diff --git a/.git-blame-ignore-revs b/.git-blame-ignore-revs
new file mode 100644
index 00000000000..4a581f9dcea
--- /dev/null
+++ b/.git-blame-ignore-revs
@@ -0,0 +1,32 @@
+# This file contains a list of commits that are not likely what you
+# are looking for in a blame, such as mass reformatting or renaming.
+# You can set this file as a default ignore file for blame by running
+# the following command.
+#
+# $ git config blame.ignoreRevsFile .git-blame-ignore-revs
+#
+# To temporarily not use this file add
+# --ignore-revs-file=""
+# to your blame command.
+#
+# The ignoreRevsFile can't be set globally due to blame failing if the file isn't present.
+# To not have to set the option in every repository it is needed in,
+# save the following script in your path with the name "git-bblame"
+# now you can run
+# $ git bblame $FILE
+# to use the .git-blame-ignore-revs file if it is present.
+#
+# #!/usr/bin/env bash
+# repo_root=$(git rev-parse --show-toplevel)
+# if [[ -e $repo_root/.git-blame-ignore-revs ]]; then
+#     git blame --ignore-revs-file="$repo_root/.git-blame-ignore-revs" $@
+# else
+#     git blame $@
+# fi
+
+
+# nixos/modules/rename: Sort alphabetically
+1f71224fe86605ef4cd23ed327b3da7882dad382
+
+# nixos: fix module paths in rename.nix
+d08ede042b74b8199dc748323768227b88efcf7c
diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index 0e3f315bb0d..bcb164a04ee 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -8,7 +8,7 @@ jobs:
     if: github.repository_owner == 'NixOS' && github.event.pull_request.merged == true && (github.event_name != 'labeled' || startsWith('backport', github.event.label.name))
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
         with:
           # required to find all branches
           fetch-depth: 0
diff --git a/.github/workflows/basic-eval.yml b/.github/workflows/basic-eval.yml
index 67634af51f6..c48b04d8c14 100644
--- a/.github/workflows/basic-eval.yml
+++ b/.github/workflows/basic-eval.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     # we don't limit this action to only NixOS repo since the checks are cheap and useful developer feedback
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
     - uses: cachix/install-nix-action@v16
     # explicit list of supportedSystems is needed until aarch64-darwin becomes part of the trunk jobset
     - run: nix-build pkgs/top-level/release.nix -A tarball.nixpkgs-basic-release-checks --arg supportedSystems '[ "aarch64-darwin" "aarch64-linux" "x86_64-linux" "x86_64-darwin"  ]'
diff --git a/.github/workflows/editorconfig.yml b/.github/workflows/editorconfig.yml
index 28e20d6c945..de49e55ef2a 100644
--- a/.github/workflows/editorconfig.yml
+++ b/.github/workflows/editorconfig.yml
@@ -24,7 +24,7 @@ jobs:
     - name: print list of changed files
       run: |
         cat "$HOME/changed_files"
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
       with:
         # pull_request_target checks out the base branch by default
         ref: refs/pull/${{ github.event.pull_request.number }}/merge
diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml
index 4d1e2a2a0f9..c464f8bf58a 100644
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
-    - uses: actions/labeler@v3
+    - uses: actions/labeler@v4
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
         sync-labels: true
diff --git a/.github/workflows/manual-nixos.yml b/.github/workflows/manual-nixos.yml
index b9181c5f3bb..787f5535296 100644
--- a/.github/workflows/manual-nixos.yml
+++ b/.github/workflows/manual-nixos.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
diff --git a/.github/workflows/manual-nixpkgs.yml b/.github/workflows/manual-nixpkgs.yml
index 3bdbd7f78fc..7d9273ef139 100644
--- a/.github/workflows/manual-nixpkgs.yml
+++ b/.github/workflows/manual-nixpkgs.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
diff --git a/.github/workflows/nixos-manual.yml b/.github/workflows/nixos-manual.yml
index e1c5b4dc93b..bd70f228d46 100644
--- a/.github/workflows/nixos-manual.yml
+++ b/.github/workflows/nixos-manual.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
       with:
         # pull_request_target checks out the base branch by default
         ref: refs/pull/${{ github.event.pull_request.number }}/merge
diff --git a/.github/workflows/periodic-merge-24h.yml b/.github/workflows/periodic-merge-24h.yml
index b8535fdf952..5ad0db1db51 100644
--- a/.github/workflows/periodic-merge-24h.yml
+++ b/.github/workflows/periodic-merge-24h.yml
@@ -38,7 +38,7 @@ jobs:
             into: staging-21.11
     name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
 
       - name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
         uses: devmasx/merge-branch@1.4.0
diff --git a/.github/workflows/periodic-merge-6h.yml b/.github/workflows/periodic-merge-6h.yml
index daa9b6d3c84..a8af04b78bc 100644
--- a/.github/workflows/periodic-merge-6h.yml
+++ b/.github/workflows/periodic-merge-6h.yml
@@ -32,7 +32,7 @@ jobs:
             into: staging
     name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
 
       - name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
         uses: devmasx/merge-branch@1.4.0
diff --git a/.github/workflows/update-terraform-providers.yml b/.github/workflows/update-terraform-providers.yml
index 9de57d6e3d1..09d208a6216 100644
--- a/.github/workflows/update-terraform-providers.yml
+++ b/.github/workflows/update-terraform-providers.yml
@@ -10,7 +10,7 @@ jobs:
     if: github.repository_owner == 'NixOS' && github.ref == 'refs/heads/master' # ensure workflow_dispatch only runs on master
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - uses: cachix/install-nix-action@v16
       - name: setup
         id: setup
diff --git a/doc/builders/packages/steam.section.md b/doc/builders/packages/steam.section.md
index 0cfc1a2c245..3ce33c9b60e 100644
--- a/doc/builders/packages/steam.section.md
+++ b/doc/builders/packages/steam.section.md
@@ -56,7 +56,7 @@ Use `programs.steam.enable = true;` if you want to add steam to systemPackages a
 
 ## steam-run {#sec-steam-run}
 
-The FHS-compatible chroot used for Steam can also be used to run other Linux games that expect a FHS environment. To use it, install the `steam-run-native` package and run the game with
+The FHS-compatible chroot used for Steam can also be used to run other Linux games that expect a FHS environment. To use it, install the `steam-run` package and run the game with
 
 ```
 steam-run ./foo
diff --git a/lib/modules.nix b/lib/modules.nix
index e9fc1007fc2..79d54e4a538 100644
--- a/lib/modules.nix
+++ b/lib/modules.nix
@@ -151,8 +151,7 @@ rec {
           };
 
           _module.freeformType = mkOption {
-            # Disallow merging for now, but could be implemented nicely with a `types.optionType`
-            type = types.nullOr (types.uniq types.attrs);
+            type = types.nullOr types.optionType;
             internal = true;
             default = null;
             description = ''
diff --git a/lib/tests/modules.sh b/lib/tests/modules.sh
index a1c592cf4ef..e4bb7ad2190 100755
--- a/lib/tests/modules.sh
+++ b/lib/tests/modules.sh
@@ -240,6 +240,11 @@ checkConfigOutput '^"24"$' config.foo ./freeform-attrsOf.nix ./freeform-str-dep-
 checkConfigError 'infinite recursion encountered' config.foo ./freeform-attrsOf.nix ./freeform-unstr-dep-str.nix
 checkConfigError 'The option .* is used but not defined' config.foo ./freeform-lazyAttrsOf.nix ./freeform-unstr-dep-str.nix
 checkConfigOutput '^"24"$' config.foo ./freeform-lazyAttrsOf.nix ./freeform-unstr-dep-str.nix ./define-value-string.nix
+# submodules in freeformTypes should have their locations annotated
+checkConfigOutput '/freeform-submodules.nix"$' config.fooDeclarations.0 ./freeform-submodules.nix
+# freeformTypes can get merged using `types.type`, including submodules
+checkConfigOutput '^10$' config.free.xxx.foo ./freeform-submodules.nix
+checkConfigOutput '^10$' config.free.yyy.bar ./freeform-submodules.nix
 
 ## types.anything
 # Check that attribute sets are merged recursively
@@ -299,6 +304,13 @@ checkConfigOutput "10" config.processedToplevel ./raw.nix
 checkConfigError "The option .multiple. is defined multiple times" config.multiple ./raw.nix
 checkConfigOutput "bar" config.priorities ./raw.nix
 
+# Test that types.optionType merges types correctly
+checkConfigOutput '^10$' config.theOption.int ./optionTypeMerging.nix
+checkConfigOutput '^"hello"$' config.theOption.str ./optionTypeMerging.nix
+
+# Test that types.optionType correctly annotates option locations
+checkConfigError 'The option .theOption.nested. in .other.nix. is already declared in .optionTypeFile.nix.' config.theOption.nested ./optionTypeFile.nix
+
 cat <<EOF
 ====== module tests ======
 $pass Pass
diff --git a/lib/tests/modules/freeform-submodules.nix b/lib/tests/modules/freeform-submodules.nix
new file mode 100644
index 00000000000..3910435a7b5
--- /dev/null
+++ b/lib/tests/modules/freeform-submodules.nix
@@ -0,0 +1,22 @@
+{ lib, options, ... }: with lib.types; {
+
+  options.fooDeclarations = lib.mkOption {
+    default = (options.free.type.getSubOptions [])._freeformOptions.foo.declarations;
+  };
+
+  options.free = lib.mkOption {
+    type = submodule {
+      config._module.freeformType = lib.mkMerge [
+        (attrsOf (submodule {
+          options.foo = lib.mkOption {};
+        }))
+        (attrsOf (submodule {
+          options.bar = lib.mkOption {};
+        }))
+      ];
+    };
+  };
+
+  config.free.xxx.foo = 10;
+  config.free.yyy.bar = 10;
+}
diff --git a/lib/tests/modules/optionTypeFile.nix b/lib/tests/modules/optionTypeFile.nix
new file mode 100644
index 00000000000..6015d59a72c
--- /dev/null
+++ b/lib/tests/modules/optionTypeFile.nix
@@ -0,0 +1,28 @@
+{ config, lib, ... }: {
+
+  _file = "optionTypeFile.nix";
+
+  options.theType = lib.mkOption {
+    type = lib.types.optionType;
+  };
+
+  options.theOption = lib.mkOption {
+    type = config.theType;
+    default = {};
+  };
+
+  config.theType = lib.mkMerge [
+    (lib.types.submodule {
+      options.nested = lib.mkOption {
+        type = lib.types.int;
+      };
+    })
+    (lib.types.submodule {
+      _file = "other.nix";
+      options.nested = lib.mkOption {
+        type = lib.types.str;
+      };
+    })
+  ];
+
+}
diff --git a/lib/tests/modules/optionTypeMerging.nix b/lib/tests/modules/optionTypeMerging.nix
new file mode 100644
index 00000000000..74a620c4620
--- /dev/null
+++ b/lib/tests/modules/optionTypeMerging.nix
@@ -0,0 +1,27 @@
+{ config, lib, ... }: {
+
+  options.theType = lib.mkOption {
+    type = lib.types.optionType;
+  };
+
+  options.theOption = lib.mkOption {
+    type = config.theType;
+  };
+
+  config.theType = lib.mkMerge [
+    (lib.types.submodule {
+      options.int = lib.mkOption {
+        type = lib.types.int;
+        default = 10;
+      };
+    })
+    (lib.types.submodule {
+      options.str = lib.mkOption {
+        type = lib.types.str;
+      };
+    })
+  ];
+
+  config.theOption.str = "hello";
+
+}
diff --git a/lib/types.nix b/lib/types.nix
index c47a35cd0d6..3fcac9c31b3 100644
--- a/lib/types.nix
+++ b/lib/types.nix
@@ -61,7 +61,11 @@ let
     boolToString
     ;
 
-  inherit (lib.modules) mergeDefinitions;
+  inherit (lib.modules)
+    mergeDefinitions
+    fixupOptionType
+    mergeOptionDecls
+    ;
   outer_types =
 rec {
   isType = type: x: (x._type or "") == type;
@@ -510,7 +514,7 @@ rec {
 
     functionTo = elemType: mkOptionType {
       name = "functionTo";
-      description = "function that evaluates to a(n) ${elemType.name}";
+      description = "function that evaluates to a(n) ${elemType.description}";
       check = isFunction;
       merge = loc: defs:
         fnArgs: (mergeDefinitions (loc ++ [ "[function body]" ]) elemType (map (fn: { inherit (fn) file; value = fn.value fnArgs; }) defs)).mergedValue;
@@ -525,6 +529,31 @@ rec {
       modules = toList modules;
     };
 
+    # The type of a type!
+    optionType = mkOptionType {
+      name = "optionType";
+      description = "optionType";
+      check = value: value._type or null == "option-type";
+      merge = loc: defs:
+        let
+          # Prepares the type definitions for mergeOptionDecls, which
+          # annotates submodules types with file locations
+          optionModules = map ({ value, file }:
+            {
+              _file = file;
+              # There's no way to merge types directly from the module system,
+              # but we can cheat a bit by just declaring an option with the type
+              options = lib.mkOption {
+                type = value;
+              };
+            }
+          ) defs;
+          # Merges all the types into a single one, including submodule merging.
+          # This also propagates file information to all submodules
+          mergedOption = fixupOptionType loc (mergeOptionDecls loc optionModules);
+        in mergedOption.type;
+    };
+
     submoduleWith =
       { modules
       , specialArgs ? {}
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index a3f2d6bd6d9..07822cfa623 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -2418,6 +2418,23 @@
     githubId = 5510514;
     name = "Conrad Mearns";
   };
+  corbanr = {
+    email = "corban@raunco.co";
+    github = "CorbanR";
+    githubId = 1918683;
+    matrix = "@corbansolo:matrix.org";
+    name = "Corban Raun";
+    keys = [
+      {
+        longkeyid = "rsa4096/0xA697A56F1F151189";
+        fingerprint = "6607 0B24 8CE5 64ED 22CE  0950 A697 A56F 1F15 1189";
+      }
+      {
+        longkeyid = "ed25519/0x230F4AC153F90F29";
+        fingerprint = "D8CB 816A B678 A4E6 1EC7  5325 230F 4AC1 53F9 0F29";
+      }
+    ];
+  };
   couchemar = {
     email = "couchemar@yandex.ru";
     github = "couchemar";
@@ -10276,6 +10293,13 @@
     githubId = 6047658;
     name = "Ryan Horiguchi";
   };
+  rhysmdnz = {
+    email = "rhys@memes.nz";
+    matrix = "@rhys:memes.nz";
+    github = "rhysmdnz";
+    githubId = 2162021;
+    name = "Rhys Davies";
+  };
   ribose-jeffreylau = {
     name = "Jeffrey Lau";
     email = "jeffrey.lau@ribose.com";
diff --git a/nixos/doc/manual/development/option-types.section.md b/nixos/doc/manual/development/option-types.section.md
index 78ace62e8f1..071e7751eb6 100644
--- a/nixos/doc/manual/development/option-types.section.md
+++ b/nixos/doc/manual/development/option-types.section.md
@@ -74,6 +74,13 @@ merging is handled.
     should only be used when checking, merging and nested evaluation are not
     desirable.
 
+`types.optionType`
+
+:   The type of an option's type. Its merging operation ensures that nested
+    options have the correct file location annotated, and that if possible,
+    multiple option definitions are correctly merged together. The main use
+    case is as the type of the `_module.freeformType` option.
+
 `types.attrs`
 
 :   A free-form attribute set.
diff --git a/nixos/doc/manual/from_md/development/option-types.section.xml b/nixos/doc/manual/from_md/development/option-types.section.xml
index 90ef05a24e7..50a3da0ef5b 100644
--- a/nixos/doc/manual/from_md/development/option-types.section.xml
+++ b/nixos/doc/manual/from_md/development/option-types.section.xml
@@ -111,6 +111,20 @@
           </para>
         </listitem>
       </varlistentry>
+      <varlistentry>
+        <term>
+          <literal>types.optionType</literal>
+        </term>
+        <listitem>
+          <para>
+            The type of an option’s type. Its merging operation ensures
+            that nested options have the correct file location
+            annotated, and that if possible, multiple option definitions
+            are correctly merged together. The main use case is as the
+            type of the <literal>_module.freeformType</literal> option.
+          </para>
+        </listitem>
+      </varlistentry>
       <varlistentry>
         <term>
           <literal>types.attrs</literal>
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
index a6bd453b35d..4acf8195a8d 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@@ -553,6 +553,13 @@
           <literal>tilp2</literal> was removed together with its module
         </para>
       </listitem>
+      <listitem>
+        <para>
+          The F-PROT antivirus (<literal>fprot</literal> package) and
+          its service module were removed because it reached
+          <link xlink:href="https://kb.cyren.com/av-support/index.php?/Knowledgebase/Article/View/434/0/end-of-sale--end-of-life-for-f-prot-and-csam">end-of-life</link>.
+        </para>
+      </listitem>
       <listitem>
         <para>
           <literal>bird1</literal> and its modules
diff --git a/nixos/doc/manual/release-notes/rl-2205.section.md b/nixos/doc/manual/release-notes/rl-2205.section.md
index 8f5b4789a42..366f0552589 100644
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@@ -180,6 +180,9 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - `tilp2` was removed together with its module
 
+- The F-PROT antivirus (`fprot` package) and its service module were removed because it
+  reached [end-of-life](https://kb.cyren.com/av-support/index.php?/Knowledgebase/Article/View/434/0/end-of-sale--end-of-life-for-f-prot-and-csam).
+
 - `bird1` and its modules `services.bird` as well as `services.bird6` have been removed. Upgrade to `services.bird2`.
 
 - The options `networking.interfaces.<name>.ipv4.routes` and `networking.interfaces.<name>.ipv6.routes` are no longer ignored when using networkd instead of the default scripted network backend by setting `networking.useNetworkd` to `true`.
diff --git a/nixos/modules/hardware/all-firmware.nix b/nixos/modules/hardware/all-firmware.nix
index 99bdb11b011..5b60b17312f 100644
--- a/nixos/modules/hardware/all-firmware.nix
+++ b/nixos/modules/hardware/all-firmware.nix
@@ -83,6 +83,7 @@ in {
         b43Firmware_5_1_138
         b43Firmware_6_30_163_46
         b43FirmwareCutter
+        xow_dongle-firmware
       ] ++ optional pkgs.stdenv.hostPlatform.isx86 facetimehd-firmware;
     })
     (mkIf cfg.wirelessRegulatoryDatabase {
diff --git a/nixos/modules/hardware/xone.nix b/nixos/modules/hardware/xone.nix
new file mode 100644
index 00000000000..89690d8c6fb
--- /dev/null
+++ b/nixos/modules/hardware/xone.nix
@@ -0,0 +1,23 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+let
+  cfg = config.hardware.xone;
+in
+{
+  options.hardware.xone = {
+    enable = mkEnableOption "the xone driver for Xbox One and Xbobx Series X|S accessories";
+  };
+
+  config = mkIf cfg.enable {
+    boot = {
+      blacklistedKernelModules = [ "xpad" "mt76x2u" ];
+      extraModulePackages = with config.boot.kernelPackages; [ xone ];
+    };
+    hardware.firmware = [ pkgs.xow_dongle-firmware ];
+  };
+
+  meta = {
+    maintainers = with maintainers; [ rhysmdnz ];
+  };
+}
diff --git a/nixos/modules/misc/ids.nix b/nixos/modules/misc/ids.nix
index 1b4105c676d..7d1faa50f4b 100644
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@@ -89,7 +89,7 @@ in
       prayer = 49;
       mpd = 50;
       clamav = 51;
-      fprot = 52;
+      #fprot = 52; # unused
       # bind = 53; #dynamically allocated as of 2021-09-03
       wwwrun = 54;
       #adm = 55; # unused
@@ -412,7 +412,7 @@ in
       prayer = 49;
       mpd = 50;
       clamav = 51;
-      fprot = 52;
+      #fprot = 52; # unused
       #bind = 53; # unused
       wwwrun = 54;
       adm = 55;
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index c6f4ec5f08c..c102f4c97ee 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -91,6 +91,7 @@
   ./hardware/video/switcheroo-control.nix
   ./hardware/video/uvcvideo/default.nix
   ./hardware/video/webcam/facetimehd.nix
+  ./hardware/xone.nix
   ./hardware/xpadneo.nix
   ./i18n/input-method/default.nix
   ./i18n/input-method/fcitx.nix
@@ -950,7 +951,6 @@
   ./services/security/clamav.nix
   ./services/security/fail2ban.nix
   ./services/security/fprintd.nix
-  ./services/security/fprot.nix
   ./services/security/haka.nix
   ./services/security/haveged.nix
   ./services/security/hockeypuck.nix
diff --git a/nixos/modules/rename.nix b/nixos/modules/rename.nix
index d72ff1c6f17..195cf87e6a8 100644
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@@ -50,6 +50,7 @@ with lib;
     (mkRemovedOptionModule [ "services" "flashpolicyd" ] "The flashpolicyd module has been removed. Adobe Flash Player is deprecated.")
     (mkRemovedOptionModule [ "services" "fourStore" ] "The fourStore module has been removed")
     (mkRemovedOptionModule [ "services" "fourStoreEndpoint" ] "The fourStoreEndpoint module has been removed")
+    (mkRemovedOptionModule [ "services" "fprot" ] "The corresponding package was removed from nixpkgs.")
     (mkRemovedOptionModule [ "services" "frab" ] "The frab module has been removed")
     (mkRemovedOptionModule [ "services" "kippo" ] "The corresponding package was removed from nixpkgs.")
     (mkRemovedOptionModule [ "services" "mailpile" ] "The corresponding package was removed from nixpkgs.")
diff --git a/nixos/modules/security/systemd-confinement.nix b/nixos/modules/security/systemd-confinement.nix
index 0e3ec5af323..f3a2de3bf87 100644
--- a/nixos/modules/security/systemd-confinement.nix
+++ b/nixos/modules/security/systemd-confinement.nix
@@ -175,8 +175,8 @@ in {
       serviceName = "${name}.service";
       excludedPath = rootPaths;
     } ''
-      mkdir -p "$out/lib/systemd/system"
-      serviceFile="$out/lib/systemd/system/$serviceName"
+      mkdir -p "$out/lib/systemd/system/$serviceName.d"
+      serviceFile="$out/lib/systemd/system/$serviceName.d/confinement.conf"
 
       echo '[Service]' > "$serviceFile"
 
diff --git a/nixos/modules/services/security/fprot.nix b/nixos/modules/services/security/fprot.nix
deleted file mode 100644
index df60d553e85..00000000000
--- a/nixos/modules/services/security/fprot.nix
+++ /dev/null
@@ -1,82 +0,0 @@
-{ config, lib, pkgs, ... }:
-with lib;
-let
-  fprotUser = "fprot";
-  stateDir = "/var/lib/fprot";
-  fprotGroup = fprotUser;
-  cfg = config.services.fprot;
-in {
-  options = {
-
-    services.fprot = {
-      updater = {
-        enable = mkEnableOption "automatic F-Prot virus definitions database updates";
-
-        productData = mkOption {
-          description = ''
-            product.data file. Defaults to the one supplied with installation package.
-          '';
-          type = types.path;
-        };
-
-        frequency = mkOption {
-          default = 30;
-          type = types.int;
-          description = ''
-            Update virus definitions every X minutes.
-          '';
-        };
-
-        licenseKeyfile = mkOption {
-          type = types.path;
-          description = ''
-            License keyfile. Defaults to the one supplied with installation package.
-          '';
-        };
-
-      };
-    };
-  };
-
-  ###### implementation
-
-  config = mkIf cfg.updater.enable {
-
-    services.fprot.updater.productData = mkDefault "${pkgs.fprot}/opt/f-prot/product.data";
-    services.fprot.updater.licenseKeyfile = mkDefault "${pkgs.fprot}/opt/f-prot/license.key";
-
-    environment.systemPackages = [ pkgs.fprot ];
-    environment.etc."f-prot.conf" = {
-      source = "${pkgs.fprot}/opt/f-prot/f-prot.conf";
-    };
-
-    users.users.${fprotUser} =
-      { uid = config.ids.uids.fprot;
-        description = "F-Prot daemon user";
-        home = stateDir;
-      };
-
-    users.groups.${fprotGroup} =
-      { gid = config.ids.gids.fprot; };
-
-    services.cron.systemCronJobs = [ "*/${toString cfg.updater.frequency} * * * * root start fprot-updater" ];
-
-    systemd.services.fprot-updater = {
-      serviceConfig = {
-        Type = "oneshot";
-        RemainAfterExit = false;
-      };
-      wantedBy = [ "multi-user.target" ];
-
-      # have to copy fpupdate executable because it insists on storing the virus database in the same dir
-      preStart = ''
-        mkdir -m 0755 -p ${stateDir}
-        chown ${fprotUser}:${fprotGroup} ${stateDir}
-        cp ${pkgs.fprot}/opt/f-prot/fpupdate ${stateDir}
-        ln -sf ${cfg.updater.productData} ${stateDir}/product.data
-      '';
-
-      script = "/var/lib/fprot/fpupdate --keyfile ${cfg.updater.licenseKeyfile}";
-    };
- };
-}
diff --git a/nixos/modules/services/security/opensnitch.nix b/nixos/modules/services/security/opensnitch.nix
index 919346cf2bb..f9b4985e199 100644
--- a/nixos/modules/services/security/opensnitch.nix
+++ b/nixos/modules/services/security/opensnitch.nix
@@ -3,22 +3,123 @@
 with lib;
 
 let
-  name = "opensnitch";
   cfg = config.services.opensnitch;
+  format = pkgs.formats.json {};
 in {
   options = {
     services.opensnitch = {
       enable = mkEnableOption "Opensnitch application firewall";
+      settings = mkOption {
+        type = types.submodule {
+          freeformType = format.type;
+
+          options = {
+            Server = {
+
+              Address = mkOption {
+                type = types.str;
+                description = ''
+                  Unix socket path (unix:///tmp/osui.sock, the "unix:///" part is
+                  mandatory) or TCP socket (192.168.1.100:50051).
+                '';
+              };
+
+              LogFile = mkOption {
+                type = types.path;
+                description = ''
+                  File to write logs to (use /dev/stdout to write logs to standard
+                  output).
+                '';
+              };
+
+            };
+
+            DefaultAction = mkOption {
+              type = types.enum [ "allow" "deny" ];
+              description = ''
+                Default action whether to block or allow application internet
+                access.
+              '';
+            };
+
+            DefaultDuration = mkOption {
+              type = types.enum [
+                "once" "always" "until restart" "30s" "5m" "15m" "30m" "1h"
+              ];
+              description = ''
+                Default duration of firewall rule.
+              '';
+            };
+
+            InterceptUnknown = mkOption {
+              type = types.bool;
+              description = ''
+                Wheter to intercept spare connections.
+              '';
+            };
+
+            ProcMonitorMethod = mkOption {
+              type = types.enum [ "ebpf" "proc" "ftrace" "audit" ];
+              description = ''
+                Which process monitoring method to use.
+              '';
+            };
+
+            LogLevel = mkOption {
+              type = types.enum [ 0 1 2 3 4 ];
+              description = ''
+                Default log level from 0 to 4 (debug, info, important, warning,
+                error).
+              '';
+            };
+
+            Firewall = mkOption {
+              type = types.enum [ "iptables" "nftables" ];
+              description = ''
+                Which firewall backend to use.
+              '';
+            };
+
+            Stats = {
+
+              MaxEvents = mkOption {
+                type = types.int;
+                description = ''
+                  Max events to send to the GUI.
+                '';
+              };
+
+              MaxStats = mkOption {
+                type = types.int;
+                description = ''
+                  Max stats per item to keep in backlog.
+                '';
+              };
+
+            };
+          };
+        };
+        description = ''
+          opensnitchd configuration. Refer to
+          <link xlink:href="https://github.com/evilsocket/opensnitch/wiki/Configurations"/>
+          for details on supported values.
+        '';
+      };
     };
   };
 
   config = mkIf cfg.enable {
 
+    # pkg.opensnitch is referred to elsewhere in the module so we don't need to worry about it being garbage collected
+    services.opensnitch.settings = mapAttrs (_: v: mkDefault v) (builtins.fromJSON (builtins.unsafeDiscardStringContext (builtins.readFile "${pkgs.opensnitch}/etc/default-config.json")));
+
     systemd = {
       packages = [ pkgs.opensnitch ];
       services.opensnitchd.wantedBy = [ "multi-user.target" ];
     };
 
+    environment.etc."opensnitchd/default-config.json".source = format.generate "default-config.json" cfg.settings;
+
   };
 }
 
diff --git a/nixos/release-small.nix b/nixos/release-small.nix
index c2ac4c653ea..1d51b4e7f28 100644
--- a/nixos/release-small.nix
+++ b/nixos/release-small.nix
@@ -38,7 +38,8 @@ in rec {
         login
         misc
         nat
-        nfs3
+        # fails with kernel >= 5.15 https://github.com/NixOS/nixpkgs/pull/152505#issuecomment-1005049314
+        #nfs3
         openssh
         php
         predictable-interface-names
diff --git a/nixos/tests/systemd-confinement.nix b/nixos/tests/systemd-confinement.nix
index 8fafb11e1e8..3181af309a6 100644
--- a/nixos/tests/systemd-confinement.nix
+++ b/nixos/tests/systemd-confinement.nix
@@ -17,15 +17,19 @@ import ./make-test-python.nix {
       exit "''${ret:-1}"
     '';
 
-    mkTestStep = num: { config ? {}, testScript }: {
-      systemd.sockets."test${toString num}" = {
+    mkTestStep = num: {
+      testScript,
+      config ? {},
+      serviceName ? "test${toString num}",
+    }: {
+      systemd.sockets.${serviceName} = {
         description = "Socket for Test Service ${toString num}";
         wantedBy = [ "sockets.target" ];
         socketConfig.ListenStream = "/run/test${toString num}.sock";
         socketConfig.Accept = true;
       };
 
-      systemd.services."test${toString num}@" = {
+      systemd.services."${serviceName}@" = {
         description = "Confined Test Service ${toString num}";
         confinement = (config.confinement or {}) // { enable = true; };
         serviceConfig = (config.serviceConfig or {}) // {
@@ -135,6 +139,16 @@ import ./make-test-python.nix {
               machine.succeed('test "$(chroot-exec \'cat "$FOOBAR"\')" = eek')
         '';
       }
+      { serviceName = "shipped-unitfile";
+        config.confinement.mode = "chroot-only";
+        testScript = ''
+          with subtest("check if shipped unit file still works"):
+              machine.succeed(
+                  'chroot-exec \'kill -9 $$ 2>&1 || :\' | '
+                  'grep -q "Too many levels of symbolic links"'
+              )
+        '';
+      }
     ];
 
     options.__testSteps = lib.mkOption {
@@ -143,6 +157,15 @@ import ./make-test-python.nix {
     };
 
     config.environment.systemPackages = lib.singleton testClient;
+    config.systemd.packages = lib.singleton (pkgs.writeTextFile {
+      name = "shipped-unitfile";
+      destination = "/etc/systemd/system/shipped-unitfile@.service";
+      text = ''
+        [Service]
+        SystemCallFilter=~kill
+        SystemCallErrorNumber=ELOOP
+      '';
+    });
 
     config.users.groups.chroot-testgroup = {};
     config.users.users.chroot-testuser = {
diff --git a/pkgs/applications/editors/eclipse/build-eclipse.nix b/pkgs/applications/editors/eclipse/build-eclipse.nix
index faa89b9c877..3b497f34a43 100644
--- a/pkgs/applications/editors/eclipse/build-eclipse.nix
+++ b/pkgs/applications/editors/eclipse/build-eclipse.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, makeDesktopItem, freetype, fontconfig, libX11, libXrender
-, zlib, jdk, glib, gtk, libXtst, libsecret, gsettings-desktop-schemas, webkitgtk
+, zlib, jdk, glib, glib-networking, gtk, libXtst, libsecret, gsettings-desktop-schemas, webkitgtk
 , makeWrapper, perl, ... }:
 
 { name, src ? builtins.getAttr stdenv.hostPlatform.system sources, sources ? null, description, productVersion }:
@@ -41,6 +41,7 @@ stdenv.mkDerivation rec {
     makeWrapper $out/eclipse/eclipse $out/bin/eclipse \
       --prefix PATH : ${jdk}/bin \
       --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath ([ glib gtk libXtst libsecret ] ++ lib.optional (webkitgtk != null) webkitgtk)} \
+      --prefix GIO_EXTRA_MODULES : "${glib-networking}/lib/gio/modules" \
       --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH" \
       --add-flags "-configuration \$HOME/.eclipse/''${productId}_${productVersion}/configuration"
 
diff --git a/pkgs/applications/editors/emacs/generic.nix b/pkgs/applications/editors/emacs/generic.nix
index 946dba0af8f..82a1d6af832 100644
--- a/pkgs/applications/editors/emacs/generic.nix
+++ b/pkgs/applications/editors/emacs/generic.nix
@@ -53,7 +53,8 @@ let emacs = stdenv.mkDerivation (lib.optionalAttrs nativeComp {
   NATIVE_FULL_AOT = "1";
   LIBRARY_PATH = "${lib.getLib stdenv.cc.libc}/lib";
 } // {
-  inherit pname version;
+  pname = pname + lib.optionalString ( !withX && !withNS && !withGTK2 && !withGTK3 ) "-nox";
+  inherit version;
 
   patches = patches fetchpatch;
 
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 7f437c8d02f..5a6545bb1d9 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1857,8 +1857,8 @@ let
         mktplcRef = {
           name = "code-spell-checker";
           publisher = "streetsidesoftware";
-          version = "2.1.5";
-          sha256 = "sha256-nIR3PtbtnSbAU0rS+qVtPsj++Dbfp/k86dWkx4xYcno=";
+          version = "2.1.7";
+          sha256 = "sha256-C0jYDIDBK1JH8eFaFmCUilBXCbU5y2TRF3OZAw9ijoY=";
         };
         meta = with lib; {
           changelog = "https://marketplace.visualstudio.com/items/streetsidesoftware.code-spell-checker/changelog";
diff --git a/pkgs/applications/misc/electrum-grs/default.nix b/pkgs/applications/misc/electrum-grs/default.nix
index 412aec97ae5..c8fb9f84ad1 100644
--- a/pkgs/applications/misc/electrum-grs/default.nix
+++ b/pkgs/applications/misc/electrum-grs/default.nix
@@ -42,7 +42,7 @@ python3.pkgs.buildPythonApplication {
   src = fetchFromGitHub {
     owner = "Groestlcoin";
     repo = "electrum-grs";
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     sha256 = "0wvbjj80r1zxpz24adkicxsdjnv3nciga6rl1wfmky463w03rca2";
   };
 
diff --git a/pkgs/applications/misc/klayout/default.nix b/pkgs/applications/misc/klayout/default.nix
index 2d75a9da818..9ed67817347 100644
--- a/pkgs/applications/misc/klayout/default.nix
+++ b/pkgs/applications/misc/klayout/default.nix
@@ -1,17 +1,17 @@
-{ lib, mkDerivation, fetchFromGitHub, fetchpatch
+{ lib, mkDerivation, fetchFromGitHub
 , python3, ruby, qtbase, qtmultimedia, qttools, qtxmlpatterns
-, which, perl, makeWrapper
+, which, perl
 }:
 
 mkDerivation rec {
   pname = "klayout";
-  version = "0.27.3";
+  version = "0.27.8";
 
   src = fetchFromGitHub {
     owner = "KLayout";
     repo = "klayout";
     rev = "v${version}";
-    sha256 = "sha256-6g/QoR16rhUfxhH4JxL6EERcoPVG/6MOxUlo6K/WoE0=";
+    hash = "sha256-t/nd7m8XpB026q/kyH16rKkw3qza19ISalB0Juzx4NU=";
   };
 
   postPatch = ''
@@ -21,6 +21,7 @@ mkDerivation rec {
 
   nativeBuildInputs = [
     which
+    perl
     python3
     ruby
   ];
@@ -35,7 +36,7 @@ mkDerivation rec {
   buildPhase = ''
     runHook preBuild
     mkdir -p $out/lib
-    ./build.sh -qt5 -prefix $out/lib -j$NIX_BUILD_CORES
+    ./build.sh -qt5 -prefix $out/lib -option -j$NIX_BUILD_CORES
     runHook postBuild
   '';
 
@@ -54,8 +55,9 @@ mkDerivation rec {
 
   meta = with lib; {
     description = "High performance layout viewer and editor with support for GDS and OASIS";
-    license = with licenses; [ gpl3 ];
+    license = with licenses; [ gpl2Plus ];
     homepage = "https://www.klayout.de/";
+    changelog = "https://www.klayout.de/development.html#${version}";
     platforms = platforms.linux;
     maintainers = with maintainers; [ knedlsepp ];
   };
diff --git a/pkgs/applications/misc/minigalaxy/default.nix b/pkgs/applications/misc/minigalaxy/default.nix
index 6a1f14cbd44..2786492d47a 100644
--- a/pkgs/applications/misc/minigalaxy/default.nix
+++ b/pkgs/applications/misc/minigalaxy/default.nix
@@ -8,7 +8,7 @@
 , gtk3
 , python3
 , python3Packages
-, steam-run-native
+, steam-run
 , unzip
 , webkitgtk
 , wrapGAppsHook
@@ -54,14 +54,14 @@ python3Packages.buildPythonApplication rec {
     python3.pkgs.requests
     python3.pkgs.setuptools
     python3.pkgs.simplejson
-    steam-run-native
+    steam-run
     unzip
     webkitgtk
   ];
 
   # Run Linux games using the Steam Runtime by using steam-run in the wrapper
   postFixup = ''
-    sed -e 's#exec -a "$0"#exec -a "$0" ${steam-run-native}/bin/steam-run#' -i $out/bin/minigalaxy
+    sed -e 's#exec -a "$0"#exec -a "$0" ${steam-run}/bin/steam-run#' -i $out/bin/minigalaxy
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/misc/playonlinux/default.nix b/pkgs/applications/misc/playonlinux/default.nix
index 761d7f6f0f4..58d45d19bee 100644
--- a/pkgs/applications/misc/playonlinux/default.nix
+++ b/pkgs/applications/misc/playonlinux/default.nix
@@ -22,11 +22,12 @@
 , jq
 , xorg
 , libGL
-, steam-run-native
+, steam-run
 # needed for avoiding crash on file selector
 , gsettings-desktop-schemas
 , glib
 , wrapGAppsHook
+, hicolor-icon-theme
 }:
 
 let
@@ -89,6 +90,8 @@ in stdenv.mkDerivation {
     xorg.libX11
     libGL
     python
+    gsettings-desktop-schemas
+    hicolor-icon-theme
   ];
 
   postPatch = ''
@@ -110,7 +113,7 @@ in stdenv.mkDerivation {
     mkdir -p $out/bin
     cat > $out/bin/playonlinux <<EOF
     #!${stdenv.shell} -e
-    exec ${steam-run-native}/bin/steam-run $out/share/playonlinux/playonlinux-wrapper "\$@"
+    exec ${steam-run}/bin/steam-run $out/share/playonlinux/playonlinux-wrapper "\$@"
     EOF
     chmod a+x $out/bin/playonlinux
 
@@ -127,6 +130,15 @@ in stdenv.mkDerivation {
     done
   '';
 
+  dontWrapGApps = true;
+  postFixup = ''
+    makeWrapper $out/share/playonlinux/playonlinux{,-wrapped} \
+      --prefix PATH : ${binpath} \
+      ''${gappsWrapperArgs[@]}
+    makeWrapper ${steam-run}/bin/steam-run $out/bin/playonlinux \
+      --add-flags $out/share/playonlinux/playonlinux-wrapped
+  '';
+
   meta = with lib; {
     description = "GUI for managing Windows programs under linux";
     homepage = "https://www.playonlinux.com/";
diff --git a/pkgs/applications/misc/whalebird/default.nix b/pkgs/applications/misc/whalebird/default.nix
index d478655eed1..3920a3a8655 100644
--- a/pkgs/applications/misc/whalebird/default.nix
+++ b/pkgs/applications/misc/whalebird/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "whalebird";
-  version = "4.5.1";
+  version = "4.5.2";
 
   src = fetchurl {
     url = "https://github.com/h3poteto/whalebird-desktop/releases/download/${version}/Whalebird-${version}-linux-x64.deb";
-    sha256 = "sha256-70fCyxiM4CiNuG4Lqr4Tq0FHak3wDcp8G93EKYj+0kc=";
+    sha256 = "sha256-4ksKXVeUGICHfx014s5g9mapS751dbexBjzyqNvk02M=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/browsers/vivaldi/default.nix b/pkgs/applications/networking/browsers/vivaldi/default.nix
index 139bfdc965f..df9bdfb77fa 100644
--- a/pkgs/applications/networking/browsers/vivaldi/default.nix
+++ b/pkgs/applications/networking/browsers/vivaldi/default.nix
@@ -19,11 +19,11 @@ let
   vivaldiName = if isSnapshot then "vivaldi-snapshot" else "vivaldi";
 in stdenv.mkDerivation rec {
   pname = "vivaldi";
-  version = "5.1.2567.39-1";
+  version = "5.1.2567.49-1";
 
   src = fetchurl {
     url = "https://downloads.vivaldi.com/${branch}/vivaldi-${branch}_${version}_amd64.deb";
-    sha256 = "140idghryk132nyb8np011xiwzgh518n0fxrkjnnvi3c67shq7qc";
+    sha256 = "1cyd789apjh71vzry2zjxb0c215yarfryb9jzxjmkfvrqg4g23xr";
   };
 
   unpackPhase = ''
diff --git a/pkgs/applications/networking/cluster/octant/default.nix b/pkgs/applications/networking/cluster/octant/default.nix
index 7c97b9eaedb..70c25579079 100644
--- a/pkgs/applications/networking/cluster/octant/default.nix
+++ b/pkgs/applications/networking/cluster/octant/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "octant";
-  version = "0.25.0";
+  version = "0.25.1";
 
   src =
     let
@@ -19,10 +19,10 @@ stdenv.mkDerivation rec {
       };
     in
     fetchsrc version {
-      x86_64-linux = "sha256-woBmYDOOh3AQH0RZJtMCrOfjFBrpMPzv22cVZ2/xHZo=";
-      aarch64-linux = "sha256-3YUUdOZULjJZqVJP0aO/d1WulXlpwf012NYJ6Mc2qp8=";
-      x86_64-darwin = "sha256-9lbMyEid4I1fRLkLwGbmrB2OkycnGBPUU5wEdVZoTLo=";
-      aarch64-darwin = "sha256-Q0ZkQX9FpzEc6WC3mRoYfg9oW3fvLB1/Ksa64TDlSgo=";
+      x86_64-linux = "sha256-bYqycTB036J8trojySPNkC+jrw76F7+N4I4puGCyalU=";
+      aarch64-linux = "sha256-DlzSIZCAASPnflXQ8ndPU7/0jXA18U4bGGOfmgLXPr0=";
+      x86_64-darwin = "sha256-FaPyrPzO7AzC6LHQP5c58NjLTqU+ei8vFffT8x6mUhQ=";
+      aarch64-darwin = "sha256-31CYhAsHYIVAenp8hFHYj8LhFf3lSiOTw7gULBu3gio=";
     };
 
   dontConfigure = true;
diff --git a/pkgs/applications/networking/cluster/terraform/default.nix b/pkgs/applications/networking/cluster/terraform/default.nix
index 3954a143e5b..897acd76237 100644
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@@ -191,9 +191,9 @@ rec {
   };
 
   terraform_1 = mkTerraform {
-    version = "1.1.6";
-    sha256 = "sha256-Y1ARRCzqYBUQqpqwVrH0PPOZ9IWnw51yfyGFD/6P/ro=";
-    vendorSha256 = "sha256-RhGiY/APd12v0Hoqw381Wlk4oDx7aZt5zZvqkR99rd0=";
+    version = "1.1.7";
+    sha256 = "sha256-E8qY17MSdA7fQW4wGSDiPzbndBP5SZwelAJAWzka/io=";
+    vendorSha256 = "sha256-lyy/hcr00ix6qZoxzSfCbXvDC8dRB2ZjrONywpqbVZ8=";
     patches = [ ./provider-path-0_15.patch ];
     passthru = { inherit plugins; };
   };
diff --git a/pkgs/applications/networking/cluster/werf/default.nix b/pkgs/applications/networking/cluster/werf/default.nix
index e238e181ded..9c9cc56539d 100644
--- a/pkgs/applications/networking/cluster/werf/default.nix
+++ b/pkgs/applications/networking/cluster/werf/default.nix
@@ -11,13 +11,13 @@
 
 buildGoModule rec {
   pname = "werf";
-  version = "1.2.71";
+  version = "1.2.72";
 
   src = fetchFromGitHub {
     owner = "werf";
     repo = "werf";
     rev = "v${version}";
-    sha256 = "sha256-bDaxxeHeswuoEU7YACa3tU80DFnmuFvEPfAq+pANSWY=";
+    sha256 = "sha256-svnZBzFYKj9hIjv4SqPSP65rKIeWQqs2qwnx8J7dUIg=";
   };
   vendorSha256 = "sha256-75uCGxW6Gqfhk5oImz26fUR8BeGHkikXHGJcCH32MxQ=";
   proxyVendor = true;
diff --git a/pkgs/applications/networking/flexget/default.nix b/pkgs/applications/networking/flexget/default.nix
index 6c3a9b76935..05ee983765f 100644
--- a/pkgs/applications/networking/flexget/default.nix
+++ b/pkgs/applications/networking/flexget/default.nix
@@ -1,4 +1,7 @@
-{ lib, python3Packages, fetchFromGitHub }:
+{ lib
+, python3Packages
+, fetchFromGitHub
+}:
 
 python3Packages.buildPythonApplication rec {
   pname = "flexget";
@@ -9,7 +12,7 @@ python3Packages.buildPythonApplication rec {
     owner = "flexget";
     repo = "flexget";
     rev = "v${version}";
-    sha256 = "sha256-68tD7I7MI/Cp94tp6c4lQx+8xwRnJTKTF/3SWz4Ddgg=";
+    hash = "sha256-68tD7I7MI/Cp94tp6c4lQx+8xwRnJTKTF/3SWz4Ddgg=";
   };
 
   postPatch = ''
@@ -18,7 +21,7 @@ python3Packages.buildPythonApplication rec {
     ln -sf requirements.in requirements.txt
 
     # remove dependency constraints
-    sed 's/==\([0-9]\.\?\)\+//' -i requirements.txt
+    sed 's/[>=]=.*//' -i requirements.txt
 
     # "zxcvbn-python" was renamed to "zxcvbn", and we don't have the former in
     # nixpkgs. See: https://github.com/NixOS/nixpkgs/issues/62110
diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index 4f19fd924e7..9becd7504e0 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -3,7 +3,7 @@ let
   inherit (pkgs) callPackage fetchurl;
   versions = if stdenv.isLinux then {
     stable = "0.0.17";
-    ptb = "0.0.27";
+    ptb = "0.0.29";
     canary = "0.0.133";
   } else {
     stable = "0.0.264";
@@ -26,7 +26,7 @@ let
       ptb = fetchurl {
         url =
           "https://dl-ptb.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-        sha256 = "0yphs65wpyr0ap6y24b0nbhq7sm02dg5c1yiym1fxjbynm1mdvqb";
+        sha256 = "d78NnQZ3MkLje8mHrI6noH2iD2oEvSJ3cDnsmzQsUYc=";
       };
       canary = fetchurl {
         url =
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
index 8af5185386c..9cc4e057995 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@@ -24,7 +24,7 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "signal-desktop";
-  version = "5.31.1"; # Please backport all updates to the stable channel.
+  version = "5.33.0"; # Please backport all updates to the stable channel.
   # All releases have a limited lifetime and "expire" 90 days after the release.
   # When releases "expire" the application becomes unusable until an update is
   # applied. The expiration date for the current release can be extracted with:
@@ -34,7 +34,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "sha256-6w6znIIN5TFXTLLhazWyBXiqS5882zMNRZxYxnZjRHA=";
+    sha256 = "03c7pw6cmv8ryw2wqsfc27d953950jc8nxs58mgk08g62v4qa672";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/instant-messengers/teamspeak/client.nix b/pkgs/applications/networking/instant-messengers/teamspeak/client.nix
index ca6cc55d65a..80d04eabc82 100644
--- a/pkgs/applications/networking/instant-messengers/teamspeak/client.nix
+++ b/pkgs/applications/networking/instant-messengers/teamspeak/client.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl, makeWrapper, makeDesktopItem, zlib, glib, libpng, freetype, openssl
 , xorg, fontconfig, qtbase, qtwebengine, qtwebchannel, qtsvg, qtwebsockets, xkeyboard_config
-, alsa-lib, libpulseaudio ? null, libredirect, quazip, which, unzip, llvmPackages, writeShellScriptBin
+, alsa-lib, libpulseaudio ? null, libredirect, quazip, which, unzip, llvmPackages_10, writeShellScriptBin
 }:
 
 let
@@ -13,7 +13,7 @@ let
     [ zlib glib libpng freetype xorg.libSM xorg.libICE xorg.libXrender openssl
       xorg.libXrandr xorg.libXfixes xorg.libXcursor xorg.libXinerama
       xorg.libxcb fontconfig xorg.libXext xorg.libX11 alsa-lib qtbase qtwebengine qtwebchannel qtsvg
-      qtwebsockets libpulseaudio quazip llvmPackages.libcxx llvmPackages.libcxxabi
+      qtwebsockets libpulseaudio quazip llvmPackages_10.libcxx llvmPackages_10.libcxxabi # llvmPackages_11 and higher crash https://github.com/NixOS/nixpkgs/issues/161395
     ];
 
   desktopItem = makeDesktopItem {
diff --git a/pkgs/applications/office/softmaker/desktop_items.nix b/pkgs/applications/office/softmaker/desktop_items.nix
index dfdf45da9e5..a97b3f7d37b 100644
--- a/pkgs/applications/office/softmaker/desktop_items.nix
+++ b/pkgs/applications/office/softmaker/desktop_items.nix
@@ -25,7 +25,9 @@
       "application/vnd.openxmlformats-officedocument.spreadsheetml.template"
       "application/vnd.ms-excel.sheet.macroenabled.12"
       "application/vnd.ms-excel.template.macroEnabled.12"
-      "application/x-dif;text/spreadsheet;text/csv"
+      "application/x-dif"
+      "text/spreadsheet"
+      "text/csv"
       "application/x-prn"
       "application/vnd.ms-excel.sheet.binary.macroenabled.12"
     ];
diff --git a/pkgs/applications/office/wpsoffice/default.nix b/pkgs/applications/office/wpsoffice/default.nix
index 178b2351a6b..46f2569b13a 100644
--- a/pkgs/applications/office/wpsoffice/default.nix
+++ b/pkgs/applications/office/wpsoffice/default.nix
@@ -142,7 +142,6 @@ stdenv.mkDerivation rec {
   installPhase = let
     steam-run = (steam.override {
       extraPkgs = p: buildInputs;
-      nativeOnly = true;
     }).run;
   in ''
     prefix=$out/opt/kingsoft/wps-office
diff --git a/pkgs/applications/science/biology/last/default.nix b/pkgs/applications/science/biology/last/default.nix
index 68cdd9f120b..bbe661b4f0a 100644
--- a/pkgs/applications/science/biology/last/default.nix
+++ b/pkgs/applications/science/biology/last/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "last";
-  version = "1260";
+  version = "1268";
 
   src = fetchFromGitLab {
     owner = "mcfrith";
     repo = "last";
     rev = version;
-    sha256 = "sha256-bJNvoHr2sQYtiC3tr1GA0T0kRhDyx6hU3OOSTvKUSCs=";
+    sha256 = "sha256-9yzeLg3xporl32sZ1Ks8s63jXJNGUiI64XyQmhbQF4M=";
   };
 
   nativeBuildInputs = [ unzip ];
@@ -24,8 +24,8 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Genomic sequence aligner";
-    homepage = "http://last.cbrc.jp/";
-    license = licenses.gpl3;
+    homepage = "https://gitlab.com/mcfrith/last";
+    license = licenses.gpl3Plus;
     maintainers = with maintainers; [ jbedo ];
     platforms = platforms.x86_64;
   };
diff --git a/pkgs/applications/terminal-emulators/alacritty/default.nix b/pkgs/applications/terminal-emulators/alacritty/default.nix
index 78c6c0988c5..e7730ba4b94 100644
--- a/pkgs/applications/terminal-emulators/alacritty/default.nix
+++ b/pkgs/applications/terminal-emulators/alacritty/default.nix
@@ -54,16 +54,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "alacritty";
-  version = "0.10.0";
+  version = "0.10.1";
 
   src = fetchFromGitHub {
     owner = "alacritty";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-eVPy47T2wcsN7NxtwMoyuC6loBVXsoJjJ/2q31i3vxQ=";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-Q/ulRgU6zNLRZUjL83O/Krx85voPWZPZDo65CLp/aOg=";
   };
 
-  cargoSha256 = "sha256-RY+qidm7NZFKq6P8qVaMpxYfTfHpZac2YJwuNbOJwoM=";
+  cargoSha256 = "sha256-S1V8hDuzp4sf6945gqs8QNVdu8jwPGVYjVbV6EY28Hk=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/build-support/dotnet/build-dotnet-module/default.nix b/pkgs/build-support/dotnet/build-dotnet-module/default.nix
index d3561282d3f..e3762327a10 100644
--- a/pkgs/build-support/dotnet/build-dotnet-module/default.nix
+++ b/pkgs/build-support/dotnet/build-dotnet-module/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenvNoCC, linkFarmFromDrvs, callPackage, nuget-to-nix, writeScript, makeWrapper, fetchurl, xml2, dotnetCorePackages, dotnetPackages, cacert }:
+{ lib, stdenvNoCC, linkFarmFromDrvs, callPackage, nuget-to-nix, writeScript, makeWrapper, fetchurl, xml2, dotnetCorePackages, dotnetPackages, mkNugetSource, mkNugetDeps, cacert }:
 
 { name ? "${args.pname}-${args.version}"
 , pname ? name
@@ -74,40 +74,13 @@ let
     inherit dotnet-sdk dotnet-test-sdk disabledTests nuget-source dotnet-runtime runtimeDeps buildType;
   }) dotnetConfigureHook dotnetBuildHook dotnetCheckHook dotnetInstallHook dotnetFixupHook;
 
-  _nugetDeps = linkFarmFromDrvs "${name}-nuget-deps" (import nugetDeps {
-    fetchNuGet = { pname, version, sha256 }: fetchurl {
-      name = "${pname}-${version}.nupkg";
-      url = "https://www.nuget.org/api/v2/package/${pname}/${version}";
-      inherit sha256;
-    };
-  });
+  _nugetDeps = mkNugetDeps { name = "${name}-nuget-deps"; nugetDeps = import nugetDeps; };
   _localDeps = linkFarmFromDrvs "${name}-local-nuget-deps" projectReferences;
 
-  nuget-source = stdenvNoCC.mkDerivation rec {
-    name = "${pname}-nuget-source";
-    meta.description = "A Nuget source with the dependencies for ${pname}";
-
-    nativeBuildInputs = [ dotnetPackages.Nuget xml2 ];
-    buildCommand = ''
-      export HOME=$(mktemp -d)
-      mkdir -p $out/{lib,share}
-
-      nuget sources Add -Name nixos -Source "$out/lib"
-      nuget init "${_nugetDeps}" "$out/lib"
-      ${lib.optionalString (projectReferences != [])
-        "nuget init \"${_localDeps}\" \"$out/lib\""}
-
-      # Generates a list of all unique licenses' spdx ids.
-      find "$out/lib" -name "*.nuspec" -exec sh -c \
-        "xml2 < {} | grep "license=" | cut -d'=' -f2" \; | sort -u > $out/share/licenses
-    '';
-  } // { # This is done because we need data from `$out` for `meta`. We have to use overrides as to not hit infinite recursion.
-    meta.licence = let
-      depLicenses = lib.splitString "\n" (builtins.readFile "${nuget-source}/share/licenses");
-      getLicence = spdx: lib.filter (license: license.spdxId or null == spdx) (builtins.attrValues lib.licenses);
-    in (lib.flatten (lib.forEach depLicenses (spdx:
-      if (getLicence spdx) != [] then (getLicence spdx) else [] ++ lib.optional (spdx != "") spdx
-    )));
+  nuget-source = mkNugetSource {
+    name = "${args.pname}-nuget-source";
+    description = "A Nuget source with the dependencies for ${args.pname}";
+    deps = [ _nugetDeps _localDeps ];
   };
 
 in stdenvNoCC.mkDerivation (args // {
@@ -158,7 +131,6 @@ in stdenvNoCC.mkDerivation (args // {
           ${lib.optionalString (!enableParallelBuilding) "--disable-parallel"} \
           -p:ContinuousIntegrationBuild=true \
           -p:Deterministic=true \
-          -p:RestoreUseStaticGraphEvaluation=true \
           --packages "$HOME/nuget_pkgs" \
           ${lib.optionalString (dotnetRestoreFlags != []) (builtins.toString dotnetRestoreFlags)} \
           ${lib.optionalString (dotnetFlags != []) (builtins.toString dotnetFlags)}
diff --git a/pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-configure-hook.sh b/pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-configure-hook.sh
index e0522dc95ce..3ca89fdc095 100644
--- a/pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-configure-hook.sh
+++ b/pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-configure-hook.sh
@@ -16,7 +16,6 @@ dotnetConfigureHook() {
             dotnet restore "$project" \
                 -p:ContinuousIntegrationBuild=true \
                 -p:Deterministic=true \
-                -p:RestoreUseStaticGraphEvaluation=true \
                 --source "@nugetSource@/lib" \
                 ${parallelFlag-} \
                 "${dotnetRestoreFlags[@]}" \
diff --git a/pkgs/build-support/dotnet/make-nuget-deps/default.nix b/pkgs/build-support/dotnet/make-nuget-deps/default.nix
new file mode 100644
index 00000000000..75178d5b779
--- /dev/null
+++ b/pkgs/build-support/dotnet/make-nuget-deps/default.nix
@@ -0,0 +1,9 @@
+{ linkFarmFromDrvs, fetchurl }:
+{ name, nugetDeps }:
+  linkFarmFromDrvs "${name}-nuget-deps" (nugetDeps {
+    fetchNuGet = { pname, version, sha256 }: fetchurl {
+      name = "${pname}-${version}.nupkg";
+      url = "https://www.nuget.org/api/v2/package/${pname}/${version}";
+      inherit sha256;
+    };
+  })
diff --git a/pkgs/build-support/dotnet/make-nuget-source/default.nix b/pkgs/build-support/dotnet/make-nuget-source/default.nix
new file mode 100644
index 00000000000..0690a05aa2b
--- /dev/null
+++ b/pkgs/build-support/dotnet/make-nuget-source/default.nix
@@ -0,0 +1,30 @@
+{ dotnetPackages, lib, xml2, stdenvNoCC }:
+{ name, description ? "", deps ? [] }:
+let
+  _nuget-source = stdenvNoCC.mkDerivation rec {
+    inherit name;
+    meta.description = description;
+
+    nativeBuildInputs = [ dotnetPackages.Nuget xml2 ];
+    buildCommand = ''
+      export HOME=$(mktemp -d)
+      mkdir -p $out/{lib,share}
+
+      nuget sources Add -Name nixos -Source "$out/lib"
+      ${ lib.concatMapStringsSep "\n" (dep:
+          ''nuget init "${dep}" "$out/lib"''
+        ) deps }
+
+      # Generates a list of all unique licenses' spdx ids.
+      find "$out/lib" -name "*.nuspec" -exec sh -c \
+        "xml2 < {} | grep "license=" | cut -d'=' -f2" \; | sort -u > $out/share/licenses
+    '';
+} // { # This is done because we need data from `$out` for `meta`. We have to use overrides as to not hit infinite recursion.
+  meta.licence = let
+    depLicenses = lib.splitString "\n" (builtins.readFile "${_nuget-source}/share/licenses");
+    getLicence = spdx: lib.filter (license: license.spdxId or null == spdx) (builtins.attrValues lib.licenses);
+  in (lib.flatten (lib.forEach depLicenses (spdx:
+    if (getLicence spdx) != [] then (getLicence spdx) else [] ++ lib.optional (spdx != "") spdx
+  )));
+};
+in _nuget-source
diff --git a/pkgs/build-support/make-darwin-bundle/write-darwin-bundle.nix b/pkgs/build-support/make-darwin-bundle/write-darwin-bundle.nix
index 63ef7e65507..d21e0475e2d 100644
--- a/pkgs/build-support/make-darwin-bundle/write-darwin-bundle.nix
+++ b/pkgs/build-support/make-darwin-bundle/write-darwin-bundle.nix
@@ -4,33 +4,34 @@ let
   pListText = lib.generators.toPlist { } {
     CFBundleDevelopmentRegion = "English";
     CFBundleExecutable = "$name";
-    CFBundleIconFiles = [ "$iconPlistArray" ];
+    CFBundleIconFile = "$icon";
     CFBundleIdentifier = "org.nixos.$name";
     CFBundleInfoDictionaryVersion = "6.0";
     CFBundleName = "$name";
     CFBundlePackageType = "APPL";
     CFBundleSignature = "???";
   };
-
-# The generation of the CFBundleIconFiles array is a bit of a hack, since we
-# will always end up with an empty first element (<string></string>) but macOS
-# appears to ignore this which allows us to use the nix PList generator.
 in writeScriptBin "write-darwin-bundle" ''
     shopt -s nullglob
 
-    readonly prefix="$1"
-    readonly name="$2"
-    readonly exec="$3"
-    iconPlistArray=""
+    readonly prefix=$1
+    readonly name=$2
+    readonly exec=$3
+    readonly icon=$4.icns
+    readonly squircle=''${5:-1}
+    readonly plist=$prefix/Applications/$name.app/Contents/Info.plist
 
-    for icon in "$prefix/Applications/$name.app/Contents/Resources"/*; do
-        iconPlistArray="$iconPlistArray</string><string>"$(basename "$icon")""
-    done
-
-    cat > "$prefix/Applications/$name.app/Contents/Info.plist" <<EOF
+    cat > "$plist" <<EOF
 ${pListText}
 EOF
 
+  if [[ $squircle != 0 && $squircle != "false" ]]; then
+    sed  "
+      s|CFBundleIconFile|CFBundleIconFiles|;
+      s|<string>$icon</string>|<array><string>$icon</string></array>|
+    " -i "$plist"
+  fi
+
     cat > "$prefix/Applications/$name.app/Contents/MacOS/$name" <<EOF
 #!/bin/bash
 exec $prefix/bin/$exec
diff --git a/pkgs/build-support/setup-hooks/desktop-to-darwin-bundle.sh b/pkgs/build-support/setup-hooks/desktop-to-darwin-bundle.sh
index d1175d3a5f9..b2e2738cb6e 100644
--- a/pkgs/build-support/setup-hooks/desktop-to-darwin-bundle.sh
+++ b/pkgs/build-support/setup-hooks/desktop-to-darwin-bundle.sh
@@ -10,31 +10,156 @@ getDesktopParam() {
     awk -F "=" "/${pattern}/ {print \$2}" "${file}"
 }
 
+# Convert a freedesktop.org icon theme for a given app to a .icns file. When possible, missing
+# icons are synthesized from SVG or rescaled from existing ones (when within the size threshold).
+convertIconTheme() {
+    local -r out=$1
+    local -r sharePath=$2
+    local -r iconName=$3
+    local -r theme=${4:-hicolor}
+
+    local -ra iconSizes=(16 32 48 128 256 512)
+    local -ra scales=([1]="" [2]="@2")
+
+    # Based loosely on the algorithm at:
+    # https://specifications.freedesktop.org/icon-theme-spec/icon-theme-spec-latest.html#icon_lookup
+    # Assumes threshold = 2 for ease of implementation.
+    function findIcon() {
+        local -r iconSize=$1
+        local -r scale=$2
+
+        local scaleSuffix=${scales[$scale]}
+        local exactSize=${iconSize}x${iconSize}${scaleSuffix}
+
+        if [[ $exactSize = '48x48@2' ]]; then
+            # macOS does not support a 2x scale variant of 48x48 icons
+            # See: https://en.wikipedia.org/wiki/Apple_Icon_Image_format#Icon_types
+            echo "unsupported"
+            return 0
+        fi
+
+        local -a validSizes=(
+            ${exactSize}
+            $((iconSize + 1))x$((iconSize + 1))${scaleSuffix}
+            $((iconSize + 2))x$((iconSize + 2))${scaleSuffix}
+            $((iconSize - 1))x$((iconSize - 1))${scaleSuffix}
+            $((iconSize - 2))x$((iconSize - 2))${scaleSuffix}
+        )
+
+        for iconIndex in "${!candidateIcons[@]}"; do
+            for maybeSize in "${validSizes[@]}"; do
+                icon=${candidateIcons[$iconIndex]}
+                if [[ $icon = */$maybeSize/* ]]; then
+                    if [[ $maybeSize = $exactSize ]]; then
+                        echo "fixed $icon"
+                    else
+                        echo "threshold $icon"
+                    fi
+                    return 0
+                fi
+            done
+        done
+        echo "scalable"
+    }
+
+    function resizeIcon() {
+        local -r in=$1
+        local -r out=$2
+        local -r iconSize=$3
+        local -r scale=$4
+
+        local density=$((72 * scale))x$((72 * scale))
+        local dim=$((iconSize * scale))
+
+        magick convert -scale "${dim}x${dim}" -density "$density" -units PixelsPerInch "$in" "$out"
+    }
+
+    function synthesizeIcon() {
+        local -r in=$1
+        local -r out=$2
+        local -r iconSize=$3
+        local -r scale=$4
+
+        if [[ $in != '-' ]]; then
+            local density=$((72 * scale))x$((72 * scale))
+            local dim=$((iconSize * scale))
+            rsvg-convert --keep-aspect-ratio --width "$dim" --height "$dim" "$in" --output "$out"
+            magick convert -density "$density" -units PixelsPerInch "$out" "$out"
+        else
+            return 1
+        fi
+    }
+
+    function getIcons() {
+        local -r sharePath=$1
+        local -r iconname=$2
+        local -r theme=$3
+        local -r resultdir=$(mktemp -d)
+
+        local -ar candidateIcons=(
+            "${sharePath}/icons/${theme}/"*"/${iconname}.png"
+            "${sharePath}/icons/${theme}/"*"/${iconname}.xpm"
+        )
+
+        local -a scalableIcon=("${sharePath}/icons/${theme}/scalable/${iconname}.svg"*)
+        if [[ ${#scalableIcon[@]} = 0 ]]; then
+            scalableIcon=('-')
+        fi
+
+        for iconSize in "${iconSizes[@]}"; do
+            for scale in "${!scales[@]}"; do
+                local iconResult=$(findIcon $iconSize $scale)
+                local type=${iconResult%% *}
+                local icon=${iconResult#* }
+                local scaleSuffix=${scales[$scale]}
+                local result=${resultdir}/${iconSize}x${iconSize}${scales[$scale]}${scaleSuffix:+x}.png
+                case $type in
+                    fixed)
+                        local density=$((72 * scale))x$((72 * scale))
+                        magick convert -density "$density" -units PixelsPerInch "$icon" "$result"
+                        ;;
+                    threshold)
+                        # Synthesize an icon of the exact size if a scalable icon is available
+                        # instead of scaling one and ending up with a fuzzy icon.
+                        if ! synthesizeIcon "${scalableIcon[0]}" "$result" "$iconSize" "$scale"; then
+                            resizeIcon "$icon" "$result" "$iconSize" "$scale"
+                        fi
+                        ;;
+                    scalable)
+                        synthesizeIcon "${scalableIcon[0]}" "$result" "$iconSize" "$scale" || true
+                        ;;
+                    *)
+                        ;;
+                esac
+            done
+        done
+        echo "$resultdir"
+    }
+
+    iconsdir=$(getIcons "$sharePath" "apps/${iconName}" "$theme")
+    if [[ ! -z "$(ls -1 "$iconsdir/"*)" ]]; then
+        icnsutil compose "$out/${iconName}.icns" "$iconsdir/"*
+    else
+        echo "Warning: no icons were found. Creating an empty icon for ${iconName}.icns."
+        touch "$out/${iconName}.icns"
+    fi
+}
+
 # For a given .desktop file, generate a darwin '.app' bundle for it.
 convertDesktopFile() {
-    local -r file="$1"
+    local -r file=$1
+    local -r sharePath=$(dirname "$(dirname "$file")")
     local -r name=$(getDesktopParam "${file}" "^Name")
     local -r exec=$(getDesktopParam "${file}" "Exec")
-    local -r iconName=$(getDesktopParam "${file}" "Icon")
-    local -r iconFiles=$(find "$out/share/icons/" -name "${iconName}.*" 2>/dev/null);
-    local -r pixMaps=$(find "$out/share/pixmaps/" -name "${iconName}.xpm" 2>/dev/null);
+    local -r iconName=$(getDesktopParam "${file}" "^Icon")
+    local -r squircle=$(getDesktopParam "${file}" "X-macOS-SquircleIcon")
 
     mkdir -p "$out/Applications/${name}.app/Contents/MacOS"
     mkdir -p "$out/Applications/${name}.app/Contents/Resources"
 
-    local i=0;
-    for icon in $iconFiles; do
-      ln -s "$icon" "$out/Applications/${name}.app/Contents/Resources/$i-$(basename "$icon")"
-      (( i +=1 ));
-    done
+    convertIconTheme "$out/Applications/${name}.app/Contents/Resources" "$sharePath" "$iconName"
 
-    for pixmap in $pixMaps; do
-      local newIconName="$i-$(basename "$pixmap")";
-      convert "$pixmap" "$out/Applications/${name}.app/Contents/Resources/${newIconName%.xpm}.png"
-      (( i +=1 ));
-    done
-
-    write-darwin-bundle "$out" "$name" "$exec"
+    write-darwin-bundle "$out" "$name" "$exec" "$iconName" "$squircle"
 }
 
 convertDesktopFiles() {
diff --git a/pkgs/build-support/writers/default.nix b/pkgs/build-support/writers/default.nix
index 30301e3b2e5..0fb9bd939a5 100644
--- a/pkgs/build-support/writers/default.nix
+++ b/pkgs/build-support/writers/default.nix
@@ -1,4 +1,4 @@
-{ pkgs, config, buildPackages, lib, stdenv, libiconv, gawk, gnused, gixy }:
+{ pkgs, config, buildPackages, lib, stdenv, libiconv, mkNugetDeps, mkNugetSource, gawk, gnused, gixy }:
 
 let
   aliases = if (config.allowAliases or true) then (import ./aliases.nix lib) else prev: {};
@@ -301,6 +301,42 @@ let
   writePyPy3Bin = name:
     writePyPy3 "/bin/${name}";
 
+
+  makeFSharpWriter = { dotnet-sdk ? pkgs.dotnet-sdk, fsi-flags ? "", libraries ? _: [] }: nameOrPath:
+  let
+    fname = last (builtins.split "/" nameOrPath);
+    path = if strings.hasSuffix ".fsx" nameOrPath then nameOrPath else "${nameOrPath}.fsx";
+    _nugetDeps = mkNugetDeps { name = "${fname}-nuget-deps"; nugetDeps = libraries; };
+
+    nuget-source = mkNugetSource {
+      name = "${fname}-nuget-source";
+      description = "A Nuget source with the dependencies for ${fname}";
+      deps = [ _nugetDeps ];
+    };
+
+    fsi = writeBash "fsi" ''
+      export DOTNET_SKIP_FIRST_TIME_EXPERIENCE=1
+      export DOTNET_CLI_TELEMETRY_OPTOUT=1
+      export DOTNET_NOLOGO=1
+      script="$1"; shift
+      ${dotnet-sdk}/bin/dotnet fsi --quiet --nologo --readline- ${fsi-flags} "$@" < "$script"
+    '';
+
+  in content: writers.makeScriptWriter {
+    interpreter = fsi;
+  } path
+  ''
+    #i "nuget: ${nuget-source}/lib"
+    ${ content }
+    exit 0
+  '';
+
+  writeFSharp =
+    makeFSharpWriter {};
+
+  writeFSharpBin = name:
+    writeFSharp "/bin/${name}";
+
 };
 in
 writers // (aliases writers)
diff --git a/pkgs/build-support/writers/test.nix b/pkgs/build-support/writers/test.nix
index decd7e42d5c..d2e5cef83aa 100644
--- a/pkgs/build-support/writers/test.nix
+++ b/pkgs/build-support/writers/test.nix
@@ -150,6 +150,29 @@ let
       print(y[0]['test'])
     '';
 
+    fsharp = makeFSharpWriter {
+      libraries = { fetchNuGet }: [
+        (fetchNuGet { pname = "FSharp.SystemTextJson"; version = "0.17.4"; sha256 = "1bplzc9ybdqspii4q28l8gmfvzpkmgq5l1hlsiyg2h46w881lwg2"; })
+      ];
+    } "test-writers-fsharp" ''
+      #r "nuget: FSharp.SystemTextJson, 0.17.4"
+
+      module Json =
+          open System.Text.Json
+          open System.Text.Json.Serialization
+          let options = JsonSerializerOptions()
+          options.Converters.Add(JsonFSharpConverter())
+          let serialize<'a> (o: 'a) = JsonSerializer.Serialize<'a>(o, options)
+          let deserialize<'a> (str: string) = JsonSerializer.Deserialize<'a>(str, options)
+
+      type Letter = A | B
+      let a = {| Hello = Some "World"; Letter = A |}
+      if a |> Json.serialize |> Json.deserialize |> (=) a
+      then "success"
+      else "failed"
+      |> printfn "%s"
+    '';
+
     pypy2NoLibs = writePyPy2 "test-writers-pypy2-no-libs" {} ''
       print("success")
     '';
@@ -161,6 +184,10 @@ let
     pypy3NoLibs = writePyPy3 "test-writers-pypy3-no-libs" {} ''
       print("success")
     '';
+
+    fsharpNoNugetDeps = writeFSharp "test-writers-fsharp-no-nuget-deps" ''
+      printfn "success"
+    '';
   };
 
 
diff --git a/pkgs/desktops/pantheon/apps/appcenter/default.nix b/pkgs/desktops/pantheon/apps/appcenter/default.nix
index d62141ece2b..93c10d07292 100644
--- a/pkgs/desktops/pantheon/apps/appcenter/default.nix
+++ b/pkgs/desktops/pantheon/apps/appcenter/default.nix
@@ -7,6 +7,7 @@
 , desktop-file-utils
 , elementary-icon-theme
 , fetchFromGitHub
+, fetchpatch
 , flatpak
 , gettext
 , glib
@@ -38,6 +39,17 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-xktIHQHmz5gh72NEz9UQ9fMvBlj1BihWxHgxsHmTIB0=";
   };
 
+  patches = [
+    # Fix AppStream.PoolFlags being renamed
+    # Though the API break has been fixed in latest appstream,
+    # let's use the non-deprecated version anyway.
+    # https://github.com/elementary/appcenter/pull/1794
+    (fetchpatch {
+      url = "https://github.com/elementary/appcenter/commit/84bc6400713484aa9365f0ba73f59c495da3f08b.patch";
+      sha256 = "sha256-HNRCJ/5mRbEVjCq9nrXtdQOOk1Jj5jalApkghD8ecpk=";
+    })
+  ];
+
   nativeBuildInputs = [
     appstream-glib
     dbus # for pkg-config
diff --git a/pkgs/desktops/pantheon/desktop/elementary-greeter/default.nix b/pkgs/desktops/pantheon/desktop/elementary-greeter/default.nix
index fe7a8e946d1..45a8f119ee0 100644
--- a/pkgs/desktops/pantheon/desktop/elementary-greeter/default.nix
+++ b/pkgs/desktops/pantheon/desktop/elementary-greeter/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , nix-update-script
 , linkFarm
 , substituteAll
@@ -31,13 +30,13 @@
 
 stdenv.mkDerivation rec {
   pname = "elementary-greeter";
-  version = "6.0.1";
+  version = "6.0.2";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = "greeter";
     rev = version;
-    sha256 = "1f606ds56sp1c58q8dblfpaq9pwwkqw9i4gkwksw45m2xkwlbflq";
+    sha256 = "sha256-0chBM8JuCYgZXHneiSxSICZwBVm2Vgx+bas9wUjbnyg=";
   };
 
   patches = [
@@ -47,15 +46,6 @@ stdenv.mkDerivation rec {
       src = ./hardcode-fallback-background.patch;
       default_wallpaper = "${nixos-artwork.wallpapers.simple-dark-gray.gnomeFilePath}";
     })
-    # https://github.com/NixOS/nixpkgs/issues/151609
-    # https://github.com/elementary/greeter/issues/578#issuecomment-1030746697
-    ./fix-crash.patch
-    # Fix build with meson 0.61
-    # https://github.com/elementary/greeter/pull/590
-    (fetchpatch {
-      url = "https://github.com/elementary/greeter/commit/a4b25244058fce794a9f13f6b22a8ff7735ebde9.patch";
-      sha256 = "sha256-qPXhdvmYG8YMDU/CjbEkfZ0glgRzxnu0TsOPtvWHxLY=";
-    })
   ];
 
   nativeBuildInputs = [
@@ -80,7 +70,6 @@ stdenv.mkDerivation rec {
     libhandy
     lightdm
     mutter
-    wingpanel-with-indicators
   ];
 
   mesonFlags = [
diff --git a/pkgs/desktops/pantheon/desktop/elementary-greeter/fix-crash.patch b/pkgs/desktops/pantheon/desktop/elementary-greeter/fix-crash.patch
deleted file mode 100644
index ca6f6aab6d6..00000000000
--- a/pkgs/desktops/pantheon/desktop/elementary-greeter/fix-crash.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-diff --git a/src/Cards/UserCard.vala b/src/Cards/UserCard.vala
-index 83df22c..8cd917e 100644
---- a/src/Cards/UserCard.vala
-+++ b/src/Cards/UserCard.vala
-@@ -42,6 +42,7 @@ public class Greeter.UserCard : Greeter.BaseCard {
-     private Gtk.Stack login_stack;
-     private Greeter.PasswordEntry password_entry;
- 
-+    private SelectionCheck logged_in;
-     private unowned Gtk.StyleContext logged_in_context;
-     private weak Gtk.StyleContext main_grid_style_context;
-     private weak Gtk.StyleContext password_entry_context;
-@@ -214,7 +215,7 @@ public class Greeter.UserCard : Greeter.BaseCard {
-         };
-         avatar_overlay.add (avatar);
- 
--        var logged_in = new SelectionCheck () {
-+        logged_in = new SelectionCheck () {
-             halign = Gtk.Align.END,
-             valign = Gtk.Align.END
-         };
diff --git a/pkgs/development/interpreters/clisp/default.nix b/pkgs/development/interpreters/clisp/default.nix
index 2a387d34f47..926308f0d30 100644
--- a/pkgs/development/interpreters/clisp/default.nix
+++ b/pkgs/development/interpreters/clisp/default.nix
@@ -24,11 +24,11 @@ assert x11Support -> (libX11 != null && libXau != null && libXt != null
   && libXpm != null && xorgproto != null && libXext != null);
 
 stdenv.mkDerivation rec {
-  v = "2.49";
-  name = "clisp-${v}";
+  version = "2.49";
+  pname = "clisp";
 
   src = fetchurl {
-    url = "mirror://gnu/clisp/release/${v}/${name}.tar.bz2";
+    url = "mirror://gnu/clisp/release/${version}/clisp-${version}.tar.bz2";
     sha256 = "8132ff353afaa70e6b19367a25ae3d5a43627279c25647c220641fed00f8e890";
   };
 
diff --git a/pkgs/development/interpreters/clisp/hg.nix b/pkgs/development/interpreters/clisp/hg.nix
index 7ab4134facb..7b10d2cad0e 100644
--- a/pkgs/development/interpreters/clisp/hg.nix
+++ b/pkgs/development/interpreters/clisp/hg.nix
@@ -23,8 +23,8 @@ assert x11Support -> (libX11 != null && libXau != null && libXt != null
   && libXpm != null && xorgproto != null && libXext != null);
 
 stdenv.mkDerivation rec {
-  v = "2.50pre20171114";
-  name = "clisp-${v}";
+  version = "2.50pre20171114";
+  pname = "clisp";
 
   src = fetchhg {
     url = "http://hg.code.sf.net/p/clisp/clisp";
diff --git a/pkgs/development/libraries/febio/default.nix b/pkgs/development/libraries/febio/default.nix
new file mode 100644
index 00000000000..4d01bf52bf7
--- /dev/null
+++ b/pkgs/development/libraries/febio/default.nix
@@ -0,0 +1,55 @@
+{ lib, stdenv, fetchFromGitHub, cmake, boost, eigen, libxml2, mpi, python3
+, mklSupport ? true, mkl
+}:
+
+stdenv.mkDerivation rec {
+  pname = "FEBio";
+  version = "3.6";
+
+  src = fetchFromGitHub {
+    owner = "febiosoftware";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "187s4lyzr806xla3smq3lsvj3f6wxlhfkban89w0fnyfmfb8w9am";
+  };
+
+  patches = [
+    ./fix-cmake.patch  # cannot find mkl libraries without this
+  ];
+
+  cmakeFlags = lib.optional mklSupport "-DUSE_MKL=On"
+    ++ lib.optional mklSupport "-DMKLROOT=${mkl}"
+  ;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/include
+    cp -R lib bin $out/
+    cp -R ../FECore \
+      ../FEBioFluid \
+      ../FEBioLib \
+      ../FEBioMech \
+      ../FEBioMix \
+      ../FEBioOpt \
+      ../FEBioPlot \
+      ../FEBioXML \
+      ../NumCore \
+      $out/include
+
+    runHook postInstall
+  '';
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ boost eigen libxml2 mpi python3 python3.pkgs.numpy ]
+   ++ lib.optional mklSupport mkl
+  ;
+
+  meta = {
+    description = "FEBio Suite Solver";
+    license = with lib.licenses; [ mit ];
+    homepage = "https://febio.org/";
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ Scriptkiddi ];
+  };
+}
diff --git a/pkgs/development/libraries/febio/fix-cmake.patch b/pkgs/development/libraries/febio/fix-cmake.patch
new file mode 100644
index 00000000000..5af10a0b396
--- /dev/null
+++ b/pkgs/development/libraries/febio/fix-cmake.patch
@@ -0,0 +1,26 @@
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -47,7 +47,7 @@ function(findLib libName libDir libOut)
+         find_library(TEMP NAMES ${libName}.lib ${ARGV3}.lib ${ARGV4}.lib ${ARGV5}.lib ${ARGV6}.lib
+             PATHS ${${libDir}} NO_DEFAULT_PATH)
+     else()
+-        find_library(TEMP NAMES lib${libName}.a lib${ARGV3}.a lib${ARGV4}.a lib${ARGV5}.a lib${ARGV6}.a
++        find_library(TEMP NAMES lib${libName}.a lib${ARGV3}.a lib${ARGV4}.a lib${ARGV5}.a lib${ARGV6}.a lib${libName}.so lib${ARGV3}.so lib${ARGV4}.so lib${ARGV5}.so lib${ARGV6}.so
+             PATHS ${${libDir}} NO_DEFAULT_PATH)
+     endif()
+     
+diff --git a/FindDependencies.cmake b/FindDependencies.cmake
+index 2d644005f..7261ba923 100644
+--- a/FindDependencies.cmake
++++ b/FindDependencies.cmake
+@@ -46,8 +46,8 @@ if(MKLROOT)
+             NO_DEFAULT_PATH)
+             
+         find_library(MKL_OMP_LIB 
+-            NAMES iomp5 iomp5md libiomp5md.lib
+-            PATHS ${MKLROOT}/../lib ${MKLROOT}/../compiler/lib
++            NAMES libiomp5.so libiomp5 iomp5 iomp5md libiomp5md.lib
++            PATHS ${MKLROOT}/lib ${MKLROOT}/../lib ${MKLROOT}/../compiler/lib
+             PATH_SUFFIXES "intel64" "intel32"
+             NO_DEFAULT_PATH
+             DOC "MKL OMP Library")
diff --git a/pkgs/development/libraries/libpulsar/default.nix b/pkgs/development/libraries/libpulsar/default.nix
new file mode 100644
index 00000000000..9abe3224120
--- /dev/null
+++ b/pkgs/development/libraries/libpulsar/default.nix
@@ -0,0 +1,102 @@
+{ lib
+, clang-tools
+, llvmPackages
+, boost17x
+, protobuf
+, python3Support ? false
+, python3
+, log4cxxSupport ? false
+, log4cxx
+, snappySupport ? false
+, snappy
+, zlibSupport ? true
+, zlib
+, zstdSupport ? true
+, zstd
+, gtest
+, gtestSupport ? false
+, cmake
+, curl
+, fetchurl
+, jsoncpp
+, openssl
+, pkg-config
+, stdenv
+}:
+
+let
+  /*
+    Check if null or false
+    Example:
+    let result = enableFeature null
+    => "OFF"
+    let result = enableFeature false
+    => "OFF"
+    let result = enableFeature «derivation»
+    => "ON"
+  */
+  enableCmakeFeature = p: if (p == null || p == false) then "OFF" else "ON";
+
+  # Not really sure why I need to do this.. If I call clang-tools without the override it defaults to a different version and fails
+  clangTools = clang-tools.override { inherit stdenv llvmPackages; };
+  # If boost has python enabled, then boost-python package will be installed which is used by libpulsars python wrapper
+  boost = if python3Support then boost17x.override { inherit stdenv; enablePython = python3Support; python = python3; } else boost17x;
+  defaultOptionals = [ boost protobuf ]
+    ++ lib.optional python3Support python3
+    ++ lib.optional snappySupport snappy.dev
+    ++ lib.optional zlibSupport zlib
+    ++ lib.optional zstdSupport zstd
+    ++ lib.optional log4cxxSupport log4cxx;
+
+in
+stdenv.mkDerivation rec {
+  pname = "libpulsar";
+  version = "2.9.1";
+
+  src = fetchurl {
+    hash = "sha512-NKHiL7D/Lmnn6ICpQyUmmQYQETz4nZPJU9/4LMRDUQ3Pck6qDh+t6CRk+b9UQ2Vb0jvPIGTjEsSp2nC7TJk3ug==";
+    url = "mirror://apache/pulsar/pulsar-${version}/apache-pulsar-${version}-src.tar.gz";
+  };
+
+  sourceRoot = "apache-pulsar-${version}-src/pulsar-client-cpp";
+
+  # clang-tools needed for clang-format
+  nativeBuildInputs = [ cmake pkg-config clangTools ]
+    ++ defaultOptionals
+    ++ lib.optional gtestSupport gtest.dev;
+
+  buildInputs = [ jsoncpp openssl curl ]
+    ++ defaultOptionals;
+
+  # Needed for GCC on Linux
+  NIX_CFLAGS_COMPILE = [ "-Wno-error=return-type" ];
+
+  cmakeFlags = [
+    "-DBUILD_TESTS=${enableCmakeFeature gtestSupport}"
+    "-DBUILD_PYTHON_WRAPPER=${enableCmakeFeature python3Support}"
+    "-DUSE_LOG4CXX=${enableCmakeFeature log4cxxSupport}"
+    "-DClangTools_PATH=${clangTools}/bin"
+  ];
+
+  enableParallelBuilding = true;
+  doInstallCheck = true;
+  installCheckPhase = ''
+    echo ${lib.escapeShellArg ''
+      #include <pulsar/Client.h>
+      int main (int argc, char **argv) {
+        pulsar::Client client("pulsar://localhost:6650");
+        return 0;
+      }
+    ''} > test.cc
+    $CXX test.cc -L $out/lib -I $out/include -lpulsar -o test
+  '';
+
+  meta = with lib; {
+    homepage = "https://pulsar.apache.org/docs/en/client-libraries-cpp";
+    description = "Apache Pulsar C++ library";
+
+    platforms = platforms.all;
+    license = licenses.asl20;
+    maintainers = [ maintainers.corbanr ];
+  };
+}
diff --git a/pkgs/development/libraries/mimalloc/default.nix b/pkgs/development/libraries/mimalloc/default.nix
index 1e9e44e0997..22d4567c562 100644
--- a/pkgs/development/libraries/mimalloc/default.nix
+++ b/pkgs/development/libraries/mimalloc/default.nix
@@ -1,4 +1,5 @@
 { lib, stdenv, fetchFromGitHub, cmake, ninja
+, fetchpatch
 , secureBuild ? false
 }:
 
@@ -7,14 +8,28 @@ let
 in
 stdenv.mkDerivation rec {
   pname   = "mimalloc";
-  version = "2.0.2";
+  version = "2.0.5";
 
   src = fetchFromGitHub {
     owner  = "microsoft";
     repo   = pname;
     rev    = "v${version}";
-    sha256 = "sha256-n4FGld3bq6ZOSLTzXcVlucCGbQ5/eSFbijU0dfBD/T0=";
+    sha256 = "sha256-q3W/w1Ofqt6EbKF/Jf9wcC+7jAxh59B3cOGxudWQXlA=";
   };
+  patches = [
+    (fetchpatch {
+      name = "older-macos-fixes.patch";
+      url = "https://github.com/microsoft/mimalloc/commit/40e0507a5959ee218f308d33aec212c3ebeef3bb.patch";
+      sha256 = "15qx2a3axhhwbfzxdis98b8j14y9cfgca0i484aj2pjpqnm0pb8c";
+    })
+  ];
+
+  doCheck = true;
+  preCheck = let
+    ldLibraryPathEnv = if stdenv.isDarwin then "DYLD_LIBRARY_PATH" else "LD_LIBRARY_PATH";
+  in ''
+    export ${ldLibraryPathEnv}="$(pwd)/build:''${${ldLibraryPathEnv}}"
+  '';
 
   nativeBuildInputs = [ cmake ninja ];
   cmakeFlags = [ "-DMI_INSTALL_TOPLEVEL=ON" ] ++ lib.optional secureBuild [ "-DMI_SECURE=ON" ];
@@ -25,10 +40,9 @@ stdenv.mkDerivation rec {
   in ''
     # first, move headers and cmake files, that's easy
     mkdir -p $dev/lib
-    mv $out/include $dev/include
-    mv $out/cmake $dev/lib/
+    mv $out/lib/cmake $dev/lib/
 
-    find $out/lib
+    find $dev $out -type f
   '' + (lib.optionalString secureBuild ''
     # pretend we're normal mimalloc
     ln -sfv $out/lib/libmimalloc-secure${suffix} $out/lib/libmimalloc${suffix}
@@ -44,6 +58,6 @@ stdenv.mkDerivation rec {
     homepage    = "https://github.com/microsoft/mimalloc";
     license     = licenses.bsd2;
     platforms   = platforms.unix;
-    maintainers = with maintainers; [ thoughtpolice ];
+    maintainers = with maintainers; [ kamadorueda thoughtpolice ];
   };
 }
diff --git a/pkgs/development/php-packages/swoole/default.nix b/pkgs/development/php-packages/swoole/default.nix
index 99b2b53f7ee..3cbd55221e1 100644
--- a/pkgs/development/php-packages/swoole/default.nix
+++ b/pkgs/development/php-packages/swoole/default.nix
@@ -3,8 +3,8 @@
 buildPecl {
   pname = "swoole";
 
-  version = "4.8.6";
-  sha256 = "sha256-4ot8LXpWcjMmD3e/EzrYNMxqUPPupQQkv2ibLkZoWxs=";
+  version = "4.8.7";
+  sha256 = "sha256-yoiMuIbIgwkuvoeIJT1gC8UsOE504nEQ+XsE7Oprb9o=";
 
   buildInputs = [ pcre2 ] ++ lib.optionals (!stdenv.isDarwin) [ valgrind ];
   internalDeps = lib.optionals (lib.versionOlder php.version "7.4") [ php.extensions.hash ];
diff --git a/pkgs/development/python-modules/adafruit-io/default.nix b/pkgs/development/python-modules/adafruit-io/default.nix
new file mode 100644
index 00000000000..88bdff440c4
--- /dev/null
+++ b/pkgs/development/python-modules/adafruit-io/default.nix
@@ -0,0 +1,57 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, paho-mqtt
+, pytestCheckHook
+, pythonOlder
+, requests
+, setuptools-scm
+}:
+
+buildPythonPackage rec {
+  pname = "adafruit-io";
+  version = "2.6.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "adafruit";
+    repo = "Adafruit_IO_Python";
+    rev = version;
+    hash = "sha256-tjm+HvUuLK3IxXwuxPidJaBetj+n0BzKOuLj75bM7a8=";
+  };
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    paho-mqtt
+    requests
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "Adafruit_IO"
+  ];
+
+  disabledTestPaths = [
+    # Tests requires valid credentials
+    "tests/test_client.py"
+    "tests/test_errors.py"
+    "tests/test_mqtt_client.py"
+  ];
+
+  meta = with lib; {
+    description = "Module for interacting with Adafruit IO";
+    homepage = "https://github.com/adafruit/Adafruit_IO_Python";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/adafruit-platformdetect/default.nix b/pkgs/development/python-modules/adafruit-platformdetect/default.nix
index da4ac528d1a..1ae1a31fa3d 100644
--- a/pkgs/development/python-modules/adafruit-platformdetect/default.nix
+++ b/pkgs/development/python-modules/adafruit-platformdetect/default.nix
@@ -6,13 +6,13 @@
 
 buildPythonPackage rec {
   pname = "adafruit-platformdetect";
-  version = "3.20.0";
+  version = "3.20.1";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "Adafruit-PlatformDetect";
     inherit version;
-    sha256 = "sha256-bbzEI/Ig7yQn4/fRmX8tIe6UL+J8iV1TbrCXBU+oLms=";
+    sha256 = "sha256-P5OWPsbRsTEMcvw7/uq0rj9p/4beVj/2OdWkllVMKMw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/fleep/0001-Fixing-paths-on-tests.patch b/pkgs/development/python-modules/fleep/0001-Fixing-paths-on-tests.patch
new file mode 100644
index 00000000000..234bf0cb379
--- /dev/null
+++ b/pkgs/development/python-modules/fleep/0001-Fixing-paths-on-tests.patch
@@ -0,0 +1,48 @@
+From 716fcfa3203bc881b543916bdb9a17460951cd26 Mon Sep 17 00:00:00 2001
+From: "P. R. d. O" <d.ol.rod@protonmail.com>
+Date: Fri, 26 Nov 2021 07:13:32 -0600
+Subject: [PATCH] Fixing paths on tests
+
+---
+ tests/maintest.py  | 7 ++++++-
+ tests/speedtest.py | 7 ++++++-
+ 2 files changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/tests/maintest.py b/tests/maintest.py
+index 0e24ca4..3484437 100644
+--- a/tests/maintest.py
++++ b/tests/maintest.py
+@@ -1,6 +1,11 @@
+ import fleep
++import os
+ 
+-with open("testfile", "rb") as file:
++current_dir = os.path.realpath(os.path.join(os.getcwd(),
++                                            os.path.dirname(__file__)))
++
++with open(os.path.join(current_dir, "./testfile"),
++          "rb") as file:
+     info = fleep.get(file.read(128))
+ 
+ assert info.type == ["raster-image"]
+diff --git a/tests/speedtest.py b/tests/speedtest.py
+index 89338ab..829d563 100644
+--- a/tests/speedtest.py
++++ b/tests/speedtest.py
+@@ -1,7 +1,12 @@
+ import time
+ import fleep
++import os
+ 
+-with open("testfile", "rb") as file:
++current_dir = os.path.realpath(os.path.join(os.getcwd(),
++                                            os.path.dirname(__file__)))
++
++with open(os.path.join(current_dir, "./testfile"),
++          "rb") as file:
+     stream = file.read(128)
+ 
+ times = []
+-- 
+2.33.1
+
diff --git a/pkgs/development/python-modules/fleep/default.nix b/pkgs/development/python-modules/fleep/default.nix
new file mode 100644
index 00000000000..04b60732513
--- /dev/null
+++ b/pkgs/development/python-modules/fleep/default.nix
@@ -0,0 +1,36 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, python
+}:
+
+buildPythonPackage rec {
+  pname = "fleep";
+  version = "1.0.1";
+
+  # Pypi version does not have tests
+  src = fetchFromGitHub {
+    owner = "floyernick";
+    repo = "fleep-py";
+    rev = "994bc2c274482d80ab13d89d8f7343eb316d3e44";
+    sha256 = "sha256-TaU7njx98nxkhZawGMFqWj4g+yCtIX9aPWQHoamzfMY=";
+  };
+
+  patches = [
+    ./0001-Fixing-paths-on-tests.patch
+  ];
+
+  checkPhase = ''
+    ${python.interpreter} tests/maintest.py
+    ${python.interpreter} tests/speedtest.py
+  '';
+
+  pythonImportsCheck = [ "fleep" ];
+
+  meta = with lib; {
+    description = "File format determination library";
+    homepage = "https://github.com/floyernick/fleep-py";
+    license = licenses.mit;
+    maintainers = with maintainers; [ wolfangaukang ];
+  };
+}
diff --git a/pkgs/development/python-modules/graphql-subscription-manager/default.nix b/pkgs/development/python-modules/graphql-subscription-manager/default.nix
index db3aea752b7..afcbe157a1e 100644
--- a/pkgs/development/python-modules/graphql-subscription-manager/default.nix
+++ b/pkgs/development/python-modules/graphql-subscription-manager/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "graphql-subscription-manager";
-  version = "0.5.0";
+  version = "0.5.1";
 
   disabled = pythonOlder "3.7";
 
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "Danielhiversen";
     repo = "PyGraphqlWebsocketManager";
     rev = version;
-    sha256 = "sha256-18GR0OZeEh6EQT0kKCJyq7ckvKYKDJn/lugN5xlRg64=";
+    sha256 = "sha256-PVQa6JmBnToXuL/wNkYO0b+K1e9yrQgRUzWNUbFN5mM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/icnsutil/default.nix b/pkgs/development/python-modules/icnsutil/default.nix
new file mode 100644
index 00000000000..05c24ec7c37
--- /dev/null
+++ b/pkgs/development/python-modules/icnsutil/default.nix
@@ -0,0 +1,31 @@
+{ lib
+, python
+, fetchFromGitHub
+, buildPythonPackage
+}:
+
+buildPythonPackage rec {
+  pname = "icnsutil";
+  version = "1.0.1";
+
+  src = fetchFromGitHub {
+    owner = "relikd";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-TfQvAbP7iCpRQg2G+ejl245NCYo9DpYwMgiwY2BuJnY=";
+  };
+
+  doCheck = true;
+
+  checkPhase = ''
+    ${python.interpreter} tests/test_icnsutil.py
+    ${python.interpreter} tests/test_cli.py
+  '';
+
+  meta = {
+    homepage = "https://github.com/relikd/icnsutil";
+    description = "Create and extract .icns files.";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.reckenrode ];
+  };
+}
diff --git a/pkgs/development/python-modules/jschema-to-python/default.nix b/pkgs/development/python-modules/jschema-to-python/default.nix
index a9100e061d7..5b25b5c18a4 100644
--- a/pkgs/development/python-modules/jschema-to-python/default.nix
+++ b/pkgs/development/python-modules/jschema-to-python/default.nix
@@ -15,13 +15,10 @@ buildPythonPackage rec {
     sha256 = "76ff14fe5d304708ccad1284e4b11f96a658949a31ee7faed9e0995279549b91";
   };
 
-  nativeBuildInputs = [
-    pbr
-  ];
-
   propagatedBuildInputs = [
     attrs
     jsonpickle
+    pbr
   ];
 
   checkInputs =[
diff --git a/pkgs/development/python-modules/meshtastic/default.nix b/pkgs/development/python-modules/meshtastic/default.nix
index 51d62c884dc..2fd61bc5a37 100644
--- a/pkgs/development/python-modules/meshtastic/default.nix
+++ b/pkgs/development/python-modules/meshtastic/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "meshtastic";
-  version = "1.2.87";
+  version = "1.2.88";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "meshtastic";
     repo = "Meshtastic-python";
     rev = version;
-    sha256 = "sha256-W56nTTbRcSRkT15xn24ywkIVNHRUavV5Z8EST3BFkjk=";
+    sha256 = "sha256-iNDS1QjlDiXb89g7Gut+5ShbgtCCHBSJuQmXfHaTXB8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/mypy-boto3-builder/default.nix b/pkgs/development/python-modules/mypy-boto3-builder/default.nix
index 4bb37145637..3276c563159 100644
--- a/pkgs/development/python-modules/mypy-boto3-builder/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3-builder/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "mypy-boto3-builder";
-  version = "7.1.2";
+  version = "7.2.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.10";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "vemel";
     repo = "mypy_boto3_builder";
     rev = version;
-    hash = "sha256-p81Dk6Kv0MzHvexhM8Su5/yIpB+ZGBFqOtm0D18l26s=";
+    hash = "sha256-jovvSNw2ahCwhA+9zOrn9bR2siXJetZPymQVG4EC9Us=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/nextcord/default.nix b/pkgs/development/python-modules/nextcord/default.nix
new file mode 100644
index 00000000000..345a77239bf
--- /dev/null
+++ b/pkgs/development/python-modules/nextcord/default.nix
@@ -0,0 +1,64 @@
+{ lib
+, stdenv
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitHub
+, substituteAll
+, ffmpeg
+, libopus
+, aiohttp
+, aiodns
+, brotli
+, cchardet
+, orjson
+, pynacl
+}:
+
+buildPythonPackage rec {
+  pname = "nextcord";
+  version = "2.0.0a8";
+
+  format = "setuptools";
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "nextcord";
+    repo = "nextcord";
+    rev = version;
+    hash = "sha256-aYFY58zWZlZwW3xwa1iAK4w29AofKIkTyCjQ2nR8JrY=";
+  };
+
+  patches = [
+    (substituteAll {
+      src = ./paths.patch;
+      ffmpeg = "${ffmpeg}/bin/ffmpeg";
+      libopus = "${libopus}/lib/libopus${stdenv.hostPlatform.extensions.sharedLibrary}";
+    })
+  ];
+
+  propagatedBuildInputs = [
+    aiodns
+    aiohttp
+    brotli
+    cchardet
+    orjson
+    pynacl
+  ];
+
+  # upstream has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "nextcord"
+    "nextcord.ext.commands"
+    "nextcord.ext.tasks"
+  ];
+
+  meta = with lib; {
+    description = "Python wrapper for the Discord API forked from discord.py";
+    homepage = "https://github.com/nextcord/nextcord";
+    license = licenses.mit;
+    maintainers = with maintainers; [ dotlambda ];
+  };
+}
diff --git a/pkgs/development/python-modules/nextcord/paths.patch b/pkgs/development/python-modules/nextcord/paths.patch
new file mode 100644
index 00000000000..389637a1887
--- /dev/null
+++ b/pkgs/development/python-modules/nextcord/paths.patch
@@ -0,0 +1,26 @@
+diff --git a/nextcord/opus.py b/nextcord/opus.py
+index 97d437a3..755e1a5c 100644
+--- a/nextcord/opus.py
++++ b/nextcord/opus.py
+@@ -213,7 +213,7 @@ def _load_default() -> bool:
+             _filename = os.path.join(_basedir, 'bin', f'libopus-0.{_target}.dll')
+             _lib = libopus_loader(_filename)
+         else:
+-            _lib = libopus_loader(ctypes.util.find_library('opus'))
++            _lib = libopus_loader('@libopus@')
+     except Exception:
+         _lib = None
+ 
+diff --git a/nextcord/player.py b/nextcord/player.py
+index bedefc5a..34de0459 100644
+--- a/nextcord/player.py
++++ b/nextcord/player.py
+@@ -140,7 +140,7 @@ class FFmpegAudio(AudioSource):
+     .. versionadded:: 1.3
+     """
+ 
+-    def __init__(self, source: Union[str, io.BufferedIOBase], *, executable: str = 'ffmpeg', args: Any, **subprocess_kwargs: Any):
++    def __init__(self, source: Union[str, io.BufferedIOBase], *, executable: str = '@ffmpeg@', args: Any, **subprocess_kwargs: Any):
+         piping = subprocess_kwargs.get('stdin') == subprocess.PIPE
+         if piping and isinstance(source, str):
+             raise TypeError("parameter conflict: 'source' parameter cannot be a string when piping to stdin")
diff --git a/pkgs/development/python-modules/opensfm/0002-cmake-find-system-distributed-gtest.patch b/pkgs/development/python-modules/opensfm/0002-cmake-find-system-distributed-gtest.patch
new file mode 100644
index 00000000000..27b87c0b2d0
--- /dev/null
+++ b/pkgs/development/python-modules/opensfm/0002-cmake-find-system-distributed-gtest.patch
@@ -0,0 +1,57 @@
+From 79577371be21df40f1f6d4a4fe3453be6df9e93c Mon Sep 17 00:00:00 2001
+From: Someone Serge <sergei.kozlukov@aalto.fi>
+Date: Fri, 31 Dec 2021 10:03:25 +0200
+Subject: [PATCH 2/4] cmake: find system-distributed gtest
+
+---
+ opensfm/src/CMakeLists.txt | 19 +++++++------------
+ 1 file changed, 7 insertions(+), 12 deletions(-)
+
+diff --git a/opensfm/src/CMakeLists.txt b/opensfm/src/CMakeLists.txt
+index c85aa6fb..640d47a6 100644
+--- a/opensfm/src/CMakeLists.txt
++++ b/opensfm/src/CMakeLists.txt
+@@ -52,12 +52,14 @@ if (OPENMP_FOUND)
+   set (CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} ${OpenMP_CXX_FLAGS}")
+ endif()
+ 
++find_package(gflags REQUIRED)
++
+ find_package(LAPACK)
+ find_package(SuiteSparse)
+ find_package(Eigen3 REQUIRED)
+ find_package(Ceres)
+-find_package(Gflags REQUIRED)
+-find_package(Glog REQUIRED)
++find_package(glog REQUIRED)
++find_package(GTest REQUIRED)
+ 
+ # Ceres2 exposes Ceres::ceres target.
+ # Ceres1 exposes just ceres.
+@@ -100,20 +102,13 @@ option(OPENSFM_BUILD_TESTS "Build OpenSfM unit tests." on)
+ 
+ if (OPENSFM_BUILD_TESTS)
+   enable_testing()
+-  include_directories(third_party/gtest)
+-  add_definitions(-DCERES_GFLAGS_NAMESPACE=${GFLAGS_NAMESPACE})
+-
+-  add_library(gtest
+-              third_party/gtest/gmock_gtest_all.cc
+-              third_party/gtest/gmock_main.cc)
+-  target_include_directories(gtest PRIVATE ${GFLAGS_INCLUDE_DIR})
+ 
+   set(TEST_MAIN test_main)
+   add_library(${TEST_MAIN} testing_main.cc)
+   target_link_libraries(${TEST_MAIN}
+-                        ${GFLAGS_LIBRARY}
+-                        ${GLOG_LIBRARY}
+-                        gtest)
++      gflags
++      glog::glog
++      GTest::gtest)
+ endif()
+ 
+ ####### OpenSfM libraries #######
+-- 
+2.33.1
+
diff --git a/pkgs/development/python-modules/opensfm/0003-cmake-use-system-pybind11.patch b/pkgs/development/python-modules/opensfm/0003-cmake-use-system-pybind11.patch
new file mode 100644
index 00000000000..2815886e7e1
--- /dev/null
+++ b/pkgs/development/python-modules/opensfm/0003-cmake-use-system-pybind11.patch
@@ -0,0 +1,161 @@
+From 36820fbab1abeeebd99f14e368093e0e3f934ca7 Mon Sep 17 00:00:00 2001
+From: Someone Serge <sergei.kozlukov@aalto.fi>
+Date: Sat, 19 Feb 2022 02:37:54 +0200
+Subject: [PATCH 3/4] cmake: use system pybind11
+
+---
+ opensfm/src/CMakeLists.txt            | 3 ++-
+ opensfm/src/bundle/CMakeLists.txt     | 2 +-
+ opensfm/src/dense/CMakeLists.txt      | 2 +-
+ opensfm/src/features/CMakeLists.txt   | 1 -
+ opensfm/src/foundation/CMakeLists.txt | 1 -
+ opensfm/src/geo/CMakeLists.txt        | 1 -
+ opensfm/src/geometry/CMakeLists.txt   | 1 -
+ opensfm/src/map/CMakeLists.txt        | 3 +--
+ opensfm/src/robust/CMakeLists.txt     | 1 -
+ opensfm/src/sfm/CMakeLists.txt        | 1 -
+ 10 files changed, 5 insertions(+), 11 deletions(-)
+
+diff --git a/opensfm/src/CMakeLists.txt b/opensfm/src/CMakeLists.txt
+index 640d47a6..6e391ffa 100644
+--- a/opensfm/src/CMakeLists.txt
++++ b/opensfm/src/CMakeLists.txt
+@@ -54,6 +54,8 @@ endif()
+ 
+ find_package(gflags REQUIRED)
+ 
++find_package(pybind11 REQUIRED)
++
+ find_package(LAPACK)
+ find_package(SuiteSparse)
+ find_package(Eigen3 REQUIRED)
+@@ -82,7 +84,6 @@ else()
+ endif()
+ 
+ ####### Third party libraries #######
+-add_subdirectory(third_party/pybind11)
+ add_subdirectory(third_party/akaze)
+ add_subdirectory(third_party/vlfeat)
+ 
+diff --git a/opensfm/src/bundle/CMakeLists.txt b/opensfm/src/bundle/CMakeLists.txt
+index 7cd9cf74..307e963a 100644
+--- a/opensfm/src/bundle/CMakeLists.txt
++++ b/opensfm/src/bundle/CMakeLists.txt
+@@ -52,7 +52,7 @@ target_link_libraries(pybundle PRIVATE
+   bundle
+   geometry
+   foundation
+-  pybind11)
++)
+ set_target_properties(pybundle PROPERTIES
+     LIBRARY_OUTPUT_DIRECTORY "${opensfm_SOURCE_DIR}/.."
+ )
+diff --git a/opensfm/src/dense/CMakeLists.txt b/opensfm/src/dense/CMakeLists.txt
+index cbebb5ea..2728749d 100644
+--- a/opensfm/src/dense/CMakeLists.txt
++++ b/opensfm/src/dense/CMakeLists.txt
+@@ -23,7 +23,7 @@ endif()
+ 
+ pybind11_add_module(pydense python/pybind.cc)
+ target_include_directories(pydense PRIVATE ${GLOG_INCLUDE_DIR})
+-target_link_libraries(pydense PRIVATE dense foundation pybind11)
++target_link_libraries(pydense PRIVATE dense foundation)
+ set_target_properties(pydense PROPERTIES
+     LIBRARY_OUTPUT_DIRECTORY "${opensfm_SOURCE_DIR}/.."
+ )
+diff --git a/opensfm/src/features/CMakeLists.txt b/opensfm/src/features/CMakeLists.txt
+index b131d30a..6db5b3f1 100644
+--- a/opensfm/src/features/CMakeLists.txt
++++ b/opensfm/src/features/CMakeLists.txt
+@@ -22,7 +22,6 @@ target_link_libraries(pyfeatures
+   PRIVATE
+     features
+     foundation
+-    pybind11
+     akaze
+ )
+ set_target_properties(pyfeatures PROPERTIES
+diff --git a/opensfm/src/foundation/CMakeLists.txt b/opensfm/src/foundation/CMakeLists.txt
+index 40185227..9e0e45e7 100644
+--- a/opensfm/src/foundation/CMakeLists.txt
++++ b/opensfm/src/foundation/CMakeLists.txt
+@@ -12,7 +12,6 @@ set(FOUNDATION_FILES
+ add_library(foundation ${FOUNDATION_FILES})
+ target_link_libraries(foundation
+   PUBLIC
+-    pybind11
+     ${OpenCV_LIBS}
+     ${OpenMP_libomp_LIBRARY}
+     Eigen3::Eigen
+diff --git a/opensfm/src/geo/CMakeLists.txt b/opensfm/src/geo/CMakeLists.txt
+index a9cbae02..75620d06 100644
+--- a/opensfm/src/geo/CMakeLists.txt
++++ b/opensfm/src/geo/CMakeLists.txt
+@@ -29,7 +29,6 @@ target_link_libraries(pygeo
+   PRIVATE
+     geo
+     foundation
+-    pybind11
+ )
+ set_target_properties(pygeo PROPERTIES
+     LIBRARY_OUTPUT_DIRECTORY "${opensfm_SOURCE_DIR}/.."
+diff --git a/opensfm/src/geometry/CMakeLists.txt b/opensfm/src/geometry/CMakeLists.txt
+index e6dda2c2..51bfd6c5 100644
+--- a/opensfm/src/geometry/CMakeLists.txt
++++ b/opensfm/src/geometry/CMakeLists.txt
+@@ -48,7 +48,6 @@ target_link_libraries(pygeometry
+   PRIVATE
+     geometry
+     foundation
+-    pybind11
+ )
+ set_target_properties(pygeometry PROPERTIES
+     LIBRARY_OUTPUT_DIRECTORY "${opensfm_SOURCE_DIR}/.."
+diff --git a/opensfm/src/map/CMakeLists.txt b/opensfm/src/map/CMakeLists.txt
+index b6f67bcd..f869aa4c 100644
+--- a/opensfm/src/map/CMakeLists.txt
++++ b/opensfm/src/map/CMakeLists.txt
+@@ -20,7 +20,7 @@ set(MAP_FILES
+ add_library(map ${MAP_FILES})
+ target_link_libraries(map
+   PUBLIC
+-    pybind11
++    pybind11::module
+     Eigen3::Eigen
+   PRIVATE
+     geo
+@@ -39,7 +39,6 @@ target_link_libraries(pymap
+     map
+     geometry
+     bundle
+-    pybind11
+ )
+ 
+ if (OPENSFM_BUILD_TESTS)
+diff --git a/opensfm/src/robust/CMakeLists.txt b/opensfm/src/robust/CMakeLists.txt
+index ce70749f..40bdf7a4 100644
+--- a/opensfm/src/robust/CMakeLists.txt
++++ b/opensfm/src/robust/CMakeLists.txt
+@@ -29,7 +29,6 @@ target_link_libraries(pyrobust
+   PRIVATE
+     robust
+     foundation
+-    pybind11
+ )
+ set_target_properties(pyrobust PROPERTIES
+     LIBRARY_OUTPUT_DIRECTORY "${opensfm_SOURCE_DIR}/.."
+diff --git a/opensfm/src/sfm/CMakeLists.txt b/opensfm/src/sfm/CMakeLists.txt
+index 98c28f41..7f56b791 100644
+--- a/opensfm/src/sfm/CMakeLists.txt
++++ b/opensfm/src/sfm/CMakeLists.txt
+@@ -35,7 +35,6 @@ target_include_directories(pysfm PRIVATE ${GLOG_INCLUDE_DIR})
+ target_link_libraries(pysfm
+   PRIVATE
+     foundation
+-    pybind11
+     sfm
+ )
+ set_target_properties(pysfm PROPERTIES
+-- 
+2.33.1
+
diff --git a/pkgs/development/python-modules/opensfm/0004-pybind_utils.h-conflicts-with-nixpkgs-pybind.patch b/pkgs/development/python-modules/opensfm/0004-pybind_utils.h-conflicts-with-nixpkgs-pybind.patch
new file mode 100644
index 00000000000..f3cb2db00ec
--- /dev/null
+++ b/pkgs/development/python-modules/opensfm/0004-pybind_utils.h-conflicts-with-nixpkgs-pybind.patch
@@ -0,0 +1,86 @@
+From c35b110a83286e7413d7309eb218eb43b52f7d48 Mon Sep 17 00:00:00 2001
+From: Someone Serge <sergei.kozlukov@aalto.fi>
+Date: Sat, 19 Feb 2022 14:36:12 +0200
+Subject: [PATCH 4/4] pybind_utils.h: conflicts with nixpkgs' pybind
+
+---
+ opensfm/src/map/pybind_utils.h | 45 +++-------------------------------
+ 1 file changed, 3 insertions(+), 42 deletions(-)
+
+diff --git a/opensfm/src/map/pybind_utils.h b/opensfm/src/map/pybind_utils.h
+index 817d1a16..3f98a2ab 100644
+--- a/opensfm/src/map/pybind_utils.h
++++ b/opensfm/src/map/pybind_utils.h
+@@ -52,38 +52,6 @@ struct sfm_iterator_state {
+ };
+ PYBIND11_NAMESPACE_END_(detail)
+ 
+-/// Makes an python iterator over the keys (`.first`) of a iterator over pairs
+-/// from a first and past-the-end InputIterator.
+-template <return_value_policy Policy = return_value_policy::reference_internal,
+-          typename Iterator, typename Sentinel,
+-          typename KeyType = decltype((*std::declval<Iterator>()).second),
+-          typename... Extra>
+-iterator make_value_iterator(Iterator first, Sentinel last, Extra &&... extra) {
+-  typedef detail::sfm_iterator_state<Iterator, Sentinel, detail::RefIterator,
+-                                     Policy>
+-      state;
+-
+-  if (!detail::get_type_info(typeid(state), false)) {
+-    class_<state>(handle(), "iterator", pybind11::module_local())
+-        .def("__iter__", [](state &s) -> state & { return s; })
+-        .def("__next__",
+-             [](state &s) -> KeyType {
+-               if (!s.first_or_done)
+-                 ++s.it;
+-               else
+-                 s.first_or_done = false;
+-               if (s.it == s.end) {
+-                 s.first_or_done = true;
+-                 throw stop_iteration();
+-               }
+-               return (*s.it).second;
+-             },
+-             std::forward<Extra>(extra)..., Policy);
+-  }
+-
+-  return cast(state{first, last, true});
+-}
+-
+ template <return_value_policy Policy = return_value_policy::reference_internal,
+           typename Iterator, typename Sentinel,
+           typename KeyType = decltype(&((*std::declval<Iterator>()).second)),
+@@ -148,12 +116,13 @@ iterator make_ref_iterator(Iterator first, Sentinel last, Extra &&... extra) {
+ }
+ 
+ /// Makes a python iterator from a first and past-the-end C++ InputIterator.
+-template <return_value_policy Policy = return_value_policy::reference_internal,
++template <typename Access,
++          return_value_policy Policy = return_value_policy::reference_internal,
+           typename Iterator, typename Sentinel,
+           typename ValueType = decltype(std::declval<Iterator>()),
+           typename... Extra>
+ iterator make_ptr_iterator(Iterator first, Sentinel last, Extra &&... extra) {
+-  typedef detail::iterator_state<Iterator, Sentinel, false, Policy> state;
++  typedef detail::iterator_state<Access, Policy, Iterator, Sentinel, ValueType, Extra...> state;
+ 
+   if (!detail::get_type_info(typeid(state), false)) {
+     class_<state>(handle(), "iterator", pybind11::module_local())
+@@ -176,14 +145,6 @@ iterator make_ptr_iterator(Iterator first, Sentinel last, Extra &&... extra) {
+   return cast(state{first, last, true});
+ }
+ 
+-/// Makes an iterator over the keys (`.first`) of a stl map-like container
+-/// supporting `std::begin()`/`std::end()`
+-template <return_value_policy Policy = return_value_policy::reference_internal,
+-          typename Type, typename... Extra>
+-iterator make_value_iterator(Type &value, Extra &&... extra) {
+-  return make_value_iterator<Policy>(std::begin(value), std::end(value),
+-                                     extra...);
+-}
+ template <return_value_policy Policy = return_value_policy::reference_internal,
+           typename Type, typename... Extra>
+ iterator make_unique_ptr_value_iterator(Type &value, Extra &&... extra) {
+-- 
+2.33.1
+
diff --git a/pkgs/development/python-modules/opensfm/default.nix b/pkgs/development/python-modules/opensfm/default.nix
new file mode 100644
index 00000000000..dec998f451c
--- /dev/null
+++ b/pkgs/development/python-modules/opensfm/default.nix
@@ -0,0 +1,127 @@
+{ lib
+, stdenv
+, buildPythonPackage
+, fetchFromGitHub
+, fetchpatch
+, cmake
+, opencv4
+, ceres-solver
+, suitesparse
+, metis
+, eigen
+, pkg-config
+, pybind11
+, numpy
+, pyyaml
+, lapack
+, gtest
+, gflags
+, glog
+, pytestCheckHook
+, networkx
+, pillow
+, exifread
+, gpxpy
+, pyproj
+, python-dateutil
+, joblib
+, repoze_lru
+, xmltodict
+, cloudpickle
+, scipy
+, sphinx
+, matplotlib
+, fpdf
+,
+}:
+
+let
+  ceresSplit = (builtins.length ceres-solver.outputs) > 1;
+  ceres' =
+    if ceresSplit
+    then ceres-solver.dev
+    else ceres-solver;
+in
+buildPythonPackage rec {
+  pname = "OpenSfM";
+  version = "0.5.2";
+
+  src = fetchFromGitHub {
+    owner = "mapillary";
+    repo = pname;
+    rev = "79aa4bdd8bd08dc0cd9e3086d170cedb29ac9760";
+    sha256 = "sha256-dHBrkYwLA1OUxUSoe7DysyeEm9Yy70tIJvAsXivdjrM=";
+  };
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/mapillary/OpenSfM/pull/872/commits/a76671db11038f3f4dfe5b8f17582fb447ad7dd5.patch";
+      sha256 = "sha256-4nizQiZIjucdydOLrETvs1xdV3qiYqAQ7x1HECKvlHs=";
+    })
+    ./0002-cmake-find-system-distributed-gtest.patch
+    ./0003-cmake-use-system-pybind11.patch
+    ./0004-pybind_utils.h-conflicts-with-nixpkgs-pybind.patch
+    ./fix-scripts.patch
+  ];
+  postPatch = ''
+    rm opensfm/src/cmake/FindGlog.cmake
+    rm opensfm/src/cmake/FindGflags.cmake
+
+    # HAHOG is the default descriptor.
+    # We'll test both HAHOG and SIFT because this is
+    # where segfaults might be introduced in future
+    echo 'feature_type: SIFT' >> data/berlin/config.yaml
+    echo 'feature_type: HAHOG' >> data/lund/config.yaml
+  '';
+
+  nativeBuildInputs = [ cmake pkg-config sphinx ];
+  buildInputs = [
+    ceres'
+    suitesparse
+    metis
+    eigen
+    lapack
+    gflags
+    gtest
+    glog
+    pybind11
+  ];
+  propagatedBuildInputs = [
+    numpy
+    scipy
+    pyyaml
+    opencv4
+    networkx
+    pillow
+    matplotlib
+    fpdf
+    exifread
+    gpxpy
+    pyproj
+    python-dateutil
+    joblib
+    repoze_lru
+    xmltodict
+    cloudpickle
+  ];
+  checkInputs = [ pytestCheckHook ];
+
+  dontUseCmakeBuildDir = true;
+  cmakeFlags = [
+    "-Bcmake_build"
+    "-Sopensfm/src"
+  ];
+
+  disabledTests = lib.optionals stdenv.isDarwin [
+    "test_reconstruction_incremental"
+    "test_reconstruction_triangulation"
+  ];
+
+  pythonImportsCheck = [ "opensfm" ];
+
+  meta = {
+    maintainers = [ lib.maintainers.SomeoneSerge ];
+    license = lib.licenses.bsd2;
+    description = "Open source Structure-from-Motion pipeline from Mapillary";
+    homepage = "https://opensfm.org/";
+  };
+}
diff --git a/pkgs/development/python-modules/opensfm/fix-scripts.patch b/pkgs/development/python-modules/opensfm/fix-scripts.patch
new file mode 100644
index 00000000000..634820a3275
--- /dev/null
+++ b/pkgs/development/python-modules/opensfm/fix-scripts.patch
@@ -0,0 +1,41 @@
+diff --git a/bin/opensfm b/bin/opensfm
+index b5ee4b15..f05c0d1c 100755
+--- a/bin/opensfm
++++ b/bin/opensfm
+@@ -1,12 +1,6 @@
+-#!/bin/bash
++#!/usr/bin/env bash
+ set -e
+ 
+ DIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )
+ 
+-if [ -x "$(command -v python3)" ]; then
+-    PYTHON=python3
+-else
+-    PYTHON=python
+-fi
+-
+-"$PYTHON" "$DIR"/opensfm_main.py "$@"
++exec "$DIR"/opensfm_main.py "$@"
+diff --git a/bin/opensfm_main.py b/bin/opensfm_main.py
+index 31249e12..cc71560c 100755
+--- a/bin/opensfm_main.py
++++ b/bin/opensfm_main.py
+@@ -1,3 +1,5 @@
++#!/usr/bin/env python
++
+ import sys
+ from os.path import abspath, join, dirname
+ 
+diff --git a/setup.py b/setup.py
+index 1120717f..438a16db 100644
+--- a/setup.py
++++ b/setup.py
+@@ -71,6 +71,7 @@ setuptools.setup(
+     scripts=[
+         "bin/opensfm_run_all",
+         "bin/opensfm",
++        "bin/opensfm_main.py",
+     ],
+     package_data={
+         "opensfm": [
diff --git a/pkgs/development/python-modules/pex/default.nix b/pkgs/development/python-modules/pex/default.nix
index 0b816fecf64..7648a7440a7 100644
--- a/pkgs/development/python-modules/pex/default.nix
+++ b/pkgs/development/python-modules/pex/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "pex";
-  version = "2.1.68";
+  version = "2.1.69";
   format = "flit";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-IuYEDKK4sQQ9xVBfHWtya/t9pLNX2gYcXMBpn72FDyo=";
+    sha256 = "sha256-JbQ8yn/uALjjVSRgqKXsQOC4rOCGkMPxb50KqWg89kM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/plaid-python/default.nix b/pkgs/development/python-modules/plaid-python/default.nix
index a57156f2604..16bcd15a1b1 100644
--- a/pkgs/development/python-modules/plaid-python/default.nix
+++ b/pkgs/development/python-modules/plaid-python/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "plaid-python";
-  version = "8.11.0";
+  version = "9.0.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-zvwqMpI/aufZLf9dSVEDY2Letiyso8oSf9o5kanXW7U=";
+    hash = "sha256-jZRfJVBSUOrfaPx8yGCwigfDghUgO0dK8aUKrOf9G1E=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pycfmodel/default.nix b/pkgs/development/python-modules/pycfmodel/default.nix
index 1385b415613..9f3a61a990e 100644
--- a/pkgs/development/python-modules/pycfmodel/default.nix
+++ b/pkgs/development/python-modules/pycfmodel/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "pycfmodel";
-  version = "0.16.3";
+  version = "0.17.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "Skyscanner";
     repo = pname;
     rev = version;
-    hash = "sha256-/0JSnJy/OUbYX26wTZ3RloVy74bU2D4Z6NOLq6IkI7o=";
+    hash = "sha256-IfeGNAgVCnrzipQpGiEqfWWNkUNmeH7TInl8kje52js=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pychromecast/default.nix b/pkgs/development/python-modules/pychromecast/default.nix
index f5921d0dfd2..37ef4da7daf 100644
--- a/pkgs/development/python-modules/pychromecast/default.nix
+++ b/pkgs/development/python-modules/pychromecast/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pychromecast";
-  version = "10.2.3";
+  version = "10.3.0";
   format = "setuptools";
 
   disabled = !isPy3k;
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "PyChromecast";
     inherit version;
-    sha256 = "ddb86c5acdc13e8bdadd2b7f5738fda36b32c1750548f7b629ca8d178f05e0da";
+    sha256 = "sha256-TrEHRG/b7YdvSMgyArYhKyIShhaKVcFrPrjt9CAPEKE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyprecice/default.nix b/pkgs/development/python-modules/pyprecice/default.nix
new file mode 100644
index 00000000000..9f2c457bc75
--- /dev/null
+++ b/pkgs/development/python-modules/pyprecice/default.nix
@@ -0,0 +1,26 @@
+{ lib, buildPythonPackage, fetchFromGitHub, precice, numpy, mpi4py, cython }:
+
+buildPythonPackage rec {
+  pname = "pyprecice";
+  version = "2.3.0.1";
+
+  src = fetchFromGitHub {
+    owner = "precice";
+    repo = "python-bindings";
+    rev = "v${version}";
+    sha256 = "1yz96pif63ms797bzxbfrjba4mgz7cz5dqrqghn5sg0g1b9qxnn5";
+  };
+
+  nativeBuildInputs = [ cython ];
+  propagatedBuildInputs = [ numpy mpi4py precice ];
+
+  doCheck = false; # Disable Test because everything depends on open mpi which requires network.
+  pythonImportChecks = [ "precice" ];
+
+  meta = with lib; {
+    description = "Python language bindings for preCICE";
+    homepage = "https://github.com/precice/python-bindings";
+    license = licenses.lgpl3Only;
+    maintainers = with maintainers; [ Scriptkiddi ];
+  };
+}
diff --git a/pkgs/development/python-modules/pyskyqremote/default.nix b/pkgs/development/python-modules/pyskyqremote/default.nix
index a971751c9ea..e72e38b30cb 100644
--- a/pkgs/development/python-modules/pyskyqremote/default.nix
+++ b/pkgs/development/python-modules/pyskyqremote/default.nix
@@ -1,7 +1,6 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, pycountry
 , pythonOlder
 , requests
 , websocket-client
@@ -10,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "pyskyqremote";
-  version = "0.3.2";
+  version = "0.3.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,11 +18,10 @@ buildPythonPackage rec {
     owner = "RogerSelwyn";
     repo = "skyq_remote";
     rev = version;
-    sha256 = "sha256-R/HmkVbVKbO54lDSw1tLYs2mXi/XqZX9GGXozv+96iI=";
+    sha256 = "sha256-/BhNoU1dnZj07ZvG126srSb6eW00n8htFuDttq006QE=";
   };
 
   propagatedBuildInputs = [
-    pycountry
     requests
     websocket-client
     xmltodict
diff --git a/pkgs/development/python-modules/soco/default.nix b/pkgs/development/python-modules/soco/default.nix
index 0922f8c10d2..e79a38d8cf5 100644
--- a/pkgs/development/python-modules/soco/default.nix
+++ b/pkgs/development/python-modules/soco/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "soco";
-  version = "0.26.3";
+  version = "0.26.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "SoCo";
     repo = "SoCo";
     rev = "v${version}";
-    hash = "sha256-tMW5SCsO1XMQdbasMw3qIMwj+Y6wTQHAmTZ+9r8Mffs=";
+    hash = "sha256-DoONq6Iqi8t47jtqggKYMHSNJAf/Kha3tszR6mYeB9Y=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/tifffile/python2-regex-compat.patch b/pkgs/development/python-modules/tifffile/python2-regex-compat.patch
deleted file mode 100644
index 7f4ec5764bb..00000000000
--- a/pkgs/development/python-modules/tifffile/python2-regex-compat.patch
+++ /dev/null
@@ -1,23 +0,0 @@
---- a/setup.py	2019-02-20 18:52:12.000000000 +0100
-+++ b/setup.py	2019-03-02 13:55:39.014019260 +0100
-@@ -20,12 +20,6 @@
- 
- description = re.search(r'"""(.*)\.(?:\r\n|\r|\n)', code).groups()[0]
- 
--readme = re.search(r'(?:\r\n|\r|\n){2}"""(.*)"""(?:\r\n|\r|\n){2}from', code,
--                   re.MULTILINE | re.DOTALL).groups()[0]
--
--readme = '\n'.join([description, '=' * len(description)]
--                   + readme.splitlines()[1:])
--
- license = re.search(r'(# Copyright.*?(?:\r\n|\r|\n))(?:\r\n|\r|\n)+""', code,
-                     re.MULTILINE | re.DOTALL).groups()[0]
- 
-@@ -41,7 +35,6 @@
-     name='tifffile',
-     version=version,
-     description=description,
--    long_description=readme,
-     author='Christoph Gohlke',
-     author_email='cgohlke@uci.edu',
-     url='https://www.lfd.uci.edu/~gohlke/',
diff --git a/pkgs/development/python-modules/torch-tb-profiler/default.nix b/pkgs/development/python-modules/torch-tb-profiler/default.nix
new file mode 100644
index 00000000000..fc53c5ba823
--- /dev/null
+++ b/pkgs/development/python-modules/torch-tb-profiler/default.nix
@@ -0,0 +1,48 @@
+{ buildPythonPackage
+, fetchFromGitHub
+, lib
+, pandas
+, pytestCheckHook
+, pytorch
+, tensorflow-tensorboard
+, torchvision
+}:
+
+let
+  version = "0.3.1";
+  repo = fetchFromGitHub {
+    owner = "pytorch";
+    repo = "kineto";
+    rev = "v${version}";
+    hash = "sha256-Yg001XzOPDmz9wEP2b7Ggz/uU6x5PFzaaBeUBwWKFS0=";
+  };
+in
+buildPythonPackage rec {
+  pname = "torch_tb_profiler";
+  inherit version;
+  format = "setuptools";
+
+  # See https://discourse.nixos.org/t/extracting-sub-directory-from-fetchgit-or-fetchurl-or-any-derivation/8830.
+  src = "${repo}/tb_plugin";
+
+  propagatedBuildInputs = [ pandas tensorflow-tensorboard ];
+
+  checkInputs = [ pytestCheckHook pytorch torchvision ];
+
+  disabledTests = [
+    # Tests that attempt to access the filesystem in naughty ways.
+    "test_profiler_api_without_gpu"
+    "test_tensorboard_end2end"
+    "test_tensorboard_with_path_prefix"
+    "test_tensorboard_with_symlinks"
+  ];
+
+  pythonImportsCheck = [ "torch_tb_profiler" ];
+
+  meta = with lib; {
+    description = "PyTorch Profiler TensorBoard Plugin";
+    homepage = "https://github.com/pytorch/kineto";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ samuela ];
+  };
+}
diff --git a/pkgs/development/python-modules/twitchapi/default.nix b/pkgs/development/python-modules/twitchapi/default.nix
new file mode 100644
index 00000000000..c6d5fbffc50
--- /dev/null
+++ b/pkgs/development/python-modules/twitchapi/default.nix
@@ -0,0 +1,48 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, aiohttp
+, python-dateutil
+, requests
+, typing-extensions
+, websockets
+}:
+
+buildPythonPackage rec {
+  pname = "twitchapi";
+  version = "2.5.2";
+
+  format = "setuptools";
+
+  src = fetchPypi {
+    pname = "twitchAPI";
+    inherit version;
+    sha256 = "f0ee5388911154375170a83df9a18e8a698fe382cea5d94a3e33ad27a7ce9133";
+  };
+
+  propagatedBuildInputs = [
+    aiohttp
+    python-dateutil
+    requests
+    typing-extensions
+    websockets
+  ];
+
+  # upstream has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "twitchAPI.eventsub"
+    "twitchAPI.oauth"
+    "twitchAPI.pubsub"
+    "twitchAPI.twitch"
+    "twitchAPI.types"
+  ];
+
+  meta = with lib; {
+    description = "Python implementation of the Twitch Helix API, its Webhook, PubSub and EventSub";
+    homepage = "https://github.com/Teekeks/pyTwitchAPI";
+    license = licenses.mit;
+    maintainers = with maintainers; [ dotlambda ];
+  };
+}
diff --git a/pkgs/development/python-modules/wandb/default.nix b/pkgs/development/python-modules/wandb/default.nix
index 6b10b30a193..ef8e6cfd247 100644
--- a/pkgs/development/python-modules/wandb/default.nix
+++ b/pkgs/development/python-modules/wandb/default.nix
@@ -28,6 +28,7 @@
 , requests
 , scikit-learn
 , sentry-sdk
+, setproctitle
 , setuptools
 , shortuuid
 , stdenv
@@ -37,13 +38,13 @@
 
 buildPythonPackage rec {
   pname = "wandb";
-  version = "0.12.10";
+  version = "0.12.11";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = "client";
     rev = "v${version}";
-    sha256 = "198c6zx7xih74cw0dwfqw7s7b7whik7wv4nfq6x6xw0kw86r6hby";
+    sha256 = "0av4vv4llan40678bw0vlah0gn6hjg5pdqwq0c5cv15lqrdb8g32";
   };
 
   # The wandb requirements.txt does not distinguish python2/3 dependencies. We
@@ -70,6 +71,7 @@ buildPythonPackage rec {
     pyyaml
     requests
     sentry-sdk
+    setproctitle
     setuptools
     shortuuid
     yaspin
@@ -99,11 +101,11 @@ buildPythonPackage rec {
     "tests/test_telemetry_full.py"
     "tests/wandb_agent_test.py"
     "tests/wandb_artifacts_test.py"
-    "tests/wandb_history_test.py"
     "tests/wandb_integration_test.py"
     "tests/wandb_run_test.py"
     "tests/wandb_settings_test.py"
     "tests/wandb_sweep_test.py"
+    "tests/wandb_verify_test.py"
 
     # Fails and borks the pytest runner as well.
     "tests/wandb_test.py"
diff --git a/pkgs/development/python-modules/weasyprint/default.nix b/pkgs/development/python-modules/weasyprint/default.nix
index 27c7521cef8..3d752596dec 100644
--- a/pkgs/development/python-modules/weasyprint/default.nix
+++ b/pkgs/development/python-modules/weasyprint/default.nix
@@ -27,7 +27,7 @@
 
 buildPythonPackage rec {
   pname = "weasyprint";
-  version = "54.1";
+  version = "54.2";
   disabled = !isPy3k;
 
   format = "pyproject";
@@ -35,7 +35,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit version;
     pname = "weasyprint";
-    sha256 = "sha256-+lfbhi4GvQHF59gtrTmbO5lSo5gnAjwXvumxwGH/G70=";
+    sha256 = "sha256-1eiqguPiokd6RUPwZG2fsUCAybo0oIWXUesjdXzABGY=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index 2a8ce7faed9..0d634e3ec46 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -32,13 +32,13 @@ with py.pkgs;
 
 buildPythonApplication rec {
   pname = "checkov";
-  version = "2.0.908";
+  version = "2.0.913";
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = pname;
     rev = version;
-    hash = "sha256-2ssVFnRd8TIxZSUUq9jOmiNHY1yuDv7mMqpKtJ3vq24=";
+    hash = "sha256-gSWD3Y7yySJvWicL5zgCGvMWfk98mBdTXB+Xwo4fork=";
   };
 
   nativeBuildInputs = with py.pkgs; [
diff --git a/pkgs/development/tools/buf/default.nix b/pkgs/development/tools/buf/default.nix
index 60d8d8f58b8..1b0ccab2964 100644
--- a/pkgs/development/tools/buf/default.nix
+++ b/pkgs/development/tools/buf/default.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "buf";
-  version = "1.0.0";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "bufbuild";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-jJaob2eaozMFRsXwW6ulgM5De3UmpLZddTHwq6PnaeE=";
+    sha256 = "sha256-8GwZsFvxaTtG/q7DaWvZcGdbyJ4Cm41BqSvwq3SqoEg=";
   };
 
-  vendorSha256 = "sha256-wPnrkfv6pJB6tkZo2oeMbWHbF9njGh1ZEWu8tkHDhGo=";
+  vendorSha256 = "sha256-g3bvfNF0XkC12/tRZsO+o2z20w+riWiHOer8Pzp1QF0=";
 
   patches = [
     # Skip a test that requires networking to be available to work.
diff --git a/pkgs/development/tools/build-managers/leiningen/default.nix b/pkgs/development/tools/build-managers/leiningen/default.nix
index 7dfb6c9b2ad..80919cfc377 100644
--- a/pkgs/development/tools/build-managers/leiningen/default.nix
+++ b/pkgs/development/tools/build-managers/leiningen/default.nix
@@ -3,16 +3,16 @@
 
 stdenv.mkDerivation rec {
   pname = "leiningen";
-  version = "2.9.7";
+  version = "2.9.8";
 
   src = fetchurl {
     url = "https://raw.github.com/technomancy/leiningen/${version}/bin/lein-pkg";
-    sha256 = "sha256-948g0ZMfAoJw53vA8MAKWg76Tst6VnYwSjSuT0aeKB0=";
+    sha256 = "1sgnxw58srjxqnskl700p7r7n23pfpjvqpiqnz1m8r6c76jwnllr";
   };
 
   jarsrc = fetchurl {
     url = "https://github.com/technomancy/leiningen/releases/download/${version}/${pname}-${version}-standalone.jar";
-    sha256 = "sha256-gvAUFKzs3bsOvW1XFQW7Zxpv0JMja82sJGjP5fLqqAI=";
+    sha256 = "13f4n15i0gsk9jq52gxivnsk32qjahmxgrddm54cf8ynw0a923ia";
   };
 
   JARNAME = "${pname}-${version}-standalone.jar";
diff --git a/pkgs/development/tools/continuous-integration/github-runner/default.nix b/pkgs/development/tools/continuous-integration/github-runner/default.nix
index 972d3199aa3..7818f7464ba 100644
--- a/pkgs/development/tools/continuous-integration/github-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/github-runner/default.nix
@@ -43,13 +43,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "github-runner";
-  version = "2.288.0";
+  version = "2.288.1";
 
   src = fetchFromGitHub {
     owner = "actions";
     repo = "runner";
     rev = "v${version}";
-    hash = "sha256-vl8p+isoK+yczmsMO2YjnmJQW/k0jLgCUbhQa/wG650=";
+    hash = "sha256-bP+6aAKnu6PxN9eppFXsqOSVSGQ6Lv+gEF2MdEz52WE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix b/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
index 9c57c500592..6dc0a7d30ee 100644
--- a/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
@@ -1,7 +1,7 @@
 { lib, buildGoModule, fetchFromGitLab, fetchurl }:
 
 let
-  version = "14.8.0";
+  version = "14.8.2";
 in
 buildGoModule rec {
   inherit version;
@@ -14,13 +14,13 @@ buildGoModule rec {
     "-X ${commonPackagePath}.REVISION=v${version}"
   ];
 
-  vendorSha256 = "sha256-MdGLl77DFXPudt26qICSH+1UuQAR8Rb/nl0Ykb0hjgE=";
+  vendorSha256 = "1aa04hbavr0bclddp5adjwwj21sp46gbhjydxc3w7vs1siw0ivq2";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-runner";
     rev = "v${version}";
-    sha256 = "sha256-+DwOKlFu9m2kt4DwaSp/Jq3eZ/+FFxV1Q7bKOy5DfoE=";
+    sha256 = "1zwr09lrrc3xx3sp00vs30ks0n77d7v0xkz0mz9jy2qdls9nfmrv";
   };
 
   patches = [
diff --git a/pkgs/development/tools/packet/default.nix b/pkgs/development/tools/packet/default.nix
index 173ff4770da..61e9b210683 100644
--- a/pkgs/development/tools/packet/default.nix
+++ b/pkgs/development/tools/packet/default.nix
@@ -1,5 +1,4 @@
-# This file was generated by https://github.com/kamilchm/go2nix v1.2.1
-{ lib, buildGoPackage, fetchgit }:
+{ lib, buildGoPackage, fetchFromGitHub }:
 
 buildGoPackage rec {
   pname = "packet";
@@ -7,19 +6,20 @@ buildGoPackage rec {
 
   goPackagePath = "github.com/ebsarr/packet";
 
-  src = fetchgit {
+  src = fetchFromGitHub {
+    owner = "ebsarr";
+    repo = "packet";
     rev = "v${version}";
-    url = "https://github.com/ebsarr/packet";
-    sha256 = "18n8f2rlab4icb28k1b9gnh30zy382v792x07fmcdqq4nkw6wvwf";
+    sha256 = "sha256-jm9u+LQE48aqO6CLdLZAw38woH1phYnEYpEsRbNwyKI=";
   };
 
   goDeps = ./deps.nix;
 
-  meta = {
+  meta = with lib; {
     description = "a CLI tool to manage packet.net services";
     homepage = "https://github.com/ebsarr/packet";
-    license = lib.licenses.mit;
-    maintainers = [ lib.maintainers.grahamc ];
-    platforms = lib.platforms.unix;
+    license = licenses.mit;
+    maintainers = with maintainers; [ grahamc ];
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/tools/rust/rust-analyzer/default.nix b/pkgs/development/tools/rust/rust-analyzer/default.nix
index 9711ef871c0..2221ae0a14b 100644
--- a/pkgs/development/tools/rust/rust-analyzer/default.nix
+++ b/pkgs/development/tools/rust/rust-analyzer/default.nix
@@ -11,14 +11,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rust-analyzer-unwrapped";
-  version = "2022-02-22";
-  cargoSha256 = "sha256-5PhmDiYC566KM0PfAaRdMpc0CAzDdez4uuLqBNBrma8=";
+  version = "2022-02-28";
+  cargoSha256 = "sha256-dTw6xp99uGtGp6YuqAX3r3GDD6Wto3KHTaO2DUUE2FA=";
 
   src = fetchFromGitHub {
     owner = "rust-analyzer";
     repo = "rust-analyzer";
     rev = version;
-    sha256 = "sha256-O9onJrAJY0TWxEZZcTWuF7SGPypRtSo0ZbpzDLC5+os=";
+    sha256 = "sha256-GQ1cPO4povnozLl0MTFs0ZXpmBn+AZeFWQVnxHHWf9g=";
   };
 
   patches = [
diff --git a/pkgs/games/steam-tui/default.nix b/pkgs/games/steam-tui/default.nix
index 66e17b1752e..63deb3b969c 100644
--- a/pkgs/games/steam-tui/default.nix
+++ b/pkgs/games/steam-tui/default.nix
@@ -2,7 +2,7 @@
 , rustPlatform
 , steamcmd
 , fetchFromGitHub
-, steam-run-native
+, steam-run
 , runtimeShell
 , withWine ? false
 , wine
@@ -21,7 +21,7 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "sha256-VYBzwDLSV4N4qt2dNgIS399T2HIbPTdQ2rDIeheLlfo=";
 
-  buildInputs = [ steamcmd steam-run-native ]
+  buildInputs = [ steamcmd ]
     ++ lib.optional withWine wine;
 
   preFixup = ''
@@ -29,7 +29,7 @@ rustPlatform.buildRustPackage rec {
     cat > $out/bin/steam-tui <<EOF
     #!${runtimeShell}
     export PATH=${steamcmd}/bin:\$PATH
-    exec ${steam-run-native}/bin/steam-run $out/bin/.steam-tui-unwrapped '\$@'
+    exec ${steam-run}/bin/steam-run $out/bin/.steam-tui-unwrapped '\$@'
     EOF
     chmod +x $out/bin/steam-tui
   '';
diff --git a/pkgs/games/steam/fhsenv.nix b/pkgs/games/steam/fhsenv.nix
index 447ff94bf9d..e54e87bf48b 100644
--- a/pkgs/games/steam/fhsenv.nix
+++ b/pkgs/games/steam/fhsenv.nix
@@ -3,7 +3,6 @@
 , extraPkgs ? pkgs: [ ] # extra packages to add to targetPkgs
 , extraLibraries ? pkgs: [ ] # extra packages to add to multiPkgs
 , extraProfile ? "" # string to append to profile
-, nativeOnly ? false
 , runtimeOnly ? false
 , runtimeShell
 , stdenv
@@ -51,7 +50,6 @@ let
   # Zachtronics and a few other studios expect STEAM_LD_LIBRARY_PATH to be present
   exportLDPath = ''
     export LD_LIBRARY_PATH=${lib.concatStringsSep ":" ldPath}''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH
-    export STEAM_LD_LIBRARY_PATH="$STEAM_LD_LIBRARY_PATH''${STEAM_LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
   '';
 
   # bootstrap.tar.xz has 444 permissions, which means that simple deletes fail
@@ -62,22 +60,6 @@ let
     fi
   '';
 
-  setupSh = writeScript "setup.sh" ''
-    #!${runtimeShell}
-  '';
-
-  runSh = writeScript "run.sh" ''
-    #!${runtimeShell}
-    runtime_paths="${lib.concatStringsSep ":" ldPath}"
-    if [ "$1" == "--print-steam-runtime-library-paths" ]; then
-      echo "$runtime_paths''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
-      exit 0
-    fi
-    export LD_LIBRARY_PATH="$runtime_paths''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
-    export STEAM_LD_LIBRARY_PATH="$STEAM_LD_LIBRARY_PATH''${STEAM_LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
-    exec "$@"
-  '';
-
 in buildFHSUserEnv rec {
   name = "steam";
 
@@ -123,7 +105,6 @@ in buildFHSUserEnv rec {
     gtk3
     dbus
     zlib
-    glib
     atk
     cairo
     freetype
@@ -149,9 +130,6 @@ in buildFHSUserEnv rec {
     openssl_1_1
     rtmpdump
 
-    # needed by getcap for vr startup
-    libcap
-
     # dependencies for mesa drivers, needed inside pressure-vessel
     mesa.drivers
     mesa.llvmPackages.llvm.lib
@@ -163,44 +141,30 @@ in buildFHSUserEnv rec {
     xorg.libxshmfence
     xorg.libXxf86vm
     libelf
-  ] ++ (if (!nativeOnly) then [
-    (steamPackages.steam-runtime-wrapped.override {
-      inherit runtimeOnly;
-    })
-  ] else [
+
     # Required
     glib
     gtk2
     bzip2
-    zlib
-    gdk-pixbuf
 
     # Without these it silently fails
     xorg.libXinerama
-    xorg.libXdamage
     xorg.libXcursor
     xorg.libXrender
     xorg.libXScrnSaver
-    xorg.libXxf86vm
     xorg.libXi
     xorg.libSM
     xorg.libICE
     gnome2.GConf
-    freetype
     (curl.override { gnutlsSupport = true; opensslSupport = false; })
     nspr
     nss
-    fontconfig
-    cairo
-    expat
-    dbus
     cups
     libcap
     SDL2
     libusb1
     dbus-glib
     ffmpeg
-    atk
     # Only libraries are needed from those two
     libudev0-shim
     networkmanager098
@@ -208,7 +172,6 @@ in buildFHSUserEnv rec {
     # Verified games requirements
     xorg.libXt
     xorg.libXmu
-    xorg.libxcb
     libogg
     libvorbis
     SDL
@@ -216,7 +179,6 @@ in buildFHSUserEnv rec {
     glew110
     libidn
     tbb
-    wayland
 
     # Other things from runtime
     flac
@@ -242,21 +204,14 @@ in buildFHSUserEnv rec {
     librsvg
     xorg.libXft
     libvdpau
-  ] ++ steamPackages.steam-runtime-wrapped.overridePkgs) ++ extraLibraries pkgs;
+  ]
+  ++ steamPackages.steam-runtime-wrapped.overridePkgs
+  ++ extraLibraries pkgs;
 
-  extraBuildCommands = if (!nativeOnly) then ''
-    mkdir -p steamrt
-    ln -s ../lib/steam-runtime steamrt/${steam-runtime-wrapped.arch}
-    ${lib.optionalString (steam-runtime-wrapped-i686 != null) ''
-      ln -s ../lib32/steam-runtime steamrt/${steam-runtime-wrapped-i686.arch}
-    ''}
-    ln -s ${runSh} steamrt/run.sh
-    ln -s ${setupSh} steamrt/setup.sh
-  '' else ''
+  extraBuildCommands = ''
     ln -s /usr/lib/libbz2.so usr/lib/libbz2.so.1.0
-    ${lib.optionalString (steam-runtime-wrapped-i686 != null) ''
-      ln -s /usr/lib32/libbz2.so usr/lib32/libbz2.so.1.0
-    ''}
+  '' + lib.optionalString (steam-runtime-wrapped-i686 != null) ''
+    ln -s /usr/lib32/libbz2.so usr/lib32/libbz2.so.1.0
   '';
 
   extraInstallCommands = ''
@@ -276,8 +231,6 @@ in buildFHSUserEnv rec {
       fi
     fi
 
-    export STEAM_RUNTIME=${if nativeOnly then "0" else "/steamrt"}
-
     # XDG_DATA_DIRS is used by pressure-vessel and vulkan loaders to find the corresponding icd
     export XDG_DATA_DIRS=$XDG_DATA_DIRS''${XDG_DATA_DIRS:+:}/run/opengl-driver/share:/run/opengl-driver-32/share
   '' + extraProfile;
@@ -300,14 +253,13 @@ in buildFHSUserEnv rec {
     EOF
       fi
     fi
-    ${lib.optionalString (!nativeOnly) exportLDPath}
+
+    export STEAM_LD_LIBRARY_PATH="$STEAM_LD_LIBRARY_PATH''${STEAM_LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
     ${fixBootstrap}
     exec steam "$@"
   '';
 
-  meta = steam.meta // {
-    broken = nativeOnly;
-  };
+  inherit (steam) meta;
 
   # allows for some gui applications to share IPC
   # this fixes certain issues where they don't render correctly
@@ -334,7 +286,7 @@ in buildFHSUserEnv rec {
         exit 1
       fi
       shift
-      ${lib.optionalString (!nativeOnly) exportLDPath}
+      export STEAM_LD_LIBRARY_PATH="$STEAM_LD_LIBRARY_PATH''${STEAM_LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
       ${fixBootstrap}
       exec -- "$run" "$@"
     '';
diff --git a/pkgs/os-specific/darwin/dockutil/default.nix b/pkgs/os-specific/darwin/dockutil/default.nix
new file mode 100644
index 00000000000..d937ce8fd12
--- /dev/null
+++ b/pkgs/os-specific/darwin/dockutil/default.nix
@@ -0,0 +1,32 @@
+{ lib, stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  pname = "dockutil";
+  version = "2.0.5";
+
+  src = fetchFromGitHub {
+    owner  = "kcrawford";
+    repo   = "dockutil";
+    rev    = version;
+    sha256 = "sha256-8tDkueCTCtvxc7owp3K9Tsrn4hL79CM04zBNv7AcHgA=";
+  };
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    install -Dm755 scripts/dockutil -t $out/bin
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Tool for managing dock items";
+    homepage = "https://github.com/kcrawford/dockutil";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ tboerger ];
+    platforms = platforms.darwin;
+  };
+}
diff --git a/pkgs/os-specific/linux/firmware/xow_dongle-firmware/default.nix b/pkgs/os-specific/linux/firmware/xow_dongle-firmware/default.nix
new file mode 100644
index 00000000000..0375eb0eead
--- /dev/null
+++ b/pkgs/os-specific/linux/firmware/xow_dongle-firmware/default.nix
@@ -0,0 +1,32 @@
+{ stdenv, lib, fetchurl, cabextract }:
+
+stdenv.mkDerivation rec {
+  pname = "xow_dongle-firmware";
+  version = "2017-07";
+
+  dontUnpack = true;
+  dontInstall = true;
+
+  src = fetchurl {
+    url = "http://download.windowsupdate.com/c/msdownload/update/driver/drvs/2017/07/1cd6a87c-623f-4407-a52d-c31be49e925c_e19f60808bdcbfbd3c3df6be3e71ffc52e43261e.cab";
+    sha256 = "013g1zngxffavqrk5jy934q3bdhsv6z05ilfixdn8dj0zy26lwv5";
+  };
+
+  nativeBuildInputs = [ cabextract ];
+
+  buildPhase = ''
+    cabextract -F FW_ACC_00U.bin ${src}
+    mkdir -p $out/lib/firmware
+    cp -a FW_ACC_00U.bin $out/lib/firmware/xow_dongle.bin
+  '';
+
+  meta = with lib; {
+    description = "Xbox One wireless dongle firmware";
+    homepage = "https://www.xbox.com/en-NZ/accessories/adapters/wireless-adapter-windows";
+    license = licenses.unfree;
+    maintainers = with lib.maintainers; [ rhysmdnz ];
+    platforms = platforms.linux;
+  };
+}
+
+
diff --git a/pkgs/os-specific/linux/xone/default.nix b/pkgs/os-specific/linux/xone/default.nix
new file mode 100644
index 00000000000..f04ccc569df
--- /dev/null
+++ b/pkgs/os-specific/linux/xone/default.nix
@@ -0,0 +1,39 @@
+{ stdenv, lib, fetchFromGitHub, kernel, fetchurl }:
+
+stdenv.mkDerivation rec {
+  name = "xone-${version}-${kernel.version}";
+  version = "0.2";
+
+  src = fetchFromGitHub {
+    owner = "medusalix";
+    repo = "xone";
+    rev = "v${version}";
+    sha256 = "sha256-m4305Xl5w4nyAVqubjwWsiyPDVtfGykjlSW2eKEytVk=";
+  };
+
+  setSourceRoot = ''
+    export sourceRoot=$(pwd)/source
+  '';
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  makeFlags = [
+    "-C"
+    "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "M=$(sourceRoot)"
+    "VERSION=${version}"
+  ];
+
+  buildFlags = [ "modules" ];
+  installFlags = [ "INSTALL_MOD_PATH=${placeholder "out"}" ];
+  installTargets = [ "modules_install" ];
+
+  meta = with lib; {
+    description = "Linux kernel driver for Xbox One and Xbox Series X|S accessories";
+    homepage = "https://github.com/medusalix/xone";
+    license = licenses.gpl2;
+    maintainers = with lib.maintainers; [ rhysmdnz ];
+    platforms = platforms.linux;
+  };
+}
+
diff --git a/pkgs/tools/admin/pulumi/data.nix b/pkgs/tools/admin/pulumi/data.nix
index 9bb3ef46d92..7491cff2ab6 100644
--- a/pkgs/tools/admin/pulumi/data.nix
+++ b/pkgs/tools/admin/pulumi/data.nix
@@ -1,40 +1,64 @@
 # DO NOT EDIT! This file is generated automatically by update.sh
 { }:
 {
-  version = "3.22.1";
+  version = "3.25.1";
   pulumiPkgs = {
     x86_64-linux = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.22.1-linux-x64.tar.gz";
-        sha256 = "0yxjlkvyxap4c7ny5x0ch0j4d5360qapb670f6im7vnaqhc00by0";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.25.1-linux-x64.tar.gz";
+        sha256 = "0p2cz6hg2xf28pj2w0avi6hz855llm9kg7v422cf0m1b94s4dsbi";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v2.4.0-linux-amd64.tar.gz";
-        sha256 = "02k3ars9i8pfby3070rnnldfcb5hbh32kd5xnbmgd0202yg5y3pd";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v4.4.0-linux-amd64.tar.gz";
+        sha256 = "0qywihi3k8505qgpr1j5gmqzyalqrrmxxz1k48ipdank48dkxs8g";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v4.34.0-linux-amd64.tar.gz";
-        sha256 = "0c61m2q7944a29dkcqcv5fv9jn2bz8mdfhnd33z8qaybhw2804rd";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-akamai-v2.7.0-linux-amd64.tar.gz";
+        sha256 = "12vwwmvjsb9fwjkazvcblizdk5xx0l4499r0rg5lr97h5c1j28al";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v4.33.0-linux-amd64.tar.gz";
-        sha256 = "0k5bpg6lmhj3cxsg43dkyw9jlwyllwwdhml3brkyfgb307cypl9b";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-alicloud-v3.17.0-linux-amd64.tar.gz";
+        sha256 = "0nkz7mcsgv1lbq0gdfs6nix4bmsn4zspn9jgji10jlawrk5l1ps4";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-cloudflare-v4.2.0-linux-amd64.tar.gz";
-        sha256 = "161g5gsr64idz17ffixbjrm0gnbpvpsf440yr26ci4bzdk0s81gh";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v0.6.0-linux-amd64.tar.gz";
+        sha256 = "0bcmj8z86dqchc9rgnvjy7q0k2pmmd1c155nm4ik1j87ccclia0p";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v2.6.0-linux-amd64.tar.gz";
+        sha256 = "08dvkkf153zkpjr2fz6wdrk4rqzmpfhj8nsmly7crr7d3xjhwqsc";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v4.38.0-linux-amd64.tar.gz";
+        sha256 = "1fm0qhbs0ih1rgr2r46fz9fc6vrl1iwk9fd9q5plra93fxjdjdc4";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuread-v5.18.0-linux-amd64.tar.gz";
+        sha256 = "06z4h7hpm17zil1vkghlndl4l6fhc6qlgvj95sxx4n1mxdpf7w5l";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuredevops-v2.3.1-linux-amd64.tar.gz";
+        sha256 = "0m89na1gqrb41h1dg5j876g5hp0mfk4g7ij7i4md1szk9fp4820k";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v4.41.0-linux-amd64.tar.gz";
+        sha256 = "1s9s6a5w18zj0y78ar49mbicz8hjmqmzmw2agnwqwk9zhj35jvz8";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-cloudflare-v4.4.0-linux-amd64.tar.gz";
+        sha256 = "1l97awwfd5hyw1q8wjcdz81blybzqklv9wk9pv1319j0251ddzz3";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-consul-v3.5.0-linux-amd64.tar.gz";
         sha256 = "0yfbiv6q2rfm27gwc4vsg2112m1vll5rkk1zwpg510dzvrnjqqn6";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-datadog-v4.5.0-linux-amd64.tar.gz";
-        sha256 = "1pi98naks37cc0nsrjfrnsknskwzsfj5ia01nhaj44caxzvnd8mh";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-datadog-v4.6.0-linux-amd64.tar.gz";
+        sha256 = "0q3mj48kddl1cb80s03x5vksx8xa006qlzfkarbc3sa2qqlgqiqr";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-digitalocean-v4.10.0-linux-amd64.tar.gz";
-        sha256 = "19y5gm5s7ps0cwdv8j7lnlx1r4c94qf6cdc28z725wpyyq1grc38";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-digitalocean-v4.11.1-linux-amd64.tar.gz";
+        sha256 = "1djm9dh1445yn7hnl3m1hm6cw9cj7m9syv08xjjclwc3dj9k7qw5";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-docker-v3.1.0-linux-amd64.tar.gz";
@@ -45,24 +69,32 @@
         sha256 = "0hnardid0kbzy65dmn7vz8ddy5hq78nf2871zz6srf2hfyiv7qa4";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v6.7.0-linux-amd64.tar.gz";
-        sha256 = "074ihk1c3g580grbipy0acryjsmaz8n65siyc7yz4gcgcwqwb5mj";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-fastly-v3.13.0-linux-amd64.tar.gz";
+        sha256 = "08r3zks93jcpih6zxjmnpvqjsxvfkj3av5a2iwxb87snmsz0jixz";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v4.9.1-linux-amd64.tar.gz";
-        sha256 = "0ffbsnpgr6wz9xj5yq6m55xj4mqji7hir6dylyjcpdkrxnigyiss";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v6.14.0-linux-amd64.tar.gz";
+        sha256 = "0lhfxqd600rjbdw16jpj5fysdm324kangi85qpwrd6273aylyv09";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gitlab-v4.4.0-linux-amd64.tar.gz";
-        sha256 = "14kz4ywhwb0lcsf3nbr9c884x83jdlbxmcg3g9jaq7r739fawpi9";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v4.10.0-linux-amd64.tar.gz";
+        sha256 = "1lni4wzmdhjbchjjx9z5iqawv4x1bixl3s541h39cr4x3y36m66m";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gitlab-v4.5.0-linux-amd64.tar.gz";
+        sha256 = "1zzrzsa07af7x4vwv7zgwkdrfmlhw30dcc7hqj92q4mn6valbn5q";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-google-native-v0.15.0-linux-amd64.tar.gz";
+        sha256 = "0cnwgr358lbrw6ssz8s7m87yniy7q2zhd6pmjhl8x41j1cljwyfa";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-hcloud-v1.7.1-linux-amd64.tar.gz";
         sha256 = "0qv3a4d6hnpga7lli7xnbwiig56h080hxrxjr8jbqsy9ymsqb39a";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.14.0-linux-amd64.tar.gz";
-        sha256 = "02xgkwfsfkqv38cjyc62rlsldbdd5j801gmlh9pf3qjdjj5d1fl3";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.16.0-linux-amd64.tar.gz";
+        sha256 = "1ngpaw5fdlv7hxjnns6ajzj8dqrj3gzkabr5h5hq5dws23x2c999";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v3.7.1-linux-amd64.tar.gz";
@@ -77,62 +109,114 @@
         sha256 = "0lj01hyjyq3qazkryvvxkx6nwai3bac9shqxb6hcqv4pfdjzzxhr";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-openstack-v3.7.0-linux-amd64.tar.gz";
-        sha256 = "0xaa2gaqgx5lf1vfg0s8y0nr6ygjcy7dbksf0jszizn08ifgpy8h";
-      }
-      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-packet-v3.2.2-linux-amd64.tar.gz";
-        sha256 = "0glbjhgrb2hiyhd6kwmy7v384j8zw641pw9737g1fczv3x16a3s3";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-openstack-v3.8.0-linux-amd64.tar.gz";
+        sha256 = "111q7jxkjni1091m3kp9c2n1zqlkiy7lrfsrqk4bzpcf67krk9vj";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-postgresql-v3.3.0-linux-amd64.tar.gz";
         sha256 = "05nfdwgfzi5f3hgj2g6dccaidqf9a9xzlv5vp3cd1rsxd159yk9j";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v4.3.1-linux-amd64.tar.gz";
-        sha256 = "1ixmsxawp0qbyjs37c74gcvj2icpbda6znl17yp9bhiyvnrdvxn7";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v4.4.0-linux-amd64.tar.gz";
+        sha256 = "18f30j0lmf2mrzynrrm068irlm972hc43vkp0205vkb1gvzf872m";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vault-v5.1.0-linux-amd64.tar.gz";
-        sha256 = "0b44kfvl01b5cmf9ii6zzcj28i1dd4dx4angdah3hghbsc5hypby";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-snowflake-v0.4.2-linux-amd64.tar.gz";
+        sha256 = "1l4njlk616ksw29vg5jg6cmn9n31iw8f0h65iwv8f5pbvw64m3n0";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.14.0-linux-amd64.tar.gz";
+        sha256 = "1b558l11r8a8xj5h2rk1lf761a83jzcbip7zvdg17f7rbyfilw56";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-sumologic-v0.4.1-linux-amd64.tar.gz";
+        sha256 = "0k1l6qf85ffbi62r7xs9clgf1g8mch5afrrjagqqb7dwi8sh34xa";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-tailscale-v0.5.0-linux-amd64.tar.gz";
+        sha256 = "1y67dlrkhrp7x2n0bbx7d8in9h4kwjqjdj4jkdbk1i3mfd46wh0k";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-tls-v4.1.0-linux-amd64.tar.gz";
+        sha256 = "0ayb1r9snjqgmczkvz4kjbswr0a98lmpapll4nws9q0rjj2w48y7";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vault-v5.2.0-linux-amd64.tar.gz";
+        sha256 = "08vfycws8gw92q43611dixnww4d80pqqjf6a3xh6zfpfn990vy97";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-venafi-v1.2.0-linux-amd64.tar.gz";
+        sha256 = "1c7qgzhmd2ifbmfznklaiqsf5mv9wir0iacw58gwyjalkvzb4v4l";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vsphere-v4.1.0-linux-amd64.tar.gz";
         sha256 = "0hl5liyga4iz7j3wy3qicx43d4mijnqayrnmpa5rws29lambgrql";
       }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-wavefront-v1.1.0-linux-amd64.tar.gz";
+        sha256 = "12qdhdbighj76ab3wz965jhybxxq4f2rlwyk9m3w8w4f2aprp0cm";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-yandex-v0.13.0-linux-amd64.tar.gz";
+        sha256 = "14qsnjafhd8ppachxr7j9541p5rbf1cakqlr7mra86fli1r49z9p";
+      }
     ];
     x86_64-darwin = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.22.1-darwin-x64.tar.gz";
-        sha256 = "0b68pfrd83x02rs2saybxycpkirjciilp4a94ps3788y1plinyih";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.25.1-darwin-x64.tar.gz";
+        sha256 = "0xfirm2pf765q1sx3h2by6s6d9gra95zq8cahljsj46dxm5gc7n9";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v2.4.0-darwin-amd64.tar.gz";
-        sha256 = "02s2lyd8rlz86rjraxk5g3g55qhih38kmvq0k2gwkdb2d11npf6r";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v4.4.0-darwin-amd64.tar.gz";
+        sha256 = "0cpzgbzascmgnzjigmsjs618lv4xnyv1vl1hwab6laryp5832c4h";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v4.34.0-darwin-amd64.tar.gz";
-        sha256 = "1a26schi28ci0zbm85yx4hlhwlwx0j0kk6d6nk9x1zldc3qzhw4y";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-akamai-v2.7.0-darwin-amd64.tar.gz";
+        sha256 = "0wm7vvbm747iqzhd8lnpq5zirlkcwcka6c3j9x59c7iwq8a3cba5";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v4.33.0-darwin-amd64.tar.gz";
-        sha256 = "04sblbjnxvxhxvzvsgjm83p6qahswwb2mvlylfpgq74ay86l6hki";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-alicloud-v3.17.0-darwin-amd64.tar.gz";
+        sha256 = "0xp45n9mhg2x9bsxr5i9nx94vwfzvamnc427hi3p2738h2h3vika";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-cloudflare-v4.2.0-darwin-amd64.tar.gz";
-        sha256 = "0cri2vqvqh4aghs4j66ykw8f4vm2fg1106xkq4q269ilxdd5ia8l";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v0.6.0-darwin-amd64.tar.gz";
+        sha256 = "0vsjiy7sf5brdf1d83n9pb6kpfrphllfndq1f6pfsh7nq7s0xpil";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v2.6.0-darwin-amd64.tar.gz";
+        sha256 = "0kmy5hf869pp40x7jlzxx6ghl0k4bn6yhh94x82ndz9syin5q21z";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v4.38.0-darwin-amd64.tar.gz";
+        sha256 = "1fggvxi0salfhi81z9pgchm6pqcw5wh0m5hwgws22clk75x3h4pg";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuread-v5.18.0-darwin-amd64.tar.gz";
+        sha256 = "1w0iwjny4vxplfi6kkdvglgalwwl5krk9hgfaiw7f1q43nkqw0bd";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuredevops-v2.3.1-darwin-amd64.tar.gz";
+        sha256 = "0fjynq1ilfv6njjyyadhpc9ks8izwif3nf8mnb7wfxchxn7gqbsi";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v4.41.0-darwin-amd64.tar.gz";
+        sha256 = "1k6pndyk6kh4db3cp92hj1vbglicx81yqxw1bis94d3cr95xr2pv";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-cloudflare-v4.4.0-darwin-amd64.tar.gz";
+        sha256 = "0is1dfv0c65sgk2hy5zng9f2jfxkvlp1pjy4ljyic039pvi80137";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-consul-v3.5.0-darwin-amd64.tar.gz";
         sha256 = "1kgk48k4898zxsnhfg6z949m3mgicdm2zfg8ba7z1lbidzc6g3sq";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-datadog-v4.5.0-darwin-amd64.tar.gz";
-        sha256 = "16dllbbmih9dm728wq86cpq2gkbyhlmpiwyh3r20jzhclrx4mgcw";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-datadog-v4.6.0-darwin-amd64.tar.gz";
+        sha256 = "16abnsllcf7ap6gvxr1b68cc7k476vhdbg8wrjabx9h9b81lwhbm";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-digitalocean-v4.10.0-darwin-amd64.tar.gz";
-        sha256 = "115lcaqkliaxqg27hb1j773299kgs44d3l7p2da9kzla3sk7dps0";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-digitalocean-v4.11.1-darwin-amd64.tar.gz";
+        sha256 = "11wnk0ssqzfcvks5qvc2yi6iv9nxxxxqwmnjyavdzp5s5vvpi5zm";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-docker-v3.1.0-darwin-amd64.tar.gz";
@@ -143,24 +227,32 @@
         sha256 = "1m5lh59h7nck1flzxs9m4n0ag0klk3jmnpf7hc509vffxs89xnjq";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v6.7.0-darwin-amd64.tar.gz";
-        sha256 = "046j20xl3ibfyqkcra242a5rpix14n4w3h9w9x618fbznk24bcxb";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-fastly-v3.13.0-darwin-amd64.tar.gz";
+        sha256 = "1d9q2q9br44kkpr7swn2qfg4xvbfb2wixbigixg3vjwz9n0bm4p8";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v4.9.1-darwin-amd64.tar.gz";
-        sha256 = "100rqkz0g1w0fhvgvgys9r6a7bqphzizn28lg7pbbkrwjh7s0bxq";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v6.14.0-darwin-amd64.tar.gz";
+        sha256 = "1200pb1ix308r5m6514s1b97q567f902c1zc1sfprr1r9psz3x16";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gitlab-v4.4.0-darwin-amd64.tar.gz";
-        sha256 = "15aj3vpafrb6hfrmi46pf6z3wj4y84dljsfzrvd6b5v0svmlr90d";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v4.10.0-darwin-amd64.tar.gz";
+        sha256 = "0i49x5s7sw69y19qmsrbrwhmjv7g07qrs5a3l1l8bsqawif5r65z";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gitlab-v4.5.0-darwin-amd64.tar.gz";
+        sha256 = "0mqciml9rzzfpjy7wdqqak1yym2yzilnsjyrpm255q38z77f5nkr";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-google-native-v0.15.0-darwin-amd64.tar.gz";
+        sha256 = "1616fbs348r539kcmvwxlhzzgdszgb0j2wy7lamqvnm8xw4l53ii";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-hcloud-v1.7.1-darwin-amd64.tar.gz";
         sha256 = "1xminhpv7b4nnvfdy5ahlcfrkan1fsmn0sp6gzkp5y4kkjd4a6vy";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.14.0-darwin-amd64.tar.gz";
-        sha256 = "1dpr4h35zby8say0kcvin5y5k4yryx06p3qcx16zrlsjaz6lj84k";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.16.0-darwin-amd64.tar.gz";
+        sha256 = "14ab1qsq22c8wyl7k7slxag9g44v3c63qjr8ip5qylbdsxsh7pp7";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v3.7.1-darwin-amd64.tar.gz";
@@ -175,62 +267,114 @@
         sha256 = "0fhhc2k0g8mpxzcgci4jl3m59q3n8w3nka94l0n7r9cvs81099n6";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-openstack-v3.7.0-darwin-amd64.tar.gz";
-        sha256 = "0fbc60l3v7mar0g16mbwgqckp9i4kckwlacv165kkwrkvj8nrbym";
-      }
-      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-packet-v3.2.2-darwin-amd64.tar.gz";
-        sha256 = "0621njipng32x43lw8n49mapq10lnvibg8vlvgciqsfvrbpz1yp5";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-openstack-v3.8.0-darwin-amd64.tar.gz";
+        sha256 = "13qxwzfsy0hmvgazry0q3qna0jk7llharcvdwz302fj4ad98s71j";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-postgresql-v3.3.0-darwin-amd64.tar.gz";
         sha256 = "0q19sh7l1mjl40i5vdsrjfldncxnicalmlgv3yjkw5xpxkgr98z0";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v4.3.1-darwin-amd64.tar.gz";
-        sha256 = "1dy4n03xvirg6fihiid786d88qlkyqkvk4fq6ggnxc92620x7342";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v4.4.0-darwin-amd64.tar.gz";
+        sha256 = "11k6vbsr2lszipjvpnpspqvj8b0j330cfpmkr5ipws9b02aqpw1c";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vault-v5.1.0-darwin-amd64.tar.gz";
-        sha256 = "1f2m3zdxbdn7gb0xb3f0rgj7h54nay1wyrn3bk2nzvrdv5c3bhcm";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-snowflake-v0.4.2-darwin-amd64.tar.gz";
+        sha256 = "1cr31yz4nmabncnim6vk8wfqihqrmsjpqgm4gmk8rsn0a21r9iry";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.14.0-darwin-amd64.tar.gz";
+        sha256 = "0dp4jvi3bbbggg7s9lmx8qqdh9nd7iff8r827s2f6js98yakhw9g";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-sumologic-v0.4.1-darwin-amd64.tar.gz";
+        sha256 = "0nzcf84dbiw3chmnwb7d2nl82kkn1scrrjiid1ni75cgwk200m04";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-tailscale-v0.5.0-darwin-amd64.tar.gz";
+        sha256 = "1xprdbxf8fza4zc2myf9mv3hl79hda0h34fz4yqfawg4spa0q128";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-tls-v4.1.0-darwin-amd64.tar.gz";
+        sha256 = "1jzirnaxy6y862khqf29i25r8qyrpac2kmacs9ny118l77xp33il";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vault-v5.2.0-darwin-amd64.tar.gz";
+        sha256 = "0rfl4hxl72n6d15klykhwzxiyscci9jyy20vprqqs5z5d825xal4";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-venafi-v1.2.0-darwin-amd64.tar.gz";
+        sha256 = "00sq1v8wkjzxw96y3gal15lqdz2ncbwa7lix3b4izy7c6rd3qfa6";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vsphere-v4.1.0-darwin-amd64.tar.gz";
         sha256 = "1wkyjxgrp3llvis3yjdnw65chscmxxcwigkr71i2crj28db8fhwx";
       }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-wavefront-v1.1.0-darwin-amd64.tar.gz";
+        sha256 = "154za5bvq1bgyzn5cfz3n0la1gy27lmjafgs42mgyy511jz4m60l";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-yandex-v0.13.0-darwin-amd64.tar.gz";
+        sha256 = "11wm9c125154brisncm9cgb41nbjl9q9h4bq6z0ym8v681qq0fc4";
+      }
     ];
     aarch64-linux = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.22.1-linux-arm64.tar.gz";
-        sha256 = "0551zp5n77jzh8k3jbqq75zj734faryxxdd2fvw881cxf95v39aj";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.25.1-linux-arm64.tar.gz";
+        sha256 = "16vm2kdc53kf6ljb62fx74sl2asj2hg9xnksz582w88xp0mhipw2";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v2.4.0-linux-arm64.tar.gz";
-        sha256 = "0rlbcxympplq1gwikxalz3c686kpy2vrsc2phfnm45vvrkl22k8j";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v4.4.0-linux-arm64.tar.gz";
+        sha256 = "19byg31lcnh7gk2xqf5601d0xj93p0b9svz6zxvv713d9ny36839";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v4.34.0-linux-arm64.tar.gz";
-        sha256 = "0639dl0hj2l33mc4vqbcyywpkfn30fikmiw10zjikcdg1jxzj4nd";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-akamai-v2.7.0-linux-arm64.tar.gz";
+        sha256 = "00f38gmdk6yjbqlmfnjqlk7x9sn8c27svabivq93hr0dc8bv2hzy";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v4.33.0-linux-arm64.tar.gz";
-        sha256 = "15lxfilkgh9ansy9n2yv693fms3x718lrxz0g2nxi32hz9hq0ysl";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-alicloud-v3.17.0-linux-arm64.tar.gz";
+        sha256 = "13gwhfl11grpv0kqdk3hd1z4mdqxj9czl9cvzkfc7idipim2wi19";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-cloudflare-v4.2.0-linux-arm64.tar.gz";
-        sha256 = "08wasnpm5j1rrpsgdlw2h2rx5m7fl4vrm2js5a1vsaxx35374a6h";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v0.6.0-linux-arm64.tar.gz";
+        sha256 = "09475k0qqiwxzgb3xm70wx6w3gr8figrsb7iqbyficfar71mvbf7";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v2.6.0-linux-arm64.tar.gz";
+        sha256 = "1w9mdg3jr5skdljxvm16qnssq94cnwpk24r76rbmh16wxb1l0z6x";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v4.38.0-linux-arm64.tar.gz";
+        sha256 = "0pxfijmbgwl1srfqhny1wps3qhmjnmi3p5ixffza1a5phffnjzwd";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuread-v5.18.0-linux-arm64.tar.gz";
+        sha256 = "17bjngcxjhh4m9zc8rbb2ixqq2dhr405y4xnsxhwyld8lnnrqm7w";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuredevops-v2.3.1-linux-arm64.tar.gz";
+        sha256 = "0a6bmiz6ys1h6n59mw3w7b2g8rhbnr0rb40rwidazvkni0s03yha";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v4.41.0-linux-arm64.tar.gz";
+        sha256 = "1q4hzzsxraw6f7z2dlqbrlrkambqixyj9bq3fk4napgv6hl77qnh";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-cloudflare-v4.4.0-linux-arm64.tar.gz";
+        sha256 = "15acmblgl5xdwrm6ikq420h8g88rvqlj34jdrngc47rlimmdh3l6";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-consul-v3.5.0-linux-arm64.tar.gz";
         sha256 = "1wwv6v9srzsdlcxv92kwv4drkx8w1h5xcvcwqqn6gi2mvsf3kj9n";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-datadog-v4.5.0-linux-arm64.tar.gz";
-        sha256 = "1s77az1b965lca69gqmmx8zfh63rf8vm2bkbzgfkj320zwbfbgj2";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-datadog-v4.6.0-linux-arm64.tar.gz";
+        sha256 = "1qia1myzcrjiq16sy4vd24wzqgww46wkdi9gq94j1g2ih75pc9k2";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-digitalocean-v4.10.0-linux-arm64.tar.gz";
-        sha256 = "1hik4456fdln7hxiw02856v02v0m33zsyiad40c9wg4n772ybchy";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-digitalocean-v4.11.1-linux-arm64.tar.gz";
+        sha256 = "0vn6kgdwd63c62kaq3b09m3yipg43yh12s0a9zhi48p4wplsgf9s";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-docker-v3.1.0-linux-arm64.tar.gz";
@@ -241,24 +385,32 @@
         sha256 = "111pia2f5xwkwaqs6p90ri29l5b3ivmahsa1bji4fwyyjyp22h4r";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v6.7.0-linux-arm64.tar.gz";
-        sha256 = "0r53qwf1w68bnqii20b44q1xlgxggsisnlr46463nxm0jb0wwyn9";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-fastly-v3.13.0-linux-arm64.tar.gz";
+        sha256 = "1dy76gsig4gyjg7xzkgb200dlhfvbq2i0zc0002c5vsykc4mji1d";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v4.9.1-linux-arm64.tar.gz";
-        sha256 = "1zr9vcr6qiql90bysapmrlafl7xmlv49bgp197w4w2290i5q7f6n";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v6.14.0-linux-arm64.tar.gz";
+        sha256 = "02gzj3zww0hmdq42d8b65wc12md9r7mygwymcix0f9lwza9gf4l2";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gitlab-v4.4.0-linux-arm64.tar.gz";
-        sha256 = "06ii12cl7wsfs9pwjkwz01szacg686vfzc6i253l6xvmmiqp6q0j";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v4.10.0-linux-arm64.tar.gz";
+        sha256 = "0p8lr9iw1h9ax90aivya513bw1dipm7yycqm5094wgx08r2yfvlm";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gitlab-v4.5.0-linux-arm64.tar.gz";
+        sha256 = "0z0ch08xqbyjmizwvgx9jysnp6g3kjjbwh11gbc6vgxacqcajgz3";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-google-native-v0.15.0-linux-arm64.tar.gz";
+        sha256 = "1v3pdsdpqzgbsg181g9w0rn3sw1xirljvgvkw0081i9hxvhwq9zq";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-hcloud-v1.7.1-linux-arm64.tar.gz";
         sha256 = "14xqlgy0wy223hg9wp1rc4hbj1pvxrqnzxzv901dqjf5434n6aa0";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.14.0-linux-arm64.tar.gz";
-        sha256 = "12lnh8hk02w1n28v6i46kxxpkzw1j9zp84ha5p6bnarza6g4wxnk";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.16.0-linux-arm64.tar.gz";
+        sha256 = "1y3nzdnh6fil12r0040h6kyyf01dgxjghpp55z49hin3k6yclnq3";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v3.7.1-linux-arm64.tar.gz";
@@ -273,59 +425,114 @@
         sha256 = "17iaf72dzy108v1njan21n72a5gzxbycq396hjh293a141kppn1m";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-openstack-v3.7.0-linux-arm64.tar.gz";
-        sha256 = "1xh93187s86x4pjm4j9djh2mfqqxrmkal761fhj2bldkgki2rkq8";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-openstack-v3.8.0-linux-arm64.tar.gz";
+        sha256 = "0dh28hhg2lbvbgw2yadw0ig68z2pcg51h38v74yczblm24k97jvq";
       }
-      # pulumi-resource-packet skipped (does not exist on remote)
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-postgresql-v3.3.0-linux-arm64.tar.gz";
         sha256 = "0j2c23ii4dn9yhpw6nymij65gv82y1xp4gi8lgxxf41b1i9bpb2i";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v4.3.1-linux-arm64.tar.gz";
-        sha256 = "12iv8vjnal2ym70rxmdnvi02x6md7fxi8jbzhzfw526pzqs1dc47";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v4.4.0-linux-arm64.tar.gz";
+        sha256 = "11k721ri7q36ss3kjvw07ki3snv35li167az6f8zp8h7fdhsrcn7";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vault-v5.1.0-linux-arm64.tar.gz";
-        sha256 = "15ambcwhrvv30ykkz9pizfrl4pri7iwvgs6s8f5416vgdj0k26fc";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-snowflake-v0.4.2-linux-arm64.tar.gz";
+        sha256 = "1hdf0zwlrc5i3k0vkqc2x8zz0zvwc1idnnai58d4k7f5qr89hg6z";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.14.0-linux-arm64.tar.gz";
+        sha256 = "0rr2cngqnibbz6d99xswjg7wybgd5xwm8fi6dkqwj51yyrz0izrz";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-sumologic-v0.4.1-linux-arm64.tar.gz";
+        sha256 = "06gdrjnk5jdnzc3jvzxl7iwf6gyyp9bqk1jrljxpkzr0ck8yz01l";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-tailscale-v0.5.0-linux-arm64.tar.gz";
+        sha256 = "1hih41dvdpxwh145kghp5xwpv5fn8r0wni8jh12qv5nl6apaa75p";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-tls-v4.1.0-linux-arm64.tar.gz";
+        sha256 = "1275cikf75lnf3d4k4ld0by1r8hr6gq6mih09fsfg98b8f7n16kq";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vault-v5.2.0-linux-arm64.tar.gz";
+        sha256 = "19iv4jp74j87p1hnqc205i9gl45c4jqc025lwgylgplfmmz9iagy";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-venafi-v1.2.0-linux-arm64.tar.gz";
+        sha256 = "12ak3ki97shnzki9gvzc52cprpi3wsqmh4dhhv4ly6m39sj3wgxx";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vsphere-v4.1.0-linux-arm64.tar.gz";
         sha256 = "1f7h6xl3jk9y29ffjxv9r4a748fwip17x7pazs62zwc3h10a65ac";
       }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-wavefront-v1.1.0-linux-arm64.tar.gz";
+        sha256 = "00902vymkc841lpdmgh80a1lipb5bjphiivy7d9xw9cldar35nz3";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-yandex-v0.13.0-linux-arm64.tar.gz";
+        sha256 = "0fd3hgvkr3ch2r5hpmi7h70w4hkbjdyc7z534h151pyc5ssxw8bd";
+      }
     ];
     aarch64-darwin = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.22.1-darwin-arm64.tar.gz";
-        sha256 = "00jzqrnw6khbw5hsaqwi73hx9h3yxdhy2n3jn3h76az27wfjkhkz";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.25.1-darwin-arm64.tar.gz";
+        sha256 = "1hg6i58vb4hlrp3s08m26wivhr7dg902nd8g19rmyfvkhvdjkax5";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v2.4.0-darwin-arm64.tar.gz";
-        sha256 = "116f1psg3wdl81apxlhgz6w1ykhlqxwqk6ahp82mca1h2qc7bg0h";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v4.4.0-darwin-arm64.tar.gz";
+        sha256 = "0z0v4i2k451fi1xz2k4w9cli8g3mc4d7a9b1gkgcs2wpgrfnifly";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v4.34.0-darwin-arm64.tar.gz";
-        sha256 = "1rzds5wrq51mzs7sgzwna016qcay3dzp5ys25cxmr47025kyv84p";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-akamai-v2.7.0-darwin-arm64.tar.gz";
+        sha256 = "0l4mqwap83rk82fnx7djc66mwnllmb49vzhr3kdavdmd5rbw5pd4";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v4.33.0-darwin-arm64.tar.gz";
-        sha256 = "1lqmjkqqq3rlsixv2kam50d5m95c81mn23y3dblbkh8d6qpwkfdp";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-alicloud-v3.17.0-darwin-arm64.tar.gz";
+        sha256 = "1q9d00dp61dv4i31c7z3nk9lqpxgyb0w180xfhg4s02vsk9yc8yf";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-cloudflare-v4.2.0-darwin-arm64.tar.gz";
-        sha256 = "18h8k6wz1givlkrd2fh6mpyc6syzsqr3a29c36cbly103nvr43jy";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v0.6.0-darwin-arm64.tar.gz";
+        sha256 = "1wpsjm191drz8687gv2d4snv8fdrivw3lqklj5cr67jngwiqhirq";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v2.6.0-darwin-arm64.tar.gz";
+        sha256 = "1ni5nlfiqpxid3s416avzgx30wjayi51j0v87hkvpmy38m4p1w18";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v4.38.0-darwin-arm64.tar.gz";
+        sha256 = "1b46cksimynk4f7idp37xn95j0is15zfrxwbs4hv9b3rxayg8s30";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuread-v5.18.0-darwin-arm64.tar.gz";
+        sha256 = "1ajanl6xgi00qc8a1apzfy45gaqxd7038hc3kmqgkrgzv8b943w4";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuredevops-v2.3.1-darwin-arm64.tar.gz";
+        sha256 = "0hlcfyxmjcq3axg35fx1dj081il60rqs7na0wx573gf028g6jj9v";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v4.41.0-darwin-arm64.tar.gz";
+        sha256 = "13xbscyg7s5cbrrsy5xcl63z31y6aa30r2d8gwchdgla3kqafjmm";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-cloudflare-v4.4.0-darwin-arm64.tar.gz";
+        sha256 = "0848db2hv0r5brjdfq1k45bkx7iz0xpwbkmmhg47ymr3g0bhr8db";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-consul-v3.5.0-darwin-arm64.tar.gz";
         sha256 = "16nnb6ql4j2207dgwmrhgx8mg19asf2n450lrmwvdzyvcy5zjm7p";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-datadog-v4.5.0-darwin-arm64.tar.gz";
-        sha256 = "1z74a9j7ih444lsg4zy3wf8vqqk67jf4cis14x6vpzbpyqpdsyvz";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-datadog-v4.6.0-darwin-arm64.tar.gz";
+        sha256 = "0irhy7vda2abcdzj6g73xh0p3kpxn1xi8agkfq4r9zpqrjp86pcr";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-digitalocean-v4.10.0-darwin-arm64.tar.gz";
-        sha256 = "1agi0dpck35rqsvxikdcl6xl2fpha2l4144mzgyslki4q86rqmhs";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-digitalocean-v4.11.1-darwin-arm64.tar.gz";
+        sha256 = "0nl47s8v47jvr4w3v5s2fnwhm56yb3knfb1za7ncynybgw8hizv0";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-docker-v3.1.0-darwin-arm64.tar.gz";
@@ -336,24 +543,32 @@
         sha256 = "12bzicm43l7yvh02v5fx3z8v46l9i7a9f677735xi5rjbmd2an4c";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v6.7.0-darwin-arm64.tar.gz";
-        sha256 = "1w5nhmc6bzfw0ihv5mwn316sj7w27psknnyffqm1pyw6drp0z58v";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-fastly-v3.13.0-darwin-arm64.tar.gz";
+        sha256 = "0jbgcw62hmhm5k8q4k948595nm2qslz7wic66iy0jr6ylhpm7hcz";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v4.9.1-darwin-arm64.tar.gz";
-        sha256 = "13w91xxma00zi7llk0hnqi10m90a5b2zhb08j6l0dn7x5a33dqay";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v6.14.0-darwin-arm64.tar.gz";
+        sha256 = "0rh9b19aqw15wzmijyyk7dv38cgf4abp6pk5abx4bp0277vl2a76";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gitlab-v4.4.0-darwin-arm64.tar.gz";
-        sha256 = "0sgg8bnsi5yyfv8gwzy8jw3f0fmkvizrgzh4jyc802qqc449p1ix";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v4.10.0-darwin-arm64.tar.gz";
+        sha256 = "167f7c7mpyjym0sw71adz5ffd7g8zmn87923xmjlrsz3wm6ybsq7";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gitlab-v4.5.0-darwin-arm64.tar.gz";
+        sha256 = "0dc7cpgvb20s6qyyfm2i4hc4rbg8zdv0j92wc397pacd6i6jhvgn";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-google-native-v0.15.0-darwin-arm64.tar.gz";
+        sha256 = "0avmwnxj1m8j3jj5w1ims64lxqgig4z8yxpi76000xrv74w625b2";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-hcloud-v1.7.1-darwin-arm64.tar.gz";
         sha256 = "0n0303423gkwi3b6dwzaqmzsbn2rh4vki6n54mmgd44a3cxbhkak";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.14.0-darwin-arm64.tar.gz";
-        sha256 = "1rq2wxw0kch7xrk0sr1l6fyz1sslyvk44l3jilzbm7mgi0d77w23";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v3.16.0-darwin-arm64.tar.gz";
+        sha256 = "1n2dh350pwhcvk8vs9mh3g6dijxrg2vh03h9x9fq7qhpgzgxq6km";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v3.7.1-darwin-arm64.tar.gz";
@@ -368,26 +583,57 @@
         sha256 = "0kym9f36h8b7s1smlmgazbzv8jjfpwxk6wv036bhx2xm3ysc7rgp";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-openstack-v3.7.0-darwin-arm64.tar.gz";
-        sha256 = "0w7gbdzs47ndvfig8qcnn5mar22plxjjsx0d4dgyhf1k391fz1jh";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-openstack-v3.8.0-darwin-arm64.tar.gz";
+        sha256 = "0xqxk9xp49s0l5cxxz9wg26fg4fj57h4yjpvs4xs8fpaqa1saynd";
       }
-      # pulumi-resource-packet skipped (does not exist on remote)
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-postgresql-v3.3.0-darwin-arm64.tar.gz";
         sha256 = "1i5ipmidg0yspayxyglbjaihajhj1bsk46saxkncfrkvqnh4iq50";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v4.3.1-darwin-arm64.tar.gz";
-        sha256 = "0jrihnwfh5wvc95nipqv7ak77kq9xj0pk5hlapv9w2ls5pwykv0r";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v4.4.0-darwin-arm64.tar.gz";
+        sha256 = "1dx39lm57sc9j715z62v74fw1gpnr8sn71d6a38gib83iiyagl3s";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vault-v5.1.0-darwin-arm64.tar.gz";
-        sha256 = "1zc8jhrf7vm2p9mjldvgcnfrzh53zvinpikhsc8b206j3pm6gmbl";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-snowflake-v0.4.2-darwin-arm64.tar.gz";
+        sha256 = "02x584440hw25nbkj880dd113ywdm280frfadyz2psy1sqfi949h";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.14.0-darwin-arm64.tar.gz";
+        sha256 = "1nl18z6i2p7dmc4f2i7wfw7ss76kmhb3jc4gfyirzp0qr2v8bs8p";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-sumologic-v0.4.1-darwin-arm64.tar.gz";
+        sha256 = "0i6hzqfvsjiyb1bzv70pwr1716scy60w7f8jkv3ayrxddaw7iwwg";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-tailscale-v0.5.0-darwin-arm64.tar.gz";
+        sha256 = "0bn8i1271mm3hqqqlidipsfdalxgc2fx8l4apdjin6k1zrnm44p1";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-tls-v4.1.0-darwin-arm64.tar.gz";
+        sha256 = "08dhxd39w7wjpqjfy59vxfipjl45psd6yh53h2g025y8hh80gcrs";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vault-v5.2.0-darwin-arm64.tar.gz";
+        sha256 = "0aqicfci56i3i9vkpm0ikg3amkzf7is6r9p2477dqm7gjphl9wmy";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-venafi-v1.2.0-darwin-arm64.tar.gz";
+        sha256 = "1m177hv8bfgsgcch8vbzwkb797i09l7lpfpai27cnljfk03vdhwr";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vsphere-v4.1.0-darwin-arm64.tar.gz";
         sha256 = "1915f5d24vfrwgzvs5nkj5p05fjgqjyxpm54ym2wshl9s4fjb6sp";
       }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-wavefront-v1.1.0-darwin-arm64.tar.gz";
+        sha256 = "0xzh9n69prbaf0795dzmyp4jbzmgqvg4sl2sad3l3mkbgghx4cll";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-yandex-v0.13.0-darwin-arm64.tar.gz";
+        sha256 = "1qaccfqw24g862ij2p49m78hnymg0j2nghshszqrg45v0d0qnknm";
+      }
     ];
   };
 }
diff --git a/pkgs/tools/admin/pulumi/update.sh b/pkgs/tools/admin/pulumi/update.sh
index c2b0818e5b9..91634301c27 100755
--- a/pkgs/tools/admin/pulumi/update.sh
+++ b/pkgs/tools/admin/pulumi/update.sh
@@ -10,36 +10,51 @@ fi
 
 # Version of Pulumi from
 # https://www.pulumi.com/docs/get-started/install/versions/
-VERSION="3.22.1"
+VERSION="3.25.1"
 
 # An array of plugin names. The respective repository inside Pulumi's
 # Github organization is called pulumi-$name by convention.
 
 declare -a pulumi_repos
 pulumi_repos=(
+  "aiven"
+  "akamai"
+  "alicloud"
+  "artifactory"
   "auth0"
   "aws"
   "azure"
+  "azuread"
+  "azuredevops"
   "cloudflare"
   "consul"
   "datadog"
   "digitalocean"
   "docker"
   "equinix-metal"
+  "fastly"
   "gcp"
   "github"
   "gitlab"
+  "google-native"
   "hcloud"
   "kubernetes"
   "linode"
   "mailgun"
   "mysql"
   "openstack"
-  "packet"
   "postgresql"
   "random"
+  "snowflake"
+  "spotinst"
+  "sumologic"
+  "tailscale"
+  "tls"
   "vault"
+  "venafi"
   "vsphere"
+  "wavefront"
+  "yandex"
 )
 
 # Contains latest release ${VERSION} from
diff --git a/pkgs/tools/misc/nncp/default.nix b/pkgs/tools/misc/nncp/default.nix
index a9c2a43734e..0e27139b5b3 100644
--- a/pkgs/tools/misc/nncp/default.nix
+++ b/pkgs/tools/misc/nncp/default.nix
@@ -3,12 +3,12 @@
 
 stdenv.mkDerivation rec {
   pname = "nncp";
-  version = "8.5.0";
+  version = "8.6.0";
   outputs = [ "out" "doc" "info" ];
 
   src = fetchurl {
     url = "http://www.nncpgo.org/download/${pname}-${version}.tar.xz";
-    sha256 = "sha256-6IUNJ3DE+nRc+bmpDO7l1gXlD6UDGggTSYRMFT57v/Q=";
+    sha256 = "sha256-rhbwoJwbfR2jdn4cD0ENnCmsyuYypEipVdtKDxW/g48=";
   };
 
   nativeBuildInputs = [ go redo-apenwarr ];
diff --git a/pkgs/tools/misc/precice-config-visualizer/default.nix b/pkgs/tools/misc/precice-config-visualizer/default.nix
new file mode 100644
index 00000000000..7605f49b153
--- /dev/null
+++ b/pkgs/tools/misc/precice-config-visualizer/default.nix
@@ -0,0 +1,23 @@
+{ lib, python3Packages, fetchFromGitHub}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "config-visualizer";
+  version = "unstable-2022-02-23";
+
+  src = fetchFromGitHub {
+    owner = "precice";
+    repo = pname;
+    rev = "60f2165f25352c8261f370dc4ceb64a8b422d4ec";
+    sha256 = "sha256:0mqzp2qdvbqbxaczlvc9xxxdz6hclraznbmc08ldx11xwy8yknfr";
+  };
+
+  propagatedBuildInputs = with python3Packages; [ lxml pydot ];
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Small python tool for visualizing the preCICE xml configuration ";
+    homepage = "https://github.com/precice/config-visualizer";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ Scriptkiddi ];
+  };
+}
diff --git a/pkgs/tools/misc/staruml/default.nix b/pkgs/tools/misc/staruml/default.nix
index 3d2042978f8..1e0b50d6f85 100644
--- a/pkgs/tools/misc/staruml/default.nix
+++ b/pkgs/tools/misc/staruml/default.nix
@@ -1,5 +1,6 @@
-{ stdenv, lib, fetchurl, makeWrapper
-, dpkg, patchelf
+{ stdenv, lib, fetchurl
+, dpkg, patchelf, wrapGAppsHook
+, hicolor-icon-theme
 , gtk3, glib, systemd
 , xorg, nss, nspr
 , atk, at-spi2-atk, dbus
@@ -30,7 +31,8 @@ stdenv.mkDerivation rec {
       sha256 = "sha256-CUOdpR8RExMLeOX8469egENotMNuPU4z8S1IGqA21z0=";
     };
 
-  nativeBuildInputs = [ makeWrapper dpkg ];
+  nativeBuildInputs = [ wrapGAppsHook dpkg ];
+  buildInputs = [ glib hicolor-icon-theme ];
 
   unpackPhase = ''
     mkdir pkg
@@ -39,8 +41,14 @@ stdenv.mkDerivation rec {
   '';
 
   installPhase = ''
-    mkdir $out
-    mv opt/StarUML $out/bin
+    mkdir -p $out/bin
+    mv opt $out
+
+    mv usr/share $out
+    rm -rf $out/share/doc
+
+    substituteInPlace $out/share/applications/staruml.desktop \
+      --replace "/opt/StarUML/staruml" "$out/bin/staruml"
 
     mkdir -p $out/lib
     ln -s ${stdenv.cc.cc.lib}/lib/libstdc++.so.6 $out/lib/
@@ -48,9 +56,15 @@ stdenv.mkDerivation rec {
 
     patchelf \
       --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-      $out/bin/staruml
-    wrapProgram $out/bin/staruml \
-      --prefix LD_LIBRARY_PATH : $out/lib:${LD_LIBRARY_PATH}
+      $out/opt/StarUML/staruml
+
+    ln -s $out/opt/StarUML/staruml $out/bin/staruml
+  '';
+
+  preFixup = ''
+    gappsWrapperArgs+=(
+      --prefix LD_LIBRARY_PATH ':' $out/lib:${LD_LIBRARY_PATH}
+    )
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/networking/opendrop/default.nix b/pkgs/tools/networking/opendrop/default.nix
new file mode 100644
index 00000000000..6a893721510
--- /dev/null
+++ b/pkgs/tools/networking/opendrop/default.nix
@@ -0,0 +1,41 @@
+{ lib
+, buildPythonApplication
+, fetchPypi
+, fleep
+, libarchive-c
+, pillow
+, requests-toolbelt
+, setuptools
+, zeroconf }:
+
+buildPythonApplication rec {
+  pname = "opendrop";
+  version = "0.13.0";
+
+  src = fetchPypi {
+    inherit version pname;
+    sha256 = "sha256-FE1oGpL6C9iBhI8Zj71Pm9qkObJvSeU2gaBZwK1bTQc=";
+  };
+
+  propagatedBuildInputs = [
+    fleep
+    libarchive-c
+    pillow
+    requests-toolbelt
+    setuptools
+    zeroconf
+  ];
+
+  # There are tests, but getting the following error:
+  # nix_run_setup: error: argument action: invalid choice: 'test' (choose from 'receive', 'find', 'send')
+  # Opendrop works as intended though
+  doCheck = false;
+
+  meta = with lib; {
+    description = "An open Apple AirDrop implementation written in Python";
+    homepage = "https://owlink.org/";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ wolfangaukang ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/tools/networking/opensnitch/daemon.nix b/pkgs/tools/networking/opensnitch/daemon.nix
index e636950cd98..25b42066419 100644
--- a/pkgs/tools/networking/opensnitch/daemon.nix
+++ b/pkgs/tools/networking/opensnitch/daemon.nix
@@ -48,7 +48,12 @@ buildGoModule rec {
 
   postBuild = ''
     mv $GOPATH/bin/daemon $GOPATH/bin/opensnitchd
-    mkdir -p $out/lib/systemd/system
+    mkdir -p $out/etc/opensnitchd $out/lib/systemd/system
+    cp system-fw.json $out/etc/opensnitchd/
+    substitute default-config.json $out/etc/default-config.json \
+      --replace "/var/log/opensnitchd.log" "/dev/stdout" \
+      --replace "iptables" "nftables" \
+      --replace "ebpf" "proc"
     substitute opensnitchd.service $out/lib/systemd/system/opensnitchd.service \
       --replace "/usr/local/bin/opensnitchd" "$out/bin/opensnitchd" \
       --replace "/etc/opensnitchd/rules" "/var/lib/opensnitch/rules" \
diff --git a/pkgs/tools/networking/owl/default.nix b/pkgs/tools/networking/owl/default.nix
new file mode 100644
index 00000000000..5a726c25a02
--- /dev/null
+++ b/pkgs/tools/networking/owl/default.nix
@@ -0,0 +1,25 @@
+{ stdenv, lib, fetchFromGitHub, cmake, libev, libnl, libpcap }:
+
+stdenv.mkDerivation rec {
+  pname = "owl";
+  version = "unstable-2022-01-30";
+
+  src = fetchFromGitHub {
+    owner = "seemoo-lab";
+    repo = "owl";
+    rev = "8e4e840b212ae5a09a8a99484be3ab18bad22fa7";
+    sha256 = "sha256-kFk+JFLGWGBu5FPH3qp/Bxa6t04f1kpeHz3H8GNF3fg=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ libev libnl libpcap ];
+
+  meta = with lib; {
+    description = "An open Apple Wireless Direct Link (AWDL) implementation written in C";
+    homepage = "https://owlink.org/";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ wolfangaukang ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/tools/security/aiodnsbrute/default.nix b/pkgs/tools/security/aiodnsbrute/default.nix
index 77f03e4174f..f1d170e7d59 100644
--- a/pkgs/tools/security/aiodnsbrute/default.nix
+++ b/pkgs/tools/security/aiodnsbrute/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonApplication rec {
   pname = "aiodnsbrute";
-  version = "0.3.2";
+  version = "0.3.3";
 
   src = fetchFromGitHub {
     owner = "blark";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0fs8544kx7vwvc97zpg4rs3lmvnb4vwika5g952rv3bfx4rv3bpg";
+    sha256 = "sha256-cEpk71VoQJZfKeAZummkk7yjtXKSMndgo0VleYiMlWE=";
   };
 
   # https://github.com/blark/aiodnsbrute/pull/8
diff --git a/pkgs/tools/security/fprot/default.nix b/pkgs/tools/security/fprot/default.nix
deleted file mode 100644
index 6b930adcc26..00000000000
--- a/pkgs/tools/security/fprot/default.nix
+++ /dev/null
@@ -1,42 +0,0 @@
-{ lib, stdenv, fetchurl }:
-
-stdenv.mkDerivation {
-
-  pname = "f-prot";
-  version = "6.2.1";
-
-  src = fetchurl {
-    url = "http://files.f-prot.com/files/unix-trial/fp-Linux.x86.32-ws.tar.gz";
-    sha256 = "0qlsrkanf0inplwv1i6hqbimdg91syf5ggd1vahsm9lhivmnr0v5";
-  };
-
-  installPhase = ''
-    mkdir -p $out/bin
-    cp fpscan $out/bin
-
-    mkdir -p $out/opt/f-prot
-    cp fpupdate $out/opt/f-prot
-    cp product.data.default $out/opt/f-prot/product.data
-    cp license.key $out/opt/f-prot/
-    cp f-prot.conf.default $out/opt/f-prot/f-prot.conf
-    ln -s $out/opt/f-prot/fpupdate $out/bin/fpupdate
-
-    patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $out/opt/f-prot/fpupdate
-
-    mkdir -p $out/share/man/
-    mkdir -p $out/share/man/man1
-    cp doc/man/fpscan.1 $out/share/man/man1
-    mkdir -p $out/share/man/man5
-    cp doc/man/f-prot.conf.5 $out/share/man/man5
-    mkdir -p $out/share/man/man8
-    cp doc/man/fpupdate.8 $out/share/man/man8
-  '';
-
-  meta = with lib; {
-    homepage = "http://www.f-prot.com";
-    description = "A popular proprietary antivirus program";
-    license = licenses.unfree;
-    maintainers = [ ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/tools/security/httpx/default.nix b/pkgs/tools/security/httpx/default.nix
index 1e57679b4ad..0d87780cee4 100644
--- a/pkgs/tools/security/httpx/default.nix
+++ b/pkgs/tools/security/httpx/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "httpx";
-  version = "1.1.5";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "httpx";
     rev = "v${version}";
-    sha256 = "sha256-XA099gBp52g0RUbbFSE8uFa7gh56bO8H66KaFAtK1RU=";
+    sha256 = "sha256-zNK/OBDo6cL0uZHosulusdOviYZMD2TCusE+0Mn330g=";
   };
 
-  vendorSha256 = "sha256-Qx0QaPKpEq4U+G3qdfMN4EVyY5zI2SyzcK/U6o6loHE=";
+  vendorSha256 = "sha256-a6Tpz4jPQbtiWt6OyDKy+xbRx6EBwADyqTkvBnyusdQ=";
 
   meta = with lib; {
     description = "Fast and multi-purpose HTTP toolkit";
diff --git a/pkgs/tools/security/step-cli/default.nix b/pkgs/tools/security/step-cli/default.nix
index e91a35b808c..0f8f37a4890 100644
--- a/pkgs/tools/security/step-cli/default.nix
+++ b/pkgs/tools/security/step-cli/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "step-cli";
-  version = "0.18.1";
+  version = "0.18.2";
 
   src = fetchFromGitHub {
     owner = "smallstep";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-gMJFzfqQsxOXPRdRj48c3FKhXsPLEmegiENa2OHWEGo=";
+    sha256 = "sha256-Ki6MrLVJf2U4Q0y6jtOQZOti/m3SULWNKZ9SdirlOVA=";
   };
 
   ldflags = [
@@ -25,7 +25,7 @@ buildGoModule rec {
     rm command/certificate/remote_test.go
   '';
 
-  vendorSha256 = "sha256-wnMQPnL8M57BOY9QmawLpqtWv+n3GdfIadJ3PwuicOU=";
+  vendorSha256 = "sha256-ftBZQmtrnGFMZRXDKmMyqnfxuY5vtrZDXVR43yd1shk=";
 
   meta = with lib; {
     description = "A zero trust swiss army knife for working with X509, OAuth, JWT, OATH OTP, etc";
diff --git a/pkgs/tools/security/witness/default.nix b/pkgs/tools/security/witness/default.nix
index 571685afb40..bb15d9d72cc 100644
--- a/pkgs/tools/security/witness/default.nix
+++ b/pkgs/tools/security/witness/default.nix
@@ -1,25 +1,57 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
 
 buildGoModule rec {
   pname = "witness";
-  version = "0.1.1";
+  version = "0.1.6";
 
   src = fetchFromGitHub {
     owner = "testifysec";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-NnDsiDUTCdjsHVA/mHnB8WRnvwFTzETkWUOd7IgMIWE=";
+    sha256 = "sha256-/35hIA6Wm/F5hwyLZbt4JXpwWISWbzVAWrX29r6pejY=";
   };
 
-  vendorSha256 = "sha256-zkLparWJsuqrhOQxxV37dBqt6fwpSinTO+paJkbl+sM=";
+  vendorSha256 = "sha256-vXDsHHJknw9hsHx1mJA2c0CWwFbRXjCjitNWPh6V4yw=";
+
+  nativeBuildInputs = [ installShellFiles ];
 
   # We only want the witness binary, not the helper utilities for generating docs.
   subPackages = [ "cmd/witness" ];
 
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/testifysec/witness/cmd/witness/cmd.Version=v${version}"
+  ];
+
+  # Feed in all tests for testing
+  # This is because subPackages above limits what is built to just what we
+  # want but also limits the tests
+  preCheck = ''
+    unset subPackages
+  '';
+
+  postInstall = ''
+    installShellCompletion --cmd witness \
+      --bash <($out/bin/witness completion bash) \
+      --fish <($out/bin/witness completion fish) \
+      --zsh <($out/bin/witness completion zsh)
+  '';
+
   meta = with lib; {
     description = "A pluggable framework for software supply chain security. Witness prevents tampering of build materials and verifies the integrity of the build process from source to target";
+    longDescription = ''
+      Witness prevents tampering of build materials and verifies the integrity
+      of the build process from source to target. It works by wrapping commands
+      executed in a continuous integration process. Its attestation system is
+      pluggable and offers support out of the box for most major CI and
+      infrastructure providers. Verification of Witness metadata and a secure
+      PKI distribution system will mitigate against many software supply chain
+      attack vectors and can be used as a framework for automated governance.
+    '';
     homepage = "https://github.com/testifysec/witness";
+    changelog = "https://github.com/testifysec/witness/releases/tag/v${version}";
     license = licenses.asl20;
-    maintainers = with maintainers; [ fkautz ];
+    maintainers = with maintainers; [ fkautz jk ];
   };
 }
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 1972123bd98..04f4955b803 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1143,6 +1143,7 @@ mapAliases ({
   squid4 = squid;  # added 2019-08-22
   sshfsFuse = throw "'sshfsFuse' has been renamed to/replaced by 'sshfs-fuse'"; # Converted to throw 2022-02-22
   stanchion = throw "Stanchion was part of riak-cs which is not maintained anymore"; # added 2020-10-14
+  steam-run-native = steam-run; # added 2022-02-21
   stumpwm-git = throw "stumpwm-git has been broken for a long time and lispPackages.stumpwm follows Quicklisp that is close to git version"; # Added 2021-05-09
   subversion19 = throw "subversion19 has been removed as it has reached its end of life"; # Added 2021-03-31
   sundials_3 = throw "sundials_3 was removed in 2020-02. outdated and no longer needed";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 69d880ffb59..94817fb66b9 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -464,6 +464,8 @@ with pkgs;
 
   buildDotnetModule = callPackage ../build-support/dotnet/build-dotnet-module { };
   nuget-to-nix = callPackage ../build-support/dotnet/nuget-to-nix { };
+  mkNugetSource = callPackage ../build-support/dotnet/make-nuget-source { };
+  mkNugetDeps = callPackage ../build-support/dotnet/make-nuget-deps { };
 
   dotnetenv = callPackage ../build-support/dotnet/dotnetenv {
     dotnetfx = dotnetfx40;
@@ -544,6 +546,10 @@ with pkgs;
 
   graph-easy = callPackage ../tools/graphics/graph-easy { };
 
+  opendrop = python3Packages.callPackage ../tools/networking/opendrop { };
+
+  owl = callPackage ../tools/networking/owl { };
+
   packer = callPackage ../development/tools/packer { };
 
   packr = callPackage ../development/libraries/packr { };
@@ -825,8 +831,9 @@ with pkgs;
 
   writeDarwinBundle = callPackage ../build-support/make-darwin-bundle/write-darwin-bundle.nix { };
 
-  desktopToDarwinBundle = makeSetupHook { deps = [ writeDarwinBundle imagemagick ]; }
-    ../build-support/setup-hooks/desktop-to-darwin-bundle.sh;
+  desktopToDarwinBundle = makeSetupHook {
+    deps = [ writeDarwinBundle librsvg imagemagick python3Packages.icnsutil ];
+  } ../build-support/setup-hooks/desktop-to-darwin-bundle.sh;
 
   keepBuildTree = makeSetupHook { } ../build-support/setup-hooks/keep-build-tree.sh;
 
@@ -3667,6 +3674,8 @@ with pkgs;
 
   precice = callPackage ../development/libraries/precice { };
 
+  precice-config-visualizer = callPackage ../tools/misc/precice-config-visualizer { };
+
   pueue = callPackage ../applications/misc/pueue {
     inherit (darwin.apple_sdk.frameworks) SystemConfiguration;
   };
@@ -5546,8 +5555,6 @@ with pkgs;
 
   fpm = callPackage ../tools/package-management/fpm { };
 
-  fprot = callPackage ../tools/security/fprot { };
-
   fprintd = callPackage ../tools/security/fprintd { };
 
   fprintd-tod = callPackage ../tools/security/fprintd/tod.nix { };
@@ -16555,6 +16562,8 @@ with pkgs;
 
   fcl = callPackage ../development/libraries/fcl { };
 
+  febio = callPackage ../development/libraries/febio { };
+
   ffcast = callPackage ../tools/X11/ffcast { };
 
   fflas-ffpack = callPackage ../development/libraries/fflas-ffpack { };
@@ -18565,6 +18574,8 @@ with pkgs;
 
   libptytty = callPackage ../development/libraries/libptytty { };
 
+  libpulsar = callPackage ../development/libraries/libpulsar { };
+
   libpwquality = callPackage ../development/libraries/libpwquality { };
 
   libqalculate = callPackage ../development/libraries/libqalculate {
@@ -21490,6 +21501,7 @@ with pkgs;
 
   openresty = callPackage ../servers/http/openresty {
     withPerl = false;
+    modules = [];
   };
 
   opensmtpd = callPackage ../servers/mail/opensmtpd { };
@@ -25298,12 +25310,12 @@ with pkgs;
     inherit (darwin) sigtool;
   };
 
-  emacs27-nox = lowPrio (appendToName "nox" (emacs27.override {
+  emacs27-nox = lowPrio (emacs27.override {
     withX = false;
     withNS = false;
     withGTK2 = false;
     withGTK3 = false;
-  }));
+  });
 
   emacsMacport = callPackage ../applications/editors/emacs/macport.nix {
     inherit (darwin.apple_sdk.frameworks)
@@ -31437,9 +31449,6 @@ with pkgs;
   steam = steamPackages.steam-fhsenv;
 
   steam-run = steam.run;
-  steam-run-native = (steam.override {
-    nativeOnly = true;
-  }).run;
 
   steam-tui = callPackage ../games/steam-tui { };
 
@@ -33020,6 +33029,8 @@ with pkgs;
 
   dell-530cdn = callPackage ../misc/drivers/dell-530cdn {};
 
+  dockutil = callPackage ../os-specific/darwin/dockutil { };
+
   dosbox = callPackage ../applications/emulators/dosbox { };
 
   dosbox-staging = callPackage ../applications/emulators/dosbox-staging { };
@@ -34189,6 +34200,8 @@ with pkgs;
 
   xosview2 = callPackage ../tools/X11/xosview2 { };
 
+  xow_dongle-firmware = callPackage ../os-specific/linux/firmware/xow_dongle-firmware { };
+
   xpad = callPackage ../applications/misc/xpad { };
 
   xsane = callPackage ../applications/graphics/sane/xsane.nix {
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index 8490870e589..5f043faecfd 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -462,6 +462,8 @@ in {
 
     xmm7360-pci = callPackage ../os-specific/linux/xmm7360-pci { };
 
+    xone = if lib.versionAtLeast kernel.version "5.4" then callPackage ../os-specific/linux/xone { } else null;
+
     xpadneo = callPackage ../os-specific/linux/xpadneo { };
 
     zenpower = callPackage ../os-specific/linux/zenpower { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index b2b3831e65d..3a9c01a08fd 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -186,6 +186,8 @@ in {
 
   actdiag = callPackage ../development/python-modules/actdiag { };
 
+  adafruit-io = callPackage ../development/python-modules/adafruit-io { };
+
   adafruit-platformdetect = callPackage ../development/python-modules/adafruit-platformdetect { };
 
   adafruit-pureio = callPackage ../development/python-modules/adafruit-pureio { };
@@ -3027,6 +3029,8 @@ in {
 
   flax = callPackage ../development/python-modules/flax { };
 
+  fleep = callPackage ../development/python-modules/fleep { };
+
   flexmock = callPackage ../development/python-modules/flexmock { };
 
   flickrapi = callPackage ../development/python-modules/flickrapi { };
@@ -3922,6 +3926,8 @@ in {
 
   icmplib = callPackage ../development/python-modules/icmplib { };
 
+  icnsutil = callPackage ../development/python-modules/icnsutil { };
+
   ics = callPackage ../development/python-modules/ics { };
 
   idasen = callPackage ../development/python-modules/idasen { };
@@ -5468,6 +5474,8 @@ in {
 
   nextcloudmonitor = callPackage ../development/python-modules/nextcloudmonitor { };
 
+  nextcord = callPackage ../development/python-modules/nextcord { };
+
   nghttp2 = (toPythonModule (pkgs.nghttp2.override {
     inherit (self) python cython setuptools;
     inherit (pkgs) ncurses;
@@ -5741,6 +5749,8 @@ in {
 
   opensensemap-api = callPackage ../development/python-modules/opensensemap-api { };
 
+  opensfm = callPackage ../development/python-modules/opensfm { };
+
   openshift = callPackage ../development/python-modules/openshift { };
 
   opensimplex = callPackage ../development/python-modules/opensimplex { };
@@ -6082,6 +6092,8 @@ in {
 
   pdunehd = callPackage ../development/python-modules/pdunehd { };
 
+  pyprecice = callPackage ../development/python-modules/pyprecice { };
+
   phonopy = callPackage ../development/python-modules/phonopy { };
 
   phpserialize = callPackage ../development/python-modules/phpserialize { };
@@ -9997,6 +10009,8 @@ in {
 
   toposort = callPackage ../development/python-modules/toposort { };
 
+  torch-tb-profiler = callPackage ../development/python-modules/torch-tb-profiler/default.nix { };
+
   torchaudio-bin = callPackage ../development/python-modules/torchaudio/bin.nix { };
 
   torchgpipe = callPackage ../development/python-modules/torchgpipe { };
@@ -10123,6 +10137,8 @@ in {
 
   twitch-python = callPackage ../development/python-modules/twitch-python { };
 
+  twitchapi = callPackage ../development/python-modules/twitchapi { };
+
   twitter = callPackage ../development/python-modules/twitter { };
 
   twitter-common-collections = callPackage ../development/python-modules/twitter-common-collections { };