diff --git a/nixos/modules/services/desktops/pipewire/pipewire.nix b/nixos/modules/services/desktops/pipewire/pipewire.nix
index 07b5dd12ffc..dd1f5e3a018 100644
--- a/nixos/modules/services/desktops/pipewire/pipewire.nix
+++ b/nixos/modules/services/desktops/pipewire/pipewire.nix
@@ -234,7 +234,7 @@ in {
     environment.etc."pipewire/pipewire.conf" = {
       source = json.generate "pipewire.conf" configs.pipewire;
     };
-    environment.etc."pipewire/pipewire-pulse.conf" = {
+    environment.etc."pipewire/pipewire-pulse.conf" = mkIf cfg.pulse.enable {
       source = json.generate "pipewire-pulse.conf" configs.pipewire-pulse;
     };
 
@@ -260,5 +260,8 @@ in {
     # https://gitlab.freedesktop.org/pipewire/pipewire/-/issues/464#note_723554
     systemd.services.pipewire.environment."PIPEWIRE_LINK_PASSIVE" = "1";
     systemd.user.services.pipewire.environment."PIPEWIRE_LINK_PASSIVE" = "1";
+
+    # pipewire-pulse default config expects pactl to be in PATH
+    systemd.user.services.pipewire-pulse.path = lib.mkIf cfg.pulse.enable [ pkgs.pulseaudio ];
   };
 }
diff --git a/pkgs/applications/editors/lighttable/default.nix b/pkgs/applications/editors/lighttable/default.nix
deleted file mode 100644
index e2e08a84c88..00000000000
--- a/pkgs/applications/editors/lighttable/default.nix
+++ /dev/null
@@ -1,65 +0,0 @@
-{ stdenv, lib, fetchurl, zlib, glib, alsa-lib, makeDesktopItem
-, dbus, gtk2, atk, pango, freetype, fontconfig, libgnome-keyring3, gdk-pixbuf
-, cairo, cups, expat, libgpg-error, nspr, gnome2, nss, xorg, systemd, libnotify
-}:
-
-let
-  libPath = lib.makeLibraryPath [
-      stdenv.cc.cc zlib glib dbus gtk2 atk pango freetype libgnome-keyring3 nss
-      fontconfig gdk-pixbuf cairo cups expat libgpg-error alsa-lib nspr gnome2.GConf
-      xorg.libXrender xorg.libX11 xorg.libXext xorg.libXdamage xorg.libXtst
-      xorg.libXcomposite xorg.libXi xorg.libXfixes libnotify xorg.libXrandr
-      xorg.libXcursor
-  ];
-  desktopItem = makeDesktopItem {
-    name = "LightTable";
-    exec = "light";
-    comment = "LightTable";
-    desktopName = "LightTable";
-    genericName = "the next generation code editor";
-  };
-in
-
-stdenv.mkDerivation rec {
-  pname = "lighttable";
-  version = "0.8.1";
-
-  src =
-      fetchurl {
-        name = "LightTableLinux64.tar.gz";
-        url = "https://github.com/LightTable/LightTable/releases/download/${version}/${pname}-${version}-linux.tar.gz";
-        sha256 = "06fj725xfhf3fwrf7dya7ijmxq3v76kfmd4lr2067a92zhlwr5pv";
-      };
-
-  dontConfigure = true;
-
-  installPhase = ''
-    tar xf ${src}
-    mkdir -p $out/{bin,share/LightTable}
-    mv ./${pname}-${version}-linux/* $out/share/LightTable
-
-    patchelf \
-      --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-      --set-rpath ${libPath}:${libPath}/lib64:$out/share/LightTable \
-      $out/share/LightTable/LightTable
-
-    mv $out/share/LightTable/light $out/bin/light
-
-    ln -sf ${lib.getLib systemd}/lib/libudev.so.1 $out/share/LightTable/libudev.so.0
-    substituteInPlace $out/bin/light \
-        --replace "/usr/lib/x86_64-linux-gnu" "${lib.getLib systemd}/lib" \
-        --replace "/lib/x86_64-linux-gnu" "$out/share/LightTable" \
-        --replace 'HERE=`dirname $(readlink -f $0)`' "HERE=$out/share/LightTable"
-
-    mkdir -p "$out"/share/applications
-    cp "${desktopItem}/share/applications/LightTable.desktop" "$out"/share/applications/
-  '';
-
-  meta = with lib; {
-    description = "The next generation code editor";
-    homepage = "http://www.lighttable.com/";
-    license = licenses.gpl3;
-    maintainers = [ maintainers.matejc ];
-    platforms = [ "x86_64-linux" ];
-  };
-}
diff --git a/pkgs/applications/networking/cluster/ssm-session-manager-plugin/default.nix b/pkgs/applications/networking/cluster/ssm-session-manager-plugin/default.nix
index 1fd71cb8e99..a3c8bc70661 100644
--- a/pkgs/applications/networking/cluster/ssm-session-manager-plugin/default.nix
+++ b/pkgs/applications/networking/cluster/ssm-session-manager-plugin/default.nix
@@ -1,13 +1,13 @@
 { stdenv, lib, fetchurl, autoPatchelfHook, dpkg, awscli, unzip }:
 let
-  ver = "1.2.312.0";
+  ver = "1.2.331.0";
   source =
     if stdenv.isDarwin then {
       url = "https://s3.amazonaws.com/session-manager-downloads/plugin/${ver}/mac/sessionmanager-bundle.zip";
-      sha256 = "50aac34a4dedddf20c20be24989ee5d33b46a72187791715fb9b395b54db8ef9";
+      sha256 = "0gr6frdn9jvxnkymkcpvgkqw4z2sac9jdf5qj4hzakq1zkfviazf";
     } else {
       url = "https://s3.amazonaws.com/session-manager-downloads/plugin/${ver}/ubuntu_64bit/session-manager-plugin.deb";
-      sha256 = "2e51ce5bf8f23a1e590fff866bbdadcf82aa03c5054c671d9115482a1b263cc7";
+      sha256 = "sha256-xWnY89dslkGhRTh9llRFkuUqYIjHQNt+TLnkPQr3u1Q=";
     };
   archivePath = if stdenv.isDarwin then "sessionmanager-bundle" else "usr/local/sessionmanagerplugin";
 in
diff --git a/pkgs/applications/networking/cluster/terraform/default.nix b/pkgs/applications/networking/cluster/terraform/default.nix
index 0532dd84868..a281505e0ec 100644
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@@ -192,9 +192,9 @@ rec {
   };
 
   terraform_1 = mkTerraform {
-    version = "1.2.2";
-    sha256 = "sha256-LkRCumyNHVBSsXRp1ovNMGCeidK/jVCjh9H1HSE1Lm8=";
-    vendorSha256 = "sha256-CVgAmPM0nt0Wx+N0qs+IO5KwCWnbfif70EHjBi0bIsQ=";
+    version = "1.2.3";
+    sha256 = "sha256-hkPlufjlvmI5tKz1VTY5RztuDKEsgjrLR+f7HRrJmkA=";
+    vendorSha256 = "sha256-1RKnNF3NC0fGiU2VKz43UBGP33QrLxESVuH6IV6kYqA=";
     patches = [ ./provider-path-0_15.patch ];
     passthru = {
       inherit plugins;
diff --git a/pkgs/applications/science/math/giac/default.nix b/pkgs/applications/science/math/giac/default.nix
index d684865432d..434291861d6 100644
--- a/pkgs/applications/science/math/giac/default.nix
+++ b/pkgs/applications/science/math/giac/default.nix
@@ -43,6 +43,9 @@ stdenv.mkDerivation rec {
     rm src/mkjs
     substituteInPlace src/Makefile.am --replace "g++ mkjs.cc" \
       "${buildPackages.stdenv.cc.targetPrefix}c++ mkjs.cc"
+
+    # to open help
+    substituteInPlace src/global.cc --replace 'browser="mozilla"' 'browser="xdg-open"'
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/video/mkvtoolnix/default.nix b/pkgs/applications/video/mkvtoolnix/default.nix
index d9a8a843693..7bd010cff15 100644
--- a/pkgs/applications/video/mkvtoolnix/default.nix
+++ b/pkgs/applications/video/mkvtoolnix/default.nix
@@ -47,13 +47,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "mkvtoolnix";
-  version = "67.0.0";
+  version = "68.0.0";
 
   src = fetchFromGitLab {
     owner = "mbunkus";
     repo = "mkvtoolnix";
     rev = "release-${version}";
-    sha256 = "0gyjgp5iyr9kvgpgl064w025ji1w8dy0cnw4fmbp71wis7qp7yl1";
+    sha256 = "0m09r0w98dja9y1yp1vq5hdh46lw0k60aa0xfkdy5zlva568cb7c";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/video/wxcam/default.nix b/pkgs/applications/video/wxcam/default.nix
deleted file mode 100644
index 5a6c6ff524e..00000000000
--- a/pkgs/applications/video/wxcam/default.nix
+++ /dev/null
@@ -1,51 +0,0 @@
-{ lib, stdenv, fetchurl
-, pkg-config
-, intltool
-, libX11, libXv, libSM
-, gtk, libglade
-, wxGTK
-, perlPackages
-, xvidcore
-, mjpegtools
-, alsa-lib
-, libv4l
-, cimg }:
-
-stdenv.mkDerivation rec {
-
-  pname = "wxcam";
-  version = "1.1";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/project/wxcam/wxcam/${version}/${pname}-${version}.tar.gz";
-    sha256 = "1765bvc65fpzn9ycnnj5hais9xkx9v0sm6a878d35x54bpanr859";
-  };
-
-  buildInputs = with lib;
-  [ pkg-config intltool libX11 libXv libSM gtk libglade wxGTK perlPackages.XMLParser xvidcore mjpegtools alsa-lib libv4l cimg ];
-
-  NIX_CFLAGS_COMPILE="-I ${cimg}/include/cimg";
-
-  postUnpack = ''
-    sed -ie 's|/usr/share/|'"$out/share/"'|g' $sourceRoot/Makefile.in
-  '';
-
-  installPhase = ''
-    make install prefix="$out" wxcamdocdir="$out/share/doc/wxcam"
-  '';
-
-  meta = with lib; {
-    description = "An open-source, wxGTK-based webcam app for Linux";
-    longDescription = ''
-    wxCam is a webcam application for linux. It supports video recording
-    (avi uncompressed and Xvid formats), snapshot taking, and some special
-    commands for philips webcams, so you can also use it for astronomy purposes.
-    It supports both video4linux 1 and 2 drivers,
-    so it should work on a very large number of devices.
-    '';
-    homepage = "http://wxcam.sourceforge.net/";
-    license = licenses.gpl3Plus;
-    maintainers = [ maintainers.AndersonTorres ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/applications/virtualization/podman/default.nix b/pkgs/applications/virtualization/podman/default.nix
index 0c9ecf7e4d8..d663d0ec8b7 100644
--- a/pkgs/applications/virtualization/podman/default.nix
+++ b/pkgs/applications/virtualization/podman/default.nix
@@ -17,13 +17,13 @@
 
 buildGoModule rec {
   pname = "podman";
-  version = "4.1.0";
+  version = "4.1.1";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "podman";
     rev = "v${version}";
-    sha256 = "sha256-3MR4ZhkhMLAK3KHu7JEV9z1/wlyCkxfx1i267TGxwt8=";
+    sha256 = "sha256-+lwq4WTPeELjugTg9l1wvoe0VTqRK2lC1jaFIwXMrL0=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/build-support/node/fetch-yarn-deps/index.js b/pkgs/build-support/node/fetch-yarn-deps/index.js
index f3662a54361..b66e1220218 100755
--- a/pkgs/build-support/node/fetch-yarn-deps/index.js
+++ b/pkgs/build-support/node/fetch-yarn-deps/index.js
@@ -33,11 +33,11 @@ const urlToName = url => {
 	}
 }
 
-const downloadFileHttps = (fileName, url, expectedHash) => {
+const downloadFileHttps = (fileName, url, expectedHash, hashType = 'sha1') => {
 	return new Promise((resolve, reject) => {
 		https.get(url, (res) => {
 			const file = fs.createWriteStream(fileName)
-			const hash = crypto.createHash('sha1')
+			const hash = crypto.createHash(hashType)
 			res.pipe(file)
 			res.pipe(hash).setEncoding('hex')
 			res.on('end', () => {
@@ -100,6 +100,10 @@ const downloadPkg = (pkg, verbose) => {
 	} else if (isGitUrl(url)) {
 		return downloadGit(fileName, url.replace(/^git\+/, ''), hash)
 	} else if (url.startsWith('https://')) {
+		if (typeof pkg.integrity === 'string' || pkg.integrity instanceof String) {
+			const [ type, checksum ] = pkg.integrity.split('-')
+			return downloadFileHttps(fileName, url, Buffer.from(checksum, 'base64').toString('hex'), type)
+		}
 		return downloadFileHttps(fileName, url, hash)
 	} else if (url.startsWith('file:')) {
 		console.warn(`ignoring unsupported file:path url "${url}"`)
diff --git a/pkgs/data/fonts/unifont/default.nix b/pkgs/data/fonts/unifont/default.nix
index 808d96ce446..b8a78096466 100644
--- a/pkgs/data/fonts/unifont/default.nix
+++ b/pkgs/data/fonts/unifont/default.nix
@@ -4,16 +4,16 @@
 
 stdenv.mkDerivation rec {
   pname = "unifont";
-  version = "14.0.03";
+  version = "14.0.04";
 
   ttf = fetchurl {
     url = "mirror://gnu/unifont/${pname}-${version}/${pname}-${version}.ttf";
-    sha256 = "1qyc7nqyhjnarwgpkah52qv7hr0yfzak7084ilrj7z0nii4f5y57";
+    hash = "sha256-IR0d3dxWZRHbJUx0bYPfd7ShubJUnN/+Cj6QHkbu/qg=";
   };
 
   pcf = fetchurl {
     url = "mirror://gnu/unifont/${pname}-${version}/${pname}-${version}.pcf.gz";
-    sha256 = "1sgvxpr4ydjnbk70j0lpgxz5x851lmrmxjb5x8lsz0i2hm32jdbc";
+    hash = "sha256-Q5lR7hX4+P+Q9fVDjw9GtLGqUIslsKOWnn8je85fH+0=";
   };
 
   nativeBuildInputs = [ libfaketime fonttosfnt mkfontscale ];
diff --git a/pkgs/data/fonts/unifont_upper/default.nix b/pkgs/data/fonts/unifont_upper/default.nix
index 84a1742b843..1020c2f1f13 100644
--- a/pkgs/data/fonts/unifont_upper/default.nix
+++ b/pkgs/data/fonts/unifont_upper/default.nix
@@ -1,15 +1,19 @@
-{ lib, fetchzip }:
+{ lib, fetchurl }:
 
 let
-  version = "14.0.03";
-in fetchzip rec {
+  version = "14.0.04";
+in fetchurl rec {
   name = "unifont_upper-${version}";
 
   url = "mirror://gnu/unifont/unifont-${version}/${name}.ttf";
 
+  downloadToTemp = true;
+
+  recursiveHash = true;
+
   postFetch = "install -Dm644 $downloadedFile $out/share/fonts/truetype/unifont_upper.ttf";
 
-  sha256 = "1lwx7syb9ij4dlqiiybp6xgvar2sszxphvaqh64vivzj9gp0g0ai";
+  hash = "sha256-cNw+3Y/6h2TD6ZSaGO32NNyiTwCUSJsA3Q5W5/m+eLE=";
 
   meta = with lib; {
     description = "Unicode font for glyphs above the Unicode Basic Multilingual Plane";
diff --git a/pkgs/desktops/gnome/apps/ghex/default.nix b/pkgs/desktops/gnome/apps/ghex/default.nix
index 5a0722af21c..58659d1748e 100644
--- a/pkgs/desktops/gnome/apps/ghex/default.nix
+++ b/pkgs/desktops/gnome/apps/ghex/default.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ghex";
-  version = "42.2";
+  version = "42.3";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/ghex/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "Rd6Oa4ofMd5amRC+GMB/CaMo2HU434BAOuxa+IF8ljE=";
+    sha256 = "rdQPirJJIdsw0nvljwAnMgGXfYf9yNeezq36iw41Te8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gtksourceview/5.x.nix b/pkgs/development/libraries/gtksourceview/5.x.nix
index 29d85980acc..307fb15e98d 100644
--- a/pkgs/development/libraries/gtksourceview/5.x.nix
+++ b/pkgs/development/libraries/gtksourceview/5.x.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gtksourceview";
-  version = "5.4.1";
+  version = "5.4.2";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "6zWECZz6CtyaCx7eCN72MgvQmeeedKLQrvtAV82T1o4=";
+    sha256 = "rRQOB+uEGRDeSDwJK9SIWr0puq3W6V+iLZPtLfC3nec=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/qt-5/5.12/default.nix b/pkgs/development/libraries/qt-5/5.12/default.nix
index 2b8dccf162c..da54865a18b 100644
--- a/pkgs/development/libraries/qt-5/5.12/default.nix
+++ b/pkgs/development/libraries/qt-5/5.12/default.nix
@@ -19,6 +19,7 @@ top-level attribute to `top-level/all-packages.nix`.
 , bison, cups ? null, harfbuzz, libGL, perl
 , gstreamer, gst-plugins-base, gtk3, dconf
 , darwin
+, buildPackages
 
   # options
 , developerBuild ? false
@@ -236,7 +237,7 @@ let
       } ../hooks/qmake-hook.sh;
 
       wrapQtAppsHook = makeSetupHook {
-        deps = [ self.qtbase.dev makeWrapper ]
+        deps = [ self.qtbase.dev buildPackages.makeWrapper ]
           ++ lib.optional stdenv.isLinux self.qtwayland.dev;
       } ../hooks/wrap-qt-apps-hook.sh;
     };
diff --git a/pkgs/development/libraries/qt-5/5.14/default.nix b/pkgs/development/libraries/qt-5/5.14/default.nix
index b95d49fef87..59b04b6a52c 100644
--- a/pkgs/development/libraries/qt-5/5.14/default.nix
+++ b/pkgs/development/libraries/qt-5/5.14/default.nix
@@ -19,6 +19,7 @@ top-level attribute to `top-level/all-packages.nix`.
 , bison, cups ? null, harfbuzz, libGL, perl
 , gstreamer, gst-plugins-base, gtk3, dconf
 , darwin
+, buildPackages
 
   # options
 , developerBuild ? false
@@ -234,7 +235,7 @@ let
       } ../hooks/qmake-hook.sh;
 
       wrapQtAppsHook = makeSetupHook {
-        deps = [ self.qtbase.dev makeWrapper ]
+        deps = [ self.qtbase.dev buildPackages.makeWrapper ]
           ++ lib.optional stdenv.isLinux self.qtwayland.dev;
       } ../hooks/wrap-qt-apps-hook.sh;
     };
diff --git a/pkgs/development/libraries/qt-5/5.15/default.nix b/pkgs/development/libraries/qt-5/5.15/default.nix
index 763bfc675cb..02b1b0db99b 100644
--- a/pkgs/development/libraries/qt-5/5.15/default.nix
+++ b/pkgs/development/libraries/qt-5/5.15/default.nix
@@ -12,6 +12,7 @@ Check for any minor version changes.
 , bison, cups ? null, harfbuzz, libGL, perl
 , gstreamer, gst-plugins-base, gtk3, dconf
 , darwin
+, buildPackages
 
   # options
 , developerBuild ? false
@@ -192,7 +193,7 @@ let
       } ../hooks/qmake-hook.sh;
 
       wrapQtAppsHook = makeSetupHook {
-        deps = [ self.qtbase.dev makeWrapper ]
+        deps = [ self.qtbase.dev buildPackages.makeWrapper ]
           ++ lib.optional stdenv.isLinux self.qtwayland.dev;
       } ../hooks/wrap-qt-apps-hook.sh;
     };
diff --git a/pkgs/development/libraries/qt-6/default.nix b/pkgs/development/libraries/qt-6/default.nix
index 5dbb241c6c5..8c12cc2fb67 100644
--- a/pkgs/development/libraries/qt-6/default.nix
+++ b/pkgs/development/libraries/qt-6/default.nix
@@ -19,6 +19,7 @@
 , gst-plugins-base
 , gtk3
 , dconf
+, buildPackages
 
   # options
 , developerBuild ? false
@@ -84,7 +85,7 @@ let
       qtwebview = callPackage ./modules/qtwebview.nix { };
 
       wrapQtAppsHook = makeSetupHook {
-          deps = [ makeWrapper ];
+          deps = [ buildPackages.makeWrapper ];
         } ./hooks/wrap-qt-apps-hook.sh;
     };
 
diff --git a/pkgs/development/libraries/rapidjson/default.nix b/pkgs/development/libraries/rapidjson/default.nix
index 1211892890a..49cbc7ab764 100644
--- a/pkgs/development/libraries/rapidjson/default.nix
+++ b/pkgs/development/libraries/rapidjson/default.nix
@@ -1,4 +1,11 @@
-{ stdenv, lib, fetchFromGitHub, fetchpatch, pkg-config, cmake }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, pkg-config
+, cmake
+, gtest
+}:
 
 stdenv.mkDerivation rec {
   pname = "rapidjson";
@@ -16,20 +23,42 @@ stdenv.mkDerivation rec {
       url = "https://src.fedoraproject.org/rpms/rapidjson/raw/48402da9f19d060ffcd40bf2b2e6987212c58b0c/f/rapidjson-1.1.0-c++20.patch";
       sha256 = "1qm62iad1xfsixv1li7qy475xc7gc04hmi2q21qdk6l69gk7mf82";
     })
+    (fetchpatch {
+      url = "https://git.alpinelinux.org/aports/plain/community/rapidjson/do-not-include-gtest-src-dir.patch";
+      hash = "sha256-BjSZEwfCXA/9V+kxQ/2JPWbc26jQn35CfN8+8NW24s4=";
+    })
   ];
 
+  postPatch = ''
+    find -name CMakeLists.txt | xargs \
+      sed -i -e "s/-Werror//g" -e "s/-march=native//g"
+  '';
+
   nativeBuildInputs = [ pkg-config cmake ];
 
-  preConfigure = ''
-    substituteInPlace CMakeLists.txt --replace "-Werror" ""
-    substituteInPlace example/CMakeLists.txt --replace "-Werror" ""
+  cmakeFlags = [
+    "-DGTEST_SOURCE_DIR=${gtest.dev}/include"
+  ];
+
+  checkInputs = [
+    gtest
+  ];
+
+  checkPhase = ''
+    runHook preCheck
+
+    ctest -E '.*valgrind.*'
+
+    runHook postCheck
   '';
 
+  doCheck = true;
+
   meta = with lib; {
     description = "Fast JSON parser/generator for C++ with both SAX/DOM style API";
     homepage = "http://rapidjson.org/";
     license = licenses.mit;
     platforms = platforms.unix;
-    maintainers = with maintainers; [ cstrahan ];
+    maintainers = with maintainers; [ cstrahan dotlambda ];
   };
 }
diff --git a/pkgs/development/python-modules/anyio/default.nix b/pkgs/development/python-modules/anyio/default.nix
index a9ae447d45f..fde9fe67fcc 100644
--- a/pkgs/development/python-modules/anyio/default.nix
+++ b/pkgs/development/python-modules/anyio/default.nix
@@ -4,6 +4,7 @@
 , fetchFromGitHub
 , fetchpatch
 , pythonOlder
+, setuptools
 , setuptools-scm
 , idna
 , sniffio
@@ -44,6 +45,7 @@ buildPythonPackage rec {
   '';
 
   nativeBuildInputs = [
+    setuptools
     setuptools-scm
   ];
 
diff --git a/pkgs/development/python-modules/libversion/default.nix b/pkgs/development/python-modules/libversion/default.nix
index a492ea7806a..5fb33fa5477 100644
--- a/pkgs/development/python-modules/libversion/default.nix
+++ b/pkgs/development/python-modules/libversion/default.nix
@@ -3,6 +3,7 @@
 , fetchFromGitHub
 , libversion
 , pkg-config
+, pytestCheckHook
 , pythonOlder
 }:
 
@@ -20,6 +21,11 @@ buildPythonPackage rec {
     sha256 = "sha256-p0wtSB+QXAERf+57MMb8cqWoy1bG3XaCpR9GPwYYvJM=";
   };
 
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "'pkg-config'" "'$(command -v $PKG_CONFIG)'"
+  '';
+
   nativeBuildInputs = [
     pkg-config
   ];
@@ -28,6 +34,15 @@ buildPythonPackage rec {
     libversion
   ];
 
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  preCheck = ''
+    # import from $out
+    rm -r libversion
+  '';
+
   pythonImportsCheck = [
     "libversion"
   ];
diff --git a/pkgs/development/python-modules/nbxmpp/default.nix b/pkgs/development/python-modules/nbxmpp/default.nix
index c94c7a0b01b..68eebbada8a 100644
--- a/pkgs/development/python-modules/nbxmpp/default.nix
+++ b/pkgs/development/python-modules/nbxmpp/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "nbxmpp";
-  version = "3.0.2";
+  version = "3.1.0";
 
   disabled = pythonOlder "3.7";
 
@@ -21,8 +21,8 @@ buildPythonPackage rec {
     domain = "dev.gajim.org";
     owner = "gajim";
     repo = "python-nbxmpp";
-    rev = "nbxmpp-${version}";
-    sha256 = "sha256:0wvganymqw90y9mz5a5mh531r2s9z0vrkbfspx5akk98syaq6f5p";
+    rev = version;
+    sha256 = "sha256-QnvV/sAxdl8V5nV1hk8sRrL6nn015dAy6cXAiy2Tmbs=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/pad4pi/default.nix b/pkgs/development/python-modules/pad4pi/default.nix
new file mode 100644
index 00000000000..a0ac82a9f16
--- /dev/null
+++ b/pkgs/development/python-modules/pad4pi/default.nix
@@ -0,0 +1,24 @@
+{ lib, buildPythonPackage, fetchPypi, rpi-gpio }:
+
+buildPythonPackage rec {
+  pname = "pad4pi";
+  version = "1.1.5";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-+oVYlqF5PQAFz4EO1ap6pjmYTLg9xQy6UbQja4utt2Q=";
+  };
+
+  propagatedBuildInputs = [ rpi-gpio ];
+
+  # Checks depend on rpi-gpio which requires to be run on a Raspberry Pi,
+  # therefore it fails on other systems
+  doCheck = false;
+
+  meta = with lib; {
+    homepage = "https://github.com/brettmclean/pad4pi";
+    description = "Interrupt-based matrix keypad library for Raspberry Pi";
+    license = licenses.lgpl3;
+    maintainers = with maintainers; [ onny ];
+  };
+}
diff --git a/pkgs/development/python-modules/pyfuse3/default.nix b/pkgs/development/python-modules/pyfuse3/default.nix
index bdb420313ba..07ba27c0ef7 100644
--- a/pkgs/development/python-modules/pyfuse3/default.nix
+++ b/pkgs/development/python-modules/pyfuse3/default.nix
@@ -27,6 +27,11 @@ buildPythonPackage rec {
     hash = "sha256-JGbp2bSI/Rvyys1xMd2o34KlqqBsV6B9LhuuNopayYA=";
   };
 
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "'pkg-config'" "'$(command -v $PKG_CONFIG)'"
+  '';
+
   nativeBuildInputs = [
     cython
     pkg-config
diff --git a/pkgs/development/python-modules/python-rapidjson/default.nix b/pkgs/development/python-modules/python-rapidjson/default.nix
index 35d11e981e4..a9423a7a58d 100644
--- a/pkgs/development/python-modules/python-rapidjson/default.nix
+++ b/pkgs/development/python-modules/python-rapidjson/default.nix
@@ -1,37 +1,58 @@
 { lib
 , buildPythonPackage
+, fetchFromGitHub
+, fetchpatch
 , fetchPypi
 , pythonOlder
-, pytest
+, rapidjson
+, pytestCheckHook
 , pytz
 , glibcLocales
 }:
 
-buildPythonPackage rec {
+let
+  rapidjson' = rapidjson.overrideAttrs (old: {
+    version = "unstable-2022-05-24";
+    src = fetchFromGitHub {
+      owner = "Tencent";
+      repo = "rapidjson";
+      rev = "232389d4f1012dddec4ef84861face2d2ba85709";
+      hash = "sha256-RLvDcInUa8E8DRA4U/oXEE8+TZ0SDXXDU/oWvpfDWjw=";
+    };
+    patches = [
+      (fetchpatch {
+        url = "https://git.alpinelinux.org/aports/plain/community/rapidjson/do-not-include-gtest-src-dir.patch";
+        hash = "sha256-BjSZEwfCXA/9V+kxQ/2JPWbc26jQn35CfN8+8NW24s4=";
+      })
+    ];
+  });
+in buildPythonPackage rec {
   version = "1.6";
   pname = "python-rapidjson";
-  disabled = pythonOlder "3.4";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
     sha256 = "sha256-GJzxqWv5/NhtADYPFa12qDzgiJuK6NHLD9srKZXlocg=";
   };
 
-  LC_ALL="en_US.utf-8";
-  buildInputs = [ glibcLocales ];
+  setupPyBuildFlags = [
+    "--rj-include-dir=${lib.getDev rapidjson'}/include"
+  ];
 
-  # buildInputs = [ ];
-  checkInputs = [ pytest pytz ];
-  # propagatedBuildInputs = [ ];
+  checkInputs = [
+    pytestCheckHook
+    pytz
+  ];
 
-  checkPhase = ''
-    pytest tests
-  '';
+  disabledTestPaths = [
+    "benchmarks"
+  ];
 
   meta = with lib; {
     homepage = "https://github.com/python-rapidjson/python-rapidjson";
-    description = "Python wrapper around rapidjson ";
+    description = "Python wrapper around rapidjson";
     license = licenses.mit;
-    maintainers = [ maintainers.costrouc ];
+    maintainers = with maintainers; [ costrouc dotlambda ];
   };
 }
diff --git a/pkgs/development/python-modules/rplcd/default.nix b/pkgs/development/python-modules/rplcd/default.nix
new file mode 100644
index 00000000000..c404317f027
--- /dev/null
+++ b/pkgs/development/python-modules/rplcd/default.nix
@@ -0,0 +1,24 @@
+{ lib, buildPythonPackage, fetchPypi }:
+
+buildPythonPackage rec {
+  pname = "rplcd";
+  version = "1.3.0";
+
+  src = fetchPypi {
+    inherit version;
+    pname = "RPLCD";
+    sha256 = "sha256-AIEiL+IPU76DF+P08c5qokiJcZdNNDJ/Jjng2Z292LY=";
+  };
+
+  # Disable check because it depends on a GPIO library
+  doCheck = false;
+
+  meta = with lib; {
+    homepage = "https://github.com/dbrgn/RPLCD";
+    description = ''
+      Raspberry Pi LCD library for the widely used Hitachi HD44780 controller
+    '';
+    license = licenses.mit;
+    maintainers = with maintainers; [ onny ];
+  };
+}
diff --git a/pkgs/development/tools/analysis/tfsec/default.nix b/pkgs/development/tools/analysis/tfsec/default.nix
index 9dc35bcb789..2d68fc2c461 100644
--- a/pkgs/development/tools/analysis/tfsec/default.nix
+++ b/pkgs/development/tools/analysis/tfsec/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "tfsec";
-  version = "1.24.0";
+  version = "1.25.1";
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-puH8MoY04OokEcHMn93i/7jBIYbXtYBh2BcBwmBZJVs=";
+    sha256 = "sha256-OgmVqwXIGtqzS27QfEeP9k4Ijwt5kXdq8Gocie5Zpqg=";
   };
 
   ldflags = [
@@ -21,7 +21,7 @@ buildGoModule rec {
     # "-extldflags '-fno-PIC -static'"
   ];
 
-  vendorSha256 = "sha256-Y6ZsLezx7rhGFkWVBpwYlfXWJU9V4u4lJ4AsyJbXTUk=";
+  vendorSha256 = "sha256-dOfosQ0pwGgBwVtySKL0oqSMjxR7zIeZnpspo2rzfyY=";
 
   subPackages = [
     "cmd/tfsec"
diff --git a/pkgs/development/tools/build-managers/scala-cli/default.nix b/pkgs/development/tools/build-managers/scala-cli/default.nix
index 1eb6b92cbd4..314acfe71ff 100644
--- a/pkgs/development/tools/build-managers/scala-cli/default.nix
+++ b/pkgs/development/tools/build-managers/scala-cli/default.nix
@@ -1,5 +1,16 @@
-{ stdenv, coreutils, lib, installShellFiles, zlib, autoPatchelfHook, fetchurl, callPackage }:
+{ stdenv
+, coreutils
+, lib
+, installShellFiles
+, zlib
+, autoPatchelfHook
+, fetchurl
+, makeWrapper
+, callPackage
+, jre
+}:
 
+assert lib.versionAtLeast jre.version "17.0.0";
 let
   pname = "scala-cli";
   sources = builtins.fromJSON (builtins.readFile ./sources.json);
@@ -9,7 +20,7 @@ let
 in
 stdenv.mkDerivation {
   inherit pname version;
-  nativeBuildInputs = [ installShellFiles ]
+  nativeBuildInputs = [ installShellFiles makeWrapper ]
     ++ lib.optional stdenv.isLinux autoPatchelfHook;
   buildInputs = [ coreutils zlib stdenv.cc.cc ];
   src =
@@ -28,7 +39,9 @@ stdenv.mkDerivation {
 
   installPhase = ''
     runHook preInstall
-    install -Dm755 scala-cli $out/bin/scala-cli
+    install -Dm755 scala-cli $out/bin/.scala-cli-wrapped
+    makeWrapper $out/bin/.scala-cli-wrapped $out/bin/scala-cli \
+      --set JAVA_HOME ${jre.home}
     runHook postInstall
   '';
 
diff --git a/pkgs/development/tools/build-managers/scala-cli/sources.json b/pkgs/development/tools/build-managers/scala-cli/sources.json
index 464675569fd..5bf6e5f3e2f 100644
--- a/pkgs/development/tools/build-managers/scala-cli/sources.json
+++ b/pkgs/development/tools/build-managers/scala-cli/sources.json
@@ -1,13 +1,13 @@
 {
-  "version": "0.1.7",
+  "version": "0.1.8",
   "assets": {
     "x86_64-darwin": {
       "asset": "scala-cli-x86_64-apple-darwin.gz",
-      "sha256": "1sly3s9y742nms8kqwh2cikjkcnbkkafsql8sw2w2zr53z28g10v"
+      "sha256": "1dxhwhdk7kflzn4ckqxfxkz4v26l39ki6ykpml6k6kvy3nn0wwz3"
     },
     "x86_64-linux": {
       "asset": "scala-cli-x86_64-pc-linux.gz",
-      "sha256": "1lgcbxzhwqfnj6n81w1ssdcrn1j0c93chqgh0zzqi08w8wk3x4j5"
+      "sha256": "0hj22lcmbbfgv69k778myb0kp79gbg7xx9a3b66g3svxmanlbvxf"
     }
   }
 }
diff --git a/pkgs/development/tools/continuous-integration/github-runner/default.nix b/pkgs/development/tools/continuous-integration/github-runner/default.nix
index 8718cd8dc80..c8208dc18e4 100644
--- a/pkgs/development/tools/continuous-integration/github-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/github-runner/default.nix
@@ -46,13 +46,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "github-runner";
-  version = "2.292.0";
+  version = "2.293.0";
 
   src = fetchFromGitHub {
     owner = "actions";
     repo = "runner";
     rev = "v${version}";
-    hash = "sha256-vmHUu4coAxFLfi+G4xLjy3+LzFnmGllhWhCXcWuDQnc=";
+    hash = "sha256-5XAlKCtIvHzaJCPVO0WsrUGKnYUNR+roqzJ+jrcBfVM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/pip-audit/default.nix b/pkgs/development/tools/pip-audit/default.nix
index 06d536c7433..02b06c61c8a 100644
--- a/pkgs/development/tools/pip-audit/default.nix
+++ b/pkgs/development/tools/pip-audit/default.nix
@@ -25,14 +25,14 @@ with py.pkgs;
 
 buildPythonApplication rec {
   pname = "pip-audit";
-  version = "2.3.1";
+  version = "2.3.2";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "trailofbits";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-W7g2ZV1Xf1s5sGRJiZdQcreBD6zp1/VRQPGs+VIOJE0=";
+    hash = "sha256-BcbTu4vDA7ry87gQXpFk3MvH0eFNNgOBf1SlxNUFDbw=";
   };
 
   nativeBuildInputs = [
@@ -48,6 +48,7 @@ buildPythonApplication rec {
     pip-api
     progress
     resolvelib
+    rich
   ];
 
   checkInputs = [
diff --git a/pkgs/games/freeciv/default.nix b/pkgs/games/freeciv/default.nix
index f5c1ff0ea3f..b1d215912a0 100644
--- a/pkgs/games/freeciv/default.nix
+++ b/pkgs/games/freeciv/default.nix
@@ -1,7 +1,8 @@
 { lib, stdenv, fetchFromGitHub, autoreconfHook, lua5_3, pkg-config, python3
-, zlib, bzip2, curl, xz, gettext, libiconv
-, sdlClient ? true, SDL, SDL_mixer, SDL_image, SDL_ttf, SDL_gfx, freetype, fluidsynth
-, gtkClient ? false, gtk3, wrapGAppsHook
+, zlib, bzip2, curl, xz, gettext, libiconv, icu
+, SDL2, SDL2_mixer, SDL2_image, SDL2_ttf, SDL2_gfx, freetype, fluidsynth
+, sdl2Client ? false
+, gtkClient ? true, gtk3, wrapGAppsHook
 , qtClient ? false, qt5
 , server ? true, readline
 , enableSqlite ? true, sqlite
@@ -9,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "freeciv";
-  version = "2.6.6";
+  version = "3.0.1";
 
   src = fetchFromGitHub {
     owner = "freeciv";
     repo = "freeciv";
     rev = "R${lib.replaceStrings [ "." ] [ "_" ] version}";
-    sha256 = "sha256-D5t6sMpm09jbixs5MCghBeDbeuRbGmrrfWR91VNolRM=";
+    sha256 = "sha256-Nzc6Tirj6TKLgTYN5XjZZut9HVYLKGOp1GZeaoqEtW8=";
   };
 
   postPatch = ''
@@ -29,8 +30,8 @@ stdenv.mkDerivation rec {
     ++ lib.optional qtClient [ qt5.wrapQtAppsHook ]
     ++ lib.optional gtkClient [ wrapGAppsHook ];
 
-  buildInputs = [ lua5_3 zlib bzip2 curl xz gettext libiconv ]
-    ++ lib.optionals sdlClient [ SDL SDL_mixer SDL_image SDL_ttf SDL_gfx freetype fluidsynth ]
+  buildInputs = [ lua5_3 zlib bzip2 curl xz gettext libiconv icu ]
+    ++ [ SDL2 SDL2_mixer SDL2_image SDL2_ttf SDL2_gfx freetype fluidsynth ]
     ++ lib.optionals gtkClient [ gtk3 ]
     ++ lib.optionals qtClient  [ qt5.qtbase ]
     ++ lib.optional server readline
@@ -39,8 +40,16 @@ stdenv.mkDerivation rec {
   dontWrapQtApps = true;
   dontWrapGApps = true;
 
+  # configure is not smart enough to look for SDL2 headers under
+  # .../SDL2, but thankfully $SDL2_PATH is almost exactly what we want
+  preConfigure = ''
+    export CPPFLAGS="$(echo $SDL2_PATH | sed 's#/nix/store/#-I/nix/store/#g')"
+  '';
   configureFlags = [ "--enable-shared" ]
-    ++ lib.optional sdlClient "--enable-client=sdl"
+    ++ lib.optionals sdl2Client [
+      "--enable-client=sdl2"
+      "--enable-sdl-mixer=sdl2"
+    ]
     ++ lib.optionals qtClient [
       "--enable-client=qt"
       "--with-qt5-includes=${qt5.qtbase.dev}/include"
diff --git a/pkgs/servers/dns/dnsdist/default.nix b/pkgs/servers/dns/dnsdist/default.nix
index 8af431640e8..2081f32ea67 100644
--- a/pkgs/servers/dns/dnsdist/default.nix
+++ b/pkgs/servers/dns/dnsdist/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "dnsdist";
-  version = "1.7.1";
+  version = "1.7.2";
 
   src = fetchurl {
     url = "https://downloads.powerdns.com/releases/dnsdist-${version}.tar.bz2";
-    sha256 = "sha256-JzqCEr4t3691T3UrzaTCq8Zxyl1C93YmMxLrRmHqLWY=";
+    hash = "sha256-UkvSuwWqLgWYKpca6FEPKBIwOrRIajhhtiIS0GsRJ80=";
   };
 
   patches = [
diff --git a/pkgs/tools/misc/sweep-visualizer/default.nix b/pkgs/tools/misc/sweep-visualizer/default.nix
deleted file mode 100644
index 74f0807a708..00000000000
--- a/pkgs/tools/misc/sweep-visualizer/default.nix
+++ /dev/null
@@ -1,59 +0,0 @@
-{ stdenv, lib, makeWrapper, fetchurl,
-  alsa-lib, atk, cairo, cups, dbus, expat, fontconfig, freetype, gdk-pixbuf, glib,
-  gnome2, pango, gtk2-x11, nspr, nss,
-  libX11, libxcb, libXcomposite, libXcursor, libXdamage, libXext, libXfixes,
-  libXi, libXrandr, libXrender, libXScrnSaver, libXtst,
-  libudev0-shim
-}:
-  stdenv.mkDerivation rec {
-    pname = "sweep-visualizer";
-    version = "0.15.0";
-
-    src = fetchurl {
-      url = "https://s3.amazonaws.com/scanse/Visualizer/v${version}/sweepvisualizer_${version}_amd64.deb";
-      sha256 = "1k6rdjw2340qrzafv6hjxvbvyh3s1wad6d3629nchdcrpyx9xy1c";
-    };
-
-    nativeBuildInputs = [ makeWrapper ];
-
-    sourceRoot = ".";
-    unpackCmd = ''
-      ar p "$src" data.tar.xz | tar xJ
-    '';
-
-    dontBuild = true;
-
-    installPhase = ''
-      mkdir -p $out/bin $out/share/sweep-visualizer
-      mv usr/share/* $out/share
-      mv opt/Sweep\ Visualizer\ BETA/* $out/share/sweep-visualizer/
-      ln -s $out/share/sweep-visualizer/sweep_visualizer $out/bin/sweep_visualizer
-    '';
-
-    preFixup = let
-      libPath = lib.makeLibraryPath [
-        alsa-lib atk cairo cups.lib dbus.lib expat fontconfig.lib freetype
-        gdk-pixbuf glib gnome2.GConf pango gtk2-x11 nspr nss stdenv.cc.cc.lib
-        libX11 libxcb libXcomposite libXcursor libXdamage libXext libXfixes
-        libXi libXrandr libXrender libXScrnSaver libXtst
-      ];
-      runtimeLibs = lib.makeLibraryPath [ libudev0-shim ];
-    in ''
-      for lib in $out/share/sweep-visualizer/*.so; do
-        patchelf --set-rpath "$out/share/sweep-visualizer:${libPath}" $lib
-      done
-      patchelf \
-        --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-        --set-rpath "$out/share/sweep-visualizer:${libPath}" \
-        $out/share/sweep-visualizer/sweep_visualizer
-      wrapProgram "$out/bin/sweep_visualizer" --prefix LD_LIBRARY_PATH : ${runtimeLibs}
-    '';
-
-    meta = with lib; {
-      homepage = "https://support.scanse.io/hc/en-us/articles/115006008948-Visualizer-Overview";
-      description = "A minimal desktop application for interfacing with the Sweep device";
-      license = licenses.unfree;
-      platforms = [ "x86_64-linux" ];
-      maintainers = with maintainers; [ mt-caret ];
-    };
-  }
diff --git a/pkgs/tools/networking/asleap/default.nix b/pkgs/tools/networking/asleap/default.nix
new file mode 100644
index 00000000000..1d40bb3b22d
--- /dev/null
+++ b/pkgs/tools/networking/asleap/default.nix
@@ -0,0 +1,27 @@
+{lib, stdenv, fetchFromGitHub, openssl, libpcap, libxcrypt}:
+
+stdenv.mkDerivation rec {
+  pname = "asleap";
+  version = "unstable-2021-06-20";
+
+  src = fetchFromGitHub {
+    owner = "zackw";
+    repo = pname;
+    rev = "eb3bd42098cba42b65f499c9d8c73d890861b94f";
+    sha256 = "sha256-S6jS0cg9tHSfmP6VHyISkXJxczhPx3HDdxT46c+YmE8=";
+  };
+
+  buildInputs = [ openssl libpcap libxcrypt ];
+
+  installPhase = ''
+    install -Dm755 asleap $out/bin/asleap
+    install -Dm755 genkeys $out/bin/genkeys
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/zackw/asleap";
+    description = "Recovers weak LEAP and PPTP passwords";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ thehedgeh0g ];
+  };
+}
diff --git a/pkgs/tools/security/chain-bench/default.nix b/pkgs/tools/security/chain-bench/default.nix
new file mode 100644
index 00000000000..43e1ecd0894
--- /dev/null
+++ b/pkgs/tools/security/chain-bench/default.nix
@@ -0,0 +1,62 @@
+{ lib
+, stdenv
+, buildGoModule
+, fetchFromGitHub
+, installShellFiles
+}:
+
+buildGoModule rec {
+  pname = "chain-bench";
+  version = "0.0.2";
+
+  src = fetchFromGitHub {
+    owner = "aquasecurity";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-aoqkCaMEFTmaV9ewSZW6iy5Uc+riha8ecOECVccb9MM=";
+  };
+  vendorSha256 = "sha256-MTWXDIHVdgqdRO0ZoXzUPeTZ6Y19TjFQSvrhKP35BuM=";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=v${version}"
+  ];
+
+  postInstall = ''
+    installShellCompletion --cmd chain-bench \
+      --bash <($out/bin/chain-bench completion bash) \
+      --fish <($out/bin/chain-bench completion fish) \
+      --zsh <($out/bin/chain-bench completion zsh)
+  '';
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
+    $out/bin/chain-bench --help
+    $out/bin/chain-bench --version | grep "v${version}"
+    runHook postInstallCheck
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/aquasecurity/chain-bench";
+    changelog = "https://github.com/aquasecurity/chain-bench/releases/tag/v${version}";
+    description = "An open-source tool for auditing your software supply chain stack for security compliance based on a new CIS Software Supply Chain benchmark";
+    longDescription = ''
+      Chain-bench is an open-source tool for auditing your software supply chain
+      stack for security compliance based on a new CIS Software Supply Chain
+      benchmark. The auditing focuses on the entire SDLC process, where it can
+      reveal risks from code time into deploy time. To win the race against
+      hackers and protect your sensitive data and customer trust, you need to
+      ensure your code is compliant with your organization's policies.
+    '';
+    license = licenses.asl20;
+    maintainers = with maintainers; [ jk ];
+    # TODO: see if this is an issue
+    # # Need updated macOS SDK
+    # # https://github.com/NixOS/nixpkgs/issues/101229
+    # broken = (stdenv.isDarwin && stdenv.isx86_64);
+  };
+}
diff --git a/pkgs/tools/security/terrascan/default.nix b/pkgs/tools/security/terrascan/default.nix
index eb7553d89f4..573f0324969 100644
--- a/pkgs/tools/security/terrascan/default.nix
+++ b/pkgs/tools/security/terrascan/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "terrascan";
-  version = "1.15.1";
+  version = "1.15.2";
 
   src = fetchFromGitHub {
     owner = "accurics";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-4Yd+ifOW5T84hPv+tyEO5HPq2esSk8DkK0G5YSjY+V8=";
+    sha256 = "sha256-lxieqHOmkazkBnwfKLVYy0TE7rfrKcLBENeABdmWpXI=";
   };
 
   vendorSha256 = "sha256-EfHcCk2NkicSPeJYgHJT2kh9EwLldksET75ZQambrWA=";
diff --git a/pkgs/tools/wayland/wl-clipboard/default.nix b/pkgs/tools/wayland/wl-clipboard/default.nix
index 40857a47203..59f7c9110cf 100644
--- a/pkgs/tools/wayland/wl-clipboard/default.nix
+++ b/pkgs/tools/wayland/wl-clipboard/default.nix
@@ -11,19 +11,23 @@
 
 stdenv.mkDerivation rec {
   pname = "wl-clipboard";
-  version = "2.0.0";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "bugaevc";
     repo = "wl-clipboard";
     rev = "v${version}";
-    sha256 = "0c4w87ipsw09aii34szj9p0xfy0m00wyjpll0gb0aqmwa60p0c5d";
+    sha256 = "sha256-lqtLHLsSChWcYWsfFigj0Xveo9doAr7G31fRSaxm0Lw=";
   };
 
   strictDeps = true;
   nativeBuildInputs = [ meson ninja pkg-config wayland-scanner ];
   buildInputs = [ wayland wayland-protocols ];
 
+  mesonFlags = [
+    "-Dfishcompletiondir=share/fish/vendor_completions.d"
+  ];
+
   meta = with lib; {
     homepage = "https://github.com/bugaevc/wl-clipboard";
     description = "Command-line copy/paste utilities for Wayland";
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 34d68ed5f13..4e4c01b6c66 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -741,6 +741,7 @@ mapAliases ({
   libva1-full = throw "'libva1-full' has been renamed to/replaced by 'libva1'"; # Converted to throw 2022-02-22
   libwnck3 = libwnck;
   lighthouse = throw "lighthouse has been removed: abandoned by upstream"; # Added 2022-04-24
+  lighttable = throw "'lighttable' crashes (SIGSEGV) on startup, has not been updated in years and depends on deprecated GTK2"; # Added 2022-06-15
   lilypond-unstable = lilypond; # Added 2021-03-11
   lilyterm = throw "lilyterm has been removed from nixpkgs, because it was relying on a vte version that depended on python2"; # Added 2022-01-14
   lilyterm-git = throw "lilyterm-git has been removed from nixpkgs, because it was relying on a vte version that depended on python2"; # Added 2022-01-14
@@ -1329,6 +1330,7 @@ mapAliases ({
   sundials_3 = throw "sundials_3 was removed in 2020-02. outdated and no longer needed";
   surf-webkit2 = throw "'surf-webkit2' has been renamed to/replaced by 'surf'"; # Converted to throw 2022-02-22
   swec = throw "swec has been removed; broken and abandoned upstream"; # Added 2021-10-14
+  sweep-visualizer = throw "'sweep-visualizer' is abondoned upstream and depends on deprecated GNOME2/GTK2"; # Added 2022-06-15
   swfdec = throw "swfdec has been removed as broken and unmaintained"; # Added 2020-08-23
   swtpm-tpm2 = swtpm; # Added 2021-02-26
   syncthing-cli = syncthing; # Added 2021-04-06
@@ -1471,6 +1473,7 @@ mapAliases ({
   wmii_hg = wmii;
   ws = throw "ws has been dropped due to the lack of maintenance from upstream since 2018"; # Added 2022-06-03
   wxmupen64plus = throw "wxmupen64plus was removed because the upstream disappeared"; # Added 2022-01-31
+  wxcam = throw "'wxcam' has seen no updates in ten years, crashes (SIGABRT) on startup and depends on deprecated wxGTK28/GNOME2/GTK2, use 'gnome.cheese'"; # Added 2022-06-15
 
   ### X ###
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 6ac898bbcec..78d63d71169 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1125,6 +1125,8 @@ with pkgs;
 
   amidst = callPackage ../tools/games/minecraft/amidst { };
 
+  asleap = callPackage ../tools/networking/asleap { };
+
   cf-vault = callPackage ../tools/admin/cf-vault { };
 
   bikeshed = python3Packages.callPackage ../applications/misc/bikeshed { };
@@ -4300,8 +4302,6 @@ with pkgs;
 
   swappy = callPackage ../applications/misc/swappy { gtk = gtk3; };
 
-  sweep-visualizer = callPackage ../tools/misc/sweep-visualizer { };
-
   swego = callPackage ../servers/swego { };
 
   sydbox = callPackage ../os-specific/linux/sydbox { };
@@ -4648,6 +4648,10 @@ with pkgs;
 
   cgreen = callPackage ../development/libraries/cgreen { };
 
+  chain-bench = callPackage ../tools/security/chain-bench {
+    buildGoModule = buildGo118Module;
+  };
+
   checkinstall = callPackage ../tools/package-management/checkinstall { };
 
   checkmake = callPackage ../development/tools/checkmake { };
@@ -20324,6 +20328,7 @@ with pkgs;
       inherit bison cups dconf harfbuzz libGL perl gtk3;
       inherit (gst_all_1) gstreamer gst-plugins-base;
       inherit darwin;
+      inherit buildPackages;
       stdenv = if stdenv.cc.isGNU
         then (if (stdenv.targetPlatform.isx86_64) then gcc10Stdenv else gcc9Stdenv)
         else stdenv;
@@ -20336,6 +20341,7 @@ with pkgs;
       inherit bison cups dconf harfbuzz libGL perl gtk3;
       inherit (gst_all_1) gstreamer gst-plugins-base;
       inherit darwin;
+      inherit buildPackages;
       stdenv = if stdenv.cc.isGNU
         then (if (stdenv.targetPlatform.isx86_64) then gcc10Stdenv else gcc9Stdenv)
         else stdenv;
@@ -20348,6 +20354,7 @@ with pkgs;
       inherit bison cups dconf harfbuzz libGL perl gtk3;
       inherit (gst_all_1) gstreamer gst-plugins-base;
       inherit darwin;
+      inherit buildPackages;
     });
 
   libsForQt512 = recurseIntoAttrs (import ./qt5-packages.nix {
@@ -20381,6 +20388,7 @@ with pkgs;
       inherit lib stdenv fetchurl fetchpatch fetchgit fetchFromGitHub makeSetupHook makeWrapper writeText;
       inherit bison cups dconf harfbuzz libGL perl gtk3 ninja;
       inherit (gst_all_1) gstreamer gst-plugins-base;
+      inherit buildPackages;
       cmake = cmake.overrideAttrs (attrs: {
         patches = attrs.patches ++ [
           ../development/libraries/qt-6/cmake.patch
@@ -27980,8 +27988,6 @@ with pkgs;
 
   lighthouse-steamvr = callPackage ../tools/misc/lighthouse-steamvr { };
 
-  lighttable = callPackage ../applications/editors/lighttable {};
-
   liblinphone = callPackage ../development/libraries/liblinphone { };
 
   links2 = callPackage ../applications/networking/browsers/links2 { };
@@ -30775,9 +30781,6 @@ with pkgs;
     wxGTK = wxGTK31;
   };
 
-  wxcam = callPackage ../applications/video/wxcam
-    { stdenv = gcc10StdenvCompat;     inherit (gnome2) libglade; wxGTK = wxGTK28; gtk = gtk2; };
-
   xa = callPackage ../development/compilers/xa/xa.nix { };
   dxa = callPackage ../development/compilers/xa/dxa.nix { };
 
@@ -31854,20 +31857,25 @@ with pkgs;
   freecell-solver = callPackage ../games/freecell-solver { };
 
   freeciv = callPackage ../games/freeciv {
-    autoreconfHook = buildPackages.autoreconfHook269;
-    qt5 = qt514;
+    sdl2Client = false;
+    gtkClient = true;
+    qtClient = false;
   };
 
-  freeciv_gtk = freeciv.override {
-    gtkClient = true;
-    sdlClient = false;
+  freeciv_sdl2 = freeciv.override {
+    sdl2Client = true;
+    gtkClient = false;
+    qtClient = false;
   };
 
   freeciv_qt = freeciv.override {
+    sdl2Client = false;
+    gtkClient = false;
     qtClient = true;
-    sdlClient = false;
   };
 
+  freeciv_gtk = freeciv;
+
   freedink = callPackage ../games/freedink { };
 
   freeorion = callPackage ../games/freeorion { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 860f83eaddb..19fcec727c2 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1121,6 +1121,8 @@ in {
 
   babelgladeextractor = callPackage ../development/python-modules/babelgladeextractor { };
 
+  pad4pi = callPackage ../development/python-modules/pad4pi { };
+
   pulumi = callPackage ../development/python-modules/pulumi { };
 
   pulumi-aws = callPackage ../development/python-modules/pulumi-aws { };
@@ -9344,6 +9346,8 @@ in {
 
   rpi-gpio2 = callPackage ../development/python-modules/rpi-gpio2 { };
 
+  rplcd = callPackage ../development/python-modules/rplcd { };
+
   rply = callPackage ../development/python-modules/rply { };
 
   rpm = toPythonModule (pkgs.rpm.override {