Merge master into staging-next

57 files changed, 460 insertions, 160 deletions

diff --git a/doc/languages-frameworks/haskell.section.md b/doc/languages-frameworks/haskell.section.md
index f0b302bbc356f..f21ba295dc8d6 100644
--- a/doc/languages-frameworks/haskell.section.md
+++ b/doc/languages-frameworks/haskell.section.md
@@ -195,7 +195,7 @@ maintenance work for `haskellPackages` is required. Besides that, it is not
 possible to get the dependencies of a legacy project from nixpkgs or to use a
 specific stack solver for compiling a project.
 
-Even though we couldn‘t use them directly in nixpkgs, it would be desirable
+Even though we couldn’t use them directly in nixpkgs, it would be desirable
 to have tooling to generate working Nix package sets from build plans generated
 by `cabal-install` or a specific Stackage snapshot via import-from-derivation.
 Sadly we currently don’t have tooling for this. For this you might be
@@ -538,7 +538,7 @@ via [`shellFor`](#haskell-shellFor).
 When using `cabal-install` for dependency resolution you need to be a bit
 careful to achieve build purity. `cabal-install` will find and use all
 dependencies installed from the packages `env` via Nix, but it will also
-consult Hackage to potentially download and compile dependencies if it can‘t
+consult Hackage to potentially download and compile dependencies if it can’t
 find a valid build plan locally. To prevent this you can either never run
 `cabal update`, remove the cabal database from your `~/.cabal` folder or run
 `cabal` with `--offline`. Note though, that for some usecases `cabal2nix` needs
diff --git a/doc/languages-frameworks/index.xml b/doc/languages-frameworks/index.xml
index 3774924c0be4a..f089b99a0451b 100644
--- a/doc/languages-frameworks/index.xml
+++ b/doc/languages-frameworks/index.xml
@@ -38,6 +38,7 @@
  <xi:include href="r.section.xml" />
  <xi:include href="ruby.section.xml" />
  <xi:include href="rust.section.xml" />
+ <xi:include href="swift.section.xml" />
  <xi:include href="texlive.section.xml" />
  <xi:include href="titanium.section.xml" />
  <xi:include href="vim.section.xml" />
diff --git a/doc/languages-frameworks/pkg-config.section.md b/doc/languages-frameworks/pkg-config.section.md
index ee0a471be3e57..eecc84b4c1aae 100644
--- a/doc/languages-frameworks/pkg-config.section.md
+++ b/doc/languages-frameworks/pkg-config.section.md
@@ -4,6 +4,48 @@
 
 Nixpkgs provides a couple of facilities for working with this tool.
 
- - A [setup hook](#setup-hook-pkg-config) bundled with in the `pkg-config` package, to bring a derivation's declared build inputs into the environment.
- - The [`validatePkgConfig` setup hook](https://nixos.org/manual/nixpkgs/stable/#validatepkgconfig), for packages that provide pkg-config modules.
- - The `defaultPkgConfigPackages` package set: a set of aliases, named after the modules they provide. This is meant to be used by language-to-nix integrations. Hand-written packages should use the normal Nixpkgs attribute name instead.
+## Writing packages providing pkg-config modules
+
+Packages should set `meta.pkgConfigProvides` with the list of package config modules they provide.
+They should also use `testers.testMetaPkgConfig` to check that the final built package matches that list.
+Additionally, the [`validatePkgConfig` setup hook](https://nixos.org/manual/nixpkgs/stable/#validatepkgconfig), will do extra checks on to-be-installed pkg-config modules.
+
+A good example of all these things is zlib:
+
+```
+{ pkg-config, testers, ... }:
+
+stdenv.mkDerivation (finalAttrs: {
+  ...
+
+  nativeBuildInputs = [ pkg-config validatePkgConfig ];
+
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
+  meta = {
+    ...
+    pkgConfigModules = [ "zlib" ];
+  };
+})
+```
+
+## Accessing packages via pkg-config module name
+
+### Within Nixpkgs
+
+A [setup hook](#setup-hook-pkg-config) is bundled in the `pkg-config` package to bring a derivation's declared build inputs into the environment.
+This will populate environment variables like `PKG_CONFIG_PATH`, `PKG_CONFIG_PATH_FOR_BUILD`, and `PKG_CONFIG_PATH_HOST` based on:
+
+ - how `pkg-config` itself is depended upon
+
+ - how other dependencies are depended upon
+
+For more details see the section on [specifying dependencies in general](#ssec-stdenv-dependencies).
+
+Normal pkg-config commands to look up dependencies by name will then work with those environment variables defined by the hook.
+
+### Externally
+
+The `defaultPkgConfigPackages` package set is a set of aliases, named after the modules they provide.
+This is meant to be used by language-to-nix integrations.
+Hand-written packages should use the normal Nixpkgs attribute name instead.
diff --git a/doc/languages-frameworks/swift.section.md b/doc/languages-frameworks/swift.section.md
new file mode 100644
index 0000000000000..1cc452cc9b9bf
--- /dev/null
+++ b/doc/languages-frameworks/swift.section.md
@@ -0,0 +1,176 @@
+# Swift {#swift}
+
+The Swift compiler is provided by the `swift` package:
+
+```sh
+# Compile and link a simple executable.
+nix-shell -p swift --run 'swiftc -' <<< 'print("Hello world!")'
+# Run it!
+./main
+```
+
+The `swift` package also provides the `swift` command, with some caveats:
+
+- Swift Package Manager (SwiftPM) is packaged separately as `swiftpm`. If you
+  need functionality like `swift build`, `swift run`, `swift test`, you must
+  also add the `swiftpm` package to your closure.
+- On Darwin, the `swift repl` command requires an Xcode installation. This is
+  because it uses the system LLDB debugserver, which has special entitlements.
+
+## Module search paths {#ssec-swift-module-search-paths}
+
+Like other toolchains in Nixpkgs, the Swift compiler executables are wrapped
+to help Swift find your application's dependencies in the Nix store. These
+wrappers scan the `buildInputs` of your package derivation for specific
+directories where Swift modules are placed by convention, and automatically
+add those directories to the Swift compiler search paths.
+
+Swift follows different conventions depending on the platform. The wrappers
+look for the following directories:
+
+- On Darwin platforms: `lib/swift/macosx`
+  (If not targeting macOS, replace `macosx` with the Xcode platform name.)
+- On other platforms: `lib/swift/linux/x86_64`
+  (Where `linux` and `x86_64` are from lowercase `uname -sm`.)
+- For convenience, Nixpkgs also adds simply `lib/swift` to the search path.
+  This can save a bit of work packaging Swift modules, because many Nix builds
+  will produce output for just one target any way.
+
+## Core libraries {#ssec-swift-core-libraries}
+
+In addition to the standard library, the Swift toolchain contains some
+additional 'core libraries' that, on Apple platforms, are normally distributed
+as part of the OS or Xcode. These are packaged separately in Nixpkgs, and can
+be found (for use in `buildInputs`) as:
+
+- `swiftPackages.Dispatch`
+- `swiftPackages.Foundation`
+- `swiftPackages.XCTest`
+
+## Packaging with SwiftPM {#ssec-swift-packaging-with-swiftpm}
+
+Nixpkgs includes a small helper `swiftpm2nix` that can fetch your SwiftPM
+dependencies for you, when you need to write a Nix expression to package your
+application.
+
+The first step is to run the generator:
+
+```sh
+cd /path/to/my/project
+# Enter a Nix shell with the required tools.
+nix-shell -p swift swiftpm swiftpm2nix
+# First, make sure the workspace is up-to-date.
+swift package resolve
+# Now generate the Nix code.
+swiftpm2nix
+```
+
+This produces some files in a directory `nix`, which will be part of your Nix
+expression. The next step is to write that expression:
+
+```nix
+{ stdenv, swift, swiftpm, swiftpm2nix, fetchFromGitHub }:
+
+let
+  # Pass the generated files to the helper.
+  generated = swiftpm2nix.helpers ./nix;
+in
+
+stdenv.mkDerivation rec {
+  pname = "myproject";
+  version = "0.0.0";
+
+  src = fetchFromGitHub {
+    owner = "nixos";
+    repo = pname;
+    rev = version;
+    hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+  };
+
+  # Including SwiftPM as a nativeBuildInput provides a buildPhase for you.
+  # This by default performs a release build using SwiftPM, essentially:
+  #   swift build -c release
+  nativeBuildInputs = [ swift swiftpm ];
+
+  # The helper provides a configure snippet that will prepare all dependencies
+  # in the correct place, where SwiftPM expects them.
+  configurePhase = generated.configure;
+
+  installPhase = ''
+    # This is a special function that invokes swiftpm to find the location
+    # of the binaries it produced.
+    binPath="$(swiftpmBinPath)"
+    # Now perform any installation steps.
+    mkdir -p $out/bin
+    cp $binPath/myproject $out/bin/
+  '';
+}
+```
+
+### Custom build flags {#ssec-swiftpm-custom-build-flags}
+
+If you'd like to build a different configuration than `release`:
+
+```nix
+swiftpmBuildConfig = "debug";
+```
+
+It is also possible to provide additional flags to `swift build`:
+
+```nix
+swiftpmFlags = [ "--disable-dead-strip" ];
+```
+
+The default `buildPhase` already passes `-j` for parallel building.
+
+If these two customization options are insufficient, simply provide your own
+`buildPhase` that invokes `swift build`.
+
+### Running tests {#ssec-swiftpm-running-tests}
+
+Including `swiftpm` in your `nativeBuildInputs` also provides a default
+`checkPhase`, but it must be enabled with:
+
+```nix
+doCheck = true;
+```
+
+This essentially runs: `swift test -c release`
+
+### Patching dependencies {#ssec-swiftpm-patching-dependencies}
+
+In some cases, it may be necessary to patch a SwiftPM dependency. SwiftPM
+dependencies are located in `.build/checkouts`, but the `swiftpm2nix` helper
+provides these as symlinks to read-only `/nix/store` paths. In order to patch
+them, we need to make them writable.
+
+A special function `swiftpmMakeMutable` is available to replace the symlink
+with a writable copy:
+
+```
+configurePhase = generated.configure ++ ''
+  # Replace the dependency symlink with a writable copy.
+  swiftpmMakeMutable swift-crypto
+  # Now apply a patch.
+  patch -p1 -d .build/checkouts/swift-crypto -i ${./some-fix.patch}
+'';
+```
+
+## Considerations for custom build tools {#ssec-swift-considerations-for-custom-build-tools}
+
+### Linking the standard library {#ssec-swift-linking-the-standard-library}
+
+The `swift` package has a separate `lib` output containing just the Swift
+standard library, to prevent Swift applications needing a dependency on the
+full Swift compiler at run-time. Linking with the Nixpkgs Swift toolchain
+already ensures binaries correctly reference the `lib` output.
+
+Sometimes, Swift is used only to compile part of a mixed codebase, and the
+link step is manual. Custom build tools often locate the standard library
+relative to the `swift` compiler executable, and while the result will work,
+when this path ends up in the binary, it will have the Swift compiler as an
+unintended dependency.
+
+In this case, you should investigate how your build process discovers the
+standard library, and override the path. The correct path will be something
+like: `"${swift.swift.lib}/${swift.swiftModuleSubdir}"`
diff --git a/nixos/maintainers/scripts/lxd/lxd-image-inner.nix b/nixos/maintainers/scripts/lxd/lxd-image-inner.nix
index c8cf2a04fb10a..ee55da1e9ce2b 100644
--- a/nixos/maintainers/scripts/lxd/lxd-image-inner.nix
+++ b/nixos/maintainers/scripts/lxd/lxd-image-inner.nix
@@ -89,7 +89,7 @@ with lib;
 
   # This value determines the NixOS release from which the default
   # settings for stateful data, like file locations and database versions
-  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # on your system were taken. It’s perfectly fine and recommended to leave
   # this value at the release version of the first install of this system.
   # Before changing this value read the documentation for this option
   # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
diff --git a/nixos/modules/config/no-x-libs.nix b/nixos/modules/config/no-x-libs.nix
index 476a2d9f30766..e18003c0d486a 100644
--- a/nixos/modules/config/no-x-libs.nix
+++ b/nixos/modules/config/no-x-libs.nix
@@ -46,6 +46,7 @@ with lib;
       libextractor = super.libextractor.override { gtkSupport = false; };
       libva = super.libva-minimal;
       limesuite = super.limesuite.override { withGui = false; };
+      mc = super.mc.override { x11Support = false; };
       mpv-unwrapped = super.mpv-unwrapped.override { sdl2Support = false; x11Support = false; };
       msmtp = super.msmtp.override { withKeyring = false; };
       neofetch = super.neofetch.override { x11Support = false; };
diff --git a/nixos/modules/installer/tools/tools.nix b/nixos/modules/installer/tools/tools.nix
index caf97f66ef31e..d1b16d042d86a 100644
--- a/nixos/modules/installer/tools/tools.nix
+++ b/nixos/modules/installer/tools/tools.nix
@@ -217,7 +217,7 @@ in
 
         # This value determines the NixOS release from which the default
         # settings for stateful data, like file locations and database versions
-        # on your system were taken. It‘s perfectly fine and recommended to leave
+        # on your system were taken. It’s perfectly fine and recommended to leave
         # this value at the release version of the first install of this system.
         # Before changing this value read the documentation for this option
         # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
diff --git a/nixos/modules/misc/version.nix b/nixos/modules/misc/version.nix
index 30d11913c533b..447f8193855f1 100644
--- a/nixos/modules/misc/version.nix
+++ b/nixos/modules/misc/version.nix
@@ -130,7 +130,7 @@ in
         to be compatible. The effect is that NixOS will use
         defaults corresponding to the specified release (such as using
         an older version of PostgreSQL).
-        It‘s perfectly fine and recommended to leave this value at the
+        It’s perfectly fine and recommended to leave this value at the
         release version of the first install of this system.
         Changing this option will not upgrade your system. In fact it
         is meant to stay constant exactly when you upgrade your system.
diff --git a/pkgs/applications/audio/musikcube/default.nix b/pkgs/applications/audio/musikcube/default.nix
index 706a36b5327fa..35e86c28f6ceb 100644
--- a/pkgs/applications/audio/musikcube/default.nix
+++ b/pkgs/applications/audio/musikcube/default.nix
@@ -28,13 +28,13 @@
 
 stdenv.mkDerivation rec {
   pname = "musikcube";
-  version = "0.99.4";
+  version = "0.99.5";
 
   src = fetchFromGitHub {
     owner = "clangen";
     repo = pname;
     rev = version;
-    sha256 = "sha256-GAO3CKtlZF8Ol4K+40lD8n2RtewiHj3f59d5RIatNws=";
+    sha256 = "sha256-SbWL36GRIJPSvxZyj6sebJxTkSPsUcsKyC3TmcIq2O0";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/applications/file-managers/mc/default.nix b/pkgs/applications/file-managers/mc/default.nix
index 8b54d79622a42..d45e6a699aeba 100644
--- a/pkgs/applications/file-managers/mc/default.nix
+++ b/pkgs/applications/file-managers/mc/default.nix
@@ -6,7 +6,6 @@
 , gpm
 , file
 , e2fsprogs
-, libX11
 , libICE
 , perl
 , zip
@@ -17,6 +16,7 @@
 , openssl
 , coreutils
 , autoSignDarwinBinariesHook
+, x11Support ? true, libX11
 
 # updater only
 , writeScript
@@ -43,12 +43,12 @@ stdenv.mkDerivation rec {
     gettext
     glib
     libICE
-    libX11
     libssh2
     openssl
     slang
     zip
-  ] ++ lib.optionals (!stdenv.isDarwin) [ e2fsprogs gpm ];
+  ] ++ lib.optional x11Support [ libX11 ]
+    ++ lib.optionals (!stdenv.isDarwin) [ e2fsprogs gpm ];
 
   enableParallelBuilding = true;
 
@@ -66,12 +66,9 @@ stdenv.mkDerivation rec {
   postPatch = ''
     substituteInPlace src/filemanager/ext.c \
       --replace /bin/rm ${coreutils}/bin/rm
-
-    substituteInPlace misc/ext.d/misc.sh.in \
-      --replace /bin/cat ${coreutils}/bin/cat
   '';
 
-  postFixup = lib.optionalString (!stdenv.isDarwin) ''
+  postFixup = lib.optionalString ((!stdenv.isDarwin) && x11Support) ''
     # libX11.so is loaded dynamically so autopatch doesn't detect it
     patchelf \
       --add-needed ${libX11}/lib/libX11.so \
diff --git a/pkgs/applications/misc/auto-multiple-choice/default.nix b/pkgs/applications/misc/auto-multiple-choice/default.nix
index c34872de4cc59..900653633a4b0 100644
--- a/pkgs/applications/misc/auto-multiple-choice/default.nix
+++ b/pkgs/applications/misc/auto-multiple-choice/default.nix
@@ -42,7 +42,8 @@ stdenv.mkDerivation rec {
     # Relative paths.
     "BINDIR=/bin"
     "PERLDIR=/share/perl5"
-    "MODSDIR=/lib/"
+    "MODSDIR=/nonexistent" # AMC will test for that dir before
+    # defaulting to the "portable" strategy, so this test *must* fail.
     "TEXDIR=/tex/latex/" # what texlive.combine expects
     "TEXDOCDIR=/share/doc/texmf/" # TODO where to put this?
     "MAN1DIR=/share/man/man1"
diff --git a/pkgs/applications/misc/toot/default.nix b/pkgs/applications/misc/toot/default.nix
index 6f6151d1ea295..99b4b2aefb0ac 100644
--- a/pkgs/applications/misc/toot/default.nix
+++ b/pkgs/applications/misc/toot/default.nix
@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "toot";
-  version = "0.33.1";
+  version = "0.34.0";
 
   src = fetchFromGitHub {
     owner  = "ihabunek";
     repo   = "toot";
     rev = "refs/tags/${version}";
-    sha256 = "sha256-qZk42zGHWpeN5rZPFw7xAmDIvhPzqTePU3If+p/L98c=";
+    sha256 = "sha256-UQR3BaBcnD2o7QJEBQmdZdtVaTo9R5vSHiUxywy1OaY=";
   };
 
   nativeCheckInputs = with python3Packages; [ pytest ];
diff --git a/pkgs/applications/video/obs-studio/plugins/obs-vaapi/default.nix b/pkgs/applications/video/obs-studio/plugins/obs-vaapi/default.nix
index 7a8e193250907..499f07fccd7af 100644
--- a/pkgs/applications/video/obs-studio/plugins/obs-vaapi/default.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-vaapi/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "obs-vaapi";
-  version = "0.1.0";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "fzwoch";
     repo = pname;
     rev = version;
-    hash = "sha256-qA4xVVShkp40QHp2HmmRzVxQaBwskRpUNEULKetVMu8=";
+    hash = "sha256-wrbVuqIe+DY3R+Jp3zCy2Uw3fv5ejYHtRV2Sv+y/n0w=";
   };
 
   nativeBuildInputs = [ pkg-config meson ninja ];
@@ -39,6 +39,12 @@ stdenv.mkDerivation rec {
       gst-vaapi
     ];
 
+  # Fix output directory
+  postInstall = ''
+    mkdir $out/lib/obs-plugins
+    mv $out/lib/obs-vaapi.so $out/lib/obs-plugins/
+  '';
+
   meta = with lib; {
     description = "OBS Studio VAAPI support via GStreamer";
     homepage = "https://github.com/fzwoch/obs-vaapi";
diff --git a/pkgs/build-support/testers/default.nix b/pkgs/build-support/testers/default.nix
index 15694162edde3..542133dd959a3 100644
--- a/pkgs/build-support/testers/default.nix
+++ b/pkgs/build-support/testers/default.nix
@@ -123,4 +123,5 @@
 
   hasPkgConfigModule = callPackage ./hasPkgConfigModule/tester.nix { };
 
+  testMetaPkgConfig = callPackage ./testMetaPkgConfig/tester.nix { };
 }
diff --git a/pkgs/build-support/testers/testMetaPkgConfig/tester.nix b/pkgs/build-support/testers/testMetaPkgConfig/tester.nix
new file mode 100644
index 0000000000000..bee97ace1409c
--- /dev/null
+++ b/pkgs/build-support/testers/testMetaPkgConfig/tester.nix
@@ -0,0 +1,14 @@
+{ lib, runCommand, testers }:
+
+package:
+
+runCommand "check-meta-pkg-config-modules-for-${package.name}" {
+  meta = {
+    description = "Test whether ${package.name} exposes all pkg-config modules ${toString package.meta.pkgConfigModules}";
+  };
+  dependsOn = map
+    (moduleName: testers.hasPkgConfigModule { inherit package moduleName; })
+    package.meta.pkgConfigModules;
+} ''
+  echo "found all of ${toString package.meta.pkgConfigModules}" > "$out"
+''
diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix
index 548110cafc112..303a6ff40091a 100644
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@@ -1139,7 +1139,7 @@ self: super: {
   # 2021-12-26: Too strict bounds on doctest
   polysemy-plugin = doJailbreak super.polysemy-plugin;
 
-  # hasn‘t bumped upper bounds
+  # hasn’t bumped upper bounds
   # upstream: https://github.com/obsidiansystems/which/pull/6
   which = doJailbreak super.which;
 
diff --git a/pkgs/development/haskell-modules/configuration-ghc-8.10.x.nix b/pkgs/development/haskell-modules/configuration-ghc-8.10.x.nix
index baa8752e1e8f9..7604a1c507a24 100644
--- a/pkgs/development/haskell-modules/configuration-ghc-8.10.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-8.10.x.nix
@@ -69,7 +69,7 @@ self: super: {
   # Pick right versions for GHC-specific packages
   ghc-api-compat = doDistribute (unmarkBroken self.ghc-api-compat_8_10_7);
 
-  # ghc versions which don‘t match the ghc-lib-parser-ex version need the
+  # ghc versions which don’t match the ghc-lib-parser-ex version need the
   # additional dependency to compile successfully.
   ghc-lib-parser-ex = addBuildDepend self.ghc-lib-parser super.ghc-lib-parser-ex;
 
@@ -77,7 +77,7 @@ self: super: {
   base-noprelude = doJailbreak super.base-noprelude;
   unliftio-core = doJailbreak super.unliftio-core;
 
-  # Jailbreaking because monoidal-containers hasn‘t bumped it's base dependency for 8.10.
+  # Jailbreaking because monoidal-containers hasn’t bumped it's base dependency for 8.10.
   monoidal-containers = doJailbreak super.monoidal-containers;
 
   # Jailbreak to fix the build.
diff --git a/pkgs/development/haskell-modules/configuration-ghc-8.6.x.nix b/pkgs/development/haskell-modules/configuration-ghc-8.6.x.nix
index ddd41bc57e723..92278ebb0e217 100644
--- a/pkgs/development/haskell-modules/configuration-ghc-8.6.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-8.6.x.nix
@@ -94,13 +94,13 @@ self: super: {
   # ghc versions prior to 8.8.x needs additional dependency to compile successfully.
   ghc-lib-parser-ex = addBuildDepend self.ghc-lib-parser super.ghc-lib-parser-ex;
 
-  # This became a core library in ghc 8.10., so we don‘t have an "exception" attribute anymore.
+  # This became a core library in ghc 8.10., so we don’t have an "exception" attribute anymore.
   exceptions = super.exceptions_0_10_4;
 
   # Older compilers need the latest ghc-lib to build this package.
   hls-hlint-plugin = addBuildDepend self.ghc-lib super.hls-hlint-plugin;
 
-  # vector 0.12.2 indroduced doctest checks that don‘t work on older compilers
+  # vector 0.12.2 indroduced doctest checks that don’t work on older compilers
   vector = dontCheck super.vector;
 
   mmorph = super.mmorph_1_1_3;
diff --git a/pkgs/development/haskell-modules/configuration-ghc-8.8.x.nix b/pkgs/development/haskell-modules/configuration-ghc-8.8.x.nix
index 941f95c07fac3..903b177efafff 100644
--- a/pkgs/development/haskell-modules/configuration-ghc-8.8.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-8.8.x.nix
@@ -125,12 +125,12 @@ self: super: {
   liquid-vector = markBroken super.liquid-vector;
   liquidhaskell = markBroken super.liquidhaskell;
 
-  # This became a core library in ghc 8.10., so we don‘t have an "exception" attribute anymore.
+  # This became a core library in ghc 8.10., so we don’t have an "exception" attribute anymore.
   exceptions = super.exceptions_0_10_7;
 
   ormolu = super.ormolu_0_2_0_0;
 
-  # vector 0.12.2 indroduced doctest checks that don‘t work on older compilers
+  # vector 0.12.2 indroduced doctest checks that don’t work on older compilers
   vector = dontCheck super.vector;
 
   ghc-api-compat = doDistribute (unmarkBroken super.ghc-api-compat_8_6);
@@ -143,7 +143,7 @@ self: super: {
 
   ghc-lib-parser = self.ghc-lib-parser_8_10_7_20220219;
 
-  # ghc versions which don‘t match the ghc-lib-parser-ex version need the
+  # ghc versions which don’t match the ghc-lib-parser-ex version need the
   # additional dependency to compile successfully.
   ghc-lib-parser-ex = addBuildDepend self.ghc-lib-parser self.ghc-lib-parser-ex_8_10_0_24;
 
diff --git a/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml b/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml
index d61ab5200cebd..961178a06d4a7 100644
--- a/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml
@@ -667,7 +667,7 @@ dont-distribute-packages:
   - yices-easy
   - yices-painless
 
-  # These packages don‘t build because they use deprecated webkit versions.
+  # These packages don’t build because they use deprecated webkit versions.
   - diagrams-hsqml
   - dialog
   - ghcjs-dom-webkit
diff --git a/pkgs/development/haskell-modules/configuration-nix.nix b/pkgs/development/haskell-modules/configuration-nix.nix
index 26d2e2aef4be5..4105a01945e8a 100644
--- a/pkgs/development/haskell-modules/configuration-nix.nix
+++ b/pkgs/development/haskell-modules/configuration-nix.nix
@@ -1115,7 +1115,7 @@ self: super: builtins.intersectAttrs super {
     hls-splice-plugin
     hls-refactor-plugin
     hls-cabal-plugin;
-  # Tests have file permissions expections that don‘t work with the nix store.
+  # Tests have file permissions expections that don’t work with the nix store.
   hls-stylish-haskell-plugin = dontCheck super.hls-stylish-haskell-plugin;
   hls-gadt-plugin = dontCheck super.hls-gadt-plugin;
 
diff --git a/pkgs/development/interpreters/clojure/babashka.nix b/pkgs/development/interpreters/clojure/babashka.nix
index d50ed8ff0520f..f8fb244d54c99 100644
--- a/pkgs/development/interpreters/clojure/babashka.nix
+++ b/pkgs/development/interpreters/clojure/babashka.nix
@@ -2,11 +2,11 @@
 
 buildGraalvmNativeImage rec {
   pname = "babashka";
-  version = "1.1.172";
+  version = "1.1.173";
 
   src = fetchurl {
     url = "https://github.com/babashka/${pname}/releases/download/v${version}/${pname}-${version}-standalone.jar";
-    sha256 = "sha256-mdcG4zKC9zX0J2S2lWCvFdFFr5sOxfOe9/iPzvEyImM=";
+    sha256 = "sha256-p/KGDCocTksvUwj6x5l1xUEM1OZ4pNHtXL4mTgg7JUI=";
   };
 
   executable = "bb";
diff --git a/pkgs/development/libraries/qt-6/modules/qtbase.nix b/pkgs/development/libraries/qt-6/modules/qtbase.nix
index 6da193bbd5fc1..e71b0a7613d99 100644
--- a/pkgs/development/libraries/qt-6/modules/qtbase.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtbase.nix
@@ -222,8 +222,8 @@ stdenv.mkDerivation rec {
     "-DQT_FEATURE_journald=${if systemdSupport then "ON" else "OFF"}"
     "-DQT_FEATURE_vulkan=ON"
   ] ++ lib.optionals stdenv.isDarwin [
-    # build as a set of dynamic libraries
-    "-DFEATURE_framework=OFF"
+    # error: 'path' is unavailable: introduced in macOS 10.15
+    "-DQT_FEATURE_cxx17_filesystem=OFF"
   ];
 
   NIX_LDFLAGS = toString (lib.optionals stdenv.isDarwin [
diff --git a/pkgs/development/libraries/zlib/default.nix b/pkgs/development/libraries/zlib/default.nix
index 52654b6541e3e..4ca77d56fca9b 100644
--- a/pkgs/development/libraries/zlib/default.nix
+++ b/pkgs/development/libraries/zlib/default.nix
@@ -8,6 +8,7 @@
 # the `.pc` file lists only the main output's lib dir.
 # If false, and if `{ static = true; }`, the .a stays in the main output.
 , splitStaticOutput ? shared && static
+, testers
 }:
 
 # Without either the build will actually still succeed because the build
@@ -21,11 +22,13 @@ assert shared || static;
 
 assert splitStaticOutput -> static;
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "zlib";
   version = "1.2.13";
 
-  src = fetchurl {
+  src = let
+    inherit (finalAttrs) version;
+  in fetchurl {
     urls = [
       # This URL works for 1.2.13 only; hopefully also for future releases.
       "https://github.com/madler/zlib/releases/download/v${version}/zlib-${version}.tar.gz"
@@ -125,10 +128,13 @@ stdenv.mkDerivation rec {
     "SHARED_MODE=1"
   ];
 
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
   meta = with lib; {
     homepage = "https://zlib.net";
     description = "Lossless data-compression library";
     license = licenses.zlib;
     platforms = platforms.all;
+    pkgConfigModules = [ "zlib" ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/bellows/default.nix b/pkgs/development/python-modules/bellows/default.nix
index 6ac6521530ac5..4d16dcebfd4bc 100644
--- a/pkgs/development/python-modules/bellows/default.nix
+++ b/pkgs/development/python-modules/bellows/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "bellows";
-  version = "0.34.7";
+  version = "0.34.8";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "zigpy";
     repo = "bellows";
     rev = "refs/tags/${version}";
-    hash = "sha256-+4OWiIRbCLvZWt5zn2djW20PrZJK4c5KOcz4Owbkozg=";
+    hash = "sha256-0pSMBPUA3djl7roVyFWe6ml9OOmWooAhwNXjsBgeLmU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/duecredit/default.nix b/pkgs/development/python-modules/duecredit/default.nix
index 6e225df0fd90e..301d99aabe0cd 100644
--- a/pkgs/development/python-modules/duecredit/default.nix
+++ b/pkgs/development/python-modules/duecredit/default.nix
@@ -12,12 +12,12 @@
 
 buildPythonPackage rec {
   pname = "duecredit";
-  version = "0.9.1";
+  version = "0.9.2";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f6192ce9315b35f6a67174761291e61d0831e496e8ff4acbc061731e7604faf8";
+    sha256 = "sha256-Dg/Yfp5GzmyUMI6feAwgP+g22JYoQE+L9a+Wp0V77Rw=";
   };
 
   propagatedBuildInputs = [ citeproc-py requests six ];
diff --git a/pkgs/development/python-modules/getmac/default.nix b/pkgs/development/python-modules/getmac/default.nix
index 05b638559aecd..49d58eab82c6b 100644
--- a/pkgs/development/python-modules/getmac/default.nix
+++ b/pkgs/development/python-modules/getmac/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "getmac";
-  version = "0.9.1";
+  version = "0.9.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "GhostofGoes";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-U04mtg7DCC78X5Fd0wGaHrf8XkUpDLi4+ctKCyR4dKg=";
+    hash = "sha256-n4WpEbkaYUS0aGdZKO5T/cuDr5OxauiuOAAdK56/+AM=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-container/default.nix b/pkgs/development/python-modules/google-cloud-container/default.nix
index 6c022b84ab75c..a8578492fb235 100644
--- a/pkgs/development/python-modules/google-cloud-container/default.nix
+++ b/pkgs/development/python-modules/google-cloud-container/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-container";
-  version = "2.17.1";
+  version = "2.17.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-PXDUjipUG7cYqeO2ivqrqLybHzDIssvBtdZixEMqXOA=";
+    hash = "sha256-VDhWYfAdU2PPzjSIhh0XMEnt9krogXV1fNTAFk6R3WM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/peaqevcore/default.nix b/pkgs/development/python-modules/peaqevcore/default.nix
index 38e06d362d934..b8b5f092dcb2b 100644
--- a/pkgs/development/python-modules/peaqevcore/default.nix
+++ b/pkgs/development/python-modules/peaqevcore/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "peaqevcore";
-  version = "11.0.4";
+  version = "11.1.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-SU8vsKwZio/5UD2SMhLenfkBjXRuMZCPo2k6+1hx8Y4=";
+    hash = "sha256-ZuXc/7xCCFl20+GAMpL1c4iavjr7iR0pTvAoDCMnxx4=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/plugwise/default.nix b/pkgs/development/python-modules/plugwise/default.nix
index 338c189678764..0a049c18fed9f 100644
--- a/pkgs/development/python-modules/plugwise/default.nix
+++ b/pkgs/development/python-modules/plugwise/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "plugwise";
-  version = "0.27.5";
+  version = "0.27.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = "python-plugwise";
     rev = "refs/tags/v${version}";
-    hash = "sha256-qEAXyWa5OjTpF4foi0ljHKbemIEHORPGE6vIVL57BOU=";
+    hash = "sha256-lG41y7bJkb7JdSsbv4PA2uaapkND59CDQq6Fvi+0hgU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pydmd/default.nix b/pkgs/development/python-modules/pydmd/default.nix
index ab7457a13086e..d77caf7e4ad0e 100644
--- a/pkgs/development/python-modules/pydmd/default.nix
+++ b/pkgs/development/python-modules/pydmd/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "pydmd";
-  version = "0.4.0.post2301";
+  version = "0.4.0.post2302";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "mathLab";
     repo = "PyDMD";
     rev = "refs/tags/v${version}";
-    hash = "sha256-0ss7yyT6u0if+YjBYNbKtx5beJU43JC1LD9rqHPKBS8=";
+    hash = "sha256-EYVmaxwOxje3KVrNbvsjwRqQBD7Rje/JK+qB1F7EqA0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/rmsd/default.nix b/pkgs/development/python-modules/rmsd/default.nix
new file mode 100644
index 0000000000000..2a0f2ecb50b2c
--- /dev/null
+++ b/pkgs/development/python-modules/rmsd/default.nix
@@ -0,0 +1,27 @@
+{ buildPythonPackage
+, lib
+, fetchPypi
+, scipy
+}:
+
+buildPythonPackage rec {
+  pname = "rmsd";
+  version = "1.5.1";
+
+  propagatedBuildInputs = [ scipy ];
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-wDQoIUMqrBDpgImHeHWizYu/YkFjlxB22TaGpA8Q0Sc=";
+  };
+
+  pythonImportsCheck = [ "rmsd" ];
+
+  meta = with lib; {
+    description = "Calculate root-mean-square deviation (RMSD) between two sets of cartesian coordinates";
+    homepage = "https://github.com/charnley/rmsd";
+    license = licenses.bsd2;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ sheepforce markuskowa ];
+  };
+}
diff --git a/pkgs/development/python-modules/solc-select/default.nix b/pkgs/development/python-modules/solc-select/default.nix
index af8724d1999d5..b20c60c4ab82b 100644
--- a/pkgs/development/python-modules/solc-select/default.nix
+++ b/pkgs/development/python-modules/solc-select/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "solc-select";
-  version = "1.0.2";
+  version = "1.0.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-zrpWHQdoCVDGaDGDf9fWhnRsTe1GVwqk1qls1PyvlLw=";
+    sha256 = "sha256-850IA1NVvQ4KiH5KEIjqEKFd1k5ECMx/zXLZE7Rvx5k=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/yj/default.nix b/pkgs/development/tools/yj/default.nix
index 017434134ca1a..150278c0ac4d8 100644
--- a/pkgs/development/tools/yj/default.nix
+++ b/pkgs/development/tools/yj/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "yj";
-  version = "5.0.0";
+  version = "5.1.0";
 
   src = fetchFromGitHub {
     owner = "sclevine";
     repo = "yj";
-    rev = "c4c13b7641389c76ea028b48091f851f3efb6376";
-    sha256 = "0bnb88wfm2vagh4yb1h9xhp3045ga0b6a77n3j2z5b4mvwshx5dr";
+    rev = "v${version}";
+    hash = "sha256-lsn5lxtix5W7po6nzvGcHmifbyhrtHgvaKYT7RPPCOg=";
   };
 
-  vendorSha256 = "0y0n9fsb85qlpf9slwsxzarmfi98asa4x04qp2r8pagl28l0i8wv";
+  vendorHash = "sha256-NeSOoL9wtFzq6ba8ghseB6D+Qq8Z5holQExcAUbtYrs=";
 
   ldflags = [ "-s" "-w" "-X main.Version=${version}" ];
 
diff --git a/pkgs/development/tools/zed/default.nix b/pkgs/development/tools/zed/default.nix
index 5441946052b35..94c1cdaa01a9c 100644
--- a/pkgs/development/tools/zed/default.nix
+++ b/pkgs/development/tools/zed/default.nix
@@ -1,6 +1,8 @@
 { lib
 , buildGoModule
 , fetchFromGitHub
+, testers
+, zed
 }:
 
 buildGoModule rec {
@@ -18,11 +20,27 @@ buildGoModule rec {
 
   subPackages = [ "cmd/zed" "cmd/zq" ];
 
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=github.com/brimdata/zed/cli.Version=${version}"
+  ];
+
+  passthru.tests = {
+    zed-version = testers.testVersion {
+      package = zed;
+    };
+    zq-version = testers.testVersion {
+      package = zed;
+      command = "zq --version";
+    };
+  };
+
   meta = with lib; {
     description = "A novel data lake based on super-structured data";
-    homepage = "https://github.com/brimdata/zed";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ dit7ya ];
+    homepage = "https://zed.brimdata.io";
     changelog = "https://github.com/brimdata/zed/blob/v${version}/CHANGELOG.md";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ dit7ya knl ];
   };
 }
diff --git a/pkgs/development/tools/zq/default.nix b/pkgs/development/tools/zq/default.nix
deleted file mode 100644
index c62de54360fc2..0000000000000
--- a/pkgs/development/tools/zq/default.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, buildGoModule
-, testers
-, zq
-}:
-
-buildGoModule rec {
-  pname = "zq";
-  version = "1.4.0";
-
-  src = fetchFromGitHub {
-    owner = "brimdata";
-    repo = "zed";
-    rev = "v${version}";
-    hash = "sha256-ias2HKwZo5Q/0M4YZI4wLgzMVWmannruXlhp8IsOuyU=";
-  };
-
-  vendorHash = "sha256-h5NYx6xhIh4i/tS5cGHXBomnVZCUn8jJuzL6k1+IdKk=";
-
-  subPackages = [ "cmd/zq" ];
-
-  ldflags = [ "-s" "-X" "github.com/brimdata/zed/cli.Version=${version}" ];
-
-  passthru.tests = testers.testVersion { package = zq; };
-
-  meta = with lib; {
-    description = "A command-line tool for processing data in diverse input formats, providing search, analytics, and extensive transformations using the Zed language";
-    homepage = "https://zed.brimdata.io";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ knl ];
-  };
-}
diff --git a/pkgs/games/ecwolf/default.nix b/pkgs/games/ecwolf/default.nix
index 34c186f7f2dcf..542b414d8a45a 100644
--- a/pkgs/games/ecwolf/default.nix
+++ b/pkgs/games/ecwolf/default.nix
@@ -1,10 +1,10 @@
 { stdenv
 , lib
 , fetchFromBitbucket
-, makeDesktopItem
-, copyDesktopItems
 , cmake
+, copyDesktopItems
 , pkg-config
+, makeWrapper
 , zlib
 , bzip2
 , libjpeg
@@ -16,27 +16,29 @@
 
 stdenv.mkDerivation rec {
   pname = "ecwolf";
-  version = "1.4.0";
+  version = "1.4.1";
 
   src = fetchFromBitbucket {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "n1G1zvfE1l42fbJ7ZaMdV0QXn45PjMpaaZTDQAOBtYk=";
+    sha256 = "V2pSP8i20zB50WtUMujzij+ISSupdQQ/oCYYrOaTU1g=";
   };
 
-  nativeBuildInputs = [ cmake copyDesktopItems pkg-config ];
+  nativeBuildInputs = [ cmake copyDesktopItems pkg-config ]
+    ++ lib.optionals stdenv.isDarwin [ makeWrapper ];
   buildInputs = [ zlib bzip2 libjpeg SDL2 SDL2_net SDL2_mixer gtk3 ];
 
-  # Disable app bundle creation on Darwin. It fails, and it is not needed to run it from the Nix store
-  preConfigure = lib.optionalString stdenv.isDarwin ''
-    sed -i -e "s|include(\''${CMAKE_CURRENT_SOURCE_DIR}/macosx/install.txt)||" src/CMakeLists.txt
-  '';
+  NIX_LDFLAGS = lib.optionalString stdenv.isDarwin "-framework AppKit";
 
   # ECWolf installs its binary to the games/ directory, but Nix only adds bin/
   # directories to the PATH.
-  postInstall = ''
+  postInstall = lib.optionalString stdenv.isLinux ''
     mv "$out/games" "$out/bin"
+  '' + lib.optionalString stdenv.isDarwin ''
+    mkdir -p $out/{Applications,bin}
+    cp -R ecwolf.app $out/Applications
+    makeWrapper $out/{Applications/ecwolf.app/Contents/MacOS,bin}/ecwolf
   '';
 
   meta = with lib; {
@@ -45,7 +47,5 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ jayman2000 sander ];
     platforms = platforms.all;
-    # On Darwin, the linker fails to find a bunch of symbols.
-    broken = stdenv.isDarwin;
   };
 }
diff --git a/pkgs/games/wesnoth/default.nix b/pkgs/games/wesnoth/default.nix
index 6b5e0c117cc53..75ea0d23e038f 100644
--- a/pkgs/games/wesnoth/default.nix
+++ b/pkgs/games/wesnoth/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wesnoth";
-  version = "1.16.7";
+  version = "1.16.8";
 
   src = fetchFromGitHub {
     rev = version;
     owner = "wesnoth";
     repo = "wesnoth";
-    sha256 = "sha256-YcBF/iNr6Q5NaA+G55xa0SOCCHW2BCoJlmXsTtkF1fk=";
+    hash = "sha256-P7OUiKJxJZ0rGdesnxpQMbRBgCHsLpyt8+pRDh27JYQ=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
@@ -20,6 +20,8 @@ stdenv.mkDerivation rec {
                   libvorbis fribidi dbus libpng pcre openssl icu ]
                 ++ lib.optionals stdenv.isDarwin [ Cocoa Foundation];
 
+  NIX_LDFLAGS = lib.optionalString stdenv.isDarwin "-framework AppKit";
+
   meta = with lib; {
     description = "The Battle for Wesnoth, a free, turn-based strategy game with a fantasy theme";
     longDescription = ''
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index a2cace8bc1e49..db4c5b76c4139 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -22,22 +22,22 @@
     "5.10": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.10.165-hardened1.patch",
-            "sha256": "0gnvnywagqqdsdrbd9fbl671pzfv49mf2xqan9bk3q41mgcyyfgg",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.165-hardened1/linux-hardened-5.10.165-hardened1.patch"
+            "name": "linux-hardened-5.10.166-hardened1.patch",
+            "sha256": "1ygxald6mq47n7i6x80mv9d5idfpwk6gpcijci8bsazhndwvi7qy",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.166-hardened1/linux-hardened-5.10.166-hardened1.patch"
         },
-        "sha256": "03dg8yx0gdzm8zbwd1f9jn4c5jhr8qilhjzxgwm0mv8riz2fy7cp",
-        "version": "5.10.165"
+        "sha256": "1bz1sgkqniwg84wv9vcg08mksa5q533vgynsd3y0xnjv1rwa2l80",
+        "version": "5.10.166"
     },
     "5.15": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.15.90-hardened1.patch",
-            "sha256": "1zj80v6xpgz00z1lpw5j9qdm0gp44pk7vkflrngbk8m3cwmpw5ha",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.90-hardened1/linux-hardened-5.15.90-hardened1.patch"
+            "name": "linux-hardened-5.15.91-hardened1.patch",
+            "sha256": "041yigcqzp7m6cibl9h3jgsz20xhxc9y7y5pay9c7fkh2ypy9zgz",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.91-hardened1/linux-hardened-5.15.91-hardened1.patch"
         },
-        "sha256": "0hiv74mxkp3v04lphnyw16akgavaz527bzhnfnpm6rv848047zg6",
-        "version": "5.15.90"
+        "sha256": "107yw7mibibhfrggm8idzn5bayjvkxaq1kv3kkm1lpxipsqjng56",
+        "version": "5.15.91"
     },
     "5.4": {
         "patch": {
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index 3e5cc009576e2..06866be49e847 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "4.14.304";
+  version = "4.14.305";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1ma9qpsx0nvi0szlivf8v5l3pjykqwrv4x6y5g0nn6bcwhsb5jv4";
+    sha256 = "16lmhxqpbhyqmgmlyicjadzz3axhl5smfrr230x45ahkdghwsnx3";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix
index 506d57d797139..11a8c11f3f291 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "4.19.271";
+  version = "4.19.272";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "06lxh9skp9213n29ynx7a9cinz7wggaxjsz52kghdbwfnjf3yvb3";
+    sha256 = "1y8kyc48v8bsl53zc6dsy5xhazv0vyna98fycj181aypicvbk7s8";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.10.nix b/pkgs/os-specific/linux/kernel/linux-5.10.nix
index b2a9f27947c33..8843f6622acec 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.10.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.10.166";
+  version = "5.10.167";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1bz1sgkqniwg84wv9vcg08mksa5q533vgynsd3y0xnjv1rwa2l80";
+    sha256 = "1iprbgwdgnylzw4dc8jgims54x8dkq070c9vs4642rp529wgj1yq";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.15.nix b/pkgs/os-specific/linux/kernel/linux-5.15.nix
index 9ae7546f3c9db..b9e6145bcffcf 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.15.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.15.91";
+  version = "5.15.92";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "107yw7mibibhfrggm8idzn5bayjvkxaq1kv3kkm1lpxipsqjng56";
+    sha256 = "14ggwrvk9n2nvk38fp4g486k864knf3n9979mm51m8wrvd8h8hlz";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.4.nix b/pkgs/os-specific/linux/kernel/linux-5.4.nix
index aef87aaa42110..42c5997f22fc6 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.4.230";
+  version = "5.4.231";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0bz6hfhsahymys2g9s4nzf862z0zfq4346577cpvf98hrhnd6kx7";
+    sha256 = "1a1nbyvkf6iaj5lz6ahg7kk9pyrx7j77jmaj92fyihdl3mzyml4d";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-6.1.nix b/pkgs/os-specific/linux/kernel/linux-6.1.nix
index 2bed730a8b119..ff5793009c4cf 100644
--- a/pkgs/os-specific/linux/kernel/linux-6.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-6.1.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.1.9";
+  version = "6.1.10";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "0awjynyy049px0h7li59w3zgn3z39alv6glzrmx6wf1wd62z236n";
+    sha256 = "17fifhfh2jrvlhry696n428ldl5ag3g2km5l9hx8gx8wm6dr3qhb";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-libre.nix b/pkgs/os-specific/linux/kernel/linux-libre.nix
index 698ca10016ca1..e0290a2aec647 100644
--- a/pkgs/os-specific/linux/kernel/linux-libre.nix
+++ b/pkgs/os-specific/linux/kernel/linux-libre.nix
@@ -1,8 +1,8 @@
 { stdenv, lib, fetchsvn, linux
 , scripts ? fetchsvn {
     url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/";
-    rev = "19027";
-    sha256 = "0g7sf48rwicwzwhjpzs82j6v3j4s17xhrgfgysdd523r07437ryv";
+    rev = "19044";
+    sha256 = "1xiykp6lwvlz8x48i7f1f3izra2hfz75iihw3y4w5f1jlji6y56m";
   }
 , ...
 }:
diff --git a/pkgs/servers/invidious/versions.json b/pkgs/servers/invidious/versions.json
index bb6063fdafb42..82438bf23f9f2 100644
--- a/pkgs/servers/invidious/versions.json
+++ b/pkgs/servers/invidious/versions.json
@@ -4,9 +4,9 @@
     "sha256": "sha256-EU6T9yQCdOLx98Io8o01rEsgxDFF/Xoy42LgPopD2/A="
   },
   "invidious": {
-    "rev": "3b8e6c6040fe341fe4b9fc16cdbd3aea697dfad3",
-    "sha256": "sha256-gESGo8zRJtGJZrZEkW0OS/O65ZwVzpDA3jmyLCV0RpI=",
-    "version": "unstable-2023-01-26"
+    "rev": "d6dd341594cc837001ed57cbea3103d22c9988c1",
+    "sha256": "sha256-BHCbIX7Qi2adixIY+hcU8t5kBXBGAv8DTviJ7BPHKCg=",
+    "version": "unstable-2023-02-02"
   },
   "lsquic": {
     "sha256": "sha256-hG8cUvhbCNeMOsKkaJlgGpzUrIx47E/WhmPIdI5F3qM=",
diff --git a/pkgs/servers/klipper/default.nix b/pkgs/servers/klipper/default.nix
index 7c9117f91c18a..b1d38c4adc3d4 100644
--- a/pkgs/servers/klipper/default.nix
+++ b/pkgs/servers/klipper/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "klipper";
-  version = "unstable-2023-01-07";
+  version = "unstable-2023-02-03";
 
   src = fetchFromGitHub {
     owner = "KevinOConnor";
     repo = "klipper";
-    rev = "f1203d56f6bc2c84d00605a76525be4c13430324";
-    sha256 = "sha256-7FJ+omzXpj49AThcv0xDilIekCyehtvpvck1+nrMS70=";
+    rev = "5644481590a16ac5b3d8c20874f0477d5d51a963";
+    sha256 = "sha256-OGFVcUPw0sqTbJyrMvCxp8nER9/42ZRN4zIrpm/qh4E=";
   };
 
   sourceRoot = "source/klippy";
diff --git a/pkgs/servers/web-apps/wiki-js/default.nix b/pkgs/servers/web-apps/wiki-js/default.nix
index 6df706e22b79c..17714ada38cc0 100644
--- a/pkgs/servers/web-apps/wiki-js/default.nix
+++ b/pkgs/servers/web-apps/wiki-js/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "wiki-js";
-  version = "2.5.295";
+  version = "2.5.296";
 
   src = fetchurl {
     url = "https://github.com/Requarks/wiki/releases/download/v${version}/${pname}.tar.gz";
-    sha256 = "sha256-itiW9/QtNpc8cFS5skwlc3JSWoVqbBbIcSlEd+GRkH0=";
+    sha256 = "sha256-05rGNKL7K4FgEUXH34jl9h4diCdwFRY98qDO+w9B52s=";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/stdenv/generic/check-meta.nix b/pkgs/stdenv/generic/check-meta.nix
index 751e19d1681ae..9d99be2a02039 100644
--- a/pkgs/stdenv/generic/check-meta.nix
+++ b/pkgs/stdenv/generic/check-meta.nix
@@ -271,6 +271,7 @@ let
     sourceProvenance = listOf lib.types.attrs;
     maintainers = listOf (attrsOf anything); # TODO use the maintainer type from lib/tests/maintainer-module.nix
     priority = int;
+    pkgConfigModules = listOf str;
     platforms = listOf (either str (attrsOf anything));   # see lib.meta.platformMatch
     hydraPlatforms = listOf str;
     broken = bool;
diff --git a/pkgs/tools/security/yubihsm-shell/default.nix b/pkgs/tools/security/yubihsm-shell/default.nix
index 83c2e535403d6..77b6b86ffd6e1 100644
--- a/pkgs/tools/security/yubihsm-shell/default.nix
+++ b/pkgs/tools/security/yubihsm-shell/default.nix
@@ -10,19 +10,31 @@
 , pkg-config
 , pcsclite
 , help2man
+, darwin
+, libiconv
 }:
 
 stdenv.mkDerivation rec {
   pname = "yubihsm-shell";
-  version = "2.3.2";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "Yubico";
     repo = "yubihsm-shell";
     rev = version;
-    sha256 = "sha256-rSIdI6ECLte+dEbT8NOUqS8jkozRhbo+eqFrdhTIKpY=";
+    hash = "sha256-zWhvECPdZnrbSAVPDVZk54SWHVkd/HEQxS3FgXoqXHY=";
   };
 
+  postPatch = ''
+    # Can't find libyubihsm at runtime because of dlopen() in C code
+    substituteInPlace lib/yubihsm.c \
+      --replace "libyubihsm_usb.so" "$out/lib/libyubihsm_usb.so" \
+      --replace "libyubihsm_http.so" "$out/lib/libyubihsm_http.so"
+    # ld: unknown option: -z
+    substituteInPlace CMakeLists.txt cmake/SecurityFlags.cmake \
+      --replace "AppleClang" "Clang"
+  '';
+
   nativeBuildInputs = [
     pkg-config
     cmake
@@ -34,16 +46,17 @@ stdenv.mkDerivation rec {
     libusb1
     libedit
     curl
-    pcsclite
     openssl
+  ] ++ lib.optionals stdenv.isLinux [
+    pcsclite
+  ] ++ lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.PCSC
+    libiconv
   ];
 
-  postPatch = ''
-    # Can't find libyubihsm at runtime because of dlopen() in C code
-    substituteInPlace lib/yubihsm.c \
-      --replace "libyubihsm_usb.so" "$out/lib/libyubihsm_usb.so" \
-      --replace "libyubihsm_http.so" "$out/lib/libyubihsm_http.so"
-  '';
+  cmakeFlags = lib.optionals stdenv.isDarwin [
+    "-DDISABLE_LTO=ON"
+  ];
 
   meta = with lib; {
     description = "yubihsm-shell and libyubihsm";
diff --git a/pkgs/tools/system/erdtree/default.nix b/pkgs/tools/system/erdtree/default.nix
new file mode 100644
index 0000000000000..a60071e447395
--- /dev/null
+++ b/pkgs/tools/system/erdtree/default.nix
@@ -0,0 +1,25 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "erdtree";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "solidiquis";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-gZC90flsfH03Grc1netzlv/iX/9DH+rpaSstfXFearc=";
+  };
+
+  cargoHash = "sha256-0I60lUYyR4Za2Q3FqcdqJhUKFjX5+PE88G6JxxxiBXw=";
+
+  meta = with lib; {
+    description = "File-tree visualizer and disk usage analyzer";
+    homepage = "https://github.com/solidiquis/erdtree";
+    license = licenses.mit;
+    maintainers = with maintainers; [ zendo ];
+  };
+}
diff --git a/pkgs/tools/system/gdu/default.nix b/pkgs/tools/system/gdu/default.nix
index b9391d7000fbb..21691b0d44722 100644
--- a/pkgs/tools/system/gdu/default.nix
+++ b/pkgs/tools/system/gdu/default.nix
@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "gdu";
-  version = "5.21.1";
+  version = "5.22.0";
 
   src = fetchFromGitHub {
     owner = "dundee";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-QxepFU/ZQWVH19AeoSnXAAUhLO6VKmrZIIpVw1tTft4=";
+    hash = "sha256-bWeMZ1tQkJsRJbolZBue9UzM4Qs7K5Rj5Z80Uotyb8I=";
   };
 
   vendorHash = "sha256-UP6IdJLc93gRP4vwKKOJl3sNt4sOFeYXjvwk8QM+D48=";
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index b87a6dec9952d..7ab149abe9bb3 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1698,6 +1698,7 @@ mapAliases ({
   zdfmediathk = throw "'zdfmediathk' has been renamed to/replaced by 'mediathekview'"; # Converted to throw 2022-02-22
   zimreader = throw "zimreader has been removed from nixpkgs as it has been replaced by kiwix-serve and stopped working with modern zimlib versions"; # Added 2021-03-28
   zimwriterfs = throw "zimwriterfs is now part of zim-tools"; # Added 2022-06-10.
+  zq = zed.overrideAttrs (old: { meta = old.meta // { mainProgram = "zq"; }; }); # Added 2023-02-06
 
   # TODO(ekleog): add ‘wasm’ alias to ‘ocamlPackages.wasm’ after 19.03
   # branch-off
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c08dcb7f5676b..8e3bb2e961dc9 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1628,8 +1628,6 @@ with pkgs;
 
   breitbandmessung = callPackage ../applications/networking/breitbandmessung { };
 
-  zq = callPackage ../development/tools/zq { };
-
   ### APPLICATIONS/VERSION-MANAGEMENT
 
   deepgit = callPackage ../applications/version-management/deepgit {};
@@ -4533,6 +4531,8 @@ with pkgs;
 
   er-patcher = callPackage ../tools/games/er-patcher { };
 
+  erdtree = callPackage ../tools/system/erdtree { };
+
   errcheck = callPackage ../development/tools/errcheck { };
 
   eschalot = callPackage ../tools/security/eschalot { };
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index b91da8ebcde39..96eca64590d2d 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -5200,14 +5200,14 @@ let
 
   CryptOpenSSLRSA = buildPerlPackage {
     pname = "Crypt-OpenSSL-RSA";
-    version = "0.31";
+    version = "0.33";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/T/TO/TODDR/Crypt-OpenSSL-RSA-0.31.tar.gz";
-      hash = "sha256-QXNAOtTPdnMhkgmfgz+/vzzYEE4CRrOEQYeuOE0sVDY=";
+      url = "mirror://cpan/authors/id/T/TO/TODDR/Crypt-OpenSSL-RSA-0.33.tar.gz";
+      hash = "sha256-vb5jD21vVAMldGrZmXcnKshmT/gb0Z8K2rptb0Xv2GQ=";
     };
     propagatedBuildInputs = [ CryptOpenSSLRandom ];
-    NIX_CFLAGS_COMPILE = "-I${pkgs.openssl_1_1.dev}/include";
-    NIX_CFLAGS_LINK = "-L${lib.getLib pkgs.openssl_1_1}/lib -lcrypto";
+    NIX_CFLAGS_COMPILE = "-I${pkgs.openssl.dev}/include";
+    NIX_CFLAGS_LINK = "-L${lib.getLib pkgs.openssl}/lib -lcrypto";
     buildInputs = [ CryptOpenSSLGuess ];
     meta = {
       description = "RSA encoding and decoding, using the openSSL libraries";
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 2464a4d153b41..1ab7087ba63ea 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -10067,6 +10067,8 @@ self: super: with self; {
 
   rmrl = callPackage ../development/python-modules/rmrl { };
 
+  rmsd = callPackage ../development/python-modules/rmsd { };
+
   rnc2rng = callPackage ../development/python-modules/rnc2rng { };
 
   rnginline = callPackage ../development/python-modules/rnginline { };