about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--doc/doc-support/default.nix9
-rw-r--r--doc/using/configuration.chapter.md8
-rw-r--r--maintainers/maintainer-list.nix12
-rw-r--r--nixos/doc/manual/from_md/release-notes/rl-2205.section.xml9
-rw-r--r--nixos/doc/manual/release-notes/rl-2205.section.md4
-rw-r--r--nixos/lib/make-options-doc/default.nix3
-rw-r--r--nixos/lib/make-options-doc/options-to-docbook.xsl18
-rw-r--r--nixos/modules/installer/cd-dvd/installation-cd-graphical-base.nix9
-rw-r--r--nixos/modules/services/networking/frr.nix11
-rw-r--r--nixos/modules/services/networking/nebula.nix1
-rw-r--r--nixos/modules/services/networking/uptermd.nix5
-rw-r--r--nixos/modules/services/web-apps/restya-board.nix6
-rw-r--r--nixos/modules/services/x11/window-managers/xmonad.nix33
-rw-r--r--nixos/tests/uptermd.nix7
-rw-r--r--pkgs/applications/audio/bristol/default.nix6
-rw-r--r--pkgs/applications/audio/dirt/default.nix11
-rw-r--r--pkgs/applications/audio/ecasound/default.nix2
-rw-r--r--pkgs/applications/audio/jamin/default.nix6
-rw-r--r--pkgs/applications/audio/musikcube/default.nix6
-rw-r--r--pkgs/applications/audio/noisetorch/default.nix2
-rw-r--r--pkgs/applications/audio/ympd/default.nix9
-rw-r--r--pkgs/applications/blockchains/alfis/default.nix6
-rw-r--r--pkgs/applications/blockchains/nearcore/default.nix46
-rw-r--r--pkgs/applications/emulators/bsnes/ares/default.nix6
-rw-r--r--pkgs/applications/emulators/bsnes/bsnes-hd/default.nix17
-rw-r--r--pkgs/applications/graphics/drawio/headless.nix36
-rw-r--r--pkgs/applications/graphics/grafx2/default.nix6
-rw-r--r--pkgs/applications/misc/bottles/default.nix4
-rw-r--r--pkgs/applications/misc/gpg-mdp/default.nix11
-rw-r--r--pkgs/applications/misc/octoprint/default.nix4
-rw-r--r--pkgs/applications/misc/tpmmanager/default.nix20
-rw-r--r--pkgs/applications/misc/zettlr/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/krane/Gemfile.lock4
-rw-r--r--pkgs/applications/networking/cluster/krane/gemset.nix8
-rw-r--r--pkgs/applications/networking/cluster/temporal-cli/default.nix38
-rw-r--r--pkgs/applications/networking/cluster/terraform/default.nix11
-rw-r--r--pkgs/applications/networking/cluster/waypoint/default.nix6
-rw-r--r--pkgs/applications/networking/flexget/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/deltachat-cursed/default.nix16
-rw-r--r--pkgs/applications/networking/mujmap/default.nix33
-rw-r--r--pkgs/applications/science/logic/alt-ergo/default.nix6
-rw-r--r--pkgs/applications/science/logic/easycrypt/default.nix8
-rw-r--r--pkgs/applications/science/logic/why3/default.nix4
-rw-r--r--pkgs/applications/science/logic/why3/with-provers.nix2
-rw-r--r--pkgs/applications/science/math/eukleides/default.nix6
-rw-r--r--pkgs/applications/terminal-emulators/kitty/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/git-workspace/default.nix6
-rw-r--r--pkgs/applications/version-management/git-and-tools/lab/default.nix6
-rw-r--r--pkgs/applications/window-managers/matchbox/default.nix11
-rw-r--r--pkgs/applications/window-managers/yeahwm/default.nix5
-rw-r--r--pkgs/data/themes/mojave/default.nix9
-rw-r--r--pkgs/development/compilers/ccl/default.nix17
-rw-r--r--pkgs/development/compilers/jasmin-compiler/default.nix4
-rw-r--r--pkgs/development/compilers/yap/default.nix6
-rw-r--r--pkgs/development/haskell-modules/configuration-common.nix9
-rw-r--r--pkgs/development/haskell-modules/configuration-ghcjs.nix2
-rw-r--r--pkgs/development/interpreters/spidermonkey/91.nix4
-rw-r--r--pkgs/development/libraries/cpp-ipfs-api/default.nix28
-rw-r--r--pkgs/development/libraries/cpp-ipfs-http-client/default.nix35
-rw-r--r--pkgs/development/libraries/cpp-ipfs-http-client/unvendor-nlohmann-json.patch27
-rw-r--r--pkgs/development/libraries/kde-frameworks/kimageformats.nix7
-rw-r--r--pkgs/development/libraries/libdeltachat/default.nix6
-rw-r--r--pkgs/development/libraries/libwpe/default.nix6
-rw-r--r--pkgs/development/libraries/libwpe/fdo.nix6
-rw-r--r--pkgs/development/libraries/precice/default.nix4
-rw-r--r--pkgs/development/libraries/rtrlib/default.nix24
-rw-r--r--pkgs/development/libraries/ucommon/default.nix3
-rw-r--r--pkgs/development/libraries/webkitgtk/default.nix17
-rw-r--r--pkgs/development/libraries/webkitgtk/fdo-backend-path.patch11
-rw-r--r--pkgs/development/ocaml-modules/genspio/default.nix16
-rw-r--r--pkgs/development/ocaml-modules/lwt/default.nix6
-rw-r--r--pkgs/development/ocaml-modules/stdcompat/default.nix2
-rw-r--r--pkgs/development/python-modules/aioesphomeapi/default.nix4
-rw-r--r--pkgs/development/python-modules/ansible/core.nix4
-rw-r--r--pkgs/development/python-modules/ansible/default.nix4
-rw-r--r--pkgs/development/python-modules/azure-mgmt-servicelinker/default.nix4
-rw-r--r--pkgs/development/python-modules/catboost/default.nix2
-rw-r--r--pkgs/development/python-modules/deepdiff/default.nix7
-rw-r--r--pkgs/development/python-modules/dropbox/default.nix6
-rw-r--r--pkgs/development/python-modules/dulwich/default.nix4
-rw-r--r--pkgs/development/python-modules/ecs-logging/default.nix6
-rw-r--r--pkgs/development/python-modules/fastavro/default.nix4
-rw-r--r--pkgs/development/python-modules/gcsfs/default.nix4
-rw-r--r--pkgs/development/python-modules/lxmf/default.nix4
-rw-r--r--pkgs/development/python-modules/mox/default.nix37
-rw-r--r--pkgs/development/python-modules/nomadnet/default.nix4
-rw-r--r--pkgs/development/python-modules/peaqevcore/default.nix4
-rw-r--r--pkgs/development/python-modules/pex/default.nix4
-rw-r--r--pkgs/development/python-modules/phik/default.nix7
-rw-r--r--pkgs/development/python-modules/pyfzf/default.nix39
-rw-r--r--pkgs/development/python-modules/pyshark/default.nix43
-rw-r--r--pkgs/development/python-modules/pyskyqremote/default.nix4
-rw-r--r--pkgs/development/python-modules/scikit-build/default.nix12
-rw-r--r--pkgs/development/python-modules/slack-sdk/default.nix4
-rw-r--r--pkgs/development/python-modules/starline/default.nix6
-rw-r--r--pkgs/development/python-modules/ttp-templates/default.nix28
-rw-r--r--pkgs/development/python-modules/ttp/default.nix20
-rw-r--r--pkgs/development/python-modules/ttp/templates.nix31
-rw-r--r--pkgs/development/python-modules/uamqp/darwin-azure-c-shared-utility-corefoundation.patch37
-rw-r--r--pkgs/development/python-modules/uamqp/default.nix4
-rw-r--r--pkgs/development/python-modules/velbus-aio/default.nix4
-rw-r--r--pkgs/development/python-modules/whois/default.nix6
-rw-r--r--pkgs/development/tools/analysis/frama-c/default.nix9
-rw-r--r--pkgs/development/tools/analysis/tfsec/default.nix6
-rw-r--r--pkgs/development/tools/apkid/default.nix13
-rw-r--r--pkgs/development/tools/rust/cargo-deny/default.nix6
-rw-r--r--pkgs/development/tools/rust/rust-analyzer/default.nix13
-rw-r--r--pkgs/development/tools/rust/rust-analyzer/test-neovim-lsp.nix49
-rw-r--r--pkgs/development/tools/treefmt/default.nix6
-rw-r--r--pkgs/development/web/deno/default.nix6
-rw-r--r--pkgs/development/web/deno/librusty_v8.nix10
-rw-r--r--pkgs/games/brogue/default.nix11
-rw-r--r--pkgs/games/cl-wordle/default.nix14
-rw-r--r--pkgs/games/egoboo/default.nix5
-rw-r--r--pkgs/misc/wiki-tui/default.nix6
-rw-r--r--pkgs/os-specific/linux/disk-indicator/default.nix29
-rw-r--r--pkgs/os-specific/linux/kmscube/default.nix11
-rw-r--r--pkgs/os-specific/linux/latencytop/default.nix10
-rw-r--r--pkgs/os-specific/linux/rt-tests/default.nix34
-rw-r--r--pkgs/servers/bloat/default.nix42
-rw-r--r--pkgs/servers/frr/default.nix3
-rw-r--r--pkgs/servers/gemini/agate/default.nix17
-rw-r--r--pkgs/servers/home-assistant/component-packages.nix4
-rw-r--r--pkgs/servers/home-assistant/default.nix4
-rw-r--r--pkgs/servers/monitoring/lcdproc/default.nix9
-rw-r--r--pkgs/servers/web-apps/wiki-js/default.nix4
-rw-r--r--pkgs/servers/zoneminder/default.nix4
-rw-r--r--pkgs/stdenv/generic/make-derivation.nix4
-rw-r--r--pkgs/tools/admin/adtool/default.nix6
-rw-r--r--pkgs/tools/admin/docker-credential-gcr/default.nix27
-rw-r--r--pkgs/tools/admin/docker-credential-helpers/default.nix2
-rw-r--r--pkgs/tools/bluetooth/bluez-tools/default.nix6
-rw-r--r--pkgs/tools/filesystems/jfsutils/default.nix6
-rw-r--r--pkgs/tools/misc/diffoscope/default.nix4
-rw-r--r--pkgs/tools/misc/dua/default.nix7
-rw-r--r--pkgs/tools/misc/esphome/dashboard.nix4
-rw-r--r--pkgs/tools/misc/esphome/default.nix4
-rw-r--r--pkgs/tools/misc/goreleaser/default.nix6
-rw-r--r--pkgs/tools/misc/neofetch/default.nix10
-rw-r--r--pkgs/tools/misc/pandoc-drawio-filter/default.nix23
-rw-r--r--pkgs/tools/misc/wimboot/default.nix2
-rw-r--r--pkgs/tools/misc/yt-dlp/default.nix6
-rw-r--r--pkgs/tools/misc/yubikey-personalization/default.nix8
-rw-r--r--pkgs/tools/networking/aria2/default.nix3
-rw-r--r--pkgs/tools/networking/goreplay/default.nix23
-rw-r--r--pkgs/tools/networking/hping/default.nix11
-rw-r--r--pkgs/tools/networking/iftop/default.nix6
-rw-r--r--pkgs/tools/networking/iouyap/default.nix5
-rw-r--r--pkgs/tools/networking/lsh/default.nix7
-rw-r--r--pkgs/tools/networking/networkmanager/default.nix4
-rw-r--r--pkgs/tools/networking/networkmanager/l2tp/default.nix57
-rw-r--r--pkgs/tools/networking/networkmanager/l2tp/fix-paths.patch36
-rw-r--r--pkgs/tools/networking/networkmanager/strongswan/default.nix48
-rw-r--r--pkgs/tools/nix/alejandra/default.nix6
-rw-r--r--pkgs/tools/package-management/cde/default.nix8
-rw-r--r--pkgs/tools/package-management/nix-update/default.nix4
-rw-r--r--pkgs/tools/security/arsenal/default.nix7
-rw-r--r--pkgs/tools/security/badrobot/default.nix45
-rw-r--r--pkgs/tools/security/exploitdb/default.nix4
-rw-r--r--pkgs/tools/security/kube-hunter/default.nix4
-rw-r--r--pkgs/tools/security/libmodsecurity/default.nix4
-rw-r--r--pkgs/tools/security/nuclei/default.nix6
-rw-r--r--pkgs/tools/security/terrascan/default.nix6
-rw-r--r--pkgs/tools/system/ddrutility/default.nix5
-rw-r--r--pkgs/tools/text/tab/default.nix10
-rw-r--r--pkgs/tools/text/vale/default.nix6
-rw-r--r--pkgs/tools/text/xml/xmldiff/default.nix6
-rw-r--r--pkgs/top-level/aliases.nix1
-rw-r--r--pkgs/top-level/all-packages.nix31
-rw-r--r--pkgs/top-level/config.nix5
-rw-r--r--pkgs/top-level/perl-packages.nix2
-rw-r--r--pkgs/top-level/python-packages.nix4
172 files changed, 1378 insertions, 547 deletions
diff --git a/doc/doc-support/default.nix b/doc/doc-support/default.nix
index 53990b6771962..7c00195ab3909 100644
--- a/doc/doc-support/default.nix
+++ b/doc/doc-support/default.nix
@@ -23,6 +23,14 @@ let
       <xsl:import href="${./parameters.xml}"/>
     </xsl:stylesheet>
   '';
+
+  # NB: This file describes the Nixpkgs manual, which happens to use module
+  #     docs infra originally developed for NixOS.
+  optionsDoc = pkgs.nixosOptionsDoc {
+    inherit (pkgs.lib.evalModules { modules = [ ../../pkgs/top-level/config.nix ]; }) options;
+    documentType = "none";
+  };
+
 in pkgs.runCommand "doc-support" {}
 ''
   mkdir result
@@ -30,6 +38,7 @@ in pkgs.runCommand "doc-support" {}
     cd result
     ln -s ${locationsXml} ./function-locations.xml
     ln -s ${functionDocs} ./function-docs
+    ln -s ${optionsDoc.optionsDocBook} ./config-options.docbook.xml
 
     ln -s ${pkgs.docbook5}/xml/rng/docbook/docbook.rng ./docbook.rng
     ln -s ${pkgs.docbook_xsl_ns}/xml/xsl ./xsl
diff --git a/doc/using/configuration.chapter.md b/doc/using/configuration.chapter.md
index 932b24237c02e..842450ebf47fb 100644
--- a/doc/using/configuration.chapter.md
+++ b/doc/using/configuration.chapter.md
@@ -164,6 +164,14 @@ There are several ways to tweak how Nix handles a package which has been marked
 
     Note that `permittedInsecurePackages` is only checked if `allowInsecurePredicate` is not specified.
 
+### `config` Options Reference
+
+The following attributes can be passed in [`config`](#chap-packageconfig).
+
+```{=docbook}
+<include xmlns="http://www.w3.org/2001/XInclude" href="../doc-support/result/config-options.docbook.xml"/>
+```
+
 ## Modify packages via `packageOverrides` {#sec-modify-via-packageOverrides}
 
 You can define a function called `packageOverrides` in your local `~/.config/nixpkgs/config.nix` to override Nix packages. It must be a function that takes pkgs as an argument and returns a modified set of packages.
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 574ce1a9897b3..b7e14de9bd548 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -3662,6 +3662,12 @@
     githubId = 103082;
     name = "Ed Brindley";
   };
+  elizagamedev = {
+    email = "eliza@eliza.sh";
+    github = "elizagamedev";
+    githubId = 4576666;
+    name = "Eliza Velasquez";
+  };
   elliot = {
     email = "hack00mind@gmail.com";
     github = "Eliot00";
@@ -10122,6 +10128,12 @@
     githubId = 81340136;
     name = "polykernel";
   };
+  poelzi = {
+    email = "nix@poelzi.org";
+    github = "poelzi";
+    githubId = 66107;
+    name = "Daniel Poelzleithner";
+  };
   polyrod = {
     email = "dc1mdp@gmail.com";
     github = "polyrod";
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
index c0f36fcfd356a..19aaf12f26a1b 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@@ -518,6 +518,15 @@
       </listitem>
       <listitem>
         <para>
+          The update of the haskell package set brings with it a new
+          version of the <literal>xmonad</literal> module, which will
+          break your configuration if you use <literal>launch</literal>
+          as entrypoint. The example code the corresponding nixos module
+          was adjusted, you way want to have a look at it.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
           The <literal>home-assistant</literal> module now requires
           users that don’t want their configuration to be managed
           declaratively to set
diff --git a/nixos/doc/manual/release-notes/rl-2205.section.md b/nixos/doc/manual/release-notes/rl-2205.section.md
index 5902957a53525..9261511e7b8c5 100644
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@@ -163,6 +163,10 @@ In addition to numerous new and upgraded packages, this release has the followin
   `useLLVM`. So instead of `(ghc.withPackages (p: [])).override { withLLVM = true; }`,
   one needs to use `(ghc.withPackages.override { useLLVM = true; }) (p: [])`.
 
+- The update of the haskell package set brings with it a new version of the `xmonad`
+  module, which will break your configuration if you use `launch` as entrypoint. The
+  example code the corresponding nixos module was adjusted, you way want to have a look at it.
+
 - The `home-assistant` module now requires users that don't want their
   configuration to be managed declaratively to set
   `services.home-assistant.config = null;`. This is required
diff --git a/nixos/lib/make-options-doc/default.nix b/nixos/lib/make-options-doc/default.nix
index 57652dd5db1e7..353fdb87a9f1c 100644
--- a/nixos/lib/make-options-doc/default.nix
+++ b/nixos/lib/make-options-doc/default.nix
@@ -20,6 +20,8 @@
 , lib
 , options
 , transformOptions ? lib.id  # function for additional tranformations of the options
+, documentType ? "appendix" # TODO deprecate "appendix" in favor of "none"
+                            #      and/or rename function to moduleOptionDoc for clean slate
 , revision ? "" # Specify revision for the options
 # a set of options the docs we are generating will be merged into, as if by recursiveUpdate.
 # used to split the options doc build into a static part (nixos/modules) and a dynamic part
@@ -161,6 +163,7 @@ in rec {
 
     ${pkgs.python3Minimal}/bin/python ${./sortXML.py} $optionsXML sorted.xml
     ${pkgs.libxslt.bin}/bin/xsltproc \
+      --stringparam documentType '${documentType}' \
       --stringparam revision '${revision}' \
       -o intermediate.xml ${./options-to-docbook.xsl} sorted.xml
     ${pkgs.libxslt.bin}/bin/xsltproc \
diff --git a/nixos/lib/make-options-doc/options-to-docbook.xsl b/nixos/lib/make-options-doc/options-to-docbook.xsl
index 607db4bb21bae..03e14365cda93 100644
--- a/nixos/lib/make-options-doc/options-to-docbook.xsl
+++ b/nixos/lib/make-options-doc/options-to-docbook.xsl
@@ -12,12 +12,25 @@
   <xsl:output method='xml' encoding="UTF-8" />
 
   <xsl:param name="revision" />
+  <xsl:param name="documentType" />
   <xsl:param name="program" />
 
 
   <xsl:template match="/expr/list">
-    <appendix xml:id="appendix-configuration-options">
-      <title>Configuration Options</title>
+    <xsl:choose>
+      <xsl:when test="$documentType = 'appendix'">
+        <appendix xml:id="appendix-configuration-options">
+          <title>Configuration Options</title>
+          <xsl:call-template name="variable-list"/>
+        </appendix>
+      </xsl:when>
+      <xsl:otherwise>
+        <xsl:call-template name="variable-list"/>
+      </xsl:otherwise>
+    </xsl:choose>
+  </xsl:template>
+
+  <xsl:template name="variable-list">
       <variablelist xml:id="configuration-variable-list">
         <xsl:for-each select="attrs">
           <xsl:variable name="id" select="
@@ -102,7 +115,6 @@
         </xsl:for-each>
 
       </variablelist>
-    </appendix>
   </xsl:template>
 
 
diff --git a/nixos/modules/installer/cd-dvd/installation-cd-graphical-base.nix b/nixos/modules/installer/cd-dvd/installation-cd-graphical-base.nix
index 0e4feba228234..8c7bac6f6cc1c 100644
--- a/nixos/modules/installer/cd-dvd/installation-cd-graphical-base.nix
+++ b/nixos/modules/installer/cd-dvd/installation-cd-graphical-base.nix
@@ -35,8 +35,15 @@ with lib;
   # Enable sound in graphical iso's.
   hardware.pulseaudio.enable = true;
 
-  # Spice guest additions
+  # VM guest additions to improve host-guest interaction
   services.spice-vdagentd.enable = true;
+  services.qemuGuest.enable = true;
+  virtualisation.vmware.guest.enable = true;
+  virtualisation.hypervGuest.enable = true;
+  services.xe-guest-utilities.enable = true;
+  # The VirtualBox guest additions rely on an out-of-tree kernel module
+  # which lags behind kernel releases, potentially causing broken builds.
+  virtualisation.virtualbox.guest.enable = false;
 
   # Enable plymouth
   boot.plymouth.enable = true;
diff --git a/nixos/modules/services/networking/frr.nix b/nixos/modules/services/networking/frr.nix
index 45a82b9450a44..98452123f0306 100644
--- a/nixos/modules/services/networking/frr.nix
+++ b/nixos/modules/services/networking/frr.nix
@@ -106,6 +106,14 @@ let
           TCP Port to bind to for the VTY interface.
         '';
       };
+
+      extraOptions = mkOption {
+        type = types.listOf types.str;
+        default = [];
+        description = ''
+          Extra options for the daemon.
+        '';
+      };
     };
 
 in
@@ -196,7 +204,8 @@ in
                 PIDFile = "frr/${daemon}.pid";
                 ExecStart = "${pkgs.frr}/libexec/frr/${daemon} -f /etc/frr/${service}.conf"
                   + optionalString (scfg.vtyListenAddress != "") " -A ${scfg.vtyListenAddress}"
-                  + optionalString (scfg.vtyListenPort != null) " -P ${toString scfg.vtyListenPort}";
+                  + optionalString (scfg.vtyListenPort != null) " -P ${toString scfg.vtyListenPort}"
+                  + " " + (concatStringsSep " " scfg.extraOptions);
                 ExecReload = "${pkgs.python3.interpreter} ${pkgs.frr}/libexec/frr/frr-reload.py --reload --daemon ${daemonName service} --bindir ${pkgs.frr}/bin --rundir /run/frr /etc/frr/${service}.conf";
                 Restart = "on-abnormal";
               };
diff --git a/nixos/modules/services/networking/nebula.nix b/nixos/modules/services/networking/nebula.nix
index de4439415cf68..c83cd9d521c6d 100644
--- a/nixos/modules/services/networking/nebula.nix
+++ b/nixos/modules/services/networking/nebula.nix
@@ -192,6 +192,7 @@ in
                 Group = networkId;
               })
             ];
+            unitConfig.StartLimitIntervalSec = 0; # ensure Restart=always is always honoured (networks can go down for arbitrarily long)
           };
         }) enabledNetworks);
 
diff --git a/nixos/modules/services/networking/uptermd.nix b/nixos/modules/services/networking/uptermd.nix
index 072f561f5c3c6..b845a00649eba 100644
--- a/nixos/modules/services/networking/uptermd.nix
+++ b/nixos/modules/services/networking/uptermd.nix
@@ -85,6 +85,7 @@ in
         AmbientCapabilities = mkIf (cfg.port < 1024) [ "CAP_NET_BIND_SERVICE" ];
         CapabilityBoundingSet = mkIf (cfg.port < 1024) [ "CAP_NET_BIND_SERVICE" ];
         PrivateUsers = cfg.port >= 1024;
+        DynamicUser = true;
         LockPersonality = true;
         MemoryDenyWriteExecute = true;
         PrivateDevices = true;
@@ -95,7 +96,9 @@ in
         ProtectKernelLogs = true;
         ProtectKernelModules = true;
         ProtectKernelTunables = true;
-        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+        ProtectProc = "invisible";
+        # AF_UNIX is for ssh-keygen, which relies on nscd to resolve the uid to a user
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
         RestrictNamespaces = true;
         RestrictRealtime = true;
         SystemCallArchitectures = "native";
diff --git a/nixos/modules/services/web-apps/restya-board.nix b/nixos/modules/services/web-apps/restya-board.nix
index 0bfa2368787ff..1a8199ab3b37b 100644
--- a/nixos/modules/services/web-apps/restya-board.nix
+++ b/nixos/modules/services/web-apps/restya-board.nix
@@ -263,8 +263,8 @@ in
       serviceConfig.RemainAfterExit = true;
 
       wantedBy = [ "multi-user.target" ];
-      requires = [ "postgresql.service" ];
-      after = [ "network.target" "postgresql.service" ];
+      requires = if cfg.database.host == null then [] else [ "postgresql.service" ];
+      after = [ "network.target" ] ++ (if cfg.database.host == null then [] else [ "postgresql.service" ]);
 
       script = ''
         rm -rf "${runDir}"
@@ -282,7 +282,7 @@ in
           sed -i "s/^.*'R_DB_PASSWORD'.*$/define('R_DB_PASSWORD', 'restya');/g" "${runDir}/server/php/config.inc.php"
         '' else ''
           sed -i "s/^.*'R_DB_HOST'.*$/define('R_DB_HOST', '${cfg.database.host}');/g" "${runDir}/server/php/config.inc.php"
-          sed -i "s/^.*'R_DB_PASSWORD'.*$/define('R_DB_PASSWORD', ${if cfg.database.passwordFile == null then "''" else "'file_get_contents(${cfg.database.passwordFile})'"});/g" "${runDir}/server/php/config.inc.php
+          sed -i "s/^.*'R_DB_PASSWORD'.*$/define('R_DB_PASSWORD', ${if cfg.database.passwordFile == null then "''" else "'$(cat ${cfg.database.passwordFile})');/g"}" "${runDir}/server/php/config.inc.php"
         ''}
         sed -i "s/^.*'R_DB_PORT'.*$/define('R_DB_PORT', '${toString cfg.database.port}');/g" "${runDir}/server/php/config.inc.php"
         sed -i "s/^.*'R_DB_NAME'.*$/define('R_DB_NAME', '${cfg.database.name}');/g" "${runDir}/server/php/config.inc.php"
diff --git a/nixos/modules/services/x11/window-managers/xmonad.nix b/nixos/modules/services/x11/window-managers/xmonad.nix
index 68f97c2f504b6..66d11131391f5 100644
--- a/nixos/modules/services/x11/window-managers/xmonad.nix
+++ b/nixos/modules/services/x11/window-managers/xmonad.nix
@@ -128,33 +128,34 @@ in {
             [ ( (mod4Mask,xK_r), compileRestart True)
             , ( (mod4Mask,xK_q), restart "xmonad" True ) ]
 
+          compileRestart resume = do
+            dirs  <- asks directories
+            whenX (recompile dirs True) $ do
+              when resume writeStateToFile
+              catchIO
+                  ( do
+                      args <- getArgs
+                      executeFile (cacheDir dirs </> compiledConfig) False args Nothing
+                  )
+
+          main = getDirectories >>= launch myConfig
+
           --------------------------------------------
-          {- version 0.17.0 -}
+          {- For versions before 0.17.0 use this instead -}
           --------------------------------------------
           -- compileRestart resume =
-          --   dirs <- io getDirectories
-          --   whenX (recompile dirs True) $
+          --   whenX (recompile True) $
           --     when resume writeStateToFile
           --       *> catchIO
           --         ( do
+          --             dir <- getXMonadDataDir
           --             args <- getArgs
-          --             executeFile (cacheDir dirs </> compiledConfig) False args Nothing
+          --             executeFile (dir </> compiledConfig) False args Nothing
           --         )
           --
-          -- main = getDirectories >>= launch myConfig
+          -- main = launch myConfig
           --------------------------------------------
 
-          compileRestart resume =
-            whenX (recompile True) $
-              when resume writeStateToFile
-                *> catchIO
-                  ( do
-                      dir <- getXMonadDataDir
-                      args <- getArgs
-                      executeFile (dir </> compiledConfig) False args Nothing
-                  )
-
-          main = launch myConfig
         '';
       };
 
diff --git a/nixos/tests/uptermd.nix b/nixos/tests/uptermd.nix
index b2ff9a1e0d9cf..d504ef0641916 100644
--- a/nixos/tests/uptermd.nix
+++ b/nixos/tests/uptermd.nix
@@ -30,11 +30,14 @@ in
     server.wait_for_unit("uptermd.service")
     server.wait_for_unit("network-online.target")
 
+    # wait for upterm port to be reachable
+    client1.wait_until_succeeds("nc -z -v server 1337")
+
     # Add SSH hostkeys from the server to both clients
     # uptermd needs an '@cert-authority entry so we need to modify the known_hosts file
-    client1.execute("sleep 3; mkdir -p ~/.ssh && ssh -o StrictHostKeyChecking=no -p 1337 server ls")
+    client1.execute("mkdir -p ~/.ssh && ssh -o StrictHostKeyChecking=no -p 1337 server ls")
     client1.execute("echo @cert-authority $(cat ~/.ssh/known_hosts) > ~/.ssh/known_hosts")
-    client2.execute("sleep 3; mkdir -p ~/.ssh && ssh -o StrictHostKeyChecking=no -p 1337 server ls")
+    client2.execute("mkdir -p ~/.ssh && ssh -o StrictHostKeyChecking=no -p 1337 server ls")
     client2.execute("echo @cert-authority $(cat ~/.ssh/known_hosts) > ~/.ssh/known_hosts")
 
     client1.wait_for_unit("multi-user.target")
diff --git a/pkgs/applications/audio/bristol/default.nix b/pkgs/applications/audio/bristol/default.nix
index 0c9248b5f0bcc..b96155cf688bf 100644
--- a/pkgs/applications/audio/bristol/default.nix
+++ b/pkgs/applications/audio/bristol/default.nix
@@ -19,6 +19,12 @@ stdenv.mkDerivation  rec {
 
   configurePhase = "./configure --prefix=$out --enable-jack-default-audio --enable-jack-default-midi";
 
+  # Workaround build failure on -fno-common toolchains like upstream
+  # gcc-10. Otherwise build fails as:
+  #  ld: brightonCLI.o:/build/bristol-0.60.11/brighton/brightonCLI.c:139: multiple definition of
+  #    `event'; brightonMixerMenu.o:/build/bristol-0.60.11/brighton/brightonMixerMenu.c:1182: first defined here
+  NIX_CFLAGS_COMPILE = "-fcommon";
+
   preInstall = ''
     sed -e "s@\`which bristol\`@$out/bin/bristol@g" -i bin/startBristol
     sed -e "s@\`which brighton\`@$out/bin/brighton@g" -i bin/startBristol
diff --git a/pkgs/applications/audio/dirt/default.nix b/pkgs/applications/audio/dirt/default.nix
index a456d62e6f695..9d9c5c869f760 100644
--- a/pkgs/applications/audio/dirt/default.nix
+++ b/pkgs/applications/audio/dirt/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, libsndfile, libsamplerate, liblo, libjack2 }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, libsndfile, libsamplerate, liblo, libjack2 }:
 
 stdenv.mkDerivation {
   pname = "dirt";
@@ -10,6 +10,15 @@ stdenv.mkDerivation {
     sha256 = "13adglk2d31d7mswfvi02b0rjdhzmsv11cc8smhidmrns3f9s96n";
     fetchSubmodules = true;
   };
+  patches = [
+    # Pull patch pending upstream inclusion for upstream gcc-10 support:
+    #  https://github.com/tidalcycles/Dirt/pull/65
+    (fetchpatch {
+      name = "fno-common.patch";
+      url = "https://github.com/tidalcycles/Dirt/commit/43fd267745d486228c4185b4fcbd7d9fbc362cc2.patch";
+      sha256 = "08r34ylzs31wwf0la995pb149ccq0vr7qg4792pkhca57zi0bff8";
+    })
+  ];
   buildInputs = [ libsndfile libsamplerate liblo libjack2 ];
   postPatch = ''
     sed -i "s|./samples|$out/share/dirt/samples|" dirt.c
diff --git a/pkgs/applications/audio/ecasound/default.nix b/pkgs/applications/audio/ecasound/default.nix
index 108be8726c50e..f23b11d1a67e4 100644
--- a/pkgs/applications/audio/ecasound/default.nix
+++ b/pkgs/applications/audio/ecasound/default.nix
@@ -60,7 +60,7 @@ stdenv.mkDerivation rec {
   strictDeps = true;
 
   CXXFLAGS = "-std=c++11";
-  configureFlags = "--enable-liblilv --with-extra-cppflags=-Dnullptr=0";
+  configureFlags = [ "--enable-liblilv" "--with-extra-cppflags=-Dnullptr=0" ];
 
   postPatch = ''
     sed -i -e '
diff --git a/pkgs/applications/audio/jamin/default.nix b/pkgs/applications/audio/jamin/default.nix
index 2bd23b821f135..70cb4d7f11094 100644
--- a/pkgs/applications/audio/jamin/default.nix
+++ b/pkgs/applications/audio/jamin/default.nix
@@ -15,6 +15,12 @@ stdenv.mkDerivation rec {
   buildInputs = [ fftwFloat gtk2 ladspaPlugins libjack2 liblo libxml2 ]
     ++ (with perlPackages; [ perl XMLParser ]);
 
+  # Workaround build failure on -fno-common toolchains like upstream
+  # gcc-10. Otherwise build fails as:
+  #     ld: jamin-preferences.o:/build/jamin-0.95.0/src/hdeq.h:64: multiple definition of
+  #       `l_notebook1'; jamin-callbacks.o:/build/jamin-0.95.0/src/hdeq.h:64: first defined here
+  NIX_CFLAGS_COMPILE = "-fcommon";
+
   NIX_LDFLAGS = "-ldl";
 
   postInstall = ''
diff --git a/pkgs/applications/audio/musikcube/default.nix b/pkgs/applications/audio/musikcube/default.nix
index 0557ee2e676e7..0894a6410d889 100644
--- a/pkgs/applications/audio/musikcube/default.nix
+++ b/pkgs/applications/audio/musikcube/default.nix
@@ -60,11 +60,11 @@ stdenv.mkDerivation rec {
     libmicrohttpd
     ncurses
     taglib
-  ] ++ lib.optional systemdSupport [
+  ] ++ lib.optionals systemdSupport [
     systemd
-  ] ++ lib.optional stdenv.isLinux [
+  ] ++ lib.optionals stdenv.isLinux [
     alsa-lib pulseaudio
-  ] ++ lib.optional stdenv.isDarwin [
+  ] ++ lib.optionals stdenv.isDarwin [
     Cocoa SystemConfiguration
   ];
 
diff --git a/pkgs/applications/audio/noisetorch/default.nix b/pkgs/applications/audio/noisetorch/default.nix
index d08991a916bd2..067263032b0df 100644
--- a/pkgs/applications/audio/noisetorch/default.nix
+++ b/pkgs/applications/audio/noisetorch/default.nix
@@ -33,6 +33,8 @@ buildGoModule rec {
   '';
 
   meta = with lib; {
+    insecure = true;
+    knownVulnerabilities = [ "https://github.com/lawl/NoiseTorch/releases/tag/0.11.6" ];
     description = "Virtual microphone device with noise supression for PulseAudio";
     homepage = "https://github.com/lawl/NoiseTorch";
     license = licenses.gpl3Plus;
diff --git a/pkgs/applications/audio/ympd/default.nix b/pkgs/applications/audio/ympd/default.nix
index 38c05276be4b7..218204d690a16 100644
--- a/pkgs/applications/audio/ympd/default.nix
+++ b/pkgs/applications/audio/ympd/default.nix
@@ -18,11 +18,18 @@ stdenv.mkDerivation rec {
     sha256 = "1nvb19jd556v2h2bi7w4dcl507p3p8xvjkqfzrcsy7ccy3502brq";
   };
 
+  # Workaround build failure on -fno-common toolchains like upstream
+  # gcc-10. Otherwise build fails as:
+  #   ld: CMakeFiles/ympd.dir/src/mpd_client.c.o:(.bss+0x0): multiple definition of `mpd';
+  #     CMakeFiles/ympd.dir/src/ympd.c.o:(.bss+0x20): first defined here
+  # Should be fixed by pending https://github.com/notandy/ympd/pull/191 (does not apply as is).
+  NIX_CFLAGS_COMPILE = "-fcommon";
+
   nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [ libmpdclient openssl ];
 
   meta = with lib; {
-    homepage = "https://www.ympd.org";
+    homepage = "https://github.com/notandy/ympd";
     description = "Standalone MPD Web GUI written in C, utilizing Websockets and Bootstrap/JS";
     maintainers = [ maintainers.siddharthist ];
     platforms = platforms.unix;
diff --git a/pkgs/applications/blockchains/alfis/default.nix b/pkgs/applications/blockchains/alfis/default.nix
index d42ee291cf050..8eb52f26cdbaf 100644
--- a/pkgs/applications/blockchains/alfis/default.nix
+++ b/pkgs/applications/blockchains/alfis/default.nix
@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "alfis";
-  version = "0.7.0";
+  version = "0.7.3";
 
   src = fetchFromGitHub {
     owner = "Revertron";
     repo = "Alfis";
     rev = "v${version}";
-    sha256 = "sha256-lamobXaDY+v8NpoI+TuuBO5Cdol9+7VPhdmLEH6sZIo=";
+    sha256 = "sha256-P+usJCzf92WZ46mdaDbej59/RUzmFcMvlYXVe2VpgY0=";
   };
 
-  cargoSha256 = "sha256-C5MCT4EG/lI4s2rVGSm9DgBu43FKpp3iTBbCf7N1jOA=";
+  cargoSha256 = "sha256-N5qHu0sCmIWtDYerWqMlD3qr8QtXLvEC7VqPEvnW2cw=";
 
   checkFlags = [
     # these want internet access, disable them
diff --git a/pkgs/applications/blockchains/nearcore/default.nix b/pkgs/applications/blockchains/nearcore/default.nix
index f9f0bd0c69bfb..264d53fc56a53 100644
--- a/pkgs/applications/blockchains/nearcore/default.nix
+++ b/pkgs/applications/blockchains/nearcore/default.nix
@@ -1,42 +1,60 @@
 { rustPlatform, lib, fetchFromGitHub
-, zlib, elfutils, openssl
-, cmake, python3, pkg-config, protobuf, perl, llvmPackages
+, zlib, openssl
+, pkg-config, protobuf, llvmPackages
 }:
 rustPlatform.buildRustPackage rec {
-  #https://github.com/near/nearcore
   pname = "nearcore";
-  version = "1.25.0";
+  version = "1.26.0";
+
+  # https://github.com/near/nearcore/tags
   src = fetchFromGitHub {
     owner = "near";
     repo = "nearcore";
     # there is also a branch for this version number, so we need to be explicit
     rev = "refs/tags/${version}";
-    sha256 = "sha256-7hiBqJLGIf+kNKJvMQ7KtGZm/SWLY3pT7YDlwbm3HDM=";
+    sha256 = "sha256-N3A+hy5I1/yJ3IN9gDw3m1IZ9qK8LNhn3fuXLMn23bg=";
   };
 
-  cargoSha256 = "sha256-EGv4CibSHL9oTAdWK7d/SOzZWPcEB16hTWlWHjKU4wc=";
+  cargoSha256 = "sha256-g07liit048TSL73wFyDK+eKu33Z6fPJcJ+VeGgTtuS8=";
+
+  postPatch = ''
+    substituteInPlace neard/build.rs \
+      --replace 'get_git_version()?' '"nix:${version}"'
+  '';
+
+  CARGO_PROFILE_RELEASE_CODEGEN_UNITS = "1";
+  CARGO_PROFILE_RELEASE_LTO = "fat";
+  NEAR_RELEASE_BUILD = "release";
+
+  OPENSSL_NO_VENDOR = 1; # we want to link to OpenSSL provided by Nix
 
   # don't build SDK samples that require wasm-enabled rust
-  cargoBuildFlags = [ "-p" "neard" ];
+  buildAndTestSubdir = "neard";
   doCheck = false; # needs network
 
-  buildInputs = [ zlib elfutils openssl ];
+  buildInputs = [
+    zlib
+    openssl
+  ];
+
   nativeBuildInputs = [
-    cmake
-    python3
     pkg-config
     protobuf
-    perl
   ];
 
+  # fat LTO requires ~3.4GB RAM
+  requiredSystemFeatures = [ "big-parallel" ];
+
   LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
   BINDGEN_EXTRA_CLANG_ARGS = "-isystem ${llvmPackages.libclang.lib}/lib/clang/${lib.getVersion llvmPackages.clang}/include";
 
   meta = with lib; {
     description = "Reference client for NEAR Protocol";
     homepage = "https://github.com/near/nearcore";
-    license = licenses.mit;
-    maintainers = with maintainers; [ mic92 ];
-    platforms = platforms.unix;
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ mic92 mikroskeem ];
+    # only x86_64 is supported in nearcore because of sse4+ support, macOS might
+    # be also possible
+    platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/pkgs/applications/emulators/bsnes/ares/default.nix b/pkgs/applications/emulators/bsnes/ares/default.nix
index c1597fe2c6eeb..4cc449ee49f4d 100644
--- a/pkgs/applications/emulators/bsnes/ares/default.nix
+++ b/pkgs/applications/emulators/bsnes/ares/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , fetchFromGitHub
 , pkg-config
+, wrapGAppsHook
 , SDL2
 , alsa-lib
 , gtk3
@@ -18,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ares";
-  version = "127";
+  version = "128";
 
   src = fetchFromGitHub {
     owner = "ares-emulator";
     repo = "ares";
     rev = "v${version}";
-    sha256 = "0rhq39w41j9yr1fkyfmf4n6fjxnq1cglj98rp4wys12kwqv7smvx";
+    sha256 = "sha256-Ojf1kyColBK0S3DwXjGaAZSl0ljhgiXkfKC11BL2fEc=";
   };
 
   patches = [
@@ -34,6 +35,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     pkg-config
+    wrapGAppsHook
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/emulators/bsnes/bsnes-hd/default.nix b/pkgs/applications/emulators/bsnes/bsnes-hd/default.nix
index 6494185958c29..edb397a49d366 100644
--- a/pkgs/applications/emulators/bsnes/bsnes-hd/default.nix
+++ b/pkgs/applications/emulators/bsnes/bsnes-hd/default.nix
@@ -1,9 +1,10 @@
 { lib, stdenv, fetchFromGitHub
 , pkg-config
+, wrapGAppsHook
 , libX11, libXv
 , udev
 , SDL2
-, gtk2, gtksourceview
+, gtk3, gtksourceview3
 , alsa-lib, libao, openal, libpulseaudio
 , libicns, Cocoa, OpenAL
 }:
@@ -34,16 +35,23 @@ stdenv.mkDerivation {
     ./macos-copy-app-to-prefix.patch
   ];
 
-  nativeBuildInputs = [ pkg-config ]
+  nativeBuildInputs = [ pkg-config wrapGAppsHook ]
     ++ lib.optionals stdenv.isDarwin [ libicns ];
 
   buildInputs = [ SDL2 libao ]
-    ++ lib.optionals stdenv.isLinux [ libX11 libXv udev gtk2 gtksourceview alsa-lib openal libpulseaudio ]
+    ++ lib.optionals stdenv.isLinux [ libX11 libXv udev gtk3 gtksourceview3 alsa-lib openal libpulseaudio ]
     ++ lib.optionals stdenv.isDarwin [ Cocoa OpenAL ];
 
   enableParallelBuilding = true;
 
-  makeFlags = [ "-C" "bsnes" "prefix=$(out)" ];
+  makeFlags = [ "-C" "bsnes" "hiro=gtk3" "prefix=$(out)" ];
+
+  # https://github.com/bsnes-emu/bsnes/issues/107
+  preFixup = ''
+    gappsWrapperArgs+=(
+      --prefix GDK_BACKEND : x11
+    )
+  '';
 
   meta = with lib; {
     description = "A fork of bsnes that adds HD video features";
@@ -51,5 +59,6 @@ stdenv.mkDerivation {
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ stevebob ];
     platforms = platforms.unix;
+    mainProgram = "bsnes";
   };
 }
diff --git a/pkgs/applications/graphics/drawio/headless.nix b/pkgs/applications/graphics/drawio/headless.nix
new file mode 100644
index 0000000000000..c70511fa6528c
--- /dev/null
+++ b/pkgs/applications/graphics/drawio/headless.nix
@@ -0,0 +1,36 @@
+{ lib, writeTextFile, runtimeShell, drawio, xvfb-run }:
+
+writeTextFile {
+  name = "${drawio.pname}-headless-${drawio.version}";
+
+  executable = true;
+  destination = "/bin/drawio";
+  text = ''
+    #!${runtimeShell}
+
+    # Electron really wants a configuration directory to not die with:
+    # "Error: Failed to get 'appData' path"
+    # so we give it some temp dir as XDG_CONFIG_HOME
+    tmpdir=$(mktemp -d)
+
+    function cleanup {
+      rm -rf "$tmpdir"
+    }
+    trap cleanup EXIT
+
+    # Drawio needs to run in a virtual X session, because Electron
+    # refuses to work and dies with an unhelpful error message otherwise:
+    # "The futex facility returned an unexpected error code."
+    XDG_CONFIG_HOME="$tmpdir" ${xvfb-run}/bin/xvfb-run ${drawio}/bin/drawio $@
+  '';
+
+  meta = with lib; {
+    description = "xvfb wrapper around drawio";
+    longDescription = ''
+      A wrapper around drawio for running in headless environments.
+      Runs drawio under xvfb-run, with configuration going to a temporary
+      directory.
+    '';
+    maintainers = with maintainers; [ qyliss tfc ];
+  };
+}
diff --git a/pkgs/applications/graphics/grafx2/default.nix b/pkgs/applications/graphics/grafx2/default.nix
index df570008b0f76..48e97e7dbb3b9 100644
--- a/pkgs/applications/graphics/grafx2/default.nix
+++ b/pkgs/applications/graphics/grafx2/default.nix
@@ -15,6 +15,12 @@ stdenv.mkDerivation rec {
 
   preBuild = "cd src";
 
+  # Workaround build failure on -fno-common toolchains like upstream
+  # gcc-10. Otherwise build fails as:
+  #   ld: ../obj/unix/tiles.o:/build/grafx2/src/global.h:306: multiple definition of
+  #     `Main_selector'; ../obj/unix/main.o:/build/grafx2/src/global.h:306: first defined here
+  NIX_CFLAGS_COMPILE = "-fcommon";
+
   preInstall = '' mkdir -p "$out" '';
 
   installPhase = ''make install prefix="$out"'';
diff --git a/pkgs/applications/misc/bottles/default.nix b/pkgs/applications/misc/bottles/default.nix
index 8af7fe1cf9a24..bff4e724f61e0 100644
--- a/pkgs/applications/misc/bottles/default.nix
+++ b/pkgs/applications/misc/bottles/default.nix
@@ -20,13 +20,13 @@ let
 in
 python3Packages.buildPythonApplication rec {
   pname = "bottles";
-  version = "2022.5.2-trento-2";
+  version = "2022.5.14-trento-1";
 
   src = fetchFromGitHub {
     owner = "bottlesdevs";
     repo = pname;
     rev = version;
-    sha256 = "sha256-ufK+h4nblnftyIaRSq43H/q3VSquf1DnD6Z+iuPTJBE=";
+    sha256 = "sha256-w5nSMJnt4WO1KOJvdjM1TYSOvPnogERgQWp1JVr3TZY=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/misc/gpg-mdp/default.nix b/pkgs/applications/misc/gpg-mdp/default.nix
index 48c7c7724ebfb..08ab2a5b7d9f6 100644
--- a/pkgs/applications/misc/gpg-mdp/default.nix
+++ b/pkgs/applications/misc/gpg-mdp/default.nix
@@ -1,4 +1,4 @@
-{ fetchurl, lib, stdenv, ncurses, gnupg }:
+{ fetchurl, fetchpatch, lib, stdenv, ncurses, gnupg }:
 
 let version = "0.7.4";
 in stdenv.mkDerivation {
@@ -14,6 +14,15 @@ in stdenv.mkDerivation {
     url = "https://tamentis.com/projects/mdp/files/mdp-${version}.tar.gz";
     sha256 = "04mdnx4ccpxf9m2myy9nvpl9ma4jgzmv9bkrzv2b9affzss3r34g";
   };
+  patches = [
+    # Pull fix pending upstream inclusion for -fno-common toolchain support:
+    #   https://github.com/tamentis/mdp/pull/9
+    (fetchpatch {
+      name = "fno-common.patch";
+      url = "https://github.com/tamentis/mdp/commit/95c77de3beb96dc7c76ff36d3f3dfb18411d7c54.patch";
+      sha256 = "1j6yvjzkx31b758yav4arhlm5ig7phl8mgx4fcwj7lm2pfvzwcsz";
+    })
+  ];
   buildInputs = [ ncurses ];
   prePatch = ''
     substituteInPlace ./configure \
diff --git a/pkgs/applications/misc/octoprint/default.nix b/pkgs/applications/misc/octoprint/default.nix
index dbdc15cb9c7a5..41841c58795e0 100644
--- a/pkgs/applications/misc/octoprint/default.nix
+++ b/pkgs/applications/misc/octoprint/default.nix
@@ -74,13 +74,13 @@ let
           self: super: {
             octoprint = self.buildPythonPackage rec {
               pname = "OctoPrint";
-              version = "1.8.0rc5";
+              version = "1.8.0";
 
               src = fetchFromGitHub {
                 owner = "OctoPrint";
                 repo = "OctoPrint";
                 rev = version;
-                sha256 = "sha256-FeT45w6VXaFV4BsuOMk58nxxiu9jhCNnA2F7Uh/3sB0=";
+                sha256 = "sha256-GDKXHLigMAork+KAFOs8znNhaTYVTWVB2Tb+4sAqF8o=";
               };
 
               propagatedBuildInputs = with super; [
diff --git a/pkgs/applications/misc/tpmmanager/default.nix b/pkgs/applications/misc/tpmmanager/default.nix
index a94363f4600cf..4523168314aef 100644
--- a/pkgs/applications/misc/tpmmanager/default.nix
+++ b/pkgs/applications/misc/tpmmanager/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, qt4, qmake4Hook, trousers }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, qtbase, qmake, wrapQtAppsHook, trousers }:
 
 stdenv.mkDerivation rec {
   version = "0.8.1";
@@ -8,12 +8,24 @@ stdenv.mkDerivation rec {
     owner = "Rohde-Schwarz";
     repo = "TPMManager";
     rev = "v${version}";
-    sha256 = "sha256-JKYG+I/tZ+0NDmHcIgKV6eGrjbPvPQKPo0sE/zBlLY4=";
+    sha256 = "sha256-UZYn4ssbvLpdB0DssT7MXqQZCu1KkLf/Bsb45Rvgm+E=";
   };
 
-  nativeBuildInputs = [ qmake4Hook ];
+  patches = [
+    # build with Qt5
+    (fetchpatch {
+      url = "https://github.com/Rohde-Schwarz/TPMManager/commit/f62c0f2de2097af9b504c80d6193818e6e4ca84f.patch";
+      sha256 = "sha256-gMhDNN2UkX2lJf/oJEzOkCvF6+EGdIj9xwtXb1rCeys=";
+    })
+    (fetchpatch {
+      url = "https://github.com/Rohde-Schwarz/TPMManager/commit/c287a841ac6b057ed35799949211866b9f533561.patch";
+      sha256 = "sha256-2ZyUml8Q9bKQLVZWr18AzLt8VYLICXH9VDeq6B5Xfto=";
+    })
+  ];
 
-  buildInputs = [ qt4 trousers ];
+  nativeBuildInputs = [ qmake wrapQtAppsHook ];
+
+  buildInputs = [ qtbase trousers ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/applications/misc/zettlr/default.nix b/pkgs/applications/misc/zettlr/default.nix
index 21ac3a908d317..bd9e5a87bf9bb 100644
--- a/pkgs/applications/misc/zettlr/default.nix
+++ b/pkgs/applications/misc/zettlr/default.nix
@@ -8,11 +8,11 @@
 # Based on https://gist.github.com/msteen/96cb7df66a359b827497c5269ccbbf94 and joplin-desktop nixpkgs.
 let
   pname = "zettlr";
-  version = "2.2.5";
+  version = "2.2.6";
   name = "${pname}-${version}";
   src = fetchurl {
     url = "https://github.com/Zettlr/Zettlr/releases/download/v${version}/Zettlr-${version}-x86_64.appimage";
-    sha256 = "sha256-KP3lt0CweT1f/BR3IpnjwCqNvhFbrpz9KLg6K8OMs+I=";
+    sha256 = "sha256-f01WLxp8fe7y2EwTUhpPqcRuWBs/9lMaAAOdybmHB5M=";
   };
   appimageContents = appimageTools.extractType2 {
     inherit name src;
diff --git a/pkgs/applications/networking/cluster/krane/Gemfile.lock b/pkgs/applications/networking/cluster/krane/Gemfile.lock
index ba7e5bb0a633f..e886f40c8a57d 100644
--- a/pkgs/applications/networking/cluster/krane/Gemfile.lock
+++ b/pkgs/applications/networking/cluster/krane/Gemfile.lock
@@ -1,7 +1,7 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    activesupport (7.0.2.3)
+    activesupport (7.0.3)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 1.6, < 2)
       minitest (>= 5.1)
@@ -60,7 +60,7 @@ GEM
       ffi-compiler (>= 1.0, < 2.0)
     i18n (1.10.0)
       concurrent-ruby (~> 1.0)
-    jsonpath (1.1.1)
+    jsonpath (1.1.2)
       multi_json
     jwt (2.3.0)
     krane (2.4.6)
diff --git a/pkgs/applications/networking/cluster/krane/gemset.nix b/pkgs/applications/networking/cluster/krane/gemset.nix
index 058910072a783..3c18789c09530 100644
--- a/pkgs/applications/networking/cluster/krane/gemset.nix
+++ b/pkgs/applications/networking/cluster/krane/gemset.nix
@@ -5,10 +5,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1jpydd414j0fig3r0f6ci67mchclg6cq2qgqbq9zplrbg40pzfi8";
+      sha256 = "0z05zyc57f8ywvdvls6nx93vrhyyzzpgz729mwampz1qb8vvcspj";
       type = "gem";
     };
-    version = "7.0.2.3";
+    version = "7.0.3";
   };
   addressable = {
     dependencies = ["public_suffix"];
@@ -276,10 +276,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0slr38w21gwizkq4nk6c7l7lcqc2c733zfn5fq1pmbwy5bwiggad";
+      sha256 = "0fkdjic88hh0accp0sbx5mcrr9yaqwampf5c3214212d4i614138";
       type = "gem";
     };
-    version = "1.1.1";
+    version = "1.1.2";
   };
   jwt = {
     groups = ["default"];
diff --git a/pkgs/applications/networking/cluster/temporal-cli/default.nix b/pkgs/applications/networking/cluster/temporal-cli/default.nix
new file mode 100644
index 0000000000000..49d64283ca0f0
--- /dev/null
+++ b/pkgs/applications/networking/cluster/temporal-cli/default.nix
@@ -0,0 +1,38 @@
+{ lib, fetchFromGitHub, fetchpatch, buildGoModule, testers, temporal-cli }:
+
+buildGoModule rec {
+  pname = "temporal-cli";
+  version = "1.16.1";
+
+  src = fetchFromGitHub {
+    owner = "temporalio";
+    repo = "tctl";
+    rev = "v${version}";
+    sha256 = "sha256-WNdu/62/VmxTmzAvzx3zIlcAAlEmpN0yKzQOSUtrL8s=";
+  };
+
+  patches = [
+    # Fix tests
+    (fetchpatch {
+      name = "fix-tests.patch";
+      url = "https://github.com/temporalio/tctl/pull/203/commits/2b113da137a3a925e8fbd7c18bdaaefc31397db4.patch";
+      sha256 = "sha256-HFPwbmLZ2uPHzaHvYoB4MTZvMVyzvUKggA76/bh50DQ=";
+    })
+  ];
+
+  vendorSha256 = "sha256-WF3T+HNisfR0JoKkHCC77kmHmsGZ9NfQ7UCwOmpCG/o=";
+
+  ldflags = [ "-s" "-w" ];
+
+  passthru.tests.version = testers.testVersion {
+    package = temporal-cli;
+  };
+
+  meta = with lib; {
+    description = "Temporal CLI";
+    homepage = "https://temporal.io";
+    license = licenses.mit;
+    maintainers = with maintainers; [ aaronjheng ];
+    mainProgram = "tctl";
+  };
+}
diff --git a/pkgs/applications/networking/cluster/terraform/default.nix b/pkgs/applications/networking/cluster/terraform/default.nix
index b4191bbd78c80..399f20fd5c1b1 100644
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@@ -63,10 +63,11 @@ let
           kalbasit
           marsam
           maxeaubrey
-          techknowlogick
           timstott
+          zimbatm
           zowoq
-        ] ++ teams.numtide.members;
+          techknowlogick
+        ];
       };
     } // attrs');
 
@@ -191,9 +192,9 @@ rec {
   };
 
   terraform_1 = mkTerraform {
-    version = "1.1.9";
-    sha256 = "sha256-6dyP3Y5cK+/qLoC2QPZW3QNgqOeVXegC06Pa7pSv1iE=";
-    vendorSha256 = "sha256-YI/KeoOIxgCAS3Q6SXaW8my0PyFD+pyksshQEAknsz4=";
+    version = "1.2.0";
+    sha256 = "sha256-5um+zS7MVL59SlxchjXdlhBGNdacbQgvg7BRAWnW5XU=";
+    vendorSha256 = "sha256-6x1cv+DKXH2yyMjIA6JY5EkTmWbwH4LBammXKtw2EZo=";
     patches = [ ./provider-path-0_15.patch ];
     passthru = { inherit plugins; };
   };
diff --git a/pkgs/applications/networking/cluster/waypoint/default.nix b/pkgs/applications/networking/cluster/waypoint/default.nix
index df0ae08eede4f..038ab2c2bf7f4 100644
--- a/pkgs/applications/networking/cluster/waypoint/default.nix
+++ b/pkgs/applications/networking/cluster/waypoint/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "waypoint";
-  version = "0.8.1";
+  version = "0.8.2";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-NRR/N61QdBF4jaioF7+X3xOdvaJ8COEzXL4hVHYSqW4=";
+    sha256 = "sha256-Pq1gGXROPHHMaOoQwx6cObvMF+SoilOROR4bwI0Y/GM=";
   };
 
-  vendorSha256 = "sha256-57/MzO5TulGKMkGdQRoFNKIKF7upJiPazF0+Ovt/LG8=";
+  vendorSha256 = "sha256-Q8ookgQwecRuSrnQiIREBMDxK9NAWfHu+sIQeMO/T4w=";
 
   nativeBuildInputs = [ go-bindata installShellFiles ];
 
diff --git a/pkgs/applications/networking/flexget/default.nix b/pkgs/applications/networking/flexget/default.nix
index d74378378b968..b50c05fd180f4 100644
--- a/pkgs/applications/networking/flexget/default.nix
+++ b/pkgs/applications/networking/flexget/default.nix
@@ -5,14 +5,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "flexget";
-  version = "3.3.9";
+  version = "3.3.10";
 
   # Fetch from GitHub in order to use `requirements.in`
   src = fetchFromGitHub {
     owner = "flexget";
     repo = "flexget";
     rev = "refs/tags/v${version}";
-    hash = "sha256-29V22B1Nkgj/qc6uyAOSOZ1rrjjtf75I9Eycu8I5ysQ=";
+    hash = "sha256-ESUkGHUVToM5rxpEa0zMo/LxWfPgovkNqDU5IAqQBZg=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/networking/instant-messengers/deltachat-cursed/default.nix b/pkgs/applications/networking/instant-messengers/deltachat-cursed/default.nix
index 442a6adcb790a..0b692104a4fa0 100644
--- a/pkgs/applications/networking/instant-messengers/deltachat-cursed/default.nix
+++ b/pkgs/applications/networking/instant-messengers/deltachat-cursed/default.nix
@@ -1,9 +1,6 @@
 { lib
 , python3
 , fetchFromGitHub
-, wrapGAppsHook
-, gobject-introspection
-, libnotify
 }:
 
 python3.pkgs.buildPythonApplication rec {
@@ -19,29 +16,16 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = [
     python3.pkgs.setuptools-scm
-    wrapGAppsHook
   ];
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
 
-  buildInputs = [
-    gobject-introspection
-    libnotify
-  ];
-
   propagatedBuildInputs = with python3.pkgs; [
     deltachat
     notify-py
-    pygobject3
     urwid-readline
   ];
 
-  dontWrapGApps = true;
-
-  preFixup = ''
-    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
-  '';
-
   doCheck = false; # no tests implemented
 
   meta = with lib; {
diff --git a/pkgs/applications/networking/mujmap/default.nix b/pkgs/applications/networking/mujmap/default.nix
new file mode 100644
index 0000000000000..247a8d589547b
--- /dev/null
+++ b/pkgs/applications/networking/mujmap/default.nix
@@ -0,0 +1,33 @@
+{ lib
+, fetchFromGitHub
+, rustPlatform
+, notmuch
+, stdenv
+, Security
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "mujmap";
+  version = "0.1.1";
+
+  src = fetchFromGitHub {
+    owner = "elizagamedev";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-O5CbLgs+MkATPtess0gocgPB9kwD8FMR/urwm6jo2rA=";
+  };
+
+  cargoSha256 = "sha256-nOZ+HnzXhVp+tLrNMZO1NmZIhIqlWz0fRMbHVIQkOxI=";
+
+  buildInputs = [
+    notmuch
+  ] ++ lib.optional stdenv.isDarwin Security;
+
+  meta = with lib; {
+    description = "Bridge for synchronizing email and tags between JMAP and notmuch";
+    homepage = "https://github.com/elizagamedev/mujmap/";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ elizagamedev ];
+    mainProgram = "mujmap";
+  };
+}
diff --git a/pkgs/applications/science/logic/alt-ergo/default.nix b/pkgs/applications/science/logic/alt-ergo/default.nix
index 096a648b4ddf0..0767c58bdea1e 100644
--- a/pkgs/applications/science/logic/alt-ergo/default.nix
+++ b/pkgs/applications/science/logic/alt-ergo/default.nix
@@ -17,7 +17,7 @@ in
 let alt-ergo-lib = ocamlPackages.buildDunePackage rec {
   pname = "alt-ergo-lib";
   inherit version src useDune2;
-  configureFlags = pname;
+  configureFlags = [ pname ];
   nativeBuildInputs = [ which ];
   buildInputs = with ocamlPackages; [ dune-configurator ];
   propagatedBuildInputs = with ocamlPackages; [ num ocplib-simplex stdlib-shims zarith ];
@@ -26,7 +26,7 @@ let alt-ergo-lib = ocamlPackages.buildDunePackage rec {
 let alt-ergo-parsers = ocamlPackages.buildDunePackage rec {
   pname = "alt-ergo-parsers";
   inherit version src useDune2;
-  configureFlags = pname;
+  configureFlags = [ pname ];
   nativeBuildInputs = [ which ocamlPackages.menhir ];
   propagatedBuildInputs = [ alt-ergo-lib ] ++ (with ocamlPackages; [ camlzip psmt2-frontend ]);
 }; in
@@ -35,7 +35,7 @@ ocamlPackages.buildDunePackage {
 
   inherit pname version src useDune2;
 
-  configureFlags = pname;
+  configureFlags = [ pname ];
 
   nativeBuildInputs = [ which ocamlPackages.menhir ];
   buildInputs = [ alt-ergo-parsers ocamlPackages.cmdliner ];
diff --git a/pkgs/applications/science/logic/easycrypt/default.nix b/pkgs/applications/science/logic/easycrypt/default.nix
index 5f28ca73c4e73..da4ff212e294b 100644
--- a/pkgs/applications/science/logic/easycrypt/default.nix
+++ b/pkgs/applications/science/logic/easycrypt/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, ocamlPackages, why3 }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, ocamlPackages, why3 }:
 
 stdenv.mkDerivation rec {
   pname = "easycrypt";
@@ -11,6 +11,12 @@ stdenv.mkDerivation rec {
     sha256 = "sha256:09rdwcj70lkamkhd895p284rfpz4bcnsf55mcimhiqncd2a21ml7";
   };
 
+  # Fix build with Why3 1.5
+  patches = fetchpatch {
+    url = "https://github.com/EasyCrypt/easycrypt/commit/d226387432deb7f22738e1d5579346a2cbc9be7a.patch";
+    sha256 = "sha256:1zvxij35fnr3h9b5wdl8ml17aqfx3a39rd4mgwmdvkapbg3pa4lm";
+  };
+
   nativeBuildInputs = with ocamlPackages; [
     dune_3
     findlib
diff --git a/pkgs/applications/science/logic/why3/default.nix b/pkgs/applications/science/logic/why3/default.nix
index 0f3dab8038eeb..8917135b2c88c 100644
--- a/pkgs/applications/science/logic/why3/default.nix
+++ b/pkgs/applications/science/logic/why3/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "why3";
-  version = "1.4.1";
+  version = "1.5.0";
 
   src = fetchurl {
     url = "https://why3.gitlabpages.inria.fr/releases/${pname}-${version}.tar.gz";
-    sha256 = "sha256:1rqyypzlvagrn43ykl0c5wxyvnry5fl1ykn3xcvlzgghk96yq3jq";
+    sha256 = "sha256:0qjh49pyqmg3xi09fn4lyzz23i6h18y9sgc8ayscvx3bwr3vcqhr";
   };
 
   buildInputs = with ocamlPackages; [
diff --git a/pkgs/applications/science/logic/why3/with-provers.nix b/pkgs/applications/science/logic/why3/with-provers.nix
index ae0acb1e525c8..739064bb61698 100644
--- a/pkgs/applications/science/logic/why3/with-provers.nix
+++ b/pkgs/applications/science/logic/why3/with-provers.nix
@@ -27,6 +27,6 @@ stdenv.mkDerivation {
 
   installPhase = ''
     mkdir -p $out/bin
-    makeWrapper ${why3}/bin/why3 $out/bin/why3 --add-flags "--extra-config $out/share/why3/why3.conf"
+    makeWrapper ${why3}/bin/why3 $out/bin/why3 --add-flags "--config $out/share/why3/why3.conf"
   '';
 }
diff --git a/pkgs/applications/science/math/eukleides/default.nix b/pkgs/applications/science/math/eukleides/default.nix
index 0c3ef25909bb2..507fa0815298b 100644
--- a/pkgs/applications/science/math/eukleides/default.nix
+++ b/pkgs/applications/science/math/eukleides/default.nix
@@ -32,6 +32,12 @@ lib.fix (eukleides: stdenv.mkDerivation rec {
       --replace '$(SHARE_DIR)/texmf' "$tex"
   '';
 
+  # Workaround build failure on -fno-common toolchains like upstream
+  # gcc-10. Otherwise build fails as:
+  #   ld: eukleides_build/triangle.o:(.bss+0x28): multiple definition of `A';
+  #     eukleides_build/quadrilateral.o:(.bss+0x18): first defined here
+  NIX_CFLAGS_COMPILE = "-fcommon";
+
   preInstall = ''
     mkdir -p $out/bin
   '';
diff --git a/pkgs/applications/terminal-emulators/kitty/default.nix b/pkgs/applications/terminal-emulators/kitty/default.nix
index 65e15a12cc7a4..efd853b82b421 100644
--- a/pkgs/applications/terminal-emulators/kitty/default.nix
+++ b/pkgs/applications/terminal-emulators/kitty/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, python3Packages, libunistring
-, harfbuzz, fontconfig, pkg-config, ncurses, imagemagick, xsel
+, harfbuzz, fontconfig, pkg-config, ncurses, imagemagick
 , libstartup_notification, libGL, libX11, libXrandr, libXinerama, libXcursor
 , libxkbcommon, libXi, libXext, wayland-protocols, wayland
 , lcms2
@@ -157,7 +157,7 @@ buildPythonApplication rec {
     '' else ''
     cp -r linux-package/{bin,share,lib} $out
     ''}
-    wrapProgram "$out/bin/kitty" --prefix PATH : "$out/bin:${lib.makeBinPath [ imagemagick xsel ncurses.dev ]}"
+    wrapProgram "$out/bin/kitty" --prefix PATH : "$out/bin:${lib.makeBinPath [ imagemagick ncurses.dev ]}"
 
     installShellCompletion --cmd kitty \
       --bash <("$out/bin/kitty" +complete setup bash) \
diff --git a/pkgs/applications/version-management/git-and-tools/git-workspace/default.nix b/pkgs/applications/version-management/git-and-tools/git-workspace/default.nix
index 7783c28927cf9..a0136ba5e4d0f 100644
--- a/pkgs/applications/version-management/git-and-tools/git-workspace/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-workspace/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "git-workspace";
-  version = "0.9.0";
+  version = "1.0.3";
 
   src = fetchFromGitHub {
     owner = "orf";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-uP1sex4Hx57ZsqVG4b3809FzFB10Un48+vbwaWZ7HSg=";
+    sha256 = "sha256-sPvb8EKrr9ZUMV1yMTXkFYgjW+LRJwJAXoc7lrWykaI=";
   };
 
-  cargoSha256 = "sha256-mkrC8uzfNpL0MQUMjcNaJf5c1wSdlBVg8AMgc/zxM6A=";
+  cargoSha256 = "sha256-WAoYFCJCWKFvWN8XyRBZdzjCrcR6jMp8ZztSLHDP+r0=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl ]
diff --git a/pkgs/applications/version-management/git-and-tools/lab/default.nix b/pkgs/applications/version-management/git-and-tools/lab/default.nix
index 8f4acbc3fc430..d73d1d13bde2c 100644
--- a/pkgs/applications/version-management/git-and-tools/lab/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/lab/default.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "lab";
-  version = "0.24.0";
+  version = "0.25.0";
 
   src = fetchFromGitHub {
     owner = "zaquestion";
     repo = "lab";
     rev = "v${version}";
-    sha256 = "sha256-sw00D/PJaLAPHoPdJC2WYUNklIzMbc/bXt2jlQZ7E90=";
+    sha256 = "sha256-7AUhH2aBRpsjUzZQGE2fHDOa1k0rMUfZJqUEKZXpJuM=";
   };
 
   subPackages = [ "." ];
 
-  vendorSha256 = "sha256-FwnVMH//GwFbi+llFF6XNqrZX2hRB4r51p8TRz2vN+g=";
+  vendorSha256 = "sha256-ChysquNuUffcM3qaWUdqu3Av33gnKkdlotEoFKoedA0=";
 
   doCheck = false;
 
diff --git a/pkgs/applications/window-managers/matchbox/default.nix b/pkgs/applications/window-managers/matchbox/default.nix
index 51bb3010d3301..f12ed0ea0a7f5 100644
--- a/pkgs/applications/window-managers/matchbox/default.nix
+++ b/pkgs/applications/window-managers/matchbox/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pkg-config, libmatchbox, libX11, libXext }:
+{ lib, stdenv, fetchurl, fetchpatch, pkg-config, libmatchbox, libX11, libXext }:
 
 stdenv.mkDerivation rec {
   pname = "matchbox";
@@ -13,6 +13,15 @@ stdenv.mkDerivation rec {
     sha256 = "1zyfq438b466ygcz78nvsmnsc5bhg4wcfnpxb43kbkwpyx53m8l1";
   };
 
+  patches = [
+    # Pull upstream fix for -fno-common tollchains:
+    (fetchpatch {
+      name = "fno-common.patch";
+      url = "https://git.yoctoproject.org/matchbox-window-manager/patch/?id=844f61069896fe3f549ab425d731c061028f697c";
+      sha256 = "1md2s7q094hn4gzg21pfyz8d426y07d5rbx2icas9nvc8jj7bwfc";
+    })
+  ];
+
   meta = {
     description = "X window manager for non-desktop embedded systems";
     homepage = "https://www.yoctoproject.org/software-item/matchbox/";
diff --git a/pkgs/applications/window-managers/yeahwm/default.nix b/pkgs/applications/window-managers/yeahwm/default.nix
index 3cf997c22c298..25a25a06ad9ed 100644
--- a/pkgs/applications/window-managers/yeahwm/default.nix
+++ b/pkgs/applications/window-managers/yeahwm/default.nix
@@ -24,6 +24,11 @@ stdenv.mkDerivation rec {
                       prefix="${placeholder "out"}" )
   '';
 
+  # Workaround build failure on -fno-common toolchains like upstream
+  # gcc-10. Otherwise build fails as:
+  #   ld: screen.o:(.bss+0x40): multiple definition of `fg'; client.o:(.bss+0x40): first defined here
+  NIX_CFLAGS_COMPILE = "-fcommon";
+
   postInstall = ''
     gzip -9 --stdout yeahwm.1 > yeahwm.1.gz
     install -m644 yeahwm.1.gz ${placeholder "out"}/share/man/man1/
diff --git a/pkgs/data/themes/mojave/default.nix b/pkgs/data/themes/mojave/default.nix
index 56d7dfcf3752b..e8e98ab0ebfef 100644
--- a/pkgs/data/themes/mojave/default.nix
+++ b/pkgs/data/themes/mojave/default.nix
@@ -16,6 +16,7 @@
 , opacityVariants ? [] # default to all
 , themeVariants ? [] # default to MacOS blue
 , wallpapers ? false
+, gitUpdater
 }:
 
 let
@@ -29,14 +30,14 @@ lib.checkListOfEnum "${pname}: theme variants" [ "default" "blue" "purple" "pink
 
 stdenv.mkDerivation rec {
   inherit pname;
-  version = "unstable-2021-12-20";
+  version = "2022-05-12";
 
   srcs = [
     (fetchFromGitHub {
       owner = "vinceliuice";
       repo = pname;
-      rev = "c148646ccab382f7a2d5fdc421fc32d843cb4172";
-      sha256 = "sha256-h4MSSh8cu9M81bM+WJSyl1SQ7CVth1DvjIVOUJXqpxs";
+      rev = version;
+      sha256 = "sha256-VrrxW16J+S21qBoAeVCWs0Q6bRL1jXAK7MOBpdSMJZY=";
     })
   ]
   ++
@@ -114,6 +115,8 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
+  passthru.updateScript = gitUpdater {inherit pname version; };
+
   meta = with lib; {
     description = "Mac OSX Mojave like theme for GTK based desktop environments";
     homepage = "https://github.com/vinceliuice/Mojave-gtk-theme";
diff --git a/pkgs/development/compilers/ccl/default.nix b/pkgs/development/compilers/ccl/default.nix
index 79e7d324ec94d..761ae5ba01975 100644
--- a/pkgs/development/compilers/ccl/default.nix
+++ b/pkgs/development/compilers/ccl/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, runCommand, bootstrap_cmds, coreutils, glibc, m4, runtimeShell }:
+{ lib, stdenv, fetchurl, fetchpatch, runCommand, bootstrap_cmds, coreutils, glibc, m4, runtimeShell }:
 
 let
   options = rec {
@@ -59,6 +59,21 @@ stdenv.mkDerivation rec {
     sha256 = cfg.sha256;
   };
 
+  patches = [
+    # Pull upstream fiux for -fno-common toolchains:
+    #  https://github.com/Clozure/ccl/pull/316
+    (fetchpatch {
+      name = "fno-common-p1.patch";
+      url = "https://github.com/Clozure/ccl/commit/185dc1a00e7492f8be98e5f93b561758423595f1.patch";
+      sha256 = "0wqfds7346qdwdsxz3bl2p601ib94rdp9nknj7igj01q8lqfpajw";
+    })
+    (fetchpatch {
+      name = "fno-common-p2.patch";
+      url = "https://github.com/Clozure/ccl/commit/997de91062d1f152d0c3b322a1e3694243e4a403.patch";
+      sha256 = "10w6zw8wgalkdyya4m48lgca4p9wgcp1h44hy9wqr94dzlllq0f6";
+    })
+  ];
+
   buildInputs = if stdenv.isDarwin then [ bootstrap_cmds m4 ] else [ glibc m4 ];
 
   CCL_RUNTIME = cfg.runtime;
diff --git a/pkgs/development/compilers/jasmin-compiler/default.nix b/pkgs/development/compilers/jasmin-compiler/default.nix
index dbacda5c4798a..140de42451928 100644
--- a/pkgs/development/compilers/jasmin-compiler/default.nix
+++ b/pkgs/development/compilers/jasmin-compiler/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "jasmin-compiler";
-  version = "21.0";
+  version = "2022.04.0";
 
   src = fetchurl {
     url = "https://github.com/jasmin-lang/jasmin/releases/download/v${version}/jasmin-compiler-v${version}.tar.bz2";
-    sha256 = "sha256:1px17fpc00gca5ayfcr4k008srkyw120c25rnyf7cgzfs1gpylj2";
+    sha256 = "sha256:0yf3lp469m8jdpqmqq3sw3h8l3psrzdp134wp3l1q31j3akskn2s";
   };
 
   sourceRoot = "jasmin-compiler-v${version}/compiler";
diff --git a/pkgs/development/compilers/yap/default.nix b/pkgs/development/compilers/yap/default.nix
index 4428d4dbba654..10ba3c559015a 100644
--- a/pkgs/development/compilers/yap/default.nix
+++ b/pkgs/development/compilers/yap/default.nix
@@ -13,7 +13,11 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--enable-tabling=yes" ];
 
-  NIX_CFLAGS_COMPILE = "-fpermissive";
+  # -fcommon: workaround build failure on -fno-common toolchains like upstream
+  # gcc-10. Otherwise build fails as:
+  #   ld: libYap.a(pl-dtoa.o):/build/yap-6.3.3/H/pl-yap.h:230: multiple definition of `ATOM_';
+  #     libYap.a(pl-buffer.o):/build/yap-6.3.3/H/pl-yap.h:230: first defined here
+  NIX_CFLAGS_COMPILE = "-fpermissive -fcommon";
 
   meta = {
     homepage = "http://www.dcc.fc.up.pt/~vsc/Yap/";
diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix
index 109ab8b9fe8ff..49087791002ca 100644
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@@ -176,6 +176,15 @@ self: super: {
   vector = doJailbreak (if pkgs.stdenv.isi686 then appendConfigureFlag "--ghc-options=-msse2" super.vector else super.vector);
 
   inline-c-cpp = overrideCabal (drv: {
+    patches = drv.patches or [] ++ [
+      (fetchpatch {
+        # awaiting release >0.5.0.0
+        url = "https://github.com/fpco/inline-c/commit/e176b8e8c3c94e7d8289a8b7cc4ce8e737741730.patch";
+        name = "inline-c-cpp-pr-132-1.patch";
+        sha256 = "sha256-CdZXAT3Ar4KKDGyAUu8A7hzddKe5/AuMKoZSjt3o0UE=";
+        stripLen = 1;
+      })
+    ];
     postPatch = (drv.postPatch or "") + ''
       substituteInPlace inline-c-cpp.cabal --replace "-optc-std=c++11" ""
     '';
diff --git a/pkgs/development/haskell-modules/configuration-ghcjs.nix b/pkgs/development/haskell-modules/configuration-ghcjs.nix
index c6e0e6a2c053d..bab115ce64178 100644
--- a/pkgs/development/haskell-modules/configuration-ghcjs.nix
+++ b/pkgs/development/haskell-modules/configuration-ghcjs.nix
@@ -25,7 +25,7 @@ self: super:
   # GHCJS does not ship with the same core packages as GHC.
   # https://github.com/ghcjs/ghcjs/issues/676
   stm = doJailbreak self.stm_2_5_0_2;
-  exceptions = dontCheck self.exceptions_0_10_4;
+  exceptions = dontCheck self.exceptions_0_10_5;
 
 ## OTHER PACKAGES
 
diff --git a/pkgs/development/interpreters/spidermonkey/91.nix b/pkgs/development/interpreters/spidermonkey/91.nix
index c1e647deb7057..f1f5c7bb56a07 100644
--- a/pkgs/development/interpreters/spidermonkey/91.nix
+++ b/pkgs/development/interpreters/spidermonkey/91.nix
@@ -19,11 +19,11 @@
 
 stdenv.mkDerivation rec {
   pname = "spidermonkey";
-  version = "91.8.0";
+  version = "91.9.0";
 
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}esr/source/firefox-${version}esr.source.tar.xz";
-    sha512 = "edea2c7d4d3d0322091b20b623019ef041090d9f89f33c8e3140f66a54624261f278257393db70d2038154de8ee02da0bee6ecf85c281f3558338da71fc173c3";
+    sha512 = "fd69d489429052013d2c1b8b766a47920ecee62f0688505758f593b27ae66d6343b9107163749406251aedebdf836147e4d562415a811b04d7ab2ae31e32f133";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/cpp-ipfs-api/default.nix b/pkgs/development/libraries/cpp-ipfs-api/default.nix
deleted file mode 100644
index 315a477e72ad1..0000000000000
--- a/pkgs/development/libraries/cpp-ipfs-api/default.nix
+++ /dev/null
@@ -1,28 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, curl, cmake, nlohmann_json }:
-
-stdenv.mkDerivation {
-  pname = "cpp-ipfs-api";
-  version = "2017-01-04";
-
-  src = fetchFromGitHub {
-    owner = "vasild";
-    repo = "cpp-ipfs-api";
-    rev = "96a890f4518665a56581a2a52311eaa65928eac8";
-    sha256 = "1z6gbd7npg4pd9wmdyzcp9h12sg84d7a43c69pp4lzqkyqg8pz1g";
-  };
-
-  nativeBuildInputs = [ cmake ];
-  buildInputs = [ curl ];
-  propagatedBuildInputs = [ nlohmann_json ];
-
-  NIX_CFLAGS_COMPILE = [
-    "-Wno-error=range-loop-construct"
-  ];
-
-  meta = with lib; {
-    description = "IPFS C++ API client library";
-    homepage = "https://github.com/vasild/cpp-ipfs-api";
-    license = licenses.mit;
-    platforms = platforms.all;
-  };
-}
diff --git a/pkgs/development/libraries/cpp-ipfs-http-client/default.nix b/pkgs/development/libraries/cpp-ipfs-http-client/default.nix
new file mode 100644
index 0000000000000..44fcbe5463cb0
--- /dev/null
+++ b/pkgs/development/libraries/cpp-ipfs-http-client/default.nix
@@ -0,0 +1,35 @@
+{ lib, stdenv, fetchFromGitHub, curl, cmake, nlohmann_json }:
+
+stdenv.mkDerivation {
+  pname = "cpp-ipfs-http-client";
+  version = "unstable-2022-01-30";
+
+  src = fetchFromGitHub {
+    owner = "vasild";
+    repo = "cpp-ipfs-http-client";
+    rev = "3cdfa7fc6326e49fc81b3c7ca43ce83bdccef6d9";
+    sha256 = "sha256-/oyafnk4SbrvoCh90wkZXNBjknMKA6EEUoEGo/amLUo=";
+  };
+
+  patches = [ ./unvendor-nlohmann-json.patch ];
+
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace '# Fetch "JSON for Modern C++"' "include_directories(${nlohmann_json}/include)"
+  '';
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ curl ];
+  propagatedBuildInputs = [ nlohmann_json ];
+
+  NIX_CFLAGS_COMPILE = [
+    "-Wno-error=range-loop-construct"
+  ];
+
+  meta = with lib; {
+    description = "IPFS C++ API client library";
+    homepage = "https://github.com/vasild/cpp-ipfs-http-client";
+    license = licenses.mit;
+    platforms = [ "x86_64-linux" "x86_64-darwin" ];
+  };
+}
diff --git a/pkgs/development/libraries/cpp-ipfs-http-client/unvendor-nlohmann-json.patch b/pkgs/development/libraries/cpp-ipfs-http-client/unvendor-nlohmann-json.patch
new file mode 100644
index 0000000000000..e21b4e9a7a71d
--- /dev/null
+++ b/pkgs/development/libraries/cpp-ipfs-http-client/unvendor-nlohmann-json.patch
@@ -0,0 +1,27 @@
+--- source/CMakeLists.txt
++++ source/CMakeLists.txt
+@@ -56,11 +56,6 @@ target_include_directories(${IPFS_API_LIBNAME}
+ )
+ 
+ # Fetch "JSON for Modern C++"
+-include(FetchContent)
+-message(STATUS "Fetching nlohmann/JSON")
+-# Retrieve Nlohmann JSON
+-FetchContent_Declare(json URL https://github.com/nlohmann/json/releases/download/v3.10.5/json.tar.xz)
+-FetchContent_MakeAvailable(json)
+ 
+ # libcurl requires additional libs only for static Windows builds
+ if(WIN32)
+@@ -71,12 +66,11 @@ set_target_properties(${IPFS_API_LIBNAME} PROPERTIES
+   SOVERSION ${PROJECT_VERSION_MAJOR}
+   VERSION ${PROJECT_VERSION}
+ )
+-target_link_libraries(${IPFS_API_LIBNAME} ${CURL_LIBRARIES} ${WINDOWS_CURL_LIBS} nlohmann_json::nlohmann_json)
++target_link_libraries(${IPFS_API_LIBNAME} ${CURL_LIBRARIES} ${WINDOWS_CURL_LIBS})
+ if(NOT DISABLE_INSTALL)
+   install(TARGETS ${IPFS_API_LIBNAME} DESTINATION lib)
+   install(FILES include/ipfs/client.h DESTINATION include/ipfs)
+   install(FILES include/ipfs/http/transport.h DESTINATION include/ipfs/http)
+-  install(FILES ${json_SOURCE_DIR}/include/nlohmann/json.hpp DESTINATION include/nlohmann)
+ endif()
+ # Tests, use "CTEST_OUTPUT_ON_FAILURE=1 make test" to see output from failed tests
diff --git a/pkgs/development/libraries/kde-frameworks/kimageformats.nix b/pkgs/development/libraries/kde-frameworks/kimageformats.nix
index 86026bf50f457..cbdaf1da892d0 100644
--- a/pkgs/development/libraries/kde-frameworks/kimageformats.nix
+++ b/pkgs/development/libraries/kde-frameworks/kimageformats.nix
@@ -1,7 +1,7 @@
 {
   mkDerivation, lib,
   extra-cmake-modules,
-  ilmbase, karchive, openexr, libavif, qtbase
+  ilmbase, karchive, openexr, libavif, libheif, qtbase
 }:
 
 let inherit (lib) getDev; in
@@ -10,9 +10,12 @@ mkDerivation {
   pname = "kimageformats";
 
   nativeBuildInputs = [ extra-cmake-modules ];
-  buildInputs = [ karchive openexr libavif qtbase ];
+  buildInputs = [ karchive openexr libavif libheif qtbase ];
   outputs = [ "out" ]; # plugins only
   CXXFLAGS = "-I${getDev ilmbase}/include/OpenEXR";
+  cmakeFlags = [
+    "-DKIMAGEFORMATS_HEIF=ON"
+  ];
 
   meta = with lib; {
     broken = versionOlder qtbase.version "5.14";
diff --git a/pkgs/development/libraries/libdeltachat/default.nix b/pkgs/development/libraries/libdeltachat/default.nix
index 462434f9839e0..2e12c3261667b 100644
--- a/pkgs/development/libraries/libdeltachat/default.nix
+++ b/pkgs/development/libraries/libdeltachat/default.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libdeltachat";
-  version = "1.80.0";
+  version = "1.82.0";
 
   src = fetchFromGitHub {
     owner = "deltachat";
     repo = "deltachat-core-rust";
     rev = version;
-    hash = "sha256-4b2tf7QmLQ5ltnkxUGCwA1TZSQRoyKaRGcxBxbSKDaE=";
+    hash = "sha256-cc5DFQucG1b+1QN0HTJLKAfCF3UvRunL07d4WdT6368=";
   };
 
   patches = [
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-t1/xztmiuJMqNkIe7cBzO7MaZQb6GtnIX5wxEpC+IFo=";
+    hash = "sha256-WYjTpHTYJGqvsUI8De6+tGgjYY1nKqPyfKP9IdZfrNY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libwpe/default.nix b/pkgs/development/libraries/libwpe/default.nix
index 66de5847d78e1..18134f18d9924 100644
--- a/pkgs/development/libraries/libwpe/default.nix
+++ b/pkgs/development/libraries/libwpe/default.nix
@@ -6,7 +6,9 @@
 , libxkbcommon
 , libGL
 , ninja
-, libX11 }:
+, libX11
+, webkitgtk
+}:
 
 stdenv.mkDerivation rec {
   pname = "libwpe";
@@ -33,7 +35,7 @@ stdenv.mkDerivation rec {
     description = "General-purpose library for WPE WebKit";
     license = licenses.bsd2;
     homepage = "https://wpewebkit.org";
-    maintainers = with maintainers; [ matthewbauer ];
+    maintainers = webkitgtk.meta.maintainers ++ (with maintainers; [ matthewbauer ]);
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/development/libraries/libwpe/fdo.nix b/pkgs/development/libraries/libwpe/fdo.nix
index a711fab631435..df6a57d2d7f78 100644
--- a/pkgs/development/libraries/libwpe/fdo.nix
+++ b/pkgs/development/libraries/libwpe/fdo.nix
@@ -10,7 +10,9 @@
 , libwpe
 , libxkbcommon
 , libGL
-, libX11 }:
+, libX11
+, webkitgtk
+ }:
 
 stdenv.mkDerivation rec {
   pname = "wpebackend-fdo";
@@ -46,7 +48,7 @@ stdenv.mkDerivation rec {
     description = "Freedesktop.org backend for WPE WebKit";
     license = licenses.bsd2;
     homepage = "https://wpewebkit.org";
-    maintainers = with maintainers; [ matthewbauer ];
+    maintainers = webkitgtk.meta.maintainers ++ (with maintainers; [ matthewbauer ]);
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/development/libraries/precice/default.nix b/pkgs/development/libraries/precice/default.nix
index e700a5f9f11b2..60c026b360049 100644
--- a/pkgs/development/libraries/precice/default.nix
+++ b/pkgs/development/libraries/precice/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "precice";
-  version = "2.3.0";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "precice";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256:0p8d2xf4bl41b30yp38sqyp4fipwgcdhl0khxcv5g69fxvz2i2il";
+    sha256 = "0qmwdxpbmy4dvjxav3dls18qns734j0yfvxvjrh1nnkk36qhfp3q";
   };
 
   cmakeFlags = [
diff --git a/pkgs/development/libraries/rtrlib/default.nix b/pkgs/development/libraries/rtrlib/default.nix
new file mode 100644
index 0000000000000..bb0aec308ae83
--- /dev/null
+++ b/pkgs/development/libraries/rtrlib/default.nix
@@ -0,0 +1,24 @@
+{ lib, fetchFromGitHub, stdenv, cmake, libssh, openssl }:
+
+stdenv.mkDerivation rec {
+  pname = "rtrlib";
+  version = "0.8.0";
+
+  src = fetchFromGitHub {
+    repo = pname;
+    owner = "rtrlib";
+    rev = "v${version}";
+    sha256 = "sha256-ISb4ojcDvXY/88GbFMrA5V5+SGE6CmE5D+pokDTwotQ=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ libssh openssl ];
+
+  meta = with lib; {
+    description = "An open-source C implementation of the RPKI/Router Protocol client";
+    homepage = "https://github.com/rtrlib/rtrlib";
+    license = licenses.mit;
+    maintainers = with maintainers; [ Anillc ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/development/libraries/ucommon/default.nix b/pkgs/development/libraries/ucommon/default.nix
index 7306243bca9d3..2ecf7729f4bfe 100644
--- a/pkgs/development/libraries/ucommon/default.nix
+++ b/pkgs/development/libraries/ucommon/default.nix
@@ -20,6 +20,9 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config ];
 
+  # use C++14 Standard until error handling code gets updated upstream
+  CXXFLAGS = [ "-std=c++14" ];
+
   # disable flaky networking test
   postPatch = ''
     substituteInPlace test/stream.cpp \
diff --git a/pkgs/development/libraries/webkitgtk/default.nix b/pkgs/development/libraries/webkitgtk/default.nix
index 2359625a4f7c5..d111ee8ed0bf1 100644
--- a/pkgs/development/libraries/webkitgtk/default.nix
+++ b/pkgs/development/libraries/webkitgtk/default.nix
@@ -19,6 +19,8 @@
 , gtk3
 , wayland
 , libwebp
+, libwpe
+, libwpe-fdo
 , enchant2
 , xorg
 , libxkbcommon
@@ -65,7 +67,7 @@
 
 stdenv.mkDerivation rec {
   pname = "webkitgtk";
-  version = "2.36.1";
+  version = "2.36.2";
 
   outputs = [ "out" "dev" ];
 
@@ -73,7 +75,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://webkitgtk.org/releases/${pname}-${version}.tar.xz";
-    sha256 = "sha256-AUnqX7HSDyqZgWd9RclSoEczAAHqJKjcKQNSOfEsDI8=";
+    sha256 = "/pO920oCwONvkm77boHSiv0oi4gk9sXPanXPQCKOAI4=";
   };
 
   patches = lib.optionals stdenv.isLinux [
@@ -82,7 +84,15 @@ stdenv.mkDerivation rec {
       inherit (builtins) storeDir;
       inherit (addOpenGLRunpath) driverLink;
     })
+
     ./libglvnd-headers.patch
+
+    # Hardcode path to WPE backend
+    # https://github.com/NixOS/nixpkgs/issues/110468
+    (substituteAll {
+      src = ./fdo-backend-path.patch;
+      wpebackend_fdo = libwpe-fdo;
+    })
   ];
 
   preConfigure = lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
@@ -160,6 +170,8 @@ stdenv.mkDerivation rec {
     libseccomp
     libmanette
     wayland
+    libwpe
+    libwpe-fdo
     xdg-dbus-proxy
   ] ++ lib.optionals systemdSupport [
     systemd
@@ -180,7 +192,6 @@ stdenv.mkDerivation rec {
     "-DENABLE_INTROSPECTION=ON"
     "-DPORT=GTK"
     "-DUSE_LIBHYPHEN=OFF"
-    "-DUSE_WPE_RENDERER=OFF"
     "-DUSE_SOUP2=${cmakeBool (lib.versions.major libsoup.version == "2")}"
     "-DUSE_LIBSECRET=${cmakeBool withLibsecret}"
   ] ++ lib.optionals stdenv.isDarwin [
diff --git a/pkgs/development/libraries/webkitgtk/fdo-backend-path.patch b/pkgs/development/libraries/webkitgtk/fdo-backend-path.patch
new file mode 100644
index 0000000000000..9ddef67f1c1de
--- /dev/null
+++ b/pkgs/development/libraries/webkitgtk/fdo-backend-path.patch
@@ -0,0 +1,11 @@
+--- a/Source/WebKit/UIProcess/glib/WebProcessPoolGLib.cpp
++++ b/Source/WebKit/UIProcess/glib/WebProcessPoolGLib.cpp
+@@ -89,7 +89,7 @@
+ #if PLATFORM(WAYLAND)
+     if (WebCore::PlatformDisplay::sharedDisplay().type() == WebCore::PlatformDisplay::Type::Wayland) {
+ #if USE(WPE_RENDERER)
+-        wpe_loader_init("libWPEBackend-fdo-1.0.so.1");
++        wpe_loader_init("@wpebackend_fdo@/lib/libWPEBackend-fdo-1.0.so.1");
+         if (AcceleratedBackingStoreWayland::checkRequirements()) {
+             parameters.hostClientFileDescriptor = IPC::Attachment(UnixFileDescriptor(wpe_renderer_host_create_client(), UnixFileDescriptor::Adopt));
+             parameters.implementationLibraryName = FileSystem::fileSystemRepresentation(String::fromLatin1(wpe_loader_get_loaded_implementation_library_name()));
diff --git a/pkgs/development/ocaml-modules/genspio/default.nix b/pkgs/development/ocaml-modules/genspio/default.nix
index 963cd1dab138a..44742cba04ab8 100644
--- a/pkgs/development/ocaml-modules/genspio/default.nix
+++ b/pkgs/development/ocaml-modules/genspio/default.nix
@@ -1,27 +1,19 @@
 { lib, fetchFromGitHub, buildDunePackage
-, nonstd, sosa
+, base, fmt
 }:
 
 buildDunePackage rec {
   pname = "genspio";
-  version = "0.0.2";
-
-  useDune2 = false;
+  version = "0.0.3";
 
   src = fetchFromGitHub {
     owner = "hammerlab";
     repo = pname;
     rev = "${pname}.${version}";
-    sha256 = "0cp6p1f713sfv4p2r03bzvjvakzn4ili7hf3a952b3w1k39hv37x";
+    sha256 = "sha256:1788cnn10idp5i1hggg4pys7k0w8m3h2p4xa42jipfg4cpj7shaf";
   };
 
-  minimalOCamlVersion = "4.03";
-
-  propagatedBuildInputs = [ nonstd sosa ];
-
-  configurePhase = ''
-    ocaml please.mlt configure
-  '';
+  propagatedBuildInputs = [ base fmt ];
 
   doCheck = true;
 
diff --git a/pkgs/development/ocaml-modules/lwt/default.nix b/pkgs/development/ocaml-modules/lwt/default.nix
index 5f1059395ab22..6afc65e386ed6 100644
--- a/pkgs/development/ocaml-modules/lwt/default.nix
+++ b/pkgs/development/ocaml-modules/lwt/default.nix
@@ -8,15 +8,13 @@ let inherit (lib) optional versionOlder; in
 
 buildDunePackage rec {
   pname = "lwt";
-  version = "5.4.1";
-
-  useDune2 = true;
+  version = "5.5.0";
 
   src = fetchFromGitHub {
     owner = "ocsigen";
     repo = "lwt";
     rev = version;
-    sha256 = "sha256-XpoRKcdNo2j05Gxm5wmKSdwqimFDSWvmLyooPYTHAjM=";
+    sha256 = "sha256:1jbjz2rsz3j56k8vh5qlmm87hhkr250bs2m3dvpy9vsri8rkzj9z";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/ocaml-modules/stdcompat/default.nix b/pkgs/development/ocaml-modules/stdcompat/default.nix
index eae9b264ba1fa..3630be368e556 100644
--- a/pkgs/development/ocaml-modules/stdcompat/default.nix
+++ b/pkgs/development/ocaml-modules/stdcompat/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   # build fails otherwise
   enableParallelBuilding = false;
 
-  configureFlags = "--libdir=$(OCAMLFIND_DESTDIR)";
+  configureFlags = [ "--libdir=$(OCAMLFIND_DESTDIR)" ];
 
   meta = {
     homepage = "https://github.com/thierry-martinez/stdcompat";
diff --git a/pkgs/development/python-modules/aioesphomeapi/default.nix b/pkgs/development/python-modules/aioesphomeapi/default.nix
index 06389d50677b7..9d6d3f2d56d87 100644
--- a/pkgs/development/python-modules/aioesphomeapi/default.nix
+++ b/pkgs/development/python-modules/aioesphomeapi/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "aioesphomeapi";
-  version = "10.8.2";
+  version = "10.10.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "esphome";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-zvilMBx9H2VDmu13IiAiCqXEGkbpAJpGnt4Ea7FlGVI=";
+    sha256 = "sha256-j1YYzyOLuH+COBDXJUpkUx8H2K8F5tC5LB8ysZKi6oI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/ansible/core.nix b/pkgs/development/python-modules/ansible/core.nix
index 49ae39feba7b9..e1e198ce17916 100644
--- a/pkgs/development/python-modules/ansible/core.nix
+++ b/pkgs/development/python-modules/ansible/core.nix
@@ -24,11 +24,11 @@
 
 buildPythonPackage rec {
   pname = "ansible-core";
-  version = "2.12.5";
+  version = "2.13.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-HMyZRPEBMxra0e1A1axmqBSRMwUq402wJnp0qnO+67M=";
+    sha256 = "sha256-COD7SnGNlnplTnDNpXz5MgGGkyndHPW4pCZ8V8XEyNM=";
   };
 
   # ansible_connection is already wrapped, so don't pass it through
diff --git a/pkgs/development/python-modules/ansible/default.nix b/pkgs/development/python-modules/ansible/default.nix
index 2e44fa4e243c7..6ca283a6e40ee 100644
--- a/pkgs/development/python-modules/ansible/default.nix
+++ b/pkgs/development/python-modules/ansible/default.nix
@@ -20,7 +20,7 @@
 
 let
   pname = "ansible";
-  version = "5.7.1";
+  version = "5.8.0";
 in
 buildPythonPackage {
   inherit pname version;
@@ -30,7 +30,7 @@ buildPythonPackage {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-kKCaNFENGU1jVWiVoiWonkqLdIua4hW1XlF6N94GOmE=";
+    sha256 = "sha256-+gVkdiAfQGJfs22VxQQe9GOIC+GL5cc7mYtXtAGWeGM=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/azure-mgmt-servicelinker/default.nix b/pkgs/development/python-modules/azure-mgmt-servicelinker/default.nix
index 55f4d9284923d..f574b32286c41 100644
--- a/pkgs/development/python-modules/azure-mgmt-servicelinker/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-servicelinker/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-servicelinker";
-  version = "1.0.0";
+  version = "1.1.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-lAjgwEa2TJDEUU8pwfwkU8EyA1bhLkcAv++I6WHb7Xs=";
+    sha256 = "sha256-QVw6Y9HachwBRwCbF0cSGLCAkSJtNnXBvsj5YX1TmJU=";
     extension = "zip";
   };
 
diff --git a/pkgs/development/python-modules/catboost/default.nix b/pkgs/development/python-modules/catboost/default.nix
index 8c5184240f624..6cda5a23aee95 100644
--- a/pkgs/development/python-modules/catboost/default.nix
+++ b/pkgs/development/python-modules/catboost/default.nix
@@ -52,5 +52,7 @@ buildPythonPackage rec {
     platforms = [ "x86_64-linux" ];
     homepage = "https://catboost.ai";
     maintainers = with maintainers; [ PlushBeaver ];
+    # _catboost.pyx.cpp:226822:19: error: use of undeclared identifier '_PyGen_Send'
+    broken = withCuda;
   };
 }
diff --git a/pkgs/development/python-modules/deepdiff/default.nix b/pkgs/development/python-modules/deepdiff/default.nix
index cba0ac56396e0..c0519332342ea 100644
--- a/pkgs/development/python-modules/deepdiff/default.nix
+++ b/pkgs/development/python-modules/deepdiff/default.nix
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "seperman";
     repo = "deepdiff";
     rev = "v${version}";
-    hash = "sha256-0UBx7sH2iMrLVl5FtHNTwoecLHi8GbInn75G3FSg4gk=";
+    hash = "sha256-7eagu6lef5bc/4KU3y067LFOGtH6whda1ocBuRHS/kI=";
   };
 
   postPatch = ''
@@ -49,11 +49,6 @@ buildPythonPackage rec {
     pyyaml
   ];
 
-  disabledTests = [
-    # Assertion issue with the decimal places
-    "test_get_numeric_types_distance"
-  ];
-
   meta = with lib; {
     description = "Deep Difference and Search of any Python object/data";
     homepage = "https://github.com/seperman/deepdiff";
diff --git a/pkgs/development/python-modules/dropbox/default.nix b/pkgs/development/python-modules/dropbox/default.nix
index 4184ddb125024..e321c110a6bd4 100644
--- a/pkgs/development/python-modules/dropbox/default.nix
+++ b/pkgs/development/python-modules/dropbox/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "dropbox";
-  version = "11.30.0";
+  version = "11.31.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -22,8 +22,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "dropbox";
     repo = "dropbox-sdk-python";
-    rev = "v${version}";
-    hash = "sha256-w07r95MBAClf0F3SICiZsHLdslzf+JuxC+BVdTACCog=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-mbBVivrpXYNuVbXeHRyy07LxPbtYvaL3JleK7QXOxi0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/dulwich/default.nix b/pkgs/development/python-modules/dulwich/default.nix
index b10d29a594345..ea3511e843a33 100644
--- a/pkgs/development/python-modules/dulwich/default.nix
+++ b/pkgs/development/python-modules/dulwich/default.nix
@@ -17,7 +17,7 @@
 }:
 
 buildPythonPackage rec {
-  version = "0.20.38";
+  version = "0.20.40";
   pname = "dulwich";
   format = "setuptools";
 
@@ -25,7 +25,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-c0Z5DYc1yG+7xbcLZ08O+UCWweUJm6cnNJFigjmBf8g=";
+    hash = "sha256-vtcO/gt91RpHvOqbmEqwamdddDi3izLaHLr891D7utc=";
   };
 
   LC_ALL = "en_US.UTF-8";
diff --git a/pkgs/development/python-modules/ecs-logging/default.nix b/pkgs/development/python-modules/ecs-logging/default.nix
index f82149ac86769..01298469f8dd1 100644
--- a/pkgs/development/python-modules/ecs-logging/default.nix
+++ b/pkgs/development/python-modules/ecs-logging/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "ecs-logging";
-  version = "1.1.0";
+  version = "2.0.0";
   format = "flit";
 
   disabled = pythonOlder "3.8";
@@ -16,8 +16,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "elastic";
     repo = "ecs-logging-python";
-    rev = version;
-    sha256 = "sha256-UcQh/+K2d4tiMZaz4IAZ2w/B88vEkHoq2LCPMNZ95Mo=";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-2BfZ96D24sfjFD6l+gjp6xXbSJ0kjQD/FhHLI3bpVGM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/fastavro/default.nix b/pkgs/development/python-modules/fastavro/default.nix
index 419cb74c2cf7e..e4d1bca573098 100644
--- a/pkgs/development/python-modules/fastavro/default.nix
+++ b/pkgs/development/python-modules/fastavro/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "fastavro";
-  version = "1.4.11";
+  version = "1.4.12";
 
   disabled = pythonOlder "3.6";
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "refs/tags/${version}";
-    sha256 = "sha256-PK8+NFJurJ0nD5coEFj8lXWg4VMcpX0954qDb1GW6Gk=";
+    sha256 = "sha256-t3SM7pTsl3JLWeJSESzXGONyjufwCHMaqK95JI3isYY=";
   };
 
   preBuild = ''
diff --git a/pkgs/development/python-modules/gcsfs/default.nix b/pkgs/development/python-modules/gcsfs/default.nix
index 518226f34dd2d..82791db5bcc46 100644
--- a/pkgs/development/python-modules/gcsfs/default.nix
+++ b/pkgs/development/python-modules/gcsfs/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "gcsfs";
-  version = "2022.01.0";
+  version = "2022.3.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "fsspec";
     repo = pname;
     rev = version;
-    hash = "sha256-wNeK1GdjK9GKaaECcFeBLjFf/h3MbLI5e4MX0UNoTqE=";
+    hash = "sha256-+Bchwsa8Jj7WBWbzyH+GQuqZki4EltMryumKt4Pm1es=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/lxmf/default.nix b/pkgs/development/python-modules/lxmf/default.nix
index c6044844a62f6..8ae981cc1f1a8 100644
--- a/pkgs/development/python-modules/lxmf/default.nix
+++ b/pkgs/development/python-modules/lxmf/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "lxmf";
-  version = "0.1.5";
+  version = "0.1.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "markqvist";
     repo = "lxmf";
     rev = "refs/tags/${version}";
-    hash = "sha256-9JG/EnL7vW4P7QiT6Xa0GLfmu1JeM0dlFSp3VRE47NI=";
+    hash = "sha256-n7ZEXz+jFokjqQJf8feDE6wuN2kI3xB0z+guUhGse3o=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/mox/default.nix b/pkgs/development/python-modules/mox/default.nix
index 380dbe594a5a9..bd7fc589a7aa4 100644
--- a/pkgs/development/python-modules/mox/default.nix
+++ b/pkgs/development/python-modules/mox/default.nix
@@ -1,24 +1,41 @@
 { lib
 , buildPythonPackage
-, fetchurl
+, fetchFromGitHub
+, pytestCheckHook
+, pythonOlder
+, six
 }:
 
 buildPythonPackage rec {
   pname = "mox";
-  version = "0.5.3";
+  version = "0.7.8";
+  format = "setuptools";
 
-  src = fetchurl {
-    url = "http://pymox.googlecode.com/files/${pname}-${version}.tar.gz";
-    sha256 = "4d18a4577d14da13d032be21cbdfceed302171c275b72adaa4c5997d589a5030";
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "ivancrneto";
+    repo = "pymox";
+    rev = "v${version}";
+    hash = "sha256-gODE9IGDk3WtO8iPOlp98fGp6Ih2laA3YlOHmq62m8Y=";
   };
 
-  # error: invalid command 'test'
-  doCheck = false;
+  propagatedBuildInputs = [
+    six
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "mox"
+  ];
 
   meta = with lib; {
-    homepage = "https://pymox.readthedocs.io/";
-    description = "A mock object framework for Python";
+    description = "Mock object framework";
+    homepage = "https://github.com/ivancrneto/pymox";
     license = licenses.asl20;
+    maintainers = with maintainers; [ ];
   };
-
 }
diff --git a/pkgs/development/python-modules/nomadnet/default.nix b/pkgs/development/python-modules/nomadnet/default.nix
index 4505c33a696bd..ef7083980af5f 100644
--- a/pkgs/development/python-modules/nomadnet/default.nix
+++ b/pkgs/development/python-modules/nomadnet/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "nomadnet";
-  version = "0.1.7";
+  version = "0.1.8";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "markqvist";
     repo = "NomadNet";
     rev = version;
-    hash = "sha256-WJpcV6+cnK1525lbYvkWqrGasioph72nuoNV4oWxVK0=";
+    hash = "sha256-gqUCE35RPt7k0RAoZGJS1srB5K4v6gJkbTKQs8Lajm8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/peaqevcore/default.nix b/pkgs/development/python-modules/peaqevcore/default.nix
index 4b11263017dd4..956a91cd5b7a2 100644
--- a/pkgs/development/python-modules/peaqevcore/default.nix
+++ b/pkgs/development/python-modules/peaqevcore/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "peaqevcore";
-  version = "0.0.23";
+  version = "0.0.24";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-z59TJ+P7WNMcTyevi4etWUFUnBJXAVhDOnO4GXjjuR0=";
+    hash = "sha256-rAC0NXkK18DmPiZJbqSZh5O0i6KvMpWvaANWyK3zMXQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pex/default.nix b/pkgs/development/python-modules/pex/default.nix
index 214f5f8bf408e..6fba5f820d969 100644
--- a/pkgs/development/python-modules/pex/default.nix
+++ b/pkgs/development/python-modules/pex/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "pex";
-  version = "2.1.88";
+  version = "2.1.89";
   format = "flit";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-lDUmudfs3Py4ytHsEvgnTiMvVQkom9X+uCeZHhTshjc=";
+    hash = "sha256-7/rJe/A6CbkminjFuL+8eIdj0kYzNMKynWX0umAMRAA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/phik/default.nix b/pkgs/development/python-modules/phik/default.nix
index 2919fb5c733a5..2e0dc2b8b2676 100644
--- a/pkgs/development/python-modules/phik/default.nix
+++ b/pkgs/development/python-modules/phik/default.nix
@@ -15,12 +15,14 @@
 , ninja
 , numba
 , pybind11
+, scikit-build
 }:
 
 buildPythonPackage rec {
   pname = "phik";
   version = "0.12.2";
   disabled = !isPy3k;
+  format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
@@ -50,10 +52,13 @@ buildPythonPackage rec {
   nativeBuildInputs = [
     cmake
     ninja
+    scikit-build
   ];
 
+  pythonImportCheck = [ "phik" ];
+
   postInstall = ''
-  rm -r $out/bin
+    rm -r $out/bin
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/pyfzf/default.nix b/pkgs/development/python-modules/pyfzf/default.nix
new file mode 100644
index 0000000000000..3578f863fa483
--- /dev/null
+++ b/pkgs/development/python-modules/pyfzf/default.nix
@@ -0,0 +1,39 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, fzf
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "pyfzf";
+  version = "0.3.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "nk412";
+    repo = pname;
+    rev = version;
+    hash = "sha256-w+ZjQGFd/lR2TiTHc2uQSJXORmzJJZXsr9BO4PIw/Co=";
+  };
+
+  propagatedBuildInputs = [
+    fzf
+  ];
+
+  pythonImportsCheck = [
+    "pyfzf"
+  ];
+
+  # Module has no tests
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Wrapper for fzf";
+    homepage = "https://github.com/nk412/pyfzf";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/pyshark/default.nix b/pkgs/development/python-modules/pyshark/default.nix
index 1bb91953983f2..ded9bcbbc4eda 100644
--- a/pkgs/development/python-modules/pyshark/default.nix
+++ b/pkgs/development/python-modules/pyshark/default.nix
@@ -1,38 +1,53 @@
-{ lib, buildPythonPackage, fetchFromGitHub, py, lxml, pytestCheckHook, wireshark-cli }:
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, lxml
+, packaging
+, py
+, pytestCheckHook
+, pythonOlder
+, wireshark-cli
+}:
 
 buildPythonPackage rec {
   pname = "pyshark";
-  version = "0.4.3";
+  version = "0.4.5";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "KimiNewt";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-cveiFkkSplfQPgUEVWyV40KKHCtKJZsfvdV8JmEUmE4=";
+    # 0.4.5 was the last release which was tagged
+    # https://github.com/KimiNewt/pyshark/issues/541
+    rev = "8f8f13aba6ae716aa0a48175255063fe542fdc3b";
+    hash = "sha256-v9CC9hgTABAiJ0qiFZ/9/zMmHzJXKq3neGtTq/ucnT4=";
   };
 
+  sourceRoot = "${src.name}/src";
+
   propagatedBuildInputs = [
     py
     lxml
+    packaging
   ];
 
-  preConfigure = ''
-    cd src
-  '';
-
-  preCheck = ''
-    cd ..
-  '';
-
   checkInputs = [
     pytestCheckHook
     wireshark-cli
   ];
 
-  pythonImportsCheck = [ "pyshark" ];
+  pythonImportsCheck = [
+    "pyshark"
+  ];
+
+  pytestFlagsArray = [
+    "../tests/"
+  ];
 
   meta = with lib; {
-    description = "Python wrapper for tshark, allowing python packet parsing using wireshark dissectors";
+    description = "Python wrapper for tshark, allowing Python packet parsing using Wireshark dissectors";
     homepage = "https://github.com/KimiNewt/pyshark/";
     license = licenses.mit;
     maintainers = with maintainers; [ petabyteboy ];
diff --git a/pkgs/development/python-modules/pyskyqremote/default.nix b/pkgs/development/python-modules/pyskyqremote/default.nix
index 2a3c7166f0cd3..54365e5900d66 100644
--- a/pkgs/development/python-modules/pyskyqremote/default.nix
+++ b/pkgs/development/python-modules/pyskyqremote/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "pyskyqremote";
-  version = "0.3.7";
+  version = "0.3.9";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "RogerSelwyn";
     repo = "skyq_remote";
     rev = "refs/tags/${version}";
-    sha256 = "sha256-VdoAtY+uZ4M6UNjYplqxx8S11eyKzqypW7IYCXOO2kQ=";
+    sha256 = "sha256-KEeTakVXt8a+SYbSGHOHAJwOa+T99qAIxAbvyMvb54A=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/scikit-build/default.nix b/pkgs/development/python-modules/scikit-build/default.nix
index 17b2ac3556702..4a466fcef06de 100644
--- a/pkgs/development/python-modules/scikit-build/default.nix
+++ b/pkgs/development/python-modules/scikit-build/default.nix
@@ -1,7 +1,6 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, fetchpatch
 , distro
 , packaging
 , python
@@ -24,21 +23,14 @@
 
 buildPythonPackage rec {
   pname = "scikit-build";
-  version = "0.14.1";
+  version = "0.15.0";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-Fwc9g3tWVRvt6Pa++utOuj2UM15ZAjmELjZg8HY6CRo=";
+    sha256 = "sha256-5yPNDzSJoEI3C56piLu5z9dyXoslsgyhx5gYIfz2X7k=";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/scikit-build/scikit-build/commit/59cf7a5b09a71d418947db3c9d487471c4573a24.patch";
-      sha256 = "sha256-oQllX3qzwWwllczXUMObrwndCfvMdS5FulEhbBORAks=";
-    })
-  ];
-
   propagatedBuildInputs = [
     distro
     packaging
diff --git a/pkgs/development/python-modules/slack-sdk/default.nix b/pkgs/development/python-modules/slack-sdk/default.nix
index 7e80ad35c5c5b..b3122653a8403 100644
--- a/pkgs/development/python-modules/slack-sdk/default.nix
+++ b/pkgs/development/python-modules/slack-sdk/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "slack-sdk";
-  version = "3.16.1";
+  version = "3.16.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "slackapi";
     repo = "python-slack-sdk";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-XTt2R0JypbDGJtiWqFzmui7UVLK4/U46co7LcHkSbWo=";
+    sha256 = "sha256-xecmza5Zsv6mJ4SCRl5VnGseKJG1yznBbLZ1tyBSjIE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/starline/default.nix b/pkgs/development/python-modules/starline/default.nix
index 4f4ad545f2df8..ce7418a887342 100644
--- a/pkgs/development/python-modules/starline/default.nix
+++ b/pkgs/development/python-modules/starline/default.nix
@@ -2,23 +2,21 @@
 , buildPythonPackage
 , pythonOlder
 , fetchPypi
-, aiohttp
 , requests
 }:
 
 buildPythonPackage rec {
   pname = "starline";
-  version = "0.1.5";
+  version = "0.2.0";
 
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1753f5fcd2a6976aed775afb03f8392159f040c673917cc0c634510d95c13cb9";
+    sha256 = "550b00ab95cf59d933f7708abab40a4e41e5790e62b653471afe86a3af3320e6";
   };
 
   propagatedBuildInputs = [
-    aiohttp
     requests
   ];
 
diff --git a/pkgs/development/python-modules/ttp-templates/default.nix b/pkgs/development/python-modules/ttp-templates/default.nix
index 46db94782be5c..45548ee21c2ba 100644
--- a/pkgs/development/python-modules/ttp-templates/default.nix
+++ b/pkgs/development/python-modules/ttp-templates/default.nix
@@ -1,11 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, netmiko
-, pytestCheckHook
-, python
 , pythonOlder
-, ttp
 }:
 
 buildPythonPackage rec {
@@ -22,24 +18,14 @@ buildPythonPackage rec {
     hash = "sha256-Qx+z/srYgD67FjXzYrc8xtA99n8shWK7yWj/r/ETN2U=";
   };
 
-  propagatedBuildInputs = [
-    ttp
-  ];
+  postPatch = ''
+    # Drop circular dependency on ttp
+    substituteInPlace setup.py \
+      --replace '"ttp>=0.6.0"' ""
+  '';
 
-  checkInputs = [
-    netmiko
-    pytestCheckHook
-  ];
-
-  pythonImportsCheck = [
-    "ttp_templates"
-  ];
-
-  pytestFlagsArray = [
-    # The other tests requires data which is no part of the source
-    "test/test_ttp_templates_methods.py"
-    "test/test_yang_openconfig_lldp.py"
-  ];
+  # Circular dependency on ttp
+  doCheck = false;
 
   meta = with lib; {
     description = "Template Text Parser Templates collections";
diff --git a/pkgs/development/python-modules/ttp/default.nix b/pkgs/development/python-modules/ttp/default.nix
index 2157af318110c..a484ed9f76ac4 100644
--- a/pkgs/development/python-modules/ttp/default.nix
+++ b/pkgs/development/python-modules/ttp/default.nix
@@ -1,22 +1,20 @@
 { lib
 , buildPythonPackage
-, callPackage
-, fetchFromGitHub
 , cerberus
 , configparser
 , deepdiff
+, fetchFromGitHub
 , geoip2
 , jinja2
+, netmiko
 , openpyxl
-, tabulate
-, yangson
 , pytestCheckHook
 , pyyaml
+, tabulate
+, ttp-templates
+, yangson
 }:
 
-let
-  ttp_templates = callPackage ./templates.nix { };
-in
 buildPythonPackage rec {
   pname = "ttp";
   version = "0.8.4";
@@ -26,7 +24,7 @@ buildPythonPackage rec {
     owner = "dmulyalin";
     repo = pname;
     rev = version;
-    sha256 = "sha256-vuKlddqm8KirqAJyvBPfRb5Nw9zo4Fl1bwbfVMhmH9g=";
+    hash = "sha256-vuKlddqm8KirqAJyvBPfRb5Nw9zo4Fl1bwbfVMhmH9g=";
   };
 
   propagatedBuildInputs = [
@@ -37,7 +35,7 @@ buildPythonPackage rec {
     geoip2
     jinja2
     # n2g unpackaged
-    # netmiko unpackaged
+    netmiko
     # nornir unpackaged
     openpyxl
     tabulate
@@ -51,7 +49,7 @@ buildPythonPackage rec {
   checkInputs = [
     pytestCheckHook
     pyyaml
-    ttp_templates
+    ttp-templates
   ];
 
   disabledTestPaths = [
@@ -87,6 +85,8 @@ buildPythonPackage rec {
     "test_TTP_CACHE_FOLDER_env_variable_usage"
     # requires additional network setup
     "test_child_group_do_not_start_if_no_parent_started"
+    # Assertion Error
+    "test_in_threads_parsing"
   ];
 
   pytestFlagsArray = [
diff --git a/pkgs/development/python-modules/ttp/templates.nix b/pkgs/development/python-modules/ttp/templates.nix
deleted file mode 100644
index 835548d07842e..0000000000000
--- a/pkgs/development/python-modules/ttp/templates.nix
+++ /dev/null
@@ -1,31 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-}:
-
-buildPythonPackage rec {
-  pname = "ttp-templates";
-  version = "0.1.1";
-  format = "setuptools";
-
-  src = fetchPypi {
-    pname = "ttp_templates";
-    inherit version;
-    sha256 = "0vg7k733i8jqnfz8mpq8kzr2l7b7drk29zkzik91029f6w7li007";
-  };
-
-  # drop circular dependency on ttp
-  postPatch = ''
-    substituteInPlace setup.py --replace '"ttp>=0.6.0"' ""
-  '';
-
-  # circular dependency on ttp
-  doCheck = false;
-
-  meta = with lib; {
-    description = "Template Text Parser Templates";
-    homepage = "https://github.com/dmulyalin/ttp_templates";
-    license = licenses.mit;
-    maintainers = with maintainers; [ hexa ];
-  };
-}
diff --git a/pkgs/development/python-modules/uamqp/darwin-azure-c-shared-utility-corefoundation.patch b/pkgs/development/python-modules/uamqp/darwin-azure-c-shared-utility-corefoundation.patch
new file mode 100644
index 0000000000000..ad2186543f3cd
--- /dev/null
+++ b/pkgs/development/python-modules/uamqp/darwin-azure-c-shared-utility-corefoundation.patch
@@ -0,0 +1,37 @@
+From 52ab2095649b5951e6af77f68954209473296983 Mon Sep 17 00:00:00 2001
+From: Sandro <sandro.jaeckel@gmail.com>
+Date: Sat, 16 Jan 2021 15:54:05 +0100
+Subject: [PATCH] Fix finding apple libraries
+
+---
+ CMakeLists.txt | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+ 
+
+(rejected by upstream in https://github.com/Azure/azure-c-shared-utility/pull/499,
+seems problem it's solving is nixpkgs-specific)
+
+diff --git a/src/vendor/azure-uamqp-c/deps/azure-c-shared-utility/CMakeLists.txt b/src/vendor/azure-uamqp-c/deps/azure-c-shared-utility/CMakeLists.txt
+index 7bbfa6f3f..3567b18bc 100644
+--- a/src/vendor/azure-uamqp-c/deps/azure-c-shared-utility/CMakeLists.txt
++++ b/src/vendor/azure-uamqp-c/deps/azure-c-shared-utility/CMakeLists.txt
+@@ -120,8 +120,9 @@ endif()
+ 
+ if(${use_applessl})
+     # MACOSX only has native tls and open ssl, so use the native apple tls
+-    find_library(cf_foundation Foundation)
++    find_library(cf_foundation CoreFoundation)
+     find_library(cf_network CFNetwork)
++    find_library(cf_security Security)
+ endif()
+ 
+ if(${no_logging})
+@@ -581,7 +582,7 @@ endif()
+ 
+ 
+ if(${use_applessl})
+-    set(aziotsharedutil_target_libs ${aziotsharedutil_target_libs} ${cf_foundation} ${cf_network})
++    set(aziotsharedutil_target_libs ${aziotsharedutil_target_libs} ${cf_foundation} ${cf_network} ${cf_security})
+ endif()
+ 
+ if(WIN32)
diff --git a/pkgs/development/python-modules/uamqp/default.nix b/pkgs/development/python-modules/uamqp/default.nix
index a838f44eb9577..61979da58d4c3 100644
--- a/pkgs/development/python-modules/uamqp/default.nix
+++ b/pkgs/development/python-modules/uamqp/default.nix
@@ -23,6 +23,10 @@ buildPythonPackage rec {
     sha256 = "sha256-guhfOMvddC4E+oOmvpeG8GsXEfqLcSHVdtj3w8fF2Vs=";
   };
 
+  patches = lib.optionals (stdenv.isDarwin && stdenv.isx86_64) [
+    ./darwin-azure-c-shared-utility-corefoundation.patch
+  ];
+
   nativeBuildInputs = [
     cmake
   ];
diff --git a/pkgs/development/python-modules/velbus-aio/default.nix b/pkgs/development/python-modules/velbus-aio/default.nix
index efa5a0fc29f8f..84e1bac03044b 100644
--- a/pkgs/development/python-modules/velbus-aio/default.nix
+++ b/pkgs/development/python-modules/velbus-aio/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "velbus-aio";
-  version = "2022.2.4";
+  version = "2022.5.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "Cereal2nd";
     repo = pname;
     rev = version;
-    sha256 = "sha256-oWHyEw1DjMynLPAARcVaqsFccpnTk1/7gpq+8TU95d0=";
+    sha256 = "sha256-XdPrKNUvAHsqw3nv7Ws2zBYDBqEOEeEUHLdB2+f+p+w=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/python-modules/whois/default.nix b/pkgs/development/python-modules/whois/default.nix
index b2875819646c9..7f51e2c61ef37 100644
--- a/pkgs/development/python-modules/whois/default.nix
+++ b/pkgs/development/python-modules/whois/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "whois";
-  version = "0.9.14";
+  version = "0.9.15";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -15,8 +15,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "DannyCork";
     repo = "python-whois";
-    rev = version;
-    sha256 = "1df4r2pr356y1c2ys6pzdl93fmx9ci4y75xphc95xn27zvqbpvix";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-Pfogvo0s678KHO85r4yopEaL4n/2cIY1+CnQu3iB8xc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/analysis/frama-c/default.nix b/pkgs/development/tools/analysis/frama-c/default.nix
index b5ae5055d02d9..0b962a97ef1f4 100644
--- a/pkgs/development/tools/analysis/frama-c/default.nix
+++ b/pkgs/development/tools/analysis/frama-c/default.nix
@@ -4,6 +4,15 @@
 , gdk-pixbuf, wrapGAppsHook
 }:
 
+let why3_1_5 = why3; in
+let why3 = why3_1_5.overrideAttrs (o: rec {
+  version = "1.4.1";
+  src = fetchurl {
+    url = "https://why3.gitlabpages.inria.fr/releases/${o.pname}-${version}.tar.gz";
+    sha256 = "sha256:1rqyypzlvagrn43ykl0c5wxyvnry5fl1ykn3xcvlzgghk96yq3jq";
+  };
+}); in
+
 let
   mkocamlpath = p: "${p}/lib/ocaml/${ocamlPackages.ocaml.version}/site-lib";
   runtimeDeps = with ocamlPackages; [
diff --git a/pkgs/development/tools/analysis/tfsec/default.nix b/pkgs/development/tools/analysis/tfsec/default.nix
index be622e99e9164..0b395deda4119 100644
--- a/pkgs/development/tools/analysis/tfsec/default.nix
+++ b/pkgs/development/tools/analysis/tfsec/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "tfsec";
-  version = "1.21.0";
+  version = "1.21.1";
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-z2RVMPZykz2FUsmn5sQs3fAK/h+cWv+A/56rhOlHkGA=";
+    sha256 = "sha256-+yCRCHTx42wHnGi4jgre9gaa4LNrWjSNQdIONMWCTkc=";
   };
 
   ldflags = [
@@ -21,7 +21,7 @@ buildGoModule rec {
     # "-extldflags '-fno-PIC -static'"
   ];
 
-  vendorSha256 = "sha256-R5sks8mbY3JpKcVl7XBKst/QI8ZWIqXAR3D6/eflV1Q=";
+  vendorSha256 = "sha256-IwHm70BSM1lIWc7MiL0Ye6Y7fGn6GnuELm082wIgtEk=";
 
   subPackages = [
     "cmd/tfsec"
diff --git a/pkgs/development/tools/apkid/default.nix b/pkgs/development/tools/apkid/default.nix
index 2cb1c4e8d00dc..71e1efa052451 100644
--- a/pkgs/development/tools/apkid/default.nix
+++ b/pkgs/development/tools/apkid/default.nix
@@ -5,13 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "apkid";
-  version = "2.1.1";
+  version = "2.1.3";
+  format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "rednaga";
     repo = "APKiD";
     rev = "v${version}";
-    sha256 = "1p6kdjjw2jhwr875445w43k46n6zwpz0l0phkl8d3y1v4gi5l6dx";
+    hash = "sha256-U4CsPTA0fXCzj5iLTbLFGudAvewVCzxe4xl0osoBy5A=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
@@ -28,12 +29,14 @@ python3.pkgs.buildPythonApplication rec {
   '';
 
   postPatch = ''
-    # The next release will have support for later yara-python releases
+    # We have dex support enabled in yara-python
     substituteInPlace setup.py \
-      --replace "yara-python==3.11.0" "yara-python"
+      --replace "yara-python-dex>=1.0.1" "yara-python"
   '';
 
-  pythonImportsCheck = [ "apkid" ];
+  pythonImportsCheck = [
+    "apkid"
+  ];
 
   meta = with lib; {
     description = "Android Application Identifier";
diff --git a/pkgs/development/tools/rust/cargo-deny/default.nix b/pkgs/development/tools/rust/cargo-deny/default.nix
index 8c05a5fc9a035..ed625cb229edf 100644
--- a/pkgs/development/tools/rust/cargo-deny/default.nix
+++ b/pkgs/development/tools/rust/cargo-deny/default.nix
@@ -11,19 +11,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-deny";
-  version = "0.11.4";
+  version = "0.12.1";
 
   src = fetchFromGitHub {
     owner = "EmbarkStudios";
     repo = pname;
     rev = version;
-    sha256 = "sha256-lwVoV+zxJfmWvlt14FFmxPCdKCoojVvRVGS1rq1QF44=";
+    sha256 = "sha256-w64fdjKXiCaM+U28Hte+I0LPqmGKxbCVRUyhNWcVyTc=";
   };
 
   # enable pkg-config feature of zstd
   cargoPatches = [ ./zstd-pkg-config.patch ];
 
-  cargoSha256 = "sha256-I+kpHaCxuNzq8+GdqQEuSdE4aD+/lBccUrSf+XW2OKE=";
+  cargoSha256 = "sha256-K9Ab4L/wnpUqe+gLKhtHX4fOgWXv6ZL9faa58hzdq/0=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/development/tools/rust/rust-analyzer/default.nix b/pkgs/development/tools/rust/rust-analyzer/default.nix
index acacdcefb4150..861a4075990c3 100644
--- a/pkgs/development/tools/rust/rust-analyzer/default.nix
+++ b/pkgs/development/tools/rust/rust-analyzer/default.nix
@@ -1,5 +1,6 @@
 { lib
 , stdenv
+, callPackage
 , fetchFromGitHub
 , rustPlatform
 , CoreServices
@@ -11,14 +12,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rust-analyzer-unwrapped";
-  version = "2022-05-02";
-  cargoSha256 = "sha256-uZCUruIBTNTKYWYb8xQgJ6FsKlRi+Sh5n7m7aVk+hHQ=";
+  version = "2022-05-17";
+  cargoSha256 = "sha256-H0nuS56mvo5YUAUOsEnR4Cv3iFKixoHK83BcM1PFMA8=";
 
   src = fetchFromGitHub {
     owner = "rust-lang";
     repo = "rust-analyzer";
     rev = version;
-    sha256 = "sha256-5kAbd/tTc9vkr27ar44hnpXdS0vQg0OLJUMlp0FBjqA=";
+    sha256 = "sha256-vrVpgQYUuJPgK1NMb1nxlCdxjoYo40YkUbZpH2Z2mwM=";
   };
 
   patches = [
@@ -54,7 +55,11 @@ rustPlatform.buildRustPackage rec {
     runHook postInstallCheck
   '';
 
-  passthru.updateScript = ./update.sh;
+  passthru = {
+    updateScript = ./update.sh;
+    # FIXME: Pass overrided `rust-analyzer` once `buildRustPackage` also implements #119942
+    tests.neovim-lsp = callPackage ./test-neovim-lsp.nix { };
+  };
 
   meta = with lib; {
     description = "A modular compiler frontend for the Rust language";
diff --git a/pkgs/development/tools/rust/rust-analyzer/test-neovim-lsp.nix b/pkgs/development/tools/rust/rust-analyzer/test-neovim-lsp.nix
new file mode 100644
index 0000000000000..6782a7418a68b
--- /dev/null
+++ b/pkgs/development/tools/rust/rust-analyzer/test-neovim-lsp.nix
@@ -0,0 +1,49 @@
+{ runCommandNoCC, cargo, neovim, rust-analyzer, rustc }:
+runCommandNoCC "test-neovim-rust-analyzer" {
+  nativeBuildInputs = [ cargo neovim rust-analyzer rustc ];
+
+  testRustSrc = /* rust */ ''
+    fn main() {
+      let mut var = vec![None];
+      var.push(Some("hello".to_owned()));
+    }
+  '';
+
+  nvimConfig = /* lua */ ''
+    vim.lsp.buf_attach_client(vim.api.nvim_get_current_buf(), vim.lsp.start_client({
+      cmd = { "rust-analyzer" },
+      handlers = {
+        ["$/progress"] = function(_, msg, ctx)
+          if msg.token == "rustAnalyzer/Indexing" and msg.value.kind == "end" then
+            vim.cmd("goto 23") -- let mut |var =...
+            vim.lsp.buf.hover()
+          end
+        end,
+        ["textDocument/hover"] = function(_, msg, ctx)
+          -- Keep newlines.
+          io.write(msg.contents.value)
+          vim.cmd("q")
+        end,
+      },
+      on_error = function(code)
+        print("error: " .. code)
+        vim.cmd("q")
+      end
+    }))
+  '';
+
+} ''
+  # neovim requires a writable HOME.
+  export HOME="$(pwd)"
+
+  cargo new --bin test-rust-analyzer
+  cd test-rust-analyzer
+  cat <<<"$testRustSrc" >src/main.rs
+  cat <<<"$nvimConfig" >script.lua
+
+  # `-u` doesn't work
+  result="$(nvim --headless +'lua dofile("script.lua")' src/main.rs)"
+  echo "$result"
+  [[ "$result" == *"var: Vec<Option<String>>"* ]]
+  touch $out
+''
diff --git a/pkgs/development/tools/treefmt/default.nix b/pkgs/development/tools/treefmt/default.nix
index f9cef54564f8c..2ffbd4a1bed69 100644
--- a/pkgs/development/tools/treefmt/default.nix
+++ b/pkgs/development/tools/treefmt/default.nix
@@ -1,16 +1,16 @@
 { lib, rustPlatform, fetchFromGitHub }:
 rustPlatform.buildRustPackage rec {
   pname = "treefmt";
-  version = "0.3.0";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "numtide";
     repo = "treefmt";
     rev = "v${version}";
-    sha256 = "sha256-PTT87Na4KpyN6a7T49vHHhSqSOF6JSWr5/jiys1Uzko=";
+    hash = "sha256-+EcqrmjZR8pkBiIXpdJ/KfmTm719lgz7oC9tH7OhJKY=";
   };
 
-  cargoSha256 = "sha256-Gvr6Zjd9Gvn2CyjNHlJaKPFYUViPezRwoDBeVelRlkU=";
+  cargoSha256 = "sha256-DXsKUeSmNUIKPsvrLxkg+Kp78rEfjmJQYf2pj1LWW38=";
 
   meta = {
     description = "one CLI to format the code tree";
diff --git a/pkgs/development/web/deno/default.nix b/pkgs/development/web/deno/default.nix
index 4291af81f405c..eff2af506c992 100644
--- a/pkgs/development/web/deno/default.nix
+++ b/pkgs/development/web/deno/default.nix
@@ -16,15 +16,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "deno";
-  version = "1.21.3";
+  version = "1.22.0";
 
   src = fetchFromGitHub {
     owner = "denoland";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-0LjY5XBtR9uoxLOOFRebbSuH9chSdH1/9rtsY15NdCM=";
+    sha256 = "sha256-gragdn3ToOz/We+iVOrX/Fx0g7Zbb7RT5C/2K1+/spc=";
   };
-  cargoSha256 = "sha256-8YldzUO9Jysu0w2NvGWDIr2eIWcrX9ALUodYwIykt64=";
+  cargoSha256 = "sha256-+lNrkOCiC9WT0hbuUBCTaFCsVWJVbp/up2iov3MMt8o=";
 
   postPatch = ''
     # upstream uses lld on aarch64-darwin for faster builds
diff --git a/pkgs/development/web/deno/librusty_v8.nix b/pkgs/development/web/deno/librusty_v8.nix
index e1a9b0de75367..f736120c416a6 100644
--- a/pkgs/development/web/deno/librusty_v8.nix
+++ b/pkgs/development/web/deno/librusty_v8.nix
@@ -11,11 +11,11 @@ let
   };
 in
 fetch_librusty_v8 {
-  version = "0.42.0";
+  version = "0.42.1";
   shas = {
-    x86_64-linux = "sha256-p8wC2r9+PKEabaHj0NF059TBSKOpE+rtZkqk1SXINzQ=";
-    aarch64-linux = "sha256-1mQQ5XmR+WcYW6BGfnUdsG4yzhwIal80Y5fWw4XAJ3g=";
-    x86_64-darwin = "sha256-a5Mu33gXn2X02WRdtO1hb9JRctmFTiCaLNhScz2D0J8=";
-    aarch64-darwin = "sha256-THEFn8nQDktXJlY1zpi2760KAS2eKEQ9O3Y+yqI2OYw=";
+    x86_64-linux = "sha256-rAqIkJ85l5eSojTowVZl5waK/fk00JI4fI1AY1ue/i4=";
+    aarch64-linux = "sha256-uGptQ5V4u6Vz5BI9xmMShB3gnIUjvA/LKeh+kj71XK8=";
+    x86_64-darwin = "sha256-Hcb4Vct9aTv4APJfNpydRY68jpEE3wZVctKhURohz4Y=";
+    aarch64-darwin = "sha256-OSrbI7pX9arCJt8ymRLEARo8admPDHvpDLqf3+iYzVQ=";
   };
 }
diff --git a/pkgs/games/brogue/default.nix b/pkgs/games/brogue/default.nix
index d4f1f8faeeba2..891c9a40ec129 100644
--- a/pkgs/games/brogue/default.nix
+++ b/pkgs/games/brogue/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, SDL, ncurses, libtcod, makeDesktopItem }:
+{ lib, stdenv, fetchurl, fetchpatch, SDL, ncurses, libtcod, makeDesktopItem }:
 
 stdenv.mkDerivation rec {
   pname = "brogue";
@@ -8,6 +8,15 @@ stdenv.mkDerivation rec {
     url = "https://sites.google.com/site/broguegame/brogue-${version}-linux-amd64.tbz2";
     sha256 = "0i042zb3axjf0cpgpdh8hvfn66dbfizidyvw0iymjk2n760z2kx7";
   };
+  patches = [
+    # Pull upstream fix for -fno-common toolchains:
+    #  https://github.com/tmewett/BrogueCE/pull/63
+    (fetchpatch {
+      name = "fno-common.patch";
+      url = "https://github.com/tmewett/BrogueCE/commit/2c7ed0c48d9efd06bf0a2589ba967c0a22a8fa87.patch";
+      sha256 = "19lr2fa25dh79klm4f4kqyyqq7w5xmw9z0fvylkcckqvcv7dwhp3";
+    })
+  ];
 
   prePatch = ''
     sed -i Makefile -e 's,LIBTCODDIR=.*,LIBTCODDIR=${libtcod},g' \
diff --git a/pkgs/games/cl-wordle/default.nix b/pkgs/games/cl-wordle/default.nix
index 1ad3487c3feda..505c5166e42ad 100644
--- a/pkgs/games/cl-wordle/default.nix
+++ b/pkgs/games/cl-wordle/default.nix
@@ -1,15 +1,17 @@
-{ lib, rustPlatform, fetchCrate }:
+{ lib, rustPlatform, fetchFromGitHub }:
 
 rustPlatform.buildRustPackage rec {
   pname = "cl-wordle";
-  version = "0.4.0";
+  version = "0.5.0";
 
-  src = fetchCrate {
-    inherit pname version;
-    sha256 = "sha256-z2XpXgOviBRcberwpxQ4ml1T04k5kMhG7wA0PAYWENg=";
+  src = fetchFromGitHub {
+    owner = "conradludgate";
+    repo = "wordle";
+    rev = "v${version}";
+    sha256 = "sha256-wFTvzAzboUFQg3fauIwIdRChK7rmLES92jK+8ff1D3s=";
   };
 
-  cargoSha256 = "sha256-C7UMkhgez2CtddftARlwN1TjZ1N26NnZfpRiX1KkMEA=";
+  cargoSha256 = "sha256-PtJbLpAUH44alupFY6wX++t/QsKknn5bXvnXzdYsd9o=";
 
   meta = with lib; {
     description = "Wordle TUI in Rust";
diff --git a/pkgs/games/egoboo/default.nix b/pkgs/games/egoboo/default.nix
index 506868efe312f..4023eccec4414 100644
--- a/pkgs/games/egoboo/default.nix
+++ b/pkgs/games/egoboo/default.nix
@@ -45,6 +45,11 @@ stdenv.mkDerivation rec {
     '';
   */
 
+  # Workaround build failure on -fno-common toolchains like upstream
+  # gcc-10. Otherwise build fails as:
+  #   ld: mad.o:(.bss+0x233800): multiple definition of `tile_dict'; camera.o:(.bss+0x140): first defined here
+  NIX_CFLAGS_COMPILE = "-fcommon";
+
   NIX_LDFLAGS = "-lm";
 
   meta = {
diff --git a/pkgs/misc/wiki-tui/default.nix b/pkgs/misc/wiki-tui/default.nix
index 1c954de3822e3..cc98cf46d0788 100644
--- a/pkgs/misc/wiki-tui/default.nix
+++ b/pkgs/misc/wiki-tui/default.nix
@@ -2,20 +2,20 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wiki-tui";
-  version = "0.4.7";
+  version = "0.4.8";
 
   src = fetchFromGitHub {
     owner = "Builditluc";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-qoj5rg0YeBWQuU/HU84wOSG9y9p4Q1DFbqsh61mYnUc=";
+    sha256 = "sha256-/u0segKHrrtXfEjOmpnQ/iFbsM+VfsZKTpyc1IfuOU8=";
   };
 
   buildInputs = [ ncurses openssl ] ++ lib.optional stdenv.isDarwin Security;
 
   nativeBuildInputs = [ pkg-config ];
 
-  cargoSha256 = "sha256-btSWvlObvn08cAWVMM4R0aciYz8swRFZjX+WDhALj3M=";
+  cargoSha256 = "sha256-3xvaEzqAz/U8CkdGYXLBnxrgW1raeKuzRsmD+0Sd4iQ=";
 
   # Tests fail with this error: `found argument --test-threads which was not expected`
   doCheck = false;
diff --git a/pkgs/os-specific/linux/disk-indicator/default.nix b/pkgs/os-specific/linux/disk-indicator/default.nix
index 44dd19b27dfb7..f5c7f3bc774e4 100644
--- a/pkgs/os-specific/linux/disk-indicator/default.nix
+++ b/pkgs/os-specific/linux/disk-indicator/default.nix
@@ -2,31 +2,40 @@
 
 stdenv.mkDerivation {
   pname = "disk-indicator";
-  version = "unstable-2014-05-19";
+  version = "unstable-2018-12-18";
 
   src = fetchFromGitHub {
     owner = "MeanEYE";
     repo = "Disk-Indicator";
-    rev = "51ef4afd8141b8d0659cbc7dc62189c56ae9c2da";
-    sha256 = "sha256-bRaVEe18VUmyftXzMNmGuL5gZ/dKCipuEDYrnHo1XYI=";
+    rev = "ec2d2f6833f038f07a72d15e2d52625c23e10b12";
+    sha256 = "sha256-cRqgIxF6H1WyJs5hhaAXVdWAlv6t22BZLp3p/qRlCSM=";
   };
 
   buildInputs = [ libX11 ];
 
-  patchPhase = ''
-    substituteInPlace ./makefile --replace "COMPILER=c99" "COMPILER=gcc -std=c99"
-    substituteInPlace ./makefile --replace "COMPILE_FLAGS=" "COMPILE_FLAGS=-O2 "
+  postPatch = ''
+    # avoid -Werror
+    substituteInPlace Makefile --replace "-Werror" ""
+    # avoid host-specific options
+    substituteInPlace Makefile --replace "-march=native" ""
   '';
 
-  buildPhase = "make -f makefile";
-
-  NIX_CFLAGS_COMPILE = "-Wno-error=cpp";
+  postConfigure = ''
+    patchShebangs ./configure.sh
+    ./configure.sh --all
+  '';
 
-  hardeningDisable = [ "fortify" ];
+  makeFlags = [
+    "COMPILER=${stdenv.cc.targetPrefix}cc"
+  ];
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p "$out/bin"
     cp ./disk_indicator "$out/bin/"
+
+    runHook postInstall
   '';
 
   meta = {
diff --git a/pkgs/os-specific/linux/kmscube/default.nix b/pkgs/os-specific/linux/kmscube/default.nix
index 53b4cd60fb1c7..b9da379017001 100644
--- a/pkgs/os-specific/linux/kmscube/default.nix
+++ b/pkgs/os-specific/linux/kmscube/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchgit, autoreconfHook, libdrm, libX11, libGL, mesa, pkg-config }:
+{ lib, stdenv, fetchgit, fetchpatch, autoreconfHook, libdrm, libX11, libGL, mesa, pkg-config }:
 
 stdenv.mkDerivation {
   pname = "kmscube";
@@ -10,6 +10,15 @@ stdenv.mkDerivation {
     sha256 = "1q5b5yvyfj3127385mp1bfmcbnpnbdswdk8gspp7g4541xk4k933";
   };
 
+  patches = [
+    # Pull upstream patch for -fno-common toolchains.
+    (fetchpatch {
+      name = "fno-common.patch";
+      url = "https://gitlab.freedesktop.org/mesa/kmscube/-/commit/908ef39864442c0807954af5d3f88a3da1a6f8a5.patch";
+      sha256 = "1gxn3b50mvjlc25234839v5z29r8fd9di4176a3yx4gbsz8cc5vi";
+    })
+  ];
+
   nativeBuildInputs = [ autoreconfHook pkg-config ];
   buildInputs = [ libdrm libX11 libGL mesa ];
 
diff --git a/pkgs/os-specific/linux/latencytop/default.nix b/pkgs/os-specific/linux/latencytop/default.nix
index 56e412379f80f..a48abf85831fe 100644
--- a/pkgs/os-specific/linux/latencytop/default.nix
+++ b/pkgs/os-specific/linux/latencytop/default.nix
@@ -1,10 +1,16 @@
-{ lib, stdenv, fetchurl, ncurses, glib, pkg-config, gtk2 }:
+{ lib, stdenv, fetchurl, ncurses, glib, pkg-config, gtk2, util-linux }:
 
 stdenv.mkDerivation rec {
   pname = "latencytop";
   version = "0.5";
 
-  patchPhase = "sed -i s,/usr,$out, Makefile";
+  postPatch = ''
+    sed -i s,/usr,$out, Makefile
+
+    # Fix #171609
+    substituteInPlace fsync.c --replace /bin/mount ${util-linux}/bin/mount
+  '';
+
   preInstall = "mkdir -p $out/sbin";
 
   src = fetchurl {
diff --git a/pkgs/os-specific/linux/rt-tests/default.nix b/pkgs/os-specific/linux/rt-tests/default.nix
new file mode 100644
index 0000000000000..67e8c7b86a5c8
--- /dev/null
+++ b/pkgs/os-specific/linux/rt-tests/default.nix
@@ -0,0 +1,34 @@
+{ stdenv
+, lib
+, makeWrapper
+, fetchurl
+, numactl
+, python3
+}:
+
+stdenv.mkDerivation rec {
+  pname = "rt-tests";
+  version = "2.3";
+
+  src = fetchurl {
+    url = "https://git.kernel.org/pub/scm/utils/rt-tests/rt-tests.git/snapshot/${pname}-${version}.tar.gz";
+    sha256 = "Q+rNdpRdsmW2gcsrfwg12EzpvO6qlEP/Mb/OWQMNmr8=";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ numactl python3 ];
+
+  makeFlags = [ "prefix=$(out)" "DESTDIR=" "PYLIB=$(out)/${python3.sitePackages}" ];
+
+  postInstall = ''
+    wrapProgram "$out/bin/determine_maximum_mpps.sh" --prefix PATH : $out/bin
+  '';
+
+  meta = with lib; {
+    homepage = https://git.kernel.org/pub/scm/utils/rt-tests/rt-tests.git;
+    description = "Suite of real-time tests - cyclictest, hwlatdetect, pip_stress, pi_stress, pmqtest, ptsematest, rt-migrate-test, sendme, signaltest, sigwaittest, svsematest";
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ poelzi ];
+    license = licenses.gpl2;
+  };
+}
diff --git a/pkgs/servers/bloat/default.nix b/pkgs/servers/bloat/default.nix
new file mode 100644
index 0000000000000..bea2f705449a5
--- /dev/null
+++ b/pkgs/servers/bloat/default.nix
@@ -0,0 +1,42 @@
+{ lib
+, buildGoModule
+, fetchgit
+, unstableGitUpdater
+}:
+
+buildGoModule {
+  pname = "bloat";
+  version = "unstable-2022-03-31";
+
+  src = fetchgit {
+    url = "git://git.freesoftwareextremist.com/bloat";
+    rev = "a38d29a43592601d37d671db8748f0980071c0c4";
+    sha256 = "sha256-7Hxt0QlOYMBMvDS40fpfSItGkd5nYFQmmjJIevNyeF8=";
+  };
+
+  vendorSha256 = null;
+
+  postInstall = ''
+    mkdir -p $out/share/bloat
+    cp -r templates $out/share/bloat/templates
+    cp -r static $out/share/bloat/static
+    sed \
+      -e "s%=templates%=$out/share/bloat/templates%g" \
+      -e "s%=static%=$out/share/bloat/static%g"       \
+      < bloat.conf > $out/share/bloat/bloat.conf.example
+  '';
+
+  passthru.updateScript = unstableGitUpdater { };
+
+  meta = with lib; {
+    description = "A web client for Pleroma and Mastodon";
+    longDescription = ''
+      A lightweight web client for Pleroma and Mastodon.
+      Does not require JavaScript to display text, images, audio and videos.
+    '';
+    homepage = "https://bloat.freesoftwareextremist.com";
+    downloadPage = "https://git.freesoftwareextremist.com/bloat/";
+    license = licenses.cc0;
+    maintainers = with maintainers; [ fgaz ];
+  };
+}
diff --git a/pkgs/servers/frr/default.nix b/pkgs/servers/frr/default.nix
index 302c5a472bd01..5e5cd767002d2 100644
--- a/pkgs/servers/frr/default.nix
+++ b/pkgs/servers/frr/default.nix
@@ -23,6 +23,7 @@
 , pcre2
 , python3
 , readline
+, rtrlib
 
 # tests
 , nettools
@@ -62,6 +63,7 @@ stdenv.mkDerivation rec {
     pcre2
     python3
     readline
+    rtrlib
   ] ++ lib.optionals stdenv.isLinux [
     libcap
   ];
@@ -78,6 +80,7 @@ stdenv.mkDerivation rec {
     "--localstatedir=/run/frr"
     "--sbindir=$(out)/libexec/frr"
     "--sysconfdir=/etc/frr"
+    "--enable-rpki"
   ];
 
   postPatch = ''
diff --git a/pkgs/servers/gemini/agate/default.nix b/pkgs/servers/gemini/agate/default.nix
index ae198707ec59c..2240536021d24 100644
--- a/pkgs/servers/gemini/agate/default.nix
+++ b/pkgs/servers/gemini/agate/default.nix
@@ -1,25 +1,16 @@
-{ lib, stdenv, nixosTests, fetchFromGitHub, fetchpatch, rustPlatform, libiconv, Security }:
+{ lib, stdenv, nixosTests, fetchFromGitHub, rustPlatform, libiconv, Security }:
 
 rustPlatform.buildRustPackage rec {
   pname = "agate";
-  version = "3.2.3";
+  version = "3.2.4";
 
   src = fetchFromGitHub {
     owner = "mbrubeck";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-nkWk/0TIAHcYQjxbg0HnT+4S4Cinl22WfqHb9U6u5eI=";
+    sha256 = "sha256-NyHs/9kRBGqmh44MSRzYb7CSvEB0RlmL9l5QpGEwDhY=";
   };
-  cargoSha256 = "sha256-aF86QpizJ+lMNmN9DQKA9o1QZWZObyQ3v3+HmT/s02g=";
-
-  patches = [
-    # https://github.com/mbrubeck/agate/pull/143
-    (fetchpatch {
-      name = "fix-port-collision.patch";
-      url = "https://github.com/mbrubeck/agate/commit/2f5d7878ec9d0dd51762c4c7680fc9f825d8ecd5.patch";
-      sha256 = "sha256-NEFmfb0y97O2W96YggD+MgcN7tlFEi9T4FNzLCND77s=";
-    })
-  ];
+  cargoSha256 = "sha256-V0MLXOLLmKnk4Iyhbu+EomsxOX6RLYHIsi/IwWiqmcg=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv Security ];
 
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index bc9e73392964a..22ef7e00c9279 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2022.5.4";
+  version = "2022.5.5";
   components = {
     "abode" = ps: with ps; [
       abodepy
@@ -2440,7 +2440,7 @@
       paho-mqtt
     ];
     "snmp" = ps: with ps; [
-      pysnmplib
+      pysnmp
     ];
     "solaredge" = ps: with ps; [
       solaredge
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index abaf16079d815..ff5c69b04fb8e 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -179,7 +179,7 @@ let
   extraPackagesFile = writeText "home-assistant-packages" (lib.concatMapStringsSep "\n" (pkg: pkg.pname) extraBuildInputs);
 
   # Don't forget to run parse-requirements.py after updating
-  hassVersion = "2022.5.4";
+  hassVersion = "2022.5.5";
 
 in python.pkgs.buildPythonApplication rec {
   pname = "homeassistant";
@@ -197,7 +197,7 @@ in python.pkgs.buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     rev = version;
-    hash = "sha256-5juHG1bVeFYrjpAAlt3GoCRmBvyCSOdnSw1WuaNWF8w=";
+    hash = "sha256-uVB3Yg3f0fNkq2rav7hmbJ9IAMg0UIrdMshJVgOharA=";
   };
 
   # leave this in, so users don't have to constantly update their downstream patch handling
diff --git a/pkgs/servers/monitoring/lcdproc/default.nix b/pkgs/servers/monitoring/lcdproc/default.nix
index bd0a7dc0dfbe5..949be34b80b53 100644
--- a/pkgs/servers/monitoring/lcdproc/default.nix
+++ b/pkgs/servers/monitoring/lcdproc/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , autoreconfHook
 , makeWrapper
 , pkg-config
@@ -27,6 +28,14 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./hardcode_mtab.patch
+
+    # Pull upstream fix for -fno-common toolchains:
+    #   https://github.com/lcdproc/lcdproc/pull/148
+    (fetchpatch {
+      name = "fno-common.patch";
+      url = "https://github.com/lcdproc/lcdproc/commit/fda5302878692da933dc03cd011f8ddffefa07a4.patch";
+      sha256 = "0ld6p1r4rjsnjr63afw3lp5lx25jxjs07lsp9yc3q96r91r835cy";
+    })
   ];
 
   # we don't need to see the GPL every time we launch lcdd in the foreground
diff --git a/pkgs/servers/web-apps/wiki-js/default.nix b/pkgs/servers/web-apps/wiki-js/default.nix
index 496bf02bb03aa..6da2e3b3d036c 100644
--- a/pkgs/servers/web-apps/wiki-js/default.nix
+++ b/pkgs/servers/web-apps/wiki-js/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "wiki-js";
-  version = "2.5.279";
+  version = "2.5.282";
 
   src = fetchurl {
     url = "https://github.com/Requarks/wiki/releases/download/v${version}/${pname}.tar.gz";
-    sha256 = "sha256-4QYNKvAEeRSJS9lO30bI/SnM9rLmuvRMR/LsGT77wvY=";
+    sha256 = "sha256-cXNO8ChZ2FGAmTmcQDqnZrJpFynmdoocqFy59VCy1RE=";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/servers/zoneminder/default.nix b/pkgs/servers/zoneminder/default.nix
index b0828de006f75..a698c2e9f7bfa 100644
--- a/pkgs/servers/zoneminder/default.nix
+++ b/pkgs/servers/zoneminder/default.nix
@@ -78,13 +78,13 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "zoneminder";
-  version = "1.36.10";
+  version = "1.36.15";
 
   src = fetchFromGitHub {
     owner  = "ZoneMinder";
     repo   = "zoneminder";
     rev    = version;
-    sha256 = "sha256-MmBnbVDitKOctPe2dNe1sMNNs/qEYGVq3UMJxAkLlCc=";
+    sha256 = "1qlsg7gd9kpjdbq9d5yrjmc7g1pbscrg4sws7xrdln1z8509sv50";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index cfed6d197cf0c..ed457019c558e 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -331,8 +331,8 @@ else let
 
       # This parameter is sometimes a string, sometimes null, and sometimes a list, yuck
       configureFlags = let inherit (lib) optional elem; in
-        (/**/ if lib.isString configureFlags then [configureFlags]
-         else if configureFlags == null      then []
+        (/**/ if lib.isString configureFlags then lib.warn "String 'configureFlags' is deprecated and will be removed in release 23.05. Please use a list of strings. Derivation name: ${derivationArg.name}, file: ${pos.file or "unknown file"}" [configureFlags]
+         else if configureFlags == null      then lib.warn "Null 'configureFlags' is deprecated and will be removed in release 23.05. Please use a empty list instead '[]'. Derivation name: ${derivationArg.name}, file: ${pos.file or "unknown file"}" []
          else                                     configureFlags)
         ++ optional (elem "build"  configurePlatforms) "--build=${stdenv.buildPlatform.config}"
         ++ optional (elem "host"   configurePlatforms) "--host=${stdenv.hostPlatform.config}"
diff --git a/pkgs/tools/admin/adtool/default.nix b/pkgs/tools/admin/adtool/default.nix
index d7f6ffadaca92..f1bc5851c7939 100644
--- a/pkgs/tools/admin/adtool/default.nix
+++ b/pkgs/tools/admin/adtool/default.nix
@@ -19,6 +19,12 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ openldap ];
 
+  # Workaround build failure on -fno-common toolchains like upstream
+  # gcc-10. Otherwise build fails as:
+  #   ld: ../../src/lib/libactive_directory.a(active_directory.o):/build/adtool-1.3.3/src/lib/active_directory.h:31:
+  #     multiple definition of `system_config_file'; adtool.o:/build/adtool-1.3.3/src/tools/../../src/lib/active_directory.h:31: first defined here
+  NIX_CFLAGS_COMPILE = "-fcommon";
+
   enableParallelBuilding = true;
 
   postInstall = ''
diff --git a/pkgs/tools/admin/docker-credential-gcr/default.nix b/pkgs/tools/admin/docker-credential-gcr/default.nix
index ee2efb206af67..c13c62c62cd53 100644
--- a/pkgs/tools/admin/docker-credential-gcr/default.nix
+++ b/pkgs/tools/admin/docker-credential-gcr/default.nix
@@ -1,16 +1,31 @@
-{ lib, buildGoPackage, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub, testers, docker-credential-gcr }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "docker-credential-gcr";
-  version = "2.0.5";
-
-  goPackagePath = "github.com/GoogleCloudPlatform/docker-credential-gcr";
+  version = "2.1.2";
 
   src = fetchFromGitHub {
     owner = "GoogleCloudPlatform";
     repo = "docker-credential-gcr";
     rev = "v${version}";
-    sha256 = "sha256-WrcGTXy5SMWDHJWddXUuvUvEWjOsJcoB1zBg02p5ggY=";
+    sha256 = "sha256-gb9c8qTHQWUOlaXAKfpwm0Pwa/N4iu48jWIwPYXD00k=";
+  };
+
+  vendorSha256 = "sha256-e7XNTizZYp/tS7KRvB9KxY3Yurphnm6Ehz4dHZNReK8=";
+
+  CGO_ENABLED = 0;
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/GoogleCloudPlatform/docker-credential-gcr/config.Version=${version}"
+  ];
+
+  checkFlags = [ "-short" ];
+
+  passthru.tests.version = testers.testVersion {
+    package = docker-credential-gcr;
+    command = "docker-credential-gcr version";
   };
 
   meta = with lib; {
diff --git a/pkgs/tools/admin/docker-credential-helpers/default.nix b/pkgs/tools/admin/docker-credential-helpers/default.nix
index 0d46eff98b51e..c32c8834f8dcd 100644
--- a/pkgs/tools/admin/docker-credential-helpers/default.nix
+++ b/pkgs/tools/admin/docker-credential-helpers/default.nix
@@ -45,5 +45,7 @@ buildGoPackage rec {
     license = licenses.mit;
     maintainers = [ maintainers.marsam ];
     platforms = platforms.linux ++ platforms.darwin;
+  } // lib.optionalAttrs stdenv.isDarwin {
+    mainProgram = "docker-credential-osxkeychain";
   };
 }
diff --git a/pkgs/tools/bluetooth/bluez-tools/default.nix b/pkgs/tools/bluetooth/bluez-tools/default.nix
index dfb7147d08eb4..af76991436fd9 100644
--- a/pkgs/tools/bluetooth/bluez-tools/default.nix
+++ b/pkgs/tools/bluetooth/bluez-tools/default.nix
@@ -2,14 +2,14 @@
 , fetchFromGitHub, glib, pkg-config }:
 
 stdenv.mkDerivation rec {
-  version = "unstable-2016-12-12";
+  version = "unstable-2020-10-24";
   pname = "bluez-tools";
 
   src = fetchFromGitHub {
     owner = "khvzak";
     repo = "bluez-tools";
-    rev = "97efd293491ad7ec96a655665339908f2478b3d1";
-    sha256 = "08xp77sf5wnq5086halmyk3vla4bfls06q1zrqdcq36hw6d409i6";
+    rev = "f65321736475429316f07ee94ec0deac8e46ec4a";
+    sha256 = "0xk39lz3hm8lcnb5fdbfz4ldbbq8gswg95vilzdwxzrglcr6xnqq";
   };
 
   nativeBuildInputs = [ pkg-config autoreconfHook ];
diff --git a/pkgs/tools/filesystems/jfsutils/default.nix b/pkgs/tools/filesystems/jfsutils/default.nix
index 290bc31391088..52b8fc4c3c281 100644
--- a/pkgs/tools/filesystems/jfsutils/default.nix
+++ b/pkgs/tools/filesystems/jfsutils/default.nix
@@ -25,6 +25,12 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [ libuuid ];
 
+  # Workaround build failure on -fno-common toolchains like upstream
+  # gcc-10. Otherwise build fails as:
+  #     ld: extract.o:/build/jfsutils-1.1.15/fscklog/extract.c:67: multiple definition of
+  #       `xchklog_buffer'; display.o:/build/jfsutils-1.1.15/fscklog/display.c:57: first defined here
+  NIX_CFLAGS_COMPILE = "-fcommon";
+
   meta = with lib; {
     description = "IBM JFS utilities";
     homepage = "http://jfs.sourceforge.net";
diff --git a/pkgs/tools/misc/diffoscope/default.nix b/pkgs/tools/misc/diffoscope/default.nix
index b07947e672ff8..b0f6c6c24e8d1 100644
--- a/pkgs/tools/misc/diffoscope/default.nix
+++ b/pkgs/tools/misc/diffoscope/default.nix
@@ -46,7 +46,7 @@ python3Packages.buildPythonApplication rec {
   pythonPath = [
       binutils-unwrapped bzip2 colordiff coreutils cpio db diffutils
       e2fsprogs file findutils fontforge-fonttools gettext gnutar gzip
-      libarchive libcaca lz4 openssl pgpdump sng sqlite squashfsTools unzip xxd
+      libarchive lz4 openssl pgpdump sng sqlite squashfsTools unzip xxd
       xz zip zstd
     ]
     ++ (with python3Packages; [
@@ -56,7 +56,7 @@ python3Packages.buildPythonApplication rec {
     ++ lib.optionals stdenv.isLinux [ python3Packages.pyxattr acl cdrkit dtc ]
     ++ lib.optionals enableBloat ([
       abootimg apksigner apktool cbfstool colord enjarify ffmpeg fpc ghc ghostscriptX giflib gnupg gnumeric
-      hdf5 imagemagick llvm jdk mono ocaml odt2txt oggvideotools openssh pdftk poppler_utils procyon qemu R tcpdump ubootTools wabt radare2 xmlbeans
+      hdf5 imagemagick libcaca llvm jdk mono ocaml odt2txt oggvideotools openssh pdftk poppler_utils procyon qemu R tcpdump ubootTools wabt radare2 xmlbeans
     ] ++ (with python3Packages; [ androguard binwalk guestfs h5py pdfminer ]));
 
   checkInputs = with python3Packages; [ pytestCheckHook ] ++ pythonPath;
diff --git a/pkgs/tools/misc/dua/default.nix b/pkgs/tools/misc/dua/default.nix
index d7f3eafe3ecab..097aee5f06885 100644
--- a/pkgs/tools/misc/dua/default.nix
+++ b/pkgs/tools/misc/dua/default.nix
@@ -2,7 +2,7 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "dua";
-  version = "2.17.1";
+  version = "2.17.5";
 
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv Foundation ];
 
@@ -10,7 +10,7 @@ rustPlatform.buildRustPackage rec {
     owner = "Byron";
     repo = "dua-cli";
     rev = "v${version}";
-    sha256 = "sha256-58l0E5wwRKbF/ja3fmMMBIONjuwVOxlwdKRT5BeO9MQ=";
+    sha256 = "sha256-dpkUbZz/bIiTMhZalXHGct77qMzYB6LATs7MPVyW1GY=";
     # Remove unicode file names which leads to different checksums on HFS+
     # vs. other filesystems because of unicode normalisation.
     extraPostFetch = ''
@@ -18,13 +18,14 @@ rustPlatform.buildRustPackage rec {
     '';
   };
 
-  cargoSha256 = "sha256-nft0wrgTMrI8Tav6NcqPwSF8Q367twIOr1voBsW2488=";
+  cargoSha256 = "sha256-xBiabY0aGPxrAHypuSg3AF/EcChDgtIK9cJDCeTNkm0=";
 
   doCheck = false;
 
   meta = with lib; {
     description = "A tool to conveniently learn about the disk usage of directories, fast!";
     homepage = "https://github.com/Byron/dua-cli";
+    changelog = "https://github.com/Byron/dua-cli/raw/v${version}/CHANGELOG.md";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ killercup ];
   };
diff --git a/pkgs/tools/misc/esphome/dashboard.nix b/pkgs/tools/misc/esphome/dashboard.nix
index 1f101735e9811..52ec2688103df 100644
--- a/pkgs/tools/misc/esphome/dashboard.nix
+++ b/pkgs/tools/misc/esphome/dashboard.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "esphome-dashboard";
-  version = "20220309.0";
+  version = "20220508.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-J/T3Av0jwT0CJSwc0j+YjaiKFqs9soLf7ctpiz5rmm4=";
+    sha256 = "sha256-nBVVNe6Qwo72ws6G8WAO99f2ftbxoixOB0eiLuILyeg=";
   };
 
   # no tests
diff --git a/pkgs/tools/misc/esphome/default.nix b/pkgs/tools/misc/esphome/default.nix
index 3ce65eb203801..6eba2ca94464f 100644
--- a/pkgs/tools/misc/esphome/default.nix
+++ b/pkgs/tools/misc/esphome/default.nix
@@ -15,14 +15,14 @@ let
 in
 with python.pkgs; buildPythonApplication rec {
   pname = "esphome";
-  version = "2022.4.0";
+  version = "2022.5.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "sha256-/IMiUMtWFouAjOlyq+BXvqQ1IddBXvua7y0i4J1cktM=";
+    sha256 = "sha256-ys4oGYZvOxKOLyeIFPR33L2uCAB1lybSo6nCIYFuA/0=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/misc/goreleaser/default.nix b/pkgs/tools/misc/goreleaser/default.nix
index 412f2733304d2..9b9505c9beb0e 100644
--- a/pkgs/tools/misc/goreleaser/default.nix
+++ b/pkgs/tools/misc/goreleaser/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "goreleaser";
-  version = "1.8.3";
+  version = "1.9.0";
 
   src = fetchFromGitHub {
     owner = "goreleaser";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-EqUaJHlZupk8CP0ob8pL5tAW/bzG38eZmA4hgTg1jYY=";
+    sha256 = "sha256-R20mzPpbFDUw/wrif3ZJCt2wgmV+yqSkGaxyuw/9z0E=";
   };
 
-  vendorSha256 = "sha256-UAApPni4zIAQVOmPAah5vEE8kTrGaJ3irjtsukBNVHo=";
+  vendorSha256 = "sha256-+Rj2hb9Sul5ntVGfuWf7JibKdG03zALiMWaaNTJFC8k=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/misc/neofetch/default.nix b/pkgs/tools/misc/neofetch/default.nix
index 64632986638d3..9a6d03c6dcaf4 100644
--- a/pkgs/tools/misc/neofetch/default.nix
+++ b/pkgs/tools/misc/neofetch/default.nix
@@ -4,7 +4,7 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "neofetch";
-  version = "unstable-2020-12-10";
+  version = "unstable-2021-12-10";
 
   src = fetchFromGitHub {
     owner = "dylanaraps";
@@ -19,8 +19,16 @@ stdenvNoCC.mkDerivation rec {
       sha256 = "1fapdg9z79f0j3vw7fgi72b54aw4brn42bjsj48brbvg3ixsciph";
       name = "avoid_overwriting_gio_extra_modules_env_var.patch";
     })
+    # https://github.com/dylanaraps/neofetch/pull/2114
+    (fetchpatch {
+      url = "https://github.com/dylanaraps/neofetch/commit/c4eb4ec7783bb94cca0dbdc96db45a4d965956d2.patch";
+      sha256 = "sha256-F6Q4dUtfmR28VxLbITiLFJ44FjG4T1Cvuz3a0nLisMs=";
+      name = "update_old_nixos_logo.patch";
+    })
   ];
 
+  outputs = [ "out" "man" ];
+
   strictDeps = true;
   buildInputs = [ bash ];
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/misc/pandoc-drawio-filter/default.nix b/pkgs/tools/misc/pandoc-drawio-filter/default.nix
index 1279296143cc9..73dd658dfb161 100644
--- a/pkgs/tools/misc/pandoc-drawio-filter/default.nix
+++ b/pkgs/tools/misc/pandoc-drawio-filter/default.nix
@@ -1,5 +1,5 @@
 { buildPythonApplication
-, drawio
+, drawio-headless
 , fetchFromGitHub
 , lib
 , pandoc
@@ -21,32 +21,13 @@ let
     sha256 = "sha256-2XJSAfxqEmmamWIAM3vZqi0mZjUUugmR3zWw8Imjadk=";
   };
 
-  wrappedDrawio = writeScriptBin "drawio" ''
-    #!${runtimeShell}
-
-    # Electron really wants a configuration directory to not die with:
-    # "Error: Failed to get 'appData' path"
-    # so we give it some temp dir as XDG_CONFIG_HOME
-    tmpdir=$(mktemp -d)
-
-    function cleanup {
-      rm -rf "$tmpdir"
-    }
-    trap cleanup EXIT
-
-    # Drawio needs to run in a virtual X session, because Electron
-    # refuses to work and dies with an unhelpful error message otherwise:
-    # "The futex facility returned an unexpected error code."
-    XDG_CONFIG_HOME="$tmpdir" ${xvfb-run}/bin/xvfb-run ${drawio}/bin/drawio $@
-  '';
-
   pandoc-drawio-filter = buildPythonApplication {
     pname = "pandoc-drawio-filter";
 
     inherit src version;
 
     propagatedBuildInputs = [
-      wrappedDrawio
+      drawio-headless
       pandocfilters
     ];
 
diff --git a/pkgs/tools/misc/wimboot/default.nix b/pkgs/tools/misc/wimboot/default.nix
index 67df4056b5f40..bc43d77bbfba5 100644
--- a/pkgs/tools/misc/wimboot/default.nix
+++ b/pkgs/tools/misc/wimboot/default.nix
@@ -26,6 +26,6 @@ stdenv.mkDerivation rec {
     description = "Windows Imaging Format bootloader";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ das_j ajs124 ];
-    platforms = platforms.x86; # Fails on aarch64
+    platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/pkgs/tools/misc/yt-dlp/default.nix b/pkgs/tools/misc/yt-dlp/default.nix
index d67678f6ee559..0eab77c5ab655 100644
--- a/pkgs/tools/misc/yt-dlp/default.nix
+++ b/pkgs/tools/misc/yt-dlp/default.nix
@@ -20,12 +20,12 @@ buildPythonPackage rec {
   # The websites yt-dlp deals with are a very moving target. That means that
   # downloads break constantly. Because of that, updates should always be backported
   # to the latest stable release.
-  version = "2022.04.08";
+  version = "2022.05.18";
 
   src = fetchPypi {
     inherit pname;
     version = builtins.replaceStrings [ ".0" ] [ "." ] version;
-    sha256 = "sha256-h1jQFlCdRXS5D73pdapwra73HtXnoZUUFYj21pRSBbo=";
+    sha256 = "sha256-OntZ0vtLOc6LqOC5xaN/4g5WJPRqI0a0rmarEyDjUTQ=";
   };
 
   propagatedBuildInputs = [ brotli certifi mutagen pycryptodomex websockets ];
@@ -67,6 +67,6 @@ buildPythonPackage rec {
       you can modify it, redistribute it or use it however you like.
     '';
     license = licenses.unlicense;
-    maintainers = with maintainers; [ mkg20001 SuperSandro2000 ];
+    maintainers = with maintainers; [ mkg20001 SuperSandro2000 marsam ];
   };
 }
diff --git a/pkgs/tools/misc/yubikey-personalization/default.nix b/pkgs/tools/misc/yubikey-personalization/default.nix
index 59739e06aa0ca..f8583f3614024 100644
--- a/pkgs/tools/misc/yubikey-personalization/default.nix
+++ b/pkgs/tools/misc/yubikey-personalization/default.nix
@@ -16,6 +16,14 @@ stdenv.mkDerivation rec {
       url = "https://github.com/Yubico/yubikey-personalization/commit/0aa2e2cae2e1777863993a10c809bb50f4cde7f8.patch";
       sha256 = "1wnigf3hbq59i15kgxpq3pwrl1drpbj134x81mmv9xm1r44cjva8";
     })
+
+    # Pull upstream fix for -fno-common toolchain support:
+    #  https://github.com/Yubico/yubikey-personalization/issues/155
+    (fetchpatch {
+      name = "fno-common.patch";
+      url = "https://github.com/Yubico/yubikey-personalization/commit/09ea16d9e2030e4da6ad00c1e5147e962aa7ff84.patch";
+      sha256 = "0n3ka8n7f3ndbxv3k0bi77d850kr2ypglkw81gqycpqyaciidqwa";
+    })
   ];
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/tools/networking/aria2/default.nix b/pkgs/tools/networking/aria2/default.nix
index 8fabea35ba90b..bb70c66b320fc 100644
--- a/pkgs/tools/networking/aria2/default.nix
+++ b/pkgs/tools/networking/aria2/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchpatch, fetchFromGitHub, pkg-config, autoreconfHook
+{ lib, stdenv, fetchFromGitHub, pkg-config, autoreconfHook
 , openssl, c-ares, libxml2, sqlite, zlib, libssh2
 , cppunit, sphinx
 , Security
@@ -26,6 +26,7 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--with-ca-bundle=/etc/ssl/certs/ca-certificates.crt"
     "--enable-libaria2"
+    "--with-bashcompletiondir=${placeholder "bin"}/share/bash-completion/completions"
   ];
 
   prePatch = ''
diff --git a/pkgs/tools/networking/goreplay/default.nix b/pkgs/tools/networking/goreplay/default.nix
index 14d0a16366ba4..dab5bee882c12 100644
--- a/pkgs/tools/networking/goreplay/default.nix
+++ b/pkgs/tools/networking/goreplay/default.nix
@@ -1,21 +1,24 @@
-{ lib, buildGoPackage, fetchFromGitHub, libpcap }:
+{ lib, buildGoModule, fetchFromGitHub, libpcap }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "goreplay";
-  version = "1.1.0";
-  rev = "v${version}";
-
-  goPackagePath = "github.com/buger/goreplay";
+  version = "1.3.3";
 
   src = fetchFromGitHub {
-    inherit rev;
-    owner  = "buger";
-    repo   = "goreplay";
-    sha256 = "07nsrx5hwmk6l8bqp48gqk40i9bxf0g4fbmpqbngx6j5f7lpbk2n";
+    owner = "buger";
+    repo = "goreplay";
+    rev = version;
+    sha256 = "sha256-FiY9e5FgpPu+K8eoO8TsU3xSaSoPPDxYEu0oi/S8Q1w=";
   };
 
+  vendorSha256 = "sha256-jDMAtcq3ZowFdky5BdTkVNxq4ltkhklr76nXYJgGALg=";
+
+  ldflags = [ "-s" "-w" ];
+
   buildInputs = [ libpcap ];
 
+  doCheck = false;
+
   meta = {
     homepage = "https://github.com/buger/goreplay";
     license = lib.licenses.lgpl3Only;
diff --git a/pkgs/tools/networking/hping/default.nix b/pkgs/tools/networking/hping/default.nix
index 97b45c64ee24f..33663a44d2a96 100644
--- a/pkgs/tools/networking/hping/default.nix
+++ b/pkgs/tools/networking/hping/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, libpcap, withTcl ? true, tcl }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, libpcap, withTcl ? true, tcl }:
 
 stdenv.mkDerivation rec {
   pname = "hping";
@@ -10,6 +10,15 @@ stdenv.mkDerivation rec {
     rev = "3547c7691742c6eaa31f8402e0ccbb81387c1b99"; # there are no tags/releases
     sha256 = "0y0n1ybij3yg9lfgzcwfmjz1sjg913zcqrv391xx83dm0j80sdpb";
   };
+  patches = [
+    # Pull patch pending upstream inclusion for -fno-common toolchain
+    # support: https://github.com/antirez/hping/pull/64
+    (fetchpatch {
+      name = "fno-common.patch";
+      url = "https://github.com/antirez/hping/pull/64/commits/d057b9309aec3a5a53aaee1ac3451a8a5b71b4e8.patch";
+      sha256 = "0bqr7kdlziijja588ipj8g5hv2109wq01c6x2qadbhjfnsps1b6l";
+    })
+  ];
 
   buildInputs = [ libpcap ] ++ lib.optional withTcl tcl;
 
diff --git a/pkgs/tools/networking/iftop/default.nix b/pkgs/tools/networking/iftop/default.nix
index abdb7d05b28b7..137ce03b2520e 100644
--- a/pkgs/tools/networking/iftop/default.nix
+++ b/pkgs/tools/networking/iftop/default.nix
@@ -19,6 +19,12 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ncurses libpcap];
 
+  # Workaround build failure on -fno-common toolchains like upstream
+  # gcc-10. Otherwise build fails as:
+  #   ld: tui.o:/build/iftop-1.0pre4/ui_common.h:41: multiple definition of `service_hash';
+  #     iftop.o:/build/iftop-1.0pre4/ui_common.h:41: first defined here
+  NIX_CFLAGS_COMPILE = "-fcommon";
+
   passthru.tests = { inherit (nixosTests) iftop; };
 
   meta = with lib; {
diff --git a/pkgs/tools/networking/iouyap/default.nix b/pkgs/tools/networking/iouyap/default.nix
index 2367261b52239..0b3c8007af6eb 100644
--- a/pkgs/tools/networking/iouyap/default.nix
+++ b/pkgs/tools/networking/iouyap/default.nix
@@ -13,6 +13,11 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ bison flex ];
 
+  # Workaround build failure on -fno-common toolchains like upstream
+  # gcc-10. Otherwise build fails as:
+  #   ld: netmap.o:(.bss+0x20): multiple definition of `sizecheck'; iouyap.o:(.bss+0x20): first defined here
+  NIX_CFLAGS_COMPILE = "-fcommon";
+
   installPhase = ''
     install -D -m555 iouyap $out/bin/iouyap;
   '';
diff --git a/pkgs/tools/networking/lsh/default.nix b/pkgs/tools/networking/lsh/default.nix
index 5893579b1a7bf..07f0524d5f4fa 100644
--- a/pkgs/tools/networking/lsh/default.nix
+++ b/pkgs/tools/networking/lsh/default.nix
@@ -31,7 +31,12 @@ stdenv.mkDerivation rec {
     export lsh_cv_sys_unix98_ptys=yes
   '';
 
-  NIX_CFLAGS_COMPILE = "-std=gnu90";
+  # -fcommon: workaround build failure on -fno-common toolchains like upstream
+  # gcc-10. Otherwise build fails as:
+  #   ld: liblsh.a(unix_user.o):/build/lsh-2.0.4/src/server_userauth.h:108: multiple definition of
+  #     `server_userauth_none_preauth'; lshd.o:/build/lsh-2.0.4/src/server_userauth.h:108: first defined here
+  # Should be present in upcoming 2.1 release.
+  NIX_CFLAGS_COMPILE = "-std=gnu90 -fcommon";
 
   buildInputs = [ gperf guile gmp zlib liboop readline gnum4 pam ];
 
diff --git a/pkgs/tools/networking/networkmanager/default.nix b/pkgs/tools/networking/networkmanager/default.nix
index 86195ba86923b..5dc59f9590f5d 100644
--- a/pkgs/tools/networking/networkmanager/default.nix
+++ b/pkgs/tools/networking/networkmanager/default.nix
@@ -54,11 +54,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "networkmanager";
-  version = "1.36.4";
+  version = "1.38.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/NetworkManager/${lib.versions.majorMinor version}/NetworkManager-${version}.tar.xz";
-    sha256 = "YTBOk33ZJkcdVnFb3t57q3zKyCc1bmfycA00MxfNPFk=";
+    sha256 = "sha256-gqTPB93+sIFnh7Z8D1BYrmxQ1iWcCwVBok41FWBisu8=";
   };
 
   outputs = [ "out" "dev" "devdoc" "man" "doc" ];
diff --git a/pkgs/tools/networking/networkmanager/l2tp/default.nix b/pkgs/tools/networking/networkmanager/l2tp/default.nix
index 889f15659592e..11a414a8a6a02 100644
--- a/pkgs/tools/networking/networkmanager/l2tp/default.nix
+++ b/pkgs/tools/networking/networkmanager/l2tp/default.nix
@@ -1,18 +1,34 @@
-{ lib, stdenv, substituteAll, fetchFromGitHub, autoreconfHook, libtool, intltool, pkg-config
-, file
-, gtk3, networkmanager, ppp, xl2tpd, strongswan, libsecret
-, withGnome ? true, libnma, glib }:
+{ stdenv
+, lib
+, substituteAll
+, fetchFromGitHub
+, autoreconfHook
+, pkg-config
+, gtk3
+, gtk4
+, networkmanager
+, ppp
+, xl2tpd
+, strongswan
+, libsecret
+, withGnome ? true
+, libnma
+, libnma-gtk4
+, glib
+, openssl
+, nss
+}:
 
 stdenv.mkDerivation rec {
   name = "${pname}${if withGnome then "-gnome" else ""}-${version}";
   pname = "NetworkManager-l2tp";
-  version = "1.2.12";
+  version = "1.20.4";
 
   src = fetchFromGitHub {
     owner = "nm-l2tp";
     repo = "network-manager-l2tp";
     rev = version;
-    sha256 = "0cq07kvlm98s8a7l4a3zmqnif8x3307kv7n645zx3f1r7x72b8m4";
+    sha256 = "VoqPjMQILBYemRE5VD/XwhWi9zL9QxxHZJ2JKtGglFo=";
   };
 
   patches = [
@@ -22,20 +38,29 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  buildInputs = [ networkmanager ppp glib ]
-    ++ lib.optionals withGnome [ gtk3 libsecret libnma ];
-
-  nativeBuildInputs = [ autoreconfHook libtool intltool pkg-config file ];
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+  ];
 
-  preConfigure = ''
-    intltoolize -f
-  '';
+  buildInputs = [
+    networkmanager
+    ppp
+    glib
+    openssl
+    nss
+  ] ++ lib.optionals withGnome [
+    gtk3
+    gtk4
+    libsecret
+    libnma
+    libnma-gtk4
+  ];
 
   configureFlags = [
-    "--without-libnm-glib"
     "--with-gnome=${if withGnome then "yes" else "no"}"
+    "--with-gtk4=${if withGnome then "yes" else "no"}"
     "--localstatedir=/var"
-    "--sysconfdir=$(out)/etc"
     "--enable-absolute-paths"
   ];
 
@@ -49,7 +74,7 @@ stdenv.mkDerivation rec {
     description = "L2TP plugin for NetworkManager";
     inherit (networkmanager.meta) platforms;
     homepage = "https://github.com/nm-l2tp/network-manager-l2tp";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     maintainers = with maintainers; [ abbradar obadz ];
   };
 }
diff --git a/pkgs/tools/networking/networkmanager/l2tp/fix-paths.patch b/pkgs/tools/networking/networkmanager/l2tp/fix-paths.patch
index 531672c393625..d9ee0dd49975e 100644
--- a/pkgs/tools/networking/networkmanager/l2tp/fix-paths.patch
+++ b/pkgs/tools/networking/networkmanager/l2tp/fix-paths.patch
@@ -1,22 +1,22 @@
 diff --git a/shared/utils.c b/shared/utils.c
-index c978a1f..d2c36cd 100644
+index 453e277..28716a5 100644
 --- a/shared/utils.c
 +++ b/shared/utils.c
-@@ -52,7 +52,7 @@ nm_find_ipsec (void)
+@@ -39,7 +39,7 @@ check_ipsec_daemon(const char *path)
+ const char *
+ nm_find_ipsec(void)
  {
- 	static const char *ipsec_binary_paths[] =
- 		{
--			"/sbin/ipsec",
-+			"@strongswan@/bin/ipsec",
- 			"/usr/sbin/ipsec",
- 			"/usr/local/sbin/ipsec",
- 			"/sbin/strongswan",
-@@ -77,7 +77,7 @@ nm_find_l2tpd (void)
- {
- 	static const char *l2tp_binary_paths[] =
- 		{
--			"/sbin/xl2tpd",
-+			"@xl2tpd@/bin/xl2tpd",
- 			"/usr/sbin/xl2tpd",
- 			"/usr/local/sbin/xl2tpd",
- 			NULL
+-    static const char *ipsec_binary_paths[] = {"/usr/bin/ipsec",
++    static const char *ipsec_binary_paths[] = {"@strongswan@/bin/ipsec",
+                                                "/sbin/ipsec",
+                                                "/usr/sbin/ipsec",
+                                                "/usr/local/sbin/ipsec",
+@@ -70,7 +70,7 @@ nm_find_l2tpd(NML2tpL2tpDaemon *l2tp_daemon)
+                                                "/usr/local/sbin/kl2tpd",
+                                                NULL};
+ 
+-    static const char *xl2tp_binary_paths[] = {"/usr/bin/xl2tpd",
++    static const char *xl2tp_binary_paths[] = {"@xl2tpd@/bin/xl2tpd",
+                                                "/sbin/xl2tpd",
+                                                "/usr/sbin/xl2tpd",
+                                                "/usr/local/sbin/xl2tpd",
diff --git a/pkgs/tools/networking/networkmanager/strongswan/default.nix b/pkgs/tools/networking/networkmanager/strongswan/default.nix
index be0dcf234ffb5..e080ca17db13c 100644
--- a/pkgs/tools/networking/networkmanager/strongswan/default.nix
+++ b/pkgs/tools/networking/networkmanager/strongswan/default.nix
@@ -1,35 +1,55 @@
-{ lib, stdenv, fetchurl, intltool, pkg-config, networkmanager, strongswanNM
-, gtk3, gnome, libsecret, libnma }:
+{ stdenv
+, lib
+, fetchurl
+, intltool
+, pkg-config
+, networkmanager
+, strongswanNM
+, gtk3
+, gtk4
+, gnome
+, libsecret
+, libnma
+, libnma-gtk4
+}:
 
 stdenv.mkDerivation rec {
   pname = "NetworkManager-strongswan";
-  version = "1.5.2";
+  version = "1.6.0";
 
   src = fetchurl {
     url = "https://download.strongswan.org/NetworkManager/${pname}-${version}.tar.bz2";
-    sha256 = "0sc1yzlxjfvl58hjjw99bchqc4061i3apw254z61v22k4sajnif8";
+    sha256 = "bbyA9qCboM9hBKMXhJWXgEFN13Fl4pY6zWZXwowlRMI=";
   };
 
-  buildInputs = [ networkmanager strongswanNM libsecret gtk3 libnma ];
-
-  nativeBuildInputs = [ intltool pkg-config ];
+  nativeBuildInputs = [
+    intltool
+    pkg-config
+  ];
 
-  # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
+  buildInputs = [
+    networkmanager
+    strongswanNM
+    libsecret
+    gtk3
+    gtk4
+    libnma
+    libnma-gtk4
+  ];
 
   configureFlags = [
-    "--without-libnm-glib"
     "--with-charon=${strongswanNM}/libexec/ipsec/charon-nm"
-    "--with-nm-libexecdir=$(out)/libexec"
-    "--with-nm-plugindir=$(out)/lib/NetworkManager"
+    "--with-nm-libexecdir=${placeholder "out"}/libexec"
+    "--with-nm-plugindir=${placeholder "out"}/lib/NetworkManager"
+    "--with-gtk4"
   ];
 
+  PKG_CONFIG_LIBNM_VPNSERVICEDIR = "${placeholder "out"}/lib/NetworkManager/VPN";
+
   passthru = {
     networkManagerPlugin = "VPN/nm-strongswan-service.name";
   };
 
-  PKG_CONFIG_LIBNM_VPNSERVICEDIR = "$(out)/lib/NetworkManager/VPN";
-
   meta = with lib; {
     description = "NetworkManager's strongswan plugin";
     inherit (networkmanager.meta) platforms;
diff --git a/pkgs/tools/nix/alejandra/default.nix b/pkgs/tools/nix/alejandra/default.nix
index 62deef516d50e..0e7f5e133eaad 100644
--- a/pkgs/tools/nix/alejandra/default.nix
+++ b/pkgs/tools/nix/alejandra/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "alejandra";
-  version = "1.2.0";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "kamadorueda";
     repo = "alejandra";
     rev = version;
-    sha256 = "sha256-35hEJuMvRswOPKb9lbB9ZuHVe0eJN6WJc4T8Frn0hYQ=";
+    sha256 = "sha256-0AolxQtKj3Oek0WSbODDpPVO5Ih8PXHOA3qXEKPB4dQ=";
   };
 
-  cargoSha256 = "sha256-SsIpggbRQPjpCYgCG4sSJ022MmMV4bJJ8UAHcJR74O8=";
+  cargoSha256 = "sha256-USI98hozlTaTj07tMbCQEWDgRkHsd4PFW1HUpKsNZJA=";
 
   passthru.tests = {
     version = testers.testVersion { package = alejandra; };
diff --git a/pkgs/tools/package-management/cde/default.nix b/pkgs/tools/package-management/cde/default.nix
index acebe4726755b..5e86e2affb32f 100644
--- a/pkgs/tools/package-management/cde/default.nix
+++ b/pkgs/tools/package-management/cde/default.nix
@@ -25,6 +25,12 @@ stdenv.mkDerivation rec {
     patchShebangs .
   '';
 
+  # Workaround build failure on -fno-common toolchains like upstream
+  # gcc-10. Otherwise build fails as:
+  #   ld: ../readelf-mini/libreadelf-mini.a(dwarf.o):/build/source/readelf-mini/dwarf.c:64:
+  #     multiple definition of `do_wide'; ../readelf-mini/libreadelf-mini.a(readelf-mini.o):/build/source/readelf-mini/readelf-mini.c:170: first defined here
+  NIX_CFLAGS_COMPILE = "-fcommon";
+
   installPhase = ''
     install -d $out/bin
     install -t $out/bin cde cde-exec
@@ -36,7 +42,7 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3Plus;
     maintainers = [ maintainers.rlupton20 ];
     platforms = platforms.linux;
-    # error: architecture aarch64 is not supported by strace
+    # error: architecture aarch64 is not supported by bundled strace
     badPlatforms = [ "aarch64-linux" ];
   };
 }
diff --git a/pkgs/tools/package-management/nix-update/default.nix b/pkgs/tools/package-management/nix-update/default.nix
index fd3b4a5a3e466..dd6cb2e560529 100644
--- a/pkgs/tools/package-management/nix-update/default.nix
+++ b/pkgs/tools/package-management/nix-update/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonApplication rec {
   pname = "nix-update";
-  version = "0.5.0";
+  version = "0.5.1";
 
   src = fetchFromGitHub {
     owner = "Mic92";
     repo = pname;
     rev = version;
-    sha256 = "sha256-D1N7ISLZJ3A8G9X5dvtCbRse5h0MRJoeZM3CHkFpqlE=";
+    sha256 = "sha256-d2S18cBkFJOIGFKrwj9U4bRvdPjrbuWfRUVug1JEw0s=";
   };
 
   makeWrapperArgs = [
diff --git a/pkgs/tools/security/arsenal/default.nix b/pkgs/tools/security/arsenal/default.nix
index cd927715d2e83..62dd9a5986689 100644
--- a/pkgs/tools/security/arsenal/default.nix
+++ b/pkgs/tools/security/arsenal/default.nix
@@ -5,19 +5,22 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "arsenal";
-  version = "1.0.2";
+  version = "1.1.0";
+  format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "Orange-Cyberdefense";
     repo = "arsenal";
     rev = version;
-    sha256 = "sha256-RZxGSrtEa3hAtowD2lUb9BgwpSWlYo90fU9nDvUfoAk=";
+    sha256 = "sha256-NbNXyR5aNKvRJU9JWGk/ndwU1bhNgDOdcRqBkAY9nPA=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
     libtmux
     docutils
+    pyfzf
     pyperclip
+    pyyaml
   ];
 
   # Project has no tests
diff --git a/pkgs/tools/security/badrobot/default.nix b/pkgs/tools/security/badrobot/default.nix
new file mode 100644
index 0000000000000..30123d3c4f7a2
--- /dev/null
+++ b/pkgs/tools/security/badrobot/default.nix
@@ -0,0 +1,45 @@
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
+
+buildGoModule rec {
+  pname = "badrobot";
+  version = "0.1.2";
+
+  src = fetchFromGitHub {
+    owner = "controlplaneio";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-LGoNM8wu1qaq4cVEzR723/cueZlndE1Z2PCYEOU+nPQ=";
+  };
+  vendorSha256 = "sha256-FS4kFVi+3NOJOfWfy5m/hDrQvCzpmsNSB/PliF6cVps=";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/controlplaneio/badrobot/cmd.version=v${version}"
+  ];
+
+  postInstall = ''
+    installShellCompletion --cmd badrobot \
+      --bash <($out/bin/badrobot completion bash) \
+      --fish <($out/bin/badrobot completion fish) \
+      --zsh <($out/bin/badrobot completion zsh)
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/controlplaneio/badrobot";
+    changelog = "https://github.com/controlplaneio/badrobot/blob/v${version}/CHANGELOG.md";
+    description = "Operator Security Audit Tool";
+    longDescription = ''
+      Badrobot is a Kubernetes Operator audit tool. It statically analyses
+      manifests for high risk configurations such as lack of security
+      restrictions on the deployed controller and the permissions of an
+      associated clusterole. The risk analysis is primarily focussed on the
+      likelihood that a compromised Operator would be able to obtain full
+      cluster permissions.
+    '';
+    license = with licenses; [ asl20 ];
+    maintainers = with maintainers; [ jk ];
+  };
+}
diff --git a/pkgs/tools/security/exploitdb/default.nix b/pkgs/tools/security/exploitdb/default.nix
index 5fc46e66629d1..8ac6771f3589f 100644
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2022-05-13";
+  version = "2022-05-18";
 
   src = fetchFromGitHub {
     owner = "offensive-security";
     repo = pname;
     rev = "refs/tags/${version}";
-    sha256 = "sha256-hSsVgH6iyfTrHwu/fNc00zhheys8mYYmuDAKJqSWGqo=";
+    sha256 = "sha256-E2QPeSlsJCRhnwgxr1NerLkSFbLLaTSLl8oeYsHQM+U=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/security/kube-hunter/default.nix b/pkgs/tools/security/kube-hunter/default.nix
index 0f82cc0cbab74..d9ef1f3825215 100644
--- a/pkgs/tools/security/kube-hunter/default.nix
+++ b/pkgs/tools/security/kube-hunter/default.nix
@@ -5,13 +5,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "kube-hunter";
-  version = "0.6.7";
+  version = "0.6.8";
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-W7jW0V91o164EIAzZ7ODWeqTmUaUFDIqlE37x/AycqY=";
+    sha256 = "sha256-+M8P/VSF9SKPvq+yNPjokyhggY7hzQ9qLLhkiTNbJls=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/security/libmodsecurity/default.nix b/pkgs/tools/security/libmodsecurity/default.nix
index 4ba294e42f260..531f88333d057 100644
--- a/pkgs/tools/security/libmodsecurity/default.nix
+++ b/pkgs/tools/security/libmodsecurity/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub
 , autoreconfHook, bison, flex, pkg-config
 , curl, geoip, libmaxminddb, libxml2, lmdb, lua, pcre
-, ssdeep, valgrind, yajl
+, ssdeep, yajl
 , nixosTests
 }:
 
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ autoreconfHook bison flex pkg-config ];
-  buildInputs = [ curl geoip libmaxminddb libxml2 lmdb lua pcre ssdeep valgrind yajl ];
+  buildInputs = [ curl geoip libmaxminddb libxml2 lmdb lua pcre ssdeep yajl ];
 
   outputs = [ "out" "dev" ];
 
diff --git a/pkgs/tools/security/nuclei/default.nix b/pkgs/tools/security/nuclei/default.nix
index 2145c5fc3339f..076b907d880e8 100644
--- a/pkgs/tools/security/nuclei/default.nix
+++ b/pkgs/tools/security/nuclei/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "nuclei";
-  version = "2.7.0";
+  version = "2.7.1";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-+yoxpdEU5TDOJsLRXBwddzAIBAzdSu8hdcvhuCWZxtc=";
+    sha256 = "sha256-ra8BxM+zpe5UKlJ28wc8yE5ta4ro4o2OHfmu9fBqFTA=";
   };
 
-  vendorSha256 = "sha256-6BC8jf/XaC7W6vsQEFIyIZ0S8XLJv+dFlaFl9VEO7yc=";
+  vendorSha256 = "sha256-4E9nHBaojkOwnSPxRn2JGFcQTF4WowTOtzE5zRjkqhk=";
 
   modRoot = "./v2";
   subPackages = [
diff --git a/pkgs/tools/security/terrascan/default.nix b/pkgs/tools/security/terrascan/default.nix
index 02f3615233ae6..e5ec1d444ce6e 100644
--- a/pkgs/tools/security/terrascan/default.nix
+++ b/pkgs/tools/security/terrascan/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "terrascan";
-  version = "1.14.0";
+  version = "1.15.0";
 
   src = fetchFromGitHub {
     owner = "accurics";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-O4oLtbijTAgUD+X3rxJkH2VmWLX5nQaN5JwoznNpKOM=";
+    sha256 = "sha256-up79ryjN9WciEl6fVgTLUZHhXSu7+utQB2ACPAx207E=";
   };
 
-  vendorSha256 = "sha256-dfd5yQ3t23YyFin770UlCtEIldRxTqeWfgl0GLLF+Qw=";
+  vendorSha256 = "sha256-EfHcCk2NkicSPeJYgHJT2kh9EwLldksET75ZQambrWA=";
 
   # Tests want to download a vulnerable Terraform project
   doCheck = false;
diff --git a/pkgs/tools/system/ddrutility/default.nix b/pkgs/tools/system/ddrutility/default.nix
index 02c89b2298907..ce5e16e4eb4bf 100644
--- a/pkgs/tools/system/ddrutility/default.nix
+++ b/pkgs/tools/system/ddrutility/default.nix
@@ -13,6 +13,11 @@ stdenv.mkDerivation rec {
     substituteInPlace makefile --replace /usr/local ""
   '';
 
+  # Workaround build failure on -fno-common toolchains like upstream
+  # gcc-10. Otherwise build fails as:
+  #   ld: /build/ccltHly5.o:(.bss+0x119f8): multiple definition of `start_time'; /build/cc9evx3L.o:(.bss+0x10978): first defined here
+  NIX_CFLAGS_COMPILE = "-fcommon";
+
   makeFlags = [ "DESTDIR=$(out)" ];
 
   meta = with lib; {
diff --git a/pkgs/tools/text/tab/default.nix b/pkgs/tools/text/tab/default.nix
index 18d3e3d004ad5..b70171e2908c5 100644
--- a/pkgs/tools/text/tab/default.nix
+++ b/pkgs/tools/text/tab/default.nix
@@ -1,24 +1,20 @@
 { lib, stdenv, fetchFromGitHub, python3 }:
 
 stdenv.mkDerivation rec {
-  version = "9.0";
+  version = "9.1";
   pname = "tab";
 
   src = fetchFromGitHub {
     owner = "ivan-tkatchev";
     repo = pname;
     rev = version;
-    sha256 = "sha256-2keVGPRYV2KCeJ+LgAcl74cjW5wvp6Rmy7VNMtdliBE=";
+    sha256 = "sha256-AhgWeV/ojB8jM16A5ggrOD1YjWfRVcoQbkd3S2bgdyE=";
   };
 
   checkInputs = [ python3 ];
 
   doCheck = !stdenv.isDarwin;
 
-  preCheck = ''
-    substituteInPlace Makefile --replace "python2 go2.py" "python go.py"
-  '';
-
   checkTarget = "test";
 
   installPhase = ''
@@ -32,7 +28,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Programming language/shell calculator";
-    homepage    = "https://tkatchev.bitbucket.io/tab/";
+    homepage    = "http://tab-lang.xyz";
     license     = licenses.boost;
     maintainers = with maintainers; [ mstarzyk ];
     platforms   = with platforms; unix;
diff --git a/pkgs/tools/text/vale/default.nix b/pkgs/tools/text/vale/default.nix
index dac2cfc0d9605..f53816c46f20c 100644
--- a/pkgs/tools/text/vale/default.nix
+++ b/pkgs/tools/text/vale/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "vale";
-  version = "2.16.0";
+  version = "2.17.0";
 
   subPackages = [ "cmd/vale" ];
   outputs = [ "out" "data" ];
@@ -11,10 +11,10 @@ buildGoModule rec {
     owner = "errata-ai";
     repo = "vale";
     rev = "v${version}";
-    sha256 = "sha256-kqyktQxQX4/jBj6vBw1VXRzD5D3wfLwnfi+QKgEqN5A=";
+    sha256 = "sha256-PUaIx6rEaLz0HUxkglsVHw0Kx/ovI2f4Yhknuysr5Gs=";
   };
 
-  vendorSha256 = "sha256-EFuzbSVIhsGUJ8a2YoQHOq7BQpOHV43r9VKynR8UZ7k=";
+  vendorSha256 = "sha256-zdgLWEArmtHTDM844LoSJwKp0UGoAR8bHnFOSlrrjdg=";
 
   postInstall = ''
     mkdir -p $data/share/vale
diff --git a/pkgs/tools/text/xml/xmldiff/default.nix b/pkgs/tools/text/xml/xmldiff/default.nix
index 5814435e111b9..d9dbd70b6483c 100644
--- a/pkgs/tools/text/xml/xmldiff/default.nix
+++ b/pkgs/tools/text/xml/xmldiff/default.nix
@@ -2,6 +2,7 @@
 , buildPythonApplication
 , fetchFromGitHub
 , lxml
+, setuptools
 , six
 }:
 
@@ -16,8 +17,9 @@ buildPythonApplication rec {
     hash = "sha256-xqudHYfwOce2C0pcFzId0JDIIC6R5bllmVKsH+CvTdE=";
   };
 
-  buildInputs = [
+  propagatedBuildInputs = [
     lxml
+    setuptools
     six
   ];
 
@@ -36,6 +38,6 @@ buildPythonApplication rec {
       readable diffs in those situations.
     '';
     license = licenses.mit;
-    maintainers = with maintainers; [ AndersonTorres ];
+    maintainers = with maintainers; [ AndersonTorres anpryl ];
   };
 }
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index eb5340740efa7..b926e36bc9ae4 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -170,6 +170,7 @@ mapAliases ({
   cifs_utils = throw "'cifs_utils' has been renamed to/replaced by 'cifs-utils'"; # Converted to throw 2022-02-22
   cipherscan = throw "cipherscan was removed from nixpkgs, as it was unmaintained"; # added 2021-12-11
   ckb = throw "'ckb' has been renamed to/replaced by 'ckb-next'"; # Converted to throw 2022-02-22
+  cpp-ipfs-api = cpp-ipfs-http-client; # Project has been renamed. Added 2022-05-15
   creddump = throw "creddump has been removed from nixpkgs as the upstream has abandoned the project"; # Added 2022-01-01
 
   # these are for convenience, not for backward compat and shouldn't expire
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 743d67d5d6aa3..0d763d9f5d1e1 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1428,7 +1428,6 @@ with pkgs;
   ares = callPackage ../applications/emulators/bsnes/ares { };
 
   bsnes-hd = callPackage ../applications/emulators/bsnes/bsnes-hd {
-    inherit (gnome2) gtksourceview;
     inherit (darwin.apple_sdk.frameworks) Cocoa OpenAL;
   };
 
@@ -2577,6 +2576,8 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) Security;
   };
 
+  badrobot = callPackage ../tools/security/badrobot {};
+
   bao = callPackage ../tools/security/bao {};
 
   bar = callPackage ../tools/system/bar {};
@@ -7767,6 +7768,10 @@ with pkgs;
 
   mtail = callPackage ../servers/monitoring/mtail { };
 
+  mujmap = callPackage ../applications/networking/mujmap {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
+
   multitail = callPackage ../tools/misc/multitail { };
 
   mx-puppet-discord = callPackage ../servers/mx-puppet-discord { };
@@ -10972,7 +10977,7 @@ with pkgs;
 
   toybox = callPackage ../tools/misc/toybox { };
 
-  tpmmanager = callPackage ../applications/misc/tpmmanager { };
+  tpmmanager = libsForQt5.callPackage ../applications/misc/tpmmanager { };
 
   tpm-quote-tools = callPackage ../tools/security/tpm-quote-tools { };
 
@@ -14788,7 +14793,14 @@ with pkgs;
   autoadb = callPackage ../misc/autoadb { };
 
   ansible = ansible_2_12;
-  ansible_2_12 = python3Packages.toPythonApplication python3Packages.ansible-core;
+  ansible_2_13 = python3Packages.toPythonApplication python3Packages.ansible-core;
+  ansible_2_12 = python3Packages.toPythonApplication (python3Packages.ansible-core.overridePythonAttrs (oldAttrs: rec {
+    version = "2.12.5";
+    src = oldAttrs.src.override {
+      inherit version;
+      hash = "sha256-HMyZRPEBMxra0e1A1axmqBSRMwUq402wJnp0qnO+67M=";
+    };
+  }));
 
   ansible-doctor = with python3.pkgs; toPythonApplication ansible-doctor;
 
@@ -16876,7 +16888,7 @@ with pkgs;
 
   cpp-hocon = callPackage ../development/libraries/cpp-hocon { };
 
-  cpp-ipfs-api = callPackage ../development/libraries/cpp-ipfs-api { };
+  cpp-ipfs-http-client = callPackage ../development/libraries/cpp-ipfs-http-client { };
 
   cpp-netlib = callPackage ../development/libraries/cpp-netlib {
     boost = boost169; # fatal error: 'boost/asio/stream_socket_service.hpp' file not found
@@ -20285,6 +20297,8 @@ with pkgs;
 
   rinutils = callPackage ../development/libraries/rinutils { };
 
+  rtrlib = callPackage ../development/libraries/rtrlib { };
+
   kissfft = callPackage ../development/libraries/kissfft { };
 
   lambdabot = callPackage ../development/tools/haskell/lambdabot {
@@ -21580,6 +21594,8 @@ with pkgs;
 
   bird = callPackage ../servers/bird { };
 
+  bloat = callPackage ../servers/bloat { };
+
   bosun = callPackage ../servers/monitoring/bosun { };
 
   cayley = callPackage ../servers/cayley { };
@@ -23652,6 +23668,8 @@ with pkgs;
 
   rtkit = callPackage ../os-specific/linux/rtkit { };
 
+  rt-tests = callPackage ../os-specific/linux/rt-tests { };
+
   rt5677-firmware = callPackage ../os-specific/linux/firmware/rt5677 { };
 
   rtl8192su-firmware = callPackage ../os-specific/linux/firmware/rtl8192su-firmware { };
@@ -25811,6 +25829,7 @@ with pkgs;
   drawing = callPackage ../applications/graphics/drawing { };
 
   drawio = callPackage ../applications/graphics/drawio {};
+  drawio-headless = callPackage ../applications/graphics/drawio/headless.nix { };
 
   drawpile = libsForQt5.callPackage ../applications/graphics/drawpile { };
   drawpile-server-headless = libsForQt5.callPackage ../applications/graphics/drawpile {
@@ -29879,6 +29898,10 @@ with pkgs;
     buildGoModule = buildGo118Module;
   };
 
+  temporal-cli = callPackage ../applications/networking/cluster/temporal-cli {
+    buildGoModule = buildGo118Module;
+  };
+
   tenacity = callPackage ../applications/audio/tenacity { wxGTK = wxGTK31-gtk3; };
 
   tendermint = callPackage ../tools/networking/tendermint { };
diff --git a/pkgs/top-level/config.nix b/pkgs/top-level/config.nix
index 8c15e63e5fb1d..853e6c76ab547 100644
--- a/pkgs/top-level/config.nix
+++ b/pkgs/top-level/config.nix
@@ -20,6 +20,11 @@ let
 
     /* Internal stuff */
 
+    # Hide built-in module system options from docs.
+    _module.args = mkOption {
+      internal = true;
+    };
+
     warnings = mkOption {
       type = types.listOf types.str;
       default = [];
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 3c97d570a905a..ced4f28cea6b1 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -19533,7 +19533,7 @@ let
       url = "mirror://cpan/authors/id/Y/YV/YVES/Sereal-4.018.tar.gz";
       sha256 = "0pqygrl88jp2w73jd9cw4k22fhvh5vcwqbiwl9wpxm67ql95cwwa";
     };
-    buildInputs = [ TestDeep TestLongString TestMemoryGrowth TestWarn ];
+    buildInputs = [ TestDeep TestLongString TestWarn ];
     propagatedBuildInputs = [ SerealDecoder SerealEncoder ];
     meta = {
       homepage = "https://github.com/Sereal/Sereal";
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 0ed03be8d5e1f..e9f377f585841 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -7232,6 +7232,10 @@ in {
 
   pyfxa = callPackage ../development/python-modules/pyfxa { };
 
+  pyfzf = callPackage ../development/python-modules/pyfzf {
+    inherit (pkgs) fzf;
+  };
+
   pygal = callPackage ../development/python-modules/pygal { };
 
   pygame = callPackage ../development/python-modules/pygame {