diff --git a/pkgs/applications/graphics/megapixels/default.nix b/pkgs/applications/graphics/megapixels/default.nix
index 7a5729de5f5e..13f6c3f5ab30 100644
--- a/pkgs/applications/graphics/megapixels/default.nix
+++ b/pkgs/applications/graphics/megapixels/default.nix
@@ -27,13 +27,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "megapixels";
-  version = "1.4.3";
+  version = "1.5.0";
 
   src = fetchFromGitLab {
     owner = "postmarketOS";
     repo = "megapixels";
     rev = version;
-    hash = "sha256-UHJ3Fayf+lS3nRuuhHHLN6mbHfHIPssWkghPMPF5ECg=";
+    hash = "sha256-zOtHxnXDzsLfaQPS0BhbuoUXglCbRULVJfk1txoS72Y=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/cluster/ktunnel/default.nix b/pkgs/applications/networking/cluster/ktunnel/default.nix
new file mode 100644
index 000000000000..368532dbef4e
--- /dev/null
+++ b/pkgs/applications/networking/cluster/ktunnel/default.nix
@@ -0,0 +1,39 @@
+{ stdenv, lib, buildGoModule, fetchFromGitHub }:
+let
+  version = "1.4.8";
+in
+buildGoModule {
+  pname = "ktunnel";
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner  = "omrikiei";
+    repo   = "ktunnel";
+    rev    = "v${version}";
+    sha256 = "sha256-Iw7Z4iuKxmRrS51KP3k/ouXW4xssdNgxDDzNQR2Zygg=";
+  };
+
+  ldflags = [
+    "-s" "-w"
+  ];
+
+  vendorSha256 = "sha256-p9AYZWNO2oqLich0qzZYuAk55HqB6ttS66ORuNZ4rJg=";
+
+  preCheck = "export HOME=$(mktemp -d)";
+
+  # # TODO investigate why some tests are failing
+  doCheck = false;
+
+  installCheckPhase = ''
+    runHook preInstallCheck
+    "$out/bin/ktunnel" --version
+    runHook postInstallCheck
+  '';
+
+  meta = with lib; {
+    description = "A cli that exposes your local resources to kubernetes ";
+    homepage = "https://github.com/omrikiei/ktunnel";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ happysalada ];
+  };
+}
diff --git a/pkgs/applications/networking/feedreaders/newsboat/default.nix b/pkgs/applications/networking/feedreaders/newsboat/default.nix
index ed5cad35474f..a03b03b035f9 100644
--- a/pkgs/applications/networking/feedreaders/newsboat/default.nix
+++ b/pkgs/applications/networking/feedreaders/newsboat/default.nix
@@ -3,16 +3,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "newsboat";
-  version = "2.27";
+  version = "2.28";
 
   src = fetchFromGitHub {
     owner = "newsboat";
     repo = "newsboat";
     rev = "r${version}";
-    hash = "sha256-cHUI95Zrwzg242BM8/roA40sAxijFw6go6BbQNZSzRw=";
+    hash = "sha256-MHbGCGtFPXG+82Qveoiv7f8qqZOxThEYb9y9Kv3pnFc=";
   };
 
-  cargoHash = "sha256-YZpaPfExKNLHWHmnCery4fGAJmOhpK3umuO343qe0Zo=";
+  cargoHash = "sha256-9YcVKZn51fhkE6bZmaNu7PXsSG8j0M4piBnTWtX8Kcg=";
 
   # TODO: Check if that's still needed
   postPatch = lib.optionalString stdenv.isDarwin ''
diff --git a/pkgs/applications/networking/irc/communi/default.nix b/pkgs/applications/networking/irc/communi/default.nix
index c8c36049a2a4..b9321f0797fa 100644
--- a/pkgs/applications/networking/irc/communi/default.nix
+++ b/pkgs/applications/networking/irc/communi/default.nix
@@ -2,13 +2,16 @@
 
 stdenv.mkDerivation rec {
   pname = "communi";
-  version = "3.5.0";
+  version = "3.6.0";
 
   src = fetchFromGitHub {
     owner = "communi";
     repo = "communi-desktop";
-    rev = "v${version}";
-    sha256 = "sha256-Ua5uXs2mEDrljvtIcdn1Kb+l5NJtRpB0AAbBz+DU+YE=";
+    # Without https://github.com/communi/communi-desktop/pull/146 fetching fails with
+    #     fatal: unable to connect to github.com:
+    #     github.com[0: 140.82.112.3]: errno=Connection timed out
+    rev = "5d813dc6e64a623cd5d78f024c8a0720a5155a28";
+    hash = "sha256-ci91Bf0EkhlPDO+NcpnMmT/vE41i5RD2mXbRAnMB++M=";
     fetchSubmodules = true;
   };
 
@@ -53,6 +56,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/communi/communi-desktop";
     license = licenses.bsd3;
     maintainers = with maintainers; [ hrdinka ];
-    platforms = platforms.all;
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/applications/networking/warp/default.nix b/pkgs/applications/networking/warp/default.nix
index 7fe54b785206..4efec422ce31 100644
--- a/pkgs/applications/networking/warp/default.nix
+++ b/pkgs/applications/networking/warp/default.nix
@@ -17,14 +17,14 @@
 
 stdenv.mkDerivation rec {
   pname = "warp";
-  version = "0.2.0";
+  version = "0.2.1";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = "warp";
     rev = "v${version}";
-    hash = "sha256-AtSU/vN20ePyxhSSl0RB2a4KKpd6PTUCC4n5RIuYVr4=";
+    hash = "sha256-ajz450ix68TDkhyAZd1IgZA/jUnXULrYZOSdcoOL+S0=";
   };
 
   postPatch = ''
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-DbKoZLB8XIZy5bIOC6blrNa3x4oCVG0Bl9xp6ARgw0c=";
+    hash = "sha256-08xbd2YmJw2NTrxBrnJZMV2VvX6V0eX+fxbEEWFoC9c=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/video/hypnotix/default.nix b/pkgs/applications/video/hypnotix/default.nix
index 582060920ea4..ad149b947e48 100644
--- a/pkgs/applications/video/hypnotix/default.nix
+++ b/pkgs/applications/video/hypnotix/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hypnotix";
-  version = "2.7";
+  version = "2.8";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "hypnotix";
     rev = version;
-    hash = "sha256-Mfj10CPYAI2QObgjbkhEPJ2nx6hsR5BHpmNofmdSz1k=";
+    hash = "sha256-uj5Bn3K9SCKE4p1jylfQ8XnAwNnN4VXHLMLrwhKhzsk=";
   };
 
   patches = [
diff --git a/pkgs/build-support/fetchurl/builder.sh b/pkgs/build-support/fetchurl/builder.sh
index 5b04a702aff4..5ca09b6fc77d 100644
--- a/pkgs/build-support/fetchurl/builder.sh
+++ b/pkgs/build-support/fetchurl/builder.sh
@@ -22,6 +22,8 @@ if ! [ -f "$SSL_CERT_FILE" ]; then
     curl+=(--insecure)
 fi
 
+eval "curl+=($curlOptsList)"
+
 curl+=(
     $curlOpts
     $NIX_CURL_FLAGS
diff --git a/pkgs/build-support/fetchurl/default.nix b/pkgs/build-support/fetchurl/default.nix
index 6dd8a685aee0..7ec831c61ac7 100644
--- a/pkgs/build-support/fetchurl/default.nix
+++ b/pkgs/build-support/fetchurl/default.nix
@@ -46,8 +46,13 @@ in
   urls ? []
 
 , # Additional curl options needed for the download to succeed.
+  # Warning: Each space (no matter the escaping) will start a new argument.
+  # If you wish to pass arguments with spaces, use `curlOptsList`
   curlOpts ? ""
 
+, # Additional curl options needed for the download to succeed.
+  curlOptsList ? []
+
 , # Name of the file.  If empty, use the basename of `url' (or of the
   # first element of `urls').
   name ? ""
@@ -147,7 +152,14 @@ stdenvNoCC.mkDerivation {
 
   outputHashMode = if (recursiveHash || executable) then "recursive" else "flat";
 
-  inherit curlOpts showURLs mirrorsFile postFetch downloadToTemp executable;
+  curlOpts = lib.warnIf (lib.isList curlOpts) ''
+    fetchurl for ${toString (builtins.head urls_)}: curlOpts is a list (${lib.generators.toPretty { multiline = false; } curlOpts}), which is not supported anymore.
+    - If you wish to get the same effect as before, for elements with spaces (even if escaped) to expand to multiple curl arguments, use a string argument instead:
+      curlOpts = ${lib.strings.escapeNixString (toString curlOpts)};
+    - If you wish for each list element to be passed as a separate curl argument, allowing arguments to contain spaces, use curlOptsList instead:
+      curlOptsList = [ ${lib.concatMapStringsSep " " lib.strings.escapeNixString curlOpts} ];'' curlOpts;
+  curlOptsList = lib.escapeShellArgs curlOptsList;
+  inherit showURLs mirrorsFile postFetch downloadToTemp executable;
 
   impureEnvVars = impureEnvVars ++ netrcImpureEnvVars;
 
diff --git a/pkgs/build-support/fetchurl/tests.nix b/pkgs/build-support/fetchurl/tests.nix
new file mode 100644
index 000000000000..fc7fb25e158f
--- /dev/null
+++ b/pkgs/build-support/fetchurl/tests.nix
@@ -0,0 +1,13 @@
+{ invalidateFetcherByDrvHash, fetchurl, jq, moreutils, ... }: {
+  # Tests that we can send custom headers with spaces in them
+  header =
+    let headerValue = "Test '\" <- These are some quotes";
+    in invalidateFetcherByDrvHash fetchurl {
+      url = "https://httpbin.org/headers";
+      sha256 = builtins.hashString "sha256" (headerValue + "\n");
+      curlOptsList = [ "-H" "Hello: ${headerValue}" ];
+      postFetch = ''
+        ${jq}/bin/jq -r '.headers.Hello' $out | ${moreutils}/bin/sponge $out
+      '';
+    };
+}
diff --git a/pkgs/data/fonts/monoid/default.nix b/pkgs/data/fonts/monoid/default.nix
index 77ef87152acf..fab91ae4e20b 100644
--- a/pkgs/data/fonts/monoid/default.nix
+++ b/pkgs/data/fonts/monoid/default.nix
@@ -1,25 +1,18 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, python3 }:
+{ lib, stdenv, fetchFromGitHub, python39 }:
 
 stdenv.mkDerivation {
   pname = "monoid";
-  version = "2018-06-03";
+  version = "2020-10-26";
 
   src = fetchFromGitHub {
     owner = "larsenwork";
     repo = "monoid";
-    rev = "a331c7c5f402c449f623e0d0895bd2fd8dc30ccf";
-    sha256 = "sha256-RV6lxv5CjywTMcuPMj6rdjLKrap7zLJ7niaNeF//U1Y=";
+    rev = "0673c8d6728df093faee9f183b6dfa62939df8c0";
+    sha256 = "sha256-u2jwVOC9QM2JHsdAVBuEpqqdiBAVs+IWnpp48A5Xk28=";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/larsenwork/monoid/pull/233/commits/f84f2ed61301ee84dadd16351314394f22ebed2f.patch";
-      sha256 = "sha256-CxfFHlR7TB64pvrfzVfUDkPwuRO2UdGOhXwW98c+oQU=";
-    })
-  ];
-
   nativeBuildInputs = [
-    (python3.withPackages (pp: with pp; [
+    (python39.withPackages (pp: with pp; [
       fontforge
     ]))
   ];
@@ -47,3 +40,4 @@ stdenv.mkDerivation {
     maintainers = [ maintainers.romildo ];
   };
 }
+
diff --git a/pkgs/data/themes/orchis-theme/default.nix b/pkgs/data/themes/orchis-theme/default.nix
index 793547bbeafa..ea8603020c06 100644
--- a/pkgs/data/themes/orchis-theme/default.nix
+++ b/pkgs/data/themes/orchis-theme/default.nix
@@ -21,13 +21,13 @@ assert lib.assertMsg (unknownTweaks == [ ]) ''
 stdenvNoCC.mkDerivation
 rec {
   pname = "orchis-theme";
-  version = "2022-05-01";
+  version = "2022-05-29";
 
   src = fetchFromGitHub {
     repo = "Orchis-theme";
     owner = "vinceliuice";
     rev = version;
-    sha256 = "sha256-OYB/TnVm8AOQTdF+rGiY5tQjUjkSSpMrqFo0+TXSHzA=";
+    sha256 = "sha256-F4kqQ1B8JNo2TAdGFondAtQu5C/6os9SQ8NS2gfRCQM=";
   };
 
   nativeBuildInputs = [ gtk3 sassc ];
diff --git a/pkgs/development/python-modules/hahomematic/default.nix b/pkgs/development/python-modules/hahomematic/default.nix
index 587931af03ec..ab00e1f05539 100644
--- a/pkgs/development/python-modules/hahomematic/default.nix
+++ b/pkgs/development/python-modules/hahomematic/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "hahomematic";
-  version = "1.9.0";
+  version = "1.9.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "danielperna84";
     repo = pname;
     rev = "refs/tags/${version}";
-    sha256 = "sha256-BmFJuugU6SsKxSB60O5dtODmgApClRT/AAzzTWAMXKI=";
+    sha256 = "sha256-HenIglv9aOVjniFunPcHq7Ktx6g0e7NYy0zgdVknDWI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/motionblinds/default.nix b/pkgs/development/python-modules/motionblinds/default.nix
index fd2700f35fff..9ff4bc02e74e 100644
--- a/pkgs/development/python-modules/motionblinds/default.nix
+++ b/pkgs/development/python-modules/motionblinds/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "motionblinds";
-  version = "0.6.8";
+  version = "0.6.10";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "starkillerOG";
     repo = "motion-blinds";
     rev = "refs/tags/${version}";
-    sha256 = "sha256-xlAQD0sJVhbr0nfJZdrBbskVbgC9Lrbrgu6rvT3jQCs=";
+    sha256 = "sha256-WCwj/2iUXOhmww4hiI5KPA7VyoVEYDeEMmnZM+DGHmc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pikepdf/default.nix b/pkgs/development/python-modules/pikepdf/default.nix
index 87609b30d80b..466a39fb2924 100644
--- a/pkgs/development/python-modules/pikepdf/default.nix
+++ b/pkgs/development/python-modules/pikepdf/default.nix
@@ -23,7 +23,7 @@
 
 buildPythonPackage rec {
   pname = "pikepdf";
-  version = "5.1.5";
+  version = "5.1.5.post1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     postFetch = ''
       rm "$out/.git_archival.txt"
     '';
-    hash = "sha256-DEgxdMVX5gQOsV9EyJtO/MO7padYMZrekanpp+nNvek=";
+    hash = "sha256-CGhkfQgsKUxiZzs1i2B2SlM++7G6Yrd9ruFh4sSJPbI=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/pykeepass/default.nix b/pkgs/development/python-modules/pykeepass/default.nix
index 7ee7b7e2c5b4..da5f2826e434 100644
--- a/pkgs/development/python-modules/pykeepass/default.nix
+++ b/pkgs/development/python-modules/pykeepass/default.nix
@@ -6,13 +6,15 @@
 
 buildPythonPackage rec {
   pname   = "pykeepass";
-  version = "4.0.2";
+  version = "4.0.3";
+
+  format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "libkeepass";
     repo = "pykeepass";
     rev = "v${version}";
-    hash = "sha256-q6cBowEki5iJh04Hp1jwbWdteEu3HXtD3tG/TsYDRNI=";
+    hash = "sha256-HyveBBsd1OFWoY3PgqqaKRLBhsxgFv8PRAxEF6r+bf4=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/qiskit-optimization/default.nix b/pkgs/development/python-modules/qiskit-optimization/default.nix
index edebad4db6f4..9a98cf29576b 100644
--- a/pkgs/development/python-modules/qiskit-optimization/default.nix
+++ b/pkgs/development/python-modules/qiskit-optimization/default.nix
@@ -18,15 +18,15 @@
 
 buildPythonPackage rec {
   pname = "qiskit-optimization";
-  version = "0.3.2";
+  version = "0.4.0";
 
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "qiskit";
     repo = pname;
-    rev = version;
-    sha256 = "sha256-SWrHNHZjynpWcwwrWzRPpbNWz8EhVujMoY8uIJQeT6U=";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-7MksgbCID4x1qW06BCBzcbiS/eNHjZiDKIvKYTPx6cc=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/resampy/default.nix b/pkgs/development/python-modules/resampy/default.nix
index e7e7ed5a7381..151d5ee97b61 100644
--- a/pkgs/development/python-modules/resampy/default.nix
+++ b/pkgs/development/python-modules/resampy/default.nix
@@ -1,38 +1,52 @@
 { lib
 , buildPythonPackage
-, fetchFromGitHub
-, pytest
-, pytest-cov
-, numpy
-, scipy
 , cython
+, fetchFromGitHub
 , numba
-, six
+, numpy
+, pytestCheckHook
+, pythonOlder
+, scipy
 }:
 
 buildPythonPackage rec {
   pname = "resampy";
-  version = "0.2.2";
+  version = "0.3.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
-  # No tests in PyPi Archive
   src = fetchFromGitHub {
     owner = "bmcfee";
     repo = pname;
-    rev = version;
-    sha256 = "0qmkxl5sbgh0j73n667vyi7ywzh09iaync91yp1j5rrcmwsn0qfs";
+    rev = "refs/tags/${version}";
+    hash = "sha256-OVj5dQafIoKeA04yTGBKTinldMjEccxrdiuRFIvRzcE=";
   };
 
-  checkInputs = [ pytest pytest-cov ];
-  propagatedBuildInputs = [ numpy scipy cython numba six ];
+  propagatedBuildInputs = [
+    numpy
+    cython
+    numba
+  ];
 
-  checkPhase = ''
-    pytest tests
+  checkInputs = [
+    pytestCheckHook
+    scipy
+  ];
+
+  postPatch = ''
+    substituteInPlace setup.cfg \
+      --replace " --cov-report term-missing --cov resampy --cov-report=xml" ""
   '';
 
-  meta = with lib; {
-    homepage = "https://github.com/bmcfee/resampy";
-    description = "Efficient signal resampling";
-    license = licenses.isc;
-  };
+  pythonImportsCheck = [
+    "resampy"
+  ];
 
+  meta = with lib; {
+    description = "Efficient signal resampling";
+    homepage = "https://github.com/bmcfee/resampy";
+    license = licenses.isc;
+    maintainers = with maintainers; [ ];
+  };
 }
diff --git a/pkgs/development/python-modules/schwifty/default.nix b/pkgs/development/python-modules/schwifty/default.nix
index 9b237757f78d..256a6069c368 100644
--- a/pkgs/development/python-modules/schwifty/default.nix
+++ b/pkgs/development/python-modules/schwifty/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "schwifty";
-  version = "2022.6.2";
+  version = "2022.6.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-urXYEX7QFl2HwoCwTSj+83TYQOkfqbc+aGJaBwKVorU=";
+    sha256 = "sha256-IBkEfc6sKk9fDFZF/4Xfcl4GbMPro75e7DmrF94ARlU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/simple-rlp/default.nix b/pkgs/development/python-modules/simple-rlp/default.nix
new file mode 100644
index 000000000000..29a4e957e84c
--- /dev/null
+++ b/pkgs/development/python-modules/simple-rlp/default.nix
@@ -0,0 +1,23 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+}:
+
+buildPythonPackage rec {
+  pname = "simple-rlp";
+  version = "0.1.2";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "5c4a9c58f1b742f7fa8af0fe4ea6ff9fb02294ae041912f771570dfaf339d2b9";
+  };
+
+  pythonImportsCheck = [ "rlp" ];
+
+  meta = with lib; {
+    description = "Simple RLP (Recursive Length Prefix)";
+    homepage = "https://github.com/SamuelHaidu/simple-rlp";
+    license = licenses.mit;
+    maintainers = with maintainers; [ prusnak ];
+  };
+}
diff --git a/pkgs/development/python-modules/textdistance/default.nix b/pkgs/development/python-modules/textdistance/default.nix
index 314a9efd940c..c6def554a641 100644
--- a/pkgs/development/python-modules/textdistance/default.nix
+++ b/pkgs/development/python-modules/textdistance/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "textdistance";
-  version = "4.2.2";
+  version = "4.3.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a43bb6f71dcccd3fc2060065c9513a7927879680512889749fd1fd800c4bad8e";
+    sha256 = "sha256-T2vAf2ZX5pNA1MytsleAoScCWy9rccQELi0BByC0yo4=";
   };
 
   # There aren't tests
diff --git a/pkgs/development/python-modules/traitsui/default.nix b/pkgs/development/python-modules/traitsui/default.nix
index dc42ba0972fc..9fcfafd99e0a 100644
--- a/pkgs/development/python-modules/traitsui/default.nix
+++ b/pkgs/development/python-modules/traitsui/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "traitsui";
-  version = "7.3.1";
+  version = "7.4.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-lHStZ/NF2Wsya0AemgFAXICCyS+kO/R8CwOYGOWHrGk=";
+    hash = "sha256-JTNa/+4jQtR+NcJd9ed4XSKlM1hP4b4JQ8y6Rdwa5Yk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/trezor/default.nix b/pkgs/development/python-modules/trezor/default.nix
index f58c24e5008c..82ddac3b620b 100644
--- a/pkgs/development/python-modules/trezor/default.nix
+++ b/pkgs/development/python-modules/trezor/default.nix
@@ -15,8 +15,8 @@
 , protobuf
 , pyblake2
 , requests
-, rlp
 , shamir-mnemonic
+, simple-rlp
 , typing-extensions
 , trezor-udev-rules
 , pytestCheckHook
@@ -24,13 +24,13 @@
 
 buildPythonPackage rec {
   pname = "trezor";
-  version = "0.13.0";
+  version = "0.13.2";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "4571aa09dbfe88b31eb2f16c7c359b4809621b75a04b7b5bc9dbffe17046c99a";
+    sha256 = "cdb696fd01dad6a0cb23b61ea3a4867bb51cecda5cb2a77366fb6a53bff58ac4";
   };
 
   nativeBuildInputs = [ installShellFiles ];
@@ -47,8 +47,8 @@ buildPythonPackage rec {
     protobuf
     pyblake2
     requests
-    rlp
     shamir-mnemonic
+    simple-rlp
     typing-extensions
   ] ++ lib.optionals stdenv.isLinux [
     trezor-udev-rules
diff --git a/pkgs/development/python-modules/venstarcolortouch/default.nix b/pkgs/development/python-modules/venstarcolortouch/default.nix
index 082db8b90ab4..10f92a997823 100644
--- a/pkgs/development/python-modules/venstarcolortouch/default.nix
+++ b/pkgs/development/python-modules/venstarcolortouch/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "venstarcolortouch";
-  version = "0.16";
+  version = "0.17";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-kV/fPxvJPMZVmRyyKJnmHgDMsD5tvxcolPSdO13GV90=";
+    sha256 = "sha256-HgUtGC2lXJ6BFhOnFK7DF4b/IooXIFPGcpJ4ru3kPNs=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index 50bf1828b430..8a239b4c37f7 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -32,14 +32,14 @@ with py.pkgs;
 
 buildPythonApplication rec {
   pname = "checkov";
-  version = "2.1.16";
+  version = "2.1.20";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = pname;
     rev = version;
-    hash = "sha256-/sYxR7xaNTScyv0rB+7CHUPnxPXMX2aIGl9WtrBo+Jc=";
+    hash = "sha256-dXpgm9S++jtBhuzX9db8Pm5LF6Qb4isXx5uyOGdWGUc=";
   };
 
   nativeBuildInputs = with py.pkgs; [
diff --git a/pkgs/development/tools/build-managers/scala-cli/sources.json b/pkgs/development/tools/build-managers/scala-cli/sources.json
index bd3a4efc57bf..77bc912c47de 100644
--- a/pkgs/development/tools/build-managers/scala-cli/sources.json
+++ b/pkgs/development/tools/build-managers/scala-cli/sources.json
@@ -1,17 +1,17 @@
 {
-  "version": "0.1.8",
+  "version": "0.1.9",
   "assets": {
     "aarch64-darwin": {
       "asset": "scala-cli-x86_64-apple-darwin.gz",
-      "sha256": "1dxhwhdk7kflzn4ckqxfxkz4v26l39ki6ykpml6k6kvy3nn0wwz3"
+      "sha256": "10lirk7h0ir2k20rf0xl72642axdhik8g66lcbyn689jybj6vks6"
     },
     "x86_64-darwin": {
       "asset": "scala-cli-x86_64-apple-darwin.gz",
-      "sha256": "1dxhwhdk7kflzn4ckqxfxkz4v26l39ki6ykpml6k6kvy3nn0wwz3"
+      "sha256": "10lirk7h0ir2k20rf0xl72642axdhik8g66lcbyn689jybj6vks6"
     },
     "x86_64-linux": {
       "asset": "scala-cli-x86_64-pc-linux.gz",
-      "sha256": "0hj22lcmbbfgv69k778myb0kp79gbg7xx9a3b66g3svxmanlbvxf"
+      "sha256": "11h471rcds0b396r6nqadzmny5dvmz8rxh1kwcj4bldss2mdcckz"
     }
   }
 }
diff --git a/pkgs/games/factorio/default.nix b/pkgs/games/factorio/default.nix
index 4ca92961bafd..17f9947b4982 100644
--- a/pkgs/games/factorio/default.nix
+++ b/pkgs/games/factorio/default.nix
@@ -85,7 +85,7 @@ let
         (lib.overrideDerivation
           (fetchurl {
             inherit name url sha256;
-            curlOpts = [
+            curlOptsList = [
               "--get"
               "--data-urlencode" "username@username"
               "--data-urlencode" "token@token"
diff --git a/pkgs/pkgs-lib/formats.nix b/pkgs/pkgs-lib/formats.nix
index cdcbd3663422..13aada3681f7 100644
--- a/pkgs/pkgs-lib/formats.nix
+++ b/pkgs/pkgs-lib/formats.nix
@@ -135,6 +135,55 @@ rec {
 
   };
 
+  keyValue = {
+    # Represents lists as duplicate keys
+    listsAsDuplicateKeys ? false,
+    # Alternative to listsAsDuplicateKeys, converts list to non-list
+    # listToValue :: [Atom] -> Atom
+    listToValue ? null,
+    ...
+    }@args:
+    assert !listsAsDuplicateKeys || listToValue == null;
+    {
+
+    type = with lib.types; let
+
+      singleAtom = nullOr (oneOf [
+        bool
+        int
+        float
+        str
+      ]) // {
+        description = "atom (null, bool, int, float or string)";
+      };
+
+      atom =
+        if listsAsDuplicateKeys then
+          coercedTo singleAtom lib.singleton (listOf singleAtom) // {
+            description = singleAtom.description + " or a list of them for duplicate keys";
+          }
+        else if listToValue != null then
+          coercedTo singleAtom lib.singleton (nonEmptyListOf singleAtom) // {
+            description = singleAtom.description + " or a non-empty list of them";
+          }
+        else
+          singleAtom;
+
+    in attrsOf atom;
+
+    generate = name: value:
+      let
+        transformedValue =
+          if listToValue != null
+          then
+            lib.mapAttrs (key: val:
+              if lib.isList val then listToValue val else val
+            ) value
+          else value;
+      in pkgs.writeText name (lib.generators.toKeyValue (removeAttrs args ["listToValue"]) transformedValue);
+
+  };
+
   gitIni = { listsAsDuplicateKeys ? false, ... }@args: {
 
     type = with lib.types; let
diff --git a/pkgs/pkgs-lib/tests/formats.nix b/pkgs/pkgs-lib/tests/formats.nix
index dba7f981cbd9..80df247f7b6a 100644
--- a/pkgs/pkgs-lib/tests/formats.nix
+++ b/pkgs/pkgs-lib/tests/formats.nix
@@ -147,6 +147,51 @@ in runBuildTests {
     '';
   };
 
+  testKeyValueAtoms = {
+    drv = evalFormat formats.keyValue {} {
+      bool = true;
+      int = 10;
+      float = 3.141;
+      str = "string";
+    };
+    expected = ''
+      bool=true
+      float=3.141000
+      int=10
+      str=string
+    '';
+  };
+
+  testKeyValueDuplicateKeys = {
+    drv = evalFormat formats.keyValue { listsAsDuplicateKeys = true; } {
+      bar = [ null true "test" 1.2 10 ];
+      baz = false;
+      qux = "qux";
+    };
+    expected = ''
+      bar=null
+      bar=true
+      bar=test
+      bar=1.200000
+      bar=10
+      baz=false
+      qux=qux
+    '';
+  };
+
+  testKeyValueListToValue = {
+    drv = evalFormat formats.keyValue { listToValue = concatMapStringsSep ", " (generators.mkValueStringDefault {}); } {
+      bar = [ null true "test" 1.2 10 ];
+      baz = false;
+      qux = "qux";
+    };
+    expected = ''
+      bar=null, true, test, 1.200000, 10
+      baz=false
+      qux=qux
+    '';
+  };
+
   testTomlAtoms = {
     drv = evalFormat formats.toml {} {
       false = false;
diff --git a/pkgs/test/default.nix b/pkgs/test/default.nix
index 48bd6ac77469..82975efb5917 100644
--- a/pkgs/test/default.nix
+++ b/pkgs/test/default.nix
@@ -29,6 +29,7 @@ with pkgs;
   cc-multilib-gcc = callPackage ./cc-wrapper/multilib.nix { stdenv = gccMultiStdenv; };
   cc-multilib-clang = callPackage ./cc-wrapper/multilib.nix { stdenv = clangMultiStdenv; };
 
+  fetchurl = callPackages ../build-support/fetchurl/tests.nix { };
   fetchpatch = callPackages ../build-support/fetchpatch/tests.nix { };
   fetchzip = callPackages ../build-support/fetchzip/tests.nix { };
   fetchgit = callPackages ../build-support/fetchgit/tests.nix { };
diff --git a/pkgs/tools/misc/vector/default.nix b/pkgs/tools/misc/vector/default.nix
index a3e2265a6e1c..08617255a23f 100644
--- a/pkgs/tools/misc/vector/default.nix
+++ b/pkgs/tools/misc/vector/default.nix
@@ -30,7 +30,7 @@
 
 let
   pname = "vector";
-  version = "0.22.2";
+  version = "0.22.3";
 in
 rustPlatform.buildRustPackage {
   inherit pname version;
@@ -39,10 +39,10 @@ rustPlatform.buildRustPackage {
     owner = "vectordotdev";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-5vfV58UvukD4CGAKUzew/se6wZw+JLSpDs8nwNihuWg=";
+    sha256 = "sha256-62oPttkdahTeMsd9lpd9/tc95kluVJuWxzP94i+gWhA=";
   };
 
-  cargoSha256 = "sha256-FlWwUIau7QJsH3ax4y3yz+iBRP/KaEB/eHzUPTq0+tQ=";
+  cargoSha256 = "sha256-WWX47pbva7ZmPR6hBstJ5VqOwu3mkhhsHK3LHHqQjDE=";
   nativeBuildInputs = [ pkg-config cmake perl ];
   buildInputs = [ oniguruma openssl protobuf rdkafka zstd ]
     ++ lib.optionals stdenv.isDarwin [ Security libiconv coreutils CoreServices ];
diff --git a/pkgs/tools/security/pass/extensions/import.nix b/pkgs/tools/security/pass/extensions/import.nix
index fdfab9bc1954..d543ef9b2575 100644
--- a/pkgs/tools/security/pass/extensions/import.nix
+++ b/pkgs/tools/security/pass/extensions/import.nix
@@ -18,6 +18,14 @@ python3Packages.buildPythonApplication rec {
     sha256 = "0hrpg7yiv50xmbajfy0zdilsyhbj5iv0qnlrgkfv99q1dvd5qy56";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "support-for-pykeepass-4.0.3.patch";
+      url = "https://github.com/roddhjav/pass-import/commit/f1b167578916d971ee4f99be99ba0e86ef49015e.patch";
+      hash = "sha256-u6bJbV3/QTfRaPauKSyCWNodpy6CKsreMXUZWKRbee0=";
+    })
+  ];
+
   propagatedBuildInputs = with python3Packages; [
     cryptography
     defusedxml
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 56109aae5c09..1aaaa1afcad6 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -28032,6 +28032,8 @@ with pkgs;
 
   k9s = callPackage ../applications/networking/cluster/k9s { };
 
+  ktunnel = callPackage ../applications/networking/cluster/ktunnel { };
+
   pgo-client = callPackage ../applications/networking/cluster/pgo-client { };
 
   popeye = callPackage ../applications/networking/cluster/popeye { };
@@ -29276,9 +29278,7 @@ with pkgs;
   pdfchain = callPackage ../tools/typesetting/pdfchain { };
 
   pdfcpu = callPackage ../applications/graphics/pdfcpu { };
-  pdftk = callPackage ../tools/typesetting/pdftk {
-    jre = jre8; # TODO: remove override https://github.com/NixOS/nixpkgs/pull/89731
-  };
+  pdftk = callPackage ../tools/typesetting/pdftk { };
   pdfgrep  = callPackage ../tools/typesetting/pdfgrep { };
 
   pdfpc = callPackage ../applications/misc/pdfpc {
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 3eb09abe3e4e..767e69eb54ba 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -9738,6 +9738,8 @@ in {
 
   simple-rest-client = callPackage ../development/python-modules/simple-rest-client { };
 
+  simple-rlp = callPackage ../development/python-modules/simple-rlp { };
+
   simple-salesforce = callPackage ../development/python-modules/simple-salesforce { };
 
   simple-websocket-server = callPackage ../development/python-modules/simple-websocket-server { };