diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 2da9655e1599..2a2366c2a536 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -10948,6 +10948,12 @@
     githubId = 7226587;
     name = "Théophane Hufschmitt";
   };
+  rehno-lindeque = {
+    email = "rehno.lindeque+code@gmail.com";
+    github = "rehno-lindeque";
+    githubId = 337811;
+    name = "Rehno Lindeque";
+  };
   relrod = {
     email = "ricky@elrod.me";
     github = "relrod";
diff --git a/pkgs/applications/graphics/tesseract/default.nix b/pkgs/applications/graphics/tesseract/default.nix
index dc5f97318708..70649d633b85 100644
--- a/pkgs/applications/graphics/tesseract/default.nix
+++ b/pkgs/applications/graphics/tesseract/default.nix
@@ -1,9 +1,11 @@
-{ callPackage, lowPrio }:
+{ callPackage, lowPrio, Accelerate, CoreGraphics, CoreVideo}:
 
 let
   base3 = callPackage ./tesseract3.nix {};
   base4 = callPackage ./tesseract4.nix {};
-  base5 = callPackage ./tesseract5.nix {};
+  base5 = callPackage ./tesseract5.nix {
+    inherit Accelerate CoreGraphics CoreVideo;
+  };
   languages = callPackage ./languages.nix {};
 in
 {
diff --git a/pkgs/applications/graphics/tesseract/tesseract5.nix b/pkgs/applications/graphics/tesseract/tesseract5.nix
index a9776d48d0a9..c3dfab7abe22 100644
--- a/pkgs/applications/graphics/tesseract/tesseract5.nix
+++ b/pkgs/applications/graphics/tesseract/tesseract5.nix
@@ -1,5 +1,7 @@
 { lib, stdenv, fetchFromGitHub, autoreconfHook, autoconf-archive, pkg-config
-, leptonica, libpng, libtiff, icu, pango, opencl-headers, fetchpatch }:
+, leptonica, libpng, libtiff, icu, pango, opencl-headers, fetchpatch
+, Accelerate, CoreGraphics, CoreVideo
+}:
 
 stdenv.mkDerivation rec {
   pname = "tesseract";
@@ -27,6 +29,10 @@ stdenv.mkDerivation rec {
     icu
     pango
     opencl-headers
+  ] ++ lib.optionals stdenv.isDarwin [
+    Accelerate
+    CoreGraphics
+    CoreVideo
   ];
 
   meta = {
@@ -34,6 +40,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/tesseract-ocr/tesseract";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ anselmschueler ];
-    platforms = with lib.platforms; linux ++ darwin;
+    platforms = lib.platforms.unix;
   };
 }
diff --git a/pkgs/applications/networking/cluster/nomad/1.3.nix b/pkgs/applications/networking/cluster/nomad/1.3.nix
index 8d4c9805b52a..511b3d34decf 100644
--- a/pkgs/applications/networking/cluster/nomad/1.3.nix
+++ b/pkgs/applications/networking/cluster/nomad/1.3.nix
@@ -4,7 +4,7 @@
 
 callPackage ./generic.nix {
   inherit buildGoModule;
-  version = "1.3.3";
-  sha256 = "sha256-/63QGknivXyBel2MhMzbh/rE+UrfV3mb+zPZzOU15WU=";
-  vendorSha256 = "sha256-5ubJ6hgpdkZd/hwy+u2S6XgQLD5xmgUnaUqJoLdguBQ=";
+  version = "1.3.4";
+  sha256 = "sha256-NeBZVCpylP16dPi68unk3H3/V6gWO/SvJRmjgwwwVts=";
+  vendorSha256 = "sha256-XIHtAB0js55mbVuTTWdLW5BMhQjd6/GUbcBk8DEYZg8=";
 }
diff --git a/pkgs/build-support/rust/build-rust-crate/build-crate.nix b/pkgs/build-support/rust/build-rust-crate/build-crate.nix
index b24398665a10..37bf3ec26f77 100644
--- a/pkgs/build-support/rust/build-rust-crate/build-crate.nix
+++ b/pkgs/build-support/rust/build-rust-crate/build-crate.nix
@@ -69,7 +69,15 @@
 
 
 
-    ${lib.optionalString (lib.length crateBin > 0) (lib.concatMapStringsSep "\n" (bin: ''
+    ${lib.optionalString (lib.length crateBin > 0) (lib.concatMapStringsSep "\n" (bin:
+    let
+      haveRequiredFeature = if bin ? requiredFeatures then
+        # Check that all element in requiredFeatures are also present in crateFeatures
+        lib.intersectLists bin.requiredFeatures crateFeatures == bin.requiredFeatures
+      else
+        true;
+    in
+    if haveRequiredFeature then ''
       mkdir -p target/bin
       BIN_NAME='${bin.name or crateName}'
       ${if !bin ? path then ''
@@ -79,6 +87,8 @@
         BIN_PATH='${bin.path}'
       ''}
         ${build_bin} "$BIN_NAME" "$BIN_PATH"
+    '' else ''
+      echo Binary ${bin.name or crateName} not compiled due to not having all of the required features -- ${lib.escapeShellArg (builtins.toJSON bin.requiredFeatures)} -- enabled.
     '') crateBin)}
 
     ${lib.optionalString buildTests ''
diff --git a/pkgs/development/compilers/halide/default.nix b/pkgs/development/compilers/halide/default.nix
index 853cf1a663e9..78eca7e84db2 100644
--- a/pkgs/development/compilers/halide/default.nix
+++ b/pkgs/development/compilers/halide/default.nix
@@ -15,22 +15,16 @@ assert blas.implementation == "openblas" && lapack.implementation == "openblas";
 
 llvmPackages.stdenv.mkDerivation rec {
   pname = "halide";
-  version = "10.0.0";
+  version = "14.0.0";
 
   src = fetchFromGitHub {
     owner = "halide";
     repo = "Halide";
     rev = "v${version}";
-    sha256 = "0il71rppjp76m7zd420siidvhs76sqiq26h60ywk812sj9mmgxj6";
+    sha256 = "sha256-/7U2TBcpSAKeEyWncAbtW6Vk/cP+rp1CXtbIjvQMmZA=";
   };
 
-  # clang fails to compile intermediate code because
-  # of unused "--gcc-toolchain" option
-  postPatch = ''
-    sed -i "s/-Werror//" src/CMakeLists.txt
-  '';
-
-  cmakeFlags = [ "-DWARNINGS_AS_ERRORS=OFF" "-DWITH_PYTHON_BINDINGS=OFF" ];
+  cmakeFlags = [ "-DWARNINGS_AS_ERRORS=OFF" "-DWITH_PYTHON_BINDINGS=OFF" "-DTARGET_WEBASSEMBLY=OFF" ];
 
   # Note: only openblas and not atlas part of this Nix expression
   # see pkgs/development/libraries/science/math/liblapack/3.5.0.nix
@@ -54,6 +48,6 @@ llvmPackages.stdenv.mkDerivation rec {
     homepage = "https://halide-lang.org";
     license = licenses.mit;
     platforms = platforms.all;
-    maintainers = [ maintainers.ck3d ];
+    maintainers = with maintainers; [ ck3d atila ];
   };
 }
diff --git a/pkgs/development/interpreters/wasmtime/default.nix b/pkgs/development/interpreters/wasmtime/default.nix
index db113b2a4816..d3d4516ca3eb 100644
--- a/pkgs/development/interpreters/wasmtime/default.nix
+++ b/pkgs/development/interpreters/wasmtime/default.nix
@@ -2,17 +2,24 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wasmtime";
-  version = "0.39.1";
+  version = "0.40.0";
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-cU03wm1+V++mV7j7VyMtjAYrPldzTysNzpJ8m0q4Rx8=";
+    sha256 = "sha256-i3dtjKy5YTyNkEaDcGxsrd4lbyUBd25OARESbJVK9uY=";
     fetchSubmodules = true;
   };
 
-  cargoSha256 = "sha256-DnThste0SbBdpGAUYhmwbdQFNEB3LozyDf0X8r2A90Q=";
+  cargoSha256 = "sha256-wlcYdZ8Akkpicyw74sh4CNwSstCtUJxf+oSEL/mUtKc=";
+
+  cargoBuildFlags = [
+    "--package wasmtime-cli"
+    "--package wasmtime-c-api"
+  ];
+
+  outputs = [ "out" "dev" ];
 
   # We disable tests on x86_64-darwin because Hydra runners do not
   # support SSE3, SSSE3, SSE4.1 and SSE4.2 at this time. This is
@@ -31,6 +38,18 @@ rustPlatform.buildRustPackage rec {
     "--skip=traps::parse_dwarf_info"
   ];
 
+  postInstall = ''
+    # move libs from out to dev
+    install -d -m 0755 $dev/lib
+    install -m 0644 ''${!outputLib}/lib/* $dev/lib
+    rm -r ''${!outputLib}/lib
+
+    install -d -m0755 $dev/include/wasmtime
+    install -m0644 $src/crates/c-api/include/*.h $dev/include
+    install -m0644 $src/crates/c-api/include/wasmtime/*.h $dev/include/wasmtime
+    install -m0644 $src/crates/c-api/wasm-c-api/include/* $dev/include
+  '';
+
   meta = with lib; {
     description = "Standalone JIT-style runtime for WebAssembly, using Cranelift";
     homepage = "https://github.com/bytecodealliance/wasmtime";
diff --git a/pkgs/development/libraries/apr/default.nix b/pkgs/development/libraries/apr/default.nix
index e2db4db80e29..536c8a5613a9 100644
--- a/pkgs/development/libraries/apr/default.nix
+++ b/pkgs/development/libraries/apr/default.nix
@@ -27,7 +27,14 @@ stdenv.mkDerivation rec {
       url = "https://github.com/apache/apr/commit/866e1df66be6704a584feaf5c3d241e3d631d03a.patch";
       sha256 = "0hhm5v5wx985c28dq6d9ngnyqihpsphq4mw7rwylk39k2p90ppcm";
     })
-  ] ++ lib.optionals stdenv.isDarwin [ ./is-this-a-compiler-bug.patch ];
+
+    # Cross fix. Patch the /dev/zero mmapable detection logic. https://bugs.gentoo.org/show_bug.cgi?id=830833
+    (fetchpatch {
+      url = "https://830833.bugs.gentoo.org/attachment.cgi?id=761676";
+      name = "cross-assume-dev-zero-mmappable.patch";
+      sha256 = "sha256-rsouJp1o7p0d+AJ5KvyhUU79vAJOcVHEuwSEKaCEGa8=";
+    })
+  ];
 
   # This test needs the net
   postPatch = ''
@@ -43,9 +50,27 @@ stdenv.mkDerivation rec {
     '';
 
   configureFlags = lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) [
+    # For cross builds, provide answers to the configure time tests.
+    # These answers are valid on x86_64-linux and aarch64-linux.
     "ac_cv_file__dev_zero=yes"
-    "ac_cv_func_setpgrp_void=0"
-    "apr_cv_tcp_nodelay_with_cork=1"
+    "ac_cv_func_setpgrp_void=yes"
+    "apr_cv_tcp_nodelay_with_cork=yes"
+    "ac_cv_define_PTHREAD_PROCESS_SHARED=yes"
+    "apr_cv_process_shared_works=yes"
+    "apr_cv_mutex_robust_shared=yes"
+    "ap_cv_atomic_builtins=yes"
+    "apr_cv_mutex_recursive=yes"
+    "apr_cv_epoll=yes"
+    "apr_cv_epoll_create1=yes"
+    "apr_cv_dup3=yes"
+    "apr_cv_accept4=yes"
+    "apr_cv_sock_cloexec=yes"
+    "ac_cv_struct_rlimit=yes"
+    "ac_cv_func_sem_open=yes"
+    "ac_cv_negative_eai=yes"
+    "apr_cv_gai_addrconfig=yes"
+    "ac_cv_o_nonblock_inherited=no"
+    "apr_cv_pthreads_lib=-lpthread"
     "CC_FOR_BUILD=${buildPackages.stdenv.cc}/bin/cc"
   ] ++ lib.optionals (stdenv.hostPlatform.system == "i686-cygwin") [
     # Including the Windows headers breaks unistd.h.
diff --git a/pkgs/development/libraries/totem-pl-parser/default.nix b/pkgs/development/libraries/totem-pl-parser/default.nix
index 1a180be283fb..871b724029c8 100644
--- a/pkgs/development/libraries/totem-pl-parser/default.nix
+++ b/pkgs/development/libraries/totem-pl-parser/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, meson, ninja, pkg-config, gettext, libxml2, gobject-introspection, gnome, glib }:
+{ lib, stdenv, fetchpatch, fetchurl, meson, ninja, pkg-config, gettext, libxml2, gobject-introspection, gnome, glib }:
 
 stdenv.mkDerivation rec {
   pname = "totem-pl-parser";
@@ -9,6 +9,14 @@ stdenv.mkDerivation rec {
     sha256 = "wN8PaNXPnX2kPIHH8T8RFYNYNo+Ywi1Hci870EvTrBw=";
   };
 
+  patches = [
+    # Upstream MR: https://gitlab.gnome.org/GNOME/totem-pl-parser/-/merge_requests/46
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/totem-pl-parser/-/commit/f4f69c9b99095416aaed18a73f7486ad9eb04aa9.patch";
+      sha256 = "sha256-Uya5fgFgauv5rIpVK3CDGCieyMus7VjcLMMe/vQ2WWY=";
+    })
+  ];
+
   passthru = {
     updateScript = gnome.updateScript {
       packageName = pname;
@@ -30,6 +38,6 @@ stdenv.mkDerivation rec {
     description = "Simple GObject-based library to parse and save a host of playlist formats";
     maintainers = teams.gnome.members;
     license = licenses.lgpl2;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/tracker-miners/default.nix b/pkgs/development/libraries/tracker-miners/default.nix
index 3224355e0451..846346d534b8 100644
--- a/pkgs/development/libraries/tracker-miners/default.nix
+++ b/pkgs/development/libraries/tracker-miners/default.nix
@@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchurl
+, fetchpatch
 , asciidoc
 , docbook-xsl-nons
 , docbook_xml_dtd_45
@@ -43,6 +44,7 @@
 , taglib
 , upower
 , totem-pl-parser
+, e2fsprogs
 }:
 
 stdenv.mkDerivation rec {
@@ -54,6 +56,18 @@ stdenv.mkDerivation rec {
     sha256 = "Pt3G0nLAKWn6TCwV360MSddtAh8aJ+xwi2m+gCU1PJQ=";
   };
 
+  # TODO: remove me on 3.4.0
+  patches = [
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/tracker-miners/-/commit/cc655ba0f95022cf35bc6d44cb5155788fee2e24.patch";
+      sha256 = "sha256-a85ygtabpkruiDgKbseQxYbFIAQlVDhs3eWkbStJjKs=";
+    })
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/tracker-miners/-/commit/9e613ceb37ec41fd1cd88c3d539e3ee03e8f6ba6.patch";
+      sha256 = "sha256-ht7EfZztyl0st0Sv7H92Q37vwXY4T61GQm9WJ8IxTTg=";
+    })
+  ];
+
   nativeBuildInputs = [
     asciidoc
     docbook-xsl-nons
@@ -72,7 +86,6 @@ stdenv.mkDerivation rec {
   buildInputs = [
     bzip2
     dbus
-    evolution-data-server
     exempi
     giflib
     glib
@@ -95,16 +108,20 @@ stdenv.mkDerivation rec {
     libjpeg
     libosinfo
     libpng
-    libseccomp
     libsoup
     libtiff
     libuuid
     libxml2
-    networkmanager
     poppler
-    systemd
     taglib
+  ] ++ lib.optionals stdenv.isLinux [
+    evolution-data-server
+    libseccomp
+    networkmanager
+    systemd
     upower
+  ] ++ lib.optionals stdenv.isDarwin [
+    e2fsprogs
   ];
 
   mesonFlags = [
@@ -115,6 +132,9 @@ stdenv.mkDerivation rec {
     # security issue since then. Despite a patch now being availab, we're opting
     # to be safe due to the general state of the project
     "-Dminer_rss=false"
+  ] ++ lib.optionals (!stdenv.isLinux) [
+    "-Dnetwork_manager=disabled"
+    "-Dsystemd_user_services=false"
   ];
 
   postInstall = ''
@@ -132,6 +152,6 @@ stdenv.mkDerivation rec {
     description = "Desktop-neutral user information store, search tool and indexer";
     maintainers = teams.gnome.members;
     license = licenses.gpl2Plus;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/python-modules/django-cryptography/default.nix b/pkgs/development/python-modules/django-cryptography/default.nix
new file mode 100644
index 000000000000..6443e74aa378
--- /dev/null
+++ b/pkgs/development/python-modules/django-cryptography/default.nix
@@ -0,0 +1,43 @@
+{ buildPythonPackage
+, cryptography
+, django
+, django-appconf
+, fetchFromGitHub
+, lib
+, python
+, pythonOlder }:
+
+buildPythonPackage rec {
+  pname = "django-cryptography";
+  version = "1.1";
+  disabled = pythonOlder "3.7";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "georgemarshall";
+    repo = "django-cryptography";
+    rev = "refs/tags/${version}";
+    hash = "sha256-C3E2iT9JdLvF+1g+xhZ8dPDjjh25JUxLAtTMnalIxPk=";
+  };
+
+  propagatedBuildInputs = [
+    cryptography
+    django
+    django-appconf
+  ];
+
+  pythonImportsCheck = [ "django_cryptography" ];
+
+  checkPhase = ''
+    runHook preCheck
+    ${python.interpreter} ./runtests.py
+    runHook postCheck
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/georgemarshall/django-cryptography";
+    description = "A set of primitives for performing cryptography in Django";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ centromere ];
+  };
+}
diff --git a/pkgs/development/python-modules/imgaug/default.nix b/pkgs/development/python-modules/imgaug/default.nix
index 50faf89d600a..2c84f5c00c50 100644
--- a/pkgs/development/python-modules/imgaug/default.nix
+++ b/pkgs/development/python-modules/imgaug/default.nix
@@ -77,5 +77,8 @@ buildPythonPackage rec {
     license = licenses.mit;
     maintainers = with maintainers; [ cmcdragonkai rakesh4g ];
     platforms = platforms.linux;
+    # Scikit-image 0.19 update broke API, see https://github.com/scikit-image/scikit-image/releases/tag/v0.19.0
+    # and https://github.com/scikit-image/scikit-image/issues/6093
+    broken = lib.versionAtLeast scikitimage.version "0.19";
   };
 }
diff --git a/pkgs/development/python-modules/kanidm/default.nix b/pkgs/development/python-modules/kanidm/default.nix
new file mode 100644
index 000000000000..57ae3c59b563
--- /dev/null
+++ b/pkgs/development/python-modules/kanidm/default.nix
@@ -0,0 +1,66 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, fetchpatch
+, pythonOlder
+
+# build
+, poetry-core
+
+# propagates
+, aiohttp
+, pydantic
+, toml
+
+# tests
+, pytest-asyncio
+, pytest-mock
+, pytestCheckHook
+}:
+
+let
+  pname = "kanidm";
+  version = "0.0.3";
+in
+buildPythonPackage {
+  inherit pname version;
+  format = "pyproject";
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-sTkAKxtJa7CVYKuXC//eMmf3l8ABsrEr2mdf1r2Gf9A=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    aiohttp
+    pydantic
+    toml
+  ];
+
+  checkInputs = [
+    pytest-asyncio
+    pytest-mock
+    pytestCheckHook
+  ];
+
+  pytestFlagsArray = [
+    "-m 'not network'"
+  ];
+
+  pythonImportsCheck = [
+    "kanidm"
+  ];
+
+  meta = with lib; {
+    description = "Kanidm client library";
+    homepage = "https://github.com/kanidm/kanidm/tree/master/pykanidm";
+    license = licenses.mpl20;
+    maintainers = with maintainers; [ arianvp hexa ];
+  };
+}
diff --git a/pkgs/development/python-modules/pydantic/default.nix b/pkgs/development/python-modules/pydantic/default.nix
index f9993850f1df..31f456dabc68 100644
--- a/pkgs/development/python-modules/pydantic/default.nix
+++ b/pkgs/development/python-modules/pydantic/default.nix
@@ -27,7 +27,7 @@
 
 buildPythonPackage rec {
   pname = "pydantic";
-  version = "1.9.1";
+  version = "1.9.2";
 
   outputs = [
     "out"
@@ -41,7 +41,7 @@ buildPythonPackage rec {
     owner = "samuelcolvin";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-jqTtNJQ9lRkxDYGG4vg91qH1jrxRU9orEeUofO+bBpA=";
+    sha256 = "sha256-ZGFxyQ1qD3zZWTdfTeoGj3UcUwAzO8K0DySdVAsMHyI=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pyxdg/default.nix b/pkgs/development/python-modules/pyxdg/default.nix
index 0ad5777e6377..1a7f5b265eb0 100644
--- a/pkgs/development/python-modules/pyxdg/default.nix
+++ b/pkgs/development/python-modules/pyxdg/default.nix
@@ -5,24 +5,25 @@
 
 buildPythonPackage rec {
   pname = "pyxdg";
-  version = "0.27";
+  version = "0.28";
 
   src =  fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "xdg";
     repo = pname;
     rev = "rel-${version}";
-    sha256 = "1dg826vrc7ifkk4lnf648h61cqfamaqmngkn9hgmxnf9gqmkbn0k";
+    sha256 = "sha256-TrFQzfkXabmfpGYwhxD1UVY1F645KycfSPPrMJFAe+0=";
   };
 
   # Tests failed (errors=4, failures=4) on NixOS
   doCheck = false;
 
+  pythonImportsCheck = [ "xdg" ];
+
   meta = with lib; {
     homepage = "http://freedesktop.org/wiki/Software/pyxdg";
     description = "Contains implementations of freedesktop.org standards";
     license = licenses.lgpl2;
     maintainers = with maintainers; [ domenkozar ];
   };
-
 }
diff --git a/pkgs/development/python-modules/scikit-image/default.nix b/pkgs/development/python-modules/scikit-image/default.nix
index 45239f64fbef..9098724da42a 100644
--- a/pkgs/development/python-modules/scikit-image/default.nix
+++ b/pkgs/development/python-modules/scikit-image/default.nix
@@ -4,6 +4,7 @@
 , buildPythonPackage
 , python
 , cython
+, pythran
 , numpy
 , scipy
 , matplotlib
@@ -16,25 +17,24 @@
 , imageio
 , tifffile
 , pytestCheckHook
-, doCheck ? false
 }:
 
 let
   installedPackageRoot = "${builtins.placeholder "out"}/${python.sitePackages}";
   self = buildPythonPackage rec {
     pname = "scikit-image";
-    version = "0.18.3";
+    version = "0.19.3";
 
     src = fetchFromGitHub {
       owner = pname;
       repo = pname;
       rev = "v${version}";
-      sha256 = "0a2h3bw5rkk23k4r04qc9maccg00nddssd7lfsps8nhp5agk1vyh";
+      sha256 = "sha256-zvXgZdvYycFbbMsBFSqMDzLanEtF9+JuVSQ3AM8/LQk=";
     };
 
     patches = [ ./add-testing-data.patch ];
 
-    nativeBuildInputs = [ cython ];
+    nativeBuildInputs = [ cython pythran ];
 
     propagatedBuildInputs = [
       cloudpickle
@@ -51,7 +51,7 @@ let
     ];
 
     # test suite is very cpu intensive, move to passthru.tests
-    inherit doCheck;
+    doCheck = false;
     checkInputs = [ pytestCheckHook ];
 
     # (1) The package has cythonized modules, whose .so libs will appear only in the wheel, i.e. in nix store;
diff --git a/pkgs/os-specific/linux/kernel/update-zen.py b/pkgs/os-specific/linux/kernel/update-zen.py
index 204a39ad3a9a..3c51f806d8f8 100755
--- a/pkgs/os-specific/linux/kernel/update-zen.py
+++ b/pkgs/os-specific/linux/kernel/update-zen.py
@@ -78,6 +78,29 @@ def update_file(relpath, variant, version, suffix, sha256):
             print(result, end='')
 
 
+def read_file(relpath, variant):
+    file_path = os.path.join(DIR, relpath)
+    re_version = re.compile(fr'^\s*version = "(.+)"; #{variant}')
+    re_suffix = re.compile(fr'^\s*suffix = "(.+)"; #{variant}')
+    version = None
+    suffix = None
+    with fileinput.FileInput(file_path, mode='r') as f:
+        for line in f:
+            version_match = re_version.match(line)
+            if version_match:
+                version = version_match.group(1)
+                continue
+
+            suffix_match = re_suffix.match(line)
+            if suffix_match:
+                suffix = suffix_match.group(1)
+                continue
+
+            if version and suffix:
+                break
+    return version, suffix
+
+
 if __name__ == "__main__":
     if len(sys.argv) == 1:
         panic("Update variant expected")
@@ -93,5 +116,7 @@ if __name__ == "__main__":
             zen_version = zen_match.group(1)
             zen_suffix = zen_match.group(2)
             break
-    zen_hash = nix_prefetch_git('https://github.com/zen-kernel/zen-kernel.git', zen_tag)
-    update_file('zen-kernels.nix', variant, zen_version, zen_suffix, zen_hash)
+    old_version, old_suffix = read_file('zen-kernels.nix', variant)
+    if old_version != zen_version or old_suffix != zen_suffix:
+        zen_hash = nix_prefetch_git('https://github.com/zen-kernel/zen-kernel.git', zen_tag)
+        update_file('zen-kernels.nix', variant, zen_version, zen_suffix, zen_hash)
diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index 8f8be9d20d61..c0758e0a94c6 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -4,16 +4,16 @@ let
   # comments with variant added for update script
   # ./update-zen.py zen
   zenVariant = {
-    version = "5.19.3"; #zen
+    version = "5.19.4"; #zen
     suffix = "zen1"; #zen
-    sha256 = "0qkkbj7sifc0vqy4q8fdnadqjh2vcv41rbm90abbrnnqiyanc01g"; #zen
+    sha256 = "0px5br9220m8s6y6qzk29i0ksmy43h4652d9xx5y2jb5idwf2sj4"; #zen
     isLqx = false;
   };
   # ./update-zen.py lqx
   lqxVariant = {
-    version = "5.19.3"; #lqx
+    version = "5.19.4"; #lqx
     suffix = "lqx1"; #lqx
-    sha256 = "1g4kgcqmwrmrxh7s07md74mpd24i1fmrns5m9k140wzjykcv8n7z"; #lqx
+    sha256 = "1vvc2c35w1xz8zkm79cbcdhwb7dkqxd835w422my5mbi7vhcx7jq"; #lqx
     isLqx = true;
   };
   zenKernelsFor = { version, suffix, sha256, isLqx }: buildLinux (args // {
diff --git a/pkgs/os-specific/linux/roccat-tools/default.nix b/pkgs/os-specific/linux/roccat-tools/default.nix
index bea79c2007db..ef18dda1191d 100644
--- a/pkgs/os-specific/linux/roccat-tools/default.nix
+++ b/pkgs/os-specific/linux/roccat-tools/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl, cmake, pkg-config, gettext
 , dbus, dbus-glib, libgaminggear, libgudev, lua
-, harfbuzz
+, harfbuzz, runtimeShell, coreutils, kmod
 }:
 
 stdenv.mkDerivation rec {
@@ -19,6 +19,11 @@ stdenv.mkDerivation rec {
       /return/c \
         return g_build_path("/", g_get_user_data_dir(), "roccat", NULL);
     }' libroccat/roccat_helper.c
+
+    substituteInPlace udev/90-roccat-kone.rules \
+      --replace "/bin/sh" "${runtimeShell}" \
+      --replace "/sbin/modprobe" "${kmod}/bin/modprobe" \
+      --replace "/bin/echo" "${coreutils}/bin/echo"
   '';
 
   nativeBuildInputs = [ cmake pkg-config gettext ];
diff --git a/pkgs/os-specific/linux/rtl8189fs/default.nix b/pkgs/os-specific/linux/rtl8189fs/default.nix
index c1fe5e9733fa..0a385d0ca39f 100644
--- a/pkgs/os-specific/linux/rtl8189fs/default.nix
+++ b/pkgs/os-specific/linux/rtl8189fs/default.nix
@@ -1,4 +1,4 @@
-{ lib, kernel, rtl8189es, fetchFromGitHub }:
+{ lib, kernel, rtl8189es, fetchFromGitHub, fetchpatch }:
 
 # rtl8189fs is a branch of the rtl8189es driver
 rtl8189es.overrideAttrs (drv: rec {
@@ -12,6 +12,13 @@ rtl8189es.overrideAttrs (drv: rec {
     sha256 = "sha256-JTv+ssSv5toNcZ5wR6p0Cywdk87z9Bdq0ftU0ekr/98=";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/jwrdegoede/rtl8189ES_linux/pull/81.patch";
+      sha256 = "sha256-ovFQBIHLk3wi2uwAyr8VmdbuhPcoHsZ/lpA66obVBK4=";
+    })
+  ];
+
   meta = with lib; {
     description = "Driver for Realtek rtl8189fs";
     homepage = "https://github.com/jwrdegoede/rtl8189ES_linux/tree/rtl8189fs";
diff --git a/pkgs/tools/compression/dtrx/default.nix b/pkgs/tools/compression/dtrx/default.nix
index 98fc0befafbf..78c2a9f399c6 100644
--- a/pkgs/tools/compression/dtrx/default.nix
+++ b/pkgs/tools/compression/dtrx/default.nix
@@ -21,13 +21,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "dtrx";
-  version = "8.2.2";
+  version = "8.3.1";
 
   src = fetchFromGitHub {
     owner = "dtrx-py";
     repo = "dtrx";
-    rev = version;
-    sha256 = "sha256-thtBVGgKRYHOAFuxDvuFxcIHoyYAI58AiNCx4vuVXGs=";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-a8ZHIPunWGwI992HfgdRvJGtDfYUP50kFt/ROAqDO7E=";
   };
 
   postInstall =
diff --git a/pkgs/tools/system/hw-probe/default.nix b/pkgs/tools/system/hw-probe/default.nix
new file mode 100644
index 000000000000..72bdbe368af0
--- /dev/null
+++ b/pkgs/tools/system/hw-probe/default.nix
@@ -0,0 +1,140 @@
+{ config
+, stdenv
+, lib
+, fetchFromGitHub
+, makeWrapper
+, makePerlPath
+
+# Perl libraries
+, LWP
+, LWPProtocolHttps
+, HTTPMessage
+, HTTPDate
+, URI
+, TryTiny
+
+# Required
+, coreutils
+, curl # Preferred to using the Perl HTTP libs - according to hw-probe.
+, dmidecode
+, edid-decode
+, gnugrep
+, gnutar
+, hwinfo
+, iproute2
+, kmod
+, pciutils
+, perl
+, smartmontools
+, usbutils
+, xz
+
+# Conditionally recommended
+, systemdSupport ? stdenv.isLinux
+, systemd
+
+# Recommended
+, withRecommended ? true # Install recommended tools
+, mcelog
+, hdparm
+, acpica-tools
+, drm_info
+, mesa-demos
+, memtester
+, sysstat
+, cpuid
+, util-linuxMinimal
+, xinput
+, libva-utils
+, inxi
+, vulkan-utils
+, i2c-tools
+, opensc
+
+# Suggested
+, withSuggested ? false # Install (most) suggested tools
+, hplip
+, sane-backends
+# , pnputils # pnputils (lspnp) isn't currently in nixpkgs and appears to be poorly maintained
+}:
+
+stdenv.mkDerivation rec {
+  pname = "hw-probe";
+  version = "1.6.4";
+
+  src = fetchFromGitHub {
+    owner = "linuxhw";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256:028wnhrbn10lfxwmcpzdbz67ygldimv7z1k1bm64ggclykvg5aim";
+  };
+
+  makeFlags = [ "prefix=$(out)" ];
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  buildInputs = [ perl ];
+
+  makeWrapperArgs =
+    let
+      requiredPrograms = [
+        hwinfo
+        dmidecode
+        smartmontools
+        pciutils
+        usbutils
+        edid-decode
+        iproute2 # (ip)
+        coreutils # (sort)
+        gnugrep
+        curl
+        gnutar
+        xz
+        kmod # (lsmod)
+      ];
+      recommendedPrograms = [
+        mcelog
+        hdparm
+        acpica-tools
+        drm_info
+        mesa-demos
+        memtester
+        sysstat # (iostat)
+        cpuid
+        util-linuxMinimal # (rfkill)
+        xinput
+        libva-utils # (vainfo)
+        inxi
+        vulkan-utils
+        i2c-tools
+        opensc
+      ];
+      conditionallyRecommendedPrograms = lib.optional systemdSupport systemd; # (systemd-analyze)
+      suggestedPrograms = [
+        hplip # (hp-probe)
+        sane-backends # (sane-find-scanner)
+        # pnputils # (lspnp)
+      ];
+      programs =
+        requiredPrograms
+        ++ conditionallyRecommendedPrograms
+        ++ lib.optionals withRecommended recommendedPrograms
+        ++ lib.optionals withSuggested suggestedPrograms;
+    in [
+      "--set" "PERL5LIB" "${makePerlPath [ LWP LWPProtocolHttps HTTPMessage URI HTTPDate TryTiny ]}"
+      "--prefix" "PATH" ":" "${lib.makeBinPath programs}"
+    ];
+
+  postInstall = ''
+    wrapProgram $out/bin/hw-probe \
+      $makeWrapperArgs
+  '';
+
+  meta = with lib; {
+    description = "Probe for hardware, check operability and find drivers";
+    homepage = "https://github.com/linuxhw/hw-probe";
+    platforms = with platforms; (linux ++ freebsd ++ netbsd ++ openbsd);
+    license = with licenses; [ lgpl21 bsdOriginal ];
+    maintainers = with maintainers; [ rehno-lindeque  ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index cdc937a91a4a..ef4a1c0e82fd 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7326,7 +7326,7 @@ with pkgs;
   halibut = callPackage ../tools/typesetting/halibut { };
 
   halide = callPackage ../development/compilers/halide {
-    llvmPackages = llvmPackages_9;
+    llvmPackages = llvmPackages_14;
   };
 
   harePackages = recurseIntoAttrs (callPackage ../development/compilers/hare { });
@@ -7480,6 +7480,8 @@ with pkgs;
 
   hwinfo = callPackage ../tools/system/hwinfo { };
 
+  hw-probe = perlPackages.callPackage ../tools/system/hw-probe { };
+
   hybridreverb2 = callPackage ../applications/audio/hybridreverb2 {
     stdenv = gcc8Stdenv;
   };
@@ -9147,7 +9149,7 @@ with pkgs;
     buildGoModule = buildGo117Module;
   };
   nomad_1_3 = callPackage ../applications/networking/cluster/nomad/1.3.nix {
-    buildGoModule = buildGo118Module;
+    buildGoModule = buildGo119Module;
   };
 
   nomad-autoscaler = callPackage ../applications/networking/cluster/nomad-autoscaler { };
@@ -21947,6 +21949,7 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) AppKit Cocoa;
   };
   vulkan-tools-lunarg = callPackage ../tools/graphics/vulkan-tools-lunarg { };
+  vulkan-utils = haskell.lib.compose.justStaticExecutables haskellPackages.vulkan-utils;
   vulkan-validation-layers = callPackage ../development/tools/vulkan-validation-layers { };
 
   vxl = callPackage ../development/libraries/vxl { };
@@ -31158,7 +31161,9 @@ with pkgs;
 
   termtosvg = callPackage ../tools/misc/termtosvg { };
 
-  inherit (callPackage ../applications/graphics/tesseract {})
+  inherit (callPackage ../applications/graphics/tesseract {
+    inherit (darwin.apple_sdk.frameworks) Accelerate CoreGraphics CoreVideo;
+  })
     tesseract3
     tesseract4
     tesseract5;
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index fee922a11619..f47bbd3f6db8 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2490,6 +2490,8 @@ in {
 
   django-cors-headers = callPackage ../development/python-modules/django-cors-headers { };
 
+  django-cryptography = callPackage ../development/python-modules/django-cryptography { };
+
   django-csp = callPackage ../development/python-modules/django-csp { };
 
   django-debug-toolbar = callPackage ../development/python-modules/django-debug-toolbar { };
@@ -4873,6 +4875,8 @@ in {
 
   kaldi-active-grammar = callPackage ../development/python-modules/kaldi-active-grammar { };
 
+  kanidm = callPackage ../development/python-modules/kanidm { };
+
   kaptan = callPackage ../development/python-modules/kaptan { };
 
   karton-asciimagic = callPackage ../development/python-modules/karton-asciimagic { };