diff --git a/nixos/tests/dhparams.nix b/nixos/tests/dhparams.nix
index a0de2911777c..021042fafdb1 100644
--- a/nixos/tests/dhparams.nix
+++ b/nixos/tests/dhparams.nix
@@ -1,81 +1,69 @@
-let
-  common = { pkgs, ... }: {
-    security.dhparams.enable = true;
-    environment.systemPackages = [ pkgs.openssl ];
-  };
-
-in import ./make-test-python.nix {
+import ./make-test-python.nix {
   name = "dhparams";
 
-  nodes.generation1 = { pkgs, config, ... }: {
-    imports = [ common ];
-    security.dhparams.params = {
-      # Use low values here because we don't want the test to run for ages.
-      foo.bits = 16;
-      # Also use the old format to make sure the type is coerced in the right
-      # way.
-      bar = 17;
-    };
+  nodes.machine = { pkgs, ... }: {
+    security.dhparams.enable = true;
+    environment.systemPackages = [ pkgs.openssl ];
 
-    systemd.services.foo = {
-      description = "Check systemd Ordering";
-      wantedBy = [ "multi-user.target" ];
-      unitConfig = {
-        # This is to make sure that the dhparams generation of foo occurs
-        # before this service so we need this service to start as early as
-        # possible to provoke a race condition.
-        DefaultDependencies = false;
+    specialisation = {
+      gen1.configuration = { config, ... }: {
+        security.dhparams.params = {
+          # Use low values here because we don't want the test to run for ages.
+          foo.bits = 1024;
+          # Also use the old format to make sure the type is coerced in the right
+          # way.
+          bar = 1025;
+        };
 
-        # We check later whether the service has been started or not.
-        ConditionPathExists = config.security.dhparams.params.foo.path;
+        systemd.services.foo = {
+          description = "Check systemd Ordering";
+          wantedBy = [ "multi-user.target" ];
+          unitConfig = {
+            # This is to make sure that the dhparams generation of foo occurs
+            # before this service so we need this service to start as early as
+            # possible to provoke a race condition.
+            DefaultDependencies = false;
+
+            # We check later whether the service has been started or not.
+            ConditionPathExists = config.security.dhparams.params.foo.path;
+          };
+          serviceConfig.Type = "oneshot";
+          serviceConfig.RemainAfterExit = true;
+          # The reason we only provide an ExecStop here is to ensure that we don't
+          # accidentally trigger an error because a file system is not yet ready
+          # during very early startup (we might not even have the Nix store
+          # available, for example if future changes in NixOS use systemd mount
+          # units to do early file system initialisation).
+          serviceConfig.ExecStop = "${pkgs.coreutils}/bin/true";
+        };
+      };
+      gen2.configuration = {
+        security.dhparams.params.foo.bits = 1026;
+      };
+      gen3.configuration =  {};
+      gen4.configuration = {
+        security.dhparams.stateful = false;
+        security.dhparams.params.foo2.bits = 1027;
+        security.dhparams.params.bar2.bits = 1028;
+      };
+      gen5.configuration = {
+        security.dhparams.defaultBitSize = 1029;
+        security.dhparams.params.foo3 = {};
+        security.dhparams.params.bar3 = {};
       };
-      serviceConfig.Type = "oneshot";
-      serviceConfig.RemainAfterExit = true;
-      # The reason we only provide an ExecStop here is to ensure that we don't
-      # accidentally trigger an error because a file system is not yet ready
-      # during very early startup (we might not even have the Nix store
-      # available, for example if future changes in NixOS use systemd mount
-      # units to do early file system initialisation).
-      serviceConfig.ExecStop = "${pkgs.coreutils}/bin/true";
     };
   };
 
-  nodes.generation2 = {
-    imports = [ common ];
-    security.dhparams.params.foo.bits = 18;
-  };
-
-  nodes.generation3 = common;
-
-  nodes.generation4 = {
-    imports = [ common ];
-    security.dhparams.stateful = false;
-    security.dhparams.params.foo2.bits = 18;
-    security.dhparams.params.bar2.bits = 19;
-  };
-
-  nodes.generation5 = {
-    imports = [ common ];
-    security.dhparams.defaultBitSize = 30;
-    security.dhparams.params.foo3 = {};
-    security.dhparams.params.bar3 = {};
-  };
-
   testScript = { nodes, ... }: let
     getParamPath = gen: name: let
-      node = "generation${toString gen}";
-    in nodes.${node}.config.security.dhparams.params.${name}.path;
+      node = "gen${toString gen}";
+    in nodes.machine.config.specialisation.${node}.configuration.security.dhparams.params.${name}.path;
 
     switchToGeneration = gen: let
-      node = "generation${toString gen}";
-      inherit (nodes.${node}.config.system.build) toplevel;
-      switchCmd = "${toplevel}/bin/switch-to-configuration test";
+      switchCmd = "${nodes.machine.config.system.build.toplevel}/specialisation/gen${toString gen}/bin/switch-to-configuration test";
     in ''
       with machine.nested("switch to generation ${toString gen}"):
-          machine.succeed(
-              "${switchCmd}"
-          )
-          machine = ${node}
+        machine.succeed("${switchCmd}")
     '';
 
   in ''
@@ -92,22 +80,20 @@ in import ./make-test-python.nix {
             if match[1] != str(bits):
                 raise Exception(f"bit size should be {bits} but it is {match[1]} instead.")
 
-
-    machine = generation1
-
     machine.wait_for_unit("multi-user.target")
+    ${switchToGeneration 1}
 
     with subtest("verify startup order"):
         machine.succeed("systemctl is-active foo.service")
 
     with subtest("check bit sizes of dhparam files"):
-        assert_param_bits("${getParamPath 1 "foo"}", 16)
-        assert_param_bits("${getParamPath 1 "bar"}", 17)
+        assert_param_bits("${getParamPath 1 "foo"}", 1024)
+        assert_param_bits("${getParamPath 1 "bar"}", 1025)
 
     ${switchToGeneration 2}
 
     with subtest("check whether bit size has changed"):
-        assert_param_bits("${getParamPath 2 "foo"}", 18)
+        assert_param_bits("${getParamPath 2 "foo"}", 1026)
 
     with subtest("ensure that dhparams file for 'bar' was deleted"):
         machine.fail("test -e ${getParamPath 1 "bar"}")
@@ -115,16 +101,16 @@ in import ./make-test-python.nix {
     ${switchToGeneration 3}
 
     with subtest("ensure that 'security.dhparams.path' has been deleted"):
-        machine.fail("test -e ${nodes.generation3.config.security.dhparams.path}")
+        machine.fail("test -e ${nodes.machine.config.specialisation.gen3.configuration.security.dhparams.path}")
 
     ${switchToGeneration 4}
 
     with subtest("check bit sizes dhparam files"):
         assert_param_bits(
-            "${getParamPath 4 "foo2"}", 18
+            "${getParamPath 4 "foo2"}", 1027
         )
         assert_param_bits(
-            "${getParamPath 4 "bar2"}", 19
+            "${getParamPath 4 "bar2"}", 1028
         )
 
     with subtest("check whether dhparam files are in the Nix store"):
@@ -136,7 +122,7 @@ in import ./make-test-python.nix {
     ${switchToGeneration 5}
 
     with subtest("check whether defaultBitSize works as intended"):
-        assert_param_bits("${getParamPath 5 "foo3"}", 30)
-        assert_param_bits("${getParamPath 5 "bar3"}", 30)
+        assert_param_bits("${getParamPath 5 "foo3"}", 1029)
+        assert_param_bits("${getParamPath 5 "bar3"}", 1029)
   '';
 }
diff --git a/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix b/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
index ad3708d11b09..d3c3d5890858 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
@@ -507,6 +507,16 @@ let
           packageRequires = with self; [ evil highlight ];
         });
 
+        hamlet-mode = super.hamlet-mode.overrideAttrs (attrs: {
+          patches = [
+            # Fix build; maintainer email fails to parse
+            (pkgs.fetchpatch {
+              url = "https://github.com/lightquake/hamlet-mode/commit/253495d1330d6ec88d97fac136c78f57c650aae0.patch";
+              sha256 = "dSxS5yuXzCW96CUyvJWwjkhf1FMGBfiKKoBxeDVdz9Y=";
+            })
+          ];
+        });
+
         helm-rtags = fix-rtags super.helm-rtags;
 
         # tries to write to $HOME
diff --git a/pkgs/applications/editors/emacs/elisp-packages/recipes-archive-melpa.json b/pkgs/applications/editors/emacs/elisp-packages/recipes-archive-melpa.json
index 1a630831d89a..976f55767366 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/recipes-archive-melpa.json
+++ b/pkgs/applications/editors/emacs/elisp-packages/recipes-archive-melpa.json
@@ -47279,20 +47279,20 @@
   "repo": "lifeisfoo/emacs-grails",
   "unstable": {
    "version": [
-    20220407,
-    1847
+    20221110,
+    929
    ],
-   "commit": "350869ecc4f429fc4e26f826d6050d068e724c5d",
-   "sha256": "1zw8hh97jlxjdgi5spsfd40qgahwbcca2cg2wbqyn1pgq4rjdx0i"
+   "commit": "3019f86e555ee94388795a0475cfa213e3897bbb",
+   "sha256": "PpdaJ5ccAEwS7uC7YkDP4++ZexG7goDXsFEcHZhDdJ4="
   },
   "stable": {
    "version": [
     0,
     5,
-    0
+    1
    ],
-   "commit": "350869ecc4f429fc4e26f826d6050d068e724c5d",
-   "sha256": "1zw8hh97jlxjdgi5spsfd40qgahwbcca2cg2wbqyn1pgq4rjdx0i"
+   "commit": "3019f86e555ee94388795a0475cfa213e3897bbb",
+   "sha256": "PpdaJ5ccAEwS7uC7YkDP4++ZexG7goDXsFEcHZhDdJ4="
   }
  },
  {
diff --git a/pkgs/applications/misc/qMasterPassword/default.nix b/pkgs/applications/misc/qMasterPassword/default.nix
index af0c1d6ca6f3..2cdc3bdd9f3a 100644
--- a/pkgs/applications/misc/qMasterPassword/default.nix
+++ b/pkgs/applications/misc/qMasterPassword/default.nix
@@ -1,18 +1,30 @@
-{ lib, stdenv, mkDerivation, fetchFromGitHub, qtbase, qmake, qttools, libX11, libXtst, openssl, libscrypt }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, libX11
+, libXtst
+, qmake
+, qtbase
+, qttools
+, qtwayland
+, openssl
+, libscrypt
+, wrapQtAppsHook
+}:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "qMasterPassword";
-  version = "1.2.3";
+  version = "1.2.4";
 
   src = fetchFromGitHub {
     owner = "bkueng";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-eUJD9FoGaDzADKm3wZHs5Bhdt7RoM1WTTVNP6xUV7gs=";
+    sha256 = "sha256-VQ1ZkXaZ5sUbtWa/GreTr5uXvnZ2Go6owJ2ZBK25zns=";
   };
 
-  buildInputs = [ qtbase libX11 libXtst openssl libscrypt ];
-  nativeBuildInputs = [ qmake qttools ];
+  buildInputs = [ qtbase qtwayland libX11 libXtst openssl libscrypt ];
+  nativeBuildInputs = [ qmake qttools wrapQtAppsHook ];
 
   # Upstream install is mostly defunct. It hardcodes target.path and doesn't
   # install anything but the binary.
@@ -46,7 +58,7 @@ mkDerivation rec {
     '';
     homepage = "https://github.com/bkueng/qMasterPassword";
     license = licenses.gpl3;
-    maintainers = [ maintainers.tadeokondrak ];
+    maintainers = with lib.maintainers; [ tadeokondrak teutat3s ];
     platforms = platforms.all;
   };
 }
diff --git a/pkgs/applications/networking/cluster/kubernetes/default.nix b/pkgs/applications/networking/cluster/kubernetes/default.nix
index 58d63c63a7fd..1ba1fd6c1338 100644
--- a/pkgs/applications/networking/cluster/kubernetes/default.nix
+++ b/pkgs/applications/networking/cluster/kubernetes/default.nix
@@ -20,13 +20,13 @@
 
 buildGoModule rec {
   pname = "kubernetes";
-  version = "1.25.3";
+  version = "1.25.4";
 
   src = fetchFromGitHub {
     owner = "kubernetes";
     repo = "kubernetes";
     rev = "v${version}";
-    sha256 = "sha256-UDulyX1PXyAe4cqtekOY1nmQnmMqVLFuHnCswFfE6v0=";
+    sha256 = "sha256-1k0L8QUj/764X0Y7qxjFMnatTGKeRPBUroHjSMMe5M4=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/applications/networking/cluster/roxctl/default.nix b/pkgs/applications/networking/cluster/roxctl/default.nix
index 2f1a6dbbd516..e2426fc7d56d 100644
--- a/pkgs/applications/networking/cluster/roxctl/default.nix
+++ b/pkgs/applications/networking/cluster/roxctl/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "roxctl";
-  version = "3.72.1";
+  version = "3.72.2";
 
   src = fetchFromGitHub {
     owner = "stackrox";
     repo = "stackrox";
     rev = version;
-    sha256 = "sha256-I6Sq5i2rkr447gxFRw2C0IV6WnFIpGHyp12NA8IUYKg=";
+    sha256 = "sha256-qw45Ifp8JcJyKaKL1St0HAQGS7JiUestiPGyZcV3gx8=";
   };
 
   vendorSha256 = "sha256-FmpnRgU3w2zthgUJuAG5AqLl2UxMb0yywN5Sk9WoWBI=";
diff --git a/pkgs/applications/office/onlyoffice-bin/default.nix b/pkgs/applications/office/onlyoffice-bin/default.nix
index 7ca12b234271..62e97670c2b6 100644
--- a/pkgs/applications/office/onlyoffice-bin/default.nix
+++ b/pkgs/applications/office/onlyoffice-bin/default.nix
@@ -73,11 +73,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "onlyoffice-desktopeditors";
-  version = "7.1.0";
+  version = "7.2.0";
   minor = null;
   src = fetchurl {
     url = "https://github.com/ONLYOFFICE/DesktopEditors/releases/download/v${version}/onlyoffice-desktopeditors_amd64.deb";
-    sha256 = "sha256-40IUAmg7PnfYrdTj7TVbfvb9ey0/zzswu+sJllAIktg=";
+    sha256 = "sha256-O9gC/b5/eZ1YImuXpEZOJhI1rzCNuFrm5IqablnYo9Y=";
   };
 
   nativeBuildInputs = [
@@ -109,6 +109,7 @@ stdenv.mkDerivation rec {
     qt5.qtbase
     qt5.qtdeclarative
     qt5.qtsvg
+    qt5.qtwayland
     xorg.libX11
     xorg.libxcb
     xorg.libXcomposite
diff --git a/pkgs/applications/science/logic/cbmc/default.nix b/pkgs/applications/science/logic/cbmc/default.nix
index e5c16695624b..0c2b497e9cc4 100644
--- a/pkgs/applications/science/logic/cbmc/default.nix
+++ b/pkgs/applications/science/logic/cbmc/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cbmc";
-  version = "5.69.1";
+  version = "5.70.0";
 
   src = fetchFromGitHub {
     owner = "diffblue";
     repo = pname;
     rev = "${pname}-${version}";
-    sha256 = "sha256-1HwR+MM2AUrx07knBDJg+xCm0/cyGzYGQ2LvJUxXEyE=";
+    sha256 = "sha256-fzc/WrHo+B9oscnTqN8nETcKc34aq4fUX8VLpYJUvRY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/virtualization/podman/default.nix b/pkgs/applications/virtualization/podman/default.nix
index 85a59c56b2ca..dabf52ca88af 100644
--- a/pkgs/applications/virtualization/podman/default.nix
+++ b/pkgs/applications/virtualization/podman/default.nix
@@ -18,13 +18,13 @@
 
 buildGoModule rec {
   pname = "podman";
-  version = "4.3.0";
+  version = "4.3.1";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "podman";
     rev = "v${version}";
-    sha256 = "sha256-wp3Dd5bhLd/eq926C+MpzMWoxieJRAslt1beZU/WbeU=";
+    sha256 = "sha256-UOAQtGDoZe+Av4+9RQCJiV3//B/pdF0pEsca4FonGxY=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/development/libraries/aws-c-compression/default.nix b/pkgs/development/libraries/aws-c-compression/default.nix
index 8627ea5b8931..45ab56edae2f 100644
--- a/pkgs/development/libraries/aws-c-compression/default.nix
+++ b/pkgs/development/libraries/aws-c-compression/default.nix
@@ -2,6 +2,7 @@
 , fetchFromGitHub
 , aws-c-common
 , cmake
+, nix
 }:
 
 stdenv.mkDerivation rec {
@@ -27,6 +28,10 @@ stdenv.mkDerivation rec {
     "-DBUILD_SHARED_LIBS=ON"
   ];
 
+  passthru.tests = {
+    inherit nix;
+  };
+
   meta = with lib; {
     description = "C99 implementation of huffman encoding/decoding";
     homepage = "https://github.com/awslabs/aws-c-compression";
diff --git a/pkgs/development/libraries/aws-c-sdkutils/default.nix b/pkgs/development/libraries/aws-c-sdkutils/default.nix
index eddefef02381..3022cf462746 100644
--- a/pkgs/development/libraries/aws-c-sdkutils/default.nix
+++ b/pkgs/development/libraries/aws-c-sdkutils/default.nix
@@ -2,6 +2,7 @@
 , fetchFromGitHub
 , aws-c-common
 , cmake
+, nix
 }:
 
 stdenv.mkDerivation rec {
@@ -29,6 +30,10 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
+  passthru.tests = {
+    inherit nix;
+  };
+
   meta = with lib; {
     description = "AWS SDK utility library";
     homepage = "https://github.com/awslabs/aws-c-sdkutils";
diff --git a/pkgs/development/libraries/aws-checksums/default.nix b/pkgs/development/libraries/aws-checksums/default.nix
index 4f5c34655672..d820b0c71930 100644
--- a/pkgs/development/libraries/aws-checksums/default.nix
+++ b/pkgs/development/libraries/aws-checksums/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, aws-c-common }:
+{ lib, stdenv, fetchFromGitHub, cmake, aws-c-common, nix }:
 
 stdenv.mkDerivation rec {
   pname = "aws-checksums";
@@ -19,6 +19,10 @@ stdenv.mkDerivation rec {
     "-DBUILD_SHARED_LIBS=ON"
   ];
 
+  passthru.tests = {
+    inherit nix;
+  };
+
   meta = with lib; {
     description = "HW accelerated CRC32c and CRC32";
     homepage = "https://github.com/awslabs/aws-checksums";
diff --git a/pkgs/development/libraries/aws-crt-cpp/default.nix b/pkgs/development/libraries/aws-crt-cpp/default.nix
index c7eac8474cb4..3d4b31ad57d1 100644
--- a/pkgs/development/libraries/aws-crt-cpp/default.nix
+++ b/pkgs/development/libraries/aws-crt-cpp/default.nix
@@ -12,6 +12,7 @@
 , aws-checksums
 , cmake
 , s2n-tls
+, nix
 }:
 
 stdenv.mkDerivation rec {
@@ -65,6 +66,10 @@ stdenv.mkDerivation rec {
     moveToOutput lib/aws-crt-cpp/cmake "$dev"
   '';
 
+  passthru.tests = {
+    inherit nix;
+  };
+
   meta = with lib; {
     description = "C++ wrapper around the aws-c-* libraries";
     homepage = "https://github.com/awslabs/aws-crt-cpp";
diff --git a/pkgs/development/libraries/libyang/default.nix b/pkgs/development/libraries/libyang/default.nix
index 040bc4758076..2bf595aae1ba 100644
--- a/pkgs/development/libraries/libyang/default.nix
+++ b/pkgs/development/libraries/libyang/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libyang";
-  version = "2.0.231";
+  version = "2.1.4";
 
   src = fetchFromGitHub {
     owner = "CESNET";
     repo = "libyang";
     rev = "v${version}";
-    sha256 = "sha256-IntucM8ABJsJNH7XnZ59McwmfSIimclrWzSz4NKdMrE=";
+    sha256 = "sha256-qmJHCADFqxjnxdDYxGmgZId3pxxgB8kw2UGBwYGauOc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/misc/brev-cli/default.nix b/pkgs/development/misc/brev-cli/default.nix
index 0ab4680b9294..2ef54ede28b5 100644
--- a/pkgs/development/misc/brev-cli/default.nix
+++ b/pkgs/development/misc/brev-cli/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "brev-cli";
-  version = "0.6.153";
+  version = "0.6.160";
 
   src = fetchFromGitHub {
     owner = "brevdev";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-v9jkQoamLiH8LsBmqNwUrnAvXamMHxhJ94SXFgdt9Cc=";
+    sha256 = "sha256-F6MQqIYyBSURU7R6RmlGai57Ajf6Ks4o0zfFi7LzE+g=";
   };
 
   vendorSha256 = "sha256-cNwfK1LpguRfM/ORebU6v+JLIxDJdT5y+zM3KmEamEw=";
diff --git a/pkgs/development/node-packages/overrides.nix b/pkgs/development/node-packages/overrides.nix
index 407879af045c..bbddad0f1e5e 100644
--- a/pkgs/development/node-packages/overrides.nix
+++ b/pkgs/development/node-packages/overrides.nix
@@ -280,7 +280,7 @@ final: prev: {
     '';
   };
 
-  manta = prev.manta.override {
+  manta = prev.manta.override ( oldAttrs: {
     nativeBuildInputs = with pkgs; [ nodejs-14_x installShellFiles ];
     postInstall = ''
       # create completions, following upstream procedure https://github.com/joyent/node-manta/blob/v5.2.3/Makefile#L85-L91
@@ -291,7 +291,8 @@ final: prev: {
         installShellCompletion --cmd $cmd --bash <(./bin/$cmd --completion)
       done
     '';
-  };
+    meta = oldAttrs.meta // { maintainers = with lib.maintainers; [ teutat3s ]; };
+  });
 
   mermaid-cli = prev."@mermaid-js/mermaid-cli".override (
   if stdenv.isDarwin
@@ -533,12 +534,13 @@ final: prev: {
     '';
   };
 
-  triton = prev.triton.override {
+  triton = prev.triton.override (oldAttrs: {
     nativeBuildInputs = [ pkgs.installShellFiles ];
     postInstall = ''
       installShellCompletion --cmd triton --bash <($out/bin/triton completion)
     '';
-  };
+    meta = oldAttrs.meta // { maintainers = with lib.maintainers; [ teutat3s ]; };
+  });
 
   ts-node = prev.ts-node.override {
     nativeBuildInputs = [ pkgs.buildPackages.makeWrapper ];
diff --git a/pkgs/development/ocaml-modules/bisect_ppx/default.nix b/pkgs/development/ocaml-modules/bisect_ppx/default.nix
index fdfc61e73c34..4ecfea79e155 100644
--- a/pkgs/development/ocaml-modules/bisect_ppx/default.nix
+++ b/pkgs/development/ocaml-modules/bisect_ppx/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, buildDunePackage, cmdliner, ppxlib }:
+{ lib, fetchFromGitHub, fetchpatch, buildDunePackage, cmdliner, ppxlib }:
 
 buildDunePackage rec {
   pname = "bisect_ppx";
@@ -11,8 +11,22 @@ buildDunePackage rec {
     sha256 = "sha256-pOeeSxzUF1jXQjA71atSZALdgQ2NB9qpKo5iaDnPwhQ=";
   };
 
-  minimumOCamlVersion = "4.08";
-  useDune2 = true;
+  patches = lib.optionals (lib.versionAtLeast ppxlib.version "0.26.0") [
+    # Ppxlib >= 0.26.0 compatibility
+    # remove when a new version is released
+    (fetchpatch {
+      name = "${pname}-${version}-ppxlib-0.26-compatibility.patch";
+      url = "https://patch-diff.githubusercontent.com/raw/aantron/bisect_ppx/pull/400.patch";
+      sha256 = "sha256-WAn6+d6pMUr79LVugOENuh9s0gbVEcTg0rxXMz1P3ak=";
+    })
+    (fetchpatch {
+      name = "${pname}-${version}-ppxlib-0.28-compatibility.patch";
+      url = "https://github.com/anmonteiro/bisect_ppx/commit/cc442a08e3a2e0e18deb48f3a696076ac0986728.patch";
+      sha256 = "sha256-pPHhmtd81eWhQd4X0gfZNPYT75+EkurwivP7acfJbNc=";
+    })
+  ];
+
+  minimalOCamlVersion = "4.08";
 
   buildInputs = [
     cmdliner
diff --git a/pkgs/development/ocaml-modules/gen_js_api/default.nix b/pkgs/development/ocaml-modules/gen_js_api/default.nix
index e0474cdac6a8..4baa21c57cf1 100644
--- a/pkgs/development/ocaml-modules/gen_js_api/default.nix
+++ b/pkgs/development/ocaml-modules/gen_js_api/default.nix
@@ -9,16 +9,16 @@
 
 buildDunePackage rec {
   pname = "gen_js_api";
-  version = "1.0.9";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "LexiFi";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1qx6if1avr484bl9x1h0cksdc6gqw5i4pwzdr27h46hppnnvi8y8";
+    sha256 = "sha256-0FKKYPbSBza/Q6oZniq/UHi5zBjD/i7j5ds3ZDWkBTs=";
   };
 
-  minimalOCamlVersion = "4.08";
+  minimalOCamlVersion = "4.11";
 
   propagatedBuildInputs = [ ojs ppxlib ];
   checkInputs = [ js_of_ocaml-compiler nodejs ];
diff --git a/pkgs/development/ocaml-modules/gen_js_api/ojs.nix b/pkgs/development/ocaml-modules/gen_js_api/ojs.nix
index 722f9fa7f6e1..381fda7acd93 100644
--- a/pkgs/development/ocaml-modules/gen_js_api/ojs.nix
+++ b/pkgs/development/ocaml-modules/gen_js_api/ojs.nix
@@ -1,5 +1,6 @@
 { buildDunePackage
 , gen_js_api
+, js_of_ocaml-compiler
 }:
 
 buildDunePackage rec {
@@ -7,6 +8,8 @@ buildDunePackage rec {
 
   inherit (gen_js_api) version src;
 
+  propagatedBuildInputs = [ js_of_ocaml-compiler ];
+
   doCheck = false; # checks depend on gen_js_api, which is a cycle
 
   minimalOCamlVersion = "4.08";
diff --git a/pkgs/development/ocaml-modules/janestreet/0.14.nix b/pkgs/development/ocaml-modules/janestreet/0.14.nix
index 68c633b800a6..67d0e6c7896e 100644
--- a/pkgs/development/ocaml-modules/janestreet/0.14.nix
+++ b/pkgs/development/ocaml-modules/janestreet/0.14.nix
@@ -613,7 +613,7 @@ with self;
     minimumOCamlVersion = "4.04.2";
     hash = "0dbri9d00ydi0dw1cavswnqdmhjaaz80vap29ns2lr6mhhlvyjmj";
     meta.description = "[@@deriving] plugin to generate S-expression conversion functions";
-    propagatedBuildInputs = [ ppxlib sexplib0 base ];
+    propagatedBuildInputs = [ (ppxlib.override { version = "0.24.0"; }) sexplib0 base ];
   };
 
   ppx_sexp_message = janePackage {
diff --git a/pkgs/development/ocaml-modules/janestreet/0.15.nix b/pkgs/development/ocaml-modules/janestreet/0.15.nix
index 3a4a20822c80..19d0219e384d 100644
--- a/pkgs/development/ocaml-modules/janestreet/0.15.nix
+++ b/pkgs/development/ocaml-modules/janestreet/0.15.nix
@@ -740,8 +740,9 @@ with self;
 
   ppx_sexp_conv = janePackage {
     pname = "ppx_sexp_conv";
-    minimumOCamlVersion = "4.04.2";
-    hash = "1fyf7hgxprn7pj58rmmrfpv938a0avpzvvk6wzihpmfm6whgbdm8";
+    version = "0.15.1";
+    minimalOCamlVersion = "4.08.0";
+    hash = "sha256-NYknZHyDklr71hihM2pPFQ7uAKkuKO2DJkjtsF+xc5g=";
     meta.description = "[@@deriving] plugin to generate S-expression conversion functions";
     propagatedBuildInputs = [ ppxlib sexplib0 base ];
   };
diff --git a/pkgs/development/ocaml-modules/piqi-ocaml/default.nix b/pkgs/development/ocaml-modules/piqi-ocaml/default.nix
index 39869765349b..09f2bd351837 100644
--- a/pkgs/development/ocaml-modules/piqi-ocaml/default.nix
+++ b/pkgs/development/ocaml-modules/piqi-ocaml/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, fetchpatch, ocaml, findlib, piqi, stdlib-shims, num }:
 
 stdenv.mkDerivation rec {
-  version = "0.7.7";
+  version = "0.7.8";
   pname = "piqi-ocaml";
   name = "ocaml${ocaml.version}-${pname}-${version}";
 
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     owner = "alavrik";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1913jpsb8mvqi8609j4g4sm5jhg50dq0xqxgy8nmvknfryyc89nm";
+    sha256 = "sha256-6Luq49sbo+AqLSq57mc6fLhrRx0K6G5LCUIzkGPfqYo=";
   };
 
   nativeBuildInputs = [ ocaml findlib ];
diff --git a/pkgs/development/ocaml-modules/piqi/default.nix b/pkgs/development/ocaml-modules/piqi/default.nix
index f9eb09987fb9..ec8231285827 100644
--- a/pkgs/development/ocaml-modules/piqi/default.nix
+++ b/pkgs/development/ocaml-modules/piqi/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, ocaml, findlib, which, sedlex, easy-format, xmlm, base64 }:
 
 stdenv.mkDerivation rec {
-  version = "0.6.15";
+  version = "0.6.16";
   pname = "piqi";
   name = "ocaml${ocaml.version}-${pname}-${version}";
 
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     owner = "alavrik";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0v04hs85xv6d4ysqxyv1dik34dx49yab9shpi4x7iv19qlzl7csb";
+    sha256 = "sha256-qE+yybTn+kzbY0h8udhZYO+GwQPI/J/6p3LMmF12cFU=";
   };
 
   nativeBuildInputs = [ ocaml findlib which ];
diff --git a/pkgs/development/ocaml-modules/ppx_deriving_cmdliner/default.nix b/pkgs/development/ocaml-modules/ppx_deriving_cmdliner/default.nix
index ec160b2fc9fb..5bf70a056507 100644
--- a/pkgs/development/ocaml-modules/ppx_deriving_cmdliner/default.nix
+++ b/pkgs/development/ocaml-modules/ppx_deriving_cmdliner/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildDunePackage
 , fetchFromGitHub
+, fetchpatch
 , alcotest
 , cmdliner
 , ppx_deriving
@@ -12,7 +13,7 @@ buildDunePackage rec {
   pname = "ppx_deriving_cmdliner";
   version = "0.6.1";
 
-  minimalOCamlVersion = "4.08";
+  minimalOCamlVersion = "4.11";
 
   src = fetchFromGitHub {
     owner = "hammerlab";
@@ -21,6 +22,15 @@ buildDunePackage rec {
     sha256 = "sha256-/22KLQnxu3e2ZSca6ZLxTJDfv/rsmgCUkJnZC0RwRi8";
   };
 
+  patches = [
+    # Ppxlib.0.26.0 compatibility
+    # remove when a new version is released
+    (fetchpatch {
+      url = "https://patch-diff.githubusercontent.com/raw/hammerlab/ppx_deriving_cmdliner/pull/50.patch";
+      sha256 = "sha256-FfUfEAsyobwZ99+s5sFAaCE6Xgx7jLr/q79OxDbGcvQ=";
+    })
+  ];
+
   propagatedBuildInputs = [
     cmdliner
     ppx_deriving
diff --git a/pkgs/development/ocaml-modules/ppx_deriving_yojson/default.nix b/pkgs/development/ocaml-modules/ppx_deriving_yojson/default.nix
index bef60b3f381c..4fef3c0619f3 100644
--- a/pkgs/development/ocaml-modules/ppx_deriving_yojson/default.nix
+++ b/pkgs/development/ocaml-modules/ppx_deriving_yojson/default.nix
@@ -2,19 +2,27 @@
 , ppx_deriving, yojson
 }:
 
+let param =
+  if lib.versionAtLeast ppxlib.version "0.26" then {
+    version = "3.7.0";
+    sha256 = "sha256-niKxn1fX0mL1MhlZvbN1wgRed9AHh+z9s6l++k1VX9k=";
+  }  else {
+    version = "3.6.1";
+    sha256 = "1icz5h6p3pfj7my5gi7wxpflrb8c902dqa17f9w424njilnpyrbk";
+  }
+; in
+
 buildDunePackage rec {
   pname = "ppx_deriving_yojson";
-  version = "3.6.1";
+  inherit (param) version;
 
-  useDune2 = true;
-
-  minimumOCamlVersion = "4.07";
+  minimalOCamlVersion = "4.07";
 
   src = fetchFromGitHub {
     owner = "ocaml-ppx";
     repo = "ppx_deriving_yojson";
     rev = "v${version}";
-    sha256 = "1icz5h6p3pfj7my5gi7wxpflrb8c902dqa17f9w424njilnpyrbk";
+    inherit (param) sha256;
   };
 
   propagatedBuildInputs = [ ppxlib ppx_deriving yojson ];
diff --git a/pkgs/development/ocaml-modules/ppx_import/default.nix b/pkgs/development/ocaml-modules/ppx_import/default.nix
index 192e7258c4c5..3a59b217e8f2 100644
--- a/pkgs/development/ocaml-modules/ppx_import/default.nix
+++ b/pkgs/development/ocaml-modules/ppx_import/default.nix
@@ -1,18 +1,29 @@
 { lib
 , fetchurl
 , buildDunePackage
+, ocaml
 , ounit
 , ppx_deriving
 , ppx_sexp_conv
 , ppxlib
+, version ? if lib.versionAtLeast ocaml.version "4.11" then "1.10.0" else "1.9.1"
 }:
 
+let param = {
+  "1.9.1" = {
+    sha256 = "sha256-0bSY4u44Ds84XPIbcT5Vt4AG/4PkzFKMl9CDGFZyIdI=";
+  };
+  "1.10.0" = {
+    sha256 = "sha256-MA8sf0F7Ch1wJDL8E8470ukKx7KieWyjWJnJQsqBVW8=";
+  };
+}."${version}"; in
+
 lib.throwIfNot (lib.versionAtLeast ppxlib.version "0.24.0")
   "ppx_import is not available with ppxlib-${ppxlib.version}"
 
 buildDunePackage rec {
   pname = "ppx_import";
-  version = "1.9.1";
+  inherit version;
 
   useDune2 = true;
 
@@ -20,7 +31,7 @@ buildDunePackage rec {
 
   src = fetchurl {
     url = "https://github.com/ocaml-ppx/ppx_import/releases/download/${version}/ppx_import-${version}.tbz";
-    sha256 = "1li1f9b1i0yhjy655k74hgzhd05palz726zjbhwcy3iqxvi9id6i";
+    inherit (param) sha256;
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/ocaml-modules/ppxlib/default.nix b/pkgs/development/ocaml-modules/ppxlib/default.nix
index 2b7feddfa89b..92090c244142 100644
--- a/pkgs/development/ocaml-modules/ppxlib/default.nix
+++ b/pkgs/development/ocaml-modules/ppxlib/default.nix
@@ -2,7 +2,8 @@
 , version ?
   if lib.versionAtLeast ocaml.version "4.07"
   then if lib.versionAtLeast ocaml.version "4.08"
-  then "0.24.0" else "0.15.0" else "0.13.0"
+  then if lib.versionAtLeast ocaml.version "4.11"
+  then "0.28.0" else "0.24.0" else "0.15.0" else "0.13.0"
 , ocaml-compiler-libs, ocaml-migrate-parsetree, ppx_derivers, stdio
 , stdlib-shims, ocaml-migrate-parsetree-2
 }:
@@ -46,6 +47,10 @@ let param = {
     sha256 = "sha256-wuG7cUZiVP2PdM+nZloip7lGGiWn6Wpkh2YoF/Fuc9o=";
     min_version = "4.07";
   };
+  "0.28.0" = {
+    sha256 = "sha256-i/U++sosKQUjyxu9GscPb1Gfv2a3Hbmj+UgIZlewnCo=";
+    min_version = "4.07";
+  };
 }."${version}"; in
 
 if param ? max_version && lib.versionAtLeast ocaml.version param.max_version
diff --git a/pkgs/development/ocaml-modules/sedlex/default.nix b/pkgs/development/ocaml-modules/sedlex/default.nix
index e49f03d3f537..a6a7604208ab 100644
--- a/pkgs/development/ocaml-modules/sedlex/default.nix
+++ b/pkgs/development/ocaml-modules/sedlex/default.nix
@@ -8,6 +8,16 @@
 , uchar
 }:
 
+let param =
+  if lib.versionAtLeast ppxlib.version "0.26.0" then {
+    version = "2.6";
+    sha256 = "sha256-AU+dV+jTG9v3BXzip2Bnv04Ewyo3pyUglDDBFsOsFf0=";
+  } else {
+    version = "2.5";
+    sha256 = "sha256:062a5dvrzvb81l3a9phljrhxfw9nlb61q341q0a6xn65hll3z2wy";
+  }
+; in
+
 let
   unicodeVersion = "15.0.0";
   baseUrl = "https://www.unicode.org/Public/${unicodeVersion}";
@@ -27,7 +37,7 @@ let
 in
 buildDunePackage rec {
   pname = "sedlex";
-  version = "2.5";
+  inherit (param) version;
 
   minimalOCamlVersion = "4.08";
 
@@ -35,7 +45,7 @@ buildDunePackage rec {
     owner = "ocaml-community";
     repo = "sedlex";
     rev = "v${version}";
-    sha256 = "sha256:062a5dvrzvb81l3a9phljrhxfw9nlb61q341q0a6xn65hll3z2wy";
+    inherit (param) sha256;
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix b/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
index ac820337af02..9a23a9603b95 100644
--- a/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
+++ b/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "appthreat-vulnerability-db";
-  version = "2.0.6";
+  version = "2.0.9";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "AppThreat";
     repo = "vulnerability-db";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-tmvt5jqgfKxCW+/XvmSu7bTsT1Qk902c1qfR4IK66vg=";
+    sha256 = "sha256-A5mphFJEjOkTG5Rv7tb4hm5eDMSir69gqkbHYn6109I=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/gremlinpython/default.nix b/pkgs/development/python-modules/gremlinpython/default.nix
index 3f7ca1011b52..2248bc806b06 100644
--- a/pkgs/development/python-modules/gremlinpython/default.nix
+++ b/pkgs/development/python-modules/gremlinpython/default.nix
@@ -15,19 +15,23 @@
 
 buildPythonPackage rec {
   pname = "gremlinpython";
-  version = "3.6.0";
+  version = "3.6.1";
 
   # pypi tarball doesn't include tests
   src = fetchFromGitHub {
     owner = "apache";
     repo = "tinkerpop";
     rev = version;
-    sha256 = "0gyf3a0zbh1grc1vr9zzpqm5yfcjvn0f1akw9l1arq36isqwvydn";
+    sha256 = "sha256-FMA9hJdq7gYkDtQO04Bwpjq2Q7nXGuN9wrBD4b9GgwY=";
   };
+
   sourceRoot = "source/gremlin-python/src/main/python";
+
   postPatch = ''
+    sed -i '/pytest-runner/d' setup.py
+
     substituteInPlace setup.py \
-      --replace 'pytest-runner==5.2' ' '
+      --replace 'aiohttp>=3.8.0,<=3.8.1' 'aiohttp'
   '';
 
   # setup-requires requirements
diff --git a/pkgs/development/python-modules/lightwave2/default.nix b/pkgs/development/python-modules/lightwave2/default.nix
index c25fb48d864d..8aa6a2eb7bb2 100644
--- a/pkgs/development/python-modules/lightwave2/default.nix
+++ b/pkgs/development/python-modules/lightwave2/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "lightwave2";
-  version = "0.8.16";
+  version = "0.8.17";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-9hWkRY71Ab2J2oQSnGu/rb0KmV3+cJb7vY2sAexDGzU=";
+    sha256 = "sha256-7rNhQXflyfEyOtn00DWYv3CIVYmFp+5z8quYRRdqJMY=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyinfra/default.nix b/pkgs/development/python-modules/pyinfra/default.nix
index 9410d5edbc5b..96a0be843c56 100644
--- a/pkgs/development/python-modules/pyinfra/default.nix
+++ b/pkgs/development/python-modules/pyinfra/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "pyinfra";
-  version = "2.5.2";
+  version = "2.5.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "Fizzadar";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-35qM6u3I8yH1E8mrlaeFjhliOVTkMXH13b8S6e9ROig=";
+    hash = "sha256-1buLaBhhmc4FnROr5M+bqSlsbkfjl58a1/4qWBXE97Y=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pysptk/default.nix b/pkgs/development/python-modules/pysptk/default.nix
index e229648bc75d..4051dc789d3c 100644
--- a/pkgs/development/python-modules/pysptk/default.nix
+++ b/pkgs/development/python-modules/pysptk/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "pysptk";
-  version = "0.1.21";
+  version = "0.2.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-AZUDI9AL57tXz7VzPGF9uEeKW4/6JsaBUiFkigl640Q=";
+    hash = "sha256-nZchBqagUn26vGmUc3+5S57mnQQ2/4vqOz00DUUF1+U=";
   };
 
   PYSPTK_BUILD_VERSION = 0;
diff --git a/pkgs/development/python-modules/types-requests/default.nix b/pkgs/development/python-modules/types-requests/default.nix
index ba8193a2f888..f53c4a141a6a 100644
--- a/pkgs/development/python-modules/types-requests/default.nix
+++ b/pkgs/development/python-modules/types-requests/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "types-requests";
-  version = "2.28.11.3";
+  version = "2.28.11.4";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-vpAHr/sX8KCbtI532xi7bgvp+CYJx48drm2zAlnXIdY=";
+    sha256 = "sha256-1PNCsN9DImLp4ybRdjjurpaliB5456aq5G0zhw1zlS4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/types-urllib3/default.nix b/pkgs/development/python-modules/types-urllib3/default.nix
index 7b667e0df56e..057ec581d0ab 100644
--- a/pkgs/development/python-modules/types-urllib3/default.nix
+++ b/pkgs/development/python-modules/types-urllib3/default.nix
@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "types-urllib3";
-  version = "1.26.25.2";
+  version = "1.26.25.3";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-o6UQ22CbNjZwzGLtt2WYuCcL001OsvbJ8IjQ59gZbWs=";
+    hash = "sha256-GAe4e47hrgImgTuixSMw7/IPsr9jWbHeJN8I6zCQ5EI=";
   };
 
   # Module doesn't have tests
diff --git a/pkgs/development/tools/appthreat-depscan/default.nix b/pkgs/development/tools/appthreat-depscan/default.nix
index ea7d1bb2d2c9..dff677ea1444 100644
--- a/pkgs/development/tools/appthreat-depscan/default.nix
+++ b/pkgs/development/tools/appthreat-depscan/default.nix
@@ -5,13 +5,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "appthreat-depscan";
-  version = "2.1.9";
+  version = "2.2.1";
 
   src = fetchFromGitHub {
     owner = "AppThreat";
     repo = "dep-scan";
     rev = "refs/tags/v${version}";
-    hash = "sha256-3K8dIKeb9bqopu8B8f1fHLIzXHTfmn4ZtDztRBSm10k=";
+    hash = "sha256-O6RHd7akTuslM+nt+4OilrjZvJs6B3BzkjjlRaty9Tg=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/development/tools/build-managers/mill/default.nix b/pkgs/development/tools/build-managers/mill/default.nix
index 1bc2e198d3fc..3a61faa42c15 100644
--- a/pkgs/development/tools/build-managers/mill/default.nix
+++ b/pkgs/development/tools/build-managers/mill/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mill";
-  version = "0.10.8";
+  version = "0.10.9";
 
   src = fetchurl {
     url = "https://github.com/com-lihaoyi/mill/releases/download/${version}/${version}-assembly";
-    hash = "sha256-5mJc5cLT9xkixB8mbDYuJYel+fNeCwr1PMzU/ZCncK0=";
+    hash = "sha256-XDy07dFzylRl825QYqRt5eydVPR4jEevC2VrqxgTFt0=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/tools/faas-cli/default.nix b/pkgs/development/tools/faas-cli/default.nix
index 6440588b7301..55fa760475d9 100644
--- a/pkgs/development/tools/faas-cli/default.nix
+++ b/pkgs/development/tools/faas-cli/default.nix
@@ -18,13 +18,13 @@ let
 in
 buildGoModule rec {
   pname = "faas-cli";
-  version = "0.15.2";
+  version = "0.15.4";
 
   src = fetchFromGitHub {
     owner = "openfaas";
     repo = "faas-cli";
     rev = version;
-    sha256 = "sha256-kHpZeon85hU1cn2UmLNvC43z2nbWGFt6fWJDljwZANI=";
+    sha256 = "sha256-Dj4Wli1z4X8FgnthjPszC/h4EIeFiMO/YB5Rlkis5f8=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/development/tools/rust/bindgen/unwrapped.nix b/pkgs/development/tools/rust/bindgen/unwrapped.nix
index 458b4a10c8d0..3a4cd640d958 100644
--- a/pkgs/development/tools/rust/bindgen/unwrapped.nix
+++ b/pkgs/development/tools/rust/bindgen/unwrapped.nix
@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, rustPlatform, clang, rustfmt
+{ lib, fetchCrate, rustPlatform, clang, rustfmt
 , runtimeShell
 , bash
 }:
@@ -7,18 +7,15 @@ let
   rustfmt-nightly = rustfmt.override { asNightly = true; };
 in rustPlatform.buildRustPackage rec {
   pname = "rust-bindgen-unwrapped";
-  version = "0.59.2";
+  version = "0.61.0";
 
-  RUSTFLAGS = "--cap-lints warn"; # probably OK to remove after update
-
-  src = fetchFromGitHub {
-    owner = "rust-lang";
-    repo = "rust-bindgen";
-    rev = "v${version}";
-    sha256 = "sha256-bJYdyf5uZgWe7fQ80/3QsRV0qyExYn6P9UET3tzwPFs=";
+  src = fetchCrate {
+    pname = "bindgen-cli";
+    inherit version;
+    sha256 = "sha256-sKcKIAkUC2GfAZ4tJBNweXhoFzqO95iCpHgekpOyHzc=";
   };
 
-  cargoSha256 = "sha256-RKZY5vf6CSFaKweuuNkeFF0ZXlSUibAkcL/YhkE0MoQ=";
+  cargoSha256 = "sha256-P246tw5Kznpxav0LashIkLlmQGVB+aKbFUQQdmcASPw=";
 
   buildInputs = [ clang.cc.lib ];
 
diff --git a/pkgs/development/tools/symfony-cli/default.nix b/pkgs/development/tools/symfony-cli/default.nix
index 516f5fbc38ad..e25d27591eed 100644
--- a/pkgs/development/tools/symfony-cli/default.nix
+++ b/pkgs/development/tools/symfony-cli/default.nix
@@ -2,14 +2,14 @@
 
 buildGoModule rec {
   pname = "symfony-cli";
-  version = "5.4.17";
+  version = "5.4.18";
   vendorSha256 = "sha256-hIi+WmLxCTFbu8E++CJkp4bOUrK81PkojRk60SljVik=";
 
   src = fetchFromGitHub {
     owner = "symfony-cli";
     repo = "symfony-cli";
     rev = "v${version}";
-    sha256 = "sha256-cOO8U0/PnH19/oaK9wM/mPplC+VTIkF5+RXdjWJyxqc=";
+    sha256 = "sha256-hRG21rXubS8K273qSjrY+U6n5bpa2kzOCqIXmapTAzs=";
   };
 
   postInstall = ''
diff --git a/pkgs/os-specific/linux/upower/default.nix b/pkgs/os-specific/linux/upower/default.nix
index ae24c4db6ec8..575ab514cc4b 100644
--- a/pkgs/os-specific/linux/upower/default.nix
+++ b/pkgs/os-specific/linux/upower/default.nix
@@ -40,6 +40,11 @@ stdenv.mkDerivation rec {
     hash = "sha256-+C/4dDg6WTLpBgkpNyxjthSdqYdaTLC8vG6jG1LNJ7w=";
   };
 
+  # Remove when this is fixed upstream:
+  # https://gitlab.freedesktop.org/upower/upower/-/issues/214
+  patches = lib.optional (stdenv.hostPlatform.system == "i686-linux")
+    ./i686-test-remove-battery-check.patch;
+
   strictDeps = true;
 
   depsBuildBuild = [
diff --git a/pkgs/os-specific/linux/upower/i686-test-remove-battery-check.patch b/pkgs/os-specific/linux/upower/i686-test-remove-battery-check.patch
new file mode 100644
index 000000000000..c9121dfb038a
--- /dev/null
+++ b/pkgs/os-specific/linux/upower/i686-test-remove-battery-check.patch
@@ -0,0 +1,12 @@
+diff -u "a/src/linux/integration-test.py" "b/src/linux/integration-test.py"
+--- a/src/linux/integration-test.py
++++ b/src/linux/integration-test.py
+@@ -870,5 +870,4 @@
+         self.assertEqual(self.get_dbus_dev_property(bat0_up, 'EnergyFull'), 126.0)
+         self.assertEqual(self.get_dbus_dev_property(bat0_up, 'EnergyFullDesign'), 132.0)
+         self.assertEqual(self.get_dbus_dev_property(bat0_up, 'Voltage'), 12.0)
+-        self.assertEqual(self.get_dbus_dev_property(bat0_up, 'Percentage'), 40.0)
+         self.stop_daemon()
+
+
+Diff finished.  Tue Nov  8 16:48:57 2022
diff --git a/pkgs/servers/dns/knot-dns/default.nix b/pkgs/servers/dns/knot-dns/default.nix
index 8b0c066548f7..d212c65cec72 100644
--- a/pkgs/servers/dns/knot-dns/default.nix
+++ b/pkgs/servers/dns/knot-dns/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pkg-config, gnutls, liburcu, lmdb, libcap_ng, libidn2, libunistring
+{ lib, stdenv, fetchurl, fetchpatch, pkg-config, gnutls, liburcu, lmdb, libcap_ng, libidn2, libunistring
 , systemd, nettle, libedit, zlib, libiconv, libintl, libmaxminddb, libbpf, nghttp2, libmnl
 , ngtcp2-gnutls
 , autoreconfHook
@@ -27,6 +27,11 @@ stdenv.mkDerivation rec {
     # They are later created from NixOS itself.
     ./dont-create-run-time-dirs.patch
     ./runtime-deps.patch
+    # knsupdate: fix segfault due to NULL pointer access when sending an update
+    (fetchpatch {
+      url = "https://gitlab.nic.cz/knot/knot-dns/-/commit/8a6645dab63d8fa7932c7d8f747fe33e8cc97e84.patch";
+      hash = "sha256-qzhSdRH5GqHqN9eLMWbDXmjO4JagsMRSZh3NWRFprao=";
+    })
   ];
 
   nativeBuildInputs = [ pkg-config autoreconfHook ];
diff --git a/pkgs/shells/oil/default.nix b/pkgs/shells/oil/default.nix
index f1f1a913c22c..bff43f683fae 100644
--- a/pkgs/shells/oil/default.nix
+++ b/pkgs/shells/oil/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "oil";
-  version = "0.12.8";
+  version = "0.12.9";
 
   src = fetchurl {
     url = "https://www.oilshell.org/download/oil-${version}.tar.xz";
-    hash = "sha256-kQN2sYFYLlTNCjOIbf59udjmdKNhNbK6vLqkJcX1C8A=";
+    hash = "sha256-HY/SZiVOfOrA69gGxEp+qdRnuTJ72XveAk9Xp45zcf8=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/filesystems/bees/default.nix b/pkgs/tools/filesystems/bees/default.nix
index 0837762fa443..75b8feeccdb2 100644
--- a/pkgs/tools/filesystems/bees/default.nix
+++ b/pkgs/tools/filesystems/bees/default.nix
@@ -5,6 +5,7 @@
 , bash
 , btrfs-progs
 , coreutils
+, linuxHeaders_5_19
 , python3Packages
 , util-linux
 , nixosTests
@@ -24,6 +25,10 @@ let
     };
 
     buildInputs = [
+      # Works around build failure for flexible array members.
+      # Can be removed after 0.7.3 release where it was fixed upstream.
+      linuxHeaders_5_19
+
       btrfs-progs # for btrfs/ioctl.h
       util-linux # for uuid.h
     ];
diff --git a/pkgs/tools/filesystems/garage/default.nix b/pkgs/tools/filesystems/garage/default.nix
index 13184afe73ce..bdb04e36a633 100644
--- a/pkgs/tools/filesystems/garage/default.nix
+++ b/pkgs/tools/filesystems/garage/default.nix
@@ -45,6 +45,6 @@ rustPlatform.buildRustPackage rec {
     description = "S3-compatible object store for small self-hosted geo-distributed deployments";
     homepage = "https://garagehq.deuxfleurs.fr";
     license = lib.licenses.agpl3Only;
-    maintainers = with lib.maintainers; [ nickcao _0x4A6F ];
+    maintainers = with lib.maintainers; [ nickcao _0x4A6F teutat3s ];
   };
 }
diff --git a/pkgs/tools/filesystems/go-mtpfs/default.nix b/pkgs/tools/filesystems/go-mtpfs/default.nix
index 260e6891f956..a544fd7b8be3 100644
--- a/pkgs/tools/filesystems/go-mtpfs/default.nix
+++ b/pkgs/tools/filesystems/go-mtpfs/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub, pkg-config, libusb1 }:
+{ lib, stdenv, buildGoModule, fetchFromGitHub, pkg-config, libusb1 }:
 
 buildGoModule rec {
   pname = "go-mtpfs";
@@ -29,5 +29,6 @@ buildGoModule rec {
     homepage = "https://github.com/hanwen/go-mtpfs";
     license = licenses.bsd3;
     maintainers = with maintainers; [ aaronjheng ];
+    broken = stdenv.isDarwin;
   };
 }
diff --git a/pkgs/tools/networking/aardvark-dns/default.nix b/pkgs/tools/networking/aardvark-dns/default.nix
index 7825b419ecf1..546d22fe46a9 100644
--- a/pkgs/tools/networking/aardvark-dns/default.nix
+++ b/pkgs/tools/networking/aardvark-dns/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "aardvark-dns";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-pIbhrYiZOZ0GoynnHvp+h5E4O4syiwVhQeczAv1zjTo=";
+    sha256 = "sha256-wlaOgWptD4qdaSRg6NNkQNARHMZe3z3QVoXjp133guQ=";
   };
 
-  cargoHash = "sha256-2aFvFP64vy0FK0k0Uq6sPVi42E5easxOUlkcZjrjoMs=";
+  cargoHash = "sha256-BnIGoLIuV/uDaskMA8CeVX2McAHJPT+gchZsS0bQxjI=";
 
   meta = with lib; {
     description = "Authoritative dns server for A/AAAA container records";
diff --git a/pkgs/tools/networking/netavark/default.nix b/pkgs/tools/networking/netavark/default.nix
index 12834f9e26ed..0bfe7f974e8d 100644
--- a/pkgs/tools/networking/netavark/default.nix
+++ b/pkgs/tools/networking/netavark/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "netavark";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-72ft1VZVv6Wxfr3RsJMOVl1Z0KMVGgCsUHKGH+filzg=";
+    sha256 = "sha256-5LczayUgIJ2mcSiHKadegzTM8PvejAD0lhUlXO4Js30=";
   };
 
-  cargoHash = "sha256-FboPbOjkGRzOeoXrIkl1l2BXeid4AOiwxCJ6wlGQ66g=";
+  cargoHash = "sha256-gBdhdJD5EkkYNdpTNq+spySaoWnWViy9+bXTL7ps4PE=";
 
   nativeBuildInputs = [ installShellFiles mandown ];
 
diff --git a/pkgs/tools/networking/openfortivpn/default.nix b/pkgs/tools/networking/openfortivpn/default.nix
index dbf69720c43a..0426066995d9 100644
--- a/pkgs/tools/networking/openfortivpn/default.nix
+++ b/pkgs/tools/networking/openfortivpn/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openfortivpn";
-  version = "1.17.3";
+  version = "1.19.0";
 
   src = fetchFromGitHub {
     owner = "adrienverge";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-VGjzxEdWnGICpGWBklYoAqhC4ka1rF/a6K17hoFDxSo=";
+    sha256 = "sha256-HwKkgRS3Hccym78T+suFkIP5nmQDWRAwm0l/PaS1p7o=";
   };
 
   # we cannot write the config file to /etc and as we don't need the file, so drop it
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index ade5b3366026..eacfcf404853 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -14326,7 +14326,37 @@ with pkgs;
 
   fsharp = callPackage ../development/compilers/fsharp { };
 
-  fstar = callPackage ../development/compilers/fstar { };
+  fstar = callPackage ../development/compilers/fstar {
+    # Work around while compatibility with ppxlib >= 0.26 is unavailable
+    # Should be removed when a fix is availaible
+    # See https://github.com/FStarLang/FStar/issues/2681
+    ocamlPackages =
+      ocamlPackages.overrideScope' (self: super: {
+        ppxlib = super.ppxlib.override {
+          version = if lib.versionAtLeast self.ocaml.version "4.07"
+                    then if lib.versionAtLeast self.ocaml.version "4.08"
+                         then "0.24.0" else "0.15.0" else "0.13.0";
+        };
+        ppx_deriving_yojson = super.ppx_deriving_yojson.overrideAttrs (oldAttrs: rec {
+          version = "3.6.1";
+          src = fetchFromGitHub {
+            owner = "ocaml-ppx";
+            repo = "ppx_deriving_yojson";
+            rev = "v${version}";
+            sha256 = "1icz5h6p3pfj7my5gi7wxpflrb8c902dqa17f9w424njilnpyrbk";
+          };
+        });
+        sedlex = super.sedlex.overrideAttrs (oldAttrs: rec {
+          version = "2.5";
+          src = fetchFromGitHub {
+            owner = "ocaml-community";
+            repo = "sedlex";
+            rev = "v${version}";
+            sha256 = "sha256:062a5dvrzvb81l3a9phljrhxfw9nlb61q341q0a6xn65hll3z2wy";
+          };
+        });
+      });
+  };
 
   dotnetPackages = recurseIntoAttrs (callPackage ./dotnet-packages.nix {});
 
@@ -37077,7 +37107,7 @@ with pkgs;
     gtk2 = gtk2-x11;
   };
 
-  qMasterPassword = libsForQt5.callPackage ../applications/misc/qMasterPassword { };
+  qMasterPassword = qt6Packages.callPackage ../applications/misc/qMasterPassword { };
 
   qtrvsim = libsForQt5.callPackage ../applications/science/computer-architecture/qtrvsim { };
 
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 91daaf811283..a64963af285c 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -12503,11 +12503,11 @@ let
 
   ImageExifTool = buildPerlPackage rec {
     pname = "Image-ExifTool";
-    version = "12.49";
+    version = "12.50";
 
     src = fetchurl {
       url = "https://exiftool.org/Image-ExifTool-${version}.tar.gz";
-      hash = "sha256-l21p2ak+pe9GSWOatsGQ9YvyZfAFfKV3xB38rzexcVs=";
+      hash = "sha256-vOhB/FwQMC8PPvdnjDvxRpU6jAZcC6GMQfc0AH4uwKg=";
     };
 
     nativeBuildInputs = lib.optional stdenv.isDarwin shortenPerlShebang;
@@ -12529,7 +12529,7 @@ let
         Reconyx, Ricoh, Samsung, Sanyo, Sigma/Foveon and Sony.
       '';
       homepage = "https://exiftool.org/";
-
+      changelog = "https://exiftool.org/history.html";
       license = with lib.licenses; [ gpl1Plus /* or */ artistic2 ];
       maintainers = with maintainers; [ kiloreux anthonyroussel ];
       mainProgram = "exiftool";