summary refs log tree commit diff
path: root/pkgs/tools
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs/tools')
-rw-r--r--pkgs/tools/admin/awscli/default.nix16
-rw-r--r--pkgs/tools/admin/azure-cli/default.nix10
-rw-r--r--pkgs/tools/admin/azure-cli/python-packages.nix32
-rw-r--r--pkgs/tools/admin/chamber/default.nix4
-rw-r--r--pkgs/tools/admin/clair/default.nix6
-rw-r--r--pkgs/tools/admin/credhub-cli/default.nix4
-rw-r--r--pkgs/tools/admin/eksctl/default.nix4
-rw-r--r--pkgs/tools/admin/exoscale-cli/default.nix4
-rw-r--r--pkgs/tools/admin/fits-cloudctl/default.nix6
-rw-r--r--pkgs/tools/admin/google-cloud-sdk/default.nix19
-rw-r--r--pkgs/tools/admin/iamy/default.nix6
-rw-r--r--pkgs/tools/admin/lxd/default.nix22
-rw-r--r--pkgs/tools/audio/acousticbrainz-client/default.nix2
-rw-r--r--pkgs/tools/audio/isrcsubmit/default.nix2
-rw-r--r--pkgs/tools/audio/opl3bankeditor/common.nix1
-rw-r--r--pkgs/tools/audio/tts/default.nix4
-rw-r--r--pkgs/tools/backup/bupstash/default.nix6
-rw-r--r--pkgs/tools/backup/duplicity/default.nix2
-rw-r--r--pkgs/tools/compression/gzip/default.nix4
-rw-r--r--pkgs/tools/filesystems/android-file-transfer/default.nix3
-rw-r--r--pkgs/tools/filesystems/gcsfuse/default.nix4
-rw-r--r--pkgs/tools/filesystems/gocryptfs/default.nix6
-rw-r--r--pkgs/tools/filesystems/s3backer/default.nix4
-rw-r--r--pkgs/tools/filesystems/snapraid/default.nix4
-rw-r--r--pkgs/tools/games/opentracker/default.nix6
-rw-r--r--pkgs/tools/graphics/argyllcms/default.nix114
-rw-r--r--pkgs/tools/graphics/gnuplot/default.nix2
-rw-r--r--pkgs/tools/graphics/goverlay/default.nix20
-rw-r--r--pkgs/tools/graphics/goverlay/find-xdg-data-files.patch10
-rw-r--r--pkgs/tools/graphics/netpbm/default.nix6
-rw-r--r--pkgs/tools/graphics/shotgun/default.nix6
-rw-r--r--pkgs/tools/inputmethods/touchegg/default.nix4
-rw-r--r--pkgs/tools/misc/bat/default.nix14
-rw-r--r--pkgs/tools/misc/bitwise/default.nix4
-rw-r--r--pkgs/tools/misc/broot/default.nix6
-rw-r--r--pkgs/tools/misc/chezmoi/default.nix6
-rw-r--r--pkgs/tools/misc/cloud-sql-proxy/default.nix6
-rw-r--r--pkgs/tools/misc/convimg/default.nix4
-rw-r--r--pkgs/tools/misc/coreutils/default.nix24
-rw-r--r--pkgs/tools/misc/coreutils/disable-seek-hole.patch43
-rw-r--r--pkgs/tools/misc/coreutils/fix-chmod-exit-code.patch108
-rw-r--r--pkgs/tools/misc/coreutils/sys-getdents-undeclared.patch100
-rw-r--r--pkgs/tools/misc/dua/default.nix6
-rw-r--r--pkgs/tools/misc/esptool/default.nix4
-rw-r--r--pkgs/tools/misc/etcher/default.nix14
-rw-r--r--pkgs/tools/misc/fclones/default.nix6
-rw-r--r--pkgs/tools/misc/fend/default.nix6
-rw-r--r--pkgs/tools/misc/ffsend/default.nix6
-rw-r--r--pkgs/tools/misc/fluent-bit/default.nix4
-rw-r--r--pkgs/tools/misc/fselect/default.nix6
-rw-r--r--pkgs/tools/misc/fx_cast/default.nix2
-rw-r--r--pkgs/tools/misc/goreleaser/default.nix6
-rw-r--r--pkgs/tools/misc/kak-lsp/default.nix10
-rw-r--r--pkgs/tools/misc/ksnip/default.nix4
-rw-r--r--pkgs/tools/misc/lf/default.nix6
-rw-r--r--pkgs/tools/misc/lnav/default.nix4
-rw-r--r--pkgs/tools/misc/lsd/default.nix14
-rw-r--r--pkgs/tools/misc/pipreqs/default.nix4
-rw-r--r--pkgs/tools/misc/plantuml-server/default.nix6
-rw-r--r--pkgs/tools/misc/ponysay/default.nix6
-rw-r--r--pkgs/tools/misc/qt5ct/default.nix4
-rw-r--r--pkgs/tools/misc/remind/default.nix4
-rw-r--r--pkgs/tools/misc/sfeed/default.nix4
-rw-r--r--pkgs/tools/misc/sharedown/default.nix81
-rw-r--r--pkgs/tools/misc/staruml/default.nix4
-rw-r--r--pkgs/tools/misc/svtplay-dl/default.nix4
-rw-r--r--pkgs/tools/misc/topgrade/default.nix6
-rw-r--r--pkgs/tools/misc/trash-cli/default.nix4
-rw-r--r--pkgs/tools/misc/tz/default.nix6
-rw-r--r--pkgs/tools/misc/uutils-coreutils/default.nix6
-rw-r--r--pkgs/tools/misc/yubikey-manager-qt/default.nix4
-rw-r--r--pkgs/tools/misc/zoxide/default.nix6
-rw-r--r--pkgs/tools/networking/amass/default.nix6
-rw-r--r--pkgs/tools/networking/brook/default.nix2
-rw-r--r--pkgs/tools/networking/curl/CVE-2021-22945.patch27
-rw-r--r--pkgs/tools/networking/curl/default.nix1
-rw-r--r--pkgs/tools/networking/dnscrypt-proxy2/default.nix4
-rw-r--r--pkgs/tools/networking/dnsproxy/default.nix10
-rw-r--r--pkgs/tools/networking/ferm/default.nix4
-rw-r--r--pkgs/tools/networking/flannel/plugin.nix13
-rw-r--r--pkgs/tools/networking/frp/default.nix6
-rw-r--r--pkgs/tools/networking/getmail6/default.nix4
-rw-r--r--pkgs/tools/networking/globalprotect-openconnect/default.nix4
-rw-r--r--pkgs/tools/networking/gobgp/default.nix4
-rw-r--r--pkgs/tools/networking/gping/default.nix8
-rw-r--r--pkgs/tools/networking/grpcui/default.nix6
-rw-r--r--pkgs/tools/networking/grpcurl/default.nix6
-rw-r--r--pkgs/tools/networking/hurl/default.nix6
-rw-r--r--pkgs/tools/networking/modemmanager/default.nix4
-rw-r--r--pkgs/tools/networking/networkmanager/default.nix4
-rw-r--r--pkgs/tools/networking/openssh/common.nix2
-rw-r--r--pkgs/tools/networking/openssh/default.nix7
-rw-r--r--pkgs/tools/networking/ppp/default.nix17
-rw-r--r--pkgs/tools/networking/s5cmd/default.nix4
-rw-r--r--pkgs/tools/networking/shadowsocks-rust/default.nix18
-rw-r--r--pkgs/tools/networking/shorewall/default.nix6
-rw-r--r--pkgs/tools/networking/sniffglue/default.nix6
-rw-r--r--pkgs/tools/networking/ssldump/default.nix2
-rw-r--r--pkgs/tools/networking/subfinder/default.nix6
-rw-r--r--pkgs/tools/networking/swagger-codegen3/default.nix4
-rw-r--r--pkgs/tools/networking/tendermint/default.nix6
-rw-r--r--pkgs/tools/networking/vtun/default.nix37
-rw-r--r--pkgs/tools/networking/ytcc/default.nix20
-rw-r--r--pkgs/tools/networking/zerotierone/default.nix4
-rw-r--r--pkgs/tools/nix/statix/default.nix28
-rw-r--r--pkgs/tools/package-management/cargo-release/default.nix6
-rw-r--r--pkgs/tools/package-management/nix-du/default.nix19
-rw-r--r--pkgs/tools/package-management/nix/default.nix2
-rw-r--r--pkgs/tools/package-management/nox/default.nix2
-rw-r--r--pkgs/tools/security/b3sum/default.nix6
-rw-r--r--pkgs/tools/security/buttercup-desktop/default.nix33
-rw-r--r--pkgs/tools/security/cariddi/default.nix6
-rw-r--r--pkgs/tools/security/dalfox/default.nix4
-rw-r--r--pkgs/tools/security/doppler/default.nix6
-rw-r--r--pkgs/tools/security/exploitdb/default.nix4
-rw-r--r--pkgs/tools/security/gpg-tui/default.nix6
-rw-r--r--pkgs/tools/security/grype/default.nix6
-rw-r--r--pkgs/tools/security/keyscope/default.nix10
-rw-r--r--pkgs/tools/security/kubescape/default.nix4
-rw-r--r--pkgs/tools/security/metasploit/Gemfile2
-rw-r--r--pkgs/tools/security/metasploit/Gemfile.lock18
-rw-r--r--pkgs/tools/security/metasploit/default.nix4
-rw-r--r--pkgs/tools/security/metasploit/gemset.nix26
-rw-r--r--pkgs/tools/security/pinentry/default.nix4
-rw-r--r--pkgs/tools/security/rbw/default.nix23
-rw-r--r--pkgs/tools/security/sedutil/default.nix26
-rw-r--r--pkgs/tools/security/tor/default.nix4
-rw-r--r--pkgs/tools/security/tpm2-tools/default.nix4
-rw-r--r--pkgs/tools/security/vaultwarden/default.nix6
-rw-r--r--pkgs/tools/security/yubikey-touch-detector/default.nix6
-rw-r--r--pkgs/tools/system/acpica-tools/default.nix4
-rw-r--r--pkgs/tools/system/btop/default.nix4
-rw-r--r--pkgs/tools/system/consul-template/default.nix6
-rw-r--r--pkgs/tools/system/datefudge/default.nix11
-rw-r--r--pkgs/tools/system/honcho/default.nix21
-rw-r--r--pkgs/tools/system/thinkfan/default.nix4
-rw-r--r--pkgs/tools/system/uptimed/default.nix4
-rw-r--r--pkgs/tools/text/angle-grinder/default.nix6
-rw-r--r--pkgs/tools/text/crowdin-cli/default.nix4
-rw-r--r--pkgs/tools/text/glogg/default.nix1
-rw-r--r--pkgs/tools/text/gnugrep/default.nix4
-rw-r--r--pkgs/tools/text/source-highlight/default.nix9
-rw-r--r--pkgs/tools/text/tidy-viewer/default.nix6
-rw-r--r--pkgs/tools/text/ucg/default.nix36
-rw-r--r--pkgs/tools/text/ugrep/default.nix4
-rw-r--r--pkgs/tools/typesetting/tex/texlive/combine.nix8
-rw-r--r--pkgs/tools/video/rav1e/default.nix28
-rw-r--r--pkgs/tools/virtualization/distrobuilder/default.nix6
-rw-r--r--pkgs/tools/wayland/cliphist/default.nix4
149 files changed, 902 insertions, 696 deletions
diff --git a/pkgs/tools/admin/awscli/default.nix b/pkgs/tools/admin/awscli/default.nix
index d11ed86e088..0b9d6b47383 100644
--- a/pkgs/tools/admin/awscli/default.nix
+++ b/pkgs/tools/admin/awscli/default.nix
@@ -1,5 +1,4 @@
 { lib
-, nixosTests
 , python3
 , groff
 , less
@@ -34,9 +33,6 @@ with py.pkgs; buildPythonApplication rec {
       --replace "docutils>=0.10,<0.16" "docutils>=0.10"
   '';
 
-  # No tests included
-  doCheck = false;
-
   propagatedBuildInputs = [
     botocore
     bcdoc
@@ -62,10 +58,18 @@ with py.pkgs; buildPythonApplication rec {
 
   passthru = {
     python = py; # for aws_shell
-
-    tests = { inherit (nixosTests) awscli; };
   };
 
+  doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    $out/bin/aws --version | grep "${py.pkgs.botocore.version}"
+    $out/bin/aws --version | grep "${version}"
+
+    runHook postInstallCheck
+  '';
+
   meta = with lib; {
     homepage = "https://aws.amazon.com/cli/";
     description = "Unified tool to manage your AWS services";
diff --git a/pkgs/tools/admin/azure-cli/default.nix b/pkgs/tools/admin/azure-cli/default.nix
index 4f0609d0a55..71d546961fc 100644
--- a/pkgs/tools/admin/azure-cli/default.nix
+++ b/pkgs/tools/admin/azure-cli/default.nix
@@ -1,7 +1,7 @@
 { stdenv, lib, python3, fetchFromGitHub, installShellFiles }:
 
 let
-  version = "2.28.1";
+  version = "2.29.1";
   srcName = "azure-cli-${version}-src";
 
   src = fetchFromGitHub {
@@ -9,7 +9,7 @@ let
     owner = "Azure";
     repo = "azure-cli";
     rev = "azure-cli-${version}";
-    sha256 = "sha256-9EkCScEj5kuKtkfnCmFUZg/qDzvmI3rvDS+NtkZC7sk=";
+    sha256 = "sha256-9H38dZZz2rGSuWS1T398p+9T+G+Rt5gi3Ip2xIauEWo=";
   };
 
   # put packages that needs to be overriden in the py package scope
@@ -26,10 +26,11 @@ py.pkgs.toPythonApplication (py.pkgs.buildAzureCliPackage {
 
   prePatch = ''
     substituteInPlace setup.py \
-      --replace "javaproperties==0.5.1" "javaproperties" \
+      --replace "chardet~=3.0.4" "chardet" \
+      --replace "javaproperties~=0.5.1" "javaproperties" \
       --replace "pytz==2019.1" "pytz" \
       --replace "scp~=0.13.2" "scp" \
-      --replace "jsondiff==1.2.0" "jsondiff~=1.2" \
+      --replace "jsondiff~=1.2.0" "jsondiff~=1.2" \
       --replace "antlr4-python3-runtime~=4.7.2" "antlr4-python3-runtime~=4.7" \
       --replace "mock~=4.0" "mock"
 
@@ -55,6 +56,7 @@ py.pkgs.toPythonApplication (py.pkgs.buildAzureCliPackage {
     azure-identity
     azure-keyvault
     azure-keyvault-administration
+    azure-keyvault-keys
     azure-loganalytics
     azure-mgmt-advisor
     azure-mgmt-apimanagement
diff --git a/pkgs/tools/admin/azure-cli/python-packages.nix b/pkgs/tools/admin/azure-cli/python-packages.nix
index b50543dbe3d..8b93e0825f8 100644
--- a/pkgs/tools/admin/azure-cli/python-packages.nix
+++ b/pkgs/tools/admin/azure-cli/python-packages.nix
@@ -163,8 +163,8 @@ let
       azure-mgmt-recoveryservices = overrideAzureMgmtPackage super.azure-mgmt-recoveryservices "2.0.0" "zip"
         "sha256-p9MTfVxGD1CsLUQGHWCnC08nedTKhEt3QZtXJeZeCb4=";
 
-      azure-mgmt-recoveryservicesbackup = overrideAzureMgmtPackage super.azure-mgmt-recoveryservicesbackup "0.14.0" "zip"
-        "sha256-sXGUQEO6tba3m1l+0Iir/eptTt+XRXyTr8FxbDzr6I0=";
+      azure-mgmt-recoveryservicesbackup = overrideAzureMgmtPackage super.azure-mgmt-recoveryservicesbackup "0.15.0" "zip"
+        "sha256-y5akbJdqXZsRi+mecq1opR1Ye9yTxNblGp/zjiXEqFY=";
 
       azure-mgmt-resource = overrideAzureMgmtPackage super.azure-mgmt-resource "19.0.0" "zip"
         "bbb60bb9419633c2339569d4e097908638c7944e782b5aef0f5d9535085a9100";
@@ -175,14 +175,14 @@ let
       azure-mgmt-cognitiveservices = overrideAzureMgmtPackage super.azure-mgmt-cognitiveservices "12.0.0" "zip"
         "73054bd19866577e7e327518afc8f47e1639a11aea29a7466354b81804f4a676";
 
-      azure-mgmt-compute = overrideAzureMgmtPackage super.azure-mgmt-compute "22.1.0" "zip"
-        "sha256-Kq1BSEOu4PVEJ/iH91NsxRVdaFJyjUTf7vYzrFITX9w=";
+      azure-mgmt-compute = overrideAzureMgmtPackage super.azure-mgmt-compute "23.0.0" "zip"
+        "sha256-HrJrllukBJ3c8Q1PJYGHJfwDxJHDvnZTfQ10zrEUawQ=";
 
       azure-mgmt-consumption = overrideAzureMgmtPackage super.azure-mgmt-consumption "2.0.0" "zip"
         "12ai4qps73ivawh0yzvgb148ksx02r30pqlvfihx497j62gsi1cs";
 
-      azure-mgmt-containerinstance = overrideAzureMgmtPackage super.azure-mgmt-containerinstance "8.0.0" "zip"
-        "7aeb380af71fc35a71d6752fa25eb5b95fdb2a0027fa32e6f50bce87e2622916";
+      azure-mgmt-containerinstance = overrideAzureMgmtPackage super.azure-mgmt-containerinstance "9.0.0" "zip"
+        "041431c5a768ac652aac318a17f2a53b90db968494c79abbafec441d0be387ff";
 
       azure-mgmt-containerservice = overrideAzureMgmtPackage super.azure-mgmt-containerservice "16.1.0" "zip"
         "sha256-NlTIrOK4ho0OqcTHjHT1HobiMzDH2KY20TIlN0fm8/Q=";
@@ -250,8 +250,8 @@ let
       azure-mgmt-privatedns = overrideAzureMgmtPackage super.azure-mgmt-privatedns "1.0.0" "zip"
         "b60f16e43f7b291582c5f57bae1b083096d8303e9d9958e2c29227a55cc27c45";
 
-      azure-mgmt-web = overrideAzureMgmtPackage super.azure-mgmt-web "2.0.0" "zip"
-        "0040e1c9c795f7bebe43647ff30b62cb0db7175175df5cbfa1e554a6a277b81e";
+      azure-mgmt-web = overrideAzureMgmtPackage super.azure-mgmt-web "4.0.0" "zip"
+        "sha256-5XQ3qTPn3qmwYY/nkODa3GP5hXc1NhrItfXoBiucKg0=";
 
       azure-mgmt-redhatopenshift = overrideAzureMgmtPackage super.azure-mgmt-redhatopenshift "1.0.0" "zip"
         "94cd41f1ebd82e40620fd3e6d88f666b5c19ac7cf8b4e8edadb9721bd7c80980";
@@ -265,8 +265,8 @@ let
       azure-mgmt-search = overrideAzureMgmtPackage super.azure-mgmt-search "8.0.0" "zip"
         "a96d50c88507233a293e757202deead980c67808f432b8e897c4df1ca088da7e";
 
-      azure-mgmt-security = overrideAzureMgmtPackage super.azure-mgmt-security "1.0.0" "zip"
-        "ae1cff598dfe80e93406e524c55c3f2cbffced9f9b7a5577e3375008a4c3bcad";
+      azure-mgmt-security = overrideAzureMgmtPackage super.azure-mgmt-security "2.0.0b1" "zip"
+        "sha256-8Ksa08w8EeZEKXIk2AQ4zHCmfvTDwzV/k9I67CVusIQ=";
 
       azure-mgmt-signalr = overrideAzureMgmtPackage super.azure-mgmt-signalr "1.0.0b2" "zip"
         "sha256-FTxY8qoihHG4OZuKT3sRRlKfORbIoqDqug9Ko+6S9dw=";
@@ -286,8 +286,8 @@ let
       azure-mgmt-relay = overrideAzureMgmtPackage super.azure-mgmt-relay "0.1.0" "zip"
         "1jss6qhvif8l5s0lblqw3qzijjf0h88agciiydaa7f4q577qgyfr";
 
-      azure-mgmt-eventhub = overrideAzureMgmtPackage super.azure-mgmt-eventhub "4.1.0" "zip"
-        "186g70slb259ybrr69zr2ibbmqgplnpncwxzg0nxp6rd7pml7d85";
+      azure-mgmt-eventhub = overrideAzureMgmtPackage super.azure-mgmt-eventhub "9.1.0" "zip"
+        "0ba9f10e1e8d03247a316e777d6f27fabf268d596dda2af56ac079fcdf5e7afe";
 
       azure-mgmt-keyvault = overrideAzureMgmtPackage super.azure-mgmt-keyvault "9.1.0" "zip"
         "sha256-zTXoHEo8+BKt5L3PH3zPS1t4qAHvlnNAASpqyf5h3tI=";
@@ -310,8 +310,8 @@ let
       azure-mgmt-authorization = overrideAzureMgmtPackage super.azure-mgmt-authorization "0.61.0" "zip"
         "0xfvx2dvfj3fbz4ngn860ipi4v6gxqajyjc8x92r8knhmniyxk7m";
 
-      azure-mgmt-storage = overrideAzureMgmtPackage super.azure-mgmt-storage "18.0.0" "zip"
-        "d17beb34273797fa89863632ff0e1eb9b6a55198abb8c7f05d84980762e5f71f";
+      azure-mgmt-storage = overrideAzureMgmtPackage super.azure-mgmt-storage "19.0.0" "zip"
+        "f05963e5a8696d0fd4dcadda4feecb9b382a380d2e461b3647704ac787d79876";
 
       azure-mgmt-servicebus = overrideAzureMgmtPackage super.azure-mgmt-servicebus "6.0.0" "zip"
         "f6c64ed97d22d0c03c4ca5fc7594bd0f3d4147659c10110160009b93f541298e";
@@ -355,11 +355,11 @@ let
       });
 
       azure-synapse-artifacts = super.azure-synapse-artifacts.overrideAttrs(oldAttrs: rec {
-        version = "0.6.0";
+        version = "0.8.0";
         src = super.fetchPypi {
           inherit (oldAttrs) pname;
           inherit version;
-          sha256 = "ec113d37386b8787862baaf9da0318364a008004a377d20fdfca31cfe8d16210";
+          sha256 = "sha256-PU/f0L1maYT3vce8DHpgGMNaXUaoGjLdGTsHwDtSi3I=";
           extension = "zip";
         };
       });
diff --git a/pkgs/tools/admin/chamber/default.nix b/pkgs/tools/admin/chamber/default.nix
index 45c62fd42f9..ef304ff208b 100644
--- a/pkgs/tools/admin/chamber/default.nix
+++ b/pkgs/tools/admin/chamber/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "chamber";
-  version = "2.10.3";
+  version = "2.10.6";
 
   src = fetchFromGitHub {
     owner = "segmentio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-nIIoU+iz2uOglNaqGIhQ2kUjpFOyOx+flXXwu02UG6Y=";
+    sha256 = "sha256-8VnFpzm5St0AYFzups2ILQ/MrQRZLQ1xY9JjlGVBmZk=";
   };
 
   CGO_ENABLED = 0;
diff --git a/pkgs/tools/admin/clair/default.nix b/pkgs/tools/admin/clair/default.nix
index ab9ebc013b8..752644c40cb 100644
--- a/pkgs/tools/admin/clair/default.nix
+++ b/pkgs/tools/admin/clair/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "clair";
-  version = "4.3.0";
+  version = "4.3.2";
 
   src = fetchFromGitHub {
     owner = "quay";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-9IRoDvvhUMXTiMl2Jj4NFlTJD7QSXsVxjoDVTlqTsWg=";
+    sha256 = "sha256-E5hMjGsub3HWzvQYLUnSHmSfiW1uaZCyJndyasrjzw8=";
   };
 
-  vendorSha256 = "sha256-9BG10+aOysFZmGytDhz11u/2uJQq4LnceCsotJIZ62U=";
+  vendorSha256 = "sha256-J0AOgget9SpV+tKhzHINfsc7Vbxc2zVWIeFHruPc2BE=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/admin/credhub-cli/default.nix b/pkgs/tools/admin/credhub-cli/default.nix
index 9cfb23ab9da..844b65e0f6c 100644
--- a/pkgs/tools/admin/credhub-cli/default.nix
+++ b/pkgs/tools/admin/credhub-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "credhub-cli";
-  version = "2.9.0";
+  version = "2.9.1";
 
   src = fetchFromGitHub {
     owner = "cloudfoundry-incubator";
     repo = "credhub-cli";
     rev = version;
-    sha256 = "1j0i0b79ph2i52cj0qln8wvp6gwhl73akkn026h27vvmlw9sndc2";
+    sha256 = "sha256-2+KOf6VQ1jTXfFE+Ptd3iiOEhvENU0XUclQ+e85DpUo=";
   };
 
   patches = [
diff --git a/pkgs/tools/admin/eksctl/default.nix b/pkgs/tools/admin/eksctl/default.nix
index 9b318ec462f..80e091845ce 100644
--- a/pkgs/tools/admin/eksctl/default.nix
+++ b/pkgs/tools/admin/eksctl/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "eksctl";
-  version = "0.69.0";
+  version = "0.70.0";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = pname;
     rev = version;
-    sha256 = "sha256-mRY/czMf6KefYCqfCVRtcHuUuqAxyPUd8TJmx7vzOsk=";
+    sha256 = "sha256-wBDG6um7HCFAEyiubnkCxg91sQ6HX0CTpYItwVkMx28=";
   };
 
   vendorSha256 = "sha256-cUo+tcHhnbJbn3HS/I8lnkvfv+6+htIs1dMtKuEArQg=";
diff --git a/pkgs/tools/admin/exoscale-cli/default.nix b/pkgs/tools/admin/exoscale-cli/default.nix
index 4bf2049d97a..6c0a3e3bbd3 100644
--- a/pkgs/tools/admin/exoscale-cli/default.nix
+++ b/pkgs/tools/admin/exoscale-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoPackage rec {
   pname = "exoscale-cli";
-  version = "1.44.0";
+  version = "1.45.2";
 
   src = fetchFromGitHub {
     owner  = "exoscale";
     repo   = "cli";
     rev    = "v${version}";
-    sha256 = "sha256-1ntKm6OA20+/gMVufbmM6fZ2UIXG/0SzH9vZQUvsIUQ=";
+    sha256 = "sha256-bzm8UNFWAXHBdarovNMyARW2xA4tSXIgIHpxROx4nOI=";
   };
 
   goPackagePath = "github.com/exoscale/cli";
diff --git a/pkgs/tools/admin/fits-cloudctl/default.nix b/pkgs/tools/admin/fits-cloudctl/default.nix
index c96c6c0ad09..92a77b461b2 100644
--- a/pkgs/tools/admin/fits-cloudctl/default.nix
+++ b/pkgs/tools/admin/fits-cloudctl/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "fits-cloudctl";
-  version = "0.10.0";
+  version = "0.10.3";
 
   src = fetchFromGitHub {
     owner = "fi-ts";
     repo = "cloudctl";
     rev = "v${version}";
-    sha256 = "09v5fgqf4c2d6k2z638g29mcsmdisg3zfq1g7330wsd7yaxv9m23";
+    sha256 = "sha256-FbKULHBzx4HcOFhIRdy7DiewOQzBdac3B+N34M/Kbzk=";
   };
 
-  vendorSha256 = "1rdqih04mlp33m69y9zxm4llx8cafwqhjhfxw873s8b35j0xz2m5";
+  vendorSha256 = "sha256-ImKN3rNotgUkQaKzoetAEG6Q/zlfH8FTK4HTIO0xn4s=";
 
   meta = with lib; {
     description = "Command-line client for FI-TS Finance Cloud Native services";
diff --git a/pkgs/tools/admin/google-cloud-sdk/default.nix b/pkgs/tools/admin/google-cloud-sdk/default.nix
index 1820781cd65..8ab301eeb38 100644
--- a/pkgs/tools/admin/google-cloud-sdk/default.nix
+++ b/pkgs/tools/admin/google-cloud-sdk/default.nix
@@ -7,7 +7,7 @@
 #   3) used by `google-cloud-sdk` only on GCE guests
 #
 
-{ stdenv, lib, fetchurl, makeWrapper, python, openssl, jq, with-gce ? false }:
+{ stdenv, lib, fetchurl, makeWrapper, nixosTests, python, openssl, jq, with-gce ? false }:
 
 let
   pythonEnv = python.withPackages (p: with p; [
@@ -21,33 +21,33 @@ let
   sources = name: system: {
     x86_64-darwin = {
       url = "${baseUrl}/${name}-darwin-x86_64.tar.gz";
-      sha256 = "1gwi15rkgxmqcr1vi5bd123833zhln725bhs5k1ip6fvhdrx31mf";
+      sha256 = "19s3nryngzv7zs7piwx92hii5p2y97fs7wngqrd9v8cxvgavp1dc";
     };
 
     aarch64-darwin = {
       url = "${baseUrl}/${name}-darwin-arm.tar.gz";
-      sha256 = "0pw2cwdx18cw77lqsq1bsd8d79mjxn7lwd27hm9j8d45r0fzj0ci";
+      sha256 = "1iphpkxrrp0gdan7ikbjbhykdpazcs1fnlcwkfyv2m9baggkd53z";
     };
 
     x86_64-linux = {
       url = "${baseUrl}/${name}-linux-x86_64.tar.gz";
-      sha256 = "01v3v4408p1wwqlqqawbc9g8j6lipwnm1sr6wckq9q0a5zpsissg";
+      sha256 = "1z1ymvij9vi8jc05b004jhd08dqbk133wd03fdxnagd6nfr0bjqm";
     };
 
     i686-linux = {
       url = "${baseUrl}/${name}-linux-x86.tar.gz";
-      sha256 = "125akqbbz1ahq0hhgbjrv1cfnv41h1pksnclz6mbdn3z2297r6dp";
+      sha256 = "17i5pkwjmi38klgr12xqgza7iwkx459cbavlq0x33zaq2a4zanlc";
     };
 
     aarch64-linux = {
       url = "${baseUrl}/${name}-linux-arm.tar.gz";
-      sha256 = "13p0vjs330zljkyfb412n6l33m5sn6kakg1wch9nhgikrqig5avl";
+      sha256 = "17zjnab4ai5w6p3cbxys9zsg4bdlp0lh6pvmkvdz9hszxxch4yms";
     };
   }.${system} or (throw "Unsupported system: ${system}");
 
 in stdenv.mkDerivation rec {
   pname = "google-cloud-sdk";
-  version = "361.0.0";
+  version = "362.0.0";
 
   src = fetchurl (sources "${pname}-${version}" stdenv.hostPlatform.system);
 
@@ -117,6 +117,11 @@ in stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
+  doInstallCheck = true;
+  installCheckPhase = ''
+    $out/bin/gcloud version --format json | jq '."Google Cloud SDK"' | grep "${version}"
+  '';
+
   meta = with lib; {
     description = "Tools for the google cloud platform";
     longDescription = "The Google Cloud SDK. This package has the programs: gcloud, gsutil, and bq";
diff --git a/pkgs/tools/admin/iamy/default.nix b/pkgs/tools/admin/iamy/default.nix
index 6ee5f3f880b..467f0ffbce0 100644
--- a/pkgs/tools/admin/iamy/default.nix
+++ b/pkgs/tools/admin/iamy/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "iamy";
-  version = "2.3.2";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "99designs";
     repo = "iamy";
     rev = "v${version}";
-    sha256 = "1fypc6yjnhlpk7zhb2lvah2ikh2zji9sll55rqjbr3i4j02h484z";
+    sha256 = "sha256-oH3ijZaWXI0TdVQN9gzp5ypWzY7OqSxDh7VBoZo42Cs=";
   };
 
-  vendorSha256 = "0c4g1zr0wl118g41hqri0vwvfin39yvgs214w3spw8ggjcj6bzph";
+  vendorSha256 = "sha256-/IUYM3pTvcHXw8t5MW6JUEWdxegFuQC8zkiySp8VEgE=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/admin/lxd/default.nix b/pkgs/tools/admin/lxd/default.nix
index 12ea0f7a55d..fc07d33f647 100644
--- a/pkgs/tools/admin/lxd/default.nix
+++ b/pkgs/tools/admin/lxd/default.nix
@@ -1,22 +1,14 @@
-{ lib, hwdata, pkg-config, lxc, buildGoPackage, fetchurl
+{ lib, hwdata, pkg-config, lxc, buildGoPackage, fetchurl, fetchpatch
 , makeWrapper, acl, rsync, gnutar, xz, btrfs-progs, gzip, dnsmasq, attr
-, squashfsTools, iproute2, iptables, ebtables, iptables-nftables-compat, libcap
+, squashfsTools, iproute2, iptables, libcap
 , dqlite, raft-canonical, sqlite-replication, udev
 , writeShellScriptBin, apparmor-profiles, apparmor-parser
 , criu
 , bash
 , installShellFiles
-, nftablesSupport ? false
 , nixosTests
 }:
 
-let
-  networkPkgs = if nftablesSupport then
-    [ iptables-nftables-compat ]
-  else
-    [ iptables ebtables ];
-
-in
 buildGoPackage rec {
   pname = "lxd";
   version = "4.19";
@@ -28,6 +20,14 @@ buildGoPackage rec {
     sha256 = "0mxbzg8xra0qpd3g3z1b230f0519h56x4jnn09lbbqa92p5zck3f";
   };
 
+  patches = [
+    # lxd/checkfeature: check whether the kernel supports core scheduling
+    (fetchpatch {
+      url = "https://github.com/lxc/lxd/commit/ba6be1043714458b29c4b37687d4f624ee421943.patch";
+      sha256 = "0716129n70c6i695fyi1j8q6cls7g62vkdpcrlfrr9i324y3w1dx";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace shared/usbid/load.go \
       --replace "/usr/share/misc/usb.ids" "${hwdata}/share/hwdata/usb.ids"
@@ -45,7 +45,7 @@ buildGoPackage rec {
     rm $out/bin/{deps,macaroon-identity,generate}
 
     wrapProgram $out/bin/lxd --prefix PATH : ${lib.makeBinPath (
-      networkPkgs
+      [ iptables ]
       ++ [ acl rsync gnutar xz btrfs-progs gzip dnsmasq squashfsTools iproute2 bash criu attr ]
       ++ [ (writeShellScriptBin "apparmor_parser" ''
              exec '${apparmor-parser}/bin/apparmor_parser' -I '${apparmor-profiles}/etc/apparmor.d' "$@"
diff --git a/pkgs/tools/audio/acousticbrainz-client/default.nix b/pkgs/tools/audio/acousticbrainz-client/default.nix
index a08710fe121..65160567968 100644
--- a/pkgs/tools/audio/acousticbrainz-client/default.nix
+++ b/pkgs/tools/audio/acousticbrainz-client/default.nix
@@ -36,6 +36,6 @@ python3Packages.buildPythonApplication rec {
     homepage = "https://github.com/MTG/acousticbrainz-client";
     # essentia-extractor is only available for those platforms
     platforms = [ "x86_64-linux" "i686-linux" ];
-    maintainers = with maintainers; [ eduardosm ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/tools/audio/isrcsubmit/default.nix b/pkgs/tools/audio/isrcsubmit/default.nix
index 457ca2b0d1c..530094b8506 100644
--- a/pkgs/tools/audio/isrcsubmit/default.nix
+++ b/pkgs/tools/audio/isrcsubmit/default.nix
@@ -19,6 +19,6 @@ python3Packages.buildPythonApplication rec {
     description = "Script to submit ISRCs from disc to MusicBrainz";
     license = licenses.gpl3Plus;
     homepage = "http://jonnyjd.github.io/musicbrainz-isrcsubmit/";
-    maintainers = with maintainers; [ eduardosm ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/tools/audio/opl3bankeditor/common.nix b/pkgs/tools/audio/opl3bankeditor/common.nix
index 9f6972ce954..04f4d3aae5a 100644
--- a/pkgs/tools/audio/opl3bankeditor/common.nix
+++ b/pkgs/tools/audio/opl3bankeditor/common.nix
@@ -53,7 +53,6 @@ mkDerivation rec {
     mv "${binname}.app" $out/Applications/
 
     install_name_tool -change {,${qwt}/lib/}libqwt.6.dylib "$out/Applications/${binname}.app/Contents/MacOS/${binname}"
-    wrapQtApp "$out/Applications/${binname}.app/Contents/MacOS/${binname}"
 
     ln -s "$out/Applications/${binname}.app/Contents/MacOS/${binname}" $out/bin/${mainProgram}
   '';
diff --git a/pkgs/tools/audio/tts/default.nix b/pkgs/tools/audio/tts/default.nix
index d15a03bc83e..1a07d2f0c33 100644
--- a/pkgs/tools/audio/tts/default.nix
+++ b/pkgs/tools/audio/tts/default.nix
@@ -16,13 +16,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "tts";
-  version = "0.3.1";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "coqui-ai";
     repo = "TTS";
     rev = "v${version}";
-    sha256 = "sha256-/CeetLm3jgS5Q69zTVkLm+Wh4nD7D4c6j9MTujMc3fU=";
+    sha256 = "sha256-ZcQUgr+1XTmXoyf2WNsP8Hept42JTFmKXdo0kcU6QWU=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/backup/bupstash/default.nix b/pkgs/tools/backup/bupstash/default.nix
index ccf9115c1e7..91876f68d4a 100644
--- a/pkgs/tools/backup/bupstash/default.nix
+++ b/pkgs/tools/backup/bupstash/default.nix
@@ -1,16 +1,16 @@
 { lib, fetchFromGitHub, installShellFiles, rustPlatform, ronn, pkg-config, libsodium }:
 rustPlatform.buildRustPackage rec {
   pname = "bupstash";
-  version = "0.10.2";
+  version = "0.10.3";
 
   src = fetchFromGitHub {
     owner = "andrewchambers";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-0PKQYvKmAGP4/15nKhB+aZh8PF9dtDFjXEuPCA5tDYk=";
+    sha256 = "sha256-YN5pIXJRTQXqFGuXvyoSlYJEjAZ4wIYEKjEeF8qIJCI=";
   };
 
-  cargoSha256 = "sha256-6zVWKVtTL6zbB4Uulq+sK4vm3qAC0B5kf0DmDv5aneo=";
+  cargoSha256 = "sha256-Erpg+Sktx+L2X9k6g1ngOyM8MNoucGcScOSPMB7vld8=";
 
   nativeBuildInputs = [ ronn pkg-config installShellFiles ];
   buildInputs = [ libsodium ];
diff --git a/pkgs/tools/backup/duplicity/default.nix b/pkgs/tools/backup/duplicity/default.nix
index cbbd86e0167..232108d8e9f 100644
--- a/pkgs/tools/backup/duplicity/default.nix
+++ b/pkgs/tools/backup/duplicity/default.nix
@@ -138,7 +138,7 @@ pythonPackages.buildPythonApplication rec {
 
   meta = with lib; {
     description = "Encrypted bandwidth-efficient backup using the rsync algorithm";
-    homepage = "https://www.nongnu.org/duplicity";
+    homepage = "https://duplicity.gitlab.io/duplicity-web/";
     license = licenses.gpl2Plus;
     platforms = platforms.unix;
   };
diff --git a/pkgs/tools/compression/gzip/default.nix b/pkgs/tools/compression/gzip/default.nix
index 6bcd5ae0c42..8bec5b481c9 100644
--- a/pkgs/tools/compression/gzip/default.nix
+++ b/pkgs/tools/compression/gzip/default.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gzip";
-  version = "1.10";
+  version = "1.11";
 
   src = fetchurl {
     url = "mirror://gnu/gzip/${pname}-${version}.tar.xz";
-    sha256 = "1h6p374d3j8d4cdfydzls021xa2yby8myc0h8d6m8bc7k6ncq9c4";
+    sha256 = "01vrly90rvc98af6rcmrb3gwv1l6pylasvsdka23dffwizb9b6lv";
   };
 
   outputs = [ "out" "man" "info" ];
diff --git a/pkgs/tools/filesystems/android-file-transfer/default.nix b/pkgs/tools/filesystems/android-file-transfer/default.nix
index a8511f8b99a..b355b0eb686 100644
--- a/pkgs/tools/filesystems/android-file-transfer/default.nix
+++ b/pkgs/tools/filesystems/android-file-transfer/default.nix
@@ -29,9 +29,6 @@ mkDerivation rec {
   postInstall = lib.optionalString stdenv.isDarwin ''
     mkdir $out/Applications
     mv $out/*.app $out/Applications
-    for f in $out/Applications/android-file-transfer.app/Contents/MacOS/*; do
-      wrapQtApp "$f"
-    done
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/filesystems/gcsfuse/default.nix b/pkgs/tools/filesystems/gcsfuse/default.nix
index 4f739769807..345b87a911d 100644
--- a/pkgs/tools/filesystems/gcsfuse/default.nix
+++ b/pkgs/tools/filesystems/gcsfuse/default.nix
@@ -2,13 +2,13 @@
 
 buildGoPackage rec {
   pname = "gcsfuse";
-  version = "0.36.0";
+  version = "0.37.0";
 
   src = fetchFromGitHub {
     owner = "googlecloudplatform";
     repo = "gcsfuse";
     rev = "v${version}";
-    sha256 = "sha256-qsvHqSvMG7VwRtNmyun2oO+ZRZ1D1spefTeUXrWGSNk=";
+    sha256 = "sha256-X7EZKHdSWQ9HKaXtoeDGNnzsBmffqHvZ6rfQXpjYTB8=";
   };
 
   goPackagePath = "github.com/googlecloudplatform/gcsfuse";
diff --git a/pkgs/tools/filesystems/gocryptfs/default.nix b/pkgs/tools/filesystems/gocryptfs/default.nix
index 2211d0e3103..a0c598c1f2b 100644
--- a/pkgs/tools/filesystems/gocryptfs/default.nix
+++ b/pkgs/tools/filesystems/gocryptfs/default.nix
@@ -12,16 +12,16 @@
 
 buildGoModule rec {
   pname = "gocryptfs";
-  version = "2.1";
+  version = "2.2.1";
 
   src = fetchFromGitHub {
     owner = "rfjakob";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-nACBEOL/vnqxdAGI37k9bxgQKgpi35/tsuCxsQ9I2sw=";
+    sha256 = "sha256-qERtX9UcdMolbffzPiVQlblirzJ5baOmHonJIO8ang0=";
   };
 
-  vendorSha256 = "sha256-Q/oBT5xdLpgQCIk7KES6c8+BaCQVUIwCwVufl4oTFRs=";
+  vendorSha256 = "sha256-yJ7RYwhArgmGlFmSplrX1hiLkc7FkS1qQCUcRlbnNWQ=";
 
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/tools/filesystems/s3backer/default.nix b/pkgs/tools/filesystems/s3backer/default.nix
index 35d0b7af073..d0a1e091636 100644
--- a/pkgs/tools/filesystems/s3backer/default.nix
+++ b/pkgs/tools/filesystems/s3backer/default.nix
@@ -4,10 +4,10 @@
 
 stdenv.mkDerivation rec {
   pname = "s3backer";
-  version = "1.6.2";
+  version = "1.6.3";
 
   src = fetchFromGitHub {
-    sha256 = "sha256-b64EEES7gO9s24hk3sZMd9guEhJNfc3DV4/NnBIcJYw=";
+    sha256 = "sha256-DOf+kpflDd2U1nXDLKYts/yf121CrBFIBI47OQa5XBs=";
     rev = version;
     repo = "s3backer";
     owner = "archiecobbs";
diff --git a/pkgs/tools/filesystems/snapraid/default.nix b/pkgs/tools/filesystems/snapraid/default.nix
index d854558b792..9365497f5fb 100644
--- a/pkgs/tools/filesystems/snapraid/default.nix
+++ b/pkgs/tools/filesystems/snapraid/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "snapraid";
-  version = "11.5";
+  version = "11.6";
 
   src = fetchFromGitHub {
     owner = "amadvance";
     repo = "snapraid";
     rev = "v${version}";
-    sha256 = "0dlhdsmq5l208zldfr9z9g0p67wry81dr0r23lpybb5c9fm2f2rm";
+    sha256 = "sha256-nO0Ujo9je59C+zP7l9Pp7JEdsSfVAv+9EnAq4OtJ78o=";
   };
 
   VERSION = version;
diff --git a/pkgs/tools/games/opentracker/default.nix b/pkgs/tools/games/opentracker/default.nix
index a191a90b17b..d774fcb8f1f 100644
--- a/pkgs/tools/games/opentracker/default.nix
+++ b/pkgs/tools/games/opentracker/default.nix
@@ -25,10 +25,14 @@ buildDotnetModule rec {
   };
 
   dotnet-runtime = dotnetCorePackages.runtime_3_1;
-  projectFile = "OpenTracker.sln";
   nugetDeps = ./deps.nix;
+
+  projectFile = "OpenTracker.sln";
   executables = [ "OpenTracker" ];
 
+  doCheck = true;
+  dotnet-test-sdk = dotnetCorePackages.sdk_3_1;
+
   nativeBuildInputs = [
     autoPatchelfHook
     wrapGAppsHook
diff --git a/pkgs/tools/graphics/argyllcms/default.nix b/pkgs/tools/graphics/argyllcms/default.nix
index ceca22eca35..294a403d7ea 100644
--- a/pkgs/tools/graphics/argyllcms/default.nix
+++ b/pkgs/tools/graphics/argyllcms/default.nix
@@ -13,83 +13,88 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-umY3wQfG26Okqnw+MCUnlwWTAyJ6MR/FHe5oe61KBh0=";
   };
 
-  # The contents of this file comes from the Jamtop file from the
-  # root of the ArgyllCMS distribution, rewritten to pick up Nixpkgs
-  # library paths. When ArgyllCMS is updated, make sure that changes
-  # in that file is reflected here.
-  jamTop = writeText "argyllcms_jamtop" ''
-    DESTDIR = "/" ;
-    REFSUBDIR = "share/argyllcms" ;
+  nativeBuildInputs = [ jam unzip ];
 
-    # Keep this DESTDIR anchored to Jamtop. PREFIX is used literally
-    ANCHORED_PATH_VARS = DESTDIR ;
+  postPatch = lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
+    substituteInPlace Jambase \
+      --replace "-m64" ""
+  '';
 
-    # Tell standalone libraries that they are part of Argyll:
-    DEFINES += ARGYLLCMS ;
+  preConfigure = let
+    # The contents of this file comes from the Jamtop file from the
+    # root of the ArgyllCMS distribution, rewritten to pick up Nixpkgs
+    # library paths. When ArgyllCMS is updated, make sure that changes
+    # in that file is reflected here.
+    jamTop = writeText "argyllcms_jamtop" ''
+      DESTDIR = "/" ;
+      REFSUBDIR = "share/argyllcms" ;
 
-    # enable serial instruments & support
-    USE_SERIAL = true ;
+      # Keep this DESTDIR anchored to Jamtop. PREFIX is used literally
+      ANCHORED_PATH_VARS = DESTDIR ;
 
-    # enable fast serial instruments & support
-    USE_FAST_SERIAL = true ;                # (Implicit in USE_SERIAL too)
+      # Tell standalone libraries that they are part of Argyll:
+      DEFINES += ARGYLLCMS ;
 
-    # enable USB instruments & support
-    USE_USB = true ;
+      # enable serial instruments & support
+      USE_SERIAL = true ;
 
-    # enable dummy Demo Instrument (only if code is available)
-    USE_DEMOINST = true ;
+      # enable fast serial instruments & support
+      USE_FAST_SERIAL = true ;                # (Implicit in USE_SERIAL too)
 
-    # enable Video Test Patch Generator and 3DLUT device support
-    # (V2.0.0 and above)
-    USE_VTPGLUT = false ;
+      # enable USB instruments & support
+      USE_USB = true ;
 
-    # enable Printer device support
-    USE_PRINTER = false ;
+      # enable dummy Demo Instrument (only if code is available)
+      USE_DEMOINST = true ;
 
-    # enable CMF Measurement device and accessory support (if present)
-    USE_CMFM = false ;
+      # enable Video Test Patch Generator and 3DLUT device support
+      # (V2.0.0 and above)
+      USE_VTPGLUT = false ;
 
-    # Use ArgyllCMS version of libusb (deprecated - don't use)
-    USE_LIBUSB = false ;
+      # enable Printer device support
+      USE_PRINTER = false ;
 
-    # Compile in graph plotting code (Not fully implemented)
-    USE_PLOT = true ;		# [true]
+      # enable CMF Measurement device and accessory support (if present)
+      USE_CMFM = false ;
 
-    JPEGLIB = ;
-    JPEGINC = ;
-    HAVE_JPEG = true ;
+      # Use ArgyllCMS version of libusb (deprecated - don't use)
+      USE_LIBUSB = false ;
 
-    TIFFLIB = ;
-    TIFFINC = ;
-    HAVE_TIFF = true ;
+      # Compile in graph plotting code (Not fully implemented)
+      USE_PLOT = true ;		# [true]
 
-    PNGLIB = ;
-    PNGINC = ;
-    HAVE_PNG = true ;
+      JPEGLIB = ;
+      JPEGINC = ;
+      HAVE_JPEG = true ;
 
-    ZLIB = ;
-    ZINC = ;
-    HAVE_Z = true ;
+      TIFFLIB = ;
+      TIFFINC = ;
+      HAVE_TIFF = true ;
 
-    SSLLIB = ;
-    SSLINC = ;
-    HAVE_SSL = true ;
+      PNGLIB = ;
+      PNGINC = ;
+      HAVE_PNG = true ;
 
-    LINKFLAGS +=
-      ${lib.concatStringsSep " " (map (x: "-L${x}/lib") buildInputs)}
-      -ldl -lrt -lX11 -lXext -lXxf86vm -lXinerama -lXrandr -lXau -lXdmcp -lXss
-      -ljpeg -ltiff -lpng -lssl ;
-  '';
+      ZLIB = ;
+      ZINC = ;
+      HAVE_Z = true ;
 
-  nativeBuildInputs = [ jam unzip ];
+      SSLLIB = ;
+      SSLINC = ;
+      HAVE_SSL = true ;
 
-  preConfigure = ''
+      LINKFLAGS +=
+        ${lib.concatStringsSep " " (map (x: "-L${x}/lib") buildInputs)}
+        -ldl -lrt -lX11 -lXext -lXxf86vm -lXinerama -lXrandr -lXau -lXdmcp -lXss
+        -ljpeg -ltiff -lpng -lssl ;
+    '';
+  in ''
     cp ${jamTop} Jamtop
     substituteInPlace Makefile --replace "-j 3" "-j $NIX_BUILD_CORES"
     # Remove tiff, jpg and png to be sure the nixpkgs-provided ones are used
     rm -rf tiff jpg png
 
-    unset AR
+    export AR="$AR rusc"
   '';
 
   buildInputs = [
@@ -110,6 +115,9 @@ stdenv.mkDerivation rec {
     mkdir -p $out/etc/udev/rules.d
     sed -i '/udev-acl/d' usb/55-Argyll.rules
     cp -v usb/55-Argyll.rules $out/etc/udev/rules.d/
+
+    sed -i -e 's/^CREATED .*/CREATED "'"$(date -d @$SOURCE_DATE_EPOCH)"'"/g' $out/share/argyllcms/RefMediumGamut.gam
+
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/graphics/gnuplot/default.nix b/pkgs/tools/graphics/gnuplot/default.nix
index 741468dfd99..c6c90442ddc 100644
--- a/pkgs/tools/graphics/gnuplot/default.nix
+++ b/pkgs/tools/graphics/gnuplot/default.nix
@@ -58,8 +58,6 @@ in
        --prefix PATH : '${coreutils}/bin' \
        --prefix PATH : '${fontconfig.bin}/bin' \
        --run '. ${./set-gdfontpath-from-fontconfig.sh}'
-  '' + lib.optionalString (stdenv.isDarwin && withQt) ''
-     wrapQtApp $out/bin/gnuplot
   '';
 
   enableParallelBuilding = true;
diff --git a/pkgs/tools/graphics/goverlay/default.nix b/pkgs/tools/graphics/goverlay/default.nix
index 2296743694e..daddc4947df 100644
--- a/pkgs/tools/graphics/goverlay/default.nix
+++ b/pkgs/tools/graphics/goverlay/default.nix
@@ -5,14 +5,15 @@
 , fetchFromGitHub
 , fpc
 , lazarus-qt
-, qt5
-, libX11
+, wrapQtAppsHook
+, libGL
+, libGLU
 , libqt5pas
+, libX11
 , coreutils
 , git
 , gnugrep
 , libnotify
-, mesa-demos
 , polkit
 , procps
 , systemd
@@ -34,13 +35,13 @@ let
   '';
 in stdenv.mkDerivation rec {
   pname = "goverlay";
-  version = "0.6";
+  version = "0.6.3";
 
   src = fetchFromGitHub {
     owner = "benjamimgois";
     repo = pname;
     rev = version;
-    hash = "sha256-E4SMUL9rpDSSdprX4fPyGCHCowdQavjhGIhV3r4jeiw=";
+    hash = "sha256-ZksQse0xWAtH+U6EjcGWT2BOG5dfSnm6XvZLLE5ynHs=";
   };
 
   outputs = [ "out" "man" ];
@@ -61,15 +62,17 @@ in stdenv.mkDerivation rec {
   nativeBuildInputs = [
     fpc
     lazarus-qt
-    qt5.wrapQtAppsHook
+    wrapQtAppsHook
   ];
 
   buildInputs = [
-    libX11
+    libGL
+    libGLU
     libqt5pas
+    libX11
   ];
 
-  NIX_LDFLAGS = "--as-needed -rpath ${lib.makeLibraryPath buildInputs}";
+  NIX_LDFLAGS = "-lGLU -rpath ${lib.makeLibraryPath buildInputs}";
 
   buildPhase = ''
     runHook preBuild
@@ -85,7 +88,6 @@ in stdenv.mkDerivation rec {
       git
       gnugrep
       libnotify
-      mesa-demos
       polkit
       procps
       systemd
diff --git a/pkgs/tools/graphics/goverlay/find-xdg-data-files.patch b/pkgs/tools/graphics/goverlay/find-xdg-data-files.patch
index 51d4dcdc54e..e29507980ad 100644
--- a/pkgs/tools/graphics/goverlay/find-xdg-data-files.patch
+++ b/pkgs/tools/graphics/goverlay/find-xdg-data-files.patch
@@ -1,8 +1,8 @@
 diff --git a/overlayunit.pas b/overlayunit.pas
-index de8725f..005f171 100644
+index a56cea7..9a4f547 100644
 --- a/overlayunit.pas
 +++ b/overlayunit.pas
-@@ -5377,7 +5377,7 @@ begin
+@@ -4880,7 +4880,7 @@ begin
     //Determine Mangohud dependency status
  
            //locate MangoHud and store result in tmp folder
@@ -11,7 +11,7 @@ index de8725f..005f171 100644
  
            // Assign Text file dependency_mangohud to variable mangohudVAR
            AssignFile(mangohudVAR, '/tmp/goverlay/dependency_mangohud');
-@@ -5386,7 +5386,7 @@ begin
+@@ -4889,7 +4889,7 @@ begin
            CloseFile(mangohudVAR);
  
            // Read String and store value on mangohuddependencyVALUE based on result
@@ -20,7 +20,7 @@ index de8725f..005f171 100644
            mangohuddependencyVALUE := 1
            else
            mangohuddependencyVALUE := 0;
-@@ -5395,7 +5395,7 @@ begin
+@@ -4898,7 +4898,7 @@ begin
     //Determine vkBasalt dependency staus
  
             //locate vkBasalt and store result in tmp folder
@@ -29,7 +29,7 @@ index de8725f..005f171 100644
  
             // Assign Text file dependency_mangohud to variable mangohudVAR
             AssignFile(vkbasaltVAR, '/tmp/goverlay/dependency_vkbasalt');
-@@ -5404,7 +5404,7 @@ begin
+@@ -4907,7 +4907,7 @@ begin
             CloseFile(vkbasaltVAR);
  
             // Read String and store value on vkbasaltdependencyVALUE based on result
diff --git a/pkgs/tools/graphics/netpbm/default.nix b/pkgs/tools/graphics/netpbm/default.nix
index dea9aa6d97e..fc7d909ca0d 100644
--- a/pkgs/tools/graphics/netpbm/default.nix
+++ b/pkgs/tools/graphics/netpbm/default.nix
@@ -20,14 +20,14 @@ stdenv.mkDerivation {
   # Determine version and revision from:
   # https://sourceforge.net/p/netpbm/code/HEAD/log/?path=/advanced
   pname = "netpbm";
-  version = "10.92.0";
+  version = "10.96.2";
 
   outputs = [ "bin" "out" "dev" ];
 
   src = fetchsvn {
     url = "https://svn.code.sf.net/p/netpbm/code/advanced";
-    rev = "3972";
-    sha256 = "09fpy4n4f867j23pr3b719wpvp8hjrr4drxp0r1csw74p8j6vfy3";
+    rev = "4158";
+    sha256 = "NK8GXCvCEnbQJWvVngB5UMOVmfsiyU4Fq0JIY9UNSjo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/graphics/shotgun/default.nix b/pkgs/tools/graphics/shotgun/default.nix
index d875b4d313d..c7692988677 100644
--- a/pkgs/tools/graphics/shotgun/default.nix
+++ b/pkgs/tools/graphics/shotgun/default.nix
@@ -2,7 +2,7 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "shotgun";
-  version = "2.2.0";
+  version = "2.2.1";
 
   nativeBuildInputs = [ pkg-config ];
 
@@ -12,10 +12,10 @@ rustPlatform.buildRustPackage rec {
     owner = "neXromancers";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0fpc09yvxjcvjkai7afyig4gyc7inaqxxrwzs17mh8wdgzawb6dl";
+    sha256 = "sha256-ClQP/iNs9b4foDUVpH37YCZyjVSgweHLKnSwnpkRwZI=";
   };
 
-  cargoSha256 = "06zplpy480965lhgav984m6wkfijv7cqa49kpramp8b6ws62pikl";
+  cargoSha256 = "sha256-w5s9I7lXO8HN9zHqZQCeqBXSd7jmbsaqMZRwPLnbqNk=";
 
   meta = with lib; {
     description = "Minimal X screenshot utility";
diff --git a/pkgs/tools/inputmethods/touchegg/default.nix b/pkgs/tools/inputmethods/touchegg/default.nix
index 69d05ceaed1..a50770c7355 100644
--- a/pkgs/tools/inputmethods/touchegg/default.nix
+++ b/pkgs/tools/inputmethods/touchegg/default.nix
@@ -16,12 +16,12 @@
 
 stdenv.mkDerivation rec {
   pname = "touchegg";
-  version = "2.0.11";
+  version = "2.0.12";
   src = fetchFromGitHub {
     owner = "JoseExposito";
     repo = pname;
     rev = version;
-    sha256 = "1zfiqs5vqlb6drnqx9nsmhgy8qc6svzr8zyjkqvwkpbgrc6ifap9";
+    sha256 = "sha256-oJzehs7oLFTDn7GSm6bY/77tEfyEdlANn69EdCApdPA=";
   };
 
   PKG_CONFIG_SYSTEMD_SYSTEMDSYSTEMUNITDIR = "${placeholder "out"}/lib/systemd/system";
diff --git a/pkgs/tools/misc/bat/default.nix b/pkgs/tools/misc/bat/default.nix
index de0f13c77fd..a46a32d6a88 100644
--- a/pkgs/tools/misc/bat/default.nix
+++ b/pkgs/tools/misc/bat/default.nix
@@ -1,6 +1,5 @@
 { lib
 , stdenv
-, nixosTests
 , rustPlatform
 , fetchFromGitHub
 , pkg-config
@@ -41,7 +40,18 @@ rustPlatform.buildRustPackage rec {
 
   checkFlags = [ "--skip=pager_more" "--skip=pager_most" ];
 
-  passthru.tests = { inherit (nixosTests) bat; };
+  doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    testFile=$(mktemp /tmp/bat-test.XXXX)
+    echo -ne 'Foobar\n\n\n42' > $testFile
+    $out/bin/bat -p $testFile | grep "Foobar"
+    $out/bin/bat -p $testFile -r 4:4 | grep 42
+    rm $testFile
+
+    runHook postInstallCheck
+  '';
 
   meta = with lib; {
     description = "A cat(1) clone with syntax highlighting and Git integration";
diff --git a/pkgs/tools/misc/bitwise/default.nix b/pkgs/tools/misc/bitwise/default.nix
index a7ae6243f45..fc6f58ca2f4 100644
--- a/pkgs/tools/misc/bitwise/default.nix
+++ b/pkgs/tools/misc/bitwise/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "bitwise";
-  version = "0.42";
+  version = "0.43";
 
   src = fetchFromGitHub {
     owner = "mellowcandle";
     repo = "bitwise";
     rev = "v${version}";
-    sha256 = "154y0sn3z64z56k84ghsazkyihbkaz40hfwxcxdymnhvhh6m9f3g";
+    sha256 = "18sz7bfpq83s2zhw7c35snz6k3b6rzad2mmfq2qwmyqwypbp1g7l";
   };
 
   buildInputs = [ ncurses readline ];
diff --git a/pkgs/tools/misc/broot/default.nix b/pkgs/tools/misc/broot/default.nix
index 9193e18d116..96788f8c731 100644
--- a/pkgs/tools/misc/broot/default.nix
+++ b/pkgs/tools/misc/broot/default.nix
@@ -14,14 +14,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "broot";
-  version = "1.6.2";
+  version = "1.6.6";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-SjfTMBGby2jzmeNEtBVYqumLExhXW8nqxpbaeeaRM3w=";
+    sha256 = "sha256-Aezi005CKhGwCRZ2HwxFRRORBvVoZEzljTcKQZ8b8XI=";
   };
 
-  cargoHash = "sha256-BdSqTzXu7Glhr0fQGmnkg5BXYgdQS6jgfH3A9hPpECY=";
+  cargoHash = "sha256-d06lvS5ajXPY/AwmE2rkya82mAOeEv04EtBElDvX2+I=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/tools/misc/chezmoi/default.nix b/pkgs/tools/misc/chezmoi/default.nix
index 415fed33170..ba8fb350769 100644
--- a/pkgs/tools/misc/chezmoi/default.nix
+++ b/pkgs/tools/misc/chezmoi/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "chezmoi";
-  version = "2.6.1";
+  version = "2.7.3";
 
   src = fetchFromGitHub {
     owner = "twpayne";
     repo = "chezmoi";
     rev = "v${version}";
-    sha256 = "sha256-x5KqDVy+thIymZHsmyO+WsGq0IBb2cZxogKsjzunC2o=";
+    sha256 = "sha256-xn9DSbAqfSK7CokxVRrHuOO62oSXKGR0/HZYadLLd74=";
   };
 
-  vendorSha256 = "sha256-8NhJfA9q6di/IPL53U/dwGNAAdtuBX5Lf6fhTk4Mz0Q=";
+  vendorSha256 = "sha256-e+LsFlF83OGbhajaGGyWARv7O6dI6ZKm3yhDqrgmMpk=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/misc/cloud-sql-proxy/default.nix b/pkgs/tools/misc/cloud-sql-proxy/default.nix
index f1f7d1bf239..512381d67f2 100644
--- a/pkgs/tools/misc/cloud-sql-proxy/default.nix
+++ b/pkgs/tools/misc/cloud-sql-proxy/default.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "cloud-sql-proxy";
-  version = "1.25.0";
+  version = "1.26.0";
 
   src = fetchFromGitHub {
     owner = "GoogleCloudPlatform";
     repo = "cloudsql-proxy";
     rev = "v${version}";
-    sha256 = "0vz5fm1bgh2g7b320hchpfb4iql1src1rpm7324sqcd26p7w3mnl";
+    sha256 = "sha256-Xgz8ku6szzbgL3cyiggHJYaj4aUhaqgIOUnwKUE1AeY=";
   };
 
   subPackages = [ "cmd/cloud_sql_proxy" ];
 
-  vendorSha256 = "04y6zx3jdyj07d68a4vk4p5rzvvjnvdwk9kkipmlmqg1xqwlb84m";
+  vendorSha256 = "sha256-7KiLJoQ0xH35ae4NGODF4t1S9h86L0TJbCqFVm+bBmk=";
 
   meta = with lib; {
     description = "An authenticating proxy for Second Generation Google Cloud SQL databases";
diff --git a/pkgs/tools/misc/convimg/default.nix b/pkgs/tools/misc/convimg/default.nix
index 0c5ffb4a6de..38c20ca4e84 100644
--- a/pkgs/tools/misc/convimg/default.nix
+++ b/pkgs/tools/misc/convimg/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "convimg";
-  version = "8.3";
+  version = "8.9";
 
   src = fetchFromGitHub {
     owner = "mateoconlechuga";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1k2fkzfg08y2gcm8jabmb2plgqmgw6y30m73ys4mmbskxgy7hc3s";
+    sha256 = "sha256-JTKyOjeiu6FAUrDPDAwLBVgZwmNY11wHonqEV1ukRpw=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index f22a7268fbc..0b8d61756bd 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -22,15 +22,18 @@ with lib;
 
 stdenv.mkDerivation (rec {
   pname = "coreutils";
-  version = "8.32";
+  version = "9.0";
 
   src = fetchurl {
     url = "mirror://gnu/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-RFjY3nhJ30TMqxXhaxVIsoUiTbul8I+sBwwcDgvMTPo=";
+    sha256 = "sha256-zjCs30pBvFuzDdlV6eqnX6IWtOPesIiJ7TJDPHs7l84=";
   };
 
-  patches = [ ./sys-getdents-undeclared.patch ]
-    ++ optional stdenv.hostPlatform.isCygwin ./coreutils-8.23-4.cygwin.patch
+  patches = [
+    ./fix-chmod-exit-code.patch
+    # Workaround for https://debbugs.gnu.org/cgi/bugreport.cgi?bug=51433
+    ./disable-seek-hole.patch
+  ] ++ optional stdenv.hostPlatform.isCygwin ./coreutils-8.23-4.cygwin.patch
     # fix gnulib tests on 32-bit ARM. Included on coreutils master.
     # https://lists.gnu.org/r/bug-gnulib/2020-08/msg00225.html
     ++ optional stdenv.hostPlatform.isAarch32 ./fix-gnulib-tests-arm.patch;
@@ -74,23 +77,26 @@ stdenv.mkDerivation (rec {
     sed '2i print "Skipping id zero test"; exit 77' -i ./tests/id/zero.sh
     sed '2i print "Skipping misc help-versiob test"; exit 77' -i ./tests/misc/help-version.sh
     sed '2i print "Skipping chown separator test"; exit 77' -i ./tests/chown/separator.sh
-  '' + optionalString (stdenv.hostPlatform.libc == "musl") (lib.concatStringsSep "\n" [
+  '' + (optionalString (stdenv.hostPlatform.libc == "musl") (lib.concatStringsSep "\n" [
     ''
       echo "int main() { return 77; }" > gnulib-tests/test-parse-datetime.c
       echo "int main() { return 77; }" > gnulib-tests/test-getlogin.c
     ''
-  ]);
+  ])) + (optionalString stdenv.isAarch64 ''
+    sed '2i print "Skipping tail assert test"; exit 77' -i ./tests/tail-2/assert.sh
+  '');
 
   outputs = [ "out" "info" ];
 
-  nativeBuildInputs = [ perl xz.bin ]
-    ++ optionals stdenv.hostPlatform.isCygwin [ autoreconfHook texinfo ];  # due to patch
+  nativeBuildInputs = [ perl xz.bin autoreconfHook ] # autoreconfHook is due to patch, normally only needed for cygwin
+    ++ optionals stdenv.hostPlatform.isCygwin [ texinfo ];  # due to patch
   configureFlags = [ "--with-packager=https://NixOS.org" ]
     ++ optional (singleBinary != false)
       ("--enable-single-binary" + optionalString (isString singleBinary) "=${singleBinary}")
     ++ optional withOpenssl "--with-openssl"
     ++ optional stdenv.hostPlatform.isSunOS "ac_cv_func_inotify_init=no"
     ++ optional withPrefix "--program-prefix=g"
+    ++ optional stdenv.isDarwin "--disable-nls" # the shipped configure script doesn't enable nls, but using autoreconfHook does so which breaks the build
     ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform && stdenv.hostPlatform.libc == "glibc") [
       # TODO(19b98110126fde7cbb1127af7e3fe1568eacad3d): Needed for fstatfs() I
       # don't know why it is not properly detected cross building with glibc.
@@ -152,7 +158,7 @@ stdenv.mkDerivation (rec {
     license = licenses.gpl3Plus;
     platforms = platforms.unix ++ platforms.windows;
     priority = 10;
-    maintainers = [ maintainers.eelco ];
+    maintainers = [ maintainers.eelco maintainers.das_j ];
   };
 } // optionalAttrs stdenv.hostPlatform.isMusl {
   # Work around a bogus warning in conjunction with musl.
diff --git a/pkgs/tools/misc/coreutils/disable-seek-hole.patch b/pkgs/tools/misc/coreutils/disable-seek-hole.patch
new file mode 100644
index 00000000000..89503287980
--- /dev/null
+++ b/pkgs/tools/misc/coreutils/disable-seek-hole.patch
@@ -0,0 +1,43 @@
+diff --git a/src/copy.c b/src/copy.c
+index cb9018f93..2a4ccc061 100644
+--- a/src/copy.c
++++ b/src/copy.c
+@@ -502,7 +502,7 @@ write_zeros (int fd, off_t n_bytes)
+   return true;
+ }
+
+-#ifdef SEEK_HOLE
++#if 0
+ /* Perform an efficient extent copy, if possible.  This avoids
+    the overhead of detecting holes in hole-introducing/preserving
+    copy, and thus makes copying sparse files much more efficient.
+@@ -1095,7 +1095,7 @@ infer_scantype (int fd, struct stat const *sb,
+          && ST_NBLOCKS (*sb) < sb->st_size / ST_NBLOCKSIZE))
+     return PLAIN_SCANTYPE;
+
+-#ifdef SEEK_HOLE
++#if 0
+   scan_inference->ext_start = lseek (fd, 0, SEEK_DATA);
+   if (0 <= scan_inference->ext_start)
+     return LSEEK_SCANTYPE;
+@@ -1377,7 +1377,7 @@ copy_reg (char const *src_name, char const *dst_name,
+       off_t n_read;
+       bool wrote_hole_at_eof = false;
+       if (! (
+-#ifdef SEEK_HOLE
++#if 0
+              scantype == LSEEK_SCANTYPE
+              ? lseek_copy (source_desc, dest_desc, buf, buf_size, hole_size,
+                            scan_inference.ext_start, src_open_sb.st_size,
+diff --git a/tests/seek-data-capable b/tests/seek-data-capable
+index cc6372214..6e7a9ec1e 100644
+--- a/tests/seek-data-capable
++++ b/tests/seek-data-capable
+@@ -1,5 +1,7 @@
+ import sys, os, errno, platform
+
++sys.exit(1)
++
+ # Pass an _empty_ file
+ if len(sys.argv) != 2:
+     sys.exit(1)
diff --git a/pkgs/tools/misc/coreutils/fix-chmod-exit-code.patch b/pkgs/tools/misc/coreutils/fix-chmod-exit-code.patch
new file mode 100644
index 00000000000..a966c3bda91
--- /dev/null
+++ b/pkgs/tools/misc/coreutils/fix-chmod-exit-code.patch
@@ -0,0 +1,108 @@
+From e8b56ebd536e82b15542a00c888109471936bfda Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?P=C3=A1draig=20Brady?= <P@draigBrady.com>
+Date: Fri, 24 Sep 2021 20:57:41 +0100
+Subject: [PATCH] chmod: fix exit status when ignoring symlinks
+
+* src/chmod.c: Reorder enum so CH_NOT_APPLIED
+can be treated as a non error.
+* tests/chmod/ignore-symlink.sh: A new test.
+* tests/local.mk: Reference the new test.
+* NEWS: Mention the bug fix.
+Fixes https://bugs.gnu.org/50784
+---
+ NEWS                          |  6 ++++++
+ src/chmod.c                   |  4 ++--
+ tests/chmod/ignore-symlink.sh | 31 +++++++++++++++++++++++++++++++
+ tests/local.mk                |  1 +
+ 4 files changed, 40 insertions(+), 2 deletions(-)
+ create mode 100755 tests/chmod/ignore-symlink.sh
+
+diff --git a/NEWS b/NEWS
+index a1470a7d7..1cb3c28a1 100644
+--- a/NEWS
++++ b/NEWS
+@@ -2,6 +2,12 @@ GNU coreutils NEWS                                    -*- outline -*-
+ 
+ * Noteworthy changes in release ?.? (????-??-??) [?]
+ 
++** Bug fixes
++
++  chmod -R no longer exits with error status when encountering symlinks.
++  All files would be processed correctly, but the exit status was incorrect.
++  [bug introduced in coreutils-9.0]
++
+ 
+ * Noteworthy changes in release 9.0 (2021-09-24) [stable]
+ 
+diff --git a/src/chmod.c b/src/chmod.c
+index 37b04f500..57ac47f33 100644
+--- a/src/chmod.c
++++ b/src/chmod.c
+@@ -44,8 +44,8 @@ struct change_status
+   enum
+     {
+       CH_NO_STAT,
+-      CH_NOT_APPLIED,
+       CH_FAILED,
++      CH_NOT_APPLIED,
+       CH_NO_CHANGE_REQUESTED,
+       CH_SUCCEEDED
+     }
+@@ -322,7 +322,7 @@ process_file (FTS *fts, FTSENT *ent)
+   if ( ! recurse)
+     fts_set (fts, ent, FTS_SKIP);
+ 
+-  return CH_NO_CHANGE_REQUESTED <= ch.status;
++  return CH_NOT_APPLIED <= ch.status;
+ }
+ 
+ /* Recursively change the modes of the specified FILES (the last entry
+diff --git a/tests/chmod/ignore-symlink.sh b/tests/chmod/ignore-symlink.sh
+new file mode 100755
+index 000000000..5ce3de816
+--- /dev/null
++++ b/tests/chmod/ignore-symlink.sh
+@@ -0,0 +1,31 @@
++#!/bin/sh
++# Test for proper exit code of chmod on a processed symlink.
++
++# Copyright (C) 2021 Free Software Foundation, Inc.
++
++# This program is free software: you can redistribute it and/or modify
++# it under the terms of the GNU General Public License as published by
++# the Free Software Foundation, either version 3 of the License, or
++# (at your option) any later version.
++
++# This program is distributed in the hope that it will be useful,
++# but WITHOUT ANY WARRANTY; without even the implied warranty of
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++# GNU General Public License for more details.
++
++# You should have received a copy of the GNU General Public License
++# along with this program.  If not, see <https://www.gnu.org/licenses/>.
++
++. "${srcdir=.}/tests/init.sh"; path_prepend_ ./src
++print_ver_ chmod
++
++mkdir dir || framework_failure_
++touch dir/f || framework_failure_
++ln -s f dir/l || framework_failure_
++
++# This operation ignores symlinks but should succeed.
++chmod u+w -R dir 2> out || fail=1
++
++compare /dev/null out || fail=1
++
++Exit $fail
+diff --git a/tests/local.mk b/tests/local.mk
+index 228d0e368..b5b893fb7 100644
+--- a/tests/local.mk
++++ b/tests/local.mk
+@@ -456,6 +456,7 @@ all_tests =					\
+   tests/chmod/c-option.sh			\
+   tests/chmod/equal-x.sh			\
+   tests/chmod/equals.sh				\
++  tests/chmod/ignore-symlink.sh			\
+   tests/chmod/inaccessible.sh			\
+   tests/chmod/octal.sh				\
+   tests/chmod/setgid.sh				\
diff --git a/pkgs/tools/misc/coreutils/sys-getdents-undeclared.patch b/pkgs/tools/misc/coreutils/sys-getdents-undeclared.patch
deleted file mode 100644
index 0af5de68415..00000000000
--- a/pkgs/tools/misc/coreutils/sys-getdents-undeclared.patch
+++ /dev/null
@@ -1,100 +0,0 @@
-From 10fcb97bd728f09d4a027eddf8ad2900f0819b0a Mon Sep 17 00:00:00 2001
-From: Paul Eggert <eggert@cs.ucla.edu>
-Date: Thu, 5 Mar 2020 17:25:29 -0800
-Subject: ls: restore 8.31 behavior on removed directories
-
-* NEWS: Mention this.
-* src/ls.c: Do not include <sys/sycall.h>
-(print_dir): Don't worry about whether the directory is removed.
-* tests/ls/removed-directory.sh: Adjust to match new (i.e., old)
-behavior.
----
- NEWS (removed diff in nixpkgs)|  6 ++++++
- src/ls.c                      | 22 ----------------------
- tests/ls/removed-directory.sh | 10 ++--------
- 3 files changed, 8 insertions(+), 30 deletions(-)
-
-diff --git a/src/ls.c b/src/ls.c
-index 24b983287..4acf5f44d 100644
---- a/src/ls.c
-+++ b/src/ls.c
-@@ -49,10 +49,6 @@
- # include <sys/ptem.h>
- #endif
- 
--#ifdef __linux__
--# include <sys/syscall.h>
--#endif
--
- #include <stdio.h>
- #include <assert.h>
- #include <setjmp.h>
-@@ -2896,7 +2892,6 @@ print_dir (char const *name, char const *realname, bool command_line_arg)
-   struct dirent *next;
-   uintmax_t total_blocks = 0;
-   static bool first = true;
--  bool found_any_entries = false;
- 
-   errno = 0;
-   dirp = opendir (name);
-@@ -2972,7 +2967,6 @@ print_dir (char const *name, char const *realname, bool command_line_arg)
-       next = readdir (dirp);
-       if (next)
-         {
--          found_any_entries = true;
-           if (! file_ignored (next->d_name))
-             {
-               enum filetype type = unknown;
-@@ -3018,22 +3012,6 @@ print_dir (char const *name, char const *realname, bool command_line_arg)
-           if (errno != EOVERFLOW)
-             break;
-         }
--#ifdef __linux__
--      else if (! found_any_entries)
--        {
--          /* If readdir finds no directory entries at all, not even "." or
--             "..", then double check that the directory exists.  */
--          if (syscall (SYS_getdents, dirfd (dirp), NULL, 0) == -1
--              && errno != EINVAL)
--            {
--              /* We exclude EINVAL as that pertains to buffer handling,
--                 and we've passed NULL as the buffer for simplicity.
--                 ENOENT is returned if appropriate before buffer handling.  */
--              file_failure (command_line_arg, _("reading directory %s"), name);
--            }
--          break;
--        }
--#endif
-       else
-         break;
- 
-diff --git a/tests/ls/removed-directory.sh b/tests/ls/removed-directory.sh
-index e8c835dab..fe8f929a1 100755
---- a/tests/ls/removed-directory.sh
-+++ b/tests/ls/removed-directory.sh
-@@ -26,20 +26,14 @@ case $host_triplet in
-   *) skip_ 'non linux kernel' ;;
- esac
- 
--LS_FAILURE=2
--
--cat <<\EOF >exp-err || framework_failure_
--ls: reading directory '.': No such file or directory
--EOF
--
- cwd=$(pwd)
- mkdir d || framework_failure_
- cd d || framework_failure_
- rmdir ../d || framework_failure_
- 
--returns_ $LS_FAILURE ls >../out 2>../err || fail=1
-+ls >../out 2>../err || fail=1
- cd "$cwd" || framework_failure_
- compare /dev/null out || fail=1
--compare exp-err err || fail=1
-+compare /dev/null err || fail=1
- 
- Exit $fail
--- 
-cgit v1.2.1
-
diff --git a/pkgs/tools/misc/dua/default.nix b/pkgs/tools/misc/dua/default.nix
index 719bb90b43d..e94fabd0156 100644
--- a/pkgs/tools/misc/dua/default.nix
+++ b/pkgs/tools/misc/dua/default.nix
@@ -2,7 +2,7 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "dua";
-  version = "2.14.7";
+  version = "2.14.11";
 
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv Foundation ];
 
@@ -10,7 +10,7 @@ rustPlatform.buildRustPackage rec {
     owner = "Byron";
     repo = "dua-cli";
     rev = "v${version}";
-    sha256 = "sha256-HkNWFWdyjpnJJANfnRDhmnhYbZIhrM9aIVN/Ov3/hK0=";
+    sha256 = "sha256-XMhgTJiP4whw1r+WtdG5CsQl/GIZPEg7/ElIEMZyWqM=";
     # Remove unicode file names which leads to different checksums on HFS+
     # vs. other filesystems because of unicode normalisation.
     extraPostFetch = ''
@@ -18,7 +18,7 @@ rustPlatform.buildRustPackage rec {
     '';
   };
 
-  cargoSha256 = "sha256-nfQGAjekd6cegvKPDxyOfcIhgagH61MT+2YVB2WppvQ=";
+  cargoSha256 = "sha256-B4e8wT/RhpwtCb11HqN8vksshBaF/CmpMPT62aBuFnw=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/misc/esptool/default.nix b/pkgs/tools/misc/esptool/default.nix
index 3fc6e96e228..5a543c6e2ad 100644
--- a/pkgs/tools/misc/esptool/default.nix
+++ b/pkgs/tools/misc/esptool/default.nix
@@ -2,13 +2,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "esptool";
-  version = "3.1";
+  version = "3.2";
 
   src = fetchFromGitHub {
     owner = "espressif";
     repo = "esptool";
     rev = "v${version}";
-    sha256 = "sha256-GaGrV8L//pU4kt4HJmY88l5BNtT0IcZox7b24AFjPCI=";
+    sha256 = "1jic5kynfan5zirv9pm3pfjps12zf68cpnhl7i1vls2m79zdkfa3";
   };
 
   checkInputs = with python3.pkgs;
diff --git a/pkgs/tools/misc/etcher/default.nix b/pkgs/tools/misc/etcher/default.nix
index 1e5fefaf645..51123f55b60 100644
--- a/pkgs/tools/misc/etcher/default.nix
+++ b/pkgs/tools/misc/etcher/default.nix
@@ -9,15 +9,19 @@
 }:
 
 let
+  inherit (stdenv.hostPlatform) system;
+
+  throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";
+
   sha256 = {
-    "x86_64-linux" = "sha256-Tasynkzyy8UIalQn6qhIuPWDflf4pL76D2czgEijrPw=";
-    "i686-linux" = "0z6y45sz086njpywg7f0jn6n02qynb1qbi889g2kcgwbfjvmcpm1";
-  }."${stdenv.system}";
+    "x86_64-linux" = "sha256-n8i4ZqjugeUfXpTzVgIwVomfPk6HvPEbTZLe/jFgwFg=";
+    "i686-linux" = "sha256-lLGfhW6el2ZOcaykH1kTjGldXo7/0q5O8QnslnDlWAQ=";
+  }."${system}" or throwSystem;
 
   arch = {
     "x86_64-linux" = "amd64";
     "i686-linux" = "i386";
-  }."${stdenv.system}";
+  }."${system}" or throwSystem;
 
   electron = electron_12;
 
@@ -25,7 +29,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "etcher";
-  version = "1.5.122";
+  version = "1.6.0";
 
   src = fetchurl {
     url = "https://github.com/balena-io/etcher/releases/download/v${version}/balena-etcher-electron_${version}_${arch}.deb";
diff --git a/pkgs/tools/misc/fclones/default.nix b/pkgs/tools/misc/fclones/default.nix
index 52ff0cc9021..1b35fe0f67b 100644
--- a/pkgs/tools/misc/fclones/default.nix
+++ b/pkgs/tools/misc/fclones/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "fclones";
-  version = "0.17.0";
+  version = "0.17.1";
 
   src = fetchFromGitHub {
     owner = "pkolaczk";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-JygW1Ri9BA4Qssu6MlQCCjnAok9OD2pcGdavOyHxbIo=";
+    sha256 = "0d5an35fnz9rdr2ssm952zpzn4jynpvbfyidnqcmp0lclr60c2ir";
   };
 
-  cargoSha256 = "sha256-sDHsj0qxKW5JJCI9H0WytgugtEmLaLU2EIgCcXdfQH0=";
+  cargoSha256 = "sha256-CtQ4grQqgMUYzPDw2Qankl8jmqwwCrawNCmaY97JPkQ=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     AppKit
diff --git a/pkgs/tools/misc/fend/default.nix b/pkgs/tools/misc/fend/default.nix
index 27352c83dee..475d8131dd0 100644
--- a/pkgs/tools/misc/fend/default.nix
+++ b/pkgs/tools/misc/fend/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "fend";
-  version = "0.1.24";
+  version = "0.1.26";
 
   src = fetchFromGitHub {
     owner = "printfn";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Oa/o2Jd0rf+fIVQCaCiSh+tI2KINh1Kx3NTVEULQlzI=";
+    sha256 = "sha256-U5LYjoq11qZYus/McDbtVljj2RSP9MCXXDvOWgbXerk=";
   };
 
-  cargoSha256 = "sha256-iFGw5mkeRGiMWe5wcrEcmH0WlHJ8p1D0rf1mh+1Mo+w=";
+  cargoSha256 = "sha256-E7by7FJfmOBqDoZLA9s/bj/EHaZ4IsHYTHWcvIuaMNg=";
 
   doInstallCheck = true;
 
diff --git a/pkgs/tools/misc/ffsend/default.nix b/pkgs/tools/misc/ffsend/default.nix
index aea480ac046..b6c7cefbccb 100644
--- a/pkgs/tools/misc/ffsend/default.nix
+++ b/pkgs/tools/misc/ffsend/default.nix
@@ -17,16 +17,16 @@ with rustPlatform;
 
 buildRustPackage rec {
   pname = "ffsend";
-  version = "0.2.72";
+  version = "0.2.74";
 
   src = fetchFromGitLab {
     owner = "timvisee";
     repo = "ffsend";
     rev = "v${version}";
-    sha256 = "sha256-YEmEaf0ob2ulmQghwDYi0RtGuTdRHCoLdPnuVjxvlxE=";
+    sha256 = "0ia9agh0h9hp06ijmlgnw63n3xz2jajjw1maz27sawqp342x9vn5";
   };
 
-  cargoSha256 = "sha256-mcWQzfMc2cJjp0EFcfG7SAM70ItwEC/N13UDiRiI3ys=";
+  cargoSha256 = "0dl671sw3amny52a81bx7imh94dvi91dprwhcm1b0g40mjic45pw";
 
   nativeBuildInputs = [ cmake pkg-config installShellFiles ];
   buildInputs =
diff --git a/pkgs/tools/misc/fluent-bit/default.nix b/pkgs/tools/misc/fluent-bit/default.nix
index f744c52b76b..795e2b39b7b 100644
--- a/pkgs/tools/misc/fluent-bit/default.nix
+++ b/pkgs/tools/misc/fluent-bit/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fluent-bit";
-  version = "1.8.6";
+  version = "1.8.9";
 
   src = fetchFromGitHub {
     owner = "fluent";
     repo = "fluent-bit";
     rev = "v${version}";
-    sha256 = "sha256-JYE4ReFiYSDx/0dlA8OkQw3rEpUEQDguTWoHC1r1fUc=";
+    sha256 = "sha256-b+MZuZQB/sl0HcioU1KCxH3TNiXYSPBfC9dBKqCVeXk=";
   };
 
   nativeBuildInputs = [ cmake flex bison ];
diff --git a/pkgs/tools/misc/fselect/default.nix b/pkgs/tools/misc/fselect/default.nix
index e877304a2d5..5bb73e7e146 100644
--- a/pkgs/tools/misc/fselect/default.nix
+++ b/pkgs/tools/misc/fselect/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "fselect";
-  version = "0.7.6";
+  version = "0.7.7";
 
   src = fetchFromGitHub {
     owner = "jhspetersson";
     repo = "fselect";
     rev = version;
-    sha256 = "sha256-uIqkk0aQVPXUWjOWmMTdM28Ihi+mflPpxnXJLFIQYJw=";
+    sha256 = "sha256-1UpY32itljkpkOjcVEcpZ0iN+PciEnG9tOpbInHwNus=";
   };
 
-  cargoSha256 = "sha256-5LRCLJbLiocB/VDf9MMxyIsERmOvuSAQEe822Dcu2j8=";
+  cargoSha256 = "sha256-M8hnXHVfKK/aQGXlMpuhoTLalpnHjxSkX+LHwpatu90=";
 
   nativeBuildInputs = [ installShellFiles ];
   buildInputs = lib.optional stdenv.isDarwin libiconv;
diff --git a/pkgs/tools/misc/fx_cast/default.nix b/pkgs/tools/misc/fx_cast/default.nix
index e3458ccfe5c..b94b16d7bf5 100644
--- a/pkgs/tools/misc/fx_cast/default.nix
+++ b/pkgs/tools/misc/fx_cast/default.nix
@@ -8,7 +8,7 @@
 # nix run nixpkgs.nodePackages.node2nix -c node2nix -l package-lock.json -d
 # cp -v node-*.nix package*.json ~/p/nixpkgs/pkgs/tools/misc/fx_cast/app
 # ```
-{ pkgs, stdenv, system }: let
+{ pkgs, stdenv }: let
   nodeEnv = import ./node-env.nix {
     inherit (pkgs) nodejs stdenv lib python2 runCommand writeTextFile;
     inherit pkgs;
diff --git a/pkgs/tools/misc/goreleaser/default.nix b/pkgs/tools/misc/goreleaser/default.nix
index 13b9f661a64..c2caab58af5 100644
--- a/pkgs/tools/misc/goreleaser/default.nix
+++ b/pkgs/tools/misc/goreleaser/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "goreleaser";
-  version = "0.179.0";
+  version = "0.183.0";
 
   src = fetchFromGitHub {
     owner = "goreleaser";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-E8a1S6CPPd8xsdt/tu1VmWxQCMUp8dEPB5H2IL4jj1k=";
+    sha256 = "sha256-bH6Crsyo1D2wBlQJK4P13Jc9x5ItaNOV1P7o16z8LS8=";
   };
 
-  vendorSha256 = "sha256-qF7mULIQrFs/SAMm/dUcYPs1urLKKg6w7hgkuJ2AivQ=";
+  vendorSha256 = "sha256-netkm/oqf7FQuuF0kjQjoopOQADPrVStIhMdEYx43FE=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/misc/kak-lsp/default.nix b/pkgs/tools/misc/kak-lsp/default.nix
index e800a93dd2a..9ba28dd3cf1 100644
--- a/pkgs/tools/misc/kak-lsp/default.nix
+++ b/pkgs/tools/misc/kak-lsp/default.nix
@@ -1,19 +1,19 @@
-{ stdenv, lib, fetchFromGitHub, rustPlatform, Security }:
+{ stdenv, lib, fetchFromGitHub, rustPlatform, Security, SystemConfiguration }:
 
 rustPlatform.buildRustPackage rec {
   pname = "kak-lsp";
-  version = "11.0.0";
+  version = "11.0.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "198y2k3vi8dh9kfqgl7vpgkxvjlfvryi9c8hmb43m0lpwsja0010";
+    sha256 = "sha256-rSUXMQF4V+ToYw3RIfEZd2AfAiHoRPDC3DZBAg2zeKo=";
   };
 
-  cargoSha256 = "0sv1a2k5rcf4hl1w50mh041r3w3nir6avyl6xa3rlcc7cy19q21y";
+  cargoSha256 = "sha256-vcq+WVHmGFrZFLzNWyHU7qN6cDSKP9pAzxZNs2+8jR8=";
 
-  buildInputs = lib.optionals stdenv.isDarwin [ Security ];
+  buildInputs = lib.optionals stdenv.isDarwin [ Security SystemConfiguration ];
 
   meta = with lib; {
     description = "Kakoune Language Server Protocol Client";
diff --git a/pkgs/tools/misc/ksnip/default.nix b/pkgs/tools/misc/ksnip/default.nix
index d78b45d9b7a..c93016fe55c 100644
--- a/pkgs/tools/misc/ksnip/default.nix
+++ b/pkgs/tools/misc/ksnip/default.nix
@@ -5,6 +5,7 @@
 , fetchFromGitHub
 , kcolorpicker
 , kimageannotator
+, wrapQtAppsHook
 , qtsvg
 , qttranslations
 , qtx11extras
@@ -21,11 +22,10 @@ stdenv.mkDerivation rec {
     sha256 = "1izsk586n9fbm0di0hj6pxs7r0a6w554gpad1ghf247icr0pfc1l";
   };
 
-  dontWrapQtApps = true;
-
   nativeBuildInputs = [
     cmake
     extra-cmake-modules
+    wrapQtAppsHook
   ];
 
   buildInputs = [
diff --git a/pkgs/tools/misc/lf/default.nix b/pkgs/tools/misc/lf/default.nix
index 5d812f5867c..73010f8d944 100644
--- a/pkgs/tools/misc/lf/default.nix
+++ b/pkgs/tools/misc/lf/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "lf";
-  version = "25";
+  version = "26";
 
   src = fetchFromGitHub {
     owner = "gokcehan";
     repo = "lf";
     rev = "r${version}";
-    sha256 = "sha256-5/OfEWgtB9R3XRJ16ponf+bBVGAXkqPq8IlB8+zyjAQ=";
+    sha256 = "0a2kybaajpmhlq708fsdyyab388lkmz17gfn0qcv352i2d4lli0s";
   };
 
   vendorSha256 = "sha256-ujQh4aE++K/fn3PJqkAbTtwRyJPSI9TJQ1DvwLF9etU=";
@@ -20,7 +20,7 @@ buildGoModule rec {
   postInstall = ''
     install -D --mode=444 lf.desktop $out/share/applications/lf.desktop
     installManPage lf.1
-    installShellCompletion etc/lf.{zsh,fish}
+    installShellCompletion etc/lf.{bash,zsh,fish}
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/misc/lnav/default.nix b/pkgs/tools/misc/lnav/default.nix
index 3cbfb2ad365..ce541e8f567 100644
--- a/pkgs/tools/misc/lnav/default.nix
+++ b/pkgs/tools/misc/lnav/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lnav";
-  version = "0.10.0";
+  version = "0.10.1";
 
   src = fetchFromGitHub {
     owner = "tstack";
     repo = "lnav";
     rev = "v${version}";
-    sha256 = "sha256-hAFyMypGC065aRgX2L4LdyFGpZ/LnX5SjA2iQv5Iuas=";
+    sha256 = "sha256-1b4mVKIUotMSK/ADHnpiM42G98JF0abL8sXXGFyS3sw=";
   };
 
   patches = [ ./0001-Forcefully-disable-docs-build.patch ];
diff --git a/pkgs/tools/misc/lsd/default.nix b/pkgs/tools/misc/lsd/default.nix
index 54b3b443d0a..c0d1c278bfd 100644
--- a/pkgs/tools/misc/lsd/default.nix
+++ b/pkgs/tools/misc/lsd/default.nix
@@ -1,5 +1,4 @@
 { lib
-, nixosTests
 , fetchFromGitHub
 , rustPlatform
 , installShellFiles
@@ -26,7 +25,18 @@ rustPlatform.buildRustPackage rec {
   # Found argument '--test-threads' which wasn't expected, or isn't valid in this context
   doCheck = false;
 
-  passthru.tests = { inherit (nixosTests) lsd; };
+  doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    testFile=$(mktemp /tmp/lsd-test.XXXX)
+    echo 'abc' > $testFile
+    $out/bin/lsd --classic --blocks "size,name" -l $testFile | grep "4 B $testFile"
+    $out/bin/lsd --version | grep "${version}"
+    rm $testFile
+
+    runHook postInstallCheck
+  '';
 
   meta = with lib; {
     homepage = "https://github.com/Peltoche/lsd";
diff --git a/pkgs/tools/misc/pipreqs/default.nix b/pkgs/tools/misc/pipreqs/default.nix
index 3f27be2c9f9..70a5ec69ff5 100644
--- a/pkgs/tools/misc/pipreqs/default.nix
+++ b/pkgs/tools/misc/pipreqs/default.nix
@@ -4,11 +4,11 @@ with python3.pkgs;
 
 buildPythonApplication rec {
   pname = "pipreqs";
-  version = "0.4.10";
+  version = "0.4.11";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0fdr3mbxjpmrxr7yfc1sn9kbpcyb0qwafimhhrrqvf989dj1sdcy";
+    sha256 = "c793b4e147ac437871b3a962c5ce467e129c859ece5ba79aca83c20f4d9c3aef";
   };
 
   propagatedBuildInputs = [ yarg docopt ];
diff --git a/pkgs/tools/misc/plantuml-server/default.nix b/pkgs/tools/misc/plantuml-server/default.nix
index eef6cdc11d5..6afaf0fbb34 100644
--- a/pkgs/tools/misc/plantuml-server/default.nix
+++ b/pkgs/tools/misc/plantuml-server/default.nix
@@ -1,13 +1,13 @@
 { lib, stdenv, fetchFromGitHub, maven, jdk8_headless }:
 
 let
-  version = "1.2021.7";
+  version = "1.2021.12";
 
   src = fetchFromGitHub {
     owner = "plantuml";
     repo = "plantuml-server";
     rev = "v${version}";
-    sha256 = "sha256-kY7b3ocm1zudGIf72MNMZDUG2t2FFqucRr3kRaFv7mo=";
+    sha256 = "sha256:016mrs4djbaid1ma5922dvq372pphbzzmjzsjalj2dqp60538xll";
   };
 
   # perform fake build to make a fixed-output derivation out of the files downloaded from maven central
@@ -28,7 +28,7 @@ let
     installPhase = ''find $out/.m2 -type f -regex '.+\(\.lastUpdated\|resolver-status\.properties\|_remote\.repositories\)' -delete'';
     outputHashAlgo = "sha256";
     outputHashMode = "recursive";
-    outputHash = "sha256-HzT5rBycrd48KskWKAGtkMKdCDQ8NPYADVWZh8K0ll4=";
+    outputHash = "sha256:12w1iw9c5j7y9hhaip07j3aszjiiakkww1v3zszlj15fj8jgqyf2";
   };
 in
 
diff --git a/pkgs/tools/misc/ponysay/default.nix b/pkgs/tools/misc/ponysay/default.nix
index b27aa32481c..e75481fcc2c 100644
--- a/pkgs/tools/misc/ponysay/default.nix
+++ b/pkgs/tools/misc/ponysay/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "ponysay";
-  version = "3.0.3";
+  version = "unstable-2021-03-27";
 
   src = fetchFromGitHub {
     owner = "erkin";
     repo = "ponysay";
-    rev = version;
-    sha256 = "sha256-R2B0TU3ZSEncGsijKgvhaHIbcZa5Dx/jVPxrILBaoVw=";
+    rev = "8a2c71416e70e4e7b0931917ebfd6479f51ddf9a";
+    sha256 = "sha256-LNc83E+7NFYYILORElNlYC7arQKGUJHv6phu+vM5xpQ=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/misc/qt5ct/default.nix b/pkgs/tools/misc/qt5ct/default.nix
index 133a1a87d66..bbb8f96f5fb 100644
--- a/pkgs/tools/misc/qt5ct/default.nix
+++ b/pkgs/tools/misc/qt5ct/default.nix
@@ -4,11 +4,11 @@ let inherit (lib) getDev; in
 
 mkDerivation rec {
   pname = "qt5ct";
-  version = "1.3";
+  version = "1.5";
 
   src = fetchurl {
     url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-3UQ7FOWQr/dqFuExbVbmiIguMkjEcN9PcbyVJWnzw7w=";
+    sha256 = "sha256-1j0M4W4CQnIH2GUx9wpxxbnIUARN1bLcsihVMfQW5JA=";
   };
 
   nativeBuildInputs = [ qmake qttools ];
diff --git a/pkgs/tools/misc/remind/default.nix b/pkgs/tools/misc/remind/default.nix
index 1ef0ee9dd46..59ddc84465b 100644
--- a/pkgs/tools/misc/remind/default.nix
+++ b/pkgs/tools/misc/remind/default.nix
@@ -16,11 +16,11 @@ let
 in
 tcl.mkTclDerivation rec {
   pname = "remind";
-  version = "03.03.07";
+  version = "03.03.09";
 
   src = fetchurl {
     url = "https://dianne.skoll.ca/projects/remind/download/remind-${version}.tar.gz";
-    sha256 = "sha256-h8lOKdHhiVT/XSIkfX7KMHzmIeEdIsFCCPkD9oo7ij0=";
+    sha256 = "sha256-yQh6jGkRNkQvPoguRmd6025pCEsvO7w8W3YNO2vztvM=";
   };
 
   propagatedBuildInputs = tclLibraries;
diff --git a/pkgs/tools/misc/sfeed/default.nix b/pkgs/tools/misc/sfeed/default.nix
index 93ef69ea2ea..6e7a6914e57 100644
--- a/pkgs/tools/misc/sfeed/default.nix
+++ b/pkgs/tools/misc/sfeed/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "sfeed";
-  version = "0.9.21";
+  version = "1.0";
 
   src = fetchgit {
     url = "git://git.codemadness.org/sfeed";
     rev = version;
-    sha256 = "010wasp6hcnwbf0d3gaxmjpkvr85zyv2xxz2pnkwxyk2bbr1h6q8";
+    sha256 = "sha256-pLKWq4KIiT6X37EUIOw5SBb1KWopnFcDO+iE++Uie5s=";
   };
 
   installPhase = ''
diff --git a/pkgs/tools/misc/sharedown/default.nix b/pkgs/tools/misc/sharedown/default.nix
index fed2a826459..0dd4c230566 100644
--- a/pkgs/tools/misc/sharedown/default.nix
+++ b/pkgs/tools/misc/sharedown/default.nix
@@ -11,12 +11,7 @@
 , chromium
 }:
 
-let
-  binPath = lib.makeBinPath ([
-    ffmpeg
-    yt-dlp
-  ]);
-
+stdenvNoCC.mkDerivation rec {
   pname = "Sharedown";
   version = "2.0.0";
 
@@ -27,22 +22,6 @@ let
     sha256 = "sha256-Z6OsZvVzk//qEkl4ciNz4cQRqC2GFg0qYgmliAyz6fo=";
   };
 
-  modules = yarn2nix-moretea.mkYarnModules {
-    name = "${pname}-modules-${version}";
-    inherit pname version;
-
-    yarnFlags = yarn2nix-moretea.defaultYarnFlags ++ [
-      "--production"
-    ];
-
-    packageJSON = "${src}/package.json";
-    yarnLock = ./yarn.lock;
-    yarnNix = ./yarndeps.nix;
-  };
-in
-stdenvNoCC.mkDerivation rec {
-  inherit pname version src;
-
   nativeBuildInputs = [
     copyDesktopItems
     makeWrapper
@@ -61,25 +40,45 @@ stdenvNoCC.mkDerivation rec {
 
   dontBuild = true;
 
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p "$out/bin" "$out/share/Sharedown" "$out/share/applications" "$out/share/icons/hicolor/512x512/apps"
-
-    # Electron app
-    cp -r *.js *.json sharedownlogo.png sharedown "${modules}/node_modules" "$out/share/Sharedown"
-
-    # Desktop Launcher
-    cp build/icon.png "$out/share/icons/hicolor/512x512/apps/Sharedown.png"
-
-    # Install electron wrapper script
-    makeWrapper "${electron}/bin/electron" "$out/bin/Sharedown" \
-      --add-flags "$out/share/Sharedown" \
-      --prefix PATH : "${binPath}" \
-      --set PUPPETEER_EXECUTABLE_PATH "${chromium}/bin/chromium"
-
-    runHook postInstall
-  '';
+  installPhase =
+    let
+      binPath = lib.makeBinPath ([
+        ffmpeg
+        yt-dlp
+      ]);
+
+      modules = yarn2nix-moretea.mkYarnModules {
+        name = "${pname}-modules-${version}";
+        inherit pname version;
+
+        yarnFlags = yarn2nix-moretea.defaultYarnFlags ++ [
+          "--production"
+        ];
+
+        packageJSON = "${src}/package.json";
+        yarnLock = ./yarn.lock;
+        yarnNix = ./yarndeps.nix;
+      };
+    in
+    ''
+      runHook preInstall
+
+      mkdir -p "$out/bin" "$out/share/Sharedown" "$out/share/applications" "$out/share/icons/hicolor/512x512/apps"
+
+      # Electron app
+      cp -r *.js *.json sharedownlogo.png sharedown "${modules}/node_modules" "$out/share/Sharedown"
+
+      # Desktop Launcher
+      cp build/icon.png "$out/share/icons/hicolor/512x512/apps/Sharedown.png"
+
+      # Install electron wrapper script
+      makeWrapper "${electron}/bin/electron" "$out/bin/Sharedown" \
+        --add-flags "$out/share/Sharedown" \
+        --prefix PATH : "${binPath}" \
+        --set PUPPETEER_EXECUTABLE_PATH "${chromium}/bin/chromium"
+
+      runHook postInstall
+    '';
 
   passthru.updateScript = ./update.sh;
 
diff --git a/pkgs/tools/misc/staruml/default.nix b/pkgs/tools/misc/staruml/default.nix
index ab28b8777f4..3d2042978f8 100644
--- a/pkgs/tools/misc/staruml/default.nix
+++ b/pkgs/tools/misc/staruml/default.nix
@@ -21,13 +21,13 @@ let
   ];
 in
 stdenv.mkDerivation rec {
-  version = "4.0.1";
+  version = "4.1.6";
   pname = "staruml";
 
   src =
     fetchurl {
       url = "https://staruml.io/download/releases-v4/StarUML_${version}_amd64.deb";
-      sha256 = "0vxrs5y4a17bnc27fd2k2qc0vi81v677mi55znylwf3a41fjfcir";
+      sha256 = "sha256-CUOdpR8RExMLeOX8469egENotMNuPU4z8S1IGqA21z0=";
     };
 
   nativeBuildInputs = [ makeWrapper dpkg ];
diff --git a/pkgs/tools/misc/svtplay-dl/default.nix b/pkgs/tools/misc/svtplay-dl/default.nix
index 39e02497dcc..fff5c25cd6e 100644
--- a/pkgs/tools/misc/svtplay-dl/default.nix
+++ b/pkgs/tools/misc/svtplay-dl/default.nix
@@ -9,13 +9,13 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "svtplay-dl";
-  version = "4.7";
+  version = "4.8";
 
   src = fetchFromGitHub {
     owner = "spaam";
     repo = "svtplay-dl";
     rev = version;
-    sha256 = "19ajm4bf7knnchggfbajx0c29q4sj8ffsvqmgizgsjdz48ppx2yf";
+    sha256 = "1mlf0yvj3zy3df0ip7qb6g4v7032rsz038a7d25zn6yfzsz04br3";
   };
 
   pythonPaths = [ cryptography pyyaml requests ];
diff --git a/pkgs/tools/misc/topgrade/default.nix b/pkgs/tools/misc/topgrade/default.nix
index 15a0e0bdcda..deb9f907005 100644
--- a/pkgs/tools/misc/topgrade/default.nix
+++ b/pkgs/tools/misc/topgrade/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "topgrade";
-  version = "8.0.0";
+  version = "8.0.3";
 
   src = fetchFromGitHub {
     owner = "r-darwish";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-af1W2Iu9K7epl8EdNkdyHyhNQfH3MaWcNfP5ukDriLE=";
+    sha256 = "sha256-yk8mW07VmABq4XSOcNKYSs04xpZQfzdDBeQFGFP6u/Y=";
   };
 
-  cargoSha256 = "sha256-HInvYDDqvkqewgIGd7nQYD+djH7lTc4vp3eVzg706+8=";
+  cargoSha256 = "sha256-rX4ZfcGlKe+v9UvvfWODaulAVkUbq2jvtuHP504uiX4=";
 
   buildInputs = lib.optional stdenv.isDarwin Foundation;
 
diff --git a/pkgs/tools/misc/trash-cli/default.nix b/pkgs/tools/misc/trash-cli/default.nix
index 5824e9cc495..5cbda62e51b 100644
--- a/pkgs/tools/misc/trash-cli/default.nix
+++ b/pkgs/tools/misc/trash-cli/default.nix
@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "trash-cli";
-  version = "0.21.7.24";
+  version = "0.21.10.24";
 
   src = fetchFromGitHub {
     owner = "andreafrancia";
     repo = "trash-cli";
     rev = version;
-    sha256 = "082mfl4mza4xkm3fdn5aka9rsbd8c149qj3cqqk62idrnszmgzg5";
+    sha256 = "01is32lk6prwhajvlmgn3xs4fcpmiqivizcqkj9k80jx6mqjifzs";
   };
 
   propagatedBuildInputs = [ python3Packages.psutil ];
diff --git a/pkgs/tools/misc/tz/default.nix b/pkgs/tools/misc/tz/default.nix
index c46137bd9e5..8148dfdec70 100644
--- a/pkgs/tools/misc/tz/default.nix
+++ b/pkgs/tools/misc/tz/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "tz";
-  version = "0.5";
+  version = "0.6.1";
 
   src = fetchFromGitHub {
     owner = "oz";
     repo = "tz";
     rev = "v${version}";
-    sha256 = "sha256-OwjhV3n1B1yQTNYm4VOW500t0524g85YYiOAAu9yPeo=";
+    sha256 = "sha256-D0rakLZ+swrDwBMcr+EJPgaYsQTWob50QteW1PoIdNk=";
   };
 
-  vendorSha256 = "sha256-Soa87I7oMa34LjYKxNAz9Limi0kQ6JUtb/zI4G7yZnw=";
+  vendorSha256 = "sha256-gMHPWf/kFb55GyyMciLWRzvrQXUGDQ72RNkIhkMVe54=";
 
   meta = with lib; {
     description = "A time zone helper";
diff --git a/pkgs/tools/misc/uutils-coreutils/default.nix b/pkgs/tools/misc/uutils-coreutils/default.nix
index 8abfb077596..62810606755 100644
--- a/pkgs/tools/misc/uutils-coreutils/default.nix
+++ b/pkgs/tools/misc/uutils-coreutils/default.nix
@@ -12,19 +12,19 @@
 
 stdenv.mkDerivation rec {
   pname = "uutils-coreutils";
-  version = "0.0.7";
+  version = "0.0.8";
 
   src = fetchFromGitHub {
     owner = "uutils";
     repo = "coreutils";
     rev = version;
-    sha256 = "sha256-XI6061nCVyL8Q1s+QH75IesneJNhbhxGnILZxQCa5LU=";
+    sha256 = "0hx5ypy58d182gxpgs0dxcw03pdgvrcikbhczg6yqpdjjh7163as";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-bfwWyeuslLjh4OCt+H8CM8hCrRFqlibOS8gS64lysa0=";
+    hash = "sha256:1ynw97dr40yg18jaqgvz3shs0s0j6pvvlkrbka2ganiv8c9fvbyw";
   };
 
   nativeBuildInputs = [ rustPlatform.cargoSetupHook sphinx ];
diff --git a/pkgs/tools/misc/yubikey-manager-qt/default.nix b/pkgs/tools/misc/yubikey-manager-qt/default.nix
index 5ef75778f25..0a5ccda2ced 100644
--- a/pkgs/tools/misc/yubikey-manager-qt/default.nix
+++ b/pkgs/tools/misc/yubikey-manager-qt/default.nix
@@ -14,11 +14,11 @@
 
 mkDerivation rec {
   pname = "yubikey-manager-qt";
-  version = "1.2.3";
+  version = "1.2.4";
 
   src = fetchurl {
     url = "https://developers.yubico.com/${pname}/Releases/${pname}-${version}.tar.gz";
-    sha256 = "sha256-54HvuJXjm846sBxwNHLmaBXvO24bbBDyK8YvY4I6LjY=";
+    sha256 = "sha256-PxHc7IeRsO+CPrNTofGypLLW8fSHDkcBqr75NwdlUyc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/misc/zoxide/default.nix b/pkgs/tools/misc/zoxide/default.nix
index 5fa6e849ac1..13199890ab6 100644
--- a/pkgs/tools/misc/zoxide/default.nix
+++ b/pkgs/tools/misc/zoxide/default.nix
@@ -10,13 +10,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "zoxide";
-  version = "0.7.7";
+  version = "0.7.9";
 
   src = fetchFromGitHub {
     owner = "ajeetdsouza";
     repo = "zoxide";
     rev = "v${version}";
-    sha256 = "18sm7smp0r7rmbq6ajl905947l5vni7hb4dfd0hhnrqjxwlkynds";
+    sha256 = "sha256-afjEqHUoLYS+IOMnWocT5dVkjWdWGavJn7q9Fqjliss=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
@@ -28,7 +28,7 @@ rustPlatform.buildRustPackage rec {
       --replace '"fzf"' '"${fzf}/bin/fzf"'
   '';
 
-  cargoSha256 = "0km4bgdl03m5ri4wzy0fsvvwlifx99m9x2j599x58ryq6lx2kkyc";
+  cargoSha256 = "sha256-CgbjSP8QotCxQ8n8SLVuLpkg8hLuRYZwsl/9HsrkCt8=";
 
   postInstall = ''
     installManPage man/*
diff --git a/pkgs/tools/networking/amass/default.nix b/pkgs/tools/networking/amass/default.nix
index caecece80ae..84f3e8b56e1 100644
--- a/pkgs/tools/networking/amass/default.nix
+++ b/pkgs/tools/networking/amass/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "amass";
-  version = "3.14.1";
+  version = "3.14.2";
 
   src = fetchFromGitHub {
     owner = "OWASP";
     repo = "Amass";
     rev = "v${version}";
-    sha256 = "sha256-AKvTnr1NeoTMBn5KNuqdR1z1P/pkQU9E1WrPQPhl8Yw=";
+    sha256 = "sha256-tyM9MscitFgV6XW7hwSrZfdYAv+08yN09ibA6OnUidA=";
   };
 
-  vendorSha256 = "sha256-v+x0S47dEgRLr2Yv8t1GnFM/iQ9bKKanPhPJMI+mF7s=";
+  vendorSha256 = "sha256-Ty1feBGgn5w6BXTEqdzWRzmUuUqRZaE4GiQrRMB3yrM=";
 
   outputs = [ "out" "wordlists" ];
 
diff --git a/pkgs/tools/networking/brook/default.nix b/pkgs/tools/networking/brook/default.nix
index c45f79fb242..ac81453e656 100644
--- a/pkgs/tools/networking/brook/default.nix
+++ b/pkgs/tools/networking/brook/default.nix
@@ -17,7 +17,7 @@ buildGoModule rec {
     homepage = "https://github.com/txthinking/brook";
     description = "A cross-platform Proxy/VPN software";
     license = with licenses; [ gpl3Only ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
     maintainers = with maintainers; [ xrelkd ];
   };
 }
diff --git a/pkgs/tools/networking/curl/CVE-2021-22945.patch b/pkgs/tools/networking/curl/CVE-2021-22945.patch
new file mode 100644
index 00000000000..f8e570d2d65
--- /dev/null
+++ b/pkgs/tools/networking/curl/CVE-2021-22945.patch
@@ -0,0 +1,27 @@
+From 43157490a5054bd24256fe12876931e8abc9df49 Mon Sep 17 00:00:00 2001
+From: z2_ on hackerone <>
+Date: Tue, 24 Aug 2021 09:50:33 +0200
+Subject: [PATCH] mqtt: clear the leftovers pointer when sending succeeds
+
+CVE-2021-22945
+
+Bug: https://curl.se/docs/CVE-2021-22945.html
+---
+ lib/mqtt.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/lib/mqtt.c b/lib/mqtt.c
+index f077e6c3dc44..fcd40b41e600 100644
+--- a/lib/mqtt.c
++++ b/lib/mqtt.c
+@@ -128,6 +128,10 @@ static CURLcode mqtt_send(struct Curl_easy *data,
+     mq->sendleftovers = sendleftovers;
+     mq->nsend = nsend;
+   }
++  else {
++    mq->sendleftovers = NULL;
++    mq->nsend = 0;
++  }
+   return result;
+ }
+ 
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index b3572e01c96..7d6b96ac9f0 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -57,6 +57,7 @@ stdenv.mkDerivation rec {
     ./CVE-2021-22897.patch
     ./CVE-2021-22898.patch
     ./CVE-2021-22901.patch
+    ./CVE-2021-22945.patch
   ];
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
diff --git a/pkgs/tools/networking/dnscrypt-proxy2/default.nix b/pkgs/tools/networking/dnscrypt-proxy2/default.nix
index ced5b477465..af4f1db4cd1 100644
--- a/pkgs/tools/networking/dnscrypt-proxy2/default.nix
+++ b/pkgs/tools/networking/dnscrypt-proxy2/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "dnscrypt-proxy2";
-  version = "2.1.0";
+  version = "2.1.1";
 
   vendorSha256 = null;
 
@@ -12,7 +12,7 @@ buildGoModule rec {
     owner = "DNSCrypt";
     repo = "dnscrypt-proxy";
     rev = version;
-    sha256 = "sha256-HU5iy1dJbCp/PHnJjLi6MM+axz5Nrlcad5GEkD2p874=";
+    sha256 = "sha256-BtH/h2HejXDWSoqWRTjZXMLYDRoMe8lSUDX6Gay1gA8=";
   };
 
   meta = with lib; {
diff --git a/pkgs/tools/networking/dnsproxy/default.nix b/pkgs/tools/networking/dnsproxy/default.nix
index b7b75037ebb..b412c7bf46c 100644
--- a/pkgs/tools/networking/dnsproxy/default.nix
+++ b/pkgs/tools/networking/dnsproxy/default.nix
@@ -1,24 +1,26 @@
-{ lib, fetchFromGitHub, buildGoModule }:
+{ lib, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
   pname = "dnsproxy";
-  version = "0.39.7";
+  version = "0.39.9";
 
   src = fetchFromGitHub {
     owner = "AdguardTeam";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-jU5O+t8muaIM7JhuNhqfWh1pWezaFvdg+oRPYAQpIkk=";
+    sha256 = "sha256-HcyzrGtBktScTPch6rCKj5Hr7VS9kf3cCHhDVaZKxG0=";
   };
 
   vendorSha256 = null;
 
+  ldflags = [ "-s" "-w" "-X" "main.VersionString=${version}" ];
+
   doCheck = false;
 
   meta = with lib; {
     description = "Simple DNS proxy with DoH, DoT, and DNSCrypt support";
     homepage = "https://github.com/AdguardTeam/dnsproxy";
-    license = licenses.gpl3;
+    license = licenses.asl20;
     maintainers = with maintainers; [ contrun ];
   };
 }
diff --git a/pkgs/tools/networking/ferm/default.nix b/pkgs/tools/networking/ferm/default.nix
index 29f9481fe32..580ca848c62 100644
--- a/pkgs/tools/networking/ferm/default.nix
+++ b/pkgs/tools/networking/ferm/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, makeWrapper, perl, ebtables, ipset, iptables, nixosTests }:
+{ lib, stdenv, fetchurl, makeWrapper, perl, iptables, nixosTests }:
 
 let
   inherit (lib.versions) majorMinor;
@@ -23,7 +23,7 @@ in stdenv.mkDerivation rec {
   postInstall = ''
     rm -r $out/lib/systemd
     for i in "$out/sbin/"*; do
-      wrapProgram "$i" --prefix PATH : "${lib.makeBinPath [ iptables ipset ebtables ]}"
+      wrapProgram "$i" --prefix PATH : "${lib.makeBinPath [ iptables ]}"
     done
   '';
 
diff --git a/pkgs/tools/networking/flannel/plugin.nix b/pkgs/tools/networking/flannel/plugin.nix
index 51e29a31ddc..db55a3dfd04 100644
--- a/pkgs/tools/networking/flannel/plugin.nix
+++ b/pkgs/tools/networking/flannel/plugin.nix
@@ -2,22 +2,29 @@
 
 buildGoModule rec {
   pname = "cni-plugin-flannel";
-  version = "1.1";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "flannel-io";
     repo = "cni-plugin";
     rev = "v${version}";
-    sha256 = "sha256-DZC6uJR6TIHdmu8kZcbM+RC7pdejqLCOep0v3PM8/QY=";
+    sha256 = "sha256-zWxw4LZIlkT88yGTnxdupq7cUSacNRxPzzp01O9USDw=";
   };
 
-  vendorSha256 = "sha256-TLAwE3pTnJYOi1AsOQfsG6t3xLKOah/7DvYjsqyltKs=";
+  vendorSha256 = "sha256-zteMlrvRTVxOFlBy+z/qfiSii8+c8PMapwIsdbN+Aig=";
 
   postInstall = ''
     mv $out/bin/cni-plugin $out/bin/flannel
   '';
 
   doCheck = false;
+  doInstallCheck = true;
+
+  installCheckPhase = ''
+    runHook preInstallCheck
+    $out/bin/flannel 2>&1 | fgrep -q v$version
+    runHook postInstallCheck
+  '';
 
   meta = with lib; {
     description = "flannel CNI plugin";
diff --git a/pkgs/tools/networking/frp/default.nix b/pkgs/tools/networking/frp/default.nix
index 1fc91277ef3..80108f77fe5 100644
--- a/pkgs/tools/networking/frp/default.nix
+++ b/pkgs/tools/networking/frp/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "frp";
-  version = "0.37.1";
+  version = "0.38.0";
 
   src = fetchFromGitHub {
     owner = "fatedier";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-TEVSxTzMgoIPcIUmhtRnFSp3xClJmOsIUjpKEr5sId8=";
+    sha256 = "sha256-wdK8o+Id7+YiSk7nZv04kTYa/9YOypstlecu6TPFI6w=";
   };
 
-  vendorSha256 = "sha256-4vvIobj1I7FbPVJJG4NZogwv4BMo7GRa5Fo5gO2Daws=";
+  vendorSha256 = "sha256-R//kD9A6U9m/7Q7FPToA5kn0kzR7W/A82HezA/+dCFY=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/networking/getmail6/default.nix b/pkgs/tools/networking/getmail6/default.nix
index 045ead7569d..15fa401ec06 100644
--- a/pkgs/tools/networking/getmail6/default.nix
+++ b/pkgs/tools/networking/getmail6/default.nix
@@ -5,13 +5,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "getmail6";
-  version = "6.18.4";
+  version = "6.18.5";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "1pxrwqpg8vnrrljigzzaq8g2g6nx55x7a8q032bp4wqyhc6jhpxq";
+    sha256 = "1bckrnvjkkbrybs9ccknd4vakzvd7vpp541p2cpv4isaizyxp2ji";
   };
 
   # needs a Docker setup
diff --git a/pkgs/tools/networking/globalprotect-openconnect/default.nix b/pkgs/tools/networking/globalprotect-openconnect/default.nix
index d61668f7b65..34fd3ef081f 100644
--- a/pkgs/tools/networking/globalprotect-openconnect/default.nix
+++ b/pkgs/tools/networking/globalprotect-openconnect/default.nix
@@ -4,14 +4,14 @@
 
 stdenv.mkDerivation rec {
   pname = "globalprotect-openconnect";
-  version = "1.2.6";
+  version = "1.3.4";
 
   src = fetchFromGitHub {
     owner = "yuezk";
     repo = "GlobalProtect-openconnect";
     rev = "c14a6ad1d2b62f8d297bc4cfbcb1dcea4d99112f";
     fetchSubmodules = true;
-    sha256 = "1zkc3vk1j31n2zs5ammzv23dah7x163gfrzz222ynbkvsccrhzrk";
+    sha256 = "sha256-M3+YGdN7LuuFEP9n94YJ/UDVhti/VlX0FzYMGeYebP4=";
   };
 
   nativeBuildInputs = [ qmake wrapQtAppsHook ];
diff --git a/pkgs/tools/networking/gobgp/default.nix b/pkgs/tools/networking/gobgp/default.nix
index 9c39b6783b3..a89c3d7ec40 100644
--- a/pkgs/tools/networking/gobgp/default.nix
+++ b/pkgs/tools/networking/gobgp/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "gobgp";
-  version = "2.31.0";
+  version = "2.32.0";
 
   src = fetchFromGitHub {
     owner = "osrg";
     repo = "gobgp";
     rev = "v${version}";
-    sha256 = "sha256-Q55BA5iMZP5D8lLfJn82fsxQ0SP5e4OdXtGly4j3dXU=";
+    sha256 = "sha256-+FVd/I1folRswTPIq09xpTCai4+FVa6TYDsaPE8sYR4=";
   };
 
   vendorSha256 = "sha256-+dX/XByFW5/zvfXvyWePAv9X71dJEKaQf6xNXAXoMxw=";
diff --git a/pkgs/tools/networking/gping/default.nix b/pkgs/tools/networking/gping/default.nix
index a6ace183df6..a08c02806e7 100644
--- a/pkgs/tools/networking/gping/default.nix
+++ b/pkgs/tools/networking/gping/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gping";
-  version = "1.2.1";
+  version = "1.2.6";
 
   src = fetchFromGitHub {
     owner = "orf";
     repo = "gping";
-    rev = "v${version}";
-    sha256 = "sha256-lApm1JLXNjDKLj6zj25OaZDVp7lLW3qyrDsvJrudl8I=";
+    rev = "gping-v${version}";
+    sha256 = "sha256-Sxmwuf+iTBTlpfMFCEUp6JyEaoHgmLIKB/gws2KY/xc=";
   };
 
-  cargoSha256 = "sha256-d1NjPwT3YDp1U9JWeUejpWDbJonFlt5lYbUf7p3jVT0=";
+  cargoSha256 = "sha256-xEASs6r5zxYJXS+at6aX5n0whGp5qwuNwq6Jh0GM+/4=";
 
   buildInputs = lib.optional stdenv.isDarwin libiconv;
 
diff --git a/pkgs/tools/networking/grpcui/default.nix b/pkgs/tools/networking/grpcui/default.nix
index 1fa47ba917f..14d790fedec 100644
--- a/pkgs/tools/networking/grpcui/default.nix
+++ b/pkgs/tools/networking/grpcui/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "grpcui";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "fullstorydev";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1l8ldx7nx2pa2ac5znss0j0dhapn3syj02xqys4jz22hr5gvfj6m";
+    sha256 = "sha256-gHzafx3nIrdLyiGlz5v6pJ8XVT+7tDN59rsdfp1V/Q0=";
   };
 
-  vendorSha256 = "15qgpbsl41swifw8w1lx0pbniwv3rf35127ald7h1r157vfa0r8b";
+  vendorSha256 = "sha256-6K644KSmFEA60yMnw7GmCmycsb5x2stvc0unyV4pF9g=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/networking/grpcurl/default.nix b/pkgs/tools/networking/grpcurl/default.nix
index e6cd09dc2fd..d075482638f 100644
--- a/pkgs/tools/networking/grpcurl/default.nix
+++ b/pkgs/tools/networking/grpcurl/default.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "grpcurl";
-  version = "1.8.2";
+  version = "1.8.5";
 
   src = fetchFromGitHub {
     owner = "fullstorydev";
     repo = "grpcurl";
     rev = "v${version}";
-    sha256 = "sha256-/no8bRGoKibtcjaITUuzwAbX+gPHNJROSf79iuuRwe4=";
+    sha256 = "sha256-73gp3UQk7D3aWK2jtMpiY4tiVhvHkTqZipoynosd3ec=";
   };
 
   subPackages = [ "cmd/grpcurl" ];
 
-  vendorSha256 = "sha256-nl8vKVhUMSO20qCDyhNkU5cghNy8vIFqSBvLk59nbWg=";
+  vendorSha256 = "sha256-dHh8zHtU/r6AscInfNfVFd5psys2b6D1FS02lSoiGto=";
 
   ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 
diff --git a/pkgs/tools/networking/hurl/default.nix b/pkgs/tools/networking/hurl/default.nix
index 0843ba3a756..fef2493fed0 100644
--- a/pkgs/tools/networking/hurl/default.nix
+++ b/pkgs/tools/networking/hurl/default.nix
@@ -12,13 +12,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "hurl";
-  version = "1.3.1";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "Orange-OpenSource";
     repo = pname;
     rev = version;
-    sha256 = "sha256-BmBqFJ64Nolq+eGZ5D3LQU3Ek2Gs+HpH/bptCQScbIg=";
+    sha256 = "sha256-oa9J51Y6Q0nPxA9SdsEZy7F6EopS5xuh1yWyTD21mGI=";
   };
 
   nativeBuildInputs = [
@@ -37,7 +37,7 @@ rustPlatform.buildRustPackage rec {
   # Tests require network access to a test server
   doCheck = false;
 
-  cargoSha256 = "sha256-tAg3xwmh7SjJsm9r5TnhXHIDLpUQpz3YDS6gWxFgps4=";
+  cargoSha256 = "sha256-CwChbp6Un9tgJu1vtfhcFclpbvGANLLEX3lwtTQPuSg=";
 
   postInstall = ''
     python ci/gen_manpage.py docs/hurl.md > hurl.1
diff --git a/pkgs/tools/networking/modemmanager/default.nix b/pkgs/tools/networking/modemmanager/default.nix
index e352e67d3fe..29934219789 100644
--- a/pkgs/tools/networking/modemmanager/default.nix
+++ b/pkgs/tools/networking/modemmanager/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "modemmanager";
-  version = "1.16.10";
+  version = "1.18.2";
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/ModemManager/ModemManager-${version}.tar.xz";
-    sha256 = "sha256-LM8fcWwtEh6OZwm8+K8p7oaXGpCtrMoujWKIswJ4hi4=";
+    sha256 = "sha256-N0vhWK4cH7OKKe7xzDzfif81NrSP8TINIIqyBOpsX4o=";
   };
 
   nativeBuildInputs = [ vala gobject-introspection gettext pkg-config ];
diff --git a/pkgs/tools/networking/networkmanager/default.nix b/pkgs/tools/networking/networkmanager/default.nix
index 8a1a6dd8fa1..3913cb0520b 100644
--- a/pkgs/tools/networking/networkmanager/default.nix
+++ b/pkgs/tools/networking/networkmanager/default.nix
@@ -54,11 +54,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "networkmanager";
-  version = "1.32.10";
+  version = "1.32.12";
 
   src = fetchurl {
     url = "mirror://gnome/sources/NetworkManager/${lib.versions.majorMinor version}/NetworkManager-${version}.tar.xz";
-    sha256 = "sha256-PlzMZoBWWePxGnGOOlmflya3mgHW/xSBS+ati8Xai7g=";
+    sha256 = "sha256-qKs2oKUC/nPNjjustlhfl/u5Tr73nids268Rwz/49Us=";
   };
 
   outputs = [ "out" "dev" "devdoc" "man" "doc" ];
diff --git a/pkgs/tools/networking/openssh/common.nix b/pkgs/tools/networking/openssh/common.nix
index eaa42039dba..fefa80b9c4f 100644
--- a/pkgs/tools/networking/openssh/common.nix
+++ b/pkgs/tools/networking/openssh/common.nix
@@ -122,7 +122,7 @@ stdenv.mkDerivation rec {
     changelog = "https://www.openssh.com/releasenotes.html";
     license = licenses.bsd2;
     platforms = platforms.unix ++ platforms.windows;
-    maintainers = with maintainers; [ eelco aneeshusa ];
+    maintainers = (extraMeta.maintainers or []) ++ (with maintainers; [ eelco aneeshusa ]);
     mainProgram = "ssh";
   } // extraMeta;
 }
diff --git a/pkgs/tools/networking/openssh/default.nix b/pkgs/tools/networking/openssh/default.nix
index c8bc1f8a1dd..4bc18171716 100644
--- a/pkgs/tools/networking/openssh/default.nix
+++ b/pkgs/tools/networking/openssh/default.nix
@@ -1,4 +1,4 @@
-{ callPackage, fetchurl, fetchpatch, fetchFromGitHub, autoreconfHook }:
+{ callPackage, lib, fetchurl, fetchpatch, fetchFromGitHub, autoreconfHook }:
 let
   common = opts: callPackage (import ./common.nix opts) { };
 in
@@ -6,14 +6,15 @@ in
 
   openssh = common rec {
     pname = "openssh";
-    version = "8.7p1";
+    version = "8.8p1";
 
     src = fetchurl {
       url = "mirror://openbsd/OpenSSH/portable/openssh-${version}.tar.gz";
-      sha256 = "090yxpi03pxxzb4ppx8g8hdpw7c4nf8p0avr6c7ybsaana5lp8vw";
+      sha256 = "1s8z6f7mi1pwsl79cqai8cr350m5lf2ifcxff57wx6mvm478k425";
     };
 
     extraPatches = [ ./ssh-keysign-8.5.patch ];
+    extraMeta.maintainers = with lib.maintainers; [ das_j ];
   };
 
   openssh_hpn = common rec {
diff --git a/pkgs/tools/networking/ppp/default.nix b/pkgs/tools/networking/ppp/default.nix
index 708932ac1c9..5608b032ac5 100644
--- a/pkgs/tools/networking/ppp/default.nix
+++ b/pkgs/tools/networking/ppp/default.nix
@@ -4,6 +4,7 @@
 , substituteAll
 , libpcap
 , openssl
+, bash
 }:
 
 stdenv.mkDerivation rec {
@@ -31,18 +32,22 @@ stdenv.mkDerivation rec {
   buildInputs = [
     libpcap
     openssl
+    bash
   ];
 
   postPatch = ''
-    # strip is not found when cross compiling with seemingly no way to point
-    # make to the right place, fixup phase will correctly strip
-    # everything anyway so we remove it from the Makefiles
     for file in $(find -name Makefile.linux); do
-      substituteInPlace "$file" --replace '$(INSTALL) -s' '$(INSTALL)'
       substituteInPlace "$file" --replace '-m 4550' '-m 550'
     done
+
+    patchShebangs --host \
+      scripts/{pon,poff,plog}
   '';
 
+  makeFlags = [
+    "CC=${stdenv.cc.targetPrefix}cc"
+  ];
+
   installPhase = ''
     runHook preInstall
     mkdir -p $out/bin
@@ -52,9 +57,7 @@ stdenv.mkDerivation rec {
   '';
 
   postFixup = ''
-    for tgt in pon poff plog; do
-      substituteInPlace "$out/bin/$tgt" --replace "/usr/sbin" "$out/bin"
-    done
+    substituteInPlace "$out/bin/pon" --replace "/usr/sbin" "$out/bin"
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/networking/s5cmd/default.nix b/pkgs/tools/networking/s5cmd/default.nix
index c472e2626e0..f7847f324cb 100644
--- a/pkgs/tools/networking/s5cmd/default.nix
+++ b/pkgs/tools/networking/s5cmd/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "s5cmd";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "peak";
     repo = "s5cmd";
     rev = "v${version}";
-    sha256 = "sha256-sood01wI0ZnkXUKDHX14ix3bWHR/PRu6+MDNeos5Jk0=";
+    sha256 = "sha256-12bKMZ6SMPsqLqaBTVxCxvs7PZ0CKimI9wlqvWZ/bgY=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/tools/networking/shadowsocks-rust/default.nix b/pkgs/tools/networking/shadowsocks-rust/default.nix
index 97157071733..065b842c384 100644
--- a/pkgs/tools/networking/shadowsocks-rust/default.nix
+++ b/pkgs/tools/networking/shadowsocks-rust/default.nix
@@ -2,28 +2,36 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "shadowsocks-rust";
-  version = "1.10.7";
+  version = "1.11.2";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "shadowsocks";
     repo = pname;
-    sha256 = "08k5j469750bhlq49qc5nwc2jjgmy9qsm58nf2jfwhxlpflv12sc";
+    sha256 = "0ry3zfwxs5j243jpbp5ymnz14ycyk6gpgb50lcazhn1yy52p8wac";
   };
 
-  cargoSha256 = "1r8w5cdygd26m95q9qpqa85aixx25jr510hpjlllbpfvm7zjpbqk";
+  cargoSha256 = "1hvrp3zf5h33j6fgqyzn2jvjbyi8c8pyqwrj5wg3lw38h0z5rvaj";
 
   RUSTC_BOOTSTRAP = 1;
 
   buildInputs = lib.optionals stdenv.isDarwin [ CoreServices libiconv ];
 
-  checkFlags = [ "--skip=http_proxy" "--skip=udp_tunnel" ];
+  # all of these rely on connecting to www.example.com:80
+  checkFlags = [
+    "--skip=http_proxy"
+    "--skip=tcp_tunnel"
+    "--skip=udp_tunnel"
+    "--skip=udp_relay"
+    "--skip=socks4_relay_connect"
+    "--skip=socks5_relay_aead"
+    "--skip=socks5_relay_stream"
+  ];
 
   meta = with lib; {
     homepage = "https://github.com/shadowsocks/shadowsocks-rust";
     description = "A Rust port of shadowsocks";
     license = licenses.mit;
     maintainers = [ maintainers.marsam ];
-    broken = stdenv.isAarch64;  # crypto2 crate doesn't build on aarch64
   };
 }
diff --git a/pkgs/tools/networking/shorewall/default.nix b/pkgs/tools/networking/shorewall/default.nix
index f95fc9d92b1..0c9e515ce09 100644
--- a/pkgs/tools/networking/shorewall/default.nix
+++ b/pkgs/tools/networking/shorewall/default.nix
@@ -1,10 +1,8 @@
 { coreutils
-, ebtables
 , fetchurl
 , gnugrep
 , gnused
 , iproute2
-, ipset
 , iptables
 , perl
 , perlPackages
@@ -17,8 +15,6 @@ let
            [ "${coreutils}/bin"
              "${iproute2}/bin"
              "${iptables}/bin"
-             "${ipset}/bin"
-             "${ebtables}/bin"
              "${util-linux}/bin"
              "${gnugrep}/bin"
              "${gnused}/bin"
@@ -47,9 +43,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     coreutils
     iproute2
-    ipset
     iptables
-    ebtables
     util-linux
     gnugrep
     gnused
diff --git a/pkgs/tools/networking/sniffglue/default.nix b/pkgs/tools/networking/sniffglue/default.nix
index 502ab323e8e..48ffb550c20 100644
--- a/pkgs/tools/networking/sniffglue/default.nix
+++ b/pkgs/tools/networking/sniffglue/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "sniffglue";
-  version = "0.13.1";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "kpcyrd";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-P8ubw523sw1O6Gpruy1Wa/Y0I3qJgvMdT53wBBoEGhE=";
+    sha256 = "sha256-s+2YzfSy7+o0VZZ4j/Cfd6F5GvBytthmDJqrPw+7SU0=";
   };
 
-  cargoSha256 = "sha256-+Wh+/C9LvYppCghv11e8NKNhiMy0SV4S3nEWA6b1hQk=";
+  cargoSha256 = "sha256-4G1OGY7/vE8NKBFeuOZzqyZ0DQN4hy/HBO9qrEtBYlM=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/tools/networking/ssldump/default.nix b/pkgs/tools/networking/ssldump/default.nix
index 0d3e5ccf07e..dd01bf50440 100644
--- a/pkgs/tools/networking/ssldump/default.nix
+++ b/pkgs/tools/networking/ssldump/default.nix
@@ -47,6 +47,6 @@ stdenv.mkDerivation rec {
     homepage = "http://ssldump.sourceforge.net";
     license = "BSD-style";
     maintainers = with maintainers; [ aycanirican ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/tools/networking/subfinder/default.nix b/pkgs/tools/networking/subfinder/default.nix
index ae87d02fe23..7960324cbd7 100644
--- a/pkgs/tools/networking/subfinder/default.nix
+++ b/pkgs/tools/networking/subfinder/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "subfinder";
-  version = "2.4.8";
+  version = "2.4.9";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1g1j3il1a595g7z8blhvyd5l03h6kccl7mzrx51c33jz74cms5kn";
+    sha256 = "sha256-BtyPy6ow3flHl4jM9cfF+y3JCtLYx2c+a8f7ol3nQj4=";
   };
 
-  vendorSha256 = "1jmik0zmfy1n3g4yjkskiqzd28dpywf0hw6adgz2jshlhka58iw0";
+  vendorSha256 = "sha256-jIU5UZdmBUqyjva+g7zoijPqHF2p3vzImEFQCP/CFwE=";
 
   modRoot = "./v2";
 
diff --git a/pkgs/tools/networking/swagger-codegen3/default.nix b/pkgs/tools/networking/swagger-codegen3/default.nix
index 8fc908a1f2c..2981196ef7c 100644
--- a/pkgs/tools/networking/swagger-codegen3/default.nix
+++ b/pkgs/tools/networking/swagger-codegen3/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchurl, jre, makeWrapper }:
 
 stdenv.mkDerivation rec {
-  version = "3.0.25";
+  version = "3.0.29";
   pname = "swagger-codegen";
 
   jarfilename = "${pname}-cli-${version}.jar";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://repo1.maven.org/maven2/io/swagger/codegen/v3/${pname}-cli/${version}/${jarfilename}";
-    sha256 = "1rdz45kmmg60fs7ddnla1xq30nah6s6rd18fqbjbjxng8r92brnd";
+    sha256 = "sha256-sEwqUmtWaoBV0QmdP8ibm3neqWHk7+tWLAuO2FaCUtQ=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/tools/networking/tendermint/default.nix b/pkgs/tools/networking/tendermint/default.nix
index 1f363ae3f9f..4c154df6ebf 100644
--- a/pkgs/tools/networking/tendermint/default.nix
+++ b/pkgs/tools/networking/tendermint/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "tendermint";
-  version = "0.34.13";
+  version = "0.34.14";
 
   src = fetchFromGitHub {
     owner = "tendermint";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-z3rbDdk68PTvJ/LPnAx8kOjCGXMfxQA0LK9GLYgaiUY=";
+    sha256 = "sha256-/FYkwHamJTty/h80KaNAmyNg0wCqiOAA3o2whouAOZc=";
   };
 
-  vendorSha256 = "sha256-bwDyis/dHKSqBFw5jFWSZip5YjBe1bq/ieg6Jg0P/TM=";
+  vendorSha256 = "sha256-9wjiL8/fhWLuGglFkS8OH026zwbrmuadB3goBqFqnvc=";
 
   subPackages = [ "cmd/tendermint" ];
 
diff --git a/pkgs/tools/networking/vtun/default.nix b/pkgs/tools/networking/vtun/default.nix
deleted file mode 100644
index 61c18af1656..00000000000
--- a/pkgs/tools/networking/vtun/default.nix
+++ /dev/null
@@ -1,37 +0,0 @@
-{ lib, stdenv, fetchurl, fetchpatch, openssl, lzo, zlib, bison, flex }:
-
-stdenv.mkDerivation rec {
-  pname = "vtun";
-  version = "3.0.4";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/vtun/vtun-${version}.tar.gz";
-    sha256 = "1fcqzn2bdjw31j1hvv6lg99v2phhszm29kp2xambxzp32mmxzy5b";
-  };
-
-  patches = [
-    (fetchpatch { url = "http://sources.debian.net/data/main/v/vtun/3.0.3-2.2/debian/patches/08-gcc5-inline.patch";
-                 sha256 = "18sys97v2hx6vac5zp3ld7sa6kz4izv3g9dnkm0lflbaxhym2vs1";
-                })
-  ];
-
-  postPatch = ''
-    sed -i -e 's/-m 755//' -e 's/-o root -g 0//' Makefile.in
-    sed -i '/strip/d' Makefile.in
-  '';
-  buildInputs = [ lzo openssl zlib bison flex ];
-
-  configureFlags = [
-    "--with-lzo-headers=${lzo}/include/lzo"
-    "--with-ssl-headers=${openssl.dev}/include/openssl"
-    "--with-blowfish-headers=${openssl.dev}/include/openssl"
-  ];
-
-  meta = with lib; {
-      description = "Virtual Tunnels over TCP/IP with traffic shaping, compression and encryption";
-      homepage = "http://vtun.sourceforge.net/";
-      license = licenses.gpl2;
-      platforms = platforms.linux;
-      maintainers = with maintainers; [ pSub ];
-  };
-}
diff --git a/pkgs/tools/networking/ytcc/default.nix b/pkgs/tools/networking/ytcc/default.nix
index 1c83acc2a18..7b6104e25fc 100644
--- a/pkgs/tools/networking/ytcc/default.nix
+++ b/pkgs/tools/networking/ytcc/default.nix
@@ -1,24 +1,28 @@
-{ lib, python3Packages, fetchFromGitHub, gettext }:
+{ lib, python3Packages, fetchFromGitHub, gettext, installShellFiles }:
 
 python3Packages.buildPythonApplication rec {
   pname = "ytcc";
-  version = "2.5.1";
+  version = "2.5.2";
 
   src = fetchFromGitHub {
     owner = "woefe";
     repo = "ytcc";
     rev = "v${version}";
-    sha256 = "1w2frcy51kwsvd486awhpl5kkm11zj1nw3nnv9337316gfs213nw";
+    sha256 = "0xpinilb8rnha35laxq076p6v7hdis6davr9ckm5xycs3m4aj7s8";
   };
 
-  nativeBuildInputs = [ gettext ];
+  postPatch = ''
+    substituteInPlace setup.py --replace "youtube_dl" "yt_dlp"
+  '';
+
+  nativeBuildInputs = [ gettext installShellFiles ];
 
   propagatedBuildInputs = with python3Packages; [
     click
     feedparser
     lxml
     sqlalchemy
-    youtube-dl
+    yt-dlp
     wcwidth
   ];
 
@@ -38,10 +42,14 @@ python3Packages.buildPythonApplication rec {
     "test_download"
   ];
 
+  postInstall = ''
+    installManPage doc/ytcc.1
+  '';
+
   meta = {
     description = "Command Line tool to keep track of your favourite YouTube channels without signing up for a Google account";
     homepage = "https://github.com/woefe/ytcc";
     license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [ marius851000 ];
+    maintainers = with lib.maintainers; [ marius851000 marsam ];
   };
 }
diff --git a/pkgs/tools/networking/zerotierone/default.nix b/pkgs/tools/networking/zerotierone/default.nix
index f2afb6d3bae..7344b12180e 100644
--- a/pkgs/tools/networking/zerotierone/default.nix
+++ b/pkgs/tools/networking/zerotierone/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "zerotierone";
-  version = "1.6.6";
+  version = "1.8.1";
 
   src = fetchFromGitHub {
     owner = "zerotier";
     repo = "ZeroTierOne";
     rev = version;
-    sha256 = "0pi22252c21gxmjcgwmagkrnp5y1hhqrm9jkjj9pg1nlzzrlyrnm";
+    sha256 = "sha256-nr5qvo/SLzQ16B/83lCzlQ5zduPGxOhfqWat/Grsf/Q=";
   };
 
   preConfigure = ''
diff --git a/pkgs/tools/nix/statix/default.nix b/pkgs/tools/nix/statix/default.nix
new file mode 100644
index 00000000000..c78ace218c0
--- /dev/null
+++ b/pkgs/tools/nix/statix/default.nix
@@ -0,0 +1,28 @@
+{ lib, rustPlatform, fetchFromGitHub, withJson ? true }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "statix";
+  # also update version of the vim plugin in pkgs/misc/vim-plugins/overrides.nix
+  # the version can be found in flake.nix of the source code
+  version = "0.3.5";
+
+  src = fetchFromGitHub {
+    owner = "nerdypepper";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-vJvHmg6X/B6wQYjeX1FZC4MDGo0HkKbTmQH+l4tZAwg=";
+  };
+
+  cargoSha256 = "sha256-OfLpnVe1QIjpjpD4ticG/7AxPGFMMjBWN3DdLZq6pA8=";
+
+  cargoBuildFlags = lib.optionals withJson [ "--features" "json" ];
+
+  cargoCheckFlags = cargoBuildFlags;
+
+  meta = with lib; {
+    description = "Lints and suggestions for the nix programming language";
+    homepage = "https://github.com/nerdypepper/statix";
+    license = licenses.mit;
+    maintainers = with maintainers; [ figsoda nerdypepper ];
+  };
+}
diff --git a/pkgs/tools/package-management/cargo-release/default.nix b/pkgs/tools/package-management/cargo-release/default.nix
index 9b7f78fa3b5..612ef69be58 100644
--- a/pkgs/tools/package-management/cargo-release/default.nix
+++ b/pkgs/tools/package-management/cargo-release/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-release";
-  version = "0.17.1";
+  version = "0.18.2";
 
   src = fetchFromGitHub {
     owner = "crate-ci";
     repo = "cargo-release";
     rev = "v${version}";
-    sha256 = "sha256-zQwgnZFYXYG1NWzC9ZultTUlU+o/Sr2u3CnRXzr+Lk8=";
+    sha256 = "sha256-DsFa+bt8McpoLb3JC3EqDwFX0H/ynXosiRThOhRceLU=";
   };
 
-  cargoSha256 = "sha256-ORv5O7DhZhmmOM5RnRIIe/WBU77iyROPIRGMJikUCgo=";
+  cargoSha256 = "sha256-cwPyCRg3NOxmkoy0qdqlyeTM43nz0Yw2/nxe418rXC4=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/tools/package-management/nix-du/default.nix b/pkgs/tools/package-management/nix-du/default.nix
index 75de1caa2db..09a5ddbe872 100644
--- a/pkgs/tools/package-management/nix-du/default.nix
+++ b/pkgs/tools/package-management/nix-du/default.nix
@@ -1,17 +1,27 @@
-{ lib, stdenv, fetchFromGitHub, rustPlatform, nix, boost, graphviz, Security, pkg-config }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, rustPlatform
+, nix
+, nlohmann_json
+, boost
+, graphviz
+, Security
+, pkg-config
+}:
 
 rustPlatform.buildRustPackage rec {
   pname = "nix-du";
-  version = "0.3.4";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "symphorien";
     repo = "nix-du";
     rev = "v${version}";
-    sha256 = "0iwlprjbphwsrxdhgsxa8ja73snsyh0rdxrpsf1ygid2ky5vc83f";
+    sha256 = "0nl451xfby8krxl2wyn91mm0rvacj1718qbqw6k56dwsqlnnxmx0";
   };
 
-  cargoSha256 = "19fwkw9iswzkhqgfq7pmcabqmq5c7vvirwaxbfjshkwcgn47rgjl";
+  cargoSha256 = "0swdlp3qdisr8gxihg5syplzssggx9avmdb2w70056436046gs1r";
 
   doCheck = true;
   checkInputs = [ nix graphviz ];
@@ -19,6 +29,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [
     boost
     nix
+    nlohmann_json
   ] ++ lib.optionals stdenv.isDarwin [ Security ];
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index 2302e14b1aa..db9b2c9465f 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -208,7 +208,7 @@ common =
     patches = (drv.patches or []) ++ [
       # Part of the GC solution in https://github.com/NixOS/nix/pull/4944
       (fetchpatch {
-        url = https://github.com/hercules-ci/nix/raw/5c58d84a76d96f269e3ff1e72c9c9ba5f68576af/boehmgc-coroutine-sp-fallback.diff;
+        url = "https://github.com/hercules-ci/nix/raw/5c58d84a76d96f269e3ff1e72c9c9ba5f68576af/boehmgc-coroutine-sp-fallback.diff";
         sha256 = "sha256-JvnWVTlkltmQUs/0qApv/LPZ690UX1/2hEP+LYRwKbI=";
       })
     ];
diff --git a/pkgs/tools/package-management/nox/default.nix b/pkgs/tools/package-management/nox/default.nix
index bf98f5400b8..c949b443e36 100644
--- a/pkgs/tools/package-management/nox/default.nix
+++ b/pkgs/tools/package-management/nox/default.nix
@@ -15,7 +15,7 @@ python3Packages.buildPythonApplication rec {
   buildInputs = [ python3Packages.pbr git ];
 
   propagatedBuildInputs = with python3Packages; [
-      dogpile_cache
+      dogpile-cache
       click
       requests
       characteristic
diff --git a/pkgs/tools/security/b3sum/default.nix b/pkgs/tools/security/b3sum/default.nix
index 9238ba06b1f..9c6dca07194 100644
--- a/pkgs/tools/security/b3sum/default.nix
+++ b/pkgs/tools/security/b3sum/default.nix
@@ -2,14 +2,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "b3sum";
-  version = "1.0.0";
+  version = "1.1.0";
 
   src = fetchCrate {
     inherit version pname;
-    sha256 = "sha256-eWsvCpMG3iWB2cYIKaaP6h9QwKQQrpFNliHTqBtdzVw=";
+    sha256 = "sha256-x5gdJLcRMnmd0VLbV8cU9vrA6Ef7GysTh25bXnw6tsE=";
   };
 
-  cargoSha256 = "sha256-YglKiEz/D5+Dz6CIzWIpoc33bhMSdGTM4MP/uJCxe7E=";
+  cargoSha256 = "sha256-+JVivP4Kppb+AoVq4XhXp4k8Hb+e9uX4u5n8KXp0kfk=";
 
   meta = {
     description = "BLAKE3 cryptographic hash function";
diff --git a/pkgs/tools/security/buttercup-desktop/default.nix b/pkgs/tools/security/buttercup-desktop/default.nix
new file mode 100644
index 00000000000..07df51e84e3
--- /dev/null
+++ b/pkgs/tools/security/buttercup-desktop/default.nix
@@ -0,0 +1,33 @@
+{ lib, fetchurl, appimageTools }:
+
+let
+  pname = "buttercup-desktop";
+  version = "2.13.0";
+  name = "${pname}-${version}";
+  src = fetchurl {
+    url = "https://github.com/buttercup/buttercup-desktop/releases/download/v${version}/Buttercup-linux-x86_64.AppImage";
+    sha256 = "sha256-JXXJZyd/fp2463WyxIB+pKcNzGUFfCouPE6iTx2lhME=";
+  };
+  appimageContents = appimageTools.extractType2 { inherit name src; };
+
+in appimageTools.wrapType2 {
+  inherit name src;
+
+  extraPkgs = pkgs: (appimageTools.defaultFhsEnvArgs.multiPkgs pkgs) ++ [ pkgs.libsecret ];
+
+  extraInstallCommands = ''
+    mv $out/bin/${name} $out/bin/buttercup-desktop
+    install -m 444 -D ${appimageContents}/buttercup.desktop -t $out/share/applications
+    substituteInPlace $out/share/applications/buttercup.desktop \
+      --replace 'Exec=AppRun' 'Exec=buttercup-desktop'
+    cp -r ${appimageContents}/usr/share/icons $out/share
+  '';
+
+  meta = with lib; {
+    description = "Cross-Platform Passwords & Secrets Vault";
+    homepage = "https://buttercup.pw";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ wolfangaukang ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/tools/security/cariddi/default.nix b/pkgs/tools/security/cariddi/default.nix
index 655b55d8cc2..fe5b2f09507 100644
--- a/pkgs/tools/security/cariddi/default.nix
+++ b/pkgs/tools/security/cariddi/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "cariddi";
-  version = "1.1";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
     owner = "edoardottt";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0cwkycydwndda11m1jszbxchpqabrgspj17y2aj3y3m2x446h27z";
+    sha256 = "sha256-5FXHJvHrfmttesgI6IE3+AedLXf1skWV12+WjbR4Xy8=";
   };
 
-  vendorSha256 = "0rmiya517i9s4l9nxzwly5vq8cqhhpq66rc7y4sapyaihx20ai3r";
+  vendorSha256 = "sha256-ZIlOPOrAWdwHwgUR/9eBEXaIcNfWh7yEQ/c9iE8sLiY=";
 
   meta = with lib; {
     description = "Crawler for URLs and endpoints";
diff --git a/pkgs/tools/security/dalfox/default.nix b/pkgs/tools/security/dalfox/default.nix
index 9303058b380..d498e69b444 100644
--- a/pkgs/tools/security/dalfox/default.nix
+++ b/pkgs/tools/security/dalfox/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "dalfox";
-  version = "2.5.2";
+  version = "2.5.4";
 
   src = fetchFromGitHub {
     owner = "hahwul";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-/tS9/VxH5r4CSmxZ7uZOgAMLRtmPs+bgPtvljOhLALc=";
+    sha256 = "sha256-zwDdOj6/YcZQZW5WWMZztTVl5QsYMCcqtaAFsM+1bn0=";
   };
 
   vendorSha256 = "sha256-AZbzcGqje2u9waH2NGWITXpax2GCFqbIEd4uNiDmcIY=";
diff --git a/pkgs/tools/security/doppler/default.nix b/pkgs/tools/security/doppler/default.nix
index 18ca909cd5e..2bd087fe4a4 100644
--- a/pkgs/tools/security/doppler/default.nix
+++ b/pkgs/tools/security/doppler/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "doppler";
-  version = "3.31.1";
+  version = "3.35.0";
 
   src = fetchFromGitHub {
     owner = "dopplerhq";
     repo = "cli";
     rev = version;
-    sha256 = "sha256-m8dugkZ0n51RnclZwKGgjVG3OrDMz3MsOQMvNbG4BPU=";
+    sha256 = "sha256-Eb6msMl5X8ct9XlVlrxbnkXSEouzK/jCW94qm3PTXBQ=";
   };
 
-  vendorSha256 = "sha256-yb7L4GSKtlwagwdxBMd5aSk9fre1NKKsy6CM4Iv2ya8=";
+  vendorSha256 = "sha256-VPxHxNtDeP5CFDMTeMsZYED9ZGWMquJdeupeCVldY/E=";
 
   ldflags = [ "-X github.com/DopplerHQ/cli/pkg/version.ProgramVersion=v${version}" ];
 
diff --git a/pkgs/tools/security/exploitdb/default.nix b/pkgs/tools/security/exploitdb/default.nix
index 82c6e831636..1fe980d3c94 100644
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2021-10-23";
+  version = "2021-10-30";
 
   src = fetchFromGitHub {
     owner = "offensive-security";
     repo = pname;
     rev = version;
-    sha256 = "sha256-gNvpNs+fYETB3zKMX7pJbMEW79vH6yTX8LxvLHw9X3I=";
+    sha256 = "sha256-GwyqtoRxiijF4lewKXX8d/pmO4r+BWn8mfmApGum8/w=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/security/gpg-tui/default.nix b/pkgs/tools/security/gpg-tui/default.nix
index 666056774c4..ea144e67a41 100644
--- a/pkgs/tools/security/gpg-tui/default.nix
+++ b/pkgs/tools/security/gpg-tui/default.nix
@@ -16,16 +16,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gpg-tui";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "orhun";
     repo = "gpg-tui";
     rev = "v${version}";
-    sha256 = "sha256-UUfZd6wTBoOyBdkidzxa3Fyc3GjeGdCT0n7jKmhdNa0=";
+    sha256 = "sha256-2fTJHcJJzQIAyxLnWdoyR77tA9p/3s3UescypGwKfc0=";
   };
 
-  cargoSha256 = "sha256-yX/g/An06nx95IaxjfYVUofvDDS2ZjiNAZf3ivi6ZF0=";
+  cargoSha256 = "sha256-8dWMJZiWy0cO0CGAFEmtGYZ8bVK1ZR7qBkjKn6rLC+k=";
 
   nativeBuildInputs = [
     gpgme # for gpgme-config
diff --git a/pkgs/tools/security/grype/default.nix b/pkgs/tools/security/grype/default.nix
index b4be43311f8..8bf0c2e8dc8 100644
--- a/pkgs/tools/security/grype/default.nix
+++ b/pkgs/tools/security/grype/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "grype";
-  version = "0.22.0";
+  version = "0.24.0";
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-5TOfy7eapkvXwVC4TcSo3mWSAkLqBeVco7SG2H21lRo=";
+    sha256 = "sha256-6OCtyB5hzG3QPmXNlT8VvN8oFjaTeqEAuMFKXG0DvII=";
   };
 
-  vendorSha256 = "sha256-pgasbJdyTBIYIeaidKYFLy0LqmCTKE7IUkFqddJtcR0=";
+  vendorSha256 = "sha256-kvfzeJoonHI5Z7roHwN1ANYWyKROUd6slRb/VLbU3xo=";
 
   propagatedBuildInputs = [ docker ];
 
diff --git a/pkgs/tools/security/keyscope/default.nix b/pkgs/tools/security/keyscope/default.nix
index 12c692a1d58..dad09970b91 100644
--- a/pkgs/tools/security/keyscope/default.nix
+++ b/pkgs/tools/security/keyscope/default.nix
@@ -4,6 +4,9 @@
 , pkg-config
 , openssl
 , stdenv
+, DiskArbitration
+, Foundation
+, IOKit
 , Security
 }:
 
@@ -22,7 +25,12 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ openssl ] ++ lib.optional stdenv.isDarwin Security;
+  buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [
+    DiskArbitration
+    Foundation
+    IOKit
+    Security
+  ];
 
   # build script tries to get information from git
   postPatch = ''
diff --git a/pkgs/tools/security/kubescape/default.nix b/pkgs/tools/security/kubescape/default.nix
index 2364afc39ea..5a8e50c7096 100644
--- a/pkgs/tools/security/kubescape/default.nix
+++ b/pkgs/tools/security/kubescape/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "kubescape";
-  version = "1.0.127";
+  version = "1.0.128";
 
   src = fetchFromGitHub {
     owner = "armosec";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-01k0FJNWrLnwOGa4JgQ/HKSJNgWAzmBUWFhdPi/yPY4=";
+    sha256 = "sha256-fHXT9vg7uenFDjYmdPkMu63dlmyIATEBCxOn39c80cg=";
   };
   vendorSha256 = "sha256-cOxjsujlpRbdw4098eMHe2oNAJXWGjKbPeYpKt0DCp8=";
 
diff --git a/pkgs/tools/security/metasploit/Gemfile b/pkgs/tools/security/metasploit/Gemfile
index f26fb9850e8..9214b7837f7 100644
--- a/pkgs/tools/security/metasploit/Gemfile
+++ b/pkgs/tools/security/metasploit/Gemfile
@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 source "https://rubygems.org"
 
-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.1.11"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.1.12"
diff --git a/pkgs/tools/security/metasploit/Gemfile.lock b/pkgs/tools/security/metasploit/Gemfile.lock
index dceb4727981..809c17e914e 100644
--- a/pkgs/tools/security/metasploit/Gemfile.lock
+++ b/pkgs/tools/security/metasploit/Gemfile.lock
@@ -1,9 +1,9 @@
 GIT
   remote: https://github.com/rapid7/metasploit-framework
-  revision: 341b0cd1cdf69fe22345aea6c84ae11ba45e0d98
-  ref: refs/tags/6.1.11
+  revision: bde342fd8293e49a45ba837ca9a1fdea505bc919
+  ref: refs/tags/6.1.12
   specs:
-    metasploit-framework (6.1.11)
+    metasploit-framework (6.1.12)
       actionpack (~> 6.0)
       activerecord (~> 6.0)
       activesupport (~> 6.0)
@@ -128,13 +128,13 @@ GEM
     arel-helpers (2.12.1)
       activerecord (>= 3.1.0, < 7)
     aws-eventstream (1.2.0)
-    aws-partitions (1.518.0)
-    aws-sdk-core (3.121.3)
+    aws-partitions (1.521.0)
+    aws-sdk-core (3.121.5)
       aws-eventstream (~> 1, >= 1.0.2)
-      aws-partitions (~> 1, >= 1.239.0)
+      aws-partitions (~> 1, >= 1.520.1)
       aws-sigv4 (~> 1.1)
       jmespath (~> 1.0)
-    aws-sdk-ec2 (1.271.0)
+    aws-sdk-ec2 (1.275.0)
       aws-sdk-core (~> 3, >= 3.121.2)
       aws-sigv4 (~> 1.1)
     aws-sdk-iam (1.62.0)
@@ -360,9 +360,9 @@ GEM
       metasm
       rex-core
       rex-text
-    rex-socket (0.1.33)
+    rex-socket (0.1.34)
       rex-core
-    rex-sslscan (0.1.6)
+    rex-sslscan (0.1.7)
       rex-core
       rex-socket
       rex-text
diff --git a/pkgs/tools/security/metasploit/default.nix b/pkgs/tools/security/metasploit/default.nix
index cc6dfb018b0..e0348a15697 100644
--- a/pkgs/tools/security/metasploit/default.nix
+++ b/pkgs/tools/security/metasploit/default.nix
@@ -14,13 +14,13 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "metasploit-framework";
-  version = "6.1.11";
+  version = "6.1.12";
 
   src = fetchFromGitHub {
     owner = "rapid7";
     repo = "metasploit-framework";
     rev = version;
-    sha256 = "sha256-0C93rxVWHHZha2oRKanTm4S0qig3qZreFV08PLwShSw=";
+    sha256 = "sha256-I7wk8DBN7i4zE4bEIMVGcZi4OMIsbh0Ay2RsAh0VRrw=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/security/metasploit/gemset.nix b/pkgs/tools/security/metasploit/gemset.nix
index 653cdeb5305..91d1e2aa60f 100644
--- a/pkgs/tools/security/metasploit/gemset.nix
+++ b/pkgs/tools/security/metasploit/gemset.nix
@@ -104,30 +104,30 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "18jjc7sxpdip10iyg0sn89ywvi2iqnhi225df7j6gs0fm25azkfw";
+      sha256 = "0zfwynw6d4lbq63lwk94insrjmgxwfp1lic4913a9ik00wnf90wd";
       type = "gem";
     };
-    version = "1.518.0";
+    version = "1.521.0";
   };
   aws-sdk-core = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "15x3qcmh81hf92x0gcj0h0h7yhnlzdqs6wdml56i3cq0nz9kxhs4";
+      sha256 = "0akv0jyr4crs4r5vdzc18j5drqgpcckm0gnpgi0bzpqyyk6m16hq";
       type = "gem";
     };
-    version = "3.121.3";
+    version = "3.121.5";
   };
   aws-sdk-ec2 = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0k85khm2c53y2sq29c9rg5kmjm1fnw2glgpjsl6hbh8cq3ciaain";
+      sha256 = "13kbrl8r9cm7i9cb6w5ayji1vqaca6h0inxpyx8bhbrwkscrbh2s";
       type = "gem";
     };
-    version = "1.271.0";
+    version = "1.275.0";
   };
   aws-sdk-iam = {
     groups = ["default"];
@@ -664,12 +664,12 @@
     platforms = [];
     source = {
       fetchSubmodules = false;
-      rev = "341b0cd1cdf69fe22345aea6c84ae11ba45e0d98";
-      sha256 = "0b452ay3qg2x2pg9ma9p52mb914vsfljj4baddhpc72n2nppfbyh";
+      rev = "bde342fd8293e49a45ba837ca9a1fdea505bc919";
+      sha256 = "1g262lfh4v34rc01svicq8wbi63i8v2j1i462crjxvjd63q29g13";
       type = "git";
       url = "https://github.com/rapid7/metasploit-framework";
     };
-    version = "6.1.11";
+    version = "6.1.12";
   };
   metasploit-model = {
     groups = ["default"];
@@ -1237,20 +1237,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1kl221lsf1dk62vsf6fsgcx54crav0wgqsb9rwjxl7gfd7kmyz04";
+      sha256 = "1rsgssbnnl5frxgnq17xq0n6rpxns6xdmxpya9852c2n72nm5ac0";
       type = "gem";
     };
-    version = "0.1.33";
+    version = "0.1.34";
   };
   rex-sslscan = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0r58n1ifbay1gq3kln9yg5iqjwp69l0pmb9sqakhqwhjlhzqx2kr";
+      sha256 = "128y9xrb2nv8ccs85lav8wcydp8239y04ad7mjkc43r59hhkx74p";
       type = "gem";
     };
-    version = "0.1.6";
+    version = "0.1.7";
   };
   rex-struct2 = {
     groups = ["default"];
diff --git a/pkgs/tools/security/pinentry/default.nix b/pkgs/tools/security/pinentry/default.nix
index 65abea4a112..4f6ddae3044 100644
--- a/pkgs/tools/security/pinentry/default.nix
+++ b/pkgs/tools/security/pinentry/default.nix
@@ -43,11 +43,11 @@ in
 
 pinentryMkDerivation rec {
   pname = "pinentry";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchurl {
     url = "mirror://gnupg/pinentry/${pname}-${version}.tar.bz2";
-    sha256 = "0w35ypl960pczg5kp6km3dyr000m1hf0vpwwlh72jjkjza36c1v8";
+    sha256 = "sha256-EAcgRaPgQ9BYH5HNVnb8rH/+6VehZjat7apPWDphZHA=";
   };
 
   nativeBuildInputs = [ pkg-config autoreconfHook ]
diff --git a/pkgs/tools/security/rbw/default.nix b/pkgs/tools/security/rbw/default.nix
index 17ecdee6d30..c799c9b2a87 100644
--- a/pkgs/tools/security/rbw/default.nix
+++ b/pkgs/tools/security/rbw/default.nix
@@ -9,27 +9,32 @@
 , Security
 , libiconv
 
-# rbw-fzf
-, withFzf ? false, fzf, perl
+  # rbw-fzf
+, withFzf ? false
+, fzf
+, perl
 
-# rbw-rofi
-, withRofi ? false, rofi, xclip
+  # rbw-rofi
+, withRofi ? false
+, rofi
+, xclip
 
-# pass-import
-, withPass ? false, pass
+  # pass-import
+, withPass ? false
+, pass
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "rbw";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchCrate {
     inherit version;
     crateName = pname;
-    sha256 = "17x4q29rsljbalc70r3ks4r6g5zc6jl4si75i33fcicxsvx6f39q";
+    sha256 = "sha256-6O33rn/MTo7Dymwh57xQJ5v7n4yNSoICyR9gRwF4AH4=";
   };
 
-  cargoSha256 = "14095ds8f5knrqcriphjlbvasc29n9rf8h5vlkmhpxyk7wh9azzc";
+  cargoSha256 = "sha256-BrjKUovVV6BDZXtILVC0qaAF5xzE3715u9w9OYIJFbk=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/tools/security/sedutil/default.nix b/pkgs/tools/security/sedutil/default.nix
index 6ed4a23af1d..cb0e367fa2c 100644
--- a/pkgs/tools/security/sedutil/default.nix
+++ b/pkgs/tools/security/sedutil/default.nix
@@ -1,28 +1,34 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, autoreconfHook
+}:
 
 stdenv.mkDerivation rec {
   pname = "sedutil";
-  version = "1.15.1";
+  version = "1.20.0";
 
   src = fetchFromGitHub {
-    owner  = "Drive-Trust-Alliance";
-    repo   = "sedutil";
-    rev    = version;
-    sha256 = "0zg5v27vbrzzl2vqzks91zj48z30qgcshkqkm1g8ycnhi145l0mf";
+    owner = "Drive-Trust-Alliance";
+    repo = "sedutil";
+    rev = version;
+    sha256 = "sha256-NG/7aqe48ShHWW5hW8axYWV4+zX0dBE7Wy9q58l0S3E=";
   };
 
   postPatch = ''
     patchShebangs .
   '';
 
-  nativeBuildInputs = [ autoreconfHook ];
+  nativeBuildInputs = [
+    autoreconfHook
+  ];
 
   enableParallelBuilding = true;
 
   meta = with lib; {
     description = "DTA sedutil Self encrypting drive software";
-    homepage    = "https://www.drivetrust.com";
-    license     = licenses.gpl3;
-    platforms   = platforms.linux;
+    homepage = "https://www.drivetrust.com";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/tools/security/tor/default.nix b/pkgs/tools/security/tor/default.nix
index a472b502b61..87be68c9975 100644
--- a/pkgs/tools/security/tor/default.nix
+++ b/pkgs/tools/security/tor/default.nix
@@ -30,11 +30,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "tor";
-  version = "0.4.6.7";
+  version = "0.4.6.8";
 
   src = fetchurl {
     url = "https://dist.torproject.org/${pname}-${version}.tar.gz";
-    sha256 = "16hga7195va8v0x062dc05nbz4sm3dscifcqpl8235dj47hmqrpz";
+    sha256 = "0sj7qn6d6js6gk4vjfkc7p9g021czbfaq00yfq3mn5ycnhvimkhm";
   };
 
   outputs = [ "out" "geoip" ];
diff --git a/pkgs/tools/security/tpm2-tools/default.nix b/pkgs/tools/security/tpm2-tools/default.nix
index 25a781d8fd8..3a2e62d4b59 100644
--- a/pkgs/tools/security/tpm2-tools/default.nix
+++ b/pkgs/tools/security/tpm2-tools/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "tpm2-tools";
-  version = "5.1.1";
+  version = "5.2";
 
   src = fetchurl {
     url = "https://github.com/tpm2-software/${pname}/releases/download/${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-VQCBD3r5mTkbq7EyFtdYQ77p8/nRVE/u1eUD2AEXSjs=";
+    sha256 = "sha256-wLQC9qezRW6OskRSEeLUHEbH52ngX+TYkJ/2QRn3pjA=";
   };
 
   nativeBuildInputs = [ pandoc pkg-config makeWrapper ];
diff --git a/pkgs/tools/security/vaultwarden/default.nix b/pkgs/tools/security/vaultwarden/default.nix
index eb4de54c303..2d2816dac0f 100644
--- a/pkgs/tools/security/vaultwarden/default.nix
+++ b/pkgs/tools/security/vaultwarden/default.nix
@@ -8,16 +8,16 @@ let
 
 in rustPlatform.buildRustPackage rec {
   pname = "vaultwarden";
-  version = "1.22.2";
+  version = "1.23.0";
 
   src = fetchFromGitHub {
     owner = "dani-garcia";
     repo = pname;
     rev = version;
-    sha256 = "sha256-37+Gor3xyo0yb3I4rrleJoPnqTA7G3WmeMSTltthi2E=";
+    sha256 = "sha256-lbOsJsmZxdBNTbhsGJ1mcjWlJ6802GYM3waTiWYOErY=";
   };
 
-  cargoSha256 = "sha256-+zu5OfvXj8DMglf5Xv5ZcaUlbE03cwyD8TN7YftgWO0=";
+  cargoSha256 = "sha256-ViXpoPkBznB0o/dc/l1r3m0y+z2w58wqlU8/cg8u7tI=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = with lib; [ openssl ]
diff --git a/pkgs/tools/security/yubikey-touch-detector/default.nix b/pkgs/tools/security/yubikey-touch-detector/default.nix
index 93531d3a2b6..8a06c363faf 100644
--- a/pkgs/tools/security/yubikey-touch-detector/default.nix
+++ b/pkgs/tools/security/yubikey-touch-detector/default.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "yubikey-touch-detector";
-  version = "1.9.1";
+  version = "1.9.3";
 
   src = fetchFromGitHub {
     owner = "maximbaz";
     repo = "yubikey-touch-detector";
     rev = version;
-    sha256 = "sha256-I9dRCQhbXd8K1zp291z9XVwHI9DcxgvrzYaHICZH5v0=";
+    sha256 = "sha256-f6j+YNYASH0Adg3236QijApALd/yXJjNMYEdP0Pifw0=";
   };
-  vendorSha256 = "sha256-UeDLGwYrXwLOtQt/8fEmficc/1j0x+zr/JLa6lLF5cs=";
+  vendorSha256 = "sha256-bmFbxMU3PEWpYI0eQw/1RRDP+JGfUY8kOCeTWbdVt9k=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/tools/system/acpica-tools/default.nix b/pkgs/tools/system/acpica-tools/default.nix
index 4f0ab029750..2374aa1489f 100644
--- a/pkgs/tools/system/acpica-tools/default.nix
+++ b/pkgs/tools/system/acpica-tools/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "acpica-tools";
-  version = "20210730";
+  version = "20210930";
 
   src = fetchurl {
     url = "https://acpica.org/sites/acpica/files/acpica-unix-${version}.tar.gz";
-    sha256 = "1pmm977nyl3bs71ipzcl4dh30qm8x9wm2p2ml0m62rl62kai832a";
+    sha256 = "08a8q174ac3jwxnd8q8iqc3cckwc2f7ncrc6f3171g0n38l2mn1w";
   };
 
   NIX_CFLAGS_COMPILE = "-O3";
diff --git a/pkgs/tools/system/btop/default.nix b/pkgs/tools/system/btop/default.nix
index b55af632697..6dfe63215f1 100644
--- a/pkgs/tools/system/btop/default.nix
+++ b/pkgs/tools/system/btop/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "btop";
-  version = "1.0.18";
+  version = "1.0.20";
 
   src = fetchFromGitHub {
     owner = "aristocratos";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-TUrCSpwbUP28COHAAFIdR5Kw18I35nBkiKU62IHCN4o=";
+    sha256 = "sha256-QMuixP4+wYVcF3s848cw6103PGDON4Inj2Nypt4FGIU=";
   };
 
   installFlags = [ "PREFIX=$(out)" ];
diff --git a/pkgs/tools/system/consul-template/default.nix b/pkgs/tools/system/consul-template/default.nix
index 020e56a1526..b811ea5f39f 100644
--- a/pkgs/tools/system/consul-template/default.nix
+++ b/pkgs/tools/system/consul-template/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "consul-template";
-  version = "0.27.0";
+  version = "0.27.1";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = "consul-template";
     rev = "v${version}";
-    sha256 = "sha256-XzsewkHaFIq1kvFDHIsnhfhtLPLFRin7YrhiZuF1+co=";
+    sha256 = "sha256-t6oqey2GlGOOxGuhlYnQeYzw1vR7qeiM+tSqzp3L3g0=";
   };
 
-  vendorSha256 = "sha256-/4ZY4YRGsUSL2e6uYPJ9tWEvXDjU5/L56yf49pUkJ2E=";
+  vendorSha256 = "sha256-my4ECzmvrPhbKlcEptQ0xi4lYxHm42IrEsOvcetuMeQ=";
 
   # consul-template tests depend on vault and consul services running to
   # execute tests so we skip them here
diff --git a/pkgs/tools/system/datefudge/default.nix b/pkgs/tools/system/datefudge/default.nix
index be2ad70498a..079b6b69436 100644
--- a/pkgs/tools/system/datefudge/default.nix
+++ b/pkgs/tools/system/datefudge/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchgit, fetchpatch }:
+{ stdenv, lib, fetchgit, fetchpatch, makeWrapper, coreutils }:
 
 stdenv.mkDerivation rec {
   pname = "datefudge";
@@ -10,6 +10,10 @@ stdenv.mkDerivation rec {
     sha256 = "1nh433yx4y4djp0bs6aawqbwk7miq7fsbs9wpjlyh2k9dvil2lrm";
   };
 
+  nativeBuildInputs = [ makeWrapper ];
+
+  buildInputs = [ coreutils ];
+
   postPatch = ''
     substituteInPlace Makefile \
      --replace "/usr" "/" \
@@ -20,7 +24,10 @@ stdenv.mkDerivation rec {
 
   installFlags = [ "DESTDIR=$(out)" ];
 
-  postInstall = "chmod +x $out/lib/datefudge/datefudge.so";
+  postInstall = ''
+    chmod +x $out/lib/datefudge/datefudge.so
+    wrapProgram $out/bin/datefudge --prefix PATH : ${coreutils}/bin
+  '';
 
   meta = with lib; {
     description = "Fake the system date";
diff --git a/pkgs/tools/system/honcho/default.nix b/pkgs/tools/system/honcho/default.nix
index 17fa9489333..66d21729656 100644
--- a/pkgs/tools/system/honcho/default.nix
+++ b/pkgs/tools/system/honcho/default.nix
@@ -8,30 +8,21 @@ in
 
 python3Packages.buildPythonApplication rec {
   name = "${pname}-${version}";
-  version = "1.0.1";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "nickstenning";
     repo = "honcho";
     rev = "v${version}";
-    sha256 = "11bd87474qpif20xdcn0ra1idj5k16ka51i658wfpxwc6nzsn92b";
+    sha256 = "1y0r8dw4pqcq7r4n58ixjdg1iy60lp0gxsd7d2jmhals16ij71rj";
   };
 
-  checkInputs = with python3Packages; [ jinja2 pytest mock coverage ];
-
-  buildPhase = ''
-    ${python.interpreter} setup.py build
-  '';
+  propagatedBuildInputs = [ python3Packages.setuptools ];
 
-  installPhase = ''
-    mkdir -p "$out/${python.sitePackages}"
-
-    export PYTHONPATH="$out/${python.sitePackages}:$PYTHONPATH"
+  checkInputs = with python3Packages; [ jinja2 pytest mock coverage ];
 
-    ${python.interpreter} setup.py install \
-      --install-lib=$out/${python.sitePackages} \
-      --prefix="$out"
-  '';
+  # missing plugins
+  doCheck = false;
 
   checkPhase = ''
     runHook preCheck
diff --git a/pkgs/tools/system/thinkfan/default.nix b/pkgs/tools/system/thinkfan/default.nix
index a53ef4ae9f8..8da87ecfa71 100644
--- a/pkgs/tools/system/thinkfan/default.nix
+++ b/pkgs/tools/system/thinkfan/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "thinkfan";
-  version = "1.2.2";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "vmatare";
     repo = "thinkfan";
     rev = version;
-    sha256 = "01l1pnj1cgy3dwgyys2s5iqzyv6kk47vlpy09qjafk8py21ijik3";
+    sha256 = "sha256-ZCZqi7A4qdWtDSkTw6ktHIZnPhdes2AX7+QBroaDDfI=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/system/uptimed/default.nix b/pkgs/tools/system/uptimed/default.nix
index 8e026575535..219d5235735 100644
--- a/pkgs/tools/system/uptimed/default.nix
+++ b/pkgs/tools/system/uptimed/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "uptimed";
-  version = "0.4.4";
+  version = "0.4.5";
 
   src = fetchFromGitHub {
-    sha256 = "sha256-DSvxE9BZpjpDQi2SxbM5iuAAHgUCaiwimcgxivD4mck=";
+    sha256 = "sha256-jvdodclZhN7WF7bsR3DHaLb8fAEABap8OAfmTZF1804=";
     rev = "v${version}";
     repo = "uptimed";
     owner = "rpodgorny";
diff --git a/pkgs/tools/text/angle-grinder/default.nix b/pkgs/tools/text/angle-grinder/default.nix
index 02235b057d4..a2303c10a63 100644
--- a/pkgs/tools/text/angle-grinder/default.nix
+++ b/pkgs/tools/text/angle-grinder/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "angle-grinder";
-  version = "0.17.0";
+  version = "0.18.0";
 
   src = fetchFromGitHub {
     owner = "rcoh";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-jG3jHFqFOrIT/e5oyLOEckw5C3LIs7amFAa4QDEI/EY=";
+    sha256 = "sha256-kohw95pvcBLviPgTDGWIbvZuz1cJmKh4eB0Bx4AEk1E=";
   };
 
-  cargoSha256 = "sha256-Rkex+fnnacV+DCRpX3Zh9J3vGuG4QfFhFezHTs33peY=";
+  cargoSha256 = "sha256-m44hFYcyQ1yRf1O5OlomF7rEpkdnnX3FNhB8kUdriKg=";
 
   meta = with lib; {
     description = "Slice and dice logs on the command line";
diff --git a/pkgs/tools/text/crowdin-cli/default.nix b/pkgs/tools/text/crowdin-cli/default.nix
index f5c489681e9..36b359365d5 100644
--- a/pkgs/tools/text/crowdin-cli/default.nix
+++ b/pkgs/tools/text/crowdin-cli/default.nix
@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation rec {
   pname = "crowdin-cli";
-  version = "3.7.0";
+  version = "3.7.1";
 
   src = fetchurl {
     url = "https://github.com/crowdin/${pname}/releases/download/${version}/${pname}.zip";
-    sha256 = "sha256-2TQL5k2ndckFjOOXNz7clVpwPUMStR4xgd1P+qUhNC8=";
+    sha256 = "sha256-WoDFBV1Nid1y57MIrTFMOB2yqHRUrvhp974Dz5agar0=";
   };
 
   nativeBuildInputs = [ installShellFiles makeWrapper unzip ];
diff --git a/pkgs/tools/text/glogg/default.nix b/pkgs/tools/text/glogg/default.nix
index 306c25498ad..855490df4ab 100644
--- a/pkgs/tools/text/glogg/default.nix
+++ b/pkgs/tools/text/glogg/default.nix
@@ -25,7 +25,6 @@ mkDerivation rec {
     mkdir -p $out/Applications
     mv $out/bin/glogg.app $out/Applications/glogg.app
     rm -fr $out/{bin,share}
-    wrapQtApp $out/Applications/glogg.app/Contents/MacOS/glogg
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/text/gnugrep/default.nix b/pkgs/tools/text/gnugrep/default.nix
index c5a661af115..bb0c90197d3 100644
--- a/pkgs/tools/text/gnugrep/default.nix
+++ b/pkgs/tools/text/gnugrep/default.nix
@@ -5,7 +5,7 @@
 # cgit) that are needed here should be included directly in Nixpkgs as
 # files.
 
-let version = "3.6"; in
+let version = "3.7"; in
 
 stdenv.mkDerivation {
   pname = "gnugrep";
@@ -13,7 +13,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "mirror://gnu/grep/grep-${version}.tar.xz";
-    sha256 = "0gipv6bzkm1aihj0ncqpyh164xrzgcxcv9r1kwzyk2g1mzl1azk6";
+    sha256 = "0g42svbc1nq5bamxfj6x7320wli4dlj86padk0hwgbk04hqxl42w";
   };
 
   # Perl is needed for testing
diff --git a/pkgs/tools/text/source-highlight/default.nix b/pkgs/tools/text/source-highlight/default.nix
index 8817b7a09fd..4a7b588cd9d 100644
--- a/pkgs/tools/text/source-highlight/default.nix
+++ b/pkgs/tools/text/source-highlight/default.nix
@@ -4,6 +4,8 @@ stdenv.mkDerivation rec {
   pname = "source-highlight";
   version = "3.1.9";
 
+  outputs = [ "out" "doc" "dev" ];
+
   src = fetchurl {
     url = "mirror://gnu/src-highlite/${pname}-${version}.tar.gz";
     sha256 = "148w47k3zswbxvhg83z38ifi85f9dqcpg7icvvw1cm6bg21x4zrs";
@@ -28,7 +30,10 @@ stdenv.mkDerivation rec {
   strictDeps = true;
   buildInputs = [ boost ];
 
-  configureFlags = [ "--with-boost=${boost.out}" ];
+  configureFlags = [
+    "--with-boost=${boost.out}"
+    "--with-bash-completion=${placeholder "out"}/share/bash_completion.d"
+  ];
 
   doCheck = !stdenv.cc.isClang;
 
@@ -37,8 +42,6 @@ stdenv.mkDerivation rec {
   # them in parallel by make will eventually break one or more tests.
   enableParallelChecking = false;
 
-  outputs = [ "out" "doc" "dev" ];
-
   meta = with lib; {
     description = "Source code renderer with syntax highlighting";
     longDescription = ''
diff --git a/pkgs/tools/text/tidy-viewer/default.nix b/pkgs/tools/text/tidy-viewer/default.nix
index 4cb99ca26ce..29d243a6504 100644
--- a/pkgs/tools/text/tidy-viewer/default.nix
+++ b/pkgs/tools/text/tidy-viewer/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "tidy-viewer";
-  version = "0.0.22";
+  version = "1.4.2";
 
   src = fetchFromGitHub {
     owner = "alexhallam";
     repo = "tv";
     rev = version;
-    sha256 = "sha256-OuNpp9EKiU+fQSZZO7zpI36nCiZBXK6OznJGY4KMftU=";
+    sha256 = "sha256-YXYz+SvL6YRwnZ7frmmx4NevNTh0rJcW7e4jSuX3TNs=";
   };
 
-  cargoSha256 = "sha256-LRoNGDOrbCjmZJRe+EUKxkDJjC92bQRRwP48jqDp9PU=";
+  cargoSha256 = "sha256-KwnnoVacTMw7kHLQynv9557zUq8aFZfzBD+Zc9Q6XBs=";
 
   # this test parses command line arguments
   # error: Found argument '--test-threads' which wasn't expected, or isn't valid in this context
diff --git a/pkgs/tools/text/ucg/default.nix b/pkgs/tools/text/ucg/default.nix
index d81b5a14f09..d19379477d6 100644
--- a/pkgs/tools/text/ucg/default.nix
+++ b/pkgs/tools/text/ucg/default.nix
@@ -3,14 +3,11 @@
 , pkg-config
 , autoreconfHook
 , pcre
-, nixosTests
 }:
 
-let
+stdenv.mkDerivation rec {
   pname = "ucg";
-  version = "20190225";
-in stdenv.mkDerivation {
-  inherit pname version;
+  version = "0.3.3+date=2019-02-25";
 
   src = fetchFromGitHub {
     owner = "gvansickle";
@@ -19,8 +16,29 @@ in stdenv.mkDerivation {
     sha256 = "sha256-/wU1PmI4ejlv7gZzZNasgROYXFiDiIxE9BFoCo6+G5Y=";
   };
 
-  nativeBuildInputs = [ autoreconfHook pkg-config ];
-  buildInputs = [ pcre ];
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+  ];
+
+  buildInputs = [
+    pcre
+  ];
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    testFile=$(mktemp /tmp/ucg-test.XXXX)
+    echo -ne 'Lorem ipsum dolor sit amet\n2.7182818284590' > $testFile
+    $out/bin/ucg 'dolor' $testFile || { rm $testFile; exit -1; }
+    $out/bin/ucg --ignore-case 'lorem' $testFile || { rm $testFile; exit -1; }
+    $out/bin/ucg --word-regexp '2718' $testFile && { rm $testFile; exit -1; }
+    $out/bin/ucg 'pisum' $testFile && { rm $testFile; exit -1; }
+    rm $testFile
+
+    runHook postInstallCheck
+  '';
 
   meta = with lib; {
     homepage = "https://github.com/gvansickle/ucg/";
@@ -34,7 +52,7 @@ in stdenv.mkDerivation {
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ AndersonTorres ];
     platforms = with platforms; unix;
+    broken = stdenv.isAarch64; # cpuid.h: no such file or directory
   };
-
-  passthru.tests = { inherit (nixosTests) ucg; };
 }
+# TODO: report upstream
diff --git a/pkgs/tools/text/ugrep/default.nix b/pkgs/tools/text/ugrep/default.nix
index 2a00ba05572..8ea58334642 100644
--- a/pkgs/tools/text/ugrep/default.nix
+++ b/pkgs/tools/text/ugrep/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ugrep";
-  version = "3.3.7";
+  version = "3.3.8";
 
   src = fetchFromGitHub {
     owner = "Genivia";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-FnSOurICD4n2Z/snP0ysWZ30DnyEDZMqpjRrS1WxG+Q=";
+    sha256 = "sha256-xVkInB2QmZjdcwzXQtmqKhuOjtkVDfY4fDB/wIqA3Jc=";
   };
 
   buildInputs = [
diff --git a/pkgs/tools/typesetting/tex/texlive/combine.nix b/pkgs/tools/typesetting/tex/texlive/combine.nix
index 1367d651a09..9569ec88854 100644
--- a/pkgs/tools/typesetting/tex/texlive/combine.nix
+++ b/pkgs/tools/typesetting/tex/texlive/combine.nix
@@ -33,9 +33,9 @@ let
       ++ lib.optional (lib.any pkgNeedsRuby splitBin.wrong) ruby;
   };
 
-  uniqueStrings = list: lib.sort (a: b: a < b) (lib.unique list);
+  sortedUniqueStrings = list: lib.sort (a: b: a < b) (lib.unique list);
 
-  mkUniqueOutPaths = pkgs: uniqueStrings
+  mkUniqueOutPaths = pkgs: lib.unique
     (map (p: p.outPath) (builtins.filter lib.isDerivation pkgs));
 
 in (buildEnv {
@@ -124,9 +124,9 @@ in (buildEnv {
     # now filter hyphenation patterns and formats
   (let
     hyphens = lib.filter (p: p.hasHyphens or false && p.tlType == "run") pkgList.splitBin.wrong;
-    hyphenPNames = uniqueStrings (map (p: p.pname) hyphens);
+    hyphenPNames = sortedUniqueStrings (map (p: p.pname) hyphens);
     formats = lib.filter (p: p.hasFormats or false && p.tlType == "run") pkgList.splitBin.wrong;
-    formatPNames = uniqueStrings (map (p: p.pname) formats);
+    formatPNames = sortedUniqueStrings (map (p: p.pname) formats);
     # sed expression that prints the lines in /start/,/end/ except for /end/
     section = start: end: "/${start}/,/${end}/{ /${start}/p; /${end}/!p; };\n";
     script =
diff --git a/pkgs/tools/video/rav1e/default.nix b/pkgs/tools/video/rav1e/default.nix
index 53e139cde3b..d6fc422b4cd 100644
--- a/pkgs/tools/video/rav1e/default.nix
+++ b/pkgs/tools/video/rav1e/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, rustPlatform, rust, fetchurl, fetchFromGitHub, lib, nasm, cargo-c, libiconv }:
+{ lib, rust, stdenv, rustPlatform, fetchCrate, nasm, cargo-c, libiconv }:
 
 let
   rustTargetPlatformSpec = rust.toRustTargetSpec stdenv.hostPlatform;
@@ -6,29 +6,13 @@ in rustPlatform.buildRustPackage rec {
   pname = "rav1e";
   version = "0.4.1";
 
-  src = stdenv.mkDerivation rec {
-    name = "${pname}-${version}-source";
-
-    src = fetchFromGitHub {
-      owner = "xiph";
-      repo = "rav1e";
-      rev = "v${version}";
-      sha256 = "0jnq5a3fv6fzzbmprzfxidlcwwgblkwwm0135cfw741wjv7f7h6r";
-    };
-
-    cargoLock = fetchurl {
-      url = "https://github.com/xiph/rav1e/releases/download/v${version}/Cargo.lock";
-      sha256 = "14fi9wam9rs5206rvcd2f3sjpzq41pnfml14w74wn2ws3gpi46zn";
-    };
-
-    installPhase = ''
-      mkdir -p $out
-      cp -r ./* $out/
-      cp ${cargoLock} $out/Cargo.lock
-    '';
+  src = fetchCrate {
+    inherit pname version;
+    sha256 = "sha256-9fBAH1vuLJ3yu8X5+CQGLQFDlzTYoFBUTy3Muo6hLkw=";
   };
 
-  cargoSha256 = "0miq6iiywwbxm6k0alnqg6bnd14pwc8vl9d8fgg6c0vjlfy5zhlb";
+  cargoSha256 = "sha256-QhWVqHcNjJF94uTvHGVnV8MTp2bYOuCEjaMBfViOLRo=";
+
   nativeBuildInputs = [ nasm cargo-c ];
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv ];
 
diff --git a/pkgs/tools/virtualization/distrobuilder/default.nix b/pkgs/tools/virtualization/distrobuilder/default.nix
index 73f602cbf69..d6be2f94257 100644
--- a/pkgs/tools/virtualization/distrobuilder/default.nix
+++ b/pkgs/tools/virtualization/distrobuilder/default.nix
@@ -21,15 +21,15 @@ let
 in
 buildGoModule rec {
   pname = "distrobuilder";
-  version = "1.3";
+  version = "2.0";
 
-  vendorSha256 = "sha256-FKnpoLA4enZ1vGSJQFLbp/OjoEgdxagL73ucxUgIoKY=";
+  vendorSha256 = "sha256-hcp+ufJFgFLBE4i2quIwhvrwDTes3saXNHHr9XXBc8E=";
 
   src = fetchFromGitHub {
     owner = "lxc";
     repo = "distrobuilder";
     rev = "distrobuilder-${version}";
-    sha256 = "sha256-cvxbJbg9yTcAPWQccH+1nQivwRh8CIN3Cga2HKY8VlQ=";
+    sha256 = "sha256-Px8mo2dwHNVjMWtzsa/4fLxlcbYkhIc7W8aR9DR85vc=";
     fetchSubmodules = false;
   };
 
diff --git a/pkgs/tools/wayland/cliphist/default.nix b/pkgs/tools/wayland/cliphist/default.nix
index 44a870db387..9ccad4397dd 100644
--- a/pkgs/tools/wayland/cliphist/default.nix
+++ b/pkgs/tools/wayland/cliphist/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "cliphist";
-  version = "0.1.0";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "sentriz";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-CZW7dhOd7E74VNjnvhxvSSUZQtbkGi4uRUM9YQCuJZw=";
+    sha256 = "sha256-fx33m7DCp5N9VGI/H/IO66ECdFLobRRAAuRGNu4gzSk=";
   };
 
   vendorSha256 = "sha256-UrKSDvskGwHjwkb/fjvaJZ8xXFD98BFeSJxwJpc8A+M=";