Merge master into staging-next

56 files changed, 525 insertions, 182 deletions

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 1a9aa3d0909a7..a66d32294f77e 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -10887,6 +10887,16 @@
       fingerprint = "5D69 CF04 B7BC 2BC1 A567  9267 00BC F29B 3208 0700";
     }];
   };
+  phdcybersec = {
+    name = "Léo Lavaur";
+    email = "phdcybersec@pm.me";
+
+    github = "phdcybersec";
+    githubId = 82591009;
+    keys = [{
+      fingerprint = "7756 E88F 3C6A 47A5 C5F0  CDFB AB54 6777 F93E 20BF";
+    }];
+  };
   phfroidmont = {
     name = "Paul-Henri Froidmont";
     email = "nix.contact-j9dw4d@froidmont.org";
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
index 32db72f3b13ee..b47808dc20873 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
@@ -1124,9 +1124,9 @@ services.github-runner.serviceOverrides.SupplementaryGroups = [
           <listitem>
             <para>
               Previously, the options
-              <xref linkend="opt-services.grafana.provision.datasources" />
+              <link linkend="opt-services.grafana.provision.datasources">services.grafana.provision.datasources</link>
               and
-              <xref linkend="opt-services.grafana.provision.dashboards" />
+              <link linkend="opt-services.grafana.provision.dashboards">services.grafana.provision.dashboards</link>
               expected lists of datasources or dashboards for the
               <link xlink:href="https://grafana.com/docs/grafana/latest/administration/provisioning/">declarative
               provisioning</link>.
@@ -1139,14 +1139,14 @@ services.github-runner.serviceOverrides.SupplementaryGroups = [
                 <para>
                   <emphasis role="strong">datasources</emphasis>, please
                   rename your declarations to
-                  <xref linkend="opt-services.grafana.provision.datasources.settings.datasources" />.
+                  <link linkend="opt-services.grafana.provision.datasources.settings.datasources">services.grafana.provision.datasources.settings.datasources</link>.
                 </para>
               </listitem>
               <listitem>
                 <para>
                   <emphasis role="strong">dashboards</emphasis>, please
                   rename your declarations to
-                  <xref linkend="opt-services.grafana.provision.dashboards.settings.providers" />.
+                  <link linkend="opt-services.grafana.provision.dashboards.settings.providers">services.grafana.provision.dashboards.settings.providers</link>.
                 </para>
               </listitem>
             </itemizedlist>
@@ -1159,9 +1159,9 @@ services.github-runner.serviceOverrides.SupplementaryGroups = [
                   It’s possible to declare the
                   <literal>apiVersion</literal> of your dashboards and
                   datasources by
-                  <xref linkend="opt-services.grafana.provision.datasources.settings.apiVersion" />
+                  <link linkend="opt-services.grafana.provision.datasources.settings.apiVersion">services.grafana.provision.datasources.settings.apiVersion</link>
                   (or
-                  <xref linkend="opt-services.grafana.provision.dashboards.settings.apiVersion" />).
+                  <link linkend="opt-services.grafana.provision.dashboards.settings.apiVersion">services.grafana.provision.dashboards.settings.apiVersion</link>).
                 </para>
               </listitem>
               <listitem>
@@ -1169,9 +1169,9 @@ services.github-runner.serviceOverrides.SupplementaryGroups = [
                   Instead of declaring datasources and dashboards in
                   pure Nix, it’s also possible to specify configuration
                   files (or directories) with YAML instead using
-                  <xref linkend="opt-services.grafana.provision.datasources.path" />
+                  <link linkend="opt-services.grafana.provision.datasources.path">services.grafana.provision.datasources.path</link>
                   (or
-                  <xref linkend="opt-services.grafana.provision.dashboards.path" />.
+                  <link linkend="opt-services.grafana.provision.dashboards.path">services.grafana.provision.dashboards.path</link>.
                   This is useful when having provisioning files from
                   non-NixOS Grafana instances that you also want to
                   deploy to NixOS.
@@ -1186,9 +1186,9 @@ services.github-runner.serviceOverrides.SupplementaryGroups = [
               </listitem>
               <listitem>
                 <para>
-                  <xref linkend="opt-services.grafana.provision.notifiers" />
+                  <link linkend="opt-services.grafana.provision.notifiers">services.grafana.provision.notifiers</link>
                   is not affected by this change because this feature is
-                  deprecated by Grafana and will probably removed in
+                  deprecated by Grafana and will probably be removed in
                   Grafana 10. It’s recommended to use
                   <literal>services.grafana.provision.alerting.contactPoints</literal>
                   instead.
diff --git a/nixos/doc/manual/release-notes/rl-2211.section.md b/nixos/doc/manual/release-notes/rl-2211.section.md
index 5ab7038cae3af..cbede784f069a 100644
--- a/nixos/doc/manual/release-notes/rl-2211.section.md
+++ b/nixos/doc/manual/release-notes/rl-2211.section.md
@@ -340,32 +340,32 @@ In addition to numerous new and upgraded packages, this release includes the fol
     Alternatively you can also set all your values from `extraOptions` to
     `systemd.services.grafana.environment`, make sure you don't forget to add
     the `GF_` prefix though!
-  - Previously, the options [](#opt-services.grafana.provision.datasources) and
-    [](#opt-services.grafana.provision.dashboards) expected lists of datasources
+  - Previously, the options [services.grafana.provision.datasources](#opt-services.grafana.provision.datasources) and
+    [services.grafana.provision.dashboards](#opt-services.grafana.provision.dashboards) expected lists of datasources
     or dashboards for the [declarative provisioning](https://grafana.com/docs/grafana/latest/administration/provisioning/).
 
     To declare lists of
-    - **datasources**, please rename your declarations to [](#opt-services.grafana.provision.datasources.settings.datasources).
-    - **dashboards**, please rename your declarations to [](#opt-services.grafana.provision.dashboards.settings.providers).
+    - **datasources**, please rename your declarations to [services.grafana.provision.datasources.settings.datasources](#opt-services.grafana.provision.datasources.settings.datasources).
+    - **dashboards**, please rename your declarations to [services.grafana.provision.dashboards.settings.providers](#opt-services.grafana.provision.dashboards.settings.providers).
 
     This change was made to support more features for that:
 
     - It's possible to declare the `apiVersion` of your dashboards and datasources
-      by [](#opt-services.grafana.provision.datasources.settings.apiVersion) (or
-      [](#opt-services.grafana.provision.dashboards.settings.apiVersion)).
+      by [services.grafana.provision.datasources.settings.apiVersion](#opt-services.grafana.provision.datasources.settings.apiVersion) (or
+      [services.grafana.provision.dashboards.settings.apiVersion](#opt-services.grafana.provision.dashboards.settings.apiVersion)).
 
     - Instead of declaring datasources and dashboards in pure Nix, it's also possible
       to specify configuration files (or directories) with YAML instead using
-      [](#opt-services.grafana.provision.datasources.path) (or
-      [](#opt-services.grafana.provision.dashboards.path). This is useful when having
+      [services.grafana.provision.datasources.path](#opt-services.grafana.provision.datasources.path) (or
+      [services.grafana.provision.dashboards.path](#opt-services.grafana.provision.dashboards.path). This is useful when having
       provisioning files from non-NixOS Grafana instances that you also want to
       deploy to NixOS.
 
       __Note:__ secrets from these files will be leaked into the store unless you use a
       [**file**-provider or env-var](https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#file-provider) for secrets!
 
-    - [](#opt-services.grafana.provision.notifiers) is not affected by this change because
-      this feature is deprecated by Grafana and will probably removed in Grafana 10.
+    - [services.grafana.provision.notifiers](#opt-services.grafana.provision.notifiers) is not affected by this change because
+      this feature is deprecated by Grafana and will probably be removed in Grafana 10.
       It's recommended to use `services.grafana.provision.alerting.contactPoints` instead.
 
 - The `services.grafana.provision.alerting` option was added. It includes suboptions for every alerting-related objects (with the exception of `notifiers`), which means it's now possible to configure modern Grafana alerting declaratively.
diff --git a/nixos/modules/config/no-x-libs.nix b/nixos/modules/config/no-x-libs.nix
index 4e1d57cc48353..18ea1f52a9766 100644
--- a/nixos/modules/config/no-x-libs.nix
+++ b/nixos/modules/config/no-x-libs.nix
@@ -33,6 +33,8 @@ with lib;
       ffmpeg_4 = super.ffmpeg_4-headless;
       ffmpeg_5 = super.ffmpeg_5-headless;
       gobject-introspection = super.gobject-introspection.override { x11Support = false; };
+      imagemagick = super.imagemagick.override { libX11Support = false; libXtSupport = false; };
+      imagemagickBig = super.imagemagickBig.override { libX11Support = false; libXtSupport = false; };
       libva = super.libva-minimal;
       networkmanager-fortisslvpn = super.networkmanager-fortisslvpn.override { withGnome = false; };
       networkmanager-iodine = super.networkmanager-iodine.override { withGnome = false; };
@@ -42,6 +44,7 @@ with lib;
       networkmanager-sstp = super.networkmanager-vpnc.override { withGnome = false; };
       networkmanager-vpnc = super.networkmanager-vpnc.override { withGnome = false; };
       qemu = super.qemu.override { gtkSupport = false; spiceSupport = false; sdlSupport = false; };
+      zbar = super.zbar.override { enableVideo = false; withXorg = false; };
     }));
   };
 }
diff --git a/pkgs/applications/editors/jetbrains/default.nix b/pkgs/applications/editors/jetbrains/default.nix
index 096fdf8427a82..1208db4424173 100644
--- a/pkgs/applications/editors/jetbrains/default.nix
+++ b/pkgs/applications/editors/jetbrains/default.nix
@@ -252,7 +252,9 @@ let
     }).overrideAttrs (attrs: {
       postPatch = lib.optionalString (!stdenv.isDarwin) (attrs.postPatch + ''
         interp="$(cat $NIX_CC/nix-support/dynamic-linker)"
-        patchelf --set-interpreter $interp lib/ReSharperHost/linux-x64/Rider.Backend
+        patchelf --set-interpreter $interp \
+          lib/ReSharperHost/linux-x64/Rider.Backend \
+          plugins/dotCommon/DotFiles/linux-x64/JetBrains.Profiler.PdbServer
 
         rm -rf lib/ReSharperHost/linux-x64/dotnet
         ln -s ${dotnet-sdk_6} lib/ReSharperHost/linux-x64/dotnet
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 65b8cd46dbefa..0e7f5ecb3ed8f 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -9617,6 +9617,18 @@ final: prev:
     meta.homepage = "https://github.com/jhradilek/vim-docbk/";
   };
 
+  vim-dotenv = buildVimPluginFrom2Nix {
+    pname = "vim-dotenv";
+    version = "2022-05-15";
+    src = fetchFromGitHub {
+      owner = "tpope";
+      repo = "vim-dotenv";
+      rev = "5c51cfcf8d87280d6414e03cd6b253eb70ecb800";
+      sha256 = "06117ilmanj07kasshg1da3gai03fk5s3az2x8vw7rqbr9s50snp";
+    };
+    meta.homepage = "https://github.com/tpope/vim-dotenv/";
+  };
+
   vim-easy-align = buildVimPluginFrom2Nix {
     pname = "vim-easy-align";
     version = "2019-04-29";
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index a6b5e4eae94c4..032a3b6d001a3 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -808,6 +808,7 @@ https://github.com/kristijanhusak/vim-dirvish-git/,,
 https://github.com/tpope/vim-dispatch/,,
 https://github.com/radenling/vim-dispatch-neovim/,,
 https://github.com/jhradilek/vim-docbk/,,
+https://github.com/tpope/vim-dotenv/,,
 https://github.com/junegunn/vim-easy-align/,,
 https://github.com/zhou13/vim-easyescape/,,
 https://github.com/neoclide/vim-easygit/,,
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 84c3707f6f559..36ce6758aed3c 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1304,8 +1304,8 @@ let
           mktplcRef = {
             name = "vscode-pull-request-github";
             publisher = "github";
-            version = "0.45.2022062709";
-            sha256 = "119dz79vl2pngf6327zbfw97qnci8xg14d23wdd4n75jmra2wrbz";
+            version = "0.55.2022120109";
+            sha256 = "036gfgj3iyz4w3j74zhx3zh7m7rmakm2lg0h7mm11lqbpfwwrki1";
           };
           meta = { license = lib.licenses.mit; };
         };
@@ -1351,8 +1351,8 @@ let
         mktplcRef = {
           name = "haskell";
           publisher = "haskell";
-          version = "2.2.0";
-          sha256 = "sha256-YGPytmI4PgH6GQuWaRF5quiKGoOabkv7On+WVupI92E=";
+          version = "2.2.1";
+          sha256 = "14p9g07zsb3da4ilaasgsdvh3wagfzayqr8ichsf6k5c952zi8fk";
         };
         meta = with lib; {
           license = licenses.mit;
@@ -1646,8 +1646,8 @@ let
         mktplcRef = {
           name = "vscode-clangd";
           publisher = "llvm-vs-code-extensions";
-          version = "0.1.17";
-          sha256 = "1vgk4xsdbx0v6sy09wkb63qz6i64n6qcmpiy49qgh2xybskrrzvf";
+          version = "0.1.23";
+          sha256 = "125incws4n688irqii3s2a1cznj0kvkbhv3sa8585chj5g4zvmfy";
         };
         meta = {
           license = lib.licenses.mit;
@@ -1790,8 +1790,8 @@ let
         mktplcRef = {
           name = "direnv";
           publisher = "mkhl";
-          version = "0.7.0";
-          sha256 = "sha256-MLBPhDBU8vPVvbde3fdwhxKvQa8orUMKAAXoOfNrbh4=";
+          version = "0.10.1";
+          sha256 = "0m89sx1qqdkwa9pfmd9b11lp8z0dqpi6jn27js5q4ymscyg41bqd";
         };
         meta = with lib; {
           description = "direnv support for Visual Studio Code";
@@ -1859,8 +1859,8 @@ let
         mktplcRef = {
           name = "cmake-tools";
           publisher = "ms-vscode";
-          version = "1.13.17";
-          sha256 = "sha256-RF4KTHXnYBfRCD06GYmprwJNkdplyZyk4ioq5Nu+UDM=";
+          version = "1.13.26";
+          sha256 = "1bkjqlv48slgb8nf8y2g4nf11c1appr0ycka2w3mmbiczwdmyjr5";
         };
         meta.license = lib.licenses.mit;
       };
@@ -1927,8 +1927,8 @@ let
         mktplcRef = {
           name = "pyright";
           publisher = "ms-pyright";
-          version = "1.1.250";
-          sha256 = "sha256-UHSY32F5wzqAHmmBWyCUkLL0z+LMWDwn/YvUOF3q87I=";
+          version = "1.1.282";
+          sha256 = "14qkk9gbpwnbkk3dk7b7s92smj374ha7axlsi74fllw74lp4ziwn";
         };
         meta = with lib; {
           description = "VS Code static type checking for Python";
@@ -1996,8 +1996,8 @@ let
         mktplcRef = {
           name = "jupyter-renderers";
           publisher = "ms-toolsai";
-          version = "1.0.4";
-          sha256 = "sha256-aKWu0Gp0f28DCv2akF/G8UDaGfTN410CcH8CAmW7mgU=";
+          version = "1.0.12";
+          sha256 = "12l5z60kpz3nx77l8ck6a6w4qdzyz3xkn6k9670r30w365q9lf0z";
         };
         meta = {
           license = lib.licenses.mit;
@@ -2110,8 +2110,8 @@ let
         mktplcRef = {
           name = "java";
           publisher = "redhat";
-          version = "1.4.0";
-          sha256 = "sha256-9q3ilNukx3sQ6Fr1LhuQdjHHS251SDoHxC33w+qrfAI=";
+          version = "1.14.2022120303";
+          sha256 = "sha256-tlWb2rkDcEWgdpuidkBGN5Nxr3pmkYxnPJN/UdbQfEw=";
         };
         buildInputs = [ jdk ];
         meta = {
@@ -2124,8 +2124,8 @@ let
         mktplcRef = {
           name = "vscode-xml";
           publisher = "redhat";
-          version = "0.22.0";
-          sha256 = "sha256-7QOw0EVcfa7MFnZAHAsUtDZHXD5AFlW54f1qaN3h+2U=";
+          version = "0.23.2022120303";
+          sha256 = "sha256-rQvbb7GOUwVwg/049jchJMJTwaFsOP63AovcEmr2HXs=";
         };
         meta.license = lib.licenses.epl20;
       };
@@ -2649,8 +2649,8 @@ let
         mktplcRef = {
           name = "vscode-nushell-lang";
           publisher = "thenuprojectcontributors";
-          version = "0.7.0";
-          sha256 = "sha256-+AGJkFx/uzgQzuRnRBZ44xGNQ6a/QWt7SNiQgwPTZxo=";
+          version = "0.8.0";
+          sha256 = "0065ckgpsalqgv9zw8gvxxkqzwl7mjp6mydnlm1m3y9qxlfl010s";
         };
         meta.license = lib.licenses.mit;
       };
@@ -2829,8 +2829,8 @@ let
         mktplcRef = {
           name = "vscode-java-debug";
           publisher = "vscjava";
-          version = "0.44.0";
-          sha256 = "sha256-8/H7rihSKAvXp8QxK949txgMKwt6aYVN4EQdwhphIiQ=";
+          version = "0.47.2022112823";
+          sha256 = "0nlkkpc2v755g39lcb5bhx207b0kjn44q539w07al9b021y2vq54";
         };
         meta = {
           license = lib.licenses.mit;
@@ -2841,8 +2841,8 @@ let
         mktplcRef = {
           name = "vscode-java-dependency";
           publisher = "vscjava";
-          version = "0.21.0";
-          sha256 = "0rjxjf137qrn91nxmvv4j0a25xgwv2p2w2a1vb7yykkqlkfazmm6";
+          version = "0.21.2022111900";
+          sha256 = "1k5wk27s0lk2ywc6ajvraldhr1d48i0l2fj7jlaayds41zhyj73l";
         };
         meta = {
           license = lib.licenses.mit;
@@ -2853,8 +2853,8 @@ let
         mktplcRef = {
           name = "vscode-java-test";
           publisher = "vscjava";
-          version = "0.37.1";
-          sha256 = "sha256-QpDMG+0RbiRY9YQYXQhA6ESBoIjBeUxq+bEZ1Y71oSM=";
+          version = "0.37.2022090902";
+          sha256 = "17i9jfwpjjxp81dg6nnviczzmr47pvz33zc4bwfvz69ckn6v74j4";
         };
         meta = {
           license = lib.licenses.mit;
@@ -2865,8 +2865,8 @@ let
         mktplcRef = {
           name = "vscode-maven";
           publisher = "vscjava";
-          version = "0.39.0";
-          sha256 = "1603s2s9abg1pqfakj43zp3dfl0y92pblra85wj2rccbzf3asba3";
+          version = "0.40.2022120203";
+          sha256 = "063b0k74zy62qg6mh2bms15jiydysv58mds8p82nw3iajm6ppm5i";
         };
         meta = {
           license = lib.licenses.mit;
diff --git a/pkgs/applications/editors/vscode/extensions/ms-toolsai-jupyter/default.nix b/pkgs/applications/editors/vscode/extensions/ms-toolsai-jupyter/default.nix
index a427c1f8764aa..e713ba29e84bd 100644
--- a/pkgs/applications/editors/vscode/extensions/ms-toolsai-jupyter/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-toolsai-jupyter/default.nix
@@ -7,8 +7,8 @@ in buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "jupyter";
     publisher = "ms-toolsai";
-    version = "2022.9.1202862440";
-    sha256 = "sha256-0F6eTEXt0PJY0+1o/qZEuUcD9sjHSnUrI1OS4IO2WLc=";
+    version = "2022.11.1003381023";
+    sha256 = "0cbnr52pq0yw6i4yzyrifyrz186l482m9s01h4l7d74fby9ska8h";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/editors/vscode/extensions/python/default.nix b/pkgs/applications/editors/vscode/extensions/python/default.nix
index 00121d29a34f8..f7765e6ceb1a6 100644
--- a/pkgs/applications/editors/vscode/extensions/python/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/python/default.nix
@@ -19,8 +19,8 @@ vscode-utils.buildVscodeMarketplaceExtension rec {
   mktplcRef = {
     name = "python";
     publisher = "ms-python";
-    version = "2022.17.13011006";
-    sha256 = "sha256-f5vbXcqKwCnL+vsTcOX7rWUfoXNih5ZaWr3XUpCYB/M=";
+    version = "2022.19.13351014";
+    sha256 = "1562f4b0v76p1wfbljc5zydq7aq7k5hshxzm2v1whb77cjskiw8s";
   };
 
   buildInputs = [ icu ];
diff --git a/pkgs/applications/editors/vscode/extensions/vscode-lldb/default.nix b/pkgs/applications/editors/vscode/extensions/vscode-lldb/default.nix
index 9eba40330b96d..f87ab47726b04 100644
--- a/pkgs/applications/editors/vscode/extensions/vscode-lldb/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/vscode-lldb/default.nix
@@ -5,7 +5,7 @@ assert lib.versionAtLeast python3.version "3.5";
 let
   publisher = "vadimcn";
   pname = "vscode-lldb";
-  version = "1.7.4";
+  version = "1.8.1";
 
   vscodeExtUniqueId = "${publisher}.${pname}";
 
@@ -13,7 +13,7 @@ let
     owner = "vadimcn";
     repo = "vscode-lldb";
     rev = "v${version}";
-    sha256 = "sha256-yAB0qxeC2sWCQ1EcKG/7LsuUrxV/kbxkcOzRfAotxFc=";
+    sha256 = "sha256-5wrw8LNH14WAyIKIRGFbvrISb5RUXeD5Uh/weja9p4Q=";
   };
 
   # need to build a custom version of lldb and llvm for enhanced rust support
@@ -23,7 +23,7 @@ let
     pname = "${pname}-adapter";
     inherit version src;
 
-    cargoSha256 = "sha256-Ly7yIGB6kLy0c9RzWt8BFuX90dxu2QASocNTEdQA3yo=";
+    cargoSha256 = "sha256-Lpo2jaDMaZGwSrpQBvBCscVbWi2Db1Cx1Tv84v1H4Es=";
 
     nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/applications/emulators/ryujinx/default.nix b/pkgs/applications/emulators/ryujinx/default.nix
index 73e93707ceedd..90687a4e191db 100644
--- a/pkgs/applications/emulators/ryujinx/default.nix
+++ b/pkgs/applications/emulators/ryujinx/default.nix
@@ -29,15 +29,18 @@
 
 buildDotnetModule rec {
   pname = "ryujinx";
-  version = "1.1.327"; # Based off of the official github actions builds: https://github.com/Ryujinx/Ryujinx/actions/workflows/release.yml
+  version = "1.1.373"; # Based off of the official github actions builds: https://github.com/Ryujinx/Ryujinx/actions/workflows/release.yml
 
   src = fetchFromGitHub {
     owner = "Ryujinx";
     repo = "Ryujinx";
-    rev = "9719b6a1129c017d96532ff026e2bb933c0b2d0b";
-    sha256 = "1vm1zwjm02jp64gjcfn923lxc4hqwgw44w9rspjy97q2z6r9vwjh";
+    rev = "567c64e149f1ec3487dea34abdffc7bfa2f55400";
+    sha256 = "0b4c3dmvnx4m7mzhm3kzw3bjnw53rwi3qr2p4i9kyxbb2790bmsb";
   };
 
+  dotnet-sdk = dotnetCorePackages.sdk_7_0;
+  dotnet-runtime = dotnetCorePackages.runtime_7_0;
+
   nugetDeps = ./deps.nix;
 
   nativeBuildInputs = [
@@ -88,7 +91,7 @@ buildDotnetModule rec {
     "/p:ExtraDefineConstants=DISABLE_UPDATER"
   ];
 
-  dotnetRestoreFlags = [ "--runtime ${dotnetCorePackages.sdk_6_0.systemToDotnetRid stdenvNoCC.targetPlatform.system}" ];
+  dotnetRestoreFlags = [ "--runtime ${dotnetCorePackages.sdk_7_0.systemToDotnetRid stdenvNoCC.targetPlatform.system}" ];
 
   executables = [
     "Ryujinx.Headless.SDL2"
diff --git a/pkgs/applications/emulators/ryujinx/deps.nix b/pkgs/applications/emulators/ryujinx/deps.nix
index 6486c13c7952f..780ec9dee8eed 100644
--- a/pkgs/applications/emulators/ryujinx/deps.nix
+++ b/pkgs/applications/emulators/ryujinx/deps.nix
@@ -41,7 +41,7 @@
   (fetchNuGet { pname = "HarfBuzzSharp.NativeAssets.Win32"; version = "2.8.2-preview.178"; sha256 = "1r5syii96wv8q558cvsqw3lr10cdw6677lyiy82p6i3if51v3mr7"; })
   (fetchNuGet { pname = "JetBrains.Annotations"; version = "10.3.0"; sha256 = "1grdx28ga9fp4hwwpwv354rizm8anfq4lp045q4ss41gvhggr3z8"; })
   (fetchNuGet { pname = "jp2masa.Avalonia.Flexbox"; version = "0.2.0"; sha256 = "1abck2gad29mgf9gwqgc6wr8iwl64v50n0sbxcj1bcxgkgndraiq"; })
-  (fetchNuGet { pname = "LibHac"; version = "0.16.1"; sha256 = "131qnqa1asdmymwdvpjza6w646b05jzn1cxjdxgwh7qdcdb77xyx"; })
+  (fetchNuGet { pname = "LibHac"; version = "0.17.0"; sha256 = "06ar4yv9mbvi42fpzs8g6j5yqrk1nbn5zssbh2k08sx3s757gd6f"; })
   (fetchNuGet { pname = "MicroCom.CodeGenerator.MSBuild"; version = "0.10.4"; sha256 = "1bdgy6g15d1mln1xpvs6sy0l2zvfs4hxw6nc3qm16qb8hdgvb73y"; })
   (fetchNuGet { pname = "MicroCom.Runtime"; version = "0.10.4"; sha256 = "0ccbzp0d01dcahm7ban7xyh1rk7k2pkml3l5i7s85cqk5lnczpw2"; })
   (fetchNuGet { pname = "Microsoft.CodeAnalysis.Analyzers"; version = "2.9.6"; sha256 = "18mr1f0wpq0fir8vjnq0a8pz50zpnblr7sabff0yqx37c975934a"; })
@@ -60,9 +60,10 @@
   (fetchNuGet { pname = "Microsoft.DotNet.InternalAbstractions"; version = "1.0.0"; sha256 = "0mp8ihqlb7fsa789frjzidrfjc1lrhk88qp3xm5qvr7vf4wy4z8x"; })
   (fetchNuGet { pname = "Microsoft.DotNet.PlatformAbstractions"; version = "3.1.6"; sha256 = "0b9myd7gqbpaw9pkd2bx45jhik9mwj0f1ss57sk2cxmag2lkdws5"; })
   (fetchNuGet { pname = "Microsoft.Extensions.DependencyModel"; version = "3.1.1"; sha256 = "0qa04dspjl4qk7l8d66wqyrvhp5dxcfn2j4r8mmj362xyrp3r8sh"; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.JsonWebTokens"; version = "6.15.0"; sha256 = "0dwx7dk8jr10784nriqbi364qbxzfwq0c6xia0ac5rzrp7179r4d"; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.Logging"; version = "6.15.0"; sha256 = "0jn9a20a2zixnkm3bmpmvmiv7mk0hqdlnpi0qgjkg1nir87czm19"; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.Tokens"; version = "6.15.0"; sha256 = "1nbgydr45f7lp980xyrkzpyaw2mkkishjwp3slgxk7f0mz6q8i1v"; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.Abstractions"; version = "6.25.0"; sha256 = "1zv220bfzwglzd22rzxmfymjb5z4sn3hydmkg8ciz133s58gdp3w"; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.JsonWebTokens"; version = "6.25.0"; sha256 = "0662zhcf7gfdiqwgw3kd8kclwc0pnlsksf5imd8axs87nvqvxbmr"; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.Logging"; version = "6.25.0"; sha256 = "0v37h9xid7ils3r8jbd2k7p63i1bi5w6ad90m5n85bz3g233wkjm"; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.Tokens"; version = "6.25.0"; sha256 = "101dbcyf46xsf6vshwx567hbzsrgag896k5v4vya3d68gk57imwh"; })
   (fetchNuGet { pname = "Microsoft.NET.Test.Sdk"; version = "16.8.0"; sha256 = "1ln2mva7j2mpsj9rdhpk8vhm3pgd8wn563xqdcwd38avnhp74rm9"; })
   (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.0.1"; sha256 = "01al6cfxp68dscl15z7rxfw9zvhm64dncsw09a1vmdkacsa2v6lr"; })
   (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.1.0"; sha256 = "08vh1r12g6ykjygq5d3vq09zylgb84l63k49jc4v8faw9g93iqqm"; })
@@ -159,7 +160,7 @@
   (fetchNuGet { pname = "SkiaSharp.NativeAssets.WebAssembly"; version = "2.88.1-preview.1"; sha256 = "0mwj2yl4gn40lry03yqkj7sbi1drmm672dv88481sgah4c21lzrq"; })
   (fetchNuGet { pname = "SkiaSharp.NativeAssets.Win32"; version = "2.88.0"; sha256 = "135ni4rba4wy4wyzy9ip11f3dwb1ipn38z9ps1p9xhw8jc06y5vp"; })
   (fetchNuGet { pname = "SkiaSharp.NativeAssets.Win32"; version = "2.88.1-preview.1"; sha256 = "1k50abd147pif9z9lkckbbk91ga1vv6k4skjz2n7wpll6fn0fvlv"; })
-  (fetchNuGet { pname = "SPB"; version = "0.0.4-build27"; sha256 = "16i10lp4w7gi5rzjs9v9vns858n735ixcb83kl2qqq9qwyrnv8mw"; })
+  (fetchNuGet { pname = "SPB"; version = "0.0.4-build28"; sha256 = "1ran6qwzlkv6xpvnp7n0nkva0zfrzwlcxj7zfzz9v8mpicqs297x"; })
   (fetchNuGet { pname = "Svg.Custom"; version = "0.5.14"; sha256 = "1wjghs2n5hk7zszzk2p2a8m6ga2gc8sfd5mdqi15sbfkmwg2nbw7"; })
   (fetchNuGet { pname = "Svg.Model"; version = "0.5.14"; sha256 = "1xilk95bmnsl93sbr7pah0jrjrnccf1ikcn8s7rkm0yjkj382hc8"; })
   (fetchNuGet { pname = "Svg.Skia"; version = "0.5.14"; sha256 = "02wv040wi8ijw9mwg3c84f8bfyfv9n99ji8q1v2bs11b463zsyd1"; })
@@ -198,7 +199,7 @@
   (fetchNuGet { pname = "System.Globalization.Calendars"; version = "4.0.1"; sha256 = "0bv0alrm2ck2zk3rz25lfyk9h42f3ywq77mx1syl6vvyncnpg4qh"; })
   (fetchNuGet { pname = "System.Globalization.Extensions"; version = "4.0.1"; sha256 = "0hjhdb5ri8z9l93bw04s7ynwrjrhx2n0p34sf33a9hl9phz69fyc"; })
   (fetchNuGet { pname = "System.Globalization.Extensions"; version = "4.3.0"; sha256 = "02a5zfxavhv3jd437bsncbhd2fp1zv4gxzakp1an9l6kdq1mcqls"; })
-  (fetchNuGet { pname = "System.IdentityModel.Tokens.Jwt"; version = "6.15.0"; sha256 = "0kzc9rqwn8xgixwm1z5zajf6bapa2rvi9lv8vgz7hlp1lgi964zk"; })
+  (fetchNuGet { pname = "System.IdentityModel.Tokens.Jwt"; version = "6.25.0"; sha256 = "14xlnz1hjgn0brc8rr73xzkzbzaa0n1g4azz91vm7km5scdmql67"; })
   (fetchNuGet { pname = "System.IO"; version = "4.1.0"; sha256 = "1g0yb8p11vfd0kbkyzlfsbsp5z44lwsvyc0h3dpw6vqnbi035ajp"; })
   (fetchNuGet { pname = "System.IO"; version = "4.3.0"; sha256 = "05l9qdrzhm4s5dixmx68kxwif4l99ll5gqmh7rqgw554fx0agv5f"; })
   (fetchNuGet { pname = "System.IO.Compression"; version = "4.1.0"; sha256 = "0iym7s3jkl8n0vzm3jd6xqg9zjjjqni05x45dwxyjr2dy88hlgji"; })
@@ -283,6 +284,7 @@
   (fetchNuGet { pname = "System.Text.Encoding.Extensions"; version = "4.0.11"; sha256 = "08nsfrpiwsg9x5ml4xyl3zyvjfdi4mvbqf93kjdh11j4fwkznizs"; })
   (fetchNuGet { pname = "System.Text.Encoding.Extensions"; version = "4.3.0"; sha256 = "11q1y8hh5hrp5a3kw25cb6l00v5l5dvirkz8jr3sq00h1xgcgrxy"; })
   (fetchNuGet { pname = "System.Text.Json"; version = "4.7.0"; sha256 = "0fp3xrysccm5dkaac4yb51d793vywxks978kkl5x4db9gw29rfdr"; })
+  (fetchNuGet { pname = "System.Text.Json"; version = "4.7.2"; sha256 = "10xj1pw2dgd42anikvj9qm23ccssrcp7dpznpj4j7xjp1ikhy3y4"; })
   (fetchNuGet { pname = "System.Text.RegularExpressions"; version = "4.1.0"; sha256 = "1mw7vfkkyd04yn2fbhm38msk7dz2xwvib14ygjsb8dq2lcvr18y7"; })
   (fetchNuGet { pname = "System.Text.RegularExpressions"; version = "4.3.0"; sha256 = "1bgq51k7fwld0njylfn7qc5fmwrk2137gdq7djqdsw347paa9c2l"; })
   (fetchNuGet { pname = "System.Threading"; version = "4.0.11"; sha256 = "19x946h926bzvbsgj28csn46gak2crv2skpwsx80hbgazmkgb1ls"; })
diff --git a/pkgs/applications/misc/gallery-dl/default.nix b/pkgs/applications/misc/gallery-dl/default.nix
index 0b7233e189c03..edd5f491cced2 100644
--- a/pkgs/applications/misc/gallery-dl/default.nix
+++ b/pkgs/applications/misc/gallery-dl/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonApplication rec {
   pname = "gallery-dl";
-  version = "1.24.0";
+  version = "1.24.1";
   format = "setuptools";
 
   src = fetchPypi {
     inherit version;
     pname = "gallery_dl";
-    sha256 = "sha256-LGZjPkiX252IRgRG1fxVS4IdnKA3RgVjOhZLxYScIJo=";
+    sha256 = "sha256-pjm410aT4+Lj3PBAlibmglNPGlmBgkRoHAg7JrIDp0s=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/applications/misc/obsidian/default.nix b/pkgs/applications/misc/obsidian/default.nix
index 85ef0c436691f..55aba845b0c04 100644
--- a/pkgs/applications/misc/obsidian/default.nix
+++ b/pkgs/applications/misc/obsidian/default.nix
@@ -51,7 +51,8 @@ let
       runHook preInstall
       mkdir -p $out/bin
       makeWrapper ${electron_18}/bin/electron $out/bin/obsidian \
-        --add-flags $out/share/obsidian/app.asar
+        --add-flags $out/share/obsidian/app.asar \
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform=wayland}}"
       install -m 444 -D resources/app.asar $out/share/obsidian/app.asar
       install -m 444 -D resources/obsidian.asar $out/share/obsidian/obsidian.asar
       install -m 444 -D "${desktopItem}/share/applications/"* \
diff --git a/pkgs/applications/networking/browsers/librewolf/src.json b/pkgs/applications/networking/browsers/librewolf/src.json
index b3bc0b85b7a4e..8cc32b8e3b319 100644
--- a/pkgs/applications/networking/browsers/librewolf/src.json
+++ b/pkgs/applications/networking/browsers/librewolf/src.json
@@ -1,11 +1,11 @@
 {
-  "packageVersion": "107.0-1",
+  "packageVersion": "107.0.1-2",
   "source": {
-    "rev": "107.0-1",
-    "sha256": "1fm4z3s0z9shxj8667pnz3gly7jv1kmm1arbn52hq7n52ywykrv7"
+    "rev": "107.0.1-2",
+    "sha256": "1s009nbsqihmhnaa20j9g1qyifl3kgsbpgxc8ms5ahx3j97hbpk5"
   },
   "firefox": {
-    "version": "107.0",
-    "sha512": "4b442631079a13e1d11223499b1d8daf622d9d84b38898f9084670ddcb5738b73e0d967a5050d5930bf862aa69e8d46ebf6d751ac6d0f075a1d75ff4738bdb6e"
+    "version": "107.0.1",
+    "sha512": "e57e4bfcecbcc6dbe73f23577a14a2998c8c3f3d602f85ea06f99e0974e78481b9f7bdb019cb4e9733e59f56be1407edd64a2adb7b284bb4a87b46b1e2295dea"
   }
 }
diff --git a/pkgs/applications/networking/cluster/pachyderm/default.nix b/pkgs/applications/networking/cluster/pachyderm/default.nix
index f199edce212db..eb68de91c233b 100644
--- a/pkgs/applications/networking/cluster/pachyderm/default.nix
+++ b/pkgs/applications/networking/cluster/pachyderm/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "pachyderm";
-  version = "2.4.0";
+  version = "2.4.1";
 
   src = fetchFromGitHub {
     owner = "pachyderm";
     repo = "pachyderm";
     rev = "v${version}";
-    hash = "sha256-8JAn7/ge1bCkHsZC1tG46N1eag0Itvlj5TW+8oSWXd8=";
+    hash = "sha256-hU1Li3ZTgCbvyfBQ7TcmmeXOfcb1DHeo/K7iT7vc+vE=";
   };
 
   vendorHash = "sha256-j7zg0vIhdYbzyi4owdVEF4XyUNwGds6J01+3k5K90Yg=";
diff --git a/pkgs/applications/networking/mailreaders/aerc/default.nix b/pkgs/applications/networking/mailreaders/aerc/default.nix
index d875e39fb7a9b..ddc0f4b932ad0 100644
--- a/pkgs/applications/networking/mailreaders/aerc/default.nix
+++ b/pkgs/applications/networking/mailreaders/aerc/default.nix
@@ -7,6 +7,7 @@
 , python3
 , w3m
 , dante
+, gawk
 }:
 
 buildGoModule rec {
@@ -46,7 +47,7 @@ buildGoModule rec {
     python3.pkgs.colorama
   ];
 
-  buildInputs = [ python3 notmuch ];
+  buildInputs = [ python3 notmuch gawk ];
 
   installPhase = ''
     runHook preInstall
@@ -57,10 +58,13 @@ buildGoModule rec {
   '';
 
   postFixup = ''
-    wrapProgram $out/bin/aerc --prefix PATH ":" \
-      "${lib.makeBinPath [ ncurses ]}"
-    wrapProgram $out/share/aerc/filters/html --prefix PATH ":" \
-      ${lib.makeBinPath [ w3m dante ]}
+    wrapProgram $out/bin/aerc \
+      --prefix PATH ":" "${lib.makeBinPath [ ncurses ]}"
+    wrapProgram $out/share/aerc/filters/html \
+      --prefix PATH ":"  ${lib.makeBinPath [ w3m dante ]}
+    wrapProgram $out/share/aerc/filters/html-unsafe \
+      --prefix PATH ":" ${lib.makeBinPath [ w3m dante ]}
+    patchShebangs $out/share/aerc/filters
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/networking/p2p/freenet/default.nix b/pkgs/applications/networking/p2p/freenet/default.nix
index 9f4f1d8414720..05cc0466264f3 100644
--- a/pkgs/applications/networking/p2p/freenet/default.nix
+++ b/pkgs/applications/networking/p2p/freenet/default.nix
@@ -1,15 +1,7 @@
-{ lib, stdenv, fetchurl, jdk, bash, coreutils, substituteAll, nixosTests }:
+{ lib, stdenv, fetchurl, jdk, bash, coreutils, substituteAll, nixosTests, jna }:
 
 let
   version = "build01494";
-  jna = fetchurl {
-    url = "https://github.com/freenet/fred/releases/download/${version}/jna-4.5.2.jar";
-    sha256 = "sha256-DI63rPZyYWVteQBRkd66ujtr9d1gpDc1okVCk4Hb7P8=";
-  };
-  jna_platform = fetchurl {
-    url = "https://github.com/freenet/fred/releases/download/${version}/jna-platform-4.5.2.jar";
-    sha256 = "sha256-8dAMFn2JIcbiPGJu+fHDrgvkc8lcaP+gErx65VqH4tY=";
-  };
   freenet_ext = fetchurl {
     url = "https://github.com/freenet/fred/releases/download/${version}/freenet-ext.jar";
     sha256 = "sha256-MvKz1r7t9UE36i+aPr72dmbXafCWawjNF/19tZuk158=";
@@ -38,8 +30,8 @@ let
       mkdir -p $out/share/freenet
       ln -s ${bcprov} $out/share/freenet/bcprov.jar
       ln -s ${freenet_ext} $out/share/freenet/freenet-ext.jar
-      ln -s ${jna_platform} $out/share/freenet/jna_platform.jar
-      ln -s ${jna} $out/share/freenet/jna.jar
+      ln -s ${jna}/share/java/jna-platform.jar $out/share/freenet/jna_platform.jar
+      ln -s ${jna}/share/java/jna.jar $out/share/freenet/jna.jar
       ln -s $src $out/share/freenet/freenet.jar
     '';
   };
@@ -71,5 +63,6 @@ in stdenv.mkDerivation {
     license = lib.licenses.gpl2Plus;
     maintainers = with lib.maintainers; [ nagy ];
     platforms = with lib.platforms; linux;
+    changelog = "https://github.com/freenet/fred/blob/build${version}/NEWS.md";
   };
 }
diff --git a/pkgs/applications/networking/p2p/rqbit/default.nix b/pkgs/applications/networking/p2p/rqbit/default.nix
index 40f6f1ed4edb3..1364acc16cced 100644
--- a/pkgs/applications/networking/p2p/rqbit/default.nix
+++ b/pkgs/applications/networking/p2p/rqbit/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rqbit";
-  version = "2.1.4";
+  version = "2.1.5";
 
   src = fetchFromGitHub {
     owner = "ikatson";
     repo = "rqbit";
     rev = "v${version}";
-    sha256 = "sha256-PkU3QJvAK2b1KQC1o5md35iucjq+SYoKAGxqiojf4rw=";
+    sha256 = "sha256-AzlYeHPCDri/FxAh5R5AES+OAfzhwqB8/ewRwDU1nnU=";
   };
 
-  cargoSha256 = "sha256-Jj2CK3nwktv2MU+EHXzQ/lKDUlC+4HkaItMTtoGF1Pw=";
+  cargoSha256 = "sha256-CqEnQNbwiB6+zM8gWhplvFPblKp+mPMAtnHP8JZiKv4=";
 
   nativeBuildInputs = lib.optionals stdenv.isLinux [ pkg-config ];
 
diff --git a/pkgs/applications/terminal-emulators/kermit-terminal/default.nix b/pkgs/applications/terminal-emulators/kermit-terminal/default.nix
index da5342aa683fb..4bcd3191af7dc 100644
--- a/pkgs/applications/terminal-emulators/kermit-terminal/default.nix
+++ b/pkgs/applications/terminal-emulators/kermit-terminal/default.nix
@@ -9,16 +9,15 @@
 , nixosTests
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "kermit";
-  version = "3.7";
+  version = "3.8";
 
   src = fetchFromGitHub {
-    name = "${pname}-${version}-src";
     owner = "orhun";
-    repo = pname;
-    rev = version;
-    hash = "sha256-O5jpiQ+aaOTPst4/Z+H5e7ylA8CNBevqNoH50p4uEA4=";
+    repo = finalAttrs.pname;
+    rev = finalAttrs.version;
+    hash = "sha256-XPHF33Nu+H8OcQFwsuUOhDBDWKm8sh5B36sfROeSWPg=";
   };
 
   nativeBuildInputs = [
@@ -37,8 +36,9 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://github.com/orhun/kermit";
     description = "A VTE-based, simple and froggy terminal emulator";
+    changelog = "https://github.com/orhun/kermit/releases/tag/${finalAttrs.version}";
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ AndersonTorres ];
     platforms = with platforms; unix;
   };
-}
+})
diff --git a/pkgs/data/misc/spdx-license-list-data/default.nix b/pkgs/data/misc/spdx-license-list-data/default.nix
index 20778f1e5e916..93405fb788ef8 100644
--- a/pkgs/data/misc/spdx-license-list-data/default.nix
+++ b/pkgs/data/misc/spdx-license-list-data/default.nix
@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "spdx-license-list-data";
-  version = "3.18";
+  version = "3.19";
 
   src = fetchFromGitHub {
     owner = "spdx";
     repo = "license-list-data";
     rev = "v${version}";
-    hash = "sha256-iXuGJzURcRyiq2rVP5jabOmFByF0YuiZg4HPCM6mk3A=";
+    hash = "sha256-qT9Q6Mntnt9lOhYmGFJlkDyAHQ0CGQpWr1rLF08FGeg=";
   };
 
   # List of file formats to package.
diff --git a/pkgs/development/compilers/ponyc/pony-corral.nix b/pkgs/development/compilers/ponyc/pony-corral.nix
index ab7bf63006a2d..a399737334749 100644
--- a/pkgs/development/compilers/ponyc/pony-corral.nix
+++ b/pkgs/development/compilers/ponyc/pony-corral.nix
@@ -1,14 +1,18 @@
-{ lib, stdenv, fetchFromGitHub, ponyc }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, ponyc
+}:
 
 stdenv.mkDerivation ( rec {
   pname = "corral";
-  version = "0.6.0";
+  version = "0.6.1";
 
   src = fetchFromGitHub {
     owner = "ponylang";
     repo = pname;
-    rev = version;
-    sha256 = "sha256-8hSs1pllAips27Lut1GbSn3E9lbp4BT1L2AlkyDd46o=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-Rv1K6kFRylWodm1uACBs8KqqEqQZh86NqAG50heNteE=";
   };
 
   buildInputs = [ ponyc ];
@@ -18,6 +22,7 @@ stdenv.mkDerivation ( rec {
   meta = with lib; {
     description = "Corral is a dependency management tool for ponylang (ponyc)";
     homepage = "https://www.ponylang.io";
+    changelog = "https://github.com/ponylang/corral/blob/${version}/CHANGELOG.md";
     license = licenses.bsd2;
     maintainers = with maintainers; [ redvers ];
     platforms = [ "x86_64-linux" "x86_64-darwin" ];
diff --git a/pkgs/development/interpreters/luau/default.nix b/pkgs/development/interpreters/luau/default.nix
index 03fd14d03dd6b..783717624ab20 100644
--- a/pkgs/development/interpreters/luau/default.nix
+++ b/pkgs/development/interpreters/luau/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "luau";
-  version = "0.554";
+  version = "0.555";
 
   src = fetchFromGitHub {
     owner = "Roblox";
     repo = "luau";
     rev = version;
-    sha256 = "sha256-BgCeLvMwMPsXIopSO2OH50SPqwZ4Ehqmog+3DydJ3vU=";
+    sha256 = "sha256-p3BTtjTmg8sS0gOugPCO1oqqboppcXa0wLHmRqmf3AA=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/java-modules/jna/default.nix b/pkgs/development/java-modules/jna/default.nix
new file mode 100644
index 0000000000000..5ab3f14354b1a
--- /dev/null
+++ b/pkgs/development/java-modules/jna/default.nix
@@ -0,0 +1,37 @@
+{ stdenv, lib, fetchFromGitHub, ant, jdk8 }:
+
+stdenv.mkDerivation rec {
+  pname = "jna";
+  version = "4.5.2";
+
+  src = fetchFromGitHub {
+    owner = "java-native-access";
+    repo = pname;
+    rev = version;
+    hash = "sha256-FJXYej49soHPa+kAUeLZYzbw+NnFoag2LdKrTihPWvE=";
+  };
+
+  nativeBuildInputs = [ ant jdk8 ];
+
+  buildPhase = ''
+    runHook preBuild
+    rm -r dist # remove prebuilt files
+    ant dist
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm444 -t $out/share/java dist/jna{,-platform}.jar
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    inherit (src.meta) homepage;
+    description = "Java Native Access";
+    license = with licenses; [ lgpl21 asl20 ];
+    maintainers = with maintainers; [ nagy ];
+    platforms = platforms.linux;
+    changelog = "https://github.com/java-native-access/jna/blob/${version}/CHANGES.md";
+  };
+}
diff --git a/pkgs/development/libraries/xercesc/default.nix b/pkgs/development/libraries/xercesc/default.nix
index f5109a1ebd6a0..c7509bc43ab56 100644
--- a/pkgs/development/libraries/xercesc/default.nix
+++ b/pkgs/development/libraries/xercesc/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "xerces-c";
-  version = "3.2.3";
+  version = "3.2.4";
 
   src = fetchurl {
     url = "mirror://apache/xerces/c/3/sources/${pname}-${version}.tar.gz";
-    sha256 = "0zicsydx6s7carwr7q0csgkg1xncibd6lfp5chg2v2gvn54zr5pv";
+    sha256 = "sha256-PY7Bx/lOOP7g5Mpa0eHZ2yPL86ELumJva0r6Le2v5as=";
   };
 
   # Disable SSE2 extensions on platforms for which they are not enabled by default
diff --git a/pkgs/development/python-modules/colorful/default.nix b/pkgs/development/python-modules/colorful/default.nix
index 9ea380cd1d55a..061d01114e04c 100644
--- a/pkgs/development/python-modules/colorful/default.nix
+++ b/pkgs/development/python-modules/colorful/default.nix
@@ -2,25 +2,35 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "colorful";
-  version = "0.5.4";
+  version = "0.5.5";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
-  # No tests in the Pypi package.
   src = fetchFromGitHub {
     owner = "timofurrer";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "1fcz5v8b318a3dsdha4c874jsf3wmcw3f25bv2csixclyzacli98";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-fgxbj1WE9JcGt+oEcBguL0wQEWIn5toRTLWsvCFO3k8=";
   };
 
-  checkInputs = [ pytestCheckHook ];
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "colorful"
+  ];
 
   meta = with lib; {
-    description = "Terminal string styling done right, in Python.";
+    description = "Library for terminal string styling";
     homepage = "https://github.com/timofurrer/colorful";
+    changelog = "https://github.com/timofurrer/colorful/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ kalbasit ];
   };
diff --git a/pkgs/development/python-modules/deezer-python/default.nix b/pkgs/development/python-modules/deezer-python/default.nix
index 0b1e6c20792c5..01223be0b6f40 100644
--- a/pkgs/development/python-modules/deezer-python/default.nix
+++ b/pkgs/development/python-modules/deezer-python/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "deezer-python";
-  version = "5.8.0";
+  version = "5.8.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "browniebroke";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-H/+ESuZ4t9oSL9QIBZWWuRCSRXRv8IuTVNP/g5h7CIE=";
+    hash = "sha256-M6icdvD412qeURAIkywUliUM9QAgG/b+yBMZVYatvyQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/diff-cover/default.nix b/pkgs/development/python-modules/diff-cover/default.nix
index 6d5395f7eb001..59564ddd38212 100644
--- a/pkgs/development/python-modules/diff-cover/default.nix
+++ b/pkgs/development/python-modules/diff-cover/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "diff-cover";
-  version = "7.1.1";
+  version = "7.2.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "diff_cover";
     inherit version;
-    hash = "sha256-1PXKCGunPas98XCVAAV7n7ihi6UWkjq/Qv5ltmgee6Y=";
+    hash = "sha256-MJvP3bwTZQsSFGIlLz9pZ6wZaBb4uR6WWi4MAroVzJI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/keepkey_agent/default.nix b/pkgs/development/python-modules/keepkey_agent/default.nix
index 27ef7d8dbf483..fc00b23ce5096 100644
--- a/pkgs/development/python-modules/keepkey_agent/default.nix
+++ b/pkgs/development/python-modules/keepkey_agent/default.nix
@@ -21,7 +21,7 @@ buildPythonPackage rec {
   ];
 
   doCheck = false;
-  pythonImportsChecks = [ "keepkey_agent" ];
+  pythonImportsCheck = [ "keepkey_agent" ];
 
   meta = with lib; {
     description = "Using KeepKey as hardware-based SSH/PGP agent";
diff --git a/pkgs/development/python-modules/line_profiler/default.nix b/pkgs/development/python-modules/line_profiler/default.nix
index cafd6d311463b..33257b3b44e60 100644
--- a/pkgs/development/python-modules/line_profiler/default.nix
+++ b/pkgs/development/python-modules/line_profiler/default.nix
@@ -13,14 +13,15 @@
 
 buildPythonPackage rec {
   pname = "line-profiler";
-  version = "3.5.1";
+  version = "4.0.1";
+  format = "setuptools";
 
   disabled = pythonOlder "3.6" || isPyPy;
 
   src = fetchPypi {
     pname = "line_profiler";
     inherit version;
-    sha256 = "sha256-d0ACCL+9XUNBk4qaOk+1GU9a9/wjstSWyRN1X4MQ6Lg=";
+    hash = "sha256-eXlt/5BUxtIZDnRz3umqXqkYqDcgYX5+goSzwBmneek=";
   };
 
   nativeBuildInputs = [
@@ -54,6 +55,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Line-by-line profiler";
     homepage = "https://github.com/pyutils/line_profiler";
+    changelog = "https://github.com/pyutils/line_profiler/blob/v${version}/CHANGELOG.rst";
     license = licenses.bsd3;
     maintainers = with maintainers; [ fridh ];
   };
diff --git a/pkgs/development/python-modules/protonvpn-nm-lib/default.nix b/pkgs/development/python-modules/protonvpn-nm-lib/default.nix
index d3868d556ebec..89a4bf789c3a0 100644
--- a/pkgs/development/python-modules/protonvpn-nm-lib/default.nix
+++ b/pkgs/development/python-modules/protonvpn-nm-lib/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage rec {
   pname = "protonvpn-nm-lib";
-  version = "3.13.0";
+  version = "3.14.0";
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "ProtonVPN";
     repo = pname;
     rev = "refs/tags/${version}";
-    sha256 = "sha256-i6Y+ardptWCVO2SzzluAOQp6MDO6Xzm0NneiqzkhHrw=";
+    sha256 = "sha256-xpK3l8BI6/DUt46VR8DS89hzdHUljAbrYhEyf00giGg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pudb/default.nix b/pkgs/development/python-modules/pudb/default.nix
index c135b0b5ccf22..1f13859449022 100644
--- a/pkgs/development/python-modules/pudb/default.nix
+++ b/pkgs/development/python-modules/pudb/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "pudb";
-  version = "2022.1.2";
+  version = "2022.1.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-a4OrgFvdtTcQEJaQoiN+mL+DwLOgADPFF8319qj6Rw0=";
+    hash = "sha256-WOg62p4Z/+ksH9x4rlRY75GuuJKluPDnN55vph4OZko=";
   };
 
   propagatedBuildInputs = [
@@ -48,6 +48,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "A full-screen, console-based Python debugger";
     homepage = "https://github.com/inducer/pudb";
+    changelog = "https://github.com/inducer/pudb/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ ];
   };
diff --git a/pkgs/development/python-modules/pulumi-aws/default.nix b/pkgs/development/python-modules/pulumi-aws/default.nix
index 8627c4f3d519e..b397d4cf59f12 100644
--- a/pkgs/development/python-modules/pulumi-aws/default.nix
+++ b/pkgs/development/python-modules/pulumi-aws/default.nix
@@ -12,7 +12,7 @@
 buildPythonPackage rec {
   pname = "pulumi-aws";
   # Version is independant of pulumi's.
-  version = "5.19.0";
+  version = "5.21.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "pulumi";
     repo = "pulumi-aws";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ZpbWqhTScWOlcVsX4OYlA5dYQg0UsfOhMLllXjEDdUI=";
+    hash = "sha256-b/X+UHJnGCzE3AR+spXJWv/NVq5BVvNlzEyHpqDhquY=";
   };
 
   sourceRoot = "${src.name}/sdk/python";
@@ -42,6 +42,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Pulumi python amazon web services provider";
     homepage = "https://github.com/pulumi/pulumi-aws";
+    changelog = "https://github.com/pulumi/pulumi-aws/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ costrouc ];
   };
diff --git a/pkgs/development/python-modules/pydal/default.nix b/pkgs/development/python-modules/pydal/default.nix
index a3bd6ee91469f..0420c3fd4f877 100644
--- a/pkgs/development/python-modules/pydal/default.nix
+++ b/pkgs/development/python-modules/pydal/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "pydal";
-  version = "20220916.1";
+  version = "20221110.1";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-GKnJ1aRLuJp+wQVjzL51o/KteGD5k4X221bDzpIiEEQ=";
+    sha256 = "sha256-fD6JHHD42JGONidvIQoZWbt7rfOydvRxkZhv/PW2o5A=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pyezviz/default.nix b/pkgs/development/python-modules/pyezviz/default.nix
index 35f8eb4bfa443..4ae751b92dd86 100644
--- a/pkgs/development/python-modules/pyezviz/default.nix
+++ b/pkgs/development/python-modules/pyezviz/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pyezviz";
-  version = "0.2.0.9";
+  version = "0.2.0.10";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -19,8 +19,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "baqs";
     repo = "pyEzviz";
-    rev = version;
-    sha256 = "sha256-HdtyERk2Af+O7/ei7S1+JO6zQxNXrSX95k9707SQuwE=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-oi2F+OYxiQXq8JlIqbQyjpUuRciMwIaBCh27lvM7TuM=";
   };
 
   propagatedBuildInputs = [
@@ -41,6 +41,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python interface for for Ezviz cameras";
     homepage = "https://github.com/baqs/pyEzviz/";
+    changelog = "https://github.com/BaQs/pyEzviz/releases/tag/${version}";
     license = with licenses; [ asl20 ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/pymupdf/default.nix b/pkgs/development/python-modules/pymupdf/default.nix
index daf2197f83373..8095ee1b7c0c9 100644
--- a/pkgs/development/python-modules/pymupdf/default.nix
+++ b/pkgs/development/python-modules/pymupdf/default.nix
@@ -9,34 +9,52 @@
 , jbig2dec
 , libjpeg_turbo
 , gumbo
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "pymupdf";
-  version = "1.20.2";
+  version = "1.21.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "PyMuPDF";
     inherit version;
-    sha256 = "sha256-Au7fAfV8a6+16GZ86gCIotJSJkPEcQDxkIvsOmioSIg=";
+    hash = "sha256-pj38KJ4SeharYDEO5gBf6DEhx6l/fBINtoj5KByeXQ8=";
   };
 
   postPatch = ''
     substituteInPlace setup.py \
         --replace '/usr/include/mupdf' ${mupdf.dev}/include/mupdf
   '';
-  nativeBuildInputs = [ swig ];
-  buildInputs = [ mupdf freetype harfbuzz openjpeg jbig2dec libjpeg_turbo gumbo ];
+  nativeBuildInputs = [
+    swig
+  ];
+
+  buildInputs = [
+    mupdf
+    freetype
+    harfbuzz
+    openjpeg
+    jbig2dec
+    libjpeg_turbo
+    gumbo
+  ];
 
   doCheck = false;
 
-  pythonImportsCheck = [ "fitz" ];
+  pythonImportsCheck = [
+    "fitz"
+  ];
 
   meta = with lib; {
-    description = "Python bindings for MuPDF's rendering library.";
+    description = "Python bindings for MuPDF's rendering library";
     homepage = "https://github.com/pymupdf/PyMuPDF";
-    maintainers = with maintainers; [ teto ];
+    changelog = "https://github.com/pymupdf/PyMuPDF/releases/tag/${version}";
     license = licenses.agpl3Only;
+    maintainers = with maintainers; [ teto ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/development/python-modules/pynamodb/default.nix b/pkgs/development/python-modules/pynamodb/default.nix
index 4844ebee99903..9348a4f8f373d 100644
--- a/pkgs/development/python-modules/pynamodb/default.nix
+++ b/pkgs/development/python-modules/pynamodb/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "pynamodb";
-  version = "5.2.3";
+  version = "5.3.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "pynamodb";
     repo = "PynamoDB";
     rev = "refs/tags/${version}";
-    sha256 = "sha256-3Si0BCMofr38OuXoX8Tj9n3ITv3rH5hNfDQZvZWk79o=";
+    hash = "sha256-j21CCPTRj7c7vClujHYEkmH31B48gDFYQbBXoChNSaI=";
   };
 
   propagatedBuildInputs = [
@@ -66,6 +66,7 @@ buildPythonPackage rec {
       verbose. PynamoDB presents you with a simple, elegant API.
     '';
     homepage = "http://jlafon.io/pynamodb.html";
+    changelog = "https://github.com/pynamodb/PynamoDB/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ ];
   };
diff --git a/pkgs/development/python-modules/zdaemon/default.nix b/pkgs/development/python-modules/zdaemon/default.nix
index 23eae31057fc1..8695c2c6927e9 100644
--- a/pkgs/development/python-modules/zdaemon/default.nix
+++ b/pkgs/development/python-modules/zdaemon/default.nix
@@ -1,28 +1,38 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, pythonOlder
 , zconfig
 }:
 
 buildPythonPackage rec {
   pname = "zdaemon";
-  version = "4.3";
+  version = "4.4";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f249fc6885646d165d7d6b228a7b71f5170fc7117de9e0688271f8fb97840f72";
+    hash = "sha256-SCHjvbRzh88eklWwREusQ3z3KqC1nRQHuTLjH9QyPvw=";
   };
 
-  propagatedBuildInputs = [ zconfig ];
+  propagatedBuildInputs = [
+    zconfig
+  ];
 
   # too many deps..
   doCheck = false;
 
+  pythonImportsCheck = [
+    "zdaemon"
+  ];
+
   meta = with lib; {
     description = "A daemon process control library and tools for Unix-based systems";
     homepage = "https://pypi.python.org/pypi/zdaemon";
+    changelog = "https://github.com/zopefoundation/zdaemon/blob/${version}/CHANGES.rst";
     license = licenses.zpl20;
     maintainers = with maintainers; [ goibhniu ];
   };
-
 }
diff --git a/pkgs/development/python-modules/zodb/default.nix b/pkgs/development/python-modules/zodb/default.nix
index 7c788f7a9f8f8..f1f960ada724b 100644
--- a/pkgs/development/python-modules/zodb/default.nix
+++ b/pkgs/development/python-modules/zodb/default.nix
@@ -16,11 +16,11 @@
 
 buildPythonPackage rec {
   pname = "ZODB";
-  version = "5.7.0";
+  version = "5.8.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-+kC7wF7NoewkNc0MbdAqE7dphGBVikYENm9qCmhAHNM=";
+    sha256 = "sha256-KNugDvYm3hBYnt7auFrQ8O33KSXnXTahXJnGOsBf52Q=";
   };
 
   # remove broken test
@@ -50,7 +50,8 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Zope Object Database: object database and persistence";
-    homepage = "https://pypi.python.org/pypi/ZODB";
+    homepage = "https://zodb-docs.readthedocs.io/";
+    changelog = "https://github.com/zopefoundation/ZODB/blob/${version}/CHANGES.rst";
     license = licenses.zpl21;
     maintainers = with maintainers; [ goibhniu ];
   };
diff --git a/pkgs/development/r-modules/default.nix b/pkgs/development/r-modules/default.nix
index a361dacc9f0c2..f5bed2e3f5b2c 100644
--- a/pkgs/development/r-modules/default.nix
+++ b/pkgs/development/r-modules/default.nix
@@ -518,7 +518,7 @@ let
     RcppEigen = [ pkgs.libiconv ];
     RCurl = [ pkgs.curl.dev ];
     R2SWF = [ pkgs.pkg-config ];
-    rgl = with pkgs; [ libGLU libGLU.dev libGL xlibsWrapper ];
+    rgl = with pkgs; [ libGLU libGLU.dev libGL xorg.libX11.dev freetype.dev libpng.dev ];
     RGtk2 = [ pkgs.pkg-config ];
     RProtoBuf = [ pkgs.pkg-config ];
     Rpoppler = [ pkgs.pkg-config ];
diff --git a/pkgs/development/tools/esbuild/default.nix b/pkgs/development/tools/esbuild/default.nix
index d5cc59b41030f..df4729eeb8166 100644
--- a/pkgs/development/tools/esbuild/default.nix
+++ b/pkgs/development/tools/esbuild/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "esbuild";
-  version = "0.15.16";
+  version = "0.15.18";
 
   src = fetchFromGitHub {
     owner = "evanw";
     repo = "esbuild";
     rev = "v${version}";
-    sha256 = "sha256-m23K1BH1Cw452GN14G9rmFi0a+sGnPwIdSyWXqTqiKw=";
+    sha256 = "sha256-b9R1ML+pgRg9j2yrkQmBulPuLHYLUQvW+WTyR/Cq6zE=";
   };
 
   vendorSha256 = "sha256-+BfxCyg0KkDQpHt/wycy/8CTG6YBA/VJvJFhhzUnSiQ=";
@@ -20,6 +20,7 @@ buildGoModule rec {
   meta = with lib; {
     description = "An extremely fast JavaScript bundler";
     homepage = "https://esbuild.github.io";
+    changelog = "https://github.com/evanw/esbuild/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ lucus16 marsam ];
   };
diff --git a/pkgs/development/tools/nap/default.nix b/pkgs/development/tools/nap/default.nix
new file mode 100644
index 0000000000000..3d925b33801cf
--- /dev/null
+++ b/pkgs/development/tools/nap/default.nix
@@ -0,0 +1,24 @@
+{ lib, buildGoModule, fetchFromGitHub, callPackage }:
+
+buildGoModule rec {
+  pname = "nap";
+  version = "0.1.1";
+
+  src = fetchFromGitHub {
+    owner = "maaslalani";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0b3sz8zp1nwcjl02b3lli5yjc7vfay1ig6fs8bgxwz22imfx076p";
+  };
+
+  vendorSha256 = "sha256-puCqql77kvdWTcwp8z6LExBt/HbNRNe0f+wtM0kLoWM=";
+
+  excludedPackages = ".nap";
+
+  meta = {
+    description = "Code snippets in your terminal 🛌";
+    homepage = "https://github.com/maaslalani/nap";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ phdcybersec maaslalani ];
+  };
+}
diff --git a/pkgs/development/tools/protoc-gen-connect-go/default.nix b/pkgs/development/tools/protoc-gen-connect-go/default.nix
index 6aa0425811d29..c29c8b0560200 100644
--- a/pkgs/development/tools/protoc-gen-connect-go/default.nix
+++ b/pkgs/development/tools/protoc-gen-connect-go/default.nix
@@ -1,23 +1,29 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
 
 buildGoModule rec {
   pname = "protoc-gen-connect-go";
-  version = "1.2.0";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "bufbuild";
     repo = "connect-go";
-    rev = "v${version}";
-    sha256 = "sha256-h1zZ4xYGS/zemb/vPvDGHRiIm4bCLeghhqHft2ll+oY=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-PRJqH+uBcF9SP6ZFcZfLfqJe4LSAbhFrcdBFRhiVTGM=";
   };
 
-  vendorSha256 = "sha256-Bh2JCWTaML/QU/sLBsxLKMzzH++K22BTGusfcVW2GBw=";
+  vendorHash = "sha256-Bh2JCWTaML/QU/sLBsxLKMzzH++K22BTGusfcVW2GBw=";
 
-  subPackages = [ "cmd/protoc-gen-connect-go" ];
+  subPackages = [
+    "cmd/protoc-gen-connect-go"
+  ];
 
   meta = with lib; {
-    description = "Simple, reliable, interoperable. A better gRPC.";
+    description = "library for building browser and gRPC-compatible HTTP APIs";
     homepage = "https://github.com/bufbuild/connect-go";
+    changelog = "https://github.com/bufbuild/connect-go/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ kilimnik ];
   };
diff --git a/pkgs/development/tools/sentry-cli/default.nix b/pkgs/development/tools/sentry-cli/default.nix
index 7fcb9fc6f2fe5..1d0ff729663e4 100644
--- a/pkgs/development/tools/sentry-cli/default.nix
+++ b/pkgs/development/tools/sentry-cli/default.nix
@@ -9,13 +9,13 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "sentry-cli";
-  version = "2.9.0";
+  version = "2.10.0";
 
   src = fetchFromGitHub {
     owner = "getsentry";
     repo = "sentry-cli";
     rev = version;
-    sha256 = "sha256-PhcCYdc865682UZMSjwj0WWh+6pJeEaYyjX+v1XZqVk=";
+    sha256 = "sha256-1KFKLvF/oFeU05BxShAoHkP24QBT88MHhjbcSXFario=";
   };
   doCheck = false;
 
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ Security SystemConfiguration ];
   nativeBuildInputs = [ pkg-config ];
 
-  cargoSha256 = "sha256-WQYiYxbSr4fOlaI5LaBllk21I7U9sL2Xq7hMBIGCL7M=";
+  cargoSha256 = "sha256-IEcQKAgZfZ3L5+1Kdbsnms6qHXGXLwxSklu1y4kk+0w=";
 
   meta = with lib; {
     homepage = "https://docs.sentry.io/cli/";
diff --git a/pkgs/development/tools/skaffold/default.nix b/pkgs/development/tools/skaffold/default.nix
index 73763ce654d44..c4c8fc0c4bdcf 100644
--- a/pkgs/development/tools/skaffold/default.nix
+++ b/pkgs/development/tools/skaffold/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "skaffold";
-  version = "2.0.2";
+  version = "2.0.3";
 
   src = fetchFromGitHub {
     owner = "GoogleContainerTools";
     repo = "skaffold";
     rev = "v${version}";
-    sha256 = "sha256-ldyGKey/s6FJLmxV25Q+blNjOOsASGqUsnqiXJme3+g=";
+    sha256 = "sha256-wt1BEa8ir8i4VWW03opfy7cSNqCPzQoHgtJz+i8iaLw=";
   };
 
-  vendorSha256 = "sha256-yy1BVorjLEcZR6PqupBiZx2plwPJ6xlxripbyB6RLek=";
+  vendorSha256 = "sha256-2i7NKf/VJduBec4rEBJqFt1cb6ODqOviSY+flGekN4w=";
 
   subPackages = ["cmd/skaffold"];
 
diff --git a/pkgs/shells/fish/plugins/autopair.nix b/pkgs/shells/fish/plugins/autopair.nix
new file mode 100644
index 0000000000000..d1036829bfdb8
--- /dev/null
+++ b/pkgs/shells/fish/plugins/autopair.nix
@@ -0,0 +1,20 @@
+{ lib, buildFishPlugin, fetchFromGitHub }:
+
+buildFishPlugin rec {
+  pname = "autopair";
+  version = "1.0.3";
+
+  src = fetchFromGitHub {
+    owner = "jorgebucaran";
+    repo = "autopair.fish";
+    rev = version;
+    sha256 = "sha256-l6WJ2kjDO/TnU9FSigjxk5xFp90xl68gDfggkE/wrlM=";
+  };
+
+  meta = with lib; {
+    description = "Auto-complete matching pairs in the Fish command line";
+    homepage = "https://github.com/jorgebucaran/autopair.fish";
+    license = licenses.mit;
+    maintainers = with maintainers; [ kidonng ];
+  };
+}
diff --git a/pkgs/shells/fish/plugins/default.nix b/pkgs/shells/fish/plugins/default.nix
index 1c67ff8f4b3bd..5b085a091e01f 100644
--- a/pkgs/shells/fish/plugins/default.nix
+++ b/pkgs/shells/fish/plugins/default.nix
@@ -1,6 +1,7 @@
 { lib, newScope }:
 
 lib.makeScope newScope (self: with self; {
+  autopair = callPackage ./autopair.nix { };
 
   autopair-fish = callPackage ./autopair-fish.nix { };
 
diff --git a/pkgs/tools/graphics/resvg/default.nix b/pkgs/tools/graphics/resvg/default.nix
index b9085a4dda1c3..f48fcd4a451fe 100644
--- a/pkgs/tools/graphics/resvg/default.nix
+++ b/pkgs/tools/graphics/resvg/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "resvg";
-  version = "0.27.0";
+  version = "0.28.0";
 
   src = fetchFromGitHub {
     owner = "RazrFalcon";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-rl3bGXCwVmJdBPANWYJEIuGlKUQTqWy8tutyx0zzG+U=";
+    sha256 = "sha256-OEknK4uLINui6U+mz0P9K36pEzfx+TevGvLqM0RXkSM=";
   };
 
-  cargoSha256 = "sha256-iluhNT4qsg5flLRdH88xuUSt22+e5cgkTYXVXNI1L3I=";
+  cargoSha256 = "sha256-L3Km+VIoIun1wjKyJ3dscK5PSfQVR7qyjU6y1j9quSg=";
 
   meta = with lib; {
     description = "An SVG rendering library";
diff --git a/pkgs/tools/graphics/zbar/default.nix b/pkgs/tools/graphics/zbar/default.nix
index d3c4003741e3e..4e850e4fe6c70 100644
--- a/pkgs/tools/graphics/zbar/default.nix
+++ b/pkgs/tools/graphics/zbar/default.nix
@@ -3,6 +3,7 @@
 , fetchFromGitHub
 , imagemagickBig
 , pkg-config
+, withXorg ? true
 , libX11
 , libv4l
 , qtbase
@@ -41,16 +42,18 @@ stdenv.mkDerivation rec {
     xmlto
     autoreconfHook
     docbook_xsl
-    wrapQtAppsHook
+  ] ++ lib.optionals enableVideo [
     wrapGAppsHook
+    wrapQtAppsHook
   ];
 
   buildInputs = [
     imagemagickBig
-    libX11
     libintl
   ] ++ lib.optionals enableDbus [
     dbus
+  ] ++ lib.optionals withXorg [
+    libX11
   ] ++ lib.optionals enableVideo [
     libv4l
     gtk3
diff --git a/pkgs/tools/misc/online-judge-template-generator/default.nix b/pkgs/tools/misc/online-judge-template-generator/default.nix
new file mode 100644
index 0000000000000..cf1ab7b707884
--- /dev/null
+++ b/pkgs/tools/misc/online-judge-template-generator/default.nix
@@ -0,0 +1,51 @@
+{ lib
+, buildPythonApplication
+, appdirs
+, beautifulsoup4
+, colorlog
+, fetchFromGitHub
+, Mako
+, online-judge-api-client
+, online-judge-tools
+, ply
+, pyyaml
+, requests
+, setuptools
+, toml
+}:
+
+buildPythonApplication rec {
+  pname = "online-judge-template-generator";
+  version = "4.8.1";
+
+  src = fetchFromGitHub {
+    owner = "online-judge-tools";
+    repo = "template-generator";
+    rev = "v${version}";
+    sha256 = "sha256-cS1ED1a92fEFqy6ht8UFjxocWIm35IA/VuaPSLsdlqg=";
+  };
+
+  propagatedBuildInputs = [
+    appdirs
+    beautifulsoup4
+    colorlog
+    Mako
+    online-judge-api-client
+    online-judge-tools
+    ply
+    pyyaml
+    requests
+    setuptools
+    toml
+  ];
+
+  # Needs internet to run tests
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Analyze problems of competitive programming and automatically generate boilerplate";
+    homepage = "https://github.com/online-judge-tools/template-generator";
+    license = licenses.mit;
+    maintainers = with maintainers; [ sei40kr ];
+  };
+}
diff --git a/pkgs/tools/networking/rathole/default.nix b/pkgs/tools/networking/rathole/default.nix
index 206849bd41f7d..bed5f81b55dfb 100644
--- a/pkgs/tools/networking/rathole/default.nix
+++ b/pkgs/tools/networking/rathole/default.nix
@@ -6,28 +6,36 @@
 , openssl
 , CoreServices
 }:
+
 rustPlatform.buildRustPackage rec {
   pname = "rathole";
-  version = "0.4.5";
+  version = "0.4.7";
 
   src = fetchFromGitHub {
     owner = "rapiz1";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-mebrhBmRPN+AydxKhe2g7ehe9r9rDqt5dXO8rRUIlJg=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-YauQg+P4Y8oO8Kn6FB3NxBI7PHoo/bjS38bM1lFeCH0=";
   };
 
-  cargoSha256 = "sha256-uECM5j/xgrzPvrarDl6wxaD3Cn3Ut3aMM9OBvsc7ZqE=";
+  cargoHash = "sha256-OcPmHqjW79SKMET6J5HIwmR5vESh+PJcQjSMsqmnIb8=";
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    pkg-config
+  ];
 
-  buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ CoreServices ];
+  buildInputs = [
+    openssl
+  ] ++ lib.optionals stdenv.isDarwin [
+    CoreServices
+  ];
 
   __darwinAllowLocalNetworking = true;
 
   meta = with lib; {
-    description = "A lightweight and high-performance reverse proxy for NAT traversal, written in Rust";
+    description = "Reverse proxy for NAT traversal";
     homepage = "https://github.com/rapiz1/rathole";
+    changelog = "https://github.com/rapiz1/rathole/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ dit7ya ];
   };
diff --git a/pkgs/tools/package-management/micromamba/default.nix b/pkgs/tools/package-management/micromamba/default.nix
index 305e996e0d713..1df83b44ca62d 100644
--- a/pkgs/tools/package-management/micromamba/default.nix
+++ b/pkgs/tools/package-management/micromamba/default.nix
@@ -44,13 +44,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "micromamba";
-  version = "0.25.0";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "mamba-org";
     repo = "mamba";
     rev = "micromamba-" + version;
-    sha256 = "sha256-aTScTM1jX1WIrAVkAvp37fMa+05teLJnVdyIwtYq7mY=";
+    sha256 = "sha256-t1DfLwBGW6MfazuFludn6/fdYWFaMnkhXva6bvus694=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/tools/security/tcb/default.nix b/pkgs/tools/security/tcb/default.nix
new file mode 100644
index 0000000000000..63b252be95214
--- /dev/null
+++ b/pkgs/tools/security/tcb/default.nix
@@ -0,0 +1,51 @@
+{ lib, stdenv, fetchFromGitHub, pkg-config
+, linux-pam, libxcrypt
+}:
+
+stdenv.mkDerivation rec {
+  pname = "tcb";
+  version = "1.2";
+
+  src = fetchFromGitHub {
+    owner = "openwall";
+    repo = pname;
+    rev = "070cf4aa784de13c52788ac22ff611d7cbca0854";
+    sha256 = "sha256-Sp5u7iTEZZnAqKQXoPO8eWpSkZeBzQqZI82wRQmgU9A=";
+  };
+
+  outputs = [ "out" "bin" "dev" "man" ];
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ linux-pam libxcrypt ];
+
+  patches = [ ./fix-makefiles.patch ];
+
+  postPatch = ''
+    substituteInPlace Make.defs \
+      --replace "PREFIX = /usr" "PREFIX = $out" \
+      --replace "SBINDIR = /sbin" "SBINDIR = $bin/bin" \
+      --replace "INCLUDEDIR = \$(PREFIX)/include" "INCLUDEDIR = $dev/include"
+  '';
+
+  meta = with lib; {
+    description = "Alternative password shadowing scheme";
+    longDescription = ''
+      The tcb package contains core components of our tcb suite implementing the alternative
+      password shadowing scheme on Openwall GNU Linux (Owl). It is being made available
+      separately from Owl primarily for use by other distributions.
+
+      The package consists of three components: pam_tcb, libnss_tcb, and libtcb.
+
+      pam_tcb is a PAM module which supersedes pam_unix. It also implements the tcb password
+      shadowing scheme. The tcb scheme allows many core system utilities (passwd(1) being
+      the primary example) to operate with little privilege. libnss_tcb is the accompanying
+      NSS module. libtcb contains code shared by the PAM and NSS modules and is also used
+      by user management tools on Owl due to our shadow suite patches.
+    '';
+    homepage = "https://www.openwall.com/tcb/";
+    license = licenses.bsd3;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ izorkin ];
+  };
+}
diff --git a/pkgs/tools/security/tcb/fix-makefiles.patch b/pkgs/tools/security/tcb/fix-makefiles.patch
new file mode 100644
index 0000000000000..9ea82605d5572
--- /dev/null
+++ b/pkgs/tools/security/tcb/fix-makefiles.patch
@@ -0,0 +1,52 @@
+diff --git a/Make.defs b/Make.defs
+index a961f7d..9e8d59b 100644
+--- a/Make.defs
++++ b/Make.defs
+@@ -19,7 +19,7 @@ LDFLAGS += $(DBGFLAG) -L../libs
+
+ PREFIX = /usr
+ SBINDIR = /sbin
+-SLIBDIR = /lib
++SLIBDIR = $(PREFIX)/lib
+ INCLUDEDIR = $(PREFIX)/include
+ LIBDIR = $(PREFIX)/lib
+ LIBEXECDIR = $(PREFIX)/libexec
+diff --git a/libs/Makefile b/libs/Makefile
+index 0083b13..27238f6 100644
+--- a/libs/Makefile
++++ b/libs/Makefile
+@@ -7,7 +7,7 @@ LIBTCB_A = libtcb.a
+ LIB_MAP = libtcb.map
+ NSS_MAP = libnss_tcb.map
+ 
+-all: $(LIBTCB_LONG) $(LIBNSS) $(LIBTCB_A)
++all: $(LIBTCB_LONG) $(LIBNSS)
+ 
+ $(LIBTCB_A): libtcb_a.o
+ 	ar -cr $@ $<
+@@ -36,9 +36,8 @@ install:
+ 	$(MKDIR) -p -m 755 $(DESTDIR)$(LIBDIR)
+ 	$(INSTALL) -m $(SHLIBMODE) $(LIBTCB_LONG) $(DESTDIR)$(SLIBDIR)/
+ 	ln -sf $(LIBTCB_LONG) $(DESTDIR)$(SLIBDIR)/$(LIBTCB)
+-	ln -sf ../..$(SLIBDIR)/$(LIBTCB) $(DESTDIR)$(LIBDIR)/libtcb.so
++	ln -sf $(LIBTCB) $(DESTDIR)$(LIBDIR)/libtcb.so
+ 	$(INSTALL) -m $(SHLIBMODE) $(LIBNSS) $(DESTDIR)$(SLIBDIR)/
+-	$(INSTALL) -m 644 $(LIBTCB_A) $(DESTDIR)$(LIBDIR)/
+ 
+ clean:
+ 	rm -f *.o *~ $(LIBTCB)* libtcb.so $(LIBNSS) *.a
+diff --git a/progs/Makefile b/progs/Makefile
+index c3a6879..e24f74b 100644
+--- a/progs/Makefile
++++ b/progs/Makefile
+@@ -23,8 +23,8 @@ install-non-root: install-common
+ 	$(INSTALL) -m 700 $(CHKPWD) $(DESTDIR)$(LIBEXECDIR)/chkpwd/
+ 
+ install: install-common
+-	$(INSTALL) -d -o root -g chkpwd -m 710 $(DESTDIR)$(LIBEXECDIR)/chkpwd
+-	$(INSTALL) -m 2711 -o root -g shadow $(CHKPWD) \
++	$(INSTALL) -d $(DESTDIR)$(LIBEXECDIR)/chkpwd
++	$(INSTALL) $(CHKPWD) \
+ 		$(DESTDIR)$(LIBEXECDIR)/chkpwd/
+ 
+ install-common:
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 878b25bef4208..6637b49e65e38 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5117,6 +5117,8 @@ with pkgs;
 
   orjail = callPackage ../tools/security/orjail { };
 
+  online-judge-template-generator = python3Packages.callPackage ../tools/misc/online-judge-template-generator { };
+
   online-judge-tools = with python3.pkgs; toPythonApplication online-judge-tools;
 
   onnxruntime = callPackage ../development/libraries/onnxruntime {
@@ -12057,6 +12059,8 @@ with pkgs;
 
   tayga = callPackage ../tools/networking/tayga { };
 
+  tcb = callPackage ../tools/security/tcb { };
+
   tcpcrypt = callPackage ../tools/security/tcpcrypt { };
 
   tcptraceroute = callPackage ../tools/networking/tcptraceroute { };
@@ -14692,6 +14696,8 @@ with pkgs;
     jdk = jdk8; # TODO: remove override https://github.com/NixOS/nixpkgs/pull/89731
   };
 
+  jna = callPackage ../development/java-modules/jna { };
+
   javacard-devkit = pkgsi686Linux.callPackage ../development/compilers/javacard-devkit { };
 
   juniper = callPackage ../development/compilers/juniper { };
@@ -17624,6 +17630,8 @@ with pkgs;
 
   nailgun = callPackage ../development/tools/nailgun { };
 
+  nap = callPackage ../development/tools/nap { };
+
   nil = callPackage ../development/tools/nil { };
 
   ninja = callPackage ../development/tools/build-managers/ninja { };