summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--doc/languages-frameworks/python.section.md7
-rw-r--r--flake.nix4
-rw-r--r--lib/systems/default.nix11
-rw-r--r--lib/systems/doubles.nix3
-rw-r--r--lib/systems/examples.nix5
-rw-r--r--lib/systems/flake-systems.nix29
-rw-r--r--lib/systems/inspect.nix1
-rw-r--r--lib/systems/parse.nix1
-rw-r--r--lib/systems/supported.nix26
-rw-r--r--maintainers/maintainer-list.nix6
-rw-r--r--nixos/doc/manual/from_md/release-notes/rl-2205.section.xml9
-rw-r--r--nixos/doc/manual/release-notes/rl-2205.section.md2
-rw-r--r--nixos/modules/config/update-users-groups.pl6
-rw-r--r--nixos/modules/config/users-groups.nix11
-rw-r--r--nixos/modules/services/networking/mosquitto.nix10
-rw-r--r--nixos/modules/system/boot/plymouth.nix10
-rw-r--r--nixos/modules/system/boot/systemd.nix17
-rw-r--r--nixos/modules/system/boot/systemd/logind.nix3
-rw-r--r--nixos/tests/all-tests.nix2
-rw-r--r--nixos/tests/mosquitto.nix28
-rw-r--r--nixos/tests/mysql/mysql-backup.nix1
-rw-r--r--nixos/tests/nginx-http3.nix90
-rw-r--r--nixos/tests/user-home-mode.nix27
-rw-r--r--pkgs/applications/audio/mpg321/default.nix7
-rw-r--r--pkgs/applications/audio/ocenaudio/default.nix4
-rw-r--r--pkgs/applications/blockchains/sparrow/default.nix232
-rw-r--r--pkgs/applications/blockchains/sparrow/openimajgrabber.nix40
-rw-r--r--pkgs/applications/editors/eclipse/plugins.nix4
-rw-r--r--pkgs/applications/editors/notepad-next/default.nix3
-rw-r--r--pkgs/applications/emulators/box64/default.nix66
-rw-r--r--pkgs/applications/emulators/citra/default.nix122
-rw-r--r--pkgs/applications/emulators/citra/generic.nix107
-rwxr-xr-xpkgs/applications/emulators/citra/update.sh84
-rw-r--r--pkgs/applications/graphics/scantailor/advanced.nix10
-rw-r--r--pkgs/applications/misc/electrum/default.nix2
-rw-r--r--pkgs/applications/misc/electrum/ltc.nix2
-rw-r--r--pkgs/applications/misc/openambit/default.nix11
-rw-r--r--pkgs/applications/misc/pgmodeler/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/terraform-providers/providers.json198
-rw-r--r--pkgs/applications/networking/instant-messengers/deltachat-cursed/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/jami/default.nix2
-rw-r--r--pkgs/applications/networking/syncplay/default.nix2
-rw-r--r--pkgs/applications/office/paperless-ngx/default.nix2
-rw-r--r--pkgs/applications/version-management/git-and-tools/gitweb/default.nix2
-rw-r--r--pkgs/applications/version-management/gitea/default.nix4
-rw-r--r--pkgs/applications/virtualization/gvisor/default.nix2
-rw-r--r--pkgs/build-support/bintools-wrapper/default.nix1
-rw-r--r--pkgs/build-support/fetchsourcehut/default.nix2
-rw-r--r--pkgs/build-support/fetchzip/default.nix8
-rw-r--r--pkgs/build-support/fetchzip/tests.nix17
-rw-r--r--pkgs/data/fonts/input-fonts/default.nix2
-rw-r--r--pkgs/desktops/gnome/extensions/buildGnomeExtension.nix2
-rw-r--r--pkgs/development/compilers/crystal/build-package.nix27
-rw-r--r--pkgs/development/compilers/gcc/10/default.nix7
-rw-r--r--pkgs/development/compilers/miranda/default.nix5
-rw-r--r--pkgs/development/compilers/zasm/default.nix2
-rw-r--r--pkgs/development/em-modules/generic/default.nix10
-rw-r--r--pkgs/development/embedded/platformio/core.nix40
-rw-r--r--pkgs/development/embedded/platformio/default.nix4
-rw-r--r--pkgs/development/embedded/platformio/use-local-spdx-license-list.patch2
-rw-r--r--pkgs/development/interpreters/falcon/default.nix4
-rw-r--r--pkgs/development/libraries/gecode/default.nix22
-rw-r--r--pkgs/development/libraries/java/swt/default.nix2
-rw-r--r--pkgs/development/libraries/libsass/default.nix2
-rw-r--r--pkgs/development/libraries/mesa/default.nix5
-rw-r--r--pkgs/development/libraries/pe-parse/default.nix12
-rw-r--r--pkgs/development/misc/resholve/oildev.nix2
-rw-r--r--pkgs/development/ocaml-modules/faraday/default.nix4
-rw-r--r--pkgs/development/ocaml-modules/hacl_x25519/default.nix4
-rw-r--r--pkgs/development/php-packages/grpc/default.nix20
-rw-r--r--pkgs/development/python-modules/Mako/default.nix4
-rw-r--r--pkgs/development/python-modules/adb-shell/default.nix6
-rw-r--r--pkgs/development/python-modules/airtouch4pyapi/default.nix9
-rw-r--r--pkgs/development/python-modules/androidtv/default.nix8
-rw-r--r--pkgs/development/python-modules/autobahn/default.nix6
-rw-r--r--pkgs/development/python-modules/beautifultable/default.nix16
-rw-r--r--pkgs/development/python-modules/buildbot/default.nix2
-rw-r--r--pkgs/development/python-modules/clize/default.nix2
-rw-r--r--pkgs/development/python-modules/dask/default.nix2
-rw-r--r--pkgs/development/python-modules/datashader/default.nix2
-rw-r--r--pkgs/development/python-modules/django_modelcluster/default.nix4
-rw-r--r--pkgs/development/python-modules/fastapi/default.nix2
-rw-r--r--pkgs/development/python-modules/flask-security-too/default.nix10
-rw-r--r--pkgs/development/python-modules/httpcore/default.nix6
-rw-r--r--pkgs/development/python-modules/httpx-socks/default.nix2
-rw-r--r--pkgs/development/python-modules/httpx/default.nix8
-rw-r--r--pkgs/development/python-modules/ibis-framework/default.nix4
-rw-r--r--pkgs/development/python-modules/keyring/default.nix9
-rw-r--r--pkgs/development/python-modules/ldaptor/default.nix2
-rw-r--r--pkgs/development/python-modules/lektor/default.nix1
-rw-r--r--pkgs/development/python-modules/limits/default.nix2
-rw-r--r--pkgs/development/python-modules/magic-wormhole-mailbox-server/default.nix4
-rw-r--r--pkgs/development/python-modules/magic-wormhole/default.nix4
-rw-r--r--pkgs/development/python-modules/mkdocs-drawio-exporter/default.nix33
-rw-r--r--pkgs/development/python-modules/ocrmypdf/default.nix2
-rw-r--r--pkgs/development/python-modules/pamqp/default.nix42
-rw-r--r--pkgs/development/python-modules/passlib/default.nix8
-rw-r--r--pkgs/development/python-modules/pelican/default.nix2
-rw-r--r--pkgs/development/python-modules/pikepdf/default.nix2
-rw-r--r--pkgs/development/python-modules/pulumi-aws/default.nix44
-rw-r--r--pkgs/development/python-modules/pulumi/default.nix89
-rw-r--r--pkgs/development/python-modules/pure-python-adb/default.nix4
-rw-r--r--pkgs/development/python-modules/pygame/default.nix2
-rw-r--r--pkgs/development/python-modules/pygatt/default.nix4
-rw-r--r--pkgs/development/python-modules/pyglet/default.nix4
-rw-r--r--pkgs/development/python-modules/python-barcode/default.nix4
-rw-r--r--pkgs/development/python-modules/python-glanceclient/default.nix12
-rw-r--r--pkgs/development/python-modules/pytile/default.nix2
-rw-r--r--pkgs/development/python-modules/pytradfri/default.nix4
-rw-r--r--pkgs/development/python-modules/pywemo/default.nix6
-rw-r--r--pkgs/development/python-modules/rasterio/default.nix12
-rw-r--r--pkgs/development/python-modules/rdflib/default.nix6
-rw-r--r--pkgs/development/python-modules/redis/default.nix2
-rw-r--r--pkgs/development/python-modules/relatorio/default.nix4
-rw-r--r--pkgs/development/python-modules/requests-aws4auth/default.nix4
-rw-r--r--pkgs/development/python-modules/samsungctl/default.nix2
-rw-r--r--pkgs/development/python-modules/samsungtvws/default.nix6
-rw-r--r--pkgs/development/python-modules/sphinx/default.nix2
-rw-r--r--pkgs/development/python-modules/ssh-mitm/default.nix4
-rw-r--r--pkgs/development/python-modules/treq/default.nix2
-rw-r--r--pkgs/development/python-modules/trytond/default.nix6
-rw-r--r--pkgs/development/python-modules/twisted/default.nix2
-rw-r--r--pkgs/development/python-modules/txtorcon/default.nix2
-rw-r--r--pkgs/development/python-modules/vivisect/default.nix4
-rw-r--r--pkgs/development/python-modules/volvooncall/default.nix4
-rw-r--r--pkgs/development/python-modules/wheel/default.nix2
-rw-r--r--pkgs/development/tools/analysis/checkov/default.nix4
-rw-r--r--pkgs/development/tools/analysis/retdec/default.nix2
-rw-r--r--pkgs/development/tools/devpi-server/default.nix2
-rw-r--r--pkgs/development/tools/parsing/hammer/default.nix39
-rw-r--r--pkgs/development/tools/rust/sqlx-cli/default.nix13
-rw-r--r--pkgs/games/openra/default.nix2
-rw-r--r--pkgs/games/openra/engines.nix4
-rw-r--r--pkgs/games/openra/mods.nix28
-rw-r--r--pkgs/games/openra/packages.nix2
-rw-r--r--pkgs/games/xonotic/default.nix2
-rw-r--r--pkgs/os-specific/linux/apfs/default.nix10
-rw-r--r--pkgs/os-specific/linux/it87/default.nix13
-rw-r--r--pkgs/os-specific/linux/systemd/default.nix2
-rw-r--r--pkgs/os-specific/linux/zenpower/default.nix8
-rw-r--r--pkgs/servers/dns/ncdns/default.nix2
-rw-r--r--pkgs/servers/home-assistant/component-packages.nix18
-rw-r--r--pkgs/servers/home-assistant/default.nix5
-rwxr-xr-xpkgs/servers/home-assistant/parse-requirements.py6
-rw-r--r--pkgs/servers/home-assistant/tests.nix1
-rw-r--r--pkgs/servers/http/envoy/default.nix2
-rw-r--r--pkgs/servers/http/nginx/generic.nix2
-rw-r--r--pkgs/servers/radicale/3.x.nix2
-rw-r--r--pkgs/servers/roon-bridge/default.nix6
-rw-r--r--pkgs/servers/roon-server/default.nix4
-rw-r--r--pkgs/servers/sql/mariadb/default.nix20
-rw-r--r--pkgs/test/default.nix1
-rw-r--r--pkgs/tools/admin/pgadmin/default.nix1
-rw-r--r--pkgs/tools/admin/pulumi/update-pulumi-shell.nix8
-rwxr-xr-xpkgs/tools/admin/pulumi/update.sh2
-rw-r--r--pkgs/tools/archivers/p7zip/default.nix2
-rw-r--r--pkgs/tools/audio/abcmidi/default.nix4
-rw-r--r--pkgs/tools/filesystems/yandex-disk/default.nix13
-rw-r--r--pkgs/tools/graphics/vips/default.nix2
-rw-r--r--pkgs/tools/misc/dua/default.nix2
-rw-r--r--pkgs/tools/misc/dust/default.nix2
-rw-r--r--pkgs/tools/misc/dutree/default.nix2
-rw-r--r--pkgs/tools/misc/jdupes/default.nix2
-rw-r--r--pkgs/tools/misc/mutagen/default.nix2
-rw-r--r--pkgs/tools/misc/nautilus-open-any-terminal/default.nix4
-rw-r--r--pkgs/tools/networking/curl/default.nix4
-rw-r--r--pkgs/tools/networking/isync/default.nix1
-rw-r--r--pkgs/tools/networking/nbd/default.nix8
-rw-r--r--pkgs/tools/networking/oonf-olsrd2/default.nix7
-rw-r--r--pkgs/tools/networking/p2p/tahoe-lafs/default.nix4
-rw-r--r--pkgs/tools/package-management/nix-prefetch/default.nix2
-rw-r--r--pkgs/tools/security/chipsec/default.nix2
-rw-r--r--pkgs/tools/security/gopass/default.nix8
-rw-r--r--pkgs/tools/security/wapiti/default.nix4
-rw-r--r--pkgs/tools/text/difftastic/default.nix33
-rw-r--r--pkgs/tools/text/html-tidy/default.nix15
-rw-r--r--pkgs/top-level/aliases.nix1
-rw-r--r--pkgs/top-level/all-packages.nix25
-rw-r--r--pkgs/top-level/emscripten-packages.nix18
-rw-r--r--pkgs/top-level/php-packages.nix2
-rw-r--r--pkgs/top-level/python-packages.nix5
-rw-r--r--pkgs/top-level/release-cross.nix1
182 files changed, 1679 insertions, 579 deletions
diff --git a/doc/languages-frameworks/python.section.md b/doc/languages-frameworks/python.section.md
index fe28f94c069d3..9cb9d2ba7bfd7 100644
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@@ -982,12 +982,13 @@ in python.withPackages(ps: [ps.blaze])).env
 #### Optional extra dependencies
 
 Some packages define optional dependencies for additional features. With
-`setuptools` this is called `extras_require` and `flit` calls it `extras-require`. A
+`setuptools` this is called `extras_require` and `flit` calls it
+`extras-require`, while PEP 621 calls these `optional-dependencies`. A
 method for supporting this is by declaring the extras of a package in its
 `passthru`, e.g. in case of the package `dask`
 
 ```nix
-passthru.extras-require = {
+passthru.optional-dependencies = {
   complete = [ distributed ];
 };
 ```
@@ -997,7 +998,7 @@ and letting the package requiring the extra add the list to its dependencies
 ```nix
 propagatedBuildInputs = [
   ...
-] ++ dask.extras-require.complete;
+] ++ dask.optional-dependencies.complete;
 ```
 
 Note this method is preferred over adding parameters to builders, as that can
diff --git a/flake.nix b/flake.nix
index c48d6c68e5834..8c0403adc4a34 100644
--- a/flake.nix
+++ b/flake.nix
@@ -11,9 +11,7 @@
 
       lib = import ./lib;
 
-      systems = lib.systems.supported.hydra;
-
-      forAllSystems = f: lib.genAttrs systems (system: f system);
+      forAllSystems = f: lib.genAttrs lib.systems.flakeExposed (system: f system);
 
     in
     {
diff --git a/lib/systems/default.nix b/lib/systems/default.nix
index 7ddd5b8a58129..e02890b113861 100644
--- a/lib/systems/default.nix
+++ b/lib/systems/default.nix
@@ -8,7 +8,16 @@ rec {
   platforms = import ./platforms.nix { inherit lib; };
   examples = import ./examples.nix { inherit lib; };
   architectures = import ./architectures.nix { inherit lib; };
-  supported = import ./supported.nix { inherit lib; };
+
+  /* List of all Nix system doubles the nixpkgs flake will expose the package set
+     for. All systems listed here must be supported by nixpkgs as `localSystem`.
+
+     **Warning**: This attribute is considered experimental and is subject to change.
+  */
+  flakeExposed = import ./flake-systems.nix { };
+
+  # TODO(@sternenseemann): remove before 21.11
+  supported = throw "2022-05-23: Use lib.systems.flakeExposed instead of lib.systems.supported.hydra, as lib.systems.supported has been removed";
 
   # Elaborate a `localSystem` or `crossSystem` so that it contains everything
   # necessary.
diff --git a/lib/systems/doubles.nix b/lib/systems/doubles.nix
index 3cdebbc07c1fa..90a6eb9f35c97 100644
--- a/lib/systems/doubles.nix
+++ b/lib/systems/doubles.nix
@@ -41,7 +41,7 @@ let
     # none
     "aarch64_be-none" "aarch64-none" "arm-none" "armv6l-none" "avr-none" "i686-none"
     "msp430-none" "or1k-none" "m68k-none" "powerpc-none" "powerpcle-none"
-    "riscv32-none" "riscv64-none" "s390-none" "s390x-none" "vc4-none"
+    "riscv32-none" "riscv64-none" "rx-none" "s390-none" "s390x-none" "vc4-none"
     "x86_64-none"
 
     # OpenBSD
@@ -76,6 +76,7 @@ in {
   riscv         = filterDoubles predicates.isRiscV;
   riscv32       = filterDoubles predicates.isRiscV32;
   riscv64       = filterDoubles predicates.isRiscV64;
+  rx            = filterDoubles predicates.isRx;
   vc4           = filterDoubles predicates.isVc4;
   or1k          = filterDoubles predicates.isOr1k;
   m68k          = filterDoubles predicates.isM68k;
diff --git a/lib/systems/examples.nix b/lib/systems/examples.nix
index 997a7a8c273ae..170db6fb9fa0d 100644
--- a/lib/systems/examples.nix
+++ b/lib/systems/examples.nix
@@ -145,6 +145,11 @@ rec {
     libc = "newlib";
   };
 
+  rx-embedded = {
+    config = "rx-none-elf";
+    libc = "newlib";
+  };
+
   msp430 = {
     config = "msp430-elf";
     libc = "newlib";
diff --git a/lib/systems/flake-systems.nix b/lib/systems/flake-systems.nix
new file mode 100644
index 0000000000000..74124c32e8369
--- /dev/null
+++ b/lib/systems/flake-systems.nix
@@ -0,0 +1,29 @@
+# See [RFC 46] for mandated platform support and ../../pkgs/stdenv for
+# implemented platform support. This list is mainly descriptive, i.e. all
+# system doubles for platforms where nixpkgs can do native compiliation
+# reasonably well are included.
+#
+# [RFC 46]: https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md
+{ }:
+
+[
+  # Tier 1
+  "x86_64-linux"
+  # Tier 2
+  "aarch64-linux"
+  "x86_64-darwin"
+  # Tier 3
+  "armv6l-linux"
+  "armv7l-linux"
+  "i686-linux"
+  "mipsel-linux"
+
+  # Other platforms with sufficient support in stdenv which is not formally
+  # mandated by their platform tier.
+  "aarch64-darwin"
+  "armv5tel-linux"
+  "powerpc64le-linux"
+  "riscv64-linux"
+
+  # "x86_64-freebsd" is excluded because it is mostly broken
+]
diff --git a/lib/systems/inspect.nix b/lib/systems/inspect.nix
index 27c25deafec38..00cbe4f012cba 100644
--- a/lib/systems/inspect.nix
+++ b/lib/systems/inspect.nix
@@ -26,6 +26,7 @@ rec {
     isRiscV        = { cpu = { family = "riscv"; }; };
     isRiscV32      = { cpu = { family = "riscv"; bits = 32; }; };
     isRiscV64      = { cpu = { family = "riscv"; bits = 64; }; };
+    isRx           = { cpu = { family = "rx"; }; };
     isSparc        = { cpu = { family = "sparc"; }; };
     isWasm         = { cpu = { family = "wasm"; }; };
     isMsp430       = { cpu = { family = "msp430"; }; };
diff --git a/lib/systems/parse.nix b/lib/systems/parse.nix
index 3ceddbb599b9c..bf436ec8db579 100644
--- a/lib/systems/parse.nix
+++ b/lib/systems/parse.nix
@@ -116,6 +116,7 @@ rec {
 
     alpha    = { bits = 64; significantByte = littleEndian; family = "alpha"; };
 
+    rx       = { bits = 32; significantByte = littleEndian; family = "rx"; };
     msp430   = { bits = 16; significantByte = littleEndian; family = "msp430"; };
     avr      = { bits = 8; family = "avr"; };
 
diff --git a/lib/systems/supported.nix b/lib/systems/supported.nix
deleted file mode 100644
index a1c038a5c8bc0..0000000000000
--- a/lib/systems/supported.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-# Supported systems according to RFC0046's definition.
-#
-# https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md
-{ lib }:
-rec {
-  # List of systems that are built by Hydra.
-  hydra = tier1 ++ tier2 ++ tier3 ++ [
-    "aarch64-darwin"
-  ];
-
-  tier1 = [
-    "x86_64-linux"
-  ];
-
-  tier2 = [
-    "aarch64-linux"
-    "x86_64-darwin"
-  ];
-
-  tier3 = [
-    "armv6l-linux"
-    "armv7l-linux"
-    "i686-linux"
-    "mipsel-linux"
-  ];
-}
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index d8eaff4a0d8d2..654311d6e287e 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -14607,4 +14607,10 @@
       fingerprint = "41EA 00B4 00F9 6970 1CB2  D3AF EF90 E3E9 8B8F 5C0B";
     }];
   };
+  snpschaaf = {
+    email = "philipe.schaaf@secunet.com";
+    name = "Philippe Schaaf";
+    github = "snpschaaf";
+    githubId = 105843013;
+  };
 }
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
index a660e28af04aa..b3d6b6a1b956b 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@@ -585,6 +585,15 @@
       </listitem>
       <listitem>
         <para>
+          <literal>lib.systems.supported</literal> has been removed, as
+          it was overengineered for determining the systems to support
+          in the nixpkgs flake. The list of systems exposed by the
+          nixpkgs flake can now be accessed as
+          <literal>lib.systems.flakeExposed</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
           For new installations
           <literal>virtualisation.oci-containers.backend</literal> is
           now set to <literal>podman</literal> by default. If you still
diff --git a/nixos/doc/manual/release-notes/rl-2205.section.md b/nixos/doc/manual/release-notes/rl-2205.section.md
index 96b138aa82e2d..f8dc78eac7ebf 100644
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@@ -193,6 +193,8 @@ In addition to numerous new and upgraded packages, this release has the followin
   This is to improve compatibility with `libcontainer` based software such as Podman and Skopeo
   which assumes they have ownership over `/etc/containers`.
 
+- `lib.systems.supported` has been removed, as it was overengineered for determining the systems to support in the nixpkgs flake. The list of systems exposed by the nixpkgs flake can now be accessed as `lib.systems.flakeExposed`.
+
 - For new installations `virtualisation.oci-containers.backend` is now set to `podman` by default.
   If you still want to use Docker on systems where `system.stateVersion` is set to to `"22.05"` set `virtualisation.oci-containers.backend = "docker";`.Old systems with older `stateVersion`s stay with "docker".
 
diff --git a/nixos/modules/config/update-users-groups.pl b/nixos/modules/config/update-users-groups.pl
index 26ce561013b6f..5a21cb45d52be 100644
--- a/nixos/modules/config/update-users-groups.pl
+++ b/nixos/modules/config/update-users-groups.pl
@@ -223,10 +223,10 @@ foreach my $u (@{$spec->{users}}) {
     }
 
     # Ensure home directory incl. ownership and permissions.
-    if ($u->{createHome}) {
-        make_path($u->{home}, { mode => 0700 }) if ! -e $u->{home} and ! $is_dry;
+    if ($u->{createHome} and !$is_dry) {
+        make_path($u->{home}, { mode => oct($u->{homeMode}) }) if ! -e $u->{home};
         chown $u->{uid}, $u->{gid}, $u->{home};
-        chmod 0700, $u->{home};
+        chmod oct($u->{homeMode}), $u->{home};
     }
 
     if (defined $u->{passwordFile}) {
diff --git a/nixos/modules/config/users-groups.nix b/nixos/modules/config/users-groups.nix
index b0f96c754fa53..d3bdf218c3392 100644
--- a/nixos/modules/config/users-groups.nix
+++ b/nixos/modules/config/users-groups.nix
@@ -48,7 +48,7 @@ let
     services such as SSH, or indirectly via <command>su</command> or
     <command>sudo</command>). This should only be used for e.g. bootable
     live systems. Note: this is different from setting an empty password,
-    which ca be achieved using <option>users.users.&lt;name?&gt;.password</option>.
+    which can be achieved using <option>users.users.&lt;name?&gt;.password</option>.
 
     If set to <literal>null</literal> (default) this user will not
     be able to log in using a password (i.e. via <command>login</command>
@@ -139,6 +139,12 @@ let
         description = "The user's home directory.";
       };
 
+      homeMode = mkOption {
+        type = types.strMatching "[0-7]{1,5}";
+        default = "700";
+        description = "The user's home directory mode in numeric format. See chmod(1). The mode is only applied if <option>users.users.&lt;name&gt;.createHome</option> is true.";
+      };
+
       cryptHomeLuks = mkOption {
         type = with types; nullOr str;
         default = null;
@@ -319,6 +325,7 @@ let
           group = mkDefault "users";
           createHome = mkDefault true;
           home = mkDefault "/home/${config.name}";
+          homeMode = mkDefault "700";
           useDefaultShell = mkDefault true;
           isSystemUser = mkDefault false;
         })
@@ -430,7 +437,7 @@ let
     inherit (cfg) mutableUsers;
     users = mapAttrsToList (_: u:
       { inherit (u)
-          name uid group description home createHome isSystemUser
+          name uid group description home homeMode createHome isSystemUser
           password passwordFile hashedPassword
           autoSubUidGidRange subUidRanges subGidRanges
           initialPassword initialHashedPassword;
diff --git a/nixos/modules/services/networking/mosquitto.nix b/nixos/modules/services/networking/mosquitto.nix
index b41a2fd27be2f..256d9457d3960 100644
--- a/nixos/modules/services/networking/mosquitto.nix
+++ b/nixos/modules/services/networking/mosquitto.nix
@@ -199,6 +199,7 @@ let
     allow_anonymous = 1;
     allow_zero_length_clientid = 1;
     auto_id_prefix = 1;
+    bind_interface = 1;
     cafile = 1;
     capath = 1;
     certfile = 1;
@@ -295,7 +296,7 @@ let
   };
 
   listenerAsserts = prefix: listener:
-    assertKeysValid prefix freeformListenerKeys listener.settings
+    assertKeysValid "${prefix}.settings" freeformListenerKeys listener.settings
     ++ userAsserts prefix listener.users
     ++ imap0
       (i: v: authAsserts "${prefix}.authPlugins.${toString i}" v)
@@ -397,7 +398,7 @@ let
   };
 
   bridgeAsserts = prefix: bridge:
-    assertKeysValid prefix freeformBridgeKeys bridge.settings
+    assertKeysValid "${prefix}.settings" freeformBridgeKeys bridge.settings
     ++ [ {
       assertion = length bridge.addresses > 0;
       message = "Bridge ${prefix} needs remote broker addresses";
@@ -526,7 +527,7 @@ let
 
   globalAsserts = prefix: cfg:
     flatten [
-      (assertKeysValid prefix freeformGlobalKeys cfg.settings)
+      (assertKeysValid "${prefix}.settings" freeformGlobalKeys cfg.settings)
       (imap0 (n: l: listenerAsserts "${prefix}.listener.${toString n}" l) cfg.listeners)
       (mapAttrsToList (n: b: bridgeAsserts "${prefix}.bridge.${n}" b) cfg.bridges)
     ];
@@ -629,9 +630,10 @@ in
                ]));
         RemoveIPC = true;
         RestrictAddressFamilies = [
-          "AF_UNIX"  # for sd_notify() call
+          "AF_UNIX"
           "AF_INET"
           "AF_INET6"
+          "AF_NETLINK"
         ];
         RestrictNamespaces = true;
         RestrictRealtime = true;
diff --git a/nixos/modules/system/boot/plymouth.nix b/nixos/modules/system/boot/plymouth.nix
index 8b57cae3c40da..59037d4e6b4d8 100644
--- a/nixos/modules/system/boot/plymouth.nix
+++ b/nixos/modules/system/boot/plymouth.nix
@@ -282,18 +282,18 @@ in
       EOF
     '';
 
-    boot.initrd.extraUtilsCommandsTest = mkIf (!config.boot.initrd.enable) ''
+    boot.initrd.extraUtilsCommandsTest = mkIf (!config.boot.initrd.systemd.enable) ''
       $out/bin/plymouthd --help >/dev/null
       $out/bin/plymouth --help >/dev/null
     '';
 
-    boot.initrd.extraUdevRulesCommands = mkIf (!config.boot.initrd.enable) ''
+    boot.initrd.extraUdevRulesCommands = mkIf (!config.boot.initrd.systemd.enable) ''
       cp ${config.systemd.package}/lib/udev/rules.d/{70-uaccess,71-seat}.rules $out
       sed -i '/loginctl/d' $out/71-seat.rules
     '';
 
     # We use `mkAfter` to ensure that LUKS password prompt would be shown earlier than the splash screen.
-    boot.initrd.preLVMCommands = mkIf (!config.boot.initrd.enable) (mkAfter ''
+    boot.initrd.preLVMCommands = mkIf (!config.boot.initrd.systemd.enable) (mkAfter ''
       mkdir -p /etc/plymouth
       mkdir -p /run/plymouth
       ln -s ${configFile} /etc/plymouth/plymouthd.conf
@@ -307,12 +307,12 @@ in
       plymouth show-splash
     '');
 
-    boot.initrd.postMountCommands = mkIf (!config.boot.initrd.enable) ''
+    boot.initrd.postMountCommands = mkIf (!config.boot.initrd.systemd.enable) ''
       plymouth update-root-fs --new-root-dir="$targetRoot"
     '';
 
     # `mkBefore` to ensure that any custom prompts would be visible.
-    boot.initrd.preFailCommands = mkIf (!config.boot.initrd.enable) (mkBefore ''
+    boot.initrd.preFailCommands = mkIf (!config.boot.initrd.systemd.enable) (mkBefore ''
       plymouth quit --wait
     '');
 
diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index 2c9ee9fc319fc..679c5210a6b32 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -35,11 +35,11 @@ let
       "nss-lookup.target"
       "nss-user-lookup.target"
       "time-sync.target"
-    ] ++ (optionals cfg.package.withCryptsetup [
+    ] ++ optionals cfg.package.withCryptsetup [
       "cryptsetup.target"
       "cryptsetup-pre.target"
       "remote-cryptsetup.target"
-    ]) ++ [
+    ] ++ [
       "sigpwr.target"
       "timers.target"
       "paths.target"
@@ -133,20 +133,27 @@ let
 
       # Slices / containers.
       "slices.target"
+    ] ++ optionals cfg.package.withImportd [
+      "systemd-importd.service"
+    ] ++ optionals cfg.package.withMachined [
       "machine.slice"
       "machines.target"
-      "systemd-importd.service"
       "systemd-machined.service"
+    ] ++ [
       "systemd-nspawn@.service"
 
       # Misc.
       "systemd-sysctl.service"
+    ] ++ optionals cfg.package.withTimedated [
       "dbus-org.freedesktop.timedate1.service"
-      "dbus-org.freedesktop.locale1.service"
-      "dbus-org.freedesktop.hostname1.service"
       "systemd-timedated.service"
+    ] ++ optionals cfg.package.withLocaled [
+      "dbus-org.freedesktop.locale1.service"
       "systemd-localed.service"
+    ] ++ optionals cfg.package.withHostnamed [
+      "dbus-org.freedesktop.hostname1.service"
       "systemd-hostnamed.service"
+    ] ++ [
       "systemd-exit.service"
       "systemd-update-done.service"
     ] ++ cfg.additionalUpstreamSystemUnits;
diff --git a/nixos/modules/system/boot/systemd/logind.nix b/nixos/modules/system/boot/systemd/logind.nix
index c1e6cfe61d041..97ac588bce174 100644
--- a/nixos/modules/system/boot/systemd/logind.nix
+++ b/nixos/modules/system/boot/systemd/logind.nix
@@ -81,8 +81,11 @@ in
       "systemd-logind.service"
       "autovt@.service"
       "systemd-user-sessions.service"
+    ] ++ optionals config.systemd.package.withImportd [
       "dbus-org.freedesktop.import1.service"
+    ] ++ optionals config.systemd.package.withMachined [
       "dbus-org.freedesktop.machine1.service"
+    ] ++ [
       "dbus-org.freedesktop.login1.service"
       "user@.service"
       "user-runtime-dir@.service"
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 84433806b48cc..f4b6ee73562eb 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -365,6 +365,7 @@ in
   nginx = handleTest ./nginx.nix {};
   nginx-auth = handleTest ./nginx-auth.nix {};
   nginx-etag = handleTest ./nginx-etag.nix {};
+  nginx-http3 = handleTest ./nginx-http3.nix {};
   nginx-modsecurity = handleTest ./nginx-modsecurity.nix {};
   nginx-pubhtml = handleTest ./nginx-pubhtml.nix {};
   nginx-sandbox = handleTestOn ["x86_64-linux"] ./nginx-sandbox.nix {};
@@ -579,6 +580,7 @@ in
   uptermd = handleTest ./uptermd.nix {};
   usbguard = handleTest ./usbguard.nix {};
   user-activation-scripts = handleTest ./user-activation-scripts.nix {};
+  user-home-mode = handleTest ./user-home-mode.nix {};
   uwsgi = handleTest ./uwsgi.nix {};
   v2ray = handleTest ./v2ray.nix {};
   vault = handleTest ./vault.nix {};
diff --git a/nixos/tests/mosquitto.nix b/nixos/tests/mosquitto.nix
index 36cc8e3e3d9bd..d516d3373d9f6 100644
--- a/nixos/tests/mosquitto.nix
+++ b/nixos/tests/mosquitto.nix
@@ -4,6 +4,7 @@ let
   port = 1888;
   tlsPort = 1889;
   anonPort = 1890;
+  bindTestPort = 1891;
   password = "VERY_secret";
   hashedPassword = "$7$101$/WJc4Mp+I+uYE9sR$o7z9rD1EYXHPwEP5GqQj6A7k4W1yVbePlb8TqNcuOLV9WNCiDgwHOB0JHC1WCtdkssqTBduBNUnUGd6kmZvDSw==";
   topic = "test/foo";
@@ -125,6 +126,10 @@ in {
               };
             };
           }
+          {
+            settings.bind_interface = "eth0";
+            port = bindTestPort;
+          }
         ];
       };
     };
@@ -134,6 +139,8 @@ in {
   };
 
   testScript = ''
+    import json
+
     def mosquitto_cmd(binary, user, topic, port):
         return (
             "mosquitto_{} "
@@ -162,6 +169,27 @@ in {
     start_all()
     server.wait_for_unit("mosquitto.service")
 
+    with subtest("bind_interface"):
+        addrs = dict()
+        for iface in json.loads(server.succeed("ip -json address show")):
+            for addr in iface['addr_info']:
+                # don't want to deal with multihoming here
+                assert addr['local'] not in addrs
+                addrs[addr['local']] = (iface['ifname'], addr['family'])
+
+        # mosquitto grabs *one* random address per type for bind_interface
+        (has4, has6) = (False, False)
+        for line in server.succeed("ss -HlptnO sport = ${toString bindTestPort}").splitlines():
+            items = line.split()
+            if "mosquitto" not in items[5]: continue
+            listener = items[3].rsplit(':', maxsplit=1)[0].strip('[]')
+            assert listener in addrs
+            assert addrs[listener][0] == "eth0"
+            has4 |= addrs[listener][1] == 'inet'
+            has6 |= addrs[listener][1] == 'inet6'
+        assert has4
+        assert has6
+
     with subtest("check passwords"):
         client1.succeed(publish("-m test", "password_store"))
         client1.succeed(publish("-m test", "password_file"))
diff --git a/nixos/tests/mysql/mysql-backup.nix b/nixos/tests/mysql/mysql-backup.nix
index 9335b233327a7..968f56dd3c9bd 100644
--- a/nixos/tests/mysql/mysql-backup.nix
+++ b/nixos/tests/mysql/mysql-backup.nix
@@ -51,7 +51,6 @@ let
 
       # Do a backup and wait for it to start
       master.start_job("mysql-backup.service")
-      master.wait_for_unit("mysql-backup.service")
 
       # wait for backup to fail, because of database 'doesnotexist'
       master.wait_until_fails("systemctl is-active -q mysql-backup.service")
diff --git a/nixos/tests/nginx-http3.nix b/nixos/tests/nginx-http3.nix
new file mode 100644
index 0000000000000..edd0759464c8a
--- /dev/null
+++ b/nixos/tests/nginx-http3.nix
@@ -0,0 +1,90 @@
+import ./make-test-python.nix ({lib, pkgs, ...}:
+let
+  hosts = ''
+    192.168.2.101 acme.test
+  '';
+
+in
+{
+  name = "nginx-http3";
+  meta.maintainers = with pkgs.lib.maintainers; [ izorkin ];
+
+  nodes = {
+    server = { pkgs, ... }: {
+      networking = {
+        interfaces.eth1 = {
+          ipv4.addresses = [
+            { address = "192.168.2.101"; prefixLength = 24; }
+          ];
+        };
+        extraHosts = hosts;
+        firewall.allowedTCPPorts = [ 443 ];
+        firewall.allowedUDPPorts = [ 443 ];
+      };
+
+      security.pki.certificates = [
+        (builtins.readFile ./common/acme/server/ca.cert.pem)
+      ];
+
+      services.nginx = {
+        enable = true;
+        package = pkgs.nginxQuic;
+
+        virtualHosts."acme.test" = {
+          onlySSL = true;
+          sslCertificate = ./common/acme/server/acme.test.cert.pem;
+          sslCertificateKey = ./common/acme/server/acme.test.key.pem;
+          http2 = true;
+          http3 = true;
+          reuseport = true;
+          root = lib.mkForce (pkgs.runCommandLocal "testdir2" {} ''
+            mkdir "$out"
+            cat > "$out/index.html" <<EOF
+            <html><body>Hello World!</body></html>
+            EOF
+            cat > "$out/example.txt" <<EOF
+            Check http3 protocol.
+            EOF
+          '');
+        };
+      };
+    };
+
+    client = { pkgs, ... }: {
+      environment.systemPackages = [ pkgs.curlHTTP3 ];
+      networking = {
+        interfaces.eth1 = {
+          ipv4.addresses = [
+            { address = "192.168.2.201"; prefixLength = 24; }
+          ];
+        };
+        extraHosts = hosts;
+      };
+
+      security.pki.certificates = [
+        (builtins.readFile ./common/acme/server/ca.cert.pem)
+      ];
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    # Check http connections
+    client.succeed("curl --verbose --http3 https://acme.test | grep 'Hello World!'")
+
+    # Check downloadings
+    client.succeed("curl --verbose --http3 https://acme.test/example.txt --output /tmp/example.txt")
+    client.succeed("cat /tmp/example.txt | grep 'Check http3 protocol.'")
+
+    # Check header reading
+    client.succeed("curl --verbose --http3 --head https://acme.test | grep 'content-type'")
+
+    # Check change User-Agent
+    client.succeed("curl --verbose --http3 --user-agent 'Curl test 3.0' https://acme.test")
+    server.succeed("cat /var/log/nginx/access.log | grep 'Curl test 3.0'")
+
+    server.shutdown()
+    client.shutdown()
+  '';
+})
diff --git a/nixos/tests/user-home-mode.nix b/nixos/tests/user-home-mode.nix
new file mode 100644
index 0000000000000..1366d102a99b3
--- /dev/null
+++ b/nixos/tests/user-home-mode.nix
@@ -0,0 +1,27 @@
+import ./make-test-python.nix ({ lib, ... }: {
+  name = "user-home-mode";
+  meta = with lib.maintainers; { maintainers = [ fbeffa ]; };
+
+  nodes.machine = {
+    users.users.alice = {
+      initialPassword = "pass1";
+      isNormalUser = true;
+    };
+    users.users.bob = {
+      initialPassword = "pass2";
+      isNormalUser = true;
+      homeMode = "750";
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_for_unit("getty@tty1.service")
+    machine.wait_until_tty_matches(1, "login: ")
+    machine.send_chars("alice\n")
+    machine.wait_until_tty_matches(1, "Password: ")
+    machine.send_chars("pass1\n")
+    machine.succeed('[ "$(stat -c %a /home/alice)" == "700" ]')
+    machine.succeed('[ "$(stat -c %a /home/bob)" == "750" ]')
+  '';
+})
diff --git a/pkgs/applications/audio/mpg321/default.nix b/pkgs/applications/audio/mpg321/default.nix
index 03aee52f2a90c..593b837704a37 100644
--- a/pkgs/applications/audio/mpg321/default.nix
+++ b/pkgs/applications/audio/mpg321/default.nix
@@ -19,6 +19,11 @@ stdenv.mkDerivation rec {
       url = "https://sources.debian.org/data/main/m/mpg321/0.3.2-3/debian/patches/handle_illegal_bitrate_value.patch";
       sha256 = "15simp5fjvm9b024ryfh441rkh2d5bcrizqkzlrh07n9sm7fkw6x";
     })
+    # Apple defines semun already. Skip redefining it to fix build errors.
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/Homebrew/formula-patches/85fa66a9/mpg321/0.3.2.patch";
+      sha256 = "sha256-qFYpKpE9PZSzOJrnsQINZi6FvUVX0anRyOvlF5eOYqE=";
+    })
   ];
 
   hardeningDisable = [ "format" ];
@@ -37,6 +42,6 @@ stdenv.mkDerivation rec {
     description = "Command-line MP3 player";
     homepage = "http://mpg321.sourceforge.net/";
     license = licenses.gpl2;
-    platforms = platforms.gnu ++ platforms.linux;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/applications/audio/ocenaudio/default.nix b/pkgs/applications/audio/ocenaudio/default.nix
index c927d8997ed82..8fe6beebc4b8d 100644
--- a/pkgs/applications/audio/ocenaudio/default.nix
+++ b/pkgs/applications/audio/ocenaudio/default.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ocenaudio";
-  version = "3.11.10";
+  version = "3.11.11";
 
   src = fetchurl {
     url = "https://www.ocenaudio.com/downloads/index.php/ocenaudio_debian9_64.deb?version=${version}";
-    sha256 = "sha256-Ah6Ni5EbFdIQ/wN7uGeMrSP5ybQfI4iy9gI1VT5LztU=";
+    sha256 = "sha256-S3Fqg5DjhVoYwfF3A/P7WcOUsU1x+IGwLopyNA3FkRQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/blockchains/sparrow/default.nix b/pkgs/applications/blockchains/sparrow/default.nix
new file mode 100644
index 0000000000000..662164a9f6f3d
--- /dev/null
+++ b/pkgs/applications/blockchains/sparrow/default.nix
@@ -0,0 +1,232 @@
+{ stdenv
+, lib
+, makeWrapper
+, fetchurl
+, makeDesktopItem
+, copyDesktopItems
+, autoPatchelfHook
+, openjdk17
+, gtk3
+, gsettings-desktop-schemas
+, writeScript
+, bash
+, gnugrep
+, tor
+, zlib
+, openimajgrabber
+, hwi
+, imagemagick
+}:
+
+let
+  pname = "sparrow";
+  version = "1.6.4";
+
+  src = fetchurl {
+    url = "https://github.com/sparrowwallet/${pname}/releases/download/${version}/${pname}-${version}.tar.gz";
+    sha256 = "1wdibpbhv3g6qk42ddfc5vyqkkwprczy45w5wi115qg3g1rf1in7";
+  };
+
+  launcher = writeScript "sparrow" ''
+    #! ${bash}/bin/bash
+    params=(
+      --module-path @out@/lib:@jdkModules@/modules
+      --add-opens javafx.graphics/com.sun.javafx.css=org.controlsfx.controls
+      --add-opens javafx.graphics/javafx.scene=org.controlsfx.controls
+      --add-opens javafx.controls/com.sun.javafx.scene.control.behavior=org.controlsfx.controls
+      --add-opens javafx.controls/com.sun.javafx.scene.control.inputmap=org.controlsfx.controls
+      --add-opens javafx.graphics/com.sun.javafx.scene.traversal=org.controlsfx.controls
+      --add-opens javafx.base/com.sun.javafx.event=org.controlsfx.controls
+      --add-opens javafx.controls/javafx.scene.control.cell=com.sparrowwallet.sparrow
+      --add-opens org.controlsfx.controls/impl.org.controlsfx.skin=com.sparrowwallet.sparrow
+      --add-opens org.controlsfx.controls/impl.org.controlsfx.skin=javafx.fxml
+      --add-opens javafx.graphics/com.sun.javafx.tk=centerdevice.nsmenufx
+      --add-opens javafx.graphics/com.sun.javafx.tk.quantum=centerdevice.nsmenufx
+      --add-opens javafx.graphics/com.sun.glass.ui=centerdevice.nsmenufx
+      --add-opens javafx.controls/com.sun.javafx.scene.control=centerdevice.nsmenufx
+      --add-opens javafx.graphics/com.sun.javafx.menu=centerdevice.nsmenufx
+      --add-opens javafx.graphics/com.sun.glass.ui=com.sparrowwallet.sparrow
+      --add-opens javafx.graphics/com.sun.javafx.application=com.sparrowwallet.sparrow
+      --add-opens java.base/java.net=com.sparrowwallet.sparrow
+      --add-opens java.base/java.io=com.google.gson
+      --add-reads com.sparrowwallet.merged.module=java.desktop
+      --add-reads com.sparrowwallet.merged.module=java.sql
+      --add-reads com.sparrowwallet.merged.module=com.sparrowwallet.sparrow
+      --add-reads com.sparrowwallet.merged.module=logback.classic
+      --add-reads com.sparrowwallet.merged.module=com.fasterxml.jackson.databind
+      --add-reads com.sparrowwallet.merged.module=com.fasterxml.jackson.annotation
+      --add-reads com.sparrowwallet.merged.module=com.fasterxml.jackson.core
+      --add-reads com.sparrowwallet.merged.module=co.nstant.in.cbor
+      -m com.sparrowwallet.sparrow
+    )
+
+    XDG_DATA_DIRS=${gsettings-desktop-schemas}/share/gsettings-schemas/${gsettings-desktop-schemas.name}:${gtk3}/share/gsettings-schemas/${gtk3.name}:$XDG_DATA_DIRS ${openjdk17}/bin/java ''${params[@]} $@
+  '';
+
+  torWrapper = writeScript "tor-wrapper" ''
+    #! ${bash}/bin/bash
+
+    exec ${tor}/bin/tor "$@"
+  '';
+
+  jdk-modules = stdenv.mkDerivation {
+    name = "jdk-modules";
+    nativeBuildInputs = [ openjdk17 ];
+    dontUnpack = true;
+
+    buildPhase = ''
+      # Extract the JDK's JIMAGE and generate a list of modules.
+      mkdir modules
+      pushd modules
+      jimage extract ${openjdk17}/lib/openjdk/lib/modules
+      ls | xargs -d " " -- echo > ../manifest.txt
+      popd
+    '';
+
+    installPhase = ''
+      mkdir -p $out
+      cp manifest.txt $out/
+      cp -r modules/ $out/
+    '';
+  };
+
+  sparrow-modules = stdenv.mkDerivation {
+    pname = "sparrow-modules";
+    inherit version src;
+    nativeBuildInputs = [ makeWrapper gnugrep openjdk17 autoPatchelfHook stdenv.cc.cc.lib zlib ];
+
+    buildPhase = ''
+      # Extract Sparrow's JIMAGE and generate a list of them.
+      mkdir modules
+      pushd modules
+      jimage extract ../lib/runtime/lib/modules
+
+      # Delete JDK modules
+      cat ${jdk-modules}/manifest.txt | xargs -I {} -- rm -fR {}
+
+      # Delete unneeded native libs.
+
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/freebsd-x86-64
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/freebsd-x86
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-aarch64
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-arm
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-armel
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-mips64el
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-ppc
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-ppc64le
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-s390x
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/linux-x86
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/openbsd-x86-64
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/openbsd-x86
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/sunos-sparc
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/sunos-sparcv9
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/sunos-x86-64
+      rm -fR com.sparrowwallet.merged.module/com/sun/jna/sunos-x86
+      rm -fR com.github.sarxos.webcam.capture/com/github/sarxos/webcam/ds/buildin/lib/linux_armel
+      rm -fR com.github.sarxos.webcam.capture/com/github/sarxos/webcam/ds/buildin/lib/linux_armhf
+      rm -fR com.github.sarxos.webcam.capture/com/github/sarxos/webcam/ds/buildin/lib/linux_x86
+      rm com.github.sarxos.webcam.capture/com/github/sarxos/webcam/ds/buildin/lib/linux_x64/OpenIMAJGrabber.so
+      rm -fR com.nativelibs4java.bridj/org/bridj/lib/linux_arm32_armel
+      rm -fR com.nativelibs4java.bridj/org/bridj/lib/linux_armel
+      rm -fR com.nativelibs4java.bridj/org/bridj/lib/linux_armhf
+      rm -fR com.nativelibs4java.bridj/org/bridj/lib/linux_x86
+      rm -fR com.nativelibs4java.bridj/org/bridj/lib/sunos_x64
+      rm -fR com.nativelibs4java.bridj/org/bridj/lib/sunos_x86
+      rm -fR com.sparrowwallet.merged.module/linux-aarch64
+      rm -fR com.sparrowwallet.merged.module/linux-arm
+      rm -fR com.sparrowwallet.merged.module/linux-x86
+      rm com.sparrowwallet.sparrow/native/linux/x64/hwi
+
+      ls | xargs -d " " -- echo > ../manifest.txt
+      find . | grep "\.so$" | xargs -- chmod ugo+x
+      popd
+
+      # Replace the embedded Tor binary (which is in a Tar archive)
+      # with one from Nixpkgs.
+      cp ${torWrapper} ./tor
+      tar -cJf tor.tar.xz tor
+      cp tor.tar.xz modules/netlayer.jpms/native/linux/x64/tor.tar.xz
+    '';
+
+    installPhase = ''
+      mkdir -p $out
+      cp manifest.txt $out/
+      cp -r modules/ $out/
+      ln -s ${openimajgrabber}/lib/OpenIMAJGrabber.so $out/modules/com.github.sarxos.webcam.capture/com/github/sarxos/webcam/ds/buildin/lib/linux_x64/OpenIMAJGrabber.so
+      ln -s ${hwi}/bin/hwi $out/modules/com.sparrowwallet.sparrow/native/linux/x64/hwi
+    '';
+  };
+
+  # To use the udev rules for connected hardware wallets,
+  # add "pkgs.sparrow" to "services.udev.packages" and add user accounts to the user group "plugdev".
+  udev-rules = stdenv.mkDerivation {
+    name = "sparrow-udev";
+
+    src = let version = "2.0.2"; in
+      fetchurl {
+        url = "https://github.com/bitcoin-core/HWI/releases/download/${version}/hwi-${version}.tar.gz";
+        sha256 = "sha256-di1fRsMbwpHcBFNTCVivfxpwhUoUKLA3YTnJxKq/jHM=";
+      };
+
+    installPhase = ''
+      mkdir -p $out/etc/udev/rules.d
+      cp -a hwilib/udev/* $out/etc/udev/rules.d
+      rm $out/etc/udev/rules.d/README.md
+    '';
+  };
+in
+stdenv.mkDerivation rec {
+  inherit pname version src;
+  nativeBuildInputs = [ makeWrapper copyDesktopItems ];
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "Sparrow";
+      exec = pname;
+      icon = pname;
+      desktopName = "Sparrow Bitcoin Wallet";
+      genericName = "Bitcoin Wallet";
+      categories = [ "Finance" ];
+    })
+  ];
+
+  sparrow-icons = stdenv.mkDerivation {
+    inherit version src;
+    pname = "sparrow-icons";
+    nativeBuildInputs = [ imagemagick ];
+
+    installPhase = ''
+      for n in 16 24 32 48 64 96 128 256; do
+        size=$n"x"$n
+        mkdir -p $out/hicolor/$size/apps
+        convert lib/Sparrow.png -resize $size $out/hicolor/$size/apps/sparrow.png
+        done;
+    '';
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin $out
+    ln -s ${sparrow-modules}/modules $out/lib
+    install -D -m 777 ${launcher} $out/bin/sparrow
+    substituteAllInPlace $out/bin/sparrow
+    substituteInPlace $out/bin/sparrow --subst-var-by jdkModules ${jdk-modules}
+
+    mkdir -p $out/share/icons
+    ln -s ${sparrow-icons}/hicolor $out/share/icons
+
+    mkdir -p $out/etc/udev
+    ln -s ${udev-rules}/etc/udev/rules.d $out/etc/udev/rules.d
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "A modern desktop Bitcoin wallet application supporting most hardware wallets and built on common standards such as PSBT, with an emphasis on transparency and usability.";
+    homepage = "https://sparrowwallet.com";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ emmanuelrosa _1000101 ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/applications/blockchains/sparrow/openimajgrabber.nix b/pkgs/applications/blockchains/sparrow/openimajgrabber.nix
new file mode 100644
index 0000000000000..0bf642d49d1ca
--- /dev/null
+++ b/pkgs/applications/blockchains/sparrow/openimajgrabber.nix
@@ -0,0 +1,40 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, libv4l
+}:
+stdenv.mkDerivation rec {
+  pname = "openimajgrabber";
+  version = "1.3.10";
+
+  src = fetchFromGitHub {
+    owner = "openimaj";
+    repo = "openimaj";
+    rev = "openimaj-${version}";
+    sha256 = "sha256-Y8707ovE7f6Fk3cJ+PtwvzNpopgH5vlF55m2Xm4hjYM=";
+  };
+
+  buildInputs = [ libv4l ];
+
+  # These build instructions come from build.sh
+  buildPhase = ''
+    pushd hardware/core-video-capture/src-native/linux
+    g++ -fPIC -g -c OpenIMAJGrabber.cpp
+    g++ -fPIC -g -c capture.cpp
+    g++ -shared -Wl,-soname,OpenIMAJGrabber.so -o OpenIMAJGrabber.so OpenIMAJGrabber.o capture.o -lv4l2 -lrt -lv4lconvert
+    popd
+  '';
+
+  installPhase = ''
+    mkdir -p $out/lib
+    cp hardware/core-video-capture/src-native/linux/OpenIMAJGrabber.so $out/lib
+  '';
+
+  meta = with lib; {
+    description = "A collection of libraries and tools for multimedia (images, text, video, audio, etc.) content analysis and content generation. This package only builds the OpenIMAJGrabber for Linux.";
+    homepage = "http://www.openimaj.org";
+    license = licenses.bsd0;
+    maintainers = with maintainers; [ emmanuelrosa _1000101 ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/applications/editors/eclipse/plugins.nix b/pkgs/applications/editors/eclipse/plugins.nix
index 8abf835eb4d86..c1217e2123c4b 100644
--- a/pkgs/applications/editors/eclipse/plugins.nix
+++ b/pkgs/applications/editors/eclipse/plugins.nix
@@ -345,7 +345,7 @@ rec {
     src = fetchzip {
       url = "https://download.jboss.org/drools/release/${version}/droolsjbpm-tools-distribution-${version}.zip";
       sha512 = "2qzc1iszqfrfnw8xip78n3kp6hlwrvrr708vlmdk7nv525xhs0ssjaxriqdhcr0s6jripmmazxivv3763rnk2bfkh31hmbnckpx4r3m";
-      extraPostFetch = ''
+      postFetch = ''
         # update site is a couple levels deep, alongside some other irrelevant stuff
         cd $out;
         find . -type f -not -path ./binaries/org.drools.updatesite/\* -exec rm {} \;
@@ -507,7 +507,7 @@ rec {
       stripRoot = false;
       url = "https://github.com/${owner}/${repo}/archive/${rev}.zip";
       sha256 = "1xfj4j27d1h4bdf2v7f78zi8lz4zkkj7s9kskmsqx5jcs2d459yp";
-      extraPostFetch =
+      postFetch =
         ''
           mv "$out/${repo}-${rev}/releases/local-repo/"* "$out/"
         '';
diff --git a/pkgs/applications/editors/notepad-next/default.nix b/pkgs/applications/editors/notepad-next/default.nix
index ba0cf93e52eae..0207ae9b24069 100644
--- a/pkgs/applications/editors/notepad-next/default.nix
+++ b/pkgs/applications/editors/notepad-next/default.nix
@@ -1,4 +1,4 @@
-{ mkDerivation, lib, fetchFromGitHub, qmake, libsForQt5 }:
+{ mkDerivation, lib, fetchFromGitHub, qmake, libsForQt5, stdenv }:
 
 mkDerivation rec {
   pname = "notepad-next";
@@ -32,5 +32,6 @@ mkDerivation rec {
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
     maintainers = [ maintainers.sebtm ];
+    broken = stdenv.isAarch64;
   };
 }
diff --git a/pkgs/applications/emulators/box64/default.nix b/pkgs/applications/emulators/box64/default.nix
new file mode 100644
index 0000000000000..e383333c42086
--- /dev/null
+++ b/pkgs/applications/emulators/box64/default.nix
@@ -0,0 +1,66 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, python3
+}:
+
+stdenv.mkDerivation rec {
+  pname = "box64";
+  version = "0.1.8";
+
+  src = fetchFromGitHub {
+    owner = "ptitSeb";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-6k8Enbafnj19ATtgmw8W7LxtRpM3Ousj1bpZbbtq8TM=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    python3
+  ];
+
+  cmakeFlags = [
+    "-DNOGIT=1"
+  ] ++ (
+    if stdenv.hostPlatform.system == "aarch64-linux" then
+      [
+        "-DARM_DYNAREC=ON"
+      ]
+    else [
+      "-DLD80BITS=1"
+      "-DNOALIGN=1"
+    ]
+  );
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm 0755 box64 "$out/bin/box64"
+    runHook postInstall
+  '';
+
+  doCheck = true;
+
+  checkPhase = ''
+    runHook preCheck
+    ctest
+    runHook postCheck
+  '';
+
+  doInstallCheck = true;
+
+  installCheckPhase = ''
+    runHook preInstallCheck
+    $out/bin/box64 -v
+    runHook postInstallCheck
+  '';
+
+  meta = with lib; {
+    homepage = "https://box86.org/";
+    description = "Lets you run x86_64 Linux programs on non-x86_64 Linux systems";
+    license = licenses.mit;
+    maintainers = with maintainers; [ gador ];
+    platforms = [ "x86_64-linux" "aarch64-linux" ];
+  };
+}
diff --git a/pkgs/applications/emulators/citra/default.nix b/pkgs/applications/emulators/citra/default.nix
index 31f5ebc3038ca..8b9f2cfd06908 100644
--- a/pkgs/applications/emulators/citra/default.nix
+++ b/pkgs/applications/emulators/citra/default.nix
@@ -1,93 +1,45 @@
-{ lib
-, stdenv
+{ branch
+, libsForQt5
 , fetchFromGitHub
-, cmake
-, wrapQtAppsHook
-, boost17x
-, pkg-config
-, libusb1
-, zstd
-, libressl
-, enableSdl2 ? true, SDL2
-, enableQt ? true, qtbase, qtmultimedia
-, enableQtTranslation ? enableQt, qttools
-, enableWebService ? true
-, enableCubeb ? true, libpulseaudio
-, enableFfmpegAudioDecoder ? true
-, enableFfmpegVideoDumper ? true
-, ffmpeg
-, useDiscordRichPresence ? true, rapidjson
-, enableFdk ? false, fdk_aac
+, fetchurl
 }:
-assert lib.assertMsg (!enableFfmpegAudioDecoder || !enableFdk) "Can't enable both enableFfmpegAudioDecoder and enableFdk";
 
-stdenv.mkDerivation {
-  pname = "citra";
-  version = "2021-11-01";
-
-  src = fetchFromGitHub {
-    owner = "citra-emu";
-    repo = "citra";
-    rev = "5a7d80172dd115ad9bc6e8e85cee6ed9511c48d0";
-    sha256 = "sha256-vy2JMizBsnRK9NBEZ1dxT7fP/HFhOZSsC+5P+Dzi27s=";
-    fetchSubmodules = true;
+let
+  # Fetched from https://api.citra-emu.org/gamedb, last updated 2022-05-02
+  # Please make sure to update this when updating citra!
+  compat-list = fetchurl {
+    name = "citra-compat-list";
+    url = "https://web.archive.org/web/20220502114622/https://api.citra-emu.org/gamedb/";
+    sha256 = "sha256-blIlaYaUQjw7Azgg+Dd7ZPEQf+ddZMO++Yxinwe+VG0=";
+  };
+in {
+  nightly = libsForQt5.callPackage ./generic.nix rec {
+    pname = "citra-nightly";
+    version = "1765";
+
+    src = fetchFromGitHub {
+      owner = "citra-emu";
+      repo = "citra-nightly";
+      rev = "nightly-${version}";
+      sha256 = "0d3dfh63cmsy5idbypdz3ibydmb4a35sfv7qmxxlcpc390pp9cvq";
+      fetchSubmodules = true;
+    };
+
+    inherit branch compat-list;
   };
 
-  nativeBuildInputs = [
-    cmake
-    pkg-config
-  ]
-  ++ lib.optionals enableQt [ wrapQtAppsHook ];
-
-  buildInputs = [
-    boost17x
-    libusb1
-  ]
-  ++ lib.optionals enableSdl2 [ SDL2 ]
-  ++ lib.optionals enableQt [ qtbase qtmultimedia ]
-  ++ lib.optionals enableQtTranslation [ qttools ]
-  ++ lib.optionals enableCubeb [ libpulseaudio ]
-  ++ lib.optionals (enableFfmpegAudioDecoder || enableFfmpegVideoDumper) [ ffmpeg ]
-  ++ lib.optionals useDiscordRichPresence [ rapidjson ]
-  ++ lib.optionals enableFdk [ fdk_aac ];
-
-  cmakeFlags = [
-    "-DUSE_SYSTEM_BOOST=ON"
-  ]
-  ++ lib.optionals (!enableSdl2) [ "-DENABLE_SDL2=OFF" ]
-  ++ lib.optionals (!enableQt) [ "-DENABLE_QT=OFF" ]
-  ++ lib.optionals enableQtTranslation [ "-DENABLE_QT_TRANSLATION=ON" ]
-  ++ lib.optionals (!enableWebService) [ "-DENABLE_WEB_SERVICE=OFF" ]
-  ++ lib.optionals (!enableCubeb) [ "-DENABLE_CUBEB=OFF" ]
-  ++ lib.optionals enableFfmpegAudioDecoder [ "-DENABLE_FFMPEG_AUDIO_DECODER=ON"]
-  ++ lib.optionals enableFfmpegVideoDumper [ "-DENABLE_FFMPEG_VIDEO_DUMPER=ON" ]
-  ++ lib.optionals useDiscordRichPresence [ "-DUSE_DISCORD_PRESENCE=ON" ]
-  ++ lib.optionals enableFdk [ "-DENABLE_FDK=ON" ];
-
-  postPatch = ''
-    # We already know the submodules are present
-    substituteInPlace CMakeLists.txt \
-      --replace "check_submodules_present()" ""
-
-    # Devendoring
-    rm -rf externals/zstd externals/libressl
-    cp -r ${zstd.src} externals/zstd
-    tar xf ${libressl.src} -C externals/
-    mv externals/${libressl.name} externals/libressl
-    chmod -R a+w externals/zstd
-  '';
+  canary = libsForQt5.callPackage ./generic.nix rec {
+    pname = "citra-canary";
+    version = "2146";
 
-  # Fixes https://github.com/NixOS/nixpkgs/issues/171173
-  postInstall = lib.optionalString (enableCubeb && enableSdl2) ''
-    wrapProgram "$out/bin/citra" \
-      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libpulseaudio ]}
-  '';
+    src = fetchFromGitHub {
+      owner = "citra-emu";
+      repo = "citra-canary";
+      rev = "canary-${version}";
+      sha256 = "1wnym0nklngimf5gaaa2703nz4g5iy572wlgp88h67rrh9b4f04r";
+      fetchSubmodules = true;
+    };
 
-  meta = with lib; {
-    homepage = "https://citra-emu.org";
-    description = "An open-source emulator for the Nintendo 3DS";
-    license = licenses.gpl2;
-    maintainers = with maintainers; [ abbradar ];
-    platforms = platforms.linux;
+    inherit branch compat-list;
   };
-}
+}.${branch}
diff --git a/pkgs/applications/emulators/citra/generic.nix b/pkgs/applications/emulators/citra/generic.nix
new file mode 100644
index 0000000000000..8a3c20c664cfc
--- /dev/null
+++ b/pkgs/applications/emulators/citra/generic.nix
@@ -0,0 +1,107 @@
+{ pname
+, version
+, src
+, branch
+, compat-list
+
+, lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, boost17x
+, pkg-config
+, libusb1
+, zstd
+, libressl
+, enableSdl2 ? true, SDL2
+, enableQt ? true, qtbase, qtmultimedia, wrapQtAppsHook
+, enableQtTranslation ? enableQt, qttools
+, enableWebService ? true
+, enableCubeb ? true, libpulseaudio
+, enableFfmpegAudioDecoder ? true
+, enableFfmpegVideoDumper ? true
+, ffmpeg
+, useDiscordRichPresence ? true, rapidjson
+, enableFdk ? false, fdk_aac
+}:
+assert lib.assertMsg (!enableFfmpegAudioDecoder || !enableFdk) "Can't enable both enableFfmpegAudioDecoder and enableFdk";
+
+stdenv.mkDerivation rec {
+  inherit pname version src;
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ] ++ lib.optionals enableQt [ wrapQtAppsHook ];
+
+  buildInputs = [
+    boost17x
+    libusb1
+  ] ++ lib.optionals enableQt [ qtbase qtmultimedia ]
+    ++ lib.optional enableSdl2 SDL2
+    ++ lib.optional enableQtTranslation qttools
+    ++ lib.optional enableCubeb libpulseaudio
+    ++ lib.optional (enableFfmpegAudioDecoder || enableFfmpegVideoDumper) ffmpeg
+    ++ lib.optional useDiscordRichPresence rapidjson
+    ++ lib.optional enableFdk fdk_aac;
+
+  cmakeFlags = [
+    "-DUSE_SYSTEM_BOOST=ON"
+    "-DCITRA_USE_BUNDLED_FFMPEG=OFF"
+    "-DCITRA_USE_BUNDLED_QT=OFF"
+    "-DCITRA_USE_BUNDLED_SDL2=OFF"
+
+    # We dont want to bother upstream with potentially outdated compat reports
+    "-DCITRA_ENABLE_COMPATIBILITY_REPORTING=ON"
+    "-DENABLE_COMPATIBILITY_LIST_DOWNLOAD=OFF" # We provide this deterministically
+  ] ++ lib.optional (!enableSdl2) "-DENABLE_SDL2=OFF"
+    ++ lib.optional (!enableQt) "-DENABLE_QT=OFF"
+    ++ lib.optional enableQtTranslation "-DENABLE_QT_TRANSLATION=ON"
+    ++ lib.optional (!enableWebService) "-DENABLE_WEB_SERVICE=OFF"
+    ++ lib.optional (!enableCubeb) "-DENABLE_CUBEB=OFF"
+    ++ lib.optional enableFfmpegAudioDecoder "-DENABLE_FFMPEG_AUDIO_DECODER=ON"
+    ++ lib.optional enableFfmpegVideoDumper "-DENABLE_FFMPEG_VIDEO_DUMPER=ON"
+    ++ lib.optional useDiscordRichPresence "-DUSE_DISCORD_PRESENCE=ON"
+    ++ lib.optional enableFdk "-DENABLE_FDK=ON";
+
+  postPatch = ''
+    # Prep compatibilitylist
+    ln -s ${compat-list} ./dist/compatibility_list/compatibility_list.json
+
+    # We already know the submodules are present
+    substituteInPlace CMakeLists.txt \
+      --replace "check_submodules_present()" ""
+
+    # Devendoring
+    rm -rf externals/zstd externals/libressl
+    cp -r ${zstd.src} externals/zstd
+    tar xf ${libressl.src} -C externals/
+    mv externals/${libressl.name} externals/libressl
+    chmod -R a+w externals/zstd
+  '';
+
+  # Fixes https://github.com/NixOS/nixpkgs/issues/171173
+  postInstall = lib.optionalString (enableCubeb && enableSdl2) ''
+    wrapProgram "$out/bin/citra" \
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libpulseaudio ]}
+  '';
+
+  meta = with lib; {
+    homepage = "https://citra-emu.org";
+    description = "The ${branch} branch of an open-source emulator for the Ninteno 3DS";
+    longDescription = ''
+      A Nintendo 3DS Emulator written in C++
+      Using the nightly branch is recommended for general usage.
+      Using the canary branch is recommended if you would like to try out
+      experimental features, with a cost of stability.
+    '';
+    mainProgram = if enableQt then "citra-qt" else "citra";
+    platforms = platforms.linux;
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [
+      abbradar
+      ashley
+      ivar
+    ];
+  };
+}
diff --git a/pkgs/applications/emulators/citra/update.sh b/pkgs/applications/emulators/citra/update.sh
new file mode 100755
index 0000000000000..eec36818fede2
--- /dev/null
+++ b/pkgs/applications/emulators/citra/update.sh
@@ -0,0 +1,84 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -i bash -p nix nix-prefetch-git coreutils curl jq gnused
+
+set -euo pipefail
+
+# Will be replaced with the actual branch when running this from passthru.updateScript
+BRANCH="@branch@"
+
+if [[ ! "$(basename $PWD)" = "citra" ]]; then
+    echo "error: Script must be ran from citra's directory!"
+    exit 1
+fi
+
+getLocalVersion() {
+    pushd ../../../.. >/dev/null
+    nix eval --raw -f default.nix "$1".version
+    popd >/dev/null
+}
+
+getLocalHash() {
+    pushd ../../../.. >/dev/null
+    nix eval --raw -f default.nix "$1".src.drvAttrs.outputHash
+    popd >/dev/null
+}
+
+updateNightly() {
+    OLD_NIGHTLY_VERSION="$(getLocalVersion "citra-nightly")"
+    OLD_NIGHTLY_HASH="$(getLocalHash "citra-nightly")"
+
+    NEW_NIGHTLY_VERSION="$(curl -s ${GITHUB_TOKEN:+"-u \":$GITHUB_TOKEN\""} \
+        "https://api.github.com/repos/citra-emu/citra-nightly/releases?per_page=1" | jq -r '.[0].name' | cut -d"-" -f2 | cut -d" " -f2)"
+
+    if [[ "${OLD_NIGHTLY_VERSION}" = "${NEW_NIGHTLY_VERSION}" ]]; then
+        echo "citra-nightly is already up to date!"
+
+        [ "$KEEP_GOING" ] && return || exit
+    else
+        echo "citra-nightly: ${OLD_NIGHTLY_VERSION} -> ${NEW_NIGHTLY_VERSION}"
+    fi
+
+    echo "  Fetching source code..."
+
+    NEW_NIGHTLY_HASH="$(nix-prefetch-git --quiet --fetch-submodules --rev "nightly-${NEW_NIGHTLY_VERSION}" "https://github.com/citra-emu/citra-nightly" | jq -r '.sha256')"
+
+    echo "  Succesfully fetched. hash: ${NEW_NIGHTLY_HASH}"
+
+    sed -i "s/${OLD_NIGHTLY_VERSION}/${NEW_NIGHTLY_VERSION}/" ./default.nix
+    sed -i "s/${OLD_NIGHTLY_HASH}/${NEW_NIGHTLY_HASH}/" ./default.nix
+}
+
+updateCanary() {
+    OLD_CANARY_VERSION="$(getLocalVersion "citra-canary")"
+    OLD_CANARY_HASH="$(getLocalHash "citra-canary")"
+
+    NEW_CANARY_VERSION="$(curl -s ${GITHUB_TOKEN:+"-u \":$GITHUB_TOKEN\""} \
+        "https://api.github.com/repos/citra-emu/citra-canary/releases?per_page=1" | jq -r '.[0].name' | cut -d"-" -f2 | cut -d" " -f1)"
+
+    if [[ "${OLD_CANARY_VERSION}" = "${NEW_CANARY_VERSION}" ]]; then
+        echo "citra-canary is already up to date!"
+
+        [ "$KEEP_GOING" ] && return || exit
+    else
+        echo "citra-canary: ${OLD_CANARY_VERSION} -> ${NEW_CANARY_VERSION}"
+    fi
+
+    echo "  Fetching source code..."
+
+    NEW_CANARY_HASH="$(nix-prefetch-git --quiet --fetch-submodules --rev "canary-${NEW_CANARY_VERSION}" "https://github.com/citra-emu/citra-canary" | jq -r '.sha256')"
+
+    echo "  Succesfully fetched. hash: ${NEW_CANARY_HASH}"
+
+    sed -i "s/${OLD_CANARY_VERSION}/${NEW_CANARY_VERSION}/" ./default.nix
+    sed -i "s/${OLD_CANARY_HASH}/${NEW_CANARY_HASH}/" ./default.nix
+}
+
+if [[ "$BRANCH" = "nightly" ]]; then
+    updateNightly
+elif [[ "$BRANCH" = "early-access" ]]; then
+    updateCanary
+else
+    KEEP_GOING=1
+    updateNightly
+    updateCanary
+fi
diff --git a/pkgs/applications/graphics/scantailor/advanced.nix b/pkgs/applications/graphics/scantailor/advanced.nix
index 048b8b56fc082..11ddc7c7db3fa 100644
--- a/pkgs/applications/graphics/scantailor/advanced.nix
+++ b/pkgs/applications/graphics/scantailor/advanced.nix
@@ -4,21 +4,21 @@
 
 mkDerivation rec {
   pname = "scantailor-advanced";
-  version = "1.0.16";
+  version = "1.0.18";
 
   src = fetchFromGitHub {
-    owner = "4lex4";
+    owner = "vigri";
     repo = "scantailor-advanced";
     rev = "v${version}";
-    sha256 = "0lc9lzbpiy5hgimyhl4s4q67pb9gacpy985gl6iy8pl79zxhmcyp";
+    sha256 = "sha256-4/QSjgHvRgIduS/AXbT7osRTdOdgR7On3CbjRnGbwHU=";
   };
 
   nativeBuildInputs = [ cmake qttools ];
   buildInputs = [ libjpeg libpng libtiff boost qtbase ];
 
   meta = with lib; {
-    homepage = "https://github.com/4lex4/scantailor-advanced";
-    description = "Interactive post-processing tool for scanned pages";
+    homepage = "https://github.com/vigri/scantailor-advanced";
+    description = "Interactive post-processing tool for scanned pages (vigri's fork)";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ jfrankenau ];
     platforms = with platforms; gnu ++ linux ++ darwin;
diff --git a/pkgs/applications/misc/electrum/default.nix b/pkgs/applications/misc/electrum/default.nix
index f9ef802ce4222..4f95efa175e97 100644
--- a/pkgs/applications/misc/electrum/default.nix
+++ b/pkgs/applications/misc/electrum/default.nix
@@ -39,7 +39,7 @@ let
     rev = version;
     sha256 = "sha256-BoikYSsQZAv8WswIr5nmBsGmjZbTXaLAbdO2QtPvc7c=";
 
-    extraPostFetch = ''
+    postFetch = ''
       mv $out ./all
       mv ./all/electrum/tests $out
     '';
diff --git a/pkgs/applications/misc/electrum/ltc.nix b/pkgs/applications/misc/electrum/ltc.nix
index 416adbe60c887..5f65fd4a368a8 100644
--- a/pkgs/applications/misc/electrum/ltc.nix
+++ b/pkgs/applications/misc/electrum/ltc.nix
@@ -38,7 +38,7 @@ let
     rev = version;
     sha256 = "sha256-oZjQnrnj8nCaQjrIz8bWNt6Ib8Wu2ZMXHEPfCCy2fjk=";
 
-    extraPostFetch = ''
+    postFetch = ''
       mv $out ./all
       mv ./all/electrum_ltc/tests $out
     '';
diff --git a/pkgs/applications/misc/openambit/default.nix b/pkgs/applications/misc/openambit/default.nix
index 5ef6d4ae84d41..f3429a05ee6e3 100644
--- a/pkgs/applications/misc/openambit/default.nix
+++ b/pkgs/applications/misc/openambit/default.nix
@@ -1,5 +1,6 @@
 { cmake
 , fetchFromGitHub
+, fetchpatch
 , lib
 , libusb1
 , mkDerivation
@@ -21,6 +22,16 @@ mkDerivation rec {
     sha256 = "1074kvkamwnlkwdajsw1799wddcfkjh2ay6l842r0s4cvrxrai85";
   };
 
+  patches = [
+    # Pull upstream patch for -fno-common toolchain support:
+    #   https://github.com/openambitproject/openambit/pull/244
+    (fetchpatch {
+      name = "fno-common.patch";
+      url = "https://github.com/openambitproject/openambit/commit/b6d97eab417977b6dbe355e0b071d0a56cc3df6b.patch";
+      sha256 = "1p0dg902mlcfjvs01dxl9wv2b50ayp4330p38d14q87mn0c2xl5d";
+    })
+  ];
+
   nativeBuildInputs = [ cmake qttools ];
   buildInputs = [ libusb1 python3 qtbase udev zlib ];
 
diff --git a/pkgs/applications/misc/pgmodeler/default.nix b/pkgs/applications/misc/pgmodeler/default.nix
index 0a99d357e68f4..93d5d74ac731c 100644
--- a/pkgs/applications/misc/pgmodeler/default.nix
+++ b/pkgs/applications/misc/pgmodeler/default.nix
@@ -10,13 +10,13 @@
 
 mkDerivation rec {
   pname = "pgmodeler";
-  version = "0.9.3";
+  version = "0.9.4";
 
   src = fetchFromGitHub {
     owner = "pgmodeler";
     repo = "pgmodeler";
     rev = "v${version}";
-    sha256 = "1bci5x418dbnkny7hn0b5q5lxyajrgl3frv41ji0hcw9vivrds2g";
+    sha256 = "sha256-FwLPhIc2ofaB8Z2ZUYMFFt5XdoosEfEOwoIaI7pSxa0=";
   };
 
   nativeBuildInputs = [ pkg-config qmake ];
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index d013eae755029..7e379d480936e 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -49,10 +49,10 @@
     "owner": "aliyun",
     "provider-source-address": "registry.terraform.io/aliyun/alicloud",
     "repo": "terraform-provider-alicloud",
-    "rev": "v1.167.0",
-    "sha256": "sha256-l2wCcYcAlKQTKkD+3yFi4zBkMVpq27Ygld1UjeD6IHM=",
+    "rev": "v1.168.0",
+    "sha256": "sha256-NN4dqEywcoP4tk2J6RfWqoGw+95bIEoxb4YpwPtoTZ0=",
     "vendorSha256": "sha256-qZNYfSlUkCu7FudbKF4IOgK1xWM5LqUghclOeGOxYXg=",
-    "version": "1.167.0"
+    "version": "1.168.0"
   },
   "ansible": {
     "owner": "nbering",
@@ -103,10 +103,10 @@
     "owner": "hashicorp",
     "provider-source-address": "registry.terraform.io/hashicorp/aws",
     "repo": "terraform-provider-aws",
-    "rev": "v4.14.0",
-    "sha256": "sha256-9xJVJw2kIutmmiKGvRBKS+/oyGSq0dipeCn2Gmtk1AU=",
-    "vendorSha256": "sha256-+YINrbj52ionuQbcgck6Dp2h88+LS5tXPmoVHXCAXOk=",
-    "version": "4.14.0"
+    "rev": "v4.15.1",
+    "sha256": "sha256-o8yUcjw4X+Vx49hV+0guccueWoHvpxSs+sMsbAoAw9o=",
+    "vendorSha256": "sha256-l7Fe5hhEvJ5DiZ3t79sZYIt+6eZkjjf7Npmr8p2/e/4=",
+    "version": "4.15.1"
   },
   "azuread": {
     "owner": "hashicorp",
@@ -121,10 +121,10 @@
     "owner": "hashicorp",
     "provider-source-address": "registry.terraform.io/hashicorp/azurerm",
     "repo": "terraform-provider-azurerm",
-    "rev": "v3.6.0",
-    "sha256": "sha256-brC9HZbyettgvwuFjrPxeRg/msQ1leD7F/h9aUxXAYo=",
+    "rev": "v3.7.0",
+    "sha256": "sha256-dvkR2nEtf4HvLTIoa++4PI5oNOPuJzI4obxdI4meKG4=",
     "vendorSha256": null,
-    "version": "3.6.0"
+    "version": "3.7.0"
   },
   "azurestack": {
     "owner": "hashicorp",
@@ -203,10 +203,10 @@
     "owner": "CheckPointSW",
     "provider-source-address": "registry.terraform.io/CheckPointSW/checkpoint",
     "repo": "terraform-provider-checkpoint",
-    "rev": "v1.7.0",
-    "sha256": "1msd3qjrrhl0v3m7n9ybkwxki5wpchzjswd2dcifbif4k8pcs470",
-    "vendorSha256": "0yaxgyzwja5dl4p7w8q77ash75xwsf05kq88nvmdf94lvspfnwlq",
-    "version": "1.7.0"
+    "rev": "v1.8.0",
+    "sha256": "sha256-+lcJr7C7FsvSzkfFwEfTrJedx6vMvOrTjNA+JTWBI4c=",
+    "vendorSha256": "sha256-mHLrrt6UJNfqtgjhWYDTvJcDtToHI34uoa0oyb9/XXk=",
+    "version": "1.8.0"
   },
   "ciscoasa": {
     "owner": "CiscoDevNet",
@@ -230,10 +230,10 @@
     "owner": "cloudflare",
     "provider-source-address": "registry.terraform.io/cloudflare/cloudflare",
     "repo": "terraform-provider-cloudflare",
-    "rev": "v3.14.0",
-    "sha256": "sha256-WjtAqL4gzr7NdRLf7mr6OULee35kyyZpr5crR514Mak=",
-    "vendorSha256": "sha256-xqjhSu1bUSpQ1A2Ga2IS2fdyIXcnt/nbQNXhcxVi22Q=",
-    "version": "3.14.0"
+    "rev": "v3.15.0",
+    "sha256": "sha256-y1UbirPJG9Behsr/VdILoVHIM2z9pF6iyEwXgDKbDaw=",
+    "vendorSha256": "sha256-R8B5fmjRBB2q12tzWbzOzzSOC0mNJNV1JiVjddDa11c=",
+    "version": "3.15.0"
   },
   "cloudfoundry": {
     "owner": "cloudfoundry-community",
@@ -257,10 +257,10 @@
     "owner": "cloudscale-ch",
     "provider-source-address": "registry.terraform.io/cloudscale-ch/cloudscale",
     "repo": "terraform-provider-cloudscale",
-    "rev": "v3.2.0",
-    "sha256": "1bczibhv2jr2h5mrqs41s6dlsi7i2pbrlbxv4m49q2xlq9lza4yk",
+    "rev": "v4.0.0",
+    "sha256": "sha256-Eo7zT/KiJdzo7fhAcCg6EV29ENM/XSBumAHmL9J8agU=",
     "vendorSha256": null,
-    "version": "3.2.0"
+    "version": "4.0.0"
   },
   "constellix": {
     "deleteVendor": true,
@@ -429,10 +429,10 @@
     "owner": "integrations",
     "provider-source-address": "registry.terraform.io/integrations/github",
     "repo": "terraform-provider-github",
-    "rev": "v4.24.1",
-    "sha256": "sha256-1fwHMN2HIVl+8ZL7OtP1U5ORc41e7Tm3qEpMqIgWL20=",
+    "rev": "v4.25.0",
+    "sha256": "sha256-9sZYg/gpCq2qpUhhFQjLVZLlNnYWaCz5K4/+TvCD/qk=",
     "vendorSha256": null,
-    "version": "4.24.1"
+    "version": "4.25.0"
   },
   "gitlab": {
     "owner": "gitlabhq",
@@ -448,20 +448,20 @@
     "provider-source-address": "registry.terraform.io/hashicorp/google",
     "proxyVendor": true,
     "repo": "terraform-provider-google",
-    "rev": "v4.20.0",
-    "sha256": "sha256-eZNa6V3aVtEgTZgTNgB4EUK3S6iKfk9qI7OnAQ5Mbp4=",
-    "vendorSha256": "sha256-l2OviwplP/Sg2ShaEA88pMwVTkREnLkFAzterjr2kvU=",
-    "version": "4.20.0"
+    "rev": "v4.21.0",
+    "sha256": "sha256-xintCclIhM2FqmbYoWTPGq/twkUH3M2ebc/b0SZ/hXY=",
+    "vendorSha256": "sha256-B3JiVeCzeCtsAvQiHayZY3pahN4bwizE6d99Qw2VYK8=",
+    "version": "4.21.0"
   },
   "google-beta": {
     "owner": "hashicorp",
     "provider-source-address": "registry.terraform.io/hashicorp/google-beta",
     "proxyVendor": true,
     "repo": "terraform-provider-google-beta",
-    "rev": "v4.20.0",
-    "sha256": "sha256-Dr3G7KskfL+4WNOPL3SZCKf+Lo6wP3XS1JrlC6Mv3O8=",
-    "vendorSha256": "sha256-l2OviwplP/Sg2ShaEA88pMwVTkREnLkFAzterjr2kvU=",
-    "version": "4.20.0"
+    "rev": "v4.21.0",
+    "sha256": "sha256-3oViGAFwUTBC4tMUlnjUDHdmk+sxtCeVZNbYGGwHhwU=",
+    "vendorSha256": "sha256-B3JiVeCzeCtsAvQiHayZY3pahN4bwizE6d99Qw2VYK8=",
+    "version": "4.21.0"
   },
   "googleworkspace": {
     "owner": "hashicorp",
@@ -566,10 +566,10 @@
     "owner": "IBM-Cloud",
     "provider-source-address": "registry.terraform.io/IBM-Cloud/ibm",
     "repo": "terraform-provider-ibm",
-    "rev": "v1.41.0",
-    "sha256": "sha256-5kHoTmQlEzTSjDnAJPdEN2y+DF9gB2BHJFHEYLh6h48=",
+    "rev": "v1.41.1",
+    "sha256": "sha256-eTwv7dtuFe7oEFFqnmpJMN2d/P5ow8HH1rXCE6xBEi4=",
     "vendorSha256": "sha256-8s32A0qgODZZy3rSrHnnBkQyKLBj0fcCBJ9ja9gXc5Q=",
-    "version": "1.41.0"
+    "version": "1.41.1"
   },
   "icinga2": {
     "owner": "Icinga",
@@ -593,10 +593,10 @@
     "owner": "Mongey",
     "provider-source-address": "registry.terraform.io/Mongey/kafka",
     "repo": "terraform-provider-kafka",
-    "rev": "v0.5.0",
-    "sha256": "sha256-1SZkCuAmYlfzYVpS+qrNN+vl3zrFZGUgdrrgKj0VRUE=",
-    "vendorSha256": "sha256-6wccODr/eJUh5eeDGDCuuK2pCFmvPlXWmdAUnjBHJ5E=",
-    "version": "0.5.0"
+    "rev": "v0.5.1",
+    "sha256": "sha256-bKbY2cOIORy3D9yCBqVuKUZb650sx+87d4wtUB3dPdg=",
+    "vendorSha256": "sha256-03QV6C2DEN5xwMwABwSvv5Ts6pTHQDBP2zUUqIcOtVQ=",
+    "version": "0.5.1"
   },
   "kafka-connect": {
     "owner": "Mongey",
@@ -683,10 +683,10 @@
     "owner": "hashicorp",
     "provider-source-address": "registry.terraform.io/hashicorp/local",
     "repo": "terraform-provider-local",
-    "rev": "v2.2.2",
-    "sha256": "sha256-JpTdRi9EagrnhYnlq6sl6+t4SE6i7T7YrGTsYCDync8=",
-    "vendorSha256": "sha256-Ha/MGbXwwhbVxaHbkU2xBhyNcDxLivk7vYQjfVzWOcY=",
-    "version": "2.2.2"
+    "rev": "v2.2.3",
+    "sha256": "sha256-l9XQpIMMar7ForZuBcGOmqrRuSnthIrilr4CHJ5SiaU=",
+    "vendorSha256": "sha256-5rqn9/NE7Q0VI6SRd2VFKJl4npz9Y0Qp1pEpfj9KxrQ=",
+    "version": "2.2.3"
   },
   "logicmonitor": {
     "owner": "logicmonitor",
@@ -764,10 +764,10 @@
     "owner": "NaverCloudPlatform",
     "provider-source-address": "registry.terraform.io/NaverCloudPlatform/ncloud",
     "repo": "terraform-provider-ncloud",
-    "rev": "v2.2.8",
-    "sha256": "sha256-G12/+tNSMEPCPCJH//MhRKJoRSex3mS7BZt0C2o0pF0=",
-    "vendorSha256": "sha256-ovHg4GcbMzjEi+qJBpdqhR0YUakZCdnpc10SCu8FP8I=",
-    "version": "2.2.8"
+    "rev": "v2.2.9",
+    "sha256": "sha256-D9B3IJZZOCR/kzFee3sBPEbDcAL33kIef/NAYDuJv7U=",
+    "vendorSha256": "sha256-DPK/RF63rz5AQY/LybT8I6z6vSvqrFqypslhquRrgfg=",
+    "version": "2.2.9"
   },
   "netlify": {
     "owner": "AegirHealth",
@@ -837,19 +837,19 @@
     "owner": "oracle",
     "provider-source-address": "registry.terraform.io/oracle/oci",
     "repo": "terraform-provider-oci",
-    "rev": "v4.75.0",
-    "sha256": "sha256-tcDo7yvlobHf4+0BuPdifrkA8UPhI0txRCBgToTjIcw=",
+    "rev": "v4.76.0",
+    "sha256": "sha256-sJ837jK/iYOC3dPFHoix1fiiSFMCNSqYEus9VlhXqMg=",
     "vendorSha256": null,
-    "version": "4.75.0"
+    "version": "4.76.0"
   },
   "okta": {
     "owner": "okta",
     "provider-source-address": "registry.terraform.io/okta/okta",
     "repo": "terraform-provider-okta",
-    "rev": "v3.26.0",
-    "sha256": "sha256-Mnc3JZtKNOB9VpsjXq8WiZz0+zmTmFRfOY23F186tw4=",
-    "vendorSha256": "sha256-LHiOQNFkMajqytrv387yIhAyCQCaG2Kw5OCI8Xe7u2k=",
-    "version": "3.26.0"
+    "rev": "v3.27.0",
+    "sha256": "sha256-DDNq4Yvx45ynNePg8bW8tQ6LuyvUfudxY+M88+pIXMQ=",
+    "vendorSha256": "sha256-but/2CF3OW2aefUIy5XnDvhtXYqfCkHIrS1EDQoD9jM=",
+    "version": "3.27.0"
   },
   "oktaasa": {
     "owner": "oktadeveloper",
@@ -891,10 +891,10 @@
     "owner": "opentelekomcloud",
     "provider-source-address": "registry.terraform.io/opentelekomcloud/opentelekomcloud",
     "repo": "terraform-provider-opentelekomcloud",
-    "rev": "v1.29.2",
-    "sha256": "sha256-V5EGRd5/JmCDaF1fQkpwHA4DNVFKwvGnMR/AyKvgLtk=",
+    "rev": "v1.29.3",
+    "sha256": "sha256-rFaryW9yibw5whTYOb7kDF45l5NI9bdZvVQezIqudE8=",
     "vendorSha256": "sha256-FOcddb1+uG5avqYZMvzR1UXDvtDDwtxBzf7FsN6ZROM=",
-    "version": "1.29.2"
+    "version": "1.29.3"
   },
   "opsgenie": {
     "owner": "opsgenie",
@@ -927,10 +927,10 @@
     "owner": "PagerDuty",
     "provider-source-address": "registry.terraform.io/PagerDuty/pagerduty",
     "repo": "terraform-provider-pagerduty",
-    "rev": "v2.4.1",
-    "sha256": "sha256-2Ot6TxWN+t33EfT5wmkkPjj9DUrPum9whl5wimgjAp0=",
+    "rev": "v2.4.2",
+    "sha256": "sha256-xCmfykHQvQ/O+8ZGe2s5Ic4n9aZvlQ34bpnVbJDCn98=",
     "vendorSha256": null,
-    "version": "2.4.1"
+    "version": "2.4.2"
   },
   "panos": {
     "owner": "PaloAltoNetworks",
@@ -990,10 +990,10 @@
     "owner": "hashicorp",
     "provider-source-address": "registry.terraform.io/hashicorp/random",
     "repo": "terraform-provider-random",
-    "rev": "v3.1.3",
-    "sha256": "sha256-q4j3DXbLiVeSyWGywwLiJspmE08ip3zL8vabfVDWnUo=",
-    "vendorSha256": "sha256-sg89QS0ncCrBGoLvsWFlyCYwNZHNG6iadNJIHWRmhXE=",
-    "version": "3.1.3"
+    "rev": "v3.2.0",
+    "sha256": "sha256-acB1BHGxquiK137OfTe31pUGHdWp7xxlv5BINNzNLSs=",
+    "vendorSha256": "sha256-MMUit5RxsymBNX9fH8B6D2gJ/k5zaN6FCyP9N/+TV+E=",
+    "version": "3.2.0"
   },
   "rundeck": {
     "owner": "rundeck",
@@ -1026,10 +1026,10 @@
     "owner": "selectel",
     "provider-source-address": "registry.terraform.io/selectel/selectel",
     "repo": "terraform-provider-selectel",
-    "rev": "v3.8.2",
-    "sha256": "sha256-Lp2ptLuN/+/fcqeSbIMmL4dmOCoplyZeA10wAsCnYlg=",
+    "rev": "v3.8.4",
+    "sha256": "sha256-27Sdez4coJ4Enc1zTg4lr1SzlW3r6wCjciC5ID8vo0w=",
     "vendorSha256": "sha256-kmsO9jFoR/93PkOeIo0pkS/OjE+m3QbIspobAv/9+KI=",
-    "version": "3.8.2"
+    "version": "3.8.4"
   },
   "sentry": {
     "owner": "jianyuan",
@@ -1089,10 +1089,10 @@
     "owner": "spotinst",
     "provider-source-address": "registry.terraform.io/spotinst/spotinst",
     "repo": "terraform-provider-spotinst",
-    "rev": "v1.73.3",
-    "sha256": "sha256-J7hswjjyWOZrsqnhMGAyXnvrVwLRY9jGIdtwN7Dympc=",
-    "vendorSha256": "sha256-szdzI/42RExYQlHnm178RM3wlKOLax+nwgRVzonxXoI=",
-    "version": "1.73.3"
+    "rev": "v1.74.0",
+    "sha256": "sha256-wdhpkQM7J4WO4nN+0R8XfgbuusK0zDzSDy/DyOB8GcI=",
+    "vendorSha256": "sha256-OT5YuAlZNRCvwvZpCrhtKj4YiosEuHrTLQkWFYuKZrw=",
+    "version": "1.74.0"
   },
   "stackpath": {
     "owner": "stackpath",
@@ -1116,10 +1116,10 @@
     "owner": "SumoLogic",
     "provider-source-address": "registry.terraform.io/SumoLogic/sumologic",
     "repo": "terraform-provider-sumologic",
-    "rev": "v2.15.0",
-    "sha256": "sha256-VAYU1v5uCIcbeLri6tG5RIAgDP4SzZxQDtK9P5gdSPc=",
+    "rev": "v2.16.0",
+    "sha256": "sha256-27+ofT5p073s2kEk87P/Witw5x9sVKOYrlBXp6/xKxk=",
     "vendorSha256": "sha256-7DGY+L41bJJrtLwdWgu2aMCefgcmtR6tmH12foi68Kc=",
-    "version": "2.15.0"
+    "version": "2.16.0"
   },
   "template": {
     "owner": "hashicorp",
@@ -1134,10 +1134,10 @@
     "owner": "tencentcloudstack",
     "provider-source-address": "registry.terraform.io/tencentcloudstack/tencentcloud",
     "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.72.3",
-    "sha256": "sha256-NfrLaKPIAMWeRNVdWEg4wn7pFoLO1Hv3HsxFKkVewPc=",
+    "rev": "v1.72.5",
+    "sha256": "sha256-4ZnhE2Woy+CquDsqJvJMUib48eRJ9OWTrO/14NkI6iM=",
     "vendorSha256": null,
-    "version": "1.72.3"
+    "version": "1.72.5"
   },
   "tfe": {
     "owner": "hashicorp",
@@ -1170,10 +1170,10 @@
     "owner": "hashicorp",
     "provider-source-address": "registry.terraform.io/hashicorp/tls",
     "repo": "terraform-provider-tls",
-    "rev": "v3.3.0",
-    "sha256": "sha256-7A9AXZxTIltZdXXIpMpQGYKwgSdU6kRRNuvVaNtMFGw=",
-    "vendorSha256": "sha256-bj2KpPFFnev5DAND9/HyUC4kOORAvnnpSihUECcHB/8=",
-    "version": "3.3.0"
+    "rev": "v3.4.0",
+    "sha256": "sha256-14sKHnmUfDbXceH+bfSPuA1TKo6Q6kkazYwHC15D4vY=",
+    "vendorSha256": "sha256-o7QvF6Z/HCyb/EBr0m90B63AVKqxteQEBXe+OuovnYg=",
+    "version": "3.4.0"
   },
   "triton": {
     "deleteVendor": true,
@@ -1207,19 +1207,19 @@
     "owner": "cloudposse",
     "provider-source-address": "registry.terraform.io/cloudposse/utils",
     "repo": "terraform-provider-utils",
-    "rev": "0.17.23",
-    "sha256": "sha256-/m2K91I1BtzfKTO6sbYL6r0N6GGtd4Ux+GSL0Ut4GUg=",
-    "vendorSha256": "sha256-Rmv3B8Sczvohlfwu248a1pi1VmFGNCB77/IFTBKKeiM=",
-    "version": "0.17.23"
+    "rev": "0.17.24",
+    "sha256": "sha256-/pM6PuvFsmRpBz5pqOy6mVlkbq+9IRlHug/DdoKjt4U=",
+    "vendorSha256": "sha256-4/Djmg6cONkJg1wH7M4Y2mZccbwyUXEvZ2bdBYEnV9w=",
+    "version": "0.17.24"
   },
   "vault": {
     "owner": "hashicorp",
     "provider-source-address": "registry.terraform.io/hashicorp/vault",
     "repo": "terraform-provider-vault",
-    "rev": "v3.5.0",
-    "sha256": "sha256-Ap96unJFTJ8HKcIs3LYSHfTXszh1gAcZSTEWpS2W2AQ=",
-    "vendorSha256": "sha256-UvczG/31YPIxPBZhwoBC3QS+QA8PRtRqgA/0W8tcXD0=",
-    "version": "3.5.0"
+    "rev": "v3.6.0",
+    "sha256": "sha256-eeE6ThAz7RwePS65RZXbz+PUfm/KlE+f+nJWvLTCSmA=",
+    "vendorSha256": "sha256-KSGhIoUKadAuiMQkJEyYCDt7GXZ9deiV14LV4gEOpVg=",
+    "version": "3.6.0"
   },
   "vcd": {
     "owner": "vmware",
@@ -1234,10 +1234,10 @@
     "owner": "Venafi",
     "provider-source-address": "registry.terraform.io/Venafi/venafi",
     "repo": "terraform-provider-venafi",
-    "rev": "v0.15.5",
-    "sha256": "sha256-aNh9P7QqhmdywP47mddcGSDRxkwkrus14tku/xrQcz8=",
-    "vendorSha256": "sha256-SKdSjBXLX344zt0GeGBLNp8cFw+PO9ObT9jC+dHp/h8=",
-    "version": "0.15.5"
+    "rev": "v0.16.0",
+    "sha256": "sha256-oGpIa+Up1bv6tf5ibna0DEwIxrZyAefqA8LSAy57QrE=",
+    "vendorSha256": "sha256-F0lMZVMNJ/1SHX8e5v4waQPqZjan/Ll+db+dseZ+dsc=",
+    "version": "0.16.0"
   },
   "vercel": {
     "owner": "ondrejsika",
@@ -1261,10 +1261,10 @@
     "owner": "vmware",
     "provider-source-address": "registry.terraform.io/vmware/vra7",
     "repo": "terraform-provider-vra7",
-    "rev": "v3.0.4",
-    "sha256": "1w16cl27fqpzy1v6cdp61shgrmj787fdfjwhr719n57hqax4pck5",
+    "rev": "v3.0.5",
+    "sha256": "sha256-4YhaABbuG4GhWYEiGrUvf4H/8dd7wWHY08CkTWCqgr8=",
     "vendorSha256": null,
-    "version": "3.0.4"
+    "version": "3.0.5"
   },
   "vsphere": {
     "owner": "hashicorp",
@@ -1279,10 +1279,10 @@
     "owner": "vultr",
     "provider-source-address": "registry.terraform.io/vultr/vultr",
     "repo": "terraform-provider-vultr",
-    "rev": "v2.11.0",
-    "sha256": "sha256-5TtrjWQ6AXYCjOi6Qe3oJVp011s87XyU2CYnXb7hFII=",
+    "rev": "v2.11.1",
+    "sha256": "sha256-EAkFlmQFPq9pSQ591GkX7um8tcBEGIJuiLuL5d9A8Ag=",
     "vendorSha256": null,
-    "version": "2.11.0"
+    "version": "2.11.1"
   },
   "wavefront": {
     "owner": "vmware",
diff --git a/pkgs/applications/networking/instant-messengers/deltachat-cursed/default.nix b/pkgs/applications/networking/instant-messengers/deltachat-cursed/default.nix
index 0b692104a4fa0..42e5d63240a9d 100644
--- a/pkgs/applications/networking/instant-messengers/deltachat-cursed/default.nix
+++ b/pkgs/applications/networking/instant-messengers/deltachat-cursed/default.nix
@@ -5,13 +5,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "deltachat-cursed";
-  version = "0.3.1";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "adbenitez";
     repo = "deltachat-cursed";
     rev = "v${version}";
-    hash = "sha256-IZrTPnj6eX1qgEPnEiD9qmVkwn1SMK38gVKAJFgZNfw=";
+    hash = "sha256-li6HsatiRJPVKKBBHyWhq2b8HhvDrOUiVT2tSupjuag=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/instant-messengers/jami/default.nix b/pkgs/applications/networking/instant-messengers/jami/default.nix
index 3e0ba8bb5e8f1..ef8959b57a97f 100644
--- a/pkgs/applications/networking/instant-messengers/jami/default.nix
+++ b/pkgs/applications/networking/instant-messengers/jami/default.nix
@@ -15,7 +15,7 @@ rec {
     sha256 = "1zw9azwmxr4991nq5kl527lbwlj7psrissgvrkl1kxxbfbdncbhh";
 
     stripRoot = false;
-    extraPostFetch = ''
+    postFetch = ''
       cd $out
       mv ring-project/* ./
       rm -r ring-project.rst ring-project client-android client-ios client-macosx client-uwp
diff --git a/pkgs/applications/networking/syncplay/default.nix b/pkgs/applications/networking/syncplay/default.nix
index 96420ff04de1c..1e88b12c74f9d 100644
--- a/pkgs/applications/networking/syncplay/default.nix
+++ b/pkgs/applications/networking/syncplay/default.nix
@@ -14,7 +14,7 @@ buildPythonApplication rec {
   };
 
   propagatedBuildInputs = [ twisted certifi ]
-    ++ twisted.extras-require.tls
+    ++ twisted.optional-dependencies.tls
     ++ lib.optional enableGUI pyside2;
   nativeBuildInputs = lib.optionals enableGUI [ qt5.wrapQtAppsHook ];
 
diff --git a/pkgs/applications/office/paperless-ngx/default.nix b/pkgs/applications/office/paperless-ngx/default.nix
index 17a1a56b769ae..358b66fb589a2 100644
--- a/pkgs/applications/office/paperless-ngx/default.nix
+++ b/pkgs/applications/office/paperless-ngx/default.nix
@@ -122,7 +122,7 @@ py.pkgs.pythonPackages.buildPythonApplication rec {
     threadpoolctl
     tika
     tqdm
-    twisted.extras-require.tls
+    twisted.optional-dependencies.tls
     txaio
     tzlocal
     urllib3
diff --git a/pkgs/applications/version-management/git-and-tools/gitweb/default.nix b/pkgs/applications/version-management/git-and-tools/gitweb/default.nix
index 478d9aaf0cc29..2c8d7eedc2d90 100644
--- a/pkgs/applications/version-management/git-and-tools/gitweb/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/gitweb/default.nix
@@ -6,7 +6,7 @@ let
     owner = "kogakure";
     repo = "gitweb-theme";
     rev = "049b88e664a359f8ec25dc6f531b7e2aa60dd1a2";
-    extraPostFetch = ''
+    postFetch = ''
       mkdir -p "$TMPDIR/gitwebTheme"
       mv "$out"/* "$TMPDIR/gitwebTheme/"
       mkdir "$out/static"
diff --git a/pkgs/applications/version-management/gitea/default.nix b/pkgs/applications/version-management/gitea/default.nix
index 6ad600e07ccb8..fbf0138ce5aa7 100644
--- a/pkgs/applications/version-management/gitea/default.nix
+++ b/pkgs/applications/version-management/gitea/default.nix
@@ -16,12 +16,12 @@ with lib;
 
 buildGoPackage rec {
   pname = "gitea";
-  version = "1.16.7";
+  version = "1.16.8";
 
   # not fetching directly from the git repo, because that lacks several vendor files for the web UI
   src = fetchurl {
     url = "https://github.com/go-gitea/gitea/releases/download/v${version}/gitea-src-${version}.tar.gz";
-    sha256 = "sha256-UVmbFtHC4W3WF+DptdHMMUoe8UE5TVgoM9QRuczSrEg=";
+    sha256 = "sha256-W/AbRfnEQfnTjXJ8wTKEFOTld4rFsBvJiXnYK8Ugoj0=";
   };
 
   unpackPhase = ''
diff --git a/pkgs/applications/virtualization/gvisor/default.nix b/pkgs/applications/virtualization/gvisor/default.nix
index 950a4ad932758..ca6ca470a5cc6 100644
--- a/pkgs/applications/virtualization/gvisor/default.nix
+++ b/pkgs/applications/virtualization/gvisor/default.nix
@@ -43,7 +43,7 @@ let
     repo = "rules_proto";
     rev = "f7a30f6f80006b591fa7c437fe5a951eb10bcbcf";
     sha256 = "10bcw0ir0skk7h33lmqm38n9w4nfs24mwajnngkbs6jb5wsvkqv8";
-    extraPostFetch = ''
+    postFetch = ''
       sed -i 's|name = "protoc"|name = "_protoc_original"|' $out/proto/private/BUILD.release
       cat <<EOF >>$out/proto/private/BUILD.release
       alias(name = "protoc", actual = "@com_github_protocolbuffers_protobuf//:protoc", visibility = ["//visibility:public"])
diff --git a/pkgs/build-support/bintools-wrapper/default.nix b/pkgs/build-support/bintools-wrapper/default.nix
index c2d67169c9caf..6b15aa0ddaff8 100644
--- a/pkgs/build-support/bintools-wrapper/default.nix
+++ b/pkgs/build-support/bintools-wrapper/default.nix
@@ -213,6 +213,7 @@ stdenv.mkDerivation {
       else if targetPlatform.isM68k then "m68k"
       else if targetPlatform.isS390 then "s390"
       else if targetPlatform.isRiscV then "lriscv"
+      else if targetPlatform.isRx then "rx"
       else throw "unknown emulation for platform: ${targetPlatform.config}";
     in if targetPlatform.useLLVM or false then ""
        else targetPlatform.bfdEmulation or (fmt + sep + arch);
diff --git a/pkgs/build-support/fetchsourcehut/default.nix b/pkgs/build-support/fetchsourcehut/default.nix
index 2b1feaa496e45..d111e96885c06 100644
--- a/pkgs/build-support/fetchsourcehut/default.nix
+++ b/pkgs/build-support/fetchsourcehut/default.nix
@@ -38,7 +38,7 @@ let
       fetch = fetchzip;
       arguments = baseArgs // {
         url = "${baseUrl}/archive/${rev}.tar.gz";
-        extraPostFetch = optionalString (vc == "hg") ''
+        postFetch = optionalString (vc == "hg") ''
           rm -f "$out/.hg_archival.txt"
         ''; # impure file; see #12002
       };
diff --git a/pkgs/build-support/fetchzip/default.nix b/pkgs/build-support/fetchzip/default.nix
index a3f22de58c71e..98c410370746c 100644
--- a/pkgs/build-support/fetchzip/default.nix
+++ b/pkgs/build-support/fetchzip/default.nix
@@ -12,6 +12,7 @@
 , url ? ""
 , urls ? []
 , extraPostFetch ? ""
+, postFetch ? ""
 , name ? "source"
 , nativeBuildInputs ? [ ]
 , # Allows to set the extension for the intermediate downloaded
@@ -20,6 +21,8 @@
   extension ? null
 , ... } @ args:
 
+
+lib.warnIf (extraPostFetch != "") "use 'postFetch' instead of 'extraPostFetch' with 'fetchzip' and 'fetchFromGitHub'."
 (fetchurl (let
   tmpFilename =
     if extension != null
@@ -60,11 +63,14 @@ in {
       mv "$unpackDir" "$out"
     '')
     + ''
+      ${postFetch}
+    '' + ''
       ${extraPostFetch}
     ''
+
     # Remove non-owner write permissions
     # Fixes https://github.com/NixOS/nixpkgs/issues/38649
     + ''
       chmod 755 "$out"
     '';
-} // removeAttrs args [ "stripRoot" "extraPostFetch" "extension" "nativeBuildInputs" ]))
+} // removeAttrs args [ "stripRoot" "extraPostFetch" "postFetch" "extension" "nativeBuildInputs" ]))
diff --git a/pkgs/build-support/fetchzip/tests.nix b/pkgs/build-support/fetchzip/tests.nix
new file mode 100644
index 0000000000000..f1a1ed65817ba
--- /dev/null
+++ b/pkgs/build-support/fetchzip/tests.nix
@@ -0,0 +1,17 @@
+{ testers, fetchzip, ... }:
+
+let
+  url = "https://gist.github.com/glandium/01d54cefdb70561b5f6675e08f2990f2/archive/2f430f0c136a69b0886281d0c76708997d8878af.zip";
+in
+{
+  simple = testers.invalidateFetcherByDrvHash fetchzip {
+    inherit url;
+    sha256 = "sha256-0ecwgL8qUavSj1+WkaxpmRBmu7cvj53V5eXQV71fddU=";
+  };
+
+  postFetch = testers.invalidateFetcherByDrvHash fetchzip {
+    inherit url;
+    sha256 = "sha256-7sAOzKa+9vYx5XyndHxeY2ffWAjOsgCkXC9anK6cuV0=";
+    postFetch = ''touch $out/filee'';
+  };
+}
diff --git a/pkgs/data/fonts/input-fonts/default.nix b/pkgs/data/fonts/input-fonts/default.nix
index 36a18c1f8f1c8..a5ffc2ec33a58 100644
--- a/pkgs/data/fonts/input-fonts/default.nix
+++ b/pkgs/data/fonts/input-fonts/default.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
       sha256 = "BESZ4Bjgm2hvQ7oPpMvYSlE8EqvQjqHZtXWIovqyIzA=";
       stripRoot = false;
 
-      extraPostFetch = ''
+      postFetch = ''
         # Reset the timestamp to release date for determinism.
         PATH=${lib.makeBinPath [ python3.pkgs.fonttools ]}:$PATH
         for ttf_file in $out/Input_Fonts/*/*/*.ttf; do
diff --git a/pkgs/desktops/gnome/extensions/buildGnomeExtension.nix b/pkgs/desktops/gnome/extensions/buildGnomeExtension.nix
index d661c853bbc1b..ca01c64217ae3 100644
--- a/pkgs/desktops/gnome/extensions/buildGnomeExtension.nix
+++ b/pkgs/desktops/gnome/extensions/buildGnomeExtension.nix
@@ -32,7 +32,7 @@ let
       # without making a new release. We simply substitute the possibly changed fields
       # with their content from when we last updated, and thus get a deterministic output
       # hash.
-      extraPostFetch = ''
+      postFetch = ''
         echo "${metadata}" | base64 --decode > $out/metadata.json
       '';
     };
diff --git a/pkgs/development/compilers/crystal/build-package.nix b/pkgs/development/compilers/crystal/build-package.nix
index 215c3d37d8871..4edf1ddf95891 100644
--- a/pkgs/development/compilers/crystal/build-package.nix
+++ b/pkgs/development/compilers/crystal/build-package.nix
@@ -24,6 +24,7 @@
   # Specify binaries to build in the form { foo.src = "src/foo.cr"; }
   # The default `crystal build` options can be overridden with { foo.options = [ "--optionname" ]; }
 , crystalBinaries ? { }
+, enableParallelBuilding ? true
 , ...
 }@args:
 
@@ -51,6 +52,20 @@ let
 
   buildDirectly = shardsFile == null || crystalBinaries != { };
 
+  mkCrystalBuildArgs = bin: attrs:
+    lib.concatStringsSep " " ([
+      "crystal"
+      "build"
+    ] ++ lib.optionals enableParallelBuilding [
+      "--threads"
+      "$NIX_BUILD_CORES"
+    ] ++ [
+      "-o"
+      bin
+      (attrs.src or (throw "No source file for crystal binary ${bin} provided"))
+      (lib.concatStringsSep " " (attrs.options or defaultOptions))
+    ]);
+
 in
 stdenv.mkDerivation (mkDerivationArgs // {
 
@@ -72,6 +87,7 @@ stdenv.mkDerivation (mkDerivationArgs // {
 
   PREFIX = placeholder "out";
 
+  inherit enableParallelBuilding;
   strictDeps = true;
   buildInputs = args.buildInputs or [ ] ++ [ crystal ];
 
@@ -88,16 +104,7 @@ stdenv.mkDerivation (mkDerivationArgs // {
     "runHook preBuild"
   ] ++ lib.optional (format == "make")
     "make \${buildTargets:-build} $makeFlags"
-  ++ lib.optionals (format == "crystal") (lib.mapAttrsToList
-    (bin: attrs: ''
-      crystal ${lib.escapeShellArgs ([
-        "build"
-        "-o"
-        bin
-        (attrs.src or (throw "No source file for crystal binary ${bin} provided"))
-      ] ++ (attrs.options or defaultOptions))}
-    '')
-    crystalBinaries)
+  ++ lib.optionals (format == "crystal") (lib.mapAttrsToList mkCrystalBuildArgs crystalBinaries)
   ++ lib.optional (format == "shards")
     "shards build --local --production ${lib.concatStringsSep " " (args.options or defaultOptions)}"
   ++ [ "runHook postBuild" ]));
diff --git a/pkgs/development/compilers/gcc/10/default.nix b/pkgs/development/compilers/gcc/10/default.nix
index 88d4831812fdf..82269a395fee2 100644
--- a/pkgs/development/compilers/gcc/10/default.nix
+++ b/pkgs/development/compilers/gcc/10/default.nix
@@ -3,6 +3,7 @@
 , langAda ? false
 , langObjC ? stdenv.targetPlatform.isDarwin
 , langObjCpp ? stdenv.targetPlatform.isDarwin
+, langD ? false
 , langGo ? false
 , reproducibleBuild ? true
 , profiledCompiler ? false
@@ -65,6 +66,7 @@ let majorVersion = "10";
         sha256 = ""; # TODO: uncomment and check hash when available.
       }) */
       ++ optional langAda ../gnat-cflags.patch
+      ++ optional langD ../libphobos.patch
       ++ optional langFortran ../gfortran-driving.patch
       ++ optional (targetPlatform.libc == "musl" && targetPlatform.isPower) ../ppc-musl.patch
 
@@ -214,6 +216,7 @@ stdenv.mkDerivation ({
       enableShared
 
       langC
+      langD
       langCC
       langFortran
       langAda
@@ -254,14 +257,14 @@ stdenv.mkDerivation ({
 
   inherit
     (import ../common/extra-target-flags.nix {
-      inherit lib stdenv crossStageStatic libcCross threadsCross;
+      inherit lib stdenv crossStageStatic langD libcCross threadsCross;
     })
     EXTRA_FLAGS_FOR_TARGET
     EXTRA_LDFLAGS_FOR_TARGET
     ;
 
   passthru = {
-    inherit langC langCC langObjC langObjCpp langAda langFortran langGo version;
+    inherit langC langCC langObjC langObjCpp langAda langFortran langGo langD version;
     isGNU = true;
   };
 
diff --git a/pkgs/development/compilers/miranda/default.nix b/pkgs/development/compilers/miranda/default.nix
index 7b29699f151da..332f3d83e263c 100644
--- a/pkgs/development/compilers/miranda/default.nix
+++ b/pkgs/development/compilers/miranda/default.nix
@@ -52,6 +52,11 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  # Workaround build failure on -fno-common toolchains like upstream
+  # gcc-10. Otherwise build fails as:
+  #   ld: types.o:(.bss+0x11b0): multiple definition of `current_file'; y.tab.o:(.bss+0x70): first defined here
+  NIX_CFLAGS_COMPILE = "-fcommon";
+
   makeFlags = [
     "CC=${stdenv.cc.targetPrefix}cc"
     "CFLAGS=-O2"
diff --git a/pkgs/development/compilers/zasm/default.nix b/pkgs/development/compilers/zasm/default.nix
index 88d77653f9238..cd15b756b36e5 100644
--- a/pkgs/development/compilers/zasm/default.nix
+++ b/pkgs/development/compilers/zasm/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     repo = "zasm";
     rev = version;
     sha256 = "sha256-Zbno8kmzss1H2FjwzHB4U7UXxa6oDfsPV80MVVFfM68=";
-    extraPostFetch = ''
+    postFetch = ''
       # remove folder containing files with weird names (causes the hash to turn out differently under macOS vs. Linux)
       rm -rv $out/Test
     '';
diff --git a/pkgs/development/em-modules/generic/default.nix b/pkgs/development/em-modules/generic/default.nix
index 8bfbf6ec30992..a859720294160 100644
--- a/pkgs/development/em-modules/generic/default.nix
+++ b/pkgs/development/em-modules/generic/default.nix
@@ -1,4 +1,4 @@
-{ pkgs, lib, emscripten, python2 }:
+{ pkgs, lib, emscripten, python3 }:
 
 { buildInputs ? [], nativeBuildInputs ? []
 
@@ -12,8 +12,8 @@ pkgs.stdenv.mkDerivation (
 
   pname = "emscripten-${lib.getName args}";
   version = lib.getVersion args;
-  buildInputs = [ emscripten python2 ] ++ buildInputs;
-  nativeBuildInputs = [ emscripten python2 ] ++ nativeBuildInputs;
+  buildInputs = [ emscripten python3 ] ++ buildInputs;
+  nativeBuildInputs = [ emscripten python3 ] ++ nativeBuildInputs;
 
   # fake conftest results with emscripten's python magic
   EMCONFIGURE_JS=2;
@@ -25,6 +25,9 @@ pkgs.stdenv.mkDerivation (
 
     emconfigure ./configure --prefix=$out
 
+    mkdir -p .emscriptencache
+    export EM_CACHE=$(pwd)/.emscriptencache
+
     runHook postConfigure
   '';
 
@@ -32,6 +35,7 @@ pkgs.stdenv.mkDerivation (
     runHook preBuild
 
     HOME=$TMPDIR
+
     emmake make
 
     runHook postBuild
diff --git a/pkgs/development/embedded/platformio/core.nix b/pkgs/development/embedded/platformio/core.nix
index c40f2f45f3128..f44ba4e95b8e7 100644
--- a/pkgs/development/embedded/platformio/core.nix
+++ b/pkgs/development/embedded/platformio/core.nix
@@ -9,32 +9,13 @@
 let
   python = python3.override {
     packageOverrides = self: super: {
-      semantic-version = super.semantic-version.overridePythonAttrs (oldAttrs: rec {
-        version = "2.9.0";
-        src = fetchPypi {
-          pname = "semantic_version";
-          version = version;
-          sha256 = "1chjd8019wnwb5mnd4x4jw9f8nhzg0xnapsdznk0fpiyamrlixdb";
-        };
-      });
-
       starlette = super.starlette.overridePythonAttrs (oldAttrs: rec {
-        version = "0.18.0";
+        version = "0.20.0";
         src = fetchFromGitHub {
           owner = "encode";
           repo = "starlette";
           rev = version;
-          sha256 = "1dpj33cggjjvpd3qdf6hv04z5ckcn9f5dfn98p5a8hx262kgsr9p";
-        };
-      });
-
-      uvicorn = super.uvicorn.overridePythonAttrs (oldAttrs: rec {
-        version = "0.17.0";
-        src = fetchFromGitHub {
-          owner = "encode";
-          repo = "uvicorn";
-          rev = version;
-          sha256 = "142x8skb1yfys6gndfaay2r240j56dkr006p49pw4y9i0v85kynp";
+          sha256 = "sha256-bSgPjKqM262PSufz1LHwrdM+uU8xO55Mifv66HRN02Y=";
         };
       });
     };
@@ -75,6 +56,8 @@ with python.pkgs; buildPythonApplication rec {
   ];
 
   pytestFlagsArray = (map (e: "--deselect tests/${e}") [
+    "commands/pkg/test_exec.py::test_pkg_specified"
+    "commands/pkg/test_exec.py::test_unrecognized_options"
     "commands/test_ci.py::test_ci_boards"
     "commands/test_ci.py::test_ci_build_dir"
     "commands/test_ci.py::test_ci_keep_build_dir"
@@ -84,6 +67,7 @@ with python.pkgs; buildPythonApplication rec {
     "commands/test_init.py::test_init_duplicated_boards"
     "commands/test_init.py::test_init_enable_auto_uploading"
     "commands/test_init.py::test_init_ide_atom"
+    "commands/test_init.py::test_init_ide_clion"
     "commands/test_init.py::test_init_ide_eclipse"
     "commands/test_init.py::test_init_ide_vscode"
     "commands/test_init.py::test_init_incorrect_board"
@@ -112,9 +96,6 @@ with python.pkgs; buildPythonApplication rec {
     "commands/test_lib_complex.py::test_lib_show"
     "commands/test_lib_complex.py::test_lib_stats"
     "commands/test_lib_complex.py::test_search"
-    "commands/test_test.py::test_local_env"
-    "commands/test_test.py::test_multiple_env_build"
-    "commands/test_test.py::test_setup_teardown_are_compilable"
     "package/test_manager.py::test_download"
     "package/test_manager.py::test_install_force"
     "package/test_manager.py::test_install_from_registry"
@@ -132,12 +113,21 @@ with python.pkgs; buildPythonApplication rec {
     "test_misc.py::test_platformio_cli"
     "test_pkgmanifest.py::test_packages"
   ]) ++ (map (e: "--ignore=tests/${e}") [
+    "commands/pkg/test_install.py"
+    "commands/pkg/test_list.py"
+    "commands/pkg/test_outdated.py"
+    "commands/pkg/test_search.py"
+    "commands/pkg/test_show.py"
+    "commands/pkg/test_uninstall.py"
+    "commands/pkg/test_update.py"
     "commands/test_boards.py"
     "commands/test_check.py"
     "commands/test_platform.py"
+    "commands/test_run.py"
+    "commands/test_test.py"
     "commands/test_update.py"
-    "test_maintenance.py"
     "test_ino2cpp.py"
+    "test_maintenance.py"
   ]) ++ [
     "tests"
   ];
diff --git a/pkgs/development/embedded/platformio/default.nix b/pkgs/development/embedded/platformio/default.nix
index 31b7b8d49518f..000c23898ff48 100644
--- a/pkgs/development/embedded/platformio/default.nix
+++ b/pkgs/development/embedded/platformio/default.nix
@@ -4,14 +4,14 @@
 let
   callPackage = newScope self;
 
-  version = "5.2.5";
+  version = "6.0.1";
 
   # pypi tarballs don't contain tests - https://github.com/platformio/platformio-core/issues/1964
   src = fetchFromGitHub {
     owner = "platformio";
     repo = "platformio-core";
     rev = "v${version}";
-    sha256 = "1x1jqprwzpb09ca953rqbh2jvizh7bz8yj30krphb6007bnjilwy";
+    sha256 = "sha256-noLdQctAaMNmfuxI3iybHFx3Q9aTr3gZaUZ+/uO+fnA=";
   };
 
   self = {
diff --git a/pkgs/development/embedded/platformio/use-local-spdx-license-list.patch b/pkgs/development/embedded/platformio/use-local-spdx-license-list.patch
index 342fb120a0f71..65fcbd39d6a1d 100644
--- a/pkgs/development/embedded/platformio/use-local-spdx-license-list.patch
+++ b/pkgs/development/embedded/platformio/use-local-spdx-license-list.patch
@@ -6,7 +6,7 @@ index 416dccfd..896c3649 100644
      @staticmethod
      @memoized(expire="1h")
      def load_spdx_licenses():
--        version = "3.16"
+-        version = "3.17"
 -        spdx_data_url = (
 -            "https://raw.githubusercontent.com/spdx/license-list-data/"
 -            "v%s/json/licenses.json" % version
diff --git a/pkgs/development/interpreters/falcon/default.nix b/pkgs/development/interpreters/falcon/default.nix
index 0d2aa0b64203f..40c05113ecffe 100644
--- a/pkgs/development/interpreters/falcon/default.nix
+++ b/pkgs/development/interpreters/falcon/default.nix
@@ -1,6 +1,6 @@
-{ lib, gccStdenv, fetchFromGitHub, cmake, pkg-config, pcre, zlib, sqlite }:
+{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, pcre, zlib, sqlite }:
 
-gccStdenv.mkDerivation {
+stdenv.mkDerivation {
   pname = "falcon";
   version = "unstable-2018-10-23";
 
diff --git a/pkgs/development/libraries/gecode/default.nix b/pkgs/development/libraries/gecode/default.nix
index fc9835d85db5d..fe13c893480ca 100644
--- a/pkgs/development/libraries/gecode/default.nix
+++ b/pkgs/development/libraries/gecode/default.nix
@@ -1,4 +1,15 @@
-{ lib, stdenv, fetchFromGitHub, bison, flex, perl, gmp, mpfr, enableGist ? true, qtbase }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, bison
+, flex
+, perl
+, gmp
+, mpfr
+, qtbase
+, enableGist ? true
+}:
 
 stdenv.mkDerivation rec {
   pname = "gecode";
@@ -11,6 +22,15 @@ stdenv.mkDerivation rec {
     sha256 = "0b1cq0c810j1xr2x9y9996p894571sdxng5h74py17c6nr8c6dmk";
   };
 
+  patches = [
+    # https://github.com/Gecode/gecode/pull/74
+    (fetchpatch {
+      name = "fix-const-weights-clang.patch";
+      url = "https://github.com/Gecode/gecode/commit/c810c96b1ce5d3692e93439f76c4fa7d3daf9fbb.patch";
+      sha256 = "0270msm22q5g5sqbdh8kmrihlxnnxqrxszk9a49hdxd72736p4fc";
+    })
+  ];
+
   enableParallelBuilding = true;
   dontWrapQtApps = true;
   nativeBuildInputs = [ bison flex ];
diff --git a/pkgs/development/libraries/java/swt/default.nix b/pkgs/development/libraries/java/swt/default.nix
index b85b348a9640a..4c900ed21ac61 100644
--- a/pkgs/development/libraries/java/swt/default.nix
+++ b/pkgs/development/libraries/java/swt/default.nix
@@ -44,7 +44,7 @@ in stdenv.mkDerivation rec {
       "R-${fullVersion}/${pname}-${version}-${metadata.platform}.zip";
     inherit (metadata) sha256;
     stripRoot = false;
-    extraPostFetch = ''
+    postFetch = ''
       mkdir "$unpackDir"
       cd "$unpackDir"
 
diff --git a/pkgs/development/libraries/libsass/default.nix b/pkgs/development/libraries/libsass/default.nix
index 83df5161a8ef1..f4293952b9f40 100644
--- a/pkgs/development/libraries/libsass/default.nix
+++ b/pkgs/development/libraries/libsass/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "1cxj6r85d5f3qxdwzxrmkx8z875hig4cr8zsi30w6vj23cyds3l2";
     # Remove unicode file names which leads to different checksums on HFS+
     # vs. other filesystems because of unicode normalisation.
-    extraPostFetch = ''
+    postFetch = ''
       rm -r $out/test/e2e/unicode-pwd
     '';
   };
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 1e84498d9a9e9..9b5a3e877f9a5 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -5,6 +5,7 @@
 , llvmPackages, libffi, libomxil-bellagio, libva-minimal
 , libelf, libvdpau
 , libglvnd, libunwind
+, vulkan-loader
 , galliumDrivers ? ["auto"]
 , vulkanDrivers ? ["auto"]
 , eglPlatforms ? [ "x11" ] ++ lib.optionals stdenv.isLinux [ "wayland" ]
@@ -144,7 +145,9 @@ self = stdenv.mkDerivation {
     ++ lib.optionals stdenv.isLinux [ libomxil-bellagio libva-minimal ]
     ++ lib.optionals stdenv.isDarwin [ libunwind ]
     ++ lib.optionals enableOpenCL [ libclc llvmPackages.clang llvmPackages.clang-unwrapped ]
-    ++ lib.optional withValgrind valgrind-light;
+    ++ lib.optional withValgrind valgrind-light
+    # Mesa will not build zink when gallium-drivers=auto
+    ++ lib.optional (elem "zink" galliumDrivers) vulkan-loader;
 
   depsBuildBuild = [ pkg-config ];
 
diff --git a/pkgs/development/libraries/pe-parse/default.nix b/pkgs/development/libraries/pe-parse/default.nix
index c8689d15e24bd..d9ccb4447b2fd 100644
--- a/pkgs/development/libraries/pe-parse/default.nix
+++ b/pkgs/development/libraries/pe-parse/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, cmake }:
+{ stdenv, lib, fetchFromGitHub, cmake, fetchpatch }:
 
 stdenv.mkDerivation rec {
   pname = "pe-parse";
@@ -11,10 +11,14 @@ stdenv.mkDerivation rec {
     hash = "sha256-HwWlMRhpB/sa/JRyAZF7LZzkXCCyuxB+gtDAfHt7e6k=";
   };
 
-  nativeBuildInputs = [ cmake ];
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/trailofbits/pe-parse/commit/eecdb3d36eb44e306398a2e66e85490f9bdcc74c.patch";
+      hash = "sha256-pd6D/JMctiQqJxnJU9Nm/GDVf4/CaIGeXx1UfdcCupo=";
+    })
+  ];
 
-  # See https://github.com/trailofbits/pe-parse/issues/169
-  NIX_CFLAGS_COMPILE = "-Wno-sign-conversion";
+  nativeBuildInputs = [ cmake ];
 
   doInstallCheck = true;
   installCheckPhase = ''
diff --git a/pkgs/development/misc/resholve/oildev.nix b/pkgs/development/misc/resholve/oildev.nix
index 7f51342fbde98..00855e7f7bcc8 100644
--- a/pkgs/development/misc/resholve/oildev.nix
+++ b/pkgs/development/misc/resholve/oildev.nix
@@ -70,7 +70,7 @@ rec {
         Note: -f is necessary to keep it from being a pain to update
         hash on rev updates. Command will fail w/o and not print hash.
       */
-      extraPostFetch = ''
+      postFetch = ''
         rm -rf Python-2.7.13 benchmarks metrics py-yajl rfc gold web testdata services demo devtools cpp
       '';
     };
diff --git a/pkgs/development/ocaml-modules/faraday/default.nix b/pkgs/development/ocaml-modules/faraday/default.nix
index 48a6a82a738c0..92a46694f86a2 100644
--- a/pkgs/development/ocaml-modules/faraday/default.nix
+++ b/pkgs/development/ocaml-modules/faraday/default.nix
@@ -2,7 +2,7 @@
 
 buildDunePackage rec {
   pname = "faraday";
-  version = "0.7.2";
+  version = "0.8.1";
 
   useDune2 = true;
 
@@ -12,7 +12,7 @@ buildDunePackage rec {
     owner = "inhabitedtype";
     repo = pname;
     rev = version;
-    sha256 = "0gdysszzk6b6npic4nhpdnz2nbq7rma6aml0rbn113bfh0rmb36x";
+    sha256 = "sha256-eeR+nst/r2iFxCDmRS+LGr3yl/o27DcsS30YAu1GJmc=";
   };
 
   checkInputs = [ alcotest ];
diff --git a/pkgs/development/ocaml-modules/hacl_x25519/default.nix b/pkgs/development/ocaml-modules/hacl_x25519/default.nix
index 46a04a51fcab3..245b61ef1aae0 100644
--- a/pkgs/development/ocaml-modules/hacl_x25519/default.nix
+++ b/pkgs/development/ocaml-modules/hacl_x25519/default.nix
@@ -3,11 +3,11 @@
 
 buildDunePackage rec {
   pname = "hacl_x25519";
-  version = "0.2.0";
+  version = "0.2.2";
 
   src = fetchurl {
     url = "https://github.com/mirage/hacl/releases/download/v${version}/${pname}-v${version}.tbz";
-    sha256 = "0ppq56i2yhxzz38w120aynnkx10kncl86zvqip9zx0v4974k3k4x";
+    sha256 = "sha256-gWdUqOj5c50ObZjO1uULAmoo1ZIyRFxQUaZuQzLMVy0=";
   };
 
   useDune2 = true;
diff --git a/pkgs/development/php-packages/grpc/default.nix b/pkgs/development/php-packages/grpc/default.nix
new file mode 100644
index 0000000000000..24be5b3a66256
--- /dev/null
+++ b/pkgs/development/php-packages/grpc/default.nix
@@ -0,0 +1,20 @@
+{ buildPecl, zlib, lib }:
+
+buildPecl {
+  pname = "grpc";
+
+  version = "1.45.0";
+  sha256 = "sha256-SPnECBZ80sXfXYiVJjGfOsSxZBBZnasO9pPu9Q5klIg";
+
+  doCheck = true;
+  checkTarget = "test";
+
+  nativeBuildInputs = [ zlib ];
+
+  meta = with lib; {
+    description = "A high performance, open source, general RPC framework that puts mobile and HTTP/2 first.";
+    license = licenses.asl20;
+    homepage = "https://github.com/grpc/grpc/tree/master/src/php/ext/grpc";
+    maintainers = teams.php.members;
+  };
+}
diff --git a/pkgs/development/python-modules/Mako/default.nix b/pkgs/development/python-modules/Mako/default.nix
index 5eca80d98a519..a74f9988ad7aa 100644
--- a/pkgs/development/python-modules/Mako/default.nix
+++ b/pkgs/development/python-modules/Mako/default.nix
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     markupsafe
   ];
 
-  passthru.extras-require = {
+  passthru.optional-dependencies = {
     babel = [
       babel
     ];
@@ -39,7 +39,7 @@ buildPythonPackage rec {
   checkInputs = [
     pytestCheckHook
     mock
-  ] ++ passthru.extras-require.babel;
+  ] ++ passthru.optional-dependencies.babel;
 
   disabledTests = lib.optionals isPyPy [
     # https://github.com/sqlalchemy/mako/issues/315
diff --git a/pkgs/development/python-modules/adb-shell/default.nix b/pkgs/development/python-modules/adb-shell/default.nix
index 792729da1fac9..bc10948f070fb 100644
--- a/pkgs/development/python-modules/adb-shell/default.nix
+++ b/pkgs/development/python-modules/adb-shell/default.nix
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     rsa
   ];
 
-  passthru.extras-require = {
+  passthru.optional-dependencies = {
     async = [
       aiofiles
     ];
@@ -47,8 +47,8 @@ buildPythonPackage rec {
     pycryptodome
     pytestCheckHook
   ]
-  ++ passthru.extras-require.async
-  ++ passthru.extras-require.usb;
+  ++ passthru.optional-dependencies.async
+  ++ passthru.optional-dependencies.usb;
 
   disabledTests = lib.optionals (pythonAtLeast "3.10") [
     # Tests are failing with Python 3.10
diff --git a/pkgs/development/python-modules/airtouch4pyapi/default.nix b/pkgs/development/python-modules/airtouch4pyapi/default.nix
index 193070ac72613..1c567181f9b48 100644
--- a/pkgs/development/python-modules/airtouch4pyapi/default.nix
+++ b/pkgs/development/python-modules/airtouch4pyapi/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , numpy
 , pythonOlder
 }:
@@ -20,6 +21,14 @@ buildPythonPackage rec {
     sha256 = "17c7fm72p085pg9msvsfdggbskvm12a6jlb5bw1cndrqsqcrxywx";
   };
 
+  patches = [
+    # https://github.com/LonePurpleWolf/airtouch4pyapi/pull/10
+    (fetchpatch {
+      url = "https://github.com/LonePurpleWolf/airtouch4pyapi/commit/5b5d91fad63495c83422e7a850897946ac95b25d.patch";
+      hash = "sha256-tVlCLXuOJSqjbs0jj0iHCIXWZE8wmMV3ChzmE6uq3SM=";
+    })
+  ];
+
   propagatedBuildInputs = [
     numpy
   ];
diff --git a/pkgs/development/python-modules/androidtv/default.nix b/pkgs/development/python-modules/androidtv/default.nix
index 2f7afc1137565..456186e45ab3e 100644
--- a/pkgs/development/python-modules/androidtv/default.nix
+++ b/pkgs/development/python-modules/androidtv/default.nix
@@ -28,19 +28,19 @@ buildPythonPackage rec {
     pure-python-adb
   ];
 
-  passthru.extras-require = {
+  passthru.optional-dependencies = {
     async = [
       aiofiles
     ];
-    inherit (adb-shell.extras-require) usb;
+    inherit (adb-shell.optional-dependencies) usb;
   };
 
   checkInputs = [
     mock
     pytestCheckHook
   ]
-  ++ passthru.extras-require.async
-  ++ passthru.extras-require.usb;
+  ++ passthru.optional-dependencies.async
+  ++ passthru.optional-dependencies.usb;
 
   disabledTests = [
     # Requires git but fails anyway
diff --git a/pkgs/development/python-modules/autobahn/default.nix b/pkgs/development/python-modules/autobahn/default.nix
index ff866c6364cab..5fd6f1a3b8f9d 100644
--- a/pkgs/development/python-modules/autobahn/default.nix
+++ b/pkgs/development/python-modules/autobahn/default.nix
@@ -68,8 +68,8 @@ buildPythonPackage rec {
     mock
     pytest-asyncio
     pytestCheckHook
-  ] ++ passthru.extras-require.scram
-  ++ passthru.extras-require.serialization;
+  ] ++ passthru.optional-dependencies.scram
+  ++ passthru.optional-dependencies.serialization;
 
   postPatch = ''
     substituteInPlace setup.py \
@@ -89,7 +89,7 @@ buildPythonPackage rec {
     "autobahn"
   ];
 
-  passthru.extras-require = rec {
+  passthru.optional-dependencies = rec {
     all = accelerate ++ compress ++ encryption ++ nvx ++ serialization ++ scram ++ twisted ++ ui ++ xbr;
     accelerate = [ /* wsaccel */ ];
     compress = [ python-snappy ];
diff --git a/pkgs/development/python-modules/beautifultable/default.nix b/pkgs/development/python-modules/beautifultable/default.nix
index 646cfe8af9a2c..e222a8cdd9c46 100644
--- a/pkgs/development/python-modules/beautifultable/default.nix
+++ b/pkgs/development/python-modules/beautifultable/default.nix
@@ -3,17 +3,21 @@
 , fetchFromGitHub
 , wcwidth
 , pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "beautifultable";
-  version = "1.0.1";
+  version = "1.1.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "pri22296";
     repo = pname;
     rev = "v${version}";
-    sha256 = "12ci6jy8qmbphsvzvj98466nlhclfzs0a0pmbsv3mf5bfcdwvbh7";
+    hash = "sha256-/SReCEvSwiNjBoz/3tGJ9zUNBAag4mLsHlUXwm47zCw=";
   };
 
   propagatedBuildInputs = [
@@ -24,9 +28,13 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  pytestFlagsArray = [ "test.py" ];
+  pytestFlagsArray = [
+    "test.py"
+  ];
 
-  pythonImportsCheck = [ "beautifultable" ];
+  pythonImportsCheck = [
+    "beautifultable"
+  ];
 
   meta = with lib; {
     description = "Python package for printing visually appealing tables";
diff --git a/pkgs/development/python-modules/buildbot/default.nix b/pkgs/development/python-modules/buildbot/default.nix
index 6111772122716..f08c434406255 100644
--- a/pkgs/development/python-modules/buildbot/default.nix
+++ b/pkgs/development/python-modules/buildbot/default.nix
@@ -54,7 +54,7 @@ let
       pyyaml
     ]
       # tls
-      ++ twisted.extras-require.tls;
+      ++ twisted.optional-dependencies.tls;
 
     checkInputs = [
       treq
diff --git a/pkgs/development/python-modules/clize/default.nix b/pkgs/development/python-modules/clize/default.nix
index 10b4c8f68c69a..1b0caeaaf266a 100644
--- a/pkgs/development/python-modules/clize/default.nix
+++ b/pkgs/development/python-modules/clize/default.nix
@@ -40,7 +40,7 @@ buildPythonPackage rec {
     six
   ];
 
-  passthru.extras-require = {
+  passthru.optional-dependencies = {
     datetime = [
       python-dateutil
     ];
diff --git a/pkgs/development/python-modules/dask/default.nix b/pkgs/development/python-modules/dask/default.nix
index 79f07c6e88f22..59869efbffd8c 100644
--- a/pkgs/development/python-modules/dask/default.nix
+++ b/pkgs/development/python-modules/dask/default.nix
@@ -98,7 +98,7 @@ buildPythonPackage rec {
     "dask.diagnostics"
   ];
 
-  passthru.extras-require = {
+  passthru.optional-dependencies = {
     complete = [ distributed ];
   };
 
diff --git a/pkgs/development/python-modules/datashader/default.nix b/pkgs/development/python-modules/datashader/default.nix
index b9630aa07fd4d..243571f248bb5 100644
--- a/pkgs/development/python-modules/datashader/default.nix
+++ b/pkgs/development/python-modules/datashader/default.nix
@@ -46,7 +46,7 @@ buildPythonPackage rec {
     param
     pyct
     scipy
-  ] ++ dask.extras-require.complete;
+  ] ++ dask.optional-dependencies.complete;
 
   checkInputs = [
     pytestCheckHook
diff --git a/pkgs/development/python-modules/django_modelcluster/default.nix b/pkgs/development/python-modules/django_modelcluster/default.nix
index 02995c1570b9f..d59682de2f819 100644
--- a/pkgs/development/python-modules/django_modelcluster/default.nix
+++ b/pkgs/development/python-modules/django_modelcluster/default.nix
@@ -27,11 +27,11 @@ buildPythonPackage rec {
     pytz
   ];
 
-  passthru.extras-require.taggit = [
+  passthru.optional-dependencies.taggit = [
     django-taggit
   ];
 
-  checkInputs = passthru.extras-require.taggit;
+  checkInputs = passthru.optional-dependencies.taggit;
 
   checkPhase = ''
     runHook preCheck
diff --git a/pkgs/development/python-modules/fastapi/default.nix b/pkgs/development/python-modules/fastapi/default.nix
index 63071fd9e4469..3d418d75333f6 100644
--- a/pkgs/development/python-modules/fastapi/default.nix
+++ b/pkgs/development/python-modules/fastapi/default.nix
@@ -49,7 +49,7 @@ buildPythonPackage rec {
     pytest-asyncio
     sqlalchemy
     trio
-  ] ++ passlib.extras-require.bcrypt;
+  ] ++ passlib.optional-dependencies.bcrypt;
 
   patches = [
     # Bump starlette, https://github.com/tiangolo/fastapi/pull/4483
diff --git a/pkgs/development/python-modules/flask-security-too/default.nix b/pkgs/development/python-modules/flask-security-too/default.nix
index 789060ed2b5e4..eb9c01699e5b8 100644
--- a/pkgs/development/python-modules/flask-security-too/default.nix
+++ b/pkgs/development/python-modules/flask-security-too/default.nix
@@ -63,7 +63,7 @@ buildPythonPackage rec {
     passlib
   ];
 
-  passthru.extras-require = {
+  passthru.optional-dependencies = {
     babel = [
       babel
       flask-babel
@@ -95,10 +95,10 @@ buildPythonPackage rec {
     pytestCheckHook
     zxcvbn
   ]
-  ++ passthru.extras-require.babel
-  ++ passthru.extras-require.common
-  ++ passthru.extras-require.fsqla
-  ++ passthru.extras-require.mfa;
+  ++ passthru.optional-dependencies.babel
+  ++ passthru.optional-dependencies.common
+  ++ passthru.optional-dependencies.fsqla
+  ++ passthru.optional-dependencies.mfa;
 
 
   pythonImportsCheck = [ "flask_security" ];
diff --git a/pkgs/development/python-modules/httpcore/default.nix b/pkgs/development/python-modules/httpcore/default.nix
index 5b8d84ec30893..d2286b6b022b9 100644
--- a/pkgs/development/python-modules/httpcore/default.nix
+++ b/pkgs/development/python-modules/httpcore/default.nix
@@ -42,7 +42,7 @@ buildPythonPackage rec {
     sniffio
   ];
 
-  passthru.extras-require = {
+  passthru.optional-dependencies = {
     http2 = [ h2 ];
     socks = [ socksio ];
   };
@@ -56,8 +56,8 @@ buildPythonPackage rec {
     trio
     trustme
     uvicorn
-  ] ++ passthru.extras-require.http2
-    ++ passthru.extras-require.socks;
+  ] ++ passthru.optional-dependencies.http2
+    ++ passthru.optional-dependencies.socks;
 
   pythonImportsCheck = [ "httpcore" ];
 
diff --git a/pkgs/development/python-modules/httpx-socks/default.nix b/pkgs/development/python-modules/httpx-socks/default.nix
index 3bfbf2327f217..f8334593904c3 100644
--- a/pkgs/development/python-modules/httpx-socks/default.nix
+++ b/pkgs/development/python-modules/httpx-socks/default.nix
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     python-socks
   ];
 
-  passthru.extras-require = {
+  passthru.optional-dependencies = {
     asyncio = [ async-timeout ];
     trio = [ trio ];
   };
diff --git a/pkgs/development/python-modules/httpx/default.nix b/pkgs/development/python-modules/httpx/default.nix
index d75dbaa1c9bdb..0070d5d04eff5 100644
--- a/pkgs/development/python-modules/httpx/default.nix
+++ b/pkgs/development/python-modules/httpx/default.nix
@@ -49,7 +49,7 @@ buildPythonPackage rec {
     async_generator
   ];
 
-  passthru.extras-require = {
+  passthru.optional-dependencies = {
     http2 = [ h2 ];
     socks = [ socksio ];
     brotli = if isPyPy then [ brotlicffi ] else [ brotli ];
@@ -63,9 +63,9 @@ buildPythonPackage rec {
     trustme
     typing-extensions
     uvicorn
-  ] ++ passthru.extras-require.http2
-    ++ passthru.extras-require.brotli
-    ++ passthru.extras-require.socks;
+  ] ++ passthru.optional-dependencies.http2
+    ++ passthru.optional-dependencies.brotli
+    ++ passthru.optional-dependencies.socks;
 
   postPatch = ''
     substituteInPlace setup.py \
diff --git a/pkgs/development/python-modules/ibis-framework/default.nix b/pkgs/development/python-modules/ibis-framework/default.nix
index c5dfcc13e5c47..539238ba948d6 100644
--- a/pkgs/development/python-modules/ibis-framework/default.nix
+++ b/pkgs/development/python-modules/ibis-framework/default.nix
@@ -99,7 +99,7 @@ buildPythonPackage rec {
     pytest-mock
     pytest-randomly
     pytest-xdist
-  ] ++ lib.concatMap (name: passthru.extras-require.${name}) testBackends;
+  ] ++ lib.concatMap (name: passthru.optional-dependencies.${name}) testBackends;
 
   preBuild = ''
     # setup.py exists only for developer convenience and is automatically generated
@@ -139,7 +139,7 @@ buildPythonPackage rec {
   ] ++ map (backend: "ibis.backends.${backend}") testBackends;
 
   passthru = {
-    extras-require = {
+    optional-dependencies = {
       clickhouse = [ clickhouse-cityhash clickhouse-driver lz4 ];
       dask = [ dask pyarrow ];
       datafusion = [ datafusion ];
diff --git a/pkgs/development/python-modules/keyring/default.nix b/pkgs/development/python-modules/keyring/default.nix
index 71e9be548e5bd..c1ad68846a79f 100644
--- a/pkgs/development/python-modules/keyring/default.nix
+++ b/pkgs/development/python-modules/keyring/default.nix
@@ -13,12 +13,14 @@
 
 buildPythonPackage rec {
   pname = "keyring";
-  version = "23.5.0";
+  version = "23.5.1";
   disabled = pythonOlder "3.7";
 
+  format = "pyproject";
+
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-kBJQjhQagL0cC2d41cYQ3Z+MRk11rGd0JIUAUD+XL7k=";
+    hash = "sha256-3uUCzfGKmCEb70KO6hFFajPABxiy8IUk/Vcnx/Qkv/0=";
   };
 
   nativeBuildInputs = [
@@ -28,8 +30,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     # this should be optional, however, it has a different API
     importlib-metadata # see https://github.com/jaraco/keyring/issues/503#issuecomment-798973205
-
-    dbus-python
+  ] ++ lib.optionals stdenv.isLinux [
     jeepney
     secretstorage
   ];
diff --git a/pkgs/development/python-modules/ldaptor/default.nix b/pkgs/development/python-modules/ldaptor/default.nix
index 55725fb49c9f8..f7b5e7cf96b86 100644
--- a/pkgs/development/python-modules/ldaptor/default.nix
+++ b/pkgs/development/python-modules/ldaptor/default.nix
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     six
     twisted
     zope_interface
-  ] ++ twisted.extras-require.tls;
+  ] ++ twisted.optional-dependencies.tls;
 
   checkInputs = [
     twisted
diff --git a/pkgs/development/python-modules/lektor/default.nix b/pkgs/development/python-modules/lektor/default.nix
index 4688b7394cc33..0c0c5c108a46a 100644
--- a/pkgs/development/python-modules/lektor/default.nix
+++ b/pkgs/development/python-modules/lektor/default.nix
@@ -62,7 +62,6 @@ buildPythonPackage rec {
   checkInputs = [
     pytest-click
     pytest-mock
-    pytest-pylint
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/limits/default.nix b/pkgs/development/python-modules/limits/default.nix
index afc777e1d858f..a79bd445b6bfb 100644
--- a/pkgs/development/python-modules/limits/default.nix
+++ b/pkgs/development/python-modules/limits/default.nix
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     # Upstream uses versioneer, which relies on git attributes substitution.
     # This leads to non-reproducible archives on github. Remove the substituted
     # file here, and recreate it later based on our version info.
-    extraPostFetch = ''
+    postFetch = ''
       rm "$out/limits/_version.py"
     '';
     hash = "sha256-ja+YbRHCcZ5tFnoofdR44jbkkdDroVUdKeDOt6yE0LI=";
diff --git a/pkgs/development/python-modules/magic-wormhole-mailbox-server/default.nix b/pkgs/development/python-modules/magic-wormhole-mailbox-server/default.nix
index 77870ed683656..4d000c7a1672f 100644
--- a/pkgs/development/python-modules/magic-wormhole-mailbox-server/default.nix
+++ b/pkgs/development/python-modules/magic-wormhole-mailbox-server/default.nix
@@ -25,8 +25,8 @@ buildPythonPackage rec {
     six
     twisted
     autobahn
-  ] ++ autobahn.extras-require.twisted
-  ++ twisted.extras-require.tls;
+  ] ++ autobahn.optional-dependencies.twisted
+  ++ twisted.optional-dependencies.tls;
 
   checkInputs = [
     treq
diff --git a/pkgs/development/python-modules/magic-wormhole/default.nix b/pkgs/development/python-modules/magic-wormhole/default.nix
index c6450c3cecb9d..38e0b16726a87 100644
--- a/pkgs/development/python-modules/magic-wormhole/default.nix
+++ b/pkgs/development/python-modules/magic-wormhole/default.nix
@@ -42,8 +42,8 @@ buildPythonPackage rec {
     click
     humanize
     txtorcon
-  ] ++ autobahn.extras-require.twisted
-  ++ twisted.extras-require.tls;
+  ] ++ autobahn.optional-dependencies.twisted
+  ++ twisted.optional-dependencies.tls;
 
   checkInputs = [
     mock
diff --git a/pkgs/development/python-modules/mkdocs-drawio-exporter/default.nix b/pkgs/development/python-modules/mkdocs-drawio-exporter/default.nix
new file mode 100644
index 0000000000000..9d95d72fee772
--- /dev/null
+++ b/pkgs/development/python-modules/mkdocs-drawio-exporter/default.nix
@@ -0,0 +1,33 @@
+{ buildPythonPackage
+, drawio-headless
+, fetchPypi
+, isPy3k
+, lib
+, mkdocs
+}:
+
+buildPythonPackage rec {
+  pname = "mkdocs-drawio-exporter";
+  version = "0.8.0";
+
+  disabled = !isPy3k;
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-9cvA186FS6bHmpOrv4OfPZ5kRfgfafBfaWxgWJIlwwA=";
+  };
+
+  propagatedBuildInputs = [ mkdocs drawio-headless ];
+
+  pythonImportsCheck = [ "mkdocsdrawioexporter" ];
+
+  meta = with lib; {
+    description = "Exports your Draw.io diagrams at build time for easier embedding into your documentation.";
+    homepage = "https://github.com/LukeCarrier/mkdocs-drawio-exporter/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ snpschaaf ];
+    longDescription = ''
+      Exports your Draw.io diagrams at build time for easier embedding into your documentation.
+    '';
+  };
+}
diff --git a/pkgs/development/python-modules/ocrmypdf/default.nix b/pkgs/development/python-modules/ocrmypdf/default.nix
index 405748599ab43..e411519c95a4a 100644
--- a/pkgs/development/python-modules/ocrmypdf/default.nix
+++ b/pkgs/development/python-modules/ocrmypdf/default.nix
@@ -36,7 +36,7 @@ buildPythonPackage rec {
     # The content of .git_archival.txt is substituted upon tarball creation,
     # which creates indeterminism if master no longer points to the tag.
     # See https://github.com/jbarlow83/OCRmyPDF/issues/841
-    extraPostFetch = ''
+    postFetch = ''
       rm "$out/.git_archival.txt"
     '';
     hash = "sha256-uFKnohUxh17h6u0vwVB7EaTEh5NRowP8a6za63Ehodk=";
diff --git a/pkgs/development/python-modules/pamqp/default.nix b/pkgs/development/python-modules/pamqp/default.nix
index 1785a8593102b..a367a180807d0 100644
--- a/pkgs/development/python-modules/pamqp/default.nix
+++ b/pkgs/development/python-modules/pamqp/default.nix
@@ -1,28 +1,46 @@
 { lib
 , buildPythonPackage
-, fetchPypi
-, mock
-, nose
-, pep8
-, pylint
-, mccabe
+, pythonOlder
+, fetchFromGitHub
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   version = "3.1.0";
   pname = "pamqp";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "e4f0886d72c6166637a5513626148bf5a7e818073a558980e9aaed8b4ccf30da";
+  disabled = pythonOlder "3.7";
+
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "gmr";
+    repo = "pamqp";
+    rev = version;
+    hash = "sha256-qiYfQsyYvG6pyRFDt3pyYKNNWNP88maj+VAeGD68OmY=";
   };
 
-  buildInputs = [ mock nose pep8 pylint mccabe ];
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "pamqp.base"
+    "pamqp.body"
+    "pamqp.commands"
+    "pamqp.common"
+    "pamqp.decode"
+    "pamqp.encode"
+    "pamqp.exceptions"
+    "pamqp.frame"
+    "pamqp.header"
+    "pamqp.heartbeat"
+  ];
 
   meta = with lib; {
     description = "RabbitMQ Focused AMQP low-level library";
-    homepage = "https://pypi.python.org/pypi/pamqp";
+    homepage = "https://github.com/gmr/pamqp";
     license = licenses.bsd3;
+    maintainers = with maintainers; [ dotlambda ];
   };
-
 }
diff --git a/pkgs/development/python-modules/passlib/default.nix b/pkgs/development/python-modules/passlib/default.nix
index 8fd7b177a27c8..3a39f7ac7d58a 100644
--- a/pkgs/development/python-modules/passlib/default.nix
+++ b/pkgs/development/python-modules/passlib/default.nix
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     sha256 = "defd50f72b65c5402ab2c573830a6978e5f202ad0d984793c8dde2c4152ebe04";
   };
 
-  passthru.extras-require = {
+  passthru.optional-dependencies = {
     argon2 = [ argon2-cffi ];
     bcrypt = [ bcrypt ];
     totp = [ cryptography ];
@@ -24,9 +24,9 @@ buildPythonPackage rec {
 
   checkInputs = [
     pytestCheckHook
-  ] ++ passthru.extras-require.argon2
-    ++ passthru.extras-require.bcrypt
-    ++ passthru.extras-require.totp;
+  ] ++ passthru.optional-dependencies.argon2
+    ++ passthru.optional-dependencies.bcrypt
+    ++ passthru.optional-dependencies.totp;
 
   meta = with lib; {
     description = "A password hashing library for Python";
diff --git a/pkgs/development/python-modules/pelican/default.nix b/pkgs/development/python-modules/pelican/default.nix
index 723b3888edb8c..9f11251ea8a81 100644
--- a/pkgs/development/python-modules/pelican/default.nix
+++ b/pkgs/development/python-modules/pelican/default.nix
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     hash = "sha256-ZBGzsyCtFt5uj9mpOpGdTzGJET0iwOAgDTy80P6anRU=";
     # Remove unicode file names which leads to different checksums on HFS+
     # vs. other filesystems because of unicode normalisation.
-    extraPostFetch = ''
+    postFetch = ''
       rm -r $out/pelican/tests/output/custom_locale/posts
     '';
   };
diff --git a/pkgs/development/python-modules/pikepdf/default.nix b/pkgs/development/python-modules/pikepdf/default.nix
index b86dabee9f2a0..aa5a66826cbe8 100644
--- a/pkgs/development/python-modules/pikepdf/default.nix
+++ b/pkgs/development/python-modules/pikepdf/default.nix
@@ -37,7 +37,7 @@ buildPythonPackage rec {
     # The content of .git_archival.txt is substituted upon tarball creation,
     # which creates indeterminism if master no longer points to the tag.
     # See https://github.com/jbarlow83/OCRmyPDF/issues/841
-    extraPostFetch = ''
+    postFetch = ''
       rm "$out/.git_archival.txt"
     '';
     hash = "sha256-jkAwc1bQ1jRDf/qY+xAjiLXXO98qKjyX+J7Lu4tYWoI=";
diff --git a/pkgs/development/python-modules/pulumi-aws/default.nix b/pkgs/development/python-modules/pulumi-aws/default.nix
new file mode 100644
index 0000000000000..1b6eed0d31a63
--- /dev/null
+++ b/pkgs/development/python-modules/pulumi-aws/default.nix
@@ -0,0 +1,44 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, fetchpatch
+, pulumi
+, parver
+, semver
+, isPy27
+}:
+
+buildPythonPackage rec {
+  pname = "pulumi-aws";
+  # version is independant of pulumi's.
+  version = "5.3.0";
+  disabled = isPy27;
+
+  src = fetchFromGitHub {
+    owner = "pulumi";
+    repo = "pulumi-aws";
+    rev = "v${version}";
+    sha256 = "sha256-LrWiNYJeQQvXJDOxklRO86VSiaadvkOepQVPhh2BBkk=";
+  };
+
+  propagatedBuildInputs = [
+    pulumi
+    parver
+    semver
+  ];
+
+  postPatch = ''
+    cd sdk/python
+  '';
+
+  # checks require cloud resources
+  doCheck = false;
+  pythonImportsCheck = ["pulumi_aws"];
+
+  meta = with lib; {
+    description = "Pulumi python amazon web services provider";
+    homepage = "https://github.com/pulumi/pulumi-aws";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ costrouc ];
+  };
+}
diff --git a/pkgs/development/python-modules/pulumi/default.nix b/pkgs/development/python-modules/pulumi/default.nix
new file mode 100644
index 0000000000000..e38157c69071c
--- /dev/null
+++ b/pkgs/development/python-modules/pulumi/default.nix
@@ -0,0 +1,89 @@
+{ lib
+, buildPythonPackage
+, fetchpatch
+, fetchFromGitHub
+, protobuf
+, dill
+, grpcio
+, pulumi-bin
+, isPy27
+, semver
+, pyyaml
+, six
+
+
+# for tests
+, tox
+, go
+, pulumictl
+, bash
+, pylint
+, pytest
+, pytest-timeout
+, coverage
+, black
+, wheel
+, pytest-asyncio
+
+, mypy
+}:
+let
+  data = import ./data.nix {};
+in
+buildPythonPackage rec {
+  pname = "pulumi";
+  version = pulumi-bin.version;
+  disabled = isPy27;
+
+  src = fetchFromGitHub {
+    owner = "pulumi";
+    repo = "pulumi";
+    rev = "v${pulumi-bin.version}";
+    sha256 = "sha256-vqEZEHTpJV65a3leWwYhyi3dzAsN67BXOvk5hnTPeuI=";
+  };
+
+  propagatedBuildInputs = [
+    semver
+    protobuf
+    dill
+    grpcio
+    pyyaml
+    six
+  ];
+
+  checkInputs = [
+    pulumi-bin
+    pulumictl
+    mypy
+    bash
+    go
+    tox
+    pytest
+    pytest-timeout
+    coverage
+    pytest-asyncio
+    wheel
+    black
+  ];
+
+  pythonImportsCheck = ["pulumi"];
+
+  postPatch = ''
+    cp README.md sdk/python/lib
+    patchShebangs .
+    cd sdk/python/lib
+
+    substituteInPlace setup.py \
+      --replace "{VERSION}" "${version}"
+  '';
+
+  # disabled because tests try to fetch go packages from the net
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Modern Infrastructure as Code. Any cloud, any language";
+    homepage = "https://github.com/pulumi/pulumi";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ teto ];
+  };
+}
diff --git a/pkgs/development/python-modules/pure-python-adb/default.nix b/pkgs/development/python-modules/pure-python-adb/default.nix
index cb054feaf10f1..512c38b730d3e 100644
--- a/pkgs/development/python-modules/pure-python-adb/default.nix
+++ b/pkgs/development/python-modules/pure-python-adb/default.nix
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     sha256 = "0kdr7w2fhgjpcf1k3l6an9im583iqkr6v8hb4q1zw30nh3bqkk0f";
   };
 
-  passthru.extras-require = {
+  passthru.optional-dependencies = {
     async = [
       aiofiles
     ];
@@ -28,7 +28,7 @@ buildPythonPackage rec {
   checkInputs = [
     pytestCheckHook
   ]
-  ++ passthru.extras-require.async;
+  ++ passthru.optional-dependencies.async;
 
   pythonImportsCheck = [
     "ppadb.client"
diff --git a/pkgs/development/python-modules/pygame/default.nix b/pkgs/development/python-modules/pygame/default.nix
index 909ce1caa38be..751bb9c8ae942 100644
--- a/pkgs/development/python-modules/pygame/default.nix
+++ b/pkgs/development/python-modules/pygame/default.nix
@@ -15,7 +15,7 @@ buildPythonPackage rec {
     # filesystems because of unicode normalisation. The documentation
     # has such files and will be removed.
     sha256 = "sha256-v1z6caEMJNXqbcbTmFXoy3KQewHiz6qK4vhNU6Qbukk=";
-    extraPostFetch = "rm -rf $out/docs/reST";
+    postFetch = "rm -rf $out/docs/reST";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/pygatt/default.nix b/pkgs/development/python-modules/pygatt/default.nix
index 8d6f67a4c7514..fab5c093c5028 100644
--- a/pkgs/development/python-modules/pygatt/default.nix
+++ b/pkgs/development/python-modules/pygatt/default.nix
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     pyserial
   ];
 
-  passthru.extras-require.GATTTOOL = [
+  passthru.optional-dependencies.GATTTOOL = [
     pexpect
   ];
 
@@ -34,7 +34,7 @@ buildPythonPackage rec {
     nose
     pytestCheckHook
   ]
-  ++ passthru.extras-require.GATTTOOL;
+  ++ passthru.optional-dependencies.GATTTOOL;
 
   postPatch = ''
     # Not support for Python < 3.4
diff --git a/pkgs/development/python-modules/pyglet/default.nix b/pkgs/development/python-modules/pyglet/default.nix
index 029061b801082..6048991cbff2d 100644
--- a/pkgs/development/python-modules/pyglet/default.nix
+++ b/pkgs/development/python-modules/pyglet/default.nix
@@ -18,13 +18,13 @@
 }:
 
 buildPythonPackage rec {
-  version = "1.5.24";
+  version = "1.5.26";
   pname = "pyglet";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-W0pNXlrVSUbjFJLqxn9ykuUaZXckRkGidxgPkKAZKo4=";
+    sha256 = "sha256-7oxeC1uH34QYjiDlUpguuo2gCUS0xVYPHP3VyXFNGbA=";
     extension = "zip";
   };
 
diff --git a/pkgs/development/python-modules/python-barcode/default.nix b/pkgs/development/python-modules/python-barcode/default.nix
index 165cb5cc5d27f..5d64f933b6910 100644
--- a/pkgs/development/python-modules/python-barcode/default.nix
+++ b/pkgs/development/python-modules/python-barcode/default.nix
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
-  passthru.extras-require = {
+  passthru.optional-dependencies = {
     images = [
       pillow
     ];
@@ -38,7 +38,7 @@ buildPythonPackage rec {
 
   checkInputs = [
     pytestCheckHook
-  ] ++ passthru.extras-require.images;
+  ] ++ passthru.optional-dependencies.images;
 
   pythonImportsCheck = [ "barcode" ];
 
diff --git a/pkgs/development/python-modules/python-glanceclient/default.nix b/pkgs/development/python-modules/python-glanceclient/default.nix
index 3d290ae5eda5e..f534d4968af1b 100644
--- a/pkgs/development/python-modules/python-glanceclient/default.nix
+++ b/pkgs/development/python-modules/python-glanceclient/default.nix
@@ -11,6 +11,7 @@
 , oslo-i18n
 , wrapt
 , pyopenssl
+, pythonOlder
 , stestr
 , testscenarios
 , ddt
@@ -19,11 +20,14 @@
 
 buildPythonApplication rec {
   pname = "python-glanceclient";
-  version = "3.6.0";
+  version = "4.0.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-gi1IYtWJL2pltoKTRy5gsHTRwHlp0GHoBMbh1UP5g9o=";
+    hash = "sha256-a3tFLmSKuaKbBQy32EkU7sPIEQtN5gaDqoGT03gka+w=";
   };
 
   postPatch = ''
@@ -54,7 +58,9 @@ buildPythonApplication rec {
     stestr run
   '';
 
-  pythonImportsCheck = [ "glanceclient" ];
+  pythonImportsCheck = [
+    "glanceclient"
+  ];
 
   meta = with lib; {
     description = "Python bindings for the OpenStack Images API";
diff --git a/pkgs/development/python-modules/pytile/default.nix b/pkgs/development/python-modules/pytile/default.nix
index a94201b037d47..b64418226d060 100644
--- a/pkgs/development/python-modules/pytile/default.nix
+++ b/pkgs/development/python-modules/pytile/default.nix
@@ -4,7 +4,6 @@
 , buildPythonPackage
 , fetchFromGitHub
 , poetry-core
-, pylint
 , pytest-aiohttp
 , pytest-asyncio
 , pytestCheckHook
@@ -31,7 +30,6 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     aiohttp
-    pylint
   ];
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/pytradfri/default.nix b/pkgs/development/python-modules/pytradfri/default.nix
index 70f9acd0380fe..1f523b60eaa03 100644
--- a/pkgs/development/python-modules/pytradfri/default.nix
+++ b/pkgs/development/python-modules/pytradfri/default.nix
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     hash = "sha256-12ol+2CnoPfkxmDGJJAkoafHGpQuWC4lh0N7lSvx2DE=";
   };
 
-  passthru.extras-require = {
+  passthru.optional-dependencies = {
     async = [
       aiocoap
       dtlssocket
@@ -31,7 +31,7 @@ buildPythonPackage rec {
   checkInputs = [
     pytestCheckHook
   ]
-  ++ passthru.extras-require.async;
+  ++ passthru.optional-dependencies.async;
 
   pythonImportsCheck = [
     "pytradfri"
diff --git a/pkgs/development/python-modules/pywemo/default.nix b/pkgs/development/python-modules/pywemo/default.nix
index 15545acf2f63e..cd6e31a0193fa 100644
--- a/pkgs/development/python-modules/pywemo/default.nix
+++ b/pkgs/development/python-modules/pywemo/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "pywemo";
-  version = "0.8.0";
+  version = "0.8.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -21,8 +21,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
-    rev = version;
-    hash = "sha256-bGoqhrjoRKUGPBNfmr2XP+1HL5mdRi6XoCi0BdvY9x8=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-kkZmn+rGRZGh9WmrHAmpqxTjw6MyCSWCeesJ0JGarKM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/rasterio/default.nix b/pkgs/development/python-modules/rasterio/default.nix
index 8c73268e6b8de..d7edf7927a8e0 100644
--- a/pkgs/development/python-modules/rasterio/default.nix
+++ b/pkgs/development/python-modules/rasterio/default.nix
@@ -1,4 +1,5 @@
 { lib
+, stdenv
 , buildPythonPackage
 , fetchFromGitHub
 , pythonOlder
@@ -17,6 +18,7 @@
 , matplotlib
 , numpy
 , snuggs
+, setuptools
 
 # tests
 , hypothesis
@@ -55,6 +57,7 @@ buildPythonPackage rec {
     matplotlib
     numpy
     snuggs
+    setuptools # needs pkg_resources at runtime
   ];
 
   preCheck = ''
@@ -73,10 +76,19 @@ buildPythonPackage rec {
     "-m 'not network'"
   ];
 
+  disabledTests = lib.optionals stdenv.isDarwin [
+    "test_reproject_error_propagation"
+  ];
+
   pythonImportsCheck = [
     "rasterio"
   ];
 
+  doInstallCheck = true;
+  installCheckPhase = ''
+    $out/bin/rio --version | grep ${version} > /dev/null
+  '';
+
   meta = with lib; {
     description = "Python package to read and write geospatial raster data";
     homepage = "https://rasterio.readthedocs.io/en/latest/";
diff --git a/pkgs/development/python-modules/rdflib/default.nix b/pkgs/development/python-modules/rdflib/default.nix
index 1aa998911343c..1aa995d85d772 100644
--- a/pkgs/development/python-modules/rdflib/default.nix
+++ b/pkgs/development/python-modules/rdflib/default.nix
@@ -43,7 +43,7 @@ buildPythonPackage rec {
     importlib-metadata
   ];
 
-  passthru.extras-require = {
+  passthru.optional-dependencies = {
     html = [
       html5lib
     ];
@@ -55,8 +55,8 @@ buildPythonPackage rec {
   checkInputs = [
     pytestCheckHook
   ]
-  ++ passthru.extras-require.networkx
-  ++ passthru.extras-require.html;
+  ++ passthru.optional-dependencies.networkx
+  ++ passthru.optional-dependencies.html;
 
   pytestFlagsArray = [
     # requires network access
diff --git a/pkgs/development/python-modules/redis/default.nix b/pkgs/development/python-modules/redis/default.nix
index b38975c9c6d67..2018006caa9b9 100644
--- a/pkgs/development/python-modules/redis/default.nix
+++ b/pkgs/development/python-modules/redis/default.nix
@@ -40,7 +40,7 @@ buildPythonPackage rec {
     importlib-metadata
   ];
 
-  passthru.extras-require = {
+  passthru.optional-dependencies = {
     hidredis = [
       hiredis
     ];
diff --git a/pkgs/development/python-modules/relatorio/default.nix b/pkgs/development/python-modules/relatorio/default.nix
index 86e53cde95d50..1baf6f4b0aacb 100644
--- a/pkgs/development/python-modules/relatorio/default.nix
+++ b/pkgs/development/python-modules/relatorio/default.nix
@@ -27,14 +27,14 @@ buildPythonPackage rec {
     lxml
   ];
 
-  passthru.extras-require = {
+  passthru.optional-dependencies = {
     chart = [ /* pycha */ pyyaml ];
     fodt = [ python-magic ];
   };
 
   checkInputs = [
     pytestCheckHook
-  ] ++ passthru.extras-require.fodt;
+  ] ++ passthru.optional-dependencies.fodt;
 
   pythonImportsCheck = [ "relatorio" ];
 
diff --git a/pkgs/development/python-modules/requests-aws4auth/default.nix b/pkgs/development/python-modules/requests-aws4auth/default.nix
index c38309f6d8d93..e024efb58b0fe 100644
--- a/pkgs/development/python-modules/requests-aws4auth/default.nix
+++ b/pkgs/development/python-modules/requests-aws4auth/default.nix
@@ -28,13 +28,13 @@ buildPythonPackage rec {
     six
   ];
 
-  passthru.extras-require = {
+  passthru.optional-dependencies = {
     httpx = [ httpx ];
   };
 
   checkInputs = [
     pytestCheckHook
-  ] ++ passthru.extras-require.httpx;
+  ] ++ passthru.optional-dependencies.httpx;
 
   pythonImportsCheck = [
     "requests_aws4auth"
diff --git a/pkgs/development/python-modules/samsungctl/default.nix b/pkgs/development/python-modules/samsungctl/default.nix
index f917c265973af..92af8775d81db 100644
--- a/pkgs/development/python-modules/samsungctl/default.nix
+++ b/pkgs/development/python-modules/samsungctl/default.nix
@@ -15,7 +15,7 @@ buildPythonPackage rec {
     sha256 = "0ipz3fd65rqkxlb02sql0awc3vnslrwb2pfrsnpfnf8bfgxpbh9g";
   };
 
-  passthru.extras-require = {
+  passthru.optional-dependencies = {
     websocket = [
       websocket-client
     ];
diff --git a/pkgs/development/python-modules/samsungtvws/default.nix b/pkgs/development/python-modules/samsungtvws/default.nix
index 383841caffa43..2e97bae92b6a7 100644
--- a/pkgs/development/python-modules/samsungtvws/default.nix
+++ b/pkgs/development/python-modules/samsungtvws/default.nix
@@ -39,7 +39,7 @@ buildPythonPackage rec {
     websocket-client
   ];
 
-  passthru.extras-require = {
+  passthru.optional-dependencies = {
     async = [
       aiohttp
       websockets
@@ -55,8 +55,8 @@ buildPythonPackage rec {
     pytest-asyncio
     pytestCheckHook
   ]
-  ++ passthru.extras-require.async
-  ++ passthru.extras-require.encrypted;
+  ++ passthru.optional-dependencies.async
+  ++ passthru.optional-dependencies.encrypted;
 
   pythonImportsCheck = [ "samsungtvws" ];
 
diff --git a/pkgs/development/python-modules/sphinx/default.nix b/pkgs/development/python-modules/sphinx/default.nix
index 4639cf43d31b6..753b3b6c37759 100644
--- a/pkgs/development/python-modules/sphinx/default.nix
+++ b/pkgs/development/python-modules/sphinx/default.nix
@@ -40,7 +40,7 @@ buildPythonPackage rec {
     repo = pname;
     rev = "v${version}";
     sha256 = "sha256-Lw9yZWCQpt02SL/McWPcyFRfVhQHC0TejcYRbVw+VxY=";
-    extraPostFetch = ''
+    postFetch = ''
       cd $out
       mv tests/roots/test-images/testimäge.png \
         tests/roots/test-images/testimæge.png
diff --git a/pkgs/development/python-modules/ssh-mitm/default.nix b/pkgs/development/python-modules/ssh-mitm/default.nix
index 22e30c7e1acc1..de5d9132c914d 100644
--- a/pkgs/development/python-modules/ssh-mitm/default.nix
+++ b/pkgs/development/python-modules/ssh-mitm/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "ssh-mitm";
-  version = "2.0.2";
+  version = "2.0.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = version;
-    hash = "sha256-cFahID4+PMQPG/pDAR0bU5MZAa8LsNiirxrzGi2c/EE=";
+    hash = "sha256-TU+jrPZtE9SasUudg1BujvIi3uH+WRdW2TReTFYtntc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/treq/default.nix b/pkgs/development/python-modules/treq/default.nix
index 1902a578ec2bb..0f77463077a0f 100644
--- a/pkgs/development/python-modules/treq/default.nix
+++ b/pkgs/development/python-modules/treq/default.nix
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     requests
     incremental
     twisted
-  ] ++ twisted.extras-require.tls;
+  ] ++ twisted.optional-dependencies.tls;
 
   checkInputs = [
     httpbin
diff --git a/pkgs/development/python-modules/trytond/default.nix b/pkgs/development/python-modules/trytond/default.nix
index 431342cf02d54..7a1ae2af2cc38 100644
--- a/pkgs/development/python-modules/trytond/default.nix
+++ b/pkgs/development/python-modules/trytond/default.nix
@@ -53,9 +53,9 @@ buildPythonPackage rec {
     weasyprint
     gevent
     pillow
-  ] ++ relatorio.extras-require.fodt
-    ++ passlib.extras-require.bcrypt
-    ++ passlib.extras-require.argon2
+  ] ++ relatorio.optional-dependencies.fodt
+    ++ passlib.optional-dependencies.bcrypt
+    ++ passlib.optional-dependencies.argon2
     ++ lib.optional withPostgresql psycopg2;
 
   checkPhase = ''
diff --git a/pkgs/development/python-modules/twisted/default.nix b/pkgs/development/python-modules/twisted/default.nix
index 8bc03b1e5cf97..ab950e6a96bd3 100644
--- a/pkgs/development/python-modules/twisted/default.nix
+++ b/pkgs/development/python-modules/twisted/default.nix
@@ -41,7 +41,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ zope_interface incremental automat constantly hyperlink pyhamcrest attrs setuptools typing-extensions ];
 
-  passthru.extras-require = rec {
+  passthru.optional-dependencies = rec {
     tls = [ pyopenssl service-identity idna ];
     conch = [ pyasn1 cryptography appdirs bcrypt ];
     conch_nacl = conch ++ [ pynacl ];
diff --git a/pkgs/development/python-modules/txtorcon/default.nix b/pkgs/development/python-modules/txtorcon/default.nix
index 7196e88e8dd93..16dbbbe5395f1 100644
--- a/pkgs/development/python-modules/txtorcon/default.nix
+++ b/pkgs/development/python-modules/txtorcon/default.nix
@@ -13,7 +13,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     incremental twisted automat zope_interface
-  ] ++ twisted.extras-require.tls
+  ] ++ twisted.optional-dependencies.tls
   ++ lib.optionals (!isPy3k) [ ipaddress ];
 
   checkInputs = [ pytestCheckHook mock lsof GeoIP ];
diff --git a/pkgs/development/python-modules/vivisect/default.nix b/pkgs/development/python-modules/vivisect/default.nix
index 8eddde2b65b72..68375a8eadc34 100644
--- a/pkgs/development/python-modules/vivisect/default.nix
+++ b/pkgs/development/python-modules/vivisect/default.nix
@@ -43,9 +43,9 @@ buildPythonPackage rec {
     cxxfilt
     msgpack
     pycparser
-  ] ++ lib.optionals (withGui) passthru.extras-require.gui;
+  ] ++ lib.optionals (withGui) passthru.optional-dependencies.gui;
 
-  passthru.extras-require.gui = [
+  passthru.optional-dependencies.gui = [
     pyqt5
     pyqtwebengine
   ];
diff --git a/pkgs/development/python-modules/volvooncall/default.nix b/pkgs/development/python-modules/volvooncall/default.nix
index 247a192588dea..3511d16962ed9 100644
--- a/pkgs/development/python-modules/volvooncall/default.nix
+++ b/pkgs/development/python-modules/volvooncall/default.nix
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     aiohttp
   ];
 
-  passthru.extras-require = {
+  passthru.optional-dependencies = {
     console = [
       certifi
       docopt
@@ -49,7 +49,7 @@ buildPythonPackage rec {
     asynctest
     pytest-asyncio
     pytestCheckHook
-  ] ++ passthru.extras-require.mqtt;
+  ] ++ passthru.optional-dependencies.mqtt;
 
   pythonImportsCheck = [ "volvooncall" ];
 
diff --git a/pkgs/development/python-modules/wheel/default.nix b/pkgs/development/python-modules/wheel/default.nix
index 62298b0d6ac4f..8735a37b21ff7 100644
--- a/pkgs/development/python-modules/wheel/default.nix
+++ b/pkgs/development/python-modules/wheel/default.nix
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     rev = version;
     sha256 = "sha256-JlTmUPY3yo/uROyd3nW1dJa23zbLhgQTwcmqZkPOrHs=";
     name = "${pname}-${version}-source";
-    extraPostFetch = ''
+    postFetch = ''
       cd $out
       mv tests/testdata/unicode.dist/unicodedist/åäö_日本語.py \
         tests/testdata/unicode.dist/unicodedist/æɐø_日本價.py
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index 9b4416213f7d2..f97d277b11e54 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -32,13 +32,13 @@ with py.pkgs;
 
 buildPythonApplication rec {
   pname = "checkov";
-  version = "2.0.1147";
+  version = "2.0.1153";
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = pname;
     rev = version;
-    hash = "sha256-tk0vPkKBiGezlHEngqJBekltbpeGa2YwFnc/Ua/YMRo=";
+    hash = "sha256-9J7KvHUT6u8Dl9ElUmUgu/EC9p2gx52AB9prMFmyX2k=";
   };
 
   nativeBuildInputs = with py.pkgs; [
diff --git a/pkgs/development/tools/analysis/retdec/default.nix b/pkgs/development/tools/analysis/retdec/default.nix
index 1701abeb25fd0..3cb64dbc13416 100644
--- a/pkgs/development/tools/analysis/retdec/default.nix
+++ b/pkgs/development/tools/analysis/retdec/default.nix
@@ -101,7 +101,7 @@ let
                                else "0ixv9qyqq40pzyqy6v9jf5rxrvivjb0z0zn260nbmb9gk765bacy";
     stripRoot = false;
     # Removing PE signatures reduces this from 3.8GB -> 642MB (uncompressed)
-    extraPostFetch = lib.optionalString (!withPEPatterns) ''
+    postFetch = lib.optionalString (!withPEPatterns) ''
       rm -r "$out/generic/yara_patterns/static-code/pe"
     '';
   } // {
diff --git a/pkgs/development/tools/devpi-server/default.nix b/pkgs/development/tools/devpi-server/default.nix
index 3f89bd4a1c509..dad3b14c4ca9d 100644
--- a/pkgs/development/tools/devpi-server/default.nix
+++ b/pkgs/development/tools/devpi-server/default.nix
@@ -46,7 +46,7 @@ buildPythonApplication rec {
     pyramid
     strictyaml
     waitress
-  ] ++ passlib.extras-require.argon2;
+  ] ++ passlib.optional-dependencies.argon2;
 
   checkInputs = [
     beautifulsoup4
diff --git a/pkgs/development/tools/parsing/hammer/default.nix b/pkgs/development/tools/parsing/hammer/default.nix
index 86697c0acdcb7..d1cd4b167003f 100644
--- a/pkgs/development/tools/parsing/hammer/default.nix
+++ b/pkgs/development/tools/parsing/hammer/default.nix
@@ -1,33 +1,38 @@
-{ lib, stdenv, fetchFromGitHub, glib, pkg-config, scons }:
+{ fetchFromGitLab
+, glib
+, lib
+, pkg-config
+, scons
+, stdenv
+}:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "hammer";
-  version = "e7aa734";
+  version = "nightly_20220416";
 
-  src = fetchFromGitHub {
-    owner = "UpstandingHackers";
+  src = fetchFromGitLab {
+    domain = "gitlab.special-circumstanc.es";
+    owner = "hammer";
     repo = "hammer";
-    rev = "47f34b81e4de834fd3537dd71928c4f3cdb7f533";
-    sha256 = "sha256-aNSmbSgcABF9T1HoFhCnkmON4hY2MtUs7dW38+HigAY=";
+    rev = version;
+    sha256 = "sha256-xMZhUnycGeHkNZfHQ2d9mETti8HwGHZNskFqh9f0810=";
   };
 
   nativeBuildInputs = [ pkg-config scons ];
   buildInputs = [ glib ];
 
-  strictDeps = true;
-
   meta = with lib; {
     description = "A bit-oriented parser combinator library";
     longDescription = ''
-      Hammer is a parsing library. Like many modern parsing libraries,
-      it provides a parser combinator interface for writing grammars
-      as inline domain-specific languages, but Hammer also provides a
-      variety of parsing backends. It's also bit-oriented rather than
-      character-oriented, making it ideal for parsing binary data such
-      as images, network packets, audio, and executables.
+      Hammer is a parsing library. Like many modern parsing libraries, it
+      provides a parser combinator interface for writing grammars as inline
+      domain-specific languages, but Hammer also provides a variety of parsing
+      backends. It's also bit-oriented rather than character-oriented, making it
+      ideal for parsing binary data such as images, network packets, audio, and
+      executables.
     '';
-    homepage = "https://github.com/UpstandingHackers/hammer";
+    homepage = "https://gitlab.special-circumstanc.es/hammer/hammer";
     license = licenses.gpl2;
-    platforms = platforms.linux;
+    maintainers = with maintainers; [ azahi ];
   };
 }
diff --git a/pkgs/development/tools/rust/sqlx-cli/default.nix b/pkgs/development/tools/rust/sqlx-cli/default.nix
index 005c5cfc47499..f20864b43f33c 100644
--- a/pkgs/development/tools/rust/sqlx-cli/default.nix
+++ b/pkgs/development/tools/rust/sqlx-cli/default.nix
@@ -1,17 +1,17 @@
-{ stdenv, lib, rustPlatform, fetchFromGitHub, pkg-config, openssl, SystemConfiguration, CoreFoundation, Security, libiconv }:
+{ stdenv, lib, rustPlatform, fetchFromGitHub, pkg-config, openssl, SystemConfiguration, CoreFoundation, Security, libiconv, testers, sqlx-cli }:
 
 rustPlatform.buildRustPackage rec {
   pname = "sqlx-cli";
-  version = "0.5.11";
+  version = "0.5.13";
 
   src = fetchFromGitHub {
     owner = "launchbadge";
     repo = "sqlx";
     rev = "v${version}";
-    sha256 = "sha256-Tz7YzGkQUwH0U14dvsttP2GpnM9kign6L9PkAVs3dEc=";
+    sha256 = "sha256-uUIvzUDDv6WUA25zMhaL2Tn3wHTu/IRgzmnB119BLvk=";
   };
 
-  cargoSha256 = "sha256-EKuRaVxwotgTPj95GJnrQGbulsFPClSettwS5f0TzoM=";
+  cargoSha256 = "sha256-IHbOuW2FPt2cH0/ld28fp1uBrJadVsJ8izG0JrZy488=";
 
   doCheck = false;
   cargoBuildFlags = [ "-p sqlx-cli" ];
@@ -20,6 +20,11 @@ rustPlatform.buildRustPackage rec {
   buildInputs = lib.optionals stdenv.isLinux [ openssl ]
     ++ lib.optionals stdenv.isDarwin [ SystemConfiguration CoreFoundation Security libiconv ];
 
+  passthru.tests.version = testers.testVersion {
+    package = sqlx-cli;
+    command = "sqlx --version";
+  };
+
   meta = with lib; {
     description =
       "SQLx's associated command-line utility for managing databases, migrations, and enabling offline mode with sqlx::query!() and friends.";
diff --git a/pkgs/games/openra/default.nix b/pkgs/games/openra/default.nix
index 22d3c6c879ed0..d996630914740 100644
--- a/pkgs/games/openra/default.nix
+++ b/pkgs/games/openra/default.nix
@@ -43,7 +43,7 @@ let
   callWithName = name: value: if isFunction value then value name else value;
   buildOpenRASet = f: args: pkgs.recurseIntoAttrs (mapAttrs callWithName (f ({
     inherit (pkgs) fetchFromGitHub;
-    extraPostFetch = ''
+    postFetch = ''
       sed -i 's/curl/curl --insecure/g' $out/thirdparty/{fetch-thirdparty-deps,noget}.sh
       $out/thirdparty/fetch-thirdparty-deps.sh
     '';
diff --git a/pkgs/games/openra/engines.nix b/pkgs/games/openra/engines.nix
index 933f8411f75a0..bbb4947acd237 100644
--- a/pkgs/games/openra/engines.nix
+++ b/pkgs/games/openra/engines.nix
@@ -1,4 +1,4 @@
-{ buildOpenRAEngine, fetchFromGitHub, extraPostFetch }:
+{ buildOpenRAEngine, fetchFromGitHub, postFetch }:
 
 let
   buildUpstreamOpenRAEngine = { version, rev, sha256 }: name: (buildOpenRAEngine {
@@ -9,7 +9,7 @@ let
     src = fetchFromGitHub {
       owner = "OpenRA";
       repo = "OpenRA" ;
-      inherit rev sha256 extraPostFetch;
+      inherit rev sha256 postFetch;
     };
   } name).overrideAttrs (origAttrs: {
     postInstall = ''
diff --git a/pkgs/games/openra/mods.nix b/pkgs/games/openra/mods.nix
index cf8cd433c2942..47e86fd09a7d2 100644
--- a/pkgs/games/openra/mods.nix
+++ b/pkgs/games/openra/mods.nix
@@ -1,4 +1,4 @@
-{ buildOpenRAMod, fetchFromGitHub, extraPostFetch }:
+{ buildOpenRAMod, fetchFromGitHub, postFetch }:
 
 let
   unsafeBuildOpenRAMod = attrs: name: (buildOpenRAMod attrs name).overrideAttrs (_: {
@@ -25,7 +25,7 @@ in {
         rev = "b8a7dd52ff893ed8225726d4ed4e14ecad748404";
         sha256 = "0dyk861qagibx8ldshz7d2nrki9q550f6f0wy8pvayvf1gv1dbxj";
         name = "engine";
-        inherit extraPostFetch;
+        inherit postFetch;
       };
     };
   };
@@ -50,7 +50,7 @@ in {
         rev = version;
         sha256 = "0p0izykjnz7pz02g2khp7msqa00jhjsrzk9y0g29dirmdv75qa4r";
         name = "engine";
-        inherit extraPostFetch;
+        inherit postFetch;
       };
     };
     assetsError = ''
@@ -78,7 +78,7 @@ in {
         rev = "f91d3f2603bbf51afaa89357e4defcdc36138102";
         sha256 = "05g900ri6q0zrkrk8rmjaz576vjggmi2y6jm0xz3cwli54prn11w";
         name = "engine";
-        inherit extraPostFetch;
+        inherit postFetch;
       };
     };
   };
@@ -102,7 +102,7 @@ in {
         rev = version;
         sha256 = "1x6byz37s8qcpqj902zvkvbv95rv2mv2kj35c12gbpyc92xkqkq0";
         name = "generals-alpha-engine";
-        inherit extraPostFetch;
+        inherit postFetch;
       };
     };
   };
@@ -127,7 +127,7 @@ in {
         rev = "4e8eab4ca00d1910203c8a103dfd2c002714daa8";
         sha256 = "1yyqparf93x8yzy1f46gsymgkj5jls25v2yc7ighr3f7mi3igdvq";
         name = "engine";
-        inherit extraPostFetch;
+        inherit postFetch;
       };
     };
   } name).overrideAttrs (origAttrs: {
@@ -156,7 +156,7 @@ in {
         rev = "52109c0910f479753704c46fb19e8afaab353c83";
         sha256 = "0ga3855j6bc7h81q03cw6laiaiz12915zg8aqah1idvxbzicfy7l";
         name = "engine";
-        inherit extraPostFetch;
+        inherit postFetch;
       };
     };
   };
@@ -180,7 +180,7 @@ in {
         rev = version;
         sha256 = "1pgi3zaq9fwwdq6yh19bwxscslqgabjxkvl9bcn1a5agy4bfbqk5";
         name = "engine";
-        inherit extraPostFetch;
+        inherit postFetch;
       };
     };
     assetsError = ''
@@ -208,7 +208,7 @@ in {
         rev = version;
         sha256 = "15pvn5cx3g0nzbrgpsfz8dngad5wkzp5dz25ydzn8bmxafiijvcr";
         name = "engine";
-        inherit extraPostFetch;
+        inherit postFetch;
       };
     };
   };
@@ -233,7 +233,7 @@ in {
         rev = "f3873ae242803051285994d77eb26f4b951594b5";
         sha256 = "02rv29wja0p5d083pd087daz7x7pp5b9ym7sci2fhg3mrnaqgwkp";
         name = "engine";
-        inherit extraPostFetch;
+        inherit postFetch;
       };
     };
     assetsError = ''
@@ -262,7 +262,7 @@ in {
         rev = "bb0930008a57c07f3002421023f6b446e3e3af69";
         sha256 = "1jvgpbf56hd02ikhklv49br4d1jiv5hphc5kl79qnjlaacnj222x";
         name = "engine";
-        inherit extraPostFetch;
+        inherit postFetch;
       };
     };
   };
@@ -286,7 +286,7 @@ in {
         rev = "6de92de8d982094a766eab97a92225c240d85493";
         sha256 = "0ps9x379plrrj1hnj4fpr26lc46mzgxknv5imxi0bmrh5y4781ql";
         name = "engine";
-        inherit extraPostFetch;
+        inherit postFetch;
       };
     };
   };
@@ -310,7 +310,7 @@ in {
         rev = version;
         sha256 = "1p5hgxxvxlz8480vj0qkmnxjh7zj3hahk312m0zljxfdb40652w1";
         name = "engine";
-        inherit extraPostFetch;
+        inherit postFetch;
       };
     };
   };
@@ -334,7 +334,7 @@ in {
         rev = version;
         sha256 = "15pvn5cx3g0nzbrgpsfz8dngad5wkzp5dz25ydzn8bmxafiijvcr";
         name = "engine";
-        inherit extraPostFetch;
+        inherit postFetch;
       };
     };
     assetsError = ''
diff --git a/pkgs/games/openra/packages.nix b/pkgs/games/openra/packages.nix
index 2f4c83c7d5a32..e98ebcaee44fb 100644
--- a/pkgs/games/openra/packages.nix
+++ b/pkgs/games/openra/packages.nix
@@ -32,7 +32,7 @@ let
   */
   buildOpenRASet = f: args: builtins.mapAttrs (name: value: if builtins.isFunction value then value name else value) (f ({
     inherit (pkgs) fetchFromGitHub;
-    extraPostFetch = ''
+    postFetch = ''
       sed -i 's/curl/curl --insecure/g' $out/thirdparty/{fetch-thirdparty-deps,noget}.sh
       $out/thirdparty/fetch-thirdparty-deps.sh
     '';
diff --git a/pkgs/games/xonotic/default.nix b/pkgs/games/xonotic/default.nix
index 208608f0c15b4..ab9cc14dc9bdf 100644
--- a/pkgs/games/xonotic/default.nix
+++ b/pkgs/games/xonotic/default.nix
@@ -147,7 +147,7 @@ in rec {
     name = "xonotic-data";
     url = "https://dl.xonotic.org/xonotic-${version}.zip";
     sha256 = "15caj11v9hhr7w55w3rs1rspblzr9lg1crqivbn9pyyq0rif8cpl";
-    extraPostFetch = ''
+    postFetch = ''
       cd $out
       rm -rf $(ls | grep -v "^data$" | grep -v "^key_0.d0pk$")
     '';
diff --git a/pkgs/os-specific/linux/apfs/default.nix b/pkgs/os-specific/linux/apfs/default.nix
index eedaa9ef96872..44cfefe680882 100644
--- a/pkgs/os-specific/linux/apfs/default.nix
+++ b/pkgs/os-specific/linux/apfs/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , kernel
 }:
 
@@ -15,6 +16,15 @@ stdenv.mkDerivation {
     sha256 = "sha256-3T1BNc6g3SDTxb0VrronLUIp/CWbwnzXTsc8Qk5c4jY=";
   };
 
+  patches = [
+    # Fix build for Linux 5.18+.
+    # https://github.com/linux-apfs/linux-apfs-rw/pull/24
+    (fetchpatch {
+      url = "https://github.com/linux-apfs/linux-apfs-rw/commit/93b93767acab614c4e6426c9fd38bdf9af00bc13.patch";
+      sha256 = "1ss7cal851qadcmkn3jcckpa2f003nzb03xsx1g8vkb1cl0n8gi7";
+    })
+  ];
+
   hardeningDisable = [ "pic" ];
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
diff --git a/pkgs/os-specific/linux/it87/default.nix b/pkgs/os-specific/linux/it87/default.nix
index 1e56d3a830cc7..471adb7c4dcf3 100644
--- a/pkgs/os-specific/linux/it87/default.nix
+++ b/pkgs/os-specific/linux/it87/default.nix
@@ -2,14 +2,15 @@
 
 stdenv.mkDerivation rec {
   name = "it87-${version}-${kernel.version}";
-  version = "2018-08-14";
+  version = "unstable-2022-02-26";
 
-  # The original was deleted from github, but this seems to be an active fork
+  # Original is no longer maintained.
+  # This is the same upstream as the AUR uses.
   src = fetchFromGitHub {
-    owner = "hannesha";
+    owner = "frankcrawford";
     repo = "it87";
-    rev = "5515f5b78838cb6be551943ffef5d1792012724c";
-    sha256 = "1ygi4mwds4q7byhg8gqnh3syamdj5rpjy3jj012k7vl54gdgrmgm";
+    rev = "c93d61adadecb009c92f3258cd3ff14a66efb193";
+    sha256 = "sha256-wVhs//iwZUUGRTk1DpV/SnA7NZ7cFyYbsUbtazlxb6Q=";
   };
 
   hardeningDisable = [ "pic" ];
@@ -29,7 +30,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Patched module for IT87xx superio chip sensors support";
     homepage = "https://github.com/hannesha/it87";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     platforms = [ "x86_64-linux" "i686-linux" ];
     maintainers = with maintainers; [ yorickvp ];
   };
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 14d5e29c372a8..dad537a1564dd 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -688,7 +688,7 @@ stdenv.mkDerivation {
     # runtime; otherwise we can't and we need to reboot.
     interfaceVersion = 2;
 
-    inherit withCryptsetup util-linux kmod kbd;
+    inherit withCryptsetup withHostnamed withImportd withLocaled withMachined withTimedated util-linux kmod kbd;
 
     tests = {
       inherit (nixosTests) switchTest;
diff --git a/pkgs/os-specific/linux/zenpower/default.nix b/pkgs/os-specific/linux/zenpower/default.nix
index f3f6e420a2a29..1ba01a1c88fbd 100644
--- a/pkgs/os-specific/linux/zenpower/default.nix
+++ b/pkgs/os-specific/linux/zenpower/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "zenpower";
-  version = "0.1.13";
+  version = "unstable-2022-04-13";
 
   src = fetchFromGitHub {
     owner = "Ta180m";
     repo = "zenpower3";
-    rev = "v${version}";
-    sha256 = "sha256-2QScHDwOKN3Psui0M2s2p6D97jjbfe3Us5Nkn2srKC0=";
+    rev = "c36a86c64b802e9b90b5166caee6a8e8eddaeb56";
+    sha256 = "1i9ap7xgab421f3c68mcmad25xs4h8pfz0g0f9yzg7hxpmb0npxi";
   };
 
   hardeningDisable = [ "pic" ];
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Linux kernel driver for reading temperature, voltage(SVI2), current(SVI2) and power(SVI2) for AMD Zen family CPUs.";
     homepage = "https://github.com/Ta180m/zenpower3";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     maintainers = with maintainers; [ alexbakker artturin ];
     platforms = [ "x86_64-linux" ];
     broken = versionOlder kernel.version "4.14";
diff --git a/pkgs/servers/dns/ncdns/default.nix b/pkgs/servers/dns/ncdns/default.nix
index 7fad548df7a5a..7729305da5b28 100644
--- a/pkgs/servers/dns/ncdns/default.nix
+++ b/pkgs/servers/dns/ncdns/default.nix
@@ -22,7 +22,7 @@ let
     rev = "fb9f2b7bc9fcba954d70f63857cc0c3841b1cf47";
     sha256 = "1arkbpbzvhcmz5fhjqg34x2jbjnwmlisapk22rjki17qpamh7zks";
     # ncdns must be put in a subdirectory for this to work.
-    extraPostFetch = ''
+    postFetch = ''
       cp -r --no-preserve=mode "${ncdns}" "$out/ncdns"
     '';
   };
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 581cd277f1575..a312105d7dbb3 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -118,9 +118,9 @@
       androidtv
       pure-python-adb
     ]
-    ++ adb-shell.extras-require.async
-    ++ androidtv.extras-require.async
-    ++ pure-python-adb.extras-require.async;
+    ++ adb-shell.optional-dependencies.async
+    ++ androidtv.optional-dependencies.async
+    ++ pure-python-adb.optional-dependencies.async;
     "anel_pwrctrl" = ps: with ps; [
     ]; # missing inputs: anel_pwrctrl-homeassistant
     "anthemav" = ps: with ps; [
@@ -279,7 +279,7 @@
     "bluetooth_le_tracker" = ps: with ps; [
       pygatt
     ]
-    ++ pygatt.extras-require.GATTTOOL;
+    ++ pygatt.optional-dependencies.GATTTOOL;
     "bluetooth_tracker" = ps: with ps; [
       bt-proximity
       pybluez
@@ -2273,9 +2273,9 @@
       wakeonlan
       zeroconf
     ]
-    ++ samsungctl.extras-require.websocket
-    ++ samsungtvws.extras-require.async
-    ++ samsungtvws.extras-require.encrypted;
+    ++ samsungctl.optional-dependencies.websocket
+    ++ samsungtvws.optional-dependencies.async
+    ++ samsungtvws.optional-dependencies.encrypted;
     "satel_integra" = ps: with ps; [
     ]; # missing inputs: satel_integra
     "scene" = ps: with ps; [
@@ -2388,7 +2388,7 @@
     "skybeacon" = ps: with ps; [
       pygatt
     ]
-    ++ pygatt.extras-require.GATTTOOL;
+    ++ pygatt.optional-dependencies.GATTTOOL;
     "skybell" = ps: with ps; [
       skybellpy
     ];
@@ -2769,7 +2769,7 @@
     "tradfri" = ps: with ps; [
       pytradfri
     ]
-    ++ pytradfri.extras-require.async;
+    ++ pytradfri.optional-dependencies.async;
     "trafikverket_ferry" = ps: with ps; [
       pytrafikverket
     ];
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index ff5c69b04fb8e..b23b9bc32520a 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -282,9 +282,6 @@ in python.pkgs.buildPythonApplication rec {
     respx
     stdlib-list
     tqdm
-    # required by tests/pylint
-    astroid
-    pylint
     # required by tests/auth/mfa_modules
     pyotp
   ] ++ lib.concatMap (component: getPackages component python.pkgs) [
@@ -308,6 +305,8 @@ in python.pkgs.buildPythonApplication rec {
   ];
 
   disabledTestPaths = [
+    # we don't care about code quality
+    "tests/pylint"
     # don't bulk test all components
     "tests/components"
     # pyotp since v2.4.0 complains about the short mock keys, hass pins v2.3.0
diff --git a/pkgs/servers/home-assistant/parse-requirements.py b/pkgs/servers/home-assistant/parse-requirements.py
index 28d8331cfe437..e2ac808b33b48 100755
--- a/pkgs/servers/home-assistant/parse-requirements.py
+++ b/pkgs/servers/home-assistant/parse-requirements.py
@@ -103,13 +103,13 @@ def repository_root() -> str:
     return os.path.abspath(sys.argv[0] + "/../../../..")
 
 
-# For a package attribute and and an extra, check if the package exposes it via passthru.extras-require
+# For a package attribute and and an extra, check if the package exposes it via passthru.optional-dependencies
 def has_extra(package: str, extra: str):
     cmd = [
         "nix-instantiate",
         repository_root(),
         "-A",
-        f"{package}.extras-require.{extra}",
+        f"{package}.optional-dependencies.{extra}",
     ]
     try:
         subprocess.run(
@@ -209,7 +209,7 @@ def main() -> None:
                 attr_paths.append(pname)
                 for extra in extras:
                     # Check if package advertises extra requirements
-                    extra_attr = f"{pname}.extras-require.{extra}"
+                    extra_attr = f"{pname}.optional-dependencies.{extra}"
                     if has_extra(attr_path, extra):
                         extra_attrs.append(extra_attr)
                     else:
diff --git a/pkgs/servers/home-assistant/tests.nix b/pkgs/servers/home-assistant/tests.nix
index 26f67e69a546f..d8436bcc9402f 100644
--- a/pkgs/servers/home-assistant/tests.nix
+++ b/pkgs/servers/home-assistant/tests.nix
@@ -71,7 +71,6 @@ in lib.listToAttrs (map (component: lib.nameValuePair component (
 
     meta = old.meta // {
       broken = lib.elem component [
-        "airtouch4"
         "bsblan"
         "dnsip"
         "efergy"
diff --git a/pkgs/servers/http/envoy/default.nix b/pkgs/servers/http/envoy/default.nix
index f7e9f8dd0908c..974d00149177a 100644
--- a/pkgs/servers/http/envoy/default.nix
+++ b/pkgs/servers/http/envoy/default.nix
@@ -37,7 +37,7 @@ buildBazelPackage rec {
     inherit (srcVer) rev;
     hash = "sha256:11mm72zmb479ss585jzqzhklyyqmdadnvr91ghzvjxc0j2a1hrr4";
 
-    extraPostFetch = ''
+    postFetch = ''
       chmod -R +w $out
       rm $out/.bazelversion
       echo ${srcVer.rev} > $out/SOURCE_VERSION
diff --git a/pkgs/servers/http/nginx/generic.nix b/pkgs/servers/http/nginx/generic.nix
index e189a7d2fdff6..79ca0d2eb5d89 100644
--- a/pkgs/servers/http/nginx/generic.nix
+++ b/pkgs/servers/http/nginx/generic.nix
@@ -165,7 +165,7 @@ stdenv.mkDerivation {
   passthru = {
     modules = modules;
     tests = {
-      inherit (nixosTests) nginx nginx-auth nginx-etag nginx-pubhtml nginx-sandbox nginx-sso;
+      inherit (nixosTests) nginx nginx-auth nginx-etag nginx-http3 nginx-pubhtml nginx-sandbox nginx-sso;
       variants = lib.recurseIntoAttrs nixosTests.nginx-variants;
       acme-integration = nixosTests.acme;
     } // passthru.tests;
diff --git a/pkgs/servers/radicale/3.x.nix b/pkgs/servers/radicale/3.x.nix
index a8f5a29db8d61..670db1532978f 100644
--- a/pkgs/servers/radicale/3.x.nix
+++ b/pkgs/servers/radicale/3.x.nix
@@ -21,7 +21,7 @@ python3.pkgs.buildPythonApplication rec {
     vobject
     python-dateutil
     pytz # https://github.com/Kozea/Radicale/issues/816
-  ] ++ passlib.extras-require.bcrypt;
+  ] ++ passlib.optional-dependencies.bcrypt;
 
   checkInputs = with python3.pkgs; [
     pytestCheckHook
diff --git a/pkgs/servers/roon-bridge/default.nix b/pkgs/servers/roon-bridge/default.nix
index 4e590dd981867..8b4d81437e2da 100644
--- a/pkgs/servers/roon-bridge/default.nix
+++ b/pkgs/servers/roon-bridge/default.nix
@@ -11,7 +11,7 @@
 }:
 stdenv.mkDerivation rec {
   pname = "roon-bridge";
-  version = "1.8-918";
+  version = "1.8-943";
 
   src =
     let
@@ -21,11 +21,11 @@ stdenv.mkDerivation rec {
       {
         x86_64-linux = fetchurl {
           url = "http://download.roonlabs.com/builds/RoonBridge_linuxx64_${urlVersion}.tar.bz2";
-          hash = "sha256-Tx8KmGKh6BNoo2RKJm0HfPHRXiFsz+FtX5gQZ1FCEEg=";
+          hash = "sha256-knmy2zlRh+ehvYKHC7UN60pMCt8bYPuo9kTz2m0pOW0";
         };
         aarch64-linux = fetchurl {
           url = "http://download.roonlabs.com/builds/RoonBridge_linuxarmv8_${urlVersion}.tar.bz2";
-          hash = "sha256-UkdAs+/l9c4j8PNlAZfNNCJogjxZItcDikS+tOjYjA0=";
+          hash = "sha256-urMhtBUjP4HpV9EDZOLLnfnMqhmsWPx0M2+Xdvc8YnU=";
         };
       }.${system} or (throw "Unsupposed system: ${system}");
 
diff --git a/pkgs/servers/roon-server/default.nix b/pkgs/servers/roon-server/default.nix
index 9e8c0254fca92..206490e49f2ab 100644
--- a/pkgs/servers/roon-server/default.nix
+++ b/pkgs/servers/roon-server/default.nix
@@ -16,7 +16,7 @@
 }:
 stdenv.mkDerivation rec {
   pname = "roon-server";
-  version = "1.8-935";
+  version = "1.8-943";
 
   src =
     let
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     in
     fetchurl {
       url = "http://download.roonlabs.com/builds/RoonServer_linuxx64_${urlVersion}.tar.bz2";
-      hash = "sha256-6I612imOCqxVlNu6zCXWS/Yy8bnot+0723t3Se4DjLg=";
+      hash = "sha256-osQ0/HhcSO6pirUDjOnw0yUsGUsxZI62ViHc6Lb/rT4=";
     };
 
   dontConfigure = true;
diff --git a/pkgs/servers/sql/mariadb/default.nix b/pkgs/servers/sql/mariadb/default.nix
index b1c71f28a835a..50989a42e3e3f 100644
--- a/pkgs/servers/sql/mariadb/default.nix
+++ b/pkgs/servers/sql/mariadb/default.nix
@@ -238,27 +238,27 @@ in stdenv.mkDerivation (common // {
 in {
   mariadb_104 = mariadbPackage {
     # Supported until 2024-06-18
-    version = "10.4.24";
-    sha256 = "0ipqilri8isn0mfvwg8imwf36zm3jsw0wf2yx905c2bznd8mb5zy";
+    version = "10.4.25";
+    sha256 = "1y3ym8pb0pyra3dwy8sbzc4656c4y7g1savgyrsvf1mw2573r5pz";
   };
   mariadb_105 = mariadbPackage {
     # Supported until 2025-06-24
-    version = "10.5.15";
-    sha256 = "0nfvyxb157qsbl0d1i5gfzr2hb1nm0iv58f7qcbk5kkhz0vyv049";
+    version = "10.5.16";
+    sha256 = "19nj7ilk1aqs9zvvzhx4619pgfqjp7ac90ffr3fdaw4viljqfgn1";
   };
   mariadb_106 = mariadbPackage {
     # Supported until 2026-07
-    version = "10.6.7";
-    sha256 = "1idjnkjfkjvyr6r899xbiwq9wwbs84cm85mbc725yxjshqghzvkm";
+    version = "10.6.8";
+    sha256 = "0f6lkvv0dbq64y7zpks7nvhy1n08gad0i0dp0s2zpgfcb62liaap";
   };
   mariadb_107 = mariadbPackage {
     # Supported until 2023-02
-    version = "10.7.3";
-    sha256 = "1m2wa67vvdm61ap8spl18b9vqkmsnq4rfd0248l17jf9zwcnja6s";
+    version = "10.7.4";
+    sha256 = "0ws17azsw3f26pkphjkyxmmi9qbv9gwidvz0ll6g482m6afrrpbk";
   };
   mariadb_108 = mariadbPackage {
     # Supported until 2023-05
-    version = "10.8.2";
-    sha256 = "0v4mms3mihylnqlc0ifvwzykah6lkdd39lmxbv5vnhbsh7wggq0l";
+    version = "10.8.3";
+    sha256 = "14h80lfb9b3rv3fd8nkljbqhx6dmwjnqkz6c3ynixb3na72sszl8";
   };
 }
diff --git a/pkgs/test/default.nix b/pkgs/test/default.nix
index 2ab03bda8b775..d6e4c545a087b 100644
--- a/pkgs/test/default.nix
+++ b/pkgs/test/default.nix
@@ -28,6 +28,7 @@ with pkgs;
   cc-multilib-clang = callPackage ./cc-wrapper/multilib.nix { stdenv = clangMultiStdenv; };
 
   fetchpatch = callPackages ../build-support/fetchpatch/tests.nix { };
+  fetchzip = callPackages ../build-support/fetchzip/tests.nix { };
   fetchgit = callPackages ../build-support/fetchgit/tests.nix { };
   fetchFirefoxAddon = callPackages ../build-support/fetchfirefoxaddon/tests.nix { };
 
diff --git a/pkgs/tools/admin/pgadmin/default.nix b/pkgs/tools/admin/pgadmin/default.nix
index d917acd656c82..53b9d54852377 100644
--- a/pkgs/tools/admin/pgadmin/default.nix
+++ b/pkgs/tools/admin/pgadmin/default.nix
@@ -197,5 +197,6 @@ pythonPackages.buildPythonApplication rec {
     license = licenses.mit;
     changelog = "https://www.pgadmin.org/docs/pgadmin4/latest/release_notes_${lib.versions.major version}_${lib.versions.minor version}.html";
     maintainers = with maintainers; [ gador ];
+    mainProgram = "pgadmin4";
   };
 }
diff --git a/pkgs/tools/admin/pulumi/update-pulumi-shell.nix b/pkgs/tools/admin/pulumi/update-pulumi-shell.nix
new file mode 100644
index 0000000000000..cf69e640550d4
--- /dev/null
+++ b/pkgs/tools/admin/pulumi/update-pulumi-shell.nix
@@ -0,0 +1,8 @@
+{ nixpkgs ? import ../../../.. { } }:
+with nixpkgs;
+mkShell {
+  packages = [
+    pkgs.gh
+  ];
+}
+
diff --git a/pkgs/tools/admin/pulumi/update.sh b/pkgs/tools/admin/pulumi/update.sh
index fadc64cf1dfef..1097759c3bd6d 100755
--- a/pkgs/tools/admin/pulumi/update.sh
+++ b/pkgs/tools/admin/pulumi/update.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p gh
+#!nix-shell update-pulumi-shell.nix -i bash
 # shellcheck shell=bash
 # Bash 3 compatible for Darwin
 
diff --git a/pkgs/tools/archivers/p7zip/default.nix b/pkgs/tools/archivers/p7zip/default.nix
index 5e92553b636c8..b38a9aa185a08 100644
--- a/pkgs/tools/archivers/p7zip/default.nix
+++ b/pkgs/tools/archivers/p7zip/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     # > the license requires that you agree to these use restrictions,
     # > or you must remove the software (source and binary) from your hard disks
     # https://fedoraproject.org/wiki/Licensing:Unrar
-    extraPostFetch = lib.optionalString (!enableUnfree) ''
+    postFetch = lib.optionalString (!enableUnfree) ''
       rm -r $out/CPP/7zip/Compress/Rar*
       find $out -name makefile'*' -exec sed -i '/Rar/d' {} +
     '';
diff --git a/pkgs/tools/audio/abcmidi/default.nix b/pkgs/tools/audio/abcmidi/default.nix
index c50a49255c9f9..1d025582c1836 100644
--- a/pkgs/tools/audio/abcmidi/default.nix
+++ b/pkgs/tools/audio/abcmidi/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "abcMIDI";
-  version = "2022.05.05";
+  version = "2022.05.20";
 
   src = fetchzip {
     url = "https://ifdo.ca/~seymour/runabc/${pname}-${version}.zip";
-    hash = "sha256-QGCws+S6Mfv0uQcfKg2DbRWS34UAeG17Z+YAyswVAFc=";
+    hash = "sha256-mTIpy5HHKQxpqN5mHnDvmq6lA0++etj93WCcX1i046I=";
   };
 
   meta = with lib; {
diff --git a/pkgs/tools/filesystems/yandex-disk/default.nix b/pkgs/tools/filesystems/yandex-disk/default.nix
index e837350abd6f2..4b8de7402a62c 100644
--- a/pkgs/tools/filesystems/yandex-disk/default.nix
+++ b/pkgs/tools/filesystems/yandex-disk/default.nix
@@ -4,21 +4,26 @@ let
   p = if stdenv.is64bit then {
       arch = "x86_64";
       gcclib = "${stdenv.cc.cc.lib}/lib64";
-      sha256 = "e4f579963199f05476657f0066beaa32d1261aef2203382f3919e1ed4bc4594e";
+      sha256 = "sha256-HH/pLZmDr6m/B3e6MHafDGnNWR83oR2y1ijVMR/LOF0=";
+      webarchive = "20220519080155";
     }
     else {
       arch = "i386";
       gcclib = "${stdenv.cc.cc.lib}/lib";
-      sha256 = "69113bf33ba0c57a363305b76361f2866c3b8394b173eed0f49db1f50bfe0373";
+      sha256 = "sha256-28dmdnJf+qh9r3F0quwlYXB/UqcOzcHzuzFq8vt2bf0=";
+      webarchive = "20220519080430";
     };
 in
 stdenv.mkDerivation rec {
 
   pname = "yandex-disk";
-  version = "0.1.6.1074";
+  version = "0.1.6.1080";
 
   src = fetchurl {
-    url = "https://repo.yandex.ru/yandex-disk/rpm/stable/${p.arch}/${pname}-${version}-1.fedora.${p.arch}.rpm";
+    urls = [
+      "https://repo.yandex.ru/yandex-disk/rpm/stable/${p.arch}/${pname}-${version}-1.fedora.${p.arch}.rpm"
+      "https://web.archive.org/web/${p.webarchive}/https://repo.yandex.ru/yandex-disk/rpm/stable/${p.arch}/${pname}-${version}-1.fedora.${p.arch}.rpm"
+    ];
     sha256 = p.sha256;
   };
 
diff --git a/pkgs/tools/graphics/vips/default.nix b/pkgs/tools/graphics/vips/default.nix
index 270f508a88b57..072327de013c6 100644
--- a/pkgs/tools/graphics/vips/default.nix
+++ b/pkgs/tools/graphics/vips/default.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-ffDJJWe/SzG+lppXEiyfXXL5KLdZgnMjv1SYnuYnh4c=";
     # Remove unicode file names which leads to different checksums on HFS+
     # vs. other filesystems because of unicode normalisation.
-    extraPostFetch = ''
+    postFetch = ''
       rm -r $out/test/test-suite/images/
     '';
   };
diff --git a/pkgs/tools/misc/dua/default.nix b/pkgs/tools/misc/dua/default.nix
index 097aee5f06885..4a83d8147acb3 100644
--- a/pkgs/tools/misc/dua/default.nix
+++ b/pkgs/tools/misc/dua/default.nix
@@ -13,7 +13,7 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-dpkUbZz/bIiTMhZalXHGct77qMzYB6LATs7MPVyW1GY=";
     # Remove unicode file names which leads to different checksums on HFS+
     # vs. other filesystems because of unicode normalisation.
-    extraPostFetch = ''
+    postFetch = ''
       rm -r $out/tests/fixtures
     '';
   };
diff --git a/pkgs/tools/misc/dust/default.nix b/pkgs/tools/misc/dust/default.nix
index 4357b251b2aa4..15ecf7dfe4e8a 100644
--- a/pkgs/tools/misc/dust/default.nix
+++ b/pkgs/tools/misc/dust/default.nix
@@ -11,7 +11,7 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-qC8AlLyg8MU9ZON0hITTaM5AmRFZMOqJVt7PJ5fCtus=";
     # Remove unicode file names which leads to different checksums on HFS+
     # vs. other filesystems because of unicode normalisation.
-    extraPostFetch = ''
+    postFetch = ''
       rm -r $out/tests/test_dir_unicode/
     '';
   };
diff --git a/pkgs/tools/misc/dutree/default.nix b/pkgs/tools/misc/dutree/default.nix
index db767a1afb62e..c40385c387bab 100644
--- a/pkgs/tools/misc/dutree/default.nix
+++ b/pkgs/tools/misc/dutree/default.nix
@@ -11,7 +11,7 @@ rustPlatform.buildRustPackage rec {
     sha256 = "17lm8jd07bi499mywg2iq669im34j4x4yhc8a3adxn12f8j0dfg7";
     # test directory has files with unicode names which causes hash mismatches
     # It is also not used by any tests or parts of build process
-    extraPostFetch = ''
+    postFetch = ''
       rm -r $out/test
     '';
   };
diff --git a/pkgs/tools/misc/jdupes/default.nix b/pkgs/tools/misc/jdupes/default.nix
index 75a3ef92645d6..9545f71efbb6e 100644
--- a/pkgs/tools/misc/jdupes/default.nix
+++ b/pkgs/tools/misc/jdupes/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     # Unicode file names lead to different checksums on HFS+ vs. other
     # filesystems because of unicode normalisation. The testdir
     # directories have such files and will be removed.
-    extraPostFetch = "rm -r $out/testdir";
+    postFetch = "rm -r $out/testdir";
   };
 
   dontConfigure = true;
diff --git a/pkgs/tools/misc/mutagen/default.nix b/pkgs/tools/misc/mutagen/default.nix
index 5b6ba782d7de2..aff3843e2ae75 100644
--- a/pkgs/tools/misc/mutagen/default.nix
+++ b/pkgs/tools/misc/mutagen/default.nix
@@ -18,7 +18,7 @@ buildGo118Module rec {
     # The package architecture does not matter since all packages contain identical mutagen-agents.tar.gz.
     url = "https://github.com/mutagen-io/mutagen/releases/download/v${version}/mutagen_linux_amd64_v${version}.tar.gz";
     stripRoot = false;
-    extraPostFetch = ''
+    postFetch = ''
       rm $out/mutagen # Keep only mutagen-agents.tar.gz.
     '';
     sha256 = "sha256-AlAo55/ewTE04WfS0beVonGA97AmpR1pAw/QxKAYjv8=";
diff --git a/pkgs/tools/misc/nautilus-open-any-terminal/default.nix b/pkgs/tools/misc/nautilus-open-any-terminal/default.nix
index c62bcbe0bc769..5f0c41cbd4005 100644
--- a/pkgs/tools/misc/nautilus-open-any-terminal/default.nix
+++ b/pkgs/tools/misc/nautilus-open-any-terminal/default.nix
@@ -15,13 +15,13 @@
 
 python3.pkgs.buildPythonPackage rec {
   pname = "nautilus-open-any-terminal";
-  version = "0.2.16";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "Stunkymonkey";
     repo = pname;
     rev = version;
-    sha256 = "sha256-g5B+tp131vmjShBCGrKR5ZQCjtJY823/kPacZ0S9E80=";
+    sha256 = "sha256-PF6DVpiAPL9NG4jK6wDqdqYw+26Nks/bGEbbaV/5aIs=";
   };
 
   patches = [ ./hardcode-gsettings.patch ];
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index 66d2dfcdb9ae2..879f8e2e38f10 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pkg-config, perl
+{ lib, stdenv, fetchurl, pkg-config, perl, nixosTests
 , brotliSupport ? false, brotli ? null
 , c-aresSupport ? false, c-ares ? null
 , gnutlsSupport ? false, gnutls ? null
@@ -177,6 +177,8 @@ stdenv.mkDerivation rec {
   '';
 
   passthru = {
+    # Additional checking with support http3 protocol.
+    tests.nginx-http3 = nixosTests.nginx-http3;
     inherit opensslSupport openssl;
     tests = {
       inherit curlpp coeurl;
diff --git a/pkgs/tools/networking/isync/default.nix b/pkgs/tools/networking/isync/default.nix
index e26526dc68d57..8e21ccee10847 100644
--- a/pkgs/tools/networking/isync/default.nix
+++ b/pkgs/tools/networking/isync/default.nix
@@ -29,5 +29,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Plus;
     platforms = platforms.unix;
     maintainers = with maintainers; [ primeos lheckemann ];
+    mainProgram = "mbsync";
   };
 }
diff --git a/pkgs/tools/networking/nbd/default.nix b/pkgs/tools/networking/nbd/default.nix
index 1317938948410..d302e6250950e 100644
--- a/pkgs/tools/networking/nbd/default.nix
+++ b/pkgs/tools/networking/nbd/default.nix
@@ -1,18 +1,18 @@
-{ lib, stdenv, fetchurl, pkg-config, glib, which, nixosTests }:
+{ lib, stdenv, fetchurl, pkg-config, glib, which, bison, nixosTests }:
 
 stdenv.mkDerivation rec {
   pname = "nbd";
-  version = "3.21";
+  version = "3.24";
 
   src = fetchurl {
     url = "mirror://sourceforge/nbd/nbd-${version}.tar.xz";
-    sha256 = "sha256-52iK852Rczu80tsIBixE/lA9AE5RUodAE5xEr/amvvk=";
+    sha256 = "sha256-aHcVbSOnsz917uidL1wskcVCr8PNy2Nt6lqIU5pY0Qw=";
   };
 
   buildInputs = [ glib ]
     ++ lib.optional (stdenv ? glibc) stdenv.glibc.linuxHeaders;
 
-  nativeBuildInputs = [ pkg-config which ];
+  nativeBuildInputs = [ pkg-config which bison ];
 
   postInstall = ''
     mkdir -p "$out/share/doc/nbd-${version}"
diff --git a/pkgs/tools/networking/oonf-olsrd2/default.nix b/pkgs/tools/networking/oonf-olsrd2/default.nix
index c2ab89834afa9..e86bfbd1961a5 100644
--- a/pkgs/tools/networking/oonf-olsrd2/default.nix
+++ b/pkgs/tools/networking/oonf-olsrd2/default.nix
@@ -15,6 +15,13 @@ stdenv.mkDerivation rec {
     hash = "sha256-7EH2K7gaBGD95WFlG6RRhKEWJm91Xv2GOHYQjZWuzl0=";
   };
 
+  # Workaround build failure on -fno-common toolchains like upstream
+  # gcc-10. Otherwise build fails as:
+  #   ld: CMakeFiles/oonf_dlep_proxy.dir/router/dlep_router_session.c.o:(.bss+0x0):
+  #     multiple definition of `LOG_DLEP_ROUTER'; CMakeFiles/oonf_dlep_proxy.dir/router/dlep_router.c.o:(.bss+0x0): first defined here
+  # Can be removed once release with https://github.com/OLSR/OONF/pull/40 is out.
+  NIX_CFLAGS_COMPILE = "-fcommon";
+
   cmakeFlags = [
     "-DOONF_NO_WERROR=yes"
   ];
diff --git a/pkgs/tools/networking/p2p/tahoe-lafs/default.nix b/pkgs/tools/networking/p2p/tahoe-lafs/default.nix
index 938bfa1dcd610..c6107086fde5d 100644
--- a/pkgs/tools/networking/p2p/tahoe-lafs/default.nix
+++ b/pkgs/tools/networking/p2p/tahoe-lafs/default.nix
@@ -60,8 +60,8 @@ python3Packages.buildPythonApplication rec {
     html5lib magic-wormhole netifaces pyasn1 pycrypto pyutil pyyaml recommonmark
     service-identity simplejson sphinx_rtd_theme testtools treq twisted zfec
     zope_interface
-  ] ++ twisted.extras-require.tls
-    ++ twisted.extras-require.conch;
+  ] ++ twisted.optional-dependencies.tls
+    ++ twisted.optional-dependencies.conch;
 
   checkInputs = with python3Packages; [ mock hypothesis twisted ];
 
diff --git a/pkgs/tools/package-management/nix-prefetch/default.nix b/pkgs/tools/package-management/nix-prefetch/default.nix
index 5936429c7a45b..03d51213b3e00 100644
--- a/pkgs/tools/package-management/nix-prefetch/default.nix
+++ b/pkgs/tools/package-management/nix-prefetch/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     rev = version;
     sha256 = "0bwv6x651gyq703pywrhb7lfby6xwnd1iwnrzzjihipn7x3v2hz9";
     # the stat call has to be in a subshell or we get the current date
-    extraPostFetch = ''
+    postFetch = ''
       echo $(stat -c %Y $out) > $out/.timestamp
     '';
   };
diff --git a/pkgs/tools/security/chipsec/default.nix b/pkgs/tools/security/chipsec/default.nix
index 64d8885eedd49..5b4957139d753 100644
--- a/pkgs/tools/security/chipsec/default.nix
+++ b/pkgs/tools/security/chipsec/default.nix
@@ -68,6 +68,6 @@ python3.pkgs.buildPythonApplication rec {
     license = licenses.gpl2Only;
     homepage = "https://github.com/chipsec/chipsec";
     maintainers = with maintainers; [ johnazoidberg ];
-    platforms = if withDriver then [ "x86_64-linux" ] else platforms.all;
+    platforms = [ "x86_64-linux" ] ++ lib.optional (!withDriver) "x86_64-darwin";
   };
 }
diff --git a/pkgs/tools/security/gopass/default.nix b/pkgs/tools/security/gopass/default.nix
index 4e3926d7f0642..f283a911a62c6 100644
--- a/pkgs/tools/security/gopass/default.nix
+++ b/pkgs/tools/security/gopass/default.nix
@@ -13,7 +13,7 @@
 
 buildGoModule rec {
   pname = "gopass";
-  version = "1.14.1";
+  version = "1.14.2";
 
   nativeBuildInputs = [ installShellFiles makeWrapper ];
 
@@ -21,10 +21,10 @@ buildGoModule rec {
     owner = "gopasspw";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-vdMOD6Zrl718jcntjEzOG+4Rr0aqhm0YidA0x3Gseqg=";
+    sha256 = "sha256-JhLFax0UR/AVl/736pdsAyyQF/555YmLWLnZrsLDjlA=";
   };
 
-  vendorSha256 = "sha256-mdPAZrcdlq7R7DRIfuxf4PCpEJoJjzo/+TDKAVglk7A=";
+  vendorSha256 = "sha256-ESIlmY3SzmfWLqLxf62dOhAsHPOKc2YYSOhzpJCjvCQ=";
 
   subPackages = [ "." ];
 
@@ -57,7 +57,7 @@ buildGoModule rec {
     description = "The slightly more awesome Standard Unix Password Manager for Teams. Written in Go";
     homepage = "https://www.gopass.pw/";
     license = licenses.mit;
-    maintainers = with maintainers; [ rvolosatovs ];
+    maintainers = with maintainers; [ rvolosatovs sikmir ];
     changelog = "https://github.com/gopasspw/gopass/raw/v${version}/CHANGELOG.md";
 
     longDescription = ''
diff --git a/pkgs/tools/security/wapiti/default.nix b/pkgs/tools/security/wapiti/default.nix
index 4c24535f8d8cc..c86cd9b8f87e3 100644
--- a/pkgs/tools/security/wapiti/default.nix
+++ b/pkgs/tools/security/wapiti/default.nix
@@ -39,8 +39,8 @@ python3.pkgs.buildPythonApplication rec {
     yaswfp
   ] ++ lib.optionals (python3.pythonOlder "3.8") [
     importlib-metadata
-  ] ++ httpx.extras-require.brotli
-    ++ httpx.extras-require.socks;
+  ] ++ httpx.optional-dependencies.brotli
+    ++ httpx.optional-dependencies.socks;
 
   checkInputs = with python3.pkgs; [
     respx
diff --git a/pkgs/tools/text/difftastic/default.nix b/pkgs/tools/text/difftastic/default.nix
index 1c1d6fc6bfa0b..500aae3fc080c 100644
--- a/pkgs/tools/text/difftastic/default.nix
+++ b/pkgs/tools/text/difftastic/default.nix
@@ -1,4 +1,11 @@
-{ lib, fetchFromGitHub, rustPlatform, tree-sitter, difftastic, testers }:
+{ lib
+, fetchFromGitHub
+, fetchpatch
+, rustPlatform
+, tree-sitter
+, difftastic
+, testers
+}:
 
 rustPlatform.buildRustPackage rec {
   pname = "difftastic";
@@ -11,7 +18,29 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-jdkyDsuOOG1dJmgRmMp2KhY9ermccjrxK2JAIzpO6nw=";
   };
 
-  cargoSha256 = "sha256-qHG3ve8HoMWBS/x6mRbXMsrpcqNqfVcbAkfYOk7Su/0=";
+  depsExtraArgs = {
+    postBuild = let
+      mimallocPatch = (fetchpatch {
+        name = "mimalloc-older-macos-fixes.patch";
+        url = "https://github.com/microsoft/mimalloc/commit/40e0507a5959ee218f308d33aec212c3ebeef3bb.patch";
+        stripLen = 1;
+        extraPrefix = "libmimalloc-sys/c_src/mimalloc/";
+        sha256 = "1cqgay6ayzxsj8v1dy8405kwd8av34m4bjc84iyg9r52amlijbg4";
+      });
+    in ''
+      pushd $name
+      patch -p1 < ${mimallocPatch}
+      substituteInPlace libmimalloc-sys/.cargo-checksum.json \
+        --replace \
+          '6a2e9f0db0d3de160f9f15ddc8a870dbc42bba724f19f1e69b8c4952cb36821a' \
+          '201ab8874d9ba863406e084888e492b785a7edae00a222f395c079028d21a89a' \
+        --replace \
+          'a87a27e8432a63e5de25703ff5025588afd458e3a573e51b3c3dee2281bff0d4' \
+          'ab98a2da81d2145003a9cba7b7025efbd2c7b37c7a23c058c150705a3ec39298'
+      popd
+    '';
+  };
+  cargoSha256 = "12a12ng9wz2rrj3xzhgrqlg3lxpqxwdgvkz3fxny17nysmmpnhvv";
 
   passthru.tests.version = testers.testVersion { package = difftastic; };
 
diff --git a/pkgs/tools/text/html-tidy/default.nix b/pkgs/tools/text/html-tidy/default.nix
index 9694295ed1fa3..d80b8e8c899cd 100644
--- a/pkgs/tools/text/html-tidy/default.nix
+++ b/pkgs/tools/text/html-tidy/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, libxslt }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake, libxslt, html-tidy }:
 
 stdenv.mkDerivation rec {
   pname = "html-tidy";
@@ -11,9 +11,18 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-ZMz0NySxzX2XHiqB8f5asvwjIG6kdIcq8Gb3EbAxBaU=";
   };
 
-  nativeBuildInputs = [ cmake libxslt/*manpage*/ ];
+  # https://github.com/htacg/tidy-html5/pull/1036
+  patches = (fetchpatch {
+    url = "https://github.com/htacg/tidy-html5/commit/e9aa038bd06bd8197a0dc049380bc2945ff55b29.diff";
+    sha256 = "sha256-Q2GjinNBWLL+HXUtslzDJ7CJSTflckbjweiSMCnIVwg=";
+  });
 
-  cmakeFlags = [];
+  nativeBuildInputs = [ cmake libxslt/*manpage*/ ]
+    ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) html-tidy;
+
+  cmakeFlags = lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "-DHOST_TIDY=tidy"
+  ];
 
   # ATM bin/tidy is statically linked, as upstream provides no other option yet.
   # https://github.com/htacg/tidy-html5/issues/326#issuecomment-160322107
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index bb88c91d1c870..8d5f06f4fbbe6 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -170,6 +170,7 @@ mapAliases ({
   chunkwm = throw "chunkwm has been removed: abandoned by upstream"; # Added 2022-01-07
   cifs_utils = throw "'cifs_utils' has been renamed to/replaced by 'cifs-utils'"; # Converted to throw 2022-02-22
   cipherscan = throw "cipherscan was removed from nixpkgs, as it was unmaintained"; # added 2021-12-11
+  citra = citra-nightly; # added 2022-05-17
   ckb = throw "'ckb' has been renamed to/replaced by 'ckb-next'"; # Converted to throw 2022-02-22
   inherit (libsForQt5.mauiPackages) clip; # added 2022-05-17
   cpp-ipfs-api = cpp-ipfs-http-client; # Project has been renamed. Added 2022-05-15
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 5ebb7608596bd..78d4ca310ee0f 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -723,7 +723,10 @@ with pkgs;
     inherit curl stdenv;
   };
 
-  fetchzip = callPackage ../build-support/fetchzip { };
+  fetchzip = callPackage ../build-support/fetchzip { }
+    // {
+      tests = pkgs.tests.fetchzip;
+    };
 
   fetchCrate = callPackage ../build-support/rust/fetchcrate.nix { };
 
@@ -1255,6 +1258,8 @@ with pkgs;
     wxGTK = wxGTK30;
   };
 
+  box64 = callPackage ../applications/emulators/box64 { };
+
   caprice32 = callPackage ../applications/emulators/caprice32 { };
 
   ccemux = callPackage ../applications/emulators/ccemux { };
@@ -1265,7 +1270,13 @@ with pkgs;
 
   cen64 = callPackage ../applications/emulators/cen64 { };
 
-  citra = libsForQt5.callPackage ../applications/emulators/citra { };
+  citra-canary = callPackage ../applications/emulators/citra {
+    branch = "canary";
+  };
+
+  citra-nightly = callPackage ../applications/emulators/citra {
+    branch = "nightly";
+  };
 
   collapseos-cvm = callPackage ../applications/emulators/collapseos-cvm { };
 
@@ -10443,6 +10454,10 @@ with pkgs;
 
   sozu = callPackage ../servers/sozu { };
 
+  sparrow = callPackage ../applications/blockchains/sparrow {
+    openimajgrabber = callPackage ../applications/blockchains/sparrow/openimajgrabber.nix {};
+  };
+
   sparsehash = callPackage ../development/libraries/sparsehash { };
 
   spectre-meltdown-checker = callPackage ../tools/security/spectre-meltdown-checker { };
@@ -13080,7 +13095,9 @@ with pkgs;
 
   hop = callPackage ../development/compilers/hop { };
 
-  falcon = callPackage ../development/interpreters/falcon { };
+  falcon = callPackage ../development/interpreters/falcon {
+    stdenv = gcc10Stdenv;
+  };
 
   fsharp = callPackage ../development/compilers/fsharp { };
 
@@ -29383,7 +29400,7 @@ with pkgs;
 
   scantailor = callPackage ../applications/graphics/scantailor { };
 
-  scantailor-advanced = libsForQt514.callPackage ../applications/graphics/scantailor/advanced.nix { };
+  scantailor-advanced = libsForQt515.callPackage ../applications/graphics/scantailor/advanced.nix { };
 
   sc-im = callPackage ../applications/misc/sc-im { };
 
diff --git a/pkgs/top-level/emscripten-packages.nix b/pkgs/top-level/emscripten-packages.nix
index d15db2b1d3882..9a6b188095023 100644
--- a/pkgs/top-level/emscripten-packages.nix
+++ b/pkgs/top-level/emscripten-packages.nix
@@ -14,6 +14,8 @@ rec {
       propagatedBuildInputs = [ zlib ];
       configurePhase = ''
         HOME=$TMPDIR
+        mkdir -p .emscriptencache
+        export EM_CACHE=$(pwd)/.emscriptencache
         emcmake cmake . $cmakeFlags -DCMAKE_INSTALL_PREFIX=$out -DCMAKE_INSTALL_INCLUDEDIR=$dev/include
       '';
       checkPhase = ''
@@ -54,6 +56,8 @@ rec {
       autoreconfPhase = "echo autoreconfPhase not used...";
       configurePhase = ''
         HOME=$TMPDIR
+        mkdir -p .emscriptencache
+        export EM_CACHE=$(pwd)/.emscriptencache
         emconfigure ./configure --prefix=$out --without-python
       '';
       checkPhase = ''
@@ -102,6 +106,8 @@ rec {
       sed -e "s/\$(JSONC_LDFLAGS) \$(ZLIB_LDFLAGS) \$(LIBXML20_LDFLAGS)/\$(JSONC_LDFLAGS) \$(LIBXML20_LDFLAGS) \$(ZLIB_LDFLAGS) /g" -i Makefile.emEnv
       # https://gitlab.com/odfplugfest/xmlmirror/issues/11
       sed -e "s/-o fastXmlLint.js/-s EXTRA_EXPORTED_RUNTIME_METHODS='[\"ccall\", \"cwrap\"]' -o fastXmlLint.js/g" -i Makefile.emEnv
+      mkdir -p .emscriptencache
+      export EM_CACHE=$(pwd)/.emscriptencache
     '';
 
     buildPhase = ''
@@ -137,16 +143,6 @@ rec {
       buildInputs = old.buildInputs ++ [ pkg-config ];
       # we need to reset this setting!
       NIX_CFLAGS_COMPILE="";
-      configurePhase = ''
-        # FIXME: Some tests require writing at $HOME
-        HOME=$TMPDIR
-        runHook preConfigure
-
-        #export EMCC_DEBUG=2
-        emconfigure ./configure --prefix=$out --shared
-
-        runHook postConfigure
-      '';
       dontStrip = true;
       outputs = [ "out" ];
       buildPhase = ''
@@ -161,7 +157,7 @@ rec {
         echo "Compiling a custom test"
         set -x
         emcc -O2 -s EMULATE_FUNCTION_POINTER_CASTS=1 test/example.c -DZ_SOLO \
-        -L. libz.so.${old.version} -I . -o example.js
+        -L. libz.a -I . -o example.js
 
         echo "Using node to execute the test"
         ${pkgs.nodejs}/bin/node ./example.js
diff --git a/pkgs/top-level/php-packages.nix b/pkgs/top-level/php-packages.nix
index db47de7f19820..3637a7a4bcf16 100644
--- a/pkgs/top-level/php-packages.nix
+++ b/pkgs/top-level/php-packages.nix
@@ -212,6 +212,8 @@ lib.makeScope pkgs.newScope (self: with self; {
 
     gnupg = callPackage ../development/php-packages/gnupg { };
 
+    grpc = callPackage ../development/php-packages/grpc { };
+
     igbinary = callPackage ../development/php-packages/igbinary { };
 
     imagick = callPackage ../development/php-packages/imagick { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index dd21231dfecd0..a93482bb7842b 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1105,6 +1105,10 @@ in {
 
   babelgladeextractor = callPackage ../development/python-modules/babelgladeextractor { };
 
+  pulumi = callPackage ../development/python-modules/pulumi { };
+
+  pulumi-aws = callPackage ../development/python-modules/pulumi-aws { };
+
   backcall = callPackage ../development/python-modules/backcall { };
 
   backoff = callPackage ../development/python-modules/backoff { };
@@ -5329,6 +5333,7 @@ in {
   mizani = callPackage ../development/python-modules/mizani { };
 
   mkdocs = callPackage ../development/python-modules/mkdocs { };
+  mkdocs-drawio-exporter = callPackage ../development/python-modules/mkdocs-drawio-exporter { };
   mkdocs-material = callPackage ../development/python-modules/mkdocs-material { };
   mkdocs-material-extensions = callPackage ../development/python-modules/mkdocs-material/mkdocs-material-extensions.nix { };
   mkdocs-minify = callPackage ../development/python-modules/mkdocs-minify { };
diff --git a/pkgs/top-level/release-cross.nix b/pkgs/top-level/release-cross.nix
index 13a49179bcbde..63a4a335dc9b5 100644
--- a/pkgs/top-level/release-cross.nix
+++ b/pkgs/top-level/release-cross.nix
@@ -197,6 +197,7 @@ in
   x86_64-embedded = mapTestOnCross lib.systems.examples.x86_64-embedded embedded;
   riscv64-embedded = mapTestOnCross lib.systems.examples.riscv64-embedded embedded;
   riscv32-embedded = mapTestOnCross lib.systems.examples.riscv32-embedded embedded;
+  rx-embedded = mapTestOnCross lib.systems.examples.rx-embedded embedded;
 
   x86_64-netbsd = mapTestOnCross lib.systems.examples.x86_64-netbsd common;