diff --git a/doc/languages-frameworks/rust.section.md b/doc/languages-frameworks/rust.section.md
index 56faf636df10..e19783e29e6a 100644
--- a/doc/languages-frameworks/rust.section.md
+++ b/doc/languages-frameworks/rust.section.md
@@ -464,6 +464,8 @@ you of the correct hash.
   be disabled by setting `dontUseCargoParallelTests`.
 * `cargoInstallHook`: install binaries and static/shared libraries
   that were built using `cargoBuildHook`.
+* `bindgenHook`: for crates which use `bindgen` as a build dependency, lets
+  `bindgen` find `libclang` and `libclang` find the libraries in `buildInputs`.
 
 ### Examples {#examples}
 
diff --git a/nixos/modules/services/home-automation/home-assistant.nix b/nixos/modules/services/home-automation/home-assistant.nix
index f4197650ab23..6022227f6ea8 100644
--- a/nixos/modules/services/home-automation/home-assistant.nix
+++ b/nixos/modules/services/home-automation/home-assistant.nix
@@ -135,7 +135,7 @@ in {
     };
 
     config = mkOption {
-      type = types.submodule {
+      type = types.nullOr (types.submodule {
         freeformType = format.type;
         options = {
           # This is a partial selection of the most common options, so new users can quickly
@@ -244,7 +244,7 @@ in {
             };
           };
         };
-      };
+      });
       example = literalExpression ''
         {
           homeassistant = {
@@ -349,10 +349,6 @@ in {
       '';
       description = ''
         The Home Assistant package to use.
-        Override <literal>extraPackages</literal> or <literal>extraComponents</literal> in order to add additional dependencies.
-        If you specify <option>config</option> and do not set <option>autoExtraComponents</option>
-        to <literal>false</literal>, overriding <literal>extraComponents</literal> will have no effect.
-        Avoid <literal>home-assistant.overridePythonAttrs</literal> if you use <literal>autoExtraComponents</literal>.
       '';
     };
 
diff --git a/nixos/modules/system/boot/modprobe.nix b/nixos/modules/system/boot/modprobe.nix
index 7426d148891f..27f78835adb2 100644
--- a/nixos/modules/system/boot/modprobe.nix
+++ b/nixos/modules/system/boot/modprobe.nix
@@ -72,6 +72,8 @@ with lib;
       '';
     environment.etc."modprobe.d/debian.conf".source = pkgs.kmod-debian-aliases;
 
+    environment.etc."modprobe.d/systemd.conf".source = "${pkgs.systemd}/lib/modprobe.d/systemd.conf";
+
     environment.systemPackages = [ pkgs.kmod ];
 
     system.activationScripts.modprobe = stringAfter ["specialfs"]
diff --git a/nixos/tests/networking.nix b/nixos/tests/networking.nix
index 2510937b5dcd..2d68bc859df5 100644
--- a/nixos/tests/networking.nix
+++ b/nixos/tests/networking.nix
@@ -246,13 +246,13 @@ let
         networking = {
           useNetworkd = networkd;
           useDHCP = false;
-          bonds.bond = {
+          bonds.bond0 = {
             interfaces = [ "eth1" "eth2" ];
-            driverOptions.mode = "balance-rr";
+            driverOptions.mode = "802.3ad";
           };
           interfaces.eth1.ipv4.addresses = mkOverride 0 [ ];
           interfaces.eth2.ipv4.addresses = mkOverride 0 [ ];
-          interfaces.bond.ipv4.addresses = mkOverride 0
+          interfaces.bond0.ipv4.addresses = mkOverride 0
             [ { inherit address; prefixLength = 30; } ];
         };
       };
@@ -274,6 +274,10 @@ let
 
               client2.wait_until_succeeds("ping -c 2 192.168.1.1")
               client2.wait_until_succeeds("ping -c 2 192.168.1.2")
+
+          with subtest("Verify bonding mode"):
+              for client in client1, client2:
+                  client.succeed('grep -q "Bonding Mode: IEEE 802.3ad Dynamic link aggregation" /proc/net/bonding/bond0')
         '';
     };
     bridge = let
diff --git a/pkgs/applications/audio/helvum/default.nix b/pkgs/applications/audio/helvum/default.nix
index dc8bf5302649..798af97ab32f 100644
--- a/pkgs/applications/audio/helvum/default.nix
+++ b/pkgs/applications/audio/helvum/default.nix
@@ -40,6 +40,7 @@ stdenv.mkDerivation rec {
     rustPlatform.cargoSetupHook
     rustPlatform.rust.cargo
     rustPlatform.rust.rustc
+    rustPlatform.bindgenHook
   ];
 
   buildInputs = [
@@ -49,8 +50,6 @@ stdenv.mkDerivation rec {
     pipewire
   ];
 
-  LIBCLANG_PATH = "${libclang.lib}/lib";
-
   meta = with lib; {
     description = "A GTK patchbay for pipewire";
     homepage = "https://gitlab.freedesktop.org/pipewire/helvum";
diff --git a/pkgs/applications/misc/cherrytree/default.nix b/pkgs/applications/misc/cherrytree/default.nix
index 237c91267839..067ad872f640 100644
--- a/pkgs/applications/misc/cherrytree/default.nix
+++ b/pkgs/applications/misc/cherrytree/default.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cherrytree";
-  version = "0.99.45";
+  version = "0.99.46";
 
   src = fetchFromGitHub {
     owner = "giuspen";
     repo = "cherrytree";
     rev = version;
-    sha256 = "sha256-DGhzqv7huFVgCdXy3DuIBT+7s2q6FB7+gFPd4zEXi2M=";
+    sha256 = "sha256-yX9USGiiCwtBcg055D8xBHoiCafQWtQFqf5i5bsi13U=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/otpclient/default.nix b/pkgs/applications/misc/otpclient/default.nix
index 364bb6c80deb..afc0ac71d5d2 100644
--- a/pkgs/applications/misc/otpclient/default.nix
+++ b/pkgs/applications/misc/otpclient/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "otpclient";
-  version = "2.4.7";
+  version = "2.4.8";
 
   src = fetchFromGitHub {
     owner = "paolostivanin";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-UR7h+btmOSnpjkrQMiABcM1tOFjOhNVWuKYDF9qXfFo=";
+    sha256 = "sha256-2exqMYcxg0UxlH+ZANQv2MFii9dZ6nizB4vxGR9cAwk=";
   };
 
   buildInputs = [ gtk3 jansson libgcrypt libzip libpng libcotp zbar ];
diff --git a/pkgs/applications/networking/browsers/firefox/common.nix b/pkgs/applications/networking/browsers/firefox/common.nix
index ca8e227664ed..d57839b0e4b6 100644
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@@ -11,7 +11,7 @@
 , hunspell, libevent, libstartup_notification
 , libvpx
 , icu70, libpng, glib, pciutils
-, autoconf213, which, gnused, rustPackages
+, autoconf213, which, gnused, rustPackages, rustPlatform
 , rust-cbindgen, nodejs, nasm, fetchpatch
 , gnum4
 , gtk3, wrapGAppsHook
@@ -196,6 +196,7 @@ buildStdenv.mkDerivation ({
       which
       unzip
       wrapGAppsHook
+      rustPlatform.bindgenHook
     ]
     ++ lib.optionals buildStdenv.isDarwin [ xcbuild rsync ]
     ++ extraNativeBuildInputs;
@@ -210,28 +211,8 @@ buildStdenv.mkDerivation ({
     rm -f .mozconfig*
     # this will run autoconf213
     configureScript="$(realpath ./mach) configure"
-    export MOZCONFIG=$(pwd)/mozconfig
     export MOZBUILD_STATE_PATH=$(pwd)/mozbuild
 
-    # Set C flags for Rust's bindgen program. Unlike ordinary C
-    # compilation, bindgen does not invoke $CC directly. Instead it
-    # uses LLVM's libclang. To make sure all necessary flags are
-    # included we need to look in a few places.
-    # TODO: generalize this process for other use-cases.
-
-    BINDGEN_CFLAGS="$(< ${buildStdenv.cc}/nix-support/libc-crt1-cflags) \
-      $(< ${buildStdenv.cc}/nix-support/libc-cflags) \
-      $(< ${buildStdenv.cc}/nix-support/cc-cflags) \
-      $(< ${buildStdenv.cc}/nix-support/libcxx-cxxflags) \
-      ${lib.optionalString buildStdenv.cc.isClang "-idirafter ${buildStdenv.cc.cc.lib}/lib/clang/${lib.getVersion buildStdenv.cc.cc}/include"} \
-      ${lib.optionalString buildStdenv.cc.isGNU "-isystem ${lib.getDev buildStdenv.cc.cc}/include/c++/${lib.getVersion buildStdenv.cc.cc} -isystem ${buildStdenv.cc.cc}/include/c++/${lib.getVersion buildStdenv.cc.cc}/${buildStdenv.hostPlatform.config}"} \
-      $NIX_CFLAGS_COMPILE"
-    ${
-    # Bindgen doesn't like the flag added by `separateDebugInfo`.
-    lib.optionalString enableDebugSymbols ''
-      BINDGEN_CFLAGS="''${BINDGEN_CFLAGS/ -Wa,--compress-debug-sections/}"
-    ''}
-    echo "ac_add_options BINDGEN_CFLAGS='$BINDGEN_CFLAGS'" >> $MOZCONFIG
   '' + (lib.optionalString googleAPISupport ''
     # Google API key used by Chromium and Firefox.
     # Note: These are for NixOS/nixpkgs use ONLY. For your own distribution,
diff --git a/pkgs/applications/networking/cluster/fluxcd/default.nix b/pkgs/applications/networking/cluster/fluxcd/default.nix
index 30a12281c872..eb73fd90e5b0 100644
--- a/pkgs/applications/networking/cluster/fluxcd/default.nix
+++ b/pkgs/applications/networking/cluster/fluxcd/default.nix
@@ -1,9 +1,9 @@
 { lib, buildGoModule, fetchFromGitHub, fetchzip, installShellFiles }:
 
 let
-  version = "0.26.3";
-  sha256 = "0j6zvcjykk775nnj8s0n5154lqslgfpi8884gh6sv204z2drfjff";
-  manifestsSha256 = "1pfk0fj228zy0m1cz0400l4r41l7p0gsdq5lqnl3a8vgb4f6i41q";
+  version = "0.27.0";
+  sha256 = "12d5azl30071s31dqbvbi1c5a5746cb9y45g889hgcyl50yzm2dx";
+  manifestsSha256 = "0mhx9xgir9ych9p0j5yc4swf371njfbwyk3cqa1nmipgpxbfczc6";
 
   manifests = fetchzip {
     url =
@@ -23,7 +23,7 @@ in buildGoModule rec {
     inherit sha256;
   };
 
-  vendorSha256 = "sha256-34hSbOB7n9OFpVqe8y1+jAC3j0HEBg9LhYOvVGH9kLY=";
+  vendorSha256 = "sha256-iyyGLHtJVXc7rdu2VkuGo+Y1tTS0krW7F/lD5TmjTQs=";
 
   postUnpack = ''
     cp -r ${manifests} source/cmd/flux/manifests
diff --git a/pkgs/applications/networking/cluster/openshift/default.nix b/pkgs/applications/networking/cluster/openshift/default.nix
index a1d4b1468376..dd542f9ffac6 100644
--- a/pkgs/applications/networking/cluster/openshift/default.nix
+++ b/pkgs/applications/networking/cluster/openshift/default.nix
@@ -33,9 +33,16 @@ in buildGoPackage rec {
 
   goPackagePath = "github.com/openshift/origin";
 
-  buildInputs = [ libkrb5 ncurses ];
+  buildInputs = [ libkrb5 ];
 
-  nativeBuildInputs = [ which rsync go-bindata clang installShellFiles ];
+  nativeBuildInputs = [
+    clang
+    go-bindata
+    installShellFiles
+    ncurses
+    rsync
+    which
+  ];
 
   patchPhase = ''
     patchShebangs ./hack
diff --git a/pkgs/applications/version-management/commitizen/default.nix b/pkgs/applications/version-management/commitizen/default.nix
index b8befad558d5..0aa3f0d02ab2 100644
--- a/pkgs/applications/version-management/commitizen/default.nix
+++ b/pkgs/applications/version-management/commitizen/default.nix
@@ -1,33 +1,46 @@
 { buildPythonApplication
-, lib
-, fetchFromGitHub
-, poetry
-, termcolor
-, questionary
 , colorama
 , decli
-, tomlkit
+, fetchFromGitHub
+, git
 , jinja2
-, pyyaml
-, argcomplete
-, typing-extensions
+, lib
 , packaging
-, pytestCheckHook
+, poetry
 , pytest-freezegun
 , pytest-mock
 , pytest-regressions
-, git
+, pytestCheckHook
+, pyyaml
+, questionary
+, termcolor
+, tomlkit
+, typing-extensions
+
+, argcomplete, fetchPypi
 }:
 
+let
+  # NOTE: Upstream requires argcomplete <2, so we make it here.
+  argcomplete_1 = argcomplete.overrideAttrs (old: rec {
+    version = "1.12.3";
+    src = fetchPypi {
+      inherit (old) pname;
+      inherit version;
+      sha256 = "sha256-LH2//YwEXqU0kh5jsL5v5l6IWZmQ2NxAisjFQrcqVEU=";
+    };
+  });
+in
+
 buildPythonApplication rec {
   pname = "commitizen";
-  version = "2.20.4";
+  version = "2.21.2";
 
   src = fetchFromGitHub {
     owner = "commitizen-tools";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-2DhWiUAkAkyNxYB1CGzUB2nGZeCWvFqSztrxasUPSXw=";
+    sha256 = "sha256-ZFKUG8dE1hpWPGitdQlYeBSzWn3LPR7VGWsuq1Le5OQ=";
     deepClone = true;
   };
 
@@ -43,7 +56,7 @@ buildPythonApplication rec {
     tomlkit
     jinja2
     pyyaml
-    argcomplete
+    argcomplete_1
     typing-extensions
     packaging
   ];
@@ -54,7 +67,7 @@ buildPythonApplication rec {
     pytest-freezegun
     pytest-mock
     pytest-regressions
-    argcomplete
+    argcomplete_1
     git
   ];
 
diff --git a/pkgs/applications/window-managers/i3/status-rust.nix b/pkgs/applications/window-managers/i3/status-rust.nix
index da04da4e9eae..cdcfcca15eae 100644
--- a/pkgs/applications/window-managers/i3/status-rust.nix
+++ b/pkgs/applications/window-managers/i3/status-rust.nix
@@ -15,16 +15,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "i3status-rust";
-  version = "0.21.5";
+  version = "0.21.6";
 
   src = fetchFromGitHub {
     owner = "greshake";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-0maPT1NdWFkSupU6CL2cFd6hlZ2BMxAOK6f3rQbfFA8=";
+    sha256 = "sha256-2PBGw5LHIOOPXBZ+12wL2ZGH+gfbkXNIItpE6SLT8so=";
   };
 
-  cargoSha256 = "sha256-QUecTmw8pWqrTdcstbXoFf53dFfwFN51tQ7ngUzkyV0=";
+  cargoSha256 = "sha256-wtxfdQw5zKCxYu7N2BpcLVTlitQmwY7s8oO4dpK8MjE=";
 
   nativeBuildInputs = [ pkg-config makeWrapper ];
 
@@ -56,7 +56,7 @@ rustPlatform.buildRustPackage rec {
   meta = with lib; {
     description = "Very resource-friendly and feature-rich replacement for i3status";
     homepage = "https://github.com/greshake/i3status-rust";
-    license = licenses.gpl3;
+    license = licenses.gpl3Only;
     maintainers = with maintainers; [ backuitist globin ma27 ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/build-support/rust/hooks/default.nix b/pkgs/build-support/rust/hooks/default.nix
index d86c9ebaed80..d33692457077 100644
--- a/pkgs/build-support/rust/hooks/default.nix
+++ b/pkgs/build-support/rust/hooks/default.nix
@@ -1,6 +1,7 @@
 { buildPackages
 , callPackage
 , cargo
+, clang
 , diffutils
 , lib
 , makeSetupHook
@@ -92,4 +93,13 @@ in {
           rustBuildPlatform rustTargetPlatform rustTargetPlatformSpec;
       };
     } ./maturin-build-hook.sh) {};
+
+    bindgenHook = callPackage ({}: makeSetupHook {
+      name = "rust-bindgen-hook";
+      substitutions = {
+        libclang = clang.cc.lib;
+        inherit clang;
+      };
+    }
+    ./rust-bindgen-hook.sh) {};
 }
diff --git a/pkgs/build-support/rust/hooks/rust-bindgen-hook.sh b/pkgs/build-support/rust/hooks/rust-bindgen-hook.sh
new file mode 100644
index 000000000000..53624b124f2b
--- /dev/null
+++ b/pkgs/build-support/rust/hooks/rust-bindgen-hook.sh
@@ -0,0 +1,13 @@
+# populates LIBCLANG_PATH and BINDGEN_EXTRA_CLANG_ARGS for rust projects that
+# depend on the bindgen crate
+
+# if you modify this, you probably also need to modify the wrapper for the cli
+# of bindgen in pkgs/development/tools/rust/bindgen/wrapper.sh
+
+populateBindgenEnv () {
+    export LIBCLANG_PATH=@libclang@/lib
+    BINDGEN_EXTRA_CLANG_ARGS="$(< @clang@/nix-support/cc-cflags) $(< @clang@/nix-support/libc-cflags) $(< @clang@/nix-support/libcxx-cxxflags) $NIX_CFLAGS_COMPILE"
+    export BINDGEN_EXTRA_CLANG_ARGS
+}
+
+postHook="${postHook:-}"$'\n'"populateBindgenEnv"$'\n'
diff --git a/pkgs/data/fonts/andika/default.nix b/pkgs/data/fonts/andika/default.nix
index aaa380098a27..02ee29a382ed 100644
--- a/pkgs/data/fonts/andika/default.nix
+++ b/pkgs/data/fonts/andika/default.nix
@@ -1,7 +1,7 @@
 { lib, fetchzip }:
 
 let
-  version = "6.001";
+  version = "6.101";
 in
   fetchzip rec {
     name = "andika-${version}";
@@ -14,7 +14,7 @@ in
       unzip -j $downloadedFile \*OFL.txt \*OFL-FAQ.txt \*README.txt \*FONTLOG.txt -d "$out/share/doc/${name}"
     '';
 
-    sha256 = "sha256-ukPFBLjHQbOosQ1h0ImVlz8HhNNMp0e41SjzUhQaZtc=";
+    sha256 = "sha256-J/Ad+fmCMOxLoo+691LE6Bgi/l3ovIfWScwwVWtqACI=";
 
     meta = with lib; {
       homepage = "https://software.sil.org/andika";
diff --git a/pkgs/data/fonts/charis-sil/default.nix b/pkgs/data/fonts/charis-sil/default.nix
index 75f1d89be770..3294cb711052 100644
--- a/pkgs/data/fonts/charis-sil/default.nix
+++ b/pkgs/data/fonts/charis-sil/default.nix
@@ -1,7 +1,7 @@
 { lib, fetchzip }:
 
 let
-  version = "6.001";
+  version = "6.101";
 in
   fetchzip rec {
     name = "charis-sil-${version}";
@@ -14,7 +14,7 @@ in
       unzip -j $downloadedFile \*OFL.txt \*OFL-FAQ.txt \*README.txt \*FONTLOG.txt -d "$out/share/doc/${name}"
     '';
 
-    sha256 = "sha256-eKSOvYuTMpAnTk4sRiWFUDJrTsF+K5716ALCepaUU08=";
+    sha256 = "sha256-b1ms9hJ6IPe7W6O9KgzHZvwT4/nAoLOhdydcUrwNfnU=";
 
     meta = with lib; {
       homepage = "https://software.sil.org/charis";
diff --git a/pkgs/data/fonts/doulos-sil/default.nix b/pkgs/data/fonts/doulos-sil/default.nix
index a1e686a320ed..f720c2cac7dc 100644
--- a/pkgs/data/fonts/doulos-sil/default.nix
+++ b/pkgs/data/fonts/doulos-sil/default.nix
@@ -1,7 +1,7 @@
 { lib, fetchzip }:
 
 let
-  version = "6.001";
+  version = "6.101";
 in
   fetchzip rec {
     name = "doulos-sil-${version}";
@@ -14,7 +14,7 @@ in
       unzip -j $downloadedFile \*OFL.txt \*OFL-FAQ.txt \*README.txt \*FONTLOG.txt -d "$out/share/doc/${name}"
     '';
 
-    sha256 = "sha256-MkeLLT7EAeSuCMxVVxVfajHufxr+xMLIz2hf3wF3U4o=";
+    sha256 = "sha256-vYdnudMkkWz6r8pwq98fyO0zcfFBRPmrqlmWxHCOIcc=";
 
     meta = with lib; {
       homepage = "https://software.sil.org/doulos";
diff --git a/pkgs/development/compilers/rust/make-rust-platform.nix b/pkgs/development/compilers/rust/make-rust-platform.nix
index f479b052019e..2071c48cc6d5 100644
--- a/pkgs/development/compilers/rust/make-rust-platform.nix
+++ b/pkgs/development/compilers/rust/make-rust-platform.nix
@@ -31,5 +31,5 @@ rec {
   # Hooks
   inherit (callPackage ../../../build-support/rust/hooks {
     inherit stdenv cargo rustc;
-  }) cargoBuildHook cargoCheckHook cargoInstallHook cargoSetupHook maturinBuildHook;
+  }) cargoBuildHook cargoCheckHook cargoInstallHook cargoSetupHook maturinBuildHook bindgenHook;
 }
diff --git a/pkgs/development/libraries/drogon/default.nix b/pkgs/development/libraries/drogon/default.nix
index 7258cb767e3f..432e7626156b 100644
--- a/pkgs/development/libraries/drogon/default.nix
+++ b/pkgs/development/libraries/drogon/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "drogon";
-  version = "1.7.4";
+  version = "1.7.5";
 
   src = fetchFromGitHub {
     owner = "drogonframework";
     repo = "drogon";
     rev = "v${version}";
-    sha256 = "02igryrv8782rwqb4w49frymlw9n7hv8fskqsw43rqly650vzakb";
+    sha256 = "sha256-DrpaXUaoO35DgmX8cYb3kbXfd6PlqI6pjEKnroiRxvg=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/libraries/libtsm/default.nix b/pkgs/development/libraries/libtsm/default.nix
index 9c8e418fba4f..25214242b531 100644
--- a/pkgs/development/libraries/libtsm/default.nix
+++ b/pkgs/development/libraries/libtsm/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libtsm";
-  version = "4.0.1";
+  version = "4.0.2";
 
   src = fetchFromGitHub {
     owner = "Aetf";
     repo = "libtsm";
     rev = "v${version}";
-    sha256 = "0mwn91i5h5d518i1s05y7hzv6bc13vzcvxszpfh77473iwg4wprx";
+    sha256 = "sha256-BYMRPjGRVSnYzkdbxypkuE0YkeVLPJ32iGZ1b0R6wto=";
   };
 
   buildInputs = [ libxkbcommon ];
diff --git a/pkgs/development/libraries/mtxclient/default.nix b/pkgs/development/libraries/mtxclient/default.nix
index 4e5eed1e4391..92285501748a 100644
--- a/pkgs/development/libraries/mtxclient/default.nix
+++ b/pkgs/development/libraries/mtxclient/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mtxclient";
-  version = "0.6.1";
+  version = "0.6.2";
 
   src = fetchFromGitHub {
     owner = "Nheko-Reborn";
     repo = "mtxclient";
     rev = "v${version}";
-    sha256 = "sha256-hTB0a5KXcQb0MCEX9YonDJOGlTmRkrOIP9UFlwuJc6g=";
+    sha256 = "sha256-TsGoSVewQJlr0zj8qYEd+UU8DlncZDCqfrqTv89LEYU=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/okapi/default.nix b/pkgs/development/libraries/okapi/default.nix
index e9b0b95d1af8..eb85bb1d41f0 100644
--- a/pkgs/development/libraries/okapi/default.nix
+++ b/pkgs/development/libraries/okapi/default.nix
@@ -2,11 +2,11 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "okapi";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchurl {
     url = "https://github.com/trinsic-id/okapi/releases/download/v${version}/okapi-vendor-${version}.tar.gz";
-    sha256 = "sha256-1aADcwEEWMhoJjwc8wkEcmBYXz+5josOfI/KLaton2k=";
+    sha256 = "sha256-I3wTcT7vLgH+B8gNzl8Yr/qMIDkMJUrG++SOSS+FUmQ=";
   };
 
   cargoVendorDir = "vendor";
diff --git a/pkgs/development/ocaml-modules/gg/default.nix b/pkgs/development/ocaml-modules/gg/default.nix
index 58e2b67eacc6..fb1920776900 100644
--- a/pkgs/development/ocaml-modules/gg/default.nix
+++ b/pkgs/development/ocaml-modules/gg/default.nix
@@ -1,31 +1,26 @@
-{ lib, stdenv, fetchurl, ocaml, findlib, ocamlbuild, opaline }:
+{ lib, stdenv, fetchurl, ocaml, findlib, topkg, ocamlbuild }:
 
 let
-  inherit (lib) getVersion versionAtLeast;
-
-  pname = "gg";
-  version = "0.9.1";
-  webpage = "https://erratique.ch/software/${pname}";
+  homepage = "https://erratique.ch/software/gg";
+  version = "1.0.0";
 in
 
-assert versionAtLeast (getVersion ocaml) "4.01.0";
+lib.throwIfNot (lib.versionAtLeast ocaml.version "4.08")
+  "gg is not available for OCaml ${ocaml.version}"
 
 stdenv.mkDerivation {
 
-  name = "ocaml-${pname}-${version}";
+  pname = "ocaml${ocaml.version}-gg";
+  inherit version;
 
   src = fetchurl {
-    url = "${webpage}/releases/${pname}-${version}.tbz";
-    sha256 = "0czj41sr8jsivl3z8wyblf9k971j3kx2wc3s0c1nhzcc8allg9i2";
+    url = "${homepage}/releases/gg-${version}.tbz";
+    sha256 = "sha256:0j7bpj8k17csnz6v6frkz9aycywsb7xmznnb31g8rbfk3626f3ci";
   };
 
-  buildInputs = [ ocaml findlib ocamlbuild opaline ];
+  buildInputs = [ ocaml findlib ocamlbuild topkg ];
 
-  createFindlibDestdir = true;
-
-  buildPhase = "ocaml pkg/build.ml native=true native-dynlink=true";
-
-  installPhase = "opaline -libdir $OCAMLFIND_DESTDIR";
+  inherit (topkg) buildPhase installPhase;
 
   meta = with lib; {
     description = "Basic types for computer graphics in OCaml";
@@ -35,8 +30,8 @@ stdenv.mkDerivation {
       matrices, quaternions, axis aligned boxes, colors, color spaces, and
       raster data.
     '';
-    homepage = webpage;
-    platforms = ocaml.meta.platforms or [];
+    inherit homepage;
+    inherit (ocaml.meta) platforms;
     license = licenses.bsd3;
     maintainers = [ maintainers.jirkamarsik ];
   };
diff --git a/pkgs/development/python-modules/gdown/default.nix b/pkgs/development/python-modules/gdown/default.nix
index 180624ea8168..9ac5b03a12a3 100644
--- a/pkgs/development/python-modules/gdown/default.nix
+++ b/pkgs/development/python-modules/gdown/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonApplication rec {
   pname = "gdown";
-  version = "4.3.0";
+  version = "4.3.1";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-KswYue892Mlpa8wnPf9bt8MEJGtjGaMjlDt0TXGoEdE=";
+    sha256 = "sha256-ZFy1/3ZI+Zu/fZbOhswNoRlKFCUSXcPO/bJetSkiyHE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyroute2-core/default.nix b/pkgs/development/python-modules/pyroute2-core/default.nix
index fe92d88beaec..d8820e6d9d0f 100644
--- a/pkgs/development/python-modules/pyroute2-core/default.nix
+++ b/pkgs/development/python-modules/pyroute2-core/default.nix
@@ -2,16 +2,20 @@
 , buildPythonPackage
 , fetchPypi
 , pyroute2-core
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "pyroute2-core";
-  version = "0.6.5";
+  version = "0.6.7";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "pyroute2.core";
     inherit version;
-    sha256 = "sha256-Jm10Dq5A+mTdBFQfAH0022ls7PMVTLpb4w+nWmfUOFI=";
+    hash = "sha256-N74cQcWx57lYIPiQTL+/Ec5Kf1rgdMrRkkYIdyaLjN4=";
   };
 
   # pyroute2 sub-modules have no tests
diff --git a/pkgs/development/python-modules/pyroute2-ethtool/default.nix b/pkgs/development/python-modules/pyroute2-ethtool/default.nix
index 6f2695507863..fe4eac248700 100644
--- a/pkgs/development/python-modules/pyroute2-ethtool/default.nix
+++ b/pkgs/development/python-modules/pyroute2-ethtool/default.nix
@@ -2,16 +2,20 @@
 , buildPythonPackage
 , fetchPypi
 , pyroute2-core
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "pyroute2-ethtool";
-  version = "0.6.5";
+  version = "0.6.7";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "pyroute2.ethtool";
     inherit version;
-    sha256 = "sha256-yvgBS2dlIRNcR2DXLPWu72q7x/onUhD36VMzBzzHcVo=";
+    hash = "sha256-jwPg7xcmQU3F4cVrs2GVUxBXV6waMkrnmyZkHo2kLR0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyroute2-ipdb/default.nix b/pkgs/development/python-modules/pyroute2-ipdb/default.nix
index 7411f49cb52a..cb40f0b4eff1 100644
--- a/pkgs/development/python-modules/pyroute2-ipdb/default.nix
+++ b/pkgs/development/python-modules/pyroute2-ipdb/default.nix
@@ -2,16 +2,20 @@
 , buildPythonPackage
 , fetchPypi
 , pyroute2-core
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "pyroute2-ipdb";
-  version = "0.6.5";
+  version = "0.6.7";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "pyroute2.ipdb";
     inherit version;
-    sha256 = "sha256-8gKP0QE9iviIFQ0DPuz3U3ZXpL434MzOqYAICZYetXc=";
+    hash = "sha256-uMEPUleEBIaIV4bCejTmeHYhKeaN9SNcUMzBAODNBEU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyroute2-ipset/default.nix b/pkgs/development/python-modules/pyroute2-ipset/default.nix
index 5ab21f8f22c7..300b1d21fa1d 100644
--- a/pkgs/development/python-modules/pyroute2-ipset/default.nix
+++ b/pkgs/development/python-modules/pyroute2-ipset/default.nix
@@ -2,16 +2,20 @@
 , buildPythonPackage
 , fetchPypi
 , pyroute2-core
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "pyroute2-ipset";
-  version = "0.6.5";
+  version = "0.6.7";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "pyroute2.ipset";
     inherit version;
-    sha256 = "sha256-rlJ8D5mXSCMKH2iNmit8JXst9tdDafROylMNAHeTt50=";
+    hash = "sha256-roNLNXmnW27a+TgxtMi8HO5hF4agxdjQ0DMsYW6O44c=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyroute2-ndb/default.nix b/pkgs/development/python-modules/pyroute2-ndb/default.nix
index 7caa902dfa7d..2564e4601199 100644
--- a/pkgs/development/python-modules/pyroute2-ndb/default.nix
+++ b/pkgs/development/python-modules/pyroute2-ndb/default.nix
@@ -2,16 +2,20 @@
 , buildPythonPackage
 , fetchPypi
 , pyroute2-core
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "pyroute2-ndb";
-  version = "0.6.5";
+  version = "0.6.7";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "pyroute2.ndb";
     inherit version;
-    sha256 = "sha256-pNMJWE6e9seEKvT4MrSPxTRKsiXnDjhLrtG3/iuU2fg=";
+    hash = "sha256-o/rmbOwfRUPw/g1Cc/5otqKvGe3Br3y4iSXad/PfTPw=";
   };
 
   propagatedBuildInputs = [
@@ -21,7 +25,9 @@ buildPythonPackage rec {
   # pyroute2 sub-modules have no tests
   doCheck = false;
 
-  pythonImportsCheck = [ "pr2modules.ndb" ];
+  pythonImportsCheck = [
+    "pr2modules.ndb"
+  ];
 
   meta = with lib; {
     description = "NDB module for pyroute2";
diff --git a/pkgs/development/python-modules/pyroute2-nftables/default.nix b/pkgs/development/python-modules/pyroute2-nftables/default.nix
index ec5ada77dd2e..6b0b4bc35c92 100644
--- a/pkgs/development/python-modules/pyroute2-nftables/default.nix
+++ b/pkgs/development/python-modules/pyroute2-nftables/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "pyroute2-nftables";
-  version = "0.6.5";
+  version = "0.6.7";
 
   src = fetchPypi {
     pname = "pyroute2.nftables";
     inherit version;
-    sha256 = "sha256-sUVaY6PvwFDRCNVQ0cr9AR7d7W6JTZnnvfoC1ZK/bxY=";
+    sha256 = "sha256-d9LdXxBQGa40MmGuK2cFOOEI7X4Y1pPv0ObW9n7ZUjo=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyroute2-nslink/default.nix b/pkgs/development/python-modules/pyroute2-nslink/default.nix
index 722ea0a12f9c..0050c4aa795e 100644
--- a/pkgs/development/python-modules/pyroute2-nslink/default.nix
+++ b/pkgs/development/python-modules/pyroute2-nslink/default.nix
@@ -2,16 +2,20 @@
 , buildPythonPackage
 , fetchPypi
 , pyroute2-core
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "pyroute2-nslink";
-  version = "0.6.5";
+  version = "0.6.7";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "pyroute2.nslink";
     inherit version;
-    sha256 = "sha256-KS5sKDKnNUTBxtW6cn9xF6qEflX4jXjpS31GB7KZmZ4=";
+    hash = "sha256-p+U3Y5vKCxuvMl/yNKlay57tlU4GKttCJrAwctKa5TY=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyroute2-protocols/default.nix b/pkgs/development/python-modules/pyroute2-protocols/default.nix
index ec3226f0cd98..39308e162e2d 100644
--- a/pkgs/development/python-modules/pyroute2-protocols/default.nix
+++ b/pkgs/development/python-modules/pyroute2-protocols/default.nix
@@ -2,16 +2,20 @@
 , buildPythonPackage
 , fetchPypi
 , pyroute2-core
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "pyroute2-protocols";
-  version = "0.6.5";
+  version = "0.6.7";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "pyroute2.protocols";
     inherit version;
-    sha256 = "sha256-lj9Q8ew+44m+Y72miQyuZhzjHmdLqYB+c2FK+ph1d84=";
+    hash = "sha256-GdququbQcU+exzxifb8UGamkSUMhR94j+auF8I6e7/Q=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyroute2/default.nix b/pkgs/development/python-modules/pyroute2/default.nix
index 9afea342e6d7..1fda8265428a 100644
--- a/pkgs/development/python-modules/pyroute2/default.nix
+++ b/pkgs/development/python-modules/pyroute2/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, importlib-metadata
 , mitogen
 , pyroute2-core
 , pyroute2-ethtool
@@ -9,15 +10,19 @@
 , pyroute2-ndb
 , pyroute2-nftables
 , pyroute2-nslink
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "pyroute2";
-  version = "0.6.5";
+  version = "0.6.7";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-0JlciuuWwOTu1NYul8nXlQAKGjO3R9bcVDJmZYV88Rw=";
+    hash = "sha256-qBv9jshyg0S9IThdrXHTFcb2neQPDmURmtSbqYCKlWo=";
   };
 
   propagatedBuildInputs = [
@@ -29,18 +34,22 @@ buildPythonPackage rec {
     pyroute2-ndb
     pyroute2-nftables
     pyroute2-nslink
+  ] ++ lib.optionals (pythonOlder "3.8") [
+    importlib-metadata
   ];
 
   # Requires root privileges, https://github.com/svinota/pyroute2/issues/778
   doCheck = false;
 
-  pythonImportsCheck = [ "pyroute2" ];
+  pythonImportsCheck = [
+    "pyroute2"
+  ];
 
   meta = with lib; {
     description = "Python Netlink library";
     homepage = "https://github.com/svinota/pyroute2";
     license = licenses.asl20;
-    maintainers = with maintainers; [ mic92 ];
+    maintainers = with maintainers; [ fab mic92 ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/python-modules/types-requests/default.nix b/pkgs/development/python-modules/types-requests/default.nix
index 4fc0cf836a15..165c65f3a9ef 100644
--- a/pkgs/development/python-modules/types-requests/default.nix
+++ b/pkgs/development/python-modules/types-requests/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "types-requests";
-  version = "2.27.10";
+  version = "2.27.11";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-XcsIj8qneO/u5rf8RpZwN+mD+/uf7AJZRXi9M/115VU=";
+    sha256 = "sha256-an7SSyF4CvSlteJMMQss2IX7YS31/ZVYTQPYfl8qGVo=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/ashpd-demo/default.nix b/pkgs/development/tools/ashpd-demo/default.nix
index f6842dacec9e..9d873b8461f1 100644
--- a/pkgs/development/tools/ashpd-demo/default.nix
+++ b/pkgs/development/tools/ashpd-demo/default.nix
@@ -48,6 +48,7 @@ stdenv.mkDerivation rec {
     rustPlatform.cargoSetupHook
     rustPlatform.rust.rustc
     wrapGAppsHook4
+    rustPlatform.bindgenHook
     desktop-file-utils
     glib # for glib-compile-schemas
   ];
@@ -63,11 +64,6 @@ stdenv.mkDerivation rec {
     libshumate
   ];
 
-  # libspa-sys requires this for bindgen
-  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
-  # <spa-0.2/spa/utils/defs.h> included by libspa-sys requires <stdbool.h>
-  BINDGEN_EXTRA_CLANG_ARGS = "-I${llvmPackages.libclang.lib}/lib/clang/${lib.getVersion llvmPackages.clang}/include -I${glibc.dev}/include";
-
   passthru = {
     updateScript = nix-update-script {
       attrPath = pname;
diff --git a/pkgs/development/tools/datree/default.nix b/pkgs/development/tools/datree/default.nix
index b50d348d7dbb..e94917f15d7c 100644
--- a/pkgs/development/tools/datree/default.nix
+++ b/pkgs/development/tools/datree/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "datree";
-  version = "0.15.16";
+  version = "0.15.22";
 
   src = fetchFromGitHub {
     owner = "datreeio";
     repo = "datree";
     rev = version;
-    sha256 = "sha256-FIFsx6iSirUY14cn6E7CPhZQKtcgnyZ2fYghrMUx3Lw=";
+    hash = "sha256-g5u2QQtVmNp01KtUKwC8uoEIuoBDLHsOlRz1Mv0n/y8=";
   };
 
-  vendorSha256 = "sha256-HaOgRbF3gMsl6PufdB5IZ2sLunvPo4GeObLb7DRSD0o=";
+  vendorSha256 = "1cvlvlwdk41f145kzifg7rv7ymwhc9k0ck91bn106240rq1igcr0";
 
   ldflags = [
     "-s"
diff --git a/pkgs/development/tools/ddosify/default.nix b/pkgs/development/tools/ddosify/default.nix
index 91ce1bb08719..a313cc512224 100644
--- a/pkgs/development/tools/ddosify/default.nix
+++ b/pkgs/development/tools/ddosify/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "ddosify";
-  version = "0.7.3";
+  version = "0.7.4";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-urls47jS9Vu64PC/Ie+UTDfg17krs+UegqKub1QaYK4=";
+    sha256 = "sha256-LIk23TZiLP2FEeHVEtd3CCUgBJ9YijclpFLyDhv6zRA=";
   };
 
   vendorSha256 = "sha256-lbo9P2UN9TmUAqyhFdbOHWokoAogVQZihpcOlhmumxU=";
diff --git a/pkgs/development/tools/go-task/default.nix b/pkgs/development/tools/go-task/default.nix
index 05ffe14dd4de..d6e5855d992c 100644
--- a/pkgs/development/tools/go-task/default.nix
+++ b/pkgs/development/tools/go-task/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "go-task";
-  version = "3.10.0";
+  version = "3.11.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = "task";
     rev = "v${version}";
-    sha256 = "sha256-E0wMFdLK8lA8oluFQuq7hPMWh4t6OsoJ14d7ErDjAdA=";
+    sha256 = "sha256-KHeZ0UH7qa+fii+sT7q9ri3DpLOKqQZqCAKQYn4l5M8=";
   };
 
-  vendorSha256 = "sha256-ClMvbxDKwwoVUC9+AJPZfBxJ26KKuLueUn9Nz/gh4Fs=";
+  vendorSha256 = "sha256-u+LeH9GijquBeYlA3f2GcyoSP/S7BtBqb8C9OgEA9fY=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/rust/bindgen/default.nix b/pkgs/development/tools/rust/bindgen/default.nix
index 782996d92180..444db1173225 100644
--- a/pkgs/development/tools/rust/bindgen/default.nix
+++ b/pkgs/development/tools/rust/bindgen/default.nix
@@ -34,7 +34,9 @@ let
           touch $out
         '';
       };
-    } ''
+    }
+    # if you modify the logic to find the right clang flags, also modify rustPlatform.bindgenHook
+    ''
     mkdir -p $out/bin
     export cincludes="$(< ${clang}/nix-support/cc-cflags) $(< ${clang}/nix-support/libc-cflags)"
     export cxxincludes="$(< ${clang}/nix-support/libcxx-cxxflags)"
diff --git a/pkgs/os-specific/linux/ryzenadj/default.nix b/pkgs/os-specific/linux/ryzenadj/default.nix
index cdc2425ae4ad..3013df7e2913 100644
--- a/pkgs/os-specific/linux/ryzenadj/default.nix
+++ b/pkgs/os-specific/linux/ryzenadj/default.nix
@@ -1,13 +1,13 @@
 { lib, stdenv, fetchFromGitHub, pciutils, cmake }:
 stdenv.mkDerivation rec {
   pname = "ryzenadj";
-  version = "0.8.3";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "FlyGoat";
     repo = "RyzenAdj";
     rev = "v${version}";
-    sha256 = "sha256-eb8DskF0SJtc0tDKJ1vU7dtuQmHO7RX8vm4DQki2ZEg=";
+    sha256 = "sha256-RoKRqqIVY9zjyXzGxHo+J4OV7cKc7CkqsdbpreB7EHc=";
   };
 
   nativeBuildInputs = [ pciutils cmake ];
diff --git a/pkgs/servers/headphones/default.nix b/pkgs/servers/headphones/default.nix
index a9403bf9edd4..f39390f5ea92 100644
--- a/pkgs/servers/headphones/default.nix
+++ b/pkgs/servers/headphones/default.nix
@@ -2,13 +2,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "headphones";
-  version = "0.6.0-alpha.1";
+  version = "0.6.0-beta.5";
 
   src = fetchFromGitHub {
     owner = "rembo10";
     repo = "headphones";
     rev = "v${version}";
-    sha256 = "sha256-+mWtceQoHSMRkA8izZnKM0cgbt0P5Hr3arKOevpKvqc=";
+    sha256 = "1ddqk5ch1dlh895cm99li4gb4a596mvq3d0gah9vrbn6fyhp3b4v";
   };
 
   dontBuild = true;
@@ -17,17 +17,21 @@ python3.pkgs.buildPythonApplication rec {
   nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/bin $out/opt/headphones
     cp -R {data,headphones,lib,Headphones.py} $out/opt/headphones
 
     echo v${version} > $out/opt/headphones/version.txt
 
     makeWrapper $out/opt/headphones/Headphones.py $out/bin/headphones
+
+    runHook postInstall
   '';
 
   meta = with lib; {
     description = "Automatic music downloader for SABnzbd";
-    license     = licenses.gpl3;
+    license     = licenses.gpl3Plus;
     homepage    = "https://github.com/rembo10/headphones";
     maintainers = with lib.maintainers; [ rembo10 ];
   };
diff --git a/pkgs/servers/imgproxy/default.nix b/pkgs/servers/imgproxy/default.nix
index a7c20d112096..29b33cd66104 100644
--- a/pkgs/servers/imgproxy/default.nix
+++ b/pkgs/servers/imgproxy/default.nix
@@ -3,16 +3,16 @@
 
 buildGoModule rec {
   pname = "imgproxy";
-  version = "3.2.2";
+  version = "3.3.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
-    sha256 = "sha256-z1Vt6rTpQ9sSwT+hr4wGZmZl55MyDx1AIDqSWmCXbMc=";
+    sha256 = "sha256-8oUPqtoxdJ768CmDNBicBGCyejt2v9GIahVRL6pYDJ4=";
     rev = "v${version}";
   };
 
-  vendorSha256 = "sha256-MHcV6n6uZsjC85vQVl+o6JD+psvE2xuPr//3RueT8V0=";
+  vendorSha256 = "sha256-Dr5qCLVsv22BcISo2OyB+VEDncPwpcp323w9IfDTQv0=";
 
   doCheck = false;
 
diff --git a/pkgs/servers/matrix-conduit/default.nix b/pkgs/servers/matrix-conduit/default.nix
index cde926de2696..c2cb3123b747 100644
--- a/pkgs/servers/matrix-conduit/default.nix
+++ b/pkgs/servers/matrix-conduit/default.nix
@@ -14,21 +14,14 @@ rustPlatform.buildRustPackage rec {
   cargoSha256 = "sha256-fpjzc2HiWP6nV8YZOwxsIOhy4ht/tQqcvCkcLMIFUaQ=";
 
   nativeBuildInputs = with pkgs; [
-    clang
-    llvmPackages.libclang
+    rustPlatform.bindgenHook
   ];
 
   buildInputs = with pkgs; [
     pkg-config
-    clangStdenv
-    llvmPackages.libclang.lib
     rocksdb
   ];
 
-  preBuild = with pkgs; ''
-    export LIBCLANG_PATH="${llvmPackages.libclang.lib}/lib";
-  '';
-
   cargoBuildFlags = "--bin conduit";
 
   meta = with lib; {
diff --git a/pkgs/servers/sql/dolt/default.nix b/pkgs/servers/sql/dolt/default.nix
index e3be7cbdec45..74fddbd49827 100644
--- a/pkgs/servers/sql/dolt/default.nix
+++ b/pkgs/servers/sql/dolt/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "dolt";
-  version = "0.37.0";
+  version = "0.37.1";
 
   src = fetchFromGitHub {
     owner = "liquidata-inc";
     repo = "dolt";
     rev = "v${version}";
-    sha256 = "sha256-uAZlQpuNUpg2ZZJBU7A49fCm6GlrYaFyn6ZrmNBW1Y0=";
+    sha256 = "sha256-rLnjWJPIf2SzWpaQxt/4zACihKptly/OJ+w0/uJBacY=";
   };
 
   modRoot = "./go";
diff --git a/pkgs/servers/swego/default.nix b/pkgs/servers/swego/default.nix
index 9009abb92060..7ead19f5ceb1 100644
--- a/pkgs/servers/swego/default.nix
+++ b/pkgs/servers/swego/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "swego";
-  version = "0.97";
+  version = "0.98";
 
   src = fetchFromGitHub {
     owner = "nodauf";
     repo = "Swego";
     rev = "v${version}";
-    sha256 = "sha256-T4xkjNdOSD0kHLVfwUz1PrFokLmnbzcj/pbV36W+2ZQ=";
+    sha256 = "sha256-fS1mrB4379hnnkLMkpKqV2QB680t5T0QEqsvqOp9pzY=";
   };
 
-  vendorSha256 = "sha256-GiYJfykcBvIoJ0zvdtT3P+iHmBgBWIeOTaniFysAPHs=";
+  vendorSha256 = "sha256-N4HDngQFNCzQ74W52R0khetN6+J7npvBC/bYZBAgLB4=";
 
   postInstall = ''
     mv $out/bin/src $out/bin/$pname
diff --git a/pkgs/shells/zsh/spaceship-prompt/default.nix b/pkgs/shells/zsh/spaceship-prompt/default.nix
index b0384eccc369..9c3843a7cefd 100644
--- a/pkgs/shells/zsh/spaceship-prompt/default.nix
+++ b/pkgs/shells/zsh/spaceship-prompt/default.nix
@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "spaceship-prompt";
-  version = "3.16.2";
+  version = "3.16.3";
 
   src = fetchFromGitHub {
     owner = "denysdovhan";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-/b+ko4d4lbjWC2rIjFBPePyzhvfHk4xyg2s86GfFNd4=";
+    sha256 = "sha256-eIvNfs9c8Ftcnbtg7lNNc2d3OWWpse91yTzcLqoeFqI=";
   };
 
   dontBuild = true;
diff --git a/pkgs/tools/admin/stripe-cli/default.nix b/pkgs/tools/admin/stripe-cli/default.nix
index ed20f688260a..673f7796f8c3 100644
--- a/pkgs/tools/admin/stripe-cli/default.nix
+++ b/pkgs/tools/admin/stripe-cli/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "stripe-cli";
-  version = "1.7.12";
+  version = "1.7.13";
 
   src = fetchFromGitHub {
     owner = "stripe";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-xDhLd1tCw+W3xXxBgHDKZtMZszXsNelv2dMygHNVq64=";
+    sha256 = "sha256-XYhOBEpHVAJ/PHovMylme56le33IUM5C9HEZAm/gG3I=";
   };
 
-  vendorSha256 = "sha256-AsEem/KuA+jxioG96Ofn0te93fyZ9sebPkLPA+LAUkk=";
+  vendorSha256 = "sha256-OP39ZuWBz/lutuYGbYLVEtjIirXq89QTdltq2v0NWRE=";
 
   subPackages = [
     "cmd/stripe"
diff --git a/pkgs/tools/compression/dtrx/default.nix b/pkgs/tools/compression/dtrx/default.nix
index 392c2b960f27..98fc0befafbf 100644
--- a/pkgs/tools/compression/dtrx/default.nix
+++ b/pkgs/tools/compression/dtrx/default.nix
@@ -21,13 +21,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "dtrx";
-  version = "8.2.1";
+  version = "8.2.2";
 
   src = fetchFromGitHub {
     owner = "dtrx-py";
     repo = "dtrx";
     rev = version;
-    sha256 = "sha256-ayQ52teXWpw3ZvPhfqxFHxMZatQK9NKv/97ovANFZcE=";
+    sha256 = "sha256-thtBVGgKRYHOAFuxDvuFxcIHoyYAI58AiNCx4vuVXGs=";
   };
 
   postInstall =
diff --git a/pkgs/tools/misc/fselect/default.nix b/pkgs/tools/misc/fselect/default.nix
index c02ceaac119c..fbdb90b12b70 100644
--- a/pkgs/tools/misc/fselect/default.nix
+++ b/pkgs/tools/misc/fselect/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "fselect";
-  version = "0.7.9";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "jhspetersson";
     repo = "fselect";
     rev = version;
-    sha256 = "sha256-Z1F63tMO3qzi/PrdVR0WCcPXx5E6PwjYPF99Bolnxc8=";
+    sha256 = "sha256-nFfzvTCiNlv+EzK51w04JHh8tfsim/8hFCxnZZue5No=";
   };
 
-  cargoSha256 = "sha256-tGzfIQ4nAFA/mXPL6cOaz97W5tjtPGsmbTSkUDFSAzY=";
+  cargoSha256 = "sha256-B7uJ9hLN/WhLA/bqoO7WZ38tN0tDMZ2KW/vjfOgcQ3A=";
 
   nativeBuildInputs = [ installShellFiles ];
   buildInputs = lib.optional stdenv.isDarwin libiconv;
diff --git a/pkgs/tools/misc/krapslog/default.nix b/pkgs/tools/misc/krapslog/default.nix
index 5aec73bde5cb..1175739159dd 100644
--- a/pkgs/tools/misc/krapslog/default.nix
+++ b/pkgs/tools/misc/krapslog/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "krapslog";
-  version = "0.3.2";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "acj";
     repo = "krapslog-rs";
     rev = version;
-    sha256 = "sha256-bzpZuLFSoIjZpK9cbxQEeyRwzuP7aDRG/xn/0056j+c=";
+    sha256 = "sha256-ETP0BvtfMHznEbM0Vu/gMoRvXn4y2XcXw6CoU60A+Cg=";
   };
 
-  cargoSha256 = "sha256-o9e0EakIbi+qk0gPxlPGfNvRidmCklieJ94sYBSR3IY=";
+  cargoSha256 = "sha256-ioD0V1S/kPF5etey04Xz1Iz/jDpyunx9PtpWKdwk21g=";
 
   buildInputs = lib.optional stdenv.isDarwin libiconv;
 
diff --git a/pkgs/tools/misc/upterm/default.nix b/pkgs/tools/misc/upterm/default.nix
index 00c6441cffe9..29775881378d 100644
--- a/pkgs/tools/misc/upterm/default.nix
+++ b/pkgs/tools/misc/upterm/default.nix
@@ -1,17 +1,18 @@
 { lib
 , buildGoModule
 , fetchFromGitHub
-, installShellFiles }:
+, installShellFiles
+}:
 
 buildGoModule rec {
   pname = "upterm";
-  version = "0.6.7";
+  version = "0.7.3";
 
   src = fetchFromGitHub {
     owner = "owenthereal";
     repo = "upterm";
     rev = "v${version}";
-    sha256 = "sha256-JxyrH48CXaaa+LkTpUPsT9aq95IuuvDoyfZndrSF1IA=";
+    hash = "sha256-eEzFqKYhsG5e1DVLWJq08NM9xyfn1yPNV0NIgOErj4E=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/tools/networking/opensnitch/ui.nix b/pkgs/tools/networking/opensnitch/ui.nix
index 8c0b7686d8a7..79a8af4ee0ff 100644
--- a/pkgs/tools/networking/opensnitch/ui.nix
+++ b/pkgs/tools/networking/opensnitch/ui.nix
@@ -27,7 +27,7 @@ python3Packages.buildPythonApplication rec {
     unicode-slugify
     pyinotify
     notify2
-    # pyasn # dpendency missing but not mandatory
+    pyasn
   ];
 
   preBuild = ''
diff --git a/pkgs/tools/nix/alejandra/default.nix b/pkgs/tools/nix/alejandra/default.nix
index d1ad257568ff..6af7fd8bc611 100644
--- a/pkgs/tools/nix/alejandra/default.nix
+++ b/pkgs/tools/nix/alejandra/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "alejandra";
-  version = "0.3.1";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "kamadorueda";
     repo = "alejandra";
     rev = version;
-    sha256 = "sha256-IQ+hv/R6uRPEPr7+SRXyYol4/cQo1ZqcqJxy26CpOoY=";
+    sha256 = "sha256-vMfCEX0DqxT4yC4qPJEoAENUj0pHfsXnLaZaBfzYXJo=";
   };
 
-  cargoSha256 = "sha256-PIqdjtqbSVQoxLj5jGSbrzRQ3qddZvp1Y7tIuFs7UEg=";
+  cargoSha256 = "sha256-wsH9zsAYSuBeyyr8KBFOEMb0qlqC5cDAIoKgTaJA6eI=";
 
   passthru.tests = {
     version = testVersion { package = alejandra; };
diff --git a/pkgs/tools/system/java-service-wrapper/default.nix b/pkgs/tools/system/java-service-wrapper/default.nix
index 43aa2b10cc3f..7c4002b8a9b8 100644
--- a/pkgs/tools/system/java-service-wrapper/default.nix
+++ b/pkgs/tools/system/java-service-wrapper/default.nix
@@ -5,36 +5,45 @@
 
 stdenv.mkDerivation rec {
   pname = "java-service-wrapper";
-  version = "3.5.48";
+  version = "3.5.49";
 
   src = fetchurl {
     url = "https://wrapper.tanukisoftware.com/download/${version}/wrapper_${version}_src.tar.gz";
-    sha256 = "sha256-woANhwLOhvTnq+Bnc8zCIDZEJOv3swNfeI/3nQ7Y1SM=";
+    hash = "sha256-gcScF5LIqWVBv8erI3hG5tt5BZPO2XlhFACz1Y60+v4=";
   };
 
   buildInputs = [ jdk ];
   nativeBuildInputs = [ ant cunit ncurses ];
 
   buildPhase = ''
+    runHook preBuild
+
     export ANT_HOME=${ant}
     export JAVA_HOME=${jdk}/lib/openjdk/jre/
     export JAVA_TOOL_OPTIONS=-Djava.home=$JAVA_HOME
     export CLASSPATH=${jdk}/lib/openjdk/lib/tools.jar
 
     ${if stdenv.isi686 then "./build32.sh" else "./build64.sh"}
+
+    runHook postBuild
   '';
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/{bin,lib}
     cp bin/wrapper $out/bin/wrapper
     cp lib/wrapper.jar $out/lib/wrapper.jar
     cp lib/libwrapper.so $out/lib/libwrapper.so
+
+    runHook postInstall
   '';
 
   meta = with lib; {
     description = "Enables a Java Application to be run as a Windows Service or Unix Daemon";
     homepage = "https://wrapper.tanukisoftware.com/";
-    license = licenses.gpl2;
+    changelog = "https://wrapper.tanukisoftware.com/doc/english/release-notes.html#${version}";
+    license = licenses.gpl2Only;
     platforms = [ "x86_64-linux" "i686-linux" ];
     maintainers = [ maintainers.suhr ];
   };
diff --git a/pkgs/tools/wayland/wluma/default.nix b/pkgs/tools/wayland/wluma/default.nix
index fd4db1a934ab..555e40384cef 100644
--- a/pkgs/tools/wayland/wluma/default.nix
+++ b/pkgs/tools/wayland/wluma/default.nix
@@ -24,25 +24,14 @@ rustPlatform.buildRustPackage rec {
   nativeBuildInputs = [
     makeWrapper
     pkg-config
+    rustPlatform.bindgenHook
   ];
 
   buildInputs = [
     udev
-    v4l-utils.lib
+    v4l-utils
   ];
 
-  LIBCLANG_PATH="${llvmPackages.libclang.lib}/lib";
-
-  # Works around the issue with rust-bindgen and the Nix gcc wrapper:
-  # https://hoverbear.org/blog/rust-bindgen-in-nix/
-  preBuild = ''
-    export BINDGEN_EXTRA_CLANG_ARGS="$(< ${stdenv.cc}/nix-support/libc-cflags) \
-    $(< ${stdenv.cc}/nix-support/cc-cflags) \
-    -isystem ${llvmPackages.libclang.lib}/lib/clang/${lib.getVersion llvmPackages.clang}/include \
-    -idirafter ${stdenv.cc.cc}/lib/gcc/${stdenv.hostPlatform.config}/${lib.getVersion stdenv.cc.cc}/include \
-    -idirafter ${v4l-utils.dev}/include"
-  '';
-
   postInstall = ''
     wrapProgram $out/bin/wluma \
       --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ vulkan-loader ]}"