diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 87639fc55d48..d51c11e14914 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -2314,6 +2314,12 @@
     githubId = 811527;
     name = "Christopher Jefferson";
   };
+  chrispattison = {
+    email = "chpattison@gmail.com";
+    github = "ChrisPattison";
+    githubId = 641627;
+    name = "Chris Pattison";
+  };
   chrispickard = {
     email = "chrispickard9@gmail.com";
     github = "chrispickard";
diff --git a/nixos/modules/system/boot/plymouth.nix b/nixos/modules/system/boot/plymouth.nix
index 366d6ee43286..02d8fcf4799c 100644
--- a/nixos/modules/system/boot/plymouth.nix
+++ b/nixos/modules/system/boot/plymouth.nix
@@ -184,9 +184,14 @@ in
           mkdir $out
           cp -r ${themesEnv}/share/plymouth/themes/${cfg.theme} $out
           # Copy more themes if the theme depends on others
-          for theme in $(grep -hRo '/etc/plymouth/themes/.*$' ${themesEnv} | xargs -n1 basename); do
-              if [[ -d "${themesEnv}/theme" ]]; then
-                  cp -r "${themesEnv}/theme" $out
+          for theme in $(grep -hRo '/etc/plymouth/themes/.*$' $out | xargs -n1 basename); do
+              if [[ -d "${themesEnv}/share/plymouth/themes/$theme" ]]; then
+                  if [[ ! -d "$out/$theme" ]]; then
+                    echo "Adding dependent theme: $theme"
+                    cp -r "${themesEnv}/share/plymouth/themes/$theme" $out
+                  fi
+              else
+                echo "Missing theme dependency: $theme"
               fi
           done
         '';
diff --git a/nixos/modules/system/boot/stage-1.nix b/nixos/modules/system/boot/stage-1.nix
index ec2f3d18c685..37adcc531d3d 100644
--- a/nixos/modules/system/boot/stage-1.nix
+++ b/nixos/modules/system/boot/stage-1.nix
@@ -219,7 +219,7 @@ let
 
       # Strip binaries further than normal.
       chmod -R u+w $out
-      stripDirs "$STRIP" "lib bin" "-s"
+      stripDirs "$STRIP" "$RANLIB" "lib bin" "-s"
 
       # Run patchelf to make the programs refer to the copied libraries.
       find $out/bin $out/lib -type f | while read i; do
diff --git a/pkgs/applications/misc/masterpdfeditor/default.nix b/pkgs/applications/misc/masterpdfeditor/default.nix
index 5916179d772c..1ea5db2515f0 100644
--- a/pkgs/applications/misc/masterpdfeditor/default.nix
+++ b/pkgs/applications/misc/masterpdfeditor/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "masterpdfeditor";
-  version = "5.8.46";
+  version = "5.8.70";
 
   src = fetchurl {
     url = "https://code-industry.net/public/master-pdf-editor-${version}-qt5.x86_64.tar.gz";
-    sha256 = "sha256-xms4aqIxYXR6v226RMf+abrFU1xz2aDIL6iQ+Yfff1k=";
+    sha256 = "sha256-mheHvHU7Z1jUxFWEEfXv2kVO51t/edTK3xV82iteUXM=";
   };
 
   nativeBuildInputs = [ autoPatchelfHook wrapQtAppsHook ];
diff --git a/pkgs/applications/networking/appgate-sdp/default.nix b/pkgs/applications/networking/appgate-sdp/default.nix
index cac64ba7f63f..7dd69aeebcdc 100644
--- a/pkgs/applications/networking/appgate-sdp/default.nix
+++ b/pkgs/applications/networking/appgate-sdp/default.nix
@@ -87,11 +87,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "appgate-sdp";
-  version = "5.5.5";
+  version = "6.0.1";
 
   src = fetchurl {
     url = "https://bin.appgate-sdp.com/${versions.majorMinor version}/client/appgate-sdp_${version}_amd64.deb";
-    sha256 = "sha256-eXcGHd3TGNFqjFQ+wSg4+1hF/6DJTPOs0ldjegFktGo=";
+    sha256 = "sha256-dVVOUdGJDmStS1ZXqPOFpeWhLgimv4lHBS/OOEDrtM0=";
   };
 
   # just patch interpreter
diff --git a/pkgs/applications/networking/cluster/werf/default.nix b/pkgs/applications/networking/cluster/werf/default.nix
index 6ba07278459b..140487868230 100644
--- a/pkgs/applications/networking/cluster/werf/default.nix
+++ b/pkgs/applications/networking/cluster/werf/default.nix
@@ -11,16 +11,16 @@
 
 buildGoModule rec {
   pname = "werf";
-  version = "1.2.146";
+  version = "1.2.151";
 
   src = fetchFromGitHub {
     owner = "werf";
     repo = "werf";
     rev = "v${version}";
-    sha256 = "sha256-6OIV9vs0XWlhosWrKX/GL5q2REYzX5UMd1IHEiM1/qA=";
+    sha256 = "sha256-YgyR3BVkfQcluTamXlsCHHfqxbM1wqdmGsHPYDyMk8I=";
   };
 
-  vendorSha256 = "sha256-yWKIaH0KXiJR1EVu/htqeDi7qEGu8IvD6m1GcMUdgJo=";
+  vendorSha256 = "sha256-XpSAFiweD2oUKleD6ztDp1+3PpfUWXfGaaE/9mzRrUQ=";
 
   proxyVendor = true;
 
diff --git a/pkgs/applications/networking/instant-messengers/zulip-term/default.nix b/pkgs/applications/networking/instant-messengers/zulip-term/default.nix
index ad16c84c6989..cf48ba4420e6 100644
--- a/pkgs/applications/networking/instant-messengers/zulip-term/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zulip-term/default.nix
@@ -17,6 +17,10 @@ python3.pkgs.buildPythonApplication rec {
     sha256 = "sha256-ZouUU4p1FSGMxPuzDo5P971R+rDXpBdJn2MqvkJO+Fw=";
   };
 
+  patches = [
+    ./pytest-executable-name.patch
+  ];
+
   propagatedBuildInputs = with python3.pkgs; [
     beautifulsoup4
     lxml
@@ -43,12 +47,6 @@ python3.pkgs.buildPythonApplication rec {
     "--prefix" "PATH" ":" (lib.makeBinPath [ libnotify ])
   ];
 
-  disabledTests = [
-    # IndexError: list index out of range
-    "test_main_multiple_notify_options"
-    "test_main_multiple_autohide_options"
-  ];
-
   meta = with lib; {
     description = "Zulip's official terminal client";
     homepage = "https://github.com/zulip/zulip-terminal";
diff --git a/pkgs/applications/networking/instant-messengers/zulip-term/pytest-executable-name.patch b/pkgs/applications/networking/instant-messengers/zulip-term/pytest-executable-name.patch
new file mode 100644
index 000000000000..a816993b8c4b
--- /dev/null
+++ b/pkgs/applications/networking/instant-messengers/zulip-term/pytest-executable-name.patch
@@ -0,0 +1,22 @@
+diff --git a/tests/cli/test_run.py b/tests/cli/test_run.py
+index 1452cfd..0a21c09 100644
+--- a/tests/cli/test_run.py
++++ b/tests/cli/test_run.py
+@@ -240,7 +240,7 @@ def test_main_multiple_autohide_options(
+ 
+     captured = capsys.readouterr()
+     lines = captured.err.strip("\n")
+-    lines = lines.split("pytest: ", 1)[1]
++    lines = lines.split("__main__.py: ", 1)[1]
+     expected = f"error: argument {options[1]}: not allowed with argument {options[0]}"
+     assert lines == expected
+ 
+@@ -277,7 +277,7 @@ def test_main_multiple_notify_options(
+ 
+     captured = capsys.readouterr()
+     lines = captured.err.strip("\n")
+-    lines = lines.split("pytest: ", 1)[1]
++    lines = lines.split("__main__.py: ", 1)[1]
+     expected = f"error: argument {options[1]}: not allowed with argument {options[0]}"
+     assert lines == expected
+ 
diff --git a/pkgs/applications/networking/mailreaders/imapfilter.nix b/pkgs/applications/networking/mailreaders/imapfilter.nix
index bed71202c4fe..870477545b53 100644
--- a/pkgs/applications/networking/mailreaders/imapfilter.nix
+++ b/pkgs/applications/networking/mailreaders/imapfilter.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "imapfilter";
-  version = "2.7.5";
+  version = "2.7.6";
 
   src = fetchFromGitHub {
     owner = "lefcha";
     repo = "imapfilter";
     rev = "v${version}";
-    sha256 = "nbVwbPkNbJz4GHhvOp+QVgiBqKA/HR34p4x3NXJB7ig=";
+    sha256 = "sha256-7B3ebY2QAk+64NycptoMmAo7GxUFOo3a7CH7txV/KTY=";
   };
   makeFlags = [
     "SSLCAFILE=/etc/ssl/certs/ca-bundle.crt"
diff --git a/pkgs/applications/networking/mailreaders/mailspring/default.nix b/pkgs/applications/networking/mailreaders/mailspring/default.nix
index 539e69069f35..a5a9b3ac89b4 100644
--- a/pkgs/applications/networking/mailreaders/mailspring/default.nix
+++ b/pkgs/applications/networking/mailreaders/mailspring/default.nix
@@ -21,11 +21,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mailspring";
-  version = "1.10.3";
+  version = "1.10.5";
 
   src = fetchurl {
     url = "https://github.com/Foundry376/Mailspring/releases/download/${version}/mailspring-${version}-amd64.deb";
-    sha256 = "sha256-+H2KeaRBApveUG6Vz+Z8LWpmNpZ4lwyeX1LK0AKx/bw=";
+    sha256 = "sha256-eVwb7E04DzGdqfH4T+gkvmBtvN7ja4o8u7LvHk/581I=";
   };
 
   nativeBuildInputs = [
@@ -93,7 +93,7 @@ stdenv.mkDerivation rec {
     '';
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ toschmidt doronbehar ];
+    maintainers = with maintainers; [ toschmidt ];
     homepage = "https://getmailspring.com";
     downloadPage = "https://github.com/Foundry376/Mailspring";
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/networking/mpop/default.nix b/pkgs/applications/networking/mpop/default.nix
index e2bf0b134d54..21d9d19e03b3 100644
--- a/pkgs/applications/networking/mpop/default.nix
+++ b/pkgs/applications/networking/mpop/default.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mpop";
-  version = "1.4.16";
+  version = "1.4.17";
 
   src = fetchurl {
     url = "https://marlam.de/${pname}/releases/${pname}-${version}.tar.xz";
-    sha256 = "sha256-hw61cerm0j+5KtDITXnenDjF9iTjYUk31XS/5Jumh/k=";
+    sha256 = "sha256-Qq5JS60pQdn2R8SMPtmMOLqapc8/5I+w/gblttrfi9U=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/office/beamerpresenter/default.nix b/pkgs/applications/office/beamerpresenter/default.nix
index 5f8d3adf8c2f..c716323d4fcc 100644
--- a/pkgs/applications/office/beamerpresenter/default.nix
+++ b/pkgs/applications/office/beamerpresenter/default.nix
@@ -1,39 +1,28 @@
-{ lib,
-  stdenv,
-  fetchFromGitHub,
-  installShellFiles,
-  pkg-config,
-  cmake,
-  qtbase,
-  qtmultimedia,
-  qttools,
-  wrapQtAppsHook,
-  bash,
-  zlib,
-  gcc,
-  gnumake,
-  coreutils,
-  # only required when using poppler
-  poppler,
-  # only required when using mupdf
-  mupdf,
-  freetype,
-  jbig2dec,
-  openjpeg,
-  gumbo,
-  # choose renderer: mupdf or poppler or both (not recommended)
-  renderer ? "mupdf",
-  # choose major Qt version: "5" or "6" (only 5 is tested)
-  qt_version ? "5"}:
-
-let
-  renderers = {
-    mupdf.buildInputs = [ mupdf freetype jbig2dec openjpeg gumbo ];
-    poppler.buildInputs = [ poppler ];
-  };
-  use_poppler = if "${renderer}" == "poppler" || "${renderer}" == "both" then "ON" else "OFF";
-  use_mupdf = if "${renderer}" == "mupdf" || "${renderer}" == "both" then "ON" else "OFF";
-in
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, pkg-config
+, wrapGAppsHook
+, wrapQtAppsHook
+, gst_all_1
+, qtbase
+, qtmultimedia
+, qttools
+, qtwayland
+, zlib
+# only required when using poppler
+, poppler
+# only required when using mupdf
+, freetype
+, gumbo
+, jbig2dec
+, mupdf
+, openjpeg
+# choose renderer: mupdf or poppler or both (not recommended)
+, usePoppler ? false
+, useMupdf ? true
+}:
 
 stdenv.mkDerivation rec {
   pname = "beamerpresenter";
@@ -46,25 +35,53 @@ stdenv.mkDerivation rec {
     sha256 = "16v263nnnipih3lxg95rmwz0ihnvpl4n1wlj9r6zavnspzlp9dvb";
   };
 
-  nativeBuildInputs = [ pkg-config installShellFiles wrapQtAppsHook ];
-  buildInputs = [ gcc cmake coreutils gnumake bash zlib qtbase qtmultimedia qttools ] ++ renderers.${renderer}.buildInputs;
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    wrapGAppsHook
+    wrapQtAppsHook
+  ];
+
+  dontWrapGApps = true;
+
+  buildInputs = [
+    gst_all_1.gst-libav
+    gst_all_1.gst-plugins-base
+    gst_all_1.gst-plugins-good
+    zlib
+    qtbase
+    qtmultimedia
+    qttools
+    qtwayland
+  ] ++ lib.optionals useMupdf [
+    freetype
+    gumbo
+    jbig2dec
+    mupdf
+    openjpeg
+  ] ++ lib.optionals usePoppler [
+    poppler
+  ];
 
   cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE='Release'"
     "-DGIT_VERSION=OFF"
-    "-DUSE_POPPLER=${use_poppler}"
-    "-DUSE_MUPDF=${use_mupdf}"
+    "-DUSE_POPPLER=${if usePoppler then "ON" else "OFF"}"
+    "-DUSE_MUPDF=${if useMupdf then "ON" else "OFF"}"
     "-DUSE_MUJS=OFF"
     "-DUSE_GUMBO=ON"
     "-DUSE_TRANSLATIONS=ON"
-    "-DQT_VERSION_MAJOR=${qt_version}"
+    "-DQT_VERSION_MAJOR=${lib.versions.major qtbase.version}"
   ];
 
+  preFixup = ''
+    qtWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';
+
   meta = with lib; {
     description = "Modular multi screen pdf presentation viewer";
     homepage = "https://github.com/stiglers-eponym/BeamerPresenter";
     license = with licenses; [ agpl3 gpl3Plus ];
     platforms = platforms.all;
-    maintainers = with maintainers; [ pacien ];
+    maintainers = with maintainers; [ pacien dotlambda ];
   };
 }
diff --git a/pkgs/applications/version-management/github-desktop/default.nix b/pkgs/applications/version-management/github-desktop/default.nix
index f439c62504d6..a834a3357064 100644
--- a/pkgs/applications/version-management/github-desktop/default.nix
+++ b/pkgs/applications/version-management/github-desktop/default.nix
@@ -19,11 +19,11 @@
 
 stdenv.mkDerivation rec {
   pname = "github-desktop";
-  version = "3.0.3";
+  version = "3.0.5";
 
   src = fetchurl {
     url = "https://github.com/shiftkey/desktop/releases/download/release-${version}-linux1/GitHubDesktop-linux-${version}-linux1.deb";
-    sha256 = "sha256-KC+D4epjEhZPIN6LutRRo2ViX6YVyol3UUEA56ymyfM=";
+    sha256 = "sha256-7Sk2jDNZtOA04hkl/J+Up2yMGT8+FcXGPiUMcHhb7iY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/video/xplayer/default.nix b/pkgs/applications/video/xplayer/default.nix
index 3bbbb115fbea..c75635b44b31 100644
--- a/pkgs/applications/video/xplayer/default.nix
+++ b/pkgs/applications/video/xplayer/default.nix
@@ -34,13 +34,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "xplayer";
-  version = "2.4.3";
+  version = "2.4.4";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = pname;
     rev = version;
-    sha256 = "sha256-0hQHhf2me28YTTKOzEkzoxRoSoHLwtiaHPKNPJ/Fg+0=";
+    sha256 = "sha256-o2vLNIELd1EYWG26t5gOpnamJrBJeg4P6fcLirkcmfM=";
   };
 
   # configure wants to find gst-inspect-1.0 via pkgconfig but
diff --git a/pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-build-hook.sh b/pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-build-hook.sh
index a8a830195eaa..c7a6d8c17aba 100644
--- a/pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-build-hook.sh
+++ b/pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-build-hook.sh
@@ -15,9 +15,9 @@ dotnetBuildHook() {
     fi
 
     if [ "${selfContainedBuild-}" ]; then
-        dotnetBuildFlags+=("--self-contained")
+        dotnetBuildFlags+=("-p:SelfContained=true")
     else
-        dotnetBuildFlags+=("--no-self-contained")
+        dotnetBuildFlags+=("-p:SelfContained=false")
     fi
 
     if [ "${version-}" ]; then
diff --git a/pkgs/data/icons/oranchelo-icon-theme/default.nix b/pkgs/data/icons/oranchelo-icon-theme/default.nix
index 5c93acbb10af..b676b5956c73 100644
--- a/pkgs/data/icons/oranchelo-icon-theme/default.nix
+++ b/pkgs/data/icons/oranchelo-icon-theme/default.nix
@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "oranchelo-icon-theme";
-  version = "0.8.0.1";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "OrancheloTeam";
     repo = pname;
-    rev = "096c8c8d550ac9a85f5f34f3f30243e6f198df2d";
-    sha256 = "sha256-TKi42SA33pGKdrPtGTpvxFbOP+5N93Y4BvO4CRTveLM=";
+    rev = "v${version}";
+    sha256 = "sha256-IDsZj/X9rFSdDpa3bL6IPEPCRe5GustPteDxSbfz+SA=";
   };
 
   nativeBuildInputs = [
@@ -22,9 +22,18 @@ stdenvNoCC.mkDerivation rec {
 
   dontDropIconThemeCache = true;
 
-  installPhase = ''
-    mkdir -p $out/share/icons
-    cp -r $Oranchelo* $out/share/icons/
+  makeFlags = [
+    "DESTDIR=$(out)"
+    "PREFIX="
+  ];
+
+  postInstall = ''
+    # space in icon name causes gtk-update-icon-cache to fail
+    mv "$out/share/icons/Oranchelo/apps/scalable/ grsync.svg" "$out/share/icons/Oranchelo/apps/scalable/grsync.svg"
+
+    for theme in $out/share/icons/*; do
+      gtk-update-icon-cache "$theme"
+    done
   '';
 
   meta = with lib; {
diff --git a/pkgs/desktops/cinnamon/cinnamon-common/default.nix b/pkgs/desktops/cinnamon/cinnamon-common/default.nix
index 87d500cf617b..3581355387e5 100644
--- a/pkgs/desktops/cinnamon/cinnamon-common/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-common/default.nix
@@ -53,13 +53,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cinnamon-common";
-  version = "5.4.8";
+  version = "5.4.9";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "cinnamon";
     rev = version;
-    hash = "sha256-Z+BbvLgH4gOsLMSC0r5Hp9yDZz4XMH7NR/A9to+/djA=";
+    hash = "sha256-nM87NO/dwOd+hN5/3zX7XUjyKvXh4uDhLcGFcKE9ccA=";
   };
 
   patches = [
diff --git a/pkgs/desktops/cinnamon/cinnamon-control-center/default.nix b/pkgs/desktops/cinnamon/cinnamon-control-center/default.nix
index 6a8e344ba47c..dded4a9ff610 100644
--- a/pkgs/desktops/cinnamon/cinnamon-control-center/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-control-center/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , pkg-config
 , glib
 , gettext
@@ -18,6 +17,7 @@
 , libgnomekbd
 , libxklavier
 , networkmanager
+, libgudev
 , libwacom
 , gnome
 , wrapGAppsHook
@@ -36,22 +36,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cinnamon-control-center";
-  version = "5.4.4";
-
-  patches = [
-    # Add missing gio-unix-2.0 dependency, can be removed on next update
-    # https://github.com/linuxmint/cinnamon-control-center/pull/294
-    (fetchpatch {
-      url = "https://github.com/linuxmint/cinnamon-control-center/commit/7f5ba6e7a691547840f8482445c09c729e10a397.patch";
-      sha256 = "sha256-xcf/O/DfhOvCpWJl0XZD+xAwWs4STAeCaFMZ9Lftv2w=";
-    })
-  ];
+  version = "5.4.6";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = pname;
     rev = version;
-    hash = "sha256-c2JbRAMcTnqaqt8MXQl4AxnENVmfYyHcCteWBWQUSO0=";
+    hash = "sha256-8BDmQT/xDnpwR2YC0TGaqWPnZ61IBmVvft2Mcf6YN+A=";
   };
 
   buildInputs = [
@@ -66,6 +57,7 @@ stdenv.mkDerivation rec {
     libxklavier
     colord
     cinnamon-settings-daemon
+    libgudev
     libwacom
     gnome-online-accounts
     tzdata
@@ -98,6 +90,8 @@ stdenv.mkDerivation rec {
   '';
 
   mesonFlags = [
+    # TODO: https://github.com/NixOS/nixpkgs/issues/36468
+    "-Dc_args=-I${glib.dev}/include/gio-unix-2.0"
     # use locales from cinnamon-translations
     "--localedir=${cinnamon-translations}/share/locale"
   ];
diff --git a/pkgs/desktops/cinnamon/cinnamon-screensaver/default.nix b/pkgs/desktops/cinnamon/cinnamon-screensaver/default.nix
index 23be4175ab6d..5f0ace4ad1ee 100644
--- a/pkgs/desktops/cinnamon/cinnamon-screensaver/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-screensaver/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , pkg-config
 , meson
 , ninja
@@ -30,22 +29,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cinnamon-screensaver";
-  version = "5.4.1";
-
-  patches = [
-    # Add missing gio-unix-2.0 dependency, can be removed on next update
-    # https://github.com/linuxmint/cinnamon-screensaver/pull/411
-    (fetchpatch {
-      url = "https://github.com/linuxmint/cinnamon-screensaver/commit/8d658e7f313879579322dce666551f132795540b.patch";
-      sha256 = "sha256-HjVQSX2yYqgZVIio2I8GBWLYOddvaFiqZzf0zaYf+OE=";
-    })
-  ];
+  version = "5.4.2";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = pname;
     rev = version;
-    hash = "sha256-PpBtLAIboXMnX5V/u06aoZ6WfPrn4mdCu0NXTGb6pAE=";
+    hash = "sha256-GRa3ChUCL/AFDg1F01DNwkC4tmrNaOWoOXwFvwpvSck=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/cinnamon/cinnamon-settings-daemon/default.nix b/pkgs/desktops/cinnamon/cinnamon-settings-daemon/default.nix
index d4d05df8f558..ed947ee2b508 100644
--- a/pkgs/desktops/cinnamon/cinnamon-settings-daemon/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-settings-daemon/default.nix
@@ -21,7 +21,6 @@
 , polkit
 , librsvg
 , libwacom
-, xf86_input_wacom
 , xorg
 , fontconfig
 , tzdata
@@ -33,13 +32,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cinnamon-settings-daemon";
-  version = "5.4.3";
+  version = "5.4.5";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = pname;
     rev = version;
-    hash = "sha256-3ELsb0hH7GjMjwjsIg2m8k/EBCHIQGW3O7eDaqT2V7I=";
+    hash = "sha256-qjI1z1MuaI5JFqjHap/+aYDQ0YuP9VNnnY6vy/AaKqs=";
   };
 
   patches = [
@@ -65,11 +64,9 @@ stdenv.mkDerivation rec {
     polkit
     librsvg
     libwacom
-    xf86_input_wacom
     xorg.libXext
     xorg.libX11
     xorg.libXi
-    xorg.libXtst
     xorg.libXfixes
     fontconfig
     nss
diff --git a/pkgs/desktops/cinnamon/mint-themes/default.nix b/pkgs/desktops/cinnamon/mint-themes/default.nix
index db57de2aee07..bfb2d74e8ea9 100644
--- a/pkgs/desktops/cinnamon/mint-themes/default.nix
+++ b/pkgs/desktops/cinnamon/mint-themes/default.nix
@@ -8,14 +8,14 @@
 
 stdenv.mkDerivation rec {
   pname = "mint-themes";
-  version = "2.0.3";
+  version = "2.0.4";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = pname;
     # they don't exactly do tags, it's just a named commit
-    rev = "38b5606c3889a9a0bac0e2ab39196f675496982c";
-    hash = "sha256-Cc5p9WWLFPQ8K0CpL236LilAgBuO6HdfGt/rb0wiVpc=";
+    rev = "73d6cfea807ea84a645f43424c60916cb6214693";
+    hash = "sha256-WyEabE3K7xuBzXuLqJO0N4nxrc67bKT5YD9yn/bELl0=";
   };
 
   nativeBuildInputs = [
@@ -29,8 +29,10 @@ stdenv.mkDerivation rec {
   '';
 
   installPhase = ''
+    runHook preInstall
     mkdir -p $out
     mv usr/share $out
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/desktops/cinnamon/mint-y-icons/default.nix b/pkgs/desktops/cinnamon/mint-y-icons/default.nix
index 48df2b260ca7..212de9646223 100644
--- a/pkgs/desktops/cinnamon/mint-y-icons/default.nix
+++ b/pkgs/desktops/cinnamon/mint-y-icons/default.nix
@@ -9,14 +9,14 @@
 
 stdenv.mkDerivation rec {
   pname = "mint-y-icons";
-  version = "1.6.0";
+  version = "1.6.1";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = pname;
     # they don't exactly do tags, it's just a named commit
-    rev = "6294c4538a08a2a6c5fd68e223472d9c144ff8b0";
-    hash = "sha256-6tR3OFvU1ID61n4gr0R6pJyo3CjKvu8mgtXzMOINgq0=";
+    rev = "57d16eb85f2af40be17e2232d279bb65b689f5b7";
+    hash = "sha256-voFYz0MiuqyNSngi4QZUJKDIjggQWOAV5B30zMP8iTk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/desktops/cinnamon/muffin/default.nix b/pkgs/desktops/cinnamon/muffin/default.nix
index c7d803ed5aca..bf385a8186d8 100644
--- a/pkgs/desktops/cinnamon/muffin/default.nix
+++ b/pkgs/desktops/cinnamon/muffin/default.nix
@@ -35,7 +35,7 @@
 
 stdenv.mkDerivation rec {
   pname = "muffin";
-  version = "5.4.4";
+  version = "5.4.5";
 
   outputs = [ "out" "dev" "man" ];
 
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
     owner = "linuxmint";
     repo = pname;
     rev = version;
-    hash = "sha256-u3PNSyjxtPLFdA+2Iz+NuqlcQC9IwsFb7Tb5eVAJunY=";
+    hash = "sha256-gtki0MTIMI1JggtVn0dAhkq364hkTuH7Zf7CF32Lc8E=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/cinnamon/xviewer/default.nix b/pkgs/desktops/cinnamon/xviewer/default.nix
index c0dc50182c01..2c55f6140244 100644
--- a/pkgs/desktops/cinnamon/xviewer/default.nix
+++ b/pkgs/desktops/cinnamon/xviewer/default.nix
@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xviewer";
-  version = "3.2.9";
+  version = "3.2.10";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = pname;
     rev = version;
-    sha256 = "sha256-sDDQ/LGhHH13gRjVfpTyHYsYhelp80KNE75I8AlskoU=";
+    sha256 = "sha256-c3K9yjeaAlyXqgxzHgnLXgqwaB5Fdw+mS9jricy8QA8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/gnome/core/gnome-shell/default.nix b/pkgs/desktops/gnome/core/gnome-shell/default.nix
index cb7ba1ce5cf7..079e64ad3dde 100644
--- a/pkgs/desktops/gnome/core/gnome-shell/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-shell/default.nix
@@ -184,6 +184,7 @@ stdenv.mkDerivation rec {
 
     # We can generate it ourselves.
     rm -f man/gnome-shell.1
+    rm data/theme/gnome-shell.css
   '';
 
   preFixup = ''
diff --git a/pkgs/development/libraries/botan/2.0.nix b/pkgs/development/libraries/botan/2.0.nix
index 113c4a27b919..6987b6c35f0a 100644
--- a/pkgs/development/libraries/botan/2.0.nix
+++ b/pkgs/development/libraries/botan/2.0.nix
@@ -1,19 +1,10 @@
 { callPackage, fetchpatch, ... } @ args:
 
 callPackage ./generic.nix (args // {
-  baseVersion = "2.18";
-  revision = "1";
-  sha256 = "0adf53drhk1hlpfih0175c9081bqpclw6p2afn51cmx849ib9izq";
+  baseVersion = "2.19";
+  revision = "2";
+  sha256 = "sha256-OvXxdhXGtc2Lgy0mn7bLTVTsZPnrCd2/Gt1Qk5QbTXU=";
   postPatch = ''
     sed -e 's@lang_flags "@&--std=c++11 @' -i src/build-data/cc/{gcc,clang}.txt
   '';
-  extraPatches = [
-    (fetchpatch {
-      name = "CVE-2021-40529.patch";
-      url = "https://github.com/randombit/botan/commit/9a23e4e3bc3966340531f2ff608fa9d33b5185a2.patch";
-      sha256 = "1ax1n2l9zh0hk35vkkywgkhzpdk76xb9apz2wm3h9kjvjs9acr3y";
-      # our source tarball doesn't include the tests
-      excludes = [ "src/tests/*" ];
-    })
-  ];
 })
diff --git a/pkgs/development/libraries/botan/generic.nix b/pkgs/development/libraries/botan/generic.nix
index 1384bdee9add..3e5884c6c99a 100644
--- a/pkgs/development/libraries/botan/generic.nix
+++ b/pkgs/development/libraries/botan/generic.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, python3, bzip2, zlib, gmp, openssl, boost
+{ lib, stdenv, fetchurl, python3, bzip2, zlib, gmp, boost
 # Passed by version specific builders
 , baseVersion, revision, sha256
 , sourceExtension ? "tar.xz"
@@ -26,11 +26,11 @@ stdenv.mkDerivation rec {
   patches = extraPatches;
   inherit postPatch;
 
-  buildInputs = [ python3 bzip2 zlib gmp openssl boost ]
+  buildInputs = [ python3 bzip2 zlib gmp boost ]
     ++ lib.optionals stdenv.isDarwin [ CoreServices Security ];
 
   configurePhase = ''
-    python configure.py --prefix=$out --with-bzip2 --with-zlib ${if openssl != null then "--with-openssl" else ""} ${extraConfigureFlags}${if stdenv.cc.isClang then " --cc=clang" else "" }
+    python configure.py --prefix=$out --with-bzip2 --with-zlib ${extraConfigureFlags}${if stdenv.cc.isClang then " --cc=clang" else "" }
   '';
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/crc32c/default.nix b/pkgs/development/libraries/crc32c/default.nix
index 2ba0c4e65b8b..8790840c4c1d 100644
--- a/pkgs/development/libraries/crc32c/default.nix
+++ b/pkgs/development/libraries/crc32c/default.nix
@@ -28,6 +28,7 @@ stdenv.mkDerivation rec {
     "-DCRC32C_BUILD_TESTS=1"
     "-DCRC32C_BUILD_BENCHMARKS=0"
     "-DCRC32C_USE_GLOG=0"
+    "-DINSTALL_GTEST=0"
     "-DBUILD_SHARED_LIBS=${if staticOnly then "0" else "1"}"
   ];
 
@@ -42,20 +43,7 @@ stdenv.mkDerivation rec {
     runHook postInstallCheck
   '';
 
-  postInstallCheck = ''
-    # without removing these libraries, dependents will look for
-    # libgtest/libgmock etc here, which can result in link time errors
-    rm $out/lib/libg*
-  '';
-
   postFixup = ''
-    # dependents shouldn't be able to find gtest libraries as dependencies of
-    # this package
-    rm -r $out/lib/pkgconfig
-
-    # remove GTest cmake config files
-    rm -r $out/lib/cmake/GTest
-
     # fix bogus include paths
     for f in $(find $out/lib/cmake -name '*.cmake'); do
       substituteInPlace "$f" --replace "\''${_IMPORT_PREFIX}/$out/include" "\''${_IMPORT_PREFIX}/include"
diff --git a/pkgs/development/libraries/imgui/default.nix b/pkgs/development/libraries/imgui/default.nix
index 62f750db62c9..8a5191aa5aea 100644
--- a/pkgs/development/libraries/imgui/default.nix
+++ b/pkgs/development/libraries/imgui/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "imgui";
-  version = "1.87";
+  version = "1.88";
 
   src = fetchFromGitHub {
     owner = "ocornut";
     repo = "imgui";
     rev = "v${version}";
-    sha256 = "sha256-H5rqXZFw+2PfVMsYvAK+K+pxxI8HnUC0GlPhooWgEYM=";
+    sha256 = "sha256-scG47rRE2qZuYYkgDiA3xnxn/9kQlZLRMb/4UjoknI0=";
   };
 
   dontBuild = true;
diff --git a/pkgs/development/libraries/science/math/faiss/default.nix b/pkgs/development/libraries/science/math/faiss/default.nix
new file mode 100644
index 000000000000..f2d5e29f6a4a
--- /dev/null
+++ b/pkgs/development/libraries/science/math/faiss/default.nix
@@ -0,0 +1,123 @@
+{ lib
+, config
+, fetchFromGitHub
+, stdenv
+, cmake
+, cudaPackages
+, cudaSupport ? config.cudaSupport or false
+, cudaCapabilities ? [ "60" "70" "80" "86" ]
+, pythonSupport ? true
+, pythonPackages
+, blas
+, swig
+, addOpenGLRunpath
+, optLevel ? let
+    optLevels =
+      lib.optional stdenv.hostPlatform.avx2Support "avx2"
+      ++ lib.optional stdenv.hostPlatform.sse4_1Support "sse4"
+      ++ [ "generic" ];
+  in
+  # Choose the maximum available optimization level
+  builtins.head optLevels
+, faiss # To run demos in the tests
+, runCommand
+}:
+
+let
+  pname = "faiss";
+  version = "1.7.2";
+  inherit (cudaPackages) cudatoolkit;
+in
+stdenv.mkDerivation {
+  inherit pname version;
+
+  outputs = [ "out" "demos" ];
+
+  src = fetchFromGitHub {
+    owner = "facebookresearch";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-Tklf5AaqJbOs9qtBZVcxXPLAp+K54EViZLSOvEhmswg=";
+  };
+
+  buildInputs = [
+    blas
+    swig
+  ] ++ lib.optionals pythonSupport [
+    pythonPackages.setuptools
+    pythonPackages.pip
+    pythonPackages.wheel
+  ];
+
+  propagatedBuildInputs = lib.optionals pythonSupport [
+    pythonPackages.numpy
+  ];
+
+  nativeBuildInputs = [ cmake ] ++ lib.optionals cudaSupport [
+    cudatoolkit
+    addOpenGLRunpath
+  ] ++ lib.optional pythonSupport [
+    pythonPackages.python
+  ];
+
+  passthru.extra-requires.all = [
+    pythonPackages.numpy
+  ];
+
+  cmakeFlags = [
+    "-DFAISS_ENABLE_GPU=${if cudaSupport then "ON" else "OFF"}"
+    "-DFAISS_ENABLE_PYTHON=${if pythonSupport then "ON" else "OFF"}"
+    "-DFAISS_OPT_LEVEL=${optLevel}"
+  ] ++ lib.optionals cudaSupport [
+    "-DCMAKE_CUDA_ARCHITECTURES=${lib.concatStringsSep ";" cudaCapabilities}"
+  ];
+
+
+  # pip wheel->pip install commands copied over from opencv4
+
+  buildPhase = ''
+    make -j faiss
+    make demo_ivfpq_indexing
+  '' + lib.optionalString pythonSupport ''
+    make -j swigfaiss
+    (cd faiss/python &&
+     python -m pip wheel --verbose --no-index --no-deps --no-clean --no-build-isolation --wheel-dir dist .)
+  '';
+
+  installPhase = ''
+    make install
+    mkdir -p $demos/bin
+    cp ./demos/demo_ivfpq_indexing $demos/bin/
+  '' + lib.optionalString pythonSupport ''
+    mkdir -p $out/${pythonPackages.python.sitePackages}
+    (cd faiss/python && python -m pip install dist/*.whl --no-index --no-warn-script-location --prefix="$out" --no-cache)
+  '';
+
+  fixupPhase = lib.optionalString (pythonSupport && cudaSupport) ''
+    addOpenGLRunpath $out/${pythonPackages.python.sitePackages}/faiss/*.so
+    addOpenGLRunpath $demos/bin/*
+  '';
+
+  passthru = {
+    inherit cudaSupport cudaPackages pythonSupport;
+
+    tests = {
+      runDemos = runCommand "${pname}-run-demos"
+        { buildInputs = [ faiss.demos ]; }
+        # There are more demos, we run just the one that documentation mentions
+        ''
+          demo_ivfpq_indexing && touch $out
+        '';
+    } // lib.optionalAttrs pythonSupport {
+      pytest = pythonPackages.callPackage ./tests.nix { };
+    };
+  };
+
+  meta = with lib; {
+    description = "A library for efficient similarity search and clustering of dense vectors by Facebook Research";
+    homepage = "https://github.com/facebookresearch/faiss";
+    license = licenses.mit;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ SomeoneSerge ];
+  };
+}
diff --git a/pkgs/development/libraries/science/math/faiss/tests.nix b/pkgs/development/libraries/science/math/faiss/tests.nix
new file mode 100644
index 000000000000..fcf57a8bc9fd
--- /dev/null
+++ b/pkgs/development/libraries/science/math/faiss/tests.nix
@@ -0,0 +1,30 @@
+{ lib
+, buildPythonPackage
+, faiss
+, scipy
+, pytestCheckHook
+}:
+
+assert faiss.pythonSupport;
+
+buildPythonPackage {
+  pname = "faiss-pytest-suite";
+  inherit (faiss) version;
+
+  src = "${faiss.src}/tests";
+
+  dontBuild = true;
+  dontInstall = true;
+
+  # Tests that need GPUs and would fail in the sandbox
+  disabledTestPaths = lib.optionals faiss.cudaSupport [
+    "test_contrib.py"
+  ];
+
+  checkInputs = [
+    faiss
+    pytestCheckHook
+    scipy
+  ] ++
+  faiss.extra-requires.all;
+}
diff --git a/pkgs/development/python-modules/aardwolf/default.nix b/pkgs/development/python-modules/aardwolf/default.nix
new file mode 100644
index 000000000000..58d07696de20
--- /dev/null
+++ b/pkgs/development/python-modules/aardwolf/default.nix
@@ -0,0 +1,57 @@
+{ lib
+, arc4
+, asn1crypto
+, asn1tools
+, asysocks
+, buildPythonPackage
+, colorama
+, fetchPypi
+, minikerberos
+, pillow
+, pyperclip
+, pythonOlder
+, tqdm
+, unicrypto
+, winsspi
+}:
+
+buildPythonPackage rec {
+  pname = "aardwolf";
+  version = "0.0.8";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-plz1D+Lr5rV8iJo7IUmuXfjxLvVxX9lgyxyYXUlPH0k=";
+  };
+
+  propagatedBuildInputs = [
+    arc4
+    asn1crypto
+    asn1tools
+    asysocks
+    colorama
+    minikerberos
+    pillow
+    pyperclip
+    tqdm
+    unicrypto
+    winsspi
+  ];
+
+  # Module doesn't have tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "aardwolf"
+  ];
+
+  meta = with lib; {
+    description = "Asynchronous RDP protocol implementation";
+    homepage = "https://github.com/skelsec/aardwolf";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/aiobiketrax/default.nix b/pkgs/development/python-modules/aiobiketrax/default.nix
new file mode 100644
index 000000000000..41e96f26cc52
--- /dev/null
+++ b/pkgs/development/python-modules/aiobiketrax/default.nix
@@ -0,0 +1,53 @@
+{ lib
+, aiohttp
+, auth0-python
+, buildPythonPackage
+, fetchFromGitHub
+, poetry-core
+, pyjwt
+, pytest-aiohttp
+, pytestCheckHook
+, python-dateutil
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "aiobiketrax";
+  version = "0.2.0";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.9";
+
+  src = fetchFromGitHub {
+    owner = "basilfx";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-zaHetU0ZG3xkYrO6qA4o+NX8V5td/E08tPEohEwMjh0=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    aiohttp
+    auth0-python
+    python-dateutil
+    pyjwt
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "aiobiketrax"
+  ];
+
+  meta = with lib; {
+    description = "Library for interacting with the PowUnity BikeTrax GPS tracker";
+    homepage = "https://github.com/basilfx/aiobiketrax";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/aiomysensors/default.nix b/pkgs/development/python-modules/aiomysensors/default.nix
new file mode 100644
index 000000000000..dfa02c979433
--- /dev/null
+++ b/pkgs/development/python-modules/aiomysensors/default.nix
@@ -0,0 +1,64 @@
+{ lib
+, aiofiles
+, asyncio-mqtt
+, awesomeversion
+, buildPythonPackage
+, click
+, fetchFromGitHub
+, marshmallow
+, poetry-core
+, pyserial-asyncio
+, pytest-asyncio
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "aiomysensors";
+  version = "0.3.0";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.9";
+
+  src = fetchFromGitHub {
+    owner = "MartinHjelmare";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-EGVoHEJrpGtp8OrhQhRZVaN1GhL4QCo/azp6pzgYYcs=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    aiofiles
+    asyncio-mqtt
+    awesomeversion
+    click
+    marshmallow
+    pyserial-asyncio
+  ];
+
+  checkInputs = [
+    pytest-asyncio
+    pytestCheckHook
+  ];
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace " --cov=src --cov-report=term-missing:skip-covered" "" \
+      --replace 'marshmallow = "^3.17"' 'marshmallow = "*"'
+  '';
+
+  pythonImportsCheck = [
+    "aiomysensors"
+  ];
+
+  meta = with lib; {
+    description = "Library to connect to MySensors gateways";
+    homepage = "https://github.com/MartinHjelmare/aiomysensors";
+    license = with licenses; [ asl20 ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/aioopenexchangerates/default.nix b/pkgs/development/python-modules/aioopenexchangerates/default.nix
new file mode 100644
index 000000000000..18b6ae78b6f2
--- /dev/null
+++ b/pkgs/development/python-modules/aioopenexchangerates/default.nix
@@ -0,0 +1,57 @@
+{ lib
+, aiohttp
+, aioresponses
+, pydantic
+, buildPythonPackage
+, fetchFromGitHub
+, poetry-core
+, pytest-aiohttp
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "aioopenexchangerates";
+  version = "0.4.0";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.9";
+
+  src = fetchFromGitHub {
+    owner = "MartinHjelmare";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-qm9B4m5CLhfqnZj+sdHZ+iA0+YnDR9Dh3lCy/YADkEI=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    aiohttp
+    pydantic
+  ];
+
+  checkInputs = [
+    aioresponses
+    pytest-aiohttp
+    pytestCheckHook
+  ];
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace " --cov=aioopenexchangerates --cov-report=term-missing:skip-covered" ""
+  '';
+
+  pythonImportsCheck = [
+    "aioopenexchangerates"
+  ];
+
+  meta = with lib; {
+    description = "Library for the Openexchangerates API";
+    homepage = "https://github.com/MartinHjelmare/aioopenexchangerates";
+    license = with licenses; [ asl20 ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/aiortm/default.nix b/pkgs/development/python-modules/aiortm/default.nix
new file mode 100644
index 000000000000..83ed397e47d0
--- /dev/null
+++ b/pkgs/development/python-modules/aiortm/default.nix
@@ -0,0 +1,55 @@
+{ lib
+, aiohttp
+, buildPythonPackage
+, click
+, fetchFromGitHub
+, poetry-core
+, pytestCheckHook
+, pythonOlder
+, yarl
+}:
+
+buildPythonPackage rec {
+  pname = "aiortm";
+  version = "0.3.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.9";
+
+  src = fetchFromGitHub {
+    owner = "MartinHjelmare";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-DTFynPFf0NUBieXDiMKhCNwBqx3s/xzggNmnz/IKjbU=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    aiohttp
+    click
+    yarl
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace " --cov=aiortm --cov-report=term-missing:skip-covered" ""
+  '';
+
+  pythonImportsCheck = [
+    "aiortm"
+  ];
+
+  meta = with lib; {
+    description = "Library for the Remember the Milk API";
+    homepage = "https://github.com/MartinHjelmare/aiortm";
+    license = with licenses; [ asl20 ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/arc4/default.nix b/pkgs/development/python-modules/arc4/default.nix
new file mode 100644
index 000000000000..755950f3a1e0
--- /dev/null
+++ b/pkgs/development/python-modules/arc4/default.nix
@@ -0,0 +1,36 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "arc4";
+  version = "0.2.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "manicmaniac";
+    repo = pname;
+    rev = version;
+    hash = "sha256-1VgPYLyBQkxyuUO7KZv5sqYIEieV1RkBtlLVkLUUO4w=";
+  };
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "arc4"
+  ];
+
+  meta = with lib; {
+    description = "ARCFOUR (RC4) cipher implementation";
+    homepage = "https://github.com/manicmaniac/arc4";
+    license = with licenses; [ bsd3 ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/auth0-python/default.nix b/pkgs/development/python-modules/auth0-python/default.nix
index 7aa062be6c95..fe52973c2cd7 100644
--- a/pkgs/development/python-modules/auth0-python/default.nix
+++ b/pkgs/development/python-modules/auth0-python/default.nix
@@ -1,5 +1,8 @@
 { lib
+, aiohttp
+, aioresponses
 , buildPythonPackage
+, callee
 , fetchPypi
 , mock
 , pyjwt
@@ -17,7 +20,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-sXEWg6zrwMs8pCSloJtLL3o7ZAXTTiMXEgI7sDaogr4=";
+    hash = "sha256-sXEWg6zrwMs8pCSloJtLL3o7ZAXTTiMXEgI7sDaogr4=";
   };
 
   propagatedBuildInputs = [
@@ -26,12 +29,15 @@ buildPythonPackage rec {
   ];
 
   checkInputs = [
+    aiohttp
+    aioresponses
+    callee
     mock
     pytestCheckHook
   ];
 
   disabledTests = [
-    # tries to ping websites (e.g. google.com)
+    # Tries to ping websites (e.g. google.com)
     "can_timeout"
     "test_options_are_created_by_default"
     "test_options_are_used_and_override"
diff --git a/pkgs/development/python-modules/azure-mgmt-keyvault/default.nix b/pkgs/development/python-modules/azure-mgmt-keyvault/default.nix
index 200674d1a444..c0efa141785f 100644
--- a/pkgs/development/python-modules/azure-mgmt-keyvault/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-keyvault/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-keyvault";
-  version = "10.0.0";
+  version = "10.1.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    hash = "sha256-ALaVll2198a6DjOpzaHobE22N78Qe5koYYLxCtFiwaM=";
+    hash = "sha256-DpO+6FvsNwjjcz2ImhHpColHVNpPUMgCtEMrfUzfAaA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/galois/default.nix b/pkgs/development/python-modules/galois/default.nix
new file mode 100644
index 000000000000..b4d66188e312
--- /dev/null
+++ b/pkgs/development/python-modules/galois/default.nix
@@ -0,0 +1,51 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitHub
+, pytestCheckHook
+, pytest-xdist
+, numpy
+, numba
+, typing-extensions
+}:
+
+buildPythonPackage rec {
+  pname = "galois";
+  version = "0.0.32";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "mhostetter";
+    repo = "galois";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-+cxRLrfqk3N9pWKCVsTxruZwMYZ5dQyKJRnrb8y+ECM=";
+  };
+
+  propagatedBuildInputs = [
+    numpy
+    numba
+    typing-extensions
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+    pytest-xdist
+  ];
+
+  postPatch = ''
+     substituteInPlace setup.cfg \
+       --replace "numpy >= 1.18.4, < 1.23" "numpy >= 1.18.4"
+    '';
+
+  pythonImportsCheck = [ "galois" ];
+
+  meta = {
+    description = "A Python 3 package that extends NumPy arrays to operate over finite fields";
+    homepage = "https://github.com/mhostetter/galois";
+    downloadPage = "https://github.com/mhostetter/galois/releases";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ chrispattison ];
+  };
+}
diff --git a/pkgs/development/python-modules/pymicrobot/default.nix b/pkgs/development/python-modules/pymicrobot/default.nix
new file mode 100644
index 000000000000..00bdd859405f
--- /dev/null
+++ b/pkgs/development/python-modules/pymicrobot/default.nix
@@ -0,0 +1,40 @@
+{ lib
+, bleak
+, bleak-retry-connector
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "pymicrobot";
+  version = "0.0.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.9";
+
+  src = fetchPypi {
+    pname = "PyMicroBot";
+    inherit version;
+    hash = "sha256-I43a75jEU/jvjAEUBXeTZGGBy0pne1P3DA9Gbzy+c34=";
+  };
+
+  propagatedBuildInputs = [
+    bleak
+    bleak-retry-connector
+  ];
+
+  # Module has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "microbot"
+  ];
+
+  meta = with lib; {
+    description = "Library to communicate with MicroBot";
+    homepage = "https://github.com/spycle/pyMicroBot/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/pyunifiprotect/default.nix b/pkgs/development/python-modules/pyunifiprotect/default.nix
index f81c1197eb34..64fa2d5480ff 100644
--- a/pkgs/development/python-modules/pyunifiprotect/default.nix
+++ b/pkgs/development/python-modules/pyunifiprotect/default.nix
@@ -26,7 +26,7 @@
 
 buildPythonPackage rec {
   pname = "pyunifiprotect";
-  version = "4.0.12";
+  version = "4.1.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -35,7 +35,7 @@ buildPythonPackage rec {
     owner = "briis";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-xbODjgJHd1e3NdnoB/srlOdeuhOj2JeN8b8MQh3D4+A=";
+    hash = "sha256-ID3KSKPtgslS1Z+BZprMcTSQUnQbiHKgGQQipOSER9g=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/qingping-ble/default.nix b/pkgs/development/python-modules/qingping-ble/default.nix
new file mode 100644
index 000000000000..8cbc94a87cfc
--- /dev/null
+++ b/pkgs/development/python-modules/qingping-ble/default.nix
@@ -0,0 +1,53 @@
+{ lib
+, bluetooth-sensor-state-data
+, buildPythonPackage
+, fetchFromGitHub
+, poetry-core
+, pytestCheckHook
+, pythonOlder
+, sensor-state-data
+}:
+
+buildPythonPackage rec {
+  pname = "qingping-ble";
+  version = "0.2.3";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.9";
+
+  src = fetchFromGitHub {
+    owner = "bluetooth-devices";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-+iUZIsaSYgptHXtNSc9sJiBU8CUEFPDsLVGuFR5WvDw=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    bluetooth-sensor-state-data
+    sensor-state-data
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace " --cov=qingping_ble --cov-report=term-missing:skip-covered" ""
+  '';
+
+  pythonImportsCheck = [
+    "qingping_ble"
+  ];
+
+  meta = with lib; {
+    description = "Library for Qingping BLE devices";
+    homepage = "https://github.com/bluetooth-devices/qingping-ble";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/sensor-state-data/default.nix b/pkgs/development/python-modules/sensor-state-data/default.nix
index a29ad29a92c3..ab451315c532 100644
--- a/pkgs/development/python-modules/sensor-state-data/default.nix
+++ b/pkgs/development/python-modules/sensor-state-data/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "sensor-state-data";
-  version = "2.0.2";
+  version = "2.1.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-EywNH6REtopJoowsKQNNyJNYYyBR7L2pcrvmZAr5PZg=";
+    hash = "sha256-Z4sHrj0APoCfPhdSKB9guRrPo4TD47+GcQ0KoFgb268=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/yalexs-ble/default.nix b/pkgs/development/python-modules/yalexs-ble/default.nix
new file mode 100644
index 000000000000..7ca03ea43dbb
--- /dev/null
+++ b/pkgs/development/python-modules/yalexs-ble/default.nix
@@ -0,0 +1,59 @@
+{ lib
+, async-timeout
+, bleak
+, bleak-retry-connector
+, buildPythonPackage
+, fetchFromGitHub
+, poetry-core
+, pycryptodome
+, pytest-asyncio
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "yalexs-ble";
+  version = "1.1.3";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.9";
+
+  src = fetchFromGitHub {
+    owner = "bdraco";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-+0r0Zg3Ge4Mndro5hdTPAjbCBJhUac3LUbQ1BgBr8yE=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    async-timeout
+    bleak
+    bleak-retry-connector
+    pycryptodome
+  ];
+
+  checkInputs = [
+    pytest-asyncio
+    pytestCheckHook
+  ];
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace " --cov=yalexs_ble --cov-report=term-missing:skip-covered" ""
+  '';
+
+  pythonImportsCheck = [
+    "yalexs_ble"
+  ];
+
+  meta = with lib; {
+    description = "Library for Yale BLE devices";
+    homepage = "https://github.com/bdraco/yalexs-ble";
+    license = with licenses; [ gpl3Only ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/yappi/default.nix b/pkgs/development/python-modules/yappi/default.nix
index 2763055a0eb1..ed60315a8b11 100644
--- a/pkgs/development/python-modules/yappi/default.nix
+++ b/pkgs/development/python-modules/yappi/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "yappi";
-  version = "1.3.5";
+  version = "1.3.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "sumerc";
     repo = pname;
     rev = version;
-    hash = "sha256-XxUAYrDQAY7fD9yTSmoRUmWJEs+L6KSQ0/bIVf/o9ag=";
+    hash = "sha256-MfvaLWw7EhfzFx4aZdRWvQVOOcvZ1Mt7EgxyB2nDB2c=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/checkmate/default.nix b/pkgs/development/tools/checkmate/default.nix
index 1de648ffc917..c5587f741cb5 100644
--- a/pkgs/development/tools/checkmate/default.nix
+++ b/pkgs/development/tools/checkmate/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "checkmate";
-  version = "0.6.9";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "adedayo";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Zs8vyPD1BpjA5EXzeKyfv9CzhD0iIp1LNLlqCp+zpaY=";
+    sha256 = "sha256-tK9jPImB3rklMVQGI84bFaWsEdmVZKnWXxfzLZL9jQU=";
   };
 
-  vendorSha256 = "sha256-Wln6vf9FJ1VJgdll5a7QS+M6PCM151EB8aOb9fFkSXo=";
+  vendorSha256 = "sha256-w90f5b70qc9mgfMkhhloLJ7UWXboOLcZD6kUBluGGfk=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/development/tools/kubie/default.nix b/pkgs/development/tools/kubie/default.nix
index 0bf711a2293d..cc40249e7ccd 100644
--- a/pkgs/development/tools/kubie/default.nix
+++ b/pkgs/development/tools/kubie/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "kubie";
-  version = "0.16.0";
+  version = "0.17.1";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "sbstp";
     repo = "kubie";
-    sha256 = "sha256-loVGMkB3p+xx7xRHdeSOcck+2vhV461VdNgUIpb/3O0=";
+    sha256 = "sha256-rLebv1lw1zaq401dPK4GbisYkES3/5lIiReTBPvgoJo=";
   };
 
-  cargoSha256 = "sha256-BLKcuumF72MPL408+fUS+7MiTYjvSRORKNP2s0I7McI=";
+  cargoSha256 = "sha256-o1wnweT+wvZNnOT3ZNMJGuiZm7pkhZLssUuIfYeWnBc=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/pipenv/default.nix b/pkgs/development/tools/pipenv/default.nix
index 81c25fa235b2..77089d133afa 100644
--- a/pkgs/development/tools/pipenv/default.nix
+++ b/pkgs/development/tools/pipenv/default.nix
@@ -19,11 +19,11 @@ let
 
 in buildPythonApplication rec {
   pname = "pipenv";
-  version = "2022.6.7";
+  version = "2022.7.24";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-asDnqLvgKFnUbFPAPT8zE2u/ScjH2abYGECeF6YE7aA=";
+    sha256 = "sha256-N05jRQIg16uymMuu4GxLAidObxyyznt7Z3/V/T3TCEE=";
   };
 
   LC_ALL = "en_US.UTF-8";
diff --git a/pkgs/development/tools/railway/default.nix b/pkgs/development/tools/railway/default.nix
index 872f06b96a42..d5408e4527fd 100644
--- a/pkgs/development/tools/railway/default.nix
+++ b/pkgs/development/tools/railway/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "railway";
-  version = "2.0.0";
+  version = "2.0.8";
 
   src = fetchFromGitHub {
     owner = "railwayapp";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-0849Rm1QSMAJ2jVK0H8sA89bxI2nFDDTEsnSdXTuWTs=";
+    sha256 = "sha256-E6DCY+xM796pQb48xkVQ6d3qgIB528hbCU96SCu2eYI=";
   };
 
   ldflags = [ "-s" "-w" ];
diff --git a/pkgs/development/tools/revive/default.nix b/pkgs/development/tools/revive/default.nix
index 8ee80ec448c9..5b11a4c9d66e 100644
--- a/pkgs/development/tools/revive/default.nix
+++ b/pkgs/development/tools/revive/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "revive";
-  version = "1.2.2";
+  version = "1.2.3";
 
   src = fetchFromGitHub {
     owner = "mgechev";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-kHnRzjhrUPXgDTBu95Ytrhx5lO5ogm9PMzeANfLcWHQ=";
+    sha256 = "sha256-g19YrO8qTWsZmDngaDfiKVXP9aCaUbEO7Ac9Ir9KE14=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -35,7 +35,7 @@ buildGoModule rec {
 
   # The following tests fail when built by nix:
   #
-  # $ nix log /nix/store/build-revive.1.2.2.drv | grep FAIL
+  # $ nix log /nix/store/build-revive.1.2.3.drv | grep FAIL
   #
   # --- FAIL: TestAll (0.01s)
   # --- FAIL: TestTimeEqual (0.00s)
diff --git a/pkgs/development/web/flyctl/default.nix b/pkgs/development/web/flyctl/default.nix
index 88acc5e1c154..b5ed8f683f26 100644
--- a/pkgs/development/web/flyctl/default.nix
+++ b/pkgs/development/web/flyctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "flyctl";
-  version = "0.0.363";
+  version = "0.0.366";
 
   src = fetchFromGitHub {
     owner = "superfly";
     repo = "flyctl";
     rev = "v${version}";
-    sha256 = "sha256-Cyc5Kah62a7HJo55lgsplbnG87ttXkkWj/qo9EdSads=";
+    sha256 = "sha256-JtWm96a6CNOhbS0Vtw/0RJ9l/bdn0mSrEa7wLjh+O6Q=";
   };
 
-  vendorSha256 = "sha256-NVLZEv5ySV3xwgTL8w3I4CZvrriADKKugt3q3IJKRf4=";
+  vendorSha256 = "sha256-Osih5S5Z2jfh47Wae+vod/j0gN2FXDX7deo0/yt/wwk=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/games/fheroes2/default.nix b/pkgs/games/fheroes2/default.nix
index f22c16241908..83c856359af6 100644
--- a/pkgs/games/fheroes2/default.nix
+++ b/pkgs/games/fheroes2/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fheroes2";
-  version = "0.9.17";
+  version = "0.9.18";
 
   src = fetchFromGitHub {
     owner = "ihhub";
     repo = "fheroes2";
     rev = version;
-    sha256 = "sha256-mitkB7BDqqDbWa+zhcg66dh/SQd6XuUjl/kLWob9zwI=";
+    sha256 = "sha256-I79PoNE6GFvYD4jnsxKo7MsoPgVow8b8fTIiClOGnAI=";
   };
 
   buildInputs = [ gettext libpng SDL2 SDL2_image SDL2_mixer SDL2_ttf zlib ];
diff --git a/pkgs/os-specific/darwin/sketchybar/default.nix b/pkgs/os-specific/darwin/sketchybar/default.nix
index a870adf35310..4f089c7be3e1 100644
--- a/pkgs/os-specific/darwin/sketchybar/default.nix
+++ b/pkgs/os-specific/darwin/sketchybar/default.nix
@@ -10,13 +10,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "sketchybar";
-  version = "2.7.1";
+  version = "2.8.2";
 
   src = fetchFromGitHub {
     owner = "FelixKratz";
     repo = "SketchyBar";
     rev = "v${version}";
-    sha256 = "sha256-JzZ7X/McWIui9nkSkSGTSdBvJvMics/j7Qqh9wZU7iM=";
+    sha256 = "sha256-GmM+0h6xxUzW2kpTDZWAiqJAXoQgdsJRlNbvsuxKmZ8=";
   };
 
   buildInputs = [ Carbon Cocoa SkyLight ]
diff --git a/pkgs/servers/consul/default.nix b/pkgs/servers/consul/default.nix
index d6545756b57c..7d69103282f5 100644
--- a/pkgs/servers/consul/default.nix
+++ b/pkgs/servers/consul/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "consul";
-  version = "1.12.3";
+  version = "1.13.0";
   rev = "v${version}";
 
   # Note: Currently only release tags are supported, because they have the Consul UI
@@ -17,7 +17,7 @@ buildGoModule rec {
     owner = "hashicorp";
     repo = pname;
     inherit rev;
-    sha256 = "sha256-QCSlRGbYCOOS81M7sl8Skr1/DhEX+U+0dCroWydzifw=";
+    sha256 = "sha256-bPLVQ5XvOk6cWtjHNtvZ3McM2SKVbjY6280rIldInpQ=";
   };
 
   passthru.tests.consul = nixosTests.consul;
@@ -26,7 +26,7 @@ buildGoModule rec {
   # has a split module structure in one repo
   subPackages = ["." "connect/certgen"];
 
-  vendorSha256 = "sha256-3WjmAbY7AVApZZXdCfbjr2X9I8vvwR2EfNmCJv9Gk6A=";
+  vendorSha256 = "sha256-bPfS8hoH45ad34CsR+9WLEDCDsx1E/ZKdipVZqirfDY=";
 
   doCheck = false;
 
diff --git a/pkgs/servers/http/lighttpd/default.nix b/pkgs/servers/http/lighttpd/default.nix
index 4892870ab0d5..2885676279dc 100644
--- a/pkgs/servers/http/lighttpd/default.nix
+++ b/pkgs/servers/http/lighttpd/default.nix
@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation rec {
   pname = "lighttpd";
-  version = "1.4.65";
+  version = "1.4.66";
 
   src = fetchurl {
     url = "https://download.lighttpd.net/lighttpd/releases-${lib.versions.majorMinor version}.x/${pname}-${version}.tar.xz";
-    sha256 = "sha256-vw+mimKfvEBAI6kSs3fnAEkzHWeXvLtLPo30w7QjKL4=";
+    sha256 = "sha256-R6xuYCcaoBluZUctAtAZVW3HxtCd87Zd8sGraGY0jjs=";
   };
 
   postPatch = ''
diff --git a/pkgs/servers/minio/default.nix b/pkgs/servers/minio/default.nix
index a5ca366e2e10..9340dc24fc24 100644
--- a/pkgs/servers/minio/default.nix
+++ b/pkgs/servers/minio/default.nix
@@ -15,16 +15,16 @@ let
 in
 buildGoModule rec {
   pname = "minio";
-  version = "2022-07-30T05-21-40Z";
+  version = "2022-08-08T18-34-09Z";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "minio";
     rev = "RELEASE.${version}";
-    sha256 = "sha256-yPysciKr8sn+TykQ+rupxAF3LLj8g4HOzjUaUTatjBk=";
+    sha256 = "sha256-HuKfpQY6dllxkrictCMBczHTg2oCLQtZrJQqPG2l6N8=";
   };
 
-  vendorSha256 = "sha256-xNxAR6cAvIhOZZ+dnIgEqkmtE70endU80TDWMFDBWo8=";
+  vendorSha256 = "sha256-uoavsixaLQg0gL70m4ea5fgH5R06YyIZHy1oxDSA0ko=";
 
   doCheck = false;
 
diff --git a/pkgs/servers/nextcloud/default.nix b/pkgs/servers/nextcloud/default.nix
index 928545a8d8d7..2ac4be1af503 100644
--- a/pkgs/servers/nextcloud/default.nix
+++ b/pkgs/servers/nextcloud/default.nix
@@ -46,13 +46,13 @@ in {
   '';
 
   nextcloud23 = generic {
-    version = "23.0.7";
-    sha256 = "89a53d3447d1dcb7ea382d18accf52223040336d08899f0b7568c6dd8a36cd50";
+    version = "23.0.8";
+    sha256 = "ac3d042253399be25a2aa01c799dec75a1459b6ae453874414f6528cc2ee5061";
   };
 
   nextcloud24 = generic {
-    version = "24.0.3";
-    sha256 = "320c81f9b902922b4bcef3eacf858596a14347fd45bddd26dac198562d212439";
+    version = "24.0.4";
+    sha256 = "d107426f8e1c193db882a04c844f9bc7e7eeb7c21e46c46197e5154d6d6ac28e";
   };
 
   # tip: get the sha with:
diff --git a/pkgs/tools/misc/goaccess/default.nix b/pkgs/tools/misc/goaccess/default.nix
index 20942f4e3c9c..c2d422fe9afb 100644
--- a/pkgs/tools/misc/goaccess/default.nix
+++ b/pkgs/tools/misc/goaccess/default.nix
@@ -10,14 +10,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.6";
+  version = "1.6.2";
   pname = "goaccess";
 
   src = fetchFromGitHub {
     owner = "allinurl";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-+42jTYYJyj+6ZRCfkgVwpyTS2lXdThlGHKD2iSoZkEI=";
+    sha256 = "sha256-Ie+66zfw11dzUgAHSRtJA09nWSSvyHZ0ygkVL4aZO14=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/misc/opentelemetry-collector/default.nix b/pkgs/tools/misc/opentelemetry-collector/default.nix
index 03d90509f952..a32512157cfc 100644
--- a/pkgs/tools/misc/opentelemetry-collector/default.nix
+++ b/pkgs/tools/misc/opentelemetry-collector/default.nix
@@ -12,17 +12,17 @@ let
 in
 buildGoModule rec {
   pname = "opentelemetry-collector";
-  version = "0.57.2";
+  version = "0.58.0";
 
   src = fetchFromGitHub {
     owner = "open-telemetry";
     repo = "opentelemetry-collector";
     rev = "v${version}";
-    sha256 = "sha256-5Bjo70OcUHRToazCe0nUDI6e9c4ES5ufNO4T0P5ukdU=";
+    sha256 = "sha256-qWRuVzRFuUBfnBkc6KDWTkPahk980KLdRqUnPbKJjpU=";
   };
   # there is a nested go.mod
   sourceRoot = "source/cmd/otelcorecol";
-  vendorSha256 = "sha256-ZsKVHmW8kpABzoecNuldxwn8FTMH74b1VDuZcnXhTpY=";
+  vendorSha256 = "sha256-iK4oXNZe4/4/Yh9/Rq3St9MmeqEq6bVu8sTh4rdMi0c=";
 
   preBuild = ''
     # set the build version, can't be done via ldflags
diff --git a/pkgs/tools/misc/plowshare/default.nix b/pkgs/tools/misc/plowshare/default.nix
index 1d15db020407..b5396f130f1d 100644
--- a/pkgs/tools/misc/plowshare/default.nix
+++ b/pkgs/tools/misc/plowshare/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, makeWrapper, curl, recode, spidermonkey_78 }:
+{ lib, stdenv, fetchFromGitHub, makeWrapper, curl, recode, spidermonkey_102 }:
 
 stdenv.mkDerivation rec {
 
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     make PREFIX="$out" install
 
     for fn in plow{del,down,list,mod,probe,up}; do
-      wrapProgram "$out/bin/$fn" --prefix PATH : "${lib.makeBinPath [ curl recode spidermonkey_78 ]}"
+      wrapProgram "$out/bin/$fn" --prefix PATH : "${lib.makeBinPath [ curl recode spidermonkey_102 ]}"
     done
   '';
 
diff --git a/pkgs/tools/misc/pubs/default.nix b/pkgs/tools/misc/pubs/default.nix
index 04021e40b74d..81cb81829a42 100644
--- a/pkgs/tools/misc/pubs/default.nix
+++ b/pkgs/tools/misc/pubs/default.nix
@@ -1,5 +1,6 @@
 { lib
 , fetchFromGitHub
+, fetchpatch
 , python3
 }:
 
@@ -14,6 +15,19 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-U/9MLqfXrzYVGttFSafw4pYDy26WgdsJMCxciZzO1pw=";
   };
 
+  patches = [
+    # https://github.com/pubs/pubs/pull/278
+    (fetchpatch {
+      url = "https://github.com/pubs/pubs/commit/9623d2c3ca8ff6d2bb7f6c8d8624f9a174d831bc.patch";
+      hash = "sha256-6qoufKPv3k6C9BQTZ2/175Nk7zWPh89vG+zebx6ZFOk=";
+    })
+    # https://github.com/pubs/pubs/pull/279
+    (fetchpatch {
+      url = "https://github.com/pubs/pubs/commit/05e214eb406447196c77c8aa3e4658f70e505f23.patch";
+      hash = "sha256-UBkKiYaG6y6z8lsRpdcsaGsoklv6qj07KWdfkQcVl2g=";
+    })
+  ];
+
   propagatedBuildInputs = with python3.pkgs; [
     pyyaml
     bibtexparser
diff --git a/pkgs/tools/misc/topicctl/default.nix b/pkgs/tools/misc/topicctl/default.nix
index 99e49185cb06..926b27c905d1 100644
--- a/pkgs/tools/misc/topicctl/default.nix
+++ b/pkgs/tools/misc/topicctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "topicctl";
-  version = "1.4.0";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "segmentio";
     repo = "topicctl";
     rev = "v${version}";
-    sha256 = "sha256-uuASiJXyYzQC+9TkoALKiygRrgoEeR2cFPDQeZ9pIQ4=";
+    sha256 = "sha256-7dw1UldffSCoJYhICb7v7XWQdXerSkrKonNNio0PkTQ=";
   };
 
-  vendorSha256 = "sha256-u5U6JnlkQOjzKjbwdKgJ2YAh8//x7H/F3PC/H60boZc=";
+  vendorSha256 = "sha256-P3o4P6CUDB0jIpmgxgYL7D6TJuaWQBCprsE4NLTLELY=";
 
   ldflags = [
     "-X main.BuildVersion=${version}"
diff --git a/pkgs/tools/networking/minio-client/default.nix b/pkgs/tools/networking/minio-client/default.nix
index e3e4ea1cb5a6..e01cddab88b7 100644
--- a/pkgs/tools/networking/minio-client/default.nix
+++ b/pkgs/tools/networking/minio-client/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "minio-client";
-  version = "2022-07-29T19-17-16Z";
+  version = "2022-08-05T08-01-28Z";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "mc";
     rev = "RELEASE.${version}";
-    sha256 = "sha256-yl8+lmhEdcFB8EASnmi9g9B+0vFKDX5wULMgj9oj4kQ=";
+    sha256 = "sha256-XtRpRp5KtqM+VwaouzbcjoiwuUDo4NtgaQ/bsCmwP58=";
   };
 
-  vendorSha256 = "sha256-I0JVLaNTxWq0hqM0ureyZHZE64DgfYR6sjj2q9xcsV8=";
+  vendorSha256 = "sha256-0WljjAgL//PqooHwAusMQwJpLRYzjpDUNcrmCHUGyNs=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/tools/security/crackmapexec/default.nix b/pkgs/tools/security/crackmapexec/default.nix
index f88563498b23..9646f3a7caf2 100644
--- a/pkgs/tools/security/crackmapexec/default.nix
+++ b/pkgs/tools/security/crackmapexec/default.nix
@@ -1,19 +1,18 @@
 { lib
 , fetchFromGitHub
-, fetchpatch
 , python3
 }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "crackmapexec";
-  version = "5.2.2";
+  version = "5.3.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "byt3bl33d3r";
     repo = "CrackMapExec";
     rev = "v${version}";
-    hash = "sha256-IgD8RjwVEoEXmnHU3DR3wzUdJDWIbFw9sES5qYg30a8=";
+    hash = "sha256-wPS1PCvR9Ffp0r9lZZkFATt+i+eR5ap16HzLWDZbJKI=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
@@ -23,6 +22,7 @@ python3.pkgs.buildPythonApplication rec {
 
   propagatedBuildInputs = with python3.pkgs; [
     aioconsole
+    aardwolf
     beautifulsoup4
     dsinternals
     impacket
@@ -40,21 +40,13 @@ python3.pkgs.buildPythonApplication rec {
     xmltodict
   ];
 
-  patches = [
-    # Switch to poetry-core, https://github.com/byt3bl33d3r/CrackMapExec/pull/580
-    (fetchpatch {
-      name = "switch-to-poetry-core.patch";
-      url = "https://github.com/byt3bl33d3r/CrackMapExec/commit/e5c6c2b5c7110035b34ea7a080defa6d42d21dd4.patch";
-      hash = "sha256-5SpoQD+uSYLM6Rdq0/NTbyEv4RsBUuawNNsknS71I9M=";
-    })
-  ];
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace '{ git = "https://github.com/mpgn/impacket.git", branch = "master" }' '"x"'
+  '';
 
   pythonRelaxDeps = true;
 
-  pythonRemoveDeps = [
-    "bs4"
-  ];
-
   # Project has no tests
   doCheck = false;
 
diff --git a/pkgs/tools/security/cryptomator/default.nix b/pkgs/tools/security/cryptomator/default.nix
index edb7fe29f1cf..19387045e736 100644
--- a/pkgs/tools/security/cryptomator/default.nix
+++ b/pkgs/tools/security/cryptomator/default.nix
@@ -6,13 +6,13 @@
 
 let
   pname = "cryptomator";
-  version = "1.6.12";
+  version = "1.6.13";
 
   src = fetchFromGitHub {
     owner = "cryptomator";
     repo = "cryptomator";
     rev = version;
-    sha256 = "sha256-+iNXQpzvZ51LJ3WsePVQXaLmUhvaw52Fp7bkUDdVijw=";
+    sha256 = "sha256-xQxCSWbovdecTFWFDFu2K+lbA6+bSV2l2kk+R/hFcQ0=";
   };
 
   # perform fake build to make a fixed-output derivation out of the files downloaded from maven central (120MB)
diff --git a/pkgs/tools/security/kube-bench/default.nix b/pkgs/tools/security/kube-bench/default.nix
new file mode 100644
index 000000000000..e95ff1a05477
--- /dev/null
+++ b/pkgs/tools/security/kube-bench/default.nix
@@ -0,0 +1,48 @@
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
+
+buildGoModule rec {
+  pname = "kube-bench";
+  version = "0.6.8";
+
+  src = fetchFromGitHub {
+    owner = "aquasecurity";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-uqjF2WtsGMzA/JDS93BSQNuBJorMIJha9qPHJkIbjQo=";
+  };
+  vendorSha256 = "sha256-/LSgIfLBsGRSyz9gExgLKAjO+RF/C8CkxSvwx2jZjoI=";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/aquasecurity/kube-bench/cmd.KubeBenchVersion=v${version}"
+  ];
+
+  postInstall = ''
+    mkdir -p $out/share/kube-bench/
+    mv ./cfg $out/share/kube-bench/
+
+    installShellCompletion --cmd kube-bench \
+      --bash <($out/bin/kube-bench completion bash) \
+      --fish <($out/bin/kube-bench completion fish) \
+      --zsh <($out/bin/kube-bench completion zsh)
+  '';
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
+    $out/bin/kube-bench --help
+    $out/bin/kube-bench version | grep "v${version}"
+    runHook postInstallCheck
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/aquasecurity/kube-bench";
+    changelog = "https://github.com/aquasecurity/kube-bench/releases/tag/v${version}";
+    description = "Checks whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ jk ];
+  };
+}
diff --git a/pkgs/tools/security/metasploit/Gemfile b/pkgs/tools/security/metasploit/Gemfile
index 290ca81b8c9a..176a9c231b9f 100644
--- a/pkgs/tools/security/metasploit/Gemfile
+++ b/pkgs/tools/security/metasploit/Gemfile
@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 source "https://rubygems.org"
 
-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.2.10"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.2.11"
diff --git a/pkgs/tools/security/metasploit/Gemfile.lock b/pkgs/tools/security/metasploit/Gemfile.lock
index 1baf8dc6c7e0..eb7bd292a0f6 100644
--- a/pkgs/tools/security/metasploit/Gemfile.lock
+++ b/pkgs/tools/security/metasploit/Gemfile.lock
@@ -1,9 +1,9 @@
 GIT
   remote: https://github.com/rapid7/metasploit-framework
-  revision: 67b884984178ba348249dd4374b809e4b6f12a90
-  ref: refs/tags/6.2.10
+  revision: addeeea49e5217ade1407a2e9a3cf6514ad8972e
+  ref: refs/tags/6.2.11
   specs:
-    metasploit-framework (6.2.10)
+    metasploit-framework (6.2.11)
       actionpack (~> 6.0)
       activerecord (~> 6.0)
       activesupport (~> 6.0)
@@ -130,8 +130,8 @@ GEM
     arel-helpers (2.14.0)
       activerecord (>= 3.1.0, < 8)
     aws-eventstream (1.2.0)
-    aws-partitions (1.614.0)
-    aws-sdk-core (3.131.5)
+    aws-partitions (1.616.0)
+    aws-sdk-core (3.132.0)
       aws-eventstream (~> 1, >= 1.0.2)
       aws-partitions (~> 1, >= 1.525.0)
       aws-sigv4 (~> 1.1)
@@ -178,10 +178,10 @@ GEM
     eventmachine (1.2.7)
     faker (2.22.0)
       i18n (>= 1.8.11, < 2)
-    faraday (2.4.0)
-      faraday-net_http (~> 2.0)
+    faraday (2.5.1)
+      faraday-net_http (>= 2.0, < 3.1)
       ruby2_keywords (>= 0.0.4)
-    faraday-net_http (2.1.0)
+    faraday-net_http (3.0.0)
     faraday-retry (2.0.0)
       faraday (~> 2.0)
     faye-websocket (0.11.1)
@@ -290,7 +290,7 @@ GEM
       hashery (~> 2.0)
       ruby-rc4
       ttfunk
-    pg (1.4.2)
+    pg (1.4.3)
     public_suffix (4.0.7)
     puma (5.6.4)
       nio4r (~> 2.0)
@@ -363,7 +363,7 @@ GEM
       rex-socket
       rex-text
     rex-struct2 (0.1.3)
-    rex-text (0.2.38)
+    rex-text (0.2.39)
     rex-zip (0.1.4)
       rex-text
     rexml (3.2.5)
diff --git a/pkgs/tools/security/metasploit/default.nix b/pkgs/tools/security/metasploit/default.nix
index 186aec8961bb..9cbe1ff2ff3b 100644
--- a/pkgs/tools/security/metasploit/default.nix
+++ b/pkgs/tools/security/metasploit/default.nix
@@ -15,13 +15,13 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "metasploit-framework";
-  version = "6.2.10";
+  version = "6.2.11";
 
   src = fetchFromGitHub {
     owner = "rapid7";
     repo = "metasploit-framework";
     rev = version;
-    sha256 = "sha256-POUwkmYnhr7laic59bBF+VdZW1vB488u0yCqsHkc6QM=";
+    sha256 = "sha256-MdSAJc0H+UU5pr6OzUNOaZDE3d0MdRQyZS2Ear2Wv9k=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/security/metasploit/gemset.nix b/pkgs/tools/security/metasploit/gemset.nix
index 299f695e38c7..078640cb9e38 100644
--- a/pkgs/tools/security/metasploit/gemset.nix
+++ b/pkgs/tools/security/metasploit/gemset.nix
@@ -104,20 +104,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0x5nqb4hppcfva0h0sjdjq1ipiwbng6d1jghb853i8q8q56sm20y";
+      sha256 = "1bz5wb377xnp4hs13sf4sxalfn2ycxfry1g5lfwixzvwhhbim5x1";
       type = "gem";
     };
-    version = "1.614.0";
+    version = "1.616.0";
   };
   aws-sdk-core = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1zjlmk1mxw25rbsg8hx5c621a7q444rjmqv1gdywgckn0mydlw8g";
+      sha256 = "0lal5x2qkz6ip36ladynb29j65brq8bbdcgx6cwbybsyadwcf693";
       type = "gem";
     };
-    version = "3.131.5";
+    version = "3.132.0";
   };
   aws-sdk-ec2 = {
     groups = ["default"];
@@ -354,20 +354,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0i45f90mg367izgpxf6rrq9zbwwqba1pymwyja6q128vrj1pjajj";
+      sha256 = "1jf9gfr2viracxm0nzd2mzs07j2ilznj7w3awyrr2wm53b56pc3h";
       type = "gem";
     };
-    version = "2.4.0";
+    version = "2.5.1";
   };
   faraday-net_http = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1rfiwhggrqgwp00c82sk8v2h93l81nxgl0mf07pijxz1zjmbgswj";
+      sha256 = "0yicplzlh5da8pr64286zga3my86cjsb2y9dqlzsacpw8hbkmjvw";
       type = "gem";
     };
-    version = "2.1.0";
+    version = "3.0.0";
   };
   faraday-retry = {
     groups = ["default"];
@@ -614,12 +614,12 @@
     platforms = [];
     source = {
       fetchSubmodules = false;
-      rev = "67b884984178ba348249dd4374b809e4b6f12a90";
-      sha256 = "00z93iwv1ai0scpczqy1bddmjmzr8nqgaf97dbjvx1i7cs931r9w";
+      rev = "addeeea49e5217ade1407a2e9a3cf6514ad8972e";
+      sha256 = "1ndzjsynm11dclr18x8cvpfw94399r1wv3mylqwlby87rljq1m1i";
       type = "git";
       url = "https://github.com/rapid7/metasploit-framework";
     };
-    version = "6.2.10";
+    version = "6.2.11";
   };
   metasploit-model = {
     groups = ["default"];
@@ -917,10 +917,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1mjy37q5pmfhj5ygsfjpskdqjba1l6iss8v9ydi8zdwlic7w3vzs";
+      sha256 = "1ypj64nhq3grs9zh40vmyfyhmxlhljjsbg5q0jxhlxg5v76ij0mb";
       type = "gem";
     };
-    version = "1.4.2";
+    version = "1.4.3";
   };
   public_suffix = {
     groups = ["default"];
@@ -1227,10 +1227,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "10jxl3p3ndhb5cfj5y5qbiv82d3zn9wn0sr8q32cqlib4wnwx254";
+      sha256 = "0za2rihc8d1hr4g5gqabpdd19npah0mmh93wylrh503hiwq7ljsv";
       type = "gem";
     };
-    version = "0.2.38";
+    version = "0.2.39";
   };
   rex-zip = {
     groups = ["default"];
diff --git a/pkgs/tools/security/semgrep/common.nix b/pkgs/tools/security/semgrep/common.nix
index bd1bf690e5ff..2c4a377efab6 100644
--- a/pkgs/tools/security/semgrep/common.nix
+++ b/pkgs/tools/security/semgrep/common.nix
@@ -1,13 +1,13 @@
-{ lib, fetchFromGitHub, fetchzip }:
+{ lib, fetchFromGitHub, fetchzip, stdenv }:
 
 rec {
-  version = "0.106.0";
+  version = "0.108.0";
 
   src = fetchFromGitHub {
     owner = "returntocorp";
     repo = "semgrep";
     rev = "v${version}";
-    sha256 = "sha256-/L8w8imvfjO3ICe0FBhfVrTivK58/9Y+j9Hc71tlpjA=";
+    sha256 = "sha256-Vdrv7lVPsBsxkwwfviD5zRAdsD02RfWmM+IlaThduQs=";
   };
 
   # submodule dependencies
@@ -24,15 +24,18 @@ rec {
   interfacesSrc = fetchFromGitHub {
     owner = "returntocorp";
     repo = "semgrep-interfaces";
-    rev = "8bc79b2bca62c051e46a33fb65751357a71b87b6";
-    sha256 = "sha256-k/rsTGYqHnw/4bsmeg7pQ/ckNglvuA0yhuz+OayXCdw=";
+    rev = "bad298d06a5dc50e69b6818ba73f0cc9b9a17b58";
+    sha256 = "sha256-AgNSvjVsP4b4zwkmq6BoNcOX3xdCSnQmXK+fVSkDXxQ=";
   };
 
   # fetch pre-built semgrep-core since the ocaml build is complex and relies on
   # the opam package manager at some point
-  coreRelease = fetchzip {
-    url = "https://github.com/returntocorp/semgrep/releases/download/v${version}/semgrep-v${version}-ubuntu-16.04.tgz";
-    sha256 = "sha256-ARf776uOJkCBGsJI8ul3IDWI24vFQxs2jlGEA6uXG+o=";
+  coreRelease = if stdenv.isDarwin then fetchzip {
+      url = "https://github.com/returntocorp/semgrep/releases/download/v${version}/semgrep-v${version}-osx.zip";
+      sha256 = "sha256-f3ah4yGvtUL3Ievz+3hhh5Am1YMplRxsRQzdRAoF9uU=";
+  } else fetchzip {
+      url = "https://github.com/returntocorp/semgrep/releases/download/v${version}/semgrep-v${version}-ubuntu-16.04.tgz";
+      sha256 = "sha256-qie9svlzRoAsI33W+Sxh4YTVk1iPV0NVXfzfKlEUul4=";
   };
 
   meta = with lib; {
@@ -50,6 +53,6 @@ rec {
     license = licenses.lgpl21Plus;
     maintainers = with maintainers; [ jk ambroisie ];
     # limited by semgrep-core
-    platforms = [ "x86_64-linux" ];
+    platforms = [ "x86_64-linux" "x86_64-darwin" ];
   };
 }
diff --git a/pkgs/tools/security/tlsx/default.nix b/pkgs/tools/security/tlsx/default.nix
new file mode 100644
index 000000000000..c616e86d793b
--- /dev/null
+++ b/pkgs/tools/security/tlsx/default.nix
@@ -0,0 +1,29 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "tlsx";
+  version = "0.0.5";
+
+  src = fetchFromGitHub {
+    owner = "projectdiscovery";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-zUaCUi7U757A8OVQHQV2LPVqu4o73qrp2xGrH7u2viA=";
+  };
+
+  vendorSha256 = "sha256-+pSmErlxRyDH1drri294vE+hUmlmKgh3zrKpVJVC1do=";
+
+  meta = with lib; {
+    description = "TLS grabber focused on TLS based data collection";
+    longDescription = ''
+      A fast and configurable TLS grabber focused on TLS based data
+      collection and analysis.
+    '';
+    homepage = "https://github.com/projectdiscovery/tlsx";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/tools/text/jsawk/default.nix b/pkgs/tools/text/jsawk/default.nix
index 4efaf56ccf69..2f21900b8d01 100644
--- a/pkgs/tools/text/jsawk/default.nix
+++ b/pkgs/tools/text/jsawk/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, makeWrapper, spidermonkey_78 }:
+{ lib, stdenv, fetchFromGitHub, makeWrapper, spidermonkey_102 }:
 
 stdenv.mkDerivation {
   pname = "jsawk";
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
     mkdir -p $out/bin
     cp $src/jsawk $out/bin/
     wrapProgram $out/bin/jsawk \
-      --prefix PATH : "${spidermonkey_78}/bin"
+      --prefix PATH : "${spidermonkey_102}/bin"
   '';
 
   meta = {
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 6da2a56a64d0..e3ae2233345f 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4720,7 +4720,7 @@ with pkgs;
 
   bdsync = callPackage ../tools/backup/bdsync { };
 
-  beamerpresenter = libsForQt5.callPackage ../applications/office/beamerpresenter { };
+  beamerpresenter = qt6Packages.callPackage ../applications/office/beamerpresenter { };
 
   beanstalkd = callPackage ../servers/beanstalkd { };
 
@@ -11334,6 +11334,8 @@ with pkgs;
 
   tlspool = callPackage ../tools/networking/tlspool { };
 
+  tlsx = callPackage ../tools/security/tlsx { };
+
   tmate = callPackage ../tools/misc/tmate { };
 
   tmate-ssh-server = callPackage ../servers/tmate-ssh-server { };
@@ -16265,6 +16267,8 @@ with pkgs;
 
   krew = callPackage ../development/tools/krew { };
 
+  kube-bench = callPackage ../tools/security/kube-bench { };
+
   kube-hunter = callPackage ../tools/security/kube-hunter { };
 
   kubeaudit = callPackage ../tools/security/kubeaudit { };
@@ -22906,7 +22910,10 @@ with pkgs;
   percona-server56 = callPackage ../servers/sql/percona/5.6.x.nix { stdenv = gcc10StdenvCompat; };
   percona-server = percona-server56;
 
-  influxdb = callPackage ../servers/nosql/influxdb { };
+  influxdb = callPackage ../servers/nosql/influxdb {
+    # pinned due to build failure or vendoring problems. When unpinning double check with: nix-build -A $name.go-modules --rebuild
+    buildGoModule = buildGo117Module;
+  };
   influxdb2-server = callPackage ../servers/nosql/influxdb2 { };
   influxdb2-cli = callPackage ../servers/nosql/influxdb2/cli.nix { };
   # For backwards compatibility with older versions of influxdb2,
@@ -34557,6 +34564,13 @@ with pkgs;
     jre = openjdk11;
   };
 
+  faiss = callPackage ../development/libraries/science/math/faiss {
+    pythonPackages = python3Packages;
+    # faiss wants the "-doxygen" option
+    # available only since swig4
+    swig = swig4;
+  };
+
   fityk = callPackage ../applications/science/misc/fityk { };
 
   galario = callPackage ../development/libraries/galario { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 4ab0b1b6194d..3f94580e2664 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -151,6 +151,8 @@ in {
 
   aafigure = callPackage ../development/python-modules/aafigure { };
 
+  aardwolf = callPackage ../development/python-modules/aardwolf { };
+
   abodepy = callPackage ../development/python-modules/abodepy { };
 
   absl-py = callPackage ../development/python-modules/absl-py { };
@@ -329,6 +331,8 @@ in {
 
   aioitertools = callPackage ../development/python-modules/aioitertools { };
 
+  aiobiketrax = callPackage ../development/python-modules/aiobiketrax { };
+
   aiobotocore = callPackage ../development/python-modules/aiobotocore { };
 
   aiobroadlink = callPackage ../development/python-modules/aiobroadlink { };
@@ -365,6 +369,8 @@ in {
 
   aiomusiccast = callPackage ../development/python-modules/aiomusiccast { };
 
+  aiomysensors = callPackage ../development/python-modules/aiomysensors { };
+
   aiomysql = callPackage ../development/python-modules/aiomysql { };
 
   aionanoleaf = callPackage ../development/python-modules/aionanoleaf { };
@@ -375,6 +381,8 @@ in {
 
   aiooncue = callPackage ../development/python-modules/aiooncue { };
 
+  aioopenexchangerates = callPackage ../development/python-modules/aioopenexchangerates { };
+
   aiopg = callPackage ../development/python-modules/aiopg { };
 
   aioprocessing = callPackage ../development/python-modules/aioprocessing { };
@@ -401,6 +409,8 @@ in {
 
   aiorpcx = callPackage ../development/python-modules/aiorpcx { };
 
+  aiortm = callPackage ../development/python-modules/aiortm { };
+
   aiorun = callPackage ../development/python-modules/aiorun { };
 
   aiosenseme = callPackage ../development/python-modules/aiosenseme { };
@@ -625,6 +635,8 @@ in {
 
   arabic-reshaper = callPackage ../development/python-modules/arabic-reshaper { };
 
+  arc4 = callPackage ../development/python-modules/arc4 { };
+
   arcam-fmj = callPackage ../development/python-modules/arcam-fmj { };
 
   archinfo = callPackage ../development/python-modules/archinfo { };
@@ -3010,6 +3022,11 @@ in {
 
   factory_boy = callPackage ../development/python-modules/factory_boy { };
 
+  faiss = toPythonModule (pkgs.faiss.override {
+    pythonSupport = true;
+    pythonPackages = self;
+  });
+
   fake-useragent = callPackage ../development/python-modules/fake-useragent { };
 
   faker = callPackage ../development/python-modules/faker { };
@@ -3442,6 +3459,8 @@ in {
     pythonPackages = self;
   });
 
+  galois = callPackage ../development/python-modules/galois { };
+
   gamble = callPackage ../development/python-modules/gamble { };
 
   gaphas = callPackage ../development/python-modules/gaphas { };
@@ -7814,6 +7833,8 @@ in {
 
   pymetno = callPackage ../development/python-modules/pymetno { };
 
+  pymicrobot = callPackage ../development/python-modules/pymicrobot { };
+
   pymitv = callPackage ../development/python-modules/pymitv { };
 
   pymfy = callPackage ../development/python-modules/pymfy { };
@@ -9106,6 +9127,8 @@ in {
 
   qimage2ndarray = callPackage ../development/python-modules/qimage2ndarray { };
 
+  qingping-ble = callPackage ../development/python-modules/qingping-ble { };
+
   qiskit = callPackage ../development/python-modules/qiskit { };
 
   qiskit-aer = callPackage ../development/python-modules/qiskit-aer { };
@@ -11637,6 +11660,8 @@ in {
 
   yalexs = callPackage ../development/python-modules/yalexs { };
 
+  yalexs-ble = callPackage ../development/python-modules/yalexs-ble { };
+
   yamale = callPackage ../development/python-modules/yamale { };
 
   yamlfix = callPackage ../development/python-modules/yamlfix { };