about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--lib/default.nix3
-rw-r--r--lib/options.nix6
-rw-r--r--maintainers/maintainer-list.nix20
-rw-r--r--maintainers/team-list.nix10
-rw-r--r--nixos/doc/manual/from_md/release-notes/rl-2205.section.xml8
-rw-r--r--nixos/doc/manual/from_md/release-notes/rl-2211.section.xml89
-rw-r--r--nixos/doc/manual/release-notes/rl-2205.section.md2
-rw-r--r--nixos/doc/manual/release-notes/rl-2211.section.md37
-rw-r--r--nixos/modules/config/i18n.nix3
-rw-r--r--nixos/modules/installer/tools/nixos-generate-config.pl9
-rw-r--r--nixos/modules/misc/ids.nix4
-rw-r--r--nixos/modules/misc/nixpkgs.nix108
-rw-r--r--nixos/modules/misc/nixpkgs/test.nix61
-rw-r--r--nixos/modules/module-list.nix4
-rw-r--r--nixos/modules/profiles/minimal.nix3
-rw-r--r--nixos/modules/rename.nix1
-rw-r--r--nixos/modules/services/databases/riak.nix162
-rw-r--r--nixos/modules/services/hardware/argonone.nix58
-rw-r--r--nixos/modules/services/mail/schleuder.nix162
-rw-r--r--nixos/modules/services/matrix/appservice-irc.nix3
-rw-r--r--nixos/modules/services/misc/gitlab.nix28
-rw-r--r--nixos/modules/services/networking/routedns.nix84
-rw-r--r--nixos/modules/services/networking/tailscale.nix13
-rw-r--r--nixos/modules/services/networking/trickster.nix20
-rw-r--r--nixos/modules/services/web-apps/tt-rss.nix1
-rw-r--r--nixos/tests/all-tests.nix2
-rw-r--r--nixos/tests/kernel-generic.nix1
-rw-r--r--nixos/tests/matrix/appservice-irc.nix3
-rw-r--r--nixos/tests/riak.nix18
-rw-r--r--nixos/tests/schleuder.nix128
-rw-r--r--nixos/tests/systemd-networkd-vrf.nix65
-rw-r--r--nixos/tests/traefik.nix22
-rw-r--r--nixos/tests/vengi-tools.nix2
-rw-r--r--pkgs/applications/audio/baudline/default.nix1
-rw-r--r--pkgs/applications/audio/easyeffects/default.nix4
-rw-r--r--pkgs/applications/audio/geonkick/default.nix4
-rw-r--r--pkgs/applications/audio/hqplayer-desktop/default.nix1
-rw-r--r--pkgs/applications/audio/losslessaudiochecker/default.nix1
-rw-r--r--pkgs/applications/audio/midas/generic.nix1
-rw-r--r--pkgs/applications/audio/ncpamixer/default.nix2
-rw-r--r--pkgs/applications/audio/ocenaudio/default.nix1
-rw-r--r--pkgs/applications/audio/pocket-casts/default.nix1
-rw-r--r--pkgs/applications/audio/reaper/default.nix1
-rw-r--r--pkgs/applications/audio/redux/default.nix1
-rw-r--r--pkgs/applications/audio/renoise/default.nix1
-rw-r--r--pkgs/applications/audio/rymcast/default.nix1
-rwxr-xr-xpkgs/applications/audio/soundwireserver/default.nix1
-rw-r--r--pkgs/applications/audio/spotify/default.nix1
-rw-r--r--pkgs/applications/audio/sunvox/default.nix1
-rw-r--r--pkgs/applications/audio/tidal-hifi/default.nix119
-rw-r--r--pkgs/applications/audio/tonelib-gfx/default.nix1
-rw-r--r--pkgs/applications/audio/tonelib-jam/default.nix1
-rw-r--r--pkgs/applications/audio/tonelib-metal/default.nix1
-rw-r--r--pkgs/applications/audio/tonelib-zoom/default.nix1
-rw-r--r--pkgs/applications/audio/transcribe/default.nix1
-rw-r--r--pkgs/applications/audio/virtual-ans/default.nix1
-rw-r--r--pkgs/applications/blockchains/exodus/default.nix1
-rw-r--r--pkgs/applications/blockchains/sparrow/default.nix4
-rw-r--r--pkgs/applications/blockchains/wasabibackend/default.nix1
-rw-r--r--pkgs/applications/blockchains/wasabiwallet/default.nix1
-rw-r--r--pkgs/applications/editors/atom/default.nix1
-rw-r--r--pkgs/applications/editors/eclipse/build-eclipse.nix1
-rw-r--r--pkgs/applications/editors/pinegrow/default.nix1
-rw-r--r--pkgs/applications/editors/quartus-prime/quartus.nix1
-rw-r--r--pkgs/applications/editors/rehex/default.nix2
-rw-r--r--pkgs/applications/editors/sublime/2/default.nix1
-rw-r--r--pkgs/applications/editors/sublime/3/common.nix1
-rw-r--r--pkgs/applications/editors/sublime/4/common.nix1
-rw-r--r--pkgs/applications/editors/vim/default.nix13
-rw-r--r--pkgs/applications/editors/vim/plugins/generated.nix844
-rw-r--r--pkgs/applications/editors/vim/plugins/overrides.nix88
-rwxr-xr-xpkgs/applications/editors/vim/plugins/update.py8
-rw-r--r--pkgs/applications/editors/vscode/extensions/default.nix33
-rw-r--r--pkgs/applications/emulators/atari800/default.nix4
-rw-r--r--pkgs/applications/emulators/kega-fusion/default.nix1
-rw-r--r--pkgs/applications/emulators/wine/base.nix4
-rw-r--r--pkgs/applications/finance/cryptowatch/default.nix1
-rw-r--r--pkgs/applications/gis/udig/default.nix1
-rw-r--r--pkgs/applications/graphics/avocode/default.nix1
-rw-r--r--pkgs/applications/graphics/drawio/default.nix1
-rw-r--r--pkgs/applications/graphics/fiji/default.nix5
-rw-r--r--pkgs/applications/graphics/freecad/default.nix4
-rw-r--r--pkgs/applications/graphics/kodelife/default.nix1
-rw-r--r--pkgs/applications/graphics/lightburn/default.nix1
-rw-r--r--pkgs/applications/graphics/odafileconverter/default.nix1
-rw-r--r--pkgs/applications/graphics/pencil/default.nix1
-rw-r--r--pkgs/applications/graphics/pixeluvo/default.nix1
-rw-r--r--pkgs/applications/graphics/pixinsight/default.nix1
-rw-r--r--pkgs/applications/graphics/sane/backends/brscan4/default.nix1
-rw-r--r--pkgs/applications/graphics/sane/backends/brscan5/default.nix1
-rw-r--r--pkgs/applications/graphics/sane/backends/dsseries/default.nix1
-rw-r--r--pkgs/applications/graphics/solvespace/default.nix8
-rw-r--r--pkgs/applications/graphics/unigine-heaven/default.nix1
-rw-r--r--pkgs/applications/graphics/unigine-sanctuary/default.nix1
-rw-r--r--pkgs/applications/graphics/unigine-superposition/default.nix1
-rw-r--r--pkgs/applications/graphics/unigine-tropics/default.nix1
-rw-r--r--pkgs/applications/graphics/unigine-valley/default.nix1
-rw-r--r--pkgs/applications/graphics/vengi-tools/default.nix4
-rw-r--r--pkgs/applications/graphics/write_stylus/default.nix1
-rw-r--r--pkgs/applications/misc/1password-gui/beta.nix1
-rw-r--r--pkgs/applications/misc/1password-gui/default.nix1
-rw-r--r--pkgs/applications/misc/1password/default.nix12
-rw-r--r--pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix3
-rw-r--r--pkgs/applications/misc/adobe-reader/default.nix1
-rw-r--r--pkgs/applications/misc/anytype/default.nix4
-rw-r--r--pkgs/applications/misc/authy/default.nix1
-rw-r--r--pkgs/applications/misc/azuredatastudio/default.nix1
-rw-r--r--pkgs/applications/misc/binance/default.nix5
-rw-r--r--pkgs/applications/misc/confclerk/default.nix18
-rw-r--r--pkgs/applications/misc/dbeaver/default.nix4
-rw-r--r--pkgs/applications/misc/debian-goodies/default.nix4
-rw-r--r--pkgs/applications/misc/foxitreader/default.nix1
-rw-r--r--pkgs/applications/misc/gometer/default.nix1
-rw-r--r--pkgs/applications/misc/googleearth-pro/default.nix1
-rw-r--r--pkgs/applications/misc/hollywood/default.nix94
-rw-r--r--pkgs/applications/misc/hollywood/nixos-paths.patch67
-rw-r--r--pkgs/applications/misc/hubstaff/default.nix1
-rw-r--r--pkgs/applications/misc/icesl/default.nix1
-rw-r--r--pkgs/applications/misc/ideamaker/default.nix1
-rw-r--r--pkgs/applications/misc/ipmicfg/default.nix1
-rw-r--r--pkgs/applications/misc/ipmiview/default.nix5
-rw-r--r--pkgs/applications/misc/join-desktop/default.nix1
-rw-r--r--pkgs/applications/misc/josm/default.nix6
-rw-r--r--pkgs/applications/misc/jotta-cli/default.nix1
-rw-r--r--pkgs/applications/misc/kdbplus/default.nix1
-rw-r--r--pkgs/applications/misc/koreader/default.nix1
-rw-r--r--pkgs/applications/misc/masterpdfeditor/default.nix1
-rw-r--r--pkgs/applications/misc/masterpdfeditor4/default.nix1
-rw-r--r--pkgs/applications/misc/megacmd/default.nix4
-rw-r--r--pkgs/applications/misc/mystem/default.nix1
-rw-r--r--pkgs/applications/misc/octoprint/plugins.nix4
-rw-r--r--pkgs/applications/misc/organicmaps/default.nix16
-rw-r--r--pkgs/applications/misc/pdfsam-basic/default.nix4
-rw-r--r--pkgs/applications/misc/pdfstudio/common.nix4
-rw-r--r--pkgs/applications/misc/playonlinux/default.nix1
-rw-r--r--pkgs/applications/misc/polar-bookshelf/default.nix1
-rw-r--r--pkgs/applications/misc/premid/default.nix1
-rw-r--r--pkgs/applications/misc/prusa-slicer/default.nix55
-rw-r--r--pkgs/applications/misc/rescuetime/default.nix1
-rw-r--r--pkgs/applications/misc/robo3t/default.nix1
-rw-r--r--pkgs/applications/misc/sidequest/default.nix1
-rw-r--r--pkgs/applications/misc/signumone-ks/default.nix4
-rw-r--r--pkgs/applications/misc/simplenote/default.nix1
-rw-r--r--pkgs/applications/misc/skytemple/default.nix22
-rw-r--r--pkgs/applications/misc/snapmaker-luban/default.nix1
-rw-r--r--pkgs/applications/misc/snowsql/default.nix1
-rw-r--r--pkgs/applications/misc/thedesk/default.nix1
-rw-r--r--pkgs/applications/misc/upwork/default.nix1
-rw-r--r--pkgs/applications/misc/whalebird/default.nix1
-rw-r--r--pkgs/applications/misc/xkblayout-state/default.nix4
-rw-r--r--pkgs/applications/misc/xmind/default.nix5
-rw-r--r--pkgs/applications/networking/aether/default.nix1
-rw-r--r--pkgs/applications/networking/apache-directory-studio/default.nix4
-rw-r--r--pkgs/applications/networking/appgate-sdp/default.nix1
-rw-r--r--pkgs/applications/networking/blocky/default.nix6
-rw-r--r--pkgs/applications/networking/browsers/brave/default.nix1
-rw-r--r--pkgs/applications/networking/browsers/chromium/common.nix4
-rw-r--r--pkgs/applications/networking/browsers/chromium/patches/m102-fix-dawn_version_generator-failure.patch43
-rw-r--r--pkgs/applications/networking/browsers/chromium/upstream-info.json16
-rw-r--r--pkgs/applications/networking/browsers/firefox/wrapper.nix7
-rw-r--r--pkgs/applications/networking/browsers/vivaldi/ffmpeg-codecs.nix1
-rw-r--r--pkgs/applications/networking/browsers/vivaldi/widevine.nix1
-rw-r--r--pkgs/applications/networking/cisco-packet-tracer/7.nix1
-rw-r--r--pkgs/applications/networking/cisco-packet-tracer/8.nix1
-rw-r--r--pkgs/applications/networking/cluster/argocd/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/cilium/default.nix23
-rw-r--r--pkgs/applications/networking/cluster/fluxcd/default.nix8
-rw-r--r--pkgs/applications/networking/cluster/helm-docs/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/kubernetes/default.nix31
-rw-r--r--pkgs/applications/networking/cluster/kubernetes/kubectl.nix13
-rw-r--r--pkgs/applications/networking/cluster/octant/default.nix1
-rw-r--r--pkgs/applications/networking/cluster/ssm-session-manager-plugin/default.nix1
-rw-r--r--pkgs/applications/networking/cluster/talosctl/default.nix42
-rw-r--r--pkgs/applications/networking/cluster/temporal-cli/default.nix17
-rw-r--r--pkgs/applications/networking/cluster/velero/default.nix8
-rw-r--r--pkgs/applications/networking/cluster/werf/default.nix6
-rw-r--r--pkgs/applications/networking/feedreaders/indigenous-desktop/default.nix1
-rw-r--r--pkgs/applications/networking/flexget/default.nix4
-rw-r--r--pkgs/applications/networking/hpmyroom/default.nix1
-rw-r--r--pkgs/applications/networking/instant-messengers/alfaview/default.nix1
-rw-r--r--pkgs/applications/networking/instant-messengers/bluejeans/default.nix1
-rw-r--r--pkgs/applications/networking/instant-messengers/chatty/default.nix5
-rw-r--r--pkgs/applications/networking/instant-messengers/discord/darwin.nix10
-rw-r--r--pkgs/applications/networking/instant-messengers/discord/default.nix9
-rw-r--r--pkgs/applications/networking/instant-messengers/discord/linux.nix10
-rw-r--r--pkgs/applications/networking/instant-messengers/discord/openasar.nix42
-rw-r--r--pkgs/applications/networking/instant-messengers/ferdi/default.nix1
-rw-r--r--pkgs/applications/networking/instant-messengers/franz/default.nix1
-rw-r--r--pkgs/applications/networking/instant-messengers/gitter/default.nix1
-rw-r--r--pkgs/applications/networking/instant-messengers/hipchat/default.nix1
-rw-r--r--pkgs/applications/networking/instant-messengers/jitsi/default.nix5
-rw-r--r--pkgs/applications/networking/instant-messengers/mattermost-desktop/default.nix1
-rw-r--r--pkgs/applications/networking/instant-messengers/ripcord/darwin.nix1
-rw-r--r--pkgs/applications/networking/instant-messengers/ripcord/default.nix1
-rw-r--r--pkgs/applications/networking/instant-messengers/rocketchat-desktop/default.nix1
-rw-r--r--pkgs/applications/networking/instant-messengers/signal-desktop/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/sky/default.nix1
-rw-r--r--pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix1
-rw-r--r--pkgs/applications/networking/instant-messengers/slack/default.nix1
-rw-r--r--pkgs/applications/networking/instant-messengers/teams/default.nix1
-rw-r--r--pkgs/applications/networking/instant-messengers/teamspeak/client.nix1
-rw-r--r--pkgs/applications/networking/instant-messengers/teamspeak/server.nix1
-rw-r--r--pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/threema-desktop/default.nix7
-rw-r--r--pkgs/applications/networking/instant-messengers/viber/default.nix1
-rw-r--r--pkgs/applications/networking/instant-messengers/vk-cli/default.nix1
-rw-r--r--pkgs/applications/networking/instant-messengers/vk-messenger/default.nix1
-rw-r--r--pkgs/applications/networking/instant-messengers/wire-desktop/default.nix1
-rw-r--r--pkgs/applications/networking/instant-messengers/zoom-us/default.nix1
-rw-r--r--pkgs/applications/networking/insync/default.nix1
-rw-r--r--pkgs/applications/networking/insync/v3.nix1
-rw-r--r--pkgs/applications/networking/mailreaders/mailspring/default.nix1
-rw-r--r--pkgs/applications/networking/mailreaders/thunderbird-bin/default.nix1
-rw-r--r--pkgs/applications/networking/mullvad-vpn/default.nix1
-rw-r--r--pkgs/applications/networking/p2p/frostwire/frostwire-bin.nix9
-rw-r--r--pkgs/applications/networking/p2p/jesec-rtorrent/default.nix4
-rw-r--r--pkgs/applications/networking/p2p/rakshasa-rtorrent/default.nix4
-rw-r--r--pkgs/applications/networking/p2p/soulseekqt/default.nix1
-rw-r--r--pkgs/applications/networking/p2p/tixati/default.nix1
-rw-r--r--pkgs/applications/networking/pcloud/default.nix1
-rw-r--r--pkgs/applications/networking/remote/anydesk/default.nix5
-rw-r--r--pkgs/applications/networking/remote/aws-workspaces/default.nix1
-rw-r--r--pkgs/applications/networking/remote/citrix-workspace/generic.nix1
-rw-r--r--pkgs/applications/networking/remote/nice-dcv-client/default.nix1
-rw-r--r--pkgs/applications/networking/remote/teamviewer/default.nix1
-rw-r--r--pkgs/applications/networking/resilio-sync/default.nix1
-rw-r--r--pkgs/applications/networking/scaleft/default.nix1
-rw-r--r--pkgs/applications/networking/sniffers/sngrep/default.nix4
-rw-r--r--pkgs/applications/networking/spideroak/default.nix1
-rw-r--r--pkgs/applications/networking/sync/onedrive/default.nix4
-rw-r--r--pkgs/applications/networking/syncthing-gtk/paths.patch22
-rw-r--r--pkgs/applications/networking/synology-drive-client/default.nix1
-rw-r--r--pkgs/applications/networking/termius/default.nix1
-rw-r--r--pkgs/applications/networking/tetrd/default.nix1
-rw-r--r--pkgs/applications/office/appflowy/default.nix1
-rw-r--r--pkgs/applications/office/jabref/default.nix1
-rw-r--r--pkgs/applications/office/libreoffice/default.nix2
-rw-r--r--pkgs/applications/office/mendeley/default.nix1
-rw-r--r--pkgs/applications/office/moneyplex/default.nix1
-rw-r--r--pkgs/applications/office/morgen/default.nix1
-rw-r--r--pkgs/applications/office/onlyoffice-bin/default.nix1
-rw-r--r--pkgs/applications/office/portfolio/default.nix5
-rw-r--r--pkgs/applications/office/qownnotes/default.nix4
-rw-r--r--pkgs/applications/office/softmaker/generic.nix1
-rw-r--r--pkgs/applications/office/wpsoffice/default.nix1
-rw-r--r--pkgs/applications/office/zotero/default.nix1
-rw-r--r--pkgs/applications/radio/gnuradio/3.9.nix4
-rw-r--r--pkgs/applications/radio/gnuradio/default.nix4
-rw-r--r--pkgs/applications/radio/js8call/cmake.patch69
-rw-r--r--pkgs/applications/radio/js8call/default.nix65
-rw-r--r--pkgs/applications/radio/sdrplay/default.nix1
-rw-r--r--pkgs/applications/science/biology/flywheel-cli/default.nix1
-rw-r--r--pkgs/applications/science/biology/quast/default.nix4
-rw-r--r--pkgs/applications/science/electronics/bitscope/common.nix1
-rw-r--r--pkgs/applications/science/electronics/eagle/eagle.nix1
-rw-r--r--pkgs/applications/science/electronics/picoscope/default.nix2
-rw-r--r--pkgs/applications/science/logic/isabelle/default.nix20
-rw-r--r--pkgs/applications/science/logic/nuXmv/default.nix1
-rw-r--r--pkgs/applications/science/logic/saw-tools/default.nix1
-rw-r--r--pkgs/applications/science/logic/tlaplus/toolbox.nix1
-rw-r--r--pkgs/applications/science/logic/tptp/default.nix1
-rw-r--r--pkgs/applications/science/logic/verifast/default.nix1
-rw-r--r--pkgs/applications/science/logic/z3/4.4.0.nix2
-rw-r--r--pkgs/applications/science/machine-learning/sc2-headless/default.nix1
-rw-r--r--pkgs/applications/science/math/cplex/default.nix1
-rw-r--r--pkgs/applications/science/math/geogebra/default.nix4
-rw-r--r--pkgs/applications/science/math/geogebra/geogebra6.nix6
-rw-r--r--pkgs/applications/science/math/gurobi/default.nix5
-rw-r--r--pkgs/applications/science/math/hmetis/default.nix1
-rw-r--r--pkgs/applications/science/math/mathematica/generic.nix2
-rw-r--r--pkgs/applications/science/math/scilab-bin/default.nix1
-rw-r--r--pkgs/applications/science/math/wolfram-engine/default.nix1
-rw-r--r--pkgs/applications/science/medicine/aliza/default.nix1
-rw-r--r--pkgs/applications/science/misc/boinc/default.nix6
-rw-r--r--pkgs/applications/science/misc/foldingathome/client.nix1
-rw-r--r--pkgs/applications/science/misc/foldingathome/control.nix1
-rw-r--r--pkgs/applications/science/misc/foldingathome/viewer.nix1
-rw-r--r--pkgs/applications/science/programming/fdr/default.nix1
-rw-r--r--pkgs/applications/science/robotics/betaflight-configurator/default.nix7
-rw-r--r--pkgs/applications/science/robotics/emuflight-configurator/default.nix1
-rw-r--r--pkgs/applications/science/robotics/inav-configurator/default.nix1
-rw-r--r--pkgs/applications/terminal-emulators/dterm/default.nix (renamed from pkgs/tools/misc/dterm/default.nix)19
-rw-r--r--pkgs/applications/terminal-emulators/hyper/default.nix1
-rw-r--r--pkgs/applications/terminal-emulators/wezterm/default.nix6
-rw-r--r--pkgs/applications/version-management/bcompare/default.nix1
-rw-r--r--pkgs/applications/version-management/git-and-tools/git-quickfix/default.nix8
-rw-r--r--pkgs/applications/version-management/gitea/default.nix15
-rw-r--r--pkgs/applications/version-management/github-desktop/default.nix1
-rw-r--r--pkgs/applications/version-management/gitkraken/default.nix1
-rw-r--r--pkgs/applications/version-management/gitlab/Remove-geo-from-database.yml.patch69
-rw-r--r--pkgs/applications/version-management/gitlab/data.json16
-rw-r--r--pkgs/applications/version-management/gitlab/default.nix14
-rw-r--r--pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock4
-rw-r--r--pkgs/applications/version-management/gitlab/gitaly/default.nix8
-rw-r--r--pkgs/applications/version-management/gitlab/gitaly/gemset.nix4
-rw-r--r--pkgs/applications/version-management/gitlab/gitlab-shell/default.nix6
-rw-r--r--pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix4
-rw-r--r--pkgs/applications/version-management/gitlab/rubyEnv/Gemfile48
-rw-r--r--pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock159
-rw-r--r--pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix261
-rw-r--r--pkgs/applications/version-management/meld/default.nix22
-rw-r--r--pkgs/applications/version-management/p4/default.nix1
-rw-r--r--pkgs/applications/version-management/p4v/default.nix1
-rw-r--r--pkgs/applications/version-management/sublime-merge/common.nix1
-rw-r--r--pkgs/applications/video/filebot/default.nix5
-rw-r--r--pkgs/applications/video/flirc/default.nix1
-rw-r--r--pkgs/applications/video/lightworks/default.nix1
-rw-r--r--pkgs/applications/video/makemkv/default.nix1
-rw-r--r--pkgs/applications/video/streamlink-twitch-gui/bin.nix1
-rw-r--r--pkgs/applications/video/vlc/default.nix2
-rw-r--r--pkgs/applications/virtualization/conmon/default.nix2
-rw-r--r--pkgs/applications/virtualization/docker/compose.nix6
-rw-r--r--pkgs/applications/virtualization/driver/win-signed-gplpv-drivers/default.nix1
-rw-r--r--pkgs/applications/virtualization/driver/win-spice/default.nix1
-rw-r--r--pkgs/applications/virtualization/virtualbox/default.nix4
-rw-r--r--pkgs/applications/virtualization/virtualbox/guest-additions/default.nix1
-rwxr-xr-xpkgs/applications/virtualization/vmware-workstation/default.nix1
-rw-r--r--pkgs/applications/window-managers/i3/status-rust.nix8
-rw-r--r--pkgs/data/fonts/victor-mono/default.nix14
-rw-r--r--pkgs/data/misc/v2ray-domain-list-community/default.nix4
-rw-r--r--pkgs/data/misc/v2ray-geoip/default.nix6
-rw-r--r--pkgs/data/themes/nordic/default.nix34
-rw-r--r--pkgs/development/compilers/gcc/4.9/default.nix6
-rw-r--r--pkgs/development/compilers/gcc/common/pre-configure.nix10
-rw-r--r--pkgs/development/compilers/hare/disable-failing-test-cases.patch37
-rw-r--r--pkgs/development/compilers/hare/hare.nix10
-rw-r--r--pkgs/development/compilers/hare/harec.nix6
-rw-r--r--pkgs/development/compilers/hare/setup-hook.sh11
-rw-r--r--pkgs/development/compilers/llvm/14/compiler-rt/armv7l.patch32
-rw-r--r--pkgs/development/compilers/llvm/14/compiler-rt/default.nix3
-rw-r--r--pkgs/development/interpreters/wasmtime/default.nix20
-rw-r--r--pkgs/development/libraries/amdvlk/default.nix4
-rw-r--r--pkgs/development/libraries/cpp-utilities/default.nix4
-rw-r--r--pkgs/development/libraries/doctest/default.nix4
-rw-r--r--pkgs/development/libraries/egl-wayland/default.nix4
-rw-r--r--pkgs/development/libraries/geos/default.nix15
-rw-r--r--pkgs/development/libraries/java/commons/daemon/default.nix4
-rw-r--r--pkgs/development/libraries/libkqueue/default.nix5
-rw-r--r--pkgs/development/libraries/libvgm/default.nix6
-rw-r--r--pkgs/development/libraries/libzip/default.nix4
-rw-r--r--pkgs/development/libraries/ncurses/default.nix12
-rw-r--r--pkgs/development/libraries/pipewire/default.nix12
-rw-r--r--pkgs/development/libraries/science/math/m4rie/default.nix4
-rw-r--r--pkgs/development/libraries/taskflow/default.nix4
-rw-r--r--pkgs/development/libraries/v8/8_x.nix1
-rw-r--r--pkgs/development/libraries/v8/default.nix1
-rw-r--r--pkgs/development/node-packages/main-programs.nix1
-rw-r--r--pkgs/development/ocaml-modules/ffmpeg/base.nix4
-rw-r--r--pkgs/development/ocaml-modules/fmt/default.nix4
-rw-r--r--pkgs/development/ocaml-modules/ocaml-r/default.nix2
-rw-r--r--pkgs/development/ocaml-modules/parmap/default.nix3
-rw-r--r--pkgs/development/ocaml-modules/pbkdf/default.nix17
-rw-r--r--pkgs/development/python-modules/ailment/default.nix4
-rw-r--r--pkgs/development/python-modules/aioswitcher/default.nix1
-rw-r--r--pkgs/development/python-modules/angr/default.nix4
-rw-r--r--pkgs/development/python-modules/angrop/default.nix9
-rw-r--r--pkgs/development/python-modules/archinfo/default.nix4
-rw-r--r--pkgs/development/python-modules/audible/default.nix6
-rw-r--r--pkgs/development/python-modules/aws-lambda-builders/default.nix4
-rw-r--r--pkgs/development/python-modules/bimmer-connected/default.nix4
-rw-r--r--pkgs/development/python-modules/claripy/default.nix4
-rw-r--r--pkgs/development/python-modules/cle/default.nix7
-rw-r--r--pkgs/development/python-modules/clickgen/default.nix3
-rw-r--r--pkgs/development/python-modules/connexion/default.nix4
-rw-r--r--pkgs/development/python-modules/crownstone-uart/default.nix4
-rw-r--r--pkgs/development/python-modules/diff-cover/default.nix4
-rw-r--r--pkgs/development/python-modules/django-allauth/default.nix4
-rw-r--r--pkgs/development/python-modules/django-debug-toolbar/default.nix4
-rw-r--r--pkgs/development/python-modules/django-oauth-toolkit/default.nix6
-rw-r--r--pkgs/development/python-modules/django-prometheus/default.nix4
-rw-r--r--pkgs/development/python-modules/django-prometheus/drop-untestable-database-backends.patch6
-rw-r--r--pkgs/development/python-modules/django-webpack-loader/default.nix4
-rw-r--r--pkgs/development/python-modules/dremel3dpy/default.nix10
-rw-r--r--pkgs/development/python-modules/drf-spectacular-sidecar/default.nix4
-rw-r--r--pkgs/development/python-modules/email-validator/default.nix3
-rw-r--r--pkgs/development/python-modules/eth-typing/default.nix4
-rw-r--r--pkgs/development/python-modules/expiringdict/default.nix4
-rw-r--r--pkgs/development/python-modules/fastapi-mail/default.nix4
-rw-r--r--pkgs/development/python-modules/flake8-bugbear/default.nix4
-rw-r--r--pkgs/development/python-modules/flask-admin/default.nix4
-rw-r--r--pkgs/development/python-modules/flask-appbuilder/default.nix4
-rw-r--r--pkgs/development/python-modules/flask-mongoengine/default.nix4
-rw-r--r--pkgs/development/python-modules/flask-security-too/default.nix4
-rw-r--r--pkgs/development/python-modules/flask-wtf/default.nix4
-rw-r--r--pkgs/development/python-modules/gehomesdk/default.nix4
-rw-r--r--pkgs/development/python-modules/gsd/default.nix6
-rw-r--r--pkgs/development/python-modules/ihatemoney/default.nix4
-rw-r--r--pkgs/development/python-modules/imap-tools/default.nix6
-rw-r--r--pkgs/development/python-modules/junos-eznc/default.nix2
-rw-r--r--pkgs/development/python-modules/losant-rest/default.nix4
-rw-r--r--pkgs/development/python-modules/lxmf/default.nix4
-rw-r--r--pkgs/development/python-modules/manuel/default.nix4
-rw-r--r--pkgs/development/python-modules/md-toc/default.nix8
-rw-r--r--pkgs/development/python-modules/miniaudio/default.nix4
-rw-r--r--pkgs/development/python-modules/mitogen/default.nix4
-rw-r--r--pkgs/development/python-modules/mockito/default.nix4
-rw-r--r--pkgs/development/python-modules/mysqlclient/default.nix4
-rw-r--r--pkgs/development/python-modules/napalm/default.nix8
-rw-r--r--pkgs/development/python-modules/nomadnet/default.nix4
-rw-r--r--pkgs/development/python-modules/proto-plus/default.nix4
-rw-r--r--pkgs/development/python-modules/pulumi-aws/default.nix4
-rw-r--r--pkgs/development/python-modules/pydantic/default.nix4
-rw-r--r--pkgs/development/python-modules/pygmt/default.nix6
-rw-r--r--pkgs/development/python-modules/pymazda/default.nix4
-rw-r--r--pkgs/development/python-modules/pypoolstation/default.nix6
-rw-r--r--pkgs/development/python-modules/pyroute2-core/default.nix4
-rw-r--r--pkgs/development/python-modules/pyroute2-ethtool/default.nix4
-rw-r--r--pkgs/development/python-modules/pyroute2-ipdb/default.nix4
-rw-r--r--pkgs/development/python-modules/pyroute2-ipset/default.nix4
-rw-r--r--pkgs/development/python-modules/pyroute2-ndb/default.nix4
-rw-r--r--pkgs/development/python-modules/pyroute2-nftables/default.nix4
-rw-r--r--pkgs/development/python-modules/pyroute2-nslink/default.nix4
-rw-r--r--pkgs/development/python-modules/pyroute2-protocols/default.nix4
-rw-r--r--pkgs/development/python-modules/pyroute2/default.nix4
-rw-r--r--pkgs/development/python-modules/pysigma-backend-splunk/default.nix4
-rw-r--r--pkgs/development/python-modules/pyswitchbot/default.nix8
-rw-r--r--pkgs/development/python-modules/python-magic/default.nix5
-rw-r--r--pkgs/development/python-modules/pyvex/default.nix4
-rw-r--r--pkgs/development/python-modules/railroad-diagrams/default.nix16
-rw-r--r--pkgs/development/python-modules/ropgadget/default.nix6
-rw-r--r--pkgs/development/python-modules/sentry-sdk/default.nix4
-rw-r--r--pkgs/development/python-modules/slack-sdk/default.nix4
-rw-r--r--pkgs/development/python-modules/snowflake-connector-python/default.nix4
-rw-r--r--pkgs/development/python-modules/soco/default.nix6
-rw-r--r--pkgs/development/python-modules/strenum/default.nix4
-rw-r--r--pkgs/development/python-modules/sunpy/default.nix4
-rw-r--r--pkgs/development/python-modules/systemd/default.nix36
-rw-r--r--pkgs/development/python-modules/time-machine/default.nix4
-rw-r--r--pkgs/development/python-modules/timetagger/default.nix4
-rw-r--r--pkgs/development/python-modules/types-redis/default.nix4
-rw-r--r--pkgs/development/python-modules/types-requests/default.nix4
-rw-r--r--pkgs/development/python-modules/types-tabulate/default.nix4
-rw-r--r--pkgs/development/python-modules/vaa/default.nix4
-rw-r--r--pkgs/development/python-modules/wandb/default.nix6
-rw-r--r--pkgs/development/python-modules/wtforms/default.nix4
-rw-r--r--pkgs/development/python-modules/xmlschema/default.nix4
-rw-r--r--pkgs/development/python-modules/youtube-search-python/default.nix4
-rw-r--r--pkgs/development/ruby-modules/bundled-common/gen-bin-stubs.rb14
-rw-r--r--pkgs/development/tools/analysis/checkov/default.nix4
-rw-r--r--pkgs/development/tools/analysis/checkstyle/default.nix4
-rw-r--r--pkgs/development/tools/analysis/cvehound/default.nix6
-rw-r--r--pkgs/development/tools/analysis/radare2/default.nix8
-rw-r--r--pkgs/development/tools/analysis/tflint/default.nix4
-rw-r--r--pkgs/development/tools/apko/default.nix6
-rw-r--r--pkgs/development/tools/asmfmt/default.nix21
-rw-r--r--pkgs/development/tools/asmfmt/deps.nix20
-rw-r--r--pkgs/development/tools/bazelisk/default.nix6
-rw-r--r--pkgs/development/tools/beancount-language-server/default.nix6
-rw-r--r--pkgs/development/tools/buf/default.nix6
-rw-r--r--pkgs/development/tools/build-managers/bazel/bazel_4/default.nix15
-rw-r--r--pkgs/development/tools/build-managers/bazel/bazel_5/default.nix16
-rw-r--r--pkgs/development/tools/check/default.nix22
-rw-r--r--pkgs/development/tools/check/deps.nix11
-rw-r--r--pkgs/development/tools/clj-kondo/default.nix4
-rw-r--r--pkgs/development/tools/cloud-nuke/default.nix6
-rw-r--r--pkgs/development/tools/continuous-integration/github-runner/default.nix4
-rw-r--r--pkgs/development/tools/continuous-integration/jenkins/default.nix4
-rw-r--r--pkgs/development/tools/continuous-integration/woodpecker/agent.nix17
-rw-r--r--pkgs/development/tools/continuous-integration/woodpecker/cli.nix17
-rw-r--r--pkgs/development/tools/continuous-integration/woodpecker/common.nix36
-rw-r--r--pkgs/development/tools/continuous-integration/woodpecker/frontend.nix40
-rw-r--r--pkgs/development/tools/continuous-integration/woodpecker/server.nix27
-rwxr-xr-xpkgs/development/tools/continuous-integration/woodpecker/update.sh50
-rw-r--r--pkgs/development/tools/continuous-integration/woodpecker/woodpecker-package.json63
-rw-r--r--pkgs/development/tools/dapper/default.nix19
-rw-r--r--pkgs/development/tools/doctl/default.nix4
-rw-r--r--pkgs/development/tools/ineffassign/default.nix27
-rw-r--r--pkgs/development/tools/jless/default.nix2
-rw-r--r--pkgs/development/tools/lc3tools/0004-configure-use-cc.patch22
-rw-r--r--pkgs/development/tools/lc3tools/default.nix10
-rw-r--r--pkgs/development/tools/maligned/default.nix27
-rw-r--r--pkgs/development/tools/maligned/deps.nix20
-rw-r--r--pkgs/development/tools/misc/checkbashisms/default.nix4
-rw-r--r--pkgs/development/tools/misc/grpc-client-cli/default.nix22
-rw-r--r--pkgs/development/tools/misc/hound/default.nix4
-rw-r--r--pkgs/development/tools/misc/terraform-ls/default.nix6
-rw-r--r--pkgs/development/tools/okteto/default.nix6
-rw-r--r--pkgs/development/tools/packer/default.nix6
-rw-r--r--pkgs/development/tools/pip-audit/default.nix4
-rw-r--r--pkgs/development/tools/rust/cargo-about/default.nix (renamed from pkgs/tools/package-management/cargo-about/default.nix)0
-rw-r--r--pkgs/development/tools/rust/cargo-about/zstd-pkg-config.patch (renamed from pkgs/tools/package-management/cargo-about/zstd-pkg-config.patch)0
-rw-r--r--pkgs/development/tools/rust/cargo-audit/default.nix (renamed from pkgs/tools/package-management/cargo-audit/default.nix)0
-rw-r--r--pkgs/development/tools/rust/cargo-bloat/default.nix6
-rw-r--r--pkgs/development/tools/rust/cargo-crev/default.nix6
-rw-r--r--pkgs/development/tools/rust/cargo-deb/default.nix (renamed from pkgs/tools/package-management/cargo-deb/default.nix)0
-rw-r--r--pkgs/development/tools/rust/cargo-depgraph/default.nix6
-rw-r--r--pkgs/development/tools/rust/cargo-deps/default.nix (renamed from pkgs/tools/package-management/cargo-deps/default.nix)0
-rw-r--r--pkgs/development/tools/rust/cargo-download/Cargo.nix (renamed from pkgs/tools/package-management/cargo-download/Cargo.nix)0
-rw-r--r--pkgs/development/tools/rust/cargo-download/crates-io.nix (renamed from pkgs/tools/package-management/cargo-download/crates-io.nix)0
-rw-r--r--pkgs/development/tools/rust/cargo-download/default.nix (renamed from pkgs/tools/package-management/cargo-download/default.nix)0
-rw-r--r--pkgs/development/tools/rust/cargo-edit/default.nix (renamed from pkgs/tools/package-management/cargo-edit/default.nix)0
-rw-r--r--pkgs/development/tools/rust/cargo-expand/default.nix6
-rw-r--r--pkgs/development/tools/rust/cargo-flamegraph/default.nix (renamed from pkgs/development/tools/cargo-flamegraph/default.nix)0
-rw-r--r--pkgs/development/tools/rust/cargo-graph/default.nix (renamed from pkgs/tools/package-management/cargo-graph/default.nix)0
-rw-r--r--pkgs/development/tools/rust/cargo-insta/default.nix6
-rw-r--r--pkgs/development/tools/rust/cargo-kcov/default.nix (renamed from pkgs/tools/package-management/cargo-kcov/default.nix)0
-rw-r--r--pkgs/development/tools/rust/cargo-license/default.nix (renamed from pkgs/tools/package-management/cargo-license/default.nix)0
-rw-r--r--pkgs/development/tools/rust/cargo-llvm-lines/default.nix6
-rw-r--r--pkgs/development/tools/rust/cargo-make/default.nix6
-rw-r--r--pkgs/development/tools/rust/cargo-nextest/default.nix10
-rw-r--r--pkgs/development/tools/rust/cargo-outdated/default.nix (renamed from pkgs/tools/package-management/cargo-outdated/default.nix)0
-rw-r--r--pkgs/development/tools/rust/cargo-release/default.nix (renamed from pkgs/tools/package-management/cargo-release/default.nix)0
-rw-r--r--pkgs/development/tools/rust/cargo-update/default.nix (renamed from pkgs/tools/package-management/cargo-update/default.nix)0
-rw-r--r--pkgs/development/tools/rust/cargo-web/default.nix (renamed from pkgs/development/tools/cargo-web/default.nix)0
-rw-r--r--pkgs/development/web/deno/default.nix6
-rw-r--r--pkgs/development/web/deno/librusty_v8.nix10
-rw-r--r--pkgs/development/web/flyctl/default.nix6
-rw-r--r--pkgs/games/ferium/default.nix28
-rw-r--r--pkgs/games/freeciv/default.nix4
-rw-r--r--pkgs/games/gnonograms/default.nix14
-rw-r--r--pkgs/games/itch-setup/default.nix24
-rw-r--r--pkgs/games/itch/butler.nix29
-rw-r--r--pkgs/games/itch/default.nix85
-rw-r--r--pkgs/games/sil-q/default.nix9
-rw-r--r--pkgs/games/sil/default.nix34
-rw-r--r--pkgs/games/sm64ex/default.nix112
-rw-r--r--pkgs/games/sm64ex/generic.nix83
-rw-r--r--pkgs/games/umoria/default.nix24
-rw-r--r--pkgs/misc/screensavers/rss-glx/cstddef.patch12
-rw-r--r--pkgs/misc/screensavers/rss-glx/default.nix20
-rw-r--r--pkgs/os-specific/linux/alsa-project/alsa-utils/default.nix4
-rw-r--r--pkgs/os-specific/linux/bcc/default.nix2
-rw-r--r--pkgs/os-specific/linux/bpftrace/default.nix10
-rw-r--r--pkgs/os-specific/linux/kernel/hardened/patches.json70
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.14.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.19.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.9.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-5.10.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-5.15.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-5.17.nix18
-rw-r--r--pkgs/os-specific/linux/kernel/linux-5.18.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-5.4.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-libre.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix1
-rwxr-xr-xpkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh2
-rw-r--r--pkgs/os-specific/linux/zfs/default.nix18
-rw-r--r--pkgs/servers/cayley/default.nix40
-rw-r--r--pkgs/servers/cayley/deps.nix471
-rw-r--r--pkgs/servers/confluencepot/default.nix44
-rw-r--r--pkgs/servers/dns/coredns/default.nix6
-rw-r--r--pkgs/servers/geospatial/geoserver/default.nix38
-rw-r--r--pkgs/servers/gpm/default.nix10
-rw-r--r--pkgs/servers/heisenbridge/default.nix4
-rw-r--r--pkgs/servers/interlock/default.nix48
-rw-r--r--pkgs/servers/interlock/deps.nix65
-rw-r--r--pkgs/servers/mail/mlmmj/default.nix6
-rw-r--r--pkgs/servers/monitoring/cadvisor/default.nix6
-rw-r--r--pkgs/servers/monitoring/grafana/default.nix8
-rw-r--r--pkgs/servers/nosql/mongodb/patches/mongodb-4.0-glibc-2.34.patch14
-rw-r--r--pkgs/servers/nosql/mongodb/v4_0.nix14
-rw-r--r--pkgs/servers/nosql/mongodb/v4_2.nix13
-rw-r--r--pkgs/servers/nosql/riak/2.2.0.nix106
-rw-r--r--pkgs/servers/plex/raw.nix6
-rw-r--r--pkgs/servers/serf/default.nix42
-rw-r--r--pkgs/servers/shairport-sync/default.nix22
-rw-r--r--pkgs/servers/traefik/default.nix29
-rw-r--r--pkgs/servers/trickster/trickster.nix53
-rw-r--r--pkgs/servers/trickster/trickster_deps.nix237
-rw-r--r--pkgs/servers/web-apps/snipe-it/default.nix4
-rw-r--r--pkgs/shells/oh/default.nix6
-rw-r--r--pkgs/stdenv/generic/make-derivation.nix4
-rw-r--r--pkgs/tools/X11/focus/default.nix34
-rw-r--r--pkgs/tools/X11/pmenu/default.nix60
-rw-r--r--pkgs/tools/admin/aliyun-cli/default.nix6
-rw-r--r--pkgs/tools/admin/boulder/default.nix53
-rw-r--r--pkgs/tools/admin/lxd/default.nix7
-rw-r--r--pkgs/tools/admin/nomachine-client/default.nix8
-rw-r--r--pkgs/tools/admin/trinsic-cli/default.nix4
-rw-r--r--pkgs/tools/backup/borgmatic/default.nix4
-rw-r--r--pkgs/tools/backup/dar/default.nix4
-rw-r--r--pkgs/tools/backup/duplicity/default.nix1
-rw-r--r--pkgs/tools/backup/zfsbackup/default.nix26
-rw-r--r--pkgs/tools/backup/zfsbackup/deps.nix1326
-rw-r--r--pkgs/tools/bluetooth/blueman/default.nix4
-rw-r--r--pkgs/tools/filesystems/bindfs/default.nix4
-rw-r--r--pkgs/tools/filesystems/gcsfuse/default.nix16
-rw-r--r--pkgs/tools/filesystems/httm/default.nix6
-rw-r--r--pkgs/tools/games/minecraft/packwiz/default.nix6
-rw-r--r--pkgs/tools/inputmethods/uim/default.nix18
-rw-r--r--pkgs/tools/misc/antimicrox/default.nix4
-rw-r--r--pkgs/tools/misc/chafa/default.nix4
-rw-r--r--pkgs/tools/misc/chezmoi/default.nix6
-rw-r--r--pkgs/tools/misc/dateutils/default.nix4
-rw-r--r--pkgs/tools/misc/diffoscope/default.nix4
-rw-r--r--pkgs/tools/misc/dsq/default.nix4
-rw-r--r--pkgs/tools/misc/dua/default.nix6
-rw-r--r--pkgs/tools/misc/fend/default.nix6
-rw-r--r--pkgs/tools/misc/flameshot/default.nix4
-rw-r--r--pkgs/tools/misc/qjoypad/default.nix36
-rw-r--r--pkgs/tools/misc/tmux/default.nix6
-rw-r--r--pkgs/tools/misc/youtube-dl/default.nix18
-rw-r--r--pkgs/tools/networking/brook/default.nix6
-rw-r--r--pkgs/tools/networking/clash/default.nix6
-rw-r--r--pkgs/tools/networking/mu/default.nix69
-rw-r--r--pkgs/tools/networking/networkmanager/default.nix16
-rw-r--r--pkgs/tools/networking/offlineimap/default.nix1
-rw-r--r--pkgs/tools/networking/routedns/default.nix29
-rw-r--r--pkgs/tools/networking/vegeta/default.nix37
-rw-r--r--pkgs/tools/networking/vegeta/deps.nix255
-rw-r--r--pkgs/tools/networking/waitron/default.nix33
-rw-r--r--pkgs/tools/networking/waitron/deps.nix57
-rw-r--r--pkgs/tools/nix/alejandra/default.nix6
-rw-r--r--pkgs/tools/nix/nar-serve/default.nix6
-rw-r--r--pkgs/tools/nix/nixel/default.nix36
-rw-r--r--pkgs/tools/package-management/appimagekit/default.nix1
-rw-r--r--pkgs/tools/package-management/micromamba/default.nix2
-rw-r--r--pkgs/tools/security/certstrap/default.nix24
-rw-r--r--pkgs/tools/security/fail2ban/default.nix6
-rw-r--r--pkgs/tools/security/himitsu-firefox/default.nix46
-rw-r--r--pkgs/tools/security/himitsu/default.nix34
-rw-r--r--pkgs/tools/security/metasploit/Gemfile2
-rw-r--r--pkgs/tools/security/metasploit/Gemfile.lock26
-rw-r--r--pkgs/tools/security/metasploit/default.nix4
-rw-r--r--pkgs/tools/security/metasploit/gemset.nix38
-rw-r--r--pkgs/tools/security/regpg/default.nix52
-rw-r--r--pkgs/tools/security/rekor/default.nix6
-rw-r--r--pkgs/tools/security/schleuder/Gemfile3
-rw-r--r--pkgs/tools/security/schleuder/Gemfile.lock85
-rw-r--r--pkgs/tools/security/schleuder/cli/Gemfile4
-rw-r--r--pkgs/tools/security/schleuder/cli/Gemfile.lock21
-rw-r--r--pkgs/tools/security/schleuder/cli/default.nix34
-rw-r--r--pkgs/tools/security/schleuder/cli/gemset.nix25
-rw-r--r--pkgs/tools/security/schleuder/default.nix38
-rw-r--r--pkgs/tools/security/schleuder/gemset.nix316
-rw-r--r--pkgs/tools/security/sslscan/default.nix4
-rw-r--r--pkgs/tools/system/btop/default.nix4
-rw-r--r--pkgs/tools/system/openipmi/default.nix2
-rw-r--r--pkgs/tools/system/smartmontools/default.nix10
-rw-r--r--pkgs/tools/text/dos2unix/default.nix4
-rw-r--r--pkgs/tools/text/mdbook/default.nix6
-rw-r--r--pkgs/tools/text/nkf/default.nix11
-rw-r--r--pkgs/tools/text/poedit/default.nix8
-rw-r--r--pkgs/tools/video/rtmpdump/default.nix6
-rw-r--r--pkgs/tools/x11/xmcp/default.nix33
-rw-r--r--pkgs/top-level/aliases.nix2
-rw-r--r--pkgs/top-level/all-packages.nix177
-rw-r--r--pkgs/top-level/config.nix4
-rw-r--r--pkgs/top-level/dotnet-packages.nix4
-rw-r--r--pkgs/top-level/linux-kernels.nix13
-rw-r--r--pkgs/top-level/python-aliases.nix1
-rw-r--r--pkgs/top-level/python-packages.nix2
641 files changed, 5815 insertions, 4944 deletions
diff --git a/lib/default.nix b/lib/default.nix
index 070c2a67cf073..e2a93e63ac1fe 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -131,7 +131,8 @@ let
       getValues getFiles
       optionAttrSetToDocList optionAttrSetToDocList'
       scrubOptionValue literalExpression literalExample literalDocBook
-      showOption showFiles unknownModule mkOption mkPackageOption
+      showOption showOptionWithDefLocs showFiles
+      unknownModule mkOption mkPackageOption
       mdDoc literalMD;
     inherit (self.types) isType setType defaultTypeMerge defaultFunctor
       isOptionType mkOptionType;
diff --git a/lib/options.nix b/lib/options.nix
index 50b19e4837360..afae1769afdd4 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -7,6 +7,7 @@ let
     collect
     concatLists
     concatMap
+    concatMapStringsSep
     elemAt
     filter
     foldl'
@@ -340,6 +341,11 @@ rec {
     in "\n- In `${def.file}'${result}"
   ) defs;
 
+  showOptionWithDefLocs = opt: ''
+      ${showOption opt.loc}, with values defined in:
+      ${concatMapStringsSep "\n" (defFile: "  - ${defFile}") opt.files}
+    '';
+
   unknownModule = "<unknown-file>";
 
 }
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index cd5023ceda7ad..4610d1f9a6c5d 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -78,6 +78,13 @@
       fingerprint = "2536 9E86 1AA5 9EB7 4C47  B138 6510 870A 77F4 9A99";
     }];
   };
+  _0xC45 = {
+    email = "jason@0xc45.com";
+    name = "Jason Vigil";
+    github = "0xC45";
+    githubId = 56617252;
+    matrix = "@oxc45:matrix.org";
+  };
   _1000101 = {
     email = "b1000101@pm.me";
     github = "1000101";
@@ -596,6 +603,12 @@
     githubId = 60479013;
     name = "Alma Cemerlic";
   };
+  alternateved = {
+    email = "alternateved@pm.me";
+    github = "alternateved";
+    githubId = 45176912;
+    name = "Tomasz Hołubowicz";
+  };
   alunduil = {
     email = "alunduil@gmail.com";
     github = "alunduil";
@@ -6347,6 +6360,13 @@
     github = "jsierles";
     githubId = 82;
   };
+  jsimonetti = {
+    email = "jeroen+nixpkgs@simonetti.nl";
+    matrix = "@jeroen:simonetti.nl";
+    name = "Jeroen Simonetti";
+    github = "jsimonetti";
+    githubId = 5478838;
+  };
   jtcoolen = {
     email = "jtcoolen@pm.me";
     name = "Julien Coolen";
diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index 5e852275b4a10..413a6f9b1d7a9 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -94,6 +94,16 @@ with lib.maintainers; {
     enableFeatureFreezePing = true;
   };
 
+  c3d2 = {
+    members = [
+      astro
+      SuperSandro2000
+    ];
+    scope = "Maintain packages used in the C3D2 hackspace";
+    shortName = "c3d2";
+    enableFeatureFreezePing = true;
+  };
+
   cinnamon = {
     members = [
       mkg20001
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
index 5208671e4dab0..8ef398e25fd00 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@@ -148,6 +148,14 @@
       </listitem>
       <listitem>
         <para>
+          <link xlink:href="https://gitlab.com/DarkElvenAngel/argononed">argonone</link>,
+          a replacement daemon for the Raspberry Pi Argon One power
+          button and cooler. Available at
+          <link xlink:href="options.html#opt-services.hardware.argonone.enable">services.hardware.argonone</link>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
           <link xlink:href="https://github.com/JustArchiNET/ArchiSteamFarm">ArchiSteamFarm</link>,
           a C# application with primary purpose of idling Steam cards
           from multiple accounts simultaneously. Available as
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
index 43e43cb4a0646..53233754f0005 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
@@ -33,6 +33,65 @@
       </listitem>
       <listitem>
         <para>
+          The <literal>nixpkgs.hostPlatform</literal> and
+          <literal>nixpkgs.buildPlatform</literal> options have been
+          added. These cover and override the
+          <literal>nixpkgs.{system,localSystem,crossSystem}</literal>
+          options.
+        </para>
+        <itemizedlist spacing="compact">
+          <listitem>
+            <para>
+              <literal>hostPlatform</literal> is the platform or
+              <quote><literal>system</literal></quote> string of the
+              NixOS system described by the configuration.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>buildPlatform</literal> is the platform that is
+              responsible for building the NixOS configuration. It
+              defaults to the <literal>hostPlatform</literal>, for a
+              non-cross build configuration. To cross compile, set
+              <literal>buildPlatform</literal> to a different value.
+            </para>
+          </listitem>
+        </itemizedlist>
+        <para>
+          The new options convey the same information, but with fewer
+          options, and following the Nixpkgs terminology.
+        </para>
+        <para>
+          The existing options
+          <literal>nixpkgs.{system,localSystem,crossSystem}</literal>
+          have not been formally deprecated, to allow for evaluation of
+          the change and to allow for a transition period so that in
+          time the ecosystem can switch without breaking compatibility
+          with any supported NixOS release.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <literal>nixos-generate-config</literal> now generates
+          configurations that can be built in pure mode. This is
+          achieved by setting the new
+          <literal>nixpkgs.hostPlatform</literal> option.
+        </para>
+        <para>
+          You may have to unset the <literal>system</literal> parameter
+          in <literal>lib.nixosSystem</literal>, or similarly remove
+          definitions of the
+          <literal>nixpkgs.{system,localSystem,crossSystem}</literal>
+          options.
+        </para>
+        <para>
+          Alternatively, you can remove the
+          <literal>hostPlatform</literal> line and use NixOS like you
+          would in NixOS 22.05 and earlier.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
           PHP now defaults to PHP 8.1, updated from 8.0.
         </para>
       </listitem>
@@ -85,6 +144,13 @@
       </listitem>
       <listitem>
         <para>
+          <link xlink:href="https://schleuder.org/">schleuder</link>, a
+          mailing list manager with PGP support. Enable using
+          <link linkend="opt-services.schleuder.enable">services.schleuder</link>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
           <link xlink:href="https://www.expressvpn.com">expressvpn</link>,
           the CLI client for ExpressVPN. Available as
           <link linkend="opt-services.expressvpn.enable">services.expressvpn</link>.
@@ -125,6 +191,16 @@
       </listitem>
       <listitem>
         <para>
+          <literal>i18n.supportedLocales</literal> is now by default
+          only generated with the default locale set in
+          <literal>i18n.defaultLocale</literal>. This got copied over
+          from the minimal profile and reduces the final system size by
+          200MB. If you require all locales installed set the option to
+          <literal>[ &quot;all&quot; ]</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
           The <literal>isPowerPC</literal> predicate, found on
           <literal>platform</literal> attrsets
           (<literal>hostPlatform</literal>,
@@ -159,6 +235,13 @@
       </listitem>
       <listitem>
         <para>
+          riak package removed along with
+          <literal>services.riak</literal> module, due to lack of
+          maintainer to update the package.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
           (Neo)Vim can not be configured with
           <literal>configure.pathogen</literal> anymore to reduce
           maintainance burden. Use <literal>configure.packages</literal>
@@ -205,6 +288,12 @@
       </listitem>
       <listitem>
         <para>
+          <literal>zfs</literal> was updated from 2.1.4 to 2.1.5,
+          enabling it to be used with Linux kernel 5.18.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
           memtest86+ was updated from 5.00-coreboot-002 to 6.00-beta2.
           It is now the upstream version from https://www.memtest.org/,
           as coreboot’s fork is no longer available.
diff --git a/nixos/doc/manual/release-notes/rl-2205.section.md b/nixos/doc/manual/release-notes/rl-2205.section.md
index faf941f569966..d83eb18f51410 100644
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@@ -61,6 +61,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [apfs](https://github.com/linux-apfs/linux-apfs-rw), a kernel module for mounting the Apple File System (APFS).
 
+- [argonone](https://gitlab.com/DarkElvenAngel/argononed), a replacement daemon for the Raspberry Pi Argon One power button and cooler. Available at [services.hardware.argonone](options.html#opt-services.hardware.argonone.enable).
+
 - [ArchiSteamFarm](https://github.com/JustArchiNET/ArchiSteamFarm), a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Available as [services.archisteamfarm](#opt-services.archisteamfarm.enable).
 
 - [BaGet](https://loic-sharma.github.io/BaGet/), a lightweight NuGet and symbol server. Available at [services.baget](#opt-services.baget.enable).
diff --git a/nixos/doc/manual/release-notes/rl-2211.section.md b/nixos/doc/manual/release-notes/rl-2211.section.md
index 9e852f165ab43..abe0c7bdeaa60 100644
--- a/nixos/doc/manual/release-notes/rl-2211.section.md
+++ b/nixos/doc/manual/release-notes/rl-2211.section.md
@@ -17,6 +17,33 @@ In addition to numerous new and upgraded packages, this release has the followin
   built for `stdenv.hostPlatform` (i.e. produced by `stdenv.cc`) by evaluating
   `stdenv.buildPlatform.canExecute stdenv.hostPlatform`.
 
+- The `nixpkgs.hostPlatform` and `nixpkgs.buildPlatform` options have been added.
+  These cover and override the `nixpkgs.{system,localSystem,crossSystem}` options.
+
+   - `hostPlatform` is the platform or "`system`" string of the NixOS system
+     described by the configuration.
+   - `buildPlatform` is the platform that is responsible for building the NixOS
+     configuration. It defaults to the `hostPlatform`, for a non-cross
+     build configuration. To cross compile, set `buildPlatform` to a different
+     value.
+
+  The new options convey the same information, but with fewer options, and
+  following the Nixpkgs terminology.
+
+  The existing options `nixpkgs.{system,localSystem,crossSystem}` have not
+  been formally deprecated, to allow for evaluation of the change and to allow
+  for a transition period so that in time the ecosystem can switch without
+  breaking compatibility with any supported NixOS release.
+
+- `nixos-generate-config` now generates configurations that can be built in pure
+  mode. This is achieved by setting the new `nixpkgs.hostPlatform` option.
+
+  You may have to unset the `system` parameter in `lib.nixosSystem`, or similarly
+  remove definitions of the `nixpkgs.{system,localSystem,crossSystem}` options.
+
+  Alternatively, you can remove the `hostPlatform` line and use NixOS like you
+  would in NixOS 22.05 and earlier.
+
 - PHP now defaults to PHP 8.1, updated from 8.0.
 
 - `hardware.nvidia` has a new option `open` that can be used to opt in the opensource version of NVIDIA kernel driver. Note that the driver's support for GeForce and Workstation GPUs is still alpha quality, see [NVIDIA Releases Open-Source GPU Kernel Modules](https://developer.nvidia.com/blog/nvidia-releases-open-source-gpu-kernel-modules/) for the official announcement.
@@ -33,6 +60,8 @@ In addition to numerous new and upgraded packages, this release has the followin
   Available as [services.infnoise](options.html#opt-services.infnoise.enable).
 - [persistent-evdev](https://github.com/aiberia/persistent-evdev), a daemon to add virtual proxy devices that mirror a physical input device but persist even if the underlying hardware is hot-plugged. Available as [services.persistent-evdev](#opt-services.persistent-evdev.enable).
 
+- [schleuder](https://schleuder.org/), a mailing list manager with PGP support. Enable using [services.schleuder](#opt-services.schleuder.enable).
+
 - [expressvpn](https://www.expressvpn.com), the CLI client for ExpressVPN. Available as [services.expressvpn](#opt-services.expressvpn.enable).
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -51,6 +80,10 @@ In addition to numerous new and upgraded packages, this release has the followin
   and [changelog](https://ngrok.com/docs/ngrok-agent/changelog). Notably, breaking changes are that the config file format has
   changed and support for single hypen arguments was dropped.
 
+- `i18n.supportedLocales` is now by default only generated with the default locale set in `i18n.defaultLocale`.
+  This got copied over from the minimal profile and reduces the final system size by 200MB.
+  If you require all locales installed set the option to ``[ "all" ]``.
+
 - The `isPowerPC` predicate, found on `platform` attrsets (`hostPlatform`, `buildPlatform`, `targetPlatform`, etc) has been removed in order to reduce confusion.  The predicate was was defined such that it matches only the 32-bit big-endian members of the POWER/PowerPC family, despite having a name which would imply a broader set of systems.  If you were using this predicate, you can replace `foo.isPowerPC` with `(with foo; isPower && is32bit && isBigEndian)`.
 
 - The Barco ClickShare driver/client package `pkgs.clickshare-csc1` and the option `programs.clickshare-csc1.enable` have been removed,
@@ -60,6 +93,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 - PHP 7.4 is no longer supported due to upstream not supporting this
   version for the entire lifecycle of the 22.11 release.
 
+- riak package removed along with `services.riak` module, due to lack of maintainer to update the package.
+
 - (Neo)Vim can not be configured with `configure.pathogen` anymore to reduce maintainance burden.
 Use `configure.packages` instead.
 
@@ -75,6 +110,8 @@ Use `configure.packages` instead.
 
 - Matrix Synapse now requires entries in the `state_group_edges` table to be unique, in order to prevent accidentally introducing duplicate information (for example, because a database backup was restored multiple times). If your Synapse database already has duplicate rows in this table, this could fail with an error and require manual remediation.
 
+- `zfs` was updated from 2.1.4 to 2.1.5, enabling it to be used with Linux kernel 5.18.
+
 - memtest86+ was updated from 5.00-coreboot-002 to 6.00-beta2. It is now the upstream version from https://www.memtest.org/, as coreboot's fork is no longer available.
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
diff --git a/nixos/modules/config/i18n.nix b/nixos/modules/config/i18n.nix
index 5b8d5b214496b..53dd325457e01 100644
--- a/nixos/modules/config/i18n.nix
+++ b/nixos/modules/config/i18n.nix
@@ -53,7 +53,8 @@ with lib;
 
       supportedLocales = mkOption {
         type = types.listOf types.str;
-        default = ["all"];
+        default = [ (config.i18n.defaultLocale + "/UTF-8") ];
+        defaultText = literalExpression "[ (config.i18n.defaultLocale + \"/UTF-8\") ]";
         example = ["en_US.UTF-8/UTF-8" "nl_NL.UTF-8/UTF-8" "nl_NL/ISO-8859-1"];
         description = ''
           List of locales that the system should support.  The value
diff --git a/nixos/modules/installer/tools/nixos-generate-config.pl b/nixos/modules/installer/tools/nixos-generate-config.pl
index b74ec838df42f..1935d8252607c 100644
--- a/nixos/modules/installer/tools/nixos-generate-config.pl
+++ b/nixos/modules/installer/tools/nixos-generate-config.pl
@@ -84,6 +84,15 @@ sub debug {
 }
 
 
+# nixpkgs.system
+my ($status, @systemLines) = runCommand("nix-instantiate --impure --eval --expr builtins.currentSystem");
+if ($status != 0 || join("", @systemLines) =~ /error/) {
+    die "Failed to retrieve current system type from nix.\n";
+}
+chomp(my $system = @systemLines[0]);
+push @attrs, "nixpkgs.hostPlatform = lib.mkDefault $system;";
+
+
 my $cpuinfo = read_file "/proc/cpuinfo";
 
 
diff --git a/nixos/modules/misc/ids.nix b/nixos/modules/misc/ids.nix
index 7d1faa50f4bfa..05d483af3c2e4 100644
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@@ -236,7 +236,7 @@ in
       gitit = 202;
       riemanntools = 203;
       subsonic = 204;
-      riak = 205;
+      # riak = 205; # unused, remove 2022-07-22
       #shout = 206; # dynamically allocated as of 2021-09-18
       gateone = 207;
       namecoin = 208;
@@ -553,7 +553,7 @@ in
       gitit = 202;
       riemanntools = 203;
       subsonic = 204;
-      riak = 205;
+      # riak = 205;#unused, removed 2022-06-22
       #shout = 206; #unused
       gateone = 207;
       namecoin = 208;
diff --git a/nixos/modules/misc/nixpkgs.nix b/nixos/modules/misc/nixpkgs.nix
index 866bb35160091..ad017aff816c7 100644
--- a/nixos/modules/misc/nixpkgs.nix
+++ b/nixos/modules/misc/nixpkgs.nix
@@ -55,9 +55,46 @@ let
     check = builtins.isAttrs;
   };
 
-  defaultPkgs = import ../../.. {
-    inherit (cfg) config overlays localSystem crossSystem;
-  };
+  hasBuildPlatform = opt.buildPlatform.highestPrio < (mkOptionDefault {}).priority;
+  hasHostPlatform = opt.hostPlatform.isDefined;
+  hasPlatform = hasHostPlatform || hasBuildPlatform;
+
+  # Context for messages
+  hostPlatformLine = optionalString hasHostPlatform "${showOptionWithDefLocs opt.hostPlatform}";
+  buildPlatformLine = optionalString hasBuildPlatform "${showOptionWithDefLocs opt.buildPlatform}";
+  platformLines = optionalString hasPlatform ''
+    Your system configuration configures nixpkgs with platform parameters:
+    ${hostPlatformLine
+    }${buildPlatformLine
+    }'';
+
+  legacyOptionsDefined =
+    optional (opt.localSystem.highestPrio < (mkDefault {}).priority) opt.system
+    ++ optional (opt.localSystem.highestPrio < (mkOptionDefault {}).priority) opt.localSystem
+    ++ optional (opt.crossSystem.highestPrio < (mkOptionDefault {}).priority) opt.crossSystem
+    ;
+
+  defaultPkgs =
+    if opt.hostPlatform.isDefined
+    then
+      let isCross = cfg.buildPlatform != cfg.hostPlatform;
+          systemArgs =
+            if isCross
+            then {
+              localSystem = cfg.buildPlatform;
+              crossSystem = cfg.hostPlatform;
+            }
+            else {
+              localSystem = cfg.hostPlatform;
+            };
+      in
+      import ../../.. ({
+        inherit (cfg) config overlays;
+      } // systemArgs)
+    else
+      import ../../.. {
+        inherit (cfg) config overlays localSystem crossSystem;
+      };
 
   finalPkgs = if opt.pkgs.isDefined then cfg.pkgs.appendOverlays cfg.overlays else defaultPkgs;
 
@@ -157,6 +194,46 @@ in
       '';
     };
 
+    hostPlatform = mkOption {
+      type = types.either types.str types.attrs; # TODO utilize lib.systems.parsedPlatform
+      example = { system = "aarch64-linux"; config = "aarch64-unknown-linux-gnu"; };
+      # Make sure that the final value has all fields for sake of other modules
+      # referring to this. TODO make `lib.systems` itself use the module system.
+      apply = lib.systems.elaborate;
+      defaultText = literalExpression
+        ''(import "''${nixos}/../lib").lib.systems.examples.aarch64-multiplatform'';
+      description = ''
+        Specifies the platform where the NixOS configuration will run.
+
+        To cross-compile, set also <code>nixpkgs.buildPlatform</code>.
+
+        Ignored when <code>nixpkgs.pkgs</code> is set.
+      '';
+    };
+
+    buildPlatform = mkOption {
+      type = types.either types.str types.attrs; # TODO utilize lib.systems.parsedPlatform
+      default = cfg.hostPlatform;
+      example = { system = "x86_64-linux"; config = "x86_64-unknown-linux-gnu"; };
+      # Make sure that the final value has all fields for sake of other modules
+      # referring to this.
+      apply = lib.systems.elaborate;
+      defaultText = literalExpression
+        ''config.nixpkgs.hostPlatform'';
+      description = ''
+        Specifies the platform on which NixOS should be built.
+        By default, NixOS is built on the system where it runs, but you can
+        change where it's built. Setting this option will cause NixOS to be
+        cross-compiled.
+
+        For instance, if you're doing distributed multi-platform deployment,
+        or if you're building machines, you can set this to match your
+        development system and/or build farm.
+
+        Ignored when <code>nixpkgs.pkgs</code> is set.
+      '';
+    };
+
     localSystem = mkOption {
       type = types.attrs; # TODO utilize lib.systems.parsedPlatform
       default = { inherit (cfg) system; };
@@ -176,10 +253,13 @@ in
         deployment, or when building virtual machines. See its
         description in the Nixpkgs manual for more details.
 
-        Ignored when <code>nixpkgs.pkgs</code> is set.
+        Ignored when <code>nixpkgs.pkgs</code> or <code>hostPlatform</code> is set.
       '';
     };
 
+    # TODO deprecate. "crossSystem" is a nonsense identifier, because "cross"
+    #      is a relation between at least 2 systems in the context of a
+    #      specific build step, not a single system.
     crossSystem = mkOption {
       type = types.nullOr types.attrs; # TODO utilize lib.systems.parsedPlatform
       default = null;
@@ -193,7 +273,7 @@ in
         should be set as null, the default. See its description in the
         Nixpkgs manual for more details.
 
-        Ignored when <code>nixpkgs.pkgs</code> is set.
+        Ignored when <code>nixpkgs.pkgs</code> or <code>hostPlatform</code> is set.
       '';
     };
 
@@ -216,8 +296,7 @@ in
         </programlisting>
         See <code>nixpkgs.localSystem</code> for more information.
 
-        Ignored when <code>nixpkgs.localSystem</code> is set.
-        Ignored when <code>nixpkgs.pkgs</code> is set.
+        Ignored when <code>nixpkgs.pkgs</code>, <code>nixpkgs.localSystem</code> or <code>nixpkgs.hostPlatform</code> is set.
       '';
     };
   };
@@ -240,10 +319,23 @@ in
             else "nixpkgs.localSystem";
           pkgsSystem = finalPkgs.stdenv.targetPlatform.system;
         in {
-          assertion = nixosExpectedSystem == pkgsSystem;
+          assertion = !hasPlatform -> nixosExpectedSystem == pkgsSystem;
           message = "The NixOS nixpkgs.pkgs option was set to a Nixpkgs invocation that compiles to target system ${pkgsSystem} but NixOS was configured for system ${nixosExpectedSystem} via NixOS option ${nixosOption}. The NixOS system settings must match the Nixpkgs target system.";
         }
       )
+      {
+        assertion = hasPlatform -> legacyOptionsDefined == [];
+        message = ''
+          Your system configures nixpkgs with the platform parameter${optionalString hasBuildPlatform "s"}:
+          ${hostPlatformLine
+          }${buildPlatformLine
+          }
+          However, it also defines the legacy options:
+          ${concatMapStrings showOptionWithDefLocs legacyOptionsDefined}
+          For a future proof system configuration, we recommend to remove
+          the legacy definitions.
+        '';
+      }
     ];
   };
 
diff --git a/nixos/modules/misc/nixpkgs/test.nix b/nixos/modules/misc/nixpkgs/test.nix
index ec5fab9fb4a5e..9e8851707f8fc 100644
--- a/nixos/modules/misc/nixpkgs/test.nix
+++ b/nixos/modules/misc/nixpkgs/test.nix
@@ -1,8 +1,63 @@
 { evalMinimalConfig, pkgs, lib, stdenv }:
+let
+  eval = mod: evalMinimalConfig {
+    imports = [ ../nixpkgs.nix mod ];
+  };
+  withHost = eval {
+    nixpkgs.hostPlatform = "aarch64-linux";
+  };
+  withHostAndBuild = eval {
+    nixpkgs.hostPlatform = "aarch64-linux";
+    nixpkgs.buildPlatform = "aarch64-darwin";
+  };
+  ambiguous = {
+    _file = "ambiguous.nix";
+    nixpkgs.hostPlatform = "aarch64-linux";
+    nixpkgs.buildPlatform = "aarch64-darwin";
+    nixpkgs.system = "x86_64-linux";
+    nixpkgs.localSystem.system = "x86_64-darwin";
+    nixpkgs.crossSystem.system = "i686-linux";
+    imports = [
+      { _file = "repeat.nix";
+        nixpkgs.hostPlatform = "aarch64-linux";
+      }
+    ];
+  };
+  getErrors = module:
+    let
+      uncheckedEval = lib.evalModules { modules = [ ../nixpkgs.nix module ]; };
+    in map (ass: ass.message) (lib.filter (ass: !ass.assertion) uncheckedEval.config.assertions);
+in
 lib.recurseIntoAttrs {
   invokeNixpkgsSimple =
-    (evalMinimalConfig ({ config, modulesPath, ... }: {
-      imports = [ (modulesPath + "/misc/nixpkgs.nix") ];
+    (eval {
       nixpkgs.system = stdenv.hostPlatform.system;
-    }))._module.args.pkgs.hello;
+    })._module.args.pkgs.hello;
+  assertions =
+    assert withHost._module.args.pkgs.stdenv.hostPlatform.system == "aarch64-linux";
+    assert withHost._module.args.pkgs.stdenv.buildPlatform.system == "aarch64-linux";
+    assert withHostAndBuild._module.args.pkgs.stdenv.hostPlatform.system == "aarch64-linux";
+    assert withHostAndBuild._module.args.pkgs.stdenv.buildPlatform.system == "aarch64-darwin";
+    assert builtins.trace (lib.head (getErrors ambiguous))
+      getErrors ambiguous ==
+        [''
+          Your system configures nixpkgs with the platform parameters:
+          nixpkgs.hostPlatform, with values defined in:
+            - repeat.nix
+            - ambiguous.nix
+          nixpkgs.buildPlatform, with values defined in:
+            - ambiguous.nix
+
+          However, it also defines the legacy options:
+          nixpkgs.system, with values defined in:
+            - ambiguous.nix
+          nixpkgs.localSystem, with values defined in:
+            - ambiguous.nix
+          nixpkgs.crossSystem, with values defined in:
+            - ambiguous.nix
+
+          For a future proof system configuration, we recommend to remove
+          the legacy definitions.
+        ''];
+    pkgs.emptyFile;
 }
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 40a84730dfc1e..c1e41c8951ca4 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -365,7 +365,6 @@
   ./services/databases/pgmanage.nix
   ./services/databases/postgresql.nix
   ./services/databases/redis.nix
-  ./services/databases/riak.nix
   ./services/databases/victoriametrics.nix
   ./services/desktops/accountsservice.nix
   ./services/desktops/bamf.nix
@@ -430,6 +429,7 @@
   ./services/games/terraria.nix
   ./services/hardware/acpid.nix
   ./services/hardware/actkbd.nix
+  ./services/hardware/argonone.nix
   ./services/hardware/auto-cpufreq.nix
   ./services/hardware/bluetooth.nix
   ./services/hardware/bolt.nix
@@ -515,6 +515,7 @@
   ./services/mail/rspamd.nix
   ./services/mail/rss2email.nix
   ./services/mail/roundcube.nix
+  ./services/mail/schleuder.nix
   ./services/mail/sympa.nix
   ./services/mail/nullmailer.nix
   ./services/matrix/appservice-discord.nix
@@ -893,6 +894,7 @@
   ./services/networking/redsocks.nix
   ./services/networking/resilio.nix
   ./services/networking/robustirc-bridge.nix
+  ./services/networking/routedns.nix
   ./services/networking/rpcbind.nix
   ./services/networking/rxe.nix
   ./services/networking/sabnzbd.nix
diff --git a/nixos/modules/profiles/minimal.nix b/nixos/modules/profiles/minimal.nix
index e79b927238419..0e65989214a18 100644
--- a/nixos/modules/profiles/minimal.nix
+++ b/nixos/modules/profiles/minimal.nix
@@ -8,9 +8,6 @@ with lib;
 {
   environment.noXlibs = mkDefault true;
 
-  # This isn't perfect, but let's expect the user specifies an UTF-8 defaultLocale
-  i18n.supportedLocales = [ (config.i18n.defaultLocale + "/UTF-8") ];
-
   documentation.enable = mkDefault false;
 
   documentation.nixos.enable = mkDefault false;
diff --git a/nixos/modules/rename.nix b/nixos/modules/rename.nix
index 1d22627649304..7a6a6b5ed30bb 100644
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@@ -97,6 +97,7 @@ with lib;
     (mkRemovedOptionModule [ "services" "gogoclient" ] "The corresponding package was removed from nixpkgs.")
     (mkRemovedOptionModule [ "services" "virtuoso" ] "The corresponding package was removed from nixpkgs.")
     (mkRemovedOptionModule [ "services" "openfire" ] "The corresponding package was removed from nixpkgs.")
+    (mkRemovedOptionModule [ "services" "riak" ] "The corresponding package was removed from nixpkgs.")
 
     # Do NOT add any option renames here, see top of the file
   ];
diff --git a/nixos/modules/services/databases/riak.nix b/nixos/modules/services/databases/riak.nix
deleted file mode 100644
index cc4237d038cdb..0000000000000
--- a/nixos/modules/services/databases/riak.nix
+++ /dev/null
@@ -1,162 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-
-  cfg = config.services.riak;
-
-in
-
-{
-
-  ###### interface
-
-  options = {
-
-    services.riak = {
-
-      enable = mkEnableOption "riak";
-
-      package = mkOption {
-        type = types.package;
-        default = pkgs.riak;
-        defaultText = literalExpression "pkgs.riak";
-        description = ''
-          Riak package to use.
-        '';
-      };
-
-      nodeName = mkOption {
-        type = types.str;
-        default = "riak@127.0.0.1";
-        description = ''
-          Name of the Erlang node.
-        '';
-      };
-
-      distributedCookie = mkOption {
-        type = types.str;
-        default = "riak";
-        description = ''
-          Cookie for distributed node communication.  All nodes in the
-          same cluster should use the same cookie or they will not be able to
-          communicate.
-        '';
-      };
-
-      dataDir = mkOption {
-        type = types.path;
-        default = "/var/db/riak";
-        description = ''
-          Data directory for Riak.
-        '';
-      };
-
-      logDir = mkOption {
-        type = types.path;
-        default = "/var/log/riak";
-        description = ''
-          Log directory for Riak.
-        '';
-      };
-
-      extraConfig = mkOption {
-        type = types.lines;
-        default = "";
-        description = ''
-          Additional text to be appended to <filename>riak.conf</filename>.
-        '';
-      };
-
-      extraAdvancedConfig = mkOption {
-        type = types.lines;
-        default = "";
-        description = ''
-          Additional text to be appended to <filename>advanced.config</filename>.
-        '';
-      };
-
-    };
-
-  };
-
-  ###### implementation
-
-  config = mkIf cfg.enable {
-
-    environment.systemPackages = [ cfg.package ];
-    environment.etc."riak/riak.conf".text = ''
-      nodename = ${cfg.nodeName}
-      distributed_cookie = ${cfg.distributedCookie}
-
-      platform_log_dir = ${cfg.logDir}
-      platform_etc_dir = /etc/riak
-      platform_data_dir = ${cfg.dataDir}
-
-      ${cfg.extraConfig}
-    '';
-
-    environment.etc."riak/advanced.config".text = ''
-      ${cfg.extraAdvancedConfig}
-    '';
-
-    users.users.riak = {
-      name = "riak";
-      uid = config.ids.uids.riak;
-      group = "riak";
-      description = "Riak server user";
-    };
-
-    users.groups.riak.gid = config.ids.gids.riak;
-
-    systemd.services.riak = {
-      description = "Riak Server";
-
-      wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" ];
-
-      path = [
-        pkgs.util-linux # for `logger`
-        pkgs.bash
-      ];
-
-      environment.HOME = "${cfg.dataDir}";
-      environment.RIAK_DATA_DIR = "${cfg.dataDir}";
-      environment.RIAK_LOG_DIR = "${cfg.logDir}";
-      environment.RIAK_ETC_DIR = "/etc/riak";
-
-      preStart = ''
-        if ! test -e ${cfg.logDir}; then
-          mkdir -m 0755 -p ${cfg.logDir}
-          chown -R riak ${cfg.logDir}
-        fi
-
-        if ! test -e ${cfg.dataDir}; then
-          mkdir -m 0700 -p ${cfg.dataDir}
-          chown -R riak ${cfg.dataDir}
-        fi
-      '';
-
-      serviceConfig = {
-        ExecStart = "${cfg.package}/bin/riak console";
-        ExecStop = "${cfg.package}/bin/riak stop";
-        StandardInput = "tty";
-        User = "riak";
-        Group = "riak";
-        PermissionsStartOnly = true;
-        # Give Riak a decent amount of time to clean up.
-        TimeoutStopSec = 120;
-        LimitNOFILE = 65536;
-      };
-
-      unitConfig.RequiresMountsFor = [
-        "${cfg.dataDir}"
-        "${cfg.logDir}"
-        "/etc/riak"
-      ];
-    };
-
-  };
-
-}
diff --git a/nixos/modules/services/hardware/argonone.nix b/nixos/modules/services/hardware/argonone.nix
new file mode 100644
index 0000000000000..638181b1b12e2
--- /dev/null
+++ b/nixos/modules/services/hardware/argonone.nix
@@ -0,0 +1,58 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.hardware.argonone;
+in
+{
+  options.services.hardware.argonone = {
+    enable = lib.mkEnableOption "the driver for Argon One Raspberry Pi case fan and power button";
+    package = lib.mkOption {
+      type = lib.types.package;
+      default = pkgs.argononed;
+      defaultText = "pkgs.argononed";
+      description = ''
+        The package implementing the Argon One driver
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    hardware.i2c.enable = true;
+    hardware.deviceTree.overlays = [
+      {
+        name = "argononed";
+        dtboFile = "${cfg.package}/boot/overlays/argonone.dtbo";
+      }
+      {
+        name = "i2c1-okay-overlay";
+        dtsText = ''
+          /dts-v1/;
+          /plugin/;
+          / {
+            compatible = "brcm,bcm2711";
+            fragment@0 {
+              target = <&i2c1>;
+              __overlay__ {
+                status = "okay";
+              };
+            };
+          };
+        '';
+      }
+    ];
+    environment.systemPackages = [ cfg.package ];
+    systemd.services.argononed = {
+      description = "Argon One Raspberry Pi case Daemon Service";
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        Type = "forking";
+        ExecStart = "${cfg.package}/bin/argononed";
+        PIDFile = "/run/argononed.pid";
+        Restart = "on-failure";
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ misterio77 ];
+
+}
diff --git a/nixos/modules/services/mail/schleuder.nix b/nixos/modules/services/mail/schleuder.nix
new file mode 100644
index 0000000000000..7ba15f1070bde
--- /dev/null
+++ b/nixos/modules/services/mail/schleuder.nix
@@ -0,0 +1,162 @@
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.services.schleuder;
+  settingsFormat = pkgs.formats.yaml { };
+  postfixMap = entries: lib.concatStringsSep "\n" (lib.mapAttrsToList (name: value: "${name} ${value}") entries);
+  writePostfixMap = name: entries: pkgs.writeText name (postfixMap entries);
+  configScript = pkgs.writeScript "schleuder-cfg" ''
+    #!${pkgs.runtimeShell}
+    set -exuo pipefail
+    umask 0077
+    ${pkgs.yq}/bin/yq \
+      --slurpfile overrides <(${pkgs.yq}/bin/yq . <${lib.escapeShellArg cfg.extraSettingsFile}) \
+      < ${settingsFormat.generate "schleuder.yml" cfg.settings} \
+      '. * $overrides[0]' \
+      > /etc/schleuder/schleuder.yml
+    chown schleuder: /etc/schleuder/schleuder.yml
+  '';
+in
+{
+  options.services.schleuder = {
+    enable = lib.mkEnableOption "Schleuder secure remailer";
+    enablePostfix = lib.mkEnableOption "automatic postfix integration" // { default = true; };
+    lists = lib.mkOption {
+      description = ''
+        List of list addresses that should be handled by Schleuder.
+
+        Note that this is only handled by the postfix integration, and
+        the setup of the lists, their members and their keys has to be
+        performed separately via schleuder's API, using a tool such as
+        schleuder-cli.
+      '';
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      example = [ "widget-team@example.com" "security@example.com" ];
+    };
+    /* maybe one day....
+      domains = lib.mkOption {
+      description = "Domains for which all mail should be handled by Schleuder.";
+      type = lib.types.listOf lib.types.str;
+      default = [];
+      example = ["securelists.example.com"];
+      };
+    */
+    settings = lib.mkOption {
+      description = ''
+        Settings for schleuder.yml.
+
+        Check the <link xlink:href="https://0xacab.org/schleuder/schleuder/blob/master/etc/schleuder.yml">example configuration</link> for possible values.
+      '';
+      type = lib.types.submodule {
+        freeformType = settingsFormat.type;
+        options.keyserver = lib.mkOption {
+          type = lib.types.str;
+          description = ''
+            Key server from which to fetch and update keys.
+
+            Note that NixOS uses a different default from upstream, since the upstream default sks-keyservers.net is deprecated.
+          '';
+          default = "keys.openpgp.org";
+        };
+      };
+      default = { };
+    };
+    extraSettingsFile = lib.mkOption {
+      description = "YAML file to merge into the schleuder config at runtime. This can be used for secrets such as API keys.";
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+    };
+    listDefaults = lib.mkOption {
+      description = ''
+        Default settings for lists (list-defaults.yml).
+
+        Check the <link xlink:href="https://0xacab.org/schleuder/schleuder/-/blob/master/etc/list-defaults.yml">example configuration</link> for possible values.
+      '';
+      type = settingsFormat.type;
+      default = { };
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = !(cfg.settings.api ? valid_api_keys);
+        message = ''
+          services.schleuder.settings.api.valid_api_keys is set. Defining API keys via NixOS config results in them being copied to the world-readable Nix store. Please use the extraSettingsFile option to store API keys in a non-public location.
+        '';
+      }
+      {
+        assertion = !(lib.any (db: db ? password) (lib.attrValues cfg.settings.database or {}));
+        message = ''
+          A password is defined for at least one database in services.schleuder.settings.database. Defining passwords via NixOS config results in them being copied to the world-readable Nix store. Please use the extraSettingsFile option to store database passwords in a non-public location.
+        '';
+      }
+    ];
+    users.users.schleuder.isSystemUser = true;
+    users.users.schleuder.group = "schleuder";
+    users.groups.schleuder = {};
+    environment.systemPackages = [
+      pkgs.schleuder-cli
+    ];
+    services.postfix = lib.mkIf cfg.enablePostfix {
+      extraMasterConf = ''
+        schleuder  unix  -       n       n       -       -       pipe
+          flags=DRhu user=schleuder argv=/${pkgs.schleuder}/bin/schleuder work ''${recipient}
+      '';
+      transport = lib.mkIf (cfg.lists != [ ]) (postfixMap (lib.genAttrs cfg.lists (_: "schleuder:")));
+      extraConfig = ''
+        schleuder_destination_recipient_limit = 1
+      '';
+      # review: does this make sense?
+      localRecipients = lib.mkIf (cfg.lists != [ ]) cfg.lists;
+    };
+    systemd.services = let commonServiceConfig = {
+      # We would have liked to use DynamicUser, but since the default
+      # database is SQLite and lives in StateDirectory, and that same
+      # database needs to be readable from the postfix service, this
+      # isn't trivial to do.
+      User = "schleuder";
+      StateDirectory = "schleuder";
+      StateDirectoryMode = "0700";
+    }; in
+      {
+        schleuder-init = {
+          serviceConfig = commonServiceConfig // {
+            ExecStartPre = lib.mkIf (cfg.extraSettingsFile != null) [
+              "+${configScript}"
+            ];
+            ExecStart = [ "${pkgs.schleuder}/bin/schleuder install" ];
+            Type = "oneshot";
+          };
+        };
+        schleuder-api-daemon = {
+          after = [ "local-fs.target" "network.target" "schleuder-init.service" ];
+          wantedBy = [ "multi-user.target" ];
+          requires = [ "schleuder-init.service" ];
+          serviceConfig = commonServiceConfig // {
+            ExecStart = [ "${pkgs.schleuder}/bin/schleuder-api-daemon" ];
+          };
+        };
+        schleuder-weekly-key-maintenance = {
+          after = [ "local-fs.target" "network.target" ];
+          startAt = "weekly";
+          serviceConfig = commonServiceConfig // {
+            ExecStart = [
+              "${pkgs.schleuder}/bin/schleuder refresh_keys"
+              "${pkgs.schleuder}/bin/schleuder check_keys"
+            ];
+          };
+        };
+      };
+
+    environment.etc."schleuder/schleuder.yml" = lib.mkIf (cfg.extraSettingsFile == null) {
+      source = settingsFormat.generate "schleuder.yml" cfg.settings;
+    };
+    environment.etc."schleuder/list-defaults.yml".source = settingsFormat.generate "list-defaults.yml" cfg.listDefaults;
+
+    services.schleuder = {
+      #lists_dir = "/var/lib/schleuder.lists";
+      settings.filters_dir = lib.mkDefault "/var/lib/schleuder/filters";
+      settings.keyword_handlers_dir = lib.mkDefault "/var/lib/schleuder/keyword_handlers";
+    };
+  };
+}
diff --git a/nixos/modules/services/matrix/appservice-irc.nix b/nixos/modules/services/matrix/appservice-irc.nix
index b041c9c82c56e..ff938527ed58a 100644
--- a/nixos/modules/services/matrix/appservice-irc.nix
+++ b/nixos/modules/services/matrix/appservice-irc.nix
@@ -153,6 +153,9 @@ in {
     systemd.services.matrix-appservice-irc = {
       description = "Matrix-IRC bridge";
       before = [ "matrix-synapse.service" ]; # So the registration can be used by Synapse
+      after = lib.optionals (cfg.settings.database.engine == "postgres") [
+        "postgresql.service"
+      ];
       wantedBy = [ "multi-user.target" ];
 
       preStart = ''
diff --git a/nixos/modules/services/misc/gitlab.nix b/nixos/modules/services/misc/gitlab.nix
index 24eefb7bf302c..0b8bd08a22bc5 100644
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@@ -13,6 +13,22 @@ let
                       else
                         pkgs.postgresql_12;
 
+  # Git 2.36.1 seemingly contains a commit-graph related bug which is
+  # easily triggered through GitLab, so we downgrade it to 2.35.x
+  # until this issue is solved. See
+  # https://gitlab.com/gitlab-org/gitlab/-/issues/360783#note_992870101.
+  gitPackage =
+    let
+      version = "2.35.3";
+    in
+      pkgs.git.overrideAttrs (oldAttrs: rec {
+        inherit version;
+        src = pkgs.fetchurl {
+          url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
+          sha256 = "sha256-FenbT5vy7Z//MMtioAxcfAkBAV9asEjNtOiwTd7gD6I=";
+        };
+      });
+
   gitlabSocket = "${cfg.statePath}/tmp/sockets/gitlab.socket";
   gitalySocket = "${cfg.statePath}/tmp/sockets/gitaly.socket";
   pathUrlQuote = url: replaceStrings ["/"] ["%2F"] url;
@@ -41,7 +57,7 @@ let
     prometheus_listen_addr = "localhost:9236"
 
     [git]
-    bin_path = "${pkgs.git}/bin/git"
+    bin_path = "${gitPackage}/bin/git"
 
     [gitaly-ruby]
     dir = "${cfg.packages.gitaly.ruby}"
@@ -137,7 +153,7 @@ let
       };
       workhorse.secret_file = "${cfg.statePath}/.gitlab_workhorse_secret";
       gitlab_kas.secret_file = "${cfg.statePath}/.gitlab_kas_secret";
-      git.bin_path = "git";
+      git.bin_path = "${gitPackage}/bin/git";
       monitoring = {
         ip_whitelist = [ "127.0.0.0/8" "::1/128" ];
         sidekiq_exporter = {
@@ -1275,7 +1291,7 @@ in {
       });
       path = with pkgs; [
         postgresqlPackage
-        git
+        gitPackage
         ruby
         openssh
         nodejs
@@ -1306,7 +1322,7 @@ in {
       path = with pkgs; [
         openssh
         procps  # See https://gitlab.com/gitlab-org/gitaly/issues/1562
-        git
+        gitPackage
         cfg.packages.gitaly.rubyEnv
         cfg.packages.gitaly.rubyEnv.wrappedRuby
         gzip
@@ -1351,7 +1367,7 @@ in {
       partOf = [ "gitlab.target" ];
       path = with pkgs; [
         exiftool
-        git
+        gitPackage
         gnutar
         gzip
         openssh
@@ -1412,7 +1428,7 @@ in {
       environment = gitlabEnv;
       path = with pkgs; [
         postgresqlPackage
-        git
+        gitPackage
         openssh
         nodejs
         procps
diff --git a/nixos/modules/services/networking/routedns.nix b/nixos/modules/services/networking/routedns.nix
new file mode 100644
index 0000000000000..e0f5eedd2c8e5
--- /dev/null
+++ b/nixos/modules/services/networking/routedns.nix
@@ -0,0 +1,84 @@
+{ config
+, lib
+, pkgs
+, ...
+}:
+
+with lib;
+
+let
+  cfg = config.services.routedns;
+  settingsFormat = pkgs.formats.toml { };
+in
+{
+  options.services.routedns = {
+    enable = mkEnableOption "RouteDNS - DNS stub resolver, proxy and router";
+
+    settings = mkOption {
+      type = settingsFormat.type;
+      example = literalExpression ''
+        {
+          resolvers.cloudflare-dot = {
+            address = "1.1.1.1:853";
+            protocol = "dot";
+          };
+          groups.cloudflare-cached = {
+            type = "cache";
+            resolvers = ["cloudflare-dot"];
+          };
+          listeners.local-udp = {
+            address = "127.0.0.1:53";
+            protocol = "udp";
+            resolver = "cloudflare-cached";
+          };
+          listeners.local-tcp = {
+            address = "127.0.0.1:53";
+            protocol = "tcp";
+            resolver = "cloudflare-cached";
+          };
+        }
+      '';
+      description = ''
+        Configuration for RouteDNS, see <link xlink:href="https://github.com/folbricht/routedns/blob/master/doc/configuration.md"/>
+        for more information.
+      '';
+    };
+
+    configFile = mkOption {
+      default = settingsFormat.generate "routedns.toml" cfg.settings;
+      defaultText = "A RouteDNS configuration file automatically generated by values from services.routedns.*";
+      type = types.path;
+      example = literalExpression ''"''${pkgs.routedns}/cmd/routedns/example-config/use-case-1.toml"'';
+      description = "Path to RouteDNS TOML configuration file.";
+    };
+
+    package = mkOption {
+      default = pkgs.routedns;
+      defaultText = literalExpression "pkgs.routedns";
+      type = types.package;
+      description = "RouteDNS package to use.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.routedns = {
+      description = "RouteDNS - DNS stub resolver, proxy and router";
+      after = [ "network.target" ]; # in case a bootstrap resolver is used, this might fail a few times until the respective server is actually reachable
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network.target" ];
+      startLimitIntervalSec = 30;
+      startLimitBurst = 5;
+      serviceConfig = {
+        Restart = "on-failure";
+        RestartSec = "5s";
+        LimitNPROC = 512;
+        LimitNOFILE = 1048576;
+        DynamicUser = true;
+        AmbientCapabilities = "CAP_NET_BIND_SERVICE";
+        NoNewPrivileges = true;
+        ExecStart = "${getBin cfg.package}/bin/routedns -l 4 ${cfg.configFile}";
+      };
+    };
+  };
+  meta.maintainers = with maintainers; [ jsimonetti ];
+}
diff --git a/nixos/modules/services/networking/tailscale.nix b/nixos/modules/services/networking/tailscale.nix
index 0133874d0e0d0..f84252289abff 100644
--- a/nixos/modules/services/networking/tailscale.nix
+++ b/nixos/modules/services/networking/tailscale.nix
@@ -6,6 +6,7 @@ let
   cfg = config.services.tailscale;
   firewallOn = config.networking.firewall.enable;
   rpfMode = config.networking.firewall.checkReversePath;
+  isNetworkd = config.networking.useNetworkd;
   rpfIsStrict = rpfMode == true || rpfMode == "strict";
 in {
   meta.maintainers = with maintainers; [ danderson mbaillie twitchyliquid64 ];
@@ -69,5 +70,17 @@ in {
       # linux distros.
       stopIfChanged = false;
     };
+
+    networking.dhcpcd.denyInterfaces = [ cfg.interfaceName ];
+
+    systemd.network.networks."50-tailscale" = mkIf isNetworkd {
+      matchConfig = {
+        Name = cfg.interfaceName;
+      };
+      linkConfig = {
+        Unmanaged = true;
+        ActivationPolicy = "manual";
+      };
+    };
   };
 }
diff --git a/nixos/modules/services/networking/trickster.nix b/nixos/modules/services/networking/trickster.nix
index e48bba8fa587f..ac260a14d9a2d 100644
--- a/nixos/modules/services/networking/trickster.nix
+++ b/nixos/modules/services/networking/trickster.nix
@@ -6,6 +6,9 @@ let
   cfg = config.services.trickster;
 in
 {
+  imports = [
+    (mkRenamedOptionModule [ "services" "trickster" "origin" ] [ "services" "trickster" "origin-url" ])
+  ];
 
   options = {
     services.trickster = {
@@ -58,11 +61,19 @@ in
         '';
       };
 
-      origin = mkOption {
+      origin-type = mkOption {
+        type = types.enum [ "prometheus" "influxdb" ];
+        default = "prometheus";
+        description = ''
+          Type of origin (prometheus, influxdb)
+        '';
+      };
+
+      origin-url = mkOption {
         type = types.str;
         default = "http://prometheus:9090";
         description = ''
-          URL to the Prometheus Origin. Enter it like you would in grafana, e.g., http://prometheus:9090 (default http://prometheus:9090).
+          URL to the Origin. Enter it like you would in grafana, e.g., http://prometheus:9090 (default http://prometheus:9090).
         '';
       };
 
@@ -87,7 +98,7 @@ in
 
   config = mkIf cfg.enable {
     systemd.services.trickster = {
-      description = "Dashboard Accelerator for Prometheus";
+      description = "Reverse proxy cache and time series dashboard accelerator";
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
       serviceConfig = {
@@ -96,7 +107,8 @@ in
           ${cfg.package}/bin/trickster \
           -log-level ${cfg.log-level} \
           -metrics-port ${toString cfg.metrics-port} \
-          -origin ${cfg.origin} \
+          -origin-type ${cfg.origin-type} \
+          -origin-url ${cfg.origin-url} \
           -proxy-port ${toString cfg.proxy-port} \
           ${optionalString (cfg.configFile != null) "-config ${cfg.configFile}"} \
           ${optionalString (cfg.profiler-port != null) "-profiler-port ${cfg.profiler-port}"} \
diff --git a/nixos/modules/services/web-apps/tt-rss.nix b/nixos/modules/services/web-apps/tt-rss.nix
index 9aa38ab25c9a3..c441a2a7764e2 100644
--- a/nixos/modules/services/web-apps/tt-rss.nix
+++ b/nixos/modules/services/web-apps/tt-rss.nix
@@ -534,6 +534,7 @@ let
     services.phpfpm.pools = mkIf (cfg.pool == "${poolName}") {
       ${poolName} = {
         inherit (cfg) user;
+        phpPackage = pkgs.php80;
         settings = mapAttrs (name: mkDefault) {
           "listen.owner" = "nginx";
           "listen.group" = "nginx";
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index fa88ad524070c..87bed40eac9e8 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -472,7 +472,6 @@ in {
   restartByActivationScript = handleTest ./restart-by-activation-script.nix {};
   restic = handleTest ./restic.nix {};
   retroarch = handleTest ./retroarch.nix {};
-  riak = handleTest ./riak.nix {};
   robustirc-bridge = handleTest ./robustirc-bridge.nix {};
   roundcube = handleTest ./roundcube.nix {};
   rspamd = handleTest ./rspamd.nix {};
@@ -485,6 +484,7 @@ in {
   samba = handleTest ./samba.nix {};
   samba-wsdd = handleTest ./samba-wsdd.nix {};
   sanoid = handleTest ./sanoid.nix {};
+  schleuder = handleTest ./schleuder.nix {};
   sddm = handleTest ./sddm.nix {};
   seafile = handleTest ./seafile.nix {};
   searx = handleTest ./searx.nix {};
diff --git a/nixos/tests/kernel-generic.nix b/nixos/tests/kernel-generic.nix
index 5e6682d1045d6..04d52cf82e42b 100644
--- a/nixos/tests/kernel-generic.nix
+++ b/nixos/tests/kernel-generic.nix
@@ -30,7 +30,6 @@ let
       linux_5_4_hardened
       linux_5_10_hardened
       linux_5_15_hardened
-      linux_5_17_hardened
       linux_5_18_hardened
 
       linux_testing;
diff --git a/nixos/tests/matrix/appservice-irc.nix b/nixos/tests/matrix/appservice-irc.nix
index 7dd44da8305e0..78c53024ca6c4 100644
--- a/nixos/tests/matrix/appservice-irc.nix
+++ b/nixos/tests/matrix/appservice-irc.nix
@@ -193,6 +193,7 @@ import ../make-test-python.nix ({ pkgs, ... }:
 
     testScript = ''
       import pathlib
+      import os
 
       start_all()
 
@@ -206,7 +207,7 @@ import ../make-test-python.nix ({ pkgs, ... }:
       with subtest("copy the registration file"):
           appservice.copy_from_vm("/var/lib/matrix-appservice-irc/registration.yml")
           homeserver.copy_from_host(
-              pathlib.Path(os.environ.get("out", os.getcwd())) / "registration.yml", "/"
+              str(pathlib.Path(os.environ.get("out", os.getcwd())) / "registration.yml"), "/"
           )
           homeserver.succeed("chmod 444 /registration.yml")
 
diff --git a/nixos/tests/riak.nix b/nixos/tests/riak.nix
deleted file mode 100644
index e75d40fa25695..0000000000000
--- a/nixos/tests/riak.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-import ./make-test-python.nix ({ lib, pkgs, ... }: {
-  name = "riak";
-  meta = with lib.maintainers; {
-    maintainers = [ Br1ght0ne ];
-  };
-
-  nodes.machine = {
-    services.riak.enable = true;
-    services.riak.package = pkgs.riak;
-  };
-
-  testScript = ''
-    machine.start()
-
-    machine.wait_for_unit("riak")
-    machine.wait_until_succeeds("riak ping 2>&1")
-  '';
-})
diff --git a/nixos/tests/schleuder.nix b/nixos/tests/schleuder.nix
new file mode 100644
index 0000000000000..a9e4cc325bc76
--- /dev/null
+++ b/nixos/tests/schleuder.nix
@@ -0,0 +1,128 @@
+let
+  certs = import ./common/acme/server/snakeoil-certs.nix;
+  domain = certs.domain;
+in
+import ./make-test-python.nix {
+  name = "schleuder";
+  nodes.machine = { pkgs, ... }: {
+    imports = [ ./common/user-account.nix ];
+    services.postfix = {
+      enable = true;
+      enableSubmission = true;
+      tlsTrustedAuthorities = "${certs.ca.cert}";
+      sslCert = "${certs.${domain}.cert}";
+      sslKey = "${certs.${domain}.key}";
+      inherit domain;
+      destination = [ domain ];
+      localRecipients = [ "root" "alice" "bob" ];
+    };
+    services.schleuder = {
+      enable = true;
+      # Don't do it like this in production! The point of this setting
+      # is to allow loading secrets from _outside_ the world-readable
+      # Nix store.
+      extraSettingsFile = pkgs.writeText "schleuder-api-keys.yml" ''
+        api:
+          valid_api_keys:
+            - fnord
+      '';
+      lists = [ "security@${domain}" ];
+      settings.api = {
+        tls_cert_file = "${certs.${domain}.cert}";
+        tls_key_file = "${certs.${domain}.key}";
+      };
+    };
+
+    environment.systemPackages = [
+      pkgs.gnupg
+      pkgs.msmtp
+      (pkgs.writeScriptBin "do-test" ''
+        #!${pkgs.runtimeShell}
+        set -exuo pipefail
+
+        # Generate a GPG key with no passphrase and export it
+        sudo -u alice gpg --passphrase-fd 0 --batch --yes --quick-generate-key 'alice@${domain}' rsa4096 sign,encr < <(echo)
+        sudo -u alice gpg --armor --export alice@${domain} > alice.asc
+        # Create a new mailing list with alice as the owner, and alice's key
+        schleuder-cli list new security@${domain} alice@${domain} alice.asc
+
+        # Send an email from a non-member of the list. Use --auto-from so we don't have to specify who it's from twice.
+        msmtp --auto-from security@${domain} --host=${domain} --port=25 --tls --tls-starttls <<EOF
+          Subject: really big security issue!!
+          From: root@${domain}
+
+          I found a big security problem!
+        EOF
+
+        # Wait for delivery
+        (set +o pipefail; journalctl -f -n 1000 -u postfix | grep -m 1 'delivered to maildir')
+
+        # There should be exactly one email
+        mail=(/var/spool/mail/alice/new/*)
+        [[ "''${#mail[@]}" = 1 ]]
+
+        # Find the fingerprint of the mailing list key
+        read list_key_fp address < <(schleuder-cli keys list security@${domain} | grep security@)
+        schleuder-cli keys export security@${domain} $list_key_fp > list.asc
+
+        # Import the key into alice's keyring, so we can verify it as well as decrypting
+        sudo -u alice gpg --import <list.asc
+        # And perform the decryption.
+        sudo -u alice gpg -d $mail >decrypted
+        # And check that the text matches.
+        grep "big security problem" decrypted
+      '')
+
+      # For debugging:
+      # pkgs.vim pkgs.openssl pkgs.sqliteinteractive
+    ];
+
+    security.pki.certificateFiles = [ certs.ca.cert ];
+
+    # Since we don't have internet here, use dnsmasq to provide MX records from /etc/hosts
+    services.dnsmasq = {
+      enable = true;
+      extraConfig = ''
+        selfmx
+      '';
+    };
+
+    networking.extraHosts = ''
+      127.0.0.1 ${domain}
+    '';
+
+    # schleuder-cli's config is not quite optimal in several ways:
+    # - A fingerprint _must_ be pinned, it doesn't even have an option
+    #   to trust the PKI
+    # - It compares certificate fingerprints rather than key
+    #   fingerprints, so renewals break the pin (though that's not
+    #   relevant for this test)
+    # - It compares them as strings, which means we need to match the
+    #   expected format exactly. This means removing the :s and
+    #   lowercasing it.
+    # Refs:
+    # https://0xacab.org/schleuder/schleuder-cli/-/issues/16
+    # https://0xacab.org/schleuder/schleuder-cli/-/blob/f8895b9f47083d8c7b99a2797c93f170f3c6a3c0/lib/schleuder-cli/helper.rb#L230-238
+    systemd.tmpfiles.rules = let cliconfig = pkgs.runCommand "schleuder-cli.yml"
+      {
+        nativeBuildInputs = [ pkgs.jq pkgs.openssl ];
+      } ''
+      fp=$(openssl x509 -in ${certs.${domain}.cert} -noout -fingerprint -sha256 | cut -d = -f 2 | tr -d : | tr 'A-Z' 'a-z')
+      cat > $out <<EOF
+      host: localhost
+      port: 4443
+      tls_fingerprint: "$fp"
+      api_key: fnord
+      EOF
+    ''; in
+      [
+        "L+ /root/.schleuder-cli/schleuder-cli.yml - - - - ${cliconfig}"
+      ];
+  };
+
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_until_succeeds("nc -z localhost 4443")
+    machine.succeed("do-test")
+  '';
+}
diff --git a/nixos/tests/systemd-networkd-vrf.nix b/nixos/tests/systemd-networkd-vrf.nix
index 8a1580fc2ada7..3c18f788e927d 100644
--- a/nixos/tests/systemd-networkd-vrf.nix
+++ b/nixos/tests/systemd-networkd-vrf.nix
@@ -138,18 +138,18 @@ in {
   };
 
   testScript = ''
-    def compare_tables(expected, actual):
-        assert (
-            expected == actual
-        ), """
-        Routing tables don't match!
-        Expected:
-          {}
-        Actual:
-          {}
-        """.format(
-            expected, actual
-        )
+    import json
+
+    def compare(raw_json, to_compare):
+        data = json.loads(raw_json)
+        assert len(raw_json) >= len(to_compare)
+        for i, row in enumerate(to_compare):
+            actual = data[i]
+            assert len(row.keys()) > 0
+            for key, value in row.items():
+                assert value == actual[key], f"""
+                  In entry {i}, value {key}: got: {actual[key]}, expected {value}
+                """
 
 
     start_all()
@@ -159,23 +159,18 @@ in {
     node2.wait_for_unit("network.target")
     node3.wait_for_unit("network.target")
 
-    # NOTE: please keep in mind that the trailing whitespaces in the following strings
-    # are intentional as the output is compared against the raw `iproute2`-output.
-    # editorconfig-checker-disable
     client_ipv4_table = """
-    192.168.1.2 dev vrf1 proto static metric 100 
+    192.168.1.2 dev vrf1 proto static metric 100\x20
     192.168.2.3 dev vrf2 proto static metric 100
     """.strip()
     vrf1_table = """
-    broadcast 192.168.1.0 dev eth1 proto kernel scope link src 192.168.1.1 
-    192.168.1.0/24 dev eth1 proto kernel scope link src 192.168.1.1 
-    local 192.168.1.1 dev eth1 proto kernel scope host src 192.168.1.1 
+    192.168.1.0/24 dev eth1 proto kernel scope link src 192.168.1.1\x20
+    local 192.168.1.1 dev eth1 proto kernel scope host src 192.168.1.1\x20
     broadcast 192.168.1.255 dev eth1 proto kernel scope link src 192.168.1.1
     """.strip()
     vrf2_table = """
-    broadcast 192.168.2.0 dev eth2 proto kernel scope link src 192.168.2.1 
-    192.168.2.0/24 dev eth2 proto kernel scope link src 192.168.2.1 
-    local 192.168.2.1 dev eth2 proto kernel scope host src 192.168.2.1 
+    192.168.2.0/24 dev eth2 proto kernel scope link src 192.168.2.1\x20
+    local 192.168.2.1 dev eth2 proto kernel scope host src 192.168.2.1\x20
     broadcast 192.168.2.255 dev eth2 proto kernel scope link src 192.168.2.1
     """.strip()
     # editorconfig-checker-enable
@@ -183,14 +178,28 @@ in {
     # Check that networkd properly configures the main routing table
     # and the routing tables for the VRF.
     with subtest("check vrf routing tables"):
-        compare_tables(
-            client_ipv4_table, client.succeed("ip -4 route list | head -n2").strip()
+        compare(
+            client.succeed("ip --json -4 route list"),
+            [
+                {"dst": "192.168.1.2", "dev": "vrf1", "metric": 100},
+                {"dst": "192.168.2.3", "dev": "vrf2", "metric": 100}
+            ]
         )
-        compare_tables(
-            vrf1_table, client.succeed("ip -4 route list table 23 | head -n4").strip()
+        compare(
+            client.succeed("ip --json -4 route list table 23"),
+            [
+                {"dst": "192.168.1.0/24", "dev": "eth1", "prefsrc": "192.168.1.1"},
+                {"type": "local", "dst": "192.168.1.1", "dev": "eth1", "prefsrc": "192.168.1.1"},
+                {"type": "broadcast", "dev": "eth1", "prefsrc": "192.168.1.1", "dst": "192.168.1.255"}
+            ]
         )
-        compare_tables(
-            vrf2_table, client.succeed("ip -4 route list table 42 | head -n4").strip()
+        compare(
+            client.succeed("ip --json -4 route list table 42"),
+            [
+                {"dst": "192.168.2.0/24", "dev": "eth2", "prefsrc": "192.168.2.1"},
+                {"type": "local", "dst": "192.168.2.1", "dev": "eth2", "prefsrc": "192.168.2.1"},
+                {"type": "broadcast", "dev": "eth2", "prefsrc": "192.168.2.1", "dst": "192.168.2.255"}
+            ]
         )
 
     # Ensure that other nodes are reachable via ICMP through the VRF.
diff --git a/nixos/tests/traefik.nix b/nixos/tests/traefik.nix
index 1d6c0a479ef62..989ec390c0603 100644
--- a/nixos/tests/traefik.nix
+++ b/nixos/tests/traefik.nix
@@ -11,14 +11,20 @@ import ./make-test-python.nix ({ pkgs, ... }: {
       environment.systemPackages = [ pkgs.curl ];
     };
     traefik = { config, pkgs, ... }: {
-      virtualisation.oci-containers.containers.nginx = {
-        extraOptions = [
-          "-l" "traefik.enable=true"
-          "-l" "traefik.http.routers.nginx.entrypoints=web"
-          "-l" "traefik.http.routers.nginx.rule=Host(`nginx.traefik.test`)"
-        ];
-        image = "nginx-container";
-        imageFile = pkgs.dockerTools.examples.nginx;
+      virtualisation.oci-containers = {
+        backend = "docker";
+        containers.nginx = {
+          extraOptions = [
+            "-l"
+            "traefik.enable=true"
+            "-l"
+            "traefik.http.routers.nginx.entrypoints=web"
+            "-l"
+            "traefik.http.routers.nginx.rule=Host(`nginx.traefik.test`)"
+          ];
+          image = "nginx-container";
+          imageFile = pkgs.dockerTools.examples.nginx;
+        };
       };
 
       networking.firewall.allowedTCPPorts = [ 80 ];
diff --git a/nixos/tests/vengi-tools.nix b/nixos/tests/vengi-tools.nix
index 8b80a13384e5a..5bc8d72c77237 100644
--- a/nixos/tests/vengi-tools.nix
+++ b/nixos/tests/vengi-tools.nix
@@ -23,7 +23,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
       # OCR on voxedit's window is very expensive, so we avoid wasting a try
       # by letting the window load fully first
       machine.sleep(15)
-      machine.wait_for_text("Palette")
+      machine.wait_for_text("Solid")
       machine.screenshot("screen")
     '';
 })
diff --git a/pkgs/applications/audio/baudline/default.nix b/pkgs/applications/audio/baudline/default.nix
index b2a74e23dc5ea..6e5c53091d7c6 100644
--- a/pkgs/applications/audio/baudline/default.nix
+++ b/pkgs/applications/audio/baudline/default.nix
@@ -63,6 +63,7 @@ stdenv.mkDerivation rec {
     # See http://www.baudline.com/faq.html#licensing_terms.
     # (Do NOT (re)distribute on hydra.)
     license = licenses.unfree;
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     platforms = [ "x86_64-linux" "i686-linux" ];
     maintainers = [ maintainers.bjornfor ];
   };
diff --git a/pkgs/applications/audio/easyeffects/default.nix b/pkgs/applications/audio/easyeffects/default.nix
index ff7cce36712de..46b801bba331d 100644
--- a/pkgs/applications/audio/easyeffects/default.nix
+++ b/pkgs/applications/audio/easyeffects/default.nix
@@ -35,13 +35,13 @@
 
 stdenv.mkDerivation rec {
   pname = "easyeffects";
-  version = "6.2.5";
+  version = "6.2.6";
 
   src = fetchFromGitHub {
     owner = "wwmm";
     repo = "easyeffects";
     rev = "v${version}";
-    sha256 = "sha256-LvTvNBo3aUGUD4vA04YtINFBjTplhmkxj3FlbTZDTA0=";
+    sha256 = "sha256-1kXYh2Qk0Wj0LgHTcRVAKro7LAPV/UM5i9VmHjmxTx0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/audio/geonkick/default.nix b/pkgs/applications/audio/geonkick/default.nix
index 9739a88586ae0..0a99edd7b069c 100644
--- a/pkgs/applications/audio/geonkick/default.nix
+++ b/pkgs/applications/audio/geonkick/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "geonkick";
-  version = "2.9.0";
+  version = "2.9.1";
 
   src = fetchFromGitLab {
     owner = "iurie-sw";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-/BDK1PyRw4xOt+rzC9yX29aRQb1aDnDBIenSz+859OY=";
+    sha256 = "sha256-XSqcj8+X6QMBnIusPB9VNrgcbdiWhNMOYeFyKklGmO8=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/applications/audio/hqplayer-desktop/default.nix b/pkgs/applications/audio/hqplayer-desktop/default.nix
index 5cfd9c7cbe898..17c8f936efd11 100644
--- a/pkgs/applications/audio/hqplayer-desktop/default.nix
+++ b/pkgs/applications/audio/hqplayer-desktop/default.nix
@@ -86,6 +86,7 @@ mkDerivation rec {
     homepage = "https://www.signalyst.com/custom.html";
     description = "High-end upsampling multichannel software HD-audio player";
     license = licenses.unfree;
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     platforms = [ "x86_64-linux" ];
     maintainers = with maintainers; [ lovesegfault ];
   };
diff --git a/pkgs/applications/audio/losslessaudiochecker/default.nix b/pkgs/applications/audio/losslessaudiochecker/default.nix
index 9fecf7b9ba924..b7150d6b67713 100644
--- a/pkgs/applications/audio/losslessaudiochecker/default.nix
+++ b/pkgs/applications/audio/losslessaudiochecker/default.nix
@@ -22,6 +22,7 @@ stdenv.mkDerivation {
   meta = {
     description = "Utility to check whether audio is truly lossless or not";
     homepage = "https://losslessaudiochecker.com";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.unfree;
     platforms = [ "x86_64-linux" ];
     maintainers = with lib.maintainers; [ p-h ];
diff --git a/pkgs/applications/audio/midas/generic.nix b/pkgs/applications/audio/midas/generic.nix
index b58bd0b275726..8c34318191bcf 100644
--- a/pkgs/applications/audio/midas/generic.nix
+++ b/pkgs/applications/audio/midas/generic.nix
@@ -35,6 +35,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     inherit homepage;
     description = "Editor for the ${brand} ${type} digital mixer";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     platforms = platforms.linux;
     maintainers = [ maintainers.magnetophon ];
diff --git a/pkgs/applications/audio/ncpamixer/default.nix b/pkgs/applications/audio/ncpamixer/default.nix
index aca96ef5da351..7663d1745d2fb 100644
--- a/pkgs/applications/audio/ncpamixer/default.nix
+++ b/pkgs/applications/audio/ncpamixer/default.nix
@@ -24,6 +24,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/fulhax/ncpamixer";
     license = licenses.mit;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ StijnDW SuperSandro2000 ];
+    maintainers = with maintainers; [ StijnDW ] ++ teams.c3d2.members;
   };
 }
diff --git a/pkgs/applications/audio/ocenaudio/default.nix b/pkgs/applications/audio/ocenaudio/default.nix
index 8fe6beebc4b8d..1bbbe3583f90a 100644
--- a/pkgs/applications/audio/ocenaudio/default.nix
+++ b/pkgs/applications/audio/ocenaudio/default.nix
@@ -47,6 +47,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Cross-platform, easy to use, fast and functional audio editor";
     homepage = "https://www.ocenaudio.com";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     platforms = platforms.linux;
     maintainers = with maintainers; [ onny ];
diff --git a/pkgs/applications/audio/pocket-casts/default.nix b/pkgs/applications/audio/pocket-casts/default.nix
index 46625253d0f6a..7b7bf50a2f83f 100644
--- a/pkgs/applications/audio/pocket-casts/default.nix
+++ b/pkgs/applications/audio/pocket-casts/default.nix
@@ -48,6 +48,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Pocket Casts webapp, packaged for the Linux Desktop";
     homepage = "https://github.com/felicianotech/pocket-casts-desktop-app";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.mit;
     maintainers = with maintainers; [ wolfangaukang ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/audio/reaper/default.nix b/pkgs/applications/audio/reaper/default.nix
index 820475be0c65b..d186755eccea2 100644
--- a/pkgs/applications/audio/reaper/default.nix
+++ b/pkgs/applications/audio/reaper/default.nix
@@ -76,6 +76,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Digital audio workstation";
     homepage = "https://www.reaper.fm/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     platforms = [ "x86_64-linux" "aarch64-linux" ];
     maintainers = with maintainers; [ jfrankenau ilian orivej uniquepointer ];
diff --git a/pkgs/applications/audio/redux/default.nix b/pkgs/applications/audio/redux/default.nix
index 45ee78917ace3..41254cc9e50ee 100644
--- a/pkgs/applications/audio/redux/default.nix
+++ b/pkgs/applications/audio/redux/default.nix
@@ -42,6 +42,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Sample-based instrument, with a powerful phrase sequencer";
     homepage = "https://www.renoise.com/products/redux";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     maintainers = with maintainers; [ mihnea-s ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/audio/renoise/default.nix b/pkgs/applications/audio/renoise/default.nix
index acd1d80c86d57..1be3f53dce5f9 100644
--- a/pkgs/applications/audio/renoise/default.nix
+++ b/pkgs/applications/audio/renoise/default.nix
@@ -79,6 +79,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Modern tracker-based DAW";
     homepage = "https://www.renoise.com/";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     maintainers = [];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/audio/rymcast/default.nix b/pkgs/applications/audio/rymcast/default.nix
index 92d3151c835c0..06e711941a637 100644
--- a/pkgs/applications/audio/rymcast/default.nix
+++ b/pkgs/applications/audio/rymcast/default.nix
@@ -25,6 +25,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Player for Mega Drive/Genesis VGM files";
     homepage = "https://www.inphonik.com/products/rymcast-genesis-vgm-player/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     platforms = [ "x86_64-linux" ];
     maintainers = with maintainers; [ astsmtl ];
diff --git a/pkgs/applications/audio/soundwireserver/default.nix b/pkgs/applications/audio/soundwireserver/default.nix
index db8d28989b27a..b296ebdad602a 100755
--- a/pkgs/applications/audio/soundwireserver/default.nix
+++ b/pkgs/applications/audio/soundwireserver/default.nix
@@ -35,6 +35,7 @@ qt5.mkDerivation {
     homepage = "https://georgielabs.net/";
     maintainers = with maintainers; [ mkg20001 ];
     platforms = [ "x86_64-linux" ];
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
   };
 }
diff --git a/pkgs/applications/audio/spotify/default.nix b/pkgs/applications/audio/spotify/default.nix
index 14caa6db9c45f..ecbdaec7f28af 100644
--- a/pkgs/applications/audio/spotify/default.nix
+++ b/pkgs/applications/audio/spotify/default.nix
@@ -167,6 +167,7 @@ stdenv.mkDerivation {
   meta = with lib; {
     homepage = "https://www.spotify.com/";
     description = "Play music from the Spotify music service";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     maintainers = with maintainers; [ eelco ftrvxmtrx sheenobu mudri timokau ma27 ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/audio/sunvox/default.nix b/pkgs/applications/audio/sunvox/default.nix
index 503079b9ed4b8..1bde46cdc944c 100644
--- a/pkgs/applications/audio/sunvox/default.nix
+++ b/pkgs/applications/audio/sunvox/default.nix
@@ -41,6 +41,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Small, fast and powerful modular synthesizer with pattern-based sequencer";
     license = licenses.unfreeRedistributable;
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     homepage = "http://www.warmplace.ru/soft/sunvox/";
     maintainers = with maintainers; [ puffnfresh ];
     platforms = [ "i686-linux" "x86_64-linux" ];
diff --git a/pkgs/applications/audio/tidal-hifi/default.nix b/pkgs/applications/audio/tidal-hifi/default.nix
new file mode 100644
index 0000000000000..1befa966d3514
--- /dev/null
+++ b/pkgs/applications/audio/tidal-hifi/default.nix
@@ -0,0 +1,119 @@
+{ lib
+, stdenv
+, fetchurl
+, autoPatchelfHook
+, dpkg
+, makeWrapper
+, alsa-lib
+, at-spi2-atk
+, at-spi2-core
+, atk
+, cairo
+, cups
+, dbus
+, expat
+, ffmpeg
+, fontconfig
+, freetype
+, gdk-pixbuf
+, glib
+, gtk3
+, libappindicator-gtk3
+, libdbusmenu
+, libdrm
+, libnotify
+, libpulseaudio
+, libsecret
+, libuuid
+, libxkbcommon
+, mesa
+, nss
+, pango
+, systemd
+, xdg-utils
+, xorg
+}:
+
+stdenv.mkDerivation rec {
+  pname = "tidal-hifi";
+  version = "4.0.0";
+
+  src = fetchurl {
+    url = "https://github.com/Mastermindzh/tidal-hifi/releases/download/${version}/tidal-hifi_${version}_amd64.deb";
+    sha256 = "19gx9x3v5ywlvg5vyqgj6pghzwinby0i8isavfrix798pfr98j5z";
+  };
+
+  nativeBuildInputs = [ autoPatchelfHook dpkg makeWrapper ];
+
+  buildInputs = [
+    alsa-lib
+    at-spi2-atk
+    at-spi2-core
+    atk
+    cairo
+    cups
+    dbus
+    expat
+    ffmpeg
+    fontconfig
+    freetype
+    gdk-pixbuf
+    glib
+    gtk3
+    pango
+    systemd
+    mesa # for libgbm
+    nss
+    libuuid
+    libdrm
+    libnotify
+    libsecret
+    libpulseaudio
+    libxkbcommon
+    libappindicator-gtk3
+    xorg.libX11
+    xorg.libxcb
+    xorg.libXcomposite
+    xorg.libXcursor
+    xorg.libXdamage
+    xorg.libXext
+    xorg.libXfixes
+    xorg.libXi
+    xorg.libXrandr
+    xorg.libXrender
+    xorg.libXScrnSaver
+    xorg.libxshmfence
+    xorg.libXtst
+  ];
+
+  runtimeDependencies =
+    [ (lib.getLib systemd) libnotify libdbusmenu xdg-utils ];
+
+  unpackPhase = "dpkg-deb -x $src .";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out/bin"
+    cp -R "opt" "$out"
+    cp -R "usr/share" "$out/share"
+    chmod -R g-w "$out"
+
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    makeWrapper $out/opt/tidal-hifi/tidal-hifi $out/bin/tidal-hifi \
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath buildInputs}" \
+      "''${gappsWrapperArgs[@]}"
+  '';
+
+  meta = with lib; {
+    description = "The web version of Tidal running in electron with hifi support thanks to widevine";
+    homepage = "https://github.com/Mastermindzh/tidal-hifi";
+    changelog = "https://github.com/Mastermindzh/tidal-hifi/releases/tag/${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ alternateved ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/applications/audio/tonelib-gfx/default.nix b/pkgs/applications/audio/tonelib-gfx/default.nix
index a0b3cf2879e6b..682627c0e8218 100644
--- a/pkgs/applications/audio/tonelib-gfx/default.nix
+++ b/pkgs/applications/audio/tonelib-gfx/default.nix
@@ -51,6 +51,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Tonelib GFX is an amp and effects modeling software for electric guitar and bass.";
     homepage = "https://tonelib.net/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     maintainers = with maintainers; [ dan4ik605743 orivej ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/audio/tonelib-jam/default.nix b/pkgs/applications/audio/tonelib-jam/default.nix
index 17b3b1197f458..9229cba4839a2 100644
--- a/pkgs/applications/audio/tonelib-jam/default.nix
+++ b/pkgs/applications/audio/tonelib-jam/default.nix
@@ -54,6 +54,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "ToneLib Jam – the learning and practice software for guitar players";
     homepage = "https://tonelib.net/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     maintainers = with maintainers; [ dan4ik605743 ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/audio/tonelib-metal/default.nix b/pkgs/applications/audio/tonelib-metal/default.nix
index 9acb6982c6a72..29c5cb6a3f24e 100644
--- a/pkgs/applications/audio/tonelib-metal/default.nix
+++ b/pkgs/applications/audio/tonelib-metal/default.nix
@@ -53,6 +53,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "ToneLib Metal – Guitar amp simulator targeted at metal players";
     homepage = "https://tonelib.net/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     maintainers = with maintainers; [ dan4ik605743 ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/audio/tonelib-zoom/default.nix b/pkgs/applications/audio/tonelib-zoom/default.nix
index 41539503e0203..74fe8645acf3c 100644
--- a/pkgs/applications/audio/tonelib-zoom/default.nix
+++ b/pkgs/applications/audio/tonelib-zoom/default.nix
@@ -56,6 +56,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "ToneLib Zoom – change and save all the settings in your Zoom(r) guitar pedal";
     homepage = "https://tonelib.net/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     maintainers = with maintainers; [ dan4ik605743 ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/audio/transcribe/default.nix b/pkgs/applications/audio/transcribe/default.nix
index d10a0d8794180..06f0d47d8a2cd 100644
--- a/pkgs/applications/audio/transcribe/default.nix
+++ b/pkgs/applications/audio/transcribe/default.nix
@@ -95,6 +95,7 @@ stdenv.mkDerivation rec {
       conventional music players.
     '';
     homepage = "https://www.seventhstring.com/xscribe/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     platforms = platforms.linux;
   };
diff --git a/pkgs/applications/audio/virtual-ans/default.nix b/pkgs/applications/audio/virtual-ans/default.nix
index c1e41e41284d3..07f006aa0cc1a 100644
--- a/pkgs/applications/audio/virtual-ans/default.nix
+++ b/pkgs/applications/audio/virtual-ans/default.nix
@@ -80,6 +80,7 @@ stdenv.mkDerivation rec {
       + supported sound systems: ASIO, DirectSound, MME, ALSA, OSS, JACK, Audiobus, IAA.
       '';
     homepage = "https://warmplace.ru/soft/ans/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.free;
     # I cannot test the Darwin version, so I'll leave it disabled
     platforms = [ "x86_64-linux" "i686-linux" ];
diff --git a/pkgs/applications/blockchains/exodus/default.nix b/pkgs/applications/blockchains/exodus/default.nix
index d13278b7deecd..654da25261d3f 100644
--- a/pkgs/applications/blockchains/exodus/default.nix
+++ b/pkgs/applications/blockchains/exodus/default.nix
@@ -76,6 +76,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://www.exodus.io/";
     description = "Top-rated cryptocurrency wallet with Trezor integration and built-in Exchange";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     platforms = platforms.linux;
     maintainers = with maintainers; [ mmahut rople380 ];
diff --git a/pkgs/applications/blockchains/sparrow/default.nix b/pkgs/applications/blockchains/sparrow/default.nix
index bf43bac96958a..e3b54a7465634 100644
--- a/pkgs/applications/blockchains/sparrow/default.nix
+++ b/pkgs/applications/blockchains/sparrow/default.nix
@@ -225,6 +225,10 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "A modern desktop Bitcoin wallet application supporting most hardware wallets and built on common standards such as PSBT, with an emphasis on transparency and usability.";
     homepage = "https://sparrowwallet.com";
+    sourceProvenance = with sourceTypes; [
+      binaryBytecode
+      binaryNativeCode
+    ];
     license = licenses.asl20;
     maintainers = with maintainers; [ emmanuelrosa _1000101 ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/blockchains/wasabibackend/default.nix b/pkgs/applications/blockchains/wasabibackend/default.nix
index df30302bc6c50..e4e97cae21a0d 100644
--- a/pkgs/applications/blockchains/wasabibackend/default.nix
+++ b/pkgs/applications/blockchains/wasabibackend/default.nix
@@ -43,6 +43,7 @@ buildDotnetModule rec {
   meta = with lib; {
     description = "Backend for the Wasabi Wallet";
     homepage = "https://wasabiwallet.io/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.mit;
     maintainers = with maintainers; [ mmahut ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/blockchains/wasabiwallet/default.nix b/pkgs/applications/blockchains/wasabiwallet/default.nix
index e3cea78629f41..71ee383282390 100644
--- a/pkgs/applications/blockchains/wasabiwallet/default.nix
+++ b/pkgs/applications/blockchains/wasabiwallet/default.nix
@@ -60,6 +60,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Privacy focused Bitcoin wallet";
     homepage = "https://wasabiwallet.io/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.mit;
     platforms = [ "x86_64-linux" ];
     maintainers = with maintainers; [ mmahut ];
diff --git a/pkgs/applications/editors/atom/default.nix b/pkgs/applications/editors/atom/default.nix
index 325dfdd85d3b1..29c4bb6c884c9 100644
--- a/pkgs/applications/editors/atom/default.nix
+++ b/pkgs/applications/editors/atom/default.nix
@@ -86,6 +86,7 @@ let
     meta = with lib; {
       description = "A hackable text editor for the 21st Century";
       homepage = "https://atom.io/";
+      sourceProvenance = with sourceTypes; [ binaryNativeCode ];
       license = licenses.mit;
       maintainers = with maintainers; [ offline ysndr ];
       platforms = platforms.x86_64;
diff --git a/pkgs/applications/editors/eclipse/build-eclipse.nix b/pkgs/applications/editors/eclipse/build-eclipse.nix
index 39b94664f0475..19a2e378f30a7 100644
--- a/pkgs/applications/editors/eclipse/build-eclipse.nix
+++ b/pkgs/applications/editors/eclipse/build-eclipse.nix
@@ -58,6 +58,7 @@ stdenv.mkDerivation rec {
   meta = {
     homepage = "http://www.eclipse.org/";
     inherit description;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     platforms = [ "x86_64-linux" ];
   };
 
diff --git a/pkgs/applications/editors/pinegrow/default.nix b/pkgs/applications/editors/pinegrow/default.nix
index 65604926b8fda..1149117e67b24 100644
--- a/pkgs/applications/editors/pinegrow/default.nix
+++ b/pkgs/applications/editors/pinegrow/default.nix
@@ -74,6 +74,7 @@ stdenv.mkDerivation rec {
     homepage = "https://pinegrow.com";
     description = "UI Web Editor";
     platforms = [ "x86_64-linux" ];
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = with licenses; [ unfreeRedistributable ];
     maintainers = with maintainers; [ gador ];
   };
diff --git a/pkgs/applications/editors/quartus-prime/quartus.nix b/pkgs/applications/editors/quartus-prime/quartus.nix
index 9475f44170314..4b56698602382 100644
--- a/pkgs/applications/editors/quartus-prime/quartus.nix
+++ b/pkgs/applications/editors/quartus-prime/quartus.nix
@@ -89,6 +89,7 @@ in stdenv.mkDerivation rec {
   meta = with lib; {
     inherit homepage;
     description = "FPGA design and simulation software";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     platforms = platforms.linux;
     hydraPlatforms = [ ]; # requireFile srcs cannot be fetched by hydra, ignore
diff --git a/pkgs/applications/editors/rehex/default.nix b/pkgs/applications/editors/rehex/default.nix
index 3b169bf4e5331..52134d15da823 100644
--- a/pkgs/applications/editors/rehex/default.nix
+++ b/pkgs/applications/editors/rehex/default.nix
@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/solemnwarning/rehex";
     changelog = "https://github.com/solemnwarning/rehex/raw/${version}/CHANGES.txt";
     license = licenses.gpl2Only;
-    maintainers = with maintainers; [ markus1189 SuperSandro2000 ];
+    maintainers = with maintainers; [ markus1189 ];
     platforms = platforms.all;
   };
 }
diff --git a/pkgs/applications/editors/sublime/2/default.nix b/pkgs/applications/editors/sublime/2/default.nix
index 074584e3360e5..6c9a43779f763 100644
--- a/pkgs/applications/editors/sublime/2/default.nix
+++ b/pkgs/applications/editors/sublime/2/default.nix
@@ -62,6 +62,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Sophisticated text editor for code, markup and prose";
     license = lib.licenses.unfree;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     platforms = [ "x86_64-linux" "i686-linux" ];
   };
 }
diff --git a/pkgs/applications/editors/sublime/3/common.nix b/pkgs/applications/editors/sublime/3/common.nix
index a5cf2d560c015..e1d5b3d4d36e3 100644
--- a/pkgs/applications/editors/sublime/3/common.nix
+++ b/pkgs/applications/editors/sublime/3/common.nix
@@ -131,6 +131,7 @@ in stdenv.mkDerivation (rec {
     description = "Sophisticated text editor for code, markup and prose";
     homepage = "https://www.sublimetext.com/";
     maintainers = with maintainers; [ jtojnar wmertens demin-dmitriy zimbatm ];
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     platforms = [ "x86_64-linux" "i686-linux" ];
   };
diff --git a/pkgs/applications/editors/sublime/4/common.nix b/pkgs/applications/editors/sublime/4/common.nix
index 81eaa442425bc..de9bf276aa5bf 100644
--- a/pkgs/applications/editors/sublime/4/common.nix
+++ b/pkgs/applications/editors/sublime/4/common.nix
@@ -142,6 +142,7 @@ in stdenv.mkDerivation (rec {
     description = "Sophisticated text editor for code, markup and prose";
     homepage = "https://www.sublimetext.com/";
     maintainers = with maintainers; [ jtojnar wmertens demin-dmitriy zimbatm ];
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     platforms = [ "aarch64-linux" "x86_64-linux" ];
   };
diff --git a/pkgs/applications/editors/vim/default.nix b/pkgs/applications/editors/vim/default.nix
index d8167f6098791..42a1b730fe15f 100644
--- a/pkgs/applications/editors/vim/default.nix
+++ b/pkgs/applications/editors/vim/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, callPackage, ncurses, gettext, pkg-config
+{ lib, stdenv, fetchurl, callPackage, ncurses, bash, gawk, gettext, pkg-config
 # default vimrc
 , vimrc ? fetchurl {
     name = "default-vimrc";
@@ -18,9 +18,11 @@ stdenv.mkDerivation {
   inherit (common) version src postPatch hardeningDisable enableParallelBuilding meta;
 
   nativeBuildInputs = [ gettext pkg-config ];
-  buildInputs = [ ncurses ]
+  buildInputs = [ ncurses bash gawk ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [ Carbon Cocoa ];
 
+  strictDeps = true;
+
   configureFlags = [
     "--enable-multibyte"
     "--enable-nls"
@@ -36,6 +38,13 @@ stdenv.mkDerivation {
     "vim_cv_memmove_handles_overlap=yes"
   ];
 
+  # which.sh is used to for vim's own shebang patching, so make it find
+  # binaries for the host platform.
+  preConfigure = ''
+    export HOST_PATH
+    substituteInPlace src/which.sh --replace '$PATH' '$HOST_PATH'
+  '';
+
   postInstall = ''
     ln -s $out/bin/vim $out/bin/vi
     mkdir -p $out/share/vim
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index b11d09063f8a9..f96dba825a6c5 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -281,12 +281,12 @@ final: prev:
 
   SchemaStore-nvim = buildVimPluginFrom2Nix {
     pname = "SchemaStore.nvim";
-    version = "2022-06-08";
+    version = "2022-06-21";
     src = fetchFromGitHub {
       owner = "b0o";
       repo = "SchemaStore.nvim";
-      rev = "005a0377c95fe521a65a90af26aadb46085871c8";
-      sha256 = "1yn541cn5m0jmwwhiygqlds9hvxsm9w6x70r24ig3nj2p9q41px3";
+      rev = "7561d31e5e668333d7e453c063ded5a2805f0e41";
+      sha256 = "0850akn3ik044dnz53d2ikdgw8b7yk6vhy58a346ac9cq1damz7r";
     };
     meta.homepage = "https://github.com/b0o/SchemaStore.nvim/";
   };
@@ -341,12 +341,12 @@ final: prev:
 
   SpaceVim = buildVimPluginFrom2Nix {
     pname = "SpaceVim";
-    version = "2022-06-07";
+    version = "2022-06-21";
     src = fetchFromGitHub {
       owner = "SpaceVim";
       repo = "SpaceVim";
-      rev = "d66173b58abe941966e0e4666e54963c7a2d7dc9";
-      sha256 = "1cfz9xj5498n3mpw2f4fk0gxdp92d697dp7mm5vnz78h17p4px6y";
+      rev = "b7e45f2b1db2bb7b1ec8d9713607c3579f43207c";
+      sha256 = "12wkzf821fglinwacs2va28my5s8bf0xs9xzxifvcvbf5kp7k55x";
     };
     meta.homepage = "https://github.com/SpaceVim/SpaceVim/";
   };
@@ -449,12 +449,12 @@ final: prev:
 
   YouCompleteMe = buildVimPluginFrom2Nix {
     pname = "YouCompleteMe";
-    version = "2022-04-02";
+    version = "2022-06-16";
     src = fetchFromGitHub {
       owner = "ycm-core";
       repo = "YouCompleteMe";
-      rev = "3ededaed2f9923d50bf3860ba8dace0f7d2724cd";
-      sha256 = "1n2h5wsp9vclsvzr40m1ffb6kjmcg0mccfj790giw77qa2i9s1rl";
+      rev = "4237c4647ec30215223d597f6172c8c46b8b239e";
+      sha256 = "17krclvg5y645g9vk43bpmhg1pzf4m8dlif5ar5h92qvbih8sw7i";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/ycm-core/YouCompleteMe/";
@@ -498,12 +498,12 @@ final: prev:
 
   aerial-nvim = buildVimPluginFrom2Nix {
     pname = "aerial.nvim";
-    version = "2022-06-05";
+    version = "2022-06-19";
     src = fetchFromGitHub {
       owner = "stevearc";
       repo = "aerial.nvim";
-      rev = "2084c3ce26aba0aea0a450b35c5971b48f277574";
-      sha256 = "0p9rsgk6ynikhic8r9iy5i5rklg4dmri0yrm4gslmrp2bdmn111k";
+      rev = "dd35fd75c480da0e0239d69a607aac1347c395c6";
+      sha256 = "02mqp20vc5jjrf8d1padldnp3fdks0wjanwd22zr56y8zphcaxvc";
     };
     meta.homepage = "https://github.com/stevearc/aerial.nvim/";
   };
@@ -546,12 +546,12 @@ final: prev:
 
   ale = buildVimPluginFrom2Nix {
     pname = "ale";
-    version = "2022-06-08";
+    version = "2022-06-16";
     src = fetchFromGitHub {
       owner = "dense-analysis";
       repo = "ale";
-      rev = "f10349b48b173d50b523ce009934bb4bfba04f7f";
-      sha256 = "1s6ba5h0cv8y80x2nv9m98q724xv242nqzgxxh7bniakzp3jm4j4";
+      rev = "91e8422d6d67f1b1139b57b8707945ea2531443e";
+      sha256 = "1fwvxs7ifshdpvzkfqld66cdlhvbrp76bpm603w1qaskm88fj2pf";
     };
     meta.homepage = "https://github.com/dense-analysis/ale/";
   };
@@ -570,12 +570,12 @@ final: prev:
 
   alpha-nvim = buildVimPluginFrom2Nix {
     pname = "alpha-nvim";
-    version = "2022-04-22";
+    version = "2022-06-13";
     src = fetchFromGitHub {
       owner = "goolord";
       repo = "alpha-nvim";
-      rev = "4781fcfea5ddc1a92d41b32dc325132ed6fce7a8";
-      sha256 = "03i75403lskpgaqv7xp5hk4v6kqb0sv15ciil9jyj735ylhry3qq";
+      rev = "ef27a59e5b4d7b1c2fe1950da3fe5b1c5f3b4c94";
+      sha256 = "0w4864v6lgyzjckrsim8si9d6g7w979n81y96hx2h840xgcj22iw";
     };
     meta.homepage = "https://github.com/goolord/alpha-nvim/";
   };
@@ -678,12 +678,12 @@ final: prev:
 
   asyncrun-vim = buildVimPluginFrom2Nix {
     pname = "asyncrun.vim";
-    version = "2022-03-08";
+    version = "2022-06-14";
     src = fetchFromGitHub {
       owner = "skywind3000";
       repo = "asyncrun.vim";
-      rev = "9f8e50033cb724d8856907a5fbf4685eb3efda24";
-      sha256 = "00j0fp57lqcn3qvkb392shj1mqfv9vmn5wjcsibf0y6vbcq17xxh";
+      rev = "aa8a99e87e64276d52556f4d9d4f4a19afd37556";
+      sha256 = "0r79iq6fl4rcpadwvwma70gxk57lri15bqb5p12xad67fxd40320";
     };
     meta.homepage = "https://github.com/skywind3000/asyncrun.vim/";
   };
@@ -714,12 +714,12 @@ final: prev:
 
   aurora = buildVimPluginFrom2Nix {
     pname = "aurora";
-    version = "2022-06-09";
+    version = "2022-06-11";
     src = fetchFromGitHub {
       owner = "ray-x";
       repo = "aurora";
-      rev = "0b16a5f1f0da15c4808fafbad5a1024140a598c7";
-      sha256 = "0gfkvfpj97ijw9rbhy80hq3ly10c4zah4l5zzsw4xpnjwcx9gnxg";
+      rev = "b19bbfe041c67f3f1144e4c88a1d88a7314bfa5b";
+      sha256 = "0ha9b3612i42ldjkq4ip00pbwr7za5bfjrph745c4xdy5dhbx2m5";
     };
     meta.homepage = "https://github.com/ray-x/aurora/";
   };
@@ -750,12 +750,12 @@ final: prev:
 
   auto-session = buildVimPluginFrom2Nix {
     pname = "auto-session";
-    version = "2022-05-06";
+    version = "2022-06-13";
     src = fetchFromGitHub {
       owner = "rmagatti";
       repo = "auto-session";
-      rev = "7c9477614fb95b103c277a98bf3f588e337cd7ac";
-      sha256 = "1d502bfkr6qxrqr0jxwngj22cz4bh7v36kakpb9g4qbxdd3h1r30";
+      rev = "2c0103eb26b41cf4b58c3063d7549746d0f5fa73";
+      sha256 = "0m93a89as399bj29mw8nnx0s9bn3kmy74bys97hv4r1n5nc720fy";
     };
     meta.homepage = "https://github.com/rmagatti/auto-session/";
   };
@@ -798,12 +798,12 @@ final: prev:
 
   barbar-nvim = buildVimPluginFrom2Nix {
     pname = "barbar.nvim";
-    version = "2022-06-05";
+    version = "2022-06-17";
     src = fetchFromGitHub {
       owner = "romgrk";
       repo = "barbar.nvim";
-      rev = "a6a6209d1f2f599553741bbb02ce940fe8a5661b";
-      sha256 = "17851pqs1hr6vv86n2c7jz08xq0zm0iw9kbs393mfid2839clck9";
+      rev = "d7123f0368aa7fdd10f587176ad60aedcdfa44de";
+      sha256 = "1mqhhfaqd07ck0m6izqrf97a1vlkjcwvmjz5c5z2xssjlmcrx8pg";
     };
     meta.homepage = "https://github.com/romgrk/barbar.nvim/";
   };
@@ -930,12 +930,12 @@ final: prev:
 
   bufferline-nvim = buildVimPluginFrom2Nix {
     pname = "bufferline.nvim";
-    version = "2022-06-05";
+    version = "2022-06-18";
     src = fetchFromGitHub {
       owner = "akinsho";
       repo = "bufferline.nvim";
-      rev = "c78b3ecf9539a719828bca82fc7ddb9b3ba0c353";
-      sha256 = "03sf49s26nb9aqr16f776p58vs3dx9kyyach2jj4k1lp318w6ikp";
+      rev = "88c742f4af988c98aee5ac1c92f056905c636aae";
+      sha256 = "1nlxsg2nzkpxwj5jiwksg1hqp25g6hzj075zjvxbix72xdiv98lq";
     };
     meta.homepage = "https://github.com/akinsho/bufferline.nvim/";
   };
@@ -1098,12 +1098,12 @@ final: prev:
 
   cmp-buffer = buildVimPluginFrom2Nix {
     pname = "cmp-buffer";
-    version = "2022-05-09";
+    version = "2022-06-15";
     src = fetchFromGitHub {
       owner = "hrsh7th";
       repo = "cmp-buffer";
-      rev = "12463cfcd9b14052f9effccbf1d84caa7a2d57f0";
-      sha256 = "11fbxw8rrhypazd256qwjvf8gg0laqb9b4h9yqdgvwj810y6n6wg";
+      rev = "62fc67a2b0205136bc3e312664624ba2ab4a9323";
+      sha256 = "0wcys2z1yw6raxr9x5nm19ac04q8gfri4pw9mfsh18smv4rnl8zs";
     };
     meta.homepage = "https://github.com/hrsh7th/cmp-buffer/";
   };
@@ -1194,12 +1194,12 @@ final: prev:
 
   cmp-dap = buildVimPluginFrom2Nix {
     pname = "cmp-dap";
-    version = "2022-04-27";
+    version = "2022-06-05";
     src = fetchFromGitHub {
       owner = "rcarriga";
       repo = "cmp-dap";
-      rev = "69f22863739482120f9240919db1ac7d4dea3278";
-      sha256 = "03cxmnbr4sn69dzg1fg4r7rgja4invzfgpid123mhahq6sn7jir9";
+      rev = "2c4cecbb9c4d255acc87ccaca727d1ad2f2b8c90";
+      sha256 = "11wg62nf37ka40l9acwxcklzghapwiw3x549vnp397sl70r3w6b2";
     };
     meta.homepage = "https://github.com/rcarriga/cmp-dap/";
   };
@@ -1302,12 +1302,12 @@ final: prev:
 
   cmp-latex-symbols = buildVimPluginFrom2Nix {
     pname = "cmp-latex-symbols";
-    version = "2021-09-10";
+    version = "2022-06-17";
     src = fetchFromGitHub {
       owner = "kdheepak";
       repo = "cmp-latex-symbols";
-      rev = "29dc9e53d17cd1f26605888f85500c8ba79cebff";
-      sha256 = "17qjw0yp0cmgyjy593qq6rfh7fgfwgb7mxg7a0kg1drjpncwv8gl";
+      rev = "46e7627afa8c8ff57158d1c29d721d8efebbc39f";
+      sha256 = "10354d12in7sr5hdamj0cw8hgja6pwl70i9lcxlnha5jzkx8xm03";
     };
     meta.homepage = "https://github.com/kdheepak/cmp-latex-symbols/";
   };
@@ -1374,12 +1374,12 @@ final: prev:
 
   cmp-nvim-lsp-signature-help = buildVimPluginFrom2Nix {
     pname = "cmp-nvim-lsp-signature-help";
-    version = "2022-03-29";
+    version = "2022-06-20";
     src = fetchFromGitHub {
       owner = "hrsh7th";
       repo = "cmp-nvim-lsp-signature-help";
-      rev = "8014f6d120f72fe0a135025c4d41e3fe41fd411b";
-      sha256 = "1k61aw9mp012h625jqrf311vnsm2rg27k08lxa4nv8kp6nk7il29";
+      rev = "007dd2740d9b70f2688db01a39d6d25b7169cd57";
+      sha256 = "194i2b6qbl3z4j2p2s6sig2fac8i9kglkdwdc5h3x2q7avw70yrg";
     };
     meta.homepage = "https://github.com/hrsh7th/cmp-nvim-lsp-signature-help/";
   };
@@ -1638,24 +1638,24 @@ final: prev:
 
   coc-fzf = buildVimPluginFrom2Nix {
     pname = "coc-fzf";
-    version = "2021-11-11";
+    version = "2022-06-16";
     src = fetchFromGitHub {
       owner = "antoinemadec";
       repo = "coc-fzf";
-      rev = "60828294b9ba846c78893389d4772021043d2fa1";
-      sha256 = "1y7rslksa558fdh3m4m626vpvs424pvxkkk70mr57is47cminm3m";
+      rev = "44bcdc4c62a773a52f0a09cff074e61890870b59";
+      sha256 = "1d0ryxqs6jx2vm5db6ca2aciqsl0559clbskif4kjp3j7ybnz9my";
     };
     meta.homepage = "https://github.com/antoinemadec/coc-fzf/";
   };
 
   coc-lua = buildVimPluginFrom2Nix {
     pname = "coc-lua";
-    version = "2022-06-09";
+    version = "2022-06-16";
     src = fetchFromGitHub {
       owner = "josa42";
       repo = "coc-lua";
-      rev = "aa49b7ff2c7aa75aaa538479b552297e38952b38";
-      sha256 = "0m0c8rg7lpaf6kpjaw9qxkrd4jj4n4kzxnmxksgww3s2hmnj8x5w";
+      rev = "e956ff8a94bc73f5a315f0b103b7202fccedd848";
+      sha256 = "0s7jq8xfvb8g24gpzc3s9wcy91l2fs1hl8h7kz79r4mljmqppzs8";
     };
     meta.homepage = "https://github.com/josa42/coc-lua/";
   };
@@ -1710,12 +1710,12 @@ final: prev:
 
   coc-nvim = buildVimPluginFrom2Nix {
     pname = "coc.nvim";
-    version = "2022-06-05";
+    version = "2022-06-14";
     src = fetchFromGitHub {
       owner = "neoclide";
       repo = "coc.nvim";
-      rev = "b4d732a29b66c75e6d130cab296cc604a2d73bc4";
-      sha256 = "08k7p189xh5rwyl9fjfmcg6z3yz6xmlyfpdf3a69vcvnixqg9ww6";
+      rev = "87e5dd692ec8ed7be25b15449fd0ab15a48bfb30";
+      sha256 = "17a7vg7yb1qxzz4a4b0bwqrh3mv1y31233xd1wihw81a0jzc5jkf";
     };
     meta.homepage = "https://github.com/neoclide/coc.nvim/";
   };
@@ -1782,12 +1782,12 @@ final: prev:
 
   command-t = buildVimPluginFrom2Nix {
     pname = "command-t";
-    version = "2022-05-28";
+    version = "2022-06-18";
     src = fetchFromGitHub {
       owner = "wincent";
       repo = "command-t";
-      rev = "d554468ebee92c42adbbd1c6bf380eb668bd06d3";
-      sha256 = "0npnj71jnk2vvsp56vvmh3vjfxqklxdg4fn585ikgygv53fndszq";
+      rev = "81dba1e2741686514f466701ca62ce3831d49a08";
+      sha256 = "0mmvdhxzj8nv38nw1vddzzg7xkair72x7lwk4lkd369yc3bbwv6g";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/wincent/command-t/";
@@ -1795,12 +1795,12 @@ final: prev:
 
   comment-nvim = buildVimPluginFrom2Nix {
     pname = "comment.nvim";
-    version = "2022-06-07";
+    version = "2022-06-15";
     src = fetchFromGitHub {
       owner = "numtostr";
       repo = "comment.nvim";
-      rev = "3c69bab36569d5d0321351ec956fc43a8d409fb0";
-      sha256 = "0wfhj4i1ycwsdmpkk9jcfmq141mqlf40sl4ymqd0zqrwzb8yz5m5";
+      rev = "2c26a00f32b190390b664e56e32fd5347613b9e2";
+      sha256 = "1ii8vjmi73i7vq9w3g13b5m0g5z0sivivkr4mav831yq7qbxvgm2";
     };
     meta.homepage = "https://github.com/numtostr/comment.nvim/";
   };
@@ -1963,36 +1963,36 @@ final: prev:
 
   copilot-vim = buildVimPluginFrom2Nix {
     pname = "copilot.vim";
-    version = "2022-06-07";
+    version = "2022-06-17";
     src = fetchFromGitHub {
       owner = "github";
       repo = "copilot.vim";
-      rev = "aa9e451dda857c6615f531f8d4e4f201e43d7a03";
-      sha256 = "1i272gzvm4psqynw7pqyb00zlmx9q0r8z9l5iswy6kjwgvzz9298";
+      rev = "c2e75a3a7519c126c6fdb35984976df9ae13f564";
+      sha256 = "0m65y0pvc7sdj2xc3r97nb5md1i0iqcyri6h83hvs88skrmwnpap";
     };
     meta.homepage = "https://github.com/github/copilot.vim/";
   };
 
   coq-artifacts = buildVimPluginFrom2Nix {
     pname = "coq.artifacts";
-    version = "2022-06-09";
+    version = "2022-06-21";
     src = fetchFromGitHub {
       owner = "ms-jpq";
       repo = "coq.artifacts";
-      rev = "8303d9265567a10a57ee88ab674de77ca6661075";
-      sha256 = "06jmbqrszb5n3lsjfk2q0fz7gyx9g3zb7ivrj4wprdnnws7nyl0a";
+      rev = "78d1c7e607ee8aa417c989f1c811ac73ee5dab9c";
+      sha256 = "128ajrr8zj3mpimvapn0i1g34sp42wammh83gkhvf8xrfrwbd1l1";
     };
     meta.homepage = "https://github.com/ms-jpq/coq.artifacts/";
   };
 
   coq-thirdparty = buildVimPluginFrom2Nix {
     pname = "coq.thirdparty";
-    version = "2022-06-09";
+    version = "2022-06-21";
     src = fetchFromGitHub {
       owner = "ms-jpq";
       repo = "coq.thirdparty";
-      rev = "7920ea2527f12620701c08c48e1f668e2ccd37b7";
-      sha256 = "1xb590xs4n9gkrslb9v9apw7h3x3w48s6c6kkzphdabys2i9sdd4";
+      rev = "3c17b7a8806e809e1707774cf56a459dc914e309";
+      sha256 = "136lizq5hvvq99n23gjsjnhv8q3kkjx70axasva49abpjnbpaxms";
     };
     meta.homepage = "https://github.com/ms-jpq/coq.thirdparty/";
   };
@@ -2011,12 +2011,12 @@ final: prev:
 
   coq_nvim = buildVimPluginFrom2Nix {
     pname = "coq_nvim";
-    version = "2022-06-09";
+    version = "2022-06-21";
     src = fetchFromGitHub {
       owner = "ms-jpq";
       repo = "coq_nvim";
-      rev = "fc168d99aeade7c3529b8883c12fdec17aad0f7c";
-      sha256 = "02p72z384xk08a2hw8byasnxvl865wxngj08s7zp07cv2vzf3hw0";
+      rev = "83a03e23da4bc52b8cf2fa13bcace18c192a32f8";
+      sha256 = "0dz24pk9dr4wmm58iyvhr3iwcbv6pvwc04s3gmp26hzds37phws2";
     };
     meta.homepage = "https://github.com/ms-jpq/coq_nvim/";
   };
@@ -2155,12 +2155,12 @@ final: prev:
 
   dashboard-nvim = buildVimPluginFrom2Nix {
     pname = "dashboard-nvim";
-    version = "2022-05-30";
+    version = "2022-06-20";
     src = fetchFromGitHub {
       owner = "glepnir";
       repo = "dashboard-nvim";
-      rev = "a36b3232c98616149784f2ca2654e77caea7a522";
-      sha256 = "0106jhw9fg2zmk0fqnr126f9gnh5bw7sjrxldn06ajj15ll15p9p";
+      rev = "6f5cb262141f41d4c603cc987cdb64bf1ea3b216";
+      sha256 = "12lv8kwlb6bmk4bbp6vnym4w6ivasp3k9xgyhcm752wbf56zgzqy";
     };
     meta.homepage = "https://github.com/glepnir/dashboard-nvim/";
   };
@@ -2529,12 +2529,12 @@ final: prev:
 
   diffview-nvim = buildVimPluginFrom2Nix {
     pname = "diffview.nvim";
-    version = "2022-06-09";
+    version = "2022-06-21";
     src = fetchFromGitHub {
       owner = "sindrets";
       repo = "diffview.nvim";
-      rev = "ca297a7e526b42b1ea0e4bd6eebb36f2654125a7";
-      sha256 = "1vr7yx7i863brmpbayxc7k9z14ai0naa030ck43cknib1bdilpkp";
+      rev = "2e77bedfe11f52621fad1d8c20ffbddd8e36d137";
+      sha256 = "0661163vkaqnsy49ha0vgx0wjy71zwi14j80q58mfgvmacc31zj9";
     };
     meta.homepage = "https://github.com/sindrets/diffview.nvim/";
   };
@@ -2589,24 +2589,24 @@ final: prev:
 
   edge = buildVimPluginFrom2Nix {
     pname = "edge";
-    version = "2022-06-04";
+    version = "2022-06-12";
     src = fetchFromGitHub {
       owner = "sainnhe";
       repo = "edge";
-      rev = "2c7c3a1bfbd7ce1a62ef61e6cfdcdb9e8c04d1f0";
-      sha256 = "0g3az80iisdbk5w6yqhpw8ws5jh82hzqwq8y6808n3f0ki1b5mz9";
+      rev = "91ce1f39311ad74c1e3bcad1e78efcd4fa3bceaa";
+      sha256 = "0gjqyvp8xfndgh6yljgm1cfvkgcayjxh07ljq14yijhmg86q00x2";
     };
     meta.homepage = "https://github.com/sainnhe/edge/";
   };
 
   editorconfig-vim = buildVimPluginFrom2Nix {
     pname = "editorconfig-vim";
-    version = "2022-01-22";
+    version = "2022-06-20";
     src = fetchFromGitHub {
       owner = "editorconfig";
       repo = "editorconfig-vim";
-      rev = "a8e3e66deefb6122f476c27cee505aaae93f7109";
-      sha256 = "19k6nii3p6a4vfyf7xxrkhj7wfamjivdp22bn1mhx4zcw8h01lkn";
+      rev = "d354117b72b3b43b75a29b8e816c0f91af10efe9";
+      sha256 = "12qvximadgb9z2i0hgvj4p4nxaqk0aqbnaqpafpma73xyb23hx5v";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/editorconfig/editorconfig-vim/";
@@ -2675,12 +2675,12 @@ final: prev:
 
   everforest = buildVimPluginFrom2Nix {
     pname = "everforest";
-    version = "2022-05-31";
+    version = "2022-06-12";
     src = fetchFromGitHub {
       owner = "sainnhe";
       repo = "everforest";
-      rev = "eca7c8c196215f687319295c81e6ba1d4e2f53a4";
-      sha256 = "10jfag6ngarq2gnwlz4w7b0ckm9j899lppznz4sbrhisv35l4mjf";
+      rev = "65ea4a8325d5d4f09bb76ddec7f2148314067eee";
+      sha256 = "1ma7iq103k4gij070wi0wa2s9c92vxrg0nkmslryvc2l8rwqc4id";
     };
     meta.homepage = "https://github.com/sainnhe/everforest/";
   };
@@ -2759,36 +2759,36 @@ final: prev:
 
   fern-vim = buildVimPluginFrom2Nix {
     pname = "fern.vim";
-    version = "2022-06-05";
+    version = "2022-06-13";
     src = fetchFromGitHub {
       owner = "lambdalisue";
       repo = "fern.vim";
-      rev = "7ba49dd915c32ede51a6f6db3c4367748707a156";
-      sha256 = "042kdnki0k6fyp951r054wlwdfm3a2wm4m4q6as9x8dikb80yn00";
+      rev = "951a05d3f6ebc785db728ccfdf1759a2cf7c15ff";
+      sha256 = "1d0g3cylci2ph7crmw888jjjpindbmab5h4z9y7qsvl5633aclk4";
     };
     meta.homepage = "https://github.com/lambdalisue/fern.vim/";
   };
 
   ferret = buildVimPluginFrom2Nix {
     pname = "ferret";
-    version = "2022-04-17";
+    version = "2022-06-12";
     src = fetchFromGitHub {
       owner = "wincent";
       repo = "ferret";
-      rev = "35757c7c9364d940efd8a46877acde04193819c2";
-      sha256 = "0b8y7qailjg2366dw03pbfsr7lq9js8jzfcpw8ljyfim94fcj650";
+      rev = "3d064304876941e4197db6b4264db6b72bd9f83d";
+      sha256 = "1lkznmavw2f4ckh3yjjvdhja313ia0aayn5pkf6ygjny1089gcih";
     };
     meta.homepage = "https://github.com/wincent/ferret/";
   };
 
   fidget-nvim = buildVimPluginFrom2Nix {
     pname = "fidget.nvim";
-    version = "2022-05-20";
+    version = "2022-06-12";
     src = fetchFromGitHub {
       owner = "j-hui";
       repo = "fidget.nvim";
-      rev = "37d536bbbee47222ddfeca0e8186e8ee6884f9a2";
-      sha256 = "1y0b1x2kl7dmc6kzg1pi1rb16kx8ggi5ybfli1y38hw398h9z7fi";
+      rev = "46d1110435f1f023c22fa95bb10b3906aecd7bde";
+      sha256 = "0v0jnzj288swbp0w8xa7287sbql1rfgziqdk1gbcgvzs7zlvczbr";
     };
     meta.homepage = "https://github.com/j-hui/fidget.nvim/";
   };
@@ -2856,12 +2856,12 @@ final: prev:
 
   flutter-tools-nvim = buildVimPluginFrom2Nix {
     pname = "flutter-tools.nvim";
-    version = "2022-06-08";
+    version = "2022-06-21";
     src = fetchFromGitHub {
       owner = "akinsho";
       repo = "flutter-tools.nvim";
-      rev = "bd6cd6744528425cead90d796ad7a96ae4d58b33";
-      sha256 = "0b3fzsppilpjc33ql4b7rbxvh2ip5kbyhjvqmfmg0kvyvx8d2m3w";
+      rev = "b17546f502c23447f462340ee126b1ce0023e943";
+      sha256 = "1y8xgdflp0gpq97an6ichf5sl8w75hq363x697z3fdryfsa1ldfq";
     };
     meta.homepage = "https://github.com/akinsho/flutter-tools.nvim/";
   };
@@ -2988,24 +2988,24 @@ final: prev:
 
   fzf-lsp-nvim = buildVimPluginFrom2Nix {
     pname = "fzf-lsp.nvim";
-    version = "2022-05-16";
+    version = "2022-06-17";
     src = fetchFromGitHub {
       owner = "gfanto";
       repo = "fzf-lsp.nvim";
-      rev = "0694c278f081958e48f3a6e136c130d15cf8576e";
-      sha256 = "03bg2ld2sh08zarjn5h4c4ypnr51k03qxpj8rk13vm6f6zfg9dnj";
+      rev = "f19d6902dfdecb3150a9dbe153599524ae080dd8";
+      sha256 = "0rii15z51gz97vc688w5si0jb9vdnzq8vvz3yx52rghm535yv46y";
     };
     meta.homepage = "https://github.com/gfanto/fzf-lsp.nvim/";
   };
 
   fzf-lua = buildVimPluginFrom2Nix {
     pname = "fzf-lua";
-    version = "2022-06-09";
+    version = "2022-06-19";
     src = fetchFromGitHub {
       owner = "ibhagwan";
       repo = "fzf-lua";
-      rev = "343322108d2458994f64af3396efccd4875326b5";
-      sha256 = "0lq9dk2iglphjn8n8ai70spyz63cin987mnjn8415g258nyfis8x";
+      rev = "6a4392564b818061731c6a39fcc116ff9fc97dd0";
+      sha256 = "02pidn8w9gkglmsmjqy8lp8wq0s91rxpj96bgpwq6f09hci8mazg";
     };
     meta.homepage = "https://github.com/ibhagwan/fzf-lua/";
   };
@@ -3096,12 +3096,12 @@ final: prev:
 
   git-blame-nvim = buildVimPluginFrom2Nix {
     pname = "git-blame.nvim";
-    version = "2022-05-17";
+    version = "2022-06-15";
     src = fetchFromGitHub {
       owner = "f-person";
       repo = "git-blame.nvim";
-      rev = "801570e3903b0aea86c7fcba44f680cc62dad077";
-      sha256 = "09xxzs7bixli5jmbxnigsbwafvz83k63v56drm7lpvvfhl39lbwf";
+      rev = "1bb73289929107309d2d90f7582ece5e9436bfd8";
+      sha256 = "02ybfv5pm7m8mbciccz0j9k21bjhf6kjpp527y6m4r2mdc4q808r";
     };
     meta.homepage = "https://github.com/f-person/git-blame.nvim/";
   };
@@ -3154,14 +3154,14 @@ final: prev:
     meta.homepage = "https://github.com/ruifm/gitlinker.nvim/";
   };
 
-  gitsigns-nvim = buildVimPluginFrom2Nix {
+  gitsigns-nvim = buildNeovimPluginFrom2Nix {
     pname = "gitsigns.nvim";
-    version = "2022-05-26";
+    version = "2022-06-20";
     src = fetchFromGitHub {
       owner = "lewis6991";
       repo = "gitsigns.nvim";
-      rev = "27aeb2e715c32cbb99aa0b326b31739464b61644";
-      sha256 = "04m1767cndrx46xsa6frf77xv64hmr6w21dk2wh4s0sqjvqqm1r6";
+      rev = "3543443eb3856fbe4a9d70f3fe8dc73e007199a1";
+      sha256 = "00mrf5qwbzgh280lq2lc7xgqmgh8g18j2f46796lbwpcb4ciawh4";
     };
     meta.homepage = "https://github.com/lewis6991/gitsigns.nvim/";
   };
@@ -3192,12 +3192,12 @@ final: prev:
 
   glow-nvim = buildVimPluginFrom2Nix {
     pname = "glow.nvim";
-    version = "2022-06-06";
+    version = "2022-06-10";
     src = fetchFromGitHub {
       owner = "ellisonleao";
       repo = "glow.nvim";
-      rev = "ef86fff7371974fd69aab1fd926bafb76893bb1b";
-      sha256 = "03i21lrcqi53swbjwfmh21fbwxw3nxb9rcislzys5078j86wicvn";
+      rev = "900042f7dda528cb980b7f1056ed7c21d4402826";
+      sha256 = "05dhbxclnn5fz9wapa6gvf7p9qk88ir6ix72sahv0vpjcccr6gk6";
     };
     meta.homepage = "https://github.com/ellisonleao/glow.nvim/";
   };
@@ -3300,24 +3300,24 @@ final: prev:
 
   gruvbox-material = buildVimPluginFrom2Nix {
     pname = "gruvbox-material";
-    version = "2022-06-02";
+    version = "2022-06-12";
     src = fetchFromGitHub {
       owner = "sainnhe";
       repo = "gruvbox-material";
-      rev = "8aba3586fdefbdad3f758e24799245b799ae5a6f";
-      sha256 = "03hkgzirnjahi44xwbzmpcbzpj4lgydq07wva32cyyrv3h8qplar";
+      rev = "5d2cec690bfa56b863a7b9d482152d873da7ba7a";
+      sha256 = "0rhhxmpjml0w9rmvph1wn70yrybnai4w71x35gn8ig6dn446q4wb";
     };
     meta.homepage = "https://github.com/sainnhe/gruvbox-material/";
   };
 
   gruvbox-nvim = buildVimPluginFrom2Nix {
     pname = "gruvbox.nvim";
-    version = "2022-06-06";
+    version = "2022-06-19";
     src = fetchFromGitHub {
       owner = "ellisonleao";
       repo = "gruvbox.nvim";
-      rev = "8135da3a90b257a2c902614e71d9cbbef8308cad";
-      sha256 = "1mcyamqxnbhqdg2skkyz6g229qa08a8c0ssbcjsbcy92d4qyx852";
+      rev = "3352c12c083d0ab6285a9738b7679e24e7602411";
+      sha256 = "044dvp03yw5r745qbs6kp2lni1psfn63807dsd6fw8k2z6m6sbx3";
     };
     meta.homepage = "https://github.com/ellisonleao/gruvbox.nvim/";
   };
@@ -3336,12 +3336,12 @@ final: prev:
 
   gv-vim = buildVimPluginFrom2Nix {
     pname = "gv.vim";
-    version = "2021-10-19";
+    version = "2022-06-17";
     src = fetchFromGitHub {
       owner = "junegunn";
       repo = "gv.vim";
-      rev = "386d770e916dd680d1d622e715b9eb3a77f21bd1";
-      sha256 = "184kvydzz9nyg0sv3crn38v04s24km0ma8vfg4i3agmffb1riibk";
+      rev = "1507838ee67f9b298def89cbfc404a0fee4a4b8c";
+      sha256 = "0fkwhyywjhh2r6c8534kvfn3shv3rjvcc53wm2pz3yqk73b6r2c9";
     };
     meta.homepage = "https://github.com/junegunn/gv.vim/";
   };
@@ -3408,11 +3408,11 @@ final: prev:
 
   hologram-nvim = buildVimPluginFrom2Nix {
     pname = "hologram.nvim";
-    version = "2022-03-13";
+    version = "2022-06-16";
     src = fetchFromGitHub {
       owner = "edluffy";
       repo = "hologram.nvim";
-      rev = "7bd3ffb073dde94c8d86c1b49c47ef9d2f2bc605";
+      rev = "d6d3ebe931529681c99aff18bc4d4c2487867e06";
       sha256 = "0hld4cr09bd0y4k9yz1lls5dqdak605zf5rnv75zi5scbgwly19c";
     };
     meta.homepage = "https://github.com/edluffy/hologram.nvim/";
@@ -3432,24 +3432,24 @@ final: prev:
 
   hop-nvim = buildVimPluginFrom2Nix {
     pname = "hop.nvim";
-    version = "2022-06-09";
+    version = "2022-06-21";
     src = fetchFromGitHub {
       owner = "phaazon";
       repo = "hop.nvim";
-      rev = "03675eba34d416dd22ad49b2d0e52b6113b434ad";
-      sha256 = "1aaniq2qd59n126v6j11gsl39c9h7nq0x2hidwpdz81yhas97ix2";
+      rev = "a3cf6684bcb9fc974609ae81424f285f05280d90";
+      sha256 = "0inrri38bkxsi936z2xa8n9lvzm9b7vl2wajyp8i6wr4byhprml3";
     };
     meta.homepage = "https://github.com/phaazon/hop.nvim/";
   };
 
   hotpot-nvim = buildVimPluginFrom2Nix {
     pname = "hotpot.nvim";
-    version = "2022-05-31";
+    version = "2022-06-19";
     src = fetchFromGitHub {
       owner = "rktjmp";
       repo = "hotpot.nvim";
-      rev = "21258d4194a606d8d53bf68d06cc25457b2e8449";
-      sha256 = "0ily343jzx9ra2mxp1flmshsl5bara0wx10fgyrrps1cfag383jm";
+      rev = "104aa65f9155d34629c9623d5dac39b5b2ad555c";
+      sha256 = "0m0w69mmy471c2axr8n15c8spd7w8zdb0ri2cnf571kpmb68szxr";
     };
     meta.homepage = "https://github.com/rktjmp/hotpot.nvim/";
   };
@@ -3504,12 +3504,12 @@ final: prev:
 
   impatient-nvim = buildVimPluginFrom2Nix {
     pname = "impatient.nvim";
-    version = "2022-06-09";
+    version = "2022-06-12";
     src = fetchFromGitHub {
       owner = "lewis6991";
       repo = "impatient.nvim";
-      rev = "7821524b7fefb02af8b8e4c4745532b039ebc8de";
-      sha256 = "1nvx2b4qr55dxr9nf641flp7adcad3zp3dlwrb1zc7ay9m5ylg2w";
+      rev = "969f2c5c90457612c09cf2a13fee1adaa986d350";
+      sha256 = "10nlz4hq1bqjsnj9pkadi3xjj74wn36f2vr66hqp7wm2z7i5zbq3";
     };
     meta.homepage = "https://github.com/lewis6991/impatient.nvim/";
   };
@@ -3733,12 +3733,12 @@ final: prev:
 
   kanagawa-nvim = buildVimPluginFrom2Nix {
     pname = "kanagawa.nvim";
-    version = "2022-05-19";
+    version = "2022-06-11";
     src = fetchFromGitHub {
       owner = "rebelot";
       repo = "kanagawa.nvim";
-      rev = "a6db77965a27ca893ea693d69cc3c152c000a627";
-      sha256 = "1asq6a2mia695gmwa81ix4ijna8p9z8mifnqksnlk1kslz68bmdp";
+      rev = "76df2251e813fdec244b2b593be62accea930119";
+      sha256 = "0cnrnf44gm51jpmkf8kx9zfk6qxcg7725aav31n2w81zm1rr8d2s";
     };
     meta.homepage = "https://github.com/rebelot/kanagawa.nvim/";
   };
@@ -3805,24 +3805,24 @@ final: prev:
 
   lazygit-nvim = buildVimPluginFrom2Nix {
     pname = "lazygit.nvim";
-    version = "2022-05-10";
+    version = "2022-06-14";
     src = fetchFromGitHub {
       owner = "kdheepak";
       repo = "lazygit.nvim";
-      rev = "1f9f372b9fc137b8123d12a78c22a26c0fa78f0a";
-      sha256 = "1s4bpi7i86246p28pjk99rv1qj1gp7l7zwfch0f23nwnggm8s6pm";
+      rev = "9c73fd69a4c1cb3b3fc35b741ac968e331642600";
+      sha256 = "0mij8mrh7fmynhz7d3i11bbsvykf2pdp3ldk8w0sbi15cgfp8fr4";
     };
     meta.homepage = "https://github.com/kdheepak/lazygit.nvim/";
   };
 
   lean-nvim = buildVimPluginFrom2Nix {
     pname = "lean.nvim";
-    version = "2022-05-30";
+    version = "2022-06-20";
     src = fetchFromGitHub {
       owner = "Julian";
       repo = "lean.nvim";
-      rev = "2be99e3fa33ab24beb035ed46c51b353fc373cd5";
-      sha256 = "0235cc6wcir4qgv9yksrj3ycd3w44w2gkb1zn0yljd5ygi3xp2mz";
+      rev = "9abfeae95ae8f51a21e384b97e006f139aeb4333";
+      sha256 = "0lcxjr3n5g55i5brw0skvy9m1kp64wggah5j97mcl0r9x4h508lv";
     };
     meta.homepage = "https://github.com/Julian/lean.nvim/";
   };
@@ -3865,12 +3865,12 @@ final: prev:
 
   lexima-vim = buildVimPluginFrom2Nix {
     pname = "lexima.vim";
-    version = "2022-06-09";
+    version = "2022-06-13";
     src = fetchFromGitHub {
       owner = "cohama";
       repo = "lexima.vim";
-      rev = "905c14e9b701cea1f05db755398ef0060f2c1fcc";
-      sha256 = "0bv7fnbb4505ckfbd37h9gl1ss2jgargcf14b6kcx620xcw2adnn";
+      rev = "f06d2fa627c66689ec0ef68fe95765f0af0ded88";
+      sha256 = "00d27f9h4s83c1bsqskv48fhcyd2yf1fn7bpzqgqipbdsj7n04hn";
     };
     meta.homepage = "https://github.com/cohama/lexima.vim/";
   };
@@ -3973,12 +3973,12 @@ final: prev:
 
   lightspeed-nvim = buildVimPluginFrom2Nix {
     pname = "lightspeed.nvim";
-    version = "2022-05-13";
+    version = "2022-06-17";
     src = fetchFromGitHub {
       owner = "ggandor";
       repo = "lightspeed.nvim";
-      rev = "c5b93fc1d76a708cb698417326e04f4786a38d90";
-      sha256 = "0lgk9i240mgzf7f3j3z93dkj00fi3rypn79zc60wqdyzhpg4r4lm";
+      rev = "8fb5ebb2c18db13bc17556376526068dce0803b5";
+      sha256 = "1mrj4x0bd68qp2g4hsmxnqr1dfv5d7c2kajkir8q78pq2csdci8j";
     };
     meta.homepage = "https://github.com/ggandor/lightspeed.nvim/";
   };
@@ -4045,12 +4045,12 @@ final: prev:
 
   litee-filetree-nvim = buildVimPluginFrom2Nix {
     pname = "litee-filetree.nvim";
-    version = "2022-05-21";
+    version = "2022-06-14";
     src = fetchFromGitHub {
       owner = "ldelossa";
       repo = "litee-filetree.nvim";
-      rev = "92aa9f0f1fcda8cf1bca9f5ea296c4af74ba3928";
-      sha256 = "1j9sgsia0w8cmkhd1qm59f0d2abh7rxwkl0nlsqcg9b1k0naqiay";
+      rev = "3d3447816beea47ba93753afa7b717f5deb8a26c";
+      sha256 = "0p4wp53lpm9awkbf6cwzxzxjbvqf5r272hlygbiwhv048lbz26xk";
     };
     meta.homepage = "https://github.com/ldelossa/litee-filetree.nvim/";
   };
@@ -4140,24 +4140,24 @@ final: prev:
 
   lsp_signature-nvim = buildVimPluginFrom2Nix {
     pname = "lsp_signature.nvim";
-    version = "2022-05-26";
+    version = "2022-06-21";
     src = fetchFromGitHub {
       owner = "ray-x";
       repo = "lsp_signature.nvim";
-      rev = "9ccee20602a10843e3ea3ebc2536dfdcc6cee9a3";
-      sha256 = "1l5naxm1mx8l3xwiqrm60w0avsbhhpxnbr4sgqpnmigb9p2150ip";
+      rev = "49837977e210959c552bf357dc40ce18fadca501";
+      sha256 = "07rywxx31wqxnw8i4irl2mq8di5dwj12bv0vqwi80vxhpvjqn1jk";
     };
     meta.homepage = "https://github.com/ray-x/lsp_signature.nvim/";
   };
 
   lspcontainers-nvim = buildVimPluginFrom2Nix {
     pname = "lspcontainers.nvim";
-    version = "2022-05-30";
+    version = "2022-06-17";
     src = fetchFromGitHub {
       owner = "lspcontainers";
       repo = "lspcontainers.nvim";
-      rev = "3c9d2156a447eb111ec60f4358768eb7510c5d0d";
-      sha256 = "043ylgpzl1ahcf62s6m0y65ddwlxcw79qksqr2304c4vhzv5sv8w";
+      rev = "ed5ee65f7c71a7963b18cfd1644134f1a65b3d4b";
+      sha256 = "01sh8jawp8k73l17zvs374pmciyjqqgll89bb228jls9vhqvwkdr";
     };
     meta.homepage = "https://github.com/lspcontainers/lspcontainers.nvim/";
   };
@@ -4176,12 +4176,12 @@ final: prev:
 
   lspsaga-nvim = buildVimPluginFrom2Nix {
     pname = "lspsaga.nvim";
-    version = "2022-06-02";
+    version = "2022-06-16";
     src = fetchFromGitHub {
       owner = "tami5";
       repo = "lspsaga.nvim";
-      rev = "e4beaeff66ae4f70d0b67fe045b70d78780bb947";
-      sha256 = "1in3yhbr535xrzgnm6n8623xgqm73djphv2xnd1q84psr1lrkzb7";
+      rev = "b4f345998fba6c894d5de3aa42cb71a71e6c6ee9";
+      sha256 = "0bxkrjmf56axdhzdnw58dv1i7yqsp57yj675lmmp2agnfifmfvm9";
     };
     meta.homepage = "https://github.com/tami5/lspsaga.nvim/";
   };
@@ -4212,24 +4212,24 @@ final: prev:
 
   lualine-nvim = buildVimPluginFrom2Nix {
     pname = "lualine.nvim";
-    version = "2022-05-30";
+    version = "2022-06-21";
     src = fetchFromGitHub {
       owner = "nvim-lualine";
       repo = "lualine.nvim";
-      rev = "3362b28f917acc37538b1047f187ff1b5645ecdd";
-      sha256 = "0pfkh7zhnwhbfdcild5vayymw4vqzcfb31nq1y33pk1zlvpwxksv";
+      rev = "5113cdb32f9d9588a2b56de6d1df6e33b06a554a";
+      sha256 = "07npk6x4ljq7f3wfcs3liaxpn23x4gdxr5jq8vglhd1xj3l99mh5";
     };
     meta.homepage = "https://github.com/nvim-lualine/lualine.nvim/";
   };
 
   luasnip = buildVimPluginFrom2Nix {
     pname = "luasnip";
-    version = "2022-05-28";
+    version = "2022-06-20";
     src = fetchFromGitHub {
       owner = "l3mon4d3";
       repo = "luasnip";
-      rev = "52f4aed58db32a3a03211d31d2b12c0495c45580";
-      sha256 = "0drc847m55xwiha1wa2ykd5cwynmvd5ik2sys9v727fb4fbqmpa0";
+      rev = "a12441e0598e93e67235eba67c8e6fbffc896f06";
+      sha256 = "055y9bm8npn8n1xysk83l7ghf0760f8037jm32zf9fc8zk1ki98d";
     };
     meta.homepage = "https://github.com/l3mon4d3/luasnip/";
   };
@@ -4248,12 +4248,12 @@ final: prev:
 
   lush-nvim = buildVimPluginFrom2Nix {
     pname = "lush.nvim";
-    version = "2022-05-30";
+    version = "2022-06-16";
     src = fetchFromGitHub {
       owner = "rktjmp";
       repo = "lush.nvim";
-      rev = "aa4eea49179852376fb9e5716aa5d03d4707373b";
-      sha256 = "1xb6pc96jq9haa02h6zmp5gaqq95yxlqnniz5f31554vrhab51kd";
+      rev = "6923ccef17c5276bc5d3cca907082e19ee165d55";
+      sha256 = "0jyq8dszbncrqfbsajbwb3j59jj8gyngi2nmz0hg902kaif4cjib";
     };
     meta.homepage = "https://github.com/rktjmp/lush.nvim/";
   };
@@ -4308,12 +4308,12 @@ final: prev:
 
   material-nvim = buildVimPluginFrom2Nix {
     pname = "material.nvim";
-    version = "2022-05-26";
+    version = "2022-06-17";
     src = fetchFromGitHub {
       owner = "marko-cerovac";
       repo = "material.nvim";
-      rev = "f24cc6cf1dcd34350769b9cb28254b3f28973cf7";
-      sha256 = "1sgpips6s2rxb2vnm6zbqmggra8qbb63nws1y1c60rqw249dw513";
+      rev = "33d764439816ad80ded0f60b4bd8c038c9f96f43";
+      sha256 = "154hhvh44408m8n7vy9js7xakqv62qh0m8ffnvb65w63k1fjmwhs";
     };
     meta.homepage = "https://github.com/marko-cerovac/material.nvim/";
   };
@@ -4332,24 +4332,24 @@ final: prev:
 
   mini-nvim = buildVimPluginFrom2Nix {
     pname = "mini.nvim";
-    version = "2022-06-02";
+    version = "2022-06-14";
     src = fetchFromGitHub {
       owner = "echasnovski";
       repo = "mini.nvim";
-      rev = "6adaf4c42455c093f00d0df3882ab48838423a57";
-      sha256 = "0198f7818m58h2bxgdnfnx5nm7vxi2psssx105dn6ndg55yf2qsx";
+      rev = "cc8fb168b95620ec1611916a6d2a74e6a5cdcbdb";
+      sha256 = "1v7j8s19r20ljlyha9d10vpaarxlqsfn6ns4qc2p3z2ihbcaapq5";
     };
     meta.homepage = "https://github.com/echasnovski/mini.nvim/";
   };
 
   minimap-vim = buildVimPluginFrom2Nix {
     pname = "minimap.vim";
-    version = "2022-05-09";
+    version = "2022-06-20";
     src = fetchFromGitHub {
       owner = "wfxr";
       repo = "minimap.vim";
-      rev = "5d44fe7a3a5f7041c4220a71e8fe83d8c8498042";
-      sha256 = "04rqv8c5g1fs8pymlf2fcbm09k64bvpiqmjilf59m843vkvgk1xf";
+      rev = "a9f47afe1032d119a1ceff2714d47e4055564d07";
+      sha256 = "1ihx2vhrwyj3zmhnzwdcq54kygm5zic14ccyld995s7vjc4d15ig";
     };
     meta.homepage = "https://github.com/wfxr/minimap.vim/";
   };
@@ -4692,12 +4692,12 @@ final: prev:
 
   neogit = buildVimPluginFrom2Nix {
     pname = "neogit";
-    version = "2022-06-01";
+    version = "2022-06-16";
     src = fetchFromGitHub {
       owner = "TimUntersberger";
       repo = "neogit";
-      rev = "441c23d355b77f4067a1ad018c5dba64efd7ff7f";
-      sha256 = "0yay92x3jmvpgqhx0hv0w19fjisakmmdzd286m656v5g26hmfxj1";
+      rev = "2b33d2edba011799c496a2dc7c77ebbe1b3c5b76";
+      sha256 = "10si9k7ybf1spw5jf8iizisx5xivzljk12ixarjrx359d9nzbi46";
     };
     meta.homepage = "https://github.com/TimUntersberger/neogit/";
   };
@@ -4752,23 +4752,23 @@ final: prev:
 
   neorg = buildVimPluginFrom2Nix {
     pname = "neorg";
-    version = "2022-06-07";
+    version = "2022-06-20";
     src = fetchFromGitHub {
       owner = "nvim-neorg";
       repo = "neorg";
-      rev = "c0ebefa516aa9e93431f0a55e033db0dec072857";
-      sha256 = "0x9qpybjj7h6b6l10bkfmwf3qn54fcbbb5spx8n1hkny40npvnn5";
+      rev = "efc10f915ec53bbc8179ae591397b61aecf8f393";
+      sha256 = "0cdrpmlx9riz1gkpgfnnk1hry19l2iggdkmf6c1zsdmbjs56c45s";
     };
     meta.homepage = "https://github.com/nvim-neorg/neorg/";
   };
 
   neoscroll-nvim = buildVimPluginFrom2Nix {
     pname = "neoscroll.nvim";
-    version = "2022-01-13";
+    version = "2022-06-15";
     src = fetchFromGitHub {
       owner = "karb94";
       repo = "neoscroll.nvim";
-      rev = "07242b9c29eed0367cb305d41851b2e04de9052e";
+      rev = "71c8fadd60362383e5e817e95f64776f5e2737d8";
       sha256 = "1xcj3dmrcnqrk2dzzr137n0g0crfyg3zk3220202v6b4vylairnh";
     };
     meta.homepage = "https://github.com/karb94/neoscroll.nvim/";
@@ -4812,12 +4812,12 @@ final: prev:
 
   neovim-ayu = buildVimPluginFrom2Nix {
     pname = "neovim-ayu";
-    version = "2022-06-05";
+    version = "2022-06-19";
     src = fetchFromGitHub {
       owner = "Shatur";
       repo = "neovim-ayu";
-      rev = "621b5eeaf9b5c1b7affb327df3889f869b3c2893";
-      sha256 = "172pxda6168a3b6xx2ba8njq72y3y5bybg5a983zncxvn00qpi9a";
+      rev = "ad1e6b8cc25062ee426cd8690d28f82cfe840f58";
+      sha256 = "1khn5kvmjh42i17hsvjs03bz4523kvshdw2mwa5g4jn7292lf4z8";
     };
     meta.homepage = "https://github.com/Shatur/neovim-ayu/";
   };
@@ -4872,12 +4872,12 @@ final: prev:
 
   nerdtree = buildVimPluginFrom2Nix {
     pname = "nerdtree";
-    version = "2021-10-29";
+    version = "2022-06-13";
     src = fetchFromGitHub {
       owner = "preservim";
       repo = "nerdtree";
-      rev = "eed488b1cd1867bd25f19f90e10440c5cc7d6424";
-      sha256 = "0hlyn2l9ppjn92zaiw51i6d15li15z5083m13m0710giqx05qrak";
+      rev = "fc85a6f07c2cd694be93496ffad75be126240068";
+      sha256 = "02z32hrh4ykv4waq22y9ng8hwxxm8s5f2kxqm57pkixyy6b8zvzi";
     };
     meta.homepage = "https://github.com/preservim/nerdtree/";
   };
@@ -5028,24 +5028,24 @@ final: prev:
 
   nui-nvim = buildVimPluginFrom2Nix {
     pname = "nui.nvim";
-    version = "2022-05-06";
+    version = "2022-06-20";
     src = fetchFromGitHub {
       owner = "MunifTanjim";
       repo = "nui.nvim";
-      rev = "abdbfab89f307151db83b1a5147cd390ef27ff99";
-      sha256 = "0z49sfnsr7hmfr4vrd82f1m6kvswfqq31n4fsdmjy9h4qmjb0w5f";
+      rev = "0f590b762416bcf2c93621f77a21aa8b8e23d7d1";
+      sha256 = "16z5fqw606ngkbvscw2cpxwm3lki5igqkslyc0hxdagnwiqm1p7p";
     };
     meta.homepage = "https://github.com/MunifTanjim/nui.nvim/";
   };
 
   null-ls-nvim = buildVimPluginFrom2Nix {
     pname = "null-ls.nvim";
-    version = "2022-06-09";
+    version = "2022-06-13";
     src = fetchFromGitHub {
       owner = "jose-elias-alvarez";
       repo = "null-ls.nvim";
-      rev = "5d5cba15594c1b093a2177b339f34b3e3468fb46";
-      sha256 = "0pr8xxcsv6aahgcfqls3sp5k58dsq8bgvdhh8b6zsmrpaxsh3rz3";
+      rev = "ff40739e5be6581899b43385997e39eecdbf9465";
+      sha256 = "1snnh6fsn89fx7l5bjbfg1kh3cbadg2qg1rin889f4xka1yqa4x6";
     };
     meta.homepage = "https://github.com/jose-elias-alvarez/null-ls.nvim/";
   };
@@ -5088,12 +5088,12 @@ final: prev:
 
   nvim-autopairs = buildVimPluginFrom2Nix {
     pname = "nvim-autopairs";
-    version = "2022-06-09";
+    version = "2022-06-18";
     src = fetchFromGitHub {
       owner = "windwp";
       repo = "nvim-autopairs";
-      rev = "84cde3547e9a8b16db0bfe523e98e19b7be5148b";
-      sha256 = "0hkfa28lcldacsxfccp99wbp42qp3cxffh5rg5s2brkkr3xdp3yl";
+      rev = "4a95b3982be7397cd8e1370d1a09503f9b002dbf";
+      sha256 = "18vn3wy83nscd0znagq9gw7bzf9ljkqiny04xbk5p2l85w4xya7k";
     };
     meta.homepage = "https://github.com/windwp/nvim-autopairs/";
   };
@@ -5124,12 +5124,12 @@ final: prev:
 
   nvim-bqf = buildVimPluginFrom2Nix {
     pname = "nvim-bqf";
-    version = "2022-06-06";
+    version = "2022-06-20";
     src = fetchFromGitHub {
       owner = "kevinhwang91";
       repo = "nvim-bqf";
-      rev = "1a58f72ac731a3cf17708301ddf094c2033ebc4e";
-      sha256 = "0iy4kfd7a5pmsr63gjaplpxgw4nsrhsric7r3dhl3zisdzpn9kzm";
+      rev = "d4bc26ce482bd980fb90b7171fe7dece7411b01b";
+      sha256 = "05m1607rycqfwd23gr92ds5bkvcr68cjdpqxzma5wrac0cssdx6x";
     };
     meta.homepage = "https://github.com/kevinhwang91/nvim-bqf/";
   };
@@ -5160,12 +5160,12 @@ final: prev:
 
   nvim-cmp = buildVimPluginFrom2Nix {
     pname = "nvim-cmp";
-    version = "2022-06-09";
+    version = "2022-06-15";
     src = fetchFromGitHub {
       owner = "hrsh7th";
       repo = "nvim-cmp";
-      rev = "15c7bf7c0dfb7c75eb526c53f9574633c13dc22d";
-      sha256 = "0fncx8cr915p5wxjb2wqmc5l3p1mjy0vwmkik4alz422c9zh436z";
+      rev = "df6734aa018d6feb4d76ba6bda94b1aeac2b378a";
+      sha256 = "0i6icap7x0p8f6i0vgrnqz2rhwc05qgsiflwndmca5dxarmxysxx";
     };
     meta.homepage = "https://github.com/hrsh7th/nvim-cmp/";
   };
@@ -5256,24 +5256,24 @@ final: prev:
 
   nvim-dap = buildVimPluginFrom2Nix {
     pname = "nvim-dap";
-    version = "2022-06-09";
+    version = "2022-06-10";
     src = fetchFromGitHub {
       owner = "mfussenegger";
       repo = "nvim-dap";
-      rev = "8092586db723beb41312f288e38a7d8edc6459d9";
-      sha256 = "01rf6jl4b9amhkdjw8ayyx55njmklrbyb98kf4ybbcsgdjj587y7";
+      rev = "014ebd53612cfd42ac8c131e6cec7c194572f21d";
+      sha256 = "0qp15ihgwxamnly9ng6qmf051rz6yjg86p00dz39ffy02f8fvr60";
     };
     meta.homepage = "https://github.com/mfussenegger/nvim-dap/";
   };
 
   nvim-dap-ui = buildVimPluginFrom2Nix {
     pname = "nvim-dap-ui";
-    version = "2022-06-06";
+    version = "2022-06-18";
     src = fetchFromGitHub {
       owner = "rcarriga";
       repo = "nvim-dap-ui";
-      rev = "d76d6594374fb54abf2d94d6a320f3fd6e9bb2f7";
-      sha256 = "1yibykhd0kilzz67rmn392l27mmjmrcw62vmcilmyldnymxlqg85";
+      rev = "52f4840cb95e6638f18a74b71b536c3bd12e9fd8";
+      sha256 = "1vbhmz5hkgbb9z03g1552wbmzmnfgyr3x45qhrlnv50fkl2rrj8v";
     };
     meta.homepage = "https://github.com/rcarriga/nvim-dap-ui/";
   };
@@ -5328,24 +5328,24 @@ final: prev:
 
   nvim-gdb = buildVimPluginFrom2Nix {
     pname = "nvim-gdb";
-    version = "2022-05-31";
+    version = "2022-06-12";
     src = fetchFromGitHub {
       owner = "sakhnik";
       repo = "nvim-gdb";
-      rev = "713e333d3d5cecaaee20c1e4d55fb5a344b5ca2e";
-      sha256 = "19jm1i5z1y3bfyp92rwjmbxjalhp3anbmfafhrp10f7sd3mbcxhf";
+      rev = "c617a18561f710c22f521f7efd05c1374a1b8073";
+      sha256 = "1rk2z7ibrsh9gqrxisf13ybx846rxhlrx6s3piabhhr5x7m3h79n";
     };
     meta.homepage = "https://github.com/sakhnik/nvim-gdb/";
   };
 
   nvim-gps = buildVimPluginFrom2Nix {
     pname = "nvim-gps";
-    version = "2022-06-09";
+    version = "2022-06-11";
     src = fetchFromGitHub {
       owner = "smiteshp";
       repo = "nvim-gps";
-      rev = "c1e561d2937048174916667af0349bc4b7b3d2e9";
-      sha256 = "0g2r45yx2vx2j7yx5n2gc4v36629vz0ngaz3q1hmwpcr15qxbb3v";
+      rev = "be4bb5b903af81f04b316425b8ba8142504d023f";
+      sha256 = "0n8a0lnf8jbfds29mk5xxk68cp7i4rb8xsfa1qk50i662l570knn";
     };
     meta.homepage = "https://github.com/smiteshp/nvim-gps/";
   };
@@ -5364,12 +5364,12 @@ final: prev:
 
   nvim-hlslens = buildVimPluginFrom2Nix {
     pname = "nvim-hlslens";
-    version = "2022-04-03";
+    version = "2022-06-11";
     src = fetchFromGitHub {
       owner = "kevinhwang91";
       repo = "nvim-hlslens";
-      rev = "1944094111217db8d40aac697ffc71f16136d9ec";
-      sha256 = "0f0lqldrgzi72qrafzwqk3i71v74xvsrhgrfnidnbnvd3jc7sa0b";
+      rev = "6cd78e73b28af4618cf67a470e53e13d59899914";
+      sha256 = "0g2xvgw1bxz76hil5iiy37gpv69xjqy2s2q79lqc1pcr54c3392i";
     };
     meta.homepage = "https://github.com/kevinhwang91/nvim-hlslens/";
   };
@@ -5388,12 +5388,12 @@ final: prev:
 
   nvim-jdtls = buildVimPluginFrom2Nix {
     pname = "nvim-jdtls";
-    version = "2022-06-02";
+    version = "2022-06-17";
     src = fetchFromGitHub {
       owner = "mfussenegger";
       repo = "nvim-jdtls";
-      rev = "72a40cdcde653df645644375307b4ea0cb658281";
-      sha256 = "180v9810bmnh9xf74sq7nrgv98iva5xpka9yyhqp7n9li7c7xp93";
+      rev = "3a148dac526396678f141a033270961d0d9ccb88";
+      sha256 = "1fbxgssd9s0vfa6w00hhvqzmc48dgk271z0rchnch0b317q88vr2";
     };
     meta.homepage = "https://github.com/mfussenegger/nvim-jdtls/";
   };
@@ -5448,12 +5448,12 @@ final: prev:
 
   nvim-lint = buildVimPluginFrom2Nix {
     pname = "nvim-lint";
-    version = "2022-06-08";
+    version = "2022-06-18";
     src = fetchFromGitHub {
       owner = "mfussenegger";
       repo = "nvim-lint";
-      rev = "28a5f3e24ccc9f70026629e9b87670ab893a870f";
-      sha256 = "11dhxa18djf2rmbnrfm60z9pcmjnblha62yl6sc8d137fj87jppp";
+      rev = "14f12733599d8feb4b3c6b9fc9e945e0bede59c2";
+      sha256 = "1prhnjk78pl3cvaydv9i4jyz8j8y7za0lwkyhwax1n0qgv1m9kq6";
     };
     meta.homepage = "https://github.com/mfussenegger/nvim-lint/";
   };
@@ -5472,12 +5472,12 @@ final: prev:
 
   nvim-lspconfig = buildVimPluginFrom2Nix {
     pname = "nvim-lspconfig";
-    version = "2022-06-09";
+    version = "2022-06-19";
     src = fetchFromGitHub {
       owner = "neovim";
       repo = "nvim-lspconfig";
-      rev = "4eac16e87f24ad26738e632446e29766e87141ae";
-      sha256 = "0shpjy5p316yxs6d8028s93z1i7rv5fafpr8vk2zvgrhnvza6q1k";
+      rev = "c55e830aa18bd15f36f7534947ec7471f2b43af7";
+      sha256 = "0625rsaw5ba92fszk5bvkcg5misj7bacrlma9k8i09hbg81f3w28";
     };
     meta.homepage = "https://github.com/neovim/nvim-lspconfig/";
   };
@@ -5496,24 +5496,24 @@ final: prev:
 
   nvim-luapad = buildVimPluginFrom2Nix {
     pname = "nvim-luapad";
-    version = "2022-04-10";
+    version = "2022-06-14";
     src = fetchFromGitHub {
       owner = "rafcamlet";
       repo = "nvim-luapad";
-      rev = "3f0d7453987c7bef87d55b8051f252578853399c";
-      sha256 = "0h97hqbx7kbwkqhbq76k5l6rcr2bmdm17g0dps2g82lizmyhpfk0";
+      rev = "171e204ed65dc9308833ff80026fc6b7cec22825";
+      sha256 = "1k7zly9xpdrxf6221w2x898fdapagzwjcf8sf6agis7flqhp3j8f";
     };
     meta.homepage = "https://github.com/rafcamlet/nvim-luapad/";
   };
 
   nvim-metals = buildVimPluginFrom2Nix {
     pname = "nvim-metals";
-    version = "2022-06-02";
+    version = "2022-06-11";
     src = fetchFromGitHub {
       owner = "scalameta";
       repo = "nvim-metals";
-      rev = "6738fe3c0e2142de01c753f8b7c18281d11488ce";
-      sha256 = "19k330fv68z9icdlbf6bjn8ckwrjkdn9k9hl4r4ss95lm7sfgzd8";
+      rev = "58ecfb61e4617139d3954138ccccc4c0befa89e0";
+      sha256 = "0qcz1ijm62ys0d7gzbgq9h537pcfyzqmnmm3gv6gxzvfbqr4mcwq";
     };
     meta.homepage = "https://github.com/scalameta/nvim-metals/";
   };
@@ -5544,12 +5544,12 @@ final: prev:
 
   nvim-notify = buildVimPluginFrom2Nix {
     pname = "nvim-notify";
-    version = "2022-06-06";
+    version = "2022-06-18";
     src = fetchFromGitHub {
       owner = "rcarriga";
       repo = "nvim-notify";
-      rev = "8252aaedfd57ad010d9fee2f620924eac063537d";
-      sha256 = "1p7hwqsxryqc25mazdxvl9q7b1w57qn1sfqg5p9ksln7zh9qs44l";
+      rev = "7caeaaef257ecbe95473ec79e5a82757b544f1fd";
+      sha256 = "1k4p358hasbcwihx4prm7arz3frvj0s17imqx865nm2bsh0gpf3j";
     };
     meta.homepage = "https://github.com/rcarriga/nvim-notify/";
   };
@@ -5580,24 +5580,24 @@ final: prev:
 
   nvim-snippy = buildVimPluginFrom2Nix {
     pname = "nvim-snippy";
-    version = "2022-05-01";
+    version = "2022-05-29";
     src = fetchFromGitHub {
       owner = "dcampos";
       repo = "nvim-snippy";
-      rev = "a4512c9a9c0de83494fac66d02e04ff4f0805cae";
-      sha256 = "0vaabj2m84ba3ryl6n5s5rryjg06kjk571z6cmdgccff4lvq9d4v";
+      rev = "b13352f259c383cb1c921a1d5f2f98b072e53539";
+      sha256 = "0cs0ir8xhivkqij25y4gf6zddq3c4j0qcdmv81k8lr1awfbr3017";
     };
     meta.homepage = "https://github.com/dcampos/nvim-snippy/";
   };
 
   nvim-solarized-lua = buildVimPluginFrom2Nix {
     pname = "nvim-solarized-lua";
-    version = "2022-05-13";
+    version = "2022-06-13";
     src = fetchFromGitHub {
       owner = "ishan9299";
       repo = "nvim-solarized-lua";
-      rev = "a6af3a33cfe78c97f3adb2d86d3165bb25fb0ec3";
-      sha256 = "1z7wi72dqrw0fgsnm0s7zmxb72cq564dqvvpl1cqgizf4ab2a42a";
+      rev = "faba49ba6b53759b89fc34d12ed7319f8c2e27e0";
+      sha256 = "1kfbad6v7azk8lhsjpsli2ba2x5wncjac35iazjhdx6dbv0gw90l";
     };
     meta.homepage = "https://github.com/ishan9299/nvim-solarized-lua/";
   };
@@ -5628,36 +5628,36 @@ final: prev:
 
   nvim-tree-lua = buildVimPluginFrom2Nix {
     pname = "nvim-tree.lua";
-    version = "2022-06-07";
+    version = "2022-06-20";
     src = fetchFromGitHub {
       owner = "kyazdani42";
       repo = "nvim-tree.lua";
-      rev = "1caca6285427ebd2b4f0eb10f4d1ae3956ff09c0";
-      sha256 = "13m893pjn816fp5b0s423vbgk5f6fdhbiqwbbxzz2311ijg72nhh";
+      rev = "79258f1d670277016523e13c0a88daa25070879f";
+      sha256 = "1wrq3g6n82lyxzgbkfgpsi908ghwzp773fslrfyxk3mwgvdj396s";
     };
     meta.homepage = "https://github.com/kyazdani42/nvim-tree.lua/";
   };
 
   nvim-treesitter = buildVimPluginFrom2Nix {
     pname = "nvim-treesitter";
-    version = "2022-06-09";
+    version = "2022-06-20";
     src = fetchFromGitHub {
       owner = "nvim-treesitter";
       repo = "nvim-treesitter";
-      rev = "a3cef7881ca8e2b8843a4500df44f94311bcc3df";
-      sha256 = "1yfhc1yhrnv7k0l1p38zydl2xrjfzbwixz0iawpmybw5vmnyl0vi";
+      rev = "8eccd820afb012df6ae22678aa01d4053ab84365";
+      sha256 = "0465y4c7i33rn5yq921viik1kmv22pii9fr7nm678hkmhwi2qhwx";
     };
     meta.homepage = "https://github.com/nvim-treesitter/nvim-treesitter/";
   };
 
   nvim-treesitter-context = buildVimPluginFrom2Nix {
     pname = "nvim-treesitter-context";
-    version = "2022-06-09";
+    version = "2022-06-20";
     src = fetchFromGitHub {
       owner = "nvim-treesitter";
       repo = "nvim-treesitter-context";
-      rev = "81116dc03abf35ca99c7910f9f779961042dea12";
-      sha256 = "150r80ik8i11a5dxn71j55gmgpfivlfmnvkqdxjwz6c14asi4ycj";
+      rev = "b05cd9cbb972f48b583b581615a046f814ccaca0";
+      sha256 = "07pxlms3j4kcd7ybmyjjkvjkkjxz084g3lm6kfv015pnca78wjj2";
     };
     meta.homepage = "https://github.com/nvim-treesitter/nvim-treesitter-context/";
   };
@@ -5724,12 +5724,12 @@ final: prev:
 
   nvim-ts-rainbow = buildVimPluginFrom2Nix {
     pname = "nvim-ts-rainbow";
-    version = "2022-05-28";
+    version = "2022-06-21";
     src = fetchFromGitHub {
       owner = "p00f";
       repo = "nvim-ts-rainbow";
-      rev = "18cb3a45e0ff843d48e8637a36b9cc6cd89d71b0";
-      sha256 = "0w8gzxps0rn20cr92ib5zk3xw6l2i8032081r0v34rry1xahdam6";
+      rev = "837167f63445821c55e6eed9dbdac1b0b29afa92";
+      sha256 = "104rvha3bqsn5rnrii0z023x7a4ph3rljlmqjgaki27crfnxx8sj";
     };
     meta.homepage = "https://github.com/p00f/nvim-ts-rainbow/";
   };
@@ -5820,12 +5820,12 @@ final: prev:
 
   octo-nvim = buildVimPluginFrom2Nix {
     pname = "octo.nvim";
-    version = "2022-06-08";
+    version = "2022-06-20";
     src = fetchFromGitHub {
       owner = "pwntester";
       repo = "octo.nvim";
-      rev = "71d4dcfe56d4c45b7f1a1520d65ef5a86d2bc9bd";
-      sha256 = "020k4nni9kqq4sqh86rsca3vkf49b56pllxk81yriwyazn8m3y2r";
+      rev = "f56b3f81661925e6487c2483ca8350c7287c70d1";
+      sha256 = "005vxvy87hfmsvg0ksmc035md99b0qykgzlwj4nhcvv1pwpjbazx";
     };
     meta.homepage = "https://github.com/pwntester/octo.nvim/";
   };
@@ -5856,12 +5856,12 @@ final: prev:
 
   onedark-nvim = buildVimPluginFrom2Nix {
     pname = "onedark.nvim";
-    version = "2022-06-09";
+    version = "2022-06-19";
     src = fetchFromGitHub {
       owner = "navarasu";
       repo = "onedark.nvim";
-      rev = "52b1ebd80831dd1232b396b82a77fba977fb6e2c";
-      sha256 = "173y7gwwwf7wdd07kgs95p5iznl202p022vyzzwc4zz41z50zzpa";
+      rev = "af5595a5bf2358ef8611ab98f5e3c058b321c38f";
+      sha256 = "0sd2isramda96kmb7inif3n3dn2p5qrccw0b3apj6pwxf3ridsf5";
     };
     meta.homepage = "https://github.com/navarasu/onedark.nvim/";
   };
@@ -5880,12 +5880,12 @@ final: prev:
 
   onedarkpro-nvim = buildVimPluginFrom2Nix {
     pname = "onedarkpro.nvim";
-    version = "2022-05-26";
+    version = "2022-06-15";
     src = fetchFromGitHub {
       owner = "olimorris";
       repo = "onedarkpro.nvim";
-      rev = "06e9020c4b014a56547dbea53163cdd1c6c0c1ec";
-      sha256 = "1biylhq7n0l7kac26ibv0zqwvfynqa1g3pn3qf9yz7ndrfqfwddk";
+      rev = "5d13f02a8ba579d68be02f877a8c38bac9ff17ed";
+      sha256 = "1f9p7crgkq68ql2ri8mjfkp5r6dhq9pmsl3073pg2hzgirb08fgl";
     };
     meta.homepage = "https://github.com/olimorris/onedarkpro.nvim/";
   };
@@ -5928,24 +5928,24 @@ final: prev:
 
   orgmode = buildVimPluginFrom2Nix {
     pname = "orgmode";
-    version = "2022-06-07";
+    version = "2022-06-21";
     src = fetchFromGitHub {
       owner = "nvim-orgmode";
       repo = "orgmode";
-      rev = "d5907359eba50a9f0017043fb220d542e17c5e1f";
-      sha256 = "0wqwxh13vh1hxcajb6zw2js36264zab8mxjnr0bkxmk821h68rwb";
+      rev = "d3b95d2036d57f67a0f78ec975c7ef10e9134908";
+      sha256 = "0yfdfpqygk77rhbyi28makmghq58rzl5aah8lpqihr604j1l54z5";
     };
     meta.homepage = "https://github.com/nvim-orgmode/orgmode/";
   };
 
   package-info-nvim = buildVimPluginFrom2Nix {
     pname = "package-info.nvim";
-    version = "2022-02-18";
+    version = "2022-06-17";
     src = fetchFromGitHub {
       owner = "vuki656";
       repo = "package-info.nvim";
-      rev = "10de4d0d50ec1d4d26118c4aa067a9d09e370c9c";
-      sha256 = "1mhhff6knqqq6pgmd3w6vfljcig37yyxvmrvhb205y67igy3vcr2";
+      rev = "45e409c69063a057250833a747e52e2ff00dd722";
+      sha256 = "048rzckb35d4s96kmk6yhbv756yhhcv6kl7nc3y96w18qjjh5ymy";
     };
     meta.homepage = "https://github.com/vuki656/package-info.nvim/";
   };
@@ -6072,12 +6072,12 @@ final: prev:
 
   plenary-nvim = buildNeovimPluginFrom2Nix {
     pname = "plenary.nvim";
-    version = "2022-06-08";
+    version = "2022-06-12";
     src = fetchFromGitHub {
       owner = "nvim-lua";
       repo = "plenary.nvim";
-      rev = "9c3239bc5f99b85be1123107f7290d16a68f8e64";
-      sha256 = "1d948hq5aa8wbr1lvpi3c54mlgh8z6yk25bfn4ckbs1g1giar8ih";
+      rev = "968a4b9afec0c633bc369662e78f8c5db0eba249";
+      sha256 = "05x9hnz960ljcb2psqycxgdmh99j36y16vbb9l92wjv5szkz37x5";
     };
     meta.homepage = "https://github.com/nvim-lua/plenary.nvim/";
   };
@@ -6181,12 +6181,12 @@ final: prev:
 
   purescript-vim = buildVimPluginFrom2Nix {
     pname = "purescript-vim";
-    version = "2021-04-21";
+    version = "2022-06-15";
     src = fetchFromGitHub {
       owner = "purescript-contrib";
       repo = "purescript-vim";
-      rev = "d493b57406d2742f6f6c6545de5a3492f2e5b888";
-      sha256 = "1qnf8lg4a6xxn335z57nqb4yp7ij62yr408nbc8m6xwnznck3wa7";
+      rev = "af5fae0b43241e9fc3e0442782272728844bec3f";
+      sha256 = "05v81i4ialja4wq3rp1fy09zjh7rvwb6pjhig7zg9pfddd015pki";
     };
     meta.homepage = "https://github.com/purescript-contrib/purescript-vim/";
   };
@@ -6350,12 +6350,12 @@ final: prev:
 
   refactoring-nvim = buildVimPluginFrom2Nix {
     pname = "refactoring.nvim";
-    version = "2022-06-09";
+    version = "2022-06-21";
     src = fetchFromGitHub {
       owner = "theprimeagen";
       repo = "refactoring.nvim";
-      rev = "21b47bda407194fbe1f603256e101c26c0dbe589";
-      sha256 = "0ggd17mmvxpym4ablhy3s46yw9a3xavn9rzvla3j83skpmqyhmmk";
+      rev = "7328413fdafeff52731e5f4961a574ad2fa0837d";
+      sha256 = "07jwjcys9h2sjnh7vlf3rjjl254b7qh0axwck66d5hk0i7xviqhm";
     };
     meta.homepage = "https://github.com/theprimeagen/refactoring.nvim/";
   };
@@ -6518,12 +6518,12 @@ final: prev:
 
   scrollbar-nvim = buildVimPluginFrom2Nix {
     pname = "scrollbar.nvim";
-    version = "2021-11-16";
+    version = "2022-06-16";
     src = fetchFromGitHub {
       owner = "Xuyuanp";
       repo = "scrollbar.nvim";
-      rev = "590b23af866a32277cf803aca0fd770d5b39c2e7";
-      sha256 = "1dvlmmxykf3vyhyvv5aiqbz8fd7zvpw4xq1nxnf3wyj371caawaq";
+      rev = "bc97c132e8367efecb2ecb937d385e7dc04eb5a1";
+      sha256 = "14g2q9nzdh9ffp2b8z3sdicrn4xq3ksq8mjxdi7cm44rlfyzfs04";
     };
     meta.homepage = "https://github.com/Xuyuanp/scrollbar.nvim/";
   };
@@ -6699,12 +6699,12 @@ final: prev:
 
   sonokai = buildVimPluginFrom2Nix {
     pname = "sonokai";
-    version = "2022-05-31";
+    version = "2022-06-12";
     src = fetchFromGitHub {
       owner = "sainnhe";
       repo = "sonokai";
-      rev = "c2f8a7259e4b67fb4d0242afababbb1dda3285a3";
-      sha256 = "1ni8b2b3cqqmi8lr4dh2f5bwnxwcdwqdjfvvds4m8jq2s3kql4bh";
+      rev = "e72e59d3e2cad8af17a1e2a0f6772ea56af32e2c";
+      sha256 = "0yw98fj4b7vm5p5kvzvpgnmlgc3p54gdh1znlhpz5jkq4r59ggsa";
     };
     meta.homepage = "https://github.com/sainnhe/sonokai/";
   };
@@ -6723,12 +6723,12 @@ final: prev:
 
   space-vim = buildVimPluginFrom2Nix {
     pname = "space-vim";
-    version = "2022-05-22";
+    version = "2022-06-20";
     src = fetchFromGitHub {
       owner = "liuchengxu";
       repo = "space-vim";
-      rev = "79f8ddcfe1312e48595d2aed3eae8c021137db2f";
-      sha256 = "1diqpkaspjcqlnbwpawh4yhls56776mndbskkcf7x69m1kfwkzip";
+      rev = "b5bd319aa4c7bede97ec1eaf1dffaf7fbc9aa8a8";
+      sha256 = "0hbxqs548z9zjjzizcz0g7h894sg4jyw97qwg8fahy0pvi976694";
     };
     meta.homepage = "https://github.com/liuchengxu/space-vim/";
   };
@@ -6771,12 +6771,12 @@ final: prev:
 
   spellsitter-nvim = buildVimPluginFrom2Nix {
     pname = "spellsitter.nvim";
-    version = "2022-06-02";
+    version = "2022-06-20";
     src = fetchFromGitHub {
       owner = "lewis6991";
       repo = "spellsitter.nvim";
-      rev = "430a25393abbf482bddf03c224cd5b8eeb27b5e1";
-      sha256 = "1cypvpyaarn9ckin2cgf2hpsq5qj517pz64imvyckzg22x9cf6yi";
+      rev = "c1b318f8b959e015f5cc7941624d1ca0f84705dd";
+      sha256 = "17v7scc6574afmjfhhzawpxhhh31fz118xzbjg1l8qnbdnb159bh";
     };
     meta.homepage = "https://github.com/lewis6991/spellsitter.nvim/";
   };
@@ -6832,12 +6832,12 @@ final: prev:
 
   sqlite-lua = buildVimPluginFrom2Nix {
     pname = "sqlite.lua";
-    version = "2022-06-07";
+    version = "2022-06-17";
     src = fetchFromGitHub {
       owner = "tami5";
       repo = "sqlite.lua";
-      rev = "de2cc544127d6dfd7f6ff3d4960b21dd6db4f1dd";
-      sha256 = "1mj4m1fk9y4l6418zamiqln09dg2h4cw9k9bywv55gd735gwfapp";
+      rev = "1ed8bff0f7522bbcb79428f91a5cacacb3ae0331";
+      sha256 = "0ckvl97v1jhr7wrrmvvgbi23z5bl29ng7f0l7hvrmm5m6c4cpkny";
     };
     meta.homepage = "https://github.com/tami5/sqlite.lua/";
   };
@@ -6952,12 +6952,12 @@ final: prev:
 
   sved = buildVimPluginFrom2Nix {
     pname = "sved";
-    version = "2021-10-22";
+    version = "2022-06-20";
     src = fetchFromGitHub {
       owner = "peterbjorgensen";
       repo = "sved";
-      rev = "2f98472720d0e0c7da5a93b4ab4574f75747f693";
-      sha256 = "070fzga0b039wjhfzb7s0s422kv3as7ifv94ma6vh62ml6zm6mpl";
+      rev = "7da91cb0eacdaae5e1a41722e95800c98d4ca675";
+      sha256 = "0rp5pklym8bnl1npgglh096i9ssrdbn2r99arh42sbdca71spbiw";
     };
     meta.homepage = "https://github.com/peterbjorgensen/sved/";
   };
@@ -7025,12 +7025,12 @@ final: prev:
 
   tabline-nvim = buildVimPluginFrom2Nix {
     pname = "tabline.nvim";
-    version = "2022-04-19";
+    version = "2022-06-13";
     src = fetchFromGitHub {
       owner = "kdheepak";
       repo = "tabline.nvim";
-      rev = "2eb56826bf7b85b9090aff73a696e0e803bf89ae";
-      sha256 = "10fqssr8la7y54q7iz2kgx1axv2rwmv0mjvnz0yvadcfz80q2ksv";
+      rev = "5d76dc8616b4b7b892229cc05cd0f4cd0200077a";
+      sha256 = "0k9yk7drxbjfwjfqmg7iam2vaz05rk3shd5lap8qakwvayvas258";
     };
     meta.homepage = "https://github.com/kdheepak/tabline.nvim/";
   };
@@ -7303,12 +7303,12 @@ final: prev:
 
   telescope-project-nvim = buildVimPluginFrom2Nix {
     pname = "telescope-project.nvim";
-    version = "2022-04-28";
+    version = "2022-06-12";
     src = fetchFromGitHub {
       owner = "nvim-telescope";
       repo = "telescope-project.nvim";
-      rev = "4658d78523a5a005af80243f1d0b4e7e2a118dae";
-      sha256 = "0fpq6jfycl5hmz7ch5ris72qjabvhvbaj6wm9gwgl7ids99982p7";
+      rev = "8cd22b696e14b353fe8ea9648a03364cb56c39d4";
+      sha256 = "1qrk2i7yvvrqg4yjma1q6c26wdlapc60yriiqx5mhfam9xh28s24";
     };
     meta.homepage = "https://github.com/nvim-telescope/telescope-project.nvim/";
   };
@@ -7387,12 +7387,12 @@ final: prev:
 
   telescope-nvim = buildVimPluginFrom2Nix {
     pname = "telescope.nvim";
-    version = "2022-06-06";
+    version = "2022-06-18";
     src = fetchFromGitHub {
       owner = "nvim-telescope";
       repo = "telescope.nvim";
-      rev = "e6b69b1488c598ff7b461c4d9cecad57ef708f9b";
-      sha256 = "060149lbhsbn0vfdivng5pc48lnfhpjwsdc0ppvvvl45b5in7k27";
+      rev = "d88b44ddf14670cffa9fdb1eaca7a0429a973653";
+      sha256 = "11ahi16nd21p9413d3rdw25bgzjkp3k83p6a1jwka3pk15c87nl0";
     };
     meta.homepage = "https://github.com/nvim-telescope/telescope.nvim/";
   };
@@ -7495,12 +7495,12 @@ final: prev:
 
   tlib_vim = buildVimPluginFrom2Nix {
     pname = "tlib_vim";
-    version = "2021-07-17";
+    version = "2022-06-14";
     src = fetchFromGitHub {
       owner = "tomtom";
       repo = "tlib_vim";
-      rev = "70c4e222464020edc2809c932b488daaf891eeef";
-      sha256 = "1amx220nbh1s51z35pkhvl3110pbha5qj2rdgxvg8dbqha7py9fx";
+      rev = "223c696eab4a3a59a33352531e42c74c721510e7";
+      sha256 = "1x9s9ypk934lkqpcyvycij5803y1vz5i3q8p8di6d6jv04ylvgvl";
     };
     meta.homepage = "https://github.com/tomtom/tlib_vim/";
   };
@@ -7568,12 +7568,12 @@ final: prev:
 
   toggleterm-nvim = buildVimPluginFrom2Nix {
     pname = "toggleterm.nvim";
-    version = "2022-06-07";
+    version = "2022-06-21";
     src = fetchFromGitHub {
       owner = "akinsho";
       repo = "toggleterm.nvim";
-      rev = "50f88d316261bfe56854cb75b9d092061c38b21e";
-      sha256 = "1cf6vqjcn5nk2ymjpflpxr9ic2k0y4bnxzy24n0q8vp05dp69qv2";
+      rev = "8f2e78d0256eba4896c8514aa150e41e63f7d5b2";
+      sha256 = "0mrjha2vadxc8n0q4kqq8x8xf03b2k0yksi68j6r1lbkd1i0rwmx";
     };
     meta.homepage = "https://github.com/akinsho/toggleterm.nvim/";
   };
@@ -7808,12 +7808,12 @@ final: prev:
 
   vifm-vim = buildVimPluginFrom2Nix {
     pname = "vifm.vim";
-    version = "2022-06-04";
+    version = "2022-06-19";
     src = fetchFromGitHub {
       owner = "vifm";
       repo = "vifm.vim";
-      rev = "d2e2a1fbed196e3bb273fe87bbd821a7e80be298";
-      sha256 = "00jvhicwa9wmf1pbd4fi4423jh02x5i7h5bgi21avfgyfxrvlaaj";
+      rev = "8f8fd1731c614a76a41fda43b5405b35ffdae3a6";
+      sha256 = "1gh5pa754mfnh5nsayq6gf6daz3ysbghd85drj35692x6jz8fpif";
     };
     meta.homepage = "https://github.com/vifm/vifm.vim/";
   };
@@ -8288,12 +8288,12 @@ final: prev:
 
   vim-autoformat = buildVimPluginFrom2Nix {
     pname = "vim-autoformat";
-    version = "2022-06-08";
+    version = "2022-06-11";
     src = fetchFromGitHub {
       owner = "vim-autoformat";
       repo = "vim-autoformat";
-      rev = "fc8eb893db0c3c7eb204066d1954a59bc78819b9";
-      sha256 = "0c8d84pgg6rck6pxm12w46k1smsaw0d83hs899ws78zcamamp7y2";
+      rev = "00df1ac5df05247238cb2ae2a0770b62209e3aa7";
+      sha256 = "11k6s5qzwd6fcd2hjr6p3w08yqfh0mrnpl3nkyfz8lf8jpd6ps1b";
     };
     meta.homepage = "https://github.com/vim-autoformat/vim-autoformat/";
   };
@@ -8516,12 +8516,12 @@ final: prev:
 
   vim-clap = buildVimPluginFrom2Nix {
     pname = "vim-clap";
-    version = "2022-06-09";
+    version = "2022-06-21";
     src = fetchFromGitHub {
       owner = "liuchengxu";
       repo = "vim-clap";
-      rev = "181524923fe04c554e37fc5acab51545b2a4715e";
-      sha256 = "0355hn1v5k1j86k8bw61vjb84cbgsg214ax07l5jrfk5dzh1avcl";
+      rev = "48b7b60c6743f4bc82d3edf61978c1c593276cc2";
+      sha256 = "02sr55jqly1b8cllhaw124ig9q3p5m3v7s2vprfqrfyy3w681xfm";
     };
     meta.homepage = "https://github.com/liuchengxu/vim-clap/";
   };
@@ -8576,12 +8576,12 @@ final: prev:
 
   vim-code-dark = buildVimPluginFrom2Nix {
     pname = "vim-code-dark";
-    version = "2022-05-27";
+    version = "2022-06-15";
     src = fetchFromGitHub {
       owner = "tomasiser";
       repo = "vim-code-dark";
-      rev = "97ef6f96bd95c3dbd725946607e7290be0266153";
-      sha256 = "03f506y3gv1hx0y66xjpg1v0nli63fh1qrvp05dwjki2vdzxmz03";
+      rev = "caf254ffa59b91c41851024a58d1eaa806a81bc9";
+      sha256 = "0ympd38yf9wlm37sgamyxi8nal0k7imd173xxfp617sj7lrnnx5q";
     };
     meta.homepage = "https://github.com/tomasiser/vim-code-dark/";
   };
@@ -8780,36 +8780,36 @@ final: prev:
 
   vim-dadbod = buildVimPluginFrom2Nix {
     pname = "vim-dadbod";
-    version = "2022-06-03";
+    version = "2022-06-13";
     src = fetchFromGitHub {
       owner = "tpope";
       repo = "vim-dadbod";
-      rev = "c2495b008f1adce6d21745b2c4c576eecc985959";
-      sha256 = "1zj1bab5ck9k9c11cmyszmlnfw3sis79kmlag2a0c0p035rzsl35";
+      rev = "136d82e1884f86b9f9bbbcc88bab6d199928a46e";
+      sha256 = "1chbvrpykswcmph3yjpv17j5j47azvb90i1a4j0pwc2mmak6gnjq";
     };
     meta.homepage = "https://github.com/tpope/vim-dadbod/";
   };
 
   vim-dadbod-completion = buildVimPluginFrom2Nix {
     pname = "vim-dadbod-completion";
-    version = "2022-03-06";
+    version = "2022-06-19";
     src = fetchFromGitHub {
       owner = "kristijanhusak";
       repo = "vim-dadbod-completion";
-      rev = "1c60988abf17f426b87a1ce2de6b6eabfd5d6b2b";
-      sha256 = "0b6mgmaak6vh2adkzdh9s5b5js362hv2hg14zwrb5846cjpbs21i";
+      rev = "22ef15e7103b78850473b57ef48233aaec8d9f64";
+      sha256 = "1ibr1db06b9bxa7jnspix6wmf1z8fl3g5rrxskgfhfpdb2blwihm";
     };
     meta.homepage = "https://github.com/kristijanhusak/vim-dadbod-completion/";
   };
 
   vim-dadbod-ui = buildVimPluginFrom2Nix {
     pname = "vim-dadbod-ui";
-    version = "2022-05-02";
+    version = "2022-06-20";
     src = fetchFromGitHub {
       owner = "kristijanhusak";
       repo = "vim-dadbod-ui";
-      rev = "7bd114b88da4bf8115bd85d70fb531e4b6d72eb7";
-      sha256 = "0mb74z2kr85wd17kbhf8qx02iciq31aqg7y12k1isvmxkv4i0hhw";
+      rev = "50cbfc825bd58081f916f989d7ae78e5320e858b";
+      sha256 = "0y2cnafw3ahxfvjc5g39nrpiwn502hp3xarnp8c3pg85hzf13jrc";
     };
     meta.homepage = "https://github.com/kristijanhusak/vim-dadbod-ui/";
   };
@@ -9224,12 +9224,12 @@ final: prev:
 
   vim-floaterm = buildVimPluginFrom2Nix {
     pname = "vim-floaterm";
-    version = "2022-06-03";
+    version = "2022-06-11";
     src = fetchFromGitHub {
       owner = "voldikss";
       repo = "vim-floaterm";
-      rev = "875c404da92bb716fdfb33d4948277651ff345a9";
-      sha256 = "0gkbd8vvyiln3v1f0hgx34ixhbqda8ggivqfgpnb7vlx5j9za706";
+      rev = "e3f2d94d722603f8b65088ea1d7e0329951985bd";
+      sha256 = "0d7r5g1wrcbq6ahd3hbwpjw54qk8k471wm704cmpdlgfjbjxdfqf";
     };
     meta.homepage = "https://github.com/voldikss/vim-floaterm/";
   };
@@ -9296,12 +9296,12 @@ final: prev:
 
   vim-fugitive = buildVimPluginFrom2Nix {
     pname = "vim-fugitive";
-    version = "2022-06-07";
+    version = "2022-06-19";
     src = fetchFromGitHub {
       owner = "tpope";
       repo = "vim-fugitive";
-      rev = "92c73bb0507338441733198d630a1fe5e7fdac3a";
-      sha256 = "0skxvlxnxcwj22qwh166i1kkn7iir3jndw1ixwvh3iipq46910zq";
+      rev = "8b39d29d947618913ba1db32de605a6335875b99";
+      sha256 = "0zmn09rh17zjq0pkf6nmmpwkchfvj8ycr2559ndjc5vdw8r10x70";
     };
     meta.homepage = "https://github.com/tpope/vim-fugitive/";
   };
@@ -9368,12 +9368,12 @@ final: prev:
 
   vim-git = buildVimPluginFrom2Nix {
     pname = "vim-git";
-    version = "2022-05-18";
+    version = "2022-06-19";
     src = fetchFromGitHub {
       owner = "tpope";
       repo = "vim-git";
-      rev = "0e571394d9c17026917235fc3df8f8d9184bc4d0";
-      sha256 = "11bifrm9b5i89yg94368npw0la57icw8v9074ry7rp5f5r3jg3k8";
+      rev = "5143bea9ed17bc32163dbe3ca706344d79507b9d";
+      sha256 = "02vk8lgl6zswg6bdg1qy4qrh47bwflil601z8i33yjx5q2qrq0ra";
     };
     meta.homepage = "https://github.com/tpope/vim-git/";
   };
@@ -10054,12 +10054,12 @@ final: prev:
 
   vim-ledger = buildVimPluginFrom2Nix {
     pname = "vim-ledger";
-    version = "2022-05-25";
+    version = "2022-06-16";
     src = fetchFromGitHub {
       owner = "ledger";
       repo = "vim-ledger";
-      rev = "ca55491ce36f30263a56b0dbd2bcb4a26be34154";
-      sha256 = "0pamfqjxiqk7rs5cn8s81197f8rilr01ka11hpbzamflz9v2lz9c";
+      rev = "78fdcae8cab810892c82d555a63bdcd20b8e1397";
+      sha256 = "0wr56azflkjx4v7xw44c960byfcak7kjgkk9a482rj19iywk9141";
     };
     meta.homepage = "https://github.com/ledger/vim-ledger/";
   };
@@ -10162,12 +10162,12 @@ final: prev:
 
   vim-lsp = buildVimPluginFrom2Nix {
     pname = "vim-lsp";
-    version = "2022-05-27";
+    version = "2022-06-18";
     src = fetchFromGitHub {
       owner = "prabirshrestha";
       repo = "vim-lsp";
-      rev = "9458f6e2d49112958499f0c82e1d6f18baa70248";
-      sha256 = "099rlqfw45gr4szi2f1zdzayrsw504ihqpn6a7byg5h89a617kwy";
+      rev = "74e458bc9c7532ff1959b2443a1d73494e3673b6";
+      sha256 = "15m00ihfka0nlvn86q6flmxcwxf64ahykh4g7x9gb030gr6miflp";
     };
     meta.homepage = "https://github.com/prabirshrestha/vim-lsp/";
   };
@@ -10198,12 +10198,12 @@ final: prev:
 
   vim-maktaba = buildVimPluginFrom2Nix {
     pname = "vim-maktaba";
-    version = "2022-04-22";
+    version = "2022-06-17";
     src = fetchFromGitHub {
       owner = "google";
       repo = "vim-maktaba";
-      rev = "fe631a85b0a1e1a709a55ef0947c9c0813f41edb";
-      sha256 = "166fgfxh6k4v2ypzjmn6hicr92xgcsi5bi930f74xv5fzm0gw9l8";
+      rev = "80b47c5f636c0ed0915af378b47428a83346a699";
+      sha256 = "1fmq4zcx8shrkw1p2sjhncy3g7j4zka4rvr97jplf8fv40yqql1i";
     };
     meta.homepage = "https://github.com/google/vim-maktaba/";
   };
@@ -10246,12 +10246,12 @@ final: prev:
 
   vim-markdown-composer = buildVimPluginFrom2Nix {
     pname = "vim-markdown-composer";
-    version = "2022-05-04";
+    version = "2022-06-14";
     src = fetchFromGitHub {
       owner = "euclio";
       repo = "vim-markdown-composer";
-      rev = "5b79f425ebd28216d9aa472be3ba07cda41d9b24";
-      sha256 = "0i4m2x2cw604aczp1ijnrv0wvh1b9bxg9zh0zmf8kk7b00zc1k5c";
+      rev = "e6f99bc20cfcb277c63041b1f766e6d5940bcc76";
+      sha256 = "0ljv8cvca8nk91g67mnzip81say04b1wbj9bzcgzy8m6qkz1r2h3";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/euclio/vim-markdown-composer/";
@@ -10391,12 +10391,12 @@ final: prev:
 
   vim-mundo = buildVimPluginFrom2Nix {
     pname = "vim-mundo";
-    version = "2022-01-30";
+    version = "2022-06-20";
     src = fetchFromGitHub {
       owner = "simnalamburt";
       repo = "vim-mundo";
-      rev = "595ee332719f397c2441d85f79608113957cc78f";
-      sha256 = "0kwiw877izpjqfj4gp4km8ivj6iy2c2jxyiqgxrvjqna62kic0ap";
+      rev = "b9a6adbcfacc1ffe42ef3aa888f7c828a0b63746";
+      sha256 = "0x0xjijadzk3z3f4bs0k3rbhb760qcdczvn0c8m9gx678wfjshyd";
     };
     meta.homepage = "https://github.com/simnalamburt/vim-mundo/";
   };
@@ -10655,12 +10655,12 @@ final: prev:
 
   vim-oscyank = buildVimPluginFrom2Nix {
     pname = "vim-oscyank";
-    version = "2022-05-21";
+    version = "2022-06-20";
     src = fetchFromGitHub {
       owner = "ojroques";
       repo = "vim-oscyank";
-      rev = "ebcb47da66329d2c654e380d87879a935576c176";
-      sha256 = "17l3ghjicf0llf7341vkhgaxs53pj2fgrsli2rpkqnm2qd041gyv";
+      rev = "360ccdc01b18cd434588c34e15e5ea382b436de8";
+      sha256 = "14phavx432h16bdm7m99a21xz2gb1s47fd5g8v2b5ig12l4yss92";
     };
     meta.homepage = "https://github.com/ojroques/vim-oscyank/";
   };
@@ -11123,12 +11123,12 @@ final: prev:
 
   vim-rhubarb = buildVimPluginFrom2Nix {
     pname = "vim-rhubarb";
-    version = "2022-05-11";
+    version = "2022-06-15";
     src = fetchFromGitHub {
       owner = "tpope";
       repo = "vim-rhubarb";
-      rev = "ab0d42bb31b3317aa66dd1c0b506837cc6ca2835";
-      sha256 = "0qv2ppmxpy72gb8ivz5cx19b4y8si4v428d9mmlx9q7mv9q4wmhq";
+      rev = "f8b70f5ef3b315af1148ef9dcc2a9afb02bc8c79";
+      sha256 = "1cgxaaizx9l11s3gs7d1gvlq2c1l42548fmdkqgqnl8z777h065k";
     };
     meta.homepage = "https://github.com/tpope/vim-rhubarb/";
   };
@@ -11183,12 +11183,12 @@ final: prev:
 
   vim-sandwich = buildVimPluginFrom2Nix {
     pname = "vim-sandwich";
-    version = "2022-05-14";
+    version = "2022-06-12";
     src = fetchFromGitHub {
       owner = "machakann";
       repo = "vim-sandwich";
-      rev = "17266bab12c4f2ca9ce871f706176d971613487e";
-      sha256 = "1zp7zkgphlavspyfha62rwhsxn0w4fp2ciylv3vq76j54xyxkqyj";
+      rev = "e114a5e0c90aefed3d2a48ca326eff9d39bc90a9";
+      sha256 = "0kqn9kzwhh1zhymvmpnbkrccj4nn5lda3fwj1hyd4z3iaffxxk9a";
     };
     meta.homepage = "https://github.com/machakann/vim-sandwich/";
   };
@@ -11363,12 +11363,12 @@ final: prev:
 
   vim-slime = buildVimPluginFrom2Nix {
     pname = "vim-slime";
-    version = "2022-05-11";
+    version = "2022-06-17";
     src = fetchFromGitHub {
       owner = "jpalardy";
       repo = "vim-slime";
-      rev = "6e4b81303968f37346925d6907b96ef07788cc82";
-      sha256 = "1z0nmfmn7ijj3hih4dbi1iq3dc6gpprck3fmidhmkv6vms041nx4";
+      rev = "93d202278004fbc8eb3ec9d734916214e6c7f034";
+      sha256 = "1nnv2kkq06d72wfsyliqvyrp735j5kg7y9c1r9lypjw2y7548spf";
     };
     meta.homepage = "https://github.com/jpalardy/vim-slime/";
   };
@@ -11399,12 +11399,12 @@ final: prev:
 
   vim-smoothie = buildVimPluginFrom2Nix {
     pname = "vim-smoothie";
-    version = "2022-05-28";
+    version = "2022-06-10";
     src = fetchFromGitHub {
       owner = "psliwka";
       repo = "vim-smoothie";
-      rev = "4206594ee4d4c6689bd41f5ee8e3617642d3b295";
-      sha256 = "1fr7bvl22p021wpwaadfczpg16qh2r2apjwq9bkcwlsg5l80qfdn";
+      rev = "df1e324e9f3395c630c1c523d0555a01d2eb1b7e";
+      sha256 = "1c87zc954wk76h9klxyygv19jp729fms2f5m18gwzskars3px076";
     };
     meta.homepage = "https://github.com/psliwka/vim-smoothie/";
   };
@@ -11435,24 +11435,24 @@ final: prev:
 
   vim-snipmate = buildVimPluginFrom2Nix {
     pname = "vim-snipmate";
-    version = "2021-06-04";
+    version = "2022-06-11";
     src = fetchFromGitHub {
       owner = "garbas";
       repo = "vim-snipmate";
-      rev = "ed3c5426a20bf1c06d7980946ada34fd9f93320e";
-      sha256 = "0bxaalza02sgm045cj4vciy3qhmj7pj1rp9bdwm5837ldq8paj1h";
+      rev = "525f331320427bf7aeb07651e2536b1f8a23df03";
+      sha256 = "0qfai0x9zg52n43ikgxx5x9y1nl3x420q8564csxirnbhnbn5xgx";
     };
     meta.homepage = "https://github.com/garbas/vim-snipmate/";
   };
 
   vim-snippets = buildVimPluginFrom2Nix {
     pname = "vim-snippets";
-    version = "2022-05-29";
+    version = "2022-06-10";
     src = fetchFromGitHub {
       owner = "honza";
       repo = "vim-snippets";
-      rev = "11c771065bfadcc0583b9711d3932c765f168bb4";
-      sha256 = "18x5y4cc1d4z5ciqhrb1554abv5ixz7jcvldjgsnlnvkx5b616s7";
+      rev = "222cf7b44bb569c9a046a9891000c898bd4c43c9";
+      sha256 = "0xksa854c8rjp9y2xvhk78z5ha9p8c3pvpzvddii2aay22cfkn8h";
     };
     meta.homepage = "https://github.com/honza/vim-snippets/";
   };
@@ -11531,12 +11531,12 @@ final: prev:
 
   vim-startuptime = buildVimPluginFrom2Nix {
     pname = "vim-startuptime";
-    version = "2022-05-30";
+    version = "2022-06-17";
     src = fetchFromGitHub {
       owner = "dstein64";
       repo = "vim-startuptime";
-      rev = "a8ab56f30c603f8022f5fb6a436f5183beeb7b27";
-      sha256 = "1xlb8q93ff9qdlk17b76sbrz2adixj7zxf8b9ccvafki8diaqkj9";
+      rev = "82c8a5491e13fa307fb2cb47182a30560f930377";
+      sha256 = "05bj0cs5m829bdcm9zgmla2ha2nwg5cn1qs9r75haway42dza3s6";
     };
     meta.homepage = "https://github.com/dstein64/vim-startuptime/";
   };
@@ -11868,12 +11868,12 @@ final: prev:
 
   vim-tpipeline = buildVimPluginFrom2Nix {
     pname = "vim-tpipeline";
-    version = "2022-05-16";
+    version = "2022-06-19";
     src = fetchFromGitHub {
       owner = "vimpostor";
       repo = "vim-tpipeline";
-      rev = "b83d430697d268a690240ec932630b8aed211aba";
-      sha256 = "0wy31h8f7j433h4anrwi7658g8plaja4gjsykgsdsgvm1zanq0dw";
+      rev = "7945984fd56bd69506c73f68bb300aaceae72e82";
+      sha256 = "1w6ifhkjjdfksmywf9r6hnvljbki0vdj440zj3ihbp2jpmhyb09q";
     };
     meta.homepage = "https://github.com/vimpostor/vim-tpipeline/";
   };
@@ -11928,12 +11928,12 @@ final: prev:
 
   vim-ultest = buildVimPluginFrom2Nix {
     pname = "vim-ultest";
-    version = "2022-05-05";
+    version = "2022-06-18";
     src = fetchFromGitHub {
       owner = "rcarriga";
       repo = "vim-ultest";
-      rev = "6978fd32e3ca2c1c5591884eea0d57a7ee43d212";
-      sha256 = "19dphm7xgfc0xvxrlys21zkp7ixbx62p11x6ms6xmwm8cjjh64pc";
+      rev = "c93eb128332f8245776b753407ab6c4432c4c556";
+      sha256 = "1y686xrcvkwqmc263syh84a396xanqka39axc460ibl9zav7z4nn";
     };
     meta.homepage = "https://github.com/rcarriga/vim-ultest/";
   };
@@ -12000,12 +12000,12 @@ final: prev:
 
   vim-visual-multi = buildVimPluginFrom2Nix {
     pname = "vim-visual-multi";
-    version = "2022-05-06";
+    version = "2022-06-10";
     src = fetchFromGitHub {
       owner = "mg979";
       repo = "vim-visual-multi";
-      rev = "046d0d5ac5fb2888447d1dd8b7e52fd0314f9766";
-      sha256 = "17masfjxrhjcfqmlgf1jpmmz18j8vb4n88dl34rry6c3abiraprj";
+      rev = "e23b98a8852255766e54bf7723a9d61fb5ab3143";
+      sha256 = "1zxdbcd4qsqdfrgvn76r0a187hs0krb7w4r39dr10wwgzq69d2vf";
     };
     meta.homepage = "https://github.com/mg979/vim-visual-multi/";
   };
@@ -12108,12 +12108,12 @@ final: prev:
 
   vim-which-key = buildVimPluginFrom2Nix {
     pname = "vim-which-key";
-    version = "2022-06-07";
+    version = "2022-06-19";
     src = fetchFromGitHub {
       owner = "liuchengxu";
       repo = "vim-which-key";
-      rev = "d7d451daa66154031dd9fb24c1798b4d07a820d9";
-      sha256 = "0f7rcmlnp24zag9ypfwd0i6bsikm0ndd58jnpv008qq8hl80rps1";
+      rev = "931260e7816ff8eeb26843f859f86dac09912add";
+      sha256 = "030ljq24lxqac3hphr5phw06lgcjg7jsrc6yxbgxx2m28v54isi6";
     };
     meta.homepage = "https://github.com/liuchengxu/vim-which-key/";
   };
@@ -12360,12 +12360,12 @@ final: prev:
 
   vimspector = buildVimPluginFrom2Nix {
     pname = "vimspector";
-    version = "2022-06-04";
+    version = "2022-06-17";
     src = fetchFromGitHub {
       owner = "puremourning";
       repo = "vimspector";
-      rev = "44eeaebd8cf8514de2b503e8698f2f341b5f23ad";
-      sha256 = "197l41s256z6iyb1pym6h9m4046k7m0jiwlrgfbf60yy2fxka7f3";
+      rev = "541cedd19bc22b5c00648352f0afe604113db32a";
+      sha256 = "1ra6jr5qvgclazaj3332kiwlc5kvpvi2dj9g2vfgd84140036cas";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/puremourning/vimspector/";
@@ -12373,12 +12373,12 @@ final: prev:
 
   vimtex = buildVimPluginFrom2Nix {
     pname = "vimtex";
-    version = "2022-06-05";
+    version = "2022-06-20";
     src = fetchFromGitHub {
       owner = "lervag";
       repo = "vimtex";
-      rev = "754bf6c97272e9bf479057b44cc968c4dad34753";
-      sha256 = "1igkd96171rhw0xdqikjhg99527jkkg7i6ri10p83v1fx9a7bk5y";
+      rev = "fcdf28ae2c7f5e0aabeead8b78bd112141ef26f8";
+      sha256 = "0d9g9cdrjhs0zwr3mc8r4dr1sf6jjhx3gywl8vfzk7xbrlyn6vcs";
     };
     meta.homepage = "https://github.com/lervag/vimtex/";
   };
@@ -12505,12 +12505,12 @@ final: prev:
 
   winshift-nvim = buildVimPluginFrom2Nix {
     pname = "winshift.nvim";
-    version = "2021-11-15";
+    version = "2022-06-20";
     src = fetchFromGitHub {
       owner = "sindrets";
       repo = "winshift.nvim";
-      rev = "aaa04b97640165eb0877bfc04943f4282887470b";
-      sha256 = "0rg7ci0m1hm9jbhjwckvjnfl0w3bl2wfr7wq67k0wdj5vnlzz6w3";
+      rev = "7014fdac39082977f11a9bed4b5486a7c04e4202";
+      sha256 = "1q21fh3rzrcl598z406nfr3gnfayy3ry3av9g41z872hx8r49kjf";
     };
     meta.homepage = "https://github.com/sindrets/winshift.nvim/";
   };
@@ -12565,12 +12565,12 @@ final: prev:
 
   xptemplate = buildVimPluginFrom2Nix {
     pname = "xptemplate";
-    version = "2020-06-29";
+    version = "2022-06-10";
     src = fetchFromGitHub {
       owner = "drmingdrmer";
       repo = "xptemplate";
-      rev = "359ffe4d426bce2e95f5866b682856b25555396f";
-      sha256 = "1rj5k58n1ybcc7qxsxlh09p2v4cps5xyzxmvjfrixy1qm2f85kd5";
+      rev = "d8500403b35d5597441773074e3976238b5e8b2c";
+      sha256 = "0dpdzx46rrwq9i2rymn0if7ci9h2b5hmdxqfw0dmdiyn1byj2wph";
     };
     meta.homepage = "https://github.com/drmingdrmer/xptemplate/";
   };
@@ -12686,36 +12686,36 @@ final: prev:
 
   catppuccin-nvim = buildVimPluginFrom2Nix {
     pname = "catppuccin-nvim";
-    version = "2022-05-30";
+    version = "2022-06-16";
     src = fetchFromGitHub {
       owner = "catppuccin";
       repo = "nvim";
-      rev = "773d339cbd307fe218cf7b3ea04eac26b345a3b7";
-      sha256 = "005r3nmjd3s0gbf319xwrvighjg391j3qh79sfc2568z53wxj8r0";
+      rev = "d46425163dad4cc74910c0c81eeedb00cadf8a61";
+      sha256 = "1iqjlvr9d1nlf5bpafd15zz0y9r6vrfgp5mwld7kwv9ipr3gw0sd";
     };
     meta.homepage = "https://github.com/catppuccin/nvim/";
   };
 
   catppuccin-vim = buildVimPluginFrom2Nix {
     pname = "catppuccin-vim";
-    version = "2022-06-06";
+    version = "2022-06-20";
     src = fetchFromGitHub {
       owner = "catppuccin";
       repo = "vim";
-      rev = "eaac7edb19ff11ce049513ac184fff7493817c1f";
-      sha256 = "181jfbw3msf1pccykabnniqry28ikassj39rc36hyz1vii1dq1d0";
+      rev = "e2fdf27b0f28f7e285beb377d2fc6936957c2122";
+      sha256 = "098blx6c2mzh6ghlvm6cv62bi8cfiys9r867msfw2h7r01gqz2hf";
     };
     meta.homepage = "https://github.com/catppuccin/vim/";
   };
 
   chad = buildVimPluginFrom2Nix {
     pname = "chad";
-    version = "2022-06-09";
+    version = "2022-06-21";
     src = fetchFromGitHub {
       owner = "ms-jpq";
       repo = "chadtree";
-      rev = "9565764a38a6ad352b6daaf40aaec1ec6aae67a4";
-      sha256 = "0frcfxnf6zzsslcpslsgpcb04ylxcf50lr3yg0gcap38gwwhna6p";
+      rev = "1efa6229ab08d4620a8aa546bfd5103bd98a74e0";
+      sha256 = "0mksvj0vswg6wbxfrr9rg6miv0kr700z3q8xcrria43rf06la32l";
     };
     meta.homepage = "https://github.com/ms-jpq/chadtree/";
   };
@@ -12782,12 +12782,12 @@ final: prev:
 
   rose-pine = buildVimPluginFrom2Nix {
     pname = "rose-pine";
-    version = "2022-06-02";
+    version = "2022-06-16";
     src = fetchFromGitHub {
       owner = "rose-pine";
       repo = "neovim";
-      rev = "04fb9d3bf29755a0cd6e53373e5750ca78a8d37c";
-      sha256 = "14zdlm3rpfkkg0y94071i6qx4bk3vp2wd2f5v7503mdc3p684amq";
+      rev = "3f0a6c06da29c7b0f3fa49a313ae4d56f0dc58b8";
+      sha256 = "01r34bkfs8kvaw72852sfk5jr1ngg2qf6a3dlpsppkb8l4lwi1k3";
     };
     meta.homepage = "https://github.com/rose-pine/neovim/";
   };
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index a9d89a4f1ed65..f7e1645d707fd 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -191,6 +191,10 @@ self: super: {
     dependencies = with self; [ nvim-cmp ];
   });
 
+  cmp-nvim-tags = super.cmp-nvim-tags.overrideAttrs (old: {
+    dependencies = with self; [ nvim-cmp ];
+  });
+
   cmp-pandoc-nvim = super.cmp-pandoc-nvim.overrideAttrs (old: {
     dependencies = with self; [ nvim-cmp pandoc plenary-nvim ];
   });
@@ -212,22 +216,18 @@ self: super: {
     '';
   });
 
-  cmp-nvim-tags = super.cmp-nvim-tags.overrideAttrs (old: {
-    dependencies = with self; [ nvim-cmp ];
-  });
-
   cmp-tmux = super.cmp-tmux.overrideAttrs (old: {
     dependencies = with self; [ nvim-cmp tmux ];
   });
 
-  cmp-vimwiki-tags = super.cmp-vimwiki-tags.overrideAttrs (old: {
-    dependencies = with self; [ nvim-cmp vimwiki ];
-  });
-
   cmp-vim-lsp = super.cmp-vim-lsp.overrideAttrs (old: {
     dependencies = with self; [ nvim-cmp vim-lsp ];
   });
 
+  cmp-vimwiki-tags = super.cmp-vimwiki-tags.overrideAttrs (old: {
+    dependencies = with self; [ nvim-cmp vimwiki ];
+  });
+
   cmp-zsh = super.cmp-zsh.overrideAttrs (old: {
     dependencies = with self; [ nvim-cmp zsh ];
   });
@@ -328,15 +328,15 @@ self: super: {
     };
   });
 
-  diffview-nvim = super.diffview-nvim.overrideAttrs (oa: {
+  diffview-nvim = super.diffview-nvim.overrideAttrs (old: {
     dependencies = with self; [ plenary-nvim ];
 
     doInstallCheck = true;
     nvimRequireCheck = "diffview";
   });
 
-  direnv-vim = super.direnv-vim.overrideAttrs (oa: {
-    preFixup = oa.preFixup or "" + ''
+  direnv-vim = super.direnv-vim.overrideAttrs (old: {
+    preFixup = old.preFixup or "" + ''
       substituteInPlace $out/autoload/direnv.vim \
         --replace "let s:direnv_cmd = get(g:, 'direnv_cmd', 'direnv')" \
           "let s:direnv_cmd = get(g:, 'direnv_cmd', '${lib.getBin direnv}/bin/direnv')"
@@ -376,7 +376,7 @@ self: super: {
       patches = [
         (substituteAll {
           src = ./patches/fruzzy/get_version.patch;
-          version = old.version;
+          inherit (old) version;
         })
       ];
       configurePhase = ''
@@ -445,31 +445,10 @@ self: super: {
     dependencies = with self; [ plenary-nvim ];
   });
 
-  # plenary-nvim = super.toVimPlugin(luaPackages.plenary-nvim);
-
-  plenary-nvim = super.plenary-nvim.overrideAttrs (old: {
-    postPatch = ''
-      sed -Ei lua/plenary/curl.lua \
-          -e 's@(command\s*=\s*")curl(")@\1${curl}/bin/curl\2@'
-    '';
-
-    doInstallCheck = true;
-    nvimRequireCheck = "plenary";
-  });
-
   gruvbox-nvim = super.gruvbox-nvim.overrideAttrs (old: {
     dependencies = with self; [ lush-nvim ];
   });
 
-  jedi-vim = super.jedi-vim.overrideAttrs (old: {
-    # checking for python3 support in vim would be neat, too, but nobody else seems to care
-    buildInputs = [ python3.pkgs.jedi ];
-    meta = {
-      description = "code-completion for python using python-jedi";
-      license = lib.licenses.mit;
-    };
-  });
-
   himalaya-vim = buildVimPluginFrom2Nix {
     pname = "himalaya-vim";
     inherit (himalaya) src version;
@@ -485,6 +464,15 @@ self: super: {
     '';
   };
 
+  jedi-vim = super.jedi-vim.overrideAttrs (old: {
+    # checking for python3 support in vim would be neat, too, but nobody else seems to care
+    buildInputs = [ python3.pkgs.jedi ];
+    meta = {
+      description = "code-completion for python using python-jedi";
+      license = lib.licenses.mit;
+    };
+  });
+
   LanguageClient-neovim =
     let
       version = "0.1.161";
@@ -659,7 +647,19 @@ self: super: {
     configurePhase = "cd vim";
   });
 
-  parinfer-rust = parinfer-rust;
+  inherit parinfer-rust;
+
+  # plenary-nvim = super.toVimPlugin(luaPackages.plenary-nvim);
+
+  plenary-nvim = super.plenary-nvim.overrideAttrs (old: {
+    postPatch = ''
+      sed -Ei lua/plenary/curl.lua \
+          -e 's@(command\s*=\s*")curl(")@\1${curl}/bin/curl\2@'
+    '';
+
+    doInstallCheck = true;
+    nvimRequireCheck = "plenary";
+  });
 
   range-highlight-nvim = super.range-highlight-nvim.overrideAttrs (old: {
     dependencies = with self; [ cmd-parser-nvim ];
@@ -676,7 +676,7 @@ self: super: {
 
   skim = buildVimPluginFrom2Nix {
     pname = "skim";
-    version = skim.version;
+    inherit (skim) version;
     src = skim.vim;
   };
 
@@ -789,16 +789,16 @@ self: super: {
     dependencies = with self; [ sqlite-lua telescope-nvim ];
   });
 
-  telescope-fzf-writer-nvim = super.telescope-fzf-writer-nvim.overrideAttrs (old: {
-    dependencies = with self; [ telescope-nvim ];
-  });
-
   telescope-fzf-native-nvim = super.telescope-fzf-native-nvim.overrideAttrs (old: {
     dependencies = with self; [ telescope-nvim ];
     buildPhase = "make";
     meta.platforms = lib.platforms.all;
   });
 
+  telescope-fzf-writer-nvim = super.telescope-fzf-writer-nvim.overrideAttrs (old: {
+    dependencies = with self; [ telescope-nvim ];
+  });
+
   telescope-fzy-native-nvim = super.telescope-fzy-native-nvim.overrideAttrs (old: {
     dependencies = with self; [ telescope-nvim ];
     preFixup =
@@ -974,7 +974,7 @@ self: super: {
             libiconv
           ];
 
-          cargoSha256 = "sha256-XmQTRmOO/tyA0F6FQQRxZPcVXCYZkEAiNIzU/ismjc0=";
+          cargoSha256 = "sha256-9Vr1gpggfAQlMgM/s8j6FTTYFppHql2PQ7cPtg1wNmo=";
         };
       in
       ''
@@ -1103,13 +1103,13 @@ self: super: {
 
   vim-markdown-composer =
     let
-      vim-markdown-composer-bin = rustPlatform.buildRustPackage rec {
+      vim-markdown-composer-bin = rustPlatform.buildRustPackage {
         pname = "vim-markdown-composer-bin";
         inherit (super.vim-markdown-composer) src version;
-        cargoSha256 = "0q0i6kyihswrjrfdj4p3z54b779sdg2wz38z943ypj6dqphhcklx";
+        cargoSha256 = "sha256-Vie8vLTplhaVU4E9IohvxERfz3eBpd62m8/1Ukzk8e4=";
       };
     in
-    super.vim-markdown-composer.overrideAttrs (oldAttrs: rec {
+    super.vim-markdown-composer.overrideAttrs (old: {
       preFixup = ''
         substituteInPlace "$out"/after/ftplugin/markdown/composer.vim \
           --replace "s:plugin_root . '/target/release/markdown-composer'" \
@@ -1287,9 +1287,9 @@ self: super: {
       "coc-smartf"
       "coc-snippets"
       "coc-solargraph"
+      "coc-sqlfluff"
       "coc-stylelint"
       "coc-sumneko-lua"
-      "coc-sqlfluff"
       "coc-tabnine"
       "coc-texlab"
       "coc-toml"
diff --git a/pkgs/applications/editors/vim/plugins/update.py b/pkgs/applications/editors/vim/plugins/update.py
index f63bd867f3682..1214e36372a62 100755
--- a/pkgs/applications/editors/vim/plugins/update.py
+++ b/pkgs/applications/editors/vim/plugins/update.py
@@ -116,13 +116,7 @@ class VimEditor(pluginupdate.Editor):
 def main():
 
     global luaPlugins
-
-    # whitelist
-    luaPlugins = run_nix_expr(GET_PLUGINS_LUA) + [
-        "diffview-nvim",
-        "marks-nvim",
-        "nvim-biscuits"
-    ]
+    luaPlugins = run_nix_expr(GET_PLUGINS_LUA)
 
     editor = VimEditor("vim", ROOT, GET_PLUGINS)
     parser = editor.create_parser()
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index ae65dc33d613e..d4a542bb99e4e 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1041,6 +1041,22 @@ let
         };
       };
 
+      grapecity.gc-excelviewer = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "gc-excelviewer";
+          publisher = "grapecity";
+          version = "4.2.55";
+          sha256 = "sha256-yHl6ZTGIKOEsqmyeYtgDUhNAN9uRpoFApA7FKkPWW3E=";
+        };
+        meta = with lib; {
+          description = "Edit Excel spreadsheets and CSV files in Visual Studio Code and VS Code for the Web";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=grapecity.gc-excelviewer";
+          homepage = "https://github.com/jjuback/gc-excelviewer";
+          license = licenses.mit;
+          maintainers = with maintainers; [ kamadorueda ];
+        };
+      };
+
       humao.rest-client = buildVscodeMarketplaceExtension {
         mktplcRef = {
           publisher = "humao";
@@ -1495,6 +1511,23 @@ let
         };
       };
 
+      mattn.lisp = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "lisp";
+          publisher = "mattn";
+          version = "0.1.12";
+          sha256 = "sha256-x6aFrcX0YElEFEr0qA669/LPlab15npmXd5Q585pIEw=";
+        };
+        meta = with lib; {
+          description = "Lisp syntax for vscode";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=mattn.lisp";
+          homepage = "https://github.com/mattn/vscode-lisp";
+          changelog = "https://marketplace.visualstudio.com/items/mattn.lisp/changelog";
+          license = licenses.mit;
+          maintainers = with maintainers; [ kamadorueda ];
+        };
+      };
+
       mhutchie.git-graph = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "git-graph";
diff --git a/pkgs/applications/emulators/atari800/default.nix b/pkgs/applications/emulators/atari800/default.nix
index 37e0d83f14060..c1f685827047a 100644
--- a/pkgs/applications/emulators/atari800/default.nix
+++ b/pkgs/applications/emulators/atari800/default.nix
@@ -4,13 +4,13 @@
 with lib;
 stdenv.mkDerivation rec {
   pname = "atari800";
-  version = "4.2.0";
+  version = "5.0.0";
 
   src = fetchFromGitHub {
     owner = "atari800";
     repo = "atari800";
     rev = "ATARI800_${replaceChars ["."] ["_"] version}";
-    sha256 = "15l08clqqayi9izrgsz9achan6gl4x57wqsc8mad3yn0xayzz3qy";
+    sha256 = "sha256-+eJXhqPyU0GhmzF7DbteTXzEnn5klCor9Io/UgXQfQg=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/applications/emulators/kega-fusion/default.nix b/pkgs/applications/emulators/kega-fusion/default.nix
index e8feb1ea7ed50..1b95dec89face 100644
--- a/pkgs/applications/emulators/kega-fusion/default.nix
+++ b/pkgs/applications/emulators/kega-fusion/default.nix
@@ -72,6 +72,7 @@ in stdenv.mkDerivation {
     description = "Sega SG1000, SC3000, SF7000, Master System, Game Gear, Genesis/Megadrive, SVP, Pico, SegaCD/MegaCD and 32X emulator";
     homepage = "https://www.carpeludum.com/kega-fusion/";
     maintainers = with maintainers; [ abbradar ];
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfreeRedistributable;
     platforms = [ "i686-linux" ];
   };
diff --git a/pkgs/applications/emulators/wine/base.nix b/pkgs/applications/emulators/wine/base.nix
index 7788b13b4ecb5..e3875e130a189 100644
--- a/pkgs/applications/emulators/wine/base.nix
+++ b/pkgs/applications/emulators/wine/base.nix
@@ -191,6 +191,10 @@ stdenv.mkDerivation ((lib.optionalAttrs (buildScript != null) {
     inherit version;
     homepage = "https://www.winehq.org/";
     license = with lib.licenses; [ lgpl21Plus ];
+    sourceProvenance = with lib.sourceTypes; [
+      fromSource
+      binaryNativeCode  # mono, gecko
+    ];
     description = if supportFlags.waylandSupport then "An Open Source implementation of the Windows API on top of OpenGL and Unix (with experimental Wayland support)" else "An Open Source implementation of the Windows API on top of X, OpenGL, and Unix";
     platforms = if supportFlags.waylandSupport then (lib.remove "x86_64-darwin" prevPlatforms) else prevPlatforms;
     maintainers = with lib.maintainers; [ avnik raskin bendlas jmc-figueira ];
diff --git a/pkgs/applications/finance/cryptowatch/default.nix b/pkgs/applications/finance/cryptowatch/default.nix
index 09531e4650e8f..4bf7a1a0b4f35 100644
--- a/pkgs/applications/finance/cryptowatch/default.nix
+++ b/pkgs/applications/finance/cryptowatch/default.nix
@@ -51,6 +51,7 @@ stdenv.mkDerivation rec {
     homepage = "https://cryptowat.ch";
     description = "Application for visualising real-time cryptocurrency market data";
     platforms = platforms.linux;
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     maintainers = with maintainers; [ livnev ];
   };
diff --git a/pkgs/applications/gis/udig/default.nix b/pkgs/applications/gis/udig/default.nix
index b939cf05e754a..808b70ed5ec93 100644
--- a/pkgs/applications/gis/udig/default.nix
+++ b/pkgs/applications/gis/udig/default.nix
@@ -18,6 +18,7 @@ let
   meta = with lib; {
     description = "User-friendly Desktop Internet GIS";
     homepage = "http://udig.refractions.net/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = with licenses; [ epl10 bsd3 ];
     maintainers = with maintainers; [ sikmir ];
     platforms = builtins.attrNames srcs;
diff --git a/pkgs/applications/graphics/avocode/default.nix b/pkgs/applications/graphics/avocode/default.nix
index 4d2db993b8d1f..a6a3563743b36 100644
--- a/pkgs/applications/graphics/avocode/default.nix
+++ b/pkgs/applications/graphics/avocode/default.nix
@@ -99,6 +99,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://avocode.com/";
     description = "The bridge between designers and developers";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     platforms = platforms.linux;
     maintainers = with maintainers; [ megheaiulian ];
diff --git a/pkgs/applications/graphics/drawio/default.nix b/pkgs/applications/graphics/drawio/default.nix
index 08cd0aad8156e..85d201f32dcd8 100644
--- a/pkgs/applications/graphics/drawio/default.nix
+++ b/pkgs/applications/graphics/drawio/default.nix
@@ -95,6 +95,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "A desktop application for creating diagrams";
     homepage = "https://about.draw.io/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.asl20;
     changelog = "https://github.com/jgraph/drawio-desktop/releases/tag/v${version}";
     maintainers = with maintainers; [ darkonion0 ];
diff --git a/pkgs/applications/graphics/fiji/default.nix b/pkgs/applications/graphics/fiji/default.nix
index 270132eca940a..039eb45a29670 100644
--- a/pkgs/applications/graphics/fiji/default.nix
+++ b/pkgs/applications/graphics/fiji/default.nix
@@ -66,7 +66,10 @@ stdenv.mkDerivation rec {
     homepage = "https://imagej.net/software/fiji/";
     description = "batteries-included distribution of ImageJ2, bundling a lot of plugins which facilitate scientific image analysis";
     platforms = [ "x86_64-linux" ];
-    sourceProvenance = with sourceTypes; [ binaryBytecode ];
+    sourceProvenance = with sourceTypes; [
+      binaryBytecode
+      binaryNativeCode
+    ];
     license = with lib.licenses; [ gpl2Plus gpl3Plus bsd2 publicDomain ];
     maintainers = with maintainers; [ zane ];
   };
diff --git a/pkgs/applications/graphics/freecad/default.nix b/pkgs/applications/graphics/freecad/default.nix
index 8f5404cf3ae92..c05f3502aec32 100644
--- a/pkgs/applications/graphics/freecad/default.nix
+++ b/pkgs/applications/graphics/freecad/default.nix
@@ -48,13 +48,13 @@
 
 mkDerivation rec {
   pname = "freecad";
-  version = "0.19.2";
+  version = "0.20";
 
   src = fetchFromGitHub {
     owner = "FreeCAD";
     repo = "FreeCAD";
     rev = version;
-    hash = "sha256-XZ+fRl3CPCIFu3nHeMTLibwwFBlG/cWpKJlI58hTAuU=";
+    hash = "sha256-Em4XVxDfvVG1Kf7q+6uHNA/VcMGLKMTv5TCh2XF/BtQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/graphics/kodelife/default.nix b/pkgs/applications/graphics/kodelife/default.nix
index 1c4609ac55b73..6286e64e3efe8 100644
--- a/pkgs/applications/graphics/kodelife/default.nix
+++ b/pkgs/applications/graphics/kodelife/default.nix
@@ -59,6 +59,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://hexler.net/products/kodelife";
     description = "Real-time GPU shader editor";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     maintainers = with maintainers; [ prusnak ];
     platforms = [ "aarch64-linux" "armv7l-linux" "x86_64-linux" ];
diff --git a/pkgs/applications/graphics/lightburn/default.nix b/pkgs/applications/graphics/lightburn/default.nix
index 05a99527e5f71..50b1cb37ffaf2 100644
--- a/pkgs/applications/graphics/lightburn/default.nix
+++ b/pkgs/applications/graphics/lightburn/default.nix
@@ -42,6 +42,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Layout, editing, and control software for your laser cutter";
     homepage = "https://lightburnsoftware.com/";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.unfree;
     maintainers = with lib.maintainers; [ q3k ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/graphics/odafileconverter/default.nix b/pkgs/applications/graphics/odafileconverter/default.nix
index b99902954572a..3a089febc3df3 100644
--- a/pkgs/applications/graphics/odafileconverter/default.nix
+++ b/pkgs/applications/graphics/odafileconverter/default.nix
@@ -46,6 +46,7 @@ in mkDerivation {
   meta = with lib; {
     description = "For converting between different versions of .dwg and .dxf";
     homepage = "https://www.opendesign.com/guestfiles/oda_file_converter";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     maintainers = with maintainers; [ nagisa ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/graphics/pencil/default.nix b/pkgs/applications/graphics/pencil/default.nix
index 5c5557d6d6016..ffd31bf7325ac 100644
--- a/pkgs/applications/graphics/pencil/default.nix
+++ b/pkgs/applications/graphics/pencil/default.nix
@@ -99,6 +99,7 @@ in stdenv.mkDerivation rec {
   meta = with lib; {
     description = "GUI prototyping/mockup tool";
     homepage    = "https://pencil.evolus.vn/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license     = licenses.gpl2; # Commercial license is also available
     maintainers = with maintainers; [ bjornfor prikhi mrVanDalo ];
     platforms   = platforms.linux;
diff --git a/pkgs/applications/graphics/pixeluvo/default.nix b/pkgs/applications/graphics/pixeluvo/default.nix
index 0c90b786baca9..f3b40b515183a 100644
--- a/pkgs/applications/graphics/pixeluvo/default.nix
+++ b/pkgs/applications/graphics/pixeluvo/default.nix
@@ -49,6 +49,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "A Beautifully Designed Image and Photo Editor for Windows and Linux";
     homepage = "http://www.pixeluvo.com/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     platforms = [ "x86_64-linux" ];
     maintainers = with maintainers; [ wolfangaukang ];
diff --git a/pkgs/applications/graphics/pixinsight/default.nix b/pkgs/applications/graphics/pixinsight/default.nix
index 6a59af40cc18e..f54aef75ac15a 100644
--- a/pkgs/applications/graphics/pixinsight/default.nix
+++ b/pkgs/applications/graphics/pixinsight/default.nix
@@ -124,6 +124,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Scientific image processing program for astrophotography";
     homepage = "https://pixinsight.com/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     platforms = [ "x86_64-linux" ];
     maintainers = [ maintainers.sheepforce ];
diff --git a/pkgs/applications/graphics/sane/backends/brscan4/default.nix b/pkgs/applications/graphics/sane/backends/brscan4/default.nix
index ea70224a932a0..ec8efcc27c2a6 100644
--- a/pkgs/applications/graphics/sane/backends/brscan4/default.nix
+++ b/pkgs/applications/graphics/sane/backends/brscan4/default.nix
@@ -89,6 +89,7 @@ stdenv.mkDerivation rec {
     description = "Brother brscan4 sane backend driver";
     homepage = "http://www.brother.com";
     platforms = [ "i686-linux" "x86_64-linux" ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.unfree;
     maintainers = with lib.maintainers; [ jraygauthier ];
   };
diff --git a/pkgs/applications/graphics/sane/backends/brscan5/default.nix b/pkgs/applications/graphics/sane/backends/brscan5/default.nix
index 4d276bd57bc3d..59daa9eb09ab8 100644
--- a/pkgs/applications/graphics/sane/backends/brscan5/default.nix
+++ b/pkgs/applications/graphics/sane/backends/brscan5/default.nix
@@ -102,6 +102,7 @@ stdenv.mkDerivation rec {
     description = "Brother brscan5 sane backend driver";
     homepage = "https://www.brother.com";
     platforms = [ "i686-linux" "x86_64-linux" ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.unfree;
     maintainers = with lib.maintainers; [ mattchrist ];
   };
diff --git a/pkgs/applications/graphics/sane/backends/dsseries/default.nix b/pkgs/applications/graphics/sane/backends/dsseries/default.nix
index 8a01f70c6b00f..93e179d867d93 100644
--- a/pkgs/applications/graphics/sane/backends/dsseries/default.nix
+++ b/pkgs/applications/graphics/sane/backends/dsseries/default.nix
@@ -47,6 +47,7 @@ stdenv.mkDerivation rec {
     description = "Brother DSSeries SANE backend driver";
     homepage = "http://www.brother.com";
     platforms = lib.platforms.linux;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.unfree;
     maintainers = with lib.maintainers; [ callahad ];
   };
diff --git a/pkgs/applications/graphics/solvespace/default.nix b/pkgs/applications/graphics/solvespace/default.nix
index 68744831538c4..e0605ad81e43f 100644
--- a/pkgs/applications/graphics/solvespace/default.nix
+++ b/pkgs/applications/graphics/solvespace/default.nix
@@ -7,6 +7,7 @@
 , at-spi2-core
 , cairo
 , dbus
+, eigen
 , freetype
 , fontconfig
 , glew
@@ -18,6 +19,7 @@
 , libpng
 , libselinux
 , libsepol
+, libspnav
 , libthai
 , libxkbcommon
 , pangomm
@@ -29,13 +31,13 @@
 
 stdenv.mkDerivation rec {
   pname = "solvespace";
-  version = "3.0";
+  version = "3.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-aaYqUZ0c1lCL91fmxtKFAAE2uUWrjnDB3WdcqdutXhE=";
+    hash = "sha256-sSDht8pBrOG1YpsWfC/CLTTWh2cI5pn2PXGH900Z0yA=";
     fetchSubmodules = true;
   };
 
@@ -49,6 +51,7 @@ stdenv.mkDerivation rec {
     at-spi2-core
     cairo
     dbus
+    eigen
     freetype
     fontconfig
     glew
@@ -60,6 +63,7 @@ stdenv.mkDerivation rec {
     libpng
     libselinux
     libsepol
+    libspnav
     libthai
     libxkbcommon
     pangomm
diff --git a/pkgs/applications/graphics/unigine-heaven/default.nix b/pkgs/applications/graphics/unigine-heaven/default.nix
index 2ce05a52812ef..1677e4d65eef4 100644
--- a/pkgs/applications/graphics/unigine-heaven/default.nix
+++ b/pkgs/applications/graphics/unigine-heaven/default.nix
@@ -100,6 +100,7 @@ stdenv.mkDerivation
     {
       description = "The Unigine Heaven GPU benchmarking tool";
       homepage = "https://benchmark.unigine.com/heaven";
+      sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
       license = lib.licenses.unfree;
       maintainers = [ lib.maintainers.BarinovMaxim ];
       platforms = [ "x86_64-linux" "i686-linux" ];
diff --git a/pkgs/applications/graphics/unigine-sanctuary/default.nix b/pkgs/applications/graphics/unigine-sanctuary/default.nix
index 25d10d6166783..4b3f3ab547c66 100644
--- a/pkgs/applications/graphics/unigine-sanctuary/default.nix
+++ b/pkgs/applications/graphics/unigine-sanctuary/default.nix
@@ -90,6 +90,7 @@ stdenv.mkDerivation rec{
   meta = {
     description = "The Unigine Heaven GPU benchmarking tool";
     homepage = "https://benchmark.unigine.com/sanctuary";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.unfree;
     maintainers = [ lib.maintainers.BarinovMaxim ];
     platforms = [ "x86_64-linux" "i686-linux" ];
diff --git a/pkgs/applications/graphics/unigine-superposition/default.nix b/pkgs/applications/graphics/unigine-superposition/default.nix
index 768089d1a0c4f..b1261bb52f23f 100644
--- a/pkgs/applications/graphics/unigine-superposition/default.nix
+++ b/pkgs/applications/graphics/unigine-superposition/default.nix
@@ -139,6 +139,7 @@ buildFHSUserEnv {
   meta = {
     description = "The Unigine Superposition GPU benchmarking tool";
     homepage = "https://benchmark.unigine.com/superposition";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.unfree;
     maintainers = [ lib.maintainers.BarinovMaxim ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/graphics/unigine-tropics/default.nix b/pkgs/applications/graphics/unigine-tropics/default.nix
index 1057c2fa6cad7..f0d5101b4be02 100644
--- a/pkgs/applications/graphics/unigine-tropics/default.nix
+++ b/pkgs/applications/graphics/unigine-tropics/default.nix
@@ -88,6 +88,7 @@ stdenv.mkDerivation {
   meta = {
     description = "The Unigine Heaven GPU benchmarking tool";
     homepage = "https://benchmark.unigine.com/tropics";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.unfree;
     maintainers = [ lib.maintainers.BarinovMaxim ];
     platforms = [ "x86_64-linux" "i686-linux" ];
diff --git a/pkgs/applications/graphics/unigine-valley/default.nix b/pkgs/applications/graphics/unigine-valley/default.nix
index 9b51373178e44..ee1c9e6c15f89 100644
--- a/pkgs/applications/graphics/unigine-valley/default.nix
+++ b/pkgs/applications/graphics/unigine-valley/default.nix
@@ -128,6 +128,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "The Unigine Valley GPU benchmarking tool";
     homepage = "https://unigine.com/products/benchmarks/valley/";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.unfree; # see also: $out/$instPath/documentation/License.pdf
     maintainers = [ lib.maintainers.kierdavis ];
     platforms = [ "x86_64-linux" "i686-linux" ];
diff --git a/pkgs/applications/graphics/vengi-tools/default.nix b/pkgs/applications/graphics/vengi-tools/default.nix
index eb5033a4a97c4..fb44d36f62a6d 100644
--- a/pkgs/applications/graphics/vengi-tools/default.nix
+++ b/pkgs/applications/graphics/vengi-tools/default.nix
@@ -29,13 +29,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vengi-tools";
-  version = "0.0.18";
+  version = "0.0.20";
 
   src = fetchFromGitHub {
     owner = "mgerhardy";
     repo = "vengi";
     rev = "v${version}";
-    sha256 = "sha256-Ur1X5FhOa87jbjWBXievBfCHW+qP/8bqLiyKAC8+KU4=";
+    sha256 = "sha256-WsG6mjO90QQNsAarxdupZvXubdy06JjQmVYUzygl8l4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/graphics/write_stylus/default.nix b/pkgs/applications/graphics/write_stylus/default.nix
index ca8cebb2ec0c6..be20635c50018 100644
--- a/pkgs/applications/graphics/write_stylus/default.nix
+++ b/pkgs/applications/graphics/write_stylus/default.nix
@@ -54,6 +54,7 @@ mkDerivation rec {
   meta = with lib; {
     homepage = "http://www.styluslabs.com/";
     description = "Write is a word processor for handwriting";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     platforms = platforms.linux;
     license = lib.licenses.unfree;
     maintainers = with maintainers; [ oyren ];
diff --git a/pkgs/applications/misc/1password-gui/beta.nix b/pkgs/applications/misc/1password-gui/beta.nix
index 306a914dc19eb..9f0d9d62e053b 100644
--- a/pkgs/applications/misc/1password-gui/beta.nix
+++ b/pkgs/applications/misc/1password-gui/beta.nix
@@ -129,6 +129,7 @@ in stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Multi-platform password manager";
     homepage = "https://1password.com/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     maintainers = with maintainers; [ timstott savannidgerinel maxeaubrey sebtm ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/misc/1password-gui/default.nix b/pkgs/applications/misc/1password-gui/default.nix
index 7ffc4a5fc7fac..e39450e5bef07 100644
--- a/pkgs/applications/misc/1password-gui/default.nix
+++ b/pkgs/applications/misc/1password-gui/default.nix
@@ -131,6 +131,7 @@ in stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Multi-platform password manager";
     homepage = "https://1password.com/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     maintainers = with maintainers; [ timstott savannidgerinel maxeaubrey sebtm ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/misc/1password/default.nix b/pkgs/applications/misc/1password/default.nix
index 6231e62bc2dcb..0d18b3dd37a3e 100644
--- a/pkgs/applications/misc/1password/default.nix
+++ b/pkgs/applications/misc/1password/default.nix
@@ -12,12 +12,12 @@ let
     if extension == "zip" then fetchzip args else fetchurl args;
 
   pname = "1password-cli";
-  version = "2.4.1";
+  version = "2.5.1";
   sources = rec {
-    aarch64-linux = fetch "linux_arm64" "sha256-ANRYE1BoezrcDxZrQYp/OPdtn4J+FmC/PLSIP5Amm18=" "zip";
-    i686-linux = fetch "linux_386" "sha256-w3anr76uj/Z+ilZ+LUGOB1CoKkvxcD+v8c8lVADPwRY=" "zip";
-    x86_64-linux = fetch "linux_amd64" "sha256-axZ+XDIMJlAicnYTIXgcaoT+Zcg6xvHlchl/ng7V9GY=" "zip";
-    aarch64-darwin = fetch "apple_universal" "sha256-/DnrQ4fwbc2ELtsEClvzA9kTrse3pMgGLbhiKZ3gphA=" "pkg";
+    aarch64-linux = fetch "linux_arm64" "sha256-HZ6AVheJrw9ZR9HGWbB6/kCzbrfYcwApa2z18tDBo1k=" "zip";
+    i686-linux = fetch "linux_386" "sha256-aG6oW0epF+P9pSWMlTStSbBynBDkGX1B+0NHUnwLRhs=" "zip";
+    x86_64-linux = fetch "linux_amd64" "sha256-7GkBVcvXM/WZiXEiIbYh9lS0f4BS4Hc4RCVjr8FoW8A=" "zip";
+    aarch64-darwin = fetch "apple_universal" "sha256-XebD33fX15RsFUdbV+DvMRIi1MSyMfIRC3JOwcmi8kk=" "pkg";
     x86_64-darwin = aarch64-darwin;
   };
   platforms = builtins.attrNames sources;
@@ -48,6 +48,7 @@ stdenv.mkDerivation {
   '';
 
   postInstall = ''
+    HOME=$TMPDIR
     installShellCompletion --cmd ${mainProgram} \
       --bash <($out/bin/${mainProgram} completion bash) \
       --fish <($out/bin/${mainProgram} completion fish) \
@@ -67,6 +68,7 @@ stdenv.mkDerivation {
     homepage = "https://developer.1password.com/docs/cli/";
     downloadPage = "https://app-updates.agilebits.com/product_history/CLI2";
     maintainers = with maintainers; [ joelburget marsam ];
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     inherit mainProgram platforms;
   };
diff --git a/pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix b/pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix
index bbe37b5ed743b..fdd2970fdac7b 100644
--- a/pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix
+++ b/pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix
@@ -27,7 +27,8 @@ in
     postInstall = ''
       patchShebangs node_modules/
       npm run build
-      ln -s $out/lib/node_modules/asf-ui/dist $out/lib/dist
+      cp -r $out/lib/node_modules/asf-ui/dist $out/lib/dist
+      rm -rf $out/lib/node_modules/
     '';
 
     meta = with lib; {
diff --git a/pkgs/applications/misc/adobe-reader/default.nix b/pkgs/applications/misc/adobe-reader/default.nix
index 2bce30365f08c..1a164f578a016 100644
--- a/pkgs/applications/misc/adobe-reader/default.nix
+++ b/pkgs/applications/misc/adobe-reader/default.nix
@@ -34,6 +34,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Adobe Reader, a viewer for PDF documents";
     homepage = "http://www.adobe.com/products/reader";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.unfree;
     knownVulnerabilities = [
       "Numerous unresolved vulnerabilities"
diff --git a/pkgs/applications/misc/anytype/default.nix b/pkgs/applications/misc/anytype/default.nix
index 07cbee42694d9..6e28c58798e79 100644
--- a/pkgs/applications/misc/anytype/default.nix
+++ b/pkgs/applications/misc/anytype/default.nix
@@ -2,13 +2,13 @@
 
 let
   pname = "anytype";
-  version = "0.25.4";
+  version = "0.26.1";
   name = "Anytype-${version}";
   nameExecutable = pname;
   src = fetchurl {
     url = "https://at9412003.fra1.digitaloceanspaces.com/Anytype-${version}.AppImage";
     name = "Anytype-${version}.AppImage";
-    sha256 = "sha256-v6Zecv/m1GvPJk/SmLlxHFyeYbNbIB+x17+AKCI45AM=";
+    sha256 = "sha256-lPzeYZzerFa0T77uaavvBQkMn4PUEfVj4SPlErqM9DI=";
   };
   appimageContents = appimageTools.extractType2 { inherit name src; };
 in
diff --git a/pkgs/applications/misc/authy/default.nix b/pkgs/applications/misc/authy/default.nix
index c448b86d0c4d0..ca243f4437071 100644
--- a/pkgs/applications/misc/authy/default.nix
+++ b/pkgs/applications/misc/authy/default.nix
@@ -59,6 +59,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://www.authy.com";
     description = "Twilio Authy two factor authentication desktop application";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     maintainers = with maintainers; [ iammrinal0 ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/misc/azuredatastudio/default.nix b/pkgs/applications/misc/azuredatastudio/default.nix
index aa7150bb6b0b5..0261f983ac79d 100644
--- a/pkgs/applications/misc/azuredatastudio/default.nix
+++ b/pkgs/applications/misc/azuredatastudio/default.nix
@@ -166,6 +166,7 @@ stdenv.mkDerivation rec {
     maintainers = with lib.maintainers; [ xavierzwirtz ];
     description = "A data management tool that enables working with SQL Server, Azure SQL DB and SQL DW";
     homepage = "https://docs.microsoft.com/en-us/sql/azure-data-studio/download-azure-data-studio";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.unfreeRedistributable;
     platforms = [ "x86_64-linux" ];
   };
diff --git a/pkgs/applications/misc/binance/default.nix b/pkgs/applications/misc/binance/default.nix
index d5d6f6b5358ea..15e3c51e9ad4c 100644
--- a/pkgs/applications/misc/binance/default.nix
+++ b/pkgs/applications/misc/binance/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "binance";
-  version = "1.35.0";
+  version = "1.36.0";
 
   src = fetchurl {
     url = "https://github.com/binance/desktop/releases/download/v${version}/${pname}-${version}-amd64-linux.deb";
-    sha256 = "sha256-6c7nrdViunnvPqqbt5/LQp2iS4EgZOCQ9PLcG+bY1YQ=";
+    sha256 = "sha256-Q1cvEQ/yxytzrPfiyeTZSCPecnmSdhy+ds/gtie4vwo=";
   };
 
   nativeBuildInputs = [
@@ -48,6 +48,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Binance Cryptoexchange Official Desktop Client";
     homepage = "https://www.binance.com/en/desktop-download";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     maintainers = with maintainers; [ wolfangaukang ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/misc/confclerk/default.nix b/pkgs/applications/misc/confclerk/default.nix
index fb89d2a7e373d..84095c4165417 100644
--- a/pkgs/applications/misc/confclerk/default.nix
+++ b/pkgs/applications/misc/confclerk/default.nix
@@ -1,22 +1,20 @@
-{ lib, stdenv, fetchurl, qt4, qmake4Hook }:
+{ lib, mkDerivation, fetchurl, qtbase, qmake }:
 
-let version = "0.6.4"; in
-stdenv.mkDerivation {
+mkDerivation rec {
   pname = "confclerk";
-  inherit version;
+  version = "0.7.1";
 
   src = fetchurl {
     url = "https://www.toastfreeware.priv.at/tarballs/confclerk/confclerk-${version}.tar.gz";
-    sha256 = "10rhg44px4nvbkd3p341cmp2ds43jn8r4rvgladda9v8zmsgr2b3";
+    sha256 = "0l5i4d6lymh0k6gzihs41x4i8v1dz0mrwpga096af0vchpvlcarg";
   };
 
-  buildInputs = [ qt4 ];
+  buildInputs = [ qtbase ];
+  nativeBuildInputs = [ qmake ];
 
-  nativeBuildInputs = [ qmake4Hook ];
-
-  installPhase = ''
+  postInstall = ''
     mkdir -p $out/bin
-    cp src/bin/confclerk $out/bin
+    mv $out/confclerk $out/bin/
   '';
 
   meta = {
diff --git a/pkgs/applications/misc/dbeaver/default.nix b/pkgs/applications/misc/dbeaver/default.nix
index 3f54826fc52af..abde33b730c03 100644
--- a/pkgs/applications/misc/dbeaver/default.nix
+++ b/pkgs/applications/misc/dbeaver/default.nix
@@ -127,6 +127,10 @@
       PostgreSQL, MariaDB, SQLite, Oracle, DB2, SQL Server, Sybase, MS Access,
       Teradata, Firebird, Derby, etc.
     '';
+    sourceProvenance = with sourceTypes; [
+      fromSource
+      binaryBytecode  # dependencies from maven
+    ];
     license = licenses.asl20;
     platforms = [ "x86_64-linux" "x86_64-darwin" "aarch64-linux" "aarch64-darwin" ];
     maintainers = with maintainers; [ jojosch mkg20001 ];
diff --git a/pkgs/applications/misc/debian-goodies/default.nix b/pkgs/applications/misc/debian-goodies/default.nix
index 20d47e204f7cc..560afe32b8a19 100644
--- a/pkgs/applications/misc/debian-goodies/default.nix
+++ b/pkgs/applications/misc/debian-goodies/default.nix
@@ -10,14 +10,14 @@
 
 stdenv.mkDerivation rec {
   pname = "debian-goodies";
-  version = "0.87";
+  version = "0.88";
 
   src = fetchFromGitLab {
     domain = "salsa.debian.org";
     owner = "debian";
     repo = "debian-goodies";
     rev = "debian/${version}";
-    sha256 = "sha256-7O2AY7tWYiOIy4ImFBxWu6S+ljc3VmqS/j4KyEzVVIA=";
+    sha256 = "sha256-SDGWRGwRuryCJSWjuYB+Cg/Pl8q4VP4zcisUOn/GhJY=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/misc/foxitreader/default.nix b/pkgs/applications/misc/foxitreader/default.nix
index b206d14323b1c..c6ed7bc1ad3ff 100644
--- a/pkgs/applications/misc/foxitreader/default.nix
+++ b/pkgs/applications/misc/foxitreader/default.nix
@@ -73,6 +73,7 @@ mkDerivation rec {
   meta = with lib; {
     description = "A viewer for PDF documents";
     homepage = "https://www.foxitsoftware.com/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     platforms = [ "x86_64-linux" ];
     maintainers = with maintainers; [ p-h rhoriguchi ];
diff --git a/pkgs/applications/misc/gometer/default.nix b/pkgs/applications/misc/gometer/default.nix
index 9b335b1aedae4..8c68f8672c3b5 100644
--- a/pkgs/applications/misc/gometer/default.nix
+++ b/pkgs/applications/misc/gometer/default.nix
@@ -41,6 +41,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Analytic-Tracking tool for GoLance";
     homepage = "https://golance.com/download-gometer";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     maintainers = with maintainers; [ wolfangaukang ];
   };
diff --git a/pkgs/applications/misc/googleearth-pro/default.nix b/pkgs/applications/misc/googleearth-pro/default.nix
index 950cb236ecbfa..dd6964318e77d 100644
--- a/pkgs/applications/misc/googleearth-pro/default.nix
+++ b/pkgs/applications/misc/googleearth-pro/default.nix
@@ -115,6 +115,7 @@ mkDerivation rec {
   meta = with lib; {
     description = "A world sphere viewer";
     homepage = "https://www.google.com/earth/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     maintainers = with maintainers; [ friedelino shamilton ];
     platforms = platforms.linux;
diff --git a/pkgs/applications/misc/hollywood/default.nix b/pkgs/applications/misc/hollywood/default.nix
new file mode 100644
index 0000000000000..f3b721bc49597
--- /dev/null
+++ b/pkgs/applications/misc/hollywood/default.nix
@@ -0,0 +1,94 @@
+{ stdenv
+, fetchFromGitHub
+, makeWrapper
+, lib
+, coreutils
+, apg
+, atop
+, bmon
+, cmatrix
+, pygments
+, moreutils
+, util-linux
+, jp2a
+, man
+, mplayer
+, openssh
+, tree
+, mlocate
+, findutils
+, ccze
+, ncurses
+, python3
+, wget
+, libcaca
+, newsboat
+, rsstail
+, w3m
+, ticker
+, tmux
+}:
+
+stdenv.mkDerivation {
+  pname = "hollywood";
+  version = "1.22";
+
+  src = fetchFromGitHub {
+    owner = "dustinkirkland";
+    repo = "hollywood";
+    rev = "35275a68c37bbc39d8b2b0e4664a0c2f5451e5f6";
+    sha256 = "sha256-faIm1uXERvIDZ6SK6uarVkWGNJskAroHgq5Cg7nUZc4=";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  patches = [ ./nixos-paths.patch ];
+  postPatch = ''
+    rm lib/hollywood/speedometer
+    rm bin/wallstreet
+    rm -r lib/wallstreet
+  '';
+
+  dontBuild = true;
+
+  installPhase =
+    let pathDeps = [
+      tmux
+      coreutils
+      ncurses
+      jp2a
+      mlocate
+      apg
+      atop
+      bmon
+      cmatrix
+      pygments
+      moreutils
+      util-linux
+      jp2a
+      man
+      mplayer
+      openssh
+      tree
+      findutils
+      ccze
+    ];
+    in ''
+      runHook preInstall
+
+      mkdir -p $out
+      cp -r bin $out/bin
+      cp -r lib $out/lib
+      cp -r share $out/share
+      wrapProgram $out/bin/hollywood --prefix PATH : ${lib.makeBinPath pathDeps}
+
+      runHook postInstall
+    '';
+
+  meta = {
+    description = "Fill your console with Hollywood melodrama technobabble";
+    homepage = "https://a.hollywood.computer/";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.anselmschueler ];
+  };
+}
diff --git a/pkgs/applications/misc/hollywood/nixos-paths.patch b/pkgs/applications/misc/hollywood/nixos-paths.patch
new file mode 100644
index 0000000000000..d280a6b003c1e
--- /dev/null
+++ b/pkgs/applications/misc/hollywood/nixos-paths.patch
@@ -0,0 +1,67 @@
+diff --git a/bin/hollywood b/bin/hollywood
+index 6f1ee68..09bc4ea 100755
+--- a/bin/hollywood
++++ b/bin/hollywood
+@@ -74,7 +74,7 @@ if [ -z "$TMUX" ]; then
+ 	else
+ 		tmux_launcher=tmux
+ 	fi
+-	$tmux_launcher new-session -d -s $PKG "/bin/bash"
++	$tmux_launcher new-session -d -s $PKG "/usr/bin/env bash"
+ 	$tmux_launcher send-keys -t $PKG "$0 $1"
+ 	$tmux_launcher send-keys -t $PKG Enter
+ 	exec $tmux_launcher attach-session -t $PKG
+diff --git a/lib/hollywood/code b/lib/hollywood/code
+index 532ce73..3448447 100755
+--- a/lib/hollywood/code
++++ b/lib/hollywood/code
+@@ -19,7 +19,7 @@ command -v view >/dev/null 2>&1 || exit 1
+ 
+ trap "pkill -f -9 lib/hollywood/ >/dev/null 2>&1; exit" INT
+ while true; do
+-	FILES=$(locate -l 4096 "/usr/*.java" "/usr/*.c" "/usr/*.cpp" 2>/dev/null | sort -R)
++	FILES=$(locate -l 4096 "/usr/*.java" "/run/current-system/sw/*.java" "/usr/*.c" "/run/current-system/sw/*.c" "/usr/*.cpp" "/run/current-system/sw/*.cpp" 2>/dev/null | sort -R)
+ 	for f in $FILES; do
+ 		[ -r "$f" ] || continue
+ 		[ -s "$f" ] || continue
+diff --git a/lib/hollywood/hexdump b/lib/hollywood/hexdump
+index f2fb0bd..db059f5 100755
+--- a/lib/hollywood/hexdump
++++ b/lib/hollywood/hexdump
+@@ -19,8 +19,8 @@ command -v ccze >/dev/null 2>&1 || exit 1
+ 
+ trap "pkill -f -9 lib/hollywood/ >/dev/null 2>&1; exit" INT
+ while true; do
+-	for f in $(ls /usr/bin/ | sort -R); do
+-		head -c 4096 "/usr/bin/$f" | hexdump -C | ccze -A -c default=green -c dir="bold green"
++	for f in $(find /usr/bin/ /run/current-system/sw/bin/ | sort -R); do
++		head -c 4096 "$f" | hexdump -C | ccze -A -c default=green -c dir="bold green"
+ 		sleep 0.7
+ 	done
+ done
+diff --git a/lib/hollywood/jp2a b/lib/hollywood/jp2a
+index e87b950..6541f80 100755
+--- a/lib/hollywood/jp2a
++++ b/lib/hollywood/jp2a
+@@ -19,7 +19,7 @@ command -v jp2a >/dev/null 2>&1 || exit 1
+ 
+ trap "pkill -f -9 lib/hollywood/ >/dev/null 2>&1; exit" INT
+ while true; do
+-	FILES=$(locate -l 4096 "/usr/*jpg" 2>/dev/null | sort -R)
++	FILES=$(locate -l 4096 "/usr/*jpg" "/run/current-system/sw/*jpg" 2>/dev/null | sort -R)
+ 	for f in $FILES; do
+ 		[ -r "$f" ] || continue
+ 		[ -s "$f" ] || continue
+diff --git a/lib/hollywood/man b/lib/hollywood/man
+index 2d42513..f4d8bbb 100755
+--- a/lib/hollywood/man
++++ b/lib/hollywood/man
+@@ -19,7 +19,7 @@ command -v ccze >/dev/null 2>&1 || exit 1
+ 
+ trap "pkill -f -9 lib/hollywood/ >/dev/null 2>&1; exit" INT
+ while true; do
+-	FILES=$(ls /usr/share/man/man1/ | sort -R | sed "s/\.1\.gz.*$//" | head -n 4096)
++	FILES=$(ls /usr/share/man/man1/ /run/current-system/sw/share/man/man1/ | sort -R | sed "s/\.1\.gz.*$//" | head -n 4096)
+ 	for f in $FILES; do
+ 		man "$f" | ccze -A
+ 		sleep 0.2
diff --git a/pkgs/applications/misc/hubstaff/default.nix b/pkgs/applications/misc/hubstaff/default.nix
index 44169f6a539e2..390f756beb101 100644
--- a/pkgs/applications/misc/hubstaff/default.nix
+++ b/pkgs/applications/misc/hubstaff/default.nix
@@ -70,6 +70,7 @@ stdenv.mkDerivation {
   meta = with lib; {
     description = "Time tracking software";
     homepage = "https://hubstaff.com/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     platforms = [ "x86_64-linux" ];
     maintainers = with maintainers; [ michalrus srghma ];
diff --git a/pkgs/applications/misc/icesl/default.nix b/pkgs/applications/misc/icesl/default.nix
index ae049699121ed..1a079ab8274c3 100644
--- a/pkgs/applications/misc/icesl/default.nix
+++ b/pkgs/applications/misc/icesl/default.nix
@@ -37,6 +37,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "GPU-accelerated procedural modeler and slicer for 3D printing";
     homepage = "https://icesl.loria.fr/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.inria-icesl;
     platforms = [ "i686-linux" "x86_64-linux" ];
     maintainers = with maintainers; [ mgttlinger ];
diff --git a/pkgs/applications/misc/ideamaker/default.nix b/pkgs/applications/misc/ideamaker/default.nix
index 1e20a0d6faf04..619a821a32c69 100644
--- a/pkgs/applications/misc/ideamaker/default.nix
+++ b/pkgs/applications/misc/ideamaker/default.nix
@@ -70,6 +70,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://www.raise3d.com/ideamaker/";
     description = "Raise3D's 3D slicer software";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     platforms = [ "x86_64-linux" ];
     maintainers = with maintainers; [ lovesegfault ];
diff --git a/pkgs/applications/misc/ipmicfg/default.nix b/pkgs/applications/misc/ipmicfg/default.nix
index 120affb988c01..ecad4bd9821b0 100644
--- a/pkgs/applications/misc/ipmicfg/default.nix
+++ b/pkgs/applications/misc/ipmicfg/default.nix
@@ -27,6 +27,7 @@ stdenv.mkDerivation rec {
    meta = with lib; {
      description = "Supermicro IPMI configuration tool";
      homepage = "http://www.supermicro.com/products/nfo/ipmi.cfm";
+     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
      license = licenses.unfree;
      platforms = [ "x86_64-linux" ];
      maintainers = with maintainers; [ sorki ];
diff --git a/pkgs/applications/misc/ipmiview/default.nix b/pkgs/applications/misc/ipmiview/default.nix
index 579890c78ba3e..fbc436c882cfc 100644
--- a/pkgs/applications/misc/ipmiview/default.nix
+++ b/pkgs/applications/misc/ipmiview/default.nix
@@ -72,7 +72,10 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    sourceProvenance = with sourceTypes; [ binaryBytecode ];
+    sourceProvenance = with sourceTypes; [
+      binaryBytecode
+      binaryNativeCode
+    ];
     license = licenses.unfree;
     maintainers = with maintainers; [ vlaci ];
     platforms = [ "x86_64-linux" "i686-linux" ];
diff --git a/pkgs/applications/misc/join-desktop/default.nix b/pkgs/applications/misc/join-desktop/default.nix
index 0b09911ddb24b..369aae0386336 100644
--- a/pkgs/applications/misc/join-desktop/default.nix
+++ b/pkgs/applications/misc/join-desktop/default.nix
@@ -64,6 +64,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://github.com/joaomgcd/JoinDesktop/";
     description = "Desktop app for Join";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     # on https://joaoapps.com/join/desktop/ "Join Desktop is an open source app" but no license
     license = licenses.free;
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/misc/josm/default.nix b/pkgs/applications/misc/josm/default.nix
index 67807887ec615..d35a526dfdb3b 100644
--- a/pkgs/applications/misc/josm/default.nix
+++ b/pkgs/applications/misc/josm/default.nix
@@ -3,15 +3,15 @@
 }:
 let
   pname = "josm";
-  version = "18427";
+  version = "18463";
   srcs = {
     jar = fetchurl {
       url = "https://josm.openstreetmap.de/download/josm-snapshot-${version}.jar";
-      sha256 = "sha256-SsoeKfpWi41sd77LfaQW0OcHnyf8iLolKWF74dhalpY=";
+      sha256 = "sha256-++8XtzAykJ+85Kvzy3xgaZoKaVlJwz+Ct1xb/QkC1Gc=";
     };
     macosx = fetchurl {
       url = "https://josm.openstreetmap.de/download/macosx/josm-macos-${version}-java17.zip";
-      sha256 = "sha256-cz3OT03StvJy9XYBiPxx+nz36O0cg+XrL/uc52/G/1c=";
+      sha256 = "sha256-n7GlUWYOAXw4G59SBsO8HZ1OaiUWwzOsiURPFBYq31E=";
     };
     pkg = fetchsvn {
       url = "https://josm.openstreetmap.de/svn/trunk/native/linux/tested";
diff --git a/pkgs/applications/misc/jotta-cli/default.nix b/pkgs/applications/misc/jotta-cli/default.nix
index b50bc7e561147..64044693203e7 100644
--- a/pkgs/applications/misc/jotta-cli/default.nix
+++ b/pkgs/applications/misc/jotta-cli/default.nix
@@ -28,6 +28,7 @@ stdenv.mkDerivation rec {
     homepage     = "https://www.jottacloud.com/";
     downloadPage = "https://repo.jotta.us/archives/linux/";
     maintainers  = with maintainers; [ evenbrenden ];
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license      = licenses.unfree;
     platforms    = [ "x86_64-linux" ];
   };
diff --git a/pkgs/applications/misc/kdbplus/default.nix b/pkgs/applications/misc/kdbplus/default.nix
index 8ee8337bea2a9..05d1c98e56ac8 100644
--- a/pkgs/applications/misc/kdbplus/default.nix
+++ b/pkgs/applications/misc/kdbplus/default.nix
@@ -68,6 +68,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Analytics and time-series database";
     homepage    = "http://www.kx.com/";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license     = lib.licenses.unfree;
     platforms   = [ "i686-linux" ];
     maintainers = [ lib.maintainers.thoughtpolice ];
diff --git a/pkgs/applications/misc/koreader/default.nix b/pkgs/applications/misc/koreader/default.nix
index e2480dd18bded..b428690b7a403 100644
--- a/pkgs/applications/misc/koreader/default.nix
+++ b/pkgs/applications/misc/koreader/default.nix
@@ -56,6 +56,7 @@ in stdenv.mkDerivation rec {
     homepage = "https://github.com/koreader/koreader";
     description =
       "An ebook reader application supporting PDF, DjVu, EPUB, FB2 and many more formats, running on Cervantes, Kindle, Kobo, PocketBook and Android devices";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     platforms = intersectLists platforms.x86_64 platforms.linux;
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ contrun neonfuz];
diff --git a/pkgs/applications/misc/masterpdfeditor/default.nix b/pkgs/applications/misc/masterpdfeditor/default.nix
index 68453252ba539..de131b7ce63f0 100644
--- a/pkgs/applications/misc/masterpdfeditor/default.nix
+++ b/pkgs/applications/misc/masterpdfeditor/default.nix
@@ -39,6 +39,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Master PDF Editor";
     homepage = "https://code-industry.net/free-pdf-editor/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfreeRedistributable;
     platforms = with platforms; [ "x86_64-linux" ];
     maintainers = with maintainers; [ cmcdragonkai ];
diff --git a/pkgs/applications/misc/masterpdfeditor4/default.nix b/pkgs/applications/misc/masterpdfeditor4/default.nix
index b4b9a4d624469..befb11a0a48b3 100644
--- a/pkgs/applications/misc/masterpdfeditor4/default.nix
+++ b/pkgs/applications/misc/masterpdfeditor4/default.nix
@@ -37,6 +37,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Master PDF Editor - version 4, without watermark";
     homepage = "https://code-industry.net/free-pdf-editor/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfreeRedistributable;
     platforms = with platforms; [ "x86_64-linux" ];
   };
diff --git a/pkgs/applications/misc/megacmd/default.nix b/pkgs/applications/misc/megacmd/default.nix
index afdfc6c905e04..2d5b6ee8f2ae6 100644
--- a/pkgs/applications/misc/megacmd/default.nix
+++ b/pkgs/applications/misc/megacmd/default.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "megacmd";
-  version = "1.5.0c";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "meganz";
     repo = "MEGAcmd";
     rev = "${version}_Linux";
-    sha256 = "sha256-JHuGkf6TBOZMvoP7Izm5/T9AWxyjaqrxR99x4bm7tVE=";
+    sha256 = "sha256-qOXw/KGt3DyWQGBe/pbMujQITCMItHobxuK+1r00ZIs=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/misc/mystem/default.nix b/pkgs/applications/misc/mystem/default.nix
index 62c1834d26ad7..198d170bd89ca 100644
--- a/pkgs/applications/misc/mystem/default.nix
+++ b/pkgs/applications/misc/mystem/default.nix
@@ -19,6 +19,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Morphological analysis of Russian text";
     homepage = "https://yandex.ru/dev/mystem/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfreeRedistributable;
     maintainers = with maintainers; [ abbradar ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/misc/octoprint/plugins.nix b/pkgs/applications/misc/octoprint/plugins.nix
index ae82d4023247d..822f2c13cbeae 100644
--- a/pkgs/applications/misc/octoprint/plugins.nix
+++ b/pkgs/applications/misc/octoprint/plugins.nix
@@ -311,8 +311,8 @@ in
     src = fetchFromGitHub {
       owner = "jneilliii";
       repo = "OctoPrint-STLViewer";
-      rev = version;
-      sha256 = "0mkvh44fn2ch4z2avsdjwi1rp353ylmk9j5fln4x7rx8ph8y7g2b";
+      rev = "refs/tags/${version}";
+      sha256 = "sha256-S7zjEbyo59OJpa7INCv1o4ybQ+Sy6a3EJ5AJ6wiBe1Y=";
     };
 
     meta = with lib; {
diff --git a/pkgs/applications/misc/organicmaps/default.nix b/pkgs/applications/misc/organicmaps/default.nix
index 0930edbd4158b..c44fc41a5c650 100644
--- a/pkgs/applications/misc/organicmaps/default.nix
+++ b/pkgs/applications/misc/organicmaps/default.nix
@@ -8,7 +8,6 @@
 , which
 , python3
 , rsync
-, makeWrapper
 , qtbase
 , qtsvg
 , libGLU
@@ -20,13 +19,13 @@
 
 mkDerivation rec {
   pname = "organicmaps";
-  version = "2022.05.31-10";
+  version = "2022.06.18-2";
 
   src = fetchFromGitHub {
     owner = "organicmaps";
     repo = "organicmaps";
     rev = "${version}-android";
-    sha256 = "sha256-2GeWa4CQoY7hi24q0/cZBbq1Ofl2Jane9BiZ0N+IsSc=";
+    sha256 = "sha256-FlytRGiqGr9L5ZwL1slbPjagJKsleOXM8+loPmtfccI=";
     fetchSubmodules = true;
   };
 
@@ -45,7 +44,6 @@ mkDerivation rec {
     which
     python3
     rsync
-    makeWrapper
   ];
 
   # Most dependencies are vendored
@@ -64,16 +62,6 @@ mkDerivation rec {
     bash ./configure.sh
   '';
 
-  # Tell the program that the read-only and the read-write data locations
-  # are different, and create the read-write one.
-  # https://github.com/organicmaps/organicmaps/issues/2387
-  postInstall = ''
-    wrapProgram $out/bin/OMaps \
-      --add-flags "-resources_path $out/share/organicmaps/data" \
-      --add-flags '-data_path "''${XDG_DATA_HOME:-''${HOME}/.local/share}/OMaps"' \
-      --run 'mkdir -p "''${XDG_DATA_HOME:-''${HOME}/.local/share}/OMaps"'
-  '';
-
   meta = with lib; {
     # darwin: "invalid application of 'sizeof' to a function type"
     broken = (stdenv.isLinux && stdenv.isAarch64) || stdenv.isDarwin;
diff --git a/pkgs/applications/misc/pdfsam-basic/default.nix b/pkgs/applications/misc/pdfsam-basic/default.nix
index 745796098e8cc..e4626ef3c947c 100644
--- a/pkgs/applications/misc/pdfsam-basic/default.nix
+++ b/pkgs/applications/misc/pdfsam-basic/default.nix
@@ -42,6 +42,10 @@ stdenv.mkDerivation rec {
   meta = with lib; {
       homepage = "https://github.com/torakiki/pdfsam";
       description = "Multi-platform software designed to extract pages, split, merge, mix and rotate PDF files";
+      sourceProvenance = with sourceTypes; [
+        binaryBytecode
+        binaryNativeCode
+      ];
       license = licenses.agpl3;
       platforms = platforms.all;
       maintainers = with maintainers; [ _1000101 ];
diff --git a/pkgs/applications/misc/pdfstudio/common.nix b/pkgs/applications/misc/pdfstudio/common.nix
index 8c034d6636b32..047d9e4190fcb 100644
--- a/pkgs/applications/misc/pdfstudio/common.nix
+++ b/pkgs/applications/misc/pdfstudio/common.nix
@@ -88,6 +88,10 @@ buildFHSUserEnv {
     homepage = "https://www.qoppa.com/${pname}/";
     description = "An easy to use, full-featured PDF editing software";
     longDescription = longDescription;
+    sourceProvenance = with sourceTypes; [
+      binaryBytecode
+      binaryNativeCode
+    ];
     license = licenses.unfree;
     platforms = platforms.linux;
     mainProgram = pname;
diff --git a/pkgs/applications/misc/playonlinux/default.nix b/pkgs/applications/misc/playonlinux/default.nix
index 58d45d19bee58..669f25e1509eb 100644
--- a/pkgs/applications/misc/playonlinux/default.nix
+++ b/pkgs/applications/misc/playonlinux/default.nix
@@ -142,6 +142,7 @@ in stdenv.mkDerivation {
   meta = with lib; {
     description = "GUI for managing Windows programs under linux";
     homepage = "https://www.playonlinux.com/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.gpl3;
     maintainers = [ maintainers.pasqui23 ];
     platforms = [ "x86_64-linux" "i686-linux" ];
diff --git a/pkgs/applications/misc/polar-bookshelf/default.nix b/pkgs/applications/misc/polar-bookshelf/default.nix
index 8fcd9e1a04fe9..1c286d611e6be 100644
--- a/pkgs/applications/misc/polar-bookshelf/default.nix
+++ b/pkgs/applications/misc/polar-bookshelf/default.nix
@@ -122,6 +122,7 @@ stdenv.mkDerivation rec {
   meta = {
     homepage = "https://getpolarized.io/";
     description = "Personal knowledge repository for PDF and web content supporting incremental reading and document annotation";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.gpl3Only;
     platforms = lib.platforms.linux;
     maintainers = [ lib.maintainers.noneucat ];
diff --git a/pkgs/applications/misc/premid/default.nix b/pkgs/applications/misc/premid/default.nix
index d2b8663d24531..3fe8c64f20be5 100644
--- a/pkgs/applications/misc/premid/default.nix
+++ b/pkgs/applications/misc/premid/default.nix
@@ -85,6 +85,7 @@ stdenv.mkDerivation rec {
     description = "A simple, configurable utility to show your web activity as playing status on Discord";
     homepage = "https://premid.app";
     downloadPage = "https://premid.app/downloads";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.mpl20;
     maintainers = with maintainers; [ natto1784 ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/misc/prusa-slicer/default.nix b/pkgs/applications/misc/prusa-slicer/default.nix
index 1488538cc55ed..679b77157cd05 100644
--- a/pkgs/applications/misc/prusa-slicer/default.nix
+++ b/pkgs/applications/misc/prusa-slicer/default.nix
@@ -1,8 +1,39 @@
-{ stdenv, lib, fetchFromGitHub, cmake, copyDesktopItems, makeDesktopItem
-, pkg-config, wrapGAppsHook, boost, cereal, cgal_5, curl, dbus, eigen, expat
-, glew, glib, gmp, gtest, gtk3, hicolor-icon-theme, ilmbase, libpng, mpfr, nlopt
-, openvdb, pcre, qhull, systemd, tbb, wxGTK31-gtk3, xorg, fetchpatch
-, wxGTK31-gtk3-override ? null }:
+{ stdenv
+, lib
+, binutils
+, fetchFromGitHub
+, cmake
+, copyDesktopItems
+, makeDesktopItem
+, pkg-config
+, wrapGAppsHook
+, boost
+, cereal
+, cgal_5
+, curl
+, dbus
+, eigen
+, expat
+, glew
+, glib
+, gmp
+, gtest
+, gtk3
+, hicolor-icon-theme
+, ilmbase
+, libpng
+, mpfr
+, nlopt
+, openvdb
+, pcre
+, qhull
+, systemd
+, tbb
+, wxGTK31-gtk3
+, xorg
+, fetchpatch
+, wxGTK31-gtk3-override ? null
+}:
 let
   wxGTK31-gtk3-prusa = wxGTK31-gtk3.overrideAttrs (old: rec {
     pname = "wxwidgets-prusa3d-patched";
@@ -16,7 +47,8 @@ let
     };
   });
   wxGTK31-gtk3-override' = if wxGTK31-gtk3-override == null then wxGTK31-gtk3-prusa else wxGTK31-gtk3-override;
-in stdenv.mkDerivation rec {
+in
+stdenv.mkDerivation rec {
   pname = "prusa-slicer";
   version = "2.4.2";
 
@@ -28,6 +60,7 @@ in stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
+    binutils
     boost
     cereal
     cgal_5
@@ -58,6 +91,16 @@ in stdenv.mkDerivation rec {
       url = "https://github.com/prusa3d/PrusaSlicer/commit/76f4d6fa98bda633694b30a6e16d58665a634680.patch";
       sha256 = "1r806ycp704ckwzgrw1940hh1l6fpz0k1ww3p37jdk6mygv53nv6";
     })
+    # Fix compile error with boost 1.79. See https://github.com/prusa3d/PrusaSlicer/issues/8238
+    # Can be removed with the next version update
+    (fetchpatch {
+      url = "https://github.com/prusa3d/PrusaSlicer/commit/408e56f0390f20aaf793e0aa0c70c4d9544401d4.patch";
+      sha256 = "sha256-vzEPjLE3Yy5szawPn2Yp3i7MceWewpdnLUPVu9+H3W8=";
+    })
+    (fetchpatch {
+      url = "https://github.com/prusa3d/PrusaSlicer/commit/926ae0471800abd1e5335e251a5934570eb8f6ff.patch";
+      sha256 = "sha256-tAEgubeGGKFWY7r7p/6pmI2HXUGKi2TM1X5ILVZVT20=";
+    })
   ];
 
   doCheck = true;
diff --git a/pkgs/applications/misc/rescuetime/default.nix b/pkgs/applications/misc/rescuetime/default.nix
index 69f0b26b9ec41..273b2d6046ed8 100644
--- a/pkgs/applications/misc/rescuetime/default.nix
+++ b/pkgs/applications/misc/rescuetime/default.nix
@@ -53,6 +53,7 @@ in mkDerivation rec {
     description = "Helps you understand your daily habits so you can focus and be more productive";
     homepage    = "https://www.rescuetime.com";
     maintainers = with maintainers; [ cstrahan ];
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license     = licenses.unfree;
     platforms   = [ "i686-linux" "x86_64-linux" ];
   };
diff --git a/pkgs/applications/misc/robo3t/default.nix b/pkgs/applications/misc/robo3t/default.nix
index 81219fc752697..ae32aac267e17 100644
--- a/pkgs/applications/misc/robo3t/default.nix
+++ b/pkgs/applications/misc/robo3t/default.nix
@@ -91,6 +91,7 @@ stdenv.mkDerivation rec {
     homepage = "https://robomongo.org/";
     description = "Query GUI for mongodb. Formerly called Robomongo";
     platforms = [ "x86_64-linux" ];
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ eperuffo ];
   };
diff --git a/pkgs/applications/misc/sidequest/default.nix b/pkgs/applications/misc/sidequest/default.nix
index e26a40667da9c..23684142a09b4 100644
--- a/pkgs/applications/misc/sidequest/default.nix
+++ b/pkgs/applications/misc/sidequest/default.nix
@@ -48,6 +48,7 @@
         description = "An open app store and side-loading tool for Android-based VR devices such as the Oculus Go, Oculus Quest or Moverio BT 300";
         homepage = "https://github.com/SideQuestVR/SideQuest";
         downloadPage = "https://github.com/SideQuestVR/SideQuest/releases";
+        sourceProvenance = with sourceTypes; [ binaryNativeCode ];
         license = licenses.mit;
         maintainers = with maintainers; [ joepie91 rvolosatovs ];
         platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/misc/signumone-ks/default.nix b/pkgs/applications/misc/signumone-ks/default.nix
index eb0af95d58d59..f183fbed3d2e4 100644
--- a/pkgs/applications/misc/signumone-ks/default.nix
+++ b/pkgs/applications/misc/signumone-ks/default.nix
@@ -48,6 +48,10 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Digital signature tool for Costa Rican electronic invoicing";
     homepage = "https://signum.one/download.html";
+    sourceProvenance = with sourceTypes; [
+      binaryBytecode
+      binaryNativeCode
+    ];
     license = licenses.unfree;
     maintainers = with maintainers; [ wolfangaukang ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/misc/simplenote/default.nix b/pkgs/applications/misc/simplenote/default.nix
index f723ba27beb8d..35f153393518c 100644
--- a/pkgs/applications/misc/simplenote/default.nix
+++ b/pkgs/applications/misc/simplenote/default.nix
@@ -27,6 +27,7 @@ let
     description = "The simplest way to keep notes";
     homepage = "https://github.com/Automattic/simplenote-electron";
     license = licenses.gpl2;
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     maintainers = with maintainers; [
       kiwi
     ];
diff --git a/pkgs/applications/misc/skytemple/default.nix b/pkgs/applications/misc/skytemple/default.nix
index 0f331ef6e2ce4..2ec034e882e18 100644
--- a/pkgs/applications/misc/skytemple/default.nix
+++ b/pkgs/applications/misc/skytemple/default.nix
@@ -1,4 +1,12 @@
-{ lib, fetchFromGitHub, gobject-introspection, gtk3, gtksourceview3, webkitgtk, wrapGAppsHook, python3Packages }:
+{ lib
+, fetchFromGitHub
+, gobject-introspection
+, gtk3
+, gtksourceview3
+, webkitgtk
+, wrapGAppsHook
+, python3Packages
+}:
 
 python3Packages.buildPythonApplication rec {
   pname = "skytemple";
@@ -8,7 +16,7 @@ python3Packages.buildPythonApplication rec {
     owner = "SkyTemple";
     repo = pname;
     rev = version;
-    sha256 = "sha256-CyYGTXdQsGpDR/gpqViEQO1xUPHaXTES592nRJixa1o=";
+    hash = "sha256-CyYGTXdQsGpDR/gpqViEQO1xUPHaXTES592nRJixa1o=";
   };
 
   buildInputs = [
@@ -20,9 +28,16 @@ python3Packages.buildPythonApplication rec {
     # any Pokemon, and clicking Stats and Moves tab.
     webkitgtk
   ];
-  nativeBuildInputs = [ gobject-introspection wrapGAppsHook ];
+
+  nativeBuildInputs = [
+    gobject-introspection
+    wrapGAppsHook
+  ];
+
   propagatedBuildInputs = with python3Packages; [
+    cairosvg
     natsort
+    ndspy
     packaging
     pycairo
     pygal
@@ -36,6 +51,7 @@ python3Packages.buildPythonApplication rec {
     skytemple-files
     skytemple-icons
     skytemple-ssb-debugger
+    tilequant
   ];
 
   doCheck = false; # there are no tests
diff --git a/pkgs/applications/misc/snapmaker-luban/default.nix b/pkgs/applications/misc/snapmaker-luban/default.nix
index b5bcbabf8674b..6a9c8843c09a3 100644
--- a/pkgs/applications/misc/snapmaker-luban/default.nix
+++ b/pkgs/applications/misc/snapmaker-luban/default.nix
@@ -81,6 +81,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Snapmaker Luban is an easy-to-use 3-in-1 software tailor-made for Snapmaker machines";
     homepage = "https://github.com/Snapmaker/Luban";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.gpl3;
     maintainers = [ maintainers.simonkampe ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/misc/snowsql/default.nix b/pkgs/applications/misc/snowsql/default.nix
index 85f4ffec5f16b..90aab7987b389 100644
--- a/pkgs/applications/misc/snowsql/default.nix
+++ b/pkgs/applications/misc/snowsql/default.nix
@@ -40,6 +40,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Command line client for the Snowflake database";
     homepage = "https://www.snowflake.com";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     maintainers = with maintainers; [ andehen ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/misc/thedesk/default.nix b/pkgs/applications/misc/thedesk/default.nix
index 42f4d36eea5d5..c9d845574ff0b 100644
--- a/pkgs/applications/misc/thedesk/default.nix
+++ b/pkgs/applications/misc/thedesk/default.nix
@@ -43,6 +43,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Mastodon/Misskey Client for PC";
     homepage = "https://thedesk.top";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ wolfangaukang ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/misc/upwork/default.nix b/pkgs/applications/misc/upwork/default.nix
index 34cc97023989e..0b1bed6785755 100644
--- a/pkgs/applications/misc/upwork/default.nix
+++ b/pkgs/applications/misc/upwork/default.nix
@@ -61,6 +61,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Online freelancing platform desktop application for time tracking";
     homepage = "https://www.upwork.com/ab/downloads/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     platforms = [ "x86_64-linux" ];
     maintainers = with maintainers; [ zakkor wolfangaukang ];
diff --git a/pkgs/applications/misc/whalebird/default.nix b/pkgs/applications/misc/whalebird/default.nix
index f49b14e8fc48f..3972d7a17230c 100644
--- a/pkgs/applications/misc/whalebird/default.nix
+++ b/pkgs/applications/misc/whalebird/default.nix
@@ -82,6 +82,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Electron based Mastodon, Pleroma and Misskey client for Windows, Mac and Linux";
     homepage = "https://whalebird.social";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.mit;
     maintainers = with maintainers; [ wolfangaukang colinsane ];
     platforms = [ "x86_64-linux" "aarch64-linux" ];
diff --git a/pkgs/applications/misc/xkblayout-state/default.nix b/pkgs/applications/misc/xkblayout-state/default.nix
index 70543b5fa186c..539a0f7d1a1d8 100644
--- a/pkgs/applications/misc/xkblayout-state/default.nix
+++ b/pkgs/applications/misc/xkblayout-state/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, qt4 }:
+{ lib, stdenv, fetchFromGitHub, libX11 }:
 
 stdenv.mkDerivation rec {
   pname = "xkblayout-state";
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-diorqwDEBdzcBteKvhRisQaY3bx5seaOaWSaPwBkWDo=";
   };
 
-  buildInputs = [ qt4 ];
+  buildInputs = [ libX11 ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/applications/misc/xmind/default.nix b/pkgs/applications/misc/xmind/default.nix
index a395ffd521f53..17134dcd3892b 100644
--- a/pkgs/applications/misc/xmind/default.nix
+++ b/pkgs/applications/misc/xmind/default.nix
@@ -85,7 +85,10 @@ stdenv.mkDerivation rec {
       and save to Evernote.
     '';
     homepage = "https://www.xmind.net/";
-    sourceProvenance = with sourceTypes; [ binaryBytecode ];
+    sourceProvenance = with sourceTypes; [
+      binaryBytecode
+      binaryNativeCode
+    ];
     license = licenses.unfree;
     platforms = platforms.linux;
     maintainers = with maintainers; [ michalrus ];
diff --git a/pkgs/applications/networking/aether/default.nix b/pkgs/applications/networking/aether/default.nix
index 5f78b244ca412..62dbae082d9a1 100644
--- a/pkgs/applications/networking/aether/default.nix
+++ b/pkgs/applications/networking/aether/default.nix
@@ -103,6 +103,7 @@ stdenv.mkDerivation rec {
     description = "Peer-to-peer ephemeral public communities";
     homepage = "https://getaether.net/";
     downloadPage = "https://getaether.net/download/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ maxhille ];
     # other platforms could be supported by building from source
diff --git a/pkgs/applications/networking/apache-directory-studio/default.nix b/pkgs/applications/networking/apache-directory-studio/default.nix
index 8b20c1aac6b0c..4a9c0da726fa2 100644
--- a/pkgs/applications/networking/apache-directory-studio/default.nix
+++ b/pkgs/applications/networking/apache-directory-studio/default.nix
@@ -45,6 +45,10 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Eclipse-based LDAP browser and directory client";
     homepage = "https://directory.apache.org/studio/";
+    sourceProvenance = with sourceTypes; [
+      binaryBytecode
+      binaryNativeCode
+    ];
     license = licenses.asl20;
     # Upstream supports macOS and Windows too.
     platforms = platforms.linux;
diff --git a/pkgs/applications/networking/appgate-sdp/default.nix b/pkgs/applications/networking/appgate-sdp/default.nix
index 7e4c5cfac888d..d6f21aa04237a 100644
--- a/pkgs/applications/networking/appgate-sdp/default.nix
+++ b/pkgs/applications/networking/appgate-sdp/default.nix
@@ -151,6 +151,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Appgate SDP (Software Defined Perimeter) desktop client";
     homepage = "https://www.appgate.com/support/software-defined-perimeter-support";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     platforms = platforms.linux;
     maintainers = with maintainers; [ ymatsiuk ];
diff --git a/pkgs/applications/networking/blocky/default.nix b/pkgs/applications/networking/blocky/default.nix
index 2f2a708455e17..0f25fd0a8ec98 100644
--- a/pkgs/applications/networking/blocky/default.nix
+++ b/pkgs/applications/networking/blocky/default.nix
@@ -6,20 +6,20 @@
 
 buildGoModule rec {
   pname = "blocky";
-  version = "0.18";
+  version = "0.19";
 
   src = fetchFromGitHub {
     owner = "0xERR0R";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-rFHDoNrEmMSNEc3RLdSeRk9mF05drUYfJFQKHAk5alE=";
+    sha256 = "sha256-jOOakRuiNbdCGmbaQFuHcLsHhV26jaQY+1GgDj9ocs0=";
   };
 
   # needs network connection and fails at
   # https://github.com/0xERR0R/blocky/blob/development/resolver/upstream_resolver_test.go
   doCheck = false;
 
-  vendorSha256 = "sha256-rrqDjh5e3KX5+saYjnMPG0bhr5YEOPfz0QCRf6omNZI=";
+  vendorSha256 = "sha256-fsMBL9qyhIrV6eAsqpSaNniibMdYRVBnl2KCzStvMGQ=";
 
   meta = with lib; {
     description = "Fast and lightweight DNS proxy as ad-blocker for local network with many features.";
diff --git a/pkgs/applications/networking/browsers/brave/default.nix b/pkgs/applications/networking/browsers/brave/default.nix
index 7833722c4d928..2d131b4279a6e 100644
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@@ -200,6 +200,7 @@ stdenv.mkDerivation rec {
       chew up your bandwidth, and invade your privacy. Brave lets you
       contribute to your favorite creators automatically.
     '';
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.mpl20;
     maintainers = with maintainers; [ uskudnik rht jefflabonte nasirhm ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index cfd6b122d6cc7..1cfc90dd4f145 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -160,10 +160,6 @@ let
       ./patches/no-build-timestamps.patch
       # For bundling Widevine (DRM), might be replaceable via bundle_widevine_cdm=true in gnFlags:
       ./patches/widevine-79.patch
-    ] ++ optionals (versionRange "102" "103") [
-      # https://dawn-review.googlesource.com/c/dawn/+/88582
-      # Wrap get_gitHash in try-catch to prevent failures in tarball builds.
-      ./patches/m102-fix-dawn_version_generator-failure.patch
     ];
 
     postPatch = ''
diff --git a/pkgs/applications/networking/browsers/chromium/patches/m102-fix-dawn_version_generator-failure.patch b/pkgs/applications/networking/browsers/chromium/patches/m102-fix-dawn_version_generator-failure.patch
deleted file mode 100644
index e9391541e435c..0000000000000
--- a/pkgs/applications/networking/browsers/chromium/patches/m102-fix-dawn_version_generator-failure.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From e9ffd084ec1ff9f7bfc86879732953dc58256958 Mon Sep 17 00:00:00 2001
-From: Loko Kung <lokokung@google.com>
-Date: Tue, 3 May 2022 00:28:53 +0000
-Subject: [PATCH] Wrap get_gitHash in try-catch to prevent failures in tarball
- builds.
-
-Bug: chromium:1321370
-Change-Id: If39d2236d1b4d965f7bd189f6bd1cdc70436c41d
-Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/88582
-Commit-Queue: Loko Kung <lokokung@google.com>
-Reviewed-by: Austin Eng <enga@chromium.org>
-Kokoro: Kokoro <noreply+kokoro@google.com>
-(cherry picked from commit 03ddfbb81fb4127ca37ea53e70fcb34fe851e24e)
----
- third_party/dawn/generator/dawn_version_generator.py | 13 ++++++++-----
- 1 file changed, 8 insertions(+), 5 deletions(-)
-
-diff --git a/third_party/dawn/generator/dawn_version_generator.py b/third_party/dawn/generator/dawn_version_generator.py
-index 1907e88da..3c1927bee 100644
---- a/third_party/dawn/generator/dawn_version_generator.py
-+++ b/third_party/dawn/generator/dawn_version_generator.py
-@@ -23,11 +23,14 @@ def get_git():
-
-
- def get_gitHash(dawnDir):
--    result = subprocess.run([get_git(), 'rev-parse', 'HEAD'],
--                            stdout=subprocess.PIPE,
--                            cwd=dawnDir)
--    if result.returncode == 0:
--        return result.stdout.decode('utf-8').strip()
-+    try:
-+        result = subprocess.run([get_git(), "rev-parse", "HEAD"],
-+                                stdout=subprocess.PIPE,
-+                                cwd=dawnDir)
-+        if result.returncode == 0:
-+            return result.stdout.decode("utf-8").strip()
-+    except Exception:
-+        return ""
-     # No hash was available (possibly) because the directory was not a git checkout. Dawn should
-     # explicitly handle its absenece and disable features relying on the hash, i.e. caching.
-     return ''
---
-2.36.0
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.json b/pkgs/applications/networking/browsers/chromium/upstream-info.json
index 0516b1d65bd39..f661e64bac7f8 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@@ -45,19 +45,19 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "102.0.5005.115",
-    "sha256": "1rj7vy824vn513hiivc90lnxvxyi2s0qkdmfqsdssv9v6zjl079h",
-    "sha256bin64": "0b32sscbjnvr98lk962i9k2srckv2s7fp9pifmsv5jlwndjhzm7y",
+    "version": "103.0.5060.53",
+    "sha256": "00di0nw6h3kb0qp2wp3ny3zsar1ayn1lyx5zr28dl1h5cwaaxjqf",
+    "sha256bin64": "19wxd4jl6fyjpcpy2331ckz6dgzrfj52wvdkp0kb18n0sym17fyn",
     "deps": {
       "gn": {
-        "version": "2022-04-14",
+        "version": "2022-05-11",
         "url": "https://gn.googlesource.com/gn",
-        "rev": "fd9f2036f26d83f9fcfe93042fb952e5a7fe2167",
-        "sha256": "0b5xs0chcv3hfhy71rycsmgxnqbm375a333hwav8929k9cbi5p9h"
+        "rev": "578a7fe4c3c6b0bc2ae1fd2e37f14857d09895bf",
+        "sha256": "03dqfrdpf5xxl64dby3qmbwpzdq2gsa8g7xl438py3a629rgxg63"
       },
       "ungoogled-patches": {
-        "rev": "102.0.5005.115-1",
-        "sha256": "1z2xkxxviggyyksga74cqa4v73gynlgzi22ckg8yv84qxrklik6p"
+        "rev": "103.0.5060.53-1",
+        "sha256": "1g5ciwzrhg9g13gvhrwqf19djk9jhj1d6nx2f6a8d5ch1mhi2z8s"
       }
     }
   }
diff --git a/pkgs/applications/networking/browsers/firefox/wrapper.nix b/pkgs/applications/networking/browsers/firefox/wrapper.nix
index 153bd31a5e725..1b8e3c879676e 100644
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@@ -97,12 +97,15 @@ let
 
       nameArray = builtins.map(a: a.name) (if usesNixExtensions then nixExtensions else []);
 
+      requiresSigning = browser ? MOZ_REQUIRE_SIGNING
+                     -> toString browser.MOZ_REQUIRE_SIGNING != "";
+
       # Check that every extension has a unqiue .name attribute
       # and an extid attribute
       extensions = if nameArray != (lib.unique nameArray) then
         throw "Firefox addon name needs to be unique"
-      else if ! (lib.hasSuffix "esr" browser.name) then
-        throw "Nix addons are only supported in Firefox ESR"
+      else if requiresSigning && !lib.hasSuffix "esr" browser.name then
+        throw "Nix addons are only supported without signature enforcement (eg. Firefox ESR)"
       else builtins.map (a:
         if ! (builtins.hasAttr "extid" a) then
         throw "nixExtensions has an invalid entry. Missing extid attribute. Please use fetchfirefoxaddon"
diff --git a/pkgs/applications/networking/browsers/vivaldi/ffmpeg-codecs.nix b/pkgs/applications/networking/browsers/vivaldi/ffmpeg-codecs.nix
index 962113a2ace5d..26b408ffdecc0 100644
--- a/pkgs/applications/networking/browsers/vivaldi/ffmpeg-codecs.nix
+++ b/pkgs/applications/networking/browsers/vivaldi/ffmpeg-codecs.nix
@@ -22,6 +22,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Additional support for proprietary codecs for Vivaldi";
     homepage    = "https://ffmpeg.org/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license     = licenses.lgpl21;
     maintainers = with maintainers; [ betaboon cawilliamson lluchs ];
     platforms   = [ "x86_64-linux" ];
diff --git a/pkgs/applications/networking/browsers/vivaldi/widevine.nix b/pkgs/applications/networking/browsers/vivaldi/widevine.nix
index 740e325fca4e9..65c58775874b1 100644
--- a/pkgs/applications/networking/browsers/vivaldi/widevine.nix
+++ b/pkgs/applications/networking/browsers/vivaldi/widevine.nix
@@ -20,6 +20,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Widevine support for Vivaldi";
     homepage = "https://www.widevine.com";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     maintainers = with maintainers; [ betaboon ];
     platforms   = [ "x86_64-linux" ];
diff --git a/pkgs/applications/networking/cisco-packet-tracer/7.nix b/pkgs/applications/networking/cisco-packet-tracer/7.nix
index f7e7317131202..422ccd05cffcb 100644
--- a/pkgs/applications/networking/cisco-packet-tracer/7.nix
+++ b/pkgs/applications/networking/cisco-packet-tracer/7.nix
@@ -83,6 +83,7 @@ in stdenv.mkDerivation {
   meta = with lib; {
     description = "Network simulation tool from Cisco";
     homepage = "https://www.netacad.com/courses/packet-tracer";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     maintainers = with maintainers; [ lucasew ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/networking/cisco-packet-tracer/8.nix b/pkgs/applications/networking/cisco-packet-tracer/8.nix
index 9bc8900174547..0dd31aea0619d 100644
--- a/pkgs/applications/networking/cisco-packet-tracer/8.nix
+++ b/pkgs/applications/networking/cisco-packet-tracer/8.nix
@@ -125,6 +125,7 @@ in stdenv.mkDerivation {
   meta = with lib; {
     description = "Network simulation tool from Cisco";
     homepage = "https://www.netacad.com/courses/packet-tracer";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     maintainers = with maintainers; [ lucasew ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/networking/cluster/argocd/default.nix b/pkgs/applications/networking/cluster/argocd/default.nix
index f0c81ab5ca5fb..212e024b98790 100644
--- a/pkgs/applications/networking/cluster/argocd/default.nix
+++ b/pkgs/applications/networking/cluster/argocd/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "argocd";
-  version = "2.4.0";
+  version = "2.4.2";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo-cd";
     rev = "v${version}";
-    sha256 = "sha256-U3i3shXsItQQlkFl/DrGdSHY2AAhaYV5WX3B+6TlOPw=";
+    sha256 = "sha256-zc99YKh5hNa4oRoKJcGWqNrDb3LqIwXWzYOsmGKVsL8=";
   };
 
   vendorSha256 = "sha256-j/35tvfUCcuFN8NGIjWgna1W0Q4CyhMLcOlepTAUl0w=";
diff --git a/pkgs/applications/networking/cluster/cilium/default.nix b/pkgs/applications/networking/cluster/cilium/default.nix
index 648b0048e3e29..076b7f2a94c70 100644
--- a/pkgs/applications/networking/cluster/cilium/default.nix
+++ b/pkgs/applications/networking/cluster/cilium/default.nix
@@ -2,22 +2,39 @@
 
 buildGoModule rec {
   pname = "cilium-cli";
-  version = "0.11.7";
+  version = "0.11.10";
 
   src = fetchFromGitHub {
     owner = "cilium";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-4+4E7v/b74DDekqymH8PR7/GfH3GGzSQFQk24VJisQ0=";
+    sha256 = "sha256-BkcnChxUceWGG5hBOHvzZokgcw8T/vvNwIEtHkLfUJA=";
   };
 
   vendorSha256 = null;
 
+  subPackages = [ "cmd/cilium" ];
+
+  ldflags = [
+    "-s" "-w"
+    "-X github.com/cilium/cilium-cli/internal/cli/cmd.Version=${version}"
+  ];
+
+
+  # Required to workaround install check error:
+  # 2022/06/25 10:36:22 Unable to start gops: mkdir /homeless-shelter: permission denied
+  HOME = "$TMPDIR";
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    $out/bin/cilium version | grep ${version} > /dev/null
+  '';
+
   meta = with lib; {
     description = "CLI to install, manage & troubleshoot Kubernetes clusters running Cilium";
     license = licenses.asl20;
     homepage = "https://www.cilium.io/";
-    maintainers = with maintainers; [ humancalico ];
+    maintainers = with maintainers; [ humancalico bryanasdev000 ];
     mainProgram = "cilium";
   };
 }
diff --git a/pkgs/applications/networking/cluster/fluxcd/default.nix b/pkgs/applications/networking/cluster/fluxcd/default.nix
index 358803a3cf379..1afb2b7a5e1f3 100644
--- a/pkgs/applications/networking/cluster/fluxcd/default.nix
+++ b/pkgs/applications/networking/cluster/fluxcd/default.nix
@@ -1,9 +1,9 @@
 { lib, buildGoModule, fetchFromGitHub, fetchzip, installShellFiles }:
 
 let
-  version = "0.31.1";
-  sha256 = "1dhs96r9yi37i5q9wqg7198f6kl59jlj3g1q76r0snqyl16g2jwf";
-  manifestsSha256 = "0wwlwai1hhz69kgaccw3w8ad6bwdd46pm4ns8nqm04927b0b2dqb";
+  version = "0.31.2";
+  sha256 = "1w373gwxxvnqsfm5r63r1bcmlrii5wy6yhbs5li0bw2anhnb0iir";
+  manifestsSha256 = "0lqfrry1kg52ikyhzgwg57zqzq24aspp2d7whyzir3dglvf999lb";
 
   manifests = fetchzip {
     url =
@@ -23,7 +23,7 @@ in buildGoModule rec {
     inherit sha256;
   };
 
-  vendorSha256 = "sha256-sPyz6ISFLe+6CJoAcG17KSfo63vuTj30IWw+S2NCszY=";
+  vendorSha256 = "sha256-Z7O/ReEZwmK5KKAHzi4B3d31ynA51XzbTKsrzCXAFPo=";
 
   postUnpack = ''
     cp -r ${manifests} source/cmd/flux/manifests
diff --git a/pkgs/applications/networking/cluster/helm-docs/default.nix b/pkgs/applications/networking/cluster/helm-docs/default.nix
index 1d3c9f43e906b..cdd6c68a76fba 100644
--- a/pkgs/applications/networking/cluster/helm-docs/default.nix
+++ b/pkgs/applications/networking/cluster/helm-docs/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "helm-docs";
-  version = "1.8.1";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "norwoodj";
     repo = "helm-docs";
     rev = "v${version}";
-    sha256 = "sha256-OpS/CYBb2Ll6ktvEhqkw/bWMSrFa4duidK3Glu8EnPw=";
+    sha256 = "sha256-V7Qw20PPoAEXl/XAMj/WSM73fLdp/gH4G3ipx49p06o=";
   };
 
   vendorSha256 = "sha256-FpmeOQ8nV+sEVu2+nY9o9aFbCpwSShQUFOmyzwEQ9Pw=";
diff --git a/pkgs/applications/networking/cluster/kubernetes/default.nix b/pkgs/applications/networking/cluster/kubernetes/default.nix
index 8ed8cd5689136..5cbd307a3d73d 100644
--- a/pkgs/applications/networking/cluster/kubernetes/default.nix
+++ b/pkgs/applications/networking/cluster/kubernetes/default.nix
@@ -1,11 +1,11 @@
-{ stdenv
-, lib
+{ lib
+, buildGoModule
 , fetchFromGitHub
 , which
-, go
 , makeWrapper
 , rsync
 , installShellFiles
+, runtimeShell
 , kubectl
 , nixosTests
 
@@ -19,7 +19,7 @@
   ]
 }:
 
-stdenv.mkDerivation rec {
+buildGoModule rec {
   pname = "kubernetes";
   version = "1.23.8";
 
@@ -30,23 +30,27 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-mu+jBSypoMNxOugLbS3foH4C4AqSZnlic4Bf1v9dYc8=";
   };
 
-  nativeBuildInputs = [ makeWrapper which go rsync installShellFiles ];
+  vendorSha256 = null;
+
+  doCheck = false;
+
+  nativeBuildInputs = [ makeWrapper which rsync installShellFiles ];
 
   outputs = [ "out" "man" "pause" ];
 
   patches = [ ./fixup-addonmanager-lib-path.patch ];
 
-  postPatch = ''
-    substituteInPlace "hack/update-generated-docs.sh" --replace "make" "make SHELL=${stdenv.shell}"
-    patchShebangs ./hack
-  '';
-
   WHAT = lib.concatStringsSep " " ([
     "cmd/kubeadm"
   ] ++ components);
 
-  postBuild = ''
+  buildPhase = ''
+    runHook preBuild
+    substituteInPlace "hack/update-generated-docs.sh" --replace "make" "make SHELL=${runtimeShell}"
+    patchShebangs ./hack ./cluster/addons/addon-manager
+    make "SHELL=${runtimeShell}" "WHAT=$WHAT"
     ./hack/update-generated-docs.sh
+    runHook postBuild
   '';
 
   installPhase = ''
@@ -69,7 +73,6 @@ stdenv.mkDerivation rec {
       --subst-var out
 
     chmod +x $out/bin/kube-addons
-    patchShebangs $out/bin/kube-addons
     wrapProgram $out/bin/kube-addons --set "KUBECTL_BIN" "$out/bin/kubectl"
 
     cp cluster/addons/addon-manager/kube-addons.sh $out/bin/kube-addons-lib.sh
@@ -80,10 +83,6 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
-  disallowedReferences = [ go ];
-
-  GOFLAGS = [ "-trimpath" ];
-
   meta = with lib; {
     description = "Production-Grade Container Scheduling and Management";
     license = licenses.asl20;
diff --git a/pkgs/applications/networking/cluster/kubernetes/kubectl.nix b/pkgs/applications/networking/cluster/kubernetes/kubectl.nix
index 6a6f9042124b8..754bca32511c1 100644
--- a/pkgs/applications/networking/cluster/kubernetes/kubectl.nix
+++ b/pkgs/applications/networking/cluster/kubernetes/kubectl.nix
@@ -1,15 +1,14 @@
-{ lib, stdenv, kubernetes }:
+{ lib, buildGoModule, kubernetes }:
 
-stdenv.mkDerivation rec {
+buildGoModule rec {
   pname = "kubectl";
 
   inherit (kubernetes)
-    disallowedReferences
-    GOFLAGS
+    buildPhase
+    doCheck
     nativeBuildInputs
-    postBuild
-    postPatch
     src
+    vendorSha256
     version
     ;
 
@@ -18,7 +17,7 @@ stdenv.mkDerivation rec {
   WHAT = lib.concatStringsSep " " [
     "cmd/kubectl"
     "cmd/kubectl-convert"
-    ];
+  ];
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/applications/networking/cluster/octant/default.nix b/pkgs/applications/networking/cluster/octant/default.nix
index 70c255790790d..733e4c04a9cca 100644
--- a/pkgs/applications/networking/cluster/octant/default.nix
+++ b/pkgs/applications/networking/cluster/octant/default.nix
@@ -59,6 +59,7 @@ stdenv.mkDerivation rec {
       introspective tooling, cluster navigation, and object management along
       with a plugin system to further extend its capabilities.
     '';
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.asl20;
     maintainers = with maintainers; [ jk ];
     platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];
diff --git a/pkgs/applications/networking/cluster/ssm-session-manager-plugin/default.nix b/pkgs/applications/networking/cluster/ssm-session-manager-plugin/default.nix
index a3c8bc706613e..7350a8bd460b4 100644
--- a/pkgs/applications/networking/cluster/ssm-session-manager-plugin/default.nix
+++ b/pkgs/applications/networking/cluster/ssm-session-manager-plugin/default.nix
@@ -39,6 +39,7 @@ stdenv.mkDerivation rec {
       "https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-working-with-install-plugin.html";
     description = "Amazon SSM Session Manager Plugin";
     platforms = [ "x86_64-linux" "x86_64-darwin" "aarch64-darwin" ];
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     maintainers = with maintainers; [ mbaillie ];
   };
diff --git a/pkgs/applications/networking/cluster/talosctl/default.nix b/pkgs/applications/networking/cluster/talosctl/default.nix
index da240b337bfc2..42d451bd44db4 100644
--- a/pkgs/applications/networking/cluster/talosctl/default.nix
+++ b/pkgs/applications/networking/cluster/talosctl/default.nix
@@ -1,42 +1,21 @@
-{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
-let
-  # look for GO_LDFLAGS getting set in the Makefile
-  version = "1.0.6";
-  sha256 = "sha256-4cUaQWqVndp06eFgqInOMMGITbTdZO5BOqXW2XEpuWU=";
-  vendorSha256 = "sha256-7q35d+jbIDe7fAy6nL5FWdSovBb/f64HYLHGL+zE6bI=";
-  pkgsVersion = "v1.0.0-25-gcf9709e";
-  extrasVersion = "v1.0.0-4-g05b0920";
-in
+{ lib, stdenv, buildGoModule, fetchFromGitHub, installShellFiles }:
+
 buildGoModule rec {
   pname = "talosctl";
-  inherit version vendorSha256;
-  # nixpkgs-update: no auto update
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "siderolabs";
     repo = "talos";
     rev = "v${version}";
-    inherit sha256;
+    sha256 = "sha256-52WzQ5LWgIX/XBJPNvWV0tAPnw1AiINDL/7D3UYvvn4=";
   };
 
-  ldflags =
-    let
-      versionPkg = "github.com/talos-systems/talos/pkg/version"; # VERSION_PKG
-      imagesPkgs = "github.com/talos-systems/talos/pkg/images"; # IMAGES_PKGS
-      mgmtHelpersPkg = "github.com/talos-systems/talos/cmd/talosctl/pkg/mgmt/helpers"; #MGMT_HELPERS_PKG
-    in
-    [
-      "-X ${versionPkg}.Name=Client"
-      "-X ${versionPkg}.SHA=${src.rev}" # should be the hash, but as we build from tags, this needs to do
-      "-X ${versionPkg}.Tag=${src.rev}"
-      "-X ${versionPkg}.PkgsVersion=${pkgsVersion}" # PKGS
-      "-X ${versionPkg}.ExtrasVersion=${extrasVersion}" # EXTRAS
-      "-X ${imagesPkgs}.Username=siderolabs" # USERNAME
-      "-X ${imagesPkgs}.Registry=ghcr.io" # REGISTRY
-      "-X ${mgmtHelpersPkg}.ArtifactsPath=_out" # ARTIFACTS
-      "-s"
-      "-w"
-    ];
+  vendorSha256 = "sha256-iluI4UGw5cZ70wmC9jDiGttvxZ7xFyqcL9IZX4ubJqs=";
+
+  ldflags = [ "-s" "-w" ];
+
+  GOWORK = "off";
 
   subPackages = [ "cmd/talosctl" ];
 
@@ -56,5 +35,8 @@ buildGoModule rec {
     homepage = "https://www.talos.dev/";
     license = licenses.mpl20;
     maintainers = with maintainers; [ flokli ];
+    # requires >= 10.14 SDK https://github.com/NixOS/nixpkgs/issues/101229
+    # Undefined symbols for architecture x86_64: "_SecTrustEvaluateWithError"
+    broken = stdenv.isDarwin && stdenv.isx86_64;
   };
 }
diff --git a/pkgs/applications/networking/cluster/temporal-cli/default.nix b/pkgs/applications/networking/cluster/temporal-cli/default.nix
index 49d64283ca0f0..0d326d5ad458a 100644
--- a/pkgs/applications/networking/cluster/temporal-cli/default.nix
+++ b/pkgs/applications/networking/cluster/temporal-cli/default.nix
@@ -1,26 +1,17 @@
-{ lib, fetchFromGitHub, fetchpatch, buildGoModule, testers, temporal-cli }:
+{ lib, fetchFromGitHub, buildGoModule, testers, temporal-cli }:
 
 buildGoModule rec {
   pname = "temporal-cli";
-  version = "1.16.1";
+  version = "1.16.2";
 
   src = fetchFromGitHub {
     owner = "temporalio";
     repo = "tctl";
     rev = "v${version}";
-    sha256 = "sha256-WNdu/62/VmxTmzAvzx3zIlcAAlEmpN0yKzQOSUtrL8s=";
+    sha256 = "sha256-KLcCFQJlFeioIhqrbkhgoNPcbAYvy1ESG8x9Y/I7+nw=";
   };
 
-  patches = [
-    # Fix tests
-    (fetchpatch {
-      name = "fix-tests.patch";
-      url = "https://github.com/temporalio/tctl/pull/203/commits/2b113da137a3a925e8fbd7c18bdaaefc31397db4.patch";
-      sha256 = "sha256-HFPwbmLZ2uPHzaHvYoB4MTZvMVyzvUKggA76/bh50DQ=";
-    })
-  ];
-
-  vendorSha256 = "sha256-WF3T+HNisfR0JoKkHCC77kmHmsGZ9NfQ7UCwOmpCG/o=";
+  vendorSha256 = "sha256-kczmoP32/V0HHeC3Mr+giuMB+McVTNeC2F+t1ohY4/U=";
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/applications/networking/cluster/velero/default.nix b/pkgs/applications/networking/cluster/velero/default.nix
index 88c3a31fd2d77..5685b0b65072c 100644
--- a/pkgs/applications/networking/cluster/velero/default.nix
+++ b/pkgs/applications/networking/cluster/velero/default.nix
@@ -2,23 +2,25 @@
 
 buildGoModule rec {
   pname = "velero";
-  version = "1.8.1";
+  version = "1.9.0";
 
 
   src = fetchFromGitHub {
     owner = "vmware-tanzu";
     repo = "velero";
     rev = "v${version}";
-    sha256 = "sha256-oiYr9JQlJVxjZxGhZyOIUy934KedBmDhzK+71qmaD58=";
+    sha256 = "sha256-zoHMyOhHEunJ8LirUxOT1qNY3jB28BEiQ+3GdqriTtQ=";
   };
 
   ldflags = [
     "-s" "-w"
     "-X github.com/vmware-tanzu/velero/pkg/buildinfo.Version=${version}"
+    "-X github.com/vmware-tanzu/velero/pkg/buildinfo.ImageRegistry=velero"
     "-X github.com/vmware-tanzu/velero/pkg/buildinfo.GitTreeState=clean"
+    "-X github.com/vmware-tanzu/velero/pkg/buildinfo.GitSHA=none"
   ];
 
-  vendorSha256 = "sha256-DyQ+MHRNZFg80Yz/SCxhnF4NVbIsyhz4mApx0+kgHoA=";
+  vendorSha256 = "sha256-PDXufnddHEA0qCfzJ0O+h3u50gWNkQAnWMZjSVQ0oHc=";
 
   excludedPackages = [ "issue-template-gen" "release-tools" "v1" "velero-restic-restore-helper" ];
 
diff --git a/pkgs/applications/networking/cluster/werf/default.nix b/pkgs/applications/networking/cluster/werf/default.nix
index bcd43d71fc8a7..d677b2d96dfdd 100644
--- a/pkgs/applications/networking/cluster/werf/default.nix
+++ b/pkgs/applications/networking/cluster/werf/default.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "werf";
-  version = "1.2.114";
+  version = "1.2.117";
 
   src = fetchFromGitHub {
     owner = "werf";
     repo = "werf";
     rev = "v${version}";
-    sha256 = "sha256-+QCKVXuROd7QB6P5tSSINWtdw5OvVnmE1+ttoBnCO1g=";
+    sha256 = "sha256-bh+4Z4+BU1exOv113ScIw9VsGM+jRireyb9lArg/Zg4=";
   };
 
-  vendorSha256 = "sha256-VuburDiYqePFvS7/aTM+krkK2UhTHhfbvGOLY3I3DN8=";
+  vendorSha256 = "sha256-cW9sjMRLslEhgyI5Z7ypUtGgzCDASQ4m9yr6DoQKoz8=";
 
   proxyVendor = true;
 
diff --git a/pkgs/applications/networking/feedreaders/indigenous-desktop/default.nix b/pkgs/applications/networking/feedreaders/indigenous-desktop/default.nix
index 9bb34ffbbd709..22bd33b87717f 100644
--- a/pkgs/applications/networking/feedreaders/indigenous-desktop/default.nix
+++ b/pkgs/applications/networking/feedreaders/indigenous-desktop/default.nix
@@ -47,6 +47,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "IndieWeb app with extensions for sharing to/reading from micropub endpoints";
     homepage = "https://indigenous.realize.be/indigenous-desktop";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ wolfangaukang ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/networking/flexget/default.nix b/pkgs/applications/networking/flexget/default.nix
index 0a4cea6288152..071ac5b7aa273 100644
--- a/pkgs/applications/networking/flexget/default.nix
+++ b/pkgs/applications/networking/flexget/default.nix
@@ -5,14 +5,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "flexget";
-  version = "3.3.17";
+  version = "3.3.18";
 
   # Fetch from GitHub in order to use `requirements.in`
   src = fetchFromGitHub {
     owner = "flexget";
     repo = "flexget";
     rev = "refs/tags/v${version}";
-    hash = "sha256-xVHk6fQBY8EQsZJDZYoQ+WXDpLGJrRTVR6xhF1DWv0I=";
+    hash = "sha256-vZOeWxCcrTRT28Bn2r/I7/ojQ6uUV3xZlAZLbrAH5tc=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/networking/hpmyroom/default.nix b/pkgs/applications/networking/hpmyroom/default.nix
index 64a237480c651..5417cc6fda145 100644
--- a/pkgs/applications/networking/hpmyroom/default.nix
+++ b/pkgs/applications/networking/hpmyroom/default.nix
@@ -50,6 +50,7 @@ mkDerivation rec {
   meta = {
     description = "Client for HPE's MyRoom web conferencing solution";
     maintainers = with lib.maintainers; [ johnazoidberg ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.unfree;
     homepage = "https://myroom.hpe.com";
     # TODO: A Darwin binary is available upstream
diff --git a/pkgs/applications/networking/instant-messengers/alfaview/default.nix b/pkgs/applications/networking/instant-messengers/alfaview/default.nix
index 51279394df5c8..ff97cb55a5563 100644
--- a/pkgs/applications/networking/instant-messengers/alfaview/default.nix
+++ b/pkgs/applications/networking/instant-messengers/alfaview/default.nix
@@ -73,6 +73,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Video-conferencing application, specialized in virtual online meetings, seminars, training sessions and conferences";
     homepage = "https://alfaview.com";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     maintainers = with maintainers; [ wolfangaukang hexchen ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/networking/instant-messengers/bluejeans/default.nix b/pkgs/applications/networking/instant-messengers/bluejeans/default.nix
index c902a7e67c57e..ddecac0735268 100644
--- a/pkgs/applications/networking/instant-messengers/bluejeans/default.nix
+++ b/pkgs/applications/networking/instant-messengers/bluejeans/default.nix
@@ -127,6 +127,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Video, audio, and web conferencing that works together with the collaboration tools you use every day";
     homepage = "https://www.bluejeans.com";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     maintainers = with maintainers; [ ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/networking/instant-messengers/chatty/default.nix b/pkgs/applications/networking/instant-messengers/chatty/default.nix
index 35266eff90092..a6e31573ae816 100644
--- a/pkgs/applications/networking/instant-messengers/chatty/default.nix
+++ b/pkgs/applications/networking/instant-messengers/chatty/default.nix
@@ -29,7 +29,7 @@
 
 stdenv.mkDerivation rec {
   pname = "chatty";
-  version = "0.6.4";
+  version = "0.6.6";
 
   src = fetchFromGitLab {
     domain = "source.puri.sm";
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
     repo = "chatty";
     rev = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-uDuSx+tWv6DV93/99QUcUKZaWA9kNW8phHZhetYlG/M=";
+    hash = "sha256-vwgXfoyZOCSMnRAB6bFSrtYlSrpMa9OOcmxYTqhU+lA=";
   };
 
   postPatch = ''
@@ -83,6 +83,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "XMPP and SMS messaging via libpurple and ModemManager";
     homepage = "https://source.puri.sm/Librem5/chatty";
+    changelog = "https://source.puri.sm/Librem5/chatty/-/blob/${src.rev}/NEWS";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ dotlambda tomfitzhenry ];
     platforms = platforms.linux;
diff --git a/pkgs/applications/networking/instant-messengers/discord/darwin.nix b/pkgs/applications/networking/instant-messengers/discord/darwin.nix
index 4bc9ac98df1f6..494a7e6a44283 100644
--- a/pkgs/applications/networking/instant-messengers/discord/darwin.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/darwin.nix
@@ -1,4 +1,4 @@
-{ pname, version, src, meta, stdenv, binaryName, desktopName, undmg }:
+{ pname, version, src, openasar, meta, stdenv, binaryName, desktopName, lib, undmg }:
 
 stdenv.mkDerivation {
   inherit pname version src meta;
@@ -8,7 +8,15 @@ stdenv.mkDerivation {
   sourceRoot = ".";
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/Applications
     cp -r "${desktopName}.app" $out/Applications
+
+    runHook postInstall
+  '';
+
+  postInstall = lib.strings.optionalString (openasar != null) ''
+    cp -f ${openasar} $out/Applications/${desktopName}.app/Contents/Resources/app.asar
   '';
 }
diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index ab471ef47fb78..71606f2dcaddb 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -1,6 +1,5 @@
-{ branch ? "stable", pkgs, lib, stdenv }:
+{ branch ? "stable", callPackage, fetchurl, lib, stdenv, withOpenASAR ? false }:
 let
-  inherit (pkgs) callPackage fetchurl;
   versions = if stdenv.isLinux then {
     stable = "0.0.18";
     ptb = "0.0.29";
@@ -55,14 +54,18 @@ let
     description = "All-in-one cross-platform voice and text chat for gamers";
     homepage = "https://discordapp.com/";
     downloadPage = "https://discordapp.com/download";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     maintainers = with maintainers; [ ldesgoui MP2E devins2518 ];
     platforms = [ "x86_64-linux" "x86_64-darwin" ]
       ++ lib.optionals (branch == "ptb") [ "aarch64-darwin" ];
   };
   package = if stdenv.isLinux then ./linux.nix else ./darwin.nix;
+
+  openasar = if withOpenASAR then callPackage ./openasar.nix { } else null;
+
   packages = (builtins.mapAttrs
-    (_: value: callPackage package (value // { inherit src version; meta = meta // { mainProgram = value.binaryName; }; }))
+    (_: value: callPackage package (value // { inherit src version openasar; meta = meta // { mainProgram = value.binaryName; }; }))
     {
       stable = rec {
         pname = "discord";
diff --git a/pkgs/applications/networking/instant-messengers/discord/linux.nix b/pkgs/applications/networking/instant-messengers/discord/linux.nix
index 74e424aaf1dfa..28c1d353ff610 100644
--- a/pkgs/applications/networking/instant-messengers/discord/linux.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/linux.nix
@@ -1,4 +1,4 @@
-{ pname, version, src, meta, binaryName, desktopName, autoPatchelfHook
+{ pname, version, src, openasar, meta, binaryName, desktopName, autoPatchelfHook
 , makeDesktopItem, lib, stdenv, wrapGAppsHook, makeShellWrapper, alsa-lib, at-spi2-atk
 , at-spi2-core, atk, cairo, cups, dbus, expat, fontconfig, freetype, gdk-pixbuf
 , glib, gtk3, libcxx, libdrm, libnotify, libpulseaudio, libuuid, libX11
@@ -72,6 +72,8 @@ stdenv.mkDerivation rec {
   ];
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/{bin,opt/${binaryName},share/pixmaps,share/icons/hicolor/256x256/apps}
     mv * $out/opt/${binaryName}
 
@@ -95,6 +97,12 @@ stdenv.mkDerivation rec {
     ln -s $out/opt/${binaryName}/discord.png $out/share/icons/hicolor/256x256/apps/${pname}.png
 
     ln -s "${desktopItem}/share/applications" $out/share/
+
+    runHook postInstall
+  '';
+
+  postInstall = lib.strings.optionalString (openasar != null) ''
+    cp -f ${openasar} $out/opt/${binaryName}/resources/app.asar
   '';
 
   desktopItem = makeDesktopItem {
diff --git a/pkgs/applications/networking/instant-messengers/discord/openasar.nix b/pkgs/applications/networking/instant-messengers/discord/openasar.nix
new file mode 100644
index 0000000000000..e378f490c0f45
--- /dev/null
+++ b/pkgs/applications/networking/instant-messengers/discord/openasar.nix
@@ -0,0 +1,42 @@
+{ lib, stdenv, fetchFromGitHub, nodejs, bash, nodePackages }:
+
+stdenv.mkDerivation rec {
+  version = "unstable-2022-06-10";
+  pname = "openasar";
+
+  src = fetchFromGitHub {
+    owner = "GooseMod";
+    repo = "OpenAsar";
+    rev = "c6f2f5eb7827fea14cb4c54345af8ff6858c633a";
+    sha256 = "m6e/WKGgkR8vjKcHSNdWE25MmDQM1Z3kgB24OJgbw/w=";
+  };
+
+  buildPhase = ''
+    runHook preBuild
+
+    bash scripts/injectPolyfills.sh
+    substituteInPlace src/index.js --replace 'nightly' '${version}'
+    ${nodejs}/bin/node scripts/strip.js
+    ${nodePackages.asar}/bin/asar pack src app.asar
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install app.asar $out
+
+    runHook postInstall
+  '';
+
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Open-source alternative of Discord desktop's \"app.asar\".";
+    homepage = "https://openasar.dev";
+    license = licenses.mit;
+    maintainers = with maintainers; [ pedrohlc ];
+    platforms = nodejs.meta.platforms;
+  };
+}
diff --git a/pkgs/applications/networking/instant-messengers/ferdi/default.nix b/pkgs/applications/networking/instant-messengers/ferdi/default.nix
index 90ab331426a09..edd05a83ad639 100644
--- a/pkgs/applications/networking/instant-messengers/ferdi/default.nix
+++ b/pkgs/applications/networking/instant-messengers/ferdi/default.nix
@@ -26,6 +26,7 @@ mkFranzDerivation' rec {
   meta = with lib; {
     description = "Combine your favorite messaging services into one application";
     homepage = "https://getferdi.com/";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = licenses.asl20;
     maintainers = with maintainers; [ davidtwco ma27 ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/networking/instant-messengers/franz/default.nix b/pkgs/applications/networking/instant-messengers/franz/default.nix
index b3d9194c6fe4b..a910105fde808 100644
--- a/pkgs/applications/networking/instant-messengers/franz/default.nix
+++ b/pkgs/applications/networking/instant-messengers/franz/default.nix
@@ -11,6 +11,7 @@ mkFranzDerivation rec {
   meta = with lib; {
     description = "A free messaging app that combines chat & messaging services into one application";
     homepage = "https://meetfranz.com";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.free;
     maintainers = [ maintainers.davidtwco ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/networking/instant-messengers/gitter/default.nix b/pkgs/applications/networking/instant-messengers/gitter/default.nix
index 8ed85cba8546f..04d8909f3d892 100644
--- a/pkgs/applications/networking/instant-messengers/gitter/default.nix
+++ b/pkgs/applications/networking/instant-messengers/gitter/default.nix
@@ -94,6 +94,7 @@ in stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Where developers come to talk";
     downloadPage = "https://gitter.im/apps";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.mit;
     maintainers = [ maintainers.imalison ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/networking/instant-messengers/hipchat/default.nix b/pkgs/applications/networking/instant-messengers/hipchat/default.nix
index 6a677c9e0d612..8debefa0c11c4 100644
--- a/pkgs/applications/networking/instant-messengers/hipchat/default.nix
+++ b/pkgs/applications/networking/instant-messengers/hipchat/default.nix
@@ -81,6 +81,7 @@ in stdenv.mkDerivation {
   meta = with lib; {
     description = "Desktop client for HipChat services";
     homepage = "http://www.hipchat.com";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     platforms = [ "x86_64-linux" ];
     maintainers = with maintainers; [ puffnfresh ];
diff --git a/pkgs/applications/networking/instant-messengers/jitsi/default.nix b/pkgs/applications/networking/instant-messengers/jitsi/default.nix
index 9646738780802..0ef6b2e74d7b8 100644
--- a/pkgs/applications/networking/instant-messengers/jitsi/default.nix
+++ b/pkgs/applications/networking/instant-messengers/jitsi/default.nix
@@ -65,7 +65,10 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://jitsi.org/";
     description = "Open Source Video Calls and Chat";
-    sourceProvenance = with sourceTypes; [ binaryBytecode ];
+    sourceProvenance = with sourceTypes; [
+      binaryBytecode
+      binaryNativeCode
+    ];
     license = licenses.lgpl21Plus;
     platforms = platforms.linux;
     maintainers = teams.jitsi.members;
diff --git a/pkgs/applications/networking/instant-messengers/mattermost-desktop/default.nix b/pkgs/applications/networking/instant-messengers/mattermost-desktop/default.nix
index ba806409e05c6..bb900654d1e8a 100644
--- a/pkgs/applications/networking/instant-messengers/mattermost-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/mattermost-desktop/default.nix
@@ -84,6 +84,7 @@ stdenv.mkDerivation {
   meta = with lib; {
     description = "Mattermost Desktop client";
     homepage = "https://about.mattermost.com/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.asl20;
     platforms = [ "x86_64-linux" "i686-linux" ];
     maintainers = [ maintainers.joko ];
diff --git a/pkgs/applications/networking/instant-messengers/ripcord/darwin.nix b/pkgs/applications/networking/instant-messengers/ripcord/darwin.nix
index ef9dad66b5d65..39403ba774fa3 100644
--- a/pkgs/applications/networking/instant-messengers/ripcord/darwin.nix
+++ b/pkgs/applications/networking/instant-messengers/ripcord/darwin.nix
@@ -25,6 +25,7 @@ stdenvNoCC.mkDerivation rec {
   meta = with lib; {
     description = "Desktop chat client for Slack and Discord";
     homepage = "https://cancel.fm/ripcord/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     # See: https://cancel.fm/ripcord/shareware-redistribution/
     license = licenses.unfreeRedistributable;
     maintainers = with maintainers; [ mikroskeem ];
diff --git a/pkgs/applications/networking/instant-messengers/ripcord/default.nix b/pkgs/applications/networking/instant-messengers/ripcord/default.nix
index 7379d769288bd..7fd0bd9bb1d34 100644
--- a/pkgs/applications/networking/instant-messengers/ripcord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/ripcord/default.nix
@@ -60,6 +60,7 @@ mkDerivation rec {
   meta = with lib; {
     description = "Desktop chat client for Slack and Discord";
     homepage = "https://cancel.fm/ripcord/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     # See: https://cancel.fm/ripcord/shareware-redistribution/
     license = licenses.unfreeRedistributable;
     maintainers = with maintainers; [ infinisil ];
diff --git a/pkgs/applications/networking/instant-messengers/rocketchat-desktop/default.nix b/pkgs/applications/networking/instant-messengers/rocketchat-desktop/default.nix
index 71379039de6f2..d854414a36b63 100644
--- a/pkgs/applications/networking/instant-messengers/rocketchat-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/rocketchat-desktop/default.nix
@@ -89,6 +89,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Official Desktop client for Rocket.Chat";
     homepage = "https://github.com/RocketChat/Rocket.Chat.Electron";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.mit;
     maintainers = with maintainers; [ gbtb ];
     platforms = platforms.x86_64;
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
index c8f57d20ec11a..7d18a8d29252f 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@@ -24,7 +24,7 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "signal-desktop";
-  version = "5.46.0"; # Please backport all updates to the stable channel.
+  version = "5.47.0"; # Please backport all updates to the stable channel.
   # All releases have a limited lifetime and "expire" 90 days after the release.
   # When releases "expire" the application becomes unusable until an update is
   # applied. The expiration date for the current release can be extracted with:
@@ -34,7 +34,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "sha256-zy9nETD82KguML0MXe8hlB4m+fBCMmJ1z/2Neq6QvEU=";
+    sha256 = "sha256-aQpylo4/pbHP2an1w6DEhRmU3uvntN/tnYhvaWtNGGg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/instant-messengers/sky/default.nix b/pkgs/applications/networking/instant-messengers/sky/default.nix
index 464d4d77f9461..e949625875e58 100644
--- a/pkgs/applications/networking/instant-messengers/sky/default.nix
+++ b/pkgs/applications/networking/instant-messengers/sky/default.nix
@@ -59,6 +59,7 @@ mkDerivation rec {
   meta = {
     description = "Lync & Skype for Business on Linux";
     homepage = "https://tel.red/";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.unfree;
     maintainers = [ lib.maintainers.wucke13 ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix b/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
index 024ac9a143182..515290ab91559 100644
--- a/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
@@ -120,6 +120,7 @@ in stdenv.mkDerivation {
   meta = with lib; {
     description = "Linux client for skype";
     homepage = "https://www.skype.com";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     maintainers = with maintainers; [ panaeon jraygauthier ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/networking/instant-messengers/slack/default.nix b/pkgs/applications/networking/instant-messengers/slack/default.nix
index 86ed37e54dc00..953d5134377be 100644
--- a/pkgs/applications/networking/instant-messengers/slack/default.nix
+++ b/pkgs/applications/networking/instant-messengers/slack/default.nix
@@ -80,6 +80,7 @@ let
   meta = with lib; {
     description = "Desktop client for Slack";
     homepage = "https://slack.com";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     maintainers = with maintainers; [ mmahut maxeaubrey ];
     platforms = [ "x86_64-darwin" "x86_64-linux" "aarch64-darwin" ];
diff --git a/pkgs/applications/networking/instant-messengers/teams/default.nix b/pkgs/applications/networking/instant-messengers/teams/default.nix
index 07462b4cc26f8..d7831d3fd5386 100644
--- a/pkgs/applications/networking/instant-messengers/teams/default.nix
+++ b/pkgs/applications/networking/instant-messengers/teams/default.nix
@@ -28,6 +28,7 @@ let
     description = "Microsoft Teams";
     homepage = "https://teams.microsoft.com";
     downloadPage = "https://teams.microsoft.com/downloads";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     maintainers = with maintainers; [ liff tricktron ];
     platforms = [ "x86_64-linux" "x86_64-darwin" "aarch64-darwin" ];
diff --git a/pkgs/applications/networking/instant-messengers/teamspeak/client.nix b/pkgs/applications/networking/instant-messengers/teamspeak/client.nix
index 83139c30075d1..5a0a9006e0df5 100644
--- a/pkgs/applications/networking/instant-messengers/teamspeak/client.nix
+++ b/pkgs/applications/networking/instant-messengers/teamspeak/client.nix
@@ -104,6 +104,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "The TeamSpeak voice communication tool";
     homepage = "https://teamspeak.com/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = {
       fullName = "Teamspeak client license";
       url = "https://www.teamspeak.com/en/privacy-and-terms/";
diff --git a/pkgs/applications/networking/instant-messengers/teamspeak/server.nix b/pkgs/applications/networking/instant-messengers/teamspeak/server.nix
index e027ed656e01a..577589f6a40b0 100644
--- a/pkgs/applications/networking/instant-messengers/teamspeak/server.nix
+++ b/pkgs/applications/networking/instant-messengers/teamspeak/server.nix
@@ -58,6 +58,7 @@ in stdenv.mkDerivation rec {
   meta = with lib; {
     description = "TeamSpeak voice communication server";
     homepage = "https://teamspeak.com/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfreeRedistributable;
     platforms = platforms.linux;
     maintainers = with maintainers; [ arobyn gerschtli ];
diff --git a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
index 0ee0bef5e233e..212092d8a1ff1 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
@@ -71,7 +71,7 @@ let
 in
 env.mkDerivation rec {
   pname = "telegram-desktop";
-  version = "4.0.0";
+  version = "4.0.2";
   # Note: Update via pkgs/applications/networking/instant-messengers/telegram/tdesktop/update.py
 
   # Telegram-Desktop with submodules
@@ -80,7 +80,7 @@ env.mkDerivation rec {
     repo = "tdesktop";
     rev = "v${version}";
     fetchSubmodules = true;
-    sha256 = "16j5rvlqr2bb1dkc7cc920ylhw3sp4qnqvm1aznnnjzcimqb8xf0";
+    sha256 = "07fhm36394171w0rvay1x9x1br3z36z4dlpi57bkq23dvi331pxj";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/networking/instant-messengers/threema-desktop/default.nix b/pkgs/applications/networking/instant-messengers/threema-desktop/default.nix
index 0951f1d3d8e7d..852abe8e6dc45 100644
--- a/pkgs/applications/networking/instant-messengers/threema-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/threema-desktop/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "threema-desktop";
-  version = "1.2.0";
+  version = "1.2.13";
 
   src = fetchurl {
     # As Threema only offers a Latest Release url, the plan is to upload each
     # new release url to web.archive.org until their Github releases page gets populated.
-    url = "https://web.archive.org/web/20220408213031if_/https://releases.threema.ch/web-electron/v1/release/Threema-Latest.deb";
-    sha256 = "7c8e1e76ad82a0cf776eb8b0a683a41a00dc8752bb79a24b0ae9d795fdedcde6";
+    url = "https://web.archive.org/web/20220621152620id_/https://releases.threema.ch/web-electron/v1/release/Threema-Latest.deb";
+    sha256 = "sha256-X16GMxUIKUloj0FxhzWQKUBf4zwfSBVg0cwLgGxHPHE=";
   };
 
   nativeBuildInputs = [
@@ -47,6 +47,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Desktop client for Threema, a privacy-focused end-to-end encrypted mobile messenger";
     homepage = "https://threema.ch";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ wolfangaukang ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/networking/instant-messengers/viber/default.nix b/pkgs/applications/networking/instant-messengers/viber/default.nix
index f8e048edc4b02..be19ec257424b 100644
--- a/pkgs/applications/networking/instant-messengers/viber/default.nix
+++ b/pkgs/applications/networking/instant-messengers/viber/default.nix
@@ -101,6 +101,7 @@ stdenv.mkDerivation {
   meta = {
     homepage = "https://www.viber.com";
     description = "An instant messaging and Voice over IP (VoIP) app";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.unfree;
     platforms = [ "x86_64-linux" ];
     maintainers = with lib.maintainers; [ jagajaga ];
diff --git a/pkgs/applications/networking/instant-messengers/vk-cli/default.nix b/pkgs/applications/networking/instant-messengers/vk-cli/default.nix
index bb34fd7534c95..a22437bf8da00 100644
--- a/pkgs/applications/networking/instant-messengers/vk-cli/default.nix
+++ b/pkgs/applications/networking/instant-messengers/vk-cli/default.nix
@@ -47,6 +47,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "A console (ncurses) client for vk.com written in D";
     homepage = "https://github.com/vk-cli/vk";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.asl20;
     maintainers = with maintainers; [ dan4ik605743 ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/networking/instant-messengers/vk-messenger/default.nix b/pkgs/applications/networking/instant-messengers/vk-messenger/default.nix
index 5fb0f14f36a04..1d249794d4431 100644
--- a/pkgs/applications/networking/instant-messengers/vk-messenger/default.nix
+++ b/pkgs/applications/networking/instant-messengers/vk-messenger/default.nix
@@ -24,6 +24,7 @@ let
   meta = with lib; {
     description = "Simple and Convenient Messaging App for VK";
     homepage = "https://vk.com/messenger";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     maintainers = [ ];
     platforms = ["i686-linux" "x86_64-linux" "x86_64-darwin"];
diff --git a/pkgs/applications/networking/instant-messengers/wire-desktop/default.nix b/pkgs/applications/networking/instant-messengers/wire-desktop/default.nix
index 4d7a2218e7dfa..304d1bf4255c8 100644
--- a/pkgs/applications/networking/instant-messengers/wire-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/wire-desktop/default.nix
@@ -47,6 +47,7 @@ let
     '';
     homepage = "https://wire.com/";
     downloadPage = "https://wire.com/download/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [
       arianvp
diff --git a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
index 06f9a2d3e8ee7..37f3c99251067 100644
--- a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
@@ -183,6 +183,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://zoom.us/";
     description = "zoom.us video conferencing application";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     platforms = builtins.attrNames srcs;
     maintainers = with maintainers; [ danbst tadfisher doronbehar ];
diff --git a/pkgs/applications/networking/insync/default.nix b/pkgs/applications/networking/insync/default.nix
index 380aad6c32914..5992453975d94 100644
--- a/pkgs/applications/networking/insync/default.nix
+++ b/pkgs/applications/networking/insync/default.nix
@@ -26,6 +26,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     platforms = ["x86_64-linux"];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.unfree;
     maintainers = [ lib.maintainers.benley ];
     homepage = "https://www.insynchq.com";
diff --git a/pkgs/applications/networking/insync/v3.nix b/pkgs/applications/networking/insync/v3.nix
index 49a5b892111e5..5efffab51c6cd 100644
--- a/pkgs/applications/networking/insync/v3.nix
+++ b/pkgs/applications/networking/insync/v3.nix
@@ -67,6 +67,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     platforms = ["x86_64-linux"];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     maintainers = with maintainers; [ benley ];
     homepage = "https://www.insynchq.com";
diff --git a/pkgs/applications/networking/mailreaders/mailspring/default.nix b/pkgs/applications/networking/mailreaders/mailspring/default.nix
index 4bc80b84b8470..539e69069f35d 100644
--- a/pkgs/applications/networking/mailreaders/mailspring/default.nix
+++ b/pkgs/applications/networking/mailreaders/mailspring/default.nix
@@ -91,6 +91,7 @@ stdenv.mkDerivation rec {
       Mailspring is an open-source mail client forked from Nylas Mail and built with Electron.
       Mailspring's sync engine runs locally, but its source is not open.
     '';
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ toschmidt doronbehar ];
     homepage = "https://getmailspring.com";
diff --git a/pkgs/applications/networking/mailreaders/thunderbird-bin/default.nix b/pkgs/applications/networking/mailreaders/thunderbird-bin/default.nix
index e4e5332e07f33..ba4edfd916f46 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird-bin/default.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird-bin/default.nix
@@ -206,6 +206,7 @@ stdenv.mkDerivation {
   meta = with lib; {
     description = "Mozilla Thunderbird, a full-featured email client (binary package)";
     homepage = "http://www.mozilla.org/thunderbird/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.mpl20;
     maintainers = with lib.maintainers; [ lovesegfault ];
     platforms = builtins.attrNames mozillaPlatforms;
diff --git a/pkgs/applications/networking/mullvad-vpn/default.nix b/pkgs/applications/networking/mullvad-vpn/default.nix
index cf22d8804068d..97dc48f6e0d06 100644
--- a/pkgs/applications/networking/mullvad-vpn/default.nix
+++ b/pkgs/applications/networking/mullvad-vpn/default.nix
@@ -89,6 +89,7 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/mullvad/mullvadvpn-app";
     description = "Client for Mullvad VPN";
     changelog = "https://github.com/mullvad/mullvadvpn-app/blob/${version}/CHANGELOG.md";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.gpl3Only;
     platforms = [ "x86_64-linux" ];
     maintainers = with maintainers; [ Br1ght0ne ymarkus flexagoon ];
diff --git a/pkgs/applications/networking/p2p/frostwire/frostwire-bin.nix b/pkgs/applications/networking/p2p/frostwire/frostwire-bin.nix
index 8de78c580aaee..fd5424cee3424 100644
--- a/pkgs/applications/networking/p2p/frostwire/frostwire-bin.nix
+++ b/pkgs/applications/networking/p2p/frostwire/frostwire-bin.nix
@@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl, jre, makeWrapper }:
 
 stdenv.mkDerivation rec {
-  version = "6.9.7";
+  version = "6.9.8";
   pname = "frostwire";
 
   src = fetchurl {
     url = "https://dl.frostwire.com/frostwire/${version}/frostwire-${version}.amd64.tar.gz";
-    sha256 = "sha256-LsmDfNAj10x+txJ4PugyF3Irj/N1reb3ChTvFFIucdc=";
+    sha256 = "sha256-gslNdvxA4rGKg0bjf2KWw7w9NMp3zqrii144AfKsV4s=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
@@ -35,7 +35,10 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://www.frostwire.com/";
     description = "BitTorrent Client and Cloud File Downloader";
-    sourceProvenance = with sourceTypes; [ binaryBytecode ];
+    sourceProvenance = with sourceTypes; [
+      binaryBytecode
+      binaryNativeCode
+    ];
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ gavin ];
     platforms = [ "x86_64-linux"];
diff --git a/pkgs/applications/networking/p2p/jesec-rtorrent/default.nix b/pkgs/applications/networking/p2p/jesec-rtorrent/default.nix
index a760a0f96c35c..df314b6591c20 100644
--- a/pkgs/applications/networking/p2p/jesec-rtorrent/default.nix
+++ b/pkgs/applications/networking/p2p/jesec-rtorrent/default.nix
@@ -21,6 +21,10 @@ stdenv.mkDerivation rec {
     hash = "sha256-i7c1jSawHshj1kaXl8tdpelIKU24okeg9K5/+ht6t2k=";
   };
 
+  passthru = {
+    inherit libtorrent;
+  };
+
   nativeBuildInputs = [
     cmake
   ];
diff --git a/pkgs/applications/networking/p2p/rakshasa-rtorrent/default.nix b/pkgs/applications/networking/p2p/rakshasa-rtorrent/default.nix
index f166f6d0e29f2..fa459137f1994 100644
--- a/pkgs/applications/networking/p2p/rakshasa-rtorrent/default.nix
+++ b/pkgs/applications/networking/p2p/rakshasa-rtorrent/default.nix
@@ -27,6 +27,10 @@ stdenv.mkDerivation rec {
     hash = "sha256-HTwAs8dfZVXfLRNiT6QpjKGnuahHfoMfYWqdKkedUL0=";
   };
 
+  passthru = {
+    inherit libtorrent;
+  };
+
   nativeBuildInputs = [
     autoconf-archive
     autoreconfHook
diff --git a/pkgs/applications/networking/p2p/soulseekqt/default.nix b/pkgs/applications/networking/p2p/soulseekqt/default.nix
index 0d2fc0fd833cd..c281756bed357 100644
--- a/pkgs/applications/networking/p2p/soulseekqt/default.nix
+++ b/pkgs/applications/networking/p2p/soulseekqt/default.nix
@@ -52,6 +52,7 @@ mkDerivation rec {
   meta = with lib; {
     description = "Official Qt SoulSeek client";
     homepage = "https://www.slsknet.org";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     maintainers = [ ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/networking/p2p/tixati/default.nix b/pkgs/applications/networking/p2p/tixati/default.nix
index 9a0cc70c1999e..bafbb443458aa 100644
--- a/pkgs/applications/networking/p2p/tixati/default.nix
+++ b/pkgs/applications/networking/p2p/tixati/default.nix
@@ -23,6 +23,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Torrent client";
     homepage = "http://www.tixati.com";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     platforms = [ "x86_64-linux" ];
     maintainers = with maintainers; [ volth ];
diff --git a/pkgs/applications/networking/pcloud/default.nix b/pkgs/applications/networking/pcloud/default.nix
index 50a26ef50f6a3..4cb3a43640cca 100644
--- a/pkgs/applications/networking/pcloud/default.nix
+++ b/pkgs/applications/networking/pcloud/default.nix
@@ -104,6 +104,7 @@ in stdenv.mkDerivation {
   meta = with lib; {
     description = "Secure and simple to use cloud storage for your files; pCloud Drive, Electron Edition";
     homepage = "https://www.pcloud.com/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     maintainers = with maintainers; [ patryk27 ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/networking/remote/anydesk/default.nix b/pkgs/applications/networking/remote/anydesk/default.nix
index 54d7c5c6813aa..69276c229b3c2 100644
--- a/pkgs/applications/networking/remote/anydesk/default.nix
+++ b/pkgs/applications/networking/remote/anydesk/default.nix
@@ -18,14 +18,14 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "anydesk";
-  version = "6.1.1";
+  version = "6.2.0";
 
   src = fetchurl {
     urls = [
       "https://download.anydesk.com/linux/${pname}-${version}-amd64.tar.gz"
       "https://download.anydesk.com/linux/generic-linux/${pname}-${version}-amd64.tar.gz"
     ];
-    sha256 = "1ai58fsivb8al1279bayl800qavy0kfj40rjhf87g902ap3p4bhh";
+    sha256 = "k85nQH2FWyEXDgB+Pd4yStfNCjkiIGE2vA/YTXLaK4o=";
   };
 
   passthru = {
@@ -85,6 +85,7 @@ in stdenv.mkDerivation rec {
   meta = with lib; {
     inherit description;
     homepage = "https://www.anydesk.com";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     platforms = [ "x86_64-linux" ];
     maintainers = with maintainers; [ shyim ];
diff --git a/pkgs/applications/networking/remote/aws-workspaces/default.nix b/pkgs/applications/networking/remote/aws-workspaces/default.nix
index 48b44656ff0af..4eea552810b51 100644
--- a/pkgs/applications/networking/remote/aws-workspaces/default.nix
+++ b/pkgs/applications/networking/remote/aws-workspaces/default.nix
@@ -65,6 +65,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Client for Amazon WorkSpaces, a managed, secure Desktop-as-a-Service (DaaS) solution";
     homepage = "https://clients.amazonworkspaces.com";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     platforms = [ "x86_64-linux" ]; # TODO Mac support
     maintainers = [ maintainers.mausch ];
diff --git a/pkgs/applications/networking/remote/citrix-workspace/generic.nix b/pkgs/applications/networking/remote/citrix-workspace/generic.nix
index 1ecf805944e25..5051d2308f02c 100644
--- a/pkgs/applications/networking/remote/citrix-workspace/generic.nix
+++ b/pkgs/applications/networking/remote/citrix-workspace/generic.nix
@@ -206,6 +206,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     license = licenses.unfree;
     description = "Citrix Workspace";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     platforms = platforms.linux;
     maintainers = with maintainers; [ pmenke michaeladler ];
     inherit homepage;
diff --git a/pkgs/applications/networking/remote/nice-dcv-client/default.nix b/pkgs/applications/networking/remote/nice-dcv-client/default.nix
index 20b850328875b..23b2727d695d6 100644
--- a/pkgs/applications/networking/remote/nice-dcv-client/default.nix
+++ b/pkgs/applications/networking/remote/nice-dcv-client/default.nix
@@ -79,6 +79,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "High-performance remote display protocol";
     homepage = "https://aws.amazon.com/hpc/dcv/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     platforms = [ "x86_64-linux" ];
     maintainers = with maintainers; [ rmcgibbo ];
diff --git a/pkgs/applications/networking/remote/teamviewer/default.nix b/pkgs/applications/networking/remote/teamviewer/default.nix
index ba6d3d3c0f854..5aa6d62209579 100644
--- a/pkgs/applications/networking/remote/teamviewer/default.nix
+++ b/pkgs/applications/networking/remote/teamviewer/default.nix
@@ -96,6 +96,7 @@ mkDerivation rec {
 
   meta = with lib; {
     homepage = "https://www.teamviewer.com";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     description = "Desktop sharing application, providing remote support and online meetings";
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/networking/resilio-sync/default.nix b/pkgs/applications/networking/resilio-sync/default.nix
index bbce0e1d350e3..35b4fa3aef43a 100644
--- a/pkgs/applications/networking/resilio-sync/default.nix
+++ b/pkgs/applications/networking/resilio-sync/default.nix
@@ -34,6 +34,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Automatically sync files via secure, distributed technology";
     homepage    = "https://www.resilio.com/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license     = licenses.unfreeRedistributable;
     platforms   = platforms.linux;
     maintainers = with maintainers; [ domenkozar thoughtpolice cwoac ];
diff --git a/pkgs/applications/networking/scaleft/default.nix b/pkgs/applications/networking/scaleft/default.nix
index 6dca196948d7a..1f340a703611b 100644
--- a/pkgs/applications/networking/scaleft/default.nix
+++ b/pkgs/applications/networking/scaleft/default.nix
@@ -34,6 +34,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "ScaleFT provides Zero Trust software which you can use to secure your internal servers and services";
     homepage = "https://www.scaleft.com";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     maintainers = with maintainers; [ jloyet ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/networking/sniffers/sngrep/default.nix b/pkgs/applications/networking/sniffers/sngrep/default.nix
index 401d6dfa32cdb..558c7ef864611 100644
--- a/pkgs/applications/networking/sniffers/sngrep/default.nix
+++ b/pkgs/applications/networking/sniffers/sngrep/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sngrep";
-  version = "1.4.10";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "irontec";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-P618QLk85W0oPisAGiRfpCgHCddKutUkGjwdfgsV4Es=";
+    sha256 = "sha256-GxC9+O72GHE8Tc6FReO7EdpZTSaqn9mBpZCYaKybJls=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/spideroak/default.nix b/pkgs/applications/networking/spideroak/default.nix
index 8c0fdfa3b9a7d..0bfc62ccfbb2b 100644
--- a/pkgs/applications/networking/spideroak/default.nix
+++ b/pkgs/applications/networking/spideroak/default.nix
@@ -53,6 +53,7 @@ in stdenv.mkDerivation {
   meta = {
     homepage = "https://spideroak.com";
     description = "Secure online backup and sychronization";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.unfree;
     maintainers = with lib.maintainers; [ amorsillo ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/applications/networking/sync/onedrive/default.nix b/pkgs/applications/networking/sync/onedrive/default.nix
index a76be3d318c3c..7b6316631e89c 100644
--- a/pkgs/applications/networking/sync/onedrive/default.nix
+++ b/pkgs/applications/networking/sync/onedrive/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "onedrive";
-  version = "2.4.17";
+  version = "2.4.19";
 
   src = fetchFromGitHub {
     owner = "abraunegg";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-+ADAPxAZNDqLKLz6rAProqSDINDiTZhc2trxJFFMQeA=";
+    hash = "sha256-7kX7gC/1jSZGgV3ZhfebMIn/Y5gXkz22GDP2zpiwUZ4=";
   };
 
   nativeBuildInputs = [ autoreconfHook ldc installShellFiles pkg-config ];
diff --git a/pkgs/applications/networking/syncthing-gtk/paths.patch b/pkgs/applications/networking/syncthing-gtk/paths.patch
deleted file mode 100644
index 0ba5a4f2db84e..0000000000000
--- a/pkgs/applications/networking/syncthing-gtk/paths.patch
+++ /dev/null
@@ -1,22 +0,0 @@
---- a/syncthing_gtk/configuration.py
-+++ b/syncthing_gtk/configuration.py
-@@ -30,7 +30,7 @@
- 		"autokill_daemon"			: (int, 2),	# 0 - never kill, 1 - always kill, 2 - ask
- 		"daemon_priority"			: (int, 0), # uses nice values
- 		"max_cpus"					: (int, 0), # 0 for all cpus
--		"syncthing_binary"			: (str, "/usr/bin/syncthing"),
-+		"syncthing_binary"			: (str, "@syncthing@"),
- 		"syncthing_arguments"		: (str, ""),
- 		"minimize_on_start"			: (bool, False),
- 		"folder_as_path"			: (bool, True),
---- a/syncthing_gtk/tools.py
-+++ b/syncthing_gtk/tools.py
-@@ -303,7 +303,7 @@
- 			return False
- 		# signal 0 doesn't kill anything, but killall exits with 1 if
- 		# named process is not found
--		p = Popen(["killall", "-u", os.environ["USER"], "-q", "-s", "0", "syncthing"])
-+		p = Popen(["@killall@", "-u", os.environ["USER"], "-q", "-s", "0", "syncthing"])
- 		p.communicate()
- 		return p.returncode == 0
- 	else:
diff --git a/pkgs/applications/networking/synology-drive-client/default.nix b/pkgs/applications/networking/synology-drive-client/default.nix
index 3184c192b127f..69468c0a4df0d 100644
--- a/pkgs/applications/networking/synology-drive-client/default.nix
+++ b/pkgs/applications/networking/synology-drive-client/default.nix
@@ -7,6 +7,7 @@ let
   meta = with lib; {
     description = "Desktop application to synchronize files and folders between the computer and the Synology Drive server.";
     homepage = "https://www.synology.com/en-global/dsm/feature/drive";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     maintainers = with maintainers; [ jcouyang MoritzBoehme ];
     platforms = [ "x86_64-linux" "x86_64-darwin" ];
diff --git a/pkgs/applications/networking/termius/default.nix b/pkgs/applications/networking/termius/default.nix
index 0d4824fb55875..6a8960367be76 100644
--- a/pkgs/applications/networking/termius/default.nix
+++ b/pkgs/applications/networking/termius/default.nix
@@ -75,6 +75,7 @@ stdenv.mkDerivation rec {
     description = "A cross-platform SSH client with cloud data sync and more";
     homepage = "https://termius.com/";
     downloadPage = "https://termius.com/linux/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     maintainers = with maintainers; [ Br1ght0ne th0rgal ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/networking/tetrd/default.nix b/pkgs/applications/networking/tetrd/default.nix
index 937992a63d718..a9ccf1d2774ff 100644
--- a/pkgs/applications/networking/tetrd/default.nix
+++ b/pkgs/applications/networking/tetrd/default.nix
@@ -78,6 +78,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Share your internet connection from your device to your PC and vice versa through a USB cable";
     homepage = "https://tetrd.app";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     platforms = [ "x86_64-linux" ];
     maintainers = with maintainers; [ Madouura ];
diff --git a/pkgs/applications/office/appflowy/default.nix b/pkgs/applications/office/appflowy/default.nix
index 821447fdfa265..82ae850065d89 100644
--- a/pkgs/applications/office/appflowy/default.nix
+++ b/pkgs/applications/office/appflowy/default.nix
@@ -69,6 +69,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "An open-source alternative to Notion";
     homepage = "https://www.appflowy.io/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.agpl3Only;
     changelog = "https://github.com/AppFlowy-IO/appflowy/releases/tag/${version}";
     maintainers = with maintainers; [ darkonion0 ];
diff --git a/pkgs/applications/office/jabref/default.nix b/pkgs/applications/office/jabref/default.nix
index 4ebfd7965954a..8d1f639622da9 100644
--- a/pkgs/applications/office/jabref/default.nix
+++ b/pkgs/applications/office/jabref/default.nix
@@ -66,6 +66,7 @@ stdenv.mkDerivation rec {
     broken = (stdenv.isLinux && stdenv.isAarch64);
     description = "Open source bibliography reference manager";
     homepage = "https://www.jabref.org";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.gpl2;
     platforms = platforms.unix;
     maintainers = [ maintainers.gebner ];
diff --git a/pkgs/applications/office/libreoffice/default.nix b/pkgs/applications/office/libreoffice/default.nix
index 6244b0fbc8cd4..a75c094521352 100644
--- a/pkgs/applications/office/libreoffice/default.nix
+++ b/pkgs/applications/office/libreoffice/default.nix
@@ -121,7 +121,7 @@ let
     optional optionals optionalString;
 
   jre' = jre_minimal.override {
-    modules = [ "java.base" "java.desktop" "java.logging" ];
+    modules = [ "java.base" "java.desktop" "java.logging" "java.sql" ];
   };
 
   importVariant = f: import (./. + "/src-${variant}/${f}");
diff --git a/pkgs/applications/office/mendeley/default.nix b/pkgs/applications/office/mendeley/default.nix
index 3b9963d8dbc7d..e204e04008ca8 100644
--- a/pkgs/applications/office/mendeley/default.nix
+++ b/pkgs/applications/office/mendeley/default.nix
@@ -139,6 +139,7 @@ mkDerivation {
   meta = with lib; {
     homepage = "https://www.mendeley.com";
     description = "A reference manager and academic social network";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     platforms = [ "x86_64-linux" "i686-linux" ];
     maintainers  = with maintainers; [ dtzWill ];
diff --git a/pkgs/applications/office/moneyplex/default.nix b/pkgs/applications/office/moneyplex/default.nix
index 4038f5fd435a0..742e4dc9e2930 100644
--- a/pkgs/applications/office/moneyplex/default.nix
+++ b/pkgs/applications/office/moneyplex/default.nix
@@ -114,6 +114,7 @@ stdenv.mkDerivation {
   meta = with lib; {
     description = "Moneyplex online banking software";
     maintainers = with maintainers; [ tstrobel ];
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     platforms = platforms.linux;
     license = licenses.unfree;
     downloadPage = "http://matrica.de/download/download.html";
diff --git a/pkgs/applications/office/morgen/default.nix b/pkgs/applications/office/morgen/default.nix
index e3390e54ee397..0e5332b953e59 100644
--- a/pkgs/applications/office/morgen/default.nix
+++ b/pkgs/applications/office/morgen/default.nix
@@ -52,6 +52,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "All-in-one Calendars, Tasks and Scheduler";
     homepage = "https://morgen.so/download";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     maintainers = with maintainers; [ wolfangaukang ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/office/onlyoffice-bin/default.nix b/pkgs/applications/office/onlyoffice-bin/default.nix
index 214b8376d8d6b..8e1b7eb790204 100644
--- a/pkgs/applications/office/onlyoffice-bin/default.nix
+++ b/pkgs/applications/office/onlyoffice-bin/default.nix
@@ -171,6 +171,7 @@ stdenv.mkDerivation rec {
     downloadPage = "https://github.com/ONLYOFFICE/DesktopEditors/releases";
     changelog = "https://github.com/ONLYOFFICE/DesktopEditors/blob/master/CHANGELOG.md";
     platforms = [ "x86_64-linux" ];
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.agpl3Plus;
     maintainers = with maintainers; [ nh2 gtrunsec ];
   };
diff --git a/pkgs/applications/office/portfolio/default.nix b/pkgs/applications/office/portfolio/default.nix
index 12d7dc0dcbf30..30da3b3520459 100644
--- a/pkgs/applications/office/portfolio/default.nix
+++ b/pkgs/applications/office/portfolio/default.nix
@@ -25,11 +25,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "PortfolioPerformance";
-  version = "0.58.4";
+  version = "0.58.5";
 
   src = fetchurl {
     url = "https://github.com/buchen/portfolio/releases/download/${version}/PortfolioPerformance-${version}-linux.gtk.x86_64.tar.gz";
-    sha256 = "sha256-Png9OcO5dzoeKp826FwdM7zkovuOnSYMnGw5weT2eJU=";
+    sha256 = "sha256-7olUx0JmztNb6uFsxKwOkBqkbMEiy2vb+iHqBe5I1PM=";
   };
 
   nativeBuildInputs = [
@@ -61,6 +61,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "A simple tool to calculate the overall performance of an investment portfolio";
     homepage = "https://www.portfolio-performance.info/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.epl10;
     maintainers = with maintainers; [ elohmeier oyren shawn8901 ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/office/qownnotes/default.nix b/pkgs/applications/office/qownnotes/default.nix
index 3fd9c3410693a..7df8a607f4dfa 100644
--- a/pkgs/applications/office/qownnotes/default.nix
+++ b/pkgs/applications/office/qownnotes/default.nix
@@ -5,13 +5,13 @@
 
 mkDerivation rec {
   pname = "qownnotes";
-  version = "22.5.0";
+  version = "22.6.1";
 
   src = fetchurl {
     url = "https://download.tuxfamily.org/${pname}/src/${pname}-${version}.tar.xz";
     # Fetch the checksum of current version with curl:
     # curl https://download.tuxfamily.org/qownnotes/src/qownnotes-<version>.tar.xz.sha256
-    sha256 = "52a81401a4a03c77e28f37f56c3ebdc6696ff43c75cc9330d10ba7e801f48ccd";
+    sha256 = "c5b2075d42298d28f901ad2df8eb65f5a61aa59727fae9eeb1f92dac1b63d8ba";
   };
 
   nativeBuildInputs = [ qmake qttools ];
diff --git a/pkgs/applications/office/softmaker/generic.nix b/pkgs/applications/office/softmaker/generic.nix
index 3c139e1eead73..6162aa2326062 100644
--- a/pkgs/applications/office/softmaker/generic.nix
+++ b/pkgs/applications/office/softmaker/generic.nix
@@ -122,6 +122,7 @@ in stdenv.mkDerivation {
   meta = with lib; {
     description = "An office suite with a word processor, spreadsheet and presentation program";
     homepage = "https://www.softmaker.com/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     maintainers = with maintainers; [ ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/office/wpsoffice/default.nix b/pkgs/applications/office/wpsoffice/default.nix
index 46f2569b13ab2..d909b26526a90 100644
--- a/pkgs/applications/office/wpsoffice/default.nix
+++ b/pkgs/applications/office/wpsoffice/default.nix
@@ -61,6 +61,7 @@ stdenv.mkDerivation rec {
     homepage = "https://www.wps.com/";
     platforms = [ "x86_64-linux" ];
     hydraPlatforms = [];
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfreeRedistributable;
     maintainers = with maintainers; [ mlatus th0rgal ];
   };
diff --git a/pkgs/applications/office/zotero/default.nix b/pkgs/applications/office/zotero/default.nix
index b39fe00f2e091..b5c1467f69182 100644
--- a/pkgs/applications/office/zotero/default.nix
+++ b/pkgs/applications/office/zotero/default.nix
@@ -149,6 +149,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://www.zotero.org";
     description = "Collect, organize, cite, and share your research sources";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.agpl3Only;
     platforms = platforms.linux;
     maintainers = with maintainers; [ i077 ];
diff --git a/pkgs/applications/radio/gnuradio/3.9.nix b/pkgs/applications/radio/gnuradio/3.9.nix
index 989722fdc3ecd..d607823bfeec4 100644
--- a/pkgs/applications/radio/gnuradio/3.9.nix
+++ b/pkgs/applications/radio/gnuradio/3.9.nix
@@ -46,13 +46,13 @@
 , pname ? "gnuradio"
 , versionAttr ? {
   major = "3.9";
-  minor = "6";
+  minor = "7";
   patch = "0";
 }
 }:
 
 let
-  sourceSha256 = "sha256-0JODgv9MNOkHDQYTVCZMzjr/G542+NvGP9wlH9iwLeg=";
+  sourceSha256 = "sha256-6HEvQsV2JCkgNvBYsy1jfSTUIwEnrKJTzXNIVcPeWFQ=";
   featuresInfo = {
     # Needed always
     basic = {
diff --git a/pkgs/applications/radio/gnuradio/default.nix b/pkgs/applications/radio/gnuradio/default.nix
index 14a4763259fa9..8a9ca156ec1a8 100644
--- a/pkgs/applications/radio/gnuradio/default.nix
+++ b/pkgs/applications/radio/gnuradio/default.nix
@@ -48,13 +48,13 @@
 , pname ? "gnuradio"
 , versionAttr ? {
   major = "3.10";
-  minor = "2";
+  minor = "3";
   patch = "0";
 }
 }:
 
 let
-  sourceSha256 = "sha256-WcfmW39wHhFdpbdBSjOfuDkxL8/fuMjjJoLUyCUud/o=";
+  sourceSha256 = "sha256-pH0nvZBUto9jXSN6fXD5vP1lIBwCMuFAvF2qT5dYsHU=";
   featuresInfo = {
     # Needed always
     basic = {
diff --git a/pkgs/applications/radio/js8call/cmake.patch b/pkgs/applications/radio/js8call/cmake.patch
new file mode 100644
index 0000000000000..04552eac40ecc
--- /dev/null
+++ b/pkgs/applications/radio/js8call/cmake.patch
@@ -0,0 +1,69 @@
+diff --git a/CMake/Modules/Findhamlib.cmake b/CMake/Modules/Findhamlib.cmake
+index 1590f05..e797851 100644
+--- a/CMake/Modules/Findhamlib.cmake
++++ b/CMake/Modules/Findhamlib.cmake
+@@ -47,7 +47,7 @@ if (NOT PC_HAMLIB_FOUND)
+ 
+   # libusb-1.0 has no pkg-config file on Windows so we have to find it
+   # ourselves
+-  find_library (LIBUSB NAMES usb-1.0 PATH_SUFFIXES MinGW32/dll)
++  find_library (LIBUSB NAMES libusb-1.0 usb-1.0 PATH_SUFFIXES MinGW32/dll)
+   if (LIBUSB)
+     set (hamlib_EXTRA_LIBRARIES ${LIBUSB} ${hamlib_EXTRA_LIBRARIES})
+     get_filename_component (hamlib_libusb_path ${LIBUSB} PATH)
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 75b80b3..7c04265 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -558,7 +558,6 @@ find_package (FFTW3 COMPONENTS double single threads REQUIRED)
+ #
+ # libhamlib setup
+ #
+-set (hamlib_STATIC 1)
+ find_package (hamlib 3 REQUIRED)
+ find_program (RIGCTL_EXE rigctl)
+ find_program (RIGCTLD_EXE rigctld)
+@@ -576,6 +576,7 @@ message (STATUS "hamlib_LIBRARY_DIRS: ${hamlib_LIBRARY_DIRS}")
+ find_package (Qt5Widgets 5 REQUIRED)
+ find_package (Qt5Multimedia 5 REQUIRED)
+ find_package (Qt5PrintSupport 5 REQUIRED)
++find_package (Qt5SerialPort 5 REQUIRED)
+ 
+ if (WIN32)
+   add_definitions (-DQT_NEEDS_QTMAIN)
+@@ -849,7 +850,7 @@ target_link_libraries (qcp Qt5::Widgets Qt5::PrintSupport)
+ add_library (wsjt_qt STATIC ${wsjt_qt_CXXSRCS} ${wsjt_qt_GENUISRCS} ${GENAXSRCS})
+ # set wsjtx_udp exports to static variants
+ target_compile_definitions (wsjt_qt PUBLIC UDP_STATIC_DEFINE)
+-target_link_libraries (wsjt_qt qcp Qt5::Widgets Qt5::Network)
++target_link_libraries (wsjt_qt qcp Qt5::Widgets Qt5::Network Qt5::SerialPort)
+ target_include_directories (wsjt_qt BEFORE PRIVATE ${hamlib_INCLUDE_DIRS})
+ if (WIN32)
+   target_link_libraries (wsjt_qt Qt5::AxContainer Qt5::AxBase)
+@@ -959,7 +960,6 @@ else ()
+       )
+   endif ()
+ endif ()
+-qt5_use_modules (js8call SerialPort) # not sure why the interface link library syntax above doesn't work
+ 
+ # if (UNIX)
+ #   if (NOT WSJT_SKIP_MANPAGES)
+@@ -1292,3 +1292,5 @@ configure_file ("${PROJECT_SOURCE_DIR}/CMakeCPackOptions.cmake.in"
+ set (CPACK_PROJECT_CONFIG_FILE "${PROJECT_BINARY_DIR}/CMakeCPackOptions.cmake")
+ 
+ include (CPack)
++
++add_definitions (-DJS8_USE_HAMLIB_THREE)
+diff --git a/Configuration.cpp b/Configuration.cpp
+index 8258f97..63a29bb 100644
+--- a/Configuration.cpp
++++ b/Configuration.cpp
+@@ -160,7 +160,7 @@
+ #include <QFont>
+ #include <QFontDialog>
+ #include <QColorDialog>
+-#include <QSerialPortInfo>
++#include <QtSerialPort/QSerialPortInfo>
+ #include <QScopedPointer>
+ #include <QDateTimeEdit>
+ #include <QProcess>
diff --git a/pkgs/applications/radio/js8call/default.nix b/pkgs/applications/radio/js8call/default.nix
new file mode 100644
index 0000000000000..e89d3445697f4
--- /dev/null
+++ b/pkgs/applications/radio/js8call/default.nix
@@ -0,0 +1,65 @@
+{ lib
+, stdenv
+, fetchFromBitbucket
+, wrapQtAppsHook
+, pkg-config
+, hamlib
+, libusb1
+, cmake
+, gfortran
+, fftw
+, fftwFloat
+, qtbase
+, qtmultimedia
+, qtserialport
+}:
+
+stdenv.mkDerivation rec {
+  pname = "js8call";
+  version = "2.2.0";
+
+  src = fetchFromBitbucket {
+    owner = "widefido";
+    repo = pname;
+    rev = "v${version}-ga";
+    sha256 = "sha256-mFPhiAAibCiAkLrysAmIQalVCGd9ips2lqbAsowYprY=";
+  };
+
+  nativeBuildInputs = [
+    wrapQtAppsHook
+    gfortran
+    pkg-config
+    cmake
+  ];
+
+  buildInputs = [
+    hamlib
+    libusb1
+    fftw
+    fftwFloat
+    qtbase
+    qtmultimedia
+    qtserialport
+  ];
+
+  prePatch = ''
+    substituteInPlace CMakeLists.txt \
+        --replace "/usr/share/applications" "$out/share/applications" \
+        --replace "/usr/share/pixmaps" "$out/share/pixmaps" \
+        --replace "/usr/bin/" "$out/bin"
+  '';
+
+  patches = [ ./cmake.patch ];
+
+  meta = with lib; {
+    description = "Weak-signal keyboard messaging for amateur radio";
+    longDescription = ''
+      JS8Call is software using the JS8 Digital Mode providing weak signal
+      keyboard to keyboard messaging to Amateur Radio Operators.
+    '';
+    homepage = "http://js8call.com/";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ melling ];
+  };
+}
diff --git a/pkgs/applications/radio/sdrplay/default.nix b/pkgs/applications/radio/sdrplay/default.nix
index 441ff1cf0f3d3..699389dd2d34b 100644
--- a/pkgs/applications/radio/sdrplay/default.nix
+++ b/pkgs/applications/radio/sdrplay/default.nix
@@ -44,6 +44,7 @@ in stdenv.mkDerivation rec {
       https://www.sdrplay.com/docs/SDRplay_API_Specification_v${lib.concatStringsSep "." (lib.take 2 (builtins.splitVersion version))}.pdf
     '';
     homepage = "https://www.sdrplay.com/downloads/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     maintainers = [ maintainers.pmenke ];
     platforms = platforms.linux;
diff --git a/pkgs/applications/science/biology/flywheel-cli/default.nix b/pkgs/applications/science/biology/flywheel-cli/default.nix
index 7db8b0066263a..7d74b51f6066f 100644
--- a/pkgs/applications/science/biology/flywheel-cli/default.nix
+++ b/pkgs/applications/science/biology/flywheel-cli/default.nix
@@ -42,6 +42,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Library and command line interface for interacting with a Flywheel site";
     homepage = "https://gitlab.com/flywheel-io/public/python-cli";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.mit;
     maintainers = with maintainers; [ rbreslow ];
     platforms = [ "x86_64-darwin" "x86_64-linux" ];
diff --git a/pkgs/applications/science/biology/quast/default.nix b/pkgs/applications/science/biology/quast/default.nix
index ed3fc116ddaba..0a33c97673196 100644
--- a/pkgs/applications/science/biology/quast/default.nix
+++ b/pkgs/applications/science/biology/quast/default.nix
@@ -49,6 +49,10 @@ pythonPackages.buildPythonApplication rec {
   meta = with lib ; {
     description = "Evaluates genome assemblies by computing various metrics";
     homepage = "https://github.com/ablab/quast";
+    sourceProvenance = with sourceTypes; [
+      fromSource
+      binaryNativeCode  # source bundles binary dependencies
+    ];
     license = licenses.gpl2;
     maintainers = [ maintainers.bzizou ];
     platforms = platforms.all;
diff --git a/pkgs/applications/science/electronics/bitscope/common.nix b/pkgs/applications/science/electronics/bitscope/common.nix
index 49415ea048413..2018878773ef0 100644
--- a/pkgs/applications/science/electronics/bitscope/common.nix
+++ b/pkgs/applications/science/electronics/bitscope/common.nix
@@ -24,6 +24,7 @@ let
 
     meta = with lib; {
       homepage = "http://bitscope.com/software/";
+      sourceProvenance = with sourceTypes; [ binaryNativeCode ];
       license = licenses.unfree;
       platforms = [ "x86_64-linux" ];
       maintainers = with maintainers; [
diff --git a/pkgs/applications/science/electronics/eagle/eagle.nix b/pkgs/applications/science/electronics/eagle/eagle.nix
index 5b4c8eb790fe6..6302c2dbfa384 100644
--- a/pkgs/applications/science/electronics/eagle/eagle.nix
+++ b/pkgs/applications/science/electronics/eagle/eagle.nix
@@ -73,6 +73,7 @@ let
     meta = with lib; {
       description = "Schematic editor and PCB layout tool from Autodesk (formerly CadSoft)";
       homepage = "https://www.autodesk.com/products/eagle/overview";
+      sourceProvenance = with sourceTypes; [ binaryNativeCode ];
       license = licenses.unfree;
       platforms = [ "x86_64-linux" ];
       maintainers = [ ];
diff --git a/pkgs/applications/science/electronics/picoscope/default.nix b/pkgs/applications/science/electronics/picoscope/default.nix
index 7db5cceebbaf6..596f220242bb2 100644
--- a/pkgs/applications/science/electronics/picoscope/default.nix
+++ b/pkgs/applications/science/electronics/picoscope/default.nix
@@ -41,6 +41,7 @@ let
       '';
       meta = with lib;
         shared_meta lib // {
+          sourceProvenance = with sourceTypes; [ binaryNativeCode ];
           description = "library for picotech oscilloscope software";
         };
     }) { };
@@ -132,6 +133,7 @@ in stdenv.mkDerivation rec {
         PicoScope for Linux, PicoScope for macOS and PicoScope for Windows
         users, or exported in text, CSV and MathWorks MATLAB 4 formats.
       '';
+      sourceProvenance = with sourceTypes; [ binaryBytecode ];
     };
 }
 
diff --git a/pkgs/applications/science/logic/isabelle/default.nix b/pkgs/applications/science/logic/isabelle/default.nix
index 9e5d40be2c6d5..009af3463a25a 100644
--- a/pkgs/applications/science/logic/isabelle/default.nix
+++ b/pkgs/applications/science/logic/isabelle/default.nix
@@ -47,10 +47,15 @@ in stdenv.mkDerivation rec {
         sha256 = "0jfaqckhg388jh9b4msrpkv6wrd6xzlw18m0bngbby8k8ywalp9i";
       };
 
-  buildInputs = [ polyml z3 veriT vampire eprover-ho ]
-    ++ lib.optionals (!stdenv.isDarwin) [ nettools java ];
+  buildInputs = [ polyml z3 veriT vampire eprover-ho nettools ]
+    ++ lib.optionals (!stdenv.isDarwin) [ java ];
 
-  sourceRoot = dirname;
+  sourceRoot = "${dirname}${lib.optionalString stdenv.isDarwin ".app"}";
+
+  postUnpack = if stdenv.isDarwin then ''
+    mv $sourceRoot ${dirname}
+    sourceRoot=${dirname}
+  '' else null;
 
   postPatch = ''
     patchShebangs .
@@ -112,6 +117,9 @@ in stdenv.mkDerivation rec {
       --replace '"$ML_HOME/" ^ (if ML_System.platform_is_windows then "sha1.dll" else "libsha1.so")' '"${sha1}/lib/libsha1.so"'
 
     rm -r heaps
+  '' + lib.optionalString (stdenv.hostPlatform.system == "x86_64-darwin") ''
+    substituteInPlace lib/scripts/isabelle-platform \
+      --replace 'ISABELLE_APPLE_PLATFORM64=arm64-darwin' ""
   '' + (if ! stdenv.isLinux then "" else ''
     arch=${if stdenv.hostPlatform.system == "x86_64-linux" then "x86_64-linux" else "x86-linux"}
     for f in contrib/*/$arch/{bash_process,epclextract,nunchaku,SPASS,zipperposition}; do
@@ -178,9 +186,13 @@ in stdenv.mkDerivation rec {
       formulas in a logical calculus.
     '';
     homepage = "https://isabelle.in.tum.de/";
+    sourceProvenance = with sourceTypes; [
+      fromSource
+      binaryNativeCode  # source bundles binary dependencies
+    ];
     license = licenses.bsd3;
     maintainers = [ maintainers.jwiegley maintainers.jvanbruegge ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
   };
 } // {
   withComponents = f:
diff --git a/pkgs/applications/science/logic/nuXmv/default.nix b/pkgs/applications/science/logic/nuXmv/default.nix
index 710cfdad39a8d..ad40902e92808 100644
--- a/pkgs/applications/science/logic/nuXmv/default.nix
+++ b/pkgs/applications/science/logic/nuXmv/default.nix
@@ -26,6 +26,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Symbolic model checker for analysis of finite and infinite state systems";
     homepage = "https://nuxmv.fbk.eu/pmwiki.php";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     maintainers = with maintainers; [ siraben ];
     platforms = [ "x86_64-linux" "x86_64-darwin" ];
diff --git a/pkgs/applications/science/logic/saw-tools/default.nix b/pkgs/applications/science/logic/saw-tools/default.nix
index df99d067f08c8..b6291bfae3698 100644
--- a/pkgs/applications/science/logic/saw-tools/default.nix
+++ b/pkgs/applications/science/logic/saw-tools/default.nix
@@ -51,6 +51,7 @@ stdenv.mkDerivation {
   meta = {
     description = "Tools for software verification and analysis";
     homepage    = "https://saw.galois.com";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license     = lib.licenses.bsd3;
     platforms   = lib.platforms.linux;
     maintainers = [ lib.maintainers.thoughtpolice ];
diff --git a/pkgs/applications/science/logic/tlaplus/toolbox.nix b/pkgs/applications/science/logic/tlaplus/toolbox.nix
index 3c53e66c8bd9f..86c3db9942a1e 100644
--- a/pkgs/applications/science/logic/tlaplus/toolbox.nix
+++ b/pkgs/applications/science/logic/tlaplus/toolbox.nix
@@ -97,6 +97,7 @@ stdenv.mkDerivation rec {
     '';
     # http://lamport.azurewebsites.net/tla/license.html
     license = with lib.licenses; [ mit ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     platforms = [ "x86_64-linux" ];
     maintainers = [ ];
   };
diff --git a/pkgs/applications/science/logic/tptp/default.nix b/pkgs/applications/science/logic/tptp/default.nix
index 9c91eaddfc47e..5df511ebaa8e7 100644
--- a/pkgs/applications/science/logic/tptp/default.nix
+++ b/pkgs/applications/science/logic/tptp/default.nix
@@ -44,6 +44,7 @@ stdenv.mkDerivation rec {
     # Also, it is unclear what is covered by "verbatim" - we will edit configs
     hydraPlatforms = [];
     platforms = platforms.all;
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfreeRedistributable;
   };
 }
diff --git a/pkgs/applications/science/logic/verifast/default.nix b/pkgs/applications/science/logic/verifast/default.nix
index c610256ccaef8..a1f5ec65a3be3 100644
--- a/pkgs/applications/science/logic/verifast/default.nix
+++ b/pkgs/applications/science/logic/verifast/default.nix
@@ -43,6 +43,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Verification for C and Java programs via separation logic";
     homepage    = "https://people.cs.kuleuven.be/~bart.jacobs/verifast/";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license     = lib.licenses.mit;
     platforms   = [ "x86_64-linux" ];
     maintainers = [ lib.maintainers.thoughtpolice ];
diff --git a/pkgs/applications/science/logic/z3/4.4.0.nix b/pkgs/applications/science/logic/z3/4.4.0.nix
index a3d6c16fb7df2..857bbbdee5d00 100644
--- a/pkgs/applications/science/logic/z3/4.4.0.nix
+++ b/pkgs/applications/science/logic/z3/4.4.0.nix
@@ -14,6 +14,8 @@ stdenv.mkDerivation rec {
   buildInputs = [ python ];
   enableParallelBuilding = true;
 
+  CXXFLAGS = if stdenv.isDarwin then "-std=gnu++98" else null;
+
   configurePhase = "python scripts/mk_make.py --prefix=$out && cd build";
 
   # z3's install phase is stupid because it tries to calculate the
diff --git a/pkgs/applications/science/machine-learning/sc2-headless/default.nix b/pkgs/applications/science/machine-learning/sc2-headless/default.nix
index 9438cd972f95b..97cad175ac17f 100644
--- a/pkgs/applications/science/machine-learning/sc2-headless/default.nix
+++ b/pkgs/applications/science/machine-learning/sc2-headless/default.nix
@@ -51,6 +51,7 @@ in stdenv.mkDerivation rec {
   meta = {
     platforms = lib.platforms.linux;
     description = "Starcraft II headless linux client for machine learning research";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = {
       fullName = "BLIZZARD® STARCRAFT® II AI AND MACHINE LEARNING LICENSE";
       url = "https://blzdistsc2-a.akamaihd.net/AI_AND_MACHINE_LEARNING_LICENSE.html";
diff --git a/pkgs/applications/science/math/cplex/default.nix b/pkgs/applications/science/math/cplex/default.nix
index a570e7e9c6d1e..ddc950b30664b 100644
--- a/pkgs/applications/science/math/cplex/default.nix
+++ b/pkgs/applications/science/math/cplex/default.nix
@@ -80,6 +80,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Optimization solver for mathematical programming";
     homepage = "https://www.ibm.com/be-en/marketplace/ibm-ilog-cplex";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     platforms = [ "x86_64-linux" ];
     maintainers = with maintainers; [ bfortz ];
diff --git a/pkgs/applications/science/math/geogebra/default.nix b/pkgs/applications/science/math/geogebra/default.nix
index b7eb8b11ecdc8..43d1a3e2068b9 100644
--- a/pkgs/applications/science/math/geogebra/default.nix
+++ b/pkgs/applications/science/math/geogebra/default.nix
@@ -29,6 +29,10 @@ let
     homepage = "https://www.geogebra.org/";
     maintainers = with maintainers; [ sikmir imsofi ];
     license = with licenses; [ gpl3 cc-by-nc-sa-30 geogebra ];
+    sourceProvenance = with sourceTypes; [
+      binaryBytecode
+      binaryNativeCode  # some jars include native binaries
+    ];
     platforms = with platforms; linux ++ darwin;
     hydraPlatforms = [];
   };
diff --git a/pkgs/applications/science/math/geogebra/geogebra6.nix b/pkgs/applications/science/math/geogebra/geogebra6.nix
index 76d178b7e490d..e1b5bbaedc2b1 100644
--- a/pkgs/applications/science/math/geogebra/geogebra6.nix
+++ b/pkgs/applications/science/math/geogebra/geogebra6.nix
@@ -48,7 +48,7 @@ let
   };
 
   darwinPkg = stdenv.mkDerivation {
-    inherit pname version meta;
+    inherit pname version;
 
     src = fetchurl {
       urls = [
@@ -66,6 +66,10 @@ let
       install -dm755 $out/Applications
       unzip $src -d $out/Applications
     '';
+
+    meta = meta // {
+      sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    };
   };
 in
 if stdenv.isDarwin
diff --git a/pkgs/applications/science/math/gurobi/default.nix b/pkgs/applications/science/math/gurobi/default.nix
index 574d849d955c2..536d520058a2d 100644
--- a/pkgs/applications/science/math/gurobi/default.nix
+++ b/pkgs/applications/science/math/gurobi/default.nix
@@ -46,7 +46,10 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Optimization solver for mathematical programming";
     homepage = "https://www.gurobi.com";
-    sourceProvenance = with sourceTypes; [ binaryBytecode ];
+    sourceProvenance = with sourceTypes; [
+      binaryBytecode
+      binaryNativeCode
+    ];
     license = licenses.unfree;
     platforms = [ "x86_64-linux" ];
     maintainers = with maintainers; [ jfrankenau ];
diff --git a/pkgs/applications/science/math/hmetis/default.nix b/pkgs/applications/science/math/hmetis/default.nix
index 762216a97a444..1c0152b7bfc77 100644
--- a/pkgs/applications/science/math/hmetis/default.nix
+++ b/pkgs/applications/science/math/hmetis/default.nix
@@ -36,6 +36,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "hMETIS is a set of programs for partitioning hypergraphs";
     homepage = "http://glaros.dtc.umn.edu/gkhome/metis/hmetis/overview";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     platforms = [ "i686-linux" "x86_64-linux" ];
   };
diff --git a/pkgs/applications/science/math/mathematica/generic.nix b/pkgs/applications/science/math/mathematica/generic.nix
index 0f4819172cea9..b081640c97d5b 100644
--- a/pkgs/applications/science/math/mathematica/generic.nix
+++ b/pkgs/applications/science/math/mathematica/generic.nix
@@ -121,6 +121,8 @@ in stdenv.mkDerivation {
     "--set USE_WOLFRAM_LD_LIBRARY_PATH 1"
     # Fix xkeyboard config path for Qt
     "--set QT_XKB_CONFIG_ROOT ${xkeyboard_config}/share/X11/xkb"
+    # wayland isn't supported
+    "--set QT_QPA_PLATFORM xcb"
   ] ++ lib.optionals cudaSupport [
     "--set CUDA_PATH ${cudaEnv}"
     "--set NVIDIA_DRIVER_LIBRARY_PATH ${addOpenGLRunpath.driverLink}/lib/libnvidia-tls.so"
diff --git a/pkgs/applications/science/math/scilab-bin/default.nix b/pkgs/applications/science/math/scilab-bin/default.nix
index 65d8c145bef6f..327472e88c752 100644
--- a/pkgs/applications/science/math/scilab-bin/default.nix
+++ b/pkgs/applications/science/math/scilab-bin/default.nix
@@ -93,6 +93,7 @@ stdenv.mkDerivation rec {
   meta = {
     homepage = "http://www.scilab.org/";
     description = "Scientific software package for numerical computations (Matlab lookalike)";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     # see http://www.scilab.org/legal_notice
     license = "Scilab";
   };
diff --git a/pkgs/applications/science/math/wolfram-engine/default.nix b/pkgs/applications/science/math/wolfram-engine/default.nix
index cf9364ffac174..acb92766910d0 100644
--- a/pkgs/applications/science/math/wolfram-engine/default.nix
+++ b/pkgs/applications/science/math/wolfram-engine/default.nix
@@ -140,6 +140,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Wolfram Engine computational software system";
     homepage = "https://www.wolfram.com/engine/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     maintainers = with maintainers; [ fbeffa ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/science/medicine/aliza/default.nix b/pkgs/applications/science/medicine/aliza/default.nix
index 0eb89b63e475f..b08acc77c640c 100644
--- a/pkgs/applications/science/medicine/aliza/default.nix
+++ b/pkgs/applications/science/medicine/aliza/default.nix
@@ -52,6 +52,7 @@ stdenv.mkDerivation {
   meta = {
     description = "Medical imaging software with 2D, 3D and 4D capabilities";
     homepage = "https://www.aliza-dicom-viewer.com";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = licenses.unfreeRedistributable;
     maintainers = with maintainers; [ mounium ];
     platforms = platforms.linux;
diff --git a/pkgs/applications/science/misc/boinc/default.nix b/pkgs/applications/science/misc/boinc/default.nix
index d0955a4d70c45..702dd3242e649 100644
--- a/pkgs/applications/science/misc/boinc/default.nix
+++ b/pkgs/applications/science/misc/boinc/default.nix
@@ -3,8 +3,8 @@ libGLU, libGL, libXmu, libXi, freeglut, libjpeg, libtool, wxGTK30, xcbutil,
 sqlite, gtk2, patchelf, libXScrnSaver, libnotify, libX11, libxcb }:
 
 let
-  majorVersion = "7.18";
-  minorVersion = "1";
+  majorVersion = "7.20";
+  minorVersion = "0";
 in
 
 stdenv.mkDerivation rec {
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     owner = "BOINC";
     repo = "boinc";
     rev = "client_release/${majorVersion}/${version}";
-    sha256 = "sha256-ijkfWTFwwJXvh6f0P5hkzWODxU+Ugz6iQUK+5jEpWXQ=";
+    sha256 = "sha256-W8+ALVO2OHxxBi80ZFgc8RxXneGINCHYNeMXimp9TIw=";
   };
 
   nativeBuildInputs = [ libtool automake autoconf m4 pkg-config ];
diff --git a/pkgs/applications/science/misc/foldingathome/client.nix b/pkgs/applications/science/misc/foldingathome/client.nix
index cc3d5445b594d..6ebc72cc7da41 100644
--- a/pkgs/applications/science/misc/foldingathome/client.nix
+++ b/pkgs/applications/science/misc/foldingathome/client.nix
@@ -52,6 +52,7 @@ buildFHSUserEnv {
   meta = {
     description = "Folding@home client";
     homepage = "https://foldingathome.org/";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.unfree;
     maintainers = [ lib.maintainers.zimbatm ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/science/misc/foldingathome/control.nix b/pkgs/applications/science/misc/foldingathome/control.nix
index e5cc02edcfbe6..a64c973914c66 100644
--- a/pkgs/applications/science/misc/foldingathome/control.nix
+++ b/pkgs/applications/science/misc/foldingathome/control.nix
@@ -1,5 +1,4 @@
 { lib, stdenv
-, autoPatchelfHook
 , dpkg
 , fahviewer
 , fetchurl
diff --git a/pkgs/applications/science/misc/foldingathome/viewer.nix b/pkgs/applications/science/misc/foldingathome/viewer.nix
index 75e900a0a72c5..7f28c8d1b1463 100644
--- a/pkgs/applications/science/misc/foldingathome/viewer.nix
+++ b/pkgs/applications/science/misc/foldingathome/viewer.nix
@@ -48,6 +48,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Folding@home viewer";
     homepage = "https://foldingathome.org/";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.unfree;
     maintainers = [ lib.maintainers.zimbatm ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/science/programming/fdr/default.nix b/pkgs/applications/science/programming/fdr/default.nix
index bc67c30aa61cf..f7b12342a6659 100644
--- a/pkgs/applications/science/programming/fdr/default.nix
+++ b/pkgs/applications/science/programming/fdr/default.nix
@@ -63,6 +63,7 @@ stdenv.mkDerivation {
     homepage = "https://cocotec.io/fdr/";
     description = "The CSP refinement checker";
     license = licenses.unfreeRedistributable;
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     platforms = platforms.linux;
     maintainers = with maintainers; [ nickhu ];
   };
diff --git a/pkgs/applications/science/robotics/betaflight-configurator/default.nix b/pkgs/applications/science/robotics/betaflight-configurator/default.nix
index 5065723995245..271274126b754 100644
--- a/pkgs/applications/science/robotics/betaflight-configurator/default.nix
+++ b/pkgs/applications/science/robotics/betaflight-configurator/default.nix
@@ -13,10 +13,10 @@ let
 in
 stdenv.mkDerivation rec {
   inherit pname;
-  version = "10.7.2";
+  version = "10.8.0";
   src = fetchurl {
-    url = "https://github.com/betaflight/${pname}/releases/download/${version}/${pname}_${version}_linux64.zip";
-    sha256 = "sha256-FDmtFRUupPKiHeF3Xvh/VagqMo+FJi8I7mhTz0VDs3o=";
+    url = "https://github.com/betaflight/${pname}/releases/download/${version}/${pname}_${version}_linux64-portable.zip";
+    sha256 = "sha256-Xn0ga2Z1UKd++TriL47ulV6idVTNBR8uiSW7FnL7r1g=";
   };
 
   nativeBuildInputs = [ wrapGAppsHook unzip ];
@@ -42,6 +42,7 @@ stdenv.mkDerivation rec {
       quadcopters, hexacopters, octocopters and fixed-wing aircraft.
     '';
     homepage    = "https://github.com/betaflight/betaflight/wiki";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license     = licenses.gpl3;
     maintainers = with maintainers; [ wucke13 ];
     platforms   = platforms.linux;
diff --git a/pkgs/applications/science/robotics/emuflight-configurator/default.nix b/pkgs/applications/science/robotics/emuflight-configurator/default.nix
index ca486006fecba..112049d7c0169 100644
--- a/pkgs/applications/science/robotics/emuflight-configurator/default.nix
+++ b/pkgs/applications/science/robotics/emuflight-configurator/default.nix
@@ -43,6 +43,7 @@ stdenv.mkDerivation rec {
       The application allows you to configure the Emuflight software running on any supported Emuflight target.
     '';
     homepage    = "https://github.com/emuflight/EmuConfigurator";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license     = licenses.gpl3Only;
     maintainers = with maintainers; [ beezow ];
     platforms   = platforms.linux;
diff --git a/pkgs/applications/science/robotics/inav-configurator/default.nix b/pkgs/applications/science/robotics/inav-configurator/default.nix
index ec605a3a97e95..a0b694f295415 100644
--- a/pkgs/applications/science/robotics/inav-configurator/default.nix
+++ b/pkgs/applications/science/robotics/inav-configurator/default.nix
@@ -50,6 +50,7 @@ stdenv.mkDerivation rec {
       quadcopters, hexacopters, octocopters and fixed-wing aircraft.
     '';
     homepage = "https://github.com/iNavFlight/inav/wiki";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ tilcreator wucke13 ];
     platforms = platforms.linux;
diff --git a/pkgs/tools/misc/dterm/default.nix b/pkgs/applications/terminal-emulators/dterm/default.nix
index 48665751aeb3f..69b1f67d629a9 100644
--- a/pkgs/tools/misc/dterm/default.nix
+++ b/pkgs/applications/terminal-emulators/dterm/default.nix
@@ -1,4 +1,8 @@
-{ lib, stdenv, fetchurl, readline }:
+{ lib
+, stdenv
+, fetchurl
+, readline
+}:
 
 stdenv.mkDerivation rec {
   pname = "dterm";
@@ -6,20 +10,31 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "http://www.knossos.net.nz/downloads/dterm-${version}.tgz";
-    sha256 = "94533be79f1eec965e59886d5f00a35cb675c5db1d89419f253bb72f140abddb";
+    hash = "sha256-lFM7558e7JZeWYhtXwCjXLZ1xdsdiUGfJTu3LxQKvds=";
   };
 
   buildInputs = [ readline ];
+
   postPatch = ''
     substituteInPlace Makefile \
       --replace 'gcc' '${stdenv.cc.targetPrefix}cc'
   '';
+
   preInstall = "mkdir -p $out/bin";
+
   installFlags = [ "BIN=$(out)/bin/" ];
 
   meta = with lib; {
     homepage = "http://www.knossos.net.nz/resources/free-software/dterm/";
     description = "A simple terminal program";
+    longDescription = ''
+      dterm is a simple terminal emulator, which doesn’t actually emulate any
+      particular terminal. Mainly, it is designed for use with xterm and
+      friends, which already do a perfectly good emulation, and therefore don’t
+      need any special help; dterm simply provides a means by which keystrokes
+      are forwarded to the serial line, and data forwarded from the serial line
+      appears on the terminal.
+    '';
     license = licenses.gpl2Only;
     maintainers = with maintainers; [ auchter ];
     platforms = platforms.unix;
diff --git a/pkgs/applications/terminal-emulators/hyper/default.nix b/pkgs/applications/terminal-emulators/hyper/default.nix
index 2266e884454b2..031d49d2458d9 100644
--- a/pkgs/applications/terminal-emulators/hyper/default.nix
+++ b/pkgs/applications/terminal-emulators/hyper/default.nix
@@ -50,6 +50,7 @@ stdenv.mkDerivation rec {
     description = "A terminal built on web technologies";
     homepage    = "https://hyper.is/";
     maintainers = with maintainers; [ puffnfresh fabiangd ];
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license     = licenses.mit;
     platforms   = [ "x86_64-linux" ];
   };
diff --git a/pkgs/applications/terminal-emulators/wezterm/default.nix b/pkgs/applications/terminal-emulators/wezterm/default.nix
index 8f15a38111c8f..4fed03db0dd08 100644
--- a/pkgs/applications/terminal-emulators/wezterm/default.nix
+++ b/pkgs/applications/terminal-emulators/wezterm/default.nix
@@ -28,14 +28,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wezterm";
-  version = "20220408-101518-b908e2dd";
+  version = "20220624-141144-bd1b7c5d";
 
   src = fetchFromGitHub {
     owner = "wez";
     repo = pname;
     rev = version;
     fetchSubmodules = true;
-    sha256 = "sha256-kuuoD+hqgj7QXFRIxa112oc4idtcK0ptFACDpI0bzGY=";
+    sha256 = "sha256-7VuNOJ4xqTxumLft7wRj4zdN8Y2ZSYtXr/KuqaLNOgw=";
   };
 
   postPatch = ''
@@ -45,7 +45,7 @@ rustPlatform.buildRustPackage rec {
     rm -r wezterm-ssh/tests
   '';
 
-  cargoSha256 = "sha256-iIb2zLUZpn23ooEiOP+yQMYUUmvef/KqvjzgLOFmjs0=";
+  cargoSha256 = "sha256-YvQ0APyPiYwISE/pDD2s+UgYFj4CKPdolb14FrNpocU=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/applications/version-management/bcompare/default.nix b/pkgs/applications/version-management/bcompare/default.nix
index 57adae69db037..bed85a37f544d 100644
--- a/pkgs/applications/version-management/bcompare/default.nix
+++ b/pkgs/applications/version-management/bcompare/default.nix
@@ -86,6 +86,7 @@ let
       You can then merge the changes, synchronize your files, and generate reports for your records.
     '';
     homepage = "https://www.scootersoftware.com";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     maintainers = with maintainers; [ ktor arkivm ];
     platforms = builtins.attrNames srcs;
diff --git a/pkgs/applications/version-management/git-and-tools/git-quickfix/default.nix b/pkgs/applications/version-management/git-and-tools/git-quickfix/default.nix
index b8743b7ea9022..4b4319f8cd7cc 100644
--- a/pkgs/applications/version-management/git-and-tools/git-quickfix/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-quickfix/default.nix
@@ -10,15 +10,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "git-quickfix";
-  version = "0.0.5";
+  version = "0.1.0";
 
   src = fetchFromGitHub {
     owner = "siedentop";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-LDA94pH5Oodf80mEENoURh+MJSg122SVWFVo9i1TEQg=";
+    sha256 = "sha256-IAjet/bDG/Hf/whS+yrEQSquj8s5DEmFis+5ysLLuxs=";
   };
 
+  doCheck = false;
+
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [
     Security
@@ -26,7 +28,7 @@ rustPlatform.buildRustPackage rec {
     libiconv
   ];
 
-  cargoSha256 = "sha256-QTPy0w45AawEU4fHf2FMGpL3YM+iTNnyiI4+mDJzWaE=";
+  cargoSha256 = "sha256-eTAEf2nRrJ7i2Dw5BBZlLLu8mK2G/wUk40ivtfxk1pI=";
 
   meta = with lib; {
     description = "Quickfix allows you to commit changes in your git repository to a new branch without leaving the current branch";
diff --git a/pkgs/applications/version-management/gitea/default.nix b/pkgs/applications/version-management/gitea/default.nix
index fbf0138ce5aa7..2cddeea816204 100644
--- a/pkgs/applications/version-management/gitea/default.nix
+++ b/pkgs/applications/version-management/gitea/default.nix
@@ -12,8 +12,6 @@
 , nixosTests
 }:
 
-with lib;
-
 buildGoPackage rec {
   pname = "gitea";
   version = "1.16.8";
@@ -36,19 +34,18 @@ buildGoPackage rec {
   ];
 
   postPatch = ''
-    patchShebangs .
     substituteInPlace modules/setting/setting.go --subst-var data
   '';
 
   nativeBuildInputs = [ makeWrapper ];
 
-  buildInputs = optional pamSupport pam;
+  buildInputs = lib.optional pamSupport pam;
 
   preBuild =
     let
-      tags = optional pamSupport "pam"
-        ++ optional sqliteSupport "sqlite sqlite_unlock_notify";
-      tagsString = concatStringsSep " " tags;
+      tags = lib.optional pamSupport "pam"
+        ++ lib.optional sqliteSupport "sqlite sqlite_unlock_notify";
+      tagsString = lib.concatStringsSep " " tags;
     in
     ''
       export buildFlagsArray=(
@@ -66,14 +63,14 @@ buildGoPackage rec {
     cp -R ./go/src/${goPackagePath}/options/locale $out/locale
 
     wrapProgram $out/bin/gitea \
-      --prefix PATH : ${makeBinPath [ bash git gzip openssh ]}
+      --prefix PATH : ${lib.makeBinPath [ bash git gzip openssh ]}
   '';
 
   goPackagePath = "code.gitea.io/gitea";
 
   passthru.tests.gitea = nixosTests.gitea;
 
-  meta = {
+  meta = with lib; {
     description = "Git with a cup of tea";
     homepage = "https://gitea.io";
     license = licenses.mit;
diff --git a/pkgs/applications/version-management/github-desktop/default.nix b/pkgs/applications/version-management/github-desktop/default.nix
index 6017d105fed71..7c07dc17c2ee9 100644
--- a/pkgs/applications/version-management/github-desktop/default.nix
+++ b/pkgs/applications/version-management/github-desktop/default.nix
@@ -66,6 +66,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "GUI for managing Git and GitHub.";
     homepage = "https://desktop.github.com/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.mit;
     maintainers = with maintainers; [ dan4ik605743 ];
     platforms = platforms.linux;
diff --git a/pkgs/applications/version-management/gitkraken/default.nix b/pkgs/applications/version-management/gitkraken/default.nix
index a0bc7477c6110..c8ca224a952b1 100644
--- a/pkgs/applications/version-management/gitkraken/default.nix
+++ b/pkgs/applications/version-management/gitkraken/default.nix
@@ -36,6 +36,7 @@ let
   meta = {
     homepage = "https://www.gitkraken.com/";
     description = "The downright luxurious and most popular Git client for Windows, Mac & Linux";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     platforms = builtins.attrNames srcs;
     maintainers = with maintainers; [ xnwdd evanjs arkivm ];
diff --git a/pkgs/applications/version-management/gitlab/Remove-geo-from-database.yml.patch b/pkgs/applications/version-management/gitlab/Remove-geo-from-database.yml.patch
new file mode 100644
index 0000000000000..968e618f3121f
--- /dev/null
+++ b/pkgs/applications/version-management/gitlab/Remove-geo-from-database.yml.patch
@@ -0,0 +1,69 @@
+From 7d833508e3bc4c737834e9edf1c429d36f67a38c Mon Sep 17 00:00:00 2001
+From: "M. A" <mak@nyantec.com>
+Date: Sat, 25 Jun 2022 13:34:42 +0000
+Subject: [PATCH] Remove geo from database.yml
+
+---
+ config/database.yml.postgresql | 28 ----------------------------
+ 1 file changed, 28 deletions(-)
+
+diff --git a/config/database.yml.postgresql b/config/database.yml.postgresql
+index 5329a8e9fd7..a4daab1fd0c 100644
+--- a/config/database.yml.postgresql
++++ b/config/database.yml.postgresql
+@@ -18,13 +18,6 @@ production:
+     #     port: 8600
+     #     record: secondary.postgresql.service.consul
+     #     interval: 300
+-  geo:
+-    adapter: postgresql
+-    encoding: unicode
+-    database: gitlabhq_geo_production
+-    username: git
+-    password: "secure password"
+-    host: localhost
+ 
+ #
+ # Development specific
+@@ -39,13 +32,6 @@ development:
+     host: localhost
+     variables:
+       statement_timeout: 15s
+-  geo:
+-    adapter: postgresql
+-    encoding: unicode
+-    database: gitlabhq_geo_development
+-    username: postgres
+-    password: "secure password"
+-    host: localhost
+ 
+ #
+ # Staging specific
+@@ -58,13 +44,6 @@ staging:
+     username: git
+     password: "secure password"
+     host: localhost
+-  geo:
+-    adapter: postgresql
+-    encoding: unicode
+-    database: gitlabhq_geo_staging
+-    username: git
+-    password: "secure password"
+-    host: localhost
+ 
+ # Warning: The database defined as "test" will be erased and
+ # re-generated from your development database when you run "rake".
+@@ -80,10 +59,3 @@ test: &test
+     prepared_statements: false
+     variables:
+       statement_timeout: 15s
+-  geo:
+-    adapter: postgresql
+-    encoding: unicode
+-    database: gitlabhq_geo_test
+-    username: postgres
+-    password:
+-    host: localhost
+-- 
+2.36.0
+
diff --git a/pkgs/applications/version-management/gitlab/data.json b/pkgs/applications/version-management/gitlab/data.json
index c2f3092a7fabc..3cfdc2a11c771 100644
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@@ -1,14 +1,14 @@
 {
-  "version": "15.0.2",
-  "repo_hash": "sha256-B5zD8yBY6d+jkIghuxShsR73+2X7Jd9mai1ouraEM44=",
-  "yarn_hash": "1a8k3x3b9sirzicqkwmr10m27n593iljfh8awdc9700akbj155lr",
+  "version": "15.1.0",
+  "repo_hash": "sha256-vOPI9kxdJlQNmI/DZueFcbvZPy2/0d+2CYM/RBAkIcU=",
+  "yarn_hash": "19df16gk0vpvdi1idqaakaglf11cic93i5njw0x4m2cnsznhpvz4",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v15.0.2-ee",
+  "rev": "v15.1.0-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "15.0.2",
-    "GITLAB_PAGES_VERSION": "1.58.0",
-    "GITLAB_SHELL_VERSION": "14.3.0",
-    "GITLAB_WORKHORSE_VERSION": "15.0.2"
+    "GITALY_SERVER_VERSION": "15.1.0",
+    "GITLAB_PAGES_VERSION": "1.59.0",
+    "GITLAB_SHELL_VERSION": "14.7.4",
+    "GITLAB_WORKHORSE_VERSION": "15.1.0"
   }
 }
diff --git a/pkgs/applications/version-management/gitlab/default.nix b/pkgs/applications/version-management/gitlab/default.nix
index e5765bb78423c..73a02673471f4 100644
--- a/pkgs/applications/version-management/gitlab/default.nix
+++ b/pkgs/applications/version-management/gitlab/default.nix
@@ -59,9 +59,17 @@ let
 
     nativeBuildInputs = [ rubyEnv.wrappedRuby rubyEnv.bundler nodejs yarn git cacert ];
 
-    # Since version 12.6.0, the rake tasks need the location of git,
-    # so we have to apply the location patches here too.
-    patches = [ ./remove-hardcoded-locations.patch ];
+    patches = [
+      # Since version 12.6.0, the rake tasks need the location of git,
+      # so we have to apply the location patches here too.
+      ./remove-hardcoded-locations.patch
+
+      # Gitlab edited the default database config since [1] and the
+      # installer complains about valid keywords only being "main" and "ci".
+      #
+      # [1]: https://gitlab.com/gitlab-org/gitlab/-/commit/99c0fac52b10cd9df62bbe785db799352a2d9028
+      ./Remove-geo-from-database.yml.patch
+    ];
     # One of the patches uses this variable - if it's unset, execution
     # of rake tasks fails.
     GITLAB_LOG_PATH = "log";
diff --git a/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock b/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock
index cc5344f8e87af..3616864ad7e6d 100644
--- a/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock
@@ -115,7 +115,7 @@ GEM
     minitest (5.15.0)
     msgpack (1.3.3)
     multipart-post (2.1.1)
-    nokogiri (1.13.3)
+    nokogiri (1.13.6)
       mini_portile2 (~> 2.8.0)
       racc (~> 1.4)
     octokit (4.20.0)
@@ -249,4 +249,4 @@ DEPENDENCIES
   timecop
 
 BUNDLED WITH
-   2.1.4
+   2.3.15
diff --git a/pkgs/applications/version-management/gitlab/gitaly/default.nix b/pkgs/applications/version-management/gitlab/gitaly/default.nix
index e38a24213b0ef..b8c1ecf6704e6 100644
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@@ -11,8 +11,8 @@ let
     gemdir = ./.;
   };
 
-  version = "15.0.2";
-  package_version = "v14";
+  version = "15.1.0";
+  package_version = "v${lib.versions.major version}";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";
 in
 
@@ -24,10 +24,10 @@ buildGoModule {
     owner = "gitlab-org";
     repo = "gitaly";
     rev = "v${version}";
-    sha256 = "sha256-jwPXar16FOq0xCg3xUXH72YPmoVa91ae3bgz95ZmYo4=";
+    sha256 = "sha256-rhMQRskum4c5bQL1sE7O4gMxIGX7q3bntuV1HkttA8M=";
   };
 
-  vendorSha256 = "sha256-/tHKWo09ZV31TSIqlOk36V3y7gNikziUJHf+nS1gHEw=";
+  vendorSha256 = "sha256-0JWJ2mpf79gJdnNRdlQLi0oDvnj6VmibkW2XcPnaCww=";
 
   passthru = {
     inherit rubyEnv;
diff --git a/pkgs/applications/version-management/gitlab/gitaly/gemset.nix b/pkgs/applications/version-management/gitlab/gitaly/gemset.nix
index ccf444330af36..1697a9f90200c 100644
--- a/pkgs/applications/version-management/gitlab/gitaly/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/gemset.nix
@@ -493,10 +493,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1p6b3q411h2mw4dsvhjrp1hh66hha5cm69fqg85vn2lizz71n6xz";
+      sha256 = "11w59ga9324yx6339dgsflz3dsqq2mky1qqdwcg6wi5s1bf2yldi";
       type = "gem";
     };
-    version = "1.13.3";
+    version = "1.13.6";
   };
   octokit = {
     dependencies = ["faraday" "sawyer"];
diff --git a/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix b/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
index 3888b0ba1104b..37d66c3a7f656 100644
--- a/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
@@ -2,19 +2,19 @@
 
 buildGoModule rec {
   pname = "gitlab-shell";
-  version = "14.3.0";
+  version = "14.7.4";
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-shell";
     rev = "v${version}";
-    sha256 = "sha256-SFoNtWcY0iJREsA+vZRsVJHmNb2vNvOiBJnochxA/Us=";
+    sha256 = "sha256-kLIjlMwoK1AlhvP38OspXnIWbdOcaLl4r05PiUmqnWw=";
   };
 
   buildInputs = [ ruby ];
 
   patches = [ ./remove-hardcoded-locations.patch ];
 
-  vendorSha256 = "sha256-eSzJon8o7ktV3rFuTE1A4tzdkBzWBZf1JxnrcMj5s00=";
+  vendorSha256 = "sha256-f2IkdkTZhve/cYKSH+N2Y5bXFSHuQ8t4hjfReyKTPUU=";
 
   postInstall = ''
     cp -r "$NIX_BUILD_TOP/source"/bin/* $out/bin
diff --git a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
index 89d82cc8dd569..b59909dd041a1 100644
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@@ -5,7 +5,7 @@ in
 buildGoModule rec {
   pname = "gitlab-workhorse";
 
-  version = "15.0.2";
+  version = "15.1.0";
 
   src = fetchFromGitLab {
     owner = data.owner;
@@ -16,7 +16,7 @@ buildGoModule rec {
 
   sourceRoot = "source/workhorse";
 
-  vendorSha256 = "sha256-7hNwBCDMdiiOliZa/lkYLo8gyAksAU0HanCSyaAMYLs=";
+  vendorSha256 = "sha256-cF2wVii/uBqlUQvrbDyPlv4tnfKA45deb/sE0c9U7Tk=";
   buildInputs = [ git ];
   ldflags = [ "-X main.Version=${version}" ];
   doCheck = false;
diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
index cbb4d6f90c0fb..9f5c0e4cbfd8d 100644
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
@@ -4,7 +4,7 @@ source 'https://rubygems.org'
 
 gem 'rails', '~> 6.1.4.7'
 
-gem 'bootsnap', '~> 1.9.4', require: false
+gem 'bootsnap', '~> 1.12.0', require: false
 
 # Responders respond_to and respond_with
 gem 'responders', '~> 3.0'
@@ -17,7 +17,7 @@ gem 'view_component', '~> 2.50.0'
 gem 'default_value_for', '~> 3.4.0'
 
 # Supported DBs
-gem 'pg', '~> 1.1'
+gem 'pg', '~> 1.3.0'
 
 gem 'rugged', '~> 1.2'
 gem 'grape-path-helpers', '~> 1.7.0'
@@ -55,7 +55,7 @@ gem 'omniauth-authentiq', '~> 0.3.3'
 gem 'gitlab-omniauth-openid-connect', '~> 0.9.0', require: 'omniauth_openid_connect'
 gem 'omniauth-salesforce', '~> 1.0.5'
 gem 'omniauth-atlassian-oauth2', '~> 0.2.0'
-gem 'rack-oauth2', '~> 1.16.0'
+gem 'rack-oauth2', '~> 1.19.0'
 gem 'jwt', '~> 2.1.0'
 
 # Kerberos authentication. EE-only
@@ -97,10 +97,10 @@ gem 'net-ldap', '~> 0.16.3'
 # API
 gem 'grape', '~> 1.5.2'
 gem 'grape-entity', '~> 0.10.0'
-gem 'rack-cors', '~> 1.0.6', require: 'rack/cors'
+gem 'rack-cors', '~> 1.1.0', require: 'rack/cors'
 
 # GraphQL API
-gem 'graphql', '~> 1.11.10'
+gem 'graphql', '~> 1.13.12'
 gem 'graphiql-rails', '~> 1.8'
 gem 'apollo_upload_server', '~> 2.1.0'
 gem 'graphql-docs', '~> 1.6.0', group: [:development, :test]
@@ -121,7 +121,7 @@ gem 'carrierwave', '~> 1.3'
 gem 'mini_magick', '~> 4.10.1'
 
 # for backups
-gem 'fog-aws', '~> 3.12'
+gem 'fog-aws', '~> 3.14'
 # Locked until fog-google resolves https://github.com/fog/fog-google/issues/421.
 # Also see config/initializers/fog_core_patch.rb.
 gem 'fog-core', '= 2.1.0'
@@ -130,7 +130,7 @@ gem 'fog-local', '~> 0.6'
 gem 'fog-openstack', '~> 1.0'
 gem 'fog-rackspace', '~> 0.1.1'
 gem 'fog-aliyun', '~> 0.3'
-gem 'gitlab-fog-azure-rm', '~> 1.2.0', require: 'fog/azurerm'
+gem 'gitlab-fog-azure-rm', '~> 1.3.0', require: 'fog/azurerm'
 
 # for Google storage
 gem 'google-api-client', '~> 0.33'
@@ -167,10 +167,10 @@ gem 'asciidoctor', '~> 2.0.10'
 gem 'asciidoctor-include-ext', '~> 0.4.0', require: false
 gem 'asciidoctor-plantuml', '~> 0.0.12'
 gem 'asciidoctor-kroki', '~> 0.5.0', require: false
-gem 'rouge', '~> 3.27.0'
+gem 'rouge', '~> 3.29.0'
 gem 'truncato', '~> 0.7.11'
 gem 'bootstrap_form', '~> 4.2.0'
-gem 'nokogiri', '~> 1.12'
+gem 'nokogiri', '~> 1.13.6'
 gem 'escape_utils', '~> 1.1'
 
 # Calendar rendering
@@ -181,9 +181,9 @@ gem 'diffy', '~> 3.3'
 gem 'diff_match_patch', '~> 0.1.0'
 
 # Application server
-gem 'rack', '~> 2.2.3'
-# https://github.com/sharpstone/rack-timeout/blob/master/README.md#rails-apps-manually
-gem 'rack-timeout', '~> 0.5.1', require: 'rack/timeout/base'
+gem 'rack', '~> 2.2.3.0'
+# https://github.com/zombocom/rack-timeout/blob/master/README.md#rails-apps-manually
+gem 'rack-timeout', '~> 0.6.0', require: 'rack/timeout/base'
 
 group :puma do
   gem 'puma', '~> 5.6.2', require: false
@@ -219,7 +219,7 @@ gem 'ruby-progressbar', '~> 1.10'
 gem 'settingslogic', '~> 2.0.9'
 
 # Linear-time regex library for untrusted regular expressions
-gem 're2', '~> 1.2.0'
+gem 're2', '~> 1.4.0'
 
 # Misc
 
@@ -301,7 +301,7 @@ gem 'base32', '~> 0.3.0'
 gem 'gitlab-license', '~> 2.1.0'
 
 # Protect against bruteforcing
-gem 'rack-attack', '~> 6.3.0'
+gem 'rack-attack', '~> 6.6.0'
 
 # Sentry integration
 gem 'sentry-raven', '~> 3.1'
@@ -311,12 +311,12 @@ gem 'sentry-sidekiq', '~> 5.1.1'
 
 # PostgreSQL query parsing
 #
-gem 'pg_query', '~> 2.1'
+gem 'pg_query', '~> 2.1.0'
 
 gem 'premailer-rails', '~> 1.10.3'
 
 # LabKit: Tracing and Correlation
-gem 'gitlab-labkit', '~> 0.22.0'
+gem 'gitlab-labkit', '~> 0.23.0'
 # Thrift is a dependency of gitlab-labkit, we want a version higher than 0.14.0
 # because of https://gitlab.com/gitlab-org/gitlab/-/issues/321900
 gem 'thrift', '>= 0.14.0'
@@ -344,7 +344,7 @@ gem 'prometheus-client-mmap', '~> 0.15.0', require: 'prometheus/client'
 gem 'warning', '~> 1.2.0'
 
 group :development do
-  gem 'lefthook', '~> 0.7.0', require: false
+  gem 'lefthook', '~> 0.8.0', require: false
   gem 'rubocop'
   gem 'solargraph', '~> 0.44.3', require: false
 
@@ -381,7 +381,7 @@ group :development, :test do
   gem 'spring', '~> 2.1.0'
   gem 'spring-commands-rspec', '~> 1.0.4'
 
-  gem 'gitlab-styles', '~> 7.0.0', require: false
+  gem 'gitlab-styles', '~> 7.1.0', require: false
 
   gem 'haml_lint', '~> 0.36.0', require: false
   gem 'bundler-audit', '~> 0.7.0.1', require: false
@@ -402,10 +402,12 @@ group :development, :test do
   gem 'test_file_finder', '~> 0.1.3'
 
   gem 'sigdump', '~> 0.2.4', require: 'sigdump/setup'
+
+  gem 'pact', '~> 1.12'
 end
 
 group :development, :test, :danger do
-  gem 'gitlab-dangerfiles', '~> 3.0', require: false
+  gem 'gitlab-dangerfiles', '~> 3.4.0', require: false
 end
 
 group :development, :test, :coverage do
@@ -477,13 +479,13 @@ gem 'sys-filesystem', '~> 1.4.3'
 gem 'net-ntp'
 
 # SSH keys support
-gem 'ssh_data', '~> 1.2'
+gem 'ssh_data', '~> 1.3'
 
 # Spamcheck GRPC protocol definitions
 gem 'spamcheck', '~> 0.1.0'
 
 # Gitaly GRPC protocol definitions
-gem 'gitaly', '~> 14.10.0-rc1'
+gem 'gitaly', '~> 15.1.0-rc1'
 
 # KAS GRPC protocol definitions
 gem 'kas-grpc', '~> 0.0.2'
@@ -503,7 +505,7 @@ gem 'gitlab-experiment', '~> 0.7.1'
 
 # Structured logging
 gem 'lograge', '~> 0.5'
-gem 'grape_logging', '~> 1.7'
+gem 'grape_logging', '~> 1.8'
 
 # DNS Lookup
 gem 'gitlab-net-dns', '~> 0.9.1'
@@ -545,3 +547,5 @@ gem 'ipaddress', '~> 0.8.3'
 gem 'parslet', '~> 1.8'
 
 gem 'ipynbdiff', '0.4.7'
+
+gem 'ed25519', '~> 1.3.0'
diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
index 4f5d0e36ab33e..535e470372c6d 100644
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
@@ -143,8 +143,8 @@ GEM
       rack (>= 0.9.0)
     bindata (2.4.10)
     binding_ninja (0.2.3)
-    bootsnap (1.9.4)
-      msgpack (~> 1.0)
+    bootsnap (1.12.0)
+      msgpack (~> 1.2)
     bootstrap_form (4.2.0)
       actionpack (>= 5.0)
       activemodel (>= 5.0)
@@ -214,10 +214,10 @@ GEM
     creole (0.5.0)
     crystalball (0.7.0)
       git
-    css_parser (1.7.0)
+    css_parser (1.11.0)
       addressable
     daemons (1.3.1)
-    danger (8.5.0)
+    danger (8.6.1)
       claide (~> 1.0)
       claide-plugins (>= 0.9.2)
       colored2 (~> 3.1)
@@ -306,6 +306,7 @@ GEM
     e2mmap (0.1.0)
     ecma-re-validator (0.3.0)
       regexp_parser (~> 2.0)
+    ed25519 (1.3.0)
     elasticsearch (7.13.3)
       elasticsearch-api (= 7.13.3)
       elasticsearch-transport (= 7.13.3)
@@ -360,7 +361,7 @@ GEM
     faraday-em_http (1.0.0)
     faraday-em_synchrony (1.0.0)
     faraday-excon (1.1.0)
-    faraday-http-cache (2.2.0)
+    faraday-http-cache (2.4.0)
       faraday (>= 0.8)
     faraday-httpclient (1.0.1)
     faraday-multipart (1.0.3)
@@ -387,6 +388,8 @@ GEM
       rake
     ffi-yajl (2.3.4)
       libyajl2 (~> 1.2)
+    filelock (1.1.1)
+    find_a_port (1.0.1)
     flipper (0.21.0)
     flipper-active_record (0.21.0)
       activerecord (>= 5.0, < 7)
@@ -402,11 +405,10 @@ GEM
       fog-json
       ipaddress (~> 0.8)
       xml-simple (~> 1.1)
-    fog-aws (3.12.0)
+    fog-aws (3.14.0)
       fog-core (~> 2.1)
       fog-json (~> 1.1)
       fog-xml (~> 0.1)
-      ipaddress (~> 0.8)
     fog-core (2.1.0)
       builder
       excon (~> 0.58)
@@ -458,7 +460,7 @@ GEM
       rails (>= 3.2.0)
     git (1.7.0)
       rchardet (~> 1.8)
-    gitaly (14.10.0.pre.rc1)
+    gitaly (15.1.0.pre.rc1)
       grpc (~> 1.0)
     github-markup (1.7.0)
     gitlab (4.16.1)
@@ -466,21 +468,21 @@ GEM
       terminal-table (~> 1.5, >= 1.5.1)
     gitlab-chronic (0.10.5)
       numerizer (~> 0.2)
-    gitlab-dangerfiles (3.0.0)
+    gitlab-dangerfiles (3.4.0)
       danger (>= 8.4.5)
       danger-gitlab (>= 8.0.0)
       rake
     gitlab-experiment (0.7.1)
       activesupport (>= 3.0)
       request_store (>= 1.0)
-    gitlab-fog-azure-rm (1.2.0)
+    gitlab-fog-azure-rm (1.3.0)
       azure-storage-blob (~> 2.0)
       azure-storage-common (~> 2.0)
       fog-core (= 2.1.0)
       fog-json (~> 1.2.0)
       mime-types
       ms_rest_azure (~> 0.12.0)
-    gitlab-labkit (0.22.0)
+    gitlab-labkit (0.23.0)
       actionpack (>= 5.0.0, < 7.0.0)
       activesupport (>= 5.0.0, < 7.0.0)
       grpc (>= 1.37)
@@ -505,7 +507,7 @@ GEM
       openid_connect (~> 1.2)
     gitlab-sidekiq-fetcher (0.8.0)
       sidekiq (~> 6.1)
-    gitlab-styles (7.0.0)
+    gitlab-styles (7.1.0)
       rubocop (~> 0.91, >= 0.91.1)
       rubocop-gitlab-security (~> 0.1.1)
       rubocop-graphql (~> 0.10)
@@ -564,7 +566,7 @@ GEM
       grape (~> 1.3)
       rake (> 12)
       ruby2_keywords (~> 0.0.2)
-    grape_logging (1.8.3)
+    grape_logging (1.8.4)
       grape
       rack
     graphiql-rails (1.8.0)
@@ -574,7 +576,7 @@ GEM
       faraday (>= 1.0)
       faraday_middleware
       graphql-client
-    graphql (1.11.10)
+    graphql (1.13.12)
     graphql-client (0.17.0)
       activesupport (>= 3.0)
       graphql (~> 1.10)
@@ -715,7 +717,7 @@ GEM
       rest-client (~> 2.0)
     launchy (2.5.0)
       addressable (~> 2.7)
-    lefthook (0.7.5)
+    lefthook (0.8.0)
     letter_opener (1.7.0)
       launchy (~> 2.2)
     letter_opener_web (2.0.0)
@@ -777,7 +779,7 @@ GEM
       faraday (>= 0.9, < 2.0.0)
       faraday-cookie_jar (~> 0.0.6)
       ms_rest (~> 0.7.6)
-    msgpack (1.5.1)
+    msgpack (1.5.2)
     multi_json (1.14.1)
     multi_xml (0.6.0)
     multipart-post (2.1.1)
@@ -798,7 +800,7 @@ GEM
     netrc (0.11.0)
     nio4r (2.5.8)
     no_proxy_fix (0.1.2)
-    nokogiri (1.13.3)
+    nokogiri (1.13.6)
       mini_portile2 (~> 2.8.0)
       racc (~> 1.4)
     notiffany (0.1.3)
@@ -852,8 +854,8 @@ GEM
       addressable (~> 2.3)
       nokogiri (~> 1.7, >= 1.7.1)
       omniauth (~> 1.2)
-    omniauth-dingtalk-oauth2 (1.0.0)
-      omniauth-oauth2 (~> 1.7.1)
+    omniauth-dingtalk-oauth2 (1.0.1)
+      omniauth-oauth2 (~> 1.7)
     omniauth-facebook (4.0.0)
       omniauth-oauth2 (~> 1.2)
     omniauth-github (1.4.0)
@@ -908,22 +910,45 @@ GEM
       rubypants (~> 0.2)
     orm_adapter (0.5.0)
     os (1.1.1)
-    parallel (1.20.1)
-    parser (3.0.3.2)
+    pact (1.59.0)
+      pact-mock_service (~> 3.0, >= 3.3.1)
+      pact-support (~> 1.15)
+      rack-test (>= 0.6.3, < 2.0.0)
+      rspec (~> 3.0)
+      term-ansicolor (~> 1.0)
+      thor (>= 0.20, < 2.0)
+      webrick (~> 1.3)
+    pact-mock_service (3.6.2)
+      filelock (~> 1.1)
+      find_a_port (~> 1.0.1)
+      json
+      pact-support (~> 1.12, >= 1.12.0)
+      rack (~> 2.0)
+      rspec (>= 2.14)
+      term-ansicolor (~> 1.0)
+      thor (>= 0.19, < 2.0)
+      webrick (~> 1.3)
+    pact-support (1.15.1)
+      awesome_print (~> 1.1)
+      randexp (~> 0.1.7)
+      rspec (>= 2.14)
+      term-ansicolor (~> 1.0)
+    parallel (1.22.1)
+    parser (3.1.2.0)
       ast (~> 2.4.1)
     parslet (1.8.2)
     pastel (0.8.0)
       tty-color (~> 0.5)
     peek (1.1.0)
       railties (>= 4.0.0)
-    pg (1.2.3)
-    pg_query (2.1.1)
-      google-protobuf (>= 3.17.1)
+    pg (1.3.5)
+    pg_query (2.1.3)
+      google-protobuf (>= 3.19.2)
     plist (3.6.0)
     png_quantizator (0.2.1)
     po_to_json (1.0.1)
       json (>= 1.6.0)
-    premailer (1.11.1)
+    premailer (1.16.0)
       addressable
       css_parser (>= 1.6.0)
       htmlentities (>= 4.0.0)
@@ -947,7 +972,7 @@ GEM
       pry (~> 0.13.0)
       tty-markdown
       tty-prompt
-    public_suffix (4.0.6)
+    public_suffix (4.0.7)
     puma (5.6.2)
       nio4r (~> 2.0)
     puma_worker_killer (0.3.1)
@@ -956,14 +981,14 @@ GEM
     pyu-ruby-sasl (0.0.3.3)
     raabro (1.1.6)
     racc (1.6.0)
-    rack (2.2.3)
+    rack (2.2.3.1)
     rack-accept (0.4.5)
       rack (>= 0.4)
-    rack-attack (6.3.0)
+    rack-attack (6.6.1)
       rack (>= 1.0, < 3)
-    rack-cors (1.0.6)
-      rack (>= 1.6.0)
-    rack-oauth2 (1.16.0)
+    rack-cors (1.1.1)
+      rack (>= 2.0.0)
+    rack-oauth2 (1.19.0)
       activesupport
       attr_required
       httpclient
@@ -973,7 +998,7 @@ GEM
       rack
     rack-test (1.1.0)
       rack (>= 1.0, < 3)
-    rack-timeout (0.5.2)
+    rack-timeout (0.6.0)
     rails (6.1.4.7)
       actioncable (= 6.1.4.7)
       actionmailbox (= 6.1.4.7)
@@ -1007,8 +1032,9 @@ GEM
       method_source
       rake (>= 0.13)
       thor (~> 1.0)
-    rainbow (3.0.0)
+    rainbow (3.1.1)
     rake (13.0.6)
+    randexp (0.1.7)
     rb-fsevent (0.10.4)
     rb-inotify (0.10.1)
       ffi (~> 1.0)
@@ -1019,7 +1045,7 @@ GEM
     rbtree (0.4.4)
     rchardet (1.8.0)
     rdoc (6.3.2)
-    re2 (1.2.0)
+    re2 (1.4.0)
     recaptcha (4.13.1)
       json
     recursive-open-struct (1.1.3)
@@ -1035,7 +1061,7 @@ GEM
       redis-store (>= 1.2, < 2)
     redis-store (1.9.0)
       redis (>= 4, < 5)
-    regexp_parser (2.2.1)
+    regexp_parser (2.5.0)
     regexp_property_values (1.0.0)
     representable (3.0.4)
       declarative (< 0.1.0)
@@ -1057,7 +1083,7 @@ GEM
     rexml (3.2.5)
     rinku (2.0.0)
     rotp (6.2.0)
-    rouge (3.27.0)
+    rouge (3.29.0)
     rqrcode (0.7.0)
       chunky_png
     rqrcode-rails3 (0.1.7)
@@ -1112,11 +1138,11 @@ GEM
       rubocop-ast (>= 0.6.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 1.4.0, < 2.0)
-    rubocop-ast (1.4.1)
-      parser (>= 2.7.1.5)
+    rubocop-ast (1.18.0)
+      parser (>= 3.1.1.0)
     rubocop-gitlab-security (0.1.1)
       rubocop (>= 0.51)
-    rubocop-graphql (0.13.0)
+    rubocop-graphql (0.14.3)
       rubocop (>= 0.87, < 2)
     rubocop-performance (1.9.2)
       rubocop (>= 0.90.0, < 2.0)
@@ -1253,7 +1279,7 @@ GEM
       activesupport (>= 5.2)
       sprockets (>= 3.0.0)
     sqlite3 (1.4.2)
-    ssh_data (1.2.0)
+    ssh_data (1.3.0)
     ssrf_filter (1.0.7)
     stackprof (0.2.15)
     state_machines (0.5.0)
@@ -1272,11 +1298,14 @@ GEM
       activesupport (>= 3)
       attr_required (>= 0.0.5)
       httpclient (>= 2.4)
+    sync (0.5.0)
     sys-filesystem (1.4.3)
       ffi (~> 1.1)
     sysexits (1.2.0)
     tanuki_emoji (0.6.0)
     temple (0.8.2)
+    term-ansicolor (1.7.1)
+      tins (~> 1.0)
     terminal-table (1.8.0)
       unicode-display_width (~> 1.1, >= 1.1.1)
     terser (1.0.2)
@@ -1295,6 +1324,8 @@ GEM
     timecop (0.9.1)
     timeliness (0.3.10)
     timfel-krb5-auth (0.8.3)
+    tins (1.31.0)
+      sync
     toml-rb (2.0.1)
       citrus (~> 3.0, > 3.0)
     tomlrb (1.3.0)
@@ -1341,7 +1372,7 @@ GEM
     unf (0.1.4)
       unf_ext
     unf_ext (0.0.8)
-    unicode-display_width (1.7.0)
+    unicode-display_width (1.8.0)
     unicode_utils (1.4.0)
     uniform_notifier (1.13.0)
     unleash (3.2.2)
@@ -1403,7 +1434,7 @@ GEM
       nokogiri (~> 1.8)
     yajl-ruby (1.4.1)
     yard (0.9.26)
-    zeitwerk (2.5.4)
+    zeitwerk (2.6.0)
 
 PLATFORMS
   ruby
@@ -1435,7 +1466,7 @@ DEPENDENCIES
   benchmark-ips (~> 2.3.0)
   benchmark-memory (~> 0.1)
   better_errors (~> 2.9.0)
-  bootsnap (~> 1.9.4)
+  bootsnap (~> 1.12.0)
   bootstrap_form (~> 4.2.0)
   browser (~> 4.2)
   bullet (~> 6.1.3)
@@ -1464,6 +1495,7 @@ DEPENDENCIES
   discordrb-webhooks (~> 3.4)
   doorkeeper (~> 5.5.0.rc2)
   doorkeeper-openid_connect (~> 1.7.5)
+  ed25519 (~> 1.3.0)
   elasticsearch-api (= 7.13.3)
   elasticsearch-model (~> 7.2)
   elasticsearch-rails (~> 7.2)
@@ -1481,7 +1513,7 @@ DEPENDENCIES
   flipper-active_support_cache_store (~> 0.21.0)
   flowdock (~> 0.7)
   fog-aliyun (~> 0.3)
-  fog-aws (~> 3.12)
+  fog-aws (~> 3.14)
   fog-core (= 2.1.0)
   fog-google (~> 1.15)
   fog-local (~> 0.6)
@@ -1492,13 +1524,13 @@ DEPENDENCIES
   gettext (~> 3.3)
   gettext_i18n_rails (~> 1.8.0)
   gettext_i18n_rails_js (~> 1.3)
-  gitaly (~> 14.10.0.pre.rc1)
+  gitaly (~> 15.1.0.pre.rc1)
   github-markup (~> 1.7.0)
   gitlab-chronic (~> 0.10.5)
-  gitlab-dangerfiles (~> 3.0)
+  gitlab-dangerfiles (~> 3.4.0)
   gitlab-experiment (~> 0.7.1)
-  gitlab-fog-azure-rm (~> 1.2.0)
-  gitlab-labkit (~> 0.22.0)
+  gitlab-fog-azure-rm (~> 1.3.0)
+  gitlab-labkit (~> 0.23.0)
   gitlab-license (~> 2.1.0)
   gitlab-license_finder (~> 6.0)
   gitlab-mail_room (~> 0.0.9)
@@ -1506,7 +1538,7 @@ DEPENDENCIES
   gitlab-net-dns (~> 0.9.1)
   gitlab-omniauth-openid-connect (~> 0.9.0)
   gitlab-sidekiq-fetcher (= 0.8.0)
-  gitlab-styles (~> 7.0.0)
+  gitlab-styles (~> 7.1.0)
   gitlab_chronic_duration (~> 0.10.6.2)
   gitlab_omniauth-ldap (~> 2.1.1)
   gon (~> 6.4.0)
@@ -1516,10 +1548,10 @@ DEPENDENCIES
   grape (~> 1.5.2)
   grape-entity (~> 0.10.0)
   grape-path-helpers (~> 1.7.0)
-  grape_logging (~> 1.7)
+  grape_logging (~> 1.8)
   graphiql-rails (~> 1.8)
   graphlient (~> 0.5.0)
-  graphql (~> 1.11.10)
+  graphql (~> 1.13.12)
   graphql-docs (~> 1.6.0)
   grpc (~> 1.42.0)
   gssapi
@@ -1547,7 +1579,7 @@ DEPENDENCIES
   knapsack (~> 1.21.1)
   kramdown (~> 2.3.1)
   kubeclient (~> 4.9.2)
-  lefthook (~> 0.7.0)
+  lefthook (~> 0.8.0)
   letter_opener_web (~> 2.0.0)
   licensee (~> 9.14.1)
   lockbox (~> 0.6.2)
@@ -1563,7 +1595,7 @@ DEPENDENCIES
   multi_json (~> 1.14.1)
   net-ldap (~> 0.16.3)
   net-ntp
-  nokogiri (~> 1.12)
+  nokogiri (~> 1.13.6)
   oauth2 (~> 1.4)
   octokit (~> 4.15)
   ohai (~> 16.10)
@@ -1588,11 +1620,12 @@ DEPENDENCIES
   omniauth-twitter (~> 1.4)
   omniauth_crowd (~> 2.4.0)
   org-ruby (~> 0.9.12)
+  pact (~> 1.12)
   parallel (~> 1.19)
   parslet (~> 1.8)
   peek (~> 1.1)
-  pg (~> 1.1)
-  pg_query (~> 2.1)
+  pg (~> 1.3.0)
+  pg_query (~> 2.1.0)
   png_quantizator (~> 0.2.1)
   premailer-rails (~> 1.10.3)
   prometheus-client-mmap (~> 0.15.0)
@@ -1601,19 +1634,19 @@ DEPENDENCIES
   pry-shell (~> 0.5.0)
   puma (~> 5.6.2)
   puma_worker_killer (~> 0.3.1)
-  rack (~> 2.2.3)
-  rack-attack (~> 6.3.0)
-  rack-cors (~> 1.0.6)
-  rack-oauth2 (~> 1.16.0)
+  rack (~> 2.2.3.0)
+  rack-attack (~> 6.6.0)
+  rack-cors (~> 1.1.0)
+  rack-oauth2 (~> 1.19.0)
   rack-proxy (~> 0.7.2)
-  rack-timeout (~> 0.5.1)
+  rack-timeout (~> 0.6.0)
   rails (~> 6.1.4.7)
   rails-controller-testing
   rails-i18n (~> 6.0)
   rainbow (~> 3.0)
   rbtrace (~> 0.4)
   rdoc (~> 6.3.2)
-  re2 (~> 1.2.0)
+  re2 (~> 1.4.0)
   recaptcha (~> 4.11)
   redis (~> 4.4.0)
   redis-actionpack (~> 5.2.0)
@@ -1622,7 +1655,7 @@ DEPENDENCIES
   responders (~> 3.0)
   retriable (~> 3.1.2)
   rexml (~> 3.2.5)
-  rouge (~> 3.27.0)
+  rouge (~> 3.29.0)
   rqrcode-rails3 (~> 0.1.7)
   rspec-benchmark (~> 0.6.0)
   rspec-parameterized
@@ -1665,7 +1698,7 @@ DEPENDENCIES
   spring-commands-rspec (~> 1.0.4)
   sprite-factory (~> 1.7)
   sprockets (~> 3.7.0)
-  ssh_data (~> 1.2)
+  ssh_data (~> 1.3)
   stackprof (~> 0.2.15)
   state_machines-activerecord (~> 0.8.0)
   sys-filesystem (~> 1.4.3)
diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix b/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
index 87791ff567532..5f11d60987854 100644
--- a/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
@@ -577,10 +577,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "19i4x2nascd74ahcvmrsnf03cygh1y4c9yf8rcv91fv0mcxpvb9n";
+      sha256 = "0yza43f42v0ys81y6jzbqfkdykf40h6l3yyvadwq32fswrbpwvbc";
       type = "gem";
     };
-    version = "1.9.4";
+    version = "1.12.0";
   };
   bootstrap_form = {
     dependencies = ["actionpack" "activemodel"];
@@ -930,10 +930,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1y4vc018b5mzp7winw4pbb22jk0dpxp22pzzxq7w0rgvfxzi89pd";
+      sha256 = "1qbdgp36dhcyljhmfxrvbgp1ha9yqxhxgyg3sdm48y9m371jd2an";
       type = "gem";
     };
-    version = "1.7.0";
+    version = "1.11.0";
   };
   daemons = {
     groups = ["default" "development"];
@@ -951,10 +951,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0xmckbl41v27x9ri6snrl01alsbwxcqsfc4a1nfhgx0py6y0dmjg";
+      sha256 = "1n6zbkkinlv2hp4ig5c170d1ckbbdf8rgxmykfm3m3gn865vapnr";
       type = "gem";
     };
-    version = "8.5.0";
+    version = "8.6.1";
   };
   danger-gitlab = {
     dependencies = ["danger" "gitlab"];
@@ -1283,6 +1283,16 @@
     };
     version = "0.3.0";
   };
+  ed25519 = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0zb2dr2ihb1qiknn5iaj1ha1w9p7lj9yq5waasndlfadz225ajji";
+      type = "gem";
+    };
+    version = "1.3.0";
+  };
   elasticsearch = {
     dependencies = ["elasticsearch-api" "elasticsearch-transport"];
     groups = ["default"];
@@ -1537,14 +1547,14 @@
   };
   faraday-http-cache = {
     dependencies = ["faraday"];
-    groups = ["default" "development"];
+    groups = ["danger" "default" "development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0lhfwlk4mhmw9pdlgdsl2bq4x45w7s51jkxjryf18wym8iiw36g7";
+      sha256 = "143cpzdrnyqyfv1jasr0qjqgm57dhv46nsf5f2s06ndxccfr13rq";
       type = "gem";
     };
-    version = "2.2.0";
+    version = "2.4.0";
   };
   faraday-httpclient = {
     groups = ["danger" "default" "development" "test"];
@@ -1712,6 +1722,26 @@
     };
     version = "2.3.4";
   };
+  filelock = {
+    groups = ["default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "085vrb6wf243iqqnrrccwhjd4chphfdsybkvjbapa2ipfj1ja1sj";
+      type = "gem";
+    };
+    version = "1.1.1";
+  };
+  find_a_port = {
+    groups = ["default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1sswgpvn38yav4i21adrr7yy8c8299d7rj065gd3iwg6nn26lpb0";
+      type = "gem";
+    };
+    version = "1.0.1";
+  };
   flipper = {
     groups = ["default"];
     platforms = [];
@@ -1767,15 +1797,15 @@
     version = "0.3.3";
   };
   fog-aws = {
-    dependencies = ["fog-core" "fog-json" "fog-xml" "ipaddress"];
+    dependencies = ["fog-core" "fog-json" "fog-xml"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0cl9b93mwhzm9fp0lmac1vzz359g3sq52k06kn0a0vnvxrxnhzjm";
+      sha256 = "1gsb26a1jp0k7hclry0dai2a9m77a9h6ybc17x0i98z2ivzjsi07";
       type = "gem";
     };
-    version = "3.12.0";
+    version = "3.14.0";
   };
   fog-core = {
     dependencies = ["builder" "excon" "formatador" "mime-types"];
@@ -1967,10 +1997,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0ls4x3h1c3axx9kqmvs1mpcmjqchl297sh1bzzl5zjgdz25w24di";
+      sha256 = "0ygf5di1sl8b3gs7ascn3r9carf6v8d9c3damc10sh81sm7bwc0z";
       type = "gem";
     };
-    version = "14.10.0.pre.rc1";
+    version = "15.1.0.pre.rc1";
   };
   github-markup = {
     groups = ["default"];
@@ -2010,10 +2040,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1kyp5kxp0jsk224y2nq4yg37wnn824ialdjvsf8fv3a20q9w4k7i";
+      sha256 = "13c7k36xq042fbf7d9jwgfc30zq9dfziwvqfi88h2199v9dkylix";
       type = "gem";
     };
-    version = "3.0.0";
+    version = "3.4.0";
   };
   gitlab-experiment = {
     dependencies = ["activesupport" "request_store"];
@@ -2032,10 +2062,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1hi9v0zy863gnk17w0fp1ks2kr1s2z6q0bkx5wdbq6yawycjs94h";
+      sha256 = "1d8plrl69q5mcsgz8ywhw7k9q0g31y3gm6h90gw9apsisqbm7vrg";
       type = "gem";
     };
-    version = "1.2.0";
+    version = "1.3.0";
   };
   gitlab-labkit = {
     dependencies = ["actionpack" "activesupport" "grpc" "jaeger-client" "opentracing" "pg_query" "redis"];
@@ -2043,10 +2073,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1vs5q1lfk5i953gv2xvz6h5x6ycllr8hdzg81zsrz7hy3aygxknj";
+      sha256 = "0kiz2m3dw6ld2z6dsl8jh2ycw061wv8wiy34flymb5zqjiyyzw8l";
       type = "gem";
     };
-    version = "0.22.0";
+    version = "0.23.0";
   };
   gitlab-license = {
     groups = ["default"];
@@ -2127,10 +2157,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "10fmvx2vx2v0mbwv5d4wcpc2iyp5y8lwxn9hjpzkk5bvxkk4c493";
+      sha256 = "0xp2f1bbx8i7a89xjwy6b5rhxr9g1vnms68chcnxdd95csxhxpzp";
       type = "gem";
     };
-    version = "7.0.0";
+    version = "7.1.0";
   };
   gitlab_chronic_duration = {
     dependencies = ["numerizer"];
@@ -2280,10 +2310,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0x6cmmj0wi1m689r8d4yhyhpl8dwj5skn8b29igm4xvw3swkg94x";
+      sha256 = "1lcjqwal3wc2r41wsi01d09cyhxhglxp6y7hd0564pdx5lr3xk7g";
       type = "gem";
     };
-    version = "1.8.3";
+    version = "1.8.4";
   };
   graphiql-rails = {
     dependencies = ["railties" "sprockets-rails"];
@@ -2312,10 +2342,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0qb6bk8gflwid4qrk2i9ndzs5fxycdjvxmhy9w547lglzb5jx19b";
+      sha256 = "1hvsv6ig6d8syr4vasa8vcc090kbawwflk5m1j6kl681y9n6d0hx";
       type = "gem";
     };
-    version = "1.11.10";
+    version = "1.13.12";
   };
   graphql-client = {
     dependencies = ["activesupport" "graphql"];
@@ -2899,10 +2929,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "07r76qlzxcz9y4dmkqf8k4khkfq7s2v22dcq6b0w0v4cfiwqva3h";
+      sha256 = "05ykgpj6cka9vprvrk37ixyhj2pdw7a9m6bq645yai6ihghahlf0";
       type = "gem";
     };
-    version = "0.7.5";
+    version = "0.8.0";
   };
   letter_opener = {
     dependencies = ["launchy"];
@@ -3226,10 +3256,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1i0gbypr1yxwfkaxzrk0i1wz4n6v3mw7z24k65jy3q1h5lda5xbw";
+      sha256 = "1hpj9mm31a5aw5qys2kglfl8jv74bkwkc5pfrpp3als89hgkznqy";
       type = "gem";
     };
-    version = "1.5.1";
+    version = "1.5.2";
   };
   multi_json = {
     groups = ["default"];
@@ -3401,10 +3431,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1p6b3q411h2mw4dsvhjrp1hh66hha5cm69fqg85vn2lizz71n6xz";
+      sha256 = "11w59ga9324yx6339dgsflz3dsqq2mky1qqdwcg6wi5s1bf2yldi";
       type = "gem";
     };
-    version = "1.13.3";
+    version = "1.13.6";
   };
   notiffany = {
     dependencies = ["nenv" "shellany"];
@@ -3574,10 +3604,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1sflfy1jvn9wqpral7gcfmbys7msvykp6rlnl33r8qgnbksn54y8";
+      sha256 = "16qkd51f1ab1hw4az27qj3vk958aal67by8djsplwd1q3h7nfib5";
       type = "gem";
     };
-    version = "1.0.0";
+    version = "1.0.1";
   };
   omniauth-facebook = {
     dependencies = ["omniauth-oauth2"];
@@ -3803,15 +3833,48 @@
     };
     version = "1.1.1";
   };
+  pact = {
+    dependencies = ["pact-mock_service" "pact-support" "rack-test" "rspec" "term-ansicolor" "thor" "webrick"];
+    groups = ["development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0ngwc4zrp6jxpb8s0y07xxic492a1n0akjxd7x4hks2fbsiwwwk2";
+      type = "gem";
+    };
+    version = "1.59.0";
+  };
+  pact-mock_service = {
+    dependencies = ["filelock" "find_a_port" "json" "pact-support" "rack" "rspec" "term-ansicolor" "thor" "webrick"];
+    groups = ["default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0izmf5h0n1mcrfk6qlz61rhzdjs6h0bkqrx6ndp8nhmfhja254fc";
+      type = "gem";
+    };
+    version = "3.6.2";
+  };
+  pact-support = {
+    dependencies = ["awesome_print" "randexp" "rspec" "term-ansicolor"];
+    groups = ["default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "07qxvxy48im9vlswqspsh2k6fy6rsmi3409863ww8y7yx5pmjr63";
+      type = "gem";
+    };
+    version = "1.15.1";
+  };
   parallel = {
     groups = ["development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0055br0mibnqz0j8wvy20zry548dhkakws681bhj3ycb972awkzd";
+      sha256 = "07vnk6bb54k4yc06xnwck7php50l09vvlw1ga8wdz0pia461zpzb";
       type = "gem";
     };
-    version = "1.20.1";
+    version = "1.22.1";
   };
   parser = {
     dependencies = ["ast"];
@@ -3819,10 +3882,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0sszdl9mpzqzn9kxrp28sqmg47mjxcwypr4d60vbajqba4v885di";
+      sha256 = "0xhfghgidj8cbdnqp01f7kvnrv1f60izpkd9dhxsvpdzkfsdg97d";
       type = "gem";
     };
-    version = "3.0.3.2";
+    version = "3.1.2.0";
   };
   parslet = {
     groups = ["default" "development" "test"];
@@ -3861,10 +3924,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "13mfrysrdrh8cka1d96zm0lnfs59i5x2g6ps49r2kz5p3q81xrzj";
+      sha256 = "10ryzmc3r5ja6g90a9ycsxcxsy5872xa1vf01jam0bm74zq3zmi6";
       type = "gem";
     };
-    version = "1.2.3";
+    version = "1.3.5";
   };
   pg_query = {
     dependencies = ["google-protobuf"];
@@ -3872,10 +3935,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0cf1b97nznl6adkx25j2x96sq8xx2b4fpic230fx65k3vqqn8a4r";
+      sha256 = "00bhwkhjy6bkp04313m5il7vd165i3fz0x4jissflf66i164ppgk";
       type = "gem";
     };
-    version = "2.1.1";
+    version = "2.1.3";
   };
   plist = {
     groups = ["default"];
@@ -3914,10 +3977,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1xrhmialxn5vlp1nmf40a4db9gji4h2wbzd7f43sz64z8lvrjj6h";
+      sha256 = "11j7d6abxivj15yax47z3f751wz4pnl02qszzc9swswf8hn41r03";
       type = "gem";
     };
-    version = "1.11.1";
+    version = "1.16.0";
   };
   premailer-rails = {
     dependencies = ["actionmailer" "premailer"];
@@ -4000,14 +4063,14 @@
     version = "0.5.0";
   };
   public_suffix = {
-    groups = ["default" "development" "test"];
+    groups = ["danger" "default" "development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1xqcgkl7bwws1qrlnmxgh8g4g9m10vg60bhlw40fplninb3ng6d9";
+      sha256 = "1f3knlwfwm05sfbaihrxm4g772b79032q14c16q4b38z8bi63qcb";
       type = "gem";
     };
-    version = "4.0.6";
+    version = "4.0.7";
   };
   puma = {
     dependencies = ["nio4r"];
@@ -4062,14 +4125,14 @@
     version = "1.6.0";
   };
   rack = {
-    groups = ["default" "development" "kerberos" "test"];
+    groups = ["default" "development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0i5vs0dph9i5jn8dfc6aqd6njcafmb20rwqngrf759c9cvmyff16";
+      sha256 = "1b1qsg0yfargdhmpapp2d3mlxj82wyygs9nj74w0r03diyi8swlc";
       type = "gem";
     };
-    version = "2.2.3";
+    version = "2.2.3.1";
   };
   rack-accept = {
     dependencies = ["rack"];
@@ -4088,10 +4151,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "15b8lk54j2abqhpn588b1wvbzwmxwa7iql6241kxpjc0gyb51p0z";
+      sha256 = "049s3y3dpl6dn478g912y6f9nzclnnkl30psrbc2w5kaihj5szhq";
       type = "gem";
     };
-    version = "6.3.0";
+    version = "6.6.1";
   };
   rack-cors = {
     dependencies = ["rack"];
@@ -4099,10 +4162,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "07dppmm1ah1gs31sb5byrkkady9vqzwjmpd92c8425nc6yzwknik";
+      sha256 = "0jvs0mq8jrsz86jva91mgql16daprpa3qaipzzfvngnnqr5680j7";
       type = "gem";
     };
-    version = "1.0.6";
+    version = "1.1.1";
   };
   rack-oauth2 = {
     dependencies = ["activesupport" "attr_required" "httpclient" "json-jwt" "rack"];
@@ -4110,10 +4173,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1b0h0rlfl0p0drymwfc71g87fp66ck3205pl32z89xsgh0lzw25k";
+      sha256 = "0gxxr209r8h3nxhc9h731khv6yswiv9hc6q2pg672v530xmknznw";
       type = "gem";
     };
-    version = "1.16.0";
+    version = "1.19.0";
   };
   rack-proxy = {
     dependencies = ["rack"];
@@ -4142,10 +4205,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0d4dgbf8rgqx03lwsm8j6i20lzawk1bsvzfj5bhzrsycfyfk25aj";
+      sha256 = "16ahj3qz3xhfrwvqb4nf6cfzvliigg0idfsp5jyr8qwk676d2f30";
       type = "gem";
     };
-    version = "0.5.2";
+    version = "0.6.0";
   };
   rails = {
     dependencies = ["actioncable" "actionmailbox" "actionmailer" "actionpack" "actiontext" "actionview" "activejob" "activemodel" "activerecord" "activestorage" "activesupport" "railties" "sprockets-rails"];
@@ -4214,14 +4277,14 @@
     version = "6.1.4.7";
   };
   rainbow = {
-    groups = ["default" "development" "test"];
+    groups = ["coverage" "default" "development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0bb2fpjspydr6x0s8pn1pqkzmxszvkfapv0p4627mywl7ky4zkhk";
+      sha256 = "0smwg4mii0fm38pyb5fddbmrdpifwv22zv3d3px2xx497am93503";
       type = "gem";
     };
-    version = "3.0.0";
+    version = "3.1.1";
   };
   rake = {
     groups = ["default" "development" "test"];
@@ -4233,6 +4296,16 @@
     };
     version = "13.0.6";
   };
+  randexp = {
+    groups = ["default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1j742j7g107jgkvpsfq2b10d5xhsni5s8vxrp518d3karw7529ih";
+      type = "gem";
+    };
+    version = "0.1.7";
+  };
   rb-fsevent = {
     groups = ["default" "development" "test"];
     platforms = [];
@@ -4300,10 +4373,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "16q71cc9wx342c697q18pkz19ym4ncjd97hcw4v6f1mgflkdv400";
+      sha256 = "13za43xb5xfg1xb1vwlvwx14jlmnk7jal5dqw8q9a5g13csx41sw";
       type = "gem";
     };
-    version = "1.2.0";
+    version = "1.4.0";
   };
   recaptcha = {
     dependencies = ["json"];
@@ -4395,10 +4468,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "155f6cr4rrfw5bs5xd3m5kfw32qhc5fsi4nk82rhif56rc6cs0wm";
+      sha256 = "1rfd3q17p7q7pa67844q8b16ipy6ksh8mkzynpm1zldqbb9x4xm0";
       type = "gem";
     };
-    version = "2.2.1";
+    version = "2.5.0";
   };
   regexp_property_values = {
     groups = ["default"];
@@ -4510,10 +4583,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0530ri0p60km0bg0ib6swkhfnas427cva7vcdmnwl8df52a10y1k";
+      sha256 = "17dhzc9hfzd8x18hfsvn9rsp4jg18wdfsdy3a5p99y5dhfh1321r";
       type = "gem";
     };
-    version = "3.27.0";
+    version = "3.29.0";
   };
   rqrcode = {
     dependencies = ["chunky_png"];
@@ -4674,10 +4747,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0gkf1p8yal38nlvdb39qaiy0gr85fxfr09j5dxh8qvrgpncpnk78";
+      sha256 = "1b3p4wy68jkyq8vhm5y568wlhsihy3ilnp2c6ig18xcw1slnkypl";
       type = "gem";
     };
-    version = "1.4.1";
+    version = "1.18.0";
   };
   rubocop-gitlab-security = {
     dependencies = ["rubocop"];
@@ -4696,10 +4769,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "18md69dkz0s5xm93c4psmvy4c0nx3a7yi61vfjn46cw6yk54fm7b";
+      sha256 = "1yam7fdm77y0x6b6i7v14iiji9020mvdd9h1ainvv88zbv8yd4wq";
       type = "gem";
     };
-    version = "0.13.0";
+    version = "0.14.3";
   };
   rubocop-performance = {
     dependencies = ["rubocop" "rubocop-ast"];
@@ -5330,10 +5403,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0p3vaq2fbmlphphqr0yjc5cyzzxjizq4zbxbbw3j2vpgdcmpi6bs";
+      sha256 = "1h5aiqqlk51z12kgvanhdvd0ajvv2i68z6a7450yxgmflfaiwz7c";
       type = "gem";
     };
-    version = "1.2.0";
+    version = "1.3.0";
   };
   ssrf_filter = {
     groups = ["default"];
@@ -5419,6 +5492,16 @@
     };
     version = "1.3.0";
   };
+  sync = {
+    groups = ["default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1z9qlq4icyiv3hz1znvsq1wz2ccqjb1zwd6gkvnwg6n50z65d0v6";
+      type = "gem";
+    };
+    version = "0.5.0";
+  };
   sys-filesystem = {
     dependencies = ["ffi"];
     groups = ["default"];
@@ -5460,6 +5543,17 @@
     };
     version = "0.8.2";
   };
+  term-ansicolor = {
+    dependencies = ["tins"];
+    groups = ["default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1xq5kci9215skdh27npyd3y55p812v4qb4x2hv3xsjvwqzz9ycwj";
+      type = "gem";
+    };
+    version = "1.7.1";
+  };
   terminal-table = {
     dependencies = ["unicode-display_width"];
     groups = ["default" "development"];
@@ -5584,6 +5678,17 @@
     };
     version = "0.8.3";
   };
+  tins = {
+    dependencies = ["sync"];
+    groups = ["default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "153q7j2nj7y43iscbfcihmwlcydx6sbd65azs27kain0gncymd90";
+      type = "gem";
+    };
+    version = "1.31.0";
+  };
   toml-rb = {
     dependencies = ["citrus"];
     groups = ["default"];
@@ -5776,14 +5881,14 @@
     version = "0.0.8";
   };
   unicode-display_width = {
-    groups = ["default" "development" "test"];
+    groups = ["danger" "default" "development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "06i3id27s60141x6fdnjn5rar1cywdwy64ilc59cz937303q3mna";
+      sha256 = "1204c1jx2g89pc25qk5150mk7j5k90692i7ihgfzqnad6qni74h2";
       type = "gem";
     };
-    version = "1.7.0";
+    version = "1.8.0";
   };
   unicode_utils = {
     groups = ["default"];
@@ -6084,9 +6189,9 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "09bq7j2p6mkbxnsg71s253dm2463kg51xc7bmjcxgyblqbh4ln7m";
+      sha256 = "0xjdr2szxvn3zb1sb5l8nfd6k9jr3b4qqbbg1mj9grf68m3fxckc";
       type = "gem";
     };
-    version = "2.5.4";
+    version = "2.6.0";
   };
 }
diff --git a/pkgs/applications/version-management/meld/default.nix b/pkgs/applications/version-management/meld/default.nix
index f8f58cdcaba29..88af6b0ceae5e 100644
--- a/pkgs/applications/version-management/meld/default.nix
+++ b/pkgs/applications/version-management/meld/default.nix
@@ -1,6 +1,5 @@
 { lib
 , fetchurl
-, fetchpatch
 , gettext
 , itstool
 , python3
@@ -19,32 +18,15 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "meld";
-  version = "3.21.1";
+  version = "3.21.2";
 
   format = "other";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "cP6Y65Ms4h1nFw47D2pzF+gT6GLemJM+pROYLpoDMgI=";
+    sha256 = "IV+odABTZ5TFllddE6nIfijxjdNyW43/mG2y4pM6cU4=";
   };
 
-  patches = [
-    # Pull upstream fix for meson-0.60:
-    #  https://gitlab.gnome.org/GNOME/meld/-/merge_requests/78
-    (fetchpatch {
-      name = "meson-0.60.patch";
-      url  = "https://gitlab.gnome.org/GNOME/meld/-/commit/cc7746c141d976a4779cf868774fae1fe7627a6d.patch";
-      sha256 = "sha256-4uJZyF00Z6svzrOebByZV1hutCZRkIQYC4rUxQr5fdQ=";
-    })
-
-    # Fix view not rendering with adwaita-icon-theme 42 due to removed icons.
-    # https://gitlab.gnome.org/GNOME/meld/-/merge_requests/83
-    (fetchpatch {
-      url  = "https://gitlab.gnome.org/GNOME/meld/-/commit/f850cdf3eaf0f08abea003d5fae118a5e92a3d61.patch";
-      sha256 = "PaK8Rpv79UwMUligm9pIY16JW/dm7eVXntAwTV4hnbE=";
-    })
-  ];
-
   nativeBuildInputs = [
     meson
     ninja
diff --git a/pkgs/applications/version-management/p4/default.nix b/pkgs/applications/version-management/p4/default.nix
index 7091f0fbc6f9c..4f61be6669aa1 100644
--- a/pkgs/applications/version-management/p4/default.nix
+++ b/pkgs/applications/version-management/p4/default.nix
@@ -23,6 +23,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Perforce Command-Line Client";
     homepage = "https://www.perforce.com";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.unfree;
     platforms = [ "x86_64-linux" ];
     maintainers = with lib.maintainers; [ corngood ];
diff --git a/pkgs/applications/version-management/p4v/default.nix b/pkgs/applications/version-management/p4v/default.nix
index 2e0e01e5c9862..9c804a7459b49 100644
--- a/pkgs/applications/version-management/p4v/default.nix
+++ b/pkgs/applications/version-management/p4v/default.nix
@@ -76,6 +76,7 @@ in stdenv.mkDerivation rec {
   meta = {
     description = "Perforce Visual Client";
     homepage = "https://www.perforce.com";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.unfreeRedistributable;
     platforms = [ "x86_64-linux" ];
     maintainers = with lib.maintainers; [ nathyong nioncode ];
diff --git a/pkgs/applications/version-management/sublime-merge/common.nix b/pkgs/applications/version-management/sublime-merge/common.nix
index 28c7350ae39b5..17f36ab4161b4 100644
--- a/pkgs/applications/version-management/sublime-merge/common.nix
+++ b/pkgs/applications/version-management/sublime-merge/common.nix
@@ -121,6 +121,7 @@ in stdenv.mkDerivation (rec {
     description = "Git client from the makers of Sublime Text";
     homepage = "https://www.sublimemerge.com";
     maintainers = with maintainers; [ zookatron ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     platforms = [ "x86_64-linux" ];
   };
diff --git a/pkgs/applications/video/filebot/default.nix b/pkgs/applications/video/filebot/default.nix
index 8bf1bf7b3ba58..45f7d099056d5 100644
--- a/pkgs/applications/video/filebot/default.nix
+++ b/pkgs/applications/video/filebot/default.nix
@@ -41,7 +41,10 @@ stdenv.mkDerivation rec {
     '';
     homepage = "https://filebot.net";
     changelog = "https://www.filebot.net/forums/viewforum.php?f=7";
-    sourceProvenance = with sourceTypes; [ binaryBytecode ];
+    sourceProvenance = with sourceTypes; [
+      binaryBytecode
+      binaryNativeCode
+    ];
     license = licenses.unfreeRedistributable;
     maintainers = with maintainers; [ gleber felschr ];
     platforms = platforms.linux;
diff --git a/pkgs/applications/video/flirc/default.nix b/pkgs/applications/video/flirc/default.nix
index 6285094c461a4..58de5ceab099a 100644
--- a/pkgs/applications/video/flirc/default.nix
+++ b/pkgs/applications/video/flirc/default.nix
@@ -39,6 +39,7 @@ mkDerivation rec {
     homepage = "https://flirc.tv/more/flirc-usb";
     description = "Use any Remote with your Media Center";
     maintainers = with maintainers; [ aanderse ];
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     platforms = [ "x86_64-linux" ];
   };
diff --git a/pkgs/applications/video/lightworks/default.nix b/pkgs/applications/video/lightworks/default.nix
index 6bec6e25533f1..b01af67cd68e6 100644
--- a/pkgs/applications/video/lightworks/default.nix
+++ b/pkgs/applications/video/lightworks/default.nix
@@ -85,6 +85,7 @@ in buildFHSUserEnv {
   meta = {
     description = "Professional Non-Linear Video Editor";
     homepage = "https://www.lwks.com/";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.unfree;
     maintainers = with lib.maintainers; [ antonxy vojta001 ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/video/makemkv/default.nix b/pkgs/applications/video/makemkv/default.nix
index 2c15513d4d65e..c3d758268917c 100644
--- a/pkgs/applications/video/makemkv/default.nix
+++ b/pkgs/applications/video/makemkv/default.nix
@@ -79,6 +79,7 @@ in mkDerivation {
       can always download the latest version from makemkv.com that will reset the
       expiration date.
     '';
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     homepage = "http://makemkv.com";
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/video/streamlink-twitch-gui/bin.nix b/pkgs/applications/video/streamlink-twitch-gui/bin.nix
index 395da881ea9f5..7459d08d59531 100644
--- a/pkgs/applications/video/streamlink-twitch-gui/bin.nix
+++ b/pkgs/applications/video/streamlink-twitch-gui/bin.nix
@@ -124,6 +124,7 @@ stdenv.mkDerivation rec {
     longDescription = "Browse Twitch.tv and watch streams in your videoplayer of choice";
     homepage = "https://streamlink.github.io/streamlink-twitch-gui/";
     downloadPage = "https://github.com/streamlink/streamlink-twitch-gui/releases";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.mit;
     maintainers = with maintainers; [ rileyinman ];
     platforms = [ "x86_64-linux" "i686-linux" ];
diff --git a/pkgs/applications/video/vlc/default.nix b/pkgs/applications/video/vlc/default.nix
index 700730a57fc97..770fe2cea3ee2 100644
--- a/pkgs/applications/video/vlc/default.nix
+++ b/pkgs/applications/video/vlc/default.nix
@@ -34,6 +34,7 @@
 , libmtp
 , liboggz
 , libopus
+, libplacebo
 , libpulseaudio
 , libraw1394
 , librsvg
@@ -123,6 +124,7 @@ stdenv.mkDerivation rec {
     libmtp
     liboggz
     libopus
+    libplacebo
     libpulseaudio
     libraw1394
     librsvg
diff --git a/pkgs/applications/virtualization/conmon/default.nix b/pkgs/applications/virtualization/conmon/default.nix
index 1236775ac67df..2a9f1a27c3d5a 100644
--- a/pkgs/applications/virtualization/conmon/default.nix
+++ b/pkgs/applications/virtualization/conmon/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     owner = "containers";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-WxRMY43Z9OytY1kc91VVmqLn5cl0UC/0Zj8x3vpsaBQ=";
+    sha256 = "sha256-KDAm+Djk1AaA3zXhxywT6HknT0tVCEZLS27nO9j/WgM=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/applications/virtualization/docker/compose.nix b/pkgs/applications/virtualization/docker/compose.nix
index 98af8ebf7fb53..583a3e50a1f59 100644
--- a/pkgs/applications/virtualization/docker/compose.nix
+++ b/pkgs/applications/virtualization/docker/compose.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "docker-compose";
-  version = "2.6.0";
+  version = "2.6.1";
 
   src = fetchFromGitHub {
     owner = "docker";
     repo = "compose";
     rev = "v${version}";
-    sha256 = "sha256-Fg99ugaqH/jL3KUZ5Vh/SJnqzEyOaR/KuPFwt2oqXxM=";
+    sha256 = "sha256-D3+qDWxg3e5/3UIMz8FZDuxmQHmTv0NJVT/otGYedtw=";
   };
 
-  vendorSha256 = "sha256-7uNQNO+EI90J2Btz2tnumKqd+AtVWON+Csh6tkTNKNA=";
+  vendorSha256 = "sha256-WxLQfu65Gr+ao/pM8B2uiS88sNT72Klhz7ZIrEadW5g=";
 
   ldflags = [ "-X github.com/docker/compose/v2/internal.Version=${version}" "-s" "-w" ];
 
diff --git a/pkgs/applications/virtualization/driver/win-signed-gplpv-drivers/default.nix b/pkgs/applications/virtualization/driver/win-signed-gplpv-drivers/default.nix
index ef8ec062e4d88..8ba02d940216c 100644
--- a/pkgs/applications/virtualization/driver/win-signed-gplpv-drivers/default.nix
+++ b/pkgs/applications/virtualization/driver/win-signed-gplpv-drivers/default.nix
@@ -40,6 +40,7 @@ stdenv.mkDerivation {
     '';
     homepage = "http://wiki.univention.de/index.php?title=Installing-signed-GPLPV-drivers";
     maintainers = [ maintainers.tstrobel ];
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     platforms = platforms.linux;
     license = licenses.gpl2;
   };
diff --git a/pkgs/applications/virtualization/driver/win-spice/default.nix b/pkgs/applications/virtualization/driver/win-spice/default.nix
index 2c2cd90f1c26f..0cf8e06c3115b 100644
--- a/pkgs/applications/virtualization/driver/win-spice/default.nix
+++ b/pkgs/applications/virtualization/driver/win-spice/default.nix
@@ -72,6 +72,7 @@ stdenv.mkDerivation  {
     description = "Windows SPICE Drivers";
     homepage = "https://www.spice-space.org/";
     license = [ licenses.asl20 ]; # See https://github.com/vrozenfe/qxl-dod
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     maintainers = [ maintainers.tstrobel ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/applications/virtualization/virtualbox/default.nix b/pkgs/applications/virtualization/virtualbox/default.nix
index 642c4b1390f46..4e07d92d661d4 100644
--- a/pkgs/applications/virtualization/virtualbox/default.nix
+++ b/pkgs/applications/virtualization/virtualbox/default.nix
@@ -230,6 +230,10 @@ in stdenv.mkDerivation {
 
   meta = {
     description = "PC emulator";
+    sourceProvenance = with lib.sourceTypes; [
+      fromSource
+      binaryNativeCode
+    ];
     license = licenses.gpl2;
     homepage = "https://www.virtualbox.org/";
     maintainers = with maintainers; [ sander ];
diff --git a/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix b/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
index 9c012750bf10c..da9f32b9c6856 100644
--- a/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
+++ b/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
@@ -155,6 +155,7 @@ in stdenv.mkDerivation rec {
       This add-on provides support for dynamic resizing of the X Display, shared
       host/guest clipboard support and guest OpenGL support.
     '';
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = "GPL";
     maintainers = [ lib.maintainers.sander ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/applications/virtualization/vmware-workstation/default.nix b/pkgs/applications/virtualization/vmware-workstation/default.nix
index 58cd4092a95d5..247fb3bd6eac2 100755
--- a/pkgs/applications/virtualization/vmware-workstation/default.nix
+++ b/pkgs/applications/virtualization/vmware-workstation/default.nix
@@ -334,6 +334,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Industry standard desktop hypervisor for x86-64 architecture";
     homepage = "https://www.vmware.com/products/workstation-pro.html";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     platforms = [ "x86_64-linux" ];
     maintainers = with maintainers; [ deinferno ];
diff --git a/pkgs/applications/window-managers/i3/status-rust.nix b/pkgs/applications/window-managers/i3/status-rust.nix
index c3d8d96bba4e1..ddc4383fbd73c 100644
--- a/pkgs/applications/window-managers/i3/status-rust.nix
+++ b/pkgs/applications/window-managers/i3/status-rust.nix
@@ -15,16 +15,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "i3status-rust";
-  version = "0.21.10";
+  version = "0.22.0";
 
   src = fetchFromGitHub {
     owner = "greshake";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-HtPgl52ysE/CVX706YeKBFc6CgGpHzvHwZoS+DzHADY=";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-9Fp5k14QkV1CwLSL1nUUu6NYIpjfvI9vNJRYNqvyr3M=";
   };
 
-  cargoSha256 = "sha256-ini0AIYwvTskNFMSC+Gy23ohL75PTET95e1mjpjCsWE=";
+  cargoSha256 = "sha256-MzosatZ4yPHAdANqOBPVW2wpjnojLo9B9N9o4DtU0Iw=";
 
   nativeBuildInputs = [ pkg-config makeWrapper ];
 
diff --git a/pkgs/data/fonts/victor-mono/default.nix b/pkgs/data/fonts/victor-mono/default.nix
index 45873e1b7f96c..11d3f1d25baef 100644
--- a/pkgs/data/fonts/victor-mono/default.nix
+++ b/pkgs/data/fonts/victor-mono/default.nix
@@ -1,10 +1,11 @@
 { lib, fetchzip }:
 
 let
-  version = "1.5.2";
+  version = "1.5.3";
 in
 fetchzip {
   name = "victor-mono-${version}";
+  stripRoot = false;
 
   # Upstream prefers we download from the website,
   # but we really insist on a more versioned resource.
@@ -16,12 +17,15 @@ fetchzip {
   url = "https://github.com/rubjo/victor-mono/raw/v${version}/public/VictorMonoAll.zip";
 
   postFetch = ''
-    mkdir -p $out/share/fonts/
-    unzip -j $downloadedFile \*.otf -d $out/share/fonts/opentype
-    unzip -j $downloadedFile \*.ttf -d $out/share/fonts/truetype
+    mkdir -p "$out/share/fonts/"
+
+    mv $out/OTF $out/share/fonts/opentype
+    mv $out/TTF $out/share/fonts/truetype
+
+    rm -r $out/{EOT,WOFF,WOFF2}
   '';
 
-  sha256 = "sha256-cNDZh0P/enmoKL/6eHzkgl5ghtai2K9cTgWMVmm8GIA=";
+  sha256 = "sha256-3TGpUDBJ24NEJb00oaJAHEbjC58bSthohzqM1klVDGA=";
 
   meta = with lib; {
     description = "Free programming font with cursive italics and ligatures";
diff --git a/pkgs/data/misc/v2ray-domain-list-community/default.nix b/pkgs/data/misc/v2ray-domain-list-community/default.nix
index 5e84f479d21bf..a5bbb2b5c013b 100644
--- a/pkgs/data/misc/v2ray-domain-list-community/default.nix
+++ b/pkgs/data/misc/v2ray-domain-list-community/default.nix
@@ -3,12 +3,12 @@
 let
   generator = pkgsBuildBuild.buildGoModule rec {
     pname = "v2ray-domain-list-community";
-    version = "20220528180904";
+    version = "20220624025859";
     src = fetchFromGitHub {
       owner = "v2fly";
       repo = "domain-list-community";
       rev = version;
-      sha256 = "sha256-j1Q7B/U0OADOcgJRJ269Jx9Z5dmmT4T2eaOHeGmUjmc=";
+      sha256 = "sha256-/4wfTtRsBzOCbx3I3H28tB935xDZPPwHOFFmjiV7kEI=";
     };
     vendorSha256 = "sha256-Igx8yGWWVmVEogvbrosaK13LVs+ZZuYLBNji7iSfzdo=";
     meta = with lib; {
diff --git a/pkgs/data/misc/v2ray-geoip/default.nix b/pkgs/data/misc/v2ray-geoip/default.nix
index a6954100d547d..e4ab5df758421 100644
--- a/pkgs/data/misc/v2ray-geoip/default.nix
+++ b/pkgs/data/misc/v2ray-geoip/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "v2ray-geoip";
-  version = "202205260055";
+  version = "202206230045";
 
   src = fetchFromGitHub {
     owner = "v2fly";
     repo = "geoip";
-    rev = "96f4639373709f7560ccaf374d1ff008781aa324";
-    sha256 = "sha256-aFTLeYr+JishhJ2AhGMrD02fKxci2rREkh8HN9HtXLs=";
+    rev = "2e2aba7f3dfb4139e8a882f85350045f2ef522d1";
+    sha256 = "sha256-WFvS51RmkAWivYj0HFAT6S3euJk+GSYLDTN3cmkcCNs=";
   };
 
   installPhase = ''
diff --git a/pkgs/data/themes/nordic/default.nix b/pkgs/data/themes/nordic/default.nix
index d250de15ca9a0..c29bb69bf7b10 100644
--- a/pkgs/data/themes/nordic/default.nix
+++ b/pkgs/data/themes/nordic/default.nix
@@ -7,70 +7,70 @@
 
 stdenv.mkDerivation rec {
   pname = "nordic";
-  version = "unstable-2022-02-26";
+  version = "unstable-2022-06-21";
 
   srcs = [
     (fetchFromGitHub {
       owner = "EliverLara";
       repo = pname;
-      rev = "0da58e462e8ba6c71245d13fbddac950b72018ae";
-      sha256 = "sha256-w7e3DqQV4L/OvntKHJA4+3Dj6dRnlH73SxvW770QIyU=";
+      rev = "bb5e31ec1488b1fd5641aa10f65f36d8714b5dba";
+      sha256 = "sha256-wTWHdao/1RLqUmqh/9gEyhERGymFWHqiC97JD28LSgk=";
       name = "Nordic";
     })
 
     (fetchFromGitHub {
       owner = "EliverLara";
       repo = pname;
-      rev = "9daf11acf3419e2f23d0993ce862a1c944fb8519";
-      sha256 = "sha256-zGgw6THLX7q19BDsllPUrWqQcL6FYAewcyqjQdXzLzg=";
+      rev = "e1fb044a14b5c7fe1f6c2de42bfb5fdfb1448415";
+      sha256 = "sha256-oWwc+bzeAf0NoYfA2r2oGpeciVUWFC7yJzlUAYfpdTY=";
       name = "Nordic-standard-buttons";
     })
 
     (fetchFromGitHub {
       owner = "EliverLara";
       repo = pname;
-      rev = "a40819bd00160f987cdf254ce8c34eabebecf0eb";
-      sha256 = "sha256-rSNLdxTfvzTFzI5723WIGRS+NZ8iqUOUliDpkznZrwE=";
+      rev = "4c7c9f2d670a6f0c9cff1ec31fab67c826fdcc0f";
+      sha256 = "sha256-txKClsygX2IUGF8oOG6gDY6Y3v28kJthjdPrPEOZarQ=";
       name = "Nordic-darker";
     })
 
     (fetchFromGitHub {
       owner = "EliverLara";
       repo = pname;
-      rev = "4e69cf6e1798938ab7c5795940c663d866ce8201";
-      sha256 = "sha256-p8VaKeKxEiYX4oVqWoyschAq0j/LvPq9yD/awaHKRZw=";
+      rev = "8abe28ff07c190b8c343aacb6a0ce58e62abbd74";
+      sha256 = "sha256-tk9VZtwpIuBcWu1ERJLnlhM71pkrNEUzu8PDb+IEnpw=";
       name = "Nordic-darker-standard-buttons";
     })
 
     (fetchFromGitHub {
       owner = "EliverLara";
       repo = pname;
-      rev = "866629583187b914725f05683125fde7f6c280f1";
-      sha256 = "sha256-TQ4G5W87zpTrLU+f+eb5VHwaWuKSbItXCgXSL33U8As=";
+      rev = "9764e0f1af100731f77bf7f15792639d0032e5ed";
+      sha256 = "sha256-3vxrbxUhPj6PKWpjyCruhFxYz9nPfo1DHferYUD7enU=";
       name = "Nordic-bluish-accent";
     })
 
     (fetchFromGitHub {
       owner = "EliverLara";
       repo = pname;
-      rev = "f3702ae02e3caaf74eab0ef9156af9f2a476021b";
-      sha256 = "sha256-drXRfZxCrH2vAXjZSAjWEHcQrehxnM0WLkgbh+cFJhI=";
+      rev = "407316a3fd5e07d183474aea4cae28bb958afa6c";
+      sha256 = "sha256-SvLTqDXjy8c4rZo0cZ83kfuiGd2+hyGvwILxVCz65jQ=";
       name = "Nordic-bluish-accent-standard-buttons";
     })
 
     (fetchFromGitHub {
       owner = "EliverLara";
       repo = "${pname}-polar";
-      rev = "4cf3e5c30ebd17a3d53ab0337c191e304feff7b5";
-      sha256 = "sha256-LTCJ7AyABQDTDkjuqcXaKXePFwOpmXeKaW2mWYah4ao=";
+      rev = "1ffa167c4807e4b22e0934aee41403721877bc56";
+      sha256 = "sha256-Xat5YWnxTBnvnUfs1o5EhdmDezmOXtqry97Yc8O+WYM=";
       name = "Nordic-Polar";
     })
 
     (fetchFromGitHub {
       owner = "EliverLara";
       repo = "${pname}-polar";
-      rev = "72cbd567212b21ea20769fe244c148f799435536";
-      sha256 = "sha256-qNIyr+Eo0dzPVh9PxDCHv0e6pswACbf9nLhAG75YEYc=";
+      rev = "9bc68223edf7ad9dc83032d7d51ccc53f9440337";
+      sha256 = "sha256-XjGjijBky/iPcoUGDRrwwoZ5f2gbLchmQizkQN+Opjg=";
       name = "Nordic-Polar-standard-buttons";
     })
   ];
diff --git a/pkgs/development/compilers/gcc/4.9/default.nix b/pkgs/development/compilers/gcc/4.9/default.nix
index b3d0f8d5d502e..571d0b023124c 100644
--- a/pkgs/development/compilers/gcc/4.9/default.nix
+++ b/pkgs/development/compilers/gcc/4.9/default.nix
@@ -154,7 +154,10 @@ stdenv.mkDerivation ({
 
   hardeningDisable = [ "format" "pie" ];
 
-  outputs = if langJava || langGo then ["out" "man" "info"]
+  # When targetting darwin, libgcc_ext.10.{4,5}.dylib are created as
+  # MH_DYLIB_STUB files, which install_name_tool can't change, so we
+  # get a cycle between $out and $lib.
+  outputs = if langJava || langGo || targetPlatform.isDarwin then ["out" "man" "info"]
     else [ "out" "lib" "man" "info" ];
   setOutputFlags = false;
   NIX_NO_SELF_RPATH = true;
@@ -328,7 +331,6 @@ stdenv.mkDerivation ({
     maintainers = with lib.maintainers; [ veprbl ];
 
     platforms = lib.platforms.unix;
-    badPlatforms = lib.platforms.darwin;
   };
 }
 
diff --git a/pkgs/development/compilers/gcc/common/pre-configure.nix b/pkgs/development/compilers/gcc/common/pre-configure.nix
index d9977e0ba2f9e..310e7f8b574bd 100644
--- a/pkgs/development/compilers/gcc/common/pre-configure.nix
+++ b/pkgs/development/compilers/gcc/common/pre-configure.nix
@@ -6,14 +6,16 @@
 , langGo }:
 
 assert langJava -> lib.versionOlder version "7";
-assert langAda -> gnatboot != null;
-
-lib.optionalString (hostPlatform.isSunOS && hostPlatform.is64bit) ''
+assert langAda -> gnatboot != null; let
+  needsLib
+    =  (lib.versionOlder version "7" && (langJava || langGo))
+    || (lib.versions.major version == "4" && lib.versions.minor version == "9" && targetPlatform.isDarwin);
+in lib.optionalString (hostPlatform.isSunOS && hostPlatform.is64bit) ''
   export NIX_LDFLAGS=`echo $NIX_LDFLAGS | sed -e s~$prefix/lib~$prefix/lib/amd64~g`
   export LDFLAGS_FOR_TARGET="-Wl,-rpath,$prefix/lib/amd64 $LDFLAGS_FOR_TARGET"
   export CXXFLAGS_FOR_TARGET="-Wl,-rpath,$prefix/lib/amd64 $CXXFLAGS_FOR_TARGET"
   export CFLAGS_FOR_TARGET="-Wl,-rpath,$prefix/lib/amd64 $CFLAGS_FOR_TARGET"
-'' + lib.optionalString (lib.versionOlder version "7" && (langJava || langGo)) ''
+'' + lib.optionalString needsLib ''
   export lib=$out;
 '' + lib.optionalString langAda ''
   export PATH=${gnatboot}/bin:$PATH
diff --git a/pkgs/development/compilers/hare/disable-failing-test-cases.patch b/pkgs/development/compilers/hare/disable-failing-test-cases.patch
new file mode 100644
index 0000000000000..4f8ba6056046d
--- /dev/null
+++ b/pkgs/development/compilers/hare/disable-failing-test-cases.patch
@@ -0,0 +1,37 @@
+diff --git a/math/complex/+test.ha b/math/complex/+test.ha
+index a1cc0916..705a0a41 100644
+--- a/math/complex/+test.ha
++++ b/math/complex/+test.ha
+@@ -567,8 +567,8 @@ const TEST_COSSC: [](c128, c128) = [
+ 		(math::INF, math::NAN)), // real sign unspecified
+ 	((math::INF, math::NAN),
+ 		(math::NAN, math::NAN)),
+-	((math::NAN, 0f64),
+-		(math::NAN, -0f64)), // imaginary sign unspecified
++//	((math::NAN, 0f64),
++//		(math::NAN, -0f64)), // imaginary sign unspecified
+ 	((math::NAN, 1f64),
+ 		(math::NAN, math::NAN)),
+ 	((math::NAN, math::INF),
+@@ -583,8 +583,8 @@ const TEST_COSHSC: [](c128, c128) = [
+ 		(1f64, 0f64)),
+ 	((0f64, math::INF),
+ 		(math::NAN, 0f64)), // imaginary sign unspecified
+-	((0f64, math::NAN),
+-		(math::NAN, 0f64)), // imaginary sign unspecified
++//	((0f64, math::NAN),
++//		(math::NAN, 0f64)), // imaginary sign unspecified
+ 	((1f64, math::INF),
+ 		(math::NAN, math::NAN)),
+ 	((1f64, math::NAN),
+@@ -627,8 +627,8 @@ const TEST_EXPSC: [](c128, c128) = [
+ 		(0f64, 0f64)), // real and imaginary sign unspecified
+ 	((math::INF, math::INF),
+ 		(math::INF, math::NAN)), // real sign unspecified
+-	((-math::INF, math::NAN),
+-		(0f64, 0f64)), // real and imaginary sign unspecified
++//	((-math::INF, math::NAN),
++//		(0f64, 0f64)), // real and imaginary sign unspecified
+ 	((math::INF, math::NAN),
+ 		(math::INF, math::NAN)), // real sign unspecified
+ 	((math::NAN, 0f64),
diff --git a/pkgs/development/compilers/hare/hare.nix b/pkgs/development/compilers/hare/hare.nix
index f5c0cd8e405f5..e24fc68ab4228 100644
--- a/pkgs/development/compilers/hare/hare.nix
+++ b/pkgs/development/compilers/hare/hare.nix
@@ -11,16 +11,18 @@
 
 stdenv.mkDerivation rec {
   pname = "hare";
-  version = "0.pre+date=2022-04-27";
+  version = "unstable-2022-06-18";
 
   src = fetchFromSourcehut {
     name = pname + "-src";
     owner = "~sircmpwn";
     repo = pname;
-    rev = "1bfb2e6dee850c675a8831b41420800d3c62c2a0";
-    hash = "sha256-1b7U5u3PM3jmnH/OnY9O++GTPyVOdFkJ0fwJBoDZgSU=";
+    rev = "ac9b2c35c09d555e09dbd81c5ed95bdfa14313ba";
+    hash = "sha256-eeS14LGkbi9IamvKzK+HF0Rvk9NFp4QVYcrHwNSNBx4=";
   };
 
+  patches = [ ./disable-failing-test-cases.patch ];
+
   nativeBuildInputs = [
     binutils-unwrapped
     harec
@@ -35,6 +37,7 @@ stdenv.mkDerivation rec {
     qbe
   ];
 
+  setupHook = ./setup-hook.sh;
   strictDeps = true;
 
   configurePhase =
@@ -59,6 +62,7 @@ stdenv.mkDerivation rec {
         runHook preConfigure
 
         export HARECACHE="$NIX_BUILD_TOP/.harecache"
+        export BINOUT="$NIX_BUILD_TOP/.bin"
         cat ${config-file} > config.mk
 
         runHook postConfigure
diff --git a/pkgs/development/compilers/hare/harec.nix b/pkgs/development/compilers/hare/harec.nix
index a3ad53350b094..4c77a77bd0d1a 100644
--- a/pkgs/development/compilers/hare/harec.nix
+++ b/pkgs/development/compilers/hare/harec.nix
@@ -6,14 +6,14 @@
 
 stdenv.mkDerivation rec {
   pname = "harec";
-  version = "0.pre+date=2022-04-26";
+  version = "unstable-2022-06-20";
 
   src = fetchFromSourcehut {
     name = pname + "-src";
     owner = "~sircmpwn";
     repo = pname;
-    rev = "e5fb5176ba629e98ace5fcb3aa427b2c25d8fdf0";
-    hash = "sha256-sqt3q6sarzrpyJ/1QYM1WTukrZpflAmAYq6pQwAwe18=";
+    rev = "2eccbc4b959a590dda91143c8487edda841106d9";
+    hash = "sha256-pwy7cNxAqIbhx9kpcjfgk7sCEns9oA6zhKSQJdHLZCM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/compilers/hare/setup-hook.sh b/pkgs/development/compilers/hare/setup-hook.sh
new file mode 100644
index 0000000000000..999b91df122fa
--- /dev/null
+++ b/pkgs/development/compilers/hare/setup-hook.sh
@@ -0,0 +1,11 @@
+export HARECACHE="$NIX_BUILD_TOP/.harecache"
+
+addHarepath () {
+    for haredir in third-party stdlib; do
+        if [[ -d "$1/src/hare/$haredir" ]]; then
+            addToSearchPath HAREPATH "$1/src/hare/$haredir"
+        fi
+    done
+}
+
+addEnvHooks "$hostOffset" addHarepath
diff --git a/pkgs/development/compilers/llvm/14/compiler-rt/armv7l.patch b/pkgs/development/compilers/llvm/14/compiler-rt/armv7l.patch
deleted file mode 100644
index 120cfe6feb2a6..0000000000000
--- a/pkgs/development/compilers/llvm/14/compiler-rt/armv7l.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-diff -ur compiler-rt-10.0.0.src/cmake/builtin-config-ix.cmake compiler-rt-10.0.0.src-patched/cmake/builtin-config-ix.cmake
---- compiler-rt-10.0.0.src/cmake/builtin-config-ix.cmake	2020-03-24 00:01:02.000000000 +0900
-+++ compiler-rt-10.0.0.src-patched/cmake/builtin-config-ix.cmake	2020-05-10 03:42:00.883450706 +0900
-@@ -24,7 +24,7 @@
- 
- 
- set(ARM64 aarch64)
--set(ARM32 arm armhf armv6m armv7m armv7em armv7 armv7s armv7k)
-+set(ARM32 arm armhf armv6m armv7m armv7em armv7 armv7s armv7k armv7l)
- set(HEXAGON hexagon)
- set(X86 i386)
- set(X86_64 x86_64)
-diff -ur compiler-rt-10.0.0.src/lib/builtins/CMakeLists.txt compiler-rt-10.0.0.src-patched/lib/builtins/CMakeLists.txt
---- compiler-rt-10.0.0.src/lib/builtins/CMakeLists.txt	2020-03-24 00:01:02.000000000 +0900
-+++ compiler-rt-10.0.0.src-patched/lib/builtins/CMakeLists.txt	2020-05-10 03:44:49.468579650 +0900
-@@ -474,6 +474,7 @@
- set(armv7_SOURCES ${arm_SOURCES})
- set(armv7s_SOURCES ${arm_SOURCES})
- set(armv7k_SOURCES ${arm_SOURCES})
-+set(armv7l_SOURCES ${arm_SOURCES})
- set(arm64_SOURCES ${aarch64_SOURCES})
- 
- # macho_embedded archs
-@@ -595,7 +596,7 @@
-   foreach (arch ${BUILTIN_SUPPORTED_ARCH})
-     if (CAN_TARGET_${arch})
-       # For ARM archs, exclude any VFP builtins if VFP is not supported
--      if (${arch} MATCHES "^(arm|armhf|armv7|armv7s|armv7k|armv7m|armv7em)$")
-+      if (${arch} MATCHES "^(arm|armhf|armv7|armv7s|armv7k|armv7l|armv7m|armv7em)$")
-         string(REPLACE ";" " " _TARGET_${arch}_CFLAGS "${TARGET_${arch}_CFLAGS}")
-         check_compile_definition(__VFP_FP__ "${CMAKE_C_FLAGS} ${_TARGET_${arch}_CFLAGS}" COMPILER_RT_HAS_${arch}_VFP)
-         if(NOT COMPILER_RT_HAS_${arch}_VFP)
diff --git a/pkgs/development/compilers/llvm/14/compiler-rt/default.nix b/pkgs/development/compilers/llvm/14/compiler-rt/default.nix
index 59ca5348fed44..cddfd5c23806b 100644
--- a/pkgs/development/compilers/llvm/14/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/14/compiler-rt/default.nix
@@ -73,8 +73,7 @@ stdenv.mkDerivation {
     # extra `/`.
     ./normalize-var.patch
   ] # Prevent a compilation error on darwin
-    ++ lib.optional stdenv.hostPlatform.isDarwin ./darwin-targetconditionals.patch
-    ++ lib.optional stdenv.hostPlatform.isAarch32 ./armv7l.patch;
+    ++ lib.optional stdenv.hostPlatform.isDarwin ./darwin-targetconditionals.patch;
 
   # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
   # to get it, but they're unfree. Since LLVM is rather central to the stdenv, we patch out TSAN support so that Hydra
diff --git a/pkgs/development/interpreters/wasmtime/default.nix b/pkgs/development/interpreters/wasmtime/default.nix
index 47bdaf8623627..508dc2be60b9b 100644
--- a/pkgs/development/interpreters/wasmtime/default.nix
+++ b/pkgs/development/interpreters/wasmtime/default.nix
@@ -1,42 +1,34 @@
-{ rustPlatform, fetchFromGitHub, lib, stdenv, v8 }:
+{ rustPlatform, fetchFromGitHub, lib }:
 
 rustPlatform.buildRustPackage rec {
   pname = "wasmtime";
-  version = "0.37.0";
+  version = "0.38.0";
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ZUr1v94If8ER4lTHLwuP+F3xfXU7IW4ZEztBA2TPvVg=";
+    sha256 = "sha256-q+6w22MbI3HRpmkybZXXWbkK7jbd6lyxodC3EpSovRI=";
     fetchSubmodules = true;
   };
 
-  cargoSha256 = "sha256-X+KDeWavFTBaxbSPlIiyuiBC7wg1/5C/NXp+VEY8Mk8=";
-
-  # This environment variable is required so that when wasmtime tries
-  # to run tests by using the rusty_v8 crate, it does not try to
-  # download a static v8 build from the Internet, what would break
-  # build hermetism.
-  RUSTY_V8_ARCHIVE = lib.optionalString stdenv.isLinux "${v8}/lib/libv8.a";
+  cargoSha256 = "sha256-uuhGb0/RDz1/3O8WYiyGIUQFh0WZWJgujqtvH+hgbdA=";
 
   doCheck = true;
   checkFlags = [
     "--skip=cli_tests::run_cwasm"
-    "--skip=commands::compile::test::test_successful_compile"
     "--skip=commands::compile::test::test_aarch64_flags_compile"
-    "--skip=commands::compile::test::test_unsupported_flags_compile"
+    "--skip=commands::compile::test::test_successful_compile"
     "--skip=commands::compile::test::test_x64_flags_compile"
     "--skip=commands::compile::test::test_x64_presets_compile"
     "--skip=traps::parse_dwarf_info"
   ];
 
   meta = with lib; {
-    broken = stdenv.isDarwin;
     description = "Standalone JIT-style runtime for WebAssembly, using Cranelift";
     homepage = "https://github.com/bytecodealliance/wasmtime";
     license = licenses.asl20;
-    maintainers = [ maintainers.matthewbauer ];
+    maintainers = with maintainers; [ ereslibre matthewbauer ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/amdvlk/default.nix b/pkgs/development/libraries/amdvlk/default.nix
index cafa505da621b..54bd91db3ae81 100644
--- a/pkgs/development/libraries/amdvlk/default.nix
+++ b/pkgs/development/libraries/amdvlk/default.nix
@@ -22,13 +22,13 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "amdvlk";
-  version = "2022.Q2.2";
+  version = "2022.Q2.3";
 
   src = fetchRepoProject {
     name = "${pname}-src";
     manifest = "https://github.com/GPUOpen-Drivers/AMDVLK.git";
     rev = "refs/tags/v-${version}";
-    sha256 = "4LV6g2snT1usY+Ic9Hb/IwXAJQ97I9DigZCah6mwewA=";
+    sha256 = "Yd2juNdSP8TdSX9j/iXsC2xrIRzDEuXJbms91AqwjEc=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/libraries/cpp-utilities/default.nix b/pkgs/development/libraries/cpp-utilities/default.nix
index f2f331eec6878..7064964adc580 100644
--- a/pkgs/development/libraries/cpp-utilities/default.nix
+++ b/pkgs/development/libraries/cpp-utilities/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cpp-utilities";
-  version = "5.15.0";
+  version = "5.16.0";
 
   src = fetchFromGitHub {
     owner = "Martchus";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-3D/5Bl5vANZrHtJGehoHwQ0mDrL8TJ7iK2GoViiuj6E=";
+    sha256 = "sha256-B/pWdfK3KddAIppJXQRohiIK8mouAQjXRHic75IzY/Q=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/doctest/default.nix b/pkgs/development/libraries/doctest/default.nix
index 360c643f52336..6c9281bda9918 100644
--- a/pkgs/development/libraries/doctest/default.nix
+++ b/pkgs/development/libraries/doctest/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "doctest";
-  version = "2.4.8";
+  version = "2.4.9";
 
   src = fetchFromGitHub {
     owner = "doctest";
     repo = "doctest";
     rev = "v${version}";
-    sha256 = "sha256-/4lyCQZHsa32ozes5MJ0JZpQ99MECRlgFeSzN/Zs/BQ=";
+    sha256 = "sha256-ugmkeX2PN4xzxAZpWgswl4zd2u125Q/ADSKzqTfnd94=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/egl-wayland/default.nix b/pkgs/development/libraries/egl-wayland/default.nix
index 3881f8f7ee38b..83cde54f348e7 100644
--- a/pkgs/development/libraries/egl-wayland/default.nix
+++ b/pkgs/development/libraries/egl-wayland/default.nix
@@ -42,7 +42,7 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "egl-wayland";
-  version = "1.1.9";
+  version = "1.1.10";
 
   outputs = [ "out" "dev" ];
 
@@ -50,7 +50,7 @@ in stdenv.mkDerivation rec {
     owner = "Nvidia";
     repo = pname;
     rev = version;
-    sha256 = "sha256-rcmGVEcOtKTR8sVkHV7Xb+8NuKWUapYn+/Fswi4z6Mc=";
+    sha256 = "sha256-dbcEMtPnzF2t7O8YtKVUGSvJqb5WPMmmW+SyqOFnDY4=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/development/libraries/geos/default.nix b/pkgs/development/libraries/geos/default.nix
index c067a705d0bfe..32b3155b8c564 100644
--- a/pkgs/development/libraries/geos/default.nix
+++ b/pkgs/development/libraries/geos/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
 , cmake }:
 
 stdenv.mkDerivation rec {
@@ -12,13 +13,15 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-ULvFmaw4a0wrOWLcxBHwBAph8gSq7066ciXs3Qz0VxU=";
   };
 
-  nativeBuildInputs = [ cmake ];
+  patches = [
+    # Fix paths with absolute CMAKE_INSTALL_*DIR
+    (fetchpatch {
+      url = "https://github.com/libgeos/geos/commit/11faa4db672ed61d64fd8a6f1a59114f5b5f2406.patch";
+      hash = "sha256-oAArwGq91Z93C6hBPQD0AlY8Q4Nnn6tA40HUPoZ5ftc=";
+    })
+  ];
 
-  postPatch = ''
-    substituteInPlace tools/geos-config.in \
-      --replace "@libdir@" "@prefix@/lib" \
-      --replace "@includedir@" "@prefix@/include"
-  '';
+  nativeBuildInputs = [ cmake ];
 
   meta = with lib; {
     description = "C++ port of the Java Topology Suite (JTS)";
diff --git a/pkgs/development/libraries/java/commons/daemon/default.nix b/pkgs/development/libraries/java/commons/daemon/default.nix
index 7b5be45e200cf..e41c475c829d3 100644
--- a/pkgs/development/libraries/java/commons/daemon/default.nix
+++ b/pkgs/development/libraries/java/commons/daemon/default.nix
@@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  version = "1.3.0";
+  version = "1.3.1";
   pname = "commons-daemon";
 
   src = fetchurl {
     url    = "mirror://apache/commons/daemon/binaries/commons-daemon-${version}-bin.tar.gz";
-    sha256 = "sha256-Fihsar8HR2adN2f9deo7bk8tRgeiD6BljVZ/mfkLUUA=";
+    sha256 = "sha256-EaQ4wy32GX1MGByCqo811WblqZgsNSw3psr94lrxEqw=";
   };
 
   installPhase = ''
diff --git a/pkgs/development/libraries/libkqueue/default.nix b/pkgs/development/libraries/libkqueue/default.nix
index 8a4bfdedd1e33..5f96353d9d69f 100644
--- a/pkgs/development/libraries/libkqueue/default.nix
+++ b/pkgs/development/libraries/libkqueue/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libkqueue";
-  version = "2.6.1";
+  version = "2.6.2";
 
   src = fetchFromGitHub {
     owner = "mheily";
     repo = "libkqueue";
     rev = "v${version}";
-    sha256 = "sha256-YKKBHOxjUS7+/ib4gcR7EYjjVOwhHVksYasLhErdV8s=";
+    sha256 = "sha256-5Zds9sqHkFldJf3ThTPOiaGKohmFcIzY0ARDA0iswVk=";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -16,6 +16,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "kqueue(2) compatibility library";
     homepage = "https://github.com/mheily/libkqueue";
+    changelog = "https://github.com/mheily/libkqueue/raw/v${version}/ChangeLog";
     license = licenses.bsd2;
     maintainers = [ maintainers.marsam ];
     platforms = platforms.linux;
diff --git a/pkgs/development/libraries/libvgm/default.nix b/pkgs/development/libraries/libvgm/default.nix
index 3db5c95ff9830..43b145be62bf5 100644
--- a/pkgs/development/libraries/libvgm/default.nix
+++ b/pkgs/development/libraries/libvgm/default.nix
@@ -42,13 +42,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "libvgm";
-  version = "unstable-2022-06-17";
+  version = "unstable-2022-06-18";
 
   src = fetchFromGitHub {
     owner = "ValleyBell";
     repo = "libvgm";
-    rev = "577ff77185aa19943e5c7a858eb2485ec75c7539";
-    sha256 = "0R7qqrFs6Ap8FM5uBHX/iE+S5cQzuwWn65xxfp4/CdQ=";
+    rev = "001ca758538ca3f82403dff654d82342730b215d";
+    sha256 = "O3jvEEW1M0cwZoG6j2ndmuQW4jP0dvt6gGp2BS4VD5s=";
   };
 
   outputs = [
diff --git a/pkgs/development/libraries/libzip/default.nix b/pkgs/development/libraries/libzip/default.nix
index 3620943d6c537..f794868baf0d1 100644
--- a/pkgs/development/libraries/libzip/default.nix
+++ b/pkgs/development/libraries/libzip/default.nix
@@ -32,6 +32,10 @@ stdenv.mkDerivation rec {
     ++ lib.optionals withOpenssl [ openssl ]
     ++ lib.optionals withZstd [ zstd ];
 
+  # Don't build the regression tests because they don't build with
+  # pkgsStatic and are not executed anyway.
+  cmakeFlags = [ "-DBUILD_REGRESS=0" ];
+
   preCheck = ''
     # regress/runtest is a generated file
     patchShebangs regress
diff --git a/pkgs/development/libraries/ncurses/default.nix b/pkgs/development/libraries/ncurses/default.nix
index 72d64854238f3..2cfe41956a4b1 100644
--- a/pkgs/development/libraries/ncurses/default.nix
+++ b/pkgs/development/libraries/ncurses/default.nix
@@ -41,7 +41,17 @@ stdenv.mkDerivation rec {
     ++ lib.optionals stdenv.hostPlatform.isWindows [
       "--enable-sp-funcs"
       "--enable-term-driver"
-    ];
+  ] ++ lib.optionals (stdenv.hostPlatform.isUnix && stdenv.hostPlatform.isStatic) [
+      # For static binaries, the point is to have a standalone binary with
+      # minimum dependencies. So here we make sure that binaries using this
+      # package won't depend on a terminfo database located in the Nix store.
+      "--with-terminfo-dirs=${lib.concatStringsSep ":" [
+        "/etc/terminfo" # Debian, Fedora, Gentoo
+        "/lib/terminfo" # Debian
+        "/usr/share/terminfo" # upstream default, probably all FHS-based distros
+        "/run/current-system/sw/share/terminfo" # NixOS
+      ]}"
+  ];
 
   # Only the C compiler, and explicitly not C++ compiler needs this flag on solaris:
   CFLAGS = lib.optionalString stdenv.isSunOS "-D_XOPEN_SOURCE_EXTENDED";
diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index 8d28ef5ad74f5..c60787d5b6220 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -2,6 +2,7 @@
 , lib
 , buildPackages
 , fetchFromGitLab
+, fetchpatch
 , removeReferencesTo
 , python3
 , meson
@@ -69,7 +70,7 @@ let
 
   self = stdenv.mkDerivation rec {
     pname = "pipewire";
-    version = "0.3.51";
+    version = "0.3.52";
 
     outputs = [
       "out"
@@ -87,7 +88,7 @@ let
       owner = "pipewire";
       repo = "pipewire";
       rev = version;
-      sha256 = "sha256-k5OdKgkQUaelvrGS4KtO0MtSJg6cF2Nf8RrsR8Kf+C8=";
+      sha256 = "sha256-JWmO36+OF2O9sLB+Z0znwm3TH+O+pEv3cXnuwP6Wy1E=";
     };
 
     patches = [
@@ -103,6 +104,12 @@ let
       ./0090-pipewire-config-template-paths.patch
       # Place SPA data files in lib output to avoid dependency cycles
       ./0095-spa-data-dir.patch
+      # Remove 44.1KHz from allowed rates (multiple regressions reported)
+      # To be removed when 0.3.53 is released
+      (fetchpatch {
+        url = "https://gitlab.freedesktop.org/pipewire/pipewire/-/commit/16a7c274989f47b0c0d8ba192a30316b545bd26a.patch";
+        sha256 = "sha256-VZ7ChjcR/PGfmH2DmLxfIhd3mj9668l9zLO4k2KBoqg=";
+      })
     ];
 
     nativeBuildInputs = [
@@ -164,6 +171,7 @@ let
       "-Dbluez5-backend-hfp-native=${mesonEnableFeature nativeHfpSupport}"
       "-Dbluez5-backend-ofono=${mesonEnableFeature ofonoSupport}"
       "-Dbluez5-backend-hsphfpd=${mesonEnableFeature hsphfpdSupport}"
+      "-Dbluez5-codec-lc3plus=disabled"
       "-Dsysconfdir=/etc"
       "-Dpipewire_confdata_dir=${placeholder "lib"}/share/pipewire"
       "-Draop=${mesonEnableFeature raopSupport}"
diff --git a/pkgs/development/libraries/science/math/m4rie/default.nix b/pkgs/development/libraries/science/math/m4rie/default.nix
index 38a633e58c712..2a46e22b60d26 100644
--- a/pkgs/development/libraries/science/math/m4rie/default.nix
+++ b/pkgs/development/libraries/science/math/m4rie/default.nix
@@ -5,14 +5,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "20200115";
+  version = "20200125";
   pname = "m4rie";
 
   src = fetchFromBitbucket {
     owner = "malb";
     repo = "m4rie";
     rev = "release-${version}";
-    sha256 = "0s8if80x5d6mikbcfsbbxg347136spahp9f3x8i1hflbwl8xj9k8";
+    sha256 = "sha256-bjAcxfXsC6+jPYC472CN78jm4UljJQlkWyvsqckCDh0=";
   };
 
   doCheck = true;
diff --git a/pkgs/development/libraries/taskflow/default.nix b/pkgs/development/libraries/taskflow/default.nix
index 29760cdb94bd2..dd2f8fb391448 100644
--- a/pkgs/development/libraries/taskflow/default.nix
+++ b/pkgs/development/libraries/taskflow/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "taskflow";
-  version = "3.3.0";
+  version = "3.4.0";
 
   src = fetchFromGitHub {
     owner = "taskflow";
     repo = "taskflow";
     rev = "v${version}";
-    hash = "sha256-UfXGupxgtowIt3BnIVWwim3rTE57TT1C9TCx9LVyN34=";
+    hash = "sha256-5bTTV/WAxslHQ+hvATtUUA1h3MuNzwVTlYMbD/sINRM=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/v8/8_x.nix b/pkgs/development/libraries/v8/8_x.nix
index 9e2469eed38e6..b5184bafcbff9 100644
--- a/pkgs/development/libraries/v8/8_x.nix
+++ b/pkgs/development/libraries/v8/8_x.nix
@@ -148,6 +148,7 @@ stdenv.mkDerivation rec {
     install -D d8 $out/bin/d8
     install -D -m644 obj/libv8_monolith.a $out/lib/libv8.a
     install -D -m644 icudtl.dat $out/share/v8/icudtl.dat
+    ln -s libv8.a $out/lib/libv8_monolith.a
     cp -r ../../include $out
 
     mkdir -p $out/lib/pkgconfig
diff --git a/pkgs/development/libraries/v8/default.nix b/pkgs/development/libraries/v8/default.nix
index 2b56d2e5dcf8e..cf9d597edc21c 100644
--- a/pkgs/development/libraries/v8/default.nix
+++ b/pkgs/development/libraries/v8/default.nix
@@ -148,6 +148,7 @@ stdenv.mkDerivation rec {
     install -D d8 $out/bin/d8
     install -D -m644 obj/libv8_monolith.a $out/lib/libv8.a
     install -D -m644 icudtl.dat $out/share/v8/icudtl.dat
+    ln -s libv8.a $out/lib/libv8_monolith.a
     cp -r ../../include $out
 
     mkdir -p $out/lib/pkgconfig
diff --git a/pkgs/development/node-packages/main-programs.nix b/pkgs/development/node-packages/main-programs.nix
index b5c710bd8c848..8004f2025a91b 100644
--- a/pkgs/development/node-packages/main-programs.nix
+++ b/pkgs/development/node-packages/main-programs.nix
@@ -32,6 +32,7 @@
   "@webassemblyjs/wasm-strip" = "wasm-strip";
   "@webassemblyjs/wasm-text-gen" = "wasmgen";
   "@webassemblyjs/wast-refmt" = "wast-refmt";
+  aws-cdk = "cdk";
   balanceofsatoshis = "bos";
   carbon-now-cli = "carbon-now";
   cdk8s-cli = "cdk8s";
diff --git a/pkgs/development/ocaml-modules/ffmpeg/base.nix b/pkgs/development/ocaml-modules/ffmpeg/base.nix
index 5dc5f612fd325..212ad686e356a 100644
--- a/pkgs/development/ocaml-modules/ffmpeg/base.nix
+++ b/pkgs/development/ocaml-modules/ffmpeg/base.nix
@@ -1,7 +1,7 @@
 { lib, fetchFromGitHub }:
 
 rec {
-  version = "1.1.3";
+  version = "1.1.4";
 
   useDune2 = true;
 
@@ -9,7 +9,7 @@ rec {
     owner = "savonet";
     repo = "ocaml-ffmpeg";
     rev = "v${version}";
-    sha256 = "1l40dfc0v3wn2drfq0mclrc1lrlpycdjrkrw4knkwpsg0za68v4c";
+    sha256 = "sha256-IM7bzOZAZQjLz4YjRTMU5fZgrA2QTZcSDMgclDo4sn0=";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/ocaml-modules/fmt/default.nix b/pkgs/development/ocaml-modules/fmt/default.nix
index 4816cab57cfd3..bd56298165284 100644
--- a/pkgs/development/ocaml-modules/fmt/default.nix
+++ b/pkgs/development/ocaml-modules/fmt/default.nix
@@ -14,8 +14,8 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ ocaml findlib ocamlbuild topkg ];
-  buildInputs = [ topkg ];
-  propagatedBuildInputs = [ cmdliner seq stdlib-shims ];
+  buildInputs = [ cmdliner topkg ];
+  propagatedBuildInputs = [ seq stdlib-shims ];
 
   strictDeps = true;
 
diff --git a/pkgs/development/ocaml-modules/ocaml-r/default.nix b/pkgs/development/ocaml-modules/ocaml-r/default.nix
index fcee63de3b5db..ed22177bfaac3 100644
--- a/pkgs/development/ocaml-modules/ocaml-r/default.nix
+++ b/pkgs/development/ocaml-modules/ocaml-r/default.nix
@@ -37,6 +37,8 @@ buildDunePackage rec {
   checkInputs = [ alcotest ];
 
   meta = {
+    # This has been broken by the update to R 4.2.0 (#171597)
+    broken = true;
     description = "OCaml bindings for the R interpreter";
     inherit (src.meta) homepage;
     license = lib.licenses.gpl3;
diff --git a/pkgs/development/ocaml-modules/parmap/default.nix b/pkgs/development/ocaml-modules/parmap/default.nix
index 521c1c406714b..18e1975b698d5 100644
--- a/pkgs/development/ocaml-modules/parmap/default.nix
+++ b/pkgs/development/ocaml-modules/parmap/default.nix
@@ -10,13 +10,12 @@ buildDunePackage rec {
   };
 
   minimalOCamlVersion = "4.03";
-  useDune2 = true;
 
   buildInputs = [
     dune-configurator
   ];
 
-  doCheck = true;
+  doCheck = false; # prevent running slow benchmarks
 
   meta = with lib; {
     description = "Library for multicore parallel programming";
diff --git a/pkgs/development/ocaml-modules/pbkdf/default.nix b/pkgs/development/ocaml-modules/pbkdf/default.nix
index 1ecf213f6d369..d82869c4392d4 100644
--- a/pkgs/development/ocaml-modules/pbkdf/default.nix
+++ b/pkgs/development/ocaml-modules/pbkdf/default.nix
@@ -1,22 +1,23 @@
 { lib
 , buildDunePackage
-, fetchurl
+, fetchFromGitHub
+, cstruct
 , mirage-crypto
 , alcotest
 }:
 
 buildDunePackage rec {
   pname = "pbkdf";
-  version = "1.1.0";
+  version = "1.2.0";
 
-  useDune2 = true;
-
-  src = fetchurl {
-    url = "https://github.com/abeaumont/ocaml-pbkdf/releases/download/${version}/pbkdf-${version}.tbz";
-    sha256 = "e53ed1bd9abf490c858a341c10fb548bc9ad50d4479acdf95a9358a73d042264";
+  src = fetchFromGitHub {
+    owner = "abeaumont";
+    repo = "ocaml-pbkdf";
+    rev = version;
+    sha256 = "sha256-dGi4Vw+7VBpK/NpJ6zdpogm+E6G/oJovXCksJBSmqjI=";
   };
 
-  propagatedBuildInputs = [ mirage-crypto ];
+  propagatedBuildInputs = [ cstruct mirage-crypto ];
   checkInputs = [ alcotest ];
   doCheck = true;
 
diff --git a/pkgs/development/python-modules/ailment/default.nix b/pkgs/development/python-modules/ailment/default.nix
index 01617f7980ef5..0b6ba901df52a 100644
--- a/pkgs/development/python-modules/ailment/default.nix
+++ b/pkgs/development/python-modules/ailment/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "ailment";
-  version = "9.2.6";
+  version = "9.2.7";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-SymOCHKIr0SOi4OM+OONA7+A2nV4JMA467OkoqDhZ+M=";
+    hash = "sha256-zQz8tbxo1Trfeg7zeW/htm+zD4n++guYXUdCHp3cikw=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/aioswitcher/default.nix b/pkgs/development/python-modules/aioswitcher/default.nix
index 68cc3150d9f69..d03cc22ab1eb1 100644
--- a/pkgs/development/python-modules/aioswitcher/default.nix
+++ b/pkgs/development/python-modules/aioswitcher/default.nix
@@ -47,6 +47,7 @@ buildPythonPackage rec {
     "test_schedule_parser_with_a_daily_recurring_enabled_schedule_data"
     "test_schedule_parser_with_a_partial_daily_recurring_enabled_schedule_data"
     "test_schedule_parser_with_a_non_recurring_enabled_schedule_data"
+    "test_hexadecimale_timestamp_to_localtime_with_the_current_timestamp_should_return_a_time_string"
   ];
 
   pythonImportsCheck = [ "aioswitcher" ];
diff --git a/pkgs/development/python-modules/angr/default.nix b/pkgs/development/python-modules/angr/default.nix
index a6a5aa49953fd..72481814f9d4a 100644
--- a/pkgs/development/python-modules/angr/default.nix
+++ b/pkgs/development/python-modules/angr/default.nix
@@ -46,7 +46,7 @@ in
 
 buildPythonPackage rec {
   pname = "angr";
-  version = "9.2.6";
+  version = "9.2.7";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -55,7 +55,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-qXzkrfF8FkALkEaFLSmaadovwLc2DkXXJivdrT6srTc=";
+    hash = "sha256-77RLoSZnzggt8ZWQwRcvMhCYGupF2Kp+u2LFZ9ozXlw=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/angrop/default.nix b/pkgs/development/python-modules/angrop/default.nix
index 63dce4bdbed78..cfd27ae4cbfe3 100644
--- a/pkgs/development/python-modules/angrop/default.nix
+++ b/pkgs/development/python-modules/angrop/default.nix
@@ -4,6 +4,7 @@
 , fetchFromGitHub
 , progressbar
 , pythonOlder
+, pythonRelaxDepsHook
 , tqdm
 }:
 
@@ -21,12 +22,20 @@ buildPythonPackage rec {
     hash = "sha256-qaDAicmYZxLPTl17il61ij01prRv2H4xxe07Xg4KWhI=";
   };
 
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+  ];
+
   propagatedBuildInputs = [
     angr
     progressbar
     tqdm
   ];
 
+  pythonRelaxDeps = [
+    "angr"
+  ];
+
   # Tests have additional requirements, e.g., angr binaries
   # cle is executing the tests with the angr binaries already and is a requirement of angr
   doCheck = false;
diff --git a/pkgs/development/python-modules/archinfo/default.nix b/pkgs/development/python-modules/archinfo/default.nix
index 348a022d2ccfd..f87c7863c264c 100644
--- a/pkgs/development/python-modules/archinfo/default.nix
+++ b/pkgs/development/python-modules/archinfo/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "archinfo";
-  version = "9.2.6";
+  version = "9.2.7";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-yMUcuZ9v1dVbh/t456fpMu8tDFWIdh55LZh7FLkz9GM=";
+    hash = "sha256-sl5qCH/biH3QBrnfZAQMWd55yKM0PGE/Rx2MscKn4Nk=";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/audible/default.nix b/pkgs/development/python-modules/audible/default.nix
index 2d4f3ac4df037..8769cdedeac31 100644
--- a/pkgs/development/python-modules/audible/default.nix
+++ b/pkgs/development/python-modules/audible/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "audible";
-  version = "0.8.1";
+  version = "0.8.2";
 
   src = fetchFromGitHub {
     owner = "mkb79";
     repo = "Audible";
-    rev = "v${version}";
-    sha256 = "0fsb5av4s7fvpn0iryl8jj3lwffwlxgbwj46l3fidy0l58nq3b1d";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-SIEDBuMCC/Hap2mGVbKEFic96ClN369SEsV06Sg+poY=";
   };
 
   propagatedBuildInputs = [ beautifulsoup4 httpx pbkdf2 pillow pyaes rsa ];
diff --git a/pkgs/development/python-modules/aws-lambda-builders/default.nix b/pkgs/development/python-modules/aws-lambda-builders/default.nix
index 1c750267695fc..f2dd2c4205271 100644
--- a/pkgs/development/python-modules/aws-lambda-builders/default.nix
+++ b/pkgs/development/python-modules/aws-lambda-builders/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "aws-lambda-builders";
-  version = "1.17.0";
+  version = "1.18.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "awslabs";
     repo = "aws-lambda-builders";
     rev = "refs/tags/v${version}";
-    hash = "sha256-EkAtRqUHwmH0LG/bkXBbZ3TMgXDtcqLfUBySPbrgWmc=";
+    hash = "sha256-yAqGVZnnragi3+jaAGnkYNH/XtpH3bojXHmPCrANgJU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/bimmer-connected/default.nix b/pkgs/development/python-modules/bimmer-connected/default.nix
index 63071d4946248..3aa2733ce10f6 100644
--- a/pkgs/development/python-modules/bimmer-connected/default.nix
+++ b/pkgs/development/python-modules/bimmer-connected/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "bimmer-connected";
-  version = "0.9.4";
+  version = "0.9.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "bimmerconnected";
     repo = "bimmer_connected";
     rev = "refs/tags/${version}";
-    hash = "sha256-+K+RffQzbJiKld0AM41OlK0ma0aopJRaTz+ZcCcYzJk=";
+    hash = "sha256-R7QmxSUbVsvb+MRTYlihxuM05WLYASRSfUs09fl7l1k=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/claripy/default.nix b/pkgs/development/python-modules/claripy/default.nix
index 7dccab0b76240..efceffd786d47 100644
--- a/pkgs/development/python-modules/claripy/default.nix
+++ b/pkgs/development/python-modules/claripy/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "claripy";
-  version = "9.2.6";
+  version = "9.2.7";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-mBpAwKUclwvgOeGD6BvPUKZHdjngfvuHdtKY3nx7jzM=";
+    hash = "sha256-4t1PbxcHxiv8W/M9McaBu7CTLc74gCZ7om3K4fgpFFI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/cle/default.nix b/pkgs/development/python-modules/cle/default.nix
index 25765fc11d3db..db926aad32b4c 100644
--- a/pkgs/development/python-modules/cle/default.nix
+++ b/pkgs/development/python-modules/cle/default.nix
@@ -15,14 +15,14 @@
 
 let
   # The binaries are following the argr projects release cycle
-  version = "9.2.6";
+  version = "9.2.7";
 
   # Binary files from https://github.com/angr/binaries (only used for testing and only here)
   binaries = fetchFromGitHub {
     owner = "angr";
     repo = "binaries";
     rev = "v${version}";
-    sha256 = "1qlrxfj1n34xvwkac6mbcc7zmixxbp34fj7lkf0fvp7zcz1rpla1";
+    hash = "sha256-LpYi5Ty6OBcW0zokCliMDhujJ7tPPl1XdPs5ad1tv5s=";
   };
 
 in
@@ -37,7 +37,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-GOrjT5CM+yzboOTgkVriuf1UpNDVhDgGpS8vp4D39W0=";
+    hash = "sha256-IQLtkS4LNyyEOwInd9A3pHGtj80yXARXcQKA3FonPUE=";
   };
 
   propagatedBuildInputs = [
@@ -66,7 +66,6 @@ buildPythonPackage rec {
     "test_ppc_rel24_relocation"
     "test_ppc_addr16_ha_relocation"
     "test_ppc_addr16_lo_relocation"
-    # Binary not found, seems to be missing in the current binaries release
     "test_plt_full_relro"
     # Test fails
     "test_tls_pe_incorrect_tls_data_start"
diff --git a/pkgs/development/python-modules/clickgen/default.nix b/pkgs/development/python-modules/clickgen/default.nix
index b74827d1971dd..d0f81a20c6d34 100644
--- a/pkgs/development/python-modules/clickgen/default.nix
+++ b/pkgs/development/python-modules/clickgen/default.nix
@@ -2,7 +2,6 @@
 , stdenv
 , buildPythonPackage
 , pythonOlder
-, pythonAtLeast
 , fetchFromGitHub
 , pillow
 , libX11
@@ -17,7 +16,7 @@ buildPythonPackage rec {
   version = "1.2.0";
   format = "setuptools";
 
-  disabled = pythonOlder "3.8" || pythonAtLeast "3.10";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "ful1e5";
diff --git a/pkgs/development/python-modules/connexion/default.nix b/pkgs/development/python-modules/connexion/default.nix
index 2e36a1c455470..3bac60d0e7d77 100644
--- a/pkgs/development/python-modules/connexion/default.nix
+++ b/pkgs/development/python-modules/connexion/default.nix
@@ -22,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "connexion";
-  version = "2.13.1";
+  version = "2.14.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -31,7 +31,7 @@ buildPythonPackage rec {
     owner = "spec-first";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-nWhrb2oyBue/Q/dAdSgk3K/JXdgLg1xAEbOtCTRYs/M=";
+    hash = "sha256-5+OZvJG68jZZsfOuOqsCUSPLV6vvjk9msJzjsCwo0jw=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/crownstone-uart/default.nix b/pkgs/development/python-modules/crownstone-uart/default.nix
index e24235203ebb9..163f6a6cec28b 100644
--- a/pkgs/development/python-modules/crownstone-uart/default.nix
+++ b/pkgs/development/python-modules/crownstone-uart/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "crownstone-uart";
-  version = "2.4.1";
+  version = "2.5.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "crownstone";
     repo = "crownstone-lib-python-uart";
     rev = version;
-    sha256 = "sha256-NGy63o56oWhHcQ9QKo05k/z8ABp3p3T3+uY2O1YyzBk=";
+    sha256 = "sha256-WcEwAqHy3tuRlx1nyc+BKAb+PLD2B55fGSgb8dsbXbM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/diff-cover/default.nix b/pkgs/development/python-modules/diff-cover/default.nix
index 7d7a9afcd300a..2b50dc97fb1e3 100644
--- a/pkgs/development/python-modules/diff-cover/default.nix
+++ b/pkgs/development/python-modules/diff-cover/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "diff-cover";
-  version = "6.5.0";
+  version = "6.5.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "diff_cover";
     inherit version;
-    hash = "sha256-N2O0/C75EGO6crUCFGUiJLLQqfMVRNVQRZb1xKhHzXs=";
+    hash = "sha256-jDuxOBLpZnvIP4x2BkAlEenC/nnWeG8SlSLnlpPuCWs=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/django-allauth/default.nix b/pkgs/development/python-modules/django-allauth/default.nix
index 16d3e88b2115a..6db3cbefedb8d 100644
--- a/pkgs/development/python-modules/django-allauth/default.nix
+++ b/pkgs/development/python-modules/django-allauth/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "django-allauth";
-  version = "0.50.0";
+  version = "0.51.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "pennersr";
     repo = pname;
     rev = version;
-    hash = "sha256-O6KEDt+Z1MJUvKXQJILqLRgNj+ZrCZjlb3CJHpRL1Kk=";
+    hash = "sha256-o8EoayMMwxoJTrUA3Jo1Dfu1XFgC+Mcpa8yMwXlKAKY=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/django-debug-toolbar/default.nix b/pkgs/development/python-modules/django-debug-toolbar/default.nix
index 871b8bb852e64..b4409dc04d4cb 100644
--- a/pkgs/development/python-modules/django-debug-toolbar/default.nix
+++ b/pkgs/development/python-modules/django-debug-toolbar/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "django-debug-toolbar";
-  version = "3.4";
+  version = "3.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "jazzband";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-tXQZcQvdGEtcIAtER1s2HSVkGHW0sdrnC+i01+RuSXg=";
+    hash = "sha256-OZWO3tXZ+p+zKtQHCkj0kGSXpDFHFV+HqSgiJvLmMTg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/django-oauth-toolkit/default.nix b/pkgs/development/python-modules/django-oauth-toolkit/default.nix
index eca67211671c4..65bf5045a0351 100644
--- a/pkgs/development/python-modules/django-oauth-toolkit/default.nix
+++ b/pkgs/development/python-modules/django-oauth-toolkit/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "django-oauth-toolkit";
-  version = "1.7.0";
+  version = "2.1.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "jazzband";
     repo = pname;
-    rev = version;
-    sha256 = "0rp7pjif54yvdxfxn0pnf8ha3fjxspnx1ijyr1f8npwk2x5vnvhb";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-c78QYlU/gB4Lt04TlQFjtsS6pyjDm/fURBMa9hXLpLI=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/django-prometheus/default.nix b/pkgs/development/python-modules/django-prometheus/default.nix
index 733a177d6a5ef..209395ef6430a 100644
--- a/pkgs/development/python-modules/django-prometheus/default.nix
+++ b/pkgs/development/python-modules/django-prometheus/default.nix
@@ -16,8 +16,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "korfuri";
     repo = pname;
-    rev = version;
-    sha256 = "1y1cmycc545xrys41jk8kia36hwnkwhkw26mlpfdjgb63vq30x1d";
+    rev = "v${version}";
+    hash = "sha256-NE0zHnGGSrtkBLrSyBcQuyGrSfSQbdpevokg3YZhwDw=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/django-prometheus/drop-untestable-database-backends.patch b/pkgs/development/python-modules/django-prometheus/drop-untestable-database-backends.patch
index 1e9e650608498..41f1229c5e59e 100644
--- a/pkgs/development/python-modules/django-prometheus/drop-untestable-database-backends.patch
+++ b/pkgs/development/python-modules/django-prometheus/drop-untestable-database-backends.patch
@@ -1,5 +1,5 @@
 diff --git a/django_prometheus/tests/end2end/testapp/settings.py b/django_prometheus/tests/end2end/testapp/settings.py
-index 0630721..bd2190a 100644
+index cdd167f..5c6073b 100644
 --- a/django_prometheus/tests/end2end/testapp/settings.py
 +++ b/django_prometheus/tests/end2end/testapp/settings.py
 @@ -53,33 +53,6 @@ DATABASES = {
@@ -28,9 +28,9 @@ index 0630721..bd2190a 100644
 -    "mysql": {
 -        "ENGINE": "django_prometheus.db.backends.mysql",
 -        "NAME": "django_prometheus_1",
--        "USER": "travis",
+-        "USER": "root",
 -        "PASSWORD": "",
--        "HOST": "localhost",
+-        "HOST": "127.0.0.1",
 -        "PORT": "3306",
 -    },
      # The following databases are used by test_db.py only
diff --git a/pkgs/development/python-modules/django-webpack-loader/default.nix b/pkgs/development/python-modules/django-webpack-loader/default.nix
index 2656dd593c1c2..ee51b0e7c8ecb 100644
--- a/pkgs/development/python-modules/django-webpack-loader/default.nix
+++ b/pkgs/development/python-modules/django-webpack-loader/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "django-webpack-loader";
-  version = "1.4.1";
+  version = "1.6.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "7e34085b7fc4d352e482ff9cf7d09ae4524e730675e25432ab1d25a2dd94e583";
+    sha256 = "sha256-opQY/0FpADW+ENLJSgZV2rCZAJxouJiDmBPWoQmxTXE=";
   };
 
   # django.core.exceptions.ImproperlyConfigured (path issue with DJANGO_SETTINGS_MODULE?)
diff --git a/pkgs/development/python-modules/dremel3dpy/default.nix b/pkgs/development/python-modules/dremel3dpy/default.nix
index 06de83a778ae5..52f0721580281 100644
--- a/pkgs/development/python-modules/dremel3dpy/default.nix
+++ b/pkgs/development/python-modules/dremel3dpy/default.nix
@@ -2,28 +2,34 @@
 , async-timeout
 , buildPythonPackage
 , fetchPypi
+, imageio
+, imutils
 , pythonOlder
 , requests
 , urllib3
+, tqdm
 , validators
 , yarl
 }:
 
 buildPythonPackage rec {
   pname = "dremel3dpy";
-  version = "0.3.4";
+  version = "1.0.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-zKbHKdgMx76cYGPvPVSm39si0LfyDA4L1CcKaQzEpCw=";
+    hash = "sha256-wqfCzS9dhRN/zerrC6g/O8tn0k1IC0wBdZMfWumtBds=";
   };
 
   propagatedBuildInputs = [
     async-timeout
+    imageio
+    imutils
     requests
+    tqdm
     urllib3
     validators
     yarl
diff --git a/pkgs/development/python-modules/drf-spectacular-sidecar/default.nix b/pkgs/development/python-modules/drf-spectacular-sidecar/default.nix
index e9128b79ec761..e2413df85d425 100644
--- a/pkgs/development/python-modules/drf-spectacular-sidecar/default.nix
+++ b/pkgs/development/python-modules/drf-spectacular-sidecar/default.nix
@@ -6,13 +6,13 @@
 
 buildPythonPackage rec {
   pname = "drf-spectacular-sidecar";
-  version = "2022.5.1";
+  version = "2022.6.1";
 
   src = fetchFromGitHub {
     owner = "tfranzel";
     repo = "drf-spectacular-sidecar";
     rev = version;
-    sha256 = "sha256-UBuHU+F4b+plhGbvqho8/bgmq6yDUXSTnfxyD1xlDY4=";
+    sha256 = "sha256-SKMAA8tcvWUF7EARq9vN8C0DWcQFRX5j/tfgHF5TUWs=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/email-validator/default.nix b/pkgs/development/python-modules/email-validator/default.nix
index b6112bb87dccd..bdd830810fb38 100644
--- a/pkgs/development/python-modules/email-validator/default.nix
+++ b/pkgs/development/python-modules/email-validator/default.nix
@@ -44,10 +44,9 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
-    description = "A robust email syntax and deliverability validation library for Python 2.x/3.x.";
+    description = "A robust email syntax and deliverability validation library";
     homepage    = "https://github.com/JoshData/python-email-validator";
     license     = licenses.cc0;
     maintainers = with maintainers; [ siddharthist ];
-    platforms   = platforms.unix;
   };
 }
diff --git a/pkgs/development/python-modules/eth-typing/default.nix b/pkgs/development/python-modules/eth-typing/default.nix
index a2f3103be47d7..6c8bc6cb57073 100644
--- a/pkgs/development/python-modules/eth-typing/default.nix
+++ b/pkgs/development/python-modules/eth-typing/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "eth-typing";
-  version = "3.0.0";
+  version = "3.1.0";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "ethereum";
     repo = "eth-typing";
     rev = "v${version}";
-    sha256 = "sha256-9rrnDFPWAmrUkr2mVTVi/8DTJdg4hzGaU0UbpwG5mtY=";
+    sha256 = "sha256-Xk/IfW1zuNbGdYAxXTNL9kL+ZW1bWruZ21KFV9+lv/E=";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/expiringdict/default.nix b/pkgs/development/python-modules/expiringdict/default.nix
index 23ca9c1c3f2a1..942feff4513f6 100644
--- a/pkgs/development/python-modules/expiringdict/default.nix
+++ b/pkgs/development/python-modules/expiringdict/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonApplication rec {
   pname = "expiringdict";
-  version = "1.2.1";
+  version = "1.2.2";
 
   # use fetchFromGitHub instead of fetchPypi because the test suite of
   # the package is not included into the PyPI tarball
@@ -18,7 +18,7 @@ buildPythonApplication rec {
     owner = "mailgun";
     repo = pname;
     rev = "v${version}";
-    sha256 = "07g1vxznmim78bankfl9brr01s31sksdcpwynq1yryh6xw9ri5xs";
+    sha256 = "sha256-vRhJSHIqc51I+s/wndtfANM44CKW3QS1iajqyoSBf0I=";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/fastapi-mail/default.nix b/pkgs/development/python-modules/fastapi-mail/default.nix
index 8b3c6d0ed0566..973c810b63476 100644
--- a/pkgs/development/python-modules/fastapi-mail/default.nix
+++ b/pkgs/development/python-modules/fastapi-mail/default.nix
@@ -3,7 +3,7 @@
 , aiosmtplib
 , blinker
 , buildPythonPackage
-, email_validator
+, email-validator
 , fakeredis
 , fastapi
 , fetchFromGitHub
@@ -45,7 +45,7 @@ buildPythonPackage rec {
     aioredis
     aiosmtplib
     blinker
-    email_validator
+    email-validator
     fakeredis
     fastapi
     httpx
diff --git a/pkgs/development/python-modules/flake8-bugbear/default.nix b/pkgs/development/python-modules/flake8-bugbear/default.nix
index a2fb820c1e5fe..7d6df07885baa 100644
--- a/pkgs/development/python-modules/flake8-bugbear/default.nix
+++ b/pkgs/development/python-modules/flake8-bugbear/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "flake8-bugbear";
-  version = "22.4.25";
+  version = "22.6.22";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "PyCQA";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-y/hpBlIQ3aJj3Y1snpArOCIv2w1ncQNMSYJ+G0CeM84=";
+    hash = "sha256-U5f7NZ1rkcYcluLsw2hTuPxme7QrmAMJrpKncFsYzNs=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/flask-admin/default.nix b/pkgs/development/python-modules/flask-admin/default.nix
index 6a1ea3991cfa3..75573c7a69d64 100644
--- a/pkgs/development/python-modules/flask-admin/default.nix
+++ b/pkgs/development/python-modules/flask-admin/default.nix
@@ -2,7 +2,7 @@
 , arrow
 , buildPythonPackage
 , colour
-, email_validator
+, email-validator
 , enum34
 , fetchPypi
 , flask
@@ -45,7 +45,7 @@ buildPythonPackage rec {
   checkInputs = [
     arrow
     colour
-    email_validator
+    email-validator
     flask_sqlalchemy
     flask-babelex
     flask-mongoengine
diff --git a/pkgs/development/python-modules/flask-appbuilder/default.nix b/pkgs/development/python-modules/flask-appbuilder/default.nix
index 5276fceb3f51a..9b0e993b1eb34 100644
--- a/pkgs/development/python-modules/flask-appbuilder/default.nix
+++ b/pkgs/development/python-modules/flask-appbuilder/default.nix
@@ -5,7 +5,7 @@
 , apispec
 , colorama
 , click
-, email_validator
+, email-validator
 , flask
 , flask-babel
 , flask_login
@@ -56,7 +56,7 @@ buildPythonPackage rec {
     apispec
     colorama
     click
-    email_validator
+    email-validator
     flask
     flask-babel
     flask_login
diff --git a/pkgs/development/python-modules/flask-mongoengine/default.nix b/pkgs/development/python-modules/flask-mongoengine/default.nix
index ee05ff420333b..e411d1f55a78b 100644
--- a/pkgs/development/python-modules/flask-mongoengine/default.nix
+++ b/pkgs/development/python-modules/flask-mongoengine/default.nix
@@ -8,7 +8,7 @@
 , nose
 , rednose
 , coverage
-, email_validator
+, email-validator
 }:
 
 buildPythonPackage rec {
@@ -23,7 +23,7 @@ buildPythonPackage rec {
   };
 
   propagatedBuildInputs = [
-    email_validator
+    email-validator
     flask
     flask-wtf
     mongoengine
diff --git a/pkgs/development/python-modules/flask-security-too/default.nix b/pkgs/development/python-modules/flask-security-too/default.nix
index ec088d5332c18..e1a598d3a0ba4 100644
--- a/pkgs/development/python-modules/flask-security-too/default.nix
+++ b/pkgs/development/python-modules/flask-security-too/default.nix
@@ -23,7 +23,7 @@
 
 # propagates
 , blinker
-, email_validator
+, email-validator
 , flask
 , flask_login
 , flask_principal
@@ -54,7 +54,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     blinker
-    email_validator
+    email-validator
     flask
     flask_login
     flask_principal
diff --git a/pkgs/development/python-modules/flask-wtf/default.nix b/pkgs/development/python-modules/flask-wtf/default.nix
index fcfa4835be7c2..014f250128c32 100644
--- a/pkgs/development/python-modules/flask-wtf/default.nix
+++ b/pkgs/development/python-modules/flask-wtf/default.nix
@@ -4,7 +4,7 @@
 , flask
 , itsdangerous
 , wtforms
-, email_validator
+, email-validator
 , pytestCheckHook
 }:
 
@@ -25,7 +25,7 @@ buildPythonPackage rec {
   ];
 
   passthru.optional-dependencies = {
-    email = [ email_validator ];
+    email = [ email-validator ];
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/gehomesdk/default.nix b/pkgs/development/python-modules/gehomesdk/default.nix
index 43609f3329244..35cd4ea7c4d95 100644
--- a/pkgs/development/python-modules/gehomesdk/default.nix
+++ b/pkgs/development/python-modules/gehomesdk/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "gehomesdk";
-  version = "0.4.25";
+  version = "0.4.27";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-TGitDdRvNKaZzbPrYvWx1bdbXAJW3OSnzbPBF2LpJW4=";
+    sha256 = "sha256-jhggGncxguG/hZutZ3gfg9dwl0Ex5wpcHFKZegAaM9Q=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/gsd/default.nix b/pkgs/development/python-modules/gsd/default.nix
index f4f3a7eb13fa9..0714352ed5eef 100644
--- a/pkgs/development/python-modules/gsd/default.nix
+++ b/pkgs/development/python-modules/gsd/default.nix
@@ -4,15 +4,15 @@
 }:
 
 buildPythonPackage rec {
-  version = "2.5.1";
+  version = "2.5.3";
   pname = "gsd";
   disabled = isPy27;
 
   src = fetchFromGitHub {
     owner = "glotzerlab";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "00cy4lw7xnl2skfx7fg7cs1c8lrbaxvkym9j6zfi1dbvsdd0r103";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-3CJKpvgJuFC/2qQdy0H/kvLbtmfF22gBAQustK99uEE=";
   };
 
   nativeBuildInputs = [ cython ];
diff --git a/pkgs/development/python-modules/ihatemoney/default.nix b/pkgs/development/python-modules/ihatemoney/default.nix
index dafea4e2cb20e..bacaea2f2cb19 100644
--- a/pkgs/development/python-modules/ihatemoney/default.nix
+++ b/pkgs/development/python-modules/ihatemoney/default.nix
@@ -10,7 +10,7 @@
 , cachetools
 , click
 , dnspython
-, email_validator
+, email-validator
 , flask
 , flask-babel
 , flask-cors
@@ -60,7 +60,7 @@ buildPythonPackage rec {
     click
     debts
     dnspython
-    email_validator
+    email-validator
     flask
     flask_mail
     flask_migrate
diff --git a/pkgs/development/python-modules/imap-tools/default.nix b/pkgs/development/python-modules/imap-tools/default.nix
index 404731e22a9a5..95f988a34951a 100644
--- a/pkgs/development/python-modules/imap-tools/default.nix
+++ b/pkgs/development/python-modules/imap-tools/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "imap-tools";
-  version = "0.55.0";
+  version = "0.56.0";
 
   disabled = isPy27;
 
@@ -16,8 +16,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "ikvk";
     repo = "imap_tools";
-    rev = "v${version}";
-    hash = "sha256-Jtuw0pYkgR1wrqPlEBOpia1rFU/+MLadOFEm2xLIFMw=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-g1m44hUtD/x7zEe/ELY6zj2hJikSmZB6S8ZHEHPrvz0=";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/junos-eznc/default.nix b/pkgs/development/python-modules/junos-eznc/default.nix
index d693c73130be8..9830d29789b51 100644
--- a/pkgs/development/python-modules/junos-eznc/default.nix
+++ b/pkgs/development/python-modules/junos-eznc/default.nix
@@ -77,7 +77,7 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "jnpr.junos" ];
 
   meta = with lib; {
-    homepage = "http://www.github.com/Juniper/py-junos-eznc";
+    homepage = "https://github.com/Juniper/py-junos-eznc";
     description = "Junos 'EZ' automation for non-programmers";
     license = licenses.asl20;
     maintainers = with maintainers; [ xnaveira ];
diff --git a/pkgs/development/python-modules/losant-rest/default.nix b/pkgs/development/python-modules/losant-rest/default.nix
index a160095513eb5..f27897a7e1ed3 100644
--- a/pkgs/development/python-modules/losant-rest/default.nix
+++ b/pkgs/development/python-modules/losant-rest/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "losant-rest";
-  version = "1.16.2";
+  version = "1.16.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "Losant";
     repo = "losant-rest-python";
     rev = "v${version}";
-    sha256 = "sha256-OR5SegUfui5g11QZZJzAq8nhp7bFjS4Ip2gMjfx7tpA=";
+    sha256 = "sha256-s9WPr5sFSyPIDRgRYcD55iRLhaVIvkiDGg/m//6acFY=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/lxmf/default.nix b/pkgs/development/python-modules/lxmf/default.nix
index 8ae981cc1f1a8..4142b0b505aad 100644
--- a/pkgs/development/python-modules/lxmf/default.nix
+++ b/pkgs/development/python-modules/lxmf/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "lxmf";
-  version = "0.1.6";
+  version = "0.1.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "markqvist";
     repo = "lxmf";
     rev = "refs/tags/${version}";
-    hash = "sha256-n7ZEXz+jFokjqQJf8feDE6wuN2kI3xB0z+guUhGse3o=";
+    hash = "sha256-SRDUFDtXJ1ZkX8A4ekF+YSOnxj/vsFsvr3W/LOIuerg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/manuel/default.nix b/pkgs/development/python-modules/manuel/default.nix
index 27ec85a1f4d12..7bf02f03895b2 100644
--- a/pkgs/development/python-modules/manuel/default.nix
+++ b/pkgs/development/python-modules/manuel/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "manuel";
-  version = "1.11.2";
+  version = "1.12.4";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-nJt3WMQ66oa3VlW5InJCzOea96Wf7WwxSbBp9WIfzqc=";
+    sha256 = "sha256-A5Wq32mR+SSseVz61Z2l3AYYcyqMxYrQ9HSWWrco9/Q=";
   };
 
   propagatedBuildInputs = [ six ];
diff --git a/pkgs/development/python-modules/md-toc/default.nix b/pkgs/development/python-modules/md-toc/default.nix
index 5d3cde1d038c6..0510aed835ad7 100644
--- a/pkgs/development/python-modules/md-toc/default.nix
+++ b/pkgs/development/python-modules/md-toc/default.nix
@@ -2,22 +2,23 @@
 , buildPythonPackage
 , fetchFromGitHub
 , fpyutils
+, pyfakefs
 , pytestCheckHook
 , pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "md-toc";
-  version = "8.1.3";
+  version = "8.1.4";
   format = "setuptools";
 
-  disabled = pythonOlder "3.5";
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "frnmst";
     repo = pname;
     rev = version;
-    sha256 = "sha256-/Hi2CW3aqbvCr7xGHD9lAe9U84waSjVfTfWq76NXNT4=";
+    hash = "sha256-7bXd+kTB1NF5KfcDVsvemCfIbZxv6nAw851bNo375Xs=";
   };
 
   propagatedBuildInputs = [
@@ -25,6 +26,7 @@ buildPythonPackage rec {
   ];
 
   checkInputs = [
+    pyfakefs
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/miniaudio/default.nix b/pkgs/development/python-modules/miniaudio/default.nix
index d40c1df47cd90..328dcd93ad48d 100644
--- a/pkgs/development/python-modules/miniaudio/default.nix
+++ b/pkgs/development/python-modules/miniaudio/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "miniaudio";
-  version = "1.50";
+  version = "1.51";
 
   disabled = pythonOlder "3.6";
 
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "irmen";
     repo = "pyminiaudio";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-GqpOuL+q5v9sKCpbNpPH4uC7k2HBs0RkTWaIC5A2eHI=";
+    sha256 = "sha256-nWx/1+b28/pvyTe8jSAOmw+vfzjuD7FFmVVUzH8DAyw=";
   };
 
   buildInputs = lib.optionals stdenv.isDarwin [
diff --git a/pkgs/development/python-modules/mitogen/default.nix b/pkgs/development/python-modules/mitogen/default.nix
index d99bdec4b0da0..6b6f29e1d5f4d 100644
--- a/pkgs/development/python-modules/mitogen/default.nix
+++ b/pkgs/development/python-modules/mitogen/default.nix
@@ -6,7 +6,7 @@
 
 buildPythonPackage rec {
   pname = "mitogen";
-  version = "0.3.2";
+  version = "0.3.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -15,7 +15,7 @@ buildPythonPackage rec {
     owner = "mitogen-hq";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ACd1z9h9RLu6Kho59L2YkXkLtBEywYbO+drUvoZaVlg=";
+    sha256 = "sha256-cx0q2Y9A6UzpdD1kuGBtXIs9oBGFpkIyvPfN2hj+A1g=";
   };
 
   # Tests require network access and Docker support
diff --git a/pkgs/development/python-modules/mockito/default.nix b/pkgs/development/python-modules/mockito/default.nix
index 1d2509c4a75e5..e9af134ba111e 100644
--- a/pkgs/development/python-modules/mockito/default.nix
+++ b/pkgs/development/python-modules/mockito/default.nix
@@ -1,12 +1,12 @@
 { lib, buildPythonPackage, fetchPypi, isPy3k, funcsigs, pytest, numpy }:
 
 buildPythonPackage rec {
-  version = "1.3.1";
+  version = "1.3.3";
   pname = "mockito";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-o8Hg3UnxWbJITBu/IjsbWRHDiJ5smffKUNHAqG21170=";
+    sha256 = "sha256-mCRTdihXcyMHNPJkmGWLHcBFrTvhNCH1CMcaXHaVe8E=";
   };
 
   propagatedBuildInputs = lib.optionals (!isPy3k) [ funcsigs ];
diff --git a/pkgs/development/python-modules/mysqlclient/default.nix b/pkgs/development/python-modules/mysqlclient/default.nix
index ad1e321e9f845..c12b16611e924 100644
--- a/pkgs/development/python-modules/mysqlclient/default.nix
+++ b/pkgs/development/python-modules/mysqlclient/default.nix
@@ -2,7 +2,7 @@
 
 buildPythonPackage rec {
   pname = "mysqlclient";
-  version = "2.1.0";
+  version = "2.1.1";
 
   nativeBuildInputs = [
     libmysqlclient
@@ -17,7 +17,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "973235686f1b720536d417bf0a0d39b4ab3d5086b2b6ad5e6752393428c02b12";
+    sha256 = "sha256-godX5Bn7Ed1sXtJXbsksPvqpOg98OeJjWG0e53nD14I=";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/napalm/default.nix b/pkgs/development/python-modules/napalm/default.nix
index 09d38875db8e8..9625c8b55649f 100644
--- a/pkgs/development/python-modules/napalm/default.nix
+++ b/pkgs/development/python-modules/napalm/default.nix
@@ -1,7 +1,7 @@
 { lib, buildPythonPackage, fetchFromGitHub, fetchpatch, setuptools, cffi
 , paramiko, requests, future, textfsm, jinja2, netaddr, pyyaml, pyeapi, netmiko
 , junos-eznc, ciscoconfparse, scp, lxml, ncclient, pytestCheckHook, ddt, mock
-, pythonOlder }:
+, pythonOlder, invoke }:
 
 buildPythonPackage rec {
   pname = "napalm";
@@ -35,14 +35,13 @@ buildPythonPackage rec {
       --replace "netmiko>=3.3.0,<4.0.0" "netmiko"
   '';
 
-  buildInputs = [ setuptools ];
-
   propagatedBuildInputs = [
     cffi
     paramiko
     requests
     future
     textfsm
+    invoke
     jinja2
     netaddr
     pyyaml
@@ -51,6 +50,7 @@ buildPythonPackage rec {
     junos-eznc
     ciscoconfparse
     scp
+    setuptools
     lxml
     ncclient
   ];
@@ -62,6 +62,6 @@ buildPythonPackage rec {
       "Network Automation and Programmability Abstraction Layer with Multivendor support";
     homepage = "https://github.com/napalm-automation/napalm";
     license = licenses.asl20;
-    maintainers = [ maintainers.astro ];
+    maintainers = with maintainers; [ ] ++ teams.c3d2.members;
   };
 }
diff --git a/pkgs/development/python-modules/nomadnet/default.nix b/pkgs/development/python-modules/nomadnet/default.nix
index ef7083980af5f..554df0878595d 100644
--- a/pkgs/development/python-modules/nomadnet/default.nix
+++ b/pkgs/development/python-modules/nomadnet/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "nomadnet";
-  version = "0.1.8";
+  version = "0.1.9";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "markqvist";
     repo = "NomadNet";
     rev = version;
-    hash = "sha256-gqUCE35RPt7k0RAoZGJS1srB5K4v6gJkbTKQs8Lajm8=";
+    hash = "sha256-GZsARzqnLyZZU900ONv1/sejsEGMTFNIhOS+SESFBqg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/proto-plus/default.nix b/pkgs/development/python-modules/proto-plus/default.nix
index ace9537c1d043..3db023447f610 100644
--- a/pkgs/development/python-modules/proto-plus/default.nix
+++ b/pkgs/development/python-modules/proto-plus/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "proto-plus";
-  version = "1.20.5";
+  version = "1.20.6";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-gXlOsb4zPGeYYzOUjfcOu4zfU44Dn4z6kv0qnXF21AU=";
+    sha256 = "sha256-RJtFN+g/R3a9aQUcTXdtuP/j+dBkHx6HsGwRbrlMkOk=";
   };
 
   propagatedBuildInputs = [ protobuf ];
diff --git a/pkgs/development/python-modules/pulumi-aws/default.nix b/pkgs/development/python-modules/pulumi-aws/default.nix
index b62f9b7eaaf5c..838422a31a250 100644
--- a/pkgs/development/python-modules/pulumi-aws/default.nix
+++ b/pkgs/development/python-modules/pulumi-aws/default.nix
@@ -12,7 +12,7 @@
 buildPythonPackage rec {
   pname = "pulumi-aws";
   # Version is independant of pulumi's.
-  version = "5.9.0";
+  version = "5.9.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "pulumi";
     repo = "pulumi-aws";
     rev = "refs/tags/v${version}";
-    hash = "sha256-QEOVI6PvFJ8gf02Hlh42grMt2cObTJsOSmrgmjEZ8Rw=";
+    hash = "sha256-LYWxdqortazhev73JSTItrEyZZYFmeXkAko/2aFKaSw=";
   };
 
   sourceRoot = "${src.name}/sdk/python";
diff --git a/pkgs/development/python-modules/pydantic/default.nix b/pkgs/development/python-modules/pydantic/default.nix
index a886b5ba78cee..25a5d54d529e0 100644
--- a/pkgs/development/python-modules/pydantic/default.nix
+++ b/pkgs/development/python-modules/pydantic/default.nix
@@ -2,7 +2,7 @@
 , buildPythonPackage
 , cython
 , devtools
-, email_validator
+, email-validator
 , fetchFromGitHub
 , pytest-mock
 , pytestCheckHook
@@ -57,7 +57,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     devtools
-    email_validator
+    email-validator
     python-dotenv
     typing-extensions
   ];
diff --git a/pkgs/development/python-modules/pygmt/default.nix b/pkgs/development/python-modules/pygmt/default.nix
index f7728cfa28db0..127150a1a626d 100644
--- a/pkgs/development/python-modules/pygmt/default.nix
+++ b/pkgs/development/python-modules/pygmt/default.nix
@@ -17,15 +17,15 @@
 
 buildPythonPackage rec {
   pname = "pygmt";
-  version = "0.6.0";
+  version = "0.6.1";
 
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "GenericMappingTools";
     repo = "pygmt";
-    rev = "v${version}";
-    sha256 = "sha256-QzqQKnANReSHIsDbiKSZ1ZgMgbj3NAfq4bmRQktnRjQ=";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-/hZUDvMhF/ojTXBcap5lL6X2bYu+opf+TwYNjANgtiw=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pymazda/default.nix b/pkgs/development/python-modules/pymazda/default.nix
index 5ee3234b70d81..228323f94845e 100644
--- a/pkgs/development/python-modules/pymazda/default.nix
+++ b/pkgs/development/python-modules/pymazda/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "pymazda";
-  version = "0.3.3";
+  version = "0.3.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-jvDjitS8r0oyANxUGbYksX7O7dbEqZeWEpYc9gABb78=";
+    sha256 = "sha256-Xq+DXrZp1NrsCgUnjaMWUoM+SDfnXK+YDX2Gcr7FKvQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pypoolstation/default.nix b/pkgs/development/python-modules/pypoolstation/default.nix
index 6ac92aeb6e9d4..5607bc0926a9e 100644
--- a/pkgs/development/python-modules/pypoolstation/default.nix
+++ b/pkgs/development/python-modules/pypoolstation/default.nix
@@ -1,5 +1,6 @@
 { lib
 , aiohttp
+, backoff
 , buildPythonPackage
 , fetchPypi
 , poetry-core
@@ -8,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "pypoolstation";
-  version = "0.4.5";
+  version = "0.4.8";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -16,7 +17,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "PyPoolstation";
     inherit version;
-    sha256 = "sha256-cf2KUdvsuC7fplg7O9Jqqb86rOjNicV+vGVBwWvvs90=";
+    sha256 = "sha256-6Fdam/LS3Nicrhe5jHHvaKCpE0HigfOVszjb5c1VM3Y=";
   };
 
   nativeBuildInputs = [
@@ -25,6 +26,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     aiohttp
+    backoff
   ];
 
   # Project has no tests
diff --git a/pkgs/development/python-modules/pyroute2-core/default.nix b/pkgs/development/python-modules/pyroute2-core/default.nix
index 085e0059a9d55..76fb240445563 100644
--- a/pkgs/development/python-modules/pyroute2-core/default.nix
+++ b/pkgs/development/python-modules/pyroute2-core/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "pyroute2-core";
-  version = "0.6.12";
+  version = "0.6.13";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -15,7 +15,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "pyroute2.core";
     inherit version;
-    hash = "sha256-uzb8nlAOHNtNq205/sJPoJtvMoo7uCFfrRQas/rv8p8=";
+    hash = "sha256-In39nxmIjd0TQZZoIv/ViA2548iTdQlkGMZg/00aEdA=";
   };
 
   # pyroute2 sub-modules have no tests
diff --git a/pkgs/development/python-modules/pyroute2-ethtool/default.nix b/pkgs/development/python-modules/pyroute2-ethtool/default.nix
index 93699e161b819..f163336028d16 100644
--- a/pkgs/development/python-modules/pyroute2-ethtool/default.nix
+++ b/pkgs/development/python-modules/pyroute2-ethtool/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "pyroute2-ethtool";
-  version = "0.6.12";
+  version = "0.6.13";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -15,7 +15,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "pyroute2.ethtool";
     inherit version;
-    hash = "sha256-MwIRm/DezL7yCN682Yckxd23+iri2V6HCokF4G36apU=";
+    hash = "sha256-Cmh/6g/Nd9kHTHwYujXZufcOQhfr5opofiAECEc6O9Q=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyroute2-ipdb/default.nix b/pkgs/development/python-modules/pyroute2-ipdb/default.nix
index 0c11d6f85cedd..a991645d4ce2c 100644
--- a/pkgs/development/python-modules/pyroute2-ipdb/default.nix
+++ b/pkgs/development/python-modules/pyroute2-ipdb/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "pyroute2-ipdb";
-  version = "0.6.12";
+  version = "0.6.13";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -15,7 +15,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "pyroute2.ipdb";
     inherit version;
-    hash = "sha256-hKh5SFFMdhECeMyA3Quzqp7h+iQMMmCYBJEuLEq5dVs=";
+    hash = "sha256-u7u3XRO+luRUnPcOuU/XCy4XNuowGsa2g/VqoazYTVo=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyroute2-ipset/default.nix b/pkgs/development/python-modules/pyroute2-ipset/default.nix
index 6b21283aa9078..28c806143808f 100644
--- a/pkgs/development/python-modules/pyroute2-ipset/default.nix
+++ b/pkgs/development/python-modules/pyroute2-ipset/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "pyroute2-ipset";
-  version = "0.6.12";
+  version = "0.6.13";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -15,7 +15,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "pyroute2.ipset";
     inherit version;
-    hash = "sha256-nvj7b6HF/XhzqmFg6aOQKMFDEFwAcyOnoJXi/coNvG4=";
+    hash = "sha256-KKJU9iKhiXbQaDYD1a79pat8hSj6nja+uFvOUgJveGY=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyroute2-ndb/default.nix b/pkgs/development/python-modules/pyroute2-ndb/default.nix
index 6965dfaf8a5a4..c43adc07647f0 100644
--- a/pkgs/development/python-modules/pyroute2-ndb/default.nix
+++ b/pkgs/development/python-modules/pyroute2-ndb/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "pyroute2-ndb";
-  version = "0.6.12";
+  version = "0.6.13";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -15,7 +15,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "pyroute2.ndb";
     inherit version;
-    hash = "sha256-Oc+uaqftRH6Dw3Sa2G1rZ3Mx2u81ErKIyz8xhnA1QgI=";
+    hash = "sha256-CbH1XyYEPOZMkz6CJP0IREpJjzgeXcSDvJ9CjLrwkBo=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyroute2-nftables/default.nix b/pkgs/development/python-modules/pyroute2-nftables/default.nix
index 19850bb9f2fb2..f6ac1b1f22478 100644
--- a/pkgs/development/python-modules/pyroute2-nftables/default.nix
+++ b/pkgs/development/python-modules/pyroute2-nftables/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "pyroute2-nftables";
-  version = "0.6.12";
+  version = "0.6.13";
 
   src = fetchPypi {
     pname = "pyroute2.nftables";
     inherit version;
-    sha256 = "sha256-jy04M73r49LxfbHAuDgSaoFWmkc0O/jPJwdDlW8YCSc=";
+    sha256 = "sha256-yUvXQNULA6Go2WVPdp53r8d6deBfxYh90FUeOXD4ZZI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyroute2-nslink/default.nix b/pkgs/development/python-modules/pyroute2-nslink/default.nix
index 7213556ea950d..59eba1b76a1ec 100644
--- a/pkgs/development/python-modules/pyroute2-nslink/default.nix
+++ b/pkgs/development/python-modules/pyroute2-nslink/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "pyroute2-nslink";
-  version = "0.6.12";
+  version = "0.6.13";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -15,7 +15,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "pyroute2.nslink";
     inherit version;
-    hash = "sha256-c66rD7CyHdyYACIiq1Nfu6rmUsIL9YmFp4Z1gxOFik4=";
+    hash = "sha256-hu1QbK3MsVTNJ667Pb9z67cjw5EQTn8PO8LEo5xiNmw=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyroute2-protocols/default.nix b/pkgs/development/python-modules/pyroute2-protocols/default.nix
index 700abb2266daa..24758a91ca24c 100644
--- a/pkgs/development/python-modules/pyroute2-protocols/default.nix
+++ b/pkgs/development/python-modules/pyroute2-protocols/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "pyroute2-protocols";
-  version = "0.6.12";
+  version = "0.6.13";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -15,7 +15,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "pyroute2.protocols";
     inherit version;
-    hash = "sha256-j83UNlQVjxIyKhOqDsx6yhvMZEfAh54gRjniacCpSxY=";
+    hash = "sha256-bb7y0D7If2MAHabua9EzgEL2Ic+9BHVfYaMoxDCwAtY=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyroute2/default.nix b/pkgs/development/python-modules/pyroute2/default.nix
index 96835a1be1f84..632fadd3c2667 100644
--- a/pkgs/development/python-modules/pyroute2/default.nix
+++ b/pkgs/development/python-modules/pyroute2/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "pyroute2";
-  version = "0.6.12";
+  version = "0.6.13";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-cnUvmx9R+4oUGgf6LpbMlAadVh/EYcNX1ep88gtPTn4=";
+    hash = "sha256-sD1JpYGUX+wrHsfR1RJcb0C6BO0Rr/yQxMrdwBniV5I=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pysigma-backend-splunk/default.nix b/pkgs/development/python-modules/pysigma-backend-splunk/default.nix
index b270fa79c88d2..aa316a2617531 100644
--- a/pkgs/development/python-modules/pysigma-backend-splunk/default.nix
+++ b/pkgs/development/python-modules/pysigma-backend-splunk/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pysigma-backend-splunk";
-  version = "0.3.3";
+  version = "0.3.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "SigmaHQ";
     repo = "pySigma-backend-splunk";
     rev = "v${version}";
-    hash = "sha256-VRHrlcty3EpGnQkVJvsNWOJSW6rNE97Lqt36HmMR53A=";
+    hash = "sha256-zsX2lycqJKRASXio8s3Cvkt1yfnBm5cwQOFAFA891GI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pyswitchbot/default.nix b/pkgs/development/python-modules/pyswitchbot/default.nix
index 38e7e2733ead5..702f179b6dad3 100644
--- a/pkgs/development/python-modules/pyswitchbot/default.nix
+++ b/pkgs/development/python-modules/pyswitchbot/default.nix
@@ -1,5 +1,5 @@
 { lib
-, bluepy
+, bleak
 , buildPythonPackage
 , fetchFromGitHub
 , pythonOlder
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "pyswitchbot";
-  version = "0.13.3";
+  version = "0.14.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -16,11 +16,11 @@ buildPythonPackage rec {
     owner = "Danielhiversen";
     repo = "pySwitchbot";
     rev = version;
-    hash = "sha256-Zgpnw4It3yyy9RQqt5SxeJXl1Z3J3Rp9baLfiw5Bgow=";
+    hash = "sha256-6u7PqYv7Q5rVzsUnoQi495svX8puBz0Oj3SGgcpJrcQ=";
   };
 
   propagatedBuildInputs = [
-    bluepy
+    bleak
   ];
 
   # Project has no tests
diff --git a/pkgs/development/python-modules/python-magic/default.nix b/pkgs/development/python-modules/python-magic/default.nix
index 852b66b44e5f1..3338fb6fa7d0d 100644
--- a/pkgs/development/python-modules/python-magic/default.nix
+++ b/pkgs/development/python-modules/python-magic/default.nix
@@ -1,6 +1,5 @@
 { lib
 , stdenv
-, python
 , buildPythonPackage
 , fetchFromGitHub
 , substituteAll
@@ -10,13 +9,13 @@
 
 buildPythonPackage rec {
   pname = "python-magic";
-  version = "0.4.26";
+  version = "0.4.27";
 
   src = fetchFromGitHub {
     owner = "ahupp";
     repo = "python-magic";
     rev = version;
-    sha256 = "sha256-RcKldMwSRroNZNEl0jwuJG9C+3OIPBzk+CjqkxKK/eY=";
+    sha256 = "sha256-fZ+5xJ3P0EYK+6rQ8VzXv2zckKfEH5VUdISIR6ybIfQ=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/pyvex/default.nix b/pkgs/development/python-modules/pyvex/default.nix
index b7bff273b231c..8710fea109f02 100644
--- a/pkgs/development/python-modules/pyvex/default.nix
+++ b/pkgs/development/python-modules/pyvex/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "pyvex";
-  version = "9.2.6";
+  version = "9.2.7";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-I2ZQJ/CDvNq5uJoLT9SHDGzeuI32YUy/6fMSNR9WM8I=";
+    hash = "sha256-vSVkredOekqUAre38jDCE8f8OXd0cNmZ2SmpEQ7+I28=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/railroad-diagrams/default.nix b/pkgs/development/python-modules/railroad-diagrams/default.nix
index 57c07e0dc48b1..55b964fb6ad27 100644
--- a/pkgs/development/python-modules/railroad-diagrams/default.nix
+++ b/pkgs/development/python-modules/railroad-diagrams/default.nix
@@ -1,24 +1,30 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "railroad-diagrams";
-  version = "1.1.1";
+  version = "2.0.4";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8a1ec227666be2000e76794aa740f77987f1586077aae4d090d2633b3064c976";
+    hash = "sha256-dBP/oZRYO9UQ78PkZo9h1aOL7soYa7fDbuptDW8D+0U=";
   };
 
-  # this is a dependency of pyparsing, which is a dependency of pytest
+  # This is a dependency of pyparsing, which is a dependency of pytest
   doCheck = false;
 
-  pythonImportsCheck = [ "railroad" ];
+  pythonImportsCheck = [
+    "railroad"
+  ];
 
   meta = with lib; {
-    description = "Generate SVG railroad syntax diagrams, like on JSON.org";
+    description = "Module to generate SVG railroad syntax diagrams";
     homepage = "https://github.com/tabatkins/railroad-diagrams";
     license = licenses.cc0;
     maintainers = with maintainers; [ jonringer ];
diff --git a/pkgs/development/python-modules/ropgadget/default.nix b/pkgs/development/python-modules/ropgadget/default.nix
index 4d0a4aa94f11e..65a80e399d1e3 100644
--- a/pkgs/development/python-modules/ropgadget/default.nix
+++ b/pkgs/development/python-modules/ropgadget/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "ropgadget";
-  version = "6.7";
+  version = "6.8";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -15,8 +15,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "JonathanSalwan";
     repo = "ROPgadget";
-    rev = "v${version}";
-    hash = "sha256-zOTbncsOvmLQMZGpcRLviSZP/d1cQTQHXCLUKyEgVBk=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-hnqjyZC3RJNQf8JdtaQ5L3PU+96p4cxdd+P4YlW9jjI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/sentry-sdk/default.nix b/pkgs/development/python-modules/sentry-sdk/default.nix
index 542178a3cae30..e434310f56f04 100644
--- a/pkgs/development/python-modules/sentry-sdk/default.nix
+++ b/pkgs/development/python-modules/sentry-sdk/default.nix
@@ -46,7 +46,7 @@
 
 buildPythonPackage rec {
   pname = "sentry-sdk";
-  version = "1.5.12";
+  version = "1.6.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -55,7 +55,7 @@ buildPythonPackage rec {
     owner = "getsentry";
     repo = "sentry-python";
     rev = version;
-    hash = "sha256-8M0FWfvaGp74Fb+qJlhyiJPUVHN2ZdEleZf27d+bftE=";
+    hash = "sha256-X831uMlxvcgxQz8xWQZkJOp/fTmF62J95esJY23DZQw=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/slack-sdk/default.nix b/pkgs/development/python-modules/slack-sdk/default.nix
index 8019339483854..a4bef1ab8e144 100644
--- a/pkgs/development/python-modules/slack-sdk/default.nix
+++ b/pkgs/development/python-modules/slack-sdk/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "slack-sdk";
-  version = "3.17.1";
+  version = "3.17.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = "slackapi";
     repo = "python-slack-sdk";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-FWjhfvBx8FXAMFKxWB4Vvjg5PPw9v7ciKU+oIEGD36s=";
+    sha256 = "sha256-Rzs2ugG6Xm8IVWt20+1oLB0FxhBHyIfDGNL2jzgDnwc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/snowflake-connector-python/default.nix b/pkgs/development/python-modules/snowflake-connector-python/default.nix
index 06474e645e474..304a1c36894f2 100644
--- a/pkgs/development/python-modules/snowflake-connector-python/default.nix
+++ b/pkgs/development/python-modules/snowflake-connector-python/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "snowflake-connector-python";
-  version = "2.7.8";
+  version = "2.7.9";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-nPsHsEi8sf5kbQP3SAzLaod+nEUGcwLpC8/3/XL2vC8=";
+    hash = "sha256-HQ/d7luqdG1BriuP8QXzZk5JZwwLJH1JQIN3BtEDpM4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/soco/default.nix b/pkgs/development/python-modules/soco/default.nix
index 50a134df2d2a3..894bdb9d0ba61 100644
--- a/pkgs/development/python-modules/soco/default.nix
+++ b/pkgs/development/python-modules/soco/default.nix
@@ -5,6 +5,7 @@
 , appdirs
 , ifaddr
 , pythonOlder
+, lxml
 , mock
 , nix-update-script
 , pytestCheckHook
@@ -15,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "soco";
-  version = "0.27.1";
+  version = "0.28.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -24,12 +25,13 @@ buildPythonPackage rec {
     owner = "SoCo";
     repo = "SoCo";
     rev = "v${version}";
-    hash = "sha256-8U7wfxqen+hgK8j9ooPHCAKvd9kSZicToTyP7XzQFrg=";
+    hash = "sha256-rH6EfPK4EEQDO63VEIM7jJO5OM4tyYfZ5yYUskPf8dE=";
   };
 
   propagatedBuildInputs = [
     appdirs
     ifaddr
+    lxml
     requests
     xmltodict
   ];
diff --git a/pkgs/development/python-modules/strenum/default.nix b/pkgs/development/python-modules/strenum/default.nix
index f287b2623a6b1..d73b60906cc57 100644
--- a/pkgs/development/python-modules/strenum/default.nix
+++ b/pkgs/development/python-modules/strenum/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "strenum";
-  version = "0.4.7";
+  version = "0.4.8";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "irgeek";
     repo = "StrEnum";
     rev = "v${version}";
-    hash = "sha256-ktsPROIv/BbPinZfrBknI4c/WwRYGhWgmw209Hfg8EQ=";
+    hash = "sha256-S64YfF+cbefXRWoeJK99ZPTiO9DUcDaT77hVQd7pKDk=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/sunpy/default.nix b/pkgs/development/python-modules/sunpy/default.nix
index b9fc0a652439e..beb7c5b73ada2 100644
--- a/pkgs/development/python-modules/sunpy/default.nix
+++ b/pkgs/development/python-modules/sunpy/default.nix
@@ -31,14 +31,14 @@
 
 buildPythonPackage rec {
   pname = "sunpy";
-  version = "4.0.1";
+  version = "4.0.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-TKOJcEg5A3zjuJbH/tugoX7A7vxSwcE20jJ5QuvWTu8=";
+    hash = "sha256-ZswUFdMRqEiMpTXAuVtEnsHJ4dgwcx2f4k1DwLl8pz8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/systemd/default.nix b/pkgs/development/python-modules/systemd/default.nix
index 86c330bd1d880..b27af96edbd75 100644
--- a/pkgs/development/python-modules/systemd/default.nix
+++ b/pkgs/development/python-modules/systemd/default.nix
@@ -1,4 +1,10 @@
-{ lib, buildPythonPackage, fetchFromGitHub, systemd, pkg-config }:
+{ lib
+, buildPythonPackage
+, fetchpatch
+, fetchFromGitHub
+, systemd
+, pkg-config
+}:
 
 buildPythonPackage rec {
   pname = "systemd";
@@ -11,14 +17,36 @@ buildPythonPackage rec {
     sha256 = "1fakw7qln44mfd6pj4kqsgyrhkc6cyr653id34kv0rdnb1bvysrz";
   };
 
-  buildInputs = [ systemd ];
-  nativeBuildInputs = [ pkg-config ];
+  patches = [
+    # Fix runtime issues on Python 3.10
+    # https://github.com/systemd/python-systemd/issues/107
+    (fetchpatch {
+      url = "https://github.com/systemd/python-systemd/commit/c71bbac357f0ac722e1bcb2edfa925b68cca23c9.patch";
+      sha256 = "22s72Wa/BCwNNvwbxEUh58jhHlbA00SNwNVchVDovcc=";
+    })
+  ];
 
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    systemd
+  ];
+
+  # No module named 'systemd._journal
   doCheck = false;
 
+  pythonImportsCheck = [
+    "systemd.journal"
+    "systemd.id128"
+    "systemd.daemon"
+    "systemd.login"
+  ];
+
   meta = with lib; {
     description = "Python module for native access to the systemd facilities";
     homepage = "http://www.freedesktop.org/software/systemd/python-systemd/";
-    license = licenses.lgpl21;
+    license = licenses.lgpl21Plus;
   };
 }
diff --git a/pkgs/development/python-modules/time-machine/default.nix b/pkgs/development/python-modules/time-machine/default.nix
index f840512c7d519..1b680dd6c1b14 100644
--- a/pkgs/development/python-modules/time-machine/default.nix
+++ b/pkgs/development/python-modules/time-machine/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "time-machine";
-  version = "2.7.0";
+  version = "2.7.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "adamchainz";
     repo = pname;
     rev = version;
-    sha256 = "sha256-d/jUyzqC4weWdY2x6lf85noE/6gNBFhhDfAaYcwB9XQ=";
+    sha256 = "sha256-bRqljS09IBp/uqbx9hrr1iEwqvAyOWyl4qjKhJqqGzc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/timetagger/default.nix b/pkgs/development/python-modules/timetagger/default.nix
index 6b99e9882c37f..4ef4369669885 100644
--- a/pkgs/development/python-modules/timetagger/default.nix
+++ b/pkgs/development/python-modules/timetagger/default.nix
@@ -15,13 +15,13 @@
 
 buildPythonPackage rec {
   pname = "timetagger";
-  version = "22.6.2";
+  version = "22.6.4";
 
   src = fetchFromGitHub {
     owner = "almarklein";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-8Rl7g0OwjabBI9ekh3+vb+20KsqttvwwzZU0U1ee8dQ=";
+    sha256 = "sha256-wLbC7NlDNgAyCnGjawfrnRPN/4DOcHVd93pIWrILs68=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/types-redis/default.nix b/pkgs/development/python-modules/types-redis/default.nix
index b98628c095cde..4e2d5950efa30 100644
--- a/pkgs/development/python-modules/types-redis/default.nix
+++ b/pkgs/development/python-modules/types-redis/default.nix
@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "types-redis";
-  version = "4.3.0";
+  version = "4.3.2";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-9L2b5qt0Hx2pEFzwpORiiG3B1drkbW0/a3/X6B/+uig=";
+    sha256 = "sha256-oZNQj6poxT3sRcwwUV6rlMMxMlr4oMPIAJX2Dyq22qY=";
   };
 
   # Module doesn't have tests
diff --git a/pkgs/development/python-modules/types-requests/default.nix b/pkgs/development/python-modules/types-requests/default.nix
index b5b52a730fcdb..b6b6f99f4d80d 100644
--- a/pkgs/development/python-modules/types-requests/default.nix
+++ b/pkgs/development/python-modules/types-requests/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "types-requests";
-  version = "2.27.31";
+  version = "2.28.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-b6uXuZ/qUrnHtGak3ZPga7MlvH50IEdeh4MQJqjdNcw=";
+    sha256 = "sha256-mGPRbfuz+lXc2mT6O5ieduiFkDOybB4WI+MEZc/ilNM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/types-tabulate/default.nix b/pkgs/development/python-modules/types-tabulate/default.nix
index c8f49386543a4..13f7453a8fcd3 100644
--- a/pkgs/development/python-modules/types-tabulate/default.nix
+++ b/pkgs/development/python-modules/types-tabulate/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "types-tabulate";
-  version = "0.8.9";
+  version = "0.8.10";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-L8P6T+GFOsmHz1Do1FmeP+RG3VMGT+hqRqQHqY6fwE8=";
+    hash = "sha256-BmdTn8ZjMKJdqmtOUtSUt4Niip/tVKP/MVB23NFaHs0=";
   };
 
   # Module doesn't have tests
diff --git a/pkgs/development/python-modules/vaa/default.nix b/pkgs/development/python-modules/vaa/default.nix
index 783cc7bd68117..d43f007c35cda 100644
--- a/pkgs/development/python-modules/vaa/default.nix
+++ b/pkgs/development/python-modules/vaa/default.nix
@@ -9,7 +9,7 @@
 , marshmallow
 , pyschemes
 , wtforms
-, email_validator
+, email-validator
 }:
 
 buildPythonPackage rec {
@@ -42,7 +42,7 @@ buildPythonPackage rec {
     marshmallow
     pyschemes
     wtforms
-    email_validator
+    email-validator
   ];
 
   pythonImportsCheck = [ "vaa" ];
diff --git a/pkgs/development/python-modules/wandb/default.nix b/pkgs/development/python-modules/wandb/default.nix
index 8304032930213..747f60bc21f85 100644
--- a/pkgs/development/python-modules/wandb/default.nix
+++ b/pkgs/development/python-modules/wandb/default.nix
@@ -39,7 +39,7 @@
 
 buildPythonPackage rec {
   pname = "wandb";
-  version = "0.12.18";
+  version = "0.12.19";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -47,8 +47,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = pname;
     repo = "client";
-    rev = "v${version}";
-    hash = "sha256-9++CFoC8p3cACPyjRbb6i8MdJp8iD9GUh0uHpTiufdg=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-eH65vk3Pnm6d4vDiaWbs1tXD0lCRkfOB2hqD9MGxuXY=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/wtforms/default.nix b/pkgs/development/python-modules/wtforms/default.nix
index c6a3ecf2088ad..ef2e06cc3e71f 100644
--- a/pkgs/development/python-modules/wtforms/default.nix
+++ b/pkgs/development/python-modules/wtforms/default.nix
@@ -4,7 +4,7 @@
 , markupsafe
 , babel
 , pytestCheckHook
-, email_validator
+, email-validator
 }:
 
 buildPythonPackage rec {
@@ -22,7 +22,7 @@ buildPythonPackage rec {
 
   checkInputs = [
     pytestCheckHook
-    email_validator
+    email-validator
   ];
 
   pythonImportsCheck = [ "wtforms" ];
diff --git a/pkgs/development/python-modules/xmlschema/default.nix b/pkgs/development/python-modules/xmlschema/default.nix
index 07001eb49f8b3..3dcfe8d7d0269 100644
--- a/pkgs/development/python-modules/xmlschema/default.nix
+++ b/pkgs/development/python-modules/xmlschema/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "xmlschema";
-  version = "1.11.2";
+  version = "1.11.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "sissaschool";
     repo = "xmlschema";
     rev = "refs/tags/v${version}";
-    hash = "sha256-coQbO5XrFjU9rAN5Vw/BlMHpkQzQy6t0dNfFsMeO2+o=";
+    hash = "sha256-z6VgLRDp5PHaYstdV30gt6xGVd4uifz4LkYQ2z3ayk4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/youtube-search-python/default.nix b/pkgs/development/python-modules/youtube-search-python/default.nix
index 9383d4cb05988..11da850c992d3 100644
--- a/pkgs/development/python-modules/youtube-search-python/default.nix
+++ b/pkgs/development/python-modules/youtube-search-python/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "youtube-search-python";
-  version = "1.6.5";
+  version = "1.6.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-1B7rppa+s/oE8w91Ca7ogjkNHu5pFSnNmDyUopCWEY8=";
+    hash = "sha256-RWjR12ns1+tLuDZfBO7G42TF9w7sezdl9UPa67E1/PU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/ruby-modules/bundled-common/gen-bin-stubs.rb b/pkgs/development/ruby-modules/bundled-common/gen-bin-stubs.rb
index 3106e9c24ca76..822996b7cbf68 100644
--- a/pkgs/development/ruby-modules/bundled-common/gen-bin-stubs.rb
+++ b/pkgs/development/ruby-modules/bundled-common/gen-bin-stubs.rb
@@ -41,6 +41,20 @@ Gem.paths = { 'GEM_HOME' => #{bundle_path.dump} }
 $LOAD_PATH.unshift #{File.join(bundler_path, "/lib").dump}
 
 require 'bundler'
+# Monkey-patch out the check that Bundler performs to determine
+# whether the bundler env is writable. It's not writable, even for
+# root! And for this use of Bundler, it shouldn't be necessary since
+# we're not trying to perform any package management operations, only
+# produce a Gem path. Thus, we replace it with a method that will
+# always return false, to squelch a warning from Bundler saying that
+# sudo may be required.
+module Bundler
+  class <<self
+    def requires_sudo?
+      return false
+    end
+  end
+end
 Bundler.setup(#{groups.map(&:dump).join(', ')})
 
 load Gem.bin_path(#{name.dump}, #{exe.dump})
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index 79bb3a2b49ce7..6cb98bf10d4dc 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -32,14 +32,14 @@ with py.pkgs;
 
 buildPythonApplication rec {
   pname = "checkov";
-  version = "2.0.1226";
+  version = "2.1.5";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = pname;
     rev = version;
-    hash = "sha256-hAHIrf1oZMPpciKTUiM+EuP4TDtb0lYI7hlZXWkIyV4=";
+    hash = "sha256-bH7W+GZ4O32ty5YD4hfKz2R10v7zEJLU1kLzKvdx3E4=";
   };
 
   nativeBuildInputs = with py.pkgs; [
diff --git a/pkgs/development/tools/analysis/checkstyle/default.nix b/pkgs/development/tools/analysis/checkstyle/default.nix
index 31f022263b22f..1f07c8ff030f0 100644
--- a/pkgs/development/tools/analysis/checkstyle/default.nix
+++ b/pkgs/development/tools/analysis/checkstyle/default.nix
@@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl, makeWrapper, jre }:
 
 stdenv.mkDerivation rec {
-  version = "10.2";
+  version = "10.3";
   pname = "checkstyle";
 
   src = fetchurl {
     url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-${version}/checkstyle-${version}-all.jar";
-    sha256 = "sha256-jcu7KMeYbHZW4zswaV/cLkY4CLX9vJIcElXJq06EfRY=";
+    sha256 = "sha256-3n5gXGHznrLGL9hudk1nZs1GJ5V2qzqVPCtn1fqujB0=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/tools/analysis/cvehound/default.nix b/pkgs/development/tools/analysis/cvehound/default.nix
index 3fe3c043c238b..12d36dc6089ef 100644
--- a/pkgs/development/tools/analysis/cvehound/default.nix
+++ b/pkgs/development/tools/analysis/cvehound/default.nix
@@ -7,13 +7,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "cvehound";
-  version = "1.0.9";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "evdenis";
     repo = "cvehound";
-    rev = version;
-    hash = "sha256-qwQfpelY1Air3wVQ3RziM/+MNOR3jiKmLpO2w6kXZwM=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-4+0Virpsq4mwOIpostS87VYTX8hsumXEL1w8FiOrNtA=";
   };
 
   makeWrapperArgs = [
diff --git a/pkgs/development/tools/analysis/radare2/default.nix b/pkgs/development/tools/analysis/radare2/default.nix
index 737034b0d2683..63594300e835d 100644
--- a/pkgs/development/tools/analysis/radare2/default.nix
+++ b/pkgs/development/tools/analysis/radare2/default.nix
@@ -31,8 +31,8 @@ let
   arm64 = fetchFromGitHub {
     owner = "radareorg";
     repo = "vector35-arch-arm64";
-    rev = "3c5eaba46dab72ecb7d5f5b865a13fdeee95b464";
-    sha256 = "sha256-alcGEi+D8CptXzfznnuxQKCvU2mbzn2sQge5jSqLVpg=";
+    rev = "9ab2b0bedde459dc86e079718333de4a63bbbacb";
+    sha256 = "sha256-2KLtjgCqHzBBlo9ImZ8WJ1bsWy/kdJCjCFxlLE+HxoI=";
   };
   armv7 = fetchFromGitHub {
     owner = "radareorg";
@@ -44,13 +44,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "radare2";
-  version = "5.7.0";
+  version = "5.7.2";
 
   src = fetchFromGitHub {
     owner = "radare";
     repo = "radare2";
     rev = version;
-    sha256 = "sha256-tCFi1m3xyQlG+8FijjQh8PMwg6CIfIxvLkd5xCIZHHo=";
+    sha256 = "sha256-TZeW+9buJvCOudHsLTMITFpRUlmNpo71efc3xswJoPw=";
   };
 
   preBuild = ''
diff --git a/pkgs/development/tools/analysis/tflint/default.nix b/pkgs/development/tools/analysis/tflint/default.nix
index 2ed23f43a4710..d37b514138034 100644
--- a/pkgs/development/tools/analysis/tflint/default.nix
+++ b/pkgs/development/tools/analysis/tflint/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "tflint";
-  version = "0.37.0";
+  version = "0.38.1";
 
   src = fetchFromGitHub {
     owner = "terraform-linters";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-2fcrKwbYuCOZE++Sin0zNuGaBQQd0dNs1MRL/doOLOw=";
+    sha256 = "sha256-sBvfcAOkfZ5V7SrLBWrSQr5zXwqbwOBmYehujk0y6eg=";
   };
 
   vendorSha256 = "sha256-2v070TwDWkN4HZ/EOu85lotA9qIKLgpwD9TrfH7pGY4=";
diff --git a/pkgs/development/tools/apko/default.nix b/pkgs/development/tools/apko/default.nix
index 05342e7714e97..ee2d7f24a6b61 100644
--- a/pkgs/development/tools/apko/default.nix
+++ b/pkgs/development/tools/apko/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "apko";
-  version = "0.3.3";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "chainguard-dev";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-j/tfa9O10HSEwzuXE2mjV2TVYuwk9lpA0PgsKDm70uI=";
+    sha256 = "sha256-gmBcN1lxzkkRpiUUWv87ji/G4Uy3DA8a6+6Qs+p/2mg=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -24,7 +24,7 @@ buildGoModule rec {
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
-  vendorSha256 = "sha256-jsNSYlTXUAUPG7vccjmonZUN1HAmULprCmJ1TYLYP00=";
+  vendorSha256 = "sha256-3gRECgKvGqkgBzB3SSxm6/LxZG8RxhjoC6Q7DZj/Has=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/asmfmt/default.nix b/pkgs/development/tools/asmfmt/default.nix
index 81f7aa764f27c..953a5469ec51d 100644
--- a/pkgs/development/tools/asmfmt/default.nix
+++ b/pkgs/development/tools/asmfmt/default.nix
@@ -1,14 +1,12 @@
-{ buildGoPackage
+{ buildGoModule
 , lib
 , fetchFromGitHub
 }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "asmfmt";
   version = "1.3.2";
 
-  goPackagePath = "github.com/klauspost/asmfmt";
-
   src = fetchFromGitHub {
     owner = "klauspost";
     repo = "asmfmt";
@@ -16,17 +14,26 @@ buildGoPackage rec {
     sha256 = "sha256-YxIVqPGsqxvOY0Qz4Jw5FuO9IbplCICjChosnHrSCgc=";
   };
 
-  goDeps = ./deps.nix;
+  vendorSha256 = "sha256-pQpattmS9VmO3ZIQUFn66az8GSmB4IvYhTTCFn6SUmo=";
 
   # This package comes with its own version of goimports, gofmt and goreturns
   # but these binaries are outdated and are offered by other packages.
   subPackages = [ "cmd/asmfmt" ];
 
+  ldflags = [ "-s" "-w" ];
+
+  # There are no tests.
+  doCheck = false;
+
   meta = with lib; {
-    description = "Go Assembler Formatter";
+    description = "Go assembler formatter";
+    longDescription = ''
+      This will format your assembler code in a similar way that gofmt formats
+      your Go code.
+    '';
     homepage = "https://github.com/klauspost/asmfmt";
+    changelog = "https://github.com/klauspost/asmfmt/releases/tag/${src.rev}";
     license = licenses.mit;
     maintainers = with maintainers; [ kalbasit ];
-    platforms = platforms.linux ++ platforms.darwin;
   };
 }
diff --git a/pkgs/development/tools/asmfmt/deps.nix b/pkgs/development/tools/asmfmt/deps.nix
deleted file mode 100644
index 0288fc206d492..0000000000000
--- a/pkgs/development/tools/asmfmt/deps.nix
+++ /dev/null
@@ -1,20 +0,0 @@
-[
-  {
-    goPackagePath = "golang.org/x/tools";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/tools";
-      rev = "3a10b9bf0a52df7e992a8c3eb712a86d3c896c75";
-      sha256 = "19f3dijcc54jnd7458jab2dgpd0gzccmv2qympd9wi8cc8jpnhws";
-    };
-  }
-  {
-    goPackagePath = "sourcegraph.com/sqs/goreturns";
-    fetch = {
-      type = "git";
-      url = "https://github.com/sqs/goreturns";
-      rev = "538ac601451833c7c4449f8431d65d53c1c60e41";
-      sha256 = "0gcplch8zmcgwl6xvcffxg50g3xnf60n7dlqxgn51179qcjr354p";
-    };
-  }
-]
diff --git a/pkgs/development/tools/bazelisk/default.nix b/pkgs/development/tools/bazelisk/default.nix
index 2ba077fa9439c..6eace485507a3 100644
--- a/pkgs/development/tools/bazelisk/default.nix
+++ b/pkgs/development/tools/bazelisk/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "bazelisk";
-  version = "1.11.0";
+  version = "1.12.0";
 
   src = fetchFromGitHub {
     owner = "bazelbuild";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-9J49+1fI3wmHQqYgdoGgaAuVMA9eG7wrFe7dQEectvI=";
+    sha256 = "sha256-RWVD6tngFE3i8JDB9b0JZz8Bd+u97b4ilmEF0N8Pm4Y=";
   };
 
-  vendorSha256 = "sha256-+zJEB9FyVvxHdwR/dAn56jrMbgVBhlbziVFe2WCQFfE=";
+  vendorSha256 = "sha256-6rJa/c5uCnBQh0VVlzefXXPuJNFi+R8X2r+o7GBLIiE=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/beancount-language-server/default.nix b/pkgs/development/tools/beancount-language-server/default.nix
index 1766f22ee1809..b415906eead76 100644
--- a/pkgs/development/tools/beancount-language-server/default.nix
+++ b/pkgs/development/tools/beancount-language-server/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "beancount-language-server";
-  version = "1.1.1";
+  version = "1.2.5";
 
   src = fetchFromGitHub {
     owner = "polarmutex";
     repo = "beancount-language-server";
     rev = "v${version}";
-    sha256 = "sha256-CkwNxamkErRo3svJNth2F8NSqlJNX+1S/srKu6Z+mX4=";
+    sha256 = "sha256-AbljduMz4mz5InsHKCq0K6i9F/lBgvdy0+W8aclr0R0=";
   };
 
-  cargoSha256 = "sha256-NTUs9ADTn+KoE08FikRHrdptZkrUqnjVIlcr8RtDvic=";
+  cargoSha256 = "sha256-jrxVMGJk4o9aROtFZBc8G/HP5xm9MjVyewww1DzrRdM=";
 
   doInstallCheck = true;
   postInstallCheck = ''
diff --git a/pkgs/development/tools/buf/default.nix b/pkgs/development/tools/buf/default.nix
index 8fcc8bad2269e..c853e361bae97 100644
--- a/pkgs/development/tools/buf/default.nix
+++ b/pkgs/development/tools/buf/default.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "buf";
-  version = "1.5.0";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "bufbuild";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Jcj1tpcG64mSVn444isGsK9AcITh171ibECukv3bXDI=";
+    sha256 = "sha256-sqByTrhtaytBMD8ULOP+xoacxMD6sw3n2XYVZ1hWIJ4=";
   };
 
-  vendorSha256 = "sha256-aHGV8UfPn7xsySPXRSzsEpcaz1Ll49Mj1S9izvaIRWY=";
+  vendorSha256 = "sha256-H000xhqjSFXGW3Saa/ryYdVcDl2ieeSW3dq3DPVX+c0=";
 
   patches = [
     # Skip a test that requires networking to be available to work.
diff --git a/pkgs/development/tools/build-managers/bazel/bazel_4/default.nix b/pkgs/development/tools/build-managers/bazel/bazel_4/default.nix
index 56a4d5b3b5a0c..aa9794b5869c0 100644
--- a/pkgs/development/tools/build-managers/bazel/bazel_4/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_4/default.nix
@@ -257,7 +257,7 @@ stdenv.mkDerivation rec {
       runLocal = name: attrs: script:
       let
         attrs' = removeAttrs attrs [ "buildInputs" ];
-        buildInputs = [ python3 which ] ++ (attrs.buildInputs or []);
+        buildInputs = attrs.buildInputs or [];
       in
       runCommandCC name ({
         inherit buildInputs;
@@ -323,13 +323,13 @@ stdenv.mkDerivation rec {
 
     in (if !stdenv.hostPlatform.isDarwin then {
       # `extracted` doesn’t work on darwin
-      shebang = callPackage ../shebang-test.nix { inherit runLocal extracted bazelTest distDir; };
+      shebang = callPackage ../shebang-test.nix { inherit runLocal extracted bazelTest distDir; bazel = bazel_self; };
     } else {}) // {
-      bashTools = callPackage ../bash-tools-test.nix { inherit runLocal bazelTest distDir; };
-      cpp = callPackage ../cpp-test.nix { inherit runLocal bazelTest bazel-examples distDir; };
-      java = callPackage ../java-test.nix { inherit runLocal bazelTest bazel-examples distDir; };
-      protobuf = callPackage ../protobuf-test.nix { inherit runLocal bazelTest distDir; };
-      pythonBinPath = callPackage ../python-bin-path-test.nix { inherit runLocal bazelTest distDir; };
+      bashTools = callPackage ../bash-tools-test.nix { inherit runLocal bazelTest distDir; bazel = bazel_self; };
+      cpp = callPackage ../cpp-test.nix { inherit runLocal bazelTest bazel-examples distDir; bazel = bazel_self; };
+      java = callPackage ../java-test.nix { inherit runLocal bazelTest bazel-examples distDir; bazel = bazel_self; };
+      protobuf = callPackage ../protobuf-test.nix { inherit runLocal bazelTest distDir; bazel = bazel_self; };
+      pythonBinPath = callPackage ../python-bin-path-test.nix { inherit runLocal bazelTest distDir; bazel = bazel_self; };
 
       bashToolsWithNixHacks = callPackage ../bash-tools-test.nix { inherit runLocal bazelTest distDir; bazel = bazelWithNixHacks; };
 
@@ -591,6 +591,7 @@ stdenv.mkDerivation rec {
     # The binary _must_ exist with this naming if your project contains a .bazelversion
     # file.
     cp ./bazel_src/scripts/packages/bazel.sh $out/bin/bazel
+    wrapProgram $out/bin/bazel $wrapperfile --suffix PATH : ${defaultShellPath}
     mv ./bazel_src/output/bazel $out/bin/bazel-${version}-${system}-${arch}
 
     mkdir $out/share
diff --git a/pkgs/development/tools/build-managers/bazel/bazel_5/default.nix b/pkgs/development/tools/build-managers/bazel/bazel_5/default.nix
index d0b71f3760c89..c9c435a0b34d7 100644
--- a/pkgs/development/tools/build-managers/bazel/bazel_5/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_5/default.nix
@@ -219,7 +219,7 @@ stdenv.mkDerivation rec {
       runLocal = name: attrs: script:
       let
         attrs' = removeAttrs attrs [ "buildInputs" ];
-        buildInputs = [ python3 which ] ++ (attrs.buildInputs or []);
+        buildInputs = attrs.buildInputs or [];
       in
       runCommandCC name ({
         inherit buildInputs;
@@ -285,13 +285,13 @@ stdenv.mkDerivation rec {
 
     in (if !stdenv.hostPlatform.isDarwin then {
       # `extracted` doesn’t work on darwin
-      shebang = callPackage ../shebang-test.nix { inherit runLocal extracted bazelTest distDir; };
+      shebang = callPackage ../shebang-test.nix { inherit runLocal extracted bazelTest distDir; bazel = bazel_self;};
     } else {}) // {
-      bashTools = callPackage ../bash-tools-test.nix { inherit runLocal bazelTest distDir; };
-      cpp = callPackage ../cpp-test.nix { inherit runLocal bazelTest bazel-examples distDir; };
-      java = callPackage ../java-test.nix { inherit runLocal bazelTest bazel-examples distDir; };
-      protobuf = callPackage ../protobuf-test.nix { inherit runLocal bazelTest distDir; };
-      pythonBinPath = callPackage ../python-bin-path-test.nix { inherit runLocal bazelTest distDir; };
+      bashTools = callPackage ../bash-tools-test.nix { inherit runLocal bazelTest distDir; bazel = bazel_self;};
+      cpp = callPackage ../cpp-test.nix { inherit runLocal bazelTest bazel-examples distDir; bazel = bazel_self;};
+      java = callPackage ../java-test.nix { inherit runLocal bazelTest bazel-examples distDir; bazel = bazel_self;};
+      protobuf = callPackage ../protobuf-test.nix { inherit runLocal bazelTest distDir; bazel = bazel_self; };
+      pythonBinPath = callPackage ../python-bin-path-test.nix { inherit runLocal bazelTest distDir; bazel = bazel_self;};
 
       bashToolsWithNixHacks = callPackage ../bash-tools-test.nix { inherit runLocal bazelTest distDir; bazel = bazelWithNixHacks; };
 
@@ -586,6 +586,7 @@ stdenv.mkDerivation rec {
     # The binary _must_ exist with this naming if your project contains a .bazelversion
     # file.
     cp ./bazel_src/scripts/packages/bazel.sh $out/bin/bazel
+    wrapProgram $out/bin/bazel $wrapperfile --suffix PATH : ${defaultShellPath}
     mv ./bazel_src/output/bazel $out/bin/bazel-${version}-${system}-${arch}
 
     mkdir $out/share
@@ -662,4 +663,3 @@ stdenv.mkDerivation rec {
   dontStrip = true;
   dontPatchELF = true;
 }
-
diff --git a/pkgs/development/tools/check/default.nix b/pkgs/development/tools/check/default.nix
index a28124828f90b..f74578e25a0d3 100644
--- a/pkgs/development/tools/check/default.nix
+++ b/pkgs/development/tools/check/default.nix
@@ -1,30 +1,26 @@
-{ buildGoPackage
-, lib
+{ lib
+, buildGoModule
 , fetchFromGitLab
 }:
 
-buildGoPackage rec {
-  pname = "check-unstable";
-  version = "2018-09-12";
-  rev = "88db195993f8e991ad402754accd0635490769f9";
-
-  goPackagePath = "gitlab.com/opennota/check";
+buildGoModule rec {
+  pname = "check";
+  version = "unstable-2018-12-24";
+  rev = "ccaba434e62accd51209476ad093810bd27ec150";
 
   src = fetchFromGitLab {
-    inherit rev;
-
     owner = "opennota";
     repo = "check";
-    sha256 = "1983xmdkgpqda4qz8ashc6xv1zg5jl4zly3w566grxc5sfxpgf0i";
+    inherit rev;
+    sha256 = "sha256-u8U/62LZEn1ffwdGsUCGam4HAk7b2LetomCLZzHuuas=";
   };
 
-  goDeps = ./deps.nix;
+  vendorSha256 = "sha256-DyysiVYFpncmyCzlHIOEtWlCMpm90AC3gdItI9WinSo=";
 
   meta = with lib; {
     description = "A set of utilities for checking Go sources";
     homepage = "https://gitlab.com/opennota/check";
     license = licenses.gpl3;
     maintainers = with maintainers; [ kalbasit ];
-    platforms = platforms.linux ++ platforms.darwin;
   };
 }
diff --git a/pkgs/development/tools/check/deps.nix b/pkgs/development/tools/check/deps.nix
deleted file mode 100644
index b9c50d95d117c..0000000000000
--- a/pkgs/development/tools/check/deps.nix
+++ /dev/null
@@ -1,11 +0,0 @@
-[
-  {
-    goPackagePath = "golang.org/x/tools";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/tools";
-      rev = "677d2ff680c1";
-      sha256 = "0vp1w1haqcjd82dxd6x9xrllbfwvm957rxwkpji96cgvhsli2bq5";
-    };
-  }
-]
diff --git a/pkgs/development/tools/clj-kondo/default.nix b/pkgs/development/tools/clj-kondo/default.nix
index 5ef65dde14d63..3fe90a3004c08 100644
--- a/pkgs/development/tools/clj-kondo/default.nix
+++ b/pkgs/development/tools/clj-kondo/default.nix
@@ -2,11 +2,11 @@
 
 buildGraalvmNativeImage rec {
   pname = "clj-kondo";
-  version = "2022.04.25";
+  version = "2022.06.22";
 
   src = fetchurl {
     url = "https://github.com/clj-kondo/${pname}/releases/download/v${version}/${pname}-${version}-standalone.jar";
-    sha256 = "sha256-BqqeJQ7mBMofX6efJCSUr6qMZXubO9CuDiCNNNKT3DA=";
+    sha256 = "sha256-g+0BYwk9bws+c7CfLGf88r2nfcDBCdDKyqRS285oIQM=";
   };
 
   extraNativeImageBuildArgs = [
diff --git a/pkgs/development/tools/cloud-nuke/default.nix b/pkgs/development/tools/cloud-nuke/default.nix
index 7f98d9ee3767e..3354b6f693711 100644
--- a/pkgs/development/tools/cloud-nuke/default.nix
+++ b/pkgs/development/tools/cloud-nuke/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "cloud-nuke";
-  version = "0.11.6";
+  version = "0.11.8";
 
   src = fetchFromGitHub {
     owner = "gruntwork-io";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-wsCe32Ui+czM0+qpMxgTahJ7FlcnFMkueEkrcwm1sdE=";
+    sha256 = "sha256-0GP7T/OspaJVATd0dYNVniDh0XAiL09dopNnOQrLpCs=";
   };
 
-  vendorSha256 = "sha256-McCbogZvgm9pnVjay9O2CxAh+653JnDMcU4CHD0PTPI=";
+  vendorSha256 = "sha256-4BUKUDr0bcd4AcMGIDC7HIhDI7pdTu2efkLqRD7Piw0=";
 
   ldflags = [ "-s" "-w" "-X main.VERSION=${version}" ];
 
diff --git a/pkgs/development/tools/continuous-integration/github-runner/default.nix b/pkgs/development/tools/continuous-integration/github-runner/default.nix
index c8208dc18e410..5b33c02809eb9 100644
--- a/pkgs/development/tools/continuous-integration/github-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/github-runner/default.nix
@@ -46,13 +46,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "github-runner";
-  version = "2.293.0";
+  version = "2.294.0";
 
   src = fetchFromGitHub {
     owner = "actions";
     repo = "runner";
     rev = "v${version}";
-    hash = "sha256-5XAlKCtIvHzaJCPVO0WsrUGKnYUNR+roqzJ+jrcBfVM=";
+    hash = "sha256-2MOvqVlUZBmCt24EYSVjXWKR+fB2Mys70L/1/7jtwQQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/continuous-integration/jenkins/default.nix b/pkgs/development/tools/continuous-integration/jenkins/default.nix
index abf7f840a4541..00395854cfd8d 100644
--- a/pkgs/development/tools/continuous-integration/jenkins/default.nix
+++ b/pkgs/development/tools/continuous-integration/jenkins/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "jenkins";
-  version = "2.332.3";
+  version = "2.346.1";
 
   src = fetchurl {
     url = "https://get.jenkins.io/war-stable/${version}/jenkins.war";
-    sha256 = "sha256-0ZPxearfOnzrYa3rw6tRIYrEp4UriJMv8ztE/XvmAQ8=";
+    sha256 = "09rvwpywf8wc3605kc0x171kmxfigqg4dq7gkd1hng1xqbjjqvhp";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/tools/continuous-integration/woodpecker/agent.nix b/pkgs/development/tools/continuous-integration/woodpecker/agent.nix
new file mode 100644
index 0000000000000..2865711d507c3
--- /dev/null
+++ b/pkgs/development/tools/continuous-integration/woodpecker/agent.nix
@@ -0,0 +1,17 @@
+{ lib, buildGoModule, callPackage, fetchFromGitHub }:
+let
+  common = callPackage ./common.nix { };
+in
+buildGoModule {
+  pname = "woodpecker-agent";
+  inherit (common) version src ldflags postBuild;
+  vendorSha256 = null;
+
+  subPackages = "cmd/agent";
+
+  CGO_ENABLED = 0;
+
+  meta = common.meta // {
+    description = "Woodpecker Continuous Integration agent";
+  };
+}
diff --git a/pkgs/development/tools/continuous-integration/woodpecker/cli.nix b/pkgs/development/tools/continuous-integration/woodpecker/cli.nix
new file mode 100644
index 0000000000000..b5eda9efb9173
--- /dev/null
+++ b/pkgs/development/tools/continuous-integration/woodpecker/cli.nix
@@ -0,0 +1,17 @@
+{ lib, buildGoModule, callPackage, fetchFromGitHub }:
+let
+  common = callPackage ./common.nix { };
+in
+buildGoModule {
+  pname = "woodpecker-cli";
+  inherit (common) version src ldflags postBuild;
+  vendorSha256 = null;
+
+  subPackages = "cmd/cli";
+
+  CGO_ENABLED = 0;
+
+  meta = common.meta // {
+    description = "Command line client for the Woodpecker Continuous Integration server";
+  };
+}
diff --git a/pkgs/development/tools/continuous-integration/woodpecker/common.nix b/pkgs/development/tools/continuous-integration/woodpecker/common.nix
new file mode 100644
index 0000000000000..932fa934b1bc7
--- /dev/null
+++ b/pkgs/development/tools/continuous-integration/woodpecker/common.nix
@@ -0,0 +1,36 @@
+{ lib, fetchFromGitHub }:
+let
+  version = "0.15.3";
+  srcSha256 = "sha256-HOOH3H2SXLcT2oW/xL80TO+ZSI+Haulnznpb4hlCQow=";
+  yarnSha256 = "sha256-x9g0vSoexfknqLejgcNIigmkFnqYsmhcQNTOStcj68o=";
+in
+{
+  inherit version yarnSha256;
+
+  src = fetchFromGitHub {
+    owner = "woodpecker-ci";
+    repo = "woodpecker";
+    rev = "v${version}";
+    sha256 = srcSha256;
+  };
+
+  postBuild = ''
+    cd $GOPATH/bin
+    for f in *; do
+      mv -- "$f" "woodpecker-$f"
+    done
+    cd -
+  '';
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/woodpecker-ci/woodpecker/version.Version=${version}"
+  ];
+
+  meta = with lib; {
+    homepage = "https://woodpecker-ci.org/";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ ambroisie ];
+  };
+}
diff --git a/pkgs/development/tools/continuous-integration/woodpecker/frontend.nix b/pkgs/development/tools/continuous-integration/woodpecker/frontend.nix
new file mode 100644
index 0000000000000..267fdc13985a9
--- /dev/null
+++ b/pkgs/development/tools/continuous-integration/woodpecker/frontend.nix
@@ -0,0 +1,40 @@
+{ lib, callPackage, fetchFromGitHub, fetchYarnDeps, mkYarnPackage }:
+let
+  common = callPackage ./common.nix { };
+in
+mkYarnPackage {
+  pname = "woodpecker-frontend";
+  inherit (common) version;
+
+  src = "${common.src}/web";
+
+  packageJSON = ./woodpecker-package.json;
+  offlineCache = fetchYarnDeps {
+    yarnLock = "${common.src}/web/yarn.lock";
+    sha256 = common.yarnSha256;
+  };
+
+  buildPhase = ''
+    runHook preBuild
+
+    yarn build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    cp -R deps/woodpecker-ci/dist $out
+    echo "${common.version}" > "$out/version"
+
+    runHook postInstall
+  '';
+
+  # Do not attempt generating a tarball for woodpecker-frontend again.
+  doDist = false;
+
+  meta = common.meta // {
+    description = "Woodpecker Continuous Integration server frontend";
+  };
+}
diff --git a/pkgs/development/tools/continuous-integration/woodpecker/server.nix b/pkgs/development/tools/continuous-integration/woodpecker/server.nix
new file mode 100644
index 0000000000000..d97412649b5db
--- /dev/null
+++ b/pkgs/development/tools/continuous-integration/woodpecker/server.nix
@@ -0,0 +1,27 @@
+{ lib, buildGoModule, callPackage, fetchFromGitHub, woodpecker-frontend }:
+let
+  common = callPackage ./common.nix { };
+in
+buildGoModule {
+  pname = "woodpecker-server";
+  inherit (common) version src ldflags postBuild;
+  vendorSha256 = null;
+
+  postPatch = ''
+    cp -r ${woodpecker-frontend} web/dist
+  '';
+
+  subPackages = "cmd/server";
+
+  CGO_ENABLED = 1;
+
+  passthru = {
+    inherit woodpecker-frontend;
+
+    updateScript = ./update.sh;
+  };
+
+  meta = common.meta // {
+    description = "Woodpecker Continuous Integration server";
+  };
+}
diff --git a/pkgs/development/tools/continuous-integration/woodpecker/update.sh b/pkgs/development/tools/continuous-integration/woodpecker/update.sh
new file mode 100755
index 0000000000000..3530ea6c46c6c
--- /dev/null
+++ b/pkgs/development/tools/continuous-integration/woodpecker/update.sh
@@ -0,0 +1,50 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nix wget prefetch-yarn-deps nix-prefetch-github jq
+
+# shellcheck shell=bash
+
+if [ -n "$GITHUB_TOKEN" ]; then
+    TOKEN_ARGS=(--header "Authorization: token $GITHUB_TOKEN")
+fi
+
+if [[ $# -gt 1 || $1 == -* ]]; then
+    echo "Regenerates packaging data for the woodpecker packages."
+    echo "Usage: $0 [git release tag]"
+    exit 1
+fi
+
+set -x
+
+cd "$(dirname "$0")"
+version="$1"
+
+set -euo pipefail
+
+if [ -z "$version" ]; then
+    version="$(wget -O- "${TOKEN_ARGS[@]}" "https://api.github.com/repos/woodpecker-ci/woodpecker/releases?per_page=1" | jq -r '.[0].tag_name')"
+fi
+
+# strip leading "v"
+version="${version#v}"
+
+# Woodpecker repository
+src_hash=$(nix-prefetch-github woodpecker-ci woodpecker --rev "v${version}" | jq -r .sha256)
+
+# Front-end dependencies
+woodpecker_src="https://raw.githubusercontent.com/woodpecker-ci/woodpecker/v$version"
+wget "${TOKEN_ARGS[@]}" "$woodpecker_src/web/package.json" -O woodpecker-package.json
+
+web_tmpdir=$(mktemp -d)
+trap 'rm -rf "$web_tmpdir"' EXIT
+pushd "$web_tmpdir"
+wget "${TOKEN_ARGS[@]}" "$woodpecker_src/web/yarn.lock"
+yarn_hash=$(prefetch-yarn-deps yarn.lock)
+popd
+
+# Use friendlier hashes
+src_hash=$(nix hash to-sri --type sha256 "$src_hash")
+yarn_hash=$(nix hash to-sri --type sha256 "$yarn_hash")
+
+sed -i -E -e "s#version = \".*\"#version = \"$version\"#" common.nix
+sed -i -E -e "s#srcSha256 = \".*\"#srcSha256 = \"$src_hash\"#" common.nix
+sed -i -E -e "s#yarnSha256 = \".*\"#yarnSha256 = \"$yarn_hash\"#" common.nix
diff --git a/pkgs/development/tools/continuous-integration/woodpecker/woodpecker-package.json b/pkgs/development/tools/continuous-integration/woodpecker/woodpecker-package.json
new file mode 100644
index 0000000000000..eb29431a0566c
--- /dev/null
+++ b/pkgs/development/tools/continuous-integration/woodpecker/woodpecker-package.json
@@ -0,0 +1,63 @@
+{
+  "name": "woodpecker-ci",
+  "author": "Woodpecker CI",
+  "version": "0.0.0",
+  "license": "Apache-2.0",
+  "engines": {
+    "node": ">=14"
+  },
+  "scripts": {
+    "start": "vite",
+    "build": "vite build",
+    "serve": "vite preview",
+    "lint": "eslint --max-warnings 0 --ext .js,.ts,.vue,.json .",
+    "formatcheck": "prettier -c .",
+    "format:fix": "prettier --write .",
+    "typecheck": "vue-tsc --noEmit",
+    "test": "echo 'No tests configured' && exit 0"
+  },
+  "dependencies": {
+    "@kyvg/vue3-notification": "2.3.4",
+    "@meforma/vue-toaster": "1.2.2",
+    "ansi-to-html": "0.7.2",
+    "dayjs": "1.10.7",
+    "floating-vue": "2.0.0-beta.5",
+    "fuse.js": "6.4.6",
+    "humanize-duration": "3.27.0",
+    "javascript-time-ago": "2.3.10",
+    "node-emoji": "1.11.0",
+    "pinia": "2.0.0",
+    "vue": "v3.2.20",
+    "vue-router": "4.0.10"
+  },
+  "devDependencies": {
+    "@iconify/json": "1.1.421",
+    "@types/humanize-duration": "3.27.0",
+    "@types/javascript-time-ago": "2.0.3",
+    "@types/node": "16.11.6",
+    "@types/node-emoji": "1.8.1",
+    "@typescript-eslint/eslint-plugin": "5.6.0",
+    "@typescript-eslint/parser": "5.6.0",
+    "@vitejs/plugin-vue": "1.9.4",
+    "@vue/compiler-sfc": "3.2.20",
+    "eslint": "7.32.0",
+    "eslint-config-airbnb-base": "15.0.0",
+    "eslint-config-airbnb-typescript": "16.1.0",
+    "eslint-config-prettier": "8.3.0",
+    "eslint-plugin-import": "2.25.3",
+    "eslint-plugin-prettier": "4.0.0",
+    "eslint-plugin-promise": "5.1.1",
+    "eslint-plugin-simple-import-sort": "7.0.0",
+    "eslint-plugin-vue": "7.18.0",
+    "eslint-plugin-vue-scoped-css": "1.3.0",
+    "prettier": "2.4.1",
+    "typescript": "4.4.4",
+    "unplugin-icons": "0.12.17",
+    "unplugin-vue-components": "0.17.0",
+    "vite": "2.6.13",
+    "vite-plugin-windicss": "1.4.12",
+    "vite-svg-loader": "3.0.0",
+    "vue-tsc": "0.28.10",
+    "windicss": "3.2.0"
+  }
+}
diff --git a/pkgs/development/tools/dapper/default.nix b/pkgs/development/tools/dapper/default.nix
index 45e4614b448af..8e3160b4cddcf 100644
--- a/pkgs/development/tools/dapper/default.nix
+++ b/pkgs/development/tools/dapper/default.nix
@@ -1,30 +1,29 @@
-{ buildGoPackage
-, lib
+{ lib
+, buildGoModule
 , fetchFromGitHub
 }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "dapper";
   version = "0.5.8";
 
-  goPackagePath = "github.com/rancher/dapper";
-
   src = fetchFromGitHub {
     owner = "rancher";
     repo = "dapper";
     rev = "v${version}";
     sha256 = "sha256-t1w8bhwCjZHmvgBG6Tv8kgqTbC7v5P5QOvJGuTJUC04=";
   };
-   patchPhase = ''
-     substituteInPlace main.go --replace 0.0.0 ${version}
-   '';
+  vendorSha256 = null;
+
+  patchPhase = ''
+    substituteInPlace main.go --replace 0.0.0 ${version}
+  '';
 
   meta = with lib; {
-    description = "Docker Build Wrapper";
+    description = "Docker build wrapper";
     homepage = "https://github.com/rancher/dapper";
     license = licenses.asl20;
     platforms = platforms.linux;
     maintainers = with maintainers; [ kuznero ];
   };
 }
-
diff --git a/pkgs/development/tools/doctl/default.nix b/pkgs/development/tools/doctl/default.nix
index fb602240bb328..926b1c75ee36b 100644
--- a/pkgs/development/tools/doctl/default.nix
+++ b/pkgs/development/tools/doctl/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "doctl";
-  version = "1.76.0";
+  version = "1.77.0";
 
   vendorSha256 = null;
 
@@ -31,7 +31,7 @@ buildGoModule rec {
     owner = "digitalocean";
     repo = "doctl";
     rev = "v${version}";
-    sha256 = "sha256-rascG0WXDsmParwzR8QZEayiQEARu8YXfU0JT2yhQrc=";
+    sha256 = "sha256-i+Z5xFO3e04c/CfOyPAjD1nwPvm5vmYLsvj6OblJuqg=";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/tools/ineffassign/default.nix b/pkgs/development/tools/ineffassign/default.nix
index 111048b562f39..16e392b6bbc49 100644
--- a/pkgs/development/tools/ineffassign/default.nix
+++ b/pkgs/development/tools/ineffassign/default.nix
@@ -1,28 +1,31 @@
-{ buildGoPackage
-, lib
+{ lib
+, buildGoModule
 , fetchFromGitHub
+, go
 }:
 
-buildGoPackage rec {
-  pname = "ineffassign-unstable";
-  version = "2018-09-09";
-  rev = "1003c8bd00dc2869cb5ca5282e6ce33834fed514";
-
-  goPackagePath = "github.com/gordonklaus/ineffassign";
+buildGoModule rec {
+  pname = "ineffassign";
+  version = "unstable-2021-09-04";
+  rev = "4cc7213b9bc8b868b2990c372f6fa057fa88b91c";
 
   src = fetchFromGitHub {
-    inherit rev;
-
     owner = "gordonklaus";
     repo = "ineffassign";
-    sha256 = "1rkzqvd3z03vq8q8qi9cghvgggsf02ammj9wq8jvpnx6b2sd16nd";
+    inherit rev;
+    sha256 = "sha256-XLXANN9TOmrNOixWtlqnIC27u+0TW2P3s9MyeyVUcAQ=";
   };
 
+  vendorSha256 = "sha256-QTgWicN2m2ughtLsEBMaQWfpDbmbL0nS5qaIKF3mTJM=";
+
+  allowGoReference = true;
+
+  checkInputs = [ go ];
+
   meta = with lib; {
     description = "Detect ineffectual assignments in Go code";
     homepage = "https://github.com/gordonklaus/ineffassign";
     license = licenses.mit;
     maintainers = with maintainers; [ kalbasit ];
-    platforms = platforms.linux ++ platforms.darwin;
   };
 }
diff --git a/pkgs/development/tools/jless/default.nix b/pkgs/development/tools/jless/default.nix
index 558c9e019e192..306a271936bfd 100644
--- a/pkgs/development/tools/jless/default.nix
+++ b/pkgs/development/tools/jless/default.nix
@@ -23,6 +23,6 @@ rustPlatform.buildRustPackage rec {
     description = "A command-line pager for JSON data";
     homepage = "https://jless.io";
     license = licenses.mit;
-    maintainers = with maintainers; [ jfchevrette zowoq ];
+    maintainers = with maintainers; [ jfchevrette ];
   };
 }
diff --git a/pkgs/development/tools/lc3tools/0004-configure-use-cc.patch b/pkgs/development/tools/lc3tools/0004-configure-use-cc.patch
new file mode 100644
index 0000000000000..caaec22000083
--- /dev/null
+++ b/pkgs/development/tools/lc3tools/0004-configure-use-cc.patch
@@ -0,0 +1,22 @@
+diff --git a/configure b/configure
+index dfc1b3e..55577af 100755
+--- a/configure
++++ b/configure
+@@ -18,7 +18,7 @@ esac
+ # Some binaries that we'll need, and the places that we might find them.
+ 
+ IFS=:
+-binlist="uname:flex:gcc:wish:rm:cp:mkdir:chmod:sed"
++binlist="uname:flex:cc:wish:rm:cp:mkdir:chmod:sed"
+ pathlist=$PATH
+ libpathlist=$LIBS
+ incpathlist=$INCLUDES
+@@ -109,7 +109,7 @@ fi
+ # Splice it all in to Makefile.def to create the Makefile.
+ 
+ rm -f Makefile
+-sed -e "s __GCC__ $gcc g" -e "s __FLEX__ $flex g" -e "s __EXE__ $EXE g"     \
++sed -e "s __GCC__ $cc g" -e "s __FLEX__ $flex g" -e "s __EXE__ $EXE g"     \
+     -e "s*__OS_SIM_LIBS__*$OS_SIM_LIBS*g" -e "s __RM__ $rm g"               \
+     -e "s __CP__ $cp g" -e "s __MKDIR__ $mkdir g" -e "s __CHMOD__ $chmod g" \
+     -e "s __USE_READLINE__ $USE_READLINE g" -e "s*__RLLPATH__*$RLLPATH*g"   \
diff --git a/pkgs/development/tools/lc3tools/default.nix b/pkgs/development/tools/lc3tools/default.nix
index 3e7f81bb4e7bc..c6120a227a993 100644
--- a/pkgs/development/tools/lc3tools/default.nix
+++ b/pkgs/development/tools/lc3tools/default.nix
@@ -19,6 +19,9 @@ stdenv.mkDerivation {
 
     # lc3sim-tk looks for lc3sim in $out/bin instead of $out
     ./0003-lc3sim-tk-path.patch
+
+    # use `cc` instead of `gcc`; on macOS the latter is not present
+    ./0004-configure-use-cc.patch
   ];
 
   nativeBuildInputs = [ unzip ];
@@ -40,8 +43,15 @@ stdenv.mkDerivation {
   '';
 
   meta = with lib; {
+    longDescription = ''
+      The LC-3 tools package contains the lc3as assembler, the lc3sim simulator,
+      and lc3sim-tk, a Tcl/Tk-based GUI frontend to the simulator.
+    '';
     description = "Toolchain and emulator for the LC-3 architecture";
+    homepage = "https://highered.mheducation.com/sites/0072467509/student_view0/lc-3_simulator.html";
     license = licenses.gpl2;
     maintainers = with maintainers; [ anna328p ];
+    mainProgram = "lc3sim-tk";
+    platforms = with lib.platforms; unix ++ windows;
   };
 }
diff --git a/pkgs/development/tools/maligned/default.nix b/pkgs/development/tools/maligned/default.nix
index 06cd23e40f4b3..f39b83489f990 100644
--- a/pkgs/development/tools/maligned/default.nix
+++ b/pkgs/development/tools/maligned/default.nix
@@ -1,30 +1,31 @@
-{ buildGoPackage
-, lib
+{ lib
+, buildGoModule
 , fetchFromGitHub
+, go
 }:
 
-buildGoPackage rec {
-  pname = "maligned-unstable";
-  version = "2018-07-07";
-  rev = "6e39bd26a8c8b58c5a22129593044655a9e25959";
-
-  goPackagePath = "github.com/mdempsky/maligned";
+buildGoModule rec {
+  pname = "maligned";
+  version = "unstable-2022-02-04";
+  rev = "d7cd9a96ae47d02b08234503b54709ad4ae82105";
 
   src = fetchFromGitHub {
-    inherit rev;
-
     owner = "mdempsky";
     repo = "maligned";
-    sha256 = "08inr5xjqv9flrlyhqd8ck1q26y5xb6iilz0xkb6bqa4dl5ialhi";
+    inherit rev;
+    sha256 = "sha256-exljmDNtVhjJkvh0EomcbBXSsmQx4I59MHDfMWSQyKk=";
   };
 
-  goDeps = ./deps.nix;
+  vendorSha256 = "sha256-q/0lxZWk3a7brMsbLvZUSZ8XUHfWfx79qxjir1Vygx4=";
+
+  allowGoReference = true;
+
+  checkInputs = [ go ];
 
   meta = with lib; {
     description = "Tool to detect Go structs that would take less memory if their fields were sorted";
     homepage = "https://github.com/mdempsky/maligned";
     license = licenses.bsd3;
     maintainers = with maintainers; [ kalbasit ];
-    platforms = platforms.linux ++ platforms.darwin;
   };
 }
diff --git a/pkgs/development/tools/maligned/deps.nix b/pkgs/development/tools/maligned/deps.nix
deleted file mode 100644
index afe5e50e47bdd..0000000000000
--- a/pkgs/development/tools/maligned/deps.nix
+++ /dev/null
@@ -1,20 +0,0 @@
-[
-  {
-    goPackagePath = "github.com/kisielk/gotool";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kisielk/gotool";
-      rev = "80517062f582ea3340cd4baf70e86d539ae7d84d";
-      sha256 = "14af2pa0ssyp8bp2mvdw184s5wcysk6akil3wzxmr05wwy951iwn";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/tools";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/tools";
-      rev = "96e9e165b75e735822645eff82850b08c377be36";
-      sha256 = "1zj9ck5sg9b0pphxybmvxf64hhcap7v7j37fx3v5aknf18crjjdg";
-    };
-  }
-]
diff --git a/pkgs/development/tools/misc/checkbashisms/default.nix b/pkgs/development/tools/misc/checkbashisms/default.nix
index 6222bb312bb08..b648a082fa3f6 100644
--- a/pkgs/development/tools/misc/checkbashisms/default.nix
+++ b/pkgs/development/tools/misc/checkbashisms/default.nix
@@ -1,11 +1,11 @@
 { lib, stdenv, fetchurl, perl, installShellFiles }:
 stdenv.mkDerivation rec {
-  version = "2.21.1";
+  version = "2.22.1";
   pname = "checkbashisms";
 
   src = fetchurl {
     url = "mirror://debian/pool/main/d/devscripts/devscripts_${version}.tar.xz";
-    hash = "sha256-1ZbIiUrFd38uMVLy7YayLLm5RrmcovsA++JTb8PbTFI=";
+    hash = "sha256-Nd1eYCnSe+NblujG44uKpvunkaITcdrC3g+M3uX+M9U=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/development/tools/misc/grpc-client-cli/default.nix b/pkgs/development/tools/misc/grpc-client-cli/default.nix
new file mode 100644
index 0000000000000..59beb7acd8bb4
--- /dev/null
+++ b/pkgs/development/tools/misc/grpc-client-cli/default.nix
@@ -0,0 +1,22 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "grpc-client-cli";
+  version = "1.12.0";
+
+  src = fetchFromGitHub {
+    owner = "vadimi";
+    repo = "grpc-client-cli";
+    rev = "v${version}";
+    sha256 = "sha256-hsx+nmkYLkSsrUEDAf5556qNLeZ3w5txFBUpDv+b3a4=";
+  };
+
+  vendorSha256 = "sha256-1WcnEl3odjxyXfSNyzPU3fa5yrF4MaEgfCAsbr3xedA=";
+
+  meta = with lib; {
+    description = "generic gRPC command line client";
+    maintainers = with maintainers; [ Philipp-M ];
+    homepage = "https://github.com/vadimi/grpc-client-cli";
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/development/tools/misc/hound/default.nix b/pkgs/development/tools/misc/hound/default.nix
index 4a2b4ac603603..7e46fadf362e0 100644
--- a/pkgs/development/tools/misc/hound/default.nix
+++ b/pkgs/development/tools/misc/hound/default.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "hound";
-  version = "0.5.0";
+  version = "0.5.1";
 
   src = fetchFromGitHub {
     owner = "hound-search";
     repo = "hound";
     rev = "v${version}";
-    sha256 = "sha256-FNK6SgISGqx+O7Vgp+KOqQyPhqzERDjeo6mQIX1SXnA=";
+    sha256 = "sha256-1URhb+ZrtP5eGS2o7lBxvAxQJR/J6oE+pCbJ7sQb0X4=";
   };
 
   vendorSha256 = "sha256-ZgF/PB3VTPx367JUkhOkSEK1uvqENNG0xuNXvCGENnQ=";
diff --git a/pkgs/development/tools/misc/terraform-ls/default.nix b/pkgs/development/tools/misc/terraform-ls/default.nix
index e85e014368afd..3e218523ed34b 100644
--- a/pkgs/development/tools/misc/terraform-ls/default.nix
+++ b/pkgs/development/tools/misc/terraform-ls/default.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "terraform-ls";
-  version = "0.26.0";
+  version = "0.28.1";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Xq9HojFjUrdThXvQ4M8o4LLmxopVErnN3WGUgI79BCw=";
+    sha256 = "sha256-6K4aOp5mjX+qhG/OS/Gs1kAOpDGUPdgRNx4zp3i/c2A=";
   };
-  vendorSha256 = "sha256-iSgK+FOD9olVN4bR2jmtWndaRHrh9pfo/42COTiIh9c=";
+  vendorSha256 = "sha256-YouAdTo7huco35er84MRfI1gmq11VbFwRGSovs1XDYo=";
 
   ldflags = [ "-s" "-w" "-X main.version=v${version}" "-X main.prerelease=" ];
 
diff --git a/pkgs/development/tools/okteto/default.nix b/pkgs/development/tools/okteto/default.nix
index 435ccd5a79fd3..ec4974876cb59 100644
--- a/pkgs/development/tools/okteto/default.nix
+++ b/pkgs/development/tools/okteto/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "okteto";
-  version = "2.3.3";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "okteto";
     repo = "okteto";
     rev = version;
-    sha256 = "sha256-rKhXzmBV59bj/Dj2ORU1ggOohAs56iB15es924pHXp4=";
+    sha256 = "sha256-+shhY7/chtq4xPwYSlcVgL/RGMNA0ahTCqT9pVQqpG4=";
   };
 
-  vendorSha256 = "sha256-XT/ZLydN1oeuRupD3gjvY6+hOB/Lq5CQwhfr9/iT7JI=";
+  vendorSha256 = "sha256-W1/QBMnMdZWokWSFmHhPqmOu827bpGXS8+GFp5Iu9Ig=";
 
   postPatch = ''
     # Disable some tests that need file system & network access.
diff --git a/pkgs/development/tools/packer/default.nix b/pkgs/development/tools/packer/default.nix
index 0d901f14863e6..8ae769429cccd 100644
--- a/pkgs/development/tools/packer/default.nix
+++ b/pkgs/development/tools/packer/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "packer";
-  version = "1.8.1";
+  version = "1.8.2";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = "packer";
     rev = "v${version}";
-    sha256 = "sha256-NqXmeBQrDnCGruJTZjAryxCmEdm1CZMPhW6JhZB0log=";
+    sha256 = "sha256-SaQGUVXtAI/FdqRZc4AjDkeEl9lE5i/wKsHKNGLpx8Y=";
   };
 
-  vendorSha256 = "sha256-Wit5DWTjVrxLLWpfOo/6JrSxqeZvC4Vjv+cW19wNHyw=";
+  vendorSha256 = "sha256-0GE5chSTonJFT7xomfa9a9QsnFpTFX7proo9joaDrOU=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/development/tools/pip-audit/default.nix b/pkgs/development/tools/pip-audit/default.nix
index 3f3d47cb75d38..09c954b199b64 100644
--- a/pkgs/development/tools/pip-audit/default.nix
+++ b/pkgs/development/tools/pip-audit/default.nix
@@ -25,14 +25,14 @@ with py.pkgs;
 
 buildPythonApplication rec {
   pname = "pip-audit";
-  version = "2.3.3";
+  version = "2.3.4";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "trailofbits";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-pzcphJWRM1OTbytZ4jJyPSQ+961gmBTrfYuLrMGkBQk=";
+    hash = "sha256-11lcF+ITvZmB5UKgGWJdXJE45Kh5rD98UOg9a648dKc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/package-management/cargo-about/default.nix b/pkgs/development/tools/rust/cargo-about/default.nix
index 8b98858e823b9..8b98858e823b9 100644
--- a/pkgs/tools/package-management/cargo-about/default.nix
+++ b/pkgs/development/tools/rust/cargo-about/default.nix
diff --git a/pkgs/tools/package-management/cargo-about/zstd-pkg-config.patch b/pkgs/development/tools/rust/cargo-about/zstd-pkg-config.patch
index e084538ca924c..e084538ca924c 100644
--- a/pkgs/tools/package-management/cargo-about/zstd-pkg-config.patch
+++ b/pkgs/development/tools/rust/cargo-about/zstd-pkg-config.patch
diff --git a/pkgs/tools/package-management/cargo-audit/default.nix b/pkgs/development/tools/rust/cargo-audit/default.nix
index 982a000caa74d..982a000caa74d 100644
--- a/pkgs/tools/package-management/cargo-audit/default.nix
+++ b/pkgs/development/tools/rust/cargo-audit/default.nix
diff --git a/pkgs/development/tools/rust/cargo-bloat/default.nix b/pkgs/development/tools/rust/cargo-bloat/default.nix
index 44e06696ae84c..0742b6b904fbc 100644
--- a/pkgs/development/tools/rust/cargo-bloat/default.nix
+++ b/pkgs/development/tools/rust/cargo-bloat/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-bloat";
-  version = "0.11.0";
+  version = "0.11.1";
 
   src = fetchFromGitHub {
     owner = "RazrFalcon";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-UzMo+IqoP3GpGu7tWlrkEU1YpVLgEL7UwIU1hPmoJNg=";
+    sha256 = "sha256-lCA7C1G2xu65jn3/wzj6prWSrjQz3EqqJyMlPR/HRFs=";
   };
 
-  cargoSha256 = "sha256-w3+ypGuVRGwC94zj/OaDUUoUbBnepGHvqulY4IVIsfo=";
+  cargoSha256 = "sha256-fOenXn5gagFss9DRDXXsGxQlDqVXZ5LZcdM4WsXAyUU=";
 
   meta = with lib; {
     description = "A tool and Cargo subcommand that helps you find out what takes most of the space in your executable";
diff --git a/pkgs/development/tools/rust/cargo-crev/default.nix b/pkgs/development/tools/rust/cargo-crev/default.nix
index 90ea165827137..0caa77e2bfd8b 100644
--- a/pkgs/development/tools/rust/cargo-crev/default.nix
+++ b/pkgs/development/tools/rust/cargo-crev/default.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-crev";
-  version = "0.23.1";
+  version = "0.23.2";
 
   src = fetchFromGitHub {
     owner = "crev-dev";
     repo = "cargo-crev";
     rev = "v${version}";
-    sha256 = "sha256-XzjZEVyPVn+7VrjG4QsqVBFmuGC1TWTWLEoqFcwQhaI=";
+    sha256 = "sha256-q/GbEsGQip7+wXxbVFfm9l3tdCT2o4yhWVTY1qmnEic=";
   };
 
-  cargoSha256 = "sha256-p87ZnOxaF9ytSUxp0P3QE3K1/jo7hz/N7BH1f2Lc0I0=";
+  cargoSha256 = "sha256-pqOVKLh+ovUy+rJIz0tjp56qhilZTno4t4dZyCY1r7c=";
 
   preCheck = ''
     export HOME=$(mktemp -d)
diff --git a/pkgs/tools/package-management/cargo-deb/default.nix b/pkgs/development/tools/rust/cargo-deb/default.nix
index 2eb2ddd2d9843..2eb2ddd2d9843 100644
--- a/pkgs/tools/package-management/cargo-deb/default.nix
+++ b/pkgs/development/tools/rust/cargo-deb/default.nix
diff --git a/pkgs/development/tools/rust/cargo-depgraph/default.nix b/pkgs/development/tools/rust/cargo-depgraph/default.nix
index 3ec0c110a69d8..5d2d1206007e1 100644
--- a/pkgs/development/tools/rust/cargo-depgraph/default.nix
+++ b/pkgs/development/tools/rust/cargo-depgraph/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-depgraph";
-  version = "1.2.4";
+  version = "1.2.5";
 
   src = fetchFromSourcehut {
     owner = "~jplatte";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-EbAV2VM73K0KiEKcy9kkK1TQHFQ1jRmKG3Tn9GAsWIk=";
+    sha256 = "sha256-ewlrxxHnsXBWSMPAlxTfrHj23jMiThkDSJhEsChO/sM=";
   };
 
-  cargoSha256 = "sha256-AAZlAYhl62c8nFvFtwwGniGbQqXu2vHTO4++O1VJ4LM=";
+  cargoSha256 = "sha256-Ce13vJ5zE63hHVkg/WFdz3LrASj7Xw6nqOO64uALOeQ=";
 
   meta = with lib; {
     description = "Create dependency graphs for cargo projects using `cargo metadata` and graphviz";
diff --git a/pkgs/tools/package-management/cargo-deps/default.nix b/pkgs/development/tools/rust/cargo-deps/default.nix
index b98a0d75793f3..b98a0d75793f3 100644
--- a/pkgs/tools/package-management/cargo-deps/default.nix
+++ b/pkgs/development/tools/rust/cargo-deps/default.nix
diff --git a/pkgs/tools/package-management/cargo-download/Cargo.nix b/pkgs/development/tools/rust/cargo-download/Cargo.nix
index f96a3a207df01..f96a3a207df01 100644
--- a/pkgs/tools/package-management/cargo-download/Cargo.nix
+++ b/pkgs/development/tools/rust/cargo-download/Cargo.nix
diff --git a/pkgs/tools/package-management/cargo-download/crates-io.nix b/pkgs/development/tools/rust/cargo-download/crates-io.nix
index dde192585e08a..dde192585e08a 100644
--- a/pkgs/tools/package-management/cargo-download/crates-io.nix
+++ b/pkgs/development/tools/rust/cargo-download/crates-io.nix
diff --git a/pkgs/tools/package-management/cargo-download/default.nix b/pkgs/development/tools/rust/cargo-download/default.nix
index 1cb53a4b6c8d8..1cb53a4b6c8d8 100644
--- a/pkgs/tools/package-management/cargo-download/default.nix
+++ b/pkgs/development/tools/rust/cargo-download/default.nix
diff --git a/pkgs/tools/package-management/cargo-edit/default.nix b/pkgs/development/tools/rust/cargo-edit/default.nix
index 53f7d581b346c..53f7d581b346c 100644
--- a/pkgs/tools/package-management/cargo-edit/default.nix
+++ b/pkgs/development/tools/rust/cargo-edit/default.nix
diff --git a/pkgs/development/tools/rust/cargo-expand/default.nix b/pkgs/development/tools/rust/cargo-expand/default.nix
index d448b9a88f863..ebca19b3cbb34 100644
--- a/pkgs/development/tools/rust/cargo-expand/default.nix
+++ b/pkgs/development/tools/rust/cargo-expand/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-expand";
-  version = "1.0.21";
+  version = "1.0.27";
 
   src = fetchFromGitHub {
     owner = "dtolnay";
     repo = pname;
     rev = version;
-    sha256 = "sha256-hxG7e5JBDv79eA7IQEdU8kpvE0B69Gqc+aPdCoc6Uf4=";
+    sha256 = "sha256-lj6B+9AdKhHc71cyzp7TcHmHv3K2ZoXEzMn/d3H0bB4=";
   };
 
-  cargoSha256 = "sha256-7CMNJb/HGHPP4CIBEYK+2HC/JAce25qGI86NkSvyxos=";
+  cargoSha256 = "sha256-j14l3E+vyeyEMYN+TEsuxlEdWa2Em0B6Y2LoTot2Np8=";
 
   buildInputs = lib.optional stdenv.isDarwin libiconv;
 
diff --git a/pkgs/development/tools/cargo-flamegraph/default.nix b/pkgs/development/tools/rust/cargo-flamegraph/default.nix
index e3bbb29164f13..e3bbb29164f13 100644
--- a/pkgs/development/tools/cargo-flamegraph/default.nix
+++ b/pkgs/development/tools/rust/cargo-flamegraph/default.nix
diff --git a/pkgs/tools/package-management/cargo-graph/default.nix b/pkgs/development/tools/rust/cargo-graph/default.nix
index 37fd43a1bcf1d..37fd43a1bcf1d 100644
--- a/pkgs/tools/package-management/cargo-graph/default.nix
+++ b/pkgs/development/tools/rust/cargo-graph/default.nix
diff --git a/pkgs/development/tools/rust/cargo-insta/default.nix b/pkgs/development/tools/rust/cargo-insta/default.nix
index aa70a576d37c2..99a19d12405fe 100644
--- a/pkgs/development/tools/rust/cargo-insta/default.nix
+++ b/pkgs/development/tools/rust/cargo-insta/default.nix
@@ -2,17 +2,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-insta";
-  version = "1.14.0";
+  version = "1.15.0";
 
   src = fetchFromGitHub {
     owner = "mitsuhiko";
     repo = "insta";
     rev = version;
-    sha256 = "sha256-kTICdLL3paJIj779w4i7QUzhdynzyjo+YjtBorJsms4=";
+    sha256 = "sha256-IwtAd8qhG7FgnC7esipwAbSssVKIirB6GCedgNRPabo=";
   };
 
   sourceRoot = "source/cargo-insta";
-  cargoSha256 = "sha256-Hfjz3arOvRbMIvV3o60zjRB2p4JbBUFPj66OpHZdIJg=";
+  cargoSha256 = "sha256-asWf+wIOpbZx9YOw5c4prg2D6FSRCTcc5FgWY93MNII=";
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv ];
 
   meta = with lib; {
diff --git a/pkgs/tools/package-management/cargo-kcov/default.nix b/pkgs/development/tools/rust/cargo-kcov/default.nix
index f94c4fa5c0f00..f94c4fa5c0f00 100644
--- a/pkgs/tools/package-management/cargo-kcov/default.nix
+++ b/pkgs/development/tools/rust/cargo-kcov/default.nix
diff --git a/pkgs/tools/package-management/cargo-license/default.nix b/pkgs/development/tools/rust/cargo-license/default.nix
index 6202e297b9a9e..6202e297b9a9e 100644
--- a/pkgs/tools/package-management/cargo-license/default.nix
+++ b/pkgs/development/tools/rust/cargo-license/default.nix
diff --git a/pkgs/development/tools/rust/cargo-llvm-lines/default.nix b/pkgs/development/tools/rust/cargo-llvm-lines/default.nix
index e523fb44bb99a..417cdd6761838 100644
--- a/pkgs/development/tools/rust/cargo-llvm-lines/default.nix
+++ b/pkgs/development/tools/rust/cargo-llvm-lines/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-llvm-lines";
-  version = "0.4.15";
+  version = "0.4.16";
 
   src = fetchFromGitHub {
     owner = "dtolnay";
     repo = pname;
     rev = version;
-    sha256 = "sha256-pP1kMwxIrL2ADvj4AkbhqKH5vzGyQnfL7hjg3/QYIY8=";
+    sha256 = "sha256-MDRVNCfyObEaN0eNnaDBQCYQV2Y1Ck5/8zdpG4eZbaE=";
   };
 
-  cargoSha256 = "sha256-V9mD9NAG7bB8uB/pjl0XGXmJqOUm4ZrFJV7nv569XOM=";
+  cargoSha256 = "sha256-oOUidCM3Xex8bqBVJmrigHZHMdjXBNDdKaPiA/+MR7s=";
 
   meta = with lib; {
     description = "Count the number of lines of LLVM IR across all instantiations of a generic function";
diff --git a/pkgs/development/tools/rust/cargo-make/default.nix b/pkgs/development/tools/rust/cargo-make/default.nix
index d099bf5f8765b..59ea51406ce0b 100644
--- a/pkgs/development/tools/rust/cargo-make/default.nix
+++ b/pkgs/development/tools/rust/cargo-make/default.nix
@@ -13,11 +13,11 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-make";
-  version = "0.35.12";
+  version = "0.35.13";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-BBSZTbzT+8obY677Yfmf1VTwg0GtvMNY/FTlS6isJTE=";
+    sha256 = "sha256-rkE/GLFZP1C5C4s6ghbfsJY92Wu3ku27VRorU/ZGelA=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [ openssl ]
     ++ lib.optionals stdenv.isDarwin [ Security SystemConfiguration libiconv ];
 
-  cargoSha256 = "sha256-Nsm6KnL72HjqGevXwg2qYagzMG5nEFuH9DblbcUv6Qg=";
+  cargoSha256 = "sha256-GSHbs8GUHqFrBN1Op6Uh4fPzXEjSkX+a6beBQxS19K8=";
 
   # Some tests fail because they need network access.
   # However, Travis ensures a proper build.
diff --git a/pkgs/development/tools/rust/cargo-nextest/default.nix b/pkgs/development/tools/rust/cargo-nextest/default.nix
index 25c809079c11b..8220b8a726667 100644
--- a/pkgs/development/tools/rust/cargo-nextest/default.nix
+++ b/pkgs/development/tools/rust/cargo-nextest/default.nix
@@ -1,17 +1,19 @@
-{ lib, fetchFromGitHub, rustPlatform, stdenv, libiconv }:
+{ lib, fetchFromGitHub, rustPlatform, stdenv, Security }:
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-nextest";
-  version = "0.9.20";
+  version = "0.9.22";
 
   src = fetchFromGitHub {
     owner = "nextest-rs";
     repo = "nextest";
     rev = "cargo-nextest-${version}";
-    sha256 = "sha256-dsXjoXoFliaALA/tz8/QqC5FpapE/E9nNMJYgvkI+nw=";
+    sha256 = "sha256-so9h6bpQzGMVwXI4qGHOJGbX7hnd9tllPGJcRvtIiIU=";
   };
 
-  cargoSha256 = "sha256-3aooeKfQtElWuGtdh0gYvdm62Cm7IhebsintQgOi1Mo=";
+  cargoSha256 = "sha256-rbrJPEMOFq37U+0uL5NIqithQAdjO8J6TDwr5vdfT50=";
+
+  buildInputs = lib.optionals stdenv.isDarwin [ Security ];
 
   cargoTestFlags = [ # TODO: investigate some more why these tests fail in nix
     "--"
diff --git a/pkgs/tools/package-management/cargo-outdated/default.nix b/pkgs/development/tools/rust/cargo-outdated/default.nix
index 2013f15d1e1a6..2013f15d1e1a6 100644
--- a/pkgs/tools/package-management/cargo-outdated/default.nix
+++ b/pkgs/development/tools/rust/cargo-outdated/default.nix
diff --git a/pkgs/tools/package-management/cargo-release/default.nix b/pkgs/development/tools/rust/cargo-release/default.nix
index 965c94742ec5e..965c94742ec5e 100644
--- a/pkgs/tools/package-management/cargo-release/default.nix
+++ b/pkgs/development/tools/rust/cargo-release/default.nix
diff --git a/pkgs/tools/package-management/cargo-update/default.nix b/pkgs/development/tools/rust/cargo-update/default.nix
index 383eeac432d9a..383eeac432d9a 100644
--- a/pkgs/tools/package-management/cargo-update/default.nix
+++ b/pkgs/development/tools/rust/cargo-update/default.nix
diff --git a/pkgs/development/tools/cargo-web/default.nix b/pkgs/development/tools/rust/cargo-web/default.nix
index 2c35e951cda13..2c35e951cda13 100644
--- a/pkgs/development/tools/cargo-web/default.nix
+++ b/pkgs/development/tools/rust/cargo-web/default.nix
diff --git a/pkgs/development/web/deno/default.nix b/pkgs/development/web/deno/default.nix
index 3a62b1802b74b..c433e2dfa671a 100644
--- a/pkgs/development/web/deno/default.nix
+++ b/pkgs/development/web/deno/default.nix
@@ -16,15 +16,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "deno";
-  version = "1.23.0";
+  version = "1.23.1";
 
   src = fetchFromGitHub {
     owner = "denoland";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-nPVghkLtXhd2/TeBeNDtA1ucgiqzZWmtxXf9bCrFh44=";
+    sha256 = "sha256-Z9dZrhH+zlYNuhFs+aicuepnUTSOfIHdLaz9sJp0LCA=";
   };
-  cargoSha256 = "sha256-bCk6zgsfyI5Nk0AHPyr29KzgltobxfD6b72N0ZaQyOU=";
+  cargoSha256 = "sha256-VIpy5vRZinFvFhyyKQwi5ThrBNwqGy1TVg5tAoxxJyQ=";
 
   postPatch = ''
     # upstream uses lld on aarch64-darwin for faster builds
diff --git a/pkgs/development/web/deno/librusty_v8.nix b/pkgs/development/web/deno/librusty_v8.nix
index 581c2e88d9ca1..793bc9cb19493 100644
--- a/pkgs/development/web/deno/librusty_v8.nix
+++ b/pkgs/development/web/deno/librusty_v8.nix
@@ -11,11 +11,11 @@ let
   };
 in
 fetch_librusty_v8 {
-  version = "0.44.1";
+  version = "0.44.2";
   shas = {
-    x86_64-linux = "sha256-8aBjN9ukbH+lr3YPdngXxSjPjutBgWv4hEdhYmcvtO4=";
-    aarch64-linux = "sha256-h0mxzeA/wB+/zNz0ZKjSBH7lpYrCLRdTgeDGwZypuXE=";
-    x86_64-darwin = "sha256-4YXYHhYwCBnb1clxW1ziccHMWsUcGz8Rr8/anCvI1lY=";
-    aarch64-darwin = "sha256-3sBeL+YJB1HaEhM76GfABvN/6iWeST7Z6lVu3X8sRjk=";
+    x86_64-linux = "sha256-I1ad9a9FtJGGGW7Odc8HfysQyCEAb8xoEYmYti0pEkE=";
+    aarch64-linux = "sha256-KHjVMI9qiJ6q3D6t6iUKxbp1qthHSSl+2AfvL3Hvk6I=";
+    x86_64-darwin = "sha256-UO1NRpbCA5MtqeRLTGM3FIWdX/ECDW/JG52U756FIv8=";
+    aarch64-darwin = "sha256-FqakcG050m52/F6nWlS7VeW0r+77CCIzG1qvBP3Naik=";
   };
 }
diff --git a/pkgs/development/web/flyctl/default.nix b/pkgs/development/web/flyctl/default.nix
index 4a2ed0a33f4e4..c9d36dd679ade 100644
--- a/pkgs/development/web/flyctl/default.nix
+++ b/pkgs/development/web/flyctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "flyctl";
-  version = "0.0.330";
+  version = "0.0.335";
 
   src = fetchFromGitHub {
     owner = "superfly";
     repo = "flyctl";
     rev = "v${version}";
-    sha256 = "sha256-lgyr2NgurOZPqJv8ZUD8ut7ELxMZqLZ+rXYTjZauv8Y=";
+    sha256 = "sha256-da7fKtByg3zwtRmsObs5SV6E9bVBe9KyVzn1eE3PcV8=";
   };
 
-  vendorSha256 = "sha256-T1E2VJiaGKhk/rDVKYEju3AyDPEUMGFNvj/KrMjLKEc=";
+  vendorSha256 = "sha256-Hn4uB9HYHVS3p9zBpOzOiyTHMmjN8YmVxHZAj1V7y2I=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/games/ferium/default.nix b/pkgs/games/ferium/default.nix
new file mode 100644
index 0000000000000..b542ae3451e74
--- /dev/null
+++ b/pkgs/games/ferium/default.nix
@@ -0,0 +1,28 @@
+{ lib, stdenv, fetchFromGitHub, rustPlatform, Security }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "ferium";
+  version = "4.1.1";
+
+  src = fetchFromGitHub {
+    owner = "gorilla-devs";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "5DYdeK6JdA7oLBkjP3WkwLwlBitdf4Yt2dNP7P0INN0=";
+  };
+
+  buildInputs = lib.optionals stdenv.isDarwin [ Security ];
+
+  cargoSha256 = "7rpxHfe+pWarPJ72WSXjgr63YctZ5+RrsEgmw7o66VI=";
+
+  buildNoDefaultFeatures = true; # by default pulls in GTK 3 just for its directory picker
+
+  doCheck = false; # requires internet
+
+  meta = with lib; {
+    description = "A CLI Minecraft mod manager for mods from Modrinth, CurseForge, and Github Releases";
+    homepage = "https://github.com/theRookieCoder/ferium";
+    license = licenses.mpl20;
+    maintainers = [ maintainers.leo60228 ];
+  };
+}
diff --git a/pkgs/games/freeciv/default.nix b/pkgs/games/freeciv/default.nix
index b1d215912a0a8..e3057d59cd43a 100644
--- a/pkgs/games/freeciv/default.nix
+++ b/pkgs/games/freeciv/default.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "freeciv";
-  version = "3.0.1";
+  version = "3.0.2";
 
   src = fetchFromGitHub {
     owner = "freeciv";
     repo = "freeciv";
     rev = "R${lib.replaceStrings [ "." ] [ "_" ] version}";
-    sha256 = "sha256-Nzc6Tirj6TKLgTYN5XjZZut9HVYLKGOp1GZeaoqEtW8=";
+    sha256 = "sha256-1QGARXIfb97aLxQ5TZ6Fjznlniznnyuc2ugiW/Drf9g=";
   };
 
   postPatch = ''
diff --git a/pkgs/games/gnonograms/default.nix b/pkgs/games/gnonograms/default.nix
index 21f522d3418f9..2446384ff719a 100644
--- a/pkgs/games/gnonograms/default.nix
+++ b/pkgs/games/gnonograms/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , vala
 , meson
 , ninja
@@ -19,24 +18,15 @@
 
 stdenv.mkDerivation rec {
   pname = "gnonograms";
-  version = "2.0.0";
+  version = "2.1.2";
 
   src = fetchFromGitHub {
     owner = "jeremypw";
     repo = "gnonograms";
     rev = "v${version}";
-    sha256 = "sha256-2uXaybpCAm9cr0o7bqfhgD7mMNPwtv1X/PgnFnSDOl0=";
+    sha256 = "sha256-TkEVjrwlr4Q5FsfcdY+9fxwaMq+DFs0RwGI2E+GT5Mk=";
   };
 
-  patches = [
-    # Fix build with meson 0.61, can be removed on next release
-    # https://github.com/jeremypw/gnonograms/pull/45
-    (fetchpatch {
-      url = "https://github.com/jeremypw/gnonograms/commit/0e90d8ff42d64a94002ec8500889bc4d7e06c1b6.patch";
-      sha256 = "sha256-G/yqsZFmOA69A3E2CROMYAS5vmok/K5l1S/M2m8DMh4=";
-    })
-  ];
-
   postPatch = ''
     patchShebangs meson/post_install.py
   '';
diff --git a/pkgs/games/itch-setup/default.nix b/pkgs/games/itch-setup/default.nix
deleted file mode 100644
index 55d488bcaac06..0000000000000
--- a/pkgs/games/itch-setup/default.nix
+++ /dev/null
@@ -1,24 +0,0 @@
-{ lib, writeShellScriptBin, steam-run, fetchurl }:
-let
-
-  pname = "itch-setup";
-  version = "1.26.0";
-
-  src = fetchurl {
-    url = "https://broth.itch.ovh/itch-setup/linux-amd64/${version}/unpacked/default";
-    hash = "sha256-bcJKqhgZK42Irx12BIvbTDMb/DHEOEXljetlDokF7x8=";
-    executable = true;
-  };
-
-in
-(writeShellScriptBin pname ''exec ${steam-run}/bin/steam-run ${src} "$@"'') // {
-
-  passthru = { inherit pname version src; };
-  meta = with lib; {
-    description = "An installer for the itch.io desktop app";
-    homepage = "https://github.com/itchio/itch-setup";
-    license = licenses.mit;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ pasqui23 ];
-  };
-}
diff --git a/pkgs/games/itch/butler.nix b/pkgs/games/itch/butler.nix
new file mode 100644
index 0000000000000..68f1bac49e903
--- /dev/null
+++ b/pkgs/games/itch/butler.nix
@@ -0,0 +1,29 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "butler";
+  version = "15.21.0";
+
+  src = fetchFromGitHub {
+    owner = "itchio";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-vciSmXR3wI3KcnC+Uz36AgI/WUfztA05MJv1InuOjJM=";
+  };
+
+  proxyVendor = true;
+
+  vendorSha256 = "sha256-EIl0ZFDKbZopUR22hp5a2vRUu0O1h1O953NrtoNa2x8=";
+
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Command-line itch.io helper";
+    homepage = "https://github.com/itchio/butler";
+    license = licenses.mit;
+    maintainers = with maintainers; [ martfont ];
+  };
+}
diff --git a/pkgs/games/itch/default.nix b/pkgs/games/itch/default.nix
index 34a2775c3c80c..991623b6c9f7e 100644
--- a/pkgs/games/itch/default.nix
+++ b/pkgs/games/itch/default.nix
@@ -1,30 +1,56 @@
 { lib
 , stdenvNoCC
-, fetchurl
-, libnotify
-, nss
-, gtk3
+, fetchpatch
+, fetchzip
 , fetchFromGitHub
+, butler
+, electron_11
+, steam-run
+, makeWrapper
+, copyDesktopItems
 , makeDesktopItem
-, itch-setup
-, runtimeShell
 }:
-stdenvNoCC.mkDerivation rec{
+stdenvNoCC.mkDerivation rec {
   pname = "itch";
   version = "25.5.1";
 
-  src = fetchFromGitHub {
-    owner = "itchio";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-Pi3l3uK4kr+N3p7fGQuqckYIzycRqJHDVX00reoSbp4=";
+  src = fetchzip {
+    url = "https://broth.itch.ovh/${pname}/linux-amd64/${version}/itch.zip";
+    stripRoot = false;
+    sha256 = "sha256-ejfS+sqhacW2h8u96W4fout3V8xrBs0SrW5w/7X83m4=";
   };
 
+  patches = [
+    # Fixes crash while browsing the store.
+    (fetchpatch {
+      name = "itch.patch";
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/itch.patch?h=itch-bin&id=0b181454567029141749f870880b10093216e133";
+      sha256 = "sha256-gmLL/BMondSflERm0z+DuGDP56JhDXiyxEwLUavTD8Q=";
+    })
+  ];
+
+  itch-setup = fetchzip {
+    url = "https://broth.itch.ovh/itch-setup/linux-amd64/1.26.0/itch-setup.zip";
+    stripRoot = false;
+    sha256 = "sha256-5MP6X33Jfu97o5R1n6Og64Bv4ZMxVM0A8lXeQug+bNA=";
+  };
+
+  icons = let sparseCheckout = "/release/images/itch-icons"; in
+    fetchFromGitHub {
+        owner = "itchio";
+        repo = pname;
+        rev = "v${version}";
+        hash = "sha256-1L6STTBHA9xL9IaERaH2OTvurTSng1D+P3KoW0ucEJc=";
+        inherit sparseCheckout;
+      } + sparseCheckout;
+
+  nativeBuildInputs = [ copyDesktopItems makeWrapper ];
+
   desktopItems = [
     (makeDesktopItem {
       name = pname;
-      exec = pname;
-      tryExec = "itch %U";
+      exec = "itch %U";
+      tryExec = pname;
       icon = pname;
       desktopName = pname;
       mimeTypes = [ "x-scheme-handler/itchio" "x-scheme-handler/itch" ];
@@ -33,23 +59,33 @@ stdenvNoCC.mkDerivation rec{
     })
   ];
 
-  itchBin = ''
-    #!${runtimeShell}
-    exec ${itch-setup}/bin/itch-setup --prefer-launch -- "$@"
-  '';
+  # As taken from https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=itch-bin
+  installPhase = ''
+    runHook preInstall
 
-  passAsFile = [ "itchBin" ];
+    mkdir -p $out/bin $out/share/${pname}/resources/app
+    cp -r resources/app "$out/share/${pname}/resources/"
 
-  # as taken from https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=itch
-  installPhase = ''
-    install -Dm0777 $itchBinPath $out/bin/itch
-    for icon in release/images/itch-icons/icon*.png
+    install -Dm644 LICENSE -t "$out/share/licenses/$pkgname/"
+    install -Dm644 LICENSES.chromium.html -t "$out/share/licenses/$pkgname/"
+
+    for icon in $icons/icon*.png
     do
-      iconsize="''${icon#release/images/itch-icons/icon}"
+      iconsize="''${icon#$icons/icon}"
       iconsize="''${iconsize%.png}"
       icondir="$out/share/icons/hicolor/''${iconsize}x''${iconsize}/apps/"
       install -Dm644 "$icon" "$icondir/itch.png"
     done
+
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    makeWrapper ${steam-run}/bin/steam-run $out/bin/${pname} \
+      --add-flags ${electron_11}/bin/electron \
+      --add-flags $out/share/${pname}/resources/app \
+      --set BROTH_USE_LOCAL butler,itch-setup \
+      --prefix PATH : ${butler}/bin/:${itch-setup}
   '';
 
   meta = with lib; {
@@ -57,6 +93,7 @@ stdenvNoCC.mkDerivation rec{
     homepage = "https://github.com/itchio/itch";
     license = licenses.mit;
     platforms = platforms.linux;
+    sourceProvenance = lib.sourceTypes.binaryBytecode;
     maintainers = with maintainers; [ pasqui23 ];
   };
 }
diff --git a/pkgs/games/sil-q/default.nix b/pkgs/games/sil-q/default.nix
index 1676f8da55a90..e4299bd8aca73 100644
--- a/pkgs/games/sil-q/default.nix
+++ b/pkgs/games/sil-q/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, writeScript, makeWrapper, ncurses, libX11 }:
+{ pkgs, lib, stdenv, fetchFromGitHub, writeScript, makeWrapper, ncurses, libX11 }:
 
 let
   setup = writeScript "setup" ''
@@ -47,6 +47,13 @@ in stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
+  passthru.tests = {
+    saveDirCreation = pkgs.runCommand "save-dir-creation" {} ''
+      HOME=$(pwd) ${lib.getExe pkgs.sil-q} --help
+      test -d .sil && touch $out
+    '';
+  };
+
   meta = {
     description = "A roguelike game set in the First Age of Middle-earth";
     longDescription = ''
diff --git a/pkgs/games/sil/default.nix b/pkgs/games/sil/default.nix
index 2e6c50daa8236..7d446a684aae0 100644
--- a/pkgs/games/sil/default.nix
+++ b/pkgs/games/sil/default.nix
@@ -1,4 +1,6 @@
-{ lib, stdenv, fetchzip, ncurses, libX11, libXaw, libXt, libXext, libXmu, makeWrapper, writeScript, ... }:
+{ pkgs, lib, stdenv, fetchzip, ncurses, libX11, libXaw, libXt, libXext, libXmu
+, makeWrapper, writeScript }:
+
 let
   setup = writeScript "setup" ''
     mkdir -p "$ANGBAND_PATH"
@@ -15,7 +17,7 @@ stdenv.mkDerivation rec {
   src = fetchzip {
     url = "http://www.amirrorclear.net/flowers/game/sil/Sil-130-src.zip";
     sha256 = "1amp2mr3fxascra0k76sdsvikjh8g76nqh46kka9379zd35lfq8w";
-    stripRoot=false;
+    stripRoot = false;
   };
 
   nativeBuildInputs = [ makeWrapper ];
@@ -25,7 +27,7 @@ stdenv.mkDerivation rec {
 
   makefile = "Makefile.std";
 
-  prePatch = ''
+  postPatch = ''
     # Allow usage of ANGBAND_PATH
     substituteInPlace config.h --replace "#define FIXED_PATHS" ""
   '';
@@ -41,30 +43,42 @@ stdenv.mkDerivation rec {
   NIX_CFLAGS_COMPILE = "-fcommon";
 
   installPhase = ''
-    # the makefile doesn't have a sensible install target, so we hav to do it ourselves
+    runHook preInstall
+
+    # the makefile doesn't have a sensible install target, so we have to do it ourselves
     mkdir -p $out/bin
     cp sil $out/bin/sil
-    # Wrap the program to set a user-local ANGBAND_PATH, and run the setup script to copy files into place
+
+    # Wrap the program to set a user-local ANGBAND_PATH, and run the setup script to copy files into place.
     # We could just use the options for a user-local save and scores dir, but it tried to write to the
     # lib directory anyway, so we might as well give everyone a copy
     wrapProgram $out/bin/sil \
-      --run "set -u" \
       --run "export ANGBAND_PATH=\$HOME/.sil" \
       --run "${setup} ${src}/Sil/lib"
+
+    runHook postInstall
   '';
 
+  passthru.tests = {
+    saveDirCreation = pkgs.runCommand "save-dir-creation" {} ''
+      HOME=$(pwd) ${lib.getExe pkgs.sil} --help
+      test -d .sil && touch $out
+    '';
+  };
+
   meta = {
-    description = "A rouge-like game set in the first age of Middle-earth";
+    description = "A rogue-like game set in the First Age of Middle-earth";
     longDescription = ''
-      A game of adventure set in the first age of Middle-earth, when the world still
-      rang with elven song and gleamed with dwarven mail.
+      A game of adventure set in the First Age of Middle-earth, when the world still
+      rang with Elven song and gleamed with Dwarven mail.
 
       Walk the dark halls of Angband.  Slay creatures black and fell.  Wrest a shining
       Silmaril from Morgoth’s iron crown.
     '';
     homepage = "http://www.amirrorclear.net/flowers/game/sil/index.html";
     license = lib.licenses.gpl2;
-    maintainers = [ lib.maintainers.michaelpj ];
+    maintainers = with lib.maintainers; [ michaelpj kenran ];
     platforms = lib.platforms.linux;
+    mainProgram = "sil";
   };
 }
diff --git a/pkgs/games/sm64ex/default.nix b/pkgs/games/sm64ex/default.nix
index c6df2099d3ce3..a6bf7202adcf4 100644
--- a/pkgs/games/sm64ex/default.nix
+++ b/pkgs/games/sm64ex/default.nix
@@ -1,71 +1,55 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
-, python3
-, pkg-config
-, audiofile
-, SDL2
-, hexdump
-, requireFile
-, compileFlags ? [ ]
-, region ? "us"
-, baseRom ? requireFile {
-    name = "baserom.${region}.z64";
-    message = ''
-      This nix expression requires that baserom.${region}.z64 is
-      already part of the store. To get this file you can dump your Super Mario 64 cartridge's contents
-      and add it to the nix store with nix-store --add-fixed sha256 <FILE>.
-      Note that if you are not using a US baserom, you must overwrite the "region" attribute with either "eu" or "jp".
-    '';
-    sha256 = {
-      "us" = "17ce077343c6133f8c9f2d6d6d9a4ab62c8cd2aa57c40aea1f490b4c8bb21d91";
-      "eu" = "c792e5ebcba34c8d98c0c44cf29747c8ee67e7b907fcc77887f9ff2523f80572";
-      "jp" = "9cf7a80db321b07a8d461fe536c02c87b7412433953891cdec9191bfad2db317";
-    }.${region};
-  }
+, callPackage
+, autoPatchelfHook
+, branch
 }:
 
-stdenv.mkDerivation rec {
-  pname = "sm64ex";
-  version = "unstable-2021-11-30";
-
-  src = fetchFromGitHub {
-    owner = "sm64pc";
-    repo = "sm64ex";
-    rev = "db9a6345baa5acb41f9d77c480510442cab26025";
-    sha256 = "sha256-q7JWDvNeNrDpcKVtIGqB1k7I0FveYwrfqu7ZZK7T8F8=";
+{
+  sm64ex = callPackage ./generic.nix {
+    pname = "sm64ex";
+    version = "0.pre+date=2021-11-30";
+
+    src = fetchFromGitHub {
+      owner = "sm64pc";
+      repo = "sm64ex";
+      rev = "db9a6345baa5acb41f9d77c480510442cab26025";
+      sha256 = "sha256-q7JWDvNeNrDpcKVtIGqB1k7I0FveYwrfqu7ZZK7T8F8=";
+    };
+
+    extraMeta = {
+      homepage = "https://github.com/sm64pc/sm64ex";
+      description = "Super Mario 64 port based off of decompilation";
+    };
   };
 
-  nativeBuildInputs = [ python3 pkg-config ];
-  buildInputs = [ audiofile SDL2 hexdump ];
-
-  makeFlags = [ "VERSION=${region}" ] ++ compileFlags
-    ++ lib.optionals stdenv.isDarwin [ "OSX_BUILD=1" ];
-
-  inherit baseRom;
-
-  preBuild = ''
-    patchShebangs extract_assets.py
-    cp $baseRom ./baserom.${region}.z64
-  '';
-
-  installPhase = ''
-    mkdir -p $out/bin
-    cp build/${region}_pc/sm64.${region}.f3dex2e $out/bin/sm64ex
-  '';
-
-  enableParallelBuilding = true;
-
-  meta = with lib; {
-    homepage = "https://github.com/sm64pc/sm64ex";
-    description = "Super Mario 64 port based off of decompilation";
-    longDescription = ''
-      Super Mario 64 port based off of decompilation.
-      Note that you must supply a baserom yourself to extract assets from.
-      If you are not using an US baserom, you must overwrite the "region" attribute with either "eu" or "jp".
-      If you would like to use patches sm64ex distributes as makeflags, add them to the "compileFlags" attribute.
+  sm64ex-coop = callPackage ./generic.nix {
+    pname = "sm64ex-coop";
+    version = "0.pre+date=2022-05-14";
+
+    src = fetchFromGitHub {
+      owner = "djoslin0";
+      repo = "sm64ex-coop";
+      rev = "8200b175607fe2939f067d496627c202a15fe24c";
+      sha256 = "sha256-c1ZmMBtvYYcaJ/WxkZBVvNGVCeSXfm8NKe/BiAIJtks=";
+    };
+
+    extraNativeBuildInputs = [
+      autoPatchelfHook
+    ];
+
+    postInstall = let
+      sharedLib = stdenv.hostPlatform.extensions.sharedLibrary;
+    in ''
+      mkdir -p $out/lib
+      cp $src/lib/bass/libbass{,_fx}${sharedLib} $out/lib
+      cp $src/lib/discordsdk/libdiscord_game_sdk${sharedLib} $out/lib
     '';
-    license = licenses.unfree;
-    maintainers = with maintainers; [ ivar ];
-    platforms = platforms.unix;
+
+    extraMeta = {
+      homepage = "https://github.com/djoslin0/sm64ex-coop";
+      description = "Super Mario 64 online co-op mod, forked from sm64ex";
+    };
   };
-}
+}.${branch}
diff --git a/pkgs/games/sm64ex/generic.nix b/pkgs/games/sm64ex/generic.nix
new file mode 100644
index 0000000000000..ab75ac70b9c53
--- /dev/null
+++ b/pkgs/games/sm64ex/generic.nix
@@ -0,0 +1,83 @@
+{ pname
+, version
+, src
+, extraNativeBuildInputs ? [ ]
+, extraMeta ? {}
+, compileFlags ? [ ]
+, postInstall ? ""
+, region ? "us"
+
+, lib
+, stdenv
+, fetchFromGitHub
+, python3
+, pkg-config
+, audiofile
+, SDL2
+, hexdump
+, requireFile
+, baseRom ? requireFile {
+    name = "baserom.${region}.z64";
+    message = ''
+      This nix expression requires that baserom.${region}.z64 is
+      already part of the store. To get this file you can dump your Super Mario 64 cartridge's contents
+      and add it to the nix store with nix-store --add-fixed sha256 <FILE>.
+      Note that if you are not using a US baserom, you must overwrite the "region" attribute with either "eu" or "jp".
+    '';
+    sha256 = {
+      "us" = "17ce077343c6133f8c9f2d6d6d9a4ab62c8cd2aa57c40aea1f490b4c8bb21d91";
+      "eu" = "c792e5ebcba34c8d98c0c44cf29747c8ee67e7b907fcc77887f9ff2523f80572";
+      "jp" = "9cf7a80db321b07a8d461fe536c02c87b7412433953891cdec9191bfad2db317";
+    }.${region};
+  }
+}:
+
+stdenv.mkDerivation rec {
+  inherit pname version src postInstall;
+
+  nativeBuildInputs = [
+    python3
+    pkg-config
+    hexdump
+  ] ++ extraNativeBuildInputs;
+
+  buildInputs = [
+    audiofile
+    SDL2
+  ];
+
+  enableParallelBuilding = true;
+
+  makeFlags = [
+    "VERSION=${region}"
+  ] ++ lib.optionals stdenv.isDarwin [
+    "OSX_BUILD=1"
+  ] ++ compileFlags;
+
+  preBuild = ''
+    patchShebangs extract_assets.py
+    ln -s ${baseRom} ./baserom.${region}.z64
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp build/${region}_pc/sm64.${region}.f3dex2e $out/bin/sm64ex
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    longDescription =
+      extraMeta.description or "Super Mario 64 port based off of decompilation" + "\n" + ''
+        Note that you must supply a baserom yourself to extract assets from.
+        If you are not using an US baserom, you must overwrite the "region" attribute with either "eu" or "jp".
+        If you would like to use patches sm64ex distributes as makeflags, add them to the "compileFlags" attribute.
+      '';
+    mainProgram = "sm64ex";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ ivar ];
+    platforms = platforms.unix;
+  } // extraMeta;
+}
diff --git a/pkgs/games/umoria/default.nix b/pkgs/games/umoria/default.nix
index 1114d47b7be56..13ec037afba78 100644
--- a/pkgs/games/umoria/default.nix
+++ b/pkgs/games/umoria/default.nix
@@ -8,7 +8,7 @@
 }:
 
 let
-  savesDir = "~/.umoria/";
+  savesDir = "~/.umoria";
 in
 gcc9Stdenv.mkDerivation rec {
   pname = "umoria";
@@ -38,24 +38,22 @@ gcc9Stdenv.mkDerivation rec {
 
     RUNDIR=\$(mktemp -d)
 
-    cleanup() {
-      rm -rf \$RUNDIR
-    }
-
-    trap cleanup EXIT
+    # Print the directory, so users have access to dumps, and let the system
+    # take care of cleaning up temp files.
+    echo "Running umoria in \$RUNDIR"
 
     cd \$RUNDIR
-    mkdir data
-
-    for i in $out/data/*; do
-      ln -s \$i "data/\$(basename \$i)"
-    done
+    ln -sn $out/data \$RUNDIR/data
 
     mkdir -p ${savesDir}
     [[ ! -f ${savesDir}/scores.dat ]] && touch ${savesDir}/scores.dat
     ln -s ${savesDir}/scores.dat scores.dat
 
-    $out/.umoria-unwrapped
+    if [ \$# -eq 0 ]; then
+       $out/.umoria-unwrapped ${savesDir}/game.sav
+    else
+       $out/.umoria-unwrapped "\$@"
+    fi
     EOF
 
     chmod +x $out/bin/umoria
@@ -74,7 +72,7 @@ gcc9Stdenv.mkDerivation rec {
     '';
     platforms = platforms.unix;
     badPlatforms = [ "aarch64-darwin" ];
-    maintainers = [ maintainers.aciceri ];
+    maintainers = with maintainers; [ aciceri kenran ];
     license = licenses.gpl3Plus;
   };
 }
diff --git a/pkgs/misc/screensavers/rss-glx/cstddef.patch b/pkgs/misc/screensavers/rss-glx/cstddef.patch
new file mode 100644
index 0000000000000..8bec510b04050
--- /dev/null
+++ b/pkgs/misc/screensavers/rss-glx/cstddef.patch
@@ -0,0 +1,12 @@
+diff --git i/src/Implicit/impSurface.h w/src/Implicit/impSurface.h
+index 41fab81..027587f 100644
+--- i/src/Implicit/impSurface.h
++++ w/src/Implicit/impSurface.h
+@@ -25,6 +25,7 @@
+ #ifdef WIN32
+ 	#include <windows.h>
+ #endif
++#include <cstddef>
+ #include <vector>
+ #include <GL/gl.h>
+ 
diff --git a/pkgs/misc/screensavers/rss-glx/default.nix b/pkgs/misc/screensavers/rss-glx/default.nix
index 981db782c7c92..a90b5d65653e0 100644
--- a/pkgs/misc/screensavers/rss-glx/default.nix
+++ b/pkgs/misc/screensavers/rss-glx/default.nix
@@ -1,4 +1,16 @@
-{lib, stdenv, fetchurl, pkg-config, xlibsWrapper, libXext, libGLU, libGL, imagemagick6, libtiff, bzip2}:
+{ lib
+, stdenv
+, fetchurl
+, autoconf
+, pkg-config
+, xlibsWrapper
+, libXext
+, libGLU
+, libGL
+, imagemagick6
+, libtiff
+, bzip2
+}:
 
 stdenv.mkDerivation rec {
   version = "0.9.1";
@@ -9,9 +21,13 @@ stdenv.mkDerivation rec {
     sha256 = "1aikafjqrfmv23jnrrm5d56dg6injh4l67zjdxzdapv9chw7g3cg";
   };
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ autoconf pkg-config ];
   buildInputs = [ libGLU libGL xlibsWrapper imagemagick6 libtiff bzip2 ];
 
+  patches = [
+    ./cstddef.patch
+  ];
+
   NIX_CFLAGS_COMPILE = "-I${imagemagick6.dev}/include/ImageMagick";
   NIX_LDFLAGS= "-rpath ${libXext}/lib";
 
diff --git a/pkgs/os-specific/linux/alsa-project/alsa-utils/default.nix b/pkgs/os-specific/linux/alsa-project/alsa-utils/default.nix
index e614be978c067..e8c6a2ae566fb 100644
--- a/pkgs/os-specific/linux/alsa-project/alsa-utils/default.nix
+++ b/pkgs/os-specific/linux/alsa-project/alsa-utils/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "alsa-utils";
-  version = "1.2.6";
+  version = "1.2.7";
 
   src = fetchurl {
     url = "mirror://alsa/utils/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-ah79ih8dnTjkiWM+rsH/+lwxVmOzFsq4BL5IaIfmFF0=";
+    sha256 = "sha256-6Qa/JAT/BMRI6qPSJtKDpiuaKD8S5P2EV/skusJ05ng=";
   };
 
   nativeBuildInputs = [ gettext makeWrapper ];
diff --git a/pkgs/os-specific/linux/bcc/default.nix b/pkgs/os-specific/linux/bcc/default.nix
index d6e4b059088dc..ab3e2232852bb 100644
--- a/pkgs/os-specific/linux/bcc/default.nix
+++ b/pkgs/os-specific/linux/bcc/default.nix
@@ -77,6 +77,8 @@ python.pkgs.buildPythonApplication rec {
     wrapPythonProgramsIn "$out/share/bcc/tools" "$out $pythonPath"
   '';
 
+  outputs = [ "out" "man" ];
+
   passthru.tests = {
     bpf = nixosTests.bpf;
   };
diff --git a/pkgs/os-specific/linux/bpftrace/default.nix b/pkgs/os-specific/linux/bpftrace/default.nix
index 0dd477ee31d29..cbf5eb4a6dd9f 100644
--- a/pkgs/os-specific/linux/bpftrace/default.nix
+++ b/pkgs/os-specific/linux/bpftrace/default.nix
@@ -62,8 +62,18 @@ stdenv.mkDerivation rec {
 
   # nuke the example/reference output .txt files, for the included tools,
   # stuffed inside $out. we don't need them at all.
+  # (see "Allow skipping examples" for a potential option
+  #  https://github.com/iovisor/bpftrace/pull/2256)
+  #
+  # Pull BPF scripts into $PATH (next to their bcc program equivalents), but do
+  # not move them to keep `${pkgs.bpftrace}/share/bpftrace/tools/...` working.
+  # (remove `chmod` once a new release "Add executable permission to tools"
+  #  https://github.com/iovisor/bpftrace/commit/77e524e6d276216ed6a6e1984cf204418db07c78)
   postInstall = ''
     rm -rf $out/share/bpftrace/tools/doc
+
+    ln -s $out/share/bpftrace/tools/*.bt $out/bin/
+    chmod +x $out/bin/*.bt
   '';
 
   outputs = [ "out" "man" ];
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index d1ad7f5b74a18..fb8c448f7fb8f 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -2,71 +2,61 @@
     "4.14": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-4.14.283-hardened1.patch",
-            "sha256": "07827a7wigdp2wml770gc0mmzmcmqf9mnry9xbsxpkgbs91ng6lp",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.283-hardened1/linux-hardened-4.14.283-hardened1.patch"
+            "name": "linux-hardened-4.14.284-hardened1.patch",
+            "sha256": "0hj6hmkv3ikgps0jrwl5jgg9pdw6mxi3iblr20r4yp8anxcrvaws",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.284-hardened1/linux-hardened-4.14.284-hardened1.patch"
         },
-        "sha256": "191gybhnck4mh9yjzwgv1crrbxjc90p12bcif721rbs6xzszmxzh",
-        "version": "4.14.283"
+        "sha256": "1f7bidisa6b4ff0mgn66h1nmf94j5mcx4wnkwnd9f49im6hcqllq",
+        "version": "4.14.284"
     },
     "4.19": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-4.19.247-hardened1.patch",
-            "sha256": "1m7289bljbki2wiy6458v13l8wvslqgqhajcp735j50psi6jr6dp",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.247-hardened1/linux-hardened-4.19.247-hardened1.patch"
+            "name": "linux-hardened-4.19.248-hardened1.patch",
+            "sha256": "09bnw0f8rd5hf4k4w4n4sb3ggsw48nkxsrnxd9b8vn6jyqhv9n3s",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.248-hardened1/linux-hardened-4.19.248-hardened1.patch"
         },
-        "sha256": "136gmsmvgb2nid4by2ld003w06lsr7hgn9ajx0wfziag7pfnjsv2",
-        "version": "4.19.247"
+        "sha256": "0cdflfk6l13slw1cawpkhpjzbbnffcbyffrh29p9jg73pdqx23y4",
+        "version": "4.19.248"
     },
     "5.10": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.10.122-hardened1.patch",
-            "sha256": "1mb10f3kfncgpwlygvnlvjy3cjlgjzbc5lp73wgjz1nzqjfdjrlp",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.122-hardened1/linux-hardened-5.10.122-hardened1.patch"
+            "name": "linux-hardened-5.10.124-hardened1.patch",
+            "sha256": "1fjwi5al5i0qb7a7viljb755ylqj3m5qp10835a3q91ad6zkjjnf",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.124-hardened1/linux-hardened-5.10.124-hardened1.patch"
         },
-        "sha256": "0h0gfi3p1dd4p8xxklrl8sc3rv4xd08q7nv0i4m166w8188v62wj",
-        "version": "5.10.122"
+        "sha256": "0yz3yw02b6b1sq800r46x5b3dagswb6z4clrfq485c4669sb2ipc",
+        "version": "5.10.124"
     },
     "5.15": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.15.47-hardened1.patch",
-            "sha256": "0bpzk0l4kcfhqinh3rpl6wv70lhw9c304zgw2qbw0fa76mqfwgs8",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.47-hardened1/linux-hardened-5.15.47-hardened1.patch"
+            "name": "linux-hardened-5.15.49-hardened1.patch",
+            "sha256": "0p14bhqk0a4xzr11cc6gqc0ncc1a3cmvwyvisbsp7b74ax9w5qbm",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.49-hardened1/linux-hardened-5.15.49-hardened1.patch"
         },
-        "sha256": "1700js21yimx8rz4bsglszry564l2ycmmcr36rdqspzbmlx5w8wb",
-        "version": "5.15.47"
-    },
-    "5.17": {
-        "patch": {
-            "extra": "-hardened1",
-            "name": "linux-hardened-5.17.15-hardened1.patch",
-            "sha256": "053zgg464rb8ca92hkzxqbffapmj0zs296af354b7jkgfpb5xzr1",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.17.15-hardened1/linux-hardened-5.17.15-hardened1.patch"
-        },
-        "sha256": "0a5n1lb43nhnhwjwclkk3dqp2nxsx5ny7zfl8idvzshf94m9472a",
-        "version": "5.17.15"
+        "sha256": "1p2r02h2z0j34hpkp3kr4741pr15ii72b94zllravx27pa9phj9j",
+        "version": "5.15.49"
     },
     "5.18": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.18.3-hardened1.patch",
-            "sha256": "1kfnknpw2g39j7gqy6mqjmkaxkmdigx617rz2vpqvjxddfv59764",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.18.3-hardened1/linux-hardened-5.18.3-hardened1.patch"
+            "name": "linux-hardened-5.18.6-hardened1.patch",
+            "sha256": "0y0s50z4qrkcd0s7rlsk8nw1xibwy2i5vigm6526ch77d61g231m",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.18.6-hardened1/linux-hardened-5.18.6-hardened1.patch"
         },
-        "sha256": "1sngy576db1zl2284kd0j8ds4biln0q98wnywirzsg3c0w2v8367",
-        "version": "5.18.3"
+        "sha256": "0y1l2cgn8rak1050fn65a9xnapqyfq2dv8bijl150y44g6g2l72f",
+        "version": "5.18.6"
     },
     "5.4": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.4.198-hardened1.patch",
-            "sha256": "0srx8kfapa8ahbqajwd8dir49l4rs0ijz3k3nrgvb2jjlrg1m4dd",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.198-hardened1/linux-hardened-5.4.198-hardened1.patch"
+            "name": "linux-hardened-5.4.200-hardened1.patch",
+            "sha256": "1mpcvgri079v8js8y2angwmksyk07vhyi2b5b24bxxdbm1s5a58s",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.200-hardened1/linux-hardened-5.4.200-hardened1.patch"
         },
-        "sha256": "0wvscr5wia2xdiqfxxdwl8kxf1s085qdj5h4423mraj7dh6l0ihh",
-        "version": "5.4.198"
+        "sha256": "1f15al9g4cd17fm43im5rqqrbz1cqhz2hq5ycpqvwa02pydprsga",
+        "version": "5.4.200"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index 459816f2aa2c9..a18ac3ac5edb5 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "4.14.283";
+  version = "4.14.284";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "191gybhnck4mh9yjzwgv1crrbxjc90p12bcif721rbs6xzszmxzh";
+    sha256 = "1f7bidisa6b4ff0mgn66h1nmf94j5mcx4wnkwnd9f49im6hcqllq";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix
index f978b45c221f6..4d322c8ed6d39 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "4.19.247";
+  version = "4.19.248";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "136gmsmvgb2nid4by2ld003w06lsr7hgn9ajx0wfziag7pfnjsv2";
+    sha256 = "0cdflfk6l13slw1cawpkhpjzbbnffcbyffrh29p9jg73pdqx23y4";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index ee4ab69b9f757..3c6aed36f3981 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,12 +1,12 @@
 { buildPackages, fetchurl, perl, buildLinux, nixosTests, stdenv, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.318";
+  version = "4.9.319";
   extraMeta.branch = "4.9";
   extraMeta.broken = stdenv.isAarch64;
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "09czsc0ynyw068yczs9qx4cliqmrh5hvz93c77lhh014wn02pba4";
+    sha256 = "11242bn95k51knm9da7xk7r10vk7iji06wix1cq4g5nzldrfp9sp";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.10.nix b/pkgs/os-specific/linux/kernel/linux-5.10.nix
index 61d3b9e6eb334..9f4dcb001af5d 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.10.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.10.122";
+  version = "5.10.124";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0h0gfi3p1dd4p8xxklrl8sc3rv4xd08q7nv0i4m166w8188v62wj";
+    sha256 = "0yz3yw02b6b1sq800r46x5b3dagswb6z4clrfq485c4669sb2ipc";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.15.nix b/pkgs/os-specific/linux/kernel/linux-5.15.nix
index 225fe27a15f26..2b96065d84fe0 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.15.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.15.47";
+  version = "5.15.49";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1700js21yimx8rz4bsglszry564l2ycmmcr36rdqspzbmlx5w8wb";
+    sha256 = "1p2r02h2z0j34hpkp3kr4741pr15ii72b94zllravx27pa9phj9j";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.17.nix b/pkgs/os-specific/linux/kernel/linux-5.17.nix
deleted file mode 100644
index 6e4c5f6de14a1..0000000000000
--- a/pkgs/os-specific/linux/kernel/linux-5.17.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{ lib, buildPackages, fetchurl, perl, buildLinux, nixosTests, modDirVersionArg ? null, ... } @ args:
-
-with lib;
-
-buildLinux (args // rec {
-  version = "5.17.15";
-
-  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
-  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
-
-  # branchVersion needs to be x.y
-  extraMeta.branch = versions.majorMinor version;
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0a5n1lb43nhnhwjwclkk3dqp2nxsx5ny7zfl8idvzshf94m9472a";
-  };
-} // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.18.nix b/pkgs/os-specific/linux/kernel/linux-5.18.nix
index 58b87840c0075..a5b50a6269e4b 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.18.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.18.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.18.4";
+  version = "5.18.6";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1pcjjiwal8jr07n5bzg6clcmm20gvmvqgxl8k46npibrdx3r6wab";
+    sha256 = "0y1l2cgn8rak1050fn65a9xnapqyfq2dv8bijl150y44g6g2l72f";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.4.nix b/pkgs/os-specific/linux/kernel/linux-5.4.nix
index dbc350e45559d..2f7a5f372cfe1 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.4.198";
+  version = "5.4.200";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0wvscr5wia2xdiqfxxdwl8kxf1s085qdj5h4423mraj7dh6l0ihh";
+    sha256 = "1f15al9g4cd17fm43im5rqqrbz1cqhz2hq5ycpqvwa02pydprsga";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-libre.nix b/pkgs/os-specific/linux/kernel/linux-libre.nix
index 159584f607ff5..8b4382f80a0ba 100644
--- a/pkgs/os-specific/linux/kernel/linux-libre.nix
+++ b/pkgs/os-specific/linux/kernel/linux-libre.nix
@@ -1,8 +1,8 @@
 { stdenv, lib, fetchsvn, linux
 , scripts ? fetchsvn {
     url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/";
-    rev = "18777";
-    sha256 = "0ycg799pdi3rarkdgrrxcfjl15n8i24d9zc54xhg79wpgxcv39n3";
+    rev = "18798";
+    sha256 = "04mxzf8k3g65yw73da9fgk27hraf69239m5757fsr5a6pj88z6lb";
   }
 , ...
 }:
diff --git a/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix b/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
index 51f47cea2c45f..a1748156d098a 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
@@ -17,6 +17,7 @@
     extraMeta = {
       branch = "master";
       maintainers = with lib.maintainers; [ davidak Madouura ];
+      broken = true;
     };
   } // argsOverride;
 
diff --git a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
index 795bedb99d4d1..95004f4479418 100755
--- a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
+++ b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
@@ -49,6 +49,8 @@ while [ "$#" -gt 0 ]; do
         ;;
       switch|boot|test|build|edit|dry-build|dry-run|dry-activate|build-vm|build-vm-with-bootloader)
         if [ "$i" = dry-run ]; then i=dry-build; fi
+        # exactly one action mandatory, bail out if multiple are given
+        if [ -n "$action" ]; then showSyntax; fi
         action="$i"
         ;;
       --install-grub)
diff --git a/pkgs/os-specific/linux/zfs/default.nix b/pkgs/os-specific/linux/zfs/default.nix
index 5a5fd2d19a8a2..eec2d1ad04abc 100644
--- a/pkgs/os-specific/linux/zfs/default.nix
+++ b/pkgs/os-specific/linux/zfs/default.nix
@@ -16,7 +16,7 @@
 , enablePython ? true
 
 # for determining the latest compatible linuxPackages
-, linuxPackages_5_17 ? pkgs.linuxKernel.packages.linux_5_17
+, linuxPackages_5_18 ? pkgs.linuxKernel.packages.linux_5_18
 }:
 
 let
@@ -216,28 +216,28 @@ in {
   # to be adapted
   zfsStable = common {
     # check the release notes for compatible kernels
-    kernelCompatible = kernel.kernelOlder "5.18";
-    latestCompatibleLinuxPackages = linuxPackages_5_17;
+    kernelCompatible = kernel.kernelOlder "5.19";
+    latestCompatibleLinuxPackages = linuxPackages_5_18;
 
     # this package should point to the latest release.
-    version = "2.1.4";
+    version = "2.1.5";
 
-    sha256 = "sha256-pHz1N2j+d9p1xleEBwwrmK9mN5gEyM69Suy0dsrkZT4=";
+    sha256 = "sha256-a9rmuPO8R8UfxdHvwjfFuYRGn97a1MPmLZRvr3l0swE=";
   };
 
   zfsUnstable = common {
     # check the release notes for compatible kernels
-    kernelCompatible = kernel.kernelOlder "5.18";
-    latestCompatibleLinuxPackages = linuxPackages_5_17;
+    kernelCompatible = kernel.kernelOlder "5.19";
+    latestCompatibleLinuxPackages = linuxPackages_5_18;
 
     # this package should point to a version / git revision compatible with the latest kernel release
     # IMPORTANT: Always use a tagged release candidate or commits from the
     # zfs-<version>-staging branch, because this is tested by the OpenZFS
     # maintainers.
-    version = "2.1.4";
+    version = "2.1.5";
     # rev = "0000000000000000000000000000000000000000";
 
-    sha256 = "sha256-pHz1N2j+d9p1xleEBwwrmK9mN5gEyM69Suy0dsrkZT4=";
+    sha256 = "sha256-a9rmuPO8R8UfxdHvwjfFuYRGn97a1MPmLZRvr3l0swE=";
 
     isUnstable = true;
   };
diff --git a/pkgs/servers/cayley/default.nix b/pkgs/servers/cayley/default.nix
index 97aac4272cead..ec94b19ae49cb 100644
--- a/pkgs/servers/cayley/default.nix
+++ b/pkgs/servers/cayley/default.nix
@@ -1,29 +1,39 @@
-{ lib, buildGoPackage, fetchFromGitHub }:
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "cayley";
-  version = "0.7.5";
-
-  goPackagePath = "github.com/cayleygraph/cayley";
+  version = "0.7.7";
+  rev = "dcf764fef381f19ee49fad186b4e00024709f148";
 
   src = fetchFromGitHub {
     owner = "cayleygraph";
     repo = "cayley";
     rev = "v${version}";
-    sha256 = "1zfxa9z6spi6xw028mvbc7c3g517gn82g77ywr6picl47fr2blnd";
+    sha256 = "sha256-jIX0v6ujiQvEAb/mKkrpNgsY0YLkJYHy2sUfQnooE48=";
   };
 
-  goDeps = ./deps.nix;
+  vendorSha256 = "sha256-SSjHGJoW3I7r8emh3IwmiZQIVzdilAsA2ULdAqld2fA=";
+
+  subPackages = [ "cmd/cayley" ];
 
-  ldflags = [
-    "-X=main.Version=${version}"
+  ldflags = let basename = "github.com/cayleygraph/cayley/version"; in [
+    "-s"
+    "-w"
+    "-X ${basename}.Version=${src.rev}"
+    "-X ${basename}.GitHash=${rev}"
   ];
 
-  meta = {
-    homepage = "https://github.com/cayleygraph/cayley";
-    description = "A graph database inspired by Freebase and Knowledge Graph";
-    maintainers = with lib.maintainers; [ sigma ];
-    license = lib.licenses.asl20;
-    platforms = lib.platforms.unix;
+  meta = with lib; {
+    description = "Graph database designed for ease of use and storing complex data";
+    longDescription = ''
+      Cayley is an open-source database for Linked Data. It is inspired by the
+      graph database behind Google's Knowledge Graph (formerly Freebase).
+    '';
+    homepage = "https://cayley.io/";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ sigma ];
   };
 }
diff --git a/pkgs/servers/cayley/deps.nix b/pkgs/servers/cayley/deps.nix
deleted file mode 100644
index d4ec2670365b0..0000000000000
--- a/pkgs/servers/cayley/deps.nix
+++ /dev/null
@@ -1,471 +0,0 @@
-# file generated from Gopkg.lock using dep2nix (https://github.com/nixcloud/dep2nix)
-[
-  {
-    goPackagePath  = "github.com/badgerodon/peg";
-    fetch = {
-      type = "git";
-      url = "https://github.com/badgerodon/peg";
-      rev =  "9e5f7f4d07ca576562618c23e8abadda278b684f";
-      sha256 = "12vd7hzdgknn8byz77lmvcrz9m5lvmffdnz2wwk83304przkra11";
-    };
-  }
-  {
-    goPackagePath  = "github.com/boltdb/bolt";
-    fetch = {
-      type = "git";
-      url = "https://github.com/boltdb/bolt";
-      rev =  "e9cf4fae01b5a8ff89d0ec6b32f0d9c9f79aefdd";
-      sha256 = "1sjxzz88bw0y37mk3xvwb9j5v7bz3r80rwg79jml6liqk1arnl99";
-    };
-  }
-  {
-    goPackagePath  = "github.com/cznic/mathutil";
-    fetch = {
-      type = "git";
-      url = "https://github.com/cznic/mathutil";
-      rev =  "1447ad269d64ca91aa8d7079baa40b6fc8b965e7";
-      sha256 = "1r9c20k2h65g38yxf3vd46nbayx1cz5w4q4yr1xfggcs0mmrb87i";
-    };
-  }
-  {
-    goPackagePath  = "github.com/davecgh/go-spew";
-    fetch = {
-      type = "git";
-      url = "https://github.com/davecgh/go-spew";
-      rev =  "346938d642f2ec3594ed81d874461961cd0faa76";
-      sha256 = "0d4jfmak5p6lb7n2r6yvf5p1zcw0l8j74kn55ghvr7zr7b7axm6c";
-    };
-  }
-  {
-    goPackagePath  = "github.com/dennwc/graphql";
-    fetch = {
-      type = "git";
-      url = "https://github.com/dennwc/graphql";
-      rev =  "12cfed44bc5de083875506a36d30f9798f9bca47";
-      sha256 = "1rfsxjjsik5618y2741lcyw56a4d4l6r04sbj1igrvcck9bz0k6a";
-    };
-  }
-  {
-    goPackagePath  = "github.com/dlclark/regexp2";
-    fetch = {
-      type = "git";
-      url = "https://github.com/dlclark/regexp2";
-      rev =  "902a5ce7a7812e2ba9f73b9d96c09d5136df39cd";
-      sha256 = "0ypmdayq50ilbmqa1wjq5nvs9igbxkzlc8phlknw244935wz3v15";
-    };
-  }
-  {
-    goPackagePath  = "github.com/dop251/goja";
-    fetch = {
-      type = "git";
-      url = "https://github.com/dop251/goja";
-      rev =  "ef8c030e3c96c5054c2f10ef925e7041e0583c07";
-      sha256 = "15419apwdpbl0lgnl9xj9wyl05vpiz6jqgj8zbcyxhzy0wycj445";
-    };
-  }
-  {
-    goPackagePath  = "github.com/fsnotify/fsnotify";
-    fetch = {
-      type = "git";
-      url = "https://github.com/fsnotify/fsnotify";
-      rev =  "4da3e2cfbabc9f751898f250b49f2439785783a1";
-      sha256 = "1y2l9jaf99j6gidcfdgq3hifxyiwv4f7awpll80p170ixdbqxvl3";
-    };
-  }
-  {
-    goPackagePath  = "github.com/go-kivik/couchdb";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-kivik/couchdb";
-      rev =  "74d231fe43245e77840213724894264f0f61ffd3";
-      sha256 = "0ga6d6y44wg8ync73wcyc7q7r3sr5vdj5qkn3yqn9yn4p0k2w89i";
-    };
-  }
-  {
-    goPackagePath  = "github.com/go-kivik/kivik";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-kivik/kivik";
-      rev =  "2a1f6b9dd407886bc59c0c28faed28fbce3b0ece";
-      sha256 = "0fpa62mriyiyl5dh5kg8858bqrwiwscpbkg9np69lk302znxalij";
-    };
-  }
-  {
-    goPackagePath  = "github.com/go-kivik/pouchdb";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-kivik/pouchdb";
-      rev =  "bbd1ab79be17c809842e193b1f84e924b6b599ba";
-      sha256 = "15kv6i94j73c8zzy5hnmf051d3i65wxc07hvass9lc4g5ad7f9vf";
-    };
-  }
-  {
-    goPackagePath  = "github.com/go-sourcemap/sourcemap";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-sourcemap/sourcemap";
-      rev =  "b019cc30c1eaa584753491b0d8f8c1534bf1eb44";
-      sha256 = "03k44fdrnknba05f7cd58lq4rzk7jdpiqksmc0wxrdzwschrbgw8";
-    };
-  }
-  {
-    goPackagePath  = "github.com/go-sql-driver/mysql";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-sql-driver/mysql";
-      rev =  "147bd02c2c516cf9a8878cb75898ee8a9eea0228";
-      sha256 = "0s75nilz1jx0vgc69jgmys95lsq9j9nfdjcc8inc8mhzh3qpjb74";
-    };
-  }
-  {
-    goPackagePath  = "github.com/gogo/protobuf";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gogo/protobuf";
-      rev =  "30433562cfbf487fe1df7cd26c7bab168d2f14d0";
-      sha256 = "155iv0jqgh0d8cykghw3ifwk8pjyyq1w4gr9khhf78n01k6180hj";
-    };
-  }
-  {
-    goPackagePath  = "github.com/golang/glog";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/glog";
-      rev =  "23def4e6c14b4da8ac2ed8007337bc5eb5007998";
-      sha256 = "0jb2834rw5sykfr937fxi8hxi2zy80sj2bdn9b3jb4b26ksqng30";
-    };
-  }
-  {
-    goPackagePath  = "github.com/golang/protobuf";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/protobuf";
-      rev =  "18c9bb3261723cd5401db4d0c9fbc5c3b6c70fe8";
-      sha256 = "0fbf8ymrcb23imkhlrlyq6i0x5w8gxzilljjsgd4hnvjgpgp3r4v";
-    };
-  }
-  {
-    goPackagePath  = "github.com/golang/snappy";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/snappy";
-      rev =  "553a641470496b2327abcac10b36396bd98e45c9";
-      sha256 = "0kssxnih1l722hx9219c7javganjqkqhvl3i0hp0hif6xm6chvqk";
-    };
-  }
-  {
-    goPackagePath  = "github.com/gopherjs/gopherjs";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gopherjs/gopherjs";
-      rev =  "558a9132744c22476178edf3126fd35a9754f565";
-      sha256 = "13mn0li83amgm4fgsm6l3shs2r4kjddr10xn0ydnr9ymg1y887vi";
-    };
-  }
-  {
-    goPackagePath  = "github.com/gopherjs/jsbuiltin";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gopherjs/jsbuiltin";
-      rev =  "67703bfb044e3192fbcab025c3aeaeedafad1f2f";
-      sha256 = "1k0df0z9fiyzbr1g1736zdp238j9z82q3gwkk060h2n84rg4c7lh";
-    };
-  }
-  {
-    goPackagePath  = "github.com/hashicorp/hcl";
-    fetch = {
-      type = "git";
-      url = "https://github.com/hashicorp/hcl";
-      rev =  "7fa7fff964d035e8a162cce3a164b3ad02ad651b";
-      sha256 = "0p3dyhpc0ajakcww3a45n750z2030xqhlswzf51d5rzid27681wp";
-    };
-  }
-  {
-    goPackagePath  = "github.com/imdario/mergo";
-    fetch = {
-      type = "git";
-      url = "https://github.com/imdario/mergo";
-      rev =  "0d4b488675fdec1dde48751b05ab530cf0b630e1";
-      sha256 = "071rram7aib70f3gk4ansgwns82w9i6m1px8mgc8x4rs9ana4qhf";
-    };
-  }
-  {
-    goPackagePath  = "github.com/inconshreveable/mousetrap";
-    fetch = {
-      type = "git";
-      url = "https://github.com/inconshreveable/mousetrap";
-      rev =  "76626ae9c91c4f2a10f34cad8ce83ea42c93bb75";
-      sha256 = "1mn0kg48xkd74brf48qf5hzp0bc6g8cf5a77w895rl3qnlpfw152";
-    };
-  }
-  {
-    goPackagePath  = "github.com/jackc/pgx";
-    fetch = {
-      type = "git";
-      url = "https://github.com/jackc/pgx";
-      rev =  "606697ffdfe6603013560dbc171656de57b4f542";
-      sha256 = "0818yb2vjjwwmscdab7wnxbyiabvy544icdczdlr5kswbqq5h25m";
-    };
-  }
-  {
-    goPackagePath  = "github.com/julienschmidt/httprouter";
-    fetch = {
-      type = "git";
-      url = "https://github.com/julienschmidt/httprouter";
-      rev =  "6f3f3919c8781ce5c0509c83fffc887a7830c938";
-      sha256 = "1hmqdpv2zywwglmnjnxfn27mkac81n3nqs1wandlpybsww4vn4kx";
-    };
-  }
-  {
-    goPackagePath  = "github.com/lib/pq";
-    fetch = {
-      type = "git";
-      url = "https://github.com/lib/pq";
-      rev =  "2704adc878c21e1329f46f6e56a1c387d788ff94";
-      sha256 = "160fmvi7bczxw3i3h5s821hv029ph5ld8x3c36b4cz2sr30wp110";
-    };
-  }
-  {
-    goPackagePath  = "github.com/linkeddata/gojsonld";
-    fetch = {
-      type = "git";
-      url = "https://github.com/linkeddata/gojsonld";
-      rev =  "4f5db6791326b8962ede4edbba693edcf20fd1ad";
-      sha256 = "11g1kygkn55whaf49q2bzxk0w8b3nhdhiaixsj2ik65j8bl9g2cq";
-    };
-  }
-  {
-    goPackagePath  = "github.com/magiconair/properties";
-    fetch = {
-      type = "git";
-      url = "https://github.com/magiconair/properties";
-      rev =  "51463bfca2576e06c62a8504b5c0f06d61312647";
-      sha256 = "0d7hr78y8gg2mrm5z4jjgm2w3awkznz383b7wvyzk3l33jw6i288";
-    };
-  }
-  {
-    goPackagePath  = "github.com/mitchellh/mapstructure";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mitchellh/mapstructure";
-      rev =  "cc8532a8e9a55ea36402aa21efdf403a60d34096";
-      sha256 = "0705c0hq7b993sabnjy65yymvpy9w1j84bg9bjczh5607z16nw86";
-    };
-  }
-  {
-    goPackagePath  = "github.com/pborman/uuid";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pborman/uuid";
-      rev =  "1b00554d822231195d1babd97ff4a781231955c9";
-      sha256 = "0rjkcf85sagdwzsycj1bbjyx5bgmrc1i8l5qf1f44z24rhbbkaan";
-    };
-  }
-  {
-    goPackagePath  = "github.com/pelletier/go-buffruneio";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pelletier/go-buffruneio";
-      rev =  "c37440a7cf42ac63b919c752ca73a85067e05992";
-      sha256 = "0l83p1gg6g5mmhmxjisrhfimhbm71lwn1r2w7d6siwwqm9q08sd2";
-    };
-  }
-  {
-    goPackagePath  = "github.com/pelletier/go-toml";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pelletier/go-toml";
-      rev =  "fe206efb84b2bc8e8cfafe6b4c1826622be969e3";
-      sha256 = "1dlabfpnlzvwf4i86idy8ilqpjsl8yqfgdv0nv5cccm8gkcans5w";
-    };
-  }
-  {
-    goPackagePath  = "github.com/peterh/liner";
-    fetch = {
-      type = "git";
-      url = "https://github.com/peterh/liner";
-      rev =  "88609521dc4b6c858fd4c98b628147da928ce4ac";
-      sha256 = "0jacb2fqgiccb98v1875j5xvj01l1z2laga1kgr8lhd0nl22r96k";
-    };
-  }
-  {
-    goPackagePath  = "github.com/pkg/errors";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pkg/errors";
-      rev =  "e881fd58d78e04cf6d0de1217f8707c8cc2249bc";
-      sha256 = "0vfhj598jp6dzy4pbyjdrqxzb5kppw8ggvfh78g80nz11r34xnzs";
-    };
-  }
-  {
-    goPackagePath  = "github.com/pmezard/go-difflib";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pmezard/go-difflib";
-      rev =  "d8ed2627bdf02c080bf22230dbb337003b7aba2d";
-      sha256 = "0w1jp4k4zbnrxh3jvh8fgbjgqpf2hg31pbj8fb32kh26px9ldpbs";
-    };
-  }
-  {
-    goPackagePath  = "github.com/russross/blackfriday";
-    fetch = {
-      type = "git";
-      url = "https://github.com/russross/blackfriday";
-      rev =  "b253417e1cb644d645a0a3bb1fa5034c8030127c";
-      sha256 = "1knj8vabymhmkg12cj3hnpqf3b74wwrvqib12yczcvpi52xaqi20";
-    };
-  }
-  {
-    goPackagePath  = "github.com/shurcooL/sanitized_anchor_name";
-    fetch = {
-      type = "git";
-      url = "https://github.com/shurcooL/sanitized_anchor_name";
-      rev =  "79c90efaf01eddc01945af5bc1797859189b830b";
-      sha256 = "1dj8v91gv1ssw2j88gjzr1hw0n63qqxykjzfbvspyi529xn3ji3y";
-    };
-  }
-  {
-    goPackagePath  = "github.com/spf13/afero";
-    fetch = {
-      type = "git";
-      url = "https://github.com/spf13/afero";
-      rev =  "9be650865eab0c12963d8753212f4f9c66cdcf12";
-      sha256 = "12dhh6d07304lsjv7c4p95hkip0hnshqhwivdw39pbypgg0p8y34";
-    };
-  }
-  {
-    goPackagePath  = "github.com/spf13/cast";
-    fetch = {
-      type = "git";
-      url = "https://github.com/spf13/cast";
-      rev =  "acbeb36b902d72a7a4c18e8f3241075e7ab763e4";
-      sha256 = "0w25s6gjbbwv47b9208hysyqqphd6pib3d2phg24mjy4wigkm050";
-    };
-  }
-  {
-    goPackagePath  = "github.com/spf13/cobra";
-    fetch = {
-      type = "git";
-      url = "https://github.com/spf13/cobra";
-      rev =  "7b1b6e8dc027253d45fc029bc269d1c019f83a34";
-      sha256 = "1nhnlpmbqq1ggix7jaxmzr8awk1zrrzag4vzq1p5q5l25d6kih35";
-    };
-  }
-  {
-    goPackagePath  = "github.com/spf13/jwalterweatherman";
-    fetch = {
-      type = "git";
-      url = "https://github.com/spf13/jwalterweatherman";
-      rev =  "fa7ca7e836cf3a8bb4ebf799f472c12d7e903d66";
-      sha256 = "0404b7bzx7cq1b2bgdb3gs7gjzm4vvg1hl2y9mcm4m6vz56vbcz8";
-    };
-  }
-  {
-    goPackagePath  = "github.com/spf13/pflag";
-    fetch = {
-      type = "git";
-      url = "https://github.com/spf13/pflag";
-      rev =  "f1d95a35e132e8a1868023a08932b14f0b8b8fcb";
-      sha256 = "0fwvkyq36jvy2gid81031ll7qaj8jxr5g36fff7hhkp3hh4kz6zh";
-    };
-  }
-  {
-    goPackagePath  = "github.com/spf13/viper";
-    fetch = {
-      type = "git";
-      url = "https://github.com/spf13/viper";
-      rev =  "0967fc9aceab2ce9da34061253ac10fb99bba5b2";
-      sha256 = "016syis0rvccp2indjqi1vnz3wk7c9dhkvkgam0j79sb019kl80f";
-    };
-  }
-  {
-    goPackagePath  = "github.com/stretchr/testify";
-    fetch = {
-      type = "git";
-      url = "https://github.com/stretchr/testify";
-      rev =  "87b1dfb5b2fa649f52695dd9eae19abe404a4308";
-      sha256 = "1iyfxs3nxdn1fyfqv3gggxcxab66a3m6cmjkhqhcapxm3qvgbrlc";
-    };
-  }
-  {
-    goPackagePath  = "github.com/syndtr/goleveldb";
-    fetch = {
-      type = "git";
-      url = "https://github.com/syndtr/goleveldb";
-      rev =  "b89cc31ef7977104127d34c1bd31ebd1a9db2199";
-      sha256 = "0pbmssaw7fsgspv0jr3hsd1208qqxcvy4faks9hypqgl5gwday4p";
-    };
-  }
-  {
-    goPackagePath  = "github.com/tylertreat/BoomFilters";
-    fetch = {
-      type = "git";
-      url = "https://github.com/tylertreat/BoomFilters";
-      rev =  "37e169ae37ed529d93ecacb509c0dc80078478fc";
-      sha256 = "15wwdsxxvkgxbxv3v0ywnwjwndpmps49n3a49z7bzjl7r2nsm7qv";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/net";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/net";
-      rev =  "da118f7b8e5954f39d0d2130ab35d4bf0e3cb344";
-      sha256 = "09xpndqc6a2r0lw42cyl1pkhfddl01sd9c3qqjjwp3vmxm004whv";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/sys";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/sys";
-      rev =  "9ccfe848b9db8435a24c424abbc07a921adf1df5";
-      sha256 = "0wn3p7nrf9lx5svnya5mxy5b8cxqs2rp8lxc477szna313m1jhs4";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/text";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/text";
-      rev =  "470f45bf29f4147d6fbd7dfd0a02a848e49f5bf4";
-      sha256 = "1yzh1qxwd0xkh0k04hwp7yii21i26b4ngxvm1g98qlji1g2wbjbc";
-    };
-  }
-  {
-    goPackagePath  = "google.golang.org/appengine";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/appengine";
-      rev =  "170382fa85b10b94728989dfcf6cc818b335c952";
-      sha256 = "0dqx24qc7h53p16xnkwn2jpk3wjjlvv48akqk74vx31pr2nn0g56";
-    };
-  }
-  {
-    goPackagePath  = "gopkg.in/mgo.v2";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-mgo/mgo";
-      rev =  "3f83fa5005286a7fe593b055f0d7771a7dce4655";
-      sha256 = "19vwb6qlcyh3nh6pkk0bynwmr5cmi6mm4hdz01lwb4ybnkzxryc7";
-    };
-  }
-  {
-    goPackagePath  = "gopkg.in/olivere/elastic.v5";
-    fetch = {
-      type = "git";
-      url = "https://github.com/olivere/elastic";
-      rev =  "79ff368708b3a2a9da641dc831d95fd0782bf4ef";
-      sha256 = "1lq8nhjnkf246nl5h40ldh1qz2yx73yaqfmsh9ddvkwn4173c7jj";
-    };
-  }
-  {
-    goPackagePath  = "gopkg.in/yaml.v2";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-yaml/yaml";
-      rev =  "cd8b52f8269e0feb286dfeef29f8fe4d5b397e0b";
-      sha256 = "1hj2ag9knxflpjibck0n90jrhsrqz7qvad4qnif7jddyapi9bqzl";
-    };
-  }
-]
diff --git a/pkgs/servers/confluencepot/default.nix b/pkgs/servers/confluencepot/default.nix
new file mode 100644
index 0000000000000..242e2b93d7ad9
--- /dev/null
+++ b/pkgs/servers/confluencepot/default.nix
@@ -0,0 +1,44 @@
+{ lib
+, stdenv
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "confluencepot";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "SIFalcon";
+    repo = "confluencePot";
+    rev = "v${version}";
+    hash = "sha256-jIbL6prOUII8o9FghIYa80BytJ9SSuyj/TZmAxwAbJk=";
+  };
+
+  vendorSha256 = "sha256-nzPHx+c369T4h9KETqMurxZK3LsJAhwBaunkcWIW3Ps=";
+
+  postPatch = ''
+    substituteInPlace confluencePot.go \
+      --replace "confluence.html" "$out/share/confluence.html"
+  '';
+
+  postInstall = lib.optionalString (!stdenv.isDarwin) ''
+    mv $out/bin/confluencePot $out/bin/${pname}
+  '';
+
+  preFixup = ''
+    # Install HTML file
+    install -vD confluence.html -t $out/share
+  '';
+
+  meta = with lib; {
+    description = "Honeypot for the Atlassian Confluence OGNL injection vulnerability";
+    homepage = "https://github.com/SIFalcon/confluencePot";
+    longDescription = ''
+      ConfluencePot is a simple honeypot for the Atlassian Confluence unauthenticated
+      and remote OGNL injection vulnerability (CVE-2022-26134).
+    '';
+    license = with licenses; [ agpl3Plus ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/servers/dns/coredns/default.nix b/pkgs/servers/dns/coredns/default.nix
index c93d1235ea821..54965fd998aa6 100644
--- a/pkgs/servers/dns/coredns/default.nix
+++ b/pkgs/servers/dns/coredns/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "coredns";
-  version = "1.9.2";
+  version = "1.9.3";
 
   src = fetchFromGitHub {
     owner = "coredns";
     repo = "coredns";
     rev = "v${version}";
-    sha256 = "sha256-6ABcXRuPEkzhjVZcltPoWGAc+fs6FwmgQCMRuLmhXxo=";
+    sha256 = "sha256-9lRZjY85SD1HXAWVCp8fpzV0d1Y+LbodT3Sp21CNp+k=";
   };
 
-  vendorSha256 = "sha256-0S77748voNlIuY6yUAa669pB09h35THojCyQKUm5VFc=";
+  vendorSha256 = "sha256-gNa+dm7n71IiSCztTO5VZ5FnGTGYfNXo/HMichNzek0=";
 
   postPatch = ''
     substituteInPlace test/file_cname_proxy_test.go \
diff --git a/pkgs/servers/geospatial/geoserver/default.nix b/pkgs/servers/geospatial/geoserver/default.nix
new file mode 100644
index 0000000000000..0fc184e063e54
--- /dev/null
+++ b/pkgs/servers/geospatial/geoserver/default.nix
@@ -0,0 +1,38 @@
+{ lib, stdenv, fetchurl, unzip, jre, makeWrapper }:
+
+stdenv.mkDerivation rec {
+  pname = "geoserver";
+  version = "2.21.0";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/geoserver/GeoServer/${version}/geoserver-${version}-bin.zip";
+    sha256 = "sha256-UCr22Ffhnux6eA0w5qoaf5Hvuypsl/FGpK+emi8G0Mc=";
+  };
+
+  sourceRoot = ".";
+  nativeBuildInputs = [ unzip makeWrapper ];
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/share/geoserver
+    cp -r . $out/share/geoserver
+    rm -fr $out/share/geoserver/bin/*.bat
+
+    makeWrapper $out/share/geoserver/bin/startup.sh $out/bin/geoserver-startup \
+      --set JAVA_HOME "${jre}" \
+      --set GEOSERVER_HOME "$out/share/geoserver"
+    makeWrapper $out/share/geoserver/bin/shutdown.sh $out/bin/geoserver-shutdown \
+      --set JAVA_HOME "${jre}" \
+      --set GEOSERVER_HOME "$out/share/geoserver"
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Open source server for sharing geospatial data";
+    homepage = "https://geoserver.org/";
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ sikmir ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/servers/gpm/default.nix b/pkgs/servers/gpm/default.nix
index f132f98344a99..66c6607e64721 100644
--- a/pkgs/servers/gpm/default.nix
+++ b/pkgs/servers/gpm/default.nix
@@ -27,6 +27,14 @@ stdenv.mkDerivation rec {
       url = "https://github.com/kaction/gpm/commit/217b4fe4c9b62298a4e9a54c1f07e3b52b013a09.patch";
       sha256 = "1f74h12iph4z1dldbxk9imcq11805c3ai2xhbsqvx8jpjrcfp19q";
     })
+
+    # Pull fix pending upstream inclusion to fix parallel installation:
+    #   https://github.com/telmich/gpm/pull/43
+    (fetchpatch {
+      name = "parallel-install.patch";
+      url = "https://github.com/telmich/gpm/commit/a88fb82a7afe96e872bb31c554e9ad5888f5a451.patch";
+      sha256 = "0g1jhz9bjw7vqjv922xkhs8xkjxdqh11nj38jj3c8nv5lcil76nx";
+    })
   ];
   preConfigure = ''
     ./autogen.sh
@@ -38,6 +46,8 @@ stdenv.mkDerivation rec {
     (if ncurses == null then "--without-curses" else "--with-curses")
   ];
 
+  enableParallelBuilding = true;
+
   # Provide libgpm.so for compatability
   postInstall = ''
     ln -sv $out/lib/libgpm.so.2 $out/lib/libgpm.so
diff --git a/pkgs/servers/heisenbridge/default.nix b/pkgs/servers/heisenbridge/default.nix
index 3d4ef94dda490..82599cdcbaa58 100644
--- a/pkgs/servers/heisenbridge/default.nix
+++ b/pkgs/servers/heisenbridge/default.nix
@@ -1,13 +1,13 @@
 { lib, fetchFromGitHub, fetchpatch, python3 }:
 python3.pkgs.buildPythonApplication rec {
   pname = "heisenbridge";
-  version = "1.13.0";
+  version = "1.13.1";
 
   src = fetchFromGitHub {
     owner = "hifi";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-3YCYLhJqZAWIwpwOd8J1+uYsxw0q6jQy35Vp+ttVKhI=";
+    sha256 = "sha256-sgZql9373xKT7Hi8M5TIZTOkS2AOFoKA1DXYa2f2IkA=";
   };
 
   postPatch = ''
diff --git a/pkgs/servers/interlock/default.nix b/pkgs/servers/interlock/default.nix
index e151c9ec45e36..1fbe7444491c5 100644
--- a/pkgs/servers/interlock/default.nix
+++ b/pkgs/servers/interlock/default.nix
@@ -1,27 +1,28 @@
-{ sudo, coreutils, systemd, cryptsetup
-, mount, umount
-, buildGoPackage, fetchFromGitHub }:
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, coreutils
+, cryptsetup
+, mount
+, systemd
+, umount
+}:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "interlock";
-  version = "2016.04.13";
-  rev = "v${version}";
-
-  goPackagePath = "github.com/inversepath/interlock";
-
-  subPackages = [ "./cmd/interlock" ];
+  version = "2020.03.05";
 
   src = fetchFromGitHub {
-    inherit rev;
-    owner = "inversepath";
+    owner = "usbarmory";
     repo = "interlock";
-    sha256 = "06aqx3jy744yx29xyg8ips0dw16186hfqbxdv3hfrmwxmaxhl4lz";
+    rev = "v${version}";
+    sha256 = "sha256-YXa4vErt3YnomTKAXCv8yUVhcc0ST47n9waW5E8QZzY=";
   };
 
-  goDeps = ./deps.nix;
+  vendorSha256 = "sha256-OL6I95IpyTIc8wCwD9nWxVUTrmZH6COhsd/YwNTyvN0=";
+
+  ldflags = [ "-s" "-w" ];
 
-  nativeBuildInputs = [ sudo ];
-  tags = [ "textsecure" ];
   postPatch = ''
     grep -lr '/s\?bin/' | xargs sed -i \
       -e 's|/bin/mount|${mount}/bin/mount|' \
@@ -34,4 +35,19 @@ buildGoPackage rec {
       -e 's|/usr/bin/sudo|/run/wrappers/bin/sudo|' \
       -e 's|/sbin/cryptsetup|${cryptsetup}/bin/cryptsetup|'
   '';
+
+  postInstall = ''
+    mkdir -p $out/share
+    cp -R $src/static $out/share
+  '';
+
+  # Tests are broken due to an error during key generation.
+  doCheck = false;
+
+  meta = with lib; {
+    homepage = "https://github.com/usbarmory/interlock";
+    description = "File encryption tool and an HSM frontend";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+  };
 }
diff --git a/pkgs/servers/interlock/deps.nix b/pkgs/servers/interlock/deps.nix
deleted file mode 100644
index be5c05295731d..0000000000000
--- a/pkgs/servers/interlock/deps.nix
+++ /dev/null
@@ -1,65 +0,0 @@
-[
-  {
-    goPackagePath = "gopkg.in/yaml.v2";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/yaml.v2";
-      rev = "a83829b6f1293c91addabc89d0571c246397bbf4";
-      sha256 = "1m4dsmk90sbi17571h6pld44zxz7jc4lrnl4f27dpd1l8g5xvjhh";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/crypto";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/crypto";
-      rev = "575fdbe86e5dd89229707ebec0575ce7d088a4a6";
-      sha256 = "1kgv1mkw9y404pk3lcwbs0vgl133mwyp294i18jg9hp10s5d56xa";
-    };
-  }
-  {
-    goPackagePath = "github.com/Sirupsen/logrus";
-    fetch = {
-      type = "git";
-      url = "https://github.com/Sirupsen/logrus";
-      rev = "be52937128b38f1d99787bb476c789e2af1147f1";
-      sha256 = "1m6vvd4pg4lwglhk54lv5mf6cc8h7bi0d9zb3gar4crz531r66y4";
-    };
-  }
-  {
-    goPackagePath = "github.com/agl/ed25519";
-    fetch = {
-      type = "git";
-      url = "https://github.com/agl/ed25519";
-      rev = "278e1ec8e8a6e017cd07577924d6766039146ced";
-      sha256 = "165d89cc6dl28j4hkn86pny0jz3sa6hamzdvpvwdj4iha3x6lzc9";
-    };
-  }
-  {
-    goPackagePath = "github.com/golang/protobuf";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/protobuf";
-      rev = "59b73b37c1e45995477aae817e4a653c89a858db";
-      sha256 = "1dx22jvhvj34ivpr7gw01fncg9yyx35mbpal4mpgnqka7ajmgjsa";
-    };
-  }
-  {
-    goPackagePath = "github.com/janimo/textsecure";
-    fetch = {
-      type = "git";
-      url = "https://github.com/janimo/textsecure";
-      rev = "c38f429e48d6b2776d17b4171f216f132185b0f6";
-      sha256 = "191pwgfgphr0x04dwpvniax4wilpv52l25bw7d3igvnw302y7i94";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/net";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/net";
-      rev = "62ac18b461605b4be188bbc7300e9aa2bc836cd4";
-      sha256 = "0lwwvbbwbf3yshxkfhn6z20gd45dkvnmw2ms36diiy34krgy402p";
-    };
-  }
-]
diff --git a/pkgs/servers/mail/mlmmj/default.nix b/pkgs/servers/mail/mlmmj/default.nix
index 89e142b04f983..aba0664b8f4fd 100644
--- a/pkgs/servers/mail/mlmmj/default.nix
+++ b/pkgs/servers/mail/mlmmj/default.nix
@@ -10,6 +10,12 @@ stdenv.mkDerivation rec {
     sha256 = "1sghqvwizvm1a9w56r34qy5njaq1c26bagj85r60h32gh3fx02bn";
   };
 
+  configureFlags = lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    # AC_FUNC_MALLOC is broken on cross builds.
+    "ac_cv_func_malloc_0_nonnull=yes"
+    "ac_cv_func_realloc_0_nonnull=yes"
+  ];
+
   # Workaround build failure on -fno-common toolchains like upstream
   # gcc-10. Otherwise build fails as:
   #   ld: getlistdelim.o:/build/mlmmj-1.3.0/src/../include/mlmmj.h:84: multiple definition of
diff --git a/pkgs/servers/monitoring/cadvisor/default.nix b/pkgs/servers/monitoring/cadvisor/default.nix
index 760bed7b9371b..73fe3ed1192d3 100644
--- a/pkgs/servers/monitoring/cadvisor/default.nix
+++ b/pkgs/servers/monitoring/cadvisor/default.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "cadvisor";
-  version = "0.40.0";
+  version = "0.44.1";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "cadvisor";
     rev = "v${version}";
-    sha256 = "sha256-8HOaKjdATVZpyx4yLf7xefz+jiOEqmkWiZnA3DOyT50=";
+    sha256 = "sha256-OVUKQGP9zzlzoC/25BHNbJuP6ELstBMaRFAzUnDSR0U=";
   };
 
   modRoot = "./cmd";
 
-  vendorSha256 = "sha256-+nrXD0hQ3zBwTTq9xoBqO3ho4s4tf8uZQz2wL1nYi/k=";
+  vendorSha256 = "sha256-LGMouB76GT/ZvG3kLoo/jmnHT0CEeND9pObTOKaS9T0=";
 
   ldflags = [ "-s" "-w" "-X github.com/google/cadvisor/version.Version=${version}" ];
 
diff --git a/pkgs/servers/monitoring/grafana/default.nix b/pkgs/servers/monitoring/grafana/default.nix
index 46c80120daa95..87430bda86d78 100644
--- a/pkgs/servers/monitoring/grafana/default.nix
+++ b/pkgs/servers/monitoring/grafana/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "grafana";
-  version = "9.0.0";
+  version = "9.0.1";
 
   excludedPackages = [ "alert_webhook_listener" "clean-swagger" "release_publisher" "slow_proxy" "slow_proxy_mac" "macaron" "devenv" ];
 
@@ -10,15 +10,15 @@ buildGoModule rec {
     rev = "v${version}";
     owner = "grafana";
     repo = "grafana";
-    sha256 = "sha256-vPPaOepx4uwOWOjeE+dWULxmJPk5To9UY3rnoEqeAJA=";
+    sha256 = "sha256-+03bfSpUT5sb0oFf9BomglcVb5bRqAwZ1MKCPmRtAss=";
   };
 
   srcStatic = fetchurl {
     url = "https://dl.grafana.com/oss/release/grafana-${version}.linux-amd64.tar.gz";
-    sha256 = "0xl5z31mkgbwkwcpvr0v0hmc0ynvxjn39w4sb1vc572kjbwqpvkr";
+    sha256 = "1kw9l3gip4lqfrc0asgsd1lf5sxa7zj67isyvhb14qdsf9rs3b2d";
   };
 
-  vendorSha256 = "sha256-E3uSwdgoPgQPQ/uCIuTxcYeNRYbQR7q7SrUrh/ypENk=";
+  vendorSha256 = "sha256-eB0SswtqAb0xoLcq021KaH4CdgLbWmhODyifQDVl5XI=";
 
   nativeBuildInputs = [ wire ];
 
diff --git a/pkgs/servers/nosql/mongodb/patches/mongodb-4.0-glibc-2.34.patch b/pkgs/servers/nosql/mongodb/patches/mongodb-4.0-glibc-2.34.patch
new file mode 100644
index 0000000000000..f5c4a5c354085
--- /dev/null
+++ b/pkgs/servers/nosql/mongodb/patches/mongodb-4.0-glibc-2.34.patch
@@ -0,0 +1,14 @@
+--- a/src/mongo/stdx/thread.h
++++ b/src/mongo/stdx/thread.h
+@@ -103,10 +103,7 @@ private:
+     //   .                     N   Y :      4,344 |  13,048 |     7,352
+     //   .                     Y   Y :      4,424 |  13,672 |     8,392
+     //   ( https://jira.mongodb.org/secure/attachment/233569/233569_stacktrace-writeup.txt )
+-    static constexpr std::size_t kMongoMinSignalStackSize = std::size_t{64} << 10;
+-
+-    static constexpr std::size_t kStackSize =
+-        std::max(kMongoMinSignalStackSize, std::size_t{MINSIGSTKSZ});
++    static constexpr std::size_t kStackSize = std::size_t{64} << 10;
+     std::unique_ptr<char[]> _stackStorage = std::make_unique<char[]>(kStackSize);
+
+ #else   // !MONGO_HAS_SIGALTSTACK
\ No newline at end of file
diff --git a/pkgs/servers/nosql/mongodb/v4_0.nix b/pkgs/servers/nosql/mongodb/v4_0.nix
index 24349686fbec8..9d28a9185ba13 100644
--- a/pkgs/servers/nosql/mongodb/v4_0.nix
+++ b/pkgs/servers/nosql/mongodb/v4_0.nix
@@ -1,4 +1,4 @@
-{ stdenv, callPackage, lib, sasl, boost, Security, CoreFoundation, cctools }:
+{ stdenv, callPackage, fetchpatch, lib, sasl, boost, Security, CoreFoundation, cctools }:
 
 let
   buildMongoDB = callPackage ./mongodb.nix {
@@ -11,7 +11,15 @@ let
 in buildMongoDB {
   version = "4.0.27";
   sha256 = "sha256-ct33mnK4pszhYM4Is7j0GZQRyi8i8Qmy0wcklyq5LjM=";
-  patches =
-    [ ./forget-build-dependencies.patch ./mozjs-45_fix-3-byte-opcode.patch ]
+  patches = [
+    ./forget-build-dependencies.patch
+    ./mozjs-45_fix-3-byte-opcode.patch
+    ./patches/mongodb-4.0-glibc-2.34.patch # https://github.com/NixOS/nixpkgs/issues/171928
+    (fetchpatch {
+      name = "mongodb-4.4.1-gcc11.patch";
+      url = "https://raw.githubusercontent.com/gentoo/gentoo/7168257cad6ea7c4856b01c5703d0ed5b764367c/dev-db/mongodb/files/mongodb-4.4.1-gcc11.patch";
+      sha256 = "sha256-RvfCP462RG+ZVjcb23DgCuxCdfPl2/UgH8N7FgCghGI=";
+    })
+  ]
     ++ lib.optionals stdenv.isDarwin [ ./asio-no-experimental-string-view.patch ];
 }
diff --git a/pkgs/servers/nosql/mongodb/v4_2.nix b/pkgs/servers/nosql/mongodb/v4_2.nix
index 3759cc1e6d585..53b73b510e3ad 100644
--- a/pkgs/servers/nosql/mongodb/v4_2.nix
+++ b/pkgs/servers/nosql/mongodb/v4_2.nix
@@ -1,4 +1,4 @@
-{ stdenv, callPackage, lib, sasl, boost, Security, CoreFoundation, cctools }:
+{ stdenv, callPackage, fetchpatch, lib, sasl, boost, Security, CoreFoundation, cctools }:
 
 let
   buildMongoDB = callPackage ./mongodb.nix {
@@ -11,7 +11,12 @@ let
 in buildMongoDB {
   version = "4.2.19";
   sha256 = "sha256-fngTHd+fSdHqiqQYOYS7o6P5eHybeZy3iNKkGzFmjTw=";
-  patches =
-    [ ./forget-build-dependencies-4-2.patch ]
-    ++ lib.optionals stdenv.isDarwin [ ./asio-no-experimental-string-view-4-2.patch ];
+  patches = [
+    ./forget-build-dependencies-4-2.patch
+    (fetchpatch {
+      name = "mongodb-4.4.1-gcc11.patch";
+      url = "https://raw.githubusercontent.com/gentoo/gentoo/7168257cad6ea7c4856b01c5703d0ed5b764367c/dev-db/mongodb/files/mongodb-4.4.1-gcc11.patch";
+      sha256 = "sha256-RvfCP462RG+ZVjcb23DgCuxCdfPl2/UgH8N7FgCghGI=";
+    })
+  ] ++ lib.optionals stdenv.isDarwin [ ./asio-no-experimental-string-view-4-2.patch ];
 }
diff --git a/pkgs/servers/nosql/riak/2.2.0.nix b/pkgs/servers/nosql/riak/2.2.0.nix
deleted file mode 100644
index 102d69f82b40d..0000000000000
--- a/pkgs/servers/nosql/riak/2.2.0.nix
+++ /dev/null
@@ -1,106 +0,0 @@
-{ stdenv, lib, fetchurl, unzip, erlang, which, pam, nixosTests }:
-
-let
-  solrName = "solr-4.10.4-yz-2.tgz";
-  yokozunaJarName = "yokozuna-3.jar";
-  yzMonitorJarName = "yz_monitor-1.jar";
-
-  srcs = {
-    riak = fetchurl {
-      url = "https://s3.amazonaws.com/downloads.basho.com/riak/2.2/2.2.0/riak-2.2.0.tar.gz";
-      sha256 = "0kl28bpyzajcllybili46jfr1schl45w5ysii187jr0ssgls2c9p";
-    };
-    solr = fetchurl {
-      url = "http://s3.amazonaws.com/files.basho.com/solr/${solrName}";
-      sha256 = "0fy5slnldn628gmr2kilyx606ph0iykf7pz6j0xjcc3wqvrixa2a";
-    };
-    yokozunaJar = fetchurl {
-      url = "http://s3.amazonaws.com/files.basho.com/yokozuna/${yokozunaJarName}";
-      sha256 = "17n6m100fz8affdcxsn4niw2lrpnswgfnd6aszgzipffwbg7v8v5";
-    };
-    yzMonitorJar = fetchurl {
-      url = "http://s3.amazonaws.com/files.basho.com/yokozuna/${yzMonitorJarName}";
-      sha256 = "0kb97d1a43vw759j1h5qwbhx455pidn2pi7sfxijqic37h81ri1m";
-    };
-  };
-in
-
-stdenv.mkDerivation {
-  pname = "riak";
-  version = "2.2.0";
-
-  nativeBuildInputs = [ unzip ];
-  buildInputs = [
-    which erlang pam
-  ];
-
-  src = srcs.riak;
-
-  hardeningDisable = [ "format" ];
-
-  postPatch = ''
-    sed -i deps/node_package/priv/base/env.sh \
-      -e 's@{{platform_data_dir}}@''${RIAK_DATA_DIR:-/var/db/riak}@' \
-      -e 's@^RUNNER_SCRIPT_DIR=.*@RUNNER_SCRIPT_DIR='$out'/bin@' \
-      -e 's@^RUNNER_BASE_DIR=.*@RUNNER_BASE_DIR='$out'@' \
-      -e 's@^RUNNER_ETC_DIR=.*@RUNNER_ETC_DIR=''${RIAK_ETC_DIR:-/etc/riak}@' \
-      -e 's@^RUNNER_LOG_DIR=.*@RUNNER_LOG_DIR=''${RIAK_LOG_DIR:-/var/log}@'
-  '';
-
-  preBuild = ''
-    mkdir solr-pkg
-    cp ${srcs.solr} solr-pkg/${solrName}
-    export SOLR_PKG_DIR=$(readlink -f solr-pkg)
-
-    mkdir -p deps/yokozuna/priv/java_lib
-    cp ${srcs.yokozunaJar} deps/yokozuna/priv/java_lib/${yokozunaJarName}
-
-    mkdir -p deps/yokozuna/priv/solr/lib/ext
-    cp ${srcs.yzMonitorJar} deps/yokozuna/priv/solr/lib/ext/${yzMonitorJarName}
-
-    patchShebangs .
-  '';
-
-  buildPhase = ''
-    runHook preBuild
-
-    make locked-deps
-    make rel
-
-    runHook postBuild
-  '';
-
-  doCheck = false;
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir $out
-    mv rel/riak/etc rel/riak/riak-etc
-    mkdir -p rel/riak/etc
-    mv rel/riak/riak-etc rel/riak/etc/riak
-    mv rel/riak/* $out
-
-    for prog in $out/bin/*; do
-      substituteInPlace $prog \
-        --replace '. "`cd \`dirname $0\` && /bin/pwd`/../lib/env.sh"' \
-                  ". $out/lib/env.sh"
-    done
-
-    runHook postInstall
-  '';
-
-  passthru.tests = { inherit (nixosTests) riak; };
-
-  meta = with lib; {
-    maintainers = with maintainers; [ cstrahan mdaiter ];
-    description = "Dynamo inspired NoSQL DB by Basho";
-    platforms   = [ "x86_64-linux" ];
-    sourceProvenance = with sourceTypes; [
-      fromSource
-      binaryBytecode  # dependencies
-    ];
-    license     = licenses.asl20;
-    knownVulnerabilities = [ "CVE-2017-3163 - see https://github.com/NixOS/nixpkgs/issues/33876" ];
-  };
-}
diff --git a/pkgs/servers/plex/raw.nix b/pkgs/servers/plex/raw.nix
index fd6adfe65a981..87e36134acbba 100644
--- a/pkgs/servers/plex/raw.nix
+++ b/pkgs/servers/plex/raw.nix
@@ -12,16 +12,16 @@
 # server, and the FHS userenv and corresponding NixOS module should
 # automatically pick up the changes.
 stdenv.mkDerivation rec {
-  version = "1.27.0.5897-3940636f2";
+  version = "1.27.1.5916-6b0e31a64";
   pname = "plexmediaserver";
 
   # Fetch the source
   src = if stdenv.hostPlatform.system == "aarch64-linux" then fetchurl {
     url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_arm64.deb";
-    sha256 = "1ibahbz276diji66m5w059a1h9crva92r83w6av1dfq44v298s77";
+    sha256 = "0cyx83a64vdq68qknsscdnawx9lcyr5siiwys2gc9gnxm6sv8x82";
   } else fetchurl {
     url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_amd64.deb";
-    sha256 = "119nmmjpca05d6vzhy3xipgca9k51ps8252vcgdsp080dh7nk2kp";
+    sha256 = "0v5gkk0izqkma9m4gvqyx94mij4jvv8vdv6897r7v8xqg9wji24l";
   };
 
   outputs = [ "out" "basedb" ];
diff --git a/pkgs/servers/serf/default.nix b/pkgs/servers/serf/default.nix
index 8964796862ce6..da1bf0770fd03 100644
--- a/pkgs/servers/serf/default.nix
+++ b/pkgs/servers/serf/default.nix
@@ -1,23 +1,43 @@
-{ lib, buildGoPackage, fetchFromGitHub }:
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "serf";
-  version = "0.8.1";
-  rev = "v${version}";
-
-  goPackagePath = "github.com/hashicorp/serf";
+  version = "0.9.8";
+  rev = "a2bba5676d6e37953715ea10e583843793a0c507";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = "serf";
-    inherit rev;
-    sha256 = "1arakjvhyasrk52vhxas2ghlrby3i3wj59r7sjrkbpln2cdbqnlx";
+    rev = "v${version}";
+    sha256 = "sha256-UWCxzwV2bcT8Sfl296HpBThe+qYX19M7sNcEJHs/sXc=";
   };
 
+  vendorSha256 = "sha256-DaPcCuj0KGpuOC6XynltMBE9wO7w5qKrTChC401249o=";
+
+  subPackages = [ "cmd/serf" ];
+
+  # These values are expected by version/version.go
+  # https://github.com/hashicorp/serf/blob/7faa1b06262f70780c3c35ac25a4c96d754f06f3/version/version.go#L8-L22
+  ldflags = lib.mapAttrsToList
+    (n: v: "-X github.com/hashicorp/serf/version.${n}=${v}") {
+      GitCommit = rev;
+      Version = version;
+      VersionPrerelease = "";
+    };
+
+  # There are no tests for cmd/serf.
+  doCheck = false;
+
   meta = with lib; {
-    description = "Tool for service orchestration and management";
-    homepage = "https://www.serf.io/";
-    platforms = platforms.linux ++ platforms.darwin;
+    description = "Service orchestration and management tool";
+    longDescription = ''
+      Serf is a decentralized solution for service discovery and orchestration
+      that is lightweight, highly available, and fault tolerant.
+    '';
+    homepage = "https://www.serf.io";
     license = licenses.mpl20;
     maintainers = with maintainers; [ pradeepchhetri ];
   };
diff --git a/pkgs/servers/shairport-sync/default.nix b/pkgs/servers/shairport-sync/default.nix
index ed3c0dcc7f9de..dbe478568ac64 100644
--- a/pkgs/servers/shairport-sync/default.nix
+++ b/pkgs/servers/shairport-sync/default.nix
@@ -1,6 +1,12 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, openssl, avahi, alsa-lib
-, libdaemon, popt, pkg-config, libconfig, libpulseaudio, soxr }:
+{ lib, stdenv, fetchFromGitHub
+, autoreconfHook, pkg-config
+, openssl, avahi, alsa-lib, glib, libdaemon, popt, libconfig, libpulseaudio, soxr
+, enableDbus ? stdenv.isLinux
+, enableMetadata ? false
+, enableMpris ? stdenv.isLinux
+}:
 
+with lib;
 stdenv.mkDerivation rec {
   version = "3.3.9";
   pname = "shairport-sync";
@@ -23,7 +29,12 @@ stdenv.mkDerivation rec {
     libconfig
     libpulseaudio
     soxr
-  ];
+  ] ++ optional stdenv.isLinux glib;
+
+  prePatch = ''
+    sed -i -e 's/G_BUS_TYPE_SYSTEM/G_BUS_TYPE_SESSION/g' dbus-service.c
+    sed -i -e 's/G_BUS_TYPE_SYSTEM/G_BUS_TYPE_SESSION/g' mpris-service.c
+  '';
 
   enableParallelBuilding = true;
 
@@ -32,7 +43,10 @@ stdenv.mkDerivation rec {
     "--with-avahi" "--with-ssl=openssl" "--with-soxr"
     "--without-configfiles"
     "--sysconfdir=/etc"
-  ];
+  ]
+    ++ optional enableDbus "--with-dbus-interface"
+    ++ optional enableMetadata "--with-metadata"
+    ++ optional enableMpris "--with-mpris-interface";
 
   meta = with lib; {
     inherit (src.meta) homepage;
diff --git a/pkgs/servers/traefik/default.nix b/pkgs/servers/traefik/default.nix
index 622662645c7ef..d6a0f497da14f 100644
--- a/pkgs/servers/traefik/default.nix
+++ b/pkgs/servers/traefik/default.nix
@@ -1,33 +1,34 @@
-{ lib, fetchzip, buildGoModule, go-bindata, nixosTests }:
+{ lib, fetchFromGitHub, buildGoModule, nixosTests }:
 
 buildGoModule rec {
   pname = "traefik";
-  version = "2.6.3";
+  version = "2.7.1";
 
-  src = fetchzip {
-    url = "https://github.com/traefik/traefik/releases/download/v${version}/traefik-v${version}.src.tar.gz";
-    sha256 = "sha256-OaKgX3qwiJM/EPprV1r3CbUnxOaWl7BTMcS5v+tmHoo=";
-    stripRoot = false;
+  src = fetchFromGitHub {
+    owner = "traefik";
+    repo = "traefik";
+    rev = "v${version}";
+    sha256 = "sha256-uTE0Z7lgxKNq1wQSMUSp9dMfxV+aIm7cwYSkZBUdnug=";
   };
 
-  vendorSha256 = "sha256-tqrfCpZ/fRYZBZ/SBAvvJebLBeD2M/AVJEPiseehJHY=";
+  vendorSha256 = "sha256-WlLntYrXs1kOu26yNeZI1xpb6FsHPiA/bNzaxCZTG4Y=";
 
   subPackages = [ "cmd/traefik" ];
 
-  nativeBuildInputs = [ go-bindata ];
-
-  passthru.tests = { inherit (nixosTests) traefik; };
-
   preBuild = ''
     go generate
 
     CODENAME=$(awk -F "=" '/CODENAME=/ { print $2}' script/binary)
 
-    buildFlagsArray+=("-ldflags=\
-      -X github.com/traefik/traefik/v2/pkg/version.Version=${version} \
-      -X github.com/traefik/traefik/v2/pkg/version.Codename=$CODENAME")
+    buildFlagsArray+=("-ldflags= -s -w \
+      -X github.com/traefik/traefik/v${lib.versions.major version}/pkg/version.Version=${version} \
+      -X github.com/traefik/traefik/v${lib.versions.major version}/pkg/version.Codename=$CODENAME")
   '';
 
+  doCheck = false;
+
+  passthru.tests = { inherit (nixosTests) traefik; };
+
   meta = with lib; {
     homepage = "https://traefik.io";
     description = "A modern reverse proxy";
diff --git a/pkgs/servers/trickster/trickster.nix b/pkgs/servers/trickster/trickster.nix
index 5cf08ee6c3cfd..a798e0ceff0d8 100644
--- a/pkgs/servers/trickster/trickster.nix
+++ b/pkgs/servers/trickster/trickster.nix
@@ -1,26 +1,53 @@
-{ lib, buildGoPackage, fetchFromGitHub }:
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "trickster";
-  version = "0.1.10";
-
-  goPackagePath = "github.com/Comcast/trickster";
-
-  goDeps = ./trickster_deps.nix;
+  version = "1.1.5";
+  rev = "4595bd6a1ae1165ef497251ad85c646dadc8a925";
 
   src = fetchFromGitHub {
-    owner = "Comcast";
-    repo = pname;
+    owner = "trickstercache";
+    repo = "trickster";
     rev = "v${version}";
-    sha256 = "12z71rf03g2x8r7cgns0n4n46r0gjsfyig6z9r5xrn9kfghabfi8";
+    sha256 = "sha256-BRD8IF3s9RaDorVtXRvbKLVVVXWiEQTQyKBR9jFo1eM=";
   };
 
-  doCheck = true;
+  vendorSha256 = null;
+
+  subPackages = [ "cmd/trickster" ];
+
+  preBuild =
+    let
+      ldflags = with lib;
+        concatStringsSep " " (
+          [ "-extldflags '-static'" "-s" "-w" ] ++
+          (mapAttrsToList (n: v: "-X main.application${n}=${v}") {
+            BuildTime = "1970-01-01T00:00:00+0000";
+            GitCommitID = rev;
+            GoVersion = "$(go env GOVERSION)";
+            GoArch = "$(go env GOARCH)";
+          })
+        );
+    in
+    ''
+      buildFlagsArray+=("-ldflags=${ldflags}")
+    '';
+
+  # Tests are broken.
+  doCheck = false;
 
   meta = with lib; {
-    description = "Reverse proxy cache for the Prometheus HTTP APIv1";
-    homepage = "https://github.com/Comcast/trickster";
+    description = "Reverse proxy cache and time series dashboard accelerator";
+    longDescription = ''
+      Trickster is a fully-featured HTTP Reverse Proxy Cache for HTTP
+      applications like static file servers and web APIs.
+    '';
+    homepage = "https://trickstercache.org/";
     license = licenses.asl20;
     maintainers = with maintainers; [ _1000101 ];
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/servers/trickster/trickster_deps.nix b/pkgs/servers/trickster/trickster_deps.nix
deleted file mode 100644
index ab100bed760e1..0000000000000
--- a/pkgs/servers/trickster/trickster_deps.nix
+++ /dev/null
@@ -1,237 +0,0 @@
-# file generated from go.mod using vgo2nix (https://github.com/adisbladis/vgo2nix)
-[
-  {
-    goPackagePath = "github.com/BurntSushi/toml";
-    fetch = {
-      type = "git";
-      url = "https://github.com/BurntSushi/toml";
-      rev = "v0.3.1";
-      sha256 = "1fjdwwfzyzllgiwydknf1pwjvy49qxfsczqx5gz3y0izs7as99j6";
-    };
-  }
-  {
-    goPackagePath = "github.com/alicebob/gopher-json";
-    fetch = {
-      type = "git";
-      url = "https://github.com/alicebob/gopher-json";
-      rev = "5a6b3ba71ee6";
-      sha256 = "0hx6n722zq51p852lv56k39yjy09lw6mnr2c3x0p23rfyyrakj2p";
-    };
-  }
-  {
-    goPackagePath = "github.com/alicebob/miniredis";
-    fetch = {
-      type = "git";
-      url = "https://github.com/alicebob/miniredis";
-      rev = "cfad8aca71cc";
-      sha256 = "0x2401nxyhdz037lj98c0sa77d8k49jfcq7is3ddiyim3csg5a0w";
-    };
-  }
-  {
-    goPackagePath = "github.com/beorn7/perks";
-    fetch = {
-      type = "git";
-      url = "https://github.com/beorn7/perks";
-      rev = "3a771d992973";
-      sha256 = "1l2lns4f5jabp61201sh88zf3b0q793w4zdgp9nll7mmfcxxjif3";
-    };
-  }
-  {
-    goPackagePath = "github.com/chzyer/readline";
-    fetch = {
-      type = "git";
-      url = "https://github.com/chzyer/readline";
-      rev = "2972be24d48e";
-      sha256 = "104q8dazj8yf6b089jjr82fy9h1g80zyyzvp3g8b44a7d8ngjj6r";
-    };
-  }
-  {
-    goPackagePath = "github.com/coreos/bbolt";
-    fetch = {
-      type = "git";
-      url = "https://github.com/coreos/bbolt";
-      rev = "v1.3.0";
-      sha256 = "0cp5v9iypg9ysiq40k3h3lg7aisxplnmxshha7nama6b170izyay";
-    };
-  }
-  {
-    goPackagePath = "github.com/go-kit/kit";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-kit/kit";
-      rev = "v0.8.0";
-      sha256 = "1rcywbc2pvab06qyf8pc2rdfjv7r6kxdv2v4wnpqnjhz225wqvc0";
-    };
-  }
-  {
-    goPackagePath = "github.com/go-logfmt/logfmt";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-logfmt/logfmt";
-      rev = "v0.4.0";
-      sha256 = "06smxc112xmixz78nyvk3b2hmc7wasf2sl5vxj1xz62kqcq9lzm9";
-    };
-  }
-  {
-    goPackagePath = "github.com/go-redis/redis";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-redis/redis";
-      rev = "v6.14.2";
-      sha256 = "0s1if96r8xnadan7pz1j8hvzk9g4fm3phwmwzadwpq21pgni66d7";
-    };
-  }
-  {
-    goPackagePath = "github.com/go-stack/stack";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-stack/stack";
-      rev = "v1.8.0";
-      sha256 = "0wk25751ryyvxclyp8jdk5c3ar0cmfr8lrjb66qbg4808x66b96v";
-    };
-  }
-  {
-    goPackagePath = "github.com/golang/protobuf";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/protobuf";
-      rev = "v1.2.0";
-      sha256 = "0kf4b59rcbb1cchfny2dm9jyznp8ri2hsb14n8iak1q8986xa0ab";
-    };
-  }
-  {
-    goPackagePath = "github.com/golang/snappy";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/snappy";
-      rev = "2e65f85255db";
-      sha256 = "05w6mpc4qcy0pv8a2bzng8nf4s5rf5phfang4jwy9rgf808q0nxf";
-    };
-  }
-  {
-    goPackagePath = "github.com/gomodule/redigo";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gomodule/redigo";
-      rev = "v2.0.0";
-      sha256 = "1kg7s8027b4g1sfw0v3nh30c15j407kv684s53gg281r807dnfpk";
-    };
-  }
-  {
-    goPackagePath = "github.com/gorilla/context";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gorilla/context";
-      rev = "v1.1.1";
-      sha256 = "03p4hn87vcmfih0p9w663qbx9lpsf7i7j3lc7yl7n84la3yz63m4";
-    };
-  }
-  {
-    goPackagePath = "github.com/gorilla/handlers";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gorilla/handlers";
-      rev = "v1.4.0";
-      sha256 = "0mnw81ayjm4d8462qg8spmcwxmchn24158bf93zxjab51pg8n9gm";
-    };
-  }
-  {
-    goPackagePath = "github.com/gorilla/mux";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gorilla/mux";
-      rev = "v1.6.2";
-      sha256 = "0pvzm23hklxysspnz52mih6h1q74vfrdhjfm1l3sa9r8hhqmmld2";
-    };
-  }
-  {
-    goPackagePath = "github.com/kr/logfmt";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kr/logfmt";
-      rev = "b84e30acd515";
-      sha256 = "02ldzxgznrfdzvghfraslhgp19la1fczcbzh7wm2zdc6lmpd1qq9";
-    };
-  }
-  {
-    goPackagePath = "github.com/matttproud/golang_protobuf_extensions";
-    fetch = {
-      type = "git";
-      url = "https://github.com/matttproud/golang_protobuf_extensions";
-      rev = "v1.0.1";
-      sha256 = "1d0c1isd2lk9pnfq2nk0aih356j30k3h1gi2w0ixsivi5csl7jya";
-    };
-  }
-  {
-    goPackagePath = "github.com/pkg/errors";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pkg/errors";
-      rev = "v0.8.0";
-      sha256 = "001i6n71ghp2l6kdl3qq1v2vmghcz3kicv9a5wgcihrzigm75pp5";
-    };
-  }
-  {
-    goPackagePath = "github.com/prometheus/client_golang";
-    fetch = {
-      type = "git";
-      url = "https://github.com/prometheus/client_golang";
-      rev = "v0.9.1";
-      sha256 = "01gnylazia30pcp069xcng482gwmm3xcx5zgrlwdkhic1lyb6i9l";
-    };
-  }
-  {
-    goPackagePath = "github.com/prometheus/client_model";
-    fetch = {
-      type = "git";
-      url = "https://github.com/prometheus/client_model";
-      rev = "5c3871d89910";
-      sha256 = "04psf81l9fjcwascsys428v03fx4fi894h7fhrj2vvcz723q57k0";
-    };
-  }
-  {
-    goPackagePath = "github.com/prometheus/common";
-    fetch = {
-      type = "git";
-      url = "https://github.com/prometheus/common";
-      rev = "4724e9255275";
-      sha256 = "0pcx8hlnrxx5nnmpk786cn99rsgqk1jrd3c9f6fsx8qd8y5iwjy6";
-    };
-  }
-  {
-    goPackagePath = "github.com/prometheus/procfs";
-    fetch = {
-      type = "git";
-      url = "https://github.com/prometheus/procfs";
-      rev = "1dc9a6cbc91a";
-      sha256 = "1zlv1x30xp7z5c3vn5vp870v4bjim0zcidzc3mr2l3xhazc0svab";
-    };
-  }
-  {
-    goPackagePath = "github.com/yuin/gopher-lua";
-    fetch = {
-      type = "git";
-      url = "https://github.com/yuin/gopher-lua";
-      rev = "a0dfe84f6227";
-      sha256 = "13k2dphx4zv6fwgqsydsc0g0b0pf7qx3yb6i7hai6nnkh0db91nn";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/sys";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/sys";
-      rev = "a5c9d58dba9a";
-      sha256 = "02qv5i7yps35p7fa81345qz7k8i73gkigj69anwmpw9rhpmzayf9";
-    };
-  }
-  {
-    goPackagePath = "gopkg.in/natefinch/lumberjack.v2";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/natefinch/lumberjack.v2";
-      rev = "a96e63847dc3";
-      sha256 = "1l3vlv72b7rfkpy1164kwd3qzrqmmjnb67akzxqp2mlvc66k6p3d";
-    };
-  }
-]
diff --git a/pkgs/servers/web-apps/snipe-it/default.nix b/pkgs/servers/web-apps/snipe-it/default.nix
index 3e3ac6fde11b7..02a1ff30d8f9a 100644
--- a/pkgs/servers/web-apps/snipe-it/default.nix
+++ b/pkgs/servers/web-apps/snipe-it/default.nix
@@ -18,13 +18,13 @@ let
 
 in package.override rec {
   pname = "snipe-it";
-  version = "6.0.4";
+  version = "6.0.5";
 
   src = fetchFromGitHub {
     owner = "snipe";
     repo = pname;
     rev = "v${version}";
-    sha256 = "06h8rnk8q85f0z0a1q0j010kzs4z2k5sxvi06avk7ndpkrisv4wz";
+    sha256 = "15dp8y0kdjg9x4iwa5ha5w4qbwwsdg5z8337rmkkla2yjmf4lrxb";
   };
 
   meta = with lib; {
diff --git a/pkgs/shells/oh/default.nix b/pkgs/shells/oh/default.nix
index 68f34fe8eb170..e9a09c8c28880 100644
--- a/pkgs/shells/oh/default.nix
+++ b/pkgs/shells/oh/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "oh";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "michaelmacinnis";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0sdpk77i5mfamkdqldybl9znzz92hqgi4xvby5j28m0a5gw46kj0";
+    sha256 = "sha256-DMxC5fv5ZLDv7gMajC/eyJd2YpO+OXFdvwAPYotnczw=";
   };
 
-  vendorSha256 = "12vlvh37hvi8c1i9arppm5wj4v9c98s7myxra10q6qpdqssgc8a0";
+  vendorSha256 = "sha256-f4rqXOu6yXUzNsseSaV9pb8c2KXItYOalB5pfH3Acnc=";
 
   meta = with lib; {
     homepage = "https://github.com/michaelmacinnis/oh";
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index f8a858a4b52de..bde8735642d8c 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -111,9 +111,9 @@ let
 , # Target is not included by default because most programs don't care.
   # Including it then would cause needless mass rebuilds.
   #
-  # TODO(@Ericson2314): Make [ "build" "host" ] always the default.
+  # TODO(@Ericson2314): Make [ "build" "host" ] always the default / resolve #87909
   configurePlatforms ? lib.optionals
-    (stdenv.hostPlatform != stdenv.buildPlatform)
+    (stdenv.hostPlatform != stdenv.buildPlatform || config.configurePlatformsByDefault)
     [ "build" "host" ]
 
 # TODO(@Ericson2314): Make unconditional / resolve #33599
diff --git a/pkgs/tools/X11/focus/default.nix b/pkgs/tools/X11/focus/default.nix
new file mode 100644
index 0000000000000..20c7e2e25d90a
--- /dev/null
+++ b/pkgs/tools/X11/focus/default.nix
@@ -0,0 +1,34 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, libX11
+, libXinerama
+}:
+
+stdenv.mkDerivation rec {
+  pname = "focus";
+  version = "unstable-2021-02-23";
+
+  src = fetchFromGitHub {
+    owner = "phillbush";
+    repo = "focus";
+    rev = "fed2fdbd3f73b192882d97aeb5b1cea681bb7d85";
+    sha256 = "sha256-IDiUXindzv5Ng5oCTyUlj2il/2kLvXG4YhgiYp7ZebQ=";
+  };
+
+  buildInputs = [ libX11 libXinerama ];
+
+  makeFlags = [ "PREFIX=\${out}" ];
+
+  meta = with lib; {
+    description = "Focus window, workspace or monitor by direction or cycle through them";
+    longDescription = ''
+      A collection of utilities that change the focus of windows, workspaces or
+      monitors.
+    '';
+    homepage = "https://github.com/phillbush/focus";
+    license = licenses.publicDomain;
+    maintainers = with maintainers; [ azahi ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/tools/X11/pmenu/default.nix b/pkgs/tools/X11/pmenu/default.nix
new file mode 100644
index 0000000000000..7de509a299c58
--- /dev/null
+++ b/pkgs/tools/X11/pmenu/default.nix
@@ -0,0 +1,60 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, writeText
+, fontconfig
+, imlib2
+, libX11
+, libXext
+, libXft
+, libXinerama
+, libXrender
+, conf ? null
+}:
+
+stdenv.mkDerivation rec {
+  pname = "pmenu";
+  version = "3.0.1";
+
+  src = fetchFromGitHub {
+    owner = "phillbush";
+    repo = "pmenu";
+    rev = "v${version}";
+    sha256 = "sha256-xeOiJEOPz5QEMlWP6bWhTjmj4tfNqh3rsEVmnKvrKuM=";
+  };
+
+  buildInputs = [
+    fontconfig
+    imlib2
+    libX11
+    libXext
+    libXft
+    libXinerama
+    libXrender
+  ];
+
+  postPatch = let
+      configFile =
+        if lib.isDerivation conf || builtins.isPath conf
+        then conf else writeText "config.h" conf;
+    in
+    lib.optionalString (conf != null) "mv ${configFile} config.h";
+
+  makeFlags = [
+    "INSTALL=install"
+    "PREFIX=\${out}"
+  ];
+
+  meta = with lib; {
+    description = "A pie-menu tool";
+    longDescription = ''
+      πmenu is a pie menu utility for X. πmenu receives a menu specification in
+      stdin, shows a menu for the user to select one of the options, and outputs
+      the option selected to stdout.
+    '';
+    homepage = "https://github.com/phillbush/pmenu";
+    license = licenses.mit;
+    maintainers = with maintainers; [ azahi ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/tools/admin/aliyun-cli/default.nix b/pkgs/tools/admin/aliyun-cli/default.nix
index e2359bd5e117a..b18b8a82088ee 100644
--- a/pkgs/tools/admin/aliyun-cli/default.nix
+++ b/pkgs/tools/admin/aliyun-cli/default.nix
@@ -2,17 +2,17 @@
 
 buildGoModule rec {
   pname = "aliyun-cli";
-  version = "3.0.121";
+  version = "3.0.123";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "aliyun";
     repo = pname;
     fetchSubmodules = true;
-    sha256 = "sha256-1D1JZZ/KMC4oZRaYvWpUazTk7llvX5WHPBxWEGCiKrI=";
+    sha256 = "sha256-68u31s7SsRRT9OQpTqlhAs5Dx+ggbTTSeKYBByiqn6g=";
   };
 
-  vendorSha256 = "sha256-f3GXkAvTe8rPFWCR5TM4mDK/VOQWt2lrZrfJ/Wvw8Uc=";
+  vendorSha256 = "sha256-X5r89aI7UdVlzEJi8zaOzwTETwb+XH8dKO6rVe//FNs=";
 
   subPackages = [ "main" ];
 
diff --git a/pkgs/tools/admin/boulder/default.nix b/pkgs/tools/admin/boulder/default.nix
index 706ac84afb330..6de6ae6c02022 100644
--- a/pkgs/tools/admin/boulder/default.nix
+++ b/pkgs/tools/admin/boulder/default.nix
@@ -1,30 +1,51 @@
-{ buildGoPackage
-, libtool
+{ lib
+, buildGoModule
 , fetchFromGitHub
-, lib
 }:
 
-buildGoPackage rec{
-
+buildGoModule rec {
   pname = "boulder";
-  version = "release-2019-10-13";
-
-  goPackagePath = "github.com/letsencrypt/boulder";
-
-  buildInputs = [ libtool ];
+  version = "release-2022-05-31";
+  rev = "99dcb9a5b31be576a55e33184581c942421bc172";
 
   src = fetchFromGitHub {
     owner = "letsencrypt";
     repo = "boulder";
     rev = version;
-    sha256 = "0kis23dnjja6jp192rjpv2m9m2zmzfwhs93440nxg354k6fp8jdg";
+    sha256 = "sha256-x1Vf8agwVTgSkDVEdAnG3div+MzRsMi96jKJRc2s8Ks=";
   };
 
-  meta = {
+  vendorSha256 = null;
+
+  subPackages = [ "cmd/boulder" ];
+
+  ldflags = with lib;
+    mapAttrsToList (n: v: ''"-X github.com/letsencrypt/boulder/core.Build${n}=${v}"'') {
+      ID = substring 0 8 rev;
+      Host = "nixbld@localhost";
+      Time = "Thu  1 Jan 00:00:00 UTC 1970";
+    };
+
+  postInstall = ''
+    for i in $($out/bin/boulder --list); do
+      ln -s $out/bin/boulder $out/bin/$i
+    done
+  '';
+
+  # There are no tests for cmd/boulder.
+  doCheck = false;
+
+  meta = with lib; {
     homepage = "https://github.com/letsencrypt/boulder";
-    description = "An ACME-based CA, written in Go";
-    license = [ lib.licenses.mpl20 ];
-    maintainers = [ ];
+    description = "An ACME-based certificate authority, written in Go";
+    longDescription = ''
+      This is an implementation of an ACME-based CA. The ACME protocol allows
+      the CA to automatically verify that an applicant for a certificate
+      actually controls an identifier, and allows domain holders to issue and
+      revoke certificates for their domains. Boulder is the software that runs
+      Let's Encrypt.
+    '';
+    license = licenses.mpl20;
+    maintainers = with maintainers; [ azahi ];
   };
-
 }
diff --git a/pkgs/tools/admin/lxd/default.nix b/pkgs/tools/admin/lxd/default.nix
index 5198f79a7f188..d664cdd50860d 100644
--- a/pkgs/tools/admin/lxd/default.nix
+++ b/pkgs/tools/admin/lxd/default.nix
@@ -1,4 +1,4 @@
-{ lib, hwdata, pkg-config, lxc, buildGo118Package, fetchurl, fetchpatch
+{ lib, hwdata, pkg-config, lxc, buildGo118Package, fetchurl
 , makeWrapper, acl, rsync, gnutar, xz, btrfs-progs, gzip, dnsmasq, attr
 , squashfsTools, iproute2, iptables, libcap
 , dqlite, raft-canonical, sqlite-replication, udev
@@ -11,7 +11,7 @@
 
 buildGo118Package rec {
   pname = "lxd";
-  version = "5.2";
+  version = "5.3";
 
   goPackagePath = "github.com/lxc/lxd";
 
@@ -20,7 +20,7 @@ buildGo118Package rec {
       "https://linuxcontainers.org/downloads/lxd/lxd-${version}.tar.gz"
       "https://github.com/lxc/lxd/releases/download/lxd-${version}/lxd-${version}.tar.gz"
     ];
-    sha256 = "sha256-4i0rNKGEjTOyCAsrHII1WvttNv3+SeZ/RLN0ntvALkw=";
+    sha256 = "sha256-DRdKCfp0nL3lg5O/Wm7vX2grO/DBuyhHRi85XI5laZU=";
   };
 
   postPatch = ''
@@ -60,6 +60,7 @@ buildGo118Package rec {
   meta = with lib; {
     description = "Daemon based on liblxc offering a REST API to manage containers";
     homepage = "https://linuxcontainers.org/lxd/";
+    changelog = "https://github.com/lxc/lxd/releases/tag/lxd-${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ fpletz marsam ];
     platforms = platforms.linux;
diff --git a/pkgs/tools/admin/nomachine-client/default.nix b/pkgs/tools/admin/nomachine-client/default.nix
index 7e8ff1d087575..d0ed40c7d059d 100644
--- a/pkgs/tools/admin/nomachine-client/default.nix
+++ b/pkgs/tools/admin/nomachine-client/default.nix
@@ -1,8 +1,8 @@
 { lib, stdenv, file, fetchurl, makeWrapper,
   autoPatchelfHook, jsoncpp, libpulseaudio }:
 let
-  versionMajor = "7.9";
-  versionMinor = "2";
+  versionMajor = "7.10";
+  versionMinor = "1";
   versionBuild_x86_64 = "1";
   versionBuild_i686 = "1";
 in
@@ -14,12 +14,12 @@ in
       if stdenv.hostPlatform.system == "x86_64-linux" then
         fetchurl {
           url = "https://download.nomachine.com/download/${versionMajor}/Linux/nomachine_${version}_${versionBuild_x86_64}_x86_64.tar.gz";
-          sha256 = "sha256-Gsi0Hj6cfpxzr0zbWfsq0ZJvCPATQn9YvHbx0Cziia4=";
+          sha256 = "sha256-alClFaNbQ76r8LukbygesWWXA5rx6VEzxK+bY5tOfO0=";
         }
       else if stdenv.hostPlatform.system == "i686-linux" then
         fetchurl {
           url = "https://download.nomachine.com/download/${versionMajor}/Linux/nomachine_${version}_${versionBuild_i686}_i686.tar.gz";
-          sha256 = "sha256-zmXOLzFePAD+oH00bAkNsEFviQwkjjqC/gAv87E1qX4=";
+          sha256 = "sha256-UDvrjb/2rXvSvpiA+UwiVi4YyXhFLNiEtrszqjAPGXc=";
         }
       else
         throw "NoMachine client is not supported on ${stdenv.hostPlatform.system}";
diff --git a/pkgs/tools/admin/trinsic-cli/default.nix b/pkgs/tools/admin/trinsic-cli/default.nix
index d6e6d6f100c56..907516ce3655b 100644
--- a/pkgs/tools/admin/trinsic-cli/default.nix
+++ b/pkgs/tools/admin/trinsic-cli/default.nix
@@ -2,11 +2,11 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "trinsic-cli";
-  version = "1.4.0";
+  version = "1.5.0";
 
   src = fetchurl {
     url = "https://github.com/trinsic-id/sdk/releases/download/v${version}/trinsic-cli-vendor-${version}.tar.gz";
-    sha256 = "sha256-Dxmjbd1Q2JNeET22Fte7bygd+oH3ZfovRTJh5xforuw=";
+    sha256 = "sha256-Z9orGhxbu/ehyaYhY35lYWcZQWNVk+zLSoqwAZwnpLY=";
   };
 
   cargoVendorDir = "vendor";
diff --git a/pkgs/tools/backup/borgmatic/default.nix b/pkgs/tools/backup/borgmatic/default.nix
index 904e64704c90a..70ca704831e68 100644
--- a/pkgs/tools/backup/borgmatic/default.nix
+++ b/pkgs/tools/backup/borgmatic/default.nix
@@ -2,11 +2,11 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "borgmatic";
-  version = "1.5.18";
+  version = "1.6.3";
 
   src = python3Packages.fetchPypi {
     inherit pname version;
-    sha256 = "sha256-dX1U1zza8zMhDiTLE+DgtN6RLRciLks4NDOukpKH/po=";
+    sha256 = "sha256-CLScfmv0Jp4nfKAQvaq3XdYxNl9pDfEi5hz1ybikWDc=";
   };
 
   checkInputs = with python3Packages; [ flexmock pytestCheckHook pytest-cov ];
diff --git a/pkgs/tools/backup/dar/default.nix b/pkgs/tools/backup/dar/default.nix
index 92642973d45b3..f4f2a2630098e 100644
--- a/pkgs/tools/backup/dar/default.nix
+++ b/pkgs/tools/backup/dar/default.nix
@@ -9,12 +9,12 @@
 with lib;
 
 stdenv.mkDerivation rec {
-  version = "2.7.5";
+  version = "2.7.6";
   pname = "dar";
 
   src = fetchurl {
     url = "mirror://sourceforge/dar/${pname}-${version}.tar.gz";
-    sha256 = "sha256-lfpJOomadV/oTJsOloH1rYF5Wy3kVr+EBUvqZ+xaCWY=";
+    sha256 = "sha256-PV5ESJE1B2gQnX6QUeJgOb3rkG3jApTn4NcRBbh9bao=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/tools/backup/duplicity/default.nix b/pkgs/tools/backup/duplicity/default.nix
index 95e29686f24e6..46f841c8f5b3b 100644
--- a/pkgs/tools/backup/duplicity/default.nix
+++ b/pkgs/tools/backup/duplicity/default.nix
@@ -70,7 +70,6 @@ pythonPackages.buildPythonApplication rec {
 
   pythonPath = with pythonPackages; [
     b2sdk
-    boto
     boto3
     cffi
     cryptography
diff --git a/pkgs/tools/backup/zfsbackup/default.nix b/pkgs/tools/backup/zfsbackup/default.nix
index ff47ce47edef1..332ad619a431d 100644
--- a/pkgs/tools/backup/zfsbackup/default.nix
+++ b/pkgs/tools/backup/zfsbackup/default.nix
@@ -1,26 +1,34 @@
-{ lib, buildGoPackage, fetchFromGitHub }:
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, zfs
+}:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "zfsbackup";
-  version = "unstable-2020-09-30";
-  rev = "092f80846b23e02f99d2aa72d9d889eabfdcb053";
-
-  goPackagePath = "github.com/someone1/zfsbackup-go";
+  version = "unstable-2021-05-26";
+  rev = "2d4534b920d3c57552667e1c6da9978b3a9278f0";
 
   src = fetchFromGitHub {
     owner = "someone1";
     repo = "zfsbackup-go";
     inherit rev;
-    sha256 = "1xiacaf4r9jkx0m8wjfis14cq622yhljldwkflh9ni3khax7dlgi";
+    sha256 = "sha256-slVwXXGLvq+eAlqzD8p1fnc17CGUBY0Z68SURBBuf2k=";
   };
 
-  goDeps = ./deps.nix;
+  vendorSha256 = "sha256-jpxp8RKDBrkBBaY89QnKYGWFI/DUURUVX8cPJ/qoLrg=";
+
+  ldflags = [ "-w" "-s" ];
+
+  # Tests require loading the zfs kernel module.
+  doCheck = false;
 
   meta = with lib; {
     description = "Backup ZFS snapshots to cloud storage such as Google, Amazon, Azure, etc";
     homepage = "https://github.com/someone1/zfsbackup-go";
     license = licenses.mit;
-    maintainers = [ maintainers.xfix ];
+    maintainers = with maintainers; [ xfix ];
+    platforms = platforms.linux;
     mainProgram = "zfsbackup-go";
   };
 }
diff --git a/pkgs/tools/backup/zfsbackup/deps.nix b/pkgs/tools/backup/zfsbackup/deps.nix
deleted file mode 100644
index 28be9fa141cf9..0000000000000
--- a/pkgs/tools/backup/zfsbackup/deps.nix
+++ /dev/null
@@ -1,1326 +0,0 @@
-# file generated from go.mod using vgo2nix (https://github.com/adisbladis/vgo2nix)
-[
-  {
-    goPackagePath = "cloud.google.com/go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/googleapis/google-cloud-go";
-      rev = "v0.57.0";
-      sha256 = "0lcq68h0x56qb14yx2df584ad0g9s1s19py813dy9nzqp0bmjig8";
-    };
-  }
-  {
-    goPackagePath = "dmitri.shuralyov.com/gpu/mtl";
-    fetch = {
-      type = "git";
-      url = "https://dmitri.shuralyov.com/gpu/mtl";
-      rev = "666a987793e9";
-      sha256 = "1isd03hgiwcf2ld1rlp0plrnfz7r4i7c5q4kb6hkcd22axnmrv0z";
-    };
-  }
-  {
-    goPackagePath = "github.com/Azure/azure-pipeline-go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/Azure/azure-pipeline-go";
-      rev = "v0.2.2";
-      sha256 = "1agn2nzmm1dkwggm4w7h4bnrav4n5jrl0vqbqy2s49vqlr8zirn6";
-    };
-  }
-  {
-    goPackagePath = "github.com/Azure/azure-sdk-for-go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/Azure/azure-sdk-for-go";
-      rev = "v42.3.0";
-      sha256 = "1nqxpifrr8n17irkfzhx253b17cwd15x4vfqxx80l5y7dn0jqavq";
-    };
-  }
-  {
-    goPackagePath = "github.com/Azure/azure-storage-blob-go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/Azure/azure-storage-blob-go";
-      rev = "v0.8.0";
-      sha256 = "00gsnk9s1rlrakqvcm917hn4r47jannxwp7rkhrb71pamzm46752";
-    };
-  }
-  {
-    goPackagePath = "github.com/BurntSushi/toml";
-    fetch = {
-      type = "git";
-      url = "https://github.com/BurntSushi/toml";
-      rev = "v0.3.1";
-      sha256 = "1fjdwwfzyzllgiwydknf1pwjvy49qxfsczqx5gz3y0izs7as99j6";
-    };
-  }
-  {
-    goPackagePath = "github.com/BurntSushi/xgb";
-    fetch = {
-      type = "git";
-      url = "https://github.com/BurntSushi/xgb";
-      rev = "27f122750802";
-      sha256 = "18lp2x8f5bljvlz0r7xn744f0c9rywjsb9ifiszqqdcpwhsa0kvj";
-    };
-  }
-  {
-    goPackagePath = "github.com/OneOfOne/xxhash";
-    fetch = {
-      type = "git";
-      url = "https://github.com/OneOfOne/xxhash";
-      rev = "v1.2.2";
-      sha256 = "1mjfhrwhvxa48rycjnqpqzm521i38h1hdyz6pdwmhd7xb8j6gwi6";
-    };
-  }
-  {
-    goPackagePath = "github.com/alecthomas/template";
-    fetch = {
-      type = "git";
-      url = "https://github.com/alecthomas/template";
-      rev = "a0175ee3bccc";
-      sha256 = "0qjgvvh26vk1cyfq9fadyhfgdj36f1iapbmr5xp6zqipldz8ffxj";
-    };
-  }
-  {
-    goPackagePath = "github.com/alecthomas/units";
-    fetch = {
-      type = "git";
-      url = "https://github.com/alecthomas/units";
-      rev = "2efee857e7cf";
-      sha256 = "1j65b91qb9sbrml9cpabfrcf07wmgzzghrl7809hjjhrmbzri5bl";
-    };
-  }
-  {
-    goPackagePath = "github.com/armon/consul-api";
-    fetch = {
-      type = "git";
-      url = "https://github.com/armon/consul-api";
-      rev = "eb2c6b5be1b6";
-      sha256 = "1j6fdr1sg36qy4n4xjl7brq739fpm5npq98cmvklzjc9qrx98nk9";
-    };
-  }
-  {
-    goPackagePath = "github.com/aws/aws-sdk-go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/aws/aws-sdk-go";
-      rev = "v1.31.4";
-      sha256 = "07ia78j6j2y139iq9x5gin0fwc77wv8x0zhg47kibykxn4iyx85y";
-    };
-  }
-  {
-    goPackagePath = "github.com/beorn7/perks";
-    fetch = {
-      type = "git";
-      url = "https://github.com/beorn7/perks";
-      rev = "v1.0.0";
-      sha256 = "1i1nz1f6g55xi2y3aiaz5kqfgvknarbfl4f0sx4nyyb4s7xb1z9x";
-    };
-  }
-  {
-    goPackagePath = "github.com/cenkalti/backoff";
-    fetch = {
-      type = "git";
-      url = "https://github.com/cenkalti/backoff";
-      rev = "v2.2.1";
-      sha256 = "1mf4lsl3rbb8kk42x0mrhzzy4ikqy0jf6nxpzhkr02rdgwh6rjk8";
-    };
-  }
-  {
-    goPackagePath = "github.com/census-instrumentation/opencensus-proto";
-    fetch = {
-      type = "git";
-      url = "https://github.com/census-instrumentation/opencensus-proto";
-      rev = "v0.2.1";
-      sha256 = "19fcx3sc99i5dsklny6r073z5j20vlwn2xqm6di1q3b1xwchzqfj";
-    };
-  }
-  {
-    goPackagePath = "github.com/cespare/xxhash";
-    fetch = {
-      type = "git";
-      url = "https://github.com/cespare/xxhash";
-      rev = "v1.1.0";
-      sha256 = "1qyzlcdcayavfazvi03izx83fvip8h36kis44zr2sg7xf6sx6l4x";
-    };
-  }
-  {
-    goPackagePath = "github.com/chzyer/logex";
-    fetch = {
-      type = "git";
-      url = "https://github.com/chzyer/logex";
-      rev = "v1.1.10";
-      sha256 = "08pbjj3wx9acavlwyr055isa8a5hnmllgdv5k6ra60l5y1brmlq4";
-    };
-  }
-  {
-    goPackagePath = "github.com/chzyer/readline";
-    fetch = {
-      type = "git";
-      url = "https://github.com/chzyer/readline";
-      rev = "2972be24d48e";
-      sha256 = "104q8dazj8yf6b089jjr82fy9h1g80zyyzvp3g8b44a7d8ngjj6r";
-    };
-  }
-  {
-    goPackagePath = "github.com/chzyer/test";
-    fetch = {
-      type = "git";
-      url = "https://github.com/chzyer/test";
-      rev = "a1ea475d72b1";
-      sha256 = "0rns2aqk22i9xsgyap0pq8wi4cfaxsri4d9q6xxhhyma8jjsnj2k";
-    };
-  }
-  {
-    goPackagePath = "github.com/client9/misspell";
-    fetch = {
-      type = "git";
-      url = "https://github.com/client9/misspell";
-      rev = "v0.3.4";
-      sha256 = "1vwf33wsc4la25zk9nylpbp9px3svlmldkm0bha4hp56jws4q9cs";
-    };
-  }
-  {
-    goPackagePath = "github.com/cncf/udpa";
-    fetch = {
-      type = "git";
-      url = "https://github.com/cncf/udpa";
-      rev = "269d4d468f6f";
-      sha256 = "0i1jiaw2k3hlwwmg4hap81vb4s1p25xp9kdfww37v0fbgjariccs";
-    };
-  }
-  {
-    goPackagePath = "github.com/coreos/bbolt";
-    fetch = {
-      type = "git";
-      url = "https://github.com/coreos/bbolt";
-      rev = "v1.3.2";
-      sha256 = "13d5l6p6c5wvkr6vn9hkhz9c593qifn7fgx0hg4d6jcvg1y0bnm2";
-    };
-  }
-  {
-    goPackagePath = "github.com/coreos/etcd";
-    fetch = {
-      type = "git";
-      url = "https://github.com/coreos/etcd";
-      rev = "v3.3.10";
-      sha256 = "1x2ii1hj8jraba8rbxz6dmc03y3sjxdnzipdvg6fywnlq1f3l3wl";
-    };
-  }
-  {
-    goPackagePath = "github.com/coreos/go-semver";
-    fetch = {
-      type = "git";
-      url = "https://github.com/coreos/go-semver";
-      rev = "v0.2.0";
-      sha256 = "1gghi5bnqj50hfxhqc1cxmynqmh2yk9ii7ab9gsm75y5cp94ymk0";
-    };
-  }
-  {
-    goPackagePath = "github.com/coreos/go-systemd";
-    fetch = {
-      type = "git";
-      url = "https://github.com/coreos/go-systemd";
-      rev = "95778dfbb74e";
-      sha256 = "1s3bg9p78wkixn2bqb2p23wbsqfg949ml6crw2b498s71mwh8rcf";
-    };
-  }
-  {
-    goPackagePath = "github.com/coreos/pkg";
-    fetch = {
-      type = "git";
-      url = "https://github.com/coreos/pkg";
-      rev = "399ea9e2e55f";
-      sha256 = "0nxbn0m7lr4dg0yrwnvlkfiyg3ndv8vdpssjx7b714nivpc6ar0y";
-    };
-  }
-  {
-    goPackagePath = "github.com/cpuguy83/go-md2man";
-    fetch = {
-      type = "git";
-      url = "https://github.com/cpuguy83/go-md2man";
-      rev = "v2.0.0";
-      sha256 = "0r1f7v475dxxgzqci1mxfliwadcrk86ippflx9n411325l4g3ghv";
-    };
-  }
-  {
-    goPackagePath = "github.com/davecgh/go-spew";
-    fetch = {
-      type = "git";
-      url = "https://github.com/davecgh/go-spew";
-      rev = "v1.1.1";
-      sha256 = "0hka6hmyvp701adzag2g26cxdj47g21x6jz4sc6jjz1mn59d474y";
-    };
-  }
-  {
-    goPackagePath = "github.com/dgrijalva/jwt-go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/dgrijalva/jwt-go";
-      rev = "v3.2.0";
-      sha256 = "08m27vlms74pfy5z79w67f9lk9zkx6a9jd68k3c4msxy75ry36mp";
-    };
-  }
-  {
-    goPackagePath = "github.com/dgryski/go-sip13";
-    fetch = {
-      type = "git";
-      url = "https://github.com/dgryski/go-sip13";
-      rev = "e10d5fee7954";
-      sha256 = "15fyibfas209ljz3f7g07kdmfbl3hhyd9n5n7aq5n5p9m5mn41d6";
-    };
-  }
-  {
-    goPackagePath = "github.com/dnaeon/go-vcr";
-    fetch = {
-      type = "git";
-      url = "https://github.com/dnaeon/go-vcr";
-      rev = "v1.0.1";
-      sha256 = "1d0kpqr12qrqlamz5a47bp05mx49za2v6l1k7c6z71xahfmb7v2d";
-    };
-  }
-  {
-    goPackagePath = "github.com/dustin/go-humanize";
-    fetch = {
-      type = "git";
-      url = "https://github.com/dustin/go-humanize";
-      rev = "v1.0.0";
-      sha256 = "1kqf1kavdyvjk7f8kx62pnm7fbypn9z1vbf8v2qdh3y7z7a0cbl3";
-    };
-  }
-  {
-    goPackagePath = "github.com/envoyproxy/go-control-plane";
-    fetch = {
-      type = "git";
-      url = "https://github.com/envoyproxy/go-control-plane";
-      rev = "v0.9.4";
-      sha256 = "0m0crzx70lp7vz13v20wxb1fcfdnzp7h3mkh3bn6a8mbfz6w5asj";
-    };
-  }
-  {
-    goPackagePath = "github.com/envoyproxy/protoc-gen-validate";
-    fetch = {
-      type = "git";
-      url = "https://github.com/envoyproxy/protoc-gen-validate";
-      rev = "v0.1.0";
-      sha256 = "0kxd3wwh3xwqk0r684hsy281xq4y71cd11d4q2hspcjbnlbwh7cy";
-    };
-  }
-  {
-    goPackagePath = "github.com/fsnotify/fsnotify";
-    fetch = {
-      type = "git";
-      url = "https://github.com/fsnotify/fsnotify";
-      rev = "v1.4.7";
-      sha256 = "07va9crci0ijlivbb7q57d2rz9h27zgn2fsm60spjsqpdbvyrx4g";
-    };
-  }
-  {
-    goPackagePath = "github.com/ghodss/yaml";
-    fetch = {
-      type = "git";
-      url = "https://github.com/ghodss/yaml";
-      rev = "v1.0.0";
-      sha256 = "0skwmimpy7hlh7pva2slpcplnm912rp3igs98xnqmn859kwa5v8g";
-    };
-  }
-  {
-    goPackagePath = "github.com/go-gl/glfw";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-gl/glfw";
-      rev = "6f7a984d4dc4";
-      sha256 = "1nyv7h08qf4dp8w9pmcnrc6vv9bkwj8fil6pz0mkbss5hf4i8xcq";
-    };
-  }
-  {
-    goPackagePath = "github.com/go-kit/kit";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-kit/kit";
-      rev = "v0.8.0";
-      sha256 = "1rcywbc2pvab06qyf8pc2rdfjv7r6kxdv2v4wnpqnjhz225wqvc0";
-    };
-  }
-  {
-    goPackagePath = "github.com/go-logfmt/logfmt";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-logfmt/logfmt";
-      rev = "v0.4.0";
-      sha256 = "06smxc112xmixz78nyvk3b2hmc7wasf2sl5vxj1xz62kqcq9lzm9";
-    };
-  }
-  {
-    goPackagePath = "github.com/go-sql-driver/mysql";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-sql-driver/mysql";
-      rev = "v1.5.0";
-      sha256 = "11x0m9yf3kdnf6981182r824psgxwfaqhn3x3in4yiidp0w0hk3v";
-    };
-  }
-  {
-    goPackagePath = "github.com/go-stack/stack";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-stack/stack";
-      rev = "v1.8.0";
-      sha256 = "0wk25751ryyvxclyp8jdk5c3ar0cmfr8lrjb66qbg4808x66b96v";
-    };
-  }
-  {
-    goPackagePath = "github.com/gogo/protobuf";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gogo/protobuf";
-      rev = "v1.2.1";
-      sha256 = "06yqa6h0kw3gr5pc3qmas7f7435a96zf7iw7p0l00r2hqf6fqq6m";
-    };
-  }
-  {
-    goPackagePath = "github.com/golang/glog";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/glog";
-      rev = "23def4e6c14b";
-      sha256 = "0jb2834rw5sykfr937fxi8hxi2zy80sj2bdn9b3jb4b26ksqng30";
-    };
-  }
-  {
-    goPackagePath = "github.com/golang/groupcache";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/groupcache";
-      rev = "8c9f03a8e57e";
-      sha256 = "0vjjr79r32icjzlb05wn02k59av7jx0rn1jijml8r4whlg7dnkfh";
-    };
-  }
-  {
-    goPackagePath = "github.com/golang/mock";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/mock";
-      rev = "v1.4.3";
-      sha256 = "1p37xnja1dgq5ykx24n7wincwz2gahjh71b95p8vpw7ss2g8j8wx";
-    };
-  }
-  {
-    goPackagePath = "github.com/golang/protobuf";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/protobuf";
-      rev = "v1.4.1";
-      sha256 = "0w7ks4vffnnkp0miwgc3chrsnmya45lzvpahb2wmw0jwhdp5kdx7";
-    };
-  }
-  {
-    goPackagePath = "github.com/google/btree";
-    fetch = {
-      type = "git";
-      url = "https://github.com/google/btree";
-      rev = "v1.0.0";
-      sha256 = "0ba430m9fbnagacp57krgidsyrgp3ycw5r7dj71brgp5r52g82p6";
-    };
-  }
-  {
-    goPackagePath = "github.com/google/go-cmp";
-    fetch = {
-      type = "git";
-      url = "https://github.com/google/go-cmp";
-      rev = "v0.4.0";
-      sha256 = "1x5pvl3fb5sbyng7i34431xycnhmx8xx94gq2n19g6p0vz68z2v2";
-    };
-  }
-  {
-    goPackagePath = "github.com/google/martian";
-    fetch = {
-      type = "git";
-      url = "https://github.com/google/martian";
-      rev = "v2.1.0";
-      sha256 = "197hil6vrjk50b9wvwyzf61csid83whsjj6ik8mc9r2lryxlyyrp";
-    };
-  }
-  {
-    goPackagePath = "github.com/google/pprof";
-    fetch = {
-      type = "git";
-      url = "https://github.com/google/pprof";
-      rev = "fc25d7d30c6d";
-      sha256 = "0ba28qx2i1bi6n6x5g670v8hmqavwj8lwl8psnc6vzagmdhjw0vg";
-    };
-  }
-  {
-    goPackagePath = "github.com/google/renameio";
-    fetch = {
-      type = "git";
-      url = "https://github.com/google/renameio";
-      rev = "v0.1.0";
-      sha256 = "1ki2x5a9nrj17sn092d6n4zr29lfg5ydv4xz5cp58z6cw8ip43jx";
-    };
-  }
-  {
-    goPackagePath = "github.com/googleapis/gax-go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/googleapis/gax-go";
-      rev = "v2.0.5";
-      sha256 = "1lxawwngv6miaqd25s3ba0didfzylbwisd2nz7r4gmbmin6jsjrx";
-    };
-  }
-  {
-    goPackagePath = "github.com/gorilla/websocket";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gorilla/websocket";
-      rev = "v1.4.0";
-      sha256 = "00i4vb31nsfkzzk7swvx3i75r2d960js3dri1875vypk3v2s0pzk";
-    };
-  }
-  {
-    goPackagePath = "github.com/grpc-ecosystem/go-grpc-middleware";
-    fetch = {
-      type = "git";
-      url = "https://github.com/grpc-ecosystem/go-grpc-middleware";
-      rev = "v1.0.0";
-      sha256 = "0lwgxih021xfhfb1xb9la5f98bpgpaiz63sbllx77qwwl2rmhrsp";
-    };
-  }
-  {
-    goPackagePath = "github.com/grpc-ecosystem/go-grpc-prometheus";
-    fetch = {
-      type = "git";
-      url = "https://github.com/grpc-ecosystem/go-grpc-prometheus";
-      rev = "v1.2.0";
-      sha256 = "1lzk54h7np32b3acidg1ggbn8ppbnns0m71gcg9d1qkkdh8zrijl";
-    };
-  }
-  {
-    goPackagePath = "github.com/grpc-ecosystem/grpc-gateway";
-    fetch = {
-      type = "git";
-      url = "https://github.com/grpc-ecosystem/grpc-gateway";
-      rev = "v1.9.0";
-      sha256 = "1r4y48c76yxc2hpqszfjirvh7zxjb6z72qmk95li12ar79dhv3dy";
-    };
-  }
-  {
-    goPackagePath = "github.com/hashicorp/golang-lru";
-    fetch = {
-      type = "git";
-      url = "https://github.com/hashicorp/golang-lru";
-      rev = "v0.5.1";
-      sha256 = "13f870cvk161bzjj6x41l45r5x9i1z9r2ymwmvm7768kg08zznpy";
-    };
-  }
-  {
-    goPackagePath = "github.com/hashicorp/hcl";
-    fetch = {
-      type = "git";
-      url = "https://github.com/hashicorp/hcl";
-      rev = "v1.0.0";
-      sha256 = "0q6ml0qqs0yil76mpn4mdx4lp94id8vbv575qm60jzl1ijcl5i66";
-    };
-  }
-  {
-    goPackagePath = "github.com/ianlancetaylor/demangle";
-    fetch = {
-      type = "git";
-      url = "https://github.com/ianlancetaylor/demangle";
-      rev = "5e5cf60278f6";
-      sha256 = "1fhjk11cip9c3jyj1byz9z77n6n2rlxmyz0xjx1zpn1da3cvri75";
-    };
-  }
-  {
-    goPackagePath = "github.com/inconshreveable/mousetrap";
-    fetch = {
-      type = "git";
-      url = "https://github.com/inconshreveable/mousetrap";
-      rev = "v1.0.0";
-      sha256 = "1mn0kg48xkd74brf48qf5hzp0bc6g8cf5a77w895rl3qnlpfw152";
-    };
-  }
-  {
-    goPackagePath = "github.com/jmespath/go-jmespath";
-    fetch = {
-      type = "git";
-      url = "https://github.com/jmespath/go-jmespath";
-      rev = "v0.3.0";
-      sha256 = "12qgp7yb7yfjxhd311kb820fcjmg7gd4hp2fc4v6x8s7121pwnjp";
-    };
-  }
-  {
-    goPackagePath = "github.com/jonboulle/clockwork";
-    fetch = {
-      type = "git";
-      url = "https://github.com/jonboulle/clockwork";
-      rev = "v0.1.0";
-      sha256 = "1pqxhsdavbp1n5grgyx2j6ylvql2fzn2cvpsgkc8li69dil7sibl";
-    };
-  }
-  {
-    goPackagePath = "github.com/jstemmer/go-junit-report";
-    fetch = {
-      type = "git";
-      url = "https://github.com/jstemmer/go-junit-report";
-      rev = "v0.9.1";
-      sha256 = "1knip80yir1cdsjlb3rzy0a4w3kl4ljpiciaz6hjzwqlfhnv7bkw";
-    };
-  }
-  {
-    goPackagePath = "github.com/juju/ratelimit";
-    fetch = {
-      type = "git";
-      url = "https://github.com/juju/ratelimit";
-      rev = "v1.0.1";
-      sha256 = "0ppwvwbh9jdpdk4f9924vw373cpfz5g5ad10c707p22a984vanrz";
-    };
-  }
-  {
-    goPackagePath = "github.com/julienschmidt/httprouter";
-    fetch = {
-      type = "git";
-      url = "https://github.com/julienschmidt/httprouter";
-      rev = "v1.2.0";
-      sha256 = "1k8bylc9s4vpvf5xhqh9h246dl1snxrzzz0614zz88cdh8yzs666";
-    };
-  }
-  {
-    goPackagePath = "github.com/kisielk/errcheck";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kisielk/errcheck";
-      rev = "v1.1.0";
-      sha256 = "19vd4rxmqbk5lpiav3pf7df3yjlz0l0dwx9mn0gjq5f998iyhy6y";
-    };
-  }
-  {
-    goPackagePath = "github.com/kisielk/gotool";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kisielk/gotool";
-      rev = "v1.0.0";
-      sha256 = "14af2pa0ssyp8bp2mvdw184s5wcysk6akil3wzxmr05wwy951iwn";
-    };
-  }
-  {
-    goPackagePath = "github.com/klauspost/compress";
-    fetch = {
-      type = "git";
-      url = "https://github.com/klauspost/compress";
-      rev = "v1.10.6";
-      sha256 = "0jnm5mjazxkjwzb7z6sjlqm2l68z4h4xjhir2lgfkf04rj4l290s";
-    };
-  }
-  {
-    goPackagePath = "github.com/klauspost/pgzip";
-    fetch = {
-      type = "git";
-      url = "https://github.com/klauspost/pgzip";
-      rev = "v1.2.4";
-      sha256 = "0mnhfdn0isbkra455jynqjbmrwymx09shlbzbyvgfycih3nbrif0";
-    };
-  }
-  {
-    goPackagePath = "github.com/konsorten/go-windows-terminal-sequences";
-    fetch = {
-      type = "git";
-      url = "https://github.com/konsorten/go-windows-terminal-sequences";
-      rev = "v1.0.1";
-      sha256 = "1lchgf27n276vma6iyxa0v1xds68n2g8lih5lavqnx5x6q5pw2ip";
-    };
-  }
-  {
-    goPackagePath = "github.com/kr/logfmt";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kr/logfmt";
-      rev = "b84e30acd515";
-      sha256 = "02ldzxgznrfdzvghfraslhgp19la1fczcbzh7wm2zdc6lmpd1qq9";
-    };
-  }
-  {
-    goPackagePath = "github.com/kr/pretty";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kr/pretty";
-      rev = "v0.1.0";
-      sha256 = "18m4pwg2abd0j9cn5v3k2ksk9ig4vlwxmlw9rrglanziv9l967qp";
-    };
-  }
-  {
-    goPackagePath = "github.com/kr/pty";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kr/pty";
-      rev = "v1.1.1";
-      sha256 = "0383f0mb9kqjvncqrfpidsf8y6ns5zlrc91c6a74xpyxjwvzl2y6";
-    };
-  }
-  {
-    goPackagePath = "github.com/kr/text";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kr/text";
-      rev = "v0.1.0";
-      sha256 = "1gm5bsl01apvc84bw06hasawyqm4q84vx1pm32wr9jnd7a8vjgj1";
-    };
-  }
-  {
-    goPackagePath = "github.com/kurin/blazer";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kurin/blazer";
-      rev = "v0.5.3";
-      sha256 = "18jsq7n31ycvaivpvyksbddj82spw4g29w6dx92x2wab2hzbc7ik";
-    };
-  }
-  {
-    goPackagePath = "github.com/magiconair/properties";
-    fetch = {
-      type = "git";
-      url = "https://github.com/magiconair/properties";
-      rev = "v1.8.0";
-      sha256 = "1a10362wv8a8qwb818wygn2z48lgzch940hvpv81hv8gc747ajxn";
-    };
-  }
-  {
-    goPackagePath = "github.com/mattn/go-ieproxy";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mattn/go-ieproxy";
-      rev = "v0.0.1";
-      sha256 = "0x1ijwwp22s20vjbca5ac7y7bx2jp6jizzqa38ks4943q7vi4w09";
-    };
-  }
-  {
-    goPackagePath = "github.com/matttproud/golang_protobuf_extensions";
-    fetch = {
-      type = "git";
-      url = "https://github.com/matttproud/golang_protobuf_extensions";
-      rev = "v1.0.1";
-      sha256 = "1d0c1isd2lk9pnfq2nk0aih356j30k3h1gi2w0ixsivi5csl7jya";
-    };
-  }
-  {
-    goPackagePath = "github.com/miolini/datacounter";
-    fetch = {
-      type = "git";
-      url = "https://github.com/miolini/datacounter";
-      rev = "v1.0.2";
-      sha256 = "0lqhdb9glx65ycjjrqqqpd28zi95qnr2sdz93y6fma0khss46c5f";
-    };
-  }
-  {
-    goPackagePath = "github.com/mitchellh/go-homedir";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mitchellh/go-homedir";
-      rev = "v1.1.0";
-      sha256 = "0ydzkipf28hwj2bfxqmwlww47khyk6d152xax4bnyh60f4lq3nx1";
-    };
-  }
-  {
-    goPackagePath = "github.com/mitchellh/mapstructure";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mitchellh/mapstructure";
-      rev = "v1.1.2";
-      sha256 = "03bpv28jz9zhn4947saqwi328ydj7f6g6pf1m2d4m5zdh5jlfkrr";
-    };
-  }
-  {
-    goPackagePath = "github.com/mwitkow/go-conntrack";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mwitkow/go-conntrack";
-      rev = "cc309e4a2223";
-      sha256 = "0nbrnpk7bkmqg9mzwsxlm0y8m7s9qd9phr1q30qlx2qmdmz7c1mf";
-    };
-  }
-  {
-    goPackagePath = "github.com/nightlyone/lockfile";
-    fetch = {
-      type = "git";
-      url = "https://github.com/nightlyone/lockfile";
-      rev = "v1.0.0";
-      sha256 = "0jzlngank7yaq5pl5mipsfglmalv9x2b9yhqr78w5dmx4hikh7kr";
-    };
-  }
-  {
-    goPackagePath = "github.com/oklog/ulid";
-    fetch = {
-      type = "git";
-      url = "https://github.com/oklog/ulid";
-      rev = "v1.3.1";
-      sha256 = "0hybwyid820n80axrk863k2py93hbqlq6hxhf84ppmz0qd0ys0gq";
-    };
-  }
-  {
-    goPackagePath = "github.com/op/go-logging";
-    fetch = {
-      type = "git";
-      url = "https://github.com/op/go-logging";
-      rev = "970db520ece7";
-      sha256 = "1cpna2x5l071z1vrnk7zipdkka8dzwsjyx7m79xk0lr08rip0kcj";
-    };
-  }
-  {
-    goPackagePath = "github.com/pelletier/go-toml";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pelletier/go-toml";
-      rev = "v1.2.0";
-      sha256 = "1fjzpcjng60mc3a4b2ql5a00d5gah84wj740dabv9kq67mpg8fxy";
-    };
-  }
-  {
-    goPackagePath = "github.com/pkg/errors";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pkg/errors";
-      rev = "v0.9.1";
-      sha256 = "1761pybhc2kqr6v5fm8faj08x9bql8427yqg6vnfv6nhrasx1mwq";
-    };
-  }
-  {
-    goPackagePath = "github.com/pmezard/go-difflib";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pmezard/go-difflib";
-      rev = "v1.0.0";
-      sha256 = "0c1cn55m4rypmscgf0rrb88pn58j3ysvc2d0432dp3c6fqg6cnzw";
-    };
-  }
-  {
-    goPackagePath = "github.com/prometheus/client_golang";
-    fetch = {
-      type = "git";
-      url = "https://github.com/prometheus/client_golang";
-      rev = "v0.9.3";
-      sha256 = "1608rm1y2p3iv8k2x7wyc6hshvpbfkv2k77hy0x870syms1g3g1p";
-    };
-  }
-  {
-    goPackagePath = "github.com/prometheus/client_model";
-    fetch = {
-      type = "git";
-      url = "https://github.com/prometheus/client_model";
-      rev = "14fe0d1b01d4";
-      sha256 = "0zdmk6rbbx39cvfz0r59v2jg5sg9yd02b4pds5n5llgvivi99550";
-    };
-  }
-  {
-    goPackagePath = "github.com/prometheus/common";
-    fetch = {
-      type = "git";
-      url = "https://github.com/prometheus/common";
-      rev = "v0.4.0";
-      sha256 = "00008pczafy982m59n1j31pnp41f4grbc2c40jccp52xg3m5klmr";
-    };
-  }
-  {
-    goPackagePath = "github.com/prometheus/procfs";
-    fetch = {
-      type = "git";
-      url = "https://github.com/prometheus/procfs";
-      rev = "5867b95ac084";
-      sha256 = "1rahdk62ajj4zpfb3mgzjqip773la9fb0m87m7s9a0b39l3fmzvr";
-    };
-  }
-  {
-    goPackagePath = "github.com/prometheus/tsdb";
-    fetch = {
-      type = "git";
-      url = "https://github.com/prometheus/tsdb";
-      rev = "v0.7.1";
-      sha256 = "1c1da8i5byvhh4fp3vqjfb65aaksjskn3ggb8wg9hcfzjrhgpz04";
-    };
-  }
-  {
-    goPackagePath = "github.com/rogpeppe/fastuuid";
-    fetch = {
-      type = "git";
-      url = "https://github.com/rogpeppe/fastuuid";
-      rev = "6724a57986af";
-      sha256 = "12s65phfx6hxj4v0b5kj8akgrbf5mxpa101fyzw03h6hld1f70cz";
-    };
-  }
-  {
-    goPackagePath = "github.com/rogpeppe/go-internal";
-    fetch = {
-      type = "git";
-      url = "https://github.com/rogpeppe/go-internal";
-      rev = "v1.3.0";
-      sha256 = "0mcdh1licgnnahwml9y2iq6xy5x9xmjw5frcnds2s3wpjyqrl216";
-    };
-  }
-  {
-    goPackagePath = "github.com/russross/blackfriday";
-    fetch = {
-      type = "git";
-      url = "https://github.com/russross/blackfriday";
-      rev = "v2.0.1";
-      sha256 = "0nlz7isdd4rgnwzs68499hlwicxz34j2k2a0b8jy0y7ycd2bcr5j";
-    };
-  }
-  {
-    goPackagePath = "github.com/satori/go.uuid";
-    fetch = {
-      type = "git";
-      url = "https://github.com/satori/go.uuid";
-      rev = "v1.2.0";
-      sha256 = "1j4s5pfg2ldm35y8ls8jah4dya2grfnx2drb4jcbjsyrp4cm5yfb";
-    };
-  }
-  {
-    goPackagePath = "github.com/shurcooL/sanitized_anchor_name";
-    fetch = {
-      type = "git";
-      url = "https://github.com/shurcooL/sanitized_anchor_name";
-      rev = "v1.0.0";
-      sha256 = "1gv9p2nr46z80dnfjsklc6zxbgk96349sdsxjz05f3z6wb6m5l8f";
-    };
-  }
-  {
-    goPackagePath = "github.com/sirupsen/logrus";
-    fetch = {
-      type = "git";
-      url = "https://github.com/sirupsen/logrus";
-      rev = "v1.2.0";
-      sha256 = "0r6334x2bls8ddznvzaldx4g88msjjns4mlks95rqrrg7h0ijigg";
-    };
-  }
-  {
-    goPackagePath = "github.com/soheilhy/cmux";
-    fetch = {
-      type = "git";
-      url = "https://github.com/soheilhy/cmux";
-      rev = "v0.1.4";
-      sha256 = "1f736g68d9vwlyfb6g0fxkr0r875369xafk30cz8kaq5niaqwv0h";
-    };
-  }
-  {
-    goPackagePath = "github.com/spaolacci/murmur3";
-    fetch = {
-      type = "git";
-      url = "https://github.com/spaolacci/murmur3";
-      rev = "f09979ecbc72";
-      sha256 = "1lv3zyz3jy2d76bhvvs8svygx66606iygdvwy5cwc0p5z8yghq25";
-    };
-  }
-  {
-    goPackagePath = "github.com/spf13/afero";
-    fetch = {
-      type = "git";
-      url = "https://github.com/spf13/afero";
-      rev = "v1.1.2";
-      sha256 = "0miv4faf5ihjfifb1zv6aia6f6ik7h1s4954kcb8n6ixzhx9ck6k";
-    };
-  }
-  {
-    goPackagePath = "github.com/spf13/cast";
-    fetch = {
-      type = "git";
-      url = "https://github.com/spf13/cast";
-      rev = "v1.3.0";
-      sha256 = "0xq1ffqj8y8h7dcnm0m9lfrh0ga7pssnn2c1dnr09chqbpn4bdc5";
-    };
-  }
-  {
-    goPackagePath = "github.com/spf13/cobra";
-    fetch = {
-      type = "git";
-      url = "https://github.com/spf13/cobra";
-      rev = "v1.0.0";
-      sha256 = "0vbppqqhby302a5ayn0296jqr71qkcd4c9am7wzsk6z71fwdsa7h";
-    };
-  }
-  {
-    goPackagePath = "github.com/spf13/jwalterweatherman";
-    fetch = {
-      type = "git";
-      url = "https://github.com/spf13/jwalterweatherman";
-      rev = "v1.0.0";
-      sha256 = "093fmmvavv84pv4q84hav7ph3fmrq87bvspjj899q0qsx37yvdr8";
-    };
-  }
-  {
-    goPackagePath = "github.com/spf13/pflag";
-    fetch = {
-      type = "git";
-      url = "https://github.com/spf13/pflag";
-      rev = "v1.0.5";
-      sha256 = "0gpmacngd0gpslnbkzi263f5ishigzgh6pbdv9hp092rnjl4nd31";
-    };
-  }
-  {
-    goPackagePath = "github.com/spf13/viper";
-    fetch = {
-      type = "git";
-      url = "https://github.com/spf13/viper";
-      rev = "v1.4.0";
-      sha256 = "1zpzxvn13wpvbblbbn73svaq39zgxfjqhci9d68g3qf309pcfy19";
-    };
-  }
-  {
-    goPackagePath = "github.com/stretchr/objx";
-    fetch = {
-      type = "git";
-      url = "https://github.com/stretchr/objx";
-      rev = "v0.1.1";
-      sha256 = "0iph0qmpyqg4kwv8jsx6a56a7hhqq8swrazv40ycxk9rzr0s8yls";
-    };
-  }
-  {
-    goPackagePath = "github.com/stretchr/testify";
-    fetch = {
-      type = "git";
-      url = "https://github.com/stretchr/testify";
-      rev = "v1.5.1";
-      sha256 = "09r89m1wy4cjv2nps1ykp00qjpi0531r07q3s34hr7m6njk4srkl";
-    };
-  }
-  {
-    goPackagePath = "github.com/tmc/grpc-websocket-proxy";
-    fetch = {
-      type = "git";
-      url = "https://github.com/tmc/grpc-websocket-proxy";
-      rev = "0ad062ec5ee5";
-      sha256 = "1anw4v9wspnw9xf2z5r9w0sszwjklyanl0l85wgg6nxak9gnrqp4";
-    };
-  }
-  {
-    goPackagePath = "github.com/ugorji/go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/ugorji/go";
-      rev = "v1.1.4";
-      sha256 = "0ma2qvn5wqvjidpdz74x832a813qnr1cxbx6n6n125ak9b3wbn5w";
-    };
-  }
-  {
-    goPackagePath = "github.com/xiang90/probing";
-    fetch = {
-      type = "git";
-      url = "https://github.com/xiang90/probing";
-      rev = "43a291ad63a2";
-      sha256 = "1z22ms16j5j42775mf31isanwx2pwr1d8wqw8006dczjv36qnz5i";
-    };
-  }
-  {
-    goPackagePath = "github.com/xordataexchange/crypt";
-    fetch = {
-      type = "git";
-      url = "https://github.com/xordataexchange/crypt";
-      rev = "b2862e3d0a77";
-      sha256 = "04q3856anpzl4gdfgmg7pbp9cx231nkz3ymq2xp27rnmmwhfxr8y";
-    };
-  }
-  {
-    goPackagePath = "github.com/yuin/goldmark";
-    fetch = {
-      type = "git";
-      url = "https://github.com/yuin/goldmark";
-      rev = "v1.1.27";
-      sha256 = "1872cqnii0kwiqcy81yin0idvjy5mdy4zlzz0csb319lcjs3b923";
-    };
-  }
-  {
-    goPackagePath = "go.etcd.io/bbolt";
-    fetch = {
-      type = "git";
-      url = "https://github.com/etcd-io/bbolt";
-      rev = "v1.3.2";
-      sha256 = "13d5l6p6c5wvkr6vn9hkhz9c593qifn7fgx0hg4d6jcvg1y0bnm2";
-    };
-  }
-  {
-    goPackagePath = "go.opencensus.io";
-    fetch = {
-      type = "git";
-      url = "https://github.com/census-instrumentation/opencensus-go";
-      rev = "v0.22.3";
-      sha256 = "0xj16iq5jp26hi2py7lsd8cvqh651fgn39y05gzvjdi88d9xd3nw";
-    };
-  }
-  {
-    goPackagePath = "go.uber.org/atomic";
-    fetch = {
-      type = "git";
-      url = "https://github.com/uber-go/atomic";
-      rev = "v1.4.0";
-      sha256 = "0c6yzx15c20719xii3dm0vyjd8i9jx45m0wh5yp1zf29b0gbljcy";
-    };
-  }
-  {
-    goPackagePath = "go.uber.org/multierr";
-    fetch = {
-      type = "git";
-      url = "https://github.com/uber-go/multierr";
-      rev = "v1.1.0";
-      sha256 = "1slfc6syvw8cvr6rbrjsy6ja5w8gsx0f8aq8qm16rp2x5c2pj07w";
-    };
-  }
-  {
-    goPackagePath = "go.uber.org/zap";
-    fetch = {
-      type = "git";
-      url = "https://github.com/uber-go/zap";
-      rev = "v1.10.0";
-      sha256 = "10hdzr1rghwbsl6bbd30779dx44fh9mg9pq8d2cgqlknqxxpvpvr";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/crypto";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/crypto";
-      rev = "06a226fb4e37";
-      sha256 = "0fdig6jx81g7a44dnxggibl909wchsj4nakmmhhz7db36sl0d7m5";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/exp";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/exp";
-      rev = "6cc2880d07d6";
-      sha256 = "1iia6hiif6hcp0cg1i6nq63qg0pmvm2kq24pf2r2il3597rfmlgy";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/image";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/image";
-      rev = "cff245a6509b";
-      sha256 = "0hiznlkiaay30acwvvyq8g6bm32r7bc6gv47pygrcxqpapasbz84";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/lint";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/lint";
-      rev = "738671d3881b";
-      sha256 = "0jkiz4py59jjnkyxbxifpf7bsar11lbgmj5jiq2kic5k03shkn9c";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/mobile";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/mobile";
-      rev = "d2bd2a29d028";
-      sha256 = "1nv6vvhnjr01nx9y06q46ww87dppdwpbqrlsfg1xf2587wxl8xiv";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/mod";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/mod";
-      rev = "v0.2.0";
-      sha256 = "1fp6885dclq77mh73v7i54v2b9llpv4di193zc8vmsbbkkc483cl";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/net";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/net";
-      rev = "7e3656a0809f";
-      sha256 = "1rmj59bd0hvf8cbp42c0y8y38prs5ill1zszhqp9i8m86cvkfqk9";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/oauth2";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/oauth2";
-      rev = "bf48bf16ab8d";
-      sha256 = "1sirdib60zwmh93kf9qrx51r8544k1p9rs5mk0797wibz3m4mrdg";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/sync";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/sync";
-      rev = "43a5402ce75a";
-      sha256 = "0j6zrrb81qjr1926kkwmn0di9a0jn8qyjd9dw614rfkihxgq1vsm";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/sys";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/sys";
-      rev = "7e40ca221e25";
-      sha256 = "1fkhs1sn6prfsqaj70kya2gn1sqqa85lmgff6j6s7027zc1yjvqa";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/text";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/text";
-      rev = "v0.3.2";
-      sha256 = "0flv9idw0jm5nm8lx25xqanbkqgfiym6619w575p7nrdh0riqwqh";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/time";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/time";
-      rev = "555d28b269f0";
-      sha256 = "1rhl4lyz030kwfsg63yk83yd3ivryv1afmzdz9sxbhcj84ym6h4r";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/tools";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/tools";
-      rev = "2bc93b1c0c88";
-      sha256 = "10sg7nvw40f2d6hxmsy4nvhmawbidk022v3arbh8acsjxglw84zs";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/xerrors";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/xerrors";
-      rev = "9bdfabe68543";
-      sha256 = "1yjfi1bk9xb81lqn85nnm13zz725wazvrx3b50hx19qmwg7a4b0c";
-    };
-  }
-  {
-    goPackagePath = "google.golang.org/api";
-    fetch = {
-      type = "git";
-      url = "https://github.com/googleapis/google-api-go-client";
-      rev = "v0.25.0";
-      sha256 = "0bfpii160ns1pl3iqc38h5db258mv58igf2ifglds3dajgsj2qrr";
-    };
-  }
-  {
-    goPackagePath = "google.golang.org/appengine";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/appengine";
-      rev = "v1.6.6";
-      sha256 = "15c38h6fbv06cnkr6yknygfrpibyms2mya4w0l29kaxf42jn1qi5";
-    };
-  }
-  {
-    goPackagePath = "google.golang.org/genproto";
-    fetch = {
-      type = "git";
-      url = "https://github.com/googleapis/go-genproto";
-      rev = "f5ebc3bea380";
-      sha256 = "1v5dyp6g35rwjwx1ixjy7yh1hay4n7ya5aq5h4ckvd9h0j7rw5sz";
-    };
-  }
-  {
-    goPackagePath = "google.golang.org/grpc";
-    fetch = {
-      type = "git";
-      url = "https://github.com/grpc/grpc-go";
-      rev = "v1.29.1";
-      sha256 = "1465947r6536si36cl2ppx7929la9zba1y6xfczfyp4kgf8988hf";
-    };
-  }
-  {
-    goPackagePath = "google.golang.org/protobuf";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/protobuf";
-      rev = "v1.22.0";
-      sha256 = "0n7lc4m7kfvj01glc0gnjy0zsnsic7cxnbvlajy0h14cxbab87pj";
-    };
-  }
-  {
-    goPackagePath = "gopkg.in/alecthomas/kingpin.v2";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/alecthomas/kingpin.v2";
-      rev = "v2.2.6";
-      sha256 = "0mndnv3hdngr3bxp7yxfd47cas4prv98sqw534mx7vp38gd88n5r";
-    };
-  }
-  {
-    goPackagePath = "gopkg.in/check.v1";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/check.v1";
-      rev = "788fd7840127";
-      sha256 = "0v3bim0j375z81zrpr5qv42knqs0y2qv2vkjiqi5axvb78slki1a";
-    };
-  }
-  {
-    goPackagePath = "gopkg.in/errgo.v2";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/errgo.v2";
-      rev = "v2.1.0";
-      sha256 = "065mbihiy7q67wnql0bzl9y1kkvck5ivra68254zbih52jxwrgr2";
-    };
-  }
-  {
-    goPackagePath = "gopkg.in/resty.v1";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/resty.v1";
-      rev = "v1.12.0";
-      sha256 = "062mn735rqzhha5ag07z4gz08hxzrfm2yx067jfmaaxmb6797lmp";
-    };
-  }
-  {
-    goPackagePath = "gopkg.in/yaml.v2";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/yaml.v2";
-      rev = "v2.2.2";
-      sha256 = "01wj12jzsdqlnidpyjssmj0r4yavlqy7dwrg7adqd8dicjc4ncsa";
-    };
-  }
-  {
-    goPackagePath = "honnef.co/go/tools";
-    fetch = {
-      type = "git";
-      url = "https://github.com/dominikh/go-tools";
-      rev = "v0.0.1-2020.1.3";
-      sha256 = "0pvi1mzhy6zgx4zfgdypbl4zhvgg11hl5qv7blf2qs0a96j2djhf";
-    };
-  }
-  {
-    goPackagePath = "rsc.io/binaryregexp";
-    fetch = {
-      type = "git";
-      url = "https://github.com/rsc/binaryregexp";
-      rev = "v0.2.0";
-      sha256 = "1kar0myy85waw418zslviwx8846zj0m9cmqkxjx0fvgjdi70nc4b";
-    };
-  }
-  {
-    goPackagePath = "rsc.io/quote";
-    fetch = {
-      type = "git";
-      url = "https://github.com/rsc/quote";
-      rev = "v3.1.0";
-      sha256 = "0nvv97hwwrl1mx5gzsbdm1ndnwpg3m7i2jb10ig9wily7zmvki0i";
-    };
-  }
-  {
-    goPackagePath = "rsc.io/sampler";
-    fetch = {
-      type = "git";
-      url = "https://github.com/rsc/sampler";
-      rev = "v1.3.0";
-      sha256 = "0byxk2ynba50py805kcvbvjzh59l1r308i1xgyzpw6lff4xx9xjh";
-    };
-  }
-]
diff --git a/pkgs/tools/bluetooth/blueman/default.nix b/pkgs/tools/bluetooth/blueman/default.nix
index 74ebb04f74744..2f59d14902bb2 100644
--- a/pkgs/tools/bluetooth/blueman/default.nix
+++ b/pkgs/tools/bluetooth/blueman/default.nix
@@ -9,11 +9,11 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "blueman";
-  version = "2.2.4";
+  version = "2.2.5";
 
   src = fetchurl {
     url = "https://github.com/blueman-project/blueman/releases/download/${version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-VdY5/u2gtDsYplnmWYUhOlS0fcsTSPO07/tSONskJgI=";
+    sha256 = "sha256-yfPAqU3HyAvTIwS7Jf3tIU/jC3AY6e9Gsvy9HYA8fHw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/filesystems/bindfs/default.nix b/pkgs/tools/filesystems/bindfs/default.nix
index 12052100db32a..333157d829fb8 100644
--- a/pkgs/tools/filesystems/bindfs/default.nix
+++ b/pkgs/tools/filesystems/bindfs/default.nix
@@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl, fuse, pkg-config }:
 
 stdenv.mkDerivation rec {
-  version = "1.15.1";
+  version = "1.16.0";
   pname = "bindfs";
 
   src = fetchurl {
     url    = "https://bindfs.org/downloads/${pname}-${version}.tar.gz";
-    sha256 = "sha256-BN01hKbN+a9DRNQDxiGFyp+rMc465aJdAQG8EJNsaKs=";
+    sha256 = "sha256-AuvvqqZOGwRPxcdDxYKarSHtb3FF9NsHI7zEXwhXgfY=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/tools/filesystems/gcsfuse/default.nix b/pkgs/tools/filesystems/gcsfuse/default.nix
index 0a621c5e034df..12447377ae933 100644
--- a/pkgs/tools/filesystems/gcsfuse/default.nix
+++ b/pkgs/tools/filesystems/gcsfuse/default.nix
@@ -1,32 +1,32 @@
-{ lib, buildGoPackage, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "gcsfuse";
-  version = "0.41.1";
+  version = "0.41.4";
 
   src = fetchFromGitHub {
     owner = "googlecloudplatform";
     repo = "gcsfuse";
     rev = "v${version}";
-    sha256 = "sha256-5Kfd033SG1ldF+2QCZ01aa7ts0mA8uPXiLmqZIr94YQ=";
+    sha256 = "sha256-8QzSvR/uelp9iBLK+DsUXsH6fBOIoeXePeN7Spht6SE=";
   };
 
-  goPackagePath = "github.com/googlecloudplatform/gcsfuse";
+  vendorSha256 = null;
 
   subPackages = [ "." "tools/mount_gcsfuse" ];
 
+  ldflags = [ "-s" "-w" "-X main.gcsfuseVersion=${version}" ];
+
   postInstall = ''
     ln -s $out/bin/mount_gcsfuse $out/bin/mount.gcsfuse
     ln -s $out/bin/mount_gcsfuse $out/bin/mount.fuse.gcsfuse
   '';
 
-  ldflags = [ "-s" "-w" "-X main.gcsfuseVersion=${version}" ];
-
   meta = with lib;{
     description = "A user-space file system for interacting with Google Cloud Storage";
     homepage = "https://cloud.google.com/storage/docs/gcs-fuse";
     license = licenses.asl20;
     platforms = platforms.unix;
-    maintainers = [];
+    maintainers = with maintainers; [ aaronjheng ];
   };
 }
diff --git a/pkgs/tools/filesystems/httm/default.nix b/pkgs/tools/filesystems/httm/default.nix
index f4cfdc46e9b43..c68e692ed2d1b 100644
--- a/pkgs/tools/filesystems/httm/default.nix
+++ b/pkgs/tools/filesystems/httm/default.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "httm";
-  version = "0.11.6";
+  version = "0.12.1";
 
   src = fetchFromGitHub {
     owner = "kimono-koans";
     repo = pname;
     rev = version;
-    sha256 = "5jeCENAas7i/eBySSBjwmdc3MEHVhWWH7/RZGS8g1Y4=";
+    sha256 = "2pShuWJns8VnxiRgj5GLv5Y7H5Qw/SfQ6lVo6VqyU/A=";
   };
 
-  cargoSha256 = "x4qfi3Wm5r0HNqDgmJBXNvS1xQDU7MQ/H2+zNpHon+s=";
+  cargoSha256 = "x5JUwQxrZ5TBG8FAMlomTkZOCxV0c/7i5sx33BCUkKo=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/games/minecraft/packwiz/default.nix b/pkgs/tools/games/minecraft/packwiz/default.nix
index 3be2798312e77..80feced2b7013 100644
--- a/pkgs/tools/games/minecraft/packwiz/default.nix
+++ b/pkgs/tools/games/minecraft/packwiz/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "packwiz";
-  version = "unstable-2022-5-25";
+  version = "unstable-2022-06-08";
 
   src = fetchFromGitHub {
     owner = "packwiz";
     repo = "packwiz";
-    rev = "e71b63ea98283c8c1f0e03ee51ae40f452f22a61";
-    sha256 = "sha256-XwGacEVfQAduDCSMQFRw7Xnx4bND2zaV7l27B+2u5xg=";
+    rev = "d051932bbbeb7b16cd21a1897019428e71f63bfd";
+    sha256 = "sha256-H1v5pY9hJYGP0ZiE/GrsATf1ljw69085t6PQhPOfYCs=";
   };
 
   vendorSha256 = "sha256-M9u7N4IrL0B4pPRQwQG5TlMaGT++w3ZKHZ0RdxEHPKk=";
diff --git a/pkgs/tools/inputmethods/uim/default.nix b/pkgs/tools/inputmethods/uim/default.nix
index 9336d5429c128..e1daecbd10ff7 100644
--- a/pkgs/tools/inputmethods/uim/default.nix
+++ b/pkgs/tools/inputmethods/uim/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, shared-mime-info
+{ lib, stdenv, fetchFromGitHub, fetchpatch, shared-mime-info
 , autoconf, automake, intltool, libtool, pkg-config, cmake
 , ruby, librsvg
 , ncurses, m17n_lib, m17n_db, expat
@@ -86,7 +86,21 @@ stdenv.mkDerivation rec {
     ./autogen.sh
   '';
 
-  patches = [ ./data-hook.patch ];
+  patches = [
+    ./data-hook.patch
+
+    # Pull upstream fix for -fno-common toolchains
+    #   https://github.com/uim/libgcroots/pull/4
+    (fetchpatch {
+      name = "libgcroots-fno-common.patch";
+      url = "https://github.com/uim/libgcroots/commit/7e39241344ad0663409e836560ae6b5eb231e1fc.patch";
+      sha256 = "0iifcl5lk8bvl0cflm47gkymg88aiwzj0gxh2aj3mqlyhvyx78nz";
+      # Patch comes from git submodule. Relocate as:
+      # a/include/private/gc_priv.h -> a/sigscheme/libgcroots/include/private/gc_priv.h
+      stripLen = 1;
+      extraPrefix = "sigscheme/libgcroots/";
+    })
+  ];
 
   configureFlags = [
     # configure in maintainer mode or else some pixmaps won't get autogenerated
diff --git a/pkgs/tools/misc/antimicrox/default.nix b/pkgs/tools/misc/antimicrox/default.nix
index b39d9b17002fe..73e430e54e340 100644
--- a/pkgs/tools/misc/antimicrox/default.nix
+++ b/pkgs/tools/misc/antimicrox/default.nix
@@ -12,13 +12,13 @@
 
 mkDerivation rec {
   pname = "antimicrox";
-  version = "3.2.3";
+  version = "3.2.4";
 
   src = fetchFromGitHub {
     owner = "AntiMicroX";
     repo = pname;
     rev = version;
-    sha256 = "sha256-Qn2XT/l3zx0u3twKsQr1cHbaRiLTglQf0WNx8tqtKro=";
+    sha256 = "sha256-catgal3bpWJUcTo0x0V0X3VV87AHO2Dp58IpQ/ILsZ8=";
   };
 
   nativeBuildInputs = [ cmake extra-cmake-modules pkg-config itstool ];
diff --git a/pkgs/tools/misc/chafa/default.nix b/pkgs/tools/misc/chafa/default.nix
index 7a0178eea735f..85b52dd398c25 100644
--- a/pkgs/tools/misc/chafa/default.nix
+++ b/pkgs/tools/misc/chafa/default.nix
@@ -4,14 +4,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.8.0";
+  version = "1.10.3";
   pname = "chafa";
 
   src = fetchFromGitHub {
     owner = "hpjansson";
     repo = "chafa";
     rev = version;
-    sha256 = "sha256-8ENPmcl0KVxoBu8FGOGk+y8XsONWW0YW32MHAKBUiPE=";
+    sha256 = "sha256-GRPn0xPWtCayOdmA6M+KQrObAHtZIJLEydXaKhhO5IU=";
   };
 
   nativeBuildInputs = [ autoconf
diff --git a/pkgs/tools/misc/chezmoi/default.nix b/pkgs/tools/misc/chezmoi/default.nix
index 782efb24f48d3..7fc8f0ad1458a 100644
--- a/pkgs/tools/misc/chezmoi/default.nix
+++ b/pkgs/tools/misc/chezmoi/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "chezmoi";
-  version = "2.16.0";
+  version = "2.18.1";
 
   src = fetchFromGitHub {
     owner = "twpayne";
     repo = "chezmoi";
     rev = "v${version}";
-    sha256 = "sha256-J5L4xFdRV8eOJgILQqK0DhvP5/AXAmr7spzokhd4kcg=";
+    sha256 = "sha256-eRlEhtpUBZBS3fNrkkXPiktPyGQ2K8MFwsDVo3DUb+o=";
   };
 
-  vendorSha256 = "sha256-y+xPuW8l3XvpnlqdlNIWdweNXMsAOrwbXHq2cJQRcOY=";
+  vendorSha256 = "sha256-u+iFnBzlaa+7heQEI18WWD45TSxEpIY73ZrxjLx84Ic=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/misc/dateutils/default.nix b/pkgs/tools/misc/dateutils/default.nix
index 20837d5ee3ec7..ec8f9ca83d93e 100644
--- a/pkgs/tools/misc/dateutils/default.nix
+++ b/pkgs/tools/misc/dateutils/default.nix
@@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl, autoreconfHook, tzdata, fetchpatch }:
 
 stdenv.mkDerivation rec {
-  version = "0.4.9";
+  version = "0.4.10";
   pname = "dateutils";
 
   src = fetchurl {
     url = "https://bitbucket.org/hroptatyr/dateutils/downloads/${pname}-${version}.tar.xz";
-    sha256 = "1hy96h9imxdbg9y7305mgv4grr6x4qic9xy3vhgh15lvjkcmc0kr";
+    sha256 = "sha256-PFCOKIm51a7Kt9WdcyWnAIlZMRGhIwpJbasPWtZ3zew=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/tools/misc/diffoscope/default.nix b/pkgs/tools/misc/diffoscope/default.nix
index ae0a38b6d3166..2307dddf6cacc 100644
--- a/pkgs/tools/misc/diffoscope/default.nix
+++ b/pkgs/tools/misc/diffoscope/default.nix
@@ -11,11 +11,11 @@
 # Note: when upgrading this package, please run the list-missing-tools.sh script as described below!
 python3Packages.buildPythonApplication rec {
   pname = "diffoscope";
-  version = "216";
+  version = "217";
 
   src = fetchurl {
     url = "https://diffoscope.org/archive/diffoscope-${version}.tar.bz2";
-    sha256 = "sha256-KSmC2mNNzsC2H5xOOQ/3gODsSvFQD95XGtrzbDud0W0=";
+    sha256 = "sha256-JS6lzxOsE3K4gH3VHsRY5Iucq5PBH3jFD5lSmNZWEG4=";
   };
 
   outputs = [ "out" "man" ];
diff --git a/pkgs/tools/misc/dsq/default.nix b/pkgs/tools/misc/dsq/default.nix
index 1d6dde3c3cffa..62a17142bde6b 100644
--- a/pkgs/tools/misc/dsq/default.nix
+++ b/pkgs/tools/misc/dsq/default.nix
@@ -15,13 +15,13 @@
 
 buildGoModule rec {
   pname = "dsq";
-  version = "0.20.1";
+  version = "0.20.2";
 
   src = fetchFromGitHub {
     owner = "multiprocessio";
     repo = "dsq";
     rev = version;
-    hash = "sha256-zTrIs6Q/+PW6CKCx1L8VaXhc1ZAqbb+Od+LJNjPCOTs=";
+    hash = "sha256-dgx1rFdhEtvyH/N3AtQE89ASBoE3CLl+ZFWwWWYe0II=";
   };
 
   vendorSha256 = "sha256-bLaBBWChK2RKXd/rX9m9UfHu8zt0j8TOm5S2M02U91A=";
diff --git a/pkgs/tools/misc/dua/default.nix b/pkgs/tools/misc/dua/default.nix
index 4a83d8147acb3..526eb705e4cc8 100644
--- a/pkgs/tools/misc/dua/default.nix
+++ b/pkgs/tools/misc/dua/default.nix
@@ -2,7 +2,7 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "dua";
-  version = "2.17.5";
+  version = "2.17.7";
 
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv Foundation ];
 
@@ -10,7 +10,7 @@ rustPlatform.buildRustPackage rec {
     owner = "Byron";
     repo = "dua-cli";
     rev = "v${version}";
-    sha256 = "sha256-dpkUbZz/bIiTMhZalXHGct77qMzYB6LATs7MPVyW1GY=";
+    sha256 = "sha256-FiTjN4coOJZ3Uu9LfaJxcpvVKS+5MVYWQPmwllBh1Jg=";
     # Remove unicode file names which leads to different checksums on HFS+
     # vs. other filesystems because of unicode normalisation.
     postFetch = ''
@@ -18,7 +18,7 @@ rustPlatform.buildRustPackage rec {
     '';
   };
 
-  cargoSha256 = "sha256-xBiabY0aGPxrAHypuSg3AF/EcChDgtIK9cJDCeTNkm0=";
+  cargoSha256 = "sha256-xCHbS+D7ss85hklv9xftJTsctvQlAjkKtuJbTt5R8nM=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/misc/fend/default.nix b/pkgs/tools/misc/fend/default.nix
index 07880c4fbdc54..afdc719a5e448 100644
--- a/pkgs/tools/misc/fend/default.nix
+++ b/pkgs/tools/misc/fend/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "fend";
-  version = "1.0.1";
+  version = "1.0.3";
 
   src = fetchFromGitHub {
     owner = "printfn";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-EV3uxoN6RuQ7grXLcFev1ZCfjVnVIDumQmHdpUm1Jbc=";
+    sha256 = "sha256-eYCFX3JVsTnmVzHQd9JU6BT80kS0LTjVwVcfNJink1M=";
   };
 
-  cargoSha256 = "sha256-lNpFdrriAglLaiWjxVP4JoiBuU+zdLlerAIApIvHHZw=";
+  cargoSha256 = "sha256-+N8/ZKj1Ht2lkTYSEm/lrLtopBQqc82gIFiLzJ6NogU=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ];
 
diff --git a/pkgs/tools/misc/flameshot/default.nix b/pkgs/tools/misc/flameshot/default.nix
index 82cf7a3b78fd9..4bbe0508c12c5 100644
--- a/pkgs/tools/misc/flameshot/default.nix
+++ b/pkgs/tools/misc/flameshot/default.nix
@@ -10,13 +10,13 @@
 
 mkDerivation rec {
   pname = "flameshot";
-  version = "11.0.0";
+  version = "12.0.0";
 
   src = fetchFromGitHub {
     owner = "flameshot-org";
     repo = "flameshot";
     rev = "v${version}";
-    sha256 = "sha256-SlnEXW3Uhdgl0icwYyYsKQOcYkAtHpAvL6LMXBF2gWM=";
+    sha256 = "sha256-ByW+XYTaeBTTbOaxNeF367nqgnBM+EC8jm+PmwHcVGQ=";
   };
 
   passthru = {
diff --git a/pkgs/tools/misc/qjoypad/default.nix b/pkgs/tools/misc/qjoypad/default.nix
index 0c3b4a9ed2f83..018086e6dc7cb 100644
--- a/pkgs/tools/misc/qjoypad/default.nix
+++ b/pkgs/tools/misc/qjoypad/default.nix
@@ -1,21 +1,19 @@
-{ lib, stdenv, fetchurl, pkg-config, libX11, libXtst, qt4 }:
-stdenv.mkDerivation rec {
+{ lib, mkDerivation, fetchFromGitHub, pkg-config, cmake, libX11, libXtst, qtbase, qttools, qtx11extras }:
+mkDerivation rec {
   pname = "qjoypad";
-  version = "4.1.0";
-  src = fetchurl {
-    url = "mirror://sourceforge/qjoypad/qjoypad-${version}.tar.gz";
-    sha256 = "1jlm7i26nfp185xrl41kz5z6fgvyj51bjpz48cg27xx64y40iamm";
+  version = "4.3.1";
+
+  src = fetchFromGitHub {
+    owner = "panzi";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256:1w26ddxb1xirb7qjf7kv9llxzjhbhcb7warnxbx41qhbni46g26y";
   };
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ libX11 libXtst qt4 ];
-  NIX_LDFLAGS = "-lX11";
-  patchPhase = ''
-    cd src
-    substituteInPlace config --replace /bin/bash ${stdenv.shell}
-    mkdir -p $out
-    export NIX_LDFLAGS="$NIX_LDFLAGS -rpath ${libX11}/lib"
-  '';
-  meta = {
+
+  nativeBuildInputs = [ pkg-config cmake ];
+  buildInputs = [ libX11 libXtst qtbase qttools qtx11extras ];
+
+  meta = with lib; {
     description = "A program that lets you use gaming devices anywhere";
     longDescription = ''
       A simple Linux/QT program that lets you use your gaming devices
@@ -33,9 +31,9 @@ stdenv.mkDerivation rec {
       of gaming devices in Linux, and makes the Linux gaming
       experience just a little bit nicer.
     '';
-    homepage = "http://qjoypad.sourceforge.net";
+    homepage = "https://github.com/panzi/qjoypad/";
     license = lib.licenses.gpl2;
-    maintainers = with lib.maintainers; [ astsmtl ];
-    platforms = with lib.platforms; linux;
+    maintainers = with maintainers; [ astsmtl ];
+    platforms = with platforms; linux;
   };
 }
diff --git a/pkgs/tools/misc/tmux/default.nix b/pkgs/tools/misc/tmux/default.nix
index fd4361d27678a..44cbe713f096e 100644
--- a/pkgs/tools/misc/tmux/default.nix
+++ b/pkgs/tools/misc/tmux/default.nix
@@ -6,7 +6,7 @@
 , libevent
 , ncurses
 , pkg-config
-, systemd
+, withSystemd ? stdenv.isLinux && !stdenv.hostPlatform.isStatic, systemd
 , utf8proc
 }:
 
@@ -43,13 +43,13 @@ stdenv.mkDerivation rec {
   buildInputs = [
     ncurses
     libevent
-  ] ++ lib.optionals stdenv.isLinux [ systemd ]
+  ] ++ lib.optionals withSystemd [ systemd ]
   ++ lib.optionals stdenv.isDarwin [ utf8proc ];
 
   configureFlags = [
     "--sysconfdir=/etc"
     "--localstatedir=/var"
-  ] ++ lib.optionals stdenv.isLinux [ "--enable-systemd" ]
+  ] ++ lib.optionals withSystemd [ "--enable-systemd" ]
   ++ lib.optionals stdenv.isDarwin [ "--enable-utf8proc" ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/tools/misc/youtube-dl/default.nix b/pkgs/tools/misc/youtube-dl/default.nix
index fd038d7acb128..4aee6bdeb5f51 100644
--- a/pkgs/tools/misc/youtube-dl/default.nix
+++ b/pkgs/tools/misc/youtube-dl/default.nix
@@ -25,8 +25,8 @@ buildPythonPackage rec {
   };
 
   patches = [
-    # Fixes throttling on youtube.com. Without the patch downloads are capped at
-    # about 80KiB/s. See, e.g.,
+    # Fixes throttling on youtube.com by decoding a "n-parameter". Without the patch
+    # downloads are capped at about 80KiB/s. See, e.g.,
     #
     #   https://github.com/ytdl-org/youtube-dl/issues/29326
     #
@@ -37,6 +37,20 @@ buildPythonPackage rec {
       url = "https://github.com/ytdl-org/youtube-dl/compare/57044eacebc6f2f3cd83c345e1b6e659a22e4773...1e677567cd083d43f55daef0cc74e5fa24575ae3.diff";
       sha256 = "11s0j3w60r75xx20p0x2j3yc4d3yvz99r0572si8b5qd93lqs4pr";
     })
+    # The above patch may fail to decode the n-parameter (if, say, YouTube is updated). Failure to decode
+    # it blocks the download instead of falling back to the throttled version. The patch below implements
+    # better fallback behaviour.
+    (fetchpatch {
+      name = "avoid-crashing-if-nsig-decode-fails.patch";
+      url = "https://github.com/ytdl-org/youtube-dl/commit/41f0043983c831b7c0c3614340d2f66ec153087b.diff";
+      sha256 = "sha256-a72gWhBXCLjuBBD36PpZ5F/AHBdiBv4W8Wf9g4P/aBY=";
+    })
+    # YouTube changed the n-parameter format in April 2022, so decoder updates are required.
+    (fetchpatch {
+      name = "fix-n-descrambling.patch";
+      url = "https://github.com/ytdl-org/youtube-dl/commit/a0068bd6bec16008bda7a39caecccbf84881c603.diff";
+      sha256 = "sha256-tSuEns4jputa2nOOo6JsFXpK3hvJ/+z1/ymcLsd3A6w=";
+    })
   ];
 
   nativeBuildInputs = [ installShellFiles makeWrapper ];
diff --git a/pkgs/tools/networking/brook/default.nix b/pkgs/tools/networking/brook/default.nix
index e0e37e99ac743..b4a5a30beeb35 100644
--- a/pkgs/tools/networking/brook/default.nix
+++ b/pkgs/tools/networking/brook/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "brook";
-  version = "20220515";
+  version = "20220707";
 
   src = fetchFromGitHub {
     owner = "txthinking";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-olYlAuIcK34nNXbfiPT4+u0L3xcxBMMty72FjSeuNqg=";
+    sha256 = "sha256-TlbVXfNUvCHHX0BReSVE6GNfmS+p6lWSdO0OtOC+I2U=";
   };
 
-  vendorSha256 = "sha256-ic5QYRVElEuH4D29PXgTzMHU0KjrxDqcdfg7Kd37/YU=";
+  vendorSha256 = "sha256-MPLM1lBM1K55q6nsfmOekdFlSDmPsLLDv09mD1XqLNo=";
 
   meta = with lib; {
     homepage = "https://github.com/txthinking/brook";
diff --git a/pkgs/tools/networking/clash/default.nix b/pkgs/tools/networking/clash/default.nix
index d3125d13adabd..0341e7e7f3d32 100644
--- a/pkgs/tools/networking/clash/default.nix
+++ b/pkgs/tools/networking/clash/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "clash";
-  version = "1.10.6";
+  version = "1.11.0";
 
   src = fetchFromGitHub {
     owner = "Dreamacro";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-v9MUMgHIpHDUEmB5vXOIOkSriX+PCPtiiHHB4H5FeMw=";
+    sha256 = "sha256-8g5rrkRA31wHvwY3JDFIU+slU0cLHFpADyd897hVyw0=";
   };
 
-  vendorSha256 = "sha256-egbXCRmC862tctapMUWTcNej1g6a9wCt2JIC9DSEP6k=";
+  vendorSha256 = "sha256-iW14KxtUY2nhpShcdrHLiCRZxsoXyLSPt01dB0Ds28Y=";
 
   # Do not build testing suit
   excludedPackages = [ "./test" ];
diff --git a/pkgs/tools/networking/mu/default.nix b/pkgs/tools/networking/mu/default.nix
index fd140bfe55edc..b218a19154a5c 100644
--- a/pkgs/tools/networking/mu/default.nix
+++ b/pkgs/tools/networking/mu/default.nix
@@ -1,53 +1,46 @@
-{ lib, stdenv, fetchFromGitHub, sqlite, pkg-config, autoreconfHook, pmccabe
-, xapian, glib, gmime3, texinfo, emacs, guile
-, gtk3, webkitgtk, libsoup, icu
-, makeWrapper
-, withMug ? false
-, batchSize ? null }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, meson
+, ninja
+, pkg-config
+, coreutils
+, emacs
+, glib
+, gmime3
+, texinfo
+, xapian
+}:
 
 stdenv.mkDerivation rec {
   pname = "mu";
-  version = "1.6.11";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner  = "djcb";
     repo   = "mu";
-    rev    = version;
-    sha256 = "E/6+vEwYXk65/ZoAtUeTjvg56g6gz+Qtcaz0qwEru6c=";
+    rev    = "v${version}";
+    sha256 = "rb8R04eU/rG7PXx/horYk0+/3AgbxYYZtxy4ACILOZ8=";
   };
 
-  postPatch = lib.optionalString (batchSize != null) ''
-    sed -i lib/mu-store.cc --regexp-extended \
-      -e 's@(constexpr auto BatchSize).*@\1 = ${toString batchSize};@'
-  '';
+  postPatch = ''
+      # Fix mu4e-builddir (set it to $out)
+      substituteInPlace mu4e/mu4e-config.el.in \
+        --replace "@abs_top_builddir@" "$out"
+      substituteInPlace lib/utils/mu-utils.cc \
+        --replace "/bin/rm" "${coreutils}/bin/rm"
+    '';
 
-  buildInputs = [
-    sqlite xapian glib gmime3 texinfo emacs libsoup icu
-  ]
-    # Workaround for https://github.com/djcb/mu/issues/1641
-    ++ lib.optional (!stdenv.isDarwin) guile
-    ++ lib.optionals withMug [ gtk3 webkitgtk ];
+  buildInputs = [ emacs glib gmime3 texinfo xapian ];
 
-  nativeBuildInputs = [ pkg-config autoreconfHook pmccabe makeWrapper ];
+  mesonFlags = [
+    "-Dguile=disabled"
+    "-Dreadline=disabled"
+  ];
 
-  enableParallelBuilding = true;
+  nativeBuildInputs = [ pkg-config meson ninja ];
 
-  preBuild = ''
-    # Fix mu4e-builddir (set it to $out)
-    substituteInPlace mu4e/mu4e-meta.el.in \
-      --replace "@abs_top_builddir@" "$out"
-  '';
-
-  # Make sure included scripts can find their dependencies & optionally install mug
-  postInstall = ''
-    wrapProgram "$out/bin/mu" \
-      --prefix LD_LIBRARY_PATH : "$out/lib" \
-      --prefix GUILE_LOAD_PATH : "$out/share/guile/site/2.2"
-  '' + lib.optionalString withMug ''
-    for f in mug ; do
-      install -m755 toys/$f/$f $out/bin/$f
-    done
-  '';
+  enableParallelBuilding = true;
 
   doCheck = true;
 
@@ -55,7 +48,7 @@ stdenv.mkDerivation rec {
     description = "A collection of utilties for indexing and searching Maildirs";
     license = licenses.gpl3Plus;
     homepage = "https://www.djcbsoftware.nl/code/mu/";
-    changelog = "https://github.com/djcb/mu/releases/tag/${version}";
+    changelog = "https://github.com/djcb/mu/releases/tag/v${version}";
     maintainers = with maintainers; [ antono chvp peterhoeg ];
     platforms = platforms.mesaPlatforms;
   };
diff --git a/pkgs/tools/networking/networkmanager/default.nix b/pkgs/tools/networking/networkmanager/default.nix
index c85d7ef612812..97a029d353b2d 100644
--- a/pkgs/tools/networking/networkmanager/default.nix
+++ b/pkgs/tools/networking/networkmanager/default.nix
@@ -119,6 +119,22 @@ stdenv.mkDerivation rec {
     # Meson does not support using different directories during build and
     # for installation like Autotools did with flags passed to make install.
     ./fix-install-paths.patch
+
+    (fetchpatch {
+      # Prevent downgrade to plain network on Enhanced Open profiles
+      url = "https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/commit/b7946e50acc0d20d31b0c1098fdadc2f105ba799.patch";
+      hash = "sha256-CdZiubfqhJQ5w4+s9O8C5WI9Ls/paONzDX4rX6yEmS0=";
+    })
+    (fetchpatch {
+      # Treat OWE BSSIDs as valid candidates for open profiles
+      url = "https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/commit/dd80cdcc1bd5e2535b8e4a1d1d0c62f1d3328a7c.patch";
+      hash = "sha256-QMZvWN3g8K+UH6y05+RkCmF+gHHU4pB+UXfU770AUis=";
+    })
+    (fetchpatch {
+      # Allow distinguishing pure OWE networks from those with transition mode enabled
+      url = "https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/commit/13ea8d2e7dddd8279c82230594cea533ca349dd3.patch";
+      hash = "sha256-BiINGzX/Zp8pwdbMiDScrZvrHtH7coXkZm1HScFuFWA=";
+    })
   ];
 
   buildInputs = [
diff --git a/pkgs/tools/networking/offlineimap/default.nix b/pkgs/tools/networking/offlineimap/default.nix
index 98aabadf6da33..aa9c588e25312 100644
--- a/pkgs/tools/networking/offlineimap/default.nix
+++ b/pkgs/tools/networking/offlineimap/default.nix
@@ -32,7 +32,6 @@ python3.pkgs.buildPythonApplication rec {
     certifi
     distro
     imaplib2
-    kerberos
     pysocks
     rfc6555
     urllib3
diff --git a/pkgs/tools/networking/routedns/default.nix b/pkgs/tools/networking/routedns/default.nix
new file mode 100644
index 0000000000000..4cf2c9eeeed8b
--- /dev/null
+++ b/pkgs/tools/networking/routedns/default.nix
@@ -0,0 +1,29 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "routedns";
+  version = "0.1.5";
+
+  src = fetchFromGitHub {
+    owner = "folbricht";
+    repo = "routedns";
+    # https://github.com/folbricht/routedns/issues/237
+    rev = "02f14a567fee2a289810979446f5260b8a31bf73";
+    sha256 = "sha256-oImimNBz1qizUPD6qHi73fGKNCu5cii99GIUo21e+bs=";
+  };
+
+  vendorSha256 = "sha256-T6adpxJgOPGy+UOOlGAAf1gjk1wJxwOc9enfv9X3LBE=";
+
+  subPackages = [ "./cmd/routedns" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/folbricht/routedns";
+    description = "DNS stub resolver, proxy and router";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ jsimonetti ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/tools/networking/vegeta/default.nix b/pkgs/tools/networking/vegeta/default.nix
index 16abe8c60335e..6e7bbaa8366bf 100644
--- a/pkgs/tools/networking/vegeta/default.nix
+++ b/pkgs/tools/networking/vegeta/default.nix
@@ -1,25 +1,40 @@
-{ lib, fetchFromGitHub, buildGoPackage }:
+{ lib
+, fetchFromGitHub
+, buildGoModule
+}:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "vegeta";
   version = "12.8.4";
+  rev = "e04d9c0df8177e8633bff4afe7b39c2f3a9e7dea";
 
   src = fetchFromGitHub {
-    owner  = "tsenart";
-    repo   = pname;
-    rev    = "v${version}";
-    sha256 = "0sw10k4g370c544dgw2c1sqdnxryld8lf6c1wnyknrm3zsfzn1hl";
+    owner = "tsenart";
+    repo = "vegeta";
+    rev = "v${version}";
+    sha256 = "sha256-FAb7nf6jZju95YEZR1GjPnfbsA5M8NcIKQyc8cgEgWs=";
   };
 
-  goPackagePath = "github.com/tsenart/${pname}";
+  vendorSha256 = "sha256-v9Hu9eQJSmm4Glt49F7EN40rKjrg4acyll9Bfgey+Mw=";
 
-  goDeps = ./deps.nix;
+  subPackages = [ "." ];
+
+  ldflags = (lib.mapAttrsToList (n: v: "-X main.${n}=${v}") {
+    Version = version;
+    Commit = rev;
+    Date = "1970-01-01T00:00:00Z";
+  }) ++ [ "-s" "-w" "-extldflags '-static'" ];
 
   meta = with lib; {
     description = "Versatile HTTP load testing tool";
-    license = licenses.mit;
+    longDescription = ''
+      Vegeta is a versatile HTTP load testing tool built out of a need to drill
+      HTTP services with a constant request rate. It can be used both as a
+      command line utility and a library.
+    '';
     homepage = "https://github.com/tsenart/vegeta/";
-    maintainers = [ maintainers.mmahut ];
+    changelog = "https://github.com/tsenart/vegeta/releases/tag/${src.rev}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ mmahut ];
   };
 }
-
diff --git a/pkgs/tools/networking/vegeta/deps.nix b/pkgs/tools/networking/vegeta/deps.nix
deleted file mode 100644
index 1a06ad178ec44..0000000000000
--- a/pkgs/tools/networking/vegeta/deps.nix
+++ /dev/null
@@ -1,255 +0,0 @@
-# file generated from go.mod using vgo2nix (https://github.com/adisbladis/vgo2nix)
-[
-  {
-    goPackagePath = "github.com/alecthomas/jsonschema";
-    fetch = {
-      type = "git";
-      url = "https://github.com/alecthomas/jsonschema";
-      rev = "f2c93856175a";
-      sha256 = "145w6zg453mbspfyixs71xfjwi3djq20lij1rcgrdcn5gmwj2cal";
-    };
-  }
-  {
-    goPackagePath = "github.com/bmizerany/perks";
-    fetch = {
-      type = "git";
-      url = "https://github.com/bmizerany/perks";
-      rev = "d9a9656a3a4b";
-      sha256 = "0f39b3zfm1zd6xcvlm6szgss026qs84n2j9y5bnb3zxzdkxb9w9n";
-    };
-  }
-  {
-    goPackagePath = "github.com/c2h5oh/datasize";
-    fetch = {
-      type = "git";
-      url = "https://github.com/c2h5oh/datasize";
-      rev = "4eba002a5eae";
-      sha256 = "02sxd659q7m7axfywiqfxk5rh6djh2m5240bin1makldj1nj16j3";
-    };
-  }
-  {
-    goPackagePath = "github.com/dgryski/go-gk";
-    fetch = {
-      type = "git";
-      url = "https://github.com/dgryski/go-gk";
-      rev = "201884a44051";
-      sha256 = "17csmdlqibg5g2pjybh4522dis6nklyhjvly55pawy0vprd17agz";
-    };
-  }
-  {
-    goPackagePath = "github.com/dgryski/go-lttb";
-    fetch = {
-      type = "git";
-      url = "https://github.com/dgryski/go-lttb";
-      rev = "318fcdf10a77";
-      sha256 = "0cs2rr2j6fbbpgmfxkq39pir4bibfzkfwxvd2cvw30q97cmfpiz3";
-    };
-  }
-  {
-    goPackagePath = "github.com/gonum/blas";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gonum/blas";
-      rev = "f22b278b28ac";
-      sha256 = "0dh73akv4gazyhva9xbm9xbq786vij8iisivp3p65p6ahf502fs6";
-    };
-  }
-  {
-    goPackagePath = "github.com/gonum/diff";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gonum/diff";
-      rev = "500114f11e71";
-      sha256 = "1bg4k3bxqb44nz1nmyigr5bx55859n55vvi45w2rq4y5djvpral8";
-    };
-  }
-  {
-    goPackagePath = "github.com/gonum/floats";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gonum/floats";
-      rev = "c233463c7e82";
-      sha256 = "12m7pa64mk3am2i10agg6c1aqdfgx9i3f4bgf3w7wra8bnnjncp6";
-    };
-  }
-  {
-    goPackagePath = "github.com/gonum/integrate";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gonum/integrate";
-      rev = "a422b5c0fdf2";
-      sha256 = "01wfav882h3bcp137cd2bsr91hkmmi4d6qwhdm0xv1p2z2qzs7iq";
-    };
-  }
-  {
-    goPackagePath = "github.com/gonum/internal";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gonum/internal";
-      rev = "f884aa714029";
-      sha256 = "038w8pc82vxq773qg0mw472f3p8h5vkh3ggcdn09qd3s6myp2zq7";
-    };
-  }
-  {
-    goPackagePath = "github.com/gonum/lapack";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gonum/lapack";
-      rev = "e4cdc5a0bff9";
-      sha256 = "046fffskysg0bmha16s5582bimpis0m6qd7c7k1n65a0qhrslli1";
-    };
-  }
-  {
-    goPackagePath = "github.com/gonum/mathext";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gonum/mathext";
-      rev = "8a4bf007ea55";
-      sha256 = "044xy32mgcjc5948na6f6fgqqq17canw3z6sppidmj52s17p0k7i";
-    };
-  }
-  {
-    goPackagePath = "github.com/gonum/matrix";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gonum/matrix";
-      rev = "c518dec07be9";
-      sha256 = "0i6pyxxhcy2s9as77g90dsj9xya48775dl5fxgvqal665cxc4l4i";
-    };
-  }
-  {
-    goPackagePath = "github.com/gonum/stat";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gonum/stat";
-      rev = "41a0da705a5b";
-      sha256 = "0r9mqiy3ma0c15p57bz4xq2vf105s9g1lqysb7ff0nip4050cpvn";
-    };
-  }
-  {
-    goPackagePath = "github.com/google/go-cmp";
-    fetch = {
-      type = "git";
-      url = "https://github.com/google/go-cmp";
-      rev = "v0.2.0";
-      sha256 = "1fbv0x27k9sn8svafc0hjwsnckk864lv4yi7bvzrxvmd3d5hskds";
-    };
-  }
-  {
-    goPackagePath = "github.com/influxdata/tdigest";
-    fetch = {
-      type = "git";
-      url = "https://github.com/influxdata/tdigest";
-      rev = "a7d76c6f093a";
-      sha256 = "02jxrb2d1n6zflwa7jhgid5344l6zj4gxg4kis20v7xa6iqrj1ni";
-    };
-  }
-  {
-    goPackagePath = "github.com/mailru/easyjson";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mailru/easyjson";
-      rev = "v0.7.0";
-      sha256 = "13zv5fvjp3nr65lhqhiw6i6mlmqvyls882rlmcas0ab35alsxni8";
-    };
-  }
-  {
-    goPackagePath = "github.com/miekg/dns";
-    fetch = {
-      type = "git";
-      url = "https://github.com/miekg/dns";
-      rev = "v1.1.17";
-      sha256 = "0x0375n7n1qmgyn7yvpr65z4ll4l39q2xagyfafw09h3kkrkpka8";
-    };
-  }
-  {
-    goPackagePath = "github.com/streadway/quantile";
-    fetch = {
-      type = "git";
-      url = "https://github.com/streadway/quantile";
-      rev = "b0c588724d25";
-      sha256 = "1y27nrg7wkyrvw07a5s7wl4lpwxshwyvhzc6i0rzn20dajah2vkh";
-    };
-  }
-  {
-    goPackagePath = "github.com/tsenart/go-tsz";
-    fetch = {
-      type = "git";
-      url = "https://github.com/tsenart/go-tsz";
-      rev = "cdeb9e1e981e";
-      sha256 = "1lgnllx810ly0203jn9vkimcwqv3302mnh9d7mip1yyq4cmvlj3b";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/crypto";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/crypto";
-      rev = "9756ffdc2472";
-      sha256 = "0q7hxaaq6lp0v8qqzifvysl47z5rfdlrxkh3d29vsl3wyby3dxl8";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/net";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/net";
-      rev = "ba9fcec4b297";
-      sha256 = "1hbqvy6r0s5h0dpdqw8fynl3cq0acin3iyqki9xvl5r8h33yb9bx";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/sync";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/sync";
-      rev = "112230192c58";
-      sha256 = "05i2k43j2d0llq768hg5pf3hb2yhfzp9la1w5wp0rsnnzblr0lfn";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/sys";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/sys";
-      rev = "749cb33beabd";
-      sha256 = "0dm3257q3rv2kyn5lmqqim2fqg634v6rhrqq4glvbk4wx4l3v337";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/text";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/text";
-      rev = "v0.3.2";
-      sha256 = "0flv9idw0jm5nm8lx25xqanbkqgfiym6619w575p7nrdh0riqwqh";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/tools";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/tools";
-      rev = "2ca718005c18";
-      sha256 = "1nl4cw8vrfigab0hij86vl2mmhfmyim69r7vy5qk2v60g8frvgxg";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/xerrors";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/xerrors";
-      rev = "a985d3407aa7";
-      sha256 = "00wzr5w8aadipgc3rkk8f11i41znskfj9ix5nhhaxyg7isrslgcj";
-    };
-  }
-  {
-    goPackagePath = "pgregory.net/rapid";
-    fetch = {
-      type = "git";
-      url = "https://github.com/flyingmutant/rapid";
-      rev = "v0.3.3";
-      sha256 = "04w4dmx753b2xp5z5br5wxalgkkgag8qpbxics2gdcksqgi85vg3";
-    };
-  }
-]
diff --git a/pkgs/tools/networking/waitron/default.nix b/pkgs/tools/networking/waitron/default.nix
index 4f2f634d4942d..7ef984147a322 100644
--- a/pkgs/tools/networking/waitron/default.nix
+++ b/pkgs/tools/networking/waitron/default.nix
@@ -1,29 +1,38 @@
-{ lib, buildGoPackage, fetchFromGitHub, fetchhg, fetchbzr, fetchsvn }:
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "waitron";
-  version = "unstable-2020-01-24";
-
-  goPackagePath = "github.com/ns1/waitron";
+  version = "unstable-2020-08-04";
+  rev = "2315857d94e3d1a1e79ac48f8f6a68d59d0ce300";
 
   src = fetchFromGitHub {
     owner = "ns1";
     repo = "waitron";
-    rev = "c96833619cbb0cf2bc71b1d7b534101e139cc6e6";
+    inherit rev;
     sha256 = "sha256-ZkGhEOckIOYGb6Yjr4I4e9cjAHDfksRwHW+zgOMZ/FE=";
   };
 
+  vendorSha256 = "sha256-grQFLo0BIIa/kNKF4vPw/V1WN9sxOucz6+wET2PBU1I=";
+
+  subPackages = [ "." ];
+
   patches = [
     ./staticfiles-directory.patch
   ];
 
-  goDeps = ./deps.nix;
-
-  meta = {
+  meta = with lib; {
     description = "A tool to manage network booting of machines";
+    longDescription = ''
+      Waitron is used to build machines (primarily bare-metal, but anything that
+      understands PXE booting will work) based on definitions from any number of
+      specified inventory sources.
+    '';
     homepage = "https://github.com/ns1/waitron";
-    license =  lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ guibert ];
-    platforms = lib.platforms.linux;
+    license =  licenses.asl20;
+    maintainers = with maintainers; [ guibert ];
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/tools/networking/waitron/deps.nix b/pkgs/tools/networking/waitron/deps.nix
deleted file mode 100644
index 46369c783184f..0000000000000
--- a/pkgs/tools/networking/waitron/deps.nix
+++ /dev/null
@@ -1,57 +0,0 @@
-# This file was generated by https://github.com/kamilchm/go2nix v1.3.0
-[
-  {
-    goPackagePath = "github.com/flosch/pongo2";
-    fetch = {
-      type = "git";
-      url = "https://github.com/flosch/pongo2";
-      rev = "bbf5a6c351f4d4e883daa40046a404d7553e0a00";
-      sha256 = "0yqh58phznnxakm64w82gawrpndb0r85vsd1s7h244qqrq7w4avq";
-    };
-  }
-  {
-    goPackagePath = "github.com/gorilla/handlers";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gorilla/handlers";
-      rev = "f08afc1876ad882db8074bcb8a4cc96107d3a5f4";
-      sha256 = "1ysm6sw3jqa3h8pb5qpqgh44g91c23n3as277sh0vyp7282290jq";
-    };
-  }
-  {
-    goPackagePath = "github.com/juju/errors";
-    fetch = {
-      type = "git";
-      url = "https://github.com/juju/errors";
-      rev = "d42613fe1ab9e303fc850e7a19fda2e8eeb6516e";
-      sha256 = "0qggzzvh9lzlfk8ixlyw8bw645rh0lrjrd367505hhl6cg18v8yf";
-    };
-  }
-  {
-    goPackagePath = "github.com/julienschmidt/httprouter";
-    fetch = {
-      type = "git";
-      url = "https://github.com/julienschmidt/httprouter";
-      rev = "8c9f31f047a304abedb5614d4a18a843cd5f4a40";
-      sha256 = "00f5ja1yslrjclx3sf29mzpcsrpfd15kkw5ygv7n4jsyb4v3xgj6";
-    };
-  }
-  {
-    goPackagePath = "github.com/satori/go.uuid";
-    fetch = {
-      type = "git";
-      url = "https://github.com/satori/go.uuid";
-      rev = "b2ce2384e17bbe0c6d34077efa39dbab3e09123b";
-      sha256 = "1yz4cx02377ijlf8mnn84j1dcmlwh8ncx7y3kw1zg2qw0z4x119c";
-    };
-  }
-  {
-    goPackagePath = "gopkg.in/yaml.v2";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/yaml.v2";
-      rev = "53403b58ad1b561927d19068c655246f2db79d48";
-      sha256 = "1inf7svydzscwv9fcjd2rm61a4xjk6jkswknybmns2n58shimapw";
-    };
-  }
-]
diff --git a/pkgs/tools/nix/alejandra/default.nix b/pkgs/tools/nix/alejandra/default.nix
index 0e7f5e133eaad..5cfacdb50bc04 100644
--- a/pkgs/tools/nix/alejandra/default.nix
+++ b/pkgs/tools/nix/alejandra/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "alejandra";
-  version = "1.4.0";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "kamadorueda";
     repo = "alejandra";
     rev = version;
-    sha256 = "sha256-0AolxQtKj3Oek0WSbODDpPVO5Ih8PXHOA3qXEKPB4dQ=";
+    sha256 = "sha256-A0ruEdPeKIzGYxyXNACnzaKtQUVc30s2ExTUzdFTcWM=";
   };
 
-  cargoSha256 = "sha256-USI98hozlTaTj07tMbCQEWDgRkHsd4PFW1HUpKsNZJA=";
+  cargoSha256 = "sha256-BmpFyVF2fxV3rExI7rpOQlVwHEJNlof44dnUshaO/no=";
 
   passthru.tests = {
     version = testers.testVersion { package = alejandra; };
diff --git a/pkgs/tools/nix/nar-serve/default.nix b/pkgs/tools/nix/nar-serve/default.nix
index 1d7fd6beb4a7d..10ac797578f98 100644
--- a/pkgs/tools/nix/nar-serve/default.nix
+++ b/pkgs/tools/nix/nar-serve/default.nix
@@ -4,16 +4,16 @@
 }:
 buildGoModule rec {
   pname = "nar-serve";
-  version = "0.4.0";
+  version = "0.6.1";
 
   src = fetchFromGitHub {
     owner = "numtide";
     repo = "nar-serve";
     rev = "v${version}";
-    hash = "sha256-h/pzKRXgcGTpr1YUKppDa+iTLKak/PGhbYa8ZczWj1U=";
+    hash = "sha256-cSOYHYJJEGzFtkD4mjTmYBiM9CaWKt64xgV/JeNHpfM=";
   };
 
-  vendorSha256 = "sha256-eW+cul/5qJocpKV/6azxj7HTmkezDw6dNubPtAOP5HU=";
+  vendorSha256 = "sha256-RpjLs4+9abbbysYAlPDUXBLe1cz4Lp+QmR1yv+LpYwQ=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/nix/nixel/default.nix b/pkgs/tools/nix/nixel/default.nix
new file mode 100644
index 0000000000000..5ce14a8d312fe
--- /dev/null
+++ b/pkgs/tools/nix/nixel/default.nix
@@ -0,0 +1,36 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, testers
+, nixel
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "nixel";
+  version = "4.1.0";
+
+  src = fetchFromGitHub {
+    owner = "kamadorueda";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-dQ3wzBTjteqk9rju+FMAO+ydimnGu24Y2DEDLX/P+1A=";
+  };
+
+  cargoSha256 = "sha256-1OsHs0W3ji9Kgpv7nGY9XyGxJ4c0faN2VuFLsdwkgKY=";
+
+  # Package requires a non reproducible submodule
+  # https://github.com/kamadorueda/nixel/blob/2873bd84bf4fc540d0ae8af062e109cc9ad40454/.gitmodules#L7
+  doCheck = false;
+  #
+  # Let's test it runs
+  passthru.tests = {
+    version = testers.testVersion { package = nixel; };
+  };
+
+  meta = with lib; {
+    description = "Lexer, Parser, Abstract Syntax Tree and Concrete Syntax Tree for the Nix Expressions Language";
+    homepage = "https://github.com/kamadorueda/nixel";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ kamadorueda ];
+  };
+}
diff --git a/pkgs/tools/package-management/appimagekit/default.nix b/pkgs/tools/package-management/appimagekit/default.nix
index 3118b784334b0..151566ba8e8e2 100644
--- a/pkgs/tools/package-management/appimagekit/default.nix
+++ b/pkgs/tools/package-management/appimagekit/default.nix
@@ -96,6 +96,7 @@ in stdenv.mkDerivation rec {
     "-DUSE_SYSTEM_LIBARCHIVE=ON"
     "-DUSE_SYSTEM_GTEST=ON"
     "-DUSE_SYSTEM_MKSQUASHFS=ON"
+    "-DTOOLS_PREFIX=${stdenv.cc.targetPrefix}"
   ];
 
   postInstall = ''
diff --git a/pkgs/tools/package-management/micromamba/default.nix b/pkgs/tools/package-management/micromamba/default.nix
index c1f8fc9c990bd..1f95e41e61031 100644
--- a/pkgs/tools/package-management/micromamba/default.nix
+++ b/pkgs/tools/package-management/micromamba/default.nix
@@ -63,7 +63,7 @@ stdenv.mkDerivation rec {
     description = "Reimplementation of the conda package manager";
     homepage = "https://github.com/mamba-org/mamba";
     license = licenses.bsd3;
-    platforms = platforms.linux;
+    platforms = platforms.all;
     maintainers = with maintainers; [ mausch ];
   };
 }
diff --git a/pkgs/tools/security/certstrap/default.nix b/pkgs/tools/security/certstrap/default.nix
index ff6522f1d35f3..9edd8b3884f8b 100644
--- a/pkgs/tools/security/certstrap/default.nix
+++ b/pkgs/tools/security/certstrap/default.nix
@@ -1,21 +1,33 @@
-{ lib, buildGoPackage, fetchFromGitHub }:
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "certstrap";
   version = "1.2.0";
 
-  goPackagePath = "github.com/square/certstrap";
-
   src = fetchFromGitHub {
     owner = "square";
     repo = "certstrap";
     rev = "v${version}";
-    sha256 = "1ymchnn7c9g3pq7rw4lrwsd6z3wfjx90g7qgrw6r5hssl77mnscj";
+    sha256 = "sha256-kmlbz6Faw5INzw+fB1KXjo9vmuaZEp4PvuMldqyFrPo=";
   };
 
+  vendorSha256 = null;
+
+  subPackages = [ "." ];
+
+  ldflags = [ "-X main.release=${version}" ];
+
   meta = with lib; {
-    inherit (src.meta) homepage;
     description = "Tools to bootstrap CAs, certificate requests, and signed certificates";
+    longDescription = ''
+      A simple certificate manager written in Go, to bootstrap your own
+      certificate authority and public key infrastructure. Adapted from etcd-ca.
+    '';
+    homepage = "https://github.com/square/certstrap";
+    changelog = "https://github.com/square/certstrap/releases/tag/${src.rev}";
     license = licenses.asl20;
     maintainers = with maintainers; [ volth ];
   };
diff --git a/pkgs/tools/security/fail2ban/default.nix b/pkgs/tools/security/fail2ban/default.nix
index 62bc16f6a4147..ef09cc1ac71b0 100644
--- a/pkgs/tools/security/fail2ban/default.nix
+++ b/pkgs/tools/security/fail2ban/default.nix
@@ -27,6 +27,12 @@ python3.pkgs.buildPythonApplication rec {
       url = "https://github.com/fail2ban/fail2ban/commit/5ac303df8a171f748330d4c645ccbf1c2c7f3497.patch";
       sha256 = "sha256-aozQJHwPcJTe/D/PLQzBk1YH3OAP6Qm7wO7cai5CVYI=";
     })
+    # fix use of MutableMapping with Python >= 3.10
+    # https://github.com/fail2ban/fail2ban/issues/3142
+    (fetchpatch {
+      url = "https://github.com/fail2ban/fail2ban/commit/294ec73f629d0e29cece3a1eb5dd60b6fccea41f.patch";
+      sha256 = "sha256-Eimm4xjBDYNn5QdTyMqGgT5EXsZdd/txxcWJojXlsFE=";
+    })
   ];
 
   preConfigure = ''
diff --git a/pkgs/tools/security/himitsu-firefox/default.nix b/pkgs/tools/security/himitsu-firefox/default.nix
new file mode 100644
index 0000000000000..b462863011871
--- /dev/null
+++ b/pkgs/tools/security/himitsu-firefox/default.nix
@@ -0,0 +1,46 @@
+{ lib
+, stdenv
+, fetchFromSourcehut
+, hare
+, himitsu
+, zip
+}:
+
+stdenv.mkDerivation rec {
+  pname = "himitsu-firefox";
+  version = "0.3";
+
+  src = fetchFromSourcehut {
+    name = pname + "-src";
+    owner = "~sircmpwn";
+    repo = pname;
+    rev = "d6d0fdb30aefc93f6ff7d48e5737557051f1ffea";
+    hash = "sha256-5RbNdEGPnfDt1KDeU2LnuRsqqqMRyV/Dh2cgEWkz4vQ=";
+  };
+
+  nativeBuildInputs = [
+    hare
+    zip
+  ];
+
+  buildInputs = [
+    himitsu
+  ];
+
+  buildFlags = [ "LIBEXECDIR=$(out)/libexec" ];
+
+  # Only install the native component; per the docs:
+  # > To install the add-on for Firefox ESR, run make install-xpi. Be advised
+  # > that this will probably not work. The recommended installation procedure
+  # > for the native extension is to install it from addons.mozilla.org instead.
+  installTargets = [ "install-native" ];
+  installFlags = [ "PREFIX=" "DESTDIR=$(out)" ];
+
+  meta = with lib; {
+    homepage = "https://git.sr.ht/~sircmpwn/himitsu-firefox";
+    description = "Himitsu integration for Firefox";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ auchter ];
+    inherit (hare.meta) platforms badPlatforms;
+  };
+}
diff --git a/pkgs/tools/security/himitsu/default.nix b/pkgs/tools/security/himitsu/default.nix
new file mode 100644
index 0000000000000..e48de780d72dd
--- /dev/null
+++ b/pkgs/tools/security/himitsu/default.nix
@@ -0,0 +1,34 @@
+{ lib
+, stdenv
+, fetchFromSourcehut
+, hare
+, scdoc
+}:
+
+stdenv.mkDerivation rec {
+  pname = "himitsu";
+  version = "0.1";
+
+  src = fetchFromSourcehut {
+    name = pname + "-src";
+    owner = "~sircmpwn";
+    repo = pname;
+    rev = "003c14747fcddceb5359c9503f20c44b15fea5fa";
+    hash = "sha256-tzBTDJKMuFh9anURy1aKQTmt77tI7wZDZQiOUowuomk=";
+  };
+
+  nativeBuildInputs = [
+    hare
+    scdoc
+  ];
+
+  installFlags = [ "PREFIX=" "DESTDIR=$(out)" ];
+
+  meta = with lib; {
+    homepage = "https://himitsustore.org/";
+    description = "A secret storage manager";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ auchter ];
+    inherit (hare.meta) platforms badPlatforms;
+  };
+}
diff --git a/pkgs/tools/security/metasploit/Gemfile b/pkgs/tools/security/metasploit/Gemfile
index d2ae05738047e..8350e202156e4 100644
--- a/pkgs/tools/security/metasploit/Gemfile
+++ b/pkgs/tools/security/metasploit/Gemfile
@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 source "https://rubygems.org"
 
-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.2.3"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.2.4"
diff --git a/pkgs/tools/security/metasploit/Gemfile.lock b/pkgs/tools/security/metasploit/Gemfile.lock
index 5fa3d58634395..6dd9a21eaa9da 100644
--- a/pkgs/tools/security/metasploit/Gemfile.lock
+++ b/pkgs/tools/security/metasploit/Gemfile.lock
@@ -1,9 +1,9 @@
 GIT
   remote: https://github.com/rapid7/metasploit-framework
-  revision: ef3f1dfb9c196e19174e59f5d75707fffb847073
-  ref: refs/tags/6.2.3
+  revision: ed772a23efa7e2a7d7ae6417939e900c66950fd9
+  ref: refs/tags/6.2.4
   specs:
-    metasploit-framework (6.2.3)
+    metasploit-framework (6.2.4)
       actionpack (~> 6.0)
       activerecord (~> 6.0)
       activesupport (~> 6.0)
@@ -32,7 +32,7 @@ GIT
       metasploit-concern
       metasploit-credential
       metasploit-model
-      metasploit-payloads (= 2.0.93)
+      metasploit-payloads (= 2.0.94)
       metasploit_data_models
       metasploit_payloads-mettle (= 1.0.18)
       mqtt
@@ -130,13 +130,13 @@ GEM
     arel-helpers (2.14.0)
       activerecord (>= 3.1.0, < 8)
     aws-eventstream (1.2.0)
-    aws-partitions (1.600.0)
-    aws-sdk-core (3.131.1)
+    aws-partitions (1.601.0)
+    aws-sdk-core (3.131.2)
       aws-eventstream (~> 1, >= 1.0.2)
       aws-partitions (~> 1, >= 1.525.0)
       aws-sigv4 (~> 1.1)
       jmespath (~> 1, >= 1.6.1)
-    aws-sdk-ec2 (1.318.0)
+    aws-sdk-ec2 (1.319.0)
       aws-sdk-core (~> 3, >= 3.127.0)
       aws-sigv4 (~> 1.1)
     aws-sdk-iam (1.69.0)
@@ -238,7 +238,7 @@ GEM
       activemodel (~> 6.0)
       activesupport (~> 6.0)
       railties (~> 6.0)
-    metasploit-payloads (2.0.93)
+    metasploit-payloads (2.0.94)
     metasploit_data_models (5.0.5)
       activerecord (~> 6.0)
       activesupport (~> 6.0)
@@ -252,7 +252,7 @@ GEM
     metasploit_payloads-mettle (1.0.18)
     method_source (1.0.0)
     mini_portile2 (2.8.0)
-    minitest (5.16.0)
+    minitest (5.16.1)
     mqtt (0.5.0)
     msgpack (1.5.2)
     multi_json (1.15.0)
@@ -290,7 +290,7 @@ GEM
       hashery (~> 2.0)
       ruby-rc4
       ttfunk
-    pg (1.3.5)
+    pg (1.4.1)
     public_suffix (4.0.7)
     puma (5.6.4)
       nio4r (~> 2.0)
@@ -298,8 +298,8 @@ GEM
     rack (2.2.3.1)
     rack-protection (2.2.0)
       rack
-    rack-test (1.1.0)
-      rack (>= 1.0, < 3)
+    rack-test (2.0.0)
+      rack (>= 1.3)
     rails-dom-testing (2.0.3)
       activesupport (>= 4.2.0)
       nokogiri (>= 1.6)
@@ -371,7 +371,7 @@ GEM
     ruby-macho (3.0.0)
     ruby-rc4 (0.1.5)
     ruby2_keywords (0.0.5)
-    ruby_smb (3.1.3)
+    ruby_smb (3.1.4)
       bindata
       openssl-ccm
       openssl-cmac
diff --git a/pkgs/tools/security/metasploit/default.nix b/pkgs/tools/security/metasploit/default.nix
index 126d21bc7d0b5..ae3c75c630fe8 100644
--- a/pkgs/tools/security/metasploit/default.nix
+++ b/pkgs/tools/security/metasploit/default.nix
@@ -15,13 +15,13 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "metasploit-framework";
-  version = "6.2.3";
+  version = "6.2.4";
 
   src = fetchFromGitHub {
     owner = "rapid7";
     repo = "metasploit-framework";
     rev = version;
-    sha256 = "sha256-5G2xjzdZro01Es3oqnUFO9TrvBCku5QE7DjPgU0xlc8=";
+    sha256 = "sha256-9JzavB6VMEM7UFa30WlHdZ/hajOly+JX75I+3DECOqM=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/security/metasploit/gemset.nix b/pkgs/tools/security/metasploit/gemset.nix
index baa4aea667211..98a026aaa9f20 100644
--- a/pkgs/tools/security/metasploit/gemset.nix
+++ b/pkgs/tools/security/metasploit/gemset.nix
@@ -104,30 +104,30 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0cx73zazv4jsh51b08jgf7pzn62wmfqlwwg2z8w4rcqbvn326n93";
+      sha256 = "0ydlikjhhsiqk7v8k7q1f036fd7yrmimasw40rnwcj3f1747lygd";
       type = "gem";
     };
-    version = "1.600.0";
+    version = "1.601.0";
   };
   aws-sdk-core = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0yiz3aaik62rxhxipwznb2bv8ywha13vdxg9nk6anq9bd0nn0728";
+      sha256 = "164abp3cvmvfa2qsgzbxvkafbhwbgn3qwknp0amwmxw5nwvz8p3s";
       type = "gem";
     };
-    version = "3.131.1";
+    version = "3.131.2";
   };
   aws-sdk-ec2 = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0airi3qgnjdxl3n459nxq6bjwq0i3jyvwa0pv8nivw6lnskl1jps";
+      sha256 = "0b42j6hdw62qz02j1llqp4c4y0dx39x3wfk1nprxwl27sdvy1mgk";
       type = "gem";
     };
-    version = "1.318.0";
+    version = "1.319.0";
   };
   aws-sdk-iam = {
     groups = ["default"];
@@ -614,12 +614,12 @@
     platforms = [];
     source = {
       fetchSubmodules = false;
-      rev = "ef3f1dfb9c196e19174e59f5d75707fffb847073";
-      sha256 = "1kwm656q3krqxh299fx422yfpm1v0mssms6d28sqvbjr6y7v2vg4";
+      rev = "ed772a23efa7e2a7d7ae6417939e900c66950fd9";
+      sha256 = "18rs08qxqgljxxby5jx56dmf37vm8xlx3dsna0xl6c4m3sydm77l";
       type = "git";
       url = "https://github.com/rapid7/metasploit-framework";
     };
-    version = "6.2.3";
+    version = "6.2.4";
   };
   metasploit-model = {
     groups = ["default"];
@@ -636,10 +636,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0y06rkm2zh13qz1b40srx7dd1f5yl669k01ji4ha41pqn7wcv32v";
+      sha256 = "1azr70qfq14wpki61hnljqnxnxlx9ifa4p92wh29cnak8v697v69";
       type = "gem";
     };
-    version = "2.0.93";
+    version = "2.0.94";
   };
   metasploit_data_models = {
     groups = ["default"];
@@ -686,10 +686,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "05ik7y422ylnv391w7lh812w43p1dirlvkzyq09v27ag683fvsbh";
+      sha256 = "08z6rgs1jgbc032843mwg3fayvzn4hihz8bl2gp87pf7z02kw5f3";
       type = "gem";
     };
-    version = "5.16.0";
+    version = "5.16.1";
   };
   mqtt = {
     groups = ["default"];
@@ -917,10 +917,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "10ryzmc3r5ja6g90a9ycsxcxsy5872xa1vf01jam0bm74zq3zmi6";
+      sha256 = "11q4zw8n0lmff5k514ip30yizr38jb2x5nh3m7fy3k13sbxbysrq";
       type = "gem";
     };
-    version = "1.3.5";
+    version = "1.4.1";
   };
   public_suffix = {
     groups = ["default"];
@@ -977,10 +977,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0rh8h376mx71ci5yklnpqqn118z3bl67nnv5k801qaqn1zs62h8m";
+      sha256 = "01igqmm7xqw6vg6x28phivl044n2crq0bcfjrxr4979kzxydgh8h";
       type = "gem";
     };
-    version = "1.1.0";
+    version = "2.0.0";
   };
   rails-dom-testing = {
     groups = ["default"];
@@ -1297,10 +1297,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0vqj4lb41vkpv0dl65caw7w9h804vzbdw5q6wvkzqv1q0k8nbqbd";
+      sha256 = "0cvavqvgwq2gcrg0gh8fdzyn9zzpkyh9g07jz6cn7zzxzgwxfn9v";
       type = "gem";
     };
-    version = "3.1.3";
+    version = "3.1.4";
   };
   rubyntlm = {
     groups = ["default"];
diff --git a/pkgs/tools/security/regpg/default.nix b/pkgs/tools/security/regpg/default.nix
new file mode 100644
index 0000000000000..aaefbef227b88
--- /dev/null
+++ b/pkgs/tools/security/regpg/default.nix
@@ -0,0 +1,52 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, makeWrapper
+, gnupg
+, perl
+}:
+
+let
+  perlEnv = perl.withPackages (p: with p; [ TextMarkdown ]);
+in
+stdenv.mkDerivation rec {
+  pname = "regpg";
+  version = "1.11";
+
+  src = fetchFromGitHub {
+    owner = "fanf2";
+    repo = "regpg";
+    rev = "regpg-${version}";
+    sha256 = "2ea99950804078190e1cc2a76d4740e3fdd5395a9043db3f3fe86bf2477d3a7d";
+  };
+
+  nativeBuildInputs = [ makeWrapper perlEnv ];
+
+  postPatch = ''
+    patchShebangs ./util/insert-here.pl ./util/markdown.pl
+    substituteInPlace ./Makefile \
+      --replace 'util/insert-here.pl' 'perl util/insert-here.pl'
+    substituteInPlace ./Makefile \
+      --replace 'util/markdown.pl' 'perl util/markdown.pl'
+    substituteInPlace util/insert-here.pl \
+      --replace 'qx(git describe)' '"regpg-${version}"'
+  '';
+
+  dontConfigure = true;
+
+  makeFlags = [ "prefix=$(out)" ];
+
+  postFixup = ''
+    patchShebangs $out/bin/regpg
+    wrapProgram $out/bin/regpg --prefix PATH ":" \
+      "${lib.makeBinPath [ gnupg ]}"
+  '';
+
+  meta = with lib; {
+    description = "GPG wrapper utility for storing secrets in VCS";
+    homepage = "https://dotat.at/prog/regpg";
+    license = licenses.gpl3;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ _0xC45 ];
+  };
+}
diff --git a/pkgs/tools/security/rekor/default.nix b/pkgs/tools/security/rekor/default.nix
index 2ecff27825a3a..99928b96caa49 100644
--- a/pkgs/tools/security/rekor/default.nix
+++ b/pkgs/tools/security/rekor/default.nix
@@ -4,13 +4,13 @@ let
   generic = { pname, packageToBuild, description }:
     buildGoModule rec {
       inherit pname;
-      version = "0.8.1";
+      version = "0.8.2";
 
       src = fetchFromGitHub {
         owner = "sigstore";
         repo = "rekor";
         rev = "v${version}";
-        sha256 = "sha256-QBS9vGKYe7aox0RhgiJ3wp7UmnxAmtox45xKOC0vhj0=";
+        sha256 = "sha256-EaOLqStoZJMTSS6g56UhFQRhuwYBjh/XLRX6JjD17+g=";
         # populate values that require us to use git. By doing this in postFetch we
         # can delete .git afterwards and maintain better reproducibility of the src.
         leaveDotGit = true;
@@ -23,7 +23,7 @@ let
         '';
       };
 
-      vendorSha256 = "sha256-OZyRIi6y47c9eS8GLClgV4JGbSsvjd6KvED3N8LIe6I=";
+      vendorSha256 = "sha256-bvn5TKfTcB/0p47r5kW1P4OlnbWYQpESo9t8IC9f+fM=";
 
       nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/security/schleuder/Gemfile b/pkgs/tools/security/schleuder/Gemfile
new file mode 100644
index 0000000000000..687c293bac913
--- /dev/null
+++ b/pkgs/tools/security/schleuder/Gemfile
@@ -0,0 +1,3 @@
+source 'https://rubygems.org' do
+  gem 'schleuder'
+end
diff --git a/pkgs/tools/security/schleuder/Gemfile.lock b/pkgs/tools/security/schleuder/Gemfile.lock
new file mode 100644
index 0000000000000..a5b7312901c27
--- /dev/null
+++ b/pkgs/tools/security/schleuder/Gemfile.lock
@@ -0,0 +1,85 @@
+GEM
+  specs:
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    activemodel (6.1.4.4)
+      activesupport (= 6.1.4.4)
+    activerecord (6.1.4.4)
+      activemodel (= 6.1.4.4)
+      activesupport (= 6.1.4.4)
+    activesupport (6.1.4.4)
+      concurrent-ruby (~> 1.0, >= 1.0.2)
+      i18n (>= 1.6, < 2)
+      minitest (>= 5.1)
+      tzinfo (~> 2.0)
+      zeitwerk (~> 2.3)
+    bcrypt (3.1.16)
+    charlock_holmes (0.7.7)
+    concurrent-ruby (1.1.9)
+    daemons (1.4.1)
+    eventmachine (1.2.7)
+    gpgme (2.0.20)
+      mini_portile2 (~> 2.3)
+    i18n (1.8.11)
+      concurrent-ruby (~> 1.0)
+    mail (2.7.1)
+      mini_mime (>= 0.1.1)
+    mail-gpg (0.4.4)
+      gpgme (~> 2.0, >= 2.0.2)
+      mail (~> 2.5, >= 2.5.3)
+    mini_mime (1.1.2)
+    mini_portile2 (2.7.1)
+    minitest (5.15.0)
+    multi_json (1.15.0)
+    mustermann (1.1.1)
+      ruby2_keywords (~> 0.0.1)
+    rack (2.2.3)
+    rack-protection (2.1.0)
+      rack
+    rake (13.0.6)
+    ruby2_keywords (0.0.5)
+    schleuder (4.0.2)
+      activerecord (~> 6.1.3)
+      bcrypt (~> 3.1.2)
+      charlock_holmes (~> 0.7.6)
+      gpgme (~> 2.0, >= 2.0.19)
+      mail (~> 2.7.1)
+      mail-gpg (~> 0.3)
+      rake (>= 10.5.0)
+      sinatra (~> 2)
+      sinatra-contrib (~> 2)
+      sqlite3 (~> 1.4.2)
+      thin (~> 1)
+      thor (~> 0)
+    sinatra (2.1.0)
+      mustermann (~> 1.0)
+      rack (~> 2.2)
+      rack-protection (= 2.1.0)
+      tilt (~> 2.0)
+    sinatra-contrib (2.1.0)
+      multi_json
+      mustermann (~> 1.0)
+      rack-protection (= 2.1.0)
+      sinatra (= 2.1.0)
+      tilt (~> 2.0)
+    sqlite3 (1.4.2)
+    thin (1.8.1)
+      daemons (~> 1.0, >= 1.0.9)
+      eventmachine (~> 1.0, >= 1.0.4)
+      rack (>= 1, < 3)
+    thor (0.20.3)
+    tilt (2.0.10)
+    tzinfo (2.0.4)
+      concurrent-ruby (~> 1.0)
+    zeitwerk (2.5.3)
+
+PLATFORMS
+  x86_64-linux
+
+DEPENDENCIES
+  schleuder!
+
+BUNDLED WITH
+   2.2.24
diff --git a/pkgs/tools/security/schleuder/cli/Gemfile b/pkgs/tools/security/schleuder/cli/Gemfile
new file mode 100644
index 0000000000000..428e856aecc65
--- /dev/null
+++ b/pkgs/tools/security/schleuder/cli/Gemfile
@@ -0,0 +1,4 @@
+source "https://rubygems.org"
+
+gem "schleuder-cli", git: "https://0xacab.org/schleuder/schleuder-cli", tag: "schleuder-cli-0.1.0"
+
diff --git a/pkgs/tools/security/schleuder/cli/Gemfile.lock b/pkgs/tools/security/schleuder/cli/Gemfile.lock
new file mode 100644
index 0000000000000..bd47b9df7f9a0
--- /dev/null
+++ b/pkgs/tools/security/schleuder/cli/Gemfile.lock
@@ -0,0 +1,21 @@
+GIT
+  remote: https://0xacab.org/schleuder/schleuder-cli
+  revision: 1de2548695d9a74f47b7868954561b48cbc966f9
+  tag: schleuder-cli-0.1.0
+  specs:
+    schleuder-cli (0.1.0)
+      thor (~> 0)
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    thor (0.20.3)
+
+PLATFORMS
+  x86_64-linux
+
+DEPENDENCIES
+  schleuder-cli!
+
+BUNDLED WITH
+   2.3.6
diff --git a/pkgs/tools/security/schleuder/cli/default.nix b/pkgs/tools/security/schleuder/cli/default.nix
new file mode 100644
index 0000000000000..e34afa699f042
--- /dev/null
+++ b/pkgs/tools/security/schleuder/cli/default.nix
@@ -0,0 +1,34 @@
+{ lib
+, bundlerApp
+, ruby
+, bundlerUpdateScript
+}:
+
+bundlerApp {
+  inherit ruby;
+
+  pname = "schleuder-cli";
+
+  gemdir = ./.;
+
+  installManpages = false;
+
+  exes = [
+    "schleuder-cli"
+  ];
+
+  passthru.updateScript = bundlerUpdateScript "schleuder-cli";
+
+  meta = with lib; {
+    description = "A command line tool to create and manage schleuder-lists";
+    longDescription = ''
+      Schleuder-cli enables creating, configuring, and deleting lists,
+      subscriptions, keys, etc. It uses the Schleuder API, provided by
+      schleuder-api-daemon (part of Schleuder).
+    '';
+    homepage = "https://schleuder.org";
+    changelog = "https://0xacab.org/schleuder/schleuder-cli/-/blob/main/CHANGELOG.md";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ hexa ];
+  };
+}
diff --git a/pkgs/tools/security/schleuder/cli/gemset.nix b/pkgs/tools/security/schleuder/cli/gemset.nix
new file mode 100644
index 0000000000000..45ff62f891370
--- /dev/null
+++ b/pkgs/tools/security/schleuder/cli/gemset.nix
@@ -0,0 +1,25 @@
+{
+  schleuder-cli = {
+    dependencies = ["thor"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      fetchSubmodules = false;
+      rev = "1de2548695d9a74f47b7868954561b48cbc966f9";
+      sha256 = "0k4i33w9a0bscw4wbs301vxca367g7pa89y6cr24i0014pbmhs9z";
+      type = "git";
+      url = "https://0xacab.org/schleuder/schleuder-cli";
+    };
+    version = "0.1.0";
+  };
+  thor = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1yhrnp9x8qcy5vc7g438amd5j9sw83ih7c30dr6g6slgw9zj3g29";
+      type = "gem";
+    };
+    version = "0.20.3";
+  };
+}
diff --git a/pkgs/tools/security/schleuder/default.nix b/pkgs/tools/security/schleuder/default.nix
new file mode 100644
index 0000000000000..84597f6f51bf7
--- /dev/null
+++ b/pkgs/tools/security/schleuder/default.nix
@@ -0,0 +1,38 @@
+{ lib
+, bundlerApp
+, ruby
+, bundlerUpdateScript
+, defaultGemConfig
+, nixosTests
+}:
+
+bundlerApp {
+  inherit ruby;
+
+  pname = "schleuder";
+
+  gemdir = ./.;
+
+  exes = [
+    "schleuder"
+    "schleuder-api-daemon"
+  ];
+
+  passthru.updateScript = bundlerUpdateScript "schleuder";
+  passthru.tests = {
+    inherit (nixosTests) schleuder;
+  };
+
+  meta = with lib; {
+    description = "Schleuder is an encrypting mailing list manager with remailing-capabilities";
+    longDescription = ''
+      Schleuder is a group's email-gateway: subscribers can exchange
+      encrypted emails among themselves, receive emails from
+      non-subscribers and send emails to non-subscribers via the list.
+    '';
+    homepage = "https://schleuder.org";
+    changelog = "https://0xacab.org/schleuder/schleuder/blob/main/CHANGELOG.md";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ hexa lheckemann ];
+  };
+}
diff --git a/pkgs/tools/security/schleuder/gemset.nix b/pkgs/tools/security/schleuder/gemset.nix
new file mode 100644
index 0000000000000..9bd9cadbb883b
--- /dev/null
+++ b/pkgs/tools/security/schleuder/gemset.nix
@@ -0,0 +1,316 @@
+{
+  activemodel = {
+    dependencies = ["activesupport"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0g3qdz8dw6zkgz45jd13lwfdnm7rhgczv1pssw63g9k6qj3bkxjm";
+      type = "gem";
+    };
+    version = "6.1.4.4";
+  };
+  activerecord = {
+    dependencies = ["activemodel" "activesupport"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "090d4wl1pq06m9mibpck0m5nm8h45fwhs3fjx27297kjmnv4gzik";
+      type = "gem";
+    };
+    version = "6.1.4.4";
+  };
+  activesupport = {
+    dependencies = ["concurrent-ruby" "i18n" "minitest" "tzinfo" "zeitwerk"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0rvnz9lsf9mrkpji748sf51f54m027snkw6rm8flyvf7fq18rm98";
+      type = "gem";
+    };
+    version = "6.1.4.4";
+  };
+  bcrypt = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "02r1c3isfchs5fxivbq99gc3aq4vfyn8snhcy707dal1p8qz12qb";
+      type = "gem";
+    };
+    version = "3.1.16";
+  };
+  charlock_holmes = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0hybw8jw9ryvz5zrki3gc9r88jqy373m6v46ynxsdzv1ysiyr40p";
+      type = "gem";
+    };
+    version = "0.7.7";
+  };
+  concurrent-ruby = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0nwad3211p7yv9sda31jmbyw6sdafzmdi2i2niaz6f0wk5nq9h0f";
+      type = "gem";
+    };
+    version = "1.1.9";
+  };
+  daemons = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "07cszb0zl8mqmwhc8a2yfg36vi6lbgrp4pa5bvmryrpcz9v6viwg";
+      type = "gem";
+    };
+    version = "1.4.1";
+  };
+  eventmachine = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0wh9aqb0skz80fhfn66lbpr4f86ya2z5rx6gm5xlfhd05bj1ch4r";
+      type = "gem";
+    };
+    version = "1.2.7";
+  };
+  gpgme = {
+    dependencies = ["mini_portile2"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0xbgh9d8nbvsvyzqnd0mzhz0nr9hx4qn025kmz6d837lry4lc6gw";
+      type = "gem";
+    };
+    version = "2.0.20";
+  };
+  i18n = {
+    dependencies = ["concurrent-ruby"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0vdd1kii40qhbr9n8qx71k2gskq6rkl8ygy8hw5hfj8bb5a364xf";
+      type = "gem";
+    };
+    version = "1.8.11";
+  };
+  mail = {
+    dependencies = ["mini_mime"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "00wwz6ys0502dpk8xprwcqfwyf3hmnx6lgxaiq6vj43mkx43sapc";
+      type = "gem";
+    };
+    version = "2.7.1";
+  };
+  mail-gpg = {
+    dependencies = ["gpgme" "mail"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1rz936m8nacy7agksvpvkf6b37d1h5qvh5xkrjqvv5wbdqs3cyfj";
+      type = "gem";
+    };
+    version = "0.4.4";
+  };
+  mini_mime = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0lbim375gw2dk6383qirz13hgdmxlan0vc5da2l072j3qw6fqjm5";
+      type = "gem";
+    };
+    version = "1.1.2";
+  };
+  mini_portile2 = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0d3ga166pahsxavzwj19yjj4lr13rw1vsb36s2qs8blcxigrdp6z";
+      type = "gem";
+    };
+    version = "2.7.1";
+  };
+  minitest = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "06xf558gid4w8lwx13jwfdafsch9maz8m0g85wnfymqj63x5nbbd";
+      type = "gem";
+    };
+    version = "5.15.0";
+  };
+  multi_json = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0pb1g1y3dsiahavspyzkdy39j4q377009f6ix0bh1ag4nqw43l0z";
+      type = "gem";
+    };
+    version = "1.15.0";
+  };
+  mustermann = {
+    dependencies = ["ruby2_keywords"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0ccm54qgshr1lq3pr1dfh7gphkilc19dp63rw6fcx7460pjwy88a";
+      type = "gem";
+    };
+    version = "1.1.1";
+  };
+  rack = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0i5vs0dph9i5jn8dfc6aqd6njcafmb20rwqngrf759c9cvmyff16";
+      type = "gem";
+    };
+    version = "2.2.3";
+  };
+  rack-protection = {
+    dependencies = ["rack"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "159a4j4kragqh0z0z8vrpilpmaisnlz3n7kgiyf16bxkwlb3qlhz";
+      type = "gem";
+    };
+    version = "2.1.0";
+  };
+  rake = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "15whn7p9nrkxangbs9hh75q585yfn66lv0v2mhj6q6dl6x8bzr2w";
+      type = "gem";
+    };
+    version = "13.0.6";
+  };
+  ruby2_keywords = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1vz322p8n39hz3b4a9gkmz9y7a5jaz41zrm2ywf31dvkqm03glgz";
+      type = "gem";
+    };
+    version = "0.0.5";
+  };
+  schleuder = {
+    dependencies = ["activerecord" "bcrypt" "charlock_holmes" "gpgme" "mail" "mail-gpg" "rake" "sinatra" "sinatra-contrib" "sqlite3" "thin" "thor"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "15j1rfkfvni82msamikynsg48s50hbsx1pxm3y967caq9s80ll6c";
+      type = "gem";
+    };
+    version = "4.0.2";
+  };
+  sinatra = {
+    dependencies = ["mustermann" "rack" "rack-protection" "tilt"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0dd53rzpkxgs697pycbhhgc9vcnxra4ly4xar8ni6aiydx2f88zk";
+      type = "gem";
+    };
+    version = "2.1.0";
+  };
+  sinatra-contrib = {
+    dependencies = ["multi_json" "mustermann" "rack-protection" "sinatra" "tilt"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1rl1iiafz51yzjd0vchl2lni7lmwppjql6cn1fnfxbma707qlcja";
+      type = "gem";
+    };
+    version = "2.1.0";
+  };
+  sqlite3 = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0lja01cp9xd5m6vmx99zwn4r7s97r1w5cb76gqd8xhbm1wxyzf78";
+      type = "gem";
+    };
+    version = "1.4.2";
+  };
+  thin = {
+    dependencies = ["daemons" "eventmachine" "rack"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "123bh7qlv6shk8bg8cjc84ix8bhlfcilwnn3iy6zq3l57yaplm9l";
+      type = "gem";
+    };
+    version = "1.8.1";
+  };
+  thor = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1yhrnp9x8qcy5vc7g438amd5j9sw83ih7c30dr6g6slgw9zj3g29";
+      type = "gem";
+    };
+    version = "0.20.3";
+  };
+  tilt = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0rn8z8hda4h41a64l0zhkiwz2vxw9b1nb70gl37h1dg2k874yrlv";
+      type = "gem";
+    };
+    version = "2.0.10";
+  };
+  tzinfo = {
+    dependencies = ["concurrent-ruby"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "10qp5x7f9hvlc0psv9gsfbxg4a7s0485wsbq1kljkxq94in91l4z";
+      type = "gem";
+    };
+    version = "2.0.4";
+  };
+  zeitwerk = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0lmg9x683gr9mkrbq9df2m0zb0650mdfxqna0bs10js44inv7znx";
+      type = "gem";
+    };
+    version = "2.5.3";
+  };
+}
diff --git a/pkgs/tools/security/sslscan/default.nix b/pkgs/tools/security/sslscan/default.nix
index ae94b6e254702..6c112d6488daa 100644
--- a/pkgs/tools/security/sslscan/default.nix
+++ b/pkgs/tools/security/sslscan/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sslscan";
-  version = "2.0.13";
+  version = "2.0.14";
 
   src = fetchFromGitHub {
     owner = "rbsec";
     repo = "sslscan";
     rev = version;
-    sha256 = "sha256-boXp26f8jiw73lMLwUMuAuDBRIw8JzokYadbKx/VeSg=";
+    sha256 = "sha256-CqfxiTRIgrr4J6qThDFqohkxJj5Byf0vQzG+voAEzag=";
   };
 
   buildInputs = [ openssl ];
diff --git a/pkgs/tools/system/btop/default.nix b/pkgs/tools/system/btop/default.nix
index 86547d04e467d..7b18f0ec604fe 100644
--- a/pkgs/tools/system/btop/default.nix
+++ b/pkgs/tools/system/btop/default.nix
@@ -8,8 +8,8 @@
 
 stdenv.mkDerivation rec {
   pname = "btop";
-  version = "1.2.6";
-  hash = "sha256-q1Dpdw7bVSG10xtoUpelRgMrWe71vCWajjsAHjAZzQ4=";
+  version = "1.2.7";
+  hash = "sha256-zQpt/CEWW3oPqPo6SPuawyfLa50y6M4hL07uRO7YjLo=";
 
   src = fetchFromGitHub {
     owner = "aristocratos";
diff --git a/pkgs/tools/system/openipmi/default.nix b/pkgs/tools/system/openipmi/default.nix
index 8a8ac04f3accc..228c305de0c6f 100644
--- a/pkgs/tools/system/openipmi/default.nix
+++ b/pkgs/tools/system/openipmi/default.nix
@@ -18,6 +18,6 @@ stdenv.mkDerivation rec {
     description = "A user-level library that provides a higher-level abstraction of IPMI and generic services";
     license = with licenses; [ gpl2Only lgpl2Only ];
     platforms = platforms.linux;
-    maintainers = with maintainers; [ arezvov SuperSandro2000 ];
+    maintainers = with maintainers; [ arezvov ] ++ teams.c3d2.members;
   };
 }
diff --git a/pkgs/tools/system/smartmontools/default.nix b/pkgs/tools/system/smartmontools/default.nix
index e72d7ff5e1c20..18dc89a868045 100644
--- a/pkgs/tools/system/smartmontools/default.nix
+++ b/pkgs/tools/system/smartmontools/default.nix
@@ -10,22 +10,22 @@
 }:
 
 let
-  dbrev = "5171";
-  drivedbBranch = "RELEASE_7_2_DRIVEDB";
+  dbrev = "5388";
+  drivedbBranch = "RELEASE_7_3_DRIVEDB";
   driverdb = fetchurl {
     url = "https://sourceforge.net/p/smartmontools/code/${dbrev}/tree/branches/${drivedbBranch}/smartmontools/drivedb.h?format=raw";
-    sha256 = "0vncr98xagbcfsxgfgxsip2qrl9q3y8va19qhv6yknlwbdfap4mn";
+    sha256 = "sha256-0dtLev4JjeHsS259+qOgg19rz4yjkeX4D3ooUgS4RTI=";
     name = "smartmontools-drivedb.h";
   };
 
 in
 stdenv.mkDerivation rec {
   pname = "smartmontools";
-  version = "7.2";
+  version = "7.3";
 
   src = fetchurl {
     url = "mirror://sourceforge/smartmontools/${pname}-${version}.tar.gz";
-    sha256 = "1mlc25sd5rgj5xmzcllci47inmfdw7cp185fday6hc9rwqkqmnaw";
+    sha256 = "sha256-pUT4gI0MWM+w50JMoYQcuFipdJIrA11QXU5MJIvjois=";
   };
 
   patches = [
diff --git a/pkgs/tools/text/dos2unix/default.nix b/pkgs/tools/text/dos2unix/default.nix
index f694b91762c55..6a0c5fc57ee93 100644
--- a/pkgs/tools/text/dos2unix/default.nix
+++ b/pkgs/tools/text/dos2unix/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "dos2unix";
-  version = "7.4.2";
+  version = "7.4.3";
 
   src = fetchurl {
     url = "https://waterlan.home.xs4all.nl/dos2unix/${pname}-${version}.tar.gz";
-    sha256 = "00dfsf4rfyjb5j12gan8xjiirm0asshdz6dmd3l34a7ays6wadb0";
+    sha256 = "sha256-to20GVba+TOChCOqMFEOAMEtKe9ZFucV6NTmlP5mynI=";
   };
 
   nativeBuildInputs = [ perl gettext ];
diff --git a/pkgs/tools/text/mdbook/default.nix b/pkgs/tools/text/mdbook/default.nix
index 075dd1b2b5879..57f373a9ce1a5 100644
--- a/pkgs/tools/text/mdbook/default.nix
+++ b/pkgs/tools/text/mdbook/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mdbook";
-  version = "0.4.17";
+  version = "0.4.18";
 
   src = fetchFromGitHub {
     owner = "rust-lang";
     repo = "mdBook";
     rev = "v${version}";
-    sha256 = "sha256-08ccRiOBXYqueKfyi/Ry39O2xOXUKishgqhn6RdbvUE=";
+    sha256 = "sha256-lsryNrgjOGdugOhtkNbnYEreF0X1ywLVaFmKUXDf884=";
   };
 
-  cargoSha256 = "sha256-vXUjKpCGlHlBvXLtmGkFtHRxxZakiEzuNzReFGEl6dw=";
+  cargoSha256 = "sha256-l95nbp9PEgO97D1M/R9IB3Xfog6+DkZwyVY2DEl5mG4=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];
 
diff --git a/pkgs/tools/text/nkf/default.nix b/pkgs/tools/text/nkf/default.nix
index a2b5f66a6e915..9a70ea9461af5 100644
--- a/pkgs/tools/text/nkf/default.nix
+++ b/pkgs/tools/text/nkf/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl }:
+{ lib, stdenv, fetchurl, fetchpatch }:
 
 stdenv.mkDerivation rec {
   pname = "nkf";
@@ -9,6 +9,15 @@ stdenv.mkDerivation rec {
     sha256 = "0i5dbcb9aipwr8ym4mhvgf1in3frl6y8h8x96cprz9s7b11xz9yi";
   };
 
+  patches = [
+    # Pull upstream fix for parllel build failures
+    (fetchpatch {
+      name = "parallel-install.patch";
+      url = "http://git.osdn.net/view?p=nkf/nkf.git;a=patch;h=9ccff5975bec7963e591e042e1ab1139252a4dc9";
+      sha256 = "00f0x414gfch650b20w0yj5x2bd67hchmadl7v54lk3vdgkc6jwj";
+    })
+  ];
+
   makeFlags = [ "prefix=$(out)" ];
 
   meta = {
diff --git a/pkgs/tools/text/poedit/default.nix b/pkgs/tools/text/poedit/default.nix
index fcb2a7019acad..c64828579c948 100644
--- a/pkgs/tools/text/poedit/default.nix
+++ b/pkgs/tools/text/poedit/default.nix
@@ -1,22 +1,22 @@
-{ lib, stdenv, fetchFromGitHub, autoconf, automake, libtool, gettext, pkg-config, wxGTK31-gtk3,
+{ lib, stdenv, fetchFromGitHub, autoconf, automake, libtool, gettext, pkg-config, wxGTK30-gtk3,
   boost, icu, lucenepp, asciidoc, libxslt, xmlto, gtk3, gtkspell3, pugixml,
   nlohmann_json, hicolor-icon-theme, wrapGAppsHook }:
 
 stdenv.mkDerivation rec {
   pname = "poedit";
-  version = "3.0.1";
+  version = "3.1";
 
   src = fetchFromGitHub {
     owner = "vslavik";
     repo = "poedit";
     rev = "v${version}-oss";
-    sha256 = "sha256-PBAOCAO3OrBE7lOho7nJNEpqwds7XiblN/f+GonrXHA=";
+    sha256 = "sha256-Wxj1xPbtupEnzuvf7JdUgdTxX2oAZDEYk6W4CjrmRRE=";
   };
 
   nativeBuildInputs = [ autoconf automake asciidoc wrapGAppsHook
     libxslt xmlto boost libtool pkg-config ];
 
-  buildInputs = [ lucenepp nlohmann_json wxGTK31-gtk3 icu pugixml gtk3 gtkspell3 hicolor-icon-theme ];
+  buildInputs = [ lucenepp nlohmann_json wxGTK30-gtk3 icu pugixml gtk3 gtkspell3 hicolor-icon-theme ];
 
   propagatedBuildInputs = [ gettext ];
 
diff --git a/pkgs/tools/video/rtmpdump/default.nix b/pkgs/tools/video/rtmpdump/default.nix
index 5f301ae88915a..6e05f81fcd8ce 100644
--- a/pkgs/tools/video/rtmpdump/default.nix
+++ b/pkgs/tools/video/rtmpdump/default.nix
@@ -15,13 +15,13 @@ assert (gnutlsSupport || opensslSupport);
 with lib;
 stdenv.mkDerivation {
   pname = "rtmpdump";
-  version = "unstable-2019-03-30";
+  version = "unstable-2021-02-19";
 
   src = fetchgit {
     url = "git://git.ffmpeg.org/rtmpdump";
     # Currently the latest commit is used (a release has not been made since 2011, i.e. '2.4')
-    rev = "c5f04a58fc2aeea6296ca7c44ee4734c18401aa3";
-    sha256 = "07ias612jgmxpam9h418kvlag32da914jsnjsfyafklpnh8gdzjb";
+    rev = "f1b83c10d8beb43fcc70a6e88cf4325499f25857";
+    sha256 = "0vchr0f0d5fi0zaa16jywva5db3x9dyws7clqaq32gwh5drbkvs0";
   };
 
   patches = [
diff --git a/pkgs/tools/x11/xmcp/default.nix b/pkgs/tools/x11/xmcp/default.nix
new file mode 100644
index 0000000000000..178861d637246
--- /dev/null
+++ b/pkgs/tools/x11/xmcp/default.nix
@@ -0,0 +1,33 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, libX11
+}:
+
+stdenv.mkDerivation rec {
+  pname = "xmcp";
+  version = "unstable-2020-10-10";
+
+  src = fetchFromGitHub {
+    owner = "blblapco";
+    repo = "xmcp";
+    rev = "ee56225f1665f9edc04fe5c165809f2fe160a420";
+    sha256 = "sha256-B3YkYrVEg6UJ2ApaVook4N2XvrCboxDMUG5CN9I79Sg=";
+  };
+
+  buildInputs = [ libX11 ];
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm0755 xmcp $out/bin/xmcp
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Tiny color picker for X11";
+    homepage = "https://github.com/blblapco/xmcp";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ azahi ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 3b2a08673c7fa..bd19a8d3059dc 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -619,6 +619,7 @@ mapAliases ({
   iops = throw "iops was removed: upstream is gone"; # Added 2022-02-06
   iproute = iproute2; # moved from top-level 2021-03-14
   ipsecTools = throw "ipsecTools has benn removed, because it was no longer maintained upstream"; # Added 2021-12-15
+  itch-setup = throw "itch-setup has benn removed, use itch instead"; # Added 2022-06-02
 
   ### J ###
 
@@ -1217,6 +1218,7 @@ mapAliases ({
   retroArchCores = throw "retroArchCores has been removed. Please use overrides instead, e.g.: `retroarch.override { cores = with libretro; [ ... ]; }`"; # Added 2021-11-19
   retroshare06 = retroshare;
   rfkill = throw "rfkill has been removed, as it's included in util-linux"; # Added 2020-08-23
+  riak = throw "riak has been removed due to lack of maintainer to update the package"; # Added 2022-06-22
   riak-cs = throw "riak-cs is not maintained anymore"; # Added 2020-10-14
   rimshot = throw "rimshot has been removed, because it is broken and no longer maintained upstream"; # Added 2022-01-15
   ring-daemon = jami-daemon; # Added 2021-10-26
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index daa41e5e4db1a..4694c54a65b9d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1139,6 +1139,8 @@ with pkgs;
 
   asleap = callPackage ../tools/networking/asleap { };
 
+  butler = callPackage ../games/itch/butler.nix { };
+
   cf-vault = callPackage ../tools/admin/cf-vault { };
 
   bikeshed = python3Packages.callPackage ../applications/misc/bikeshed { };
@@ -1147,8 +1149,6 @@ with pkgs;
 
   cope = callPackage ../tools/misc/cope { };
 
-  dterm = callPackage ../tools/misc/dterm { };
-
   ejson2env = callPackage ../tools/admin/ejson2env { };
 
   davinci-resolve = callPackage ../applications/video/davinci-resolve { };
@@ -1583,6 +1583,8 @@ with pkgs;
 
   darktile = callPackage ../applications/terminal-emulators/darktile { };
 
+  dterm = callPackage ../applications/terminal-emulators/dterm { };
+
   eterm = callPackage ../applications/terminal-emulators/eterm { };
 
   foot = callPackage ../applications/terminal-emulators/foot { };
@@ -2085,7 +2087,9 @@ with pkgs;
 
   botamusique = callPackage ../tools/audio/botamusique { };
 
-  boulder = callPackage ../tools/admin/boulder { };
+  boulder = callPackage ../tools/admin/boulder {
+    buildGoModule = buildGo118Module;
+  };
 
   btrfs-heatmap = callPackage ../tools/filesystems/btrfs-heatmap { };
 
@@ -2401,6 +2405,10 @@ with pkgs;
 
   hime = callPackage ../tools/inputmethods/hime {};
 
+  himitsu = callPackage ../tools/security/himitsu { };
+
+  himitsu-firefox = callPackage ../tools/security/himitsu-firefox { };
+
   hinit = haskell.lib.compose.justStaticExecutables haskellPackages.hinit;
 
   hostctl = callPackage ../tools/system/hostctl { };
@@ -2429,8 +2437,6 @@ with pkgs;
 
   itch = callPackage ../games/itch {};
 
-  itch-setup = callPackage ../games/itch-setup {};
-
   lastpass-cli = callPackage ../tools/security/lastpass-cli { };
 
   leetcode-cli = callPackage ../applications/misc/leetcode-cli { };
@@ -4093,6 +4099,8 @@ with pkgs;
 
   nix-direnv = callPackage ../tools/misc/nix-direnv { };
 
+  nixel = callPackage ../tools/nix/nixel { };
+
   nix-output-monitor = callPackage ../tools/nix/nix-output-monitor { };
 
   nix-template = callPackage ../tools/package-management/nix-template {
@@ -5549,6 +5557,10 @@ with pkgs;
     conf = config.schildichat-web.conf or {};
   };
 
+  schleuder = callPackage ../tools/security/schleuder { };
+
+  schleuder-cli = callPackage ../tools/security/schleuder/cli { };
+
   tealdeer = callPackage ../tools/misc/tealdeer {
     inherit (darwin.apple_sdk.frameworks) Security;
   };
@@ -6779,6 +6791,8 @@ with pkgs;
 
   grpc-tools = callPackage ../development/tools/misc/grpc-tools { };
 
+  grpc-client-cli = callPackage ../development/tools/misc/grpc-client-cli { };
+
   grub = pkgsi686Linux.callPackage ../tools/misc/grub ({
     stdenv = overrideCC stdenv buildPackages.pkgsi686Linux.gcc6;
   } // (config.grub or {}));
@@ -7762,14 +7776,6 @@ with pkgs;
 
   mani = callPackage ../development/tools/mani { };
 
-  mapcache = callPackage ../servers/geospatial/mapcache { };
-
-  mapserver = callPackage ../servers/geospatial/mapserver { };
-
-  martin = callPackage ../servers/geospatial/martin {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
-
   mask = callPackage ../development/tools/mask { };
 
   mathpix-snipping-tool = callPackage ../tools/misc/mathpix-snipping-tool { };
@@ -9538,6 +9544,8 @@ with pkgs;
 
   pm2 = nodePackages.pm2;
 
+  pmenu = callPackage ../tools/X11/pmenu { };
+
   pngcheck = callPackage ../tools/graphics/pngcheck { };
 
   pngcrush = callPackage ../tools/graphics/pngcrush { };
@@ -9568,7 +9576,7 @@ with pkgs;
   pod2mdoc = callPackage ../tools/misc/pod2mdoc { };
 
   poedit = callPackage ../tools/text/poedit {
-    wxGTK31-gtk3 = wxGTK31-gtk3.override { withWebKit = true; };
+    wxGTK30-gtk3 = wxGTK30-gtk3.override { withWebKit = true; };
   };
 
   polipo = callPackage ../servers/polipo { };
@@ -9802,7 +9810,7 @@ with pkgs;
 
   qjournalctl = libsForQt5.callPackage ../applications/system/qjournalctl { };
 
-  qjoypad = callPackage ../tools/misc/qjoypad { };
+  qjoypad = libsForQt5.callPackage ../tools/misc/qjoypad { };
 
   qmk = callPackage ../tools/misc/qmk { };
 
@@ -9983,6 +9991,8 @@ with pkgs;
 
   reftools = callPackage ../development/tools/reftools { };
 
+  regpg = callPackage ../tools/security/regpg { };
+
   remote-touchpad = callPackage ../tools/inputmethods/remote-touchpad { };
 
   reposurgeon = callPackage ../applications/version-management/reposurgeon { };
@@ -10980,8 +10990,6 @@ with pkgs;
 
   tidy-viewer = callPackage ../tools/text/tidy-viewer { };
 
-  tile38 = callPackage ../servers/geospatial/tile38 { };
-
   tiled = libsForQt5.callPackage ../applications/editors/tiled { };
 
   tiledb = callPackage ../development/libraries/tiledb { };
@@ -11548,6 +11556,14 @@ with pkgs;
 
   woff2 = callPackage ../development/web/woff2 { };
 
+  woodpecker-agent = callPackage ../development/tools/continuous-integration/woodpecker/agent.nix { };
+
+  woodpecker-cli = callPackage ../development/tools/continuous-integration/woodpecker/cli.nix { };
+
+  woodpecker-server = callPackage ../development/tools/continuous-integration/woodpecker/server.nix {
+    woodpecker-frontend = callPackage ../development/tools/continuous-integration/woodpecker/frontend.nix { };
+  };
+
   woof = callPackage ../tools/misc/woof { };
 
   wootility = callPackage ../tools/misc/wootility {
@@ -11596,8 +11612,6 @@ with pkgs;
 
   td = callPackage ../tools/misc/td { };
 
-  tegola = callPackage ../servers/geospatial/tegola {};
-
   tftp-hpa = callPackage ../tools/networking/tftp-hpa {};
 
   tigervnc = callPackage ../tools/admin/tigervnc {};
@@ -12812,6 +12826,9 @@ with pkgs;
     isl = if !stdenv.isDarwin then isl_0_11 else null;
 
     cloog = if !stdenv.isDarwin then cloog_0_18_0 else null;
+
+    # Build fails on Darwin with clang
+    stdenv = if stdenv.isDarwin then gccStdenv else stdenv;
   }));
 
   gcc6 = lowPrio (wrapCC (callPackage ../development/compilers/gcc/6 {
@@ -13215,10 +13232,6 @@ with pkgs;
 
   remarkable2-toolchain = callPackage ../development/tools/misc/remarkable/remarkable2-toolchain { };
 
-  t-rex = callPackage ../servers/geospatial/t-rex {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
-
   tacacsplus = callPackage ../servers/tacacsplus { };
 
   tamarin-prover =
@@ -13842,11 +13855,11 @@ with pkgs;
   buildRustCrateHelpers = callPackage ../build-support/rust/build-rust-crate/helpers.nix { };
   cratesIO = callPackage ../build-support/rust/crates-io.nix { };
 
-  cargo-web = callPackage ../development/tools/cargo-web {
+  cargo-web = callPackage ../development/tools/rust/cargo-web {
     inherit (darwin.apple_sdk.frameworks) CoreServices Security;
   };
 
-  cargo-flamegraph = callPackage ../development/tools/cargo-flamegraph {
+  cargo-flamegraph = callPackage ../development/tools/rust/cargo-flamegraph {
     inherit (darwin.apple_sdk.frameworks) Security;
     inherit (linuxPackages) perf;
   };
@@ -13855,9 +13868,9 @@ with pkgs;
 
   defaultCrateOverrides = callPackage ../build-support/rust/default-crate-overrides.nix { };
 
-  cargo-about = callPackage ../tools/package-management/cargo-about { };
+  cargo-about = callPackage ../development/tools/rust/cargo-about { };
   cargo-all-features = callPackage ../development/tools/rust/cargo-all-features { };
-  cargo-audit = callPackage ../tools/package-management/cargo-audit {
+  cargo-audit = callPackage ../development/tools/rust/cargo-audit {
     inherit (darwin.apple_sdk.frameworks) Security;
   };
   cargo-bisect-rustc = callPackage ../development/tools/rust/cargo-bisect-rustc {
@@ -13871,29 +13884,29 @@ with pkgs;
   cargo-deadlinks = callPackage ../development/tools/rust/cargo-deadlinks {
     inherit (darwin.apple_sdk.frameworks) Security;
   };
-  cargo-deb = callPackage ../tools/package-management/cargo-deb {
+  cargo-deb = callPackage ../development/tools/rust/cargo-deb {
     inherit (darwin.apple_sdk.frameworks) Security;
   };
-  cargo-deps = callPackage ../tools/package-management/cargo-deps { };
-  cargo-download = callPackage ../tools/package-management/cargo-download { };
-  cargo-edit = callPackage ../tools/package-management/cargo-edit {
+  cargo-deps = callPackage ../development/tools/rust/cargo-deps { };
+  cargo-download = callPackage ../development/tools/rust/cargo-download { };
+  cargo-edit = callPackage ../development/tools/rust/cargo-edit {
     inherit (darwin.apple_sdk.frameworks) Security;
   };
-  cargo-kcov = callPackage ../tools/package-management/cargo-kcov { };
-  cargo-graph = callPackage ../tools/package-management/cargo-graph { };
-  cargo-license = callPackage ../tools/package-management/cargo-license { };
+  cargo-kcov = callPackage ../development/tools/rust/cargo-kcov { };
+  cargo-graph = callPackage ../development/tools/rust/cargo-graph { };
+  cargo-license = callPackage ../development/tools/rust/cargo-license { };
   cargo-llvm-lines = callPackage ../development/tools/rust/cargo-llvm-lines { };
-  cargo-outdated = callPackage ../tools/package-management/cargo-outdated {
+  cargo-outdated = callPackage ../development/tools/rust/cargo-outdated {
     inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration;
   };
-  cargo-release = callPackage ../tools/package-management/cargo-release {
+  cargo-release = callPackage ../development/tools/rust/cargo-release {
     inherit (darwin.apple_sdk.frameworks) Security;
   };
   cargo-rr = callPackage ../development/tools/rust/cargo-rr { };
   cargo-tarpaulin = callPackage ../development/tools/analysis/cargo-tarpaulin {
     inherit (darwin.apple_sdk.frameworks) Security;
   };
-  cargo-update = callPackage ../tools/package-management/cargo-update {
+  cargo-update = callPackage ../development/tools/rust/cargo-update {
     inherit (darwin.apple_sdk.frameworks) Security;
   };
 
@@ -13948,7 +13961,9 @@ with pkgs;
   cargo-msrv = callPackage ../development/tools/rust/cargo-msrv {
     inherit (darwin.apple_sdk.frameworks) Security;
   };
-  cargo-nextest = callPackage ../development/tools/rust/cargo-nextest { };
+  cargo-nextest = callPackage ../development/tools/rust/cargo-nextest {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
   cargo-play = callPackage ../development/tools/rust/cargo-play { };
   cargo-raze = callPackage ../development/tools/rust/cargo-raze {
     inherit (darwin.apple_sdk.frameworks) Security;
@@ -15353,6 +15368,8 @@ with pkgs;
 
   corundum = callPackage ../development/tools/corundum { };
 
+  confluencepot = callPackage ../servers/confluencepot {};
+
   confluent-platform = callPackage ../servers/confluent-platform {};
 
   ctags = callPackage ../development/tools/misc/ctags { };
@@ -21027,6 +21044,8 @@ with pkgs;
 
   tidyp = callPackage ../development/libraries/tidyp { };
 
+  tidal-hifi = callPackage ../applications/audio/tidal-hifi { };
+
   tinycdb = callPackage ../development/libraries/tinycdb { };
 
   tinyxml = tinyxml2;
@@ -22108,8 +22127,6 @@ with pkgs;
 
   mattermost-desktop = callPackage ../applications/networking/instant-messengers/mattermost-desktop { };
 
-  mbtileserver = callPackage ../servers/geospatial/mbtileserver { };
-
   memcached = callPackage ../servers/memcached {};
 
   meteor = callPackage ../servers/meteor { };
@@ -22352,10 +22369,6 @@ with pkgs;
 
   tomcat-native = callPackage ../servers/http/tomcat/tomcat-native.nix { };
 
-  pg_featureserv = callPackage ../servers/geospatial/pg_featureserv { };
-
-  pg_tileserv = callPackage ../servers/geospatial/pg_tileserv { };
-
   pies = callPackage ../servers/pies { };
 
   rpcbind = callPackage ../servers/rpcbind { };
@@ -22434,10 +22447,6 @@ with pkgs;
   percona-server56 = callPackage ../servers/sql/percona/5.6.x.nix { stdenv = gcc10StdenvCompat; };
   percona-server = percona-server56;
 
-  riak = callPackage ../servers/nosql/riak/2.2.0.nix {
-    erlang = erlang_basho_R16B02;
-  };
-
   influxdb = callPackage ../servers/nosql/influxdb { };
   influxdb2-server = callPackage ../servers/nosql/influxdb2 { };
   influxdb2-cli = callPackage ../servers/nosql/influxdb2/cli.nix { };
@@ -22948,6 +22957,32 @@ with pkgs;
 
   zipkin = callPackage ../servers/monitoring/zipkin { };
 
+  ### SERVERS / GEOSPATIAL
+
+  geoserver = callPackage ../servers/geospatial/geoserver { };
+
+  mapcache = callPackage ../servers/geospatial/mapcache { };
+
+  mapserver = callPackage ../servers/geospatial/mapserver { };
+
+  martin = callPackage ../servers/geospatial/martin {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
+
+  mbtileserver = callPackage ../servers/geospatial/mbtileserver { };
+
+  pg_featureserv = callPackage ../servers/geospatial/pg_featureserv { };
+
+  pg_tileserv = callPackage ../servers/geospatial/pg_tileserv { };
+
+  t-rex = callPackage ../servers/geospatial/t-rex {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
+
+  tegola = callPackage ../servers/geospatial/tegola { };
+
+  tile38 = callPackage ../servers/geospatial/tile38 { };
+
   ### OS-SPECIFIC
 
   afuse = callPackage ../os-specific/linux/afuse { };
@@ -23450,8 +23485,6 @@ with pkgs;
   linux_5_10_hardened = linuxKernel.kernels.linux_5_10_hardened;
   linuxPackages_5_15_hardened = linuxKernel.packages.linux_5_15_hardened;
   linux_5_15_hardened = linuxKernel.kernels.linux_5_15_hardened;
-  linuxPackages_5_17_hardened = linuxKernel.packages.linux_5_17_hardened;
-  linux_5_17_hardened = linuxKernel.kernels.linux_5_17_hardened;
   linuxPackages_5_18_hardened = linuxKernel.packages.linux_5_18_hardened;
   linux_5_18_hardened = linuxKernel.kernels.linux_5_18_hardened;
 
@@ -25829,7 +25862,7 @@ with pkgs;
 
   complete-alias = callPackage ../tools/misc/complete-alias { };
 
-  confclerk = callPackage ../applications/misc/confclerk { };
+  confclerk = libsForQt5.callPackage ../applications/misc/confclerk { };
 
   copyq = libsForQt5.callPackage ../applications/misc/copyq { };
 
@@ -26400,6 +26433,8 @@ with pkgs;
 
   fnc = callPackage ../applications/version-management/fnc { };
 
+  focus = callPackage ../tools/X11/focus { };
+
   focuswriter = libsForQt5.callPackage ../applications/editors/focuswriter { };
 
   foliate = callPackage ../applications/office/foliate { };
@@ -27185,6 +27220,10 @@ with pkgs;
     gtk = gtk3;
   };
 
+  hollywood = callPackage ../applications/misc/hollywood {
+    inherit (python3Packages) pygments;
+  };
+
   hors = callPackage ../development/tools/hors {
     inherit (darwin.apple_sdk.frameworks) Security;
   };
@@ -27665,6 +27704,8 @@ with pkgs;
 
   josm = callPackage ../applications/misc/josm { };
 
+  js8call = qt5.callPackage ../applications/radio/js8call { };
+
   jwm = callPackage ../applications/window-managers/jwm { };
 
   jwm-settings-manager = callPackage ../applications/window-managers/jwm/jwm-settings-manager.nix { };
@@ -29855,6 +29896,10 @@ with pkgs;
 
   robustirc-bridge = callPackage ../servers/irc/robustirc-bridge { };
 
+  routedns = callPackage ../tools/networking/routedns {
+    buildGoModule = buildGo118Module;
+  };
+
   skrooge = libsForQt5.callPackage ../applications/office/skrooge {};
 
   smartgithg = callPackage ../applications/version-management/smartgithg {
@@ -30054,7 +30099,9 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) Security;
   };
 
-  talosctl = callPackage ../applications/networking/cluster/talosctl { };
+  talosctl = callPackage ../applications/networking/cluster/talosctl {
+    buildGoModule = buildGo118Module;
+  };
 
   talentedhack = callPackage ../applications/audio/talentedhack { };
 
@@ -31621,7 +31668,13 @@ with pkgs;
 
   runescape = callPackage ../games/runescape-launcher { };
 
-  sm64ex = callPackage ../games/sm64ex { };
+  sm64ex = callPackage ../games/sm64ex {
+    branch = "sm64ex";
+  };
+
+  sm64ex-coop = callPackage ../games/sm64ex {
+    branch = "sm64ex-coop";
+  };
 
   snipes = callPackage ../games/snipes { };
 
@@ -31891,6 +31944,10 @@ with pkgs;
 
   fairymax = callPackage ../games/fairymax { };
 
+  ferium = callPackage ../games/ferium {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
+
   fheroes2 = callPackage ../games/fheroes2 { };
 
   fish-fillets-ng = callPackage ../games/fish-fillets-ng { };
@@ -33628,7 +33685,7 @@ with pkgs;
   z3 = z3_4_8;
   z3_4_4_0 = callPackage ../applications/science/logic/z3/4.4.0.nix {
     python = python2;
-    stdenv = gcc49Stdenv;
+    stdenv = if stdenv.isDarwin then stdenv else gcc49Stdenv;
   };
   z3-tptp = callPackage ../applications/science/logic/z3/tptp.nix {};
 
@@ -34732,7 +34789,7 @@ with pkgs;
     stdenv = gccStdenv;
   };
 
-  rss-glx = callPackage ../misc/screensavers/rss-glx { stdenv = gcc10StdenvCompat; };
+  rss-glx = callPackage ../misc/screensavers/rss-glx { };
 
   run-scaled = callPackage ../tools/X11/run-scaled { };
 
@@ -35277,19 +35334,16 @@ with pkgs;
 
   mpvc = callPackage ../applications/misc/mpvc { };
 
-  discord = import ../applications/networking/instant-messengers/discord {
+  discord = callPackage ../applications/networking/instant-messengers/discord {
     branch = "stable";
-    inherit pkgs lib stdenv;
   };
 
-  discord-ptb = import ../applications/networking/instant-messengers/discord {
+  discord-ptb = callPackage ../applications/networking/instant-messengers/discord {
     branch = "ptb";
-    inherit pkgs lib stdenv;
   };
 
-  discord-canary = import ../applications/networking/instant-messengers/discord {
+  discord-canary = callPackage ../applications/networking/instant-messengers/discord {
     branch = "canary";
-    inherit pkgs lib stdenv;
   };
 
   golden-cheetah = libsForQt5.callPackage ../applications/misc/golden-cheetah {};
@@ -35612,6 +35666,7 @@ with pkgs;
 
   xsos = callPackage ../os-specific/linux/xsos { };
 
+  xmcp = callPackage ../tools/x11/xmcp { };
 
   zk = callPackage ../applications/office/zk {};
 
diff --git a/pkgs/top-level/config.nix b/pkgs/top-level/config.nix
index e9cb8681f653e..0ab29d8516365 100644
--- a/pkgs/top-level/config.nix
+++ b/pkgs/top-level/config.nix
@@ -50,6 +50,10 @@ let
       feature = "set <literal>enableParallelBuilding</literal> to true by default";
     };
 
+    configurePlatformsByDefault = mkMassRebuild {
+      feature = "set <literal>configurePlatforms</literal> to <literal>[\"build\" \"host\"]</literal> by default";
+    };
+
     contentAddressedByDefault = mkMassRebuild {
       feature = "set <literal>__contentAddressed</literal> to true by default";
     };
diff --git a/pkgs/top-level/dotnet-packages.nix b/pkgs/top-level/dotnet-packages.nix
index 10188cee9148b..732fb66731efe 100644
--- a/pkgs/top-level/dotnet-packages.nix
+++ b/pkgs/top-level/dotnet-packages.nix
@@ -53,8 +53,8 @@ let self = dotnetPackages // overrides; dotnetPackages = with self; {
 
   SharpZipLib = fetchNuGet {
     pname = "SharpZipLib";
-    version = "0.86.0";
-    sha256 = "01w2038gckfnq31pncrlgm7d0c939pwr1x4jj5450vcqpd4c41jr";
+    version = "1.3.3";
+    sha256 = "sha256-HWEQTKh9Ktwg/zIl079dAiH+ob2ShWFAqLgG6XgIMr4=";
     outputFiles = [ "lib/*" ];
   };
 
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index fe8969b43add3..0e61796ef2816 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -162,12 +162,7 @@ in {
 
     linux_5_16 = throw "linux 5.16 was removed because it has reached its end of life upstream";
 
-    linux_5_17 = callPackage ../os-specific/linux/kernel/linux-5.17.nix {
-      kernelPatches = [
-        kernelPatches.bridge_stp_helper
-        kernelPatches.request_key_helper
-      ];
-    };
+    linux_5_17 = throw "linux 5.17 was removed because it has reached its end of life upstream";
 
     linux_5_18 = callPackage ../os-specific/linux/kernel/linux-5.18.nix {
       kernelPatches = [
@@ -189,7 +184,7 @@ in {
        else testing;
 
     linux_testing_bcachefs = callPackage ../os-specific/linux/kernel/linux-testing-bcachefs.nix rec {
-      kernel = linux_5_17;
+      kernel = linux_5_18;
       kernelPatches = kernel.kernelPatches;
    };
 
@@ -243,7 +238,6 @@ in {
     linux_5_4_hardened = hardenedKernelFor kernels.linux_5_4 { };
     linux_5_10_hardened = hardenedKernelFor kernels.linux_5_10 { };
     linux_5_15_hardened = hardenedKernelFor kernels.linux_5_15 { };
-    linux_5_17_hardened = hardenedKernelFor kernels.linux_5_17 { };
     linux_5_18_hardened = hardenedKernelFor kernels.linux_5_18 { };
 
   }));
@@ -517,7 +511,7 @@ in {
     linux_5_10 = recurseIntoAttrs (packagesFor kernels.linux_5_10);
     linux_5_15 = recurseIntoAttrs (packagesFor kernels.linux_5_15);
     linux_5_16 = throw "linux 5.16 was removed because it reached its end of life upstream"; # Added 2022-04-23
-    linux_5_17 = recurseIntoAttrs (packagesFor kernels.linux_5_17);
+    linux_5_17 = throw "linux 5.17 was removed because it reached its end of life upstream"; # Added 2022-06-23
     linux_5_18 = recurseIntoAttrs (packagesFor kernels.linux_5_18);
   };
 
@@ -557,7 +551,6 @@ in {
     });
     linux_5_10_hardened = recurseIntoAttrs (hardenedPackagesFor kernels.linux_5_10 { });
     linux_5_15_hardened = recurseIntoAttrs (hardenedPackagesFor kernels.linux_5_15 { });
-    linux_5_17_hardened = recurseIntoAttrs (hardenedPackagesFor kernels.linux_5_17 { });
     linux_5_18_hardened = recurseIntoAttrs (hardenedPackagesFor kernels.linux_5_18 { });
 
     linux_zen = recurseIntoAttrs (packagesFor kernels.linux_zen);
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 8fd557ce60a63..a6c676ea60156 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -69,6 +69,7 @@ mapAliases ({
   dogpile_cache = dogpile-cache; # added 2021-10-28
   dogpile-core = throw "dogpile-core is no longer maintained, use dogpile-cache instead"; # added 2021-11-20
   eebrightbox = throw "eebrightbox is unmaintained upstream and has therefore been removed"; # added 2022-02-03
+  email_validator = email-validator; # added 2022-06-22
   fake_factory = throw "fake_factory has been removed because it is unused and deprecated by upstream since 2016."; # added 2022-05-30
   faulthandler = throw "faulthandler is built into ${python.executable}"; # added 2021-07-12
   flask_testing = flask-testing; # added 2022-04-25
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 88f9286b1e41b..1a652fa48d6dc 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2734,7 +2734,7 @@ in {
 
   emailthreads = callPackage ../development/python-modules/emailthreads { };
 
-  email_validator = callPackage ../development/python-modules/email-validator { };
+  email-validator = callPackage ../development/python-modules/email-validator { };
 
   embrace = callPackage ../development/python-modules/embrace { };