diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 0f8b5faef12..b90598e6791 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -20,7 +20,7 @@ Below is a short excerpt of some points in there:
   ```
   (pkg-name | nixos/<module>): (from -> to | init at version | refactor | etc)
 
-  (Motivation for change. Additional information.)
+  (Motivation for change. Link to release notes. Additional information.)
   ```
 
   For consistency, there should not be a period at the end of the commit message's summary line (the first line of the commit message).
@@ -29,6 +29,7 @@ Below is a short excerpt of some points in there:
 
   * nginx: init at 2.0.1
   * firefox: 54.0.1 -> 55.0
+    https://www.mozilla.org/en-US/firefox/55.0/releasenotes/
   * nixos/hydra: add bazBaz option
 
     Dual baz behavior is needed to do foo.
diff --git a/lib/generators.nix b/lib/generators.nix
index 79ae9055ce3..3bc0fee332a 100644
--- a/lib/generators.nix
+++ b/lib/generators.nix
@@ -10,7 +10,7 @@
  * are mostly generators themselves, called with
  * their respective default values; they can be reused.
  *
- * Tests can be found in ./tests.nix
+ * Tests can be found in ./tests/misc.nix
  * Documentation in the manual, #sec-generators
  */
 { lib }:
@@ -108,7 +108,7 @@ rec {
    * The mk* configuration attributes can generically change
    * the way sections and key-value strings are generated.
    *
-   * For more examples see the test cases in ./tests.nix.
+   * For more examples see the test cases in ./tests/misc.nix.
    */
   toINI = {
     # apply transformations (e.g. escapes) to section names
@@ -130,6 +130,51 @@ rec {
       # map input to ini sections
       mapAttrsToStringsSep "\n" mkSection attrsOfAttrs;
 
+  /* Generate an INI-style config file from an attrset
+   * specifying the global section (no header), and an
+   * attrset of sections to an attrset of key-value pairs.
+   *
+   * generators.toINIWithGlobalSection {} {
+   *   globalSection = {
+   *     someGlobalKey = "hi";
+   *   };
+   *   sections = {
+   *     foo = { hi = "${pkgs.hello}"; ciao = "bar"; };
+   *     baz = { "also, integers" = 42; };
+   * }
+   *
+   *> someGlobalKey=hi
+   *>
+   *> [baz]
+   *> also, integers=42
+   *>
+   *> [foo]
+   *> ciao=bar
+   *> hi=/nix/store/y93qql1p5ggfnaqjjqhxcw0vqw95rlz0-hello-2.10
+   *
+   * The mk* configuration attributes can generically change
+   * the way sections and key-value strings are generated.
+   *
+   * For more examples see the test cases in ./tests/misc.nix.
+   *
+   * If you don’t need a global section, you can also use
+   * `generators.toINI` directly, which only takes
+   * the part in `sections`.
+   */
+  toINIWithGlobalSection = {
+    # apply transformations (e.g. escapes) to section names
+    mkSectionName ? (name: libStr.escape [ "[" "]" ] name),
+    # format a setting line from key and value
+    mkKeyValue    ? mkKeyValueDefault {} "=",
+    # allow lists as values for duplicate keys
+    listsAsDuplicateKeys ? false
+  }: { globalSection, sections }:
+    ( if globalSection == {}
+      then ""
+      else (toKeyValue { inherit mkKeyValue listsAsDuplicateKeys; } globalSection)
+           + "\n")
+    + (toINI { inherit mkSectionName mkKeyValue listsAsDuplicateKeys; } sections);
+
   /* Generate a git-config file from an attrset.
    *
    * It has two major differences from the regular INI format:
diff --git a/lib/tests/misc.nix b/lib/tests/misc.nix
index 9012bba2b56..fcccf89cc88 100644
--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@@ -471,6 +471,66 @@ runTests {
     '';
   };
 
+  testToINIWithGlobalSectionEmpty = {
+    expr = generators.toINIWithGlobalSection {} {
+      globalSection = {
+      };
+      sections = {
+      };
+    };
+    expected = ''
+    '';
+  };
+
+  testToINIWithGlobalSectionGlobalEmptyIsTheSameAsToINI =
+    let
+      sections = {
+        "section 1" = {
+          attribute1 = 5;
+          x = "Me-se JarJar Binx";
+        };
+        "foo" = {
+          "he\\h=he" = "this is okay";
+        };
+      };
+    in {
+      expr =
+        generators.toINIWithGlobalSection {} {
+            globalSection = {};
+            sections = sections;
+        };
+      expected = generators.toINI {} sections;
+  };
+
+  testToINIWithGlobalSectionFull = {
+    expr = generators.toINIWithGlobalSection {} {
+      globalSection = {
+        foo = "bar";
+        test = false;
+      };
+      sections = {
+        "section 1" = {
+          attribute1 = 5;
+          x = "Me-se JarJar Binx";
+        };
+        "foo" = {
+          "he\\h=he" = "this is okay";
+        };
+      };
+    };
+    expected = ''
+      foo=bar
+      test=false
+
+      [foo]
+      he\h\=he=this is okay
+
+      [section 1]
+      attribute1=5
+      x=Me-se JarJar Binx
+    '';
+  };
+
   /* right now only invocation check */
   testToJSONSimple =
     let val = {
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 72d4e8dfb21..d0d012856d6 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -4656,6 +4656,12 @@
     githubId = 4656860;
     name = "Gaute Ravndal";
   };
+  graysonhead = {
+    email = "grayson@graysonhead.net";
+    github = "graysonhead";
+    githubId = 6179496;
+    name = "Grayson Head";
+  };
   grburst = {
     email = "GRBurst@protonmail.com";
     github = "GRBurst";
diff --git a/nixos/modules/system/boot/loader/grub/grub.nix b/nixos/modules/system/boot/loader/grub/grub.nix
index 8db271f8713..1f915d1f419 100644
--- a/nixos/modules/system/boot/loader/grub/grub.nix
+++ b/nixos/modules/system/boot/loader/grub/grub.nix
@@ -44,6 +44,8 @@ let
     { splashImage = f cfg.splashImage;
       splashMode = f cfg.splashMode;
       backgroundColor = f cfg.backgroundColor;
+      entryOptions = f cfg.entryOptions;
+      subEntryOptions = f cfg.subEntryOptions;
       grub = f grub;
       grubTarget = f (grub.grubTarget or "");
       shell = "${pkgs.runtimeShell}";
@@ -448,6 +450,30 @@ in
         '';
       };
 
+      entryOptions = mkOption {
+        default = "--class nixos --unrestricted";
+        type = types.nullOr types.str;
+        description = ''
+          Options applied to the primary NixOS menu entry.
+
+          <note><para>
+          This options has no effect for GRUB 1.
+          </para></note>
+        '';
+      };
+
+      subEntryOptions = mkOption {
+        default = "--class nixos";
+        type = types.nullOr types.str;
+        description = ''
+          Options applied to the secondary NixOS submenu entry.
+
+          <note><para>
+          This options has no effect for GRUB 1.
+          </para></note>
+        '';
+      };
+
       theme = mkOption {
         type = types.nullOr types.path;
         example = literalExpression "pkgs.nixos-grub2-theme";
diff --git a/nixos/modules/system/boot/loader/grub/install-grub.pl b/nixos/modules/system/boot/loader/grub/install-grub.pl
index 0c93b288fc6..d5f019423b6 100644
--- a/nixos/modules/system/boot/loader/grub/install-grub.pl
+++ b/nixos/modules/system/boot/loader/grub/install-grub.pl
@@ -64,6 +64,8 @@ my $extraEntries = get("extraEntries");
 my $extraEntriesBeforeNixOS = get("extraEntriesBeforeNixOS") eq "true";
 my $splashImage = get("splashImage");
 my $splashMode = get("splashMode");
+my $entryOptions = get("entryOptions");
+my $subEntryOptions = get("subEntryOptions");
 my $backgroundColor = get("backgroundColor");
 my $configurationLimit = int(get("configurationLimit"));
 my $copyKernels = get("copyKernels") eq "true";
@@ -509,7 +511,7 @@ sub addEntry {
 # Add default entries.
 $conf .= "$extraEntries\n" if $extraEntriesBeforeNixOS;
 
-addEntry("NixOS - Default", $defaultConfig, "--unrestricted");
+addEntry("NixOS - Default", $defaultConfig, $entryOptions);
 
 $conf .= "$extraEntries\n" unless $extraEntriesBeforeNixOS;
 
@@ -546,7 +548,7 @@ sub addProfile {
     my ($profile, $description) = @_;
 
     # Add entries for all generations of this profile.
-    $conf .= "submenu \"$description\" {\n" if $grubVersion == 2;
+    $conf .= "submenu \"$description\" --class submenu {\n" if $grubVersion == 2;
 
     sub nrFromGen { my ($x) = @_; $x =~ /\/\w+-(\d+)-link/; return $1; }
 
@@ -566,7 +568,7 @@ sub addProfile {
             -e "$link/nixos-version"
             ? readFile("$link/nixos-version")
             : basename((glob(dirname(Cwd::abs_path("$link/kernel")) . "/lib/modules/*"))[0]);
-        addEntry("NixOS - Configuration " . nrFromGen($link) . " ($date - $version)", $link);
+        addEntry("NixOS - Configuration " . nrFromGen($link) . " ($date - $version)", $link, $subEntryOptions);
     }
 
     $conf .= "}\n" if $grubVersion == 2;
diff --git a/pkgs/applications/audio/audacity/0001-Use-a-different-approach-to-estimate-the-disk-space-.patch b/pkgs/applications/audio/audacity/0001-Use-a-different-approach-to-estimate-the-disk-space-.patch
deleted file mode 100644
index 33b7554db44..00000000000
--- a/pkgs/applications/audio/audacity/0001-Use-a-different-approach-to-estimate-the-disk-space-.patch
+++ /dev/null
@@ -1,355 +0,0 @@
-From deeb435829d73524df851f6f4c2d4be552c99230 Mon Sep 17 00:00:00 2001
-From: Dmitry Vedenko <dmitry@crsib.me>
-Date: Fri, 1 Oct 2021 16:21:22 +0300
-Subject: [PATCH] Use a different approach to estimate the disk space usage
-
-New a approach is a bit less precise, but removes the requirement for the "private" SQLite3 table and allows Audacity to be built against system SQLite3.
----
- cmake-proxies/sqlite/CMakeLists.txt |   5 -
- src/DBConnection.h                  |   4 +-
- src/ProjectFileIO.cpp               | 269 +++++-----------------------
- 3 files changed, 44 insertions(+), 234 deletions(-)
-
-diff --git a/cmake-proxies/sqlite/CMakeLists.txt b/cmake-proxies/sqlite/CMakeLists.txt
-index 63d70637c..d7b9b95ef 100644
---- a/cmake-proxies/sqlite/CMakeLists.txt
-+++ b/cmake-proxies/sqlite/CMakeLists.txt
-@@ -19,11 +19,6 @@ list( APPEND INCLUDES
- 
- list( APPEND DEFINES
-    PRIVATE
--      #
--      # We need the dbpage table for space calculations.
--      #
--      SQLITE_ENABLE_DBPAGE_VTAB=1
--
-       # Can't be set after a WAL mode database is initialized, so change
-       # the default here to ensure all project files get the same page 
-       # size.
-diff --git a/src/DBConnection.h b/src/DBConnection.h
-index 16a7fc9d4..07d3af95e 100644
---- a/src/DBConnection.h
-+++ b/src/DBConnection.h
-@@ -75,8 +75,8 @@ public:
-       LoadSampleBlock,
-       InsertSampleBlock,
-       DeleteSampleBlock,
--      GetRootPage,
--      GetDBPage
-+      GetSampleBlockSize,
-+      GetAllSampleBlocksSize
-    };
-    sqlite3_stmt *Prepare(enum StatementID id, const char *sql);
- 
-diff --git a/src/ProjectFileIO.cpp b/src/ProjectFileIO.cpp
-index 3b3e2e1fd..c9bc45af4 100644
---- a/src/ProjectFileIO.cpp
-+++ b/src/ProjectFileIO.cpp
-@@ -35,6 +35,7 @@ Paul Licameli split from AudacityProject.cpp
- #include "widgets/ProgressDialog.h"
- #include "wxFileNameWrapper.h"
- #include "xml/XMLFileReader.h"
-+#include "MemoryX.h"`
- 
- #undef NO_SHM
- #if !defined(__WXMSW__)
-@@ -2357,255 +2358,69 @@ int64_t ProjectFileIO::GetTotalUsage()
- }
- 
- //
--// Returns the amount of disk space used by the specified sample blockid or all
--// of the sample blocks if the blockid is 0.  It does this by using the raw SQLite
--// pages available from the "sqlite_dbpage" virtual table to traverse the SQLite
--// table b-tree described here:  https://www.sqlite.org/fileformat.html
-+// Returns the estimation of disk space used by the specified sample blockid or all
-+// of the sample blocks if the blockid is 0. This does not include small overhead
-+// of the internal SQLite structures, only the size used by the data
- //
- int64_t ProjectFileIO::GetDiskUsage(DBConnection &conn, SampleBlockID blockid /* = 0 */)
- {
--   // Information we need to track our travels through the b-tree
--   typedef struct
--   {
--      int64_t pgno;
--      int currentCell;
--      int numCells;
--      unsigned char data[65536];
--   } page;
--   std::vector<page> stack;
--
--   int64_t total = 0;
--   int64_t found = 0;
--   int64_t right = 0;
--   int rc;
-+   sqlite3_stmt* stmt = nullptr;
- 
--   // Get the rootpage for the sampleblocks table.
--   sqlite3_stmt *stmt =
--      conn.Prepare(DBConnection::GetRootPage,
--                    "SELECT rootpage FROM sqlite_master WHERE tbl_name = 'sampleblocks';");
--   if (stmt == nullptr || sqlite3_step(stmt) != SQLITE_ROW)
-+   if (blockid == 0)
-    {
--      return 0;
--   }
--
--   // And store it in our first stack frame
--   stack.push_back({sqlite3_column_int64(stmt, 0)});
-+      static const char* statement =
-+R"(SELECT 
-+	sum(length(blockid) + length(sampleformat) + 
-+	length(summin) + length(summax) + length(sumrms) + 
-+	length(summary256) + length(summary64k) +
-+	length(samples))
-+FROM sampleblocks;)";
- 
--   // All done with the statement
--   sqlite3_clear_bindings(stmt);
--   sqlite3_reset(stmt);
--
--   // Prepare/retrieve statement to read raw database page
--   stmt = conn.Prepare(DBConnection::GetDBPage,
--      "SELECT data FROM sqlite_dbpage WHERE pgno = ?1;");
--   if (stmt == nullptr)
--   {
--      return 0;
-+      stmt = conn.Prepare(DBConnection::GetAllSampleBlocksSize, statement);
-    }
--
--   // Traverse the b-tree until we've visited all of the leaf pages or until
--   // we find the one corresponding to the passed in sample blockid. Because we
--   // use an integer primary key for the sampleblocks table, the traversal will
--   // be in ascending blockid sequence.
--   do
-+   else
-    {
--      // Acces the top stack frame
--      page &pg = stack.back();
-+      static const char* statement =
-+R"(SELECT 
-+	length(blockid) + length(sampleformat) + 
-+	length(summin) + length(summax) + length(sumrms) + 
-+	length(summary256) + length(summary64k) +
-+	length(samples)
-+FROM sampleblocks WHERE blockid = ?1;)";
- 
--      // Read the page from the sqlite_dbpage table if it hasn't yet been loaded
--      if (pg.numCells == 0)
--      {
--         // Bind the page number
--         sqlite3_bind_int64(stmt, 1, pg.pgno);
-+      stmt = conn.Prepare(DBConnection::GetSampleBlockSize, statement);
-+   }
- 
--         // And retrieve the page
--         if (sqlite3_step(stmt) != SQLITE_ROW)
-+   auto cleanup = finally(
-+      [stmt]() {
-+         // Clear statement bindings and rewind statement
-+         if (stmt != nullptr)
-          {
--            // REVIEW: Likely harmless failure - says size is zero on
--            // this error.
--            // LLL: Yea, but not much else we can do.
--            return 0;
-+            sqlite3_clear_bindings(stmt);
-+            sqlite3_reset(stmt);
-          }
-+      });
- 
--         // Copy the page content to the stack frame
--         memcpy(&pg.data,
--                sqlite3_column_blob(stmt, 0),
--                sqlite3_column_bytes(stmt, 0));
--
--         // And retrieve the total number of cells within it
--         pg.numCells = get2(&pg.data[3]);
--
--         // Reset statement for next usage
--         sqlite3_clear_bindings(stmt);
--         sqlite3_reset(stmt);
--      }
--
--      //wxLogDebug("%*.*spgno %lld currentCell %d numCells %d", (stack.size() - 1) * 2, (stack.size() - 1) * 2, "", pg.pgno, pg.currentCell, pg.numCells);
--
--      // Process an interior table b-tree page
--      if (pg.data[0] == 0x05)
--      {
--         // Process the next cell if we haven't examined all of them yet
--         if (pg.currentCell < pg.numCells)
--         {
--            // Remember the right-most leaf page number.
--            right = get4(&pg.data[8]);
--
--            // Iterate over the cells.
--            //
--            // If we're not looking for a specific blockid, then we always push the
--            // target page onto the stack and leave the loop after a single iteration.
--            //
--            // Otherwise, we match the blockid against the highest integer key contained
--            // within the cell and if the blockid falls within the cell, we stack the
--            // page and stop the iteration.
--            //
--            // In theory, we could do a binary search for a specific blockid here, but
--            // because our sample blocks are always large, we will get very few cells
--            // per page...usually 6 or less.
--            //
--            // In both cases, the stacked page can be either an internal or leaf page.
--            bool stacked = false;
--            while (pg.currentCell < pg.numCells)
--            {
--               // Get the offset to this cell using the offset in the cell pointer
--               // array.
--               //
--               // The cell pointer array starts immediately after the page header
--               // at offset 12 and the retrieved offset is from the beginning of
--               // the page.
--               int celloff = get2(&pg.data[12 + (pg.currentCell * 2)]);
--
--               // Bump to the next cell for the next iteration.
--               pg.currentCell++;
--
--               // Get the page number this cell describes
--               int pagenum = get4(&pg.data[celloff]);
--
--               // And the highest integer key, which starts at offset 4 within the cell.
--               int64_t intkey = 0;
--               get_varint(&pg.data[celloff + 4], &intkey);
--
--               //wxLogDebug("%*.*sinternal - right %lld celloff %d pagenum %d intkey %lld", (stack.size() - 1) * 2, (stack.size() - 1) * 2, " ", right, celloff, pagenum, intkey);
--
--               // Stack the described page if we're not looking for a specific blockid
--               // or if this page contains the given blockid.
--               if (!blockid || blockid <= intkey)
--               {
--                  stack.push_back({pagenum, 0, 0});
--                  stacked = true;
--                  break;
--               }
--            }
--
--            // If we pushed a new page onto the stack, we need to jump back up
--            // to read the page
--            if (stacked)
--            {
--               continue;
--            }
--         }
-+   if (blockid != 0)
-+   {
-+      int rc = sqlite3_bind_int64(stmt, 1, blockid);
- 
--         // We've exhausted all the cells with this page, so we stack the right-most
--         // leaf page.  Ensure we only process it once.
--         if (right)
--         {
--            stack.push_back({right, 0, 0});
--            right = 0;
--            continue;
--         }
--      }
--      // Process a leaf table b-tree page
--      else if (pg.data[0] == 0x0d)
-+      if (rc != SQLITE_OK)
-       {
--         // Iterate over the cells
--         //
--         // If we're not looking for a specific blockid, then just accumulate the
--         // payload sizes. We will be reading every leaf page in the sampleblocks
--         // table.
--         //
--         // Otherwise we break out when we find the matching blockid. In this case,
--         // we only ever look at 1 leaf page.
--         bool stop = false;
--         for (int i = 0; i < pg.numCells; i++)
--         {
--            // Get the offset to this cell using the offset in the cell pointer
--            // array.
--            //
--            // The cell pointer array starts immediately after the page header
--            // at offset 8 and the retrieved offset is from the beginning of
--            // the page.
--            int celloff = get2(&pg.data[8 + (i * 2)]);
--
--            // Get the total payload size in bytes of the described row.
--            int64_t payload = 0;
--            int digits = get_varint(&pg.data[celloff], &payload);
--
--            // Get the integer key for this row.
--            int64_t intkey = 0;
--            get_varint(&pg.data[celloff + digits], &intkey);
--
--            //wxLogDebug("%*.*sleaf - celloff %4d intkey %lld payload %lld", (stack.size() - 1) * 2, (stack.size() - 1) * 2, " ", celloff, intkey, payload);
--
--            // Add this payload size to the total if we're not looking for a specific
--            // blockid
--            if (!blockid)
--            {
--               total += payload;
--            }
--            // Otherwise, return the payload size for a matching row
--            else if (blockid == intkey)
--            {
--               return payload;
--            }
--         }
-+         conn.ThrowException(false);
-       }
-+   }
- 
--      // Done with the current branch, so pop back up to the previous one (if any)
--      stack.pop_back();
--   } while (!stack.empty());
--
--   // Return the total used for all sample blocks
--   return total;
--}
--
--// Retrieves a 2-byte big-endian integer from the page data
--unsigned int ProjectFileIO::get2(const unsigned char *ptr)
--{
--   return (ptr[0] << 8) | ptr[1];
--}
--
--// Retrieves a 4-byte big-endian integer from the page data
--unsigned int ProjectFileIO::get4(const unsigned char *ptr)
--{
--   return ((unsigned int) ptr[0] << 24) |
--          ((unsigned int) ptr[1] << 16) |
--          ((unsigned int) ptr[2] << 8)  |
--          ((unsigned int) ptr[3]);
--}
--
--// Retrieves a variable length integer from the page data. Returns the
--// number of digits used to encode the integer and the stores the
--// value at the given location.
--int ProjectFileIO::get_varint(const unsigned char *ptr, int64_t *out)
--{
--   int64_t val = 0;
--   int i;
-+   int rc = sqlite3_step(stmt);
- 
--   for (i = 0; i < 8; ++i)
-+   if (rc != SQLITE_ROW)
-    {
--      val = (val << 7) + (ptr[i] & 0x7f);
--      if ((ptr[i] & 0x80) == 0)
--      {
--         *out = val;
--         return i + 1;
--      }
-+      conn.ThrowException(false);
-    }
- 
--   val = (val << 8) + (ptr[i] & 0xff);
--   *out = val;
-+   const int64_t size = sqlite3_column_int64(stmt, 0);
- 
--   return 9;
-+   return size;
- }
- 
- InvisibleTemporaryProject::InvisibleTemporaryProject()
--- 
-2.33.1
-
diff --git a/pkgs/applications/audio/audacity/default.nix b/pkgs/applications/audio/audacity/default.nix
index 9d4c522edc1..653d5555eb1 100644
--- a/pkgs/applications/audio/audacity/default.nix
+++ b/pkgs/applications/audio/audacity/default.nix
@@ -3,6 +3,7 @@
 , fetchFromGitHub
 , fetchpatch
 , cmake
+, makeWrapper
 , pkg-config
 , python3
 , gettext
@@ -20,14 +21,17 @@
 , libsndfile
 , soxr
 , flac
+, lame
 , twolame
 , expat
 , libid3tag
 , libopus
+, libuuid
 , ffmpeg_4
 , soundtouch
 , pcre
-/*, portaudio - given up fighting their portaudio.patch */
+, portaudio # given up fighting their portaudio.patch?
+, portmidi
 , linuxHeaders
 , alsa-lib
 , at-spi2-core
@@ -36,11 +40,14 @@
 , libXdmcp
 , libXtst
 , libpthreadstubs
+, libsbsms_2_3_0
 , libselinux
 , libsepol
 , libxkbcommon
 , util-linux
 , wxGTK
+, libpng
+, libjpeg
 , AppKit ? null
 , AudioToolbox ? null
 , AudioUnit ? null
@@ -58,12 +65,14 @@
 
 let
   inherit (lib) optionals;
+  pname = "audacity";
+  version = "3.1.3";
 
   wxWidgets_src = fetchFromGitHub {
-    owner = "audacity";
+    owner = pname;
     repo = "wxWidgets";
-    rev = "07e7d832c7a337aedba3537b90b2c98c4d8e2985";
-    sha256 = "1mawnkcrmqj98jp0jxlnh9xkc950ca033ccb51c7035pzmi9if9a";
+    rev = "v${version}-${pname}";
+    sha256 = "sha256-KrmYYv23DHBYKIuxMYBioCQ2e4KWdgmuREnimtm0XNU=";
     fetchSubmodules = true;
   };
 
@@ -74,41 +83,20 @@ let
   wxmac' = wxmac.overrideAttrs (oldAttrs: rec {
     src = wxWidgets_src;
   });
-
-in
-stdenv.mkDerivation rec {
-  pname = "audacity";
-  # nixpkgs-update: no auto update
-  # Humans too! Let's wait to see how the situation with
-  # https://github.com/audacity/audacity/issues/1213 develops before
-  # pulling any updates that are subject to this privacy policy. We
-  # may wish to switch to a fork, but at the time of writing
-  # (2021-07-05) it's too early to tell how well any of the forks will
-  # be maintained.
-  version = "3.0.2";
+in stdenv.mkDerivation rec {
+  inherit pname version;
 
   src = fetchFromGitHub {
-    owner = "audacity";
-    repo = "audacity";
+    owner = pname;
+    repo = pname;
     rev = "Audacity-${version}";
-    sha256 = "035qq2ff16cdl2cb9iply2bfjmhfl1dpscg79x6c9l0i9m8k41zj";
+    sha256 = "sha256-sdI4paxIHDZgoWTCekjrkFR4JFpQC6OatcnJdVXCCZk=";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/audacity/audacity/commit/7f8135e112a0e1e8e906abab9339680d1e491441.patch";
-      sha256 = "0zp2iydd46analda9cfnbmzdkjphz5m7dynrdj5qdnmq6j3px9fw";
-      name = "audacity_xdg_paths.patch";
-    })
-    # This is required to make audacity work with nixpkgs’ sqlite
-    # https://github.com/audacity/audacity/pull/1802 rebased onto 3.0.2
-    ./0001-Use-a-different-approach-to-estimate-the-disk-space-.patch
-  ];
-
   postPatch = ''
-    touch src/RevisionIdent.h
+    mkdir src/private
   '' + lib.optionalString stdenv.isLinux ''
-    substituteInPlace src/FileNames.cpp \
+    substituteInPlace libraries/lib-files/FileNames.cpp \
       --replace /usr/include/linux/magic.h ${linuxHeaders}/include/linux/magic.h
   '';
 
@@ -119,6 +107,7 @@ stdenv.mkDerivation rec {
     python3
   ] ++ optionals stdenv.isLinux [
     linuxHeaders
+    makeWrapper
   ];
 
   buildInputs = [
@@ -126,15 +115,18 @@ stdenv.mkDerivation rec {
     ffmpeg_4
     file
     flac
+    lame
     libid3tag
     libjack2
     libmad
     libopus
+    libsbsms_2_3_0
     libsndfile
     libvorbis
     lilv
     lv2
     pcre
+    portmidi
     serd
     sord
     soundtouch
@@ -143,6 +135,7 @@ stdenv.mkDerivation rec {
     sratom
     suil
     twolame
+    portaudio
   ] ++ optionals stdenv.isLinux [
     alsa-lib # for portaudio
     at-spi2-core
@@ -154,6 +147,7 @@ stdenv.mkDerivation rec {
     libxkbcommon
     libselinux
     libsepol
+    libuuid
     util-linux
     wxGTK'
     wxGTK'.gtk
@@ -163,20 +157,49 @@ stdenv.mkDerivation rec {
     Cocoa
     CoreAudioKit
     AudioUnit AudioToolbox CoreAudio CoreServices Carbon # for portaudio
+    libpng
+    libjpeg
   ];
 
   cmakeFlags = [
-    "-Daudacity_use_ffmpeg=linked"
+    "-DAUDACITY_REV_LONG=nixpkgs"
+    "-DAUDACITY_REV_TIME=nixpkgs"
     "-DDISABLE_DYNAMIC_LOADING_FFMPEG=ON"
+    "-Daudacity_conan_enabled=Off"
+    "-Daudacity_use_ffmpeg=loaded"
   ];
 
   doCheck = false; # Test fails
 
+  # Replace audacity's wrapper, to:
+  # - put it in the right place, it shouldn't be in "$out/audacity"
+  # - Add the ffmpeg dynamic dependency
+  postInstall = lib.optionalString stdenv.isLinux ''
+    rm "$out/audacity"
+    wrapProgram "$out/bin/audacity" \
+      --prefix LD_LIBRARY_PATH : "$out/lib/audacity":${lib.makeLibraryPath [ ffmpeg_4 ]} \
+      --suffix AUDACITY_MODULES_PATH : "$out/lib/audacity/modules" \
+      --suffix AUDACITY_PATH : "$out/share/audacity"
+  '';
+
   meta = with lib; {
     description = "Sound editor with graphical UI";
-    homepage = "https://www.audacityteam.org/";
-    license = licenses.gpl2Plus;
+    homepage = "https://www.audacityteam.org";
+    changelog = "https://github.com/audacity/audacity/releases";
+    license = with licenses; [
+      gpl2Plus
+      # Must be GPL3 when building with "technologies that require it,
+      # such as the VST3 audio plugin interface".
+      # https://github.com/audacity/audacity/discussions/2142.
+      gpl3
+      # Documentation.
+      cc-by-30
+    ];
     maintainers = with maintainers; [ lheckemann veprbl ];
     platforms = platforms.unix;
+    # darwin-aarch due to qtbase broken for it.
+    # darwin-x86_64 due to
+    # https://logs.nix.ci/?attempt_id=5cbc4581-09b4-4148-82fe-0326411a56b3&key=nixos%2Fnixpkgs.152273.
+    broken = stdenv.isDarwin;
   };
 }
diff --git a/pkgs/applications/editors/marker/default.nix b/pkgs/applications/editors/marker/default.nix
index c6779b8fba8..93b8dabb681 100644
--- a/pkgs/applications/editors/marker/default.nix
+++ b/pkgs/applications/editors/marker/default.nix
@@ -1,5 +1,7 @@
-{ lib, stdenv
+{ stdenv
+, lib
 , fetchFromGitHub
+, itstool
 , meson
 , ninja
 , pkg-config
@@ -24,6 +26,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [
+    itstool
     meson
     ninja
     pkg-config
diff --git a/pkgs/applications/emulators/proton-caller/default.nix b/pkgs/applications/emulators/proton-caller/default.nix
index d10c4364232..14c5b7be731 100644
--- a/pkgs/applications/emulators/proton-caller/default.nix
+++ b/pkgs/applications/emulators/proton-caller/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "proton-caller";
-  version = "2.3.2";
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     owner = "caverym";
     repo = pname;
     rev = version;
-    sha256 = "sha256-k+cH86atuVoLCQ+I1zu08f4T+y0u8vnjo3VA+Otg+a4=";
+    sha256 = "sha256-eyHFKAGx8du4osoGDsMFzVE/TC/ZMPsx6mrWUPDCLJ4=";
   };
 
-  cargoSha256 = "sha256-rkgg96IdIhVXZ5y/ECUxNPyPV9Nv5XGAtlxAkILry2s=";
+  cargoSha256 = "sha256-/4+r5rvRUqQL8EVIg/22ZytXyE4+SV4UEcXiEw4795U=";
 
   meta = with lib; {
     description = "Run Windows programs with Proton";
diff --git a/pkgs/applications/emulators/ryujinx/default.nix b/pkgs/applications/emulators/ryujinx/default.nix
index 7a4f4351dc9..1c731718887 100644
--- a/pkgs/applications/emulators/ryujinx/default.nix
+++ b/pkgs/applications/emulators/ryujinx/default.nix
@@ -17,13 +17,13 @@
 
 buildDotnetModule rec {
   pname = "ryujinx";
-  version = "1.1.77"; # Based off of the official github actions builds: https://github.com/Ryujinx/Ryujinx/actions/workflows/release.yml
+  version = "1.1.91"; # Based off of the official github actions builds: https://github.com/Ryujinx/Ryujinx/actions/workflows/release.yml
 
   src = fetchFromGitHub {
     owner = "Ryujinx";
     repo = "Ryujinx";
-    rev = "df70442c46e7ee133b1fb79dc23ddd134e618085";
-    sha256 = "1m9msp7kxsj7251l2yjcfzrb4k1lisk9sip7acm22pxmi1a7gw73";
+    rev = "3f4fb8f73a6635dbdca9dd11738c3a793f53ac65";
+    sha256 = "1amky7a2rikl5sg8y0y6il0jjqwhjgxw0d2ivynfhmhz2v2ciwwi";
   };
 
   dotnet-sdk = dotnetCorePackages.sdk_6_0;
@@ -63,6 +63,10 @@ buildDotnetModule rec {
   ];
 
   preInstall = ''
+    # workaround for https://github.com/Ryujinx/Ryujinx/issues/2349
+    mkdir -p $out/lib/sndio-6
+    ln -s ${sndio}/lib/libsndio.so $out/lib/sndio-6/libsndio.so.6
+
     # Ryujinx tries to use ffmpeg from PATH
     makeWrapperArgs+=(
       --suffix PATH : ${lib.makeBinPath [ ffmpeg ]}
diff --git a/pkgs/applications/emulators/ryujinx/deps.nix b/pkgs/applications/emulators/ryujinx/deps.nix
index 33f55f8cb6e..f8cdee576e9 100644
--- a/pkgs/applications/emulators/ryujinx/deps.nix
+++ b/pkgs/applications/emulators/ryujinx/deps.nix
@@ -23,9 +23,8 @@
   (fetchNuGet { pname = "Microsoft.IdentityModel.Logging"; version = "6.15.0"; sha256 = "0jn9a20a2zixnkm3bmpmvmiv7mk0hqdlnpi0qgjkg1nir87czm19"; })
   (fetchNuGet { pname = "Microsoft.IdentityModel.Tokens"; version = "6.15.0"; sha256 = "1nbgydr45f7lp980xyrkzpyaw2mkkishjwp3slgxk7f0mz6q8i1v"; })
   (fetchNuGet { pname = "Microsoft.NET.Test.Sdk"; version = "16.8.0"; sha256 = "1ln2mva7j2mpsj9rdhpk8vhm3pgd8wn563xqdcwd38avnhp74rm9"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.linux-x64"; version = "6.0.3"; sha256 = "1py3nrfvllqlnb9mhs0qwgy7c14n33b2hfb0qc49rx22sqv8ylbp"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.win-x64"; version = "6.0.3"; sha256 = "1y428glba68s76icjzfl1v3p61pcz7rd78wybhabs8zq8w9cp2pj"; })
   (fetchNuGet { pname = "Microsoft.NETCore.App.Host.osx-x64"; version = "6.0.3"; sha256 = "0k9gc94cvn36p0v3pj296asg2sq9a8ah6lfw0xvvmd4hq2k72s79"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.win-x64"; version = "6.0.3"; sha256 = "1y428glba68s76icjzfl1v3p61pcz7rd78wybhabs8zq8w9cp2pj"; })
   (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-x64"; version = "6.0.3"; sha256 = "0f04srx6q0jk81a60n956hz32fdngzp0xmdb2x7gyl77gsq8yijj"; })
   (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.osx-x64"; version = "6.0.3"; sha256 = "0180ipzzz9pc6f6l17rg5bxz1ghzbapmiqq66kdl33bmbny6vmm9"; })
   (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.win-x64"; version = "6.0.3"; sha256 = "1rjkzs2013razi2xs943q62ys1jh8blhjcnj75qkvirf859d11qw"; })
diff --git a/pkgs/applications/emulators/ryujinx/updater.sh b/pkgs/applications/emulators/ryujinx/updater.sh
index 9c2f69e606c..3f6acf5e44d 100755
--- a/pkgs/applications/emulators/ryujinx/updater.sh
+++ b/pkgs/applications/emulators/ryujinx/updater.sh
@@ -1,33 +1,60 @@
 #! /usr/bin/env nix-shell
-#! nix-shell -i bash -p coreutils gnused curl common-updater-scripts nuget-to-nix nix-prefetch-git jq dotnet-sdk_6
+#! nix-shell -I nixpkgs=./. -i bash -p coreutils gnused curl common-updater-scripts nuget-to-nix nix-prefetch-git jq dotnet-sdk_6
 set -euo pipefail
 cd "$(dirname "${BASH_SOURCE[0]}")"
 
 DEPS_FILE="$(realpath "./deps.nix")"
 
-RELEASE_JOB_DATA=$(
-    curl -s -H "Accept: application/vnd.github.v3+json" \
-        https://api.github.com/repos/Ryujinx/Ryujinx/actions/workflows |
-        jq -r '.workflows[] | select(.name == "Release job") | { id, path }'
-)
-RELEASE_JOB_ID=$(echo "$RELEASE_JOB_DATA" | jq -r '.id')
-RELEASE_JOB_FILE=$(echo "$RELEASE_JOB_DATA" | jq -r '.path')
+# provide a github token so you don't get rate limited
+# if you use gh cli you can use:
+#     `export GITHUB_TOKEN="$(cat ~/.config/gh/config.yml | yq '.hosts."github.com".oauth_token' -r)"`
+# or just set your token by hand:
+#     `read -s -p "Enter your token: " GITHUB_TOKEN; export GITHUB_TOKEN`
+#     (we use read so it doesn't show in our shell history and in secret mode so the token you paste isn't visible)
+if [ -z "${GITHUB_TOKEN:-}" ]; then
+    echo "no GITHUB_TOKEN provided - you could meet API request limiting" >&2
+fi
 
-BASE_VERSION=$(
-    curl -s "https://raw.githubusercontent.com/Ryujinx/Ryujinx/master/${RELEASE_JOB_FILE}" |
-        grep -Po 'RYUJINX_BASE_VERSION:.*?".*"' |
-        sed 's/RYUJINX_BASE_VERSION: "\(.*\)"/\1/'
-)
+# or provide the new version manually
+# manually modify and uncomment or export these env vars in your shell so they're accessable within the script
+# make sure you don't commit your changes here
+#
+# NEW_VERSION=""
+# COMMIT=""
 
-LATEST_RELEASE_JOB_DATA=$(
-    curl -s -H "Accept: application/vnd.github.v3+json" \
-        "https://api.github.com/repos/Ryujinx/Ryujinx/actions/workflows/${RELEASE_JOB_ID}/runs" |
-        jq -r '.workflow_runs[0] | { head_sha, run_number }'
-)
-COMMIT=$(echo "$LATEST_RELEASE_JOB_DATA" | jq -r '.head_sha')
-PATCH_VERSION=$(echo "$LATEST_RELEASE_JOB_DATA" | jq -r '.run_number')
+if [ -z ${NEW_VERSION+x} ] && [ -z ${COMMIT+x} ]; then
+    RELEASE_JOB_DATA=$(
+        curl -s -H "Accept: application/vnd.github.v3+json" \
+            ${GITHUB_TOKEN:+ -H "Authorization: bearer $GITHUB_TOKEN"} \
+            https://api.github.com/repos/Ryujinx/Ryujinx/actions/workflows
+    )
+    if [ -z "$RELEASE_JOB_DATA" ] || [[ $RELEASE_JOB_DATA =~ "rate limit exceeded" ]]; then
+        echo "failed to get release job data" >&2
+        exit 1
+    fi
+    RELEASE_JOB_ID=$(echo "$RELEASE_JOB_DATA" | jq -r '.workflows[] | select(.name == "Release job") | .id')
+    RELEASE_JOB_FILE=$(echo "$RELEASE_JOB_DATA" | jq -r '.workflows[] | select(.name == "Release job") | .path')
 
-NEW_VERSION="${BASE_VERSION}.${PATCH_VERSION}"
+    LATEST_RELEASE_JOB_DATA=$(
+        curl -s -H "Accept: application/vnd.github.v3+json" \
+            ${GITHUB_TOKEN:+ -H "Authorization: bearer $GITHUB_TOKEN"} \
+            "https://api.github.com/repos/Ryujinx/Ryujinx/actions/workflows/${RELEASE_JOB_ID}/runs"
+    )
+    if [ -z "$LATEST_RELEASE_JOB_DATA" ] || [[ $LATEST_RELEASE_JOB_DATA =~ "rate limit exceeded" ]]; then
+        echo "failed to get latest release job data" >&2
+        exit 1
+    fi
+    COMMIT=$(echo "$LATEST_RELEASE_JOB_DATA" | jq -r '.workflow_runs[0] | .head_sha')
+    PATCH_VERSION=$(echo "$LATEST_RELEASE_JOB_DATA" | jq -r '.workflow_runs[0] | .run_number')
+
+    BASE_VERSION=$(
+        curl -s "https://raw.githubusercontent.com/Ryujinx/Ryujinx/master/${RELEASE_JOB_FILE}" |
+            grep -Po 'RYUJINX_BASE_VERSION:.*?".*"' |
+            sed 's/RYUJINX_BASE_VERSION: "\(.*\)"/\1/'
+    )
+
+    NEW_VERSION="${BASE_VERSION}.${PATCH_VERSION}"
+fi
 
 OLD_VERSION="$(sed -nE 's/\s*version = "(.*)".*/\1/p' ./default.nix)"
 
diff --git a/pkgs/applications/graphics/hydrus/default.nix b/pkgs/applications/graphics/hydrus/default.nix
index 1d0cf4bec7d..63174ecba98 100644
--- a/pkgs/applications/graphics/hydrus/default.nix
+++ b/pkgs/applications/graphics/hydrus/default.nix
@@ -10,14 +10,14 @@
 
 python3Packages.buildPythonPackage rec {
   pname = "hydrus";
-  version = "478";
+  version = "479";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "hydrusnetwork";
     repo = "hydrus";
     rev = "v${version}";
-    sha256 = "sha256-ZsQzKc2fOFTzI/kBS8ws2+XT9kRAn4L55n1EZgVy4Kk=";
+    sha256 = "sha256-hP+tOrtYfxAKmNCJSYWQzmd0hjxktNEjJqb42lPG9IM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/cluster/argocd-autopilot/default.nix b/pkgs/applications/networking/cluster/argocd-autopilot/default.nix
index 674db790f22..58f5dfed851 100644
--- a/pkgs/applications/networking/cluster/argocd-autopilot/default.nix
+++ b/pkgs/applications/networking/cluster/argocd-autopilot/default.nix
@@ -2,17 +2,16 @@
 
 buildGoModule rec {
   pname = "argocd-autopilot";
-  version = "0.3.0";
-  commit = "c8d17bef976649e4dc2428c14c39e30a0f846552";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "argoproj-labs";
     repo = "argocd-autopilot";
     rev = "v${version}";
-    sha256 = "sha256-tggE1T+oD/dJS9tD9xOExjhy+T1GDd0vwTerD3P2KvA=";
+    sha256 = "sha256-L8+sb0lGPuc6smOFwijRGFS+oSCxEqB5c1tG55MPlgE=";
   };
 
-  vendorSha256 = "sha256-v8UMSObE6w+ULzueEK0UFeebLqoamy/788SQLBmJZ8U=";
+  vendorSha256 = "sha256-sxPTOao3scTmiVKFyGeWPMzXQz/d0HSVmUYocNGm1vA=";
 
   proxyVendor = true;
 
@@ -24,7 +23,7 @@ buildGoModule rec {
       "-X ${package_url}.binaryName=${pname}"
       "-X ${package_url}.version=${src.rev}"
       "-X ${package_url}.buildDate=unknown"
-      "-X ${package_url}.gitCommit=${commit}"
+      "-X ${package_url}.gitCommit=${src.rev}"
       "-X ${package_url}.installationManifestURL=github.com/argoproj-labs/argocd-autopilot/manifests/base?ref=${src.rev}"
       "-X ${package_url}.installationManifestsNamespacedURL=github.com/argoproj-labs/argocd-autopilot/manifests/insecure?ref=${src.rev}"
     ];
diff --git a/pkgs/applications/networking/cluster/argocd/default.nix b/pkgs/applications/networking/cluster/argocd/default.nix
index 211c2ce211e..9ce9286e610 100644
--- a/pkgs/applications/networking/cluster/argocd/default.nix
+++ b/pkgs/applications/networking/cluster/argocd/default.nix
@@ -2,20 +2,16 @@
 
 buildGoModule rec {
   pname = "argocd";
-  version = "2.3.2";
-  tag = "v${version}";
-  # Update commit to match the tag above
-  # TODO make updadeScript
-  commit = "ecc2af9dcaa12975e654cde8cbbeaffbb315f75c";
+  version = "2.3.3";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo-cd";
-    rev = tag;
-    sha256 = "sha256-n+C4l4U3cDU+fgCnGWOYLdyjknw7n/xPEtC1i8AaU4o=";
+    rev = "v${version}";
+    sha256 = "sha256-ChgWqhkzVKhbyEA+g2flWK/WMxur7UHWXJUcLzp9RTE=";
   };
 
-  vendorSha256 = "sha256-Km+1o6yuuxJs+DNTQ/XVTUFurD5gM5ohwDc7MwJuu5s=";
+  vendorSha256 = "sha256-XrIIMnn65Y10KnVTsmw6vLE53Zra1lWNFgklmaj3gF8=";
 
   # Set target as ./cmd per release-cli
   # https://github.com/argoproj/argo-cd/blob/master/Makefile#L222
@@ -27,8 +23,8 @@ buildGoModule rec {
       "-s" "-w"
       "-X ${package_url}.version=${version}"
       "-X ${package_url}.buildDate=unknown"
-      "-X ${package_url}.gitCommit=${commit}"
-      "-X ${package_url}.gitTag=${tag}"
+      "-X ${package_url}.gitCommit=${src.rev}"
+      "-X ${package_url}.gitTag=${src.rev}"
       "-X ${package_url}.gitTreeState=clean"
     ];
 
@@ -43,7 +39,7 @@ buildGoModule rec {
 
   doInstallCheck = true;
   installCheckPhase = ''
-    $out/bin/argocd version --client | grep ${tag} > /dev/null
+    $out/bin/argocd version --client | grep ${src.rev} > /dev/null
   '';
 
   postInstall = ''
diff --git a/pkgs/applications/networking/cluster/arkade/default.nix b/pkgs/applications/networking/cluster/arkade/default.nix
index 2ee7374e81b..57a56e20c2e 100644
--- a/pkgs/applications/networking/cluster/arkade/default.nix
+++ b/pkgs/applications/networking/cluster/arkade/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "arkade";
-  version = "0.8.19";
+  version = "0.8.20";
 
   src = fetchFromGitHub {
     owner = "alexellis";
     repo = "arkade";
     rev = version;
-    sha256 = "sha256-GbuDL0JSG0r2LVcdJgQFBMNDpAl2WbhjIX0Ls9yCDYg=";
+    sha256 = "sha256-DIXvsYYckNlxFzeJqk3TYRQIAtafAfylyDc/a20kl+0=";
   };
 
   CGO_ENABLED = 0;
diff --git a/pkgs/applications/networking/cluster/istioctl/default.nix b/pkgs/applications/networking/cluster/istioctl/default.nix
index da633af2b8f..84ba5330da1 100644
--- a/pkgs/applications/networking/cluster/istioctl/default.nix
+++ b/pkgs/applications/networking/cluster/istioctl/default.nix
@@ -12,8 +12,6 @@ buildGoModule rec {
   };
   vendorSha256 = "sha256-AOcWkcw+2DcgBxvxRO/sdb339a7hmI7Oy5I4kW4oE+k=";
 
-  doCheck = false;
-
   nativeBuildInputs = [ installShellFiles ];
 
   # Bundle release metadata
diff --git a/pkgs/applications/networking/cluster/kubeseal/default.nix b/pkgs/applications/networking/cluster/kubeseal/default.nix
index b42a98405d2..72218fa2209 100644
--- a/pkgs/applications/networking/cluster/kubeseal/default.nix
+++ b/pkgs/applications/networking/cluster/kubeseal/default.nix
@@ -13,8 +13,6 @@ buildGoModule rec {
 
   vendorSha256 = null;
 
-  doCheck = false;
-
   subPackages = [ "cmd/kubeseal" ];
 
   ldflags = [ "-s" "-w" "-X main.VERSION=${version}" ];
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
index e3fa08e3df3..72bd18163e6 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@@ -24,7 +24,7 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "signal-desktop";
-  version = "5.36.0"; # Please backport all updates to the stable channel.
+  version = "5.37.0"; # Please backport all updates to the stable channel.
   # All releases have a limited lifetime and "expire" 90 days after the release.
   # When releases "expire" the application becomes unusable until an update is
   # applied. The expiration date for the current release can be extracted with:
@@ -34,7 +34,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "sha256-x1PUEDq/0B1T14mBs2FuKtcGpJHWOIvHAs8hptpzhZk=";
+    sha256 = "sha256-hnRS/7CZPk1bbBjpHLAywKVu2u7jgg3p5/pxEdkzMJ8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/nextdns/default.nix b/pkgs/applications/networking/nextdns/default.nix
index d2c24d9c7a3..d3d6d5aa806 100644
--- a/pkgs/applications/networking/nextdns/default.nix
+++ b/pkgs/applications/networking/nextdns/default.nix
@@ -13,8 +13,6 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-M2PlvUsEG3Um+NqbpHdtu9g+Gj6jSXZ9YZ7t1MwjjdI=";
 
-  doCheck = false;
-
   ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 
   meta = with lib; {
diff --git a/pkgs/applications/networking/sniffers/wireshark/default.nix b/pkgs/applications/networking/sniffers/wireshark/default.nix
index 468a06af209..0947686144e 100644
--- a/pkgs/applications/networking/sniffers/wireshark/default.nix
+++ b/pkgs/applications/networking/sniffers/wireshark/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pkg-config, pcre, perl, flex, bison, gettext, libpcap, libnl, c-ares
+{ lib, stdenv, buildPackages, fetchurl, pkg-config, pcre, perl, flex, bison, gettext, libpcap, libnl, c-ares
 , gnutls, libgcrypt, libgpg-error, geoip, openssl, lua5, python3, libcap, glib
 , libssh, nghttp2, zlib, cmake, makeWrapper, wrapGAppsHook
 , withQt ? true, qt5 ? null
@@ -29,22 +29,30 @@ in stdenv.mkDerivation {
     "-DENABLE_APPLICATION_BUNDLE=${if withQt && stdenv.isDarwin then "ON" else "OFF"}"
     # Fix `extcap` and `plugins` paths. See https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16444
     "-DCMAKE_INSTALL_LIBDIR=lib"
+    "-DLEMON_C_COMPILER=cc"
+  ] ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
+    "-DHAVE_C99_VSNPRINTF_EXITCODE=0"
+    "-DHAVE_C99_VSNPRINTF_EXITCODE__TRYRUN_OUTPUT="
   ];
 
   # Avoid referencing -dev paths because of debug assertions.
   NIX_CFLAGS_COMPILE = [ "-DQT_NO_DEBUG" ];
 
-  nativeBuildInputs = [ asciidoctor bison cmake flex makeWrapper pkg-config ]
+  nativeBuildInputs = [ asciidoctor bison cmake flex makeWrapper pkg-config python3 perl ]
     ++ optionals withQt [ qt5.wrapQtAppsHook wrapGAppsHook ];
 
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+
   buildInputs = [
-    gettext pcre perl libpcap lua5 libssh nghttp2 openssl libgcrypt
-    libgpg-error gnutls geoip c-ares python3 glib zlib
+    gettext pcre libpcap lua5 libssh nghttp2 openssl libgcrypt
+    libgpg-error gnutls geoip c-ares glib zlib
   ] ++ optionals withQt  (with qt5; [ qtbase qtmultimedia qtsvg qttools ])
     ++ optionals stdenv.isLinux  [ libcap libnl ]
     ++ optionals stdenv.isDarwin [ SystemConfiguration ApplicationServices gmp ]
     ++ optionals (withQt && stdenv.isDarwin) (with qt5; [ qtmacextras ]);
 
+  strictDeps = true;
+
   patches = [ ./wireshark-lookup-dumpcap-in-path.patch ];
 
   postPatch = ''
diff --git a/pkgs/applications/science/logic/z3/default.nix b/pkgs/applications/science/logic/z3/default.nix
index a820539eb9a..985df6a8f5f 100644
--- a/pkgs/applications/science/logic/z3/default.nix
+++ b/pkgs/applications/science/logic/z3/default.nix
@@ -18,78 +18,78 @@ assert ocamlBindings -> ocaml != null && findlib != null && zarith != null;
 
 with lib;
 
-stdenv.mkDerivation rec {
-  pname = "z3";
-  version = "4.8.14";
+let common = { version, sha256, patches ? [ ] }:
+  stdenv.mkDerivation rec {
+    pname = "z3";
+    inherit version sha256 patches;
+    src = fetchFromGitHub {
+      owner = "Z3Prover";
+      repo = pname;
+      rev = "z3-${version}";
+      sha256 = sha256;
+    };
 
-  src = fetchFromGitHub {
-    owner = "Z3Prover";
-    repo = pname;
-    rev = "z3-${version}";
-    sha256 = "jPSTVSndp/T7n+VxZ/g9Rjco00Up+9xeDIVkeLl1MTw=";
-  };
+    nativeBuildInputs = optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
+    buildInputs = [ python ]
+      ++ optional javaBindings jdk
+      ++ optionals ocamlBindings [ ocaml findlib zarith ]
+    ;
+    propagatedBuildInputs = [ python.pkgs.setuptools ];
+    enableParallelBuilding = true;
 
-  nativeBuildInputs = optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
-  buildInputs = [ python ]
-    ++ optional javaBindings jdk
-    ++ optionals ocamlBindings [ ocaml findlib zarith ]
-  ;
-  propagatedBuildInputs = [ python.pkgs.setuptools ];
-  enableParallelBuilding = true;
-
-  postPatch = optionalString ocamlBindings ''
-    export OCAMLFIND_DESTDIR=$ocaml/lib/ocaml/${ocaml.version}/site-lib
-    mkdir -p $OCAMLFIND_DESTDIR/stublibs
-  '';
-
-  configurePhase = concatStringsSep " "
-    (
-      [ "${python.interpreter} scripts/mk_make.py --prefix=$out" ]
-        ++ optional javaBindings "--java"
-        ++ optional ocamlBindings "--ml"
-        ++ optional pythonBindings "--python --pypkgdir=$out/${python.sitePackages}"
-    ) + "\n" + "cd build";
-
-  postInstall = ''
-    mkdir -p $dev $lib
-    mv $out/lib $lib/lib
-    mv $out/include $dev/include
-  '' + optionalString pythonBindings ''
-    mkdir -p $python/lib
-    mv $lib/lib/python* $python/lib/
-    ln -sf $lib/lib/libz3${stdenv.hostPlatform.extensions.sharedLibrary} $python/${python.sitePackages}/z3/lib/libz3${stdenv.hostPlatform.extensions.sharedLibrary}
-  '' + optionalString javaBindings ''
-    mkdir -p $java/share/java
-    mv com.microsoft.z3.jar $java/share/java
-    moveToOutput "lib/libz3java.${stdenv.hostPlatform.extensions.sharedLibrary}" "$java"
-  '';
-
-  outputs = [ "out" "lib" "dev" "python" ]
-    ++ optional javaBindings "java"
-    ++ optional ocamlBindings "ocaml";
-
-   passthru = {
-    updateScript = writeScript "update-z3" ''
-      #!/usr/bin/env nix-shell
-      #!nix-shell -i bash -p common-updater-scripts curl jq
-
-      set -eu -o pipefail
-
-      # Expect tags in format
-      #    [{name: "Nightly", ..., {name: "z3-vv.vv.vv", ...].
-      # Below we extract frst "z3-vv.vv" and drop "z3-" prefix.
-      newVersion="$(curl -s https://api.github.com/repos/Z3Prover/z3/releases |
-          jq 'first(.[].name|select(startswith("z3-"))|ltrimstr("z3-"))' --raw-output
-      )"
-      update-source-version ${pname} "$newVersion"
+    postPatch = optionalString ocamlBindings ''
+      export OCAMLFIND_DESTDIR=$ocaml/lib/ocaml/${ocaml.version}/site-lib
+      mkdir -p $OCAMLFIND_DESTDIR/stublibs
     '';
-   };
 
-  meta = with lib; {
-    description = "A high-performance theorem prover and SMT solver";
-    homepage = "https://github.com/Z3Prover/z3";
-    license = licenses.mit;
-    platforms = platforms.unix;
-    maintainers = with maintainers; [ thoughtpolice ttuegel ];
+    configurePhase = concatStringsSep " "
+      (
+        [ "${python.interpreter} scripts/mk_make.py --prefix=$out" ]
+          ++ optional javaBindings "--java"
+          ++ optional ocamlBindings "--ml"
+          ++ optional pythonBindings "--python --pypkgdir=$out/${python.sitePackages}"
+      ) + "\n" + "cd build";
+
+    doCheck = true;
+    checkPhase = ''
+      make test
+      ./test-z3 -a
+    '';
+
+    postInstall = ''
+      mkdir -p $dev $lib
+      mv $out/lib $lib/lib
+      mv $out/include $dev/include
+    '' + optionalString pythonBindings ''
+      mkdir -p $python/lib
+      mv $lib/lib/python* $python/lib/
+      ln -sf $lib/lib/libz3${stdenv.hostPlatform.extensions.sharedLibrary} $python/${python.sitePackages}/z3/lib/libz3${stdenv.hostPlatform.extensions.sharedLibrary}
+    '' + optionalString javaBindings ''
+      mkdir -p $java/share/java
+      mv com.microsoft.z3.jar $java/share/java
+      moveToOutput "lib/libz3java.${stdenv.hostPlatform.extensions.sharedLibrary}" "$java"
+    '';
+
+    outputs = [ "out" "lib" "dev" "python" ]
+      ++ optional javaBindings "java"
+      ++ optional ocamlBindings "ocaml";
+
+    meta = with lib; {
+      description = "A high-performance theorem prover and SMT solver";
+      homepage = "https://github.com/Z3Prover/z3";
+      license = licenses.mit;
+      platforms = platforms.unix;
+      maintainers = with maintainers; [ thoughtpolice ttuegel ];
+    };
+  };
+in
+{
+  z3_4_8 = common {
+    version = "4.8.15";
+    sha256 = "0xkwqz0y5d1lfb6kfqy8wn8n2dqalzf4c8ghmjsajc1bpdl70yc5";
+  };
+  z3_4_7 = common {
+    version = "4.7.1";
+    sha256 = "1s850r6qifwl83zzgvrb5l0jigvmymzpv18ph71hg2bcpk7kjw3d";
   };
 }
diff --git a/pkgs/applications/version-management/git-and-tools/ghorg/default.nix b/pkgs/applications/version-management/git-and-tools/ghorg/default.nix
index 543e3a7501a..87d11dd9c1e 100644
--- a/pkgs/applications/version-management/git-and-tools/ghorg/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/ghorg/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "ghorg";
-  version = "1.7.11";
+  version = "1.7.12";
 
   src = fetchFromGitHub {
     owner = "gabrie30";
     repo = "ghorg";
     rev = "v${version}";
-    sha256 = "sha256-/JecaTRmqTB1I0tqBRidlqWOvNE6U5zep5/lFi8VTCc=";
+    sha256 = "sha256-y5o4yY5M9eDKN9LtbrPR29EafN3X7J51ARCEpFtLxCo=";
   };
 
   doCheck = false;
diff --git a/pkgs/applications/version-management/subversion/default.nix b/pkgs/applications/version-management/subversion/default.nix
index 4789d654ae6..0f88a18a478 100644
--- a/pkgs/applications/version-management/subversion/default.nix
+++ b/pkgs/applications/version-management/subversion/default.nix
@@ -22,10 +22,10 @@ let
 
   common = { version, sha256, extraPatches ? [ ] }: stdenv.mkDerivation (rec {
     inherit version;
-    pname = "subversion";
+    pname = "subversion${lib.optionalString (!bdbSupport && perlBindings && pythonBindings) "-client"}";
 
     src = fetchurl {
-      url = "mirror://apache/subversion/${pname}-${version}.tar.bz2";
+      url = "mirror://apache/subversion/subversion-${version}.tar.bz2";
       inherit sha256;
     };
 
diff --git a/pkgs/applications/video/pitivi/default.nix b/pkgs/applications/video/pitivi/default.nix
index 7ae463b9873..1b97fa9b7c6 100644
--- a/pkgs/applications/video/pitivi/default.nix
+++ b/pkgs/applications/video/pitivi/default.nix
@@ -1,5 +1,6 @@
 { lib
 , fetchurl
+, fetchpatch
 , pkg-config
 , gettext
 , itstool
@@ -36,6 +37,13 @@ python3Packages.buildPythonApplication rec {
     # and saves them to the generated binary. This would make the build-time
     # dependencies part of the closure so we remove it.
     ./prevent-closure-contamination.patch
+
+    # Fix build with meson 0.61
+    # https://gitlab.gnome.org/GNOME/pitivi/-/merge_requests/414
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/pitivi/-/commit/ddf2369d1fc6fddd63f676cc905a8b8e96291a4c.patch";
+      sha256 = "MC4naGnqhrYlFBFHZaSzbOzrqaNK5/Xv5jBmCu0fLQE=";
+    })
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/video/webtorrent_desktop/default.nix b/pkgs/applications/video/webtorrent_desktop/default.nix
index b4f8af61fca..8f1353fa83e 100644
--- a/pkgs/applications/video/webtorrent_desktop/default.nix
+++ b/pkgs/applications/video/webtorrent_desktop/default.nix
@@ -1,95 +1,76 @@
+## FIXME: see ../../../servers/code-server/ for a proper yarn packaging
+##  - export ELECTRON_SKIP_BINARY_DOWNLOAD=1
+##  - jq "del(.scripts.preinstall)" node_modules/shellcheck/package.json | sponge node_modules/shellcheck/package.json
 {
-  alsa-lib, atk, cairo, cups, dbus, dpkg, expat, fetchurl, fetchzip, fontconfig, freetype,
-  gdk-pixbuf, glib, gtk3, libX11, libXScrnSaver, libXcomposite, libXcursor,
-  libXdamage, libXext, libXfixes, libXi, libXrandr, libXrender, libXtst,
-  libxcb, nspr, nss, lib, stdenv, udev, libuuid, pango, at-spi2-atk, at-spi2-core
+  lib, stdenv, buildFHSUserEnvBubblewrap, runCommand, writeScript, fetchurl, fetchzip
 }:
+let
+  pname = "webtorrent-desktop";
+  version = "0.21.0";
+in
+runCommand "${pname}-${version}" rec {
+  inherit (stdenv) shell;
+  inherit pname version;
+  src =
+    if stdenv.hostPlatform.system == "x86_64-linux" then
+      fetchzip {
+        url = "https://github.com/webtorrent/webtorrent-desktop/releases/download/v${version}/WebTorrent-v${version}-linux.zip";
+        sha256 = "13gd8isq2l10kibsc1bsc15dbgpnwa7nw4cwcamycgx6pfz9a852";
+      }
+    else
+      throw "Webtorrent is not currently supported on ${stdenv.hostPlatform.system}";
 
-  let
-    rpath = lib.makeLibraryPath ([
-    alsa-lib
-    atk
-    at-spi2-core
-    at-spi2-atk
-    cairo
-    cups
-    dbus
-    expat
-    fontconfig
-    freetype
-    gdk-pixbuf
-    glib
-    gtk3
-    pango
-    libuuid
-    libX11
-    libXScrnSaver
-    libXcomposite
-    libXcursor
-    libXdamage
-    libXext
-    libXfixes
-    libXi
-    libXrandr
-    libXrender
-    libXtst
-    libxcb
-    nspr
-    nss
-    stdenv.cc.cc
-    udev
-    ]);
-  in stdenv.mkDerivation rec {
-    pname = "webtorrent-desktop";
-    version = "0.21.0";
+  fhs = buildFHSUserEnvBubblewrap rec {
+    name = "fhsEnterWebTorrent";
+    runScript = "${src}/WebTorrent";
+    ## use the trampoline, if you need to shell into the fhsenv
+    # runScript = writeScript "trampoline" ''
+    #   #!/bin/sh
+    #   exec "$@"
+    # '';
+    targetPkgs = pkgs: with pkgs; with xorg; [
+      alsa-lib atk at-spi2-core at-spi2-atk cairo cups dbus expat
+      fontconfig freetype gdk-pixbuf glib gtk3 pango libuuid libX11
+      libXScrnSaver libXcomposite libXcursor libXdamage libXext
+      libXfixes libXi libXrandr libXrender libXtst libxcb nspr nss
+      stdenv.cc.cc udev
+    ];
+    # extraBwrapArgs = [
+    #   "--ro-bind /run/user/$(id -u)/pulse /run/user/$(id -u)/pulse"
+    # ];
+  };
 
-    src =
-      if stdenv.hostPlatform.system == "x86_64-linux" then
-        fetchzip {
-          url = "https://github.com/webtorrent/webtorrent-desktop/releases/download/v${version}/WebTorrent-v${version}-linux.zip";
-          sha256 = "13gd8isq2l10kibsc1bsc15dbgpnwa7nw4cwcamycgx6pfz9a852";
-        }
-        else
-          throw "Webtorrent is not currently supported on ${stdenv.hostPlatform.system}";
-    desktopFile = fetchurl {
-      url = "https://raw.githubusercontent.com/webtorrent/webtorrent-desktop/v${version}/static/linux/share/applications/webtorrent-desktop.desktop";
-      sha256 = "1v16dqbxqds3cqg3xkzxsa5fyd8ssddvjhy9g3i3lz90n47916ca";
-    };
-    icon256File = fetchurl {
-      url = "https://raw.githubusercontent.com/webtorrent/webtorrent-desktop/v${version}/static/linux/share/icons/hicolor/256x256/apps/webtorrent-desktop.png";
-      sha256 = "1dapxvvp7cx52zhyaby4bxm4rll9xc7x3wk8k0il4g3mc7zzn3yk";
-    };
-    icon48File = fetchurl {
-      url = "https://raw.githubusercontent.com/webtorrent/webtorrent-desktop/v${version}/static/linux/share/icons/hicolor/48x48/apps/webtorrent-desktop.png";
-      sha256 = "00y96w9shbbrdbf6xcjlahqd08154kkrxmqraik7qshiwcqpw7p4";
-    };
-    nativeBuildInputs = [ dpkg ];
-    installPhase = ''
-      mkdir -p $out/share/{applications,icons/hicolor/{48x48,256x256}/apps}
-      cp -R . $out/libexec
+  desktopFile = fetchurl {
+    url = "https://raw.githubusercontent.com/webtorrent/webtorrent-desktop/v${version}/static/linux/share/applications/webtorrent-desktop.desktop";
+    sha256 = "1v16dqbxqds3cqg3xkzxsa5fyd8ssddvjhy9g3i3lz90n47916ca";
+  };
+  icon256File = fetchurl {
+    url = "https://raw.githubusercontent.com/webtorrent/webtorrent-desktop/v${version}/static/linux/share/icons/hicolor/256x256/apps/webtorrent-desktop.png";
+    sha256 = "1dapxvvp7cx52zhyaby4bxm4rll9xc7x3wk8k0il4g3mc7zzn3yk";
+  };
+  icon48File = fetchurl {
+    url = "https://raw.githubusercontent.com/webtorrent/webtorrent-desktop/v${version}/static/linux/share/icons/hicolor/48x48/apps/webtorrent-desktop.png";
+    sha256 = "00y96w9shbbrdbf6xcjlahqd08154kkrxmqraik7qshiwcqpw7p4";
+  };
 
-      # Patch WebTorrent
-      patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-               --set-rpath ${rpath}:$out/libexec $out/libexec/WebTorrent
+  meta = with lib; {
+    description = "Streaming torrent app for Mac, Windows, and Linux";
+    homepage = "https://webtorrent.io/desktop";
+    license = licenses.mit;
+    maintainers = [ maintainers.flokli maintainers.bendlas ];
+    platforms = [
+      "x86_64-linux"
+    ];
+  };
 
-      # Symlink to bin
-      mkdir -p $out/bin
-      ln -s $out/libexec/WebTorrent $out/bin/WebTorrent
+} ''
+  mkdir -p $out/{bin,share/{applications,icons/hicolor/{48x48,256x256}/apps}}
 
-      cp $icon48File $out/share/icons/hicolor/48x48/apps/webtorrent-desktop.png
-      cp $icon256File $out/share/icons/hicolor/256x256/apps/webtorrent-desktop.png
-      ## Fix the desktop link
-      substitute $desktopFile $out/share/applications/webtorrent-desktop.desktop \
-        --replace /opt/webtorrent-desktop $out/libexec
-    '';
+  cp $fhs/bin/fhsEnterWebTorrent $out/bin/WebTorrent
 
-    meta = with lib; {
-      description = "Streaming torrent app for Mac, Windows, and Linux";
-      homepage = "https://webtorrent.io/desktop";
-      license = licenses.mit;
-      maintainers = [ maintainers.flokli ];
-      platforms = [
-        "x86_64-linux"
-      ];
-    };
-  }
+  cp $icon48File $out/share/icons/hicolor/48x48/apps/webtorrent-desktop.png
+  cp $icon256File $out/share/icons/hicolor/256x256/apps/webtorrent-desktop.png
+  ## Fix the desktop link
+  substitute $desktopFile $out/share/applications/webtorrent-desktop.desktop \
+    --replace /opt/webtorrent-desktop $out/libexec
+''
diff --git a/pkgs/applications/virtualization/x11docker/default.nix b/pkgs/applications/virtualization/x11docker/default.nix
index bad1e98296c..621514ad4c8 100644
--- a/pkgs/applications/virtualization/x11docker/default.nix
+++ b/pkgs/applications/virtualization/x11docker/default.nix
@@ -1,12 +1,12 @@
 { lib, stdenv, fetchFromGitHub, makeWrapper, nx-libs, xorg, getopt, gnugrep, gawk, ps, mount, iproute2 }:
 stdenv.mkDerivation rec {
   pname = "x11docker";
-  version = "7.1.3";
+  version = "7.1.4";
   src = fetchFromGitHub {
     owner = "mviereck";
     repo = "x11docker";
     rev = "v${version}";
-    sha256 = "sha256-eSarw5RG2ckup9pNlZtAyZAN8IPZy94RRfej9ppiLfo=";
+    sha256 = "sha256-geYn1ir8h1EAUpTWsTS7giQt5eQwIBFeemS+a940ORg=";
   };
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/applications/window-managers/berry/default.nix b/pkgs/applications/window-managers/berry/default.nix
index f6ba52013f6..5c2c7dcb5ce 100644
--- a/pkgs/applications/window-managers/berry/default.nix
+++ b/pkgs/applications/window-managers/berry/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "berry";
-  version = "0.1.10";
+  version = "0.1.11";
 
   src = fetchFromGitHub {
     owner = "JLErvin";
     repo = pname;
     rev = version;
-    hash = "sha256-6asph0QXzhmHuYcfrLcQ8RTP4QzX8m6AcCp5ImA++9M=";
+    hash = "sha256-cs1NVwaANMIteCQuGqPcEWuUbfJulhjmfWnlU8Eb2OM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/data/themes/flat-remix-gtk/default.nix b/pkgs/data/themes/flat-remix-gtk/default.nix
index ec76d48457c..177e606a0e6 100644
--- a/pkgs/data/themes/flat-remix-gtk/default.nix
+++ b/pkgs/data/themes/flat-remix-gtk/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "flat-remix-gtk";
-  version = "20220321";
+  version = "20220330";
 
   src = fetchFromGitHub {
     owner = "daniruiz";
     repo = pname;
     rev = version;
-    sha256 = "sha256-QFG/jh3tPO0eflyDQaC1PJL/SavYD/W6rYp26Rxe/2E=";
+    sha256 = "sha256-TRBjttAYpx3M/Qza6N9dJy50vQtUOJGmdLNdobnAt2Y=";
   };
 
   dontBuild = true;
diff --git a/pkgs/desktops/xfce/applications/mousepad/default.nix b/pkgs/desktops/xfce/applications/mousepad/default.nix
index 2b794aa4b8a..1da88a0104f 100644
--- a/pkgs/desktops/xfce/applications/mousepad/default.nix
+++ b/pkgs/desktops/xfce/applications/mousepad/default.nix
@@ -3,10 +3,10 @@
 mkXfceDerivation {
   category = "apps";
   pname = "mousepad";
-  version = "0.5.8";
+  version = "0.5.9";
   odd-unstable = false;
 
-  sha256 = "sha256-Q5coRO2Swo0LpB+pzi+fxrwNyhcDbQXLuQtepPlCyxY=";
+  sha256 = "sha256-xuSv2H1+/NNUAm+D8f+f5fPVR97iJ5vIDzPa3S0HLM0=";
 
   nativeBuildInputs = [ gobject-introspection ];
 
diff --git a/pkgs/development/compilers/kotlin/default.nix b/pkgs/development/compilers/kotlin/default.nix
index 82d7fe3237b..fe0bd29a1b2 100644
--- a/pkgs/development/compilers/kotlin/default.nix
+++ b/pkgs/development/compilers/kotlin/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "kotlin";
-  version = "1.6.10";
+  version = "1.6.20";
 
   src = fetchurl {
     url = "https://github.com/JetBrains/kotlin/releases/download/v${version}/kotlin-compiler-${version}.zip";
-    sha256 = "sha256-QyJnmW0Na0sXyo3g+HjkTUoJm36fFYepjtxNJ+dsIVo=";
+    hash = "sha256-2vF9scGU9CBfOvZxKTZ6abOI+BkXeWPcU6e0ssTYziI=";
   };
 
   propagatedBuildInputs = [ jre ] ;
diff --git a/pkgs/development/compilers/kotlin/native.nix b/pkgs/development/compilers/kotlin/native.nix
index 514293e5745..0c0315d8766 100644
--- a/pkgs/development/compilers/kotlin/native.nix
+++ b/pkgs/development/compilers/kotlin/native.nix
@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation rec {
   pname = "kotlin-native";
-  version = "1.6.10";
+  version = "1.6.20";
 
   src = let
     getArch = {
@@ -20,9 +20,9 @@ stdenv.mkDerivation rec {
       "https://github.com/JetBrains/kotlin/releases/download/v${version}/kotlin-native-${arch}-${version}.tar.gz";
 
     getHash = arch: {
-      "macos-aarch64" = "sha256-W+9F1YZ5ATa6KaALYQEXW4xr4UxfquuC72xoB2987iM=";
-      "macos-x86_64" = "sha256-pceORt+YJZiP67nbnUB6ny1ic/r0aTrdA2hsQi5Otp8=";
-      "linux-x86_64" = "sha256-tcZffJPcR6PYJ22wIh5BHn/yjG3Jb+MG5COLbAQ2/Ww=";
+      "macos-aarch64" = "sha256-Nb/5UrNnIOJI+5PdXX4FfhUvCChrfUTkjaMS7nN/eGg=";
+      "macos-x86_64" = "sha256-cgET1zjk14/o3EH/1t7jfCfXHwcjfAANKG+yxpQccMc=";
+      "linux-x86_64" = "sha256-qbXyvCTGqRK0mCav6Ei128y1Ok1vfZ1o0haZ+MJjmBQ=";
     }.${arch};
   in
     fetchurl {
diff --git a/pkgs/development/compilers/ocaml/4.00.1.nix b/pkgs/development/compilers/ocaml/4.00.1.nix
index 93e08740ddd..abc5ff14bf2 100644
--- a/pkgs/development/compilers/ocaml/4.00.1.nix
+++ b/pkgs/development/compilers/ocaml/4.00.1.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, ncurses, xlibsWrapper }:
+{ lib, stdenv, fetchurl, fetchpatch, ncurses, xlibsWrapper }:
 
 let
    useX11 = !stdenv.isAarch32 && !stdenv.isMips;
@@ -15,6 +15,12 @@ stdenv.mkDerivation rec {
     sha256 = "33c3f4acff51685f5bfd7c260f066645e767d4e865877bf1613c176a77799951";
   };
 
+  # Compatibility with Glibc 2.34
+  patches = [ (fetchpatch {
+    url = "https://github.com/ocaml/ocaml/commit/60b0cdaf2519d881947af4175ac4c6ff68901be3.patch";
+    sha256 = "sha256:07g9q9sjk4xsbqix7jxggfp36v15pmqw4bms80g5car0hfbszirn";
+  })];
+
   prefixKey = "-prefix ";
   configureFlags = [ "-no-tk" ] ++ optionals useX11 [ "-x11lib" xlibsWrapper ];
   buildFlags = [ "world" ] ++ optionals useNativeCompilers [ "bootstrap" "world.opt" ];
diff --git a/pkgs/development/compilers/ocaml/4.01.0.nix b/pkgs/development/compilers/ocaml/4.01.0.nix
index 6362f360f7d..c19f03c5d16 100644
--- a/pkgs/development/compilers/ocaml/4.01.0.nix
+++ b/pkgs/development/compilers/ocaml/4.01.0.nix
@@ -2,6 +2,12 @@ import ./generic.nix {
   major_version = "4";
   minor_version = "01";
   patch_version = "0";
-  patches = [ ./fix-clang-build-on-osx.diff ];
+  patches = [
+    ./fix-clang-build-on-osx.diff
+
+    # Compatibility with Glibc 2.34
+    { url = "https://github.com/ocaml/ocaml/commit/d111407bf4ff71171598d30825c8e59ed5f75fd6.patch";
+      sha256 = "sha256:08mpy7lsiwv8m5qrqc4xzyiv2hri5713gz2qs1nfz02hz1bd79mc"; }
+  ];
   sha256 = "03d7ida94s1gpr3gadf4jyhmh5rrszd5s4m4z59daaib25rvfyv7";
 }
diff --git a/pkgs/development/compilers/ocaml/4.02.nix b/pkgs/development/compilers/ocaml/4.02.nix
index 4773f9f74a5..9610b782576 100644
--- a/pkgs/development/compilers/ocaml/4.02.nix
+++ b/pkgs/development/compilers/ocaml/4.02.nix
@@ -2,6 +2,12 @@ import ./generic.nix {
   major_version = "4";
   minor_version = "02";
   patch_version = "3";
-  patches = [ ./ocamlbuild.patch ];
+  patches = [
+    ./ocamlbuild.patch
+
+    # Compatibility with Glibc 2.34
+    { url = "https://github.com/ocaml/ocaml/commit/9de2b77472aee18a94b41cff70caee27fb901225.patch";
+      sha256 = "sha256:12sw512kpwk0xf2g6j0h5vqgd8xcmgrvgyilx6fxbd6bnfv1yib9"; }
+  ];
   sha256 = "1qwwvy8nzd87hk8rd9sm667nppakiapnx4ypdwcrlnav2dz6kil3";
 }
diff --git a/pkgs/development/compilers/ocaml/4.03.nix b/pkgs/development/compilers/ocaml/4.03.nix
index 0bbe8233041..9f6c24014ea 100644
--- a/pkgs/development/compilers/ocaml/4.03.nix
+++ b/pkgs/development/compilers/ocaml/4.03.nix
@@ -3,4 +3,10 @@ import ./generic.nix {
   minor_version = "03";
   patch_version = "0";
   sha256 = "09p3iwwi55r6rbrpyp8f0wmkb0ppcgw67yxw6yfky60524wayp39";
+
+  patches = [
+    # Compatibility with Glibc 2.34
+    { url = "https://github.com/ocaml/ocaml/commit/a8b2cc3b40f5269ce8525164ec2a63b35722b22b.patch";
+      sha256 = "sha256:1rrknmrk86xrj2k3hznnjk1gwnliyqh125zabg1hvy6dlvml9b0x"; }
+  ];
 }
diff --git a/pkgs/development/compilers/ocaml/4.04.nix b/pkgs/development/compilers/ocaml/4.04.nix
index 4f49bcf8072..7fa1367a512 100644
--- a/pkgs/development/compilers/ocaml/4.04.nix
+++ b/pkgs/development/compilers/ocaml/4.04.nix
@@ -6,4 +6,10 @@ import ./generic.nix {
 
   # If the executable is stipped it does not work
   dontStrip = true;
+
+  patches = [
+    # Compatibility with Glibc 2.34
+    { url = "https://github.com/ocaml/ocaml/commit/6bcff7e6ce1a43e088469278eb3a9341e6a2ca5b.patch";
+      sha256 = "sha256:1hd45f7mwwrrym2y4dbcwklpv0g94avbz7qrn81l7w8mrrj3bngi"; }
+  ];
 }
diff --git a/pkgs/development/compilers/ocaml/4.05.nix b/pkgs/development/compilers/ocaml/4.05.nix
index a63b06a9f62..60cd6c35999 100644
--- a/pkgs/development/compilers/ocaml/4.05.nix
+++ b/pkgs/development/compilers/ocaml/4.05.nix
@@ -6,4 +6,10 @@ import ./generic.nix {
 
   # If the executable is stipped it does not work
   dontStrip = true;
+
+  patches = [
+    # Compatibility with Glibc 2.34
+    { url = "https://github.com/ocaml/ocaml/commit/50c2d1275e537906ea144bd557fde31e0bf16e5f.patch";
+      sha256 = "sha256:0ck9b2dpgg5k2p9ndbgniql24h35pn1bbpxjvk69j715lswzy4mh"; }
+  ];
 }
diff --git a/pkgs/development/compilers/ocaml/4.06.nix b/pkgs/development/compilers/ocaml/4.06.nix
index b54b8a6288f..0f5e0a2d70b 100644
--- a/pkgs/development/compilers/ocaml/4.06.nix
+++ b/pkgs/development/compilers/ocaml/4.06.nix
@@ -6,4 +6,10 @@ import ./generic.nix {
 
   # If the executable is stipped it does not work
   dontStrip = true;
+
+  patches = [
+    # Compatibility with Glibc 2.34
+    { url = "https://github.com/ocaml/ocaml/commit/137a4ad167f25fe1bee792977ed89f30d19bcd74.patch";
+      sha256 = "sha256:0izsf6rm3677vbbx0snkmn9pkfcsayrdwz3ipiml5wjiaysnchjz"; }
+  ];
 }
diff --git a/pkgs/development/compilers/ocaml/4.07.nix b/pkgs/development/compilers/ocaml/4.07.nix
index c1952f30ba6..8292213bf46 100644
--- a/pkgs/development/compilers/ocaml/4.07.nix
+++ b/pkgs/development/compilers/ocaml/4.07.nix
@@ -6,4 +6,10 @@ import ./generic.nix {
 
   # If the executable is stripped it does not work
   dontStrip = true;
+
+  patches = [
+    # Compatibility with Glibc 2.34
+    { url = "https://github.com/ocaml/ocaml/commit/00b8c4d503732343d5d01761ad09650fe50ff3a0.patch";
+      sha256 = "sha256:02cfya5ff5szx0fsl5x8ax76jyrla9zmf3qxavf3adhwq5ssrfcv"; }
+  ];
 }
diff --git a/pkgs/development/compilers/ocaml/4.08.nix b/pkgs/development/compilers/ocaml/4.08.nix
index 11c22e636ef..3c4cf0a7125 100644
--- a/pkgs/development/compilers/ocaml/4.08.nix
+++ b/pkgs/development/compilers/ocaml/4.08.nix
@@ -9,4 +9,10 @@ import ./generic.nix {
 
   # Breaks build with Clang
   hardeningDisable = [ "strictoverflow" ];
+
+  patches = [
+    # Compatibility with Glibc 2.34
+    { url = "https://github.com/ocaml/ocaml/commit/17df117b4939486d3285031900587afce5262c8c.patch";
+      sha256 = "sha256:1b3jc6sj2k23yvfwrv6nc1f4x2n2biqbhbbp74aqb6iyqyjsq35n"; }
+  ];
 }
diff --git a/pkgs/development/compilers/ocaml/4.09.nix b/pkgs/development/compilers/ocaml/4.09.nix
index a093a244641..c5f649c15d6 100644
--- a/pkgs/development/compilers/ocaml/4.09.nix
+++ b/pkgs/development/compilers/ocaml/4.09.nix
@@ -6,4 +6,10 @@ import ./generic.nix {
 
   # Breaks build with Clang
   hardeningDisable = [ "strictoverflow" ];
+
+  patches = [
+    # Compatibility with Glibc 2.34
+    { url = "https://github.com/ocaml/ocaml/commit/8eed2e441222588dc385a98ae8bd6f5820eb0223.patch";
+      sha256 = "sha256:1b3jc6sj2k23yvfwrv6nc1f4x2n2biqbhbbp74aqb6iyqyjsq35n"; }
+  ];
 }
diff --git a/pkgs/development/compilers/rust/rustfmt.nix b/pkgs/development/compilers/rust/rustfmt.nix
index b3191c242fe..f8ac8bf39df 100644
--- a/pkgs/development/compilers/rust/rustfmt.nix
+++ b/pkgs/development/compilers/rust/rustfmt.nix
@@ -18,8 +18,8 @@ rustPlatform.buildRustPackage rec {
 
   # As of rustc 1.45.0, these env vars are required to build rustfmt (due to
   # https://github.com/rust-lang/rust/pull/72001)
-  CFG_RELEASE = "${rustPlatform.rust.rustc.version}-nightly";
-  CFG_RELEASE_CHANNEL = "nightly";
+  CFG_RELEASE = rustPlatform.rust.rustc.version;
+  CFG_RELEASE_CHANNEL = "stable";
 
   meta = with lib; {
     description = "A tool for formatting Rust code according to style guidelines";
diff --git a/pkgs/development/interpreters/clojure/default.nix b/pkgs/development/interpreters/clojure/default.nix
index cd63e506a55..50b2a49fdc6 100644
--- a/pkgs/development/interpreters/clojure/default.nix
+++ b/pkgs/development/interpreters/clojure/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "clojure";
-  version = "1.11.0.1100";
+  version = "1.11.1.1107";
 
   src = fetchurl {
     # https://clojure.org/releases/tools
     url = "https://download.clojure.org/install/clojure-tools-${version}.tar.gz";
-    sha256 = "sha256-9KEsO32118fvKE1Gls+9nAeRdlhTKfmJylsiSYCoKKU=";
+    sha256 = "sha256-ItSKM546QW4DpnGotGzYs6917cbHYYkPvL9XezQBzOY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libsecret/default.nix b/pkgs/development/libraries/libsecret/default.nix
index e023a524ae2..95e2c69e4c7 100644
--- a/pkgs/development/libraries/libsecret/default.nix
+++ b/pkgs/development/libraries/libsecret/default.nix
@@ -18,7 +18,6 @@
 , gjs
 , libintl
 , dbus
-, xvfb-run
 }:
 
 stdenv.mkDerivation rec {
@@ -59,16 +58,14 @@ stdenv.mkDerivation rec {
     python3
     python3.pkgs.dbus-python
     python3.pkgs.pygobject3
-    xvfb-run
     dbus
     gjs
   ];
 
-  doCheck = true;
-
+  doCheck = stdenv.isLinux;
 
   postPatch = ''
-    patchShebangs .
+    patchShebangs ./tool/test-*.sh
   '';
 
   preCheck = ''
diff --git a/pkgs/development/libraries/libuldaq/default.nix b/pkgs/development/libraries/libuldaq/default.nix
index 2f8f7fbb30e..fb234ef60d1 100644
--- a/pkgs/development/libraries/libuldaq/default.nix
+++ b/pkgs/development/libraries/libuldaq/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libuldaq";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "mccdaq";
     repo = "uldaq";
     rev = "v${version}";
-    sha256 = "0l9ima8ac99yd9vvjvdrmacm95ghv687wiy39zxm00cmghcfv3vj";
+    sha256 = "sha256-DA1mxu94z5xDpGK9OBwD02HXlOATv/slqZ4lz5GM7QM=";
   };
 
   patches = [
diff --git a/pkgs/development/node-packages/default.nix b/pkgs/development/node-packages/default.nix
index 9ecb7c5f3ef..d31da0892e4 100644
--- a/pkgs/development/node-packages/default.nix
+++ b/pkgs/development/node-packages/default.nix
@@ -343,13 +343,17 @@ let
         wrapProgram "$out/bin/postcss" \
           --prefix NODE_PATH : ${self.postcss}/lib/node_modules \
           --prefix NODE_PATH : ${self.autoprefixer}/lib/node_modules
+        ln -s '${self.postcss}/lib/node_modules/postcss' "$out/lib/node_modules/postcss"
       '';
       passthru.tests = {
         simple-execution = pkgs.callPackage ./package-tests/postcss-cli.nix {
           inherit (self) postcss-cli;
         };
       };
-      meta.mainProgram = "postcss";
+      meta = {
+        mainProgram = "postcss";
+        maintainers = with lib.maintainers; [ Luflosi ];
+      };
     };
 
     # To update prisma, please first update prisma-engines to the latest
diff --git a/pkgs/development/ocaml-modules/asn1-combinators/default.nix b/pkgs/development/ocaml-modules/asn1-combinators/default.nix
index 3c8be666b66..8447c25cd70 100644
--- a/pkgs/development/ocaml-modules/asn1-combinators/default.nix
+++ b/pkgs/development/ocaml-modules/asn1-combinators/default.nix
@@ -3,13 +3,11 @@
 }:
 
 buildDunePackage rec {
-  minimumOCamlVersion = "4.05";
+  minimalOCamlVersion = "4.08";
 
   pname = "asn1-combinators";
   version = "0.2.6";
 
-  useDune2 = true;
-
   src = fetchurl {
     url = "https://github.com/mirleft/ocaml-asn1-combinators/releases/download/v${version}/asn1-combinators-v${version}.tbz";
     sha256 = "sha256-ASreDYhp72IQY3UsHPjqAm9rxwL+0Q35r1ZojikbGpE=";
diff --git a/pkgs/development/ocaml-modules/sqlite3EZ/default.nix b/pkgs/development/ocaml-modules/sqlite3EZ/default.nix
deleted file mode 100644
index 6009eaecce1..00000000000
--- a/pkgs/development/ocaml-modules/sqlite3EZ/default.nix
+++ /dev/null
@@ -1,36 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, ocaml, findlib, ocamlbuild, twt, ocaml_sqlite3 }:
-
-assert lib.versionAtLeast (lib.getVersion ocaml) "3.12";
-
-if lib.versionAtLeast ocaml.version "4.06"
-then throw "sqlite3EZ is not available for OCaml ${ocaml.version}"
-else
-
-stdenv.mkDerivation rec {
-  pname = "ocaml-sqlite3EZ";
-  version = "0.1.0";
-
-  src = fetchFromGitHub {
-    owner = "mlin";
-    repo = "ocaml-sqlite3EZ";
-    rev = "v${version}";
-    sha256 = "sha256-pKysvth0efxJeyJQY2Dnqarg7OtsKyyLnFV/1ZhsfDY=";
-  };
-
-  nativeBuildInputs = [ ocaml findlib ocamlbuild ];
-  buildInputs = [ twt ];
-
-  propagatedBuildInputs = [ ocaml_sqlite3 ];
-
-  strictDeps = true;
-
-  createFindlibDestdir = true;
-
-  meta = with lib; {
-    homepage = "https://github.com/mlin/ocaml-sqlite3EZ";
-    description = "A thin wrapper for sqlite3-ocaml with a simplified interface";
-    license = licenses.mit;
-    maintainers = [ maintainers.vbgl ];
-    platforms = ocaml.meta.platforms or [ ];
-  };
-}
diff --git a/pkgs/development/ocaml-modules/torch/default.nix b/pkgs/development/ocaml-modules/torch/default.nix
index 7a0c6bdadef..c4c80dacc9f 100644
--- a/pkgs/development/ocaml-modules/torch/default.nix
+++ b/pkgs/development/ocaml-modules/torch/default.nix
@@ -56,5 +56,6 @@ buildDunePackage rec {
     description = "Ocaml bindings to Pytorch";
     maintainers = [ maintainers.bcdarwin ];
     license = licenses.asl20;
+    broken = lib.versionAtLeast pytorch.version "1.11";
   };
 }
diff --git a/pkgs/development/ocaml-modules/z3/default.nix b/pkgs/development/ocaml-modules/z3/default.nix
index b17f29b4353..35709b3105e 100644
--- a/pkgs/development/ocaml-modules/z3/default.nix
+++ b/pkgs/development/ocaml-modules/z3/default.nix
@@ -7,11 +7,6 @@ else
 let z3-with-ocaml = (z3.override {
   ocamlBindings = true;
   inherit ocaml findlib zarith;
-}).overrideAttrs (o: {
-  patches = (o.patches or []) ++ [
-    # Fix build; see: https://github.com/Z3Prover/z3/issues/5776
-    ./ocamlfind.patch
-  ];
 }); in
 
 stdenv.mkDerivation {
diff --git a/pkgs/development/ocaml-modules/z3/ocamlfind.patch b/pkgs/development/ocaml-modules/z3/ocamlfind.patch
deleted file mode 100644
index d84907cf793..00000000000
--- a/pkgs/development/ocaml-modules/z3/ocamlfind.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/scripts/mk_util.py b/scripts/mk_util.py
-index 042e6af46..1e105b002 100644
---- a/scripts/mk_util.py
-+++ b/scripts/mk_util.py
-@@ -1995,7 +1995,7 @@ class MLComponent(Component):
- 
-             LIBZ3 = LIBZ3 + ' ' + ' '.join(map(lambda x: '-cclib ' + x, LDFLAGS.split()))
- 
--            stubs_install_path = '$$(%s printconf path)/stublibs' % OCAMLFIND
-+            stubs_install_path = '$$(%s printconf destdir)/stublibs' % OCAMLFIND
-             if not STATIC_LIB:
-                 loadpath = '-ccopt -L' + stubs_install_path
-                 dllpath = '-dllpath ' + stubs_install_path
diff --git a/pkgs/development/python-modules/anyconfig/default.nix b/pkgs/development/python-modules/anyconfig/default.nix
index 3e0e347bbfa..17794d5c8c4 100644
--- a/pkgs/development/python-modules/anyconfig/default.nix
+++ b/pkgs/development/python-modules/anyconfig/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "anyconfig";
-  version = "0.12.0";
+  version = "0.13.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-MJHXZ1dAaG+t6FdVU38qfGzO+oZZxbtWF04C3tdLltU=";
+    sha256 = "sha256-A/8uF2KvOI+7vtHBq3+fHsAGqR2n2zpouWPabneV0qw=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/aplpy/default.nix b/pkgs/development/python-modules/aplpy/default.nix
index 682ef6e17fd..7461c502a31 100644
--- a/pkgs/development/python-modules/aplpy/default.nix
+++ b/pkgs/development/python-modules/aplpy/default.nix
@@ -11,6 +11,7 @@
 , pyregion
 , pillow
 , scikitimage
+, cython
 , shapely
 , pytest
 , pytest-astropy
@@ -18,39 +19,18 @@
 
 buildPythonPackage rec {
   pname = "aplpy";
-  version = "2.0.3";
+  version = "2.1.0";
   format = "pyproject";
 
   src = fetchPypi {
-    pname = "APLpy";
+    pname = "aplpy";
     inherit version;
-    sha256 = "239f3d83635ca4251536aeb577df7c60df77fc4d658097b92094719739aec3f3";
+    sha256 = "sha256-KCdmBwQWt7IfHsjq7pWlbSISEpfQZDyt+SQSTDaUCV4=";
   };
 
-  patches = [
-    # Fixes compatibility with astropy-helpers. This patch has been merged into
-    # the master branch as of May 2020, and should be part of the next
-    # upstream release (v2.0.3 was tagged in Feb. 2019).
-    (fetchpatch {
-      url = "https://github.com/aplpy/aplpy/pull/448.patch";
-      sha256 = "1pnzh7ykjc8hwahzbzyryrzv5a8fddgd1bmzbhagkrn6lmvhhpvq";
-      excludes = [ "tox.ini" "azure-pipelines.yml" ".circleci/config.yml" "MANIFEST.in" ".gitignore"
-       "setup.cfg" "appveyor.yml" "readthedocs.yml" "CHANGES.rst" ".gitmodules" ".travis.yml" "astropy_helpers" ];
-    })
-    # Fix for matplotlib >= 3.4 (https://github.com/aplpy/aplpy/pull/466)
-    # Note: because of a security thing, github will refuse to serve this patch from the
-    # "normal" location
-    # (https://github.com/aplpy/aplpy/commit/56c1cc694fdea69e7da8506d3212c4495adb0ca5.patch)
-    # due to the fact that it contains the PDF magic bytes, but it will serve it from
-    # this githubusercontent domain.
-    (fetchpatch {
-      url = "https://patch-diff.githubusercontent.com/raw/aplpy/aplpy/pull/466/commit/56c1cc694fdea69e7da8506d3212c4495adb0ca5.patch";
-      sha256 = "0jna2n1cgfzr0a27m5z94wwph7qg25hs7lycrdb2dp3943rb35g4";
-    })
-  ];
-
   propagatedBuildInputs = [
     numpy
+    cython
     astropy
     matplotlib
     reproject
diff --git a/pkgs/development/python-modules/azure-identity/default.nix b/pkgs/development/python-modules/azure-identity/default.nix
index 44660e56f42..c4897fb306f 100644
--- a/pkgs/development/python-modules/azure-identity/default.nix
+++ b/pkgs/development/python-modules/azure-identity/default.nix
@@ -16,12 +16,12 @@
 
 buildPythonPackage rec {
   pname = "azure-identity";
-  version = "1.8.0";
+  version = "1.9.0";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "sha256-Ag/w5HFXhS5KrIo62waEGCcUfyepTL50qQRCXY5i2Tw=";
+    sha256 = "sha256-CFTRnaTFZEZBgU3E+VHELgFAC1eS8J37a/+nJti5Fg0=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/databricks-connect/default.nix b/pkgs/development/python-modules/databricks-connect/default.nix
index d242c59acdb..5442ba7e8cf 100644
--- a/pkgs/development/python-modules/databricks-connect/default.nix
+++ b/pkgs/development/python-modules/databricks-connect/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "databricks-connect";
-  version = "9.1.10";
+  version = "9.1.12";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-OR3TXO6IzqwqbBbfFf+FGIUbwTa0DoKry84e1hL0I3Q=";
+    sha256 = "sha256-o3r2qZbSAAzyxfPdf9JNDhd/WKRhDdJFfnjCI8eTEE0=";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/development/python-modules/doc8/default.nix b/pkgs/development/python-modules/doc8/default.nix
index 61c4ca6890a..c02100e379e 100644
--- a/pkgs/development/python-modules/doc8/default.nix
+++ b/pkgs/development/python-modules/doc8/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "doc8";
-  version = "0.10.1";
+  version = "0.11.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "376e50f4e70a1ae935416ddfcf93db35dd5d4cc0e557f2ec72f0667d0ace4548";
+    sha256 = "sha256-bby1Ry79Mydj/7KGK0/e7EDIpv3Gu2fmhxOtdJylgIw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-bigtable/default.nix b/pkgs/development/python-modules/google-cloud-bigtable/default.nix
index 9763cd4e0ba..d6cc1f35e61 100644
--- a/pkgs/development/python-modules/google-cloud-bigtable/default.nix
+++ b/pkgs/development/python-modules/google-cloud-bigtable/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-bigtable";
-  version = "2.7.1";
+  version = "2.8.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-TUMgrv1JNt8h6DzCNtk0Fm4LQFC73/FNfpgTs9jhkYs=";
+    hash = "sha256-FLnEEsbTie1Z/9Y8nLzvLFbxiexUL4GFa8jCcEAYK1s=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/hatchling/default.nix b/pkgs/development/python-modules/hatchling/default.nix
index 09cbdead671..045bbafd636 100644
--- a/pkgs/development/python-modules/hatchling/default.nix
+++ b/pkgs/development/python-modules/hatchling/default.nix
@@ -21,7 +21,7 @@
 
 let
   pname = "hatchling";
-  version = "0.20.1";
+  version = "0.22.0";
 in
 buildPythonPackage {
   inherit pname version;
@@ -29,7 +29,7 @@ buildPythonPackage {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-l1VRce5H3CSAwZBeuxRyy7bNpOM6zX5s2L1/DXPo/Bg=";
+    hash = "sha256-BUJ24F4oON/9dWpnnDNM5nIOuh3yuwlvDnLA9uQAIXo=";
   };
 
   # listed in backend/src/hatchling/ouroboros.py
diff --git a/pkgs/development/python-modules/hg-git/default.nix b/pkgs/development/python-modules/hg-git/default.nix
index be3edd37218..6ccde29313b 100644
--- a/pkgs/development/python-modules/hg-git/default.nix
+++ b/pkgs/development/python-modules/hg-git/default.nix
@@ -3,24 +3,34 @@
 , fetchPypi
 , dulwich
 , mercurial
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "hg-git";
-  version = "0.10.4";
+  version = "1.0.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-guJlIm9HPTgKw5cg/s7rFST/crAXfPxGYGeZxEJ+hcw=";
+    hash = "sha256-ORGDOWLrnImca+qPtJZmyC8hGxJNCEC+tq2V4jpGIbY=";
   };
 
-  propagatedBuildInputs = [ dulwich mercurial ];
+  propagatedBuildInputs = [
+    dulwich
+    mercurial
+  ];
+
+  pythonImportsCheck = [
+    "hggit"
+  ];
 
   meta = with lib; {
     description = "Push and pull from a Git server using Mercurial";
     homepage = "https://hg-git.github.io/";
-    maintainers = with maintainers; [ koral ];
     license = licenses.gpl2Only;
+    maintainers = with maintainers; [ koral ];
   };
-
 }
diff --git a/pkgs/development/python-modules/inquirer/default.nix b/pkgs/development/python-modules/inquirer/default.nix
index dd2db106ace..0fb7a245121 100644
--- a/pkgs/development/python-modules/inquirer/default.nix
+++ b/pkgs/development/python-modules/inquirer/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "inquirer";
-  version = "2.9.1";
+  version = "2.9.2";
   format = "pyproject";
 
   src = fetchFromGitHub rec {
     owner = "magmax";
     repo = "python-inquirer";
     rev = "v${version}";
-    sha256 = "sha256:0vdly2k4i7bfcqc8zh2miv9dbpmqvayxk72qn9d4hr7z15wph233";
+    sha256 = "sha256-TQEZeZDl4N78dE7CXy5OwquUoHuxxjmDAC3wdxqydaQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/jupytext/default.nix b/pkgs/development/python-modules/jupytext/default.nix
index 6e0668de147..a7a7d48c9d1 100644
--- a/pkgs/development/python-modules/jupytext/default.nix
+++ b/pkgs/development/python-modules/jupytext/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "jupytext";
-  version = "1.13.7";
+  version = "1.13.8";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -26,8 +26,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "mwouts";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-DWK5ZoPL6Ek3dXHOlZfecQKLNwBqDjMZ77XZ7YLCXKI=";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-ebe5sQJxA8QE6eJp6vPUyMaEvZUPqzCmQ6damzo1BVo=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/karton-core/default.nix b/pkgs/development/python-modules/karton-core/default.nix
index 07f317a8aba..562d8880692 100644
--- a/pkgs/development/python-modules/karton-core/default.nix
+++ b/pkgs/development/python-modules/karton-core/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "karton-core";
-  version = "4.3.0";
+  version = "4.4.0";
 
   src = fetchFromGitHub {
     owner = "CERT-Polska";
     repo = "karton";
-    rev = "v${version}";
-    sha256 = "sha256-pIYDY+pie4xqH11UHBal7/+MVmJDgNCFVpSD9we9ZPA=";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-TwTq44l/Nx+FQ6tFZHat4SPGOmHSwYfg7ShbGnxpkVw=";
   };
 
   propagatedBuildInputs = [ minio redis ];
diff --git a/pkgs/development/python-modules/lektor/default.nix b/pkgs/development/python-modules/lektor/default.nix
index 918cbd2591c..020506d5191 100644
--- a/pkgs/development/python-modules/lektor/default.nix
+++ b/pkgs/development/python-modules/lektor/default.nix
@@ -1,58 +1,84 @@
 { lib
-, buildPythonPackage
-, fetchFromGitHub
-, click
-, filetype
-, watchdog
-, exifread
-, requests
-, mistune
-, inifile
 , Babel
-, jinja2
+, buildPythonPackage
+, click
+, exifread
+, fetchFromGitHub
+, filetype
 , flask
+, inifile
+, jinja2
+, marshmallow
+, marshmallow-dataclass
+, mistune
+, pip
 , pyopenssl
-, ndg-httpsclient
-, pytestCheckHook
-, pytest-cov
+, pytest-click
 , pytest-mock
 , pytest-pylint
-, pytest-click
+, pytestCheckHook
+, pythonOlder
 , python-slugify
-, isPy27
-, functools32
+, requests
 , setuptools
+, watchdog
+, werkzeug
 }:
 
 buildPythonPackage rec {
   pname = "lektor";
-  version = "3.3.2";
+  version = "3.3.3";
   format = "pyproject";
 
+  disabled = pythonOlder "3.7";
+
   src = fetchFromGitHub {
     owner = "lektor";
-    repo = "lektor";
-    rev = "v${version}";
-    sha256 = "sha256-PNHQ87aO+b1xseupIOsO7MXdr16s0gjoHGnZhPlKKRY=";
+    repo = pname;
+    rev = "refs/tags/v${version}";
+    hash = "sha256-3jPN4VQdIUVjSSGJxPek2RrnXzCwkDxoEBqk4vuL+nc=";
   };
 
   propagatedBuildInputs = [
-    click filetype watchdog exifread requests mistune inifile Babel jinja2
-    flask pyopenssl python-slugify ndg-httpsclient setuptools
-  ] ++ lib.optionals isPy27 [ functools32 ];
-
-  checkInputs = [
-    pytestCheckHook pytest-cov pytest-mock pytest-pylint pytest-click
+    Babel
+    click
+    exifread
+    filetype
+    flask
+    inifile
+    jinja2
+    marshmallow
+    marshmallow-dataclass
+    mistune
+    pip
+    pyopenssl
+    python-slugify
+    requests
+    setuptools
+    watchdog
+    werkzeug
   ];
 
-  # many errors -- tests assume inside of git repo, linting errors 13/317 fail
-  doCheck = false;
+  checkInputs = [
+    pytest-click
+    pytest-mock
+    pytest-pylint
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "lektor"
+  ];
+
+  disabledTests = [
+    # Test requires network access
+    "test_path_installed_plugin_is_none"
+  ];
 
   meta = with lib; {
     description = "A static content management system";
-    homepage    = "https://www.getlektor.com/";
-    license     = licenses.bsd0;
+    homepage = "https://www.getlektor.com/";
+    license = licenses.bsd0;
     maintainers = with maintainers; [ costrouc ];
   };
-
 }
diff --git a/pkgs/development/python-modules/mergedb/default.nix b/pkgs/development/python-modules/mergedb/default.nix
new file mode 100644
index 00000000000..b31d4ddf192
--- /dev/null
+++ b/pkgs/development/python-modules/mergedb/default.nix
@@ -0,0 +1,51 @@
+{ lib
+, buildPythonPackage
+, colorama
+, fetchPypi
+, jinja2
+, pytestCheckHook
+, pythonOlder
+, pyyaml
+, setuptools
+, setuptools-scm
+}:
+
+buildPythonPackage rec {
+  pname = "mergedb";
+  version = "0.1.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "2034c18dca23456c5b166b63d94300bcd8ec9f386e6cd639c2f66e141c0313f9";
+  };
+
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    pyyaml
+    colorama
+    jinja2
+    setuptools
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "mergedb"
+  ];
+
+  meta = with lib; {
+    description = "A tool/library for deep merging YAML files";
+    homepage = "https://github.com/graysonhead/mergedb";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ graysonhead ];
+  };
+}
+
diff --git a/pkgs/development/python-modules/nats-py/default.nix b/pkgs/development/python-modules/nats-py/default.nix
index f87eb269da7..3cc92514bd6 100644
--- a/pkgs/development/python-modules/nats-py/default.nix
+++ b/pkgs/development/python-modules/nats-py/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "nats-py";
-  version = "2.0.0";
+  version = "2.1.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,8 +18,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "nats-io";
     repo = "nats.py";
-    rev = "v${version}";
-    hash = "sha256-BraT30J7OIcW2NXAwjcg9PYu+kgf8f1iDjKiN9J6l7Y=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-OwxTcjHB1YLijEtTA+QFjEmihqXsiitIcCtdl/3uipI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/oslo-log/default.nix b/pkgs/development/python-modules/oslo-log/default.nix
index a2e6eac8e38..c2b11dd3167 100644
--- a/pkgs/development/python-modules/oslo-log/default.nix
+++ b/pkgs/development/python-modules/oslo-log/default.nix
@@ -11,16 +11,20 @@
 , pyinotify
 , python-dateutil
 , pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "oslo-log";
-  version = "4.6.1";
+  version = "4.7.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     pname = "oslo.log";
     inherit version;
-    sha256 = "0dlnxjci9mpwhgfv19fy1z7xrdp8m95skrj5dr60all3pr7n22f6";
+    hash = "sha256-ycLEyW098LLuuTG0djvbCpBbqvKbiVgW2Vd41p+hJwc=";
   };
 
   propagatedBuildInputs = [
@@ -44,7 +48,9 @@ buildPythonPackage rec {
     "test_logging_handle_error"
   ];
 
-  pythonImportsCheck = [ "oslo_log" ];
+  pythonImportsCheck = [
+    "oslo_log"
+  ];
 
   meta = with lib; {
     description = "oslo.log library";
diff --git a/pkgs/development/python-modules/pex/default.nix b/pkgs/development/python-modules/pex/default.nix
index 4d6085e6deb..305f47a17f0 100644
--- a/pkgs/development/python-modules/pex/default.nix
+++ b/pkgs/development/python-modules/pex/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "pex";
-  version = "2.1.76";
+  version = "2.1.77";
   format = "flit";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-a/e0tz67QR7SSYQRt3tJqgCGJLn6oi0+3HMpg8NKRH8=";
+    hash = "sha256-lvzRb+m3a3DmimzVIroobJaNe2PuMoadb48YwhxCVvA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pyhaversion/default.nix b/pkgs/development/python-modules/pyhaversion/default.nix
index 6028f19bdab..ff59ccd9c9c 100644
--- a/pkgs/development/python-modules/pyhaversion/default.nix
+++ b/pkgs/development/python-modules/pyhaversion/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pyhaversion";
-  version = "22.02.0";
+  version = "22.04.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -19,8 +19,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "ludeeus";
     repo = pname;
-    rev = version;
-    sha256 = "sha256-7cBUsTEZ9yVlWsUdKs4YWm647baN09AQJI+7CTORhLc=";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-ItemkSm85Sq3utEG28mvfS7gq95veeYwhHG6BpOUJJY=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyisy/default.nix b/pkgs/development/python-modules/pyisy/default.nix
index 5daadce41f4..40371467100 100644
--- a/pkgs/development/python-modules/pyisy/default.nix
+++ b/pkgs/development/python-modules/pyisy/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "pyisy";
-  version = "3.0.5";
+  version = "3.0.6";
 
   src = fetchFromGitHub {
     owner = "automicus";
     repo = "PyISY";
-    rev = "v${version}";
-    hash = "sha256-lVutG/xJvVP0qS0UnEyS/9KwwqdRX6ownTKek8/VXbU=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-4thCP9Xc3dtL6IaP863sW/L4aj4+QIPFv6p0kFLGh7E=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pynetgear/default.nix b/pkgs/development/python-modules/pynetgear/default.nix
index 1e93ebdc486..1eabc9daaee 100644
--- a/pkgs/development/python-modules/pynetgear/default.nix
+++ b/pkgs/development/python-modules/pynetgear/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "pynetgear";
-  version = "0.9.3";
+  version = "0.9.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -15,8 +15,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "MatMaul";
     repo = pname;
-    rev = version;
-    sha256 = "sha256-zydSx2OZowf+1KZ5ZJ/1FDVqDZQZ4U0+q62eB1+s+WY=";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-/oxwUukYq/a0WeO/XhkMW3Jj7I1icZZUDwh1mdbGi08=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyplaato/default.nix b/pkgs/development/python-modules/pyplaato/default.nix
index d4e91a985ef..46168b87116 100644
--- a/pkgs/development/python-modules/pyplaato/default.nix
+++ b/pkgs/development/python-modules/pyplaato/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "pyplaato";
-  version = "0.0.15";
+  version = "0.0.16";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1nykbkv2fg1x5min07cbi44x6am48f5gw3mnyj7x2kpmj6sqfpqp";
+    sha256 = "sha256-0hbdwgkQhcjD9YbpG+bczAAi9u1QfrJdMn1g14EBPac=";
   };
 
   propagatedBuildInputs = [ aiohttp python-dateutil ];
diff --git a/pkgs/development/python-modules/pyscss/default.nix b/pkgs/development/python-modules/pyscss/default.nix
index bbf4ee712c6..3b91236a6cc 100644
--- a/pkgs/development/python-modules/pyscss/default.nix
+++ b/pkgs/development/python-modules/pyscss/default.nix
@@ -11,13 +11,13 @@
 
 buildPythonPackage rec {
   pname = "pyScss";
-  version = "1.3.7";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     repo = "pyScss";
     owner = "Kronuz";
-    rev = version;
-    sha256 = "0701hziiiw67blafgpmjhzspmrss8mfvif7fw0rs8fikddwwc9g6";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-z0y4z+/JE6rZWHAvps/taDZvutyVhxxs2gMujV5rNu4=";
   };
 
   checkInputs = [ pytest ];
diff --git a/pkgs/development/python-modules/pysimplegui/default.nix b/pkgs/development/python-modules/pysimplegui/default.nix
index d645a068d29..31e40fcb12d 100644
--- a/pkgs/development/python-modules/pysimplegui/default.nix
+++ b/pkgs/development/python-modules/pysimplegui/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "pysimplegui";
-  version = "4.57.0";
+  version = "4.59.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -15,7 +15,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "PySimpleGUI";
     inherit version;
-    sha256 = "sha256-+Dcrv+esnthI74AFLK47sS2qI4sPvihuQlL54Zo32RM=";
+    sha256 = "sha256-GW6BwKQ36sSJNZXy7mlRW5hB5gjTUb08V33XqRNFT1E=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/python-kasa/default.nix b/pkgs/development/python-modules/python-kasa/default.nix
index 6adfbf5745d..46ee0ad00fb 100644
--- a/pkgs/development/python-modules/python-kasa/default.nix
+++ b/pkgs/development/python-modules/python-kasa/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "python-kasa";
-  version = "0.4.2";
+  version = "0.4.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -21,8 +21,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
-    rev = version;
-    sha256 = "sha256-5Ohks3yfqAAe+CiLEucibezmibl6TtktDXMHAhecXzA=";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-r1PoOxFPA4zYFEpw+BakzDAJ13IMfcZpTJWkRt/q4go=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/rdflib/default.nix b/pkgs/development/python-modules/rdflib/default.nix
index 73f170b90b1..1a587d8d61a 100644
--- a/pkgs/development/python-modules/rdflib/default.nix
+++ b/pkgs/development/python-modules/rdflib/default.nix
@@ -2,16 +2,23 @@
 , stdenv
 , buildPythonPackage
 , fetchFromGitHub
-, html5lib
-, isodate
-, networkx
-, nose
-, pyparsing
-, tabulate
-, pandas
-, pytestCheckHook
 , pythonOlder
-, SPARQLWrapper
+
+# propagates
+, isodate
+, pyparsing
+
+# propagates <3.8
+, importlib-metadata
+
+# extras: networkx
+, networkx
+
+# extras: html
+, html5lib
+
+# tests
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -32,34 +39,37 @@ buildPythonPackage rec {
     isodate
     html5lib
     pyparsing
-    SPARQLWrapper
+  ] ++ lib.optionals (pythonOlder "3.8") [
+    importlib-metadata
   ];
 
+  passthru.extra-requires = {
+    html = [
+      html5lib
+    ];
+    networkx = [
+      networkx
+    ];
+  };
+
   checkInputs = [
-    networkx
-    pandas
-    nose
-    tabulate
     pytestCheckHook
-  ];
+  ]
+  ++ passthru.extra-requires.networkx
+  ++ passthru.extra-requires.html;
 
   pytestFlagsArray = [
     # requires network access
-    "--deselect rdflib/__init__.py::rdflib"
-    "--deselect test/jsonld/test_onedotone.py::test_suite"
+    "--deselect=rdflib/__init__.py::rdflib"
+    "--deselect=test/jsonld/test_onedotone.py::test_suite"
   ];
 
   disabledTests = [
     # Requires network access
-    "api_key"
-    "BerkeleyDBTestCase"
-    "test_bad_password"
     "test_service"
     "testGuessFormatForParse"
   ] ++ lib.optional stdenv.isDarwin [
     # Require loopback network access
-    "test_sparqlstore"
-    "test_sparqlupdatestore_mock"
     "TestGraphHTTP"
   ];
 
diff --git a/pkgs/development/python-modules/srp/default.nix b/pkgs/development/python-modules/srp/default.nix
index 17a3ab51cc7..13820a23634 100644
--- a/pkgs/development/python-modules/srp/default.nix
+++ b/pkgs/development/python-modules/srp/default.nix
@@ -1,20 +1,35 @@
-{ buildPythonPackage, fetchPypi, six, lib }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, six
+, pythonOlder
+}:
 
 buildPythonPackage rec {
   pname = "srp";
-  version = "1.0.18";
+  version = "1.0.19";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1582317ccd383dc39d54f223424c588254d73d1cfb2c5c24d945e018ec9516bb";
+    hash = "sha256-SOZT6MP1kJCbpAcwbrLoRgosfR+GxWvOWc9Cr1T/XSo=";
   };
 
-  propagatedBuildInputs = [ six ];
+  propagatedBuildInputs = [
+    six
+  ];
 
   # Tests ends up with libssl.so cannot load shared
   doCheck = false;
 
+  pythonImportsCheck = [
+    "srp"
+  ];
+
   meta = with lib; {
+    description = "Implementation of the Secure Remote Password protocol (SRP)";
     longDescription = ''
      This package provides an implementation of the Secure Remote Password protocol (SRP).
      SRP is a cryptographically strong authentication protocol for password-based, mutual authentication over an insecure network connection.
diff --git a/pkgs/development/python-modules/teslajsonpy/default.nix b/pkgs/development/python-modules/teslajsonpy/default.nix
index 5cdc1dafc03..83d1e1780b0 100644
--- a/pkgs/development/python-modules/teslajsonpy/default.nix
+++ b/pkgs/development/python-modules/teslajsonpy/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "teslajsonpy";
-  version = "1.9.0";
+  version = "2.0.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -23,8 +23,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "zabuldon";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-Q/ltNdr2Huvfj1RmKFopJbaR4FSM7ziWadmDKPS26vc=";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-cplx6Zhqc/ft7l9dy1ian3zzgDqEfpO/0AF7ErX4wqk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/tweepy/default.nix b/pkgs/development/python-modules/tweepy/default.nix
index c97fd85a8be..6b7dbee8fa5 100644
--- a/pkgs/development/python-modules/tweepy/default.nix
+++ b/pkgs/development/python-modules/tweepy/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "tweepy";
-  version = "4.6.0";
+  version = "4.8.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -20,8 +20,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-7ogsocRTMTO5yegyY7BADu9NrHK7zMMbihBu8oF4UlQ=";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-RaM2JN2WOHyZY+AxzgQLvhXg6UnevDbSFSR4jFLsYrc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/twilio/default.nix b/pkgs/development/python-modules/twilio/default.nix
index 4404b743bc5..13bbff916cf 100644
--- a/pkgs/development/python-modules/twilio/default.nix
+++ b/pkgs/development/python-modules/twilio/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "twilio";
-  version = "7.7.0";
+  version = "7.8.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -21,8 +21,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "twilio";
     repo = "twilio-python";
-    rev = version;
-    sha256 = "sha256-PxLDAP/6Ddvf58eEyX3DHkdBNuLE5DlLdCEaRguqOy0=";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-r28iKUv+i8D6JLvsJA7x8T2KFzK26limIwqsXC5jjSE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/types-cryptography/default.nix b/pkgs/development/python-modules/types-cryptography/default.nix
index dd68bfddef7..50882472036 100644
--- a/pkgs/development/python-modules/types-cryptography/default.nix
+++ b/pkgs/development/python-modules/types-cryptography/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "types-cryptography";
-  version = "3.3.18";
+  version = "3.3.19";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-RI/q+a4xImFJvGvOHPj/9U2mYe8Eg398DDFoKYhcNig=";
+    sha256 = "sha256-+VcTjwczMrnAfq2wgx76pXj9tgTlU6w41yxGeutLfCM=";
   };
 
   pythonImportsCheck = [
diff --git a/pkgs/development/tools/build-managers/qbs/default.nix b/pkgs/development/tools/build-managers/qbs/default.nix
index e09aeea75a3..14d9f146651 100644
--- a/pkgs/development/tools/build-managers/qbs/default.nix
+++ b/pkgs/development/tools/build-managers/qbs/default.nix
@@ -3,13 +3,13 @@
 stdenv.mkDerivation rec {
   pname = "qbs";
 
-  version = "1.21.0";
+  version = "1.22.0";
 
   src = fetchFromGitHub {
     owner = "qbs";
     repo = "qbs";
     rev = "v${version}";
-    sha256 = "sha256-jlJ7bk+lKBUs+jB6MTMe2Qxhf7BA7s5M9Xa2Dnx2UJs=";
+    sha256 = "sha256-gFPcT/TNsKEUNzkJVaXHCGNmhQ0dV1/NYgQQInYrcNI=";
   };
 
   nativeBuildInputs = [ qmake ];
diff --git a/pkgs/development/tools/database/indradb/default.nix b/pkgs/development/tools/database/indradb/default.nix
index f577963e8f4..eefb0a32525 100644
--- a/pkgs/development/tools/database/indradb/default.nix
+++ b/pkgs/development/tools/database/indradb/default.nix
@@ -3,6 +3,7 @@
 , lib
 , rustPlatform
 , rustfmt
+, protobuf
 }:
 let
   src = fetchFromGitHub {
@@ -30,7 +31,9 @@ in
 
     buildAndTestSubdir = "server";
 
-    nativeBuildInputs = [ rustfmt ];
+    PROTOC = "${protobuf}/bin/protoc";
+
+    nativeBuildInputs = [ rustfmt rustPlatform.bindgenHook ];
 
     # test rely on libindradb and it can't be found
     # failure at https://github.com/indradb/indradb/blob/master/server/tests/plugins.rs#L63
@@ -44,7 +47,9 @@ in
 
     cargoSha256 = "sha256-pxan6W/CEsOxv8DbbytEBuIqxWn/C4qT4ze/RnvESOM=";
 
-    nativeBuildInputs = [ rustfmt ];
+    PROTOC = "${protobuf}/bin/protoc";
+
+    nativeBuildInputs = [ rustfmt rustPlatform.bindgenHook ];
 
     buildAndTestSubdir = "client";
   };
diff --git a/pkgs/development/tools/go-task/default.nix b/pkgs/development/tools/go-task/default.nix
index d6e5855d992..ff8a8174fd7 100644
--- a/pkgs/development/tools/go-task/default.nix
+++ b/pkgs/development/tools/go-task/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "go-task";
-  version = "3.11.0";
+  version = "3.12.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = "task";
     rev = "v${version}";
-    sha256 = "sha256-KHeZ0UH7qa+fii+sT7q9ri3DpLOKqQZqCAKQYn4l5M8=";
+    sha256 = "sha256-FArt9w4nZJW/Kql3Y2rr/IVz+SnWCS2lzNMWF6TN0Bg=";
   };
 
-  vendorSha256 = "sha256-u+LeH9GijquBeYlA3f2GcyoSP/S7BtBqb8C9OgEA9fY=";
+  vendorSha256 = "sha256-73DtLYyq3sltzv4VtZMlZaSbP9zA9RZw2wgXVkzwrso=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/kubectx/default.nix b/pkgs/development/tools/kubectx/default.nix
index 8ddd7685dcf..1de22705ebd 100644
--- a/pkgs/development/tools/kubectx/default.nix
+++ b/pkgs/development/tools/kubectx/default.nix
@@ -13,8 +13,6 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-4sQaqC0BOsDfWH3cHy2EMQNMq6qiAcbV+RwxCdcSxsg=";
 
-  doCheck = false;
-
   nativeBuildInputs = [ installShellFiles ];
 
   postInstall = ''
diff --git a/pkgs/development/tools/misc/nix-bisect/default.nix b/pkgs/development/tools/misc/nix-bisect/default.nix
index 4075fe5ffbb..23efce44cff 100644
--- a/pkgs/development/tools/misc/nix-bisect/default.nix
+++ b/pkgs/development/tools/misc/nix-bisect/default.nix
@@ -1,4 +1,5 @@
 { lib
+, fetchpatch
 , fetchFromGitHub
 , python3
 }:
@@ -18,6 +19,14 @@ python3.pkgs.buildPythonApplication {
     hash = "sha256-01vj35mMakqKi5zbMIPQ+R8xdkOWbzpnigd3/SU+svw=";
   };
 
+  patches = [
+    (fetchpatch {
+      # Fixes compatibility with recent nix versions
+      url = "https://github.com/timokau/nix-bisect/commit/01eefe174b740cb90e48b06d67d5582d51786b96.patch";
+      hash = "sha256-Gls/NtHH7LujdEgLbcIRZ12KsJDrasXIMcHeeBVns4A=";
+    })
+  ];
+
   propagatedBuildInputs = with python3.pkgs; [
     appdirs
     numpy
diff --git a/pkgs/development/tools/misc/saleae-logic-2/default.nix b/pkgs/development/tools/misc/saleae-logic-2/default.nix
index 242d76174ce..3b9ae267d70 100644
--- a/pkgs/development/tools/misc/saleae-logic-2/default.nix
+++ b/pkgs/development/tools/misc/saleae-logic-2/default.nix
@@ -1,10 +1,10 @@
 { lib, fetchurl, makeDesktopItem, appimageTools, gtk3 }:
 let
   name = "saleae-logic-2";
-  version = "2.3.45";
+  version = "2.3.47";
   src = fetchurl {
     url = "https://downloads.saleae.com/logic2/Logic-${version}-master.AppImage";
-    sha256 = "sha256-kX8jMCUkz7B0muxsEwEttEX+DA2P+6swdZJGHyo7ScA=";
+    sha256 = "sha256-6/FtdupveKnbAK6LizmJ6BokE0kXgUaMz0sOWi+Fq8k=";
   };
   desktopItem = makeDesktopItem {
     inherit name;
@@ -70,6 +70,6 @@ appimageTools.wrapType2 {
     description = "Software for Saleae logic analyzers";
     license = licenses.unfree;
     platforms = [ "x86_64-linux" ];
-    maintainers = [ maintainers.j-hui ];
+    maintainers = with maintainers; [ j-hui newam ];
   };
 }
diff --git a/pkgs/development/tools/rust/rust-analyzer/default.nix b/pkgs/development/tools/rust/rust-analyzer/default.nix
index f155fdbaf78..78ce0626ae5 100644
--- a/pkgs/development/tools/rust/rust-analyzer/default.nix
+++ b/pkgs/development/tools/rust/rust-analyzer/default.nix
@@ -11,14 +11,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rust-analyzer-unwrapped";
-  version = "2022-03-07";
-  cargoSha256 = "sha256-geMzdo5frW5VkuTwBHKHXCTJZrHDUIRSTs2kkCfA5Vc=";
+  version = "2022-04-04";
+  cargoSha256 = "sha256-5PA4EHCwuRO3uOK+Q+Lkp8Fs4MMlmOSOqdcEctkME4A=";
 
   src = fetchFromGitHub {
     owner = "rust-analyzer";
     repo = "rust-analyzer";
     rev = version;
-    sha256 = "sha256-/qKh4utesAjlyG8A3hEmSx+HBgh48Uje6ZRtUGz5f0g=";
+    sha256 = "sha256-ZzghqbLHMxAabG+RDu7Zniy8bJQMdtQVn3oLTnP3jLc=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/yq-go/default.nix b/pkgs/development/tools/yq-go/default.nix
index 9f31ce6f943..59244b053ef 100644
--- a/pkgs/development/tools/yq-go/default.nix
+++ b/pkgs/development/tools/yq-go/default.nix
@@ -13,8 +13,6 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-R40zU0jOc/eIFVDsWG3+4o51iro7Sd7jwtyH/fpWVZs=";
 
-  doCheck = false;
-
   nativeBuildInputs = [ installShellFiles ];
 
   postInstall = ''
diff --git a/pkgs/os-specific/linux/wireguard/default.nix b/pkgs/os-specific/linux/wireguard/default.nix
index 32389d27369..f10a4471072 100644
--- a/pkgs/os-specific/linux/wireguard/default.nix
+++ b/pkgs/os-specific/linux/wireguard/default.nix
@@ -7,11 +7,11 @@ assert lib.versionOlder kernel.version "5.6";
 
 stdenv.mkDerivation rec {
   pname = "wireguard";
-  version = "1.0.20210606";
+  version = "1.0.20211208";
 
   src = fetchzip {
     url = "https://git.zx2c4.com/wireguard-linux-compat/snapshot/wireguard-linux-compat-${version}.tar.xz";
-    sha256 = "sha256-ha7x6+41oPRRhuRwEb1ojRWLF1dlEMoJtqXrzRKQ408=";
+    sha256 = "sha256-MHC4ojhRD8IGwTUE8oEew8IVof9hQCC7CPgVQIBfBRQ=";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/servers/echoip/default.nix b/pkgs/servers/echoip/default.nix
index 745cf96df46..840d7a2d4e6 100644
--- a/pkgs/servers/echoip/default.nix
+++ b/pkgs/servers/echoip/default.nix
@@ -13,8 +13,6 @@ buildGoModule {
 
   vendorSha256 = "0vvs717pl5gzggxpbn2vkyxmpiw5zjdfnpbh8i81xidbqvlnm22h";
 
-  doCheck = false;
-
   outputs = [ "out" "index" ];
 
   postInstall = ''
diff --git a/pkgs/servers/imgproxy/default.nix b/pkgs/servers/imgproxy/default.nix
index d35c53de9af..a46efc07fa8 100644
--- a/pkgs/servers/imgproxy/default.nix
+++ b/pkgs/servers/imgproxy/default.nix
@@ -14,8 +14,6 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-Rp0vTtpdKpYg/7UjX73Qwxu6dOqDr24nqp41fKN1IYw=";
 
-  doCheck = false;
-
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [ gobject-introspection vips ]
diff --git a/pkgs/servers/traefik/default.nix b/pkgs/servers/traefik/default.nix
index 844ab036b5a..622662645c7 100644
--- a/pkgs/servers/traefik/default.nix
+++ b/pkgs/servers/traefik/default.nix
@@ -12,8 +12,6 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-tqrfCpZ/fRYZBZ/SBAvvJebLBeD2M/AVJEPiseehJHY=";
 
-  doCheck = false;
-
   subPackages = [ "cmd/traefik" ];
 
   nativeBuildInputs = [ go-bindata ];
diff --git a/pkgs/shells/nushell/default.nix b/pkgs/shells/nushell/default.nix
index 51261ac1de8..b77cad3d12b 100644
--- a/pkgs/shells/nushell/default.nix
+++ b/pkgs/shells/nushell/default.nix
@@ -18,16 +18,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nushell";
-  version = "0.44.0";
+  version = "0.60.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "sha256-LMG72XfDHA9dKiBbaB09v0rDdUKRy/Czu/lsYw6jUog=";
+    sha256 = "1qfqn2q2bam0jrr4yqq9rb29k8qj9w9g0j9x4n8h0zp28vn7c2bq";
   };
 
-  cargoSha256 = "sha256-wgaRTf+ZQ7alibCdeCjSQhhR9MC77qM1n0jakDgr114=";
+  cargoSha256 = "sha256-gZ9r1Ryp5a7MjG9yM0pGCBYtM4GylZg7Sg9wCiB+SW0=";
 
   nativeBuildInputs = [ pkg-config ]
     ++ lib.optionals (withExtraFeatures && stdenv.isLinux) [ python3 ];
diff --git a/pkgs/shells/nushell/use-system-zstd-lib.diff b/pkgs/shells/nushell/use-system-zstd-lib.diff
index 271ad6c692e..232ee942010 100644
--- a/pkgs/shells/nushell/use-system-zstd-lib.diff
+++ b/pkgs/shells/nushell/use-system-zstd-lib.diff
@@ -1,32 +1,32 @@
 diff --git a/Cargo.lock b/Cargo.lock
-index 8833c3e5..0c90d2fe 100644
+index 4261c06..6d6e537 100644
 --- a/Cargo.lock
 +++ b/Cargo.lock
-@@ -3188,6 +3188,7 @@ dependencies = [
-  "nu_plugin_xpath",
+@@ -2166,6 +2166,7 @@ dependencies = [
   "rstest",
   "serial_test",
+  "tempfile",
 + "zstd-sys",
  ]
-
+ 
  [[package]]
-@@ -6954,4 +6955,5 @@ checksum = "615120c7a2431d16cf1cf979e7fc31ba7a5b5e5707b29c8a99e5dbf8a8392a33"
+@@ -4962,4 +4963,5 @@ checksum = "fc49afa5c8d634e75761feda8c592051e7eeb4683ba827211eb0d731d3402ea8"
  dependencies = [
   "cc",
   "libc",
 + "pkg-config",
  ]
 diff --git a/Cargo.toml b/Cargo.toml
-index 89e8a311..4cc2331a 100644
+index e214da1..b78919a 100644
 --- a/Cargo.toml
 +++ b/Cargo.toml
-@@ -63,6 +63,9 @@ serial_test = "0.5.1"
- hamcrest2 = "0.3.0"
- rstest = "0.10.0"
-
+@@ -67,6 +69,9 @@ hamcrest2 = "0.3.0"
+ rstest = "0.12.0"
+ itertools = "0.10.3"
+ 
 +# Specify that the indirect dependency ztsd-sys should pick up the system zstd C library
 +zstd-sys = { version = "1", features = [ "pkg-config" ] }
 +
- [build-dependencies]
-
- [features]
+ [target.'cfg(windows)'.build-dependencies]
+ embed-resource = "1"
+ 
diff --git a/pkgs/tools/admin/iamy/default.nix b/pkgs/tools/admin/iamy/default.nix
index 467f0ffbce0..caaa1cd488f 100644
--- a/pkgs/tools/admin/iamy/default.nix
+++ b/pkgs/tools/admin/iamy/default.nix
@@ -13,8 +13,6 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-/IUYM3pTvcHXw8t5MW6JUEWdxegFuQC8zkiySp8VEgE=";
 
-  doCheck = false;
-
   ldflags = [
     "-X main.Version=v${version}" "-s" "-w"
   ];
diff --git a/pkgs/tools/filesystems/apfsprogs/default.nix b/pkgs/tools/filesystems/apfsprogs/default.nix
index 2c2aa108077..a9f9a746d98 100644
--- a/pkgs/tools/filesystems/apfsprogs/default.nix
+++ b/pkgs/tools/filesystems/apfsprogs/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation {
   pname = "apfsprogs";
-  version = "unstable-2021-10-26";
+  version = "unstable-2022-02-23";
 
   src = fetchFromGitHub {
     owner = "linux-apfs";
     repo = "apfsprogs";
-    rev = "05ecfa367a8142e289dc76333294271b5edfe395";
-    sha256 = "sha256-McGQG8f12DTp/It8KjMHGyfE5tgmgLd7MZlZIn/xC+E=";
+    rev = "5bce5c7f42843dfbbed90767640e748062e23dd2";
+    sha256 = "sha256-0N+aC5paP6ZoXUD7A9lLnF2onbOJU+dqZ8oKs+dCUcg=";
   };
 
   buildPhase = ''
diff --git a/pkgs/tools/misc/docui/default.nix b/pkgs/tools/misc/docui/default.nix
index a1b2ad662bc..9f0cb31c1ff 100644
--- a/pkgs/tools/misc/docui/default.nix
+++ b/pkgs/tools/misc/docui/default.nix
@@ -13,8 +13,6 @@ buildGoModule rec {
 
   vendorSha256 = "1ggdczvv03lj0g6cq26vrk1rba6pk0805n85w9hkbjx9c4r3j577";
 
-  doCheck = false;
-
   meta = with lib; {
     description = "TUI Client for Docker";
     homepage = "https://github.com/skanehira/docui";
diff --git a/pkgs/tools/misc/ntfy-sh/default.nix b/pkgs/tools/misc/ntfy-sh/default.nix
index 6f5a0b01163..c916f61f0d4 100644
--- a/pkgs/tools/misc/ntfy-sh/default.nix
+++ b/pkgs/tools/misc/ntfy-sh/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "ntfy-sh";
-  version = "1.18.1";
+  version = "1.19.0";
 
   src = fetchFromGitHub {
     owner = "binwiederhier";
     repo = "ntfy";
     rev = "v${version}";
-    sha256 = "sha256-rXdkNJYpQ8s2BeFRR4fSIuCrdq60me4B3wee64ei8qM=";
+    sha256 = "sha256-su4Q41x0PrKHRg2R6jxo1KUmWaaLSrU9UZSDsonKNyA=";
   };
 
-  vendorSha256 = "sha256-7b3cQczQLUZ//5ubKvq8s9U75qJpJaieLN+kzjXIyHg=";
+  vendorSha256 = "sha256-eZmvngNSYY5Z5Xd5tPXzxv9GkosUMueaBGjZ6L7o/yU=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/misc/steampipe/default.nix b/pkgs/tools/misc/steampipe/default.nix
index ee97166deb1..664290dbc93 100644
--- a/pkgs/tools/misc/steampipe/default.nix
+++ b/pkgs/tools/misc/steampipe/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "steampipe";
-  version = "0.13.3";
+  version = "0.13.4";
 
   src = fetchFromGitHub {
     owner = "turbot";
     repo = "steampipe";
     rev = "v${version}";
-    sha256 = "sha256-zU/FWrlE4TQhzRNOVED7hFub+lehPFD+fEJ3v0PFGdM=";
+    sha256 = "sha256-Qq8i/uU2TtrEpvTPFmnZdku2vNo5O240dAT2OQKel1U=";
   };
 
-  vendorSha256 = "sha256-0jixQcgSXQJAd899EWOUKde5OXZcSZwQfH7LRdQlm7c=";
+  vendorSha256 = "sha256-pEQG9BHhsVDVSOoKJBocLXMLjmP72RM+GXz4nYD4D7s=";
   proxyVendor = true;
 
   # tests are failing for no obvious reasons
diff --git a/pkgs/tools/security/cosign/default.nix b/pkgs/tools/security/cosign/default.nix
index 63d36e99032..d36a1fa8a4a 100644
--- a/pkgs/tools/security/cosign/default.nix
+++ b/pkgs/tools/security/cosign/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "cosign";
-  version = "1.6.0";
+  version = "1.7.1";
 
   src = fetchFromGitHub {
     owner = "sigstore";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-jAkTIO+tmb1vjS2eRWU9Fau7qzPCBlXJCk00iwNpULE=";
+    sha256 = "sha256-TyU5aznt3xra23Q52LUmvWlHYkw0s7E3Wqw9ppmzScw=";
   };
 
   buildInputs = lib.optional (stdenv.isLinux && pivKeySupport) (lib.getDev pcsclite)
@@ -16,7 +16,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ pkg-config installShellFiles ];
 
-  vendorSha256 = "sha256-E9zeRlPIIoXo/EfagHC3aDnW747SdsPiqIA384D7NQI=";
+  vendorSha256 = "sha256-WhixkCKW/vQ6J3vJp+KX0JmZxHN38nzzAi5TS2lF3CM=";
 
   subPackages = [
     "cmd/cosign"
diff --git a/pkgs/tools/security/fprintd/default.nix b/pkgs/tools/security/fprintd/default.nix
index b0339846a67..d9c17f935ed 100644
--- a/pkgs/tools/security/fprintd/default.nix
+++ b/pkgs/tools/security/fprintd/default.nix
@@ -25,7 +25,7 @@
 
 stdenv.mkDerivation rec {
   pname = "fprintd";
-  version = "1.94.1";
+  version = "1.94.2";
   outputs = [ "out" "devdoc" ];
 
   src = fetchFromGitLab {
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
     owner = "libfprint";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-XHfHPffVp0jV3Md9Gui9v/nyOJ/bTWM3+hiR7WdEsgQ=";
+    sha256 = "sha256-ePhcIZyXoGr8XlBuzKjpibU9D/44iCXYBlpVR9gcswQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/gobuster/default.nix b/pkgs/tools/security/gobuster/default.nix
index cc436a16b58..e11e76cc971 100644
--- a/pkgs/tools/security/gobuster/default.nix
+++ b/pkgs/tools/security/gobuster/default.nix
@@ -16,8 +16,6 @@ buildGoModule rec {
 
   vendorSha256 = "1isp2jd6k4ppns5zi9irj09090imnc0xp6vcps135ymgp8qg4163";
 
-  doCheck = false;
-
   meta = with lib; {
     description = "Tool used to brute-force URIs, DNS subdomains, Virtual Host names on target web servers";
     homepage = "https://github.com/OJ/gobuster";
diff --git a/pkgs/tools/security/saml2aws/default.nix b/pkgs/tools/security/saml2aws/default.nix
index 2f1127fd68a..296845c644d 100644
--- a/pkgs/tools/security/saml2aws/default.nix
+++ b/pkgs/tools/security/saml2aws/default.nix
@@ -15,8 +15,6 @@ buildGoModule rec {
 
   buildInputs = lib.optionals stdenv.isDarwin [ AppKit ];
 
-  doCheck = false;
-
   subPackages = [ "." "cmd/saml2aws" ];
 
   ldflags = [
diff --git a/pkgs/tools/security/whatweb/Gemfile b/pkgs/tools/security/whatweb/Gemfile
new file mode 100644
index 00000000000..a376a3baae3
--- /dev/null
+++ b/pkgs/tools/security/whatweb/Gemfile
@@ -0,0 +1,6 @@
+source 'https://rubygems.org'
+gem 'ipaddr'
+gem 'addressable'
+gem 'json'
+gem 'mongo'
+gem 'rchardet'
diff --git a/pkgs/tools/security/whatweb/Gemfile.lock b/pkgs/tools/security/whatweb/Gemfile.lock
new file mode 100644
index 00000000000..7bfd24112b1
--- /dev/null
+++ b/pkgs/tools/security/whatweb/Gemfile.lock
@@ -0,0 +1,25 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    addressable (2.8.0)
+      public_suffix (>= 2.0.2, < 5.0)
+    bson (4.14.1)
+    ipaddr (1.2.4)
+    json (2.6.1)
+    mongo (2.17.1)
+      bson (>= 4.8.2, < 5.0.0)
+    public_suffix (4.0.6)
+    rchardet (1.8.0)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  addressable
+  ipaddr
+  json
+  mongo
+  rchardet
+
+BUNDLED WITH
+   2.1.4
diff --git a/pkgs/tools/security/whatweb/default.nix b/pkgs/tools/security/whatweb/default.nix
new file mode 100644
index 00000000000..30d866da869
--- /dev/null
+++ b/pkgs/tools/security/whatweb/default.nix
@@ -0,0 +1,50 @@
+{ lib, stdenv, fetchFromGitHub, bundlerEnv, ruby }:
+
+let
+  gems = bundlerEnv {
+    name = "whatweb-env";
+    inherit ruby;
+    gemdir = ./.;
+  };
+
+in stdenv.mkDerivation rec {
+  pname = "whatweb";
+  version = "0.5.5";
+
+  src = fetchFromGitHub {
+    owner = "urbanadventurer";
+    repo = "whatweb";
+    rev = "v${version}";
+    sha256 = "sha256-HLF55x4C8n8aPO4SI0d6Z9wZe80krtUaGUFmMaYRBIE=";
+  };
+
+  prePatch = ''
+    substituteInPlace Makefile \
+      --replace "/usr/local" "$out" \
+      --replace "/usr" "$out"
+  '';
+
+  buildInputs = [ gems ];
+
+  installPhase = ''
+    runHook preInstall
+
+    raw=$out/share/whatweb/whatweb
+    rm $out/bin/whatweb
+    cat << EOF >> $out/bin/whatweb
+    #!/bin/sh -e
+    exec ${gems}/bin/bundle exec ${ruby}/bin/ruby "$raw" "\$@"
+    EOF
+    chmod +x $out/bin/whatweb
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Next generation web scanner";
+    homepage = "https://github.com/urbanadventurer/whatweb";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ wolfangaukang ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/tools/security/whatweb/gemset.nix b/pkgs/tools/security/whatweb/gemset.nix
new file mode 100644
index 00000000000..22d469b53e2
--- /dev/null
+++ b/pkgs/tools/security/whatweb/gemset.nix
@@ -0,0 +1,74 @@
+{
+  addressable = {
+    dependencies = ["public_suffix"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "022r3m9wdxljpbya69y2i3h9g3dhhfaqzidf95m6qjzms792jvgp";
+      type = "gem";
+    };
+    version = "2.8.0";
+  };
+  bson = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "03n3w96vpblaxvk1qk8hq7sbsmg4nv7qdkdr8f7nfvalgpakp5i5";
+      type = "gem";
+    };
+    version = "4.14.1";
+  };
+  ipaddr = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "13qd34nzpgp3fxfjbvaqg3dcnfr0cgl5vjvcqy0hfllbvfcklnbq";
+      type = "gem";
+    };
+    version = "1.2.4";
+  };
+  json = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1z9grvjyfz16ag55hg522d3q4dh07hf391sf9s96npc0vfi85xkz";
+      type = "gem";
+    };
+    version = "2.6.1";
+  };
+  mongo = {
+    dependencies = ["bson"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "19sihy8ihi3hmdg3gxbf4qvzmjnzx8xygg9534012j9z0wmhs7h1";
+      type = "gem";
+    };
+    version = "2.17.1";
+  };
+  public_suffix = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1xqcgkl7bwws1qrlnmxgh8g4g9m10vg60bhlw40fplninb3ng6d9";
+      type = "gem";
+    };
+    version = "4.0.6";
+  };
+  rchardet = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1isj1b3ywgg2m1vdlnr41lpvpm3dbyarf1lla4dfibfmad9csfk9";
+      type = "gem";
+    };
+    version = "1.8.0";
+  };
+}
diff --git a/pkgs/tools/system/ctop/default.nix b/pkgs/tools/system/ctop/default.nix
index 6091eff255d..cd8c755e1af 100644
--- a/pkgs/tools/system/ctop/default.nix
+++ b/pkgs/tools/system/ctop/default.nix
@@ -13,8 +13,6 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-UAja7XuoLqJFNcK1PgHGcuf/HbvSrWyRvW2D3T7Hg0g=";
 
-  doCheck = false;
-
   ldflags = [ "-s" "-w" "-X main.version=${version}" "-X main.build=v${version}" ];
 
   meta = with lib; {
diff --git a/pkgs/tools/system/goreman/default.nix b/pkgs/tools/system/goreman/default.nix
index 8257e930779..51d70fbc933 100644
--- a/pkgs/tools/system/goreman/default.nix
+++ b/pkgs/tools/system/goreman/default.nix
@@ -20,8 +20,6 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-87aHBRWm5Odv6LeshZty5N31sC+vdSwGlTYhk3BZkPo=";
 
-  doCheck = false;
-
   meta = with lib; {
     description = "foreman clone written in go language";
     homepage = "https://github.com/mattn/goreman";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 638fe676706..06010955d45 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -11065,6 +11065,8 @@ with pkgs;
 
   wf-recorder = callPackage ../applications/video/wf-recorder { };
 
+  whatweb = callPackage ../tools/security/whatweb { };
+
   whipper = callPackage ../applications/audio/whipper { };
 
   whitebophir = callPackage ../servers/web-apps/whitebophir { };
@@ -12710,12 +12712,9 @@ with pkgs;
     buildPackages = buildPackages // { stdenv = buildPackages.gcc8Stdenv; };
   });
 
-  go_1_18 = callPackage ../development/compilers/go/1.18.nix ({
+  go_1_18 = callPackage ../development/compilers/go/1.18.nix {
     inherit (darwin.apple_sdk.frameworks) Security Foundation;
-  } // lib.optionalAttrs (stdenv.cc.isGNU && stdenv.isAarch64) {
-    stdenv = gcc8Stdenv;
-    buildPackages = buildPackages // { stdenv = buildPackages.gcc8Stdenv; };
-  });
+  };
 
   go_2-dev = callPackage ../development/compilers/go/2-dev.nix ({
     inherit (darwin.apple_sdk.frameworks) Security Foundation;
@@ -29274,11 +29273,11 @@ with pkgs;
   inherit (callPackages ../applications/version-management/subversion { sasl = cyrus_sasl; })
     subversion_1_10 subversion;
 
-  subversionClient = appendToName "client" (subversion.override {
+  subversionClient = subversion.override {
     bdbSupport = false;
     perlBindings = true;
     pythonBindings = true;
-  });
+  };
 
   sublime-music = callPackage ../applications/audio/sublime-music { };
 
@@ -32806,7 +32805,11 @@ with pkgs;
     gmp-static = gmp.override { withStatic = true; };
   };
 
-  z3 = callPackage ../applications/science/logic/z3 { python = python2; };
+
+  inherit (callPackages ../applications/science/logic/z3 { python = python2; })
+    z3_4_8
+    z3_4_7;
+  z3 = z3_4_8;
   z3_4_4_0 = callPackage ../applications/science/logic/z3/4.4.0.nix {
     python = python2;
     stdenv = gcc49Stdenv;
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 62394a00c6d..17015119cd9 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -1293,8 +1293,6 @@ let
 
     spelll = callPackage ../development/ocaml-modules/spelll { };
 
-    sqlite3EZ = callPackage ../development/ocaml-modules/sqlite3EZ { };
-
     srt = callPackage ../development/ocaml-modules/srt {
       inherit (pkgs) srt;
     };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 80d02059aed..b908f688829 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5107,6 +5107,8 @@ in {
     python3Packages = self;
   });
 
+  mergedb = callPackage ../development/python-modules/mergedb { };
+
   mergedeep = callPackage ../development/python-modules/mergedeep { };
 
   merkletools = callPackage ../development/python-modules/merkletools { };