diff --git a/nixos/modules/programs/gnupg.nix b/nixos/modules/programs/gnupg.nix
index 1028ef53bae1..1a9006aad14e 100644
--- a/nixos/modules/programs/gnupg.nix
+++ b/nixos/modules/programs/gnupg.nix
@@ -129,12 +129,14 @@ in
     environment.interactiveShellInit = ''
       # Bind gpg-agent to this TTY if gpg commands are used.
       export GPG_TTY=$(tty)
+    '';
 
-    '' + (optionalString cfg.agent.enableSSHSupport ''
-      # SSH agent protocol doesn't support changing TTYs, so bind the agent
-      # to every new TTY.
-      ${cfg.package}/bin/gpg-connect-agent --quiet updatestartuptty /bye > /dev/null
-    '');
+    programs.ssh.extraConfig = optionalString cfg.agent.enableSSHSupport ''
+      # The SSH agent protocol doesn't have support for changing TTYs; however we
+      # can simulate this with the `exec` feature of openssh (see ssh_config(5))
+      # that hooks a command to the shell currently running the ssh program.
+      Match host * exec "${cfg.package}/bin/gpg-connect-agent --quiet updatestartuptty /bye > /dev/null"
+    '';
 
     environment.extraInit = mkIf cfg.agent.enableSSHSupport ''
       if [ -z "$SSH_AUTH_SOCK" ]; then
diff --git a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
index 77280a9680e3..5398ef6b84eb 100644
--- a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
+++ b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
@@ -240,11 +240,11 @@ def main() -> None:
         if "@graceful@" == "1":
             flags.append("--graceful")
 
-        subprocess.check_call(["@systemd@/bin/bootctl", "--path=@efiSysMountPoint@"] + flags + ["install"])
+        subprocess.check_call(["@systemd@/bin/bootctl", "--esp-path=@efiSysMountPoint@"] + flags + ["install"])
     else:
         # Update bootloader to latest if needed
         available_out = subprocess.check_output(["@systemd@/bin/bootctl", "--version"], universal_newlines=True).split()[2]
-        installed_out = subprocess.check_output(["@systemd@/bin/bootctl", "--path=@efiSysMountPoint@", "status"], universal_newlines=True)
+        installed_out = subprocess.check_output(["@systemd@/bin/bootctl", "--esp-path=@efiSysMountPoint@", "status"], universal_newlines=True)
 
         # See status_binaries() in systemd bootctl.c for code which generates this
         installed_match = re.search(r"^\W+File:.*/EFI/(?:BOOT|systemd)/.*\.efi \(systemd-boot ([\d.]+[^)]*)\)$",
@@ -263,7 +263,7 @@ def main() -> None:
 
         if installed_version < available_version:
             print("updating systemd-boot from %s to %s" % (installed_version, available_version))
-            subprocess.check_call(["@systemd@/bin/bootctl", "--path=@efiSysMountPoint@", "update"])
+            subprocess.check_call(["@systemd@/bin/bootctl", "--esp-path=@efiSysMountPoint@", "update"])
 
     mkdir_p("@efiSysMountPoint@/efi/nixos")
     mkdir_p("@efiSysMountPoint@/loader/entries")
diff --git a/pkgs/applications/blockchains/polkadot/default.nix b/pkgs/applications/blockchains/polkadot/default.nix
index abf56d54fe6b..2e7df608eba0 100644
--- a/pkgs/applications/blockchains/polkadot/default.nix
+++ b/pkgs/applications/blockchains/polkadot/default.nix
@@ -10,13 +10,13 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "polkadot";
-  version = "0.9.27";
+  version = "0.9.28";
 
   src = fetchFromGitHub {
     owner = "paritytech";
     repo = "polkadot";
     rev = "v${version}";
-    sha256 = "sha256-abDkDkFXBG4C7lvE9g6cvUYTfQt7ObZ+Ya8V0W7ASBE=";
+    sha256 = "sha256-PYPNbysk9jHGtAUGr8O/Ah0ArTNKQYYToR5djG+XujI=";
 
     # the build process of polkadot requires a .git folder in order to determine
     # the git commit hash that is being built and add it to the version string.
@@ -32,7 +32,7 @@ rustPlatform.buildRustPackage rec {
     '';
   };
 
-  cargoSha256 = "sha256-xDjHu6JARIFy2fVQMGhkdU9Qcz/aqumBFe4MjlH0TCY=";
+  cargoSha256 = "sha256-Dqcjt3yvZdaHp6sIQFo9wYH/icIInyXqKHE1Q/JjrwY=";
 
   buildInputs = lib.optional stdenv.isDarwin [ Security ];
 
diff --git a/pkgs/applications/kde/kleopatra.nix b/pkgs/applications/kde/kleopatra.nix
index a640802fed31..37b10d1085c8 100644
--- a/pkgs/applications/kde/kleopatra.nix
+++ b/pkgs/applications/kde/kleopatra.nix
@@ -1,5 +1,5 @@
 {
-  mkDerivation, lib, kdepimTeam,
+  mkDerivation, fetchpatch, lib, kdepimTeam,
   extra-cmake-modules, kdoctools,
   boost, gpgme, kcmutils, kdbusaddons, kiconthemes, kitemmodels, kmime,
   knotifications, kwindowsystem, kxmlgui, libkleo, kcrash
@@ -7,15 +7,25 @@
 
 mkDerivation {
   pname = "kleopatra";
+
+  patches = [
+    (fetchpatch {
+      url = "https://invent.kde.org/pim/kleopatra/-/commit/87d8b00d4b2286489d5fadc9cfa07f1d721cdfe3.patch";
+      sha256 = "sha256-s1tXB7h0KtFwwZHx8rhpI0nLZmwhWAiraHEF3KzncMc=";
+    })
+  ];
+
+  nativeBuildInputs = [ extra-cmake-modules kdoctools ];
+
+  buildInputs = [
+    boost gpgme kcmutils kdbusaddons kiconthemes kitemmodels kmime
+    knotifications kwindowsystem kxmlgui libkleo kcrash
+  ];
+
   meta = {
     homepage = "https://apps.kde.org/kleopatra/";
     description = "Certificate manager and unified crypto GUI";
     license = with lib.licenses; [ gpl2 lgpl21 fdl12 ];
     maintainers = kdepimTeam;
   };
-  nativeBuildInputs = [ extra-cmake-modules kdoctools ];
-  buildInputs = [
-    boost gpgme kcmutils kdbusaddons kiconthemes kitemmodels kmime
-    knotifications kwindowsystem kxmlgui libkleo kcrash
-  ];
 }
diff --git a/pkgs/applications/misc/gum/default.nix b/pkgs/applications/misc/gum/default.nix
index 988b4d0c6f18..b552b6083258 100644
--- a/pkgs/applications/misc/gum/default.nix
+++ b/pkgs/applications/misc/gum/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "gum";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "charmbracelet";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-zFw2Lf+N8jxrw6JYqzsDMXIMchFc2bxAofELrgIMquk=";
+    sha256 = "sha256-S+sbfo7F6+bJeHywxM3jkZN+7MNQh9YRyLPHTC4wZnk=";
   };
 
-  vendorSha256 = "sha256-8MqBGMcYR/kbExfXBeQrO8p7a/uawUk2hLmnQtarWEw=";
+  vendorSha256 = "sha256-vvNoO5eABGVwvAzK33uPelmo3BKxfqiYgEXZI7kgeSo=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/applications/misc/hugo/default.nix b/pkgs/applications/misc/hugo/default.nix
index dc4d2851c1fa..b2c177fda2d6 100644
--- a/pkgs/applications/misc/hugo/default.nix
+++ b/pkgs/applications/misc/hugo/default.nix
@@ -1,14 +1,14 @@
-{ stdenv, lib, buildGoModule, fetchFromGitHub, installShellFiles }:
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
 
 buildGoModule rec {
   pname = "hugo";
-  version = "0.102.0";
+  version = "0.102.1";
 
   src = fetchFromGitHub {
     owner = "gohugoio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-OepxYjzTJisBNoZP3IrYMj01Op7jsA2tWHrVDpwP9qE=";
+    sha256 = "sha256-lCdFxUlqGRQ5IMlhPhcJ5Ma35q75LnlcBNW1XUSWb1I=";
   };
 
   vendorSha256 = "sha256-y9bZ9EoB/n300oXO+PT4d8vSVMJC3HYyMRNf6eNhVik=";
@@ -23,6 +23,8 @@ buildGoModule rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
+  ldflags = [ "-s" "-w" "-X github.com/gohugoio/hugo/common/hugo.vendorInfo=nixpkgs" ];
+
   postInstall = ''
     $out/bin/hugo gen man
     installManPage man/*
diff --git a/pkgs/applications/misc/limesctl/default.nix b/pkgs/applications/misc/limesctl/default.nix
index 73c8abaa13fe..1fddd369779a 100644
--- a/pkgs/applications/misc/limesctl/default.nix
+++ b/pkgs/applications/misc/limesctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "limesctl";
-  version = "3.0.0";
+  version = "3.0.2";
 
   src = fetchFromGitHub {
     owner = "sapcc";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-52Tq6gKozM/IFUyAy8N+YDqlbcFNQw6b2tc268Zco6g=";
+    sha256 = "sha256-+KOtGf+WgI2PhfFJnNyx5ycekRmfbqjSqvWOEhG65Oo=";
   };
 
-  vendorSha256 = "sha256-7QEb5J5IaxisKjbulyHq5PGVeKAX022Pz+5OV5qD7Uo=";
+  vendorSha256 = "sha256-LzLUz6diWva2HaxlhEGElbwUvUhCR0Tjsk/G/n5N3+k=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/applications/networking/ipfs/default.nix b/pkgs/applications/networking/ipfs/default.nix
index 71df2c1a075f..6054bca1d8ad 100644
--- a/pkgs/applications/networking/ipfs/default.nix
+++ b/pkgs/applications/networking/ipfs/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "ipfs";
-  version = "0.14.0"; # When updating, also check if the repo version changed and adjust repoVersion below
+  version = "0.15.0"; # When updating, also check if the repo version changed and adjust repoVersion below
   rev = "v${version}";
 
   passthru.repoVersion = "12"; # Also update ipfs-migrator when changing the repo version
@@ -10,7 +10,7 @@ buildGoModule rec {
   # go-ipfs makes changes to it's source tarball that don't match the git source.
   src = fetchurl {
     url = "https://github.com/ipfs/kubo/releases/download/${rev}/kubo-source.tar.gz";
-    hash = "sha256-93jd0r5nWkGrMnaPXoJMf6dHxMrtiWPgkHYaWH109lg=";
+    hash = "sha256-GkOY1G2CKXbMbHXkw5v27HmfkJIl2nZOmjjZbzuaRWs=";
   };
 
   # tarball contains multiple files/directories
diff --git a/pkgs/applications/terminal-emulators/hyper/default.nix b/pkgs/applications/terminal-emulators/hyper/default.nix
index 707534d26193..06c819d4bb1b 100644
--- a/pkgs/applications/terminal-emulators/hyper/default.nix
+++ b/pkgs/applications/terminal-emulators/hyper/default.nix
@@ -15,11 +15,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "hyper";
-  version = "3.2.3";
+  version = "3.3.0";
 
   src = fetchurl {
     url = "https://github.com/vercel/hyper/releases/download/v${version}/hyper_${version}_amd64.deb";
-    sha256 = "sha256-CHLkHH9u5YWlmRDa4H3ymqg1YMBYjo+kuxpu0OVv4E8=";
+    sha256 = "sha256-VJAFa4I5nHuS/aXhiiXztUh2MjCq5zdwCtK0oSsOrGQ=";
   };
 
   nativeBuildInputs = [ dpkg ];
diff --git a/pkgs/applications/virtualization/nixpacks/default.nix b/pkgs/applications/virtualization/nixpacks/default.nix
index b5e5c3e08285..9449eeee3e0c 100644
--- a/pkgs/applications/virtualization/nixpacks/default.nix
+++ b/pkgs/applications/virtualization/nixpacks/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nixpacks";
-  version = "0.3.3";
+  version = "0.3.8";
 
   src = fetchFromGitHub {
     owner = "railwayapp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-CnRYMdqQvYvHzYNFa6QNh9yFyHeXrMJFPafEcYZ/sHE=";
+    sha256 = "sha256-Fzj22vGW4qLXSw5lICxVbiVFxYYvkarVLLHT+DdLVRk=";
   };
 
-  cargoSha256 = "sha256-OHG1XMSurmSxtMb/rizgLnyIHIo+SJSlM1Ggl8crHzM=";
+  cargoSha256 = "sha256-v3LNadq3E08Z+LfRSGQxG1HPgYWBQ8K/44LOrjgrsy0=";
 
   # skip test due FHS dependency
   doCheck = false;
diff --git a/pkgs/data/icons/fluent-icon-theme/default.nix b/pkgs/data/icons/fluent-icon-theme/default.nix
new file mode 100644
index 000000000000..c3e4f71e6cdc
--- /dev/null
+++ b/pkgs/data/icons/fluent-icon-theme/default.nix
@@ -0,0 +1,73 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+, gtk3
+, hicolor-icon-theme
+, jdupes
+, roundedIcons ? false
+, blackPanelIcons ? false
+, colorVariants ? []
+,
+}:
+let
+  pname = "Fluent-icon-theme";
+in
+lib.checkListOfEnum "${pname}: available color variants" [
+  "standard"
+  "green"
+  "grey"
+  "orange"
+  "pink"
+  "purple"
+  "red"
+  "yellow"
+  "teal"
+  "all"
+] colorVariants
+
+stdenvNoCC.mkDerivation rec {
+  inherit pname;
+  version = "2022-02-28";
+
+  src = fetchFromGitHub {
+    owner = "vinceliuice";
+    repo = pname;
+    rev = version;
+    sha256 = "UMj3qF9lhd9kM7J/3RtG3AiWlBontrowfsFOb3yr0tQ=";
+  };
+
+  nativeBuildInputs = [ gtk3 jdupes ];
+
+  buildInputs = [ hicolor-icon-theme ];
+
+  # Unnecessary & slow fixup's
+  dontPatchELF = true;
+  dontRewriteSymlinks = true;
+  dontDropIconThemeCache = true;
+
+  postPatch = ''
+    patchShebangs install.sh
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    ./install.sh --dest $out/share/icons \
+      --name Fluent \
+      ${builtins.toString colorVariants} \
+      ${lib.optionalString roundedIcons "--round"} \
+      ${lib.optionalString blackPanelIcons "--black"}
+
+    jdupes --link-soft --recurse $out/share
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Fluent icon theme for linux desktops";
+    homepage = "https://github.com/vinceliuice/Fluent-icon-theme";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ icy-thought ];
+  };
+}
diff --git a/pkgs/data/icons/whitesur-icon-theme/default.nix b/pkgs/data/icons/whitesur-icon-theme/default.nix
index 8708ee28807d..6270d2a66429 100644
--- a/pkgs/data/icons/whitesur-icon-theme/default.nix
+++ b/pkgs/data/icons/whitesur-icon-theme/default.nix
@@ -12,17 +12,28 @@
 let
   pname = "Whitesur-icon-theme";
 in
-lib.checkListOfEnum "${pname}: theme variants" [ "default" "purple" "pink" "red" "orange" "yellow" "green" "grey" "nord" "all" ] themeVariants
+lib.checkListOfEnum "${pname}: theme variants" [
+  "default"
+  "purple"
+  "pink"
+  "red"
+  "orange"
+  "yellow"
+  "green"
+  "grey"
+  "nord"
+  "all"
+] themeVariants
 
 stdenvNoCC.mkDerivation rec {
   inherit pname;
-  version = "2022-05-11";
+  version = "2022-08-30";
 
   src = fetchFromGitHub {
     owner = "vinceliuice";
     repo = pname;
     rev = version;
-    sha256 = "sha256-7Bbkjbh6nZdYot0tJMWFuW1Jnl9U4KOLN/n+z92UWh4=";
+    sha256 = "pcvRD4CUwUT46/kmMbnerj5mqPCcHIRreVIh9wz6Kfg=";
   };
 
   nativeBuildInputs = [ gtk3 jdupes ];
@@ -32,7 +43,6 @@ stdenvNoCC.mkDerivation rec {
   # These fixup steps are slow and unnecessary
   dontPatchELF = true;
   dontRewriteSymlinks = true;
-
   dontDropIconThemeCache = true;
 
   postPatch = ''
diff --git a/pkgs/development/compilers/elm/default.nix b/pkgs/development/compilers/elm/default.nix
index 376e956d7ca1..ba98648a8a95 100644
--- a/pkgs/development/compilers/elm/default.nix
+++ b/pkgs/development/compilers/elm/default.nix
@@ -238,6 +238,8 @@ in lib.makeScope pkgs.newScope (self: with self; {
         }
       );
 
+      lamdera = callPackage ./packages/lamdera.nix {};
+
       inherit (nodePkgs) elm-doc-preview elm-live elm-upgrade elm-xref elm-analyse elm-git-install;
     })
   )
diff --git a/pkgs/development/compilers/elm/packages/lamdera.nix b/pkgs/development/compilers/elm/packages/lamdera.nix
new file mode 100644
index 000000000000..2439ed04cc8b
--- /dev/null
+++ b/pkgs/development/compilers/elm/packages/lamdera.nix
@@ -0,0 +1,40 @@
+{ stdenv, lib
+, fetchurl
+, autoPatchelfHook
+, gmp5, ncurses5, zlib
+}:
+
+stdenv.mkDerivation rec {
+  pname = "lamdera";
+  version = "1.0.1";
+
+  src = fetchurl {
+    url = "https://static.lamdera.com/bin/linux/lamdera-v${version}";
+    sha256 = "15dee9df5d4e71b07a65fbd89d0f7dcd8c3e7ba05fe2b0e7a30d29bbd1239d9f";
+  };
+
+  dontUnpack = true;
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+  ];
+
+  buildInputs = [
+    gmp5
+    ncurses5
+    zlib
+  ];
+
+
+  installPhase = ''
+    install -m755 -D $src $out/bin/lamdera
+  '';
+
+  meta = with lib; {
+    homepage = https://lamdera.com;
+    license = licenses.unfree;
+    description = "A delightful platform for full-stack web apps";
+    platforms = [ "x86_64-linux" ];
+    maintainers = with maintainers; [ Zimmi48 ];
+  };
+}
diff --git a/pkgs/development/compilers/silice/default.nix b/pkgs/development/compilers/silice/default.nix
new file mode 100644
index 000000000000..287862b5f2b8
--- /dev/null
+++ b/pkgs/development/compilers/silice/default.nix
@@ -0,0 +1,87 @@
+{ stdenv, fetchFromGitHub, lib
+, cmake, pkg-config, openjdk
+, libuuid, python3
+, silice, yosys, nextpnr, verilator
+, dfu-util, icestorm, trellis
+}:
+
+stdenv.mkDerivation rec {
+  pname = "silice";
+  version = "unstable-2022-08-05";
+
+  src = fetchFromGitHub {
+    owner = "sylefeb";
+    repo = pname;
+    rev = "e26662ac757151e5dd8c60c45291b44906b1299f";
+    sha256 = "sha256-Q1JdgDlEErutZh0OfxYy5C4aVijFKlf6Hm5Iv+1jsj4=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    openjdk
+  ];
+  buildInputs = [
+    libuuid
+  ];
+  propagatedBuildInputs = [
+    (python3.withPackages (p: with p; [ edalize ]))
+  ];
+
+  postPatch = ''
+    patchShebangs antlr/antlr.sh
+    # use nixpkgs version
+    rm -r python/pybind11
+  '';
+
+  installPhase = ''
+    make install
+    mkdir -p $out
+    cp -ar ../{bin,frameworks,lib} $out/
+  '';
+
+  passthru.tests =
+    let
+      testProject = project: stdenv.mkDerivation {
+        name = "${silice.name}-test-${project}";
+        nativeBuildInputs = [
+          silice
+          yosys
+          nextpnr
+          verilator
+          dfu-util
+          icestorm
+          trellis
+        ];
+        src = "${src}/projects";
+        sourceRoot = "projects/${project}";
+        buildPhase = ''
+          targets=$(cut -d " " -f 2 configs | tr -d '\r')
+          for target in $targets ; do
+            make $target ARGS="--no_program"
+          done
+        '';
+        installPhase = ''
+          mkdir $out
+          for target in $targets ; do
+            cp -r BUILD_$target $out/
+          done
+        '';
+      };
+    in {
+      # a selection of test projects that build with the FPGA tools in
+      # nixpkgs
+      audio_sdcard_streamer = testProject "audio_sdcard_streamer";
+      bram_interface = testProject "bram_interface";
+      blinky = testProject "blinky";
+      pipeline_sort = testProject "pipeline_sort";
+    };
+
+  meta = with lib; {
+    description = "Open source language that simplifies prototyping and writing algorithms on FPGA architectures";
+    homepage = "https://github.com/sylefeb/Silice";
+    license = licenses.bsd2;
+    maintainers = [ maintainers.astro ];
+  };
+}
diff --git a/pkgs/development/libraries/poppler/default.nix b/pkgs/development/libraries/poppler/default.nix
index 8d2e91513f1e..59b4258420cb 100644
--- a/pkgs/development/libraries/poppler/default.nix
+++ b/pkgs/development/libraries/poppler/default.nix
@@ -23,7 +23,7 @@
 , texlive
 , zlib
 , withData ? true, poppler_data
-, qt5Support ? false, qtbase ? null
+, qt5Support ? false, qt6Support ? false, qtbase ? null
 , introspectionSupport ? false, gobject-introspection ? null
 , utils ? false, nss ? null
 , minimal ? false
@@ -72,7 +72,7 @@ stdenv.mkDerivation rec {
     lcms
     curl
     nss
-  ] ++ lib.optionals qt5Support [
+  ] ++ lib.optionals (qt5Support || qt6Support) [
     qtbase
   ] ++ lib.optionals introspectionSupport [
     gobject-introspection
@@ -85,6 +85,7 @@ stdenv.mkDerivation rec {
     (mkFlag (!minimal) "LIBCURL")
     (mkFlag utils "UTILS")
     (mkFlag qt5Support "QT5")
+    (mkFlag qt6Support "QT6")
   ];
 
   dontWrapQtApps = true;
diff --git a/pkgs/development/libraries/xsimd/default.nix b/pkgs/development/libraries/xsimd/default.nix
index 745ee9ee3fce..79bfdf9712ad 100644
--- a/pkgs/development/libraries/xsimd/default.nix
+++ b/pkgs/development/libraries/xsimd/default.nix
@@ -1,35 +1,13 @@
 { lib, stdenv, fetchFromGitHub, cmake, gtest }:
-let
-  version = "7.5.0";
-
-  darwin_src = fetchFromGitHub {
-    owner = "xtensor-stack";
-    repo = "xsimd";
-    rev = version;
-    sha256 = "eGAdRSYhf7rbFdm8g1Tz1ZtSVu44yjH/loewblhv9Vs=";
-    # Avoid requiring apple_sdk. We're doing this here instead of in the patchPhase
-    # because this source is directly used in arrow-cpp.
-    # pyconfig.h defines _GNU_SOURCE to 1, so we need to stamp that out too.
-    # Upstream PR with a better fix: https://github.com/xtensor-stack/xsimd/pull/463
-    postFetch = ''
-      mkdir $out
-      tar -xf $downloadedFile --directory=$out --strip-components=1
-      substituteInPlace $out/include/xsimd/types/xsimd_scalar.hpp \
-        --replace 'defined(__APPLE__)' 0 \
-        --replace 'defined(_GNU_SOURCE)' 0
-    '';
-  };
-
+stdenv.mkDerivation rec {
+  pname = "xsimd";
+  version = "8.1.0";
   src = fetchFromGitHub {
     owner = "xtensor-stack";
     repo = "xsimd";
     rev = version;
-    sha256 = "0c9pq5vz43j99z83w3b9qylfi66mn749k1afpv5cwfxggbxvy63f";
+    sha256 = "sha256-Aqs6XJkGjAjGAp0PprabSM4m+32M/UXpSHppCHdzaZk=";
   };
-in stdenv.mkDerivation {
-  pname = "xsimd";
-  inherit version;
-  src = if stdenv.hostPlatform.isDarwin then darwin_src else src;
 
   nativeBuildInputs = [ cmake ];
 
@@ -38,13 +16,14 @@ in stdenv.mkDerivation {
   doCheck = true;
   checkInputs = [ gtest ];
   checkTarget = "xtest";
-  GTEST_FILTER = let
+  GTEST_FILTER =
+    let
       # Upstream Issue: https://github.com/xtensor-stack/xsimd/issues/456
       filteredTests = lib.optionals stdenv.hostPlatform.isDarwin [
-        "error_gamma_test/sse_double.gamma"
-        "error_gamma_test/avx_double.gamma"
+        "error_gamma_test/*"
       ];
-    in "-${builtins.concatStringsSep ":" filteredTests}";
+    in
+    "-${builtins.concatStringsSep ":" filteredTests}";
 
   meta = with lib; {
     description = "C++ wrappers for SIMD intrinsics";
diff --git a/pkgs/development/python-modules/aioaladdinconnect/default.nix b/pkgs/development/python-modules/aioaladdinconnect/default.nix
index 4bb6a9305444..56298ca0b373 100644
--- a/pkgs/development/python-modules/aioaladdinconnect/default.nix
+++ b/pkgs/development/python-modules/aioaladdinconnect/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "aioaladdinconnect";
-  version = "0.1.43";
+  version = "0.1.44";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -15,7 +15,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "AIOAladdinConnect";
     inherit version;
-    hash = "sha256-P0o8LhjTzhfJerunTcadvYQOZMd7WbfnKbeAEhXFP1Q=";
+    hash = "sha256-TtqCbU3NYrRy4upBOZNSC3+TrcBg4ol7JXqeOI6+IhA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/cloudscraper/default.nix b/pkgs/development/python-modules/cloudscraper/default.nix
index 9fdc60dd7f4b..1d66da4e2bc6 100644
--- a/pkgs/development/python-modules/cloudscraper/default.nix
+++ b/pkgs/development/python-modules/cloudscraper/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "cloudscraper";
-  version = "1.2.63";
+  version = "1.2.64";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-JId7lxdSnU1BQ6AoGj2rB8Z+9QOK5/5IhjluCrDBQHg=";
+    hash = "sha256-FS+p+dtfGfStp+dWI+k/RdBb/T+ynZyuhPKRc6JZFTA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/dicom2nifti/default.nix b/pkgs/development/python-modules/dicom2nifti/default.nix
index dd43902949ab..0a9344313303 100644
--- a/pkgs/development/python-modules/dicom2nifti/default.nix
+++ b/pkgs/development/python-modules/dicom2nifti/default.nix
@@ -1,9 +1,9 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, isPy27
+, pythonOlder
+, pytestCheckHook
 , gdcm
-, nose
 , nibabel
 , numpy
 , pydicom
@@ -13,21 +13,30 @@
 
 buildPythonPackage rec {
   pname = "dicom2nifti";
-  version = "2.3.0";
-  disabled = isPy27;
+  version = "2.4.3";
+  disabled = pythonOlder "3.6";
 
   # no tests in PyPI dist
   src = fetchFromGitHub {
     owner = "icometrix";
     repo = pname;
     rev = version;
-    sha256 = "sha256-QSu9CGXFjDpI25Cy6QSbrwiQ2bwsVezCUxSovRLs6AI=";
+    hash = "sha256-za2+HdnUhPu3+p29JsF4iL1lyPQVmEv3fam0Yf1oeMQ=";
   };
 
-  propagatedBuildInputs = [ nibabel numpy pydicom scipy setuptools ];
+  propagatedBuildInputs = [ gdcm nibabel numpy pydicom scipy setuptools ];
 
-  checkInputs = [ nose gdcm ];
-  checkPhase = "nosetests tests";
+  # python-gdcm just builds the python interface provided by the "gdcm" package, so
+  # we should be able to replace "python-gdcm" with "gdcm" but this doesn't work
+  # (similar to https://github.com/NixOS/nixpkgs/issues/84774)
+  postPatch = ''
+    substituteInPlace setup.py --replace "python-gdcm" ""
+    substituteInPlace tests/test_generic.py --replace "from common" "from dicom2nifti.common"
+  '';
+
+  checkInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "dicom2nifti" ];
 
   meta = with lib; {
     homepage = "https://github.com/icometrix/dicom2nifti";
diff --git a/pkgs/development/python-modules/edalize/default.nix b/pkgs/development/python-modules/edalize/default.nix
new file mode 100644
index 000000000000..4e220ba64667
--- /dev/null
+++ b/pkgs/development/python-modules/edalize/default.nix
@@ -0,0 +1,73 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, coreutils
+, jinja2
+, pandas
+, pytestCheckHook
+, which
+, verilog
+, yosys
+}:
+
+buildPythonPackage rec {
+  pname = "edalize";
+  version = "0.4.0";
+
+  src = fetchFromGitHub {
+    owner = "olofk";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-fpUNCxW7+uymodJ/yGME9VNcCEZdBROIdT1+blpgkzA=";
+  };
+
+  postPatch = ''
+    substituteInPlace tests/test_edam.py \
+      --replace /usr/bin/touch ${coreutils}/bin/touch
+    patchShebangs tests/mock_commands/vsim
+  '';
+
+  propagatedBuildInputs = [ jinja2 ];
+
+  checkInputs = [
+    pytestCheckHook
+    pandas
+    which
+    yosys
+    verilog
+  ];
+
+  pythonImportsCheck = [ "edalize" ];
+
+  disabledTestPaths = [
+    "tests/test_apicula.py"
+    "tests/test_ascentlint.py"
+    "tests/test_diamond.py"
+    "tests/test_gatemate.py"
+    "tests/test_ghdl.py"
+    "tests/test_icarus.py"
+    "tests/test_icestorm.py"
+    "tests/test_ise.py"
+    "tests/test_mistral.py"
+    "tests/test_openlane.py"
+    "tests/test_oxide.py"
+    "tests/test_quartus.py"
+    "tests/test_radiant.py"
+    "tests/test_spyglass.py"
+    "tests/test_symbiyosys.py"
+    "tests/test_trellis.py"
+    "tests/test_vcs.py"
+    "tests/test_veribleformat.py"
+    "tests/test_veriblelint.py"
+    "tests/test_vivado.py"
+    "tests/test_xcelium.py"
+    "tests/test_xsim.py"
+  ];
+
+  meta = with lib; {
+    description = "Abstraction library for interfacing EDA tools";
+    homepage = "https://github.com/olofk/edalize";
+    license = licenses.bsd2;
+    maintainers = [ maintainers.astro ];
+  };
+}
diff --git a/pkgs/development/python-modules/google-cloud-secret-manager/default.nix b/pkgs/development/python-modules/google-cloud-secret-manager/default.nix
index 9246c8393ffe..6bee80695f0d 100644
--- a/pkgs/development/python-modules/google-cloud-secret-manager/default.nix
+++ b/pkgs/development/python-modules/google-cloud-secret-manager/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-secret-manager";
-  version = "2.12.3";
+  version = "2.12.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-591Z/JIMwIwjhj4VKJKUztu2FMupdyUuKmxxUfK/TLE=";
+    hash = "sha256-nbM+uZr7a3RXvtLI7n5XZZD9r9ZVoh5iCSoZAnDIuQQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-securitycenter/default.nix b/pkgs/development/python-modules/google-cloud-securitycenter/default.nix
index 67c60295c51f..076be48781fc 100644
--- a/pkgs/development/python-modules/google-cloud-securitycenter/default.nix
+++ b/pkgs/development/python-modules/google-cloud-securitycenter/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-securitycenter";
-  version = "1.13.0";
+  version = "1.14.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Jrd1ySx6n2ilUbObPrvsLOzUIUIGHeFQZTop8xbrAdY=";
+    hash = "sha256-VNvIt3WYMMXOMovJvbSwKU2/Xz8/F+BW0XoKdi0QSo0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/jax/cache-fix.patch b/pkgs/development/python-modules/jax/cache-fix.patch
deleted file mode 100644
index 5db5319485f8..000000000000
--- a/pkgs/development/python-modules/jax/cache-fix.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/jax/experimental/compilation_cache/file_system_cache.py b/jax/experimental/compilation_cache/file_system_cache.py
-index b85969de..92acd523 100644
---- a/jax/experimental/compilation_cache/file_system_cache.py
-+++ b/jax/experimental/compilation_cache/file_system_cache.py
-@@ -33,6 +33,7 @@ class FileSystemCache(CacheInterface):
-     path_to_key = os.path.join(self._path, key)
-     if os.path.exists(path_to_key):
-       with open(path_to_key, "rb") as file:
-+        os.utime(file.fileno())
-         return file.read()
-     else:
-       return None
diff --git a/pkgs/development/python-modules/jax/default.nix b/pkgs/development/python-modules/jax/default.nix
index a302341c3141..9970783aa3bc 100644
--- a/pkgs/development/python-modules/jax/default.nix
+++ b/pkgs/development/python-modules/jax/default.nix
@@ -2,10 +2,11 @@
 , absl-py
 , blas
 , buildPythonPackage
+, etils
 , fetchFromGitHub
-, fetchpatch
 , jaxlib
 , lapack
+, matplotlib
 , numpy
 , opt-einsum
 , pytestCheckHook
@@ -20,7 +21,7 @@ let
 in
 buildPythonPackage rec {
   pname = "jax";
-  version = "0.3.6";
+  version = "0.3.16";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -29,34 +30,25 @@ buildPythonPackage rec {
     owner = "google";
     repo = pname;
     rev = "jax-v${version}";
-    hash = "sha256-eGdAEZFHadNTHgciP4KMYHdwksz9g6un0Ar+A/KV5TE=";
+    hash = "sha256-4idh7boqBXSO9vEHxEcrzXjBIrKmmXiCf6cXh7En1/I=";
   };
 
-  patches = [
-    # See https://github.com/google/jax/issues/7944
-    ./cache-fix.patch
-
-    # See https://github.com/google/jax/issues/10292
-    (fetchpatch {
-      url = "https://github.com/google/jax/commit/cadc8046d56e0c1433cf48a2f106947d5f4ecbfd.patch";
-      hash = "sha256-jrpIqt4LzWAswt/Cpwtfa5d1Yn31HcXkVH3ETmaigA0=";
-    })
-  ];
-
   # jaxlib is _not_ included in propagatedBuildInputs because there are
   # different versions of jaxlib depending on the desired target hardware. The
   # JAX project ships separate wheels for CPU, GPU, and TPU. Currently only the
   # CPU wheel is packaged.
   propagatedBuildInputs = [
     absl-py
+    etils
     numpy
     opt-einsum
     scipy
     typing-extensions
-  ];
+  ] ++ etils.optional-dependencies.epath;
 
   checkInputs = [
     jaxlib
+    matplotlib
     pytestCheckHook
     pytest-xdist
   ];
diff --git a/pkgs/development/python-modules/jaxlib/default.nix b/pkgs/development/python-modules/jaxlib/default.nix
index eee432f71853..456c9108593e 100644
--- a/pkgs/development/python-modules/jaxlib/default.nix
+++ b/pkgs/development/python-modules/jaxlib/default.nix
@@ -9,11 +9,14 @@
 , buildBazelPackage
 , buildPythonPackage
 , cctools
+, curl
 , cython
 , fetchFromGitHub
 , git
 , IOKit
 , jsoncpp
+, nsync
+, openssl
 , pybind11
 , setuptools
 , symlinkJoin
@@ -50,7 +53,7 @@ let
   inherit (cudaPackages) cudatoolkit cudnn nccl;
 
   pname = "jaxlib";
-  version = "0.3.0";
+  version = "0.3.15";
 
   meta = with lib; {
     description = "JAX is Autograd and XLA, brought together for high-performance machine learning research.";
@@ -93,7 +96,7 @@ let
       owner = "google";
       repo = "jax";
       rev = "${pname}-v${version}";
-      sha256 = "0ndpngx5k6lf6jqjck82bbp0gs943z0wh7vs9gwbyk2bw0da7w72";
+      sha256 = "sha256-pIl7zzl82w5HHnJadH2vtCT4mYFd5YmM9iHC2GoJD6s=";
     };
 
     nativeBuildInputs = [
@@ -103,15 +106,19 @@ let
       setuptools
       wheel
       which
+    ] ++ lib.optionals stdenv.isDarwin [
+      cctools
     ];
 
     buildInputs = [
+      curl
       double-conversion
       giflib
       grpc
       jsoncpp
       libjpeg_turbo
       numpy
+      openssl
       pkgs.flatbuffers
       pkgs.protobuf
       pybind11
@@ -124,6 +131,8 @@ let
       cudnn
     ] ++ lib.optionals stdenv.isDarwin [
       IOKit
+    ] ++ lib.optionals (!stdenv.isDarwin) [
+      nsync
     ];
 
     postPatch = ''
@@ -149,6 +158,7 @@ let
       build --action_env=PYENV_ROOT
       build --python_path="${python}/bin/python"
       build --distinct_host_configuration=false
+      build --define PROTOBUF_INCLUDE_PATH="${pkgs.protobuf}/include"
     '' + lib.optionalString cudaSupport ''
       build --action_env CUDA_TOOLKIT_PATH="${cudatoolkit_joined}"
       build --action_env CUDNN_INSTALL_PATH="${cudnn}"
@@ -163,7 +173,7 @@ let
     # Copy-paste from TF derivation.
     # Most of these are not really used in jaxlib compilation but it's simpler to keep it
     # 'as is' so that it's more compatible with TF derivation.
-    TF_SYSTEM_LIBS = lib.concatStringsSep "," [
+    TF_SYSTEM_LIBS = lib.concatStringsSep "," ([
       "absl_py"
       "astor_archive"
       "astunparse_archive"
@@ -179,7 +189,6 @@ let
       "cython"
       "dill_archive"
       "double_conversion"
-      "enum34_archive"
       "flatbuffers"
       "functools32_archive"
       "gast_archive"
@@ -190,11 +199,9 @@ let
       "libjpeg_turbo"
       "lmdb"
       "nasm"
-      # "nsync" # not packaged in nixpkgs
       "opt_einsum_archive"
       "org_sqlite"
       "pasta"
-      "pcre"
       "png"
       "pybind11"
       "six_archive"
@@ -204,7 +211,9 @@ let
       "typing_extensions_archive"
       "wrapt"
       "zlib"
-    ];
+    ] ++ lib.optionals (!stdenv.isDarwin) [
+      "nsync" # fails to build on darwin
+    ]);
 
     # Make sure Bazel knows about our configuration flags during fetching so that the
     # relevant dependencies can be downloaded.
@@ -226,9 +235,11 @@ let
     fetchAttrs = {
       sha256 =
         if cudaSupport then
-          "sha256-Ald+vplRx/DDG/7TfHAqD4Gktb1BGnf7FSCCJzSI0eo="
+          "sha256-tdO4YjO985zbittb16RFWgxgUBrHYQfv5gRsA4IAkTk="
+        else if stdenv.isDarwin then
+          "sha256-+XYxfXBCASueqDGg0Zqcmpf7zmemYM6xCE+x0rl3j34="
         else
-          "sha256-eK5IjTAncDarkWYKnXrEo7kw7J7iOH7in2L2GabnFYo=";
+          "sha256-La1wC8X5aGK5mXvYy/kO8n4J+zaRZEc/DAX5zaH1D5A=";
     };
 
     buildAttrs = {
@@ -239,15 +250,10 @@ let
       # 2) Link protobuf from nixpkgs (through TF_SYSTEM_LIBS when using gcc) to prevent crashes on
       #    loading multiple extensions in the same python program due to duplicate protobuf DBs.
       # 3) Patch python path in the compiler driver.
-      # 4) Patch tensorflow sources to work with later versions of protobuf. See
-      #    https://github.com/google/jax/issues/9534. Note that this should be
-      #    removed on the next release after 0.3.0.
       preBuild = ''
-        for src in ./jaxlib/*.{cc,h}; do
+        for src in ./jaxlib/*.{cc,h} ./jaxlib/cuda/*.{cc,h}; do
           sed -i 's@include/pybind11@pybind11@g' $src
         done
-        substituteInPlace ../output/external/org_tensorflow/tensorflow/compiler/xla/python/pprof_profile_builder.cc \
-          --replace "status.message()" "std::string{status.message()}"
       '' + lib.optionalString cudaSupport ''
         patchShebangs ../output/external/org_tensorflow/third_party/gpus/crosstool/clang/bin/crosstool_wrapper_driver_is_not_gcc.tpl
       '' + lib.optionalString stdenv.isDarwin ''
@@ -275,7 +281,7 @@ let
   };
   platformTag =
     if stdenv.targetPlatform.isLinux then
-      "manylinux2010_${stdenv.targetPlatform.linuxArch}"
+      "manylinux2014_${stdenv.targetPlatform.linuxArch}"
     else if stdenv.system == "x86_64-darwin" then
       "macosx_10_9_${stdenv.targetPlatform.linuxArch}"
     else if stdenv.system == "aarch64-darwin" then
@@ -306,6 +312,7 @@ buildPythonPackage {
 
   propagatedBuildInputs = [
     absl-py
+    curl
     double-conversion
     flatbuffers
     giflib
diff --git a/pkgs/development/python-modules/jc/default.nix b/pkgs/development/python-modules/jc/default.nix
index 9e368792b275..7cce5dca7aa5 100644
--- a/pkgs/development/python-modules/jc/default.nix
+++ b/pkgs/development/python-modules/jc/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "jc";
-  version = "1.21.1";
+  version = "1.21.2";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "kellyjonbrazil";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-JkxLDuSaEfPb/Z+Bz2uZ3i0LcQgvYlKUNxXATGdCkzE=";
+    sha256 = "sha256-gzxN2ZbnZw7EE5oVeSpugzl/paAbyKKQlxVs/8n3Hzw=";
   };
 
   propagatedBuildInputs = [ ruamel-yaml xmltodict pygments ];
diff --git a/pkgs/development/python-modules/peaqevcore/default.nix b/pkgs/development/python-modules/peaqevcore/default.nix
index 1987375f0983..65d5417ee15b 100644
--- a/pkgs/development/python-modules/peaqevcore/default.nix
+++ b/pkgs/development/python-modules/peaqevcore/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "peaqevcore";
-  version = "5.14.0";
+  version = "5.16.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-YDdQ/q/QyR9vgY0jteAfQg6A4oCPKjFLySt/g74+eyw=";
+    hash = "sha256-hL07M5lelXmxhSVkY0dmnQWpI6B/9pW7jf00x/nDaJU=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/psycopg/default.nix b/pkgs/development/python-modules/psycopg/default.nix
index f2398238b28e..a5fe3150d5d9 100644
--- a/pkgs/development/python-modules/psycopg/default.nix
+++ b/pkgs/development/python-modules/psycopg/default.nix
@@ -32,13 +32,13 @@
 
 let
   pname = "psycopg";
-  version = "3.0.16";
+  version = "3.1";
 
   src = fetchFromGitHub {
     owner = "psycopg";
     repo = pname;
-    rev = version;
-    hash = "sha256-jKhpmCcDi7FyMSpn51eSukFvmu3yacNovmRYG9jnu3g=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-N0Qc8pSWN2NFZn06lYZ7DKMbk6H8aIByS+wDnOQ/O+Y=";
   };
 
   patches = [
@@ -192,6 +192,7 @@ buildPythonPackage rec {
     "tests/test_dns_srv.py"
     # Mypy typing test
     "tests/test_typing.py"
+    "tests/crdb/test_typing.py"
   ];
 
   pytestFlagsArray = [
diff --git a/pkgs/development/python-modules/sanic/22.3.2-CVE-2022-35920.patch b/pkgs/development/python-modules/sanic/22.3.2-CVE-2022-35920.patch
new file mode 100644
index 000000000000..694c69602c12
--- /dev/null
+++ b/pkgs/development/python-modules/sanic/22.3.2-CVE-2022-35920.patch
@@ -0,0 +1,141 @@
+Based on upstream 9d415e4ec63d31b3749fd540e2c2ac7c98dedcdd and
+2fa28f1711a8e59c6f4d3468e9c2f8b6991188a2, adjusted to apply to
+v22.3.2, raise the same exception as before and not remove any
+imports.
+
+diff --git a/sanic/mixins/routes.py b/sanic/mixins/routes.py
+index 9e2cf96..e0cf86b 100644
+--- a/sanic/mixins/routes.py
++++ b/sanic/mixins/routes.py
+@@ -3,7 +3,7 @@ from contextlib import suppress
+ from functools import partial, wraps
+ from inspect import getsource, signature
+ from mimetypes import guess_type
+-from os import path
++from os import path, sep
+ from pathlib import PurePath
+ from re import sub
+ from textwrap import dedent
+@@ -775,23 +775,23 @@ class RouteMixin(metaclass=SanicMeta):
+         content_type=None,
+         __file_uri__=None,
+     ):
+-        # Using this to determine if the URL is trying to break out of the path
+-        # served.  os.path.realpath seems to be very slow
+-        if __file_uri__ and "../" in __file_uri__:
+-            raise InvalidUsage("Invalid URL")
+         # Merge served directory and requested file if provided
+-        # Strip all / that in the beginning of the URL to help prevent python
+-        # from herping a derp and treating the uri as an absolute path
+-        root_path = file_path = file_or_directory
++        root_path = file_path = path.abspath(unquote(file_or_directory))
++
+         if __file_uri__:
+-            file_path = path.join(
+-                file_or_directory, sub("^[/]*", "", __file_uri__)
+-            )
++            # Strip all / that in the beginning of the URL to help prevent
++            # python from herping a derp and treating the uri as an
++            # absolute path
++            unquoted_file_uri = unquote(__file_uri__).lstrip("/")
++
++            segments = unquoted_file_uri.split("/")
++            if ".." in segments or any(sep in segment for segment in segments):
++                raise InvalidUsage("Invalid URL")
++
++            file_path = path.join(file_or_directory, unquoted_file_uri)
++            file_path = path.abspath(file_path)
+ 
+-        # URL decode the path sent by the browser otherwise we won't be able to
+-        # match filenames which got encoded (filenames with spaces etc)
+-        file_path = path.abspath(unquote(file_path))
+-        if not file_path.startswith(path.abspath(unquote(root_path))):
++        if not file_path.startswith(root_path):
+             error_logger.exception(
+                 f"File not found: path={file_or_directory}, "
+                 f"relative_url={__file_uri__}"
+diff --git a/tests/test_static.py b/tests/test_static.py
+index 36a98e1..aeb625b 100644
+--- a/tests/test_static.py
++++ b/tests/test_static.py
+@@ -1,6 +1,7 @@
+ import inspect
+ import logging
+ import os
++import sys
+ 
+ from collections import Counter
+ from pathlib import Path
+@@ -8,7 +9,7 @@ from time import gmtime, strftime
+ 
+ import pytest
+ 
+-from sanic import text
++from sanic import Sanic, text
+ from sanic.exceptions import FileNotFound
+ 
+ 
+@@ -21,6 +22,22 @@ def static_file_directory():
+     return static_directory
+ 
+ 
++@pytest.fixture(scope="module")
++def double_dotted_directory_file(static_file_directory: str):
++    """Generate double dotted directory and its files"""
++    if sys.platform == "win32":
++        raise Exception("Windows doesn't support double dotted directories")
++
++    file_path = Path(static_file_directory) / "dotted.." / "dot.txt"
++    double_dotted_dir = file_path.parent
++    Path.mkdir(double_dotted_dir, exist_ok=True)
++    with open(file_path, "w") as f:
++        f.write("DOT\n")
++    yield file_path
++    Path.unlink(file_path)
++    Path.rmdir(double_dotted_dir)
++
++
+ def get_file_path(static_file_directory, file_name):
+     return os.path.join(static_file_directory, file_name)
+ 
+@@ -578,3 +595,40 @@ def test_resource_type_dir(app, static_file_directory):
+ def test_resource_type_unknown(app, static_file_directory, caplog):
+     with pytest.raises(ValueError):
+         app.static("/static", static_file_directory, resource_type="unknown")
++
++
++@pytest.mark.skipif(
++    sys.platform == "win32",
++    reason="Windows does not support double dotted directories",
++)
++def test_dotted_dir_ok(
++    app: Sanic, static_file_directory: str, double_dotted_directory_file: Path
++):
++    app.static("/foo", static_file_directory)
++    dot_relative_path = str(
++        double_dotted_directory_file.relative_to(static_file_directory)
++    )
++    _, response = app.test_client.get("/foo/" + dot_relative_path)
++    assert response.status == 200
++    assert response.body == b"DOT\n"
++
++
++def test_breakout(app: Sanic, static_file_directory: str):
++    app.static("/foo", static_file_directory)
++
++    _, response = app.test_client.get("/foo/..%2Fstatic/test.file")
++    assert response.status == 400
++
++
++@pytest.mark.skipif(
++    sys.platform != "win32", reason="Block backslash on Windows only"
++)
++def test_double_backslash_prohibited_on_win32(
++    app: Sanic, static_file_directory: str
++):
++    app.static("/foo", static_file_directory)
++
++    _, response = app.test_client.get("/foo/static/..\\static/test.file")
++    assert response.status == 400
++    _, response = app.test_client.get("/foo/static\\../static/test.file")
++    assert response.status == 400
diff --git a/pkgs/development/python-modules/sanic/default.nix b/pkgs/development/python-modules/sanic/default.nix
index 45dec8763357..3959c3b7bd7b 100644
--- a/pkgs/development/python-modules/sanic/default.nix
+++ b/pkgs/development/python-modules/sanic/default.nix
@@ -36,6 +36,10 @@ buildPythonPackage rec {
     hash = "sha256-4zdPp3X22dfZ5YlW3G5/OqeUxrt+NiFO9dk2XjEKXEg=";
   };
 
+  patches = [
+    ./22.3.2-CVE-2022-35920.patch
+  ];
+
   postPatch = ''
     # Loosen dependency requirements.
     substituteInPlace setup.py \
diff --git a/pkgs/development/python-modules/xsdata/default.nix b/pkgs/development/python-modules/xsdata/default.nix
index fbc621a59692..3ae950bf86ae 100644
--- a/pkgs/development/python-modules/xsdata/default.nix
+++ b/pkgs/development/python-modules/xsdata/default.nix
@@ -14,15 +14,15 @@
 
 buildPythonPackage rec {
   pname = "xsdata";
-  version = "22.7";
+  version = "22.8";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-2EpbTNYdjcHOQQqe+bEpMzGxD2Jh34P+eI+uK4SJPdo=";
+    hash = "sha256-MWHMRPY35Fs4n9O0z3QRW4IylfSltH3XUNdrCBK2iW4=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/tools/changie/default.nix b/pkgs/development/tools/changie/default.nix
index de0fd5c16fbd..b85841f087d9 100644
--- a/pkgs/development/tools/changie/default.nix
+++ b/pkgs/development/tools/changie/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "changie";
-  version = "1.8.0";
+  version = "1.9.0";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "miniscruff";
     repo = pname;
-    sha256 = "sha256-VzrSfigpkOvgywq0dHIXZS2If8qc8HCo51FzopKORwM=";
+    sha256 = "sha256-3i+GInsxGeHXdFYfI664sOshHFsEIVXgXolzPhc9eoM=";
   };
 
-  vendorSha256 = "sha256-+Q0vNMd8wFz+9bOPfqdPpN2brnUmIf46/9rUYsCTUrQ=";
+  vendorSha256 = "sha256-/tYhoHk4+gbdfeBNqcBSM0y4V3tVH67Xta3+e+Sctsg=";
 
   meta = with lib; {
     homepage = "https://changie.dev";
diff --git a/pkgs/development/tools/database/timescaledb-tune/default.nix b/pkgs/development/tools/database/timescaledb-tune/default.nix
index 195a5b8b18e2..9be1055e4762 100644
--- a/pkgs/development/tools/database/timescaledb-tune/default.nix
+++ b/pkgs/development/tools/database/timescaledb-tune/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "timescaledb-tune";
-  version = "0.13.1";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "timescale";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-sCwMLVp4MCTJ5ZgALDs+of+upYMQeHz3xRk4YD2g23M=";
+    sha256 = "sha256-veqsVqG2UCKRRXAcJVF0bPv2FwgC/0KQ49pU+ASuIhA=";
   };
 
   vendorSha256 = "sha256-n2jrg9FiR/gSrbds/QVV8Duf7BTEs36yYi4F3Ve+d0E=";
diff --git a/pkgs/development/tools/esbuild/default.nix b/pkgs/development/tools/esbuild/default.nix
index 61e780850738..bf3dfd6ce8de 100644
--- a/pkgs/development/tools/esbuild/default.nix
+++ b/pkgs/development/tools/esbuild/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "esbuild";
-  version = "0.15.5";
+  version = "0.15.6";
 
   src = fetchFromGitHub {
     owner = "evanw";
     repo = "esbuild";
     rev = "v${version}";
-    sha256 = "sha256-vLdj5naUDKVCENqGfQRoxbnHd+nuZu6Ac6HTSPnqoVA=";
+    sha256 = "sha256-xEM5xGgwT2bys4OFDyrZsREkKl92lSl3m+QDQS4rfBQ=";
   };
 
   vendorSha256 = "sha256-+BfxCyg0KkDQpHt/wycy/8CTG6YBA/VJvJFhhzUnSiQ=";
diff --git a/pkgs/development/tools/go-swagger/default.nix b/pkgs/development/tools/go-swagger/default.nix
index f438584a2921..feae045b68e1 100644
--- a/pkgs/development/tools/go-swagger/default.nix
+++ b/pkgs/development/tools/go-swagger/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "go-swagger";
-  version = "0.29.0";
+  version = "0.30.0";
 
   src = fetchFromGitHub {
     owner = "go-swagger";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-sahInHXv1GtylsY8kpw1dDjKiENmq4myx+7mq60vJAI=";
+    sha256 = "sha256-Hc3b1r8Wr8cXAWoqINneBRU1Mdv4RkAeOOCK7O9Vp9g=";
   };
 
-  vendorSha256 = "sha256-KLV6ABo1K+KtAzAQ4FcFiK1LAZEsKup+BtgjRJfonAY=";
+  vendorSha256 = "sha256-g/0OjAqT+0P0VtB0i0o2QfMqU8YDnoRtwA5isNJlSBE=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/ocaml/ocamlformat/default.nix b/pkgs/development/tools/ocaml/ocamlformat/default.nix
index a92fafeac4ac..f90eaca5273c 100644
--- a/pkgs/development/tools/ocaml/ocamlformat/default.nix
+++ b/pkgs/development/tools/ocaml/ocamlformat/default.nix
@@ -11,7 +11,7 @@ rec {
   ocamlformat_0_21_0 = ocamlformat.override { version = "0.21.0"; };
   ocamlformat_0_22_4 = ocamlformat.override { version = "0.22.4"; };
   ocamlformat_0_23_0 = ocamlformat.override { version = "0.23.0"; };
-  ocamlformat_0_24_0 = ocamlformat.override { version = "0.24.0"; };
+  ocamlformat_0_24_1 = ocamlformat.override { version = "0.24.1"; };
 
   ocamlformat = callPackage ./generic.nix {};
 }
diff --git a/pkgs/development/tools/ocaml/ocamlformat/generic.nix b/pkgs/development/tools/ocaml/ocamlformat/generic.nix
index a27672fcd7f3..325ab8227b72 100644
--- a/pkgs/development/tools/ocaml/ocamlformat/generic.nix
+++ b/pkgs/development/tools/ocaml/ocamlformat/generic.nix
@@ -1,5 +1,5 @@
 { lib, fetchurl, fetchzip, ocaml-ng
-, version ? "0.24.0"
+, version ? "0.24.1"
 , tarballName ? "ocamlformat-${version}.tbz",
 }:
 
@@ -14,6 +14,7 @@ let src =
       "0.22.4" = "sha256-61TeK4GsfMLmjYGn3ICzkagbc3/Po++Wnqkb2tbJwGA=";
       "0.23.0" = "sha256-m9Pjz7DaGy917M1GjyfqG5Lm5ne7YSlJF2SVcDHe3+0=";
       "0.24.0" = "sha256-Zil0wceeXmq2xy0OVLxa/Ujl4Dtsmc4COyv6Jo7rVaM=";
+      "0.24.1" = "sha256-AjQl6YGPgOpQU3sjcaSnZsFJqZV9BYB+iKAE0tX0Qc4=";
     }."${version}";
   };
   ocamlPackages = ocaml-ng.ocamlPackages;
diff --git a/pkgs/development/tools/rust/cargo-make/default.nix b/pkgs/development/tools/rust/cargo-make/default.nix
index d42b41094973..e4c93d7a041d 100644
--- a/pkgs/development/tools/rust/cargo-make/default.nix
+++ b/pkgs/development/tools/rust/cargo-make/default.nix
@@ -13,11 +13,11 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-make";
-  version = "0.35.16";
+  version = "0.36.0";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-QRsJoQ2lUOnSkQYwCgUI1su0avQLqEYn56Y0H1hOaVw=";
+    sha256 = "sha256-Kh6llGiSzzrd4V2wBRe7FW1cq1JaMv+A0VUy8FLi5J0=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [ openssl ]
     ++ lib.optionals stdenv.isDarwin [ Security SystemConfiguration libiconv ];
 
-  cargoSha256 = "sha256-ppg+UksukKQLRncZYlvI7Qi9bdQn07dFPrNn8nQRCsI=";
+  cargoSha256 = "sha256-FKmr590pwscWxQZYakkc6zFVLO2nGK9OMDhLiZxnELs=";
 
   # Some tests fail because they need network access.
   # However, Travis ensures a proper build.
diff --git a/pkgs/development/tools/rust/cargo-tally/default.nix b/pkgs/development/tools/rust/cargo-tally/default.nix
index dccb76b1d959..d6868a74ccc3 100644
--- a/pkgs/development/tools/rust/cargo-tally/default.nix
+++ b/pkgs/development/tools/rust/cargo-tally/default.nix
@@ -2,14 +2,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-tally";
-  version = "1.0.9";
+  version = "1.0.12";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-KwR//7UpVoxreQVBY4/GawdU9Bk0d2Qj9EW3odvofc0=";
+    sha256 = "sha256-v9nAiV3t/l6B+a7hzq4IYOetrNM5f22+nEIQncLs5tU=";
   };
 
-  cargoSha256 = "sha256-myqSki5pBT01bsJcEy92HkZHbLaWT+5Tl5u4LEUmlK4=";
+  cargoSha256 = "sha256-/PypVUT6n2pdsWIN+5EGHmj/UlfguvlbufBlHvuROg8=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     DiskArbitration
diff --git a/pkgs/development/tools/zld/default.nix b/pkgs/development/tools/zld/default.nix
index 408e3308b658..69385c688ea7 100644
--- a/pkgs/development/tools/zld/default.nix
+++ b/pkgs/development/tools/zld/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "zld";
-  version = "1.3.3";
+  version = "1.3.4";
   src = fetchzip {
     url = "https://github.com/michaeleisel/zld/releases/download/${version}/zld.zip";
-    sha256 = "0qb4l7a4vhpnzkgzhw0jivz40jr5gdhqfyynhbkhn7ryh5s52d1p";
+    sha256 = "1rzdcrky0dl9n7niv39a5gc7q7rwl8jv6h77nvm6gwdymkjf2973";
   };
 
   installPhase = ''
diff --git a/pkgs/os-specific/linux/intel-compute-runtime/default.nix b/pkgs/os-specific/linux/intel-compute-runtime/default.nix
index 5c38e05fbfe4..3908d0056b9c 100644
--- a/pkgs/os-specific/linux/intel-compute-runtime/default.nix
+++ b/pkgs/os-specific/linux/intel-compute-runtime/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-compute-runtime";
-  version = "22.32.23937";
+  version = "22.34.24023";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "compute-runtime";
     rev = version;
-    sha256 = "sha256-W+0EbrbF+jPtsf9QCMmSEX7HFDlfiRtD/kjeMJVqCoY=";
+    sha256 = "sha256-stiFH1eNi+SlgL/Y2p5p+zLN8XeES/77yaG5fFpJges=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/os-specific/linux/libcgroup/default.nix b/pkgs/os-specific/linux/libcgroup/default.nix
index f95e6b9ee55d..13c248a03982 100644
--- a/pkgs/os-specific/linux/libcgroup/default.nix
+++ b/pkgs/os-specific/linux/libcgroup/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "libcgroup";
-  version = "2.0.2";
+  version = "3.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-o9eXbsgtGhODEbpbEn30RbYfYpXo6xkU5ptU1och5tU=";
+    hash = "sha256-x2yBqpr3LedtWmpZ4K1ipZxIualNJuDtC4FVGzzcQn8=";
   };
 
   buildInputs = [ pam bison flex ];
diff --git a/pkgs/servers/pocketbase/default.nix b/pkgs/servers/pocketbase/default.nix
index b02ba47cb326..d5b7ae34f191 100644
--- a/pkgs/servers/pocketbase/default.nix
+++ b/pkgs/servers/pocketbase/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "pocketbase";
-  version = "0.4.2";
+  version = "0.5.1";
 
   src = fetchFromGitHub {
     owner = "pocketbase";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-uDseJmuK6SI3e2ICqr8SJ0iKOVCXONueZUJ6J8MKwYE=";
+    sha256 = "sha256-Wcj2pAKuRT3gWzczoNd0mJktM2dUL3z+2JUsM5SYRVM=";
   };
 
-  vendorSha256 = "sha256-8IiY/gjK8m2ntOXyG84HMiyT4GK3CgDTRG1DB+v0jAs=";
+  vendorSha256 = "sha256-OGbfcKvPTSM9DGJ+u2fXBmHq0Sv/n8oMbHNoPZy854Q=";
 
   # This is the released subpackage from upstream repo
   subPackages = [ "examples/base" ];
diff --git a/pkgs/tools/admin/syft/default.nix b/pkgs/tools/admin/syft/default.nix
index 34c79fed60a1..a9faf35ec529 100644
--- a/pkgs/tools/admin/syft/default.nix
+++ b/pkgs/tools/admin/syft/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "syft";
-  version = "0.54.0";
+  version = "0.55.0";
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-TSWP9VT5D9J9a7WkAdxXxlbVthbkQxZAAPzuc3Q8joc=";
+    sha256 = "sha256-tzrWgmEMe7y6PQgtYiN12LGR24FuaEvzOBAfgbIOepo=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -20,7 +20,7 @@ buildGoModule rec {
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
-  vendorSha256 = "sha256-4exKUrhESpfrFr9jGqSMPQZP644HU7gjh1kOVXUhO7Q=";
+  vendorSha256 = "sha256-HaTUjNKAZNiVcM4tZJb0r9ezsvWTlOicPct/ZtpTz5Y=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/graphics/gifski/default.nix b/pkgs/tools/graphics/gifski/default.nix
index 3845588203c5..3c7ae47991bc 100644
--- a/pkgs/tools/graphics/gifski/default.nix
+++ b/pkgs/tools/graphics/gifski/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gifski";
-  version = "1.7.1";
+  version = "1.7.2";
 
   src = fetchFromGitHub {
     owner = "ImageOptim";
     repo = "gifski";
     rev = version;
-    sha256 = "sha256-Y2gNVm8Ziq3ipfgqRLbw1Hrd0ry556b78riWCo9sg3s=";
+    sha256 = "sha256-Hlowm+wtj3bJBGJd/JndOaGC6iSdab3sURUjzshqh+k=";
   };
 
-  cargoSha256 = "sha256-KH+RoPilgigBzvQaY542Q9cImNVeYlL7QGnslBWHtwE=";
+  cargoSha256 = "sha256-Ir3u57nCBgzEuwaOzx8z71cxXmrIJLkURhuwFRoB2Xw=";
 
   nativeBuildInputs = lib.optionals stdenv.isLinux [ pkg-config ];
 
diff --git a/pkgs/tools/misc/plantuml-server/default.nix b/pkgs/tools/misc/plantuml-server/default.nix
index 5727d5466ce8..cf04887f743c 100644
--- a/pkgs/tools/misc/plantuml-server/default.nix
+++ b/pkgs/tools/misc/plantuml-server/default.nix
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchurl }:
 
 let
-  version = "1.2022.6";
+  version = "1.2022.7";
 in
 stdenv.mkDerivation rec {
   pname = "plantuml-server";
   inherit version;
   src = fetchurl {
     url = "https://github.com/plantuml/plantuml-server/releases/download/v${version}/plantuml-v${version}.war";
-    sha256 = "sha256-/dl3ZqvHcr92jhg2QDqOPCOuvpjV/9Qrw8pbsOXKZkU=";
+    sha256 = "sha256-QX4eZStNXBHy44hKV1GnTDpumq65OsGYR0VmXyF7DVg=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/tools/networking/i2pd/default.nix b/pkgs/tools/networking/i2pd/default.nix
index ab245540c9b6..f99d10deed84 100644
--- a/pkgs/tools/networking/i2pd/default.nix
+++ b/pkgs/tools/networking/i2pd/default.nix
@@ -10,13 +10,13 @@ assert upnpSupport -> miniupnpc != null;
 
 stdenv.mkDerivation rec {
   pname = "i2pd";
-  version = "2.42.1";
+  version = "2.43.0";
 
   src = fetchFromGitHub {
     owner = "PurpleI2P";
     repo = pname;
     rev = version;
-    sha256 = "sha256-q44r+PVGxeoElVfthUh++X8EhxbzqJwjC/r5TD+89WA=";
+    sha256 = "sha256-JIO1Zm7me/SX0W7sVHOesERnqvC7jy0Fu1vfKFePFd0=";
   };
 
   buildInputs = with lib; [ boost zlib openssl ]
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 25a7c719c270..5c169c686c1b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4800,7 +4800,17 @@ with pkgs;
 
   bdsync = callPackage ../tools/backup/bdsync { };
 
-  beamerpresenter = qt6Packages.callPackage ../applications/office/beamerpresenter { };
+  beamerpresenter = beamerpresenter-mupdf;
+
+  beamerpresenter-mupdf = qt6Packages.callPackage ../applications/office/beamerpresenter {
+    useMupdf = true;
+    usePoppler = false;
+  };
+
+  beamerpresenter-poppler = qt6Packages.callPackage ../applications/office/beamerpresenter {
+    useMupdf = false;
+    usePoppler = true;
+  };
 
   beanstalkd = callPackage ../servers/beanstalkd { };
 
@@ -10863,6 +10873,8 @@ with pkgs;
     lua = lua5_3;
   };
 
+  silice = callPackage ../development/compilers/silice { };
+
   silver-searcher = callPackage ../tools/text/silver-searcher { };
 
   simpleproxy = callPackage ../tools/networking/simpleproxy { };
@@ -14258,7 +14270,7 @@ with pkgs;
   inherit (callPackage ../development/tools/ocaml/ocamlformat { })
     ocamlformat # latest version
     ocamlformat_0_19_0 ocamlformat_0_20_0 ocamlformat_0_20_1 ocamlformat_0_21_0
-    ocamlformat_0_22_4 ocamlformat_0_23_0 ocamlformat_0_24_0;
+    ocamlformat_0_22_4 ocamlformat_0_23_0 ocamlformat_0_24_1;
 
   orc = callPackage ../development/compilers/orc { };
 
@@ -25353,6 +25365,8 @@ with pkgs;
   flat-remix-gtk = callPackage ../data/themes/flat-remix-gtk { };
   flat-remix-gnome = callPackage ../data/themes/flat-remix-gnome { };
 
+  fluent-icon-theme = callPackage ../data/icons/fluent-icon-theme { };
+
   font-awesome_4 = (callPackage ../data/fonts/font-awesome { }).v4;
   font-awesome_5 = (callPackage ../data/fonts/font-awesome { }).v5;
   font-awesome_6 = (callPackage ../data/fonts/font-awesome { }).v6;
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index a94c0dce230a..45c3ee62c530 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -90,13 +90,13 @@ let
   makeFullPerlPath = deps: makePerlPath (lib.misc.closePropagation deps);
 
 
-  ack = buildPerlPackage {
+  ack = buildPerlPackage rec {
     pname = "ack";
-    version = "3.5.0";
+    version = "3.6.0";
 
     src = fetchurl {
-      url = "mirror://cpan/authors/id/P/PE/PETDANCE/ack-v3.5.0.tar.gz";
-      hash = "sha256-ZgU+iE6AM4egLd7g1oq/KhAjn6tlQ2TaszKHMJpyVSE=";
+      url = "mirror://cpan/authors/id/P/PE/PETDANCE/ack-v${version}.tar.gz";
+      hash = "sha256-AxRNEHBknpL2obfSC9xTXiuxrCWNqr5ILpqoJ3tI8AU=";
     };
 
     outputs = ["out" "man"];
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 07ae0f0b7ae9..0d8d2ec44e55 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2852,6 +2852,8 @@ in {
 
   ed25519 = callPackage ../development/python-modules/ed25519 { };
 
+  edalize = callPackage ../development/python-modules/edalize { };
+
   editables = callPackage ../development/python-modules/editables { };
 
   editdistance = callPackage ../development/python-modules/editdistance { };
diff --git a/pkgs/top-level/qt6-packages.nix b/pkgs/top-level/qt6-packages.nix
index 4d66d838dd2b..e6f3b4ae5fd5 100644
--- a/pkgs/top-level/qt6-packages.nix
+++ b/pkgs/top-level/qt6-packages.nix
@@ -20,4 +20,10 @@ in
   # LIBRARIES
 
   quazip = callPackage ../development/libraries/quazip { };
+
+  poppler = callPackage ../development/libraries/poppler {
+    lcms = pkgs.lcms2;
+    qt6Support = true;
+    suffix = "qt6";
+  };
 })))