diff --git a/nixos/modules/installer/cd-dvd/installation-cd-graphical-base.nix b/nixos/modules/installer/cd-dvd/installation-cd-graphical-base.nix
index 0e4feba2282..8c7bac6f6cc 100644
--- a/nixos/modules/installer/cd-dvd/installation-cd-graphical-base.nix
+++ b/nixos/modules/installer/cd-dvd/installation-cd-graphical-base.nix
@@ -35,8 +35,15 @@ with lib;
   # Enable sound in graphical iso's.
   hardware.pulseaudio.enable = true;
 
-  # Spice guest additions
+  # VM guest additions to improve host-guest interaction
   services.spice-vdagentd.enable = true;
+  services.qemuGuest.enable = true;
+  virtualisation.vmware.guest.enable = true;
+  virtualisation.hypervGuest.enable = true;
+  services.xe-guest-utilities.enable = true;
+  # The VirtualBox guest additions rely on an out-of-tree kernel module
+  # which lags behind kernel releases, potentially causing broken builds.
+  virtualisation.virtualbox.guest.enable = false;
 
   # Enable plymouth
   boot.plymouth.enable = true;
diff --git a/nixos/modules/services/networking/frr.nix b/nixos/modules/services/networking/frr.nix
index 45a82b9450a..98452123f03 100644
--- a/nixos/modules/services/networking/frr.nix
+++ b/nixos/modules/services/networking/frr.nix
@@ -106,6 +106,14 @@ let
           TCP Port to bind to for the VTY interface.
         '';
       };
+
+      extraOptions = mkOption {
+        type = types.listOf types.str;
+        default = [];
+        description = ''
+          Extra options for the daemon.
+        '';
+      };
     };
 
 in
@@ -196,7 +204,8 @@ in
                 PIDFile = "frr/${daemon}.pid";
                 ExecStart = "${pkgs.frr}/libexec/frr/${daemon} -f /etc/frr/${service}.conf"
                   + optionalString (scfg.vtyListenAddress != "") " -A ${scfg.vtyListenAddress}"
-                  + optionalString (scfg.vtyListenPort != null) " -P ${toString scfg.vtyListenPort}";
+                  + optionalString (scfg.vtyListenPort != null) " -P ${toString scfg.vtyListenPort}"
+                  + " " + (concatStringsSep " " scfg.extraOptions);
                 ExecReload = "${pkgs.python3.interpreter} ${pkgs.frr}/libexec/frr/frr-reload.py --reload --daemon ${daemonName service} --bindir ${pkgs.frr}/bin --rundir /run/frr /etc/frr/${service}.conf";
                 Restart = "on-abnormal";
               };
diff --git a/pkgs/applications/audio/dirt/default.nix b/pkgs/applications/audio/dirt/default.nix
index a456d62e6f6..9d9c5c869f7 100644
--- a/pkgs/applications/audio/dirt/default.nix
+++ b/pkgs/applications/audio/dirt/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, libsndfile, libsamplerate, liblo, libjack2 }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, libsndfile, libsamplerate, liblo, libjack2 }:
 
 stdenv.mkDerivation {
   pname = "dirt";
@@ -10,6 +10,15 @@ stdenv.mkDerivation {
     sha256 = "13adglk2d31d7mswfvi02b0rjdhzmsv11cc8smhidmrns3f9s96n";
     fetchSubmodules = true;
   };
+  patches = [
+    # Pull patch pending upstream inclusion for upstream gcc-10 support:
+    #  https://github.com/tidalcycles/Dirt/pull/65
+    (fetchpatch {
+      name = "fno-common.patch";
+      url = "https://github.com/tidalcycles/Dirt/commit/43fd267745d486228c4185b4fcbd7d9fbc362cc2.patch";
+      sha256 = "08r34ylzs31wwf0la995pb149ccq0vr7qg4792pkhca57zi0bff8";
+    })
+  ];
   buildInputs = [ libsndfile libsamplerate liblo libjack2 ];
   postPatch = ''
     sed -i "s|./samples|$out/share/dirt/samples|" dirt.c
diff --git a/pkgs/applications/audio/ecasound/default.nix b/pkgs/applications/audio/ecasound/default.nix
index 108be8726c5..f23b11d1a67 100644
--- a/pkgs/applications/audio/ecasound/default.nix
+++ b/pkgs/applications/audio/ecasound/default.nix
@@ -60,7 +60,7 @@ stdenv.mkDerivation rec {
   strictDeps = true;
 
   CXXFLAGS = "-std=c++11";
-  configureFlags = "--enable-liblilv --with-extra-cppflags=-Dnullptr=0";
+  configureFlags = [ "--enable-liblilv" "--with-extra-cppflags=-Dnullptr=0" ];
 
   postPatch = ''
     sed -i -e '
diff --git a/pkgs/applications/blockchains/nearcore/default.nix b/pkgs/applications/blockchains/nearcore/default.nix
index f9f0bd0c69b..264d53fc56a 100644
--- a/pkgs/applications/blockchains/nearcore/default.nix
+++ b/pkgs/applications/blockchains/nearcore/default.nix
@@ -1,42 +1,60 @@
 { rustPlatform, lib, fetchFromGitHub
-, zlib, elfutils, openssl
-, cmake, python3, pkg-config, protobuf, perl, llvmPackages
+, zlib, openssl
+, pkg-config, protobuf, llvmPackages
 }:
 rustPlatform.buildRustPackage rec {
-  #https://github.com/near/nearcore
   pname = "nearcore";
-  version = "1.25.0";
+  version = "1.26.0";
+
+  # https://github.com/near/nearcore/tags
   src = fetchFromGitHub {
     owner = "near";
     repo = "nearcore";
     # there is also a branch for this version number, so we need to be explicit
     rev = "refs/tags/${version}";
-    sha256 = "sha256-7hiBqJLGIf+kNKJvMQ7KtGZm/SWLY3pT7YDlwbm3HDM=";
+    sha256 = "sha256-N3A+hy5I1/yJ3IN9gDw3m1IZ9qK8LNhn3fuXLMn23bg=";
   };
 
-  cargoSha256 = "sha256-EGv4CibSHL9oTAdWK7d/SOzZWPcEB16hTWlWHjKU4wc=";
+  cargoSha256 = "sha256-g07liit048TSL73wFyDK+eKu33Z6fPJcJ+VeGgTtuS8=";
+
+  postPatch = ''
+    substituteInPlace neard/build.rs \
+      --replace 'get_git_version()?' '"nix:${version}"'
+  '';
+
+  CARGO_PROFILE_RELEASE_CODEGEN_UNITS = "1";
+  CARGO_PROFILE_RELEASE_LTO = "fat";
+  NEAR_RELEASE_BUILD = "release";
+
+  OPENSSL_NO_VENDOR = 1; # we want to link to OpenSSL provided by Nix
 
   # don't build SDK samples that require wasm-enabled rust
-  cargoBuildFlags = [ "-p" "neard" ];
+  buildAndTestSubdir = "neard";
   doCheck = false; # needs network
 
-  buildInputs = [ zlib elfutils openssl ];
+  buildInputs = [
+    zlib
+    openssl
+  ];
+
   nativeBuildInputs = [
-    cmake
-    python3
     pkg-config
     protobuf
-    perl
   ];
 
+  # fat LTO requires ~3.4GB RAM
+  requiredSystemFeatures = [ "big-parallel" ];
+
   LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
   BINDGEN_EXTRA_CLANG_ARGS = "-isystem ${llvmPackages.libclang.lib}/lib/clang/${lib.getVersion llvmPackages.clang}/include";
 
   meta = with lib; {
     description = "Reference client for NEAR Protocol";
     homepage = "https://github.com/near/nearcore";
-    license = licenses.mit;
-    maintainers = with maintainers; [ mic92 ];
-    platforms = platforms.unix;
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ mic92 mikroskeem ];
+    # only x86_64 is supported in nearcore because of sse4+ support, macOS might
+    # be also possible
+    platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/pkgs/applications/graphics/drawio/headless.nix b/pkgs/applications/graphics/drawio/headless.nix
new file mode 100644
index 00000000000..c70511fa652
--- /dev/null
+++ b/pkgs/applications/graphics/drawio/headless.nix
@@ -0,0 +1,36 @@
+{ lib, writeTextFile, runtimeShell, drawio, xvfb-run }:
+
+writeTextFile {
+  name = "${drawio.pname}-headless-${drawio.version}";
+
+  executable = true;
+  destination = "/bin/drawio";
+  text = ''
+    #!${runtimeShell}
+
+    # Electron really wants a configuration directory to not die with:
+    # "Error: Failed to get 'appData' path"
+    # so we give it some temp dir as XDG_CONFIG_HOME
+    tmpdir=$(mktemp -d)
+
+    function cleanup {
+      rm -rf "$tmpdir"
+    }
+    trap cleanup EXIT
+
+    # Drawio needs to run in a virtual X session, because Electron
+    # refuses to work and dies with an unhelpful error message otherwise:
+    # "The futex facility returned an unexpected error code."
+    XDG_CONFIG_HOME="$tmpdir" ${xvfb-run}/bin/xvfb-run ${drawio}/bin/drawio $@
+  '';
+
+  meta = with lib; {
+    description = "xvfb wrapper around drawio";
+    longDescription = ''
+      A wrapper around drawio for running in headless environments.
+      Runs drawio under xvfb-run, with configuration going to a temporary
+      directory.
+    '';
+    maintainers = with maintainers; [ qyliss tfc ];
+  };
+}
diff --git a/pkgs/applications/graphics/grafx2/default.nix b/pkgs/applications/graphics/grafx2/default.nix
index df570008b0f..48e97e7dbb3 100644
--- a/pkgs/applications/graphics/grafx2/default.nix
+++ b/pkgs/applications/graphics/grafx2/default.nix
@@ -15,6 +15,12 @@ stdenv.mkDerivation rec {
 
   preBuild = "cd src";
 
+  # Workaround build failure on -fno-common toolchains like upstream
+  # gcc-10. Otherwise build fails as:
+  #   ld: ../obj/unix/tiles.o:/build/grafx2/src/global.h:306: multiple definition of
+  #     `Main_selector'; ../obj/unix/main.o:/build/grafx2/src/global.h:306: first defined here
+  NIX_CFLAGS_COMPILE = "-fcommon";
+
   preInstall = '' mkdir -p "$out" '';
 
   installPhase = ''make install prefix="$out"'';
diff --git a/pkgs/applications/misc/gpg-mdp/default.nix b/pkgs/applications/misc/gpg-mdp/default.nix
index 48c7c7724eb..08ab2a5b7d9 100644
--- a/pkgs/applications/misc/gpg-mdp/default.nix
+++ b/pkgs/applications/misc/gpg-mdp/default.nix
@@ -1,4 +1,4 @@
-{ fetchurl, lib, stdenv, ncurses, gnupg }:
+{ fetchurl, fetchpatch, lib, stdenv, ncurses, gnupg }:
 
 let version = "0.7.4";
 in stdenv.mkDerivation {
@@ -14,6 +14,15 @@ in stdenv.mkDerivation {
     url = "https://tamentis.com/projects/mdp/files/mdp-${version}.tar.gz";
     sha256 = "04mdnx4ccpxf9m2myy9nvpl9ma4jgzmv9bkrzv2b9affzss3r34g";
   };
+  patches = [
+    # Pull fix pending upstream inclusion for -fno-common toolchain support:
+    #   https://github.com/tamentis/mdp/pull/9
+    (fetchpatch {
+      name = "fno-common.patch";
+      url = "https://github.com/tamentis/mdp/commit/95c77de3beb96dc7c76ff36d3f3dfb18411d7c54.patch";
+      sha256 = "1j6yvjzkx31b758yav4arhlm5ig7phl8mgx4fcwj7lm2pfvzwcsz";
+    })
+  ];
   buildInputs = [ ncurses ];
   prePatch = ''
     substituteInPlace ./configure \
diff --git a/pkgs/applications/misc/zettlr/default.nix b/pkgs/applications/misc/zettlr/default.nix
index 21ac3a908d3..bd9e5a87bf9 100644
--- a/pkgs/applications/misc/zettlr/default.nix
+++ b/pkgs/applications/misc/zettlr/default.nix
@@ -8,11 +8,11 @@
 # Based on https://gist.github.com/msteen/96cb7df66a359b827497c5269ccbbf94 and joplin-desktop nixpkgs.
 let
   pname = "zettlr";
-  version = "2.2.5";
+  version = "2.2.6";
   name = "${pname}-${version}";
   src = fetchurl {
     url = "https://github.com/Zettlr/Zettlr/releases/download/v${version}/Zettlr-${version}-x86_64.appimage";
-    sha256 = "sha256-KP3lt0CweT1f/BR3IpnjwCqNvhFbrpz9KLg6K8OMs+I=";
+    sha256 = "sha256-f01WLxp8fe7y2EwTUhpPqcRuWBs/9lMaAAOdybmHB5M=";
   };
   appimageContents = appimageTools.extractType2 {
     inherit name src;
diff --git a/pkgs/applications/science/logic/alt-ergo/default.nix b/pkgs/applications/science/logic/alt-ergo/default.nix
index 096a648b4dd..0767c58bdea 100644
--- a/pkgs/applications/science/logic/alt-ergo/default.nix
+++ b/pkgs/applications/science/logic/alt-ergo/default.nix
@@ -17,7 +17,7 @@ in
 let alt-ergo-lib = ocamlPackages.buildDunePackage rec {
   pname = "alt-ergo-lib";
   inherit version src useDune2;
-  configureFlags = pname;
+  configureFlags = [ pname ];
   nativeBuildInputs = [ which ];
   buildInputs = with ocamlPackages; [ dune-configurator ];
   propagatedBuildInputs = with ocamlPackages; [ num ocplib-simplex stdlib-shims zarith ];
@@ -26,7 +26,7 @@ let alt-ergo-lib = ocamlPackages.buildDunePackage rec {
 let alt-ergo-parsers = ocamlPackages.buildDunePackage rec {
   pname = "alt-ergo-parsers";
   inherit version src useDune2;
-  configureFlags = pname;
+  configureFlags = [ pname ];
   nativeBuildInputs = [ which ocamlPackages.menhir ];
   propagatedBuildInputs = [ alt-ergo-lib ] ++ (with ocamlPackages; [ camlzip psmt2-frontend ]);
 }; in
@@ -35,7 +35,7 @@ ocamlPackages.buildDunePackage {
 
   inherit pname version src useDune2;
 
-  configureFlags = pname;
+  configureFlags = [ pname ];
 
   nativeBuildInputs = [ which ocamlPackages.menhir ];
   buildInputs = [ alt-ergo-parsers ocamlPackages.cmdliner ];
diff --git a/pkgs/applications/science/math/eukleides/default.nix b/pkgs/applications/science/math/eukleides/default.nix
index 0c3ef25909b..507fa081529 100644
--- a/pkgs/applications/science/math/eukleides/default.nix
+++ b/pkgs/applications/science/math/eukleides/default.nix
@@ -32,6 +32,12 @@ lib.fix (eukleides: stdenv.mkDerivation rec {
       --replace '$(SHARE_DIR)/texmf' "$tex"
   '';
 
+  # Workaround build failure on -fno-common toolchains like upstream
+  # gcc-10. Otherwise build fails as:
+  #   ld: eukleides_build/triangle.o:(.bss+0x28): multiple definition of `A';
+  #     eukleides_build/quadrilateral.o:(.bss+0x18): first defined here
+  NIX_CFLAGS_COMPILE = "-fcommon";
+
   preInstall = ''
     mkdir -p $out/bin
   '';
diff --git a/pkgs/applications/version-management/git-and-tools/lab/default.nix b/pkgs/applications/version-management/git-and-tools/lab/default.nix
index 8f4acbc3fc4..d73d1d13bde 100644
--- a/pkgs/applications/version-management/git-and-tools/lab/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/lab/default.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "lab";
-  version = "0.24.0";
+  version = "0.25.0";
 
   src = fetchFromGitHub {
     owner = "zaquestion";
     repo = "lab";
     rev = "v${version}";
-    sha256 = "sha256-sw00D/PJaLAPHoPdJC2WYUNklIzMbc/bXt2jlQZ7E90=";
+    sha256 = "sha256-7AUhH2aBRpsjUzZQGE2fHDOa1k0rMUfZJqUEKZXpJuM=";
   };
 
   subPackages = [ "." ];
 
-  vendorSha256 = "sha256-FwnVMH//GwFbi+llFF6XNqrZX2hRB4r51p8TRz2vN+g=";
+  vendorSha256 = "sha256-ChysquNuUffcM3qaWUdqu3Av33gnKkdlotEoFKoedA0=";
 
   doCheck = false;
 
diff --git a/pkgs/applications/window-managers/matchbox/default.nix b/pkgs/applications/window-managers/matchbox/default.nix
index 51bb3010d33..f12ed0ea0a7 100644
--- a/pkgs/applications/window-managers/matchbox/default.nix
+++ b/pkgs/applications/window-managers/matchbox/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pkg-config, libmatchbox, libX11, libXext }:
+{ lib, stdenv, fetchurl, fetchpatch, pkg-config, libmatchbox, libX11, libXext }:
 
 stdenv.mkDerivation rec {
   pname = "matchbox";
@@ -13,6 +13,15 @@ stdenv.mkDerivation rec {
     sha256 = "1zyfq438b466ygcz78nvsmnsc5bhg4wcfnpxb43kbkwpyx53m8l1";
   };
 
+  patches = [
+    # Pull upstream fix for -fno-common tollchains:
+    (fetchpatch {
+      name = "fno-common.patch";
+      url = "https://git.yoctoproject.org/matchbox-window-manager/patch/?id=844f61069896fe3f549ab425d731c061028f697c";
+      sha256 = "1md2s7q094hn4gzg21pfyz8d426y07d5rbx2icas9nvc8jj7bwfc";
+    })
+  ];
+
   meta = {
     description = "X window manager for non-desktop embedded systems";
     homepage = "https://www.yoctoproject.org/software-item/matchbox/";
diff --git a/pkgs/development/compilers/yap/default.nix b/pkgs/development/compilers/yap/default.nix
index 4428d4dbba6..10ba3c55901 100644
--- a/pkgs/development/compilers/yap/default.nix
+++ b/pkgs/development/compilers/yap/default.nix
@@ -13,7 +13,11 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--enable-tabling=yes" ];
 
-  NIX_CFLAGS_COMPILE = "-fpermissive";
+  # -fcommon: workaround build failure on -fno-common toolchains like upstream
+  # gcc-10. Otherwise build fails as:
+  #   ld: libYap.a(pl-dtoa.o):/build/yap-6.3.3/H/pl-yap.h:230: multiple definition of `ATOM_';
+  #     libYap.a(pl-buffer.o):/build/yap-6.3.3/H/pl-yap.h:230: first defined here
+  NIX_CFLAGS_COMPILE = "-fpermissive -fcommon";
 
   meta = {
     homepage = "http://www.dcc.fc.up.pt/~vsc/Yap/";
diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix
index 109ab8b9fe8..49087791002 100644
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@@ -176,6 +176,15 @@ self: super: {
   vector = doJailbreak (if pkgs.stdenv.isi686 then appendConfigureFlag "--ghc-options=-msse2" super.vector else super.vector);
 
   inline-c-cpp = overrideCabal (drv: {
+    patches = drv.patches or [] ++ [
+      (fetchpatch {
+        # awaiting release >0.5.0.0
+        url = "https://github.com/fpco/inline-c/commit/e176b8e8c3c94e7d8289a8b7cc4ce8e737741730.patch";
+        name = "inline-c-cpp-pr-132-1.patch";
+        sha256 = "sha256-CdZXAT3Ar4KKDGyAUu8A7hzddKe5/AuMKoZSjt3o0UE=";
+        stripLen = 1;
+      })
+    ];
     postPatch = (drv.postPatch or "") + ''
       substituteInPlace inline-c-cpp.cabal --replace "-optc-std=c++11" ""
     '';
diff --git a/pkgs/development/haskell-modules/configuration-ghcjs.nix b/pkgs/development/haskell-modules/configuration-ghcjs.nix
index c6e0e6a2c05..bab115ce641 100644
--- a/pkgs/development/haskell-modules/configuration-ghcjs.nix
+++ b/pkgs/development/haskell-modules/configuration-ghcjs.nix
@@ -25,7 +25,7 @@ self: super:
   # GHCJS does not ship with the same core packages as GHC.
   # https://github.com/ghcjs/ghcjs/issues/676
   stm = doJailbreak self.stm_2_5_0_2;
-  exceptions = dontCheck self.exceptions_0_10_4;
+  exceptions = dontCheck self.exceptions_0_10_5;
 
 ## OTHER PACKAGES
 
diff --git a/pkgs/development/libraries/rtrlib/default.nix b/pkgs/development/libraries/rtrlib/default.nix
new file mode 100644
index 00000000000..bb0aec308ae
--- /dev/null
+++ b/pkgs/development/libraries/rtrlib/default.nix
@@ -0,0 +1,24 @@
+{ lib, fetchFromGitHub, stdenv, cmake, libssh, openssl }:
+
+stdenv.mkDerivation rec {
+  pname = "rtrlib";
+  version = "0.8.0";
+
+  src = fetchFromGitHub {
+    repo = pname;
+    owner = "rtrlib";
+    rev = "v${version}";
+    sha256 = "sha256-ISb4ojcDvXY/88GbFMrA5V5+SGE6CmE5D+pokDTwotQ=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ libssh openssl ];
+
+  meta = with lib; {
+    description = "An open-source C implementation of the RPKI/Router Protocol client";
+    homepage = "https://github.com/rtrlib/rtrlib";
+    license = licenses.mit;
+    maintainers = with maintainers; [ Anillc ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/development/ocaml-modules/stdcompat/default.nix b/pkgs/development/ocaml-modules/stdcompat/default.nix
index eae9b264ba1..3630be368e5 100644
--- a/pkgs/development/ocaml-modules/stdcompat/default.nix
+++ b/pkgs/development/ocaml-modules/stdcompat/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   # build fails otherwise
   enableParallelBuilding = false;
 
-  configureFlags = "--libdir=$(OCAMLFIND_DESTDIR)";
+  configureFlags = [ "--libdir=$(OCAMLFIND_DESTDIR)" ];
 
   meta = {
     homepage = "https://github.com/thierry-martinez/stdcompat";
diff --git a/pkgs/development/python-modules/aioesphomeapi/default.nix b/pkgs/development/python-modules/aioesphomeapi/default.nix
index 06389d50677..9d6d3f2d56d 100644
--- a/pkgs/development/python-modules/aioesphomeapi/default.nix
+++ b/pkgs/development/python-modules/aioesphomeapi/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "aioesphomeapi";
-  version = "10.8.2";
+  version = "10.10.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "esphome";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-zvilMBx9H2VDmu13IiAiCqXEGkbpAJpGnt4Ea7FlGVI=";
+    sha256 = "sha256-j1YYzyOLuH+COBDXJUpkUx8H2K8F5tC5LB8ysZKi6oI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/deepdiff/default.nix b/pkgs/development/python-modules/deepdiff/default.nix
index cba0ac56396..c0519332342 100644
--- a/pkgs/development/python-modules/deepdiff/default.nix
+++ b/pkgs/development/python-modules/deepdiff/default.nix
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "seperman";
     repo = "deepdiff";
     rev = "v${version}";
-    hash = "sha256-0UBx7sH2iMrLVl5FtHNTwoecLHi8GbInn75G3FSg4gk=";
+    hash = "sha256-7eagu6lef5bc/4KU3y067LFOGtH6whda1ocBuRHS/kI=";
   };
 
   postPatch = ''
@@ -49,11 +49,6 @@ buildPythonPackage rec {
     pyyaml
   ];
 
-  disabledTests = [
-    # Assertion issue with the decimal places
-    "test_get_numeric_types_distance"
-  ];
-
   meta = with lib; {
     description = "Deep Difference and Search of any Python object/data";
     homepage = "https://github.com/seperman/deepdiff";
diff --git a/pkgs/development/python-modules/dropbox/default.nix b/pkgs/development/python-modules/dropbox/default.nix
index 4184ddb1250..e321c110a6b 100644
--- a/pkgs/development/python-modules/dropbox/default.nix
+++ b/pkgs/development/python-modules/dropbox/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "dropbox";
-  version = "11.30.0";
+  version = "11.31.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -22,8 +22,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "dropbox";
     repo = "dropbox-sdk-python";
-    rev = "v${version}";
-    hash = "sha256-w07r95MBAClf0F3SICiZsHLdslzf+JuxC+BVdTACCog=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-mbBVivrpXYNuVbXeHRyy07LxPbtYvaL3JleK7QXOxi0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/ecs-logging/default.nix b/pkgs/development/python-modules/ecs-logging/default.nix
index f82149ac867..01298469f8d 100644
--- a/pkgs/development/python-modules/ecs-logging/default.nix
+++ b/pkgs/development/python-modules/ecs-logging/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "ecs-logging";
-  version = "1.1.0";
+  version = "2.0.0";
   format = "flit";
 
   disabled = pythonOlder "3.8";
@@ -16,8 +16,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "elastic";
     repo = "ecs-logging-python";
-    rev = version;
-    sha256 = "sha256-UcQh/+K2d4tiMZaz4IAZ2w/B88vEkHoq2LCPMNZ95Mo=";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-2BfZ96D24sfjFD6l+gjp6xXbSJ0kjQD/FhHLI3bpVGM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/gcsfs/default.nix b/pkgs/development/python-modules/gcsfs/default.nix
index 518226f34dd..82791db5bcc 100644
--- a/pkgs/development/python-modules/gcsfs/default.nix
+++ b/pkgs/development/python-modules/gcsfs/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "gcsfs";
-  version = "2022.01.0";
+  version = "2022.3.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "fsspec";
     repo = pname;
     rev = version;
-    hash = "sha256-wNeK1GdjK9GKaaECcFeBLjFf/h3MbLI5e4MX0UNoTqE=";
+    hash = "sha256-+Bchwsa8Jj7WBWbzyH+GQuqZki4EltMryumKt4Pm1es=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/lxmf/default.nix b/pkgs/development/python-modules/lxmf/default.nix
index c6044844a62..8ae981cc1f1 100644
--- a/pkgs/development/python-modules/lxmf/default.nix
+++ b/pkgs/development/python-modules/lxmf/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "lxmf";
-  version = "0.1.5";
+  version = "0.1.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "markqvist";
     repo = "lxmf";
     rev = "refs/tags/${version}";
-    hash = "sha256-9JG/EnL7vW4P7QiT6Xa0GLfmu1JeM0dlFSp3VRE47NI=";
+    hash = "sha256-n7ZEXz+jFokjqQJf8feDE6wuN2kI3xB0z+guUhGse3o=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/mox/default.nix b/pkgs/development/python-modules/mox/default.nix
index 380dbe594a5..bd7fc589a7a 100644
--- a/pkgs/development/python-modules/mox/default.nix
+++ b/pkgs/development/python-modules/mox/default.nix
@@ -1,24 +1,41 @@
 { lib
 , buildPythonPackage
-, fetchurl
+, fetchFromGitHub
+, pytestCheckHook
+, pythonOlder
+, six
 }:
 
 buildPythonPackage rec {
   pname = "mox";
-  version = "0.5.3";
+  version = "0.7.8";
+  format = "setuptools";
 
-  src = fetchurl {
-    url = "http://pymox.googlecode.com/files/${pname}-${version}.tar.gz";
-    sha256 = "4d18a4577d14da13d032be21cbdfceed302171c275b72adaa4c5997d589a5030";
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "ivancrneto";
+    repo = "pymox";
+    rev = "v${version}";
+    hash = "sha256-gODE9IGDk3WtO8iPOlp98fGp6Ih2laA3YlOHmq62m8Y=";
   };
 
-  # error: invalid command 'test'
-  doCheck = false;
+  propagatedBuildInputs = [
+    six
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "mox"
+  ];
 
   meta = with lib; {
-    homepage = "https://pymox.readthedocs.io/";
-    description = "A mock object framework for Python";
+    description = "Mock object framework";
+    homepage = "https://github.com/ivancrneto/pymox";
     license = licenses.asl20;
+    maintainers = with maintainers; [ ];
   };
-
 }
diff --git a/pkgs/development/python-modules/nomadnet/default.nix b/pkgs/development/python-modules/nomadnet/default.nix
index 4505c33a696..ef7083980af 100644
--- a/pkgs/development/python-modules/nomadnet/default.nix
+++ b/pkgs/development/python-modules/nomadnet/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "nomadnet";
-  version = "0.1.7";
+  version = "0.1.8";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "markqvist";
     repo = "NomadNet";
     rev = version;
-    hash = "sha256-WJpcV6+cnK1525lbYvkWqrGasioph72nuoNV4oWxVK0=";
+    hash = "sha256-gqUCE35RPt7k0RAoZGJS1srB5K4v6gJkbTKQs8Lajm8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/peaqevcore/default.nix b/pkgs/development/python-modules/peaqevcore/default.nix
index 4b11263017d..956a91cd5b7 100644
--- a/pkgs/development/python-modules/peaqevcore/default.nix
+++ b/pkgs/development/python-modules/peaqevcore/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "peaqevcore";
-  version = "0.0.23";
+  version = "0.0.24";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-z59TJ+P7WNMcTyevi4etWUFUnBJXAVhDOnO4GXjjuR0=";
+    hash = "sha256-rAC0NXkK18DmPiZJbqSZh5O0i6KvMpWvaANWyK3zMXQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pyshark/default.nix b/pkgs/development/python-modules/pyshark/default.nix
index 1bb91953983..ded9bcbbc4e 100644
--- a/pkgs/development/python-modules/pyshark/default.nix
+++ b/pkgs/development/python-modules/pyshark/default.nix
@@ -1,38 +1,53 @@
-{ lib, buildPythonPackage, fetchFromGitHub, py, lxml, pytestCheckHook, wireshark-cli }:
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, lxml
+, packaging
+, py
+, pytestCheckHook
+, pythonOlder
+, wireshark-cli
+}:
 
 buildPythonPackage rec {
   pname = "pyshark";
-  version = "0.4.3";
+  version = "0.4.5";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "KimiNewt";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-cveiFkkSplfQPgUEVWyV40KKHCtKJZsfvdV8JmEUmE4=";
+    # 0.4.5 was the last release which was tagged
+    # https://github.com/KimiNewt/pyshark/issues/541
+    rev = "8f8f13aba6ae716aa0a48175255063fe542fdc3b";
+    hash = "sha256-v9CC9hgTABAiJ0qiFZ/9/zMmHzJXKq3neGtTq/ucnT4=";
   };
 
+  sourceRoot = "${src.name}/src";
+
   propagatedBuildInputs = [
     py
     lxml
+    packaging
   ];
 
-  preConfigure = ''
-    cd src
-  '';
-
-  preCheck = ''
-    cd ..
-  '';
-
   checkInputs = [
     pytestCheckHook
     wireshark-cli
   ];
 
-  pythonImportsCheck = [ "pyshark" ];
+  pythonImportsCheck = [
+    "pyshark"
+  ];
+
+  pytestFlagsArray = [
+    "../tests/"
+  ];
 
   meta = with lib; {
-    description = "Python wrapper for tshark, allowing python packet parsing using wireshark dissectors";
+    description = "Python wrapper for tshark, allowing Python packet parsing using Wireshark dissectors";
     homepage = "https://github.com/KimiNewt/pyshark/";
     license = licenses.mit;
     maintainers = with maintainers; [ petabyteboy ];
diff --git a/pkgs/development/python-modules/pyskyqremote/default.nix b/pkgs/development/python-modules/pyskyqremote/default.nix
index 2a3c7166f0c..54365e5900d 100644
--- a/pkgs/development/python-modules/pyskyqremote/default.nix
+++ b/pkgs/development/python-modules/pyskyqremote/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "pyskyqremote";
-  version = "0.3.7";
+  version = "0.3.9";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "RogerSelwyn";
     repo = "skyq_remote";
     rev = "refs/tags/${version}";
-    sha256 = "sha256-VdoAtY+uZ4M6UNjYplqxx8S11eyKzqypW7IYCXOO2kQ=";
+    sha256 = "sha256-KEeTakVXt8a+SYbSGHOHAJwOa+T99qAIxAbvyMvb54A=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/slack-sdk/default.nix b/pkgs/development/python-modules/slack-sdk/default.nix
index 7e80ad35c5c..b3122653a84 100644
--- a/pkgs/development/python-modules/slack-sdk/default.nix
+++ b/pkgs/development/python-modules/slack-sdk/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "slack-sdk";
-  version = "3.16.1";
+  version = "3.16.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "slackapi";
     repo = "python-slack-sdk";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-XTt2R0JypbDGJtiWqFzmui7UVLK4/U46co7LcHkSbWo=";
+    sha256 = "sha256-xecmza5Zsv6mJ4SCRl5VnGseKJG1yznBbLZ1tyBSjIE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/ttp-templates/default.nix b/pkgs/development/python-modules/ttp-templates/default.nix
index 46db94782be..45548ee21c2 100644
--- a/pkgs/development/python-modules/ttp-templates/default.nix
+++ b/pkgs/development/python-modules/ttp-templates/default.nix
@@ -1,11 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, netmiko
-, pytestCheckHook
-, python
 , pythonOlder
-, ttp
 }:
 
 buildPythonPackage rec {
@@ -22,24 +18,14 @@ buildPythonPackage rec {
     hash = "sha256-Qx+z/srYgD67FjXzYrc8xtA99n8shWK7yWj/r/ETN2U=";
   };
 
-  propagatedBuildInputs = [
-    ttp
-  ];
+  postPatch = ''
+    # Drop circular dependency on ttp
+    substituteInPlace setup.py \
+      --replace '"ttp>=0.6.0"' ""
+  '';
 
-  checkInputs = [
-    netmiko
-    pytestCheckHook
-  ];
-
-  pythonImportsCheck = [
-    "ttp_templates"
-  ];
-
-  pytestFlagsArray = [
-    # The other tests requires data which is no part of the source
-    "test/test_ttp_templates_methods.py"
-    "test/test_yang_openconfig_lldp.py"
-  ];
+  # Circular dependency on ttp
+  doCheck = false;
 
   meta = with lib; {
     description = "Template Text Parser Templates collections";
diff --git a/pkgs/development/python-modules/ttp/default.nix b/pkgs/development/python-modules/ttp/default.nix
index 2157af31811..a484ed9f76a 100644
--- a/pkgs/development/python-modules/ttp/default.nix
+++ b/pkgs/development/python-modules/ttp/default.nix
@@ -1,22 +1,20 @@
 { lib
 , buildPythonPackage
-, callPackage
-, fetchFromGitHub
 , cerberus
 , configparser
 , deepdiff
+, fetchFromGitHub
 , geoip2
 , jinja2
+, netmiko
 , openpyxl
-, tabulate
-, yangson
 , pytestCheckHook
 , pyyaml
+, tabulate
+, ttp-templates
+, yangson
 }:
 
-let
-  ttp_templates = callPackage ./templates.nix { };
-in
 buildPythonPackage rec {
   pname = "ttp";
   version = "0.8.4";
@@ -26,7 +24,7 @@ buildPythonPackage rec {
     owner = "dmulyalin";
     repo = pname;
     rev = version;
-    sha256 = "sha256-vuKlddqm8KirqAJyvBPfRb5Nw9zo4Fl1bwbfVMhmH9g=";
+    hash = "sha256-vuKlddqm8KirqAJyvBPfRb5Nw9zo4Fl1bwbfVMhmH9g=";
   };
 
   propagatedBuildInputs = [
@@ -37,7 +35,7 @@ buildPythonPackage rec {
     geoip2
     jinja2
     # n2g unpackaged
-    # netmiko unpackaged
+    netmiko
     # nornir unpackaged
     openpyxl
     tabulate
@@ -51,7 +49,7 @@ buildPythonPackage rec {
   checkInputs = [
     pytestCheckHook
     pyyaml
-    ttp_templates
+    ttp-templates
   ];
 
   disabledTestPaths = [
@@ -87,6 +85,8 @@ buildPythonPackage rec {
     "test_TTP_CACHE_FOLDER_env_variable_usage"
     # requires additional network setup
     "test_child_group_do_not_start_if_no_parent_started"
+    # Assertion Error
+    "test_in_threads_parsing"
   ];
 
   pytestFlagsArray = [
diff --git a/pkgs/development/python-modules/ttp/templates.nix b/pkgs/development/python-modules/ttp/templates.nix
deleted file mode 100644
index 835548d0784..00000000000
--- a/pkgs/development/python-modules/ttp/templates.nix
+++ /dev/null
@@ -1,31 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-}:
-
-buildPythonPackage rec {
-  pname = "ttp-templates";
-  version = "0.1.1";
-  format = "setuptools";
-
-  src = fetchPypi {
-    pname = "ttp_templates";
-    inherit version;
-    sha256 = "0vg7k733i8jqnfz8mpq8kzr2l7b7drk29zkzik91029f6w7li007";
-  };
-
-  # drop circular dependency on ttp
-  postPatch = ''
-    substituteInPlace setup.py --replace '"ttp>=0.6.0"' ""
-  '';
-
-  # circular dependency on ttp
-  doCheck = false;
-
-  meta = with lib; {
-    description = "Template Text Parser Templates";
-    homepage = "https://github.com/dmulyalin/ttp_templates";
-    license = licenses.mit;
-    maintainers = with maintainers; [ hexa ];
-  };
-}
diff --git a/pkgs/development/python-modules/velbus-aio/default.nix b/pkgs/development/python-modules/velbus-aio/default.nix
index efa5a0fc29f..84e1bac0304 100644
--- a/pkgs/development/python-modules/velbus-aio/default.nix
+++ b/pkgs/development/python-modules/velbus-aio/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "velbus-aio";
-  version = "2022.2.4";
+  version = "2022.5.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "Cereal2nd";
     repo = pname;
     rev = version;
-    sha256 = "sha256-oWHyEw1DjMynLPAARcVaqsFccpnTk1/7gpq+8TU95d0=";
+    sha256 = "sha256-XdPrKNUvAHsqw3nv7Ws2zBYDBqEOEeEUHLdB2+f+p+w=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/python-modules/whois/default.nix b/pkgs/development/python-modules/whois/default.nix
index b2875819646..7f51e2c61ef 100644
--- a/pkgs/development/python-modules/whois/default.nix
+++ b/pkgs/development/python-modules/whois/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "whois";
-  version = "0.9.14";
+  version = "0.9.15";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -15,8 +15,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "DannyCork";
     repo = "python-whois";
-    rev = version;
-    sha256 = "1df4r2pr356y1c2ys6pzdl93fmx9ci4y75xphc95xn27zvqbpvix";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-Pfogvo0s678KHO85r4yopEaL4n/2cIY1+CnQu3iB8xc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/games/egoboo/default.nix b/pkgs/games/egoboo/default.nix
index 506868efe31..4023eccec44 100644
--- a/pkgs/games/egoboo/default.nix
+++ b/pkgs/games/egoboo/default.nix
@@ -45,6 +45,11 @@ stdenv.mkDerivation rec {
     '';
   */
 
+  # Workaround build failure on -fno-common toolchains like upstream
+  # gcc-10. Otherwise build fails as:
+  #   ld: mad.o:(.bss+0x233800): multiple definition of `tile_dict'; camera.o:(.bss+0x140): first defined here
+  NIX_CFLAGS_COMPILE = "-fcommon";
+
   NIX_LDFLAGS = "-lm";
 
   meta = {
diff --git a/pkgs/os-specific/linux/disk-indicator/default.nix b/pkgs/os-specific/linux/disk-indicator/default.nix
index 44dd19b27df..f5c7f3bc774 100644
--- a/pkgs/os-specific/linux/disk-indicator/default.nix
+++ b/pkgs/os-specific/linux/disk-indicator/default.nix
@@ -2,31 +2,40 @@
 
 stdenv.mkDerivation {
   pname = "disk-indicator";
-  version = "unstable-2014-05-19";
+  version = "unstable-2018-12-18";
 
   src = fetchFromGitHub {
     owner = "MeanEYE";
     repo = "Disk-Indicator";
-    rev = "51ef4afd8141b8d0659cbc7dc62189c56ae9c2da";
-    sha256 = "sha256-bRaVEe18VUmyftXzMNmGuL5gZ/dKCipuEDYrnHo1XYI=";
+    rev = "ec2d2f6833f038f07a72d15e2d52625c23e10b12";
+    sha256 = "sha256-cRqgIxF6H1WyJs5hhaAXVdWAlv6t22BZLp3p/qRlCSM=";
   };
 
   buildInputs = [ libX11 ];
 
-  patchPhase = ''
-    substituteInPlace ./makefile --replace "COMPILER=c99" "COMPILER=gcc -std=c99"
-    substituteInPlace ./makefile --replace "COMPILE_FLAGS=" "COMPILE_FLAGS=-O2 "
+  postPatch = ''
+    # avoid -Werror
+    substituteInPlace Makefile --replace "-Werror" ""
+    # avoid host-specific options
+    substituteInPlace Makefile --replace "-march=native" ""
   '';
 
-  buildPhase = "make -f makefile";
+  postConfigure = ''
+    patchShebangs ./configure.sh
+    ./configure.sh --all
+  '';
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=cpp";
-
-  hardeningDisable = [ "fortify" ];
+  makeFlags = [
+    "COMPILER=${stdenv.cc.targetPrefix}cc"
+  ];
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p "$out/bin"
     cp ./disk_indicator "$out/bin/"
+
+    runHook postInstall
   '';
 
   meta = {
diff --git a/pkgs/servers/frr/default.nix b/pkgs/servers/frr/default.nix
index 302c5a472bd..5e5cd767002 100644
--- a/pkgs/servers/frr/default.nix
+++ b/pkgs/servers/frr/default.nix
@@ -23,6 +23,7 @@
 , pcre2
 , python3
 , readline
+, rtrlib
 
 # tests
 , nettools
@@ -62,6 +63,7 @@ stdenv.mkDerivation rec {
     pcre2
     python3
     readline
+    rtrlib
   ] ++ lib.optionals stdenv.isLinux [
     libcap
   ];
@@ -78,6 +80,7 @@ stdenv.mkDerivation rec {
     "--localstatedir=/run/frr"
     "--sbindir=$(out)/libexec/frr"
     "--sysconfdir=/etc/frr"
+    "--enable-rpki"
   ];
 
   postPatch = ''
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index cfed6d197cf..ed457019c55 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -331,8 +331,8 @@ else let
 
       # This parameter is sometimes a string, sometimes null, and sometimes a list, yuck
       configureFlags = let inherit (lib) optional elem; in
-        (/**/ if lib.isString configureFlags then [configureFlags]
-         else if configureFlags == null      then []
+        (/**/ if lib.isString configureFlags then lib.warn "String 'configureFlags' is deprecated and will be removed in release 23.05. Please use a list of strings. Derivation name: ${derivationArg.name}, file: ${pos.file or "unknown file"}" [configureFlags]
+         else if configureFlags == null      then lib.warn "Null 'configureFlags' is deprecated and will be removed in release 23.05. Please use a empty list instead '[]'. Derivation name: ${derivationArg.name}, file: ${pos.file or "unknown file"}" []
          else                                     configureFlags)
         ++ optional (elem "build"  configurePlatforms) "--build=${stdenv.buildPlatform.config}"
         ++ optional (elem "host"   configurePlatforms) "--host=${stdenv.hostPlatform.config}"
diff --git a/pkgs/tools/bluetooth/bluez-tools/default.nix b/pkgs/tools/bluetooth/bluez-tools/default.nix
index dfb7147d08e..af76991436f 100644
--- a/pkgs/tools/bluetooth/bluez-tools/default.nix
+++ b/pkgs/tools/bluetooth/bluez-tools/default.nix
@@ -2,14 +2,14 @@
 , fetchFromGitHub, glib, pkg-config }:
 
 stdenv.mkDerivation rec {
-  version = "unstable-2016-12-12";
+  version = "unstable-2020-10-24";
   pname = "bluez-tools";
 
   src = fetchFromGitHub {
     owner = "khvzak";
     repo = "bluez-tools";
-    rev = "97efd293491ad7ec96a655665339908f2478b3d1";
-    sha256 = "08xp77sf5wnq5086halmyk3vla4bfls06q1zrqdcq36hw6d409i6";
+    rev = "f65321736475429316f07ee94ec0deac8e46ec4a";
+    sha256 = "0xk39lz3hm8lcnb5fdbfz4ldbbq8gswg95vilzdwxzrglcr6xnqq";
   };
 
   nativeBuildInputs = [ pkg-config autoreconfHook ];
diff --git a/pkgs/tools/filesystems/jfsutils/default.nix b/pkgs/tools/filesystems/jfsutils/default.nix
index 290bc313910..52b8fc4c3c2 100644
--- a/pkgs/tools/filesystems/jfsutils/default.nix
+++ b/pkgs/tools/filesystems/jfsutils/default.nix
@@ -25,6 +25,12 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [ libuuid ];
 
+  # Workaround build failure on -fno-common toolchains like upstream
+  # gcc-10. Otherwise build fails as:
+  #     ld: extract.o:/build/jfsutils-1.1.15/fscklog/extract.c:67: multiple definition of
+  #       `xchklog_buffer'; display.o:/build/jfsutils-1.1.15/fscklog/display.c:57: first defined here
+  NIX_CFLAGS_COMPILE = "-fcommon";
+
   meta = with lib; {
     description = "IBM JFS utilities";
     homepage = "http://jfs.sourceforge.net";
diff --git a/pkgs/tools/misc/esphome/dashboard.nix b/pkgs/tools/misc/esphome/dashboard.nix
index 1f101735e98..52ec2688103 100644
--- a/pkgs/tools/misc/esphome/dashboard.nix
+++ b/pkgs/tools/misc/esphome/dashboard.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "esphome-dashboard";
-  version = "20220309.0";
+  version = "20220508.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-J/T3Av0jwT0CJSwc0j+YjaiKFqs9soLf7ctpiz5rmm4=";
+    sha256 = "sha256-nBVVNe6Qwo72ws6G8WAO99f2ftbxoixOB0eiLuILyeg=";
   };
 
   # no tests
diff --git a/pkgs/tools/misc/esphome/default.nix b/pkgs/tools/misc/esphome/default.nix
index 3ce65eb2038..6eba2ca9446 100644
--- a/pkgs/tools/misc/esphome/default.nix
+++ b/pkgs/tools/misc/esphome/default.nix
@@ -15,14 +15,14 @@ let
 in
 with python.pkgs; buildPythonApplication rec {
   pname = "esphome";
-  version = "2022.4.0";
+  version = "2022.5.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "sha256-/IMiUMtWFouAjOlyq+BXvqQ1IddBXvua7y0i4J1cktM=";
+    sha256 = "sha256-ys4oGYZvOxKOLyeIFPR33L2uCAB1lybSo6nCIYFuA/0=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/misc/pandoc-drawio-filter/default.nix b/pkgs/tools/misc/pandoc-drawio-filter/default.nix
index 1279296143c..73dd658dfb1 100644
--- a/pkgs/tools/misc/pandoc-drawio-filter/default.nix
+++ b/pkgs/tools/misc/pandoc-drawio-filter/default.nix
@@ -1,5 +1,5 @@
 { buildPythonApplication
-, drawio
+, drawio-headless
 , fetchFromGitHub
 , lib
 , pandoc
@@ -21,32 +21,13 @@ let
     sha256 = "sha256-2XJSAfxqEmmamWIAM3vZqi0mZjUUugmR3zWw8Imjadk=";
   };
 
-  wrappedDrawio = writeScriptBin "drawio" ''
-    #!${runtimeShell}
-
-    # Electron really wants a configuration directory to not die with:
-    # "Error: Failed to get 'appData' path"
-    # so we give it some temp dir as XDG_CONFIG_HOME
-    tmpdir=$(mktemp -d)
-
-    function cleanup {
-      rm -rf "$tmpdir"
-    }
-    trap cleanup EXIT
-
-    # Drawio needs to run in a virtual X session, because Electron
-    # refuses to work and dies with an unhelpful error message otherwise:
-    # "The futex facility returned an unexpected error code."
-    XDG_CONFIG_HOME="$tmpdir" ${xvfb-run}/bin/xvfb-run ${drawio}/bin/drawio $@
-  '';
-
   pandoc-drawio-filter = buildPythonApplication {
     pname = "pandoc-drawio-filter";
 
     inherit src version;
 
     propagatedBuildInputs = [
-      wrappedDrawio
+      drawio-headless
       pandocfilters
     ];
 
diff --git a/pkgs/tools/misc/wimboot/default.nix b/pkgs/tools/misc/wimboot/default.nix
index 67df4056b5f..bc43d77bbfb 100644
--- a/pkgs/tools/misc/wimboot/default.nix
+++ b/pkgs/tools/misc/wimboot/default.nix
@@ -26,6 +26,6 @@ stdenv.mkDerivation rec {
     description = "Windows Imaging Format bootloader";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ das_j ajs124 ];
-    platforms = platforms.x86; # Fails on aarch64
+    platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/pkgs/tools/misc/yubikey-personalization/default.nix b/pkgs/tools/misc/yubikey-personalization/default.nix
index 59739e06aa0..f8583f36140 100644
--- a/pkgs/tools/misc/yubikey-personalization/default.nix
+++ b/pkgs/tools/misc/yubikey-personalization/default.nix
@@ -16,6 +16,14 @@ stdenv.mkDerivation rec {
       url = "https://github.com/Yubico/yubikey-personalization/commit/0aa2e2cae2e1777863993a10c809bb50f4cde7f8.patch";
       sha256 = "1wnigf3hbq59i15kgxpq3pwrl1drpbj134x81mmv9xm1r44cjva8";
     })
+
+    # Pull upstream fix for -fno-common toolchain support:
+    #  https://github.com/Yubico/yubikey-personalization/issues/155
+    (fetchpatch {
+      name = "fno-common.patch";
+      url = "https://github.com/Yubico/yubikey-personalization/commit/09ea16d9e2030e4da6ad00c1e5147e962aa7ff84.patch";
+      sha256 = "0n3ka8n7f3ndbxv3k0bi77d850kr2ypglkw81gqycpqyaciidqwa";
+    })
   ];
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/tools/networking/hping/default.nix b/pkgs/tools/networking/hping/default.nix
index 97b45c64ee2..33663a44d2a 100644
--- a/pkgs/tools/networking/hping/default.nix
+++ b/pkgs/tools/networking/hping/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, libpcap, withTcl ? true, tcl }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, libpcap, withTcl ? true, tcl }:
 
 stdenv.mkDerivation rec {
   pname = "hping";
@@ -10,6 +10,15 @@ stdenv.mkDerivation rec {
     rev = "3547c7691742c6eaa31f8402e0ccbb81387c1b99"; # there are no tags/releases
     sha256 = "0y0n1ybij3yg9lfgzcwfmjz1sjg913zcqrv391xx83dm0j80sdpb";
   };
+  patches = [
+    # Pull patch pending upstream inclusion for -fno-common toolchain
+    # support: https://github.com/antirez/hping/pull/64
+    (fetchpatch {
+      name = "fno-common.patch";
+      url = "https://github.com/antirez/hping/pull/64/commits/d057b9309aec3a5a53aaee1ac3451a8a5b71b4e8.patch";
+      sha256 = "0bqr7kdlziijja588ipj8g5hv2109wq01c6x2qadbhjfnsps1b6l";
+    })
+  ];
 
   buildInputs = [ libpcap ] ++ lib.optional withTcl tcl;
 
diff --git a/pkgs/tools/networking/iftop/default.nix b/pkgs/tools/networking/iftop/default.nix
index abdb7d05b28..137ce03b252 100644
--- a/pkgs/tools/networking/iftop/default.nix
+++ b/pkgs/tools/networking/iftop/default.nix
@@ -19,6 +19,12 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ncurses libpcap];
 
+  # Workaround build failure on -fno-common toolchains like upstream
+  # gcc-10. Otherwise build fails as:
+  #   ld: tui.o:/build/iftop-1.0pre4/ui_common.h:41: multiple definition of `service_hash';
+  #     iftop.o:/build/iftop-1.0pre4/ui_common.h:41: first defined here
+  NIX_CFLAGS_COMPILE = "-fcommon";
+
   passthru.tests = { inherit (nixosTests) iftop; };
 
   meta = with lib; {
diff --git a/pkgs/tools/networking/lsh/default.nix b/pkgs/tools/networking/lsh/default.nix
index 5893579b1a7..07f0524d5f4 100644
--- a/pkgs/tools/networking/lsh/default.nix
+++ b/pkgs/tools/networking/lsh/default.nix
@@ -31,7 +31,12 @@ stdenv.mkDerivation rec {
     export lsh_cv_sys_unix98_ptys=yes
   '';
 
-  NIX_CFLAGS_COMPILE = "-std=gnu90";
+  # -fcommon: workaround build failure on -fno-common toolchains like upstream
+  # gcc-10. Otherwise build fails as:
+  #   ld: liblsh.a(unix_user.o):/build/lsh-2.0.4/src/server_userauth.h:108: multiple definition of
+  #     `server_userauth_none_preauth'; lshd.o:/build/lsh-2.0.4/src/server_userauth.h:108: first defined here
+  # Should be present in upcoming 2.1 release.
+  NIX_CFLAGS_COMPILE = "-std=gnu90 -fcommon";
 
   buildInputs = [ gperf guile gmp zlib liboop readline gnum4 pam ];
 
diff --git a/pkgs/tools/networking/networkmanager/default.nix b/pkgs/tools/networking/networkmanager/default.nix
index 86195ba8692..5dc59f9590f 100644
--- a/pkgs/tools/networking/networkmanager/default.nix
+++ b/pkgs/tools/networking/networkmanager/default.nix
@@ -54,11 +54,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "networkmanager";
-  version = "1.36.4";
+  version = "1.38.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/NetworkManager/${lib.versions.majorMinor version}/NetworkManager-${version}.tar.xz";
-    sha256 = "YTBOk33ZJkcdVnFb3t57q3zKyCc1bmfycA00MxfNPFk=";
+    sha256 = "sha256-gqTPB93+sIFnh7Z8D1BYrmxQ1iWcCwVBok41FWBisu8=";
   };
 
   outputs = [ "out" "dev" "devdoc" "man" "doc" ];
diff --git a/pkgs/tools/package-management/nix-update/default.nix b/pkgs/tools/package-management/nix-update/default.nix
index fd3b4a5a3e4..dd6cb2e5605 100644
--- a/pkgs/tools/package-management/nix-update/default.nix
+++ b/pkgs/tools/package-management/nix-update/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonApplication rec {
   pname = "nix-update";
-  version = "0.5.0";
+  version = "0.5.1";
 
   src = fetchFromGitHub {
     owner = "Mic92";
     repo = pname;
     rev = version;
-    sha256 = "sha256-D1N7ISLZJ3A8G9X5dvtCbRse5h0MRJoeZM3CHkFpqlE=";
+    sha256 = "sha256-d2S18cBkFJOIGFKrwj9U4bRvdPjrbuWfRUVug1JEw0s=";
   };
 
   makeWrapperArgs = [
diff --git a/pkgs/tools/security/kube-hunter/default.nix b/pkgs/tools/security/kube-hunter/default.nix
index 0f82cc0cbab..d9ef1f38252 100644
--- a/pkgs/tools/security/kube-hunter/default.nix
+++ b/pkgs/tools/security/kube-hunter/default.nix
@@ -5,13 +5,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "kube-hunter";
-  version = "0.6.7";
+  version = "0.6.8";
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-W7jW0V91o164EIAzZ7ODWeqTmUaUFDIqlE37x/AycqY=";
+    sha256 = "sha256-+M8P/VSF9SKPvq+yNPjokyhggY7hzQ9qLLhkiTNbJls=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/security/nuclei/default.nix b/pkgs/tools/security/nuclei/default.nix
index 2145c5fc333..076b907d880 100644
--- a/pkgs/tools/security/nuclei/default.nix
+++ b/pkgs/tools/security/nuclei/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "nuclei";
-  version = "2.7.0";
+  version = "2.7.1";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-+yoxpdEU5TDOJsLRXBwddzAIBAzdSu8hdcvhuCWZxtc=";
+    sha256 = "sha256-ra8BxM+zpe5UKlJ28wc8yE5ta4ro4o2OHfmu9fBqFTA=";
   };
 
-  vendorSha256 = "sha256-6BC8jf/XaC7W6vsQEFIyIZ0S8XLJv+dFlaFl9VEO7yc=";
+  vendorSha256 = "sha256-4E9nHBaojkOwnSPxRn2JGFcQTF4WowTOtzE5zRjkqhk=";
 
   modRoot = "./v2";
   subPackages = [
diff --git a/pkgs/tools/security/terrascan/default.nix b/pkgs/tools/security/terrascan/default.nix
index 02f3615233a..e5ec1d444ce 100644
--- a/pkgs/tools/security/terrascan/default.nix
+++ b/pkgs/tools/security/terrascan/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "terrascan";
-  version = "1.14.0";
+  version = "1.15.0";
 
   src = fetchFromGitHub {
     owner = "accurics";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-O4oLtbijTAgUD+X3rxJkH2VmWLX5nQaN5JwoznNpKOM=";
+    sha256 = "sha256-up79ryjN9WciEl6fVgTLUZHhXSu7+utQB2ACPAx207E=";
   };
 
-  vendorSha256 = "sha256-dfd5yQ3t23YyFin770UlCtEIldRxTqeWfgl0GLLF+Qw=";
+  vendorSha256 = "sha256-EfHcCk2NkicSPeJYgHJT2kh9EwLldksET75ZQambrWA=";
 
   # Tests want to download a vulnerable Terraform project
   doCheck = false;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 47f06df150a..48c516bcd3b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -20274,6 +20274,8 @@ with pkgs;
 
   rinutils = callPackage ../development/libraries/rinutils { };
 
+  rtrlib = callPackage ../development/libraries/rtrlib { };
+
   kissfft = callPackage ../development/libraries/kissfft { };
 
   lambdabot = callPackage ../development/tools/haskell/lambdabot {
@@ -25800,6 +25802,7 @@ with pkgs;
   drawing = callPackage ../applications/graphics/drawing { };
 
   drawio = callPackage ../applications/graphics/drawio {};
+  drawio-headless = callPackage ../applications/graphics/drawio/headless.nix { };
 
   drawpile = libsForQt5.callPackage ../applications/graphics/drawpile { };
   drawpile-server-headless = libsForQt5.callPackage ../applications/graphics/drawpile {