summary refs log tree commit diff
path: root/pkgs/tools
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs/tools')
-rw-r--r--pkgs/tools/X11/jumpapp/default.nix4
-rw-r--r--pkgs/tools/admin/aws-vault/default.nix6
-rw-r--r--pkgs/tools/admin/berglas/default.nix33
-rw-r--r--pkgs/tools/admin/eksctl/default.nix6
-rw-r--r--pkgs/tools/admin/exoscale-cli/default.nix4
-rw-r--r--pkgs/tools/admin/fits-cloudctl/default.nix4
-rw-r--r--pkgs/tools/admin/lxd/default.nix4
-rw-r--r--pkgs/tools/admin/stripe-cli/default.nix4
-rw-r--r--pkgs/tools/admin/syft/default.nix6
-rw-r--r--pkgs/tools/admin/trinsic-cli/default.nix4
-rw-r--r--pkgs/tools/admin/trivy/default.nix6
-rw-r--r--pkgs/tools/archivers/7zz/default.nix58
-rwxr-xr-xpkgs/tools/archivers/7zz/update.sh50
-rw-r--r--pkgs/tools/archivers/p7zip/default.nix35
-rwxr-xr-xpkgs/tools/archivers/p7zip/update.sh47
-rw-r--r--pkgs/tools/backup/autorestic/default.nix6
-rw-r--r--pkgs/tools/backup/btrbk/default.nix4
-rw-r--r--pkgs/tools/backup/bupstash/default.nix6
-rw-r--r--pkgs/tools/filesystems/dosfstools/default.nix15
-rw-r--r--pkgs/tools/filesystems/squashfs/darwin.patch36
-rw-r--r--pkgs/tools/filesystems/squashfs/default.nix25
-rw-r--r--pkgs/tools/graphics/wkhtmltopdf-bin/default.nix51
-rw-r--r--pkgs/tools/misc/apkeep/default.nix6
-rw-r--r--pkgs/tools/misc/broadlink-cli/default.nix4
-rw-r--r--pkgs/tools/misc/chezmoi/default.nix6
-rw-r--r--pkgs/tools/misc/diffoscope/default.nix11
-rw-r--r--pkgs/tools/misc/dua/default.nix6
-rw-r--r--pkgs/tools/misc/hashit/default.nix1
-rw-r--r--pkgs/tools/misc/infracost/default.nix12
-rw-r--r--pkgs/tools/misc/miniserve/default.nix20
-rw-r--r--pkgs/tools/misc/mmv/default.nix4
-rw-r--r--pkgs/tools/misc/mpdscribble/default.nix4
-rw-r--r--pkgs/tools/misc/onefetch/default.nix11
-rw-r--r--pkgs/tools/misc/opentelemetry-collector/contrib.nix6
-rw-r--r--pkgs/tools/misc/opentelemetry-collector/default.nix6
-rw-r--r--pkgs/tools/misc/pg_flame/default.nix2
-rw-r--r--pkgs/tools/misc/plantuml-server/default.nix63
-rw-r--r--pkgs/tools/misc/rockbox-utility/default.nix43
-rw-r--r--pkgs/tools/misc/steampipe/default.nix6
-rw-r--r--pkgs/tools/misc/ttchat/default.nix23
-rw-r--r--pkgs/tools/misc/up/default.nix2
-rw-r--r--pkgs/tools/misc/ytmdl/default.nix7
-rw-r--r--pkgs/tools/misc/zellij/default.nix6
-rw-r--r--pkgs/tools/networking/boundary/default.nix10
-rw-r--r--pkgs/tools/networking/cloudflare-warp/default.nix48
-rw-r--r--pkgs/tools/networking/corerad/default.nix10
-rw-r--r--pkgs/tools/networking/frp/default.nix6
-rw-r--r--pkgs/tools/networking/hey/default.nix2
-rw-r--r--pkgs/tools/networking/httpie/default.nix18
-rw-r--r--pkgs/tools/networking/innernet/default.nix6
-rw-r--r--pkgs/tools/networking/magic-wormhole-rs/Cargo.toml.patch67
-rw-r--r--pkgs/tools/networking/magic-wormhole-rs/default.nix32
-rw-r--r--pkgs/tools/networking/minio-client/default.nix4
-rw-r--r--pkgs/tools/networking/netproc/default.nix25
-rw-r--r--pkgs/tools/networking/openapi-generator-cli/unstable.nix6
-rw-r--r--pkgs/tools/networking/openvpn/default.nix10
-rw-r--r--pkgs/tools/networking/tinyssh/default.nix4
-rw-r--r--pkgs/tools/nix/nix-output-monitor/default.nix179
-rw-r--r--pkgs/tools/nix/nix-output-monitor/generated-package.nix147
-rwxr-xr-xpkgs/tools/nix/nix-output-monitor/update.sh25
-rw-r--r--pkgs/tools/package-management/cargo-about/default.nix6
-rw-r--r--pkgs/tools/package-management/nfpm/default.nix10
-rw-r--r--pkgs/tools/security/cariddi/default.nix6
-rw-r--r--pkgs/tools/security/cfripper/default.nix4
-rw-r--r--pkgs/tools/security/feroxbuster/default.nix45
-rw-r--r--pkgs/tools/security/fulcio/default.nix52
-rw-r--r--pkgs/tools/security/grype/default.nix21
-rw-r--r--pkgs/tools/security/metasploit/Gemfile2
-rw-r--r--pkgs/tools/security/metasploit/Gemfile.lock58
-rw-r--r--pkgs/tools/security/metasploit/default.nix4
-rw-r--r--pkgs/tools/security/metasploit/gemset.nix74
-rw-r--r--pkgs/tools/security/minio-certgen/default.nix4
-rw-r--r--pkgs/tools/security/sequoia/default.nix8
-rw-r--r--pkgs/tools/security/sigma-cli/default.nix4
-rw-r--r--pkgs/tools/security/spire/default.nix7
-rw-r--r--pkgs/tools/security/volatility3/default.nix10
-rw-r--r--pkgs/tools/security/zdns/default.nix11
-rw-r--r--pkgs/tools/system/goreman/default.nix8
-rw-r--r--pkgs/tools/system/hostctl/default.nix23
-rw-r--r--pkgs/tools/system/syslog-ng/default.nix4
-rw-r--r--pkgs/tools/text/mmdoc/default.nix37
-rw-r--r--pkgs/tools/text/snippetpixie/default.nix2
-rw-r--r--pkgs/tools/text/tab/default.nix10
-rw-r--r--pkgs/tools/text/vale/default.nix6
-rw-r--r--pkgs/tools/virtualization/awsebcli/default.nix1
-rw-r--r--pkgs/tools/virtualization/shipyard/default.nix4
-rw-r--r--pkgs/tools/wayland/cliphist/default.nix6
-rw-r--r--pkgs/tools/wayland/swaykbdd/default.nix4
-rw-r--r--pkgs/tools/wayland/swayr/default.nix6
-rw-r--r--pkgs/tools/wayland/ydotool/default.nix29
-rw-r--r--pkgs/tools/wayland/ydotool/fixup-cmakelists.patch58
91 files changed, 1114 insertions, 672 deletions
diff --git a/pkgs/tools/X11/jumpapp/default.nix b/pkgs/tools/X11/jumpapp/default.nix
index c152a72a23d..cce6ced7573 100644
--- a/pkgs/tools/X11/jumpapp/default.nix
+++ b/pkgs/tools/X11/jumpapp/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "jumpapp";
-  version = "1.1";
+  version = "1.2";
 
   src = fetchFromGitHub {
     owner = "mkropat";
     repo = "jumpapp";
     rev = "v${version}";
-    sha256 = "1jrk4mm42sz6ca2gkb6w3dad53d4im4shpgsq8s4vr6xpl3b43ry";
+    sha256 = "sha256-9sh0+zpDxwqRGC1jUgGTDdSDRdAFsL12mQ/Opwh/UBc=";
   };
 
   makeFlags = [ "PREFIX=$(out)" ];
diff --git a/pkgs/tools/admin/aws-vault/default.nix b/pkgs/tools/admin/aws-vault/default.nix
index 7462f3506fd..f861a22d812 100644
--- a/pkgs/tools/admin/aws-vault/default.nix
+++ b/pkgs/tools/admin/aws-vault/default.nix
@@ -7,16 +7,16 @@
 }:
 buildGoModule rec {
   pname = "aws-vault";
-  version = "6.5.0";
+  version = "6.6.0";
 
   src = fetchFromGitHub {
     owner = "99designs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-PYaCbefIglzvBTeFnyz+uQnFxE61cBMWvC3RdV8rq90=";
+    sha256 = "sha256-wJVbB1MPSKX8/gTX29ThPDxJJRW79+PDwhGDGODtRko=";
   };
 
-  vendorSha256 = "sha256-GTP6KqAfESrdrtLkerRLmre2tBkG4CXMcfxL/flgya0=";
+  vendorSha256 = "sha256-h9qGrb2UxtdKewBsWNcir4YfjUNczYP+WiNoWx45w30=";
 
   nativeBuildInputs = [ installShellFiles makeWrapper ];
 
diff --git a/pkgs/tools/admin/berglas/default.nix b/pkgs/tools/admin/berglas/default.nix
index 8a6bb559041..bf86a5c02ec 100644
--- a/pkgs/tools/admin/berglas/default.nix
+++ b/pkgs/tools/admin/berglas/default.nix
@@ -1,19 +1,44 @@
 { lib, buildGoModule, fetchFromGitHub }:
 
+let
+  skipTests = {
+    access = "Access";
+    create = "Create";
+    delete = "Delete";
+    list = "List";
+    read = "Read";
+    replace = "Replace";
+    resolver = "Resolve";
+    revoke = "Revoke";
+    update = "Update";
+  };
+
+  skipTestsCommand =
+    builtins.foldl' (acc: goFileName:
+      let testName = builtins.getAttr goFileName skipTests; in
+      ''
+        ${acc}
+        substituteInPlace pkg/berglas/${goFileName}_test.go \
+          --replace "TestClient_${testName}_storage" "SkipClient_${testName}_storage" \
+          --replace "TestClient_${testName}_secretManager" "SkipClient_${testName}_secretManager"
+      ''
+    ) "" (builtins.attrNames skipTests);
+in
+
 buildGoModule rec {
   pname = "berglas";
-  version = "0.5.1";
+  version = "0.6.2";
 
   src = fetchFromGitHub {
     owner = "GoogleCloudPlatform";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0y393g36h35zzqyf5b10j6qq2jhvz83j17cmasnv6wbyrb3vnn0n";
+    sha256 = "sha256-aLsrrK+z080qn7L2zggA8yD+QqLaSRJLTjWQnFKFogQ=";
   };
 
-  vendorSha256 = null;
+  vendorSha256 = "sha256-HjZT0jezJzoEvXuzrjoTv/zSex+xDuGoP1h82CIlX14=";
 
-  doCheck = false;
+  postPatch = skipTestsCommand;
 
   meta = with lib; {
     description = "A tool for managing secrets on Google Cloud";
diff --git a/pkgs/tools/admin/eksctl/default.nix b/pkgs/tools/admin/eksctl/default.nix
index 035dfe183e6..0bde787bfe5 100644
--- a/pkgs/tools/admin/eksctl/default.nix
+++ b/pkgs/tools/admin/eksctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "eksctl";
-  version = "0.87.0";
+  version = "0.88.0";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = pname;
     rev = version;
-    sha256 = "sha256-909cInKo6X8yzpXlumDYIi8yCYLqr1CVcsGgYSd2pnQ=";
+    sha256 = "sha256-HngpmCJ2oT+6LKtYGaDmQYjB6ibeIr8AaTZp8w8gftc=";
   };
 
-  vendorSha256 = "sha256-3pEKG5YW83YMSkAjiJQDW1eQbMl6SkokHTXn+kJ/3l4=";
+  vendorSha256 = "sha256-hF7G5Bh87gf2gpaorBh7aICfhq4jPXj6Zay/qMC+cmU=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/admin/exoscale-cli/default.nix b/pkgs/tools/admin/exoscale-cli/default.nix
index 6cb52ccd135..f1a420b0c10 100644
--- a/pkgs/tools/admin/exoscale-cli/default.nix
+++ b/pkgs/tools/admin/exoscale-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoPackage rec {
   pname = "exoscale-cli";
-  version = "1.51.2";
+  version = "1.52.0";
 
   src = fetchFromGitHub {
     owner  = "exoscale";
     repo   = "cli";
     rev    = "v${version}";
-    sha256 = "sha256-Nx9lASZOEetkADVEs2JxPRi9SCrb4SLnEpLpzcpp/Is=";
+    sha256 = "sha256-uaJt1QS4nDVliIFo11OhQYvOxJMeda0QGuaGZCPRoWk=";
   };
 
   goPackagePath = "github.com/exoscale/cli";
diff --git a/pkgs/tools/admin/fits-cloudctl/default.nix b/pkgs/tools/admin/fits-cloudctl/default.nix
index b506d1d678f..f53315613e7 100644
--- a/pkgs/tools/admin/fits-cloudctl/default.nix
+++ b/pkgs/tools/admin/fits-cloudctl/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "fits-cloudctl";
-  version = "0.10.11";
+  version = "0.10.12";
 
   src = fetchFromGitHub {
     owner = "fi-ts";
     repo = "cloudctl";
     rev = "v${version}";
-    sha256 = "sha256-hGKnQk2OPpHsjbRh/xx3MidbUMio6tYn+oJB0t1a/yM=";
+    sha256 = "sha256-nFxudeJJ5BkfZxSnRquyATHyHwI+7xwfQxiY8cedtis=";
   };
 
   vendorSha256 = "sha256-f35Asf9l6ZfixpjMGzesTsxmANreilMxH2CULMH3b2o=";
diff --git a/pkgs/tools/admin/lxd/default.nix b/pkgs/tools/admin/lxd/default.nix
index f726e5669e3..55267651c9f 100644
--- a/pkgs/tools/admin/lxd/default.nix
+++ b/pkgs/tools/admin/lxd/default.nix
@@ -11,13 +11,13 @@
 
 buildGoPackage rec {
   pname = "lxd";
-  version = "4.23";
+  version = "4.24";
 
   goPackagePath = "github.com/lxc/lxd";
 
   src = fetchurl {
     url = "https://linuxcontainers.org/downloads/lxd/lxd-${version}.tar.gz";
-    sha256 = "sha256-bPzH9MRirgl3b/wkkYIRhEvryvy/5M2Y9LLPqD4IL8U=";
+    sha256 = "sha256-l/rhWhgmvHOkXL+Omt93X9lwIkiGO4pZl95UlOquslI=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/admin/stripe-cli/default.nix b/pkgs/tools/admin/stripe-cli/default.nix
index 347f6d6f7cf..053446554c7 100644
--- a/pkgs/tools/admin/stripe-cli/default.nix
+++ b/pkgs/tools/admin/stripe-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "stripe-cli";
-  version = "1.8.0";
+  version = "1.8.1";
 
   src = fetchFromGitHub {
     owner = "stripe";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-5Dvmlzhu7xqJAcAdyjPJ/iMooK7N+Qv8J93uEySYb/s=";
+    sha256 = "sha256-R1w+dVBIPbmBOhtVWKfB4tS+Jp1/tahRk6rifPM53HA=";
   };
 
   vendorSha256 = "sha256-KgoSJcVUtE4ryJLtQXNCdl51sgO94vyb682OdL5CYw8=";
diff --git a/pkgs/tools/admin/syft/default.nix b/pkgs/tools/admin/syft/default.nix
index 43d9a628787..cf261187c52 100644
--- a/pkgs/tools/admin/syft/default.nix
+++ b/pkgs/tools/admin/syft/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "syft";
-  version = "0.41.4";
+  version = "0.41.6";
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-QRT5wvud9VMtXQ8QPC7joIMq7kYYlfVUSgzqMFW5LIE=";
+    sha256 = "sha256-Ebs0IVdcll7bTNjoZalD5Ye0GFXJeas1nPseYLzZxOk=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -22,7 +22,7 @@ buildGoModule rec {
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
-  vendorSha256 = "sha256-9/Mtjqny68HN4FItT2+yoknzdHBAS1aQL0VkTdm6624=";
+  vendorSha256 = "sha256-/WGkQfCUDmolGdzNxIZKzZnXWnqO2vvizBLJgO+s4Ak=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/admin/trinsic-cli/default.nix b/pkgs/tools/admin/trinsic-cli/default.nix
index d8e084218d4..d280fac0733 100644
--- a/pkgs/tools/admin/trinsic-cli/default.nix
+++ b/pkgs/tools/admin/trinsic-cli/default.nix
@@ -2,11 +2,11 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "trinsic-cli";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchurl {
     url = "https://github.com/trinsic-id/sdk/releases/download/v${version}/trinsic-cli-vendor-${version}.tar.gz";
-    sha256 = "4ec8a02cf7cd31822668e97befe96f0a7a32b1103abfe27c1bff643d3bf16588";
+    sha256 = "sha256-Dxmjbd1Q2JNeET22Fte7bygd+oH3ZfovRTJh5xforuw=";
   };
 
   cargoVendorDir = "vendor";
diff --git a/pkgs/tools/admin/trivy/default.nix b/pkgs/tools/admin/trivy/default.nix
index 00fa4cc6d65..b37bdef882a 100644
--- a/pkgs/tools/admin/trivy/default.nix
+++ b/pkgs/tools/admin/trivy/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "trivy";
-  version = "0.24.2";
+  version = "0.24.4";
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-xMLSou+8kIQVEJlkA7ygv623hvETcEAdyFPR3HJr5ZQ=";
+    sha256 = "sha256-IroWxLfDVkS6mFweQioOxjSBA1yXrcdtqFG0W+Sb8Sc=";
   };
 
-  vendorSha256 = "sha256-qRkxDvrqMVOsz5r3m3I+E0HAVoUwFykkfGzTz9Qc/S4=";
+  vendorSha256 = "sha256-OGwqRrhj/+oCCaXnb2s4N6a+vhTZHwe2HidAn0UaFXM=";
 
   excludedPackages = "misc";
 
diff --git a/pkgs/tools/archivers/7zz/default.nix b/pkgs/tools/archivers/7zz/default.nix
index c93a750e48f..c4ccae0272e 100644
--- a/pkgs/tools/archivers/7zz/default.nix
+++ b/pkgs/tools/archivers/7zz/default.nix
@@ -1,4 +1,14 @@
-{ stdenv, lib, fetchurl, p7zip, uasm, useUasm ? stdenv.isx86_64 }:
+{ stdenv
+, lib
+, fetchurl
+
+, uasm
+, useUasm ? stdenv.isx86_64
+
+  # RAR code is under non-free unRAR license
+  # see the meta.license section below for more details
+, enableUnfree ? false
+}:
 
 let
   inherit (stdenv.hostPlatform) system;
@@ -14,17 +24,38 @@ stdenv.mkDerivation rec {
   version = "21.07";
 
   src = fetchurl {
-    url = "https://7-zip.org/a/7z${lib.replaceStrings [ "." ] [ "" ] version}-src.7z";
-    sha256 = "sha256-0QdNVvQVqrmdmeWXp7ZtxFXbpjSa6KTInfdkdbahKEw=";
+    url = "https://7-zip.org/a/7z${lib.replaceStrings [ "." ] [ "" ] version}-src.tar.xz";
+    sha256 = {
+      free = "sha256-SMM6kQ6AZ05s4miJjMoE4NnsXQ0tlkdWx0q2HKjhaM8=";
+      unfree = "sha256-IT1ZRAfLjvy6NmELFSykkh7aFBYzELQ5A9E+aDE+Hjk=";
+    }.${if enableUnfree then "unfree" else "free"};
+    downloadToTemp = (!enableUnfree);
+    # remove the unRAR related code from the src drv
+    # > the license requires that you agree to these use restrictions,
+    # > or you must remove the software (source and binary) from your hard disks
+    # https://fedoraproject.org/wiki/Licensing:Unrar
+    postFetch = lib.optionalString (!enableUnfree) ''
+      mkdir tmp
+      tar xf $downloadedFile -C ./tmp
+      rm -r ./tmp/CPP/7zip/Compress/Rar*
+      tar cfJ $out -C ./tmp . \
+        --sort=name \
+        --mtime="@$SOURCE_DATE_EPOCH" \
+        --owner=0 --group=0 --numeric-owner \
+        --pax-option=exthdr.name=%d/PaxHeaders/%f,delete=atime,delete=ctime
+    '';
   };
 
   sourceRoot = "CPP/7zip/Bundles/Alone2";
 
-  makeFlags = lib.optionals useUasm [ "MY_ASM=uasm" ];
+  makeFlags =
+    lib.optionals useUasm [ "MY_ASM=uasm" ] ++
+    # it's the compression code with the restriction, see DOC/License.txt
+    lib.optionals (!enableUnfree) [ "DISABLE_RAR_COMPRESS=true" ];
 
   makefile = "../../cmpl_gcc${platformSuffix}.mak";
 
-  nativeBuildInputs = [ p7zip ] ++ lib.optionals useUasm [ uasm ];
+  nativeBuildInputs = lib.optionals useUasm [ uasm ];
 
   enableParallelBuilding = true;
 
@@ -40,14 +71,27 @@ stdenv.mkDerivation rec {
   doInstallCheck = true;
 
   installCheckPhase = ''
+    runHook preInstallCheck
+
     $out/bin/7zz --help | grep ${version}
+
+    runHook postInstallCheck
   '';
 
+  passthru.updateScript = ./update.sh;
+
   meta = with lib; {
     description = "Command line archiver utility";
     homepage = "https://7-zip.org";
-    license = licenses.lgpl21Plus;
-    maintainers = with maintainers; [ anna328p peterhoeg ];
+    license = with licenses;
+      # 7zip code is largely lgpl2Plus
+      # CPP/7zip/Compress/LzfseDecoder.cpp is bsd3
+      [ lgpl2Plus /* and */ bsd3 ] ++
+      # and CPP/7zip/Compress/Rar* are unfree with the unRAR license restriction
+      # the unRAR compression code is disabled by default
+      lib.optionals enableUnfree [ unfree ];
+    maintainers = with maintainers; [ anna328p peterhoeg jk ];
     platforms = platforms.linux;
+    mainProgram = "7zz";
   };
 }
diff --git a/pkgs/tools/archivers/7zz/update.sh b/pkgs/tools/archivers/7zz/update.sh
new file mode 100755
index 00000000000..bbc9804799a
--- /dev/null
+++ b/pkgs/tools/archivers/7zz/update.sh
@@ -0,0 +1,50 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -i bash -p coreutils gnused curl jq
+set -euo pipefail
+cd "$(dirname "${BASH_SOURCE[0]}")"
+
+DRV_DIR="$PWD"
+
+OLD_VERSION="$(sed -nE 's/\s*version = "(.*)".*/\1/p' ./default.nix)"
+
+NEW_VERSION="$(curl "https://sourceforge.net/projects/sevenzip/best_release.json" | jq '.platform_releases.linux.filename' -r | cut -d/ -f3)"
+
+echo "comparing versions $OLD_VERSION => $NEW_VERSION"
+if [[ "$OLD_VERSION" == "$NEW_VERSION" ]]; then
+    echo "Already up to date! Doing nothing"
+    exit 0
+fi
+
+NIXPKGS_ROOT="$(realpath "$DRV_DIR/../../../..")"
+
+echo "getting free source hash"
+OLD_FREE_HASH="$(nix-instantiate --eval --strict -E "with import $NIXPKGS_ROOT {}; _7zz.src.drvAttrs.outputHash" | tr -d '"')"
+echo "getting unfree source hash"
+OLD_UNFREE_HASH="$(nix-instantiate --eval --strict -E "with import $NIXPKGS_ROOT {}; (_7zz.override { enableUnfree = true; }).src.drvAttrs.outputHash" | tr -d '"')"
+
+NEW_VERSION_FORMATTED="$(echo "$NEW_VERSION" | tr -d '.')"
+URL="https://7-zip.org/a/7z${NEW_VERSION_FORMATTED}-src.tar.xz"
+
+
+NEW_FREE_HASH=$(nix-prefetch -f "$NIXPKGS_ROOT" -E "_7zz.src" --url "$URL")
+
+NEW_UNFREE_OUT=$(nix-prefetch -f "$NIXPKGS_ROOT" -E "(_7zz.override { enableUnfree = true; }).src" --url "$URL" --output raw --print-path)
+# first line of raw output is the hash
+NEW_UNFREE_HASH="$(echo "$NEW_UNFREE_OUT" | sed -n 1p)"
+# second line of raw output is the src path
+NEW_UNFREE_SRC="$(echo "$NEW_UNFREE_OUT" | sed -n 2p)"
+# make sure to nuke the unfree src from the updater's machine
+# > the license requires that you agree to these use restrictions, or you must remove the software (source and binary) from your hard disks
+# https://fedoraproject.org/wiki/Licensing:Unrar
+nix-store --delete "$NEW_UNFREE_SRC"
+
+
+echo "updating version"
+sed -i "s/version = \"$OLD_VERSION\";/version = \"$NEW_VERSION\";/" "$DRV_DIR/default.nix"
+
+echo "updating free hash"
+sed -i "s@free = \"$OLD_FREE_HASH\";@free = \"$NEW_FREE_HASH\";@" "$DRV_DIR/default.nix"
+echo "updating unfree hash"
+sed -i "s@unfree = \"$OLD_UNFREE_HASH\";@unfree = \"$NEW_UNFREE_HASH\";@" "$DRV_DIR/default.nix"
+
+echo "done"
diff --git a/pkgs/tools/archivers/p7zip/default.nix b/pkgs/tools/archivers/p7zip/default.nix
index 7f892a44da5..5e92553b636 100644
--- a/pkgs/tools/archivers/p7zip/default.nix
+++ b/pkgs/tools/archivers/p7zip/default.nix
@@ -8,7 +8,18 @@ stdenv.mkDerivation rec {
     owner  = "jinfeihan57";
     repo   = pname;
     rev    = "v${version}";
-    sha256 = "sha256-19F4hPV0nKVuFZNbOcXrcA1uW6Y3HQolaHVIYXGmh18=";
+    sha256 = {
+      free = "sha256-DrBuf2VPdcprHI6pMSmL7psm2ofOrUf0Oj0qwMjXzkk=";
+      unfree = "sha256-19F4hPV0nKVuFZNbOcXrcA1uW6Y3HQolaHVIYXGmh18=";
+    }.${if enableUnfree then "unfree" else "free"};
+    # remove the unRAR related code from the src drv
+    # > the license requires that you agree to these use restrictions,
+    # > or you must remove the software (source and binary) from your hard disks
+    # https://fedoraproject.org/wiki/Licensing:Unrar
+    extraPostFetch = lib.optionalString (!enableUnfree) ''
+      rm -r $out/CPP/7zip/Compress/Rar*
+      find $out -name makefile'*' -exec sed -i '/Rar/d' {} +
+    '';
   };
 
   # Default makefile is full of impurities on Darwin. The patch doesn't hurt Linux so I'm leaving it unconditional
@@ -25,11 +36,6 @@ stdenv.mkDerivation rec {
     substituteInPlace makefile.machine \
       --replace 'CC=gcc'  'CC=${stdenv.cc.targetPrefix}gcc' \
       --replace 'CXX=g++' 'CXX=${stdenv.cc.targetPrefix}g++'
-  '' + lib.optionalString (!enableUnfree) ''
-    # Remove non-free RAR source code
-    # (see DOC/License.txt, https://fedoraproject.org/wiki/Licensing:Unrar)
-    rm -r CPP/7zip/Compress/Rar*
-    find . -name makefile'*' -exec sed -i '/Rar/d' {} +
   '';
 
   makeFlags = [ "DEST_HOME=${placeholder "out"}" ];
@@ -46,13 +52,20 @@ stdenv.mkDerivation rec {
 
   NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=c++11-narrowing";
 
-  meta = {
+  passthru.updateScript = ./update.sh;
+
+  meta = with lib; {
     homepage = "https://github.com/jinfeihan57/p7zip";
     description = "A new p7zip fork with additional codecs and improvements (forked from https://sourceforge.net/projects/p7zip/)";
-    platforms = lib.platforms.unix;
-    maintainers = [ lib.maintainers.raskin ];
+    license = with licenses;
+      # p7zip code is largely lgpl2Plus
+      # CPP/7zip/Compress/LzfseDecoder.cpp is bsd3
+      [ lgpl2Plus /* and */ bsd3 ] ++
+      # and CPP/7zip/Compress/Rar* are unfree with the unRAR license restriction
+      # the unRAR compression code is disabled by default
+      lib.optionals enableUnfree [ unfree ];
+    maintainers = with maintainers; [ raskin jk ];
+    platforms = platforms.unix;
     mainProgram = "7z";
-    # RAR code is under non-free UnRAR license, but we remove it
-    license = if enableUnfree then lib.licenses.unfree else lib.licenses.lgpl2Plus;
   };
 }
diff --git a/pkgs/tools/archivers/p7zip/update.sh b/pkgs/tools/archivers/p7zip/update.sh
new file mode 100755
index 00000000000..0d4b91e56e8
--- /dev/null
+++ b/pkgs/tools/archivers/p7zip/update.sh
@@ -0,0 +1,47 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -i bash -p coreutils gnused curl jq
+set -euo pipefail
+cd "$(dirname "${BASH_SOURCE[0]}")"
+
+DRV_DIR="$PWD"
+
+OLD_VERSION="$(sed -nE 's/\s*version = "(.*)".*/\1/p' ./default.nix)"
+
+NEW_VERSION="$(curl https://api.github.com/repos/jinfeihan57/p7zip/releases/latest | jq .tag_name -r | tr -d 'v')"
+
+echo "comparing versions $OLD_VERSION => $NEW_VERSION"
+if [[ "$OLD_VERSION" == "$NEW_VERSION" ]]; then
+    echo "Already up to date! Doing nothing"
+    exit 0
+fi
+
+NIXPKGS_ROOT="$(realpath "$DRV_DIR/../../../..")"
+
+echo "getting free source hash"
+OLD_FREE_HASH="$(nix-instantiate --eval --strict -E "with import $NIXPKGS_ROOT {}; p7zip.src.drvAttrs.outputHash" | tr -d '"')"
+echo "getting unfree source hash"
+OLD_UNFREE_HASH="$(nix-instantiate --eval --strict -E "with import $NIXPKGS_ROOT {}; (p7zip.override { enableUnfree = true; }).src.drvAttrs.outputHash" | tr -d '"')"
+
+
+NEW_FREE_HASH=$(nix-prefetch -f "$NIXPKGS_ROOT" -E "p7zip.src" --rev "v$NEW_VERSION")
+
+NEW_UNFREE_OUT=$(nix-prefetch -f "$NIXPKGS_ROOT" -E "(p7zip.override { enableUnfree = true; }).src" --rev "v$NEW_VERSION" --output raw --print-path)
+# first line of raw output is the hash
+NEW_UNFREE_HASH="$(echo "$NEW_UNFREE_OUT" | sed -n 1p)"
+# second line of raw output is the src path
+NEW_UNFREE_SRC="$(echo "$NEW_UNFREE_OUT" | sed -n 2p)"
+# make sure to nuke the unfree src from the updater's machine
+# > the license requires that you agree to these use restrictions, or you must remove the software (source and binary) from your hard disks
+# https://fedoraproject.org/wiki/Licensing:Unrar
+nix-store --delete "$NEW_UNFREE_SRC"
+
+
+echo "updating version"
+sed -i "s/version = \"$OLD_VERSION\";/version = \"$NEW_VERSION\";/" "$DRV_DIR/default.nix"
+
+echo "updating free hash"
+sed -i "s@free = \"$OLD_FREE_HASH\";@free = \"$NEW_FREE_HASH\";@" "$DRV_DIR/default.nix"
+echo "updating unfree hash"
+sed -i "s@unfree = \"$OLD_UNFREE_HASH\";@unfree = \"$NEW_UNFREE_HASH\";@" "$DRV_DIR/default.nix"
+
+echo "done"
diff --git a/pkgs/tools/backup/autorestic/default.nix b/pkgs/tools/backup/autorestic/default.nix
index 3837c55655e..b1d863c1cf1 100644
--- a/pkgs/tools/backup/autorestic/default.nix
+++ b/pkgs/tools/backup/autorestic/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "autorestic";
-  version = "1.5.6";
+  version = "1.5.7";
 
   src = fetchFromGitHub {
     owner = "cupcakearmy";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-NhKAxybPLBR1Kaw2d4xI8WKS4cG0yAMHbUBDWgr5T0A=";
+    sha256 = "sha256-o3SO3y26ur16D20rTYtzfyZWNDbeOzvj/BpMykvG698=";
   };
 
-  vendorSha256 = "sha256-WzmgV0wUsGfMVeho6M8wXJKD9adaAKRYmaJYaAcXwFc=";
+  vendorSha256 = "sha256-qYXdRpQT7x+Y5h8PuKGjsANXLqjNlsPKO76GQhnufTU=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/backup/btrbk/default.nix b/pkgs/tools/backup/btrbk/default.nix
index b04263a7168..d9f336c86d4 100644
--- a/pkgs/tools/backup/btrbk/default.nix
+++ b/pkgs/tools/backup/btrbk/default.nix
@@ -18,11 +18,11 @@
 
 stdenv.mkDerivation rec {
   pname = "btrbk";
-  version = "0.32.0";
+  version = "0.32.1";
 
   src = fetchurl {
     url = "https://digint.ch/download/btrbk/releases/${pname}-${version}.tar.xz";
-    sha256 = "HmvNtIgFfeaiFuSRobWlcJqusPSYtqAqx+79+CeNVDQ=";
+    sha256 = "flQf1KTybPImDoD+iNe+P+u1rOiYxXjQoltuGPWuX3g=";
   };
 
   nativeBuildInputs = [ asciidoctor makeWrapper ];
diff --git a/pkgs/tools/backup/bupstash/default.nix b/pkgs/tools/backup/bupstash/default.nix
index 91876f68d4a..0d3550c05bc 100644
--- a/pkgs/tools/backup/bupstash/default.nix
+++ b/pkgs/tools/backup/bupstash/default.nix
@@ -1,16 +1,16 @@
 { lib, fetchFromGitHub, installShellFiles, rustPlatform, ronn, pkg-config, libsodium }:
 rustPlatform.buildRustPackage rec {
   pname = "bupstash";
-  version = "0.10.3";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "andrewchambers";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-YN5pIXJRTQXqFGuXvyoSlYJEjAZ4wIYEKjEeF8qIJCI=";
+    sha256 = "sha256-9yWQQ8uzDkN3Pi2OiEn+oEazc3nH53dF2GswBCu8d3c=";
   };
 
-  cargoSha256 = "sha256-Erpg+Sktx+L2X9k6g1ngOyM8MNoucGcScOSPMB7vld8=";
+  cargoSha256 = "sha256-JAclSUFuQk768cgDEvG1rxux2xBGHl1d/NAoxw161YU=";
 
   nativeBuildInputs = [ ronn pkg-config installShellFiles ];
   buildInputs = [ libsodium ];
diff --git a/pkgs/tools/filesystems/dosfstools/default.nix b/pkgs/tools/filesystems/dosfstools/default.nix
index 14d054364fd..75a39fdfe92 100644
--- a/pkgs/tools/filesystems/dosfstools/default.nix
+++ b/pkgs/tools/filesystems/dosfstools/default.nix
@@ -1,21 +1,30 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, libiconv }:
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, libiconv, gettext, xxd }:
 
 stdenv.mkDerivation rec {
   pname = "dosfstools";
-  version = "4.1";
+  version = "4.2";
 
   src = fetchFromGitHub {
     owner = "dosfstools";
     repo = "dosfstools";
     rev = "v${version}";
-    sha256 = "1a2zn1655d5f1m6jp9vpn3bp8yfxhcmxx3mx23ai9hmxiydiykr1";
+    sha256 = "sha256-2gxB0lQixiHOHw8uTetHekaM57fvUd9zOzSxWnvUz/c=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ]
     ++ lib.optional stdenv.isDarwin libiconv;
 
+  # configure.ac:75: error: required file './config.rpath' not found
+  # https://github.com/dosfstools/dosfstools/blob/master/autogen.sh
+  postPatch = ''
+    cp ${gettext}/share/gettext/config.rpath config.rpath
+  '';
+
   configureFlags = [ "--enable-compat-symlinks" ];
 
+  checkInputs = [ xxd ];
+  doCheck = true;
+
   meta = {
     description = "Utilities for creating and checking FAT and VFAT file systems";
     homepage = "https://github.com/dosfstools/dosfstools";
diff --git a/pkgs/tools/filesystems/squashfs/darwin.patch b/pkgs/tools/filesystems/squashfs/darwin.patch
index 5f2e0b07299..657971c5b0a 100644
--- a/pkgs/tools/filesystems/squashfs/darwin.patch
+++ b/pkgs/tools/filesystems/squashfs/darwin.patch
@@ -5,7 +5,7 @@ with BSD-specific changes omitted.
 See also https://github.com/plougher/squashfs-tools/pull/69.
 
 diff --git a/squashfs-tools/action.c b/squashfs-tools/action.c
-index 4b06ccb..3cad2ab 100644
+index ea2f604..9c979f8 100644
 --- a/squashfs-tools/action.c
 +++ b/squashfs-tools/action.c
 @@ -39,6 +39,10 @@
@@ -19,7 +19,7 @@ index 4b06ccb..3cad2ab 100644
  #include "squashfs_fs.h"
  #include "mksquashfs.h"
  #include "action.h"
-@@ -2414,9 +2418,12 @@ static char *get_start(char *s, int n)
+@@ -2415,9 +2419,12 @@ static char *get_start(char *s, int n)
  
  static int subpathname_fn(struct atom *atom, struct action_data *action_data)
  {
@@ -34,7 +34,7 @@ index 4b06ccb..3cad2ab 100644
  
  /*
 diff --git a/squashfs-tools/info.c b/squashfs-tools/info.c
-index fe23d78..5c2f835 100644
+index 216b979..eea2ec9 100644
 --- a/squashfs-tools/info.c
 +++ b/squashfs-tools/info.c
 @@ -144,31 +144,22 @@ void dump_state()
@@ -89,7 +89,7 @@ index fe23d78..5c2f835 100644
  }
  
 diff --git a/squashfs-tools/mksquashfs.c b/squashfs-tools/mksquashfs.c
-index a45b77f..3607448 100644
+index 843f9f4..ed2c3a6 100644
 --- a/squashfs-tools/mksquashfs.c
 +++ b/squashfs-tools/mksquashfs.c
 @@ -35,7 +35,12 @@
@@ -117,7 +117,7 @@ index a45b77f..3607448 100644
  
  #ifndef linux
  #include <sys/sysctl.h>
-@@ -5022,6 +5030,7 @@ static void initialise_threads(int readq, int fragq, int bwriteq, int fwriteq,
+@@ -5064,6 +5072,7 @@ static void initialise_threads(int readq, int fragq, int bwriteq, int fwriteq,
  	sigemptyset(&sigmask);
  	sigaddset(&sigmask, SIGQUIT);
  	sigaddset(&sigmask, SIGHUP);
@@ -125,7 +125,7 @@ index a45b77f..3607448 100644
  	if(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) != 0)
  		BAD_ERROR("Failed to set signal mask in intialise_threads\n");
  
-@@ -5760,6 +5769,35 @@ static int get_physical_memory()
+@@ -5802,6 +5811,35 @@ static int get_physical_memory()
  	long long page_size = sysconf(_SC_PAGESIZE);
  	int phys_mem;
  
@@ -161,7 +161,7 @@ index a45b77f..3607448 100644
  	if(num_pages == -1 || page_size == -1) {
  		struct sysinfo sys;
  		int res = sysinfo(&sys);
-@@ -5772,6 +5810,7 @@ static int get_physical_memory()
+@@ -5814,6 +5852,7 @@ static int get_physical_memory()
  	}
  
  	phys_mem = num_pages * page_size >> 20;
@@ -170,7 +170,7 @@ index a45b77f..3607448 100644
  	if(phys_mem < SQUASHFS_LOWMEM)
  		BAD_ERROR("Mksquashfs requires more physical memory than is "
 diff --git a/squashfs-tools/read_xattrs.c b/squashfs-tools/read_xattrs.c
-index 4debedf..3257c30 100644
+index 2067f80..ca8b7f4 100644
 --- a/squashfs-tools/read_xattrs.c
 +++ b/squashfs-tools/read_xattrs.c
 @@ -31,13 +31,13 @@
@@ -186,11 +186,11 @@ index 4debedf..3257c30 100644
  
 -#include <stdlib.h>
 -
- extern int read_fs_bytes(int, long long, int, void *);
+ extern int read_fs_bytes(int, long long, long long, void *);
  extern int read_block(int, long long, long long *, int, void *);
  
 diff --git a/squashfs-tools/unsquashfs.c b/squashfs-tools/unsquashfs.c
-index 727f1d5..c1a6183 100644
+index d434b42..1208e45 100644
 --- a/squashfs-tools/unsquashfs.c
 +++ b/squashfs-tools/unsquashfs.c
 @@ -32,8 +32,12 @@
@@ -206,7 +206,7 @@ index 727f1d5..c1a6183 100644
  #include <sys/types.h>
  #include <sys/time.h>
  #include <sys/resource.h>
-@@ -1175,7 +1179,7 @@ int create_inode(char *pathname, struct inode *i)
+@@ -1182,7 +1186,7 @@ int create_inode(char *pathname, struct inode *i)
  			break;
  		case SQUASHFS_SYMLINK_TYPE:
  		case SQUASHFS_LSYMLINK_TYPE: {
@@ -215,7 +215,7 @@ index 727f1d5..c1a6183 100644
  				{ i->time, 0 },
  				{ i->time, 0 }
  			};
-@@ -1194,8 +1198,7 @@ int create_inode(char *pathname, struct inode *i)
+@@ -1201,8 +1205,7 @@ int create_inode(char *pathname, struct inode *i)
  				goto failed;
  			}
  
@@ -225,7 +225,7 @@ index 727f1d5..c1a6183 100644
  			if(res == -1) {
  				EXIT_UNSQUASH_STRICT("create_inode: failed to"
  					" set time on %s, because %s\n",
-@@ -2683,6 +2686,7 @@ void initialise_threads(int fragment_buffer_size, int data_buffer_size, int cat_
+@@ -2687,6 +2690,7 @@ void initialise_threads(int fragment_buffer_size, int data_buffer_size, int cat_
  		sigemptyset(&sigmask);
  		sigaddset(&sigmask, SIGQUIT);
  		sigaddset(&sigmask, SIGHUP);
@@ -234,7 +234,7 @@ index 727f1d5..c1a6183 100644
  			EXIT_UNSQUASH("Failed to set signal mask in initialise_threads\n");
  
 diff --git a/squashfs-tools/unsquashfs.h b/squashfs-tools/unsquashfs.h
-index 934618b..0e680ab 100644
+index 1099678..5b6a038 100644
 --- a/squashfs-tools/unsquashfs.h
 +++ b/squashfs-tools/unsquashfs.h
 @@ -46,6 +46,10 @@
@@ -249,7 +249,7 @@ index 934618b..0e680ab 100644
  #include "squashfs_fs.h"
  #include "unsquashfs_error.h"
 diff --git a/squashfs-tools/unsquashfs_info.c b/squashfs-tools/unsquashfs_info.c
-index c8e2b9b..7d4f7af 100644
+index e906eaf..f1e68c2 100644
 --- a/squashfs-tools/unsquashfs_info.c
 +++ b/squashfs-tools/unsquashfs_info.c
 @@ -96,31 +96,22 @@ void dump_state()
@@ -304,7 +304,7 @@ index c8e2b9b..7d4f7af 100644
  }
  
 diff --git a/squashfs-tools/unsquashfs_xattr.c b/squashfs-tools/unsquashfs_xattr.c
-index 7742dfe..f8cd3b6 100644
+index 61910e1..73e0090 100644
 --- a/squashfs-tools/unsquashfs_xattr.c
 +++ b/squashfs-tools/unsquashfs_xattr.c
 @@ -27,6 +27,11 @@
@@ -320,7 +320,7 @@ index 7742dfe..f8cd3b6 100644
  
  extern int root_process;
 diff --git a/squashfs-tools/xattr.c b/squashfs-tools/xattr.c
-index 64dfd82..d82d186 100644
+index b1c0089..6d7ed98 100644
 --- a/squashfs-tools/xattr.c
 +++ b/squashfs-tools/xattr.c
 @@ -22,6 +22,14 @@
@@ -353,5 +353,5 @@ index 64dfd82..d82d186 100644
  #include "squashfs_swap.h"
  #include "mksquashfs.h"
 -- 
-2.23.0
+2.35.1
 
diff --git a/pkgs/tools/filesystems/squashfs/default.nix b/pkgs/tools/filesystems/squashfs/default.nix
index ee6a9d9a4c3..340c5add295 100644
--- a/pkgs/tools/filesystems/squashfs/default.nix
+++ b/pkgs/tools/filesystems/squashfs/default.nix
@@ -2,44 +2,43 @@
 , stdenv
 , fetchFromGitHub
 , fetchpatch
-, zlib
-, xz
+, help2man
 , lz4
 , lzo
-, zstd
 , nixosTests
+, which
+, xz
+, zlib
+, zstd
 }:
 
 stdenv.mkDerivation rec {
   pname = "squashfs";
-  version = "4.5";
+  version = "4.5.1";
 
   src = fetchFromGitHub {
     owner = "plougher";
     repo = "squashfs-tools";
     rev = version;
-    sha256 = "1nanwz5qvsakxfm37md5i7xqagv69nfik9hpj8qlp6ymw266vgxr";
+    sha256 = "sha256-Y3ZPjeE9HN1F+NtGe6EchYziWrTPVQ4SuKaCvNbXMKI=";
   };
 
   patches = [
     # This patch adds an option to pad filesystems (increasing size) in
     # exchange for better chunking / binary diff calculation.
     ./4k-align.patch
-    # Otherwise sizes of some files may break in our ISO; see
-    # https://github.com/NixOS/nixpkgs/issues/132286
-    (fetchpatch {
-      url = "https://github.com/plougher/squashfs-tools/commit/19b161c1cd3e31f7a396ea92dea4390ad43f27b9.diff";
-      sha256 = "15ng8m2my3a6a9hnfx474bip2vwdh08hzs2k0l5gwd36jv2z1h3f";
-    })
   ] ++ lib.optional stdenv.isDarwin ./darwin.patch;
 
-  buildInputs = [ zlib xz zstd lz4 lzo ];
+  buildInputs = [ zlib xz zstd lz4 lzo which help2man ];
 
   preBuild = ''
     cd squashfs-tools
   '' ;
 
-  installFlags = [ "INSTALL_DIR=${placeholder "out"}/bin" ];
+  installFlags = [
+    "INSTALL_DIR=${placeholder "out"}/bin"
+    "INSTALL_MANPAGES_DIR=${placeholder "out"}/share/man/man1"
+  ];
 
   makeFlags = [
     "XZ_SUPPORT=1"
diff --git a/pkgs/tools/graphics/wkhtmltopdf-bin/default.nix b/pkgs/tools/graphics/wkhtmltopdf-bin/default.nix
new file mode 100644
index 00000000000..3c2b446a8e1
--- /dev/null
+++ b/pkgs/tools/graphics/wkhtmltopdf-bin/default.nix
@@ -0,0 +1,51 @@
+{ stdenv, lib, fetchurl, wkhtmltopdf, xar, cpio }:
+
+stdenv.mkDerivation rec {
+
+  pname = "wkhtmltopdf-bin";
+  version = "0.12.6-1";
+  sha256 = "1db59kdprzpmvdj1bg47lmfgi3zlvzvqif11sbym9hw61xy6gp3d";
+  src = fetchurl {
+    url =
+      "https://github.com/wkhtmltopdf/packaging/releases/download/${version}/wkhtmltox-${version}.macos-cocoa.pkg";
+    inherit sha256;
+  };
+
+  buildInputs = [ xar cpio ];
+
+  unpackPhase = ''
+    xar -xf $src
+    zcat Payload | cpio -i
+    tar -xf usr/local/share/wkhtmltox-installer/wkhtmltox.tar.gz
+  '';
+
+  installPhase = ''
+    mkdir -p $out
+    cp -r bin include lib share $out/
+  '';
+
+  dontStrip = true;
+
+  doInstallCheck = true;
+
+  installCheckPhase = ''
+    $out/bin/wkhtmltopdf --version
+  '';
+
+  meta = with lib; {
+    homepage = "https://wkhtmltopdf.org/";
+    description =
+      "Tools for rendering web pages to PDF or images (binary package)";
+    longDescription = ''
+      wkhtmltopdf and wkhtmltoimage are open source (LGPL) command line tools
+      to render HTML into PDF and various image formats using the QT Webkit
+      rendering engine. These run entirely "headless" and do not require a
+      display or display service.
+
+      There is also a C library, if you're into that kind of thing.
+    '';
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ nbr ];
+    platforms = [ "x86_64-darwin" ];
+  };
+}
diff --git a/pkgs/tools/misc/apkeep/default.nix b/pkgs/tools/misc/apkeep/default.nix
index d405302282f..ef7699ccf28 100644
--- a/pkgs/tools/misc/apkeep/default.nix
+++ b/pkgs/tools/misc/apkeep/default.nix
@@ -2,14 +2,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "apkeep";
-  version = "0.9.0";
+  version = "0.10.0";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-ST1ifON25mizKZQX3fKeqBloXWW9LXDq5JkZIeiguRY=";
+    sha256 = "14vm3b2gbmn9pil0aagwchn4kyvi9311id6qv4a376qfb6r1aybf";
   };
 
-  cargoSha256 = "sha256-/Xh1s4PO336B1ioKe0IKVGDACpMuXOpxA82U6zn2lj0=";
+  cargoSha256 = "0i8wzc58ji317kjdw3ls1908z4bqlh1cgjph0fxsvs5i552qjkzp";
 
   prePatch = ''
     rm .cargo/config.toml
diff --git a/pkgs/tools/misc/broadlink-cli/default.nix b/pkgs/tools/misc/broadlink-cli/default.nix
index b71b5b444e3..ee99e643b1f 100644
--- a/pkgs/tools/misc/broadlink-cli/default.nix
+++ b/pkgs/tools/misc/broadlink-cli/default.nix
@@ -2,7 +2,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "broadlink-cli";
-  version = "0.18.0";
+  version = "0.18.1";
 
   # the tools are available as part of the source distribution from GH but
   # not pypi, so we have to fetch them here.
@@ -10,7 +10,7 @@ python3Packages.buildPythonApplication rec {
     owner  = "mjg59";
     repo   = "python-broadlink";
     rev    = version;
-    sha256 = "0nh9rn1zpc44qsc50360ycg02gwbgq59784mnkp01nhavnwwwx10";
+    sha256 = "sha256-x7RVCu5xOwhUOxXIHP7ZAe1/9F9ecf9RgL9I53e9Mcw=";
   };
 
   format = "other";
diff --git a/pkgs/tools/misc/chezmoi/default.nix b/pkgs/tools/misc/chezmoi/default.nix
index 787e4248d46..4ffffa63609 100644
--- a/pkgs/tools/misc/chezmoi/default.nix
+++ b/pkgs/tools/misc/chezmoi/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "chezmoi";
-  version = "2.13.1";
+  version = "2.14.0";
 
   src = fetchFromGitHub {
     owner = "twpayne";
     repo = "chezmoi";
     rev = "v${version}";
-    sha256 = "sha256-Ui9zj/PI8vYkbT8M13dZ1N4sxhM8fo8ZVeOP9Oa35xg=";
+    sha256 = "sha256-WxOpmowRP8KSxxjW4JNQlQL6jZ2EhvpNb87NgeSO890=";
   };
 
-  vendorSha256 = "sha256-6+T0UQDrCnoRZkMajyw50eH/AFIUzCgxCkWVmTfycD0=";
+  vendorSha256 = "sha256-ord4jHjgiW+Z2OD/x2ZAFOJYLyoB7Tja6SOd+JqxWDM=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/misc/diffoscope/default.nix b/pkgs/tools/misc/diffoscope/default.nix
index 7f1655b9843..17f57d31ab8 100644
--- a/pkgs/tools/misc/diffoscope/default.nix
+++ b/pkgs/tools/misc/diffoscope/default.nix
@@ -50,7 +50,7 @@ python3Packages.buildPythonApplication rec {
       xz zip zstd
     ]
     ++ (with python3Packages; [
-      argcomplete black debian defusedxml jsondiff jsbeautifier libarchive-c
+      argcomplete debian defusedxml jsondiff jsbeautifier libarchive-c
       python_magic progressbar33 pypdf2 rpm tlsh
     ])
     ++ lib.optionals stdenv.isLinux [ python3Packages.pyxattr acl cdrkit dtc ]
@@ -66,20 +66,19 @@ python3Packages.buildPythonApplication rec {
     installManPage doc/diffoscope.1
   '';
 
-  # Disable flaky test and a failing one
   disabledTests = [
+    # Disable flaky test and a failing one
     "test_android_manifest"
     "test_sbin_added_to_path"
     "test_diff_meta"
     "test_diff_meta2"
     "test_obj_no_differences"
 
-    # Failing because of file-v5.40 has a slightly different output.
-    # Upstream issue: https://salsa.debian.org/reproducible-builds/diffoscope/-/issues/271
-    "test_text_proper_indentation"
-
     # fails because it fails to determine llvm version
     "test_item3_deflate_llvm_bitcode"
+
+    # disable formatting tests because they can break on black updates
+    "test_code_is_black_clean"
   ] ++ lib.optionals stdenv.isDarwin [
     # Disable flaky tests on Darwin
     "test_non_unicode_filename"
diff --git a/pkgs/tools/misc/dua/default.nix b/pkgs/tools/misc/dua/default.nix
index f0984696fe3..d7f3eafe3ec 100644
--- a/pkgs/tools/misc/dua/default.nix
+++ b/pkgs/tools/misc/dua/default.nix
@@ -2,7 +2,7 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "dua";
-  version = "2.17.0";
+  version = "2.17.1";
 
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv Foundation ];
 
@@ -10,7 +10,7 @@ rustPlatform.buildRustPackage rec {
     owner = "Byron";
     repo = "dua-cli";
     rev = "v${version}";
-    sha256 = "sha256-yac/WUVL10JU1V5f9LYh57yYzZ2JMf24jMd8Mun7OMU=";
+    sha256 = "sha256-58l0E5wwRKbF/ja3fmMMBIONjuwVOxlwdKRT5BeO9MQ=";
     # Remove unicode file names which leads to different checksums on HFS+
     # vs. other filesystems because of unicode normalisation.
     extraPostFetch = ''
@@ -18,7 +18,7 @@ rustPlatform.buildRustPackage rec {
     '';
   };
 
-  cargoSha256 = "sha256-Q0ZLMbnQeG/64QvAIPpa3k+lI6dbSSQcdYb5e2rX8U0=";
+  cargoSha256 = "sha256-nft0wrgTMrI8Tav6NcqPwSF8Q367twIOr1voBsW2488=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/misc/hashit/default.nix b/pkgs/tools/misc/hashit/default.nix
index b9bf5f0ae5f..5971939da17 100644
--- a/pkgs/tools/misc/hashit/default.nix
+++ b/pkgs/tools/misc/hashit/default.nix
@@ -24,7 +24,6 @@ stdenv.mkDerivation rec {
   buildInputs = [
     gtk3
     libgee
-    pantheon.elementary-icon-theme
     pantheon.granite
   ];
 
diff --git a/pkgs/tools/misc/infracost/default.nix b/pkgs/tools/misc/infracost/default.nix
index 293ee08a275..920d4a19e79 100644
--- a/pkgs/tools/misc/infracost/default.nix
+++ b/pkgs/tools/misc/infracost/default.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "infracost";
-  version = "0.9.18";
+  version = "0.9.20";
 
   src = fetchFromGitHub {
     owner = "infracost";
     rev = "v${version}";
     repo = "infracost";
-    sha256 = "sha256-ukFY6Iy7RaUjECbMCMdOkulMdzUlsoBnyRiuzldXVc8=";
+    sha256 = "sha256-ujoKnf6f9rrPIxvWlzVnC6q+2BxzhpXgb66clgAuC+8=";
   };
-  vendorSha256 = "sha256-D4tXBXtD3FlWvp4GPIuo/2p3MKg81DVPT5pKVOGe/5c=";
+  vendorSha256 = "sha256-TfO3+pGxR9dPzigkx89a/Ak+tKiBa6Z0a6U4kIdRsSQ=";
 
   ldflags = [ "-s" "-w" "-X github.com/infracost/infracost/internal/version.Version=v${version}" ];
 
@@ -23,9 +23,9 @@ buildGoModule rec {
   checkPhase = ''
     runHook preCheck
 
-    # Remove tests that require networking
-    rm cmd/infracost/{breakdown_test,diff_test,run_test}.go
-
+    # remove tests that require networking
+    rm cmd/infracost/{breakdown,diff,hcl,run}_test.go
+    # checkFlags aren't correctly passed through via buildGoModule
     go test $checkFlags ''${ldflags:+-ldflags="$ldflags"} -v -p $NIX_BUILD_CORES ./...
 
     runHook postCheck
diff --git a/pkgs/tools/misc/miniserve/default.nix b/pkgs/tools/misc/miniserve/default.nix
index 89607f13ac9..d24fae2a1fa 100644
--- a/pkgs/tools/misc/miniserve/default.nix
+++ b/pkgs/tools/misc/miniserve/default.nix
@@ -11,19 +11,27 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "miniserve";
-  version = "0.19.2";
+  version = "0.19.3";
 
   src = fetchFromGitHub {
     owner = "svenstaro";
     repo = "miniserve";
     rev = "v${version}";
-    sha256 = "sha256-/LmLz4hTmOjpR4Bqf+hABh3PSeaO/sSz/EgHp+nM20o=";
+    hash = "sha256-JlpjDUX8v7sGADhdKNQXoklbl/fw8DT0A6hEaUG61TQ=";
   };
 
-  cargoSha256 = "sha256-/KL5c5OeflNDKWuE5Gzqgcew9zf8HFjvmBid+mQSqZE=";
+  cargoSha256 = "sha256-5V8+Mcuu3fxG399QjW++/uWpPMvVWBfhI/L/6pmbkVY=";
 
-  nativeBuildInputs = [ installShellFiles pkg-config zlib ];
-  buildInputs = lib.optionals stdenv.isDarwin [ libiconv Security ];
+  nativeBuildInputs = [
+    installShellFiles
+    pkg-config
+    zlib
+  ];
+
+  buildInputs = lib.optionals stdenv.isDarwin [
+    libiconv
+    Security
+  ];
 
   checkFlags = [
     "--skip=bind_ipv4_ipv6::case_2"
@@ -38,7 +46,7 @@ rustPlatform.buildRustPackage rec {
   '';
 
   meta = with lib; {
-    description = "For when you really just want to serve some files over HTTP right now!";
+    description = "CLI tool to serve files and directories over HTTP";
     homepage = "https://github.com/svenstaro/miniserve";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ ];
diff --git a/pkgs/tools/misc/mmv/default.nix b/pkgs/tools/misc/mmv/default.nix
index 2c58381100a..1f2d61c6c81 100644
--- a/pkgs/tools/misc/mmv/default.nix
+++ b/pkgs/tools/misc/mmv/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mmv";
-  version = "2.1";
+  version = "2.3";
 
   src = fetchFromGitHub {
     owner = "rrthomas";
     repo = "mmv";
     rev = "v${version}";
-    sha256 = "sha256-3XWXOp30P/bOd+c7PC8duidewX8h0hk9VsEUw05dAE4=";
+    sha256 = "sha256-lujar6QGlhNawGOIfM5RAUa4Sbs0BFgG8rEsCDLqDDE=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/tools/misc/mpdscribble/default.nix b/pkgs/tools/misc/mpdscribble/default.nix
index fce376bb32e..deb610950e2 100644
--- a/pkgs/tools/misc/mpdscribble/default.nix
+++ b/pkgs/tools/misc/mpdscribble/default.nix
@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mpdscribble";
-  version = "0.23";
+  version = "0.24";
 
   src = fetchurl {
     url = "https://www.musicpd.org/download/mpdscribble/${version}/mpdscribble-${version}.tar.xz";
-    sha256 = "0s66zqscb44p88cl3kcv5jkjcqsskcnrv7xgrjhzrchf2kcpwf53";
+    sha256 = "sha256-9rTLp0izuH5wUnC0kjyOI+lMLgD+3VC+sUaNvi+yqOc=";
   };
 
   nativeBuildInputs = [ pkg-config meson ninja ];
diff --git a/pkgs/tools/misc/onefetch/default.nix b/pkgs/tools/misc/onefetch/default.nix
index 860a9758d4f..d5e77d4461d 100644
--- a/pkgs/tools/misc/onefetch/default.nix
+++ b/pkgs/tools/misc/onefetch/default.nix
@@ -22,8 +22,15 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-16oiZAyj6haBk6mgUT25pPDUrCMd7pGo2kAQ0gTe2kM=";
   };
 
-  # enable pkg-config feature of zstd
-  cargoPatches = [ ./zstd-pkg-config.patch ];
+  cargoPatches = [
+    # enable pkg-config feature of zstd
+    ./zstd-pkg-config.patch
+    # fix flaky test
+    (fetchpatch {
+      url = "https://github.com/o2sh/onefetch/commit/2c1f2f0b2c666f6ce94af0299f88048dd1d83484.patch";
+      sha256 = "sha256-pI3yCFYkqOmLgKnCwexv1LcCrCkhi44zhEAx0szaMkg=";
+    })
+  ];
 
   cargoSha256 = "sha256-6wnfn33mfye5o/vY1JQX1Lc4+jzHiKKgGsSLxeJWyFc=";
 
diff --git a/pkgs/tools/misc/opentelemetry-collector/contrib.nix b/pkgs/tools/misc/opentelemetry-collector/contrib.nix
index 57a21a2822d..384c448e1d9 100644
--- a/pkgs/tools/misc/opentelemetry-collector/contrib.nix
+++ b/pkgs/tools/misc/opentelemetry-collector/contrib.nix
@@ -6,17 +6,17 @@
 
 buildGoModule rec {
   pname = "opentelemetry-collector-contrib";
-  version = "0.46.0";
+  version = "0.47.0";
 
   src = fetchFromGitHub {
     owner = "open-telemetry";
     repo = "opentelemetry-collector-contrib";
     rev = "v${version}";
-    sha256 = "sha256-VD/gN9lUwzhRTfr8rAQld+4sN+deYhUlNvCphtZncDU=";
+    sha256 = "sha256-IbpQd01uU6/Ihli+gVDjTB8T8cj//XHoZYcDjXD635Q=";
   };
   # proxy vendor to avoid hash missmatches between linux and macOS
   proxyVendor = true;
-  vendorSha256 = "sha256-ojNDDPCo6TGp8BYio/pYykXSLjC5Qplw0WFD9UIiYM4=";
+  vendorSha256 = "sha256-1svBCXfutjXfXfVqVHUTAt9T1ON/qbiS+VCt5kP/YIc=";
 
   subPackages = [ "cmd/otelcontribcol" ];
 
diff --git a/pkgs/tools/misc/opentelemetry-collector/default.nix b/pkgs/tools/misc/opentelemetry-collector/default.nix
index 851d4f2dc18..1feb290bb13 100644
--- a/pkgs/tools/misc/opentelemetry-collector/default.nix
+++ b/pkgs/tools/misc/opentelemetry-collector/default.nix
@@ -12,17 +12,17 @@ let
 in
 buildGoModule rec {
   pname = "opentelemetry-collector";
-  version = "0.46.0";
+  version = "0.47.0";
 
   src = fetchFromGitHub {
     owner = "open-telemetry";
     repo = "opentelemetry-collector";
     rev = "v${version}";
-    sha256 = "sha256-ibaA9oCSsId9A4ul5sfM+L8ExBl+Wv7rhGnb6TZ4WJw=";
+    sha256 = "sha256-1dMdQWV+gxbMc/2iVsB1LCsYxR0bt5AJEvoFq2/KHCg=";
   };
   # there is a nested go.mod
   sourceRoot = "source/cmd/otelcorecol";
-  vendorSha256 = "sha256-Okmsd/skfBmkyLv9oPFH0QvewFZFPpUH2ahWxHt7cy8=";
+  vendorSha256 = "sha256-ps6fUVg7vhGgy47WTJv/U1qHQ2MGXIWXNZ5Rddo1yQY=";
 
   preBuild = ''
     # set the build version, can't be done via ldflags
diff --git a/pkgs/tools/misc/pg_flame/default.nix b/pkgs/tools/misc/pg_flame/default.nix
index 7625e67e001..ca58e2a6570 100644
--- a/pkgs/tools/misc/pg_flame/default.nix
+++ b/pkgs/tools/misc/pg_flame/default.nix
@@ -13,8 +13,6 @@ buildGoModule rec {
 
   vendorSha256 = "1rkx20winh66y2m7i7q13jpr83044i2d1pfd5p5l5kkpsix5mra5";
 
-  doCheck = false;
-
   meta = with lib; {
     description = "Flamegraph generator for Postgres EXPLAIN ANALYZE output";
     homepage = "https://github.com/mgartner/pg_flame";
diff --git a/pkgs/tools/misc/plantuml-server/default.nix b/pkgs/tools/misc/plantuml-server/default.nix
index 8b6c52446aa..8be9c0eecee 100644
--- a/pkgs/tools/misc/plantuml-server/default.nix
+++ b/pkgs/tools/misc/plantuml-server/default.nix
@@ -1,69 +1,20 @@
-{ lib, stdenv, fetchFromGitHub, maven, jdk17_headless }:
+{ lib, stdenv, fetchurl }:
 
 let
   version = "1.2022.2";
-
-  src = fetchFromGitHub {
-    owner = "plantuml";
-    repo = "plantuml-server";
-    rev = "v${version}";
-    sha256 = "sha256-55IBhulFo42jscBFrHM39qA0GRgKBoYNye4q9QkmjsM=";
-  };
-
-  # perform fake build to make a fixed-output derivation out of the files downloaded from maven central
-  deps = stdenv.mkDerivation {
-    name = "plantuml-server-${version}-deps";
-    inherit src;
-    nativeBuildInputs = [ jdk17_headless maven ];
-    buildPhase = ''
-      runHook preBuild
-
-      while mvn package -Dmaven.repo.local=$out/.m2; [ $? = 1 ]; do
-        echo "timeout, restart maven to continue downloading"
-      done
-
-      runHook postBuild
-    '';
-    # keep only *.{pom,jar,sha1,nbm} and delete all ephemeral files with lastModified timestamps inside
-    installPhase = ''
-      find $out/.m2 -type f -regex '.+\(\.lastUpdated\|resolver-status\.properties\|_remote\.repositories\)' -delete
-    '';
-    outputHashAlgo = "sha256";
-    outputHashMode = "recursive";
-    outputHash = "sha256-AheCBX5jFzDHqTI2pCWBIiDESEKMClXlvWIcFvu0goA=";
-  };
 in
-
 stdenv.mkDerivation rec {
   pname = "plantuml-server";
   inherit version;
-  inherit src;
-
-  nativeBuildInputs = [ jdk17_headless maven ];
-
-  buildPhase = ''
-    runHook preBuild
-
-    # maven can output reproducible files after setting project.build.outputTimestamp property
-    # see https://maven.apache.org/guides/mini/guide-reproducible-builds.html#how-do-i-configure-my-maven-build
-    # 'maven.repo.local' must be writable so copy it out of nix store
-    cp -R $src repo
-    chmod +w -R repo
-    cd repo
-    mvn package --offline \
-      -Dproject.build.outputTimestamp=0 \
-      -Dmaven.repo.local=$(cp -dpR ${deps}/.m2 ./ && chmod +w -R .m2 && pwd)/.m2
-
-    runHook postBuild
-  '';
+  src = fetchurl {
+    url = "https://github.com/plantuml/plantuml-server/releases/download/v${version}/plantuml-v${version}.war";
+    sha256 = "sha256-h4ulXzZ5L+VPhk2CnZQNxfnEJzWT3B9TNvDEWt4o9Hk=";
+  };
 
+  dontUnpack = true;
   installPhase = ''
-    runHook preInstall
-
     mkdir -p "$out/webapps"
-    cp "target/plantuml.war" "$out/webapps/plantuml.war"
-
-    runHook postInstall
+    cp "$src" "$out/webapps/plantuml.war"
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/misc/rockbox-utility/default.nix b/pkgs/tools/misc/rockbox-utility/default.nix
index a75b90d6f54..bf191beca3f 100644
--- a/pkgs/tools/misc/rockbox-utility/default.nix
+++ b/pkgs/tools/misc/rockbox-utility/default.nix
@@ -1,9 +1,13 @@
-{ lib, stdenv, fetchurl, pkg-config, cryptopp
-, libusb1, qtbase, qttools, makeWrapper
-, qmake, withEspeak ? false, espeak ? null
-, qt5 }:
-
-let inherit (lib) getDev; in
+{ lib
+, stdenv
+, fetchurl
+, cryptopp
+, libusb1
+, makeWrapper
+, pkg-config
+, qt5
+, withEspeak ? false, espeak ? null
+}:
 
 stdenv.mkDerivation  rec {
   pname = "rockbox-utility";
@@ -11,16 +15,27 @@ stdenv.mkDerivation  rec {
 
   src = fetchurl {
     url = "https://download.rockbox.org/rbutil/source/RockboxUtility-v${version}-src.tar.bz2";
-    sha256 = "0zm9f01a810y7aq0nravbsl0vs9vargwvxnfl4iz9qsqygwlj69y";
+    hash = "sha256-PhlJ+fNY4/Qjoc72zV9WO+kNqF5bZQuwOh4EpAJwqX4=";
   };
 
-  buildInputs = [ cryptopp libusb1 qtbase qttools ]
-    ++ lib.optional withEspeak espeak;
-  nativeBuildInputs = [ makeWrapper pkg-config qmake qt5.wrapQtAppsHook ];
+  nativeBuildInputs = [
+    makeWrapper
+    pkg-config
+    qt5.qmake
+    qt5.wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    cryptopp
+    libusb1
+    qt5.qtbase
+    qt5.qttools
+  ]
+  ++ lib.optional withEspeak espeak;
 
   postPatch = ''
     sed -i rbutil/rbutilqt/rbutilqt.pro \
-        -e '/^lrelease.commands =/ s|$$\[QT_INSTALL_BINS\]/lrelease -silent|${getDev qttools}/bin/lrelease|'
+        -e '/^lrelease.commands =/ s|$$\[QT_INSTALL_BINS\]/lrelease -silent|${lib.getDev qt5.qttools}/bin/lrelease|'
   '';
 
   preConfigure = ''
@@ -48,10 +63,10 @@ stdenv.mkDerivation  rec {
   enableParallelBuilding = false;
 
   meta = with lib; {
-    description = "Open source firmware for mp3 players";
     homepage = "https://www.rockbox.org";
-    license = licenses.gpl2;
+    description = "Open source firmware for digital music players";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ AndersonTorres goibhniu ];
     platforms = platforms.linux;
-    maintainers = with maintainers; [ goibhniu ];
   };
 }
diff --git a/pkgs/tools/misc/steampipe/default.nix b/pkgs/tools/misc/steampipe/default.nix
index cfdb2b79c6d..74fc37800e9 100644
--- a/pkgs/tools/misc/steampipe/default.nix
+++ b/pkgs/tools/misc/steampipe/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "steampipe";
-  version = "0.13.0";
+  version = "0.13.2";
 
   src = fetchFromGitHub {
     owner = "turbot";
     repo = "steampipe";
     rev = "v${version}";
-    sha256 = "sha256-+QtZmrPE3R98UVSwrC8xoehNKwd0Exg+AZ2BJxBIrfY=";
+    sha256 = "sha256-Ty8yCcxdPa/z1k9xMv8iCybRXfvJKRJIT+oH7MbLWmw=";
   };
 
-  vendorSha256 = "sha256-rRp8pR2cpW88o0KPwuvgSkE263S5oGK/4df4CQSOlRo=";
+  vendorSha256 = "sha256-0jixQcgSXQJAd899EWOUKde5OXZcSZwQfH7LRdQlm7c=";
   proxyVendor = true;
 
   # tests are failing for no obvious reasons
diff --git a/pkgs/tools/misc/ttchat/default.nix b/pkgs/tools/misc/ttchat/default.nix
new file mode 100644
index 00000000000..c88f4098b76
--- /dev/null
+++ b/pkgs/tools/misc/ttchat/default.nix
@@ -0,0 +1,23 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "ttchat";
+  version = "0.1.6";
+
+  src = fetchFromGitHub {
+    owner = "atye";
+    repo = "ttchat";
+    rev = "v${version}";
+    sha256 = "sha256-Km8aBThs2h8vVpQQaN/OuDeQcrewhP0hMMRuU8/1Ilk=";
+  };
+
+  vendorSha256 = "sha256-pJAwx7RmD2sSHsz1DxtsU7bjC/b0JujlrFeGL6zmTiI=";
+
+  meta = with lib; {
+    description = "Connect to a Twitch channel's chat from your terminal";
+    homepage = "https://github.com/atye/ttchat";
+    license = licenses.asl20;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ wolfangaukang ];
+  };
+}
diff --git a/pkgs/tools/misc/up/default.nix b/pkgs/tools/misc/up/default.nix
index 47c504cd1a7..7737c67faa2 100644
--- a/pkgs/tools/misc/up/default.nix
+++ b/pkgs/tools/misc/up/default.nix
@@ -13,8 +13,6 @@ buildGoModule rec {
 
   vendorSha256 = "1q8wfsfl3rz698ck5q5s5z6iw9k134fxxvwipcp2b052n998rcrx";
 
-  doCheck = false;
-
   meta = with lib; {
     description = "Ultimate Plumber is a tool for writing Linux pipes with instant live preview";
     homepage = "https://github.com/akavel/up";
diff --git a/pkgs/tools/misc/ytmdl/default.nix b/pkgs/tools/misc/ytmdl/default.nix
index 90a0590b8d9..c2a2a2adf2d 100644
--- a/pkgs/tools/misc/ytmdl/default.nix
+++ b/pkgs/tools/misc/ytmdl/default.nix
@@ -1,16 +1,17 @@
 { lib
 , python3Packages
+, yt-dlp
 , ffmpeg
 }:
 
 python3Packages.buildPythonApplication rec {
   pname = "ytmdl";
-  version = "2021.08.01";
+  version = "2022.03.16";
 
   src = python3Packages.fetchPypi {
     inherit pname;
     version = builtins.replaceStrings [ ".0" ] [ "." ] version;
-    sha256 = "f5ef23dcba89aaf2307baf4ffc2326dc5c02324f646e5e5748219ed328202af4";
+    sha256 = "sha256-2lEOgwSi4fAVK+gJXvjWQDBWIb1cODFmUiq0FUfpyXA=";
   };
 
   postPatch = ''
@@ -34,7 +35,7 @@ python3Packages.buildPythonApplication rec {
     itunespy
     mutagen
     pysocks
-    youtube-dl
+    yt-dlp
     ytmusicapi
     spotipy
   ];
diff --git a/pkgs/tools/misc/zellij/default.nix b/pkgs/tools/misc/zellij/default.nix
index 7fc1c6e335a..4855e979ed6 100644
--- a/pkgs/tools/misc/zellij/default.nix
+++ b/pkgs/tools/misc/zellij/default.nix
@@ -15,16 +15,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "zellij";
-  version = "0.26.0";
+  version = "0.26.1";
 
   src = fetchFromGitHub {
     owner = "zellij-org";
     repo = "zellij";
     rev = "v${version}";
-    sha256 = "sha256-8PgEsRh2nBOIvKeX9SJ853NN8Szb4geKwv2qvTtkMxk=";
+    sha256 = "sha256-ngCE1DhbbuOu07R69gSlFvDKl5EFtTGOkfr5e4u4Dkw=";
   };
 
-  cargoSha256 = "sha256-YaqaXn1Ol5RfwAzWi7767vt1je+wqWFtfgxMOSIy9UI=";
+  cargoSha256 = "sha256-lRnxZiJiq601oOXkxZqVNPXc0miK3TsAyGeVTjTxdhw=";
 
   nativeBuildInputs = [
     mandown
diff --git a/pkgs/tools/networking/boundary/default.nix b/pkgs/tools/networking/boundary/default.nix
index 3745856a8c0..c86c9c5fd68 100644
--- a/pkgs/tools/networking/boundary/default.nix
+++ b/pkgs/tools/networking/boundary/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "boundary";
-  version = "0.7.5";
+  version = "0.7.6";
 
   src =
     let
@@ -15,10 +15,10 @@ stdenv.mkDerivation rec {
         aarch64-darwin = "darwin_arm64";
       };
       sha256 = selectSystem {
-        x86_64-linux = "sha256-wqNeeEQhR8cj7Gpbzp7UQV0j+w0peo41uKqgK9BoLH4=";
-        aarch64-linux = "sha256-HK/6eMBWUW1IbYE5RpInhcQuIw16X9vQEZmOBje9Yzk=";
-        x86_64-darwin = "sha256-ghgkPlEN9DHFviQzcGS/+oG+9Qqy2AfJ2IEyiSMJwwY=";
-        aarch64-darwin = "sha256-F4iOCxAm8s34KktuS5PRPkIg9A0179H6zlOM3OuTyUw=";
+        x86_64-linux = "sha256-nsc8S63OUEo9db/hs9oA53Lk+amIsxB/O4TJCs4zdNw=";
+        aarch64-linux = "sha256-KttqYuF7xC88L49f7JKKr77FbKBihptoBIoemgFInm0=";
+        x86_64-darwin = "sha256-ov4CtiWsOU/AWfAo7x99RshW6+eU9lFD5ypo6MKyPM0=";
+        aarch64-darwin = "sha256-3E9fv8BSu7XXIwRmTrDECLNQKdoeUqitKbsTrXs+tTE=";
       };
     in
     fetchzip {
diff --git a/pkgs/tools/networking/cloudflare-warp/default.nix b/pkgs/tools/networking/cloudflare-warp/default.nix
new file mode 100644
index 00000000000..a96b8e005e3
--- /dev/null
+++ b/pkgs/tools/networking/cloudflare-warp/default.nix
@@ -0,0 +1,48 @@
+{ stdenv, lib, fetchurl, dpkg, autoPatchelfHook, dbus }:
+
+stdenv.mkDerivation rec {
+  pname = "cloudflare-warp";
+  version = "2022.02.24";
+
+  src = fetchurl {
+    url = "https://pkg.cloudflareclient.com/uploads/cloudflare_warp_2022_2_288_1_amd64_a0be7b47b3.deb";
+    sha256 = "sha256-gBXF0EfFMT6BC6ts/6PQYJH3AAQSDsFoZGK3RZIqmOA=";
+  };
+
+  nativeBuildInputs = [
+    dpkg
+    autoPatchelfHook
+  ];
+
+  buildInputs = [ dbus ];
+
+  dontBuild = true;
+  dontConfigure = true;
+
+  unpackPhase = ''
+    dpkg-deb -x ${src} ./
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mv usr $out
+    mv lib $out
+    mv bin $out
+
+    runHook postInstall
+  '';
+
+  postInstall = ''
+    substituteInPlace $out/lib/systemd/system/warp-svc.service \
+      --replace "ExecStart=" "ExecStart=$out"
+  '';
+
+  meta = with lib; {
+    description = "Replaces the connection between your device and the Internet with a modern, optimized, protocol";
+    homepage = "https://pkg.cloudflareclient.com/packages/cloudflare-warp";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ wolfangaukang ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/tools/networking/corerad/default.nix b/pkgs/tools/networking/corerad/default.nix
index 03962f1e9e2..df6a6315937 100644
--- a/pkgs/tools/networking/corerad/default.nix
+++ b/pkgs/tools/networking/corerad/default.nix
@@ -1,17 +1,17 @@
-{ lib, buildGoModule, fetchFromGitHub, nixosTests }:
+{ lib, buildGo118Module, fetchFromGitHub, nixosTests }:
 
-buildGoModule rec {
+buildGo118Module rec {
   pname = "corerad";
-  version = "1.0.0";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "mdlayher";
     repo = "corerad";
     rev = "v${version}";
-    sha256 = "sha256-23f+WJcTf+x9GW+hGUU3/j4Qi9MfcsfQuS7aEU4uGU4=";
+    sha256 = "sha256-2XPWexpr3xGwnvjT08BVq6uf1haPuZGwKswiy/1Z8vE=";
   };
 
-  vendorSha256 = "sha256-SSa+yBZjZ+5vRfzfCtNhF+kRyJ/VMgd9uWqKPwIi8+Y=";
+  vendorSha256 = "sha256-+9KjgbKuAJexdGEKu9hIsHfHsVbKeB5ZtSgFzM2/bOI=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/networking/frp/default.nix b/pkgs/tools/networking/frp/default.nix
index 1ef3c13172b..e7d2752a94f 100644
--- a/pkgs/tools/networking/frp/default.nix
+++ b/pkgs/tools/networking/frp/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "frp";
-  version = "0.39.1";
+  version = "0.40.0";
 
   src = fetchFromGitHub {
     owner = "fatedier";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-tqdrYrIWbmRn+5iAZKd9GlcmFNQnh3yNxZ95As7+v5Q=";
+    sha256 = "sha256-W+88Fq9oYDBLCNp+6rc9jACJzky7FCZg/xLDowGGdm0=";
   };
 
-  vendorSha256 = "sha256-NPnchl+N6DeqMhsOIw2MYD/i2IZzHS9ZqbUOeulgb90=";
+  vendorSha256 = "sha256-iBjMFOERWQ1aPn+2gEoI9og2ov2LlBVV1sLAZlvqZPM=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/networking/hey/default.nix b/pkgs/tools/networking/hey/default.nix
index edf91dd311d..d59e58981e7 100644
--- a/pkgs/tools/networking/hey/default.nix
+++ b/pkgs/tools/networking/hey/default.nix
@@ -13,8 +13,6 @@ buildGoModule rec {
 
   vendorSha256 = null;
 
-  doCheck = false;
-
   meta = with lib; {
     description = "HTTP load generator, ApacheBench (ab) replacement";
     homepage = "https://github.com/rakyll/hey";
diff --git a/pkgs/tools/networking/httpie/default.nix b/pkgs/tools/networking/httpie/default.nix
index f3488ae402b..a6c6ddfe5bb 100644
--- a/pkgs/tools/networking/httpie/default.nix
+++ b/pkgs/tools/networking/httpie/default.nix
@@ -1,19 +1,20 @@
 { lib
 , fetchFromGitHub
 , installShellFiles
-, python3Packages
+, python3
 , pandoc
 }:
 
-python3Packages.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "httpie";
-  version = "3.0.2";
+  version = "3.1.0";
+  format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "httpie";
     repo = "httpie";
     rev = version;
-    sha256 = "sha256-s3IFzEUQmPBocgspVGx1nINkUamsi7tzwW37IqdBMxo=";
+    hash = "sha256-x7Zucb2i8D4Xbn77eBzSxOAcc2fGg5MFKFiyJhytQ0s=";
   };
 
   nativeBuildInputs = [
@@ -21,7 +22,7 @@ python3Packages.buildPythonApplication rec {
     pandoc
   ];
 
-  propagatedBuildInputs = with python3Packages; [
+  propagatedBuildInputs = with python3.pkgs; [
     charset-normalizer
     defusedxml
     multidict
@@ -31,10 +32,11 @@ python3Packages.buildPythonApplication rec {
     setuptools
   ];
 
-  checkInputs = with python3Packages; [
+  checkInputs = with python3.pkgs; [
     mock
     pytest
     pytest-httpbin
+    pytest-lazy-fixture
     pytestCheckHook
     responses
   ];
@@ -65,7 +67,9 @@ python3Packages.buildPythonApplication rec {
     "httpie.encoding.detect_encoding"
   ];
 
-  pythonImportsCheck = [ "httpie" ];
+  pythonImportsCheck = [
+    "httpie"
+  ];
 
   meta = with lib; {
     description = "A command line HTTP client whose goal is to make CLI human-friendly";
diff --git a/pkgs/tools/networking/innernet/default.nix b/pkgs/tools/networking/innernet/default.nix
index 67f9a9d793b..68ccdfc3870 100644
--- a/pkgs/tools/networking/innernet/default.nix
+++ b/pkgs/tools/networking/innernet/default.nix
@@ -13,15 +13,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "innernet";
-  version = "1.5.3";
+  version = "1.5.4";
 
   src = fetchFromGitHub {
     owner = "tonarino";
     repo = "innernet";
     rev = "v${version}";
-    sha256 = "sha256-dpoSjGtjGJTF/sQ8vbeAUCjnkYqz4zGnfO8br8gJbsQ=";
+    sha256 = "sha256-CcZ4241EU+ktPbFsuR/sF4yP6xAOFg+oW8thtAQZr/4=";
   };
-  cargoSha256 = "sha256-EmAlm3W9r6pP1VIxeM2UP1ZG9TjopTarckMfLDonr1k=";
+  cargoSha256 = "sha256-7APUSDxw6X4KJnFvm6xhiHL1D4NTNS2pC/4UVGyjJYY=";
 
   nativeBuildInputs = with llvmPackages; [
     llvm
diff --git a/pkgs/tools/networking/magic-wormhole-rs/Cargo.toml.patch b/pkgs/tools/networking/magic-wormhole-rs/Cargo.toml.patch
new file mode 100644
index 00000000000..debb1e26439
--- /dev/null
+++ b/pkgs/tools/networking/magic-wormhole-rs/Cargo.toml.patch
@@ -0,0 +1,67 @@
+diff --git a/Cargo.lock b/Cargo.lock
+index d33b5d6..ddde8ed 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -150,33 +150,6 @@ dependencies = [
+  "winapi 0.3.9",
+ ]
+ 
+-[[package]]
+-name = "async-std"
+-version = "1.10.0"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "f8056f1455169ab86dd47b47391e4ab0cbd25410a70e9fe675544f49bafaf952"
+-dependencies = [
+- "async-channel",
+- "async-global-executor",
+- "async-io",
+- "async-lock",
+- "crossbeam-utils",
+- "futures-channel",
+- "futures-core",
+- "futures-io",
+- "futures-lite",
+- "gloo-timers",
+- "kv-log-macro",
+- "log",
+- "memchr",
+- "num_cpus",
+- "once_cell",
+- "pin-project-lite",
+- "pin-utils",
+- "slab",
+- "wasm-bindgen-futures",
+-]
+-
+ [[package]]
+ name = "async-std"
+ version = "1.10.0"
+@@ -230,7 +203,7 @@ version = "0.16.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "5682ea0913e5c20780fe5785abacb85a411e7437bf52a1bedb93ddb3972cb8dd"
+ dependencies = [
+- "async-std 1.10.0 (registry+https://github.com/rust-lang/crates.io-index)",
++ "async-std",
+  "async-tls",
+  "futures-io",
+  "futures-util",
+@@ -1154,7 +1127,7 @@ name = "magic-wormhole"
+ version = "0.3.0"
+ dependencies = [
+  "async-io",
+- "async-std 1.10.0 (git+https://github.com/async-rs/async-std)",
++ "async-std",
+  "async-tungstenite",
+  "base64",
+  "bytecodec",
+diff --git a/Cargo.toml b/Cargo.toml
+index b4ff2c0..d4094af 100644
+--- a/Cargo.toml
++++ b/Cargo.toml
+@@ -82,3 +82,6 @@ required-features = ["bin"]
+ 
+ [profile.release]
+ overflow-checks = true
++
++[patch.crates-io]
++async-std = { version = "1.9.0", features = ["attributes", "unstable"], git = "https://github.com/async-rs/async-std" }
diff --git a/pkgs/tools/networking/magic-wormhole-rs/default.nix b/pkgs/tools/networking/magic-wormhole-rs/default.nix
new file mode 100644
index 00000000000..951a0664376
--- /dev/null
+++ b/pkgs/tools/networking/magic-wormhole-rs/default.nix
@@ -0,0 +1,32 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, rustPlatform
+}:
+rustPlatform.buildRustPackage rec {
+  name = "magic-wormhole-rs";
+  version = "0.3.0";
+
+  src = fetchFromGitHub {
+    owner = "magic-wormhole";
+    repo = "magic-wormhole.rs";
+    rev = version;
+    sha256 = "sha256-i4vJ6HmtM42m1x1UtOq9xlmhYIa5ZKXUm1rGFNRprmY=";
+  };
+
+  # this patch serves as a workaround for the problems of cargo-vendor described in
+  # https://github.com/NixOS/nixpkgs/issues/30742
+  # and can probably be removed once the issue is resolved
+  cargoPatches = [ ./Cargo.toml.patch ];
+  cargoSha256 = "sha256-DG1kyukgzDbolX9Mg9hK1TRyzIWbAX6f54jSM8clj/c=";
+
+  # all tests involve networking and are bound fail
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Rust implementation of Magic Wormhole, with new features and enhancements";
+    homepage = "https://github.com/magic-wormhole/magic-wormhole.rs";
+    license = licenses.eupl12;
+    maintainers = with maintainers; [ zeri piegames ];
+  };
+}
diff --git a/pkgs/tools/networking/minio-client/default.nix b/pkgs/tools/networking/minio-client/default.nix
index c90ba9cfc64..c4a0baf3160 100644
--- a/pkgs/tools/networking/minio-client/default.nix
+++ b/pkgs/tools/networking/minio-client/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "minio-client";
-  version = "2022-03-13T22-34-00Z";
+  version = "2022-03-17T20-25-06Z";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "mc";
     rev = "RELEASE.${version}";
-    sha256 = "sha256-NIhowfkG2bFIcCNXUQ3cETHsR5/NLvIHQ9LeftgSyd0=";
+    sha256 = "sha256-+MfRosEyIaQ5RndpAeK5AXm8EHX2ND7VJcr1NVFs5TI=";
   };
 
   vendorSha256 = "sha256-Wdw9mZ3UupoJ4yDwS4f3mOmCn+7TvHmx4aRu+96pHM4=";
diff --git a/pkgs/tools/networking/netproc/default.nix b/pkgs/tools/networking/netproc/default.nix
new file mode 100644
index 00000000000..851f71fcaab
--- /dev/null
+++ b/pkgs/tools/networking/netproc/default.nix
@@ -0,0 +1,25 @@
+{ lib, stdenv, fetchFromGitHub, ncurses }:
+
+stdenv.mkDerivation rec {
+  pname = "netproc";
+  version = "unstable-2022-02-11";
+
+  src = fetchFromGitHub {
+    owner = "berghetti";
+    repo = "netproc";
+    rev = "87a10ce31ae150847674ad87ef84ef2fd374b420";
+    sha256 = "sha256-YSKDOvqWLCrnP1qjmzMuRgjXiXZ9D4AuxXm/3xzS4gc=";
+  };
+
+  buildInputs = [ ncurses ];
+
+  installFlags = [ "prefix=$(out)" ];
+
+  meta = with lib; {
+    description = "Tool to monitor network traffic based on processes";
+    license = licenses.gpl3;
+    homepage = "https://github.com/berghetti/netproc";
+    platforms = platforms.linux;
+    maintainers = [ maintainers.azuwis ];
+  };
+}
diff --git a/pkgs/tools/networking/openapi-generator-cli/unstable.nix b/pkgs/tools/networking/openapi-generator-cli/unstable.nix
index 33eb33e10b0..9af28b3e09e 100644
--- a/pkgs/tools/networking/openapi-generator-cli/unstable.nix
+++ b/pkgs/tools/networking/openapi-generator-cli/unstable.nix
@@ -1,7 +1,7 @@
 { callPackage, lib, stdenv, fetchurl, jre, makeWrapper }:
 
 let this = stdenv.mkDerivation rec {
-  version = "6.0.0-2021-01-18";  # Also update the fetchurl link
+  version = "6.0.0-2022-03-18";  # Also update the fetchurl link
   pname = "openapi-generator-cli";
 
   jarfilename = "${pname}-${version}.jar";
@@ -11,8 +11,8 @@ let this = stdenv.mkDerivation rec {
   ];
 
   src = fetchurl {
-    url = "https://oss.sonatype.org/content/repositories/snapshots/org/openapitools/openapi-generator-cli/6.0.0-SNAPSHOT/openapi-generator-cli-6.0.0-20210118.082537-4.jar";
-    sha256 = "1ji3yw9dp4srlgqxvb21vrcp2bzj4himxsmp8l8zid9nxsc1m71x";
+    url = "https://oss.sonatype.org/content/repositories/snapshots/org/openapitools/openapi-generator-cli/6.0.0-SNAPSHOT/openapi-generator-cli-6.0.0-20220318.042704-93.jar";
+    sha256 = "1h126kpbnpbrsnjrxb09hzb796dwl4g58d6wrh1hhv8svwy5p0bl";
   };
 
   dontUnpack = true;
diff --git a/pkgs/tools/networking/openvpn/default.nix b/pkgs/tools/networking/openvpn/default.nix
index e2805f0ccf0..9200bc3f30e 100644
--- a/pkgs/tools/networking/openvpn/default.nix
+++ b/pkgs/tools/networking/openvpn/default.nix
@@ -32,7 +32,7 @@ let
         inherit version;
 
         src = fetchurl {
-          url = "https://swupdate.openvpn.net/community/releases/${pname}-${version}.tar.xz";
+          url = "https://swupdate.openvpn.net/community/releases/${pname}-${version}.tar.gz";
           inherit sha256;
         };
 
@@ -78,12 +78,12 @@ let
 in
 {
   openvpn_24 = generic {
-    version = "2.4.11";
-    sha256 = "06s4m0xvixjhd3azrzbsf4j86kah4xwr2jp6cmcpc7db33rfyyg5";
+    version = "2.4.12";
+    sha256 = "1vjx82nlkxrgzfiwvmmlnz8ids5m2fiqz7scy1smh3j9jnf2v5b6";
   };
 
   openvpn = generic {
-    version = "2.5.5";
-    sha256 = "sha256-EZvWn6AhCDj2zaonNpbcc476IA9FTb4R6237dd+2ADs=";
+    version = "2.5.6";
+    sha256 = "0gdd88rcan9vfiwkzsqn6fxxdim7kb1bsxrcra59c5xksprpwfik";
   };
 }
diff --git a/pkgs/tools/networking/tinyssh/default.nix b/pkgs/tools/networking/tinyssh/default.nix
index ddd2d460f73..36518357e60 100644
--- a/pkgs/tools/networking/tinyssh/default.nix
+++ b/pkgs/tools/networking/tinyssh/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tinyssh";
-  version = "20220305";
+  version = "20220311";
 
   src = fetchFromGitHub {
     owner = "janmojzis";
     repo = "tinyssh";
     rev = version;
-    sha256 = "sha256-d49saN0I22DZixx5AdvQmx3WM7yzQH5lOKnKbzhlls0=";
+    sha256 = "sha256-+lmPPc2UsNtOfuheWEZHAzmKBilNQ3kNh8ixzDnRjRc=";
   };
 
   preConfigure = ''
diff --git a/pkgs/tools/nix/nix-output-monitor/default.nix b/pkgs/tools/nix/nix-output-monitor/default.nix
index 0f78600a050..a79b41a4a5d 100644
--- a/pkgs/tools/nix/nix-output-monitor/default.nix
+++ b/pkgs/tools/nix/nix-output-monitor/default.nix
@@ -1,164 +1,23 @@
-# This file has been autogenerate with cabal2nix.
-# Update via ./update.sh"
 {
-  mkDerivation,
-  ansi-terminal,
-  async,
-  attoparsec,
-  base,
-  bytestring,
-  cassava,
-  containers,
-  data-default,
-  directory,
+  haskell,
   expect,
-  extra,
-  fetchzip,
-  filepath,
-  generic-optics,
-  HUnit,
+  haskellPackages,
   installShellFiles,
-  lib,
-  lock-file,
-  MemoTrie,
-  mtl,
-  nix-derivation,
-  optics,
-  process,
-  random,
-  relude,
-  runtimeShell,
-  safe,
-  stm,
-  streamly,
-  terminal-size,
-  text,
-  time,
-  unix,
-  vector,
-  wcwidth,
-  word8,
-}:
-mkDerivation {
-  pname = "nix-output-monitor";
-  version = "1.1.2.0";
-  src = fetchzip {
-    url = "https://github.com/maralorn/nix-output-monitor/archive/refs/tags/v1.1.2.0.tar.gz";
-    sha256 = "03qhy4xzika41pxlmvpz3psgy54va72ipn9v1lv33l6369ikrhl1";
+}: let
+  inherit (haskell.lib.compose) justStaticExecutables overrideCabal;
+  overrides = {
+    passthru.updateScript = ./update.sh;
+    testTarget = "unit-tests";
+    buildTools = [installShellFiles];
+    postInstall = ''
+      substitute "exe-sh/nom-build" "$out/bin/nom-build" \
+        --replace 'unbuffer' '${expect}/bin/unbuffer' \
+        --replace 'nom' "$out/bin/nom"
+      chmod a+x $out/bin/nom-build
+      installShellCompletion --zsh --name _nom-build completions/completion.zsh
+    '';
   };
-  isLibrary = true;
-  isExecutable = true;
-  libraryHaskellDepends = [
-    ansi-terminal
-    async
-    attoparsec
-    base
-    bytestring
-    cassava
-    containers
-    data-default
-    directory
-    extra
-    filepath
-    generic-optics
-    lock-file
-    MemoTrie
-    mtl
-    nix-derivation
-    optics
-    random
-    relude
-    safe
-    stm
-    streamly
-    terminal-size
-    text
-    time
-    unix
-    vector
-    wcwidth
-    word8
-  ];
-  executableHaskellDepends = [
-    ansi-terminal
-    async
-    attoparsec
-    base
-    bytestring
-    cassava
-    containers
-    data-default
-    directory
-    extra
-    filepath
-    generic-optics
-    lock-file
-    MemoTrie
-    mtl
-    nix-derivation
-    optics
-    random
-    relude
-    safe
-    stm
-    streamly
-    terminal-size
-    text
-    time
-    unix
-    vector
-    wcwidth
-    word8
-  ];
-  testHaskellDepends = [
-    ansi-terminal
-    async
-    attoparsec
-    base
-    bytestring
-    cassava
-    containers
-    data-default
-    directory
-    extra
-    filepath
-    generic-optics
-    HUnit
-    lock-file
-    MemoTrie
-    mtl
-    nix-derivation
-    optics
-    process
-    random
-    relude
-    safe
-    stm
-    streamly
-    terminal-size
-    text
-    time
-    unix
-    vector
-    wcwidth
-    word8
-  ];
-  homepage = "https://github.com/maralorn/nix-output-monitor";
-  description = "Parses output of nix-build to show additional information";
-  license = lib.licenses.agpl3Plus;
-  maintainers = with lib.maintainers; [maralorn];
-  passthru.updateScript = ./update.sh;
-  testTarget = "unit-tests";
-  buildTools = [installShellFiles];
-  postInstall = ''
-    cat > $out/bin/nom-build << EOF
-    #!${runtimeShell}
-    ${expect}/bin/unbuffer nix-build "\$@" 2>&1 | exec $out/bin/nom
-    EOF
-    chmod a+x $out/bin/nom-build
-    installShellCompletion --zsh --name _nom-build ${builtins.toFile "completion.zsh" ''
-      #compdef nom-build
-      compdef nom-build=nix-build
-    ''}
-  '';
-}
+in
+  justStaticExecutables
+  (overrideCabal overrides
+    (haskellPackages.callPackage ./generated-package.nix {}))
diff --git a/pkgs/tools/nix/nix-output-monitor/generated-package.nix b/pkgs/tools/nix/nix-output-monitor/generated-package.nix
new file mode 100644
index 00000000000..9f4d4b5042b
--- /dev/null
+++ b/pkgs/tools/nix/nix-output-monitor/generated-package.nix
@@ -0,0 +1,147 @@
+# This file has been autogenerate with cabal2nix.
+# Update via ./update.sh"
+{
+  mkDerivation,
+  ansi-terminal,
+  async,
+  attoparsec,
+  base,
+  bytestring,
+  cassava,
+  containers,
+  data-default,
+  directory,
+  extra,
+  fetchzip,
+  filepath,
+  generic-optics,
+  HUnit,
+  lib,
+  lock-file,
+  MemoTrie,
+  mtl,
+  nix-derivation,
+  optics,
+  process,
+  random,
+  relude,
+  safe,
+  stm,
+  streamly,
+  terminal-size,
+  text,
+  time,
+  unix,
+  vector,
+  wcwidth,
+  word8,
+}:
+mkDerivation {
+  pname = "nix-output-monitor";
+  version = "1.1.2.1";
+  src = fetchzip {
+    url = "https://github.com/maralorn/nix-output-monitor/archive/refs/tags/v1.1.2.1.tar.gz";
+    sha256 = "00jn963jskyqnwvbvn5x0z92x2gv105p5h8m13nlmr90lj4axynx";
+  };
+  isLibrary = true;
+  isExecutable = true;
+  libraryHaskellDepends = [
+    ansi-terminal
+    async
+    attoparsec
+    base
+    bytestring
+    cassava
+    containers
+    data-default
+    directory
+    extra
+    filepath
+    generic-optics
+    lock-file
+    MemoTrie
+    mtl
+    nix-derivation
+    optics
+    random
+    relude
+    safe
+    stm
+    streamly
+    terminal-size
+    text
+    time
+    unix
+    vector
+    wcwidth
+    word8
+  ];
+  executableHaskellDepends = [
+    ansi-terminal
+    async
+    attoparsec
+    base
+    bytestring
+    cassava
+    containers
+    data-default
+    directory
+    extra
+    filepath
+    generic-optics
+    lock-file
+    MemoTrie
+    mtl
+    nix-derivation
+    optics
+    random
+    relude
+    safe
+    stm
+    streamly
+    terminal-size
+    text
+    time
+    unix
+    vector
+    wcwidth
+    word8
+  ];
+  testHaskellDepends = [
+    ansi-terminal
+    async
+    attoparsec
+    base
+    bytestring
+    cassava
+    containers
+    data-default
+    directory
+    extra
+    filepath
+    generic-optics
+    HUnit
+    lock-file
+    MemoTrie
+    mtl
+    nix-derivation
+    optics
+    process
+    random
+    relude
+    safe
+    stm
+    streamly
+    terminal-size
+    text
+    time
+    unix
+    vector
+    wcwidth
+    word8
+  ];
+  homepage = "https://github.com/maralorn/nix-output-monitor";
+  description = "Parses output of nix-build to show additional information";
+  license = lib.licenses.agpl3Plus;
+  maintainers = with lib.maintainers; [maralorn];
+}
diff --git a/pkgs/tools/nix/nix-output-monitor/update.sh b/pkgs/tools/nix/nix-output-monitor/update.sh
index ad5da000030..b25a65fca2d 100755
--- a/pkgs/tools/nix/nix-output-monitor/update.sh
+++ b/pkgs/tools/nix/nix-output-monitor/update.sh
@@ -9,7 +9,7 @@ set -eo pipefail
 # This is the directory of this update.sh script.
 script_dir="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 
-derivation_file="${script_dir}/default.nix"
+derivation_file="${script_dir}/generated-package.nix"
 
 # This is the latest released version of nix-output-monitor on GitHub.
 new_version=$(curl --silent "https://api.github.com/repos/maralorn/nix-output-monitor/releases" | jq '.[0].tag_name' --raw-output)
@@ -23,30 +23,9 @@ cat > "$derivation_file" << EOF
 EOF
 
 cabal2nix \
-  --extra-arguments expect \
-  --extra-arguments runtimeShell\
-  --extra-arguments installShellFiles\
   --maintainer maralorn \
   "https://github.com/maralorn/nix-output-monitor/archive/refs/tags/${new_version}.tar.gz" \
-  | head -n-1 >> "$derivation_file"
-
-cat >> "$derivation_file" << EOF
-    passthru.updateScript = ./update.sh;
-    testTarget = "unit-tests";
-    buildTools = [ installShellFiles ];
-    postInstall = ''
-        cat > \$out/bin/nom-build << EOF
-        #!\${runtimeShell}
-        \${expect}/bin/unbuffer nix-build "\\\$@" 2>&1 | exec \$out/bin/nom
-        EOF
-        chmod a+x \$out/bin/nom-build
-        installShellCompletion --zsh --name _nom-build \${builtins.toFile "completion.zsh" ''
-            #compdef nom-build
-            compdef nom-build=nix-build
-        ''}
-    '';
-}
-EOF
+  >> "$derivation_file"
 
 alejandra "${derivation_file}" | cat
 
diff --git a/pkgs/tools/package-management/cargo-about/default.nix b/pkgs/tools/package-management/cargo-about/default.nix
index a61aff2107d..0ed6f978ba9 100644
--- a/pkgs/tools/package-management/cargo-about/default.nix
+++ b/pkgs/tools/package-management/cargo-about/default.nix
@@ -2,19 +2,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-about";
-  version = "0.4.8";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "EmbarkStudios";
     repo = "cargo-about";
     rev = version;
-    sha256 = "sha256-cKzGg3fAXKqnBZES3YUMbv1ZAcLqo6AdrXKXSFSAnis=";
+    sha256 = "sha256-M09X7UwrTtrOhOphhpGHSAqxneY50jNrFKJCeBQhRfc=";
   };
 
   # enable pkg-config feature of zstd
   cargoPatches = [ ./zstd-pkg-config.patch ];
 
-  cargoSha256 = "sha256-OLrxqbTIhHMNPEnSAUbTqoYnaZi/BxbWUCxaTo9Zyww=";
+  cargoSha256 = "sha256-E1+OfVAzrezXoUz9Nlyhdq1xxEWm4UJhVyp+nG7UmYY=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/tools/package-management/nfpm/default.nix b/pkgs/tools/package-management/nfpm/default.nix
index dc877ee2d81..8b03779ae7d 100644
--- a/pkgs/tools/package-management/nfpm/default.nix
+++ b/pkgs/tools/package-management/nfpm/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "nfpm";
-  version = "2.14.0";
+  version = "2.15.0";
 
   src = fetchFromGitHub {
     owner = "goreleaser";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-KZeamXMhTX8CbPR66f4ij29GsIvzSbDUZtla+EXPRG4=";
+    sha256 = "sha256-z9jGivdO7LduJuHbyKr4sl8xg+FGVvKwCm+RgVQPxJQ=";
   };
 
-  vendorSha256 = "sha256-j4ebzVOzlmQwSkP8epDGClT7fhSUtC6uWdcoo+tFbnc=";
+  vendorSha256 = "sha256-guJgLjmB29sOLIzs2+gKNp0WTWC3zS9Sb5DD5IistKY=";
 
   doCheck = false;
 
@@ -20,7 +20,7 @@ buildGoModule rec {
   meta = with lib; {
     description = "A simple deb and rpm packager written in Go";
     homepage = "https://github.com/goreleaser/nfpm";
-    maintainers = [ maintainers.marsam ];
-    license = licenses.mit;
+    maintainers = with maintainers; [ marsam techknowlogick ];
+    license = with licenses; [ mit ];
   };
 }
diff --git a/pkgs/tools/security/cariddi/default.nix b/pkgs/tools/security/cariddi/default.nix
index 9f29826808d..74e9b05b237 100644
--- a/pkgs/tools/security/cariddi/default.nix
+++ b/pkgs/tools/security/cariddi/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "cariddi";
-  version = "1.1.5";
+  version = "1.1.6";
 
   src = fetchFromGitHub {
     owner = "edoardottt";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-PXQljC9rwlxXQ96fII3EjD4NXu61EMkYvMWqkcJZ4vU=";
+    sha256 = "sha256-/ez2biYU8NnVny8v5Mu9pLq0oqzcIenpyEb3qkPd9v8=";
   };
 
-  vendorSha256 = "sha256-zNUdglsfy6lEV54afCAoigxa3rR0qf/e3+B4PvVRIa4=";
+  vendorSha256 = "sha256-zJ39tAq+ooROMHG1vC2m2rbq+wttxqYxAd2hLg5GtJM=";
 
   meta = with lib; {
     description = "Crawler for URLs and endpoints";
diff --git a/pkgs/tools/security/cfripper/default.nix b/pkgs/tools/security/cfripper/default.nix
index 39b0187c4a6..4e5d2e7e030 100644
--- a/pkgs/tools/security/cfripper/default.nix
+++ b/pkgs/tools/security/cfripper/default.nix
@@ -5,13 +5,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "cfripper";
-  version = "1.5.1";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "Skyscanner";
     repo = pname;
     rev = version;
-    hash = "sha256-/qcpLCk1ZZMKxhqK6q6sSbRDjiF5GQmDJzvCaV2kAqQ=";
+    hash = "sha256-bomQqg+xzq7+iccE+x6mN265HxkYvy13aAwBBikth3U=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/security/feroxbuster/default.nix b/pkgs/tools/security/feroxbuster/default.nix
new file mode 100644
index 00000000000..ecfc496ce8e
--- /dev/null
+++ b/pkgs/tools/security/feroxbuster/default.nix
@@ -0,0 +1,45 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, openssl
+, pkg-config
+, rustPlatform
+, Security
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "feroxbuster";
+  version = "2.6.1";
+
+  src = fetchFromGitHub {
+    owner = "epi052";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-RY9bFuALRaVXDrC0eIx0inPjRqNpRKNZf3mCrKIdGL8=";
+  };
+
+  cargoSha256 = "sha256-0Zawlx/lhF7K8nOsHYKO84pnctVMpm3RfnAFCOltOqE=";
+
+  OPENSSL_NO_VENDOR = true;
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl
+  ] ++ lib.optionals stdenv.isDarwin [
+    Security
+  ];
+
+  # Tests require network access
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Fast, simple, recursive content discovery tool";
+    homepage = "https://github.com/epi052/feroxbuster";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
+
diff --git a/pkgs/tools/security/fulcio/default.nix b/pkgs/tools/security/fulcio/default.nix
index 96ef86d18d1..300b996524d 100644
--- a/pkgs/tools/security/fulcio/default.nix
+++ b/pkgs/tools/security/fulcio/default.nix
@@ -2,33 +2,61 @@
 
 buildGoModule rec {
   pname = "fulcio";
-  version = "0.1.1";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "sigstore";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-MvLQMGPyJYqYUljLqsr+qJeeYnxdH9aNGkWpDRvOeh8=";
+    sha256 = "sha256-tCjFx9Ug8rO8cSxQb2vBG/MHSUJCx17lDeGnSGjZLcI=";
+    # populate values that require us to use git. By doing this in postFetch we
+    # can delete .git afterwards and maintain better reproducibility of the src.
+    leaveDotGit = true;
+    postFetch = ''
+      cd "$out"
+      git rev-parse HEAD > $out/COMMIT
+      # '0000-00-00T00:00:00Z'
+      date -u -d "@$(git log -1 --pretty=%ct)" "+'%Y-%m-%dT%H:%M:%SZ'" > $out/SOURCE_DATE_EPOCH
+      find "$out" -name .git -print0 | xargs -0 rm -rf
+    '';
   };
-  vendorSha256 = "sha256-pRL0et+UOi/tzuQz/Q7UmSA+pVhLJYR8lG8NAbPN9PU=";
+  vendorSha256 = "sha256-CmtsReP0JacgNyRqCrYZRONwR5eluymrQgsj/ukhYNQ=";
 
-  ldflags = [ "-s" "-w" ];
-
-  # Install completions post-install
+  # install completions post-install
   nativeBuildInputs = [ installShellFiles ];
 
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/sigstore/fulcio/cmd/app.gitVersion=v${version}"
+    "-X github.com/sigstore/fulcio/cmd/app.gitTreeState=clean"
+  ];
+
+  # ldflags based on metadata from git and source
+  preBuild = ''
+    ldflags+=" -X github.com/sigstore/fulcio/cmd/app.gitCommit=$(cat COMMIT)"
+    ldflags+=" -X github.com/sigstore/fulcio/cmd/app.buildDate=$(cat SOURCE_DATE_EPOCH)"
+  '';
+
+  preCheck = ''
+    # remove test that requires networking
+    rm pkg/config/config_test.go
+  '';
+
   postInstall = ''
-    mv $out/bin/fulcio $out/bin/fulcio-server
-    installShellCompletion --cmd fulcio-server \
-      --bash <($out/bin/fulcio-server completion bash) \
-      --fish <($out/bin/fulcio-server completion fish) \
-      --zsh <($out/bin/fulcio-server completion zsh)
+    installShellCompletion --cmd fulcio \
+      --bash <($out/bin/fulcio completion bash) \
+      --fish <($out/bin/fulcio completion fish) \
+      --zsh <($out/bin/fulcio completion zsh)
   '';
 
   doInstallCheck = true;
   installCheckPhase = ''
     runHook preInstallCheck
-    $out/bin/fulcio-server --help
+
+    $out/bin/fulcio --help
+    $out/bin/fulcio version | grep "v${version}"
+
     runHook postInstallCheck
   '';
 
diff --git a/pkgs/tools/security/grype/default.nix b/pkgs/tools/security/grype/default.nix
index 377bed93054..1b80d7ecd88 100644
--- a/pkgs/tools/security/grype/default.nix
+++ b/pkgs/tools/security/grype/default.nix
@@ -6,28 +6,26 @@
 
 buildGoModule rec {
   pname = "grype";
-  version = "0.34.1";
+  version = "0.34.3";
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Xr3ws6qmfL25Kml7Klw095N9MNrm6a8lBtOWiucnzXE=";
+    sha256 = "sha256-iWmLfQ08+dhjvKQiK2iy2Tegk4jH9dGopu/6kdDRZd0=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
     postFetch = ''
       cd "$out"
-      commit="$(git rev-parse HEAD)"
-      source_date_epoch=$(git log --date=format:'%Y-%m-%dT%H:%M:%SZ' -1 --pretty=%ad)
-      substituteInPlace "$out/internal/version/build.go" \
-        --replace 'gitCommit = valueNotProvided' "gitCommit = \"$commit\"" \
-        --replace 'buildDate = valueNotProvided' "buildDate = \"$source_date_epoch\""
+      git rev-parse HEAD > $out/COMMIT
+      # 0000-00-00T00:00:00Z
+      date -u -d "@$(git log -1 --pretty=%ct)" "+%Y-%m-%dT%H:%M:%SZ" > $out/SOURCE_DATE_EPOCH
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
 
-  vendorSha256 = "sha256-fuOAfLESs/97aQUkIy6DkmYFyvKKCHazgt1WnE8GeH8=";
+  vendorSha256 = "sha256-WrUZFlN7dPbyN9InjX/Y9J+iYKu5v2/SHmRgDP5BJi8=";
 
   nativeBuildInputs = [
     installShellFiles
@@ -37,14 +35,17 @@ buildGoModule rec {
     "-s"
     "-w"
     "-X github.com/anchore/grype/internal/version.version=${version}"
+    "-X github.com/anchore/grype/internal/version.gitDescription=v${version}"
     "-X github.com/anchore/grype/internal/version.gitTreeState=clean"
   ];
 
   preBuild = ''
     # grype version also displays the version of the syft library used
     # we need to grab it from the go.sum and add an ldflag for it
-    SYFTVERSION="$(grep "github.com/anchore/syft" go.sum -m 1 | awk '{print $2}')"
-    ldflags+=" -X github.com/anchore/grype/internal/version.syftVersion=$SYFTVERSION"
+    SYFT_VERSION="$(grep "github.com/anchore/syft" go.sum -m 1 | awk '{print $2}')"
+    ldflags+=" -X github.com/anchore/grype/internal/version.syftVersion=$SYFT_VERSION"
+    ldflags+=" -X github.com/anchore/grype/internal/version.gitCommit=$(cat COMMIT)"
+    ldflags+=" -X github.com/anchore/grype/internal/version.buildDate=$(cat SOURCE_DATE_EPOCH)"
   '';
 
   # Tests require a running Docker instance
diff --git a/pkgs/tools/security/metasploit/Gemfile b/pkgs/tools/security/metasploit/Gemfile
index bdecd4e0a94..90c0d3987cd 100644
--- a/pkgs/tools/security/metasploit/Gemfile
+++ b/pkgs/tools/security/metasploit/Gemfile
@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 source "https://rubygems.org"
 
-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.1.32"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.1.34"
diff --git a/pkgs/tools/security/metasploit/Gemfile.lock b/pkgs/tools/security/metasploit/Gemfile.lock
index 6855f10bb48..080eefa6e2b 100644
--- a/pkgs/tools/security/metasploit/Gemfile.lock
+++ b/pkgs/tools/security/metasploit/Gemfile.lock
@@ -1,9 +1,9 @@
 GIT
   remote: https://github.com/rapid7/metasploit-framework
-  revision: f7cd9896b753377c4c663188b6c26500b7850f41
-  ref: refs/tags/6.1.32
+  revision: e1ab1599c07319d2732645b003c038ffa4dad7cd
+  ref: refs/tags/6.1.34
   specs:
-    metasploit-framework (6.1.32)
+    metasploit-framework (6.1.34)
       actionpack (~> 6.0)
       activerecord (~> 6.0)
       activesupport (~> 6.0)
@@ -98,25 +98,25 @@ GEM
   remote: https://rubygems.org/
   specs:
     Ascii85 (1.1.0)
-    actionpack (6.1.4.6)
-      actionview (= 6.1.4.6)
-      activesupport (= 6.1.4.6)
+    actionpack (6.1.5)
+      actionview (= 6.1.5)
+      activesupport (= 6.1.5)
       rack (~> 2.0, >= 2.0.9)
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.0, >= 1.2.0)
-    actionview (6.1.4.6)
-      activesupport (= 6.1.4.6)
+    actionview (6.1.5)
+      activesupport (= 6.1.5)
       builder (~> 3.1)
       erubi (~> 1.4)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.1, >= 1.2.0)
-    activemodel (6.1.4.6)
-      activesupport (= 6.1.4.6)
-    activerecord (6.1.4.6)
-      activemodel (= 6.1.4.6)
-      activesupport (= 6.1.4.6)
-    activesupport (6.1.4.6)
+    activemodel (6.1.5)
+      activesupport (= 6.1.5)
+    activerecord (6.1.5)
+      activemodel (= 6.1.5)
+      activesupport (= 6.1.5)
+    activesupport (6.1.5)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 1.6, < 2)
       minitest (>= 5.1)
@@ -128,13 +128,13 @@ GEM
     arel-helpers (2.14.0)
       activerecord (>= 3.1.0, < 8)
     aws-eventstream (1.2.0)
-    aws-partitions (1.563.0)
-    aws-sdk-core (3.128.0)
+    aws-partitions (1.568.0)
+    aws-sdk-core (3.130.0)
       aws-eventstream (~> 1, >= 1.0.2)
       aws-partitions (~> 1, >= 1.525.0)
       aws-sigv4 (~> 1.1)
       jmespath (~> 1.0)
-    aws-sdk-ec2 (1.302.0)
+    aws-sdk-ec2 (1.303.0)
       aws-sdk-core (~> 3, >= 3.127.0)
       aws-sigv4 (~> 1.1)
     aws-sdk-iam (1.68.0)
@@ -149,7 +149,7 @@ GEM
       aws-sigv4 (~> 1.4)
     aws-sigv4 (1.4.0)
       aws-eventstream (~> 1, >= 1.0.2)
-    bcrypt (3.1.16)
+    bcrypt (3.1.17)
     bcrypt_pbkdf (1.1.0)
     bindata (2.4.10)
     bson (4.14.1)
@@ -221,7 +221,7 @@ GEM
     io-console (0.5.11)
     irb (1.3.6)
       reline (>= 0.2.5)
-    jmespath (1.6.0)
+    jmespath (1.6.1)
     jsobfu (0.4.2)
       rkelly-remix
     json (2.6.1)
@@ -229,7 +229,7 @@ GEM
     logging (2.3.0)
       little-plugger (~> 1.1)
       multi_json (~> 1.14)
-    loofah (2.14.0)
+    loofah (2.15.0)
       crass (~> 1.0.2)
       nokogiri (>= 1.5.9)
     metasm (1.0.5)
@@ -298,7 +298,7 @@ GEM
       hashery (~> 2.0)
       ruby-rc4
       ttfunk
-    pg (1.3.3)
+    pg (1.3.4)
     public_suffix (4.0.6)
     puma (5.6.2)
       nio4r (~> 2.0)
@@ -313,11 +313,11 @@ GEM
       nokogiri (>= 1.6)
     rails-html-sanitizer (1.4.2)
       loofah (~> 2.3)
-    railties (6.1.4.6)
-      actionpack (= 6.1.4.6)
-      activesupport (= 6.1.4.6)
+    railties (6.1.5)
+      actionpack (= 6.1.5)
+      activesupport (= 6.1.5)
       method_source
-      rake (>= 0.13)
+      rake (>= 12.2)
       thor (~> 1.0)
     rake (13.0.6)
     rb-readline (0.5.5)
@@ -339,7 +339,7 @@ GEM
       metasm
       rex-arch
       rex-text
-    rex-exploitation (0.1.28)
+    rex-exploitation (0.1.29)
       jsobfu
       metasm
       rex-arch
@@ -347,7 +347,7 @@ GEM
       rex-text
       rexml
     rex-java (0.1.6)
-    rex-mime (0.1.6)
+    rex-mime (0.1.7)
       rex-text
     rex-nop (0.1.2)
       rex-arch
@@ -409,11 +409,11 @@ GEM
     ttfunk (1.7.0)
     tzinfo (2.0.4)
       concurrent-ruby (~> 1.0)
-    tzinfo-data (1.2021.5)
+    tzinfo-data (1.2022.1)
       tzinfo (>= 1.0.0)
     unf (0.1.4)
       unf_ext
-    unf_ext (0.0.8)
+    unf_ext (0.0.8.1)
     unix-crypt (1.3.0)
     warden (1.2.9)
       rack (>= 2.0.9)
diff --git a/pkgs/tools/security/metasploit/default.nix b/pkgs/tools/security/metasploit/default.nix
index 11215cd3dde..99d801482af 100644
--- a/pkgs/tools/security/metasploit/default.nix
+++ b/pkgs/tools/security/metasploit/default.nix
@@ -15,13 +15,13 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "metasploit-framework";
-  version = "6.1.32";
+  version = "6.1.34";
 
   src = fetchFromGitHub {
     owner = "rapid7";
     repo = "metasploit-framework";
     rev = version;
-    sha256 = "sha256-UoH+tp3I9YTXXNXDaYne1E9Zpoj9fbr7mnIQws6TXJs=";
+    sha256 = "sha256-6rGELJYmddWoR6qIuXKoCT5RpMASIzssWG9Y0Xtx+Z8=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/security/metasploit/gemset.nix b/pkgs/tools/security/metasploit/gemset.nix
index 0104412d350..0d0271cca4b 100644
--- a/pkgs/tools/security/metasploit/gemset.nix
+++ b/pkgs/tools/security/metasploit/gemset.nix
@@ -4,50 +4,50 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1d4nxv0p3wv4w0pf89nmxzg10balny5rwbchwsscgiminzh3mg7y";
+      sha256 = "0kk8c6n94lg5gyarsy33wakw04zbmdwgfr7zxv4zzmbnp1yach0w";
       type = "gem";
     };
-    version = "6.1.4.6";
+    version = "6.1.5";
   };
   actionview = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0cmxc80gg7pm6d9y7ah5qr4ymzks8rp51jv0a2qdq2m9p6llzlkk";
+      sha256 = "16w7pl8ir253g1dzlzx4mwrjsx3v7fl7zn941xz53zb4ld286mhi";
       type = "gem";
     };
-    version = "6.1.4.6";
+    version = "6.1.5";
   };
   activemodel = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0izra8g3g1agv3mz72b0474adkj4ldszj3nwk3l0szgrln7df0lv";
+      sha256 = "16anyz7wqwmphzb6w1sgmvdvj50g3zp70s94s5v8hwxj680f6195";
       type = "gem";
     };
-    version = "6.1.4.6";
+    version = "6.1.5";
   };
   activerecord = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "15v0dwp2122yzwlw8ca0lgx5qbw8fsasbn8zzcks1mvmc9afisss";
+      sha256 = "0jl6jc9g9jxsljfnnmbkxrgwrz86icw6g745cv6iavryizrmw939";
       type = "gem";
     };
-    version = "6.1.4.6";
+    version = "6.1.5";
   };
   activesupport = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0vrz4vgqz4grr2ykwkd8zhhd0rg12z89n89zl6aff17zrdhhad35";
+      sha256 = "0jmqndx3a46hpwz33ximqch27018n3mk9z19azgpylm33w7xpkx4";
       type = "gem";
     };
-    version = "6.1.4.6";
+    version = "6.1.5";
   };
   addressable = {
     groups = ["default"];
@@ -104,30 +104,30 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0l4f97kmsz1niicj52bm88ggbq3lvn41w0cckfwksh4yikjh20wv";
+      sha256 = "1ap27g6hxcczpb5dj7v0wzxrvywfa2kf3zx69xnjz1qvxf3plw54";
       type = "gem";
     };
-    version = "1.563.0";
+    version = "1.568.0";
   };
   aws-sdk-core = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0xpqx000gq1j0n211c9bch5b2rc48a54kxk87m6y8z844c0wlqk7";
+      sha256 = "14ymvp06k46gvkpvz5zaqvbvr6wd8vdka5iq25q0wd0fzdx7aivm";
       type = "gem";
     };
-    version = "3.128.0";
+    version = "3.130.0";
   };
   aws-sdk-ec2 = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "13x9rwkykyw873prd2k9pqwrjkf9jsqih9aksbf9fn8hfnsv6db8";
+      sha256 = "12k3gjsagdb11crg2gx7373qn1zhglkkija9d6558v0slcza8m3j";
       type = "gem";
     };
-    version = "1.302.0";
+    version = "1.303.0";
   };
   aws-sdk-iam = {
     groups = ["default"];
@@ -174,10 +174,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "02r1c3isfchs5fxivbq99gc3aq4vfyn8snhcy707dal1p8qz12qb";
+      sha256 = "1rakdhrnlclrpy7sihi9ipwdh7fjkkvzga171464lq6rzp07cf65";
       type = "gem";
     };
-    version = "3.1.16";
+    version = "3.1.17";
   };
   bcrypt_pbkdf = {
     groups = ["default"];
@@ -594,10 +594,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1gjrr5pdcl3l3skhp9d0jzs4yhmknpv3ldcz59b339b9lqbqasnr";
+      sha256 = "1mnvb80cdg7fzdcs3xscv21p28w4igk5sj5m7m81xp8v2ks87jj0";
       type = "gem";
     };
-    version = "1.6.0";
+    version = "1.6.1";
   };
   jsobfu = {
     groups = ["default"];
@@ -644,10 +644,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0z8bdcmw66j3dy6ivcc02yq32lx3n9bavx497llln8qy014xjm4w";
+      sha256 = "1yp1h1j7pdkqvnx8jl6bkzlajav3h5mhqzihgs9p6y3c8927mw23";
       type = "gem";
     };
-    version = "2.14.0";
+    version = "2.15.0";
   };
   metasm = {
     groups = ["default"];
@@ -684,12 +684,12 @@
     platforms = [];
     source = {
       fetchSubmodules = false;
-      rev = "f7cd9896b753377c4c663188b6c26500b7850f41";
-      sha256 = "16swjg7c443jkbxvlzgxi2k5jkylvs4nkhymbkbq9xf8knvgx0aj";
+      rev = "e1ab1599c07319d2732645b003c038ffa4dad7cd";
+      sha256 = "17zrf5xx2n3gb0n3n8qjq2j52gh9m1rbk25a8yldax96jqn89cga";
       type = "git";
       url = "https://github.com/rapid7/metasploit-framework";
     };
-    version = "6.1.32";
+    version = "6.1.34";
   };
   metasploit-model = {
     groups = ["default"];
@@ -977,10 +977,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0qqky1q9xhji017q1apx9w81qdlwpm6ix3amhikjy416hxxmhcj1";
+      sha256 = "090c3kazlmiizp25las7dgi8wlc11s29nrs2gy3qrp1z8qikgcmb";
       type = "gem";
     };
-    version = "1.3.3";
+    version = "1.3.4";
   };
   public_suffix = {
     groups = ["default"];
@@ -1067,10 +1067,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1snhwpbnmsyhr297qmin8i5i631aimjca1hiazi128i1355255hb";
+      sha256 = "1fdqhv8qhk2dspkrr9f5dj3806g52cb0l1chh2hx8v81y218cl93";
       type = "gem";
     };
-    version = "6.1.4.6";
+    version = "6.1.5";
   };
   rake = {
     groups = ["default"];
@@ -1167,10 +1167,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "08v5nam0xp6f8qi3nyqzh97sz07hy59w82y213jz919mrgpb70vc";
+      sha256 = "0asx13g0xqb8wnslrmsld2l1w2qpl6kjrcbfl945kw1nm7k5bwxb";
       type = "gem";
     };
-    version = "0.1.28";
+    version = "0.1.29";
   };
   rex-java = {
     groups = ["default"];
@@ -1187,10 +1187,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0wzw1qcdgbn3iyskppy5038mcdrzplyai45pilm5qjj4fwvjdl6m";
+      sha256 = "00qpd5i8naw601q6aij652gw8x6my5d5drf63lq9fridjrqj0nja";
       type = "gem";
     };
-    version = "0.1.6";
+    version = "0.1.7";
   };
   rex-nop = {
     groups = ["default"];
@@ -1497,10 +1497,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0w1iyvw0m2xvdr4654jnn1g27jwj84y94dvaj1k2p3lcrvndm698";
+      sha256 = "0yvfyxz70r45j65763fzy0p5j8cxlhnpn1n5lcxj4is7hp8v5i23";
       type = "gem";
     };
-    version = "1.2021.5";
+    version = "1.2022.1";
   };
   unf = {
     groups = ["default"];
@@ -1517,10 +1517,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0jmbimpnpjdzz8hlrppgl9spm99qh3qzbx0b81k3gkgwba8nk3yd";
+      sha256 = "0bf120xbq23zjyf8zi8h1576d71g58srr8rndig0whn10w72vrxz";
       type = "gem";
     };
-    version = "0.0.8";
+    version = "0.0.8.1";
   };
   unix-crypt = {
     groups = ["default"];
diff --git a/pkgs/tools/security/minio-certgen/default.nix b/pkgs/tools/security/minio-certgen/default.nix
index ee4413c9041..16dbfdf63ad 100644
--- a/pkgs/tools/security/minio-certgen/default.nix
+++ b/pkgs/tools/security/minio-certgen/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "minio-certgen";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "certgen";
     rev = "v${version}";
-    sha256 = "sha256-Qs+wpx9pRdWdY9FrBaKM8gdB0+POy80I6DB4UaBsJEE=";
+    sha256 = "sha256-FBx4v29ZuhXwubWivIXReO5Ge/rPt1J3LbXlprC7E9c=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/tools/security/sequoia/default.nix b/pkgs/tools/security/sequoia/default.nix
index 324af6aa4c9..4803430018e 100644
--- a/pkgs/tools/security/sequoia/default.nix
+++ b/pkgs/tools/security/sequoia/default.nix
@@ -5,7 +5,7 @@
 , git
 , nettle
 # Use the same llvmPackages version as Rust
-, llvmPackages_10
+, llvmPackages_12
 , cargo
 , rustc
 , rustPlatform
@@ -41,8 +41,8 @@ rustPlatform.buildRustPackage rec {
     cargo
     rustc
     git
-    llvmPackages_10.libclang.lib
-    llvmPackages_10.clang
+    llvmPackages_12.libclang.lib
+    llvmPackages_12.clang
     ensureNewerSourcesForZipFilesHook
     capnproto
   ] ++
@@ -72,7 +72,7 @@ rustPlatform.buildRustPackage rec {
     "build-release"
   ];
 
-  LIBCLANG_PATH = "${llvmPackages_10.libclang.lib}/lib";
+  LIBCLANG_PATH = "${llvmPackages_12.libclang.lib}/lib";
 
   # Sometimes, tests fail on CI (ofborg) & hydra without this
   CARGO_TEST_ARGS = "--workspace --exclude sequoia-store";
diff --git a/pkgs/tools/security/sigma-cli/default.nix b/pkgs/tools/security/sigma-cli/default.nix
index 3bf4e788912..5a6a3ab9ef5 100644
--- a/pkgs/tools/security/sigma-cli/default.nix
+++ b/pkgs/tools/security/sigma-cli/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "sigma-cli";
-  version = "0.3.0";
+  version = "0.3.2";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "SigmaHQ";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Nfd78Y35naDTzwodcdvJr/02CptcHxS717VGsR/QOuI=";
+    hash = "sha256-We6vJXLIxGe//78pgJFrihFJHl0gRd02I53hoYWcao0=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/security/spire/default.nix b/pkgs/tools/security/spire/default.nix
index 5f06abeda1b..9b9e9e93488 100644
--- a/pkgs/tools/security/spire/default.nix
+++ b/pkgs/tools/security/spire/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "spire";
-  version = "1.2.0";
+  version = "1.2.1";
 
   outputs = [ "out" "agent" "server" ];
 
@@ -10,10 +10,10 @@ buildGoModule rec {
     owner = "spiffe";
     repo = pname;
     rev = "v${version}";
-    sha256 = "01ph9jzh18bnidrsbnnxm3gxh0cgfllnjvf7a5haqz51lm6a9pny";
+    sha256 = "sha256-LK73RGSTwGhCXOglsqK8RAAldovRzliE78vi2ilTSrw=";
   };
 
-  vendorSha256 = "1fd1k5by4wcjmzfgi3gnrwnb38b0wa3w67kzjlx8s0nwapyfgx0b";
+  vendorSha256 = "sha256-am8ZTUX8Vph1Eg013NObMiSVeupS2hlHdpZ/1mO27dY=";
 
   subPackages = [ "cmd/spire-agent" "cmd/spire-server" ];
 
@@ -30,6 +30,7 @@ buildGoModule rec {
   meta = with lib; {
     description = "The SPIFFE Runtime Environment";
     homepage = "https://github.com/spiffe/spire";
+    changelog = "https://github.com/spiffe/spire/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ jonringer fkautz ];
   };
diff --git a/pkgs/tools/security/volatility3/default.nix b/pkgs/tools/security/volatility3/default.nix
index 393ac90d316..e019d96129f 100644
--- a/pkgs/tools/security/volatility3/default.nix
+++ b/pkgs/tools/security/volatility3/default.nix
@@ -5,15 +5,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "volatility3";
-  version = "2.0.0";
-
-  disabled = python3.pythonOlder "3.6";
+  version = "2.0.1";
 
   src = fetchFromGitHub {
     owner = "volatilityfoundation";
     repo = pname;
     rev = "v${version}";
-    sha256 = "141n09cdc17pfdhs01aw8l4cvsqpcz8ji5l4gi7r88cyf4ix2lnz";
+    hash = "sha256-rEqp+V5r4Sk4D+r2ukR1uy4IDj9XQGhYwoYSPeMyKpA=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
@@ -31,7 +29,9 @@ python3.pkgs.buildPythonApplication rec {
   # Project has no tests
   doCheck = false;
 
-  pythonImportsCheck = [ "volatility3" ];
+  pythonImportsCheck = [
+    "volatility3"
+  ];
 
   meta = with lib; {
     description = "Volatile memory extraction frameworks";
diff --git a/pkgs/tools/security/zdns/default.nix b/pkgs/tools/security/zdns/default.nix
index 913735d4cb9..354dd5b6447 100644
--- a/pkgs/tools/security/zdns/default.nix
+++ b/pkgs/tools/security/zdns/default.nix
@@ -5,19 +5,16 @@
 
 buildGoModule rec {
   pname = "zdns";
-  version = "20210327-${lib.strings.substring 0 7 rev}";
-  rev = "8c53210f0b9a4fe16c70a5d854e9413c3d0c1ba2";
+  version = "2022-03-14-unstable";
 
   src = fetchFromGitHub {
     owner = "zmap";
     repo = pname;
-    inherit rev;
-    sha256 = "0pdfz1489ynpw72flalnlkwybp683v826icjx7ljys45xvagdvck";
+    rev = "d659a361f6d5165462c10e1c1243f420175e066b";
+    hash = "sha256-856O6H03me3IM39/+6n56KJIetL+v4on6+lJx5D2Pcw=";
   };
 
-  vendorSha256 = "0b8h5n01xmhar1a09svb35ah48k9zdy1mn5balq0h2l0jxr05z78";
-
-  subPackages = [ "zdns" ];
+  vendorSha256 = "sha256-5kZ0voyicnqK/0yrMYW+gR1vVDyptW6I1HgyG4zleX8=";
 
   meta = with lib; {
     description = "CLI DNS lookup tool";
diff --git a/pkgs/tools/system/goreman/default.nix b/pkgs/tools/system/goreman/default.nix
index 9613ab8d650..8257e930779 100644
--- a/pkgs/tools/system/goreman/default.nix
+++ b/pkgs/tools/system/goreman/default.nix
@@ -2,14 +2,14 @@
 
 buildGoModule rec {
   pname = "goreman";
-  version = "0.3.9";
-  rev = "df1209e7cdbad10aecc0aa75d332bc32822925f5";
+  version = "0.3.11";
+  rev = "6006c6e410ec5a5ba22b50e96227754a42f2834d";
 
   src = fetchFromGitHub {
     owner = "mattn";
     repo = "goreman";
     rev = "v${version}";
-    sha256 = "1irjf5i5ybdchyn42bamfq8pj3w00p633h1gg202n0vsr39h0bxw";
+    sha256 = "sha256-TbJfeU94wakI2028kDqU+7dRRmqXuqpPeL4XBaA/HPo=";
   };
 
   ldflags = [
@@ -18,7 +18,7 @@ buildGoModule rec {
     "-X main.revision=${builtins.substring 0 7 rev}"
   ];
 
-  vendorSha256 = "sha256-+RFh6Ppxxs7P7DWqOBeEJTvPsBgOfopMjx22hPEI1/U=";
+  vendorSha256 = "sha256-87aHBRWm5Odv6LeshZty5N31sC+vdSwGlTYhk3BZkPo=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/system/hostctl/default.nix b/pkgs/tools/system/hostctl/default.nix
index fb3a293a80f..bf3a2511858 100644
--- a/pkgs/tools/system/hostctl/default.nix
+++ b/pkgs/tools/system/hostctl/default.nix
@@ -1,21 +1,32 @@
-{ buildGoModule, fetchFromGitHub, lib, installShellFiles }:
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, installShellFiles
+}:
 
 buildGoModule rec {
   pname = "hostctl";
-  version = "1.1.1";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
     owner = "guumaster";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-VjFjGvIoymGVVRiZUk/qoq/PTYoklp+Jz89zndX0e5A=";
+    hash = "sha256-rvUm31WRSLusM9VGsIHKGTH6Vs8LWPtzPDs3azA710w=";
   };
 
   vendorSha256 = "sha256-rGDWrivIdl5FTu/kNR8nAfE2+1hE4cm3uDg7oBobE9M=";
 
-  ldflags = [ "-s" "-w" "-X github.com/guumaster/hostctl/cmd/hostctl/actions.version=${version}" ];
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/guumaster/hostctl/cmd/hostctl/actions.version=${version}"
+  ];
 
-  nativeBuildInputs = [ installShellFiles ];
   postInstall = ''
     installShellCompletion --cmd hostctl \
       --bash <($out/bin/hostctl completion bash) \
@@ -23,7 +34,7 @@ buildGoModule rec {
   '';
 
   meta = with lib; {
-    description = "Your dev tool to manage /etc/hosts like a pro!";
+    description = "CLI tool to manage the /etc/hosts file";
     longDescription = ''
       This tool gives you more control over the use of your hosts file.
       You can have multiple profiles and switch them on/off as you need.
diff --git a/pkgs/tools/system/syslog-ng/default.nix b/pkgs/tools/system/syslog-ng/default.nix
index 5d7fd2b1b6d..6948728f16b 100644
--- a/pkgs/tools/system/syslog-ng/default.nix
+++ b/pkgs/tools/system/syslog-ng/default.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "syslog-ng";
-  version = "3.35.1";
+  version = "3.36.1";
 
   src = fetchurl {
     url = "https://github.com/${pname}/${pname}/releases/download/${pname}-${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-HQI4sGs+WYfIWeW1Kezuc491us/wSxSTmLH+jLsSHlM=";
+    sha256 = "sha256-kKJcl2f+dJ21DxGN38kuxxOZdj0uzVrU8R/17qBJ5gs=";
   };
 
   nativeBuildInputs = [ pkg-config which ];
diff --git a/pkgs/tools/text/mmdoc/default.nix b/pkgs/tools/text/mmdoc/default.nix
new file mode 100644
index 00000000000..e30020d15d9
--- /dev/null
+++ b/pkgs/tools/text/mmdoc/default.nix
@@ -0,0 +1,37 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmark-gfm
+, xxd
+, fastJson
+, libzip
+, ninja
+, meson
+, pkg-config
+}:
+
+stdenv.mkDerivation rec {
+  pname = "mmdoc";
+  version = "0.9.1";
+
+  src = fetchFromGitHub {
+    owner = "ryantm";
+    repo = "mmdoc";
+    rev = version;
+    hash = "sha256-Lz2+vsXjz9BVOCI1vIrNTvZgh19OuvXEhnMw2QBZr1w=";
+  };
+
+  nativeBuildInputs = [ ninja meson pkg-config xxd ];
+
+  buildInputs = [ cmark-gfm fastJson libzip ];
+
+  doCheck = stdenv.isx86_64;
+
+  meta = with lib; {
+    description = "Minimal Markdown Documentation";
+    homepage = "https://github.com/ryantm/mmdoc";
+    license = licenses.cc0;
+    maintainers = with maintainers; [ ryantm ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/tools/text/snippetpixie/default.nix b/pkgs/tools/text/snippetpixie/default.nix
index 7102977e8ee..a83135b5024 100644
--- a/pkgs/tools/text/snippetpixie/default.nix
+++ b/pkgs/tools/text/snippetpixie/default.nix
@@ -56,8 +56,6 @@ stdenv.mkDerivation rec {
     json-glib
     xorg.libXtst
     pantheon.granite
-    pantheon.elementary-gtk-theme
-    pantheon.elementary-icon-theme
   ];
 
   doCheck = true;
diff --git a/pkgs/tools/text/tab/default.nix b/pkgs/tools/text/tab/default.nix
index 096e0b04c69..18d3e3d004a 100644
--- a/pkgs/tools/text/tab/default.nix
+++ b/pkgs/tools/text/tab/default.nix
@@ -1,14 +1,14 @@
-{ lib, stdenv, fetchFromBitbucket, python3 }:
+{ lib, stdenv, fetchFromGitHub, python3 }:
 
 stdenv.mkDerivation rec {
-  version = "8.0";
+  version = "9.0";
   pname = "tab";
 
-  src = fetchFromBitbucket {
-    owner = "tkatchev";
+  src = fetchFromGitHub {
+    owner = "ivan-tkatchev";
     repo = pname;
     rev = version;
-    sha256 = "sha256-RcDvghTiqIdH79khwDIo8PhvmcObmix8WBrHToLwcw4=";
+    sha256 = "sha256-2keVGPRYV2KCeJ+LgAcl74cjW5wvp6Rmy7VNMtdliBE=";
   };
 
   checkInputs = [ python3 ];
diff --git a/pkgs/tools/text/vale/default.nix b/pkgs/tools/text/vale/default.nix
index 91ac9ae2e12..9ecd7f44cfa 100644
--- a/pkgs/tools/text/vale/default.nix
+++ b/pkgs/tools/text/vale/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "vale";
-  version = "2.15.2";
+  version = "2.15.3";
 
   subPackages = [ "cmd/vale" ];
   outputs = [ "out" "data" ];
@@ -11,10 +11,10 @@ buildGoModule rec {
     owner = "errata-ai";
     repo = "vale";
     rev = "v${version}";
-    sha256 = "sha256-4KP4/mfuHTYxOwWqHOa2RNHgElOg6YNAEFmiuF/sHa8=";
+    sha256 = "sha256-vhsn72xCe1wC4YRdo2m49iUj/3nVl0cyfeSmWRfESaY=";
   };
 
-  vendorSha256 = "sha256-2vYe943HHybOLcP8nDJe7RimMRIJdND2UPwtwB2mttE=";
+  vendorSha256 = "sha256-/0H35PGFFPch4jDnQ/ggctyHZJ5W/C1PNlkT5zzvI3M=";
 
   postInstall = ''
     mkdir -p $data/share/vale
diff --git a/pkgs/tools/virtualization/awsebcli/default.nix b/pkgs/tools/virtualization/awsebcli/default.nix
index 734ba58e693..8230768e997 100644
--- a/pkgs/tools/virtualization/awsebcli/default.nix
+++ b/pkgs/tools/virtualization/awsebcli/default.nix
@@ -29,6 +29,7 @@ let
         requests = changeVersionHash super.requests.overridePythonAttrs "2.26.0" "sha256-uKpY+M95P/2HgtPYyxnmbvNverpDU+7IWedGeLAbB6c=";
         six = changeVersion super.six.overridePythonAttrs "1.14.0" "02lw67hprv57hyg3cfy02y3ixjk3nzwc0dx3c4ynlvkfwkfdnsr3";
         wcwidth = changeVersion super.wcwidth.overridePythonAttrs "0.1.9" "1wf5ycjx8s066rdvr0fgz4xds9a8zhs91c4jzxvvymm1c8l8cwzf";
+        semantic-version = changeVersion super.semantic-version.overridePythonAttrs "2.8.5" "d2cb2de0558762934679b9a104e82eca7af448c9f4974d1f3eeccff651df8a54";
         pyyaml = super.pyyaml.overridePythonAttrs (oldAttrs: rec {
           version = "5.4.1";
           checkPhase = ''
diff --git a/pkgs/tools/virtualization/shipyard/default.nix b/pkgs/tools/virtualization/shipyard/default.nix
index dfdde2ead96..ee329828dc3 100644
--- a/pkgs/tools/virtualization/shipyard/default.nix
+++ b/pkgs/tools/virtualization/shipyard/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "shipyard";
-  version = "0.3.47";
+  version = "0.3.48";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "shipyard-run";
     repo = pname;
-    sha256 = "sha256-hzycO6yAwOoanoxxaGW0EwFiclu0WMkepzUAa6Zf8fg=";
+    sha256 = "sha256-Hbvp8MV5usg0R+QXM7Laq9I6XeZnvuVCjj/aHmnskiE=";
   };
   vendorSha256 = "sha256-mXYnmDppVqhjlkGVkvp1YaEwBEkHBUddxLof389huMQ=";
 
diff --git a/pkgs/tools/wayland/cliphist/default.nix b/pkgs/tools/wayland/cliphist/default.nix
index 9ccad4397dd..473c6fabc5a 100644
--- a/pkgs/tools/wayland/cliphist/default.nix
+++ b/pkgs/tools/wayland/cliphist/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "cliphist";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "sentriz";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-fx33m7DCp5N9VGI/H/IO66ECdFLobRRAAuRGNu4gzSk=";
+    sha256 = "sha256-kmXR8xzjAphgaC2Yd55VwZIJ4ehxP1LEA24hgyAbM7A=";
   };
 
-  vendorSha256 = "sha256-UrKSDvskGwHjwkb/fjvaJZ8xXFD98BFeSJxwJpc8A+M=";
+  vendorSha256 = "sha256-LZnefa0FjYG39YJrSN9ef6OnXHXgSrlSL4LvRqLxFx4=";
 
   meta = with lib; {
     description = "Wayland clipboard manager";
diff --git a/pkgs/tools/wayland/swaykbdd/default.nix b/pkgs/tools/wayland/swaykbdd/default.nix
index 4584018596d..e4f480dba8e 100644
--- a/pkgs/tools/wayland/swaykbdd/default.nix
+++ b/pkgs/tools/wayland/swaykbdd/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "swaykbdd";
-  version = "1.0";
+  version = "1.1";
 
   src = fetchFromGitHub {
     owner = "artemsen";
     repo = "swaykbdd";
     rev = "v${version}";
-    sha256 = "101mbf7pvm4ykmkh29g5xswrzdhdwq0rslzxqqfd5ksf1fphzgxd";
+    sha256 = "sha256-umYPVkkYeu6TyVkjDsVBsRZLYh8WyseCPdih85kTz6A=";
   };
 
   nativeBuildInputs = [ meson ninja pkg-config ];
diff --git a/pkgs/tools/wayland/swayr/default.nix b/pkgs/tools/wayland/swayr/default.nix
index c1bcf3b4e9f..6237d1a88ee 100644
--- a/pkgs/tools/wayland/swayr/default.nix
+++ b/pkgs/tools/wayland/swayr/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "swayr";
-  version = "0.13.0";
+  version = "0.15.0";
 
   src = fetchFromSourcehut {
     owner = "~tsdh";
     repo = "swayr";
     rev = "v${version}";
-    sha256 = "sha256-V4ETsraJo9X10fPMGSuiokPiSlZGYHncOdfheGom1go=";
+    sha256 = "sha256-GLOJjGr29v4oVNCWgjPWluIiSeLoIYeOw2HwmSfxA8Y=";
   };
 
-  cargoSha256 = "sha256-3ErzkS8u+4Ve26jpDbsYr4BVDm/XEgydYdZ2ErtVuVA=";
+  cargoSha256 = "sha256-gg/IHrgfDZT+3FNM/se5X1YMcHX127jMNI/WDEpMzy4=";
 
   patches = [
     ./icon-paths.patch
diff --git a/pkgs/tools/wayland/ydotool/default.nix b/pkgs/tools/wayland/ydotool/default.nix
index 4a75eac8c57..8d55233638e 100644
--- a/pkgs/tools/wayland/ydotool/default.nix
+++ b/pkgs/tools/wayland/ydotool/default.nix
@@ -1,41 +1,26 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, cmake, boost, libevdevplus, libuinputplus, iodash, cxxopts}:
+{ lib, stdenv, fetchFromGitHub, pkg-config, cmake, scdoc }:
 
 stdenv.mkDerivation rec {
   pname = "ydotool";
-  version = "unstable-2021-01-20";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "ReimuNotMoe";
     repo = "ydotool";
-    rev = "b1d041f52f7bac364d6539b1251d29c3b77c0f37";
-    sha256 = "1gzdbx6fv0dbcyia3yyzhv93az2gf90aszb9kcj5cnxywfpv9w9g";
+    rev = "v${version}";
+    sha256 = "sha256-maXXGCqB8dkGO8956hsKSwM4HQdYn6z1jBFENQ9sKcA=";
   };
 
-  # upstream decided to use a cpp package manager called cpm.
-  # we need to disable that because it wants networking, furthermore,
-  # it does some system folder creating which also needs to be disabled.
-  # Both changes are to respect the sandbox.
-  patches = [ ./fixup-cmakelists.patch ];
-
-
-  # cxxopts is a header only library.
-  # See pull request: https://github.com/ReimuNotMoe/ydotool/pull/105
-  postPatch = ''
-    substituteInPlace CMakeLists.txt --replace \
-      "PUBLIC cxxopts" \
-      "PUBLIC"
-  '';
-
   nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [
-    boost libevdevplus libuinputplus iodash cxxopts
+    scdoc
   ];
 
   meta = with lib; {
     inherit (src.meta) homepage;
     description = "Generic Linux command-line automation tool";
-    license = licenses.mit;
-    maintainers = with maintainers; [ willibutz ];
+    license = licenses.agpl3Plus;
+    maintainers = with maintainers; [ willibutz kraem ];
     platforms = with platforms; linux;
   };
 }
diff --git a/pkgs/tools/wayland/ydotool/fixup-cmakelists.patch b/pkgs/tools/wayland/ydotool/fixup-cmakelists.patch
deleted file mode 100644
index 965d5c38d83..00000000000
--- a/pkgs/tools/wayland/ydotool/fixup-cmakelists.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-From bb8bc44d22060cd1215712117cf30eae09f4f6ba Mon Sep 17 00:00:00 2001
-From: Jappie Klooster <jappieklooster@hotmail.com>
-Date: Fri, 2 Apr 2021 14:04:14 -0400
-Subject: [PATCH] Fixup cmaklists
-
-We remove cpm, which is a package manager for c++,
-which requires networking, so it's better just deleted.
-
-Furthermore we delete the adddirectory statements.
-These want to modify directories outside of the sandbox.
----
- CMakeLists.txt | 26 --------------------------
- 1 file changed, 26 deletions(-)
-
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index b5e8789..b797538 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -13,30 +13,6 @@ endif()
- 
- include(${CPM_DOWNLOAD_LOCATION})
- 
--CPMAddPackage(
--        NAME IODash
--        GITHUB_REPOSITORY YukiWorkshop/IODash
--        VERSION 0.1.0
--)
--
--CPMAddPackage(
--        NAME libevdevPlus
--        GITHUB_REPOSITORY YukiWorkshop/libevdevPlus
--        VERSION 0.2.1
--)
--
--CPMAddPackage(
--        NAME libuInputPlus
--        GITHUB_REPOSITORY YukiWorkshop/libuInputPlus
--        VERSION 0.2.1
--)
--
--CPMAddPackage(
--        NAME cxxopts
--        GITHUB_REPOSITORY jarro2783/cxxopts
--        VERSION 3.0.0
--        GIT_TAG 2d8e17c4f88efce80e274cb03eeb902e055a91d3
--)
- 
- set(SOURCE_FILES_LIBRARY
-         CommonIncludes.hpp
-@@ -74,5 +50,3 @@ add_executable(ydotool ${SOURCE_FILES_CLIENT})
- target_link_libraries(ydotool ydotool_library dl pthread uInputPlus evdevPlus)
- install(TARGETS ydotool DESTINATION ${CMAKE_INSTALL_BINDIR})
- 
--add_subdirectory(Daemon)
--add_subdirectory(manpage)
--- 
-2.29.2
-