diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index fdc0cd3c458d..2e1efa65be99 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -10006,6 +10006,12 @@
       fingerprint = "6F8A 18AE 4101 103F 3C54  24B9 6AA2 3A11 93B7 064B";
     }];
   };
+  smancill = {
+    email = "smancill@smancill.dev";
+    github = "smancill";
+    githubId = 238528;
+    name = "Sebastián Mancilla";
+  };
   smaret = {
     email = "sebastien.maret@icloud.com";
     github = "smaret";
@@ -11277,7 +11283,7 @@
   };
   vel = {
     email = "llathasa@outlook.com";
-    github = "llathasa-veleth";
+    github = "q60";
     githubId = 61933599;
     name = "vel";
   };
diff --git a/nixos/modules/services/web-servers/caddy.nix b/nixos/modules/services/web-servers/caddy.nix
index 955b9756406d..b0565fcea162 100644
--- a/nixos/modules/services/web-servers/caddy.nix
+++ b/nixos/modules/services/web-servers/caddy.nix
@@ -8,10 +8,10 @@ let
 
   tlsConfig = {
     apps.tls.automation.policies = [{
-      issuer = {
+      issuers = [{
         inherit (cfg) ca email;
         module = "acme";
-      };
+      }];
     }];
   };
 
@@ -23,23 +23,28 @@ let
 
   # merge the TLS config options we expose with the ones originating in the Caddyfile
   configJSON =
-    let tlsConfigMerge = ''
-      {"apps":
-        {"tls":
-          {"automation":
-            {"policies":
-              (if .[0].apps.tls.automation.policies == .[1]?.apps.tls.automation.policies
-               then .[0].apps.tls.automation.policies
-               else (.[0].apps.tls.automation.policies + .[1]?.apps.tls.automation.policies)
-               end)
+    if cfg.ca != null then
+      let tlsConfigMerge = ''
+        {"apps":
+          {"tls":
+            {"automation":
+              {"policies":
+                (if .[0].apps.tls.automation.policies == .[1]?.apps.tls.automation.policies
+                 then .[0].apps.tls.automation.policies
+                 else (.[0].apps.tls.automation.policies + .[1]?.apps.tls.automation.policies)
+                 end)
+              }
             }
           }
-        }
-      }'';
-    in pkgs.runCommand "caddy-config.json" { } ''
-    ${pkgs.jq}/bin/jq -s '.[0] * ${tlsConfigMerge}' ${adaptedConfig} ${tlsJSON} > $out
-  '';
-in {
+        }'';
+      in
+      pkgs.runCommand "caddy-config.json" { } ''
+        ${pkgs.jq}/bin/jq -s '.[0] * ${tlsConfigMerge}' ${adaptedConfig} ${tlsJSON} > $out
+      ''
+    else
+      adaptedConfig;
+in
+{
   imports = [
     (mkRemovedOptionModule [ "services" "caddy" "agree" ] "this option is no longer necessary for Caddy 2")
   ];
@@ -88,8 +93,13 @@ in {
     ca = mkOption {
       default = "https://acme-v02.api.letsencrypt.org/directory";
       example = "https://acme-staging-v02.api.letsencrypt.org/directory";
-      type = types.str;
-      description = "Certificate authority ACME server. The default (Let's Encrypt production server) should be fine for most people.";
+      type = types.nullOr types.str;
+      description = ''
+        Certificate authority ACME server. The default (Let's Encrypt
+        production server) should be fine for most people. Set it to null if
+        you don't want to include any authority (or if you want to write a more
+        fine-graned configuration manually)
+      '';
     };
 
     email = mkOption {
diff --git a/nixos/modules/system/boot/loader/grub/grub.nix b/nixos/modules/system/boot/loader/grub/grub.nix
index e183bc3648ce..1be663670384 100644
--- a/nixos/modules/system/boot/loader/grub/grub.nix
+++ b/nixos/modules/system/boot/loader/grub/grub.nix
@@ -553,6 +553,8 @@ in
         apply = toString;
         description = ''
           Index of the default menu item to be booted.
+          Can also be set to "saved", which will make GRUB select
+          the menu item that was used at the last boot.
         '';
       };
 
diff --git a/nixos/modules/system/boot/loader/grub/install-grub.pl b/nixos/modules/system/boot/loader/grub/install-grub.pl
index e0167654748e..4d8537d4c327 100644
--- a/nixos/modules/system/boot/loader/grub/install-grub.pl
+++ b/nixos/modules/system/boot/loader/grub/install-grub.pl
@@ -85,6 +85,7 @@ my $bootloaderId = get("bootloaderId");
 my $forceInstall = get("forceInstall");
 my $font = get("font");
 my $theme = get("theme");
+my $saveDefault = $defaultEntry eq "saved";
 $ENV{'PATH'} = get("path");
 
 die "unsupported GRUB version\n" if $grubVersion != 1 && $grubVersion != 2;
@@ -250,6 +251,8 @@ if ($copyKernels == 0) {
 my $conf .= "# Automatically generated.  DO NOT EDIT THIS FILE!\n";
 
 if ($grubVersion == 1) {
+    # $defaultEntry might be "saved", indicating that we want to use the last selected configuration as default.
+    # Incidentally this is already the correct value for the grub 1 config to achieve this behaviour.
     $conf .= "
     default $defaultEntry
     timeout $timeout
@@ -305,6 +308,10 @@ else {
         " . $grubStore->search;
     }
     # FIXME: should use grub-mkconfig.
+    my $defaultEntryText = $defaultEntry;
+    if ($saveDefault) {
+        $defaultEntryText = "\"\${saved_entry}\"";
+    }
     $conf .= "
     " . $grubBoot->search . "
     if [ -s \$prefix/grubenv ]; then
@@ -318,11 +325,19 @@ else {
     set next_entry=
     save_env next_entry
     set timeout=1
+    set boot_once=true
     else
-    set default=$defaultEntry
+    set default=$defaultEntryText
     set timeout=$timeout
     fi
 
+    function savedefault {
+        if [ -z \"\${boot_once}\"]; then
+        saved_entry=\"\${chosen}\"
+        save_env saved_entry
+        fi
+    }
+
     # Setup the graphics stack for bios and efi systems
     if [ \"\${grub_platform}\" = \"efi\" ]; then
     insmod efi_gop
@@ -468,9 +483,16 @@ sub addEntry {
         $conf .= "  $extraPerEntryConfig\n" if $extraPerEntryConfig;
         $conf .= "  kernel $xen $xenParams\n" if $xen;
         $conf .= "  " . ($xen ? "module" : "kernel") . " $kernel $kernelParams\n";
-        $conf .= "  " . ($xen ? "module" : "initrd") . " $initrd\n\n";
+        $conf .= "  " . ($xen ? "module" : "initrd") . " $initrd\n";
+        if ($saveDefault) {
+            $conf .= "  savedefault\n";
+        }
+        $conf .= "\n";
     } else {
         $conf .= "menuentry \"$name\" " . ($options||"") . " {\n";
+        if ($saveDefault) {
+            $conf .= "  savedefault\n";
+        }
         $conf .= $grubBoot->search . "\n";
         if ($copyKernels == 0) {
             $conf .= $grubStore->search . "\n";
@@ -605,6 +627,11 @@ my $efiTarget = getEfiTarget();
 
 # Append entries detected by os-prober
 if (get("useOSProber") eq "true") {
+    if ($saveDefault) {
+        # os-prober will read this to determine if "savedefault" should be added to generated entries
+        $ENV{'GRUB_SAVEDEFAULT'} = "true";
+    }
+
     my $targetpackage = ($efiTarget eq "no") ? $grub : $grubEfi;
     system(get("shell"), "-c", "pkgdatadir=$targetpackage/share/grub $targetpackage/etc/grub.d/30_os-prober >> $tmpFile");
 }
diff --git a/pkgs/applications/misc/gallery-dl/default.nix b/pkgs/applications/misc/gallery-dl/default.nix
index 3f71bd2be220..94852aa13851 100644
--- a/pkgs/applications/misc/gallery-dl/default.nix
+++ b/pkgs/applications/misc/gallery-dl/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonApplication rec {
   pname = "gallery_dl";
-  version = "1.18.2";
+  version = "1.18.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "786772ce774929ef1ba64d8394dbab329a72447fd8b930968bc1fb0aacdba567";
+    sha256 = "6e058dd25a8a54ead41479579fd73de71472abb980a6254765c5e538b591d162";
   };
 
   propagatedBuildInputs = [ requests ];
diff --git a/pkgs/applications/misc/ulauncher/default.nix b/pkgs/applications/misc/ulauncher/default.nix
index 6d9d9deefa20..f9bf70b661ce 100644
--- a/pkgs/applications/misc/ulauncher/default.nix
+++ b/pkgs/applications/misc/ulauncher/default.nix
@@ -20,13 +20,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "ulauncher";
-  version = "5.9.0";
+  version = "5.11.0";
 
   disabled = python3Packages.isPy27;
 
   src = fetchurl {
     url = "https://github.com/Ulauncher/Ulauncher/releases/download/${version}/ulauncher_${version}.tar.gz";
-    sha256 = "sha256-jRCrkJcjUHDd3wF+Hkxg0QaW7YgIh7zM/KZ4TAH84/U=";
+    sha256 = "sha256-xEM7sG0NRWouDu6NxNA94WTycykEhPI4ByjDk2yjHjo=";
   };
 
   nativeBuildInputs = with python3Packages; [
diff --git a/pkgs/applications/networking/flent/default.nix b/pkgs/applications/networking/flent/default.nix
index 9e76a73233cf..8df990ec4fa5 100644
--- a/pkgs/applications/networking/flent/default.nix
+++ b/pkgs/applications/networking/flent/default.nix
@@ -3,10 +3,10 @@
 
 buildPythonApplication rec {
   pname = "flent";
-  version = "1.3.2";
+  version = "2.0.1";
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1k265xxxjld6q38m9lsgy7p0j70qp9a49vh9zg0njbi4i21lxq23";
+    sha256 = "300a09938dc2b4a0463c9144626f25e0bd736fd47806a9444719fa024d671796";
   };
 
   buildInputs = [ sphinx ];
diff --git a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
index 81a69d2615d2..6f15459ab65b 100644
--- a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
@@ -28,11 +28,11 @@
 }:
 
 let
-  version = "5.7.28991.0726";
+  version = "5.7.29123.0808";
   srcs = {
     x86_64-linux = fetchurl {
       url = "https://zoom.us/client/${version}/zoom_x86_64.pkg.tar.xz";
-      sha256 = "w1oeMKADG5+7EV1OXyuEbotrwcVywob82KOXKoRUifA=";
+      sha256 = "WAeE/2hUaQbWwDg/iqlKSZVoH3ruVHvh+9SEWdPwCIc=";
     };
   };
 
diff --git a/pkgs/applications/office/grisbi/default.nix b/pkgs/applications/office/grisbi/default.nix
index f370d94d1cf7..49344becf03d 100644
--- a/pkgs/applications/office/grisbi/default.nix
+++ b/pkgs/applications/office/grisbi/default.nix
@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation rec {
   pname = "grisbi";
-  version = "2.0.2";
+  version = "2.0.4";
 
   src = fetchurl {
     url = "mirror://sourceforge/grisbi/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-bCO82EWAf/kiMDdojA5goWeWiKWZNOGYixmIJQwovGM=";
+    sha256 = "sha256-4ykG310He1aFaUNo5fClaM3QWFBzKERGihYfqaxR1Vo=";
   };
 
   nativeBuildInputs = [ pkg-config wrapGAppsHook ];
diff --git a/pkgs/applications/office/homebank/default.nix b/pkgs/applications/office/homebank/default.nix
index c77c52774be9..acef5578d670 100644
--- a/pkgs/applications/office/homebank/default.nix
+++ b/pkgs/applications/office/homebank/default.nix
@@ -2,10 +2,10 @@
 , libsoup, gnome }:
 
 stdenv.mkDerivation rec {
-  name = "homebank-5.5.2";
+  name = "homebank-5.5.3";
   src = fetchurl {
     url = "http://homebank.free.fr/public/${name}.tar.gz";
-    sha256 = "sha256-mJ7zeOTJ+CNLYruT1qSxS9TJjciJUZg426H0TxLFHtI=";
+    sha256 = "sha256-BzYHkYqWEAh3kfNvWecNEmH+6OThFGpc/VhxodLZEJM=";
   };
 
   nativeBuildInputs = [ pkg-config wrapGAppsHook ];
diff --git a/pkgs/applications/radio/xlog/default.nix b/pkgs/applications/radio/xlog/default.nix
index a013fe41d830..06b7c108fa96 100644
--- a/pkgs/applications/radio/xlog/default.nix
+++ b/pkgs/applications/radio/xlog/default.nix
@@ -1,11 +1,11 @@
 { lib, stdenv, fetchurl, glib, gtk2, pkg-config, hamlib }:
 stdenv.mkDerivation rec {
   pname = "xlog";
-  version = "2.0.20";
+  version = "2.0.23";
 
   src = fetchurl {
     url = "https://download.savannah.gnu.org/releases/xlog/${pname}-${version}.tar.gz";
-    sha256 = "sha256-pSGmKLHGc+Eb9OG27k1rYOMn/2BiRejrBajARjEgsUA=";
+    sha256 = "sha256-JSPyXOJbYOCeWY6h0v8fbmBkf1Dop1gdmnn4gKdBgac=";
   };
 
   # glib-2.62 deprecations
diff --git a/pkgs/desktops/gnome/apps/cheese/default.nix b/pkgs/desktops/gnome/apps/cheese/default.nix
index d0a9d6aaabb1..71a582993abf 100644
--- a/pkgs/desktops/gnome/apps/cheese/default.nix
+++ b/pkgs/desktops/gnome/apps/cheese/default.nix
@@ -30,6 +30,7 @@
 , ninja
 , dbus
 , python3
+, pipewire
 }:
 
 stdenv.mkDerivation rec {
@@ -85,6 +86,7 @@ stdenv.mkDerivation rec {
     gtk3
     libcanberra-gtk3
     librsvg
+    pipewire # PipeWire provides a gstreamer plugin for using PipeWire for video
   ];
 
   postPatch = ''
diff --git a/pkgs/desktops/gnome/core/totem/default.nix b/pkgs/desktops/gnome/core/totem/default.nix
index 45b99680a120..7d1d4e90abf0 100644
--- a/pkgs/desktops/gnome/core/totem/default.nix
+++ b/pkgs/desktops/gnome/core/totem/default.nix
@@ -30,11 +30,11 @@
 
 stdenv.mkDerivation rec {
   pname = "totem";
-  version = "3.38.0";
+  version = "3.38.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/totem/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0bs33ijvxbr2prb9yj4dxglsszslsn9k258n311sld84masz4ad8";
+    sha256 = "j/rPfA6inO3qBndzCGHUh2qPesTaTGI0u3X3/TcFoQg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/compilers/bigloo/default.nix b/pkgs/development/compilers/bigloo/default.nix
index a4f4287523f4..c4fa5712ea63 100644
--- a/pkgs/development/compilers/bigloo/default.nix
+++ b/pkgs/development/compilers/bigloo/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bigloo";
-  version = "4.3h";
+  version = "4.4b";
 
   src = fetchurl {
     url = "ftp://ftp-sop.inria.fr/indes/fp/Bigloo/bigloo-${version}.tar.gz";
-    sha256 = "0fw08096sf8ma2cncipnidnysxii0h0pc7kcqkjhkhdchknp8vig";
+    sha256 = "sha256-oxOSJwKWmwo7PYAwmeoFrKaYdYvmvQquWXyutolc488=";
   };
 
   nativeBuildInputs = [ autoconf automake libtool ];
diff --git a/pkgs/development/compilers/hop/default.nix b/pkgs/development/compilers/hop/default.nix
index 8e5bd6a7df03..00900b6fffe4 100644
--- a/pkgs/development/compilers/hop/default.nix
+++ b/pkgs/development/compilers/hop/default.nix
@@ -7,10 +7,11 @@ let bigloo-release =
 ; in
 
 stdenv.mkDerivation rec {
-  name = "hop-3.3.0";
+  pname = "hop";
+  version = "3.4.4";
   src = fetchurl {
-    url = "ftp://ftp-sop.inria.fr/indes/fp/Hop/${name}.tar.gz";
-    sha256 = "14gf9ihmw95zdnxsqhn5jymfivpfq5cg9v0y7yjd5i7c787dncp5";
+    url = "ftp://ftp-sop.inria.fr/indes/fp/Hop/hop-${version}.tar.gz";
+    sha256 = "sha256-GzXh4HC+SFFoUi7SMqu36iYRPAJ6tMnOHd+he6n9k1I=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/half/default.nix b/pkgs/development/libraries/half/default.nix
index 5232dfa51230..c0d11e9ce773 100644
--- a/pkgs/development/libraries/half/default.nix
+++ b/pkgs/development/libraries/half/default.nix
@@ -1,12 +1,12 @@
 { lib, stdenv, fetchzip }:
 
 stdenv.mkDerivation rec {
-  version = "2.1.0";
+  version = "2.2.0";
   pname = "half";
 
   src = fetchzip {
     url = "mirror://sourceforge/half/${version}/half-${version}.zip";
-    sha256 = "04v4rhs1ffd4c9zcnk4yjhq0gdqy020518wb7n8ryk1ckrdd7hbm";
+    sha256 = "sha256-ZdGgBMZylFgkvs/XVBnvgBY2EYSHRLY3S4YwXjshpOY=";
     stripRoot = false;
   };
 
diff --git a/pkgs/development/libraries/intel-media-sdk/default.nix b/pkgs/development/libraries/intel-media-sdk/default.nix
index 00c80277ea2b..c0bac7e5466d 100644
--- a/pkgs/development/libraries/intel-media-sdk/default.nix
+++ b/pkgs/development/libraries/intel-media-sdk/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-media-sdk";
-  version = "21.2.3";
+  version = "21.3.1";
 
   src = fetchFromGitHub {
     owner = "Intel-Media-SDK";
     repo = "MediaSDK";
     rev = "intel-mediasdk-${version}";
-    sha256 = "sha256-Id2/d6rRKiei6UQ0pywdcbNLfIQR8gEseiDgqeaT3p8=";
+    sha256 = "sha256-Ki+gTDL6gj+f3wjhVp4EIVvrPn6NRmCCkCj5g//kAW8=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/development/python-modules/authlib/default.nix b/pkgs/development/python-modules/authlib/default.nix
index 4fa14a60ff83..1ac9954730dd 100644
--- a/pkgs/development/python-modules/authlib/default.nix
+++ b/pkgs/development/python-modules/authlib/default.nix
@@ -8,14 +8,14 @@
 }:
 
 buildPythonPackage rec {
-  version = "0.15.3";
+  version = "0.15.4";
   pname = "authlib";
 
   src = fetchFromGitHub {
     owner = "lepture";
     repo = "authlib";
     rev = "v${version}";
-    sha256 = "1lqicv8awyygqh1z8vhwvx38dw619kgbirdn8c9sc3qilagq1rdx";
+    sha256 = "1jc7rssi1y6brkwjplj8qmi4q5w9h9wz03fbhg01c0y5bmy0g1nj";
   };
 
   propagatedBuildInputs = [ cryptography requests ];
diff --git a/pkgs/development/python-modules/chess/default.nix b/pkgs/development/python-modules/chess/default.nix
new file mode 100644
index 000000000000..baef04eab5b5
--- /dev/null
+++ b/pkgs/development/python-modules/chess/default.nix
@@ -0,0 +1,33 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, python
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "chess";
+  version = "1.6.1";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "niklasf";
+    repo = "python-${pname}";
+    rev = "v${version}";
+    sha256 = "sha256-2pyABmr6q1Y2/ivtvMYqRHE2Zjlyz2QO0us0w4l2HQM=";
+  };
+
+  pythonImportsCheck = [ "chess" ];
+
+  checkPhase = ''
+    ${python.interpreter} ./test.py -v
+  '';
+
+  meta = with lib; {
+    description = "A chess library for Python, with move generation, move validation, and support for common formats";
+    homepage = "https://github.com/niklasf/python-chess";
+    maintainers = with maintainers; [ smancill ];
+    license = licenses.gpl3Plus;
+  };
+}
diff --git a/pkgs/development/python-modules/wrapio/default.nix b/pkgs/development/python-modules/wrapio/default.nix
index 3e6a4372a642..e04424ba49e2 100644
--- a/pkgs/development/python-modules/wrapio/default.nix
+++ b/pkgs/development/python-modules/wrapio/default.nix
@@ -1,15 +1,18 @@
 { lib
 , buildPythonPackage
+, pythonOlder
 , fetchPypi
 }:
 
 buildPythonPackage rec {
   pname = "wrapio";
-  version = "1.0.0";
+  version = "2.0.0";
+
+  disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-JWcPsqZy1wM6/mbU3H0W3EkpLg0wrEUUg3pT/QrL+rE=";
+    sha256 = "sha256-CUocIbdZ/tJQCxAHzhFpB267ynlXf8Mu+thcRRc0yeg=";
   };
 
   doCheck = false;
diff --git a/pkgs/development/tools/buf/default.nix b/pkgs/development/tools/buf/default.nix
index 230f5b09b99f..84979df92c24 100644
--- a/pkgs/development/tools/buf/default.nix
+++ b/pkgs/development/tools/buf/default.nix
@@ -7,15 +7,15 @@
 
 buildGoModule rec {
   pname = "buf";
-  version = "0.49.0";
+  version = "0.50.0";
 
   src = fetchFromGitHub {
     owner = "bufbuild";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-xP2UbcHwimN09IXrGp3zhBLL74l/8YKotqBNRTITF18=";
+    sha256 = "sha256-Kg3p6BsYrIGn16VQ87TQwa7B+YVEq6oCSd3Je2A6NC8=";
   };
-  vendorSha256 = "sha256-WgQSLe99CbOwJC8ewDcSq6PcBJdmiPRmvAonq8drQ1w=";
+  vendorSha256 = "sha256-0vvDzs4LliEm202tScmzL+riL3FqHdvawhzU0lPkRew=";
 
   patches = [
     # Skip a test that requires networking to be available to work.
diff --git a/pkgs/servers/asterisk/default.nix b/pkgs/servers/asterisk/default.nix
index be0cd877458c..e8912f4b5374 100644
--- a/pkgs/servers/asterisk/default.nix
+++ b/pkgs/servers/asterisk/default.nix
@@ -90,7 +90,16 @@ let
     sha256 = "1s9idx2miwk178sa731ig9r4fzx4gy1q8xazfqyd7q4lfd70s1cy";
   };
 
-in rec {
+  # auto-generated by update.py
+  versions = lib.mapAttrs (_: {version, sha256}: common {
+    inherit version sha256;
+    externals = {
+      "externals_cache/pjproject-2.10.tar.bz2" = pjproject_2_10;
+      "addons/mp3" = mp3-202;
+    };
+  }) (builtins.fromJSON (builtins.readFile ./versions.json));
+
+in {
   # Supported releases (as of 2020-10-26).
   # Source: https://wiki.asterisk.org/wiki/display/AST/Asterisk+Versions
   # Exact version can be found at https://www.asterisk.org/downloads/asterisk/all-asterisk-versions/
@@ -100,43 +109,8 @@ in rec {
   # 16.x    LTS        2018-10-09  2022-10-09  2023-10-09
   # 17.x    Standard   2019-10-28  2020-10-28  2021-10-28
   # 18.x    LTS        2020-10-20  2024-10-20  2025-10-20
-  asterisk-lts = asterisk_18;
-  asterisk-stable = asterisk_18;
-  asterisk = asterisk_18;
+  asterisk-lts = versions.asterisk_18;
+  asterisk-stable = versions.asterisk_18;
+  asterisk = versions.asterisk_18;
 
-  asterisk_13 = common {
-    version = "13.38.2";
-    sha256 = "1v7wgsa9vf7qycg3xpvmn2bkandkfh3x15pr8ylg0w0gvfkkf5b9";
-    externals = {
-      "externals_cache/pjproject-2.10.tar.bz2" = pjproject_2_10;
-      "addons/mp3" = mp3-202;
-    };
-  };
-
-  asterisk_16 = common {
-    version = "16.17.0";
-    sha256 = "1bzlsk9k735qf8a693b6sa548my7m9ahavmdicwmc14px70wrvnw";
-    externals = {
-      "externals_cache/pjproject-2.10.tar.bz2" = pjproject_2_10;
-      "addons/mp3" = mp3-202;
-    };
-  };
-
-  asterisk_17 = common {
-    version = "17.9.3";
-    sha256 = "0nhk0izrxx24pz806fwnhidjmciwrkcrsvxvhrdvibiqyvfk8yk7";
-    externals = {
-      "externals_cache/pjproject-2.10.tar.bz2" = pjproject_2_10;
-      "addons/mp3" = mp3-202;
-    };
-  };
-
-  asterisk_18 = common {
-    version = "18.3.0";
-    sha256 = "1xb953i9ay82vcdv8izi5dd5xnspcsvg10ajiyph377jw2xnd5fb";
-    externals = {
-      "externals_cache/pjproject-2.10.tar.bz2" = pjproject_2_10;
-      "addons/mp3" = mp3-202;
-    };
-  };
-}
+} // versions
diff --git a/pkgs/servers/asterisk/update.py b/pkgs/servers/asterisk/update.py
new file mode 100755
index 000000000000..5a7fabf9d676
--- /dev/null
+++ b/pkgs/servers/asterisk/update.py
@@ -0,0 +1,36 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i python3 -p python39 python39.pkgs.packaging python39.pkgs.beautifulsoup4 python39.pkgs.requests
+from packaging import version
+from bs4 import BeautifulSoup
+import re, requests, json
+
+URL = "https://downloads.asterisk.org/pub/telephony/asterisk"
+
+page = requests.get(URL)
+changelog = re.compile("^ChangeLog-\d+\.\d+\.\d+$")
+changelogs = [a.get_text() for a in BeautifulSoup(page.text, 'html.parser').find_all('a') if changelog.match(a.get_text())]
+major_versions = {}
+for changelog in changelogs:
+    v = version.parse(changelog.removeprefix("ChangeLog-"))
+    major_versions.setdefault(v.major, []).append(v)
+
+out = {}
+for mv in major_versions.keys():
+    v = max(major_versions[mv])
+    sha = requests.get(f"{URL}/asterisk-{v}.sha256").text.split()[0]
+    out["asterisk_" + str(mv)] = {
+        "version": str(v),
+        "sha256": sha
+    }
+
+try:
+    with open("versions.json", "r") as in_file:
+        in_data = json.loads(in_file.read())
+        for v in in_data.keys():
+            print(v + ":", in_data[v]["version"], "->", out[v]["version"])
+except:
+    # nice to have for the PR, not a requirement
+    pass
+
+with open("versions.json", "w") as out_file:
+    out_file.write(json.dumps(out, sort_keys=True, indent=2) + "\n")
diff --git a/pkgs/servers/asterisk/versions.json b/pkgs/servers/asterisk/versions.json
new file mode 100644
index 000000000000..93d2539993de
--- /dev/null
+++ b/pkgs/servers/asterisk/versions.json
@@ -0,0 +1,18 @@
+{
+  "asterisk_13": {
+    "sha256": "478040705f5819259bb1d22cb4e27970092a5bfdb691d27d321c26235eea4bb3",
+    "version": "13.38.3"
+  },
+  "asterisk_16": {
+    "sha256": "c34fc38287cea533c0d0a34959112119e47d12d8ea6ac11bdddf9265afda6d11",
+    "version": "16.19.1"
+  },
+  "asterisk_17": {
+    "sha256": "cc0d6b9ef1512d4e279b80ca8bf78032d69fe6e92492c95c22c44023d6c111fa",
+    "version": "17.9.4"
+  },
+  "asterisk_18": {
+    "sha256": "e7d78716a0deeadf24b7d537cd24c11c2d9a096265eefc9470565c4da0fc54c7",
+    "version": "18.5.1"
+  }
+}
diff --git a/pkgs/servers/sql/dolt/default.nix b/pkgs/servers/sql/dolt/default.nix
index 113866c3911d..55bf9ba2342f 100644
--- a/pkgs/servers/sql/dolt/default.nix
+++ b/pkgs/servers/sql/dolt/default.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec {
     pname = "dolt";
-    version = "0.27.2";
+    version = "0.27.3";
 
     src = fetchFromGitHub {
         owner = "liquidata-inc";
         repo = "dolt";
         rev = "v${version}";
-        sha256 = "sha256-Px2b0s10N5uDYsz95/1cT2tfS/NfhRfKmCdXIaMb5Po=";
+        sha256 = "sha256-zqLGvbvl21KNBbESbp9gA8iA1Y6MXwqz3HBZlOYYdIo=";
     };
 
     modRoot = "./go";
     subPackages = [ "cmd/dolt" "cmd/git-dolt" "cmd/git-dolt-smudge" ];
-  vendorSha256 = "sha256-6KjSmxNLY0msMqpPZR7LUZV63Pj6JGhGVRWTKbbnDtk=";
+  vendorSha256 = "sha256-JVDYSPLemJRD1Gb6rZJdI/0Z5f1a+0TkP1b0IZe/Ns0=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/admin/eksctl/default.nix b/pkgs/tools/admin/eksctl/default.nix
index a51d33735b77..7d0809b099e7 100644
--- a/pkgs/tools/admin/eksctl/default.nix
+++ b/pkgs/tools/admin/eksctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "eksctl";
-  version = "0.60.0";
+  version = "0.61.0";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = pname;
     rev = version;
-    sha256 = "sha256-zRwdluwVi4hbDZGlRwhNWkeq05c2VTZ52KrxvyFIBio=";
+    sha256 = "sha256-8/1imYCPtSTZjk27nCkXOVi4hYzczsCzrn2k3WqHFzc=";
   };
 
-  vendorSha256 = "sha256-mapok/c3uh7xmLZnN5S9zavgxSOfytqtqxBScv4Ao8w=";
+  vendorSha256 = "sha256-AWNTjqEeSEoXO9wcpEXM3y1AeqQYlbswjr0kXvXqGjk=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/archivers/maxcso/default.nix b/pkgs/tools/archivers/maxcso/default.nix
index ed81a1825257..1e7fe73728de 100644
--- a/pkgs/tools/archivers/maxcso/default.nix
+++ b/pkgs/tools/archivers/maxcso/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "maxcso";
-  version = "1.12.0";
+  version = "1.13.0";
 
   src = fetchFromGitHub {
     owner = "unknownbrackets";
     repo = "maxcso";
     rev = "v${version}";
-    sha256 = "10r0vb3ndpq1pw5224d48nim5xz8jj94zhlfy29br6h6jblq8zap";
+    sha256 = "sha256-6LjR1ZMZsi6toz9swPzNmSAlrUykwvVdYi1mR8Ctq5U=";
   };
 
   buildInputs = [ libuv lz4 zlib ];
diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-table/default.nix b/pkgs/tools/inputmethods/ibus-engines/ibus-table/default.nix
index ac29545db3b0..9dcde821e14d 100644
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-table/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-table/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ibus-table";
-  version = "1.12.4";
+  version = "1.14.0";
 
   src = fetchFromGitHub {
     owner  = "kaio";
     repo   = "ibus-table";
     rev    = version;
-    sha256 = "sha256-2qST5k2+8gfSf1/FaxXW4qwSQgNw/QKM+1mMWDdrjCU=";
+    sha256 = "sha256-HGSa8T1fY3PGow/rB9ixAPTibLCykImcs0kM/dUIwmQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/misc/disfetch/default.nix b/pkgs/tools/misc/disfetch/default.nix
index 1e6c466d8f39..47215a6dea6c 100644
--- a/pkgs/tools/misc/disfetch/default.nix
+++ b/pkgs/tools/misc/disfetch/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "disfetch";
-  version = "2.9";
+  version = "2.10";
 
   src = fetchFromGitHub {
     owner = "q60";
     repo = "disfetch";
     rev = version;
-    sha256 = "sha256-dmDDO1DcDMGWtQtIQncOjSc114tL5QH1Jaq1n4vAe5M=";
+    sha256 = "sha256-mjjFy6VItTg4VVXvGNjOJYHKHTy8o26iYsVC9Fq0YVg=";
   };
 
   dontBuild = true;
diff --git a/pkgs/tools/misc/fwup/default.nix b/pkgs/tools/misc/fwup/default.nix
index 69b76cf648d8..e2b6df253a9f 100644
--- a/pkgs/tools/misc/fwup/default.nix
+++ b/pkgs/tools/misc/fwup/default.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fwup";
-  version = "1.8.4";
+  version = "1.9.0";
 
   src = fetchFromGitHub {
     owner = "fhunleth";
     repo = "fwup";
     rev = "v${version}";
-    sha256 = "sha256-NaSA3mFWf3C03SAGssMqLT0vr5KMfxD5y/iragGNKjw=";
+    sha256 = "sha256-ARwBm9p6o/iC09F6pc5c4qq3WClNTyAvLPsG58YQOAM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index e705d5093201..651e2406d18c 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1427,6 +1427,8 @@ in {
 
   cherrypy = callPackage ../development/python-modules/cherrypy { };
 
+  chess = callPackage ../development/python-modules/chess { };
+
   chevron = callPackage ../development/python-modules/chevron { };
 
   chiabip158 = callPackage ../development/python-modules/chiabip158 { };