diff --git a/nixos/modules/programs/nm-applet.nix b/nixos/modules/programs/nm-applet.nix
index 5bcee30125bb..db03ea679750 100644
--- a/nixos/modules/programs/nm-applet.nix
+++ b/nixos/modules/programs/nm-applet.nix
@@ -23,7 +23,7 @@
       description = "Network manager applet";
       wantedBy = [ "graphical-session.target" ];
       partOf = [ "graphical-session.target" ];
-      serviceConfig.ExecStart = "${pkgs.networkmanagerapplet}/bin/nm-applet ${lib.optionalString config.programs.nm-applet.indicator "--indicator"}";
+      serviceConfig.ExecStart = "${pkgs.networkmanager-applet}/bin/nm-applet ${lib.optionalString config.programs.nm-applet.indicator "--indicator"}";
     };
 
     services.dbus.packages = [ pkgs.gcr ];
diff --git a/nixos/modules/services/web-apps/keycloak.nix b/nixos/modules/services/web-apps/keycloak.nix
index 2d817ca19234..a1855e1c1a79 100644
--- a/nixos/modules/services/web-apps/keycloak.nix
+++ b/nixos/modules/services/web-apps/keycloak.nix
@@ -540,7 +540,8 @@ in
               db = if cfg.database.type == "postgresql" then "postgres" else cfg.database.type;
               db-username = if databaseActuallyCreateLocally then "keycloak" else cfg.database.username;
               db-password._secret = cfg.database.passwordFile;
-              db-url-host = "${cfg.database.host}:${toString cfg.database.port}";
+              db-url-host = cfg.database.host;
+              db-url-port = toString cfg.database.port;
               db-url-database = if databaseActuallyCreateLocally then "keycloak" else cfg.database.name;
               db-url-properties = prefixUnlessEmpty "?" dbProps;
               db-url = null;
diff --git a/nixos/modules/services/x11/desktop-managers/cinnamon.nix b/nixos/modules/services/x11/desktop-managers/cinnamon.nix
index 705dbec5e742..d75fdc0fa0c1 100644
--- a/nixos/modules/services/x11/desktop-managers/cinnamon.nix
+++ b/nixos/modules/services/x11/desktop-managers/cinnamon.nix
@@ -136,7 +136,7 @@ in
         # session requirements
         cinnamon-screensaver
         # cinnamon-killer-daemon: provided by cinnamon-common
-        networkmanagerapplet # session requirement - also nm-applet not needed
+        networkmanager-applet # session requirement - also nm-applet not needed
 
         # For a polkit authentication agent
         polkit_gnome
diff --git a/nixos/tests/openssh.nix b/nixos/tests/openssh.nix
index 003813379e69..4083f5906d79 100644
--- a/nixos/tests/openssh.nix
+++ b/nixos/tests/openssh.nix
@@ -80,17 +80,21 @@ in {
 
         client.wait_for_unit("network.target")
         client.succeed(
-            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server 'echo hello world' >&2"
+            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server 'echo hello world' >&2",
+            timeout=30
         )
         client.succeed(
-            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server 'ulimit -l' | grep 1024"
+            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server 'ulimit -l' | grep 1024",
+            timeout=30
         )
 
         client.succeed(
-            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server_lazy 'echo hello world' >&2"
+            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server_lazy 'echo hello world' >&2",
+            timeout=30
         )
         client.succeed(
-            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server_lazy 'ulimit -l' | grep 1024"
+            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server_lazy 'ulimit -l' | grep 1024",
+            timeout=30
         )
 
     with subtest("configured-authkey"):
@@ -99,10 +103,12 @@ in {
         )
         client.succeed("chmod 600 privkey.snakeoil")
         client.succeed(
-            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil server true"
+            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil server true",
+            timeout=30
         )
         client.succeed(
-            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil server_lazy true"
+            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil server_lazy true",
+            timeout=30
         )
 
     with subtest("localhost-only"):
diff --git a/pkgs/applications/misc/libosmocore/default.nix b/pkgs/applications/misc/libosmocore/default.nix
index 273ca0245a2b..2b825705b006 100644
--- a/pkgs/applications/misc/libosmocore/default.nix
+++ b/pkgs/applications/misc/libosmocore/default.nix
@@ -1,16 +1,25 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config
-, pcsclite, talloc, python2, gnutls
+{ lib, stdenv
+, autoreconfHook
+, fetchFromGitHub
+, gnutls
+, libmnl
+, libusb1
+, lksctp-tools
+, pcsclite
+, pkg-config
+, python3
+, talloc
 }:
 
 stdenv.mkDerivation rec {
   pname = "libosmocore";
-  version = "1.2.0";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "osmocom";
     repo = "libosmocore";
     rev = version;
-    sha256 = "1535y6r4csvslrxcki80ya6zhhc5jw2nvy9bymb55ln77pf853vg";
+    hash = "sha256-AjOyZiLlXhsetbyMBuUssoNxk22LzGOkZpeLt4vKli4=";
   };
 
   propagatedBuildInputs = [
@@ -18,11 +27,17 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [
-    autoreconfHook pkg-config
+    autoreconfHook
+    pkg-config
+    python3
   ];
 
   buildInputs = [
-    pcsclite python2 gnutls
+    gnutls
+    libmnl
+    libusb1
+    lksctp-tools
+    pcsclite
   ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.json b/pkgs/applications/networking/browsers/chromium/upstream-info.json
index 0df1f31fb50d..bb994f7008f4 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@@ -45,9 +45,9 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "101.0.4951.41",
-    "sha256": "0dzsbr309n70jg7fpq2qfnrgcm4553akvdmnzhss1fc85s467609",
-    "sha256bin64": "12nzzsp4040mwc7jah5w0p58ckv8s16wv6ylf6vlmfby06a4xlkq",
+    "version": "101.0.4951.54",
+    "sha256": "1d808a7mvg0nd0mm20c1ny5kdvb2xvrs8vz4nnk456ix8pywcv62",
+    "sha256bin64": "1m6s6xf2wvz535w6jskk3pnibvsjpzmbxvd9rlxmqr08y219gp5y",
     "deps": {
       "gn": {
         "version": "2022-03-14",
@@ -56,8 +56,8 @@
         "sha256": "0nql15ckjqkm001xajq3qyn4h4q80i7x6dm9zinxxr1a8q5lppx3"
       },
       "ungoogled-patches": {
-        "rev": "101.0.4951.41-1",
-        "sha256": "19m31bd04yvba3w5iymkxfjnmilas3cfp383m9fl6pd4wwhy9md0"
+        "rev": "101.0.4951.54-1",
+        "sha256": "0zhzy7llqddvym992pwhkgqh2f6ywjqqg0bhahl6c0np95gzhpbs"
       }
     }
   }
diff --git a/pkgs/applications/networking/firewalld/default.nix b/pkgs/applications/networking/firewalld/default.nix
new file mode 100644
index 000000000000..825222783e34
--- /dev/null
+++ b/pkgs/applications/networking/firewalld/default.nix
@@ -0,0 +1,104 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, autoreconfHook
+, bash
+, docbook_xml_dtd_42
+, docbook-xsl-nons
+, glib
+, gobject-introspection
+, gtk3
+, intltool
+, libnotify
+, libxml2
+, libxslt
+, networkmanager-applet
+, pkg-config
+, python3
+, wrapGAppsNoGuiHook
+, withGui ? false
+}:
+
+let
+  pythonPath = python3.withPackages (ps: with ps; [
+    dbus-python
+    nftables
+    pygobject3
+  ] ++ lib.optionals withGui [
+    pyqt5
+    pyqt5_sip
+  ]);
+in
+stdenv.mkDerivation rec {
+  pname = "firewalld";
+  version = "1.1.1";
+
+  src = fetchFromGitHub {
+    owner = "firewalld";
+    repo = "firewalld";
+    rev = "v${version}";
+    sha256 = "sha256-w8TbovIhOhJAUZWbKdBd/+db8Hro/ttlxWZDcrCXX4Q=";
+  };
+
+  patches = [
+    ./respect-xml-catalog-files-var.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace src/firewall/config/__init__.py.in \
+      --replace "/usr/share" "$out/share"
+
+    for file in config/firewall-{applet,config}.desktop.in; do
+      substituteInPlace $file \
+        --replace "/usr/bin/" "$out/bin/"
+    done
+  '' + lib.optionalString withGui ''
+    substituteInPlace src/firewall-applet.in \
+      --replace "/usr/bin/nm-connection-editor" "${networkmanager-applet}/bin/nm-conenction-editor"
+  '';
+
+  nativeBuildInputs = [
+    autoreconfHook
+    docbook_xml_dtd_42
+    docbook-xsl-nons
+    glib
+    intltool
+    libxml2
+    libxslt
+    pkg-config
+    python3
+    python3.pkgs.wrapPython
+  ] ++ lib.optionals withGui [
+    gobject-introspection
+    wrapGAppsNoGuiHook
+  ];
+
+  buildInputs = [
+    bash
+    glib
+  ] ++ lib.optionals withGui [
+    gtk3
+    libnotify
+    pythonPath
+  ];
+
+  dontWrapGApps = true;
+
+  preFixup = lib.optionalString withGui ''
+    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';
+
+  postFixup = ''
+    chmod +x $out/share/firewalld/*.py $out/share/firewalld/testsuite/python/*.py $out/share/firewalld/testsuite/{,integration/}testsuite
+    patchShebangs --host $out/share/firewalld/testsuite/{,integration/}testsuite $out/share/firewalld/*.py
+    wrapPythonProgramsIn "$out/bin" "$out ${pythonPath}"
+    wrapPythonProgramsIn "$out/share/firewalld/testsuite/python" "$out ${pythonPath}"
+  '';
+
+  meta = with lib; {
+    description = "Firewall daemon with D-Bus interface";
+    homepage = "https://github.com/firewalld/firewalld";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ SuperSandro2000 ];
+  };
+}
diff --git a/pkgs/applications/networking/firewalld/respect-xml-catalog-files-var.patch b/pkgs/applications/networking/firewalld/respect-xml-catalog-files-var.patch
new file mode 100644
index 000000000000..03a10121c6be
--- /dev/null
+++ b/pkgs/applications/networking/firewalld/respect-xml-catalog-files-var.patch
@@ -0,0 +1,13 @@
+--- a/m4/jh_path_xml_catalog.m4
++++ b/m4/jh_path_xml_catalog.m4
+@@ -40,8 +40,8 @@ AC_DEFUN([JH_CHECK_XML_CATALOG],
+ [
+   AC_REQUIRE([JH_PATH_XML_CATALOG],[JH_PATH_XML_CATALOG(,[:])])dnl
+   AC_MSG_CHECKING([for ifelse([$2],,[$1],[$2]) in XML catalog])
+-  if $jh_found_xmlcatalog && \
+-     AC_RUN_LOG([$XMLCATALOG --noout "$XML_CATALOG_FILE" "$1" >&2]); then
++  # empty argument forces libxml to use XML_CATALOG_FILES variable
++  if AC_RUN_LOG([$XMLCATALOG --noout "" "$1" >&2]); then
+     AC_MSG_RESULT([found])
+     ifelse([$3],,,[$3
+ ])dnl
diff --git a/pkgs/desktops/gnome/core/gnome-control-center/default.nix b/pkgs/desktops/gnome/core/gnome-control-center/default.nix
index c7da1e43a15c..1d2597c02dbb 100644
--- a/pkgs/desktops/gnome/core/gnome-control-center/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-control-center/default.nix
@@ -42,7 +42,7 @@
 , modemmanager
 , mutter
 , networkmanager
-, networkmanagerapplet
+, networkmanager-applet
 , libnma-gtk4
 , ninja
 , pkg-config
@@ -76,8 +76,9 @@ stdenv.mkDerivation rec {
       src = ./paths.patch;
       gcm = gnome-color-manager;
       gnome_desktop = gnome-desktop;
+      networkmanagerapplet = networkmanager-applet;
       inherit glibc libgnomekbd tzdata;
-      inherit cups networkmanagerapplet;
+      inherit cups;
     })
 
     # Fix Online Accounts configuration on X11
diff --git a/pkgs/desktops/gnome/default.nix b/pkgs/desktops/gnome/default.nix
index a0561ca00300..1b5c452288f4 100644
--- a/pkgs/desktops/gnome/default.nix
+++ b/pkgs/desktops/gnome/default.nix
@@ -379,7 +379,7 @@ lib.makeScope pkgs.newScope (self: with self; {
 
   dconf = throw "The ‘gnome.dconf’ alias was removed on 2022-01-13. Please use ‘pkgs.dconf’ directly."; # added 2019-11-30
 
-  networkmanagerapplet = throw "The ‘gnome.networkmanagerapplet’ alias was removed on 2022-01-13. Please use ‘pkgs.networkmanagerapplet’ directly."; # added 2019-12-12
+  networkmanagerapplet = throw "The ‘gnome.networkmanagerapplet’ alias was removed on 2022-01-13. Please use ‘pkgs.networkmanager-applet’ directly."; # added 2019-12-12
 
   glade = throw "The ‘gnome.glade’ alias was removed on 2022-01-13. Please use ‘pkgs.glade’ directly."; # added 2020-05-15
 
diff --git a/pkgs/desktops/pantheon/apps/switchboard-plugs/network/default.nix b/pkgs/desktops/pantheon/apps/switchboard-plugs/network/default.nix
index fbad5aa7a012..0f93d30b19be 100644
--- a/pkgs/desktops/pantheon/apps/switchboard-plugs/network/default.nix
+++ b/pkgs/desktops/pantheon/apps/switchboard-plugs/network/default.nix
@@ -11,7 +11,7 @@
 , granite
 , gtk3
 , networkmanager
-, networkmanagerapplet
+, networkmanager-applet
 , libnma
 , switchboard
 }:
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
   patches = [
     (substituteAll {
       src = ./fix-paths.patch;
-      inherit networkmanagerapplet;
+      networkmanagerapplet = networkmanager-applet;
     })
   ];
 
diff --git a/pkgs/development/libraries/docopt_cpp/default.nix b/pkgs/development/libraries/docopt_cpp/default.nix
index 3de84b684e52..4fae1db9ba3c 100644
--- a/pkgs/development/libraries/docopt_cpp/default.nix
+++ b/pkgs/development/libraries/docopt_cpp/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, python2 }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake, python3 }:
 
 stdenv.mkDerivation rec {
   version = "0.6.3";
@@ -11,7 +11,15 @@ stdenv.mkDerivation rec {
     sha256 = "0cz3vv7g5snfbsqcf3q8bmd6kv5qp84gj3avwkn4vl00krw13bl7";
   };
 
-  nativeBuildInputs = [ cmake python2 ];
+  patches = [
+    (fetchpatch {
+      name = "python3-for-tests";
+      url = "https://github.com/docopt/docopt.cpp/commit/b3d909dc952ab102a4ad5a1541a41736f35b92ba.patch";
+      hash = "sha256-JJR09pbn3QhYaZAIAjs+pe28+g1VfgHUKspWorHzr8o=";
+    })
+  ];
+
+  nativeBuildInputs = [ cmake python3 ];
 
   cmakeFlags = ["-DWITH_TESTS=ON"];
 
diff --git a/pkgs/development/libraries/libinjection/default.nix b/pkgs/development/libraries/libinjection/default.nix
index 81a1398147ba..d4193f32ccc0 100644
--- a/pkgs/development/libraries/libinjection/default.nix
+++ b/pkgs/development/libraries/libinjection/default.nix
@@ -1,5 +1,5 @@
-{ lib, stdenv, fetchFromGitHub
-, python2
+{ lib, stdenv, fetchFromGitHub, fetchpatch
+, python3
 }:
 
 stdenv.mkDerivation rec {
@@ -13,11 +13,19 @@ stdenv.mkDerivation rec {
     sha256 = "0chsgam5dqr9vjfhdcp8cgk7la6nf3lq44zs6z6si98cq743550g";
   };
 
-  nativeBuildInputs = [ python2 ];
+  nativeBuildInputs = [ python3 ];
 
   strictDeps = true;
 
-  patchPhase = ''
+  patches = [
+    (fetchpatch {
+      name = "support-python3-for-building";
+      url = "https://raw.githubusercontent.com/sysown/proxysql/bed58f92917eb651b80fd8ffa627a485eb320805/deps/libinjection/update-build-py3.diff";
+      hash = "sha256-SPdf57FIDDNpatWe5pjhAiZl5yPMDEv50k0Wj+eWTEM=";
+    })
+  ];
+
+  postPatch = ''
     patchShebangs src
     substituteInPlace src/Makefile \
       --replace /usr/local $out
diff --git a/pkgs/development/libraries/zimg/default.nix b/pkgs/development/libraries/zimg/default.nix
index 475ebc7517e5..38b106d474b7 100644
--- a/pkgs/development/libraries/zimg/default.nix
+++ b/pkgs/development/libraries/zimg/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "zimg";
-  version = "3.0.4";
+  version = "3.0.3";
 
   src = fetchFromGitHub {
     owner  = "sekrit-twc";
     repo   = "zimg";
     rev    = "release-${version}";
-    sha256 = "1069x49l7kh1mqcq1h3f0m5j0h832jp5x230bh4c613ymgg5kn00";
+    sha256 = "0pwgf1mybpa3fs13p6jryzm32vfldyql9biwaypqdcimlnlmyk20";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/development/python-modules/breezy/default.nix b/pkgs/development/python-modules/breezy/default.nix
index 3c24d5f31924..64774a70867a 100644
--- a/pkgs/development/python-modules/breezy/default.nix
+++ b/pkgs/development/python-modules/breezy/default.nix
@@ -3,23 +3,36 @@
 , fetchPypi
 , configobj
 , patiencediff
-, six
+, fastbencode
 , fastimport
 , dulwich
 , launchpadlib
 , testtools
+, pythonOlder
+, installShellFiles
 }:
 
 buildPythonPackage rec {
   pname = "breezy";
-  version = "3.2.1";
+  version = "3.2.2";
+
+  disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-4LJo6xoooq8EUoDDfQIa4y1/8XX0ybmfM6rX2wsp2Fw=";
+    sha256 = "sha256-GHpuRSCN0F2BdQc2cgyDcQz0gJT1R+xAgcVxJZVZpNU=";
   };
 
-  propagatedBuildInputs = [ configobj patiencediff six fastimport dulwich launchpadlib ];
+  nativeBuildInputs = [ installShellFiles ];
+
+  propagatedBuildInputs = [
+    configobj
+    fastbencode
+    patiencediff
+    fastimport
+    dulwich
+    launchpadlib
+  ];
 
   checkInputs = [ testtools ];
 
@@ -29,6 +42,8 @@ buildPythonPackage rec {
   # symlink for bazaar compatibility
   postInstall = ''
     ln -s "$out/bin/brz" "$out/bin/bzr"
+
+    installShellCompletion --cmd brz --bash contrib/bash/brz
   '';
 
   pythonImportsCheck = [ "breezy" ];
@@ -36,7 +51,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Friendly distributed version control system";
     homepage = "https://www.breezy-vcs.org/";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     maintainers = [ maintainers.marsam ];
   };
 }
diff --git a/pkgs/development/python-modules/fastbencode/default.nix b/pkgs/development/python-modules/fastbencode/default.nix
new file mode 100644
index 000000000000..87072491cef4
--- /dev/null
+++ b/pkgs/development/python-modules/fastbencode/default.nix
@@ -0,0 +1,26 @@
+{ lib, buildPythonPackage, fetchPypi, python, cython }:
+
+buildPythonPackage rec {
+  pname = "fastbencode";
+  version = "0.0.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-tryavlQtBmN5NSlXb0m6iJFQhVT4XQm11tXtevfgxuQ=";
+  };
+
+  nativeBuildInputs = [ cython ];
+
+  pythonImportsCheck = [ "fastbencode" ];
+
+  checkPhase = ''
+    ${python.interpreter} -m unittest fastbencode.tests.test_suite
+  '';
+
+  meta = with lib; {
+    description = "Fast implementation of bencode";
+    homepage = "https://github.com/breezy-team/fastbencode";
+    license = licenses.gpl2Only;
+    maintainers = [ maintainers.marsam ];
+  };
+}
diff --git a/pkgs/development/python-modules/nvchecker/default.nix b/pkgs/development/python-modules/nvchecker/default.nix
index d4d9cf1811e0..bc650b7eafe1 100644
--- a/pkgs/development/python-modules/nvchecker/default.nix
+++ b/pkgs/development/python-modules/nvchecker/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "nvchecker";
-  version = "2.7";
+  version = "2.8";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "lilydjwg";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-OPUqkHLG8PUlD5NP7q/BpKUvmAA8Jk1NvsPPVbImv0A=";
+    hash = "sha256-ikpjR1fEZBsSOE20jxTyarb9Pqn3Fz+TYOzXp0g4G9c=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/wandb/default.nix b/pkgs/development/python-modules/wandb/default.nix
index f31708baef8b..ef1e1d1198f7 100644
--- a/pkgs/development/python-modules/wandb/default.nix
+++ b/pkgs/development/python-modules/wandb/default.nix
@@ -12,6 +12,7 @@
 , jsonref
 , jsonschema
 , matplotlib
+, nbconvert
 , nbformat
 , pandas
 , pathtools
@@ -36,7 +37,7 @@
 
 buildPythonPackage rec {
   pname = "wandb";
-  version = "0.12.15";
+  version = "0.12.16";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -45,7 +46,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = "client";
     rev = "v${version}";
-    hash = "sha256-Fq+JwUEZP1QDFKYVyiR8DUU0GQV6fK50FW78qaWh+Mo=";
+    hash = "sha256-ZY7nTj93piTEeHhW+H+nQ+ws2dDmmY6u3p7uz296PbA=";
   };
 
   # setuptools is necessary since pkg_resources is required at runtime.
@@ -66,23 +67,6 @@ buildPythonPackage rec {
     shortuuid
   ];
 
-  checkInputs = [
-    azure-core
-    bokeh
-    flask
-    jsonref
-    jsonschema
-    matplotlib
-    nbformat
-    pandas
-    pydantic
-    pytest-mock
-    pytest-xdist
-    pytestCheckHook
-    scikit-learn
-    tqdm
-  ];
-
   # wandb expects git to be in PATH. See https://gist.github.com/samuela/57aeee710e41ab2bf361b7ed8fbbeabf
   # for the error message, and an example usage here: https://github.com/wandb/client/blob/d5f655b7ca7e3eac2f3a67a84bc5c2a664a31baf/wandb/sdk/internal/meta.py#L128.
   # See https://github.com/NixOS/nixpkgs/pull/164176#discussion_r828801621 as to
@@ -93,6 +77,30 @@ buildPythonPackage rec {
     ln -s ${git}/bin/git $out/bin/git
   '';
 
+  preCheck = ''
+    export HOME=$(mktemp -d)
+  '';
+
+  checkInputs = [
+    azure-core
+    bokeh
+    flask
+    jsonref
+    jsonschema
+    matplotlib
+    # Oddly enough, nbclient does not provide the `nbclient` module. Rather it's
+    # available in nbconvert. See https://github.com/NixOS/nixpkgs/issues/171493#issuecomment-1116960488.
+    nbconvert
+    nbformat
+    pandas
+    pydantic
+    pytest-mock
+    pytest-xdist
+    pytestCheckHook
+    scikit-learn
+    tqdm
+  ];
+
   disabledTestPaths = [
     # Tests that try to get chatty over sockets or spin up servers, not possible in the nix build environment.
     "tests/test_cli.py"
diff --git a/pkgs/development/tools/dive/default.nix b/pkgs/development/tools/dive/default.nix
index 581b0db3b35a..d6217671b0c1 100644
--- a/pkgs/development/tools/dive/default.nix
+++ b/pkgs/development/tools/dive/default.nix
@@ -13,8 +13,6 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-0gJ3dAPoilh3IWkuesy8geNsuI1T0DN64XvInc9LvlM=";
 
-  doCheck = false;
-
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = lib.optionals stdenv.isLinux [ btrfs-progs gpgme lvm2 ];
diff --git a/pkgs/development/tools/gosec/default.nix b/pkgs/development/tools/gosec/default.nix
index ac653db1bf02..343ab9624ca6 100644
--- a/pkgs/development/tools/gosec/default.nix
+++ b/pkgs/development/tools/gosec/default.nix
@@ -20,8 +20,6 @@ buildGoModule rec {
     "cmd/gosec"
   ];
 
-  doCheck = false;
-
   ldflags = [
     "-s"
     "-w"
diff --git a/pkgs/development/tools/protoc-gen-entgrpc/default.nix b/pkgs/development/tools/protoc-gen-entgrpc/default.nix
new file mode 100644
index 000000000000..d92b805082a2
--- /dev/null
+++ b/pkgs/development/tools/protoc-gen-entgrpc/default.nix
@@ -0,0 +1,28 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "protoc-gen-entgrpc";
+  version = "0.2.0";
+
+  src = fetchFromGitHub {
+    owner = "ent";
+    repo = "contrib";
+    rev = "v${version}";
+    sha256 = "sha256-cpk8yRDBsupI277NWYFaLCvi3ltQDLgCrcpJ/FUVi9o=";
+  };
+
+  vendorSha256 = "sha256-RwwGFBiasxMmtKMLSyAqvkozqoyzzYuslMq+HnzZUhw=";
+
+  subPackages = [ "entproto/cmd/protoc-gen-entgrpc" ];
+
+  ldflags = [ "-s" "-w" ];
+
+  meta = with lib; {
+    description = "Generator of an implementation of the service interface for ent protobuff";
+    downloadPage = "https://github.com/ent/contrib/";
+    license = licenses.asl20;
+    homepage = "https://entgo.io/";
+    maintainers = with maintainers; [ superherointj ];
+  };
+}
+
diff --git a/pkgs/os-specific/linux/nftables/default.nix b/pkgs/os-specific/linux/nftables/default.nix
index 8485a868d8a5..051ca1963051 100644
--- a/pkgs/os-specific/linux/nftables/default.nix
+++ b/pkgs/os-specific/linux/nftables/default.nix
@@ -8,8 +8,6 @@
 , withXtables ? true , iptables
 }:
 
-with lib;
-
 stdenv.mkDerivation rec {
   version = "1.0.2";
   pname = "nftables";
@@ -28,8 +26,8 @@ stdenv.mkDerivation rec {
   buildInputs = [
     libmnl libnftnl libpcap
     gmp jansson libedit
-  ] ++ optional withXtables iptables
-    ++ optional withPython python3;
+  ] ++ lib.optional withXtables iptables
+    ++ lib.optional withPython python3;
 
   preConfigure = ''
     substituteInPlace ./configure --replace /usr/bin/file ${file}/bin/file
@@ -46,12 +44,12 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--with-json"
     "--with-cli=editline"
-  ] ++ optional (!withDebugSymbols) "--disable-debug"
-    ++ optional (!withPython) "--disable-python"
-    ++ optional withPython "--enable-python"
-    ++ optional withXtables "--with-xtables";
+  ] ++ lib.optional (!withDebugSymbols) "--disable-debug"
+    ++ lib.optional (!withPython) "--disable-python"
+    ++ lib.optional withPython "--enable-python"
+    ++ lib.optional withXtables "--with-xtables";
 
-  meta = {
+  meta = with lib; {
     description = "The project that aims to replace the existing {ip,ip6,arp,eb}tables framework";
     homepage = "https://netfilter.org/projects/nftables/";
     license = licenses.gpl2Only;
diff --git a/pkgs/servers/keycloak/default.nix b/pkgs/servers/keycloak/default.nix
index f28679f2cf5f..95a3ade822c1 100644
--- a/pkgs/servers/keycloak/default.nix
+++ b/pkgs/servers/keycloak/default.nix
@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation rec {
   pname = "keycloak";
-  version = "17.0.1";
+  version = "18.0.0";
 
   src = fetchzip {
     url = "https://github.com/keycloak/keycloak/releases/download/${version}/keycloak-${version}.zip";
-    sha256 = "sha256-z1LfTUoK+v4oQxdyIQruFhl5O333zirSrkPoTFgVfmI=";
+    sha256 = "0fxf9m50hpjplj077z2zjp0qibixz5y4lbc8159cnxbd4gzpkaaf";
   };
 
   nativeBuildInputs = [ makeWrapper jre ];
@@ -57,8 +57,8 @@ stdenv.mkDerivation rec {
   '';
 
   postFixup = ''
-    substituteInPlace $out/bin/kc.sh --replace '-Dkc.home.dir=$DIRNAME/../' '-Dkc.home.dir=$KC_HOME_DIR'
-    substituteInPlace $out/bin/kc.sh --replace '-Djboss.server.config.dir=$DIRNAME/../conf' '-Djboss.server.config.dir=$KC_CONF_DIR'
+    substituteInPlace $out/bin/kc.sh --replace ${lib.escapeShellArg "-Dkc.home.dir='$DIRNAME'/../"} '-Dkc.home.dir=$KC_HOME_DIR'
+    substituteInPlace $out/bin/kc.sh --replace ${lib.escapeShellArg "-Djboss.server.config.dir='$DIRNAME'/../conf"} '-Djboss.server.config.dir=$KC_CONF_DIR'
 
     for script in $(find $out/bin -type f -executable); do
       wrapProgram "$script" --set JAVA_HOME ${jre} --prefix PATH : ${jre}/bin
diff --git a/pkgs/tools/networking/networkmanager/applet/default.nix b/pkgs/tools/networking/networkmanager/applet/default.nix
index cca96577ad4c..512058810913 100644
--- a/pkgs/tools/networking/networkmanager/applet/default.nix
+++ b/pkgs/tools/networking/networkmanager/applet/default.nix
@@ -74,7 +74,7 @@ stdenv.mkDerivation rec {
   passthru = {
     updateScript = gnome.updateScript {
       packageName = pname;
-      attrPath = "networkmanagerapplet";
+      attrPath = "networkmanager-applet";
       versionPolicy = "odd-unstable";
     };
   };
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index cfb1ed919726..3a150e2c7829 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -849,6 +849,7 @@ mapAliases ({
   neap = throw "neap was removed from nixpkgs, as it relies on python2"; # Added 2022-01-12
   netcat-openbsd = throw "'netcat-openbsd' has been renamed to/replaced by 'libressl.nc'"; # Converted to throw 2022-02-22
   netease-cloud-music = throw "netease-cloud-music has been removed together with deepin"; # Added 2020-08-31
+  networkmanagerapplet = networkmanager-applet; # Added 2022-04-30
   networkmanager_fortisslvpn = throw "'networkmanager_fortisslvpn' has been renamed to/replaced by 'networkmanager-fortisslvpn'"; # Converted to throw 2022-02-22
   networkmanager_iodine = throw "'networkmanager_iodine' has been renamed to/replaced by 'networkmanager-iodine'"; # Converted to throw 2022-02-22
   networkmanager_l2tp = throw "'networkmanager_l2tp' has been renamed to/replaced by 'networkmanager-l2tp'"; # Converted to throw 2022-02-22
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index ac174b549f39..6cd884ae7a7d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -406,6 +406,8 @@ with pkgs;
 
   protoc-gen-doc = callPackage ../development/tools/protoc-gen-doc { };
 
+  protoc-gen-entgrpc = callPackage ../development/tools/protoc-gen-entgrpc { };
+
   protoc-gen-go = callPackage ../development/tools/protoc-gen-go { };
 
   protoc-gen-go-grpc = callPackage ../development/tools/protoc-gen-go-grpc { };
@@ -8560,6 +8562,8 @@ with pkgs;
 
   networkmanager = callPackage ../tools/networking/networkmanager { };
 
+  networkmanager-applet = callPackage ../tools/networking/networkmanager/applet { };
+
   networkmanager-iodine = callPackage ../tools/networking/networkmanager/iodine { };
 
   networkmanager-openvpn = callPackage ../tools/networking/networkmanager/openvpn { };
@@ -8576,8 +8580,6 @@ with pkgs;
 
   networkmanager-sstp = callPackage ../tools/networking/networkmanager/sstp { };
 
-  networkmanagerapplet = callPackage ../tools/networking/networkmanager/applet { };
-
   libnma = callPackage ../tools/networking/networkmanager/libnma { };
 
   libnma-gtk4 = libnma.override { withGtk4 = true; };
@@ -26117,6 +26119,10 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) Security;
   };
 
+  firewalld = callPackage ../applications/networking/firewalld { };
+
+  firewalld-gui = firewalld.override { withGui = true; };
+
   flacon = libsForQt5.callPackage ../applications/audio/flacon { };
 
   flexget = callPackage ../applications/networking/flexget { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 079dd9f60805..c00f89978a43 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2841,6 +2841,8 @@ in {
 
   fastavro = callPackage ../development/python-modules/fastavro { };
 
+  fastbencode = callPackage ../development/python-modules/fastbencode { };
+
   fastcache = callPackage ../development/python-modules/fastcache { };
 
   fastcore = callPackage ../development/python-modules/fastcore { };
@@ -5623,6 +5625,11 @@ in {
 
   nextcord = callPackage ../development/python-modules/nextcord { };
 
+  nftables = toPythonModule (pkgs.nftables.override {
+    python3 = python;
+    withPython = true;
+  });
+
   nghttp2 = (toPythonModule (pkgs.nghttp2.override {
     inherit (self) python cython setuptools;
     inherit (pkgs) ncurses;