diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 36a5ee0dadd..37777799305 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -6353,6 +6353,13 @@
     github = "jsierles";
     githubId = 82;
   };
+  jsimonetti = {
+    email = "jeroen+nixpkgs@simonetti.nl";
+    matrix = "@jeroen:simonetti.nl";
+    name = "Jeroen Simonetti";
+    github = "jsimonetti";
+    githubId = 5478838;
+  };
   jtcoolen = {
     email = "jtcoolen@pm.me";
     name = "Julien Coolen";
diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index 5e852275b4a..413a6f9b1d7 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -94,6 +94,16 @@ with lib.maintainers; {
     enableFeatureFreezePing = true;
   };
 
+  c3d2 = {
+    members = [
+      astro
+      SuperSandro2000
+    ];
+    scope = "Maintain packages used in the C3D2 hackspace";
+    shortName = "c3d2";
+    enableFeatureFreezePing = true;
+  };
+
   cinnamon = {
     members = [
       mkg20001
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 40a84730dfc..7af6d826a78 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -893,6 +893,7 @@
   ./services/networking/redsocks.nix
   ./services/networking/resilio.nix
   ./services/networking/robustirc-bridge.nix
+  ./services/networking/routedns.nix
   ./services/networking/rpcbind.nix
   ./services/networking/rxe.nix
   ./services/networking/sabnzbd.nix
diff --git a/nixos/modules/services/networking/routedns.nix b/nixos/modules/services/networking/routedns.nix
new file mode 100644
index 00000000000..e0f5eedd2c8
--- /dev/null
+++ b/nixos/modules/services/networking/routedns.nix
@@ -0,0 +1,84 @@
+{ config
+, lib
+, pkgs
+, ...
+}:
+
+with lib;
+
+let
+  cfg = config.services.routedns;
+  settingsFormat = pkgs.formats.toml { };
+in
+{
+  options.services.routedns = {
+    enable = mkEnableOption "RouteDNS - DNS stub resolver, proxy and router";
+
+    settings = mkOption {
+      type = settingsFormat.type;
+      example = literalExpression ''
+        {
+          resolvers.cloudflare-dot = {
+            address = "1.1.1.1:853";
+            protocol = "dot";
+          };
+          groups.cloudflare-cached = {
+            type = "cache";
+            resolvers = ["cloudflare-dot"];
+          };
+          listeners.local-udp = {
+            address = "127.0.0.1:53";
+            protocol = "udp";
+            resolver = "cloudflare-cached";
+          };
+          listeners.local-tcp = {
+            address = "127.0.0.1:53";
+            protocol = "tcp";
+            resolver = "cloudflare-cached";
+          };
+        }
+      '';
+      description = ''
+        Configuration for RouteDNS, see <link xlink:href="https://github.com/folbricht/routedns/blob/master/doc/configuration.md"/>
+        for more information.
+      '';
+    };
+
+    configFile = mkOption {
+      default = settingsFormat.generate "routedns.toml" cfg.settings;
+      defaultText = "A RouteDNS configuration file automatically generated by values from services.routedns.*";
+      type = types.path;
+      example = literalExpression ''"''${pkgs.routedns}/cmd/routedns/example-config/use-case-1.toml"'';
+      description = "Path to RouteDNS TOML configuration file.";
+    };
+
+    package = mkOption {
+      default = pkgs.routedns;
+      defaultText = literalExpression "pkgs.routedns";
+      type = types.package;
+      description = "RouteDNS package to use.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.routedns = {
+      description = "RouteDNS - DNS stub resolver, proxy and router";
+      after = [ "network.target" ]; # in case a bootstrap resolver is used, this might fail a few times until the respective server is actually reachable
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network.target" ];
+      startLimitIntervalSec = 30;
+      startLimitBurst = 5;
+      serviceConfig = {
+        Restart = "on-failure";
+        RestartSec = "5s";
+        LimitNPROC = 512;
+        LimitNOFILE = 1048576;
+        DynamicUser = true;
+        AmbientCapabilities = "CAP_NET_BIND_SERVICE";
+        NoNewPrivileges = true;
+        ExecStart = "${getBin cfg.package}/bin/routedns -l 4 ${cfg.configFile}";
+      };
+    };
+  };
+  meta.maintainers = with maintainers; [ jsimonetti ];
+}
diff --git a/pkgs/applications/audio/ncpamixer/default.nix b/pkgs/applications/audio/ncpamixer/default.nix
index aca96ef5da3..7663d1745d2 100644
--- a/pkgs/applications/audio/ncpamixer/default.nix
+++ b/pkgs/applications/audio/ncpamixer/default.nix
@@ -24,6 +24,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/fulhax/ncpamixer";
     license = licenses.mit;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ StijnDW SuperSandro2000 ];
+    maintainers = with maintainers; [ StijnDW ] ++ teams.c3d2.members;
   };
 }
diff --git a/pkgs/applications/audio/tidal-hifi/default.nix b/pkgs/applications/audio/tidal-hifi/default.nix
new file mode 100644
index 00000000000..1befa966d35
--- /dev/null
+++ b/pkgs/applications/audio/tidal-hifi/default.nix
@@ -0,0 +1,119 @@
+{ lib
+, stdenv
+, fetchurl
+, autoPatchelfHook
+, dpkg
+, makeWrapper
+, alsa-lib
+, at-spi2-atk
+, at-spi2-core
+, atk
+, cairo
+, cups
+, dbus
+, expat
+, ffmpeg
+, fontconfig
+, freetype
+, gdk-pixbuf
+, glib
+, gtk3
+, libappindicator-gtk3
+, libdbusmenu
+, libdrm
+, libnotify
+, libpulseaudio
+, libsecret
+, libuuid
+, libxkbcommon
+, mesa
+, nss
+, pango
+, systemd
+, xdg-utils
+, xorg
+}:
+
+stdenv.mkDerivation rec {
+  pname = "tidal-hifi";
+  version = "4.0.0";
+
+  src = fetchurl {
+    url = "https://github.com/Mastermindzh/tidal-hifi/releases/download/${version}/tidal-hifi_${version}_amd64.deb";
+    sha256 = "19gx9x3v5ywlvg5vyqgj6pghzwinby0i8isavfrix798pfr98j5z";
+  };
+
+  nativeBuildInputs = [ autoPatchelfHook dpkg makeWrapper ];
+
+  buildInputs = [
+    alsa-lib
+    at-spi2-atk
+    at-spi2-core
+    atk
+    cairo
+    cups
+    dbus
+    expat
+    ffmpeg
+    fontconfig
+    freetype
+    gdk-pixbuf
+    glib
+    gtk3
+    pango
+    systemd
+    mesa # for libgbm
+    nss
+    libuuid
+    libdrm
+    libnotify
+    libsecret
+    libpulseaudio
+    libxkbcommon
+    libappindicator-gtk3
+    xorg.libX11
+    xorg.libxcb
+    xorg.libXcomposite
+    xorg.libXcursor
+    xorg.libXdamage
+    xorg.libXext
+    xorg.libXfixes
+    xorg.libXi
+    xorg.libXrandr
+    xorg.libXrender
+    xorg.libXScrnSaver
+    xorg.libxshmfence
+    xorg.libXtst
+  ];
+
+  runtimeDependencies =
+    [ (lib.getLib systemd) libnotify libdbusmenu xdg-utils ];
+
+  unpackPhase = "dpkg-deb -x $src .";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out/bin"
+    cp -R "opt" "$out"
+    cp -R "usr/share" "$out/share"
+    chmod -R g-w "$out"
+
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    makeWrapper $out/opt/tidal-hifi/tidal-hifi $out/bin/tidal-hifi \
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath buildInputs}" \
+      "''${gappsWrapperArgs[@]}"
+  '';
+
+  meta = with lib; {
+    description = "The web version of Tidal running in electron with hifi support thanks to widevine";
+    homepage = "https://github.com/Mastermindzh/tidal-hifi";
+    changelog = "https://github.com/Mastermindzh/tidal-hifi/releases/tag/${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ alternateved ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix b/pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix
index bbe37b5ed74..fdd2970fdac 100644
--- a/pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix
+++ b/pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix
@@ -27,7 +27,8 @@ in
     postInstall = ''
       patchShebangs node_modules/
       npm run build
-      ln -s $out/lib/node_modules/asf-ui/dist $out/lib/dist
+      cp -r $out/lib/node_modules/asf-ui/dist $out/lib/dist
+      rm -rf $out/lib/node_modules/
     '';
 
     meta = with lib; {
diff --git a/pkgs/applications/misc/skytemple/default.nix b/pkgs/applications/misc/skytemple/default.nix
index 0f331ef6e2c..2ec034e882e 100644
--- a/pkgs/applications/misc/skytemple/default.nix
+++ b/pkgs/applications/misc/skytemple/default.nix
@@ -1,4 +1,12 @@
-{ lib, fetchFromGitHub, gobject-introspection, gtk3, gtksourceview3, webkitgtk, wrapGAppsHook, python3Packages }:
+{ lib
+, fetchFromGitHub
+, gobject-introspection
+, gtk3
+, gtksourceview3
+, webkitgtk
+, wrapGAppsHook
+, python3Packages
+}:
 
 python3Packages.buildPythonApplication rec {
   pname = "skytemple";
@@ -8,7 +16,7 @@ python3Packages.buildPythonApplication rec {
     owner = "SkyTemple";
     repo = pname;
     rev = version;
-    sha256 = "sha256-CyYGTXdQsGpDR/gpqViEQO1xUPHaXTES592nRJixa1o=";
+    hash = "sha256-CyYGTXdQsGpDR/gpqViEQO1xUPHaXTES592nRJixa1o=";
   };
 
   buildInputs = [
@@ -20,9 +28,16 @@ python3Packages.buildPythonApplication rec {
     # any Pokemon, and clicking Stats and Moves tab.
     webkitgtk
   ];
-  nativeBuildInputs = [ gobject-introspection wrapGAppsHook ];
+
+  nativeBuildInputs = [
+    gobject-introspection
+    wrapGAppsHook
+  ];
+
   propagatedBuildInputs = with python3Packages; [
+    cairosvg
     natsort
+    ndspy
     packaging
     pycairo
     pygal
@@ -36,6 +51,7 @@ python3Packages.buildPythonApplication rec {
     skytemple-files
     skytemple-icons
     skytemple-ssb-debugger
+    tilequant
   ];
 
   doCheck = false; # there are no tests
diff --git a/pkgs/applications/networking/cluster/kubernetes/default.nix b/pkgs/applications/networking/cluster/kubernetes/default.nix
index 8ed8cd56891..5cbd307a3d7 100644
--- a/pkgs/applications/networking/cluster/kubernetes/default.nix
+++ b/pkgs/applications/networking/cluster/kubernetes/default.nix
@@ -1,11 +1,11 @@
-{ stdenv
-, lib
+{ lib
+, buildGoModule
 , fetchFromGitHub
 , which
-, go
 , makeWrapper
 , rsync
 , installShellFiles
+, runtimeShell
 , kubectl
 , nixosTests
 
@@ -19,7 +19,7 @@
   ]
 }:
 
-stdenv.mkDerivation rec {
+buildGoModule rec {
   pname = "kubernetes";
   version = "1.23.8";
 
@@ -30,23 +30,27 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-mu+jBSypoMNxOugLbS3foH4C4AqSZnlic4Bf1v9dYc8=";
   };
 
-  nativeBuildInputs = [ makeWrapper which go rsync installShellFiles ];
+  vendorSha256 = null;
+
+  doCheck = false;
+
+  nativeBuildInputs = [ makeWrapper which rsync installShellFiles ];
 
   outputs = [ "out" "man" "pause" ];
 
   patches = [ ./fixup-addonmanager-lib-path.patch ];
 
-  postPatch = ''
-    substituteInPlace "hack/update-generated-docs.sh" --replace "make" "make SHELL=${stdenv.shell}"
-    patchShebangs ./hack
-  '';
-
   WHAT = lib.concatStringsSep " " ([
     "cmd/kubeadm"
   ] ++ components);
 
-  postBuild = ''
+  buildPhase = ''
+    runHook preBuild
+    substituteInPlace "hack/update-generated-docs.sh" --replace "make" "make SHELL=${runtimeShell}"
+    patchShebangs ./hack ./cluster/addons/addon-manager
+    make "SHELL=${runtimeShell}" "WHAT=$WHAT"
     ./hack/update-generated-docs.sh
+    runHook postBuild
   '';
 
   installPhase = ''
@@ -69,7 +73,6 @@ stdenv.mkDerivation rec {
       --subst-var out
 
     chmod +x $out/bin/kube-addons
-    patchShebangs $out/bin/kube-addons
     wrapProgram $out/bin/kube-addons --set "KUBECTL_BIN" "$out/bin/kubectl"
 
     cp cluster/addons/addon-manager/kube-addons.sh $out/bin/kube-addons-lib.sh
@@ -80,10 +83,6 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
-  disallowedReferences = [ go ];
-
-  GOFLAGS = [ "-trimpath" ];
-
   meta = with lib; {
     description = "Production-Grade Container Scheduling and Management";
     license = licenses.asl20;
diff --git a/pkgs/applications/networking/cluster/kubernetes/kubectl.nix b/pkgs/applications/networking/cluster/kubernetes/kubectl.nix
index 6a6f9042124..754bca32511 100644
--- a/pkgs/applications/networking/cluster/kubernetes/kubectl.nix
+++ b/pkgs/applications/networking/cluster/kubernetes/kubectl.nix
@@ -1,15 +1,14 @@
-{ lib, stdenv, kubernetes }:
+{ lib, buildGoModule, kubernetes }:
 
-stdenv.mkDerivation rec {
+buildGoModule rec {
   pname = "kubectl";
 
   inherit (kubernetes)
-    disallowedReferences
-    GOFLAGS
+    buildPhase
+    doCheck
     nativeBuildInputs
-    postBuild
-    postPatch
     src
+    vendorSha256
     version
     ;
 
@@ -18,7 +17,7 @@ stdenv.mkDerivation rec {
   WHAT = lib.concatStringsSep " " [
     "cmd/kubectl"
     "cmd/kubectl-convert"
-    ];
+  ];
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/applications/networking/cluster/talosctl/default.nix b/pkgs/applications/networking/cluster/talosctl/default.nix
index da240b337bf..42d451bd44d 100644
--- a/pkgs/applications/networking/cluster/talosctl/default.nix
+++ b/pkgs/applications/networking/cluster/talosctl/default.nix
@@ -1,42 +1,21 @@
-{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
-let
-  # look for GO_LDFLAGS getting set in the Makefile
-  version = "1.0.6";
-  sha256 = "sha256-4cUaQWqVndp06eFgqInOMMGITbTdZO5BOqXW2XEpuWU=";
-  vendorSha256 = "sha256-7q35d+jbIDe7fAy6nL5FWdSovBb/f64HYLHGL+zE6bI=";
-  pkgsVersion = "v1.0.0-25-gcf9709e";
-  extrasVersion = "v1.0.0-4-g05b0920";
-in
+{ lib, stdenv, buildGoModule, fetchFromGitHub, installShellFiles }:
+
 buildGoModule rec {
   pname = "talosctl";
-  inherit version vendorSha256;
-  # nixpkgs-update: no auto update
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "siderolabs";
     repo = "talos";
     rev = "v${version}";
-    inherit sha256;
+    sha256 = "sha256-52WzQ5LWgIX/XBJPNvWV0tAPnw1AiINDL/7D3UYvvn4=";
   };
 
-  ldflags =
-    let
-      versionPkg = "github.com/talos-systems/talos/pkg/version"; # VERSION_PKG
-      imagesPkgs = "github.com/talos-systems/talos/pkg/images"; # IMAGES_PKGS
-      mgmtHelpersPkg = "github.com/talos-systems/talos/cmd/talosctl/pkg/mgmt/helpers"; #MGMT_HELPERS_PKG
-    in
-    [
-      "-X ${versionPkg}.Name=Client"
-      "-X ${versionPkg}.SHA=${src.rev}" # should be the hash, but as we build from tags, this needs to do
-      "-X ${versionPkg}.Tag=${src.rev}"
-      "-X ${versionPkg}.PkgsVersion=${pkgsVersion}" # PKGS
-      "-X ${versionPkg}.ExtrasVersion=${extrasVersion}" # EXTRAS
-      "-X ${imagesPkgs}.Username=siderolabs" # USERNAME
-      "-X ${imagesPkgs}.Registry=ghcr.io" # REGISTRY
-      "-X ${mgmtHelpersPkg}.ArtifactsPath=_out" # ARTIFACTS
-      "-s"
-      "-w"
-    ];
+  vendorSha256 = "sha256-iluI4UGw5cZ70wmC9jDiGttvxZ7xFyqcL9IZX4ubJqs=";
+
+  ldflags = [ "-s" "-w" ];
+
+  GOWORK = "off";
 
   subPackages = [ "cmd/talosctl" ];
 
@@ -56,5 +35,8 @@ buildGoModule rec {
     homepage = "https://www.talos.dev/";
     license = licenses.mpl20;
     maintainers = with maintainers; [ flokli ];
+    # requires >= 10.14 SDK https://github.com/NixOS/nixpkgs/issues/101229
+    # Undefined symbols for architecture x86_64: "_SecTrustEvaluateWithError"
+    broken = stdenv.isDarwin && stdenv.isx86_64;
   };
 }
diff --git a/pkgs/applications/radio/js8call/cmake.patch b/pkgs/applications/radio/js8call/cmake.patch
new file mode 100644
index 00000000000..04552eac40e
--- /dev/null
+++ b/pkgs/applications/radio/js8call/cmake.patch
@@ -0,0 +1,69 @@
+diff --git a/CMake/Modules/Findhamlib.cmake b/CMake/Modules/Findhamlib.cmake
+index 1590f05..e797851 100644
+--- a/CMake/Modules/Findhamlib.cmake
++++ b/CMake/Modules/Findhamlib.cmake
+@@ -47,7 +47,7 @@ if (NOT PC_HAMLIB_FOUND)
+ 
+   # libusb-1.0 has no pkg-config file on Windows so we have to find it
+   # ourselves
+-  find_library (LIBUSB NAMES usb-1.0 PATH_SUFFIXES MinGW32/dll)
++  find_library (LIBUSB NAMES libusb-1.0 usb-1.0 PATH_SUFFIXES MinGW32/dll)
+   if (LIBUSB)
+     set (hamlib_EXTRA_LIBRARIES ${LIBUSB} ${hamlib_EXTRA_LIBRARIES})
+     get_filename_component (hamlib_libusb_path ${LIBUSB} PATH)
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 75b80b3..7c04265 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -558,7 +558,6 @@ find_package (FFTW3 COMPONENTS double single threads REQUIRED)
+ #
+ # libhamlib setup
+ #
+-set (hamlib_STATIC 1)
+ find_package (hamlib 3 REQUIRED)
+ find_program (RIGCTL_EXE rigctl)
+ find_program (RIGCTLD_EXE rigctld)
+@@ -576,6 +576,7 @@ message (STATUS "hamlib_LIBRARY_DIRS: ${hamlib_LIBRARY_DIRS}")
+ find_package (Qt5Widgets 5 REQUIRED)
+ find_package (Qt5Multimedia 5 REQUIRED)
+ find_package (Qt5PrintSupport 5 REQUIRED)
++find_package (Qt5SerialPort 5 REQUIRED)
+ 
+ if (WIN32)
+   add_definitions (-DQT_NEEDS_QTMAIN)
+@@ -849,7 +850,7 @@ target_link_libraries (qcp Qt5::Widgets Qt5::PrintSupport)
+ add_library (wsjt_qt STATIC ${wsjt_qt_CXXSRCS} ${wsjt_qt_GENUISRCS} ${GENAXSRCS})
+ # set wsjtx_udp exports to static variants
+ target_compile_definitions (wsjt_qt PUBLIC UDP_STATIC_DEFINE)
+-target_link_libraries (wsjt_qt qcp Qt5::Widgets Qt5::Network)
++target_link_libraries (wsjt_qt qcp Qt5::Widgets Qt5::Network Qt5::SerialPort)
+ target_include_directories (wsjt_qt BEFORE PRIVATE ${hamlib_INCLUDE_DIRS})
+ if (WIN32)
+   target_link_libraries (wsjt_qt Qt5::AxContainer Qt5::AxBase)
+@@ -959,7 +960,6 @@ else ()
+       )
+   endif ()
+ endif ()
+-qt5_use_modules (js8call SerialPort) # not sure why the interface link library syntax above doesn't work
+ 
+ # if (UNIX)
+ #   if (NOT WSJT_SKIP_MANPAGES)
+@@ -1292,3 +1292,5 @@ configure_file ("${PROJECT_SOURCE_DIR}/CMakeCPackOptions.cmake.in"
+ set (CPACK_PROJECT_CONFIG_FILE "${PROJECT_BINARY_DIR}/CMakeCPackOptions.cmake")
+ 
+ include (CPack)
++
++add_definitions (-DJS8_USE_HAMLIB_THREE)
+diff --git a/Configuration.cpp b/Configuration.cpp
+index 8258f97..63a29bb 100644
+--- a/Configuration.cpp
++++ b/Configuration.cpp
+@@ -160,7 +160,7 @@
+ #include <QFont>
+ #include <QFontDialog>
+ #include <QColorDialog>
+-#include <QSerialPortInfo>
++#include <QtSerialPort/QSerialPortInfo>
+ #include <QScopedPointer>
+ #include <QDateTimeEdit>
+ #include <QProcess>
diff --git a/pkgs/applications/radio/js8call/default.nix b/pkgs/applications/radio/js8call/default.nix
new file mode 100644
index 00000000000..e89d3445697
--- /dev/null
+++ b/pkgs/applications/radio/js8call/default.nix
@@ -0,0 +1,65 @@
+{ lib
+, stdenv
+, fetchFromBitbucket
+, wrapQtAppsHook
+, pkg-config
+, hamlib
+, libusb1
+, cmake
+, gfortran
+, fftw
+, fftwFloat
+, qtbase
+, qtmultimedia
+, qtserialport
+}:
+
+stdenv.mkDerivation rec {
+  pname = "js8call";
+  version = "2.2.0";
+
+  src = fetchFromBitbucket {
+    owner = "widefido";
+    repo = pname;
+    rev = "v${version}-ga";
+    sha256 = "sha256-mFPhiAAibCiAkLrysAmIQalVCGd9ips2lqbAsowYprY=";
+  };
+
+  nativeBuildInputs = [
+    wrapQtAppsHook
+    gfortran
+    pkg-config
+    cmake
+  ];
+
+  buildInputs = [
+    hamlib
+    libusb1
+    fftw
+    fftwFloat
+    qtbase
+    qtmultimedia
+    qtserialport
+  ];
+
+  prePatch = ''
+    substituteInPlace CMakeLists.txt \
+        --replace "/usr/share/applications" "$out/share/applications" \
+        --replace "/usr/share/pixmaps" "$out/share/pixmaps" \
+        --replace "/usr/bin/" "$out/bin"
+  '';
+
+  patches = [ ./cmake.patch ];
+
+  meta = with lib; {
+    description = "Weak-signal keyboard messaging for amateur radio";
+    longDescription = ''
+      JS8Call is software using the JS8 Digital Mode providing weak signal
+      keyboard to keyboard messaging to Amateur Radio Operators.
+    '';
+    homepage = "http://js8call.com/";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ melling ];
+  };
+}
diff --git a/pkgs/development/libraries/geos/default.nix b/pkgs/development/libraries/geos/default.nix
index c067a705d0b..32b3155b8c5 100644
--- a/pkgs/development/libraries/geos/default.nix
+++ b/pkgs/development/libraries/geos/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
 , cmake }:
 
 stdenv.mkDerivation rec {
@@ -12,13 +13,15 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-ULvFmaw4a0wrOWLcxBHwBAph8gSq7066ciXs3Qz0VxU=";
   };
 
-  nativeBuildInputs = [ cmake ];
+  patches = [
+    # Fix paths with absolute CMAKE_INSTALL_*DIR
+    (fetchpatch {
+      url = "https://github.com/libgeos/geos/commit/11faa4db672ed61d64fd8a6f1a59114f5b5f2406.patch";
+      hash = "sha256-oAArwGq91Z93C6hBPQD0AlY8Q4Nnn6tA40HUPoZ5ftc=";
+    })
+  ];
 
-  postPatch = ''
-    substituteInPlace tools/geos-config.in \
-      --replace "@libdir@" "@prefix@/lib" \
-      --replace "@includedir@" "@prefix@/include"
-  '';
+  nativeBuildInputs = [ cmake ];
 
   meta = with lib; {
     description = "C++ port of the Java Topology Suite (JTS)";
diff --git a/pkgs/development/libraries/taskflow/default.nix b/pkgs/development/libraries/taskflow/default.nix
index 29760cdb94b..dd2f8fb3914 100644
--- a/pkgs/development/libraries/taskflow/default.nix
+++ b/pkgs/development/libraries/taskflow/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "taskflow";
-  version = "3.3.0";
+  version = "3.4.0";
 
   src = fetchFromGitHub {
     owner = "taskflow";
     repo = "taskflow";
     rev = "v${version}";
-    hash = "sha256-UfXGupxgtowIt3BnIVWwim3rTE57TT1C9TCx9LVyN34=";
+    hash = "sha256-5bTTV/WAxslHQ+hvATtUUA1h3MuNzwVTlYMbD/sINRM=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/django-oauth-toolkit/default.nix b/pkgs/development/python-modules/django-oauth-toolkit/default.nix
index eca67211671..65bf5045a03 100644
--- a/pkgs/development/python-modules/django-oauth-toolkit/default.nix
+++ b/pkgs/development/python-modules/django-oauth-toolkit/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "django-oauth-toolkit";
-  version = "1.7.0";
+  version = "2.1.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "jazzband";
     repo = pname;
-    rev = version;
-    sha256 = "0rp7pjif54yvdxfxn0pnf8ha3fjxspnx1ijyr1f8npwk2x5vnvhb";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-c78QYlU/gB4Lt04TlQFjtsS6pyjDm/fURBMa9hXLpLI=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/django-prometheus/default.nix b/pkgs/development/python-modules/django-prometheus/default.nix
index 733a177d6a5..209395ef643 100644
--- a/pkgs/development/python-modules/django-prometheus/default.nix
+++ b/pkgs/development/python-modules/django-prometheus/default.nix
@@ -16,8 +16,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "korfuri";
     repo = pname;
-    rev = version;
-    sha256 = "1y1cmycc545xrys41jk8kia36hwnkwhkw26mlpfdjgb63vq30x1d";
+    rev = "v${version}";
+    hash = "sha256-NE0zHnGGSrtkBLrSyBcQuyGrSfSQbdpevokg3YZhwDw=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/django-prometheus/drop-untestable-database-backends.patch b/pkgs/development/python-modules/django-prometheus/drop-untestable-database-backends.patch
index 1e9e6506084..41f1229c5e5 100644
--- a/pkgs/development/python-modules/django-prometheus/drop-untestable-database-backends.patch
+++ b/pkgs/development/python-modules/django-prometheus/drop-untestable-database-backends.patch
@@ -1,5 +1,5 @@
 diff --git a/django_prometheus/tests/end2end/testapp/settings.py b/django_prometheus/tests/end2end/testapp/settings.py
-index 0630721..bd2190a 100644
+index cdd167f..5c6073b 100644
 --- a/django_prometheus/tests/end2end/testapp/settings.py
 +++ b/django_prometheus/tests/end2end/testapp/settings.py
 @@ -53,33 +53,6 @@ DATABASES = {
@@ -28,9 +28,9 @@ index 0630721..bd2190a 100644
 -    "mysql": {
 -        "ENGINE": "django_prometheus.db.backends.mysql",
 -        "NAME": "django_prometheus_1",
--        "USER": "travis",
+-        "USER": "root",
 -        "PASSWORD": "",
--        "HOST": "localhost",
+-        "HOST": "127.0.0.1",
 -        "PORT": "3306",
 -    },
      # The following databases are used by test_db.py only
diff --git a/pkgs/development/python-modules/django-webpack-loader/default.nix b/pkgs/development/python-modules/django-webpack-loader/default.nix
index 2656dd593c1..ee51b0e7c8e 100644
--- a/pkgs/development/python-modules/django-webpack-loader/default.nix
+++ b/pkgs/development/python-modules/django-webpack-loader/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "django-webpack-loader";
-  version = "1.4.1";
+  version = "1.6.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "7e34085b7fc4d352e482ff9cf7d09ae4524e730675e25432ab1d25a2dd94e583";
+    sha256 = "sha256-opQY/0FpADW+ENLJSgZV2rCZAJxouJiDmBPWoQmxTXE=";
   };
 
   # django.core.exceptions.ImproperlyConfigured (path issue with DJANGO_SETTINGS_MODULE?)
diff --git a/pkgs/development/python-modules/railroad-diagrams/default.nix b/pkgs/development/python-modules/railroad-diagrams/default.nix
index 57c07e0dc48..1af5a196250 100644
--- a/pkgs/development/python-modules/railroad-diagrams/default.nix
+++ b/pkgs/development/python-modules/railroad-diagrams/default.nix
@@ -1,24 +1,30 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "railroad-diagrams";
-  version = "1.1.1";
+  version = "2.0.3";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8a1ec227666be2000e76794aa740f77987f1586077aae4d090d2633b3064c976";
+    hash = "sha256-wRClrA4I/DWNw/hL5rowQMn0R61c6qiNg9Ho6nXqi+4=";
   };
 
-  # this is a dependency of pyparsing, which is a dependency of pytest
+  # This is a dependency of pyparsing, which is a dependency of pytest
   doCheck = false;
 
-  pythonImportsCheck = [ "railroad" ];
+  pythonImportsCheck = [
+    "railroad"
+  ];
 
   meta = with lib; {
-    description = "Generate SVG railroad syntax diagrams, like on JSON.org";
+    description = "Module to generate SVG railroad syntax diagrams";
     homepage = "https://github.com/tabatkins/railroad-diagrams";
     license = licenses.cc0;
     maintainers = with maintainers; [ jonringer ];
diff --git a/pkgs/development/python-modules/sentry-sdk/default.nix b/pkgs/development/python-modules/sentry-sdk/default.nix
index 542178a3cae..e434310f56f 100644
--- a/pkgs/development/python-modules/sentry-sdk/default.nix
+++ b/pkgs/development/python-modules/sentry-sdk/default.nix
@@ -46,7 +46,7 @@
 
 buildPythonPackage rec {
   pname = "sentry-sdk";
-  version = "1.5.12";
+  version = "1.6.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -55,7 +55,7 @@ buildPythonPackage rec {
     owner = "getsentry";
     repo = "sentry-python";
     rev = version;
-    hash = "sha256-8M0FWfvaGp74Fb+qJlhyiJPUVHN2ZdEleZf27d+bftE=";
+    hash = "sha256-X831uMlxvcgxQz8xWQZkJOp/fTmF62J95esJY23DZQw=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/continuous-integration/woodpecker/agent.nix b/pkgs/development/tools/continuous-integration/woodpecker/agent.nix
new file mode 100644
index 00000000000..2865711d507
--- /dev/null
+++ b/pkgs/development/tools/continuous-integration/woodpecker/agent.nix
@@ -0,0 +1,17 @@
+{ lib, buildGoModule, callPackage, fetchFromGitHub }:
+let
+  common = callPackage ./common.nix { };
+in
+buildGoModule {
+  pname = "woodpecker-agent";
+  inherit (common) version src ldflags postBuild;
+  vendorSha256 = null;
+
+  subPackages = "cmd/agent";
+
+  CGO_ENABLED = 0;
+
+  meta = common.meta // {
+    description = "Woodpecker Continuous Integration agent";
+  };
+}
diff --git a/pkgs/development/tools/continuous-integration/woodpecker/cli.nix b/pkgs/development/tools/continuous-integration/woodpecker/cli.nix
new file mode 100644
index 00000000000..b5eda9efb91
--- /dev/null
+++ b/pkgs/development/tools/continuous-integration/woodpecker/cli.nix
@@ -0,0 +1,17 @@
+{ lib, buildGoModule, callPackage, fetchFromGitHub }:
+let
+  common = callPackage ./common.nix { };
+in
+buildGoModule {
+  pname = "woodpecker-cli";
+  inherit (common) version src ldflags postBuild;
+  vendorSha256 = null;
+
+  subPackages = "cmd/cli";
+
+  CGO_ENABLED = 0;
+
+  meta = common.meta // {
+    description = "Command line client for the Woodpecker Continuous Integration server";
+  };
+}
diff --git a/pkgs/development/tools/continuous-integration/woodpecker/common.nix b/pkgs/development/tools/continuous-integration/woodpecker/common.nix
new file mode 100644
index 00000000000..932fa934b1b
--- /dev/null
+++ b/pkgs/development/tools/continuous-integration/woodpecker/common.nix
@@ -0,0 +1,36 @@
+{ lib, fetchFromGitHub }:
+let
+  version = "0.15.3";
+  srcSha256 = "sha256-HOOH3H2SXLcT2oW/xL80TO+ZSI+Haulnznpb4hlCQow=";
+  yarnSha256 = "sha256-x9g0vSoexfknqLejgcNIigmkFnqYsmhcQNTOStcj68o=";
+in
+{
+  inherit version yarnSha256;
+
+  src = fetchFromGitHub {
+    owner = "woodpecker-ci";
+    repo = "woodpecker";
+    rev = "v${version}";
+    sha256 = srcSha256;
+  };
+
+  postBuild = ''
+    cd $GOPATH/bin
+    for f in *; do
+      mv -- "$f" "woodpecker-$f"
+    done
+    cd -
+  '';
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/woodpecker-ci/woodpecker/version.Version=${version}"
+  ];
+
+  meta = with lib; {
+    homepage = "https://woodpecker-ci.org/";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ ambroisie ];
+  };
+}
diff --git a/pkgs/development/tools/continuous-integration/woodpecker/frontend.nix b/pkgs/development/tools/continuous-integration/woodpecker/frontend.nix
new file mode 100644
index 00000000000..267fdc13985
--- /dev/null
+++ b/pkgs/development/tools/continuous-integration/woodpecker/frontend.nix
@@ -0,0 +1,40 @@
+{ lib, callPackage, fetchFromGitHub, fetchYarnDeps, mkYarnPackage }:
+let
+  common = callPackage ./common.nix { };
+in
+mkYarnPackage {
+  pname = "woodpecker-frontend";
+  inherit (common) version;
+
+  src = "${common.src}/web";
+
+  packageJSON = ./woodpecker-package.json;
+  offlineCache = fetchYarnDeps {
+    yarnLock = "${common.src}/web/yarn.lock";
+    sha256 = common.yarnSha256;
+  };
+
+  buildPhase = ''
+    runHook preBuild
+
+    yarn build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    cp -R deps/woodpecker-ci/dist $out
+    echo "${common.version}" > "$out/version"
+
+    runHook postInstall
+  '';
+
+  # Do not attempt generating a tarball for woodpecker-frontend again.
+  doDist = false;
+
+  meta = common.meta // {
+    description = "Woodpecker Continuous Integration server frontend";
+  };
+}
diff --git a/pkgs/development/tools/continuous-integration/woodpecker/server.nix b/pkgs/development/tools/continuous-integration/woodpecker/server.nix
new file mode 100644
index 00000000000..d97412649b5
--- /dev/null
+++ b/pkgs/development/tools/continuous-integration/woodpecker/server.nix
@@ -0,0 +1,27 @@
+{ lib, buildGoModule, callPackage, fetchFromGitHub, woodpecker-frontend }:
+let
+  common = callPackage ./common.nix { };
+in
+buildGoModule {
+  pname = "woodpecker-server";
+  inherit (common) version src ldflags postBuild;
+  vendorSha256 = null;
+
+  postPatch = ''
+    cp -r ${woodpecker-frontend} web/dist
+  '';
+
+  subPackages = "cmd/server";
+
+  CGO_ENABLED = 1;
+
+  passthru = {
+    inherit woodpecker-frontend;
+
+    updateScript = ./update.sh;
+  };
+
+  meta = common.meta // {
+    description = "Woodpecker Continuous Integration server";
+  };
+}
diff --git a/pkgs/development/tools/continuous-integration/woodpecker/update.sh b/pkgs/development/tools/continuous-integration/woodpecker/update.sh
new file mode 100755
index 00000000000..3530ea6c46c
--- /dev/null
+++ b/pkgs/development/tools/continuous-integration/woodpecker/update.sh
@@ -0,0 +1,50 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nix wget prefetch-yarn-deps nix-prefetch-github jq
+
+# shellcheck shell=bash
+
+if [ -n "$GITHUB_TOKEN" ]; then
+    TOKEN_ARGS=(--header "Authorization: token $GITHUB_TOKEN")
+fi
+
+if [[ $# -gt 1 || $1 == -* ]]; then
+    echo "Regenerates packaging data for the woodpecker packages."
+    echo "Usage: $0 [git release tag]"
+    exit 1
+fi
+
+set -x
+
+cd "$(dirname "$0")"
+version="$1"
+
+set -euo pipefail
+
+if [ -z "$version" ]; then
+    version="$(wget -O- "${TOKEN_ARGS[@]}" "https://api.github.com/repos/woodpecker-ci/woodpecker/releases?per_page=1" | jq -r '.[0].tag_name')"
+fi
+
+# strip leading "v"
+version="${version#v}"
+
+# Woodpecker repository
+src_hash=$(nix-prefetch-github woodpecker-ci woodpecker --rev "v${version}" | jq -r .sha256)
+
+# Front-end dependencies
+woodpecker_src="https://raw.githubusercontent.com/woodpecker-ci/woodpecker/v$version"
+wget "${TOKEN_ARGS[@]}" "$woodpecker_src/web/package.json" -O woodpecker-package.json
+
+web_tmpdir=$(mktemp -d)
+trap 'rm -rf "$web_tmpdir"' EXIT
+pushd "$web_tmpdir"
+wget "${TOKEN_ARGS[@]}" "$woodpecker_src/web/yarn.lock"
+yarn_hash=$(prefetch-yarn-deps yarn.lock)
+popd
+
+# Use friendlier hashes
+src_hash=$(nix hash to-sri --type sha256 "$src_hash")
+yarn_hash=$(nix hash to-sri --type sha256 "$yarn_hash")
+
+sed -i -E -e "s#version = \".*\"#version = \"$version\"#" common.nix
+sed -i -E -e "s#srcSha256 = \".*\"#srcSha256 = \"$src_hash\"#" common.nix
+sed -i -E -e "s#yarnSha256 = \".*\"#yarnSha256 = \"$yarn_hash\"#" common.nix
diff --git a/pkgs/development/tools/continuous-integration/woodpecker/woodpecker-package.json b/pkgs/development/tools/continuous-integration/woodpecker/woodpecker-package.json
new file mode 100644
index 00000000000..eb29431a056
--- /dev/null
+++ b/pkgs/development/tools/continuous-integration/woodpecker/woodpecker-package.json
@@ -0,0 +1,63 @@
+{
+  "name": "woodpecker-ci",
+  "author": "Woodpecker CI",
+  "version": "0.0.0",
+  "license": "Apache-2.0",
+  "engines": {
+    "node": ">=14"
+  },
+  "scripts": {
+    "start": "vite",
+    "build": "vite build",
+    "serve": "vite preview",
+    "lint": "eslint --max-warnings 0 --ext .js,.ts,.vue,.json .",
+    "formatcheck": "prettier -c .",
+    "format:fix": "prettier --write .",
+    "typecheck": "vue-tsc --noEmit",
+    "test": "echo 'No tests configured' && exit 0"
+  },
+  "dependencies": {
+    "@kyvg/vue3-notification": "2.3.4",
+    "@meforma/vue-toaster": "1.2.2",
+    "ansi-to-html": "0.7.2",
+    "dayjs": "1.10.7",
+    "floating-vue": "2.0.0-beta.5",
+    "fuse.js": "6.4.6",
+    "humanize-duration": "3.27.0",
+    "javascript-time-ago": "2.3.10",
+    "node-emoji": "1.11.0",
+    "pinia": "2.0.0",
+    "vue": "v3.2.20",
+    "vue-router": "4.0.10"
+  },
+  "devDependencies": {
+    "@iconify/json": "1.1.421",
+    "@types/humanize-duration": "3.27.0",
+    "@types/javascript-time-ago": "2.0.3",
+    "@types/node": "16.11.6",
+    "@types/node-emoji": "1.8.1",
+    "@typescript-eslint/eslint-plugin": "5.6.0",
+    "@typescript-eslint/parser": "5.6.0",
+    "@vitejs/plugin-vue": "1.9.4",
+    "@vue/compiler-sfc": "3.2.20",
+    "eslint": "7.32.0",
+    "eslint-config-airbnb-base": "15.0.0",
+    "eslint-config-airbnb-typescript": "16.1.0",
+    "eslint-config-prettier": "8.3.0",
+    "eslint-plugin-import": "2.25.3",
+    "eslint-plugin-prettier": "4.0.0",
+    "eslint-plugin-promise": "5.1.1",
+    "eslint-plugin-simple-import-sort": "7.0.0",
+    "eslint-plugin-vue": "7.18.0",
+    "eslint-plugin-vue-scoped-css": "1.3.0",
+    "prettier": "2.4.1",
+    "typescript": "4.4.4",
+    "unplugin-icons": "0.12.17",
+    "unplugin-vue-components": "0.17.0",
+    "vite": "2.6.13",
+    "vite-plugin-windicss": "1.4.12",
+    "vite-svg-loader": "3.0.0",
+    "vue-tsc": "0.28.10",
+    "windicss": "3.2.0"
+  }
+}
diff --git a/pkgs/games/itch-setup/default.nix b/pkgs/games/itch-setup/default.nix
deleted file mode 100644
index 55d488bcaac..00000000000
--- a/pkgs/games/itch-setup/default.nix
+++ /dev/null
@@ -1,24 +0,0 @@
-{ lib, writeShellScriptBin, steam-run, fetchurl }:
-let
-
-  pname = "itch-setup";
-  version = "1.26.0";
-
-  src = fetchurl {
-    url = "https://broth.itch.ovh/itch-setup/linux-amd64/${version}/unpacked/default";
-    hash = "sha256-bcJKqhgZK42Irx12BIvbTDMb/DHEOEXljetlDokF7x8=";
-    executable = true;
-  };
-
-in
-(writeShellScriptBin pname ''exec ${steam-run}/bin/steam-run ${src} "$@"'') // {
-
-  passthru = { inherit pname version src; };
-  meta = with lib; {
-    description = "An installer for the itch.io desktop app";
-    homepage = "https://github.com/itchio/itch-setup";
-    license = licenses.mit;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ pasqui23 ];
-  };
-}
diff --git a/pkgs/games/itch/butler.nix b/pkgs/games/itch/butler.nix
new file mode 100644
index 00000000000..68f1bac49e9
--- /dev/null
+++ b/pkgs/games/itch/butler.nix
@@ -0,0 +1,29 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "butler";
+  version = "15.21.0";
+
+  src = fetchFromGitHub {
+    owner = "itchio";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-vciSmXR3wI3KcnC+Uz36AgI/WUfztA05MJv1InuOjJM=";
+  };
+
+  proxyVendor = true;
+
+  vendorSha256 = "sha256-EIl0ZFDKbZopUR22hp5a2vRUu0O1h1O953NrtoNa2x8=";
+
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Command-line itch.io helper";
+    homepage = "https://github.com/itchio/butler";
+    license = licenses.mit;
+    maintainers = with maintainers; [ martfont ];
+  };
+}
diff --git a/pkgs/games/itch/default.nix b/pkgs/games/itch/default.nix
index 34a2775c3c8..991623b6c9f 100644
--- a/pkgs/games/itch/default.nix
+++ b/pkgs/games/itch/default.nix
@@ -1,30 +1,56 @@
 { lib
 , stdenvNoCC
-, fetchurl
-, libnotify
-, nss
-, gtk3
+, fetchpatch
+, fetchzip
 , fetchFromGitHub
+, butler
+, electron_11
+, steam-run
+, makeWrapper
+, copyDesktopItems
 , makeDesktopItem
-, itch-setup
-, runtimeShell
 }:
-stdenvNoCC.mkDerivation rec{
+stdenvNoCC.mkDerivation rec {
   pname = "itch";
   version = "25.5.1";
 
-  src = fetchFromGitHub {
-    owner = "itchio";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-Pi3l3uK4kr+N3p7fGQuqckYIzycRqJHDVX00reoSbp4=";
+  src = fetchzip {
+    url = "https://broth.itch.ovh/${pname}/linux-amd64/${version}/itch.zip";
+    stripRoot = false;
+    sha256 = "sha256-ejfS+sqhacW2h8u96W4fout3V8xrBs0SrW5w/7X83m4=";
   };
 
+  patches = [
+    # Fixes crash while browsing the store.
+    (fetchpatch {
+      name = "itch.patch";
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/itch.patch?h=itch-bin&id=0b181454567029141749f870880b10093216e133";
+      sha256 = "sha256-gmLL/BMondSflERm0z+DuGDP56JhDXiyxEwLUavTD8Q=";
+    })
+  ];
+
+  itch-setup = fetchzip {
+    url = "https://broth.itch.ovh/itch-setup/linux-amd64/1.26.0/itch-setup.zip";
+    stripRoot = false;
+    sha256 = "sha256-5MP6X33Jfu97o5R1n6Og64Bv4ZMxVM0A8lXeQug+bNA=";
+  };
+
+  icons = let sparseCheckout = "/release/images/itch-icons"; in
+    fetchFromGitHub {
+        owner = "itchio";
+        repo = pname;
+        rev = "v${version}";
+        hash = "sha256-1L6STTBHA9xL9IaERaH2OTvurTSng1D+P3KoW0ucEJc=";
+        inherit sparseCheckout;
+      } + sparseCheckout;
+
+  nativeBuildInputs = [ copyDesktopItems makeWrapper ];
+
   desktopItems = [
     (makeDesktopItem {
       name = pname;
-      exec = pname;
-      tryExec = "itch %U";
+      exec = "itch %U";
+      tryExec = pname;
       icon = pname;
       desktopName = pname;
       mimeTypes = [ "x-scheme-handler/itchio" "x-scheme-handler/itch" ];
@@ -33,23 +59,33 @@ stdenvNoCC.mkDerivation rec{
     })
   ];
 
-  itchBin = ''
-    #!${runtimeShell}
-    exec ${itch-setup}/bin/itch-setup --prefer-launch -- "$@"
-  '';
-
-  passAsFile = [ "itchBin" ];
-
-  # as taken from https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=itch
+  # As taken from https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=itch-bin
   installPhase = ''
-    install -Dm0777 $itchBinPath $out/bin/itch
-    for icon in release/images/itch-icons/icon*.png
+    runHook preInstall
+
+    mkdir -p $out/bin $out/share/${pname}/resources/app
+    cp -r resources/app "$out/share/${pname}/resources/"
+
+    install -Dm644 LICENSE -t "$out/share/licenses/$pkgname/"
+    install -Dm644 LICENSES.chromium.html -t "$out/share/licenses/$pkgname/"
+
+    for icon in $icons/icon*.png
     do
-      iconsize="''${icon#release/images/itch-icons/icon}"
+      iconsize="''${icon#$icons/icon}"
       iconsize="''${iconsize%.png}"
       icondir="$out/share/icons/hicolor/''${iconsize}x''${iconsize}/apps/"
       install -Dm644 "$icon" "$icondir/itch.png"
     done
+
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    makeWrapper ${steam-run}/bin/steam-run $out/bin/${pname} \
+      --add-flags ${electron_11}/bin/electron \
+      --add-flags $out/share/${pname}/resources/app \
+      --set BROTH_USE_LOCAL butler,itch-setup \
+      --prefix PATH : ${butler}/bin/:${itch-setup}
   '';
 
   meta = with lib; {
@@ -57,6 +93,7 @@ stdenvNoCC.mkDerivation rec{
     homepage = "https://github.com/itchio/itch";
     license = licenses.mit;
     platforms = platforms.linux;
+    sourceProvenance = lib.sourceTypes.binaryBytecode;
     maintainers = with maintainers; [ pasqui23 ];
   };
 }
diff --git a/pkgs/servers/geospatial/geoserver/default.nix b/pkgs/servers/geospatial/geoserver/default.nix
new file mode 100644
index 00000000000..0fc184e063e
--- /dev/null
+++ b/pkgs/servers/geospatial/geoserver/default.nix
@@ -0,0 +1,38 @@
+{ lib, stdenv, fetchurl, unzip, jre, makeWrapper }:
+
+stdenv.mkDerivation rec {
+  pname = "geoserver";
+  version = "2.21.0";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/geoserver/GeoServer/${version}/geoserver-${version}-bin.zip";
+    sha256 = "sha256-UCr22Ffhnux6eA0w5qoaf5Hvuypsl/FGpK+emi8G0Mc=";
+  };
+
+  sourceRoot = ".";
+  nativeBuildInputs = [ unzip makeWrapper ];
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/share/geoserver
+    cp -r . $out/share/geoserver
+    rm -fr $out/share/geoserver/bin/*.bat
+
+    makeWrapper $out/share/geoserver/bin/startup.sh $out/bin/geoserver-startup \
+      --set JAVA_HOME "${jre}" \
+      --set GEOSERVER_HOME "$out/share/geoserver"
+    makeWrapper $out/share/geoserver/bin/shutdown.sh $out/bin/geoserver-shutdown \
+      --set JAVA_HOME "${jre}" \
+      --set GEOSERVER_HOME "$out/share/geoserver"
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Open source server for sharing geospatial data";
+    homepage = "https://geoserver.org/";
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ sikmir ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/tools/networking/routedns/default.nix b/pkgs/tools/networking/routedns/default.nix
new file mode 100644
index 00000000000..4cf2c9eeeed
--- /dev/null
+++ b/pkgs/tools/networking/routedns/default.nix
@@ -0,0 +1,29 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "routedns";
+  version = "0.1.5";
+
+  src = fetchFromGitHub {
+    owner = "folbricht";
+    repo = "routedns";
+    # https://github.com/folbricht/routedns/issues/237
+    rev = "02f14a567fee2a289810979446f5260b8a31bf73";
+    sha256 = "sha256-oImimNBz1qizUPD6qHi73fGKNCu5cii99GIUo21e+bs=";
+  };
+
+  vendorSha256 = "sha256-T6adpxJgOPGy+UOOlGAAf1gjk1wJxwOc9enfv9X3LBE=";
+
+  subPackages = [ "./cmd/routedns" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/folbricht/routedns";
+    description = "DNS stub resolver, proxy and router";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ jsimonetti ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/tools/nix/nar-serve/default.nix b/pkgs/tools/nix/nar-serve/default.nix
index 1d7fd6beb4a..10ac797578f 100644
--- a/pkgs/tools/nix/nar-serve/default.nix
+++ b/pkgs/tools/nix/nar-serve/default.nix
@@ -4,16 +4,16 @@
 }:
 buildGoModule rec {
   pname = "nar-serve";
-  version = "0.4.0";
+  version = "0.6.1";
 
   src = fetchFromGitHub {
     owner = "numtide";
     repo = "nar-serve";
     rev = "v${version}";
-    hash = "sha256-h/pzKRXgcGTpr1YUKppDa+iTLKak/PGhbYa8ZczWj1U=";
+    hash = "sha256-cSOYHYJJEGzFtkD4mjTmYBiM9CaWKt64xgV/JeNHpfM=";
   };
 
-  vendorSha256 = "sha256-eW+cul/5qJocpKV/6azxj7HTmkezDw6dNubPtAOP5HU=";
+  vendorSha256 = "sha256-RpjLs4+9abbbysYAlPDUXBLe1cz4Lp+QmR1yv+LpYwQ=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/package-management/micromamba/default.nix b/pkgs/tools/package-management/micromamba/default.nix
index c1f8fc9c990..1f95e41e610 100644
--- a/pkgs/tools/package-management/micromamba/default.nix
+++ b/pkgs/tools/package-management/micromamba/default.nix
@@ -63,7 +63,7 @@ stdenv.mkDerivation rec {
     description = "Reimplementation of the conda package manager";
     homepage = "https://github.com/mamba-org/mamba";
     license = licenses.bsd3;
-    platforms = platforms.linux;
+    platforms = platforms.all;
     maintainers = with maintainers; [ mausch ];
   };
 }
diff --git a/pkgs/tools/system/openipmi/default.nix b/pkgs/tools/system/openipmi/default.nix
index 8a8ac04f3ac..228c305de0c 100644
--- a/pkgs/tools/system/openipmi/default.nix
+++ b/pkgs/tools/system/openipmi/default.nix
@@ -18,6 +18,6 @@ stdenv.mkDerivation rec {
     description = "A user-level library that provides a higher-level abstraction of IPMI and generic services";
     license = with licenses; [ gpl2Only lgpl2Only ];
     platforms = platforms.linux;
-    maintainers = with maintainers; [ arezvov SuperSandro2000 ];
+    maintainers = with maintainers; [ arezvov ] ++ teams.c3d2.members;
   };
 }
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 3b2a08673c7..fdf0e40de72 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -619,6 +619,7 @@ mapAliases ({
   iops = throw "iops was removed: upstream is gone"; # Added 2022-02-06
   iproute = iproute2; # moved from top-level 2021-03-14
   ipsecTools = throw "ipsecTools has benn removed, because it was no longer maintained upstream"; # Added 2021-12-15
+  itch-setup = throw "itch-setup has benn removed, use itch instead"; # Added 2022-06-02
 
   ### J ###
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index b72e88a1553..bbaadeb7cfb 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1139,6 +1139,8 @@ with pkgs;
 
   asleap = callPackage ../tools/networking/asleap { };
 
+  butler = callPackage ../games/itch/butler.nix { };
+
   cf-vault = callPackage ../tools/admin/cf-vault { };
 
   bikeshed = python3Packages.callPackage ../applications/misc/bikeshed { };
@@ -2435,8 +2437,6 @@ with pkgs;
 
   itch = callPackage ../games/itch {};
 
-  itch-setup = callPackage ../games/itch-setup {};
-
   lastpass-cli = callPackage ../tools/security/lastpass-cli { };
 
   leetcode-cli = callPackage ../applications/misc/leetcode-cli { };
@@ -7788,14 +7788,6 @@ with pkgs;
 
   mani = callPackage ../development/tools/mani { };
 
-  mapcache = callPackage ../servers/geospatial/mapcache { };
-
-  mapserver = callPackage ../servers/geospatial/mapserver { };
-
-  martin = callPackage ../servers/geospatial/martin {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
-
   mask = callPackage ../development/tools/mask { };
 
   mathpix-snipping-tool = callPackage ../tools/misc/mathpix-snipping-tool { };
@@ -11006,8 +10998,6 @@ with pkgs;
 
   tidy-viewer = callPackage ../tools/text/tidy-viewer { };
 
-  tile38 = callPackage ../servers/geospatial/tile38 { };
-
   tiled = libsForQt5.callPackage ../applications/editors/tiled { };
 
   tiledb = callPackage ../development/libraries/tiledb { };
@@ -11574,6 +11564,14 @@ with pkgs;
 
   woff2 = callPackage ../development/web/woff2 { };
 
+  woodpecker-agent = callPackage ../development/tools/continuous-integration/woodpecker/agent.nix { };
+
+  woodpecker-cli = callPackage ../development/tools/continuous-integration/woodpecker/cli.nix { };
+
+  woodpecker-server = callPackage ../development/tools/continuous-integration/woodpecker/server.nix {
+    woodpecker-frontend = callPackage ../development/tools/continuous-integration/woodpecker/frontend.nix { };
+  };
+
   woof = callPackage ../tools/misc/woof { };
 
   wootility = callPackage ../tools/misc/wootility {
@@ -11622,8 +11620,6 @@ with pkgs;
 
   td = callPackage ../tools/misc/td { };
 
-  tegola = callPackage ../servers/geospatial/tegola {};
-
   tftp-hpa = callPackage ../tools/networking/tftp-hpa {};
 
   tigervnc = callPackage ../tools/admin/tigervnc {};
@@ -13244,10 +13240,6 @@ with pkgs;
 
   remarkable2-toolchain = callPackage ../development/tools/misc/remarkable/remarkable2-toolchain { };
 
-  t-rex = callPackage ../servers/geospatial/t-rex {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
-
   tacacsplus = callPackage ../servers/tacacsplus { };
 
   tamarin-prover =
@@ -21069,6 +21061,8 @@ with pkgs;
 
   tidyp = callPackage ../development/libraries/tidyp { };
 
+  tidal-hifi = callPackage ../applications/audio/tidal-hifi { };
+
   tinycdb = callPackage ../development/libraries/tinycdb { };
 
   tinyxml = tinyxml2;
@@ -22150,8 +22144,6 @@ with pkgs;
 
   mattermost-desktop = callPackage ../applications/networking/instant-messengers/mattermost-desktop { };
 
-  mbtileserver = callPackage ../servers/geospatial/mbtileserver { };
-
   memcached = callPackage ../servers/memcached {};
 
   meteor = callPackage ../servers/meteor { };
@@ -22394,10 +22386,6 @@ with pkgs;
 
   tomcat-native = callPackage ../servers/http/tomcat/tomcat-native.nix { };
 
-  pg_featureserv = callPackage ../servers/geospatial/pg_featureserv { };
-
-  pg_tileserv = callPackage ../servers/geospatial/pg_tileserv { };
-
   pies = callPackage ../servers/pies { };
 
   rpcbind = callPackage ../servers/rpcbind { };
@@ -22990,6 +22978,32 @@ with pkgs;
 
   zipkin = callPackage ../servers/monitoring/zipkin { };
 
+  ### SERVERS / GEOSPATIAL
+
+  geoserver = callPackage ../servers/geospatial/geoserver { };
+
+  mapcache = callPackage ../servers/geospatial/mapcache { };
+
+  mapserver = callPackage ../servers/geospatial/mapserver { };
+
+  martin = callPackage ../servers/geospatial/martin {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
+
+  mbtileserver = callPackage ../servers/geospatial/mbtileserver { };
+
+  pg_featureserv = callPackage ../servers/geospatial/pg_featureserv { };
+
+  pg_tileserv = callPackage ../servers/geospatial/pg_tileserv { };
+
+  t-rex = callPackage ../servers/geospatial/t-rex {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
+
+  tegola = callPackage ../servers/geospatial/tegola { };
+
+  tile38 = callPackage ../servers/geospatial/tile38 { };
+
   ### OS-SPECIFIC
 
   afuse = callPackage ../os-specific/linux/afuse { };
@@ -27709,6 +27723,8 @@ with pkgs;
 
   josm = callPackage ../applications/misc/josm { };
 
+  js8call = qt5.callPackage ../applications/radio/js8call { };
+
   jwm = callPackage ../applications/window-managers/jwm { };
 
   jwm-settings-manager = callPackage ../applications/window-managers/jwm/jwm-settings-manager.nix { };
@@ -29899,6 +29915,10 @@ with pkgs;
 
   robustirc-bridge = callPackage ../servers/irc/robustirc-bridge { };
 
+  routedns = callPackage ../tools/networking/routedns {
+    buildGoModule = buildGo118Module;
+  };
+
   skrooge = libsForQt5.callPackage ../applications/office/skrooge {};
 
   smartgithg = callPackage ../applications/version-management/smartgithg {
@@ -30098,7 +30118,9 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) Security;
   };
 
-  talosctl = callPackage ../applications/networking/cluster/talosctl { };
+  talosctl = callPackage ../applications/networking/cluster/talosctl {
+    buildGoModule = buildGo118Module;
+  };
 
   talentedhack = callPackage ../applications/audio/talentedhack { };