Merge remote-tracking branch 'nixpkgs/staging-next' into staging

Conflicts:
	pkgs/development/libraries/zlib/default.nix
	pkgs/development/lua-modules/overrides.nix

485 files changed, 7451 insertions, 5000 deletions

diff --git a/.github/workflows/basic-eval.yml b/.github/workflows/basic-eval.yml
index 51429ae40bee0..41f751fd061f7 100644
--- a/.github/workflows/basic-eval.yml
+++ b/.github/workflows/basic-eval.yml
@@ -1,14 +1,15 @@
 name: Basic evaluation checks
 
 on:
-  pull_request:
-    branches:
-     - master
-     - release-**
-  push:
-    branches:
-     - master
-     - release-**
+  workflow_dispatch
+  # pull_request:
+  #   branches:
+  #    - master
+  #    - release-**
+  # push:
+  #   branches:
+  #    - master
+  #    - release-**
 jobs:
   tests:
     runs-on: ubuntu-latest
diff --git a/lib/customisation.nix b/lib/customisation.nix
index 234a528527d3c..cc9a9b1c55d0a 100644
--- a/lib/customisation.nix
+++ b/lib/customisation.nix
@@ -117,8 +117,55 @@ rec {
   callPackageWith = autoArgs: fn: args:
     let
       f = if lib.isFunction fn then fn else import fn;
-      auto = builtins.intersectAttrs (lib.functionArgs f) autoArgs;
-    in makeOverridable f (auto // args);
+      fargs = lib.functionArgs f;
+
+      # All arguments that will be passed to the function
+      # This includes automatic ones and ones passed explicitly
+      allArgs = builtins.intersectAttrs fargs autoArgs // args;
+
+      # A list of argument names that the function requires, but
+      # wouldn't be passed to it
+      missingArgs = lib.attrNames
+        # Filter out arguments that have a default value
+        (lib.filterAttrs (name: value: ! value)
+        # Filter out arguments that would be passed
+        (removeAttrs fargs (lib.attrNames allArgs)));
+
+      # Get a list of suggested argument names for a given missing one
+      getSuggestions = arg: lib.pipe (autoArgs // args) [
+        lib.attrNames
+        # Only use ones that are at most 2 edits away. While mork would work,
+        # levenshteinAtMost is only fast for 2 or less.
+        (lib.filter (lib.strings.levenshteinAtMost 2 arg))
+        # Put strings with shorter distance first
+        (lib.sort (x: y: lib.strings.levenshtein x arg < lib.strings.levenshtein y arg))
+        # Only take the first couple results
+        (lib.take 3)
+        # Quote all entries
+        (map (x: "\"" + x + "\""))
+      ];
+
+      prettySuggestions = suggestions:
+        if suggestions == [] then ""
+        else if lib.length suggestions == 1 then ", did you mean ${lib.elemAt suggestions 0}?"
+        else ", did you mean ${lib.concatStringsSep ", " (lib.init suggestions)} or ${lib.last suggestions}?";
+
+      errorForArg = arg:
+        let
+          loc = builtins.unsafeGetAttrPos arg fargs;
+          # loc' can be removed once lib/minver.nix is >2.3.4, since that includes
+          # https://github.com/NixOS/nix/pull/3468 which makes loc be non-null
+          loc' = if loc != null then loc.file + ":" + toString loc.line
+            else if ! lib.isFunction fn then
+              toString fn + lib.optionalString (lib.sources.pathIsDirectory fn) "/default.nix"
+            else "<unknown location>";
+        in "Function called without required argument \"${arg}\" at "
+        + "${loc'}${prettySuggestions (getSuggestions arg)}";
+
+      # Only show the error for the first missing argument
+      error = errorForArg (lib.head missingArgs);
+
+    in if missingArgs == [] then makeOverridable f allArgs else throw error;
 
 
   /* Like callPackage, but for a function that returns an attribute
diff --git a/lib/strings.nix b/lib/strings.nix
index b2fd495e4c841..d34263c994948 100644
--- a/lib/strings.nix
+++ b/lib/strings.nix
@@ -774,4 +774,131 @@ rec {
     (x: if stringLength x == 0 then "unknown" else x)
   ];
 
+  /* Computes the Levenshtein distance between two strings.
+     Complexity O(n*m) where n and m are the lengths of the strings.
+     Algorithm adjusted from https://stackoverflow.com/a/9750974/6605742
+
+     Type: levenshtein :: string -> string -> int
+
+     Example:
+       levenshtein "foo" "foo"
+       => 0
+       levenshtein "book" "hook"
+       => 1
+       levenshtein "hello" "Heyo"
+       => 3
+  */
+  levenshtein = a: b: let
+    # Two dimensional array with dimensions (stringLength a + 1, stringLength b + 1)
+    arr = lib.genList (i:
+      lib.genList (j:
+        dist i j
+      ) (stringLength b + 1)
+    ) (stringLength a + 1);
+    d = x: y: lib.elemAt (lib.elemAt arr x) y;
+    dist = i: j:
+      let c = if substring (i - 1) 1 a == substring (j - 1) 1 b
+        then 0 else 1;
+      in
+      if j == 0 then i
+      else if i == 0 then j
+      else lib.min
+        ( lib.min (d (i - 1) j + 1) (d i (j - 1) + 1))
+        ( d (i - 1) (j - 1) + c );
+  in d (stringLength a) (stringLength b);
+
+  /* Returns the length of the prefix common to both strings.
+  */
+  commonPrefixLength = a: b:
+    let
+      m = lib.min (stringLength a) (stringLength b);
+      go = i: if i >= m then m else if substring i 1 a == substring i 1 b then go (i + 1) else i;
+    in go 0;
+
+  /* Returns the length of the suffix common to both strings.
+  */
+  commonSuffixLength = a: b:
+    let
+      m = lib.min (stringLength a) (stringLength b);
+      go = i: if i >= m then m else if substring (stringLength a - i - 1) 1 a == substring (stringLength b - i - 1) 1 b then go (i + 1) else i;
+    in go 0;
+
+  /* Returns whether the levenshtein distance between two strings is at most some value
+     Complexity is O(min(n,m)) for k <= 2 and O(n*m) otherwise
+
+     Type: levenshteinAtMost :: int -> string -> string -> bool
+
+     Example:
+       levenshteinAtMost 0 "foo" "foo"
+       => true
+       levenshteinAtMost 1 "foo" "boa"
+       => false
+       levenshteinAtMost 2 "foo" "boa"
+       => true
+       levenshteinAtMost 2 "This is a sentence" "this is a sentense."
+       => false
+       levenshteinAtMost 3 "This is a sentence" "this is a sentense."
+       => true
+
+  */
+  levenshteinAtMost = let
+    infixDifferAtMost1 = x: y: stringLength x <= 1 && stringLength y <= 1;
+
+    # This function takes two strings stripped by their common pre and suffix,
+    # and returns whether they differ by at most two by Levenshtein distance.
+    # Because of this stripping, if they do indeed differ by at most two edits,
+    # we know that those edits were (if at all) done at the start or the end,
+    # while the middle has to have stayed the same. This fact is used in the
+    # implementation.
+    infixDifferAtMost2 = x: y:
+      let
+        xlen = stringLength x;
+        ylen = stringLength y;
+        # This function is only called with |x| >= |y| and |x| - |y| <= 2, so
+        # diff is one of 0, 1 or 2
+        diff = xlen - ylen;
+
+        # Infix of x and y, stripped by the left and right most character
+        xinfix = substring 1 (xlen - 2) x;
+        yinfix = substring 1 (ylen - 2) y;
+
+        # x and y but a character deleted at the left or right
+        xdelr = substring 0 (xlen - 1) x;
+        xdell = substring 1 (xlen - 1) x;
+        ydelr = substring 0 (ylen - 1) y;
+        ydell = substring 1 (ylen - 1) y;
+      in
+        # A length difference of 2 can only be gotten with 2 delete edits,
+        # which have to have happened at the start and end of x
+        # Example: "abcdef" -> "bcde"
+        if diff == 2 then xinfix == y
+        # A length difference of 1 can only be gotten with a deletion on the
+        # right and a replacement on the left or vice versa.
+        # Example: "abcdef" -> "bcdez" or "zbcde"
+        else if diff == 1 then xinfix == ydelr || xinfix == ydell
+        # No length difference can either happen through replacements on both
+        # sides, or a deletion on the left and an insertion on the right or
+        # vice versa
+        # Example: "abcdef" -> "zbcdez" or "bcdefz" or "zabcde"
+        else xinfix == yinfix || xdelr == ydell || xdell == ydelr;
+
+    in k: if k <= 0 then a: b: a == b else
+      let f = a: b:
+        let
+          alen = stringLength a;
+          blen = stringLength b;
+          prelen = commonPrefixLength a b;
+          suflen = commonSuffixLength a b;
+          presuflen = prelen + suflen;
+          ainfix = substring prelen (alen - presuflen) a;
+          binfix = substring prelen (blen - presuflen) b;
+        in
+        # Make a be the bigger string
+        if alen < blen then f b a
+        # If a has over k more characters than b, even with k deletes on a, b can't be reached
+        else if alen - blen > k then false
+        else if k == 1 then infixDifferAtMost1 ainfix binfix
+        else if k == 2 then infixDifferAtMost2 ainfix binfix
+        else levenshtein ainfix binfix <= k;
+      in f;
 }
diff --git a/lib/tests/misc.nix b/lib/tests/misc.nix
index 2711190313956..1eb2d953ebbe9 100644
--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@@ -913,4 +913,156 @@ runTests {
     };
   };
 
+  ## Levenshtein distance functions and co.
+  testCommonPrefixLengthEmpty = {
+    expr = strings.commonPrefixLength "" "hello";
+    expected = 0;
+  };
+
+  testCommonPrefixLengthSame = {
+    expr = strings.commonPrefixLength "hello" "hello";
+    expected = 5;
+  };
+
+  testCommonPrefixLengthDiffering = {
+    expr = strings.commonPrefixLength "hello" "hey";
+    expected = 2;
+  };
+
+  testCommonSuffixLengthEmpty = {
+    expr = strings.commonSuffixLength "" "hello";
+    expected = 0;
+  };
+
+  testCommonSuffixLengthSame = {
+    expr = strings.commonSuffixLength "hello" "hello";
+    expected = 5;
+  };
+
+  testCommonSuffixLengthDiffering = {
+    expr = strings.commonSuffixLength "test" "rest";
+    expected = 3;
+  };
+
+  testLevenshteinEmpty = {
+    expr = strings.levenshtein "" "";
+    expected = 0;
+  };
+
+  testLevenshteinOnlyAdd = {
+    expr = strings.levenshtein "" "hello there";
+    expected = 11;
+  };
+
+  testLevenshteinOnlyRemove = {
+    expr = strings.levenshtein "hello there" "";
+    expected = 11;
+  };
+
+  testLevenshteinOnlyTransform = {
+    expr = strings.levenshtein "abcdef" "ghijkl";
+    expected = 6;
+  };
+
+  testLevenshteinMixed = {
+    expr = strings.levenshtein "kitchen" "sitting";
+    expected = 5;
+  };
+
+  testLevenshteinAtMostZeroFalse = {
+    expr = strings.levenshteinAtMost 0 "foo" "boo";
+    expected = false;
+  };
+
+  testLevenshteinAtMostZeroTrue = {
+    expr = strings.levenshteinAtMost 0 "foo" "foo";
+    expected = true;
+  };
+
+  testLevenshteinAtMostOneFalse = {
+    expr = strings.levenshteinAtMost 1 "car" "ct";
+    expected = false;
+  };
+
+  testLevenshteinAtMostOneTrue = {
+    expr = strings.levenshteinAtMost 1 "car" "cr";
+    expected = true;
+  };
+
+  # We test levenshteinAtMost 2 particularly well because it uses a complicated
+  # implementation
+  testLevenshteinAtMostTwoIsEmpty = {
+    expr = strings.levenshteinAtMost 2 "" "";
+    expected = true;
+  };
+
+  testLevenshteinAtMostTwoIsZero = {
+    expr = strings.levenshteinAtMost 2 "abcdef" "abcdef";
+    expected = true;
+  };
+
+  testLevenshteinAtMostTwoIsOne = {
+    expr = strings.levenshteinAtMost 2 "abcdef" "abddef";
+    expected = true;
+  };
+
+  testLevenshteinAtMostTwoDiff0False = {
+    expr = strings.levenshteinAtMost 2 "abcdef" "aczyef";
+    expected = false;
+  };
+
+  testLevenshteinAtMostTwoDiff0Outer = {
+    expr = strings.levenshteinAtMost 2 "abcdef" "zbcdez";
+    expected = true;
+  };
+
+  testLevenshteinAtMostTwoDiff0DelLeft = {
+    expr = strings.levenshteinAtMost 2 "abcdef" "bcdefz";
+    expected = true;
+  };
+
+  testLevenshteinAtMostTwoDiff0DelRight = {
+    expr = strings.levenshteinAtMost 2 "abcdef" "zabcde";
+    expected = true;
+  };
+
+  testLevenshteinAtMostTwoDiff1False = {
+    expr = strings.levenshteinAtMost 2 "abcdef" "bddez";
+    expected = false;
+  };
+
+  testLevenshteinAtMostTwoDiff1DelLeft = {
+    expr = strings.levenshteinAtMost 2 "abcdef" "bcdez";
+    expected = true;
+  };
+
+  testLevenshteinAtMostTwoDiff1DelRight = {
+    expr = strings.levenshteinAtMost 2 "abcdef" "zbcde";
+    expected = true;
+  };
+
+  testLevenshteinAtMostTwoDiff2False = {
+    expr = strings.levenshteinAtMost 2 "hello" "hxo";
+    expected = false;
+  };
+
+  testLevenshteinAtMostTwoDiff2True = {
+    expr = strings.levenshteinAtMost 2 "hello" "heo";
+    expected = true;
+  };
+
+  testLevenshteinAtMostTwoDiff3 = {
+    expr = strings.levenshteinAtMost 2 "hello" "ho";
+    expected = false;
+  };
+
+  testLevenshteinAtMostThreeFalse = {
+    expr = strings.levenshteinAtMost 3 "hello" "Holla!";
+    expected = false;
+  };
+
+  testLevenshteinAtMostThreeTrue = {
+    expr = strings.levenshteinAtMost 3 "hello" "Holla";
+    expected = true;
+  };
 }
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index af379f48cb2ba..7cae29a1eefed 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -8549,7 +8549,7 @@
   };
   msfjarvis = {
     github = "msfjarvis";
-    githubId = 3348378;
+    githubId = 13348378;
     name = "Harsh Shandilya";
     email = "nixos@msfjarvis.dev";
     keys = [{
diff --git a/maintainers/scripts/feature-freeze-teams.pl b/maintainers/scripts/feature-freeze-teams.pl
new file mode 100755
index 0000000000000..eb37150befe37
--- /dev/null
+++ b/maintainers/scripts/feature-freeze-teams.pl
@@ -0,0 +1,98 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i perl -p perl -p perlPackages.JSON perlPackages.LWPUserAgent perlPackages.LWPProtocolHttps perlPackages.TermReadKey
+
+# This script generates a list of teams to ping for the Feature Freeze announcement on Discourse.
+# It's intended to be used by Release Managers before creating such posts.
+#
+# The script interactively reads a GitHub username and a corresponding GitHub Personal Access token.
+# This is required to access the GitHub Teams API so the token needs at least the read:org privilege.
+
+## no critic (InputOutput::RequireCheckedSyscalls, InputOutput::ProhibitBacktickOperators)
+use strict;
+use warnings;
+use Carp;
+use Cwd 'abs_path';
+use File::Basename;
+use JSON qw(decode_json);
+use LWP::UserAgent;
+use Term::ReadKey qw(ReadLine ReadMode);
+
+sub github_team_members {
+    my ($team_name, $username, $token) = @_;
+    my @ret;
+
+    my $req = HTTP::Request->new('GET', "https://api.github.com/orgs/NixOS/teams/$team_name/members", [ 'Accept' => 'application/vnd.github.v3+json' ]);
+    $req->authorization_basic($username, $token);
+    my $response = LWP::UserAgent->new->request($req);
+
+    if ($response->is_success) {
+        my $content = decode_json($response->decoded_content);
+        foreach (@{$content}) {
+            push @ret, $_->{'login'};
+        }
+    } else {
+        print {*STDERR} "!! Requesting members of GitHub Team '$team_name' failed: $response->status_line";
+    }
+
+    return \@ret;
+}
+
+# Read GitHub credentials
+print {*STDERR} 'GitHub username: ';
+my $github_user = ReadLine(0);
+ReadMode('noecho');
+print {*STDERR} 'GitHub personal access token (no echo): ';
+my $github_token = ReadLine(0);
+ReadMode('restore');
+print {*STDERR} "\n";
+chomp $github_user;
+chomp $github_token;
+
+# Read nix output
+my $nix_version = `nix --version`;
+my $out;
+my $lib_path = abs_path(dirname(__FILE__)) . '../../../lib';
+if ($nix_version =~ m/2[.]3[.]/msx) {
+    $out = `nix eval --json '(import $lib_path).teams'` || croak 'nix eval failed';
+} else {
+    $out = `nix --extra-experimental-features nix-command eval --json --impure --expr '(import $lib_path).teams'` || croak('nix eval failed');
+}
+my $data = decode_json($out);
+
+# Process teams
+print {*STDERR} "\n";
+while (my ($team_nix_key, $team_config) = each %{$data}) {
+    # Ignore teams that don't want to be or can't be pinged
+    if (not defined $team_config->{enableFeatureFreezePing} or not $team_config->{enableFeatureFreezePing}) {
+        next;
+    }
+    if (not defined $team_config->{shortName}) {
+        print {*STDERR} "!! The team with the nix key '$team_nix_key' has no shortName set - ignoring";
+        next;
+    }
+    #  Team name
+    print {*STDERR} "$team_config->{shortName}:";
+    # GitHub Teams
+    my @github_members;
+    if (defined $team_config->{githubTeams}) {
+        foreach (@{$team_config->{githubTeams}}) {
+            print {*STDERR} " \@NixOS/${_}";
+            push @github_members, @{github_team_members($_, $github_user, $github_token)};
+        }
+    }
+    my %github_members = map { $_ => 1 } @github_members;
+    # Members
+    if (defined $team_config->{members}) {
+        foreach (@{$team_config->{members}}) {
+            my %user = %{$_};
+            my $github_handle = $user{'github'};
+            # Ensure we don't ping team members twice (as team member and directly)
+            if (defined $github_members{$github_handle}) {
+                next;
+            }
+            print {*STDERR} " \@$github_handle";
+        }
+    }
+
+    print {*STDERR} "\n";
+}
diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index 8076edacd81ab..effcebf0d799b 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -3,12 +3,19 @@
       # Required
       members = [ maintainer1 maintainer2 ];
       scope = "Maintain foo packages.";
+      shortName = "foo";
+      # Optional
+      enableFeatureFreezePing = true;
+      githubTeams = [ "my-subsystem" ];
     };
 
   where
 
   - `members` is the list of maintainers belonging to the group,
   - `scope` describes the scope of the group.
+  - `shortName` short human-readable name
+  - `enableFeatureFreezePing` will ping this team during the Feature Freeze announcements on releases
+  - `githubTeams` will ping specified GitHub teams as well
 
   More fields may be added in the future.
 
@@ -27,6 +34,7 @@ with lib.maintainers; {
       m1cr0man
     ];
     scope = "Maintain ACME-related packages and modules.";
+    shortName = "ACME";
   };
 
   bazel = {
@@ -41,6 +49,8 @@ with lib.maintainers; {
       ylecornec
     ];
     scope = "Bazel build tool & related tools https://bazel.build/";
+    shortName = "Bazel";
+    enableFeatureFreezePing = true;
   };
 
   beam = {
@@ -53,7 +63,32 @@ with lib.maintainers; {
       minijackson
       yurrriq
     ];
+    githubTeams = [
+      "beam"
+    ];
     scope = "Maintain BEAM-related packages and modules.";
+    shortName = "BEAM";
+    enableFeatureFreezePing = true;
+  };
+
+  blockchains = {
+    members = [
+      mmahut
+      RaghavSood
+    ];
+    scope = "Maintain Blockchain packages and modules.";
+    shortName = "Blockchains";
+    enableFeatureFreezePing = true;
+  };
+
+  c = {
+    members = [
+      matthewbauer
+      mic92
+    ];
+    scope = "Maintain C libraries and tooling.";
+    shortName = "C";
+    enableFeatureFreezePing = true;
   };
 
   cinnamon = {
@@ -61,6 +96,8 @@ with lib.maintainers; {
       mkg20001
     ];
     scope = "Maintain Cinnamon desktop environment and applications made by the LinuxMint team.";
+    shortName = "Cinnamon";
+    enableFeatureFreezePing = true;
   };
 
   chia = {
@@ -68,6 +105,41 @@ with lib.maintainers; {
       lourkeur
     ];
     scope = "Maintain the Chia blockchain and its dependencies";
+    shortName = "Chia Blockchain";
+  };
+
+  cleanup = {
+    members = [
+      ajs124
+    ];
+    scope = "Cleaning of the nixpkgs source tree.";
+    shortName = "Cleanup";
+    enableFeatureFreezePing = true;
+  };
+
+  coq = {
+    members = [
+      cohencyril
+      Zimmi48
+      # gares has no entry in the maintainers list
+      siraben
+      vbgl
+    ];
+    scope = "Maintain the Coq theorem prover and related packages.";
+    shortName = "Coq";
+    enableFeatureFreezePing = true;
+  };
+
+  darwin = {
+    members = [
+      toonn
+    ];
+    githubTeams = [
+      "darwin-maintainers"
+    ];
+    scope = "Maintain Darwin compatibility of packages and Darwin-only packages.";
+    shortName = "Darwin";
+    enableFeatureFreezePing = true;
   };
 
   cosmopolitan = {
@@ -84,6 +156,7 @@ with lib.maintainers; {
       limeytexan
     ];
     scope = "Group registration for D. E. Shaw employees who collectively maintain packages.";
+    shortName = "Shaw employees";
   };
 
   determinatesystems = {
@@ -93,11 +166,63 @@ with lib.maintainers; {
       grahamc
     ];
     scope = "Group registration for packages maintained by Determinate Systems.";
+    shortName = "Determinate Systems employees";
+  };
+
+  dhall = {
+    members = [
+      Gabriel439
+      ehmry
+    ];
+    scope = "Maintain Dhall and related packages.";
+    shortName = "Dhall";
+    enableFeatureFreezePing = true;
+  };
+
+  docker = {
+    members = [
+      roberth
+      utdemir
+    ];
+    scope = "Maintain Docker and related tools.";
+    shortName = "DockerTools";
+    enableFeatureFreezePing = true;
+  };
+
+  docs = {
+    members = [
+      ryantm
+    ];
+    scope = "Maintain nixpkgs/NixOS documentation and tools for building it.";
+    shortName = "Docs";
+    enableFeatureFreezePing = true;
+  };
+
+  emacs = {
+    members = [
+      adisbladis
+    ];
+    scope = "Maintain the Emacs editor and packages.";
+    shortName = "Emacs";
+    enableFeatureFreezePing = true;
+  };
+
+  # Dummy group for the "everyone else" section
+  feature-freeze-everyone-else = {
+    members = [ ];
+    githubTeams = [
+      "nixpkgs-committers"
+      "release-engineers"
+    ];
+    scope = "Dummy team for the #everyone else' section during feture freezes, not to be used as package maintainers!";
+    shortName = "Everyone else";
+    enableFeatureFreezePing = true;
   };
 
   freedesktop = {
     members = [ jtojnar ];
     scope = "Maintain Freedesktop.org packages for graphical desktop.";
+    shortName = "freedesktop.org packaging";
   };
 
   gcc = {
@@ -107,6 +232,7 @@ with lib.maintainers; {
       ericson2314
     ];
     scope = "Maintain GCC (GNU Compiler Collection) compilers";
+    shortName = "GCC";
   };
 
   golang = {
@@ -121,6 +247,8 @@ with lib.maintainers; {
       zowoq
     ];
     scope = "Maintain Golang compilers.";
+    shortName = "Go";
+    enableFeatureFreezePing = true;
   };
 
   gnome = {
@@ -131,7 +259,12 @@ with lib.maintainers; {
       dasj19
       maxeaubrey
     ];
+    githubTeams = [
+      "gnome"
+    ];
     scope = "Maintain GNOME desktop environment and platform.";
+    shortName = "GNOME";
+    enableFeatureFreezePing = true;
   };
 
   haskell = {
@@ -141,7 +274,12 @@ with lib.maintainers; {
       maralorn
       sternenseemann
     ];
+    githubTeams = [
+      "haskell"
+    ];
     scope = "Maintain Haskell packages and infrastructure.";
+    shortName = "Haskell";
+    enableFeatureFreezePing = true;
   };
 
   home-assistant = {
@@ -152,6 +290,7 @@ with lib.maintainers; {
       mic92
     ];
     scope = "Maintain the Home Assistant ecosystem";
+    shortName = "Home Assistant";
   };
 
   iog = {
@@ -163,6 +302,7 @@ with lib.maintainers; {
       nrdxp
     ];
     scope = "Input-Output Global employees, which maintain critical software";
+    shortName = "Input-Output Global employees";
   };
 
   jitsi = {
@@ -173,6 +313,7 @@ with lib.maintainers; {
       yuka
     ];
     scope = "Maintain Jitsi.";
+    shortName = "Jitsi";
   };
 
   kubernetes = {
@@ -184,6 +325,7 @@ with lib.maintainers; {
       zowoq
     ];
     scope = "Maintain the Kubernetes package and module";
+    shortName = "Kubernetes";
   };
 
   kodi = {
@@ -196,6 +338,7 @@ with lib.maintainers; {
       sephalon
     ];
     scope = "Maintain Kodi and related packages.";
+    shortName = "Kodi";
   };
 
   linux-kernel = {
@@ -206,6 +349,17 @@ with lib.maintainers; {
       qyliss
     ];
     scope = "Maintain the Linux kernel.";
+    shortName = "Linux Kernel";
+  };
+
+  marketing = {
+    members = [
+      garbas
+      tomberek
+    ];
+    scope = "Marketing of Nix/NixOS/nixpkgs.";
+    shortName = "Marketing";
+    enableFeatureFreezePing = true;
   };
 
   mate = {
@@ -214,6 +368,7 @@ with lib.maintainers; {
       romildo
     ];
     scope = "Maintain Mate desktop environment and related packages.";
+    shortName = "MATE";
   };
 
   matrix = {
@@ -227,6 +382,40 @@ with lib.maintainers; {
       sumnerevans
     ];
     scope = "Maintain the ecosystem around Matrix, a decentralized messenger.";
+    shortName = "Matrix";
+  };
+
+  mobile = {
+    members = [
+      samueldr
+    ];
+    scope = "Maintain Mobile NixOS.";
+    shortName = "Mobile";
+    enableFeatureFreezePing = true;
+  };
+
+  nix = {
+    members = [
+      Profpatsch
+      eelco
+      grahamc
+      pierron
+    ];
+    scope = "Maintain the Nix package manager.";
+    shortName = "Nix/nix-cli ecosystem";
+    enableFeatureFreezePing = true;
+  };
+
+  nixos-modules = {
+    members = [
+      ericson2314
+      infinisil
+      qyliss
+      roberth
+    ];
+    scope = "Maintain nixpkgs module system internals.";
+    shortName = "NixOS Modules / internals";
+    enableFeatureFreezePing = true;
   };
 
   openstack = {
@@ -235,6 +424,7 @@ with lib.maintainers; {
       SuperSandro2000
     ];
     scope = "Maintain the ecosystem around OpenStack";
+    shortName = "OpenStack";
   };
 
   pantheon = {
@@ -242,7 +432,21 @@ with lib.maintainers; {
       davidak
       bobby285271
     ];
+    githubTeams = [
+      "pantheon"
+    ];
     scope = "Maintain Pantheon desktop environment and platform.";
+    shortName = "Pantheon";
+    enableFeatureFreezePing = true;
+  };
+
+  perl = {
+    members = [
+      sgo
+    ];
+    scope = "Maintain the Perl interpreter and Perl packages.";
+    shortName = "Perl";
+    enableFeatureFreezePing = true;
   };
 
   php = {
@@ -254,7 +458,12 @@ with lib.maintainers; {
       ma27
       talyz
     ];
+    githubTeams = [
+      "php"
+    ];
     scope = "Maintain PHP related packages and extensions.";
+    shortName = "PHP";
+    enableFeatureFreezePing = true;
   };
 
   podman = {
@@ -264,7 +473,54 @@ with lib.maintainers; {
       vdemeester
       zowoq
     ];
+    githubTeams = [
+      "podman"
+    ];
     scope = "Maintain Podman and CRI-O related packages and modules.";
+    shortName = "Podman";
+    enableFeatureFreezePing = true;
+  };
+
+  postgres = {
+    members = [
+      thoughtpolice
+    ];
+    scope = "Maintain the PostgreSQL package and plugins along with the NixOS module.";
+    shortName = "PostgreSQL";
+    enableFeatureFreezePing = true;
+  };
+
+  python = {
+    members = [
+      fridh
+      hexa
+      jonringer
+    ];
+    scope = "Maintain the Python interpreter and related packages.";
+    shortName = "Python";
+    enableFeatureFreezePing = true;
+  };
+
+  qt-kde = {
+    members = [
+      ttuegel
+    ];
+    githubTeams = [
+      "qt-kde"
+    ];
+    scope = "Maintain the KDE desktop environment and Qt.";
+    shortName = "Qt / KDE";
+    enableFeatureFreezePing = true;
+  };
+
+  r = {
+    members = [
+      bcdarwin
+      jbedo
+    ];
+    scope = "Maintain the R programming language and related packages.";
+    shortName = "R";
+    enableFeatureFreezePing = true;
   };
 
   redcodelabs = {
@@ -274,6 +530,38 @@ with lib.maintainers; {
       wintrmvte
     ];
     scope = "Maintain Red Code Labs related packages and modules.";
+    shortName = "Red Code Labs";
+  };
+
+  release = {
+    members = [ ];
+    githubTeams = [
+      "nixos-release-managers"
+    ];
+    scope = "Manage the current nixpkgs/NixOS release.";
+    shortName = "Release";
+    enableFeatureFreezePing = true;
+  };
+
+  ruby = {
+    members = [
+      marsam
+    ];
+    scope = "Maintain the Ruby interpreter and related packages.";
+    shortName = "Ruby";
+    enableFeatureFreezePing = true;
+  };
+
+  rust = {
+    members = [
+      andir
+      lnl7
+      mic92
+      zowoq
+    ];
+    scope = "Maintain the Rust compiler toolchain and nixpkgs integration.";
+    shortName = "Rust";
+    enableFeatureFreezePing = true;
   };
 
   sage = {
@@ -284,6 +572,7 @@ with lib.maintainers; {
       collares
     ];
     scope = "Maintain SageMath and the dependencies that are likely to break it.";
+    shortName = "SageMath";
   };
 
   sphinx = {
@@ -291,6 +580,7 @@ with lib.maintainers; {
       SuperSandro2000
     ];
     scope = "Maintain Sphinx related packages.";
+    shortName = "Sphinx";
   };
 
   serokell = {
@@ -300,6 +590,26 @@ with lib.maintainers; {
       mkaito
     ];
     scope = "Group registration for Serokell employees who collectively maintain packages.";
+    shortName = "Serokell employees";
+  };
+
+  systemd = {
+    members = [ ];
+    githubTeams = [
+      "systemd"
+    ];
+    scope = "Maintain systemd for NixOS.";
+    shortName = "systemd";
+    enableFeatureFreezePing = true;
+  };
+
+  tests = {
+    members = [
+      tfc
+    ];
+    scope = "Maintain the NixOS VM test runner.";
+    shortName = "NixOS tests";
+    enableFeatureFreezePing = true;
   };
 
   tts = {
@@ -308,6 +618,18 @@ with lib.maintainers; {
       mic92
     ];
     scope = "coqui-ai TTS (formerly Mozilla TTS) and leaf packages";
+    shortName = "coqui-ai TTS";
+  };
+
+  vim = {
+    members = [
+      jonringer
+      softinio
+      teto
+    ];
+    scope = "Maintain the vim and neovim text editors and related packages.";
+    shortName = "Vim/Neovim";
+    enableFeatureFreezePing = true;
   };
 
   xfce = {
@@ -315,5 +637,6 @@ with lib.maintainers; {
       romildo
     ];
     scope = "Maintain Xfce desktop environment and related packages.";
+    shortName = "Xfce";
   };
 }
diff --git a/nixos/doc/manual/development/settings-options.section.md b/nixos/doc/manual/development/settings-options.section.md
index f9bb6ff9cc41f..d569e23adbdcb 100644
--- a/nixos/doc/manual/development/settings-options.section.md
+++ b/nixos/doc/manual/development/settings-options.section.md
@@ -32,6 +32,20 @@ type of this option should represent the format. The most common formats
 have a predefined type and string generator already declared under
 `pkgs.formats`:
 
+`pkgs.formats.javaProperties` { *`comment`* ? `"Generated with Nix"` }
+
+:   A function taking an attribute set with values
+
+    `comment`
+
+    :   A string to put at the start of the
+        file in a comment. It can have multiple
+        lines.
+
+    It returns the `type`: `attrsOf str` and a function
+    `generate` to build a Java `.properties` file, taking
+    care of the correct escaping, etc.
+
 `pkgs.formats.json` { }
 
 :   A function taking an empty attribute set (for future extensibility)
diff --git a/nixos/doc/manual/development/writing-nixos-tests.section.md b/nixos/doc/manual/development/writing-nixos-tests.section.md
index 433e1906f7756..a9ffffe2277c2 100644
--- a/nixos/doc/manual/development/writing-nixos-tests.section.md
+++ b/nixos/doc/manual/development/writing-nixos-tests.section.md
@@ -5,15 +5,9 @@ A NixOS test is a Nix expression that has the following structure:
 ```nix
 import ./make-test-python.nix {
 
-  # Either the configuration of a single machine:
-  machine =
-    { config, pkgs, ... }:
-    { configuration…
-    };
-
-  # Or a set of machines:
+  # One or more machines:
   nodes =
-    { machine1 =
+    { machine =
         { config, pkgs, ... }: { … };
       machine2 =
         { config, pkgs, ... }: { … };
@@ -29,17 +23,16 @@ import ./make-test-python.nix {
 
 The attribute `testScript` is a bit of Python code that executes the
 test (described below). During the test, it will start one or more
-virtual machines, the configuration of which is described by the
-attribute `machine` (if you need only one machine in your test) or by
-the attribute `nodes` (if you need multiple machines). For instance,
-[`login.nix`](https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/login.nix)
-only needs a single machine to test whether users can log in
+virtual machines, the configuration of which is described by
+the attribute `nodes`.
+
+An example of a single-node test is
+[`login.nix`](https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/login.nix).
+It only needs a single machine to test whether users can log in
 on the virtual console, whether device ownership is correctly maintained
-when switching between consoles, and so on. On the other hand,
-[`nfs/simple.nix`](https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/nfs/simple.nix),
-which tests NFS client and server functionality in the
-Linux kernel (including whether locks are maintained across server
-crashes), requires three machines: a server and two clients.
+when switching between consoles, and so on. An interesting multi-node test is
+[`nfs/simple.nix`](https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/nfs/simple.nix).
+It uses two client nodes to test correct locking across server crashes.
 
 There are a few special NixOS configuration options for test VMs:
 
@@ -67,8 +60,7 @@ The test script is a sequence of Python statements that perform various
 actions, such as starting VMs, executing commands in the VMs, and so on.
 Each virtual machine is represented as an object stored in the variable
 `name` if this is also the identifier of the machine in the declarative
-config. If you didn\'t specify multiple machines using the `nodes`
-attribute, it is just `machine`. The following example starts the
+config. If you specified a node `nodes.machine`, the following example starts the
 machine, waits until it has finished booting, then executes a command
 and checks that the output is more-or-less correct:
 
@@ -79,7 +71,7 @@ if not "Linux" in machine.succeed("uname"):
   raise Exception("Wrong OS")
 ```
 
-The first line is actually unnecessary; machines are implicitly started
+The first line is technically unnecessary; machines are implicitly started
 when you first execute an action on them (such as `wait_for_unit` or
 `succeed`). If you have multiple machines, you can speed up the test by
 starting them in parallel:
@@ -303,7 +295,7 @@ For faster dev cycles it\'s also possible to disable the code-linters
 ```nix
 import ./make-test-python.nix {
   skipLint = true;
-  machine =
+  nodes.machine =
     { config, pkgs, ... }:
     { configuration…
     };
diff --git a/nixos/doc/manual/from_md/development/settings-options.section.xml b/nixos/doc/manual/from_md/development/settings-options.section.xml
index 746011a2d075b..d26dd96243dbe 100644
--- a/nixos/doc/manual/from_md/development/settings-options.section.xml
+++ b/nixos/doc/manual/from_md/development/settings-options.section.xml
@@ -55,6 +55,38 @@
     <variablelist>
       <varlistentry>
         <term>
+          <literal>pkgs.formats.javaProperties</literal> {
+          <emphasis><literal>comment</literal></emphasis> ?
+          <literal>&quot;Generated with Nix&quot;</literal> }
+        </term>
+        <listitem>
+          <para>
+            A function taking an attribute set with values
+          </para>
+          <variablelist>
+            <varlistentry>
+              <term>
+                <literal>comment</literal>
+              </term>
+              <listitem>
+                <para>
+                  A string to put at the start of the file in a comment.
+                  It can have multiple lines.
+                </para>
+              </listitem>
+            </varlistentry>
+          </variablelist>
+          <para>
+            It returns the <literal>type</literal>:
+            <literal>attrsOf str</literal> and a function
+            <literal>generate</literal> to build a Java
+            <literal>.properties</literal> file, taking care of the
+            correct escaping, etc.
+          </para>
+        </listitem>
+      </varlistentry>
+      <varlistentry>
+        <term>
           <literal>pkgs.formats.json</literal> { }
         </term>
         <listitem>
diff --git a/nixos/doc/manual/from_md/development/writing-nixos-tests.section.xml b/nixos/doc/manual/from_md/development/writing-nixos-tests.section.xml
index 4f856f98f2a22..b194d58e5beb6 100644
--- a/nixos/doc/manual/from_md/development/writing-nixos-tests.section.xml
+++ b/nixos/doc/manual/from_md/development/writing-nixos-tests.section.xml
@@ -6,15 +6,9 @@
   <programlisting language="bash">
 import ./make-test-python.nix {
 
-  # Either the configuration of a single machine:
-  machine =
-    { config, pkgs, ... }:
-    { configuration…
-    };
-
-  # Or a set of machines:
+  # One or more machines:
   nodes =
-    { machine1 =
+    { machine =
         { config, pkgs, ... }: { … };
       machine2 =
         { config, pkgs, ... }: { … };
@@ -31,18 +25,18 @@ import ./make-test-python.nix {
     The attribute <literal>testScript</literal> is a bit of Python code
     that executes the test (described below). During the test, it will
     start one or more virtual machines, the configuration of which is
-    described by the attribute <literal>machine</literal> (if you need
-    only one machine in your test) or by the attribute
-    <literal>nodes</literal> (if you need multiple machines). For
-    instance,
-    <link xlink:href="https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/login.nix"><literal>login.nix</literal></link>
-    only needs a single machine to test whether users can log in on the
-    virtual console, whether device ownership is correctly maintained
-    when switching between consoles, and so on. On the other hand,
-    <link xlink:href="https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/nfs/simple.nix"><literal>nfs/simple.nix</literal></link>,
-    which tests NFS client and server functionality in the Linux kernel
-    (including whether locks are maintained across server crashes),
-    requires three machines: a server and two clients.
+    described by the attribute <literal>nodes</literal>.
+  </para>
+  <para>
+    An example of a single-node test is
+    <link xlink:href="https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/login.nix"><literal>login.nix</literal></link>.
+    It only needs a single machine to test whether users can log in on
+    the virtual console, whether device ownership is correctly
+    maintained when switching between consoles, and so on. An
+    interesting multi-node test is
+    <link xlink:href="https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/nfs/simple.nix"><literal>nfs/simple.nix</literal></link>.
+    It uses two client nodes to test correct locking across server
+    crashes.
   </para>
   <para>
     There are a few special NixOS configuration options for test VMs:
@@ -94,9 +88,8 @@ import ./make-test-python.nix {
     various actions, such as starting VMs, executing commands in the
     VMs, and so on. Each virtual machine is represented as an object
     stored in the variable <literal>name</literal> if this is also the
-    identifier of the machine in the declarative config. If you didn't
-    specify multiple machines using the <literal>nodes</literal>
-    attribute, it is just <literal>machine</literal>. The following
+    identifier of the machine in the declarative config. If you
+    specified a node <literal>nodes.machine</literal>, the following
     example starts the machine, waits until it has finished booting,
     then executes a command and checks that the output is more-or-less
     correct:
@@ -108,7 +101,7 @@ if not &quot;Linux&quot; in machine.succeed(&quot;uname&quot;):
   raise Exception(&quot;Wrong OS&quot;)
 </programlisting>
   <para>
-    The first line is actually unnecessary; machines are implicitly
+    The first line is technically unnecessary; machines are implicitly
     started when you first execute an action on them (such as
     <literal>wait_for_unit</literal> or <literal>succeed</literal>). If
     you have multiple machines, you can speed up the test by starting
@@ -554,7 +547,7 @@ machine.wait_for_unit(&quot;xautolock.service&quot;, &quot;x-session-user&quot;)
     <programlisting language="bash">
 import ./make-test-python.nix {
   skipLint = true;
-  machine =
+  nodes.machine =
     { config, pkgs, ... }:
     { configuration…
     };
diff --git a/nixos/doc/manual/from_md/installation/installing-usb.section.xml b/nixos/doc/manual/from_md/installation/installing-usb.section.xml
index b46a1d565557d..df266eb16800f 100644
--- a/nixos/doc/manual/from_md/installation/installing-usb.section.xml
+++ b/nixos/doc/manual/from_md/installation/installing-usb.section.xml
@@ -17,7 +17,7 @@ $ diskutil list
 [..]
 $ diskutil unmountDisk diskN
 Unmount of all volumes on diskN was successful
-$ sudo dd if=nix.iso of=/dev/rdiskN
+$ sudo dd if=nix.iso of=/dev/rdiskN bs=1M
 </programlisting>
     <para>
       Using the 'raw' <literal>rdiskN</literal> device instead of
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
index 89b23678454ce..f46372918fbc9 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@@ -1414,6 +1414,35 @@
       </listitem>
       <listitem>
         <para>
+          A new option group
+          <literal>systemd.network.wait-online</literal> was added, with
+          options to configure
+          <literal>systemd-networkd-wait-online.service</literal>:
+        </para>
+        <itemizedlist spacing="compact">
+          <listitem>
+            <para>
+              <literal>anyInterface</literal> allows specifying that the
+              network should be considered online when <emphasis>at
+              least one</emphasis> interface is online (useful on
+              laptops)
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>timeout</literal> defines how long to wait for
+              the network to come online
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>extraArgs</literal> for everything else
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
+      <listitem>
+        <para>
           The <literal>influxdb2</literal> package was split into
           <literal>influxdb2-server</literal> and
           <literal>influxdb2-cli</literal>, matching the split that took
@@ -1666,9 +1695,20 @@
       </listitem>
       <listitem>
         <para>
-          <literal>services.logrotate.enable</literal> now defaults to
-          true if any rotate path has been defined, and some paths have
-          been added by default.
+          <link linkend="opt-services.logrotate.enable">services.logrotate.enable</link>
+          now defaults to true if any rotate path has been defined, and
+          some paths have been added by default.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The logrotate module also has been updated to freeform syntax:
+          <link linkend="opt-services.logrotate.paths">services.logrotate.paths</link>
+          and
+          <link linkend="opt-services.logrotate.extraConfig">services.logrotate.extraConfig</link>
+          will work, but issue deprecation warnings and
+          <link linkend="opt-services.logrotate.settings">services.logrotate.settings</link>
+          should now be used instead.
         </para>
       </listitem>
       <listitem>
diff --git a/nixos/doc/manual/installation/installing-usb.section.md b/nixos/doc/manual/installation/installing-usb.section.md
index ae58c08e5237e..d893e22e6381b 100644
--- a/nixos/doc/manual/installation/installing-usb.section.md
+++ b/nixos/doc/manual/installation/installing-usb.section.md
@@ -18,7 +18,7 @@ $ diskutil list
 [..]
 $ diskutil unmountDisk diskN
 Unmount of all volumes on diskN was successful
-$ sudo dd if=nix.iso of=/dev/rdiskN
+$ sudo dd if=nix.iso of=/dev/rdiskN bs=1M
 ```
 
 Using the \'raw\' `rdiskN` device instead of `diskN` completes in
diff --git a/nixos/doc/manual/release-notes/rl-2205.section.md b/nixos/doc/manual/release-notes/rl-2205.section.md
index 4918d8460b581..7c69b075838b5 100644
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@@ -502,6 +502,11 @@ In addition to numerous new and upgraded packages, this release has the followin
   still under heavy development and behavior is not always flawless.
   Furthermore, not all Electron apps use the latest Electron versions.
 
+- A new option group `systemd.network.wait-online` was added, with options to configure `systemd-networkd-wait-online.service`:
+  - `anyInterface` allows specifying that the network should be considered online when *at least one* interface is online (useful on laptops)
+  - `timeout` defines how long to wait for the network to come online
+  - `extraArgs` for everything else
+
 - The `influxdb2` package was split into `influxdb2-server` and
   `influxdb2-cli`, matching the split that took place upstream. A
   combined `influxdb2` package is still provided in this release for
@@ -582,8 +587,11 @@ In addition to numerous new and upgraded packages, this release has the followin
 - `services.mattermost.plugins` has been added to allow the declarative installation of Mattermost plugins.
   Plugins are automatically repackaged using autoPatchelf.
 
-- `services.logrotate.enable` now defaults to true if any rotate path has
+- [services.logrotate.enable](#opt-services.logrotate.enable) now defaults to true if any rotate path has
   been defined, and some paths have been added by default.
+- The logrotate module also has been updated to freeform syntax: [services.logrotate.paths](#opt-services.logrotate.paths)
+  and [services.logrotate.extraConfig](#opt-services.logrotate.extraConfig) will work, but issue deprecation
+  warnings and [services.logrotate.settings](#opt-services.logrotate.settings) should now be used instead.
 
 - The `zrepl` package has been updated from 0.4.0 to 0.5:
 
diff --git a/nixos/lib/testing-python.nix b/nixos/lib/testing-python.nix
index facc7a253a759..cd2bb2f9d4d4c 100644
--- a/nixos/lib/testing-python.nix
+++ b/nixos/lib/testing-python.nix
@@ -206,6 +206,7 @@ rec {
             )];
           };
         in
+          lib.warnIf (t?machine) "In test `${name}': The `machine' attribute in NixOS tests (pkgs.nixosTest / make-test-pyton.nix / testing-python.nix / makeTest) is deprecated. Please use the equivalent `nodes.machine'."
           build-vms.buildVirtualNetwork (
               nodes // lib.optionalAttrs (machine != null) { inherit machine; }
           );
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index a9ed8f251283a..c4958c36ea004 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -977,6 +977,7 @@
   ./services/security/shibboleth-sp.nix
   ./services/security/sks.nix
   ./services/security/sshguard.nix
+  ./services/security/sslmate-agent.nix
   ./services/security/step-ca.nix
   ./services/security/tor.nix
   ./services/security/torify.nix
diff --git a/nixos/modules/programs/_1password-gui.nix b/nixos/modules/programs/_1password-gui.nix
index f57de44bb9e26..42f6a0b52252c 100644
--- a/nixos/modules/programs/_1password-gui.nix
+++ b/nixos/modules/programs/_1password-gui.nix
@@ -3,67 +3,66 @@
 with lib;
 
 let
+
   cfg = config.programs._1password-gui;
 
-in {
+in
+{
   options = {
     programs._1password-gui = {
-      enable = mkEnableOption "The 1Password Desktop application with browser integration";
+      enable = mkEnableOption "the 1Password GUI application";
 
-      groupId = mkOption {
-        type = types.int;
+      gid = mkOption {
+        type = types.addCheck types.int (x: x >= 1000);
         example = literalExpression "5000";
         description = ''
-          The GroupID to assign to the onepassword group, which is needed for browser integration. The group ID must be 1000 or greater.
-          '';
+          The gid to assign to the onepassword group, which is needed for browser integration.
+          It must be 1000 or greater.
+        '';
       };
 
       polkitPolicyOwners = mkOption {
         type = types.listOf types.str;
-        default = [];
-        example = literalExpression "[\"user1\" \"user2\" \"user3\"]";
+        default = [ ];
+        example = literalExpression ''["user1" "user2" "user3"]'';
         description = ''
-          A list of users who should be able to integrate 1Password with polkit-based authentication mechanisms. By default, no users will have such access.
-          '';
+          A list of users who should be able to integrate 1Password with polkit-based authentication mechanisms.
+        '';
       };
 
-      package = mkOption {
-        type = types.package;
-        default = pkgs._1password-gui;
-        defaultText = literalExpression "pkgs._1password-gui";
-        example = literalExpression "pkgs._1password-gui";
-        description = ''
-          The 1Password derivation to use. This can be used to upgrade from the stable release that we keep in nixpkgs to the betas.
-          '';
+      package = mkPackageOption pkgs "1Password GUI" {
+        default = [ "_1password-gui" ];
       };
     };
   };
 
-  config = let
-    package = cfg.package.override {
-      polkitPolicyOwners = cfg.polkitPolicyOwners;
-    };
-  in mkIf cfg.enable {
-    environment.systemPackages = [ package ];
-    users.groups.onepassword.gid = cfg.groupId;
+  config =
+    let
+      package = cfg.package.override {
+        polkitPolicyOwners = cfg.polkitPolicyOwners;
+      };
+    in
+    mkIf cfg.enable {
+      environment.systemPackages = [ package ];
+      users.groups.onepassword.gid = cfg.gid;
 
-    security.wrappers = {
-      "1Password-BrowserSupport" =
-        { source = "${cfg.package}/share/1password/1Password-BrowserSupport";
+      security.wrappers = {
+        "1Password-BrowserSupport" = {
+          source = "${package}/share/1password/1Password-BrowserSupport";
           owner = "root";
           group = "onepassword";
           setuid = false;
           setgid = true;
         };
 
-      "1Password-KeyringHelper" =
-        { source = "${cfg.package}/share/1password/1Password-KeyringHelper";
+        "1Password-KeyringHelper" = {
+          source = "${package}/share/1password/1Password-KeyringHelper";
           owner = "root";
           group = "onepassword";
           setuid = true;
           setgid = true;
         };
-    };
+      };
 
-  };
+    };
 }
diff --git a/nixos/modules/programs/_1password.nix b/nixos/modules/programs/_1password.nix
index eae518e61ca73..547c12867a916 100644
--- a/nixos/modules/programs/_1password.nix
+++ b/nixos/modules/programs/_1password.nix
@@ -3,35 +3,33 @@
 with lib;
 
 let
+
   cfg = config.programs._1password;
-in {
+
+in
+{
   options = {
     programs._1password = {
-      enable = mkEnableOption "The 1Password CLI tool with biometric unlock and integration with the 1Password GUI.";
+      enable = mkEnableOption "the 1Password CLI tool";
 
-      groupId = mkOption {
-        type = types.int;
+      gid = mkOption {
+        type = types.addCheck types.int (x: x >= 1000);
         example = literalExpression "5001";
         description = ''
-          The GroupID to assign to the onepassword-cli group, which is needed for integration with the 1Password GUI. The group ID must be 1000 or greater.
+          The gid to assign to the onepassword-cli group, which is needed for integration with the 1Password GUI.
+          It must be 1000 or greater.
         '';
       };
 
-      package = mkOption {
-        type = types.package;
-        default = pkgs._1password;
-        defaultText = literalExpression "pkgs._1password";
-        example = literalExpression "pkgs._1password";
-        description = ''
-          The 1Password CLI derivation to use.
-        '';
+      package = mkPackageOption pkgs "1Password CLI" {
+        default = [ "_1password" ];
       };
     };
   };
 
   config = mkIf cfg.enable {
     environment.systemPackages = [ cfg.package ];
-    users.groups.onepassword-cli.gid = cfg.groupId;
+    users.groups.onepassword-cli.gid = cfg.gid;
 
     security.wrappers = {
       "op" = {
diff --git a/nixos/modules/services/continuous-integration/jenkins/slave.nix b/nixos/modules/services/continuous-integration/jenkins/slave.nix
index 3c0e6f78e74ca..871b9914fb27a 100644
--- a/nixos/modules/services/continuous-integration/jenkins/slave.nix
+++ b/nixos/modules/services/continuous-integration/jenkins/slave.nix
@@ -1,4 +1,4 @@
-{ config, lib, ... }:
+{ config, lib, pkgs, ... }:
 with lib;
 let
   cfg = config.services.jenkinsSlave;
@@ -46,6 +46,15 @@ in {
           this is the home of the "jenkins" user.
         '';
       };
+
+      javaPackage = mkOption {
+        default = pkgs.jdk;
+        defaultText = literalExpression "pkgs.jdk";
+        description = ''
+          Java package to install.
+        '';
+        type = types.package;
+      };
     };
   };
 
@@ -64,5 +73,10 @@ in {
         uid = config.ids.uids.jenkins;
       };
     };
+
+    programs.java = {
+      enable = true;
+      package = cfg.javaPackage;
+    };
   };
 }
diff --git a/nixos/modules/services/desktops/pipewire/daemon/pipewire-pulse.conf.json b/nixos/modules/services/desktops/pipewire/daemon/pipewire-pulse.conf.json
index df0f62556dff6..b19fb33ec1788 100644
--- a/nixos/modules/services/desktops/pipewire/daemon/pipewire-pulse.conf.json
+++ b/nixos/modules/services/desktops/pipewire/daemon/pipewire-pulse.conf.json
@@ -29,14 +29,7 @@
     },
     {
       "name": "libpipewire-module-protocol-pulse",
-      "args": {
-        "server.address": [
-          "unix:native"
-        ],
-        "vm.overrides": {
-          "pulse.min.quantum": "1024/48000"
-        }
-      }
+      "args": {}
     }
   ],
   "context.exec": [
@@ -46,6 +39,14 @@
     }
   ],
   "stream.properties": {},
+  "pulse.properties": {
+    "server.address": [
+      "unix:native"
+    ],
+    "vm.overrides": {
+      "pulse.min.quantum": "1024/48000"
+    }
+  },
   "pulse.rules": [
     {
       "matches": [
diff --git a/nixos/modules/services/desktops/pipewire/wireplumber.nix b/nixos/modules/services/desktops/pipewire/wireplumber.nix
index 32206ccb4e600..1dbdd842c4a1e 100644
--- a/nixos/modules/services/desktops/pipewire/wireplumber.nix
+++ b/nixos/modules/services/desktops/pipewire/wireplumber.nix
@@ -38,7 +38,7 @@ in
 
     environment.etc."wireplumber/main.lua.d/80-nixos.lua" = lib.mkIf (!pwUsedForAudio) {
      text = ''
-        # Pipewire is not used for audio, so prevent it from grabbing audio devices
+        -- Pipewire is not used for audio, so prevent it from grabbing audio devices
         alsa_monitor.enable = function() end
       '';
     };
diff --git a/nixos/modules/services/logging/logrotate.nix b/nixos/modules/services/logging/logrotate.nix
index 082cf92ff4efe..332a2a597edc1 100644
--- a/nixos/modules/services/logging/logrotate.nix
+++ b/nixos/modules/services/logging/logrotate.nix
@@ -5,7 +5,10 @@ with lib;
 let
   cfg = config.services.logrotate;
 
-  pathOpts = { name, ... }:  {
+  # deprecated legacy compat settings
+  # these options will be removed before 22.11 in the following PR:
+  # https://github.com/NixOS/nixpkgs/pull/164169
+  pathOpts = { name, ... }: {
     options = {
       enable = mkOption {
         type = types.bool;
@@ -86,23 +89,113 @@ let
     config.name = name;
   };
 
-  mkConf = pathOpts: ''
-    # generated by NixOS using the `services.logrotate.paths.${pathOpts.name}` attribute set
-    ${concatMapStringsSep " " (path: ''"${path}"'') (toList pathOpts.path)} {
-      ${optionalString (pathOpts.user != null || pathOpts.group != null) "su ${pathOpts.user} ${pathOpts.group}"}
-      ${pathOpts.frequency}
-      rotate ${toString pathOpts.keep}
-      ${pathOpts.extraConfig}
-    }
-  '';
-
-  paths = sortProperties (attrValues (filterAttrs (_: pathOpts: pathOpts.enable) cfg.paths));
-  configFile = pkgs.writeText "logrotate.conf" (
-    concatStringsSep "\n" (
-      [ "missingok" "notifempty" cfg.extraConfig ] ++ (map mkConf paths)
-    )
+  generateLine = n: v:
+    if builtins.elem n [ "files" "priority" "enable" "global" ] || v == null then null
+    else if builtins.elem n [ "extraConfig" "frequency" ] then "${v}\n"
+    else if builtins.elem n [ "firstaction" "lastaction" "prerotate" "postrotate" "preremove" ]
+         then "${n}\n    ${v}\n  endscript\n"
+    else if isInt v then "${n} ${toString v}\n"
+    else if v == true then "${n}\n"
+    else if v == false then "no${n}\n"
+    else "${n} ${v}\n";
+  generateSection = indent: settings: concatStringsSep (fixedWidthString indent " " "") (
+    filter (x: x != null) (mapAttrsToList generateLine settings)
   );
 
+  # generateSection includes a final newline hence weird closing brace
+  mkConf = settings:
+    if settings.global or false then generateSection 0 settings
+    else ''
+      ${concatMapStringsSep "\n" (files: ''"${files}"'') (toList settings.files)} {
+        ${generateSection 2 settings}}
+    '';
+
+  # below two mapPaths are compat functions
+  mapPathOptToSetting = n: v:
+    if n == "keep" then nameValuePair "rotate" v
+    else if n == "path" then nameValuePair "files" v
+    else nameValuePair n v;
+
+  mapPathsToSettings = path: pathOpts:
+    nameValuePair path (
+      filterAttrs (n: v: ! builtins.elem n [ "user" "group" "name" ] && v != "") (
+        (mapAttrs' mapPathOptToSetting pathOpts) //
+        {
+          su =
+            if pathOpts.user != null
+            then "${pathOpts.user} ${pathOpts.group}"
+            else null;
+        }
+      )
+    );
+
+  settings = sortProperties (attrValues (filterAttrs (_: settings: settings.enable) (
+    foldAttrs recursiveUpdate { } [
+      {
+        header = {
+          enable = true;
+          missingok = true;
+          notifempty = true;
+          frequency = "weekly";
+          rotate = 4;
+        };
+        # compat section
+        extraConfig = {
+          enable = (cfg.extraConfig != "");
+          global = true;
+          extraConfig = cfg.extraConfig;
+          priority = 101;
+        };
+      }
+      (mapAttrs' mapPathsToSettings cfg.paths)
+      cfg.settings
+      { header = { global = true; priority = 100; }; }
+    ]
+  )));
+  configFile = pkgs.writeTextFile {
+    name = "logrotate.conf";
+    text = concatStringsSep "\n" (
+      map mkConf settings
+    );
+    checkPhase = optionalString cfg.checkConfig ''
+      # logrotate --debug also checks that users specified in config
+      # file exist, but we only have sandboxed users here so brown these
+      # out. according to man page that means su, create and createolddir.
+      # files required to exist also won't be present, so missingok is forced.
+      user=$(${pkgs.coreutils}/bin/id -un)
+      group=$(${pkgs.coreutils}/bin/id -gn)
+      sed -e "s/\bsu\s.*/su $user $group/" \
+          -e "s/\b\(create\s\+[0-9]*\s*\|createolddir\s\+[0-9]*\s\+\).*/\1$user $group/" \
+          -e "1imissingok" -e "s/\bnomissingok\b//" \
+          $out > /tmp/logrotate.conf
+      # Since this makes for very verbose builds only show real error.
+      # There is no way to control log level, but logrotate hardcodes
+      # 'error:' at common log level, so we can use grep, taking care
+      # to keep error codes
+      set -o pipefail
+      if ! ${pkgs.logrotate}/sbin/logrotate --debug /tmp/logrotate.conf 2>&1 \
+          | ( ! grep "error:" ) > /tmp/logrotate-error; then
+              echo "Logrotate configuration check failed."
+              echo "The failing configuration (after adjustments to pass tests in sandbox) was:"
+              printf "%s\n" "-------"
+              cat /tmp/logrotate.conf
+              printf "%s\n" "-------"
+              echo "The error reported by logrotate was as follow:"
+              printf "%s\n" "-------"
+              cat /tmp/logrotate-error
+              printf "%s\n" "-------"
+              echo "You can disable this check with services.logrotate.checkConfig = false,"
+              echo "but if you think it should work please report this failure along with"
+              echo "the config file being tested!"
+              false
+      fi
+    '';
+  };
+
+  mailOption =
+    if foldr (n: a: a || n ? mail) false (attrValues cfg.settings)
+    then "--mail=${pkgs.mailutils}/bin/mail"
+    else "";
 in
 {
   imports = [
@@ -112,17 +205,121 @@ in
   options = {
     services.logrotate = {
       enable = mkEnableOption "the logrotate systemd service" // {
-        default = foldr (n: a: a || n.enable) false (attrValues cfg.paths);
-        defaultText = literalExpression "cfg.paths != {}";
+        default = foldr (n: a: a || n.enable) false (attrValues cfg.settings);
+        defaultText = literalExpression "cfg.settings != {}";
+      };
+
+      settings = mkOption {
+        default = { };
+        description = ''
+          logrotate freeform settings: each attribute here will define its own section,
+          ordered by priority, which can either define files to rotate with their settings
+          or settings common to all further files settings.
+          Refer to <link xlink:href="https://linux.die.net/man/8/logrotate"/> for details.
+        '';
+        type = types.attrsOf (types.submodule ({ name, ... }: {
+          freeformType = with types; attrsOf (nullOr (oneOf [ int bool str ]));
+
+          options = {
+            enable = mkEnableOption "setting individual kill switch" // {
+              default = true;
+            };
+
+            global = mkOption {
+              type = types.bool;
+              default = false;
+              description = ''
+                Whether this setting is a global option or not: set to have these
+                settings apply to all files settings with a higher priority.
+              '';
+            };
+            files = mkOption {
+              type = with types; either str (listOf str);
+              default = name;
+              defaultText = ''
+                The attrset name if not specified
+              '';
+              description = ''
+                Single or list of files for which rules are defined.
+                The files are quoted with double-quotes in logrotate configuration,
+                so globs and spaces are supported.
+                Note this setting is ignored if globals is true.
+              '';
+            };
+
+            frequency = mkOption {
+              type = types.nullOr types.str;
+              default = null;
+              description = ''
+                How often to rotate the logs. Defaults to previously set global setting,
+                which itself defauts to weekly.
+              '';
+            };
+
+            priority = mkOption {
+              type = types.int;
+              default = 1000;
+              description = ''
+                Order of this logrotate block in relation to the others. The semantics are
+                the same as with `lib.mkOrder`. Smaller values are inserted first.
+              '';
+            };
+          };
+
+        }));
+      };
+
+      configFile = mkOption {
+        type = types.path;
+        default = configFile;
+        defaultText = ''
+          A configuration file automatically generated by NixOS.
+        '';
+        description = ''
+          Override the configuration file used by MySQL. By default,
+          NixOS generates one automatically from <xref linkend="opt-services.logrotate.settings"/>.
+        '';
+        example = literalExpression ''
+          pkgs.writeText "logrotate.conf" '''
+            missingok
+            "/var/log/*.log" {
+              rotate 4
+              weekly
+            }
+          ''';
+        '';
       };
 
+      checkConfig = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Whether the config should be checked at build time.
+
+          Some options are not checkable at build time because of the build sandbox:
+          for example, the test does not know about existing files and system users are
+          not known.
+          These limitations mean we must adjust the file for tests (missingok is forced
+          and users are replaced by dummy users), so tests are complemented by a
+          logrotate-checkconf service that is enabled by default.
+          This extra check can be disabled by disabling it at the systemd level with the
+          <option>services.systemd.services.logrotate-checkconf.enable</option> option.
+
+          Conversely there are still things that might make this check fail incorrectly
+          (e.g. a file path where we don't have access to intermediate directories):
+          in this case you can disable the failing check with this option.
+        '';
+      };
+
+      # deprecated legacy compat settings
       paths = mkOption {
         type = with types; attrsOf (submodule pathOpts);
-        default = {};
+        default = { };
         description = ''
           Attribute set of paths to rotate. The order each block appears in the generated configuration file
           can be controlled by the <link linkend="opt-services.logrotate.paths._name_.priority">priority</link> option
           using the same semantics as `lib.mkOrder`. Smaller values have a greater priority.
+          This setting has been deprecated in favor of <link linkend="opt-services.logrotate.settings">logrotate settings</link>.
         '';
         example = literalExpression ''
           {
@@ -151,19 +348,37 @@ in
         description = ''
           Extra contents to append to the logrotate configuration file. Refer to
           <link xlink:href="https://linux.die.net/man/8/logrotate"/> for details.
+          This setting has been deprecated in favor of
+          <link linkend="opt-services.logrotate.settings">logrotate settings</link>.
         '';
       };
     };
   };
 
   config = mkIf cfg.enable {
-    assertions = mapAttrsToList (name: pathOpts:
-      { assertion = (pathOpts.user != null) == (pathOpts.group != null);
-        message = ''
-          If either of `services.logrotate.paths.${name}.user` or `services.logrotate.paths.${name}.group` are specified then *both* must be specified.
-        '';
-      }
-    ) cfg.paths;
+    assertions =
+      mapAttrsToList
+        (name: pathOpts:
+          {
+            assertion = (pathOpts.user != null) == (pathOpts.group != null);
+            message = ''
+              If either of `services.logrotate.paths.${name}.user` or `services.logrotate.paths.${name}.group` are specified then *both* must be specified.
+            '';
+          })
+        cfg.paths;
+
+    warnings =
+      (mapAttrsToList
+        (name: pathOpts: ''
+          Using config.services.logrotate.paths.${name} is deprecated and will become unsupported in a future release.
+          Please use services.logrotate.settings instead.
+        '')
+        cfg.paths
+      ) ++
+      (optional (cfg.extraConfig != "") ''
+        Using config.services.logrotate.extraConfig is deprecated and will become unsupported in a future release.
+        Please use services.logrotate.settings with globals=true instead.
+      '');
 
     systemd.services.logrotate = {
       description = "Logrotate Service";
@@ -172,7 +387,16 @@ in
       serviceConfig = {
         Restart = "no";
         User = "root";
-        ExecStart = "${pkgs.logrotate}/sbin/logrotate ${configFile}";
+        ExecStart = "${pkgs.logrotate}/sbin/logrotate ${mailOption} ${cfg.configFile}";
+      };
+    };
+    systemd.services.logrotate-checkconf = {
+      description = "Logrotate configuration check";
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+        ExecStart = "${pkgs.logrotate}/sbin/logrotate --debug ${cfg.configFile}";
       };
     };
   };
diff --git a/nixos/modules/services/matrix/matrix-synapse.nix b/nixos/modules/services/matrix/matrix-synapse.nix
index c4d14dbd547ef..4abcc8b69bc53 100644
--- a/nixos/modules/services/matrix/matrix-synapse.nix
+++ b/nixos/modules/services/matrix/matrix-synapse.nix
@@ -141,7 +141,7 @@ in {
       enable = mkEnableOption "matrix.org synapse";
 
       configFile = mkOption {
-        type = types.str;
+        type = types.path;
         readOnly = true;
         description = ''
           Path to the configuration file on the target system. Useful to configure e.g. workers
diff --git a/nixos/modules/services/misc/gitlab.nix b/nixos/modules/services/misc/gitlab.nix
index c3b23f4d34825..0811b34156e49 100644
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@@ -848,10 +848,7 @@ in {
 
         extraConfig = mkOption {
           type = types.lines;
-          default = ''
-            copytruncate
-            compress
-          '';
+          default = "";
           description = ''
             Extra logrotate config options for this path. Refer to
             <link xlink:href="https://linux.die.net/man/8/logrotate"/> for details.
@@ -977,13 +974,14 @@ in {
     # Enable rotation of log files
     services.logrotate = {
       enable = cfg.logrotate.enable;
-      paths = {
+      settings = {
         gitlab = {
-          path = "${cfg.statePath}/log/*.log";
-          user = cfg.user;
-          group = cfg.group;
+          files = "${cfg.statePath}/log/*.log";
+          su = "${cfg.user} ${cfg.group}";
           frequency = cfg.logrotate.frequency;
-          keep = cfg.logrotate.keep;
+          rotate = cfg.logrotate.keep;
+          copytruncate = true;
+          compress = true;
           extraConfig = cfg.logrotate.extraConfig;
         };
       };
diff --git a/nixos/modules/services/misc/nix-gc.nix b/nixos/modules/services/misc/nix-gc.nix
index b4b4b55a6c823..0fcb016010175 100644
--- a/nixos/modules/services/misc/nix-gc.nix
+++ b/nixos/modules/services/misc/nix-gc.nix
@@ -39,7 +39,7 @@ in
         type = types.str;
         example = "45min";
         description = ''
-          Add a randomized delay before each automatic upgrade.
+          Add a randomized delay before each garbage collection.
           The delay will be chosen between zero and this value.
           This value must be a time span in the format specified by
           <citerefentry><refentrytitle>systemd.time</refentrytitle>
diff --git a/nixos/modules/services/misc/paperless-ng.nix b/nixos/modules/services/misc/paperless-ng.nix
index 11e44f5ece575..881fa93c04eed 100644
--- a/nixos/modules/services/misc/paperless-ng.nix
+++ b/nixos/modules/services/misc/paperless-ng.nix
@@ -216,6 +216,8 @@ in
         Restart = "on-failure";
         # The `mbind` syscall is needed for running the classifier.
         SystemCallFilter = defaultServiceConfig.SystemCallFilter ++ [ "mbind" ];
+        # Needs to talk to mail server for automated import rules
+        PrivateNetwork = false;
       };
       environment = env;
       wantedBy = [ "multi-user.target" ];
@@ -258,8 +260,6 @@ in
             '${cfg.passwordFile}' '${cfg.dataDir}/superuser-password'
         '';
         Type = "oneshot";
-        # Needs to talk to mail server for automated import rules
-        PrivateNetwork = false;
       };
     };
 
diff --git a/nixos/modules/services/monitoring/prometheus/exporters/bird.nix b/nixos/modules/services/monitoring/prometheus/exporters/bird.nix
index 1ef264fc86e5a..5fda4c980ebb8 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters/bird.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/bird.nix
@@ -17,7 +17,7 @@ in
     };
     birdSocket = mkOption {
       type = types.path;
-      default = "/var/run/bird.ctl";
+      default = "/run/bird/bird.ctl";
       description = ''
         Path to BIRD2 (or BIRD1 v4) socket.
       '';
diff --git a/nixos/modules/services/networking/lxd-image-server.nix b/nixos/modules/services/networking/lxd-image-server.nix
index b119ba8acf634..d326626eed442 100644
--- a/nixos/modules/services/networking/lxd-image-server.nix
+++ b/nixos/modules/services/networking/lxd-image-server.nix
@@ -51,18 +51,14 @@ in
 
       environment.etc."lxd-image-server/config.toml".source = format.generate "config.toml" cfg.settings;
 
-      services.logrotate.paths.lxd-image-server = {
-        path = "/var/log/lxd-image-server/lxd-image-server.log";
+      services.logrotate.settings.lxd-image-server = {
+        files = "/var/log/lxd-image-server/lxd-image-server.log";
         frequency = "daily";
-        keep = 21;
-        extraConfig = ''
-          create 755 lxd-image-server ${cfg.group}
-          missingok
-          compress
-          delaycompress
-          copytruncate
-          notifempty
-        '';
+        rotate = 21;
+        create = "755 lxd-image-server ${cfg.group}";
+        compress = true;
+        delaycompress = true;
+        copytruncate = true;
       };
 
       systemd.tmpfiles.rules = [
diff --git a/nixos/modules/services/networking/syncplay.nix b/nixos/modules/services/networking/syncplay.nix
index b6faf2d3f7727..c17426ecced72 100644
--- a/nixos/modules/services/networking/syncplay.nix
+++ b/nixos/modules/services/networking/syncplay.nix
@@ -61,6 +61,15 @@ in
           Group to use when running Syncplay.
         '';
       };
+
+      passwordFile = mkOption {
+        type = types.nullOr types.path;
+        default = null;
+        description = ''
+          Path to the file that contains the server password. If
+          <literal>null</literal>, the server doesn't require a password.
+        '';
+      };
     };
   };
 
@@ -71,10 +80,17 @@ in
       after       = [ "network-online.target" ];
 
       serviceConfig = {
-        ExecStart = "${pkgs.syncplay}/bin/syncplay-server ${escapeShellArgs cmdArgs}";
         User = cfg.user;
         Group = cfg.group;
+        LoadCredential = lib.mkIf (cfg.passwordFile != null) "password:${cfg.passwordFile}";
       };
+
+      script = ''
+        ${lib.optionalString (cfg.passwordFile != null) ''
+          export SYNCPLAY_PASSWORD=$(cat "''${CREDENTIALS_DIRECTORY}/password")
+        ''}
+        exec ${pkgs.syncplay}/bin/syncplay-server ${escapeShellArgs cmdArgs}
+      '';
     };
   };
 }
diff --git a/nixos/modules/services/security/oauth2_proxy.nix b/nixos/modules/services/security/oauth2_proxy.nix
index ce295bd4ba3bb..5c89d58723760 100644
--- a/nixos/modules/services/security/oauth2_proxy.nix
+++ b/nixos/modules/services/security/oauth2_proxy.nix
@@ -571,8 +571,11 @@ in
     users.users.oauth2_proxy = {
       description = "OAuth2 Proxy";
       isSystemUser = true;
+      group = "oauth2_proxy";
     };
 
+    users.groups.oauth2_proxy = {};
+
     systemd.services.oauth2_proxy = {
       description = "OAuth2 Proxy";
       path = [ cfg.package ];
diff --git a/nixos/modules/services/web-servers/apache-httpd/default.nix b/nixos/modules/services/web-servers/apache-httpd/default.nix
index d817ff6019a3b..3099705acbe2e 100644
--- a/nixos/modules/services/web-servers/apache-httpd/default.nix
+++ b/nixos/modules/services/web-servers/apache-httpd/default.nix
@@ -710,20 +710,15 @@ in
 
     services.logrotate = optionalAttrs (cfg.logFormat != "none") {
       enable = mkDefault true;
-      paths.httpd = {
-        path = "${cfg.logDir}/*.log";
-        user = cfg.user;
-        group = cfg.group;
+      settings.httpd = {
+        files = "${cfg.logDir}/*.log";
+        su = "${cfg.user} ${cfg.group}";
         frequency = "daily";
-        keep = 28;
-        extraConfig = ''
-          sharedscripts
-          compress
-          delaycompress
-          postrotate
-            systemctl reload httpd.service > /dev/null 2>/dev/null || true
-          endscript
-        '';
+        rotate = 28;
+        sharedscripts = true;
+        compress = true;
+        delaycompress = true;
+        postrotate = "systemctl reload httpd.service > /dev/null 2>/dev/null || true";
       };
     };
 
diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index e046c28dd6bbe..7caaf5611cc0e 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -989,17 +989,14 @@ in
       nginx.gid = config.ids.gids.nginx;
     };
 
-    services.logrotate.paths.nginx = mapAttrs (_: mkDefault) {
-      path = "/var/log/nginx/*.log";
+    services.logrotate.settings.nginx = mapAttrs (_: mkDefault) {
+      files = "/var/log/nginx/*.log";
       frequency = "weekly";
-      keep = 26;
-      extraConfig = ''
-        compress
-        delaycompress
-        postrotate
-          [ ! -f /var/run/nginx/nginx.pid ] || kill -USR1 `cat /var/run/nginx/nginx.pid`
-        endscript
-      '';
+      su = "${cfg.user} ${cfg.group}";
+      rotate = 26;
+      compress = true;
+      delaycompress = true;
+      postrotate = "[ ! -f /var/run/nginx/nginx.pid ] || kill -USR1 `cat /var/run/nginx/nginx.pid`";
     };
   };
 }
diff --git a/nixos/modules/services/x11/desktop-managers/pantheon.nix b/nixos/modules/services/x11/desktop-managers/pantheon.nix
index 48e119a861875..3528b0f40e7b7 100644
--- a/nixos/modules/services/x11/desktop-managers/pantheon.nix
+++ b/nixos/modules/services/x11/desktop-managers/pantheon.nix
@@ -302,6 +302,7 @@ in
       environment.systemPackages = with pkgs.pantheon; [
         contractor
         file-roller-contract
+        gnome-bluetooth-contract
       ];
 
       environment.pathsToLink = [
diff --git a/nixos/modules/system/boot/kernel.nix b/nixos/modules/system/boot/kernel.nix
index db00244ca0afa..fad00e39497d9 100644
--- a/nixos/modules/system/boot/kernel.nix
+++ b/nixos/modules/system/boot/kernel.nix
@@ -241,7 +241,7 @@ in
             "xhci_pci"
             "usbhid"
             "hid_generic" "hid_lenovo" "hid_apple" "hid_roccat"
-            "hid_logitech_hidpp" "hid_logitech_dj" "hid_microsoft"
+            "hid_logitech_hidpp" "hid_logitech_dj" "hid_microsoft" "hid_cherry"
 
           ] ++ optionals pkgs.stdenv.hostPlatform.isx86 [
             # Misc. x86 keyboard stuff.
diff --git a/nixos/modules/system/boot/networkd.nix b/nixos/modules/system/boot/networkd.nix
index 4444ce3363a10..1e9f870b32fb7 100644
--- a/nixos/modules/system/boot/networkd.nix
+++ b/nixos/modules/system/boot/networkd.nix
@@ -1745,6 +1745,48 @@ in
         }));
     };
 
+    systemd.network.wait-online = {
+      anyInterface = mkOption {
+        description = ''
+          Whether to consider the network online when any interface is online, as opposed to all of them.
+          This is useful on portable machines with a wired and a wireless interface, for example.
+        '';
+        type = types.bool;
+        default = false;
+      };
+
+      ignoredInterfaces = mkOption {
+        description = ''
+          Network interfaces to be ignored when deciding if the system is online.
+        '';
+        type = with types; listOf str;
+        default = [];
+        example = [ "wg0" ];
+      };
+
+      timeout = mkOption {
+        description = ''
+          Time to wait for the network to come online, in seconds. Set to 0 to disable.
+        '';
+        type = types.ints.unsigned;
+        default = 120;
+        example = 0;
+      };
+
+      extraArgs = mkOption {
+        description = ''
+          Extra command-line arguments to pass to systemd-networkd-wait-online.
+          These also affect per-interface <literal>systemd-network-wait-online@</literal> services.
+
+          See <link xlink:href="https://www.freedesktop.org/software/systemd/man/systemd-networkd-wait-online.service.html">
+          <citerefentry><refentrytitle>systemd-networkd-wait-online.service</refentrytitle><manvolnum>8</manvolnum>
+          </citerefentry></link> for all available options.
+        '';
+        type = with types; listOf str;
+        default = [];
+      };
+    };
+
   };
 
   config = mkMerge [
@@ -1753,6 +1795,11 @@ in
     {
       systemd.network.units = mapAttrs' (n: v: nameValuePair "${n}.link" (linkToUnit n v)) cfg.links;
       environment.etc = unitFiles;
+
+      systemd.network.wait-online.extraArgs =
+        [ "--timeout=${toString cfg.wait-online.timeout}" ]
+        ++ optional cfg.wait-online.anyInterface "--any"
+        ++ map (i: "--ignore=${i}") cfg.wait-online.ignoredInterfaces;
     }
 
     (mkIf config.systemd.network.enable {
@@ -1781,6 +1828,10 @@ in
 
       systemd.services.systemd-networkd-wait-online = {
         wantedBy = [ "network-online.target" ];
+        serviceConfig.ExecStart = [
+          ""
+          "${config.systemd.package}/lib/systemd/systemd-networkd-wait-online ${utils.escapeSystemdExecArgs cfg.wait-online.extraArgs}"
+        ];
       };
 
       systemd.services."systemd-network-wait-online@" = {
@@ -1791,7 +1842,7 @@ in
         serviceConfig = {
           Type = "oneshot";
           RemainAfterExit = true;
-          ExecStart = "${config.systemd.package}/lib/systemd/systemd-networkd-wait-online -i %I";
+          ExecStart = "${config.systemd.package}/lib/systemd/systemd-networkd-wait-online -i %I ${utils.escapeSystemdExecArgs cfg.wait-online.extraArgs}";
         };
       };
 
diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index 297a80d4681ba..f69c5d3d5a641 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -612,22 +612,18 @@ in
 
     boot.kernelParams = optional (!cfg.enableUnifiedCgroupHierarchy) "systemd.unified_cgroup_hierarchy=0";
 
-    services.logrotate.paths = {
+    services.logrotate.settings = {
       "/var/log/btmp" = mapAttrs (_: mkDefault) {
         frequency = "monthly";
-        keep = 1;
-        extraConfig = ''
-          create 0660 root ${config.users.groups.utmp.name}
-          minsize 1M
-        '';
+        rotate = 1;
+        create = "0660 root ${config.users.groups.utmp.name}";
+        minsize = "1M";
       };
       "/var/log/wtmp" = mapAttrs (_: mkDefault) {
         frequency = "monthly";
-        keep = 1;
-        extraConfig = ''
-          create 0664 root ${config.users.groups.utmp.name}
-          minsize 1M
-        '';
+        rotate = 1;
+        create = "0664 root ${config.users.groups.utmp.name}";
+        minsize = "1M";
       };
     };
   };
diff --git a/nixos/modules/tasks/auto-upgrade.nix b/nixos/modules/tasks/auto-upgrade.nix
index 1404dcbaf7c0f..a5755d08d7de9 100644
--- a/nixos/modules/tasks/auto-upgrade.nix
+++ b/nixos/modules/tasks/auto-upgrade.nix
@@ -90,7 +90,7 @@ in {
         example = "45min";
         description = ''
           Add a randomized delay before each automatic upgrade.
-          The delay will be chozen between zero and this value.
+          The delay will be chosen between zero and this value.
           This value must be a time span in the format specified by
           <citerefentry><refentrytitle>systemd.time</refentrytitle>
           <manvolnum>7</manvolnum></citerefentry>
diff --git a/nixos/modules/virtualisation/azure-agent.nix b/nixos/modules/virtualisation/azure-agent.nix
index bd8c7f8c1eea3..e2425b44eac4a 100644
--- a/nixos/modules/virtualisation/azure-agent.nix
+++ b/nixos/modules/virtualisation/azure-agent.nix
@@ -146,15 +146,11 @@ in
 
     services.logrotate = {
       enable = true;
-      extraConfig = ''
-        /var/log/waagent.log {
-            compress
-            monthly
-            rotate 6
-            notifempty
-            missingok
-        }
-      '';
+      settings."/var/log/waagent.log" = {
+        compress = true;
+        frequency = "monthly";
+        rotate = 6;
+      };
     };
 
     systemd.targets.provisioned = {
diff --git a/nixos/modules/virtualisation/podman/default.nix b/nixos/modules/virtualisation/podman/default.nix
index 94fd727a4b564..b7e7f78ded78f 100644
--- a/nixos/modules/virtualisation/podman/default.nix
+++ b/nixos/modules/virtualisation/podman/default.nix
@@ -6,7 +6,10 @@ let
 
   inherit (lib) mkOption types;
 
-  podmanPackage = (pkgs.podman.override { inherit (cfg) extraPackages; });
+  podmanPackage = (pkgs.podman.override {
+    extraPackages = cfg.extraPackages
+      ++ lib.optional (builtins.elem "zfs" config.boot.supportedFilesystems) config.boot.zfs.package;
+  });
 
   # Provides a fake "docker" binary mapping to podman
   dockerCompat = pkgs.runCommand "${podmanPackage.pname}-docker-compat-${podmanPackage.version}" {
diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix
index dacbb64a2dacb..760f69121612b 100644
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@@ -961,7 +961,10 @@ in
 
     services.qemuGuest.enable = cfg.qemu.guestAgent.enable;
 
-    system.build.vm = pkgs.runCommand "nixos-vm" { preferLocalBuild = true; }
+    system.build.vm = pkgs.runCommand "nixos-vm" {
+      preferLocalBuild = true;
+      meta.mainProgram = "run-${config.system.name}-vm";
+    }
       ''
         mkdir -p $out/bin
         ln -s ${config.system.build.toplevel} $out/system
diff --git a/nixos/tests/aesmd.nix b/nixos/tests/aesmd.nix
index 59c04fe7e96a3..9f07426be8d8e 100644
--- a/nixos/tests/aesmd.nix
+++ b/nixos/tests/aesmd.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
     maintainers = with lib.maintainers; [ veehaitch ];
   };
 
-  machine = { lib, ... }: {
+  nodes.machine = { lib, ... }: {
     services.aesmd = {
       enable = true;
       settings = {
diff --git a/nixos/tests/agda.nix b/nixos/tests/agda.nix
index ec61af2afe754..6f51300111acf 100644
--- a/nixos/tests/agda.nix
+++ b/nixos/tests/agda.nix
@@ -15,7 +15,7 @@ in
     maintainers = [ alexarice turion ];
   };
 
-  machine = { pkgs, ... }: {
+  nodes.machine = { pkgs, ... }: {
     environment.systemPackages = [
       (pkgs.agda.withPackages {
         pkgs = p: [ p.standard-library ];
diff --git a/nixos/tests/airsonic.nix b/nixos/tests/airsonic.nix
index d8df092c2ecfa..2f60c56f643be 100644
--- a/nixos/tests/airsonic.nix
+++ b/nixos/tests/airsonic.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
     maintainers = [ sumnerevans ];
   };
 
-  machine =
+  nodes.machine =
     { pkgs, ... }:
     {
       services.airsonic = {
diff --git a/nixos/tests/amazon-init-shell.nix b/nixos/tests/amazon-init-shell.nix
index f9268b2f3a009..3c040841b6d29 100644
--- a/nixos/tests/amazon-init-shell.nix
+++ b/nixos/tests/amazon-init-shell.nix
@@ -18,7 +18,7 @@ makeTest {
   meta = with maintainers; {
     maintainers = [ urbas ];
   };
-  machine = { ... }:
+  nodes.machine = { ... }:
   {
     imports = [ ../modules/profiles/headless.nix ../modules/virtualisation/amazon-init.nix ];
     services.openssh.enable = true;
diff --git a/nixos/tests/apfs.nix b/nixos/tests/apfs.nix
index a82886cbe7317..a8841fe93046e 100644
--- a/nixos/tests/apfs.nix
+++ b/nixos/tests/apfs.nix
@@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
   name = "apfs";
   meta.maintainers = with pkgs.lib.maintainers; [ Luflosi ];
 
-  machine = { pkgs, ... }: {
+  nodes.machine = { pkgs, ... }: {
     virtualisation.emptyDiskImages = [ 1024 ];
 
     boot.supportedFilesystems = [ "apfs" ];
diff --git a/nixos/tests/apparmor.nix b/nixos/tests/apparmor.nix
index c6daa8e67de3f..f85bff0295e71 100644
--- a/nixos/tests/apparmor.nix
+++ b/nixos/tests/apparmor.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, ... } : {
     maintainers = [ julm ];
   };
 
-  machine =
+  nodes.machine =
     { lib, pkgs, config, ... }:
     with lib;
     {
diff --git a/nixos/tests/atd.nix b/nixos/tests/atd.nix
index ad4d60067cf1e..4342e9d7dc181 100644
--- a/nixos/tests/atd.nix
+++ b/nixos/tests/atd.nix
@@ -6,7 +6,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
     maintainers = [ bjornfor ];
   };
 
-  machine =
+  nodes.machine =
     { ... }:
     { services.atd.enable = true;
       users.users.alice = { isNormalUser = true; };
diff --git a/nixos/tests/atop.nix b/nixos/tests/atop.nix
index f7a90346f3d74..d9304834692c8 100644
--- a/nixos/tests/atop.nix
+++ b/nixos/tests/atop.nix
@@ -107,7 +107,7 @@ in
 {
   justThePackage = makeTest {
     name = "atop-justThePackage";
-    machine = {
+    nodes.machine = {
       environment.systemPackages = [ pkgs.atop ];
     };
     testScript = with assertions; builtins.concatStringsSep "\n" [
@@ -123,7 +123,7 @@ in
   };
   defaults = makeTest {
     name = "atop-defaults";
-    machine = {
+    nodes.machine = {
       programs.atop = {
         enable = true;
       };
@@ -141,7 +141,7 @@ in
   };
   minimal = makeTest {
     name = "atop-minimal";
-    machine = {
+    nodes.machine = {
       programs.atop = {
         enable = true;
         atopService.enable = false;
@@ -162,7 +162,7 @@ in
   };
   netatop = makeTest {
     name = "atop-netatop";
-    machine = {
+    nodes.machine = {
       programs.atop = {
         enable = true;
         netatop.enable = true;
@@ -181,7 +181,7 @@ in
   };
   atopgpu = makeTest {
     name = "atop-atopgpu";
-    machine = {
+    nodes.machine = {
       nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (getName pkg) [
         "cudatoolkit"
       ];
@@ -204,7 +204,7 @@ in
   };
   everything = makeTest {
     name = "atop-everthing";
-    machine = {
+    nodes.machine = {
       nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (getName pkg) [
         "cudatoolkit"
       ];
diff --git a/nixos/tests/bcachefs.nix b/nixos/tests/bcachefs.nix
index 44997a746879b..832cc9c38f012 100644
--- a/nixos/tests/bcachefs.nix
+++ b/nixos/tests/bcachefs.nix
@@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
   name = "bcachefs";
   meta.maintainers = with pkgs.lib.maintainers; [ chiiruno ];
 
-  machine = { pkgs, ... }: {
+  nodes.machine = { pkgs, ... }: {
     virtualisation.emptyDiskImages = [ 4096 ];
     networking.hostId = "deadbeef";
     boot.supportedFilesystems = [ "bcachefs" ];
diff --git a/nixos/tests/beanstalkd.nix b/nixos/tests/beanstalkd.nix
index 4f4a454fb47f9..518f018408ad8 100644
--- a/nixos/tests/beanstalkd.nix
+++ b/nixos/tests/beanstalkd.nix
@@ -28,7 +28,7 @@ in
   name = "beanstalkd";
   meta.maintainers = [ lib.maintainers.aanderse ];
 
-  machine =
+  nodes.machine =
     { ... }:
     { services.beanstalkd.enable = true;
     };
diff --git a/nixos/tests/bees.nix b/nixos/tests/bees.nix
index 58a9c29513567..3ab9f38ada8fe 100644
--- a/nixos/tests/bees.nix
+++ b/nixos/tests/bees.nix
@@ -2,7 +2,7 @@ import ./make-test-python.nix ({ lib, pkgs, ... }:
 {
   name = "bees";
 
-  machine = { config, pkgs, ... }: {
+  nodes.machine = { config, pkgs, ... }: {
     boot.initrd.postDeviceCommands = ''
       ${pkgs.btrfs-progs}/bin/mkfs.btrfs -f -L aux1 /dev/vdb
       ${pkgs.btrfs-progs}/bin/mkfs.btrfs -f -L aux2 /dev/vdc
diff --git a/nixos/tests/bind.nix b/nixos/tests/bind.nix
index 7234f56a1c3a8..15accbd49db43 100644
--- a/nixos/tests/bind.nix
+++ b/nixos/tests/bind.nix
@@ -1,7 +1,7 @@
 import ./make-test-python.nix {
   name = "bind";
 
-  machine = { pkgs, lib, ... }: {
+  nodes.machine = { pkgs, lib, ... }: {
     services.bind.enable = true;
     services.bind.extraOptions = "empty-zones-enable no;";
     services.bind.zones = lib.singleton {
diff --git a/nixos/tests/bitcoind.nix b/nixos/tests/bitcoind.nix
index 3e9e085287ac0..04655b7f6a51b 100644
--- a/nixos/tests/bitcoind.nix
+++ b/nixos/tests/bitcoind.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
     maintainers = with maintainers; [ _1000101 ];
   };
 
-  machine = { ... }: {
+  nodes.machine = { ... }: {
     services.bitcoind."mainnet" = {
       enable = true;
       rpc = {
diff --git a/nixos/tests/blockbook-frontend.nix b/nixos/tests/blockbook-frontend.nix
index e17a2d0577977..dca4f2f53cc10 100644
--- a/nixos/tests/blockbook-frontend.nix
+++ b/nixos/tests/blockbook-frontend.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
     maintainers = with maintainers; [ _1000101 ];
   };
 
-  machine = { ... }: {
+  nodes.machine = { ... }: {
     services.blockbook-frontend."test" = {
       enable = true;
     };
diff --git a/nixos/tests/boot-stage1.nix b/nixos/tests/boot-stage1.nix
index 756decd2039d6..fbe82d61afaea 100644
--- a/nixos/tests/boot-stage1.nix
+++ b/nixos/tests/boot-stage1.nix
@@ -1,7 +1,7 @@
 import ./make-test-python.nix ({ pkgs, ... }: {
   name = "boot-stage1";
 
-  machine = { config, pkgs, lib, ... }: {
+  nodes.machine = { config, pkgs, lib, ... }: {
     boot.extraModulePackages = let
       compileKernelModule = name: source: pkgs.runCommandCC name rec {
         inherit source;
diff --git a/nixos/tests/boot.nix b/nixos/tests/boot.nix
index ec2a9f6527c93..8e469a6549728 100644
--- a/nixos/tests/boot.nix
+++ b/nixos/tests/boot.nix
@@ -42,7 +42,7 @@ let
         nodes = { };
         testScript =
           ''
-            machine = create_machine(${machineConfig})
+            nodes.machine = create_machine(${machineConfig})
             machine.start()
             machine.wait_for_unit("multi-user.target")
             machine.succeed("nix store verify --no-trust -r --option experimental-features nix-command /run/current-system")
@@ -83,7 +83,7 @@ let
         name = "boot-netboot-" + name;
         nodes = { };
         testScript = ''
-            machine = create_machine(${machineConfig})
+            nodes.machine = create_machine(${machineConfig})
             machine.start()
             machine.wait_for_unit("multi-user.target")
             machine.shutdown()
@@ -138,7 +138,7 @@ in {
         if os.system("qemu-img create -f qcow2 -F raw -b ${sdImage} ${mutableImage}") != 0:
             raise RuntimeError("Could not create mutable linked image")
 
-        machine = create_machine(${machineConfig})
+        nodes.machine = create_machine(${machineConfig})
         machine.start()
         machine.wait_for_unit("multi-user.target")
         machine.succeed("nix store verify -r --no-trust --option experimental-features nix-command /run/current-system")
diff --git a/nixos/tests/bpf.nix b/nixos/tests/bpf.nix
index e479cd0579215..5868e3bfcb4cc 100644
--- a/nixos/tests/bpf.nix
+++ b/nixos/tests/bpf.nix
@@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
   name = "bpf";
   meta.maintainers = with pkgs.lib.maintainers; [ martinetd ];
 
-  machine = { pkgs, ... }: {
+  nodes.machine = { pkgs, ... }: {
     programs.bcc.enable = true;
     environment.systemPackages = with pkgs; [ bpftrace ];
   };
diff --git a/nixos/tests/breitbandmessung.nix b/nixos/tests/breitbandmessung.nix
index 12b1a094839be..78df0d5017eb0 100644
--- a/nixos/tests/breitbandmessung.nix
+++ b/nixos/tests/breitbandmessung.nix
@@ -2,7 +2,7 @@ import ./make-test-python.nix ({ lib, ... }: {
   name = "breitbandmessung";
   meta.maintainers = with lib.maintainers; [ b4dm4n ];
 
-  machine = { pkgs, ... }: {
+  nodes.machine = { pkgs, ... }: {
     imports = [
       ./common/user-account.nix
       ./common/x11.nix
diff --git a/nixos/tests/brscan5.nix b/nixos/tests/brscan5.nix
index 9aed742f6de79..9156a4cccfcfa 100644
--- a/nixos/tests/brscan5.nix
+++ b/nixos/tests/brscan5.nix
@@ -7,7 +7,7 @@ import ./make-test-python.nix ({ pkgs, ...} : {
     maintainers = [ mattchrist ];
   };
 
-  machine = { pkgs, ... }:
+  nodes.machine = { pkgs, ... }:
     {
       nixpkgs.config.allowUnfree = true;
       hardware.sane = {
diff --git a/nixos/tests/buildkite-agents.nix b/nixos/tests/buildkite-agents.nix
index 6674a0e884ed3..2c5593323e873 100644
--- a/nixos/tests/buildkite-agents.nix
+++ b/nixos/tests/buildkite-agents.nix
@@ -6,7 +6,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
     maintainers = [ flokli ];
   };
 
-  machine = { pkgs, ... }: {
+  nodes.machine = { pkgs, ... }: {
     services.buildkite-agents = {
       one = {
         privateSshKeyPath = (import ./ssh-keys.nix pkgs).snakeOilPrivateKey;
diff --git a/nixos/tests/cage.nix b/nixos/tests/cage.nix
index 83bae3deeeab2..39c8d0441b6d1 100644
--- a/nixos/tests/cage.nix
+++ b/nixos/tests/cage.nix
@@ -6,7 +6,7 @@ import ./make-test-python.nix ({ pkgs, ...} :
     maintainers = [ matthewbauer ];
   };
 
-  machine = { ... }:
+  nodes.machine = { ... }:
 
   {
     imports = [ ./common/user-account.nix ];
diff --git a/nixos/tests/cagebreak.nix b/nixos/tests/cagebreak.nix
index c6c2c632b61ac..1dcc910f97444 100644
--- a/nixos/tests/cagebreak.nix
+++ b/nixos/tests/cagebreak.nix
@@ -13,7 +13,7 @@ in
     maintainers = [ berbiche ];
   };
 
-  machine = { config, ... }:
+  nodes.machine = { config, ... }:
   let
     alice = config.users.users.alice;
   in {
diff --git a/nixos/tests/cfssl.nix b/nixos/tests/cfssl.nix
index 170f09d9b76cc..e673df3131f8e 100644
--- a/nixos/tests/cfssl.nix
+++ b/nixos/tests/cfssl.nix
@@ -1,7 +1,7 @@
 import ./make-test-python.nix ({ pkgs, ...} : {
   name = "cfssl";
 
-  machine = { config, lib, pkgs, ... }:
+  nodes.machine = { config, lib, pkgs, ... }:
   {
     networking.firewall.allowedTCPPorts = [ config.services.cfssl.port ];
 
diff --git a/nixos/tests/clickhouse.nix b/nixos/tests/clickhouse.nix
index 017f2ee35dab0..043263ec05dd9 100644
--- a/nixos/tests/clickhouse.nix
+++ b/nixos/tests/clickhouse.nix
@@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
   name = "clickhouse";
   meta.maintainers = with pkgs.lib.maintainers; [ ma27 ];
 
-  machine = {
+  nodes.machine = {
     services.clickhouse.enable = true;
     virtualisation.memorySize = 4096;
   };
diff --git a/nixos/tests/cloud-init.nix b/nixos/tests/cloud-init.nix
index 3f191ff5616e0..9feb8d5c1526e 100644
--- a/nixos/tests/cloud-init.nix
+++ b/nixos/tests/cloud-init.nix
@@ -61,7 +61,7 @@ in makeTest {
   meta = with pkgs.lib.maintainers; {
     maintainers = [ lewo ];
   };
-  machine = { ... }:
+  nodes.machine = { ... }:
   {
     virtualisation.qemu.options = [ "-cdrom" "${metadataDrive}/metadata.iso" ];
     services.cloud-init = {
diff --git a/nixos/tests/cntr.nix b/nixos/tests/cntr.nix
index e4e13545b8762..598143beb6c0f 100644
--- a/nixos/tests/cntr.nix
+++ b/nixos/tests/cntr.nix
@@ -46,7 +46,7 @@ let
 
     meta = with pkgs.lib.maintainers; { maintainers = [ sorki mic92 ]; };
 
-    machine = { lib, ... }: {
+    nodes.machine = { lib, ... }: {
       environment.systemPackages = [ pkgs.cntr ];
       containers.test = {
         autoStart = true;
diff --git a/nixos/tests/collectd.nix b/nixos/tests/collectd.nix
index cb196224a2317..8c9361087661f 100644
--- a/nixos/tests/collectd.nix
+++ b/nixos/tests/collectd.nix
@@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
   name = "collectd";
   meta = { };
 
-  machine =
+  nodes.machine =
     { pkgs, ... }:
 
     {
diff --git a/nixos/tests/containers-bridge.nix b/nixos/tests/containers-bridge.nix
index b8661fd7997c9..d2e16299edaad 100644
--- a/nixos/tests/containers-bridge.nix
+++ b/nixos/tests/containers-bridge.nix
@@ -11,7 +11,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
     maintainers = with lib.maintainers; [ aristid aszlig eelco kampfschlaefer ];
   };
 
-  machine =
+  nodes.machine =
     { pkgs, ... }:
     { imports = [ ../modules/installer/cd-dvd/channel.nix ];
       virtualisation.writableStore = true;
diff --git a/nixos/tests/containers-custom-pkgs.nix b/nixos/tests/containers-custom-pkgs.nix
index 1627a2c70c3ca..9894e6643762e 100644
--- a/nixos/tests/containers-custom-pkgs.nix
+++ b/nixos/tests/containers-custom-pkgs.nix
@@ -12,7 +12,7 @@ in {
     maintainers = with lib.maintainers; [ adisbladis earvstedt ];
   };
 
-  machine = { config, ... }: {
+  nodes.machine = { config, ... }: {
     assertions = let
       helloName = (builtins.head config.containers.test.config.system.extraDependencies).name;
     in [ {
diff --git a/nixos/tests/containers-ephemeral.nix b/nixos/tests/containers-ephemeral.nix
index db1631cf5b5d1..c9fe2778cacdf 100644
--- a/nixos/tests/containers-ephemeral.nix
+++ b/nixos/tests/containers-ephemeral.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
     maintainers = with lib.maintainers; [ patryk27 ];
   };
 
-  machine = { pkgs, ... }: {
+  nodes.machine = { pkgs, ... }: {
     virtualisation.writableStore = true;
 
     containers.webserver = {
diff --git a/nixos/tests/containers-extra_veth.nix b/nixos/tests/containers-extra_veth.nix
index b8f3d9844064c..f3e62265f6c4f 100644
--- a/nixos/tests/containers-extra_veth.nix
+++ b/nixos/tests/containers-extra_veth.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
     maintainers = with lib.maintainers; [ kampfschlaefer ];
   };
 
-  machine =
+  nodes.machine =
     { pkgs, ... }:
     { imports = [ ../modules/installer/cd-dvd/channel.nix ];
       virtualisation.writableStore = true;
diff --git a/nixos/tests/containers-hosts.nix b/nixos/tests/containers-hosts.nix
index 3c6a15710027a..7bce7c997efee 100644
--- a/nixos/tests/containers-hosts.nix
+++ b/nixos/tests/containers-hosts.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
     maintainers = with lib.maintainers; [ montag451 ];
   };
 
-  machine =
+  nodes.machine =
     { lib, ... }:
     {
       virtualisation.vlans = [];
diff --git a/nixos/tests/containers-imperative.nix b/nixos/tests/containers-imperative.nix
index 14001657bee0b..44d2e50288b4a 100644
--- a/nixos/tests/containers-imperative.nix
+++ b/nixos/tests/containers-imperative.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
     maintainers = with lib.maintainers; [ aristid aszlig eelco kampfschlaefer ];
   };
 
-  machine =
+  nodes.machine =
     { config, pkgs, lib, ... }:
     { imports = [ ../modules/installer/cd-dvd/channel.nix ];
 
diff --git a/nixos/tests/containers-ip.nix b/nixos/tests/containers-ip.nix
index 91fdda0392a9b..ecead5c22f756 100644
--- a/nixos/tests/containers-ip.nix
+++ b/nixos/tests/containers-ip.nix
@@ -17,7 +17,7 @@ in import ./make-test-python.nix ({ pkgs, lib, ... }: {
     maintainers = with lib.maintainers; [ aristid aszlig eelco kampfschlaefer ];
   };
 
-  machine =
+  nodes.machine =
     { pkgs, ... }: {
       imports = [ ../modules/installer/cd-dvd/channel.nix ];
       virtualisation = {
diff --git a/nixos/tests/containers-names.nix b/nixos/tests/containers-names.nix
index 9ad2bfb748a8d..721f64990724e 100644
--- a/nixos/tests/containers-names.nix
+++ b/nixos/tests/containers-names.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
     maintainers = with lib.maintainers; [ patryk27 ];
   };
 
-  machine = { ... }: {
+  nodes.machine = { ... }: {
     # We're using the newest kernel, so that we can test containers with long names.
     # Please see https://github.com/NixOS/nixpkgs/issues/38509 for details.
     boot.kernelPackages = pkgs.linuxPackages_latest;
diff --git a/nixos/tests/containers-nested.nix b/nixos/tests/containers-nested.nix
index a653361494f96..4a9fb8f01e241 100644
--- a/nixos/tests/containers-nested.nix
+++ b/nixos/tests/containers-nested.nix
@@ -5,7 +5,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
 
   meta = with pkgs.lib.maintainers; { maintainers = [ sorki ]; };
 
-  machine = { lib, ... }:
+  nodes.machine = { lib, ... }:
     let
       makeNested = subConf: {
         containers.nested = {
diff --git a/nixos/tests/containers-portforward.nix b/nixos/tests/containers-portforward.nix
index 6cecd72f1bda3..b8c7aabc5a50b 100644
--- a/nixos/tests/containers-portforward.nix
+++ b/nixos/tests/containers-portforward.nix
@@ -11,7 +11,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
     maintainers = with lib.maintainers; [ aristid aszlig eelco kampfschlaefer ianwookim ];
   };
 
-  machine =
+  nodes.machine =
     { pkgs, ... }:
     { imports = [ ../modules/installer/cd-dvd/channel.nix ];
       virtualisation.writableStore = true;
diff --git a/nixos/tests/containers-tmpfs.nix b/nixos/tests/containers-tmpfs.nix
index d95178d1ff588..7a2c835b120aa 100644
--- a/nixos/tests/containers-tmpfs.nix
+++ b/nixos/tests/containers-tmpfs.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
     maintainers = with lib.maintainers; [ patryk27 ];
   };
 
-  machine =
+  nodes.machine =
     { pkgs, ... }:
     { imports = [ ../modules/installer/cd-dvd/channel.nix ];
       virtualisation.writableStore = true;
diff --git a/nixos/tests/custom-ca.nix b/nixos/tests/custom-ca.nix
index a55449a397a7c..60c6c82223a93 100644
--- a/nixos/tests/custom-ca.nix
+++ b/nixos/tests/custom-ca.nix
@@ -76,7 +76,7 @@ in
 
   enableOCR = true;
 
-  machine = { pkgs, ... }:
+  nodes.machine = { pkgs, ... }:
     { imports = [ ./common/user-account.nix ./common/x11.nix ];
 
       # chromium-based browsers refuse to run as root
diff --git a/nixos/tests/disable-installer-tools.nix b/nixos/tests/disable-installer-tools.nix
index 23c15faa8d334..69f99122753a8 100644
--- a/nixos/tests/disable-installer-tools.nix
+++ b/nixos/tests/disable-installer-tools.nix
@@ -3,7 +3,7 @@ import ./make-test-python.nix ({ pkgs, latestKernel ? false, ... }:
 {
   name = "disable-installer-tools";
 
-  machine =
+  nodes.machine =
     { pkgs, lib, ... }:
     {
         system.disableInstallerTools = true;
diff --git a/nixos/tests/dnsdist.nix b/nixos/tests/dnsdist.nix
index cfc41c13864e0..e72fa05ff282b 100644
--- a/nixos/tests/dnsdist.nix
+++ b/nixos/tests/dnsdist.nix
@@ -5,7 +5,7 @@ import ./make-test-python.nix (
       maintainers = with maintainers; [ jojosch ];
     };
 
-    machine = { pkgs, lib, ... }: {
+    nodes.machine = { pkgs, lib, ... }: {
       services.bind = {
         enable = true;
         extraOptions = "empty-zones-enable no;";
diff --git a/nixos/tests/doas.nix b/nixos/tests/doas.nix
index 7f038b2bee296..3713c728195ce 100644
--- a/nixos/tests/doas.nix
+++ b/nixos/tests/doas.nix
@@ -6,7 +6,7 @@ import ./make-test-python.nix (
       maintainers = [ cole-h ];
     };
 
-    machine =
+    nodes.machine =
       { ... }:
         {
           users.groups = { foobar = {}; barfoo = {}; baz = { gid = 1337; }; };
diff --git a/nixos/tests/documize.nix b/nixos/tests/documize.nix
index d5a77ffcd4f26..528bf5338ce0d 100644
--- a/nixos/tests/documize.nix
+++ b/nixos/tests/documize.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
     maintainers = [ ma27 ];
   };
 
-  machine = { pkgs, ... }: {
+  nodes.machine = { pkgs, ... }: {
     environment.systemPackages = [ pkgs.jq ];
 
     services.documize = {
diff --git a/nixos/tests/domination.nix b/nixos/tests/domination.nix
index c76d4ed8c61b3..09027740ab8de 100644
--- a/nixos/tests/domination.nix
+++ b/nixos/tests/domination.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
     maintainers = [ fgaz ];
   };
 
-  machine = { config, pkgs, ... }: {
+  nodes.machine = { config, pkgs, ... }: {
     imports = [
       ./common/x11.nix
     ];
diff --git a/nixos/tests/dovecot.nix b/nixos/tests/dovecot.nix
index 8913c2a6a7e82..5439387807fd7 100644
--- a/nixos/tests/dovecot.nix
+++ b/nixos/tests/dovecot.nix
@@ -1,7 +1,7 @@
 import ./make-test-python.nix {
   name = "dovecot";
 
-  machine = { pkgs, ... }: {
+  nodes.machine = { pkgs, ... }: {
     imports = [ common/user-account.nix ];
     services.postfix.enable = true;
     services.dovecot2 = {
diff --git a/nixos/tests/ecryptfs.nix b/nixos/tests/ecryptfs.nix
index ef7bd13eb92c4..e3cfb2ed998c2 100644
--- a/nixos/tests/ecryptfs.nix
+++ b/nixos/tests/ecryptfs.nix
@@ -2,7 +2,7 @@ import ./make-test-python.nix ({ ... }:
 {
   name = "ecryptfs";
 
-  machine = { pkgs, ... }: {
+  nodes.machine = { pkgs, ... }: {
     imports = [ ./common/user-account.nix ];
     boot.kernelModules = [ "ecryptfs" ];
     security.pam.enableEcryptfs = true;
diff --git a/nixos/tests/emacs-daemon.nix b/nixos/tests/emacs-daemon.nix
index e12da56021dab..d53031a67f62c 100644
--- a/nixos/tests/emacs-daemon.nix
+++ b/nixos/tests/emacs-daemon.nix
@@ -6,7 +6,7 @@ import ./make-test-python.nix ({ pkgs, ...} : {
 
   enableOCR = true;
 
-  machine =
+  nodes.machine =
     { ... }:
 
     { imports = [ ./common/x11.nix ];
diff --git a/nixos/tests/enlightenment.nix b/nixos/tests/enlightenment.nix
index 8506c348246de..2e06eedd9915b 100644
--- a/nixos/tests/enlightenment.nix
+++ b/nixos/tests/enlightenment.nix
@@ -6,7 +6,7 @@ import ./make-test-python.nix ({ pkgs, ...} :
     maintainers = [ romildo ];
   };
 
-  machine = { ... }:
+  nodes.machine = { ... }:
   {
     imports = [ ./common/user-account.nix ];
     services.xserver.enable = true;
diff --git a/nixos/tests/env.nix b/nixos/tests/env.nix
index fc96ace6b2d2a..dec17b6b565a0 100644
--- a/nixos/tests/env.nix
+++ b/nixos/tests/env.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, ...} : {
     maintainers = [ nequissimus ];
   };
 
-  machine = { pkgs, ... }:
+  nodes.machine = { pkgs, ... }:
     {
       boot.kernelPackages = pkgs.linuxPackages;
       environment.etc.plainFile.text = ''
diff --git a/nixos/tests/etebase-server.nix b/nixos/tests/etebase-server.nix
index 4fc3c1f6392f8..49bfccf359e2a 100644
--- a/nixos/tests/etebase-server.nix
+++ b/nixos/tests/etebase-server.nix
@@ -9,7 +9,7 @@ in {
       maintainers = [ felschr ];
     };
 
-    machine = { pkgs, ... }:
+    nodes.machine = { pkgs, ... }:
       {
         services.etebase-server = {
           inherit dataDir;
diff --git a/nixos/tests/etesync-dav.nix b/nixos/tests/etesync-dav.nix
index 6a747e23f76f6..f49152c60991f 100644
--- a/nixos/tests/etesync-dav.nix
+++ b/nixos/tests/etesync-dav.nix
@@ -5,7 +5,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
     maintainers = [ _3699n ];
   };
 
-  machine = { config, pkgs, ... }: {
+  nodes.machine = { config, pkgs, ... }: {
       environment.systemPackages = [ pkgs.curl pkgs.etesync-dav ];
   };
 
diff --git a/nixos/tests/fancontrol.nix b/nixos/tests/fancontrol.nix
index 296c680264150..ecb9360974463 100644
--- a/nixos/tests/fancontrol.nix
+++ b/nixos/tests/fancontrol.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, ... } : {
     maintainers = [ evils ];
   };
 
-  machine = { ... }: {
+  nodes.machine = { ... }: {
     imports = [ ../modules/profiles/minimal.nix ];
     hardware.fancontrol.enable = true;
     hardware.fancontrol.config = ''
diff --git a/nixos/tests/fcitx/default.nix b/nixos/tests/fcitx/default.nix
index a243be8dc19b1..78b322d351d3b 100644
--- a/nixos/tests/fcitx/default.nix
+++ b/nixos/tests/fcitx/default.nix
@@ -5,7 +5,7 @@ import ../make-test-python.nix (
     # copy_from_host works only for store paths
     rec {
         name = "fcitx";
-        machine =
+        nodes.machine =
         {
           pkgs,
           ...
diff --git a/nixos/tests/firefox.nix b/nixos/tests/firefox.nix
index 6101fc9735641..c773368a3e60a 100644
--- a/nixos/tests/firefox.nix
+++ b/nixos/tests/firefox.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, firefoxPackage, ... }: {
     maintainers = [ eelco shlevy ];
   };
 
-  machine =
+  nodes.machine =
     { pkgs, ... }:
 
     { imports = [ ./common/x11.nix ];
diff --git a/nixos/tests/fish.nix b/nixos/tests/fish.nix
index 68fba428439b6..3d9b13c6af70a 100644
--- a/nixos/tests/fish.nix
+++ b/nixos/tests/fish.nix
@@ -1,7 +1,7 @@
 import ./make-test-python.nix ({ pkgs, ... }: {
   name = "fish";
 
-  machine =
+  nodes.machine =
     { pkgs, ... }:
 
     {
diff --git a/nixos/tests/fluentd.nix b/nixos/tests/fluentd.nix
index 918f2f87db17f..150638f246f26 100644
--- a/nixos/tests/fluentd.nix
+++ b/nixos/tests/fluentd.nix
@@ -1,7 +1,7 @@
 import ./make-test-python.nix ({ pkgs, lib, ... }: {
   name = "fluentd";
 
-  machine = { pkgs, ... }: {
+  nodes.machine = { pkgs, ... }: {
     services.fluentd = {
       enable = true;
       config = ''
diff --git a/nixos/tests/fontconfig-default-fonts.nix b/nixos/tests/fontconfig-default-fonts.nix
index 58d0f6227cc7b..664afc9bf44c4 100644
--- a/nixos/tests/fontconfig-default-fonts.nix
+++ b/nixos/tests/fontconfig-default-fonts.nix
@@ -6,7 +6,7 @@ import ./make-test-python.nix ({ lib, ... }:
     jtojnar
   ];
 
-  machine = { config, pkgs, ... }: {
+  nodes.machine = { config, pkgs, ... }: {
     fonts.enableDefaultFonts = true; # Background fonts
     fonts.fonts = with pkgs; [
       noto-fonts-emoji
diff --git a/nixos/tests/fsck.nix b/nixos/tests/fsck.nix
index 5453f3bc48b59..5b8b09f433a22 100644
--- a/nixos/tests/fsck.nix
+++ b/nixos/tests/fsck.nix
@@ -1,7 +1,7 @@
 import ./make-test-python.nix {
   name = "fsck";
 
-  machine = { lib, ... }: {
+  nodes.machine = { lib, ... }: {
     virtualisation.emptyDiskImages = [ 1 ];
 
     virtualisation.fileSystems = {
diff --git a/nixos/tests/ft2-clone.nix b/nixos/tests/ft2-clone.nix
index 71eda43e2b245..3c90b3d3fa201 100644
--- a/nixos/tests/ft2-clone.nix
+++ b/nixos/tests/ft2-clone.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
     maintainers = [ fgaz ];
   };
 
-  machine = { config, pkgs, ... }: {
+  nodes.machine = { config, pkgs, ... }: {
     imports = [
       ./common/x11.nix
     ];
diff --git a/nixos/tests/geth.nix b/nixos/tests/geth.nix
index af8230553bbbb..11ad1ed2ea66f 100644
--- a/nixos/tests/geth.nix
+++ b/nixos/tests/geth.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
     maintainers = with maintainers; [bachp ];
   };
 
-  machine = { ... }: {
+  nodes.machine = { ... }: {
     services.geth."mainnet" = {
       enable = true;
       http = {
diff --git a/nixos/tests/gitlab.nix b/nixos/tests/gitlab.nix
index dc3b889c8e8e2..e1916ed36f315 100644
--- a/nixos/tests/gitlab.nix
+++ b/nixos/tests/gitlab.nix
@@ -6,7 +6,7 @@ in
 import ./make-test-python.nix ({ pkgs, lib, ...} : with lib; {
   name = "gitlab";
   meta = with pkgs.lib.maintainers; {
-    maintainers = [ globin ];
+    maintainers = [ globin yayayayaka ];
   };
 
   nodes = {
@@ -112,21 +112,27 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : with lib; {
             "${pkgs.sudo}/bin/sudo -u gitlab -H gitlab-rake gitlab:check 1>&2"
         )
         gitlab.succeed(
-            "echo \"Authorization: Bearer \$(curl -X POST -H 'Content-Type: application/json' -d @${auth} http://gitlab/oauth/token | ${pkgs.jq}/bin/jq -r '.access_token')\" >/tmp/headers"
+            "echo \"Authorization: Bearer $(curl -X POST -H 'Content-Type: application/json' -d @${auth} http://gitlab/oauth/token | ${pkgs.jq}/bin/jq -r '.access_token')\" >/tmp/headers"
         )
       '' + optionalString doSetup ''
         gitlab.succeed(
-            "curl -X POST -H 'Content-Type: application/json' -H @/tmp/headers -d @${createProject} http://gitlab/api/v4/projects"
+            """[ "$(curl -o /dev/null -w '%{http_code}' -X POST -H 'Content-Type: application/json' -H @/tmp/headers -d @${createProject} http://gitlab/api/v4/projects)" = "201" ]"""
         )
         gitlab.succeed(
-            "curl -X POST -H 'Content-Type: application/json' -H @/tmp/headers -d @${putFile} http://gitlab/api/v4/projects/1/repository/files/some-file.txt"
+            """[ "$(curl -o /dev/null -w '%{http_code}' -X POST -H 'Content-Type: application/json' -H @/tmp/headers -d @${putFile} http://gitlab/api/v4/projects/2/repository/files/some-file.txt)" = "201" ]"""
         )
       '' + ''
         gitlab.succeed(
-            "curl -H @/tmp/headers http://gitlab/api/v4/projects/1/repository/archive.tar.gz > /tmp/archive.tar.gz"
+            """[ "$(curl -o /dev/null -w '%{http_code}' -H @/tmp/headers http://gitlab/api/v4/projects/2/repository/archive.tar.gz)" = "200" ]"""
         )
         gitlab.succeed(
-            "curl -H @/tmp/headers http://gitlab/api/v4/projects/1/repository/archive.tar.bz2 > /tmp/archive.tar.bz2"
+            """curl -H @/tmp/headers http://gitlab/api/v4/projects/2/repository/archive.tar.gz > /tmp/archive.tar.gz"""
+        )
+        gitlab.succeed(
+            """[ "$(curl -o /dev/null -w '%{http_code}' -H @/tmp/headers http://gitlab/api/v4/projects/2/repository/archive.tar.bz2)" = "200" ]"""
+        )
+        gitlab.succeed(
+            """curl -o /dev/null -w '%{http_code}' -H @/tmp/headers http://gitlab/api/v4/projects/2/repository/archive.tar.bz2 > /tmp/archive.tar.bz2"""
         )
         gitlab.succeed("test -s /tmp/archive.tar.gz")
         gitlab.succeed("test -s /tmp/archive.tar.bz2")
diff --git a/nixos/tests/gnome-xorg.nix b/nixos/tests/gnome-xorg.nix
index d7be531e364ec..618458b1f6b5b 100644
--- a/nixos/tests/gnome-xorg.nix
+++ b/nixos/tests/gnome-xorg.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
     maintainers = teams.gnome.members;
   };
 
-  machine = { nodes, ... }: let
+  nodes.machine = { nodes, ... }: let
     user = nodes.machine.config.users.users.alice;
   in
 
diff --git a/nixos/tests/gnome.nix b/nixos/tests/gnome.nix
index ca49183fe442c..05619cbd7d82a 100644
--- a/nixos/tests/gnome.nix
+++ b/nixos/tests/gnome.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
     maintainers = teams.gnome.members;
   };
 
-  machine =
+  nodes.machine =
     { ... }:
 
     { imports = [ ./common/user-account.nix ];
diff --git a/nixos/tests/gotify-server.nix b/nixos/tests/gotify-server.nix
index 051666fbe72e7..e7942b76d8e50 100644
--- a/nixos/tests/gotify-server.nix
+++ b/nixos/tests/gotify-server.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
     maintainers = [ ma27 ];
   };
 
-  machine = { pkgs, ... }: {
+  nodes.machine = { pkgs, ... }: {
     environment.systemPackages = [ pkgs.jq ];
 
     services.gotify = {
diff --git a/nixos/tests/graylog.nix b/nixos/tests/graylog.nix
index 572904f60d575..23f426fc7af95 100644
--- a/nixos/tests/graylog.nix
+++ b/nixos/tests/graylog.nix
@@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
   name = "graylog";
   meta.maintainers = with lib.maintainers; [ ];
 
-  machine = { pkgs, ... }: {
+  nodes.machine = { pkgs, ... }: {
     virtualisation.memorySize = 4096;
     virtualisation.diskSize = 4096;
 
diff --git a/nixos/tests/grocy.nix b/nixos/tests/grocy.nix
index 2be5c24ecb55c..fe0ddd341486b 100644
--- a/nixos/tests/grocy.nix
+++ b/nixos/tests/grocy.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
     maintainers = [ ma27 ];
   };
 
-  machine = { pkgs, ... }: {
+  nodes.machine = { pkgs, ... }: {
     services.grocy = {
       enable = true;
       hostName = "localhost";
diff --git a/nixos/tests/grub.nix b/nixos/tests/grub.nix
index 84bfc90955b54..e0875e70f6a51 100644
--- a/nixos/tests/grub.nix
+++ b/nixos/tests/grub.nix
@@ -5,7 +5,7 @@ import ./make-test-python.nix ({ lib, ... }: {
     maintainers = [ rnhmjoj ];
   };
 
-  machine = { ... }: {
+  nodes.machine = { ... }: {
     virtualisation.useBootLoader = true;
 
     boot.loader.timeout = null;
diff --git a/nixos/tests/hardened.nix b/nixos/tests/hardened.nix
index dc455f971f5c1..3afa8ebf2b5f7 100644
--- a/nixos/tests/hardened.nix
+++ b/nixos/tests/hardened.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, ... } : {
     maintainers = [ joachifm ];
   };
 
-  machine =
+  nodes.machine =
     { lib, pkgs, config, ... }:
     with lib;
     { users.users.alice = { isNormalUser = true; extraGroups = [ "proc" ]; };
diff --git a/nixos/tests/herbstluftwm.nix b/nixos/tests/herbstluftwm.nix
index 7d079f4bfb695..b6965914360e7 100644
--- a/nixos/tests/herbstluftwm.nix
+++ b/nixos/tests/herbstluftwm.nix
@@ -5,7 +5,7 @@ import ./make-test-python.nix ({ lib, ...} : {
     maintainers = with lib.maintainers; [ thibautmarty ];
   };
 
-  machine = { pkgs, lib, ... }: {
+  nodes.machine = { pkgs, lib, ... }: {
     imports = [ ./common/x11.nix ./common/user-account.nix ];
     test-support.displayManager.auto.user = "alice";
     services.xserver.displayManager.defaultSession = lib.mkForce "none+herbstluftwm";
diff --git a/nixos/tests/hibernate.nix b/nixos/tests/hibernate.nix
index 3880f1649bd3d..ae3f9a80eb33b 100644
--- a/nixos/tests/hibernate.nix
+++ b/nixos/tests/hibernate.nix
@@ -39,7 +39,7 @@ in makeTest {
 
   nodes = {
     # System configuration used for installing the installedConfig from above.
-    machine = { config, lib, pkgs, ... }: with lib; {
+    nodes.machine = { config, lib, pkgs, ... }: with lib; {
       imports = [
         ../modules/profiles/installation-device.nix
         ../modules/profiles/base.nix
diff --git a/nixos/tests/hitch/default.nix b/nixos/tests/hitch/default.nix
index a1d8e6162606d..4283b9f7dffbe 100644
--- a/nixos/tests/hitch/default.nix
+++ b/nixos/tests/hitch/default.nix
@@ -4,7 +4,7 @@ import ../make-test-python.nix ({ pkgs, ... }:
   meta = with pkgs.lib.maintainers; {
     maintainers = [ jflanglois ];
   };
-  machine = { pkgs, ... }: {
+  nodes.machine = { pkgs, ... }: {
     environment.systemPackages = [ pkgs.curl ];
     services.hitch = {
       enable = true;
diff --git a/nixos/tests/hocker-fetchdocker/default.nix b/nixos/tests/hocker-fetchdocker/default.nix
index e3979db3c60b5..b5c06126c2e80 100644
--- a/nixos/tests/hocker-fetchdocker/default.nix
+++ b/nixos/tests/hocker-fetchdocker/default.nix
@@ -5,7 +5,7 @@ import ../make-test-python.nix ({ pkgs, ...} : {
     broken = true; # tries to download from registry-1.docker.io - how did this ever work?
   };
 
-  machine = import ./machine.nix;
+  nodes.machine = import ./machine.nix;
 
   testScript = ''
     start_all()
diff --git a/nixos/tests/hockeypuck.nix b/nixos/tests/hockeypuck.nix
index 19df9dee3d315..d1ef4cbf588a8 100644
--- a/nixos/tests/hockeypuck.nix
+++ b/nixos/tests/hockeypuck.nix
@@ -24,7 +24,7 @@ in {
   name = "hockeypuck";
   meta.maintainers = with lib.maintainers; [ etu ];
 
-  machine = { ... }: {
+  nodes.machine = { ... }: {
     # Used for test
     environment.systemPackages = [ pkgs.gnupg ];
 
diff --git a/nixos/tests/hostname.nix b/nixos/tests/hostname.nix
index 2e92b4259a6ab..1de8f19267af8 100644
--- a/nixos/tests/hostname.nix
+++ b/nixos/tests/hostname.nix
@@ -20,7 +20,7 @@ let
           maintainers = [ primeos blitz ];
         };
 
-        machine = { lib, ... }: {
+        nodes.machine = { lib, ... }: {
           networking.hostName = hostName;
           networking.domain = domain;
 
diff --git a/nixos/tests/hound.nix b/nixos/tests/hound.nix
index 4f51db1de9dec..a9b036deb0dda 100644
--- a/nixos/tests/hound.nix
+++ b/nixos/tests/hound.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, ... } : {
   meta = with pkgs.lib.maintainers; {
     maintainers = [ grahamc ];
   };
-  machine = { pkgs, ... }: {
+  nodes.machine = { pkgs, ... }: {
     services.hound = {
       enable = true;
       config = ''
diff --git a/nixos/tests/hydra/default.nix b/nixos/tests/hydra/default.nix
index ef5e677953dcd..9fc787842d854 100644
--- a/nixos/tests/hydra/default.nix
+++ b/nixos/tests/hydra/default.nix
@@ -20,7 +20,7 @@ let
       maintainers = [ lewo ma27 ];
     };
 
-    machine = { pkgs, lib, ... }: {
+    nodes.machine = { pkgs, lib, ... }: {
       imports = [ baseConfig ];
       services.hydra = { inherit package; };
     };
diff --git a/nixos/tests/i3wm.nix b/nixos/tests/i3wm.nix
index 59b4ffe3986e2..b216650d8192b 100644
--- a/nixos/tests/i3wm.nix
+++ b/nixos/tests/i3wm.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, ...} : {
     maintainers = [ aszlig ];
   };
 
-  machine = { lib, ... }: {
+  nodes.machine = { lib, ... }: {
     imports = [ ./common/x11.nix ./common/user-account.nix ];
     test-support.displayManager.auto.user = "alice";
     services.xserver.displayManager.defaultSession = lib.mkForce "none+i3";
diff --git a/nixos/tests/ihatemoney/default.nix b/nixos/tests/ihatemoney/default.nix
index 78278d2e86996..cd5f073343daa 100644
--- a/nixos/tests/ihatemoney/default.nix
+++ b/nixos/tests/ihatemoney/default.nix
@@ -7,7 +7,7 @@ let
   inherit (import ../../lib/testing-python.nix { inherit system pkgs; }) makeTest;
   f = backend: makeTest {
     name = "ihatemoney-${backend}";
-    machine = { nodes, lib, ... }: {
+    nodes.machine = { nodes, lib, ... }: {
       services.ihatemoney = {
         enable = true;
         enablePublicProjectCreation = true;
diff --git a/nixos/tests/incron.nix b/nixos/tests/incron.nix
index b22ee4c9a037a..c978ff27dfad5 100644
--- a/nixos/tests/incron.nix
+++ b/nixos/tests/incron.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
   name = "incron";
   meta.maintainers = [ lib.maintainers.aanderse ];
 
-  machine =
+  nodes.machine =
     { ... }:
     { services.incron.enable = true;
       services.incron.extraPackages = [ pkgs.coreutils ];
diff --git a/nixos/tests/initrd-network.nix b/nixos/tests/initrd-network.nix
index 14e7e7d40bc59..f2483b7393de4 100644
--- a/nixos/tests/initrd-network.nix
+++ b/nixos/tests/initrd-network.nix
@@ -3,7 +3,7 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
 
   meta.maintainers = [ pkgs.lib.maintainers.eelco ];
 
-  machine = { ... }: {
+  nodes.machine = { ... }: {
     imports = [ ../modules/profiles/minimal.nix ];
     boot.initrd.network.enable = true;
     boot.initrd.network.postCommands =
diff --git a/nixos/tests/initrd-secrets.nix b/nixos/tests/initrd-secrets.nix
index 113a9cebf7880..0f3f83b0904e3 100644
--- a/nixos/tests/initrd-secrets.nix
+++ b/nixos/tests/initrd-secrets.nix
@@ -11,7 +11,7 @@ let
 
     meta.maintainers = [ lib.maintainers.lheckemann ];
 
-    machine = { ... }: {
+    nodes.machine = { ... }: {
       virtualisation.useBootLoader = true;
       boot.initrd.secrets = {
         "/test" = secretInStore;
diff --git a/nixos/tests/input-remapper.nix b/nixos/tests/input-remapper.nix
index f692564caa577..1b0350063f7f2 100644
--- a/nixos/tests/input-remapper.nix
+++ b/nixos/tests/input-remapper.nix
@@ -6,7 +6,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
       maintainers = with pkgs.lib.maintainers; [ LunNova ];
     };
 
-    machine = { config, ... }:
+    nodes.machine = { config, ... }:
       let user = config.users.users.sybil; in
       {
         imports = [
diff --git a/nixos/tests/installed-tests/default.nix b/nixos/tests/installed-tests/default.nix
index 079fd54e71e57..fd16b481168f4 100644
--- a/nixos/tests/installed-tests/default.nix
+++ b/nixos/tests/installed-tests/default.nix
@@ -43,7 +43,7 @@ let
             maintainers = tested.meta.maintainers;
           };
 
-          machine = { ... }: {
+          nodes.machine = { ... }: {
             imports = [
               testConfig
             ] ++ optional withX11 ../common/x11.nix;
diff --git a/nixos/tests/invidious.nix b/nixos/tests/invidious.nix
index 8b831715a441f..582d1550fff1a 100644
--- a/nixos/tests/invidious.nix
+++ b/nixos/tests/invidious.nix
@@ -5,7 +5,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
     maintainers = [ sbruder ];
   };
 
-  machine = { config, lib, pkgs, ... }: {
+  nodes.machine = { config, lib, pkgs, ... }: {
     services.invidious = {
       enable = true;
     };
diff --git a/nixos/tests/isso.nix b/nixos/tests/isso.nix
index 99dc8009ae064..65bae5f5dcede 100644
--- a/nixos/tests/isso.nix
+++ b/nixos/tests/isso.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
     maintainers = [ asbachb ];
   };
 
-  machine = { config, pkgs, ... }: {
+  nodes.machine = { config, pkgs, ... }: {
     services.isso = {
       enable = true;
       settings = {
diff --git a/nixos/tests/jellyfin.nix b/nixos/tests/jellyfin.nix
index cae31a7192582..4ac3786996378 100644
--- a/nixos/tests/jellyfin.nix
+++ b/nixos/tests/jellyfin.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ lib, pkgs, ... }:
     name = "jellyfin";
     meta.maintainers = with lib.maintainers; [ minijackson ];
 
-    machine =
+    nodes.machine =
       { ... }:
       {
         services.jellyfin.enable = true;
diff --git a/nixos/tests/jenkins.nix b/nixos/tests/jenkins.nix
index cb4207c6e7738..265d1a330cd94 100644
--- a/nixos/tests/jenkins.nix
+++ b/nixos/tests/jenkins.nix
@@ -90,6 +90,8 @@ import ./make-test-python.nix ({ pkgs, ...} : {
 
     slave.fail("systemctl is-enabled jenkins.service")
 
+    slave.succeed("java -fullversion")
+
     with subtest("jobs are declarative"):
         # Check that jobs are created on disk.
         master.wait_for_unit("jenkins-job-builder")
diff --git a/nixos/tests/jibri.nix b/nixos/tests/jibri.nix
index af20e639d30ef..223120cdb2291 100644
--- a/nixos/tests/jibri.nix
+++ b/nixos/tests/jibri.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
     maintainers = teams.jitsi.members;
   };
 
-    machine = { config, pkgs, ... }: {
+    nodes.machine = { config, pkgs, ... }: {
       virtualisation.memorySize = 5120;
 
       services.jitsi-meet = {
diff --git a/nixos/tests/k3s-single-node-docker.nix b/nixos/tests/k3s-single-node-docker.nix
index 7f3d15788b043..735aa5ac2975d 100644
--- a/nixos/tests/k3s-single-node-docker.nix
+++ b/nixos/tests/k3s-single-node-docker.nix
@@ -38,7 +38,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
       maintainers = [ euank ];
     };
 
-    machine = { pkgs, ... }: {
+    nodes.machine = { pkgs, ... }: {
       environment.systemPackages = with pkgs; [ k3s gzip ];
 
       # k3s uses enough resources the default vm fails.
diff --git a/nixos/tests/k3s-single-node.nix b/nixos/tests/k3s-single-node.nix
index d98f20d468cbc..fb6510ee087bc 100644
--- a/nixos/tests/k3s-single-node.nix
+++ b/nixos/tests/k3s-single-node.nix
@@ -38,7 +38,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
       maintainers = [ euank ];
     };
 
-    machine = { pkgs, ... }: {
+    nodes.machine = { pkgs, ... }: {
       environment.systemPackages = with pkgs; [ k3s gzip ];
 
       # k3s uses enough resources the default vm fails.
diff --git a/nixos/tests/kbd-setfont-decompress.nix b/nixos/tests/kbd-setfont-decompress.nix
index c3a495afac840..810ef39cc11a3 100644
--- a/nixos/tests/kbd-setfont-decompress.nix
+++ b/nixos/tests/kbd-setfont-decompress.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ lib, pkgs, ... }:
 
   meta.maintainers = with lib.maintainers; [ oxalica ];
 
-  machine = { ... }: {};
+  nodes.machine = { ... }: {};
 
   testScript = ''
     machine.succeed("gzip -cd ${pkgs.terminus_font}/share/consolefonts/ter-v16b.psf.gz >font.psf")
diff --git a/nixos/tests/kbd-update-search-paths-patch.nix b/nixos/tests/kbd-update-search-paths-patch.nix
index 2cdb12340b1bc..746a809c4cdf7 100644
--- a/nixos/tests/kbd-update-search-paths-patch.nix
+++ b/nixos/tests/kbd-update-search-paths-patch.nix
@@ -1,7 +1,7 @@
 import ./make-test-python.nix ({ pkgs, ... }: {
   name = "kbd-update-search-paths-patch";
 
-  machine = { pkgs, options, ... }: {
+  nodes.machine = { pkgs, options, ... }: {
     console = {
       packages = options.console.packages.default ++ [ pkgs.terminus_font ];
     };
diff --git a/nixos/tests/keepassxc.nix b/nixos/tests/keepassxc.nix
index 924c137a9032d..d0f353c71e0ba 100644
--- a/nixos/tests/keepassxc.nix
+++ b/nixos/tests/keepassxc.nix
@@ -6,7 +6,7 @@ import ./make-test-python.nix ({ pkgs, ...} :
     maintainers = [ turion ];
   };
 
-  machine = { ... }:
+  nodes.machine = { ... }:
 
   {
     imports = [
diff --git a/nixos/tests/kerberos/heimdal.nix b/nixos/tests/kerberos/heimdal.nix
index 391a61cc9a90b..47f9d0285aef7 100644
--- a/nixos/tests/kerberos/heimdal.nix
+++ b/nixos/tests/kerberos/heimdal.nix
@@ -1,6 +1,6 @@
 import ../make-test-python.nix ({pkgs, ...}: {
   name = "kerberos_server-heimdal";
-  machine = { config, libs, pkgs, ...}:
+  nodes.machine = { config, libs, pkgs, ...}:
   { services.kerberos_server =
     { enable = true;
       realms = {
diff --git a/nixos/tests/kerberos/mit.nix b/nixos/tests/kerberos/mit.nix
index 93b4020d49941..b475b7e4c92bb 100644
--- a/nixos/tests/kerberos/mit.nix
+++ b/nixos/tests/kerberos/mit.nix
@@ -1,6 +1,6 @@
 import ../make-test-python.nix ({pkgs, ...}: {
   name = "kerberos_server-mit";
-  machine = { config, libs, pkgs, ...}:
+  nodes.machine = { config, libs, pkgs, ...}:
   { services.kerberos_server =
     { enable = true;
       realms = {
diff --git a/nixos/tests/kernel-generic.nix b/nixos/tests/kernel-generic.nix
index 45c5c1963a0db..f34d5d6079404 100644
--- a/nixos/tests/kernel-generic.nix
+++ b/nixos/tests/kernel-generic.nix
@@ -12,7 +12,7 @@ let
       maintainers = [ nequissimus atemu ];
     };
 
-    machine = { ... }:
+    nodes.machine = { ... }:
       {
         boot.kernelPackages = linuxPackages;
       };
diff --git a/nixos/tests/kernel-latest-ath-user-regd.nix b/nixos/tests/kernel-latest-ath-user-regd.nix
index 11a3959e692e9..09e1da9d2affe 100644
--- a/nixos/tests/kernel-latest-ath-user-regd.nix
+++ b/nixos/tests/kernel-latest-ath-user-regd.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, ...} : {
     maintainers = [ veehaitch ];
   };
 
-  machine = { pkgs, ... }:
+  nodes.machine = { pkgs, ... }:
     {
       boot.kernelPackages = pkgs.linuxPackages_latest;
       networking.wireless.athUserRegulatoryDomain = true;
diff --git a/nixos/tests/kexec.nix b/nixos/tests/kexec.nix
index 010f3da49846a..55b71e0999f68 100644
--- a/nixos/tests/kexec.nix
+++ b/nixos/tests/kexec.nix
@@ -6,7 +6,7 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
     maintainers = [ eelco ];
   };
 
-  machine = { ... }:
+  nodes.machine = { ... }:
     { virtualisation.vlans = [ ]; };
 
   testScript =
diff --git a/nixos/tests/krb5/deprecated-config.nix b/nixos/tests/krb5/deprecated-config.nix
index 9a9cafd4b13e9..aca29ae6ca2b2 100644
--- a/nixos/tests/krb5/deprecated-config.nix
+++ b/nixos/tests/krb5/deprecated-config.nix
@@ -7,7 +7,7 @@ import ../make-test-python.nix ({ pkgs, ...} : {
     maintainers = [ eqyiel ];
   };
 
-  machine =
+  nodes.machine =
     { ... }: {
       krb5 = {
         enable = true;
diff --git a/nixos/tests/krb5/example-config.nix b/nixos/tests/krb5/example-config.nix
index 0932c71dd9705..1125b02f01ca8 100644
--- a/nixos/tests/krb5/example-config.nix
+++ b/nixos/tests/krb5/example-config.nix
@@ -7,7 +7,7 @@ import ../make-test-python.nix ({ pkgs, ...} : {
     maintainers = [ eqyiel ];
   };
 
-  machine =
+  nodes.machine =
     { pkgs, ... }: {
       krb5 = {
         enable = true;
diff --git a/nixos/tests/ksm.nix b/nixos/tests/ksm.nix
index 8f84b32020ab9..026d2ee85a24a 100644
--- a/nixos/tests/ksm.nix
+++ b/nixos/tests/ksm.nix
@@ -6,7 +6,7 @@ import ./make-test-python.nix ({ lib, ...} :
     maintainers = [ rnhmjoj ];
   };
 
-  machine = { ... }: {
+  nodes.machine = { ... }: {
     imports = [ ../modules/profiles/minimal.nix ];
 
     hardware.ksm.enable = true;
diff --git a/nixos/tests/libinput.nix b/nixos/tests/libinput.nix
index 2f84aaadcd0be..9b6fa159b999c 100644
--- a/nixos/tests/libinput.nix
+++ b/nixos/tests/libinput.nix
@@ -3,7 +3,7 @@ import ./make-test-python.nix ({ ... }:
 {
   name = "libinput";
 
-  machine = { ... }:
+  nodes.machine = { ... }:
     {
       imports = [
         ./common/x11.nix
diff --git a/nixos/tests/libresprite.nix b/nixos/tests/libresprite.nix
index 1a6210e3671ae..16d272acfa0fa 100644
--- a/nixos/tests/libresprite.nix
+++ b/nixos/tests/libresprite.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
     maintainers = [ fgaz ];
   };
 
-  machine = { config, pkgs, ... }: {
+  nodes.machine = { config, pkgs, ... }: {
     imports = [
       ./common/x11.nix
     ];
diff --git a/nixos/tests/lightdm.nix b/nixos/tests/lightdm.nix
index e98230ecb1794..94cebd4a630ab 100644
--- a/nixos/tests/lightdm.nix
+++ b/nixos/tests/lightdm.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, ...} : {
     maintainers = [ aszlig ];
   };
 
-  machine = { ... }: {
+  nodes.machine = { ... }: {
     imports = [ ./common/user-account.nix ];
     services.xserver.enable = true;
     services.xserver.displayManager.lightdm.enable = true;
diff --git a/nixos/tests/limesurvey.nix b/nixos/tests/limesurvey.nix
index b60e80be2444c..9a3193991f352 100644
--- a/nixos/tests/limesurvey.nix
+++ b/nixos/tests/limesurvey.nix
@@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
   name = "limesurvey";
   meta.maintainers = [ pkgs.lib.maintainers.aanderse ];
 
-  machine = { ... }: {
+  nodes.machine = { ... }: {
     services.limesurvey = {
       enable = true;
       virtualHost = {
diff --git a/nixos/tests/litestream.nix b/nixos/tests/litestream.nix
index 886fbfef9cf55..f9d71c526e9e7 100644
--- a/nixos/tests/litestream.nix
+++ b/nixos/tests/litestream.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, ...} : {
     maintainers = [ jwygoda ];
   };
 
-  machine =
+  nodes.machine =
     { pkgs, ... }:
     { services.litestream = {
         enable = true;
diff --git a/nixos/tests/login.nix b/nixos/tests/login.nix
index 4d1dcc8cc32da..0d6f81b172191 100644
--- a/nixos/tests/login.nix
+++ b/nixos/tests/login.nix
@@ -6,7 +6,7 @@ import ./make-test-python.nix ({ pkgs, latestKernel ? false, ... }:
     maintainers = [ eelco ];
   };
 
-  machine =
+  nodes.machine =
     { pkgs, lib, ... }:
     { boot.kernelPackages = lib.mkIf latestKernel pkgs.linuxPackages_latest;
       sound.enable = true; # needed for the factl test, /dev/snd/* exists without them but udev doesn't care then
diff --git a/nixos/tests/logrotate.nix b/nixos/tests/logrotate.nix
index 38da8d535275c..b0685f3af9ff1 100644
--- a/nixos/tests/logrotate.nix
+++ b/nixos/tests/logrotate.nix
@@ -1,26 +1,105 @@
 # Test logrotate service works and is enabled by default
 
-import ./make-test-python.nix ({ pkgs, ...} : rec {
+let
+  importTest = { ... }: {
+    services.logrotate.settings.import = {
+      olddir = false;
+    };
+  };
+
+in
+
+import ./make-test-python.nix ({ pkgs, ... }: rec {
   name = "logrotate";
   meta = with pkgs.lib.maintainers; {
     maintainers = [ martinetd ];
   };
 
-  # default machine
-  machine = { ... }: {
+  nodes = {
+    defaultMachine = { ... }: { };
+    failingMachine = { ... }: {
+      services.logrotate.configFile = pkgs.writeText "logrotate.conf" ''
+        # self-written config file
+        su notarealuser notagroupeither
+      '';
+    };
+    machine = { config, ... }: {
+      imports = [ importTest ];
+
+      services.logrotate.settings = {
+        # remove default frequency header and add another
+        header = {
+          frequency = null;
+          delaycompress = true;
+        };
+        # extra global setting... affecting nothing
+        last_line = {
+          global = true;
+          priority = 2000;
+          shred = true;
+        };
+        # using mail somewhere should add --mail to logrotate invokation
+        sendmail = {
+          mail = "user@domain.tld";
+        };
+        # postrotate should be suffixed by 'endscript'
+        postrotate = {
+          postrotate = "touch /dev/null";
+        };
+        # check checkConfig works as expected: there is nothing to check here
+        # except that the file build passes
+        checkConf = {
+          su = "root utmp";
+          createolddir = "0750 root utmp";
+          create = "root utmp";
+          "create " = "0750 root utmp";
+        };
+        # multiple paths should be aggregated
+        multipath = {
+          files = [ "file1" "file2" ];
+        };
+        # overriding imported path should keep existing attributes
+        # (e.g. olddir is still set)
+        import = {
+          notifempty = true;
+        };
+      };
+      # extraConfig compatibility - should be added to top level, early.
+      services.logrotate.extraConfig = ''
+        nomail
+      '';
+      # paths compatibility
+      services.logrotate.paths = {
+        compat_path = {
+          path = "compat_test_path";
+        };
+        # user/group should be grouped as 'su user group'
+        compat_user = {
+          user = config.users.users.root.name;
+          group = "root";
+        };
+        # extraConfig in path should be added to block
+        compat_extraConfig = {
+          extraConfig = "dateext";
+        };
+        # keep -> rotate
+        compat_keep = {
+          keep = 1;
+        };
+      };
+    };
   };
 
   testScript =
     ''
       with subtest("whether logrotate works"):
-          machine.succeed(
-              # we must rotate once first to create logrotate stamp
-              "systemctl start logrotate.service")
+          # we must rotate once first to create logrotate stamp
+          defaultMachine.succeed("systemctl start logrotate.service")
           # we need to wait for console text once here to
           # clear console buffer up to this point for next wait
-          machine.wait_for_console_text('logrotate.service: Deactivated successfully')
+          defaultMachine.wait_for_console_text('logrotate.service: Deactivated successfully')
 
-          machine.succeed(
+          defaultMachine.succeed(
               # wtmp is present in default config.
               "rm -f /var/log/wtmp*",
               # we need to give it at least 1MB
@@ -28,10 +107,46 @@ import ./make-test-python.nix ({ pkgs, ...} : rec {
 
               # move into the future and check rotation.
               "date -s 'now + 1 month + 1 day'")
-          machine.wait_for_console_text('logrotate.service: Deactivated successfully')
-          machine.succeed(
+          defaultMachine.wait_for_console_text('logrotate.service: Deactivated successfully')
+          defaultMachine.succeed(
               # check rotate worked
               "[ -e /var/log/wtmp.1 ]",
           )
+      with subtest("default config does not have mail"):
+          defaultMachine.fail("systemctl cat logrotate.service | grep -- --mail")
+      with subtest("using mails adds mail option"):
+          machine.succeed("systemctl cat logrotate.service | grep -- --mail")
+      with subtest("check generated config matches expectation"):
+          machine.succeed(
+              # copy conf to /tmp/logrotate.conf for easy grep
+              "conf=$(systemctl cat logrotate | grep -oE '/nix/store[^ ]*logrotate.conf'); cp $conf /tmp/logrotate.conf",
+              "! grep weekly /tmp/logrotate.conf",
+              "grep -E '^delaycompress' /tmp/logrotate.conf",
+              "tail -n 1 /tmp/logrotate.conf | grep shred",
+              "sed -ne '/\"sendmail\" {/,/}/p' /tmp/logrotate.conf | grep 'mail user@domain.tld'",
+              "sed -ne '/\"postrotate\" {/,/}/p' /tmp/logrotate.conf | grep endscript",
+              "grep '\"file1\"\n\"file2\" {' /tmp/logrotate.conf",
+              "sed -ne '/\"import\" {/,/}/p' /tmp/logrotate.conf | grep noolddir",
+              "sed -ne '1,/^\"/p' /tmp/logrotate.conf | grep nomail",
+              "grep '\"compat_test_path\" {' /tmp/logrotate.conf",
+              "sed -ne '/\"compat_user\" {/,/}/p' /tmp/logrotate.conf | grep 'su root root'",
+              "sed -ne '/\"compat_extraConfig\" {/,/}/p' /tmp/logrotate.conf | grep dateext",
+              "[[ $(sed -ne '/\"compat_keep\" {/,/}/p' /tmp/logrotate.conf | grep -w rotate) = \"  rotate 1\" ]]",
+              "! sed -ne '/\"compat_keep\" {/,/}/p' /tmp/logrotate.conf | grep -w keep",
+          )
+          # also check configFile option
+          failingMachine.succeed(
+              "conf=$(systemctl cat logrotate | grep -oE '/nix/store[^ ]*logrotate.conf'); cp $conf /tmp/logrotate.conf",
+              "grep 'self-written config' /tmp/logrotate.conf",
+          )
+      with subtest("Check logrotate-checkconf service"):
+          machine.wait_for_unit("logrotate-checkconf.service")
+          # wait_for_unit also asserts for success, so wait for
+          # parent target instead and check manually.
+          failingMachine.wait_for_unit("multi-user.target")
+          info = failingMachine.get_unit_info("logrotate-checkconf.service")
+          if info["ActiveState"] != "failed":
+              raise Exception('logrotate-checkconf.service was not failed')
+
     '';
 })
diff --git a/nixos/tests/loki.nix b/nixos/tests/loki.nix
index 0c6dff3fdf137..470f80e9db635 100644
--- a/nixos/tests/loki.nix
+++ b/nixos/tests/loki.nix
@@ -7,7 +7,7 @@ import ./make-test-python.nix ({ lib, pkgs, ... }:
     maintainers = [ willibutz ];
   };
 
-  machine = { ... }: {
+  nodes.machine = { ... }: {
     services.loki = {
       enable = true;
       configFile = "${pkgs.grafana-loki.src}/cmd/loki/loki-local-config.yaml";
diff --git a/nixos/tests/lorri/default.nix b/nixos/tests/lorri/default.nix
index c33c7503993da..209b87f9f26a3 100644
--- a/nixos/tests/lorri/default.nix
+++ b/nixos/tests/lorri/default.nix
@@ -1,5 +1,5 @@
 import ../make-test-python.nix {
-  machine = { pkgs, ... }: {
+  nodes.machine = { pkgs, ... }: {
     imports = [ ../../modules/profiles/minimal.nix ];
     environment.systemPackages = [ pkgs.lorri ];
   };
diff --git a/nixos/tests/lxd-image-server.nix b/nixos/tests/lxd-image-server.nix
index 9f060fed38d87..fa40e33e74dd6 100644
--- a/nixos/tests/lxd-image-server.nix
+++ b/nixos/tests/lxd-image-server.nix
@@ -51,7 +51,7 @@ in {
     maintainers = [ mkg20001 ];
   };
 
-  machine = { lib, ... }: {
+  nodes.machine = { lib, ... }: {
     virtualisation = {
       cores = 2;
 
diff --git a/nixos/tests/lxd-image.nix b/nixos/tests/lxd-image.nix
index 096b9d9aba906..4930b55f19094 100644
--- a/nixos/tests/lxd-image.nix
+++ b/nixos/tests/lxd-image.nix
@@ -44,7 +44,7 @@ in {
     maintainers = [ mkg20001 ];
   };
 
-  machine = { lib, ... }: {
+  nodes.machine = { lib, ... }: {
     virtualisation = {
       # disk full otherwise
       diskSize = 2048;
diff --git a/nixos/tests/lxd-nftables.nix b/nixos/tests/lxd-nftables.nix
index a62d5a3064dfb..2930650015679 100644
--- a/nixos/tests/lxd-nftables.nix
+++ b/nixos/tests/lxd-nftables.nix
@@ -12,7 +12,7 @@ import ./make-test-python.nix ({ pkgs, ...} : {
     maintainers = [ patryk27 ];
   };
 
-  machine = { lib, ... }: {
+  nodes.machine = { lib, ... }: {
     virtualisation = {
       lxd.enable = true;
     };
diff --git a/nixos/tests/lxd.nix b/nixos/tests/lxd.nix
index 1a3b84a85cf68..81b36124cc6b2 100644
--- a/nixos/tests/lxd.nix
+++ b/nixos/tests/lxd.nix
@@ -51,7 +51,7 @@ in {
     maintainers = [ patryk27 ];
   };
 
-  machine = { lib, ... }: {
+  nodes.machine = { lib, ... }: {
     virtualisation = {
       # Since we're testing `limits.cpu`, we've gotta have a known number of
       # cores to lean on
diff --git a/nixos/tests/magnetico.nix b/nixos/tests/magnetico.nix
index 8433a974f453b..ee84aacaf7a74 100644
--- a/nixos/tests/magnetico.nix
+++ b/nixos/tests/magnetico.nix
@@ -9,7 +9,7 @@ in
     maintainers = [ rnhmjoj ];
   };
 
-  machine = { ... }: {
+  nodes.machine = { ... }: {
     imports = [ ../modules/profiles/minimal.nix ];
 
     networking.firewall.allowedTCPPorts = [ 9000 ];
diff --git a/nixos/tests/mailcatcher.nix b/nixos/tests/mailcatcher.nix
index a55fba8a9950b..d7858ab354bd3 100644
--- a/nixos/tests/mailcatcher.nix
+++ b/nixos/tests/mailcatcher.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ lib, ... }:
   name = "mailcatcher";
   meta.maintainers = [ lib.maintainers.aanderse ];
 
-  machine =
+  nodes.machine =
     { pkgs, ... }:
     {
       services.mailcatcher.enable = true;
diff --git a/nixos/tests/mailhog.nix b/nixos/tests/mailhog.nix
index aece57178dd17..3508c2c0a5ea3 100644
--- a/nixos/tests/mailhog.nix
+++ b/nixos/tests/mailhog.nix
@@ -2,7 +2,7 @@ import ./make-test-python.nix ({ lib, ... }: {
   name = "mailhog";
   meta.maintainers = with lib.maintainers; [ jojosch ];
 
-  machine = { pkgs, ... }: {
+  nodes.machine = { pkgs, ... }: {
     services.mailhog.enable = true;
 
     environment.systemPackages = with pkgs; [ swaks ];
diff --git a/nixos/tests/matomo.nix b/nixos/tests/matomo.nix
index f6b0845749cde..526a24fc4db75 100644
--- a/nixos/tests/matomo.nix
+++ b/nixos/tests/matomo.nix
@@ -7,7 +7,7 @@ with pkgs.lib;
 let
   matomoTest = package:
   makeTest {
-    machine = { config, pkgs, ... }: {
+    nodes.machine = { config, pkgs, ... }: {
       services.matomo = {
         package = package;
         enable = true;
diff --git a/nixos/tests/matrix/pantalaimon.nix b/nixos/tests/matrix/pantalaimon.nix
index 1a9894dd21596..b5d649e6517aa 100644
--- a/nixos/tests/matrix/pantalaimon.nix
+++ b/nixos/tests/matrix/pantalaimon.nix
@@ -36,7 +36,7 @@ import ../make-test-python.nix (
       maintainers = teams.matrix.members;
     };
 
-    machine = { pkgs, ... }: {
+    nodes.machine = { pkgs, ... }: {
       services.pantalaimon-headless.instances.${pantalaimonInstanceName} = {
         homeserver = "https://localhost:8448";
         listenAddress = "0.0.0.0";
diff --git a/nixos/tests/mediawiki.nix b/nixos/tests/mediawiki.nix
index 702fefefa1610..7f31d6aadfa2c 100644
--- a/nixos/tests/mediawiki.nix
+++ b/nixos/tests/mediawiki.nix
@@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
   name = "mediawiki";
   meta.maintainers = [ lib.maintainers.aanderse ];
 
-  machine =
+  nodes.machine =
     { ... }:
     { services.mediawiki.enable = true;
       services.mediawiki.virtualHost.hostName = "localhost";
diff --git a/nixos/tests/meilisearch.nix b/nixos/tests/meilisearch.nix
index c379bda74c59a..9f54aa97d6adc 100644
--- a/nixos/tests/meilisearch.nix
+++ b/nixos/tests/meilisearch.nix
@@ -12,7 +12,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
     name = "meilisearch";
     meta.maintainers = with lib.maintainers; [ Br1ght0ne ];
 
-    machine = { ... }: {
+    nodes.machine = { ... }: {
       environment.systemPackages = with pkgs; [ curl jq ];
       services.meilisearch = {
         enable = true;
diff --git a/nixos/tests/memcached.nix b/nixos/tests/memcached.nix
index 31f5627d25ceb..6549995110d79 100644
--- a/nixos/tests/memcached.nix
+++ b/nixos/tests/memcached.nix
@@ -1,7 +1,7 @@
 import ./make-test-python.nix ({ pkgs, ... }: {
   name = "memcached";
 
-  machine = {
+  nodes.machine = {
     imports = [ ../modules/profiles/minimal.nix ];
     services.memcached.enable = true;
   };
diff --git a/nixos/tests/misc.nix b/nixos/tests/misc.nix
index 02513c4726c1b..0d5f0fe2f044c 100644
--- a/nixos/tests/misc.nix
+++ b/nixos/tests/misc.nix
@@ -8,7 +8,7 @@ in {
     maintainers = [ eelco ];
   };
 
-  machine =
+  nodes.machine =
     { lib, ... }:
     with lib;
     { swapDevices = mkOverride 0
diff --git a/nixos/tests/mod_perl.nix b/nixos/tests/mod_perl.nix
index 29a1eb6503fdf..f29d79ea6206a 100644
--- a/nixos/tests/mod_perl.nix
+++ b/nixos/tests/mod_perl.nix
@@ -5,7 +5,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
     maintainers = [ sgo ];
   };
 
-  machine = { config, lib, pkgs, ... }: {
+  nodes.machine = { config, lib, pkgs, ... }: {
     services.httpd = {
       enable = true;
       adminAddr = "admin@localhost";
diff --git a/nixos/tests/moodle.nix b/nixos/tests/moodle.nix
index 56aa62596c078..4570e89638822 100644
--- a/nixos/tests/moodle.nix
+++ b/nixos/tests/moodle.nix
@@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
   name = "moodle";
   meta.maintainers = [ lib.maintainers.aanderse ];
 
-  machine =
+  nodes.machine =
     { ... }:
     { services.moodle.enable = true;
       services.moodle.virtualHost.hostName = "localhost";
diff --git a/nixos/tests/musescore.nix b/nixos/tests/musescore.nix
index 7fd80d70df124..18de0a5502390 100644
--- a/nixos/tests/musescore.nix
+++ b/nixos/tests/musescore.nix
@@ -17,7 +17,7 @@ in
     maintainers = [ turion ];
   };
 
-  machine = { ... }:
+  nodes.machine = { ... }:
 
   {
     imports = [
diff --git a/nixos/tests/mysql/mysql-autobackup.nix b/nixos/tests/mysql/mysql-autobackup.nix
index 101122f7bdef8..b49466db0a9ce 100644
--- a/nixos/tests/mysql/mysql-autobackup.nix
+++ b/nixos/tests/mysql/mysql-autobackup.nix
@@ -17,7 +17,7 @@ let
     name = "${name}-automysqlbackup";
     meta.maintainers = [ lib.maintainers.aanderse ];
 
-    machine = {
+    nodes.machine = {
       services.mysql = {
         inherit package;
         enable = true;
diff --git a/nixos/tests/nagios.nix b/nixos/tests/nagios.nix
index e4d8dabedf72c..b6e45fc103afd 100644
--- a/nixos/tests/nagios.nix
+++ b/nixos/tests/nagios.nix
@@ -5,7 +5,7 @@ import ./make-test-python.nix (
       maintainers = [ symphorien ];
     };
 
-    machine = { lib, ... }: let
+    nodes.machine = { lib, ... }: let
       writer = pkgs.writeShellScript "write" ''
         set -x
         echo "$@"  >> /tmp/notifications
diff --git a/nixos/tests/navidrome.nix b/nixos/tests/navidrome.nix
index 42e14720b2edf..62290d50fc7e9 100644
--- a/nixos/tests/navidrome.nix
+++ b/nixos/tests/navidrome.nix
@@ -1,7 +1,7 @@
 import ./make-test-python.nix ({ pkgs, ... }: {
   name = "navidrome";
 
-  machine = { ... }: {
+  nodes.machine = { ... }: {
     services.navidrome.enable = true;
   };
 
diff --git a/nixos/tests/networking.nix b/nixos/tests/networking.nix
index dc7938a436aa7..bd517093eb3d0 100644
--- a/nixos/tests/networking.nix
+++ b/nixos/tests/networking.nix
@@ -640,7 +640,7 @@ let
     };
     virtual = {
       name = "Virtual";
-      machine = {
+      nodes.machine = {
         networking.useNetworkd = networkd;
         networking.useDHCP = false;
         networking.interfaces.tap0 = {
@@ -784,7 +784,7 @@ let
     };
     routes = {
       name = "routes";
-      machine = {
+      nodes.machine = {
         networking.useNetworkd = networkd;
         networking.useDHCP = false;
         networking.interfaces.eth0 = {
@@ -865,7 +865,7 @@ let
     };
     rename = {
       name = "RenameInterface";
-      machine = { pkgs, ... }: {
+      nodes.machine = { pkgs, ... }: {
         virtualisation.vlans = [ 1 ];
         networking = {
           useNetworkd = networkd;
@@ -916,7 +916,7 @@ let
       testMac = "06:00:00:00:02:00";
     in {
       name = "WlanInterface";
-      machine = { pkgs, ... }: {
+      nodes.machine = { pkgs, ... }: {
         boot.kernelModules = [ "mac80211_hwsim" ];
         networking.wlanInterfaces = {
           wlan0 = { device = "wlan0"; };
diff --git a/nixos/tests/nginx-modsecurity.nix b/nixos/tests/nginx-modsecurity.nix
index 8c53c0196d4cc..5ceee3787297d 100644
--- a/nixos/tests/nginx-modsecurity.nix
+++ b/nixos/tests/nginx-modsecurity.nix
@@ -1,7 +1,7 @@
 import ./make-test-python.nix ({ pkgs, lib, ... }: {
   name = "nginx-modsecurity";
 
-  machine = { config, lib, pkgs, ... }: {
+  nodes.machine = { config, lib, pkgs, ... }: {
     services.nginx = {
       enable = true;
       additionalModules = [ pkgs.nginxModules.modsecurity-nginx ];
diff --git a/nixos/tests/nginx-pubhtml.nix b/nixos/tests/nginx-pubhtml.nix
index 6e1e605628e9a..bff24c99d41a4 100644
--- a/nixos/tests/nginx-pubhtml.nix
+++ b/nixos/tests/nginx-pubhtml.nix
@@ -1,7 +1,7 @@
 import ./make-test-python.nix {
   name = "nginx-pubhtml";
 
-  machine = { pkgs, ... }: {
+  nodes.machine = { pkgs, ... }: {
     systemd.services.nginx.serviceConfig.ProtectHome = "read-only";
     services.nginx.enable = true;
     services.nginx.virtualHosts.localhost = {
diff --git a/nixos/tests/nginx-sandbox.nix b/nixos/tests/nginx-sandbox.nix
index 2d512725f2650..92ba30a09cf9f 100644
--- a/nixos/tests/nginx-sandbox.nix
+++ b/nixos/tests/nginx-sandbox.nix
@@ -6,7 +6,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
 
   # This test checks the creation and reading of a file in sandbox mode. Used simple lua script.
 
-  machine = { pkgs, ... }: {
+  nodes.machine = { pkgs, ... }: {
     nixpkgs.overlays = [
       (self: super: {
         nginx-lua = super.nginx.override {
diff --git a/nixos/tests/nginx-sso.nix b/nixos/tests/nginx-sso.nix
index aeb89859c73f1..221c5f4ed9058 100644
--- a/nixos/tests/nginx-sso.nix
+++ b/nixos/tests/nginx-sso.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
     maintainers = with pkgs.lib.maintainers; [ delroth ];
   };
 
-  machine = {
+  nodes.machine = {
     services.nginx.sso = {
       enable = true;
       configuration = {
diff --git a/nixos/tests/nginx-variants.nix b/nixos/tests/nginx-variants.nix
index 96a9a2c3b8c1d..0faa0127669dd 100644
--- a/nixos/tests/nginx-variants.nix
+++ b/nixos/tests/nginx-variants.nix
@@ -13,7 +13,7 @@ builtins.listToAttrs (
         value = makeTest {
           name = "nginx-variant-${nginxName}";
 
-          machine = { pkgs, ... }: {
+          nodes.machine = { pkgs, ... }: {
             services.nginx = {
               enable = true;
               virtualHosts.localhost.locations."/".return = "200 'foo'";
diff --git a/nixos/tests/nix-serve.nix b/nixos/tests/nix-serve.nix
index ab82f4be43e68..3aa913f81107a 100644
--- a/nixos/tests/nix-serve.nix
+++ b/nixos/tests/nix-serve.nix
@@ -1,7 +1,7 @@
 import ./make-test-python.nix ({ pkgs, ... }:
 {
   name = "nix-serve";
-  machine = { pkgs, ... }: {
+  nodes.machine = { pkgs, ... }: {
     services.nix-serve.enable = true;
     environment.systemPackages = [
       pkgs.hello
diff --git a/nixos/tests/nixos-generate-config.nix b/nixos/tests/nixos-generate-config.nix
index 1dadf4992ed00..e1c2f29e06732 100644
--- a/nixos/tests/nixos-generate-config.nix
+++ b/nixos/tests/nixos-generate-config.nix
@@ -1,7 +1,7 @@
 import ./make-test-python.nix ({ lib, ... } : {
   name = "nixos-generate-config";
   meta.maintainers = with lib.maintainers; [ basvandijk ];
-  machine = {
+  nodes.machine = {
     system.nixos-generate-config.configuration = ''
       # OVERRIDDEN
       { config, pkgs, ... }: {
diff --git a/nixos/tests/noto-fonts.nix b/nixos/tests/noto-fonts.nix
index 049dc766bd3b7..e4c33fe26a9e6 100644
--- a/nixos/tests/noto-fonts.nix
+++ b/nixos/tests/noto-fonts.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
     maintainers = with lib.maintainers; [ nickcao midchildan ];
   };
 
-  machine = {
+  nodes.machine = {
     imports = [ ./common/x11.nix ];
     environment.systemPackages = [ pkgs.gnome.gedit ];
     fonts = {
diff --git a/nixos/tests/novacomd.nix b/nixos/tests/novacomd.nix
index b470c117e1e15..d47d212fb2eca 100644
--- a/nixos/tests/novacomd.nix
+++ b/nixos/tests/novacomd.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, ...} : {
     maintainers = [ dtzWill ];
   };
 
-  machine = { ... }: {
+  nodes.machine = { ... }: {
     services.novacomd.enable = true;
   };
 
diff --git a/nixos/tests/oh-my-zsh.nix b/nixos/tests/oh-my-zsh.nix
index 57a073b086e88..1d5227e36236d 100644
--- a/nixos/tests/oh-my-zsh.nix
+++ b/nixos/tests/oh-my-zsh.nix
@@ -1,7 +1,7 @@
 import ./make-test-python.nix ({ pkgs, ... }: {
   name = "oh-my-zsh";
 
-  machine = { pkgs, ... }:
+  nodes.machine = { pkgs, ... }:
 
     {
       programs.zsh = {
diff --git a/nixos/tests/openldap.nix b/nixos/tests/openldap.nix
index f1a39ad7dde2f..3c388119d5d24 100644
--- a/nixos/tests/openldap.nix
+++ b/nixos/tests/openldap.nix
@@ -25,7 +25,7 @@ in {
     inherit testScript;
     name = "openldap";
 
-    machine = { pkgs, ... }: {
+    nodes.machine = { pkgs, ... }: {
       environment.etc."openldap/root_password".text = "notapassword";
       services.openldap = {
         enable = true;
@@ -65,7 +65,7 @@ in {
     inherit testScript;
     name = "openldap";
 
-    machine = { pkgs, ... }: {
+    nodes.machine = { pkgs, ... }: {
       services.openldap = {
         enable = true;
         logLevel = "stats acl";
@@ -83,7 +83,7 @@ in {
   manualConfigDir = import ./make-test-python.nix ({ pkgs, ... }: {
     name = "openldap";
 
-    machine = { pkgs, ... }: {
+    nodes.machine = { pkgs, ... }: {
       services.openldap = {
         enable = true;
         configDir = "/var/db/slapd.d";
diff --git a/nixos/tests/opentabletdriver.nix b/nixos/tests/opentabletdriver.nix
index fe345a7bec735..b7583f6dd2648 100644
--- a/nixos/tests/opentabletdriver.nix
+++ b/nixos/tests/opentabletdriver.nix
@@ -6,7 +6,7 @@ in {
     maintainers = with pkgs.lib.maintainers; [ thiagokokada ];
   };
 
-  machine = { pkgs, ... }:
+  nodes.machine = { pkgs, ... }:
     {
       imports = [
         ./common/user-account.nix
diff --git a/nixos/tests/os-prober.nix b/nixos/tests/os-prober.nix
index 90375450fe1b2..ac05bd80c601a 100644
--- a/nixos/tests/os-prober.nix
+++ b/nixos/tests/os-prober.nix
@@ -65,7 +65,7 @@ let
 in {
   name = "os-prober";
 
-  machine = { config, pkgs, ... }: (simpleConfig // {
+  nodes.machine = { config, pkgs, ... }: (simpleConfig // {
       imports = [ ../modules/profiles/installation-device.nix
                   ../modules/profiles/base.nix ];
       virtualisation.memorySize = 1300;
diff --git a/nixos/tests/osrm-backend.nix b/nixos/tests/osrm-backend.nix
index 4067d5b1a239a..b0e65a2ae1c10 100644
--- a/nixos/tests/osrm-backend.nix
+++ b/nixos/tests/osrm-backend.nix
@@ -5,7 +5,7 @@ in {
   name = "osrm-backend";
   meta.maintainers = [ lib.maintainers.erictapen ];
 
-  machine = { config, pkgs, ... }:{
+  nodes.machine = { config, pkgs, ... }:{
 
     services.osrm = {
       enable = true;
diff --git a/nixos/tests/overlayfs.nix b/nixos/tests/overlayfs.nix
index 1768f1fea1ed1..6dab6760c5b99 100644
--- a/nixos/tests/overlayfs.nix
+++ b/nixos/tests/overlayfs.nix
@@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
   name = "overlayfs";
   meta.maintainers = with pkgs.lib.maintainers; [ bachp ];
 
-  machine = { pkgs, ... }: {
+  nodes.machine = { pkgs, ... }: {
     virtualisation.emptyDiskImages = [ 512 ];
     networking.hostId = "deadbeef";
     environment.systemPackages = with pkgs; [ parted ];
diff --git a/nixos/tests/packagekit.nix b/nixos/tests/packagekit.nix
index 020a4e65e6d8f..5769c6c9a8d45 100644
--- a/nixos/tests/packagekit.nix
+++ b/nixos/tests/packagekit.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
     maintainers = [ peterhoeg ];
   };
 
-  machine = { ... }: {
+  nodes.machine = { ... }: {
     environment.systemPackages = with pkgs; [ dbus ];
     services.packagekit = {
       enable = true;
diff --git a/nixos/tests/pam/pam-oath-login.nix b/nixos/tests/pam/pam-oath-login.nix
index 597596b211b11..8fb7553de9073 100644
--- a/nixos/tests/pam/pam-oath-login.nix
+++ b/nixos/tests/pam/pam-oath-login.nix
@@ -21,7 +21,7 @@ in
 {
   name = "pam-oath-login";
 
-  machine =
+  nodes.machine =
     { ... }:
     {
       security.pam.oath = {
diff --git a/nixos/tests/pam/pam-u2f.nix b/nixos/tests/pam/pam-u2f.nix
index 0ac6ac17be823..d7c540982cfa0 100644
--- a/nixos/tests/pam/pam-u2f.nix
+++ b/nixos/tests/pam/pam-u2f.nix
@@ -3,7 +3,7 @@ import ../make-test-python.nix ({ ... }:
 {
   name = "pam-u2f";
 
-  machine =
+  nodes.machine =
     { ... }:
     {
       security.pam.u2f = {
diff --git a/nixos/tests/pantheon.nix b/nixos/tests/pantheon.nix
index 989d29a966dfb..52f85f5c07da8 100644
--- a/nixos/tests/pantheon.nix
+++ b/nixos/tests/pantheon.nix
@@ -7,7 +7,7 @@ import ./make-test-python.nix ({ pkgs, lib, ...} :
     maintainers = teams.pantheon.members;
   };
 
-  machine = { ... }:
+  nodes.machine = { ... }:
 
   {
     imports = [ ./common/user-account.nix ];
diff --git a/nixos/tests/php/fpm.nix b/nixos/tests/php/fpm.nix
index 718a635a6c7c9..64b61a377e28a 100644
--- a/nixos/tests/php/fpm.nix
+++ b/nixos/tests/php/fpm.nix
@@ -2,7 +2,7 @@ import ../make-test-python.nix ({ pkgs, lib, php, ... }: {
   name = "php-${php.version}-fpm-nginx-test";
   meta.maintainers = lib.teams.php.members;
 
-  machine = { config, lib, pkgs, ... }: {
+  nodes.machine = { config, lib, pkgs, ... }: {
     environment.systemPackages = [ php ];
 
     services.nginx = {
diff --git a/nixos/tests/php/httpd.nix b/nixos/tests/php/httpd.nix
index 36d90e72d7d14..b6dfbeeaed527 100644
--- a/nixos/tests/php/httpd.nix
+++ b/nixos/tests/php/httpd.nix
@@ -2,7 +2,7 @@ import ../make-test-python.nix ({ pkgs, lib, php, ... }: {
   name = "php-${php.version}-httpd-test";
   meta.maintainers = lib.teams.php.members;
 
-  machine = { config, lib, pkgs, ... }: {
+  nodes.machine = { config, lib, pkgs, ... }: {
     services.httpd = {
       enable = true;
       adminAddr = "admin@phpfpm";
diff --git a/nixos/tests/php/pcre.nix b/nixos/tests/php/pcre.nix
index 917184b975ec6..57407477f4b8e 100644
--- a/nixos/tests/php/pcre.nix
+++ b/nixos/tests/php/pcre.nix
@@ -5,7 +5,7 @@ import ../make-test-python.nix ({ lib, php, ... }: {
   name = "php-${php.version}-httpd-pcre-jit-test";
   meta.maintainers = lib.teams.php.members;
 
-  machine = { lib, pkgs, ... }: {
+  nodes.machine = { lib, pkgs, ... }: {
     time.timeZone = "UTC";
     services.httpd = {
       enable = true;
diff --git a/nixos/tests/pict-rs.nix b/nixos/tests/pict-rs.nix
index 432fd6a50ccd8..90f01d6d5d022 100644
--- a/nixos/tests/pict-rs.nix
+++ b/nixos/tests/pict-rs.nix
@@ -3,7 +3,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
     name = "pict-rs";
     meta.maintainers = with lib.maintainers; [ happysalada ];
 
-    machine = { ... }: {
+    nodes.machine = { ... }: {
       environment.systemPackages = with pkgs; [ curl jq ];
       services.pict-rs.enable = true;
     };
diff --git a/nixos/tests/plasma5-systemd-start.nix b/nixos/tests/plasma5-systemd-start.nix
index 72de19af70cef..f584c1ec137aa 100644
--- a/nixos/tests/plasma5-systemd-start.nix
+++ b/nixos/tests/plasma5-systemd-start.nix
@@ -6,7 +6,7 @@ import ./make-test-python.nix ({ pkgs, ...} :
     maintainers = [ oxalica ];
   };
 
-  machine = { ... }:
+  nodes.machine = { ... }:
 
   {
     imports = [ ./common/user-account.nix ];
diff --git a/nixos/tests/plasma5.nix b/nixos/tests/plasma5.nix
index 5c7ea602f79e0..3358a72570e87 100644
--- a/nixos/tests/plasma5.nix
+++ b/nixos/tests/plasma5.nix
@@ -6,7 +6,7 @@ import ./make-test-python.nix ({ pkgs, ...} :
     maintainers = [ ttuegel ];
   };
 
-  machine = { ... }:
+  nodes.machine = { ... }:
 
   {
     imports = [ ./common/user-account.nix ];
diff --git a/nixos/tests/plausible.nix b/nixos/tests/plausible.nix
index 58c1dd5cf4a80..ab91e08beb349 100644
--- a/nixos/tests/plausible.nix
+++ b/nixos/tests/plausible.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
     maintainers = [ ma27 ];
   };
 
-  machine = { pkgs, ... }: {
+  nodes.machine = { pkgs, ... }: {
     virtualisation.memorySize = 4096;
     services.plausible = {
       enable = true;
diff --git a/nixos/tests/plikd.nix b/nixos/tests/plikd.nix
index 8fec93c01f6bf..643fd5bfcd376 100644
--- a/nixos/tests/plikd.nix
+++ b/nixos/tests/plikd.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ lib, ... }: {
     maintainers = [ freezeboy ];
   };
 
-  machine = { pkgs, ... }: let
+  nodes.machine = { pkgs, ... }: let
   in {
     services.plikd.enable = true;
     environment.systemPackages = [ pkgs.plik ];
diff --git a/nixos/tests/plotinus.nix b/nixos/tests/plotinus.nix
index af38b41813b7b..b6ebab9b01989 100644
--- a/nixos/tests/plotinus.nix
+++ b/nixos/tests/plotinus.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
     maintainers = pkgs.plotinus.meta.maintainers;
   };
 
-  machine =
+  nodes.machine =
     { pkgs, ... }:
 
     { imports = [ ./common/x11.nix ];
diff --git a/nixos/tests/postfix-raise-smtpd-tls-security-level.nix b/nixos/tests/postfix-raise-smtpd-tls-security-level.nix
index 5fad1fed75b20..2a6c85a3a9202 100644
--- a/nixos/tests/postfix-raise-smtpd-tls-security-level.nix
+++ b/nixos/tests/postfix-raise-smtpd-tls-security-level.nix
@@ -1,7 +1,7 @@
 import ./make-test-python.nix {
   name = "postfix";
 
-  machine = { pkgs, ... }: {
+  nodes.machine = { pkgs, ... }: {
     imports = [ common/user-account.nix ];
     services.postfix = {
       enable = true;
diff --git a/nixos/tests/postfix.nix b/nixos/tests/postfix.nix
index 6d22b4edba0a2..1dbe6a4c51934 100644
--- a/nixos/tests/postfix.nix
+++ b/nixos/tests/postfix.nix
@@ -5,7 +5,7 @@ in
 import ./make-test-python.nix {
   name = "postfix";
 
-  machine = { pkgs, ... }: {
+  nodes.machine = { pkgs, ... }: {
     imports = [ common/user-account.nix ];
     services.postfix = {
       enable = true;
diff --git a/nixos/tests/postgresql-wal-receiver.nix b/nixos/tests/postgresql-wal-receiver.nix
index 0e8b3bfd6c34f..ae2708546f5db 100644
--- a/nixos/tests/postgresql-wal-receiver.nix
+++ b/nixos/tests/postgresql-wal-receiver.nix
@@ -31,7 +31,7 @@ let
         name = "postgresql-wal-receiver-${postgresqlPackage}";
         meta.maintainers = with lib.maintainers; [ pacien ];
 
-        machine = { ... }: {
+        nodes.machine = { ... }: {
           services.postgresql = {
             package = pkg;
             enable = true;
diff --git a/nixos/tests/postgresql.nix b/nixos/tests/postgresql.nix
index 2b487c20a6258..7864f5d6ff32c 100644
--- a/nixos/tests/postgresql.nix
+++ b/nixos/tests/postgresql.nix
@@ -27,7 +27,7 @@ let
       maintainers = [ zagy ];
     };
 
-    machine = {...}:
+    nodes.machine = {...}:
       {
         services.postgresql = {
           enable = true;
diff --git a/nixos/tests/power-profiles-daemon.nix b/nixos/tests/power-profiles-daemon.nix
index e073677bee9d7..278e94711830a 100644
--- a/nixos/tests/power-profiles-daemon.nix
+++ b/nixos/tests/power-profiles-daemon.nix
@@ -5,7 +5,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
   meta = with pkgs.lib.maintainers; {
     maintainers = [ mvnetbiz ];
   };
-  machine = { pkgs, ... }: {
+  nodes.machine = { pkgs, ... }: {
     services.power-profiles-daemon.enable = true;
     environment.systemPackages = [ pkgs.glib ];
   };
diff --git a/nixos/tests/predictable-interface-names.nix b/nixos/tests/predictable-interface-names.nix
index c0b472638a14d..08773120bc127 100644
--- a/nixos/tests/predictable-interface-names.nix
+++ b/nixos/tests/predictable-interface-names.nix
@@ -16,7 +16,7 @@ in pkgs.lib.listToAttrs (builtins.map ({ predictable, withNetworkd }: {
     name = "${if predictable then "" else "un"}predictableInterfaceNames${if withNetworkd then "-with-networkd" else ""}";
     meta = {};
 
-    machine = { lib, ... }: {
+    nodes.machine = { lib, ... }: {
       networking.usePredictableInterfaceNames = lib.mkForce predictable;
       networking.useNetworkd = withNetworkd;
       networking.dhcpcd.enable = !withNetworkd;
diff --git a/nixos/tests/privacyidea.nix b/nixos/tests/privacyidea.nix
index c1141465ec24e..fb072514dd90f 100644
--- a/nixos/tests/privacyidea.nix
+++ b/nixos/tests/privacyidea.nix
@@ -6,7 +6,7 @@ import ./make-test-python.nix ({ pkgs, ...} : rec {
     maintainers = [ fpletz ];
   };
 
-  machine = { ... }: {
+  nodes.machine = { ... }: {
     virtualisation.cores = 2;
 
     services.privacyidea = {
diff --git a/nixos/tests/privoxy.nix b/nixos/tests/privoxy.nix
index d16cc498691fd..47072ce4b0afb 100644
--- a/nixos/tests/privoxy.nix
+++ b/nixos/tests/privoxy.nix
@@ -33,7 +33,7 @@ in
     maintainers = [ rnhmjoj ];
   };
 
-  machine = { ... }: {
+  nodes.machine = { ... }: {
     services.nginx.enable = true;
     services.nginx.virtualHosts."example.com" = {
       addSSL = true;
diff --git a/nixos/tests/pt2-clone.nix b/nixos/tests/pt2-clone.nix
index 364920c398711..ea4329c4a9806 100644
--- a/nixos/tests/pt2-clone.nix
+++ b/nixos/tests/pt2-clone.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
     maintainers = [ fgaz ];
   };
 
-  machine = { config, pkgs, ... }: {
+  nodes.machine = { config, pkgs, ... }: {
     imports = [
       ./common/x11.nix
     ];
diff --git a/nixos/tests/pulseaudio.nix b/nixos/tests/pulseaudio.nix
index 4e2ce679acd71..cfdc61bc6c2b8 100644
--- a/nixos/tests/pulseaudio.nix
+++ b/nixos/tests/pulseaudio.nix
@@ -27,7 +27,7 @@ let
           maintainers = [ synthetica ] ++ pkgs.pulseaudio.meta.maintainers;
         };
 
-        machine = { ... }:
+        nodes.machine = { ... }:
 
           {
             imports = [ ./common/wayland-cage.nix ];
diff --git a/nixos/tests/qboot.nix b/nixos/tests/qboot.nix
index 12aef6decfaed..29d999be58e5b 100644
--- a/nixos/tests/qboot.nix
+++ b/nixos/tests/qboot.nix
@@ -1,7 +1,7 @@
 import ./make-test-python.nix ({ pkgs, ...} : {
   name = "qboot";
 
-  machine = { ... }: {
+  nodes.machine = { ... }: {
     virtualisation.bios = pkgs.qboot;
   };
 
diff --git a/nixos/tests/rabbitmq.nix b/nixos/tests/rabbitmq.nix
index 03f1fa46d29e3..831335d8c5186 100644
--- a/nixos/tests/rabbitmq.nix
+++ b/nixos/tests/rabbitmq.nix
@@ -6,7 +6,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
     maintainers = [ eelco offline ];
   };
 
-  machine = {
+  nodes.machine = {
     services.rabbitmq = {
       enable = true;
       managementPlugin.enable = true;
diff --git a/nixos/tests/radicale.nix b/nixos/tests/radicale.nix
index 5101628a682c6..66650dce4a008 100644
--- a/nixos/tests/radicale.nix
+++ b/nixos/tests/radicale.nix
@@ -11,7 +11,7 @@ in {
   name = "radicale3";
   meta.maintainers = with lib.maintainers; [ dotlambda ];
 
-  machine = { pkgs, ... }: {
+  nodes.machine = { pkgs, ... }: {
     services.radicale = {
       enable = true;
       settings = {
diff --git a/nixos/tests/rasdaemon.nix b/nixos/tests/rasdaemon.nix
index e4bd8d96a8d53..7f30a3b81ab55 100644
--- a/nixos/tests/rasdaemon.nix
+++ b/nixos/tests/rasdaemon.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, ... } : {
     maintainers = [ evils ];
   };
 
-  machine = { pkgs, ... }: {
+  nodes.machine = { pkgs, ... }: {
     imports = [ ../modules/profiles/minimal.nix ];
     hardware.rasdaemon = {
       enable = true;
diff --git a/nixos/tests/redmine.nix b/nixos/tests/redmine.nix
index 3866a1f528c05..621b3e6a36eee 100644
--- a/nixos/tests/redmine.nix
+++ b/nixos/tests/redmine.nix
@@ -9,7 +9,7 @@ with pkgs.lib;
 let
   redmineTest = { name, type }: makeTest {
     name = "redmine-${name}";
-    machine = { config, pkgs, ... }: {
+    nodes.machine = { config, pkgs, ... }: {
       services.redmine = {
         enable = true;
         package = pkgs.redmine;
diff --git a/nixos/tests/restart-by-activation-script.nix b/nixos/tests/restart-by-activation-script.nix
index 0eec292ea9e2b..0ac079e0101e0 100644
--- a/nixos/tests/restart-by-activation-script.nix
+++ b/nixos/tests/restart-by-activation-script.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, ...} : {
     maintainers = [ das_j ];
   };
 
-  machine = { pkgs, ... }: {
+  nodes.machine = { pkgs, ... }: {
     imports = [ ../modules/profiles/minimal.nix ];
 
     systemd.services.restart-me = {
diff --git a/nixos/tests/retroarch.nix b/nixos/tests/retroarch.nix
index 4c96f9eabc824..c506ed02da89b 100644
--- a/nixos/tests/retroarch.nix
+++ b/nixos/tests/retroarch.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
     name = "retroarch";
     meta = with pkgs.lib.maintainers; { maintainers = [ j0hax ]; };
 
-    machine = { ... }:
+    nodes.machine = { ... }:
 
       {
         imports = [ ./common/user-account.nix ];
diff --git a/nixos/tests/riak.nix b/nixos/tests/riak.nix
index 3dd4e333d6691..e75d40fa25695 100644
--- a/nixos/tests/riak.nix
+++ b/nixos/tests/riak.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ lib, pkgs, ... }: {
     maintainers = [ Br1ght0ne ];
   };
 
-  machine = {
+  nodes.machine = {
     services.riak.enable = true;
     services.riak.package = pkgs.riak;
   };
diff --git a/nixos/tests/rspamd.nix b/nixos/tests/rspamd.nix
index f0ccfe7ea0e6a..26895fbad3f3b 100644
--- a/nixos/tests/rspamd.nix
+++ b/nixos/tests/rspamd.nix
@@ -22,7 +22,7 @@ let
   '';
   simple = name: enableIPv6: makeTest {
     name = "rspamd-${name}";
-    machine = {
+    nodes.machine = {
       services.rspamd.enable = true;
       networking.enableIPv6 = enableIPv6;
     };
@@ -52,7 +52,7 @@ in
   ipv4only = simple "ipv4only" false;
   deprecated = makeTest {
     name = "rspamd-deprecated";
-    machine = {
+    nodes.machine = {
       services.rspamd = {
         enable = true;
         workers.normal.bindSockets = [{
@@ -91,7 +91,7 @@ in
 
   bindports = makeTest {
     name = "rspamd-bindports";
-    machine = {
+    nodes.machine = {
       services.rspamd = {
         enable = true;
         workers.normal.bindSockets = [{
@@ -152,7 +152,7 @@ in
   };
   customLuaRules = makeTest {
     name = "rspamd-custom-lua-rules";
-    machine = {
+    nodes.machine = {
       environment.etc."tests/no-muh.eml".text = ''
         From: Sheep1<bah@example.com>
         To: Sheep2<mah@example.com>
@@ -256,7 +256,7 @@ in
   };
   postfixIntegration = makeTest {
     name = "rspamd-postfix-integration";
-    machine = {
+    nodes.machine = {
       environment.systemPackages = with pkgs; [ msmtp ];
       environment.etc."tests/gtube.eml".text = ''
         From: Sheep1<bah@example.com>
diff --git a/nixos/tests/rsyslogd.nix b/nixos/tests/rsyslogd.nix
index f35db3bd44b83..049acdcd43934 100644
--- a/nixos/tests/rsyslogd.nix
+++ b/nixos/tests/rsyslogd.nix
@@ -11,7 +11,7 @@ with pkgs.lib;
     name = "rsyslogd-test1";
     meta.maintainers = [ pkgs.lib.maintainers.aanderse ];
 
-    machine = { config, pkgs, ... }: {
+    nodes.machine = { config, pkgs, ... }: {
       services.rsyslogd.enable = true;
       services.journald.forwardToSyslog = false;
     };
@@ -27,7 +27,7 @@ with pkgs.lib;
     name = "rsyslogd-test2";
     meta.maintainers = [ pkgs.lib.maintainers.aanderse ];
 
-    machine = { config, pkgs, ... }: {
+    nodes.machine = { config, pkgs, ... }: {
       services.rsyslogd.enable = true;
     };
 
diff --git a/nixos/tests/sabnzbd.nix b/nixos/tests/sabnzbd.nix
index fb35b212b493b..075bd0b1fe093 100644
--- a/nixos/tests/sabnzbd.nix
+++ b/nixos/tests/sabnzbd.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
     maintainers = with maintainers; [ jojosch ];
   };
 
-  machine = { pkgs, ... }: {
+  nodes.machine = { pkgs, ... }: {
     services.sabnzbd = {
       enable = true;
     };
diff --git a/nixos/tests/sddm.nix b/nixos/tests/sddm.nix
index d7c65fa33d67c..c76a9683e66d0 100644
--- a/nixos/tests/sddm.nix
+++ b/nixos/tests/sddm.nix
@@ -12,7 +12,7 @@ let
     default = {
       name = "sddm";
 
-      machine = { ... }: {
+      nodes.machine = { ... }: {
         imports = [ ./common/user-account.nix ];
         services.xserver.enable = true;
         services.xserver.displayManager.sddm.enable = true;
@@ -41,7 +41,7 @@ let
         maintainers = [ ttuegel ];
       };
 
-      machine = { ... }: {
+      nodes.machine = { ... }: {
         imports = [ ./common/user-account.nix ];
         services.xserver.enable = true;
         services.xserver.displayManager = {
diff --git a/nixos/tests/shattered-pixel-dungeon.nix b/nixos/tests/shattered-pixel-dungeon.nix
index d4e5de22ab9d0..a256bbdfd7357 100644
--- a/nixos/tests/shattered-pixel-dungeon.nix
+++ b/nixos/tests/shattered-pixel-dungeon.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
     maintainers = [ fgaz ];
   };
 
-  machine = { config, pkgs, ... }: {
+  nodes.machine = { config, pkgs, ... }: {
     imports = [
       ./common/x11.nix
     ];
diff --git a/nixos/tests/shiori.nix b/nixos/tests/shiori.nix
index 6c59c394009e6..d0f68b903f8c3 100644
--- a/nixos/tests/shiori.nix
+++ b/nixos/tests/shiori.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, lib, ...}:
   name = "shiori";
   meta.maintainers = with lib.maintainers; [ minijackson ];
 
-  machine =
+  nodes.machine =
     { ... }:
     { services.shiori.enable = true; };
 
diff --git a/nixos/tests/signal-desktop.nix b/nixos/tests/signal-desktop.nix
index 8c72306299230..fbe9cdf84d05a 100644
--- a/nixos/tests/signal-desktop.nix
+++ b/nixos/tests/signal-desktop.nix
@@ -16,7 +16,7 @@ in {
     maintainers = [ flokli primeos ];
   };
 
-  machine = { ... }:
+  nodes.machine = { ... }:
 
   {
     imports = [
diff --git a/nixos/tests/simple.nix b/nixos/tests/simple.nix
index b4d90f750ecfb..c36287b4e843b 100644
--- a/nixos/tests/simple.nix
+++ b/nixos/tests/simple.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, ...} : {
     maintainers = [ eelco ];
   };
 
-  machine = { ... }: {
+  nodes.machine = { ... }: {
     imports = [ ../modules/profiles/minimal.nix ];
   };
 
diff --git a/nixos/tests/snapper.nix b/nixos/tests/snapper.nix
index 098d8d9d72f55..651adc8934d38 100644
--- a/nixos/tests/snapper.nix
+++ b/nixos/tests/snapper.nix
@@ -2,7 +2,7 @@ import ./make-test-python.nix ({ ... }:
 {
   name = "snapper";
 
-  machine = { pkgs, lib, ... }: {
+  nodes.machine = { pkgs, lib, ... }: {
     boot.initrd.postDeviceCommands = ''
       ${pkgs.btrfs-progs}/bin/mkfs.btrfs -f -L aux /dev/vdb
     '';
diff --git a/nixos/tests/soapui.nix b/nixos/tests/soapui.nix
index 76a87ed5efa1c..e4ce3888fd437 100644
--- a/nixos/tests/soapui.nix
+++ b/nixos/tests/soapui.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
     maintainers = [ asbachb ];
   };
 
-  machine = { config, pkgs, ... }: {
+  nodes.machine = { config, pkgs, ... }: {
     imports = [
       ./common/x11.nix
     ];
diff --git a/nixos/tests/solr.nix b/nixos/tests/solr.nix
index 86efe87c70783..33afe9d788f78 100644
--- a/nixos/tests/solr.nix
+++ b/nixos/tests/solr.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
   name = "solr";
   meta.maintainers = [ pkgs.lib.maintainers.aanderse ];
 
-  machine =
+  nodes.machine =
     { config, pkgs, ... }:
     {
       # Ensure the virtual machine has enough memory for Solr to avoid the following error:
diff --git a/nixos/tests/sourcehut.nix b/nixos/tests/sourcehut.nix
index 55757e35f9b43..34a60247e00e5 100644
--- a/nixos/tests/sourcehut.nix
+++ b/nixos/tests/sourcehut.nix
@@ -119,7 +119,7 @@ in
 
   meta.maintainers = [ pkgs.lib.maintainers.tomberek ];
 
-  machine = { config, pkgs, nodes, ... }: {
+  nodes.machine = { config, pkgs, nodes, ... }: {
     # buildsrht needs space
     virtualisation.diskSize = 4 * 1024;
     virtualisation.memorySize = 2 * 1024;
diff --git a/nixos/tests/sssd-ldap.nix b/nixos/tests/sssd-ldap.nix
index 5c58eaef7146f..f816c0652cc55 100644
--- a/nixos/tests/sssd-ldap.nix
+++ b/nixos/tests/sssd-ldap.nix
@@ -13,7 +13,7 @@ in import ./make-test-python.nix ({pkgs, ...}: {
     maintainers = [ bbigras ];
   };
 
-  machine = { pkgs, ... }: {
+  nodes.machine = { pkgs, ... }: {
     services.openldap = {
       enable = true;
       settings = {
diff --git a/nixos/tests/sssd.nix b/nixos/tests/sssd.nix
index 5c1abdca6aef4..25527cb59a59b 100644
--- a/nixos/tests/sssd.nix
+++ b/nixos/tests/sssd.nix
@@ -5,7 +5,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
   meta = with pkgs.lib.maintainers; {
     maintainers = [ bbigras ];
   };
-  machine = { pkgs, ... }: {
+  nodes.machine = { pkgs, ... }: {
     services.sssd.enable = true;
   };
 
diff --git a/nixos/tests/starship.nix b/nixos/tests/starship.nix
index 33e9a72f70000..48a4be6caf176 100644
--- a/nixos/tests/starship.nix
+++ b/nixos/tests/starship.nix
@@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
   name = "starship";
   meta.maintainers = pkgs.starship.meta.maintainers;
 
-  machine = {
+  nodes.machine = {
     programs = {
       fish.enable = true;
       zsh.enable = true;
diff --git a/nixos/tests/sway.nix b/nixos/tests/sway.nix
index 1e9e146c4b6ce..8f95f2a030d1b 100644
--- a/nixos/tests/sway.nix
+++ b/nixos/tests/sway.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
     maintainers = with lib.maintainers; [ primeos synthetica ];
   };
 
-  machine = { config, ... }: {
+  nodes.machine = { config, ... }: {
     # Automatically login on tty1 as a normal user:
     imports = [ ./common/user-account.nix ];
     services.getty.autologinUser = "alice";
diff --git a/nixos/tests/sympa.nix b/nixos/tests/sympa.nix
index aad7c95b6c99c..76ca17d0a1890 100644
--- a/nixos/tests/sympa.nix
+++ b/nixos/tests/sympa.nix
@@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
   name = "sympa";
   meta.maintainers = with lib.maintainers; [ mmilata ];
 
-  machine =
+  nodes.machine =
     { ... }:
     {
 
diff --git a/nixos/tests/syncthing-init.nix b/nixos/tests/syncthing-init.nix
index 8b60ad7faf090..fcd90739e6a55 100644
--- a/nixos/tests/syncthing-init.nix
+++ b/nixos/tests/syncthing-init.nix
@@ -6,7 +6,7 @@ in {
   name = "syncthing-init";
   meta.maintainers = with pkgs.lib.maintainers; [ lassulus ];
 
-  machine = {
+  nodes.machine = {
     services.syncthing = {
       enable = true;
       devices.testDevice = {
diff --git a/nixos/tests/syncthing-relay.nix b/nixos/tests/syncthing-relay.nix
index a0233c969ec06..3d70b1eda7b2a 100644
--- a/nixos/tests/syncthing-relay.nix
+++ b/nixos/tests/syncthing-relay.nix
@@ -2,7 +2,7 @@ import ./make-test-python.nix ({ lib, pkgs, ... }: {
   name = "syncthing-relay";
   meta.maintainers = with pkgs.lib.maintainers; [ delroth ];
 
-  machine = {
+  nodes.machine = {
     environment.systemPackages = [ pkgs.jq ];
     services.syncthing.relay = {
       enable = true;
diff --git a/nixos/tests/systemd-analyze.nix b/nixos/tests/systemd-analyze.nix
index 186f5aee7b85e..31588e2b41aa5 100644
--- a/nixos/tests/systemd-analyze.nix
+++ b/nixos/tests/systemd-analyze.nix
@@ -6,7 +6,7 @@ import ./make-test-python.nix ({ pkgs, latestKernel ? false, ... }:
     maintainers = [ raskin ];
   };
 
-  machine =
+  nodes.machine =
     { pkgs, lib, ... }:
     { boot.kernelPackages = lib.mkIf latestKernel pkgs.linuxPackages_latest;
       sound.enable = true; # needed for the factl test, /dev/snd/* exists without them but udev doesn't care then
diff --git a/nixos/tests/systemd-binfmt.nix b/nixos/tests/systemd-binfmt.nix
index a3a6efac3e4dc..b16fda0ddb1a6 100644
--- a/nixos/tests/systemd-binfmt.nix
+++ b/nixos/tests/systemd-binfmt.nix
@@ -31,7 +31,7 @@ let
 in {
   basic = makeTest {
     name = "systemd-binfmt";
-    machine = {
+    nodes.machine = {
       boot.binfmt.emulatedSystems = [
         "armv7l-linux"
         "aarch64-linux"
@@ -56,7 +56,7 @@ in {
 
   preserveArgvZero = makeTest {
     name = "systemd-binfmt-preserve-argv0";
-    machine = {
+    nodes.machine = {
       boot.binfmt.emulatedSystems = [
         "aarch64-linux"
       ];
@@ -71,7 +71,7 @@ in {
 
   ldPreload = makeTest {
     name = "systemd-binfmt-ld-preload";
-    machine = {
+    nodes.machine = {
       boot.binfmt.emulatedSystems = [
         "aarch64-linux"
       ];
diff --git a/nixos/tests/systemd-boot.nix b/nixos/tests/systemd-boot.nix
index 51cfd82e6c4bb..039e6bdd9d5ab 100644
--- a/nixos/tests/systemd-boot.nix
+++ b/nixos/tests/systemd-boot.nix
@@ -20,7 +20,7 @@ in
     name = "systemd-boot";
     meta.maintainers = with pkgs.lib.maintainers; [ danielfullmer ];
 
-    machine = common;
+    nodes.machine = common;
 
     testScript = ''
       machine.start()
@@ -44,7 +44,7 @@ in
     name = "systemd-boot-specialisation";
     meta.maintainers = with pkgs.lib.maintainers; [ lukegb ];
 
-    machine = { pkgs, lib, ... }: {
+    nodes.machine = { pkgs, lib, ... }: {
       imports = [ common ];
       specialisation.something.configuration = {};
     };
@@ -67,7 +67,7 @@ in
     name = "systemd-boot-fallback";
     meta.maintainers = with pkgs.lib.maintainers; [ danielfullmer ];
 
-    machine = { pkgs, lib, ... }: {
+    nodes.machine = { pkgs, lib, ... }: {
       imports = [ common ];
       boot.loader.efi.canTouchEfiVariables = mkForce false;
     };
@@ -93,7 +93,7 @@ in
     name = "systemd-boot-update";
     meta.maintainers = with pkgs.lib.maintainers; [ danielfullmer ];
 
-    machine = common;
+    nodes.machine = common;
 
     testScript = ''
       machine.succeed("mount -o remount,rw /boot")
@@ -115,7 +115,7 @@ in
     name = "systemd-boot-memtest86";
     meta.maintainers = with pkgs.lib.maintainers; [ Enzime ];
 
-    machine = { pkgs, lib, ... }: {
+    nodes.machine = { pkgs, lib, ... }: {
       imports = [ common ];
       boot.loader.systemd-boot.memtest86.enable = true;
       nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
@@ -133,7 +133,7 @@ in
     name = "systemd-boot-netbootxyz";
     meta.maintainers = with pkgs.lib.maintainers; [ Enzime ];
 
-    machine = { pkgs, lib, ... }: {
+    nodes.machine = { pkgs, lib, ... }: {
       imports = [ common ];
       boot.loader.systemd-boot.netbootxyz.enable = true;
     };
@@ -148,7 +148,7 @@ in
     name = "systemd-boot-entry-filename";
     meta.maintainers = with pkgs.lib.maintainers; [ Enzime ];
 
-    machine = { pkgs, lib, ... }: {
+    nodes.machine = { pkgs, lib, ... }: {
       imports = [ common ];
       boot.loader.systemd-boot.memtest86.enable = true;
       boot.loader.systemd-boot.memtest86.entryFilename = "apple.conf";
@@ -168,7 +168,7 @@ in
     name = "systemd-boot-extra-entries";
     meta.maintainers = with pkgs.lib.maintainers; [ Enzime ];
 
-    machine = { pkgs, lib, ... }: {
+    nodes.machine = { pkgs, lib, ... }: {
       imports = [ common ];
       boot.loader.systemd-boot.extraEntries = {
         "banana.conf" = ''
@@ -187,7 +187,7 @@ in
     name = "systemd-boot-extra-files";
     meta.maintainers = with pkgs.lib.maintainers; [ Enzime ];
 
-    machine = { pkgs, lib, ... }: {
+    nodes.machine = { pkgs, lib, ... }: {
       imports = [ common ];
       boot.loader.systemd-boot.extraFiles = {
         "efi/fruits/tomato.efi" = pkgs.netbootxyz-efi;
diff --git a/nixos/tests/systemd-confinement.nix b/nixos/tests/systemd-confinement.nix
index 3181af309a6e2..bde5b770ea50d 100644
--- a/nixos/tests/systemd-confinement.nix
+++ b/nixos/tests/systemd-confinement.nix
@@ -1,7 +1,7 @@
 import ./make-test-python.nix {
   name = "systemd-confinement";
 
-  machine = { pkgs, lib, ... }: let
+  nodes.machine = { pkgs, lib, ... }: let
     testServer = pkgs.writeScript "testserver.sh" ''
       #!${pkgs.runtimeShell}
       export PATH=${lib.escapeShellArg "${pkgs.coreutils}/bin"}
diff --git a/nixos/tests/systemd-cryptenroll.nix b/nixos/tests/systemd-cryptenroll.nix
index 49634ef65672c..055ae7d1681f2 100644
--- a/nixos/tests/systemd-cryptenroll.nix
+++ b/nixos/tests/systemd-cryptenroll.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
     maintainers = [ ymatsiuk ];
   };
 
-  machine = { pkgs, lib, ... }: {
+  nodes.machine = { pkgs, lib, ... }: {
     environment.systemPackages = [ pkgs.cryptsetup ];
     virtualisation = {
       emptyDiskImages = [ 512 ];
diff --git a/nixos/tests/systemd-escaping.nix b/nixos/tests/systemd-escaping.nix
index 7f93eb5e4f70c..29d2ed1aa3523 100644
--- a/nixos/tests/systemd-escaping.nix
+++ b/nixos/tests/systemd-escaping.nix
@@ -14,7 +14,7 @@ in
 {
   name = "systemd-escaping";
 
-  machine = { pkgs, lib, utils, ... }: {
+  nodes.machine = { pkgs, lib, utils, ... }: {
     systemd.services.echo =
       assert !(builtins.tryEval (utils.escapeSystemdExecArgs [ [] ])).success;
       assert !(builtins.tryEval (utils.escapeSystemdExecArgs [ {} ])).success;
diff --git a/nixos/tests/systemd-journal.nix b/nixos/tests/systemd-journal.nix
index 6ab7c72463181..d2063a3b9a44e 100644
--- a/nixos/tests/systemd-journal.nix
+++ b/nixos/tests/systemd-journal.nix
@@ -6,7 +6,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
     maintainers = [ lewo ];
   };
 
-  machine = { pkgs, lib, ... }: {
+  nodes.machine = { pkgs, lib, ... }: {
     services.journald.enableHttpGateway = true;
   };
 
diff --git a/nixos/tests/systemd-machinectl.nix b/nixos/tests/systemd-machinectl.nix
index 4fc5864357c00..ce0c56a360e96 100644
--- a/nixos/tests/systemd-machinectl.nix
+++ b/nixos/tests/systemd-machinectl.nix
@@ -28,7 +28,7 @@ import ./make-test-python.nix (
   {
     name = "systemd-machinectl";
 
-    machine = { lib, ... }: {
+    nodes.machine = { lib, ... }: {
       # use networkd to obtain systemd network setup
       networking.useNetworkd = true;
       networking.useDHCP = false;
diff --git a/nixos/tests/systemd-misc.nix b/nixos/tests/systemd-misc.nix
index e416baa8b5f56..0ddd51100463e 100644
--- a/nixos/tests/systemd-misc.nix
+++ b/nixos/tests/systemd-misc.nix
@@ -31,7 +31,7 @@ in
 {
   name = "systemd-misc";
 
-  machine = { pkgs, lib, ... }: {
+  nodes.machine = { pkgs, lib, ... }: {
     boot.extraSystemdUnitPaths = [ "/etc/systemd-rw/system" ];
 
     users.users.limited = {
diff --git a/nixos/tests/systemd.nix b/nixos/tests/systemd.nix
index 94805ee5781a1..3317823e03f76 100644
--- a/nixos/tests/systemd.nix
+++ b/nixos/tests/systemd.nix
@@ -1,7 +1,7 @@
 import ./make-test-python.nix ({ pkgs, ... }: {
   name = "systemd";
 
-  machine = { lib, ... }: {
+  nodes.machine = { lib, ... }: {
     imports = [ common/user-account.nix common/x11.nix ];
 
     virtualisation.emptyDiskImages = [ 512 512 ];
diff --git a/nixos/tests/telegraf.nix b/nixos/tests/telegraf.nix
index d99680ce2c3c4..c3cdb1645213a 100644
--- a/nixos/tests/telegraf.nix
+++ b/nixos/tests/telegraf.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, ...} : {
     maintainers = [ mic92 ];
   };
 
-  machine = { ... }: {
+  nodes.machine = { ... }: {
     services.telegraf.enable = true;
     services.telegraf.environmentFiles = [(pkgs.writeText "secrets" ''
       SECRET=example
diff --git a/nixos/tests/tinywl.nix b/nixos/tests/tinywl.nix
index 8fb87b533306c..411cdb1f64192 100644
--- a/nixos/tests/tinywl.nix
+++ b/nixos/tests/tinywl.nix
@@ -6,7 +6,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
       maintainers = with lib.maintainers; [ primeos ];
     };
 
-    machine = { config, ... }: {
+    nodes.machine = { config, ... }: {
       # Automatically login on tty1 as a normal user:
       imports = [ ./common/user-account.nix ];
       services.getty.autologinUser = "alice";
diff --git a/nixos/tests/tomcat.nix b/nixos/tests/tomcat.nix
index e383f224e3d16..4cfb3cc5a7d84 100644
--- a/nixos/tests/tomcat.nix
+++ b/nixos/tests/tomcat.nix
@@ -3,7 +3,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
 {
   name = "tomcat";
 
-  machine = { pkgs, ... }: {
+  nodes.machine = { pkgs, ... }: {
     services.tomcat.enable = true;
   };
 
diff --git a/nixos/tests/transmission.nix b/nixos/tests/transmission.nix
index 7e2648804de21..b69ddd84d009a 100644
--- a/nixos/tests/transmission.nix
+++ b/nixos/tests/transmission.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, ...} : {
     maintainers = [ coconnor ];
   };
 
-  machine = { ... }: {
+  nodes.machine = { ... }: {
     imports = [ ../modules/profiles/minimal.nix ];
 
     networking.firewall.allowedTCPPorts = [ 9091 ];
diff --git a/nixos/tests/tsm-client-gui.nix b/nixos/tests/tsm-client-gui.nix
index e4bcd344a8957..e11501da53d0c 100644
--- a/nixos/tests/tsm-client-gui.nix
+++ b/nixos/tests/tsm-client-gui.nix
@@ -10,7 +10,7 @@ import ./make-test-python.nix ({ lib, pkgs, ... }: {
 
   enableOCR = true;
 
-  machine = { pkgs, ... }: {
+  nodes.machine = { pkgs, ... }: {
     imports = [ ./common/x11.nix ];
     programs.tsmClient = {
       enable = true;
diff --git a/nixos/tests/tuptime.nix b/nixos/tests/tuptime.nix
index 6d37e30698390..93410de7bdf52 100644
--- a/nixos/tests/tuptime.nix
+++ b/nixos/tests/tuptime.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, ...} : {
     maintainers = [ evils ];
   };
 
-  machine = { pkgs, ... }: {
+  nodes.machine = { pkgs, ... }: {
     imports = [ ../modules/profiles/minimal.nix ];
     services.tuptime.enable = true;
   };
diff --git a/nixos/tests/turbovnc-headless-server.nix b/nixos/tests/turbovnc-headless-server.nix
index 7d705c56ecf31..1dbf9297c8131 100644
--- a/nixos/tests/turbovnc-headless-server.nix
+++ b/nixos/tests/turbovnc-headless-server.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
     maintainers = with lib.maintainers; [ nh2 ];
   };
 
-  machine = { pkgs, ... }: {
+  nodes.machine = { pkgs, ... }: {
 
     environment.systemPackages = with pkgs; [
       glxinfo
diff --git a/nixos/tests/tuxguitar.nix b/nixos/tests/tuxguitar.nix
index 63a7b6c7dec9b..037f489e54483 100644
--- a/nixos/tests/tuxguitar.nix
+++ b/nixos/tests/tuxguitar.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
     maintainers = [ asbachb ];
   };
 
-  machine = { config, pkgs, ... }: {
+  nodes.machine = { config, pkgs, ... }: {
     imports = [
       ./common/x11.nix
     ];
diff --git a/nixos/tests/udisks2.nix b/nixos/tests/udisks2.nix
index 6c4b71aaa2eda..6afb200f85664 100644
--- a/nixos/tests/udisks2.nix
+++ b/nixos/tests/udisks2.nix
@@ -15,7 +15,7 @@ in
     maintainers = [ eelco ];
   };
 
-  machine =
+  nodes.machine =
     { ... }:
     { services.udisks2.enable = true;
       imports = [ ./common/user-account.nix ];
diff --git a/nixos/tests/usbguard.nix b/nixos/tests/usbguard.nix
index bb707bdbf7024..d6d3a80c5d23c 100644
--- a/nixos/tests/usbguard.nix
+++ b/nixos/tests/usbguard.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
     maintainers = [ tnias ];
   };
 
-  machine =
+  nodes.machine =
     { ... }:
     {
       services.usbguard = {
diff --git a/nixos/tests/user-activation-scripts.nix b/nixos/tests/user-activation-scripts.nix
index 0de8664c5ef07..9345735781873 100644
--- a/nixos/tests/user-activation-scripts.nix
+++ b/nixos/tests/user-activation-scripts.nix
@@ -2,7 +2,7 @@ import ./make-test-python.nix ({ lib, ... }: {
   name = "user-activation-scripts";
   meta = with lib.maintainers; { maintainers = [ chkno ]; };
 
-  machine = {
+  nodes.machine = {
     system.userActivationScripts.foo = "mktemp ~/user-activation-ran.XXXXXX";
     users.users.alice = {
       initialPassword = "pass1";
diff --git a/nixos/tests/uwsgi.nix b/nixos/tests/uwsgi.nix
index 80dcde324aad7..62da9e0a7168c 100644
--- a/nixos/tests/uwsgi.nix
+++ b/nixos/tests/uwsgi.nix
@@ -5,7 +5,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
     maintainers = [ lnl7 ];
   };
 
-  machine = { pkgs, ... }: {
+  nodes.machine = { pkgs, ... }: {
     users.users.hello  =
       { isSystemUser = true;
         group = "hello";
diff --git a/nixos/tests/v2ray.nix b/nixos/tests/v2ray.nix
index 4808e149d31ed..fb36ea8557d59 100644
--- a/nixos/tests/v2ray.nix
+++ b/nixos/tests/v2ray.nix
@@ -57,7 +57,7 @@ in {
   meta = with lib.maintainers; {
     maintainers = [ servalcatty ];
   };
-  machine = { pkgs, ... }: {
+  nodes.machine = { pkgs, ... }: {
     environment.systemPackages = [ pkgs.curl ];
     services.v2ray = {
       enable = true;
diff --git a/nixos/tests/vault-postgresql.nix b/nixos/tests/vault-postgresql.nix
index 2847af13cbf05..e0e5881c6da79 100644
--- a/nixos/tests/vault-postgresql.nix
+++ b/nixos/tests/vault-postgresql.nix
@@ -11,7 +11,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
   meta = with pkgs.lib.maintainers; {
     maintainers = [ lnl7 roberth ];
   };
-  machine = { lib, pkgs, ... }: {
+  nodes.machine = { lib, pkgs, ... }: {
     environment.systemPackages = [ pkgs.vault ];
     environment.variables.VAULT_ADDR = "http://127.0.0.1:8200";
     services.vault.enable = true;
diff --git a/nixos/tests/vault.nix b/nixos/tests/vault.nix
index e86acd5b593fb..1b0a26a4487f0 100644
--- a/nixos/tests/vault.nix
+++ b/nixos/tests/vault.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
   meta = with pkgs.lib.maintainers; {
     maintainers = [ lnl7 ];
   };
-  machine = { pkgs, ... }: {
+  nodes.machine = { pkgs, ... }: {
     environment.systemPackages = [ pkgs.vault ];
     environment.variables.VAULT_ADDR = "http://127.0.0.1:8200";
     services.vault.enable = true;
diff --git a/nixos/tests/vector.nix b/nixos/tests/vector.nix
index 583e60ddc5681..ecf94e33ff17e 100644
--- a/nixos/tests/vector.nix
+++ b/nixos/tests/vector.nix
@@ -9,7 +9,7 @@ with pkgs.lib;
     name = "vector-test1";
     meta.maintainers = [ pkgs.lib.maintainers.happysalada ];
 
-    machine = { config, pkgs, ... }: {
+    nodes.machine = { config, pkgs, ... }: {
       services.vector = {
         enable = true;
         journaldAccess = true;
diff --git a/nixos/tests/vengi-tools.nix b/nixos/tests/vengi-tools.nix
index 6b90542887d51..8b80a13384e5a 100644
--- a/nixos/tests/vengi-tools.nix
+++ b/nixos/tests/vengi-tools.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
     maintainers = [ fgaz ];
   };
 
-  machine = { config, pkgs, ... }: {
+  nodes.machine = { config, pkgs, ... }: {
     imports = [
       ./common/x11.nix
     ];
diff --git a/nixos/tests/virtualbox.nix b/nixos/tests/virtualbox.nix
index f15412d365fa9..27093aab96ee5 100644
--- a/nixos/tests/virtualbox.nix
+++ b/nixos/tests/virtualbox.nix
@@ -353,7 +353,7 @@ let
   mkVBoxTest = useExtensionPack: vms: name: testScript: makeTest {
     name = "virtualbox-${name}";
 
-    machine = { lib, config, ... }: {
+    nodes.machine = { lib, config, ... }: {
       imports = let
         mkVMConf = name: val: val.machine // { key = "${name}-config"; };
         vmConfigs = mapAttrsToList mkVMConf vms;
diff --git a/nixos/tests/web-servers/unit-php.nix b/nixos/tests/web-servers/unit-php.nix
index 00512b506cc2e..5bef7fab3efff 100644
--- a/nixos/tests/web-servers/unit-php.nix
+++ b/nixos/tests/web-servers/unit-php.nix
@@ -6,7 +6,7 @@ in {
   name = "unit-php-test";
   meta.maintainers = with pkgs.lib.maintainers; [ izorkin ];
 
-  machine = { config, lib, pkgs, ... }: {
+  nodes.machine = { config, lib, pkgs, ... }: {
     services.unit = {
       enable = true;
       config = pkgs.lib.strings.toJSON {
diff --git a/nixos/tests/wiki-js.nix b/nixos/tests/wiki-js.nix
index 783887d2dcaa9..c3541be5d8b52 100644
--- a/nixos/tests/wiki-js.nix
+++ b/nixos/tests/wiki-js.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
     maintainers = [ ma27 ];
   };
 
-  machine = { pkgs, ... }: {
+  nodes.machine = { pkgs, ... }: {
     virtualisation.memorySize = 2048;
     services.wiki-js = {
       enable = true;
diff --git a/nixos/tests/wine.nix b/nixos/tests/wine.nix
index 8135cb90a5914..8a64c3179c518 100644
--- a/nixos/tests/wine.nix
+++ b/nixos/tests/wine.nix
@@ -15,7 +15,7 @@ let
       inherit name;
       meta = with pkgs.lib.maintainers; { maintainers = [ chkno ]; };
 
-      machine = { pkgs, ... }: {
+      nodes.machine = { pkgs, ... }: {
         environment.systemPackages = [ pkgs."${packageSet}"."${variant}" ];
         virtualisation.diskSize = 800;
       };
diff --git a/nixos/tests/wmderland.nix b/nixos/tests/wmderland.nix
index 6de0cd9212eea..ebfd443763e1e 100644
--- a/nixos/tests/wmderland.nix
+++ b/nixos/tests/wmderland.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, ...} : {
     maintainers = [ takagiy ];
   };
 
-  machine = { lib, ... }: {
+  nodes.machine = { lib, ... }: {
     imports = [ ./common/x11.nix ./common/user-account.nix ];
     test-support.displayManager.auto.user = "alice";
     services.xserver.displayManager.defaultSession = lib.mkForce "none+wmderland";
diff --git a/nixos/tests/wpa_supplicant.nix b/nixos/tests/wpa_supplicant.nix
index 40d934b8e1db2..a05a79e8367d9 100644
--- a/nixos/tests/wpa_supplicant.nix
+++ b/nixos/tests/wpa_supplicant.nix
@@ -5,7 +5,7 @@ import ./make-test-python.nix ({ pkgs, lib, ...}:
     maintainers = [ rnhmjoj ];
   };
 
-  machine = { ... }: {
+  nodes.machine = { ... }: {
     imports = [ ../modules/profiles/minimal.nix ];
 
     # add a virtual wlan interface
diff --git a/nixos/tests/xfce.nix b/nixos/tests/xfce.nix
index 9051deebae76e..31f00f77c40d4 100644
--- a/nixos/tests/xfce.nix
+++ b/nixos/tests/xfce.nix
@@ -1,7 +1,7 @@
 import ./make-test-python.nix ({ pkgs, ...} : {
   name = "xfce";
 
-  machine =
+  nodes.machine =
     { pkgs, ... }:
 
     {
diff --git a/nixos/tests/xmonad.nix b/nixos/tests/xmonad.nix
index a2fb38e53bd15..aa55f0e3ca6f2 100644
--- a/nixos/tests/xmonad.nix
+++ b/nixos/tests/xmonad.nix
@@ -55,7 +55,7 @@ in {
     maintainers = [ nequissimus ivanbrennan ];
   };
 
-  machine = { pkgs, ... }: {
+  nodes.machine = { pkgs, ... }: {
     imports = [ ./common/x11.nix ./common/user-account.nix ];
     test-support.displayManager.auto.user = "alice";
     services.xserver.displayManager.defaultSession = "none+xmonad";
diff --git a/nixos/tests/xterm.nix b/nixos/tests/xterm.nix
index 4ee31139ab52b..745d33e8a0d53 100644
--- a/nixos/tests/xterm.nix
+++ b/nixos/tests/xterm.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, ...} : {
     maintainers = [ nequissimus ];
   };
 
-  machine = { pkgs, ... }:
+  nodes.machine = { pkgs, ... }:
     {
       imports = [ ./common/x11.nix ];
       services.xserver.desktopManager.xterm.enable = false;
diff --git a/nixos/tests/yabar.nix b/nixos/tests/yabar.nix
index c2431e556c378..ff7a47ae63709 100644
--- a/nixos/tests/yabar.nix
+++ b/nixos/tests/yabar.nix
@@ -8,7 +8,7 @@ with lib;
     maintainers = [ ];
   };
 
-  machine = {
+  nodes.machine = {
     imports = [ ./common/x11.nix ./common/user-account.nix ];
 
     test-support.displayManager.auto.user = "bob";
diff --git a/nixos/tests/zfs.nix b/nixos/tests/zfs.nix
index d25090403e5fa..bf0165b88162d 100644
--- a/nixos/tests/zfs.nix
+++ b/nixos/tests/zfs.nix
@@ -18,7 +18,7 @@ let
         maintainers = [ adisbladis ];
       };
 
-      machine = { pkgs, lib, ... }:
+      nodes.machine = { pkgs, lib, ... }:
         let
           usersharePath = "/var/lib/samba/usershares";
         in {
diff --git a/nixos/tests/zigbee2mqtt.nix b/nixos/tests/zigbee2mqtt.nix
index 98aadbb699bdf..1592202fb3a76 100644
--- a/nixos/tests/zigbee2mqtt.nix
+++ b/nixos/tests/zigbee2mqtt.nix
@@ -1,7 +1,7 @@
 import ./make-test-python.nix ({ pkgs, lib, ... }:
 
   {
-    machine = { pkgs, ... }:
+    nodes.machine = { pkgs, ... }:
       {
         services.zigbee2mqtt = {
           enable = true;
diff --git a/nixos/tests/zoneminder.nix b/nixos/tests/zoneminder.nix
index a4e1a05ec0ee4..3c97bc8282d22 100644
--- a/nixos/tests/zoneminder.nix
+++ b/nixos/tests/zoneminder.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ lib, ...}:
   name = "zoneminder";
   meta.maintainers = with lib.maintainers; [ danielfullmer ];
 
-  machine = { ... }:
+  nodes.machine = { ... }:
   {
     services.zoneminder = {
       enable = true;
diff --git a/pkgs/applications/audio/sonic-pi/default.nix b/pkgs/applications/audio/sonic-pi/default.nix
index e9d8f979e4ad1..b41bea58453ce 100644
--- a/pkgs/applications/audio/sonic-pi/default.nix
+++ b/pkgs/applications/audio/sonic-pi/default.nix
@@ -54,9 +54,9 @@ in
 mkDerivation rec {
   inherit pname version src;
 
+  nativeBuildInputs = [ cmake ];
   buildInputs = [
     bash
-    cmake
     pkg-config
     qtbase
     qwt
diff --git a/pkgs/applications/blockchains/go-ethereum/default.nix b/pkgs/applications/blockchains/go-ethereum/default.nix
index 842ebcc69ec81..661a25c8314b4 100644
--- a/pkgs/applications/blockchains/go-ethereum/default.nix
+++ b/pkgs/applications/blockchains/go-ethereum/default.nix
@@ -9,16 +9,16 @@ let
 
 in buildGoModule rec {
   pname = "go-ethereum";
-  version = "1.10.16";
+  version = "1.10.17";
 
   src = fetchFromGitHub {
     owner = "ethereum";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-l+hxAUw55d9MYLIUdF6qSEIelJQYRCvHyw1yuossmyA=";
+    sha256 = "sha256-GBlrg4wOiqEQTZC3CtfAZbIvS16/pSjEedEDrPGNUtY=";
   };
 
-  vendorSha256 = "sha256-keeox2d2WEzY9ynEcovPaU95YzVQlbTu1i7PLpjkjZU=";
+  vendorSha256 = "sha256-D4odWuGFipSvbKbNlA6PkTo3rWGTCptJcn/7V7ZA7qs=";
 
   doCheck = false;
 
diff --git a/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix b/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
index 18c8549b9ccac..7c481c6d977e9 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
@@ -547,6 +547,13 @@ let
               '';
           });
         });
+
+        mozc = super.mozc.overrideAttrs (attrs: {
+          postPatch = attrs.postPatch or "" + ''
+            substituteInPlace src/unix/emacs/mozc.el \
+              --replace '"mozc_emacs_helper"' '"${pkgs.ibus-engines.mozc}/lib/mozc/mozc_emacs_helper"'
+          '';
+        });
       };
 
     in lib.mapAttrs (n: v: if lib.hasAttr n overrides then overrides.${n} else v) super);
diff --git a/pkgs/applications/editors/jucipp/default.nix b/pkgs/applications/editors/jucipp/default.nix
index 7a57e21710950..b06c93c103401 100644
--- a/pkgs/applications/editors/jucipp/default.nix
+++ b/pkgs/applications/editors/jucipp/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     sha256 = "0xp6ijnrggskjrvscp204bmdpz48l5a8nxr9abp17wni6akb5wiq";
   };
 
-  nativeBuildInputs = [ pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config wrapGAppsHook cmake ];
   buildInputs = [
     dbus
     openssl
@@ -38,7 +38,6 @@ stdenv.mkDerivation rec {
     libepoxy
     boost
     libXdmcp
-    cmake
     aspell
     libgit2
     libxkbcommon
diff --git a/pkgs/applications/editors/neovim/default.nix b/pkgs/applications/editors/neovim/default.nix
index 03cc0b35b8d39..e06096933c975 100644
--- a/pkgs/applications/editors/neovim/default.nix
+++ b/pkgs/applications/editors/neovim/default.nix
@@ -5,7 +5,8 @@
 , tree-sitter
 , glibcLocales ? null, procps ? null
 
-# now defaults to false because some tests can be flaky (clipboard etc)
+# now defaults to false because some tests can be flaky (clipboard etc), see
+# also: https://github.com/neovim/neovim/issues/16233
 , doCheck ? false
 , nodejs ? null, fish ? null, python3 ? null
 }:
@@ -21,14 +22,6 @@ let
     ));
 
   pyEnv = python3.withPackages(ps: with ps; [ pynvim msgpack ]);
-
-  # FIXME: this is verry messy and strange.
-  # see https://github.com/NixOS/nixpkgs/pull/80528
-  luv = lua.pkgs.luv;
-  luvpath = with builtins ; if stdenv.isDarwin
-    then "${luv.libluv}/lib/lua/${lua.luaversion}/libluv.${head (match "([0-9.]+).*" luv.version)}.dylib"
-    else "${luv}/lib/lua/${lua.luaversion}/luv.so";
-
 in
   stdenv.mkDerivation rec {
     pname = "neovim-unwrapped";
@@ -57,7 +50,11 @@ in
       libtermkey
       libuv
       libvterm-neovim
-      luv.libluv
+      # This is actually a c library, hence it's not included in neovimLuaEnv,
+      # see:
+      # https://github.com/luarocks/luarocks/issues/1402#issuecomment-1080616570
+      # and it's definition at: pkgs/development/lua-modules/overrides.nix
+      lua.pkgs.libluv
       msgpack
       ncurses
       neovimLuaEnv
@@ -97,12 +94,12 @@ in
     disallowedReferences = [ stdenv.cc ];
 
     cmakeFlags = [
-      "-DGPERF_PRG=${gperf}/bin/gperf"
-      "-DLUA_PRG=${neovimLuaEnv.interpreter}"
-      "-DLIBLUV_LIBRARY=${luvpath}"
+      # Don't use downloaded dependencies. At the end of the configurePhase one
+      # can spot that cmake says this option was "not used by the project".
+      # That's because all dependencies were found and
+      # third-party/CMakeLists.txt is not read at all.
       "-DUSE_BUNDLED=OFF"
     ]
-    ++ optional doCheck "-DBUSTED_PRG=${neovimLuaEnv}/bin/busted"
     ++ optional (!lua.pkgs.isLuaJIT) "-DPREFER_LUA=ON"
     ;
 
@@ -113,12 +110,6 @@ in
       substituteInPlace src/nvim/CMakeLists.txt --replace "    util" ""
     '';
 
-    # For treesitter plugins, libstdc++.so.6, or equivalent will be needed
-    NIX_LDFLAGS =
-      lib.optionals stdenv.cc.isGNU [ "-lstdc++"]
-      ++ lib.optionals stdenv.cc.isClang [ "-lc++" ];
-
-    # export PATH=$PWD/build/bin:${PATH}
     shellHook=''
       export VIMRUNTIME=$PWD/runtime
     '';
diff --git a/pkgs/applications/editors/pinegrow/default.nix b/pkgs/applications/editors/pinegrow/default.nix
index 4c93c4ae03628..65604926b8fda 100644
--- a/pkgs/applications/editors/pinegrow/default.nix
+++ b/pkgs/applications/editors/pinegrow/default.nix
@@ -8,6 +8,7 @@
 , autoPatchelfHook
 , gsettings-desktop-schemas
 , gtk3
+, wrapGAppsHook
 , makeWrapper
 }:
 
@@ -24,6 +25,7 @@ stdenv.mkDerivation rec {
     unzip
     autoPatchelfHook
     makeWrapper
+    wrapGAppsHook
   ];
 
   buildInputs = [
@@ -34,7 +36,8 @@ stdenv.mkDerivation rec {
     gtk3
   ];
 
-  wrapProgramFlags = [
+  dontWrapGApps = true;
+  makeWrapperArgs = [
     "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ gcc-unwrapped.lib gtk3 udev ]}"
     "--prefix PATH : ${lib.makeBinPath [ stdenv.cc ]}"
   ];
@@ -51,7 +54,7 @@ stdenv.mkDerivation rec {
     # we can't unzip it in $out/lib, because nw.js will start with
     # an empty screen. Therefore it will be unzipped in a non-typical
     # folder and symlinked.
-    unzip $src -d $out/opt/pinegrow
+    unzip -q $src -d $out/opt/pinegrow
     substituteInPlace $out/opt/pinegrow/Pinegrow.desktop \
       --replace 'Exec=sh -c "$(dirname %k)/PinegrowLibrary"' 'Exec=sh -c "$out/bin/Pinegrow"'
     mv $out/opt/pinegrow/Pinegrow.desktop $out/share/applications/Pinegrow.desktop
@@ -60,9 +63,11 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
+  # GSETTINGS_SCHEMAS_PATH is not set in installPhase
   preFixup = ''
-    export XDG_DATA_DIRS=${gsettings-desktop-schemas}/share/gsettings-schemas/${gsettings-desktop-schemas.name}:${gtk3}/share/gsettings-schemas/${gtk3.name}:$XDG_DATA_DIRS
-    wrapProgram "$out/opt/pinegrow/PinegrowLibrary" ''${wrapProgramFlags[@]}
+    wrapProgram $out/bin/Pinegrow \
+      ''${makeWrapperArgs[@]} \
+      ''${gappsWrapperArgs[@]}
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/editors/poke/default.nix b/pkgs/applications/editors/poke/default.nix
index e050086139109..c2ade207d6093 100644
--- a/pkgs/applications/editors/poke/default.nix
+++ b/pkgs/applications/editors/poke/default.nix
@@ -22,11 +22,11 @@ let
   isCross = stdenv.hostPlatform != stdenv.buildPlatform;
 in stdenv.mkDerivation rec {
   pname = "poke";
-  version = "2.1";
+  version = "2.2";
 
   src = fetchurl {
     url = "mirror://gnu/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-zVKObBu8VAw7YpwrTza3hLMKAmsAWji5koNCJZlEJnA=";
+    sha256 = "sha256-xF6k5xpRohhTZzhcAc65dZbsW3EDOGm+xKYLHLciWQM=";
   };
 
   outputs = [ "out" "dev" "info" "lib" "man" ];
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index f3e1a5f12c33f..8b55c1706939f 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -173,10 +173,9 @@ self: super: {
   });
 
   cpsm = super.cpsm.overrideAttrs (old: {
+    nativeBuildInputs = [ cmake ];
     buildInputs = [
       python3
-      stdenv
-      cmake
       boost
       icu
       ncurses
diff --git a/pkgs/applications/editors/vscode/vscode.nix b/pkgs/applications/editors/vscode/vscode.nix
index 370647de1fcff..a9ab7e8e55dee 100644
--- a/pkgs/applications/editors/vscode/vscode.nix
+++ b/pkgs/applications/editors/vscode/vscode.nix
@@ -14,17 +14,17 @@ let
   archive_fmt = if stdenv.isDarwin then "zip" else "tar.gz";
 
   sha256 = {
-    x86_64-linux = "0x8vc6gj83mn767wi285k0hxhlh5gh1lcvq63na89vglja4ipna4";
-    x86_64-darwin = "1x47xfq0fgd10wq6aa8gq55aqrl1ir1f6v1mm6324yny16pf20k2";
-    aarch64-linux = "1ibg2qvpnwfwwzgby2xva9xz138b13x9q8vf1xf6plazv0arla1l";
-    aarch64-darwin = "100834mqix7b46frlqf0jz4qs673lavxm8sizfjm7c9y0xxy4ld3";
-    armv7l-linux = "100yfkzvnjccp1g3p353jr2vicvkjc0skiwmmzgad6i8j1m9js62";
+    x86_64-linux = "077a847p8l2yk3dpn8qqwjdch5nqm8a7fxlnwg5xzx892lr6l4ax";
+    x86_64-darwin = "03gbrnkzks4if3mkpwn4yjajj3z9cax0jskhw8pz5n1mibv4kg4p";
+    aarch64-linux = "0xqpc69m5jmm6dyvhlc20bpbr2czmi0pn00jxpf5md8fqxmbvj90";
+    aarch64-darwin = "1zd2s841xpq5fk6bkrbqbzbcyladpp8sp7wx2spkzj1gmbjfzw4a";
+    armv7l-linux = "1swbg3zklixyk3cf0nh0xcwszm9rrvw1caqzmb80lc3c7qx9qx1s";
   }.${system};
 in
   callPackage ./generic.nix rec {
     # Please backport all compatible updates to the stable release.
     # This is important for the extension ecosystem.
-    version = "1.65.2";
+    version = "1.66.0";
     pname = "vscode";
 
     executableName = "code" + lib.optionalString isInsiders "-insiders";
diff --git a/pkgs/applications/editors/vscode/vscodium.nix b/pkgs/applications/editors/vscode/vscodium.nix
index a91227d9db40e..0101b896e8cf7 100644
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@@ -13,10 +13,10 @@ let
   archive_fmt = if system == "x86_64-darwin" then "zip" else "tar.gz";
 
   sha256 = {
-    x86_64-linux = "1sh2f7hwhilwmlgy11kl0s2n3phpcir15wyl2fkyhsr2kdj4jz9r";
-    x86_64-darwin = "1s04d91f08982wi8hb4dw0j57d6zqrdgns16ihrgsvahrzksgq4b";
-    aarch64-linux = "1a97lk1qz2lz0lk5lpja32zy07iwdbskp6baf429iz7fz232rshm";
-    armv7l-linux = "0vjqxqcr7fq3ncx1nl6ny7qcqm4vlsn33c074hhcg5292blg2a0p";
+    x86_64-linux = "0dv28i8mxf45n7xj4gzgh4gsx76875nxs4yfqswxij8kzz72vqfn";
+    x86_64-darwin = "0xs4f1ffqcbvzw1v64f9l8i7rflz7h1j5xgjxdz6l0hw0j4aalb2";
+    aarch64-linux = "1fa7g531apigp8k7fxkp2ijmhz5axx7ixzdhlwgbsb80rb2mqhi0";
+    armv7l-linux = "1ry9qm6rk46s0jn7hl30jbjdhi3fshzcs0x9krd9qin7by18hhz3";
   }.${system};
 
   sourceRoot = {
@@ -31,7 +31,7 @@ in
 
     # Please backport all compatible updates to the stable release.
     # This is important for the extension ecosystem.
-    version = "1.65.2";
+    version = "1.66.0";
     pname = "vscodium";
 
     executableName = "codium";
diff --git a/pkgs/applications/emulators/rpcs3/default.nix b/pkgs/applications/emulators/rpcs3/default.nix
index 74c5b8ee6b354..ee85b71cf8a47 100644
--- a/pkgs/applications/emulators/rpcs3/default.nix
+++ b/pkgs/applications/emulators/rpcs3/default.nix
@@ -9,10 +9,10 @@
 
 let
   # Keep these separate so the update script can regex them
-  rpcs3GitVersion = "13352-e58906cb4";
-  rpcs3Version = "0.0.21-13352-e58906cb4";
-  rpcs3Revision = "e58906cb4df26c14fcade07d7c15ab432dae6882";
-  rpcs3Sha256 = "1bzx6af77z5l6jdgazw8x59pi2xhwkz0knynmf5kzww39m6npx0a";
+  rpcs3GitVersion = "13388-4a86638ce";
+  rpcs3Version = "0.0.21-13388-4a86638ce";
+  rpcs3Revision = "4a86638ce898e3bd68ade8e7ba794253782ea411";
+  rpcs3Sha256 = "0bc1n0jy4a869mn1g5i008vb5m2a6qfhyf7lw0d0jiljgsppiys1";
 
   ittapi = fetchFromGitHub {
     owner = "intel";
diff --git a/pkgs/applications/graphics/ImageMagick/6.x.nix b/pkgs/applications/graphics/ImageMagick/6.x.nix
index 4c06eb7962bc0..032af6cf61444 100644
--- a/pkgs/applications/graphics/ImageMagick/6.x.nix
+++ b/pkgs/applications/graphics/ImageMagick/6.x.nix
@@ -83,7 +83,7 @@ stdenv.mkDerivation rec {
     changelog = "https://legacy.imagemagick.org/script/changelog.php";
     description = "A software suite to create, edit, compose, or convert bitmap images";
     platforms = platforms.linux ++ platforms.darwin;
-    maintainers = with maintainers; [ erictapen ];
+    maintainers = with maintainers; [ ];
     license = licenses.asl20;
   };
 }
diff --git a/pkgs/applications/graphics/drawing/default.nix b/pkgs/applications/graphics/drawing/default.nix
index 862863bdddaca..40c651ac25705 100644
--- a/pkgs/applications/graphics/drawing/default.nix
+++ b/pkgs/applications/graphics/drawing/default.nix
@@ -18,7 +18,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "drawing";
-  version = "0.8.5";
+  version = "1.0.0";
 
   format = "other";
 
@@ -26,7 +26,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "maoschanz";
     repo = pname;
     rev = version;
-    sha256 = "1q4a1gwmzz0rm10cnd4nzd51zfc2bjc6dsvf90qk1di9x7svis64";
+    sha256 = "sha256-qNaljtuA5E/QaLJ9QILPRQCqOvKmX4ZGq/0z5unA8KA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/graphics/exrtools/default.nix b/pkgs/applications/graphics/exrtools/default.nix
index 1985176765f0b..b29d1d5869009 100644
--- a/pkgs/applications/graphics/exrtools/default.nix
+++ b/pkgs/applications/graphics/exrtools/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ stdenv openexr libpng12 libjpeg ];
+  buildInputs = [ openexr libpng12 libjpeg ];
 
   meta = with lib; {
     description = "Collection of utilities for manipulating OpenEXR images";
diff --git a/pkgs/applications/graphics/icon-library/default.nix b/pkgs/applications/graphics/icon-library/default.nix
index 4dd97d92217d6..4f16a0d6e2d8a 100644
--- a/pkgs/applications/graphics/icon-library/default.nix
+++ b/pkgs/applications/graphics/icon-library/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, wrapGAppsHook
+{ lib, stdenv, fetchurl, fetchpatch, wrapGAppsHook4
 , cargo, desktop-file-utils, meson, ninja, pkg-config, rustc
 , gdk-pixbuf, glib, gtk4, gtksourceview5, libadwaita
 }:
@@ -12,8 +12,18 @@ stdenv.mkDerivation rec {
     sha256 = "1zrcnc5dn5fgcl3vklfpbp3m0qzi2n2viw59vw5fhwkysvp670y7";
   };
 
+  patches = [
+    # Fix build with meson 0.61
+    # data/meson.build:85:0: ERROR: gnome.compile_resources takes exactly 2 arguments, but got 3.
+    # https://gitlab.gnome.org/World/design/icon-library/-/merge_requests/54
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/World/design/icon-library/-/commit/c629dbf6670f9bb0b98ff21c17110489b58f5c85.patch";
+      sha256 = "UKC1CPaM58/z0zINN794luWZdoFx1zGxETPb8VtbO3E=";
+    })
+  ];
+
   nativeBuildInputs = [
-    cargo desktop-file-utils meson ninja pkg-config rustc wrapGAppsHook
+    cargo desktop-file-utils meson ninja pkg-config rustc wrapGAppsHook4
   ];
   buildInputs = [ gdk-pixbuf glib gtk4 gtksourceview5 libadwaita ];
 
diff --git a/pkgs/applications/misc/HentaiAtHome/default.nix b/pkgs/applications/misc/HentaiAtHome/default.nix
index dc2b7ab804ab0..d185096aa7974 100644
--- a/pkgs/applications/misc/HentaiAtHome/default.nix
+++ b/pkgs/applications/misc/HentaiAtHome/default.nix
@@ -13,7 +13,7 @@ buildGraalvmNativeImage rec {
   jar = "${src}/HentaiAtHome.jar";
   dontUnpack = true;
 
-  graalvm = graalvm17-ce;
+  graalvmDrv = graalvm17-ce;
   extraNativeImageBuildArgs = [
     "--enable-url-protocols=http,https"
     "--install-exit-handlers"
diff --git a/pkgs/applications/misc/gofu/default.nix b/pkgs/applications/misc/gofu/default.nix
index 13cb7129a00be..ea3cbde3adb7d 100644
--- a/pkgs/applications/misc/gofu/default.nix
+++ b/pkgs/applications/misc/gofu/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "gofu";
-  version = "unstable-2021-09-11";
+  version = "unstable-2022-04-01";
 
   src = fetchFromGitHub {
     owner = "majewsky";
     repo = pname;
-    rev = "cb398f58a5cb4f3e858fe60e84debde6ab58f7c8";
-    sha256 = "sha256-R8Pr8SyLeoTaYKKV+PzHDPi1/RY4j7pkUbW8kE4ydBU=";
+    rev = "be0e424eecec3fec19ba3518f8fd1bb07b6908dc";
+    sha256 = "sha256-jMOmvCsuRtL9EgPicdNEksVgFepL/JZA53o2wzr8uzQ=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/applications/misc/gpxsee/default.nix b/pkgs/applications/misc/gpxsee/default.nix
index ac9b56f48c11a..b4e8e7151c150 100644
--- a/pkgs/applications/misc/gpxsee/default.nix
+++ b/pkgs/applications/misc/gpxsee/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gpxsee";
-  version = "10.4";
+  version = "10.5";
 
   src = fetchFromGitHub {
     owner = "tumic0";
     repo = "GPXSee";
     rev = version;
-    sha256 = "sha256-3AwUfx8IIWJO4uVAhXJE5Oola+60VUpXUwmALqJo2vw=";
+    sha256 = "sha256-TvOdyzWvGSdl8aSA+pAOpPVpQzK9POmqtClqdXAMsws=";
   };
 
   patches = (substituteAll {
diff --git a/pkgs/applications/misc/gtk2fontsel/default.nix b/pkgs/applications/misc/gtk2fontsel/default.nix
index d635fa8d86575..b622d9f19cca7 100644
--- a/pkgs/applications/misc/gtk2fontsel/default.nix
+++ b/pkgs/applications/misc/gtk2fontsel/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ stdenv gtk2 ];
+  buildInputs = [ gtk2 ];
 
   preferLocalBuild = true;
 
diff --git a/pkgs/applications/misc/p2pool/default.nix b/pkgs/applications/misc/p2pool/default.nix
index f888d162fc446..cb0b53e887b2f 100644
--- a/pkgs/applications/misc/p2pool/default.nix
+++ b/pkgs/applications/misc/p2pool/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "p2pool";
-  version = "1.8";
+  version = "1.9";
 
   src = fetchFromGitHub {
     owner = "SChernykh";
     repo = "p2pool";
     rev = "v${version}";
-    sha256 = "sha256-cQd3dtih7C+pEmkvlrsYTJtQWBVVMiFbtNQUM0Ck3tg=";
+    sha256 = "sha256-nqJ0F99QjrpwXHRPxZ7kLCYA9VJWGH2ahcr/MBQrhyY=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/misc/stag/default.nix b/pkgs/applications/misc/stag/default.nix
index f9c91d28f14ad..974ebb78c2f11 100644
--- a/pkgs/applications/misc/stag/default.nix
+++ b/pkgs/applications/misc/stag/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
     sha256 = "1yrzjhcwrxrxq5jj695wvpgb0pz047m88yq5n5ymkcw5qr78fy1v";
   };
 
-  buildInputs = [ stdenv curses ];
+  buildInputs = [ curses ];
 
   installPhase = ''
     make install PREFIX=$out
diff --git a/pkgs/applications/misc/taskwarrior-tui/default.nix b/pkgs/applications/misc/taskwarrior-tui/default.nix
index 7d730421398c3..1346cba9acd5b 100644
--- a/pkgs/applications/misc/taskwarrior-tui/default.nix
+++ b/pkgs/applications/misc/taskwarrior-tui/default.nix
@@ -5,19 +5,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "taskwarrior-tui";
-  version = "0.21.1";
+  version = "0.22.0";
 
   src = fetchFromGitHub {
     owner = "kdheepak";
     repo = "taskwarrior-tui";
     rev = "v${version}";
-    sha256 = "sha256-fgoK7Y+3h2VFfP8yiR8JM8Xf7UJbkX9PO1RoJRoYLW4=";
+    sha256 = "sha256-121TfmaWrWppsOiuF+8gxy+3J5YzbliYj88nw4aLt9w=";
   };
 
   # Because there's a test that requires terminal access
   doCheck = false;
 
-  cargoSha256 = "sha256-3rDvla1mCcQclALbomUTvE3aLzsMeIjcIbEv4KfCKZE=";
+  cargoSha256 = "sha256-oTb1pSA9g9cExCXKaQjNm+h5WB4bWuqODkU7MvvspGQ=";
 
   meta = with lib; {
     description = "A terminal user interface for taskwarrior ";
diff --git a/pkgs/applications/misc/yubioath-desktop/default.nix b/pkgs/applications/misc/yubioath-desktop/default.nix
index 9cfd7650c49f6..3d35e3658e568 100644
--- a/pkgs/applications/misc/yubioath-desktop/default.nix
+++ b/pkgs/applications/misc/yubioath-desktop/default.nix
@@ -15,7 +15,7 @@ mkDerivation rec {
 
   doCheck = false;
 
-  buildInputs = [ stdenv qtbase qtquickcontrols2 qtgraphicaleffects python3 ];
+  buildInputs = [ qtbase qtquickcontrols2 qtgraphicaleffects python3 ];
 
   nativeBuildInputs = [ qmake makeWrapper python3.pkgs.wrapPython ];
 
diff --git a/pkgs/applications/networking/browsers/brave/default.nix b/pkgs/applications/networking/browsers/brave/default.nix
index 65627a490d106..7c0006f745c65 100644
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@@ -91,11 +91,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "brave";
-  version = "1.36.122";
+  version = "1.37.109";
 
   src = fetchurl {
     url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    sha256 = "aBHoEu1egRPMpeUBgRl2V5J3op1Ju+CvprG14dIWc8M=";
+    sha256 = "fL3vuCqUnzq38JD0bzM/DxLVb5P31iChbMVY2eax9RE=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/applications/networking/browsers/chromium/browser.nix b/pkgs/applications/networking/browsers/chromium/browser.nix
index 40a0d79975284..ca52cf94d8c60 100644
--- a/pkgs/applications/networking/browsers/chromium/browser.nix
+++ b/pkgs/applications/networking/browsers/chromium/browser.nix
@@ -87,7 +87,7 @@ mkChromiumDerivation (base: rec {
       then "https://github.com/Eloston/ungoogled-chromium"
       else "https://www.chromium.org/";
     maintainers = with maintainers; if ungoogled
-      then [ squalus primeos ]
+      then [ squalus primeos michaeladler ]
       else [ primeos thefloweringash ];
     license = if enableWideVine then licenses.unfree else licenses.bsd3;
     platforms = platforms.linux;
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.json b/pkgs/applications/networking/browsers/chromium/upstream-info.json
index 78377193eb35f..35610f1537a78 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@@ -19,22 +19,22 @@
     }
   },
   "beta": {
-    "version": "100.0.4896.60",
-    "sha256": "1p7zggnhsz9gj3zil0nyas4ym5bd94vs0z6mdg7r1l0s0vrsaphf",
-    "sha256bin64": "059zrf3mm04iyzmgp594m3m7pw4458vym3wpawmdn94h5zi705i7",
+    "version": "101.0.4951.15",
+    "sha256": "1gm70mz6gzildh1g082q4dg5q9namm9kvxfj5qrdcj67gvz5m66y",
+    "sha256bin64": "0z2rx7mw9wg5ly8wmxkflk8f9gifq4cxqvi224v9dr11qqj8gwm2",
     "deps": {
       "gn": {
-        "version": "2022-01-21",
+        "version": "2022-03-14",
         "url": "https://gn.googlesource.com/gn",
-        "rev": "0725d7827575b239594fbc8fd5192873a1d62f44",
-        "sha256": "1dzdvcn2r5c9giknvasf3y5y4901kav7igivjvrpww66ywsj8fzr"
+        "rev": "bd99dbf98cbdefe18a4128189665c5761263bcfb",
+        "sha256": "0nql15ckjqkm001xajq3qyn4h4q80i7x6dm9zinxxr1a8q5lppx3"
       }
     }
   },
   "dev": {
-    "version": "101.0.4951.7",
-    "sha256": "0xnvbiqi50hgky35qaivcyzfp05nnwfwqrd50dksqkzycl8avb4z",
-    "sha256bin64": "19my3zr9d3w2ypl9cm1xa15vhyv9add1f283alb9fmh2qwhl4scg",
+    "version": "101.0.4951.15",
+    "sha256": "1gm70mz6gzildh1g082q4dg5q9namm9kvxfj5qrdcj67gvz5m66y",
+    "sha256bin64": "0m1q85ai9pyam9anh8aiv7hyadam0hjkkhnsa6s05d82k8kz5rvc",
     "deps": {
       "gn": {
         "version": "2022-03-14",
@@ -45,19 +45,19 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "99.0.4844.84",
-    "sha256": "05bma8lsm5lad58mlfiv8bg0fw5k5mxh0v6g1ik7xp2bsd71iv10",
-    "sha256bin64": "0sdnsnp7hnpip91hwbz3hiw2727g0a3ydf55ldqv9bgik3vn1wln",
+    "version": "100.0.4896.60",
+    "sha256": "1p7zggnhsz9gj3zil0nyas4ym5bd94vs0z6mdg7r1l0s0vrsaphf",
+    "sha256bin64": "07wavs9r6ilwx5rzyqvydcjskg6sml5b8m6mw7qzykvhs8bnvfh5",
     "deps": {
       "gn": {
-        "version": "2022-01-10",
+        "version": "2022-01-21",
         "url": "https://gn.googlesource.com/gn",
-        "rev": "80a40b07305373617eba2d5878d353532af77da3",
-        "sha256": "1103lf38h7412949j6nrk48m2vv2rrxacn42sjg33lg88nyv7skv"
+        "rev": "0725d7827575b239594fbc8fd5192873a1d62f44",
+        "sha256": "1dzdvcn2r5c9giknvasf3y5y4901kav7igivjvrpww66ywsj8fzr"
       },
       "ungoogled-patches": {
-        "rev": "99.0.4844.84-1",
-        "sha256": "1j02zcam09mdw7wg30r1mx27b8bw0s9dvk4qjl6vrhp24rbmscs7"
+        "rev": "100.0.4896.60-1",
+        "sha256": "02q7ghxynkgkbilcb8bx8q26s80fvd4hbc58zq74pnzpmn7qi342"
       }
     }
   }
diff --git a/pkgs/applications/networking/cluster/driftctl/default.nix b/pkgs/applications/networking/cluster/driftctl/default.nix
index 28dd421c72c55..fc8d8da18af83 100644
--- a/pkgs/applications/networking/cluster/driftctl/default.nix
+++ b/pkgs/applications/networking/cluster/driftctl/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "driftctl";
-  version = "0.25.0";
+  version = "0.26.0";
 
   src = fetchFromGitHub {
     owner = "snyk";
     repo = "driftctl";
     rev = "v${version}";
-    sha256 = "sha256-opR1NkMGptZilSPVZ7yNjYBBjnOXxrqAFCYzQ1tNS78=";
+    sha256 = "sha256-cwI27hAfnSKT7P2rfM86tRtSKRR9bruRV9w440uGLIU=";
   };
 
   vendorSha256 = "sha256-I0OCRhUvuaF4k5qqPaV6R24mrd9AG5GgQCCF6yodK0E=";
diff --git a/pkgs/applications/networking/cluster/fluxcd/default.nix b/pkgs/applications/networking/cluster/fluxcd/default.nix
index ff686314f0c45..0e9630a23d538 100644
--- a/pkgs/applications/networking/cluster/fluxcd/default.nix
+++ b/pkgs/applications/networking/cluster/fluxcd/default.nix
@@ -1,9 +1,9 @@
 { lib, buildGoModule, fetchFromGitHub, fetchzip, installShellFiles }:
 
 let
-  version = "0.28.4";
-  sha256 = "1b98hna3qhg7gzs5rqpkrxdvas7zjzavzmi9rzn9936rw88lpgx6";
-  manifestsSha256 = "0k8hpkcnxw2w1pvdkvvmmqzrmsrrbij5f734iwh4n9fd326bqgwc";
+  version = "0.28.5";
+  sha256 = "11k8sb8pjhrg8ar256rfdw736cg32m6n8xcfhyqc3r4pkj3ksli8";
+  manifestsSha256 = "1gjya8xcmx065ywx7bc2xdsp3qj2y47b7l1dlr4y0hzp19pclmcw";
 
   manifests = fetchzip {
     url =
@@ -23,7 +23,7 @@ in buildGoModule rec {
     inherit sha256;
   };
 
-  vendorSha256 = "sha256-IL9RjmMQahFZ04FXKxH6L2PHsOM1MJnqCJorRdr49FY=";
+  vendorSha256 = "sha256-kxI2sOaY66XLIRMT1l3VLQh1XR4nvvsYvsdZbVLxbHM=";
 
   postUnpack = ''
     cp -r ${manifests} source/cmd/flux/manifests
diff --git a/pkgs/applications/networking/cluster/pluto/default.nix b/pkgs/applications/networking/cluster/pluto/default.nix
index 1fa4dc161952f..4297ec62376d6 100644
--- a/pkgs/applications/networking/cluster/pluto/default.nix
+++ b/pkgs/applications/networking/cluster/pluto/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "pluto";
-  version = "5.6.0";
+  version = "5.7.0";
 
   src = fetchFromGitHub {
     owner = "FairwindsOps";
     repo = "pluto";
     rev = "v${version}";
-    sha256 = "0nr8h8vg8ifgibgw80rs4mk63bj3qhmd37lfjc89iyml4g6p9mwr";
+    sha256 = "sha256-/H8/wpDqlo96qb6QBIxpIGMv6VtK/nn/GwozIJjZyNY=";
   };
 
-  vendorSha256 = "08x5mzypg66s54apkd7hhj6bi5pgbch9if2dbr58ksd3arkji2pv";
+  vendorSha256 = "sha256-jPVlHyKZ1ygF08OypXOMzHBfb2z5mhg5B8zJmAcQbLk=";
 
   ldflags = [
     "-w" "-s"
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 56743624efaa3..b70bf0de63e92 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -697,6 +697,15 @@
     "vendorSha256": "0kkkrdbapyvfzmnbh5kmhlcz5l8g8gf0mfwbya66iy1bb6f6w4mz",
     "version": "1.3.0"
   },
+  "namecheap": {
+    "owner": "namecheap",
+    "provider-source-address": "registry.terraform.io/namecheap/namecheap",
+    "repo": "terraform-provider-namecheap",
+    "rev": "v2.1.0",
+    "sha256": "sha256-cms8YUL+SjTeYyIOQibksi8ZHEBYq2JlgTEpOO1uMZE=",
+    "vendorSha256": null,
+    "version": "2.1.0"
+  },
   "ncloud": {
     "owner": "NaverCloudPlatform",
     "provider-source-address": "registry.terraform.io/NaverCloudPlatform/ncloud",
diff --git a/pkgs/applications/networking/instant-messengers/chatty/default.nix b/pkgs/applications/networking/instant-messengers/chatty/default.nix
index 97282c76d04cf..34b525a98a61d 100644
--- a/pkgs/applications/networking/instant-messengers/chatty/default.nix
+++ b/pkgs/applications/networking/instant-messengers/chatty/default.nix
@@ -3,6 +3,7 @@
 , fetchFromGitLab
 , appstream-glib
 , desktop-file-utils
+, itstool
 , meson
 , ninja
 , pkg-config
@@ -46,6 +47,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     appstream-glib
     desktop-file-utils
+    itstool
     meson
     ninja
     pkg-config
diff --git a/pkgs/applications/networking/mailreaders/mailspring/default.nix b/pkgs/applications/networking/mailreaders/mailspring/default.nix
index c63084f3550f9..04e9accbe14af 100644
--- a/pkgs/applications/networking/mailreaders/mailspring/default.nix
+++ b/pkgs/applications/networking/mailreaders/mailspring/default.nix
@@ -15,15 +15,17 @@
 , openssl
 , udev
 , xorg
+, mesa
+, libdrm
 }:
 
 stdenv.mkDerivation rec {
   pname = "mailspring";
-  version = "1.9.2";
+  version = "1.10.2";
 
   src = fetchurl {
     url = "https://github.com/Foundry376/Mailspring/releases/download/${version}/mailspring-${version}-amd64.deb";
-    sha256 = "sha256-o7w2XHd5FnPYt9j8IIGy6OgKtdeNb/qZ+EiXGEn0NUQ=";
+    sha256 = "sha256-6KHhkmHWhj/AgECYqNuJ0iSPEYyuBDac/3fW6J0fgTg=";
   };
 
   nativeBuildInputs = [
@@ -44,6 +46,9 @@ stdenv.mkDerivation rec {
     xorg.libXdamage
     xorg.libXScrnSaver
     xorg.libXtst
+    xorg.libxshmfence
+    mesa
+    libdrm
   ];
 
   runtimeDependencies = [
diff --git a/pkgs/applications/networking/mullvad/default.nix b/pkgs/applications/networking/mullvad/default.nix
new file mode 100644
index 0000000000000..7b4bcf9d61b25
--- /dev/null
+++ b/pkgs/applications/networking/mullvad/default.nix
@@ -0,0 +1,8 @@
+{ lib
+, newScope
+}:
+lib.makeScope newScope (self: {
+  libwg = self.callPackage ./libwg.nix { };
+  mullvad = self.callPackage ./mullvad.nix { };
+  openvpn-mullvad = self.callPackage ./openvpn.nix { };
+})
diff --git a/pkgs/applications/networking/mullvad/libwg.nix b/pkgs/applications/networking/mullvad/libwg.nix
new file mode 100644
index 0000000000000..d54a2cafe8c0c
--- /dev/null
+++ b/pkgs/applications/networking/mullvad/libwg.nix
@@ -0,0 +1,35 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, mullvad
+}:
+buildGoModule {
+  pname = "libwg";
+
+  inherit (mullvad)
+    version
+    src
+    ;
+
+  sourceRoot = "source/wireguard/libwg";
+
+  vendorSha256 = "qvymWCdJ+GY90W/Fpdp+r1+mTq6O4LyN2Yw/PjKdFm0=";
+
+  # XXX: hack to make the ar archive go to the correct place
+  # This is necessary because passing `-o ...` to `ldflags` does not work
+  # (this doesn't get communicated everywhere in the chain, apparently, so
+  # `go` complains that it can't find an `a.out` file).
+  GOBIN = "${placeholder "out"}/lib";
+  ldflags = [ "-s" "-w" "-buildmode=c-archive" ];
+
+  postInstall = ''
+    mv $out/lib/libwg{,.a}
+  '';
+
+  meta = with lib; {
+    description = "A tiny wrapper around wireguard-go";
+    homepage = "https://github.com/mullvad/mullvadvpn-app/tree/master/wireguard/libwg";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ cole-h ];
+  };
+}
diff --git a/pkgs/applications/networking/mullvad/mullvad.nix b/pkgs/applications/networking/mullvad/mullvad.nix
new file mode 100644
index 0000000000000..801e8602cc95c
--- /dev/null
+++ b/pkgs/applications/networking/mullvad/mullvad.nix
@@ -0,0 +1,107 @@
+{ lib
+, stdenv
+, writeText
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, protobuf
+, makeWrapper
+, dbus
+, libnftnl
+, libmnl
+, libwg
+, openvpn-mullvad
+, shadowsocks-rust
+}:
+let
+  # result of running address_cache as of 02 Mar 2022
+  bootstrap-address-cache = writeText "api-ip-address.txt" ''
+    193.138.218.78:443
+    193.138.218.71:444
+    185.65.134.66:444
+    185.65.135.117:444
+    217.138.254.130:444
+    91.90.44.10:444
+  '';
+in
+rustPlatform.buildRustPackage rec {
+  pname = "mullvad";
+  version = "2022.1";
+
+  src = fetchFromGitHub {
+    owner = "mullvad";
+    repo = "mullvadvpn-app";
+    rev = version;
+    hash = "sha256-bLwuM3Qy2iStbXIvDEWp31vuiihSQThOej297XKo5Xc=";
+  };
+
+  cargoHash = "sha256-CBbm8cJHTjyvvzCFQfKmsE5d9N7azEm8nI6KeWLVaa8=";
+
+  nativeBuildInputs = [
+    pkg-config
+    protobuf
+    makeWrapper
+  ];
+
+  buildInputs = [
+    dbus.dev
+    libnftnl
+    libmnl
+  ];
+
+  # talpid-core wants libwg.a in build/lib/{triple}
+  preBuild = ''
+    dest=build/lib/${stdenv.targetPlatform.config}
+    mkdir -p $dest
+    ln -s ${libwg}/lib/libwg.a $dest
+  '';
+
+  postFixup =
+    # Place all binaries in the 'mullvad-' namespace, even though these
+    # specific binaries aren't used in the lifetime of the program.
+    # `address_cache` is used to generate the `api-ip-address.txt` file, which
+    # contains list of Mullvad API servers -- though we provide a "backup" of
+    # the output of this command, it could change at any time, so we want
+    # users to be able to regenerate the list at any time. (The daemon will
+    # refuse to start without this file.)
+    ''
+      for bin in address_cache relay_list translations-converter; do
+        mv "$out/bin/$bin" "$out/bin/mullvad-$bin"
+      done
+    '' +
+    # Put distributed assets in-place -- specifically, the
+    # bootstrap-address-cache is necessary; otherwise, the user will have to run
+    # the `address_cache` binary and move the contents into place at
+    # `/var/cache/mullvad-vpn/api-ip-address.txt` manually.
+    ''
+      mkdir -p $out/share/mullvad
+      ln -s ${bootstrap-address-cache} $out/share/mullvad/api-ip-address.txt
+    '' +
+    # Files necessary for OpenVPN tunnels to work.
+    ''
+      cp dist-assets/ca.crt $out/share/mullvad
+      ln -s ${openvpn-mullvad}/bin/openvpn $out/share/mullvad
+      ln -s ${shadowsocks-rust}/bin/sslocal $out/share/mullvad
+      ln -s $out/lib/libtalpid_openvpn_plugin.so $out/share/mullvad
+    '' +
+    # Set the directory where Mullvad will look for its resources by default to
+    # `$out/share`, so that we can avoid putting the files in `$out/bin` --
+    # Mullvad defaults to looking inside the directory its binary is located in
+    # for its resources.
+    ''
+      wrapProgram $out/bin/mullvad-daemon \
+        --set-default MULLVAD_RESOURCE_DIR "$out/share/mullvad"
+    '';
+
+  passthru = {
+    inherit libwg;
+    inherit openvpn-mullvad;
+  };
+
+  meta = with lib; {
+    description = "Mullvad VPN command-line client tools";
+    homepage = "https://github.com/mullvad/mullvadvpn-app";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ cole-h ];
+  };
+}
diff --git a/pkgs/applications/networking/mullvad/openvpn.nix b/pkgs/applications/networking/mullvad/openvpn.nix
new file mode 100644
index 0000000000000..b191c31d39ac7
--- /dev/null
+++ b/pkgs/applications/networking/mullvad/openvpn.nix
@@ -0,0 +1,87 @@
+{ lib
+, openvpn
+, fetchpatch
+, fetchurl
+, iproute2
+, autoconf
+, automake
+}:
+
+openvpn.overrideAttrs (oldAttrs:
+  let
+    fetchMullvadPatch = { commit, sha256 }: fetchpatch {
+      url = "https://github.com/mullvad/openvpn/commit/${commit}.patch";
+      inherit sha256;
+    };
+  in
+  rec {
+    pname = "openvpn-mullvad";
+    version = "2.5.3";
+
+    src = fetchurl {
+      url = "https://swupdate.openvpn.net/community/releases/openvpn-${version}.tar.gz";
+      sha256 = "sha256-dfAETfRJQwVVynuZWit3qyTylG/cNmgwG47cI5hqX34=";
+    };
+
+    buildInputs = oldAttrs.buildInputs or [ ] ++ [
+      iproute2
+    ];
+
+    configureFlags = oldAttrs.configureFlags  or [ ] ++ [
+      "--enable-iproute2"
+      "IPROUTE=${iproute2}/sbin/ip"
+    ];
+
+    nativeBuildInputs = oldAttrs.nativeBuildInputs or [ ] ++ [
+      autoconf
+      automake
+    ];
+
+    patches = oldAttrs.patches or [ ] ++ [
+      # look at compare to find the relevant commits
+      # https://github.com/OpenVPN/openvpn/compare/release/2.5...mullvad:mullvad-patches
+      # used openvpn version is the latest tag ending with -mullvad
+      # https://github.com/mullvad/openvpn/tags
+      (fetchMullvadPatch {
+        # "Reduce PUSH_REQUEST_INTERVAL to one second"
+        commit = "41e44158fc71bb6cc8cc6edb6ada3307765a12e8";
+        sha256 = "sha256-UoH0V6gTPdEuybFkWxdaB4zomt7rZeEUyXs9hVPbLb4=";
+      })
+      (fetchMullvadPatch {
+        # "Allow auth plugins to set a failure reason"
+        commit = "f51781c601e8c72ae107deaf25bf66f7c193e9cd";
+        sha256 = "sha256-+kwG0YElL16T0e+avHlI8gNQdAxneRS6fylv7QXvC1s=";
+      })
+      (fetchMullvadPatch {
+        # "Send an event to any plugins when authentication fails"
+        commit = "c2f810f966f2ffd68564d940b5b8946ea6007d5a";
+        sha256 = "sha256-PsKIxYwpLD66YaIpntXJM8OGcObyWBSAJsQ60ojvj30=";
+      })
+      (fetchMullvadPatch {
+        # "Shutdown when STDIN is closed"
+        commit = "879d6a3c0288b5443bbe1b94261655c329fc2e0e";
+        sha256 = "sha256-pRFY4r+b91/xAKXx6u5GLzouQySXuO5gH0kMGm77a3c=";
+      })
+      (fetchMullvadPatch {
+        # "Update TAP hardware ID"
+        commit = "7f71b37a3b25bec0b33a0e29780c222aef869e9d";
+        sha256 = "sha256-RF/GvD/ZvhLdt34wDdUT/yxa+IVWx0eY6WRdNWXxXeQ=";
+      })
+      (fetchMullvadPatch {
+        # "Undo dependency on Python docutils"
+        commit = "abd3c6214529d9f4143cc92dd874d8743abea17c";
+        sha256 = "sha256-SC2RlpWHUDMAEKap1t60dC4hmalk3vok6xY+/xhC2U0=";
+      })
+      (fetchMullvadPatch {
+        # "Prevent signal when stdin is closed from being cleared (#10)"
+        commit = "b45b090c81e7b4f2dc938642af7a1e12f699f5c5";
+        sha256 = "sha256-KPTFmbuJhMI+AvaRuu30CPPLQAXiE/VApxlUCqbZFls=";
+      })
+    ];
+
+    meta = oldAttrs.meta or { } // {
+      description = "OpenVPN with Mullvad-specific patches applied";
+      homepage = "https://github.com/mullvad/openvpn";
+      maintainers = with lib; [ maintainers.cole-h ];
+    };
+  })
diff --git a/pkgs/applications/networking/sniffers/wireshark/default.nix b/pkgs/applications/networking/sniffers/wireshark/default.nix
index b667c7671bdc5..931606f324898 100644
--- a/pkgs/applications/networking/sniffers/wireshark/default.nix
+++ b/pkgs/applications/networking/sniffers/wireshark/default.nix
@@ -11,7 +11,7 @@ assert withQt  -> qt5  != null;
 with lib;
 
 let
-  version = "3.6.2";
+  version = "3.6.3";
   variant = if withQt then "qt" else "cli";
 
 in stdenv.mkDerivation {
@@ -21,7 +21,7 @@ in stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.wireshark.org/download/src/all-versions/wireshark-${version}.tar.xz";
-    sha256 = "sha256-XZAaVXKu+VPwStwlPtKgaZ1MYnedMkkCHh6FQaAkww4=";
+    sha256 = "sha256-tgNkpMAGihCBGrP9B1ymwesOddRGACcbiKIO2Tou9jE=";
   };
 
   cmakeFlags = [
diff --git a/pkgs/applications/networking/sync/lsyncd/default.nix b/pkgs/applications/networking/sync/lsyncd/default.nix
index 4c95a35ab85a4..7690bf6ee5403 100644
--- a/pkgs/applications/networking/sync/lsyncd/default.nix
+++ b/pkgs/applications/networking/sync/lsyncd/default.nix
@@ -31,9 +31,10 @@ stdenv.mkDerivation rec {
 
   dontUseCmakeBuildDir = true;
 
+  nativeBuildInputs = [ cmake ];
   buildInputs = [
     rsync
-    cmake lua pkg-config
+    lua pkg-config
     asciidoc libxml2 docbook_xml_dtd_45 docbook_xsl libxslt
   ];
 
diff --git a/pkgs/applications/office/zotero/default.nix b/pkgs/applications/office/zotero/default.nix
index 53c61f0d993ce..749b6959b7409 100644
--- a/pkgs/applications/office/zotero/default.nix
+++ b/pkgs/applications/office/zotero/default.nix
@@ -105,7 +105,7 @@ stdenv.mkDerivation rec {
     genericName = "Reference Management";
     categories = [ "Office" "Database" ];
     startupNotify = true;
-    mimeTypes = [ "text/plain" ];
+    mimeTypes = [ "x-scheme-handler/zotero" "text/plain" ];
   };
 
   installPhase = ''
diff --git a/pkgs/applications/terminal-emulators/kitty/default.nix b/pkgs/applications/terminal-emulators/kitty/default.nix
index d06c6d937c11b..52e691f985045 100644
--- a/pkgs/applications/terminal-emulators/kitty/default.nix
+++ b/pkgs/applications/terminal-emulators/kitty/default.nix
@@ -90,6 +90,11 @@ buildPythonApplication rec {
       url = "https://github.com/kovidgoyal/kitty/commit/d8ed42ae8e014d9abf9550a65ae203468f8bfa43.patch";
       sha256 = "sha256-Azgzqf5atW999FVn9rSGKMyZLsI692dYXhJPx07GBO0=";
     })
+    (fetchpatch {
+      name = "fix-build-with-non-framework-python-on-darwin.patch";
+      url = "https://github.com/kovidgoyal/kitty/commit/57cffc71b78244e6a9d49f4c9af24d1a88dbf537.patch";
+      sha256 = "sha256-1IGONSVCVo5SmLKw90eqxaI5Mwc764O1ur+aMsc7h94=";
+    })
   ];
 
   # Causes build failure due to warning
diff --git a/pkgs/applications/version-management/gitlab/data.json b/pkgs/applications/version-management/gitlab/data.json
index bd524c622d6f2..dbae269aab8c5 100644
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@@ -1,14 +1,14 @@
 {
-  "version": "14.9.1",
-  "repo_hash": "0jkhvglisaj3h9ls8q8wrxnnp4xp3zggc8vmwg6jqqjsmbpi332h",
-  "yarn_hash": "1bq1ka0nlb2nkjx70qpwpm8x6crbkfj0c8m39pwwc42j8wn10r9g",
+  "version": "14.9.2",
+  "repo_hash": "sha256-+tZN6isOb7LtUVwGshx9TP+P42sftJmQGVk1L9UJqcY=",
+  "yarn_hash": "1mya6y0cb9x8491gpf7f1i7qi2rb0l7d9g5yzj44vvy3mb4rcqaj",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v14.9.1-ee",
+  "rev": "v14.9.2-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "14.9.1",
-    "GITLAB_PAGES_VERSION": "1.56.0",
+    "GITALY_SERVER_VERSION": "14.9.2",
+    "GITLAB_PAGES_VERSION": "1.56.1",
     "GITLAB_SHELL_VERSION": "13.24.0",
-    "GITLAB_WORKHORSE_VERSION": "14.9.1"
+    "GITLAB_WORKHORSE_VERSION": "14.9.2"
   }
 }
diff --git a/pkgs/applications/version-management/gitlab/gitaly/default.nix b/pkgs/applications/version-management/gitlab/gitaly/default.nix
index d8ab7f36b39c4..cd76768aee495 100644
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@@ -11,7 +11,7 @@ let
     gemdir = ./.;
   };
 
-  version = "14.9.1";
+  version = "14.9.2";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/v${lib.versions.major version}";
 in
 
@@ -23,7 +23,7 @@ buildGoModule {
     owner = "gitlab-org";
     repo = "gitaly";
     rev = "v${version}";
-    sha256 = "sha256-mk6JZuu6b2r/OqRI4ZUf8AV/ObRKhTIQT9bQE8sH894=";
+    sha256 = "sha256-eEo+WZ2N/5bLfvwJCNf9qt+h/V5dIVqCjVJeomzw/Ps=";
   };
 
   vendorSha256 = "sha256-kEjgWA/Task23PScPYrqdDu3vdVR/FJl7OilUug/Bds=";
diff --git a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
index e16d7f75bf696..9fcecc53a0709 100644
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@@ -5,7 +5,7 @@ in
 buildGoModule rec {
   pname = "gitlab-workhorse";
 
-  version = "14.9.1";
+  version = "14.9.2";
 
   src = fetchFromGitLab {
     owner = data.owner;
diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
index fd469fd8bcc7a..ae8a8e0124142 100644
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
@@ -67,7 +67,7 @@ gem 'akismet', '~> 3.0'
 gem 'invisible_captcha', '~> 1.1.0'
 
 # Two-factor authentication
-gem 'devise-two-factor', '~> 4.0.0'
+gem 'devise-two-factor', '~> 4.0.2'
 gem 'rqrcode-rails3', '~> 0.1.7'
 gem 'attr_encrypted', '~> 3.1.0'
 gem 'u2f', '~> 0.2.1'
diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
index da4987d35dcd7..658d79dfcc663 100644
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
@@ -263,11 +263,11 @@ GEM
       railties (>= 4.1.0)
       responders
       warden (~> 1.2.3)
-    devise-two-factor (4.0.0)
-      activesupport (< 6.2)
+    devise-two-factor (4.0.2)
+      activesupport (< 7.1)
       attr_encrypted (>= 1.3, < 4, != 2)
       devise (~> 4.0)
-      railties (< 6.2)
+      railties (< 7.1)
       rotp (~> 6.0)
     diff-lcs (1.4.4)
     diff_match_patch (0.1.0)
@@ -1450,7 +1450,7 @@ DEPENDENCIES
   derailed_benchmarks
   device_detector
   devise (~> 4.7.2)
-  devise-two-factor (~> 4.0.0)
+  devise-two-factor (~> 4.0.2)
   diff_match_patch (~> 0.1.0)
   diffy (~> 3.3)
   discordrb-webhooks (~> 3.4)
diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix b/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
index 5fc9a183a8b9f..cc88cbbbab5b4 100644
--- a/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
@@ -1088,10 +1088,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "148pfr6g8dwikdq3994gsid2a3n6p5h4z1a1dzh1898shr5f9znc";
+      sha256 = "04f5rb8fg4cvzm32v413z3h53wc0fgxg927q8rqd546hdrlx4j35";
       type = "gem";
     };
-    version = "4.0.0";
+    version = "4.0.2";
   };
   diff-lcs = {
     groups = ["default" "development" "test"];
diff --git a/pkgs/applications/version-management/verco/default.nix b/pkgs/applications/version-management/verco/default.nix
index 715ae0978cc1e..407608cc22d54 100644
--- a/pkgs/applications/version-management/verco/default.nix
+++ b/pkgs/applications/version-management/verco/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "verco";
-  version = "6.7.0";
+  version = "6.8.0";
 
   src = fetchFromGitHub {
     owner = "vamolessa";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-H8rDaRVU3G3iuBv0Tz/YOuYbL2k8wEoEIIEG7hjU6eM=";
+    sha256 = "sha256-E1kqJLnTLPu38zvDGaPHiKSW/yKormbx5N1CBSzQxgc=";
   };
 
-  cargoSha256 = "sha256-4Ou/stedL3WCY4Awsl++lc5fZ9gxd4uorf4G2/0DiPc=";
+  cargoSha256 = "sha256-9342LAChCv61kxTJoeOy7EdafMfR10s8dtkc2pTgXT0=";
 
   meta = with lib; {
     description = "A simple Git/Mercurial/PlasticSCM tui client based on keyboard shortcuts";
diff --git a/pkgs/applications/video/davinci-resolve/default.nix b/pkgs/applications/video/davinci-resolve/default.nix
new file mode 100644
index 0000000000000..289fcdad52275
--- /dev/null
+++ b/pkgs/applications/video/davinci-resolve/default.nix
@@ -0,0 +1,178 @@
+{ stdenv
+, lib
+, cacert
+, curl
+, runCommandLocal
+, targetPlatform
+, unzip
+, appimage-run
+, addOpenGLRunpath
+, libGLU
+, xorg
+, buildFHSUserEnv
+, bash
+, writeText
+, ocl-icd
+, xkeyboard_config
+, glib
+, libarchive
+}:
+
+let
+  davinci = (
+    stdenv.mkDerivation rec {
+      pname = "davinci-resolve";
+      version = "17.4.3";
+
+      nativeBuildInputs = [ unzip appimage-run addOpenGLRunpath ];
+
+      # Pretty sure, there are missing dependencies ...
+      buildInputs = [ libGLU xorg.libXxf86vm ];
+
+      src = runCommandLocal "${pname}-src.zip"
+        rec {
+          outputHashMode = "recursive";
+          outputHashAlgo = "sha256";
+          outputHash = "0hq374n26mbcds8f1z644cvnh4h2rjdrbxxxbj4p34mx9b04ab28";
+
+          impureEnvVars = lib.fetchers.proxyImpureEnvVars;
+
+          nativeBuildInputs = [ curl ];
+
+          # ENV VARS
+          SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+
+          DOWNLOADID = "5efad1a052e8471989f662338d5247f1";
+          REFERID = "263d62f31cbb49e0868005059abcb0c9";
+          SITEURL = "https://www.blackmagicdesign.com/api/register/us/download/${DOWNLOADID}";
+
+          USERAGENT = builtins.concatStringsSep " " [
+            "User-Agent: Mozilla/5.0 (X11; Linux ${targetPlatform.linuxArch})"
+            "AppleWebKit/537.36 (KHTML, like Gecko)"
+            "Chrome/77.0.3865.75"
+            "Safari/537.36"
+          ];
+
+          REQJSON = builtins.toJSON {
+            "firstname" = "NixOS";
+            "lastname" = "Linux";
+            "email" = "someone@nixos.org";
+            "phone" = "+31 71 452 5670";
+            "country" = "nl";
+            "state" = "Province of Utrecht";
+            "city" = "Utrecht";
+            "product" = "DaVinci Resolve";
+          };
+
+        } ''
+        RESOLVEURL=$(curl \
+          -s \
+          -H 'Host: www.blackmagicdesign.com' \
+          -H 'Accept: application/json, text/plain, */*' \
+          -H 'Origin: https://www.blackmagicdesign.com' \
+          -H "$USERAGENT" \
+          -H 'Content-Type: application/json;charset=UTF-8' \
+          -H "Referer: https://www.blackmagicdesign.com/support/download/$REFERID/Linux" \
+          -H 'Accept-Encoding: gzip, deflate, br' \
+          -H 'Accept-Language: en-US,en;q=0.9' \
+          -H 'Authority: www.blackmagicdesign.com' \
+          -H 'Cookie: _ga=GA1.2.1849503966.1518103294; _gid=GA1.2.953840595.1518103294' \
+          --data-ascii "$REQJSON" \
+          --compressed \
+          "$SITEURL")
+
+        curl \
+          --retry 3 --retry-delay 3 \
+          -H "Host: sw.blackmagicdesign.com" \
+          -H "Upgrade-Insecure-Requests: 1" \
+          -H "$USERAGENT" \
+          -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8" \
+          -H "Accept-Language: en-US,en;q=0.9" \
+          --compressed \
+          "$RESOLVEURL" \
+          > $out
+      '';
+
+      # The unpack phase won't generate a directory
+      setSourceRoot = ''
+        sourceRoot=$PWD
+      '';
+
+      installPhase = ''
+        runHook preInstall
+
+        export HOME=$PWD/home
+        mkdir -p $HOME
+
+        mkdir -p $out
+        appimage-run ./DaVinci_Resolve_${version}_Linux.run -i -y -n -C $out
+
+        mkdir -p $out/{configs,DolbyVision,easyDCP,Fairlight,GPUCache,logs,Media,"Resolve Disk Database",.crashreport,.license,.LUT}
+        runHook postInstall
+      '';
+
+      dontStrip = true;
+
+      postFixup = ''
+        for program in $out/bin/*; do
+          isELF "$program" || continue
+          addOpenGLRunpath "$program"
+        done
+
+        for program in $out/libs/*; do
+          isELF "$program" || continue
+          if [[ "$program" != *"libcudnn_cnn_infer"* ]];then
+            echo $program
+            addOpenGLRunpath "$program"
+          fi
+        done
+      '';
+    }
+  );
+in
+buildFHSUserEnv {
+  name = "davinci-resolve";
+  targetPkgs = pkgs: with pkgs; [
+    librsvg
+    libGLU
+    libGL
+    xorg.libICE
+    xorg.libSM
+    xorg.libXxf86vm
+    xorg.libxcb
+    udev
+    opencl-headers
+    alsa-lib
+    xorg.libX11
+    xorg.libXext
+    expat
+    zlib
+    libuuid
+    bzip2
+    libtool
+    ocl-icd
+    glib
+    libarchive
+    xdg-utils # xdg-open needed to open URLs
+    python
+    # currently they want python 3.6 which is EOL
+    #python3
+  ];
+
+  runScript = "${bash}/bin/bash ${
+    writeText "davinci-wrapper"
+    ''
+    export QT_XKB_CONFIG_ROOT="${xkeyboard_config}/share/X11/xkb"
+    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:${davinci}/libs
+    ${davinci}/bin/resolve
+    ''
+  }";
+
+  meta = with lib; {
+    description = "Professional Video Editing, Color, Effects and Audio Post";
+    homepage = "https://www.blackmagicdesign.com/products/davinciresolve/";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ jshcmpbll ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/applications/virtualization/podman-tui/default.nix b/pkgs/applications/virtualization/podman-tui/default.nix
index 7a8ed6fed284d..17272acd86ebb 100644
--- a/pkgs/applications/virtualization/podman-tui/default.nix
+++ b/pkgs/applications/virtualization/podman-tui/default.nix
@@ -11,13 +11,13 @@
 }:
 buildGoModule rec {
   pname = "podman-tui";
-  version = "0.2.0";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "podman-tui";
     rev = "v${version}";
-    sha256 = "sha256-y5bFr31CQ4JES6tjvThyy7qmoKFC59uwtDMG5r+r8K4=";
+    sha256 = "sha256-1WbDmnKyFosp4Kz9QINr3lOR/wD0UW2QZf7nAAaoClM=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/applications/virtualization/podman/default.nix b/pkgs/applications/virtualization/podman/default.nix
index 7d783b211bbd7..1f596c609062c 100644
--- a/pkgs/applications/virtualization/podman/default.nix
+++ b/pkgs/applications/virtualization/podman/default.nix
@@ -17,13 +17,13 @@
 
 buildGoModule rec {
   pname = "podman";
-  version = "4.0.2";
+  version = "4.0.3";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "podman";
     rev = "v${version}";
-    sha256 = "sha256-uLpvTnn2EWEI8+5gC3ofMjsZ9O7nLOaaUGGuvSE1gdE=";
+    sha256 = "sha256-o/CIs+3LnbaUUpOQI1hijrxH7f1qBnrQw56TJ18jKQw=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/build-support/build-graalvm-native-image/default.nix b/pkgs/build-support/build-graalvm-native-image/default.nix
index 3aedd61ea6ce5..d34f562bc5372 100644
--- a/pkgs/build-support/build-graalvm-native-image/default.nix
+++ b/pkgs/build-support/build-graalvm-native-image/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, graalvmCEPackages, glibcLocales }:
+{ lib, stdenv, graalvm, glibcLocales }:
 
 { name ? "${args.pname}-${args.version}"
   # Final executable name
@@ -19,8 +19,8 @@
 , extraNativeImageBuildArgs ? [ ]
   # XMX size of GraalVM during build
 , graalvmXmx ? "-J-Xmx6g"
-  # The GraalVM to use
-, graalvm ? graalvmCEPackages.graalvm11-ce
+  # The GraalVM derivation to use
+, graalvmDrv ? graalvm
 , meta ? { }
 , ...
 } @ args:
@@ -28,7 +28,7 @@
 stdenv.mkDerivation (args // {
   inherit dontUnpack;
 
-  nativeBuildInputs = (args.nativeBuildInputs or [ ]) ++ [ graalvm glibcLocales ];
+  nativeBuildInputs = (args.nativeBuildInputs or [ ]) ++ [ graalvmDrv glibcLocales ];
 
   nativeImageBuildArgs = nativeImageBuildArgs ++ extraNativeImageBuildArgs ++ [ graalvmXmx ];
 
@@ -52,7 +52,7 @@ stdenv.mkDerivation (args // {
 
   meta = {
     # default to graalvm's platforms
-    platforms = graalvm.meta.platforms;
+    platforms = graalvmDrv.meta.platforms;
     # default to executable name
     mainProgram = executable;
   } // meta;
diff --git a/pkgs/data/fonts/noto-fonts/default.nix b/pkgs/data/fonts/noto-fonts/default.nix
index 248d076b997a2..4d91bf8905d55 100644
--- a/pkgs/data/fonts/noto-fonts/default.nix
+++ b/pkgs/data/fonts/noto-fonts/default.nix
@@ -71,11 +71,11 @@ let
         owner = "googlefonts";
         repo = "noto-cjk";
         inherit rev sha256;
-        sparseCheckout = "${typeface}/OTC";
+        sparseCheckout = "${typeface}/Variable/OTC";
       };
 
       installPhase = ''
-        install -m444 -Dt $out/share/fonts/opentype/noto-cjk ${typeface}/OTC/*.ttc
+        install -m444 -Dt $out/share/fonts/opentype/noto-cjk ${typeface}/Variable/OTC/*.otf.ttc
       '';
 
       passthru.tests.noto-fonts = nixosTests.noto-fonts;
@@ -117,14 +117,14 @@ in
     typeface = "Sans";
     version = "2.004";
     rev = "9f7f3c38eab63e1d1fddd8d50937fe4f1eacdb1d";
-    sha256 = "sha256-pNC/WJCYHSlU28E/CSFsrEMbyCe/6tjevDlOvDK9RwU=";
+    sha256 = "sha256-11d/78i21yuzxrfB5t2VQN9OBz/qZKeozuS6BrLFjzw=";
   };
 
   noto-fonts-cjk-serif = mkNotoCJK {
     typeface = "Serif";
     version = "2.000";
     rev = "9f7f3c38eab63e1d1fddd8d50937fe4f1eacdb1d";
-    sha256 = "sha256-Iy4lmWj5l+/Us/dJJ/Jl4MEojE9mrFnhNQxX2zhVngY=";
+    sha256 = "sha256-G+yl3LZvSFpbEUuuvattPDctKTzBCshOi970DcbPliE=";
   };
 
   noto-fonts-emoji = let
diff --git a/pkgs/data/misc/v2ray-geoip/default.nix b/pkgs/data/misc/v2ray-geoip/default.nix
index 1e0d35d52000d..49f8fc746d67c 100644
--- a/pkgs/data/misc/v2ray-geoip/default.nix
+++ b/pkgs/data/misc/v2ray-geoip/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "v2ray-geoip";
-  version = "202203240042";
+  version = "202203310042";
 
   src = fetchFromGitHub {
     owner = "v2fly";
     repo = "geoip";
-    rev = "d7ff77f883216595a4b6674e9507f305195dcda3";
-    sha256 = "sha256-wSm24nXz4QIM8e7Z8d08NjluLaBWEdl09FNAL3GR9so=";
+    rev = "eb0fc69f57bdceef077e38d4f4f57c114411bd76";
+    sha256 = "sha256-CSABX+329/WgaXy144JgYsr3OesI69vCfew5qxz5jMY=";
   };
 
   installPhase = ''
diff --git a/pkgs/data/themes/yaru/default.nix b/pkgs/data/themes/yaru/default.nix
index 67762e747f4a8..a27370b963683 100644
--- a/pkgs/data/themes/yaru/default.nix
+++ b/pkgs/data/themes/yaru/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "yaru";
-  version = "22.04.2";
+  version = "22.04.3.1";
 
   src = fetchFromGitHub {
     owner = "ubuntu";
     repo = "yaru";
     rev = version;
-    sha256 = "sha256-oW5OOJPhC3OB3GIQWTQxPgqE7p4bAO1TyVbyKUHnyD0=";
+    sha256 = "sha256-nNI6Nm3ZpIJRTbIbe/P9cKofcthb6qWKjn81/ZpPo2g=";
   };
 
   nativeBuildInputs = [ meson sassc pkg-config glib ninja python3 ];
diff --git a/pkgs/tools/bluetooth/blueberry/gnome-bluetooth.nix b/pkgs/desktops/gnome/core/gnome-bluetooth/1.0/default.nix
index cf0028cf833d6..38bb96980dcad 100644
--- a/pkgs/tools/bluetooth/blueberry/gnome-bluetooth.nix
+++ b/pkgs/desktops/gnome/core/gnome-bluetooth/1.0/default.nix
@@ -1,5 +1,5 @@
-{ lib
-, stdenv
+{ stdenv
+, lib
 , fetchurl
 , fetchpatch
 , gnome
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1a9ynlwwkb3wpg293ym517vmrkk63y809mmcv9a21k5yr199x53c";
+    sha256 = "bJSeUsi+zCBU2qzWBJAfZs5c9wml+pHEu3ysyTm1Pqk=";
   };
 
   patches = [
@@ -82,7 +82,8 @@ stdenv.mkDerivation rec {
   passthru = {
     updateScript = gnome.updateScript {
       packageName = pname;
-      attrPath = "gnome.${pname}";
+      attrPath = "gnome.gnome-bluetooth_1_0";
+      freeze = true;
     };
   };
 
diff --git a/pkgs/desktops/gnome/core/gucharmap/default.nix b/pkgs/desktops/gnome/core/gucharmap/default.nix
index 3dc08e66357a3..dbea63db4a35e 100644
--- a/pkgs/desktops/gnome/core/gucharmap/default.nix
+++ b/pkgs/desktops/gnome/core/gucharmap/default.nix
@@ -45,7 +45,7 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "gucharmap";
-  version = "14.0.2";
+  version = "14.0.3";
 
   outputs = [ "out" "lib" "dev" "devdoc" ];
 
@@ -54,7 +54,7 @@ in stdenv.mkDerivation rec {
     owner = "GNOME";
     repo = pname;
     rev = version;
-    sha256 = "sha256-gyOm/S0ae0kX4AFUiglqyGRGB8C/KUuaG/dr/Wf1ug0=";
+    sha256 = "sha256-xO34CR+SWxtHuP6G8m0jla0rivVp3ddrsODNo50MhHw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/gnome/core/sushi/default.nix b/pkgs/desktops/gnome/core/sushi/default.nix
index 00ac8e40aad0e..4c6f960d8c845 100644
--- a/pkgs/desktops/gnome/core/sushi/default.nix
+++ b/pkgs/desktops/gnome/core/sushi/default.nix
@@ -23,11 +23,11 @@
 
 stdenv.mkDerivation rec {
   pname = "sushi";
-  version = "41.0";
+  version = "41.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/sushi/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "m3UlaQzkNmJO+gpgV3NJNDLNDva49GSYLouETtqYmO4=";
+    sha256 = "JifbYWLnV3hZDAfhZbLzbqJNEjGlE7FkAj/G3fx1xKM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/gnome/default.nix b/pkgs/desktops/gnome/default.nix
index 729a6bd16ca8d..1fc15fc6406f1 100644
--- a/pkgs/desktops/gnome/default.nix
+++ b/pkgs/desktops/gnome/default.nix
@@ -48,6 +48,8 @@ lib.makeScope pkgs.newScope (self: with self; {
 
   gnome-bluetooth = callPackage ./core/gnome-bluetooth { };
 
+  gnome-bluetooth_1_0 = callPackage ./core/gnome-bluetooth/1.0 { };
+
   gnome-color-manager = callPackage ./core/gnome-color-manager { };
 
   gnome-contacts = callPackage ./core/gnome-contacts { };
diff --git a/pkgs/desktops/gnome/extensions/pop-shell/default.nix b/pkgs/desktops/gnome/extensions/pop-shell/default.nix
index 381a82e5bdf08..d24a407f92b7a 100644
--- a/pkgs/desktops/gnome/extensions/pop-shell/default.nix
+++ b/pkgs/desktops/gnome/extensions/pop-shell/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-shell-extension-pop-shell";
-  version = "unstable-2022-01-14";
+  version = "unstable-2022-03-25";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "shell";
-    rev = "21745c4a8076ad52c9ccc77ca5726f5c7b83de6c";
-    sha256 = "sha256-d6NRNbTimwtGVLhcpdFD1AuignVii/xi3YtMWzkS/v0=";
+    rev = "a317816d02dd2cb20d31aeca81bf09eccc63e370";
+    hash = "sha256-uxoeCv25ew5+NkTpsKjQqDFrqw6ZA/+iYhyCHoCb6jM=";
   };
 
   nativeBuildInputs = [ glib nodePackages.typescript gjs ];
diff --git a/pkgs/desktops/gnome/games/aisleriot/default.nix b/pkgs/desktops/gnome/games/aisleriot/default.nix
index 5a7446862bdc5..953a40623c0d0 100644
--- a/pkgs/desktops/gnome/games/aisleriot/default.nix
+++ b/pkgs/desktops/gnome/games/aisleriot/default.nix
@@ -10,7 +10,7 @@
 , librsvg
 , libxml2
 , desktop-file-utils
-, guile_3_0
+, guile
 , libcanberra-gtk3
 , ninja
 , appstream-glib
@@ -19,14 +19,14 @@
 
 stdenv.mkDerivation rec {
   pname = "aisleriot";
-  version = "3.22.21";
+  version = "3.22.22";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "GNOME";
     repo = pname;
     rev = version;
-    sha256 = "sha256-dpzuePxSoJcwUlj314r5G9A8aF1Yz49r+DxNTfA8/Ks=";
+    sha256 = "sha256-Jr4XEj6h+gI1gNqoJ/cJ3cDBB4mSbpzvOUQkwGxkLPs=";
   };
 
   nativeBuildInputs = [
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     gtk3
     librsvg
-    guile_3_0
+    guile
     libcanberra-gtk3
   ];
 
diff --git a/pkgs/desktops/gnome/games/five-or-more/default.nix b/pkgs/desktops/gnome/games/five-or-more/default.nix
index f01d137979ec1..ce532d1d5cd47 100644
--- a/pkgs/desktops/gnome/games/five-or-more/default.nix
+++ b/pkgs/desktops/gnome/games/five-or-more/default.nix
@@ -1,21 +1,46 @@
-{ lib, stdenv, fetchurl, meson, ninja, pkg-config, gnome, gtk3, wrapGAppsHook
-, librsvg, libgnome-games-support, gettext, itstool, libxml2, python3, vala }:
+{ stdenv
+, lib
+, fetchurl
+, meson
+, ninja
+, pkg-config
+, gnome
+, gtk3
+, wrapGAppsHook
+, librsvg
+, libgnome-games-support
+, gettext
+, itstool
+, libxml2
+, python3
+, vala
+}:
 
 stdenv.mkDerivation rec {
   pname = "five-or-more";
-  version = "3.32.2";
+  version = "3.32.3";
 
   src = fetchurl {
     url = "mirror://gnome/sources/five-or-more/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "19pf8wzbf3ciqf2k4bj9sddvyhckfd62x86pnqr6s8h4vn9jc6ii";
+    sha256 = "LRDXLu/esyS0R9YyrwwySW4l/BWjwB230vAMm1HQnvQ=";
   };
 
   nativeBuildInputs = [
-    meson ninja pkg-config gettext itstool libxml2 python3 wrapGAppsHook
+    meson
+    ninja
+    pkg-config
+    gettext
+    itstool
+    libxml2
+    python3
+    wrapGAppsHook
     vala
   ];
+
   buildInputs = [
-    gtk3 librsvg libgnome-games-support gnome.adwaita-icon-theme
+    gtk3
+    librsvg
+    libgnome-games-support
   ];
 
   postPatch = ''
diff --git a/pkgs/desktops/gnome/misc/gnome-flashback/default.nix b/pkgs/desktops/gnome/misc/gnome-flashback/default.nix
index 34d2b6eea3c29..4401915d40ba1 100644
--- a/pkgs/desktops/gnome/misc/gnome-flashback/default.nix
+++ b/pkgs/desktops/gnome/misc/gnome-flashback/default.nix
@@ -1,9 +1,10 @@
-{ lib, stdenv
+{ stdenv
+, lib
 , autoreconfHook
 , fetchurl
 , gettext
 , glib
-, gnome-bluetooth
+, gnome-bluetooth_1_0
 , gnome-desktop
 , gnome-panel
 , gnome-session
@@ -94,7 +95,7 @@ let
 
     buildInputs = [
       glib
-      gnome-bluetooth
+      gnome-bluetooth_1_0
       gnome-desktop
       gsettings-desktop-schemas
       gtk3
diff --git a/pkgs/desktops/gnome/misc/gnome-panel/default.nix b/pkgs/desktops/gnome/misc/gnome-panel/default.nix
index 139e161352a11..0b107f23d78d1 100644
--- a/pkgs/desktops/gnome/misc/gnome-panel/default.nix
+++ b/pkgs/desktops/gnome/misc/gnome-panel/default.nix
@@ -1,9 +1,12 @@
-{ lib, stdenv
+{ stdenv
+, lib
 , fetchurl
+, fetchpatch
 , autoreconfHook
 , dconf
 , evolution-data-server
 , gdm
+, geocode-glib
 , gettext
 , glib
 , gnome-desktop
@@ -37,6 +40,13 @@ stdenv.mkDerivation rec {
     # instead of gnome-panel’s libdir so that the NixOS module can make gnome-panel
     # load modules from other packages as well.
     ./modulesdir-env-var.patch
+
+    # Add missing geocode-glib-1.0 dependency
+    # https://gitlab.gnome.org/GNOME/gnome-panel/-/merge_requests/49
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/gnome-panel/-/commit/f58a43ec4649a25f1a762b36e1401b81cd2b214b.patch";
+      sha256 = "sha256-DFqaNUjkLh4xd81qgQpl+568eUZeWyF8LxdZoTgMfCQ=";
+    })
   ];
 
   # make .desktop Exec absolute
@@ -69,6 +79,7 @@ stdenv.mkDerivation rec {
     dconf
     evolution-data-server
     gdm
+    geocode-glib
     glib
     gnome-desktop
     gnome-menus
diff --git a/pkgs/desktops/pantheon/apps/elementary-dock/default.nix b/pkgs/desktops/pantheon/apps/elementary-dock/default.nix
index 5aa61062a8f6f..d9cd7f184943c 100644
--- a/pkgs/desktops/pantheon/apps/elementary-dock/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-dock/default.nix
@@ -68,6 +68,14 @@ stdenv.mkDerivation rec {
     pango
   ];
 
+  postInstall = ''
+    # elementary/dock/master is missing a Meson post
+    # install script that does this. This has been
+    # resolved after the dock rewrite (the `main` branch).
+    # https://github.com/elementary/default-settings/issues/267
+    glib-compile-schemas $out/share/glib-2.0/schemas
+  '';
+
   meta = with lib; {
     description = "Elegant, simple, clean dock";
     homepage = "https://github.com/elementary/dock";
diff --git a/pkgs/desktops/pantheon/default.nix b/pkgs/desktops/pantheon/default.nix
index a3d5f873cbcbc..7f28109ad1013 100644
--- a/pkgs/desktops/pantheon/default.nix
+++ b/pkgs/desktops/pantheon/default.nix
@@ -108,7 +108,7 @@ lib.makeScope pkgs.newScope (self: with self; {
   gala = callPackage ./desktop/gala { };
 
   gnome-bluetooth-contract = callPackage ./desktop/gnome-bluetooth-contract {
-    inherit (gnome) gnome-bluetooth;
+    inherit (gnome) gnome-bluetooth_1_0;
   };
 
   wingpanel = callPackage ./desktop/wingpanel { };
diff --git a/pkgs/desktops/pantheon/desktop/gnome-bluetooth-contract/default.nix b/pkgs/desktops/pantheon/desktop/gnome-bluetooth-contract/default.nix
index 1905143920987..6df583c2ce6ab 100644
--- a/pkgs/desktops/pantheon/desktop/gnome-bluetooth-contract/default.nix
+++ b/pkgs/desktops/pantheon/desktop/gnome-bluetooth-contract/default.nix
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , unstableGitUpdater
 , substituteAll
-, gnome-bluetooth
+, gnome-bluetooth_1_0
 }:
 
 stdenv.mkDerivation rec {
@@ -20,7 +20,9 @@ stdenv.mkDerivation rec {
   patches = [
     (substituteAll {
       src = ./exec-path.patch;
-      gnome_bluetooth = gnome-bluetooth;
+      # sendto device selection is removed in gnome-bluetooth 42
+      # https://github.com/elementary/gnome-bluetooth-contract/issues/1
+      gnome_bluetooth = gnome-bluetooth_1_0;
     })
   ];
 
@@ -49,8 +51,5 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3Plus;
     maintainers = teams.pantheon.members;
     platforms = platforms.linux;
-    # sendto device selection is removed in gnome-bluetooth 42
-    # https://github.com/elementary/gnome-bluetooth-contract/issues/1
-    broken = true;
   };
 }
diff --git a/pkgs/development/compilers/aliceml/default.nix b/pkgs/development/compilers/aliceml/default.nix
index c7dc561e7b6c3..fe223cacec899 100644
--- a/pkgs/development/compilers/aliceml/default.nix
+++ b/pkgs/development/compilers/aliceml/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ autoconf automake ];
   buildInputs = [
-    stdenv gcc glibc
+    gcc glibc
     libtool gnumake
     file which zsh m4 gtk2 zlib gmp
     gnome2.libgnomecanvas pango sqlite
diff --git a/pkgs/development/compilers/ocaml/4.14.nix b/pkgs/development/compilers/ocaml/4.14.nix
index 558a1491ca7f0..216620d67d606 100644
--- a/pkgs/development/compilers/ocaml/4.14.nix
+++ b/pkgs/development/compilers/ocaml/4.14.nix
@@ -1,9 +1,6 @@
 import ./generic.nix {
   major_version = "4";
   minor_version = "14";
-  patch_version = "0-rc2";
-  src = fetchTarball {
-    url = "https://caml.inria.fr/pub/distrib/ocaml-4.14/ocaml-4.14.0~rc2.tar.xz";
-    sha256 = "sha256:0ch8nyfk2mzwhmlxb434cyamp7n14zxhwsq1h8033g629kw50kb0";
-  };
+  patch_version = "0";
+  sha256 = "sha256:0axcc7c23pf4qinz4vxgkba6pwziwbp9i2ydwzar7x9zlp6diarn";
 }
diff --git a/pkgs/development/compilers/vala/default.nix b/pkgs/development/compilers/vala/default.nix
index 230f6ee19a20d..8013f283c708d 100644
--- a/pkgs/development/compilers/vala/default.nix
+++ b/pkgs/development/compilers/vala/default.nix
@@ -90,8 +90,8 @@ let
 
 in rec {
   vala_0_48 = generic {
-    version = "0.48.23";
-    sha256 = "sha256-3jzIWNmV4HR0IZ4lo+Hw7ZmAcNLiBtOjE9Q3ml93oGo=";
+    version = "0.48.24";
+    sha256 = "NknvhFc7aGX8NHBkDuYDcgCZ65FbOfqtGbdJjeGn3yQ=";
   };
 
   vala_0_54 = generic {
diff --git a/pkgs/development/haskell-modules/configuration-nix.nix b/pkgs/development/haskell-modules/configuration-nix.nix
index 32108a0b7182a..7100aeeb7fdea 100644
--- a/pkgs/development/haskell-modules/configuration-nix.nix
+++ b/pkgs/development/haskell-modules/configuration-nix.nix
@@ -866,11 +866,11 @@ self: super: builtins.intersectAttrs super {
 
   rel8 = addTestToolDepend pkgs.postgresql super.rel8;
 
-  cachix = generateOptparseApplicativeCompletion "cachix" (super.cachix.override { nix = pkgs.nixVersions.nix_2_4; });
+  cachix = generateOptparseApplicativeCompletion "cachix" (super.cachix.override { nix = pkgs.nixVersions.nix_2_7; });
 
-  hercules-ci-agent = appendConfigureFlag "-fnix-2_4" (super.hercules-ci-agent.override { nix = pkgs.nixVersions.nix_2_4; });
-  hercules-ci-cnix-expr = appendConfigureFlag "-fnix-2_4" (super.hercules-ci-cnix-expr.override { nix = pkgs.nixVersions.nix_2_4; });
-  hercules-ci-cnix-store = appendConfigureFlag "-fnix-2_4" (super.hercules-ci-cnix-store.override { nix = pkgs.nixVersions.nix_2_4; });
+  hercules-ci-agent = super.hercules-ci-agent.override { nix = pkgs.nixVersions.nix_2_7; };
+  hercules-ci-cnix-expr = super.hercules-ci-cnix-expr.override { nix = pkgs.nixVersions.nix_2_7; };
+  hercules-ci-cnix-store = super.hercules-ci-cnix-store.override { nix = pkgs.nixVersions.nix_2_7; };
 
   # Enable extra optimisations which increase build time, but also
   # later compiler performance, so we should do this for user's benefit.
diff --git a/pkgs/development/libraries/allegro/5.nix b/pkgs/development/libraries/allegro/5.nix
index 380cc1f7198eb..859d46459cb8a 100644
--- a/pkgs/development/libraries/allegro/5.nix
+++ b/pkgs/development/libraries/allegro/5.nix
@@ -18,9 +18,10 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-JdnzEW+qAhAljR+WfmgE3P9xeR2HvjS64tFgCC0tNA0=";
   };
 
+  nativeBuildInputs = [ cmake ];
   buildInputs = [
     texinfo libXext xorgproto libX11 libXpm libXt libXcursor
-    alsa-lib cmake zlib libpng libvorbis libXxf86dga libXxf86misc
+    alsa-lib zlib libpng libvorbis libXxf86dga libXxf86misc
     libXxf86vm openal libGLU libGL
     libjpeg flac
     libXi libXfixes
diff --git a/pkgs/development/libraries/allegro/default.nix b/pkgs/development/libraries/allegro/default.nix
index 6abf632806a49..d9c862443653a 100644
--- a/pkgs/development/libraries/allegro/default.nix
+++ b/pkgs/development/libraries/allegro/default.nix
@@ -17,9 +17,10 @@ stdenv.mkDerivation rec {
     ./encoding.patch
   ];
 
+  nativeBuildInputs = [ cmake ];
   buildInputs = [
     texinfo6_5 libXext xorgproto libX11 libXpm libXt libXcursor
-    alsa-lib cmake zlib libpng libvorbis libXxf86dga libXxf86misc
+    alsa-lib zlib libpng libvorbis libXxf86dga libXxf86misc
     libXxf86vm openal libGLU libGL
   ];
 
diff --git a/pkgs/development/libraries/gcr/default.nix b/pkgs/development/libraries/gcr/default.nix
index b277a52a65837..6c1c3de08a2ee 100644
--- a/pkgs/development/libraries/gcr/default.nix
+++ b/pkgs/development/libraries/gcr/default.nix
@@ -16,7 +16,7 @@
 , openssh
 , systemd
 , gobject-introspection
-, makeWrapper
+, wrapGAppsHook
 , libxslt
 , vala
 , gnome
@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
     gettext
     gobject-introspection
     libxslt
-    makeWrapper
+    wrapGAppsHook
     vala
     shared-mime-info
   ];
@@ -96,11 +96,6 @@ stdenv.mkDerivation rec {
     patchShebangs meson_post_install.py
   '';
 
-  preFixup = ''
-    wrapProgram "$out/bin/gcr-viewer" \
-      --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH"
-  '';
-
   passthru = {
     updateScript = gnome.updateScript {
       packageName = pname;
diff --git a/pkgs/development/libraries/gnome-online-accounts/default.nix b/pkgs/development/libraries/gnome-online-accounts/default.nix
index f58e87b2f7e68..1fed0b470691f 100644
--- a/pkgs/development/libraries/gnome-online-accounts/default.nix
+++ b/pkgs/development/libraries/gnome-online-accounts/default.nix
@@ -30,7 +30,7 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-online-accounts";
-  version = "3.43.1";
+  version = "3.44.0";
 
   # https://gitlab.gnome.org/GNOME/gnome-online-accounts/issues/87
   src = fetchFromGitLab {
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     owner = "GNOME";
     repo = "gnome-online-accounts";
     rev = version;
-    sha256 = "sha256-Dpq5bQwU0ZAxmEllpbLnS1Jz3F0rxtFMKZcIvAteObU=";
+    sha256 = "sha256-8dp3cizyQVHegDxX9G6iGLW5g44audn431hCPMS/KlA=";
   };
 
   outputs = [ "out" "man" "dev" "devdoc" ];
diff --git a/pkgs/development/libraries/intel-media-sdk/default.nix b/pkgs/development/libraries/intel-media-sdk/default.nix
index 71a4437397a55..034d5b74b5633 100644
--- a/pkgs/development/libraries/intel-media-sdk/default.nix
+++ b/pkgs/development/libraries/intel-media-sdk/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-media-sdk";
-  version = "22.2.0";
+  version = "22.2.1";
 
   src = fetchFromGitHub {
     owner = "Intel-Media-SDK";
     repo = "MediaSDK";
     rev = "intel-mediasdk-${version}";
-    sha256 = "sha256-Hcm48KTuBQbnVHd/T5XqQKbVS/XgJ4TYNbSCc8O53XQ=";
+    sha256 = "sha256-S8RShdpXz1WQoyuLxUDT94ftnep2WCy8oYKzeYBgftw=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index d37e0a050866c..f6cdf0b1f7cb8 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -68,7 +68,7 @@ let
 
   self = stdenv.mkDerivation rec {
     pname = "pipewire";
-    version = "0.3.48";
+    version = "0.3.49";
 
     outputs = [
       "out"
@@ -86,7 +86,7 @@ let
       owner = "pipewire";
       repo = "pipewire";
       rev = version;
-      sha256 = "sha256-+gk/MJ9YimHBwN2I42DRP+I2OqBFFtZ81Fd/l89HcSk=";
+      sha256 = "sha256-8heX/9BsPguIOzHOuqEQdt6MS3eS4HxR4A+FUZKNpdo=";
     };
 
     patches = [
diff --git a/pkgs/development/libraries/xalanc/default.nix b/pkgs/development/libraries/xalanc/default.nix
index b750b26996d5e..2b5f2379fde7f 100644
--- a/pkgs/development/libraries/xalanc/default.nix
+++ b/pkgs/development/libraries/xalanc/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256:0q1204qk97i9h14vxxq7phcfpyiin0i1zzk74ixvg4wqy87b62s8";
   };
 
-  buildInputs = [ xercesc getopt cmake ];
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ xercesc getopt ];
 
   meta = {
     homepage = "https://xalan.apache.org/";
diff --git a/pkgs/development/libraries/zlib/default.nix b/pkgs/development/libraries/zlib/default.nix
index 144a4a64d1da4..91cd037e0e33d 100644
--- a/pkgs/development/libraries/zlib/default.nix
+++ b/pkgs/development/libraries/zlib/default.nix
@@ -23,26 +23,16 @@ assert splitStaticOutput -> static;
 
 stdenv.mkDerivation (rec {
   pname = "zlib";
-  version = "1.2.11";
+  version = "1.2.12";
 
   src = fetchurl {
     urls =
       [ "https://www.zlib.net/fossils/zlib-${version}.tar.gz"  # stable archive path
         "mirror://sourceforge/libpng/zlib/${version}/zlib-${version}.tar.gz"
       ];
-    sha256 = "c3e5e9fdd5004dcb542feda5ee4f0ff0744628baf8ed2dd5d66f8ca1197cb1a1";
+    sha256 = "91844808532e5ce316b3c010929493c0244f3d37593afd6de04f71821d5136d9";
   };
 
-  patches = [
-    # https://nvd.nist.gov/vuln/detail/CVE-2018-25032
-    # https://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531
-    ./CVE-2018-25032-1.patch
-    # https://github.com/madler/zlib/commit/4346a16853e19b45787ce933666026903fb8f3f8
-    ./CVE-2018-25032-2.patch
-  ] ++ lib.optionals stdenv.hostPlatform.isCygwin [
-    ./disable-cygwin-widechar.patch
-  ];
-
   postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
     substituteInPlace configure \
       --replace '/usr/bin/libtool' '${stdenv.cc.targetPrefix}ar' \
diff --git a/pkgs/development/libraries/zlib/disable-cygwin-widechar.patch b/pkgs/development/libraries/zlib/disable-cygwin-widechar.patch
deleted file mode 100644
index 3de4978c30661..0000000000000
--- a/pkgs/development/libraries/zlib/disable-cygwin-widechar.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/gzguts.h b/gzguts.h
-index 990a4d2..6378d46 100644
---- a/gzguts.h
-+++ b/gzguts.h
-@@ -39,7 +39,7 @@
- #  include <io.h>
- #endif
- 
--#if defined(_WIN32) || defined(__CYGWIN__)
-+#if defined(_WIN32)
- #  define WIDECHAR
- #endif
- 
diff --git a/pkgs/development/lisp-modules/shell.nix b/pkgs/development/lisp-modules/shell.nix
index dcec6db8edd32..0d1fadf2552c7 100644
--- a/pkgs/development/lisp-modules/shell.nix
+++ b/pkgs/development/lisp-modules/shell.nix
@@ -5,7 +5,7 @@ self = rec {
   name = "ql-to-nix";
   env = buildEnv { name = name; paths = buildInputs; };
   buildInputs = [
-    gcc stdenv
+    gcc
     openssl fuse libuv libmysqlclient libfixposix libev sqlite
     freetds
     lispPackages.quicklisp-to-nix lispPackages.quicklisp-to-nix-system-info
diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index 71d85a776bb29..4269d7eb0d7e6 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -2028,22 +2028,32 @@ buildLuarocksPackage {
   };
 }) {};
 
-luv = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
-, fetchurl, lua
+luv = callPackage ({ buildLuarocksPackage, luaOlder, luaAtLeast
+, cmake, fetchurl, lua
 }:
 buildLuarocksPackage {
   pname = "luv";
   version = "1.43.0-0";
   knownRockspec = (fetchurl {
-    url    = "https://raw.githubusercontent.com/rocks-moonscript-org/moonrocks-mirror/master/luv-1.43.0-0.rockspec";
+    url    = "https://luarocks.org/luv-1.43.0-0.rockspec";
     sha256 = "0z5a7yp20xbb3f9w73skm9fj89gxxqv72nrxjq3kycsc6c2v3m8f";
   }).outPath;
-  src = fetchurl {
-    url    = "https://github.com/luvit/luv/releases/download/1.43.0-0/luv-1.43.0-0.tar.gz";
-    sha256 = "1qlx1r79sfn8r20yx19bhdr0v58ykpwgwzy5vma9p2ngrlynyyjn";
-  };
+
+  src = fetchgit ( removeAttrs (builtins.fromJSON ''{
+  "url": "https://github.com/luvit/luv.git",
+  "rev": "1.43.0-0",
+  "date": "2022-03-12T16:05:50+08:00",
+  "path": "/nix/store/d7f3sdw5l0cm8xkjdm4m6jkmx794w48j-luv",
+  "sha256": "sha256-CcUX69XzgWlJEwHUhhtqs9sDA5TNIusKek5yV2Nt3Wc=",
+  "fetchLFS": false,
+  "fetchSubmodules": true,
+  "deepClone": false,
+  "leaveDotGit": false
+}
+ '') ["date" "path"]) ;
 
   disabled = with lua; (luaOlder "5.1");
+  nativeBuildInputs = [ cmake ];
   propagatedBuildInputs = [ lua ];
 
   meta = {
diff --git a/pkgs/development/lua-modules/lib.nix b/pkgs/development/lua-modules/lib.nix
index bd952e7b8ce78..5079a4b25405c 100644
--- a/pkgs/development/lua-modules/lib.nix
+++ b/pkgs/development/lua-modules/lib.nix
@@ -82,6 +82,8 @@ rec {
   */
   generateLuarocksConfig = {
     externalDeps
+
+    # a list of lua derivations
     , requiredLuaRocks
     , extraVariables ? {}
     , rocksSubdir
@@ -113,9 +115,10 @@ rec {
     -- To prevent collisions when creating environments, we install the rock
     -- files into per-package subdirectories
     rocks_subdir = '${rocksSubdir}'
-    -- Then we need to tell luarocks where to find the rock files per
-    -- dependency
+    -- first tree is the default target where new rocks are installed,
+    -- any other trees in the list are treated as additional sources of installed rocks for matching dependencies.
     rocks_trees = {
+      {name = "current", root = '${placeholder "out"}', rocks_dir = "current" },
       ${lib.concatStringsSep "\n, " rocksTrees}
     }
   '' + lib.optionalString lua.pkgs.isLuaJIT ''
diff --git a/pkgs/development/lua-modules/overrides.nix b/pkgs/development/lua-modules/overrides.nix
index 4db4200f7e22c..106675a4d28e5 100644
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@@ -280,34 +280,49 @@ with prev;
     '';
   });
 
-  luv = prev.lib.overrideLuarocks prev.luv (drv: {
-    # Use system libuv instead of building local and statically linking
-    # This is a hacky way to specify -DWITH_SHARED_LIBUV=ON which
-    # is not possible with luarocks and the current luv rockspec
-    # While at it, remove bundled libuv source entirely to be sure.
-    # We may wish to drop bundled lua submodules too...
-    preBuild = ''
-     sed -i 's,\(option(WITH_SHARED_LIBUV.*\)OFF,\1ON,' CMakeLists.txt
-     rm -rf deps/libuv
-    '';
 
-    buildInputs = [ pkgs.libuv ];
+  # as advised in https://github.com/luarocks/luarocks/issues/1402#issuecomment-1080616570
+  # we shouldn't use luarocks machinery to build complex cmake components
+  libluv = pkgs.stdenv.mkDerivation {
+
+    inherit (prev.luv) pname version meta src;
 
-    passthru = {
-      libluv = final.luv.overrideAttrs (oa: {
-        preBuild = final.luv.preBuild + ''
-          sed -i 's,\(option(BUILD_MODULE.*\)ON,\1OFF,' CMakeLists.txt
-          sed -i 's,\(option(BUILD_SHARED_LIBS.*\)OFF,\1ON,' CMakeLists.txt
-          sed -i 's,${"\${.*INSTALL_INC_DIR}"},${placeholder "out"}/include/luv,' CMakeLists.txt
-        '';
+      cmakeFlags = [
+        "-DBUILD_SHARED_LIBS=ON"
+        "-DBUILD_MODULE=OFF"
+        "-DWITH_SHARED_LIBUV=ON"
+      ];
 
-        nativeBuildInputs = pkgs.lib.optionals pkgs.stdenv.isDarwin [ pkgs.fixDarwinDylibNames ];
+      buildInputs = [ pkgs.libuv ];
+
+      nativeBuildInputs = [ pkgs.pkg-config pkgs.cmake ]
+        ++ pkgs.lib.optionals pkgs.stdenv.isDarwin [ pkgs.fixDarwinDylibNames ];
+
+      # Fixup linking libluv.dylib, for some reason it's not linked against lua correctly.
+      NIX_LDFLAGS = pkgs.lib.optionalString pkgs.stdenv.isDarwin
+        (if isLuaJIT then "-lluajit-${lua.luaversion}" else "-llua");
+  };
+
+  luv = prev.lib.overrideLuarocks prev.luv (drv: {
 
-        # Fixup linking libluv.dylib, for some reason it's not linked against lua correctly.
-        NIX_LDFLAGS = pkgs.lib.optionalString pkgs.stdenv.isDarwin
-          (if isLuaJIT then "-lluajit-${lua.luaversion}" else "-llua");
-      });
+    buildInputs = [ pkgs.pkg-config pkgs.libuv ];
+
+    doInstallCheck = true;
+
+    # Use system libuv instead of building local and statically linking
+    extraVariables = {
+      "WITH_SHARED_LIBUV" = "ON";
     };
+
+    # we unset the LUA_PATH since the hook erases the interpreter defaults (To fix)
+    installCheckPhase = ''
+      unset LUA_PATH
+      rm tests/test-{dns,thread}.lua
+      lua tests/run.lua
+    '';
+
+    passthru.libluv = final.libluv;
+
   });
 
   lyaml = prev.lib.overrideLuarocks prev.lyaml (oa: {
diff --git a/pkgs/development/ocaml-modules/unionFind/default.nix b/pkgs/development/ocaml-modules/unionFind/default.nix
new file mode 100644
index 0000000000000..aa1d5e82362bc
--- /dev/null
+++ b/pkgs/development/ocaml-modules/unionFind/default.nix
@@ -0,0 +1,24 @@
+{ lib, fetchFromGitLab, buildDunePackage }:
+
+buildDunePackage rec {
+  pname = "unionFind";
+  version = "20220122";
+
+  useDune2 = true;
+  minimalOCamlVersion = "4.05";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.inria.fr";
+    owner = "fpottier";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256:0hdh56rbg8vfjd61q09cbmh8l5wmry5ykivg7gsm0v5ckkb3531r";
+  };
+
+  meta = {
+    description = "Implementations of the union-find data structure";
+    license = lib.licenses.lgpl2Only;
+    inherit (src.meta) homepage;
+    maintainers = [ lib.maintainers.vbgl ];
+  };
+}
diff --git a/pkgs/development/python-modules/aioairzone/default.nix b/pkgs/development/python-modules/aioairzone/default.nix
index cda625d495335..5983c46b3ab8c 100644
--- a/pkgs/development/python-modules/aioairzone/default.nix
+++ b/pkgs/development/python-modules/aioairzone/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "aioairzone";
-  version = "0.2.1";
+  version = "0.3.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "Noltari";
     repo = pname;
     rev = version;
-    hash = "sha256-R5OK/B7fq15lpt8nKECiHMmfK9xmiLPtoKC65C7H/7c=";
+    hash = "sha256-iu0pX12GmP5u6G8uY+6FODj732dD6JPxkrpWXw41/6Q=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/aioguardian/default.nix b/pkgs/development/python-modules/aioguardian/default.nix
index 439035229a766..baf84ad89f42b 100644
--- a/pkgs/development/python-modules/aioguardian/default.nix
+++ b/pkgs/development/python-modules/aioguardian/default.nix
@@ -15,13 +15,13 @@
 
 buildPythonPackage rec {
   pname = "aioguardian";
-  version = "2021.11.0";
+  version = "2022.03.1";
 
   src = fetchFromGitHub {
     owner = "bachya";
     repo = pname;
     rev = version;
-    sha256 = "sha256-jQIRACm0d0a5mQqlwxSTgLZfJFvGLWuJTb/MacppmS4=";
+    sha256 = "sha256-UiRTyUAoTcohRkTBF5Jvd/uY2zAbHV5z4HC8Oc0QNTs=";
   };
 
   format = "pyproject";
diff --git a/pkgs/development/python-modules/amazon-ion/default.nix b/pkgs/development/python-modules/amazon-ion/default.nix
new file mode 100644
index 0000000000000..016fa989a8ab3
--- /dev/null
+++ b/pkgs/development/python-modules/amazon-ion/default.nix
@@ -0,0 +1,29 @@
+{ lib, buildPythonPackage, fetchPypi, jsonconversion, six, pytestCheckHook }:
+
+buildPythonPackage rec {
+  pname = "amazon-ion";
+  version = "0.8.0";
+
+  src = fetchPypi {
+    pname = "amazon.ion";
+    inherit version;
+    sha256 = "sha256-vtztUHSnGoPYozhwvigxEdieVtbKNfV4B5yZ4MHaWGw=";
+  };
+
+  postPatch = ''
+    substituteInPlace setup.py --replace "'pytest-runner'," ""
+  '';
+
+  propagatedBuildInputs = [ jsonconversion six ];
+
+  checkInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "amazon.ion" ];
+
+  meta = with lib; {
+    description = "A Python implementation of Amazon Ion";
+    homepage = "https://github.com/amzn/ion-python";
+    license = licenses.asl20;
+    maintainers = [ maintainers.terlar ];
+  };
+}
diff --git a/pkgs/development/python-modules/ansible-later/default.nix b/pkgs/development/python-modules/ansible-later/default.nix
index 9ed54dee25e88..43f24bfbf0a46 100644
--- a/pkgs/development/python-modules/ansible-later/default.nix
+++ b/pkgs/development/python-modules/ansible-later/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "ansible-later";
-  version = "2.0.8";
+  version = "2.0.9";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = "thegeeklab";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-oPlm9uxyN3hyf4gFv37YWEn/HOkg0QQ1Ya3tjLd53rQ=";
+    hash = "sha256-g7/RClQB+6HsDbe/VjjKka97LcwRTKO0OD0RlCG9lWY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/apycula/default.nix b/pkgs/development/python-modules/apycula/default.nix
index e84e3eb301b5d..d8bb92e0d3bcf 100644
--- a/pkgs/development/python-modules/apycula/default.nix
+++ b/pkgs/development/python-modules/apycula/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "apycula";
-  version = "0.2";
+  version = "0.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit version;
     pname = "Apycula";
-    hash = "sha256-xvr/NDAjCjhpImzNlCOcI4x5dIAefJ1TnUgoBhgdhPA=";
+    hash = "sha256-Ncecrn5fQW0iAgrE3P7GZTx8E1TiFqiDMhZQSPrDvdk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/azure-mgmt-media/default.nix b/pkgs/development/python-modules/azure-mgmt-media/default.nix
index e0dd1af1ad0fb..eb1bed0b547d0 100644
--- a/pkgs/development/python-modules/azure-mgmt-media/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-media/default.nix
@@ -5,18 +5,20 @@
 , msrestazure
 , azure-common
 , azure-mgmt-core
-, azure-mgmt-nspkg
-, isPy3k
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "azure-mgmt-media";
-  version = "8.0.0";
+  version = "9.0.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "c08e687c0afa061a3e05acaf29ce81e737480d592b07e0de5f77e9a7f9f00c00";
+    hash = "sha256-TI7l8sSQ2QUgPqiE3Cu/F67Wna+KHbQS3fuIjOb95ZM=";
   };
 
   propagatedBuildInputs = [
@@ -24,14 +26,14 @@ buildPythonPackage rec {
     msrestazure
     azure-common
     azure-mgmt-core
-  ] ++ lib.optionals (!isPy3k) [
-    azure-mgmt-nspkg
   ];
 
   # has no tests
   doCheck = false;
 
-  pythonImportsCheck = [ "azure.mgmt.media" ];
+  pythonImportsCheck = [
+    "azure.mgmt.media"
+  ];
 
   meta = with lib; {
     description = "This is the Microsoft Azure Media Services Client Library";
diff --git a/pkgs/development/python-modules/cdcs/default.nix b/pkgs/development/python-modules/cdcs/default.nix
index ec11019cc9a71..748d0ff623fde 100644
--- a/pkgs/development/python-modules/cdcs/default.nix
+++ b/pkgs/development/python-modules/cdcs/default.nix
@@ -9,7 +9,7 @@
 }:
 
 buildPythonPackage rec {
-  version = "0.1.6";
+  version = "0.1.8";
   pname = "cdcs";
   format = "setuptools";
 
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "usnistgov";
     repo = "pycdcs";
     rev = "v${version}";
-    sha256 = "sha256-w9CBNOK9oXTIUa+SsnepRN0wAz7WPZGfUNDSbtVn1L8=";
+    sha256 = "sha256-s+COE7hus1J5I8PTdagl7KEK5QFoidjQ3ee46kOWmkE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/dropbox/default.nix b/pkgs/development/python-modules/dropbox/default.nix
index 2e2490568e9df..f18f6203d1e09 100644
--- a/pkgs/development/python-modules/dropbox/default.nix
+++ b/pkgs/development/python-modules/dropbox/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dropbox";
-  version = "11.28.0";
+  version = "11.29.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "dropbox";
     repo = "dropbox-sdk-python";
     rev = "v${version}";
-    sha256 = "sha256-xNenBmeCRIYxQqAkV8IDpPpIHyVAYJs1jAFr8w1tz2Y=";
+    sha256 = "sha256-TKJb34hJYzZtQcqgopLpN8c1utWCNjmev9epY+hYU7M=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/fastcore/default.nix b/pkgs/development/python-modules/fastcore/default.nix
index 2e43ab9a15d20..b7fc364958dd2 100644
--- a/pkgs/development/python-modules/fastcore/default.nix
+++ b/pkgs/development/python-modules/fastcore/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "fastcore";
-  version = "1.4.0";
+  version = "1.4.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "fastai";
     repo = pname;
     rev = version;
-    sha256 = "sha256-U7tZkqfBbl5IVZlC2/JBIx7Bm5iIiXTMSm0QHmzNiys=";
+    sha256 = "sha256-qZsCsMwZxJsnznQ/C1SUPexkquv0tIyCkNYL5f2k0FU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/glean-parser/default.nix b/pkgs/development/python-modules/glean-parser/default.nix
index 953e3faa67bb5..afcdd3d66b976 100644
--- a/pkgs/development/python-modules/glean-parser/default.nix
+++ b/pkgs/development/python-modules/glean-parser/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "glean-parser";
-  version = "5.1.0";
+  version = "5.1.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "glean_parser";
     inherit version;
-    hash = "sha256-8oMbaGsW5Lkw9OluNsXXe2IBNbjeoIb9vDjVOt+uHR0=";
+    hash = "sha256-zUiF0buHBe0BaaeIRJcRoT/g+NhWv6XTuhCZ6WPrris=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/hahomematic/default.nix b/pkgs/development/python-modules/hahomematic/default.nix
index 7d1a3d8425fee..b70c808197544 100644
--- a/pkgs/development/python-modules/hahomematic/default.nix
+++ b/pkgs/development/python-modules/hahomematic/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "hahomematic";
-  version = "1.0.3";
+  version = "1.0.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "danielperna84";
     repo = pname;
     rev = version;
-    sha256 = "sha256-WteSLhO/Ei+467tXT7Y1S6bYNNFUILbP5Pm4ZhBYaeg=";
+    sha256 = "sha256-YpsZKhuK3IzUZFNmBToBOuUacaDgbMC/N7pZDjuSzbE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/hepunits/default.nix b/pkgs/development/python-modules/hepunits/default.nix
new file mode 100644
index 0000000000000..9bfd4de36f789
--- /dev/null
+++ b/pkgs/development/python-modules/hepunits/default.nix
@@ -0,0 +1,31 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, setuptools-scm
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "hepunits";
+  version = "2.2.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-6A5hb+8oF/PGbHXcDkHtJjYkiMzgX5Stz977jgXry1g=";
+  };
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  meta = {
+    description = "Units and constants in the HEP system of units";
+    homepage = "https://github.com/scikit-hep/hepunits";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ doronbehar ];
+  };
+}
+
diff --git a/pkgs/development/python-modules/idasen/default.nix b/pkgs/development/python-modules/idasen/default.nix
index b0e9b7d57065a..231f9e367698a 100644
--- a/pkgs/development/python-modules/idasen/default.nix
+++ b/pkgs/development/python-modules/idasen/default.nix
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "newAM";
     repo = "idasen";
     rev = "v${version}";
-    sha256 = "sha256-s8CnYMUVl2VbGbVxICSaKH5DxTA+NP/zPX1z7vfMqi4=";
+    hash = "sha256-s8CnYMUVl2VbGbVxICSaKH5DxTA+NP/zPX1z7vfMqi4=";
   };
 
   nativeBuildInputs = [
@@ -39,7 +39,14 @@ buildPythonPackage rec {
     pytest-asyncio
   ];
 
-  pythonImportsCheck = [ "idasen" ];
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace 'voluptuous = "^0.12"' 'voluptuous = "*"'
+  '';
+
+  pythonImportsCheck = [
+    "idasen"
+  ];
 
   meta = with lib; {
     description = "Python API and CLI for the ikea IDÅSEN desk";
diff --git a/pkgs/development/python-modules/ionhash/default.nix b/pkgs/development/python-modules/ionhash/default.nix
new file mode 100644
index 0000000000000..4d90d572876ce
--- /dev/null
+++ b/pkgs/development/python-modules/ionhash/default.nix
@@ -0,0 +1,38 @@
+{ lib, buildPythonPackage, fetchFromGitHub, fetchpatch, amazon-ion, six, pytestCheckHook }:
+
+buildPythonPackage rec {
+  pname = "ionhash";
+  version = "1.2.1";
+
+  src = fetchFromGitHub {
+    owner = "amzn";
+    repo = "ion-hash-python";
+    rev = "v${version}";
+    sha256 = "sha256-mXOLKXauWwwIA/LnF4qyZsBiF/QM+rF9MmE2ewmozYo=";
+    fetchSubmodules = true;
+  };
+
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/amzn/ion-hash-python/commit/5cab56d694ecc176e394bb455c2d726ba1514ce0.patch";
+      sha256 = "sha256-P5QByNafgxI//e3m+b0oG00+rVymCsT/J4dOZSk3354=";
+    })
+  ];
+
+  postPatch = ''
+    substituteInPlace setup.py --replace "'pytest-runner'," ""
+  '';
+
+  propagatedBuildInputs = [ amazon-ion six ];
+
+  checkInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "ionhash" ];
+
+  meta = with lib; {
+    description = "Python implementation of Amazon Ion Hash";
+    homepage = "https://github.com/amzn/ion-hash-python";
+    license = licenses.asl20;
+    maintainers = [ maintainers.terlar ];
+  };
+}
diff --git a/pkgs/development/python-modules/jsbeautifier/default.nix b/pkgs/development/python-modules/jsbeautifier/default.nix
index 746619a614458..bdd0897acbe68 100644
--- a/pkgs/development/python-modules/jsbeautifier/default.nix
+++ b/pkgs/development/python-modules/jsbeautifier/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonApplication rec {
   pname = "jsbeautifier";
-  version = "1.14.1";
+  version = "1.14.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ZfT3dLDkywIutJmbRc1ndi92Qnxe80CCq6VLwdjvI+s=";
+    hash = "sha256-PskybkfTilQ5W97/h2lWakcnWOcLnhG6fMVs/spqm/Y=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/jsonconversion/default.nix b/pkgs/development/python-modules/jsonconversion/default.nix
new file mode 100644
index 0000000000000..22f7fe4625d18
--- /dev/null
+++ b/pkgs/development/python-modules/jsonconversion/default.nix
@@ -0,0 +1,26 @@
+{ lib, buildPythonPackage, fetchPypi, pytestCheckHook, numpy }:
+
+buildPythonPackage rec {
+  pname = "jsonconversion";
+  version = "0.2.13";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-4hMY0N/Px+g5zn3YzNfDWPyi8Pglvd/c2N9SeC4JoZ0=";
+  };
+
+  postPatch = ''
+    substituteInPlace setup.py --replace "'pytest-runner'" ""
+  '';
+
+  checkInputs = [ pytestCheckHook numpy ];
+
+  pythonImportsCheck = [ "jsonconversion" ];
+
+  meta = with lib; {
+    description = "This python module helps converting arbitrary Python objects into JSON strings and back";
+    homepage = "https://pypi.org/project/jsonconversion/";
+    license = licenses.bsd2;
+    maintainers = [ maintainers.terlar ];
+  };
+}
diff --git a/pkgs/development/python-modules/meilisearch/default.nix b/pkgs/development/python-modules/meilisearch/default.nix
index 9671c43df081f..73f1c75a5192b 100644
--- a/pkgs/development/python-modules/meilisearch/default.nix
+++ b/pkgs/development/python-modules/meilisearch/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "meilisearch";
-  version = "0.18.1";
+  version = "0.18.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "meilisearch";
     repo = "meilisearch-python";
     rev = "v${version}";
-    hash = "sha256-Rd2GmomNzW0+oI2QEGcPY4g8H+4FN7eLKY1ljcibsLw=";
+    hash = "sha256-U9fdMcxPdtLiUStgTez99SPRh93WLZNVn8uIj4lNWh4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/mypy-boto3-builder/default.nix b/pkgs/development/python-modules/mypy-boto3-builder/default.nix
index a9e4a3eed5cdd..e46d8eab2bceb 100644
--- a/pkgs/development/python-modules/mypy-boto3-builder/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3-builder/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "mypy-boto3-builder";
-  version = "7.5.4";
+  version = "7.5.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.10";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "vemel";
     repo = "mypy_boto3_builder";
     rev = version;
-    hash = "sha256-NS8lFetL/8hcvCnIHw+GDtdEKFsN81MPybEA4PGaP/Q=";
+    hash = "sha256-rv0c0QoXOd7aSOLhGDGfq4v0bnGBOJhGhZVNhS5hgOs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/param/default.nix b/pkgs/development/python-modules/param/default.nix
index 23c9bc9c3933d..701c9db7962a2 100644
--- a/pkgs/development/python-modules/param/default.nix
+++ b/pkgs/development/python-modules/param/default.nix
@@ -6,13 +6,13 @@
 
 buildPythonPackage rec {
   pname = "param";
-  version = "1.12.0";
+  version = "1.12.1";
 
   src = fetchFromGitHub {
     owner = "holoviz";
     repo = pname;
     rev = "v${version}";
-    sha256 = "02zmd4bwyn8b4q1l9jgddc70ii1i7bmynacanl1cvbr6la4v9b2c";
+    sha256 = "sha256-MehTz0qCpWe/11PZ5jmFxHE54TA+QX2KfqvKB8L79V4=";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/particle/default.nix b/pkgs/development/python-modules/particle/default.nix
new file mode 100644
index 0000000000000..d1207fe849833
--- /dev/null
+++ b/pkgs/development/python-modules/particle/default.nix
@@ -0,0 +1,56 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, fetchPypi
+, setuptools-scm
+, attrs
+, deprecated
+, hepunits
+, pytestCheckHook
+, tabulate
+, pandas
+}:
+
+buildPythonPackage rec {
+  pname = "particle";
+  version = "0.20.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-HoWWwoGMrkRqlYzrF2apGsxsZAHwHbHSO5TCSCelxUc=";
+  };
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    attrs
+    deprecated
+    hepunits
+  ];
+
+  pythonImportsCheck = [
+    "particle"
+  ];
+
+  preCheck = ''
+    # Disable benchmark tests, so we won't need pytest-benchmark and pytest-cov
+    # as dependencies
+    substituteInPlace pyproject.toml \
+      --replace '"--benchmark-disable", ' ""
+    rm tests/particle/test_performance.py
+  '';
+
+  checkInputs = [
+    pytestCheckHook
+    tabulate
+    pandas
+  ];
+
+  meta = {
+    description = "Package to deal with particles, the PDG particle data table, PDGIDs, etc.";
+    homepage = "https://github.com/scikit-hep/particle";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ doronbehar ];
+  };
+}
diff --git a/pkgs/development/python-modules/pontos/default.nix b/pkgs/development/python-modules/pontos/default.nix
index d36c5d7e7ae37..0ea1be9c21f0f 100644
--- a/pkgs/development/python-modules/pontos/default.nix
+++ b/pkgs/development/python-modules/pontos/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "pontos";
-  version = "22.2.4";
+  version = "22.4.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "greenbone";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-RmMlwnAJlCTDnTyim0MdAeW3NA8r2IiqrE0YeWgxUk4=";
+    hash = "sha256-W+l5QIpum1uTsx/mxZGkRoJAZaC1viURVYg4Kvjv32Y=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pycfmodel/default.nix b/pkgs/development/python-modules/pycfmodel/default.nix
index a6a2446da07b6..c47362e339e50 100644
--- a/pkgs/development/python-modules/pycfmodel/default.nix
+++ b/pkgs/development/python-modules/pycfmodel/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "pycfmodel";
-  version = "0.17.1";
+  version = "0.18.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "Skyscanner";
     repo = pname;
     rev = version;
-    hash = "sha256-Rw0sZ2k+tXo04mvlL83hUgdHIND5NIsVH/CzrfmbKlE=";
+    hash = "sha256-g249Nq4u4pPQLbW9Kw5vLwVKCaZoots5LD6yk1NPv6s=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pynetgear/default.nix b/pkgs/development/python-modules/pynetgear/default.nix
index e1d87cdcae330..2030507e07f3a 100644
--- a/pkgs/development/python-modules/pynetgear/default.nix
+++ b/pkgs/development/python-modules/pynetgear/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "pynetgear";
-  version = "0.9.1";
+  version = "0.9.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "MatMaul";
     repo = pname;
     rev = version;
-    sha256 = "sha256-sLGr8I0LcLPrmQZ6dI+hwRAiNCrnLtr2WU04rPoG4x4=";
+    sha256 = "sha256-/aPyx+jNOCW6bzeYAEBP1yfIJfQwJjo1i6WaRvAz0oU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyoverkiz/default.nix b/pkgs/development/python-modules/pyoverkiz/default.nix
index c60b69836c8c4..f39b17a67541b 100644
--- a/pkgs/development/python-modules/pyoverkiz/default.nix
+++ b/pkgs/development/python-modules/pyoverkiz/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "pyoverkiz";
-  version = "1.3.13";
+  version = "1.3.14";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "iMicknl";
     repo = "python-overkiz-api";
     rev = "v${version}";
-    hash = "sha256-CkEo8H5S2/nf7jWU51sVN+GCqaL5Kgx77m6669Pr4dU=";
+    hash = "sha256-dyT2hrTQwYoKEZAVIed2N4259YlR2JmvOEpAuPLCur4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pypugjs/default.nix b/pkgs/development/python-modules/pypugjs/default.nix
index 9b19c4c8a2614..cfc7fbf2ded34 100644
--- a/pkgs/development/python-modules/pypugjs/default.nix
+++ b/pkgs/development/python-modules/pypugjs/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "pypugjs";
-  version = "5.9.10";
+  version = "5.9.11";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "082dae87d44e184030b66da9ea9bd1a0209f86c089d8f2bd61064b97a7511a28";
+    sha256 = "sha256-kStaT1S8cPJF+iDFk/jLGKi3JVOMmtf7PzeYDKCdD0E=";
   };
 
   propagatedBuildInputs = [ six chardet ];
diff --git a/pkgs/development/python-modules/pyqldb/default.nix b/pkgs/development/python-modules/pyqldb/default.nix
new file mode 100644
index 0000000000000..a6fd8665fd149
--- /dev/null
+++ b/pkgs/development/python-modules/pyqldb/default.nix
@@ -0,0 +1,32 @@
+{ lib, buildPythonPackage, fetchFromGitHub, boto3, amazon-ion, ionhash, pytestCheckHook }:
+
+buildPythonPackage rec {
+  pname = "pyqldb";
+  version = "3.2.2";
+
+  src = fetchFromGitHub {
+    owner = "awslabs";
+    repo = "amazon-qldb-driver-python";
+    rev = "v${version}";
+    sha256 = "sha256-TKf43+k428h8T6ye6mJrnK9D4J1xpIu0QacM7lWJF7w=";
+  };
+
+  propagatedBuildInputs = [ boto3 amazon-ion ionhash ];
+
+  checkInputs = [ pytestCheckHook ];
+
+  preCheck = ''
+    export AWS_DEFAULT_REGION=us-east-1
+  '';
+
+  pytestFlagsArray = [ "tests/unit" ];
+
+  pythonImportsCheck = [ "pyqldb" ];
+
+  meta = with lib; {
+    description = "Python driver for Amazon QLDB";
+    homepage = "https://github.com/awslabs/amazon-qldb-driver-python";
+    license = licenses.asl20;
+    maintainers = [ maintainers.terlar ];
+  };
+}
diff --git a/pkgs/development/python-modules/python-awair/default.nix b/pkgs/development/python-modules/python-awair/default.nix
index b676a7a3de986..913d91c0901c2 100644
--- a/pkgs/development/python-modules/python-awair/default.nix
+++ b/pkgs/development/python-modules/python-awair/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "python-awair";
-  version = "0.2.2";
+  version = "0.2.3";
   format = "pyproject";
   disabled = pythonOlder "3.6";
 
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "ahayworth";
     repo = "python_awair";
     rev = version;
-    sha256 = "sha256-5+s1aSvt+rXyumvf/qZ58Uvmq0p45mu23Djbwgih3qI=";
+    sha256 = "sha256-Roqmwamv/2/O87jfyymCGgRlw/woUhCNIuM9MLT3+Cw=";
   };
 
   nativeBuildInputs = [ poetry-core ];
diff --git a/pkgs/development/python-modules/qiskit-optimization/default.nix b/pkgs/development/python-modules/qiskit-optimization/default.nix
index d2b87d9cfeafc..edebad4db6f4b 100644
--- a/pkgs/development/python-modules/qiskit-optimization/default.nix
+++ b/pkgs/development/python-modules/qiskit-optimization/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "qiskit-optimization";
-  version = "0.3.1";
+  version = "0.3.2";
 
   disabled = pythonOlder "3.6";
 
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "qiskit";
     repo = pname;
     rev = version;
-    sha256 = "sha256-6oqhM5sEu0id0qYrhdVyx0xXUvwxBgZSPvrlAnmtY5A=";
+    sha256 = "sha256-SWrHNHZjynpWcwwrWzRPpbNWz8EhVujMoY8uIJQeT6U=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/sabyenc3/default.nix b/pkgs/development/python-modules/sabyenc3/default.nix
index 2dec98d5ca1ad..831680670d1fe 100644
--- a/pkgs/development/python-modules/sabyenc3/default.nix
+++ b/pkgs/development/python-modules/sabyenc3/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "sabyenc3";
-  version = "5.1.5";
+  version = "5.1.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-JwCzy3QRCzxT8B0VM5SXIIWlYi08tT8eLj/QKtMYLRE=";
+    hash = "sha256-DHHil9ZQsrKLgw5dje0Yo1J5FZAFrY1tn5y3mdBJHWg=";
   };
 
   # Tests are not included in pypi distribution
diff --git a/pkgs/development/python-modules/simplisafe-python/default.nix b/pkgs/development/python-modules/simplisafe-python/default.nix
index 1c2c206f87f0b..710a24f0ac040 100644
--- a/pkgs/development/python-modules/simplisafe-python/default.nix
+++ b/pkgs/development/python-modules/simplisafe-python/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "simplisafe-python";
-  version = "2022.03.0";
+  version = "2022.03.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "bachya";
     repo = pname;
     rev = version;
-    sha256 = "sha256-B4Tg122S2lJaBXBKUSN2ndt5EOiC5HyORTQXofZKUpw=";
+    sha256 = "sha256-WWpGRgmjOBCdsxESEpfZEigK7mfutromx6EEr/C/cO0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/voluptuous/default.nix b/pkgs/development/python-modules/voluptuous/default.nix
index cc9d772eda171..d2e221d6e3903 100644
--- a/pkgs/development/python-modules/voluptuous/default.nix
+++ b/pkgs/development/python-modules/voluptuous/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "voluptuous";
-  version = "0.12.2";
+  version = "0.13.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-TbGsUHnbkkmCDUnIkctGYKb4yuNQSRIQq850H6v1ZRM=";
+    sha256 = "sha256-yuakUmtDS2QoFrNKAOEYbVpfXgyUirlNKpGOAeWHQGY=";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/wled/default.nix b/pkgs/development/python-modules/wled/default.nix
index 3bd0d5b55b90e..362d4e4d2b29a 100644
--- a/pkgs/development/python-modules/wled/default.nix
+++ b/pkgs/development/python-modules/wled/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "wled";
-  version = "0.13.1";
+  version = "0.13.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "frenck";
     repo = "python-wled";
     rev = "v${version}";
-    sha256 = "sha256-QQPrAfk+BX8mjqn9ISim9hLEZR2nbgxbkwCv+91yeRY=";
+    sha256 = "sha256-Rv0jaKkN6jQ7oiv1cBYx4HAr7IqPm57jZFykXayp0T0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/youtube-transcript-api/default.nix b/pkgs/development/python-modules/youtube-transcript-api/default.nix
index 088ee476e3f0e..a3c7e93031c70 100644
--- a/pkgs/development/python-modules/youtube-transcript-api/default.nix
+++ b/pkgs/development/python-modules/youtube-transcript-api/default.nix
@@ -1,22 +1,40 @@
-{ lib, buildPythonPackage, fetchFromGitHub, requests, mock, httpretty, pytestCheckHook }:
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, requests
+, mock
+, httpretty
+, pytestCheckHook
+, pythonOlder
+}:
 
 buildPythonPackage rec {
   pname = "youtube-transcript-api";
-  version = "0.4.3";
+  version = "0.4.4";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
-  # PyPI tarball is missing some test files
   src = fetchFromGitHub {
     owner = "jdepoix";
-    repo = "youtube-transcript-api";
+    repo = pname;
     rev = "v${version}";
-    sha256 = "1krak5j2faj6951cl13h7hg9i3kyp6nslcbi608k8hxlbd80hc5h";
+    hash = "sha256-RNPWTgAOwS+tXGLQYyIyka36xS1E1499OAP84aT6m3A=";
   };
 
-  propagatedBuildInputs = [ requests ];
+  propagatedBuildInputs = [
+    requests
+  ];
 
-  checkInputs = [ mock httpretty pytestCheckHook ];
+  checkInputs = [
+    mock
+    httpretty
+    pytestCheckHook
+  ];
 
-  pythonImportsCheck = [ "youtube_transcript_api" ];
+  pythonImportsCheck = [
+    "youtube_transcript_api"
+  ];
 
   meta = with lib; {
     description = "Python API which allows you to get the transcripts/subtitles for a given YouTube video";
diff --git a/pkgs/development/tools/analysis/include-what-you-use/default.nix b/pkgs/development/tools/analysis/include-what-you-use/default.nix
index bc1be4e5ba5e8..ccda1b7baba59 100644
--- a/pkgs/development/tools/analysis/include-what-you-use/default.nix
+++ b/pkgs/development/tools/analysis/include-what-you-use/default.nix
@@ -3,10 +3,10 @@
 stdenv.mkDerivation rec {
   pname = "include-what-you-use";
   # Also bump llvmPackages in all-packages.nix to the supported version!
-  version = "0.17";
+  version = "0.18";
 
   src = fetchurl {
-    sha256 = "sha256-7KfAT4tBa2OF7QDjNmmn+kaTzSbLcrUizeVYgo6wxmU=";
+    sha256 = "sha256-kQL8hBkpR1ffhqic5uwwX42QqBjR8lmKE50V6xiUuPM=";
     url = "${meta.homepage}/downloads/${pname}-${version}.src.tar.gz";
   };
 
diff --git a/pkgs/development/tools/analysis/tfsec/default.nix b/pkgs/development/tools/analysis/tfsec/default.nix
index bd04f4a2060ed..bea9e09855255 100644
--- a/pkgs/development/tools/analysis/tfsec/default.nix
+++ b/pkgs/development/tools/analysis/tfsec/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "tfsec";
-  version = "1.15.2";
+  version = "1.15.4";
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-nXrWKKHb64HGHttppBveLp45qKLnGvkElqxn8f/cWok=";
+    sha256 = "sha256-IYmS3Q2WWkOYISx0jI8yggArk0fhl3WQWrsc+Zfg8gU=";
   };
 
   ldflags = [
diff --git a/pkgs/development/tools/buildah/default.nix b/pkgs/development/tools/buildah/default.nix
index ea6f866a48b12..1855ed966d514 100644
--- a/pkgs/development/tools/buildah/default.nix
+++ b/pkgs/development/tools/buildah/default.nix
@@ -14,13 +14,13 @@
 
 buildGoModule rec {
   pname = "buildah";
-  version = "1.24.2";
+  version = "1.25.1";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "buildah";
     rev = "v${version}";
-    sha256 = "sha256-gBO+H26YGmOtP3CUHZjynAaOb0h+MJbJnWqxOZdif6w=";
+    sha256 = "sha256-NQ+Tv3KUrvX+MWM1ZFmsJ4JKoSIpSBjGNiruJkRd6rE=";
   };
 
   outputs = [ "out" "man" ];
diff --git a/pkgs/development/tools/continuous-integration/github-runner/default.nix b/pkgs/development/tools/continuous-integration/github-runner/default.nix
index c8513d004af5b..f53ebd645d05d 100644
--- a/pkgs/development/tools/continuous-integration/github-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/github-runner/default.nix
@@ -43,13 +43,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "github-runner";
-  version = "2.289.1";
+  version = "2.289.2";
 
   src = fetchFromGitHub {
     owner = "actions";
     repo = "runner";
     rev = "v${version}";
-    hash = "sha256-5TS/tW1hnDvPZQdR659rw+spLq98niyUms3BrixaKRE=";
+    hash = "sha256-yISJ/qGJ+tGnJOqpTUe+rkG4UGzTZ5tIXix6wuDKXO0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/earthly/default.nix b/pkgs/development/tools/earthly/default.nix
index 377d287e531e2..86805daf1c739 100644
--- a/pkgs/development/tools/earthly/default.nix
+++ b/pkgs/development/tools/earthly/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "earthly";
-  version = "0.6.12";
+  version = "0.6.13";
 
   src = fetchFromGitHub {
     owner = "earthly";
     repo = "earthly";
     rev = "v${version}";
-    sha256 = "sha256-M8DnSpQhW4i83cu9wp0ZKyP7137IQVjyBl0cgVvQmPI=";
+    sha256 = "sha256-xOsLFFa6OsfdXOjYZBV71gafaAAX9PfMokppMKJzlZg=";
   };
 
-  vendorSha256 = "sha256-GvTWj0uEsCyC4/RL6woym8UwA3OCFx8NWkNQApnVMM8=";
+  vendorSha256 = "sha256-2bOaJdK12qGjjVtoBp3LeSyIiFwm4ZvxNI5yR0HriXI=";
 
   ldflags = [
     "-s" "-w"
diff --git a/pkgs/development/tools/electron/default.nix b/pkgs/development/tools/electron/default.nix
index 24dc8614b29a8..0ed800eb7c631 100644
--- a/pkgs/development/tools/electron/default.nix
+++ b/pkgs/development/tools/electron/default.nix
@@ -73,43 +73,43 @@ rec {
     headers = "0vvizddmhprprbdf6bklasz6amwc254bpc9j0zlx23d1pgyxpnhc";
   };
 
-  electron_14 = mkElectron "14.2.7" {
-    armv7l-linux = "bb0c25671daa0dc235e212831d62f18b9a7f2692279bcd8e4a15f2d84ee7124d";
-    aarch64-linux = "149c5df2cf98ee0a2ce5445b3fb00752f42c3f7ab9677b7a54ba01fba2e2f4ec";
-    x86_64-linux = "ad80f424e8d8d79f0be078d8a1ddef8fd659fa3dd8aaf6704ab97f2a13489558";
-    i686-linux = "82b29272cb52dbe969c0bd6cf9b69896c86abe1d9ef473a3844c0ab3dc92b353";
-    x86_64-darwin = "2a5d8336dcd140158964801d482344756377d924a06e6605959034a41f7e026b";
-    aarch64-darwin = "b45869ff61bdf392bca498529b6445d47a784079f6a33af6b19d517953f03fd8";
-    headers = "0339fs3iyp869xi1xmn9z2b1n32wf408cc0z9bz6shns44ymkyhd";
+  electron_14 = mkElectron "14.2.9" {
+    armv7l-linux = "02ae6cd9ec9c2dcb2f550923576a0c851fff3e796a5048dd3806947c541fd564";
+    aarch64-linux = "631ba0f716d0272931418de42468114360bd21ec72875605fc32d67620743d2c";
+    x86_64-linux = "0a62a41e8ac4592aba347c82f9c40f3fb4c84c7d00b6bb9501d02375cd49cb7d";
+    i686-linux = "55e395a209d4a90e2dcd20a78af4724355feaba86411a39e66b977ed39de4d05";
+    x86_64-darwin = "1df5b4c4414ade75c6cbfe13d3024702b8ae7c77f3f07b8955b2459fde6a5842";
+    aarch64-darwin = "17089e54830976c4216d26e7e2e15ad2224e3b288d94973fed7e67e9b1c213b3";
+    headers = "181b2agnf4b5s81p2rdnd6wkw9c2ri4cv1x0wwf7rj60axvzvydm";
   };
 
-  electron_15 = mkElectron "15.4.1" {
-    armv7l-linux = "e0fe5daed46a5d718b3209fa301aea743df694daf6605f9313f4ca6c70fe5167";
-    aarch64-linux = "fa108edd4c146811bdee842fcd278b046ae0ff157de5e072c3ff3ac0bcb310c2";
-    x86_64-linux = "867095924d434b3918df8576e7af94fecea4d29461fcfb69c40161f02158ff15";
-    i686-linux = "8e79fa9f4125f254abb437445fed8f3f8ec10dd2462e1ced3e7df49c622e087d";
-    x86_64-darwin = "899d16a0e0157809c297ceb3710c53441ec4396333d9ad5b65297446874e14dc";
-    aarch64-darwin = "8295bf45dab1131dfdfd15654a0b1d85bfae221052ba64353368a2c0faaaa3ff";
-    headers = "073697wjq60cnz42xmnjsr0xqcmcsl4m48mmzrz1rxrc8mvi86gr";
+  electron_15 = mkElectron "15.5.1" {
+    armv7l-linux = "222e9ad3210cf538c45f938b5b1a5d901b36fb6ec09461446e4ab4ea6ee9bc1b";
+    aarch64-linux = "16a0053036a9f6ba947445c85bacda720975a23a910e78cab8dce1bf8ad2acf7";
+    x86_64-linux = "99867ef0eef53f214ef4c8a4ec0223890d9c38b73fd6bf4fb49a9e400dff5726";
+    i686-linux = "6d65c900c77b9e259932b20978d78a56bb04fad590f29a5935d8a31f5e0891db";
+    x86_64-darwin = "54e6312d5e06e16eab78d86ddb01553864b66f608d017c7a1c4a0a318be32081";
+    aarch64-darwin = "6472bea7f38f38c20a8c87e6daf70ca0d00b7c29b1641eeda6c8d45f9e60784b";
+    headers = "0dgxyndsyhk5m9m8iiy2h3vg1gz1xg5nj75537apsh9mdiizsfhk";
   };
 
-  electron_16 = mkElectron "16.1.0" {
-    armv7l-linux = "f3ab34c73b4100ffc5041ed9aa0608d1dc6b98fe3c2caa14be3d5c3ffbebda76";
-    aarch64-linux = "e80a7e4a59b94c7cd02b16ca37a2b0f26ddb58ddac23135c6180b238589f1c62";
-    x86_64-linux = "36c79af4d05e89ef9c9616a156f63adc5b453ee6bee5d8f4331e75ee77198e85";
-    i686-linux = "7129a96fc33de70cfe5d6d0e17ecff1b4dcf52d825a6ad05b10ca67da7b43665";
-    x86_64-darwin = "723859249e959948cdd339acf708022fb0195b433809af25b4a9f4d69b9da52f";
-    aarch64-darwin = "e76558028979f70107e5b1897275a9789be20b13991bfbcebeab7fc220f15764";
-    headers = "0yv9rssrfi0hdzrjf1n735dsz9sgy78jzxdcf9is2387yrr1qiyz";
+  electron_16 = mkElectron "16.2.1" {
+    armv7l-linux = "d55daeffed60cfd0c2de4ea8cab102ec5957dbd0cd863add881080e891b02334";
+    aarch64-linux = "6446c665a1c6d7648dbeae94a669423b4c6768bafa96f0d3f8072b8c5d5a949e";
+    x86_64-linux = "7b27a8531a8ef60fa27dd119422a81a710e09f7d8cb01777f1fe7b7ab67e3ac4";
+    i686-linux = "eb7e0c8113af80f0e4edbae35d2cca718c1e98966da87041304fa6afb2d3e4c0";
+    x86_64-darwin = "0386e3318d4b5cfabccc226ca88bd9946669901f381e3817d1d414b1356e472c";
+    aarch64-darwin = "280660c0333702de9d95bcf9a21d3db8d148bef2a5946bb57d20b9e5f2aadb96";
+    headers = "121wrzy81h9m12y83mb0xs9jbm5l4w31f831lmb4wmkkg54bvcwj";
   };
 
-  electron_17 = mkElectron "17.1.2" {
-    armv7l-linux = "b561c04c9fa8c512f418ea5c32f5526732e1ccd150ee4830a0091d0fa1b7e31c";
-    aarch64-linux = "cda7e66c6672def9edd881107c28e2eec09b7802a38227ac89bb233191ce4840";
-    x86_64-linux = "7e7c35e8c1a0fc451e7af19fa73264881ae2c4672c52a2ae1cdd61604650ca94";
-    i686-linux = "de87a7952c93c1d8e8c533a700bbfc76d3893e9ad438413507d11450b80a9c97";
-    x86_64-darwin = "d4382d3f01b750676a1f3c9e2273ad69cac16dc64a4145469c663bcda8d2471b";
-    aarch64-darwin = "135dec87211fcefdb53ab1fef13344c7b71a321f7c4f6846f260c1e0848e73bf";
-    headers = "15k234d044lgmc3psyxz9syy9wvzgn54znklak9sv6gcajjzll10";
+  electron_17 = mkElectron "17.3.1" {
+    armv7l-linux = "ad7864f9a580b3fd8865480caa6cccbaefa5d7e5fdbe455700ab711b0adf2228";
+    aarch64-linux = "e0f03aff5339e4dab85cbc970568ca31599ee0f032d1e766c23deea7d96654b0";
+    x86_64-linux = "59d13b1d060523d1098e6e1e5bf7c6f2494b713321541f863dc459a42d2c40a8";
+    i686-linux = "6d31d5117f4508bc7e0f9ecb6423d266b47fb5f074b0dfa8ddcfc2298c764151";
+    x86_64-darwin = "c70a6e906ae7ce02552f1722022147f2416f27de0f98b88a0b7b1a09e341426f";
+    aarch64-darwin = "76a9c8cbfa578c7e6678e6ccab2417374d1b3d3d81c6cac5ceea0aa058c12a8f";
+    headers = "11k5sw7wk0fjjdlhcvbkwpffslngm9ns8l4c7rxa4qx8n1six9sf";
   };
 }
diff --git a/pkgs/development/tools/electron/generic.nix b/pkgs/development/tools/electron/generic.nix
index 08edf8a309277..7fefe186c1089 100644
--- a/pkgs/development/tools/electron/generic.nix
+++ b/pkgs/development/tools/electron/generic.nix
@@ -29,7 +29,7 @@ let
     maintainers = with maintainers; [ travisbhartwell manveru prusnak ];
     platforms = [ "x86_64-darwin" "x86_64-linux" "i686-linux" "armv7l-linux" "aarch64-linux" ]
       ++ optionals (versionAtLeast version "11.0.0") [ "aarch64-darwin" ];
-    knownVulnerabilities = optional (versionOlder version "14.0.0") "Electron version ${version} is EOL";
+    knownVulnerabilities = optional (versionOlder version "15.0.0") "Electron version ${version} is EOL";
   };
 
   fetcher = vers: tag: hash: fetchurl {
diff --git a/pkgs/development/tools/esbuild/default.nix b/pkgs/development/tools/esbuild/default.nix
index 33f3bfc19c125..8844af40f4d11 100644
--- a/pkgs/development/tools/esbuild/default.nix
+++ b/pkgs/development/tools/esbuild/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "esbuild";
-  version = "0.14.28";
+  version = "0.14.29";
 
   src = fetchFromGitHub {
     owner = "evanw";
     repo = "esbuild";
     rev = "v${version}";
-    sha256 = "sha256-Z4Na4Tp5zNbzrOH14t+3rUTL8Q9OfyE6mUAdnETzFrs=";
+    sha256 = "sha256-v16wKi+CphROS9s3PdzzuRoh3gLfSUgincyTp38WKxQ=";
   };
 
   vendorSha256 = "sha256-QPkBR+FscUc3jOvH7olcGUhM6OW4vxawmNJuRQxPuGs=";
diff --git a/pkgs/development/tools/jql/default.nix b/pkgs/development/tools/jql/default.nix
index d7f557edfb019..0154df2c7fc0b 100644
--- a/pkgs/development/tools/jql/default.nix
+++ b/pkgs/development/tools/jql/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "jql";
-  version = "3.1.3";
+  version = "3.2.0";
 
   src = fetchFromGitHub {
     owner = "yamafaktory";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-kYAVgQa5NAfZ7EVzO/3fW3A5Zl8uaFXguvxBco8DfRY=";
+    sha256 = "sha256-U++yypq9M1C6Sh9rv3rmn/qwTXWdPFDBpjFS6eoS2L4=";
   };
 
-  cargoSha256 = "sha256-Mz+1A7Wg7sh0pxg7umRym3UkXsMkRE0AQDTkt+e7l+s=";
+  cargoSha256 = "sha256-uyD+QBDfnZa3nfZcUAqruYqJ9nVAa5+XOPONds0ysXU=";
 
   meta = with lib; {
     description = "A JSON Query Language CLI tool built with Rust";
diff --git a/pkgs/development/tools/just/default.nix b/pkgs/development/tools/just/default.nix
index c11d386d74641..e5ad74d64c735 100644
--- a/pkgs/development/tools/just/default.nix
+++ b/pkgs/development/tools/just/default.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "just";
-  version = "1.1.1";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
     owner = "casey";
     repo = pname;
     rev = version;
-    sha256 = "sha256-hgXMWQ7UlGyeb/j7V/Uw4gZjk/r1hA7lMjVL8i8st7o=";
+    sha256 = "sha256-vUtJ9QVMmDGfkYTBoK8mVaJTEfNBQD5sTEp7kC0LNZw=";
   };
 
-  cargoSha256 = "sha256-QJruh4voCB/q7xh5I6XnVtKA4Jbn9U84Mt2pHte7Kog=";
+  cargoSha256 = "sha256-rJjLXktWnT6kRx1/18AFr6KciaFF8PaTpz27wz+vGug=";
 
   nativeBuildInputs = [ installShellFiles ];
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv ];
diff --git a/pkgs/development/tools/misc/arcanist/default.nix b/pkgs/development/tools/misc/arcanist/default.nix
index a2af61fb6a164..0fa34c7eefe81 100644
--- a/pkgs/development/tools/misc/arcanist/default.nix
+++ b/pkgs/development/tools/misc/arcanist/default.nix
@@ -5,6 +5,8 @@
 , php
 , lib, stdenv
 , installShellFiles
+, which
+, python3
 }:
 
 # Make a custom wrapper. If `wrapProgram` is used, arcanist thinks .arc-wrapped is being
@@ -14,7 +16,7 @@
 let makeArcWrapper = toolset: ''
   cat << WRAPPER > $out/bin/${toolset}
   #!$shell -e
-  export PATH='${php}/bin/'\''${PATH:+':'}\$PATH
+  export PATH='${php}/bin:${which}/bin'\''${PATH:+':'}\$PATH
   exec ${php}/bin/php $out/libexec/arcanist/bin/${toolset} "\$@"
   WRAPPER
   chmod +x $out/bin/${toolset}
@@ -32,7 +34,9 @@ stdenv.mkDerivation {
     sha256 = "0jiv4aj4m5750dqw9r8hizjkwiyxk4cg4grkr63sllsa2dpiibxw";
   };
 
-  buildInputs = [ php ];
+  patches = [ ./dont-require-python3-in-path.patch ];
+
+  buildInputs = [ php python3 ];
 
   nativeBuildInputs = [ bison flex installShellFiles ];
 
diff --git a/pkgs/development/tools/misc/arcanist/dont-require-python3-in-path.patch b/pkgs/development/tools/misc/arcanist/dont-require-python3-in-path.patch
new file mode 100644
index 0000000000000..5c127491bb844
--- /dev/null
+++ b/pkgs/development/tools/misc/arcanist/dont-require-python3-in-path.patch
@@ -0,0 +1,26 @@
+Don't require python3 in PATH
+
+Once packaged, the arcanoid.py script has an absolute path shebang to
+python3, so there is no need to also require python3 in PATH.
+
+This prevents leaking in a python3 in PATH in the environment which arc
+runs linters etc.
+
+Author: bjorn.forsman@gmail.com
+diff -uNr arcanist.orig/src/workflow/ArcanistAnoidWorkflow.php arcanist.new/src/workflow/ArcanistAnoidWorkflow.php
+--- arcanist.orig/src/workflow/ArcanistAnoidWorkflow.php	2022-03-31 13:23:30.865095192 +0200
++++ arcanist.new/src/workflow/ArcanistAnoidWorkflow.php	2022-04-01 12:19:15.644159639 +0200
+@@ -24,13 +24,6 @@
+   }
+ 
+   public function runWorkflow() {
+-    if (!Filesystem::binaryExists('python3')) {
+-      throw new PhutilArgumentUsageException(
+-        pht(
+-          'The "arc anoid" workflow requires "python3" to be available '.
+-          'in your $PATH.'));
+-    }
+-
+     $support_dir = phutil_get_library_root('arcanist');
+     $support_dir = dirname($support_dir);
+     $support_dir = $support_dir.'/support/';
diff --git a/pkgs/development/tools/misc/clojure-lsp/default.nix b/pkgs/development/tools/misc/clojure-lsp/default.nix
index 4d39387991b1c..307bcd273a40e 100644
--- a/pkgs/development/tools/misc/clojure-lsp/default.nix
+++ b/pkgs/development/tools/misc/clojure-lsp/default.nix
@@ -2,18 +2,18 @@
 
 buildGraalvmNativeImage rec {
   pname = "clojure-lsp";
-  version = "2022.03.26-18.47.08";
+  version = "2022.03.31-20.00.20";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "sha256-tlI4h9/DTc3JwqCM58YC5x4FDpuPm7Qeik3PJe64nVA=";
+    sha256 = "sha256-UQA/BXf6hTTxZ504e1faPdS8mKYS8WrY5L/zgaGCxpU=";
   };
 
   jar = fetchurl {
     url = "https://github.com/clojure-lsp/clojure-lsp/releases/download/${version}/clojure-lsp-standalone.jar";
-    sha256 = "4973f5cf45f0b8120206d057d88d6a7fca03e071c8ad1ecd7229db46a0604ed2";
+    sha256 = "e66689326c39ae74f0e8d9f5a8229c7ebebe010849870a47faf88e81cbaa37e0";
   };
 
   extraNativeImageBuildArgs = [
diff --git a/pkgs/development/tools/misc/luarocks/3.7.nix b/pkgs/development/tools/misc/luarocks/3.7.nix
deleted file mode 100644
index 95fa79c6d125b..0000000000000
--- a/pkgs/development/tools/misc/luarocks/3.7.nix
+++ /dev/null
@@ -1,81 +0,0 @@
-{lib, stdenv, fetchFromGitHub
-, curl, makeWrapper, which, unzip
-, lua
-# for 'luarocks pack'
-, zip
-# some packages need to be compiled with cmake
-, cmake
-, installShellFiles
-}:
-
-stdenv.mkDerivation rec {
-  pname = "luarocks";
-  version = "3.7.0";
-
-  src = fetchFromGitHub {
-    owner = "luarocks";
-    repo = "luarocks";
-    rev = "v${version}";
-    sha256 = "1sn2j7hv8nbdjqj1747glk9770zw8q5v8ivaxhvwbk3vl038ck9d";
-  };
-
-  patches = [ ./darwin-3.7.0.patch ];
-
-  postPatch = lib.optionalString stdenv.targetPlatform.isDarwin ''
-    substituteInPlace src/luarocks/core/cfg.lua --subst-var-by 'darwinMinVersion' '${stdenv.targetPlatform.darwinMinVersion}'
-  '';
-
-  preConfigure = ''
-    lua -e "" || {
-        luajit -e "" && {
-            export LUA_SUFFIX=jit
-            configureFlags="$configureFlags --lua-suffix=$LUA_SUFFIX"
-        }
-    }
-    lua_inc="$(echo "${lua}/include"/*/)"
-    if test -n "$lua_inc"; then
-        configureFlags="$configureFlags --with-lua-include=$lua_inc"
-    fi
-  '';
-
-  nativeBuildInputs = [ makeWrapper installShellFiles ];
-
-  buildInputs = [ lua curl which ];
-
-  postInstall = ''
-    sed -e "1s@.*@#! ${lua}/bin/lua$LUA_SUFFIX@" -i "$out"/bin/*
-    for i in "$out"/bin/*; do
-        test -L "$i" || {
-            wrapProgram "$i" \
-              --suffix LUA_PATH ";" "$(echo "$out"/share/lua/*/)?.lua" \
-              --suffix LUA_PATH ";" "$(echo "$out"/share/lua/*/)?/init.lua" \
-              --suffix LUA_CPATH ";" "$(echo "$out"/lib/lua/*/)?.so" \
-              --suffix LUA_CPATH ";" "$(echo "$out"/share/lua/*/)?/init.lua"
-        }
-    done
-
-    installShellCompletion --cmd luarocks --bash <($out/bin/luarocks completion bash)
-    installShellCompletion --cmd luarocks --zsh <($out/bin/luarocks completion zsh)
-  '';
-
-  propagatedBuildInputs = [ zip unzip cmake ];
-
-  # unpack hook for src.rock and rockspec files
-  setupHook = ./setup-hook.sh;
-
-  # cmake is just to compile packages with "cmake" buildType, not luarocks itself
-  dontUseCmakeConfigure = true;
-
-  shellHook = ''
-    export PATH="src/bin:''${PATH:-}"
-    export LUA_PATH="src/?.lua;''${LUA_PATH:-}"
-  '';
-
-  meta = with lib; {
-    description = "A package manager for Lua";
-    license = licenses.mit ;
-    maintainers = with maintainers; [raskin teto];
-    platforms = platforms.linux ++ platforms.darwin;
-    downloadPage = "http://luarocks.org/releases/";
-  };
-}
diff --git a/pkgs/development/tools/misc/luarocks/darwin-3.1.3.patch b/pkgs/development/tools/misc/luarocks/darwin-3.1.3.patch
deleted file mode 100644
index 8070af173aaf7..0000000000000
--- a/pkgs/development/tools/misc/luarocks/darwin-3.1.3.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-diff --git a/src/luarocks/core/cfg.lua b/src/luarocks/core/cfg.lua
-index c5af5a2..1949fdc 100644
---- a/src/luarocks/core/cfg.lua
-+++ b/src/luarocks/core/cfg.lua
-@@ -425,7 +425,7 @@ local function make_defaults(lua_version, target_cpu, platforms, home)
-       defaults.external_lib_extension = "dylib"
-       defaults.arch = "macosx-"..target_cpu
-       defaults.variables.LIBFLAG = "-bundle -undefined dynamic_lookup -all_load"
--      local version = util.popen_read("sw_vers -productVersion")
-+      local version = os.getenv("MACOSX_DEPLOYMENT_TARGET") or "@darwinMinVersion@"
-       version = tonumber(version and version:match("^[^.]+%.([^.]+)")) or 3
-       if version >= 10 then
-          version = 8
-@@ -434,8 +434,8 @@ local function make_defaults(lua_version, target_cpu, platforms, home)
-       else
-          defaults.gcc_rpath = false
-       end
--      defaults.variables.CC = "env MACOSX_DEPLOYMENT_TARGET=10."..version.." gcc"
--      defaults.variables.LD = "env MACOSX_DEPLOYMENT_TARGET=10."..version.." gcc"
-+      defaults.variables.CC = "env MACOSX_DEPLOYMENT_TARGET=10."..version.." clang"
-+      defaults.variables.LD = "env MACOSX_DEPLOYMENT_TARGET=10."..version.." clang"
-       defaults.web_browser = "open"
-    end
- 
diff --git a/pkgs/development/tools/misc/luarocks/default.nix b/pkgs/development/tools/misc/luarocks/default.nix
index 58f5996992af6..b34c889792113 100644
--- a/pkgs/development/tools/misc/luarocks/default.nix
+++ b/pkgs/development/tools/misc/luarocks/default.nix
@@ -10,16 +10,16 @@
 
 stdenv.mkDerivation rec {
   pname = "luarocks";
-  version = "3.2.1";
+  version = "3.8.0";
 
   src = fetchFromGitHub {
     owner = "luarocks";
     repo = "luarocks";
     rev = "v${version}";
-    sha256 = "0viiafmb8binksda79ah828q1dfnb6jsqlk7vyndl2xvx9yfn4y2";
+    sha256 = "sha256-tPSAtveOodF2w54d82hEyaTj91imtySJUTsk/gje2dQ=";
   };
 
-  patches = [ ./darwin-3.1.3.patch ];
+  patches = [ ./darwin-3.7.0.patch ];
 
   postPatch = lib.optionalString stdenv.targetPlatform.isDarwin ''
     substituteInPlace src/luarocks/core/cfg.lua --subst-var-by 'darwinMinVersion' '${stdenv.targetPlatform.darwinMinVersion}'
diff --git a/pkgs/development/tools/misc/luarocks/luarocks-nix.nix b/pkgs/development/tools/misc/luarocks/luarocks-nix.nix
index 05770464de7d6..fe34bfd20a6f9 100644
--- a/pkgs/development/tools/misc/luarocks/luarocks-nix.nix
+++ b/pkgs/development/tools/misc/luarocks/luarocks-nix.nix
@@ -5,8 +5,8 @@ luarocks.overrideAttrs(old: {
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "luarocks-nix";
-    rev = "standalone";
-    sha256 = "sha256-53Zi+GTayO9EQTCIVrzPeRRHeIkHLqy0mHyBDzbcQQk=";
+    rev = "6aa1d59e88eaef72d699477c3e7aa98b274ca405";
+    sha256 = "sha256-nQLl01RFYZYhpShz0gHxnhwFPvTgALpAbjFPIuTD2D0=";
   };
   patches = [];
 
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/default.nix b/pkgs/development/tools/poetry2nix/poetry2nix/default.nix
index c9b70c83bfeec..6489a23c37d8b 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/default.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/default.nix
@@ -5,17 +5,10 @@
 }:
 let
   # Poetry2nix version
-  version = "1.26.0";
+  version = "1.27.1";
 
   inherit (poetryLib) isCompatible readTOML moduleName;
 
-  /* The default list of poetry2nix override overlays */
-  mkEvalPep508 = import ./pep508.nix {
-    inherit lib poetryLib;
-    stdenv = pkgs.stdenv;
-  };
-  getFunctorFn = fn: if builtins.typeOf fn == "set" then fn.__functor else fn;
-
   # Map SPDX identifiers to license names
   spdxLicenses = lib.listToAttrs (lib.filter (pair: pair.name != null) (builtins.map (v: { name = if lib.hasAttr "spdxId" v then v.spdxId else null; value = v; }) (lib.attrValues lib.licenses)));
   # Get license by id falling back to input string
@@ -121,10 +114,16 @@ lib.makeScope pkgs.newScope (self: {
     , preferWheels ? false
       # Example: { my-app = ./src; }
     , editablePackageSources ? { }
-    , __isBootstrap ? false  # Hack: Always add Poetry as a build input unless bootstrapping
     , pyProject ? readTOML pyproject
     }@attrs:
     let
+      /* The default list of poetry2nix override overlays */
+      mkEvalPep508 = import ./pep508.nix {
+        inherit lib poetryLib;
+        inherit (python) stdenv;
+      };
+      getFunctorFn = fn: if builtins.typeOf fn == "set" then fn.__functor else fn;
+
       poetryPkg = poetry.override { inherit python; };
 
       scripts = pyProject.tool.poetry.scripts or { };
@@ -180,7 +179,6 @@ lib.makeScope pkgs.newScope (self: {
                   value = self.mkPoetryDep (
                     pkgMeta // {
                       inherit pwd preferWheels;
-                      inherit __isBootstrap;
                       source = pkgMeta.source or null;
                       files = lockFiles.${name};
                       pythonPackages = self;
@@ -207,12 +205,12 @@ lib.makeScope pkgs.newScope (self: {
                 in
                 {
                   mkPoetryDep = self.callPackage ./mk-poetry-dep.nix {
-                    inherit pkgs lib python poetryLib evalPep508;
+                    inherit lib python poetryLib evalPep508;
                   };
 
-                  # Use poetry-core from the poetry build (pep517/518 build-system)
-                  poetry-core = if __isBootstrap then null else poetryPkg.passthru.python.pkgs.poetry-core;
-                  poetry = if __isBootstrap then null else poetryPkg;
+                  # # Use poetry-core from the poetry build (pep517/518 build-system)
+                  poetry-core = poetryPkg.passthru.python.pkgs.poetry-core;
+                  poetry = poetryPkg;
 
                   __toPluginAble = toPluginAble self;
 
@@ -222,10 +220,21 @@ lib.makeScope pkgs.newScope (self: {
                   setuptools-scm = super.setuptools_scm;
                 }
             )
+
+            # Fix infinite recursion in a lot of packages because of checkInputs
+            (self: super: lib.mapAttrs
+              (name: value: (
+                if lib.isDerivation value && lib.hasAttr "overridePythonAttrs" value
+                then value.overridePythonAttrs (_: { doCheck = false; })
+                else value
+              ))
+              super)
+
             # Null out any filtered packages, we don't want python.pkgs from nixpkgs
             (self: super: builtins.listToAttrs (builtins.map (x: { name = moduleName x.name; value = null; }) incompatible))
             # Create poetry2nix layer
             baseOverlay
+
           ] ++ # User provided overrides
           (if builtins.typeOf overrides == "list" then overrides else [ overrides ])
         );
@@ -318,12 +327,11 @@ lib.makeScope pkgs.newScope (self: {
     , python ? pkgs.python3
     , pwd ? projectDir
     , preferWheels ? false
-    , __isBootstrap ? false  # Hack: Always add Poetry as a build input unless bootstrapping
     , ...
     }@attrs:
     let
       poetryPython = self.mkPoetryPackages {
-        inherit pyproject poetrylock overrides python pwd preferWheels __isBootstrap;
+        inherit pyproject poetrylock overrides python pwd preferWheels;
       };
       py = poetryPython.python;
 
@@ -429,7 +437,7 @@ lib.makeScope pkgs.newScope (self: {
 
     Can be overriden by calling defaultPoetryOverrides.overrideOverlay which takes an overlay function
   */
-  defaultPoetryOverrides = self.mkDefaultPoetryOverrides (import ./overrides.nix { inherit pkgs lib; });
+  defaultPoetryOverrides = self.mkDefaultPoetryOverrides (import ./overrides { inherit pkgs lib; });
 
   /*
     Convenience functions for specifying overlays with or without the poerty2nix default overrides
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/hooks/default.nix b/pkgs/development/tools/poetry2nix/poetry2nix/hooks/default.nix
index 0abbe2459927c..5d562017b8fbb 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/hooks/default.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/hooks/default.nix
@@ -67,6 +67,13 @@ in
         {
           name = "fixup-hook.sh";
           deps = [ ];
+          substitutions = {
+            inherit pythonSitePackages;
+            filenames = builtins.concatStringsSep " " [
+              "pyproject.toml"
+              "README.md"
+            ];
+          };
         } ./fixup-hook.sh
     )
     { };
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/hooks/fixup-hook.sh b/pkgs/development/tools/poetry2nix/poetry2nix/hooks/fixup-hook.sh
index fc539e4298c61..8cbe2b178c7ac 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/hooks/fixup-hook.sh
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/hooks/fixup-hook.sh
@@ -1,8 +1,20 @@
 poetry2nix-fixup-hook() {
+
     # Including tests in the output is a common mistake
     if [ -z "${dontFixupTests-}" ]; then
-        rm -rf $out/lib/python3.7/site-packages/tests
+        rm -rf $out/@pythonSitePackages@/tests
+    fi
+
+    # Including files in site-packages is a common packaging mistake
+    #
+    # While we cannot remove all normal files dumped in site-packages
+    # we can clean up some common mistakes
+    if [ -z "${dontFixupSitePackages-}" ]; then
+        for f in @filenames@; do
+            rm -f $out/@pythonSitePackages@/$f
+        done
     fi
+
 }
 
 postFixupHooks+=(poetry2nix-fixup-hook)
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/hooks/pip-build-hook.sh b/pkgs/development/tools/poetry2nix/poetry2nix/hooks/pip-build-hook.sh
index a3ebe311d591e..31e06909b3b69 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/hooks/pip-build-hook.sh
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/hooks/pip-build-hook.sh
@@ -5,14 +5,6 @@ pipBuildPhase() {
     echo "Executing pipBuildPhase"
     runHook preBuild
 
-    # Prefer using setup.py to avoid build-system dependencies if we have a setup.py
-    if [ -z "${dontPreferSetupPy-}" ]; then
-      if test -e setup.py && test -e pyproject.toml; then
-        echo "Removing pyproject.toml..."
-        rm -f pyproject.toml
-      fi
-    fi
-
     mkdir -p dist
     echo "Creating a wheel..."
     @pythonInterpreter@ -m pip wheel --verbose --no-index --no-deps --no-clean --no-build-isolation --wheel-dir dist .
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/lib.nix b/pkgs/development/tools/poetry2nix/poetry2nix/lib.nix
index 8e9dee865a543..a905d302d2a9b 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/lib.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/lib.nix
@@ -79,6 +79,7 @@ let
     if lib.strings.hasInfix "manylinux1" f then { pkg = [ ml.manylinux1 ]; str = "1"; }
     else if lib.strings.hasInfix "manylinux2010" f then { pkg = [ ml.manylinux2010 ]; str = "2010"; }
     else if lib.strings.hasInfix "manylinux2014" f then { pkg = [ ml.manylinux2014 ]; str = "2014"; }
+    else if lib.strings.hasInfix "manylinux_" f then { pkg = [ ml.manylinux2014 ]; str = "pep600"; }
     else { pkg = [ ]; str = null; };
 
   # Predict URL from the PyPI index.
@@ -110,8 +111,8 @@ let
     (pkgs.stdenvNoCC.mkDerivation {
       name = file;
       nativeBuildInputs = [
-        pkgs.curl
-        pkgs.jq
+        pkgs.buildPackages.curl
+        pkgs.buildPackages.jq
       ];
       isWheel = lib.strings.hasSuffix "whl" file;
       system = "builtin";
@@ -219,7 +220,8 @@ let
   };
 
   # Machine tag for our target platform (if available)
-  targetMachine = manyLinuxTargetMachines.${stdenv.targetPlatform.parsed.cpu.name} or null;
+  getTargetMachine = stdenv: manyLinuxTargetMachines.${stdenv.targetPlatform.parsed.cpu.name} or null;
+
 in
 {
   inherit
@@ -233,6 +235,6 @@ in
     cleanPythonSources
     moduleName
     getPythonVersion
-    targetMachine
+    getTargetMachine
     ;
 }
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/mk-poetry-dep.nix b/pkgs/development/tools/poetry2nix/poetry2nix/mk-poetry-dep.nix
index 5735e320c03fb..a5c19f873616d 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/mk-poetry-dep.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/mk-poetry-dep.nix
@@ -1,5 +1,4 @@
 { autoPatchelfHook
-, pkgs
 , lib
 , python
 , buildPythonPackage
@@ -17,7 +16,6 @@
 , sourceSpec
 , supportedExtensions ? lib.importJSON ./extensions.json
 , preferWheels ? false
-, __isBootstrap ? false  # Hack: Always add Poetry as a build input unless bootstrapping
 , ...
 }:
 
@@ -27,12 +25,11 @@ pythonPackages.callPackage
     , ...
     }@args:
     let
-      inherit (pkgs) stdenv;
+      inherit (python) stdenv;
       inherit (poetryLib) isCompatible getManyLinuxDeps fetchFromLegacy fetchFromPypi moduleName;
 
       inherit (import ./pep425.nix {
-        inherit lib poetryLib python;
-        inherit (pkgs) stdenv;
+        inherit lib poetryLib python stdenv;
       }) selectWheel
         ;
       fileCandidates =
@@ -97,6 +94,7 @@ pythonPackages.callPackage
         "setuptools-scm"
         "toml" # Toml is an extra for setuptools-scm
         "tomli" # tomli is an extra for later versions of setuptools-scm
+        "flit-core"
         "packaging"
         "six"
         "pyparsing"
@@ -129,7 +127,6 @@ pythonPackages.callPackage
         ++ lib.optional (stdenv.buildPlatform != stdenv.hostPlatform) pythonPackages.setuptools
         ++ lib.optional (!isSource) (getManyLinuxDeps fileInfo.name).pkg
         ++ lib.optional isDirectory buildSystemPkgs
-        ++ lib.optional (!__isBootstrap) pythonPackages.poetry
       );
 
       propagatedBuildInputs =
@@ -169,11 +166,18 @@ pythonPackages.callPackage
       src =
         if isGit then
           (
-            builtins.fetchGit {
+            builtins.fetchGit ({
               inherit (source) url;
               rev = source.resolved_reference or source.reference;
-              ref = sourceSpec.branch or sourceSpec.rev or (if sourceSpec?tag then "refs/tags/${sourceSpec.tag}" else "HEAD");
-            }
+              ref = sourceSpec.branch or (if sourceSpec ? tag then "refs/tags/${sourceSpec.tag}" else "HEAD");
+            } // (
+              let
+                nixVersion = builtins.substring 0 3 builtins.nixVersion;
+              in
+              lib.optionalAttrs ((sourceSpec ? rev) && (lib.versionAtLeast nixVersion "2.4")) {
+                allRefs = true;
+              }
+            ))
           )
         else if isUrl then
           builtins.fetchTarball
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/overrides.nix b/pkgs/development/tools/poetry2nix/poetry2nix/overrides.nix
deleted file mode 100644
index 6e35069a817c7..0000000000000
--- a/pkgs/development/tools/poetry2nix/poetry2nix/overrides.nix
+++ /dev/null
@@ -1,2271 +0,0 @@
-{ pkgs ? import <nixpkgs> { }
-, lib ? pkgs.lib
-, stdenv ? pkgs.stdenv
-}:
-
-self: super:
-
-{
-  automat = super.automat.overridePythonAttrs (
-    old: rec {
-      propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ self.m2r ];
-    }
-  );
-
-  aiohttp-swagger3 = super.aiohttp-swagger3.overridePythonAttrs (
-    old: {
-      nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ self.pytest-runner ];
-    }
-  );
-
-  ansible = super.ansible.overridePythonAttrs (
-    old: {
-      # Inputs copied from nixpkgs as ansible doesn't specify it's dependencies
-      # in a correct manner.
-      propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [
-        self.pycrypto
-        self.paramiko
-        self.jinja2
-        self.pyyaml
-        self.httplib2
-        self.six
-        self.netaddr
-        self.dnspython
-        self.jmespath
-        self.dopy
-        self.ncclient
-      ];
-    } // lib.optionalAttrs (lib.versionOlder old.version "5.0") {
-      prePatch = pkgs.python.pkgs.ansible.prePatch or "";
-      postInstall = pkgs.python.pkgs.ansible.postInstall or "";
-    }
-  );
-
-  ansible-lint = super.ansible-lint.overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ]) ++ [ self.setuptools-scm-git-archive ];
-      preBuild = ''
-        export HOME=$(mktemp -d)
-      '';
-    }
-  );
-
-  anyio = super.anyio.overridePythonAttrs (old: {
-    postPatch = ''
-      substituteInPlace setup.py --replace 'setup()' 'setup(version="${old.version}")'
-    '';
-  });
-
-  argcomplete = super.argcomplete.overridePythonAttrs (
-    old: rec {
-      buildInputs = (old.buildInputs or [ ]) ++ [ self.importlib-metadata ];
-    }
-  );
-
-  arpeggio = super.arpeggio.overridePythonAttrs (
-    old: {
-      nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ self.pytest-runner ];
-    }
-  );
-
-  astroid = super.astroid.overridePythonAttrs (
-    old: rec {
-      buildInputs = (old.buildInputs or [ ]) ++ [ self.pytest-runner ];
-    }
-  );
-
-  av = super.av.overridePythonAttrs (
-    old: {
-      nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [
-        pkgs.pkg-config
-      ];
-      buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.ffmpeg_4 ];
-    }
-  );
-
-  argon2-cffi = super.argon2-cffi.overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ]) ++
-        lib.optional (lib.versionAtLeast old.version "21.2.0") [ self.flit-core ];
-    }
-  );
-
-  backports-entry-points-selectable = super.backports-entry-points-selectable.overridePythonAttrs (old: {
-    postPatch = ''
-      substituteInPlace setup.py --replace \
-        'setuptools.setup()' \
-        'setuptools.setup(version="${old.version}")'
-    '';
-  });
-
-  backports-functools-lru-cache = super.backports-functools-lru-cache.overridePythonAttrs (old: {
-    postPatch = ''
-      substituteInPlace setup.py --replace \
-        'setuptools.setup()' \
-        'setuptools.setup(version="${old.version}")'
-    '';
-  });
-
-  bcrypt = super.bcrypt.overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.libffi ];
-    }
-  );
-
-  bjoern = super.bjoern.overridePythonAttrs (
-    old: {
-      buildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.libev ];
-    }
-  );
-
-  black = super.black.overridePythonAttrs (
-    old: {
-      dontPreferSetupPy = true;
-    }
-  );
-
-  borgbackup = super.borgbackup.overridePythonAttrs (
-    old: {
-      BORG_OPENSSL_PREFIX = pkgs.openssl.dev;
-      nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.pkg-config ];
-      buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.openssl pkgs.acl ];
-    }
-  );
-
-  cairocffi = super.cairocffi.overridePythonAttrs (
-    old: {
-      inherit (pkgs.python3.pkgs.cairocffi) patches;
-      buildInputs = (old.buildInputs or [ ]) ++ [ self.pytest-runner ];
-    }
-  );
-
-  cairosvg = super.cairosvg.overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ]) ++ [ self.pytest-runner ];
-    }
-  );
-
-  celery = super.celery.overridePythonAttrs (old: {
-    propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ self.setuptools ];
-  });
-
-  cssselect2 = super.cssselect2.overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ]) ++ [ self.pytest-runner ];
-    }
-  );
-
-  cffi =
-    # cffi is bundled with pypy
-    if self.python.implementation == "pypy" then null else
-    (
-      super.cffi.overridePythonAttrs (
-        old: {
-          buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.libffi ];
-        }
-      )
-    );
-
-  cftime = super.cftime.overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ]) ++ [
-        self.cython
-      ];
-    }
-  );
-
-  cheroot = super.cheroot.overridePythonAttrs (
-    old: {
-      dontPreferSetupPy = true;
-    }
-  );
-
-  cloudflare = super.cloudflare.overridePythonAttrs (
-    old: {
-      postPatch = ''
-        rm -rf examples/*
-      '';
-    }
-  );
-
-  colour = super.colour.overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ]) ++ [ self.d2to1 ];
-    }
-  );
-
-  configparser = super.configparser.overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ]) ++ [
-        self.toml
-      ];
-
-      postPatch = ''
-        substituteInPlace setup.py --replace 'setuptools.setup()' 'setuptools.setup(version="${old.version}")'
-      '';
-    }
-  );
-
-  cryptography = super.cryptography.overridePythonAttrs (
-    old: {
-      nativeBuildInputs = (old.nativeBuildInputs or [ ])
-        ++ lib.optional (lib.versionAtLeast old.version "3.4") [ self.setuptools-rust ]
-        ++ lib.optional (stdenv.buildPlatform != stdenv.hostPlatform) self.python.pythonForBuild.pkgs.cffi
-        ++ lib.optional (lib.versionAtLeast old.version "3.5")
-        (with pkgs.rustPlatform; [ cargoSetupHook rust.cargo rust.rustc ]);
-      buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.openssl ];
-    } // lib.optionalAttrs (lib.versionAtLeast old.version "3.4" && lib.versionOlder old.version "3.5") {
-      CRYPTOGRAPHY_DONT_BUILD_RUST = "1";
-    } // lib.optionalAttrs (lib.versionAtLeast old.version "35") rec {
-      cargoDeps =
-        let
-          getCargoHash = version:
-            if lib.versionOlder version "36.0.0" then "sha256-tQoQfo+TAoqAea86YFxyj/LNQCiViu5ij/3wj7ZnYLI="
-            else if lib.versionOlder version "36.0.1" then "sha256-Y6TuW7AryVgSvZ6G8WNoDIvi+0tvx8ZlEYF5qB0jfNk="
-            # This hash could no longer be valid for cryptography versions
-            # different from 36.0.1
-            else "sha256-kozYXkqt1Wpqyo9GYCwN08J+zV92ZWFJY/f+rulxmeQ=";
-        in
-        pkgs.rustPlatform.fetchCargoTarball {
-          src = old.src;
-          sourceRoot = "${old.pname}-${old.version}/${cargoRoot}";
-          name = "${old.pname}-${old.version}";
-          sha256 = getCargoHash old.version;
-        };
-      cargoRoot = "src/rust";
-    }
-  );
-
-  cwcwidth = super.cwcwidth.overridePythonAttrs (old: {
-    nativeBuildInputs = (old.nativeBuildInputs or [ ])
-      ++ [ self.cython ];
-  });
-
-  cyclonedx-python-lib = super.cyclonedx-python-lib.overridePythonAttrs (old: {
-    propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ self.setuptools ];
-    postPatch = ''
-      substituteInPlace setup.py --replace 'setuptools>=50.3.2,<51.0.0' 'setuptools'
-    '';
-  });
-
-  daphne = super.daphne.overridePythonAttrs (old: {
-    postPatch = ''
-      substituteInPlace setup.py --replace 'setup_requires=["pytest-runner"],' ""
-    '';
-  });
-
-  datadog-lambda = super.datadog-lambda.overridePythonAttrs (old: {
-    postPatch = ''
-      substituteInPlace setup.py --replace "setuptools==" "setuptools>="
-    '';
-    buildInputs = (old.buildInputs or [ ]) ++ [ self.setuptools ];
-  });
-
-  dbus-python = super.dbus-python.overridePythonAttrs (old: {
-    outputs = [ "out" "dev" ];
-
-    postPatch = old.postPatch or "" + ''
-      substituteInPlace ./configure --replace /usr/bin/file ${pkgs.file}/bin/file
-      substituteInPlace ./dbus-python.pc.in --replace 'Cflags: -I''${includedir}' 'Cflags: -I''${includedir}/dbus-1.0'
-    '';
-
-    configureFlags = (old.configureFlags or [ ]) ++ [
-      "PYTHON_VERSION=${lib.versions.major self.python.version}"
-    ];
-
-    preConfigure = lib.concatStringsSep "\n" [
-      (old.preConfigure or "")
-      (if (lib.versionAtLeast stdenv.hostPlatform.darwinMinVersion "11" && stdenv.isDarwin) then ''
-        MACOSX_DEPLOYMENT_TARGET=10.16
-      '' else "")
-    ];
-
-    preBuild = old.preBuild or "" + ''
-      make distclean
-    '';
-
-    nativeBuildInputs = old.nativeBuildInputs or [ ] ++ [ pkgs.pkg-config ];
-    buildInputs = old.buildInputs or [ ] ++ [ pkgs.dbus pkgs.dbus-glib ]
-      # My guess why it's sometimes trying to -lncurses.
-      # It seems not to retain the dependency anyway.
-      ++ lib.optional (! self.python ? modules) pkgs.ncurses;
-  });
-
-  dcli = super.dcli.overridePythonAttrs (old: {
-    propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ self.setuptools ];
-  });
-
-  ddtrace = super.ddtrace.overridePythonAttrs (old: {
-    buildInputs = (old.buildInputs or [ ]) ++
-      (pkgs.lib.optionals pkgs.stdenv.isDarwin [ pkgs.darwin.IOKit ]) ++ [ self.cython ];
-  });
-
-  dictdiffer = super.dictdiffer.overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ]) ++ [ self.pytest-runner ];
-      propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ self.setuptools ];
-    }
-  );
-
-  django = (
-    super.django.overridePythonAttrs (
-      old: {
-        propagatedNativeBuildInputs = (old.propagatedNativeBuildInputs or [ ])
-          ++ [ pkgs.gettext self.pytest-runner ];
-      }
-    )
-  );
-
-  django-bakery = super.django-bakery.overridePythonAttrs (
-    old: {
-      configurePhase = ''
-        if ! test -e LICENSE; then
-          touch LICENSE
-        fi
-      '' + (old.configurePhase or "");
-    }
-  );
-
-  django-cors-headers = super.django-cors-headers.overridePythonAttrs (
-    old: {
-      nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ self.pytest-runner ];
-    }
-  );
-
-  django-hijack = super.django-hijack.overridePythonAttrs (
-    old: {
-      nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ self.pytest-runner ];
-    }
-  );
-
-  django-prometheus = super.django-prometheus.overridePythonAttrs (
-    old: {
-      nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ self.pytest-runner ];
-    }
-  );
-
-  django-rosetta = super.django-rosetta.overridePythonAttrs (
-    old: {
-      nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ self.pytest-runner ];
-    }
-  );
-
-  django-stubs-ext = super.django-stubs-ext.overridePythonAttrs (
-    old: {
-      prePatch = (old.prePatch or "") + "touch ../LICENSE.txt";
-    }
-  );
-
-  dlib = super.dlib.overridePythonAttrs (
-    old: {
-      # Parallel building enabled
-      inherit (pkgs.python.pkgs.dlib) patches;
-
-      enableParallelBuilding = true;
-      dontUseCmakeConfigure = true;
-
-      nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ pkgs.dlib.nativeBuildInputs;
-      buildInputs = (old.buildInputs or [ ]) ++ pkgs.dlib.buildInputs;
-    }
-  );
-
-  # Environment markers are not always included (depending on how a dep was defined)
-  enum34 = if self.pythonAtLeast "3.4" then null else super.enum34;
-
-  eth-hash = super.eth-hash.overridePythonAttrs {
-    preConfigure = ''
-      substituteInPlace setup.py --replace \'setuptools-markdown\' ""
-    '';
-  };
-
-  eth-keyfile = super.eth-keyfile.overridePythonAttrs {
-    preConfigure = ''
-      substituteInPlace setup.py --replace \'setuptools-markdown\' ""
-    '';
-  };
-
-  eth-keys = super.eth-keys.overridePythonAttrs {
-    preConfigure = ''
-      substituteInPlace setup.py --replace \'setuptools-markdown\' ""
-    '';
-  };
-
-  # remove eth-hash dependency because eth-hash also depends on eth-utils causing a cycle.
-  eth-utils = super.eth-utils.overridePythonAttrs (old: {
-    propagatedBuildInputs =
-      builtins.filter (i: i.pname != "eth-hash") old.propagatedBuildInputs;
-    preConfigure = ''
-      ${old.preConfigure or ""}
-      sed -i '/eth-hash/d' setup.py
-    '';
-  });
-
-  faker = super.faker.overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ]) ++ [ self.pytest-runner ];
-      doCheck = false;
-    }
-  );
-
-  fancycompleter = super.fancycompleter.overridePythonAttrs (
-    old: {
-      postPatch = ''
-        substituteInPlace setup.py \
-          --replace 'setup_requires="setupmeta"' 'setup_requires=[]' \
-          --replace 'versioning="devcommit"' 'version="${old.version}"'
-      '';
-    }
-  );
-
-  fastapi = super.fastapi.overridePythonAttrs (
-    old: {
-      # Note: requires full flit, not just flit-core
-      nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ self.flit ];
-    }
-  );
-
-  fastecdsa = super.fastecdsa.overridePythonAttrs (old: {
-    buildInputs = old.buildInputs ++ [ pkgs.gmp.dev ];
-  });
-
-  fastparquet = super.fastparquet.overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ]) ++ [ self.pytest-runner ];
-    }
-  );
-
-  filelock = super.filelock.overridePythonAttrs (old: {
-    postPatch = ''
-      substituteInPlace setup.py --replace 'setup()' 'setup(version="${old.version}")'
-    '';
-  });
-
-  fiona = super.fiona.overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.gdal_2 ];
-      nativeBuildInputs = [
-        pkgs.gdal_2 # for gdal-config
-      ];
-    }
-  );
-
-  gdal = super.gdal.overridePythonAttrs (
-    old: {
-      preBuild = (old.preBuild or "") + ''
-        substituteInPlace setup.cfg \
-          --replace "../../apps/gdal-config" '${pkgs.gdal}/bin/gdal-config'
-      '';
-    }
-  );
-
-  grandalf = super.grandalf.overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ]) ++ [ self.pytest-runner ];
-      doCheck = false;
-    }
-  );
-
-  gitpython = super.gitpython.overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ]) ++ [ self.typing-extensions ];
-    }
-  );
-
-  grpcio = super.grpcio.overridePythonAttrs (old: {
-    nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ self.cython pkgs.pkg-config ];
-    buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.c-ares pkgs.openssl pkgs.zlib ];
-
-    outputs = [ "out" "dev" ];
-
-    GRPC_BUILD_WITH_BORING_SSL_ASM = "";
-    GRPC_PYTHON_BUILD_SYSTEM_OPENSSL = 1;
-    GRPC_PYTHON_BUILD_SYSTEM_ZLIB = 1;
-    GRPC_PYTHON_BUILD_SYSTEM_CARES = 1;
-    DISABLE_LIBC_COMPATIBILITY = 1;
-  });
-
-  grpcio-tools = super.grpcio-tools.overridePythonAttrs (old: {
-    outputs = [ "out" "dev" ];
-  });
-
-  h3 = super.h3.overridePythonAttrs (
-    old: {
-      preBuild = (old.preBuild or "") + ''
-        substituteInPlace h3/h3.py \
-          --replace "'{}/{}'.format(_dirname, libh3_path)" '"${pkgs.h3}/lib/libh3${pkgs.stdenv.hostPlatform.extensions.sharedLibrary}"'
-      '';
-    }
-  );
-
-  h5py = super.h5py.overridePythonAttrs (
-    old:
-    if old.format != "wheel" then
-      (
-        let
-          mpi = pkgs.hdf5.mpi;
-          mpiSupport = pkgs.hdf5.mpiSupport;
-        in
-        {
-          nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.pkg-config ];
-          buildInputs =
-            (old.buildInputs or [ ])
-            ++ [ pkgs.hdf5 self.pkgconfig self.cython ]
-            ++ lib.optional mpiSupport mpi
-          ;
-          propagatedBuildInputs =
-            (old.propagatedBuildInputs or [ ])
-            ++ lib.optionals mpiSupport [ self.mpi4py self.openssh ]
-          ;
-          preBuild = if mpiSupport then "export CC=${mpi}/bin/mpicc" else "";
-          HDF5_DIR = "${pkgs.hdf5}";
-          HDF5_MPI = if mpiSupport then "ON" else "OFF";
-          # avoid strict pinning of numpy
-          postPatch = ''
-            substituteInPlace setup.py \
-              --replace "numpy ==" "numpy >="
-          '';
-          pythonImportsCheck = [ "h5py" ];
-        }
-      ) else old
-  );
-
-  hid = super.hid.overridePythonAttrs (
-    old: {
-      postPatch = ''
-        found=
-        for name in libhidapi-hidraw libhidapi-libusb libhidapi-iohidmanager libhidapi; do
-          full_path=${pkgs.hidapi.out}/lib/$name${pkgs.stdenv.hostPlatform.extensions.sharedLibrary}
-          if test -f $full_path; then
-            found=t
-            sed -i -e "s|'$name\..*'|'$full_path'|" hid/__init__.py
-          fi
-        done
-        test -n "$found" || { echo "ERROR: No known libraries found in ${pkgs.hidapi.out}/lib, please update/fix this build expression."; exit 1; }
-      '';
-    }
-  );
-
-  horovod = super.horovod.overridePythonAttrs (
-    old: {
-      propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ pkgs.mpi ];
-    }
-  );
-
-  httplib2 = super.httplib2.overridePythonAttrs (old: {
-    propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ self.pyparsing ];
-  });
-
-  icecream = super.icecream.overridePythonAttrs (old: {
-    #  # ERROR: Could not find a version that satisfies the requirement executing>=0.3.1 (from icecream) (from versions: none)
-    postPatch = ''
-      substituteInPlace setup.py --replace 'executing>=0.3.1' 'executing'
-    '';
-  });
-
-  imagecodecs = super.imagecodecs.overridePythonAttrs (
-    old: {
-      patchPhase = ''
-        substituteInPlace setup.py \
-          --replace "/usr/include/openjpeg-2.3" \
-                    "${pkgs.openjpeg.dev}/include/${pkgs.openjpeg.dev.incDir}
-        substituteInPlace setup.py \
-          --replace "/usr/include/jxrlib" \
-                    "$out/include/libjxr"
-        substituteInPlace imagecodecs/_zopfli.c \
-          --replace '"zopfli/zopfli.h"' \
-                    '<zopfli.h>'
-        substituteInPlace imagecodecs/_zopfli.c \
-          --replace '"zopfli/zlib_container.h"' \
-                    '<zlib_container.h>'
-        substituteInPlace imagecodecs/_zopfli.c \
-          --replace '"zopfli/gzip_container.h"' \
-                    '<gzip_container.h>'
-      '';
-
-      preBuild = ''
-        mkdir -p $out/include/libjxr
-        ln -s ${pkgs.jxrlib}/include/libjxr/**/* $out/include/libjxr
-
-      '';
-
-      buildInputs = (old.buildInputs or [ ]) ++ [
-        # Commented out packages are declared required, but not actually
-        # needed to build. They are not yet packaged for nixpkgs.
-        # bitshuffle
-        pkgs.brotli
-        # brunsli
-        pkgs.bzip2
-        pkgs.c-blosc
-        # charls
-        pkgs.giflib
-        pkgs.jxrlib
-        pkgs.lcms
-        pkgs.libaec
-        pkgs.libaec
-        pkgs.libjpeg_turbo
-        # liblzf
-        # liblzma
-        pkgs.libpng
-        pkgs.libtiff
-        pkgs.libwebp
-        pkgs.lz4
-        pkgs.openjpeg
-        pkgs.snappy
-        # zfp
-        pkgs.zopfli
-        pkgs.zstd
-        pkgs.zlib
-      ];
-    }
-  );
-
-  # importlib-metadata has an incomplete dependency specification
-  importlib-metadata = super.importlib-metadata.overridePythonAttrs (
-    old: {
-      propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ lib.optional self.python.isPy2 self.pathlib2;
-
-      # disable the removal of pyproject.toml, required because of setuptools_scm
-      dontPreferSetupPy = true;
-
-      postPatch = old.postPatch or "" + (lib.optionalString ((old.format or "") != "wheel") ''
-        substituteInPlace setup.py --replace 'setuptools.setup()' 'setuptools.setup(version="${old.version}")'
-      '');
-    }
-  );
-
-  importlib-resources = super.importlib-resources.overridePythonAttrs (
-    old: {
-      # disable the removal of pyproject.toml, required because of setuptools_scm
-      dontPreferSetupPy = true;
-    }
-  );
-
-  intreehooks = super.intreehooks.overridePythonAttrs (
-    old: {
-      doCheck = false;
-    }
-  );
-
-  isort = super.isort.overridePythonAttrs (
-    old: {
-      propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ self.setuptools ];
-    }
-  );
-
-  jaraco-functools = super.jaraco-functools.overridePythonAttrs (
-    old: {
-      # required for the extra "toml" dependency in setuptools_scm[toml]
-      buildInputs = (old.buildInputs or [ ]) ++ [
-        self.toml
-      ];
-      # disable the removal of pyproject.toml, required because of setuptools_scm
-      dontPreferSetupPy = true;
-    }
-  );
-
-  jira = super.jira.overridePythonAttrs (
-    old: {
-      inherit (pkgs.python3Packages.jira) patches;
-      buildInputs = (old.buildInputs or [ ]) ++ [
-        self.pytestrunner
-        self.cryptography
-        self.pyjwt
-        self.setuptools-scm-git-archive
-      ];
-    }
-  );
-
-  jq = super.jq.overridePythonAttrs (attrs: {
-    buildInputs = [ pkgs.jq ];
-    patches = [
-      (pkgs.fetchpatch {
-        url = "https://raw.githubusercontent.com/NixOS/nixpkgs/088da8735f6620b60d724aa7db742607ea216087/pkgs/development/python-modules/jq/jq-py-setup.patch";
-        sha256 = "sha256-MYvX3S1YGe0QsUtExtOtULvp++AdVrv+Fid4Jh1xewQ=";
-      })
-    ];
-  });
-
-  jsondiff = super.jsondiff.overridePythonAttrs (
-    old: {
-      preBuild = (old.preBuild or "") + ''
-        substituteInPlace setup.py \
-          --replace "'jsondiff=jsondiff.cli:main_deprecated'," ""
-      '';
-    }
-  );
-
-  jsonpickle = super.jsonpickle.overridePythonAttrs (
-    old: {
-      dontPreferSetupPy = true;
-    }
-  );
-
-  jsonslicer = super.jsonslicer.overridePythonAttrs (old: {
-    nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.pkgconfig ];
-    buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.yajl ];
-  });
-
-  jupyter = super.jupyter.overridePythonAttrs (
-    old: rec {
-      # jupyter is a meta-package. Everything relevant comes from the
-      # dependencies. It does however have a jupyter.py file that conflicts
-      # with jupyter-core so this meta solves this conflict.
-      meta.priority = 100;
-    }
-  );
-
-  jupyterlab-widgets = super.jupyterlab-widgets.overridePythonAttrs (
-    old: rec {
-      buildInputs = (old.buildInputs or [ ]) ++ [ self.jupyter-packaging ];
-    }
-  );
-
-  kerberos = super.kerberos.overrideAttrs (old: {
-    nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.libkrb5 ];
-  });
-
-  keyring = super.keyring.overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ]) ++ [
-        self.toml
-      ];
-      postPatch = ''
-        substituteInPlace setup.py --replace 'setuptools.setup()' 'setuptools.setup(version="${old.version}")'
-      '';
-    }
-  );
-
-  kiwisolver = super.kiwisolver.overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ]) ++ [
-        self.cppy
-      ];
-    }
-  );
-
-  lap = super.lap.overridePythonAttrs (
-    old: {
-      propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [
-        self.numpy
-      ];
-    }
-  );
-
-  libvirt-python = super.libvirt-python.overridePythonAttrs ({ nativeBuildInputs ? [ ], ... }: {
-    nativeBuildInputs = nativeBuildInputs ++ [ pkgs.pkg-config ];
-    propagatedBuildInputs = [ pkgs.libvirt ];
-  });
-
-  licensecheck = super.licensecheck.overridePythonAttrs (old: {
-    dontPreferSetupPy = true;
-  });
-
-  llvmlite = super.llvmlite.overridePythonAttrs (
-    old:
-    let
-      llvm =
-        if lib.versionAtLeast old.version "0.37.0" then
-          pkgs.llvmPackages_11.llvm
-        else if (lib.versionOlder old.version "0.37.0" && lib.versionAtLeast old.version "0.34.0") then
-          pkgs.llvmPackages_10.llvm
-        else if (lib.versionOlder old.version "0.34.0" && lib.versionAtLeast old.version "0.33.0") then
-          pkgs.llvmPackages_9.llvm
-        else if (lib.versionOlder old.version "0.33.0" && lib.versionAtLeast old.version "0.29.0") then
-          pkgs.llvmPackages_8.llvm
-        else if (lib.versionOlder old.version "0.28.0" && lib.versionAtLeast old.version "0.27.0") then
-          pkgs.llvmPackages_7.llvm
-        else if (lib.versionOlder old.version "0.27.0" && lib.versionAtLeast old.version "0.23.0") then
-          pkgs.llvmPackages_6.llvm
-        else if (lib.versionOlder old.version "0.23.0" && lib.versionAtLeast old.version "0.21.0") then
-          pkgs.llvmPackages_5.llvm
-        else
-          pkgs.llvm; # Likely to fail.
-    in
-    {
-      nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.llvm ];
-
-      # Disable static linking
-      # https://github.com/numba/llvmlite/issues/93
-      postPatch = ''
-        substituteInPlace ffi/Makefile.linux --replace "-static-libstdc++" ""
-
-        substituteInPlace llvmlite/tests/test_binding.py --replace "test_linux" "nope"
-      '';
-
-      # Set directory containing llvm-config binary
-      preConfigure = ''
-        export LLVM_CONFIG=${llvm.dev}/bin/llvm-config
-      '';
-
-      __impureHostDeps = lib.optionals pkgs.stdenv.isDarwin [ "/usr/lib/libm.dylib" ];
-
-      passthru = old.passthru // { llvm = llvm; };
-    }
-  );
-
-  lockfile = super.lockfile.overridePythonAttrs (
-    old: {
-      propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ self.pbr ];
-    }
-  );
-
-  lxml = super.lxml.overridePythonAttrs (
-    old: {
-      nativeBuildInputs = with pkgs; (old.nativeBuildInputs or [ ]) ++ [ pkg-config libxml2.dev libxslt.dev ] ++ lib.optionals stdenv.isDarwin [ xcodebuild ];
-      buildInputs = with pkgs; (old.buildInputs or [ ]) ++ [ libxml2 libxslt ];
-    }
-  );
-
-  markupsafe = super.markupsafe.overridePythonAttrs (
-    old: {
-      src = old.src.override { pname = builtins.replaceStrings [ "markupsafe" ] [ "MarkupSafe" ] old.pname; };
-    }
-  );
-
-  matplotlib = super.matplotlib.overridePythonAttrs (
-    old:
-    let
-      enableGhostscript = old.passthru.enableGhostscript or false;
-      enableGtk3 = old.passthru.enableTk or false;
-      enableQt = old.passthru.enableQt or false;
-      enableTk = old.passthru.enableTk or false;
-
-      inherit (pkgs.darwin.apple_sdk.frameworks) Cocoa;
-    in
-    {
-      NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-I${pkgs.libcxx}/include/c++/v1";
-
-      XDG_RUNTIME_DIR = "/tmp";
-
-      buildInputs = (old.buildInputs or [ ])
-        ++ lib.optional enableGhostscript pkgs.ghostscript
-        ++ lib.optional stdenv.isDarwin [ Cocoa ]
-        ++ [ self.certifi ];
-
-      nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [
-        pkgs.pkg-config
-      ] ++ lib.optional (lib.versionAtLeast super.matplotlib.version "3.5.0") [
-        self.setuptools-scm
-        self.setuptools-scm-git-archive
-      ];
-
-      MPLSETUPCFG = pkgs.writeText "mplsetup.cfg" ''
-        [libs]
-        system_freetype = True
-        system_qhull = True
-      '' + lib.optionalString stdenv.isDarwin ''
-        # LTO not working in darwin stdenv, see NixOS/nixpkgs/pull/19312
-        enable_lto = false
-      '';
-
-      propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [
-        pkgs.libpng
-        pkgs.freetype
-        pkgs.qhull
-      ]
-        ++ lib.optionals enableGtk3 [ pkgs.cairo self.pycairo pkgs.gtk3 pkgs.gobject-introspection self.pygobject3 ]
-        ++ lib.optionals enableTk [ pkgs.tcl pkgs.tk self.tkinter pkgs.libX11 ]
-        ++ lib.optionals enableQt [ self.pyqt5 ]
-      ;
-
-      preBuild = ''
-        cp -r ${pkgs.qhull} .
-      '';
-
-      inherit (super.matplotlib) patches;
-    }
-  );
-
-  # Calls Cargo at build time for source builds and is really tricky to package
-  maturin = super.maturin.override {
-    preferWheel = true;
-  };
-
-  mccabe = super.mccabe.overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ]) ++ [ self.pytest-runner ];
-      doCheck = false;
-    }
-  );
-
-  mip = super.mip.overridePythonAttrs (
-    old: {
-      nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.autoPatchelfHook ];
-
-      buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.zlib self.cppy ];
-    }
-  );
-
-  mmdet = super.mmdet.overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ]) ++ [ self.pytorch ];
-    }
-  );
-
-  molecule =
-    if lib.versionOlder super.molecule.version "3.0.0" then
-      (super.molecule.overridePythonAttrs (
-        old: {
-          patches = (old.patches or [ ]) ++ [
-            # Fix build with more recent setuptools versions
-            (pkgs.fetchpatch {
-              url = "https://github.com/ansible-community/molecule/commit/c9fee498646a702c77b5aecf6497cff324acd056.patch";
-              sha256 = "1g1n45izdz0a3c9akgxx14zhdw6c3dkb48j8pq64n82fa6ndl1b7";
-              excludes = [ "pyproject.toml" ];
-            })
-          ];
-          buildInputs = (old.buildInputs or [ ]) ++ [ self.setuptools-scm-git-archive ];
-        }
-      )) else
-      super.molecule.overridePythonAttrs (old: {
-        buildInputs = (old.buildInputs or [ ]) ++ [ self.setuptools-scm-git-archive ];
-      });
-
-  mongomock = super.mongomock.overridePythonAttrs (oa: {
-    buildInputs = oa.buildInputs ++ [ self.pbr ];
-  });
-
-  mpi4py = super.mpi4py.overridePythonAttrs (
-    old:
-    let
-      cfg = pkgs.writeTextFile {
-        name = "mpi.cfg";
-        text = (
-          lib.generators.toINI
-            { }
-            {
-              mpi = {
-                mpicc = "${pkgs.mpi.outPath}/bin/mpicc";
-              };
-            }
-        );
-      };
-    in
-    {
-      propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ pkgs.mpi ];
-      enableParallelBuilding = true;
-      preBuild = ''
-        ln -sf ${cfg} mpi.cfg
-      '';
-    }
-  );
-
-  multiaddr = super.multiaddr.overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ]) ++ [ self.pytest-runner ];
-    }
-  );
-
-  munch = super.munch.overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ]) ++ [ self.pbr ];
-    }
-  );
-
-  mypy = super.mypy.overridePythonAttrs (
-    old: {
-      MYPY_USE_MYPYC =
-        # is64bit: unfortunately the build would exhaust all possible memory on i686-linux.
-        stdenv.buildPlatform.is64bit
-        # Derivation fails to build since v0.900 if mypyc is enabled.
-        && lib.strings.versionOlder old.version "0.900";
-    }
-  );
-
-  mysqlclient = super.mysqlclient.overridePythonAttrs (
-    old: {
-      nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.libmysqlclient ];
-      buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.libmysqlclient ];
-    }
-  );
-
-  netcdf4 = super.netcdf4.overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ]) ++ [
-        self.cython
-      ];
-
-      propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [
-        pkgs.zlib
-        pkgs.netcdf
-        pkgs.hdf5
-        pkgs.curl
-        pkgs.libjpeg
-      ];
-
-      # Variables used to configure the build process
-      USE_NCCONFIG = "0";
-      HDF5_DIR = lib.getDev pkgs.hdf5;
-      NETCDF4_DIR = pkgs.netcdf;
-      CURL_DIR = pkgs.curl.dev;
-      JPEG_DIR = pkgs.libjpeg.dev;
-    }
-  );
-
-  numpy = super.numpy.overridePythonAttrs (
-    old:
-    let
-      blas = old.passthru.args.blas or pkgs.openblasCompat;
-      blasImplementation = lib.nameFromURL blas.name "-";
-      cfg = pkgs.writeTextFile {
-        name = "site.cfg";
-        text = (
-          lib.generators.toINI
-            { }
-            {
-              ${blasImplementation} = {
-                include_dirs = "${blas}/include";
-                library_dirs = "${blas}/lib";
-              } // lib.optionalAttrs (blasImplementation == "mkl") {
-                mkl_libs = "mkl_rt";
-                lapack_libs = "";
-              };
-            }
-        );
-      };
-    in
-    {
-      nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.gfortran ];
-      buildInputs = (old.buildInputs or [ ]) ++ [ blas self.cython ];
-      enableParallelBuilding = true;
-      preBuild = ''
-        ln -s ${cfg} site.cfg
-      '';
-      passthru = old.passthru // {
-        blas = blas;
-        inherit blasImplementation cfg;
-      };
-    }
-  );
-
-  opencv-python = super.opencv-python.overridePythonAttrs (
-    old: {
-      nativeBuildInputs = [ pkgs.cmake ] ++ old.nativeBuildInputs;
-      buildInputs = [ self.scikit-build ] ++ (old.buildInputs or [ ]);
-      dontUseCmakeConfigure = true;
-    }
-  );
-
-  opencv-contrib-python = super.opencv-contrib-python.overridePythonAttrs (
-    old: {
-      nativeBuildInputs = [ pkgs.cmake ] ++ old.nativeBuildInputs;
-      buildInputs = [ self.scikit-build ] ++ (old.buildInputs or [ ]);
-      dontUseCmakeConfigure = true;
-    }
-  );
-
-  openexr = super.openexr.overridePythonAttrs (
-    old: rec {
-      buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.openexr pkgs.ilmbase ];
-      NIX_CFLAGS_COMPILE = [ "-I${pkgs.openexr.dev}/include/OpenEXR" "-I${pkgs.ilmbase.dev}/include/OpenEXR" ];
-    }
-  );
-
-  osqp = super.osqp.overridePythonAttrs (
-    old: {
-      nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.cmake ];
-      dontUseCmakeConfigure = true;
-    }
-  );
-
-  pantalaimon = super.pantalaimon.overridePythonAttrs (old: {
-    nativeBuildInputs = old.nativeBuildInputs or [ ] ++ [ pkgs.installShellFiles ];
-    postInstall = old.postInstall or "" + ''
-      installManPage docs/man/*.[1-9]
-    '';
-  });
-
-  paramiko = super.paramiko.overridePythonAttrs (old: {
-    doCheck = false; # requires networking
-  });
-
-  parsel = super.parsel.overridePythonAttrs (
-    old: rec {
-      nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ self.pytest-runner ];
-    }
-  );
-
-  pdal = super.pdal.overridePythonAttrs (
-    old: {
-      PDAL_CONFIG = "${pkgs.pdal}/bin/pdal-config";
-    }
-  );
-
-  peewee = super.peewee.overridePythonAttrs (
-    old:
-    let
-      withPostgres = old.passthru.withPostgres or false;
-      withMysql = old.passthru.withMysql or false;
-    in
-    {
-      buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.sqlite ];
-      propagatedBuildInputs = (old.propagatedBuildInputs or [ ])
-        ++ lib.optional withPostgres self.psycopg2
-        ++ lib.optional withMysql self.mysql-connector;
-    }
-  );
-
-  pillow = super.pillow.overridePythonAttrs (
-    old: {
-      nativeBuildInputs = [ pkgs.pkg-config self.pytest-runner ] ++ (old.nativeBuildInputs or [ ]);
-      buildInputs = with pkgs; [ freetype libjpeg zlib libtiff libwebp tcl lcms2 ] ++ (old.buildInputs or [ ]);
-    }
-  );
-
-  platformdirs = super.platformdirs.overridePythonAttrs (old: {
-    postPatch = ''
-      substituteInPlace setup.py --replace 'setup()' 'setup(version="${old.version}")'
-    '';
-  });
-
-  poetry-core = super.poetry-core.overridePythonAttrs (old: {
-    # "Vendor" dependencies (for build-system support)
-    postPatch = ''
-      echo "import sys" >> poetry/__init__.py
-      for path in $propagatedBuildInputs; do
-          echo "sys.path.insert(0, \"$path\")" >> poetry/__init__.py
-      done
-    '';
-
-    # Propagating dependencies leads to issues downstream
-    # We've already patched poetry to prefer "vendored" dependencies
-    postFixup = ''
-      rm $out/nix-support/propagated-build-inputs
-    '';
-  });
-
-  portend = super.portend.overridePythonAttrs (
-    old: {
-      # required for the extra "toml" dependency in setuptools_scm[toml]
-      buildInputs = (old.buildInputs or [ ]) ++ [
-        self.toml
-      ];
-      # disable the removal of pyproject.toml, required because of setuptools_scm
-      dontPreferSetupPy = true;
-    }
-  );
-
-  prettytable = super.prettytable.overridePythonAttrs (old: {
-    propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ self.setuptools ];
-  });
-
-  psycopg2 = super.psycopg2.overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ])
-        ++ lib.optional stdenv.isDarwin pkgs.openssl;
-      nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.postgresql ];
-    }
-  );
-
-  psycopg2-binary = super.psycopg2-binary.overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ])
-        ++ lib.optional stdenv.isDarwin pkgs.openssl;
-      nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.postgresql ];
-    }
-  );
-
-  pyarrow =
-    if lib.versionAtLeast super.pyarrow.version "0.16.0" then
-      super.pyarrow.overridePythonAttrs
-        (
-          old:
-          let
-            parseMinor = drv: lib.concatStringsSep "." (lib.take 2 (lib.splitVersion drv.version));
-
-            # Starting with nixpkgs revision f149c7030a7, pyarrow takes "python3" as an argument
-            # instead of "python". Below we inspect function arguments to maintain compatibilitiy.
-            _arrow-cpp = pkgs.arrow-cpp.override (
-              builtins.intersectAttrs
-                (lib.functionArgs pkgs.arrow-cpp.override)
-                { python = self.python; python3 = self.python; }
-            );
-
-            ARROW_HOME = _arrow-cpp;
-            arrowCppVersion = parseMinor _arrow-cpp;
-            pyArrowVersion = parseMinor super.pyarrow;
-            errorMessage = "arrow-cpp version (${arrowCppVersion}) mismatches pyarrow version (${pyArrowVersion})";
-          in
-          if arrowCppVersion != pyArrowVersion then throw errorMessage else {
-
-            nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [
-              self.cython
-              pkgs.pkg-config
-              pkgs.cmake
-            ];
-
-            preBuild = ''
-              export PYARROW_PARALLEL=$NIX_BUILD_CORES
-            '';
-
-            PARQUET_HOME = _arrow-cpp;
-            inherit ARROW_HOME;
-
-            PYARROW_BUILD_TYPE = "release";
-            PYARROW_WITH_FLIGHT = if _arrow-cpp.enableFlight then 1 else 0;
-            PYARROW_WITH_DATASET = 1;
-            PYARROW_WITH_PARQUET = 1;
-            PYARROW_CMAKE_OPTIONS = [
-              "-DCMAKE_INSTALL_RPATH=${ARROW_HOME}/lib"
-
-              # This doesn't use setup hook to call cmake so we need to workaround #54606
-              # ourselves
-              "-DCMAKE_POLICY_DEFAULT_CMP0025=NEW"
-            ];
-
-            dontUseCmakeConfigure = true;
-          }
-        ) else
-      super.pyarrow.overridePythonAttrs (
-        old: {
-          nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [
-            self.cython
-          ];
-        }
-      );
-
-  pycairo = (
-    drv: (
-      drv.overridePythonAttrs (
-        _: {
-          format = "other";
-        }
-      )
-    ).overridePythonAttrs (
-      old: {
-
-        nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [
-          pkgs.meson
-          pkgs.ninja
-          pkgs.pkg-config
-        ];
-
-        propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [
-          pkgs.cairo
-          pkgs.xlibsWrapper
-        ];
-
-        mesonFlags = [ "-Dpython=${if self.isPy3k then "python3" else "python"}" ];
-      }
-    )
-  )
-    super.pycairo;
-
-  pycocotools = super.pycocotools.overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ]) ++ [
-        self.cython
-        self.numpy
-      ];
-    }
-  );
-
-  pyfuse3 = super.pyfuse3.overridePythonAttrs (old: {
-    nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.pkg-config ];
-    buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.fuse3 ];
-  });
-
-  pygame = super.pygame.overridePythonAttrs (
-    old: rec {
-      nativeBuildInputs = [
-        pkgs.pkg-config
-        pkgs.SDL
-      ];
-
-      buildInputs = [
-        pkgs.SDL
-        pkgs.SDL_image
-        pkgs.SDL_mixer
-        pkgs.SDL_ttf
-        pkgs.libpng
-        pkgs.libjpeg
-        pkgs.portmidi
-        pkgs.xorg.libX11
-        pkgs.freetype
-      ];
-
-      # Tests fail because of no audio device and display.
-      doCheck = false;
-      preConfigure = ''
-                sed \
-                  -e "s/origincdirs = .*/origincdirs = []/" \
-                  -e "s/origlibdirs = .*/origlibdirs = []/" \
-                  -e "/'\/lib\/i386-linux-gnu', '\/lib\/x86_64-linux-gnu']/d" \
-                  -e "/\/include\/smpeg/d" \
-                  -i buildconfig/config_unix.py
-                ${lib.concatMapStrings
-        (dep: ''
-                  sed \
-                    -e "/origincdirs =/a\        origincdirs += ['${lib.getDev dep}/include']" \
-                    -e "/origlibdirs =/a\        origlibdirs += ['${lib.getLib dep}/lib']" \
-                    -i buildconfig/config_unix.py
-                '')
-        buildInputs
-                }
-                LOCALBASE=/ ${self.python.interpreter} buildconfig/config.py
-      '';
-    }
-  );
-
-  pygeos = super.pygeos.overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.geos ];
-      nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.geos ];
-    }
-  );
-
-  pygobject = super.pygobject.overridePythonAttrs (
-    old: {
-      nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.pkg-config ];
-      buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.glib pkgs.gobject-introspection ];
-    }
-  );
-
-  pylint = super.pylint.overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ]) ++ [ self.pytest-runner ];
-    }
-  );
-
-  pyopenssl = super.pyopenssl.overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.openssl ];
-    }
-  );
-
-  pyproj = super.pyproj.overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ]) ++
-        [ self.cython ];
-      PROJ_DIR = "${pkgs.proj}";
-      PROJ_LIBDIR = "${pkgs.proj}/lib";
-      PROJ_INCDIR = "${pkgs.proj.dev}/include";
-    }
-  );
-
-  pyproject-flake8 = super.pyproject-flake8.overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ]) ++ [ self.flit-core ];
-    }
-  );
-
-  pytaglib = super.pytaglib.overridePythonAttrs (old: {
-    buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.taglib ];
-  });
-
-  pytezos = super.pytezos.overridePythonAttrs (old: {
-    buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.libsodium ];
-  });
-
-  python-bugzilla = super.python-bugzilla.overridePythonAttrs (
-    old: {
-      nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [
-        self.docutils
-      ];
-    }
-  );
-
-  python-ldap = super.python-ldap.overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.openldap pkgs.cyrus_sasl ];
-    }
-  );
-
-  pytoml = super.pytoml.overridePythonAttrs (
-    old: {
-      doCheck = false;
-    }
-  );
-
-  pyqt5 =
-    let
-      drv = super.pyqt5;
-      withConnectivity = drv.passthru.args.withConnectivity or false;
-      withMultimedia = drv.passthru.args.withMultimedia or false;
-      withWebKit = drv.passthru.args.withWebKit or false;
-      withWebSockets = drv.passthru.args.withWebSockets or false;
-    in
-    super.pyqt5.overridePythonAttrs (
-      old: {
-        format = "other";
-
-        dontWrapQtApps = true;
-
-        nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [
-          pkgs.pkg-config
-          pkgs.qt5.qmake
-          pkgs.xorg.lndir
-          pkgs.qt5.qtbase
-          pkgs.qt5.qtsvg
-          pkgs.qt5.qtdeclarative
-          pkgs.qt5.qtwebchannel
-          pkgs.qt5.qt3d
-          # self.pyqt5-sip
-          self.sip
-        ]
-          ++ lib.optional withConnectivity pkgs.qt5.qtconnectivity
-          ++ lib.optional withMultimedia pkgs.qt5.qtmultimedia
-          ++ lib.optional withWebKit pkgs.qt5.qtwebkit
-          ++ lib.optional withWebSockets pkgs.qt5.qtwebsockets
-        ;
-
-        buildInputs = (old.buildInputs or [ ]) ++ [
-          pkgs.dbus
-          pkgs.qt5.qtbase
-          pkgs.qt5.qtsvg
-          pkgs.qt5.qtdeclarative
-          self.sip
-        ]
-          ++ lib.optional withConnectivity pkgs.qt5.qtconnectivity
-          ++ lib.optional withWebKit pkgs.qt5.qtwebkit
-          ++ lib.optional withWebSockets pkgs.qt5.qtwebsockets
-        ;
-
-        # Fix dbus mainloop
-        patches = pkgs.python3.pkgs.pyqt5.patches or [ ];
-
-        configurePhase = ''
-          runHook preConfigure
-
-          export PYTHONPATH=$PYTHONPATH:$out/${self.python.sitePackages}
-
-          mkdir -p $out/${self.python.sitePackages}/dbus/mainloop
-          ${self.python.executable} configure.py  -w \
-            --confirm-license \
-            --no-qml-plugin \
-            --bindir=$out/bin \
-            --destdir=$out/${self.python.sitePackages} \
-            --stubsdir=$out/${self.python.sitePackages}/PyQt5 \
-            --sipdir=$out/share/sip/PyQt5 \
-            --designer-plugindir=$out/plugins/designer
-
-          runHook postConfigure
-        '';
-
-        postInstall = ''
-          ln -s ${self.pyqt5-sip}/${self.python.sitePackages}/PyQt5/sip.* $out/${self.python.sitePackages}/PyQt5/
-          for i in $out/bin/*; do
-            wrapProgram $i --prefix PYTHONPATH : "$PYTHONPATH"
-          done
-
-          # Let's make it a namespace package
-          cat << EOF > $out/${self.python.sitePackages}/PyQt5/__init__.py
-          from pkgutil import extend_path
-          __path__ = extend_path(__path__, __name__)
-          EOF
-        '';
-
-        installCheckPhase =
-          let
-            modules = [
-              "PyQt5"
-              "PyQt5.QtCore"
-              "PyQt5.QtQml"
-              "PyQt5.QtWidgets"
-              "PyQt5.QtGui"
-            ]
-            ++ lib.optional withWebSockets "PyQt5.QtWebSockets"
-            ++ lib.optional withWebKit "PyQt5.QtWebKit"
-            ++ lib.optional withMultimedia "PyQt5.QtMultimedia"
-            ++ lib.optional withConnectivity "PyQt5.QtConnectivity"
-            ;
-            imports = lib.concatMapStrings (module: "import ${module};") modules;
-          in
-          ''
-            echo "Checking whether modules can be imported..."
-            ${self.python.interpreter} -c "${imports}"
-          '';
-
-        doCheck = true;
-
-        enableParallelBuilding = true;
-      }
-    );
-
-  pytest-datadir = super.pytest-datadir.overridePythonAttrs (
-    old: {
-      postInstall = ''
-        rm -f $out/LICENSE
-      '';
-    }
-  );
-
-  pytest = super.pytest.overridePythonAttrs (
-    old: {
-      # Fixes https://github.com/pytest-dev/pytest/issues/7891
-      postPatch = old.postPatch or "" + ''
-        sed -i '/\[metadata\]/aversion = ${old.version}' setup.cfg
-      '';
-    }
-  );
-
-  pytest-django = super.pytest-django.overridePythonAttrs (
-    old: {
-      postPatch = ''
-        substituteInPlace setup.py --replace "'pytest>=3.6'," ""
-        substituteInPlace setup.py --replace "'pytest>=3.6'" ""
-      '';
-    }
-  );
-
-  pytest-randomly = super.pytest-randomly.overrideAttrs (old: {
-    propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [
-      self.importlib-metadata
-    ];
-  });
-
-  pytest-runner = super.pytest-runner or super.pytestrunner;
-
-  pytest-pylint = super.pytest-pylint.overridePythonAttrs (
-    old: {
-      buildInputs = [ self.pytest-runner ];
-    }
-  );
-
-  # pytest-splinter seems to put a .marker file in an empty directory
-  # presumably so it's tracked by and can be installed with MANIFEST.in, see
-  # https://github.com/pytest-dev/pytest-splinter/commit/a48eeef662f66ff9d3772af618748e73211a186b
-  #
-  # This directory then gets used as an empty initial profile directory and is
-  # zipped up. But if the .marker file is in the Nix store, it has the
-  # creation date of 1970, and Zip doesn't work with such old files, so it
-  # fails at runtime!
-  #
-  # We fix this here by just removing the file after the installation
-  #
-  # The error you get without this is:
-  #
-  # E           ValueError: ZIP does not support timestamps before 1980
-  # /nix/store/55b9ip7xkpimaccw9pa0vacy5q94f5xa-python3-3.7.6/lib/python3.7/zipfile.py:357: ValueError
-  pytest-splinter = super.pytest-splinter.overrideAttrs (old: {
-    postInstall = old.postInstall or "" + ''
-      rm $out/${super.python.sitePackages}/pytest_splinter/profiles/firefox/.marker
-    '';
-  });
-
-  python-jose = super.python-jose.overridePythonAttrs (
-    old: {
-      buildInputs = [ self.pytest-runner ];
-    }
-  );
-
-  python-olm = super.python-olm.overridePythonAttrs (
-    old: {
-      buildInputs = old.buildInputs or [ ] ++ [ pkgs.olm ];
-    }
-  );
-
-  python-snappy = super.python-snappy.overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.snappy ];
-    }
-  );
-
-  pythran = super.pythran.overridePythonAttrs (old: {
-    buildInputs = (old.buildInputs or [ ]) ++ [ self.pytest-runner ];
-  });
-
-  ffmpeg-python = super.ffmpeg-python.overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ]) ++ [ self.pytest-runner ];
-    }
-  );
-
-  python-prctl = super.python-prctl.overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ]) ++ [
-        pkgs.libcap
-      ];
-    }
-  );
-
-  pyudev = super.pyudev.overridePythonAttrs (old: {
-    postPatch = ''
-      substituteInPlace src/pyudev/_ctypeslib/utils.py \
-        --replace "find_library(name)" "'${pkgs.lib.getLib pkgs.systemd}/lib/libudev.so'"
-    '';
-  });
-
-  pyusb = super.pyusb.overridePythonAttrs (
-    old: {
-      postPatch = ''
-        libusb=${pkgs.libusb1.out}/lib/libusb-1.0${pkgs.stdenv.hostPlatform.extensions.sharedLibrary}
-        test -f $libusb || { echo "ERROR: $libusb doesn't exist, please update/fix this build expression."; exit 1; }
-        sed -i -e "s|find_library=None|find_library=lambda _:\"$libusb\"|" usb/backend/libusb1.py
-      '';
-    }
-  );
-
-  pywavelets = super.pywavelets.overridePythonAttrs (
-    old: {
-      HDF5_DIR = "${pkgs.hdf5}";
-      propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ pkgs.hdf5 ];
-    }
-  );
-
-  pyzmq = super.pyzmq.overridePythonAttrs (
-    old: {
-      nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.pkg-config ];
-      propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ pkgs.zeromq ];
-    }
-  );
-
-  rockset = super.rockset.overridePythonAttrs (
-    old: rec {
-      postPatch = ''
-        cp ./setup_rockset.py ./setup.py
-      '';
-    }
-  );
-
-  scaleapi = super.scaleapi.overridePythonAttrs (
-    old: {
-      postPatch = ''
-        substituteInPlace setup.py --replace "install_requires = ['requests>=2.4.2', 'enum34']" "install_requires = ['requests>=2.4.2']" || true
-      '';
-    }
-  );
-
-  pandas = super.pandas.overridePythonAttrs (
-    old: {
-      nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ self.cython ];
-    }
-  );
-
-  panel = super.panel.overridePythonAttrs (
-    old: {
-      nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.nodejs ];
-    }
-  );
-
-  # Pybind11 is an undeclared dependency of scipy that we need to pick from nixpkgs
-  # Make it not fail with infinite recursion
-  pybind11 = super.pybind11.overridePythonAttrs (
-    old: {
-      cmakeFlags = (old.cmakeFlags or [ ]) ++ [
-        "-DPYBIND11_TEST=off"
-      ];
-      doCheck = false; # Circular test dependency
-    }
-  );
-
-  requests-mock = super.requests-mock.overridePythonAttrs (
-    old: {
-      propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ super.pbr ];
-    }
-  );
-
-  requests-unixsocket = super.requests-unixsocket.overridePythonAttrs (
-    old: {
-      nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ self.pbr ];
-    }
-  );
-
-  requestsexceptions = super.requestsexceptions.overridePythonAttrs (old: {
-    nativeBuildInputs = old.nativeBuildInputs ++ [ self.pbr ];
-  });
-
-  rlp = super.rlp.overridePythonAttrs {
-    preConfigure = ''
-      substituteInPlace setup.py --replace \'setuptools-markdown\' ""
-    '';
-  };
-
-
-  rmfuse = super.rmfuse.overridePythonAttrs (old: {
-    propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ self.setuptools ];
-  });
-
-  rtree = super.rtree.overridePythonAttrs (old: {
-    propagatedNativeBuildInputs = (old.propagatedNativeBuildInputs or [ ]) ++ [ pkgs.libspatialindex ];
-    postPatch = ''
-      substituteInPlace rtree/finder.py --replace \
-        "find_library('spatialindex_c')" \
-        "'${pkgs.libspatialindex}/lib/libspatialindex_c${pkgs.stdenv.hostPlatform.extensions.sharedLibrary}'"
-    '';
-  });
-
-  ruamel-yaml = super.ruamel-yaml.overridePythonAttrs (
-    old: {
-      propagatedBuildInputs = (old.propagatedBuildInputs or [ ])
-        ++ [ self.ruamel-yaml-clib ];
-    }
-  );
-
-  scipy = super.scipy.overridePythonAttrs (
-    old:
-    if old.format != "wheel" then {
-      nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++
-        [ pkgs.gfortran ] ++
-        lib.optional (lib.versionAtLeast super.scipy.version "1.7.0") [ self.cython self.pythran ];
-      propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ self.pybind11 ];
-      setupPyBuildFlags = [ "--fcompiler='gnu95'" ];
-      enableParallelBuilding = true;
-      buildInputs = (old.buildInputs or [ ]) ++ [ self.numpy.blas ];
-      preConfigure = ''
-        sed -i '0,/from numpy.distutils.core/s//import setuptools;from numpy.distutils.core/' setup.py
-        export NPY_NUM_BUILD_JOBS=$NIX_BUILD_CORES
-      '';
-      preBuild = ''
-        ln -s ${self.numpy.cfg} site.cfg
-      '';
-    } else old
-  );
-
-  scikit-image = super.scikit-image.overridePythonAttrs (
-    old: {
-      nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [
-        self.cython
-        self.pythran
-        self.packaging
-        self.wheel
-        self.numpy
-      ];
-    }
-  );
-
-  scikit-learn = super.scikit-learn.overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ]) ++ [
-        pkgs.gfortran
-        pkgs.glibcLocales
-      ] ++ lib.optionals stdenv.cc.isClang [
-        pkgs.llvmPackages.openmp
-      ];
-
-      nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [
-        self.cython
-      ];
-
-      enableParallelBuilding = true;
-    }
-  );
-
-  secp256k1 = super.secp256k1.overridePythonAttrs (old: {
-    nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.pkgconfig pkgs.autoconf pkgs.automake pkgs.libtool ];
-    buildInputs = (old.buildInputs or [ ]) ++ [ self.pytest-runner ];
-    doCheck = false;
-    # Local setuptools versions like "x.y.post0" confuse an internal check
-    postPatch = ''
-      substituteInPlace setup.py \
-        --replace 'setuptools_version.' '"${self.setuptools.version}".'
-    '';
-  });
-
-  shapely = super.shapely.overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.geos self.cython ];
-      inherit (pkgs.python3.pkgs.shapely) patches GEOS_LIBRARY_PATH;
-    }
-  );
-
-  shellcheck-py = super.shellcheck-py.overridePythonAttrs (old: {
-
-    # Make fetching/installing external binaries no-ops
-    preConfigure =
-      let
-        fakeCommand = "type('FakeCommand', (Command,), {'initialize_options': lambda self: None, 'finalize_options': lambda self: None, 'run': lambda self: None})";
-      in
-      ''
-        substituteInPlace setup.py \
-          --replace "'fetch_binaries': fetch_binaries," "'fetch_binaries': ${fakeCommand}," \
-          --replace "'install_shellcheck': install_shellcheck," "'install_shellcheck': ${fakeCommand},"
-      '';
-
-    propagatedUserEnvPkgs = (old.propagatedUserEnvPkgs or [ ]) ++ [
-      pkgs.shellcheck
-    ];
-
-  });
-
-  tables = super.tables.overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ]) ++ [ self.pywavelets ];
-      HDF5_DIR = lib.getDev pkgs.hdf5;
-      nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.pkg-config ];
-      propagatedBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.hdf5 self.numpy self.numexpr ];
-    }
-  );
-
-  tempora = super.tempora.overridePythonAttrs (
-    old: {
-      # required for the extra "toml" dependency in setuptools_scm[toml]
-      buildInputs = (old.buildInputs or [ ]) ++ [
-        self.toml
-      ];
-      # disable the removal of pyproject.toml, required because of setuptools_scm
-      dontPreferSetupPy = true;
-    }
-  );
-
-  tensorboard = super.tensorboard.overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ]) ++ [
-        self.wheel
-        self.absl-py
-      ];
-      HDF5_DIR = "${pkgs.hdf5}";
-      propagatedBuildInputs = (old.nativeBuildInputs or [ ]) ++ [
-        pkgs.hdf5
-        self.google-auth-oauthlib
-        self.tensorboard-plugin-wit
-        self.numpy
-        self.markdown
-        self.tensorboard-data-server
-        self.grpcio
-        self.protobuf
-        self.werkzeug
-        self.absl-py
-      ];
-    }
-  );
-
-  tensorflow = super.tensorflow.overridePythonAttrs (
-    old: {
-      postInstall = ''
-        rm $out/bin/tensorboard
-      '';
-    }
-  );
-
-  tensorpack = super.tensorpack.overridePythonAttrs (
-    old: {
-      postPatch = ''
-        substituteInPlace setup.cfg --replace "# will call find_packages()" ""
-      '';
-    }
-  );
-
-  tinycss2 = super.tinycss2.overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ]) ++ [ self.pytest-runner ];
-    }
-  );
-
-  # The tokenizers build requires a complex rust setup (cf. nixpkgs override)
-  #
-  # Instead of providing a full source build, we use a wheel to keep
-  # the complexity manageable for now.
-  tokenizers = super.tokenizers.override {
-    preferWheel = true;
-  };
-
-  torch = lib.makeOverridable
-    ({ enableCuda ? false
-     , cudatoolkit ? pkgs.cudatoolkit_10_1
-     , pkg ? super.torch
-     }: pkg.overrideAttrs (old:
-      {
-        preConfigure =
-          if (!enableCuda) then ''
-            export USE_CUDA=0
-          '' else ''
-            export LD_LIBRARY_PATH="$LD_LIBRARY_PATH:${cudatoolkit}/targets/x86_64-linux/lib"
-          '';
-        preFixup = lib.optionalString (!enableCuda) ''
-          # For some reason pytorch retains a reference to libcuda even if it
-          # is explicitly disabled with USE_CUDA=0.
-          find $out -name "*.so" -exec ${pkgs.patchelf}/bin/patchelf --remove-needed libcuda.so.1 {} \;
-        '';
-        buildInputs =
-          (old.buildInputs or [ ])
-          ++ [ self.typing-extensions ]
-          ++ lib.optionals enableCuda [
-            pkgs.linuxPackages.nvidia_x11
-            pkgs.nccl.dev
-            pkgs.nccl.out
-          ];
-        propagatedBuildInputs = [
-          self.numpy
-          self.future
-          self.typing-extensions
-        ];
-      })
-    )
-    { };
-
-  torchvision = lib.makeOverridable
-    ({ enableCuda ? false
-     , cudatoolkit ? pkgs.cudatoolkit_10_1
-     , pkg ? super.torchvision
-     }: pkg.overrideAttrs (old: {
-
-      # without that autoPatchelfHook will fail because cudatoolkit is not in LD_LIBRARY_PATH
-      autoPatchelfIgnoreMissingDeps = true;
-      buildInputs = (old.buildInputs or [ ])
-        ++ [ self.torch ]
-        ++ lib.optionals enableCuda [
-        cudatoolkit
-      ];
-      preConfigure =
-        if (enableCuda) then ''
-          export LD_LIBRARY_PATH="$LD_LIBRARY_PATH:${self.torch}/${self.python.sitePackages}/torch/lib:${lib.makeLibraryPath [ cudatoolkit "${cudatoolkit}" ]}"
-        '' else ''
-          export LD_LIBRARY_PATH="$LD_LIBRARY_PATH:${self.torch}/${self.python.sitePackages}/torch/lib"
-        '';
-    }))
-    { };
-
-  typeguard = super.typeguard.overridePythonAttrs (old: {
-    postPatch = ''
-      substituteInPlace setup.py \
-        --replace 'setup()' 'setup(version="${old.version}")'
-    '';
-  });
-
-  typed_ast = super.typed-ast.overridePythonAttrs (old: {
-    nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [
-      self.pytest-runner
-    ];
-  });
-
-  # nix uses a dash, poetry uses an underscore
-  typing-extensions = (super.typing_extensions or super.typing-extensions).overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ]) ++
-        lib.optional (lib.versionAtLeast old.version "4.0.0") [ self.flit-core ];
-    }
-  );
-
-  urwidtrees = super.urwidtrees.overridePythonAttrs (
-    old: {
-      propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [
-        self.urwid
-      ];
-    }
-  );
-
-  vose-alias-method = super.vose-alias-method.overridePythonAttrs (
-    old: {
-      postInstall = ''
-        rm -f $out/LICENSE
-      '';
-    }
-  );
-
-  vispy = super.vispy.overrideAttrs (
-    old: {
-      inherit (pkgs.python3.pkgs.vispy) patches;
-      nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [
-        self.cython
-        self.setuptools-scm-git-archive
-      ];
-    }
-  );
-
-  uvloop = super.uvloop.overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ]) ++ lib.optionals stdenv.isDarwin [
-        pkgs.darwin.apple_sdk.frameworks.ApplicationServices
-        pkgs.darwin.apple_sdk.frameworks.CoreServices
-      ];
-    }
-  );
-
-
-  # Stop infinite recursion by using bootstrapped pkg from nixpkgs
-  bootstrapped-pip = super.bootstrapped-pip.override {
-    wheel = (pkgs.python3.pkgs.override {
-      python = self.python;
-    }).wheel;
-  };
-
-  weasyprint = super.weasyprint.overridePythonAttrs (
-    old: {
-      inherit (pkgs.python3.pkgs.weasyprint) patches;
-      nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ self.pytest-runner ];
-      buildInputs = (old.buildInputs or [ ]) ++ [ self.pytest-runner ];
-    }
-  );
-
-  web3 = super.web3.overridePythonAttrs {
-    preConfigure = ''
-      substituteInPlace setup.py --replace \'setuptools-markdown\' ""
-    '';
-  };
-
-  weblate-language-data = super.weblate-language-data.overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ]) ++ [
-        self.translate-toolkit
-      ];
-    }
-  );
-
-  wheel =
-    let
-      isWheel = super.wheel.src.isWheel or false;
-      # If "wheel" is a pre-built binary wheel
-      wheelPackage = super.buildPythonPackage {
-        inherit (super.wheel) pname name version src;
-        inherit (pkgs.python3.pkgs.wheel) meta;
-        format = "wheel";
-      };
-      # If "wheel" is built from source
-      sourcePackage = ((
-        pkgs.python3.pkgs.override {
-          python = self.python;
-        }
-      ).wheel.override {
-        inherit (self) buildPythonPackage bootstrapped-pip setuptools;
-      }).overrideAttrs (old: {
-        inherit (super.wheel) pname name version src;
-      });
-    in
-    if isWheel then wheelPackage else sourcePackage;
-
-  zipp = if super.zipp == null then null else
-  (
-    if lib.versionAtLeast super.zipp.version "2.0.0" then
-      (
-        super.zipp.overridePythonAttrs (
-          old:
-          if (old.format or "pyproject") != "wheel" then {
-            prePatch = ''
-              substituteInPlace setup.py --replace \
-              'setuptools.setup()' \
-              'setuptools.setup(version="${super.zipp.version}")'
-            '';
-          } else old
-        )
-      ) else super.zipp
-  ).overridePythonAttrs (
-    old: {
-      propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [
-        self.toml
-      ];
-    }
-  );
-
-  credis = super.credis.overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ]) ++ [ self.cython ];
-    }
-  );
-
-  hashids = super.hashids.overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ]) ++ [ self.flit-core ];
-    }
-  );
-
-  packaging = super.packaging.overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ]) ++
-        # From 20.5 until 20.7, packaging used flit for packaging (heh)
-        # See https://github.com/pypa/packaging/pull/352 and https://github.com/pypa/packaging/pull/367
-        lib.optional (lib.versionAtLeast old.version "20.5" && lib.versionOlder old.version "20.8") [ self.flit-core ];
-    }
-  );
-
-  psutil = super.psutil.overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ]) ++
-        lib.optional stdenv.isDarwin pkgs.darwin.apple_sdk.frameworks.IOKit;
-    }
-  );
-
-  sentencepiece = super.sentencepiece.overridePythonAttrs (
-    old: {
-      dontUseCmakeConfigure = true;
-      nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [
-        pkgs.pkg-config
-        pkgs.cmake
-        pkgs.gperftools
-      ];
-      buildInputs = (old.buildInputs or [ ]) ++ [
-        pkgs.sentencepiece
-      ];
-    }
-  );
-
-  sentence-transformers = super.sentence-transformers.overridePythonAttrs (
-    old: {
-      buildInputs =
-        (old.buildInputs or [ ])
-        ++ [ self.typing-extensions ];
-    }
-  );
-
-  supervisor = super.supervisor.overridePythonAttrs (
-    old: {
-      propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [
-        self.meld3
-        self.setuptools
-      ];
-    }
-  );
-
-  cytoolz = super.cytoolz.overridePythonAttrs (
-    old: {
-      propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ self.toolz ];
-    }
-  );
-
-  # For some reason the toml dependency of tqdm declared here:
-  # https://github.com/tqdm/tqdm/blob/67130a23646ae672836b971e1086b6ae4c77d930/pyproject.toml#L2
-  # is not translated correctly to a nix dependency.
-  tqdm = super.tqdm.overrideAttrs (
-    old: {
-      buildInputs = [ super.toml ] ++ (old.buildInputs or [ ]);
-    }
-  );
-
-  watchdog = super.watchdog.overrideAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ])
-        ++ pkgs.lib.optional pkgs.stdenv.isDarwin pkgs.darwin.apple_sdk.frameworks.CoreServices;
-    }
-  );
-
-  # pyee cannot find `vcversioner` and other "setup requirements", so it tries to
-  # download them from the internet, which only works when nix sandboxing is disabled.
-  # Additionally, since pyee uses vcversioner to specify its version, we need to do this
-  # manually specify its version.
-  pyee = super.pyee.overrideAttrs (
-    old: {
-      postPatch = old.postPatch or "" + ''
-        sed -i setup.py \
-          -e '/setup_requires/,/],/d' \
-          -e 's/vcversioner={},/version="${old.version}",/'
-      '';
-    }
-  );
-
-  # nixpkgs has setuptools_scm 4.1.2
-  # but newrelic has a seemingly unnecessary version constraint for <4
-  # So we patch that out
-  newrelic = super.newrelic.overridePythonAttrs (
-    old: {
-      postPatch = old.postPatch or "" + ''
-        substituteInPlace setup.py --replace '"setuptools_scm>=3.2,<4"' '"setuptools_scm"'
-      '';
-    }
-  );
-
-  wxpython = super.wxpython.overridePythonAttrs (old:
-    let
-      localPython = self.python.withPackages (ps: with ps; [
-        setuptools
-        numpy
-        six
-      ]);
-    in
-    {
-      DOXYGEN = "${pkgs.doxygen}/bin/doxygen";
-
-      nativeBuildInputs = with pkgs; [
-        which
-        doxygen
-        gtk3
-        pkg-config
-        autoPatchelfHook
-      ] ++ (old.nativeBuildInputs or [ ]);
-
-      buildInputs = with pkgs; [
-        gtk3
-        webkitgtk
-        ncurses
-        SDL2
-        xorg.libXinerama
-        xorg.libSM
-        xorg.libXxf86vm
-        xorg.libXtst
-        xorg.xorgproto
-        gst_all_1.gstreamer
-        gst_all_1.gst-plugins-base
-        libGLU
-        libGL
-        libglvnd
-        mesa
-      ] ++ old.buildInputs;
-
-      buildPhase = ''
-        ${localPython.interpreter} build.py -v build_wx
-        ${localPython.interpreter} build.py -v dox etg --nodoc sip
-        ${localPython.interpreter} build.py -v build_py
-      '';
-
-      installPhase = ''
-        ${localPython.interpreter} setup.py install --skip-build --prefix=$out
-      '';
-    });
-
-  marisa-trie = super.marisa-trie.overridePythonAttrs (
-    old: {
-      buildInputs = (old.buildInputs or [ ]) ++ [ self.pytest-runner ];
-    }
-  );
-
-  ua-parser = super.ua-parser.overridePythonAttrs (
-    old: {
-      propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ self.pyyaml ];
-    }
-  );
-
-  lazy-object-proxy = super.lazy-object-proxy.overridePythonAttrs (
-    old: {
-      # disable the removal of pyproject.toml, required because of setuptools_scm
-      dontPreferSetupPy = true;
-    }
-  );
-
-  pendulum = super.pendulum.overridePythonAttrs (old: {
-    # Technically incorrect, but fixes the build error..
-    preInstall = lib.optionalString stdenv.isLinux ''
-      mv --no-clobber ./dist/*.whl $(echo ./dist/*.whl | sed s/'manylinux_[0-9]*_[0-9]*'/'manylinux1'/)
-    '';
-  });
-
-  pygraphviz = super.pygraphviz.overridePythonAttrs (old: {
-    nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.pkg-config ];
-    buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.graphviz ];
-  });
-
-  pyjsg = super.pyjsg.overridePythonAttrs (old: {
-    buildInputs = (old.buildInputs or [ ]) ++ [ self.pbr ];
-  });
-
-  pyshex = super.pyshex.overridePythonAttrs (old: {
-    buildInputs = (old.buildInputs or [ ]) ++ [ self.pbr ];
-  });
-
-  pyshexc = super.pyshexc.overridePythonAttrs (old: {
-    buildInputs = (old.buildInputs or [ ]) ++ [ self.pbr ];
-  });
-
-  pysqlite = super.pysqlite.overridePythonAttrs (old: {
-    buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.sqlite ];
-  });
-
-  selinux = super.selinux.overridePythonAttrs (old: {
-    buildInputs = (old.buildInputs or [ ]) ++ [ self.setuptools-scm-git-archive ];
-  });
-
-  shexjsg = super.shexjsg.overridePythonAttrs (old: {
-    buildInputs = (old.buildInputs or [ ]) ++ [ self.pbr ];
-  });
-
-  sparqlslurper = super.sparqlslurper.overridePythonAttrs (old: {
-    buildInputs = (old.buildInputs or [ ]) ++ [ self.pbr ];
-  });
-
-  tomli = super.tomli.overridePythonAttrs (old: {
-    nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ self.flit-core ];
-  });
-
-  uwsgi = super.uwsgi.overridePythonAttrs (old: {
-    buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.ncurses ];
-    sourceRoot = ".";
-  });
-
-  wcwidth = super.wcwidth.overridePythonAttrs (old: {
-    propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++
-      lib.optional self.isPy27 (self.backports-functools-lru-cache or self.backports_functools_lru_cache)
-    ;
-  });
-
-  wtforms = super.wtforms.overridePythonAttrs (old: {
-    buildInputs = (old.buildInputs or [ ]) ++ [ self.Babel ];
-  });
-}
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/overrides/build-systems.json b/pkgs/development/tools/poetry2nix/poetry2nix/overrides/build-systems.json
new file mode 100644
index 0000000000000..e3c74473b8cce
--- /dev/null
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/overrides/build-systems.json
@@ -0,0 +1,1557 @@
+{
+  "HTSeq": [
+    "cython"
+  ],
+  "PyStemmer": [
+    "cython"
+  ],
+  "adguardhome": [
+    "poetry-core"
+  ],
+  "aesara": [
+    "cython"
+  ],
+  "aioambient": [
+    "poetry-core"
+  ],
+  "aioboto3": [
+    "poetry"
+  ],
+  "aiocurrencylayer": [
+    "poetry-core"
+  ],
+  "aioeafm": [
+    "poetry"
+  ],
+  "aiofiles": [
+    "poetry-core"
+  ],
+  "aioflo": [
+    "poetry-core"
+  ],
+  "aioguardian": [
+    "poetry-core"
+  ],
+  "aiohomekit": [
+    "poetry-core"
+  ],
+  "aiohttp-remotes": [
+    "flitBuildHook"
+  ],
+  "aioitertools": [
+    "flit-core"
+  ],
+  "aiojobs": [
+    "flitBuildHook"
+  ],
+  "aiokafka": [
+    "cython"
+  ],
+  "aiomultiprocess": [
+    "flit-core"
+  ],
+  "aiomusiccast": [
+    "poetry-core"
+  ],
+  "aionotion": [
+    "poetry-core"
+  ],
+  "aiopvpc": [
+    "poetry-core"
+  ],
+  "aiorecollect": [
+    "poetry-core"
+  ],
+  "aioresponses": [
+    "pbr"
+  ],
+  "aioridwell": [
+    "poetry-core"
+  ],
+  "aiorun": [
+    "flitBuildHook"
+  ],
+  "aiosqlite": [
+    "flit-core"
+  ],
+  "aiosteamist": [
+    "poetry-core"
+  ],
+  "aioswitcher": [
+    "poetry-core"
+  ],
+  "aiowatttime": [
+    "poetry-core"
+  ],
+  "ambee": [
+    "poetry-core"
+  ],
+  "amqtt": [
+    "poetry-core"
+  ],
+  "apache-beam": [
+    "cython"
+  ],
+  "argon2_cffi": [
+    "flitBuildHook"
+  ],
+  "aria2p": [
+    "poetry"
+  ],
+  "astropy": [
+    "cython"
+  ],
+  "async-dns": [
+    "poetry-core"
+  ],
+  "asyncmy": [
+    "cython",
+    "poetry-core"
+  ],
+  "asyncstdlib": [
+    "flitBuildHook"
+  ],
+  "atomman": [
+    "cython"
+  ],
+  "autarco": [
+    "poetry-core"
+  ],
+  "authcaptureproxy": [
+    "poetry-core"
+  ],
+  "awesomeversion": [
+    "poetry-core"
+  ],
+  "aws-error-utils": [
+    "poetry"
+  ],
+  "backcall": [
+    "flit-core"
+  ],
+  "backoff": [
+    "poetry"
+  ],
+  "bandit": [
+    "pbr"
+  ],
+  "bash_kernel": [
+    "flitBuildHook"
+  ],
+  "bimmer-connected": [
+    "pbr"
+  ],
+  "blis": [
+    "cython"
+  ],
+  "boltztrap2": [
+    "cython"
+  ],
+  "build": [
+    "flit-core"
+  ],
+  "bx-python": [
+    "cython"
+  ],
+  "cartopy": [
+    "cython"
+  ],
+  "cassandra-driver": [
+    "cython"
+  ],
+  "cattrs": [
+    "poetry-core"
+  ],
+  "censys": [
+    "poetry-core"
+  ],
+  "cftime": [
+    "cython"
+  ],
+  "chispa": [
+    "poetry-core"
+  ],
+  "ciscoconfparse": [
+    "poetry-core"
+  ],
+  "cleo": [
+    "poetry-core"
+  ],
+  "cliff": [
+    "pbr"
+  ],
+  "clikit": [
+    "poetry-core"
+  ],
+  "collections-extended": [
+    "poetry-core"
+  ],
+  "colorclass": [
+    "poetry"
+  ],
+  "colorhash": [
+    "poetry"
+  ],
+  "commitizen": [
+    "poetry-core"
+  ],
+  "confuse": [
+    "flit-core",
+    "flitBuildHook"
+  ],
+  "cpyparsing": [
+    "cython"
+  ],
+  "crashtest": [
+    "poetry-core"
+  ],
+  "credis": [
+    "cython",
+    "poetry-core"
+  ],
+  "cssselect2": [
+    "flit"
+  ],
+  "cwcwidth": [
+    "cython"
+  ],
+  "cyclonedx-python-lib": [
+    "poetry-core"
+  ],
+  "cymem": [
+    "cython"
+  ],
+  "cypari2": [
+    "cython"
+  ],
+  "cysignals": [
+    "cython"
+  ],
+  "datrie": [
+    "cython"
+  ],
+  "ddtrace": [
+    "cython"
+  ],
+  "debtcollector": [
+    "pbr"
+  ],
+  "deezer-python": [
+    "poetry-core"
+  ],
+  "diagrams": [
+    "poetry-core"
+  ],
+  "dipy": [
+    "cython"
+  ],
+  "discovery30303": [
+    "poetry-core"
+  ],
+  "django-graphiql-debug-toolbar": [
+    "poetry-core"
+  ],
+  "django-timezone-field": [
+    "poetry-core"
+  ],
+  "dnspython": [
+    "poetry-core"
+  ],
+  "doc8": [
+    "pbr"
+  ],
+  "dtlssocket": [
+    "cython"
+  ],
+  "duckdb": [
+    "pybind11"
+  ],
+  "duckdb-engine": [
+    "poetry-core"
+  ],
+  "dunamai": [
+    "poetry-core"
+  ],
+  "dynd": [
+    "cython"
+  ],
+  "ecs-logging": [
+    "flit-core",
+    "flitBuildHook"
+  ],
+  "editdistance": [
+    "cython"
+  ],
+  "eebrightbox": [
+    "pbr"
+  ],
+  "eiswarnung": [
+    "poetry-core"
+  ],
+  "elegy": [
+    "poetry"
+  ],
+  "elgato": [
+    "poetry-core"
+  ],
+  "elkm1-lib": [
+    "poetry-core"
+  ],
+  "elmax": [
+    "poetry-core"
+  ],
+  "entrypoints": [
+    "flit"
+  ],
+  "enturclient": [
+    "poetry-core"
+  ],
+  "enumatch": [
+    "poetry"
+  ],
+  "fastapi": [
+    "flitBuildHook"
+  ],
+  "fastapi-restful": [
+    "poetry"
+  ],
+  "fastavro": [
+    "cython"
+  ],
+  "fastdtw": [
+    "cython"
+  ],
+  "fhconfparser": [
+    "poetry-core"
+  ],
+  "finalfusion": [
+    "cython"
+  ],
+  "fixtures": [
+    "pbr"
+  ],
+  "flake8-debugger": [
+    "poetry-core"
+  ],
+  "flake8-print": [
+    "poetry-core"
+  ],
+  "flatten-dict": [
+    "poetry-core"
+  ],
+  "flipr-api": [
+    "poetry-core"
+  ],
+  "flit": [
+    "flit-core"
+  ],
+  "formbox": [
+    "flitBuildHook"
+  ],
+  "fpylll": [
+    "cython"
+  ],
+  "freebox-api": [
+    "poetry-core"
+  ],
+  "frozenlist": [
+    "cython"
+  ],
+  "funcparserlib": [
+    "poetry-core"
+  ],
+  "furo": [
+    "flitBuildHook"
+  ],
+  "galario": [
+    "cython"
+  ],
+  "gaphas": [
+    "poetry-core"
+  ],
+  "garages-amsterdam": [
+    "poetry-core"
+  ],
+  "gbinder-python": [
+    "cython"
+  ],
+  "generic": [
+    "poetry-core"
+  ],
+  "glances-api": [
+    "poetry-core"
+  ],
+  "gpy": [
+    "cython"
+  ],
+  "gpyopt": [
+    "cython"
+  ],
+  "gradient-utils": [
+    "poetry-core"
+  ],
+  "graphql-core": [
+    "poetry-core"
+  ],
+  "graphql-relay": [
+    "poetry-core"
+  ],
+  "gridnet": [
+    "poetry-core"
+  ],
+  "grpcio": [
+    "cython"
+  ],
+  "gsd": [
+    "cython"
+  ],
+  "gssapi": [
+    "cython"
+  ],
+  "gudhi": [
+    "cython"
+  ],
+  "gvm-tools": [
+    "poetry-core"
+  ],
+  "h3": [
+    "cython"
+  ],
+  "h5py": [
+    "cython"
+  ],
+  "h5py-mpi": [
+    "cython"
+  ],
+  "hacking": [
+    "pbr"
+  ],
+  "hashids": [
+    "flit-core"
+  ],
+  "hdate": [
+    "poetry-core"
+  ],
+  "hdbscan": [
+    "cython"
+  ],
+  "hdmedians": [
+    "cython"
+  ],
+  "hidapi": [
+    "cython"
+  ],
+  "hmmlearn": [
+    "cython"
+  ],
+  "homeassistant-pyozw": [
+    "cython"
+  ],
+  "html5lib": [
+    "flit-core"
+  ],
+  "hypercorn": [
+    "poetry-core"
+  ],
+  "hyperion-py": [
+    "poetry-core"
+  ],
+  "hypothesis-auto": [
+    "poetry"
+  ],
+  "hypothesis-graphql": [
+    "poetry"
+  ],
+  "ibis-framework": [
+    "poetry-core"
+  ],
+  "icmplib": [
+    "pbr"
+  ],
+  "idasen": [
+    "poetry-core"
+  ],
+  "imagecodecs-lite": [
+    "cython"
+  ],
+  "immutabledict": [
+    "poetry-core"
+  ],
+  "inquirer": [
+    "poetry-core"
+  ],
+  "installer": [
+    "flit-core"
+  ],
+  "iodata": [
+    "cython"
+  ],
+  "ipfshttpclient": [
+    "flitBuildHook"
+  ],
+  "ipwhl": [
+    "flitBuildHook"
+  ],
+  "isort": [
+    "poetry-core"
+  ],
+  "jedi-language-server": [
+    "poetry"
+  ],
+  "jeepney": [
+    "flit-core"
+  ],
+  "jenkins-job-builder": [
+    "pbr"
+  ],
+  "jinja2-git": [
+    "poetry-core"
+  ],
+  "jschema-to-python": [
+    "pbr"
+  ],
+  "json-schema-for-humans": [
+    "poetry-core"
+  ],
+  "jupyter-server": [
+    "jupyter-packaging"
+  ],
+  "jupyterlab": [
+    "jupyter-packaging"
+  ],
+  "keystoneauth1": [
+    "pbr"
+  ],
+  "kivy": [
+    "cython"
+  ],
+  "langcodes": [
+    "poetry-core"
+  ],
+  "language-data": [
+    "poetry-core"
+  ],
+  "lc7001": [
+    "poetry-core"
+  ],
+  "ldappool": [
+    "pbr"
+  ],
+  "libgpuarray": [
+    "cython"
+  ],
+  "libmr": [
+    "cython"
+  ],
+  "libtmux": [
+    "poetry-core"
+  ],
+  "licensecheck": [
+    "poetry-core"
+  ],
+  "line_profiler": [
+    "cython"
+  ],
+  "linecache2": [
+    "pbr"
+  ],
+  "llfuse": [
+    "cython"
+  ],
+  "loca": [
+    "flitBuildHook"
+  ],
+  "lockfile": [
+    "pbr"
+  ],
+  "luftdaten": [
+    "poetry-core"
+  ],
+  "lupa": [
+    "cython"
+  ],
+  "lxml": [
+    "cython"
+  ],
+  "lz4": [
+    "pkgconfig"
+  ],
+  "maestral": [
+    "pbr"
+  ],
+  "manimpango": [
+    "cython"
+  ],
+  "marisa-trie": [
+    "cython"
+  ],
+  "mask-rcnn": [
+    "cython"
+  ],
+  "matrix-nio": [
+    "poetry-core"
+  ],
+  "mcstatus": [
+    "poetry-core"
+  ],
+  "mdformat": [
+    "poetry-core"
+  ],
+  "mdurl": [
+    "flit-core"
+  ],
+  "mediafile": [
+    "flit-core",
+    "flitBuildHook"
+  ],
+  "memory-allocator": [
+    "cython"
+  ],
+  "metprint": [
+    "poetry-core"
+  ],
+  "mkdocs-autorefs": [
+    "pdm-pep517",
+    "poetry"
+  ],
+  "mkdocs-gen-files": [
+    "poetry"
+  ],
+  "mkdocs-jupyter": [
+    "poetry-core"
+  ],
+  "mkdocs-literate-nav": [
+    "poetry"
+  ],
+  "mkdocstrings": [
+    "pdm-pep517"
+  ],
+  "mock": [
+    "pbr"
+  ],
+  "mongomock": [
+    "pbr"
+  ],
+  "monosat": [
+    "cython"
+  ],
+  "motioneye-client": [
+    "poetry-core"
+  ],
+  "mox3": [
+    "pbr"
+  ],
+  "msgpack-numpy": [
+    "cython"
+  ],
+  "msoffcrypto-tool": [
+    "poetry-core"
+  ],
+  "munch": [
+    "pbr"
+  ],
+  "murmurhash": [
+    "cython"
+  ],
+  "myhome": [
+    "poetry-core"
+  ],
+  "mypy-boto3-builder": [
+    "poetry-core"
+  ],
+  "nats-python": [
+    "poetry-core"
+  ],
+  "nbclassic": [
+    "jupyter-packaging"
+  ],
+  "net2grid": [
+    "poetry-core"
+  ],
+  "netcdf4": [
+    "cython"
+  ],
+  "netdata": [
+    "poetry-core"
+  ],
+  "newversion": [
+    "poetry-core"
+  ],
+  "nghttp2": [
+    "cython"
+  ],
+  "nitime": [
+    "cython"
+  ],
+  "nixpkgs": [
+    "pbr"
+  ],
+  "nkdfu": [
+    "flitBuildHook"
+  ],
+  "notus-scanner": [
+    "poetry-core"
+  ],
+  "ntc-templates": [
+    "poetry-core"
+  ],
+  "numcodecs": [
+    "cython"
+  ],
+  "numpy": [
+    "cython"
+  ],
+  "numpy-stl": [
+    "cython"
+  ],
+  "omnikinverter": [
+    "poetry-core"
+  ],
+  "open-meteo": [
+    "poetry-core"
+  ],
+  "openapi-schema-validator": [
+    "poetry-core"
+  ],
+  "openapi-spec-validator": [
+    "poetry-core"
+  ],
+  "openevsewifi": [
+    "poetry-core"
+  ],
+  "openstackdocstheme": [
+    "pbr"
+  ],
+  "openstacksdk": [
+    "pbr"
+  ],
+  "openvino": [
+    "cython"
+  ],
+  "ormar": [
+    "poetry-core"
+  ],
+  "os-service-types": [
+    "pbr"
+  ],
+  "osc-lib": [
+    "pbr"
+  ],
+  "oslo-concurrency": [
+    "pbr"
+  ],
+  "oslo-config": [
+    "pbr"
+  ],
+  "oslo-context": [
+    "pbr"
+  ],
+  "oslo-db": [
+    "pbr"
+  ],
+  "oslo-i18n": [
+    "pbr"
+  ],
+  "oslo-log": [
+    "pbr"
+  ],
+  "oslo-serialization": [
+    "pbr"
+  ],
+  "oslo-utils": [
+    "pbr"
+  ],
+  "oslotest": [
+    "pbr"
+  ],
+  "p1monitor": [
+    "poetry-core"
+  ],
+  "paddle-client": [
+    "poetry"
+  ],
+  "palace": [
+    "cython"
+  ],
+  "pandas": [
+    "cython"
+  ],
+  "pastel": [
+    "poetry-core"
+  ],
+  "pathable": [
+    "poetry-core"
+  ],
+  "peewee": [
+    "cython"
+  ],
+  "pendulum": [
+    "poetry-core"
+  ],
+  "pep440-version-utils": [
+    "poetry"
+  ],
+  "pep517": [
+    "flit-core"
+  ],
+  "pex": [
+    "flit-core",
+    "flitBuildHook"
+  ],
+  "pipenv-poetry-migrate": [
+    "poetry"
+  ],
+  "pixelmatch": [
+    "poetry-core"
+  ],
+  "poetry": [
+    "poetry-core"
+  ],
+  "poetry2conda": [
+    "poetry"
+  ],
+  "pomegranate": [
+    "cython"
+  ],
+  "pontos": [
+    "poetry-core"
+  ],
+  "pot": [
+    "cython"
+  ],
+  "pplpy": [
+    "cython"
+  ],
+  "preprocess-cancellation": [
+    "poetry-core"
+  ],
+  "preshed": [
+    "cython"
+  ],
+  "primecountpy": [
+    "cython"
+  ],
+  "primer3": [
+    "cython"
+  ],
+  "prometheus-fastapi-instrumentator": [
+    "poetry"
+  ],
+  "ptyprocess": [
+    "flit-core"
+  ],
+  "publication": [
+    "flit"
+  ],
+  "purepng": [
+    "cython"
+  ],
+  "pvo": [
+    "poetry-core"
+  ],
+  "py-synologydsm-api": [
+    "poetry-core"
+  ],
+  "py17track": [
+    "poetry-core"
+  ],
+  "pyairnow": [
+    "poetry"
+  ],
+  "pyairvisual": [
+    "poetry-core"
+  ],
+  "pyarrow": [
+    "cython"
+  ],
+  "pyaussiebb": [
+    "poetry-core"
+  ],
+  "pycangjie": [
+    "cython"
+  ],
+  "pycapnp": [
+    "cython"
+  ],
+  "pycep-parser": [
+    "poetry-core"
+  ],
+  "pyclipper": [
+    "cython"
+  ],
+  "pycocotools": [
+    "cython"
+  ],
+  "pydantic": [
+    "cython"
+  ],
+  "pydy": [
+    "cython"
+  ],
+  "pyebus": [
+    "poetry-core"
+  ],
+  "pyemd": [
+    "cython"
+  ],
+  "pyfftw": [
+    "cython"
+  ],
+  "pyflunearyou": [
+    "poetry-core"
+  ],
+  "pygame_sdl2": [
+    "cython"
+  ],
+  "pygeos": [
+    "cython"
+  ],
+  "pyhumps": [
+    "poetry-core"
+  ],
+  "pyiqvia": [
+    "poetry-core"
+  ],
+  "pyjet": [
+    "cython"
+  ],
+  "pyjsg": [
+    "pbr"
+  ],
+  "pykka": [
+    "poetry-core"
+  ],
+  "pyliblo": [
+    "cython"
+  ],
+  "pymatgen": [
+    "cython"
+  ],
+  "pymaven-patch": [
+    "pbr"
+  ],
+  "pymfy": [
+    "poetry-core"
+  ],
+  "pymssql": [
+    "cython"
+  ],
+  "pynixutil": [
+    "poetry"
+  ],
+  "pynuki": [
+    "poetry-core"
+  ],
+  "pyopencl": [
+    "pybind11"
+  ],
+  "pyopenuv": [
+    "poetry-core"
+  ],
+  "pyopnsense": [
+    "pbr"
+  ],
+  "pyoverkiz": [
+    "poetry-core"
+  ],
+  "pypass": [
+    "pbr"
+  ],
+  "pyphen": [
+    "flit"
+  ],
+  "pypika-tortoise": [
+    "poetry-core"
+  ],
+  "pypoolstation": [
+    "poetry-core"
+  ],
+  "pyppeteer": [
+    "poetry-core"
+  ],
+  "pyprecice": [
+    "cython"
+  ],
+  "pyproj": [
+    "cython"
+  ],
+  "pyproject-flake8": [
+    "flit-core"
+  ],
+  "pyquil": [
+    "poetry-core"
+  ],
+  "pyregion": [
+    "cython"
+  ],
+  "pyrmvtransport": [
+    "flit"
+  ],
+  "pysam": [
+    "cython"
+  ],
+  "pyshex": [
+    "pbr"
+  ],
+  "pyshexc": [
+    "pbr"
+  ],
+  "pysigma": [
+    "poetry-core"
+  ],
+  "pysigma-backend-splunk": [
+    "poetry-core"
+  ],
+  "pysigma-pipeline-crowdstrike": [
+    "poetry-core"
+  ],
+  "pysigma-pipeline-sysmon": [
+    "poetry-core"
+  ],
+  "pysmf": [
+    "cython"
+  ],
+  "pysml": [
+    "poetry-core"
+  ],
+  "pysnow": [
+    "poetry"
+  ],
+  "pysptk": [
+    "cython"
+  ],
+  "pytaglib": [
+    "cython"
+  ],
+  "pytest-celery": [
+    "flitBuildHook"
+  ],
+  "pytest-check": [
+    "flitBuildHook"
+  ],
+  "pytest-cid": [
+    "flitBuildHook"
+  ],
+  "pytest-httpserver": [
+    "poetry-core"
+  ],
+  "pytest-mockservers": [
+    "poetry-core"
+  ],
+  "pytest-profiling": [
+    "setuptools-git"
+  ],
+  "pytest-raisin": [
+    "flit-core",
+    "flitBuildHook"
+  ],
+  "pytest-socket": [
+    "poetry-core"
+  ],
+  "python-awair": [
+    "poetry-core"
+  ],
+  "python-cinderclient": [
+    "pbr"
+  ],
+  "python-csxcad": [
+    "cython"
+  ],
+  "python-fontconfig": [
+    "cython"
+  ],
+  "python-glanceclient": [
+    "pbr"
+  ],
+  "python-gvm": [
+    "poetry-core"
+  ],
+  "python-heatclient": [
+    "pbr"
+  ],
+  "python-ironicclient": [
+    "pbr"
+  ],
+  "python-jenkins": [
+    "pbr"
+  ],
+  "python-kasa": [
+    "poetry-core"
+  ],
+  "python-keystoneclient": [
+    "pbr"
+  ],
+  "python-manilaclient": [
+    "pbr"
+  ],
+  "python-miio": [
+    "poetry",
+    "poetry-core"
+  ],
+  "python-novaclient": [
+    "pbr"
+  ],
+  "python-openems": [
+    "cython"
+  ],
+  "python-openstackclient": [
+    "pbr"
+  ],
+  "python-pkcs11": [
+    "cython"
+  ],
+  "python-songpal": [
+    "poetry-core"
+  ],
+  "python-swiftclient": [
+    "pbr"
+  ],
+  "python_openzwave": [
+    "cython"
+  ],
+  "pytile": [
+    "poetry-core"
+  ],
+  "pytkdocs": [
+    "pdm-pep517"
+  ],
+  "pytzdata": [
+    "poetry"
+  ],
+  "pyvera": [
+    "poetry-core"
+  ],
+  "pywavelets": [
+    "cython"
+  ],
+  "pywbem": [
+    "pbr"
+  ],
+  "pywemo": [
+    "poetry-core"
+  ],
+  "pyworld": [
+    "cython"
+  ],
+  "pyyaml": [
+    "cython"
+  ],
+  "pyyaml-env-tag": [
+    "flit-core"
+  ],
+  "qcs-api-client": [
+    "poetry-core"
+  ],
+  "qiskit-aer": [
+    "cython"
+  ],
+  "qiskit-terra": [
+    "cython"
+  ],
+  "questionary": [
+    "poetry-core"
+  ],
+  "qutip": [
+    "cython"
+  ],
+  "radios": [
+    "poetry-core"
+  ],
+  "rasterio": [
+    "cython"
+  ],
+  "reedsolo": [
+    "cython"
+  ],
+  "regenmaschine": [
+    "poetry-core"
+  ],
+  "remarshal": [
+    "poetry-core"
+  ],
+  "renault-api": [
+    "poetry-core"
+  ],
+  "rencode": [
+    "cython"
+  ],
+  "reproject": [
+    "cython"
+  ],
+  "requests-cache": [
+    "poetry-core"
+  ],
+  "requests-mock": [
+    "pbr"
+  ],
+  "requests-unixsocket": [
+    "pbr"
+  ],
+  "requestsexceptions": [
+    "pbr"
+  ],
+  "requirements-parser": [
+    "poetry-core"
+  ],
+  "resampy": [
+    "cython"
+  ],
+  "retry": [
+    "pbr"
+  ],
+  "rich": [
+    "poetry-core"
+  ],
+  "ripser": [
+    "cython"
+  ],
+  "rmcl": [
+    "poetry-core"
+  ],
+  "rmfuse": [
+    "poetry-core"
+  ],
+  "rmrl": [
+    "poetry-core"
+  ],
+  "rokuecp": [
+    "poetry"
+  ],
+  "roombapy": [
+    "poetry-core"
+  ],
+  "roonapi": [
+    "poetry-core"
+  ],
+  "rsa": [
+    "poetry-core"
+  ],
+  "rtmidi-python": [
+    "cython"
+  ],
+  "rtmixer": [
+    "cython"
+  ],
+  "sanic": [
+    "poetry-core"
+  ],
+  "sarif-om": [
+    "pbr"
+  ],
+  "scikit-bio": [
+    "cython"
+  ],
+  "scikit-build": [
+    "cython"
+  ],
+  "scikit-image": [
+    "cython"
+  ],
+  "scikit-learn": [
+    "cython"
+  ],
+  "scikit-learn-extra": [
+    "cython"
+  ],
+  "scikit-survival": [
+    "cython"
+  ],
+  "scikit-tda": [
+    "cython"
+  ],
+  "scikitimage": [
+    "cython"
+  ],
+  "scikitlearn": [
+    "cython"
+  ],
+  "scikits-odes": [
+    "cython"
+  ],
+  "scipy": [
+    "cython"
+  ],
+  "seabreeze": [
+    "cython"
+  ],
+  "seccomp": [
+    "cython"
+  ],
+  "sentinel": [
+    "poetry-core"
+  ],
+  "sfepy": [
+    "cython"
+  ],
+  "shapely": [
+    "cython"
+  ],
+  "shexjsg": [
+    "pbr"
+  ],
+  "simplisafe-python": [
+    "poetry-core"
+  ],
+  "single-source": [
+    "poetry-core"
+  ],
+  "single-version": [
+    "poetry-core"
+  ],
+  "slowapi": [
+    "poetry-core"
+  ],
+  "solo-python": [
+    "flitBuildHook"
+  ],
+  "spacy-pkuseg": [
+    "cython"
+  ],
+  "sparqlslurper": [
+    "pbr"
+  ],
+  "sphinx-inline-tabs": [
+    "flitBuildHook"
+  ],
+  "sphinx-jinja": [
+    "pbr"
+  ],
+  "sphinxcontrib-apidoc": [
+    "pbr"
+  ],
+  "sphinxcontrib-fulltoc": [
+    "pbr"
+  ],
+  "sphinxcontrib-spelling": [
+    "pbr"
+  ],
+  "spiderpy": [
+    "poetry-core"
+  ],
+  "sqlalchemy-migrate": [
+    "pbr"
+  ],
+  "sqlalchemy_migrate": [
+    "pbr"
+  ],
+  "srsly": [
+    "cython"
+  ],
+  "ssdp": [
+    "pbr"
+  ],
+  "stack-data": [
+    "cython"
+  ],
+  "staticjinja": [
+    "poetry-core"
+  ],
+  "statmake": [
+    "poetry-core"
+  ],
+  "statsmodels": [
+    "cython"
+  ],
+  "stestr": [
+    "pbr"
+  ],
+  "stevedore": [
+    "pbr"
+  ],
+  "strawberry-graphql": [
+    "poetry"
+  ],
+  "streaming-form-data": [
+    "cython"
+  ],
+  "structlog": [
+    "flitBuildHook"
+  ],
+  "structlog-sentry": [
+    "poetry-core"
+  ],
+  "subunit2sql": [
+    "pbr"
+  ],
+  "sumo": [
+    "cython"
+  ],
+  "surepy": [
+    "poetry-core"
+  ],
+  "swift": [
+    "pbr"
+  ],
+  "swspotify": [
+    "poetry-core"
+  ],
+  "symengine": [
+    "cython"
+  ],
+  "synologydsm-api": [
+    "poetry-core"
+  ],
+  "tables": [
+    "cython"
+  ],
+  "tailscale": [
+    "poetry-core"
+  ],
+  "tarsafe": [
+    "poetry"
+  ],
+  "tempest": [
+    "pbr"
+  ],
+  "tenacity": [
+    "pbr"
+  ],
+  "terminaltables": [
+    "poetry"
+  ],
+  "tern": [
+    "pbr"
+  ],
+  "tesla-wall-connector": [
+    "poetry-core"
+  ],
+  "teslajsonpy": [
+    "poetry-core"
+  ],
+  "tess": [
+    "cython"
+  ],
+  "tesserocr": [
+    "cython"
+  ],
+  "testpath": [
+    "flit"
+  ],
+  "testrepository": [
+    "pbr"
+  ],
+  "testresources": [
+    "pbr"
+  ],
+  "testtools": [
+    "pbr"
+  ],
+  "textual": [
+    "poetry-core"
+  ],
+  "thinc": [
+    "cython"
+  ],
+  "threadpoolctl": [
+    "flitBuildHook"
+  ],
+  "thriftpy2": [
+    "cython"
+  ],
+  "tikzplotlib": [
+    "flit-core"
+  ],
+  "tinycss": [
+    "cython"
+  ],
+  "tinycss2": [
+    "flitBuildHook"
+  ],
+  "tinydb": [
+    "poetry-core"
+  ],
+  "toggl-cli": [
+    "pbr"
+  ],
+  "toml-sort": [
+    "poetry"
+  ],
+  "tomli": [
+    "flit-core"
+  ],
+  "tomli-w": [
+    "flit-core"
+  ],
+  "tomlkit": [
+    "poetry-core"
+  ],
+  "tortoise-orm": [
+    "poetry-core"
+  ],
+  "traceback2": [
+    "pbr"
+  ],
+  "transmission-rpc": [
+    "poetry-core"
+  ],
+  "treeo": [
+    "poetry-core"
+  ],
+  "treex": [
+    "poetry-core"
+  ],
+  "ttls": [
+    "poetry-core"
+  ],
+  "twentemilieu": [
+    "poetry-core"
+  ],
+  "typer": [
+    "flit-core"
+  ],
+  "typical": [
+    "poetry-core"
+  ],
+  "typing-extensions": [
+    "flit-core"
+  ],
+  "unpaddedbase64": [
+    "poetry-core"
+  ],
+  "url-normalize": [
+    "poetry-core"
+  ],
+  "vehicle": [
+    "poetry-core"
+  ],
+  "virtualenv": [
+    "cython"
+  ],
+  "virtualenvwrapper": [
+    "pbr"
+  ],
+  "vispy": [
+    "cython"
+  ],
+  "wakeonlan": [
+    "poetry-core"
+  ],
+  "weasyprint": [
+    "flit-core"
+  ],
+  "wled": [
+    "poetry-core"
+  ],
+  "word2vec": [
+    "cython"
+  ],
+  "wordcloud": [
+    "cython"
+  ],
+  "xdg": [
+    "poetry-core"
+  ],
+  "xpath-expressions": [
+    "poetry-core"
+  ],
+  "yaspin": [
+    "poetry-core"
+  ],
+  "yoda": [
+    "cython"
+  ],
+  "zeversolarlocal": [
+    "flit-core",
+    "flitBuildHook"
+  ]
+}
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix b/pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix
new file mode 100644
index 0000000000000..5439f1814dc54
--- /dev/null
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix
@@ -0,0 +1,2294 @@
+{ pkgs ? import <nixpkgs> { }
+, lib ? pkgs.lib
+, stdenv ? pkgs.stdenv
+}:
+
+let
+  addBuildSystem =
+    { self
+    , drv
+    , attr
+    }:
+    let
+      buildSystem = if attr == "cython" then self.python.pythonForBuild.pkgs.cython else self.${attr};
+    in
+    (
+      # Flit only works on Python3
+      if (attr == "flit-core" || attr == "flit") && !self.isPy3k then drv
+      else
+        drv.overridePythonAttrs (
+          old:
+          # We do not need the build system for wheels.
+          if old ? format && old.format == "wheel" then
+            { }
+          else
+            {
+              nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ self.${attr} ];
+            }
+        )
+    );
+
+
+in
+lib.composeManyExtensions [
+
+  # NixOps
+  (self: super:
+    lib.mapAttrs (_: v: addBuildSystem { inherit self; drv = v; attr = "poetry"; }) (lib.filterAttrs (n: _: lib.strings.hasPrefix "nixops" n) super)
+    // {
+      # NixOps >=2 dependency
+      nixos-modules-contrib = addBuildSystem { inherit self; drv = super.nixos-modules-contrib; attr = "poetry"; };
+    }
+  )
+
+  # Add build systems
+  (self: super:
+    let
+      buildSystems = lib.importJSON ./build-systems.json;
+    in
+    lib.mapAttrs
+      (attr: systems: builtins.foldl'
+        (drv: attr: addBuildSystem {
+          inherit drv self attr;
+        })
+        super.${attr}
+        systems)
+      buildSystems)
+
+  # Build fixes
+  (self: super:
+    let
+      inherit (self.python) stdenv;
+      inherit (pkgs.buildPackages) pkg-config;
+      inherit (pkgs) buildPackages;
+      pyBuildPackages = self.python.pythonForBuild.pkgs;
+
+    in
+
+    {
+      automat = super.automat.overridePythonAttrs (
+        old: rec {
+          propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ self.m2r ];
+        }
+      );
+
+      aiohttp-swagger3 = super.aiohttp-swagger3.overridePythonAttrs (
+        old: {
+          nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ self.pytest-runner ];
+        }
+      );
+
+      ansible = super.ansible.overridePythonAttrs (
+        old: {
+          # Inputs copied from nixpkgs as ansible doesn't specify it's dependencies
+          # in a correct manner.
+          propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [
+            self.pycrypto
+            self.paramiko
+            self.jinja2
+            self.pyyaml
+            self.httplib2
+            self.six
+            self.netaddr
+            self.dnspython
+            self.jmespath
+            self.dopy
+            self.ncclient
+          ];
+        } // lib.optionalAttrs (lib.versionOlder old.version "5.0") {
+          prePatch = pkgs.python.pkgs.ansible.prePatch or "";
+          postInstall = pkgs.python.pkgs.ansible.postInstall or "";
+        }
+      );
+
+      ansible-lint = super.ansible-lint.overridePythonAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ]) ++ [ self.setuptools-scm-git-archive ];
+          preBuild = ''
+            export HOME=$(mktemp -d)
+          '';
+        }
+      );
+
+      argcomplete = super.argcomplete.overridePythonAttrs (
+        old: rec {
+          buildInputs = (old.buildInputs or [ ]) ++ [ self.importlib-metadata ];
+        }
+      );
+
+      arpeggio = super.arpeggio.overridePythonAttrs (
+        old: {
+          nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ self.pytest-runner ];
+        }
+      );
+
+      astroid = super.astroid.overridePythonAttrs (
+        old: rec {
+          buildInputs = (old.buildInputs or [ ]) ++ [ self.pytest-runner ];
+        }
+      );
+
+      av = super.av.overridePythonAttrs (
+        old: {
+          nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [
+            pkg-config
+          ];
+          buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.ffmpeg_4 ];
+        }
+      );
+
+      argon2-cffi =
+        if (lib.versionAtLeast super.argon2-cffi.version "21.2.0") then
+          addBuildSystem
+            {
+              inherit self;
+              drv = super.argon2-cffi;
+              attr = "flit-core";
+            } else super.argon2-cffi;
+
+      bcrypt = super.bcrypt.overridePythonAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.libffi ];
+        }
+      );
+
+      bjoern = super.bjoern.overridePythonAttrs (
+        old: {
+          buildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.libev ];
+        }
+      );
+
+      borgbackup = super.borgbackup.overridePythonAttrs (
+        old: {
+          BORG_OPENSSL_PREFIX = pkgs.openssl.dev;
+          nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkg-config ];
+          buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.openssl pkgs.acl ];
+        }
+      );
+
+      cairocffi = super.cairocffi.overridePythonAttrs (
+        old: {
+          inherit (pkgs.python3.pkgs.cairocffi) patches;
+          buildInputs = (old.buildInputs or [ ]) ++ [ self.pytest-runner ];
+        }
+      );
+
+      cairosvg = super.cairosvg.overridePythonAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ]) ++ [ self.pytest-runner ];
+        }
+      );
+
+      cattrs =
+        let
+          drv = super.cattrs;
+        in
+        if drv.version == "1.10.0" then
+          drv.overridePythonAttrs
+            (old: {
+              # 1.10.0 contains a pyproject.toml that requires a pre-release Poetry
+              # We can avoid using Poetry and use the generated setup.py
+              preConfigure = old.preConfigure or "" + ''
+                rm pyproject.toml
+              '';
+            }) else drv;
+
+      ccxt = super.ccxt.overridePythonAttrs (old: {
+        preBuild = ''
+          ln -s README.{rst,md}
+        '';
+      });
+
+      celery = super.celery.overridePythonAttrs (old: {
+        propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ self.setuptools ];
+      });
+
+      cssselect2 = super.cssselect2.overridePythonAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ]) ++ [ self.pytest-runner ];
+        }
+      );
+
+      cffi =
+        # cffi is bundled with pypy
+        if self.python.implementation == "pypy" then null else
+        (
+          super.cffi.overridePythonAttrs (
+            old: {
+              nativeBuildInputs = old.nativeBuildInputs or [ ] ++ [ pkg-config ];
+              buildInputs = old.buildInputs or [ ] ++ [ pkgs.libffi ];
+              prePatch = (old.prePatch or "") + lib.optionalString stdenv.isDarwin ''
+                # Remove setup.py impurities
+                substituteInPlace setup.py --replace "'-iwithsysroot/usr/include/ffi'" ""
+                substituteInPlace setup.py --replace "'/usr/include/ffi'," ""
+                substituteInPlace setup.py --replace '/usr/include/libffi' '${lib.getDev pkgs.libffi}/include'
+              '';
+
+            }
+          )
+        );
+
+      cloudflare = super.cloudflare.overridePythonAttrs (
+        old: {
+          postPatch = ''
+            rm -rf examples/*
+          '';
+        }
+      );
+
+      colour = super.colour.overridePythonAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ]) ++ [ self.d2to1 ];
+        }
+      );
+
+      coincurve = super.coincurve.overridePythonAttrs (
+        old: {
+          # package setup logic
+          LIB_DIR = "${lib.getLib pkgs.secp256k1}/lib";
+
+          # for actual C toolchain build
+          NIX_CFLAGS_COMPILE = "-I ${lib.getDev pkgs.secp256k1}/include";
+          NIX_LDFLAGS = "-L ${lib.getLib pkgs.secp256k1}/lib";
+        }
+      );
+
+      configparser = super.configparser.overridePythonAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ]) ++ [
+            self.toml
+          ];
+        }
+      );
+
+      confluent-kafka = super.confluent-kafka.overridePythonAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ]) ++ [
+            pkgs.rdkafka
+          ];
+        }
+      );
+
+      cryptography =
+        let
+          getCargoHash = version: {
+            "35.0.0" = "sha256-tQoQfo+TAoqAea86YFxyj/LNQCiViu5ij/3wj7ZnYLI=";
+            "36.0.0" = "sha256-Y6TuW7AryVgSvZ6G8WNoDIvi+0tvx8ZlEYF5qB0jfNk=";
+            "36.0.1" = "sha256-kozYXkqt1Wpqyo9GYCwN08J+zV92ZWFJY/f+rulxmeQ=";
+            "36.0.2" = "1a0ni1a3dbv2dvh6gx2i54z8v5j9m6asqg97kkv7gqb1ivihsbp8";
+          }.${version} or null;
+          sha256 = getCargoHash super.cryptography.version;
+          scrypto =
+            if lib.versionAtLeast super.cryptography.version "35" && sha256 == null then
+              (
+                super.cryptography.override { preferWheel = true; }
+              ) else super.cryptography;
+        in
+        scrypto.overridePythonAttrs
+          (
+            old: {
+              nativeBuildInputs = (old.nativeBuildInputs or [ ])
+                ++ lib.optional (lib.versionAtLeast old.version "3.4") [ self.setuptools-rust ]
+                ++ lib.optional (!self.isPyPy) pyBuildPackages.cffi
+                ++ lib.optional (lib.versionAtLeast old.version "3.5")
+                (with pkgs.rustPlatform; [ cargoSetupHook rust.cargo rust.rustc ]);
+              buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.openssl ]
+                ++ lib.optionals stdenv.isDarwin [ pkgs.darwin.apple_sdk.frameworks.Security pkgs.libiconv ];
+              propagatedBuildInputs = old.propagatedBuildInputs or [ ] ++ [ self.cffi ];
+            } // lib.optionalAttrs (lib.versionAtLeast old.version "3.4" && lib.versionOlder old.version "3.5") {
+              CRYPTOGRAPHY_DONT_BUILD_RUST = "1";
+            } // lib.optionalAttrs (lib.versionAtLeast old.version "35" && sha256 != null) rec {
+              cargoDeps =
+                pkgs.rustPlatform.fetchCargoTarball {
+                  src = old.src;
+                  sourceRoot = "${old.pname}-${old.version}/${cargoRoot}";
+                  name = "${old.pname}-${old.version}";
+                  inherit sha256;
+                };
+              cargoRoot = "src/rust";
+            }
+          );
+
+      cyclonedx-python-lib = super.cyclonedx-python-lib.overridePythonAttrs (old: {
+        propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ self.setuptools ];
+        postPatch = ''
+          substituteInPlace setup.py --replace 'setuptools>=50.3.2,<51.0.0' 'setuptools'
+        '';
+      });
+
+      daphne = super.daphne.overridePythonAttrs (old: {
+        postPatch = ''
+          substituteInPlace setup.py --replace 'setup_requires=["pytest-runner"],' ""
+        '';
+      });
+
+      datadog-lambda = super.datadog-lambda.overridePythonAttrs (old: {
+        postPatch = ''
+          substituteInPlace setup.py --replace "setuptools==" "setuptools>="
+        '';
+        buildInputs = (old.buildInputs or [ ]) ++ [ self.setuptools ];
+      });
+
+      dbus-python = super.dbus-python.overridePythonAttrs (old: {
+        outputs = [ "out" "dev" ];
+
+        postPatch = old.postPatch or "" + ''
+          substituteInPlace ./configure --replace /usr/bin/file ${pkgs.file}/bin/file
+          substituteInPlace ./dbus-python.pc.in --replace 'Cflags: -I''${includedir}' 'Cflags: -I''${includedir}/dbus-1.0'
+        '';
+
+        configureFlags = (old.configureFlags or [ ]) ++ [
+          "PYTHON_VERSION=${lib.versions.major self.python.version}"
+        ];
+
+        preConfigure = lib.concatStringsSep "\n" [
+          (old.preConfigure or "")
+          (if (lib.versionAtLeast stdenv.hostPlatform.darwinMinVersion "11" && stdenv.isDarwin) then ''
+            MACOSX_DEPLOYMENT_TARGET=10.16
+          '' else "")
+        ];
+
+        preBuild = old.preBuild or "" + ''
+          make distclean
+        '';
+
+        nativeBuildInputs = old.nativeBuildInputs or [ ] ++ [ pkg-config ];
+        buildInputs = old.buildInputs or [ ] ++ [ pkgs.dbus pkgs.dbus-glib ]
+          # My guess why it's sometimes trying to -lncurses.
+          # It seems not to retain the dependency anyway.
+          ++ lib.optional (! self.python ? modules) pkgs.ncurses;
+      });
+
+      dcli = super.dcli.overridePythonAttrs (old: {
+        propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ self.setuptools ];
+      });
+
+      ddtrace = super.ddtrace.overridePythonAttrs (old: {
+        buildInputs = (old.buildInputs or [ ]) ++
+          (lib.optionals pkgs.stdenv.isDarwin [ pkgs.darwin.IOKit ]);
+      });
+
+      dictdiffer = super.dictdiffer.overridePythonAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ]) ++ [ self.pytest-runner ];
+          propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ self.setuptools ];
+        }
+      );
+
+      django = (
+        super.django.overridePythonAttrs (
+          old: {
+            propagatedNativeBuildInputs = (old.propagatedNativeBuildInputs or [ ])
+              ++ [ pkgs.gettext self.pytest-runner ];
+          }
+        )
+      );
+
+      django-bakery = super.django-bakery.overridePythonAttrs (
+        old: {
+          configurePhase = ''
+            if ! test -e LICENSE; then
+              touch LICENSE
+            fi
+          '' + (old.configurePhase or "");
+        }
+      );
+
+      django-cors-headers = super.django-cors-headers.overridePythonAttrs (
+        old: {
+          nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ self.pytest-runner ];
+        }
+      );
+
+      django-hijack = super.django-hijack.overridePythonAttrs (
+        old: {
+          nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ self.pytest-runner ];
+        }
+      );
+
+      django-prometheus = super.django-prometheus.overridePythonAttrs (
+        old: {
+          nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ self.pytest-runner ];
+        }
+      );
+
+      django-rosetta = super.django-rosetta.overridePythonAttrs (
+        old: {
+          nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ self.pytest-runner ];
+        }
+      );
+
+      django-stubs-ext = super.django-stubs-ext.overridePythonAttrs (
+        old: {
+          prePatch = (old.prePatch or "") + "touch ../LICENSE.txt";
+        }
+      );
+
+      dlib = super.dlib.overridePythonAttrs (
+        old: {
+          # Parallel building enabled
+          inherit (pkgs.python.pkgs.dlib) patches;
+
+          enableParallelBuilding = true;
+          dontUseCmakeConfigure = true;
+
+          nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ pkgs.dlib.nativeBuildInputs;
+          buildInputs = (old.buildInputs or [ ]) ++ pkgs.dlib.buildInputs;
+        }
+      );
+
+      # Environment markers are not always included (depending on how a dep was defined)
+      enum34 = if self.pythonAtLeast "3.4" then null else super.enum34;
+
+      eth-hash = super.eth-hash.overridePythonAttrs {
+        preConfigure = ''
+          substituteInPlace setup.py --replace \'setuptools-markdown\' ""
+        '';
+      };
+
+      eth-keyfile = super.eth-keyfile.overridePythonAttrs {
+        preConfigure = ''
+          substituteInPlace setup.py --replace \'setuptools-markdown\' ""
+        '';
+      };
+
+      eth-keys = super.eth-keys.overridePythonAttrs {
+        preConfigure = ''
+          substituteInPlace setup.py --replace \'setuptools-markdown\' ""
+        '';
+      };
+
+      # remove eth-hash dependency because eth-hash also depends on eth-utils causing a cycle.
+      eth-utils = super.eth-utils.overridePythonAttrs (old: {
+        propagatedBuildInputs =
+          builtins.filter (i: i.pname != "eth-hash") old.propagatedBuildInputs;
+        preConfigure = ''
+          ${old.preConfigure or ""}
+          sed -i '/eth-hash/d' setup.py
+        '';
+      });
+
+      faker = super.faker.overridePythonAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ]) ++ [ self.pytest-runner ];
+          doCheck = false;
+        }
+      );
+
+      fancycompleter = super.fancycompleter.overridePythonAttrs (
+        old: {
+          postPatch = ''
+            substituteInPlace setup.py \
+              --replace 'setup_requires="setupmeta"' 'setup_requires=[]' \
+              --replace 'versioning="devcommit"' 'version="${old.version}"'
+          '';
+        }
+      );
+
+      fastecdsa = super.fastecdsa.overridePythonAttrs (old: {
+        buildInputs = old.buildInputs ++ [ pkgs.gmp.dev ];
+      });
+
+      fastparquet = super.fastparquet.overridePythonAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ]) ++ [ self.pytest-runner ];
+        }
+      );
+
+      fiona = super.fiona.overridePythonAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.gdal_2 ];
+          nativeBuildInputs = [
+            pkgs.gdal_2 # for gdal-config
+          ];
+        }
+      );
+
+      flatbuffers = super.flatbuffers.overrideAttrs (old: {
+        VERSION = old.version;
+      });
+
+      gdal = super.gdal.overridePythonAttrs (
+        old: {
+          preBuild = (old.preBuild or "") + ''
+            substituteInPlace setup.cfg \
+              --replace "../../apps/gdal-config" '${pkgs.gdal}/bin/gdal-config'
+          '';
+        }
+      );
+
+      grandalf = super.grandalf.overridePythonAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ]) ++ [ self.pytest-runner ];
+          doCheck = false;
+        }
+      );
+
+      gitpython = super.gitpython.overridePythonAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ]) ++ [ self.typing-extensions ];
+        }
+      );
+
+      grpcio = super.grpcio.overridePythonAttrs (old: {
+        nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkg-config ];
+        buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.c-ares pkgs.openssl pkgs.zlib ];
+
+        outputs = [ "out" "dev" ];
+
+        GRPC_BUILD_WITH_BORING_SSL_ASM = "";
+        GRPC_PYTHON_BUILD_SYSTEM_OPENSSL = 1;
+        GRPC_PYTHON_BUILD_SYSTEM_ZLIB = 1;
+        GRPC_PYTHON_BUILD_SYSTEM_CARES = 1;
+        DISABLE_LIBC_COMPATIBILITY = 1;
+      });
+
+      grpcio-tools = super.grpcio-tools.overridePythonAttrs (old: {
+        outputs = [ "out" "dev" ];
+      });
+
+      h3 = super.h3.overridePythonAttrs (
+        old: {
+          preBuild = (old.preBuild or "") + ''
+            substituteInPlace h3/h3.py \
+              --replace "'{}/{}'.format(_dirname, libh3_path)" '"${pkgs.h3}/lib/libh3${pkgs.stdenv.hostPlatform.extensions.sharedLibrary}"'
+          '';
+        }
+      );
+
+      h5py = super.h5py.overridePythonAttrs (
+        old:
+        if old.format != "wheel" then
+          (
+            let
+              mpi = pkgs.hdf5.mpi;
+              mpiSupport = pkgs.hdf5.mpiSupport;
+            in
+            {
+              nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkg-config ];
+              buildInputs =
+                (old.buildInputs or [ ])
+                ++ [ pkgs.hdf5 self.pkgconfig ]
+                ++ lib.optional mpiSupport mpi
+              ;
+              propagatedBuildInputs =
+                (old.propagatedBuildInputs or [ ])
+                ++ lib.optionals mpiSupport [ self.mpi4py self.openssh ]
+              ;
+              preBuild = if mpiSupport then "export CC=${mpi}/bin/mpicc" else "";
+              HDF5_DIR = "${pkgs.hdf5}";
+              HDF5_MPI = if mpiSupport then "ON" else "OFF";
+              # avoid strict pinning of numpy
+              postPatch = ''
+                substituteInPlace setup.py \
+                  --replace "numpy ==" "numpy >="
+              '';
+              pythonImportsCheck = [ "h5py" ];
+            }
+          ) else old
+      );
+
+      hid = super.hid.overridePythonAttrs (
+        old: {
+          postPatch = ''
+            found=
+            for name in libhidapi-hidraw libhidapi-libusb libhidapi-iohidmanager libhidapi; do
+              full_path=${pkgs.hidapi.out}/lib/$name${pkgs.stdenv.hostPlatform.extensions.sharedLibrary}
+              if test -f $full_path; then
+                found=t
+                sed -i -e "s|'$name\..*'|'$full_path'|" hid/__init__.py
+              fi
+            done
+            test -n "$found" || { echo "ERROR: No known libraries found in ${pkgs.hidapi.out}/lib, please update/fix this build expression."; exit 1; }
+          '';
+        }
+      );
+
+      horovod = super.horovod.overridePythonAttrs (
+        old: {
+          propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ pkgs.mpi ];
+        }
+      );
+
+      httplib2 = super.httplib2.overridePythonAttrs (old: {
+        propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ self.pyparsing ];
+      });
+
+      icecream = super.icecream.overridePythonAttrs (old: {
+        #  # ERROR: Could not find a version that satisfies the requirement executing>=0.3.1 (from icecream) (from versions: none)
+        postPatch = ''
+          substituteInPlace setup.py --replace 'executing>=0.3.1' 'executing'
+        '';
+      });
+
+      igraph = super.igraph.overridePythonAttrs (
+        old: {
+          nativeBuildInputs = [ pkgs.cmake ] ++ old.nativeBuildInputs;
+          dontUseCmakeConfigure = true;
+        }
+      );
+
+      imagecodecs = super.imagecodecs.overridePythonAttrs (
+        old: {
+          patchPhase = ''
+            substituteInPlace setup.py \
+              --replace "/usr/include/openjpeg-2.3" \
+                        "${pkgs.openjpeg.dev}/include/${pkgs.openjpeg.dev.incDir}
+            substituteInPlace setup.py \
+              --replace "/usr/include/jxrlib" \
+                        "$out/include/libjxr"
+            substituteInPlace imagecodecs/_zopfli.c \
+              --replace '"zopfli/zopfli.h"' \
+                        '<zopfli.h>'
+            substituteInPlace imagecodecs/_zopfli.c \
+              --replace '"zopfli/zlib_container.h"' \
+                        '<zlib_container.h>'
+            substituteInPlace imagecodecs/_zopfli.c \
+              --replace '"zopfli/gzip_container.h"' \
+                        '<gzip_container.h>'
+          '';
+
+          preBuild = ''
+            mkdir -p $out/include/libjxr
+            ln -s ${pkgs.jxrlib}/include/libjxr/**/* $out/include/libjxr
+
+          '';
+
+          buildInputs = (old.buildInputs or [ ]) ++ [
+            # Commented out packages are declared required, but not actually
+            # needed to build. They are not yet packaged for nixpkgs.
+            # bitshuffle
+            pkgs.brotli
+            # brunsli
+            pkgs.bzip2
+            pkgs.c-blosc
+            # charls
+            pkgs.giflib
+            pkgs.jxrlib
+            pkgs.lcms
+            pkgs.libaec
+            pkgs.libaec
+            pkgs.libjpeg_turbo
+            # liblzf
+            # liblzma
+            pkgs.libpng
+            pkgs.libtiff
+            pkgs.libwebp
+            pkgs.lz4
+            pkgs.openjpeg
+            pkgs.snappy
+            # zfp
+            pkgs.zopfli
+            pkgs.zstd
+            pkgs.zlib
+          ];
+        }
+      );
+
+      # importlib-metadata has an incomplete dependency specification
+      importlib-metadata = super.importlib-metadata.overridePythonAttrs (
+        old: {
+          propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ lib.optional self.python.isPy2 self.pathlib2;
+        }
+      );
+
+      intreehooks = super.intreehooks.overridePythonAttrs (
+        old: {
+          doCheck = false;
+        }
+      );
+
+      isort = super.isort.overridePythonAttrs (
+        old: {
+          propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ self.setuptools ];
+        }
+      );
+
+      jaraco-functools = super.jaraco-functools.overridePythonAttrs (
+        old: {
+          # required for the extra "toml" dependency in setuptools_scm[toml]
+          buildInputs = (old.buildInputs or [ ]) ++ [
+            self.toml
+          ];
+        }
+      );
+
+      jira = super.jira.overridePythonAttrs (
+        old: {
+          inherit (pkgs.python3Packages.jira) patches;
+          buildInputs = (old.buildInputs or [ ]) ++ [
+            self.pytestrunner
+            self.cryptography
+            self.pyjwt
+            self.setuptools-scm-git-archive
+          ];
+        }
+      );
+
+      jq = super.jq.overridePythonAttrs (attrs: {
+        buildInputs = [ pkgs.jq ];
+        patches = [
+          (pkgs.fetchpatch {
+            url = "https://raw.githubusercontent.com/NixOS/nixpkgs/088da8735f6620b60d724aa7db742607ea216087/pkgs/development/python-modules/jq/jq-py-setup.patch";
+            sha256 = "sha256-MYvX3S1YGe0QsUtExtOtULvp++AdVrv+Fid4Jh1xewQ=";
+          })
+        ];
+      });
+
+      jsondiff = super.jsondiff.overridePythonAttrs (
+        old: {
+          preBuild = (old.preBuild or "") + ''
+            substituteInPlace setup.py \
+              --replace "'jsondiff=jsondiff.cli:main_deprecated'," ""
+          '';
+        }
+      );
+
+      jsonslicer = super.jsonslicer.overridePythonAttrs (old: {
+        nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.pkgconfig ];
+        buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.yajl ];
+      });
+
+      jupyter = super.jupyter.overridePythonAttrs (
+        old: rec {
+          # jupyter is a meta-package. Everything relevant comes from the
+          # dependencies. It does however have a jupyter.py file that conflicts
+          # with jupyter-core so this meta solves this conflict.
+          meta.priority = 100;
+        }
+      );
+
+      jupyter-packaging = super.jupyter-packaging.overridePythonAttrs (old: {
+        propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ self.wheel ];
+      });
+
+      jupyterlab-widgets = super.jupyterlab-widgets.overridePythonAttrs (
+        old: rec {
+          buildInputs = (old.buildInputs or [ ]) ++ [ self.jupyter-packaging ];
+        }
+      );
+
+      kerberos = super.kerberos.overrideAttrs (old: {
+        nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.libkrb5 ];
+      });
+
+      keyring = super.keyring.overridePythonAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ]) ++ [
+            self.toml
+          ];
+        }
+      );
+
+      kiwisolver = super.kiwisolver.overridePythonAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ]) ++ [
+            self.cppy
+          ];
+        }
+      );
+
+      lap = super.lap.overridePythonAttrs (
+        old: {
+          propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [
+            self.numpy
+          ];
+        }
+      );
+
+      libvirt-python = super.libvirt-python.overridePythonAttrs ({ nativeBuildInputs ? [ ], ... }: {
+        nativeBuildInputs = nativeBuildInputs ++ [ pkg-config ];
+        propagatedBuildInputs = [ pkgs.libvirt ];
+      });
+
+      llvmlite = super.llvmlite.overridePythonAttrs (
+        old:
+        let
+          llvm =
+            if lib.versionAtLeast old.version "0.37.0" then
+              pkgs.llvmPackages_11.llvm
+            else if (lib.versionOlder old.version "0.37.0" && lib.versionAtLeast old.version "0.34.0") then
+              pkgs.llvmPackages_10.llvm
+            else if (lib.versionOlder old.version "0.34.0" && lib.versionAtLeast old.version "0.33.0") then
+              pkgs.llvmPackages_9.llvm
+            else if (lib.versionOlder old.version "0.33.0" && lib.versionAtLeast old.version "0.29.0") then
+              pkgs.llvmPackages_8.llvm
+            else if (lib.versionOlder old.version "0.28.0" && lib.versionAtLeast old.version "0.27.0") then
+              pkgs.llvmPackages_7.llvm
+            else if (lib.versionOlder old.version "0.27.0" && lib.versionAtLeast old.version "0.23.0") then
+              pkgs.llvmPackages_6.llvm
+            else if (lib.versionOlder old.version "0.23.0" && lib.versionAtLeast old.version "0.21.0") then
+              pkgs.llvmPackages_5.llvm
+            else
+              pkgs.llvm; # Likely to fail.
+        in
+        {
+          nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.llvm ];
+
+          # Disable static linking
+          # https://github.com/numba/llvmlite/issues/93
+          postPatch = ''
+            substituteInPlace ffi/Makefile.linux --replace "-static-libstdc++" ""
+
+            substituteInPlace llvmlite/tests/test_binding.py --replace "test_linux" "nope"
+          '';
+
+          # Set directory containing llvm-config binary
+          preConfigure = ''
+            export LLVM_CONFIG=${llvm.dev}/bin/llvm-config
+          '';
+
+          __impureHostDeps = lib.optionals pkgs.stdenv.isDarwin [ "/usr/lib/libm.dylib" ];
+
+          passthru = old.passthru // { llvm = llvm; };
+        }
+      );
+
+      lxml = super.lxml.overridePythonAttrs (
+        old: {
+          nativeBuildInputs = with pkgs.buildPackages; (old.nativeBuildInputs or [ ]) ++ [ pkg-config libxml2.dev libxslt.dev ] ++ lib.optionals stdenv.isDarwin [ xcodebuild ];
+          buildInputs = with pkgs; (old.buildInputs or [ ]) ++ [ libxml2 libxslt ];
+        }
+      );
+
+      markupsafe = super.markupsafe.overridePythonAttrs (
+        old: {
+          src = old.src.override { pname = builtins.replaceStrings [ "markupsafe" ] [ "MarkupSafe" ] old.pname; };
+        }
+      );
+
+      matplotlib = super.matplotlib.overridePythonAttrs (
+        old:
+        let
+          enableGhostscript = old.passthru.args.enableGhostscript or false;
+          enableGtk3 = old.passthru.args.enableGtk3 or false;
+          enableQt = old.passthru.args.enableQt or false;
+          enableTk = old.passthru.args.enableTk or false;
+
+          interactive = enableTk || enableGtk3 || enableQt;
+
+          passthru = {
+            config = {
+              directories = { basedirlist = "."; };
+              libs = {
+                system_freetype = true;
+                system_qhull = true;
+              } // lib.optionalAttrs stdenv.isDarwin {
+                # LTO not working in darwin stdenv, see Nixpkgs #19312
+                enable_lto = false;
+              };
+            };
+          };
+
+          inherit (pkgs) tk tcl wayland qhull;
+          inherit (pkgs.xorg) libX11;
+          inherit (pkgs.darwin.apple_sdk.frameworks) Cocoa;
+        in
+        {
+          XDG_RUNTIME_DIR = "/tmp";
+
+          buildInputs = old.buildInputs or [ ] ++ [
+            pkgs.which
+          ] ++ lib.optional enableGhostscript [
+            pkgs.ghostscript
+          ] ++ lib.optional stdenv.isDarwin [
+            Cocoa
+          ];
+
+          propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [
+            self.certifi
+            pkgs.libpng
+            pkgs.freetype
+            qhull
+          ]
+            ++ lib.optionals enableGtk3 [ pkgs.cairo self.pycairo pkgs.gtk3 pkgs.gobject-introspection self.pygobject3 ]
+            ++ lib.optionals enableTk [ pkgs.tcl pkgs.tk self.tkinter pkgs.libX11 ]
+            ++ lib.optionals enableQt [ self.pyqt5 ]
+          ;
+
+          nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [
+            pkg-config
+          ] ++ lib.optional (lib.versionAtLeast super.matplotlib.version "3.5.0") [
+            self.setuptools-scm
+            self.setuptools-scm-git-archive
+          ];
+
+          passthru = old.passthru or { } // passthru;
+
+          MPLSETUPCFG = pkgs.writeText "mplsetup.cfg" (lib.generators.toINI { } passthru.config);
+
+          # Matplotlib tries to find Tcl/Tk by opening a Tk window and asking the
+          # corresponding interpreter object for its library paths. This fails if
+          # `$DISPLAY` is not set. The fallback option assumes that Tcl/Tk are both
+          # installed under the same path which is not true in Nix.
+          # With the following patch we just hard-code these paths into the install
+          # script.
+          postPatch =
+            let
+              tcl_tk_cache = ''"${tk}/lib", "${tcl}/lib", "${lib.strings.substring 0 3 tk.version}"'';
+            in
+            lib.optionalString enableTk ''
+              sed -i '/self.tcl_tk_cache = None/s|None|${tcl_tk_cache}|' setupext.py
+            '' + lib.optionalString (stdenv.isLinux && interactive) ''
+              # fix paths to libraries in dlopen calls (headless detection)
+              substituteInPlace src/_c_internal_utils.c \
+                --replace libX11.so.6 ${libX11}/lib/libX11.so.6 \
+                --replace libwayland-client.so.0 ${wayland}/lib/libwayland-client.so.0
+            '' +
+            # avoid matplotlib trying to download dependencies
+            ''
+              echo "[libs]
+              system_freetype=true
+              system_qhull=true" > mplsetup.cfg
+            '';
+
+        }
+      );
+
+      # Calls Cargo at build time for source builds and is really tricky to package
+      maturin = super.maturin.override {
+        preferWheel = true;
+      };
+
+      mccabe = super.mccabe.overridePythonAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ]) ++ [ self.pytest-runner ];
+          doCheck = false;
+        }
+      );
+
+      mip = super.mip.overridePythonAttrs (
+        old: {
+          nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.autoPatchelfHook ];
+
+          buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.zlib self.cppy ];
+        }
+      );
+
+      mmdet = super.mmdet.overridePythonAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ]) ++ [ self.pytorch ];
+        }
+      );
+
+      molecule =
+        if lib.versionOlder super.molecule.version "3.0.0" then
+          (super.molecule.overridePythonAttrs (
+            old: {
+              patches = (old.patches or [ ]) ++ [
+                # Fix build with more recent setuptools versions
+                (pkgs.fetchpatch {
+                  url = "https://github.com/ansible-community/molecule/commit/c9fee498646a702c77b5aecf6497cff324acd056.patch";
+                  sha256 = "1g1n45izdz0a3c9akgxx14zhdw6c3dkb48j8pq64n82fa6ndl1b7";
+                  excludes = [ "pyproject.toml" ];
+                })
+              ];
+              buildInputs = (old.buildInputs or [ ]) ++ [ self.setuptools-scm-git-archive ];
+            }
+          )) else
+          super.molecule.overridePythonAttrs (old: {
+            buildInputs = (old.buildInputs or [ ]) ++ [ self.setuptools-scm-git-archive ];
+          });
+
+      mpi4py = super.mpi4py.overridePythonAttrs (
+        old:
+        let
+          cfg = pkgs.writeTextFile {
+            name = "mpi.cfg";
+            text = (
+              lib.generators.toINI
+                { }
+                {
+                  mpi = {
+                    mpicc = "${pkgs.mpi.outPath}/bin/mpicc";
+                  };
+                }
+            );
+          };
+        in
+        {
+          propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ pkgs.mpi ];
+          enableParallelBuilding = true;
+          preBuild = ''
+            ln -sf ${cfg} mpi.cfg
+          '';
+        }
+      );
+
+      multiaddr = super.multiaddr.overridePythonAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ]) ++ [ self.pytest-runner ];
+        }
+      );
+
+      mypy = super.mypy.overridePythonAttrs (
+        old: {
+          # FIXME: Remove patch after upstream has decided the proper solution.
+          #        https://github.com/python/mypy/pull/11143
+          patches = (old.patches or [ ]) ++ lib.optionals ((lib.strings.versionAtLeast old.version "0.900") && lib.strings.versionOlder old.version "0.940") [
+            (pkgs.fetchpatch {
+              url = "https://github.com/python/mypy/commit/f1755259d54330cd087cae763cd5bbbff26e3e8a.patch";
+              sha256 = "sha256-5gPahX2X6+/qUaqDQIGJGvh9lQ2EDtks2cpQutgbOHk=";
+            })
+          ] ++ lib.optionals (lib.strings.versionAtLeast old.version "0.940") [
+            (pkgs.fetchpatch {
+              url = "https://github.com/python/mypy/commit/e7869f05751561958b946b562093397027f6d5fa.patch";
+              sha256 = "sha256-waIZ+m3tfvYE4HJ8kL6rN/C4fMjvLEe9UoPbt9mHWIM=";
+            })
+          ];
+          buildInputs = (old.buildInputs or [ ]) ++ [
+            self.types-typed-ast
+          ];
+          # Compile mypy with mypyc, which makes mypy about 4 times faster. The compiled
+          # version is also the default in the wheels on Pypi that include binaries.
+          # is64bit: unfortunately the build would exhaust all possible memory on i686-linux.
+          MYPY_USE_MYPYC = stdenv.buildPlatform.is64bit;
+
+          # when testing reduce optimisation level to drastically reduce build time
+          # (default is 3)
+          # MYPYC_OPT_LEVEL = 1;
+        }
+      );
+
+      mysqlclient = super.mysqlclient.overridePythonAttrs (
+        old: {
+          nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.libmysqlclient ];
+          buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.libmysqlclient ];
+        }
+      );
+
+      netcdf4 = super.netcdf4.overridePythonAttrs (
+        old: {
+          propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [
+            pkgs.zlib
+            pkgs.netcdf
+            pkgs.hdf5
+            pkgs.curl
+            pkgs.libjpeg
+          ];
+
+          # Variables used to configure the build process
+          USE_NCCONFIG = "0";
+          HDF5_DIR = lib.getDev pkgs.hdf5;
+          NETCDF4_DIR = pkgs.netcdf;
+          CURL_DIR = pkgs.curl.dev;
+          JPEG_DIR = pkgs.libjpeg.dev;
+        }
+      );
+
+      numpy = super.numpy.overridePythonAttrs (
+        old:
+        let
+          blas = old.passthru.args.blas or pkgs.openblasCompat;
+          blasImplementation = lib.nameFromURL blas.name "-";
+          cfg = pkgs.writeTextFile {
+            name = "site.cfg";
+            text = (
+              lib.generators.toINI
+                { }
+                {
+                  ${blasImplementation} = {
+                    include_dirs = "${blas}/include";
+                    library_dirs = "${blas}/lib";
+                  } // lib.optionalAttrs (blasImplementation == "mkl") {
+                    mkl_libs = "mkl_rt";
+                    lapack_libs = "";
+                  };
+                }
+            );
+          };
+        in
+        {
+          nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.gfortran ];
+          buildInputs = (old.buildInputs or [ ]) ++ [ blas ];
+          enableParallelBuilding = true;
+          preBuild = ''
+            ln -s ${cfg} site.cfg
+          '';
+          passthru = old.passthru // {
+            blas = blas;
+            inherit blasImplementation cfg;
+          };
+        }
+      );
+
+      open3d = super.open3d.overridePythonAttrs (old: {
+        buildInputs = (old.buildInputs or [ ]) ++ (with pkgs; [
+          udev
+        ]);
+        # TODO(Sem Mulder): Add overridable flags for CUDA/PyTorch/Tensorflow support.
+        autoPatchelfIgnoreMissingDeps = true;
+      });
+
+      opencv-python = super.opencv-python.overridePythonAttrs (
+        old: {
+          nativeBuildInputs = [ pkgs.cmake ] ++ old.nativeBuildInputs;
+          buildInputs = [ self.scikit-build ] ++ (old.buildInputs or [ ]);
+          dontUseCmakeConfigure = true;
+        }
+      );
+
+      opencv-contrib-python = super.opencv-contrib-python.overridePythonAttrs (
+        old: {
+          nativeBuildInputs = [ pkgs.cmake ] ++ old.nativeBuildInputs;
+          buildInputs = [ self.scikit-build ] ++ (old.buildInputs or [ ]);
+          dontUseCmakeConfigure = true;
+        }
+      );
+
+      openexr = super.openexr.overridePythonAttrs (
+        old: rec {
+          buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.openexr pkgs.ilmbase ];
+          NIX_CFLAGS_COMPILE = [ "-I${pkgs.openexr.dev}/include/OpenEXR" "-I${pkgs.ilmbase.dev}/include/OpenEXR" ];
+        }
+      );
+
+      osqp = super.osqp.overridePythonAttrs (
+        old: {
+          nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.cmake ];
+          dontUseCmakeConfigure = true;
+        }
+      );
+
+      pantalaimon = super.pantalaimon.overridePythonAttrs (old: {
+        nativeBuildInputs = old.nativeBuildInputs or [ ] ++ [ pkgs.installShellFiles ];
+        postInstall = old.postInstall or "" + ''
+          installManPage docs/man/*.[1-9]
+        '';
+      });
+
+      paramiko = super.paramiko.overridePythonAttrs (old: {
+        doCheck = false; # requires networking
+      });
+
+      parsel = super.parsel.overridePythonAttrs (
+        old: rec {
+          nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ self.pytest-runner ];
+        }
+      );
+
+      pdal = super.pdal.overridePythonAttrs (
+        old: {
+          PDAL_CONFIG = "${pkgs.pdal}/bin/pdal-config";
+        }
+      );
+
+      peewee = super.peewee.overridePythonAttrs (
+        old:
+        let
+          withPostgres = old.passthru.withPostgres or false;
+          withMysql = old.passthru.withMysql or false;
+        in
+        {
+          buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.sqlite ];
+          propagatedBuildInputs = (old.propagatedBuildInputs or [ ])
+            ++ lib.optional withPostgres self.psycopg2
+            ++ lib.optional withMysql self.mysql-connector;
+        }
+      );
+
+      pikepdf = super.pikepdf.overridePythonAttrs (
+        old: {
+          buildInputs = old.buildInputs or [ ] ++ [ pkgs.qpdf self.pybind11 ];
+          pythonImportsCheck = old.pythonImportsCheck or [ ] ++ [ "pikepdf" ];
+        }
+      );
+
+      pillow = super.pillow.overridePythonAttrs (
+        old: {
+          nativeBuildInputs = [ pkg-config self.pytest-runner ] ++ (old.nativeBuildInputs or [ ]);
+          buildInputs = with pkgs; [ freetype libjpeg zlib libtiff libwebp tcl lcms2 ] ++ (old.buildInputs or [ ]);
+        }
+      );
+
+      poetry-core = super.poetry-core.overridePythonAttrs (old: {
+        # "Vendor" dependencies (for build-system support)
+        postPatch = ''
+          echo "import sys" >> poetry/__init__.py
+          for path in $propagatedBuildInputs; do
+              echo "sys.path.insert(0, \"$path\")" >> poetry/__init__.py
+          done
+        '';
+
+        # Propagating dependencies leads to issues downstream
+        # We've already patched poetry to prefer "vendored" dependencies
+        postFixup = ''
+          rm $out/nix-support/propagated-build-inputs
+        '';
+      });
+
+      portend = super.portend.overridePythonAttrs (
+        old: {
+          # required for the extra "toml" dependency in setuptools_scm[toml]
+          buildInputs = (old.buildInputs or [ ]) ++ [
+            self.toml
+          ];
+        }
+      );
+
+      prettytable = super.prettytable.overridePythonAttrs (old: {
+        propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ self.setuptools ];
+      });
+
+      psycopg2 = super.psycopg2.overridePythonAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ])
+            ++ lib.optional stdenv.isDarwin pkgs.openssl;
+          nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.postgresql ];
+        }
+      );
+
+      psycopg2-binary = super.psycopg2-binary.overridePythonAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ])
+            ++ lib.optional stdenv.isDarwin pkgs.openssl;
+          nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.postgresql ];
+        }
+      );
+
+      py-solc-x = super.py-solc-x.overridePythonAttrs (
+        old: {
+          preConfigure = ''
+            substituteInPlace setup.py --replace \'setuptools-markdown\' ""
+          '';
+          propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ self.requests self.semantic-version ];
+        }
+      );
+
+      pyarrow =
+        if lib.versionAtLeast super.pyarrow.version "0.16.0" then
+          super.pyarrow.overridePythonAttrs
+            (
+              old:
+              let
+                parseMinor = drv: lib.concatStringsSep "." (lib.take 2 (lib.splitVersion drv.version));
+
+                # Starting with nixpkgs revision f149c7030a7, pyarrow takes "python3" as an argument
+                # instead of "python". Below we inspect function arguments to maintain compatibilitiy.
+                _arrow-cpp = pkgs.arrow-cpp.override (
+                  builtins.intersectAttrs
+                    (lib.functionArgs pkgs.arrow-cpp.override)
+                    { python = self.python; python3 = self.python; }
+                );
+
+                ARROW_HOME = _arrow-cpp;
+                arrowCppVersion = parseMinor _arrow-cpp;
+                pyArrowVersion = parseMinor super.pyarrow;
+                errorMessage = "arrow-cpp version (${arrowCppVersion}) mismatches pyarrow version (${pyArrowVersion})";
+              in
+              if arrowCppVersion != pyArrowVersion then throw errorMessage else {
+
+                nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [
+                  pkg-config
+                  pkgs.cmake
+                ];
+
+                preBuild = ''
+                  export PYARROW_PARALLEL=$NIX_BUILD_CORES
+                '';
+
+                PARQUET_HOME = _arrow-cpp;
+                inherit ARROW_HOME;
+
+                PYARROW_BUILD_TYPE = "release";
+                PYARROW_WITH_FLIGHT = if _arrow-cpp.enableFlight then 1 else 0;
+                PYARROW_WITH_DATASET = 1;
+                PYARROW_WITH_PARQUET = 1;
+                PYARROW_CMAKE_OPTIONS = [
+                  "-DCMAKE_INSTALL_RPATH=${ARROW_HOME}/lib"
+
+                  # This doesn't use setup hook to call cmake so we need to workaround #54606
+                  # ourselves
+                  "-DCMAKE_POLICY_DEFAULT_CMP0025=NEW"
+                ];
+
+                dontUseCmakeConfigure = true;
+              }
+            ) else
+          super.pyarrow;
+
+      pycairo = (
+        drv: (
+          drv.overridePythonAttrs (
+            _: {
+              format = "other";
+            }
+          )
+        ).overridePythonAttrs (
+          old: {
+
+            nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [
+              pkgs.meson
+              pkgs.ninja
+              pkg-config
+            ];
+
+            propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [
+              pkgs.cairo
+              pkgs.xlibsWrapper
+            ];
+
+            mesonFlags = [ "-Dpython=${if self.isPy3k then "python3" else "python"}" ];
+          }
+        )
+      )
+        super.pycairo;
+
+      pycocotools = super.pycocotools.overridePythonAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ]) ++ [
+            self.numpy
+          ];
+        }
+      );
+
+      pyfuse3 = super.pyfuse3.overridePythonAttrs (old: {
+        nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkg-config ];
+        buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.fuse3 ];
+      });
+
+      pygame = super.pygame.overridePythonAttrs (
+        old: rec {
+          nativeBuildInputs = [
+            pkg-config
+            pkgs.SDL
+          ];
+
+          buildInputs = [
+            pkgs.SDL
+            pkgs.SDL_image
+            pkgs.SDL_mixer
+            pkgs.SDL_ttf
+            pkgs.libpng
+            pkgs.libjpeg
+            pkgs.portmidi
+            pkgs.xorg.libX11
+            pkgs.freetype
+          ];
+
+          # Tests fail because of no audio device and display.
+          doCheck = false;
+          preConfigure = ''
+                    sed \
+                      -e "s/origincdirs = .*/origincdirs = []/" \
+                      -e "s/origlibdirs = .*/origlibdirs = []/" \
+                      -e "/'\/lib\/i386-linux-gnu', '\/lib\/x86_64-linux-gnu']/d" \
+                      -e "/\/include\/smpeg/d" \
+                      -i buildconfig/config_unix.py
+                    ${lib.concatMapStrings
+            (dep: ''
+                      sed \
+                        -e "/origincdirs =/a\        origincdirs += ['${lib.getDev dep}/include']" \
+                        -e "/origlibdirs =/a\        origlibdirs += ['${lib.getLib dep}/lib']" \
+                        -i buildconfig/config_unix.py
+                    '')
+            buildInputs
+                    }
+                    LOCALBASE=/ ${self.python.interpreter} buildconfig/config.py
+          '';
+        }
+      );
+
+      pygeos = super.pygeos.overridePythonAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.geos ];
+          nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.geos ];
+        }
+      );
+
+      pygobject = super.pygobject.overridePythonAttrs (
+        old: {
+          nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkg-config ];
+          buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.glib pkgs.gobject-introspection ];
+        }
+      );
+
+      pylint = super.pylint.overridePythonAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ]) ++ [ self.pytest-runner ];
+        }
+      );
+
+      pymediainfo = super.pymediainfo.overridePythonAttrs (
+        old: {
+          postPatch = (old.postPatch or "") + ''
+            substituteInPlace pymediainfo/__init__.py \
+              --replace "libmediainfo.0.dylib" \
+                        "${pkgs.libmediainfo}/lib/libmediainfo.0${stdenv.hostPlatform.extensions.sharedLibrary}" \
+              --replace "libmediainfo.dylib" \
+                        "${pkgs.libmediainfo}/lib/libmediainfo${stdenv.hostPlatform.extensions.sharedLibrary}" \
+              --replace "libmediainfo.so.0" \
+                        "${pkgs.libmediainfo}/lib/libmediainfo${stdenv.hostPlatform.extensions.sharedLibrary}.0"
+          '';
+        }
+      );
+
+      pymssql = super.pymssql.overridePythonAttrs (old: {
+        buildInputs = (old.buildInputs or [ ])
+          ++ [ pkgs.openssl ];
+        propagatedBuildInputs = (old.propagatedBuildInputs or [ ])
+          ++ [ pkgs.freetds ];
+      });
+
+      pyopenssl = super.pyopenssl.overridePythonAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.openssl ];
+        }
+      );
+
+      pyproj = super.pyproj.overridePythonAttrs (
+        old: {
+          PROJ_DIR = "${pkgs.proj}";
+          PROJ_LIBDIR = "${pkgs.proj}/lib";
+          PROJ_INCDIR = "${pkgs.proj.dev}/include";
+        }
+      );
+
+      pyrfr = super.pyrfr.overridePythonAttrs (old: {
+        nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.swig ];
+      });
+
+      pytaglib = super.pytaglib.overridePythonAttrs (old: {
+        buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.taglib ];
+      });
+
+      pytezos = super.pytezos.overridePythonAttrs (old: {
+        buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.libsodium ];
+      });
+
+      python-bugzilla = super.python-bugzilla.overridePythonAttrs (
+        old: {
+          nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [
+            self.docutils
+          ];
+        }
+      );
+
+      python-ldap = super.python-ldap.overridePythonAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.openldap pkgs.cyrus_sasl ];
+        }
+      );
+
+      pytoml = super.pytoml.overridePythonAttrs (
+        old: {
+          doCheck = false;
+        }
+      );
+
+      pyqt5 =
+        let
+          drv = super.pyqt5;
+          withConnectivity = drv.passthru.args.withConnectivity or false;
+          withMultimedia = drv.passthru.args.withMultimedia or false;
+          withWebKit = drv.passthru.args.withWebKit or false;
+          withWebSockets = drv.passthru.args.withWebSockets or false;
+        in
+        super.pyqt5.overridePythonAttrs (
+          old: {
+            format = "other";
+
+            dontWrapQtApps = true;
+
+            nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [
+              pkg-config
+              pkgs.qt5.qmake
+              pkgs.xorg.lndir
+              pkgs.qt5.qtbase
+              pkgs.qt5.qtsvg
+              pkgs.qt5.qtdeclarative
+              pkgs.qt5.qtwebchannel
+              pkgs.qt5.qt3d
+              # self.pyqt5-sip
+              self.sip
+            ]
+              ++ lib.optional withConnectivity pkgs.qt5.qtconnectivity
+              ++ lib.optional withMultimedia pkgs.qt5.qtmultimedia
+              ++ lib.optional withWebKit pkgs.qt5.qtwebkit
+              ++ lib.optional withWebSockets pkgs.qt5.qtwebsockets
+            ;
+
+            buildInputs = (old.buildInputs or [ ]) ++ [
+              pkgs.dbus
+              pkgs.qt5.qtbase
+              pkgs.qt5.qtsvg
+              pkgs.qt5.qtdeclarative
+              self.sip
+            ]
+              ++ lib.optional withConnectivity pkgs.qt5.qtconnectivity
+              ++ lib.optional withWebKit pkgs.qt5.qtwebkit
+              ++ lib.optional withWebSockets pkgs.qt5.qtwebsockets
+            ;
+
+            # Fix dbus mainloop
+            patches = pkgs.python3.pkgs.pyqt5.patches or [ ];
+
+            configurePhase = ''
+              runHook preConfigure
+
+              export PYTHONPATH=$PYTHONPATH:$out/${self.python.sitePackages}
+
+              mkdir -p $out/${self.python.sitePackages}/dbus/mainloop
+              ${self.python.executable} configure.py  -w \
+                --confirm-license \
+                --no-qml-plugin \
+                --bindir=$out/bin \
+                --destdir=$out/${self.python.sitePackages} \
+                --stubsdir=$out/${self.python.sitePackages}/PyQt5 \
+                --sipdir=$out/share/sip/PyQt5 \
+                --designer-plugindir=$out/plugins/designer
+
+              runHook postConfigure
+            '';
+
+            postInstall = ''
+              ln -s ${self.pyqt5-sip}/${self.python.sitePackages}/PyQt5/sip.* $out/${self.python.sitePackages}/PyQt5/
+              for i in $out/bin/*; do
+                wrapProgram $i --prefix PYTHONPATH : "$PYTHONPATH"
+              done
+
+              # Let's make it a namespace package
+              cat << EOF > $out/${self.python.sitePackages}/PyQt5/__init__.py
+              from pkgutil import extend_path
+              __path__ = extend_path(__path__, __name__)
+              EOF
+            '';
+
+            installCheckPhase =
+              let
+                modules = [
+                  "PyQt5"
+                  "PyQt5.QtCore"
+                  "PyQt5.QtQml"
+                  "PyQt5.QtWidgets"
+                  "PyQt5.QtGui"
+                ]
+                ++ lib.optional withWebSockets "PyQt5.QtWebSockets"
+                ++ lib.optional withWebKit "PyQt5.QtWebKit"
+                ++ lib.optional withMultimedia "PyQt5.QtMultimedia"
+                ++ lib.optional withConnectivity "PyQt5.QtConnectivity"
+                ;
+                imports = lib.concatMapStrings (module: "import ${module};") modules;
+              in
+              ''
+                echo "Checking whether modules can be imported..."
+                ${self.python.interpreter} -c "${imports}"
+              '';
+
+            doCheck = true;
+
+            enableParallelBuilding = true;
+          }
+        );
+
+      pytest-datadir = super.pytest-datadir.overridePythonAttrs (
+        old: {
+          postInstall = ''
+            rm -f $out/LICENSE
+          '';
+        }
+      );
+
+      pytest = super.pytest.overridePythonAttrs (
+        old: {
+          # Fixes https://github.com/pytest-dev/pytest/issues/7891
+          postPatch = old.postPatch or "" + ''
+            sed -i '/\[metadata\]/aversion = ${old.version}' setup.cfg
+          '';
+        }
+      );
+
+      pytest-django = super.pytest-django.overridePythonAttrs (
+        old: {
+          postPatch = ''
+            substituteInPlace setup.py --replace "'pytest>=3.6'," ""
+            substituteInPlace setup.py --replace "'pytest>=3.6'" ""
+          '';
+        }
+      );
+
+      pytest-randomly = super.pytest-randomly.overrideAttrs (old: {
+        propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [
+          self.importlib-metadata
+        ];
+      });
+
+      pytest-runner = super.pytest-runner or super.pytestrunner;
+
+      pytest-pylint = super.pytest-pylint.overridePythonAttrs (
+        old: {
+          buildInputs = [ self.pytest-runner ];
+        }
+      );
+
+      # pytest-splinter seems to put a .marker file in an empty directory
+      # presumably so it's tracked by and can be installed with MANIFEST.in, see
+      # https://github.com/pytest-dev/pytest-splinter/commit/a48eeef662f66ff9d3772af618748e73211a186b
+      #
+      # This directory then gets used as an empty initial profile directory and is
+      # zipped up. But if the .marker file is in the Nix store, it has the
+      # creation date of 1970, and Zip doesn't work with such old files, so it
+      # fails at runtime!
+      #
+      # We fix this here by just removing the file after the installation
+      #
+      # The error you get without this is:
+      #
+      # E           ValueError: ZIP does not support timestamps before 1980
+      # /nix/store/55b9ip7xkpimaccw9pa0vacy5q94f5xa-python3-3.7.6/lib/python3.7/zipfile.py:357: ValueError
+      pytest-splinter = super.pytest-splinter.overrideAttrs (old: {
+        postInstall = old.postInstall or "" + ''
+          rm $out/${super.python.sitePackages}/pytest_splinter/profiles/firefox/.marker
+        '';
+      });
+
+      python-jose = super.python-jose.overridePythonAttrs (
+        old: {
+          buildInputs = [ self.pytest-runner ];
+        }
+      );
+
+      python-magic = super.python-magic.overridePythonAttrs (
+        old: {
+          postPatch = ''
+            substituteInPlace magic/loader.py \
+              --replace "'libmagic.so.1'" "'${lib.getLib pkgs.file}/lib/libmagic.so.1'"
+          '';
+          pythonImportsCheck = old.pythonImportsCheck or [ ] ++ [ "magic" ];
+        }
+      );
+
+      python-olm = super.python-olm.overridePythonAttrs (
+        old: {
+          buildInputs = old.buildInputs or [ ] ++ [ pkgs.olm ];
+        }
+      );
+
+      python-snappy = super.python-snappy.overridePythonAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.snappy ];
+        }
+      );
+
+      pythran = super.pythran.overridePythonAttrs (old: {
+        buildInputs = (old.buildInputs or [ ]) ++ [ self.pytest-runner ];
+      });
+
+      ffmpeg-python = super.ffmpeg-python.overridePythonAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ]) ++ [ self.pytest-runner ];
+        }
+      );
+
+      python-prctl = super.python-prctl.overridePythonAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ]) ++ [
+            pkgs.libcap
+          ];
+        }
+      );
+
+      pyudev = super.pyudev.overridePythonAttrs (old: {
+        postPatch = ''
+          substituteInPlace src/pyudev/_ctypeslib/utils.py \
+            --replace "find_library(name)" "'${lib.getLib pkgs.systemd}/lib/libudev.so'"
+        '';
+      });
+
+      pyusb = super.pyusb.overridePythonAttrs (
+        old: {
+          postPatch = ''
+            libusb=${pkgs.libusb1.out}/lib/libusb-1.0${pkgs.stdenv.hostPlatform.extensions.sharedLibrary}
+            test -f $libusb || { echo "ERROR: $libusb doesn't exist, please update/fix this build expression."; exit 1; }
+            sed -i -e "s|find_library=None|find_library=lambda _:\"$libusb\"|" usb/backend/libusb1.py
+          '';
+        }
+      );
+
+      pywavelets = super.pywavelets.overridePythonAttrs (
+        old: {
+          HDF5_DIR = "${pkgs.hdf5}";
+          propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ pkgs.hdf5 ];
+        }
+      );
+
+      pyzmq = super.pyzmq.overridePythonAttrs (
+        old: {
+          nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkg-config ];
+          propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ pkgs.zeromq ];
+        }
+      );
+
+      rockset = super.rockset.overridePythonAttrs (
+        old: rec {
+          postPatch = ''
+            cp ./setup_rockset.py ./setup.py
+          '';
+        }
+      );
+
+      scaleapi = super.scaleapi.overridePythonAttrs (
+        old: {
+          postPatch = ''
+            substituteInPlace setup.py --replace "install_requires = ['requests>=2.4.2', 'enum34']" "install_requires = ['requests>=2.4.2']" || true
+          '';
+        }
+      );
+
+      panel = super.panel.overridePythonAttrs (
+        old: {
+          nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.nodejs ];
+        }
+      );
+
+      # Pybind11 is an undeclared dependency of scipy that we need to pick from nixpkgs
+      # Make it not fail with infinite recursion
+      pybind11 = super.pybind11.overridePythonAttrs (
+        old: {
+          cmakeFlags = (old.cmakeFlags or [ ]) ++ [
+            "-DPYBIND11_TEST=off"
+          ];
+          doCheck = false; # Circular test dependency
+        }
+      );
+
+      rlp = super.rlp.overridePythonAttrs {
+        preConfigure = ''
+          substituteInPlace setup.py --replace \'setuptools-markdown\' ""
+        '';
+      };
+
+      rmfuse = super.rmfuse.overridePythonAttrs (old: {
+        propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ self.setuptools ];
+      });
+
+      rtree = super.rtree.overridePythonAttrs (old: {
+        propagatedNativeBuildInputs = (old.propagatedNativeBuildInputs or [ ]) ++ [ pkgs.libspatialindex ];
+        postPatch = ''
+          substituteInPlace rtree/finder.py --replace \
+            "find_library('spatialindex_c')" \
+            "'${pkgs.libspatialindex}/lib/libspatialindex_c${pkgs.stdenv.hostPlatform.extensions.sharedLibrary}'"
+        '';
+      });
+
+      ruamel-yaml = super.ruamel-yaml.overridePythonAttrs (
+        old: {
+          propagatedBuildInputs = (old.propagatedBuildInputs or [ ])
+            ++ [ self.ruamel-yaml-clib ];
+        }
+      );
+
+      scipy = super.scipy.overridePythonAttrs (
+        old:
+        if old.format != "wheel" then {
+          nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++
+            [ pkgs.gfortran ] ++
+            lib.optional (lib.versionAtLeast super.scipy.version "1.7.0") [ self.pythran ];
+          propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ self.pybind11 ];
+          setupPyBuildFlags = [ "--fcompiler='gnu95'" ];
+          enableParallelBuilding = true;
+          buildInputs = (old.buildInputs or [ ]) ++ [ self.numpy.blas ];
+          preConfigure = ''
+            sed -i '0,/from numpy.distutils.core/s//import setuptools;from numpy.distutils.core/' setup.py
+            export NPY_NUM_BUILD_JOBS=$NIX_BUILD_CORES
+          '';
+          preBuild = ''
+            ln -s ${self.numpy.cfg} site.cfg
+          '';
+        } else old
+      );
+
+      scikit-image = super.scikit-image.overridePythonAttrs (
+        old: {
+          nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [
+            self.pythran
+            self.packaging
+            self.wheel
+            self.numpy
+          ];
+        }
+      );
+
+      scikit-learn = super.scikit-learn.overridePythonAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ]) ++ [
+            pkgs.gfortran
+          ] ++ lib.optionals stdenv.cc.isClang [
+            pkgs.llvmPackages.openmp
+          ] ++ lib.optionals stdenv.isLinux [
+            pkgs.glibcLocales
+          ];
+
+          enableParallelBuilding = true;
+        }
+      );
+
+      secp256k1 = super.secp256k1.overridePythonAttrs (old: {
+        nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.pkgconfig pkgs.autoconf pkgs.automake pkgs.libtool ];
+        buildInputs = (old.buildInputs or [ ]) ++ [ self.pytest-runner ];
+        doCheck = false;
+        # Local setuptools versions like "x.y.post0" confuse an internal check
+        postPatch = ''
+          substituteInPlace setup.py \
+            --replace 'setuptools_version.' '"${self.setuptools.version}".'
+        '';
+      });
+
+      shapely = super.shapely.overridePythonAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.geos ];
+          inherit (pkgs.python3.pkgs.shapely) patches GEOS_LIBRARY_PATH;
+        }
+      );
+
+      shellcheck-py = super.shellcheck-py.overridePythonAttrs (old: {
+
+        # Make fetching/installing external binaries no-ops
+        preConfigure =
+          let
+            fakeCommand = "type('FakeCommand', (Command,), {'initialize_options': lambda self: None, 'finalize_options': lambda self: None, 'run': lambda self: None})";
+          in
+          ''
+            substituteInPlace setup.py \
+              --replace "'fetch_binaries': fetch_binaries," "'fetch_binaries': ${fakeCommand}," \
+              --replace "'install_shellcheck': install_shellcheck," "'install_shellcheck': ${fakeCommand},"
+          '';
+
+        propagatedUserEnvPkgs = (old.propagatedUserEnvPkgs or [ ]) ++ [
+          pkgs.shellcheck
+        ];
+
+      });
+
+      systemd-python = super.systemd-python.overridePythonAttrs (old: {
+        buildInputs = old.buildInputs ++ [ pkgs.systemd ];
+        nativeBuildInputs = old.nativeBuildInputs ++ [ pkgs.pkg-config ];
+      });
+
+      tables = super.tables.overridePythonAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ]) ++ [ self.pywavelets ];
+          HDF5_DIR = lib.getDev pkgs.hdf5;
+          nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkg-config ];
+          propagatedBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.hdf5 self.numpy self.numexpr ];
+        }
+      );
+
+      tempora = super.tempora.overridePythonAttrs (
+        old: {
+          # required for the extra "toml" dependency in setuptools_scm[toml]
+          buildInputs = (old.buildInputs or [ ]) ++ [
+            self.toml
+          ];
+        }
+      );
+
+      tensorboard = super.tensorboard.overridePythonAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ]) ++ [
+            self.wheel
+            self.absl-py
+          ];
+          HDF5_DIR = "${pkgs.hdf5}";
+          propagatedBuildInputs = (old.nativeBuildInputs or [ ]) ++ [
+            pkgs.hdf5
+            self.google-auth-oauthlib
+            self.tensorboard-plugin-wit
+            self.numpy
+            self.markdown
+            self.tensorboard-data-server
+            self.grpcio
+            self.protobuf
+            self.werkzeug
+            self.absl-py
+          ];
+        }
+      );
+
+      tensorflow = super.tensorflow.overridePythonAttrs (
+        old: {
+          postInstall = ''
+            rm $out/bin/tensorboard
+          '';
+        }
+      );
+
+      tensorpack = super.tensorpack.overridePythonAttrs (
+        old: {
+          postPatch = ''
+            substituteInPlace setup.cfg --replace "# will call find_packages()" ""
+          '';
+        }
+      );
+
+      tinycss2 = super.tinycss2.overridePythonAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ]) ++ [ self.pytest-runner ];
+        }
+      );
+
+      # The tokenizers build requires a complex rust setup (cf. nixpkgs override)
+      #
+      # Instead of providing a full source build, we use a wheel to keep
+      # the complexity manageable for now.
+      tokenizers = super.tokenizers.override {
+        preferWheel = true;
+      };
+
+      torch = lib.makeOverridable
+        ({ enableCuda ? false
+         , cudatoolkit ? pkgs.cudatoolkit_10_1
+         , pkg ? super.torch
+         }: pkg.overrideAttrs (old:
+          {
+            preConfigure =
+              if (!enableCuda) then ''
+                export USE_CUDA=0
+              '' else ''
+                export LD_LIBRARY_PATH="$LD_LIBRARY_PATH:${cudatoolkit}/targets/x86_64-linux/lib"
+              '';
+            preFixup = lib.optionalString (!enableCuda) ''
+              # For some reason pytorch retains a reference to libcuda even if it
+              # is explicitly disabled with USE_CUDA=0.
+              find $out -name "*.so" -exec ${pkgs.patchelf}/bin/patchelf --remove-needed libcuda.so.1 {} \;
+            '';
+            buildInputs =
+              (old.buildInputs or [ ])
+              ++ [ self.typing-extensions ]
+              ++ lib.optionals enableCuda [
+                pkgs.linuxPackages.nvidia_x11
+                pkgs.nccl.dev
+                pkgs.nccl.out
+              ];
+            propagatedBuildInputs = [
+              self.numpy
+              self.future
+              self.typing-extensions
+            ];
+          })
+        )
+        { };
+
+      torchvision = lib.makeOverridable
+        ({ enableCuda ? false
+         , cudatoolkit ? pkgs.cudatoolkit_10_1
+         , pkg ? super.torchvision
+         }: pkg.overrideAttrs (old: {
+
+          # without that autoPatchelfHook will fail because cudatoolkit is not in LD_LIBRARY_PATH
+          autoPatchelfIgnoreMissingDeps = true;
+          buildInputs = (old.buildInputs or [ ])
+            ++ [ self.torch ]
+            ++ lib.optionals enableCuda [
+            cudatoolkit
+          ];
+          preConfigure =
+            if (enableCuda) then ''
+              export LD_LIBRARY_PATH="$LD_LIBRARY_PATH:${self.torch}/${self.python.sitePackages}/torch/lib:${lib.makeLibraryPath [ cudatoolkit "${cudatoolkit}" ]}"
+            '' else ''
+              export LD_LIBRARY_PATH="$LD_LIBRARY_PATH:${self.torch}/${self.python.sitePackages}/torch/lib"
+            '';
+        }))
+        { };
+
+      typed_ast = super.typed-ast.overridePythonAttrs (old: {
+        nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [
+          self.pytest-runner
+        ];
+      });
+
+      urwidtrees = super.urwidtrees.overridePythonAttrs (
+        old: {
+          propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [
+            self.urwid
+          ];
+        }
+      );
+
+      vose-alias-method = super.vose-alias-method.overridePythonAttrs (
+        old: {
+          postInstall = ''
+            rm -f $out/LICENSE
+          '';
+        }
+      );
+
+      vispy = super.vispy.overrideAttrs (
+        old: {
+          inherit (pkgs.python3.pkgs.vispy) patches;
+          nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [
+            self.setuptools-scm-git-archive
+          ];
+        }
+      );
+
+      uvloop = super.uvloop.overridePythonAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ]) ++ lib.optionals stdenv.isDarwin [
+            pkgs.darwin.apple_sdk.frameworks.ApplicationServices
+            pkgs.darwin.apple_sdk.frameworks.CoreServices
+          ];
+        }
+      );
+
+
+      # Stop infinite recursion by using bootstrapped pkg from nixpkgs
+      bootstrapped-pip = super.bootstrapped-pip.override {
+        wheel = (pkgs.python3.pkgs.override {
+          python = self.python;
+        }).wheel;
+      };
+
+      weasyprint = super.weasyprint.overridePythonAttrs (
+        old: {
+          inherit (pkgs.python3.pkgs.weasyprint) patches;
+          nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ self.pytest-runner ];
+          buildInputs = (old.buildInputs or [ ]) ++ [ self.pytest-runner ];
+        }
+      );
+
+      web3 = super.web3.overridePythonAttrs {
+        preConfigure = ''
+          substituteInPlace setup.py --replace \'setuptools-markdown\' ""
+        '';
+      };
+
+      weblate-language-data = super.weblate-language-data.overridePythonAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ]) ++ [
+            self.translate-toolkit
+          ];
+        }
+      );
+
+      wheel =
+        let
+          isWheel = super.wheel.src.isWheel or false;
+          # If "wheel" is a pre-built binary wheel
+          wheelPackage = super.buildPythonPackage {
+            inherit (super.wheel) pname name version src;
+            inherit (pkgs.python3.pkgs.wheel) meta;
+            format = "wheel";
+          };
+          # If "wheel" is built from source
+          sourcePackage = ((
+            pkgs.python3.pkgs.override {
+              python = self.python;
+            }
+          ).wheel.override {
+            inherit (self) buildPythonPackage bootstrapped-pip setuptools;
+          }).overrideAttrs (old: {
+            inherit (super.wheel) pname name version src;
+          });
+        in
+        if isWheel then wheelPackage else sourcePackage;
+
+      zipp = if super.zipp == null then null else
+      super.zipp.overridePythonAttrs (
+        old: {
+          propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [
+            self.toml
+          ];
+        }
+      );
+
+      packaging =
+        let
+          old = super.packaging;
+        in
+        # From 20.5 until 20.7, packaging used flit for packaging (heh)
+          # See https://github.com/pypa/packaging/pull/352 and https://github.com/pypa/packaging/pull/367
+        if (lib.versionAtLeast old.version "20.5" && lib.versionOlder old.version "20.8") then
+          addBuildSystem
+            {
+              inherit self;
+              drv = old;
+              attr = "flit-core";
+            } else old;
+
+      psutil = super.psutil.overridePythonAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ]) ++
+            lib.optional stdenv.isDarwin pkgs.darwin.apple_sdk.frameworks.IOKit;
+        }
+      );
+
+      sentencepiece = super.sentencepiece.overridePythonAttrs (
+        old: {
+          dontUseCmakeConfigure = true;
+          nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [
+            pkg-config
+            pkgs.cmake
+            pkgs.gperftools
+          ];
+          buildInputs = (old.buildInputs or [ ]) ++ [
+            pkgs.sentencepiece
+          ];
+        }
+      );
+
+      sentence-transformers = super.sentence-transformers.overridePythonAttrs (
+        old: {
+          buildInputs =
+            (old.buildInputs or [ ])
+            ++ [ self.typing-extensions ];
+        }
+      );
+
+      supervisor = super.supervisor.overridePythonAttrs (
+        old: {
+          propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [
+            self.meld3
+            self.setuptools
+          ];
+        }
+      );
+
+      cytoolz = super.cytoolz.overridePythonAttrs (
+        old: {
+          propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ self.toolz ];
+        }
+      );
+
+      # For some reason the toml dependency of tqdm declared here:
+      # https://github.com/tqdm/tqdm/blob/67130a23646ae672836b971e1086b6ae4c77d930/pyproject.toml#L2
+      # is not translated correctly to a nix dependency.
+      tqdm = super.tqdm.overrideAttrs (
+        old: {
+          buildInputs = [ super.toml ] ++ (old.buildInputs or [ ]);
+        }
+      );
+
+      watchdog = super.watchdog.overrideAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ])
+            ++ lib.optional pkgs.stdenv.isDarwin pkgs.darwin.apple_sdk.frameworks.CoreServices;
+        }
+      );
+
+      # pyee cannot find `vcversioner` and other "setup requirements", so it tries to
+      # download them from the internet, which only works when nix sandboxing is disabled.
+      # Additionally, since pyee uses vcversioner to specify its version, we need to do this
+      # manually specify its version.
+      pyee = super.pyee.overrideAttrs (
+        old: {
+          postPatch = old.postPatch or "" + ''
+            sed -i setup.py \
+              -e '/setup_requires/,/],/d' \
+              -e 's/vcversioner={},/version="${old.version}",/'
+          '';
+        }
+      );
+
+      # nixpkgs has setuptools_scm 4.1.2
+      # but newrelic has a seemingly unnecessary version constraint for <4
+      # So we patch that out
+      newrelic = super.newrelic.overridePythonAttrs (
+        old: {
+          postPatch = old.postPatch or "" + ''
+            substituteInPlace setup.py --replace '"setuptools_scm>=3.2,<4"' '"setuptools_scm"'
+          '';
+        }
+      );
+
+      wxpython = super.wxpython.overridePythonAttrs (old:
+        let
+          localPython = self.python.withPackages (ps: with ps; [
+            setuptools
+            numpy
+            six
+          ]);
+        in
+        {
+          DOXYGEN = "${pkgs.doxygen}/bin/doxygen";
+
+          nativeBuildInputs = with pkgs; [
+            which
+            doxygen
+            gtk3
+            pkg-config
+            autoPatchelfHook
+          ] ++ (old.nativeBuildInputs or [ ]);
+
+          buildInputs = with pkgs; [
+            gtk3
+            webkitgtk
+            ncurses
+            SDL2
+            xorg.libXinerama
+            xorg.libSM
+            xorg.libXxf86vm
+            xorg.libXtst
+            xorg.xorgproto
+            gst_all_1.gstreamer
+            gst_all_1.gst-plugins-base
+            libGLU
+            libGL
+            libglvnd
+            mesa
+          ] ++ old.buildInputs;
+
+          buildPhase = ''
+            ${localPython.interpreter} build.py -v build_wx
+            ${localPython.interpreter} build.py -v dox etg --nodoc sip
+            ${localPython.interpreter} build.py -v build_py
+          '';
+
+          installPhase = ''
+            ${localPython.interpreter} setup.py install --skip-build --prefix=$out
+          '';
+        });
+
+      marisa-trie = super.marisa-trie.overridePythonAttrs (
+        old: {
+          buildInputs = (old.buildInputs or [ ]) ++ [ self.pytest-runner ];
+        }
+      );
+
+      ua-parser = super.ua-parser.overridePythonAttrs (
+        old: {
+          propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ self.pyyaml ];
+        }
+      );
+
+      pygraphviz = super.pygraphviz.overridePythonAttrs (old: {
+        nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkg-config ];
+        buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.graphviz ];
+      });
+
+      pysqlite = super.pysqlite.overridePythonAttrs (old: {
+        propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ pkgs.sqlite ];
+        patchPhase = ''
+          substituteInPlace "setup.cfg"                                     \
+                  --replace "/usr/local/include" "${pkgs.sqlite.dev}/include"   \
+                  --replace "/usr/local/lib" "${pkgs.sqlite.out}/lib"
+          ${lib.optionalString (!stdenv.isDarwin) ''export LDSHARED="$CC -pthread -shared"''}
+        '';
+      });
+
+      selinux = super.selinux.overridePythonAttrs (old: {
+        buildInputs = (old.buildInputs or [ ]) ++ [ self.setuptools-scm-git-archive ];
+      });
+
+      uwsgi = super.uwsgi.overridePythonAttrs
+        (old:
+          {
+            buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.ncurses ];
+          } // lib.optionalAttrs (lib.versionAtLeast old.version "2.0.19" && lib.versionOlder old.version "2.0.20") {
+            sourceRoot = ".";
+          });
+
+      wcwidth = super.wcwidth.overridePythonAttrs (old: {
+        propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++
+          lib.optional self.isPy27 (self.backports-functools-lru-cache or self.backports_functools_lru_cache)
+        ;
+      });
+
+      wtforms = super.wtforms.overridePythonAttrs (old: {
+        buildInputs = (old.buildInputs or [ ]) ++ [ self.Babel ];
+      });
+
+    }
+  )
+
+]
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/pep425.nix b/pkgs/development/tools/poetry2nix/poetry2nix/pep425.nix
index 56f894c2e7529..b16bd5f3cebc9 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/pep425.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/pep425.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, poetryLib, python, isLinux ? stdenv.isLinux }:
 let
-  inherit (lib.strings) hasSuffix hasInfix splitString removeSuffix;
-  inherit (poetryLib) targetMachine;
+  inherit (lib.strings) escapeRegex hasPrefix hasSuffix hasInfix splitString removePrefix removeSuffix;
+  targetMachine = poetryLib.getTargetMachine stdenv;
 
   # The 'cpxy" as determined by `python.version`
   #
@@ -52,10 +52,10 @@ let
   # x     = "cpXX" | "py2" | "py3" | "py2.py3"
   isPyVersionCompatible = pyver: x:
     let
-      normalize = y: ''cp${lib.strings.removePrefix "cp" (lib.strings.removePrefix "py" y)}'';
-      isCompat = p: x: lib.strings.hasPrefix (normalize x) p;
+      normalize = y: ''cp${removePrefix "cp" (removePrefix "py" y)}'';
+      isCompat = p: x: hasPrefix (normalize x) p;
     in
-    lib.lists.any (isCompat pyver) (lib.strings.splitString "." x);
+    lib.lists.any (isCompat pyver) (splitString "." x);
 
   #
   # Selects the best matching wheel file from a list of files
@@ -63,7 +63,7 @@ let
   selectWheel = files:
     let
       filesWithoutSources = (builtins.filter (x: hasSuffix ".whl" x.file) files);
-      isPyAbiCompatible = pyabi: x: x == "none" || lib.hasPrefix pyabi x || lib.hasPrefix x pyabi || (
+      isPyAbiCompatible = pyabi: x: x == "none" || hasPrefix pyabi x || hasPrefix x pyabi || (
         # The CPython stable ABI is abi3 as in the shared library suffix.
         python.passthru.implementation == "cpython" &&
           builtins.elemAt (lib.splitString "." python.version) 0 == "3" &&
@@ -75,32 +75,30 @@ let
         then
           if targetMachine != null
           then
-            (
-              x: x.platform == "any" || lib.lists.any (e: hasInfix e x.platform) [
-                "manylinux1_${targetMachine}"
-                "manylinux2010_${targetMachine}"
-                "manylinux2014_${targetMachine}"
-              ]
+          # See PEP 600 for details.
+            (p:
+              builtins.match "any|manylinux(1|2010|2014)_${escapeRegex targetMachine}|manylinux_[0-9]+_[0-9]+_${escapeRegex targetMachine}" p != null
             )
           else
-            (x: x.platform == "any")
+            (p: p == "any")
         else
           if stdenv.isDarwin
           then
             if stdenv.targetPlatform.isAarch64
-            then (x: x.platform == "any" || (hasInfix "macosx" x.platform && lib.lists.any (e: hasSuffix e x.platform) [ "arm64" "aarch64" ]))
-            else (x: x.platform == "any" || (hasInfix "macosx" x.platform && hasSuffix "x86_64" x.platform))
-          else (x: x.platform == "any");
+            then (p: p == "any" || (hasInfix "macosx" p && lib.lists.any (e: hasSuffix e p) [ "arm64" "aarch64" ]))
+            else (p: p == "any" || (hasInfix "macosx" p && hasSuffix "x86_64" p))
+          else (p: p == "any");
+      withPlatforms = x: lib.lists.any withPlatform (splitString "." x.platform);
       filterWheel = x:
         let
           f = toWheelAttrs x.file;
         in
-        (withPython pythonTag abiTag f) && (withPlatform f);
+        (withPython pythonTag abiTag f) && (withPlatforms f);
       filtered = builtins.filter filterWheel filesWithoutSources;
       choose = files:
         let
           osxMatches = [ "12_0" "11_0" "10_12" "10_11" "10_10" "10_9" "10_8" "10_7" "any" ];
-          linuxMatches = [ "manylinux1_" "manylinux2010_" "manylinux2014_" "any" ];
+          linuxMatches = [ "manylinux1_" "manylinux2010_" "manylinux2014_" "manylinux_" "any" ];
           chooseLinux = x: lib.take 1 (findBestMatches linuxMatches x);
           chooseOSX = x: lib.take 1 (findBestMatches osxMatches x);
         in
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/pep508.nix b/pkgs/development/tools/poetry2nix/poetry2nix/pep508.nix
index 5098c5c3a90cb..c9cef28fe85ef 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/pep508.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/pep508.nix
@@ -1,6 +1,8 @@
 { lib, stdenv, poetryLib }: python:
 let
-  inherit (poetryLib) ireplace targetMachine;
+  inherit (poetryLib) ireplace;
+
+  targetMachine = poetryLib.getTargetMachine stdenv;
 
   # Like builtins.substring but with stop being offset instead of length
   substr = start: stop: s: builtins.substring start (stop - start) s;
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/default.nix b/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/default.nix
index 8e52d7387c406..868599bde6897 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/default.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/default.nix
@@ -14,9 +14,6 @@ poetry2nix.mkPoetryApplication {
 
   inherit projectDir pyproject poetrylock;
 
-  # Don't include poetry in inputs
-  __isBootstrap = true;
-
   src = fetchFromGitHub (lib.importJSON ./src.json);
 
   # "Vendor" dependencies (for build-system support)
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/poetry.lock b/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/poetry.lock
index 2da1370add736..5f179e2415d74 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/poetry.lock
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/poetry.lock
@@ -8,32 +8,17 @@ python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*"
 
 [[package]]
 name = "attrs"
-version = "21.2.0"
+version = "21.4.0"
 description = "Classes Without Boilerplate"
 category = "dev"
 optional = false
 python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, !=3.4.*"
 
 [package.extras]
-dev = ["coverage[toml] (>=5.0.2)", "hypothesis", "pympler", "pytest (>=4.3.0)", "six", "mypy", "pytest-mypy-plugins", "zope.interface", "furo", "sphinx", "sphinx-notfound-page", "pre-commit"]
+dev = ["coverage[toml] (>=5.0.2)", "hypothesis", "pympler", "pytest (>=4.3.0)", "six", "mypy", "pytest-mypy-plugins", "zope.interface", "furo", "sphinx", "sphinx-notfound-page", "pre-commit", "cloudpickle"]
 docs = ["furo", "sphinx", "zope.interface", "sphinx-notfound-page"]
-tests = ["coverage[toml] (>=5.0.2)", "hypothesis", "pympler", "pytest (>=4.3.0)", "six", "mypy", "pytest-mypy-plugins", "zope.interface"]
-tests_no_zope = ["coverage[toml] (>=5.0.2)", "hypothesis", "pympler", "pytest (>=4.3.0)", "six", "mypy", "pytest-mypy-plugins"]
-
-[[package]]
-name = "backports.entry-points-selectable"
-version = "1.1.1"
-description = "Compatibility shim providing selectable entry points for older implementations"
-category = "main"
-optional = false
-python-versions = ">=2.7"
-
-[package.dependencies]
-importlib-metadata = {version = "*", markers = "python_version < \"3.8\""}
-
-[package.extras]
-docs = ["sphinx", "jaraco.packaging (>=8.2)", "rst.linker (>=1.9)"]
-testing = ["pytest", "pytest-flake8", "pytest-cov", "pytest-black (>=0.3.7)", "pytest-mypy", "pytest-checkdocs (>=2.4)", "pytest-enabler (>=1.0.1)"]
+tests = ["coverage[toml] (>=5.0.2)", "hypothesis", "pympler", "pytest (>=4.3.0)", "six", "mypy", "pytest-mypy-plugins", "zope.interface", "cloudpickle"]
+tests_no_zope = ["coverage[toml] (>=5.0.2)", "hypothesis", "pympler", "pytest (>=4.3.0)", "six", "mypy", "pytest-mypy-plugins", "cloudpickle"]
 
 [[package]]
 name = "backports.functools-lru-cache"
@@ -245,7 +230,7 @@ test = ["pytest (>=3.6.0,!=3.9.0,!=3.9.1,!=3.9.2)", "pretend", "iso8601", "pytz"
 
 [[package]]
 name = "cryptography"
-version = "36.0.1"
+version = "36.0.2"
 description = "cryptography is a package which provides cryptographic recipes and primitives to Python developers."
 category = "main"
 optional = false
@@ -364,7 +349,7 @@ six = "*"
 
 [[package]]
 name = "identify"
-version = "2.4.0"
+version = "2.4.4"
 description = "File identification library for Python"
 category = "dev"
 optional = false
@@ -418,6 +403,14 @@ zipp = {version = ">=0.4", markers = "python_version < \"3.8\""}
 docs = ["sphinx", "rst.linker", "jaraco.packaging"]
 
 [[package]]
+name = "iniconfig"
+version = "1.1.1"
+description = "iniconfig: brain-dead simple config-ini parsing"
+category = "dev"
+optional = false
+python-versions = "*"
+
+[[package]]
 name = "ipaddress"
 version = "1.0.23"
 description = "IPv4/IPv6 manipulation library"
@@ -484,7 +477,7 @@ testing = ["pytest (>=3.5,!=3.7.3)", "pytest-checkdocs (>=1.2.3)", "pytest-flake
 
 [[package]]
 name = "keyring"
-version = "21.8.0"
+version = "22.3.0"
 description = "Store and access your passwords safely."
 category = "main"
 optional = false
@@ -498,7 +491,7 @@ SecretStorage = {version = ">=3.2", markers = "sys_platform == \"linux\""}
 
 [package.extras]
 docs = ["sphinx", "jaraco.packaging (>=8.2)", "rst.linker (>=1.9)"]
-testing = ["pytest (>=3.5,!=3.7.3)", "pytest-checkdocs (>=1.2.3)", "pytest-flake8", "pytest-cov", "jaraco.test (>=3.2.0)", "pytest-black (>=0.3.7)", "pytest-mypy"]
+testing = ["pytest (>=4.6)", "pytest-checkdocs (>=1.2.3)", "pytest-flake8", "pytest-cov", "pytest-enabler", "pytest-black (>=0.3.7)", "pytest-mypy"]
 
 [[package]]
 name = "lockfile"
@@ -589,7 +582,7 @@ python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*"
 
 [[package]]
 name = "pathlib2"
-version = "2.3.6"
+version = "2.3.7.post1"
 description = "Object-oriented filesystem paths"
 category = "main"
 optional = false
@@ -598,6 +591,7 @@ python-versions = "*"
 [package.dependencies]
 scandir = {version = "*", markers = "python_version < \"3.5\""}
 six = "*"
+typing = {version = "*", markers = "python_version < \"3.5\""}
 
 [[package]]
 name = "pexpect"
@@ -645,7 +639,7 @@ dev = ["pre-commit", "tox"]
 
 [[package]]
 name = "poetry-core"
-version = "1.0.7"
+version = "1.0.8"
 description = "Poetry PEP 517 Build Backend"
 category = "main"
 optional = false
@@ -660,7 +654,7 @@ typing = {version = ">=3.7.4.1,<4.0.0.0", markers = "python_version >= \"2.7\" a
 
 [[package]]
 name = "pre-commit"
-version = "2.16.0"
+version = "2.17.0"
 description = "A framework for managing and maintaining multi-language pre-commit hooks."
 category = "dev"
 optional = false
@@ -769,6 +763,28 @@ checkqa-mypy = ["mypy (==v0.761)"]
 testing = ["argcomplete", "hypothesis (>=3.56)", "mock", "nose", "requests", "xmlschema"]
 
 [[package]]
+name = "pytest"
+version = "6.2.5"
+description = "pytest: simple powerful testing with Python"
+category = "dev"
+optional = false
+python-versions = ">=3.6"
+
+[package.dependencies]
+atomicwrites = {version = ">=1.0", markers = "sys_platform == \"win32\""}
+attrs = ">=19.2.0"
+colorama = {version = "*", markers = "sys_platform == \"win32\""}
+importlib-metadata = {version = ">=0.12", markers = "python_version < \"3.8\""}
+iniconfig = "*"
+packaging = "*"
+pluggy = ">=0.12,<2.0"
+py = ">=1.8.2"
+toml = "*"
+
+[package.extras]
+testing = ["argcomplete", "hypothesis (>=3.56)", "mock", "nose", "requests", "xmlschema"]
+
+[[package]]
 name = "pytest-cov"
 version = "2.12.1"
 description = "Pytest plugin for measuring coverage."
@@ -973,7 +989,7 @@ typing = {version = ">=3.6,<4.0", markers = "python_version >= \"2.7\" and pytho
 
 [[package]]
 name = "tox"
-version = "3.24.4"
+version = "3.24.5"
 description = "tox is a generic virtualenv management and test command line tool"
 category = "dev"
 optional = false
@@ -992,7 +1008,7 @@ virtualenv = ">=16.0.0,<20.0.0 || >20.0.0,<20.0.1 || >20.0.1,<20.0.2 || >20.0.2,
 
 [package.extras]
 docs = ["pygments-github-lexers (>=0.0.5)", "sphinx (>=2.0.0)", "sphinxcontrib-autoprogram (>=0.1.5)", "towncrier (>=18.5.0)"]
-testing = ["flaky (>=3.4.0)", "freezegun (>=0.3.11)", "psutil (>=5.6.1)", "pytest (>=4.0.0)", "pytest-cov (>=2.5.1)", "pytest-mock (>=1.10.0)", "pytest-randomly (>=1.0.0)", "pytest-xdist (>=1.22.2)", "pathlib2 (>=2.3.3)"]
+testing = ["flaky (>=3.4.0)", "freezegun (>=0.3.11)", "pytest (>=4.0.0)", "pytest-cov (>=2.5.1)", "pytest-mock (>=1.10.0)", "pytest-randomly (>=1.0.0)", "psutil (>=5.6.1)", "pathlib2 (>=2.3.3)"]
 
 [[package]]
 name = "typing"
@@ -1025,14 +1041,13 @@ socks = ["PySocks (>=1.5.6,!=1.5.7,<2.0)"]
 
 [[package]]
 name = "virtualenv"
-version = "20.10.0"
+version = "20.14.0"
 description = "Virtual Python Environment builder"
 category = "main"
 optional = false
 python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*,>=2.7"
 
 [package.dependencies]
-"backports.entry-points-selectable" = ">=1.0.4"
 distlib = ">=0.3.1,<1"
 filelock = ">=3.2,<4"
 importlib-metadata = {version = ">=0.12", markers = "python_version < \"3.8\""}
@@ -1082,7 +1097,7 @@ testing = ["pathlib2", "unittest2", "jaraco.itertools", "func-timeout"]
 [metadata]
 lock-version = "1.1"
 python-versions = "~2.7 || ^3.5"
-content-hash = "290e530f0cdd81360dd6cb93f3182ac8e8b18a46238198d25de11c26f6b0c356"
+content-hash = "3de9a28e5a2f53d26b75a9aa3eb333b360eb04470769675fb435183ab871798c"
 
 [metadata.files]
 atomicwrites = [
@@ -1090,12 +1105,8 @@ atomicwrites = [
     {file = "atomicwrites-1.4.0.tar.gz", hash = "sha256:ae70396ad1a434f9c7046fd2dd196fc04b12f9e91ffb859164193be8b6168a7a"},
 ]
 attrs = [
-    {file = "attrs-21.2.0-py2.py3-none-any.whl", hash = "sha256:149e90d6d8ac20db7a955ad60cf0e6881a3f20d37096140088356da6c716b0b1"},
-    {file = "attrs-21.2.0.tar.gz", hash = "sha256:ef6aaac3ca6cd92904cdd0d83f629a15f18053ec84e6432106f7a4d04ae4f5fb"},
-]
-"backports.entry-points-selectable" = [
-    {file = "backports.entry_points_selectable-1.1.1-py2.py3-none-any.whl", hash = "sha256:7fceed9532a7aa2bd888654a7314f864a3c16a4e710b34a58cfc0f08114c663b"},
-    {file = "backports.entry_points_selectable-1.1.1.tar.gz", hash = "sha256:914b21a479fde881635f7af5adc7f6e38d6b274be32269070c53b698c60d5386"},
+    {file = "attrs-21.4.0-py2.py3-none-any.whl", hash = "sha256:2d27e3784d7a565d36ab851fe94887c5eccd6a463168875832a1be79c82828b4"},
+    {file = "attrs-21.4.0.tar.gz", hash = "sha256:626ba8234211db98e869df76230a137c4c40a12d72445c45d5f5b716f076e2fd"},
 ]
 "backports.functools-lru-cache" = [
     {file = "backports.functools_lru_cache-1.6.4-py2.py3-none-any.whl", hash = "sha256:dbead04b9daa817909ec64e8d2855fb78feafe0b901d4568758e3a60559d8978"},
@@ -1290,26 +1301,26 @@ cryptography = [
     {file = "cryptography-3.3.2-cp36-abi3-win32.whl", hash = "sha256:3c284fc1e504e88e51c428db9c9274f2da9f73fdf5d7e13a36b8ecb039af6e6c"},
     {file = "cryptography-3.3.2-cp36-abi3-win_amd64.whl", hash = "sha256:7951a966613c4211b6612b0352f5bf29989955ee592c4a885d8c7d0f830d0433"},
     {file = "cryptography-3.3.2.tar.gz", hash = "sha256:5a60d3780149e13b7a6ff7ad6526b38846354d11a15e21068e57073e29e19bed"},
-    {file = "cryptography-36.0.1-cp36-abi3-macosx_10_10_universal2.whl", hash = "sha256:73bc2d3f2444bcfeac67dd130ff2ea598ea5f20b40e36d19821b4df8c9c5037b"},
-    {file = "cryptography-36.0.1-cp36-abi3-macosx_10_10_x86_64.whl", hash = "sha256:2d87cdcb378d3cfed944dac30596da1968f88fb96d7fc34fdae30a99054b2e31"},
-    {file = "cryptography-36.0.1-cp36-abi3-manylinux_2_12_x86_64.manylinux2010_x86_64.whl", hash = "sha256:74d6c7e80609c0f4c2434b97b80c7f8fdfaa072ca4baab7e239a15d6d70ed73a"},
-    {file = "cryptography-36.0.1-cp36-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl", hash = "sha256:6c0c021f35b421ebf5976abf2daacc47e235f8b6082d3396a2fe3ccd537ab173"},
-    {file = "cryptography-36.0.1-cp36-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:5d59a9d55027a8b88fd9fd2826c4392bd487d74bf628bb9d39beecc62a644c12"},
-    {file = "cryptography-36.0.1-cp36-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:0a817b961b46894c5ca8a66b599c745b9a3d9f822725221f0e0fe49dc043a3a3"},
-    {file = "cryptography-36.0.1-cp36-abi3-manylinux_2_24_x86_64.whl", hash = "sha256:94ae132f0e40fe48f310bba63f477f14a43116f05ddb69d6fa31e93f05848ae2"},
-    {file = "cryptography-36.0.1-cp36-abi3-musllinux_1_1_aarch64.whl", hash = "sha256:7be0eec337359c155df191d6ae00a5e8bbb63933883f4f5dffc439dac5348c3f"},
-    {file = "cryptography-36.0.1-cp36-abi3-musllinux_1_1_x86_64.whl", hash = "sha256:e0344c14c9cb89e76eb6a060e67980c9e35b3f36691e15e1b7a9e58a0a6c6dc3"},
-    {file = "cryptography-36.0.1-cp36-abi3-win32.whl", hash = "sha256:4caa4b893d8fad33cf1964d3e51842cd78ba87401ab1d2e44556826df849a8ca"},
-    {file = "cryptography-36.0.1-cp36-abi3-win_amd64.whl", hash = "sha256:391432971a66cfaf94b21c24ab465a4cc3e8bf4a939c1ca5c3e3a6e0abebdbcf"},
-    {file = "cryptography-36.0.1-pp37-pypy37_pp73-manylinux_2_12_x86_64.manylinux2010_x86_64.whl", hash = "sha256:bb5829d027ff82aa872d76158919045a7c1e91fbf241aec32cb07956e9ebd3c9"},
-    {file = "cryptography-36.0.1-pp37-pypy37_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:ebc15b1c22e55c4d5566e3ca4db8689470a0ca2babef8e3a9ee057a8b82ce4b1"},
-    {file = "cryptography-36.0.1-pp37-pypy37_pp73-manylinux_2_24_x86_64.whl", hash = "sha256:596f3cd67e1b950bc372c33f1a28a0692080625592ea6392987dba7f09f17a94"},
-    {file = "cryptography-36.0.1-pp38-pypy38_pp73-macosx_10_10_x86_64.whl", hash = "sha256:30ee1eb3ebe1644d1c3f183d115a8c04e4e603ed6ce8e394ed39eea4a98469ac"},
-    {file = "cryptography-36.0.1-pp38-pypy38_pp73-manylinux_2_12_x86_64.manylinux2010_x86_64.whl", hash = "sha256:ec63da4e7e4a5f924b90af42eddf20b698a70e58d86a72d943857c4c6045b3ee"},
-    {file = "cryptography-36.0.1-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:ca238ceb7ba0bdf6ce88c1b74a87bffcee5afbfa1e41e173b1ceb095b39add46"},
-    {file = "cryptography-36.0.1-pp38-pypy38_pp73-manylinux_2_24_x86_64.whl", hash = "sha256:ca28641954f767f9822c24e927ad894d45d5a1e501767599647259cbf030b903"},
-    {file = "cryptography-36.0.1-pp38-pypy38_pp73-win_amd64.whl", hash = "sha256:39bdf8e70eee6b1c7b289ec6e5d84d49a6bfa11f8b8646b5b3dfe41219153316"},
-    {file = "cryptography-36.0.1.tar.gz", hash = "sha256:53e5c1dc3d7a953de055d77bef2ff607ceef7a2aac0353b5d630ab67f7423638"},
+    {file = "cryptography-36.0.2-cp36-abi3-macosx_10_10_universal2.whl", hash = "sha256:4e2dddd38a5ba733be6a025a1475a9f45e4e41139d1321f412c6b360b19070b6"},
+    {file = "cryptography-36.0.2-cp36-abi3-macosx_10_10_x86_64.whl", hash = "sha256:4881d09298cd0b669bb15b9cfe6166f16fc1277b4ed0d04a22f3d6430cb30f1d"},
+    {file = "cryptography-36.0.2-cp36-abi3-manylinux_2_12_x86_64.manylinux2010_x86_64.whl", hash = "sha256:ea634401ca02367c1567f012317502ef3437522e2fc44a3ea1844de028fa4b84"},
+    {file = "cryptography-36.0.2-cp36-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl", hash = "sha256:7be666cc4599b415f320839e36367b273db8501127b38316f3b9f22f17a0b815"},
+    {file = "cryptography-36.0.2-cp36-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:8241cac0aae90b82d6b5c443b853723bcc66963970c67e56e71a2609dc4b5eaf"},
+    {file = "cryptography-36.0.2-cp36-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:7b2d54e787a884ffc6e187262823b6feb06c338084bbe80d45166a1cb1c6c5bf"},
+    {file = "cryptography-36.0.2-cp36-abi3-manylinux_2_24_x86_64.whl", hash = "sha256:c2c5250ff0d36fd58550252f54915776940e4e866f38f3a7866d92b32a654b86"},
+    {file = "cryptography-36.0.2-cp36-abi3-musllinux_1_1_aarch64.whl", hash = "sha256:ec6597aa85ce03f3e507566b8bcdf9da2227ec86c4266bd5e6ab4d9e0cc8dab2"},
+    {file = "cryptography-36.0.2-cp36-abi3-musllinux_1_1_x86_64.whl", hash = "sha256:ca9f686517ec2c4a4ce930207f75c00bf03d94e5063cbc00a1dc42531511b7eb"},
+    {file = "cryptography-36.0.2-cp36-abi3-win32.whl", hash = "sha256:f64b232348ee82f13aac22856515ce0195837f6968aeaa94a3d0353ea2ec06a6"},
+    {file = "cryptography-36.0.2-cp36-abi3-win_amd64.whl", hash = "sha256:53e0285b49fd0ab6e604f4c5d9c5ddd98de77018542e88366923f152dbeb3c29"},
+    {file = "cryptography-36.0.2-pp37-pypy37_pp73-manylinux_2_12_x86_64.manylinux2010_x86_64.whl", hash = "sha256:32db5cc49c73f39aac27574522cecd0a4bb7384e71198bc65a0d23f901e89bb7"},
+    {file = "cryptography-36.0.2-pp37-pypy37_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:d2b3d199647468d410994dbeb8cec5816fb74feb9368aedf300af709ef507e3e"},
+    {file = "cryptography-36.0.2-pp37-pypy37_pp73-manylinux_2_24_x86_64.whl", hash = "sha256:da73d095f8590ad437cd5e9faf6628a218aa7c387e1fdf67b888b47ba56a17f0"},
+    {file = "cryptography-36.0.2-pp38-pypy38_pp73-macosx_10_10_x86_64.whl", hash = "sha256:0a3bf09bb0b7a2c93ce7b98cb107e9170a90c51a0162a20af1c61c765b90e60b"},
+    {file = "cryptography-36.0.2-pp38-pypy38_pp73-manylinux_2_12_x86_64.manylinux2010_x86_64.whl", hash = "sha256:8897b7b7ec077c819187a123174b645eb680c13df68354ed99f9b40a50898f77"},
+    {file = "cryptography-36.0.2-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:82740818f2f240a5da8dfb8943b360e4f24022b093207160c77cadade47d7c85"},
+    {file = "cryptography-36.0.2-pp38-pypy38_pp73-manylinux_2_24_x86_64.whl", hash = "sha256:1f64a62b3b75e4005df19d3b5235abd43fa6358d5516cfc43d87aeba8d08dd51"},
+    {file = "cryptography-36.0.2-pp38-pypy38_pp73-win_amd64.whl", hash = "sha256:e167b6b710c7f7bc54e67ef593f8731e1f45aa35f8a8a7b72d6e42ec76afd4b3"},
+    {file = "cryptography-36.0.2.tar.gz", hash = "sha256:70f8f4f7bb2ac9f340655cbac89d68c527af5bb4387522a8413e841e3e6628c9"},
 ]
 distlib = [
     {file = "distlib-0.3.4-py2.py3-none-any.whl", hash = "sha256:6564fe0a8f51e734df6333d08b8b94d4ea8ee6b99b5ed50613f731fd4089f34b"},
@@ -1351,8 +1362,8 @@ httpretty = [
     {file = "httpretty-0.9.7.tar.gz", hash = "sha256:66216f26b9d2c52e81808f3e674a6fb65d4bf719721394a1a9be926177e55fbe"},
 ]
 identify = [
-    {file = "identify-2.4.0-py2.py3-none-any.whl", hash = "sha256:eba31ca80258de6bb51453084bff4a923187cd2193b9c13710f2516ab30732cc"},
-    {file = "identify-2.4.0.tar.gz", hash = "sha256:a33ae873287e81651c7800ca309dc1f84679b763c9c8b30680e16fbfa82f0107"},
+    {file = "identify-2.4.4-py2.py3-none-any.whl", hash = "sha256:aa68609c7454dbcaae60a01ff6b8df1de9b39fe6e50b1f6107ec81dcda624aa6"},
+    {file = "identify-2.4.4.tar.gz", hash = "sha256:6b4b5031f69c48bf93a646b90de9b381c6b5f560df4cbe0ed3cf7650ae741e4d"},
 ]
 idna = [
     {file = "idna-2.10-py2.py3-none-any.whl", hash = "sha256:b97d804b1e9b523befed77c48dacec60e6dcb0b5391d57af6a65a312a90648c0"},
@@ -1366,6 +1377,10 @@ importlib-resources = [
     {file = "importlib_resources-3.2.1-py2.py3-none-any.whl", hash = "sha256:e2860cf0c4bc999947228d18be154fa3779c5dde0b882bd2d7b3f4d25e698bd6"},
     {file = "importlib_resources-3.2.1.tar.gz", hash = "sha256:a9fe213ab6452708ec1b3f4ec6f2881b8ab3645cb4e5efb7fea2bbf05a91db3b"},
 ]
+iniconfig = [
+    {file = "iniconfig-1.1.1-py2.py3-none-any.whl", hash = "sha256:011e24c64b7f47f6ebd835bb12a743f2fbe9a26d4cecaa7f53bc4f35ee9da8b3"},
+    {file = "iniconfig-1.1.1.tar.gz", hash = "sha256:bc3af051d7d14b2ee5ef9969666def0cd1a000e121eaea580d4a313df4b37f32"},
+]
 ipaddress = [
     {file = "ipaddress-1.0.23-py2.py3-none-any.whl", hash = "sha256:6e0f4a39e66cb5bb9a137b00276a2eff74f93b71dcbdad6f10ff7df9d3557fcc"},
     {file = "ipaddress-1.0.23.tar.gz", hash = "sha256:b7f8e0369580bb4a24d5ba1d7cc29660a4a6987763faf1d8a8046830e020e7e2"},
@@ -1381,8 +1396,8 @@ keyring = [
     {file = "keyring-18.0.1.tar.gz", hash = "sha256:67d6cc0132bd77922725fae9f18366bb314fd8f95ff4d323a4df41890a96a838"},
     {file = "keyring-20.0.1-py2.py3-none-any.whl", hash = "sha256:c674f032424b4bffc62abeac5523ec49cc84aed07a480c3233e0baf618efc15c"},
     {file = "keyring-20.0.1.tar.gz", hash = "sha256:963bfa7f090269d30bdc5e25589e5fd9dad2cf2a7c6f176a7f2386910e5d0d8d"},
-    {file = "keyring-21.8.0-py3-none-any.whl", hash = "sha256:4be9cbaaaf83e61d6399f733d113ede7d1c73bc75cb6aeb64eee0f6ac39b30ea"},
-    {file = "keyring-21.8.0.tar.gz", hash = "sha256:1746d3ac913d449a090caf11e9e4af00e26c3f7f7e81027872192b2398b98675"},
+    {file = "keyring-22.3.0-py3-none-any.whl", hash = "sha256:2bc8363ebdd63886126a012057a85c8cb6e143877afa02619ac7dbc9f38a207b"},
+    {file = "keyring-22.3.0.tar.gz", hash = "sha256:16927a444b2c73f983520a48dec79ddab49fe76429ea05b8d528d778c8339522"},
 ]
 lockfile = [
     {file = "lockfile-0.12.2-py2.py3-none-any.whl", hash = "sha256:6c3cb24f344923d30b2785d5ad75182c8ea7ac1b6171b08657258ec7429d50fa"},
@@ -1450,8 +1465,8 @@ pastel = [
     {file = "pastel-0.2.1.tar.gz", hash = "sha256:e6581ac04e973cac858828c6202c1e1e81fee1dc7de7683f3e1ffe0bfd8a573d"},
 ]
 pathlib2 = [
-    {file = "pathlib2-2.3.6-py2.py3-none-any.whl", hash = "sha256:3a130b266b3a36134dcc79c17b3c7ac9634f083825ca6ea9d8f557ee6195c9c8"},
-    {file = "pathlib2-2.3.6.tar.gz", hash = "sha256:7d8bcb5555003cdf4a8d2872c538faa3a0f5d20630cb360e518ca3b981795e5f"},
+    {file = "pathlib2-2.3.7.post1-py2.py3-none-any.whl", hash = "sha256:5266a0fd000452f1b3467d782f079a4343c63aaa119221fbdc4e39577489ca5b"},
+    {file = "pathlib2-2.3.7.post1.tar.gz", hash = "sha256:9fe0edad898b83c0c3e199c842b27ed216645d2e177757b2dd67384d4113c641"},
 ]
 pexpect = [
     {file = "pexpect-4.8.0-py2.py3-none-any.whl", hash = "sha256:0b48a55dcb3c05f3329815901ea4fc1537514d6ba867a152b581d69ae3710937"},
@@ -1470,12 +1485,12 @@ pluggy = [
     {file = "pluggy-0.13.1.tar.gz", hash = "sha256:15b2acde666561e1298d71b523007ed7364de07029219b604cf808bfa1c765b0"},
 ]
 poetry-core = [
-    {file = "poetry-core-1.0.7.tar.gz", hash = "sha256:98c11c755a16ef6c5673c22ca94a3802a7df4746a0853a70b6fae8b9f5cac206"},
-    {file = "poetry_core-1.0.7-py2.py3-none-any.whl", hash = "sha256:4f8a7f5390d772f42c4c4c3f188e6424b802cb4b57466c6633a1b9ac36f18a43"},
+    {file = "poetry-core-1.0.8.tar.gz", hash = "sha256:951fc7c1f8d710a94cb49019ee3742125039fc659675912ea614ac2aa405b118"},
+    {file = "poetry_core-1.0.8-py2.py3-none-any.whl", hash = "sha256:54b0fab6f7b313886e547a52f8bf52b8cf43e65b2633c65117f8755289061924"},
 ]
 pre-commit = [
-    {file = "pre_commit-2.16.0-py2.py3-none-any.whl", hash = "sha256:758d1dc9b62c2ed8881585c254976d66eae0889919ab9b859064fc2fe3c7743e"},
-    {file = "pre_commit-2.16.0.tar.gz", hash = "sha256:fe9897cac830aa7164dbd02a4e7b90cae49630451ce88464bca73db486ba9f65"},
+    {file = "pre_commit-2.17.0-py2.py3-none-any.whl", hash = "sha256:725fa7459782d7bec5ead072810e47351de01709be838c2ce1726b9591dad616"},
+    {file = "pre_commit-2.17.0.tar.gz", hash = "sha256:c1a8040ff15ad3d648c70cc3e55b93e4d2d5b687320955505587fd79bbaed06a"},
 ]
 ptyprocess = [
     {file = "ptyprocess-0.7.0-py2.py3-none-any.whl", hash = "sha256:4b41f3967fce3af57cc7e94b888626c18bf37a083e3651ca8feeb66d492fef35"},
@@ -1502,6 +1517,8 @@ pytest = [
     {file = "pytest-4.6.11.tar.gz", hash = "sha256:50fa82392f2120cc3ec2ca0a75ee615be4c479e66669789771f1758332be4353"},
     {file = "pytest-5.4.3-py3-none-any.whl", hash = "sha256:5c0db86b698e8f170ba4582a492248919255fcd4c79b1ee64ace34301fb589a1"},
     {file = "pytest-5.4.3.tar.gz", hash = "sha256:7979331bfcba207414f5e1263b5a0f8f521d0f457318836a7355531ed1a4c7d8"},
+    {file = "pytest-6.2.5-py3-none-any.whl", hash = "sha256:7310f8d27bc79ced999e760ca304d69f6ba6c6649c0b60fb0e04a4a77cacc134"},
+    {file = "pytest-6.2.5.tar.gz", hash = "sha256:131b36680866a76e6781d13f101efb86cf674ebb9762eb70d3082b6f29889e89"},
 ]
 pytest-cov = [
     {file = "pytest-cov-2.12.1.tar.gz", hash = "sha256:261ceeb8c227b726249b376b8526b600f38667ee314f910353fa318caa01f4d7"},
@@ -1610,8 +1627,8 @@ tomlkit = [
     {file = "tomlkit-0.7.2.tar.gz", hash = "sha256:d7a454f319a7e9bd2e249f239168729327e4dd2d27b17dc68be264ad1ce36754"},
 ]
 tox = [
-    {file = "tox-3.24.4-py2.py3-none-any.whl", hash = "sha256:5e274227a53dc9ef856767c21867377ba395992549f02ce55eb549f9fb9a8d10"},
-    {file = "tox-3.24.4.tar.gz", hash = "sha256:c30b57fa2477f1fb7c36aa1d83292d5c2336cd0018119e1b1c17340e2c2708ca"},
+    {file = "tox-3.24.5-py2.py3-none-any.whl", hash = "sha256:be3362472a33094bce26727f5f771ca0facf6dafa217f65875314e9a6600c95c"},
+    {file = "tox-3.24.5.tar.gz", hash = "sha256:67e0e32c90e278251fea45b696d0fef3879089ccbe979b0c556d35d5a70e2993"},
 ]
 typing = [
     {file = "typing-3.10.0.0-py2-none-any.whl", hash = "sha256:c7219ef20c5fbf413b4567092adfc46fa6203cb8454eda33c3fc1afe1398a308"},
@@ -1628,8 +1645,8 @@ urllib3 = [
     {file = "urllib3-1.25.11.tar.gz", hash = "sha256:8d7eaa5a82a1cac232164990f04874c594c9453ec55eef02eab885aa02fc17a2"},
 ]
 virtualenv = [
-    {file = "virtualenv-20.10.0-py2.py3-none-any.whl", hash = "sha256:4b02e52a624336eece99c96e3ab7111f469c24ba226a53ec474e8e787b365814"},
-    {file = "virtualenv-20.10.0.tar.gz", hash = "sha256:576d05b46eace16a9c348085f7d0dc8ef28713a2cabaa1cf0aea41e8f12c9218"},
+    {file = "virtualenv-20.14.0-py2.py3-none-any.whl", hash = "sha256:1e8588f35e8b42c6ec6841a13c5e88239de1e6e4e4cedfd3916b306dc826ec66"},
+    {file = "virtualenv-20.14.0.tar.gz", hash = "sha256:8e5b402037287126e81ccde9432b95a8be5b19d36584f64957060a3488c11ca8"},
 ]
 wcwidth = [
     {file = "wcwidth-0.2.5-py2.py3-none-any.whl", hash = "sha256:beb4802a9cebb9144e99086eff703a642a13d6a0052920003a230f3294bbe784"},
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/pyproject.toml b/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/pyproject.toml
index 5cf34372b050c..4fff27d4e0eb8 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/pyproject.toml
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "poetry"
-version = "1.1.12"
+version = "1.1.13"
 description = "Python dependency management and packaging made easy."
 authors = [
     "Sébastien Eustace <sebastien@eustace.io>"
@@ -57,7 +57,7 @@ functools32 = { version = "^3.2.3", python = "~2.7" }
 keyring = [
     { version = "^18.0.1", python = "~2.7" },
     { version = "^20.0.1", python = "~3.5" },
-    { version = "^21.2.0", python = "^3.6" }
+    { version = ">=21.2.0", python = "^3.6" }
 ]
 # Use subprocess32 for Python 2.7
 subprocess32 = { version = "^3.5", python = "~2.7" }
@@ -66,7 +66,8 @@ importlib-metadata = {version = "^1.6.0", python = "<3.8"}
 [tool.poetry.dev-dependencies]
 pytest = [
     {version = "^4.1", python = "<3.5"},
-    {version = "^5.4.3", python = ">=3.5"}
+    {version = "^5.4.3", python = "~3.5"},
+    {version = "^6.2.5", python = ">=3.6"}
 ]
 pytest-cov = "^2.5"
 pytest-mock = "^1.9"
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/src.json b/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/src.json
index aeee3abb7d42f..7b35dc31494e8 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/src.json
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/src.json
@@ -1,7 +1,7 @@
 {
-    "owner": "python-poetry",
-    "repo": "poetry",
-    "rev": "020fb336e6da11d3a9909f30bd908437a69f13b3",
-    "sha256": "1fm4yj6wxr24v7b77gmf63j7xsgszhbhzw2i9fvlfi0p9l0q34pm",
-    "fetchSubmodules": true
+  "owner": "python-poetry",
+  "repo": "poetry",
+  "rev": "1.1.13",
+  "sha256": "0zm73wcxjfad3841wl1xpx20drhynrqlxsjh1d1gsh618b7ldpib",
+  "fetchSubmodules": true
 }
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/update b/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/update
deleted file mode 100755
index 95b7f5bb3318f..0000000000000
--- a/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/update
+++ /dev/null
@@ -1,11 +0,0 @@
-#!/usr/bin/env nix-shell
-#! nix-shell -i bash -p curl nix-prefetch-github jq
-
-rev=$(curl -s https://api.github.com/repos/python-poetry/poetry/releases/latest | jq -r '.name')
-nix-prefetch-github --rev "$rev" python-poetry poetry > src.json
-echo >> src.json
-
-src=$(nix-build --no-out-link --expr 'with import <nixpkgs> {}; fetchFromGitHub (lib.importJSON ./src.json)')
-cp $src/pyproject.toml $src/poetry.lock .
-nix-shell -p poetry --run 'poetry lock'
-nix-build --expr '(import <nixpkgs> { overlays = [ (import ../../overlay.nix) ]; }).poetry'
diff --git a/pkgs/development/tools/poetry2nix/update b/pkgs/development/tools/poetry2nix/update
index ac8c98a33d9cf..047f7a8fea65d 100755
--- a/pkgs/development/tools/poetry2nix/update
+++ b/pkgs/development/tools/poetry2nix/update
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+set -euo pipefail
 pwd=$(pwd)
 workdir=$(mktemp -d)
 
@@ -15,8 +16,8 @@ mv poetry2nix-master/* .
 
 mkdir build
 cp *.* build/
-cp -r pkgs hooks bin build/
-rm build/shell.nix build/generate.py build/overlay.nix build/flake.* build/check-fmt.nix
+cp -r overrides pkgs hooks bin build/
+rm build/shell.nix build/generate.py build/overlay.nix build/flake.* build/check-fmt.nix build/pkgs/poetry/update*
 
 cat > build/README.md << EOF
 Dont change these files here, they are maintained at https://github.com/nix-community/poetry2nix
diff --git a/pkgs/development/tools/rocminfo/default.nix b/pkgs/development/tools/rocminfo/default.nix
index 60ca0a51d2659..d399a912b5ff4 100644
--- a/pkgs/development/tools/rocminfo/default.nix
+++ b/pkgs/development/tools/rocminfo/default.nix
@@ -17,7 +17,8 @@ stdenv.mkDerivation rec {
   };
 
   enableParallelBuilding = true;
-  buildInputs = [ cmake rocm-cmake rocm-runtime ];
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ rocm-cmake rocm-runtime ];
   cmakeFlags = [
     "-DROCM_DIR=${rocm-runtime}"
     "-DROCRTST_BLD_TYPE=Release"
diff --git a/pkgs/development/tools/rust/cargo-spellcheck/default.nix b/pkgs/development/tools/rust/cargo-spellcheck/default.nix
index 4d99fe1f6309f..2eda19afd8381 100644
--- a/pkgs/development/tools/rust/cargo-spellcheck/default.nix
+++ b/pkgs/development/tools/rust/cargo-spellcheck/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-spellcheck";
-  version = "0.11.1";
+  version = "0.11.2";
 
   src = fetchFromGitHub {
     owner = "drahnr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Iafhx0bK386grGadsJc/t1lLjd/C89fCVuHrq3FMaE0=";
+    sha256 = "sha256-ZiRa4XYnY4fwbMenRLnvFQms66tIyGbm5saK8gN39ag=";
   };
 
-  cargoSha256 = "sha256-ZYZA4H1LvsFQR6mvKAie9Tha3MWocAVpNtG7LwdtcPg=";
+  cargoSha256 = "sha256-gWQbhFPdBDhPZY1LHxFlWO9xG4AXfyhZp0UnZ3Y86/Y=";
 
   buildInputs = lib.optional stdenv.isDarwin Security;
 
diff --git a/pkgs/development/tools/stylua/default.nix b/pkgs/development/tools/stylua/default.nix
index e21f058b8a066..729c0c191885d 100644
--- a/pkgs/development/tools/stylua/default.nix
+++ b/pkgs/development/tools/stylua/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "stylua";
-  version = "0.12.5";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "johnnymorganz";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-4tQQTTAdIAhlkBJevwwwGXOKd6bJJOyG4nlbCv7909Y=";
+    sha256 = "sha256-Ecv6am4JT4cJKAApieOWQZG3XZkeCpmLrs6K7+4c8xA=";
   };
 
-  cargoSha256 = "sha256-DGe2lB8xZgY9ikTsIHDOdHzTyHfDaSlmy8FU/S9FDCI=";
+  cargoSha256 = "sha256-r09fTZTmOZQCI3qIWcnQnhUXYLVK8pF5y0y/dQl88CI=";
 
   buildFeatures = lib.optional lua52Support "lua52"
     ++ lib.optional luauSupport "luau";
diff --git a/pkgs/development/tools/wrangler/default.nix b/pkgs/development/tools/wrangler/default.nix
index dca054db3feaf..c34c3b0a0376c 100644
--- a/pkgs/development/tools/wrangler/default.nix
+++ b/pkgs/development/tools/wrangler/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wrangler";
-  version = "1.19.10";
+  version = "1.19.11";
 
   src = fetchFromGitHub {
     owner = "cloudflare";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-RKOAs7MRHcGx6BNBml7WQ81bNvdB9ipd0R1ErLTwjTQ=";
+    sha256 = "sha256-8Vka8HTU0YkTS1DeQuqVLsnRGnig7Aiql5e/6NBk7qs=";
   };
 
-  cargoSha256 = "sha256-9GvKDLuDIW5q1R5g20rtSScv2c0sLSo+hI9LSA4W3M8=";
+  cargoSha256 = "sha256-bw6Z4SW+NOFFpUJ5xGwdccv8KQnSri/TFxAJp+9fsWk=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/development/web/flyctl/default.nix b/pkgs/development/web/flyctl/default.nix
index 9fe93bac44203..f70faf37fac96 100644
--- a/pkgs/development/web/flyctl/default.nix
+++ b/pkgs/development/web/flyctl/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "flyctl";
-  version = "0.0.308";
+  version = "0.0.310";
 
   src = fetchFromGitHub {
     owner = "superfly";
     repo = "flyctl";
     rev = "v${version}";
-    sha256 = "sha256-Di0egdreY3c6kulcvAl4dFfYpIuMocQzHiFW48kJ6u4=";
+    sha256 = "sha256-69yyH4og7FGS3+M72YhlrwjatucfGliHYcMpPi1ddjA=";
   };
 
   preBuild = ''
diff --git a/pkgs/games/nanosaur/default.nix b/pkgs/games/nanosaur/default.nix
index e0001cfb7d5a8..0d5ea528a92da 100644
--- a/pkgs/games/nanosaur/default.nix
+++ b/pkgs/games/nanosaur/default.nix
@@ -12,9 +12,9 @@ stdenv.mkDerivation rec {
     fetchSubmodules = true;
   };
 
+  nativeBuildInputs = [ cmake ];
   buildInputs = [
     SDL2
-    cmake
     makeWrapper
   ];
 
diff --git a/pkgs/games/space-cadet-pinball/default.nix b/pkgs/games/space-cadet-pinball/default.nix
index 31df5377f1d3d..3aed29adfd743 100644
--- a/pkgs/games/space-cadet-pinball/default.nix
+++ b/pkgs/games/space-cadet-pinball/default.nix
@@ -33,10 +33,10 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  nativeBuildInputs = [ cmake ];
   buildInputs = [
     SDL2
     SDL2_mixer
-    cmake
     makeWrapper
     Cocoa
   ];
diff --git a/pkgs/games/the-butterfly-effect/default.nix b/pkgs/games/the-butterfly-effect/default.nix
index f5330485eddc6..cc753783f0358 100644
--- a/pkgs/games/the-butterfly-effect/default.nix
+++ b/pkgs/games/the-butterfly-effect/default.nix
@@ -13,8 +13,9 @@ mkDerivation rec {
 
   postPatch = "sed '1i#include <vector>' -i src/model/World.h";
 
+  nativeBuildInputs = [ cmake ];
   buildInputs = [
-    qt5.qtbase qt5.qtsvg qt5.qttranslations box2d which cmake
+    qt5.qtbase qt5.qtsvg qt5.qttranslations box2d which
     gettext
   ];
 
diff --git a/pkgs/os-specific/linux/autosuspend/default.nix b/pkgs/os-specific/linux/autosuspend/default.nix
index 4283230f7ad78..fd4164be34a7a 100644
--- a/pkgs/os-specific/linux/autosuspend/default.nix
+++ b/pkgs/os-specific/linux/autosuspend/default.nix
@@ -5,13 +5,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "autosuspend";
-  version = "4.1.0";
+  version = "4.1.1";
 
   src = fetchFromGitHub {
     owner = "languitar";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0vn1qhsmjlgd7gn11w938kraz55xyixpzrgq06dar066hcsn1x8w";
+    sha256 = "sha256-UdHaz1JIofUrw9G/K40AVhBWdvMdTK4Wa7FWb6ntwr0=";
   };
 
   postPatch = ''
diff --git a/pkgs/os-specific/linux/intel-ocl/default.nix b/pkgs/os-specific/linux/intel-ocl/default.nix
index 06cb18b237742..026ce80c645af 100644
--- a/pkgs/os-specific/linux/intel-ocl/default.nix
+++ b/pkgs/os-specific/linux/intel-ocl/default.nix
@@ -5,7 +5,11 @@ stdenv.mkDerivation rec {
   version = "5.0-63503";
 
   src = fetchzip {
-    url = "https://registrationcenter-download.intel.com/akdlm/irc_nas/11396/SRB5.0_linux64.zip";
+    # https://github.com/NixOS/nixpkgs/issues/166886
+    urls = [
+      "https://registrationcenter-download.intel.com/akdlm/irc_nas/11396/SRB5.0_linux64.zip"
+      "http://registrationcenter-download.intel.com/akdlm/irc_nas/11396/SRB5.0_linux64.zip"
+    ];
     sha256 = "0qbp63l74s0i80ysh9ya8x7r79xkddbbz4378nms9i7a0kprg9p2";
     stripRoot = false;
   };
diff --git a/pkgs/pkgs-lib/formats.nix b/pkgs/pkgs-lib/formats.nix
index 495a7094f9b40..6495b024b0086 100644
--- a/pkgs/pkgs-lib/formats.nix
+++ b/pkgs/pkgs-lib/formats.nix
@@ -31,6 +31,9 @@ rec {
   */
 
 
+  inherit (import ./formats/java-properties/default.nix { inherit lib pkgs; })
+    javaProperties;
+
   json = {}: {
 
     type = with lib.types; let
diff --git a/pkgs/pkgs-lib/formats/java-properties/default.nix b/pkgs/pkgs-lib/formats/java-properties/default.nix
new file mode 100644
index 0000000000000..b63b96d32769f
--- /dev/null
+++ b/pkgs/pkgs-lib/formats/java-properties/default.nix
@@ -0,0 +1,90 @@
+{ lib, pkgs }:
+{
+  javaProperties = { comment ? "Generated with Nix" }: {
+    type = lib.types.attrsOf lib.types.str;
+
+    generate = name: value:
+      pkgs.runCommandLocal name
+        {
+          # Requirements
+          # ============
+          #
+          #  1. Strings in Nix carry over to the same
+          #     strings in Java => need proper escapes
+          #  2. Generate files quickly
+          #      - A JVM would have to match the app's
+          #        JVM to avoid build closure bloat
+          #      - Even then, JVM startup would slow
+          #        down config generation.
+          #
+          #
+          # Implementation
+          # ==============
+          #
+          # Escaping has two steps
+          #
+          # 1. jq
+          #    Escape known separators, in order not
+          #    to break up the keys and values.
+          #    This handles typical whitespace correctly,
+          #    but may produce garbage for other control
+          #    characters.
+          #
+          # 2. iconv
+          #    Escape >ascii code points to java escapes,
+          #    as .properties files are supposed to be
+          #    encoded in ISO 8859-1. It's an old format.
+          #    UTF-8 behavior may exist in some apps and
+          #    libraries, but we can't rely on this in
+          #    general.
+
+          passAsFile = [ "value" ];
+          value = builtins.toJSON value;
+          nativeBuildInputs = [
+            pkgs.jq
+            pkgs.libiconvReal
+          ];
+
+          jqCode =
+            let
+              main = ''
+                to_entries
+                  | .[]
+                  | "\(
+                      .key
+                      | ${commonEscapes}
+                      | gsub(" "; "\\ ")
+                      | gsub("="; "\\=")
+                    ) = \(
+                      .value
+                      | ${commonEscapes}
+                      | gsub("^ "; "\\ ")
+                      | gsub("\\n "; "\n\\ ")
+                    )"
+              '';
+              # Most escapes are equal for both keys and values.
+              commonEscapes = ''
+                gsub("\\\\"; "\\\\")
+                | gsub("\\n"; "\\n\\\n")
+                | gsub("#"; "\\#")
+                | gsub("!"; "\\!")
+                | gsub("\\t"; "\\t")
+                | gsub("\r"; "\\r")
+              '';
+            in
+            main;
+
+          inputEncoding = "UTF-8";
+
+          inherit comment;
+
+        } ''
+        (
+          echo "$comment" | while read -r ln; do echo "# $ln"; done
+          echo
+          jq -r --arg hash '#' "$jqCode" "$valuePath" \
+            | iconv --from-code "$inputEncoding" --to-code JAVA \
+        ) > "$out"
+      '';
+  };
+}
diff --git a/pkgs/pkgs-lib/formats/java-properties/test/Main.java b/pkgs/pkgs-lib/formats/java-properties/test/Main.java
new file mode 100644
index 0000000000000..dc83944f24b0c
--- /dev/null
+++ b/pkgs/pkgs-lib/formats/java-properties/test/Main.java
@@ -0,0 +1,27 @@
+import java.io.FileInputStream;
+import java.io.InputStream;
+import java.util.Properties;
+import java.util.SortedSet;
+import java.util.TreeSet;
+
+class Main {
+    public static void main (String args[]) {
+        try {
+            InputStream input = new FileInputStream(args[0]);
+            Properties prop = new Properties();
+            prop.load(input);
+            SortedSet<String> keySet = new TreeSet(prop.keySet());
+            for (String key : keySet) {
+                System.out.println("KEY");
+                System.out.println(key);
+                System.out.println("VALUE");
+                System.out.println(prop.get(key));
+                System.out.println("");
+            }
+        } catch (Exception e) {
+          e.printStackTrace();
+          System.err.println(e.toString());
+          System.exit(1);
+        }
+    }
+}
diff --git a/pkgs/pkgs-lib/formats/java-properties/test/default.nix b/pkgs/pkgs-lib/formats/java-properties/test/default.nix
new file mode 100644
index 0000000000000..4b3845c102966
--- /dev/null
+++ b/pkgs/pkgs-lib/formats/java-properties/test/default.nix
@@ -0,0 +1,85 @@
+{ fetchurl
+, formats
+, glibcLocales
+, jdk
+, lib
+, stdenv
+}:
+let
+  inherit (lib) concatStrings attrValues mapAttrs;
+
+  javaProperties = formats.javaProperties { };
+
+  input = {
+    foo = "bar";
+    "empty value" = "";
+    "typical.dot.syntax" = "com.sun.awt";
+    "" = "empty key's value";
+    "1" = "2 3";
+    "#" = "not a comment # still not";
+    "!" = "not a comment!";
+    "!a" = "still not! a comment";
+    "!b" = "still not ! a comment";
+    "dos paths" = "C:\\Program Files\\Nix For Windows\\nix.exe";
+    "a \t\nb" = " c";
+    "angry \t\nkey" = ''
+      multi
+      ${"\tline\r"}
+       space-
+        indented
+      trailing-space${" "}
+      trailing-space${"  "}
+      value
+    '';
+    "this=not" = "bad";
+    "nor = this" = "bad";
+    "all stuff" = "foo = bar";
+    "unicode big brain" = "e = mc□";
+    "ütf-8" = "dûh";
+    # NB: Some editors (vscode) show this _whole_ line in right-to-left order
+    "الجبر" = "أكثر من مجرد أرقام";
+  };
+
+in
+stdenv.mkDerivation {
+  name = "pkgs.formats.javaProperties-test-${jdk.name}";
+  nativeBuildInputs = [
+    jdk
+    glibcLocales
+  ];
+
+  # technically should go through the type.merge first, but that's tested
+  # in tests/formats.nix.
+  properties = javaProperties.generate "example.properties" input;
+
+  # Expected output as printed by Main.java
+  passAsFile = [ "expected" ];
+  expected = concatStrings (attrValues (
+    mapAttrs
+      (key: value:
+        ''
+          KEY
+          ${key}
+          VALUE
+          ${value}
+
+        ''
+      )
+      input
+  ));
+
+  src = lib.sourceByRegex ./. [
+    ".*\.java"
+  ];
+  LANG = "C.UTF-8";
+  buildPhase = ''
+    javac Main.java
+  '';
+  doCheck = true;
+  checkPhase = ''
+    cat -v $properties
+    java Main $properties >actual
+    diff -U3 $expectedPath actual
+  '';
+  installPhase = "touch $out";
+}
diff --git a/pkgs/pkgs-lib/tests/default.nix b/pkgs/pkgs-lib/tests/default.nix
index f3549ea9b0f2c..ae91e15aa9efa 100644
--- a/pkgs/pkgs-lib/tests/default.nix
+++ b/pkgs/pkgs-lib/tests/default.nix
@@ -1,7 +1,45 @@
 # Call nix-build on this file to run all tests in this directory
-{ pkgs ? import ../../.. {} }:
+
+# This produces a link farm derivation with the original attrs
+# merged on top of it.
+# You can run parts of the "hierarchy" with for example:
+#     nix-build -A java-properties
+# See `structured` below.
+
+{ pkgs ? import ../../.. { } }:
 let
-  formats = import ./formats.nix { inherit pkgs; };
-in pkgs.linkFarm "nixpkgs-pkgs-lib-tests" [
-  { name = "formats"; path = import ./formats.nix { inherit pkgs; }; }
-]
+  inherit (pkgs.lib) mapAttrs mapAttrsToList isDerivation mergeAttrs foldl' attrValues recurseIntoAttrs;
+
+  structured = {
+    formats = import ./formats.nix { inherit pkgs; };
+    java-properties = recurseIntoAttrs {
+      jdk8 = pkgs.callPackage ../formats/java-properties/test { jdk = pkgs.jdk8; };
+      jdk11 = pkgs.callPackage ../formats/java-properties/test { jdk = pkgs.jdk11_headless; };
+      jdk17 = pkgs.callPackage ../formats/java-properties/test { jdk = pkgs.jdk17_headless; };
+    };
+  };
+
+  flatten = prefix: as:
+    foldl'
+      mergeAttrs
+      { }
+      (attrValues
+        (mapAttrs
+          (k: v:
+            if isDerivation v
+            then { "${prefix}${k}" = v; }
+            else if v?recurseForDerivations
+            then flatten "${prefix}${k}-" (removeAttrs v [ "recurseForDerivations" ])
+            else builtins.trace v throw "expected derivation or recurseIntoAttrs")
+          as
+        )
+      );
+in
+
+# It has to be a link farm for inclusion in the hydra unstable jobset.
+pkgs.linkFarm "pkgs-lib-formats-tests"
+  (mapAttrsToList
+    (k: v: { name = k; path = v; })
+    (flatten "" structured)
+  )
+// structured
diff --git a/pkgs/pkgs-lib/tests/formats.nix b/pkgs/pkgs-lib/tests/formats.nix
index 2bc4e407fe752..1efe9d8686b1d 100644
--- a/pkgs/pkgs-lib/tests/formats.nix
+++ b/pkgs/pkgs-lib/tests/formats.nix
@@ -168,4 +168,23 @@ in runBuildTests {
       level4 = "deep"
     '';
   };
+
+  # See also java-properties/default.nix for more complete tests
+  testJavaProperties = {
+    drv = evalFormat formats.javaProperties {} {
+      foo = "bar";
+      "1" = "2";
+      "ütf 8" = "dûh";
+      # NB: Some editors (vscode) show this _whole_ line in right-to-left order
+      "الجبر" = "أكثر من مجرد أرقام";
+    };
+    expected = ''
+      # Generated with Nix
+
+      1 = 2
+      foo = bar
+      \u00fctf\ 8 = d\u00fbh
+      \u0627\u0644\u062c\u0628\u0631 = \u0623\u0643\u062b\u0631 \u0645\u0646 \u0645\u062c\u0631\u062f \u0623\u0631\u0642\u0627\u0645
+    '';
+  };
 }
diff --git a/pkgs/servers/calibre-web/default.nix b/pkgs/servers/calibre-web/default.nix
index f6cb86e409c7e..308654039983f 100644
--- a/pkgs/servers/calibre-web/default.nix
+++ b/pkgs/servers/calibre-web/default.nix
@@ -7,13 +7,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "calibre-web";
-  version = "0.6.16";
+  version = "0.6.17";
 
   src = fetchFromGitHub {
     owner = "janeczku";
     repo = "calibre-web";
     rev = version;
-    sha256 = "sha256-vRnzsV9pubAmyVSxZpBK+mD9Bkbt6BQYo5S0Jsl26Ns=";
+    sha256 = "sha256-K2va9as+z00txpg/0fR89+kpMzpQSiSSIV489NDs8Bs=";
   };
 
   propagatedBuildInputs = with python3Packages; [
diff --git a/pkgs/servers/dante/default.nix b/pkgs/servers/dante/default.nix
index 1ed03f0e3d5ae..12ba281d811c3 100644
--- a/pkgs/servers/dante/default.nix
+++ b/pkgs/servers/dante/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pam, libkrb5, cyrus_sasl, miniupnpc }:
+{ lib, stdenv, fetchurl, fetchpatch, pam, libkrb5, cyrus_sasl, miniupnpc, autoreconfHook }:
 
 stdenv.mkDerivation rec {
   pname = "dante";
@@ -9,6 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "0pbahkj43rx7rmv2x40mf5p3g3x9d6i2sz7pzglarf54w5ghd2j1";
   };
 
+  nativeBuildInputs = lib.optional stdenv.hostPlatform.isMips64 autoreconfHook;
   buildInputs = [ pam libkrb5 cyrus_sasl miniupnpc ];
 
   configureFlags = if !stdenv.isDarwin
@@ -17,6 +18,13 @@ stdenv.mkDerivation rec {
 
   dontAddDisableDepTrack = stdenv.isDarwin;
 
+  patches = lib.optional stdenv.hostPlatform.isMips64 [
+    (fetchpatch {
+      name = "0002-osdep-m4-Remove-getaddrinfo-too-low-checks.patch";
+      url = "https://raw.githubusercontent.com/buildroot/buildroot/master/package/dante/0002-osdep-m4-Remove-getaddrinfo-too-low-checks.patch";
+      sha256 = "sha256-e+qF8lB5tkiA7RlJ+tX5O6KxQrQp33RSPdP1TxU961Y=";
+    }) ];
+
   meta = with lib; {
     description = "A circuit-level SOCKS client/server that can be used to provide convenient and secure network connectivity";
     homepage    = "https://www.inet.no/dante/";
diff --git a/pkgs/servers/dns/knot-dns/default.nix b/pkgs/servers/dns/knot-dns/default.nix
index 80939b8df45dc..7367c269ab8d1 100644
--- a/pkgs/servers/dns/knot-dns/default.nix
+++ b/pkgs/servers/dns/knot-dns/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "knot-dns";
-  version = "3.1.6";
+  version = "3.1.7";
 
   src = fetchurl {
     url = "https://secure.nic.cz/files/knot-dns/knot-${version}.tar.xz";
-    sha256 = "e9ba1305d750dc08fb08687aec7ac55737ca073deaa0b867c884e0c0f2fdb753";
+    sha256 = "ffb6887e238ce4c7df0cc76bb55a5093465275201ac12156a3390782dc49857b";
   };
 
   outputs = [ "bin" "out" "dev" ];
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 7d749a31659ff..32273d35e7a76 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -30,6 +30,7 @@ let
   defaultOverrides = [
     # Override the version of some packages pinned in Home Assistant's setup.py and requirements_all.txt
     (mkOverride "python-slugify" "4.0.1" "sha256-aaUXdm4AwSaOW7/A0BCgqFCN4LGNMK1aH/NX+K5yQnA=")
+    (mkOverride "voluptuous" "0.12.2" "sha256-TbGsUHnbkkmCDUnIkctGYKb4yuNQSRIQq850H6v1ZRM=")
 
     # pytest-aiohttp>0.3.0 breaks home-assistant tests
     (self: super: {
diff --git a/pkgs/servers/matrix-synapse/default.nix b/pkgs/servers/matrix-synapse/default.nix
index cd762c7dc8bef..ffe76b25b1914 100644
--- a/pkgs/servers/matrix-synapse/default.nix
+++ b/pkgs/servers/matrix-synapse/default.nix
@@ -11,11 +11,11 @@ in
 with python3.pkgs;
 buildPythonApplication rec {
   pname = "matrix-synapse";
-  version = "1.55.0";
+  version = "1.55.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-IfLyp6IexNTMrq795qUMAPQ62mrMPwFyLE1yL8cu0T0=";
+    sha256 = "sha256-MCdwatNo4cDAaq9a3UFwSLJzT1ZxhoYqPOu/a957D2Y=";
   };
 
   buildInputs = [ openssl ];
diff --git a/pkgs/servers/monitoring/grafana/default.nix b/pkgs/servers/monitoring/grafana/default.nix
index f08652a648577..c541c74d5be5f 100644
--- a/pkgs/servers/monitoring/grafana/default.nix
+++ b/pkgs/servers/monitoring/grafana/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "grafana";
-  version = "8.4.4";
+  version = "8.4.5";
 
   excludedPackages = [ "alert_webhook_listener" "clean-swagger" "release_publisher" "slow_proxy" "slow_proxy_mac" "macaron" ];
 
@@ -10,15 +10,15 @@ buildGoModule rec {
     rev = "v${version}";
     owner = "grafana";
     repo = "grafana";
-    sha256 = "sha256-WLmmf2GlP7axuYj0TLJlDwe1k/9xNQbLvAggG+AshKg=";
+    sha256 = "sha256-CdGg979c7XD5V3jZbVeHUGylAarGc+cR+bFi5FngKtU=";
   };
 
   srcStatic = fetchurl {
     url = "https://dl.grafana.com/oss/release/grafana-${version}.linux-amd64.tar.gz";
-    sha256 = "sha256-eH6L7X1WvvL+9+R9FrpvVMxVJYcrHicaLkH2LUJs3AQ=";
+    sha256 = "sha256-PjDTEmzjDmT1WQGqF3GwojJ6mG2whBoPK0KWfXI8AB4=";
   };
 
-  vendorSha256 = "sha256-RugV5cHlpR739CA1C/7FkXasvkv18m7pPsK6mxfSkC0=";
+  vendorSha256 = "sha256-iOJEy7dCZGRTaOuL/09wcMlNDHjRi9SIr9bialdcKi4=";
 
   nativeBuildInputs = [ wire ];
 
diff --git a/pkgs/servers/monitoring/prometheus/dmarc-exporter/default.nix b/pkgs/servers/monitoring/prometheus/dmarc-exporter/default.nix
index 98848ee670227..e083df90b4135 100644
--- a/pkgs/servers/monitoring/prometheus/dmarc-exporter/default.nix
+++ b/pkgs/servers/monitoring/prometheus/dmarc-exporter/default.nix
@@ -7,7 +7,8 @@ let
       poetry2nix.defaultPoetryOverrides
       (import ./poetry-git-overlay.nix { inherit pkgs; })
       (self: super: {
-        dmarc-metrics-exporter = super.dmarc-metrics-exporter.overridePythonAttrs ({ meta ? {}, ... }: {
+        dmarc-metrics-exporter = super.dmarc-metrics-exporter.overridePythonAttrs ({ nativeBuildInputs ? [ ], meta ? {}, ... }: {
+          nativeBuildInputs = nativeBuildInputs ++ [ self.poetry ];
           meta = with lib; meta // {
             license = licenses.mit;
             homepage = "https://github.com/jgosmann/dmarc-metrics-exporter/";
@@ -44,6 +45,9 @@ let
           '';
         });
         dataclasses = null;
+        bite-parser = super.bite-parser.overridePythonAttrs (old: {
+          nativeBuildInputs = old.nativeBuildInputs ++ [ self.poetry ];
+        });
       })
     ];
   }) python;
diff --git a/pkgs/servers/tautulli/default.nix b/pkgs/servers/tautulli/default.nix
index 9e5fb8e448273..df327f0e8f32c 100644
--- a/pkgs/servers/tautulli/default.nix
+++ b/pkgs/servers/tautulli/default.nix
@@ -2,7 +2,7 @@
 
 buildPythonApplication rec {
   pname = "Tautulli";
-  version = "2.9.4";
+  version = "2.9.5";
   format = "other";
 
   pythonPath = [ setuptools ];
@@ -12,7 +12,7 @@ buildPythonApplication rec {
     owner = "Tautulli";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Hgu1peKv00+FZtszewqofwRueC5ZfUFMM/5ax2Gnf44=";
+    sha256 = "sha256-agkYfLWmeQOD+dtoYvTcNPXjfU3kv56c15AFeB7eVTw=";
   };
 
   installPhase = ''
diff --git a/pkgs/servers/web-apps/frab/Gemfile b/pkgs/servers/web-apps/frab/Gemfile
deleted file mode 100644
index 098b8f3d7d7a1..0000000000000
--- a/pkgs/servers/web-apps/frab/Gemfile
+++ /dev/null
@@ -1,88 +0,0 @@
-source 'https://rubygems.org'
-
-if ENV['CUSTOM_RUBY_VERSION']
-  ruby ENV['CUSTOM_RUBY_VERSION'] # i.e.: '2.3'
-end
-
-gem 'rails', '~> 4.2'
-
-# Use SCSS for stylesheets
-gem 'sass-rails', '~> 5.0'
-# Use Uglifier as compressor for JavaScript assets
-gem 'uglifier', '>= 1.3.0'
-# Use CoffeeScript for .coffee assets and views
-gem 'coffee-rails', '~> 4.1.0'
-
-gem 'mysql2', group: :mysql
-gem 'pg', group: :postgresql
-gem 'sqlite3', group: :sqlite3
-
-# Use Puma as the app server
-gem 'puma'
-
-# Capistrano for deployment
-group :capistrano do
-  gem 'airbrussh'
-  gem 'capistrano', '~> 3.4.0', require: false
-  gem 'capistrano-rails',   require: false
-  gem 'capistrano-bundler', require: false
-  gem 'capistrano-rvm',     require: false
-  gem 'capistrano3-puma',   require: false
-end
-
-# Use jquery as the JavaScript library
-gem 'jquery-rails'
-gem 'jquery-migrate-rails'
-gem 'jquery-ui-rails'
-
-# Build JSON APIs with ease. Read more: https://github.com/rails/jbuilder
-gem 'jbuilder', '~> 2.0'
-
-gem 'activeresource'
-gem 'acts_as_commentable'
-gem 'bcrypt'
-gem 'cancancan'
-gem 'cocoon'
-gem 'dotenv-rails'
-gem 'haml'
-gem 'localized_language_select', github: 'frab/localized_language_select', branch: 'master'
-gem 'nokogiri'
-gem 'paperclip', '~> 4.1'
-gem 'paper_trail'
-gem 'prawn', '< 1.0'
-gem 'prawn_rails'
-gem 'ransack'
-gem 'ri_cal'
-gem 'roust'
-gem 'rqrcode'
-#gem 'roust', :git => 'git@github.com:bulletproofnetworks/roust.git'
-gem 'simple_form'
-gem 'sucker_punch'
-gem 'transitions', require: ['transitions', 'active_record/transitions']
-gem 'will_paginate'
-
-group :production do
-  gem 'exception_notification'
-end
-
-group :development, :test do
-  gem 'bullet'
-  gem 'pry-rails'
-  gem 'pry-byebug'
-  gem 'letter_opener'
-  gem 'faker'
-end
-
-group :test do
-  gem 'database_cleaner'
-  gem 'factory_girl_rails', '~> 4.0'
-  gem 'shoulda'
-end
-
-group :doc do
-  gem 'redcarpet'       # documentation
-  gem 'github-markdown' # documentation
-  gem 'yard'            # documentation
-  # gem 'rails-erd'      # graph
-  # gem 'ruby-graphviz', require: 'graphviz' # Optional: only required for graphing
-end
diff --git a/pkgs/servers/web-apps/frab/Gemfile.lock b/pkgs/servers/web-apps/frab/Gemfile.lock
deleted file mode 100644
index dc18be7a33db8..0000000000000
--- a/pkgs/servers/web-apps/frab/Gemfile.lock
+++ /dev/null
@@ -1,329 +0,0 @@
-GIT
-  remote: git://github.com/frab/localized_language_select.git
-  revision: 85df6b97789de6e29c630808b630e56a1b76f80c
-  branch: master
-  specs:
-    localized_language_select (0.3.0)
-      rails (>= 4.1.0)
-
-GEM
-  remote: https://rubygems.org/
-  specs:
-    actionmailer (4.2.7.1)
-      actionpack (= 4.2.7.1)
-      actionview (= 4.2.7.1)
-      activejob (= 4.2.7.1)
-      mail (~> 2.5, >= 2.5.4)
-      rails-dom-testing (~> 1.0, >= 1.0.5)
-    actionpack (4.2.7.1)
-      actionview (= 4.2.7.1)
-      activesupport (= 4.2.7.1)
-      rack (~> 1.6)
-      rack-test (~> 0.6.2)
-      rails-dom-testing (~> 1.0, >= 1.0.5)
-      rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    actionview (4.2.7.1)
-      activesupport (= 4.2.7.1)
-      builder (~> 3.1)
-      erubis (~> 2.7.0)
-      rails-dom-testing (~> 1.0, >= 1.0.5)
-      rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    activejob (4.2.7.1)
-      activesupport (= 4.2.7.1)
-      globalid (>= 0.3.0)
-    activemodel (4.2.7.1)
-      activesupport (= 4.2.7.1)
-      builder (~> 3.1)
-    activerecord (4.2.7.1)
-      activemodel (= 4.2.7.1)
-      activesupport (= 4.2.7.1)
-      arel (~> 6.0)
-    activeresource (4.1.0)
-      activemodel (~> 4.0)
-      activesupport (~> 4.0)
-      rails-observers (~> 0.1.2)
-    activesupport (4.2.7.1)
-      i18n (~> 0.7)
-      json (~> 1.7, >= 1.7.7)
-      minitest (~> 5.1)
-      thread_safe (~> 0.3, >= 0.3.4)
-      tzinfo (~> 1.1)
-    acts_as_commentable (4.0.2)
-    addressable (2.4.0)
-    airbrussh (1.1.1)
-      sshkit (>= 1.6.1, != 1.7.0)
-    arel (6.0.3)
-    bcrypt (3.1.11)
-    builder (3.2.2)
-    bullet (5.4.0)
-      activesupport (>= 3.0.0)
-      uniform_notifier (~> 1.10.0)
-    byebug (9.0.5)
-    cancancan (1.15.0)
-    capistrano (3.4.1)
-      i18n
-      rake (>= 10.0.0)
-      sshkit (~> 1.3)
-    capistrano-bundler (1.1.4)
-      capistrano (~> 3.1)
-      sshkit (~> 1.2)
-    capistrano-rails (1.1.8)
-      capistrano (~> 3.1)
-      capistrano-bundler (~> 1.1)
-    capistrano-rvm (0.1.2)
-      capistrano (~> 3.0)
-      sshkit (~> 1.2)
-    capistrano3-puma (1.2.1)
-      capistrano (~> 3.0)
-      puma (>= 2.6)
-    chunky_png (1.3.7)
-    climate_control (0.0.3)
-      activesupport (>= 3.0)
-    cocaine (0.5.8)
-      climate_control (>= 0.0.3, < 1.0)
-    cocoon (1.2.9)
-    coderay (1.1.1)
-    coffee-rails (4.1.1)
-      coffee-script (>= 2.2.0)
-      railties (>= 4.0.0, < 5.1.x)
-    coffee-script (2.4.1)
-      coffee-script-source
-      execjs
-    coffee-script-source (1.10.0)
-    concurrent-ruby (1.0.2)
-    database_cleaner (1.5.3)
-    dotenv (2.1.1)
-    dotenv-rails (2.1.1)
-      dotenv (= 2.1.1)
-      railties (>= 4.0, < 5.1)
-    erubis (2.7.0)
-    exception_notification (4.2.1)
-      actionmailer (>= 4.0, < 6)
-      activesupport (>= 4.0, < 6)
-    execjs (2.7.0)
-    factory_girl (4.7.0)
-      activesupport (>= 3.0.0)
-    factory_girl_rails (4.7.0)
-      factory_girl (~> 4.7.0)
-      railties (>= 3.0.0)
-    faker (1.6.6)
-      i18n (~> 0.5)
-    github-markdown (0.6.9)
-    globalid (0.3.7)
-      activesupport (>= 4.1.0)
-    haml (4.0.7)
-      tilt
-    httparty (0.14.0)
-      multi_xml (>= 0.5.2)
-    i18n (0.7.0)
-    jbuilder (2.6.0)
-      activesupport (>= 3.0.0, < 5.1)
-      multi_json (~> 1.2)
-    jquery-migrate-rails (1.2.1)
-    jquery-rails (4.2.1)
-      rails-dom-testing (>= 1, < 3)
-      railties (>= 4.2.0)
-      thor (>= 0.14, < 2.0)
-    jquery-ui-rails (5.0.5)
-      railties (>= 3.2.16)
-    json (1.8.3)
-    launchy (2.4.3)
-      addressable (~> 2.3)
-    letter_opener (1.4.1)
-      launchy (~> 2.2)
-    loofah (2.0.3)
-      nokogiri (>= 1.5.9)
-    mail (2.6.4)
-      mime-types (>= 1.16, < 4)
-    method_source (0.8.2)
-    mime-types (3.1)
-      mime-types-data (~> 3.2015)
-    mime-types-data (3.2016.0521)
-    mimemagic (0.3.0)
-    mini_portile2 (2.1.0)
-    minitest (5.9.1)
-    multi_json (1.12.1)
-    multi_xml (0.5.5)
-    mysql2 (0.4.4)
-    net-scp (1.2.1)
-      net-ssh (>= 2.6.5)
-    net-ssh (3.2.0)
-    nokogiri (1.6.7.2)
-      mini_portile2 (~> 2.0.0.rc2)
-      pkg-config (~> 1.1.7)
-    paper_trail (5.2.2)
-      activerecord (>= 3.0, < 6.0)
-      request_store (~> 1.1)
-    paperclip (4.3.7)
-      activemodel (>= 3.2.0)
-      activesupport (>= 3.2.0)
-      cocaine (~> 0.5.5)
-      mime-types
-      mimemagic (= 0.3.0)
-    pdf-core (0.1.6)
-    pg (0.19.0)
-    pkg-config (1.1.7)
-    polyamorous (1.3.1)
-      activerecord (>= 3.0)
-    prawn (0.15.0)
-      pdf-core (~> 0.1.3)
-      ttfunk (~> 1.1.0)
-    prawn_rails (0.0.11)
-      prawn (>= 0.11.1)
-      railties (>= 3.0.0)
-    pry (0.10.4)
-      coderay (~> 1.1.0)
-      method_source (~> 0.8.1)
-      slop (~> 3.4)
-    pry-byebug (3.4.0)
-      byebug (~> 9.0)
-      pry (~> 0.10)
-    pry-rails (0.3.4)
-      pry (>= 0.9.10)
-    puma (3.9.1)
-    rack (1.6.11)
-    rack-test (0.6.3)
-      rack (>= 1.0)
-    rails (4.2.7.1)
-      actionmailer (= 4.2.7.1)
-      actionpack (= 4.2.7.1)
-      actionview (= 4.2.7.1)
-      activejob (= 4.2.7.1)
-      activemodel (= 4.2.7.1)
-      activerecord (= 4.2.7.1)
-      activesupport (= 4.2.7.1)
-      bundler (>= 1.3.0, < 2.0)
-      railties (= 4.2.7.1)
-      sprockets-rails
-    rails-deprecated_sanitizer (1.0.3)
-      activesupport (>= 4.2.0.alpha)
-    rails-dom-testing (1.0.7)
-      activesupport (>= 4.2.0.beta, < 5.0)
-      nokogiri (~> 1.6.0)
-      rails-deprecated_sanitizer (>= 1.0.1)
-    rails-html-sanitizer (1.0.3)
-      loofah (~> 2.0)
-    rails-observers (0.1.2)
-      activemodel (~> 4.0)
-    railties (4.2.7.1)
-      actionpack (= 4.2.7.1)
-      activesupport (= 4.2.7.1)
-      rake (>= 0.8.7)
-      thor (>= 0.18.1, < 2.0)
-    rake (11.3.0)
-    ransack (1.8.2)
-      actionpack (>= 3.0)
-      activerecord (>= 3.0)
-      activesupport (>= 3.0)
-      i18n
-      polyamorous (~> 1.3)
-    redcarpet (3.3.4)
-    request_store (1.3.1)
-    ri_cal (0.8.8)
-    roust (1.8.9)
-      activesupport (>= 4.0.10)
-      httparty (>= 0.13.1)
-      mail (>= 2.5.4)
-    rqrcode (0.10.1)
-      chunky_png (~> 1.0)
-    sass (3.4.22)
-    sass-rails (5.0.6)
-      railties (>= 4.0.0, < 6)
-      sass (~> 3.1)
-      sprockets (>= 2.8, < 4.0)
-      sprockets-rails (>= 2.0, < 4.0)
-      tilt (>= 1.1, < 3)
-    shoulda (3.5.0)
-      shoulda-context (~> 1.0, >= 1.0.1)
-      shoulda-matchers (>= 1.4.1, < 3.0)
-    shoulda-context (1.2.1)
-    shoulda-matchers (2.8.0)
-      activesupport (>= 3.0.0)
-    simple_form (3.3.1)
-      actionpack (> 4, < 5.1)
-      activemodel (> 4, < 5.1)
-    slop (3.6.0)
-    sprockets (3.7.0)
-      concurrent-ruby (~> 1.0)
-      rack (> 1, < 3)
-    sprockets-rails (3.2.0)
-      actionpack (>= 4.0)
-      activesupport (>= 4.0)
-      sprockets (>= 3.0.0)
-    sqlite3 (1.3.11)
-    sshkit (1.11.3)
-      net-scp (>= 1.1.2)
-      net-ssh (>= 2.8.0)
-    sucker_punch (2.0.2)
-      concurrent-ruby (~> 1.0.0)
-    thor (0.19.1)
-    thread_safe (0.3.5)
-    tilt (2.0.5)
-    transitions (1.2.0)
-    ttfunk (1.1.1)
-    tzinfo (1.2.2)
-      thread_safe (~> 0.1)
-    uglifier (3.0.2)
-      execjs (>= 0.3.0, < 3)
-    uniform_notifier (1.10.0)
-    will_paginate (3.1.3)
-    yard (0.9.5)
-
-PLATFORMS
-  ruby
-
-DEPENDENCIES
-  activeresource
-  acts_as_commentable
-  airbrussh
-  bcrypt
-  bullet
-  cancancan
-  capistrano (~> 3.4.0)
-  capistrano-bundler
-  capistrano-rails
-  capistrano-rvm
-  capistrano3-puma
-  cocoon
-  coffee-rails (~> 4.1.0)
-  database_cleaner
-  dotenv-rails
-  exception_notification
-  factory_girl_rails (~> 4.0)
-  faker
-  github-markdown
-  haml
-  jbuilder (~> 2.0)
-  jquery-migrate-rails
-  jquery-rails
-  jquery-ui-rails
-  letter_opener
-  localized_language_select!
-  mysql2
-  nokogiri
-  paper_trail
-  paperclip (~> 4.1)
-  pg
-  prawn (< 1.0)
-  prawn_rails
-  pry-byebug
-  pry-rails
-  puma
-  rails (~> 4.2)
-  ransack
-  redcarpet
-  ri_cal
-  roust
-  rqrcode
-  sass-rails (~> 5.0)
-  shoulda
-  simple_form
-  sqlite3
-  sucker_punch
-  transitions
-  uglifier (>= 1.3.0)
-  will_paginate
-  yard
-
-BUNDLED WITH
-   1.13.1
diff --git a/pkgs/servers/web-apps/frab/gemset.nix b/pkgs/servers/web-apps/frab/gemset.nix
deleted file mode 100644
index cf39de25ea6aa..0000000000000
--- a/pkgs/servers/web-apps/frab/gemset.nix
+++ /dev/null
@@ -1,998 +0,0 @@
-{
-  actionmailer = {
-    dependencies = ["actionpack" "actionview" "activejob" "mail" "rails-dom-testing"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0lw1pss1mrjm7x7qcg9pvxv55rz3d994yf3mwmlfg1y12fxq00n3";
-      type = "gem";
-    };
-    version = "4.2.7.1";
-  };
-  actionpack = {
-    dependencies = ["actionview" "activesupport" "rack" "rack-test" "rails-dom-testing" "rails-html-sanitizer"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1ray5bvlmkimjax011zsw0mz9llfkqrfm7q1avjlp4i0kpcz8zlh";
-      type = "gem";
-    };
-    version = "4.2.7.1";
-  };
-  actionview = {
-    dependencies = ["activesupport" "builder" "erubis" "rails-dom-testing" "rails-html-sanitizer"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "11m2x5nlbqrw79fh6h7m444lrka7wwy32b0dvgqg7ilbzih43k0c";
-      type = "gem";
-    };
-    version = "4.2.7.1";
-  };
-  activejob = {
-    dependencies = ["activesupport" "globalid"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0ish5wd8nvmj7f6x1i22aw5ycizy5n1z1c7f3kyxmqwhw7lb0gaz";
-      type = "gem";
-    };
-    version = "4.2.7.1";
-  };
-  activemodel = {
-    dependencies = ["activesupport" "builder"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0acz0mbmahsc9mn41275fpfnrqwig5k09m3xhz3455kv90fn79v5";
-      type = "gem";
-    };
-    version = "4.2.7.1";
-  };
-  activerecord = {
-    dependencies = ["activemodel" "activesupport" "arel"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1lk8l6i9p7qfl0pg261v5yph0w0sc0vysrdzc6bm5i5rxgi68flj";
-      type = "gem";
-    };
-    version = "4.2.7.1";
-  };
-  activeresource = {
-    dependencies = ["activemodel" "activesupport" "rails-observers"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0nr5is20cx18s7vg8bdrdc996s2abl3h7fsi1q6mqsrzw7nrv2fa";
-      type = "gem";
-    };
-    version = "4.1.0";
-  };
-  activesupport = {
-    dependencies = ["i18n" "json" "minitest" "thread_safe" "tzinfo"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1gds12k7nxrcc09b727a458ndidy1nfcllj9x22jcaj7pppvq6r4";
-      type = "gem";
-    };
-    version = "4.2.7.1";
-  };
-  acts_as_commentable = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1p4bwyqmm4ybcscn292aixschdzvns2dpl8a7w4zm0rqy2619cc9";
-      type = "gem";
-    };
-    version = "4.0.2";
-  };
-  addressable = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0mpn7sbjl477h56gmxsjqb89r5s3w7vx5af994ssgc3iamvgzgvs";
-      type = "gem";
-    };
-    version = "2.4.0";
-  };
-  airbrussh = {
-    dependencies = ["sshkit"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0pv22d2kjdbsg9q45jca3f5gsylr2r1wfpn58g58xj4s4q4r95nx";
-      type = "gem";
-    };
-    version = "1.1.1";
-  };
-  arel = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1a270mlajhrmpqbhxcqjqypnvgrq4pgixpv3w9gwp1wrrapnwrzk";
-      type = "gem";
-    };
-    version = "6.0.3";
-  };
-  bcrypt = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1d254sdhdj6mzak3fb5x3jam8b94pvl1srladvs53j05a89j5z50";
-      type = "gem";
-    };
-    version = "3.1.11";
-  };
-  builder = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "14fii7ab8qszrvsvhz6z2z3i4dw0h41a62fjr2h1j8m41vbrmyv2";
-      type = "gem";
-    };
-    version = "3.2.2";
-  };
-  bullet = {
-    dependencies = ["activesupport" "uniform_notifier"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "06pba7bdjnazbl0yhhvlina08nkawnm76zihkaam4k7fm0yrq1k0";
-      type = "gem";
-    };
-    version = "5.4.0";
-  };
-  byebug = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "18sdnscwwm76i2kbcib2ckwfwpq8b1dbfr97gdcx3j1x547yqv9x";
-      type = "gem";
-    };
-    version = "9.0.5";
-  };
-  cancancan = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "05kb459laaw339n7mas37v4k83nwz228bfpaghgybza347341x85";
-      type = "gem";
-    };
-    version = "1.15.0";
-  };
-  capistrano = {
-    dependencies = ["i18n" "rake" "sshkit"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0f73w6gpml0ickmwky1cn6d8392q075zy10a323f3vmyvxyhr0jb";
-      type = "gem";
-    };
-    version = "3.4.1";
-  };
-  capistrano-bundler = {
-    dependencies = ["capistrano" "sshkit"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1f4iikm7pn0li2lj6p53wl0d6y7svn0h76z9c6c582mmwxa9c72p";
-      type = "gem";
-    };
-    version = "1.1.4";
-  };
-  capistrano-rails = {
-    dependencies = ["capistrano" "capistrano-bundler"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "03lzihrq72rwcqq7jiqak79wy0xbdnymn5gxj0bfgfjlg5kpgssw";
-      type = "gem";
-    };
-    version = "1.1.8";
-  };
-  capistrano-rvm = {
-    dependencies = ["capistrano" "sshkit"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "15sy8zcal041yy5kb7fcdqnxvndgdhg3w1kvb5dk7hfjk3ypznsa";
-      type = "gem";
-    };
-    version = "0.1.2";
-  };
-  capistrano3-puma = {
-    dependencies = ["capistrano" "puma"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0ynz1arnr07kcl0vsaa1znhp2ywhhs4fwndnkw8sasr9bydksln8";
-      type = "gem";
-    };
-    version = "1.2.1";
-  };
-  chunky_png = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1p1zy4gyfp7rapr2yxcljkw6qh0chkwf356i387b3fg85cwdj4xh";
-      type = "gem";
-    };
-    version = "1.3.7";
-  };
-  climate_control = {
-    dependencies = ["activesupport"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0krknwk6b8lwv1j9kjbxib6kf5zh4pxkf3y2vcyycx5d6nci1s55";
-      type = "gem";
-    };
-    version = "0.0.3";
-  };
-  cocaine = {
-    dependencies = ["climate_control"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "01kk5xd7lspbkdvn6nyj0y51zhvia3z6r4nalbdcqw5fbsywwi7d";
-      type = "gem";
-    };
-    version = "0.5.8";
-  };
-  cocoon = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1gzznkrs6qy31v85cvdqyn5wd3vwlciwibf9clmd6gi4dns21pmv";
-      type = "gem";
-    };
-    version = "1.2.9";
-  };
-  coderay = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1x6z923iwr1hi04k6kz5a6llrixflz8h5sskl9mhaaxy9jx2x93r";
-      type = "gem";
-    };
-    version = "1.1.1";
-  };
-  coffee-rails = {
-    dependencies = ["coffee-script" "railties"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1mv1kaw3z4ry6cm51w8pfrbby40gqwxanrqyqr0nvs8j1bscc1gw";
-      type = "gem";
-    };
-    version = "4.1.1";
-  };
-  coffee-script = {
-    dependencies = ["coffee-script-source" "execjs"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0rc7scyk7mnpfxqv5yy4y5q1hx3i7q3ahplcp4bq2g5r24g2izl2";
-      type = "gem";
-    };
-    version = "2.4.1";
-  };
-  coffee-script-source = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1k4fg39rrkl3bpgchfj94fbl9s4ysaz16w8dkqncf2vyf79l3qz0";
-      type = "gem";
-    };
-    version = "1.10.0";
-  };
-  concurrent-ruby = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1kb4sav7yli12pjr8lscv8z49g52a5xzpfg3z9h8clzw6z74qjsw";
-      type = "gem";
-    };
-    version = "1.0.2";
-  };
-  database_cleaner = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0fx6zmqznklmkbjl6f713jyl11d4g9q220rcl86m2jp82r8kfwjj";
-      type = "gem";
-    };
-    version = "1.5.3";
-  };
-  dotenv = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1p6zz0xzb15vq8jphpw2fh6m4dianw7s76ci8vj9x3zxayrn4lfm";
-      type = "gem";
-    };
-    version = "2.1.1";
-  };
-  dotenv-rails = {
-    dependencies = ["dotenv" "railties"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "17s6c0yqaz01xd5wywjscbvv0pa3grak2lhwby91j84qm6h95vxz";
-      type = "gem";
-    };
-    version = "2.1.1";
-  };
-  erubis = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1fj827xqjs91yqsydf0zmfyw9p4l2jz5yikg3mppz6d7fi8kyrb3";
-      type = "gem";
-    };
-    version = "2.7.0";
-  };
-  exception_notification = {
-    dependencies = ["actionmailer" "activesupport"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1vclsr0rjfy1khvqyj67lgpa0v14nb542vvjkyaswn367nnmijhw";
-      type = "gem";
-    };
-    version = "4.2.1";
-  };
-  execjs = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1yz55sf2nd3l666ms6xr18sm2aggcvmb8qr3v53lr4rir32y1yp1";
-      type = "gem";
-    };
-    version = "2.7.0";
-  };
-  factory_girl = {
-    dependencies = ["activesupport"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1xzl4z9z390fsnyxp10c9if2n46zan3n6zwwpfnwc33crv4s410i";
-      type = "gem";
-    };
-    version = "4.7.0";
-  };
-  factory_girl_rails = {
-    dependencies = ["factory_girl" "railties"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0hzpirb33xdqaz44i1mbcfv0icjrghhgaz747llcfsflljd4pa4r";
-      type = "gem";
-    };
-    version = "4.7.0";
-  };
-  faker = {
-    dependencies = ["i18n"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "09amnh5d0m3q2gpb0vr9spbfa8l2nc0kl3s79y6sx7a16hrl4vvc";
-      type = "gem";
-    };
-    version = "1.6.6";
-  };
-  github-markdown = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0nax4fyyhz9xmi7q6mmc6d1h8hc0cxda9d7q5z0pba88mj00s9fj";
-      type = "gem";
-    };
-    version = "0.6.9";
-  };
-  globalid = {
-    dependencies = ["activesupport"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "11plkgyl3w9k4y2scc1igvpgwyz4fnmsr63h2q4j8wkb48nlnhak";
-      type = "gem";
-    };
-    version = "0.3.7";
-  };
-  haml = {
-    dependencies = ["tilt"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0mrzjgkygvfii66bbylj2j93na8i89998yi01fin3whwqbvx0m1p";
-      type = "gem";
-    };
-    version = "4.0.7";
-  };
-  httparty = {
-    dependencies = ["multi_xml"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1msa213hclsv14ijh49i1wggf9avhnj2j4xr58m9jx6fixlbggw6";
-      type = "gem";
-    };
-    version = "0.14.0";
-  };
-  i18n = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1i5z1ykl8zhszsxcs8mzl8d0dxgs3ylz8qlzrw74jb0gplkx6758";
-      type = "gem";
-    };
-    version = "0.7.0";
-  };
-  jbuilder = {
-    dependencies = ["activesupport" "multi_json"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1jbh1296imd0arc9nl1m71yfd7kg505p8srr1ijpsqv4hhbz5qci";
-      type = "gem";
-    };
-    version = "2.6.0";
-  };
-  jquery-migrate-rails = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0pcfs339wki4ax4imb4qi2xb04bbj6j4xvn8x3yn6yf95frrvch6";
-      type = "gem";
-    };
-    version = "1.2.1";
-  };
-  jquery-rails = {
-    dependencies = ["rails-dom-testing" "railties" "thor"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0prqyixv7j2qlq67qdr3miwcyvi27b9a82j51gbpb6vcl0ig2rik";
-      type = "gem";
-    };
-    version = "4.2.1";
-  };
-  jquery-ui-rails = {
-    dependencies = ["railties"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1gfygrv4bjpjd2c377lw7xzk1b77rxjyy3w6wl4bq1gkqvyrkx77";
-      type = "gem";
-    };
-    version = "5.0.5";
-  };
-  json = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1nsby6ry8l9xg3yw4adlhk2pnc7i0h0rznvcss4vk3v74qg0k8lc";
-      type = "gem";
-    };
-    version = "1.8.3";
-  };
-  launchy = {
-    dependencies = ["addressable"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "190lfbiy1vwxhbgn4nl4dcbzxvm049jwc158r2x7kq3g5khjrxa2";
-      type = "gem";
-    };
-    version = "2.4.3";
-  };
-  letter_opener = {
-    dependencies = ["launchy"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1pcrdbxvp2x5six8fqn8gf09bn9rd3jga76ds205yph5m8fsda21";
-      type = "gem";
-    };
-    version = "1.4.1";
-  };
-  localized_language_select = {
-    dependencies = ["rails"];
-    source = {
-      fetchSubmodules = false;
-      rev = "85df6b97789de6e29c630808b630e56a1b76f80c";
-      sha256 = "1b2pd8120nrl3s3idpgdzhrjkn9g5sxnkx4j671fjiyhadlr0q5j";
-      type = "git";
-      url = "git://github.com/frab/localized_language_select.git";
-    };
-    version = "0.3.0";
-  };
-  loofah = {
-    dependencies = ["nokogiri"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "109ps521p0sr3kgc460d58b4pr1z4mqggan2jbsf0aajy9s6xis8";
-      type = "gem";
-    };
-    version = "2.0.3";
-  };
-  mail = {
-    dependencies = ["mime-types"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0c9vqfy0na9b5096i5i4qvrvhwamjnmajhgqi3kdsdfl8l6agmkp";
-      type = "gem";
-    };
-    version = "2.6.4";
-  };
-  method_source = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1g5i4w0dmlhzd18dijlqw5gk27bv6dj2kziqzrzb7mpgxgsd1sf2";
-      type = "gem";
-    };
-    version = "0.8.2";
-  };
-  mime-types = {
-    dependencies = ["mime-types-data"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0087z9kbnlqhci7fxh9f6il63hj1k02icq2rs0c6cppmqchr753m";
-      type = "gem";
-    };
-    version = "3.1";
-  };
-  mime-types-data = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "04my3746hwa4yvbx1ranhfaqkgf6vavi1kyijjnw8w3dy37vqhkm";
-      type = "gem";
-    };
-    version = "3.2016.0521";
-  };
-  mimemagic = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "101lq4bnjs7ywdcicpw3vbz9amg5gbb4va1626fybd2hawgdx8d9";
-      type = "gem";
-    };
-    version = "0.3.0";
-  };
-  mini_portile2 = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1y25adxb1hgg1wb2rn20g3vl07qziq6fz364jc5694611zz863hb";
-      type = "gem";
-    };
-    version = "2.1.0";
-  };
-  minitest = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0300naf4ilpd9sf0k8si9h9sclkizaschn8bpnri5fqmvm9ybdbq";
-      type = "gem";
-    };
-    version = "5.9.1";
-  };
-  multi_json = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1wpc23ls6v2xbk3l1qncsbz16npvmw8p0b38l8czdzri18mp51xk";
-      type = "gem";
-    };
-    version = "1.12.1";
-  };
-  multi_xml = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0i8r7dsz4z79z3j023l8swan7qpbgxbwwz11g38y2vjqjk16v4q8";
-      type = "gem";
-    };
-    version = "0.5.5";
-  };
-  mysql2 = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1v537b7865f4z610rljy8prwmq1yhk3zalp9mcbxn7aqb3g75pra";
-      type = "gem";
-    };
-    version = "0.4.4";
-  };
-  net-scp = {
-    dependencies = ["net-ssh"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0b0jqrcsp4bbi4n4mzyf70cp2ysyp6x07j8k8cqgxnvb4i3a134j";
-      type = "gem";
-    };
-    version = "1.2.1";
-  };
-  net-ssh = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "11djaq0h3bzzy61dca3l84rrs91702hha4vgg387gviipgz7f3yy";
-      type = "gem";
-    };
-    version = "3.2.0";
-  };
-  nokogiri = {
-    dependencies = ["mini_portile2" "pkg-config"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "11sbmpy60ynak6s3794q32lc99hs448msjy8rkp84ay7mq7zqspv";
-      type = "gem";
-    };
-    version = "1.6.7.2";
-  };
-  paper_trail = {
-    dependencies = ["activerecord" "request_store"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1w3y2h1w0kml2fmzx4sdcrhnbj273npwrs0cx91xdgy2qfjj6hmr";
-      type = "gem";
-    };
-    version = "5.2.2";
-  };
-  paperclip = {
-    dependencies = ["activemodel" "activesupport" "cocaine" "mime-types" "mimemagic"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0r8krh5xg790845wzlc2r7l0jwskw4c4wk9xh4bpprqykwaghg0r";
-      type = "gem";
-    };
-    version = "4.3.7";
-  };
-  pdf-core = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1x121sznmhfmjnk0rzpp6djxgi28afpc8avnhn3kzlmpc87r7fyi";
-      type = "gem";
-    };
-    version = "0.1.6";
-  };
-  pg = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0bplv27d0f8vwdj51967498pl1cjxq19hhcj4hdjr4h3s72l2z4j";
-      type = "gem";
-    };
-    version = "0.19.0";
-  };
-  pkg-config = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0lljiqnm0b4z6iy87lzapwrdfa6ps63x2z5zbs038iig8dqx2g0z";
-      type = "gem";
-    };
-    version = "1.1.7";
-  };
-  polyamorous = {
-    dependencies = ["activerecord"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1501y9l81b2lwb93fkycq8dr1bi6qcdhia3qv4fddnmrdihkl3pv";
-      type = "gem";
-    };
-    version = "1.3.1";
-  };
-  prawn = {
-    dependencies = ["pdf-core" "ttfunk"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "04pxzfmmy8a6bv3zvh1mmyy5zi4bj994kq1v6qnlq2xlhvg4cxjc";
-      type = "gem";
-    };
-    version = "0.15.0";
-  };
-  prawn_rails = {
-    dependencies = ["prawn" "railties"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "19m1pv2rsl3rf9rni78l8137dy2sq1r2443biv19wi9nis2pvgdg";
-      type = "gem";
-    };
-    version = "0.0.11";
-  };
-  pry = {
-    dependencies = ["coderay" "method_source" "slop"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "05xbzyin63aj2prrv8fbq2d5df2mid93m81hz5bvf2v4hnzs42ar";
-      type = "gem";
-    };
-    version = "0.10.4";
-  };
-  pry-byebug = {
-    dependencies = ["byebug" "pry"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0pvc94kgxd33p6iz41ghyadq8zfbjhkk07nvz2mbh3yhrc8w7gmw";
-      type = "gem";
-    };
-    version = "3.4.0";
-  };
-  pry-rails = {
-    dependencies = ["pry"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0a2iinvabis2xmv0z7z7jmh7bbkkngxj2qixfdg5m6qj9x8k1kx6";
-      type = "gem";
-    };
-    version = "0.3.4";
-  };
-  puma = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1k13n500r7v480rcbxm7k09hip0zi7p8zvy3vajj8g9hb7gdcwnp";
-      type = "gem";
-    };
-    version = "3.9.1";
-  };
-  rack = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1g9926ln2lw12lfxm4ylq1h6nl0rafl10za3xvjzc87qvnqic87f";
-      type = "gem";
-    };
-    version = "1.6.11";
-  };
-  rack-test = {
-    dependencies = ["rack"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0h6x5jq24makgv2fq5qqgjlrk74dxfy62jif9blk43llw8ib2q7z";
-      type = "gem";
-    };
-    version = "0.6.3";
-  };
-  rails = {
-    dependencies = ["actionmailer" "actionpack" "actionview" "activejob" "activemodel" "activerecord" "activesupport" "railties" "sprockets-rails"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1avd16ir7qx23dcnz1b3cafq1lja6rq0w222bs658p9n33rbw54l";
-      type = "gem";
-    };
-    version = "4.2.7.1";
-  };
-  rails-deprecated_sanitizer = {
-    dependencies = ["activesupport"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0qxymchzdxww8bjsxj05kbf86hsmrjx40r41ksj0xsixr2gmhbbj";
-      type = "gem";
-    };
-    version = "1.0.3";
-  };
-  rails-dom-testing = {
-    dependencies = ["activesupport" "nokogiri" "rails-deprecated_sanitizer"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1v8jl6803mbqpxh4hn0szj081q1a3ap0nb8ni0qswi7z4la844v8";
-      type = "gem";
-    };
-    version = "1.0.7";
-  };
-  rails-html-sanitizer = {
-    dependencies = ["loofah"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "138fd86kv073zqfx0xifm646w6bgw2lr8snk16lknrrfrss8xnm7";
-      type = "gem";
-    };
-    version = "1.0.3";
-  };
-  rails-observers = {
-    dependencies = ["activemodel"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1lsw19jzmvipvrfy2z04hi7r29dvkfc43h43vs67x6lsj9rxwwcy";
-      type = "gem";
-    };
-    version = "0.1.2";
-  };
-  railties = {
-    dependencies = ["actionpack" "activesupport" "rake" "thor"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "04rz7cn64zzvq7lnhc9zqmaqmqkq84q25v0ym9lcw75j1cj1mrq4";
-      type = "gem";
-    };
-    version = "4.2.7.1";
-  };
-  rake = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0cnjmbcyhm4hacpjn337mg1pnaw6hj09f74clwgh6znx8wam9xla";
-      type = "gem";
-    };
-    version = "11.3.0";
-  };
-  ransack = {
-    dependencies = ["actionpack" "activerecord" "activesupport" "i18n" "polyamorous"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0cya3wygwjhj8rckckkl387bmva4nyfvqcl0qhp9hk3zv8y6wxjc";
-      type = "gem";
-    };
-    version = "1.8.2";
-  };
-  redcarpet = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "04v85p0bnpf1c7w4n0yr03s35yimxh0idgdrrybl9y13zbw5kgvg";
-      type = "gem";
-    };
-    version = "3.3.4";
-  };
-  request_store = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1va9x0b3ww4chcfqlmi8b14db39di1mwa7qrjbh7ma0lhndvs2zv";
-      type = "gem";
-    };
-    version = "1.3.1";
-  };
-  ri_cal = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1flga63anfpfpdwz6lpm3icpdqmvjq757hihfaw63rlkwq4pf390";
-      type = "gem";
-    };
-    version = "0.8.8";
-  };
-  roust = {
-    dependencies = ["activesupport" "httparty" "mail"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1zdnwxxh34psv0iybcdnk9w4dpgpr07j3w1fvigkpccgz5vs82qk";
-      type = "gem";
-    };
-    version = "1.8.9";
-  };
-  rqrcode = {
-    dependencies = ["chunky_png"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0h1pnnydgs032psakvg3l779w3ghbn08ajhhhw19hpmnfhrs8k0a";
-      type = "gem";
-    };
-    version = "0.10.1";
-  };
-  sass = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0dkj6v26fkg1g0majqswwmhxva7cd6p3psrhdlx93qal72dssywy";
-      type = "gem";
-    };
-    version = "3.4.22";
-  };
-  sass-rails = {
-    dependencies = ["railties" "sass" "sprockets" "sprockets-rails" "tilt"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0iji20hb8crncz14piss1b29bfb6l89sz3ai5fny3iw39vnxkdcb";
-      type = "gem";
-    };
-    version = "5.0.6";
-  };
-  shoulda = {
-    dependencies = ["shoulda-context" "shoulda-matchers"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0csmf15a7mcinfq54lfa4arp0f4b2jmwva55m0p94hdf3pxnjymy";
-      type = "gem";
-    };
-    version = "3.5.0";
-  };
-  shoulda-context = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "06wv2ika5zrbxn0m3qxwk0zkbspxids3zmlq3xxays5qmvl1qb55";
-      type = "gem";
-    };
-    version = "1.2.1";
-  };
-  shoulda-matchers = {
-    dependencies = ["activesupport"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0d3ryqcsk1n9y35bx5wxnqbgw4m8b3c79isazdjnnbg8crdp72d0";
-      type = "gem";
-    };
-    version = "2.8.0";
-  };
-  simple_form = {
-    dependencies = ["actionpack" "activemodel"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0ii3rkkbj5cc10f5rdiny18ncdh36kijr25cah0ybbr7kigh3v3b";
-      type = "gem";
-    };
-    version = "3.3.1";
-  };
-  slop = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "00w8g3j7k7kl8ri2cf1m58ckxk8rn350gp4chfscmgv6pq1spk3n";
-      type = "gem";
-    };
-    version = "3.6.0";
-  };
-  sprockets = {
-    dependencies = ["concurrent-ruby" "rack"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0jzsfiladswnzbrwqfiaj1xip68y58rwx0lpmj907vvq47k87gj1";
-      type = "gem";
-    };
-    version = "3.7.0";
-  };
-  sprockets-rails = {
-    dependencies = ["actionpack" "activesupport" "sprockets"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1zr9vk2vn44wcn4265hhnnnsciwlmqzqc6bnx78if1xcssxj6x44";
-      type = "gem";
-    };
-    version = "3.2.0";
-  };
-  sqlite3 = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "19r06wglnm6479ffj9dl0fa4p5j2wi6dj7k6k3d0rbx7036cv3ny";
-      type = "gem";
-    };
-    version = "1.3.11";
-  };
-  sshkit = {
-    dependencies = ["net-scp" "net-ssh"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0wpqvr2dyxwp3shwh0221i1ahyg8vd2hyilmjvdi026l00gk2j4l";
-      type = "gem";
-    };
-    version = "1.11.3";
-  };
-  sucker_punch = {
-    dependencies = ["concurrent-ruby"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0l8b53mlzl568kdl4la8kcjjcnawmbl0q6hq9c3kkyippa5c0x55";
-      type = "gem";
-    };
-    version = "2.0.2";
-  };
-  thor = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "08p5gx18yrbnwc6xc0mxvsfaxzgy2y9i78xq7ds0qmdm67q39y4z";
-      type = "gem";
-    };
-    version = "0.19.1";
-  };
-  thread_safe = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1hq46wqsyylx5afkp6jmcihdpv4ynzzq9ygb6z2pb1cbz5js0gcr";
-      type = "gem";
-    };
-    version = "0.3.5";
-  };
-  tilt = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0lgk8bfx24959yq1cn55php3321wddw947mgj07bxfnwyipy9hqf";
-      type = "gem";
-    };
-    version = "2.0.5";
-  };
-  transitions = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "11byymi45s4pxbhj195277r16dyhxkqc2jwf7snbhan23izzay2c";
-      type = "gem";
-    };
-    version = "1.2.0";
-  };
-  ttfunk = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1jvgqhp0i6v9d7davwdn20skgi508yd0xcf1h4p9f5dlslmpnkhj";
-      type = "gem";
-    };
-    version = "1.1.1";
-  };
-  tzinfo = {
-    dependencies = ["thread_safe"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1c01p3kg6xvy1cgjnzdfq45fggbwish8krd0h864jvbpybyx7cgx";
-      type = "gem";
-    };
-    version = "1.2.2";
-  };
-  uglifier = {
-    dependencies = ["execjs"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0f30s1631k03x4wm7xyc79g92pppzvyysa773zsaq2kcry1pmifc";
-      type = "gem";
-    };
-    version = "3.0.2";
-  };
-  uniform_notifier = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1jha0l7x602g5rvah960xl9r0f3q25gslj39i0x1vai8i5z6zr1l";
-      type = "gem";
-    };
-    version = "1.10.0";
-  };
-  will_paginate = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1xlls78hkkmk33q1rb84rgg2xr39g06a1z1239nq59c825g83k01";
-      type = "gem";
-    };
-    version = "3.1.3";
-  };
-  yard = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1gjl0sh7h0a9s67pllagw8192kscljg4y8nddfrqhji4g21yvcas";
-      type = "gem";
-    };
-    version = "0.9.5";
-  };
-}
diff --git a/pkgs/servers/web-apps/mediawiki/default.nix b/pkgs/servers/web-apps/mediawiki/default.nix
index 650b27a7f554c..2339c170f166b 100644
--- a/pkgs/servers/web-apps/mediawiki/default.nix
+++ b/pkgs/servers/web-apps/mediawiki/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mediawiki";
-  version = "1.37.1";
+  version = "1.37.2";
 
   src = with lib; fetchurl {
     url = "https://releases.wikimedia.org/mediawiki/${versions.majorMinor version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-U0NuktwwrbFLZ5fYE50gaWpUYVJfOKN1yD5DXPBC4uc=";
+    sha256 = "sha256-WD8HS8r87BfaUBQqVvW7/eXDNml31h2RLX5W/Mo72hs=";
   };
 
   prePatch = ''
diff --git a/pkgs/shells/zsh/oh-my-zsh/default.nix b/pkgs/shells/zsh/oh-my-zsh/default.nix
index 851d5b08ff361..082472b9cd396 100644
--- a/pkgs/shells/zsh/oh-my-zsh/default.nix
+++ b/pkgs/shells/zsh/oh-my-zsh/default.nix
@@ -5,15 +5,15 @@
 , git, nix, nixfmt, jq, coreutils, gnused, curl, cacert }:
 
 stdenv.mkDerivation rec {
-  version = "2022-03-29";
+  version = "2022-03-31";
   pname = "oh-my-zsh";
-  rev = "93435bff4947ca0855d4d8ecc4786877578f0dd3";
+  rev = "53863e7b3ff0c2e2816e90dab3d870adebdf49c7";
 
   src = fetchFromGitHub {
     inherit rev;
     owner = "ohmyzsh";
     repo = "ohmyzsh";
-    sha256 = "w9DU2eTf8fID/xDhkJYVPuvYbVIXE9GKW8pycKZ9jVA=";
+    sha256 = "TQOGSAzcJfcUNTzUcCI5tTlAKD1JYtH9CiPnfHZaA9E=";
   };
 
   installPhase = ''
diff --git a/pkgs/test/default.nix b/pkgs/test/default.nix
index d572c03906096..63aaf6bb72e71 100644
--- a/pkgs/test/default.nix
+++ b/pkgs/test/default.nix
@@ -70,4 +70,6 @@ with pkgs;
   dhall = callPackage ./dhall { };
 
   makeWrapper = callPackage ./make-wrapper {};
+
+  pkgs-lib = recurseIntoAttrs (import ../pkgs-lib/tests { inherit pkgs; });
 }
diff --git a/pkgs/test/nixos-functions/default.nix b/pkgs/test/nixos-functions/default.nix
index a59160511b91f..f2914455246c2 100644
--- a/pkgs/test/nixos-functions/default.nix
+++ b/pkgs/test/nixos-functions/default.nix
@@ -28,7 +28,7 @@ in lib.optionalAttrs stdenv.hostPlatform.isLinux (
 
     nixosTest-test = pkgs.nixosTest ({ lib, pkgs, figlet, ... }: {
       name = "nixosTest-test";
-      machine = { pkgs, ... }: {
+      nodes.machine = { pkgs, ... }: {
         system.nixos = dummyVersioning;
         environment.systemPackages = [ pkgs.hello figlet ];
       };
diff --git a/pkgs/tools/admin/pulumi/data.nix b/pkgs/tools/admin/pulumi/data.nix
index 2ac357db5b2c9..194cc1618520e 100644
--- a/pkgs/tools/admin/pulumi/data.nix
+++ b/pkgs/tools/admin/pulumi/data.nix
@@ -21,8 +21,8 @@
         sha256 = "16vg56vyxqid566nzdvcnx0fm70nif31wr71mrx1n6ibk767l00i";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v0.8.1-linux-amd64.tar.gz";
-        sha256 = "1phy4499vm87hf6bzwfcmn13nkzbwl9l7fj0ih8vd5gsng2bsjqd";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v1.1.0-linux-amd64.tar.gz";
+        sha256 = "1sh9kcjp6b2wh0bpagp60a8hyxaq6gh1fblcbifzdf6ps7g3y58x";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v2.7.0-linux-amd64.tar.gz";
@@ -81,20 +81,20 @@
         sha256 = "0bs0haa863a2qwwx140911mh2xprgyv316y98jcm8qbl03lmyzvs";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gitlab-v4.6.0-linux-amd64.tar.gz";
-        sha256 = "0s1qyxdkdgy2br2kmpc0ypc6s95cryc0lbpdb9gslsl0q66gn7mk";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gitlab-v4.7.0-linux-amd64.tar.gz";
+        sha256 = "17v460kbghvrvhxgckzg2bq556amy5hwmks4m1idkcz8akh6vlni";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-google-native-v0.17.1-linux-amd64.tar.gz";
-        sha256 = "10gvqkqyaxna1077rkvlzqq0mhx7zhz5k8x93bgcylv8slqcjx0k";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-google-native-v0.18.0-linux-amd64.tar.gz";
+        sha256 = "0br9faaqaksfqyngf3s9kmsjfqmhmpc09rpyqjxprxh1vmd4s31n";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-hcloud-v1.8.0-linux-amd64.tar.gz";
         sha256 = "1gfiiwgb51ylwns3mqgnbgm2knrdzvy9r9v23yx0z03ba189d3m9";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.17.0-linux-amd64.tar.gz";
-        sha256 = "0xqvjqykwjgsvp379g1hjzzk64zc34xqm5da8fjhykz0l4q0cv76";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.18.0-linux-amd64.tar.gz";
+        sha256 = "0b4v07wc2xg0w1932dp14qfnvwbhr14x3ivj1vkcz2gy2gg4k2y4";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v3.7.1-linux-amd64.tar.gz";
@@ -121,12 +121,12 @@
         sha256 = "0agf96ji7mzkf4k4axm1v3psm5wkml41714dz88rn0csq0b31ca9";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-snowflake-v0.5.2-linux-amd64.tar.gz";
-        sha256 = "0b3sj2waa3l6x4xrrsf1dq4ax3n7v5r8n0wzmk9cbgmdx97297df";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-snowflake-v0.6.0-linux-amd64.tar.gz";
+        sha256 = "10sk1hnn7sgnjgxxdjdshlgs1lf8j02y5almd3sp821gfaclfzq9";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.15.0-linux-amd64.tar.gz";
-        sha256 = "0k230wq144bs51d9w635jc572gix5jr6dhb5ai59pmzsqjiis607";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.16.0-linux-amd64.tar.gz";
+        sha256 = "01yaz2yh77fdcqcv94xh85b3km7q1gpjdys03gll6gz1vb0qlhis";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-sumologic-v0.5.0-linux-amd64.tar.gz";
@@ -141,20 +141,20 @@
         sha256 = "0ayb1r9snjqgmczkvz4kjbswr0a98lmpapll4nws9q0rjj2w48y7";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vault-v5.3.0-linux-amd64.tar.gz";
-        sha256 = "0b340xsxb05c2mrckilmrh8s3bxq7z02rgrdgr02xyfrvv0r8whz";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vault-v5.4.0-linux-amd64.tar.gz";
+        sha256 = "0cj46m1jzfhx400qq4p40sqg0j6m2nggfpvyv4m1jxxzna11615n";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-venafi-v1.4.0-linux-amd64.tar.gz";
         sha256 = "0hf7jrr91wpq28xsf8ajbdillblryh35k5w367d5fps7ph3fjk3f";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vsphere-v4.1.0-linux-amd64.tar.gz";
-        sha256 = "0hl5liyga4iz7j3wy3qicx43d4mijnqayrnmpa5rws29lambgrql";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vsphere-v4.2.0-linux-amd64.tar.gz";
+        sha256 = "1yg18l0dhljy841gi47k63wq7qxg51zds2w59hw0x3i8lgaz0m2f";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-wavefront-v1.1.0-linux-amd64.tar.gz";
-        sha256 = "12qdhdbighj76ab3wz965jhybxxq4f2rlwyk9m3w8w4f2aprp0cm";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-wavefront-v1.1.1-linux-amd64.tar.gz";
+        sha256 = "0vwlpczrzpgh274r300ilmm0z3vhg1fdlbx8p5j91p3cp86sj2s1";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-yandex-v0.13.0-linux-amd64.tar.gz";
@@ -179,8 +179,8 @@
         sha256 = "14skymvy5mf0509v3b8wrmi7n390la9nr859l7afbhxk4cwvq3av";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v0.8.1-darwin-amd64.tar.gz";
-        sha256 = "149wbmpc51qcfsxsffif2ar9pzmg91h33jd3fy23hyfjbqp6yvdz";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v1.1.0-darwin-amd64.tar.gz";
+        sha256 = "0g68wfgrmdapf7nkiyxapqykq5svcsms5si5848x23nn4rwx0qkk";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v2.7.0-darwin-amd64.tar.gz";
@@ -239,20 +239,20 @@
         sha256 = "0a8lycsgk2xawhg9yd6lkbfg7j6v6l3m0llvdzs0drb2k954wbym";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gitlab-v4.6.0-darwin-amd64.tar.gz";
-        sha256 = "026sh6x8jl8krq2vv0vwbrfi4yl4pbwbfliqqhidvv71xqv7igah";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gitlab-v4.7.0-darwin-amd64.tar.gz";
+        sha256 = "08b6p6gliay66bd7687kjc9n3n7xdgbrrcnbjbqi7a3am14mf5p6";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-google-native-v0.17.1-darwin-amd64.tar.gz";
-        sha256 = "1v5dxqc9rl7m3yqxlbklg0bv20l4qvhs86g5lavc1bj46jysr8nk";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-google-native-v0.18.0-darwin-amd64.tar.gz";
+        sha256 = "0wn9jpvaj3hwlm3yakgm7y87dcv1ja606hkf3vllqjmjz99113c3";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-hcloud-v1.8.0-darwin-amd64.tar.gz";
         sha256 = "11r73jfqkc0wgdf66zp6pmgq5packlm4dkjp12a00z6l2s4f0w4h";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.17.0-darwin-amd64.tar.gz";
-        sha256 = "1x13w1j8vm3qvpn99npnsvx7kr5vac8vkrb31jii9difrgwis2wc";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.18.0-darwin-amd64.tar.gz";
+        sha256 = "1v0bgd7dyc19wp95grxgq65i9sx60d487yqzjqqzscxqx62d7axh";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v3.7.1-darwin-amd64.tar.gz";
@@ -279,12 +279,12 @@
         sha256 = "1wmvmhxnjp32kp43fhjp8w9nrb0biki63w23l4zjxsdk7njply7c";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-snowflake-v0.5.2-darwin-amd64.tar.gz";
-        sha256 = "0digqqr920g2ahmbiyird7kidnk0j04bbzb9nr2p6lgmdd659ayq";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-snowflake-v0.6.0-darwin-amd64.tar.gz";
+        sha256 = "0g3l2yslnwp72w7r00h5hdj3w00dbgbgbsw31m327rd6p143iasr";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.15.0-darwin-amd64.tar.gz";
-        sha256 = "0b0ynqd7drkycaf7xxx6s9xbm3xp8k18xsrys68hr8gh2nq8s0y9";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.16.0-darwin-amd64.tar.gz";
+        sha256 = "1viwk26qj9civh4plqm34j5iky69sxvskmqbga03x1v5rd7567aa";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-sumologic-v0.5.0-darwin-amd64.tar.gz";
@@ -299,20 +299,20 @@
         sha256 = "1jzirnaxy6y862khqf29i25r8qyrpac2kmacs9ny118l77xp33il";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vault-v5.3.0-darwin-amd64.tar.gz";
-        sha256 = "1dwv4aa5albn8yfyb430klc3w3fsy4pz07lmrppcbzg5mwf22mq1";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vault-v5.4.0-darwin-amd64.tar.gz";
+        sha256 = "1ghghaq9svy7sv2s1j8b1qjah6aj7vwwdh9wd9agm4xdiillprhf";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-venafi-v1.4.0-darwin-amd64.tar.gz";
         sha256 = "08b3lyyf8zjkn9jaw4l0yb741i6kqhfb7cbwshrwqh6l3yh7kc2y";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vsphere-v4.1.0-darwin-amd64.tar.gz";
-        sha256 = "1wkyjxgrp3llvis3yjdnw65chscmxxcwigkr71i2crj28db8fhwx";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vsphere-v4.2.0-darwin-amd64.tar.gz";
+        sha256 = "06sws30nxmhkcgg6ag01b32l4vi4c6sr9rdwdc3sy27abqhsmhgn";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-wavefront-v1.1.0-darwin-amd64.tar.gz";
-        sha256 = "154za5bvq1bgyzn5cfz3n0la1gy27lmjafgs42mgyy511jz4m60l";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-wavefront-v1.1.1-darwin-amd64.tar.gz";
+        sha256 = "1ldksyxgwbg6fswfakgy3gdm5y50kc0bk74pxcza7w7ncirr9cvg";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-yandex-v0.13.0-darwin-amd64.tar.gz";
@@ -337,8 +337,8 @@
         sha256 = "1g6ymjsmxp149cv93sn5843pxlih1dbw16nvv4sn3prl360c4lxa";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v0.8.1-linux-arm64.tar.gz";
-        sha256 = "0ghgm1p79smlcx5cby34pxl8apwm33n1aqs2lxkgjz9m6895djkx";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v1.1.0-linux-arm64.tar.gz";
+        sha256 = "0lhgp5wmlza75v1b7nkkp4y2d4bzk1658frnqblxsdcz9z12cwmi";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v2.7.0-linux-arm64.tar.gz";
@@ -397,20 +397,20 @@
         sha256 = "1lrbl7x7hf1i7xx10cpxz17hihl8b6654wphz8s8g9lp0jryn6am";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gitlab-v4.6.0-linux-arm64.tar.gz";
-        sha256 = "1d04bxq8vrxmsiix130lhqys5q1jbgwbdhyhn6rsskk0636hbf71";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gitlab-v4.7.0-linux-arm64.tar.gz";
+        sha256 = "0i6qxrdijf653nj6yqhdikbj3spzzwr5rbgngkc0v7yxkphlzlnj";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-google-native-v0.17.1-linux-arm64.tar.gz";
-        sha256 = "0paypln2948dyj6cic3riybl2zpps6ia0pjsv3wjpklp57gfc9h4";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-google-native-v0.18.0-linux-arm64.tar.gz";
+        sha256 = "152qrcik44iz5lrfg649wmk67wcjdm4lnkwrc1gwhm34w0lrbarf";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-hcloud-v1.8.0-linux-arm64.tar.gz";
         sha256 = "1vrz3pm14i5zdmk3yibny2sghxk8kzwb2qi77mjbiyfhbvciy97q";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.17.0-linux-arm64.tar.gz";
-        sha256 = "0jvm3g1d3yhghcd14rz1ca7zps8cajw0cy38s1p6lh2c5f1yaqcj";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.18.0-linux-arm64.tar.gz";
+        sha256 = "1w2j27sd5gsfz561wgr3lgcpxn9wghgvc5s4zpciiwyxpczmv8r3";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v3.7.1-linux-arm64.tar.gz";
@@ -437,12 +437,12 @@
         sha256 = "1x8v39icapr8iakp9yd50md9dyvj63z7yj93cl3b07qlwr9lcvmv";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-snowflake-v0.5.2-linux-arm64.tar.gz";
-        sha256 = "0dbqyizvx8gxlidiqc390wjfix1hyikpan32q3hq8d4f8342vjks";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-snowflake-v0.6.0-linux-arm64.tar.gz";
+        sha256 = "1jh4qbdgcqbkznyq0ivf4wlrn1izgjqf811qncgkab890fp9v37w";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.15.0-linux-arm64.tar.gz";
-        sha256 = "0x1mjdaaaa40ks8glqq906dbq2x13z760agnfmd5hc3m9swvnczs";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.16.0-linux-arm64.tar.gz";
+        sha256 = "0ksya9nywimkm4jcd67ccaaxbvsxq747d21j8aywpwp3nwfl58wi";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-sumologic-v0.5.0-linux-arm64.tar.gz";
@@ -457,20 +457,20 @@
         sha256 = "1275cikf75lnf3d4k4ld0by1r8hr6gq6mih09fsfg98b8f7n16kq";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vault-v5.3.0-linux-arm64.tar.gz";
-        sha256 = "0sqgdxkqrh0d1y53qigzs4wywmvjws0j6av2z19lyc2qwz3gn0hn";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vault-v5.4.0-linux-arm64.tar.gz";
+        sha256 = "09rvvps2kijjr4r9h75xijpsxw5ar2gy3ncmrvjfyqx17zch92v6";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-venafi-v1.4.0-linux-arm64.tar.gz";
         sha256 = "1lh459lxa4gvxkbypmcm4hwcwcchkvs79ajlb9gvrm4ds68nm5xb";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vsphere-v4.1.0-linux-arm64.tar.gz";
-        sha256 = "1f7h6xl3jk9y29ffjxv9r4a748fwip17x7pazs62zwc3h10a65ac";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vsphere-v4.2.0-linux-arm64.tar.gz";
+        sha256 = "1wbx83fc5v4n57rjn5xn4y7iiv8z4fdx1inj9w1ibqlij5hf0xra";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-wavefront-v1.1.0-linux-arm64.tar.gz";
-        sha256 = "00902vymkc841lpdmgh80a1lipb5bjphiivy7d9xw9cldar35nz3";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-wavefront-v1.1.1-linux-arm64.tar.gz";
+        sha256 = "13ys3i7anpvbmikzxlj44kw8shp9x4cg6nlqijx80vwl3hwk5qpw";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-yandex-v0.13.0-linux-arm64.tar.gz";
@@ -495,8 +495,8 @@
         sha256 = "1n061d8phk6cjvr24138vqzxs5midfadqgrpmaaknbpykcd3vym3";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v0.8.1-darwin-arm64.tar.gz";
-        sha256 = "0i8k2z1is7iw6hfgsqfwirby469f8nkczhzvxda48fhwlix6x55d";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v1.1.0-darwin-arm64.tar.gz";
+        sha256 = "1vldwyy7vhq9l6c51lqc30h0sal5liqza4s1yhk1pbc0wsgvcdv2";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v2.7.0-darwin-arm64.tar.gz";
@@ -555,20 +555,20 @@
         sha256 = "1hx8rsf9yysvjg6df8dxzz8kqci000jxzg8wwxjfhcfb9adzjmy8";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gitlab-v4.6.0-darwin-arm64.tar.gz";
-        sha256 = "0r8bvrnyspmczn38lav7hfhjgkflsiciw8slbs5k3s6z8690dxc2";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gitlab-v4.7.0-darwin-arm64.tar.gz";
+        sha256 = "1gvzjf5mp3iy43srvx3blxfwcg20gqbqvycysnl2p8g8sg3scx5f";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-google-native-v0.17.1-darwin-arm64.tar.gz";
-        sha256 = "0qva7r2pdbpxjd50ijjckwsbagj46h94s12z05czgj8sfslx8jpz";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-google-native-v0.18.0-darwin-arm64.tar.gz";
+        sha256 = "04qjg2rd71375ny817h1l4174bafrhkl0d9n5qrp546dhaqmv6vr";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-hcloud-v1.8.0-darwin-arm64.tar.gz";
         sha256 = "058f1j40ar4xh860c3qrm0qaagm69fdmbw14avvrhsmw245cyyzc";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.17.0-darwin-arm64.tar.gz";
-        sha256 = "1fz906l37kykbn725p81xpyvpg7ywvqav9r7rxrnc05d338c391d";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.18.0-darwin-arm64.tar.gz";
+        sha256 = "1llvcnrghhwr0qzd1zmdrc1x384lrd06dqcx1ng9l4ixhz6nmkl1";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v3.7.1-darwin-arm64.tar.gz";
@@ -595,12 +595,12 @@
         sha256 = "1rbig2n5x2lzxpscnja0ya9a68z3jk0qz2zwdnzi66xy7i3zd39l";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-snowflake-v0.5.2-darwin-arm64.tar.gz";
-        sha256 = "1r1ln833jfi7hpyfb0cbg8vgam1wghdgr03m75w4hbds5nllw3zm";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-snowflake-v0.6.0-darwin-arm64.tar.gz";
+        sha256 = "1mlwggyx7l23z9fiy9bnlsjbsiw3i8kwrag2zjszbqj6sflskrij";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.15.0-darwin-arm64.tar.gz";
-        sha256 = "14ag3gq6w4yzbrwpy0vqqbr091fs26xvhmwd0v1adjl3sxa0lcqc";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.16.0-darwin-arm64.tar.gz";
+        sha256 = "0wk8vdx3w5n60dbh2fjqmfxnc24cbrfxygsa211ckb2pcmmr93lm";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-sumologic-v0.5.0-darwin-arm64.tar.gz";
@@ -615,20 +615,20 @@
         sha256 = "08dhxd39w7wjpqjfy59vxfipjl45psd6yh53h2g025y8hh80gcrs";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vault-v5.3.0-darwin-arm64.tar.gz";
-        sha256 = "13q9r819wln46hiy2anri44wvxvjigcvfj7dpr3ya69kj17kyr4n";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vault-v5.4.0-darwin-arm64.tar.gz";
+        sha256 = "1jfgphwcr3z31yyf36wh147spwdk82713m03kkahva11m6h4x6gm";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-venafi-v1.4.0-darwin-arm64.tar.gz";
         sha256 = "0pgrlz8nx1gfgwlp5sk70w14z0hrxcwkv9xkzjc694nwlwk1ipm8";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vsphere-v4.1.0-darwin-arm64.tar.gz";
-        sha256 = "1915f5d24vfrwgzvs5nkj5p05fjgqjyxpm54ym2wshl9s4fjb6sp";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vsphere-v4.2.0-darwin-arm64.tar.gz";
+        sha256 = "0r399sqs15knbq1h1p9qixzm3836whskpk9i91ag5h7kg5xjvnin";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-wavefront-v1.1.0-darwin-arm64.tar.gz";
-        sha256 = "0xzh9n69prbaf0795dzmyp4jbzmgqvg4sl2sad3l3mkbgghx4cll";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-wavefront-v1.1.1-darwin-arm64.tar.gz";
+        sha256 = "02zj0d1cc9qmmql27licsm33ygvgcmj19blxkhn8zxwr666jf6kw";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-yandex-v0.13.0-darwin-arm64.tar.gz";
diff --git a/pkgs/tools/admin/trivy/default.nix b/pkgs/tools/admin/trivy/default.nix
index b37bdef882a05..0d88df6185a69 100644
--- a/pkgs/tools/admin/trivy/default.nix
+++ b/pkgs/tools/admin/trivy/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "trivy";
-  version = "0.24.4";
+  version = "0.25.0";
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-IroWxLfDVkS6mFweQioOxjSBA1yXrcdtqFG0W+Sb8Sc=";
+    sha256 = "sha256-jlLE8io7/Yhu0rF7brV9YhDIsZBANZtatnWbgoHMReg=";
   };
 
-  vendorSha256 = "sha256-OGwqRrhj/+oCCaXnb2s4N6a+vhTZHwe2HidAn0UaFXM=";
+  vendorSha256 = "sha256-hOurOL7xowgBs9gXa++X7+iOKJJ6WjekGGFiR9Q0OEU=";
 
   excludedPackages = "misc";
 
diff --git a/pkgs/tools/bluetooth/blueberry/default.nix b/pkgs/tools/bluetooth/blueberry/default.nix
index bbc3babbd1321..6a0f1d2d00bcf 100644
--- a/pkgs/tools/bluetooth/blueberry/default.nix
+++ b/pkgs/tools/bluetooth/blueberry/default.nix
@@ -3,18 +3,15 @@
 , fetchFromGitHub
 , bluez-tools
 , cinnamon
+, gnome
 , gobject-introspection
 , intltool
 , pavucontrol
 , python3Packages
 , util-linux
 , wrapGAppsHook
-, callPackage
 }:
 
-let
-  gnome-bluetooth = callPackage ./gnome-bluetooth.nix {};
-in
 stdenv.mkDerivation rec {
   pname = "blueberry";
   version = "1.4.7";
@@ -35,7 +32,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     bluez-tools
     cinnamon.xapps
-    gnome-bluetooth
+    gnome.gnome-bluetooth_1_0
     python3Packages.python
     util-linux
   ];
diff --git a/pkgs/tools/filesystems/grive2/default.nix b/pkgs/tools/filesystems/grive2/default.nix
index 68475b9e29086..9d1d021641a9f 100644
--- a/pkgs/tools/filesystems/grive2/default.nix
+++ b/pkgs/tools/filesystems/grive2/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake pkg-config ];
 
-  buildInputs = [ libgcrypt yajl curl expat stdenv boost libiberty ];
+  buildInputs = [ libgcrypt yajl curl expat boost libiberty ];
 
   meta = with lib; {
     description = "A console Google Drive client";
diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-mozc/default.nix b/pkgs/tools/inputmethods/ibus-engines/ibus-mozc/default.nix
index 049e369e296e4..8d4a93a375ecf 100644
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-mozc/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-mozc/default.nix
@@ -73,6 +73,7 @@ stdenv.mkDerivation rec {
     install    -m 644 data/images/unix/ui-alpha_half.png    $out/share/ibus-mozc/alpha_half.png
     install    -m 644 data/images/unix/ui-alpha_full.png    $out/share/ibus-mozc/alpha_full.png
     install -D -m 755 out_linux/Release/mozc_renderer       $out/lib/mozc/mozc_renderer
+    install -D -m 755 out_linux/Release/mozc_emacs_helper   $out/lib/mozc/mozc_emacs_helper
 
     runHook postInstall
   '';
diff --git a/pkgs/tools/misc/dsq/default.nix b/pkgs/tools/misc/dsq/default.nix
index 2451800b41f9c..32c5ec6566dae 100644
--- a/pkgs/tools/misc/dsq/default.nix
+++ b/pkgs/tools/misc/dsq/default.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "dsq";
-  version = "0.9.0";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "multiprocessio";
     repo = "dsq";
     rev = version;
-    hash = "sha256-JzS94kfvgZDz4tIXa4veY3XSFeMDBN61sU8/+5V5y9Y=";
+    hash = "sha256-4g9fu5taFtb7VzVa0X8s6SbEO9qTFD0ff+CVJpr376c=";
   };
 
-  vendorSha256 = "sha256-9Exy2VLxOd4lgwbIOZ6NJ45NABO9a0rLjmZ+Cd7jjLM=";
+  vendorSha256 = "sha256-YPH/uPPNT1byXOtCrNyU68H4mHO8arl6l5hs9WMcxVk=";
 
   nativeBuildInputs = [ diffutils ];
 
diff --git a/pkgs/tools/misc/fclones/default.nix b/pkgs/tools/misc/fclones/default.nix
index 1b35fe0f67b7e..4b5c5234bf94e 100644
--- a/pkgs/tools/misc/fclones/default.nix
+++ b/pkgs/tools/misc/fclones/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "fclones";
-  version = "0.17.1";
+  version = "0.19.0";
 
   src = fetchFromGitHub {
     owner = "pkolaczk";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0d5an35fnz9rdr2ssm952zpzn4jynpvbfyidnqcmp0lclr60c2ir";
+    sha256 = "0m6l6c71f40a6wc8w7cdikwx3blwqxw55p4frrww25qgd0xdcgls";
   };
 
-  cargoSha256 = "sha256-CtQ4grQqgMUYzPDw2Qankl8jmqwwCrawNCmaY97JPkQ=";
+  cargoSha256 = "1pl4lrr1p3c7j9fb0mb4spjzgcn9zvr67nskzgmhrbr3kyzc2ssc";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     AppKit
diff --git a/pkgs/tools/misc/kak-lsp/default.nix b/pkgs/tools/misc/kak-lsp/default.nix
index 772eb520869b0..d2b79c4d011cb 100644
--- a/pkgs/tools/misc/kak-lsp/default.nix
+++ b/pkgs/tools/misc/kak-lsp/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "kak-lsp";
-  version = "12.0.1";
+  version = "12.1.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-K2GMoLaH7D6UtPuL+GJMqsPFwriyyi7WMdfzBmOceSA=";
+    sha256 = "sha256-5sPw95lSbswIUbNIZ4mpA3WeZt7u+a5s4KxkTnN14Sw=";
   };
 
-  cargoSha256 = "sha256-suBBEHGHUlZyxKy5hwhc2K/qTNis75GY33+7QhpmGos=";
+  cargoSha256 = "sha256-rPsiMeoc8cWUgmqAxdDGrAQdurIH3bzNq5tpocnnegA=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ Security SystemConfiguration ];
 
diff --git a/pkgs/tools/misc/statserial/default.nix b/pkgs/tools/misc/statserial/default.nix
index 1ca0771914b27..8b5ae4cdc86e9 100644
--- a/pkgs/tools/misc/statserial/default.nix
+++ b/pkgs/tools/misc/statserial/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
       --replace 'LDFLAGS = -s -N' '#LDFLAGS = -s -N'
   '';
 
-  buildInputs = [ ncurses glibc stdenv ];
+  buildInputs = [ ncurses glibc ];
 
   installPhase = ''
   mkdir -p $out/bin
diff --git a/pkgs/tools/security/cfripper/default.nix b/pkgs/tools/security/cfripper/default.nix
index 96848acd7c041..9d7a30fdc3454 100644
--- a/pkgs/tools/security/cfripper/default.nix
+++ b/pkgs/tools/security/cfripper/default.nix
@@ -5,13 +5,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "cfripper";
-  version = "1.7.0";
+  version = "1.7.1";
 
   src = fetchFromGitHub {
     owner = "Skyscanner";
     repo = pname;
     rev = version;
-    hash = "sha256-bYKusyEItnhj1mU6Tucsdi5pdMoWrUK4Y91SK8dNGE4=";
+    hash = "sha256-Q1J5M6RyYjVi2rkOCThFQdBCxVKkza+wytO67vLlVQg=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/security/exploitdb/default.nix b/pkgs/tools/security/exploitdb/default.nix
index e589ca529c61d..cfb1490e3c7fa 100644
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@@ -2,14 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2022-03-24";
+  version = "2022-03-31";
 
   src = fetchFromGitHub {
     owner = "offensive-security";
     repo = pname;
     rev = version;
-    sha256 = "sha256-G2KFDNNM4NJ7DgQu1+uNjgixzyLFnF0G0YQ29PgYZ/0=";
-
+    sha256 = "sha256-T7vPDbB330Uv276+oGnEYK1xGpJCMzzZiQXx4uW1kc4=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/security/gnupg/1.nix b/pkgs/tools/security/gnupg/1.nix
index 8fc5dce7ba049..b7bc395cc0a7b 100644
--- a/pkgs/tools/security/gnupg/1.nix
+++ b/pkgs/tools/security/gnupg/1.nix
@@ -29,5 +29,6 @@ stdenv.mkDerivation rec {
       available.
     '';
     platforms = platforms.all;
+    mainProgram = "gpg";
   };
 }
diff --git a/pkgs/tools/security/gnupg/23.nix b/pkgs/tools/security/gnupg/23.nix
index e80804cd002fc..d9ad2d0a276fc 100644
--- a/pkgs/tools/security/gnupg/23.nix
+++ b/pkgs/tools/security/gnupg/23.nix
@@ -93,5 +93,6 @@ stdenv.mkDerivation rec {
     '';
     maintainers = with maintainers; [ fpletz vrthra ];
     platforms = platforms.all;
+    mainProgram = "gpg";
   };
 }
diff --git a/pkgs/tools/security/kubescape/default.nix b/pkgs/tools/security/kubescape/default.nix
index e881fad4a929e..377327e6571c9 100644
--- a/pkgs/tools/security/kubescape/default.nix
+++ b/pkgs/tools/security/kubescape/default.nix
@@ -6,37 +6,48 @@
 
 buildGoModule rec {
   pname = "kubescape";
-  version = "2.0.149";
+  version = "2.0.150";
 
   src = fetchFromGitHub {
     owner = "armosec";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-m6tJjC5BXxFC+bSOHbKXXGZQlJIM0+fIA+JYWBntgk8=";
+    hash = "sha256-1D/ixtZI7/H05MD6zRtZCF8yhW1FhvRpdPWieAPwxHs=";
   };
 
   nativeBuildInputs = [
     installShellFiles
   ];
 
-  vendorSha256 = "sha256-vplHaaT7x0ZSpvityJF5aGKDARvGPBT9DMltOpUkOMo=";
+  modRoot = "cmd";
+  vendorSha256 = "sha256-Nznf793OMQ7ZCWb5voVcLyMiBa1Z8Dswp7Tdn1AzlJA=";
 
   ldflags = [
     "-s"
     "-w"
-    "-X github.com/armosec/kubescape/clihandler/cmd.BuildNumber=v${version}"
+    "-X github.com/armosec/kubescape/core/cautils.BuildNumber=v${version}"
   ];
 
+  postBuild = ''
+    # kubescape/cmd should be called kubescape
+    mv $GOPATH/bin/{cmd,kubescape}
+  '';
+
   postInstall = ''
-    # Running kubescape to generate completions outputs error warnings
-    # but does not crash and completes successfully
-    # https://github.com/armosec/kubescape/issues/200
     installShellCompletion --cmd kubescape \
       --bash <($out/bin/kubescape completion bash) \
       --fish <($out/bin/kubescape completion fish) \
       --zsh <($out/bin/kubescape completion zsh)
   '';
 
+  doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
+    $out/bin/kubescape --help
+    $out/bin/kubescape --version | grep "v${version}"
+    runHook postInstallCheck
+  '';
+
   meta = with lib; {
     description = "Tool for testing if Kubernetes is deployed securely";
     homepage = "https://github.com/armosec/kubescape";
diff --git a/pkgs/tools/security/sn0int/default.nix b/pkgs/tools/security/sn0int/default.nix
index b2d812d521af4..8e3a806d871c8 100644
--- a/pkgs/tools/security/sn0int/default.nix
+++ b/pkgs/tools/security/sn0int/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "sn0int";
-  version = "0.24.1";
+  version = "0.24.2";
 
   src = fetchFromGitHub {
     owner = "kpcyrd";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-AP/3QCol2qOvRqNW9F/m9JpiZrqtfXvr//Ku2XE3vqY=";
+    sha256 = "sha256-WcCNNLNvOtYiSWVvXA8mnlXOV2T/yIXFzZky5y3tYJ4=";
   };
 
-  cargoSha256 = "sha256-gdDQjYU8hJdkQCh1Iswn5KlPW2BT/J5vCSOS/KHvbH4=";
+  cargoSha256 = "sha256-5pVxOkm9OLSX5Lxe3DSM0mVSMhlHfFBCiMMR37WrZbI=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/tools/security/spectre-meltdown-checker/default.nix b/pkgs/tools/security/spectre-meltdown-checker/default.nix
index 49aa4a2a4ca5f..cf85ed9310a1a 100644
--- a/pkgs/tools/security/spectre-meltdown-checker/default.nix
+++ b/pkgs/tools/security/spectre-meltdown-checker/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "spectre-meltdown-checker";
-  version = "0.44";
+  version = "0.45";
 
   src = fetchFromGitHub {
     owner = "speed47";
     repo = "spectre-meltdown-checker";
     rev = "v${version}";
-    sha256 = "1b47wlc52jnp2d5c7kbqnxmlm4g3cfbv25q30llv5mlmzs6d7bam";
+    sha256 = "sha256-yGrsiPBux4YeiQ3BL2fnne5P55R/sQZ4FwzSkE6BqPc=";
   };
 
   prePatch = ''
diff --git a/pkgs/tools/system/logrotate/default.nix b/pkgs/tools/system/logrotate/default.nix
index f0ce08383359c..4c9536cd7cf40 100644
--- a/pkgs/tools/system/logrotate/default.nix
+++ b/pkgs/tools/system/logrotate/default.nix
@@ -1,5 +1,4 @@
 { lib, stdenv, fetchFromGitHub, gzip, popt, autoreconfHook
-, mailutils ? null
 , aclSupport ? true, acl
 , nixosTests
 }:
@@ -19,8 +18,6 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--with-compress-command=${gzip}/bin/gzip"
     "--with-uncompress-command=${gzip}/bin/gunzip"
-  ] ++ lib.optionals (mailutils != null) [
-    "--with-default-mail-command=${mailutils}/bin/mail"
   ];
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/tools/text/difftastic/default.nix b/pkgs/tools/text/difftastic/default.nix
index 18fd01165e83e..17c1a33d8c897 100644
--- a/pkgs/tools/text/difftastic/default.nix
+++ b/pkgs/tools/text/difftastic/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "difftastic";
-  version = "0.24.0";
+  version = "0.25.0";
 
   src = fetchFromGitHub {
     owner = "wilfred";
     repo = pname;
     rev = version;
-    sha256 = "sha256-Yp0WwzGo8nuRZuiHdUPxPM1SYBeeVA3SMDfHnQmqUqY=";
+    sha256 = "sha256-TJMMy1fMwqUMVhztMOlN4yQhW5IF36yahOhDTJ9kadA=";
   };
 
-  cargoSha256 = "sha256-m80PT2UQYhA5KEh7ax/fhh6vuse0DXhbFsh2x4pwkWY=";
+  cargoSha256 = "sha256-crH2SodT+Wy3auk3uli253rIrHyKsibQcYGtpxwbJJQ=";
 
   meta = with lib; {
     description = "A syntax-aware diff";
diff --git a/pkgs/tools/text/mdbook/default.nix b/pkgs/tools/text/mdbook/default.nix
index d3a136d6bf756..3ca4d0d8a5597 100644
--- a/pkgs/tools/text/mdbook/default.nix
+++ b/pkgs/tools/text/mdbook/default.nix
@@ -2,19 +2,25 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mdbook";
-  version = "0.4.12";
+  version = "0.4.15";
 
   src = fetchFromGitHub {
     owner = "rust-lang";
     repo = "mdBook";
     rev = "v${version}";
-    sha256 = "sha256-2lxotwL3Dc9jRA12iKO5zotO80pa+RfUZucyDRgFOsI=";
+    sha256 = "sha256-FYuai7YeqrnL5XgOV/EvxIRAu3TkeKJvKiDxnx94PJ8=";
   };
 
-  cargoSha256 = "sha256-TNd4pj4qSKgmmVtSCSKFCxNtv96xD7+24BPsLXPgiEI=";
+  cargoSha256 = "sha256-YWifpXrk+T8C3fGlURDKYWw7mD1TUjJbFHTlK84Tgpc=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];
 
+  # Tests rely on unset 'RUST_LOG' value to emit INFO messages.
+  # 'RUST_LOG=' nixpkgs default enables warnings only and breaks tests.
+  # Can be removed when https://github.com/rust-lang/mdBook/pull/1777
+  # is released.
+  logLevel = "info";
+
   meta = with lib; {
     description = "Create books from MarkDown";
     homepage = "https://github.com/rust-lang/mdBook";
diff --git a/pkgs/tools/virtualization/linode-cli/default.nix b/pkgs/tools/virtualization/linode-cli/default.nix
index 6ba947fb2f5b9..8484762e3896f 100644
--- a/pkgs/tools/virtualization/linode-cli/default.nix
+++ b/pkgs/tools/virtualization/linode-cli/default.nix
@@ -33,6 +33,10 @@ buildPythonApplication rec {
     inherit sha256;
   };
 
+  patches = [
+    ./remove-update-check.patch
+  ];
+
   # remove need for git history
   prePatch = ''
     substituteInPlace setup.py \
diff --git a/pkgs/tools/virtualization/linode-cli/remove-update-check.patch b/pkgs/tools/virtualization/linode-cli/remove-update-check.patch
new file mode 100644
index 0000000000000..316d2855b1f45
--- /dev/null
+++ b/pkgs/tools/virtualization/linode-cli/remove-update-check.patch
@@ -0,0 +1,11 @@
+--- a/linodecli/cli.py
++++ b/linodecli/cli.py
+@@ -555,7 +555,7 @@
+         if self.debug_request:
+             self.print_response_debug_info(result)
+ 
+-        if not self.suppress_warnings:
++        if False:
+             # check the major/minor version API reported against what we were built
+             # with to see if an upgrade should be available
+             api_version_higher = False
diff --git a/pkgs/tools/virtualization/xe-guest-utilities/default.nix b/pkgs/tools/virtualization/xe-guest-utilities/default.nix
index 2497cc6a9df0f..69b9f540e4581 100644
--- a/pkgs/tools/virtualization/xe-guest-utilities/default.nix
+++ b/pkgs/tools/virtualization/xe-guest-utilities/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation (rec {
     url = "https://sources.archlinux.org/other/community/xe-guest-utilities/xe-guest-utilities_${version}-1120.tar.gz";
     sha256 = "f9593cd9588188f80253e736f48d8dd94c5b517abb18316085f86acffab48794";
   };
-  buildInputs = [ bzip2 gnutar gnused python2 lzo zlib xz stdenv gnugrep which ];
+  buildInputs = [ bzip2 gnutar gnused python2 lzo zlib xz gnugrep which ];
   patches = [ ./ip-address.patch ];
   postPatch = ''
     tar xf "$NIX_BUILD_TOP/$name/xenstore-sources.tar.bz2"
diff --git a/pkgs/tools/wayland/swayr/default.nix b/pkgs/tools/wayland/swayr/default.nix
index 6237d1a88eeb6..b359118321506 100644
--- a/pkgs/tools/wayland/swayr/default.nix
+++ b/pkgs/tools/wayland/swayr/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "swayr";
-  version = "0.15.0";
+  version = "0.16.0";
 
   src = fetchFromSourcehut {
     owner = "~tsdh";
     repo = "swayr";
     rev = "v${version}";
-    sha256 = "sha256-GLOJjGr29v4oVNCWgjPWluIiSeLoIYeOw2HwmSfxA8Y=";
+    sha256 = "sha256-b35jGbAEQ3w46Oea21xiUODRDD7cixiMuPlc40YxelE=";
   };
 
-  cargoSha256 = "sha256-gg/IHrgfDZT+3FNM/se5X1YMcHX127jMNI/WDEpMzy4=";
+  cargoSha256 = "sha256-EwK4F+XQWYhZqE4NMrghmVfWJ0znPJdGZLNUq6weoqQ=";
 
   patches = [
     ./icon-paths.patch
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 949dbe7700afb..62f1ede87ffdf 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1070,6 +1070,8 @@ with pkgs;
 
   ejson2env = callPackage ../tools/admin/ejson2env { };
 
+  davinci-resolve = callPackage ../applications/video/davinci-resolve { };
+
   gamemode = callPackage ../tools/games/gamemode {
     libgamemode32 = pkgsi686Linux.gamemode.lib;
   };
@@ -5159,7 +5161,9 @@ with pkgs;
 
   tridactyl-native = callPackage ../tools/networking/tridactyl-native { };
 
-  trivy = callPackage ../tools/admin/trivy { };
+  trivy = callPackage ../tools/admin/trivy {
+    buildGoModule = buildGo118Module;
+  };
 
   trompeloeil = callPackage ../development/libraries/trompeloeil { };
 
@@ -12871,7 +12875,9 @@ with pkgs;
     });
   graalvm11-ce = graalvmCEPackages.graalvm11-ce;
   graalvm17-ce = graalvmCEPackages.graalvm17-ce;
-  buildGraalvmNativeImage = callPackage ../build-support/build-graalvm-native-image { };
+  buildGraalvmNativeImage = callPackage ../build-support/build-graalvm-native-image {
+    graalvm = graalvm11-ce;
+  };
 
   inherit (callPackages ../development/compilers/graalvm/enterprise-edition.nix { })
     graalvm8-ee
@@ -15352,7 +15358,7 @@ with pkgs;
   img = callPackage ../development/tools/img { };
 
   include-what-you-use = callPackage ../development/tools/analysis/include-what-you-use {
-    llvmPackages = llvmPackages_13;
+    llvmPackages = llvmPackages_14;
   };
 
   indent = callPackage ../development/tools/misc/indent { };
@@ -21658,6 +21664,9 @@ with pkgs;
 
   morty = callPackage ../servers/web-apps/morty { };
 
+  inherit (callPackage ../applications/networking/mullvad { })
+    mullvad;
+
   mullvad-vpn = callPackage ../applications/networking/mullvad-vpn { };
 
   mycorrhiza = callPackage ../servers/mycorrhiza {
diff --git a/pkgs/top-level/lua-packages.nix b/pkgs/top-level/lua-packages.nix
index efaf06d30a22b..e8ac6445d0ebf 100644
--- a/pkgs/top-level/lua-packages.nix
+++ b/pkgs/top-level/lua-packages.nix
@@ -63,11 +63,7 @@ in
     inherit (pkgs) makeSetupHook makeWrapper;
   };
 
-  luarocks = callPackage ../development/tools/misc/luarocks {
-    inherit lua lib;
-  };
-
-  luarocks-3_7 = callPackage ../development/tools/misc/luarocks/3.7.nix {
+  luarocks = callPackage ../development/tools/misc/luarocks/default.nix {
     inherit lua lib;
   };
 
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 5a4a03fda0660..6e38e07ff3b6a 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -1406,6 +1406,8 @@ let
 
     stdint = callPackage ../development/ocaml-modules/stdint { };
 
+    unionFind = callPackage ../development/ocaml-modules/unionFind { };
+
     unstrctrd = callPackage ../development/ocaml-modules/unstrctrd { };
 
     uucd = callPackage ../development/ocaml-modules/uucd { };
@@ -1576,7 +1578,7 @@ in let inherit (pkgs) callPackage; in rec
 
   ocamlPackages_4_14 = mkOcamlPackages (callPackage ../development/compilers/ocaml/4.14.nix { });
 
-  ocamlPackages_latest = ocamlPackages_4_13;
+  ocamlPackages_latest = ocamlPackages_4_14;
 
   ocamlPackages = ocamlPackages_4_13;
 }
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index b73b0a7d7b2f6..b18afebdc15f6 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -472,6 +472,8 @@ in {
 
   altair = callPackage ../development/python-modules/altair { };
 
+  amazon-ion = callPackage ../development/python-modules/amazon-ion { };
+
   amazon_kclpy = callPackage ../development/python-modules/amazon_kclpy { };
 
   ambee = callPackage ../development/python-modules/ambee { };
@@ -3748,6 +3750,8 @@ in {
     inherit python;
   });
 
+  hepunits = callPackage ../development/python-modules/hepunits { };
+
   herepy = callPackage ../development/python-modules/herepy { };
 
   hetzner = callPackage ../development/python-modules/hetzner { };
@@ -4102,6 +4106,8 @@ in {
 
   iocapture = callPackage ../development/python-modules/iocapture { };
 
+  ionhash = callPackage ../development/python-modules/ionhash { };
+
   iotawattpy = callPackage ../development/python-modules/iotawattpy { };
 
   iowait = callPackage ../development/python-modules/iowait { };
@@ -4310,6 +4316,8 @@ in {
 
   json5 = callPackage ../development/python-modules/json5 { };
 
+  jsonconversion = callPackage ../development/python-modules/jsonconversion { };
+
   jsondate = callPackage ../development/python-modules/jsondate { };
 
   jsondiff = callPackage ../development/python-modules/jsondiff { };
@@ -5983,6 +5991,8 @@ in {
 
   parts = callPackage ../development/python-modules/parts { };
 
+  particle = callPackage ../development/python-modules/particle { };
+
   parver = callPackage ../development/python-modules/parver { };
   arpeggio = callPackage ../development/python-modules/arpeggio { };
 
@@ -7491,6 +7501,8 @@ in {
 
   pypytools = callPackage ../development/python-modules/pypytools { };
 
+  pyqldb = callPackage ../development/python-modules/pyqldb { };
+
   pyqrcode = callPackage ../development/python-modules/pyqrcode { };
 
   pyqt-builder = callPackage ../development/python-modules/pyqt-builder { };