diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index acc04a533f6..e776ef0d0c0 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -845,6 +845,16 @@
     githubId = 11699655;
     name = "Stanislas Lange";
   };
+  AngryAnt = {
+    name = "Emil Johansen";
+    email = "git@eej.dk";
+    matrix = "@angryant:envs.net";
+    github = "AngryAnt";
+    githubId = 102513;
+    keys = [{
+      fingerprint = "B7B7 582E 564E 789B FCB8  71AB 0C6D FE2F B234 534A";
+    }];
+  };
   anhdle14 = {
     name = "Le Anh Duc";
     email = "anhdle14@icloud.com";
@@ -14720,4 +14730,10 @@
     github = "dfithian";
     githubId = 8409320;
   };
+  nikstur = {
+    email = "nikstur@outlook.com";
+    name = "nikstur";
+    github = "nikstur";
+    githubId = 61635709;
+  };
 }
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 82c0b5d74de..3010a213705 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1088,6 +1088,7 @@
   ./services/web-apps/nifi.nix
   ./services/web-apps/node-red.nix
   ./services/web-apps/phylactery.nix
+  ./services/web-apps/onlyoffice.nix
   ./services/web-apps/pict-rs.nix
   ./services/web-apps/peertube.nix
   ./services/web-apps/plantuml-server.nix
diff --git a/nixos/modules/services/databases/openldap.nix b/nixos/modules/services/databases/openldap.nix
index d80d1b07b97..7c7340094e2 100644
--- a/nixos/modules/services/databases/openldap.nix
+++ b/nixos/modules/services/databases/openldap.nix
@@ -245,7 +245,7 @@ in {
     };
   };
 
-  meta.maintainers = with lib.maintainers; [ mic92 kwohlfahrt ];
+  meta.maintainers = with lib.maintainers; [ kwohlfahrt ];
 
   config = mkIf cfg.enable {
     assertions = map (opt: {
diff --git a/nixos/modules/services/web-apps/onlyoffice.nix b/nixos/modules/services/web-apps/onlyoffice.nix
new file mode 100644
index 00000000000..ce6a3e835e3
--- /dev/null
+++ b/nixos/modules/services/web-apps/onlyoffice.nix
@@ -0,0 +1,288 @@
+{ lib, config, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.onlyoffice;
+in
+{
+  options.services.onlyoffice = {
+    enable = mkEnableOption "OnlyOffice DocumentServer";
+
+    enableExampleServer = mkEnableOption "OnlyOffice example server";
+
+    hostname = mkOption {
+      type = types.str;
+      default = "localhost";
+      description = "FQDN for the onlyoffice instance.";
+    };
+
+    jwtSecretFile = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = ''
+        Path to a file that contains the secret to sign web requests using JSON Web Tokens.
+        If left at the default value null signing is disabled.
+      '';
+    };
+
+    package = mkOption {
+      type = types.package;
+      default = pkgs.onlyoffice-documentserver;
+      defaultText = "pkgs.onlyoffice-documentserver";
+      description = "Which package to use for the OnlyOffice instance.";
+    };
+
+    port = mkOption {
+      type = types.port;
+      default = 8000;
+      description = "Port the OnlyOffice DocumentServer should listens on.";
+    };
+
+    examplePort = mkOption {
+      type = types.port;
+      default = null;
+      description = "Port the OnlyOffice Example server should listens on.";
+    };
+
+    postgresHost = mkOption {
+      type = types.str;
+      default = "/run/postgresql";
+      description = "The Postgresql hostname or socket path OnlyOffice should connect to.";
+    };
+
+    postgresName = mkOption {
+      type = types.str;
+      default = "onlyoffice";
+      description = "The name of databse OnlyOffice should user.";
+    };
+
+    postgresPasswordFile = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = ''
+        Path to a file that contains the password OnlyOffice should use to connect to Postgresql.
+        Unused when using socket authentication.
+      '';
+    };
+
+    postgresUser = mkOption {
+      type = types.str;
+      default = "onlyoffice";
+      description = ''
+        The username OnlyOffice should use to connect to Postgresql.
+        Unused when using socket authentication.
+      '';
+    };
+
+    rabbitmqUrl = mkOption {
+      type = types.str;
+      default = "amqp://guest:guest@localhost:5672";
+      description = "The Rabbitmq in amqp URI style OnlyOffice should connect to.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services = {
+      nginx = {
+        enable = mkDefault true;
+        # misses text/csv, font/ttf, application/x-font-ttf, application/rtf, application/wasm
+        recommendedGzipSettings = mkDefault true;
+        recommendedProxySettings = mkDefault true;
+
+        upstreams = {
+          # /etc/nginx/includes/http-common.conf
+          onlyoffice-docservice = {
+            servers = { "localhost:${toString cfg.port}" = { }; };
+          };
+          onlyoffice-example = lib.mkIf cfg.enableExampleServer {
+            servers = { "localhost:${toString cfg.examplePort}" = { }; };
+          };
+        };
+
+        virtualHosts.${cfg.hostname} = {
+          locations = {
+            # /etc/nginx/includes/ds-docservice.conf
+            "~ ^(\/[\d]+\.[\d]+\.[\d]+[\.|-][\d]+)?\/(web-apps\/apps\/api\/documents\/api\.js)$".extraConfig = ''
+              expires -1;
+              alias ${cfg.package}/var/www/onlyoffice/documentserver/$2;
+            '';
+            "~ ^(\/[\d]+\.[\d]+\.[\d]+[\.|-][\d]+)?\/(web-apps)(\/.*\.json)$".extraConfig = ''
+              expires 365d;
+              error_log /dev/null crit;
+              alias ${cfg.package}/var/www/onlyoffice/documentserver/$2$3;
+            '';
+            "~ ^(\/[\d]+\.[\d]+\.[\d]+[\.|-][\d]+)?\/(sdkjs-plugins)(\/.*\.json)$".extraConfig = ''
+              expires 365d;
+              error_log /dev/null crit;
+              alias ${cfg.package}/var/www/onlyoffice/documentserver/$2$3;
+            '';
+            "~ ^(\/[\d]+\.[\d]+\.[\d]+[\.|-][\d]+)?\/(web-apps|sdkjs|sdkjs-plugins|fonts)(\/.*)$".extraConfig = ''
+              expires 365d;
+              alias ${cfg.package}/var/www/onlyoffice/documentserver/$2$3;
+            '';
+            "~* ^(\/cache\/files.*)(\/.*)".extraConfig = ''
+              alias /var/lib/onlyoffice/documentserver/App_Data$1;
+              add_header Content-Disposition "attachment; filename*=UTF-8''$arg_filename";
+
+              set $secret_string verysecretstring;
+              secure_link $arg_md5,$arg_expires;
+              secure_link_md5 "$secure_link_expires$uri$secret_string";
+
+              if ($secure_link = "") {
+                return 403;
+              }
+
+              if ($secure_link = "0") {
+                return 410;
+              }
+            '';
+            "~* ^(\/[\d]+\.[\d]+\.[\d]+[\.|-][\d]+)?\/(internal)(\/.*)$".extraConfig = ''
+              allow 127.0.0.1;
+              deny all;
+              proxy_pass http://onlyoffice-docservice/$2$3;
+            '';
+            "~* ^(\/[\d]+\.[\d]+\.[\d]+[\.|-][\d]+)?\/(info)(\/.*)$".extraConfig = ''
+              allow 127.0.0.1;
+              deny all;
+              proxy_pass http://onlyoffice-docservice/$2$3;
+            '';
+            "/".extraConfig = ''
+              proxy_pass http://onlyoffice-docservice;
+            '';
+            "~ ^(\/[\d]+\.[\d]+\.[\d]+[\.|-][\d]+)?(\/doc\/.*)".extraConfig = ''
+              proxy_pass http://onlyoffice-docservice$2;
+              proxy_http_version 1.1;
+            '';
+            "/${cfg.package.version}/".extraConfig = ''
+              proxy_pass http://onlyoffice-docservice/;
+            '';
+            "~ ^(\/[\d]+\.[\d]+\.[\d]+[\.|-][\d]+)?\/(dictionaries)(\/.*)$".extraConfig = ''
+              expires 365d;
+              alias ${cfg.package}/var/www/onlyoffice/documentserver/$2$3;
+            '';
+            # /etc/nginx/includes/ds-example.conf
+            "~ ^(\/welcome\/.*)$".extraConfig = ''
+              expires 365d;
+              alias ${cfg.package}/var/www/onlyoffice/documentserver-example$1;
+              index docker.html;
+            '';
+            "/example/".extraConfig = lib.mkIf cfg.enableExampleServer ''
+              proxy_pass http://onlyoffice-example/;
+              proxy_set_header X-Forwarded-Path /example;
+            '';
+          };
+          extraConfig = ''
+            rewrite ^/$ /welcome/ redirect;
+            rewrite ^\/OfficeWeb(\/apps\/.*)$ /${cfg.package.version}/web-apps$1 redirect;
+            rewrite ^(\/web-apps\/apps\/(?!api\/).*)$ /${cfg.package.version}$1 redirect;
+
+            # based on https://github.com/ONLYOFFICE/document-server-package/blob/master/common/documentserver/nginx/includes/http-common.conf.m4#L29-L34
+            # without variable indirection and correct variable names
+            proxy_set_header Host $host;
+            proxy_set_header X-Forwarded-Host $host;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            # required for CSP to take effect
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            # required for websocket
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+          '';
+        };
+      };
+
+      rabbitmq.enable = lib.mkDefault true;
+
+      postgresql = {
+        enable = lib.mkDefault true;
+        ensureDatabases = [ "onlyoffice" ];
+        ensureUsers = [{
+          name = "onlyoffice";
+          ensurePermissions = { "DATABASE \"onlyoffice\"" = "ALL PRIVILEGES"; };
+        }];
+      };
+    };
+
+    systemd.services = {
+      onlyoffice-converter = {
+        description = "onlyoffice converter";
+        after = [ "network.target" "onlyoffice-docservice.service" "postgresql.service" ];
+        requires = [ "network.target" "onlyoffice-docservice.service" "postgresql.service" ];
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          ExecStart = "${cfg.package.fhs}/bin/onlyoffice-wrapper FileConverter/converter /run/onlyoffice/config";
+          Group = "onlyoffice";
+          Restart = "always";
+          RuntimeDirectory = "onlyoffice";
+          StateDirectory = "onlyoffice";
+          Type = "simple";
+          User = "onlyoffice";
+        };
+      };
+
+      onlyoffice-docservice =
+        let
+          onlyoffice-prestart = pkgs.writeShellScript "onlyoffice-prestart" ''
+            PATH=$PATH:${lib.makeBinPath (with pkgs; [ jq moreutils config.services.postgresql.package ])}
+            umask 077
+            mkdir -p /run/onlyoffice/config/ /var/lib/onlyoffice/documentserver/sdkjs/{slide/themes,common}/ /var/lib/onlyoffice/documentserver/{fonts,server/FileConverter/bin}/
+            cp -r ${cfg.package}/etc/onlyoffice/documentserver/* /run/onlyoffice/config/
+            chmod u+w /run/onlyoffice/config/default.json
+
+            cp /run/onlyoffice/config/default.json{,.orig}
+
+            # for a mapping of environment variables from the docker container to json options see
+            # https://github.com/ONLYOFFICE/Docker-DocumentServer/blob/master/run-document-server.sh
+            jq '
+              .services.CoAuthoring.server.port = ${toString cfg.port} |
+              .services.CoAuthoring.sql.dbHost = "${cfg.postgresHost}" |
+              .services.CoAuthoring.sql.dbName = "${cfg.postgresName}" |
+            ${lib.optionalString (cfg.postgresPasswordFile != null) ''
+              .services.CoAuthoring.sql.dbPass = "'"$(cat ${cfg.postgresPasswordFile})"'" |
+            ''}
+              .services.CoAuthoring.sql.dbUser = "${cfg.postgresUser}" |
+            ${lib.optionalString (cfg.jwtSecretFile != null) ''
+              .services.CoAuthoring.token.enable.browser = true |
+              .services.CoAuthoring.token.enable.request.inbox = true |
+              .services.CoAuthoring.token.enable.request.outbox = true |
+              .services.CoAuthoring.secret.inbox.string = "'"$(cat ${cfg.jwtSecretFile})"'" |
+              .services.CoAuthoring.secret.outbox.string = "'"$(cat ${cfg.jwtSecretFile})"'" |
+              .services.CoAuthoring.secret.session.string = "'"$(cat ${cfg.jwtSecretFile})"'" |
+            ''}
+              .rabbitmq.url = "${cfg.rabbitmqUrl}"
+              ' /run/onlyoffice/config/default.json | sponge /run/onlyoffice/config/default.json
+
+            if ! psql -d onlyoffice -c "SELECT 'task_result'::regclass;" >/dev/null; then
+              psql -f ${cfg.package}/var/www/onlyoffice/documentserver/server/schema/postgresql/createdb.sql
+            fi
+          '';
+        in
+        {
+          description = "onlyoffice documentserver";
+          after = [ "network.target" "postgresql.service" ];
+          requires = [ "postgresql.service" ];
+          wantedBy = [ "multi-user.target" ];
+          serviceConfig = {
+            ExecStart = "${cfg.package.fhs}/bin/onlyoffice-wrapper DocService/docservice /run/onlyoffice/config";
+            ExecStartPre = onlyoffice-prestart;
+            Group = "onlyoffice";
+            Restart = "always";
+            RuntimeDirectory = "onlyoffice";
+            StateDirectory = "onlyoffice";
+            Type = "simple";
+            User = "onlyoffice";
+          };
+        };
+    };
+
+    users.users = {
+      onlyoffice = {
+        description = "OnlyOffice Service";
+        group = "onlyoffice";
+        isSystemUser = true;
+      };
+    };
+
+    users.groups.onlyoffice = { };
+  };
+}
diff --git a/pkgs/applications/audio/musikcube/0001-apple-cmake.patch b/pkgs/applications/audio/musikcube/0001-apple-cmake.patch
deleted file mode 100644
index 3c4630af4aa..00000000000
--- a/pkgs/applications/audio/musikcube/0001-apple-cmake.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-diff --git a/src/musikcube/CMakeLists.txt b/src/musikcube/CMakeLists.txt
-index f42748aa..ae339946 100644
---- a/src/musikcube/CMakeLists.txt
-+++ b/src/musikcube/CMakeLists.txt
-@@ -98,9 +98,6 @@ else()
- endif()
- 
- if (APPLE)
--    message(STATUS "[ncurses] detected Darwin, linking statically")
--    set(CURSES_LIBRARY_NAME "lib${CURSES_LIBRARY_NAME}.a")
--    set(PANEL_LIBRARY_NAME "lib${PANEL_LIBRARY_NAME}.a")
- else()
-     message(STATUS "[ncurses] not Darwin! will attempt to link against libtinfo")
-     find_library(LIBTINFO NAMES tinfo)
diff --git a/pkgs/applications/audio/musikcube/default.nix b/pkgs/applications/audio/musikcube/default.nix
index 0894a6410d8..273b62401e8 100644
--- a/pkgs/applications/audio/musikcube/default.nix
+++ b/pkgs/applications/audio/musikcube/default.nix
@@ -9,6 +9,8 @@
 , lame
 , libev
 , libmicrohttpd
+, libopenmpt
+, mpg123
 , ncurses
 , lib
 , stdenv
@@ -25,25 +27,25 @@
 
 stdenv.mkDerivation rec {
   pname = "musikcube";
-  version = "0.97.0";
+  version = "0.98.0";
 
   src = fetchFromGitHub {
     owner = "clangen";
     repo = pname;
     rev = version;
-    sha256 = "sha256-W9Ng1kqai5qhaDs5KWg/1sOTIAalBXLng1MG8sl/ZOg=";
+    sha256 = "sha256-bnwOxEcvRXWPuqtkv8YlpclvH/6ZtQvyvHy4mqJCwik=";
   };
 
-  patches = [
-    # Fix pending upstream inclusion for ncurses-6.3 support:
-    #  https://github.com/clangen/musikcube/pull/474
-    (fetchpatch {
-      name = "ncurses-6.3.patch";
-      url = "https://github.com/clangen/musikcube/commit/1240720e27232fdb199a4da93ca6705864442026.patch";
-      sha256 = "0bhjgwnj6d24wb1m9xz1vi1k9xk27arba1absjbcimggn54pinid";
-    })
-    ./0001-apple-cmake.patch
-  ];
+  patches = []
+    ++ lib.optionals stdenv.isDarwin [
+      # Fix pending upstream inclusion for Darwin nixpkgs builds:
+      # https://github.com/clangen/musikcube/pull/531
+      (fetchpatch {
+        name = "darwin-build.patch";
+        url = "https://github.com/clangen/musikcube/commit/9077bb9fa6ddfe93ebb14bb8feebc8a0ef9b7ee4.patch";
+        sha256 = "sha256-Am9AGKDGMN5z+JJFJKdsBLrHf2neHFovgF/8I5EXLDA=";
+      })
+    ];
 
   nativeBuildInputs = [
     cmake
@@ -58,6 +60,8 @@ stdenv.mkDerivation rec {
     lame
     libev
     libmicrohttpd
+    libopenmpt
+    mpg123
     ncurses
     taglib
   ] ++ lib.optionals systemdSupport [
diff --git a/pkgs/applications/audio/surge/default.nix b/pkgs/applications/audio/surge/default.nix
index 849b07d67e1..f1d8600ed01 100644
--- a/pkgs/applications/audio/surge/default.nix
+++ b/pkgs/applications/audio/surge/default.nix
@@ -1,6 +1,22 @@
-{ stdenv, lib, fetchurl, fetchFromGitHub, cmake, git, pkg-config, python3
-, cairo, libsndfile, libxcb, libxkbcommon, xcbutil, xcbutilcursor, xcbutilkeysyms, zenity
-, curl, rsync
+{ stdenv
+, lib
+, fetchurl
+, fetchpatch
+, fetchFromGitHub
+, cmake
+, git
+, pkg-config
+, python3
+, cairo
+, libsndfile
+, libxcb
+, libxkbcommon
+, xcbutil
+, xcbutilcursor
+, xcbutilkeysyms
+, zenity
+, curl
+, rsync
 }:
 
 stdenv.mkDerivation rec {
@@ -21,12 +37,43 @@ stdenv.mkDerivation rec {
     rev = "afc591cc06d9adc3dc8dc515a55c66873fa10296";
     sha256 = "1wqv86l70nwlrb10n47rib80f47a96j9qqg8w5dv46ys1sq2nz7z";
   };
-  nativeBuildInputs = [ cmake git pkg-config python3 ];
-  buildInputs = [ cairo libsndfile libxcb libxkbcommon xcbutil xcbutilcursor xcbutilkeysyms zenity curl rsync ];
+
+  patches = [
+    # Fix build error due to newer glibc version by upgrading lib "catch 2"
+    # Issue: https://github.com/surge-synthesizer/surge/pull/4843
+    # Patch: https://github.com/surge-synthesizer/surge/pull/4845
+    (fetchpatch {
+      url = "https://github.com/surge-synthesizer/surge/commit/7a552038bab4b000d188ae425aa97963dc91db17.patch";
+      sha256 = "sha256-5Flf0uJqEK6e+sadB+vr6phdvvdZYXcFFfm4ywhAeW0=";
+      name = "glibc_build_fix.patch";
+    })
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    git
+    pkg-config
+    python3
+  ];
+
+  buildInputs = [
+    cairo
+    libsndfile
+    libxcb
+    libxkbcommon
+    xcbutil
+    xcbutilcursor
+    xcbutilkeysyms
+    zenity
+    curl
+    rsync
+  ];
 
   postPatch = ''
-    substituteInPlace src/common/SurgeStorage.cpp --replace "/usr/share/Surge" "$out/share/surge"
-    substituteInPlace src/linux/UserInteractionsLinux.cpp --replace '"zenity' '"${zenity}/bin/zenity'
+    substituteInPlace src/common/SurgeStorage.cpp \
+      --replace "/usr/share/Surge" "$out/share/surge"
+    substituteInPlace src/linux/UserInteractionsLinux.cpp \
+      --replace '"zenity' '"${zenity}/bin/zenity'
     patchShebangs scripts/linux/
     cp -r $extraContent/Skins/ resources/data/skins
   '';
@@ -38,6 +85,7 @@ stdenv.mkDerivation rec {
   '';
 
   doInstallCheck = true;
+
   installCheckPhase = ''
     export HOME=$(mktemp -d)
     export SURGE_DISABLE_NETWORK_TESTS=TRUE
@@ -45,7 +93,10 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    description = "LV2 & VST3 synthesizer plug-in (previously released as Vember Audio Surge)";
+    description = ''
+      LV2 & VST3 synthesizer plug-in (previously released as Vember Audio
+      Surge)
+    '';
     homepage = "https://surge-synthesizer.github.io";
     license = licenses.gpl3;
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/blockchains/framesh/default.nix b/pkgs/applications/blockchains/framesh/default.nix
index 2acc88fc93e..098d56ec4a7 100644
--- a/pkgs/applications/blockchains/framesh/default.nix
+++ b/pkgs/applications/blockchains/framesh/default.nix
@@ -2,10 +2,10 @@
 
 let
   pname = "framesh";
-  version = "0.5.0-beta.20";
+  version = "0.5.0-beta.21";
   src = fetchurl {
     url = "https://github.com/floating/frame/releases/download/v${version}/Frame-${version}.AppImage";
-    sha256 = "sha256-4PU3f5e9NJYnP49nVtCjbGXxWJDCJIArzuaLsWB3Cx0=";
+    sha256 = "sha256-rWZ7oC74qrylNPIfBzHnNMcsYjccGL2zeXFab9OwBNA=";
   };
 
   appimageContents = appimageTools.extractType2 {
diff --git a/pkgs/applications/editors/nvpy/default.nix b/pkgs/applications/editors/nvpy/default.nix
index 99e49925767..cc5f60984c9 100644
--- a/pkgs/applications/editors/nvpy/default.nix
+++ b/pkgs/applications/editors/nvpy/default.nix
@@ -3,14 +3,14 @@
 let
   pythonPackages = python3Packages;
 in pythonPackages.buildPythonApplication rec {
-  version = "2.1.0";
+  version = "2.2.0";
   pname = "nvpy";
 
   src = fetchFromGitHub {
     owner = "cpbotha";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "02njvybd8yaqdnc5ghwrm8225z57gg4w7rhmx3w5jqzh16ld4mhh";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-eWvD1k0wbzo0G46/LEOlHl1wLvc4JHLL1fg6wuCHiQY=";
   };
 
 
diff --git a/pkgs/applications/graphics/hydrus/default.nix b/pkgs/applications/graphics/hydrus/default.nix
index d44ef1f9cf5..698872f4a8f 100644
--- a/pkgs/applications/graphics/hydrus/default.nix
+++ b/pkgs/applications/graphics/hydrus/default.nix
@@ -10,14 +10,14 @@
 
 python3Packages.buildPythonPackage rec {
   pname = "hydrus";
-  version = "491";
+  version = "492";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "hydrusnetwork";
     repo = "hydrus";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-ceKawn2jyfZPP4HzhkB1jIQoStCPRO/Ni/+Ys1R2FJQ=";
+    sha256 = "sha256-KtuHPKVwk6nRQ5lqHxRgm7k7DfcGeRAzR/kkHVMizDM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/avalonia-ilspy/default.nix b/pkgs/applications/misc/avalonia-ilspy/default.nix
new file mode 100644
index 00000000000..7defa48a8f6
--- /dev/null
+++ b/pkgs/applications/misc/avalonia-ilspy/default.nix
@@ -0,0 +1,99 @@
+{ lib
+, stdenv
+, fetchzip
+, unzip
+, autoPatchelfHook
+, makeWrapper
+, makeDesktopItem
+, copyDesktopItems
+, lttng-ust
+, libkrb5
+, zlib
+, fontconfig
+, openssl_1_1
+, libX11
+, libICE
+, libSM
+, icu
+}:
+
+stdenv.mkDerivation rec {
+  pname = "avalonia-ilspy";
+  version = "7.2-rc";
+
+  src = fetchzip {
+    url = "https://github.com/icsharpcode/AvaloniaILSpy/releases/download/v${version}/Linux.x64.Release.zip";
+    sha256 = "1crf0ng4l6x70wjlz3r6qw8l166gd52ys11j7ilb4nyy3mkjxk11";
+  };
+
+  nativeBuildInputs = [
+    unzip
+    autoPatchelfHook
+    makeWrapper
+    copyDesktopItems
+  ];
+
+  buildInputs = [
+    stdenv.cc.cc.lib
+    lttng-ust
+    libkrb5
+    zlib
+    fontconfig
+  ];
+
+  libraryPath = lib.makeLibraryPath [
+    openssl_1_1
+    libX11
+    libICE
+    libSM
+    icu
+  ];
+
+  unpackPhase = ''
+    unzip -qq $src/ILSpy-linux-x64-Release.zip
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin $out/lib $out/share/icons/hicolor/scalable/apps
+    cp -r artifacts/linux-x64/* $out/lib
+    ln -s $out/lib/Images/ILSpy.png $out/share/icons/hicolor/scalable/apps/ILSpy.png
+
+    chmod +x $out/lib/ILSpy
+    wrapProgram $out/lib/ILSpy --prefix LD_LIBRARY_PATH : ${libraryPath}
+    mv $out/lib/ILSpy $out/bin
+
+    runHook postInstall
+  '';
+
+  # dotnet runtime requirements
+  preFixup = ''
+    patchelf --replace-needed liblttng-ust.so.0 liblttng-ust.so $out/lib/libcoreclrtraceptprovider.so
+  '';
+  dontStrip = true;
+
+  desktopItem = makeDesktopItem {
+    name = "ILSpy";
+    desktopName = "ILSpy";
+    exec = "ILSpy";
+    icon = "ILSpy";
+    comment = ".NET assembly browser and decompiler";
+    categories = [
+      "Development"
+    ];
+    keywords = [
+      ".net"
+      "il"
+      "assembly"
+    ];
+  };
+
+  meta = with lib; {
+    description = ".NET assembly browser and decompiler";
+    homepage = "https://github.com/icsharpcode/AvaloniaILSpy";
+    license = licenses.mit;
+    platforms = [ "x86_64-linux" ];
+    maintainers = with lib.maintainers; [ AngryAnt ];
+  };
+}
diff --git a/pkgs/applications/misc/binocle/default.nix b/pkgs/applications/misc/binocle/default.nix
index ccb748fe3a6..6a999790635 100644
--- a/pkgs/applications/misc/binocle/default.nix
+++ b/pkgs/applications/misc/binocle/default.nix
@@ -3,6 +3,13 @@
 , rustPlatform
 , fetchFromGitHub
 , makeWrapper
+, AppKit
+, CoreFoundation
+, CoreGraphics
+, CoreVideo
+, Foundation
+, Metal
+, QuartzCore
 , xorg
 , vulkan-loader
 }:
@@ -24,7 +31,11 @@ rustPlatform.buildRustPackage rec {
     makeWrapper
   ];
 
-  postInstall = ''
+  buildInputs = lib.optionals stdenv.isDarwin [
+    AppKit CoreFoundation CoreGraphics CoreVideo Foundation Metal QuartzCore
+  ];
+
+  postInstall = lib.optionalString (!stdenv.isDarwin) ''
     wrapProgram $out/bin/binocle \
       --suffix LD_LIBRARY_PATH : ${lib.makeLibraryPath (with xorg; [ libX11 libXcursor libXi libXrandr ] ++ [ vulkan-loader ])}
   '';
@@ -34,6 +45,5 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/sharkdp/binocle";
     license = with licenses; [ asl20 /* or */ mit ];
     maintainers = with maintainers; [ SuperSandro2000 ];
-    broken = stdenv.isDarwin;
   };
 }
diff --git a/pkgs/applications/misc/dialect/default.nix b/pkgs/applications/misc/dialect/default.nix
index a4f9d94d9ec..6e504ab7173 100644
--- a/pkgs/applications/misc/dialect/default.nix
+++ b/pkgs/applications/misc/dialect/default.nix
@@ -18,7 +18,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "dialect";
-  version = "2.0.1";
+  version = "2.0.2";
 
   format = "other";
 
@@ -27,7 +27,7 @@ python3.pkgs.buildPythonApplication rec {
     repo = pname;
     rev = version;
     fetchSubmodules = true;
-    hash = "sha256-Ke23QnvKpmyuaqkiBQL1cUa0T7lSfYPLFi6wa9G8LYk=";
+    hash = "sha256-55vqxS0ySV8lItxLl1J+wLvPtmR87HzGfAiOKuhigFA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/logseq/default.nix b/pkgs/applications/misc/logseq/default.nix
index 36b06219a23..86d181ba5a5 100644
--- a/pkgs/applications/misc/logseq/default.nix
+++ b/pkgs/applications/misc/logseq/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "logseq";
-  version = "0.7.7";
+  version = "0.7.8";
 
   src = fetchurl {
     url = "https://github.com/logseq/logseq/releases/download/${version}/logseq-linux-x64-${version}.AppImage";
-    sha256 = "sha256-FRhtB7l40nNy8YTocXShbvhGudFWOrzpXsfe4yFY4us=";
+    sha256 = "sha256-5NEx4OEISa7q0tp6v4AWK9eMn58dje7non653iJhipE=";
     name = "${pname}-${version}.AppImage";
   };
 
diff --git a/pkgs/applications/misc/tut/default.nix b/pkgs/applications/misc/tut/default.nix
index 8fa43da8098..9bc97edfe48 100644
--- a/pkgs/applications/misc/tut/default.nix
+++ b/pkgs/applications/misc/tut/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "tut";
-  version = "1.0.13";
+  version = "1.0.14";
 
   src = fetchFromGitHub {
     owner = "RasmusLindroth";
     repo = pname;
     rev = version;
-    sha256 = "sha256-EORvIqA2bsmNUY1euUBmEYNMU02nW0doRDmTQjt15Os=";
+    sha256 = "sha256-2zlCO73UBT2E94+AvDdqACotWFna6G1P+Q9VrOKxK+c=";
   };
 
   vendorSha256 = "sha256-ilq1sfFY6WuNACryDGjkpF5eUTan8Y6Yt26vot9XR54=";
diff --git a/pkgs/applications/networking/browsers/brave/default.nix b/pkgs/applications/networking/browsers/brave/default.nix
index bc707dfb993..8af5e984c02 100644
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@@ -90,11 +90,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "brave";
-  version = "1.41.96";
+  version = "1.41.99";
 
   src = fetchurl {
     url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    sha256 = "sha256-sPIzQkaa6PGxwLkCHYz2GdSDns5x/Q2YwWcXBWBx+Fo=";
+    sha256 = "sha256-SGh2yp6sYtamIZc5YvBwkoAQxYw0Y9KZyVLI/EGS0dg=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/applications/networking/sync/onedrive/default.nix b/pkgs/applications/networking/sync/onedrive/default.nix
index 7b6316631e8..d2c6620b8d6 100644
--- a/pkgs/applications/networking/sync/onedrive/default.nix
+++ b/pkgs/applications/networking/sync/onedrive/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "onedrive";
-  version = "2.4.19";
+  version = "2.4.20";
 
   src = fetchFromGitHub {
     owner = "abraunegg";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-7kX7gC/1jSZGgV3ZhfebMIn/Y5gXkz22GDP2zpiwUZ4=";
+    hash = "sha256-2sDs4AhiyccVpnfCGPBL+QifQGStbrzSUIL547kh2ko=";
   };
 
   nativeBuildInputs = [ autoreconfHook ldc installShellFiles pkg-config ];
diff --git a/pkgs/applications/office/zk/default.nix b/pkgs/applications/office/zk/default.nix
index f6b9f1393ea..23b1977308c 100644
--- a/pkgs/applications/office/zk/default.nix
+++ b/pkgs/applications/office/zk/default.nix
@@ -2,26 +2,24 @@
 
 buildGoModule rec {
   pname = "zk";
-  version = "0.9.0";
+  version = "0.11.1";
 
   src = fetchFromGitHub {
     owner = "mickael-menu";
     repo = "zk";
     rev = "v${version}";
-    sha256 = "sha256-AXKIi70evf581lMwfbfxm8hFCzsnhKRQgnIEZQFS75A=";
+    sha256 = "sha256-30Vw6RGREg/ULS+eNExulHNOsOssMjXE+/tuRBQ17kI=";
   };
 
-  vendorSha256 = "sha256-m7QGv8Vx776TsN7QHXtO+yl3U1D573UMZVyg1B4UeIk=";
+  vendorSha256 = "sha256-11GzI3aEhKKTiULoWq9uIc66E3YCrW/HJQUYXRhCaek=";
 
   doCheck = false;
 
-  buildInputs = [ icu ];
-
   CGO_ENABLED = 1;
 
   ldflags = [ "-s" "-w" "-X=main.Build=${version}" ];
 
-  tags = [ "fts5" "icu" ];
+  tags = [ "fts5" ];
 
   meta = with lib; {
     maintainers = with maintainers; [ pinpox ];
diff --git a/pkgs/applications/virtualization/docker/compose.nix b/pkgs/applications/virtualization/docker/compose.nix
index 583a3e50a1f..f95568f918f 100644
--- a/pkgs/applications/virtualization/docker/compose.nix
+++ b/pkgs/applications/virtualization/docker/compose.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "docker-compose";
-  version = "2.6.1";
+  version = "2.7.0";
 
   src = fetchFromGitHub {
     owner = "docker";
     repo = "compose";
     rev = "v${version}";
-    sha256 = "sha256-D3+qDWxg3e5/3UIMz8FZDuxmQHmTv0NJVT/otGYedtw=";
+    sha256 = "sha256-cx2Qn5NHQgs2iJ1SDyTdptHSyPUhx4SpCTfvjUwldfI=";
   };
 
-  vendorSha256 = "sha256-WxLQfu65Gr+ao/pM8B2uiS88sNT72Klhz7ZIrEadW5g=";
+  vendorSha256 = "sha256-8CvtqnXSKoK/SA0tc/0Duv3pmYT69/3a/HFvAr4KNJo=";
 
   ldflags = [ "-X github.com/docker/compose/v2/internal.Version=${version}" "-s" "-w" ];
 
diff --git a/pkgs/data/icons/qogir-icon-theme/default.nix b/pkgs/data/icons/qogir-icon-theme/default.nix
index 24ad687834e..e2f3e6cb3bb 100644
--- a/pkgs/data/icons/qogir-icon-theme/default.nix
+++ b/pkgs/data/icons/qogir-icon-theme/default.nix
@@ -1,20 +1,30 @@
 { lib
 , stdenvNoCC
 , fetchFromGitHub
+, gitUpdater
 , gtk3
 , hicolor-icon-theme
 , jdupes
+, colorVariants ? [] # default is all
+, themeVariants ? [] # default is all
 }:
 
-stdenvNoCC.mkDerivation rec {
+let
   pname = "qogir-icon-theme";
-  version = "2022-01-12";
+
+in
+lib.checkListOfEnum "${pname}: color variants" [ "default" "dark" "all" ] colorVariants
+lib.checkListOfEnum "${pname}: theme variants" [ "default" "manjaro" "ubuntu" "all" ] themeVariants
+
+stdenvNoCC.mkDerivation rec {
+  inherit pname;
+  version = "2022-07-20";
 
   src = fetchFromGitHub {
     owner = "vinceliuice";
     repo = pname;
     rev = version;
-    sha256 = "1daayxsqh7di3bvfnl39h1arsj1fypd3ba30mas6dl1d0qy17z1p";
+    sha256 = "sha256-I+eojCTR3fXcp7v5Bdie9vstmJja9HB71aQSF5jLDD4=";
   };
 
   nativeBuildInputs = [ gtk3 jdupes ];
@@ -27,15 +37,27 @@ stdenvNoCC.mkDerivation rec {
   dontPatchELF = true;
   dontRewriteSymlinks = true;
 
+  postPatch = ''
+    patchShebangs install.sh
+  '';
+
   installPhase = ''
     runHook preInstall
-    patchShebangs install.sh
+
     mkdir -p $out/share/icons
-    name= ./install.sh -d $out/share/icons
-    jdupes -L -r $out/share/icons
+
+    name= ./install.sh \
+      ${lib.optionalString (themeVariants != []) ("--theme " + builtins.toString themeVariants)} \
+      ${lib.optionalString (colorVariants != []) ("--color " + builtins.toString colorVariants)} \
+      --dest $out/share/icons
+
+    jdupes --quiet --link-soft --recurse $out/share
+
     runHook postInstall
   '';
 
+  passthru.updateScript = gitUpdater { inherit pname version; };
+
   meta = with lib; {
     description = "Flat colorful design icon theme";
     homepage = "https://github.com/vinceliuice/Qogir-icon-theme";
diff --git a/pkgs/data/themes/colloid-gtk-theme/default.nix b/pkgs/data/themes/colloid-gtk-theme/default.nix
new file mode 100644
index 00000000000..dabe19d68d7
--- /dev/null
+++ b/pkgs/data/themes/colloid-gtk-theme/default.nix
@@ -0,0 +1,76 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+, gitUpdater
+, gnome-themes-extra
+, gtk-engine-murrine
+, jdupes
+, sassc
+, themeVariants ? [] # default: blue
+, colorVariants ? [] # default: all
+, sizeVariants ? [] # default: standard
+, tweaks ? []
+}:
+
+let
+  pname = "colloid-gtk-theme";
+
+in
+lib.checkListOfEnum "${pname}: theme variants" [ "default" "purple" "pink" "red" "orange" "yellow" "green" "teal" "grey" "all" ] themeVariants
+lib.checkListOfEnum "${pname}: color variants" [ "standard" "light" "dark" ] colorVariants
+lib.checkListOfEnum "${pname}: size variants" [ "standard" "compact" ] sizeVariants
+lib.checkListOfEnum "${pname}: tweaks" [ "nord" "black" "dracula" "rimless" "normal" ] tweaks
+
+stdenvNoCC.mkDerivation rec {
+  inherit pname;
+  version = "2022-07-18";
+
+  src = fetchFromGitHub {
+    owner = "vinceliuice";
+    repo = pname;
+    rev = version;
+    hash = "sha256-dWYRTwfQRMBdg+htxpWatF325rToaovF/43LxX6I1GI=";
+  };
+
+  nativeBuildInputs = [
+    jdupes
+    sassc
+  ];
+
+  buildInputs = [
+    gnome-themes-extra
+  ];
+
+  propagatedUserEnvPkgs = [
+    gtk-engine-murrine
+  ];
+
+  postPatch = ''
+    patchShebangs install.sh clean-old-theme.sh
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    name= HOME="$TMPDIR" ./install.sh \
+      ${lib.optionalString (themeVariants != []) "--theme " + builtins.toString themeVariants} \
+      ${lib.optionalString (colorVariants != []) "--color " + builtins.toString colorVariants} \
+      ${lib.optionalString (sizeVariants != []) "--size " + builtins.toString sizeVariants} \
+      ${lib.optionalString (tweaks != []) "--tweaks " + builtins.toString tweaks} \
+      --dest $out/share/themes
+
+    jdupes --link-soft --recurse $out/share
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = gitUpdater { inherit pname version; };
+
+  meta = with lib; {
+    description = "A modern and clean Gtk theme";
+    homepage = "https://github.com/vinceliuice/Colloid-gtk-theme";
+    license = licenses.gpl3Only;
+    platforms = platforms.unix;
+    maintainers = [ maintainers.romildo ];
+  };
+}
diff --git a/pkgs/data/themes/qogir-kde/default.nix b/pkgs/data/themes/qogir-kde/default.nix
new file mode 100644
index 00000000000..30ef4ed82d3
--- /dev/null
+++ b/pkgs/data/themes/qogir-kde/default.nix
@@ -0,0 +1,48 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+, gitUpdater
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "qogir-kde";
+  version = "unstable-2022-07-08";
+
+  src = fetchFromGitHub {
+    owner = "vinceliuice";
+    repo = pname;
+    rev = "f240eae10978c7fee518f7a8be1c41a21a9d5c2e";
+    hash = "sha256-AV60IQWwgvLwDO3ylILwx1DkKadwo4isn3JX3WpKoxQ=";
+  };
+
+  postPatch = ''
+    patchShebangs install.sh
+
+    substituteInPlace install.sh \
+      --replace '$HOME/.local' $out \
+      --replace '$HOME/.config' $out/share
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/plasma/plasmoids
+
+    name= HOME="$TMPDIR" ./install.sh --dest $out/share/themes
+
+    mkdir -p $out/share/sddm/themes
+    cp -a sddm/Qogir $out/share/sddm/themes/
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = gitUpdater { inherit pname version; };
+
+  meta = with lib; {
+    description = "A flat Design theme for KDE Plasma desktop";
+    homepage = "https://github.com/vinceliuice/Qogir-kde";
+    license = licenses.gpl3Only;
+    platforms = platforms.all;
+    maintainers = [ maintainers.romildo ];
+  };
+}
diff --git a/pkgs/desktops/xfce/applications/catfish/default.nix b/pkgs/desktops/xfce/applications/catfish/default.nix
index 7d5ef0a288c..d58ae684fcb 100644
--- a/pkgs/desktops/xfce/applications/catfish/default.nix
+++ b/pkgs/desktops/xfce/applications/catfish/default.nix
@@ -1,15 +1,29 @@
-{ lib, fetchurl, file, which, intltool, gobject-introspection,
-  findutils, xdg-utils, dconf, gtk3, python3Packages, xfconf,
-  wrapGAppsHook
+{ lib
+, fetchFromGitLab
+, gitUpdater
+, file
+, which
+, intltool
+, gobject-introspection
+, findutils
+, xdg-utils
+, dconf
+, gtk3
+, python3Packages
+, xfconf
+, wrapGAppsHook
 }:
 
 python3Packages.buildPythonApplication rec {
   pname = "catfish";
-  version = "4.16.3";
+  version = "4.16.4";
 
-  src = fetchurl {
-    url = "https://archive.xfce.org/src/apps/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-6amaYtEJgTkVCN1D88v6LVCmm9a30e7vfTC6TGc9z9o=";
+  src = fetchFromGitLab {
+    domain = "gitlab.xfce.org";
+    owner = "apps";
+    repo = pname;
+    rev = "${pname}-${version}";
+    sha256 = "sha256-hdrEFdBa/4i/PF7VyEI7ObiJXLIRW+RFSe8yGnUpqRc=";
   };
 
   nativeBuildInputs = [
@@ -51,6 +65,11 @@ python3Packages.buildPythonApplication rec {
   # Disable check because there is no test in the source distribution
   doCheck = false;
 
+  passthru.updateScript = gitUpdater {
+    inherit pname version;
+    rev-prefix = "${pname}-";
+  };
+
   meta = with lib; {
     homepage = "https://docs.xfce.org/apps/catfish/start";
     description = "Handy file search tool";
diff --git a/pkgs/development/libraries/gobject-introspection/wrapper.nix b/pkgs/development/libraries/gobject-introspection/wrapper.nix
index 87ed44f9db1..9e8f20ce146 100644
--- a/pkgs/development/libraries/gobject-introspection/wrapper.nix
+++ b/pkgs/development/libraries/gobject-introspection/wrapper.nix
@@ -1,13 +1,22 @@
 { lib
 , stdenv
 , buildPackages
-, gobject-introspection-unwrapped
 , targetPackages
-}:
+, gobject-introspection-unwrapped
+, ...
+}@_args:
 
 # to build, run
 # `nix build ".#pkgsCross.aarch64-multiplatform.buildPackages.gobject-introspection"`
-gobject-introspection-unwrapped.overrideAttrs (previousAttrs: {
+
+let
+  # ensure that `.override` works when gobject-introspection == gobject-introspection-wrapped
+  args = builtins.removeAttrs _args [ "buildPackages" "targetPackages" "gobject-introspection-unwrapped" ];
+  # passing this stdenv to `targetPackages...` breaks due to splicing not working in `.override``
+  argsForTarget = builtins.removeAttrs args [ "stdenv" ];
+in
+
+(gobject-introspection-unwrapped.override args).overrideAttrs (previousAttrs: {
   pname = "gobject-introspection-wrapped";
   # failure in e.g. pkgsCross.aarch64-multiplatform.polkit
   # subprocess.CalledProcessError: Command '['/nix/store/...-prelink-unstable-2019-06-24/bin/prelink-rtld', '/build/source/build/tmp-introspectzp2ldkyk/PolkitAgent-1.0']' returned non-zero exit status 127.
@@ -21,7 +30,7 @@ gobject-introspection-unwrapped.overrideAttrs (previousAttrs: {
       export emulator=${lib.escapeShellArg (stdenv.targetPlatform.emulator buildPackages)}
       export buildprelink="${buildPackages.prelink}/bin/prelink-rtld"
 
-      export targetgir="${lib.getDev targetPackages.gobject-introspection-unwrapped}"
+      export targetgir="${lib.getDev (targetPackages.gobject-introspection-unwrapped.override argsForTarget)}"
 
       substituteAll "${./wrappers/g-ir-compiler.sh}" "$dev/bin/g-ir-compiler"
       substituteAll "${./wrappers/g-ir-scanner.sh}" "$dev/bin/g-ir-scanner"
diff --git a/pkgs/development/libraries/libplacebo/default.nix b/pkgs/development/libraries/libplacebo/default.nix
index 807b69f17f2..73d97a47655 100644
--- a/pkgs/development/libraries/libplacebo/default.nix
+++ b/pkgs/development/libraries/libplacebo/default.nix
@@ -50,6 +50,8 @@ stdenv.mkDerivation rec {
     "-Dvulkan-registry=${vulkan-headers}/share/vulkan/registry/vk.xml"
     "-Ddemos=false" # Don't build and install the demo programs
     "-Dd3d11=disabled" # Disable the Direct3D 11 based renderer
+  ] ++ lib.optionals stdenv.isDarwin [
+    "-Dunwind=disabled" # libplacebo doesn’t build with `darwin.libunwind`
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/physics/herwig/default.nix b/pkgs/development/libraries/physics/herwig/default.nix
index 1c3bfaa2064..569f8d80e54 100644
--- a/pkgs/development/libraries/physics/herwig/default.nix
+++ b/pkgs/development/libraries/physics/herwig/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "herwig";
-  version = "7.2.2";
+  version = "7.2.3";
 
   src = fetchurl {
     url = "https://www.hepforge.org/archive/herwig/Herwig-${version}.tar.bz2";
-    sha256 = "10y3fb33zsinr0z3hzap9rsbcqhy1yjqnv4b4vz21g7mdlw6pq2k";
+    hash = "sha256-VZmJk3mwGwnjMaJCbXjTm39uwSbbJUPp00Cu/mqlD4Q=";
   };
 
   nativeBuildInputs = [ autoconf automake libtool gfortran ];
@@ -17,6 +17,10 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     patchShebangs ./
+
+    # Fix failing "make install" being unable to find HwEvtGenInterface.so
+    substituteInPlace src/defaults/decayers.in.in \
+      --replace "read EvtGenDecayer.in" ""
   '';
 
   configureFlags = [
diff --git a/pkgs/development/libraries/physics/thepeg/default.nix b/pkgs/development/libraries/physics/thepeg/default.nix
index ed92889b5b2..adef606be54 100644
--- a/pkgs/development/libraries/physics/thepeg/default.nix
+++ b/pkgs/development/libraries/physics/thepeg/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "thepeg";
-  version = "2.2.2";
+  version = "2.2.3";
 
   src = fetchurl {
     url = "https://www.hepforge.org/archive/thepeg/ThePEG-${version}.tar.bz2";
-    sha256 = "0gif4vb9lw2px2qdywqm7x0frbv0h5gq9lq36c50f2hv77a5bgwp";
+    hash = "sha256-8hRzGXp2H8MpF7CKjSTSv6+T/1fzRB/WBdqZrJ3l1Qs=";
   };
 
   buildInputs = [ boost fastjet gsl hepmc2 lhapdf rivet zlib ];
diff --git a/pkgs/development/python-modules/afsapi/default.nix b/pkgs/development/python-modules/afsapi/default.nix
index 4df1dba8dd1..323c0a22531 100644
--- a/pkgs/development/python-modules/afsapi/default.nix
+++ b/pkgs/development/python-modules/afsapi/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "afsapi";
-  version = "0.2.6";
+  version = "0.2.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "wlcrs";
     repo = "python-afsapi";
     rev = "refs/tags/${version}";
-    hash = "sha256-SPHED/zbrjULtJFz1x+0kq+lDrLeuol+1rOH2/xWEnI=";
+    hash = "sha256-TTZk/8mfG5lBr8SyMbqSaYDskWKnUlMkAUp94DXPCKo=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/plantuml/default.nix b/pkgs/development/python-modules/plantuml/default.nix
new file mode 100644
index 00000000000..f887453bd68
--- /dev/null
+++ b/pkgs/development/python-modules/plantuml/default.nix
@@ -0,0 +1,36 @@
+{ buildPythonPackage
+, fetchFromGitHub
+, lib
+  # Runtime dependencies
+, httplib2
+, six
+}:
+
+buildPythonPackage {
+  pname = "plantuml";
+  version = "0.3.0";
+
+  src = fetchFromGitHub {
+    owner = "dougn";
+    repo = "python-plantuml";
+    rev = "93e1aac25b17d896b0d05d0a1aa352c7bd11dd31";
+    sha256 = "sha256-aPXPqoKlu8VLi0Jn84brG7v3qM9L18Ut4sabYYGb3qQ=";
+  };
+
+  propagatedBuildInputs = [
+    httplib2
+    six
+  ];
+
+  # Project does not contain a test suite
+  doCheck = false;
+
+  pythonImportsCheck = [ "plantuml" ];
+
+  meta = with lib; {
+    description = "Python interface to a plantuml web service instead of having to run java locally";
+    homepage = "https://github.com/dougn/python-plantuml";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ nikstur ];
+  };
+}
diff --git a/pkgs/development/python-modules/snowflake-sqlalchemy/default.nix b/pkgs/development/python-modules/snowflake-sqlalchemy/default.nix
index b2b6f92a01a..6d30f143ce2 100644
--- a/pkgs/development/python-modules/snowflake-sqlalchemy/default.nix
+++ b/pkgs/development/python-modules/snowflake-sqlalchemy/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "snowflake-sqlalchemy";
-  version = "1.3.4";
+  version = "1.4.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-nXTPnWChj/rIMmPoVZr1AhY7tHVRygmpNmh1oGR6W4A=";
+    sha256 = "sha256-9IooTfzXRmOE22huBSduM4kX8ltI6F50nvkUnXRkAFo=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/ijq/default.nix b/pkgs/development/tools/ijq/default.nix
index 528294ac4e1..a51518968d2 100644
--- a/pkgs/development/tools/ijq/default.nix
+++ b/pkgs/development/tools/ijq/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "ijq";
-  version = "0.3.8";
+  version = "0.4.0";
 
   src = fetchFromSourcehut {
     owner = "~gpanders";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-N4wrm0nUmQ0NTsLkomJrcSiYJWgFUEh1/yn3pagM9vI=";
+    sha256 = "sha256-EQfCEdQIrjg38JjjePNDNWKi0cFezjYvIGVJajbf9jw=";
   };
 
   vendorSha256 = "sha256-DX8m5FsqMZnzk1wgJA/ESZl0QeDv3p9huF4h1HY9DIA=";
diff --git a/pkgs/development/tools/millet/default.nix b/pkgs/development/tools/millet/default.nix
index 7d95607b618..57dee681094 100644
--- a/pkgs/development/tools/millet/default.nix
+++ b/pkgs/development/tools/millet/default.nix
@@ -1,22 +1,17 @@
-{ lib, rustPlatform, fetchFromGitHub, rustfmt }:
+{ lib, rustPlatform, fetchFromGitHub }:
 
 rustPlatform.buildRustPackage rec {
   pname = "millet";
-  version = "0.2.5";
+  version = "0.2.7";
 
   src = fetchFromGitHub {
     owner = "azdavis";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-HnVvq6Tb0yDvoa0KxZHZG0Tm0CWYWsn9unj0v0zYuTw=";
+    sha256 = "sha256-+4lMRd4pzbkRDct5kz17MB9drN6sEtYLk29d6TlubLk=";
   };
 
-  cargoSha256 = "sha256-cbp4eAcqKuUKKqmlS2Azo5NRHDy+F4LNwcrwbFj+Z5g=";
-
-  nativeBuildInputs = [
-    # Required for `syntax-gen` crate https://github.com/azdavis/language-util/blob/8ec2dc509c88951102ad3e751820443059a363af/crates/syntax-gen/src/util.rs#L37
-    rustfmt
-  ];
+  cargoSha256 = "sha256-MoXKNUgNeg2AG7G78wnZvLXADhCsK/WB5WiT5lTSmIQ=";
 
   cargoBuildFlags = [ "--package" "lang-srv" ];
 
diff --git a/pkgs/development/tools/misc/drush/default.nix b/pkgs/development/tools/misc/drush/default.nix
index 8cafab36f2a..c06a566fb59 100644
--- a/pkgs/development/tools/misc/drush/default.nix
+++ b/pkgs/development/tools/misc/drush/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "drush";
-  version = "8.4.10";
+  version = "8.4.11";
 
   src = fetchurl {
     url = "https://github.com/drush-ops/drush/releases/download/${version}/drush.phar";
-    sha256 = "sha256-yXSoTDFLsjDiYkRfrIxv2WTVdHzgxZRvtn3Pht5XF4k=";
+    sha256 = "sha256-4DD16PQHGZzAGwmm/WNeZ/dDKnlQslcb35AkpiJs5tQ=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/development/tools/misc/netcoredbg/default.nix b/pkgs/development/tools/misc/netcoredbg/default.nix
index c57b421dbef..d736e4a1d29 100644
--- a/pkgs/development/tools/misc/netcoredbg/default.nix
+++ b/pkgs/development/tools/misc/netcoredbg/default.nix
@@ -30,7 +30,9 @@ let
     hardeningDisable = [ "strictoverflow" ];
 
     preConfigure = ''
+      export DOTNET_SYSTEM_GLOBALIZATION_INVARIANT=1
       dotnetVersion="$(${dotnet-sdk}/bin/dotnet --list-runtimes | grep -Po '^Microsoft.NETCore.App \K.*?(?= )')"
+
       cmakeFlagsArray+=(
         "-DDBGSHIM_RUNTIME_DIR=${dotnet-sdk}/shared/Microsoft.NETCore.App/$dotnetVersion"
       )
diff --git a/pkgs/development/tools/misc/polylith/default.nix b/pkgs/development/tools/misc/polylith/default.nix
index a48f629ad63..3d28ffa5238 100644
--- a/pkgs/development/tools/misc/polylith/default.nix
+++ b/pkgs/development/tools/misc/polylith/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "polylith";
-  version = "0.2.13-alpha";
+  version = "0.2.14-alpha";
 
   src = fetchurl {
     url = "https://github.com/polyfy/polylith/releases/download/v${version}/poly-${version}.jar";
-    sha256 = "sha256-iLN92qurc8+D0pt7Hwag+TFGoeFl9DvEeS67sKmmoSI=";
+    sha256 = "sha256-0yJLSveKd49nBnCtBVfwcACXfIH43ZgqTLoo2aLPE2g=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/development/tools/okteto/default.nix b/pkgs/development/tools/okteto/default.nix
index ec4974876cb..1e9ae945200 100644
--- a/pkgs/development/tools/okteto/default.nix
+++ b/pkgs/development/tools/okteto/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "okteto";
-  version = "2.4.0";
+  version = "2.5.0";
 
   src = fetchFromGitHub {
     owner = "okteto";
     repo = "okteto";
     rev = version;
-    sha256 = "sha256-+shhY7/chtq4xPwYSlcVgL/RGMNA0ahTCqT9pVQqpG4=";
+    sha256 = "sha256-jcGnkLut8MlMqdWQxj/M6vQgIf3e7qFv8dJ1j6bEqj8=";
   };
 
   vendorSha256 = "sha256-W1/QBMnMdZWokWSFmHhPqmOu827bpGXS8+GFp5Iu9Ig=";
diff --git a/pkgs/development/tools/stylua/default.nix b/pkgs/development/tools/stylua/default.nix
index 3bba34c531e..60d37177682 100644
--- a/pkgs/development/tools/stylua/default.nix
+++ b/pkgs/development/tools/stylua/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "stylua";
-  version = "0.14.0";
+  version = "0.14.1";
 
   src = fetchFromGitHub {
     owner = "johnnymorganz";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-G7fCLkvpO5GHqWCfy2m3GxSgDSHCcYOaXyPDtdmdSY0=";
+    sha256 = "sha256-SoO5xujSPe+6TOBvPt09sm77cRUU4s9nYjR1EOpcTBY=";
   };
 
-  cargoSha256 = "sha256-MqRoGuRMEgOYvL2VI324EXZjrPVCbCE/c7aVEXr0xmw=";
+  cargoSha256 = "sha256-L8nGAT7HoI67kxX+vf++iQ0NzY4hNW/H32LL6WZSJM4=";
 
   buildFeatures = lib.optional lua52Support "lua52"
     ++ lib.optional luauSupport "luau";
diff --git a/pkgs/games/oh-my-git/default.nix b/pkgs/games/oh-my-git/default.nix
index 0da53bbf9aa..cd4fd216eaa 100644
--- a/pkgs/games/oh-my-git/default.nix
+++ b/pkgs/games/oh-my-git/default.nix
@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation rec {
   pname = "oh-my-git";
-  version = "0.6.4";
+  version = "0.6.5";
 
   src = fetchFromGitHub {
     owner = "git-learning-game";
     repo = "oh-my-git";
     rev = version;
-    sha256 = "sha256-GQLHyBUXF+yqEZ/LYutAn6TBCXFX8ViOaERQEm2J6CY=";
+    sha256 = "sha256-XqxliMVU55D5JSt7Yo5btvZnnTlagSukyhXv6Akgklo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/darwin/moltenvk/MoltenVK.xcodeproj.patch b/pkgs/os-specific/darwin/moltenvk/MoltenVK.xcodeproj.patch
index abbb3b8fb0e..e4b03dfe0cc 100644
--- a/pkgs/os-specific/darwin/moltenvk/MoltenVK.xcodeproj.patch
+++ b/pkgs/os-specific/darwin/moltenvk/MoltenVK.xcodeproj.patch
@@ -86,61 +86,3 @@ index c23afce4..12ac12f4 100644
  /* Begin XCBuildConfiguration section */
  		2FEA0AB824902F9F00EEF3AD /* Debug */ = {
  			isa = XCBuildConfiguration;
-@@ -1586,11 +1544,12 @@
- 				GCC_WARN_UNUSED_VARIABLE = YES;
- 				GENERATE_MASTER_OBJECT_FILE = YES;
- 				HEADER_SEARCH_PATHS = (
--					"\"$(SRCROOT)/include\"",
--					"\"$(SRCROOT)/../MoltenVKShaderConverter\"",
--					"\"$(SRCROOT)/../MoltenVKShaderConverter/SPIRV-Cross\"",
--					"\"$(SRCROOT)/../External/cereal/include\"",
--					"\"${BUILT_PRODUCTS_DIR}\"",
-+					"@@sourceRoot@@/outputs/include",
-+					"@@sourceRoot@@/outputs/include/simd_workaround",
-+					"@@sourceRoot@@/MoltenVKShaderConverter",
-+					"@@cereal@@/include",
-+					"@@spirv-cross@@/include/spirv_cross",
-+					"@@vulkan-headers@@/include",
- 				);
- 				IPHONEOS_DEPLOYMENT_TARGET = 9.0;
- 				MACH_O_TYPE = staticlib;
-@@ -1600,6 +1559,10 @@
- 				MVK_SKIP_DYLIB = "";
- 				"MVK_SKIP_DYLIB[sdk=appletvsimulator*]" = YES;
- 				"MVK_SKIP_DYLIB[sdk=iphonesimulator*]" = YES;
-+				OTHER_CFLAGS = (
-+					"-isystem",
-+					"@@libcxx@@/include/c++/v1",
-+				);
- 				PRELINK_LIBS = "${CONFIGURATION_BUILD_DIR}/libMoltenVKShaderConverter.a";
- 				PRODUCT_NAME = MoltenVK;
- 				SKIP_INSTALL = YES;
-@@ -1658,11 +1621,12 @@
- 				GCC_WARN_UNUSED_VARIABLE = YES;
- 				GENERATE_MASTER_OBJECT_FILE = YES;
- 				HEADER_SEARCH_PATHS = (
--					"\"$(SRCROOT)/include\"",
--					"\"$(SRCROOT)/../MoltenVKShaderConverter\"",
--					"\"$(SRCROOT)/../MoltenVKShaderConverter/SPIRV-Cross\"",
--					"\"$(SRCROOT)/../External/cereal/include\"",
--					"\"${BUILT_PRODUCTS_DIR}\"",
-+					"@@sourceRoot@@/outputs/include",
-+					"@@sourceRoot@@/outputs/include/simd_workaround",
-+					"@@sourceRoot@@/MoltenVKShaderConverter",
-+					"@@cereal@@/include",
-+					"@@spirv-cross@@/include/spirv_cross",
-+					"@@vulkan-headers@@/include",
- 				);
- 				IPHONEOS_DEPLOYMENT_TARGET = 9.0;
- 				MACH_O_TYPE = staticlib;
-@@ -1672,6 +1636,10 @@
- 				MVK_SKIP_DYLIB = "";
- 				"MVK_SKIP_DYLIB[sdk=appletvsimulator*]" = YES;
- 				"MVK_SKIP_DYLIB[sdk=iphonesimulator*]" = YES;
-+				OTHER_CFLAGS = (
-+					"-isystem",
-+					"@@libcxx@@/include/c++/v1",
-+				);
- 				PRELINK_LIBS = "${CONFIGURATION_BUILD_DIR}/libMoltenVKShaderConverter.a";
- 				PRODUCT_NAME = MoltenVK;
- 				SKIP_INSTALL = YES;
diff --git a/pkgs/os-specific/darwin/moltenvk/MoltenVKShaderConverter.xcodeproj.patch b/pkgs/os-specific/darwin/moltenvk/MoltenVKShaderConverter.xcodeproj.patch
index 7a7ec7afa2e..ecc5242684d 100644
--- a/pkgs/os-specific/darwin/moltenvk/MoltenVKShaderConverter.xcodeproj.patch
+++ b/pkgs/os-specific/darwin/moltenvk/MoltenVKShaderConverter.xcodeproj.patch
@@ -82,99 +82,3 @@ index c7842b63..d55f73ed 100644
  			productReference = A93903C71C57E9ED00FE90DC /* libMoltenVKShaderConverter.a */;
  			productType = "com.apple.product-type.library.static";
  		};
-@@ -536,6 +518,17 @@
- 				OTHER_LDFLAGS = (
- 					"-ObjC",
- 					"-w",
-+					"-lMachineIndependent",
-+					"-lGenericCodeGen",
-+					"-lOGLCompiler",
-+					"-lglslang",
-+					"-lOSDependent",
-+					"-lSPIRV",
-+					"-lSPIRV-Tools",
-+					"-lSPIRV-Tools-opt",
-+					"-lspirv-cross-msl",
-+					"-lspirv-cross-core",
-+					"-lspirv-cross-glsl",
- 				);
- 				SDKROOT = macosx;
- 			};
-@@ -548,6 +541,17 @@
- 				OTHER_LDFLAGS = (
- 					"-ObjC",
- 					"-w",
-+					"-lMachineIndependent",
-+					"-lGenericCodeGen",
-+					"-lOGLCompiler",
-+					"-lglslang",
-+					"-lOSDependent",
-+					"-lSPIRV",
-+					"-lSPIRV-Tools",
-+					"-lSPIRV-Tools-opt",
-+					"-lspirv-cross-msl",
-+					"-lspirv-cross-core",
-+					"-lspirv-cross-glsl",
- 				);
- 				SDKROOT = macosx;
- 			};
-@@ -624,15 +628,24 @@
- 				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
- 				GCC_WARN_UNUSED_FUNCTION = YES;
- 				HEADER_SEARCH_PATHS = (
--					"$(inherited)",
--					"\"$(SRCROOT)\"",
--					"\"$(SRCROOT)/SPIRV-Cross\"",
--					"\"$(SRCROOT)/glslang\"",
--					"\"$(SRCROOT)/glslang/External/spirv-tools/include\"",
-+					"@@sourceRoot@@/Common",
-+					"@@glslang@@/include",
-+					"@@spirv-cross@@/include/spirv_cross",
-+					"@@spirv-tools@@/include",
-+					"@@spirv-headers@@/include/spirv/unified1/",
- 				);
- 				IPHONEOS_DEPLOYMENT_TARGET = 9.0;
-+				LIBRARY_SEARCH_PATHS = (
-+					"@@glslang@@/lib",
-+					"@@spirv-cross@@/lib",
-+					"@@spirv-tools@@/lib",
-+				);
- 				MACH_O_TYPE = staticlib;
- 				MACOSX_DEPLOYMENT_TARGET = 10.11;
-+				OTHER_CFLAGS = (
-+					"-isystem",
-+					"@@libcxx@@/include/c++/v1",
-+				);
- 				PRODUCT_NAME = MoltenVKShaderConverter;
- 				SKIP_INSTALL = YES;
- 				TVOS_DEPLOYMENT_TARGET = 9.0;
-@@ -683,15 +696,24 @@
- 				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
- 				GCC_WARN_UNUSED_FUNCTION = YES;
- 				HEADER_SEARCH_PATHS = (
--					"$(inherited)",
--					"\"$(SRCROOT)\"",
--					"\"$(SRCROOT)/SPIRV-Cross\"",
--					"\"$(SRCROOT)/glslang\"",
--					"\"$(SRCROOT)/glslang/External/spirv-tools/include\"",
-+					"@@sourceRoot@@/Common",
-+					"@@glslang@@/include",
-+					"@@spirv-cross@@/include/spirv_cross",
-+					"@@spirv-tools@@/include",
-+					"@@spirv-headers@@/include/spirv/unified1/",
- 				);
- 				IPHONEOS_DEPLOYMENT_TARGET = 9.0;
-+				LIBRARY_SEARCH_PATHS = (
-+					"@@glslang@@/lib",
-+					"@@spirv-cross@@/lib",
-+					"@@spirv-tools@@/lib",
-+				);
- 				MACH_O_TYPE = staticlib;
- 				MACOSX_DEPLOYMENT_TARGET = 10.11;
-+				OTHER_CFLAGS = (
-+					"-isystem",
-+					"@@libcxx@@/include/c++/v1",
-+				);
- 				PRODUCT_NAME = MoltenVKShaderConverter;
- 				SKIP_INSTALL = YES;
- 				TVOS_DEPLOYMENT_TARGET = 9.0;
diff --git a/pkgs/os-specific/darwin/moltenvk/createDylib.patch b/pkgs/os-specific/darwin/moltenvk/createDylib.patch
deleted file mode 100644
index b4a990cd989..00000000000
--- a/pkgs/os-specific/darwin/moltenvk/createDylib.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/Scripts/create_dylib.sh b/Scripts/create_dylib.sh
-index 5ba75f67..a0405067 100755
---- a/Scripts/create_dylib.sh
-+++ b/Scripts/create_dylib.sh
-@@ -57,6 +57,8 @@ ${MVK_SAN} \
- -framework Metal ${MVK_IOSURFACE_FWK} -framework ${MVK_UX_FWK} -framework QuartzCore -framework CoreGraphics ${MVK_IOKIT_FWK} -framework Foundation \
- --library-directory ${MVK_USR_LIB_DIR} \
- -o "${MVK_BUILT_PROD_DIR}/dynamic/${MVK_DYLIB_NAME}" \
-+-L@@sourceRoot@@/outputs/lib -L@@glslang@@/lib -L@@spirv-tools@@/lib -L@@spirv-cross@@/lib \
-+-lobjc -lMoltenVKShaderConverter -lGenericCodeGen -lMachineIndependent -lOGLCompiler -lOSDependent -lSPIRV -lSPIRV-Tools -lSPIRV-Tools-opt -lspirv-cross-core -lspirv-cross-glsl -lspirv-cross-msl -lspirv-cross-reflect \
- -force_load "${MVK_BUILT_PROD_DIR}/lib${PRODUCT_NAME}.a"
-
- if test "$CONFIGURATION" = Debug; then
diff --git a/pkgs/os-specific/darwin/moltenvk/default.nix b/pkgs/os-specific/darwin/moltenvk/default.nix
index 0b3946a3f4b..1d8f89deff1 100644
--- a/pkgs/os-specific/darwin/moltenvk/default.nix
+++ b/pkgs/os-specific/darwin/moltenvk/default.nix
@@ -1,42 +1,34 @@
 { lib
+, overrideCC
 , stdenv
-, stdenvNoCC
 , fetchurl
 , fetchFromGitHub
 , cctools
 , sigtool
 , cereal
+, libcxx
 , glslang
 , spirv-cross
 , spirv-headers
 , spirv-tools
 , vulkan-headers
+, xcbuild
 , AppKit
 , Foundation
+, Libsystem
+, MacOSX-SDK
 , Metal
 , QuartzCore
 }:
 
-# Even though the derivation is currently impure, it is written to build successfully using
-# `xcbuild`.  Once the SDK on x86_64-darwin is updated, it should be possible to switch from being
-# an impure derivation.
-#
-# The `sandboxProfile` was copied from the iTerm2 derivation.  In order to build you at least need
-# the `sandbox` option set to `relaxed` or `false`.  Xcode should be available in the default
-# location.
-let
-  libcxx.dev = "/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr";
-in
-stdenvNoCC.mkDerivation (finalAttrs: {
+stdenv.mkDerivation (finalAttrs: {
   pname = "MoltenVK";
-  version = "1.1.9";
+  version = "1.1.10";
 
-  buildInputs = [
-    AppKit
-    Foundation
-    Metal
-    QuartzCore
-  ];
+  buildInputs = [ AppKit Foundation Metal QuartzCore cereal ]
+    ++ lib.attrValues finalAttrs.passthru;
+
+  nativeBuildInputs = [ cctools sigtool xcbuild ];
 
   outputs = [ "out" "bin" "dev" ];
 
@@ -47,47 +39,42 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       src = fetchFromGitHub {
         owner = "KhronosGroup";
         repo = "glslang";
-        rev = "9bb8cfffb0eed010e07132282c41d73064a7a609";
-        hash = "sha256-YLn/Mxuk6mXPGtBBgfwky5Nl1TCAW6i2g+AZLzqVz+A=";
+        rev = "adbf0d3106b26daa237b10b9bf72b1af7c31092d";
+        hash = "sha256-sjidkiPtRADhyOEKDb2cHCBXnFjLwk2F5Lppv5/fwNQ=";
       };
-    })).override {
-      inherit (finalAttrs.passthru) spirv-headers spirv-tools;
-    };
+    })).override { inherit (finalAttrs.passthru) spirv-headers spirv-tools; };
     spirv-cross = spirv-cross.overrideAttrs (old: {
-      cmakeFlags = (old.cmakeFlags or [ ]) ++ [
-        "-DSPIRV_CROSS_NAMESPACE_OVERRIDE=MVK_spirv_cross"
-      ];
+      cmakeFlags = (old.cmakeFlags or [ ])
+        ++ [ "-DSPIRV_CROSS_NAMESPACE_OVERRIDE=MVK_spirv_cross" ];
       src = fetchFromGitHub {
         owner = "KhronosGroup";
         repo = "SPIRV-Cross";
-        rev = "0d4ce028bf8b8a94d325dc1e1c20446153ba19c4";
-        hash = "sha256-OluTxOEfDIGMdrXhvIifjpMgZBvyh9ofLKxKt0dX5ZU=";
+        rev = "50b4d5389b6a06f86fb63a2848e1a7da6d9755ca";
+        hash = "sha256-SsupPHJ3VHxJhEAUl3EeQwN4texYhdDjxTnGD+bkNAw=";
       };
     });
     spirv-headers = spirv-headers.overrideAttrs (_: {
       src = fetchFromGitHub {
         owner = "KhronosGroup";
         repo = "spirv-headers";
-        rev = "4995a2f2723c401eb0ea3e10c81298906bf1422b";
-        hash = "sha256-LkIrTFWYvZffLVJJW3152um5LTEsMJEDEsIhBAdhBlk=";
+        rev = "5a121866927a16ab9d49bed4788b532c7fcea766";
+        hash = "sha256-X4GuFesX015mrzutguhZLrIGlllCgAZ+DUBGSADt8xU=";
       };
     });
     spirv-tools = (spirv-tools.overrideAttrs (old: {
       src = fetchFromGitHub {
         owner = "KhronosGroup";
         repo = "spirv-tools";
-        rev = "eed5c76a57bb965f2e1b56d1dc40b50910b5ec1d";
-        hash = "sha256-2Mr3HbhRslLpRfwHascl7e/UoPijhrij9Bjg3aCiqBM=";
+        rev = "b930e734ea198b7aabbbf04ee1562cf6f57962f0";
+        hash = "sha256-NWpFSRoxtYWi+hLUt9gpw0YScM3shcUwv9yUmbivRb0=";
       };
-    })).override {
-      inherit (finalAttrs.passthru) spirv-headers;
-    };
+    })).override { inherit (finalAttrs.passthru) spirv-headers; };
     vulkan-headers = vulkan-headers.overrideAttrs (old: {
       src = fetchFromGitHub {
         owner = "KhronosGroup";
         repo = "Vulkan-Headers";
-        rev = "76f00ef6cbb1886eb1162d1fa39bee8b51e22ee8";
-        hash = "sha256-FqrcFHsUS8e4ZgZpxVc8nNZWdNltniFmMjyyWVoNc7w=";
+        rev = "3ef4c97fd6ea001d75a8e9da408ee473c180e456";
+        hash = "sha256-jHzW3m9smuzEGbZrSyBI74K9rFozxiG3M5Xql/WOw7U=";
       };
     });
   };
@@ -96,92 +83,99 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     owner = "KhronosGroup";
     repo = "MoltenVK";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-5ie1IGzZqaYbciFnrBJ1/9V0LEuz7JsEOFXXkG3hJzg=";
+    hash = "sha256-LZvCCP2yelTaWcNt+WvG+RZnVLHRgMDTlNWwRIey7ZM=";
   };
 
   patches = [
-    # Specify the libraries to link directly since XCFrameworks are not being used.
-    ./createDylib.patch
-    # Move `mvkGitRevDerived.h` to a stable location
-    ./gitRevHeaderStability.patch
     # Fix the Xcode projects to play nicely with `xcbuild`.
     ./MoltenVKShaderConverter.xcodeproj.patch
     ./MoltenVK.xcodeproj.patch
   ];
 
   postPatch = ''
-    substituteInPlace MoltenVKShaderConverter/MoltenVKShaderConverter.xcodeproj/project.pbxproj \
-      --replace @@sourceRoot@@ $(pwd) \
-      --replace @@libcxx@@ "${libcxx.dev}" \
-      --replace @@glslang@@ "${finalAttrs.passthru.glslang}" \
-      --replace @@spirv-cross@@ "${finalAttrs.passthru.spirv-cross}" \
-      --replace @@spirv-tools@@ "${finalAttrs.passthru.glslang.spirv-tools}" \
-      --replace @@spirv-headers@@ "${finalAttrs.passthru.glslang.spirv-headers}"
-    substituteInPlace MoltenVK/MoltenVK.xcodeproj/project.pbxproj \
-      --replace @@sourceRoot@@ $(pwd) \
-      --replace @@libcxx@@ "${libcxx.dev}" \
-      --replace @@cereal@@ "${cereal}" \
-      --replace @@spirv-cross@@ "${finalAttrs.passthru.spirv-cross}" \
-      --replace @@vulkan-headers@@ "${finalAttrs.passthru.vulkan-headers}"
-    substituteInPlace Scripts/create_dylib.sh \
-      --replace @@sourceRoot@@ $(pwd) \
-      --replace @@glslang@@ "${finalAttrs.passthru.glslang}" \
-      --replace @@spirv-tools@@ "${finalAttrs.passthru.glslang.spirv-tools}" \
-      --replace @@spirv-cross@@ "${finalAttrs.passthru.spirv-cross}"
+    # Move `mvkGitRevDerived.h` to a stable location
     substituteInPlace Scripts/gen_moltenvk_rev_hdr.sh \
-      --replace @@sourceRoot@@ $(pwd) \
+      --replace '$'''{BUILT_PRODUCTS_DIR}' "$NIX_BUILD_TOP/$sourceRoot/build/include" \
       --replace '$(git rev-parse HEAD)' ${finalAttrs.src.rev}
+    # Adding all of `usr/include` from the SDK results in header conflicts with `libcxx.dev`.
+    # Work around it by symlinking just the SIMD stuff needed by MoltenVK.
+    mkdir -p build/include
+    ln -s "${MacOSX-SDK}/usr/include/simd" "build/include"
   '';
 
   dontConfigure = true;
 
+  NIX_CFLAGS_COMPILE = [
+    "-isystem ${lib.getDev libcxx}/include/c++/v1"
+    "-I${finalAttrs.passthru.spirv-cross}/include/spirv_cross"
+    "-I${finalAttrs.passthru.spirv-headers}/include/spirv/unified1/"
+  ];
+
   buildPhase = ''
+    NIX_CFLAGS_COMPILE+=" \
+      -I$NIX_BUILD_TOP/$sourceRoot/build/include \
+      -I$NIX_BUILD_TOP/$sourceRoot/Common"
+    NIX_LDFLAGS+=" -L$NIX_BUILD_TOP/$sourceRoot/build/lib"
+
     # Build each project on its own because `xcbuild` fails to build `MoltenVKPackaging.xcodeproj`.
-    derived_data_path=$(pwd)/DerivedData
+    build=$NIX_BUILD_TOP/$sourceRoot/build
+    mkdir -p "$build/bin" "$build/lib"
+
+    NIX_LDFLAGS+=" \
+      -lMachineIndependent \
+      -lGenericCodeGen \
+      -lOGLCompiler \
+      -lglslang \
+      -lOSDependent \
+      -lSPIRV \
+      -lSPIRV-Tools \
+      -lSPIRV-Tools-opt \
+      -lspirv-cross-msl \
+      -lspirv-cross-core \
+      -lspirv-cross-glsl"
+
     pushd MoltenVKShaderConverter
-      /usr/bin/xcodebuild build \
-        -jobs $NIX_BUILD_CORES \
-        -derivedDataPath "$derived_data_path" \
-        -configuration Release \
-        -project MoltenVKShaderConverter.xcodeproj \
-        -scheme MoltenVKShaderConverter \
-        -arch ${stdenv.targetPlatform.darwinArch}
-    popd
-    mkdir -p outputs/bin outputs/lib
-    declare -A outputs=( [MoltenVKShaderConverter]=bin [libMoltenVKShaderConverter.a]=lib )
-    for output in "''${!outputs[@]}"; do
-      cp DerivedData/Build/Products/Release/$output "outputs/''${outputs[$output]}/$output"
+    xcodebuild build \
+      -jobs $NIX_BUILD_CORES \
+      -configuration Release \
+      -project MoltenVKShaderConverter.xcodeproj \
+      -scheme MoltenVKShaderConverter \
+      -arch ${stdenv.targetPlatform.darwinArch}
+    declare -A products=( [MoltenVKShaderConverter]=bin [libMoltenVKShaderConverter.a]=lib )
+    for product in "''${!products[@]}"; do
+      cp MoltenVKShaderConverter-*/Build/Products/Release/$product "$build/''${products[$product]}/$product"
     done
+    popd
+
+    NIX_LDFLAGS+=" \
+      -lobjc \
+      -lMoltenVKShaderConverter \
+      -lspirv-cross-reflect"
 
     pushd MoltenVK
-      /usr/bin/xcodebuild build \
-        -jobs $NIX_BUILD_CORES \
-        -derivedDataPath "$derived_data_path" \
-        -configuration Release \
-        -project MoltenVK.xcodeproj \
-        -scheme MoltenVK-macOS \
-        -arch ${stdenv.targetPlatform.darwinArch}
+    xcodebuild build \
+      -jobs $NIX_BUILD_CORES \
+      -configuration Release \
+      -project MoltenVK.xcodeproj \
+      -scheme MoltenVK-macOS \
+      -arch ${stdenv.targetPlatform.darwinArch}
+    cp MoltenVK-*/Build/Products/Release/dynamic/libMoltenVK.dylib "$build/lib/libMoltenVK.dylib"
     popd
-    cp DerivedData/Build/Products/Release/dynamic/libMoltenVK.dylib outputs/lib/libMoltenVK.dylib
   '';
 
   installPhase = ''
     mkdir -p "$out/lib" "$out/share/vulkan/icd.d" "$bin/bin" "$dev/include/MoltenVK"
-    cp outputs/bin/MoltenVKShaderConverter "$bin/bin/"
-    cp outputs/lib/libMoltenVK.dylib "$out/lib/"
+    cp build/bin/MoltenVKShaderConverter "$bin/bin/"
+    cp build/lib/libMoltenVK.dylib "$out/lib/"
     cp MoltenVK/MoltenVK/API/* "$dev/include/MoltenVK"
-    ${cctools}/bin/install_name_tool -id "$out/lib/libMoltenVK.dylib" "$out/lib/libMoltenVK.dylib"
-    # FIXME: https://github.com/NixOS/nixpkgs/issues/148189
-    /usr/bin/codesign -s - -f "$out/lib/libMoltenVK.dylib"
     install -m644 MoltenVK/icd/MoltenVK_icd.json "$out/share/vulkan/icd.d/MoltenVK_icd.json"
     substituteInPlace $out/share/vulkan/icd.d/MoltenVK_icd.json \
       --replace ./libMoltenVK.dylib "$out/lib/libMoltenVK.dylib"
   '';
 
-  sandboxProfile = ''
-    (allow file-read* file-write* process-exec mach-lookup)
-    ; block homebrew dependencies
-    (deny file-read* file-write* process-exec mach-lookup (subpath "/usr/local") (with no-log))
+  postFixup = ''
+    install_name_tool -id "$out/lib/libMoltenVK.dylib" "$out/lib/libMoltenVK.dylib"
+    codesign -s - -f "$out/lib/libMoltenVK.dylib"
   '';
 
   meta = {
@@ -189,7 +183,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     homepage = "https://github.com/KhronosGroup/MoltenVK";
     changelog = "https://github.com/KhronosGroup/MoltenVK/releases";
     maintainers = [ lib.maintainers.reckenrode ];
-    hydraPlatforms = [ ]; # Prevent building on Hydra until MoltenVK no longer requires Xcode.
     license = lib.licenses.asl20;
     platforms = lib.platforms.darwin;
   };
diff --git a/pkgs/os-specific/darwin/moltenvk/gitRevHeaderStability.patch b/pkgs/os-specific/darwin/moltenvk/gitRevHeaderStability.patch
deleted file mode 100644
index e28b9ee70b6..00000000000
--- a/pkgs/os-specific/darwin/moltenvk/gitRevHeaderStability.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-diff --git a/Scripts/gen_moltenvk_rev_hdr.sh b/Scripts/gen_moltenvk_rev_hdr.sh
-index c49ea4e6..9b7d13d1 100755
---- a/Scripts/gen_moltenvk_rev_hdr.sh
-+++ b/Scripts/gen_moltenvk_rev_hdr.sh
-@@ -2,7 +2,7 @@
-
- # Record the MoltenVK GIT revision as a derived header file suitable for including in a build
- MVK_GIT_REV=$(git rev-parse HEAD)
--MVK_HDR_FILE="${BUILT_PRODUCTS_DIR}/mvkGitRevDerived.h"
-+MVK_HDR_FILE="@@sourceRoot@@/outputs/include/mvkGitRevDerived.h"
-+mkdir -p $(dirname ${MVK_HDR_FILE})
- echo "// Auto-generated by MoltenVK" > "${MVK_HDR_FILE}"
- echo "static const char* mvkRevString = \"${MVK_GIT_REV}\";" >> "${MVK_HDR_FILE}"
--
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index 0e00eac0bac..e8721c9eed0 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -22,41 +22,41 @@
     "5.10": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.10.130-hardened1.patch",
-            "sha256": "13wf4khc1nqljrvmc283145j6wxcd22qvqg8gwrjndqxlb5qb5bl",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.130-hardened1/linux-hardened-5.10.130-hardened1.patch"
+            "name": "linux-hardened-5.10.131-hardened1.patch",
+            "sha256": "00px04xyr8hz73rm0adc0x9fifwcyh2bh0rg0vqc1yjva4kl639d",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.131-hardened1/linux-hardened-5.10.131-hardened1.patch"
         },
-        "sha256": "0b4nm96yvkb9r5rkwlq9vsmllzqvvffdnpyl8dvrgqm8a7caci71",
-        "version": "5.10.130"
+        "sha256": "1ki11mvl3dky7iih90znr47vr66dxnlwrqwg2jkk1hqn5i243i4b",
+        "version": "5.10.131"
     },
     "5.15": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.15.54-hardened1.patch",
-            "sha256": "1zk6lgm9hg4m7pp16l8dhdv4pf0c1x94sfaah1ppjlq8i64704hd",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.54-hardened1/linux-hardened-5.15.54-hardened1.patch"
+            "name": "linux-hardened-5.15.55-hardened1.patch",
+            "sha256": "1nqf97la1sryis600pac0hnivahbhzq1k5q73wg9nmzrc0qjz5w0",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.55-hardened1/linux-hardened-5.15.55-hardened1.patch"
         },
-        "sha256": "0kffavh9mbycqljacmvjd04nfrl4r4v8i0zgvq49qgm7n25m8ksr",
-        "version": "5.15.54"
+        "sha256": "1k7x7fp675wglfd357n7hjidnm3j8zj3gcymyazg6fkcid8bvxhy",
+        "version": "5.15.55"
     },
     "5.18": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.18.11-hardened1.patch",
-            "sha256": "19g8w933srq3p3zsi38j26cda5a43lzkhhla4pcbd54kmvwjyyjl",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.18.11-hardened1/linux-hardened-5.18.11-hardened1.patch"
+            "name": "linux-hardened-5.18.12-hardened1.patch",
+            "sha256": "07wap8qjjn21pxd04ll88kw6cq681ila46ji7i4jbad2dp3p5pcl",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.18.12-hardened1/linux-hardened-5.18.12-hardened1.patch"
         },
-        "sha256": "1bqm32nqas1dvcx5b0qh3cshh3gcmpl8wbkn4adhgxw2lxa8w3g2",
-        "version": "5.18.11"
+        "sha256": "09wmgfrnv1df6jg9v3svwhvnxl0j6h4f240p903xlmgj884lvds0",
+        "version": "5.18.12"
     },
     "5.4": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.4.205-hardened1.patch",
-            "sha256": "074jyvxmk8fhskndxhc80ibprnh1h2f5z16i7b2pp3723dlm5p5l",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.205-hardened1/linux-hardened-5.4.205-hardened1.patch"
+            "name": "linux-hardened-5.4.206-hardened1.patch",
+            "sha256": "0m4jcyvjqfki0asxapn4q9qgyfxw8k6yqcyw899zss8584zqa6i2",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.206-hardened1/linux-hardened-5.4.206-hardened1.patch"
         },
-        "sha256": "1m8ms5nizw3iimhw61kr11a09b6h8cfi8az3wwg4mcpb0k58lqrp",
-        "version": "5.4.205"
+        "sha256": "1asvc7y1f938icspxx39n6y6r0w9mp0k9vik84rsx1hzzv0db41c",
+        "version": "5.4.206"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index 8220a15234b..6de2a35fd47 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "4.14.288";
+  version = "4.14.289";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0yyzxyz66mfngx3ll3pl43413xb67iyxddzh3lpzqcfg7d0rxfwz";
+    sha256 = "1v24mv49skgijcbafgai0glrzwiv2j1hndkz7v6ygc18jxh5fqg6";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix
index c3906f10ebe..c9f0431244d 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "4.19.252";
+  version = "4.19.253";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0ac7k6x9h8gqi37n8d4fyi52h4cmzyy8f5vfv1aiihww4kvzca7v";
+    sha256 = "1jc2j0wskgr1bdzpz6sn2bvafpviiin6mwr93yykcczzfjijr8yz";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index ea492828232..c8e16830f4e 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,12 +1,12 @@
 { buildPackages, fetchurl, perl, buildLinux, nixosTests, stdenv, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.323";
+  version = "4.9.324";
   extraMeta.branch = "4.9";
   extraMeta.broken = stdenv.isAarch64;
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1h96ai9w5q2axhliw85aymdsg8py9y6gl8big5r2gwkbls6h7pa3";
+    sha256 = "0g51vfp0g3py82l3q66p7nvl03h6l1nlny18gangji75a3c39yh4";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.10.nix b/pkgs/os-specific/linux/kernel/linux-5.10.nix
index 495a6ff8b52..93b11cc7890 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.10.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.10.131";
+  version = "5.10.132";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1ki11mvl3dky7iih90znr47vr66dxnlwrqwg2jkk1hqn5i243i4b";
+    sha256 = "0aps3kglzw480ps9agw1k3zn8ipibwkrx13kzijfl7g0xqqsj1bx";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.15.nix b/pkgs/os-specific/linux/kernel/linux-5.15.nix
index 9735868b141..f286e1bfea0 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.15.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.15.55";
+  version = "5.15.56";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1k7x7fp675wglfd357n7hjidnm3j8zj3gcymyazg6fkcid8bvxhy";
+    sha256 = "08w2kgc0v0ld7nxbary7d9fr2vxrsmqby7l4fhf7njgi6wsbp9p9";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.18.nix b/pkgs/os-specific/linux/kernel/linux-5.18.nix
index 2ad48c7afc1..f8844461d79 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.18.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.18.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.18.12";
+  version = "5.18.13";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "09wmgfrnv1df6jg9v3svwhvnxl0j6h4f240p903xlmgj884lvds0";
+    sha256 = "1nkb4wl2v2pflqnfgmas1pmkr8wm14lm1c8py9sa5k1gwvzil3j3";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.4.nix b/pkgs/os-specific/linux/kernel/linux-5.4.nix
index 5fd398d111b..bcd502f7915 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.4.206";
+  version = "5.4.207";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1asvc7y1f938icspxx39n6y6r0w9mp0k9vik84rsx1hzzv0db41c";
+    sha256 = "1wwpd26qhv6i00p0yxjisns6qiz9bfrxvn1xb4ylwr8ls7zyx78v";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
index 0754ff335ba..0ed4c48047a 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.15-rc6";
+  version = "5.19-rc5";
   extraMeta.branch = lib.versions.majorMinor version;
 
   # modDirVersion needs to be x.y.z, will always add .0
@@ -11,7 +11,7 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    sha256 = "1lp3jqwsbd97k3bx4crs8rc2wssyaf0v8x4kl4zv7g7ww2kkg2ii";
+    sha256 = "sha256-eqBbQBZaqexgx6m3jAoU/0HWAdHbAuT3slZWMZhrht0=";
   };
 
   # Should the testing kernels ever be built on Hydra?
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 910541f0ba6..acf965d9950 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -114,7 +114,8 @@ let
       patches =
         map (p: p.patch) kernelPatches
         # Required for deterministic builds along with some postPatch magic.
-        ++ optional (lib.versionAtLeast version "4.13") ./randstruct-provide-seed.patch
+        ++ optional (lib.versionAtLeast version "4.13" && lib.versionOlder version "5.19") ./randstruct-provide-seed.patch
+        ++ optional (lib.versionAtLeast version "5.19") ./randstruct-provide-seed-5.19.patch
         # Fixes determinism by normalizing metadata for the archive of kheaders
         ++ optional (lib.versionAtLeast version "5.2" && lib.versionOlder version "5.4") ./gen-kheaders-metadata.patch;
 
diff --git a/pkgs/os-specific/linux/kernel/randstruct-provide-seed-5.19.patch b/pkgs/os-specific/linux/kernel/randstruct-provide-seed-5.19.patch
new file mode 100644
index 00000000000..5ca897a76bf
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/randstruct-provide-seed-5.19.patch
@@ -0,0 +1,13 @@
+diff --git a/scripts/gen-randstruct-seed.sh b/scripts/gen-randstruct-seed.sh
+index 61017b36c464..7bb494dd2e18 100755
+--- a/scripts/gen-randstruct-seed.sh
++++ b/scripts/gen-randstruct-seed.sh
+@@ -1,7 +1,7 @@
+ #!/bin/sh
+ # SPDX-License-Identifier: GPL-2.0
+ 
+-SEED=$(od -A n -t x8 -N 32 /dev/urandom | tr -d ' \n')
++SEED="NIXOS_RANDSTRUCT_SEED"
+ echo "$SEED" > "$1"
+ HASH=$(echo -n "$SEED" | sha256sum | cut -d" " -f1)
+ echo "#define RANDSTRUCT_HASHED_SEED \"$HASH\"" > "$2"
diff --git a/pkgs/servers/onlyoffice-documentserver/default.nix b/pkgs/servers/onlyoffice-documentserver/default.nix
new file mode 100644
index 00000000000..703eaecf601
--- /dev/null
+++ b/pkgs/servers/onlyoffice-documentserver/default.nix
@@ -0,0 +1,152 @@
+{ lib
+, stdenv
+, buildFHSUserEnvBubblewrap
+, corefonts
+, dejavu_fonts
+, dpkg
+, fetchurl
+, gcc-unwrapped
+, liberation_ttf_v1
+, writeScript
+, xorg
+}:
+
+let
+  # var/www/onlyoffice/documentserver/server/DocService/docservice
+  onlyoffice-documentserver = stdenv.mkDerivation rec {
+    pname = "onlyoffice-documentserver";
+    version = "7.1.1-23";
+
+    src = fetchurl {
+      url = "https://github.com/ONLYOFFICE/DocumentServer/releases/download/v${lib.concatStringsSep "." (lib.take 3 (lib.splitVersion version))}/onlyoffice-documentserver_amd64.deb";
+      sha256 = "sha256-hmQx8htSjFszdSAzJgiU7Lo6ebF7TVRfK8rJbJDhX5Q=";
+    };
+
+    preferLocalBuild = true;
+
+    unpackCmd = "dpkg -x $curSrc source";
+
+    nativeBuildInputs = [
+      dpkg
+    ];
+
+    installPhase = ''
+      # replace dangling symlinks which are not copied into fhs with actually files
+      rm lib/*.so*
+      for file in var/www/onlyoffice/documentserver/server/FileConverter/bin/*.so* ; do
+        ln -rs "$file" lib/$(basename "$file")
+      done
+
+      # NixOS uses systemd, not supervisor
+      rm -rf etc/supervisor
+
+      install -Dm755 usr/bin/documentserver-prepare4shutdown.sh -t $out/bin
+      # maintainer scripts which expect supervisorctl, try to write into the nix store or are handled by nixos modules
+      rm -rf usr/bin
+
+      # .deb default documentation
+      rm -rf usr/share
+
+      # required for bwrap --bind
+      mkdir -p var/lib/onlyoffice/ var/www/onlyoffice/documentserver/fonts/
+
+      mv * $out/
+    '';
+
+    # stripping self extracting javascript binaries likely breaks them
+    dontStrip = true;
+
+    passthru = {
+      fhs = buildFHSUserEnvBubblewrap {
+        name = "onlyoffice-wrapper";
+
+        targetPkgs = pkgs: [
+          gcc-unwrapped.lib
+          onlyoffice-documentserver
+
+          # fonts
+          corefonts
+          dejavu_fonts
+          liberation_ttf_v1
+        ];
+
+        extraBwrapArgs = [
+          "--bind var/lib/onlyoffice/ var/lib/onlyoffice/"
+          "--bind var/lib/onlyoffice/documentserver/sdkjs/common/ var/www/onlyoffice/documentserver/sdkjs/common/"
+          "--bind var/lib/onlyoffice/documentserver/sdkjs/slide/themes/ var/www/onlyoffice/documentserver/sdkjs/slide/themes/"
+          "--bind var/lib/onlyoffice/documentserver/fonts/ var/www/onlyoffice/documentserver/fonts/"
+          "--bind var/lib/onlyoffice/documentserver/server/FileConverter/bin/ var/www/onlyoffice/documentserver/server/FileConverter/bin/"
+        ];
+
+        runScript = writeScript "onlyoffice-documentserver-run-script" ''
+          export NODE_CONFIG_DIR=$2
+          export NODE_DISABLE_COLORS=1
+          export NODE_ENV=production-linux
+
+          if [[ $1 == DocService/docservice ]]; then
+            mkdir -p var/www/onlyoffice/documentserver/sdkjs/slide/themes/
+            # symlinking themes/src breaks discovery in allfontsgen
+            rm -rf var/www/onlyoffice/documentserver/sdkjs/slide/themes/src
+            cp -r ${onlyoffice-documentserver}/var/www/onlyoffice/documentserver/sdkjs/slide/themes/src var/www/onlyoffice/documentserver/sdkjs/slide/themes/
+            chmod -R u+w var/www/onlyoffice/documentserver/sdkjs/slide/themes/
+
+            # onlyoffice places generated files in those directores
+            rm -rf var/www/onlyoffice/documentserver/sdkjs/common/*
+            ${xorg.lndir}/bin/lndir -silent ${onlyoffice-documentserver}/var/www/onlyoffice/documentserver/sdkjs/common/ var/www/onlyoffice/documentserver/sdkjs/common/
+            rm -rf var/www/onlyoffice/documentserver/server/FileConverter/bin/*
+            ${xorg.lndir}/bin/lndir -silent ${onlyoffice-documentserver}/var/www/onlyoffice/documentserver/server/FileConverter/bin/ var/www/onlyoffice/documentserver/server/FileConverter/bin/
+
+            # https://github.com/ONLYOFFICE/document-server-package/blob/master/common/documentserver/bin/documentserver-generate-allfonts.sh.m4
+            echo -n Generating AllFonts.js, please wait...
+            "var/www/onlyoffice/documentserver/server/tools/allfontsgen"\
+              --input="${onlyoffice-documentserver}/var/www/onlyoffice/documentserver/core-fonts"\
+              --allfonts-web="var/www/onlyoffice/documentserver/sdkjs/common/AllFonts.js"\
+              --allfonts="var/www/onlyoffice/documentserver/server/FileConverter/bin/AllFonts.js"\
+              --images="var/www/onlyoffice/documentserver/sdkjs/common/Images"\
+              --selection="var/www/onlyoffice/documentserver/server/FileConverter/bin/font_selection.bin"\
+              --output-web="var/www/onlyoffice/documentserver/fonts"\
+              --use-system="true"
+            echo Done
+
+            echo -n Generating presentation themes, please wait...
+            "var/www/onlyoffice/documentserver/server/tools/allthemesgen"\
+              --converter-dir="var/www/onlyoffice/documentserver/server/FileConverter/bin"\
+              --src="var/www/onlyoffice/documentserver/sdkjs/slide/themes"\
+              --output="var/www/onlyoffice/documentserver/sdkjs/common/Images"
+
+            "var/www/onlyoffice/documentserver/server/tools/allthemesgen"\
+              --converter-dir="var/www/onlyoffice/documentserver/server/FileConverter/bin"\
+              --src="var/www/onlyoffice/documentserver/sdkjs/slide/themes"\
+              --output="var/www/onlyoffice/documentserver/sdkjs/common/Images"\
+              --postfix="ios"\
+              --params="280,224"
+
+            "var/www/onlyoffice/documentserver/server/tools/allthemesgen"\
+              --converter-dir="var/www/onlyoffice/documentserver/server/FileConverter/bin"\
+              --src="var/www/onlyoffice/documentserver/sdkjs/slide/themes"\
+              --output="var/www/onlyoffice/documentserver/sdkjs/common/Images"\
+              --postfix="android"\
+              --params="280,224"
+            echo Done
+          fi
+
+          exec var/www/onlyoffice/documentserver/server/$1
+        '';
+      };
+    };
+
+    meta = with lib; {
+      description = "ONLYOFFICE Document Server is an online office suite comprising viewers and editors";
+      longDescription = ''
+        ONLYOFFICE Document Server is an online office suite comprising viewers and editors for texts, spreadsheets and presentations,
+        fully compatible with Office Open XML formats: .docx, .xlsx, .pptx and enabling collaborative editing in real time.
+      '';
+      homepage = "ONLYOFFICE Document Server is an online office suite comprising viewers and editors";
+      license = licenses.agpl3;
+      platforms = [ "x86_64-linux" ];
+      sourceProvenance = sourceTypes.binaryNativeCode;
+      maintainers = with maintainers; [ SuperSandro2000 ];
+    };
+  };
+in
+onlyoffice-documentserver
diff --git a/pkgs/servers/tailscale/default.nix b/pkgs/servers/tailscale/default.nix
index 5678502454a..ee17c110e1a 100644
--- a/pkgs/servers/tailscale/default.nix
+++ b/pkgs/servers/tailscale/default.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "tailscale";
-  version = "1.26.2";
+  version = "1.28.0";
 
   src = fetchFromGitHub {
     owner = "tailscale";
     repo = "tailscale";
     rev = "v${version}";
-    sha256 = "sha256:0axcqkqrj4l8c63fd316hp0wlndrbry9x3wml7ssah491f4f3g9w";
+    sha256 = "sha256-6h9LAtaDIwQb+oU4zNABJeBOMaiKqWvhxsFbwEQNC4o=";
   };
-  vendorSha256 = "sha256:0b04ihp5ds8vcqv78kjdz5ffn91yid0pn0aq54jawdd4cfb6bmji";
+  vendorSha256 = "sha256-W5QiHhdSP5xPIJWs8LMl+EGu/AE9/aFD2sOZOnDL0yo=";
 
   nativeBuildInputs = lib.optionals stdenv.isLinux [ makeWrapper ];
 
diff --git a/pkgs/tools/graphics/amber/default.nix b/pkgs/tools/graphics/amber/default.nix
index 4e1948ce87f..c6b4a2c2229 100644
--- a/pkgs/tools/graphics/amber/default.nix
+++ b/pkgs/tools/graphics/amber/default.nix
@@ -2,6 +2,7 @@
 , fetchFromGitHub
 , cmake
 , pkg-config
+, cctools
 , python3
 , vulkan-headers
 , vulkan-loader
@@ -63,6 +64,8 @@ stdenv.mkDerivation rec {
     cmake
     pkg-config
     python3
+  ] ++ lib.optionals stdenv.isDarwin [
+    cctools
   ];
 
   # Tests are disabled so we do not have to pull in googletest and more dependencies
diff --git a/pkgs/tools/graphics/pdftoipe/default.nix b/pkgs/tools/graphics/pdftoipe/default.nix
index 950e82e3865..763a1366801 100644
--- a/pkgs/tools/graphics/pdftoipe/default.nix
+++ b/pkgs/tools/graphics/pdftoipe/default.nix
@@ -3,6 +3,7 @@
 , fetchFromGitHub
 , pkg-config
 , poppler
+, fetchpatch
 }:
 
 stdenv.mkDerivation rec {
@@ -15,6 +16,18 @@ stdenv.mkDerivation rec {
     rev = "v${version}";
     sha256 = "jlrjrjzZQo79CKMySayhCm1dqLh89wOQuXrXa2aqc0k=";
   };
+
+  patches = [
+    # Fix build with poppler > 22.03.0
+    # https://github.com/otfried/ipe-tools/pull/48
+    (fetchpatch {
+      url = "https://github.com/otfried/ipe-tools/commit/14335180432152ad094300d0afd00d8e390469b2.patch";
+      sha256 = "sha256-V3FmwG3bR6io/smxjasFJ5K0/u8RSFfdUX41ClGXhFc=";
+      stripLen = 1;
+      name = "poppler_fix_build.patch";
+    })
+  ];
+
   sourceRoot = "source/pdftoipe";
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/tools/graphics/realesrgan-ncnn-vulkan/default.nix b/pkgs/tools/graphics/realesrgan-ncnn-vulkan/default.nix
index d66a06b7eed..b41f2cc49d4 100644
--- a/pkgs/tools/graphics/realesrgan-ncnn-vulkan/default.nix
+++ b/pkgs/tools/graphics/realesrgan-ncnn-vulkan/default.nix
@@ -44,7 +44,8 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [ cmake ];
-  buildInputs = [ vulkan-headers vulkan-loader glslang libgcc libwebp ncnn ];
+  buildInputs = [ vulkan-headers vulkan-loader glslang libwebp ncnn ]
+    ++ lib.optional (!stdenv.isDarwin) libgcc;
 
   postPatch = ''
     substituteInPlace main.cpp --replace REPLACE_MODELS $out/share/models
diff --git a/pkgs/tools/graphics/wgpu-utils/default.nix b/pkgs/tools/graphics/wgpu-utils/default.nix
index 737f7132212..ab5eac27315 100644
--- a/pkgs/tools/graphics/wgpu-utils/default.nix
+++ b/pkgs/tools/graphics/wgpu-utils/default.nix
@@ -1,4 +1,4 @@
-{ lib, rustPlatform, fetchFromGitHub, pkg-config, makeWrapper, vulkan-loader }:
+{ lib, stdenv, rustPlatform, fetchFromGitHub, pkg-config, makeWrapper, vulkan-loader, QuartzCore }:
 
 rustPlatform.buildRustPackage rec {
   pname = "wgpu-utils";
@@ -18,6 +18,8 @@ rustPlatform.buildRustPackage rec {
     makeWrapper
   ];
 
+  buildInputs = lib.optional stdenv.isDarwin QuartzCore;
+
   # Tests fail, as the Nix sandbox doesn't provide an appropriate adapter (e.g. Vulkan).
   doCheck = false;
 
diff --git a/pkgs/tools/misc/eget/default.nix b/pkgs/tools/misc/eget/default.nix
new file mode 100644
index 00000000000..f9337c580ed
--- /dev/null
+++ b/pkgs/tools/misc/eget/default.nix
@@ -0,0 +1,48 @@
+{ lib
+, fetchFromGitHub
+, buildGoModule
+, pandoc
+, installShellFiles
+, nix-update-script
+, testers
+, eget
+}:
+
+buildGoModule rec {
+  pname = "eget";
+  version = "1.1.0";
+
+  src = fetchFromGitHub {
+    owner = "zyedidia";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-+sl98pOc3YSy7LnEWsoPQwUtmY/pgMKOX73glzu+3MM=";
+  };
+
+  vendorSha256 = "sha256-axJqi41Fj+MJnaLzSOnSws9/c/0dSkUAtaWkVXNmFxI=";
+
+  ldflags = [ "-s" "-w" "-X main.Version=v${version}" ];
+
+  nativeBuildInputs = [ pandoc installShellFiles ];
+
+  postInstall = ''
+    pandoc man/eget.md -s -t man -o eget.1
+    installManPage eget.1
+  '';
+
+  passthru = {
+    updateScript = nix-update-script { attrPath = pname; };
+    tests.version = testers.testVersion {
+      package = eget;
+      command = "eget -v";
+      version = "v${version}";
+    };
+  };
+
+  meta = with lib; {
+    description = "Easily install prebuilt binaries from GitHub";
+    homepage = "https://github.com/zyedidia/eget";
+    license = licenses.mit;
+    maintainers = with maintainers; [ zendo ];
+  };
+}
diff --git a/pkgs/tools/misc/ncdu_2/default.nix b/pkgs/tools/misc/ncdu/1.nix
similarity index 62%
rename from pkgs/tools/misc/ncdu_2/default.nix
rename to pkgs/tools/misc/ncdu/1.nix
index 0cfb78bcf0b..d1c185c0f23 100644
--- a/pkgs/tools/misc/ncdu_2/default.nix
+++ b/pkgs/tools/misc/ncdu/1.nix
@@ -1,24 +1,16 @@
-{ lib, stdenv, fetchurl, zig, ncurses }:
+{ lib, stdenv, fetchurl, ncurses }:
 
 stdenv.mkDerivation rec {
   pname = "ncdu";
-  version = "2.1.2";
+  version = "1.17";
 
   src = fetchurl {
     url = "https://dev.yorhel.nl/download/${pname}-${version}.tar.gz";
-    sha256 = "sha256-ng1u8DYYo8MWcmv0khe37+Rc7HWLLJF86JLe10Myxtw=";
+    sha256 = "sha256-gQdFqO0as3iMh9OupMwaFO327iJvdkvMOD4CS6Vq2/E=";
   };
 
-  XDG_CACHE_HOME="Cache"; # FIXME This should be set in stdenv
-
-  nativeBuildInputs = [
-    zig
-  ];
-
   buildInputs = [ ncurses ];
 
-  PREFIX = placeholder "out";
-
   meta = with lib; {
     description = "Disk usage analyzer with an ncurses interface";
     homepage = "https://dev.yorhel.nl/ncdu";
diff --git a/pkgs/tools/misc/ncdu/default.nix b/pkgs/tools/misc/ncdu/default.nix
index d1c185c0f23..0cfb78bcf0b 100644
--- a/pkgs/tools/misc/ncdu/default.nix
+++ b/pkgs/tools/misc/ncdu/default.nix
@@ -1,16 +1,24 @@
-{ lib, stdenv, fetchurl, ncurses }:
+{ lib, stdenv, fetchurl, zig, ncurses }:
 
 stdenv.mkDerivation rec {
   pname = "ncdu";
-  version = "1.17";
+  version = "2.1.2";
 
   src = fetchurl {
     url = "https://dev.yorhel.nl/download/${pname}-${version}.tar.gz";
-    sha256 = "sha256-gQdFqO0as3iMh9OupMwaFO327iJvdkvMOD4CS6Vq2/E=";
+    sha256 = "sha256-ng1u8DYYo8MWcmv0khe37+Rc7HWLLJF86JLe10Myxtw=";
   };
 
+  XDG_CACHE_HOME="Cache"; # FIXME This should be set in stdenv
+
+  nativeBuildInputs = [
+    zig
+  ];
+
   buildInputs = [ ncurses ];
 
+  PREFIX = placeholder "out";
+
   meta = with lib; {
     description = "Disk usage analyzer with an ncurses interface";
     homepage = "https://dev.yorhel.nl/ncdu";
diff --git a/pkgs/tools/misc/yubikey-manager-qt/default.nix b/pkgs/tools/misc/yubikey-manager-qt/default.nix
index 0a5ccda2ced..a193075633d 100644
--- a/pkgs/tools/misc/yubikey-manager-qt/default.nix
+++ b/pkgs/tools/misc/yubikey-manager-qt/default.nix
@@ -1,6 +1,7 @@
 { lib
 , mkDerivation
 , fetchurl
+, imagemagick
 , pcsclite
 , pyotherside
 , python3
@@ -24,6 +25,7 @@ mkDerivation rec {
   nativeBuildInputs = [
     python3.pkgs.wrapPython
     qmake
+    imagemagick
   ];
 
   postPatch = ''
@@ -43,10 +45,25 @@ mkDerivation rec {
   ];
 
   postInstall = ''
-    install -Dt $out/share/applications resources/ykman-gui.desktop
-    install -Dt $out/share/ykman-gui/icons resources/icons/*.{icns,ico,png,xpm}
-    substituteInPlace $out/share/applications/ykman-gui.desktop \
-      --replace 'Exec=ykman-gui' "Exec=$out/bin/ykman-gui"
+    # Desktop files
+    install -D -m0644 resources/ykman-gui.desktop "$out/share/applications/ykman-gui.desktop"
+    substituteInPlace "$out/share/applications/ykman-gui.desktop" \
+      --replace Exec=ykman-gui "Exec=$out/bin/ykman-gui"
+
+    # Icons
+    install -Dt $out/share/ykman-gui/icons resources/icons/*.{icns,ico}
+    install -D -m0644 resources/icons/ykman.png "$out/share/icons/hicolor/128x128/apps/ykman.png"
+    ln -s -- "$out/share/icons/hicolor/128x128/apps/ykman.png" "$out/share/icons/hicolor/128x128/apps/ykman-gui.png"
+    for SIZE in 16 24 32 48 64 96; do
+      # set modify/create for reproducible builds
+      convert -scale ''${SIZE} +set date:create +set date:modify \
+        resources/icons/ykman.png ykman.png
+
+      imageFolder="$out/share/icons/hicolor/''${SIZE}x''${SIZE}/apps"
+      install -D -m0644 ykman.png "$imageFolder/ykman.png"
+      ln -s -- "$imageFolder/ykman.png" "$imageFolder/ykman-gui.png"
+    done
+    unset SIZE imageFolder
   '';
 
   qtWrapperArgs = [
diff --git a/pkgs/tools/security/beyond-identity/default.nix b/pkgs/tools/security/beyond-identity/default.nix
index 15a8ab3882c..eec53d3bf97 100644
--- a/pkgs/tools/security/beyond-identity/default.nix
+++ b/pkgs/tools/security/beyond-identity/default.nix
@@ -5,7 +5,7 @@
 
 let
   pname = "beyond-identity";
-  version = "2.49.0-0";
+  version = "2.60.0-0";
   libPath = lib.makeLibraryPath ([ glib glibc openssl tpm2-tss gtk3 gnome.gnome-keyring polkit polkit_gnome ]);
   meta = with lib; {
     description = "Passwordless MFA identities for workforces, customers, and developers";
@@ -22,7 +22,7 @@ let
 
     src = fetchurl {
       url = "https://packages.beyondidentity.com/public/linux-authenticator/deb/ubuntu/pool/focal/main/b/be/${pname}_${version}/${pname}_${version}_amd64.deb";
-      sha512 = "sha512-+9vwH1r5WW+MqyiwsAFInboaM7o2dc7zvRaKwHC/o2LOBugvUHmUzmZ6uSHilc9zQ5FcHUIIglhkASbFtsvPeA==";
+      sha512 = "sha512-JrHLf7KkJVbJLxx54OTvOSaIzY3+hjX+bpkeBHKX23YriCJssUUvEP6vlbI4r6gjMMFMhW92k0iikAgD1Tr4ug==";
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/tools/security/exploitdb/default.nix b/pkgs/tools/security/exploitdb/default.nix
index 2325374d961..e9c419809ea 100644
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2022-07-12";
+  version = "2022-07-22";
 
   src = fetchFromGitHub {
     owner = "offensive-security";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-fnhiLB5Ga2yWhj0/w94d9gl874ekPJBwiIgK8DapN+w=";
+    hash = "sha256-36zfLPXAeYVJQ448E5xuwrNR4cb7xpjwqOQY/WcteQ0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/jadx/default.nix b/pkgs/tools/security/jadx/default.nix
index 21a0a3c6124..903dfa090f5 100644
--- a/pkgs/tools/security/jadx/default.nix
+++ b/pkgs/tools/security/jadx/default.nix
@@ -2,13 +2,13 @@
 
 let
   pname = "jadx";
-  version = "1.4.2";
+  version = "1.4.3";
 
   src = fetchFromGitHub {
     owner = "skylot";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-WSQyym9RMrCiWlb2O4Cd7/ra2UNTL8XsaSNnSTAmhjs=";
+    hash = "sha256-5Cx5rwXUNnVSbLjkpB6qeudRHI4RVzl6T4zo7Dg9geo=";
   };
 
   deps = stdenv.mkDerivation {
@@ -40,7 +40,7 @@ let
     '';
 
     outputHashMode = "recursive";
-    outputHash = "sha256-LCF03nTC7T2YxlLIWO3zgrbJVTCQOU8Who9NIqvicb4=";
+    outputHash = "sha256-Q7eGZQJZObLyZlp8JyodA3gEAgfh7ub+BNQh/LEm2Nk=";
   };
 in stdenv.mkDerivation {
   inherit pname version src;
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index c8f4cdde0da..90cd965a4b1 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -919,6 +919,7 @@ mapAliases ({
 
   ### N ###
 
+  ncdu_2 = ncdu; # Added 2022-07-22
   nccl = throw "nccl has been renamed to cudaPackages.nccl"; # Added 2022-04-04
   nccl_cudatoolkit_10 = throw "nccl_cudatoolkit_10 has been renamed to cudaPackages_10.nccl"; # Added 2022-04-04
   nccl_cudatoolkit_11 = throw "nccl_cudatoolkit_11 has been renamed to cudaPackages_11.nccl"; # Added 2022-04-04
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 30b060539e6..4eef51c847a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2050,7 +2050,9 @@ with pkgs;
 
   betterdiscord-installer = callPackage ../tools/misc/betterdiscord-installer { };
 
-  binocle = callPackage ../applications/misc/binocle { };
+  binocle = callPackage ../applications/misc/binocle {
+    inherit (darwin.apple_sdk.frameworks) AppKit CoreFoundation CoreGraphics CoreVideo Foundation Metal QuartzCore;
+  };
 
   bitwise = callPackage ../tools/misc/bitwise { };
 
@@ -2490,7 +2492,9 @@ with pkgs;
 
   gtklp = callPackage ../tools/misc/gtklp { };
 
-  google-amber = callPackage ../tools/graphics/amber { };
+  google-amber = callPackage ../tools/graphics/amber {
+    inherit (darwin) cctools;
+  };
 
   hakrawler = callPackage ../tools/security/hakrawler { };
 
@@ -5807,6 +5811,8 @@ with pkgs;
 
   efivar = callPackage ../tools/system/efivar { };
 
+  eget = callPackage ../tools/misc/eget { };
+
   evemu = callPackage ../tools/system/evemu { };
 
   # The latest version used by elasticsearch, logstash, kibana and the the beats from elastic.
@@ -12006,7 +12012,9 @@ with pkgs;
     });
   };
 
-  wgpu-utils = callPackage ../tools/graphics/wgpu-utils { };
+  wgpu-utils = callPackage ../tools/graphics/wgpu-utils {
+    inherit (darwin.apple_sdk.frameworks) QuartzCore;
+  };
 
   wg-bond = callPackage ../applications/networking/wg-bond { };
 
@@ -22542,6 +22550,8 @@ with pkgs;
 
   oauth2-proxy = callPackage ../servers/oauth2-proxy { };
 
+  onlyoffice-documentserver = callPackage ../servers/onlyoffice-documentserver { };
+
   openbgpd = callPackage ../servers/openbgpd { };
 
   openafs_1_8 = callPackage ../servers/openafs/1.8 { tsmbac = null; ncurses = null; };
@@ -24656,6 +24666,8 @@ with pkgs;
 
   cnstrokeorder = callPackage ../data/fonts/cnstrokeorder {};
 
+  colloid-gtk-theme = callPackage ../data/themes/colloid-gtk-theme { };
+
   comfortaa = callPackage ../data/fonts/comfortaa {};
 
   comic-mono = callPackage ../data/fonts/comic-mono { };
@@ -25279,6 +25291,8 @@ with pkgs;
 
   qogir-icon-theme = callPackage ../data/icons/qogir-icon-theme { };
 
+  qogir-kde = callPackage ../data/themes/qogir-kde { };
+
   qogir-theme = callPackage ../data/themes/qogir { };
 
   quintom-cursor-theme = callPackage ../data/icons/quintom-cursor-theme { };
@@ -27894,6 +27908,8 @@ with pkgs;
     texinfo = texinfo6_7; # Uses @setcontentsaftertitlepage, removed in 6.8.
   };
 
+  avalonia-ilspy = callPackage ../applications/misc/avalonia-ilspy { };
+
   imag = callPackage ../applications/misc/imag {
     inherit (darwin.apple_sdk.frameworks) Security;
   };
@@ -29263,7 +29279,7 @@ with pkgs;
   netcoredbg = callPackage ../development/tools/misc/netcoredbg { };
 
   ncdu = callPackage ../tools/misc/ncdu { };
-  ncdu_2 = callPackage ../tools/misc/ncdu_2 { };
+  ncdu_1 = callPackage ../tools/misc/ncdu/1.nix { };
 
   ncdc = callPackage ../applications/networking/p2p/ncdc { };
 
diff --git a/pkgs/top-level/darwin-packages.nix b/pkgs/top-level/darwin-packages.nix
index 47dd47aedea..27023a991c9 100644
--- a/pkgs/top-level/darwin-packages.nix
+++ b/pkgs/top-level/darwin-packages.nix
@@ -148,7 +148,11 @@ impure-cmds // appleSourcePackages // chooseLibs // {
 
   lsusb = callPackage ../os-specific/darwin/lsusb { };
 
-  moltenvk = callPackage ../os-specific/darwin/moltenvk { };
+  moltenvk = pkgs.darwin.apple_sdk_11_0.callPackage ../os-specific/darwin/moltenvk {
+    inherit (apple_sdk_11_0.frameworks) AppKit Foundation Metal QuartzCore;
+    inherit (apple_sdk_11_0) MacOSX-SDK Libsystem;
+    inherit (pkgs.darwin) cctools sigtool;
+  };
 
   opencflite = callPackage ../os-specific/darwin/opencflite { };
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 4f461c44076..48929f73c96 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6757,6 +6757,8 @@ in {
 
   plaid-python = callPackage ../development/python-modules/plaid-python { };
 
+  plantuml = callPackage ../development/python-modules/plantuml { };
+
   plaster = callPackage ../development/python-modules/plaster { };
 
   plaster-pastedeploy = callPackage ../development/python-modules/plaster-pastedeploy { };