diff --git a/doc/doc-support/lib-function-locations.nix b/doc/doc-support/lib-function-locations.nix
index 68edd270985..ac4da88052d 100644
--- a/doc/doc-support/lib-function-locations.nix
+++ b/doc/doc-support/lib-function-locations.nix
@@ -38,7 +38,7 @@ let
       substr = builtins.substring prefixLen filenameLen filename;
       in substr;
 
-  removeNixpkgs = removeFilenamePrefix (builtins.toString pkgs.path);
+  removeNixpkgs = removeFilenamePrefix pkgs.path;
 
   liblocations =
     builtins.filter
diff --git a/lib/sources.nix b/lib/sources.nix
index cec395c9bb1..b7fb71bd0b0 100644
--- a/lib/sources.nix
+++ b/lib/sources.nix
@@ -140,7 +140,7 @@ let
       origSrc = if isFiltered then src.origSrc else src;
     in lib.cleanSourceWith {
       filter = (path: type:
-        let relPath = lib.removePrefix (toString origSrc + "/") (toString path);
+        let relPath = lib.removePrefix (origSrc + "/") (path);
         in lib.any (re: match re relPath != null) regexes);
       inherit src;
     };
@@ -175,12 +175,12 @@ let
   */
   commitIdFromGitRepo =
     let readCommitFromFile = file: path:
-        let fileName       = toString path + "/" + file;
-            packedRefsName = toString path + "/packed-refs";
+        let fileName       = path + "/" + file;
+            packedRefsName = path + "/packed-refs";
             absolutePath   = base: path:
               if lib.hasPrefix "/" path
               then path
-              else toString (/. + "${base}/${path}");
+              else /. + "${base}/${path}";
         in if pathIsRegularFile path
            # Resolve git worktrees. See gitrepository-layout(5)
            then
@@ -226,7 +226,7 @@ let
 
   pathHasContext = builtins.hasContext or (lib.hasPrefix storeDir);
 
-  canCleanSource = src: src ? _isLibCleanSourceWith || !(pathHasContext (toString src));
+  canCleanSource = src: src ? _isLibCleanSourceWith || !(pathHasContext src);
 
   # -------------------------------------------------------------------------- #
   # Internal functions
diff --git a/lib/trivial.nix b/lib/trivial.nix
index 5d4fad8266b..8f2023caaf8 100644
--- a/lib/trivial.nix
+++ b/lib/trivial.nix
@@ -213,8 +213,8 @@ rec {
     # Default value to return if revision can not be determined
     default:
     let
-      revisionFile = "${toString ./..}/.git-revision";
-      gitRepo      = "${toString ./..}/.git";
+      revisionFile = ./.. + "/.git-revision";
+      gitRepo      = ./.. + "/.git";
     in if lib.pathIsGitRepo gitRepo
        then lib.commitIdFromGitRepo gitRepo
        else if lib.pathExists revisionFile then lib.fileContents revisionFile
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index cb3b9a248c0..380f1a7d27e 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -691,6 +691,7 @@ in {
   wmderland = handleTest ./wmderland.nix {};
   wpa_supplicant = handleTest ./wpa_supplicant.nix {};
   wordpress = handleTest ./wordpress.nix {};
+  wrappers = handleTest ./wrappers.nix {};
   writefreely = handleTest ./web-apps/writefreely.nix {};
   xandikos = handleTest ./xandikos.nix {};
   xautolock = handleTest ./xautolock.nix {};
diff --git a/nixos/tests/wrappers.nix b/nixos/tests/wrappers.nix
new file mode 100644
index 00000000000..08c1ad0b6b9
--- /dev/null
+++ b/nixos/tests/wrappers.nix
@@ -0,0 +1,79 @@
+import ./make-test-python.nix ({ pkgs, ... }:
+let
+  userUid = 1000;
+  usersGid = 100;
+  busybox = pkgs : pkgs.busybox.override {
+    # Without this, the busybox binary drops euid to ruid for most applets, including id.
+    # See https://bugs.busybox.net/show_bug.cgi?id=15101
+    extraConfig = "CONFIG_FEATURE_SUID n";
+  };
+in
+{
+  name = "wrappers";
+
+  nodes.machine = { config, pkgs, ... }: {
+    ids.gids.users = usersGid;
+
+    users.users = {
+      regular = {
+        uid = userUid;
+        isNormalUser = true;
+      };
+    };
+
+    security.wrappers = {
+      suidRoot = {
+        owner = "root";
+        group = "root";
+        setuid = true;
+        source = "${busybox pkgs}/bin/busybox";
+        program = "suid_root_busybox";
+      };
+      sgidRoot = {
+        owner = "root";
+        group = "root";
+        setgid = true;
+        source = "${busybox pkgs}/bin/busybox";
+        program = "sgid_root_busybox";
+      };
+      withChown = {
+        owner = "root";
+        group = "root";
+        source = "${pkgs.libcap}/bin/capsh";
+        program = "capsh_with_chown";
+        capabilities = "cap_chown+ep";
+      };
+    };
+  };
+
+  testScript =
+    ''
+      def cmd_as_regular(cmd):
+        return "su -l regular -c '{0}'".format(cmd)
+
+      def test_as_regular(cmd, expected):
+        out = machine.succeed(cmd_as_regular(cmd)).strip()
+        assert out == expected, "Expected {0} to output {1}, but got {2}".format(cmd, expected, out)
+
+      test_as_regular('${busybox pkgs}/bin/busybox id -u', '${toString userUid}')
+      test_as_regular('${busybox pkgs}/bin/busybox id -ru', '${toString userUid}')
+      test_as_regular('${busybox pkgs}/bin/busybox id -g', '${toString usersGid}')
+      test_as_regular('${busybox pkgs}/bin/busybox id -rg', '${toString usersGid}')
+
+      test_as_regular('/run/wrappers/bin/suid_root_busybox id -u', '0')
+      test_as_regular('/run/wrappers/bin/suid_root_busybox id -ru', '${toString userUid}')
+      test_as_regular('/run/wrappers/bin/suid_root_busybox id -g', '${toString usersGid}')
+      test_as_regular('/run/wrappers/bin/suid_root_busybox id -rg', '${toString usersGid}')
+
+      test_as_regular('/run/wrappers/bin/sgid_root_busybox id -u', '${toString userUid}')
+      test_as_regular('/run/wrappers/bin/sgid_root_busybox id -ru', '${toString userUid}')
+      test_as_regular('/run/wrappers/bin/sgid_root_busybox id -g', '0')
+      test_as_regular('/run/wrappers/bin/sgid_root_busybox id -rg', '${toString usersGid}')
+
+      # We are only testing the permitted set, because it's easiest to look at with capsh.
+      machine.fail(cmd_as_regular('${pkgs.libcap}/bin/capsh --has-p=CAP_CHOWN'))
+      machine.fail(cmd_as_regular('${pkgs.libcap}/bin/capsh --has-p=CAP_SYS_ADMIN'))
+      machine.succeed(cmd_as_regular('/run/wrappers/bin/capsh_with_chown --has-p=CAP_CHOWN'))
+      machine.fail(cmd_as_regular('/run/wrappers/bin/capsh_with_chown --has-p=CAP_SYS_ADMIN'))
+    '';
+})
diff --git a/pkgs/applications/audio/espeak/edit.nix b/pkgs/applications/audio/espeak/edit.nix
index 2240a856116..2c86a036ceb 100644
--- a/pkgs/applications/audio/espeak/edit.nix
+++ b/pkgs/applications/audio/espeak/edit.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pkg-config, unzip, portaudio, wxGTK, sox }:
+{ lib, stdenv, fetchurl, pkg-config, unzip, portaudio, wxGTK32, sox }:
 
 stdenv.mkDerivation rec {
   pname = "espeakedit";
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ pkg-config unzip ];
-  buildInputs = [ portaudio wxGTK ];
+  buildInputs = [ portaudio wxGTK32 ];
 
   # TODO:
   # Uhm, seems like espeakedit still wants espeak-data/ in $HOME, even thought
@@ -27,6 +27,7 @@ stdenv.mkDerivation rec {
     ./espeakedit-configurable-sox-path.patch
     ./espeakedit-configurable-path-espeak-data.patch
     ./espeakedit-gcc6.patch
+    ./espeakedit-wxgtk30.patch
   ];
 
   postPatch = ''
diff --git a/pkgs/applications/audio/espeak/espeakedit-wxgtk30.patch b/pkgs/applications/audio/espeak/espeakedit-wxgtk30.patch
new file mode 100644
index 00000000000..04e57882498
--- /dev/null
+++ b/pkgs/applications/audio/espeak/espeakedit-wxgtk30.patch
@@ -0,0 +1,32 @@
+diff -uNr a/src/espeakedit.cpp b/src/espeakedit.cpp
+--- a/src/espeakedit.cpp
++++ b/src/espeakedit.cpp
+@@ -123,7 +126,7 @@ bool MyApp::OnInit(void)
+ {//=====================
+ 
+ int j;
+-wxChar *p;
++const wxChar *p;
+ char param[120];
+ 
+ 
+diff -uNr a/src/spect.cpp b/src/spect.cpp
+--- a/src/spect.cpp
++++ b/src/spect.cpp
+@@ -1,6 +1,7 @@
+ /***************************************************************************
+  *   Copyright (C) 2005 to 2007 by Jonathan Duddington                     *
+  *   email: jonsd@users.sourceforge.net                                    *
++ *   Copyright (C) 2013 by Reece H. Dunn                                   *
+  *                                                                         *
+  *   This program is free software; you can redistribute it and/or modify  *
+  *   it under the terms of the GNU General Public License as published by  *
+@@ -92,6 +93,8 @@ float SpectTilt(int value, int freq)
+ 
+ 
+ SpectFrame::SpectFrame(SpectFrame *copy)
++	: FONT_SMALL(8,wxSWISS,wxNORMAL,wxNORMAL)
++	, FONT_MEDIUM(9,wxSWISS,wxNORMAL,wxNORMAL)
+ {//=====================================
+ 
+ 	int  ix;
diff --git a/pkgs/applications/audio/faust/faust2.nix b/pkgs/applications/audio/faust/faust2.nix
index 32bcbee2e6c..19468b3af34 100644
--- a/pkgs/applications/audio/faust/faust2.nix
+++ b/pkgs/applications/audio/faust/faust2.nix
@@ -34,7 +34,7 @@ let
     homepage = "https://faust.grame.fr/";
     downloadPage = "https://github.com/grame-cncm/faust/";
     license = licenses.gpl2;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
     maintainers = with maintainers; [ magnetophon pmahoney ];
   };
 
diff --git a/pkgs/applications/editors/xmlcopyeditor/default.nix b/pkgs/applications/editors/xmlcopyeditor/default.nix
index d9bf7f52b2c..bd7c237e8c1 100644
--- a/pkgs/applications/editors/xmlcopyeditor/default.nix
+++ b/pkgs/applications/editors/xmlcopyeditor/default.nix
@@ -1,28 +1,55 @@
-{ lib, stdenv, fetchurl, aspell, boost, expat, intltool, libxml2, libxslt, pcre, wxGTK, xercesc }:
+{ lib
+, stdenv
+, fetchurl
+, aspell
+, boost
+, expat
+, intltool
+, pkg-config
+, libxml2
+, libxslt
+, pcre2
+, wxGTK32
+, xercesc
+, Cocoa
+}:
 
 stdenv.mkDerivation rec {
   pname = "xmlcopyeditor";
-  version = "1.2.1.3";
+  version = "1.3.1.0";
 
   src = fetchurl {
-    name = "${pname}-${version}.tar.gz";
     url = "mirror://sourceforge/xml-copy-editor/${pname}-${version}.tar.gz";
-    sha256 = "0bwxn89600jbrkvlwyawgc0c0qqxpl453mbgcb9qbbxl8984ns4v";
+    sha256 = "sha256-6HHKl7hqyvF3gJ9vmjLjTT49prJ8KhEEV0qPsJfQfJE=";
   };
 
   patches = [ ./xmlcopyeditor.patch ];
-  CPLUS_INCLUDE_PATH = "${libxml2.dev}/include/libxml2";
 
-  nativeBuildInputs = [ intltool ];
-  buildInputs = [ aspell boost expat libxml2 libxslt pcre wxGTK xercesc ];
+  nativeBuildInputs = [
+    intltool
+    pkg-config
+  ];
+
+  buildInputs = [
+    aspell
+    boost
+    expat
+    libxml2
+    libxslt
+    pcre2
+    wxGTK32
+    xercesc
+  ] ++ lib.optionals stdenv.isDarwin [
+    Cocoa
+  ];
 
   enableParallelBuilding = true;
 
   meta = with lib; {
     description = "A fast, free, validating XML editor";
-    homepage = "http://xml-copy-editor.sourceforge.net/";
+    homepage = "https://xml-copy-editor.sourceforge.io/";
     license = licenses.gpl2Plus;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ candeira ];
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ candeira wegank ];
   };
 }
diff --git a/pkgs/applications/editors/xmlcopyeditor/xmlcopyeditor.patch b/pkgs/applications/editors/xmlcopyeditor/xmlcopyeditor.patch
index 253b9ce49ba..1f35663bdad 100644
--- a/pkgs/applications/editors/xmlcopyeditor/xmlcopyeditor.patch
+++ b/pkgs/applications/editors/xmlcopyeditor/xmlcopyeditor.patch
@@ -1,17 +1,8 @@
-From 626c385ba141c6abcff01bef4451fcad062d232c Mon Sep 17 00:00:00 2001
-From: Javier Candeira <javier@candeira.com>
-Date: Sat, 7 Apr 2018 20:21:45 +1000
-Subject: [PATCH] nixpckgs patches
-
----
- src/Makefile.in | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
 diff --git a/src/Makefile.in b/src/Makefile.in
-index e75918f..e04703b 100644
+index e2b01fc..7f3a21e 100644
 --- a/src/Makefile.in
 +++ b/src/Makefile.in
-@@ -283,8 +283,8 @@ top_srcdir = @top_srcdir@
+@@ -427,8 +427,8 @@ top_srcdir = @top_srcdir@
  # these are the headers for your project
  noinst_HEADERS = $(srcdir)/*.h
  xmlcopyeditordir = ${prefix}/share/xmlcopyeditor
@@ -21,16 +12,4 @@ index e75918f..e04703b 100644
 +applicationsdir = ${prefix}/share/applications
  
  # the application source, library search path, and link libraries
- xmlcopyeditor_SOURCES = aboutdialog.cpp associatedialog.cpp binaryfile.cpp \
-@@ -357,7 +357,7 @@ EXTRA_DIST = \
- 	$(srcdir)/xmlcopyeditor.rc \
- 	$(srcdir)/xmlschemaparser.cpp
- 
--AM_CPPFLAGS = -I/usr/include/libxml2 $(ENCHANT_CFLAGS) $(GTK_CFLAGS)
-+AM_CPPFLAGS = -I$(CPLUS_INCLUDE_PATH) $(ENCHANT_CFLAGS) $(GTK_CFLAGS)
- all: all-am
- 
- .SUFFIXES:
--- 
-2.16.2
-
+ xmlcopyeditor_SOURCES = aboutdialog.cpp \
diff --git a/pkgs/applications/emulators/wine/base.nix b/pkgs/applications/emulators/wine/base.nix
index d30fe6039ec..699aa303462 100644
--- a/pkgs/applications/emulators/wine/base.nix
+++ b/pkgs/applications/emulators/wine/base.nix
@@ -108,6 +108,7 @@ stdenv.mkDerivation ((lib.optionalAttrs (buildScript != null) {
   ])
   ++ lib.optionals waylandSupport (with pkgs; [
      wayland libxkbcommon wayland-protocols wayland.dev libxkbcommon.dev
+     mesa # for libgbm
   ])));
 
   patches = [ ]
diff --git a/pkgs/applications/emulators/wine/sources.nix b/pkgs/applications/emulators/wine/sources.nix
index b90ac2d07a8..0841729026a 100644
--- a/pkgs/applications/emulators/wine/sources.nix
+++ b/pkgs/applications/emulators/wine/sources.nix
@@ -70,12 +70,13 @@ in rec {
   };
 
   wayland = fetchFromGitLab rec {
-    version = "7.0-rc2";
-    sha256 = "sha256-FU9L8cyIIfFQ+8f/AUg7IT+RxTpyNTuSfL0zBnur0SA=";
+    # https://gitlab.collabora.com/alf/wine/-/tree/wayland
+    version = "7.20";
+    sha256 = "sha256-UrukAnlfrr6eeVwFSEOWSVSfyMHbMT1o1tfXxow61xY=";
     domain = "gitlab.collabora.com";
     owner = "alf";
     repo = "wine";
-    rev = "95f0154c96a4b7d81e783ee5ba2f5d9cc7cda351";
+    rev = "1dc9821ef0b6109c74d0c95cd5418caf7f9feaf1";
 
     inherit (unstable) gecko32 gecko64;
 
diff --git a/pkgs/applications/misc/privacyidea/default.nix b/pkgs/applications/misc/privacyidea/default.nix
index 405d992576d..8ec18a87486 100644
--- a/pkgs/applications/misc/privacyidea/default.nix
+++ b/pkgs/applications/misc/privacyidea/default.nix
@@ -89,13 +89,13 @@ let
 in
 python3'.pkgs.buildPythonPackage rec {
   pname = "privacyIDEA";
-  version = "3.7.3";
+  version = "3.7.4";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-odwYUGfgoRrGbLpOh8SuQzYby8Ya6hKSn0rdHp+RS/U=";
+    sha256 = "sha256-QoVL6WJjX6+sN5S/iqV3kcfQ5fWTXkTnf6NpZcw3bGo=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/networking/cluster/cni/default.nix b/pkgs/applications/networking/cluster/cni/default.nix
index 3a9bb84938c..3dcf284021e 100644
--- a/pkgs/applications/networking/cluster/cni/default.nix
+++ b/pkgs/applications/networking/cluster/cni/default.nix
@@ -1,17 +1,23 @@
-{ lib, fetchFromGitHub, buildGoPackage }:
+{ lib, fetchFromGitHub, buildGoModule }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "cni";
-  version = "0.8.1";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
     owner = "containernetworking";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-vxwNHIc3rFi7HKIEZrBcr7Oxs2iUtFYcfJK7aXDUv3k=";
+    sha256 = "sha256-g7fVeoqquxPa17AfTu6wnB6PQJDluJ21T3ETrcvWtWg=";
   };
 
-  goPackagePath = "github.com/containernetworking/cni";
+  vendorSha256 = "sha256-nH/myA/KdTeFXvmBymXITyx5fdCGnWRn6hNRinXc3/s=";
+
+  subPackages = [
+    "./cnitool"
+  ];
+
+  ldflags = [ "-s" "-w" ];
 
   meta = with lib; {
     description = "Container Network Interface - networking for Linux containers";
diff --git a/pkgs/applications/networking/cluster/waypoint/default.nix b/pkgs/applications/networking/cluster/waypoint/default.nix
index 7649cc5b7df..317c0d5374b 100644
--- a/pkgs/applications/networking/cluster/waypoint/default.nix
+++ b/pkgs/applications/networking/cluster/waypoint/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "waypoint";
-  version = "0.10.2";
+  version = "0.10.3";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-4RAnGPzXrPXMclDiTd38VrOy7zqvccD/xrm3QpeFubM=";
+    sha256 = "sha256-+lNeMcSlhmbs1knONnoX2RhEgxTYyCfpdD6WuDTiLx8=";
   };
 
-  vendorSha256 = "sha256-fBsRmUE72lot9Ju/hUqpdSSXvMktRGP+H4WQ0GOCxrY=";
+  vendorSha256 = "sha256-59rJ30m6eiNIapJUNc1jRJE7IoAj0O+5G8JyKkhcyvY=";
 
   nativeBuildInputs = [ go-bindata installShellFiles ];
 
diff --git a/pkgs/applications/networking/flent/default.nix b/pkgs/applications/networking/flent/default.nix
index 8df990ec4fa..008579ea54f 100644
--- a/pkgs/applications/networking/flent/default.nix
+++ b/pkgs/applications/networking/flent/default.nix
@@ -1,23 +1,39 @@
-{ lib, buildPythonApplication, fetchPypi, matplotlib, procps, pyqt5, python
-, pythonPackages, qt5, sphinx, xvfb-run }:
-
+{
+  lib,
+  buildPythonApplication,
+  fetchPypi,
+  procps,
+  python,
+  qt5,
+  xvfb-run,
+}:
 buildPythonApplication rec {
   pname = "flent";
-  version = "2.0.1";
+  version = "2.1.1";
   src = fetchPypi {
     inherit pname version;
-    sha256 = "300a09938dc2b4a0463c9144626f25e0bd736fd47806a9444719fa024d671796";
+    sha256 = "sha256-21gd6sPYCZll3Q2O7kucTRhXvc5byXeQr50+1bZVT3M=";
   };
 
-  buildInputs = [ sphinx ];
-  nativeBuildInputs = [ qt5.wrapQtAppsHook ];
-  propagatedBuildInputs = [ matplotlib procps pyqt5 ];
-  checkInputs = [ procps pythonPackages.mock pyqt5 xvfb-run ];
+  buildInputs = [python.pkgs.sphinx];
+  nativeBuildInputs = [qt5.wrapQtAppsHook];
+  propagatedBuildInputs = [
+    procps
+    python.pkgs.matplotlib
+    python.pkgs.pyqt5
+    python.pkgs.qtpy
+  ];
+  checkInputs = [
+    python.pkgs.mock
+    xvfb-run
+  ];
 
   checkPhase = ''
+    # we want the gui tests to always run
+    sed -i 's|self.skip|pass; #&|' unittests/test_gui.py
+
     cat >test-runner <<EOF
     #!/bin/sh
-
     ${python.pythonForBuild.interpreter} nix_run_setup test
     EOF
     chmod +x test-runner
@@ -34,6 +50,6 @@ buildPythonApplication rec {
     homepage = "https://flent.org";
     license = licenses.gpl3;
 
-    maintainers = [ maintainers.mmlb ];
+    maintainers = [maintainers.mmlb];
   };
 }
diff --git a/pkgs/applications/networking/instant-messengers/dino/default.nix b/pkgs/applications/networking/instant-messengers/dino/default.nix
index d18341b220f..72e546286bf 100644
--- a/pkgs/applications/networking/instant-messengers/dino/default.nix
+++ b/pkgs/applications/networking/instant-messengers/dino/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dino";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "dino";
     repo = "dino";
     rev = "v${version}";
-    sha256 = "sha256-L5a5QlF9qlr4X/hGTabbbvOE5J1x/UVneWl/BRAa29Q=";
+    sha256 = "sha256-wjSgs1mUMV7j/8ZeXqWs8aOeWvJHwKziUfbtOC1HS3s=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/science/electronics/kicad/default.nix b/pkgs/applications/science/electronics/kicad/default.nix
index 9042862eac3..1540e3bdb69 100644
--- a/pkgs/applications/science/electronics/kicad/default.nix
+++ b/pkgs/applications/science/electronics/kicad/default.nix
@@ -2,7 +2,7 @@
 , fetchFromGitLab
 , gnome
 , dconf
-, wxGTK31
+, wxGTK32
 , gtk3
 , makeWrapper
 , gsettings-desktop-schemas
@@ -104,9 +104,9 @@ let
     if srcOverridep "libVersion" then srcs.libVersion
     else versionsImport.${baseName}.libVersion.version;
 
-  wxGTK = wxGTK31;
+  wxGTK = wxGTK32;
   python = python3;
-  wxPython = python.pkgs.wxPython_4_1;
+  wxPython = python.pkgs.wxPython_4_2;
 
   inherit (lib) concatStringsSep flatten optionalString optionals;
 in
@@ -224,11 +224,6 @@ stdenv.mkDerivation rec {
     maintainers = with lib.maintainers; [ evils kiwi ];
     # kicad is cross platform
     platforms = lib.platforms.all;
-    # despite that, nipkgs' wxGTK for darwin is "wxmac"
-    # and wxPython_4_0 does not account for this
-    # adjusting this package to downgrade to python2Packages.wxPython (wxPython 3),
-    # seems like more trouble than fixing wxPython_4_0 would be
-    # additionally, libngspice is marked as linux only, though it should support darwin
 
     hydraPlatforms = if (with3d) then [ ] else platforms;
     # We can't download the 3d models on Hydra,
diff --git a/pkgs/applications/video/obs-studio/plugins/obs-vkcapture.nix b/pkgs/applications/video/obs-studio/plugins/obs-vkcapture.nix
index 0e61f4aaeca..a1abc952fc7 100644
--- a/pkgs/applications/video/obs-studio/plugins/obs-vkcapture.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-vkcapture.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "obs-vkcapture";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "nowrep";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-yaN0am24p9gC+s64Rop+jQ3952UOtZund/KttnVxP48=";
+    hash = "sha256-FOyUgsHQlsjVGCct+ky189alVImoG+paqDKmGvnHoXo=";
   };
 
   cmakeFlags = lib.optionals stdenv.isi686 [
diff --git a/pkgs/applications/virtualization/conmon/default.nix b/pkgs/applications/virtualization/conmon/default.nix
index 4f16053c1a4..25b89889b52 100644
--- a/pkgs/applications/virtualization/conmon/default.nix
+++ b/pkgs/applications/virtualization/conmon/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "conmon";
-  version = "2.1.4";
+  version = "2.1.5";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-d7fXbzbrqhP6zLVZo3gO+FyvZg7Z3AGlNSNLy0PD6EE=";
+    sha256 = "sha256-zpZ3hVgnh8gkrSghSvhSZnG9uaN+GTKFGHv+MMcs73Q=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/development/libraries/aws-c-http/default.nix b/pkgs/development/libraries/aws-c-http/default.nix
index 555647a771e..73ed621c651 100644
--- a/pkgs/development/libraries/aws-c-http/default.nix
+++ b/pkgs/development/libraries/aws-c-http/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-http";
-  version = "0.6.22";
+  version = "0.6.24";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-http";
     rev = "v${version}";
-    sha256 = "sha256-wUaKLeIMu7iA+rXO6pVEJtE6Lxc5JIio3vZqhn9PV3M=";
+    sha256 = "sha256-sY0R9Hn0keX4djkHVXszCCfdqa+rzokTe18e5YH0fqs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/aws-c-io/default.nix b/pkgs/development/libraries/aws-c-io/default.nix
index 072c180765c..232efd2eec5 100644
--- a/pkgs/development/libraries/aws-c-io/default.nix
+++ b/pkgs/development/libraries/aws-c-io/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-io";
-  version = "0.13.5";
+  version = "0.13.6";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-7qNJMIG+bshtapm7uj+8ECSN9j0Bd1famSXp+i+67Uw=";
+    sha256 = "sha256-axFhFGeJhfqb4zu5u9an0pgpVDe+OyT+7A5SlAs502I=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/aws-c-s3/default.nix b/pkgs/development/libraries/aws-c-s3/default.nix
index 60db68153b7..0692c5ef7ab 100644
--- a/pkgs/development/libraries/aws-c-s3/default.nix
+++ b/pkgs/development/libraries/aws-c-s3/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-s3";
-  version = "0.1.50";
+  version = "0.1.51";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-s3";
     rev = "v${version}";
-    sha256 = "sha256-LFp7GkqdVXjOeeVD/4gOUK5chWcUMiepGoDLoN2XUok=";
+    sha256 = "sha256-10SDOl0XoALdSxJWHDLDkvX7rArUQKXjjXfAECFy/Vw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/aws-crt-cpp/default.nix b/pkgs/development/libraries/aws-crt-cpp/default.nix
index 9247de33a35..c7eac8474cb 100644
--- a/pkgs/development/libraries/aws-crt-cpp/default.nix
+++ b/pkgs/development/libraries/aws-crt-cpp/default.nix
@@ -16,7 +16,7 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-crt-cpp";
-  version = "0.18.7";
+  version = "0.18.9";
 
   outputs = [ "out" "dev" ];
 
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     owner = "awslabs";
     repo = "aws-crt-cpp";
     rev = "v${version}";
-    sha256 = "sha256-a5LY5GndhpKl5hFWl5DT5sj8xe24w4CJCkVg97oNA7U=";
+    sha256 = "sha256-NEsEKUKmADevb8SSc8EFuXLc12fuOf6fXI76yVeDQno=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/libpulsar/default.nix b/pkgs/development/libraries/libpulsar/default.nix
index 3ad5c16d352..76e379b45a6 100644
--- a/pkgs/development/libraries/libpulsar/default.nix
+++ b/pkgs/development/libraries/libpulsar/default.nix
@@ -51,10 +51,10 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "libpulsar";
-  version = "2.10.1";
+  version = "2.10.2";
 
   src = fetchurl {
-    hash = "sha256-qMj76jnxRH68DE6JkZjQrLSNzgXGnO7HjPjlaFavaUY=";
+    hash = "sha256-IONnsSDbnX2qz+Xya0taHYSViTOiRI36AfcxmY3dNpo=";
     url = "mirror://apache/pulsar/pulsar-${version}/apache-pulsar-${version}-src.tar.gz";
   };
 
diff --git a/pkgs/development/ocaml-modules/ocaml-gettext/camomile.nix b/pkgs/development/ocaml-modules/ocaml-gettext/camomile.nix
index d3606330019..4466234fdbc 100644
--- a/pkgs/development/ocaml-modules/ocaml-gettext/camomile.nix
+++ b/pkgs/development/ocaml-modules/ocaml-gettext/camomile.nix
@@ -2,7 +2,7 @@
 
 buildDunePackage {
   pname = "gettext-camomile";
-  inherit (ocaml_gettext) src version useDune2;
+  inherit (ocaml_gettext) src version;
 
   propagatedBuildInputs = [ camomile ocaml_gettext ];
 
diff --git a/pkgs/development/ocaml-modules/ocaml-gettext/default.nix b/pkgs/development/ocaml-modules/ocaml-gettext/default.nix
index 26f932ff8d7..481619ebd07 100644
--- a/pkgs/development/ocaml-modules/ocaml-gettext/default.nix
+++ b/pkgs/development/ocaml-modules/ocaml-gettext/default.nix
@@ -4,9 +4,7 @@ buildDunePackage rec {
   pname = "gettext";
   version = "0.4.2";
 
-  minimumOCamlVersion = "4.03";
-
-  useDune2 = true;
+  minimalOCamlVersion = "4.03";
 
   src = fetchurl {
     url = "https://github.com/gildor478/ocaml-gettext/releases/download/v${version}/gettext-v${version}.tbz";
@@ -17,7 +15,8 @@ buildDunePackage rec {
 
   propagatedBuildInputs = [ gettext fileutils ];
 
-  doCheck = true;
+  # Tests for version 0.4.2 are not compatible with OUnit 2.2.6
+  doCheck = false;
 
   checkInputs = [ ounit ];
 
diff --git a/pkgs/development/ocaml-modules/ocaml-gettext/stub.nix b/pkgs/development/ocaml-modules/ocaml-gettext/stub.nix
index 950ac652e54..75e739959c3 100644
--- a/pkgs/development/ocaml-modules/ocaml-gettext/stub.nix
+++ b/pkgs/development/ocaml-modules/ocaml-gettext/stub.nix
@@ -4,7 +4,7 @@ buildDunePackage rec {
 
   pname = "gettext-stub";
 
-  inherit (ocaml_gettext) src version useDune2;
+  inherit (ocaml_gettext) src version;
 
   buildInputs = [ dune-configurator ];
 
diff --git a/pkgs/development/ocaml-modules/ounit2/default.nix b/pkgs/development/ocaml-modules/ounit2/default.nix
index 0b68609584d..f1358760696 100644
--- a/pkgs/development/ocaml-modules/ounit2/default.nix
+++ b/pkgs/development/ocaml-modules/ounit2/default.nix
@@ -1,19 +1,19 @@
-{ lib, ocaml, buildDunePackage, fetchurl, stdlib-shims, ncurses }:
+{ lib, ocaml, buildDunePackage, fetchurl, seq, stdlib-shims, ncurses }:
 
 buildDunePackage rec {
   minimumOCamlVersion = "4.04";
 
   pname = "ounit2";
-  version = "2.2.4";
+  version = "2.2.6";
 
   useDune2 = lib.versionAtLeast ocaml.version "4.08";
 
   src = fetchurl {
-    url = "https://github.com/gildor478/ounit/releases/download/v${version}/ounit-v${version}.tbz";
-    sha256 = "0i9kiqbf2dp12c4qcvbn4abdpdp6h4g5z54ycsh0q8jpv6jnkh5m";
+    url = "https://github.com/gildor478/ounit/releases/download/v${version}/ounit-${version}.tbz";
+    sha256 = "sha256-BpD7Hg6QoY7tXDVms8wYJdmLDox9UbtrhGyVxFphWRM=";
   };
 
-  propagatedBuildInputs = [ stdlib-shims ];
+  propagatedBuildInputs = [ seq stdlib-shims ];
 
   doCheck = true;
   checkInputs = lib.optional (lib.versionOlder ocaml.version "4.07") ncurses;
diff --git a/pkgs/development/ocaml-modules/stdint/default.nix b/pkgs/development/ocaml-modules/stdint/default.nix
index 2a4bf2bb633..cec0ec81830 100644
--- a/pkgs/development/ocaml-modules/stdint/default.nix
+++ b/pkgs/development/ocaml-modules/stdint/default.nix
@@ -1,26 +1,18 @@
-{ lib, fetchurl, fetchpatch, buildDunePackage, ocaml, qcheck }:
+{ lib, fetchurl, buildDunePackage, ocaml, qcheck }:
 
 buildDunePackage rec {
   pname = "stdint";
-  version = "0.7.0";
+  version = "0.7.2";
 
-  useDune2 = true;
+  duneVersion = "3";
 
-  minimumOCamlVersion = "4.03";
+  minimalOCamlVersion = "4.03";
 
   src = fetchurl {
     url = "https://github.com/andrenth/ocaml-stdint/releases/download/${version}/stdint-${version}.tbz";
-    sha256 = "4fcc66aef58e2b96e7af3bbca9d910aa239e045ba5fb2400aaef67d0041252dc";
+    sha256 = "sha256-FWAZjYvJx68+qVLEDavoJmZpQhDsw/35u/60MhHpd+Y=";
   };
 
-  patches = [
-    # fix test bug, remove at next release
-    (fetchpatch {
-      url = "https://github.com/andrenth/ocaml-stdint/commit/fc64293f99f597cdfd4470954da6fb323988e2af.patch";
-      sha256 = "0nxck14vfjfzldsf8cdj2jg1cvhnyh37hqnrcxbdkqmpx4rxkbxs";
-    })
-  ];
-
   # 1. disable remaining broken tests, see
   #    https://github.com/andrenth/ocaml-stdint/issues/59
   # 2. fix tests to liberal test range
@@ -30,9 +22,7 @@ buildDunePackage rec {
       --replace 'test "An integer should perform left-shifts correctly"' \
                 'skip "An integer should perform left-shifts correctly"' \
       --replace 'test "Logical shifts must not sign-extend"' \
-                'skip "Logical shifts must not sign-extend"' \
-      --replace 'let pos_int = QCheck.map_same_type abs in_range' \
-                'let pos_int = QCheck.int_range 0 maxi'
+                'skip "Logical shifts must not sign-extend"'
   '';
 
   doCheck = lib.versionAtLeast ocaml.version "4.08";
diff --git a/pkgs/development/python-modules/flask-restx/default.nix b/pkgs/development/python-modules/flask-restx/default.nix
index c1e81a1801e..6f7c83010eb 100644
--- a/pkgs/development/python-modules/flask-restx/default.nix
+++ b/pkgs/development/python-modules/flask-restx/default.nix
@@ -1,14 +1,13 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
+, pythonOlder
 , aniso8601
 , jsonschema
 , flask
 , werkzeug
 , pytz
 , faker
-, six
 , mock
 , blinker
 , pytest-flask
@@ -19,42 +18,24 @@
 
 buildPythonPackage rec {
   pname = "flask-restx";
-  version = "0.5.1";
+  version = "1.0.3";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   # Tests not included in PyPI tarball
   src = fetchFromGitHub {
     owner = "python-restx";
     repo = pname;
     rev = version;
-    sha256 = "18vrmknyxw6adn62pz3kr9kvazfgjgl4pgimdf8527fyyiwcqy15";
+    sha256 = "sha256-fodoGeVSNw4XZrVt907H20OJQIR8FlfINvEPWOkZQqI=";
   };
 
-  patches = [
-    # Fixes werkzeug 2.1 compatibility
-    (fetchpatch {
-      # https://github.com/python-restx/flask-restx/pull/427
-      url = "https://github.com/python-restx/flask-restx/commit/bb72a51860ea8a42c928f69bdd44ad20b1f9ee7e.patch";
-      hash = "sha256-DRH3lI6TV1m0Dq1VyscL7GQS26OOra9g88dXZNrNpmQ=";
-    })
-    (fetchpatch {
-      # https://github.com/python-restx/flask-restx/pull/427
-      url = "https://github.com/python-restx/flask-restx/commit/bb3e9dd83b9d4c0d0fa0de7d7ff713fae71eccee.patch";
-      hash = "sha256-HJpjG4aQWzEPCMfbXfkw4mz5TH9d89BCvGH2dE6Jfv0=";
-    })
-    # Fixes werkzeug 2.2 compatibility
-    (fetchpatch {
-      # https://github.com/python-restx/flask-restx/pull/463
-      url = "https://github.com/python-restx/flask-restx/commit/82f7340ebb51e5c143b804bc0f20f785e96968c0.patch";
-      hash = "sha256-GA+UlFDu771ul3qplsukce/mjGvJ3E4Dw/IoJQLevNU=";
-    })
-  ];
-
   propagatedBuildInputs = [
     aniso8601
     flask
     jsonschema
     pytz
-    six
     werkzeug
   ];
 
@@ -75,11 +56,13 @@ buildPythonPackage rec {
     "--deselect=tests/test_logging.py::LoggingTest::test_override_app_level"
   ];
 
-  pythonImportsCheck = [ "flask_restx" ];
+  pythonImportsCheck = [
+    "flask_restx"
+  ];
 
   meta = with lib; {
-    homepage = "https://flask-restx.readthedocs.io/en/${version}/";
     description = "Fully featured framework for fast, easy and documented API development with Flask";
+    homepage = "https://github.com/python-restx/flask-restx";
     changelog = "https://github.com/python-restx/flask-restx/raw/${version}/CHANGELOG.rst";
     license = licenses.bsd3;
     maintainers = [ maintainers.marsam ];
diff --git a/pkgs/development/python-modules/pdfminer-six/default.nix b/pkgs/development/python-modules/pdfminer-six/default.nix
index 3911794b89c..ec434b3dfbe 100644
--- a/pkgs/development/python-modules/pdfminer-six/default.nix
+++ b/pkgs/development/python-modules/pdfminer-six/default.nix
@@ -4,13 +4,16 @@
 , isPy3k
 , cryptography
 , charset-normalizer
+, pythonOlder
+, typing-extensions
 , pytestCheckHook
 , ocrmypdf
 }:
 
 buildPythonPackage rec {
   pname = "pdfminer-six";
-  version = "20220524";
+  version = "20221105";
+  format = "setuptools";
 
   disabled = !isPy3k;
 
@@ -18,10 +21,13 @@ buildPythonPackage rec {
     owner = "pdfminer";
     repo = "pdfminer.six";
     rev = version;
-    sha256 = "sha256-XO9sdHeS/8MgVW0mxbTe2AY5BDfnBSDNzZwLsSKmQh0=";
+    sha256 = "sha256-OyEeQBuYfj4iEcRt2/daSaUfTOjCVSCyHW2qffal+Bk=";
   };
 
-  propagatedBuildInputs = [ charset-normalizer cryptography ];
+  propagatedBuildInputs = [
+    charset-normalizer
+    cryptography
+  ] ++ lib.optionals (pythonOlder "3.8") [ typing-extensions ];
 
   postInstall = ''
     for file in $out/bin/*.py; do
@@ -30,14 +36,19 @@ buildPythonPackage rec {
   '';
 
   postPatch = ''
-    # Verion is not stored in repo, gets added by a GitHub action after tag is created
+    # Version is not stored in repo, gets added by a GitHub action after tag is created
     # https://github.com/pdfminer/pdfminer.six/pull/727
     substituteInPlace pdfminer/__init__.py --replace "__VERSION__" ${version}
   '';
 
-  pythonImportsCheck = [ "pdfminer" ];
+  pythonImportsCheck = [
+    "pdfminer"
+    "pdfminer.high_level"
+  ];
 
-  checkInputs = [ pytestCheckHook ];
+  checkInputs = [
+    pytestCheckHook
+  ];
 
   passthru = {
     tests = {
diff --git a/pkgs/development/python-modules/pdoc3/default.nix b/pkgs/development/python-modules/pdoc3/default.nix
index ea0f20f5a4a..740ce08af4e 100644
--- a/pkgs/development/python-modules/pdoc3/default.nix
+++ b/pkgs/development/python-modules/pdoc3/default.nix
@@ -17,7 +17,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "5f22e7bcb969006738e1aa4219c75a32f34c2d62d46dc9d2fb2d3e0b0287e4b7";
+    hash = "sha256-XyLnvLlpAGc44apCGcdaMvNMLWLUbcnS+y0+CwKH5Lc=";
   };
 
   patches = [
@@ -25,7 +25,14 @@ buildPythonPackage rec {
       # test_Class_params fails in 0.10.0
       # https://github.com/pdoc3/pdoc/issues/355
       url = "https://github.com/pdoc3/pdoc/commit/4aa70de2221a34a3003a7e5f52a9b91965f0e359.patch";
-      sha256 = "07sbf7bh09vgd5z1lbay604rz7rhg88414whs6iy60wwbvkz5c2v";
+      hash = "sha256-W7Dy516cA+Oj0ZCTQBB6MJ+fCTBeLRp+aW8nANdxSx8=";
+    })
+    # https://github.com/pdoc3/pdoc/issues/400
+    (fetchpatch {
+      name = "fix-test-for-python310.patch";
+      url = "https://github.com/pdoc3/pdoc/commit/80af5d40d3ca39e2701c44941c1003ae6a280799.patch";
+      hash = "sha256-69Cn+BY7feisSHugONIF/PRgEDEfnvnS/RBHWv1P8/w=";
+      excludes = [".github/workflows/ci.yml"];
     })
   ];
 
@@ -40,7 +47,6 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
-    broken = (stdenv.isLinux && stdenv.isAarch64) || stdenv.isDarwin;
     description = "Auto-generate API documentation for Python projects.";
     homepage = "https://pdoc3.github.io/pdoc/";
     license = with licenses; [ agpl3Plus ];
diff --git a/pkgs/development/tools/apksigner/default.nix b/pkgs/development/tools/apksigner/default.nix
index 854e913dd58..c2bbf65526c 100644
--- a/pkgs/development/tools/apksigner/default.nix
+++ b/pkgs/development/tools/apksigner/default.nix
@@ -87,6 +87,6 @@ stdenv.mkDerivation rec {
     homepage = "https://developer.android.com/studio/command-line/apksigner";
     license = licenses.asl20;
     maintainers = with maintainers; [ linsui ];
-    platforms = [ "x86_64-linux" ];
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/tools/continuous-integration/laminar/default.nix b/pkgs/development/tools/continuous-integration/laminar/default.nix
index fc0a77cdb66..f8472978311 100644
--- a/pkgs/development/tools/continuous-integration/laminar/default.nix
+++ b/pkgs/development/tools/continuous-integration/laminar/default.nix
@@ -38,6 +38,8 @@ in stdenv.mkDerivation rec {
   # We need both binary from "capnproto" and library files.
   nativeBuildInputs = [ cmake pandoc capnproto ];
   buildInputs = [ capnproto sqlite boost zlib rapidjson ];
+  cmakeFlags = [ "-DLAMINAR_VERSION=${version}" ];
+
   preBuild = ''
     mkdir -p js css
     cp  ${js.vue}         js/vue.min.js
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index bfcfa874add..a808338c987 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -2,61 +2,61 @@
     "4.14": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-4.14.296-hardened1.patch",
-            "sha256": "1shbnrzdl0zpyq1wpd610l5xf0j1nsnbgd6yg88gjacgd2hpx143",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.296-hardened1/linux-hardened-4.14.296-hardened1.patch"
+            "name": "linux-hardened-4.14.298-hardened1.patch",
+            "sha256": "1gzp5fxyv5s029s6c9zrnvj3wb02blabmdmcziaqvf6k7k178prs",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.298-hardened1/linux-hardened-4.14.298-hardened1.patch"
         },
-        "sha256": "1n4vngqbywwkqrq9fwp3lp4w6d3z588hbnzfngcp07z1ffrcvm9d",
-        "version": "4.14.296"
+        "sha256": "0w8f7m3mdj6gcxdvsvxw5hqqfhwffpfl794rgianl4r6iad8w7s6",
+        "version": "4.14.298"
     },
     "4.19": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-4.19.262-hardened1.patch",
-            "sha256": "117l4azj4j6jydrgrjs96xgab0g3ail4q75hkyqn85if7bjjnymk",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.262-hardened1/linux-hardened-4.19.262-hardened1.patch"
+            "name": "linux-hardened-4.19.264-hardened1.patch",
+            "sha256": "08swipghq66lx3nrww1319qwwgw3yipy5m4kvzpsz6mfhkm54aw9",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.264-hardened1/linux-hardened-4.19.264-hardened1.patch"
         },
-        "sha256": "07xnslqvmspqizng50yyprzrydwp0qdjmpsq2l1gjxr1lf3n8r5v",
-        "version": "4.19.262"
+        "sha256": "07ihf55y4xcbzpfgj9mxzchy1jmdpy46j32w15hac46a4504xcps",
+        "version": "4.19.264"
     },
     "5.10": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.10.152-hardened1.patch",
-            "sha256": "0j5zbmhf1lf9b4xy11h48rl7vcj7jk4bx8phwkk2bvvrapv05r3j",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.152-hardened1/linux-hardened-5.10.152-hardened1.patch"
+            "name": "linux-hardened-5.10.153-hardened1.patch",
+            "sha256": "02kw33m0j10dnl30n17ppffqh8l8v91jpz1d1pkqipfw3j40j8az",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.153-hardened1/linux-hardened-5.10.153-hardened1.patch"
         },
-        "sha256": "19nq2pgy4vmn30nywdvcvsx4vhmndrj97iiclpqakzgblj1mq2zs",
-        "version": "5.10.152"
+        "sha256": "0qhn5xv0m6baip1my1gp4mrjc4j6d6nbxa701vpwllg4kx8y9wiw",
+        "version": "5.10.153"
     },
     "5.15": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.15.76-hardened1.patch",
-            "sha256": "0wrrys0wbjczish6jp3mdcsrqph8bvid27cjfr6r7pvpzw9cwimi",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.76-hardened1/linux-hardened-5.15.76-hardened1.patch"
+            "name": "linux-hardened-5.15.77-hardened1.patch",
+            "sha256": "0pfa2xi64an716by3rqgn521a4igzb1y2bmbdn87icg8p79qavgx",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.77-hardened1/linux-hardened-5.15.77-hardened1.patch"
         },
-        "sha256": "0zymcp88654qk896djvc2ngdksvhkzh1ndhfk1dn5qqrqhha01wh",
-        "version": "5.15.76"
+        "sha256": "1yg9myqcv4kn2p7c9ap0z6xxh2qjsab2nbxf5z388skr6cgq8bql",
+        "version": "5.15.77"
     },
     "5.4": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.4.221-hardened1.patch",
-            "sha256": "19zp4pn8vbrgcnq1m9wck5ixs7247amwifngzb1630jniqhkrj0n",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.221-hardened1/linux-hardened-5.4.221-hardened1.patch"
+            "name": "linux-hardened-5.4.223-hardened1.patch",
+            "sha256": "1jsnrxv9a16l5gdhbn7w4rc9ql7arggvcizmkdvnk7ymd6ni6518",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.223-hardened1/linux-hardened-5.4.223-hardened1.patch"
         },
-        "sha256": "02nz9534998s922fdb0kpb09flgjmc7p78x0ypfxrd6pzv0pzcr7",
-        "version": "5.4.221"
+        "sha256": "1svyf4m5d3vrskylpal6npk5jj454rzij772wabg31v8vw97zw4y",
+        "version": "5.4.223"
     },
     "6.0": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.0.6-hardened1.patch",
-            "sha256": "1p6l1ysxclp10bl3sd5kvzrp29kdqddk6hvy8dxydni1kysvf2j8",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.0.6-hardened1/linux-hardened-6.0.6-hardened1.patch"
+            "name": "linux-hardened-6.0.7-hardened1.patch",
+            "sha256": "0y1g4zahlq28s8grzzpxcccr7sjh6cgbviz880g1wqg7vmqpi1fz",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.0.7-hardened1/linux-hardened-6.0.7-hardened1.patch"
         },
-        "sha256": "1akzfkwjbxki6r41gcnp5fml389i8ng9bid9c4ysg6w65nphajw6",
-        "version": "6.0.6"
+        "sha256": "03srfv33r2vc48h051zicvn9hz78kc08vh7ljzlmcnk0g0mwrnk7",
+        "version": "6.0.7"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index e94263de28e..97fd9d525f3 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "4.14.296";
+  version = "4.14.298";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1n4vngqbywwkqrq9fwp3lp4w6d3z588hbnzfngcp07z1ffrcvm9d";
+    sha256 = "0w8f7m3mdj6gcxdvsvxw5hqqfhwffpfl794rgianl4r6iad8w7s6";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix
index 7a4c0dff7ae..902be54d30e 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "4.19.262";
+  version = "4.19.264";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "07xnslqvmspqizng50yyprzrydwp0qdjmpsq2l1gjxr1lf3n8r5v";
+    sha256 = "07ihf55y4xcbzpfgj9mxzchy1jmdpy46j32w15hac46a4504xcps";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index f85b78a8f54..c58e05b485e 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,12 +1,12 @@
 { buildPackages, fetchurl, perl, buildLinux, nixosTests, stdenv, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.331";
+  version = "4.9.332";
   extraMeta.branch = "4.9";
   extraMeta.broken = stdenv.isAarch64;
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0v3vv02i9aqgx4g4kw0vpixxsms7w3s5fhry4wlqmsq0gkmqv3j8";
+    sha256 = "1kiqa9kw4932n5qglkyymsrak849wbbszw9rnq1aygmdinjz4c8i";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.10.nix b/pkgs/os-specific/linux/kernel/linux-5.10.nix
index b80fce4f2d1..b918ef7c35f 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.10.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.10.152";
+  version = "5.10.153";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "19nq2pgy4vmn30nywdvcvsx4vhmndrj97iiclpqakzgblj1mq2zs";
+    sha256 = "0qhn5xv0m6baip1my1gp4mrjc4j6d6nbxa701vpwllg4kx8y9wiw";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.15.nix b/pkgs/os-specific/linux/kernel/linux-5.15.nix
index a53e38fe388..8dd899d0bac 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.15.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.15.76";
+  version = "5.15.77";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0zymcp88654qk896djvc2ngdksvhkzh1ndhfk1dn5qqrqhha01wh";
+    sha256 = "1yg9myqcv4kn2p7c9ap0z6xxh2qjsab2nbxf5z388skr6cgq8bql";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.4.nix b/pkgs/os-specific/linux/kernel/linux-5.4.nix
index d1da73804f4..f617ba6f0e3 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.4.221";
+  version = "5.4.223";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "02nz9534998s922fdb0kpb09flgjmc7p78x0ypfxrd6pzv0pzcr7";
+    sha256 = "1svyf4m5d3vrskylpal6npk5jj454rzij772wabg31v8vw97zw4y";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-6.0.nix b/pkgs/os-specific/linux/kernel/linux-6.0.nix
index 5213856218d..0661da8d338 100644
--- a/pkgs/os-specific/linux/kernel/linux-6.0.nix
+++ b/pkgs/os-specific/linux/kernel/linux-6.0.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.0.6";
+  version = "6.0.7";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "1akzfkwjbxki6r41gcnp5fml389i8ng9bid9c4ysg6w65nphajw6";
+    sha256 = "03srfv33r2vc48h051zicvn9hz78kc08vh7ljzlmcnk0g0mwrnk7";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-libre.nix b/pkgs/os-specific/linux/kernel/linux-libre.nix
index 1814d4cee06..0a397d63936 100644
--- a/pkgs/os-specific/linux/kernel/linux-libre.nix
+++ b/pkgs/os-specific/linux/kernel/linux-libre.nix
@@ -1,8 +1,8 @@
 { stdenv, lib, fetchsvn, linux
 , scripts ? fetchsvn {
     url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/";
-    rev = "18950";
-    sha256 = "1k84mqvi71bmd7x0km980z1y7cm71fc6jvnf2rzhxss9pjscrh2j";
+    rev = "18978";
+    sha256 = "12mvj5c2k774fpmixcv7i4ciw7xqjaxqd20ryn8xw8vgrnb4h6fi";
   }
 , ...
 }:
diff --git a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
index 44746439ec2..2f6545c3d48 100644
--- a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -9,8 +9,8 @@ let
   };
 
   mainVariant = {
-    version = "6.0.6";
-    hash = "sha256-JMfAtiPDgoVF+ypeFXev06PL39ZM2H7m07IxpasjAoM=";
+    version = "6.0.7";
+    hash = "sha256-qeM2oswuop42rvyBGlrH6VvODScLCpAOjTc4KR5a2Ec=";
     variant = "main";
   };
 
diff --git a/pkgs/os-specific/linux/prl-tools/default.nix b/pkgs/os-specific/linux/prl-tools/default.nix
index 97c72750ebd..e3d70f04675 100644
--- a/pkgs/os-specific/linux/prl-tools/default.nix
+++ b/pkgs/os-specific/linux/prl-tools/default.nix
@@ -24,20 +24,16 @@
 assert (!libsOnly) -> kernel != null;
 
 stdenv.mkDerivation rec {
-  version = "18.0.3-53079";
+  version = "18.1.0-53311";
   pname = "prl-tools";
 
   # We download the full distribution to extract prl-tools-lin.iso from
   # => ${dmg}/Parallels\ Desktop.app/Contents/Resources/Tools/prl-tools-lin.iso
   src = fetchurl {
     url = "https://download.parallels.com/desktop/v${lib.versions.major version}/${version}/ParallelsDesktop-${version}.dmg";
-    sha256 = "sha256-z9B2nhcTSZr3L30fa54zYi6WnonQ2wezHoneT2tQWAc=";
+    sha256 = "sha256-2ROPFIDoV2/sMVsVhcSyn0m1QVMCNb399WzKd/cozws=";
   };
 
-  patches = lib.optionals (lib.versionAtLeast kernel.version "6.0") [
-    ./prl-tools-6.0.patch
-  ];
-
   hardeningDisable = [ "pic" "format" ];
 
   nativeBuildInputs = [ p7zip undmg perl bbe autoPatchelfHook ]
@@ -51,7 +47,7 @@ stdenv.mkDerivation rec {
   inherit libsOnly;
 
   unpackPhase = ''
-    undmg "${src}"
+    undmg $src
     export sourceRoot=prl-tools-build
     7z x "Parallels Desktop.app/Contents/Resources/Tools/prl-tools-lin${lib.optionalString stdenv.isAarch64 "-arm"}.iso" -o$sourceRoot
     if test -z "$libsOnly"; then
diff --git a/pkgs/os-specific/linux/prl-tools/prl-tools-6.0.patch b/pkgs/os-specific/linux/prl-tools/prl-tools-6.0.patch
deleted file mode 100644
index f0bd00d24e0..00000000000
--- a/pkgs/os-specific/linux/prl-tools/prl-tools-6.0.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/kmods/prl_fs_freeze/Snapshot/Guest/Linux/prl_freeze/prl_fs_freeze.c b/kmods/prl_fs_freeze/Snapshot/Guest/Linux/prl_freeze/prl_fs_freeze.c
-index baa8a19..6788791 100644
---- a/kmods/prl_fs_freeze/Snapshot/Guest/Linux/prl_freeze/prl_fs_freeze.c
-+++ b/kmods/prl_fs_freeze/Snapshot/Guest/Linux/prl_freeze/prl_fs_freeze.c
-@@ -306,7 +306,7 @@ int seq_show(struct seq_file *file, void *data)
- 	char buf[BDEVNAME_SIZE];
- 
- 	fsb = list_entry((struct list_head*)data, struct frozen_sb, list);
--	bdevname(fsb->sb->s_bdev, buf);
-+	snprintf(buf, sizeof(buf), "%pg", fsb->sb->s_bdev);
- 	seq_printf(file, "%s\n", buf);
- 	return 0;
- }
diff --git a/pkgs/servers/etebase/default.nix b/pkgs/servers/etebase/default.nix
index 1aab4a4591d..e84a3b45ce9 100644
--- a/pkgs/servers/etebase/default.nix
+++ b/pkgs/servers/etebase/default.nix
@@ -1,6 +1,7 @@
 { lib, fetchFromGitHub, buildPythonPackage, aiofiles, django_3
 , fastapi, msgpack, pynacl, redis, typing-extensions
-, withLdap ? true, python-ldap }:
+, withLdap ? true, python-ldap
+, withPostgres ? true, psycopg2 }:
 
 buildPythonPackage rec {
   pname = "etebase-server";
@@ -24,7 +25,8 @@ buildPythonPackage rec {
     pynacl
     redis
     typing-extensions
-  ] ++ lib.optional withLdap python-ldap;
+  ] ++ lib.optional withLdap python-ldap
+    ++ lib.optional withPostgres psycopg2;
 
   installPhase = ''
     mkdir -p $out/bin $out/lib
diff --git a/pkgs/servers/http/tomcat/default.nix b/pkgs/servers/http/tomcat/default.nix
index 8b0f814177a..eec573b72f6 100644
--- a/pkgs/servers/http/tomcat/default.nix
+++ b/pkgs/servers/http/tomcat/default.nix
@@ -32,13 +32,13 @@ let
 in {
   tomcat9 = common {
     versionMajor = "9";
-    versionMinor = "0.53";
-    sha256 = "1zdnbb0bfbi7762lz69li0wf48jbfz1mv637jzcl42vbsxp4agkv";
+    versionMinor = "0.68";
+    sha256 = "sha256-rxsv8zEIIbTel4CqIuncS5pellGwgHamKRa0KgzsOF0=";
   };
 
   tomcat10 = common {
     versionMajor = "10";
-    versionMinor = "0.11";
-    sha256 = "1hjvsxxxavni7bis1hm56281ffmf4x0zdh65zqkrnhqa1rbs0lg2";
+    versionMinor = "0.27";
+    sha256 = "sha256-N2atmOdhVrGx88eXOc9Wziq8kn7IWzTeFyFpir/5HLc=";
   };
 }
diff --git a/pkgs/servers/monitoring/grafana/default.nix b/pkgs/servers/monitoring/grafana/default.nix
index 7be5999aa34..23558f7f760 100644
--- a/pkgs/servers/monitoring/grafana/default.nix
+++ b/pkgs/servers/monitoring/grafana/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "grafana";
-  version = "9.2.2";
+  version = "9.2.3";
 
   excludedPackages = [ "alert_webhook_listener" "clean-swagger" "release_publisher" "slow_proxy" "slow_proxy_mac" "macaron" "devenv" ];
 
@@ -10,15 +10,15 @@ buildGoModule rec {
     rev = "v${version}";
     owner = "grafana";
     repo = "grafana";
-    sha256 = "sha256-oXtEAhyCwV9DQfrun9rTPTeTCuzMv2l0sVyi2+pOASw=";
+    sha256 = "sha256-aqCGFgrODOdSJtvYDTygHsPhi5ON4fkpmFSnPZgR26U=";
   };
 
   srcStatic = fetchurl {
     url = "https://dl.grafana.com/oss/release/grafana-${version}.linux-amd64.tar.gz";
-    sha256 = "sha256-trbc2iNDhBa72J15wPZKIlNJHbQUzE6cz/0TmivXJxE=";
+    sha256 = "sha256-m2pgRXxaXLRRl5iwfPuLqHEsxhuaCfSFCKSAKAYk9J8=";
   };
 
-  vendorSha256 = "sha256-021b+Jdk1VUGNSVNef89KLbWLdy4XhhEry4S2S0AhRg=";
+  vendorSha256 = "sha256-2DO0eAKSJzavOKKHIl3beQhBhuARm7ccwwDODPByL4Y=";
 
   nativeBuildInputs = [ wire ];
 
diff --git a/pkgs/servers/sabnzbd/default.nix b/pkgs/servers/sabnzbd/default.nix
index 4f320ff2c3a..03d754eca73 100644
--- a/pkgs/servers/sabnzbd/default.nix
+++ b/pkgs/servers/sabnzbd/default.nix
@@ -24,14 +24,14 @@ let
   ]);
   path = lib.makeBinPath [ par2cmdline unrar unzip p7zip ];
 in stdenv.mkDerivation rec {
-  version = "3.6.1";
+  version = "3.7.0";
   pname = "sabnzbd";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "sha256-xaryCwIJ3705T7znnJKQOfC87ceh8D4e00JCY6e/CI0=";
+    sha256 = "sha256-ngsNDxK3J8acrVqxtEnfoqEOhNsQemOcuaf3ru3eQMw=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/backup/duplicacy/default.nix b/pkgs/tools/backup/duplicacy/default.nix
index 9fecfb70f39..ea6a1ffa88e 100644
--- a/pkgs/tools/backup/duplicacy/default.nix
+++ b/pkgs/tools/backup/duplicacy/default.nix
@@ -1,32 +1,25 @@
-{ lib, buildGoPackage, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "duplicacy";
-  version = "2.7.2";
-
-  goPackagePath = "github.com/gilbertchen/duplicacy";
+  version = "3.0.1";
 
   src = fetchFromGitHub {
     owner = "gilbertchen";
     repo = "duplicacy";
     rev = "v${version}";
-    sha256 = "0j37sqicj7rl982czqsl3ipxw7k8k4smcr63s0yklxwz7ch3353c";
+    sha256 = "sha256-7VCgXUmmAlmv0UwSM3Hs9t586gJWvFWsP/0BJXze1r4=";
   };
-  goDeps = ./deps.nix;
-  buildPhase = ''
-    cd go/src/${goPackagePath}
-    go build duplicacy/duplicacy_main.go
-  '';
 
-  installPhase = ''
-    install -D duplicacy_main $out/bin/duplicacy
-  '';
+  vendorSha256 = "sha256-3vzx2SCgJAhSwW8DRtkQ6pywquFwwou0HZ6a1dmHhPY=";
+
+  doCheck = false;
 
   meta = with lib; {
     homepage = "https://duplicacy.com";
     description = "A new generation cloud backup tool";
     platforms = platforms.linux ++ platforms.darwin;
     license = lib.licenses.unfree;
-    maintainers = with maintainers; [ ffinkdevs ];
+    maintainers = with maintainers; [ ffinkdevs devusb ];
   };
 }
diff --git a/pkgs/tools/backup/duplicacy/deps.nix b/pkgs/tools/backup/duplicacy/deps.nix
deleted file mode 100644
index 83d69d398cb..00000000000
--- a/pkgs/tools/backup/duplicacy/deps.nix
+++ /dev/null
@@ -1,408 +0,0 @@
-# file generated from Gopkg.lock using dep2nix (https://github.com/nixcloud/dep2nix)
-[
-  {
-    goPackagePath  = "cloud.google.com/go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/googleapis/google-cloud-go";
-      rev =  "2d3a6656c17a60b0815b7e06ab0be04eacb6e613";
-      sha256 = "0fi3qj9fvc4bxbrwa1m5sxsb8yhvawiwigaddvmmizjykxbq5csq";
-    };
-  }
-  {
-    goPackagePath  = "github.com/Azure/go-autorest";
-    fetch = {
-      type = "git";
-      url = "https://github.com/Azure/go-autorest";
-      rev =  "9bc4033dd347c7f416fca46b2f42a043dc1fbdf6";
-      sha256 = "158xbd8wn1bna1k1ichlirz6a1zvlh3rg7klr9cnp72l2q8jwvcl";
-    };
-  }
-  {
-    goPackagePath  = "github.com/aryann/difflib";
-    fetch = {
-      type = "git";
-      url = "https://github.com/aryann/difflib";
-      rev =  "e206f873d14a916d3d26c40ab667bca123f365a3";
-      sha256 = "00zb9sx6l6b2zq614x45zlyshl20zjhwfj8r5krw4f9y0mx3n2dm";
-    };
-  }
-  {
-    goPackagePath  = "github.com/aws/aws-sdk-go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/aws/aws-sdk-go";
-      rev =  "851d5ffb66720c2540cc68020d4d8708950686c8";
-      sha256 = "16qp8ywcf04d2y1ibf3mpglcrxk07x8gak46a2l53lchps2mgcrp";
-    };
-  }
-  {
-    goPackagePath  = "github.com/bkaradzic/go-lz4";
-    fetch = {
-      type = "git";
-      url = "https://github.com/bkaradzic/go-lz4";
-      rev =  "74ddf82598bc4745b965729e9c6a463bedd33049";
-      sha256 = "1vdid8v0c2v2qhrg9rzn3l7ya1h34jirrxfnir7gv7w6s4ivdvc1";
-    };
-  }
-  {
-    goPackagePath  = "github.com/dgrijalva/jwt-go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/dgrijalva/jwt-go";
-      rev =  "06ea1031745cb8b3dab3f6a236daf2b0aa468b7e";
-      sha256 = "08m27vlms74pfy5z79w67f9lk9zkx6a9jd68k3c4msxy75ry36mp";
-    };
-  }
-  {
-    goPackagePath  = "github.com/gilbertchen/azure-sdk-for-go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gilbertchen/azure-sdk-for-go";
-      rev =  "8fd4663cab7c7c1c46d00449291c92ad23b0d0d9";
-      sha256 = "123fj5jni1pjj8i9adzd4r07n9hnlmfprlcjf5hqb1zjb72xi1p7";
-    };
-  }
-  {
-    goPackagePath  = "github.com/gilbertchen/cli";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gilbertchen/cli";
-      rev =  "1de0a1836ce9c3ae1bf737a0869c4f04f28a7f98";
-      sha256 = "00vbyjsn009cqg24sxcizq10rgicnmrv0f8jg3fa1fw6yp5gqdl5";
-    };
-  }
-  {
-    goPackagePath  = "github.com/gilbertchen/go-dropbox";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gilbertchen/go-dropbox";
-      rev =  "2233fa1dd846b3a3e8060b6c1ea12883deb9d288";
-      sha256 = "01fqxad5mm7rs0mp1ipp9aw80ski6sqyqljpf9dgify8dbiffl97";
-    };
-  }
-  {
-    goPackagePath  = "github.com/gilbertchen/go-ole";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gilbertchen/go-ole";
-      rev =  "0e87ea779d9deb219633b828a023b32e1244dd57";
-      sha256 = "1d937b4i9mrwfgs1s17qhbd78dcd97wwm8zsajkarky8d55rz1bw";
-    };
-  }
-  {
-    goPackagePath  = "github.com/gilbertchen/go.dbus";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gilbertchen/go.dbus";
-      rev =  "8591994fa32f1dbe3fa9486bc6f4d4361ac16649";
-      sha256 = "0wg82hwgk4s65ns76x7cby6dfdxsdkc4jyqn9zd7g037fhzh8rk5";
-    };
-  }
-  {
-    goPackagePath  = "github.com/gilbertchen/goamz";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gilbertchen/goamz";
-      rev =  "eada9f4e8cc2a45db775dee08a2c37597ce4760a";
-      sha256 = "0v6i4jdly06wixmm58ygxh284hnlbfxczvcwxvywiyy9bp5qyaid";
-    };
-  }
-  {
-    goPackagePath  = "github.com/gilbertchen/gopass";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gilbertchen/gopass";
-      rev =  "bf9dde6d0d2c004a008c27aaee91170c786f6db8";
-      sha256 = "1jxzyfnqi0h1fzlsvlkn10bncic803bfhslyijcxk55mgh297g45";
-    };
-  }
-  {
-    goPackagePath  = "github.com/gilbertchen/keyring";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gilbertchen/keyring";
-      rev =  "8855f5632086e51468cd7ce91056f8da69687ef6";
-      sha256 = "1ja623dqnhkr1cvynrcai10s8kn2aiq53cvd8yxr47bb8i2a2q1m";
-    };
-  }
-  {
-    goPackagePath  = "github.com/gilbertchen/xattr";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gilbertchen/xattr";
-      rev =  "68e7a6806b0137a396d7d05601d7403ae1abac58";
-      sha256 = "120lq8vasc5yh0ajczsdpi8cfzgi4ymrnphgqdfcar3b9rsvx80b";
-    };
-  }
-  {
-    goPackagePath  = "github.com/golang/groupcache";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/groupcache";
-      rev =  "8c9f03a8e57eb486e42badaed3fb287da51807ba";
-      sha256 = "0vjjr79r32icjzlb05wn02k59av7jx0rn1jijml8r4whlg7dnkfh";
-    };
-  }
-  {
-    goPackagePath  = "github.com/golang/protobuf";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/protobuf";
-      rev =  "84668698ea25b64748563aa20726db66a6b8d299";
-      sha256 = "1gkd1942vk9n8kfzdwy1iil6wgvlwjq7a3y5jc49ck4lz9rhmgkq";
-    };
-  }
-  {
-    goPackagePath  = "github.com/googleapis/gax-go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/googleapis/gax-go";
-      rev =  "c8a15bac9b9fe955bd9f900272f9a306465d28cf";
-      sha256 = "13x3x7agq0b46wpchbd2sqli5l33z6hvfn1qjbiqvsgpbv7wd140";
-    };
-  }
-  {
-    goPackagePath  = "github.com/jmespath/go-jmespath";
-    fetch = {
-      type = "git";
-      url = "https://github.com/jmespath/go-jmespath";
-      rev =  "c2b33e84";
-      sha256 = "1r6w7ydx8ydryxk3sfhzsk8m6f1nsik9jg3i1zhi69v4kfl4d5cz";
-    };
-  }
-  {
-    goPackagePath  = "github.com/klauspost/cpuid";
-    fetch = {
-      type = "git";
-      url = "https://github.com/klauspost/cpuid";
-      rev =  "750c0591dbbd50ef88371c665ad49e426a4b830b";
-      sha256 = "1yiby4xa12j3kcw5q7dfsbcybhaxjkppvgz6ac2p2lcwha303b1g";
-    };
-  }
-  {
-    goPackagePath  = "github.com/klauspost/reedsolomon";
-    fetch = {
-      type = "git";
-      url = "https://github.com/klauspost/reedsolomon";
-      rev =  "7daa20bf74337a939c54f892a2eca9d9b578eb7f";
-      sha256 = "1xk4wqgrl63l95lqnszzbpa06apzxfmpwfnkrn1n8jb0ws7mi01m";
-    };
-  }
-  {
-    goPackagePath  = "github.com/kr/fs";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kr/fs";
-      rev =  "1455def202f6e05b95cc7bfc7e8ae67ae5141eba";
-      sha256 = "11zg176x9hr9q7fsk95r6q0wf214gg4czy02slax4x56n79g6a7q";
-    };
-  }
-  {
-    goPackagePath  = "github.com/marstr/guid";
-    fetch = {
-      type = "git";
-      url = "https://github.com/marstr/guid";
-      rev =  "8bd9a64bf37eb297b492a4101fb28e80ac0b290f";
-      sha256 = "081qrar6wwpmb2pq3swv4byh73r9riyhl2dwv0902d8jg3kwricm";
-    };
-  }
-  {
-    goPackagePath  = "github.com/minio/blake2b-simd";
-    fetch = {
-      type = "git";
-      url = "https://github.com/minio/blake2b-simd";
-      rev =  "3f5f724cb5b182a5c278d6d3d55b40e7f8c2efb4";
-      sha256 = "0b6jbnj62c0gmmfd4zdmh8xbg01p80f13yygir9xprqkzk6fikmd";
-    };
-  }
-  {
-    goPackagePath  = "github.com/minio/highwayhash";
-    fetch = {
-      type = "git";
-      url = "https://github.com/minio/highwayhash";
-      rev =  "86a2a969d04373bf05ca722517d30fb1c9a3e4f9";
-      sha256 = "0kj2hs82sphag0h25xvprvf2fz3zlinmlif89sk9jp8h518aiahf";
-    };
-  }
-  {
-    goPackagePath  = "github.com/mmcloughlin/avo";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mmcloughlin/avo";
-      rev =  "443f81d771042b019379ae4bfcd0a591cb47c88a";
-      sha256 = "1zc95crbyi7ylqq3jwv4ya55lyzn9x730szdm307vdss4gqlx8yn";
-    };
-  }
-  {
-    goPackagePath  = "github.com/ncw/swift";
-    fetch = {
-      type = "git";
-      url = "https://github.com/ncw/swift";
-      rev =  "3e1a09f21340e4828e7265aa89f4dc1495fa7ccc";
-      sha256 = "19gb8xh400hzlbdp3nx1f85jxzs36zk0py39vmjcg3fnvdjzblm2";
-    };
-  }
-  {
-    goPackagePath  = "github.com/pkg/errors";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pkg/errors";
-      rev =  "614d223910a179a466c1767a985424175c39b465";
-      sha256 = "1761pybhc2kqr6v5fm8faj08x9bql8427yqg6vnfv6nhrasx1mwq";
-    };
-  }
-  {
-    goPackagePath  = "github.com/pkg/sftp";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pkg/sftp";
-      rev =  "5616182052227b951e76d9c9b79a616c608bd91b";
-      sha256 = "1rjlhlkr505a0wvync1ycfn9njfc6bib6bw44qnnm50hlfs59hz2";
-    };
-  }
-  {
-    goPackagePath  = "github.com/pkg/xattr";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pkg/xattr";
-      rev =  "dd870b5cfebab49617ea0c1da6176474e8a52bf4";
-      sha256 = "11ynkc61qrmf853g04sav8vawz8i6a8b73w71f3cq4djb4cnsw0d";
-    };
-  }
-  {
-    goPackagePath  = "github.com/satori/go.uuid";
-    fetch = {
-      type = "git";
-      url = "https://github.com/satori/go.uuid";
-      rev =  "f58768cc1a7a7e77a3bd49e98cdd21419399b6a3";
-      sha256 = "1j4s5pfg2ldm35y8ls8jah4dya2grfnx2drb4jcbjsyrp4cm5yfb";
-    };
-  }
-  {
-    goPackagePath  = "github.com/vaughan0/go-ini";
-    fetch = {
-      type = "git";
-      url = "https://github.com/vaughan0/go-ini";
-      rev =  "a98ad7ee00ec53921f08832bc06ecf7fd600e6a1";
-      sha256 = "1l1isi3czis009d9k5awsj4xdxgbxn4n9yqjc1ac7f724x6jacfa";
-    };
-  }
-  {
-    goPackagePath  = "go.opencensus.io";
-    fetch = {
-      type = "git";
-      url = "https://github.com/census-instrumentation/opencensus-go";
-      rev =  "d835ff86be02193d324330acdb7d65546b05f814";
-      sha256 = "0xj16iq5jp26hi2py7lsd8cvqh651fgn39y05gzvjdi88d9xd3nw";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/crypto";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/crypto";
-      rev =  "056763e48d71961566155f089ac0f02f1dda9b5a";
-      sha256 = "0dcmns62hwid7hk4bmpl22z6ygjh168p23x3arzy320sd1lvap92";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/mod";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/mod";
-      rev =  "859b3ef565e237f9f1a0fb6b55385c497545680d";
-      sha256 = "0ldgbx2zpprbsfn6p8pfgs4nn87gwbfcv2z0fa7n8alwsq2yw78q";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/net";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/net";
-      rev =  "d3edc9973b7eb1fb302b0ff2c62357091cea9a30";
-      sha256 = "12zbjwcsh9b0lwycqlkrnbyg5a6a9dzgj8hhgq399bdda5bd97y7";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/oauth2";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/oauth2";
-      rev =  "bf48bf16ab8d622ce64ec6ce98d2c98f916b6303";
-      sha256 = "1sirdib60zwmh93kf9qrx51r8544k1p9rs5mk0797wibz3m4mrdg";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/sys";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/sys";
-      rev =  "59c9f1ba88faf592b225274f69c5ef1e4ebacf82";
-      sha256 = "014iiqjh9sikbcvacqiwhg6mvrsrr1va91wmc9yrnsm11c63yxfa";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/text";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/text";
-      rev =  "342b2e1fbaa52c93f31447ad2c6abc048c63e475";
-      sha256 = "0flv9idw0jm5nm8lx25xqanbkqgfiym6619w575p7nrdh0riqwqh";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/tools";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/tools";
-      rev =  "5d1fdd8fa3469142b9369713b23d8413d6d83189";
-      sha256 = "0xp5ggnjnl1gqwi2ks042zimgkfv2qda9a57ar198xpyzdn1bv5s";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/xerrors";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/xerrors";
-      rev =  "5ec99f83aff198f5fbd629d6c8d8eb38a04218ca";
-      sha256 = "1dbzc3gmf2haazpv7cgmv97rq40g2xzwbglc17vas8dwhgwgwrzb";
-    };
-  }
-  {
-    goPackagePath  = "google.golang.org/api";
-    fetch = {
-      type = "git";
-      url = "https://github.com/googleapis/google-api-go-client";
-      rev =  "52f0532eadbcc6f6b82d6f5edf66e610d10bfde6";
-      sha256 = "0l7q0mmq0v51wc72bk50nwaz9frl1pqp7gn5jhy1vzxdry930gkc";
-    };
-  }
-  {
-    goPackagePath  = "google.golang.org/appengine";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/appengine";
-      rev =  "971852bfffca25b069c31162ae8f247a3dba083b";
-      sha256 = "05hbq4cs7bqw0zl17bx8rzdkszid3nyl92100scg3jjrg70dhm7w";
-    };
-  }
-  {
-    goPackagePath  = "google.golang.org/genproto";
-    fetch = {
-      type = "git";
-      url = "https://github.com/googleapis/go-genproto";
-      rev =  "baae70f3302d3efdff74db41e48a5d476d036906";
-      sha256 = "1xacik4i5w2bpkrxzrfm00ggy5vygbzh8jmm2yq4mxiv0lnsh9nk";
-    };
-  }
-  {
-    goPackagePath  = "google.golang.org/grpc";
-    fetch = {
-      type = "git";
-      url = "https://github.com/grpc/grpc-go";
-      rev =  "ac54eec90516cee50fc6b9b113b34628a85f976f";
-      sha256 = "17zfx4xgqjamk7rc1sivm5gppkh3j4qp3i294w9rqbv0rqi0c9pq";
-    };
-  }
-]
diff --git a/pkgs/tools/graphics/timg/default.nix b/pkgs/tools/graphics/timg/default.nix
index 136b5a24151..a8d808bb637 100644
--- a/pkgs/tools/graphics/timg/default.nix
+++ b/pkgs/tools/graphics/timg/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, graphicsmagick, libjpeg
+{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake, pkg-config, graphicsmagick, libjpeg
 , ffmpeg, zlib, libexif, openslide }:
 
 stdenv.mkDerivation rec {
@@ -12,6 +12,14 @@ stdenv.mkDerivation rec {
     sha256 = "1gdwg15fywya6k6pajkx86kv2d8k85pmisnq53b02br5i01y4k41";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/hzeller/timg/commit/e9667ea2c811aa9eb399b631aef9bba0d3711834.patch";
+      sha256 = "sha256-xvbOcnKqX52wYZlzm4Be9dz8Rq+n3s2kKPFr0Y0igAU=";
+      name = "CVE-2022-43151.patch";
+    })
+  ];
+
   buildInputs = [ graphicsmagick ffmpeg libexif libjpeg openslide zlib ];
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/tools/graphics/wallutils/default.nix b/pkgs/tools/graphics/wallutils/default.nix
index 8ab6bba1ef1..67c325eb26a 100644
--- a/pkgs/tools/graphics/wallutils/default.nix
+++ b/pkgs/tools/graphics/wallutils/default.nix
@@ -1,35 +1,56 @@
-{ buildGoPackage, fetchFromGitHub, lib
+{ lib
+, buildGoModule
+, fetchFromGitHub
 , pkg-config
-, wayland, libX11, xbitmaps, libXcursor, libXmu, libXpm, libheif
+, wayland
+, libX11
+, xbitmaps
+, libXcursor
+, libXmu
+, libXpm
+, libheif
 }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "wallutils";
-  version = "5.11.1";
+  version = "5.12.4";
 
   src = fetchFromGitHub {
     owner = "xyproto";
     repo = "wallutils";
     rev = version;
-    sha256 = "sha256-FL66HALXsf7shoUKIZp6HORyuxhOfgTrY+PQAe92yk8=";
+    sha256 = "sha256-NODG4Lw/7X1aoT+dDSWxWEbDX6EAQzzDJPwsWOLaJEM=";
   };
 
-  goPackagePath = "github.com/xyproto/wallutils";
+  vendorSha256 = null;
 
   patches = [ ./lscollection-Add-NixOS-paths-to-DefaultWallpaperDirectories.patch ];
 
-  postPatch = ''
-    # VersionString is sometimes not up-to-date:
-    sed -iE 's/VersionString = "[0-9].[0-9].[0-9]"/VersionString = "${version}"/' wallutils.go
-  '';
+  excludedPackages = [
+    "./pkg/event/cmd" # Development tools
+  ];
+
+  ldflags = [ "-s" "-w" ];
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ wayland libX11 xbitmaps libXcursor libXmu libXpm libheif ];
 
+  preCheck =
+    let skippedTests = [
+      "TestClosest" # Requiring Wayland or X.
+      "TestNewSimpleEvent" # Blocking
+      "TestEveryMinute" # Blocking
+    ]; in
+    ''
+      export XDG_RUNTIME_DIR=`mktemp -d`
+
+      buildFlagsArray+=("-run" "[^(${builtins.concatStringsSep "|" skippedTests})]")
+    '';
+
   meta = with lib; {
     description = "Utilities for handling monitors, resolutions, and (timed) wallpapers";
     inherit (src.meta) homepage;
-    license = licenses.mit;
+    license = licenses.bsd3;
     maintainers = with maintainers; [ ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/tools/networking/httping/default.nix b/pkgs/tools/networking/httping/default.nix
index 77f2b52890e..195f739aa5a 100644
--- a/pkgs/tools/networking/httping/default.nix
+++ b/pkgs/tools/networking/httping/default.nix
@@ -1,26 +1,34 @@
-{ lib, stdenv, fetchurl, fetchpatch, gettext, libintl, ncurses, openssl
-, fftw ? null }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, fftw ? null
+, gettext
+, libintl
+, ncurses
+, openssl
+}:
 
 stdenv.mkDerivation rec {
   pname = "httping";
-  version = "2.5";
+  version = "2.9";
 
-  src = fetchurl {
-    url = "https://vanheusden.com/httping/${pname}-${version}.tgz";
-    sha256 = "1y7sbgkhgadmd93x1zafqc4yp26ssiv16ni5bbi9vmvvdl55m29y";
+  src = fetchFromGitHub {
+    owner = "folkertvanheusden";
+    repo = "HTTPing";
+    rev = "v${version}";
+    hash = "sha256-aExTXXtW03UKMuMjTMx1k/MUpcRMh1PdSPkDGH+Od70=";
   };
 
-  patches = [
-    # Upstream fix for ncurses-6.3.
-    (fetchpatch {
-      name = "ncurses-6.3.patch";
-      url = "https://github.com/folkertvanheusden/HTTPing/commit/4ea9d5b78540c972e3fe1bf44db9f7b3f87c0ad0.patch";
-      sha256 = "0w3kdkq6c6hz1d9jjnw0ldvd6dy39yamj8haf0hvcyb1sb67qjmp";
-    })
+  nativeBuildInputs = [
+    gettext
   ];
 
-  buildInputs = [ fftw libintl ncurses openssl ];
-  nativeBuildInputs = [ gettext ];
+  buildInputs = [
+    fftw
+    libintl
+    ncurses
+    openssl
+  ];
 
   makeFlags = [
     "DESTDIR=$(out)"
@@ -36,7 +44,7 @@ stdenv.mkDerivation rec {
       the transmission across the network also takes time! So it measures the
       latency of the webserver + network. It supports IPv6.
     '';
-    license = licenses.agpl3;
+    license = licenses.agpl3Only;
     maintainers = [];
     platforms = platforms.linux ++ platforms.darwin;
   };
diff --git a/pkgs/tools/security/b2sum/default.nix b/pkgs/tools/security/b2sum/default.nix
index e5de613bee7..c915361ff20 100644
--- a/pkgs/tools/security/b2sum/default.nix
+++ b/pkgs/tools/security/b2sum/default.nix
@@ -13,6 +13,13 @@ stdenv.mkDerivation {
     sha256 = "E60M9oP/Sdfg/L3ZxUcDtUXhFz9oP72IybdtVUJh9Sk=";
   };
 
+  # Use the generic C implementation rather than the SSE optimised version on non-x86 platforms
+  postPatch = lib.optionalString (!stdenv.hostPlatform.isx86) ''
+    substituteInPlace makefile \
+      --replace "#FILES=b2sum.c ../ref/" "FILES=b2sum.c ../ref/" \
+      --replace "FILES=b2sum.c ../sse/" "#FILES=b2sum.c ../sse/"
+  '';
+
   sourceRoot = "source/b2sum";
 
   buildInputs = [ openmp ];
@@ -25,7 +32,6 @@ stdenv.mkDerivation {
     homepage = "https://blake2.net";
     license = with licenses; [ asl20 cc0 openssl ];
     maintainers = with maintainers; [ kirelagin ];
-    # "This code requires at least SSE2."
-    platforms = [ "x86_64-linux" "i686-linux" ] ++ platforms.darwin;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/tools/virtualization/google-guest-agent/default.nix b/pkgs/tools/virtualization/google-guest-agent/default.nix
index 0f42441b7cd..f007057222f 100644
--- a/pkgs/tools/virtualization/google-guest-agent/default.nix
+++ b/pkgs/tools/virtualization/google-guest-agent/default.nix
@@ -4,13 +4,13 @@
 
 buildGoModule rec {
   pname = "guest-agent";
-  version = "20221025.00";
+  version = "20221104.00";
 
   src = fetchFromGitHub {
     owner = "GoogleCloudPlatform";
     repo = pname;
     rev = version;
-    sha256 = "sha256-LbpSRQgxAfgaO7UPJD5j/wrMjR383qjD5SD1cVTzWLs=";
+    sha256 = "sha256-JvI0tj6/+iCu+Q5XB3QOrrfBl6n2/bB6pj9lUDZL8DE=";
   };
 
   vendorSha256 = "sha256-JZfplQGwe+UCzdMLMD+9JJ2ksK9dZ6scz2jl0XoZ9rI=";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 3e880dc4df6..9c788a2e257 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -33177,7 +33177,9 @@ with pkgs;
 
   xmenu = callPackage ../applications/misc/xmenu { };
 
-  xmlcopyeditor = callPackage ../applications/editors/xmlcopyeditor { };
+  xmlcopyeditor = callPackage ../applications/editors/xmlcopyeditor {
+    inherit (darwin.apple_sdk.frameworks) Cocoa;
+  };
 
   xmp = callPackage ../applications/audio/xmp { };