diff --git a/nixos/modules/services/monitoring/grafana.nix b/nixos/modules/services/monitoring/grafana.nix
index d72aaf0464ed..dd99fa3ddccd 100644
--- a/nixos/modules/services/monitoring/grafana.nix
+++ b/nixos/modules/services/monitoring/grafana.nix
@@ -792,7 +792,7 @@ in {
         SystemCallArchitectures = "native";
         # Upstream grafana is not setting SystemCallFilter for compatibility
         # reasons, see https://github.com/grafana/grafana/pull/40176
-        SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
+        SystemCallFilter = [ "@system-service" "~@privileged" ];
         UMask = "0027";
       };
       preStart = ''
diff --git a/pkgs/applications/misc/gpxsee/default.nix b/pkgs/applications/misc/gpxsee/default.nix
index 0fbfbcba3139..8f7ab1e5f9e0 100644
--- a/pkgs/applications/misc/gpxsee/default.nix
+++ b/pkgs/applications/misc/gpxsee/default.nix
@@ -1,14 +1,16 @@
-{ lib, stdenv, fetchFromGitHub, qmake, qttools, qttranslations, qtlocation, qtpbfimageplugin, wrapQtAppsHook, substituteAll }:
+{ lib, stdenv, fetchFromGitHub, nix-update-script, substituteAll
+, qmake, qttools, qttranslations, qtlocation, qtpbfimageplugin, wrapQtAppsHook
+}:
 
 stdenv.mkDerivation rec {
   pname = "gpxsee";
-  version = "11.3";
+  version = "11.4";
 
   src = fetchFromGitHub {
     owner = "tumic0";
     repo = "GPXSee";
     rev = version;
-    sha256 = "sha256-n8busir6IYyWyGOv9AzYjm8erR0fjMAduIzITH+EvVI=";
+    hash = "sha256-aePX82B810I45n2t0OVCt1FlmkVKWgNgzCD71lYyngU=";
   };
 
   patches = (substituteAll {
@@ -30,6 +32,12 @@ stdenv.mkDerivation rec {
     mv GPXSee.app $out/Applications
   '';
 
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = pname;
+    };
+  };
+
   meta = with lib; {
     description = "GPS log file viewer and analyzer";
     longDescription = ''
diff --git a/pkgs/applications/networking/syncthing/default.nix b/pkgs/applications/networking/syncthing/default.nix
index 6fdc0e0d0051..e668b35d482f 100644
--- a/pkgs/applications/networking/syncthing/default.nix
+++ b/pkgs/applications/networking/syncthing/default.nix
@@ -4,16 +4,16 @@ let
   common = { stname, target, postInstall ? "" }:
     buildGoModule rec {
       pname = stname;
-      version = "1.20.4";
+      version = "1.21.0";
 
       src = fetchFromGitHub {
         owner = "syncthing";
         repo = "syncthing";
         rev = "v${version}";
-        hash = "sha256-umnlYvCtT+76Yer17T7ZvWJ5sUdXu+7kiRikrmWrIM8=";
+        hash = "sha256-Qgp9fo3yZabxsCFhn7U9B2AcVSUb9GCzm7B81HrI1jY=";
       };
 
-      vendorSha256 = "sha256-CJFKY69Iz8GrVpvUdDveMQQFj6RXApfgYjP7B1wfgfo=";
+      vendorSha256 = "sha256-rde7oyEZA8uGmkvz078Cu+aFrn9TuLTv0i7SW0ytyxU=";
 
       doCheck = false;
 
diff --git a/pkgs/applications/terminal-emulators/wezterm/default.nix b/pkgs/applications/terminal-emulators/wezterm/default.nix
index 0342b6817c66..ebf7883e3657 100644
--- a/pkgs/applications/terminal-emulators/wezterm/default.nix
+++ b/pkgs/applications/terminal-emulators/wezterm/default.nix
@@ -29,14 +29,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wezterm";
-  version = "20220903-194523-3bb1ed61";
+  version = "20220905-102802-7d4b8249";
 
   src = fetchFromGitHub {
     owner = "wez";
     repo = pname;
     rev = version;
     fetchSubmodules = true;
-    sha256 = "sha256-R5DFBO6U1hVDCjvvNF2nDoldl+mzkrjaXR5rIPCosmM=";
+    sha256 = "sha256-Xvi0bluLM4F3BFefIPhkhTF3dmRvP8u+qV70Rz4CGKI=";
   };
 
   postPatch = ''
@@ -46,7 +46,7 @@ rustPlatform.buildRustPackage rec {
     rm -r wezterm-ssh/tests
   '';
 
-  cargoSha256 = "sha256-x2n8ti9zk+h2MrwDg/FgRWTQJmCAckxE2fOHgrWdayA=";
+  cargoSha256 = "sha256-XJAeMDwtLtBzHMU/cb3lZgmcw5F3ifjKzKVmuP85/RY=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/development/python-modules/assay/default.nix b/pkgs/development/python-modules/assay/default.nix
new file mode 100644
index 000000000000..b019e24579ce
--- /dev/null
+++ b/pkgs/development/python-modules/assay/default.nix
@@ -0,0 +1,22 @@
+{ lib, buildPythonPackage, fetchFromGitHub }:
+
+buildPythonPackage rec {
+  pname = "assay";
+  version = "unstable-2022-01-19";
+
+  src = fetchFromGitHub {
+    owner = "brandon-rhodes";
+    repo = pname;
+    rev = "bb62d1f7d51d798b05a88045fff3a2ff92c299c3";
+    sha256 = "sha256-FuAD74mFJ9F9AMgB3vPmODAlZKgPR7FQ4yn7HEBS5Rw=";
+  };
+
+  pythonImportsCheck = [ "assay" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/brandon-rhodes/assay";
+    description = "Attempt to write a Python testing framework I can actually stand";
+    license = licenses.mit;
+    maintainers = with maintainers; [ zane ];
+  };
+}
diff --git a/pkgs/development/python-modules/cairo-lang/default.nix b/pkgs/development/python-modules/cairo-lang/default.nix
index de2b0253e1b5..00a9361c27f8 100644
--- a/pkgs/development/python-modules/cairo-lang/default.nix
+++ b/pkgs/development/python-modules/cairo-lang/default.nix
@@ -29,11 +29,11 @@
 
 buildPythonPackage rec {
   pname = "cairo-lang";
-  version = "0.9.1";
+  version = "0.10.0";
 
   src = fetchzip {
     url = "https://github.com/starkware-libs/cairo-lang/releases/download/v${version}/cairo-lang-${version}.zip";
-    sha256 = "sha256-i4030QLG6PssfKD5FO4VrZxap19obMZ3Aa77p5MXlNY=";
+    sha256 = "sha256-+PE7RSKEGADbue63FoT6UBOwURJs7lBNkL7aNlpSxP8=";
   };
 
   # TODO: remove a substantial part when https://github.com/starkware-libs/cairo-lang/pull/88/files is merged.
diff --git a/pkgs/development/python-modules/jplephem/default.nix b/pkgs/development/python-modules/jplephem/default.nix
new file mode 100644
index 000000000000..a55c1ed15ee5
--- /dev/null
+++ b/pkgs/development/python-modules/jplephem/default.nix
@@ -0,0 +1,28 @@
+{ lib, buildPythonPackage, fetchPypi, numpy, pytestCheckHook }:
+
+buildPythonPackage rec {
+  pname = "jplephem";
+  version = "2.17";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-4cblVlxNAEhfEGMkG00e/wRFhcIrjpf60P8vbvuKqic=";
+  };
+
+  propagatedBuildInputs = [ numpy ];
+
+  # Weird import error, only happens in testing:
+  #   File "/build/jplephem-2.17/jplephem/daf.py", line 10, in <module>
+  #     from numpy import array as numpy_array, ndarray
+  # ImportError: cannot import name 'array' from 'sys' (unknown location)
+  doCheck = false;
+
+  pythonImportsCheck = [ "jplephem" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/brandon-rhodes/python-jplephem/";
+    description = "Python version of NASA DE4xx ephemerides, the basis for the Astronomical Alamanac";
+    license = licenses.mit;
+    maintainers = with maintainers; [ zane ];
+  };
+}
diff --git a/pkgs/development/python-modules/niapy/default.nix b/pkgs/development/python-modules/niapy/default.nix
index b83091cc1dad..867c7969e545 100644
--- a/pkgs/development/python-modules/niapy/default.nix
+++ b/pkgs/development/python-modules/niapy/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "niapy";
-  version = "2.0.2";
+  version = "2.0.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,8 +19,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "NiaOrg";
     repo = "NiaPy";
-    rev = version;
-    hash = "sha256-b/0TEO27fPuoPzkNBCwgUqBG+8htOR2ipFikpqjYdnM=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-h3bCitNFjw2WQtsQFR25VJlNVMojdfik+lrPMKwp8Mw=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/sgp4/default.nix b/pkgs/development/python-modules/sgp4/default.nix
new file mode 100644
index 000000000000..1b8ecc0b46ba
--- /dev/null
+++ b/pkgs/development/python-modules/sgp4/default.nix
@@ -0,0 +1,22 @@
+{ lib, buildPythonPackage, fetchPypi, tox, numpy }:
+
+buildPythonPackage rec {
+  pname = "sgp4";
+  version = "2.21";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-YXm4dQRId+lBYzwgr3ci/SMaiNiomvAb8wvWTzPN7O8=";
+  };
+
+  checkInputs = [ tox numpy ];
+
+  pythonImportsCheck = [ "sgp4" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/brandon-rhodes/python-sgp4";
+    description = "Python version of the SGP4 satellite position library";
+    license = licenses.mit;
+    maintainers = with maintainers; [ zane ];
+  };
+}
diff --git a/pkgs/development/python-modules/skyfield/default.nix b/pkgs/development/python-modules/skyfield/default.nix
new file mode 100644
index 000000000000..c6b3c69fc3e9
--- /dev/null
+++ b/pkgs/development/python-modules/skyfield/default.nix
@@ -0,0 +1,37 @@
+{ lib, buildPythonPackage, fetchFromGitHub, certifi, numpy, sgp4, jplephem
+, pandas, ipython, matplotlib, assay
+}:
+
+buildPythonPackage rec {
+  pname = "skyfield";
+  version = "1.42";
+
+  src = fetchFromGitHub {
+    owner = "skyfielders";
+    repo = "python-skyfield";
+    rev = version;
+    sha256 = "sha256-aoSkuLhZcEy+13EJQOBHV2/rgmN6aZQHqfj4OOirOG0=";
+  };
+
+  propagatedBuildInputs = [ certifi numpy sgp4 jplephem ];
+
+  checkInputs = [ pandas ipython matplotlib assay ];
+
+  checkPhase = ''
+    runHook preCheck
+
+    cd ci
+    assay --batch skyfield.tests
+
+    runHook postCheck
+  '';
+
+  pythonImportsCheck = [ "skyfield" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/skyfielders/python-skyfield";
+    description = "Elegant astronomy for Python";
+    license = licenses.mit;
+    maintainers = with maintainers; [ zane ];
+  };
+}
diff --git a/pkgs/os-specific/linux/ksmbd-tools/default.nix b/pkgs/os-specific/linux/ksmbd-tools/default.nix
new file mode 100644
index 000000000000..d0a1f1f4e684
--- /dev/null
+++ b/pkgs/os-specific/linux/ksmbd-tools/default.nix
@@ -0,0 +1,40 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, autoconf
+, automake
+, glib
+, libkrb5
+, libnl
+, libtool
+, pkg-config
+, withKerberos ? false
+}:
+
+stdenv.mkDerivation rec {
+  pname = "ksmbd-tools";
+  version = "3.4.5";
+
+  src = fetchFromGitHub {
+    owner = "cifsd-team";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-sSCLXNdVUAdk+GnFlVx/BsAzyfz0KDdugJ1isrOztgs=";
+  };
+
+  buildInputs = [ glib libnl ] ++ lib.optional withKerberos libkrb5;
+
+  nativeBuildInputs = [ autoconf automake libtool pkg-config ];
+
+  preConfigure = "./autogen.sh";
+
+  configureFlags = lib.optional withKerberos "--enable-krb5";
+
+  meta = with lib; {
+    description = "Userspace utilities for the ksmbd kernel SMB server";
+    homepage = "https://www.kernel.org/doc/html/latest/filesystems/cifs/ksmbd.html";
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ elohmeier ];
+  };
+}
diff --git a/pkgs/servers/http/envoy/default.nix b/pkgs/servers/http/envoy/default.nix
index 1cd6e0c785ef..b9342ccd4fac 100644
--- a/pkgs/servers/http/envoy/default.nix
+++ b/pkgs/servers/http/envoy/default.nix
@@ -1,14 +1,14 @@
 { lib
-, bazel_4
+, bazel_5
 , buildBazelPackage
 , fetchFromGitHub
-, fetchpatch
 , stdenv
 , cmake
 , gn
 , go
 , jdk
 , ninja
+, patchelf
 , python3
 , linuxHeaders
 , nixosTests
@@ -23,19 +23,19 @@ let
     # However, the version string is more useful for end-users.
     # These are contained in a attrset of their own to make it obvious that
     # people should update both.
-    version = "1.21.4";
-    rev = "782ba5e5ab9476770378ec9f1901803e0d38ac41";
+    version = "1.23.1";
+    rev = "edd69583372955fdfa0b8ca3820dd7312c094e46";
   };
 in
 buildBazelPackage rec {
   pname = "envoy";
   inherit (srcVer) version;
-  bazel = bazel_4;
+  bazel = bazel_5;
   src = fetchFromGitHub {
     owner = "envoyproxy";
     repo = "envoy";
     inherit (srcVer) rev;
-    hash = "sha256-SthKDMQs5yNU0iouAPVsDeCPKcsBXmO9ebDwu58UQRs=";
+    sha256 = "sha256:157dbmp479xv5507n48yibvlgi2ac0l3sl9rzm28cm9lhzwva3k0";
 
     postFetch = ''
       chmod -R +w $out
@@ -48,26 +48,21 @@ buildBazelPackage rec {
   postPatch = ''
     sed -i 's,#!/usr/bin/env python3,#!${python3}/bin/python,' bazel/foreign_cc/luajit.patch
     sed -i '/javabase=/d' .bazelrc
-    # Patch paths to build tools, and disable gold because it just segfaults.
-    substituteInPlace bazel/external/wee8.genrule_cmd \
-      --replace '"''$$gn"' '"''$$(command -v gn)"' \
-      --replace '"''$$ninja"' '"''$$(command -v ninja)"' \
-      --replace '"''$$WEE8_BUILD_ARGS"' '"''$$WEE8_BUILD_ARGS use_gold=false"'
+
+    # Use system Python.
+    sed -i -e '/python_interpreter_target =/d' -e '/@python3_10/d' bazel/python_dependencies.bzl
   '';
 
   patches = [
-    # make linux/tcp.h relative. drop when upgrading to >1.21
-    (fetchpatch {
-      url = "https://github.com/envoyproxy/envoy/commit/68448aae7a78a3123097b6ea96016b270457e7b8.patch";
-      sha256 = "123kv3x37p8fgfp29jhw5xg5js5q5ipibs8hsm7gzfd5bcllnpfh";
-    })
-
     # fix issues with brotli and GCC 11.2.0+ (-Werror=vla-parameter)
     ./bump-brotli.patch
 
     # fix linux-aarch64 WAMR builds
     # (upstream WAMR only detects aarch64 on Darwin, not Linux)
     ./fix-aarch64-wamr.patch
+
+    # use system Python, not bazel-fetched binary Python
+    ./use-system-python.patch
   ];
 
   nativeBuildInputs = [
@@ -77,6 +72,7 @@ buildBazelPackage rec {
     go
     jdk
     ninja
+    patchelf
   ];
 
   buildInputs = [
@@ -85,8 +81,8 @@ buildBazelPackage rec {
 
   fetchAttrs = {
     sha256 = {
-      x86_64-linux = "sha256-/SA+WFHcMjk6iLwuEmuBIzy3pMhw7TThIEx292dv6IE=";
-      aarch64-linux = "sha256-0XdeirdIP7+nKy8zZbr2uHN2RZ4ZFOJt9i/+Ow1s/W4=";
+      x86_64-linux = "0y3gpvx148bnn6kljdvkg99m681vw39l0avrhvncbf62hvpifqkw";
+      aarch64-linux = "0lln5mdlskahz5hb4w268ys2ksy3051drrwlhracmk4i7rpm7fq3";
     }.${stdenv.system} or (throw "unsupported system ${stdenv.system}");
     dontUseCmakeConfigure = true;
     dontUseGnConfigure = true;
@@ -95,6 +91,12 @@ buildBazelPackage rec {
       find $bazelOut/external -name requirements.bzl | while read requirements; do
         sed -i '/# Generated from /d' "$requirements"
       done
+      find $bazelOut/external -type f -executable | while read execbin; do
+        file "$execbin" | grep -q ': ELF .*, dynamically linked,' || continue
+        patchelf \
+          --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) \
+          "$execbin"
+      done
 
       # Remove references to paths in the Nix store.
       sed -i \
@@ -138,6 +140,12 @@ buildBazelPackage rec {
     "--cxxopt=-Wno-maybe-uninitialized"
     "--cxxopt=-Wno-uninitialized"
     "--cxxopt=-Wno-error=type-limits"
+    "--cxxopt=-Wno-error=range-loop-construct"
+
+    # Force use of system Java.
+    "--extra_toolchains=@local_jdk//:all"
+    "--java_runtime_version=local_jdk"
+    "--tool_java_runtime_version=local_jdk"
 
     "--define=wasm=${wasmRuntime}"
   ];
diff --git a/pkgs/servers/http/envoy/use-system-python.patch b/pkgs/servers/http/envoy/use-system-python.patch
new file mode 100644
index 000000000000..a2030cc75fd0
--- /dev/null
+++ b/pkgs/servers/http/envoy/use-system-python.patch
@@ -0,0 +1,58 @@
+diff --git a/bazel/python_dependencies.bzl b/bazel/python_dependencies.bzl
+index d9dfb14a9b..b8e92452a7 100644
+--- a/bazel/python_dependencies.bzl
++++ b/bazel/python_dependencies.bzl
+@@ -1,10 +1,8 @@
+ load("@rules_python//python:pip.bzl", "pip_install", "pip_parse")
+-load("@python3_10//:defs.bzl", "interpreter")
+ 
+ def envoy_python_dependencies():
+     pip_parse(
+         name = "base_pip3",
+-        python_interpreter_target = interpreter,
+         requirements_lock = "@envoy//tools/base:requirements.txt",
+         extra_pip_args = ["--require-hashes"],
+     )
+@@ -12,14 +10,12 @@ def envoy_python_dependencies():
+     # These need to use `pip_install`
+     pip_install(
+         # Note: dev requirements do *not* check hashes
+-        python_interpreter_target = interpreter,
+         name = "dev_pip3",
+         requirements = "@envoy//tools/dev:requirements.txt",
+     )
+ 
+     pip_install(
+         name = "fuzzing_pip3",
+-        python_interpreter_target = interpreter,
+         requirements = "@rules_fuzzing//fuzzing:requirements.txt",
+         extra_pip_args = ["--require-hashes"],
+     )
+diff --git a/bazel/repositories_extra.bzl b/bazel/repositories_extra.bzl
+index 885b41dec6..ac5605eb30 100644
+--- a/bazel/repositories_extra.bzl
++++ b/bazel/repositories_extra.bzl
+@@ -1,22 +1,12 @@
+ load("@emsdk//:deps.bzl", emsdk_deps = "deps")
+-load("@rules_python//python:repositories.bzl", "python_register_toolchains")
+ load("@proxy_wasm_cpp_host//bazel/cargo/wasmtime:crates.bzl", "wasmtime_fetch_remote_crates")
+ load("//bazel/external/cargo:crates.bzl", "raze_fetch_remote_crates")
+ load("@aspect_bazel_lib//lib:repositories.bzl", "aspect_bazel_lib_dependencies")
+ 
+-# Python version for `rules_python`
+-PYTHON_VERSION = "3.10.2"
+-
+ # Envoy deps that rely on a first stage of dependency loading in envoy_dependencies().
+-def envoy_dependencies_extra(python_version = PYTHON_VERSION):
++def envoy_dependencies_extra():
+     emsdk_deps()
+     raze_fetch_remote_crates()
+     wasmtime_fetch_remote_crates()
+ 
+-    # Registers underscored Python minor version - eg `python3_10`
+-    python_register_toolchains(
+-        name = "python%s" % ("_".join(python_version.split(".")[:-1])),
+-        python_version = python_version,
+-    )
+-
+     aspect_bazel_lib_dependencies()
diff --git a/pkgs/servers/http/pomerium/default.nix b/pkgs/servers/http/pomerium/default.nix
index b6de805a619b..42af2054caf2 100644
--- a/pkgs/servers/http/pomerium/default.nix
+++ b/pkgs/servers/http/pomerium/default.nix
@@ -1,8 +1,10 @@
 { buildGoModule
 , fetchFromGitHub
+, callPackage
 , lib
 , envoy
-, zip
+, mkYarnPackage
+, fetchYarnDeps
 , nixosTests
 , pomerium-cli
 }:
@@ -12,19 +14,49 @@ let
 in
 buildGoModule rec {
   pname = "pomerium";
-  version = "0.17.1";
+  version = "0.19.0";
   src = fetchFromGitHub {
     owner = "pomerium";
     repo = "pomerium";
     rev = "v${version}";
-    hash = "sha256:0b9mdzyfn7c6gwgslqk787yyrrcmdjf3282vx2zvhcr3psz0xqwx";
+    sha256 = "sha256:0s5ji1iywymzxlv89y3ivl5vngkifhbpidpwxdrh969l3c5r4klf";
+  };
+
+  vendorSha256 = "sha256:1p78nb7bryvs7p5iq6ihylflyjia60x4hd9c62ffwz37dwqlbi33";
+
+  ui = mkYarnPackage {
+    inherit version;
+    src = "${src}/ui";
+
+    # update pomerium-ui-package.json when updating package, sourced from ui/package.json
+    packageJSON = ./pomerium-ui-package.json;
+    offlineCache = fetchYarnDeps {
+      yarnLock = "${src}/ui/yarn.lock";
+      sha256 = "sha256:1n6swanrds9hbd4yyfjzpnfhsb8fzj1pwvvcg3w7b1cgnihclrmv";
+    };
+
+    buildPhase = ''
+      runHook preBuild
+      yarn --offline build
+      runHook postbuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+      cp -R deps/pomerium/dist $out
+      runHook postInstall
+    '';
+
+    doDist = false;
   };
 
-  vendorSha256 = "sha256:1cq4m5a7z64yg3v1c68d15ilw78il6p53vaqzxgn338zjggr3kig";
   subPackages = [
     "cmd/pomerium"
   ];
 
+  # patch pomerium to allow use of external envoy
+  patches = [ ./external-envoy.diff ];
+
   ldflags = let
     # Set a variety of useful meta variables for stamping the build with.
     setVars = {
@@ -34,7 +66,7 @@ buildGoModule rec {
         ProjectName = "pomerium";
         ProjectURL = "github.com/pomerium/pomerium";
       };
-      "github.com/pomerium/pomerium/internal/envoy" = {
+      "github.com/pomerium/pomerium/pkg/envoy" = {
         OverrideEnvoyPath = "${envoy}/bin/envoy";
       };
     };
@@ -54,8 +86,8 @@ buildGoModule rec {
     # Replace embedded envoy with nothing.
     # We set OverrideEnvoyPath above, so rawBinary should never get looked at
     # but we still need to set a checksum/version.
-    rm internal/envoy/files/files_{darwin,linux}*.go
-    cat <<EOF >internal/envoy/files/files_generic.go
+    rm pkg/envoy/files/files_{darwin,linux}*.go
+    cat <<EOF >pkg/envoy/files/files_external.go
     package files
 
     import _ "embed" // embed
@@ -68,8 +100,11 @@ buildGoModule rec {
     //go:embed envoy.version
     var rawVersion string
     EOF
-    sha256sum '${envoy}/bin/envoy' > internal/envoy/files/envoy.sha256
-    echo '${envoy.version}' > internal/envoy/files/envoy.version
+    sha256sum '${envoy}/bin/envoy' > pkg/envoy/files/envoy.sha256
+    echo '${envoy.version}' > pkg/envoy/files/envoy.version
+
+    # put the built UI files where they will be picked up as part of binary build
+    cp -r ${ui}/* ui/dist
   '';
 
   installPhase = ''
diff --git a/pkgs/servers/http/pomerium/external-envoy.diff b/pkgs/servers/http/pomerium/external-envoy.diff
new file mode 100644
index 000000000000..49f4985ad77c
--- /dev/null
+++ b/pkgs/servers/http/pomerium/external-envoy.diff
@@ -0,0 +1,48 @@
+diff --git a/pkg/envoy/envoy.go b/pkg/envoy/envoy.go
+index e32cfc29..9d32c057 100644
+--- a/pkg/envoy/envoy.go
++++ b/pkg/envoy/envoy.go
+@@ -8,9 +8,9 @@ import (
+ 	"errors"
+ 	"fmt"
+ 	"io"
++	"io/fs"
+ 	"os"
+ 	"os/exec"
+-	"path"
+ 	"path/filepath"
+ 	"regexp"
+ 	"strconv"
+@@ -36,8 +36,12 @@ import (
+ 
+ const (
+ 	configFileName = "envoy-config.yaml"
++	workingDirectoryName = ".pomerium-envoy"
++	embeddedEnvoyPermissions     fs.FileMode = 0o700
+ )
+ 
++var OverrideEnvoyPath = ""
++
+ type serverOptions struct {
+ 	services string
+ 	logLevel string
+@@ -60,13 +64,16 @@ type Server struct {
+ 
+ // NewServer creates a new server with traffic routed by envoy.
+ func NewServer(ctx context.Context, src config.Source, builder *envoyconfig.Builder) (*Server, error) {
+-	envoyPath, err := Extract()
++	envoyPath := OverrideEnvoyPath
++	wd := filepath.Join(os.TempDir(), workingDirectoryName)
++
++	err := os.MkdirAll(wd, embeddedEnvoyPermissions)
+ 	if err != nil {
+-		return nil, fmt.Errorf("extracting envoy: %w", err)
++		return nil, fmt.Errorf("error creating temporary working directory for envoy: %w", err)
+ 	}
+ 
+ 	srv := &Server{
+-		wd:        path.Dir(envoyPath),
++		wd:        wd,
+ 		builder:   builder,
+ 		grpcPort:  src.GetConfig().GRPCPort,
+ 		httpPort:  src.GetConfig().HTTPPort,
diff --git a/pkgs/servers/http/pomerium/pomerium-ui-package.json b/pkgs/servers/http/pomerium/pomerium-ui-package.json
new file mode 100644
index 000000000000..6b9dcf4a3e8d
--- /dev/null
+++ b/pkgs/servers/http/pomerium/pomerium-ui-package.json
@@ -0,0 +1,61 @@
+{
+  "name": "pomerium",
+  "version": "1.0.0",
+  "main": "src/index.tsx",
+  "license": "Apache-2.0",
+  "scripts": {
+    "build": "ts-node ./scripts/esbuild.ts",
+    "format": "prettier --write .",
+    "lint": "eslint .",
+    "watch": "ts-node ./scripts/esbuild.ts --watch"
+  },
+  "browserslist": {
+    "production": [
+      ">0.2%",
+      "not dead",
+      "not op_mini all"
+    ],
+    "development": [
+      "last 1 chrome version",
+      "last 1 firefox version",
+      "last 1 safari version"
+    ]
+  },
+  "dependencies": {
+    "@babel/core": "^7.0.0",
+    "@emotion/react": "^11.7.1",
+    "@emotion/styled": "^11.6.0",
+    "@fontsource/dm-mono": "^4.5.2",
+    "@fontsource/dm-sans": "^4.5.1",
+    "@mui/icons-material": "^5.3.1",
+    "@mui/material": "^5.4.0",
+    "luxon": "^2.3.0",
+    "markdown-to-jsx": "^7.1.7",
+    "react": "^17.0.2",
+    "react-dom": "^17.0.2",
+    "react-feather": "^2.0.9"
+  },
+  "devDependencies": {
+    "@trivago/prettier-plugin-sort-imports": "2.0.4",
+    "@types/luxon": "^2.0.9",
+    "@types/node": "^17.0.14",
+    "@types/react": "^17.0.34",
+    "@types/react-dom": "^17.0.11",
+    "@typescript-eslint/eslint-plugin": "^5.10.2",
+    "@typescript-eslint/parser": "^5.10.2",
+    "esbuild": "^0.13.12",
+    "eslint": "7.32.0",
+    "eslint-config-prettier": "^8.3.0",
+    "eslint-plugin-react": "^7.28.0",
+    "prettier": "^2.4.1",
+    "ts-node": "^10.4.0",
+    "typescript": "^4.4.4"
+  },
+  "prettier": {
+    "importOrder": [
+      "^[./]"
+    ],
+    "importOrderSeparation": true,
+    "importOrderSortSpecifiers": true
+  }
+}
diff --git a/pkgs/servers/tautulli/default.nix b/pkgs/servers/tautulli/default.nix
index ceb8582a6868..f02b0f7e92e6 100644
--- a/pkgs/servers/tautulli/default.nix
+++ b/pkgs/servers/tautulli/default.nix
@@ -2,7 +2,7 @@
 
 buildPythonApplication rec {
   pname = "Tautulli";
-  version = "2.10.2";
+  version = "2.10.4";
   format = "other";
 
   pythonPath = [ setuptools ];
@@ -12,7 +12,7 @@ buildPythonApplication rec {
     owner = "Tautulli";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-nEiyYpj5J95tQAFcyRlaF5VEfosCkk4cmdYKLjfeA98=";
+    sha256 = "sha256-G7rKPDozo5IyYOqfhoZcn1obASzJx8PpQt53CCmDZek=";
   };
 
   installPhase = ''
diff --git a/pkgs/tools/security/hashcat/default.nix b/pkgs/tools/security/hashcat/default.nix
index ed06ee992e4a..ec078d4695a8 100644
--- a/pkgs/tools/security/hashcat/default.nix
+++ b/pkgs/tools/security/hashcat/default.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname   = "hashcat";
-  version = "6.2.5";
+  version = "6.2.6";
 
   src = fetchurl {
     url = "https://hashcat.net/files/hashcat-${version}.tar.gz";
-    sha256 = "sha256-b2iZ162Jlln3tDpNaAmFQ6tUbSFx+OUdaR0Iplk3iWk=";
+    sha256 = "sha256-sl4Qd7zzSQjMjxjBppouyYsEeyy88PURRNzzuh4Leyo=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/security/pomerium-cli/default.nix b/pkgs/tools/security/pomerium-cli/default.nix
index 9463e0851898..cded5b83643a 100644
--- a/pkgs/tools/security/pomerium-cli/default.nix
+++ b/pkgs/tools/security/pomerium-cli/default.nix
@@ -1,7 +1,6 @@
 { buildGoModule
 , fetchFromGitHub
 , lib
-, pomerium
 }:
 
 let
@@ -9,16 +8,16 @@ let
 in
 buildGoModule rec {
   pname = "pomerium-cli";
-  inherit (pomerium) version;
+  version = "0.18.0";
 
   src = fetchFromGitHub {
     owner = "pomerium";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-AZeBtHy2MEPE8uZVJv4wLdOt6f9QNbaQnP5a2YVYYAg=";
+    sha256 = "sha256-P1aEAr+Q2wnKLq3JHQbss6SPdrYnzE8J2yp/Lu5Cg/0=";
   };
 
-  vendorSha256 = "sha256-K0Vdsl6wD0eJeJRsUjiNPuGx1KPkZrlCCzdyAysVonc=";
+  vendorSha256 = "sha256-AAdhFpFCbUU3kjVQ84sYWYrGBWD5u6f219MvVS0j9Oo=";
 
   subPackages = [
     "cmd/pomerium-cli"
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 20ac244847d5..fb00b15e5c57 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1301,6 +1301,8 @@ with pkgs;
 
   kanata-with-cmd = callPackage ../tools/system/kanata { withCmd = true; };
 
+  ksmbd-tools = callPackage ../os-specific/linux/ksmbd-tools { };
+
   ksnip = libsForQt5.callPackage ../tools/misc/ksnip { };
 
   kubevirt = callPackage ../tools/virtualization/kubevirt { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 527d270363a9..c112586205c5 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -754,6 +754,8 @@ in {
 
   aspy-yaml = callPackage ../development/python-modules/aspy.yaml { };
 
+  assay = callPackage ../development/python-modules/assay { };
+
   assertpy = callPackage ../development/python-modules/assertpy { };
 
   asterisk-mbox = callPackage ../development/python-modules/asterisk-mbox { };
@@ -4723,6 +4725,8 @@ in {
     inherit (self) systemd pytest;
   };
 
+  jplephem = callPackage ../development/python-modules/jplephem { };
+
   jproperties = callPackage ../development/python-modules/jproperties { };
 
   jpylyzer = callPackage ../development/python-modules/jpylyzer { };
@@ -9960,6 +9964,8 @@ in {
 
   sgmllib3k = callPackage ../development/python-modules/sgmllib3k { };
 
+  sgp4 = callPackage ../development/python-modules/sgp4 { };
+
   shamir-mnemonic = callPackage ../development/python-modules/shamir-mnemonic { };
 
   shap = callPackage ../development/python-modules/shap { };
@@ -10070,6 +10076,8 @@ in {
 
   skybellpy = callPackage ../development/python-modules/skybellpy { };
 
+  skyfield = callPackage ../development/python-modules/skyfield { };
+
   skytemple-dtef = callPackage ../development/python-modules/skytemple-dtef { };
 
   skytemple-eventserver = callPackage ../development/python-modules/skytemple-eventserver { };