diff --git a/.github/workflows/basic-eval.yml b/.github/workflows/basic-eval.yml
index c12999e8d0c0..fcc07b633b3e 100644
--- a/.github/workflows/basic-eval.yml
+++ b/.github/workflows/basic-eval.yml
@@ -19,7 +19,7 @@ jobs:
     # we don't limit this action to only NixOS repo since the checks are cheap and useful developer feedback
     steps:
     - uses: actions/checkout@v3
-    - uses: cachix/install-nix-action@v18
+    - uses: cachix/install-nix-action@v19
     - uses: cachix/cachix-action@v12
       with:
         # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
diff --git a/.github/workflows/editorconfig.yml b/.github/workflows/editorconfig.yml
index ae411fefbe47..549563d4ec26 100644
--- a/.github/workflows/editorconfig.yml
+++ b/.github/workflows/editorconfig.yml
@@ -28,7 +28,7 @@ jobs:
       with:
         # pull_request_target checks out the base branch by default
         ref: refs/pull/${{ github.event.pull_request.number }}/merge
-    - uses: cachix/install-nix-action@v18
+    - uses: cachix/install-nix-action@v19
       with:
         # nixpkgs commit is pinned so that it doesn't break
         # editorconfig-checker 2.4.0
diff --git a/.github/workflows/manual-nixos.yml b/.github/workflows/manual-nixos.yml
index 08af28fcfb4c..99f14562d50e 100644
--- a/.github/workflows/manual-nixos.yml
+++ b/.github/workflows/manual-nixos.yml
@@ -18,7 +18,7 @@ jobs:
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
-      - uses: cachix/install-nix-action@v18
+      - uses: cachix/install-nix-action@v19
         with:
           # explicitly enable sandbox
           extra_nix_config: sandbox = true
diff --git a/.github/workflows/manual-nixpkgs.yml b/.github/workflows/manual-nixpkgs.yml
index 23f2caf021b8..63b504f670f8 100644
--- a/.github/workflows/manual-nixpkgs.yml
+++ b/.github/workflows/manual-nixpkgs.yml
@@ -18,7 +18,7 @@ jobs:
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
-      - uses: cachix/install-nix-action@v18
+      - uses: cachix/install-nix-action@v19
         with:
           # explicitly enable sandbox
           extra_nix_config: sandbox = true
diff --git a/.github/workflows/manual-rendering.yml b/.github/workflows/manual-rendering.yml
index c9f77c191c66..5534d23416eb 100644
--- a/.github/workflows/manual-rendering.yml
+++ b/.github/workflows/manual-rendering.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: cachix/install-nix-action@v18
+      - uses: cachix/install-nix-action@v19
         with:
           # explicitly enable sandbox
           extra_nix_config: sandbox = true
diff --git a/.github/workflows/update-terraform-providers.yml b/.github/workflows/update-terraform-providers.yml
index 079147f7d724..c57102b0aa0c 100644
--- a/.github/workflows/update-terraform-providers.yml
+++ b/.github/workflows/update-terraform-providers.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: cachix/install-nix-action@v18
+      - uses: cachix/install-nix-action@v19
         with:
           nix_path: nixpkgs=channel:nixpkgs-unstable
       - name: setup
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 4726f1be727e..05940e1dfc7d 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -12827,6 +12827,12 @@
     githubId = 5236428;
     name = "Gaëtan André";
   };
+  rvnstn = {
+    email = "github@rvnstn.de";
+    github = "rvnstn";
+    githubId = 2364742;
+    name = "Tobias Ravenstein";
+  };
   rvolosatovs = {
     email = "rvolosatovs@riseup.net";
     github = "rvolosatovs";
diff --git a/pkgs/applications/graphics/gimp/plugins/default.nix b/pkgs/applications/graphics/gimp/plugins/default.nix
index ae44b47643cd..5f75d2770ac6 100644
--- a/pkgs/applications/graphics/gimp/plugins/default.nix
+++ b/pkgs/applications/graphics/gimp/plugins/default.nix
@@ -109,7 +109,9 @@ in
     /* menu:
        Video
     */
-    name = "gap-2.6.0";
+    pname = "gap";
+    version = "2.6.0";
+
     src = fetchurl {
       url = "https://ftp.gimp.org/pub/gimp/plug-ins/v2.6/gap/gimp-gap-2.6.0.tar.bz2";
       sha256 = "1jic7ixcmsn4kx2cn32nc5087rk6g8xsrz022xy11yfmgvhzb0ql";
@@ -228,7 +230,9 @@ in
     /* menu:
       Filters/Enhance/Wavelet sharpen
     */
-    name = "wavelet-sharpen-0.1.2";
+    pname = "wavelet-sharpen";
+    version = "0.1.2";
+
     # Workaround build failure on -fno-common toolchains like upstream
     # gcc-10. Otherwise build fails as:
     #   ld: interface.o:(.bss+0xe0): multiple definition of `fimg'; plugin.o:(.bss+0x40): first defined here
@@ -271,7 +275,7 @@ in
 
   gimplensfun = pluginDerivation rec {
     version = "unstable-2018-10-21";
-    name = "gimplensfun-${version}";
+    pname = "gimplensfun";
 
     src = fetchFromGitHub {
       owner = "seebk";
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.json b/pkgs/applications/networking/browsers/chromium/upstream-info.json
index 620041643676..3206e56670b3 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@@ -19,9 +19,9 @@
     }
   },
   "beta": {
-    "version": "110.0.5481.77",
-    "sha256": "1kl1k29sr5qw8pg7shvizw4b37fxjlgah56p57kq641iqhnsnj73",
-    "sha256bin64": "0wnzgvwbpmb5ja4ba5mjk4bk0aaxzbw4zi509vw96q6mbqmr4iwr",
+    "version": "111.0.5563.19",
+    "sha256": "0hrapzi45jpkb1b87nzlb896jd2h2jbz1mq91md5r2y6ag6fc55w",
+    "sha256bin64": "1mjrp13xf913xhm9hz6yg595g0jg2afmwvzxzpw79y4snaf2ihza",
     "deps": {
       "gn": {
         "version": "2022-12-12",
diff --git a/pkgs/applications/networking/cluster/kluctl/default.nix b/pkgs/applications/networking/cluster/kluctl/default.nix
index aefcef2baccc..6a02127405d3 100644
--- a/pkgs/applications/networking/cluster/kluctl/default.nix
+++ b/pkgs/applications/networking/cluster/kluctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kluctl";
-  version = "2.18.4";
+  version = "2.19.0";
 
   src = fetchFromGitHub {
     owner = "kluctl";
     repo = "kluctl";
     rev = "v${version}";
-    hash = "sha256-nHfJ7Dt9nAY4fY+U7W46cPRwWSgtGvwdbUjQAynOQdw=";
+    hash = "sha256-2nAgJj/cMDiE5rw/YixNYQNCWnuC/8EX4BrnXN4Npao=";
   };
 
-  vendorHash = "sha256-ADYXLcCYmlQim9KvqkXGdEXJ9cACBsRCb3emcmrL0kg=";
+  vendorHash = "sha256-xBUrY8v4yHtWGaaRXHxQRGdZHzMGoJX2hFLL+0Vb1QY=";
 
   ldflags = [ "-s" "-w" "-X main.version=v${version}" ];
 
diff --git a/pkgs/applications/radio/qdmr/default.nix b/pkgs/applications/radio/qdmr/default.nix
index 6d0d71e86733..aa89d8819751 100644
--- a/pkgs/applications/radio/qdmr/default.nix
+++ b/pkgs/applications/radio/qdmr/default.nix
@@ -9,11 +9,11 @@
   docbook_xsl_ns,
   wrapQtAppsHook,
   libusb1,
-  libyamlcpp,
   qtlocation,
   qtserialport,
   qttools,
   qtbase,
+  yaml-cpp,
 }:
 
 let
@@ -39,12 +39,12 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    libyamlcpp
     libusb1
     qtlocation
     qtserialport
     qttools
     qtbase
+    yaml-cpp
   ];
 
   postPatch = lib.optionalString isLinux ''
diff --git a/pkgs/applications/science/biology/inormalize/default.nix b/pkgs/applications/science/biology/inormalize/default.nix
index 8ea115c6b25d..b4999193e177 100644
--- a/pkgs/applications/science/biology/inormalize/default.nix
+++ b/pkgs/applications/science/biology/inormalize/default.nix
@@ -4,7 +4,7 @@
 
 stdenv.mkDerivation rec {
   pname = "inormalize";
-  name  = "${pname}-2014-10-21";
+  version  = "unstable-2014-10-21";
 
   src = fetchFromGitHub {
     owner  = "BIC-MNI";
diff --git a/pkgs/applications/science/biology/minc-widgets/default.nix b/pkgs/applications/science/biology/minc-widgets/default.nix
index e8aef4138b05..42178722b551 100644
--- a/pkgs/applications/science/biology/minc-widgets/default.nix
+++ b/pkgs/applications/science/biology/minc-widgets/default.nix
@@ -4,8 +4,7 @@
 
 stdenv.mkDerivation rec {
   pname = "minc-widgets";
-  name  = "${pname}-2016-04-20";
-
+  version = "unstable-2016-04-20";
 
   src = fetchFromGitHub {
     owner  = "BIC-MNI";
diff --git a/pkgs/applications/science/math/R/default.nix b/pkgs/applications/science/math/R/default.nix
index 83acfcfe9c37..580de87bdb23 100644
--- a/pkgs/applications/science/math/R/default.nix
+++ b/pkgs/applications/science/math/R/default.nix
@@ -8,15 +8,18 @@
 # R as of writing does not support outputting both .so and .a files; it outputs:
 #     --enable-R-static-lib conflicts with --enable-R-shlib and will be ignored
 , static ? false
+, testers
 }:
 
 assert (!blas.isILP64) && (!lapack.isILP64);
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "R";
   version = "4.2.2";
 
-  src = fetchurl {
+  src = let
+    inherit (finalAttrs) pname version;
+  in fetchurl {
     url = "https://cran.r-project.org/src/base/R-${lib.versions.major version}/${pname}-${version}.tar.gz";
     sha256 = "sha256-D/YrQuxRr6VxPK7nxP3noMRZQLo5vvjFyUh/7wyVPfU=";
   };
@@ -97,6 +100,8 @@ stdenv.mkDerivation rec {
 
   setupHook = ./setup-hook.sh;
 
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
   meta = with lib; {
     homepage = "http://www.r-project.org/";
     description = "Free software environment for statistical computing and graphics";
@@ -121,8 +126,9 @@ stdenv.mkDerivation rec {
       user-defined recursive functions and input and output facilities.
     '';
 
+    pkgConfigModules = [ "libR" ];
     platforms = platforms.all;
 
     maintainers = with maintainers; [ jbedo ] ++ teams.sage.members;
   };
-}
+})
diff --git a/pkgs/applications/window-managers/sway/default.nix b/pkgs/applications/window-managers/sway/default.nix
index 6cfc55240222..32c8cf1b86a3 100644
--- a/pkgs/applications/window-managers/sway/default.nix
+++ b/pkgs/applications/window-managers/sway/default.nix
@@ -22,13 +22,13 @@ let sd-bus-provider = if systemdSupport then "libsystemd" else "basu"; in
 
 stdenv.mkDerivation rec {
   pname = "sway-unwrapped";
-  version = "1.8";
+  version = "1.8.1";
 
   src = fetchFromGitHub {
     owner = "swaywm";
     repo = "sway";
     rev = version;
-    hash = "sha256-r5qf50YK0Wl0gFiFdSE/J6ZU+D/Cz32u1mKzOqnIuJ0=";
+    hash = "sha256-WxnT+le9vneQLFPz2KoBduOI+zfZPhn1fKlaqbPL6/g=";
   };
 
   patches = [
diff --git a/pkgs/data/themes/whitesur/default.nix b/pkgs/data/themes/whitesur/default.nix
index 1073fd8f2505..c01c8e08166e 100644
--- a/pkgs/data/themes/whitesur/default.nix
+++ b/pkgs/data/themes/whitesur/default.nix
@@ -33,13 +33,13 @@ lib.checkListOfEnum "${pname}: panel size" [ "default" "smaller" "bigger" ] (sin
 
 stdenv.mkDerivation rec {
   pname = "whitesur-gtk-theme";
-  version = "2022-10-27";
+  version = "2023-02-07";
 
   src = fetchFromGitHub {
     owner = "vinceliuice";
     repo = pname;
     rev = version;
-    sha256 = "sha256-jOrTasnkNExCgvST+09JOQ0iosjoEu3aoj3C1pNHTgY=";
+    sha256 = "sha256-RGYD2+ZTUTPyFbaHvXU9VD3W6WTNeg3ifY+DAR3MmtI=";
   };
 
   nativeBuildInputs = [
@@ -61,10 +61,10 @@ stdenv.mkDerivation rec {
     done
 
     # Do not provide `sudo`, as it is not needed in our use case of the install script
-    substituteInPlace lib-core.sh --replace '$(which sudo)' false
+    substituteInPlace shell/lib-core.sh --replace '$(which sudo)' false
 
     # Provides a dummy home directory
-    substituteInPlace lib-core.sh --replace 'MY_HOME=$(getent passwd "''${MY_USERNAME}" | cut -d: -f6)' 'MY_HOME=/tmp'
+    substituteInPlace shell/lib-core.sh --replace 'MY_HOME=$(getent passwd "''${MY_USERNAME}" | cut -d: -f6)' 'MY_HOME=/tmp'
   '';
 
   dontBuild = true;
diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index dceada0f7f8f..d0374c74901e 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -266,6 +266,10 @@
 , MediaToolbox
 , VideoDecodeAcceleration
 , VideoToolbox
+/*
+ *  Testing
+ */
+, testers
 }:
 
 /* Maintainer notes:
@@ -321,13 +325,13 @@ assert buildAvformat -> buildAvcodec && buildAvutil; # configure flag since 0.6
 assert buildPostproc -> buildAvutil;
 assert buildSwscale -> buildAvutil;
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "ffmpeg" + (if ffmpegVariant == "small" then "" else "-${ffmpegVariant}");
   inherit version;
 
   src = fetchgit {
     url = "https://git.ffmpeg.org/ffmpeg.git";
-    rev = "n${version}";
+    rev = "n${finalAttrs.version}";
     inherit sha256;
   };
 
@@ -522,7 +526,7 @@ stdenv.mkDerivation rec {
   # outputs where we don't want them. Patch the generated config.h to remove all
   # such references except for data.
   postConfigure = let
-    toStrip = lib.remove "data" outputs; # We want to keep references to the data dir.
+    toStrip = lib.remove "data" finalAttrs.outputs; # We want to keep references to the data dir.
   in
     "remove-references-to ${lib.concatStringsSep " " (map (o: "-t ${placeholder o}") toStrip)} config.h";
 
@@ -656,6 +660,8 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
   meta = with lib; {
     description = "A complete, cross-platform solution to record, convert and stream audio and video";
     homepage = "https://www.ffmpeg.org/";
@@ -671,7 +677,8 @@ stdenv.mkDerivation rec {
       ++ optional withGPL gpl2Plus
       ++ optional withGPLv3 gpl3Plus
       ++ optional withUnfree unfreeRedistributable;
+    pkgConfigModules = [ "libavutil" ];
     platforms = platforms.all;
     maintainers = with maintainers; [ atemu ];
   };
-}
+})
diff --git a/pkgs/development/libraries/hidapi/default.nix b/pkgs/development/libraries/hidapi/default.nix
index b29b64c2a757..e9bfe33e9f48 100644
--- a/pkgs/development/libraries/hidapi/default.nix
+++ b/pkgs/development/libraries/hidapi/default.nix
@@ -7,16 +7,17 @@
 , udev
 , Cocoa
 , IOKit
+, testers
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "hidapi";
   version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "libusb";
     repo = "hidapi";
-    rev = "${pname}-${version}";
+    rev = "${finalAttrs.pname}-${finalAttrs.version}";
     sha256 = "sha256-SMhlcB7LcViC6UFVYACjunxsGkvSOKC3mbLBH4XQSzM=";
   };
 
@@ -28,12 +29,20 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = lib.optionals stdenv.isDarwin [ Cocoa IOKit ];
 
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
   meta = with lib; {
     description = "Library for communicating with USB and Bluetooth HID devices";
     homepage = "https://github.com/libusb/hidapi";
     maintainers = with maintainers; [ prusnak ];
     # You can choose between GPLv3, BSD or HIDAPI license (even more liberal)
     license = with licenses; [ bsd3 /* or */ gpl3Only ] ;
+    pkgConfigModules = lib.optionals stdenv.isDarwin [
+      "hidapi"
+    ] ++ lib.optionals stdenv.isLinux [
+      "hidapi-hidraw"
+      "hidapi-libusb"
+    ];
     platforms = platforms.unix;
   };
-}
+})
diff --git a/pkgs/development/libraries/icu/63.nix b/pkgs/development/libraries/icu/63.nix
index 19838763f5b4..a83e2cd5f5eb 100644
--- a/pkgs/development/libraries/icu/63.nix
+++ b/pkgs/development/libraries/icu/63.nix
@@ -1,4 +1,6 @@
-{ stdenv, lib, fetchurl, fetchpatch, fixDarwinDylibNames, nativeBuildRoot, buildRootOnly ? false }:
+{ stdenv, lib, fetchurl, fetchpatch, fixDarwinDylibNames, nativeBuildRoot, testers
+, buildRootOnly ? false
+}:
 
 import ./base.nix {
   version = "63.1";
@@ -11,4 +13,4 @@ import ./base.nix {
     })
   ];
   patchFlags = [ "-p3" ];
-} { inherit stdenv lib fetchurl fixDarwinDylibNames nativeBuildRoot buildRootOnly; }
+} { inherit stdenv lib fetchurl fixDarwinDylibNames nativeBuildRoot testers buildRootOnly; }
diff --git a/pkgs/development/libraries/icu/base.nix b/pkgs/development/libraries/icu/base.nix
index a714e758bd88..c5e46fa4530d 100644
--- a/pkgs/development/libraries/icu/base.nix
+++ b/pkgs/development/libraries/icu/base.nix
@@ -2,6 +2,7 @@
 { stdenv, lib, fetchurl, fixDarwinDylibNames
   # Cross-compiled icu4c requires a build-root of a native compile
 , buildRootOnly ? false, nativeBuildRoot
+, testers
 }:
 
 let
@@ -45,6 +46,11 @@ let
       description = "Unicode and globalization support library";
       homepage = "https://icu.unicode.org/";
       maintainers = with maintainers; [ raskin ];
+      pkgConfigModules = [
+        "icu-i18n"
+        "icu-io"
+        "icu-uc"
+      ];
       platforms = platforms.all;
     };
   };
@@ -97,4 +103,6 @@ let
             then buildRootOnlyAttrs
           else realAttrs;
 in
-stdenv.mkDerivation attrs
+stdenv.mkDerivation (finalAttrs: attrs // {
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+})
diff --git a/pkgs/development/libraries/imlib2/default.nix b/pkgs/development/libraries/imlib2/default.nix
index 66092f436509..02707c750c06 100644
--- a/pkgs/development/libraries/imlib2/default.nix
+++ b/pkgs/development/libraries/imlib2/default.nix
@@ -21,17 +21,18 @@
 , fluxbox
 , enlightenment
 , xorg
+, testers
 }:
 
 let
   inherit (lib) optional optionals;
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "imlib2";
   version = "1.9.1";
 
   src = fetchurl {
-    url = "mirror://sourceforge/enlightenment/${pname}-${version}.tar.xz";
+    url = "mirror://sourceforge/enlightenment/${finalAttrs.pname}-${finalAttrs.version}.tar.xz";
     hash = "sha256-SiJAOL//vl1NJQxE4F9O5a4k3P74OVsWd8cVxY92TUM=";
   };
 
@@ -69,6 +70,8 @@ stdenv.mkDerivation rec {
       enlightenment;
   };
 
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
   meta = with lib; {
     description = "Image manipulation library";
 
@@ -83,7 +86,8 @@ stdenv.mkDerivation rec {
     homepage = "https://docs.enlightenment.org/api/imlib2/html";
     changelog = "https://git.enlightenment.org/legacy/imlib2.git/plain/ChangeLog?h=v${version}";
     license = licenses.imlib2;
+    pkgConfigModules = [ "imlib2" ];
     platforms = platforms.unix;
     maintainers = with maintainers; [ spwhitt ];
   };
-}
+})
diff --git a/pkgs/development/libraries/libb2/default.nix b/pkgs/development/libraries/libb2/default.nix
index a461f5039aa7..9e507188aad3 100644
--- a/pkgs/development/libraries/libb2/default.nix
+++ b/pkgs/development/libraries/libb2/default.nix
@@ -4,16 +4,17 @@
 , autoreconfHook
 , libtool
 , pkg-config
+, testers
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libb2";
   version = "0.98.1";
 
   src = fetchFromGitHub {
     owner = "BLAKE2";
     repo = "libb2";
-    rev = "refs/tags/v${version}";
+    rev = "refs/tags/v${finalAttrs.version}";
     sha256 = "0qj8aaqvfcavj1vj5asm4pqm03ap7q8x4c2fy83cqggvky0frgya";
   };
 
@@ -29,11 +30,14 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
   meta = with lib; {
     description = "The BLAKE2 family of cryptographic hash functions";
     homepage = "https://blake2.net/";
+    pkgConfigModules = [ "libb2" ];
     platforms = platforms.all;
     maintainers = with maintainers; [ dfoxfranke dotlambda ];
     license = licenses.cc0;
   };
-}
+})
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 488613fd489a..75ffe5ae06a6 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -10,6 +10,7 @@
 # path to openssl.cnf file. will be placed in $etc/etc/ssl/openssl.cnf to replace the default
 , conf ? null
 , removeReferencesTo
+, testers
 }:
 
 # Note: this package is used for bootstrapping fetchurl, and thus
@@ -19,12 +20,12 @@
 
 let
   common = { version, sha256, patches ? [], withDocs ? false, extraMeta ? {} }:
-   stdenv.mkDerivation rec {
+   stdenv.mkDerivation (finalAttrs: {
     pname = "openssl";
     inherit version;
 
     src = fetchurl {
-      url = "https://www.openssl.org/source/${pname}-${version}.tar.gz";
+      url = "https://www.openssl.org/source/${finalAttrs.pname}-${version}.tar.gz";
       inherit sha256;
     };
 
@@ -204,13 +205,20 @@ let
       fi
     '';
 
+    passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
     meta = with lib; {
       homepage = "https://www.openssl.org/";
       description = "A cryptographic library that implements the SSL and TLS protocols";
       license = licenses.openssl;
+      pkgConfigModules = [
+        "libcrypto"
+        "libssl"
+        "openssl"
+      ];
       platforms = platforms.all;
     } // extraMeta;
-  };
+  });
 
 in {
 
diff --git a/pkgs/development/libraries/science/math/liblapack/default.nix b/pkgs/development/libraries/science/math/liblapack/default.nix
index b9563346ada4..3bf16057f835 100644
--- a/pkgs/development/libraries/science/math/liblapack/default.nix
+++ b/pkgs/development/libraries/science/math/liblapack/default.nix
@@ -6,16 +6,17 @@
 , shared ? true
 # Compile with ILP64 interface
 , blas64 ? false
+, testers
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "liblapack";
   version = "3.11";
 
   src = fetchFromGitHub {
     owner = "Reference-LAPACK";
     repo = "lapack";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     sha256 = "sha256-AYD78u70y8cY19hmM/aDjQEzxO8u9lPWhCFxRe5cqXI=";
   };
 
@@ -40,7 +41,7 @@ stdenv.mkDerivation rec {
 
   postInstall =  let
     canonicalExtension = if stdenv.hostPlatform.isLinux
-                       then "${stdenv.hostPlatform.extensions.sharedLibrary}.${lib.versions.major version}"
+                       then "${stdenv.hostPlatform.extensions.sharedLibrary}.${lib.versions.major finalAttrs.version}"
                        else stdenv.hostPlatform.extensions.sharedLibrary;
   in lib.optionalString blas64 ''
     ln -s $out/lib/liblapack64${canonicalExtension} $out/lib/liblapack${canonicalExtension}
@@ -65,15 +66,18 @@ stdenv.mkDerivation rec {
 
   checkPhase = ''
     runHook preCheck
-    ctest ${ctestArgs}
+    ctest ${finalAttrs.ctestArgs}
     runHook postCheck
   '';
 
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
   meta = with lib; {
     description = "Linear Algebra PACKage";
     homepage = "http://www.netlib.org/lapack/";
     maintainers = with maintainers; [ markuskowa ];
     license = licenses.bsd3;
+    pkgConfigModules = [ "lapack" ];
     platforms = platforms.all;
   };
-}
+})
diff --git a/pkgs/development/libraries/webkitgtk/default.nix b/pkgs/development/libraries/webkitgtk/default.nix
index 99ee89edcac3..fdefeb86a046 100644
--- a/pkgs/development/libraries/webkitgtk/default.nix
+++ b/pkgs/development/libraries/webkitgtk/default.nix
@@ -64,6 +64,7 @@
 , enableGeoLocation ? true
 , withLibsecret ? true
 , systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemd
+, testers
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -232,10 +233,17 @@ stdenv.mkDerivation (finalAttrs: {
 
   requiredSystemFeatures = [ "big-parallel" ];
 
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
   meta = with lib; {
     description = "Web content rendering engine, GTK port";
     homepage = "https://webkitgtk.org/";
     license = licenses.bsd2;
+    pkgConfigModules = [
+      "javascriptcoregtk-4.0"
+      "webkit2gtk-4.0"
+      "webkit2gtk-web-extension-4.0"
+    ];
     platforms = platforms.linux ++ platforms.darwin;
     maintainers = teams.gnome.members;
     broken = stdenv.isDarwin;
diff --git a/pkgs/development/libraries/xgboost/default.nix b/pkgs/development/libraries/xgboost/default.nix
index bf2825b5967e..4370a27012dc 100644
--- a/pkgs/development/libraries/xgboost/default.nix
+++ b/pkgs/development/libraries/xgboost/default.nix
@@ -1,69 +1,110 @@
-{ config
-, stdenv
-, lib
-, fetchFromGitHub
-, cmake
-, gtest
-, doCheck ? true
-, cudaSupport ? config.cudaSupport or false
-, ncclSupport ? false
-, cudaPackages
-, llvmPackages
-}:
+{ config, stdenv, lib, fetchFromGitHub, cmake, gtest, doCheck ? true
+, cudaSupport ? config.cudaSupport or false, ncclSupport ? false
+, rLibrary ? false, cudaPackages, llvmPackages, R, rPackages }:
 
 assert ncclSupport -> cudaSupport;
+# Disable regular tests when building the R package
+# because 1) the R package runs its own tests and
+# 2) the R package creates a different binary shared
+# object that isn't compatible with the regular CLI
+# tests.
+assert rLibrary -> doCheck != true;
 
 stdenv.mkDerivation rec {
-  pname = "xgboost";
+  pnameBase = "xgboost";
+  # prefix with r when building the R library
+  # The R package build results in a special xgboost.so file
+  # that contains a subset of the .so file use for the CLI
+  # and python version. In general, the CRAN version from
+  # nixpkgs's r-modules should be used, but this non-standard
+  # build allows for enabling CUDA and NCCL support which aren't
+  # included in the CRAN release. Build with:
+  # nix-build -E "with (import $NIXPKGS{}); \
+  #   let \
+  #     xgb = xgboost.override{rLibrary = true; doCheck = false;}; \
+  #   in \
+  #   rWrapper.override{ packages = [ xgb ]; }"
+  pname = lib.optionalString rLibrary "r-" + pnameBase;
   version = "1.7.3";
 
   src = fetchFromGitHub {
     owner = "dmlc";
-    repo = pname;
+    repo = pnameBase;
     rev = "v${version}";
     fetchSubmodules = true;
     hash = "sha256-unTss2byytG8KUQfg5s34YpRuHHDLo7D/ZickHhz1AE=";
   };
 
-  nativeBuildInputs = [
-    cmake
-  ] ++ lib.optionals stdenv.isDarwin [
-    llvmPackages.openmp
-  ] ++ lib.optionals cudaSupport [
-    cudaPackages.autoAddOpenGLRunpathHook
-  ];
+  nativeBuildInputs = [ cmake ]
+    ++ lib.optionals stdenv.isDarwin [ llvmPackages.openmp ]
+    ++ lib.optionals cudaSupport [ cudaPackages.autoAddOpenGLRunpathHook ]
+    ++ lib.optionals rLibrary [ R ];
 
   buildInputs = [ gtest ] ++ lib.optional cudaSupport cudaPackages.cudatoolkit
-                ++ lib.optional ncclSupport cudaPackages.nccl;
+    ++ lib.optional ncclSupport cudaPackages.nccl;
+
+  propagatedBuildInputs = lib.optionals rLibrary [
+    rPackages.data_table
+    rPackages.jsonlite
+    rPackages.Matrix
+  ];
 
   cmakeFlags = lib.optionals doCheck [ "-DGOOGLE_TEST=ON" ]
-    ++ lib.optionals cudaSupport [ "-DUSE_CUDA=ON" "-DCUDA_HOST_COMPILER=${cudaPackages.cudatoolkit.cc}/bin/cc" ]
-    ++ lib.optionals (cudaSupport && lib.versionAtLeast cudaPackages.cudatoolkit.version "11.4.0") [ "-DBUILD_WITH_CUDA_CUB=ON" ]
-    ++ lib.optionals ncclSupport [ "-DUSE_NCCL=ON" ];
+    ++ lib.optionals cudaSupport [
+      "-DUSE_CUDA=ON"
+      "-DCUDA_HOST_COMPILER=${cudaPackages.cudatoolkit.cc}/bin/cc"
+    ] ++ lib.optionals (cudaSupport
+      && lib.versionAtLeast cudaPackages.cudatoolkit.version "11.4.0")
+    [ "-DBUILD_WITH_CUDA_CUB=ON" ]
+    ++ lib.optionals ncclSupport [ "-DUSE_NCCL=ON" ]
+    ++ lib.optionals rLibrary [ "-DR_LIB=ON" ];
+
+  preConfigure = lib.optionals rLibrary ''
+    substituteInPlace cmake/RPackageInstall.cmake.in --replace "CMD INSTALL" "CMD INSTALL -l $out/library"
+    export R_LIBS_SITE="$R_LIBS_SITE''${R_LIBS_SITE:+:}$out/library"
+  '';
 
   inherit doCheck;
 
   # By default, cmake build will run ctests with all checks enabled
   # If we're building with cuda, we run ctest manually so that we can skip the GPU tests
   checkPhase = lib.optionalString cudaSupport ''
-    ctest --force-new-ctest-process ${lib.optionalString cudaSupport "-E TestXGBoostLib"}
+    ctest --force-new-ctest-process ${
+      lib.optionalString cudaSupport "-E TestXGBoostLib"
+    }
   '';
 
-  installPhase = let
-    libname = "libxgboost${stdenv.hostPlatform.extensions.sharedLibrary}";
-  in ''
-    runHook preInstall
-    mkdir -p $out
-    cp -r ../include $out
-    cp -r ../dmlc-core/include/dmlc $out/include
-    cp -r ../rabit/include/rabit $out/include
-    install -Dm755 ../lib/${libname} $out/lib/${libname}
-    install -Dm755 ../xgboost $out/bin/xgboost
-    runHook postInstall
+  installPhase =
+    let libname = "libxgboost${stdenv.hostPlatform.extensions.sharedLibrary}";
+    in ''
+      runHook preInstall
+      mkdir -p $out
+      cp -r ../include $out
+      cp -r ../dmlc-core/include/dmlc $out/include
+      cp -r ../rabit/include/rabit $out/include
+    '' + lib.optionalString (!rLibrary) ''
+      install -Dm755 ../lib/${libname} $out/lib/${libname}
+      install -Dm755 ../xgboost $out/bin/xgboost
+    ''
+    # the R library option builds a completely different binary xgboost.so instead of
+    # libxgboost.so, which isn't full featured for python and CLI
+    + lib.optionalString rLibrary ''
+      mkdir $out/library
+      export R_LIBS_SITE="$out/library:$R_LIBS_SITE''${R_LIBS_SITE:+:}"
+      make install -l $out/library
+    '' + ''
+      runHook postInstall
+    '';
+
+  postFixup = lib.optionalString rLibrary ''
+    if test -e $out/nix-support/propagated-build-inputs; then
+        ln -s $out/nix-support/propagated-build-inputs $out/nix-support/propagated-user-env-packages
+    fi
   '';
 
   meta = with lib; {
-    description = "Scalable, Portable and Distributed Gradient Boosting (GBDT, GBRT or GBM) Library";
+    description =
+      "Scalable, Portable and Distributed Gradient Boosting (GBDT, GBRT or GBM) Library";
     homepage = "https://github.com/dmlc/xgboost";
     license = licenses.asl20;
     platforms = platforms.unix;
diff --git a/pkgs/development/python-modules/aio-geojson-generic-client/default.nix b/pkgs/development/python-modules/aio-geojson-generic-client/default.nix
index 9a302f5af088..56e5f8475cbc 100644
--- a/pkgs/development/python-modules/aio-geojson-generic-client/default.nix
+++ b/pkgs/development/python-modules/aio-geojson-generic-client/default.nix
@@ -1,7 +1,6 @@
 { lib
 , aiohttp
 , aresponses
-, asynctest
 , buildPythonPackage
 , aio-geojson-client
 , fetchFromGitHub
@@ -33,7 +32,6 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     aresponses
-    asynctest
     pytest-asyncio
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/aio-geojson-usgs-earthquakes/default.nix b/pkgs/development/python-modules/aio-geojson-usgs-earthquakes/default.nix
index 728a666447d3..1cb112583935 100644
--- a/pkgs/development/python-modules/aio-geojson-usgs-earthquakes/default.nix
+++ b/pkgs/development/python-modules/aio-geojson-usgs-earthquakes/default.nix
@@ -2,7 +2,6 @@
 , aio-geojson-client
 , aiohttp
 , aresponses
-, asynctest
 , buildPythonPackage
 , fetchFromGitHub
 , pytest-asyncio
@@ -32,12 +31,14 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
-    aresponses
-    asynctest
-    pytest-asyncio
     pytestCheckHook
   ];
 
+  checkInputs = [
+    aresponses
+    pytest-asyncio
+  ];
+
   pythonImportsCheck = [
     "aio_geojson_usgs_earthquakes"
   ];
diff --git a/pkgs/development/python-modules/cot/default.nix b/pkgs/development/python-modules/cot/default.nix
index 9b7914e5b9c1..ed40735a2063 100644
--- a/pkgs/development/python-modules/cot/default.nix
+++ b/pkgs/development/python-modules/cot/default.nix
@@ -66,6 +66,10 @@ buildPythonPackage rec {
     "TestVMDKConversion"
     # CLI test fails with AssertionError
     "test_help"
+    # Failing TestCOTDeployESXi tests
+    "test_serial_fixup_stubbed"
+    "test_serial_fixup_stubbed_create"
+    "test_serial_fixup_stubbed_vm_not_found"
   ] ++ lib.optionals stdenv.isDarwin [
     "test_serial_fixup_invalid_host"
   ];
diff --git a/pkgs/development/python-modules/nipy/default.nix b/pkgs/development/python-modules/nipy/default.nix
index d5e399701dc8..9f600bdf86ac 100644
--- a/pkgs/development/python-modules/nipy/default.nix
+++ b/pkgs/development/python-modules/nipy/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchPypi
 , pythonOlder
+, cython
 , nose
 , matplotlib
 , nibabel
@@ -21,9 +22,14 @@ buildPythonPackage rec {
     sha256 = "a8a2c97ce854fece4aced5a6394b9fdca5846150ad6d2a36b86590924af3c848";
   };
 
+  nativeBuildInputs = [ cython ];
   buildInputs = lib.optionals doCheck [ nose ];
   propagatedBuildInputs = [ matplotlib nibabel numpy scipy sympy ];
 
+  preBuild = ''
+    make recythonize
+  '';
+
   checkPhase = ''    # wants to be run in a different directory
     mkdir nosetests
     cd nosetests
diff --git a/pkgs/development/tools/wgo/default.nix b/pkgs/development/tools/wgo/default.nix
new file mode 100644
index 000000000000..3440c0f947e8
--- /dev/null
+++ b/pkgs/development/tools/wgo/default.nix
@@ -0,0 +1,27 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "wgo";
+  version = "0.5.1";
+
+  src = fetchFromGitHub {
+    owner = "bokwoon95";
+    repo = "wgo";
+    rev = "v${version}";
+    hash = "sha256-kfa3Lm2oJomhoHbtSPLylRr+BFGV/y7xqSIv3xHHg3Q=";
+  };
+
+  vendorSha256 = "sha256-jxyO3MGrC+y/jJuwur/+tLIsbxGnT57ZXYzaf1lCv7A=";
+
+  ldflags = [ "-s" "-w" ];
+
+  subPackages = [ "." ];
+
+  meta = with lib; {
+    description = "Live reload for Go apps";
+    homepage = "https://github.com/bokwoon95/wgo";
+    license = licenses.mit;
+    maintainers = with maintainers; [ bokwoon95 ];
+  };
+}
+
diff --git a/pkgs/misc/jackaudio/default.nix b/pkgs/misc/jackaudio/default.nix
index 441f3ccb37f4..fce51aabd263 100644
--- a/pkgs/misc/jackaudio/default.nix
+++ b/pkgs/misc/jackaudio/default.nix
@@ -10,6 +10,8 @@
 
 # Extra options
 , prefix ? ""
+
+, testers
 }:
 
 with lib;
@@ -25,7 +27,7 @@ let
   optAlsaLib = if libOnly then null else shouldUsePkg alsa-lib;
   optLibopus = shouldUsePkg libopus;
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "${prefix}jack2";
   version = "1.9.19";
 
@@ -63,11 +65,14 @@ stdenv.mkDerivation rec {
     wrapProgram $out/bin/jack_control --set PYTHONPATH $PYTHONPATH
   '');
 
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
   meta = {
     description = "JACK audio connection kit, version 2 with jackdbus";
     homepage = "https://jackaudio.org";
     license = licenses.gpl2Plus;
+    pkgConfigModules = [ "jack" ];
     platforms = platforms.unix;
     maintainers = with maintainers; [ goibhniu ];
   };
-}
+})
diff --git a/pkgs/misc/jackaudio/jack1.nix b/pkgs/misc/jackaudio/jack1.nix
index ba77e9c3c91a..4e7375a26916 100644
--- a/pkgs/misc/jackaudio/jack1.nix
+++ b/pkgs/misc/jackaudio/jack1.nix
@@ -2,6 +2,8 @@
 
 # Optional Dependencies
 , alsa-lib ? null, db ? null, libuuid ? null, libffado ? null, celt ? null
+
+, testers
 }:
 
 let
@@ -13,12 +15,12 @@ let
   optLibffado = shouldUsePkg libffado;
   optCelt = shouldUsePkg celt;
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "jack1";
   version = "0.125.0";
 
   src = fetchurl {
-    url = "https://jackaudio.org/downloads/jack-audio-connection-kit-${version}.tar.gz";
+    url = "https://jackaudio.org/downloads/jack-audio-connection-kit-${finalAttrs.version}.tar.gz";
     sha256 = "0i6l25dmfk2ji2lrakqq9icnwjxklgcjzzk65dmsff91z2zva5rm";
   };
 
@@ -30,11 +32,14 @@ stdenv.mkDerivation rec {
   buildInputs = [ optAlsaLib optDb optLibffado optCelt ];
   propagatedBuildInputs = [ optLibuuid ];
 
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
   meta = with lib; {
     broken = stdenv.isDarwin;
     description = "JACK audio connection kit";
     homepage = "https://jackaudio.org";
     license = with licenses; [ gpl2 lgpl21 ];
+    pkgConfigModules = [ "jack" ];
     platforms = platforms.unix;
   };
-}
+})
diff --git a/pkgs/os-specific/linux/firmware/linux-firmware/default.nix b/pkgs/os-specific/linux/firmware/linux-firmware/default.nix
index e882ddd69b43..a2229a0a60ce 100644
--- a/pkgs/os-specific/linux/firmware/linux-firmware/default.nix
+++ b/pkgs/os-specific/linux/firmware/linux-firmware/default.nix
@@ -33,5 +33,8 @@ stdenvNoCC.mkDerivation rec {
     priority = 6; # give precedence to kernel firmware
   };
 
-  passthru = { inherit version; };
+  passthru = {
+    inherit version;
+    updateScript = ./update.sh;
+  };
 }
diff --git a/pkgs/servers/web-apps/wordpress/packages/thirdparty.nix b/pkgs/servers/web-apps/wordpress/packages/thirdparty.nix
index 19d23531f6b0..a60c06854183 100644
--- a/pkgs/servers/web-apps/wordpress/packages/thirdparty.nix
+++ b/pkgs/servers/web-apps/wordpress/packages/thirdparty.nix
@@ -5,4 +5,10 @@
     url = "https://storage.googleapis.com/${name}/${name}-stable/${version}/${name}-${version}-wordpress.zip";
     hash = "sha256-XsNFxVL0LF+OHlsqjjTV41x9ERLwMDq9BnKKP3Px2aI=";
   };
+  themes.geist = fetchzip rec {
+    name = "geist";
+    version = "2.0.3";
+    url = "https://github.com/christophery/geist/archive/refs/tags/${version}.zip";
+    hash = "sha256-c85oRhqu5E5IJlpgqKJRQITur1W7x40obOvHZbPevzU=";
+  };
 }
diff --git a/pkgs/tools/compression/brotli/default.nix b/pkgs/tools/compression/brotli/default.nix
index dfac5af0980b..3d15cbd395c4 100644
--- a/pkgs/tools/compression/brotli/default.nix
+++ b/pkgs/tools/compression/brotli/default.nix
@@ -4,18 +4,19 @@
 , cmake
 , fetchpatch
 , staticOnly ? stdenv.hostPlatform.isStatic
+, testers
 }:
 
 # ?TODO: there's also python lib in there
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "brotli";
   version = "1.0.9";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "brotli";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     sha256 = "z6Dhrabav1MDQ4rAcXaDv0aN+qOoh9cvoXZqEWBB13c=";
   };
 
@@ -55,6 +56,8 @@ stdenv.mkDerivation rec {
     cp ../docs/*.3 $out/share/man/man3/
   '';
 
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
   meta = with lib; {
     homepage = "https://github.com/google/brotli";
     description = "A generic-purpose lossless compression algorithm and tool";
@@ -72,6 +75,10 @@ stdenv.mkDerivation rec {
       '';
     license = licenses.mit;
     maintainers = with maintainers; [ freezeboy ];
+    pkgConfigModules = [
+      "libbrotlidec"
+      "libbrotlienc"
+    ];
     platforms = platforms.all;
   };
-}
+})
diff --git a/pkgs/tools/misc/hoard/default.nix b/pkgs/tools/misc/hoard/default.nix
index 1eb1080c16b8..f44787924d94 100644
--- a/pkgs/tools/misc/hoard/default.nix
+++ b/pkgs/tools/misc/hoard/default.nix
@@ -2,13 +2,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "hoard";
-  version = "1.3.0";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "Hyde46";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-WCyu6vW0l8J2Xh8OGXMXVDBs287m2nPlRHeA0j8uvlk=";
+    sha256 = "sha256-Gm3X6/g5JQJEl7wRvWcO4j5XpROhtfRJ72LNaUeZRGc=";
   };
 
   buildInputs = [ ncurses openssl ]
@@ -16,7 +16,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  cargoSha256 = "sha256-Cku9NnrjWT7VmOCryb0sbCQibG+iU9CHT3Cvd6M/9f4=";
+  cargoHash = "sha256-ZNhUqnsme1rczl3FdFBGGs+vBDFcFEELkPp0/udTfR4=";
 
   meta = with lib; {
     description = "CLI command organizer written in rust";
diff --git a/pkgs/tools/networking/openconnect/common.nix b/pkgs/tools/networking/openconnect/common.nix
index 146a2fc6ea50..e35c8d71cce9 100644
--- a/pkgs/tools/networking/openconnect/common.nix
+++ b/pkgs/tools/networking/openconnect/common.nix
@@ -15,7 +15,7 @@
 , zlib
 , vpnc-scripts
 , PCSC
-, useDefaultExternalBrowser ? true
+, useDefaultExternalBrowser ? stdenv.isLinux && stdenv.buildPlatform == stdenv.hostPlatform # xdg-utils doesn't cross-compile
 , xdg-utils
 , autoreconfHook
 }:
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ gmp libxml2 stoken zlib (if useOpenSSL then openssl else gnutls) ]
     ++ lib.optional stdenv.isDarwin PCSC
     ++ lib.optional stdenv.isLinux p11-kit
-    ++ lib.optional (stdenv.isLinux && useDefaultExternalBrowser) xdg-utils;
+    ++ lib.optional useDefaultExternalBrowser xdg-utils;
   nativeBuildInputs = [ pkg-config autoreconfHook ];
 
   meta = with lib; {
diff --git a/pkgs/tools/package-management/nix-index/default.nix b/pkgs/tools/package-management/nix-index/default.nix
index 877141126216..246e7c9c9810 100644
--- a/pkgs/tools/package-management/nix-index/default.nix
+++ b/pkgs/tools/package-management/nix-index/default.nix
@@ -4,16 +4,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nix-index";
-  version = "0.1.4";
+  version = "0.1.5";
 
   src = fetchFromGitHub {
     owner = "bennofs";
     repo = "nix-index";
     rev = "v${version}";
-    sha256 = "sha256-TDGtnSgY897fRm1BWLlQZQa8v6Wu5/JIF4UH+1CZm4U=";
+    sha256 = "sha256-/btQP7I4zpIA0MWEQJVYnR1XhyudPnYD5Qx4vrW+Uq8=";
   };
 
-  cargoSha256 = "sha256-z1lLpZBD4HjO6gLw96wbucfchRgZs26Q8Gl+hpUB1xo=";
+  cargoSha256 = "sha256-CzLBOLtzIYqdWjTDKHVnc1YXXyj1HqvXzoFYHS0qxog=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl curl sqlite ]
diff --git a/pkgs/tools/security/enc/default.nix b/pkgs/tools/security/enc/default.nix
new file mode 100644
index 000000000000..00d6d0211f80
--- /dev/null
+++ b/pkgs/tools/security/enc/default.nix
@@ -0,0 +1,55 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, git
+, installShellFiles
+}:
+
+buildGoModule rec {
+  pname = "enc";
+  version = "1.1.0";
+
+  src = fetchFromGitHub {
+    owner = "life4";
+    repo = "enc";
+    rev = "v${version}";
+    sha256 = "Tt+J/MnYJNewSl5UeewS0b47NGW2yzfcVHA5+9UQWSs=";
+  };
+  vendorSha256 = "lB6GkE6prfBG7OCOJ1gm23Ee5+nAgmJg8I9Nqe1fsRw=";
+
+  proxyVendor = true;
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  subPackages = ".";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/life4/enc/version.GitCommit=${version}"
+  ];
+
+  nativeCheckInputs = [ git ];
+
+  postInstall = ''
+    installShellCompletion --cmd enc \
+      --bash <($out/bin/enc completion bash) \
+      --fish <($out/bin/enc completion fish) \
+      --zsh <($out/bin/enc completion zsh)
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/life4/enc";
+    changelog = "https://github.com/life4/enc/releases/tag/v${version}";
+    description = "A modern and friendly alternative to GnuPG";
+    longDescription = ''
+      Enc is a CLI tool for encryption, a modern and friendly alternative to GnuPG.
+      It is easy to use, secure by default and can encrypt and decrypt files using password or encryption keys,
+      manage and download keys, and sign data.
+      Our goal was to make encryption available to all engineers without the need to learn a lot of new words, concepts,
+      and commands. It is the most beginner-friendly CLI tool for encryption, and keeping it that way is our top priority.
+    '';
+    license = licenses.mit;
+    maintainers = with maintainers; [ rvnstn ];
+  };
+}
diff --git a/pkgs/tools/security/opencryptoki/default.nix b/pkgs/tools/security/opencryptoki/default.nix
index 140f032a5fde..dcb1c0bb0cbe 100644
--- a/pkgs/tools/security/opencryptoki/default.nix
+++ b/pkgs/tools/security/opencryptoki/default.nix
@@ -1,18 +1,36 @@
-{ lib, stdenv, fetchFromGitHub, openssl, trousers, autoreconfHook, libtool, bison, flex }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, autoreconfHook
+, bison
+, flex
+, openldap
+, openssl
+, trousers
+}:
 
 stdenv.mkDerivation rec {
   pname = "opencryptoki";
-  version = "3.8.2";
+  version = "3.19.0";
 
   src = fetchFromGitHub {
     owner = "opencryptoki";
     repo = "opencryptoki";
     rev = "v${version}";
-    sha256 = "1rf7cmibmx636vzv7p54g212478a8wim2lfjf2861hfd0m96nv4l";
+    hash = "sha256-ym13I34H3d1JuVBnItkceUbqpjYFhD+mPgWYHPetF7Y=";
   };
 
-  nativeBuildInputs = [ autoreconfHook libtool bison flex ];
-  buildInputs = [ openssl trousers ];
+  nativeBuildInputs = [
+    autoreconfHook
+    bison
+    flex
+  ];
+
+  buildInputs = [
+    openldap
+    openssl
+    trousers
+  ];
 
   postPatch = ''
     substituteInPlace configure.ac \
@@ -20,18 +38,22 @@ stdenv.mkDerivation rec {
       --replace "groupadd" "true" \
       --replace "chmod" "true" \
       --replace "chgrp" "true"
-    substituteInPlace usr/lib/Makefile.am --replace "DESTDIR" "out"
   '';
 
   configureFlags = [
-    "--prefix=$(out)"
+    "--prefix="
     "--disable-ccatok"
     "--disable-icatok"
   ];
 
   enableParallelBuilding = true;
 
+  installFlags = [
+    "DESTDIR=${placeholder "out"}"
+  ];
+
   meta = with lib; {
+    changelog   = "https://github.com/opencryptoki/opencryptoki/blob/${src.rev}/ChangeLog";
     description = "PKCS#11 implementation for Linux";
     homepage    = "https://github.com/opencryptoki/opencryptoki";
     license     = licenses.cpl10;
diff --git a/pkgs/tools/text/mdbook-katex/default.nix b/pkgs/tools/text/mdbook-katex/default.nix
index ded440fb79c6..7b7062a7526a 100644
--- a/pkgs/tools/text/mdbook-katex/default.nix
+++ b/pkgs/tools/text/mdbook-katex/default.nix
@@ -2,14 +2,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mdbook-katex";
-  version = "0.3.7";
+  version = "0.3.8";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-DZ+5rYRHS5m4Alw6/Ak98UH2FD3EPBGDtB+vD0v8EMk=";
+    hash = "sha256-LeI46x5M2ZYUOIxuj9bCNwwucRLvoOkdRhsowmVxS68=";
   };
 
-  cargoHash = "sha256-i6u7kriLFgMSJDfA6JRjTLc3Oi8GfHjE7wEJbTLnMN8=";
+  cargoHash = "sha256-pEwPnE2EpS+0bw3/SSKOCy8R5xUiG6mBMoup6wbrf+0=";
 
   OPENSSL_DIR = "${lib.getDev openssl}";
   OPENSSL_LIB_DIR = "${lib.getLib openssl}/lib";
diff --git a/pkgs/tools/typesetting/tex/texlive/tl2nix.sed b/pkgs/tools/typesetting/tex/texlive/tl2nix.sed
index 61150fa8b7cf..c02ca35296ec 100644
--- a/pkgs/tools/typesetting/tex/texlive/tl2nix.sed
+++ b/pkgs/tools/typesetting/tex/texlive/tl2nix.sed
@@ -2,37 +2,47 @@
 1itl: { # no indentation
 $a}
 
-# trash packages we don't want
-/^name .*\./,/^$/d
-
-# quote package names, as some start with a number :-/
-s/^name (.*)/name "\1"/
-
-# extract revision
-s/^revision ([0-9]*)$/  revision = \1;/p
-
 # form an attrmap per package
-/^name /s/^name (.*)/\1 = {/p
-/^$/,1i};
+# ignore packages whose name contains "." (such as binaries)
+/^name ([^.]+)$/,/^$/{
+  # quote package names, as some start with a number :-/
+  s/^name (.*)$/"\1" = {/p
+  /^$/,1i};
 
-# extract hashes of *.tar.xz
-s/^containerchecksum (.*)/  sha512.run = "\1";/p
-s/^doccontainerchecksum (.*)/  sha512.doc = "\1";/p
-s/^srccontainerchecksum (.*)/  sha512.source = "\1";/p
-/^runfiles /i\  hasRunfiles = true;
+  # extract revision
+  s/^revision ([0-9]*)$/  revision = \1;/p
 
-# number of path components to strip, defaulting to 1 ("texmf-dist/")
-/^relocated 1/i\  stripPrefix = 0;
+  # extract hashes of *.tar.xz
+  s/^containerchecksum (.*)/  sha512.run = "\1";/p
+  s/^doccontainerchecksum (.*)/  sha512.doc = "\1";/p
+  s/^srccontainerchecksum (.*)/  sha512.source = "\1";/p
+  /^runfiles /i\  hasRunfiles = true;
 
-# extract version and clean unwanted chars from it
-/^catalogue-version/y/ \/~/_--/
-/^catalogue-version/s/[\#,:\(\)]//g
-s/^catalogue-version_(.*)/  version = "\1";/p
+  # number of path components to strip, defaulting to 1 ("texmf-dist/")
+  /^relocated 1/i\  stripPrefix = 0;
 
-# extract deps
-s/^depend ([^.]*)$/  deps."\1" = tl."\1";/p
+  # extract version and clean unwanted chars from it
+  /^catalogue-version/y/ \/~/_--/
+  /^catalogue-version/s/[\#,:\(\)]//g
+  s/^catalogue-version_(.*)/  version = "\1";/p
 
-# extract hyphenation patterns and formats
-# (this may create duplicate lines, use uniq to remove them)
-/^execute\sAddHyphen/i\  hasHyphens = true;
-/^execute\sAddFormat/i\  hasFormats = true;
+  # extract deps
+  /^depend [^.]+$/{
+    s/^depend (.+)$/  deps."\1" = tl."\1";/
+
+    # loop through following depend lines
+    :next
+      h ; N     # save & read next line
+      s/\ndepend (.+)\.(.+)$//
+      s/\ndepend (.+)$/\n  deps."\1" = tl."\1";/
+      t next    # loop if the previous lines matched
+
+    x; p; x     # print saved deps
+    s/^.*\n//   # remove deps, resume processing
+  }
+
+  # extract hyphenation patterns and formats
+  # (this may create duplicate lines, use uniq to remove them)
+  /^execute\sAddHyphen/i\  hasHyphens = true;
+  /^execute\sAddFormat/i\  hasFormats = true;
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0ee84cd2bbd1..005e63be84a7 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7040,6 +7040,8 @@ with pkgs;
     boost = boost172;
   };
 
+  enc = callPackage ../tools/security/enc { };
+
   endlessh = callPackage ../servers/endlessh { };
 
   endlessh-go = callPackage ../servers/endlessh-go { };