cc}/bin/${pkgsCross.wasi32.stdenv.cc.targetPrefix}cc
     export WASM_CXX=${pkgsCross.wasi32.stdenv.cc}/bin/${pkgsCross.wasi32.stdenv.cc.targetPrefix}c++
-  '') + (lib.optionalString googleAPISupport ''
+  '' + lib.optionalString googleAPISupport ''
     # Google API key used by Chromium and Firefox.
     # Note: These are for NixOS/nixpkgs use ONLY. For your own distribution,
     # please get your own set of keys.
@@ -239,49 +236,44 @@ buildStdenv.mkDerivation ({
     # 60.5+ & 66+ did split the google API key arguments: https://bugzilla.mozilla.org/show_bug.cgi?id=1531176
     configureFlagsArray+=("--with-google-location-service-api-keyfile=$TMPDIR/ga")
     configureFlagsArray+=("--with-google-safebrowsing-api-keyfile=$TMPDIR/ga")
-  '') + ''
-    # AS=as in the environment causes build failure https://bugzilla.mozilla.org/show_bug.cgi?id=1497286
-    unset AS
-  '' + (lib.optionalString enableOfficialBranding ''
+  '' + lib.optionalString enableOfficialBranding ''
     export MOZILLA_OFFICIAL=1
-    export BUILD_OFFICIAL=1
-  '');
+  '';
 
   configureFlags = [
+    "--disable-tests"
+    "--disable-updater"
     "--enable-application=${application}"
+    "--enable-default-toolkit=cairo-gtk3${lib.optionalString waylandSupport "-wayland"}"
+    "--enable-system-pixman"
+    "--with-libclang-path=${llvmPackages.libclang.lib}/lib"
+    "--with-system-ffi"
+    "--with-system-icu"
     "--with-system-jpeg"
-    "--with-system-zlib"
     "--with-system-libevent"
     "--with-system-libvpx"
-    "--with-system-png" # needs APNG support
-    "--with-system-icu"
-    "--enable-system-ffi"
-    "--enable-system-pixman"
-    #"--enable-system-cairo"
-    "--disable-tests"
-    "--disable-necko-wifi" # maybe we want to enable this at some point
-    "--disable-updater"
-    "--enable-default-toolkit=${default-toolkit}"
-    "--with-libclang-path=${llvmPackages.libclang.lib}/lib"
     "--with-system-nspr"
     "--with-system-nss"
+    "--with-system-png" # needs APNG support
+    "--with-system-webp"
+    "--with-system-zlib"
   ]
-  ++ lib.optional (buildStdenv.isDarwin) "--disable-xcode-checks"
   ++ lib.optional (!ltoSupport) "--with-clang-path=${llvmPackages.clang}/bin/clang"
   # LTO is done using clang and lld on Linux.
-  # Darwin needs to use the default linker as lld is not supported (yet?):
-  #   https://bugzilla.mozilla.org/show_bug.cgi?id=1538724
+  ++ lib.optionals ltoSupport [
+     "--enable-lto=cross" # Cross-Language LTO
+     "--enable-linker=lld"
+  ]
   # elf-hack is broken when using clang+lld:
-  #   https://bugzilla.mozilla.org/show_bug.cgi?id=1482204
-  ++ lib.optional ltoSupport "--enable-lto=cross" # Cross-language LTO.
+  # https://bugzilla.mozilla.org/show_bug.cgi?id=1482204
   ++ lib.optional (ltoSupport && (buildStdenv.isAarch32 || buildStdenv.isi686 || buildStdenv.isx86_64)) "--disable-elf-hack"
-  ++ lib.optional (ltoSupport && !buildStdenv.isDarwin) "--enable-linker=lld"
   ++ lib.optional (lib.versionAtLeast version "95") "--with-wasi-sysroot=${wasiSysRoot}"
 
   ++ flag alsaSupport "alsa"
   ++ flag pulseaudioSupport "pulseaudio"
   ++ flag ffmpegSupport "ffmpeg"
   ++ flag jemallocSupport "jemalloc"
+  ++ flag geolocationSupport "necko-wifi"
   ++ flag gssSupport "negotiateauth"
   ++ flag webrtcSupport "webrtc"
   ++ flag crashreporterSupport "crashreporter"
@@ -298,19 +290,62 @@ buildStdenv.mkDerivation ({
   ++ lib.optional enableOfficialBranding "--enable-official-branding"
   ++ extraConfigureFlags;
 
-  postConfigure = ''
-    cd obj-*
+  buildInputs = [
+    bzip2
+    dbus
+    dbus-glib
+    file
+    fontconfig
+    freetype
+    glib
+    gnum4
+    gtk3
+    icu
+    libffi
+    libGL
+    libGLU
+    libevent
+    libjpeg
+    libpng
+    libstartup_notification
+    libvpx
+    libwebp
+    nasm
+    nspr
+    nss
+    pango
+    perl
+    xorg.libX11
+    xorg.libXcursor
+    xorg.libXdamage
+    xorg.libXext
+    xorg.libXft
+    xorg.libXi
+    xorg.libXrender
+    xorg.libXt
+    xorg.libXtst
+    xorg.pixman
+    xorg.xorgproto
+    zip
+    zlib
+  ]
+  ++ lib.optional  alsaSupport alsa-lib
+  ++ lib.optional  pulseaudioSupport libpulseaudio # only headers are needed
+  ++ lib.optional  gssSupport libkrb5
+  ++ lib.optionals waylandSupport [ libxkbcommon libdrm ]
+  ++ lib.optional  jemallocSupport jemalloc
+  ++ extraBuildInputs;
+
+  preBuild = ''
+    cd mozobj
   '';
 
   makeFlags = extraMakeFlags;
-
+  separateDebugInfo = enableDebugSymbols;
   enableParallelBuilding = true;
-  doCheck = false; # "--disable-tests" above
 
-  installPhase = if buildStdenv.isDarwin then ''
-    mkdir -p $out/Applications
-    cp -LR dist/${binaryNameCapitalized}.app $out/Applications
-  '' else null;
+  # tests were disabled in configureFlags
+  doCheck = false;
 
   postInstall = lib.optionalString buildStdenv.isLinux ''
     # Remove SDK cruft. FIXME: move to a separate output?
@@ -322,7 +357,7 @@ buildStdenv.mkDerivation ({
 
   # Workaround: The separateDebugInfo hook skips artifacts whose build ID's length is not 40.
   # But we got 16-length build ID here. The function body is mainly copied from pkgs/build-support/setup-hooks/separate-debug-info.sh
-  # Remove it when PR #146275 is merged.
+  # Remove it when https://github.com/NixOS/nixpkgs/pull/146275 is merged.
   preFixup = lib.optionalString enableDebugSymbols ''
     _separateDebugInfo() {
         [ -e "$prefix" ] || return 0
@@ -359,19 +394,18 @@ buildStdenv.mkDerivation ({
   doInstallCheck = true;
   installCheckPhase = ''
     # Some basic testing
-    "$out${execdir}/${applicationName}" --version
+    "$out/bin/${binaryName}" --version
   '';
 
   passthru = {
     inherit updateScript;
     inherit version;
     inherit alsaSupport;
+    inherit binaryName;
     inherit pipewireSupport;
     inherit nspr;
     inherit ffmpegSupport;
     inherit gssSupport;
-    inherit execdir;
-    inherit applicationName;
     inherit tests;
     inherit gtk3;
     inherit wasiSysRoot;
diff --git a/pkgs/applications/networking/browsers/firefox/librewolf/default.nix b/pkgs/applications/networking/browsers/firefox/librewolf/default.nix
index 4d8fe708e75..10b65e8825c 100644
--- a/pkgs/applications/networking/browsers/firefox/librewolf/default.nix
+++ b/pkgs/applications/networking/browsers/firefox/librewolf/default.nix
@@ -6,7 +6,7 @@ rec {
 
   inherit (src) packageVersion firefox source;
 
-  patches = [ ./verify-telemetry-macros.patch ];
+  extraPatches = [ ./verify-telemetry-macros.patch ];
 
   extraConfigureFlags = [
     "--with-app-name=librewolf"
@@ -34,7 +34,7 @@ rec {
   extraPoliciesFiles = [ "${source}/submodules/settings/distribution/policies.json" ];
 
   extraPassthru = {
-    librewolf = { inherit src patches; };
+    librewolf = { inherit src extraPatches; };
     inherit extraPrefsFiles extraPoliciesFiles;
   };
 }
diff --git a/pkgs/applications/networking/browsers/firefox/wrapper.nix b/pkgs/applications/networking/browsers/firefox/wrapper.nix
index 4713320e068..d5055f04ed8 100644
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@@ -12,6 +12,7 @@
 , libva
 , mesa # firefox wants gbm for drm+dmabuf
 , cups
+, pciutils
 }:
 
 ## configurability of the wrapper itself
@@ -20,7 +21,7 @@ browser:
 
 let
   wrapper =
-    { applicationName ? browser.applicationName or (lib.getName browser)
+    { applicationName ? browser.binaryName or (lib.getName browser)
     , pname ? applicationName
     , version ? lib.getVersion browser
     , desktopName ? # applicationName with first letter capitalized
@@ -66,8 +67,8 @@ let
           ++ lib.optional (cfg.enableFXCastBridge or false) fx_cast_bridge
           ++ extraNativeMessagingHosts
         );
-      libs =   lib.optionals stdenv.isLinux [ udev libva mesa libnotify xorg.libXScrnSaver cups ]
-            ++ lib.optional (pipewireSupport && lib.versionAtLeast version "83") pipewire
+      libs =   lib.optionals stdenv.isLinux [ udev libva mesa libnotify xorg.libXScrnSaver cups pciutils ]
+            ++ lib.optional pipewireSupport pipewire
             ++ lib.optional ffmpegSupport ffmpeg
             ++ lib.optional gssSupport libkrb5
             ++ lib.optional useGlvnd libglvnd
@@ -179,14 +180,10 @@ let
       buildInputs = [ browser.gtk3 ];
 
 
-      buildCommand = lib.optionalString stdenv.isDarwin ''
-        mkdir -p $out/Applications
-        cp -R --no-preserve=mode,ownership ${browser}/Applications/${applicationName}.app $out/Applications
-        rm -f $out${browser.execdir or "/bin"}/${applicationName}
-      '' + ''
-        if [ ! -x "${browser}${browser.execdir or "/bin"}/${applicationName}" ]
+      buildCommand = ''
+        if [ ! -x "${browser}/bin/${applicationName}" ]
         then
-            echo "cannot find executable file \`${browser}${browser.execdir or "/bin"}/${applicationName}'"
+            echo "cannot find executable file \`${browser}/bin/${applicationName}'"
             exit 1
         fi
 
@@ -223,12 +220,12 @@ let
 
         # create the wrapper
 
-        executablePrefix="$out${browser.execdir or "/bin"}"
+        executablePrefix="$out/bin"
         executablePath="$executablePrefix/${applicationName}"
 
         if [ ! -x "$executablePath" ]
         then
-            echo "cannot find executable file \`${browser}${browser.execdir or "/bin"}/${applicationName}'"
+            echo "cannot find executable file \`${browser}/bin/${applicationName}'"
             exit 1
         fi
 
@@ -243,18 +240,18 @@ let
           oldExe="$(readlink -v --canonicalize-existing "$executablePath")"
         fi
 
-        if [ ! -x "${browser}${browser.execdir or "/bin"}/${applicationName}" ]
+        if [ ! -x "${browser}/bin/${applicationName}" ]
         then
-            echo "cannot find executable file \`${browser}${browser.execdir or "/bin"}/${applicationName}'"
+            echo "cannot find executable file \`${browser}/bin/${applicationName}'"
             exit 1
         fi
 
         makeWrapper "$oldExe" \
-          "$out${browser.execdir or "/bin"}/${applicationName}${nameSuffix}" \
+          "$out/bin/${applicationName}${nameSuffix}" \
             --prefix LD_LIBRARY_PATH ':' "$libs" \
             --suffix-each GTK_PATH ':' "$gtk_modules" \
             --prefix PATH ':' "${xdg-utils}/bin" \
-            --suffix PATH ':' "$out${browser.execdir or "/bin"}" \
+            --suffix PATH ':' "$out/bin" \
             --set MOZ_APP_LAUNCHER "${applicationName}${nameSuffix}" \
             --set MOZ_SYSTEM_DIR "$out/lib/mozilla" \
             --set MOZ_LEGACY_PROFILES 1 \
@@ -278,7 +275,7 @@ let
             mkdir -p "$out/share/icons/hicolor/''${res}x''${res}/apps"
             icon=$( find "${browser}/lib/" -name "default''${res}.png" )
               if [ -e "$icon" ]; then ln -s "$icon" \
-                "$out/share/icons/hicolor/''${res}x''${res}/apps/${applicationName}.png"
+                "$out/share/icons/hicolor/''${res}x''${res}/apps/${icon}.png"
               fi
             done
         fi
diff --git a/pkgs/applications/networking/cluster/cmctl/default.nix b/pkgs/applications/networking/cluster/cmctl/default.nix
index 64a8ebd4a99..df34db0e147 100644
--- a/pkgs/applications/networking/cluster/cmctl/default.nix
+++ b/pkgs/applications/networking/cluster/cmctl/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "cmctl";
-  version = "1.7.1";
+  version = "1.7.2";
 
   src = fetchFromGitHub {
     owner = "cert-manager";
     repo = "cert-manager";
     rev = "v${version}";
-    sha256 = "sha256-RO7YcGEfAQ9kTxfqgekYf6M5b6Fg64hCPLA/vt6IWp8=";
+    sha256 = "sha256-Hx6MG5GCZyOX0tfpg1bfUT0BOI3p7Mws1VCz2PuUuw8=";
   };
 
   vendorSha256 = "sha256-4zhdpedOmLl/i1G0QCto4ACxguWRZLzOm5HfMBMtvPY=";
diff --git a/pkgs/applications/networking/cluster/werf/default.nix b/pkgs/applications/networking/cluster/werf/default.nix
index c55ccfa02fa..9a9f454ac00 100644
--- a/pkgs/applications/networking/cluster/werf/default.nix
+++ b/pkgs/applications/networking/cluster/werf/default.nix
@@ -11,15 +11,15 @@
 
 buildGoModule rec {
   pname = "werf";
-  version = "1.2.77";
+  version = "1.2.78";
 
   src = fetchFromGitHub {
     owner = "werf";
     repo = "werf";
     rev = "v${version}";
-    sha256 = "sha256-JmadwNERjexnJN+fBUjgMkvPtAaTbb7GITPsZlx2vik=";
+    sha256 = "sha256-ehrzb7WvkYL8oj2RSzKc1KDagV0zg6vMzgpT2sPyhcI=";
   };
-  vendorSha256 = "sha256-IPQiS1GgNP+k/INv3f3VitoHActC3MrRys905nTSXyI=";
+  vendorSha256 = "sha256-w8ZeAQbZIVOBoRa9fJhXgTeYRCYpkh/U4pwb5u6A9mQ=";
   proxyVendor = true;
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/applications/networking/instant-messengers/fractal/default.nix b/pkgs/applications/networking/instant-messengers/fractal/default.nix
index d957daced26..3b5349d65ff 100644
--- a/pkgs/applications/networking/instant-messengers/fractal/default.nix
+++ b/pkgs/applications/networking/instant-messengers/fractal/default.nix
@@ -1,5 +1,7 @@
-{ lib, stdenv
+{ stdenv
+, lib
 , fetchFromGitLab
+, fetchpatch
 , nix-update-script
 , meson
 , ninja
@@ -33,6 +35,15 @@ stdenv.mkDerivation rec {
     sha256 = "DSNVd9YvI7Dd3s3+M0+wE594tmL1yPNMnD1W9wLhSuw=";
   };
 
+  patches = [
+    # Fix build with meson 0.61
+    # fractal-gtk/res/meson.build:5:0: ERROR: Function does not take positional arguments.
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/fractal/-/commit/6fa1a23596d65d94aa889efe725174e6cd2903f0.patch";
+      sha256 = "3OzU9XL2V1VNOkvL1j677K3HNoBqPMQudQDmiDxYfAc=";
+    })
+  ];
+
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
index 99ee871c917..e3fa08e3df3 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@@ -24,7 +24,7 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "signal-desktop";
-  version = "5.35.0"; # Please backport all updates to the stable channel.
+  version = "5.36.0"; # Please backport all updates to the stable channel.
   # All releases have a limited lifetime and "expire" 90 days after the release.
   # When releases "expire" the application becomes unusable until an update is
   # applied. The expiration date for the current release can be extracted with:
@@ -34,7 +34,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "sha256-2KF2OLq6/vHElgloxn+kgQisJC+HAkpOBfsKfEPW35c=";
+    sha256 = "sha256-x1PUEDq/0B1T14mBs2FuKtcGpJHWOIvHAs8hptpzhZk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
index 3ab0c58ecc5..d559976d800 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
@@ -17,7 +17,7 @@ rec {
       url = "mirror://mozilla/thunderbird/releases/${version}/source/thunderbird-${version}.source.tar.xz";
       sha512 = "2afaee16f155edcb0bdb46ebe282a733cf041ec6f562aebd06f8b675e46917f6f500fcc532fc54d74f3f4b0b489a88934a2c6c304f849873de4bc2690b9056a0";
     };
-    patches = [
+    extraPatches = [
       # The file to be patched is different from firefox's `no-buildconfig-ffx90.patch`.
       ./no-buildconfig.patch
     ];
diff --git a/pkgs/applications/networking/p2p/frostwire/default.nix b/pkgs/applications/networking/p2p/frostwire/default.nix
index e4c1c8f5b7b..cd6ae563aa0 100644
--- a/pkgs/applications/networking/p2p/frostwire/default.nix
+++ b/pkgs/applications/networking/p2p/frostwire/default.nix
@@ -2,12 +2,11 @@
 
 let
   version = "6.6.7-build-529";
-  name = "frostwire-desktop-${version}";
 
   src = fetchFromGitHub {
     owner = "frostwire";
     repo = "frostwire";
-    rev = name;
+    rev = "frostwire-desktop-${version}";
     sha256 = "03wdj2kr8akzx8m1scvg98132zbaxh81qjdsxn2645b3gahjwz0m";
   };
 
@@ -23,8 +22,8 @@ let
 
   # fake build to pre-download deps into fixed-output derivation
   deps = stdenv.mkDerivation {
-    name = "${name}-deps";
-    inherit src;
+    pname = "frostwire-desktop-deps";
+    inherit version src;
     buildInputs = [ gradle_6 perl ];
     buildPhase = ''
       export GRADLE_USER_HOME=$(mktemp -d)
@@ -40,11 +39,12 @@ let
     '';
     outputHashAlgo = "sha256";
     outputHashMode = "recursive";
-    outputHash = "11zd98g0d0fdgls4lsskkagwfxyh26spfd6c6g9cahl89czvlg3c";
+    outputHash = "sha256-r6YSrbSJbM3063JrX4tCVKFrJxTaLN4Trc+33jzpwcE=";
   };
 
 in stdenv.mkDerivation {
-  inherit name src;
+  pname = "frostwire-desktop";
+  inherit version src;
 
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [ gradle_6 ];
diff --git a/pkgs/applications/networking/remote/vmware-horizon-client/default.nix b/pkgs/applications/networking/remote/vmware-horizon-client/default.nix
index be0832a075f..f114f8a3091 100644
--- a/pkgs/applications/networking/remote/vmware-horizon-client/default.nix
+++ b/pkgs/applications/networking/remote/vmware-horizon-client/default.nix
@@ -115,7 +115,8 @@ let
 
 in
 stdenv.mkDerivation {
-  name = "vmware-horizon-client";
+  pname = "vmware-horizon-client";
+  inherit version;
 
   dontUnpack = true;
 
diff --git a/pkgs/applications/office/jameica/default.nix b/pkgs/applications/office/jameica/default.nix
index 767a4202ae8..d5c4dcb6501 100644
--- a/pkgs/applications/office/jameica/default.nix
+++ b/pkgs/applications/office/jameica/default.nix
@@ -4,7 +4,6 @@ let
   _version = "2.10.1";
   _build = "482";
   version = "${_version}-${_build}";
-  name = "jameica-${version}";
 
   swtSystem = if stdenv.hostPlatform.system == "i686-linux" then "linux"
   else if stdenv.hostPlatform.system == "x86_64-linux" then "linux64"
@@ -22,7 +21,8 @@ let
   };
 in
 stdenv.mkDerivation rec {
-  inherit name version;
+  pname = "jameica";
+  inherit version;
 
   nativeBuildInputs = [ ant jdk makeWrapper ];
   buildInputs = lib.optionals stdenv.isLinux [ gtk2 glib xorg.libXtst ]
@@ -42,12 +42,12 @@ stdenv.mkDerivation rec {
   '';
 
   installPhase = ''
-    mkdir -p $out/libexec $out/lib $out/bin $out/share/{applications,${name},java}/
+    mkdir -p $out/libexec $out/lib $out/bin $out/share/{applications,jameica-${version},java}/
 
     # copy libraries except SWT
-    cp $(find lib -type f -iname '*.jar' | grep -ve 'swt/.*/swt.jar') $out/share/${name}/
+    cp $(find lib -type f -iname '*.jar' | grep -ve 'swt/.*/swt.jar') $out/share/jameica-${version}/
     # copy platform-specific SWT
-    cp lib/swt/${swtSystem}/swt.jar $out/share/${name}/
+    cp lib/swt/${swtSystem}/swt.jar $out/share/jameica-${version}/
 
     install -Dm644 releases/${_version}-*/jameica/jameica.jar $out/share/java/
     install -Dm644 plugin.xml $out/share/java/
@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
     cp ${desktopItem}/share/applications/* $out/share/applications/
 
     makeWrapper ${jre}/bin/java $out/bin/jameica \
-      --add-flags "-cp $out/share/java/jameica.jar:$out/share/${name}/* ${
+      --add-flags "-cp $out/share/java/jameica.jar:$out/share/jameica-${version}/* ${
         lib.optionalString stdenv.isDarwin ''-Xdock:name="Jameica" -XstartOnFirstThread''
       } de.willuhn.jameica.Main" \
       --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath buildInputs} \
diff --git a/pkgs/applications/radio/rtl-ais/default.nix b/pkgs/applications/radio/rtl-ais/default.nix
index 7fd37d21fe1..243d3126b5f 100644
--- a/pkgs/applications/radio/rtl-ais/default.nix
+++ b/pkgs/applications/radio/rtl-ais/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, pkg-config, libusb1, rtl-sdr }:
 
 stdenv.mkDerivation {
-  name = "rtl-ais";
+  pname = "rtl-ais";
   version = "0.8.1";
   buildInputs = [ pkg-config rtl-sdr libusb1 ];
 
diff --git a/pkgs/applications/radio/sdrplay/default.nix b/pkgs/applications/radio/sdrplay/default.nix
index d12b12ecc13..441ff1cf0f3 100644
--- a/pkgs/applications/radio/sdrplay/default.nix
+++ b/pkgs/applications/radio/sdrplay/default.nix
@@ -4,7 +4,7 @@ let
     else if stdenv.isi686    then "i686"
     else throw "unsupported architecture";
 in stdenv.mkDerivation rec {
-  name = "sdrplay";
+  pname = "sdrplay";
   version = "3.07.1";
 
   src = fetchurl {
diff --git a/pkgs/applications/radio/soapysdrplay/default.nix b/pkgs/applications/radio/soapysdrplay/default.nix
index dbee593bd0d..d205462fb60 100644
--- a/pkgs/applications/radio/soapysdrplay/default.nix
+++ b/pkgs/applications/radio/soapysdrplay/default.nix
@@ -1,8 +1,8 @@
 { stdenv, lib, fetchFromGitHub, cmake, pkg-config, soapysdr, sdrplay }:
 
 stdenv.mkDerivation {
-  name = "soapysdr-sdrplay3";
-  version = "20210425";
+  pname = "soapysdr-sdrplay3";
+  version = "unstable-2021-04-25";
 
   src = fetchFromGitHub {
     owner = "pothosware";
diff --git a/pkgs/applications/radio/soundmodem/default.nix b/pkgs/applications/radio/soundmodem/default.nix
index bedcc8b02c4..01a8006822f 100644
--- a/pkgs/applications/radio/soundmodem/default.nix
+++ b/pkgs/applications/radio/soundmodem/default.nix
@@ -1,11 +1,11 @@
 { lib, stdenv, fetchurl, pkg-config, alsa-lib, audiofile, gtk2, libxml2 }:
 
 stdenv.mkDerivation rec {
-  name = "soundmodem";
+  pname = "soundmodem";
   version = "0.20";
 
   src = fetchurl {
-    url = "https://archive.org/download/${name}-${version}/${name}-${version}.tar.gz";
+    url = "https://archive.org/download/soundmodem-${version}/soundmodem-${version}.tar.gz";
     sha256 = "156l3wjnh5rcisxb42kcmlf74swf679v4xnj09zy5j74rd4h721z";
   };
 
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     '';
     #homepage = "http://gna.org/projects/soundmodem"; # official, but "Connection refused"
     homepage = "http://soundmodem.vk4msl.id.au/";
-    downloadPage = "https://archive.org/download/${name}-${version}/${name}-${version}.tar.gz";
+    downloadPage = "https://archive.org/download/${pname}-${version}/${pname}-${version}.tar.gz";
     license = licenses.gpl2Only;
     maintainers = with maintainers; [ ymarkus ];
     platforms = platforms.all;
diff --git a/pkgs/applications/science/biology/ncbi-tools/default.nix b/pkgs/applications/science/biology/ncbi-tools/default.nix
index 0e273dbefaa..dff041971ea 100644
--- a/pkgs/applications/science/biology/ncbi-tools/default.nix
+++ b/pkgs/applications/science/biology/ncbi-tools/default.nix
@@ -8,10 +8,10 @@
 # Another note: you may want the older and deprecated C-libs at ftp://ftp.ncbi.nih.gov/toolbox/ncbi_tools++/2008/Mar_17_2008/NCBI_C_Toolkit/ncbi_c--Mar_17_2008.tar.gz
 
 stdenv.mkDerivation rec {
-  name = "ncbi_tools";
-  ncbi_version = "Dec_31_2008";
+  pname = "ncbi_tools";
+  version = "Dec_31_2008";
   src = fetchurl {
-    url = "ftp://ftp.ncbi.nih.gov/toolbox/ncbi_tools++/2008/${ncbi_version}/ncbi_cxx--${ncbi_version}.tar.gz";
+    url = "ftp://ftp.ncbi.nih.gov/toolbox/ncbi_tools++/2008/${version}/ncbi_cxx--${version}.tar.gz";
     sha256 = "1b2v0dcdqn3bysgdkj57sxmd6s0hc9wpnxssviz399g6plhxggbr";
   };
 
diff --git a/pkgs/applications/science/chemistry/marvin/default.nix b/pkgs/applications/science/chemistry/marvin/default.nix
index 698095715cc..2b5a1b96950 100644
--- a/pkgs/applications/science/chemistry/marvin/default.nix
+++ b/pkgs/applications/science/chemistry/marvin/default.nix
@@ -4,12 +4,12 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "marvin";
-  version = "22.7.0";
+  version = "22.8.0";
 
   src = fetchurl {
     name = "marvin-${version}.deb";
     url = "http://dl.chemaxon.com/marvin/${version}/marvin_linux_${versions.majorMinor version}.deb";
-    sha256 = "sha256-xK4C+0/Qpc2vXPmsI8KuHuDJLmJ5LXdAfRIREE+gkWA=";
+    sha256 = "sha256-dmG2p4KqzjLuuVw+wPWaxVoqOqba8Tx5l44PauWpqv4=";
   };
 
   nativeBuildInputs = [ dpkg makeWrapper ];
diff --git a/pkgs/applications/science/electronics/xcircuit/default.nix b/pkgs/applications/science/electronics/xcircuit/default.nix
index 68322a19178..eb2a29382e6 100644
--- a/pkgs/applications/science/electronics/xcircuit/default.nix
+++ b/pkgs/applications/science/electronics/xcircuit/default.nix
@@ -1,16 +1,12 @@
 { lib, stdenv, fetchurl, autoreconfHook, automake, pkg-config
 , cairo, ghostscript, ngspice, tcl, tk, xorg, zlib }:
 
-let
+stdenv.mkDerivation rec {
   version = "3.10.12";
-  name = "xcircuit-${version}";
-  inherit (lib) getBin;
-
-in stdenv.mkDerivation {
-  inherit name version;
+  pname = "xcircuit";
 
   src = fetchurl {
-    url = "http://opencircuitdesign.com/xcircuit/archive/${name}.tgz";
+    url = "http://opencircuitdesign.com/xcircuit/archive/xcircuit-${version}.tgz";
     sha256 = "1h1ywc3mr7plvwnhdii2zgnnv5ih2nhyl4qbdjpi83dq0aq1s2mn";
   };
 
@@ -20,7 +16,7 @@ in stdenv.mkDerivation {
   configureFlags = [
     "--with-tcl=${tcl}/lib"
     "--with-tk=${tk}/lib"
-    "--with-ngspice=${getBin ngspice}/bin/ngspice"
+    "--with-ngspice=${lib.getBin ngspice}/bin/ngspice"
   ];
 
   buildInputs = with xorg; [ cairo ghostscript libSM libXt libICE libX11 libXpm tcl tk zlib ];
diff --git a/pkgs/applications/science/logic/coq/default.nix b/pkgs/applications/science/logic/coq/default.nix
index 29959be2fa9..a9fb2168158 100644
--- a/pkgs/applications/science/logic/coq/default.nix
+++ b/pkgs/applications/science/logic/coq/default.nix
@@ -47,6 +47,7 @@ let
    "8.14.0".sha256     = "04y2z0qyvag66zanfyc3f9agvmzbn4lsr0p1l7ck6yjhqx7vbm17";
    "8.14.1".sha256     = "0sx78pgx0qw8v7v2r32zzy3l161zipzq95iacda628girim7psnl";
    "8.15.0".sha256     = "sha256:1ma76wfrpfsl72yh10w1ys2a0vi0mdc2jc79kdc8nrmxkhpw1nxx";
+   "8.15.1".sha256     = "sha256:1dsa04jzkx5pw69pmxn0l55q4w88lg6fvz7clbga0bazzsfnsgd6";
   };
   releaseRev = v: "V${v}";
   fetched = import ../../../../build-support/coq/meta-fetch/default.nix
diff --git a/pkgs/applications/science/logic/z3/4.4.0.nix b/pkgs/applications/science/logic/z3/4.4.0.nix
index 2fbaa0a28ca..a3d6c16fb7d 100644
--- a/pkgs/applications/science/logic/z3/4.4.0.nix
+++ b/pkgs/applications/science/logic/z3/4.4.0.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, python }:
 
 stdenv.mkDerivation rec {
-  name = "z3-${version}";
+  pname = "z3";
   version = "4.4.0";
 
   src = fetchFromGitHub {
diff --git a/pkgs/applications/science/math/fricas/default.nix b/pkgs/applications/science/math/fricas/default.nix
index 79d5664426b..8c2541fe412 100644
--- a/pkgs/applications/science/math/fricas/default.nix
+++ b/pkgs/applications/science/math/fricas/default.nix
@@ -1,14 +1,11 @@
 { lib, stdenv, fetchurl, sbcl, libX11, libXpm, libICE, libSM, libXt, libXau, libXdmcp }:
 
-let
+stdenv.mkDerivation rec {
+  pname = "fricas";
   version = "1.3.7";
-  name = "fricas-" + version;
-in
-stdenv.mkDerivation {
-  inherit name;
 
   src = fetchurl {
-    url = "mirror://sourceforge/fricas/fricas/${version}/${name}-full.tar.bz2";
+    url = "mirror://sourceforge/fricas/fricas/${version}/fricas-${version}-full.tar.bz2";
     sha256 = "sha256-cOqMvSe3ef/ZeVy5cj/VU/aTRtxgfxZfRbE4lWE5TU4=";
   };
 
diff --git a/pkgs/applications/science/math/scilab-bin/default.nix b/pkgs/applications/science/math/scilab-bin/default.nix
index 18dba2952ca..65d8c145bef 100644
--- a/pkgs/applications/science/math/scilab-bin/default.nix
+++ b/pkgs/applications/science/math/scilab-bin/default.nix
@@ -1,11 +1,7 @@
 { stdenv, fetchurl, lib, xorg }:
 
 let
-  name = "scilab-bin-${ver}";
-
-  ver = "6.1.1";
-
-  badArch = throw "${name} requires i686-linux or x86_64-linux";
+  badArch = throw "scilab-bin requires i686-linux or x86_64-linux";
 
   architecture =
     if stdenv.hostPlatform.system == "i686-linux" then
@@ -15,11 +11,12 @@ let
     else
       badArch;
 in
-stdenv.mkDerivation {
-  inherit name;
+stdenv.mkDerivation rec {
+  pname = "scilab-bin";
+  version = "6.1.1";
 
   src = fetchurl {
-    url = "https://www.scilab.org/download/${ver}/scilab-${ver}.bin.linux-${architecture}.tar.gz";
+    url = "https://www.scilab.org/download/${version}/scilab-${version}.bin.linux-${architecture}.tar.gz";
     sha256 =
       if stdenv.hostPlatform.system == "i686-linux" then
         "0fgjc2ak3b2qi6yin3fy50qwk2bcj0zbz1h4lyyic9n1n1qcliib"
@@ -43,7 +40,7 @@ stdenv.mkDerivation {
     sed -i 's|\$(/bin/|$(|g' bin/scilab
     sed -i 's|/usr/bin/||g' bin/scilab
 
-    sci="$out/opt/scilab-${ver}"
+    sci="$out/opt/scilab-${version}"
     fullLibPath="$sci/lib/scilab:$sci/lib/thirdparty:$libPath"
     fullLibPath="$fullLibPath:$sci/lib/thirdparty/redist"
 
@@ -55,31 +52,31 @@ stdenv.mkDerivation {
   '';
 
   installPhase = ''
-    mkdir -p "$out/opt/scilab-${ver}"
-    cp -r . "$out/opt/scilab-${ver}/"
+    mkdir -p "$out/opt/scilab-${version}"
+    cp -r . "$out/opt/scilab-${version}/"
 
     # Create bin/ dir
     mkdir "$out/bin"
 
     # Creating executable symlinks
-    ln -s "$out/opt/scilab-${ver}/bin/scilab" "$out/bin/scilab"
-    ln -s "$out/opt/scilab-${ver}/bin/scilab-cli" "$out/bin/scilab-cli"
-    ln -s "$out/opt/scilab-${ver}/bin/scilab-adv-cli" "$out/bin/scilab-adv-cli"
+    ln -s "$out/opt/scilab-${version}/bin/scilab" "$out/bin/scilab"
+    ln -s "$out/opt/scilab-${version}/bin/scilab-cli" "$out/bin/scilab-cli"
+    ln -s "$out/opt/scilab-${version}/bin/scilab-adv-cli" "$out/bin/scilab-adv-cli"
 
     # Creating desktop config dir
     mkdir -p "$out/share/applications"
 
     # Moving desktop config files
-    mv $out/opt/scilab-${ver}/share/applications/*.desktop $out/share/applications
+    mv $out/opt/scilab-${version}/share/applications/*.desktop $out/share/applications
 
     # Fixing Exec paths and launching each app with a terminal
-    sed -i -e "s|Exec=|Exec=$out/opt/scilab-${ver}/bin/|g" \
+    sed -i -e "s|Exec=|Exec=$out/opt/scilab-${version}/bin/|g" \
            -e "s|Terminal=.*$|Terminal=true|g" $out/share/applications/*.desktop
 
     # Moving icons to the appropriate locations
-    for path in $out/opt/scilab-${ver}/share/icons/hicolor/*/*/*
+    for path in $out/opt/scilab-${version}/share/icons/hicolor/*/*/*
     do
-      newpath=$(echo $path | sed 's|/opt/scilab-${ver}||g')
+      newpath=$(echo $path | sed 's|/opt/scilab-${version}||g')
       filename=$(echo $path | sed 's|.*/||g')
       dir=$(echo $newpath | sed "s|$filename||g")
       mkdir -p $dir
@@ -87,10 +84,10 @@ stdenv.mkDerivation {
     done
 
     # Removing emptied folders
-    rm -rf $out/opt/scilab-${ver}/share/{applications,icons}
+    rm -rf $out/opt/scilab-${version}/share/{applications,icons}
 
     # Moving other share/ folders
-    mv $out/opt/scilab-${ver}/share/{appdata,locale,mime} $out/share
+    mv $out/opt/scilab-${version}/share/{appdata,locale,mime} $out/share
   '';
 
   meta = {
diff --git a/pkgs/applications/science/misc/fityk/default.nix b/pkgs/applications/science/misc/fityk/default.nix
index 974fd3ece45..a3d6e156466 100644
--- a/pkgs/applications/science/misc/fityk/default.nix
+++ b/pkgs/applications/science/misc/fityk/default.nix
@@ -1,12 +1,9 @@
 { lib, stdenv, fetchFromGitHub, autoreconfHook, wxGTK30, boost, lua, zlib, bzip2
 , xylib, readline, gnuplot, swig3 }:
 
-let
-  name    = "fityk";
+stdenv.mkDerivation rec {
+  pname = "fityk";
   version = "1.3.1";
-in
-stdenv.mkDerivation {
-  name = "${name}-${version}";
 
   src = fetchFromGitHub {
     owner = "wojdyr";
diff --git a/pkgs/applications/terminal-emulators/rxvt-unicode-plugins/urxvt-font-size/default.nix b/pkgs/applications/terminal-emulators/rxvt-unicode-plugins/urxvt-font-size/default.nix
index 88dae0a34ff..7824fa2a814 100644
--- a/pkgs/applications/terminal-emulators/rxvt-unicode-plugins/urxvt-font-size/default.nix
+++ b/pkgs/applications/terminal-emulators/rxvt-unicode-plugins/urxvt-font-size/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, xrdb, xlsfonts }:
 
 stdenv.mkDerivation rec {
-  name = "urxvt-font-size";
+  pname = "urxvt-font-size";
   version = "1.3";
 
   src = fetchFromGitHub {
diff --git a/pkgs/applications/terminal-emulators/termonad/default.nix b/pkgs/applications/terminal-emulators/termonad/default.nix
index 111d790c695..efddfa45466 100644
--- a/pkgs/applications/terminal-emulators/termonad/default.nix
+++ b/pkgs/applications/terminal-emulators/termonad/default.nix
@@ -3,7 +3,8 @@
 let
   termonadEnv = haskellPackages.ghcWithPackages (self: [ self.termonad ] ++ packages self);
 in stdenv.mkDerivation {
-  name = "termonad-with-packages-${termonadEnv.version}";
+  pname = "termonad-with-packages";
+  inherit (termonadEnv) version;
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/applications/version-management/git-and-tools/bfg-repo-cleaner/default.nix b/pkgs/applications/version-management/git-and-tools/bfg-repo-cleaner/default.nix
index 42ac2ed4508..7de53c7c541 100644
--- a/pkgs/applications/version-management/git-and-tools/bfg-repo-cleaner/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/bfg-repo-cleaner/default.nix
@@ -1,50 +1,46 @@
 { lib, stdenv, fetchurl, jre, makeWrapper }:
 
-let
+stdenv.mkDerivation rec {
+  pname = "bfg-repo-cleaner";
   version = "1.13.0";
-  jarName = "bfg-${version}.jar";
-  mavenUrl = "mirror://maven/com/madgag/bfg/${version}/${jarName}";
-in
-  stdenv.mkDerivation {
-    inherit version jarName;
-
-    name = "bfg-repo-cleaner-${version}";
-
-    src = fetchurl {
-      url = mavenUrl;
-      sha256 = "1kn84rsvms1v5l1j2xgrk7dc7mnsmxkc6sqd94mnim22vnwvl8mz";
-    };
 
-    nativeBuildInputs = [ makeWrapper ];
-    buildInputs = [ jre ];
-
-    dontUnpack = true;
+  jarName = "bfg-${version}.jar";
 
-    installPhase = ''
-      mkdir -p $out/share/java
-      mkdir -p $out/bin
-      cp $src $out/share/java/$jarName
-      makeWrapper "${jre}/bin/java" $out/bin/bfg --add-flags "-cp $out/share/java/$jarName com.madgag.git.bfg.cli.Main"
+  src = fetchurl {
+    url = "mirror://maven/com/madgag/bfg/${version}/${jarName}";
+    sha256 = "1kn84rsvms1v5l1j2xgrk7dc7mnsmxkc6sqd94mnim22vnwvl8mz";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre ];
+
+  dontUnpack = true;
+
+  installPhase = ''
+    mkdir -p $out/share/java
+    mkdir -p $out/bin
+    cp $src $out/share/java/$jarName
+    makeWrapper "${jre}/bin/java" $out/bin/bfg --add-flags "-cp $out/share/java/$jarName com.madgag.git.bfg.cli.Main"
+  '';
+
+  meta = with lib; {
+    homepage = "https://rtyley.github.io/bfg-repo-cleaner/";
+    # Descriptions taken with minor modification from the homepage of bfg-repo-cleaner
+    description = "Removes large or troublesome blobs in a git repository like git-filter-branch does, but faster";
+    longDescription = ''
+      The BFG is a simpler, faster alternative to git-filter-branch for
+      cleansing bad data out of your Git repository history, in particular removing
+      crazy big files and removing passwords, credentials, and other private data.
+
+      The git-filter-branch command is enormously powerful and can do things
+      that the BFG can't - but the BFG is much better for the tasks above, because
+      it's faster (10-720x), simpler (dedicated to just removing things), and
+      beautiful (can use Scala instead of bash to script customizations).
     '';
+    license = licenses.gpl3;
+    maintainers = [ maintainers.changlinli ];
+    platforms = platforms.unix;
+    downloadPage = "https://mvnrepository.com/artifact/com.madgag/bfg/${version}";
+  };
 
-    meta = with lib; {
-      homepage = "https://rtyley.github.io/bfg-repo-cleaner/";
-      # Descriptions taken with minor modification from the homepage of bfg-repo-cleaner
-      description = "Removes large or troublesome blobs in a git repository like git-filter-branch does, but faster";
-      longDescription = ''
-        The BFG is a simpler, faster alternative to git-filter-branch for
-        cleansing bad data out of your Git repository history, in particular removing
-        crazy big files and removing passwords, credentials, and other private data.
-
-        The git-filter-branch command is enormously powerful and can do things
-        that the BFG can't - but the BFG is much better for the tasks above, because
-        it's faster (10-720x), simpler (dedicated to just removing things), and
-        beautiful (can use Scala instead of bash to script customizations).
-      '';
-      license = licenses.gpl3;
-      maintainers = [ maintainers.changlinli ];
-      platforms = platforms.unix;
-      downloadPage = "https://mvnrepository.com/artifact/com.madgag/bfg/${version}";
-    };
-
-  }
+}
diff --git a/pkgs/applications/version-management/git-and-tools/git-secret/default.nix b/pkgs/applications/version-management/git-and-tools/git-secret/default.nix
index e3845af8926..4c50836cfdb 100644
--- a/pkgs/applications/version-management/git-and-tools/git-secret/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-secret/default.nix
@@ -1,14 +1,11 @@
 { stdenv, lib, fetchFromGitHub, makeWrapper, git, gnupg, gawk }:
 
-let
+stdenv.mkDerivation rec {
+  pname = "git-secret";
   version = "0.4.0";
-  repo = "git-secret";
-
-in stdenv.mkDerivation {
-  name = "${repo}-${version}";
 
   src = fetchFromGitHub {
-    inherit repo;
+    repo = "git-secret";
     owner = "sobolevn";
     rev = "v${version}";
     sha256 = "sha256-Mtuj+e/yCDr4XkmYkWUFJB3cqOT5yOMOq9P/QJV1S80=";
diff --git a/pkgs/applications/video/p2pvc/default.nix b/pkgs/applications/video/p2pvc/default.nix
index 35dceddf224..f64af16709f 100644
--- a/pkgs/applications/video/p2pvc/default.nix
+++ b/pkgs/applications/video/p2pvc/default.nix
@@ -1,7 +1,8 @@
 { lib, stdenv, pkg-config, fetchFromGitHub, opencv2, ncurses, portaudio }:
 
 stdenv.mkDerivation {
-  name = "p2pvc";
+  pname = "p2pvc";
+  version = "unstable-2015-02-12";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ opencv2 ncurses portaudio ];
diff --git a/pkgs/applications/virtualization/OVMF/default.nix b/pkgs/applications/virtualization/OVMF/default.nix
index 7adcd328add..843cebe7d6b 100644
--- a/pkgs/applications/virtualization/OVMF/default.nix
+++ b/pkgs/applications/virtualization/OVMF/default.nix
@@ -22,7 +22,8 @@ let
 in
 
 edk2.mkDerivation projectDscPath {
-  name = "OVMF-${version}";
+  pname = "OVMF";
+  inherit version;
 
   outputs = [ "out" "fd" ];
 
diff --git a/pkgs/applications/virtualization/containerd/default.nix b/pkgs/applications/virtualization/containerd/default.nix
index 281f1f24612..367f43deb80 100644
--- a/pkgs/applications/virtualization/containerd/default.nix
+++ b/pkgs/applications/virtualization/containerd/default.nix
@@ -10,13 +10,13 @@
 
 buildGoModule rec {
   pname = "containerd";
-  version = "1.6.1";
+  version = "1.6.2";
 
   src = fetchFromGitHub {
     owner = "containerd";
     repo = "containerd";
     rev = "v${version}";
-    sha256 = "sha256-NOFDUOypq/1ePM8rdK2cDnH1LsSZJ7eQOzDc5h4/PvY=";
+    sha256 = "sha256-l/9jOvZ4nn/wy+XPRoT1lojfGvPEXhPz2FJjLpZ/EE8=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/applications/virtualization/crun/default.nix b/pkgs/applications/virtualization/crun/default.nix
index 07e0cb6c533..5855eee6379 100644
--- a/pkgs/applications/virtualization/crun/default.nix
+++ b/pkgs/applications/virtualization/crun/default.nix
@@ -38,13 +38,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "crun";
-  version = "1.4.3";
+  version = "1.4.4";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = pname;
     rev = version;
-    sha256 = "sha256-5q8HirGOPsbaJ7JoLa4DRYkZX3kucWOZ633nzx4zVhg=";
+    sha256 = "sha256-ITUj905ZSdCH0mcw8tubyVKqI6p/oNcC4OW7/NbkR5o=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index 87bb16ab833..ef9050f47d9 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -243,19 +243,19 @@ rec {
   # Get revisions from
   # https://github.com/moby/moby/tree/${version}/hack/dockerfile/install/*
   docker_20_10 = callPackage dockerGen rec {
-    version = "20.10.13";
+    version = "20.10.14";
     rev = "v${version}";
     sha256 = "sha256-eDwgqFx4io++SMOjhxMxVzqzcOgOnv6Xe/qmmPCvZts=";
     moby-src = fetchFromGitHub {
       owner = "moby";
       repo = "moby";
       rev = "v${version}";
-      sha256 = "sha256-ajceIdMM8yAa+bvTjRwZ/zF7yTLF2LhGmbrweWni7hM=";
+      sha256 = "sha256-I5oxpFLH789I2Sb29OXDaM4fCbQT/KvPq0DYcAVp0aI=";
     };
     runcRev = "v1.0.3";
     runcSha256 = "sha256-Tl/JKbIpao+FCjngPzaVkxse50zo3XQ9Mg/AdkblMcI=";
-    containerdRev = "v1.5.10";
-    containerdSha256 = "sha256-ee0dwWSGedo08omKOmZtW5qQ1J5M9Mm+kZHq7a+zyT4=";
+    containerdRev = "v1.5.11";
+    containerdSha256 = "sha256-YzFtv6DIjImSK0SywxhZrEeEmCnHTceAi3pfwnPubKg=";
     tiniRev = "v0.19.0";
     tiniSha256 = "sha256-ZDKu/8yE5G0RYFJdhgmCdN3obJNyRWv6K/Gd17zc1sI=";
   };
diff --git a/pkgs/applications/virtualization/docker/gc.nix b/pkgs/applications/virtualization/docker/gc.nix
index 52ca54501d7..0736516ee7d 100644
--- a/pkgs/applications/virtualization/docker/gc.nix
+++ b/pkgs/applications/virtualization/docker/gc.nix
@@ -3,13 +3,13 @@
 with lib;
 
 stdenv.mkDerivation rec {
-  name = "docker-gc-${rev}";
-  rev = "b0cc52aa3da2e2ac0080794e0be6e674b1f063fc";
+  pname = "docker-gc";
+  version = "unstable-2015-10-5";
 
   src = fetchFromGitHub {
-    inherit rev;
     owner = "spotify";
     repo = "docker-gc";
+    rev = "b0cc52aa3da2e2ac0080794e0be6e674b1f063fc";
     sha256 = "07wf9yn0f771xkm3x12946x5rp83hxjkd70xgfgy35zvj27wskzm";
   };
 
diff --git a/pkgs/applications/virtualization/docker/proxy.nix b/pkgs/applications/virtualization/docker/proxy.nix
index a247e2cecfa..6038a129e2a 100644
--- a/pkgs/applications/virtualization/docker/proxy.nix
+++ b/pkgs/applications/virtualization/docker/proxy.nix
@@ -1,13 +1,13 @@
 { lib, buildGoPackage, fetchFromGitHub }:
 
 buildGoPackage rec {
-  name = "docker-proxy-${rev}";
-  rev = "fa125a3512ee0f6187721c88582bf8c4378bd4d7";
+  pname = "docker-proxy";
+  version = "unstable-2020-12-15";
 
   src = fetchFromGitHub {
-    inherit rev;
     owner = "docker";
     repo = "libnetwork";
+    rev = "fa125a3512ee0f6187721c88582bf8c4378bd4d7";
     sha256 = "1r47y0gww3j7fas4kgiqbhrz5fazsx1c6sxnccdfhj8fzik77s9y";
   };
 
diff --git a/pkgs/applications/virtualization/gvisor/containerd-shim.nix b/pkgs/applications/virtualization/gvisor/containerd-shim.nix
index c8610b73865..612ef0f4b53 100644
--- a/pkgs/applications/virtualization/gvisor/containerd-shim.nix
+++ b/pkgs/applications/virtualization/gvisor/containerd-shim.nix
@@ -1,8 +1,8 @@
 { lib, fetchFromGitHub, buildGoModule }:
 
 buildGoModule rec {
-  name = "gvisor-containerd-shim-${version}";
-  version = "2019-10-09";
+  pname = "gvisor-containerd-shim";
+  version = "unstable-2019-10-09";
 
   src = fetchFromGitHub {
     owner  = "google";
diff --git a/pkgs/applications/virtualization/gvisor/default.nix b/pkgs/applications/virtualization/gvisor/default.nix
index 4cd043d4eb6..cf6f2102e6a 100644
--- a/pkgs/applications/virtualization/gvisor/default.nix
+++ b/pkgs/applications/virtualization/gvisor/default.nix
@@ -52,7 +52,7 @@ let
   };
 
 in buildBazelPackage rec {
-  name = "gvisor-${version}";
+  pname = "gvisor";
   version = "20210518.0";
 
   src = fetchFromGitHub {
diff --git a/pkgs/applications/virtualization/qemu/utils.nix b/pkgs/applications/virtualization/qemu/utils.nix
index 90783039a1a..d9a88bf545b 100644
--- a/pkgs/applications/virtualization/qemu/utils.nix
+++ b/pkgs/applications/virtualization/qemu/utils.nix
@@ -1,8 +1,8 @@
 { stdenv, installShellFiles, qemu }:
 
 stdenv.mkDerivation rec {
-  name = "qemu-utils-${version}";
-  version = qemu.version;
+  pname = "qemu-utils";
+  inherit (qemu) version;
 
   nativeBuildInputs = [ installShellFiles ];
   buildInputs = [ qemu ];
diff --git a/pkgs/applications/virtualization/virt-viewer/default.nix b/pkgs/applications/virtualization/virt-viewer/default.nix
index 29e05a069ce..86474da9ee6 100644
--- a/pkgs/applications/virtualization/virt-viewer/default.nix
+++ b/pkgs/applications/virtualization/virt-viewer/default.nix
@@ -35,12 +35,11 @@ assert spiceSupport -> (
 with lib;
 
 stdenv.mkDerivation rec {
-  baseName = "virt-viewer";
+  pname = "virt-viewer";
   version = "11.0";
-  name = "${baseName}-${version}";
 
   src = fetchurl {
-    url = "http://virt-manager.org/download/sources/${baseName}/${name}.tar.xz";
+    url = "https://releases.pagure.org/virt-viewer/virt-viewer-${version}.tar.xz";
     sha256 = "sha256-pD+iMlxMHHelyMmAZaww7wURohrJjlkPIjQIabrZq9A=";
   };
 
diff --git a/pkgs/applications/window-managers/clfswm/default.nix b/pkgs/applications/window-managers/clfswm/default.nix
index 1c6f92a38f2..9984e878846 100644
--- a/pkgs/applications/window-managers/clfswm/default.nix
+++ b/pkgs/applications/window-managers/clfswm/default.nix
@@ -2,11 +2,12 @@
 , makeWrapper }:
 
 stdenv.mkDerivation {
-  name = "clfswm";
+  pname = "clfswm";
+  version = "unstable-2016-11-12";
 
   src = fetchgit {
     url = "https://gitlab.common-lisp.net/clfswm/clfswm.git";
-    rev = "refs/heads/master";
+    rev = "3c7721dba6339ebb4f8c8d7ce2341740fa86f837";
     sha256 = "0hynzh3a1zr719cxfb0k4cvh5lskzs616hwn7p942isyvhwzhynd";
   };
 
diff --git a/pkgs/applications/window-managers/taffybar/default.nix b/pkgs/applications/window-managers/taffybar/default.nix
index 7d9e5f9c1cb..2afb6e505c3 100644
--- a/pkgs/applications/window-managers/taffybar/default.nix
+++ b/pkgs/applications/window-managers/taffybar/default.nix
@@ -5,7 +5,8 @@ let
     self.taffybar
   ] ++ packages self);
 in stdenv.mkDerivation {
-  name = "taffybar-with-packages-${taffybarEnv.version}";
+  pname = "taffybar-with-packages";
+  inherit (taffybarEnv) version;
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/applications/window-managers/xmonad/wrapper.nix b/pkgs/applications/window-managers/xmonad/wrapper.nix
index f5c9f12a23f..409bf73c893 100644
--- a/pkgs/applications/window-managers/xmonad/wrapper.nix
+++ b/pkgs/applications/window-managers/xmonad/wrapper.nix
@@ -3,7 +3,8 @@
 let
 xmonadEnv = ghcWithPackages (self: [ self.xmonad ] ++ packages self);
 in stdenv.mkDerivation {
-  name = "xmonad-with-packages-${xmonadEnv.version}";
+  pname = "xmonad-with-packages";
+  inherit (xmonadEnv) version;
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/data/documentation/std-man-pages/default.nix b/pkgs/data/documentation/std-man-pages/default.nix
index a2f9f005eb9..c9ce9c2bf76 100644
--- a/pkgs/data/documentation/std-man-pages/default.nix
+++ b/pkgs/data/documentation/std-man-pages/default.nix
@@ -1,10 +1,11 @@
 { stdenv, lib, fetchurl }:
 
-stdenv.mkDerivation {
-  name = "std-man-pages-4.4.0";
+stdenv.mkDerivation rec {
+  pname = "std-man-pages";
+  version = "4.4.0";
 
   src = fetchurl {
-    url = "mirror://gcc/libstdc++/doxygen/libstdc++-man.4.4.0.tar.bz2";
+    url = "mirror://gcc/libstdc++/doxygen/libstdc++-man.${version}.tar.bz2";
     sha256 = "0153py77ll759jacq41dp2z2ksr08pdcfic0rwjd6pr84dk89y9v";
   };
 
diff --git a/pkgs/data/fonts/sarasa-gothic/default.nix b/pkgs/data/fonts/sarasa-gothic/default.nix
index efd58b348dc..57c35613674 100644
--- a/pkgs/data/fonts/sarasa-gothic/default.nix
+++ b/pkgs/data/fonts/sarasa-gothic/default.nix
@@ -1,14 +1,14 @@
 { lib, fetchurl, libarchive }:
 
 let
-  version = "0.36.0";
+  version = "0.36.1";
 in fetchurl {
   name = "sarasa-gothic-${version}";
 
   # Use the 'ttc' files here for a smaller closure size.
   # (Using 'ttf' files gives a closure size about 15x larger, as of November 2021.)
   url = "https://github.com/be5invis/Sarasa-Gothic/releases/download/v${version}/sarasa-gothic-ttc-${version}.7z";
-  sha256 = "sha256-ENBF7dVFp9lrGGRwNIB0Yg7y1F5XbVivgD2e9pLZQwQ=";
+  sha256 = "sha256-w8PVDvbnHFZF7/X4EzO0IJsEKMC7c+GPng1sn8Q8G14=";
 
   recursiveHash = true;
   downloadToTemp = true;
diff --git a/pkgs/data/icons/faba-icon-theme/default.nix b/pkgs/data/icons/faba-icon-theme/default.nix
index 6ccd4c4622f..1119e248522 100644
--- a/pkgs/data/icons/faba-icon-theme/default.nix
+++ b/pkgs/data/icons/faba-icon-theme/default.nix
@@ -1,13 +1,12 @@
 { lib, stdenv, fetchFromGitHub, meson, ninja, python3, gtk3, pantheon, gnome-icon-theme, hicolor-icon-theme }:
 
 stdenv.mkDerivation rec {
-  name = "${package-name}-${version}";
-  package-name = "faba-icon-theme";
+  pname = "faba-icon-theme";
   version = "4.3";
 
   src = fetchFromGitHub {
     owner = "moka-project";
-    repo = package-name;
+    repo = "faba-icon-theme";
     rev = "v${version}";
     sha256 = "0xh6ppr73p76z60ym49b4d0liwdc96w41cc5p07d48hxjsa6qd6n";
   };
diff --git a/pkgs/data/icons/tango-icon-theme/default.nix b/pkgs/data/icons/tango-icon-theme/default.nix
index 09d0875ca8a..9e6b0666a11 100644
--- a/pkgs/data/icons/tango-icon-theme/default.nix
+++ b/pkgs/data/icons/tango-icon-theme/default.nix
@@ -3,10 +3,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "tango-icon-theme-0.8.90";
+  pname = "tango-icon-theme";
+  version = "0.8.90";
 
   src = fetchurl {
-    url = "http://tango.freedesktop.org/releases/${name}.tar.gz";
+    url = "http://tango.freedesktop.org/releases/tango-icon-theme-${version}.tar.gz";
     sha256 = "13n8cpml71w6zfm2jz5fa7r1z18qlzk4gv07r6n1in2p5l1xi63f";
   };
 
diff --git a/pkgs/data/misc/brise/default.nix b/pkgs/data/misc/brise/default.nix
index f4e1a6d2905..45f86f6be21 100644
--- a/pkgs/data/misc/brise/default.nix
+++ b/pkgs/data/misc/brise/default.nix
@@ -1,7 +1,8 @@
 { lib, stdenv, fetchFromGitHub, librime }:
 
 stdenv.mkDerivation {
-  name = "brise-unstable-2017-09-16";
+  pname = "brise";
+  version = "unstable-2017-09-16";
 
   src = fetchFromGitHub {
     owner = "rime";
diff --git a/pkgs/data/misc/miscfiles/default.nix b/pkgs/data/misc/miscfiles/default.nix
index 783dc29ecb2..ad58e5bd7b7 100644
--- a/pkgs/data/misc/miscfiles/default.nix
+++ b/pkgs/data/misc/miscfiles/default.nix
@@ -1,10 +1,11 @@
 {lib, stdenv, fetchurl}:
 
 stdenv.mkDerivation rec {
-  name = "miscfiles-1.5";
+  pname = "miscfiles";
+  version = "1.5";
 
   src = fetchurl {
-    url = "mirror://gnu/miscfiles/${name}.tar.gz";
+    url = "mirror://gnu/miscfiles/miscfiles-${version}.tar.gz";
     sha256 = "005588vfrwx8ghsdv9p7zczj9lbc9a3r4m5aphcaqv8gif4siaka";
   };
 
diff --git a/pkgs/data/misc/shared-desktop-ontologies/default.nix b/pkgs/data/misc/shared-desktop-ontologies/default.nix
index 88f9eec8fca..fd797d8d63f 100644
--- a/pkgs/data/misc/shared-desktop-ontologies/default.nix
+++ b/pkgs/data/misc/shared-desktop-ontologies/default.nix
@@ -1,10 +1,11 @@
 { lib, stdenv, fetchurl, cmake }:
 
 stdenv.mkDerivation rec {
-  name = "shared-desktop-ontologies-0.11.0";
+  pname = "shared-desktop-ontologies";
+  version = "0.11.0";
 
   src = fetchurl {
-    url = "mirror://sourceforge/oscaf/${name}.tar.bz2";
+    url = "mirror://sourceforge/oscaf/shared-desktop-ontologies-${version}.tar.bz2";
     sha256 = "1m5vnijg7rnwg41vig2ckg632dlczzdab1gsq51g4x7m9k1fdbw2";
   };
 
diff --git a/pkgs/data/themes/dracula-theme/default.nix b/pkgs/data/themes/dracula-theme/default.nix
index cb6fc84723f..326e004070b 100644
--- a/pkgs/data/themes/dracula-theme/default.nix
+++ b/pkgs/data/themes/dracula-theme/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation {
   installPhase = ''
     runHook preInstall
     mkdir -p $out/share/themes/${themeName}
-    cp -a {assets,cinnamon,gnome-shell,gtk-2.0,gtk-3.0,gtk-3.20,index.theme,metacity-1,unity,xfwm4} $out/share/themes/${themeName}
+    cp -a {assets,cinnamon,gnome-shell,gtk-2.0,gtk-3.0,gtk-3.20,gtk-4.0,index.theme,metacity-1,unity,xfwm4} $out/share/themes/${themeName}
 
     cp -a kde/{color-schemes,plasma} $out/share/
     cp -a kde/kvantum $out/share/Kvantum
diff --git a/pkgs/desktops/gnome/apps/gnome-notes/default.nix b/pkgs/desktops/gnome/apps/gnome-notes/default.nix
index 6af206069e2..0ecd1e2ef6f 100644
--- a/pkgs/desktops/gnome/apps/gnome-notes/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-notes/default.nix
@@ -1,8 +1,10 @@
-{ lib, stdenv
+{ stdenv
+, lib
 , meson
 , ninja
 , gettext
 , fetchurl
+, fetchpatch
 , pkg-config
 , wrapGAppsHook
 , itstool
@@ -32,6 +34,15 @@ stdenv.mkDerivation rec {
     sha256 = "1gvvb2klkzbmyzwkjgmscdiqcl8lyz9b0rxb4igjz079csq6z805";
   };
 
+  patches = [
+    # Fix build with meson 0.61
+    # data/appdata/meson.build:3:5: ERROR: Function does not take positional arguments.
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/gnome-notes/-/commit/994af76ce5144062d55d141129bf6bf5fab002ee.patch";
+      sha256 = "sha256-z7dPOLZzaqvdqUIDy6+V3dKossRbG0EDjBu2oJCF6b4=";
+    })
+  ];
+
   doCheck = true;
 
   postPatch = ''
diff --git a/pkgs/desktops/gnome/core/gnome-dictionary/default.nix b/pkgs/desktops/gnome/core/gnome-dictionary/default.nix
index a399c4e8537..6cdb8831c48 100644
--- a/pkgs/desktops/gnome/core/gnome-dictionary/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-dictionary/default.nix
@@ -1,6 +1,24 @@
-{ lib, stdenv, fetchurl, meson, ninja, pkg-config, desktop-file-utils, appstream-glib, libxslt
-, libxml2, gettext, itstool, wrapGAppsHook, docbook_xsl, docbook_xml_dtd_43
-, gnome, gtk3, glib, gsettings-desktop-schemas }:
+{ stdenv
+, lib
+, fetchurl
+, fetchpatch
+, meson
+, ninja
+, pkg-config
+, desktop-file-utils
+, appstream-glib
+, libxslt
+, libxml2
+, gettext
+, itstool
+, wrapGAppsHook
+, docbook_xsl
+, docbook_xml_dtd_43
+, gnome
+, gtk3
+, glib
+, gsettings-desktop-schemas
+}:
 
 stdenv.mkDerivation rec {
   pname = "gnome-dictionary";
@@ -11,13 +29,44 @@ stdenv.mkDerivation rec {
     sha256 = "1d8dhcfys788vv27v34i3s3x3jdvdi2kqn2a5p8c937a9hm0qr9f";
   };
 
-  doCheck = true;
+  patches = [
+    # Fix test dependencies with meson 0.57, can be removed on next bump
+    # We need to explicitly depend on the generated files.
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/gnome-dictionary/-/commit/87c026cfe4acbcfc62d15950f88a71d8d9678c7e.patch";
+      sha256 = "tKesWeOK3OqOxrXm4dZvCZHHdTD7AQbYDjtYDCsLd3A=";
+    })
+    # Fix build with meson 0.61, can be removed on next bump
+    # data/appdata/meson.build:3:5: ERROR: Function does not take positional arguments.
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/gnome-dictionary/-/commit/cf3f8a67cd6f3059c555ed9cf0f5fba10abb7f68.patch";
+      sha256 = "cIRM6ACqsnEo2JWYvr6EBye5o0BudugZMShCe1U5hz8=";
+    })
+  ];
 
   nativeBuildInputs = [
-    meson ninja pkg-config wrapGAppsHook libxml2 gettext itstool
-    desktop-file-utils appstream-glib libxslt docbook_xsl docbook_xml_dtd_43
+    meson
+    ninja
+    pkg-config
+    wrapGAppsHook
+    libxml2
+    gettext
+    itstool
+    desktop-file-utils
+    appstream-glib
+    libxslt
+    docbook_xsl
+    docbook_xml_dtd_43
+  ];
+
+  buildInputs = [
+    gtk3
+    glib
+    gsettings-desktop-schemas
+    gnome.adwaita-icon-theme
   ];
-  buildInputs = [ gtk3 glib gsettings-desktop-schemas gnome.adwaita-icon-theme ];
+
+  doCheck = true;
 
   passthru = {
     updateScript = gnome.updateScript {
diff --git a/pkgs/desktops/gnome/core/gucharmap/default.nix b/pkgs/desktops/gnome/core/gucharmap/default.nix
index 7d15e6b41ef..3dc08e66357 100644
--- a/pkgs/desktops/gnome/core/gucharmap/default.nix
+++ b/pkgs/desktops/gnome/core/gucharmap/default.nix
@@ -7,7 +7,7 @@
 , pkg-config
 , python3
 , gtk3
-, adwaita-icon-theme
+, pcre2
 , glib
 , desktop-file-utils
 , gtk-doc
@@ -45,7 +45,7 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "gucharmap";
-  version = "14.0.0";
+  version = "14.0.2";
 
   outputs = [ "out" "lib" "dev" "devdoc" ];
 
@@ -54,7 +54,7 @@ in stdenv.mkDerivation rec {
     owner = "GNOME";
     repo = pname;
     rev = version;
-    sha256 = "sha256-d283zVRH42NZNq+vGmItN3ZBrRrl9gpYDco7osm3RoY=";
+    sha256 = "sha256-gyOm/S0ae0kX4AFUiglqyGRGB8C/KUuaG/dr/Wf1ug0=";
   };
 
   nativeBuildInputs = [
@@ -79,7 +79,7 @@ in stdenv.mkDerivation rec {
     gtk3
     glib
     gsettings-desktop-schemas
-    adwaita-icon-theme
+    pcre2
   ];
 
   mesonFlags = [
diff --git a/pkgs/desktops/gnome/games/gnome-mahjongg/default.nix b/pkgs/desktops/gnome/games/gnome-mahjongg/default.nix
index 7ef68e470e1..698741ba836 100644
--- a/pkgs/desktops/gnome/games/gnome-mahjongg/default.nix
+++ b/pkgs/desktops/gnome/games/gnome-mahjongg/default.nix
@@ -1,6 +1,20 @@
-{ lib, stdenv, fetchurl, pkg-config, gnome, gtk3, wrapGAppsHook
-, librsvg, gettext, itstool, libxml2
-, meson, ninja, glib, vala, desktop-file-utils
+{ stdenv
+, lib
+, fetchurl
+, fetchpatch
+, pkg-config
+, gnome
+, gtk3
+, wrapGAppsHook
+, librsvg
+, gettext
+, itstool
+, libxml2
+, meson
+, ninja
+, glib
+, vala
+, desktop-file-utils
 }:
 
 stdenv.mkDerivation rec {
@@ -12,12 +26,30 @@ stdenv.mkDerivation rec {
     sha256 = "144ia3zn9rhwa1xbdkvsz6m0dsysl6mxvqw9bnrlh845hmyy9cfj";
   };
 
+  patches = [
+    # Fix build with meson 0.61
+    # data/meson.build:24:0: ERROR: Function does not take positional arguments.
+    # data/meson.build:45:0: ERROR: Function does not take positional arguments.
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/gnome-mahjongg/-/commit/a2037b0747163601a5d5b57856d037eecf3a4db7.patch";
+      sha256 = "Wcder6Y9H6c1f8I+IPDvST3umaCU21HgxfXn809JDz0=";
+    })
+  ];
+
   nativeBuildInputs = [
-    meson ninja vala desktop-file-utils
-    pkg-config gnome.adwaita-icon-theme
-    libxml2 itstool gettext wrapGAppsHook
+    meson
+    ninja
+    vala
+    desktop-file-utils
+    pkg-config
+    gnome.adwaita-icon-theme
+    libxml2
+    itstool
+    gettext
+    wrapGAppsHook
     glib # for glib-compile-schemas
   ];
+
   buildInputs = [
     glib
     gtk3
diff --git a/pkgs/desktops/gnome/games/gnome-tetravex/default.nix b/pkgs/desktops/gnome/games/gnome-tetravex/default.nix
index a1cdf98d9a1..6578bf7c058 100644
--- a/pkgs/desktops/gnome/games/gnome-tetravex/default.nix
+++ b/pkgs/desktops/gnome/games/gnome-tetravex/default.nix
@@ -1,6 +1,19 @@
-{ lib, stdenv, fetchurl, pkg-config, gnome, gtk3, wrapGAppsHook
-, libxml2, gettext, itstool, meson, ninja, python3
-, vala, desktop-file-utils
+{ stdenv
+, lib
+, fetchurl
+, fetchpatch
+, pkg-config
+, gnome
+, gtk3
+, wrapGAppsHook
+, libxml2
+, gettext
+, itstool
+, meson
+, ninja
+, python3
+, vala
+, desktop-file-utils
 }:
 
 stdenv.mkDerivation rec {
@@ -12,14 +25,31 @@ stdenv.mkDerivation rec {
     sha256 = "06wihvqp2p52zd2dnknsc3rii69qib4a30yp15h558xrg44z3k8z";
   };
 
-  passthru = {
-    updateScript = gnome.updateScript { packageName = "gnome-tetravex"; attrPath = "gnome.gnome-tetravex"; };
-  };
+  patches = [
+    # Fix build with meson 0.61
+    # data/meson.build:37:0: ERROR: Function does not take positional arguments.
+    # data/meson.build:59:0: ERROR: Function does not take positional arguments.
+    # Taken from https://gitlab.gnome.org/GNOME/gnome-tetravex/-/merge_requests/20
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/gnome-tetravex/-/commit/80912d06f5e588f6aca966fa516103275e58d94e.patch";
+      sha256 = "2+nFw5sJzbInibKaq3J10Ufbl3CnZWlgnUtzRTZ5G0I=";
+    })
+  ];
 
   nativeBuildInputs = [
-    wrapGAppsHook itstool libxml2 gnome.adwaita-icon-theme
-    pkg-config gettext meson ninja python3 vala desktop-file-utils
+    wrapGAppsHook
+    itstool
+    libxml2
+    gnome.adwaita-icon-theme
+    pkg-config
+    gettext
+    meson
+    ninja
+    python3
+    vala
+    desktop-file-utils
   ];
+
   buildInputs = [
     gtk3
   ];
@@ -29,6 +59,13 @@ stdenv.mkDerivation rec {
     patchShebangs build-aux/meson_post_install.py
   '';
 
+  passthru = {
+    updateScript = gnome.updateScript {
+      packageName = "gnome-tetravex";
+      attrPath = "gnome.gnome-tetravex";
+    };
+  };
+
   meta = with lib; {
     homepage = "https://wiki.gnome.org/Apps/Tetravex";
     description = "Complete the puzzle by matching numbered tiles";
diff --git a/pkgs/desktops/gnome/games/hitori/default.nix b/pkgs/desktops/gnome/games/hitori/default.nix
index 15759c68198..bb210c2fffb 100644
--- a/pkgs/desktops/gnome/games/hitori/default.nix
+++ b/pkgs/desktops/gnome/games/hitori/default.nix
@@ -1,5 +1,7 @@
-{ lib, stdenv
+{ stdenv
+, lib
 , fetchurl
+, fetchpatch
 , meson
 , ninja
 , pkg-config
@@ -25,6 +27,15 @@ stdenv.mkDerivation rec {
     sha256 = "99cQPLBjP7ATcwExqYw646IWK5+5SZ/H8ZUS1YG/ZWk=";
   };
 
+  patches = [
+    # Fix build with meson 0.61
+    # data/meson.build:3:0: ERROR: Function does not take positional arguments.
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/hitori/-/commit/d25728e122f1d7b985029a5ba96810c3e57c27f7.patch";
+      sha256 = "LwBpFFr+vLacLTpto7PwvO1p2lku6epyEv9YZvUvW+g=";
+    })
+  ];
+
   nativeBuildInputs = [
     meson
     ninja
diff --git a/pkgs/desktops/gnome/misc/gitg/default.nix b/pkgs/desktops/gnome/misc/gitg/default.nix
index e29464556ec..31e6bd7f2ed 100644
--- a/pkgs/desktops/gnome/misc/gitg/default.nix
+++ b/pkgs/desktops/gnome/misc/gitg/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
 , vala
 , gettext
 , pkg-config
@@ -36,6 +37,15 @@ stdenv.mkDerivation rec {
     sha256 = "f7Ybn7EPuqVI0j1wZbq9cq1j5iHeVYQMBlzm45hsRik=";
   };
 
+  patches = [
+    # Fix build with meson 0.61
+    # data/meson.build:8:5: ERROR: Function does not take positional arguments.
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/gitg/-/commit/1978973b12848741b08695ec2020bac98584d636.patch";
+      sha256 = "sha256-RzaGPGGiKMgjy0waFqt48rV2yWBGZgC3kHehhVhxktk=";
+    })
+  ];
+
   nativeBuildInputs = [
     gobject-introspection
     gettext
diff --git a/pkgs/development/compilers/openjdk/8.nix b/pkgs/development/compilers/openjdk/8.nix
index 8d68c2a6010..dae405ff3b2 100644
--- a/pkgs/development/compilers/openjdk/8.nix
+++ b/pkgs/development/compilers/openjdk/8.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, pkg-config, lndir, bash, cpio, file, which, unzip, zip
+{ stdenv, lib, fetchFromGitHub, pkg-config, lndir, bash, cpio, file, which, unzip, zip
 , cups, freetype, alsa-lib, cacert, perl, liberation_ttf, fontconfig, zlib
 , libX11, libICE, libXrender, libXext, libXt, libXtst, libXi, libXinerama, libXcursor, libXrandr
 , libjpeg, giflib
@@ -19,68 +19,19 @@ let
     aarch64-linux = "aarch64";
   }.${stdenv.system} or (throw "Unsupported platform");
 
-  update = "272";
-  build = if stdenv.isAarch64 then "b10" else "b10";
-  baseurl = if stdenv.isAarch64 then "https://hg.openjdk.java.net/aarch64-port/jdk8u-shenandoah"
-            else "https://hg.openjdk.java.net/jdk8u/jdk8u";
-  repover = lib.optionalString stdenv.isAarch64 "aarch64-shenandoah-"
-            + "jdk8u${update}-${build}";
-
-  jdk8 = fetchurl {
-             name = "jdk8-${repover}.tar.gz";
-             url = "${baseurl}/archive/${repover}.tar.gz";
-             sha256 = if stdenv.isAarch64 then "db98897d6fddce85996a9b0daf4352abce4578be0b51eada41702ee1469dd415"
-                      else "8f0e8324d3500432e8ed642b4cc7dff90a617dbb2a18a94c07c1020d32f93b7a";
-          };
-  langtools = fetchurl {
-             name = "langtools-${repover}.tar.gz";
-             url = "${baseurl}/langtools/archive/${repover}.tar.gz";
-             sha256 = if stdenv.isAarch64 then "6544c1cc455844bbbb3d2914ffc716b1cee7f19e6aa223764d41a7cddc41322c"
-                      else "632417b0b067c929eda6958341352e29c5810056a5fec138641eb3503f9635b7";
-          };
-  hotspot = fetchurl {
-             name = "hotspot-${repover}.tar.gz";
-             url = "${baseurl}/hotspot/archive/${repover}.tar.gz";
-             sha256 = if stdenv.isAarch64 then "37abb89e66641607dc6f372946bfc6bd413f23fec0b9c3baf75f41ce517e21d8"
-                      else "2142f3b769800a955613b51ffe192551bab1db95b0c219900cf34febc6f20245";
-          };
-  corba = fetchurl {
-             name = "corba-${repover}.tar.gz";
-             url = "${baseurl}/corba/archive/${repover}.tar.gz";
-             sha256 = if stdenv.isAarch64 then "5da82f7b4aceff32e02d2f559033e3b62b9509d79f1a6891af871502e1d125b1"
-                      else "320098d64c843c1ff2ae62579817f9fb4a81772bc0313a543ce68976ad7a6d98";
-          };
-  jdk = fetchurl {
-             name = "jdk-${repover}.tar.gz";
-             url = "${baseurl}/jdk/archive/${repover}.tar.gz";
-             sha256 = if stdenv.isAarch64 then "ee613296d823605dcd1a0fe2f89b4c7393bdb8ae5f2659f48f5cbc0012bb1a47"
-                      else "957c24fc58ac723c8cd808ab60c77d7853710148944c8b9a59f470c4c809e1a0";
-          };
-  jaxws = fetchurl {
-             name = "jaxws-${repover}.tar.gz";
-             url = "${baseurl}/jaxws/archive/${repover}.tar.gz";
-             sha256 = if stdenv.isAarch64 then "7c426b85f0d378125fa46e6d1b25ddc27ad29d93514d38c5935c84fc540b26ce"
-                      else "4efb0ee143dfe86c8ee06db2429fb81a0c8c65af9ea8fc18daa05148c8a1162f";
-          };
-  jaxp = fetchurl {
-             name = "jaxp-${repover}.tar.gz";
-             url = "${baseurl}/jaxp/archive/${repover}.tar.gz";
-             sha256 = if stdenv.isAarch64 then "928e363877afa7e0ad0c350bb18be6ab056b23708c0624a0bd7f01c4106c2a14"
-                      else "25a651c670d5b036042f7244617a3eb11fec80c07745c1c8181a1cdebeda3d8e";
-          };
-  nashorn = fetchurl {
-             name = "nashorn-${repover}.tar.gz";
-             url = "${baseurl}/nashorn/archive/${repover}.tar.gz";
-             sha256 = if stdenv.isAarch64 then "f060e08c5924457d4f5047c02ad6a987bdbdcd1cea53d2208322073ba4f398c3"
-                      else "a28b41d86f0c87ceacd2b686dd31c9bf391d851b1b5187a49ef5e565fc2cbc84";
-          };
-  openjdk8 = stdenv.mkDerivation {
+  update = "322";
+  build = "ga";
+
+  openjdk8 = stdenv.mkDerivation rec {
     pname = "openjdk" + lib.optionalString headless "-headless";
     version = "8u${update}-${build}";
 
-    srcs = [ jdk8 langtools hotspot corba jdk jaxws jaxp nashorn ];
-    sourceRoot = ".";
-
+    src = fetchFromGitHub {
+      owner = "openjdk";
+      repo = "jdk8u";
+      rev = "jdk${version}";
+      sha256 = "sha256-e39Yv+NDQG7z6fGmpKEnkKd5MoHZ50SXlq/Q7lzWcDA=";
+    };
     outputs = [ "out" "jre" ];
 
     nativeBuildInputs = [ pkg-config lndir unzip ];
@@ -92,16 +43,6 @@ let
       gtk2 gnome_vfs GConf glib
     ];
 
-    # move the seven other source dirs under the main jdk8u directory,
-    # with version suffixes removed, as the remainder of the build will expect
-    prePatch = ''
-      mainDir=$(find . -maxdepth 1 -name jdk8u\*);
-      find . -maxdepth 1 -name \*jdk\* -not -name jdk8u\* | awk -F- '{print $1}' | while read p; do
-        mv $p-* $mainDir/$p
-      done
-      cd $mainDir
-    '';
-
     patches = [
       ./fix-java-home-jdk8.patch
       ./read-truststore-from-env-jdk8.patch
diff --git a/pkgs/development/coq-modules/VST/default.nix b/pkgs/development/coq-modules/VST/default.nix
index 80aaf506139..a5dee94d045 100644
--- a/pkgs/development/coq-modules/VST/default.nix
+++ b/pkgs/development/coq-modules/VST/default.nix
@@ -37,6 +37,7 @@ mkCoqDerivation {
   preConfigure = ''
     patchShebangs util
     substituteInPlace Makefile \
+      --replace 'COQVERSION= ' 'COQVERSION= 8.15.1 or-else '\
       --replace 'FLOYD_FILES=' 'FLOYD_FILES= ${toString extra_floyd_files}'
   '';
 
diff --git a/pkgs/development/coq-modules/compcert/default.nix b/pkgs/development/coq-modules/compcert/default.nix
index 197f1a96fc4..092bb58d174 100644
--- a/pkgs/development/coq-modules/compcert/default.nix
+++ b/pkgs/development/coq-modules/compcert/default.nix
@@ -119,6 +119,11 @@ compcert.overrideAttrs (o:
             url = "https://github.com/AbsInt/CompCert/commit/a882f78c069f7337dd9f4abff117d4df98ef38a6.patch";
             sha256 = "sha256:16i87s608fj9ni7cvd5wrd7gicqniad7w78wi26pxdy0pacl7bjg";
           })
+          # Support for Coq 8.15.1
+          (fetchpatch {
+            url = "https://github.com/AbsInt/CompCert/commit/10a976994d7fd30d143354c289ae735d210ccc09.patch";
+            sha256 = "sha256:0bg58gpkgxlmxzp6sg0dvybrfk0pxnm7qd6vxlrbsbm2w6wk03jv";
+          })
         ];
       }
     ] [];
diff --git a/pkgs/development/interpreters/php/8.0.nix b/pkgs/development/interpreters/php/8.0.nix
index 1f1fa1dfbc4..3332c9d5a42 100644
--- a/pkgs/development/interpreters/php/8.0.nix
+++ b/pkgs/development/interpreters/php/8.0.nix
@@ -2,8 +2,8 @@
 
 let
   base = callPackage ./generic.nix (_args // {
-    version = "8.0.16";
-    sha256 = "sha256-9J+Bge4pRjoNI6DGWWnpLVj+6KxWTfkXz/WOSNZeGEk=";
+    version = "8.0.17";
+    sha256 = "52811ee2dde71660ca32737a4ac696c24591eb22e846dd8e09ee77122660283f";
   });
 
 in
diff --git a/pkgs/development/interpreters/php/8.1.nix b/pkgs/development/interpreters/php/8.1.nix
index 8d87a5e7a22..aa98204b997 100644
--- a/pkgs/development/interpreters/php/8.1.nix
+++ b/pkgs/development/interpreters/php/8.1.nix
@@ -2,8 +2,8 @@
 
 let
   base = callPackage ./generic.nix (_args // {
-    version = "8.1.3";
-    sha256 = "sha256-NUxOLFBgRuyoEtH8JSaISi9UtePSDvDt6RmmnrIy0L4=";
+    version = "8.1.4";
+    sha256 = "b3f688cb69758523838b8e7f509aaef0152133d9b84a84a0b7cf68eeafc1df76";
   });
 
 in
diff --git a/pkgs/development/libraries/bctoolbox/default.nix b/pkgs/development/libraries/bctoolbox/default.nix
index aaa7c9e048b..869f3862241 100644
--- a/pkgs/development/libraries/bctoolbox/default.nix
+++ b/pkgs/development/libraries/bctoolbox/default.nix
@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation rec {
   pname = "bctoolbox";
-  version = "5.1.10";
+  version = "5.1.12";
 
   nativeBuildInputs = [ cmake bcunit ];
   buildInputs = [ mbedtls ];
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     group = "BC";
     repo = pname;
     rev = version;
-    sha256 = "sha256-BOJ/NUJnoTeDuURH8Lx6S4RlNZPfsQX4blJkpUdraBg=";
+    sha256 = "sha256-tmZ1XC8z4NUww58pvvqxZifOxFNXSrEBMY2biCJ55XM=";
   };
 
   # Do not build static libraries
diff --git a/pkgs/development/libraries/cglm/default.nix b/pkgs/development/libraries/cglm/default.nix
index dfc9f81edb6..50a9bf62c54 100644
--- a/pkgs/development/libraries/cglm/default.nix
+++ b/pkgs/development/libraries/cglm/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cglm";
-  version = "0.8.4";
+  version = "0.8.5";
 
   src = fetchFromGitHub {
     owner = "recp";
     repo = "cglm";
     rev = "v${version}";
-    sha256 = "sha256-AJK1M6iyYdL61pZQhbUWzf+YOUE5FEvUyKqxbQqc7H0=";
+    sha256 = "sha256-PJHDZXc0DD/d+K/4uouv5F8gAf1sE5e3jLkGILPMpnI=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/gcr/default.nix b/pkgs/development/libraries/gcr/default.nix
index 9c97faaa45c..b277a52a658 100644
--- a/pkgs/development/libraries/gcr/default.nix
+++ b/pkgs/development/libraries/gcr/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv
 , fetchurl
+, fetchpatch
 , pkg-config
 , meson
 , ninja
@@ -34,6 +35,16 @@ stdenv.mkDerivation rec {
     sha256 = "CQn8SeqK1IMtJ1ZP8v0dxmZpbioHxzlBxIgp5gVy2gE=";
   };
 
+  patches = [
+    # Pull upstream fix for meson-0.60:
+    #  https://gitlab.gnome.org/GNOME/gcr/-/merge_requests/81
+    (fetchpatch {
+      name = "meson-0.60.patch";
+      url = "https://gitlab.gnome.org/GNOME/gcr/-/commit/b3ca1d02bb0148ca787ac4aead164d7c8ce2c4d8.patch";
+      sha256 = "15gwxkcm5q5p87p5lrqwgykpzx5gmk179xd3481yak93yhbvy165";
+    })
+  ];
+
   nativeBuildInputs = [
     pkg-config
     meson
diff --git a/pkgs/development/libraries/libtoxcore/default.nix b/pkgs/development/libraries/libtoxcore/default.nix
index 10cc499d09d..5d97a263b88 100644
--- a/pkgs/development/libraries/libtoxcore/default.nix
+++ b/pkgs/development/libraries/libtoxcore/default.nix
@@ -53,7 +53,7 @@ in {
   };
 
   libtoxcore_0_2 = generic {
-    version = "0.2.13";
-    sha256 = "0a1cp00bnxl3q4l74yqp4aa6fg9slz4rg4lfzkl3khvmm6nzckds";
+    version = "0.2.17";
+    sha256 = "sha256-SOI6QKOSt/EK9JDrSaV6CrD5sx8aYb5ZL3StYq8u/Dg=";
   };
 }
diff --git a/pkgs/development/ocaml-modules/biniou/1.0.nix b/pkgs/development/ocaml-modules/biniou/1.0.nix
index 5a2e2ea9a7f..ec81e5b8db9 100644
--- a/pkgs/development/ocaml-modules/biniou/1.0.nix
+++ b/pkgs/development/ocaml-modules/biniou/1.0.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
   makeFlags = [ "PREFIX=$(out)" ];
 
   preBuild = ''
-    mkdir $out/bin
+    mkdir -p $out/bin
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/ocaml-modules/csv/1.5.nix b/pkgs/development/ocaml-modules/csv/1.5.nix
index cd298fb39a9..ef4ae4484d8 100644
--- a/pkgs/development/ocaml-modules/csv/1.5.nix
+++ b/pkgs/development/ocaml-modules/csv/1.5.nix
@@ -22,13 +22,17 @@ stdenv.mkDerivation rec {
   doCheck = true;
   checkPhase = "ocaml setup.ml -test";
 
-  installPhase = "ocaml setup.ml -install";
+  installPhase = ''
+    runHook preInstall
+    ocaml setup.ml -install
+    runHook postInstall
+  '';
 
   meta = with lib; {
     description = "A pure OCaml library to read and write CSV files";
     homepage = "https://github.com/Chris00/ocaml-csv";
     license = licenses.lgpl21;
     maintainers = [ maintainers.vbgl ];
-    platforms = ocaml.meta.platforms or [ ];
+    inherit (ocaml.meta) platforms;
   };
 }
diff --git a/pkgs/development/ocaml-modules/magick/default.nix b/pkgs/development/ocaml-modules/magick/default.nix
deleted file mode 100644
index 87c43fb6869..00000000000
--- a/pkgs/development/ocaml-modules/magick/default.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{ stdenv, lib, fetchurl, which, pkg-config, ocaml, findlib, imagemagick }:
-
-if lib.versionAtLeast ocaml.version "4.06"
-then throw "magick is not available for OCaml ${ocaml.version}"
-else
-
-stdenv.mkDerivation rec {
-  pname = "ocaml-magick";
-  version = "0.34";
-
-  src = fetchurl {
-    url = "http://www.linux-nantes.org/~fmonnier/OCaml/ImageMagick/ImageMagick/OCaml-ImageMagick-${version}.tgz";
-    sha256 = "0gn9l2qdr8gby2x8c2mb59x1kipb2plr45rbq6ymcxyi0wmzfh3q";
-  };
-
-  nativeBuildInputs = [ which pkg-config ocaml findlib ];
-  buildInputs = [ imagemagick ];
-
-  strictDeps = true;
-
-  createFindlibDestdir = true;
-
-  preConfigure = "substituteInPlace Makefile --replace gcc $CC";
-
-  installTargets = [ "find_install" ];
-
-  meta = {
-    homepage = "http://www.linux-nantes.org/~fmonnier/OCaml/ImageMagick/";
-    description = "ImageMagick Binding for OCaml";
-    license = lib.licenses.mit;
-    platforms = imagemagick.meta.platforms;
-    maintainers = with lib.maintainers; [ vbgl ];
-  };
-}
diff --git a/pkgs/development/ocaml-modules/ocaml-libvirt/default.nix b/pkgs/development/ocaml-modules/ocaml-libvirt/default.nix
index b4410981afb..f2336cf88bb 100644
--- a/pkgs/development/ocaml-modules/ocaml-libvirt/default.nix
+++ b/pkgs/development/ocaml-modules/ocaml-libvirt/default.nix
@@ -1,5 +1,8 @@
 { lib, stdenv, fetchFromGitLab, libvirt, autoreconfHook, pkg-config, ocaml, findlib, perl }:
 
+lib.throwIfNot (lib.versionAtLeast ocaml.version "4.02")
+  "libvirt is not available for OCaml ${ocaml.version}"
+
 stdenv.mkDerivation rec {
   pname = "ocaml-libvirt";
   version = "0.6.1.5";
diff --git a/pkgs/development/python-modules/ansible-runner/default.nix b/pkgs/development/python-modules/ansible-runner/default.nix
index 7cfe51e29c8..0083362c753 100644
--- a/pkgs/development/python-modules/ansible-runner/default.nix
+++ b/pkgs/development/python-modules/ansible-runner/default.nix
@@ -18,12 +18,12 @@
 
 buildPythonPackage rec {
   pname = "ansible-runner";
-  version = "2.1.2";
+  version = "2.1.3";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-GK/CqmMm67VmvzlhMV6ow+40m0DYUpXCFkP+9NgR/e4=";
+    hash = "sha256-2m5dD+gGDL5LnY7QbDYiGdu4GYu0C49WU29GZY2bnBo=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/auth0-python/default.nix b/pkgs/development/python-modules/auth0-python/default.nix
index 94a0044d3ac..c6886dc8bed 100644
--- a/pkgs/development/python-modules/auth0-python/default.nix
+++ b/pkgs/development/python-modules/auth0-python/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "auth0-python";
-  version = "3.20.0";
+  version = "3.22.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-WIH2lMPehrqkXCh+JbEI5nf99nt61OwLhP/pF6BbsnQ=";
+    sha256 = "sha256-05yJbF6eXz+vJx+plY5gqzRRYL2SjDnF7gSfX6WIS4E=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/azure-mgmt-applicationinsights/default.nix b/pkgs/development/python-modules/azure-mgmt-applicationinsights/default.nix
index d71539efc23..78605fd429c 100644
--- a/pkgs/development/python-modules/azure-mgmt-applicationinsights/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-applicationinsights/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-applicationinsights";
-  version = "2.1.0";
+  version = "3.0.0";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "68deed8ee884dd0b9631804e8b9c65fcd94e8e01c7218beae96a9fe557d7a0d7";
+    sha256 = "sha256-K46J0WqQt4vwr1CE4yjxKUT/Atds5BLs0k8EjOA4yzA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/azure-mgmt-resource/default.nix b/pkgs/development/python-modules/azure-mgmt-resource/default.nix
index 37a30147aa5..761472b631f 100644
--- a/pkgs/development/python-modules/azure-mgmt-resource/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-resource/default.nix
@@ -8,14 +8,14 @@
 
 
 buildPythonPackage rec {
-  version = "20.1.0";
+  version = "21.0.0";
   pname = "azure-mgmt-resource";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "4fbb2158320e0bdd367882642f266a6dfb3b4b8610792b3afbbca39089f212d7";
+    sha256 = "sha256-y9J/UhxwtA/YO/Y88XsStbwD5ecNwrbnpxtevYuQDQM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/bidict/default.nix b/pkgs/development/python-modules/bidict/default.nix
index 4b5ebc912b2..f59e6418fe9 100644
--- a/pkgs/development/python-modules/bidict/default.nix
+++ b/pkgs/development/python-modules/bidict/default.nix
@@ -13,13 +13,13 @@
 
 buildPythonPackage rec {
   pname = "bidict";
-  version = "0.21.4";
+  version = "0.22.0";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-QshP++b43omK9gc7S+nqfM7c1400dKqETFTknVoHn28=";
+    sha256 = "sha256-XIJrPhXpfMbmFd4pV1aEfCgqebecVDDTv8kJsayfW9g=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/blis/default.nix b/pkgs/development/python-modules/blis/default.nix
index e8e9962f9b4..be41b2acb87 100644
--- a/pkgs/development/python-modules/blis/default.nix
+++ b/pkgs/development/python-modules/blis/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "blis";
-  version = "0.7.6";
+  version = "0.7.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-/pexD2ihx7VMDlS+rahOGPTvto3UDJBvuHSPURR0PsY=";
+    sha256 = "sha256-XUqB+UONt6GayOZK1BMx9lplnqjzuxiJqcIIjP2f4QQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/coqui-trainer/default.nix b/pkgs/development/python-modules/coqui-trainer/default.nix
index de04e444e83..3c447db0a0e 100644
--- a/pkgs/development/python-modules/coqui-trainer/default.nix
+++ b/pkgs/development/python-modules/coqui-trainer/default.nix
@@ -1,15 +1,16 @@
 { lib
 , buildPythonPackage
+, fetchpatch
 , fetchFromGitHub
+, pythonAtLeast
 
 , coqpit
 , fsspec
-, pytorch
+, pytorch-bin
 
 , pytestCheckHook
 , soundfile
-, tensorboardx
-, torchvision
+, torchvision-bin
 }:
 
 let
@@ -20,6 +21,8 @@ buildPythonPackage {
   inherit pname version;
   format = "pyproject";
 
+  disabled = pythonAtLeast "3.10"; # https://github.com/coqui-ai/Trainer/issues/22
+
   src = fetchFromGitHub {
     owner = "coqui-ai";
     repo = "Trainer";
@@ -27,12 +30,18 @@ buildPythonPackage {
     hash = "sha256-NsgCh+N2qWmRkTOjXqisVCP5aInH2zcNz6lsnIfVLiY=";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/coqui-ai/Trainer/commit/07b447abf3290c8f2e5e723687b8a480b7382265.patch";
+      sha256 = "0v1hl784d9rghkblcfwgzp0gg9d6r5r0yv2kapzdz2qymiajy7y2";
+    })
+  ];
+
   propagatedBuildInputs = [
     coqpit
     fsspec
-    pytorch
+    pytorch-bin
     soundfile
-    tensorboardx
   ];
 
   # only one test and that requires training data from the internet
@@ -40,7 +49,7 @@ buildPythonPackage {
 
   checkInputs = [
     pytestCheckHook
-    torchvision
+    torchvision-bin
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/datasette/default.nix b/pkgs/development/python-modules/datasette/default.nix
index 481f4c58b3f..f2a0d531a0a 100644
--- a/pkgs/development/python-modules/datasette/default.nix
+++ b/pkgs/development/python-modules/datasette/default.nix
@@ -30,7 +30,7 @@
 
 buildPythonPackage rec {
   pname = "datasette";
-  version = "0.60.2";
+  version = "0.61.1";
 
   disabled = pythonOlder "3.6";
 
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     owner = "simonw";
     repo = pname;
     rev = version;
-    sha256 = "sha256-GehtjukmSVHffAnDeDwjopgnuycD1CLQRHzLtO1iLsE=";
+    sha256 = "sha256-HVzMyF4ujYK12UQ25il/XROPo+iBldsMxOTx+duoc5o=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/evdev/default.nix b/pkgs/development/python-modules/evdev/default.nix
index 1a3f2a0e642..86149cbd865 100644
--- a/pkgs/development/python-modules/evdev/default.nix
+++ b/pkgs/development/python-modules/evdev/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "evdev";
-  version = "1.4.0";
+  version = "1.5.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8782740eb1a86b187334c07feb5127d3faa0b236e113206dfe3ae8f77fb1aaf1";
+    sha256 = "sha256-WzOxdPfIRXbn3WBx5Di/WtIn2pXv1DVqOf5Mg1VBL+Y=";
   };
 
   buildInputs = [ linuxHeaders ];
diff --git a/pkgs/development/python-modules/fakeredis/default.nix b/pkgs/development/python-modules/fakeredis/default.nix
index 3127ac0dcdb..5860a959afc 100644
--- a/pkgs/development/python-modules/fakeredis/default.nix
+++ b/pkgs/development/python-modules/fakeredis/default.nix
@@ -3,7 +3,6 @@
 , async_generator
 , buildPythonPackage
 , fetchPypi
-, fetchpatch
 , hypothesis
 , lupa
 , pytest-asyncio
@@ -17,29 +16,16 @@
 
 buildPythonPackage rec {
   pname = "fakeredis";
-  version = "1.7.0";
-
+  version = "1.7.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-yb0S5DAzbL0+GJ+uDpHrmZl7k+dtv91u1n+jUtxoTHE=";
+    hash = "sha256-fCxLobQuCnUzfFS3d78GcQVrRWllDj/5J+S5s4WvyOw=";
   };
 
-  patches = [
-    (fetchpatch {
-      # redis 4.1.0 compatibility
-      # https://github.com/jamesls/fakeredis/pull/324
-      url = "https://github.com/jamesls/fakeredis/commit/8ef8dc6dacc9baf571d66a25ffbf0fadd7c70f78.patch";
-      sha256 = "sha256:03xlqmwq8nkzisrjk7y51j2jd6qdin8nbj5n9hc4wjabbvlgx4qr";
-      excludes = [
-        "setup.cfg"
-      ];
-    })
-  ];
-
   propagatedBuildInputs = [
     aioredis
     lupa
@@ -60,11 +46,6 @@ buildPythonPackage rec {
     "fakeredis"
   ];
 
-  postPatch = ''
-    substituteInPlace setup.cfg \
-      --replace "redis<4.1.0" "redis"
-  '';
-
   meta = with lib; {
     description = "Fake implementation of Redis API";
     homepage = "https://github.com/jamesls/fakeredis";
diff --git a/pkgs/development/python-modules/flake8-bugbear/default.nix b/pkgs/development/python-modules/flake8-bugbear/default.nix
index 20e8f588826..ef014011bdf 100644
--- a/pkgs/development/python-modules/flake8-bugbear/default.nix
+++ b/pkgs/development/python-modules/flake8-bugbear/default.nix
@@ -10,13 +10,13 @@
 
 buildPythonPackage rec {
   pname = "flake8-bugbear";
-  version = "22.3.20";
+  version = "22.3.23";
 
   src = fetchFromGitHub {
     owner = "PyCQA";
     repo = pname;
     rev = version;
-    sha256 = "sha256-tq008SNytZCttnVY1NLf9/2aeqP+iPLUNsRLZu0k3Uk=";
+    sha256 = "sha256-s1EnPM2He+R+vafu14XI1Xuft8Rg6W3vPH2Atc6N7I0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/gaphas/default.nix b/pkgs/development/python-modules/gaphas/default.nix
index 0f23415fe6e..3c8933686b2 100644
--- a/pkgs/development/python-modules/gaphas/default.nix
+++ b/pkgs/development/python-modules/gaphas/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "gaphas";
-  version = "3.5.1";
+  version = "3.6.0";
   disabled = pythonOlder "3.7";
 
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-71oYuLhqJ7bst0W7v9tQSoaisjONZSa9zEWzYWtGl2E=";
+    sha256 = "sha256-yleYbAJdDVzZrMQ3izi9UX3Ji1vIuQDc+RK5+wzrMi4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-container/default.nix b/pkgs/development/python-modules/google-cloud-container/default.nix
index b66ff08cff8..ae3c6a8be74 100644
--- a/pkgs/development/python-modules/google-cloud-container/default.nix
+++ b/pkgs/development/python-modules/google-cloud-container/default.nix
@@ -8,20 +8,33 @@
 , proto-plus
 , pytestCheckHook
 , pytest-asyncio
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-container";
-  version = "2.10.6";
+  version = "2.10.7";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-dBt2Vs9J0+l534YtKS70MuUEUegwVoU66zghmcz7fGk=";
+    hash = "sha256-I3oYldj915GBCX5VLEZRqGS7jMHWasQGVIvj50EUTK4=";
   };
 
-  propagatedBuildInputs = [ google-api-core grpc-google-iam-v1 libcst proto-plus ];
+  propagatedBuildInputs = [
+    google-api-core
+    grpc-google-iam-v1
+    libcst
+    proto-plus
+  ];
 
-  checkInputs = [ mock pytestCheckHook pytest-asyncio ];
+  checkInputs = [
+    mock
+    pytestCheckHook
+    pytest-asyncio
+  ];
 
   disabledTests = [
     # requires credentials
diff --git a/pkgs/development/python-modules/hahomematic/default.nix b/pkgs/development/python-modules/hahomematic/default.nix
index 8bde0676784..1df738f80fb 100644
--- a/pkgs/development/python-modules/hahomematic/default.nix
+++ b/pkgs/development/python-modules/hahomematic/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "hahomematic";
-  version = "0.38.4";
+  version = "0.38.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "danielperna84";
     repo = pname;
     rev = version;
-    sha256 = "sha256-WvcQTaYlKTOYbYwH/FbNTMoHdUhesYeeNYP8RDgQms4=";
+    sha256 = "sha256-RzTRRWHmdEjDQM/x4pX1gy7mIJD3K2hjQRAkz53xL50=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/jdatetime/default.nix b/pkgs/development/python-modules/jdatetime/default.nix
index f2e9b66b7b3..463d3ce5e03 100644
--- a/pkgs/development/python-modules/jdatetime/default.nix
+++ b/pkgs/development/python-modules/jdatetime/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "jdatetime";
-  version = "4.0.0";
+  version = "4.1.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-01uuou0hPk6Hu4QMYWNwAVQL0h6ORFS9EjUrBlkewI4=";
+    sha256 = "sha256-SmeoLuV+NbX2+ff75qDtpj9Wzh3Yr0CbTComozQEV9s=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/mkdocs-material/default.nix b/pkgs/development/python-modules/mkdocs-material/default.nix
index 16a81580916..228aa1913c5 100644
--- a/pkgs/development/python-modules/mkdocs-material/default.nix
+++ b/pkgs/development/python-modules/mkdocs-material/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonApplication rec {
   pname = "mkdocs-material";
-  version = "8.2.5";
+  version = "8.2.6";
 
   src = fetchFromGitHub {
     owner = "squidfunk";
     repo = pname;
     rev = version;
-    sha256 = "0v30x2cgc5i307p0hsy5h58pfd8w6xpnvimsb75614xlmx3ycaqd";
+    sha256 = "sha256-4t9LBZc73V8eAIUO+BAZPgak+AX3o2YKZJWug+b6TBY=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/motionblinds/default.nix b/pkgs/development/python-modules/motionblinds/default.nix
index 8bed74a4d52..5d67133b255 100644
--- a/pkgs/development/python-modules/motionblinds/default.nix
+++ b/pkgs/development/python-modules/motionblinds/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "motionblinds";
-  version = "0.6.1";
+  version = "0.6.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "starkillerOG";
     repo = "motion-blinds";
     rev = version;
-    sha256 = "sha256-31ofLiBQjSMDtptgYF5rqS1bB5UDUbsbo25Nrk4WvIY=";
+    sha256 = "sha256-Y5yF/dJUm0ICUY8UU8ILypSAnCVanvW4hzyz7ZOdBrc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/ndspy/default.nix b/pkgs/development/python-modules/ndspy/default.nix
index 9c4d91df9d6..7408949649f 100644
--- a/pkgs/development/python-modules/ndspy/default.nix
+++ b/pkgs/development/python-modules/ndspy/default.nix
@@ -1,22 +1,44 @@
-{ lib, buildPythonPackage, fetchPypi, crcmod }:
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, crcmod
+, pytestCheckHook
+, pythonOlder
+}:
 
 buildPythonPackage rec {
   pname = "ndspy";
-  version = "3.0.0";
+  version = "4.0.0";
+  format = "setuptools";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "1s0i81gspas22bjwk9vhy3x5sw1svyybk7c2j1ixc77drr9ym20a";
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "RoadrunnerWMC";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0x3sp10had1mq192m7kgjivvs8kpjagxjgj9d4z95dfjhzzbjh70";
   };
 
-  propagatedBuildInputs = [ crcmod ];
+  propagatedBuildInputs = [
+    crcmod
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "ndspy"
+  ];
 
-  doCheck = false; # there are no tests
-  pythonImportsCheck = [ "ndspy" ];
+  preCheck = ''
+    cd tests
+  '';
 
   meta = with lib; {
+    description = "Python library for many Nintendo DS file formats";
     homepage = "https://github.com/RoadrunnerWMC/ndspy";
-    description = "A Python library for many Nintendo DS file formats";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ xfix ];
   };
diff --git a/pkgs/development/python-modules/ocrmypdf/default.nix b/pkgs/development/python-modules/ocrmypdf/default.nix
index a268f34cc71..fe521180280 100644
--- a/pkgs/development/python-modules/ocrmypdf/default.nix
+++ b/pkgs/development/python-modules/ocrmypdf/default.nix
@@ -80,6 +80,12 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  postPatch = ''
+    # https://github.com/ocrmypdf/OCRmyPDF/issues/933
+    substituteInPlace setup.cfg \
+      --replace "pdfminer.six!=20200720,>=20191110,<=20211012" "pdfminer.six!=20200720,>=20191110,<=20220319"
+  '';
+
   pythonImportsCheck = [
     "ocrmypdf"
   ];
diff --git a/pkgs/development/python-modules/pdfminer_six/default.nix b/pkgs/development/python-modules/pdfminer_six/default.nix
index 6d2b0adcf41..449ea4f7fd7 100644
--- a/pkgs/development/python-modules/pdfminer_six/default.nix
+++ b/pkgs/development/python-modules/pdfminer_six/default.nix
@@ -21,6 +21,12 @@ buildPythonPackage rec {
     done
   '';
 
+  postPatch = ''
+    # Verion is not stored in repo, gets added by a GitHub action after tag is created
+    # https://github.com/pdfminer/pdfminer.six/pull/727
+    substituteInPlace pdfminer/__init__.py --replace "__VERSION__" ${version}
+  '';
+
   checkInputs = [ pytestCheckHook ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/pdfx/default.nix b/pkgs/development/python-modules/pdfx/default.nix
index 3b63e67fdde..25efc4418bf 100644
--- a/pkgs/development/python-modules/pdfx/default.nix
+++ b/pkgs/development/python-modules/pdfx/default.nix
@@ -13,7 +13,8 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace requirements.txt \
-      --replace "chardet==4.0.0" "chardet"
+      --replace "chardet==4.0.0" "chardet" \
+      --replace "pdfminer.six==20201018" "pdfminer.six"
   '';
 
   propagatedBuildInputs = [ pdfminer chardet ];
diff --git a/pkgs/development/python-modules/preprocess-cancellation/default.nix b/pkgs/development/python-modules/preprocess-cancellation/default.nix
new file mode 100644
index 00000000000..d671cb4d66e
--- /dev/null
+++ b/pkgs/development/python-modules/preprocess-cancellation/default.nix
@@ -0,0 +1,31 @@
+{ lib, fetchFromGitHub, buildPythonPackage, pythonOlder, poetry-core
+, pytestCheckHook, pytest-cov
+, shapely }:
+
+buildPythonPackage rec {
+  pname = "preprocess-cancellation";
+  version = "0.2.0";
+  disabled = pythonOlder "3.6"; # >= 3.6
+  format = "pyproject";
+
+  # No tests in PyPI
+  src = fetchFromGitHub {
+    owner = "kageurufu";
+    repo = "cancelobject-preprocessor";
+    rev = version;
+    hash = "sha256-mn3/etXA5dkL+IsyxwD4/XjU/t4/roYFVyqQxlLOoOI=";
+  };
+
+  nativeBuildInputs = [ poetry-core ];
+
+  propagatedBuildInputs = [ shapely ];
+
+  checkInputs = [ pytestCheckHook pytest-cov ];
+
+  meta = with lib; {
+    description = "Klipper GCode Preprocessor for Object Cancellation";
+    homepage = "https://github.com/kageurufu/cancelobject-preprocessor";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ zhaofengli ];
+  };
+}
diff --git a/pkgs/development/python-modules/pulsectl/default.nix b/pkgs/development/python-modules/pulsectl/default.nix
index 584ef5538a0..1990915eef4 100644
--- a/pkgs/development/python-modules/pulsectl/default.nix
+++ b/pkgs/development/python-modules/pulsectl/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "pulsectl";
-  version = "22.1.3";
+  version = "22.3.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-8o/kuIHdLMFE0tlPg+xg2MWaUmQqCtNjXMTQ+EBvSFg=";
+    sha256 = "sha256-zBdOHO69TmIixbePT0FfEugHU8mrdas1QVm0y1lQsIQ=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/py-synologydsm-api/default.nix b/pkgs/development/python-modules/py-synologydsm-api/default.nix
index 3d2e1b05e10..24c4b3c9f59 100644
--- a/pkgs/development/python-modules/py-synologydsm-api/default.nix
+++ b/pkgs/development/python-modules/py-synologydsm-api/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "py-synologydsm-api";
-  version = "1.0.6";
+  version = "1.0.7";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "mib1185";
     repo = "synologydsm-api";
     rev = "v${version}";
-    sha256 = "sha256-jAdD6FCbsBocJNX7o+dpthgHaPLIueFWJMzBNoKAq7w=";
+    sha256 = "sha256-VhAzR/knvun6hJj8/YREqMfNvOKpTyYNI9fk9hsbHDQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pyaussiebb/default.nix b/pkgs/development/python-modules/pyaussiebb/default.nix
index d764e93e3f0..86d2f59e942 100644
--- a/pkgs/development/python-modules/pyaussiebb/default.nix
+++ b/pkgs/development/python-modules/pyaussiebb/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pyaussiebb";
-  version = "0.0.14";
+  version = "0.0.15";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "yaleman";
     repo = "aussiebb";
     rev = "v${version}";
-    hash = "sha256-Z+xLCKnUnBAH9nm0YR11zx1lyNrIb8BZLFmaZdpnfdw=";
+    hash = "sha256-V9yN05Bkv5vkHgXZ77ps3d6JS39M5iMuiijOGRBFi0U=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pygame/default.nix b/pkgs/development/python-modules/pygame/default.nix
index 68e5a90d0cf..909ce1caa38 100644
--- a/pkgs/development/python-modules/pygame/default.nix
+++ b/pkgs/development/python-modules/pygame/default.nix
@@ -25,6 +25,7 @@ buildPythonPackage rec {
       buildinputs_include = builtins.toJSON (builtins.concatMap (dep: [
         "${lib.getDev dep}/"
         "${lib.getDev dep}/include"
+        "${lib.getDev dep}/include/SDL2"
       ]) buildInputs);
       buildinputs_lib = builtins.toJSON (builtins.concatMap (dep: [
         "${lib.getLib dep}/"
diff --git a/pkgs/development/python-modules/pypandoc/default.nix b/pkgs/development/python-modules/pypandoc/default.nix
index d2ff1aab1a4..32bada43c15 100644
--- a/pkgs/development/python-modules/pypandoc/default.nix
+++ b/pkgs/development/python-modules/pypandoc/default.nix
@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "pypandoc";
-  version = "1.7.3";
+  version = "1.7.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-Tv0vqKN9AAXdfQRMt/QuqeFB3wNTh1DsWu0XNZukTUc=";
+    sha256 = "sha256-KN4j9kbZ6ARAPGth180yptdso1arx563IXvb/2dI+G4=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/pysigma-backend-splunk/default.nix b/pkgs/development/python-modules/pysigma-backend-splunk/default.nix
index ab757085d1c..2fc5c6a6ccd 100644
--- a/pkgs/development/python-modules/pysigma-backend-splunk/default.nix
+++ b/pkgs/development/python-modules/pysigma-backend-splunk/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pysigma-backend-splunk";
-  version = "0.2.0";
+  version = "0.2.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "SigmaHQ";
     repo = "pySigma-backend-splunk";
     rev = "v${version}";
-    hash = "sha256-EP0gcK05hZ5TCOgTePezfEGbW45dGrnnksWyI9Jo9MQ=";
+    hash = "sha256-NAhAWK1eSSGQAlMGgMHrW/RTpT9LJMqwkhE9/8xWGT8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pysigma/default.nix b/pkgs/development/python-modules/pysigma/default.nix
index be35230dbd6..cd3e9ed8859 100644
--- a/pkgs/development/python-modules/pysigma/default.nix
+++ b/pkgs/development/python-modules/pysigma/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pysigma";
-  version = "0.4.2";
+  version = "0.4.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "SigmaHQ";
     repo = "pySigma";
     rev = "v${version}";
-    hash = "sha256-0k6m86RQoP4QTuxmCWBpxiGqaJt3alOLS5BAuOFwdb4=";
+    hash = "sha256-NE6XmylUc3MeDRMOJo51jtb6J0Vi9tDT6tbYBepDsvw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pytorch/bin.nix b/pkgs/development/python-modules/pytorch/bin.nix
index df3e5da4c5a..24533a08e47 100644
--- a/pkgs/development/python-modules/pytorch/bin.nix
+++ b/pkgs/development/python-modules/pytorch/bin.nix
@@ -4,6 +4,7 @@
 , isPy37
 , isPy38
 , isPy39
+, isPy310
 , python
 , addOpenGLRunpath
 , future
@@ -19,7 +20,7 @@ let
   pyVerNoDot = builtins.replaceStrings [ "." ] [ "" ] python.pythonVersion;
   srcs = import ./binary-hashes.nix version;
   unsupported = throw "Unsupported system";
-  version = "1.10.0";
+  version = "1.11.0";
 in buildPythonPackage {
   inherit version;
 
@@ -28,7 +29,7 @@ in buildPythonPackage {
 
   format = "wheel";
 
-  disabled = !(isPy37 || isPy38 || isPy39);
+  disabled = !(isPy37 || isPy38 || isPy39 || isPy310);
 
   src = fetchurl srcs."${stdenv.system}-${pyVerNoDot}" or unsupported;
 
diff --git a/pkgs/development/python-modules/pytorch/binary-hashes.nix b/pkgs/development/python-modules/pytorch/binary-hashes.nix
index 61f1e59d09e..945af484a4a 100644
--- a/pkgs/development/python-modules/pytorch/binary-hashes.nix
+++ b/pkgs/development/python-modules/pytorch/binary-hashes.nix
@@ -6,46 +6,61 @@
 # To add a new version, run "prefetch.sh 'new-version'" to paste the generated file as follows.
 
 version : builtins.getAttr version {
-  "1.10.0" = {
+  "1.11.0" = {
     x86_64-linux-37 = {
-      name = "torch-1.10.0-cp37-cp37m-linux_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cu113/torch-1.10.0%2Bcu113-cp37-cp37m-linux_x86_64.whl";
-      hash = "sha256-KpDbklee2HXSqgrWr1U1nj8EJqUjBWp7SbACw8xtKtg=";
+      name = "torch-1.11.0-cp37-cp37m-linux_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cu113/torch-1.11.0%2Bcu113-cp37-cp37m-linux_x86_64.whl";
+      hash = "sha256-9WMzRw2uo8lweLN2B+ADXMz3L8XDb9hFRuGkuNmUTys=";
     };
     x86_64-linux-38 = {
-      name = "torch-1.10.0-cp38-cp38-linux_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cu113/torch-1.10.0%2Bcu113-cp38-cp38-linux_x86_64.whl";
-      hash = "sha256-zM3cMriUG9A+3in/ChzOLytRETpe4ju4uXkxasIRQYM=";
+      name = "torch-1.11.0-cp38-cp38-linux_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cu113/torch-1.11.0%2Bcu113-cp38-cp38-linux_x86_64.whl";
+      hash = "sha256-tqeZvbbuPZFOXmK920J21KECSMGvTy0hdzjl+e4nSFs=";
     };
     x86_64-linux-39 = {
-      name = "torch-1.10.0-cp39-cp39-linux_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cu113/torch-1.10.0%2Bcu113-cp39-cp39-linux_x86_64.whl";
-      hash = "sha256-w8UJDh4b5cgDu7ZSvDoKzNH4hiXEyRfvpycNOg+wJOg=";
+      name = "torch-1.11.0-cp39-cp39-linux_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cu113/torch-1.11.0%2Bcu113-cp39-cp39-linux_x86_64.whl";
+      hash = "sha256-6RJrCl2VcEvuQKnQ7xy9gtjceGPkY4o3a+9wLf1lk3A=";
+    };
+    x86_64-linux-310 = {
+      name = "torch-1.11.0-cp310-cp310-linux_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cu113/torch-1.11.0%2Bcu113-cp310-cp310-linux_x86_64.whl";
+      hash = "sha256-powzZXpUYTHrm8ROKpjS+nBKr66GFGCwUbgoE4Usy0Q=";
     };
     x86_64-darwin-37 = {
-      name = "torch-1.10.0-cp37-none-macosx_10_9_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torch-1.10.0-cp37-none-macosx_10_9_x86_64.whl";
-      hash = "sha256-RJkFVUcIfX736KdU8JwsTxRwKXrj5UkDY9umbHVQGyE=";
+      name = "torch-1.11.0-cp37-none-macosx_10_9_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torch-1.11.0-cp37-none-macosx_10_9_x86_64.whl";
+      hash = "sha256-aGCx0b8LsLZ6a9R/haDkyCW1GO6hO11hAZmdu8vVvAw=";
     };
     x86_64-darwin-38 = {
-      name = "torch-1.10.0-cp38-none-macosx_10_9_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torch-1.10.0-cp38-none-macosx_10_9_x86_64.whl";
-      hash = "sha256-rvevti6bF0tODl4eSkLjurO4SQpmjWZvYvfUUXVZ+/I=";
+      name = "torch-1.11.0-cp38-none-macosx_10_9_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torch-1.11.0-cp38-none-macosx_10_9_x86_64.whl";
+      hash = "sha256-DMyFzQYiej7fgJ4seV/Vdiw9Too4tcn3RMbnz4QTYbs=";
     };
     x86_64-darwin-39 = {
-      name = "torch-1.10.0-cp39-none-macosx_10_9_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torch-1.10.0-cp39-none-macosx_10_9_x86_64.whl";
-      hash = "sha256-1u+HRwtE35lw6EVCVH1bp3ILuJYWYCRB31VaObEk4rw=";
+      name = "torch-1.11.0-cp39-none-macosx_10_9_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torch-1.11.0-cp39-none-macosx_10_9_x86_64.whl";
+      hash = "sha256-UP2b+FxXjIccKPHLCs6d/GAkQBx/OZsXT7DzcImfRFQ=";
+    };
+    x86_64-darwin-310 = {
+      name = "torch-1.11.0-cp310-none-macosx_10_9_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torch-1.11.0-cp39-none-macosx_10_9_x86_64.whl";
+      hash = "sha256-UP2b+FxXjIccKPHLCs6d/GAkQBx/OZsXT7DzcImfRFQ=";
     };
     aarch64-darwin-38 = {
-      name = "torch-1.10.0-cp38-none-macosx_11_0_arm64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torch-1.10.0-cp38-none-macosx_11_0_arm64.whl";
-      hash = "sha256-1hhYJ7KFeAZTzdgdd6Cf3KdqWxkNWYbVUr4qXEQs+qQ=";
+      name = "torch-1.11.0-cp38-none-macosx_11_0_arm64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torch-1.11.0-cp38-none-macosx_11_0_arm64.whl";
+      hash = "sha256-wVVOSddPGyw+cgLXcFa6LddGVDdYW6xkBitYD3FKROk=";
     };
     aarch64-darwin-39 = {
-      name = "torch-1.10.0-cp39-none-macosx_11_0_arm64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torch-1.10.0-cp39-none-macosx_11_0_arm64.whl";
-      hash = "sha256-7qZ17AHsS0oGVf0phPFmpco7kz2uatTrTlLrpwJtwXY=";
+      name = "torch-1.11.0-cp39-none-macosx_11_0_arm64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torch-1.11.0-cp39-none-macosx_11_0_arm64.whl";
+      hash = "sha256-DkivZq11Xw+cXyZkAopBT1fEnWrcN+d+Bv4ABNpO22E=";
+    };
+    aarch64-darwin-310 = {
+      name = "torch-1.11.0-cp310-none-macosx_11_0_arm64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torch-1.11.0-cp39-none-macosx_11_0_arm64.whl";
+      hash = "sha256-DkivZq11Xw+cXyZkAopBT1fEnWrcN+d+Bv4ABNpO22E=";
     };
   };
 }
diff --git a/pkgs/development/python-modules/pytorch/prefetch.sh b/pkgs/development/python-modules/pytorch/prefetch.sh
index debf26bfa20..31aae438dc5 100755
--- a/pkgs/development/python-modules/pytorch/prefetch.sh
+++ b/pkgs/development/python-modules/pytorch/prefetch.sh
@@ -5,12 +5,21 @@ set -eou pipefail
 
 version=$1
 
-bucket="https://download.pytorch.org/whl/cu113"
+linux_bucket="https://download.pytorch.org/whl/cu113"
+darwin_bucket="https://download.pytorch.org/whl/cpu"
 
 url_and_key_list=(
-  "x86_64-linux-37 $bucket/torch-${version}%2Bcu113-cp37-cp37m-linux_x86_64.whl torch-${version}-cp37-cp37m-linux_x86_64.whl"
-  "x86_64-linux-38 $bucket/torch-${version}%2Bcu113-cp38-cp38-linux_x86_64.whl torch-${version}-cp38-cp38-linux_x86_64.whl"
-  "x86_64-linux-39 $bucket/torch-${version}%2Bcu113-cp39-cp39-linux_x86_64.whl torch-${version}-cp39-cp39-linux_x86_64.whl"
+  "x86_64-linux-37 $linux_bucket/torch-${version}%2Bcu113-cp37-cp37m-linux_x86_64.whl torch-${version}-cp37-cp37m-linux_x86_64.whl"
+  "x86_64-linux-38 $linux_bucket/torch-${version}%2Bcu113-cp38-cp38-linux_x86_64.whl torch-${version}-cp38-cp38-linux_x86_64.whl"
+  "x86_64-linux-39 $linux_bucket/torch-${version}%2Bcu113-cp39-cp39-linux_x86_64.whl torch-${version}-cp39-cp39-linux_x86_64.whl"
+  "x86_64-linux-310 $linux_bucket/torch-${version}%2Bcu113-cp310-cp310-linux_x86_64.whl torch-${version}-cp310-cp310-linux_x86_64.whl"
+  "x86_64-darwin-37 $darwin_bucket/torch-${version}-cp37-none-macosx_10_9_x86_64.whl torch-${version}-cp37-none-macosx_10_9_x86_64.whl"
+  "x86_64-darwin-38 $darwin_bucket/torch-${version}-cp38-none-macosx_10_9_x86_64.whl torch-${version}-cp38-none-macosx_10_9_x86_64.whl"
+  "x86_64-darwin-39 $darwin_bucket/torch-${version}-cp39-none-macosx_10_9_x86_64.whl torch-${version}-cp39-none-macosx_10_9_x86_64.whl"
+  "x86_64-darwin-310 $darwin_bucket/torch-${version}-cp310-none-macosx_10_9_x86_64.whl torch-${version}-cp310-none-macosx_10_9_x86_64.whl"
+  "aarch64-darwin-38 $darwin_bucket/torch-${version}-cp38-none-macosx_11_0_arm64.whl torch-${version}-cp38-none-macosx_11_0_arm64.whl"
+  "aarch64-darwin-39 $darwin_bucket/torch-${version}-cp39-none-macosx_11_0_arm64.whl torch-${version}-cp39-none-macosx_11_0_arm64.whl"
+  "aarch64-darwin-310 $darwin_bucket/torch-${version}-cp310-none-macosx_11_0_arm64.whl torch-${version}-cp310-none-macosx_11_0_arm64.whl"
 )
 
 hashfile="binary-hashes-$version.nix"
diff --git a/pkgs/development/python-modules/pyudev/default.nix b/pkgs/development/python-modules/pyudev/default.nix
index aabf9cd5de5..89cd50f085f 100644
--- a/pkgs/development/python-modules/pyudev/default.nix
+++ b/pkgs/development/python-modules/pyudev/default.nix
@@ -1,5 +1,5 @@
 { lib, fetchPypi, buildPythonPackage
-, six, systemd, pytest, mock, hypothesis, docutils
+, six, udev, pytest, mock, hypothesis, docutils
 }:
 
 buildPythonPackage rec {
@@ -13,7 +13,7 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace src/pyudev/_ctypeslib/utils.py \
-      --replace "find_library(name)" "'${lib.getLib systemd}/lib/libudev.so'"
+      --replace "find_library(name)" "'${lib.getLib udev}/lib/libudev.so'"
     '';
 
   checkInputs = [ pytest mock hypothesis docutils ];
diff --git a/pkgs/development/python-modules/samsungtvws/default.nix b/pkgs/development/python-modules/samsungtvws/default.nix
index bed661ce200..cd137b1547e 100644
--- a/pkgs/development/python-modules/samsungtvws/default.nix
+++ b/pkgs/development/python-modules/samsungtvws/default.nix
@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "samsungtvws";
-  version = "2.4.0";
+  version = "2.5.0";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-LbNHaSbNCwoffox6B8kEUzxjkSJotB+P1bw3wbU7DZk=";
+    sha256 = "sha256-AFCN1b80GZ24g3oWe1qqc72yWQy4+/sorL8zwOYM7vo=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/scancode-toolkit/default.nix b/pkgs/development/python-modules/scancode-toolkit/default.nix
index afde27967db..a5fdf3d547e 100644
--- a/pkgs/development/python-modules/scancode-toolkit/default.nix
+++ b/pkgs/development/python-modules/scancode-toolkit/default.nix
@@ -131,6 +131,7 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace setup.cfg \
+      --replace "pdfminer.six >= 20200101" "pdfminer.six" \
       --replace "pluggy >= 0.12.0, < 1.0" "pluggy" \
       --replace "pygmars >= 0.7.0" "pygmars" \
       --replace "license_expression >= 21.6.14" "license_expression"
diff --git a/pkgs/development/python-modules/sense-energy/default.nix b/pkgs/development/python-modules/sense-energy/default.nix
index 57a7e367d72..d5e9b4da0eb 100644
--- a/pkgs/development/python-modules/sense-energy/default.nix
+++ b/pkgs/development/python-modules/sense-energy/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "sense-energy";
-  version = "0.10.2";
+  version = "0.10.3";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "scottbonline";
     repo = "sense";
     rev = version;
-    hash = "sha256-0D0AagmLozF5nLbdcmtE9q65vG2WxWv+hZLTnjmmfEY=";
+    hash = "sha256-oekzLnEQleJPYO6QI2EwflXsbnrQVbqXQOZOnCfEHdg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/teslajsonpy/default.nix b/pkgs/development/python-modules/teslajsonpy/default.nix
index 4809fde718d..5cdc1dafc03 100644
--- a/pkgs/development/python-modules/teslajsonpy/default.nix
+++ b/pkgs/development/python-modules/teslajsonpy/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "teslajsonpy";
-  version = "1.8.0";
+  version = "1.9.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "zabuldon";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-9EFbsJPn543fVGQ46cikEE9rE4qBr/2q6vX7u4tui7I=";
+    sha256 = "sha256-Q/ltNdr2Huvfj1RmKFopJbaR4FSM7ziWadmDKPS26vc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/torchaudio/bin.nix b/pkgs/development/python-modules/torchaudio/bin.nix
index 1f6ae80b032..ba504102329 100644
--- a/pkgs/development/python-modules/torchaudio/bin.nix
+++ b/pkgs/development/python-modules/torchaudio/bin.nix
@@ -2,6 +2,10 @@
 , stdenv
 , buildPythonPackage
 , fetchurl
+, isPy37
+, isPy38
+, isPy39
+, isPy310
 , python
 , pytorch-bin
 , pythonOlder
@@ -10,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "torchaudio";
-  version = "0.10.0";
+  version = "0.11.0";
   format = "wheel";
 
   src =
@@ -19,7 +23,7 @@ buildPythonPackage rec {
         srcs = (import ./binary-hashes.nix version)."${stdenv.system}-${pyVerNoDot}" or unsupported;
     in fetchurl srcs;
 
-  disabled = ! (pythonAtLeast "3.7" && pythonOlder "3.10");
+  disabled = !(isPy37 || isPy38 || isPy39 || isPy310);
 
   propagatedBuildInputs = [
     pytorch-bin
diff --git a/pkgs/development/python-modules/torchaudio/binary-hashes.nix b/pkgs/development/python-modules/torchaudio/binary-hashes.nix
index 764b9db426b..70ae3357221 100644
--- a/pkgs/development/python-modules/torchaudio/binary-hashes.nix
+++ b/pkgs/development/python-modules/torchaudio/binary-hashes.nix
@@ -6,21 +6,61 @@
 # To add a new version, run "prefetch.sh 'new-version'" to paste the generated file as follows.
 
 version : builtins.getAttr version {
-  "0.10.0" = {
+  "0.11.0" = {
     x86_64-linux-37 = {
-      name = "torchaudio-0.10.0-cp37-cp37m-linux_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cu113/torchaudio-0.10.0%2Bcu113-cp37-cp37m-linux_x86_64.whl";
-      hash = "sha256-FspXTTODdkO0nPUJcJm8+vLIvckUa8gRfBPBT9LcKPw=";
+      name = "torchaudio-0.11.0-cp37-cp37m-linux_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cu113/torchaudio-0.11.0%2Bcu113-cp37-cp37m-linux_x86_64.whl";
+      hash = "sha256-AdqgntXh2rTD7rBePshFAQ2tVl7b+734wG4r471/Y2U=";
     };
     x86_64-linux-38 = {
-      name = "torchaudio-0.10.0-cp38-cp38-linux_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cu113/torchaudio-0.10.0%2Bcu113-cp38-cp38-linux_x86_64.whl";
-      hash = "sha256-Mf7QdXBSIIWRfT7ACthEwFA1V2ieid8legbMnRQnzqI=";
+      name = "torchaudio-0.11.0-cp38-cp38-linux_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cu113/torchaudio-0.11.0%2Bcu113-cp38-cp38-linux_x86_64.whl";
+      hash = "sha256-zuCHDpz3bkOUjYWprqX9VXoUbXfR8Vhdf1VFfOUg8z4=";
     };
     x86_64-linux-39 = {
-      name = "torchaudio-0.10.0-cp39-cp39-linux_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cu113/torchaudio-0.10.0%2Bcu113-cp39-cp39-linux_x86_64.whl";
-      hash = "sha256-LMSGNdmku1iHRy1jCRTTOYcQlRL+Oc9jjZC1nx++skA=";
+      name = "torchaudio-0.11.0-cp39-cp39-linux_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cu113/torchaudio-0.11.0%2Bcu113-cp39-cp39-linux_x86_64.whl";
+      hash = "sha256-btI9TpsOjeLnIz6J56avNv4poJTpXjjhDbMy6+ZFQvI=";
+    };
+    x86_64-linux-310 = {
+      name = "torchaudio-0.11.0-cp310-cp310-linux_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cu113/torchaudio-0.11.0%2Bcu113-cp310-cp310-linux_x86_64.whl";
+      hash = "sha256-Zk+AWytEXfJ+HM69BAPhVsvN6pgQwC6uaW7Xux2row4=";
+    };
+    x86_64-darwin-37 = {
+      name = "torchaudio-0.11.0-cp37-cp37m-macosx_10_15_x86_64.whl";
+      url = "https://download.pytorch.org/whl/torchaudio-0.11.0-cp37-cp37m-macosx_10_15_x86_64.whl";
+      hash = "sha256-uaTT4athEWHAZe0hBoBIM/9LhfZNhAIexZBGg2MWn50=";
+    };
+    x86_64-darwin-38 = {
+      name = "torchaudio-0.11.0-cp38-cp38-macosx_10_15_x86_64.whl";
+      url = "https://download.pytorch.org/whl/torchaudio-0.11.0-cp38-cp38-macosx_10_15_x86_64.whl";
+      hash = "sha256-9OndqejTzgu9XnkZJiGfUFS4uFNlx5vi7pAzOs+a2/w=";
+    };
+    x86_64-darwin-39 = {
+      name = "torchaudio-0.11.0-cp39-cp39-macosx_10_15_x86_64.whl";
+      url = "https://download.pytorch.org/whl/torchaudio-0.11.0-cp39-cp39-macosx_10_15_x86_64.whl";
+      hash = "sha256-cNi8B/J3YI0jqaoI2z+68DVmAlS8EtmzYWQMRVZ3dVk=";
+    };
+    x86_64-darwin-310 = {
+      name = "torchaudio-0.11.0-cp310-cp310-macosx_10_15_x86_64.whl";
+      url = "https://download.pytorch.org/whl/torchaudio-0.11.0-cp310-cp310-macosx_10_15_x86_64.whl";
+      hash = "sha256-g2Pj2wqK9YIP19O/g5agryPcgiHJqdS2Di44mAVJKUQ=";
+    };
+    aarch64-darwin-38 = {
+      name = "torchaudio-0.11.0-cp38-cp38-macosx_11_0_arm64.whl";
+      url = "https://download.pytorch.org/whl/torchaudio-0.11.0-cp38-cp38-macosx_11_0_arm64.whl";
+      hash = "sha256-MX/Y7Dn92zrx2tkGWTuezcPt9o5/V4DEL43pVlha5IA=";
+    };
+    aarch64-darwin-39 = {
+      name = "torchaudio-0.11.0-cp39-cp39-macosx_11_0_arm64.whl";
+      url = "https://download.pytorch.org/whl/torchaudio-0.11.0-cp39-cp39-macosx_11_0_arm64.whl";
+      hash = "sha256-5eVRP83VeHAGGWW++/B2V4eyX0mcPgC1j02ETkQYMXc=";
+    };
+    aarch64-darwin-310 = {
+      name = "torchaudio-0.11.0-cp310-cp310-macosx_11_0_arm64.whl";
+      url = "https://download.pytorch.org/whl/torchaudio-0.11.0-cp310-cp310-macosx_11_0_arm64.whl";
+      hash = "sha256-06OyzOuV8E7ZNtozvFO9Zm2rBxWnnbM65HGYUiQdwtI=";
     };
   };
 }
diff --git a/pkgs/development/python-modules/torchaudio/prefetch.sh b/pkgs/development/python-modules/torchaudio/prefetch.sh
index 4e62ab4ed35..294c917e0d1 100755
--- a/pkgs/development/python-modules/torchaudio/prefetch.sh
+++ b/pkgs/development/python-modules/torchaudio/prefetch.sh
@@ -5,12 +5,21 @@ set -eou pipefail
 
 version=$1
 
-bucket="https://download.pytorch.org/whl/cu113"
+linux_bucket="https://download.pytorch.org/whl/cu113"
+darwin_bucket="https://download.pytorch.org/whl"
 
 url_and_key_list=(
-  "x86_64-linux-37 $bucket/torchaudio-${version}%2Bcu113-cp37-cp37m-linux_x86_64.whl torchaudio-${version}-cp37-cp37m-linux_x86_64.whl"
-  "x86_64-linux-38 $bucket/torchaudio-${version}%2Bcu113-cp38-cp38-linux_x86_64.whl torchaudio-${version}-cp38-cp38-linux_x86_64.whl"
-  "x86_64-linux-39 $bucket/torchaudio-${version}%2Bcu113-cp39-cp39-linux_x86_64.whl torchaudio-${version}-cp39-cp39-linux_x86_64.whl"
+  "x86_64-linux-37 $linux_bucket/torchaudio-${version}%2Bcu113-cp37-cp37m-linux_x86_64.whl torchaudio-${version}-cp37-cp37m-linux_x86_64.whl"
+  "x86_64-linux-38 $linux_bucket/torchaudio-${version}%2Bcu113-cp38-cp38-linux_x86_64.whl torchaudio-${version}-cp38-cp38-linux_x86_64.whl"
+  "x86_64-linux-39 $linux_bucket/torchaudio-${version}%2Bcu113-cp39-cp39-linux_x86_64.whl torchaudio-${version}-cp39-cp39-linux_x86_64.whl"
+  "x86_64-linux-310 $linux_bucket/torchaudio-${version}%2Bcu113-cp310-cp310-linux_x86_64.whl torchaudio-${version}-cp310-cp310-linux_x86_64.whl"
+  "x86_64-darwin-37 $darwin_bucket/torchaudio-${version}-cp37-cp37m-macosx_10_15_x86_64.whl torchaudio-${version}-cp37-cp37m-macosx_10_15_x86_64.whl"
+  "x86_64-darwin-38 $darwin_bucket/torchaudio-${version}-cp38-cp38-macosx_10_15_x86_64.whl torchaudio-${version}-cp38-cp38-macosx_10_15_x86_64.whl"
+  "x86_64-darwin-39 $darwin_bucket/torchaudio-${version}-cp39-cp39-macosx_10_15_x86_64.whl torchaudio-${version}-cp39-cp39-macosx_10_15_x86_64.whl"
+  "x86_64-darwin-310 $darwin_bucket/torchaudio-${version}-cp310-cp310-macosx_10_15_x86_64.whl torchaudio-${version}-cp310-cp310-macosx_10_15_x86_64.whl"
+  "aarch64-darwin-38 $darwin_bucket/torchaudio-${version}-cp38-cp38-macosx_11_0_arm64.whl torchaudio-${version}-cp38-cp38-macosx_11_0_arm64.whl"
+  "aarch64-darwin-39 $darwin_bucket/torchaudio-${version}-cp39-cp39-macosx_11_0_arm64.whl torchaudio-${version}-cp39-cp39-macosx_11_0_arm64.whl"
+  "aarch64-darwin-310 $darwin_bucket/torchaudio-${version}-cp310-cp310-macosx_11_0_arm64.whl torchaudio-${version}-cp310-cp310-macosx_11_0_arm64.whl"
 )
 
 hashfile=binary-hashes-"$version".nix
diff --git a/pkgs/development/python-modules/torchvision/bin.nix b/pkgs/development/python-modules/torchvision/bin.nix
index f7041dbb519..8b1d0e2ec8d 100644
--- a/pkgs/development/python-modules/torchvision/bin.nix
+++ b/pkgs/development/python-modules/torchvision/bin.nix
@@ -5,6 +5,7 @@
 , isPy37
 , isPy38
 , isPy39
+, isPy310
 , patchelf
 , pillow
 , python
@@ -15,7 +16,7 @@ let
   pyVerNoDot = builtins.replaceStrings [ "." ] [ "" ] python.pythonVersion;
   srcs = import ./binary-hashes.nix version;
   unsupported = throw "Unsupported system";
-  version = "0.11.1";
+  version = "0.12.0";
 in buildPythonPackage {
   inherit version;
 
@@ -25,7 +26,7 @@ in buildPythonPackage {
 
   src = fetchurl srcs."${stdenv.system}-${pyVerNoDot}" or unsupported;
 
-  disabled = !(isPy37 || isPy38 || isPy39);
+  disabled = !(isPy37 || isPy38 || isPy39 || isPy310);
 
   nativeBuildInputs = [
     patchelf
diff --git a/pkgs/development/python-modules/torchvision/binary-hashes.nix b/pkgs/development/python-modules/torchvision/binary-hashes.nix
index b608bab2440..271968391ef 100644
--- a/pkgs/development/python-modules/torchvision/binary-hashes.nix
+++ b/pkgs/development/python-modules/torchvision/binary-hashes.nix
@@ -6,21 +6,61 @@
 # To add a new version, run "prefetch.sh 'new-version'" to paste the generated file as follows.
 
 version : builtins.getAttr version {
-  "0.11.1" = {
+  "0.12.0" = {
     x86_64-linux-37 = {
-      name = "torchvision-0.11.1-cp37-cp37m-linux_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cu113/torchvision-0.11.1%2Bcu113-cp37-cp37m-linux_x86_64.whl";
-      hash = "sha256-2xKWqWNKqmOMyVJnPfbtF+B9PQ7z4S66J1T3P8EvM0I=";
+      name = "torchvision-0.12.0-cp37-cp37m-linux_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cu113/torchvision-0.12.0%2Bcu113-cp37-cp37m-linux_x86_64.whl";
+      hash = "sha256-i/qktZT+5HQYQjtTHtxOV751DcsP9AHMsSV9/svsGzA=";
     };
     x86_64-linux-38 = {
-      name = "torchvision-0.11.1-cp38-cp38-linux_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cu113/torchvision-0.11.1%2Bcu113-cp38-cp38-linux_x86_64.whl";
-      hash = "sha256-bFxvJaNEomytXXANHng+oU8YSLGkuO/TSzkoDskkaIE=";
+      name = "torchvision-0.12.0-cp38-cp38-linux_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cu113/torchvision-0.12.0%2Bcu113-cp38-cp38-linux_x86_64.whl";
+      hash = "sha256-NxM+jFsOwvAZmeWRFvbQ422a+xx/j1i9DD3ImW+DVBk=";
     };
     x86_64-linux-39 = {
-      name = "torchvision-0.11.1-cp39-cp39-linux_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cu113/torchvision-0.11.1%2Bcu113-cp39-cp39-linux_x86_64.whl";
-      hash = "sha256-ysN3LmSKR+FVKYGnCGQJqa8lVApVT5rPMO+NHmmazAc=";
+      name = "torchvision-0.12.0-cp39-cp39-linux_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cu113/torchvision-0.12.0%2Bcu113-cp39-cp39-linux_x86_64.whl";
+      hash = "sha256-bGO5q+KEnv7SexmbbUWaIbsBcIxyDbL8pevZQbLwDbg=";
+    };
+    x86_64-linux-310 = {
+      name = "torchvision-0.12.0-cp310-cp310-linux_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cu113/torchvision-0.12.0%2Bcu113-cp310-cp310-linux_x86_64.whl";
+      hash = "sha256-ocsGOHa967HcZGV+1omD/xMHufmoi166Yg2Hr+SEhfE=";
+    };
+    x86_64-darwin-37 = {
+      name = "torchvision-0.12.0-cp37-cp37m-macosx_10_9_x86_64.whl";
+      url = "https://download.pytorch.org/whl/torchvision-0.12.0-cp37-cp37m-macosx_10_9_x86_64.whl";
+      hash = "sha256-GJM7xZf0VjmTJJcZqWqV28fTN0yQ+7MNPafVGPOv60I=";
+    };
+    x86_64-darwin-38 = {
+      name = "torchvision-0.12.0-cp38-cp38-macosx_10_9_x86_64.whl";
+      url = "https://download.pytorch.org/whl/torchvision-0.12.0-cp38-cp38-macosx_10_9_x86_64.whl";
+      hash = "sha256-DWAuCb1Fc2/y55aOjduw7s6Vb/ltcVSLGxtIeP33S9g=";
+    };
+    x86_64-darwin-39 = {
+      name = "torchvision-0.12.0-cp39-cp39-macosx_10_9_x86_64.whl";
+      url = "https://download.pytorch.org/whl/torchvision-0.12.0-cp39-cp39-macosx_10_9_x86_64.whl";
+      hash = "sha256-RMye+ZLS4qtjsIg/fezrwiRNupO3JUe6EfV6yEUvbq0=";
+    };
+    x86_64-darwin-310 = {
+      name = "torchvision-0.12.0-cp310-cp310-macosx_10_9_x86_64.whl";
+      url = "https://download.pytorch.org/whl/torchvision-0.12.0-cp310-cp310-macosx_10_9_x86_64.whl";
+      hash = "sha256-aTZW5nkLarIeSm6H6BwpgrrZ5FW16yThS7ZyOC7GEw8=";
+    };
+    aarch64-darwin-38 = {
+      name = "torchvision-0.12.0-cp38-cp38-macosx_11_0_arm64.whl";
+      url = "https://download.pytorch.org/whl/torchvision-0.12.0-cp38-cp38-macosx_11_0_arm64.whl";
+      hash = "sha256-n0JCD38LKc09YXdt8xV4JyV6DPFrLAJ3bcFslquxJW0=";
+    };
+    aarch64-darwin-39 = {
+      name = "torchvision-0.12.0-cp39-cp39-macosx_11_0_arm64.whl";
+      url = "https://download.pytorch.org/whl/torchvision-0.12.0-cp39-cp39-macosx_11_0_arm64.whl";
+      hash = "sha256-adgvR7Z7rW3cu4eDO6WVCmwnG6l7quTAlVYQBxvwNPU=";
+    };
+    aarch64-darwin-310 = {
+      name = "torchvision-0.12.0-cp310-cp310-macosx_11_0_arm64.whl";
+      url = "https://download.pytorch.org/whl/torchvision-0.12.0-cp310-cp310-macosx_11_0_arm64.whl";
+      hash = "sha256-oL5FAcoLobGVZEySQ/SaHEmiblKn83kkxCOdC/XsvY0=";
     };
   };
 }
diff --git a/pkgs/development/python-modules/torchvision/prefetch.sh b/pkgs/development/python-modules/torchvision/prefetch.sh
index 686d1b3e620..5f38bce8d8b 100755
--- a/pkgs/development/python-modules/torchvision/prefetch.sh
+++ b/pkgs/development/python-modules/torchvision/prefetch.sh
@@ -5,12 +5,21 @@ set -eou pipefail
 
 version=$1
 
-bucket="https://download.pytorch.org/whl/cu113"
+linux_bucket="https://download.pytorch.org/whl/cu113"
+darwin_bucket="https://download.pytorch.org/whl"
 
 url_and_key_list=(
-  "x86_64-linux-37 $bucket/torchvision-${version}%2Bcu113-cp37-cp37m-linux_x86_64.whl torchvision-${version}-cp37-cp37m-linux_x86_64.whl"
-  "x86_64-linux-38 $bucket/torchvision-${version}%2Bcu113-cp38-cp38-linux_x86_64.whl torchvision-${version}-cp38-cp38-linux_x86_64.whl"
-  "x86_64-linux-39 $bucket/torchvision-${version}%2Bcu113-cp39-cp39-linux_x86_64.whl torchvision-${version}-cp39-cp39-linux_x86_64.whl"
+  "x86_64-linux-37 $linux_bucket/torchvision-${version}%2Bcu113-cp37-cp37m-linux_x86_64.whl torchvision-${version}-cp37-cp37m-linux_x86_64.whl"
+  "x86_64-linux-38 $linux_bucket/torchvision-${version}%2Bcu113-cp38-cp38-linux_x86_64.whl torchvision-${version}-cp38-cp38-linux_x86_64.whl"
+  "x86_64-linux-39 $linux_bucket/torchvision-${version}%2Bcu113-cp39-cp39-linux_x86_64.whl torchvision-${version}-cp39-cp39-linux_x86_64.whl"
+  "x86_64-linux-310 $linux_bucket/torchvision-${version}%2Bcu113-cp310-cp310-linux_x86_64.whl torchvision-${version}-cp310-cp310-linux_x86_64.whl"
+  "x86_64-darwin-37 $darwin_bucket/torchvision-${version}-cp37-cp37m-macosx_10_9_x86_64.whl torchvision-${version}-cp37-cp37m-macosx_10_9_x86_64.whl"
+  "x86_64-darwin-38 $darwin_bucket/torchvision-${version}-cp38-cp38-macosx_10_9_x86_64.whl torchvision-${version}-cp38-cp38-macosx_10_9_x86_64.whl"
+  "x86_64-darwin-39 $darwin_bucket/torchvision-${version}-cp39-cp39-macosx_10_9_x86_64.whl torchvision-${version}-cp39-cp39-macosx_10_9_x86_64.whl"
+  "x86_64-darwin-310 $darwin_bucket/torchvision-${version}-cp310-cp310-macosx_10_9_x86_64.whl torchvision-${version}-cp310-cp310-macosx_10_9_x86_64.whl"
+  "aarch64-darwin-38 $darwin_bucket/torchvision-${version}-cp38-cp38-macosx_11_0_arm64.whl torchvision-${version}-cp38-cp38-macosx_11_0_arm64.whl"
+  "aarch64-darwin-39 $darwin_bucket/torchvision-${version}-cp39-cp39-macosx_11_0_arm64.whl torchvision-${version}-cp39-cp39-macosx_11_0_arm64.whl"
+  "aarch64-darwin-310 $darwin_bucket/torchvision-${version}-cp310-cp310-macosx_11_0_arm64.whl torchvision-${version}-cp310-cp310-macosx_11_0_arm64.whl"
 )
 
 hashfile="binary-hashes-$version.nix"
diff --git a/pkgs/development/python-modules/yamale/default.nix b/pkgs/development/python-modules/yamale/default.nix
index 7444d8d24ac..5cd60f02b58 100644
--- a/pkgs/development/python-modules/yamale/default.nix
+++ b/pkgs/development/python-modules/yamale/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "yamale";
-  version = "4.0.3";
+  version = "4.0.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "23andMe";
     repo = pname;
     rev = version;
-    sha256 = "sha256-EkCKUSPRrj3g2AY17tquBDxf+nWfpdnILu5AS/2SsLo=";
+    sha256 = "sha256-1GFvgfy3MDsJGKSEm0yaQoLM7VqIS2wphw16trNTUOc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index a025abf1e34..c04911f4ecc 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -32,13 +32,13 @@ with py.pkgs;
 
 buildPythonApplication rec {
   pname = "checkov";
-  version = "2.0.975";
+  version = "2.0.983";
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = pname;
     rev = version;
-    hash = "sha256-vzq6HKugjM9LBaklv0IlMauSAl3bqHOikDCzrhVBVPA=";
+    hash = "sha256-X/p9dZAs5+HCriMguVnVDlNQjiTBUiMt4HxOgeEeWD4=";
   };
 
   nativeBuildInputs = with py.pkgs; [
diff --git a/pkgs/development/tools/analysis/tfsec/default.nix b/pkgs/development/tools/analysis/tfsec/default.nix
index 6c2427d3724..284ef21094e 100644
--- a/pkgs/development/tools/analysis/tfsec/default.nix
+++ b/pkgs/development/tools/analysis/tfsec/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "tfsec";
-  version = "1.13.0";
+  version = "1.13.2";
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-/N8p/tw97sDW4I1ysfJ2QXACGsSc5nRFSu6jHwQvPU4=";
+    sha256 = "sha256-ixiuAm1MCLS7daUwiFUPoO86YOoz9qEkQT5i/YlIdf0=";
   };
 
   ldflags = [
@@ -21,7 +21,7 @@ buildGoModule rec {
     # "-extldflags '-fno-PIC -static'"
   ];
 
-  vendorSha256 = "sha256-nTma96kT84mpJHRA9+/sZQVvwtz9arv/OHY9lgWJDFc=";
+  vendorSha256 = "sha256-WlZJvBIdJCMA+GJ0svEzwqrdPz2wnlJx/csVarjyExw=";
 
   subPackages = [
     "cmd/tfsec"
diff --git a/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix b/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
index 6caccc45e97..f2989545f5c 100644
--- a/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
@@ -1,7 +1,7 @@
 { lib, buildGoModule, fetchFromGitLab, fetchurl }:
 
 let
-  version = "14.9.0";
+  version = "14.9.1";
 in
 buildGoModule rec {
   inherit version;
@@ -20,7 +20,7 @@ buildGoModule rec {
     owner = "gitlab-org";
     repo = "gitlab-runner";
     rev = "v${version}";
-    sha256 = "0qqwg2k50cq7bc7k1389knrjq6xdbmlxd5kavyj7pg4sfapa3i8l";
+    sha256 = "1h6fyhbc154fr6a8brva3clirgvga6sal6ikylf9mbkxbh7d9rcn";
   };
 
   patches = [
diff --git a/pkgs/development/tools/efm-langserver/default.nix b/pkgs/development/tools/efm-langserver/default.nix
index 29304d7d265..a030a271b48 100644
--- a/pkgs/development/tools/efm-langserver/default.nix
+++ b/pkgs/development/tools/efm-langserver/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "efm-langserver";
-  version = "0.0.41";
+  version = "0.0.42";
 
   src = fetchFromGitHub {
     owner = "mattn";
     repo = "efm-langserver";
     rev = "v${version}";
-    sha256 = "sha256-0s6GmMbjtXGUcChzc8Pkqvmt3iU5uDUqe76OUDngboU=";
+    sha256 = "sha256-1IAPtqIozp9Wp3L95mmhFuWvWvCDuTh1VsCVaJSzyfk=";
   };
 
-  vendorSha256 = "sha256-tca+1SRrFyvU8ttHmfMFiGXd1A8rQSEWm1Mc2qp0EfI=";
+  vendorSha256 = "sha256-KABezphT5/o3XWSFNe2OvfawFR8uwsGMnjsI9xh378Q=";
   subPackages = [ "." ];
 
   meta = with lib; {
diff --git a/pkgs/development/tools/glade/default.nix b/pkgs/development/tools/glade/default.nix
index 3e5c7b0438f..adec880eabe 100644
--- a/pkgs/development/tools/glade/default.nix
+++ b/pkgs/development/tools/glade/default.nix
@@ -1,6 +1,8 @@
-{ lib, stdenv
+{ stdenv
+, lib
 , gettext
 , fetchurl
+, fetchpatch
 , python3
 , meson
 , ninja
@@ -30,6 +32,22 @@ stdenv.mkDerivation rec {
     sha256 = "1dxsiz9ahqkxg2a1dw9sbd8jg59y5pdz4c1gvnbmql48gmj8gz4q";
   };
 
+  patches = [
+    # Fix build with meson 0.61
+    # data/meson.build:4:5: ERROR: Function does not take positional arguments.
+    # Taken from https://gitlab.gnome.org/GNOME/glade/-/merge_requests/117
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/glade/-/commit/61304b2e8bac8ded76643cb7c3e781f73881dd2b.patch";
+      sha256 = "9x6RK8Wgnm8bDxeBLV3PlUkUuH2706Ba9kwE5S87DgE=";
+    })
+    # help/meson.build:6:6: ERROR: Tried to create target "help-glade-da-update-po", but a target of that name already exists.
+    # Taken from https://gitlab.gnome.org/GNOME/glade/-/merge_requests/117
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/glade/-/commit/04ba6f969f716fbfe3c7feb7e4bab8678cc1e9eb.patch";
+      sha256 = "j3XfF7P6rndL+0PWqnp+QYph7Ba6bgcp4Pkikr2wuJA=";
+    })
+  ];
+
   nativeBuildInputs = [
     meson
     ninja
diff --git a/pkgs/development/tools/ocaml/cppo/default.nix b/pkgs/development/tools/ocaml/cppo/default.nix
index 55e9692a0a3..3134c310c45 100644
--- a/pkgs/development/tools/ocaml/cppo/default.nix
+++ b/pkgs/development/tools/ocaml/cppo/default.nix
@@ -61,7 +61,7 @@ stdenv.mkDerivation {
   makeFlags = [ "PREFIX=$(out)" ];
 
   preBuild = ''
-    mkdir $out/bin
+    mkdir -p $out/bin
   '';
 
 }
diff --git a/pkgs/development/tools/wrangler/default.nix b/pkgs/development/tools/wrangler/default.nix
index 5752fe1477c..dca054db3fe 100644
--- a/pkgs/development/tools/wrangler/default.nix
+++ b/pkgs/development/tools/wrangler/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wrangler";
-  version = "1.19.9";
+  version = "1.19.10";
 
   src = fetchFromGitHub {
     owner = "cloudflare";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-cuntghTMGrAcrPunyi9ZWlxDcryYv7R6S3V8WJjEUtQ=";
+    sha256 = "sha256-RKOAs7MRHcGx6BNBml7WQ81bNvdB9ipd0R1ErLTwjTQ=";
   };
 
-  cargoSha256 = "sha256-gao8vCfzb81GUte6WAt2x/pxecg443bpQxvUSQCXL40=";
+  cargoSha256 = "sha256-9GvKDLuDIW5q1R5g20rtSScv2c0sLSo+hI9LSA4W3M8=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/development/tools/yarn2nix-moretea/yarn2nix/default.nix b/pkgs/development/tools/yarn2nix-moretea/yarn2nix/default.nix
index 81d4a36a869..3b30e2a8af0 100644
--- a/pkgs/development/tools/yarn2nix-moretea/yarn2nix/default.nix
+++ b/pkgs/development/tools/yarn2nix-moretea/yarn2nix/default.nix
@@ -74,6 +74,7 @@ in rec {
     preBuild ? "",
     postBuild ? "",
     workspaceDependencies ? [], # List of yarn packages
+    packageResolutions ? {},
   }:
     let
       extraNativeBuildInputs =
@@ -98,7 +99,7 @@ in rec {
 
       workspaceJSON = pkgs.writeText
         "${name}-workspace-package.json"
-        (builtins.toJSON { private = true; workspaces = ["deps/**"]; }); # scoped packages need second splat
+        (builtins.toJSON { private = true; workspaces = ["deps/**"]; resolutions = packageResolutions; }); # scoped packages need second splat
 
       workspaceDependencyLinks = lib.concatMapStringsSep "\n"
         (dep: ''
@@ -176,6 +177,8 @@ in rec {
 
     packageGlobs = if lib.isList package.workspaces then package.workspaces else package.workspaces.packages;
 
+    packageResolutions = package.resolutions or {};
+
     globElemToRegex = lib.replaceStrings ["*"] [".*"];
 
     # PathGlob -> [PathGlobElem]
@@ -223,7 +226,7 @@ in rec {
         inherit name;
         value = mkYarnPackage (
           builtins.removeAttrs attrs ["packageOverrides"]
-          // { inherit src packageJSON yarnLock workspaceDependencies; }
+          // { inherit src packageJSON yarnLock packageResolutions workspaceDependencies; }
           // lib.attrByPath [name] {} packageOverrides
         );
       })
@@ -245,6 +248,7 @@ in rec {
     extraBuildInputs ? [],
     publishBinsFor ? null,
     workspaceDependencies ? [], # List of yarnPackages
+    packageResolutions ? {},
     ...
   }@attrs:
     let
@@ -264,7 +268,7 @@ in rec {
         preBuild = yarnPreBuild;
         postBuild = yarnPostBuild;
         workspaceDependencies = workspaceDependenciesTransitive;
-        inherit packageJSON pname version yarnLock offlineCache yarnFlags pkgConfig;
+        inherit packageJSON pname version yarnLock offlineCache yarnFlags pkgConfig packageResolutions;
       };
 
       publishBinsFor_ = unlessNull publishBinsFor [pname];
@@ -298,7 +302,7 @@ in rec {
         '')
         workspaceDependenciesTransitive;
 
-    in stdenv.mkDerivation (builtins.removeAttrs attrs ["yarnNix" "pkgConfig" "workspaceDependencies"] // {
+    in stdenv.mkDerivation (builtins.removeAttrs attrs ["yarnNix" "pkgConfig" "workspaceDependencies" "packageResolutions"] // {
       inherit src pname;
 
       name = baseName;
diff --git a/pkgs/development/web/grails/default.nix b/pkgs/development/web/grails/default.nix
index 0efa2b41a98..5caacbd0d50 100644
--- a/pkgs/development/web/grails/default.nix
+++ b/pkgs/development/web/grails/default.nix
@@ -11,11 +11,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "grails";
-  version = "5.1.3";
+  version = "5.1.4";
 
   src = fetchurl {
     url = "https://github.com/grails/grails-core/releases/download/v${version}/grails-${version}.zip";
-    sha256 = "sha256-BacAVAnS3qdmzHGVUdZI2hn4Arp9Qep6cAXRabpB10M=";
+    sha256 = "sha256-EoMSnT1MmYGeF82XC7Ed9woe8t+xzYJaylLBVpdFvoI=";
   };
 
   nativeBuildInputs = [ unzip ];
diff --git a/pkgs/misc/cups/drivers/mfcl2750dw/default.nix b/pkgs/misc/cups/drivers/mfcl2750dw/default.nix
new file mode 100644
index 00000000000..f51a5e74666
--- /dev/null
+++ b/pkgs/misc/cups/drivers/mfcl2750dw/default.nix
@@ -0,0 +1,93 @@
+{ lib
+, stdenv
+, fetchurl
+, dpkg
+, autoPatchelfHook
+, makeWrapper
+, perl
+, gnused
+, ghostscript
+, file
+, coreutils
+, gnugrep
+, which
+}:
+
+let
+  arches = [ "x86_64" "i686" "armv7l" ];
+
+  runtimeDeps = [
+    ghostscript
+    file
+    gnused
+    gnugrep
+    coreutils
+    which
+  ];
+in
+
+stdenv.mkDerivation rec {
+  pname = "cups-brother-mfcl2750dw";
+  version = "4.0.0-1";
+
+  nativeBuildInputs = [ dpkg makeWrapper autoPatchelfHook ];
+  buildInputs = [ perl ];
+
+  dontUnpack = true;
+
+  src = fetchurl {
+    url = "https://download.brother.com/welcome/dlf103530/mfcl2750dwpdrv-${version}.i386.deb";
+    hash = "sha256-3uDwzLQTF8r1tsGZ7ChGhk4ryQmVsZYdUaj9eFaC0jc=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out
+    dpkg-deb -x $src $out
+
+    # delete unnecessary files for the current architecture
+  '' + lib.concatMapStrings (arch: ''
+    echo Deleting files for ${arch}
+    rm -r "$out/opt/brother/Printers/MFCL2750DW/lpd/${arch}"
+  '') (builtins.filter (arch: arch != stdenv.hostPlatform.linuxArch) arches) + ''
+
+      # bundled scripts don't understand the arch subdirectories for some reason
+      ln -s \
+        "$out/opt/brother/Printers/MFCL2750DW/lpd/${stdenv.hostPlatform.linuxArch}/"* \
+        "$out/opt/brother/Printers/MFCL2750DW/lpd/"
+
+      # Fix global references and replace auto discovery mechanism with hardcoded values
+      substituteInPlace $out/opt/brother/Printers/MFCL2750DW/lpd/lpdfilter \
+        --replace /opt "$out/opt" \
+        --replace "my \$BR_PRT_PATH =" "my \$BR_PRT_PATH = \"$out/opt/brother/Printers/MFCL2750DW\"; #" \
+        --replace "PRINTER =~" "PRINTER = \"MFCL2750DW\"; #"
+
+      # Make sure all executables have the necessary runtime dependencies available
+      find "$out" -executable -and -type f | while read file; do
+        wrapProgram "$file" --prefix PATH : "${lib.makeBinPath runtimeDeps}"
+      done
+
+      # Symlink filter and ppd into a location where CUPS will discover it
+      mkdir -p $out/lib/cups/filter
+      mkdir -p $out/share/cups/model
+
+      ln -s \
+        $out/opt/brother/Printers/MFCL2750DW/lpd/lpdfilter \
+        $out/lib/cups/filter/brother_lpdwrapper_MFCL2750DW
+
+      ln -s \
+        $out/opt/brother/Printers/MFCL2750DW/cupswrapper/brother-MFCL2750DW-cups-en.ppd \
+        $out/share/cups/model/
+
+      runHook postInstall
+    '';
+
+  meta = with lib; {
+    homepage = "http://www.brother.com/";
+    description = "Brother MFC-L2750DW printer driver";
+    license = licenses.unfree;
+    platforms = builtins.map (arch: "${arch}-linux") arches;
+    maintainers = [ maintainers.lovesegfault ];
+  };
+}
diff --git a/pkgs/os-specific/linux/earlyoom/default.nix b/pkgs/os-specific/linux/earlyoom/default.nix
index 46e83609722..ad7468bac0f 100644
--- a/pkgs/os-specific/linux/earlyoom/default.nix
+++ b/pkgs/os-specific/linux/earlyoom/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, pandoc, installShellFiles, withManpage ? false }:
+{ lib, stdenv, fetchFromGitHub, pandoc, installShellFiles, withManpage ? false, nixosTests }:
 
 stdenv.mkDerivation rec {
   pname = "earlyoom";
@@ -23,6 +23,10 @@ stdenv.mkDerivation rec {
     installManPage earlyoom.1
   '';
 
+  passthru.tests = {
+    inherit (nixosTests) earlyoom;
+  };
+
   meta = with lib; {
     description = "Early OOM Daemon for Linux";
     homepage = "https://github.com/rfjakob/earlyoom";
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index ce6123a10f7..d3aeea3ec62 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -479,6 +479,7 @@ let
       DEFAULT_SECURITY_APPARMOR        = yes;
 
       RANDOM_TRUST_CPU                 = whenAtLeast "4.19" yes; # allow RDRAND to seed the RNG
+      RANDOM_TRUST_BOOTLOADER          = whenAtLeast "5.4" yes; # allow the bootloader to seed the RNG
 
       MODULE_SIG            = no; # r13y, generates a random key during build and bakes it in
       # Depends on MODULE_SIG and only really helps when you sign your modules
diff --git a/pkgs/os-specific/linux/projecteur/default.nix b/pkgs/os-specific/linux/projecteur/default.nix
new file mode 100644
index 00000000000..63de7453935
--- /dev/null
+++ b/pkgs/os-specific/linux/projecteur/default.nix
@@ -0,0 +1,32 @@
+{ lib, mkDerivation, fetchFromGitHub,
+  cmake, pkg-config,
+  qtbase, qtgraphicaleffects, wrapQtAppsHook }:
+mkDerivation rec {
+  pname = "projecteur";
+  version = "0.9.2";
+
+  src = fetchFromGitHub {
+    owner = "jahnf";
+    repo = "Projecteur";
+    rev = "v${version}";
+    fetchSubmodules = false;
+    sha256 = "sha256-kg6oYtJ4H5A6RNATBg+XvMfCb9FlhEBFjfxamGosMQg=";
+  };
+
+  buildInputs = [ qtbase qtgraphicaleffects ];
+  nativeBuildInputs = [ wrapQtAppsHook cmake pkg-config ];
+
+  cmakeFlags = [
+    "-DCMAKE_INSTALL_PREFIX:PATH=${placeholder "out"}"
+    "-DPACKAGE_TARGETS=OFF"
+    "-DCMAKE_INSTALL_UDEVRULESDIR=${placeholder "out"}/lib/udev/rules.d"
+  ];
+
+  meta = with lib; {
+    description = "Linux/X11 application for the Logitech Spotlight device (and similar devices).";
+    homepage = "https://github.com/jahnf/Projecteur";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ benneti ];
+  };
+}
diff --git a/pkgs/servers/dns/https-dns-proxy/default.nix b/pkgs/servers/dns/https-dns-proxy/default.nix
index c32d3eca226..5e2efae8a28 100644
--- a/pkgs/servers/dns/https-dns-proxy/default.nix
+++ b/pkgs/servers/dns/https-dns-proxy/default.nix
@@ -3,13 +3,13 @@
 stdenv.mkDerivation rec {
   pname = "https-dns-proxy";
   # there are no stable releases (yet?)
-  version = "unstable-20200419";
+  version = "unstable-2021-03-29";
 
   src = fetchFromGitHub {
     owner = "aarond10";
     repo = "https_dns_proxy";
-    rev = "79fc7b085e3b1ad64c8332f7115dfe2bf5f1f3e4";
-    sha256 = "1cdfswfjby4alp6gy7yyjm76kfyclh5ax0zadnqs2pyigg9plh0b";
+    rev = "bbd9ef272dcda3ead515871f594768af13192af7";
+    sha256 = "sha256-r+IpDklI3vITK8ZlZvIFm3JdDe2r8DK2ND3n1a/ThrM=";
   };
 
   nativeBuildInputs = [ cmake gtest ];
diff --git a/pkgs/servers/icingaweb2/default.nix b/pkgs/servers/icingaweb2/default.nix
index 4a6adb2b024..75282ad15c4 100644
--- a/pkgs/servers/icingaweb2/default.nix
+++ b/pkgs/servers/icingaweb2/default.nix
@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "icingaweb2";
-  version = "2.9.6";
+  version = "2.10.0";
 
   src = fetchFromGitHub {
     owner = "Icinga";
     repo = "icingaweb2";
     rev = "v${version}";
-    sha256 = "sha256:1kcn1kkhm8fkwhjqmpysd2hvnrvh6bka8r67yq8d58m117l9wnpq";
+    sha256 = "sha256:0fhhq6mzpwj3dh6w583n4sngshf15dm8zgbli5cacy7jkzmsz0wn";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/servers/icingaweb2/ipl.nix b/pkgs/servers/icingaweb2/ipl.nix
index 7e67e645be9..e9075d7d043 100644
--- a/pkgs/servers/icingaweb2/ipl.nix
+++ b/pkgs/servers/icingaweb2/ipl.nix
@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "icingaweb2-ipl";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "Icinga";
     repo = "icinga-php-library";
     rev = "v${version}";
-    sha256 = "sha256:118bg9mxjxajm2ydbycgqdmdx8przwxblsaxc373r0g1dp1lv0fz";
+    sha256 = "sha256:05k0qcd5c5xb124dpp6lvfdh4dzf6bkd34v4sy7aj776p4hrlqx2";
   };
 
   installPhase = ''
diff --git a/pkgs/servers/keycloak/default.nix b/pkgs/servers/keycloak/default.nix
index 9d8a2b31bf1..19268de42ff 100644
--- a/pkgs/servers/keycloak/default.nix
+++ b/pkgs/servers/keycloak/default.nix
@@ -50,9 +50,11 @@ stdenv.mkDerivation rec {
       ln -s ${mkModuleXml "com.mysql" "mysql-connector-java.jar"} $module_path/com/mysql/main/module.xml
     ''}
 
-    wrapProgram $out/bin/standalone.sh --set JAVA_HOME ${jre}
-    wrapProgram $out/bin/add-user-keycloak.sh --set JAVA_HOME ${jre}
-    wrapProgram $out/bin/jboss-cli.sh --set JAVA_HOME ${jre}
+    for script in add-user-keycloak.sh add-user.sh domain.sh elytron-tool.sh jboss-cli.sh jconsole.sh jdr.sh standalone.sh wsconsume.sh wsprovide.sh; do
+      wrapProgram $out/bin/$script --set JAVA_HOME ${jre}
+    done
+    wrapProgram $out/bin/kcadm.sh --prefix PATH : ${jre}/bin
+    wrapProgram $out/bin/kcreg.sh --prefix PATH : ${jre}/bin
   '';
 
   passthru.tests = nixosTests.keycloak;
diff --git a/pkgs/servers/klipper/default.nix b/pkgs/servers/klipper/default.nix
index e2932c16a10..490bb9c9e09 100644
--- a/pkgs/servers/klipper/default.nix
+++ b/pkgs/servers/klipper/default.nix
@@ -36,6 +36,11 @@ stdenv.mkDerivation rec {
     mkdir -p $out/lib/klipper
     cp -r ./* $out/lib/klipper
 
+    # Moonraker expects `config_examples` and `docs` to be available
+    # under `klipper_path`
+    cp -r $src/docs $out/lib/docs
+    cp -r $src/config $out/lib/config
+
     chmod 755 $out/lib/klipper/klippy.py
     runHook postInstall
   '';
diff --git a/pkgs/servers/minio/default.nix b/pkgs/servers/minio/default.nix
index 9823ee5dddd..afa537bddd4 100644
--- a/pkgs/servers/minio/default.nix
+++ b/pkgs/servers/minio/default.nix
@@ -15,16 +15,16 @@ let
 in
 buildGoModule rec {
   pname = "minio";
-  version = "2022-03-17T06-34-49Z";
+  version = "2022-03-22T02-05-10Z";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "minio";
     rev = "RELEASE.${version}";
-    sha256 = "sha256-iHwFkxfSLrtzSiOmfVFggBvfL0SL6ZLVJWMGK3RHZGU=";
+    sha256 = "sha256-N0ua+XHkLr33PElSdOzVQF3POPU+lx4/M6LJzxtkisI=";
   };
 
-  vendorSha256 = "sha256-ujkrbP7FuL7jdYTRaGMEYha1BJKJnpCssuO47XGMBGo=";
+  vendorSha256 = "sha256-Ql3J2r489Hzhy6E9uZwQXJIw/njb5oafCYjOyWGzbXs=";
 
   doCheck = false;
 
diff --git a/pkgs/servers/monitoring/prometheus/blackbox-exporter.nix b/pkgs/servers/monitoring/prometheus/blackbox-exporter.nix
index da235ff96fb..2349bac177c 100644
--- a/pkgs/servers/monitoring/prometheus/blackbox-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/blackbox-exporter.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "blackbox_exporter";
-  version = "0.19.0";
+  version = "0.20.0";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "prometheus";
     repo = "blackbox_exporter";
-    sha256 = "1lrabbp6nsd9h3hs3y5a37yl4g8zzkv0m3vhz2vrir3wmfn07n4g";
+    sha256 = "sha256-Y3HdFIChkQVooxy2I2Gbqw3WLHsI4Zm+osHTzFluRZA=";
   };
 
-  vendorSha256 = "1wi9dmbxb6i1qglnp1v0lkqpp7l29lrbsg4lvx052nkcwkgq8g1y";
+  vendorSha256 = "sha256-KFLR0In4txQQp5dt8P0yAFtf82b4SBq2xMnlz+vMuuU=";
 
   # dns-lookup is performed for the tests
   doCheck = false;
diff --git a/pkgs/servers/monitoring/prometheus/node-exporter.nix b/pkgs/servers/monitoring/prometheus/node-exporter.nix
index 7d40e919773..0da2bb604a0 100644
--- a/pkgs/servers/monitoring/prometheus/node-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/node-exporter.nix
@@ -1,4 +1,7 @@
-{ lib, buildGoModule, fetchFromGitHub, nixosTests }:
+{ lib, stdenv, buildGoModule, fetchFromGitHub, nixosTests
+  # darwin
+  , CoreFoundation, IOKit
+}:
 
 buildGoModule rec {
   pname = "node_exporter";
@@ -17,6 +20,13 @@ buildGoModule rec {
   # FIXME: tests fail due to read-only nix store
   doCheck = false;
 
+  buildInputs = lib.optionals stdenv.isDarwin [ CoreFoundation IOKit ];
+  # upstream currently doesn't work with the version of the macOS SDK
+  # we're building against in nix-darwin without a patch.
+  # this patch has been submitted upstream at https://github.com/prometheus/node_exporter/pull/2327
+  # and only needs to be carried until it lands in a new release.
+  patches = lib.optionals stdenv.isDarwin [ ./node-exporter/node-exporter-darwin.patch ];
+
   excludedPackages = [ "docs/node-mixin" ];
 
   ldflags = [
diff --git a/pkgs/servers/monitoring/prometheus/node-exporter/node-exporter-darwin.patch b/pkgs/servers/monitoring/prometheus/node-exporter/node-exporter-darwin.patch
new file mode 100644
index 00000000000..8077bbc4751
--- /dev/null
+++ b/pkgs/servers/monitoring/prometheus/node-exporter/node-exporter-darwin.patch
@@ -0,0 +1,17 @@
+diff --git a/collector/powersupplyclass_darwin.go b/collector/powersupplyclass_darwin.go
+index a070f64..01d7f18 100644
+--- a/collector/powersupplyclass_darwin.go
++++ b/collector/powersupplyclass_darwin.go
+@@ -18,9 +18,11 @@ package collector
+ 
+ /*
+ #cgo LDFLAGS: -framework IOKit -framework CoreFoundation
++#include <CoreFoundation/CFNumber.h>
++#include <CoreFoundation/CFRunLoop.h>
++#include <CoreFoundation/CFString.h>
+ #include <IOKit/ps/IOPowerSources.h>
+ #include <IOKit/ps/IOPSKeys.h>
+-#include <CoreFoundation/CFArray.h>
+ 
+ // values collected from IOKit Power Source APIs
+ // Functions documentation available at
diff --git a/pkgs/servers/moonraker/default.nix b/pkgs/servers/moonraker/default.nix
index 31525464c0c..2350cd18042 100644
--- a/pkgs/servers/moonraker/default.nix
+++ b/pkgs/servers/moonraker/default.nix
@@ -1,9 +1,9 @@
-{ lib, stdenvNoCC, fetchFromGitHub, python3, makeWrapper, unstableGitUpdater }:
+{ lib, stdenvNoCC, fetchFromGitHub, python3, makeWrapper, unstableGitUpdater, nixosTests }:
 
 let
   pythonEnv = python3.withPackages (packages: with packages; [
     tornado
-    pyserial
+    pyserial-asyncio
     pillow
     lmdb
     streaming-form-data
@@ -12,16 +12,21 @@ let
     libnacl
     paho-mqtt
     pycurl
+    zeroconf
+    preprocess-cancellation
+    jinja2
+    dbus-next
+    apprise
   ]);
 in stdenvNoCC.mkDerivation rec {
   pname = "moonraker";
-  version = "unstable-2021-12-05";
+  version = "unstable-2022-03-10";
 
   src = fetchFromGitHub {
     owner = "Arksine";
     repo = "moonraker";
-    rev = "ac73036857cc1ca83df072dd94bf28eb9d0ed8b0";
-    sha256 = "Oqjt0z4grt+hdQ4t7KQSwkkCeRGoFFedJsTpMHwMm34=";
+    rev = "ee312ee9c6597c8d077d7c3208ccea4e696c97ca";
+    sha256 = "l0VOQIfKgZ/Je4z+SKhWMgYzxye8WKs9W1GkNs7kABo=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
@@ -34,7 +39,10 @@ in stdenvNoCC.mkDerivation rec {
       --add-flags "$out/lib/moonraker/moonraker.py"
   '';
 
-  passthru.updateScript = unstableGitUpdater { url = meta.homepage; };
+  passthru = {
+    updateScript = unstableGitUpdater { url = meta.homepage; };
+    tests.moonraker = nixosTests.moonraker;
+  };
 
   meta = with lib; {
     description = "API web server for Klipper";
diff --git a/pkgs/servers/varnish/default.nix b/pkgs/servers/varnish/default.nix
index 7d52b3a0a26..31884fd8022 100644
--- a/pkgs/servers/varnish/default.nix
+++ b/pkgs/servers/varnish/default.nix
@@ -51,15 +51,8 @@ in
     version = "6.0.10";
     sha256 = "1sr60wg5mzjb14y75cga836f19sbmmpgh13mwc4alyg3irsbz1bb";
   };
-  varnish70 = (common {
-    version = "7.0.2";
-    sha256 = "0q9z1iilqwbh5flfy9pl18kxv0yjs5z91c4j81z5pgyjd9d4jjjj";
-  }).overrideAttrs (oA: {
-    patches = [
-      (fetchpatch {
-        url = "https://github.com/varnishcache/varnish-cache/commit/20e007a5b17c1f68f70ab42080de384f9e192900.patch";
-        sha256 = "0vvihbjknb0skdv2ksn2lz89pwmn4f2rjmb6q65cvgnnjfj46s82";
-      })
-    ];
-  });
+  varnish71 = common {
+    version = "7.1.0";
+    sha256 = "1flyqr212jamqpwafdil170vc966r1mbb7n3ngjn8xk6hn3bhjpm";
+  };
 }
diff --git a/pkgs/servers/varnish/packages.nix b/pkgs/servers/varnish/packages.nix
index 257b421112e..60141b13829 100644
--- a/pkgs/servers/varnish/packages.nix
+++ b/pkgs/servers/varnish/packages.nix
@@ -1,4 +1,4 @@
-{ callPackages, callPackage, varnish60, varnish70, fetchFromGitHub }: {
+{ callPackages, callPackage, varnish60, varnish71, fetchFromGitHub }: {
   varnish60Packages = rec {
     varnish = varnish60;
     modules = (callPackages ./modules.nix { inherit varnish; }).modules15;
@@ -13,8 +13,8 @@
       sha256 = "1n94slrm6vn3hpymfkla03gw9603jajclg84bjhwb8kxsk3rxpmk";
     };
   };
-  varnish70Packages = rec {
-    varnish = varnish70;
+  varnish71Packages = rec {
+    varnish = varnish71;
     modules = (callPackages ./modules.nix { inherit varnish; }).modules19;
     digest  = callPackage ./digest.nix {
       inherit varnish;
diff --git a/pkgs/shells/zsh/oh-my-zsh/default.nix b/pkgs/shells/zsh/oh-my-zsh/default.nix
index 03fffa9ba95..c10951239a3 100644
--- a/pkgs/shells/zsh/oh-my-zsh/default.nix
+++ b/pkgs/shells/zsh/oh-my-zsh/default.nix
@@ -5,15 +5,15 @@
 , git, nix, nixfmt, jq, coreutils, gnused, curl, cacert }:
 
 stdenv.mkDerivation rec {
-  version = "2022-03-18";
+  version = "2022-03-22";
   pname = "oh-my-zsh";
-  rev = "c96fc233c4903ba75fba5bc55e7f91f9dc8e460e";
+  rev = "50113a53f379b7d98e6921ba58e8440324beb32c";
 
   src = fetchFromGitHub {
     inherit rev;
     owner = "ohmyzsh";
     repo = "ohmyzsh";
-    sha256 = "HCFbdo08Um3ut9SngtHDbl/w265G6OOb+RF/liE1Rlg=";
+    sha256 = "RBaJ6/NmPS106xWEj47zBsTWSOp19aq3WTyXcdA5T3c=";
   };
 
   installPhase = ''
diff --git a/pkgs/test/nixos-functions/default.nix b/pkgs/test/nixos-functions/default.nix
index 6a4f3164f92..a59160511b9 100644
--- a/pkgs/test/nixos-functions/default.nix
+++ b/pkgs/test/nixos-functions/default.nix
@@ -26,14 +26,14 @@ in lib.optionalAttrs stdenv.hostPlatform.isLinux (
       fileSystems."/".device = "/dev/null";
     }).toplevel;
 
-    nixosTest-test = pkgs.nixosTest ({ lib, pkgs, ... }: {
+    nixosTest-test = pkgs.nixosTest ({ lib, pkgs, figlet, ... }: {
       name = "nixosTest-test";
       machine = { pkgs, ... }: {
         system.nixos = dummyVersioning;
-        environment.systemPackages = [ pkgs.hello ];
+        environment.systemPackages = [ pkgs.hello figlet ];
       };
       testScript = ''
-        machine.succeed("hello")
+        machine.succeed("hello | figlet >/dev/console")
       '';
     });
 
diff --git a/pkgs/tools/audio/tts/default.nix b/pkgs/tools/audio/tts/default.nix
index a7b0212a7b0..a15a29f9d57 100644
--- a/pkgs/tools/audio/tts/default.nix
+++ b/pkgs/tools/audio/tts/default.nix
@@ -57,6 +57,7 @@ python.pkgs.buildPythonApplication rec {
         ''-e 's/${package}.*[<>=]+.*/${package}/g' \''
       ) relaxedConstraints)}
     requirements.txt
+    sed -i '/tensorboardX/d' requirements.txt
   '';
 
   nativeBuildInputs = with python.pkgs; [
@@ -84,7 +85,6 @@ python.pkgs.buildPythonApplication rec {
     pyworld
     scipy
     soundfile
-    tensorboardx
     tensorflow
     torchaudio-bin
     tqdm
diff --git a/pkgs/tools/misc/nix-direnv/default.nix b/pkgs/tools/misc/nix-direnv/default.nix
index f0fa2529f06..731278cafe0 100644
--- a/pkgs/tools/misc/nix-direnv/default.nix
+++ b/pkgs/tools/misc/nix-direnv/default.nix
@@ -7,13 +7,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "nix-direnv";
-  version = "1.6.0";
+  version = "1.6.1";
 
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "nix-direnv";
     rev = version;
-    sha256 = "sha256-vMs4CyMhEy96gWMWXD74rTR1uNjU+y21i0dh6AdaMGE=";
+    sha256 = "sha256-WgNfo9GRqIrXsIgNRhoNPU2/uwyPd8xG8xEEImEy4KY=";
   };
 
   # Substitute instead of wrapping because the resulting file is
diff --git a/pkgs/tools/misc/remind/default.nix b/pkgs/tools/misc/remind/default.nix
index 91251abde13..6d5e0e37703 100644
--- a/pkgs/tools/misc/remind/default.nix
+++ b/pkgs/tools/misc/remind/default.nix
@@ -16,11 +16,11 @@ let
 in
 tcl.mkTclDerivation rec {
   pname = "remind";
-  version = "03.04.01";
+  version = "03.04.02";
 
   src = fetchurl {
     url = "https://dianne.skoll.ca/projects/remind/download/remind-${version}.tar.gz";
-    sha256 = "sha256-8INtFmftMb1JSotUdDtMXdSm+UE/8zQW/wIOExr8nkI=";
+    sha256 = "sha256-kjDcO0l39l2KJXo0elZesKZWDZoSoUXIu1Ua7IxWY4w=";
   };
 
   propagatedBuildInputs = tclLibraries;
diff --git a/pkgs/tools/networking/aardvark-dns/default.nix b/pkgs/tools/networking/aardvark-dns/default.nix
index 5d49842237f..412b3e0349c 100644
--- a/pkgs/tools/networking/aardvark-dns/default.nix
+++ b/pkgs/tools/networking/aardvark-dns/default.nix
@@ -5,26 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "aardvark-dns";
-  version = "1.0.1";
+  version = "1.0.2";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-6O/7GoGH0xNbTfIFeD5VLrifNFpHcxxG0bdq/YQb3Ew=";
+    sha256 = "sha256-d4YSCVZkNung4frgAeP46E9Ptpnu9y0HwmPRADo4t0U=";
   };
 
-  cargoHash = "sha256-YdHIyCJ00MKH8PL0osOqQIMwaws3+cOUwvhvA8mOp84=";
-
-  preBuild = ''
-    rm build.rs
-
-    export \
-      VERGEN_BUILD_SEMVER="${version}" \
-      VERGEN_BUILD_TIMESTAMP="$SOURCE_DATE_EPOCH" \
-      VERGEN_GIT_SHA="${src.rev}" \
-      VERGEN_RUSTC_HOST_TRIPLE=""
-  '';
+  cargoHash = "sha256-fu7ZopS55IzzeO7uzLx1wVHQ8A1Ff+9f7FagoZPerxk=";
 
   meta = with lib; {
     description = "Authoritative dns server for A/AAAA container records";
diff --git a/pkgs/tools/networking/drill/default.nix b/pkgs/tools/networking/drill/default.nix
index fce409dc2dc..7e5d1ac1e00 100644
--- a/pkgs/tools/networking/drill/default.nix
+++ b/pkgs/tools/networking/drill/default.nix
@@ -24,6 +24,9 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
+  OPENSSL_LIB_DIR = "${openssl.out}/lib";
+  OPENSSL_DIR="${lib.getDev openssl}";
+
   buildInputs = lib.optionals stdenv.isLinux [
     openssl
   ] ++ lib.optionals stdenv.isDarwin [
diff --git a/pkgs/tools/networking/lychee/default.nix b/pkgs/tools/networking/lychee/default.nix
index d8376016bbf..5e788638e6e 100644
--- a/pkgs/tools/networking/lychee/default.nix
+++ b/pkgs/tools/networking/lychee/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "lychee";
-  version = "0.8.2";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "lycheeverse";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-zgIFJLdYHSDsO34KFK51g4nVlSkc9/TFdXx2yPJ7kRQ=";
+    sha256 = "sha256-XjG4u0z3u89Wg2lrcD3T0OqNMgLxmKO1e1zYlGd3dqQ=";
   };
 
-  cargoSha256 = "sha256-r4a+JkaXVYsynBiWUHaleATXvfxyhRHfR/qcooD0FmI=";
+  cargoSha256 = "sha256-aXxhKH0dB6VpXfoWJwXBjsxGFcK071MZfCoi4z9uHdc=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/tools/networking/mqttui/default.nix b/pkgs/tools/networking/mqttui/default.nix
index 4b14caf9b67..4243c7ddbd8 100644
--- a/pkgs/tools/networking/mqttui/default.nix
+++ b/pkgs/tools/networking/mqttui/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mqttui";
-  version = "0.16.0";
+  version = "0.16.1";
 
   src = fetchFromGitHub {
     owner = "EdJoPaTo";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-kGOQIoE+0lCBm9zQwPMFfYnLJgR79hSKECerWyOFsjI=";
+    sha256 = "sha256-nLUDuLolv52WJAwBG5gSADWM2LmquJt5jZJioZWX8VA=";
   };
 
-  cargoSha256 = "sha256-vm4IR/yQlQDn9LN9Ifr4vJvM6cCqgjRU2vdAHVEsWnI=";
+  cargoSha256 = "sha256-Z6V7k69fjtiG01s1Xf0UA8lhRsq3T+ImDsCHPSVIDfQ=";
 
   buildInputs = lib.optional stdenv.isDarwin Security;
 
diff --git a/pkgs/tools/networking/netavark/default.nix b/pkgs/tools/networking/netavark/default.nix
index 34e60b25e32..3116644eb68 100644
--- a/pkgs/tools/networking/netavark/default.nix
+++ b/pkgs/tools/networking/netavark/default.nix
@@ -7,29 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "netavark";
-  version = "1.0.1";
+  version = "1.0.2";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-r9NoPDFCqmzESxlovs91j0OyunGDmfWJXN+U1f0w2QQ=";
+    sha256 = "sha256-2ElEhKit/XysRsUw+dg7SnhDl+Zf+FJb5pIYpq1ALNs=";
   };
 
-  cargoHash = "sha256-/N9oKzcAwaxI2BbeoYZ2quN+Z3UO67ecpogK2SRG9Dw=";
-
-  preBuild = ''
-    substituteInPlace Cargo.toml \
-      --replace 'build = "build.rs"' ""
-
-    rm build.rs
-
-    export \
-      VERGEN_BUILD_SEMVER="${version}" \
-      VERGEN_BUILD_TIMESTAMP="$SOURCE_DATE_EPOCH" \
-      VERGEN_GIT_SHA="${src.rev}" \
-      VERGEN_RUSTC_HOST_TRIPLE=""
-  '';
+  cargoHash = "sha256-w3qz4ygjIvn+Rxd1JEVO6Ax08leuuJvC4Bk7VygbBh4=";
 
   nativeBuildInputs = [ installShellFiles mandown ];
 
diff --git a/pkgs/tools/networking/tuntox/default.nix b/pkgs/tools/networking/tuntox/default.nix
index 8870f0e32ce..6df9f724500 100644
--- a/pkgs/tools/networking/tuntox/default.nix
+++ b/pkgs/tools/networking/tuntox/default.nix
@@ -9,6 +9,7 @@
 , libsodium
 , libtoxcore
 , libvpx
+, msgpack
 , pkg-config
 , python3
 , python3Packages
@@ -27,7 +28,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cscope git pkg-config ];
 
-  buildInputs = [ libopus libtoxcore libsodium libevent libvpx python3 ];
+  buildInputs = [ libopus libtoxcore libsodium libevent libvpx msgpack python3 ];
 
   pythonBuildInputs = with python3Packages; [
     jinja2
diff --git a/pkgs/tools/security/gitleaks/default.nix b/pkgs/tools/security/gitleaks/default.nix
index 2b0a30811e8..bbeca94a993 100644
--- a/pkgs/tools/security/gitleaks/default.nix
+++ b/pkgs/tools/security/gitleaks/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "gitleaks";
-  version = "8.5.0";
+  version = "8.5.1";
 
   src = fetchFromGitHub {
     owner = "zricethezav";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-vd6mEjswqIX2F3GO7AF1Me4NolbeZZPwLxfyzJaNmT8=";
+    sha256 = "sha256-lx7xjOajFyeetnGcJwX66pIcZw2A7+QGWb5crCoA83g=";
   };
 
-  vendorSha256 = "sha256-J1xX+r+Mph1QkqjK87tqGDkYvPZp0lHgdRhd88WZi1c=";
+  vendorSha256 = "sha256-gelUrZOYiThO0+COIv9cOgho/tjv7ZqSKOktWIbdADw=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/security/grype/default.nix b/pkgs/tools/security/grype/default.nix
index e97a1b6fb13..d59767e4bed 100644
--- a/pkgs/tools/security/grype/default.nix
+++ b/pkgs/tools/security/grype/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "grype";
-  version = "0.34.4";
+  version = "0.34.6";
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-t5N9C69u8bTXXobptmxA+yuQ88Hko8Hhhp+nyC/tMFc=";
+    sha256 = "sha256-3+6ZhAlEOKrgvAXzgOY0q+R/4dbN+qk4Nxuj1IBntzo=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
diff --git a/pkgs/tools/security/sigma-cli/default.nix b/pkgs/tools/security/sigma-cli/default.nix
index 3d83653cb00..a2417e7b8fe 100644
--- a/pkgs/tools/security/sigma-cli/default.nix
+++ b/pkgs/tools/security/sigma-cli/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "sigma-cli";
-  version = "0.3.3";
+  version = "0.3.4";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "SigmaHQ";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-AUAOZrwLNu+Llg8RX4RKm4vAETgpPLKK1mcpl8jxGYE=";
+    hash = "sha256-FWcPHtEYqS+81dU4lB+4BLFOXtFumcyhucwvmu2TAt8=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/system/ctop/default.nix b/pkgs/tools/system/ctop/default.nix
index 36dfd02c33f..6091eff255d 100644
--- a/pkgs/tools/system/ctop/default.nix
+++ b/pkgs/tools/system/ctop/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "ctop";
-  version = "0.7.6";
+  version = "0.7.7";
 
   src = fetchFromGitHub {
     owner = "bcicen";
     repo = pname;
-    rev = version;
-    sha256 = "sha256-ceRyYrqmgdTnV8m9LkLlR6iTrC5F81X/V3fWI2CiKBw=";
+    rev = "v${version}";
+    sha256 = "sha256-tojSzgpoGQg6MwV/MVpQpCA5w6bZO+9IOvfkw0Ydr6c=";
   };
 
-  vendorSha256 = "sha256-UCeMy4iT0c2sTcCDPg0TIYCLYfrIUvHluUuGIpzluSg=";
+  vendorSha256 = "sha256-UAja7XuoLqJFNcK1PgHGcuf/HbvSrWyRvW2D3T7Hg0g=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/system/nats-top/default.nix b/pkgs/tools/system/nats-top/default.nix
index f2be03d4301..651a9635fb4 100644
--- a/pkgs/tools/system/nats-top/default.nix
+++ b/pkgs/tools/system/nats-top/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "nats-top";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "nats-io";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0b1hpnq8m1xfrn58ammmnx6lmhk319m8z4xjxgckz7wvy2fbzw0n";
+    sha256 = "sha256-IZQDwopFAXPT0V+TTiJk6+j/KhLTA3g4kN1j1PVlNt0=";
   };
 
-  vendorSha256 = "1a48p9gx5zdc340ma6cqakhi6f3lw9b0kz2597j1jcsk2qb7s581";
+  vendorSha256 = "sha256-cBCR/OXUOa+Lh8UvL/VraDAW0hGGwV7teyvdswZQ5Lo=";
 
   meta = with lib; {
     description = "top-like tool for monitoring NATS servers";
diff --git a/pkgs/tools/text/gnused/422.nix b/pkgs/tools/text/gnused/422.nix
deleted file mode 100644
index 15e57e31901..00000000000
--- a/pkgs/tools/text/gnused/422.nix
+++ /dev/null
@@ -1,35 +0,0 @@
-{ lib, stdenv, fetchurl }:
-
-stdenv.mkDerivation rec {
-  pname = "gnused";
-  version = "4.2.2";
-
-  src = fetchurl {
-    url = "mirror://gnu/sed/sed-${version}.tar.bz2";
-    sha256 = "f048d1838da284c8bc9753e4506b85a1e0cc1ea8999d36f6995bcb9460cddbd7";
-  };
-
-  configureFlags = lib.optional stdenv.hostPlatform.isMinGW "ac_cv_func__set_invalid_parameter_handler=no";
-
-  outputs = [ "out" "info" ];
-
-  meta = {
-    homepage = "https://www.gnu.org/software/sed/";
-    description = "GNU sed, a batch stream editor";
-
-    longDescription = ''
-      Sed (stream editor) isn't really a true text editor or text
-      processor.  Instead, it is used to filter text, i.e., it takes
-      text input and performs some operation (or set of operations) on
-      it and outputs the modified text.  Sed is typically used for
-      extracting part of a file using pattern matching or substituting
-      multiple occurrences of a string within a file.
-    '';
-
-    license = lib.licenses.gpl3Plus;
-
-    platforms = lib.platforms.all;
-    maintainers = [ ];
-    mainProgram = "sed";
-  };
-}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 6c1473d9c97..2731c0bd3fc 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1263,6 +1263,7 @@ mapAliases ({
   varnish62 = throw "varnish62 was removed from nixpkgs, because it is unmaintained upstream. Please switch to a different release"; # Added 2021-07-26
   varnish63 = throw "varnish63 was removed from nixpkgs, because it is unmaintained upstream. Please switch to a different release"; # Added 2021-07-26
   varnish65 = throw "varnish65 was removed from nixpkgs, because it is unmaintained upstream. Please switch to a different release"; # Added 2021-09-15
+  varnish70 = throw "varnish70 was removed from nixpkgs, because it was superseded upstream. Please switch to a different release"; # Added 2022-03-17
   vdirsyncerStable  = vdirsyncer; # Added 2020-11-08, see https://github.com/NixOS/nixpkgs/issues/103026#issuecomment-723428168
   venus = throw "venus has been removed from nixpkgs, as it's unmaintained"; # Added 2021-02-05
   vimbWrapper = throw "'vimbWrapper' has been renamed to/replaced by 'vimb'"; # Converted to throw 2022-02-22
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index a5ee3327e03..63fe1960ff9 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6164,11 +6164,7 @@ with pkgs;
 
   gnu-pw-mgr = callPackage ../tools/security/gnu-pw-mgr { };
 
-  gnused = if !stdenv.hostPlatform.isWindows
-    then callPackage ../tools/text/gnused { } # broken on Windows
-    else gnused_422;
-  # This is an easy work-around for [:space:] problems.
-  gnused_422 = callPackage ../tools/text/gnused/422.nix { };
+  gnused = callPackage ../tools/text/gnused { };
 
   gnutar = callPackage ../tools/archivers/gnutar { };
 
@@ -11292,11 +11288,11 @@ with pkgs;
   valum = callPackage ../development/web/valum { };
 
   inherit (callPackages ../servers/varnish { })
-    varnish60 varnish70;
+    varnish60 varnish71;
   inherit (callPackages ../servers/varnish/packages.nix { })
-    varnish60Packages varnish70Packages;
+    varnish60Packages varnish71Packages;
 
-  varnishPackages = varnish70Packages;
+  varnishPackages = varnish71Packages;
   varnish = varnishPackages.varnish;
 
   hitch = callPackage ../servers/hitch { };
@@ -22004,7 +22000,9 @@ with pkgs;
   prometheus-nextcloud-exporter = callPackage ../servers/monitoring/prometheus/nextcloud-exporter.nix { };
   prometheus-nginx-exporter = callPackage ../servers/monitoring/prometheus/nginx-exporter.nix { };
   prometheus-nginxlog-exporter = callPackage ../servers/monitoring/prometheus/nginxlog-exporter.nix { };
-  prometheus-node-exporter = callPackage ../servers/monitoring/prometheus/node-exporter.nix { };
+  prometheus-node-exporter = callPackage ../servers/monitoring/prometheus/node-exporter.nix {
+    inherit (darwin.apple_sdk.frameworks) CoreFoundation IOKit;
+  };
   prometheus-openldap-exporter = callPackage ../servers/monitoring/prometheus/openldap-exporter.nix { };
   prometheus-openvpn-exporter = callPackage ../servers/monitoring/prometheus/openvpn-exporter.nix { };
   prometheus-pihole-exporter = callPackage ../servers/monitoring/prometheus/pihole-exporter.nix {  };
@@ -22752,6 +22750,8 @@ with pkgs;
 
   powerstat = callPackage ../os-specific/linux/powerstat { };
 
+  projecteur = libsForQt5.callPackage ../os-specific/linux/projecteur { };
+
   smemstat = callPackage ../os-specific/linux/smemstat { };
 
   tgt = callPackage ../tools/networking/tgt { };
@@ -25971,11 +25971,6 @@ with pkgs;
   firefoxPackages = recurseIntoAttrs (callPackage ../applications/networking/browsers/firefox/packages.nix {
     callPackage = newScope {
       inherit (rustPackages) cargo rustc;
-      gnused = gnused_422;
-      inherit (darwin.apple_sdk.frameworks) CoreMedia ExceptionHandling
-                                            Kerberos AVFoundation MediaToolbox
-                                            CoreLocation Foundation AddressBook;
-      inherit (darwin) libobjc;
     };
   });
 
@@ -29460,11 +29455,6 @@ with pkgs;
   thunderbirdPackages = recurseIntoAttrs (callPackage ../applications/networking/mailreaders/thunderbird/packages.nix {
     callPackage = newScope {
       inherit (rustPackages) cargo rustc;
-      gnused = gnused_422;
-      inherit (darwin.apple_sdk.frameworks) CoreMedia ExceptionHandling
-                                            Kerberos AVFoundation MediaToolbox
-                                            CoreLocation Foundation AddressBook;
-      inherit (darwin) libobjc;
     };
   });
 
@@ -33275,6 +33265,8 @@ with pkgs;
 
   cups-brother-hll2350dw = callPackage  ../misc/cups/drivers/hll2350dw { };
 
+  cups-brother-mfcl2750dw = callPackage  ../misc/cups/drivers/mfcl2750dw { };
+
   cups-drv-rastertosag-gdi = callPackage ../misc/cups/drivers/cups-drv-rastertosag-gdi { };
 
   # this driver ships with pre-compiled 32-bit binary libraries
@@ -33725,9 +33717,7 @@ with pkgs;
           loadedTest = if builtins.typeOf test == "path"
             then import test
             else test;
-          calledTest = if lib.isFunction loadedTest
-            then callPackage loadedTest {}
-            else loadedTest;
+          calledTest = lib.toFunction loadedTest pkgs;
         in
           nixosTesting.makeTest calledTest;
 
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index cc126dc320d..5c45168524f 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -709,8 +709,6 @@ let
 
     magic-mime = callPackage ../development/ocaml-modules/magic-mime { };
 
-    magick = callPackage ../development/ocaml-modules/magick { };
-
     mariadb = callPackage ../development/ocaml-modules/mariadb {
       inherit (pkgs) mariadb;
     };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 6a15088011d..03f3147e976 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6466,6 +6466,8 @@ in {
 
   premailer = callPackage ../development/python-modules/premailer { };
 
+  preprocess-cancellation = callPackage ../development/python-modules/preprocess-cancellation { };
+
   preshed = callPackage ../development/python-modules/preshed { };
 
   pretend = callPackage ../development/python-modules/pretend { };
@@ -8381,7 +8383,7 @@ in {
     };
 
   pyudev = callPackage ../development/python-modules/pyudev {
-    inherit (pkgs) systemd;
+    inherit (pkgs) udev;
   };
 
   pyunbound = callPackage ../tools/networking/unbound/python.nix { };