diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 70964ad80f73..0c2a43f1a87b 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -595,6 +595,7 @@
   ./services/misc/redmine.nix
   ./services/misc/rippled.nix
   ./services/misc/ripple-data-api.nix
+  ./services/misc/rmfakecloud.nix
   ./services/misc/serviio.nix
   ./services/misc/safeeyes.nix
   ./services/misc/sdrplay.nix
diff --git a/nixos/modules/services/misc/rmfakecloud.nix b/nixos/modules/services/misc/rmfakecloud.nix
new file mode 100644
index 000000000000..fe522653c216
--- /dev/null
+++ b/nixos/modules/services/misc/rmfakecloud.nix
@@ -0,0 +1,147 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.rmfakecloud;
+  serviceDataDir = "/var/lib/rmfakecloud";
+
+in {
+  options = {
+    services.rmfakecloud = {
+      enable = mkEnableOption "rmfakecloud remarkable self-hosted cloud";
+
+      package = mkOption {
+        type = types.package;
+        default = pkgs.rmfakecloud;
+        defaultText = literalExpression "pkgs.rmfakecloud";
+        description = ''
+          rmfakecloud package to use.
+
+          The default does not include the web user interface.
+        '';
+      };
+
+      storageUrl = mkOption {
+        type = types.str;
+        example = "https://local.appspot.com";
+        description = ''
+          URL used by the tablet to access the rmfakecloud service.
+        '';
+      };
+
+      port = mkOption {
+        type = types.port;
+        default = 3000;
+        description = ''
+          Listening port number.
+        '';
+      };
+
+      logLevel = mkOption {
+        type = types.enum [ "info" "debug" "warn" "error" ];
+        default = "info";
+        description = ''
+          Logging level.
+        '';
+      };
+
+      extraSettings = mkOption {
+        type = with types; attrsOf str;
+        default = { };
+        example = { DATADIR = "/custom/path/for/rmfakecloud/data"; };
+        description = ''
+          Extra settings in the form of a set of key-value pairs.
+          For tokens and secrets, use `environmentFile` instead.
+
+          Available settings are listed on
+          https://ddvk.github.io/rmfakecloud/install/configuration/.
+        '';
+      };
+
+      environmentFile = mkOption {
+        type = with types; nullOr path;
+        default = null;
+        example = "/etc/secrets/rmfakecloud.env";
+        description = ''
+          Path to an environment file loaded for the rmfakecloud service.
+
+          This can be used to securely store tokens and secrets outside of the
+          world-readable Nix store. Since this file is read by systemd, it may
+          have permission 0400 and be owned by root.
+        '';
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.rmfakecloud = {
+      description = "rmfakecloud remarkable self-hosted cloud";
+
+      environment = {
+        STORAGE_URL = cfg.storageUrl;
+        PORT = toString cfg.port;
+        LOGLEVEL = cfg.logLevel;
+      } // cfg.extraSettings;
+
+      preStart = ''
+        # Generate the secret key used to sign client session tokens.
+        # Replacing it invalidates the previously established sessions.
+        if [ -z "$JWT_SECRET_KEY" ] && [ ! -f jwt_secret_key ]; then
+          (umask 077; touch jwt_secret_key)
+          cat /dev/urandom | tr -cd '[:alnum:]' | head -c 48 >> jwt_secret_key
+        fi
+      '';
+
+      script = ''
+        if [ -z "$JWT_SECRET_KEY" ]; then
+          export JWT_SECRET_KEY="$(cat jwt_secret_key)"
+        fi
+
+        ${cfg.package}/bin/rmfakecloud
+      '';
+
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
+      after = [ "network-online.target" ];
+
+      serviceConfig = {
+        Type = "simple";
+        Restart = "always";
+
+        EnvironmentFile =
+          mkIf (cfg.environmentFile != null) cfg.environmentFile;
+
+        AmbientCapabilities =
+          mkIf (cfg.port < 1024) [ "CAP_NET_BIND_SERVICE" ];
+
+        DynamicUser = true;
+        PrivateDevices = true;
+        ProtectHome = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectControlGroups = true;
+        CapabilityBoundingSet = [ "" ];
+        DevicePolicy = "closed";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        ProtectClock = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectProc = "invisible";
+        ProcSubset = "pid";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        WorkingDirectory = serviceDataDir;
+        StateDirectory = baseNameOf serviceDataDir;
+        UMask = 0027;
+      };
+    };
+  };
+
+  meta.maintainers = with maintainers; [ pacien ];
+}
diff --git a/pkgs/applications/blockchains/erigon.nix b/pkgs/applications/blockchains/erigon.nix
index 56114ed72a83..cb69104fb9b7 100644
--- a/pkgs/applications/blockchains/erigon.nix
+++ b/pkgs/applications/blockchains/erigon.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "erigon";
-  version = "2021.09.04";
+  version = "2022.01.02";
 
   src = fetchFromGitHub {
     owner = "ledgerwatch";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0l0w1badhvlh1rgqzvlmy5k7xhb1nf4f5dmhkl935a5ila08aak3";
+    sha256 = "sha256-PzLFwpLKPMV9J2+hqwFppdrFvGxyWpSzYDiQTWZXKco=";
   };
 
-  vendorSha256 = "sha256-i8BaT9C39tmHU3GGgd0hUB1PHXnoAdNYRIqZA1ggbjQ=";
+  vendorSha256 = "sha256-YslMHpc3ApPiZOhNZrKoLaQcUWZwj7WLxmzYFyThnRo=";
   proxyVendor = true;
 
   # Build errors in mdbx when format hardening is enabled:
diff --git a/pkgs/applications/gis/gmt/default.nix b/pkgs/applications/gis/gmt/default.nix
index a894d121bd3d..0420619e8779 100644
--- a/pkgs/applications/gis/gmt/default.nix
+++ b/pkgs/applications/gis/gmt/default.nix
@@ -9,10 +9,10 @@
 
 stdenv.mkDerivation rec {
   pname = "gmt";
-  version = "6.2.0";
+  version = "6.3.0";
   src = fetchurl {
     url = "https://github.com/GenericMappingTools/gmt/releases/download/${version}/gmt-${version}-src.tar.gz";
-    sha256 = "sha256-q3BikSrurRAhdw+tR1bgqZhg/ejqm0KPsAwi+hWju/w=";
+    sha256 = "sha256-LNBz2LHxG4elmziqeq+OOceUDStVpGoyZ+I4AuyKCNE=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/networking/cluster/k3s/default.nix b/pkgs/applications/networking/cluster/k3s/default.nix
index 34fe2bfb9d02..5b5dfece1f1b 100644
--- a/pkgs/applications/networking/cluster/k3s/default.nix
+++ b/pkgs/applications/networking/cluster/k3s/default.nix
@@ -5,9 +5,11 @@
 , iptables
 , iproute2
 , bridge-utils
+, btrfs-progs
 , conntrack-tools
-, buildGoPackage
+, buildGoModule
 , runc
+, rsync
 , kmod
 , libseccomp
 , pkg-config
@@ -18,6 +20,7 @@
 , fetchzip
 , fetchgit
 , zstd
+, yq-go
 , nixosTests
 }:
 
@@ -43,27 +46,58 @@ with lib;
 # Those pieces of software we entirely ignore upstream's handling of, and just
 # make sure they're in the path if desired.
 let
-  k3sVersion = "1.22.3+k3s1";     # k3s git tag
-  k3sCommit = "61a2aab25eeb97c26fa3f2b177e4355a7654c991"; # k3s git commit at the above version
-  k3sRepoSha256 = "0lz5hr3c86gxm9w5jy3g26n6a26m8k0y559hv6220rsi709j7ma9";
+  k3sVersion = "1.23.3+k3s1";     # k3s git tag
+  k3sCommit = "6f4217a3405d16a1a51bbb40872d7dcb87207bb9"; # k3s git commit at the above version
+  k3sRepoSha256 = "sha256-0dRusG1vL+1KbmViIUNCZK1b+FEgV6otcVUyFonHmm4=";
 
-  traefikChartVersion = "10.3.0"; # taken from ./manifests/traefik.yaml at spec.version
-  traefikChartSha256 = "0y6wr64xp7bgx24kqil0x6myr3pnfrg8rw0d1h5zd2n5a8nfd73f";
+  # taken from ./manifests/traefik.yaml, extracted from '.spec.chart' https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/download#L9
+  # The 'patch' and 'minor' versions are currently hardcoded as single digits only, so ignore the trailing two digits. Weird, I know.
+  traefikChartVersion = "10.9.1";
+  traefikChartSha256 = "sha256-XM1DLofU1zEEFeB5bNQ7cgv102gXsToPP7SFh87QuGQ=";
 
-  k3sRootVersion = "0.9.1";       # taken from ./scripts/download at ROOT_VERSION
+  # taken from ./scripts/version.sh VERSION_ROOT https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/version.sh#L47
+  k3sRootVersion = "0.9.1";
   k3sRootSha256 = "0r2cj4l50cxkrvszpzxfk36lvbjf9vcmp6d5lvxg8qsah8lki3x8";
 
-  k3sCNIVersion = "0.9.1-k3s1";   # taken from ./scripts/version.sh at VERSION_CNIPLUGINS
+  # taken from ./scripts/version.sh VERSION_CNIPLUGINS https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/version.sh#L45
+  k3sCNIVersion = "0.9.1-k3s1";
   k3sCNISha256 = "1327vmfph7b8i14q05c2xdfzk60caflg1zhycx0mrf3d59f4zsz5";
 
+  # taken from go.mod, the 'github.com/containerd/containerd' line
+  # run `grep github.com/containerd/containerd go.mod | head -n1 | awk '{print $4}'`
+  containerdVersion = "v1.5.9-k3s1";
+  containerdSha256 = "sha256-7xlhBA6KuwFlw+jyThygv4Ow9F3xjjIUtS6x8YHwjic=";
+
+  # run `grep github.com/kubernetes-sigs/cri-tools go.mod | head -n1 | awk '{print $4}'` in the k3s repo at the tag
+  criCtlVersion = "v1.22.0-k3s1";
+
   baseMeta = {
     description = "A lightweight Kubernetes distribution";
     license = licenses.asl20;
     homepage = "https://k3s.io";
-    maintainers = with maintainers; [ euank ];
+    maintainers = with maintainers; [ euank mic92 ];
     platforms = platforms.linux;
   };
 
+  # https://github.com/k3s-io/k3s/blob/5fb370e53e0014dc96183b8ecb2c25a61e891e76/scripts/build#L19-L40
+  versionldflags = [
+    "-X github.com/rancher/k3s/pkg/version.Version=v${k3sVersion}"
+    "-X github.com/rancher/k3s/pkg/version.GitCommit=${lib.substring 0 8 k3sCommit}"
+    "-X k8s.io/client-go/pkg/version.gitVersion=v${k3sVersion}"
+    "-X k8s.io/client-go/pkg/version.gitCommit=${k3sCommit}"
+    "-X k8s.io/client-go/pkg/version.gitTreeState=clean"
+    "-X k8s.io/client-go/pkg/version.buildDate=1970-01-01T01:01:01Z"
+    "-X k8s.io/component-base/version.gitVersion=v${k3sVersion}"
+    "-X k8s.io/component-base/version.gitCommit=${k3sCommit}"
+    "-X k8s.io/component-base/version.gitTreeState=clean"
+    "-X k8s.io/component-base/version.buildDate=1970-01-01T01:01:01Z"
+    "-X github.com/kubernetes-sigs/cri-tools/pkg/version.Version=${criCtlVersion}"
+    "-X github.com/containerd/containerd/version.Version=${containerdVersion}"
+    "-X github.com/containerd/containerd/version.Package=github.com/k3s-io/containerd"
+    "-X github.com/containerd/containerd/version.Version=${containerdVersion}"
+    "-X github.com/containerd/containerd/version.Package=github.com/k3s-io/containerd"
+  ];
+
   # bundled into the k3s binary
   traefikChart = fetchurl {
     url = "https://helm.traefik.io/traefik/traefik-${traefikChartVersion}.tgz";
@@ -84,11 +118,11 @@ let
     sha256 = k3sRootSha256;
     stripRoot = false;
   };
-  k3sPlugins = buildGoPackage rec {
-    name = "k3s-cni-plugins";
+  k3sCNIPlugins = buildGoModule rec {
+    pname = "k3s-cni-plugins";
     version = k3sCNIVersion;
+    vendorSha256 = null;
 
-    goPackagePath = "github.com/containernetworking/plugins";
     subPackages = [ "." ];
 
     src = fetchFromGitHub {
@@ -98,6 +132,10 @@ let
       sha256 = k3sCNISha256;
     };
 
+    postInstall = ''
+      mv $out/bin/plugins $out/bin/cni
+    '';
+
     meta = baseMeta // {
       description = "CNI plugins, as patched by rancher for k3s";
     };
@@ -124,50 +162,38 @@ let
   # Then, we bundle those binaries into our thick k3s binary and use that as
   # the final single output.
   # This approach was chosen because it ensures the bundled binaries all are
-  # correctly built to run with nix (we can lean on the existing buildGoPackage
+  # correctly built to run with nix (we can lean on the existing buildGoModule
   # stuff), and we can again lean on that tooling for the final k3s binary too.
   # Other alternatives would be to manually run the
   # strip/patchelf/remove-references step ourselves in the installPhase of the
   # derivation when we've built all the binaries, but haven't bundled them in
   # with generated bindata yet.
-  k3sBuildStage1 = buildGoPackage rec {
-    name = "k3s-build-1";
+  k3sServer = buildGoModule rec {
+    pname = "k3s-server";
     version = k3sVersion;
 
-    goPackagePath = "github.com/rancher/k3s";
-
     src = k3sRepo;
-
-    # Patch build scripts so that we can use them.
-    # This makes things more dynamically linked (because nix can deal with
-    # dynamically linked dependencies just fine), removes the upload at the
-    # end, and skips building runc + cni, since we have our own derivations for
-    # those.
-    patches = [ ./patches/0002-Add-nixpkgs-patches.patch ];
+    vendorSha256 = "sha256-9+2k/ipAOhc8JJU+L2dwaM01Dkw+0xyrF5kt6mL19G0=";
 
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libseccomp ];
 
-    # Versioning info for build script
-    DRONE_TAG = "v${version}";
-    DRONE_COMMIT = k3sCommit;
-
-    buildPhase = ''
-      pushd go/src/${goPackagePath}
-
-      patchShebangs ./scripts/build ./scripts/version.sh
-      mkdir -p bin
-      ./scripts/build
-
-      popd
-    '';
-
-    installPhase = ''
-      pushd go/src/${goPackagePath}
-
-      mkdir -p "$out/bin"
-      install -m 0755 -t "$out/bin" ./bin/*
+    subPackages = [ "cmd/server" ];
+    ldflags = versionldflags;
 
+    # create the multicall symlinks for k3s
+    postInstall = ''
+      mv $out/bin/server $out/bin/k3s
+      pushd $out
+      # taken verbatim from https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/build#L105-L113
+      ln -s k3s ./bin/k3s-agent
+      ln -s k3s ./bin/k3s-server
+      ln -s k3s ./bin/k3s-etcd-snapshot
+      ln -s k3s ./bin/k3s-secrets-encrypt
+      ln -s k3s ./bin/k3s-certificate
+      ln -s k3s ./bin/kubectl
+      ln -s k3s ./bin/crictl
+      ln -s k3s ./bin/ctr
       popd
     '';
 
@@ -175,76 +201,33 @@ let
       description = "The various binaries that get packaged into the final k3s binary";
     };
   };
-  k3sBin = buildGoPackage rec {
-    name = "k3s-bin";
+  k3sContainerd = buildGoModule {
+    pname = "k3s-containerd";
     version = k3sVersion;
-
-    goPackagePath = "github.com/rancher/k3s";
-
-    src = k3sRepo;
-
-    # See the above comment in k3sBuildStage1
-    patches = [ ./patches/0002-Add-nixpkgs-patches.patch ];
-
-    nativeBuildInputs = [ pkg-config zstd ];
-    # These dependencies are embedded as compressed files in k3s at runtime.
-    # Propagate them to avoid broken runtime references to libraries.
-    propagatedBuildInputs = [ k3sPlugins k3sBuildStage1 runc ];
-
-    # k3s appends a suffix to the final distribution binary for some arches
-    archSuffix =
-      if stdenv.hostPlatform.system == "x86_64-linux" then ""
-      else if stdenv.hostPlatform.system == "aarch64-linux" then "-arm64"
-      else throw "k3s isn't being built for ${stdenv.hostPlatform.system} yet.";
-
-    DRONE_TAG = "v${version}";
-    DRONE_COMMIT = k3sCommit;
-
-    # In order to build the thick k3s binary (which is what
-    # ./scripts/package-cli does), we need to get all the binaries that script
-    # expects in place.
-    buildPhase = ''
-      pushd go/src/${goPackagePath}
-
-      patchShebangs ./scripts/build ./scripts/version.sh ./scripts/package-cli
-
-      mkdir -p bin
-
-      install -m 0755 -t ./bin ${k3sBuildStage1}/bin/*
-      install -m 0755 -T "${k3sPlugins}/bin/plugins" ./bin/cni
-      # Note: use the already-nixpkgs-bundled k3s rather than the one bundled
-      # in k3s because the k3s one is completely unmodified from upstream
-      # (unlike containerd, cni, etc)
-      install -m 0755 -T "${runc}/bin/runc" ./bin/runc
-      cp -R "${k3sRoot}/etc" ./etc
-      mkdir -p "build/static/charts"
-      cp "${traefikChart}" "build/static/charts/traefik-${traefikChartVersion}.tgz"
-
-      ./scripts/package-cli
-
-      popd
-    '';
-
-    installPhase = ''
-      pushd go/src/${goPackagePath}
-
-      mkdir -p "$out/bin"
-      install -m 0755 -T ./dist/artifacts/k3s${archSuffix} "$out/bin/k3s"
-
-      popd
-    '';
-
-    meta = baseMeta // {
-      description = "The k3s go binary which is used by the final wrapped output below";
+    src = fetchFromGitHub {
+      owner = "k3s-io";
+      repo = "containerd";
+      rev = containerdVersion;
+      sha256 = containerdSha256;
     };
+    vendorSha256 = null;
+    buildInputs = [ btrfs-progs ];
+    subPackages = [ "cmd/containerd" "cmd/containerd-shim-runc-v2" ];
+    ldflags = versionldflags;
   };
 in
-stdenv.mkDerivation rec {
+buildGoModule rec {
   pname = "k3s";
   version = k3sVersion;
 
-  # `src` here is a workaround for the updateScript bot. It couldn't be empty.
-  src = builtins.filterSource (path: type: false) ./.;
+  src = k3sRepo;
+  proxyVendor = true;
+  vendorSha256 = "sha256-8Yp9csyRNSYi9wo8E8mF8cu92wG1t3l18wJ8Y4L7HEA=";
+
+  patches = [
+    ./patches/0001-scrips-download-strip-downloading-just-package-CRD.patch
+    ./patches/0002-Don-t-build-a-static-binary-in-package-cli.patch
+  ];
 
   # Important utilities used by the kubelet, see
   # https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-237202494
@@ -260,32 +243,68 @@ stdenv.mkDerivation rec {
     conntrack-tools
   ];
 
-  buildInputs = [
-    k3sBin
-  ] ++ k3sRuntimeDeps;
+  buildInputs = k3sRuntimeDeps;
 
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [
+    makeWrapper
+    rsync
+    yq-go
+    zstd
+  ];
 
-  unpackPhase = "true";
+  # embedded in the final k3s cli
+  propagatedBuildInputs = [
+    k3sCNIPlugins
+    k3sContainerd
+    k3sServer
+    runc
+  ];
+
+  # We override most of buildPhase due to peculiarities in k3s's build.
+  # Specifically, it has a 'go generate' which runs part of the package. See
+  # this comment:
+  # https://github.com/NixOS/nixpkgs/pull/158089#discussion_r799965694
+  # So, why do we use buildGoModule at all? For the `vendorSha256` / `go mod download` stuff primarily.
+  buildPhase = ''
+    patchShebangs ./scripts/package-cli ./scripts/download ./scripts/build-upload
+
+    # copy needed 'go generate' inputs into place
+    mkdir -p ./bin/aux
+    rsync -a --no-perms ${k3sServer}/bin/ ./bin/
+    ln -vsf ${runc}/bin/runc ./bin/runc
+    ln -vsf ${k3sCNIPlugins}/bin/cni ./bin/cni
+    ln -vsf ${k3sContainerd}/bin/* ./bin/
+    rsync -a --no-perms --chmod u=rwX ${k3sRoot}/etc/ ./etc/
+    mkdir -p ./build/static/charts
+    # Note, upstream's chart has a 00 suffix. This seems to not matter though, so we're ignoring that naming detail.
+    export TRAEFIK_CHART_FILE=${traefikChart}
+    # place the traefik chart using their code since it's complicated
+    # We trim the actual download, see patches
+    ./scripts/download
+
+    export ARCH=$GOARCH
+    export DRONE_TAG="v${k3sVersion}"
+    export DRONE_COMMIT="${k3sCommit}"
+    # use ./scripts/package-cli to run 'go generate' + 'go build'
+
+    ./scripts/package-cli
+    mkdir -p $out/bin
+  '';
+
+  # Otherwise it depends on 'getGoDirs', which is normally set in buildPhase
+  doCheck = false;
 
-  # And, one final derivation (you thought the last one was it, right?)
-  # We got the binary we wanted above, but it doesn't have all the runtime
-  # dependencies k8s wants, including mount utilities for kubelet, networking
-  # tools for cni/kubelet stuff, etc
-  # Use a wrapper script to reference all the binaries that k3s tries to
-  # execute, but that we didn't bundle with it.
   installPhase = ''
-    runHook preInstall
-    mkdir -p "$out/bin"
-    makeWrapper ${k3sBin}/bin/k3s "$out/bin/k3s" \
+    # wildcard to match the arm64 build too
+    install -m 0755 dist/artifacts/k3s* -D $out/bin/k3s
+    wrapProgram $out/bin/k3s \
       --prefix PATH : ${lib.makeBinPath k3sRuntimeDeps} \
       --prefix PATH : "$out/bin"
-    runHook postInstall
   '';
 
   doInstallCheck = true;
   installCheckPhase = ''
-    $out/bin/k3s --version | grep v${k3sVersion} > /dev/null
+    $out/bin/k3s --version | grep -F "v${k3sVersion}" >/dev/null
   '';
 
   passthru.updateScript = ./update.sh;
diff --git a/pkgs/applications/networking/cluster/k3s/patches/0001-scrips-download-strip-downloading-just-package-CRD.patch b/pkgs/applications/networking/cluster/k3s/patches/0001-scrips-download-strip-downloading-just-package-CRD.patch
new file mode 100644
index 000000000000..115fd6824772
--- /dev/null
+++ b/pkgs/applications/networking/cluster/k3s/patches/0001-scrips-download-strip-downloading-just-package-CRD.patch
@@ -0,0 +1,41 @@
+From 6f53bd36a40da4c71486e3b79f6e32d53d6eea5d Mon Sep 17 00:00:00 2001
+From: Euan Kemp <euank@euank.com>
+Date: Thu, 3 Feb 2022 23:50:40 -0800
+Subject: [PATCH 2/2] scrips/download: strip downloading, just package CRD
+
+The CRD packaging is a complicated set of commands, so let's reuse it.
+---
+ scripts/download | 10 ++--------
+ 1 file changed, 2 insertions(+), 8 deletions(-)
+
+diff --git a/scripts/download b/scripts/download
+index 5effc0562a..82361803ee 100755
+--- a/scripts/download
++++ b/scripts/download
+@@ -24,12 +24,6 @@ rm -rf ${CONTAINERD_DIR}
+ mkdir -p ${CHARTS_DIR}
+ mkdir -p ${DATA_DIR}
+ 
+-curl --compressed -sfL https://github.com/k3s-io/k3s-root/releases/download/${VERSION_ROOT}/k3s-root-${ARCH}.tar | tar xf - --exclude=bin/socat
+-
+-git clone --single-branch --branch=${VERSION_RUNC} --depth=1 https://github.com/opencontainers/runc ${RUNC_DIR}
+-
+-git clone --single-branch --branch=${VERSION_CONTAINERD} --depth=1 https://github.com/k3s-io/containerd ${CONTAINERD_DIR}
+-
+ setup_tmp() {
+     TMP_DIR=$(mktemp -d --tmpdir=${CHARTS_DIR})
+     cleanup() {
+@@ -44,8 +38,8 @@ setup_tmp() {
+ 
+ download_and_package_traefik () {
+   echo "Downloading Traefik Helm chart from ${TRAEFIK_URL}"
+-  curl -sfL ${TRAEFIK_URL} -o ${TMP_DIR}/${TRAEFIK_FILE}
+-  code=$?
++  # nixpkgs: copy in our known traefik chart instead
++  cp $TRAEFIK_CHART_FILE ${TMP_DIR}/${TRAEFIK_FILE}
+ 
+   if [ $code -ne 0 ]; then
+     echo "Error: Failed to download Traefik Helm chart!"
+-- 
+2.34.1
+
diff --git a/pkgs/applications/networking/cluster/k3s/patches/0002-Add-nixpkgs-patches.patch b/pkgs/applications/networking/cluster/k3s/patches/0002-Add-nixpkgs-patches.patch
deleted file mode 100644
index dd26810a4563..000000000000
--- a/pkgs/applications/networking/cluster/k3s/patches/0002-Add-nixpkgs-patches.patch
+++ /dev/null
@@ -1,81 +0,0 @@
--Subject: [PATCH 2/2] Add nixpkgs patches
--Original patch by: Euan Kemp <euank@euank.com>
--Adapted by: superherointj
--
--This patch allows us to re-use upstream build scripts when building for nix.
-----
-- 2 files changed:
--   scripts/build
--   scripts/package-cli
--
-diff --git a/scripts/build b/scripts/build
-index 2f3d1dc496..4f4e5aa897 100755
---- a/scripts/build
-+++ b/scripts/build
-@@ -12,7 +12,8 @@ PKG_CONTAINERD="github.com/containerd/containerd"
- PKG_K3S_CONTAINERD="github.com/k3s-io/containerd"
- PKG_CRICTL="github.com/kubernetes-sigs/cri-tools"
- 
--buildDate=$(date -u '+%Y-%m-%dT%H:%M:%SZ')
-+# nixpkgs: deterministic build date
-+buildDate="$(date -d "$(git log -1 --format=%ai)" -u "+%Y-%m-%dT%H:%M:%SZ")"
- 
- VENDOR_PREFIX="${PKG}/vendor/"
- VERSIONFLAGS="
-@@ -89,17 +90,7 @@ cleanup() {
- }
- 
- INSTALLBIN=$(pwd)/bin
--if [ ! -x ${INSTALLBIN}/cni ]; then
--(
--    echo Building cni
--    TMPDIR=$(mktemp -d)
--    trap cleanup EXIT
--    WORKDIR=$TMPDIR/src/github.com/containernetworking/plugins
--    git clone -b $VERSION_CNIPLUGINS https://github.com/rancher/plugins.git $WORKDIR
--    cd $WORKDIR
--    GOPATH=$TMPDIR CGO_ENABLED=0 "${GO}" build -tags "$TAGS" -ldflags "$LDFLAGS $STATIC" -o $INSTALLBIN/cni
--)
--fi
-+# nixpkgs: skip building cni, we build it separately
- # echo Building agent
- # CGO_ENABLED=1 "${GO}" build -tags "$TAGS" -ldflags "$VERSIONFLAGS $LDFLAGS $STATIC" -o bin/k3s-agent ./cmd/agent/main.go
- echo Building server
-@@ -116,10 +107,7 @@ ln -s containerd ./bin/ctr
- #CGO_ENABLED=1 "${GO}" build -tags "$TAGS" -ldflags "$VERSIONFLAGS $LDFLAGS $STATIC_SQLITE" -o bin/ctr ./cmd/ctr/main.go
- # echo Building containerd
- # CGO_ENABLED=0 "${GO}" build -tags "$TAGS" -ldflags "$VERSIONFLAGS $LDFLAGS $STATIC" -o bin/containerd ./cmd/containerd/
--echo Building runc
--rm -f ./build/src/github.com/opencontainers/runc/runc
--make GOPATH=$(pwd)/build EXTRA_LDFLAGS="-w -s" BUILDTAGS="$RUNC_TAGS" -C ./build/src/github.com/opencontainers/runc $RUNC_STATIC
--cp -f ./build/src/github.com/opencontainers/runc/runc ./bin/runc
-+# nixpkgs: we build runc separately
- 
- echo Building containerd-shim
- rm -f ./vendor/github.com/containerd/containerd/bin/containerd-shim
-diff --git a/scripts/package-cli b/scripts/package-cli
-index ab4a6dac63..044b5587d0 100755
---- a/scripts/package-cli
-+++ b/scripts/package-cli
-@@ -50,15 +50,17 @@ fi
- 
- CMD_NAME=dist/artifacts/k3s${BIN_SUFFIX}
- 
--"${GO}" generate
-+CGO_ENABLED=0 env -u GOARCH "${GO}" generate
- LDFLAGS="
-     -X github.com/rancher/k3s/pkg/version.Version=$VERSION
-     -X github.com/rancher/k3s/pkg/version.GitCommit=${COMMIT:0:8}
-     -w -s
- "
--STATIC="-extldflags '-static'"
--CGO_ENABLED=0 "${GO}" build -ldflags "$LDFLAGS $STATIC" -o ${CMD_NAME} ./cmd/k3s/main.go
-+# STATIC="-extldflags '-static'"
-+# nixpkgs: we can depend on dynamic linking because we have a good package manager
-+"${GO}" build -ldflags "$LDFLAGS" -o ${CMD_NAME} ./cmd/k3s/main.go
- 
- stat ${CMD_NAME}
- 
--./scripts/build-upload ${CMD_NAME} ${COMMIT}
-+# nixpkgs: skip uploading
-+# ./scripts/build-upload ${CMD_NAME} ${COMMIT}
diff --git a/pkgs/applications/networking/cluster/k3s/patches/0002-Don-t-build-a-static-binary-in-package-cli.patch b/pkgs/applications/networking/cluster/k3s/patches/0002-Don-t-build-a-static-binary-in-package-cli.patch
new file mode 100644
index 000000000000..886b6ec7409b
--- /dev/null
+++ b/pkgs/applications/networking/cluster/k3s/patches/0002-Don-t-build-a-static-binary-in-package-cli.patch
@@ -0,0 +1,37 @@
+From 49c000c7c5dd7a502a2be4c638d2c32b65673c00 Mon Sep 17 00:00:00 2001
+From: Euan Kemp <euank@euank.com>
+Date: Sun, 6 Feb 2022 23:13:00 -0800
+Subject: [PATCH] Don't build a static binary in package-cli
+
+since nixpkgs prefers dynamically linked binaries.
+
+Also remove "trimpath" for the 'go generate' step because the codegen
+they use doesn't work with trimpath set.
+---
+ scripts/package-cli | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/scripts/package-cli b/scripts/package-cli
+index 28927327b7..95dbb469f1 100755
+--- a/scripts/package-cli
++++ b/scripts/package-cli
+@@ -48,14 +48,13 @@ fi
+ 
+ CMD_NAME=dist/artifacts/k3s${BIN_SUFFIX}
+ 
+-"${GO}" generate
++GOFLAGS="" "${GO}" generate
+ LDFLAGS="
+     -X github.com/rancher/k3s/pkg/version.Version=$VERSION
+     -X github.com/rancher/k3s/pkg/version.GitCommit=${COMMIT:0:8}
+     -w -s
+ "
+-STATIC="-extldflags '-static'"
+-CGO_ENABLED=0 "${GO}" build -ldflags "$LDFLAGS $STATIC" -o ${CMD_NAME} ./cmd/k3s/main.go
++CGO_ENABLED=0 "${GO}" build -ldflags "$LDFLAGS" -o ${CMD_NAME} ./cmd/k3s/main.go
+ 
+ stat ${CMD_NAME}
+ 
+-- 
+2.34.1
+
diff --git a/pkgs/applications/networking/instant-messengers/ripcord/darwin.nix b/pkgs/applications/networking/instant-messengers/ripcord/darwin.nix
new file mode 100644
index 000000000000..ef9dad66b5d6
--- /dev/null
+++ b/pkgs/applications/networking/instant-messengers/ripcord/darwin.nix
@@ -0,0 +1,33 @@
+{ stdenvNoCC, lib, fetchzip }:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "ripcord";
+  version = "0.4.29";
+
+  src = fetchzip {
+    url = "https://cancel.fm/dl/Ripcord_Mac_${version}.zip";
+    sha256 = "sha256-v8iydjLBjFN5LuctpcBpEkhSICxPhLKzLjSASWtsQok=";
+    stripRoot = false;
+  };
+
+  dontBuild = true;
+  dontFixup = true; # modification is not allowed by the license https://cancel.fm/ripcord/shareware-redistribution/
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/Applications
+    cp -r $src/Ripcord.app $out/Applications/
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Desktop chat client for Slack and Discord";
+    homepage = "https://cancel.fm/ripcord/";
+    # See: https://cancel.fm/ripcord/shareware-redistribution/
+    license = licenses.unfreeRedistributable;
+    maintainers = with maintainers; [ mikroskeem ];
+    platforms = [ "x86_64-darwin" ];
+  };
+}
diff --git a/pkgs/applications/networking/instant-messengers/ripcord/default.nix b/pkgs/applications/networking/instant-messengers/ripcord/default.nix
old mode 100755
new mode 100644
diff --git a/pkgs/applications/networking/nextdns/default.nix b/pkgs/applications/networking/nextdns/default.nix
index ae7eb49a1c66..a18257dfeb65 100644
--- a/pkgs/applications/networking/nextdns/default.nix
+++ b/pkgs/applications/networking/nextdns/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "nextdns";
-  version = "1.37.3";
+  version = "1.37.7";
 
   src = fetchFromGitHub {
     owner = "nextdns";
     repo = "nextdns";
     rev = "v${version}";
-    sha256 = "sha256-BCDVn4JaRYIexI7NrRDchUl9u4AEJa+An9ItYYJDs3A=";
+    sha256 = "sha256-L5PeT4Y2oWM1WUJaBK9xgrpfkpvKM1+sA29A3AiDE38=";
   };
 
-  vendorSha256 = "sha256-YZm+DUrH+1xdJrGjmlajbcsnqVODVbZKivVjmqZ2e48=";
+  vendorSha256 = "sha256-6hWD05lXteqL7egj9tiRVHlevKM33i+a+zBUZs7PF7I=";
 
   doCheck = false;
 
diff --git a/pkgs/applications/office/trilium/default.nix b/pkgs/applications/office/trilium/default.nix
index fd317b848109..0c72bc964182 100644
--- a/pkgs/applications/office/trilium/default.nix
+++ b/pkgs/applications/office/trilium/default.nix
@@ -19,16 +19,16 @@ let
     maintainers = with maintainers; [ fliegendewurst ];
   };
 
-  version = "0.50.1";
+  version = "0.50.2";
 
   desktopSource = {
     url = "https://github.com/zadam/trilium/releases/download/v${version}/trilium-linux-x64-${version}.tar.xz";
-    sha256 = "1fb491ld3z6b2cndy8nl7zhpdsbb2v6kkrrc0hv92zm9qnfp7a99";
+    sha256 = "0fljza5afpjxgrzgskjhs7w86aa51d88xzv2h43666638j3c5mvk";
   };
 
   serverSource = {
     url = "https://github.com/zadam/trilium/releases/download/v${version}/trilium-linux-x64-server-${version}.tar.xz";
-    sha256 = "1yfj1i5hsphp1y52rgsapqmmv7cvl4imf6dkv8fp3qx5i7j4y5j9";
+    sha256 = "0jqpi1gc48jxvc68yzx80jp553haihybj3g3c5ymvqmgivwn7n4c";
   };
 
 in {
diff --git a/pkgs/applications/science/electronics/kicad/versions.nix b/pkgs/applications/science/electronics/kicad/versions.nix
index f1ae123c715b..364321afbf71 100644
--- a/pkgs/applications/science/electronics/kicad/versions.nix
+++ b/pkgs/applications/science/electronics/kicad/versions.nix
@@ -3,23 +3,23 @@
 {
   "kicad" = {
     kicadVersion = {
-      version =			"6.0.1";
+      version =			"6.0.2";
       src = {
-        rev =			"79c1e3a40b913f818bddb69ae98d4d38ab81f926";
-        sha256 =		"1vpcbhhw8844hm6vpk3kk405wak531pvcvcpc66z0b48iprk3imr";
+        rev =			"378541a8ebe8a691b61c8ed1b4012c71343acfbb";
+        sha256 =		"1lcl25zkqkyj5rvw9rad3n7bklpg10kmhmhkyyrgg8ql7di6wa0f";
       };
     };
     libVersion = {
-      version =			"6.0.1";
+      version =			"6.0.2";
       libSources = {
-        symbols.rev =		"9f21fdcd5728ce6339dd4e1b26ebe60a1bba05e0";
-        symbols.sha256 =	"1azjx1bmxaz8bniyw75lq60mc8hvay00jn9qdc2zp7isy3c9ibp0";
-        templates.rev =		"5a9266bc796ba5c285401dd1fd900dbc4b6a8cd3";
+        symbols.rev =		"80a176076a8f3785a4cd64e55ec87f27f6fcc163";
+        symbols.sha256 =	"1f57wv5b95iqd64k8ab82fvxnh5q890v7bzclmn019gl6ikisxj5";
+        templates.rev =		"c9a51b852eacc3e64639548032b50edd80ddb27c";
         templates.sha256 =	"13h9ly6amiwm7zkwa2fd9730kh295ls8j95fszlfjp9rczv2yyzm";
-        footprints.rev =	"c7f4881b9ec1cbe7f7e5a0828946d0dd909afbee";
-        footprints.sha256 =	"0mv9xs0mmmfn0yhzx1v55r5app13ckagb16249rabyiz3v5crdpb";
-        packages3d.rev =	"5d0c3590b26835f9d206a355d7579706c06d8bfe";
-        packages3d.sha256 =	"0vwcbzq42hzjl4f0zjaswmiff1x59hv64g5n00mx1gl0gwngnyla";
+        footprints.rev =	"c81b399054b0d3842094d7e8dfe08eb04310573a";
+        footprints.sha256 =	"1xmnq2731v2afan1d08xb1qqgl5xd01v5jphi6cdmw28ri555cna";
+        packages3d.rev =	"75175a21b720c59a26efce9a8c6dba3d032392a9";
+        packages3d.sha256 =	"10zf8hp85ksi84cbiczsksn0ygvri4ffsa126v73nnkx6irw6nkk";
       };
     };
   };
diff --git a/pkgs/development/interpreters/janet/darwin-remove-net-test.patch b/pkgs/development/interpreters/janet/darwin-remove-net-test.patch
new file mode 100644
index 000000000000..b2a66d5465ea
--- /dev/null
+++ b/pkgs/development/interpreters/janet/darwin-remove-net-test.patch
@@ -0,0 +1,20 @@
+diff --git a/test/suite0009.janet b/test/suite0009.janet
+index 6095bc60..25360d60 100644
+--- a/test/suite0009.janet
++++ b/test/suite0009.janet
+@@ -174,15 +174,6 @@
+   (defer (:close stream)
+     (check-matching-names stream)))
+ 
+-# Test localname and peername
+-(repeat 20
+-  (with [s (net/server "127.0.0.1" "8000" names-handler)]
+-    (defn test-names []
+-      (with [conn (net/connect "127.0.0.1" "8000")]
+-        (check-matching-names conn)))
+-    (repeat 20 (test-names)))
+-  (gccollect))
+-
+ # Create pipe
+ 
+ (var pipe-counter 0)
\ No newline at end of file
diff --git a/pkgs/development/interpreters/janet/default.nix b/pkgs/development/interpreters/janet/default.nix
index 35631174e260..a6ee3dc61fad 100644
--- a/pkgs/development/interpreters/janet/default.nix
+++ b/pkgs/development/interpreters/janet/default.nix
@@ -2,25 +2,22 @@
 
 stdenv.mkDerivation rec {
   pname = "janet";
-  version = "1.16.1";
+  version = "1.20.0";
 
   src = fetchFromGitHub {
     owner = "janet-lang";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-TzJbHmHIySlf3asQ02HOdehMR+s0KkPifBiaQ4FvFCg=";
+    sha256 = "sha256-mCeOaTbOQej4Uza9fg+xop77z31SQ3sO09dZK8SVAyU=";
   };
 
-  # we don't have /usr/bin/env in the sandbox, so substitute for a proper,
-  # absolute path to janet
-  postPatch = ''
-    substituteInPlace jpm \
-      --replace '/usr/bin/env janet' $out/bin/janet \
-      --replace /usr/local/lib/janet $out/lib \
-      --replace /usr/local           $out
+  # This release fails the test suite on darwin, remove when debugged.
+  # See https://github.com/NixOS/nixpkgs/pull/150618 for discussion.
+  patches = lib.optionals stdenv.isDarwin ./darwin-remove-net-test.patch;
 
+  postPatch = ''
     substituteInPlace janet.1 \
-      --replace /usr/local/lib/janet $out/lib
+      --replace /usr/local/ $out/
   '';
 
   nativeBuildInputs = [ meson ninja ];
@@ -35,5 +32,7 @@ stdenv.mkDerivation rec {
     license = licenses.mit;
     maintainers = with maintainers; [ andrewchambers peterhoeg ];
     platforms = platforms.all;
+    # Marked as broken when patch is applied, see comment above patch.
+    broken = stdenv.isDarwin;
   };
 }
diff --git a/pkgs/development/interpreters/janet/jpm.nix b/pkgs/development/interpreters/janet/jpm.nix
new file mode 100644
index 000000000000..708930851255
--- /dev/null
+++ b/pkgs/development/interpreters/janet/jpm.nix
@@ -0,0 +1,59 @@
+{ lib, stdenv, fetchFromGitHub, janet }:
+
+let
+  platformFiles = {
+    aarch64-darwin = "macos_config.janet";
+    aarch64-linux = "linux_config.janet";
+    x86_64-darwin = "macos_config.janet";
+    x86_64-linux = "linux_config.janet";
+  };
+
+  platformFile = platformFiles.${stdenv.hostPlatform.system};
+
+in
+stdenv.mkDerivation rec {
+  pname = "jpm";
+  version = "0.0.2";
+
+  src = fetchFromGitHub {
+    owner = "janet-lang";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-nv+vkDjEY711L+C5ibw48DUSNqq2UJiFC2i5LntuBNM=";
+  };
+
+  # `auto-shebangs true` gives us a shebang line that points to janet inside the
+  # jpm bin folder
+  postPatch = ''
+    substituteInPlace configs/${platformFile} \
+      --replace 'auto-shebang true' 'auto-shebang false' \
+      --replace /usr/local $out
+  '';
+
+  dontConfigure = true;
+
+  buildInputs = [ janet ];
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/{lib/janet,share/man/man1}
+
+    janet bootstrap.janet configs/${platformFile}
+
+    runHook postInstall
+  '';
+
+  doInstallCheck = true;
+
+  installCheckPhase = ''
+    $out/bin/jpm help
+  '';
+
+  meta = janet.meta // {
+    description = "Janet Project Manager for the Janet programming language";
+    platforms = lib.attrNames platformFiles;
+  };
+}
diff --git a/pkgs/development/libraries/armadillo/default.nix b/pkgs/development/libraries/armadillo/default.nix
index 850d48ca345d..14400f8ebf95 100644
--- a/pkgs/development/libraries/armadillo/default.nix
+++ b/pkgs/development/libraries/armadillo/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "armadillo";
-  version = "10.7.5";
+  version = "10.8.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/arma/armadillo-${version}.tar.xz";
-    sha256 = "sha256-XQ2f1rNO/Lpqb87/VMDS0T/L6RXXr4owxecs8xfSCU8=";
+    sha256 = "sha256-if3YmL9r/3X278OjAYF+Tt51K5qAkn+wfuNYsT41OSI=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/elpa/default.nix b/pkgs/development/libraries/elpa/default.nix
index 3bb59ce9ca6a..76152996a1d0 100644
--- a/pkgs/development/libraries/elpa/default.nix
+++ b/pkgs/development/libraries/elpa/default.nix
@@ -13,13 +13,15 @@
 , cudatoolkit
 } :
 
-# The standard Scalapack has no iLP64 interface
-assert (!blas.isILP64) && (!lapack.isILP64);
+assert blas.isILP64 == lapack.isILP64;
+assert blas.isILP64 == scalapack.isILP64;
 
 stdenv.mkDerivation rec {
   pname = "elpa";
   version = "2021.11.001";
 
+  passthru = { inherit (blas) isILP64; };
+
   src = fetchurl {
     url = "https://elpa.mpcdf.mpg.de/software/tarball-archive/Releases/${version}/elpa-${version}.tar.gz";
     sha256 = "0bw0nwzwvjfmijfwznmrghypd3q237a3h5g5fcdncilrqnk1sdpv";
@@ -60,7 +62,8 @@ stdenv.mkDerivation rec {
     "--with-mpi"
     "--enable-openmp"
     "--without-threading-support-check-during-build"
-  ] ++ lib.optional (!avxSupport) "--disable-avx"
+  ] ++ lib.optional blas.isILP64 "--enable-64bit-integer-math-support"
+    ++ lib.optional (!avxSupport) "--disable-avx"
     ++ lib.optional (!avx2Support) "--disable-avx2"
     ++ lib.optional (!avx512Support) "--disable-avx512"
     ++ lib.optional (!stdenv.hostPlatform.isx86_64) "--disable-sse"
diff --git a/pkgs/development/python-modules/lightwave/default.nix b/pkgs/development/python-modules/lightwave/default.nix
new file mode 100644
index 000000000000..ba937f7700d9
--- /dev/null
+++ b/pkgs/development/python-modules/lightwave/default.nix
@@ -0,0 +1,32 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "lightwave";
+  version = "0.20";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-jhffMDhgQ257ZQxvidiRgBSnZvzLJFKNU2NZ8AyGTGc=";
+  };
+
+  pythonImportsCheck = [
+    "lightwave"
+  ];
+
+  # Requires phyiscal hardware
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Module for interacting with LightwaveRF hubs";
+    homepage = "https://github.com/GeoffAtHome/lightwave";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/pyasn/default.nix b/pkgs/development/python-modules/pyasn/default.nix
new file mode 100644
index 000000000000..b180226ec46c
--- /dev/null
+++ b/pkgs/development/python-modules/pyasn/default.nix
@@ -0,0 +1,22 @@
+{ lib, buildPythonPackage, fetchPypi, }:
+
+buildPythonPackage rec {
+  pname = "pyasn";
+  version = "1.6.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-6UK1SRY2Pse4tw6urs0OtOQe8bz0ojl7KabXFfzN+SU=";
+  };
+
+  doCheck = false; # Tests require internet connection which wont work
+
+  pythonImportsCheck = [ "pyasn" ];
+
+  meta = with lib; {
+    description = "Offline IP address to Autonomous System Number lookup module";
+    homepage = "https://github.com/hadiasghari/pyasn";
+    license = with licenses; [ bsdOriginal mit ];
+    maintainers = with maintainers; [ onny ];
+  };
+}
diff --git a/pkgs/development/python-modules/sqlmap/default.nix b/pkgs/development/python-modules/sqlmap/default.nix
index 2abfaef9ab39..18dac082f06a 100644
--- a/pkgs/development/python-modules/sqlmap/default.nix
+++ b/pkgs/development/python-modules/sqlmap/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "sqlmap";
-  version = "1.6";
+  version = "1.6.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-gYr/+sgkFT24JXNDHgmT4ee5b977Iax9TLZ9/nh7PP0=";
+    sha256 = "sha256-X8FpGnrF0aHuf3yIzRrxoNAu77UASTL36CQpcuxESV8=";
   };
 
   postPatch = ''
@@ -31,6 +31,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Automatic SQL injection and database takeover tool";
     homepage = "https://sqlmap.org";
+    changelog = "https://github.com/sqlmapproject/sqlmap/releases/tag/${version}";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ bennofs ];
   };
diff --git a/pkgs/development/python-modules/temescal/default.nix b/pkgs/development/python-modules/temescal/default.nix
new file mode 100644
index 000000000000..429b0a23d187
--- /dev/null
+++ b/pkgs/development/python-modules/temescal/default.nix
@@ -0,0 +1,37 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+, pycryptodome
+}:
+
+buildPythonPackage rec {
+  pname = "temescal";
+  version = "0.3";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-V1wsncIm4f6NPa6lwlO9pkDIFBG1K3VhmOQCwyrPGm4=";
+  };
+
+  propagatedBuildInputs = [
+    pycryptodome
+  ];
+
+  # Module has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "temescal"
+  ];
+
+  meta = with lib; {
+    description = "Module for interacting with LG speaker systems";
+    homepage = "https://github.com/google/python-temescal";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/ttp/default.nix b/pkgs/development/python-modules/ttp/default.nix
index d4200bc66f7d..2157af318110 100644
--- a/pkgs/development/python-modules/ttp/default.nix
+++ b/pkgs/development/python-modules/ttp/default.nix
@@ -19,14 +19,14 @@ let
 in
 buildPythonPackage rec {
   pname = "ttp";
-  version = "0.8.3";
+  version = "0.8.4";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "dmulyalin";
     repo = pname;
     rev = version;
-    sha256 = "0rnixz01dnxl1hmzh34v4w4c117ncldr33ws0m2hqhjf5n4kgrg3";
+    sha256 = "sha256-vuKlddqm8KirqAJyvBPfRb5Nw9zo4Fl1bwbfVMhmH9g=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/continuous-integration/drone-runner-docker/default.nix b/pkgs/development/tools/continuous-integration/drone-runner-docker/default.nix
index a2e7b739718b..fa2957be986d 100644
--- a/pkgs/development/tools/continuous-integration/drone-runner-docker/default.nix
+++ b/pkgs/development/tools/continuous-integration/drone-runner-docker/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "drone-runner-docker";
-  version = "1.6.3";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "drone-runners";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-WI3pr0t6EevIBOQwCAI+CY2O8Q7+W/CLDT/5Y0+tduQ=";
+    sha256 = "sha256-F04h9kwrVvQEenzw1QTeNnQun9tHzu8HT24gNEMcRro=";
   };
 
-  vendorSha256 = "15lpdliqz129yq5zgzjvndwdxngxa96g0ska4zkny7ycb3vwq0xm";
+  vendorSha256 = "sha256-E18ykjQc1eoHpviYok+NiLaeH01UMQmigl9JDwtR+zo=";
 
   meta = with lib; {
     maintainers = with maintainers; [ endocrimes ];
diff --git a/pkgs/development/tools/jfmt/default.nix b/pkgs/development/tools/jfmt/default.nix
new file mode 100644
index 000000000000..cf1292b4b121
--- /dev/null
+++ b/pkgs/development/tools/jfmt/default.nix
@@ -0,0 +1,22 @@
+{ lib, rustPlatform, fetchFromGitHub }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "jfmt";
+  version = "1.2.0";
+
+  src = fetchFromGitHub {
+    owner = "scruffystuffs";
+    repo = "${pname}.rs";
+    rev = version;
+    sha256 = "07qb0sjwww6d2n7fw8w4razq1mkn4psrs9wqi1ccndrya1y39d8b";
+  };
+
+  cargoSha256 = "19kg2n53y9nazwpp8gcvdprxry2llf2k7g4q4zalyxkhpf7k6irb";
+
+  meta = with lib; {
+    description = "CLI utility to format json files";
+    homepage = "https://github.com/scruffystuffs/jfmt.rs";
+    license = licenses.mit;
+    maintainers = [ maintainers.psibi ];
+  };
+}
diff --git a/pkgs/development/tools/misc/hydra/common.nix b/pkgs/development/tools/misc/hydra/common.nix
index fd1896f24b81..1ae54d629acc 100644
--- a/pkgs/development/tools/misc/hydra/common.nix
+++ b/pkgs/development/tools/misc/hydra/common.nix
@@ -137,6 +137,6 @@ in stdenv.mkDerivation rec {
     description = "Nix-based continuous build system";
     license = licenses.gpl3;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ ma27 ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 22744e2e4c50..8518f0350f18 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -459,12 +459,12 @@
     "launch_library" = ps: with ps; [ pylaunches ];
     "lcn" = ps: with ps; [ pypck ];
     "lg_netcast" = ps: with ps; [ pylgnetcast ];
-    "lg_soundbar" = ps: with ps; [ ]; # missing inputs: temescal
+    "lg_soundbar" = ps: with ps; [ temescal ];
     "life360" = ps: with ps; [ life360 ];
     "lifx" = ps: with ps; [ aiolifx aiolifx-effects ];
     "lifx_cloud" = ps: with ps; [ ];
     "light" = ps: with ps; [ ];
-    "lightwave" = ps: with ps; [ ]; # missing inputs: lightwave
+    "lightwave" = ps: with ps; [ lightwave ];
     "limitlessled" = ps: with ps; [ limitlessled ];
     "linksys_smart" = ps: with ps; [ ];
     "linode" = ps: with ps; [ linode-api ];
diff --git a/pkgs/servers/rmfakecloud/default.nix b/pkgs/servers/rmfakecloud/default.nix
new file mode 100644
index 000000000000..b3055cf566c0
--- /dev/null
+++ b/pkgs/servers/rmfakecloud/default.nix
@@ -0,0 +1,31 @@
+{ lib, fetchFromGitHub, buildGoModule }:
+
+buildGoModule rec {
+  pname = "rmfakecloud";
+  version = "0.0.7";
+
+  src = fetchFromGitHub {
+    owner = "ddvk";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-Ax+eozbAIE3425ndT4z4fVBMwzLN7iR5fTz8rz60zWg=";
+  };
+
+  vendorSha256 = "sha256-NwDaPpjkQogXE37RGS3zEALlp3NuXP9RW//vbwM6y0A=";
+
+  postPatch = ''
+    # skip including the JS SPA, which is difficult to build
+    sed -i '/go:/d' ui/assets.go
+  '';
+
+  ldflags = [
+    "-s" "-w" "-X main.version=v${version}"
+  ];
+
+  meta = with lib; {
+    description = "Host your own cloud for the Remarkable";
+    homepage = "https://ddvk.github.io/rmfakecloud/";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ pacien martinetd ];
+  };
+}
diff --git a/pkgs/tools/bluetooth/blueberry/default.nix b/pkgs/tools/bluetooth/blueberry/default.nix
index 2ef7fedefc40..5616560108cf 100644
--- a/pkgs/tools/bluetooth/blueberry/default.nix
+++ b/pkgs/tools/bluetooth/blueberry/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "blueberry";
-  version = "1.4.6";
+  version = "1.4.7";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = pname;
     rev = version;
-    sha256 = "sha256-4SKEkoIEflOX5WXJ7X3onrieecT2NoH/eV3H3Cx/SYQ=";
+    sha256 = "sha256-ziAdLFSZS8bh+OBSYLqxJ3g7mgFai/psvlBw3Qt17w0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/misc/disfetch/default.nix b/pkgs/tools/misc/disfetch/default.nix
index 83be1943a308..57ab08971861 100644
--- a/pkgs/tools/misc/disfetch/default.nix
+++ b/pkgs/tools/misc/disfetch/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "disfetch";
-  version = "3.3";
+  version = "3.6";
 
   src = fetchFromGitHub {
     owner = "q60";
     repo = "disfetch";
     rev = version;
-    sha256 = "sha256-pKjSEK0DuQf2rBkOtqRhfhnpEHMqvmXwzKrwKL/T3QU=";
+    sha256 = "sha256-/Not2jNwk3jX8TLN7CT3JXDilatSYXPaudGKNAgQDPY=";
   };
 
   dontBuild = true;
diff --git a/pkgs/tools/misc/starship/default.nix b/pkgs/tools/misc/starship/default.nix
index 770be03243a6..6205106858ef 100644
--- a/pkgs/tools/misc/starship/default.nix
+++ b/pkgs/tools/misc/starship/default.nix
@@ -12,13 +12,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "starship";
-  version = "1.2.1";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "starship";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-5MJA8eHo1enOHlLpAOF1iDvOHCS/Nw0sc84VWu9nApE=";
+    sha256 = "sha256-mqUE4JzNBhvtDpT2LM23eHX8q93wtPqA+/zr/PxEDiE=";
   };
 
   nativeBuildInputs = [ installShellFiles ] ++ lib.optionals stdenv.isLinux [ pkg-config ];
@@ -26,8 +26,6 @@ rustPlatform.buildRustPackage rec {
   buildInputs = lib.optionals stdenv.isLinux [ openssl ]
     ++ lib.optionals stdenv.isDarwin [ libiconv Security ];
 
-  buildFeatures = lib.optional (!stdenv.isDarwin) "notify-rust";
-
   postInstall = ''
     for shell in bash fish zsh; do
       STARSHIP_CACHE=$TMPDIR $out/bin/starship completions $shell > starship.$shell
@@ -35,7 +33,7 @@ rustPlatform.buildRustPackage rec {
     done
   '';
 
-  cargoSha256 = "sha256-DTQQFxj6stzlVzSdmv4J4Nsf8X/VMlwvfIumnuK0YDo=";
+  cargoSha256 = "sha256-hQNDiayVT4UgbxcxdXssi/evPvwgyvG/UOFyEHj7jpo=";
 
   preCheck = ''
     HOME=$TMPDIR
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index b0ccd3e86323..36fcb585739f 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6772,6 +6772,8 @@ with pkgs;
 
   jet = callPackage ../development/tools/jet { };
 
+  jfmt = callPackage ../development/tools/jfmt { };
+
   jfsutils = callPackage ../tools/filesystems/jfsutils { };
 
   jhead = callPackage ../tools/graphics/jhead { };
@@ -13593,6 +13595,8 @@ with pkgs;
 
   janet = callPackage ../development/interpreters/janet {};
 
+  jpm = callPackage ../development/interpreters/janet/jpm.nix {};
+
   jelly = callPackage ../development/interpreters/jelly {};
 
   jimtcl = callPackage ../development/interpreters/jimtcl {};
@@ -26623,7 +26627,7 @@ with pkgs;
 
   jwm-settings-manager = callPackage ../applications/window-managers/jwm/jwm-settings-manager.nix { };
 
-  k3s = callPackage ../applications/networking/cluster/k3s {};
+  k3s = callPackage ../applications/networking/cluster/k3s { };
 
   kconf = callPackage ../applications/networking/cluster/kconf { };
 
@@ -28451,7 +28455,10 @@ with pkgs;
 
   ries = callPackage ../applications/science/math/ries { };
 
-  ripcord = qt5.callPackage ../applications/networking/instant-messengers/ripcord { };
+  ripcord = if stdenv.isLinux then
+    qt5.callPackage ../applications/networking/instant-messengers/ripcord { }
+  else
+    callPackage ../applications/networking/instant-messengers/ripcord/darwin.nix { };
 
   ripser = callPackage ../applications/science/math/ripser { };
 
@@ -33553,6 +33560,8 @@ with pkgs;
 
   ricty = callPackage ../data/fonts/ricty { };
 
+  rmfakecloud = callPackage ../servers/rmfakecloud { };
+
   rmfuse = callPackage ../tools/filesystems/rmfuse {};
 
   rmount = callPackage ../tools/filesystems/rmount {};
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index afe94f2645f1..02b72065e4ed 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4670,6 +4670,8 @@ in {
 
   lightparam = callPackage ../development/python-modules/lightparam { };
 
+  lightwave = callPackage ../development/python-modules/lightwave { };
+
   lightwave2 = callPackage ../development/python-modules/lightwave2 { };
 
   lima = callPackage ../development/python-modules/lima { };
@@ -6537,6 +6539,8 @@ in {
     inherit (pkgs) arrow-cpp cmake;
   };
 
+  pyasn = callPackage ../development/python-modules/pyasn { };
+
   pyasn1 = callPackage ../development/python-modules/pyasn1 { };
 
   pyasn1-modules = callPackage ../development/python-modules/pyasn1-modules { };
@@ -9628,6 +9632,8 @@ in {
 
   telfhash = callPackage ../development/python-modules/telfhash { };
 
+  temescal = callPackage ../development/python-modules/temescal { };
+
   tempest = callPackage ../development/python-modules/tempest { };
 
   tempita = callPackage ../development/python-modules/tempita { };