diff --git a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
index 7c088ae7b47e..0f1dffc798e7 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
@@ -563,6 +563,15 @@
           option, and it is enabled by default, for servers.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <literal>stylua</literal> no longer accepts
+          <literal>lua52Support</literal> and
+          <literal>luauSupport</literal> overrides, use
+          <literal>features</literal> instead, which defaults to
+          <literal>[ &quot;lua54&quot; &quot;luau&quot; ]</literal>.
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
   <section xml:id="sec-release-22.11-notable-changes">
diff --git a/nixos/doc/manual/release-notes/rl-2211.section.md b/nixos/doc/manual/release-notes/rl-2211.section.md
index 094f0cd80f26..7214937781d2 100644
--- a/nixos/doc/manual/release-notes/rl-2211.section.md
+++ b/nixos/doc/manual/release-notes/rl-2211.section.md
@@ -192,6 +192,8 @@ Available as [services.patroni](options.html#opt-services.patroni.enable).
 
 - `k3s` supports `clusterInit` option, and it is enabled by default, for servers.
 
+- `stylua` no longer accepts `lua52Support` and `luauSupport` overrides, use `features` instead, which defaults to `[ "lua54" "luau" ]`.
+
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
 ## Other Notable Changes {#sec-release-22.11-notable-changes}
diff --git a/pkgs/applications/blockchains/nearcore/default.nix b/pkgs/applications/blockchains/nearcore/default.nix
index 579627d97486..a5c475308b32 100644
--- a/pkgs/applications/blockchains/nearcore/default.nix
+++ b/pkgs/applications/blockchains/nearcore/default.nix
@@ -4,7 +4,7 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "nearcore";
-  version = "1.28.1";
+  version = "1.29.0";
 
   # https://github.com/near/nearcore/tags
   src = fetchFromGitHub {
@@ -13,10 +13,10 @@ rustPlatform.buildRustPackage rec {
     # there is also a branch for this version number, so we need to be explicit
     rev = "refs/tags/${version}";
 
-    sha256 = "sha256-lAbVcmr8StAZAII++21xiBd4tRcdprefvcGzPLIjl74=";
+    sha256 = "sha256-TOZ6j4CaiOXmNn8kgVGP27SjvLDlGvabAA+PAEyFXIk=";
   };
 
-  cargoSha256 = "sha256-1aoL5fbKZ4XZ1ELVDWNDFHDL2FyNuoX/DVb0h8RWBxI=";
+  cargoSha256 = "sha256-LjBgsQynHIfrQP4Z7j1J8+PLqRZWGAOQ5dJaGOqabVk=";
   cargoPatches = [ ./0001-make-near-test-contracts-optional.patch ];
 
   postPatch = ''
diff --git a/pkgs/applications/virtualization/gvisor/default.nix b/pkgs/applications/virtualization/gvisor/default.nix
index 2609c3e7bc73..08e1b97355d3 100644
--- a/pkgs/applications/virtualization/gvisor/default.nix
+++ b/pkgs/applications/virtualization/gvisor/default.nix
@@ -9,19 +9,25 @@
 
 buildGoModule rec {
   pname = "gvisor";
-  version = "20220905.0";
+  version = "20220919.0";
+
+  # gvisor provides a synthetic go branch (https://github.com/google/gvisor/tree/go)
+  # that can be used to build gvisor without bazel.
+  # For updates, you should stick to the commits labeled "Merge release-** (automated)"
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "gvisor";
-    rev = "442a3cd44a0858ac2a8e773b6fbba67cf3bd3767";
-    sha256 = "sha256-LKY7AKAHX29eGuXRrkCVCFl/bdHAVOC0QNZfzlpXqwc=";
+    rev = "4e7fd140e8d0056f8f031950fcace8ff4d48a526";
+    sha256 = "sha256-II0lnthabkyCgPum7EBdyOYwB0rWjA2Jd9DVGLJQy6Q=";
   };
 
-  vendorSha256 = "sha256-Fn8A8iwTv0lNI9ZBJkq3SlRelnAGIQY0GInTxaCzSAU=";
+  vendorSha256 = "sha256-iGLWxx/Kn1QaJTNOZcc+mwoF3ecEDOkaqmA0DH4pdgU=";
 
   nativeBuildInputs = [ makeWrapper ];
 
+  CGO_ENABLED = 0;
+
   ldflags = [ "-s" "-w" ];
 
   subPackages = [ "runsc" "shim" ];
diff --git a/pkgs/development/python-modules/shapely/default.nix b/pkgs/development/python-modules/shapely/default.nix
index a41381fe35bf..fda2645105f6 100644
--- a/pkgs/development/python-modules/shapely/default.nix
+++ b/pkgs/development/python-modules/shapely/default.nix
@@ -2,7 +2,6 @@
 , stdenv
 , buildPythonPackage
 , fetchPypi
-, fetchpatch
 , substituteAll
 , pythonOlder
 , geos
@@ -13,12 +12,12 @@
 
 buildPythonPackage rec {
   pname = "Shapely";
-  version = "1.8.2";
+  version = "1.8.4";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-Vyr51QBv1eMhPjfuVIkSsDQfsmck1tyKTjlQwQGX67Y=";
+    sha256 = "sha256-oZXlHKr6IYKR8suqP+9p/TNTyT7EtlsqRyLEz0DDGYw=";
   };
 
   nativeBuildInputs = [
@@ -44,20 +43,21 @@ buildPythonPackage rec {
       libgeos_c = GEOS_LIBRARY_PATH;
       libc = lib.optionalString (!stdenv.isDarwin) "${stdenv.cc.libc}/lib/libc${stdenv.hostPlatform.extensions.sharedLibrary}.6";
     })
-    (fetchpatch {
-      name = "fix-tests-geos-3.11.patch";
-      url = "https://github.com/shapely/shapely/commit/21c8e8a7909e7fb3cce6daa5c5b8284ac927fcb0.patch";
-      includes = [ "tests/test_parallel_offset.py" ];
-      sha256 = "sha256-85c8NlmAzzfCgepe/411ug5Sq+665dFMb3ySaUt9Kew=";
-    })
  ];
 
   preCheck = ''
     rm -r shapely # prevent import of local shapely
   '';
 
-  disabledTests = [
-    "test_collection"
+  disabledTests = lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [
+    # FIXME(lf-): these logging tests are broken, which is definitely our
+    # fault. I've tried figuring out the cause and failed.
+    #
+    # It is apparently some sandbox or no-sandbox related thing on macOS only
+    # though.
+    "test_error_handler_exception"
+    "test_error_handler"
+    "test_info_handler"
   ];
 
   pythonImportsCheck = [ "shapely" ];
diff --git a/pkgs/development/tools/gokart/default.nix b/pkgs/development/tools/gokart/default.nix
index f7d0857580ef..c2775f7826a1 100644
--- a/pkgs/development/tools/gokart/default.nix
+++ b/pkgs/development/tools/gokart/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "gokart";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "praetorian-inc";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-HsjLNY5Z5UidsLDWSP+1bu3jrfn3oAERPrPV/AkTH8I=";
+    sha256 = "sha256-oxYlwc3FatYyaICQFZJtkH9/7zYfT2gI+R5BU7CQVkg=";
   };
 
-  vendorSha256 = "sha256-S3RukCKAJnPH1KGVdnkgAJQKEDTZYpcMMdoQ4OnHZVg=";
+  vendorSha256 = "sha256-lgKYVgJlmUJ/msdIqG7EKAZuISie1lG7+VeCF/rcSlE=";
 
   # Would need files to scan which are not shipped by the project
   doCheck = false;
diff --git a/pkgs/development/tools/metal-cli/default.nix b/pkgs/development/tools/metal-cli/default.nix
index a01dc7d9d28e..06bd51bd31c5 100644
--- a/pkgs/development/tools/metal-cli/default.nix
+++ b/pkgs/development/tools/metal-cli/default.nix
@@ -1,14 +1,14 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
 
 buildGoModule rec {
   pname = "metal-cli";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "equinix";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ivO4YFFDTza20WgTGEaSGUcIEvXVtwKKVGyKWe8d9bA=";
+    sha256 = "sha256-+G3PBYeez1dcUELc4j6CRgxDCDWCxpOfI52QlvMVkrY=";
   };
 
   vendorSha256 = "sha256-rf0EWMVvuoPUMTQKi/FnUbE2ZAs0C7XosHAzCgwB5wg=";
@@ -18,6 +18,15 @@ buildGoModule rec {
     "-X github.com/equinix/metal-cli/cmd.Version=${version}"
   ];
 
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    installShellCompletion --cmd metal \
+      --bash <($out/bin/metal completion bash) \
+      --fish <($out/bin/metal completion fish) \
+      --zsh <($out/bin/metal completion zsh)
+  '';
+
   doCheck = false;
 
   doInstallCheck = true;
diff --git a/pkgs/development/tools/regclient/default.nix b/pkgs/development/tools/regclient/default.nix
index ff43dbfebcc3..fc98bff40f98 100644
--- a/pkgs/development/tools/regclient/default.nix
+++ b/pkgs/development/tools/regclient/default.nix
@@ -4,14 +4,14 @@ let bins = [ "regbot" "regctl" "regsync" ]; in
 
 buildGoModule rec {
   pname = "regclient";
-  version = "0.4.4";
+  version = "0.4.5";
   tag = "v${version}";
 
   src = fetchFromGitHub {
     owner = "regclient";
     repo = "regclient";
     rev = tag;
-    sha256 = "sha256-jIdbSDUpSKlb6RES6hx+r+vZyny56aWyjAurCI3mywk=";
+    sha256 = "sha256-WyjVJp0JVwLitz46YjPGpR/+AjLhjgqTRqabCB9VhHw=";
   };
   vendorSha256 = "sha256-QTeVgvjRw2wBd8QGoVpRVTTh+Wwu2NEZYR1Z9R52/p0=";
 
diff --git a/pkgs/development/tools/stylua/default.nix b/pkgs/development/tools/stylua/default.nix
index 383a6534671b..ffa548ec377e 100644
--- a/pkgs/development/tools/stylua/default.nix
+++ b/pkgs/development/tools/stylua/default.nix
@@ -1,34 +1,29 @@
-{ fetchFromGitHub
-, lib
+{ lib
 , rustPlatform
-, lua52Support ? true
-, luauSupport ? false
-, fetchpatch
+, fetchFromGitHub
+  # lua54 implies lua52/lua53
+, features ? [ "lua54" "luau" ]
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "stylua";
-  version = "0.14.3";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "johnnymorganz";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-l4q6Qlgdxgm4K5+NkWMZI3Hhtx6m/0DG9PE4gvo/ylo=";
+    sha256 = "sha256-x4/DmFi/6bIQVn8sfSFEOJIv4Zd/3oHKXbrd6yIsSYU=";
   };
 
-  cargoSha256 = "sha256-zlk9KdiSKWknyuJTTqpzCeSJUXJGDK2A0g1ss8AHoYs=";
+  cargoSha256 = "sha256-lY18so+uG3yri18zd29B479nl0l1C0F1mw+sPrccRQs=";
 
-  cargoPatches = [
-    # fixes broken 0.14.3 lockfile
-    (fetchpatch {
-      url = "https://github.com/JohnnyMorganz/StyLua/commit/834f632f67af6425e7773eaade8d23a880946843.patch";
-      sha256 = "sha256-oM2gaILwiNMqTGFRQBw6/fxbjljNWxeIb0lcXcAJR3w=";
-    })
-  ];
+  # remove cargo config so it can find the linker on aarch64-unknown-linux-gnu
+  postPatch = ''
+    rm .cargo/config.toml
+  '';
 
-  buildFeatures = lib.optional lua52Support "lua52"
-    ++ lib.optional luauSupport "luau";
+  buildFeatures = features;
 
   meta = with lib; {
     description = "An opinionated Lua code formatter";
diff --git a/pkgs/servers/dns/knot-resolver/default.nix b/pkgs/servers/dns/knot-resolver/default.nix
index dc14049b9dbb..cccc366c9291 100644
--- a/pkgs/servers/dns/knot-resolver/default.nix
+++ b/pkgs/servers/dns/knot-resolver/default.nix
@@ -1,5 +1,4 @@
 { lib, stdenv, fetchurl
-, fetchpatch
 # native deps.
 , runCommand, pkg-config, meson, ninja, makeWrapper
 # build+runtime deps.
@@ -18,28 +17,15 @@ lua = luajitPackages;
 
 unwrapped = stdenv.mkDerivation rec {
   pname = "knot-resolver";
-  version = "5.5.2";
+  version = "5.5.3";
 
   src = fetchurl {
     url = "https://secure.nic.cz/files/knot-resolver/${pname}-${version}.tar.xz";
-    sha256 = "3f78aa69c3f28edc42b5900b9788fba39498d8bffda7fb9c772bb470865780cb";
+    sha256 = "a38f57c68b7d237d662784d8406e6098aad66a148f44dcf498d1e9664c5fed2d";
   };
 
   outputs = [ "out" "dev" ];
 
-  patches = [
-    (fetchpatch {
-      name = "fix-config-tests-on-darwin.patch";
-      url = "https://gitlab.nic.cz/knot/knot-resolver/-/commit/48ad9d436cf80f58c107774c313a561d852148a0.diff";
-      sha256 = "CEX1XkeYLUSe31xUhNdMRMl1VUXtKFCs5noNJaqL5x0=";
-    })
-    (fetchpatch {
-      name = "fix-config-tests-on-aarch64-darwin.patch";
-      url = "https://gitlab.nic.cz/knot/knot-resolver/-/commit/adaac913c50a5db2f226a081ddc419b0d56d1757.diff";
-      sha256 = "1LrL74luzPTyJ7VBi7fskDga4lYAh7cSUmDcd1BNO78=";
-    })
-  ];
-
   # Path fixups for the NixOS service.
   postPatch = ''
     patch meson.build <<EOF
diff --git a/pkgs/servers/monitoring/mimir/default.nix b/pkgs/servers/monitoring/mimir/default.nix
index 57f99a4388c8..6e161b44b730 100644
--- a/pkgs/servers/monitoring/mimir/default.nix
+++ b/pkgs/servers/monitoring/mimir/default.nix
@@ -1,13 +1,13 @@
 { lib, buildGoModule, fetchFromGitHub, nixosTests }:
 buildGoModule rec {
   pname = "mimir";
-  version = "2.2.0";
+  version = "2.3.0";
 
   src = fetchFromGitHub {
     rev = "${pname}-${version}";
     owner = "grafana";
     repo = pname;
-    sha256 = "sha256-c2WOE7lm62uZ+oVSWd2Gyo0UZJaf9yFzEQZvcwpvshA=";
+    sha256 = "sha256-lLrDgt4WYxyMkwjS8TLTy1agPAo/Z0BtqY9hIYSDyGI=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/servers/redpanda/default.nix b/pkgs/servers/redpanda/default.nix
index 496e527b6b8f..308b30bee44c 100644
--- a/pkgs/servers/redpanda/default.nix
+++ b/pkgs/servers/redpanda/default.nix
@@ -1,13 +1,13 @@
 { lib, stdenv, fetchzip }:
 
 let
-  version = "22.2.2";
+  version = "22.2.3";
   platform = if stdenv.isLinux then "linux" else "darwin";
   arch = if stdenv.isAarch64 then "arm" else "amd";
   sha256s = {
     darwin.amd = "sha256-AXk3aP1SGiHTfHTCBRTagX0DAVmdcVVIkxWaTnZxB8g=";
     darwin.arm = "sha256-pvOVvNc8lZ2d2fVZVYWvumVWYpnLORNY/3o1t4BN2N4=";
-    linux.amd = "sha256-j+apxUiGAPzQfv7qtXzuykN/FOtzZ0Yb82q2bIS2ZC4=";
+    linux.amd = "sha256-ir7ld7xB42SQzZS+ixMriL/eMEnp1wuBAL4gkvlCnLk=";
     linux.arm = "sha256-WHjYAbytiu747jFqN0KZ/CkIwAVI7fb32ywtRiQOBm8=";
   };
 in stdenv.mkDerivation rec {
diff --git a/pkgs/tools/virtualization/linode-cli/default.nix b/pkgs/tools/virtualization/linode-cli/default.nix
index 7dfe15d67d62..2aa9c8f6e815 100644
--- a/pkgs/tools/virtualization/linode-cli/default.nix
+++ b/pkgs/tools/virtualization/linode-cli/default.nix
@@ -13,8 +13,8 @@
 let
   sha256 = "1fv53wikx745kci86xrsq9kfsgv0a65srhywdw32cab1wywwpn2z";
   # specVersion taken from: https://www.linode.com/docs/api/openapi.yaml at `info.version`.
-  specVersion = "4.135.0";
-  specSha256 = "082rkpj8yl6s75y5i9zz287059fxf6zh9hdmdwa463lr6ig90kl4";
+  specVersion = "4.136.0";
+  specSha256 = "17cxg83cav9qnrnv7i45hsn0z4a6a5yyfhzy80x1v0fshnc52dpw";
   spec = fetchurl {
     url = "https://raw.githubusercontent.com/linode/linode-api-docs/v${specVersion}/openapi.yaml";
     sha256 = specSha256;
@@ -24,7 +24,7 @@ in
 
 buildPythonApplication rec {
   pname = "linode-cli";
-  version = "5.22.0";
+  version = "5.23.0";
 
   src = fetchFromGitHub {
     owner = "linode";