diff --git a/doc/builders/images/dockertools.section.md b/doc/builders/images/dockertools.section.md
index 6fdd4b5cadd3..db1a2a214d1e 100644
--- a/doc/builders/images/dockertools.section.md
+++ b/doc/builders/images/dockertools.section.md
@@ -308,7 +308,44 @@ The parameters relative to the base image have the same synopsis as described in
 
 The `name` argument is the name of the derivation output, which defaults to `fromImage.name`.
 
-## shadowSetup {#ssec-pkgs-dockerTools-shadowSetup}
+## Environment Helpers {#ssec-pkgs-dockerTools-helpers}
+
+Some packages expect certain files to be available globally.
+When building an image from scratch (i.e. without `fromImage`), these files are missing.
+`pkgs.dockerTools` provides some helpers to set up an environment with the necessary files.
+You can include them in `copyToRoot` like this:
+
+```nix
+buildImage {
+  name = "environment-example";
+  copyToRoot = with pkgs.dockerTools; [
+    usrBinEnv
+    binSh
+    caCertificates
+    fakeNss
+  ];
+}
+```
+
+### usrBinEnv {#sssec-pkgs-dockerTools-helpers-usrBinEnv}
+
+This provides the `env` utility at `/usr/bin/env`.
+
+### binSh {#sssec-pkgs-dockerTools-helpers-binSh}
+
+This provides `bashInteractive` at `/bin/sh`.
+
+### caCertificates {#sssec-pkgs-dockerTools-helpers-caCertificates}
+
+This sets up `/etc/ssl/certs/ca-certificates.crt`.
+
+### fakeNss {#sssec-pkgs-dockerTools-helpers-fakeNss}
+
+Provides `/etc/passwd` and `/etc/group` that contain root and nobody.
+Useful when packaging binaries that insist on using nss to look up
+username/groups (like nginx).
+
+### shadowSetup {#ssec-pkgs-dockerTools-shadowSetup}
 
 This constant string is a helper for setting up the base files for managing users and groups, only if such files don't exist already. It is suitable for being used in a [`buildImage` `runAsRoot`](#ex-dockerTools-buildImage-runAsRoot) script for cases like in the example below:
 
diff --git a/lib/modules.nix b/lib/modules.nix
index 7f1646e9b8bc..6a1b0bfdc4fa 100644
--- a/lib/modules.nix
+++ b/lib/modules.nix
@@ -433,7 +433,9 @@ rec {
       # modules recursively. It returns the final list of unique-by-key modules
       filterModules = modulesPath: { disabled, modules }:
         let
-          moduleKey = m: if isString m then toString modulesPath + "/" + m else toString m;
+          moduleKey = m: if isString m && (builtins.substring 0 1 m != "/")
+            then toString modulesPath + "/" + m
+            else toString m;
           disabledKeys = map moduleKey disabled;
           keyFilter = filter (attrs: ! elem attrs.key disabledKeys);
         in map (attrs: attrs.module) (builtins.genericClosure {
diff --git a/lib/tests/modules.sh b/lib/tests/modules.sh
index c92cc62023b5..2ef7c4806595 100755
--- a/lib/tests/modules.sh
+++ b/lib/tests/modules.sh
@@ -130,6 +130,7 @@ checkConfigOutput '^true$' "$@" ./define-enable.nix ./define-attrsOfSub-foo-enab
 set -- config.enable ./define-enable.nix ./declare-enable.nix
 checkConfigOutput '^true$' "$@"
 checkConfigOutput '^false$' "$@" ./disable-define-enable.nix
+checkConfigOutput '^false$' "$@" ./disable-define-enable-string-path.nix
 checkConfigError "The option .*enable.* does not exist. Definition values:\n\s*- In .*: true" "$@" ./disable-declare-enable.nix
 checkConfigError "attribute .*enable.* in selection path .*config.enable.* not found" "$@" ./disable-define-enable.nix ./disable-declare-enable.nix
 checkConfigError "attribute .*enable.* in selection path .*config.enable.* not found" "$@" ./disable-enable-modules.nix
diff --git a/lib/tests/modules/disable-define-enable-string-path.nix b/lib/tests/modules/disable-define-enable-string-path.nix
new file mode 100644
index 000000000000..6429a6d6354a
--- /dev/null
+++ b/lib/tests/modules/disable-define-enable-string-path.nix
@@ -0,0 +1,5 @@
+{ lib, ... }:
+
+{
+  disabledModules = [ (toString ./define-enable.nix) ];
+}
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 08f9d57a5407..e3a9f6cb1506 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -1423,6 +1423,12 @@
     githubId = 35324;
     name = "Badi' Abdul-Wahid";
   };
+  baitinq = {
+    email = "manuelpalenzuelamerino@gmail.com";
+    name = "Baitinq";
+    github = "Baitinq";
+    githubId = 30861839;
+  };
   balodja = {
     email = "balodja@gmail.com";
     github = "balodja";
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
index cc7a8b3d27e3..2230ed05d4a7 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
@@ -441,6 +441,12 @@
           due to upstream dropping support.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <literal>k3s</literal> supports <literal>clusterInit</literal>
+          option, and it is enabled by default, for servers.
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
   <section xml:id="sec-release-22.11-notable-changes">
diff --git a/nixos/doc/manual/release-notes/rl-2211.section.md b/nixos/doc/manual/release-notes/rl-2211.section.md
index 2a1b4a423617..ffde5495d289 100644
--- a/nixos/doc/manual/release-notes/rl-2211.section.md
+++ b/nixos/doc/manual/release-notes/rl-2211.section.md
@@ -154,6 +154,8 @@ Use `configure.packages` instead.
 
 - `k3s` no longer supports docker as runtime due to upstream dropping support.
 
+- `k3s` supports `clusterInit` option, and it is enabled by default, for servers.
+
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
 ## Other Notable Changes {#sec-release-22.11-notable-changes}
diff --git a/nixos/modules/services/cluster/k3s/default.nix b/nixos/modules/services/cluster/k3s/default.nix
index a1f6d4ecdfad..d0269fde8936 100644
--- a/nixos/modules/services/cluster/k3s/default.nix
+++ b/nixos/modules/services/cluster/k3s/default.nix
@@ -25,7 +25,17 @@ in
     role = mkOption {
       description = lib.mdDoc ''
         Whether k3s should run as a server or agent.
-        Note that the server, by default, also runs as an agent.
+
+        If it's a server:
+
+        - By default it also runs workloads as an agent.
+        - Starts by default as a standalone server using an embedded sqlite datastore.
+        - Configure `clusterInit = true` to switch over to embedded etcd datastore and enable HA mode.
+        - Configure `serverAddr` to join an already-initialized HA cluster.
+
+        If it's an agent:
+
+        - `serverAddr` is required.
       '';
       default = "server";
       type = types.enum [ "server" "agent" ];
@@ -33,15 +43,44 @@ in
 
     serverAddr = mkOption {
       type = types.str;
-      description = lib.mdDoc "The k3s server to connect to. This option only makes sense for an agent.";
+      description = lib.mdDoc ''
+        The k3s server to connect to.
+
+        Servers and agents need to communicate each other. Read
+        [the networking docs](https://rancher.com/docs/k3s/latest/en/installation/installation-requirements/#networking)
+        to know how to configure the firewall.
+      '';
       example = "https://10.0.0.10:6443";
       default = "";
     };
 
+    clusterInit = mkOption {
+      type = types.bool;
+      default = false;
+      description = lib.mdDoc ''
+        Initialize HA cluster using an embedded etcd datastore.
+
+        If this option is `false` and `role` is `server`
+
+        On a server that was using the default embedded sqlite backend,
+        enabling this option will migrate to an embedded etcd DB.
+
+        If an HA cluster using the embedded etcd datastore was already initialized,
+        this option has no effect.
+
+        This option only makes sense in a server that is not connecting to another server.
+
+        If you are configuring an HA cluster with an embedded etcd,
+        the 1st server must have `clusterInit = true`
+        and other servers must connect to it using `serverAddr`.
+      '';
+    };
+
     token = mkOption {
       type = types.str;
       description = lib.mdDoc ''
-        The k3s token to use when connecting to the server. This option only makes sense for an agent.
+        The k3s token to use when connecting to a server.
+
         WARNING: This option will expose store your token unencrypted world-readable in the nix store.
         If this is undesired use the tokenFile option instead.
       '';
@@ -50,7 +89,7 @@ in
 
     tokenFile = mkOption {
       type = types.nullOr types.path;
-      description = lib.mdDoc "File path containing k3s token to use when connecting to the server. This option only makes sense for an agent.";
+      description = lib.mdDoc "File path containing k3s token to use when connecting to the server.";
       default = null;
     };
 
@@ -86,6 +125,14 @@ in
         assertion = cfg.role == "agent" -> cfg.configPath != null || cfg.tokenFile != null || cfg.token != "";
         message = "token or tokenFile or configPath (with 'token' or 'token-file' keys) should be set if role is 'agent'";
       }
+      {
+        assertion = cfg.role == "agent" -> !cfg.disableAgent;
+        message = "disableAgent must be false if role is 'agent'";
+      }
+      {
+        assertion = cfg.role == "agent" -> !cfg.clusterInit;
+        message = "clusterInit must be false if role is 'agent'";
+      }
     ];
 
     environment.systemPackages = [ config.services.k3s.package ];
@@ -111,6 +158,7 @@ in
           [
             "${cfg.package}/bin/k3s ${cfg.role}"
           ]
+          ++ (optional cfg.clusterInit "--cluster-init")
           ++ (optional cfg.disableAgent "--disable-agent")
           ++ (optional (cfg.serverAddr != "") "--server ${cfg.serverAddr}")
           ++ (optional (cfg.token != "") "--token ${cfg.token}")
diff --git a/nixos/modules/services/web-apps/keycloak.nix b/nixos/modules/services/web-apps/keycloak.nix
index 26bed24eed27..172a3e59335f 100644
--- a/nixos/modules/services/web-apps/keycloak.nix
+++ b/nixos/modules/services/web-apps/keycloak.nix
@@ -25,6 +25,7 @@ let
     catAttrs
     collect
     splitString
+    hasPrefix
     ;
 
   inherit (builtins)
@@ -312,8 +313,9 @@ in
 
             http-relative-path = mkOption {
               type = str;
-              default = "";
+              default = "/";
               example = "/auth";
+              apply = x: if !(hasPrefix "/") x then "/" + x else x;
               description = ''
                 The path relative to <literal>/</literal> for serving
                 resources.
@@ -658,7 +660,7 @@ in
             '' + ''
               export KEYCLOAK_ADMIN=admin
               export KEYCLOAK_ADMIN_PASSWORD=${cfg.initialAdminPassword}
-              kc.sh start
+              kc.sh start --optimized
             '';
           };
 
diff --git a/nixos/tests/k3s/multi-node.nix b/nixos/tests/k3s/multi-node.nix
index afb8c78f2339..ae9609fbccc9 100644
--- a/nixos/tests/k3s/multi-node.nix
+++ b/nixos/tests/k3s/multi-node.nix
@@ -53,9 +53,10 @@ import ../make-test-python.nix ({ pkgs, ... }:
           enable = true;
           role = "server";
           package = pkgs.k3s;
+          clusterInit = true;
           extraFlags = "--no-deploy coredns,servicelb,traefik,local-storage,metrics-server --pause-image test.local/pause:local --node-ip 192.168.1.1";
         };
-        networking.firewall.allowedTCPPorts = [ 6443 ];
+        networking.firewall.allowedTCPPorts = [ 2379 2380 6443 ];
         networking.firewall.allowedUDPPorts = [ 8472 ];
         networking.firewall.trustedInterfaces = [ "flannel.1" ];
         networking.useDHCP = false;
@@ -65,6 +66,28 @@ import ../make-test-python.nix ({ pkgs, ... }:
         ];
       };
 
+      server2 = { pkgs, ... }: {
+        environment.systemPackages = with pkgs; [ gzip jq ];
+        virtualisation.memorySize = 1536;
+        virtualisation.diskSize = 4096;
+
+        services.k3s = {
+          inherit tokenFile;
+          enable = true;
+          serverAddr = "https://192.168.1.1:6443";
+          clusterInit = false;
+          extraFlags = "--no-deploy coredns,servicelb,traefik,local-storage,metrics-server --pause-image test.local/pause:local --node-ip 192.168.1.3";
+        };
+        networking.firewall.allowedTCPPorts = [ 2379 2380 6443 ];
+        networking.firewall.allowedUDPPorts = [ 8472 ];
+        networking.firewall.trustedInterfaces = [ "flannel.1" ];
+        networking.useDHCP = false;
+        networking.defaultGateway = "192.168.1.3";
+        networking.interfaces.eth1.ipv4.addresses = pkgs.lib.mkForce [
+          { address = "192.168.1.3"; prefixLength = 24; }
+        ];
+      };
+
       agent = { pkgs, ... }: {
         virtualisation.memorySize = 1024;
         virtualisation.diskSize = 2048;
@@ -72,7 +95,7 @@ import ../make-test-python.nix ({ pkgs, ... }:
           inherit tokenFile;
           enable = true;
           role = "agent";
-          serverAddr = "https://192.168.1.1:6443";
+          serverAddr = "https://192.168.1.3:6443";
           extraFlags = "--pause-image test.local/pause:local --node-ip 192.168.1.2";
         };
         networking.firewall.allowedTCPPorts = [ 6443 ];
@@ -91,9 +114,9 @@ import ../make-test-python.nix ({ pkgs, ... }:
     };
 
     testScript = ''
-      start_all()
-      machines = [server, agent]
+      machines = [server, server2, agent]
       for m in machines:
+          m.start()
           m.wait_for_unit("k3s")
 
       # wait for the agent to show up
diff --git a/pkgs/applications/audio/amberol/default.nix b/pkgs/applications/audio/amberol/default.nix
index 0c5523c0a359..5c905f97c4a8 100644
--- a/pkgs/applications/audio/amberol/default.nix
+++ b/pkgs/applications/audio/amberol/default.nix
@@ -19,20 +19,20 @@
 
 stdenv.mkDerivation rec {
   pname = "amberol";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = pname;
     rev = version;
-    hash = "sha256-/kZYzUzycHKre6/dvZgeqXu6mrkblftV51Z7866fZVY=";
+    hash = "sha256-UZFOQw9eXSyCey4YQ4pWV91BIo+5tFw1N8es5H03+fc=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-1+RWL9MD6aX+zI2rtQUQCqemCephLKGEAf5xNCb+jo4=";
+    hash = "sha256-ebo718+HAZFd7Pjy06jAzmaLdjR3o4Hn0xEeO7yiIC0=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/blockchains/lnd/default.nix b/pkgs/applications/blockchains/lnd/default.nix
index aa8673351c34..28813ae6b0dc 100644
--- a/pkgs/applications/blockchains/lnd/default.nix
+++ b/pkgs/applications/blockchains/lnd/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "lnd";
-  version = "0.15.0-beta";
+  version = "0.15.1-beta";
 
   src = fetchFromGitHub {
     owner = "lightningnetwork";
     repo = "lnd";
     rev = "v${version}";
-    sha256 = "sha256-v8nLsnd6dus+og75U9VIO1K5IuyNh+VYdQfbfbYeox0=";
+    sha256 = "sha256-E1RxFy7eRCTnzTg2B0llRt+r41K6V4VQH7Edh1As4cY=";
   };
 
-  vendorSha256 = "sha256-fx3WsyLyES+ezJGDe3SjFTeGlPMmqKEtWlYGkWpxODc=";
+  vendorSha256 = "sha256-e72HIsS1fftJEOvjr1RQMo3+gjlBxXPHq2olGWfurJk=";
 
   subPackages = [ "cmd/lncli" "cmd/lnd" ];
 
diff --git a/pkgs/applications/graphics/digikam/default.nix b/pkgs/applications/graphics/digikam/default.nix
index 7de66b87f8f5..f08e49283c12 100644
--- a/pkgs/applications/graphics/digikam/default.nix
+++ b/pkgs/applications/graphics/digikam/default.nix
@@ -56,11 +56,11 @@
 
 mkDerivation rec {
   pname   = "digikam";
-  version = "7.7.0";
+  version = "7.8.0";
 
   src = fetchurl {
     url = "mirror://kde/stable/${pname}/${version}/digiKam-${version}.tar.xz";
-    sha256 = "sha256-wMbdLqigdRSsvyRi86VFGOfoCZszN/iBM2Foz/Y9dxw=";
+    sha256 = "sha256-sIV3sLFe+ZhDaVcIqiwOmNVHMD2Fvio7OZBUhPLKts4=";
   };
 
   nativeBuildInputs = [ cmake doxygen extra-cmake-modules kdoctools wrapGAppsHook ];
diff --git a/pkgs/applications/misc/anytype/default.nix b/pkgs/applications/misc/anytype/default.nix
index 6cb1e67f30bf..7b327cd7f096 100644
--- a/pkgs/applications/misc/anytype/default.nix
+++ b/pkgs/applications/misc/anytype/default.nix
@@ -2,13 +2,13 @@
 
 let
   pname = "anytype";
-  version = "0.27.0";
+  version = "0.28.0";
   name = "Anytype-${version}";
   nameExecutable = pname;
   src = fetchurl {
     url = "https://at9412003.fra1.digitaloceanspaces.com/Anytype-${version}.AppImage";
     name = "Anytype-${version}.AppImage";
-    sha256 = "sha256-AcnXhilnr5ay45S30eNSDuN+Ed1TDv/Rh523LsUf3iM=";
+    sha256 = "sha256-tYeVz10saTJBf6DDGIVSd4IkSREDJFi/am/kg/An02E=";
   };
   appimageContents = appimageTools.extractType2 { inherit name src; };
 in
diff --git a/pkgs/applications/misc/styx/default.nix b/pkgs/applications/misc/styx/default.nix
index e59f6710737a..6ef1bb9b95ee 100644
--- a/pkgs/applications/misc/styx/default.nix
+++ b/pkgs/applications/misc/styx/default.nix
@@ -1,16 +1,16 @@
 { lib, stdenv, fetchFromGitHub, caddy, asciidoctor
 , file, lessc, sass, multimarkdown, linkchecker
-, perlPackages, python27 }:
+, perlPackages, python3Packages }:
 
 stdenv.mkDerivation rec {
   pname = "styx";
-  version = "0.7.2";
+  version = "0.7.5";
 
   src = fetchFromGitHub {
     owner  = "styx-static";
     repo   = "styx";
-    rev    = "0f0a878156eac416620a177cc030fa9f2f69b1b8";
-    sha256 = "0ig456j1s17w4zhhcmkrskpy6n7061v5f2isa3qhipmn0gwb91af";
+    rev    = "v${version}";
+    hash = "sha256-f6iA/nHpKnm3BALoQq8SzdcSzJLCFSferEf69SpgD2Y=";
   };
 
   server = "${caddy}/bin/caddy";
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     asciidoctor
     multimarkdown
     perlPackages.ImageExifTool
-    (python27.withPackages (ps: [ ps.parsimonious ]))
+    python3Packages.parsimonious
   ];
 
   installPhase = ''
diff --git a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
index f3a443c6ffc1..58456a53d3b1 100644
--- a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
@@ -87,7 +87,7 @@ let
   fteLibPath = makeLibraryPath [ stdenv.cc.cc gmp ];
 
   # Upstream source
-  version = "11.5.1";
+  version = "11.5.2";
 
   lang = "en-US";
 
@@ -98,7 +98,7 @@ let
         "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
         "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
       ];
-      sha256 = "sha256-LgzvptQoTHGngW4xDZNfm5teSjpAjcUzMKDbBHRInoo=";
+      sha256 = "sha256-kM3OOFTpEU7nIyqqdGcqLZ86QLb6isM5cfWG7jo891o=";
     };
 
     i686-linux = fetchurl {
@@ -107,7 +107,7 @@ let
         "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
         "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
       ];
-      sha256 = "sha256-J/ka/Qvu2UC5KTfatkWq0jc6bHTazA20vL9tz1sK/Rg=";
+      sha256 = "sha256-62dGoIqaCrSzsDjvt8c5hEAwOSTFst9PCpvMzveBukY=";
     };
   };
 in
diff --git a/pkgs/applications/networking/cluster/fluxctl/default.nix b/pkgs/applications/networking/cluster/fluxctl/default.nix
index cda692cacf42..a192abc57e4e 100644
--- a/pkgs/applications/networking/cluster/fluxctl/default.nix
+++ b/pkgs/applications/networking/cluster/fluxctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "fluxctl";
-  version = "1.25.3";
+  version = "1.25.4";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = "flux";
     rev = version;
-    sha256 = "sha256-tV6rPpZW3HWxUBUdDkYOP6gIc/ZD+CMmT7FVYXiLp5A=";
+    sha256 = "sha256-rKZ0fI9UN4oq6gfDMNR2+kCazlDexE1+UVzQ3xgkSA8=";
   };
 
-  vendorSha256 = "sha256-wApm7IXblhQiV7VpBXZndJgFpQmq2WEFjCEG1qd+Nlo=";
+  vendorSha256 = "sha256-6Trk49Vo3oMjSaHRDm2v+elPDHwdn2D3Z6i4UYcx0IQ=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/applications/networking/instant-messengers/alfaview/default.nix b/pkgs/applications/networking/instant-messengers/alfaview/default.nix
index 685643ac7969..e4813cbbf343 100644
--- a/pkgs/applications/networking/instant-messengers/alfaview/default.nix
+++ b/pkgs/applications/networking/instant-messengers/alfaview/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "alfaview";
-  version = "8.51.0";
+  version = "8.52.0";
 
   src = fetchurl {
     url = "https://production-alfaview-assets.alfaview.com/stable/linux/${pname}_${version}.deb";
-    sha256 = "sha256-rnzYTQpAX1OSBnVfnFsamd9i9Zpab4mZwlxot0CakgY=";
+    sha256 = "sha256-Taw/qMrqgxFWmRTSed8xINDBGTWx7kteN637Fjrzn44=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index c4b11068a115..1c9090ea9620 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -3,7 +3,7 @@ let
   versions = if stdenv.isLinux then {
     stable = "0.0.19";
     ptb = "0.0.29";
-    canary = "0.0.136";
+    canary = "0.0.137";
   } else {
     stable = "0.0.264";
     ptb = "0.0.59";
@@ -22,7 +22,7 @@ let
       };
       canary = fetchurl {
         url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        sha256 = "sha256-OrGg4jXziesHBhQORxREN/wq776RgNGaTyjJNV4pSAU=";
+        sha256 = "sha256-dreKO2yBDP547VYuJziBhC2sLdpbM2fcK5bxeds0zUQ=";
       };
     };
     aarch64-darwin = {
diff --git a/pkgs/applications/virtualization/docker-slim/default.nix b/pkgs/applications/virtualization/docker-slim/default.nix
index 09c8de64f280..25e1b96822fe 100644
--- a/pkgs/applications/virtualization/docker-slim/default.nix
+++ b/pkgs/applications/virtualization/docker-slim/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "docker-slim";
-  version = "1.37.6";
+  version = "1.38.0";
 
   src = fetchFromGitHub {
     owner = "docker-slim";
     repo = "docker-slim";
     rev = version;
-    sha256 = "sha256-Jzi6JC6DRklZhNqmFx6eHx6qR8/fb/JuSpgwtPThcc4=";
+    sha256 = "sha256-UDEM7KCTkx+9GTkC8LSkcf4u6SozI3yYrdDwAdjeiLg=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/build-support/docker/default.nix b/pkgs/build-support/docker/default.nix
index 7468f056005a..6876e9e73588 100644
--- a/pkgs/build-support/docker/default.nix
+++ b/pkgs/build-support/docker/default.nix
@@ -792,6 +792,16 @@ rec {
     ln -s ${bashInteractive}/bin/bash $out/bin/sh
   '';
 
+  # This provides the ca bundle in common locations
+  caCertificates = runCommand "ca-certificates" { } ''
+    # Old NixOS compatibility.
+    ln -s ${cacert}/etc/ssl/certs/ca-bundle.crt $out/etc/ssl/certs/ca-bundle.crt
+    # NixOS canonical location + Debian/Ubuntu/Arch/Gentoo compatibility.
+    ln -s ${cacert}/etc/ssl/certs/ca-bundle.crt $out/etc/ssl/certs/ca-certificates.crt
+    # CentOS/Fedora compatibility.
+    ln -s ${cacert}/etc/ssl/certs/ca-bundle.crt $out/etc/pki/tls/certs/ca-bundle.crt
+  '';
+
   # Build an image and populate its nix database with the provided
   # contents. The main purpose is to be able to use nix commands in
   # the container.
diff --git a/pkgs/development/compilers/fennel/default.nix b/pkgs/development/compilers/fennel/default.nix
index e449b4ef098e..9362c34808d3 100644
--- a/pkgs/development/compilers/fennel/default.nix
+++ b/pkgs/development/compilers/fennel/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fennel";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromSourcehut {
     owner = "~technomancy";
     repo = pname;
     rev = version;
-    sha256 = "sha256-3Pfl/KNwuGCkZjG/FlF6K2IQHwJQbWsCBmJpLizr1ng=";
+    sha256 = "sha256-TXmqvhT7Ab+S0UdLgl4xWrVvE//eCbu6qNnoxB7smE4=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/development/coq-modules/gaia/default.nix b/pkgs/development/coq-modules/gaia/default.nix
index 9879ef55db8d..d4fa4a1da309 100644
--- a/pkgs/development/coq-modules/gaia/default.nix
+++ b/pkgs/development/coq-modules/gaia/default.nix
@@ -7,11 +7,12 @@ with lib; mkCoqDerivation {
   release."1.12".sha256 = "sha256:0c6cim4x6f9944g8v0cp0lxs244lrhb04ms4y2s6y1wh321zj5mi";
   release."1.13".sha256 = "sha256:0i8ix2rbw10v34bi0yrx0z89ng96ydqbxm8rv2rnfgy4d1b27x6q";
   release."1.14".sha256 = "sha256-wgeQC0fIN3PSmRY1K6/KTy+rJmqqxdo3Bhsz1vjVAes=";
+  release."1.15".sha256 = "sha256:04zchnkvaq2mzpcilpspn5l947689gj3m0w20m0nd7w4drvlahnw";
   releaseRev = (v: "v${v}");
 
   inherit version;
   defaultVersion = with versions; switch [ coq.version mathcomp.version ] [
-    { cases = [ (range "8.10" "8.15") (isGe "1.12.0") ]; out = "1.14"; }
+    { cases = [ (range "8.10" "8.16") (isGe "1.12.0") ]; out = "1.15"; }
     { cases = [ (range "8.10" "8.12") "1.11.0" ]; out = "1.11"; }
   ] null;
 
diff --git a/pkgs/development/coq-modules/hierarchy-builder/default.nix b/pkgs/development/coq-modules/hierarchy-builder/default.nix
index bd836d979c45..9468e7ab356f 100644
--- a/pkgs/development/coq-modules/hierarchy-builder/default.nix
+++ b/pkgs/development/coq-modules/hierarchy-builder/default.nix
@@ -5,11 +5,12 @@ with lib; let hb = mkCoqDerivation {
   owner = "math-comp";
   inherit version;
   defaultVersion = with versions; switch coq.coq-version [
-    { case = range "8.15" "8.16"; out = "1.2.1"; }
+    { case = range "8.15" "8.16"; out = "1.3.0"; }
     { case = range "8.13" "8.14"; out = "1.2.0"; }
     { case = range "8.12" "8.13"; out = "1.1.0"; }
     { case = isEq "8.11";         out = "0.10.0"; }
   ] null;
+  release."1.3.0".sha256  = "17k7rlxdx43qda6i1yafpgc64na8br285cb0mbxy5wryafcdrkrc";
   release."1.2.1".sha256  = "sha256-pQYZJ34YzvdlRSGLwsrYgPdz3p/l5f+KhJjkYT08Mj0=";
   release."1.2.0".sha256  = "0sk01rvvk652d86aibc8rik2m8iz7jn6mw9hh6xkbxlsvh50719d";
   release."1.1.0".sha256  = "sha256-spno5ty4kU4WWiOfzoqbXF8lWlNSlySWcRReR3zE/4Q=";
diff --git a/pkgs/development/coq-modules/mathcomp-analysis/default.nix b/pkgs/development/coq-modules/mathcomp-analysis/default.nix
index ec60af63fb13..19c4e6a5a187 100644
--- a/pkgs/development/coq-modules/mathcomp-analysis/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-analysis/default.nix
@@ -9,6 +9,8 @@ let mca = mkCoqDerivation {
   owner = "math-comp";
 
   release."0.5.3".sha256 = "sha256-1NjFsi5TITF8ZWx1NyppRmi8g6YaoUtTdS9bU/sUe5k=";
+  release."0.5.2".sha256 = "0yx5p9zyl8jv1vg7rgkyq8dqzkdnkqv969mi62whmhkvxbavgzbw";
+  release."0.5.1".sha256 = "1hnzqb1gxf88wgj2n1b0f2xm6sxg9j0735zdsv6j12hlvx5lwk68";
   release."0.3.13".sha256 = "sha256-Yaztew79KWRC933kGFOAUIIoqukaZOdNOdw4XszR1Hg=";
   release."0.3.10".sha256 = "sha256-FBH2c8QRibq5Ycw/ieB8mZl0fDiPrYdIzZ6W/A3pIhI=";
   release."0.3.9".sha256 = "sha256-uUU9diBwUqBrNRLiDc0kz0CGkwTZCUmigPwLbpDOeg4=";
@@ -20,13 +22,15 @@ let mca = mkCoqDerivation {
 
   inherit version;
   defaultVersion = with versions; switch [ coq.version mathcomp.version ]  [
-      { cases = [ (isGe "8.14") (isGe "1.13.0") ];      out = "0.5.3"; }
-      { cases = [ (isGe "8.13") (isGe "1.12.0") ];      out = "0.3.13"; }
-      { cases = [ (range "8.11" "8.14") (isGe "1.12.0") ];      out = "0.3.10"; }
-      { cases = [ (range "8.11" "8.13") "1.11.0" ];             out = "0.3.4"; }
-      { cases = [ (range "8.10" "8.12") "1.11.0" ];             out = "0.3.3"; }
-      { cases = [ (range "8.10" "8.11") "1.11.0" ];             out = "0.3.1"; }
-      { cases = [ (range "8.8"  "8.11") (range "1.8" "1.10") ]; out = "0.2.3"; }
+      { cases = [ (isGe "8.14") (isGe "1.13.0") ];               out = "0.5.3"; }
+      { cases = [ (isGe "8.14") (range "1.13" "1.15") ];         out = "0.5.2"; }
+      { cases = [ (isGe "8.13") (range "1.13" "1.14") ];         out = "0.5.1"; }
+      { cases = [ (range "8.13" "8.15") (range "1.12" "1.14") ]; out = "0.3.13"; }
+      { cases = [ (range "8.11" "8.14") (isGe "1.12.0") ];       out = "0.3.10"; }
+      { cases = [ (range "8.11" "8.13") "1.11.0" ];              out = "0.3.4"; }
+      { cases = [ (range "8.10" "8.12") "1.11.0" ];              out = "0.3.3"; }
+      { cases = [ (range "8.10" "8.11") "1.11.0" ];              out = "0.3.1"; }
+      { cases = [ (range "8.8"  "8.11") (range "1.8" "1.10") ];  out = "0.2.3"; }
     ] null;
 
   propagatedBuildInputs =
diff --git a/pkgs/development/coq-modules/mathcomp-bigenough/default.nix b/pkgs/development/coq-modules/mathcomp-bigenough/default.nix
index 2283d5ef1733..8731017eee46 100644
--- a/pkgs/development/coq-modules/mathcomp-bigenough/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-bigenough/default.nix
@@ -12,7 +12,7 @@ with lib; mkCoqDerivation {
   };
   inherit version;
   defaultVersion = with versions; switch coq.version [
-    { case = range "8.10" "8.15"; out = "1.0.1"; }
+    { case = isGe "8.10"        ; out = "1.0.1"; }
     { case = range "8.5"  "8.14"; out = "1.0.0"; }
   ] null;
 
diff --git a/pkgs/development/coq-modules/mathcomp-finmap/default.nix b/pkgs/development/coq-modules/mathcomp-finmap/default.nix
index dc19cd6e56e5..8c29208c3f63 100644
--- a/pkgs/development/coq-modules/mathcomp-finmap/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-finmap/default.nix
@@ -7,7 +7,7 @@ with lib; mkCoqDerivation {
   owner = "math-comp";
   inherit version;
   defaultVersion = with versions; switch [ coq.version mathcomp.version ]  [
-      { cases = [ (range "8.13" "8.15")  (isGe "1.12") ];         out = "1.5.2"; }
+      { cases = [ (range "8.13" "8.16")  (isGe "1.12") ];         out = "1.5.2"; }
       { cases = [ (isGe "8.10")          (isGe "1.11") ];         out = "1.5.1"; }
       { cases = [ (range "8.7" "8.11")   "1.11.0" ];              out = "1.5.0"; }
       { cases = [ (isEq "8.11")          (range "1.8" "1.10") ];  out = "1.4.0+coq-8.11"; }
diff --git a/pkgs/development/coq-modules/mathcomp-real-closed/default.nix b/pkgs/development/coq-modules/mathcomp-real-closed/default.nix
index 0364ad09578e..aef912c6151c 100644
--- a/pkgs/development/coq-modules/mathcomp-real-closed/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-real-closed/default.nix
@@ -8,6 +8,7 @@ with lib; mkCoqDerivation {
   owner = "math-comp";
   inherit version;
   release = {
+    "1.1.3".sha256 = "1vwmmnzy8i4f203i2s60dn9i0kr27lsmwlqlyyzdpsghvbr8h5b7";
     "1.1.2".sha256 = "0907x4nf7nnvn764q3x9lx41g74rilvq5cki5ziwgpsdgb98pppn";
     "1.1.1".sha256 = "0ksjscrgq1i79vys4zrmgvzy2y4ylxa8wdsf4kih63apw6v5ws6b";
     "1.0.5".sha256 = "0q8nkxr9fba4naylr5xk7hfxsqzq2pvwlg1j0xxlhlgr3fmlavg2";
@@ -17,6 +18,7 @@ with lib; mkCoqDerivation {
   };
 
   defaultVersion = with versions; switch [ coq.version mathcomp.version ]  [
+      { cases = [ (isGe "8.13")  (isGe "1.12.0") ]; out = "1.1.3"; }
       { cases = [ (isGe "8.10")  (isGe "1.12.0") ]; out = "1.1.2"; }
       { cases = [ (isGe "8.7")   "1.11.0" ]; out = "1.1.1"; }
       { cases = [ (isGe "8.7")   (range "1.9.0" "1.10.0") ]; out = "1.0.4"; }
diff --git a/pkgs/development/coq-modules/mathcomp/default.nix b/pkgs/development/coq-modules/mathcomp/default.nix
index a5cef76a6d7a..7be30844eb05 100644
--- a/pkgs/development/coq-modules/mathcomp/default.nix
+++ b/pkgs/development/coq-modules/mathcomp/default.nix
@@ -19,6 +19,7 @@ let
   owner = "math-comp";
   withDoc = single && (args.withDoc or false);
   defaultVersion = with versions; switch coq.coq-version [
+      { case = range "8.14" "8.16"; out = "1.15.0"; }
       { case = range "8.11" "8.15"; out = "1.14.0"; }
       { case = range "8.11" "8.15"; out = "1.13.0"; }
       { case = range "8.10" "8.13"; out = "1.12.0"; }
@@ -30,6 +31,7 @@ let
       { case = range "8.5" "8.7";   out = "1.6.4";  }
     ] null;
   release = {
+    "1.15.0".sha256 = "1bp0jxl35ms54s0mdqky15w9af03f3i0n06qk12k4gw1xzvwqv21";
     "1.14.0".sha256 = "07yamlp1c0g5nahkd2gpfhammcca74ga2s6qr7a3wm6y6j5pivk9";
     "1.13.0".sha256 = "0j4cz2y1r1aw79snkcf1pmicgzf8swbaf9ippz0vg99a572zqzri";
     "1.12.0".sha256 = "1ccfny1vwgmdl91kz5xlmhq4wz078xm4z5wpd0jy5rn890dx03wp";
diff --git a/pkgs/development/coq-modules/odd-order/default.nix b/pkgs/development/coq-modules/odd-order/default.nix
index 0d2005326c54..066976e8b4b7 100644
--- a/pkgs/development/coq-modules/odd-order/default.nix
+++ b/pkgs/development/coq-modules/odd-order/default.nix
@@ -5,13 +5,14 @@ mkCoqDerivation {
   pname = "odd-order";
   owner = "math-comp";
 
-  release."1.13.0".rev    = "mathcomp-odd-order.1.13.0";
+  release."1.14.0".sha256 = "0iln70npkvixqyz469l6nry545a15jlaix532i1l7pzfkqqn6v68";
   release."1.13.0".sha256 = "sha256-EzNKR/JzM8T17sMhPhgZNs14e50X4dY3OwFi133IsT0=";
-  release."1.12.0".rev    = "mathcomp-odd-order.1.12.0";
   release."1.12.0".sha256 = "sha256-omsfdc294CxKAHNMMeqJCcVimvyRCHgxcQ4NJOWSfNM=";
+  releaseRev = v: "mathcomp-odd-order.${v}";
 
   inherit version;
   defaultVersion = with versions; switch mathcomp.character.version [
+    { case = (range "1.13.0" "1.15.0"); out = "1.14.0"; }
     { case = (range "1.12.0" "1.14.0"); out = "1.13.0"; }
     { case = (range "1.10.0" "1.12.0"); out = "1.12.0"; }
   ] null;
diff --git a/pkgs/development/libraries/qpdf/default.nix b/pkgs/development/libraries/qpdf/default.nix
index 0537b2b0ddf9..8e46b2d3577f 100644
--- a/pkgs/development/libraries/qpdf/default.nix
+++ b/pkgs/development/libraries/qpdf/default.nix
@@ -15,6 +15,9 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ zlib libjpeg ];
 
+  configureFlags = lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
+                     "--with-random=/dev/urandom";
+
   preCheck = ''
     patchShebangs qtest/bin/qtest-driver
   '';
diff --git a/pkgs/development/ocaml-modules/resource-pooling/default.nix b/pkgs/development/ocaml-modules/resource-pooling/default.nix
index 51407f6b49df..463f8b386f24 100644
--- a/pkgs/development/ocaml-modules/resource-pooling/default.nix
+++ b/pkgs/development/ocaml-modules/resource-pooling/default.nix
@@ -1,18 +1,16 @@
 { lib, fetchFromGitHub, buildDunePackage, lwt_log }:
 
 buildDunePackage rec {
-  version = "1.1";
+  version = "1.2";
   pname = "resource-pooling";
 
-  useDune2 = true;
-
-  minimumOCamlVersion = "4.06";
+  minimalOCamlVersion = "4.06";
 
   src = fetchFromGitHub {
     owner = "ocsigen";
     repo = pname;
     rev = version;
-    sha256 = "0wsbnwszafdv3gsiiaslgf6m6pfx74h7h19i0gp2c4ivdiv3wck9";
+    sha256 = "sha256-GNYPxjMTo7y40y7aQdseuFyeVF/hSCZKXfEaH/WIO9w=";
   };
 
   propagatedBuildInputs = [ lwt_log ];
diff --git a/pkgs/development/python-modules/chex/default.nix b/pkgs/development/python-modules/chex/default.nix
index 98598e4acf15..79eeb9319973 100644
--- a/pkgs/development/python-modules/chex/default.nix
+++ b/pkgs/development/python-modules/chex/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "chex";
-  version = "0.1.3";
+  version = "0.1.4";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "deepmind";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-oIdRh0WKzdvyCfcamKRDiMsV51b6rdmNYcELjDQKGX4=";
+    hash = "sha256-FiZElESyOVu1VJxUDNiN6HVADiaubDrGdQHYp2CN8f4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-compute/default.nix b/pkgs/development/python-modules/google-cloud-compute/default.nix
new file mode 100644
index 000000000000..6607dde52553
--- /dev/null
+++ b/pkgs/development/python-modules/google-cloud-compute/default.nix
@@ -0,0 +1,54 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+, google-api-core
+, mock
+, proto-plus
+, protobuf
+, pytest-asyncio
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "google-cloud-compute";
+  version = "1.4.0";
+  disabled = pythonOlder "3.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0sgp0xa9cfmgyb1dwdy1f4q9dfr3lgsgm7vbiks9xmiaf0fr221m";
+  };
+
+  propagatedBuildInputs = [
+    google-api-core
+    proto-plus
+    protobuf
+  ];
+
+  checkInputs = [
+    mock
+    pytest-asyncio
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "google.cloud.compute"
+    "google.cloud.compute_v1"
+  ];
+
+  # disable tests that require credentials
+  disabledTestPaths = [
+    "tests/system/test_addresses.py"
+    "tests/system/test_instance_group.py"
+    "tests/system/test_pagination.py"
+    "tests/system/test_smoke.py"
+  ];
+
+  meta = with lib; {
+    description = "API Client library for Google Cloud Compute";
+    homepage = "https://github.com/googleapis/python-compute";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ jpetrucciani ];
+  };
+}
diff --git a/pkgs/development/python-modules/minikerberos/default.nix b/pkgs/development/python-modules/minikerberos/default.nix
index a6e9fd68c2bd..b480438d885a 100644
--- a/pkgs/development/python-modules/minikerberos/default.nix
+++ b/pkgs/development/python-modules/minikerberos/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "minikerberos";
-  version = "0.2.20";
+  version = "0.3.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-eJ+AImP6GIL3AbEj9u7ASLRc1zG/G1KIcABdrwdAIEc=";
+    hash = "sha256-3uh0iFBD+WW4DWl1gcwfGERCq21CrF8iggNKULnAhUE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/peaqevcore/default.nix b/pkgs/development/python-modules/peaqevcore/default.nix
index 65d5417ee15b..dfcfe87c9a93 100644
--- a/pkgs/development/python-modules/peaqevcore/default.nix
+++ b/pkgs/development/python-modules/peaqevcore/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "peaqevcore";
-  version = "5.16.7";
+  version = "5.18.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-hL07M5lelXmxhSVkY0dmnQWpI6B/9pW7jf00x/nDaJU=";
+    hash = "sha256-LKb1sTekBbOKdsdxZbiAMAmOTjS21nvq7UWzVxEqJh0=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pypdf2/default.nix b/pkgs/development/python-modules/pypdf2/default.nix
index 037c0437ffc6..d9522d63a745 100644
--- a/pkgs/development/python-modules/pypdf2/default.nix
+++ b/pkgs/development/python-modules/pypdf2/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "PyPDF2";
-  version = "2.10.0";
+  version = "2.10.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-smB4IGIhxkEeyXpaXAiXWuebp+xGdXXRFHepnM5gHrk=";
+    sha256 = "sha256-8JDF/HmQz1ptY2TOI2KDSXTjITbVIpG6uyNy5dZH0Yg=";
   };
 
   LC_ALL = "en_US.UTF-8";
diff --git a/pkgs/development/python-modules/python-gitlab/default.nix b/pkgs/development/python-modules/python-gitlab/default.nix
index 21cb103df83f..eb4316989733 100644
--- a/pkgs/development/python-modules/python-gitlab/default.nix
+++ b/pkgs/development/python-modules/python-gitlab/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "python-gitlab";
-  version = "3.8.1";
+  version = "3.9.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-4dslB2Ug4RjHwmvssNB0p6aBJ0OYcNQ7hjY0Igax4JE=";
+    sha256 = "sha256-X8Xoj4HzZuEYUcuLS5pbgnSRziC6dYVEa3TJsJdya6M=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/screeninfo/default.nix b/pkgs/development/python-modules/screeninfo/default.nix
index 886854d1f2af..dc794513fc4c 100644
--- a/pkgs/development/python-modules/screeninfo/default.nix
+++ b/pkgs/development/python-modules/screeninfo/default.nix
@@ -25,11 +25,14 @@ buildPythonApplication rec {
     dataclasses
   ];
 
-  buildInputs = [
-    libX11
-    libXinerama
-    libXrandr
-  ];
+  postPatch = ''
+    substituteInPlace screeninfo/enumerators/xinerama.py \
+      --replace 'load_library("X11")' 'ctypes.cdll.LoadLibrary("${libX11}/lib/libX11.so")' \
+      --replace 'load_library("Xinerama")' 'ctypes.cdll.LoadLibrary("${libXinerama}/lib/libXinerama.so")'
+    substituteInPlace screeninfo/enumerators/xrandr.py \
+      --replace 'load_library("X11")' 'ctypes.cdll.LoadLibrary("${libX11}/lib/libX11.so")' \
+      --replace 'load_library("Xrandr")' 'ctypes.cdll.LoadLibrary("${libXrandr}/lib/libXrandr.so")'
+  '';
 
   checkInputs = [
     pytestCheckHook
diff --git a/pkgs/development/python-modules/sphinxcontrib-openapi/default.nix b/pkgs/development/python-modules/sphinxcontrib-openapi/default.nix
index fbdeb9ae00a3..1b4c5f11d11b 100644
--- a/pkgs/development/python-modules/sphinxcontrib-openapi/default.nix
+++ b/pkgs/development/python-modules/sphinxcontrib-openapi/default.nix
@@ -23,6 +23,9 @@ buildPythonPackage rec {
   # https://github.com/cilium/cilium/commit/b9862461568dd41d4dc8924711d4cc363907270b and
   # https://github.com/cilium/openapi/commit/cd829a05caebd90b31e325d4c9c2714b459d135f
   # for details.
+  # PR to switch upstream sphinx-contrib/openapi from m2r to sphinx-mdinclude:
+  # https://github.com/sphinx-contrib/openapi/pull/127
+  # (once merged, we should switch away from that fork again)
   src = fetchFromGitHub {
     owner = "cilium";
     repo = "openapi";
@@ -48,5 +51,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/ikalnytskyi/sphinxcontrib-openapi";
     description = "OpenAPI (fka Swagger) spec renderer for Sphinx";
     license = licenses.bsd0;
+    maintainers = [ maintainers.flokli ];
   };
 }
diff --git a/pkgs/development/python-modules/versioneer/default.nix b/pkgs/development/python-modules/versioneer/default.nix
index 9fbea40b1e8e..d4847cf4363f 100644
--- a/pkgs/development/python-modules/versioneer/default.nix
+++ b/pkgs/development/python-modules/versioneer/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "versioneer";
-  version = "0.23";
+  version = "0.24";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-1rbWjCmWU3NqKfGZMJ7kMG6XoPDQp47LceIckM4TIrs=";
+    hash = "sha256-G426nlHi8OBMfoVFIW7s3qLWPhvVVpRI7mbFSffneC8=";
   };
 
   # Couldn't get tests to work because, for instance, they used virtualenv and
diff --git a/pkgs/development/tools/analysis/cargo-tarpaulin/default.nix b/pkgs/development/tools/analysis/cargo-tarpaulin/default.nix
index 8bae667b6d27..502a72cd4c04 100644
--- a/pkgs/development/tools/analysis/cargo-tarpaulin/default.nix
+++ b/pkgs/development/tools/analysis/cargo-tarpaulin/default.nix
@@ -2,13 +2,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-tarpaulin";
-  version = "0.20.1";
+  version = "0.21.0";
 
   src = fetchFromGitHub {
     owner = "xd009642";
     repo = "tarpaulin";
     rev = version;
-    sha256 = "sha256-WobKZeO0U54mHj7hlkOH33TcOklWBJRWYSJBEt5sYII=";
+    sha256 = "sha256-u6HZekrFfL+jqUh7UAo9DbgYxzS/drpt1/WdJqRFFe4=";
   };
 
   nativeBuildInputs = [
@@ -17,7 +17,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [ openssl ]
     ++ lib.optionals stdenv.isDarwin [ curl Security ];
 
-  cargoSha256 = "sha256-LR4jU7V44f00ry0VEd3qFryZtnn/t0K/OZGnRproksE=";
+  cargoSha256 = "sha256-g3PrsyGhBiN32wPtdrIPjnQK79gaJtTfZkwv7MzYYrU=";
   #checkFlags = [ "--test-threads" "1" ];
   doCheck = false;
 
diff --git a/pkgs/development/tools/cbfmt/default.nix b/pkgs/development/tools/cbfmt/default.nix
index b171152a36ed..09471b76ef52 100644
--- a/pkgs/development/tools/cbfmt/default.nix
+++ b/pkgs/development/tools/cbfmt/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cbfmt";
-  version = "0.1.4";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "lukas-reineke";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-MOvTsyfKsBSog/0SpHJO9xiIc6/hmQVN4dqqytiiCgs=";
+    sha256 = "sha256-/ZvL1ZHXcmE1n+hHvJeSqmnI9nSHJ+zM9lLNx0VQfIE=";
   };
 
-  cargoSha256 = "sha256-Vu4bcw5WSwS2MB0sPumoQDhSdjnZyzrYF8eMPeVallA=";
+  cargoSha256 = "sha256-6oZCpjQ8t/QLFhEtF7td8KGI/kFE04pg7OELutsrJKo=";
 
   passthru.tests.version = testers.testVersion {
     package = cbfmt;
diff --git a/pkgs/development/tools/continuous-integration/dagger/default.nix b/pkgs/development/tools/continuous-integration/dagger/default.nix
index 427f116f7558..cb12da46e97b 100644
--- a/pkgs/development/tools/continuous-integration/dagger/default.nix
+++ b/pkgs/development/tools/continuous-integration/dagger/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "dagger";
-  version = "0.2.31";
+  version = "0.2.32";
 
   src = fetchFromGitHub {
     owner = "dagger";
     repo = "dagger";
     rev = "v${version}";
-    sha256 = "sha256-G4SittUyh0vqpDWi9vRxTB2Be+gwluYaLCSHDoV8uMg=";
+    sha256 = "sha256-D/iCHXEwsJ4QbDem9+cCjljMTeZY7HDmyXEcPCKjNck=";
   };
 
-  vendorSha256 = "sha256-kQ40tydh3CpXupqDE5DRpnj4Xb36jpHAeTRvZf5ZNus=";
+  vendorSha256 = "sha256-GsBeitFYkjwybyRmC0GfYWGs4rwbFz4o6RlmuJibQDY=";
 
   subPackages = [
     "cmd/dagger"
diff --git a/pkgs/development/tools/dprint/default.nix b/pkgs/development/tools/dprint/default.nix
index 63a6a6a39f38..c6e18c16c5e7 100644
--- a/pkgs/development/tools/dprint/default.nix
+++ b/pkgs/development/tools/dprint/default.nix
@@ -2,14 +2,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "dprint";
-  version = "0.30.3";
+  version = "0.31.1";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-/lptdZEcnbBQL9hYj0xyI95fMT22tGy8zeQz+8VwMog=";
+    sha256 = "sha256-NgUc3QrH7y72DS01ypfnifHzQeFCogPa+8+Kzv4i4xE=";
   };
 
-  cargoSha256 = "sha256-BJGOaZgY03CYC8fa0wnlDmc9SO72lrLmdafovFD3BBI=";
+  cargoSha256 = "sha256-0BIkO9sMQbQTONSsNgR5UFPIkA0mzADqHxlEhHlIG0Y=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ Security ];
 
diff --git a/pkgs/development/tools/pipenv/default.nix b/pkgs/development/tools/pipenv/default.nix
index 355aadb60ddd..793b1da2fa03 100644
--- a/pkgs/development/tools/pipenv/default.nix
+++ b/pkgs/development/tools/pipenv/default.nix
@@ -19,11 +19,11 @@ let
 
 in buildPythonApplication rec {
   pname = "pipenv";
-  version = "2022.8.24";
+  version = "2022.8.30";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-7b/4F2bUMoEVsoc43w5SQMsimaNP8MYNUkrShV3xjGk=";
+    sha256 = "sha256-QUda28Wt4XGEZDvP36mWMuf2FROhfsccSDIDG4hiy6s=";
   };
 
   LC_ALL = "en_US.UTF-8";
diff --git a/pkgs/development/tools/verible/default.nix b/pkgs/development/tools/verible/default.nix
new file mode 100644
index 000000000000..6763638cab74
--- /dev/null
+++ b/pkgs/development/tools/verible/default.nix
@@ -0,0 +1,85 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, buildBazelPackage
+, bazel_4
+, flex
+, bison
+, python3
+}:
+
+buildBazelPackage rec {
+  pname = "verible";
+  version = "0.0-2172-g238b6df6";
+
+  # These environment variables are read in bazel/build-version.py to create
+  # a build string. Otherwise it would attempt to extract it from .git/.
+  GIT_DATE = "2022-08-08";
+  GIT_VERSION = version;
+
+  src = fetchFromGitHub {
+    owner = "chipsalliance";
+    repo = "verible";
+    rev = "v${version}";
+    sha256 = "sha256-iOJhdbipuqqBiYGgk95d1c8bEK6Z16l16GuzYCQRc2g=";
+  };
+
+  patches = [
+    # Patch WORKSPACE file to not include windows-related dependencies,
+    # as they are removed by bazel, breaking the fixed output derivation
+    # TODO: fix upstream
+    ./remove-unused-deps.patch
+  ];
+
+  bazelFlags = [ "--//bazel:use_local_flex_bison" ];
+
+  fetchAttrs = {
+    # Fixed output derivation hash after bazel fetch
+    sha256 = "sha256-XoLdlEeoDJlyWlnXZADHOKu06zKHgHJfgey8UhOt+LM=";
+  };
+
+  nativeBuildInputs = [
+    flex       # We use local flex and bison as WORKSPACE sources fail
+    bison      # .. to compile with newer glibc
+    python3
+  ];
+
+  postPatch = ''
+    patchShebangs bazel/build-version.py \
+      common/util/create_version_header.sh \
+      common/parser/move_yacc_stack_symbols.sh \
+      common/parser/record_syntax_error.sh
+  '';
+
+  removeRulesCC = false;
+  bazelTarget = ":install-binaries";
+  bazelBuildFlags = [
+    "-c opt"
+  ];
+  buildAttrs = {
+    installPhase = ''
+      mkdir -p "$out/bin"
+
+      install bazel-bin/common/tools/verible-patch-tool "$out/bin"
+
+      V_TOOLS_DIR=bazel-bin/verilog/tools
+      install $V_TOOLS_DIR/diff/verible-verilog-diff "$out/bin"
+      install $V_TOOLS_DIR/formatter/verible-verilog-format "$out/bin"
+      install $V_TOOLS_DIR/kythe/verible-verilog-kythe-extractor "$out/bin"
+      install $V_TOOLS_DIR/lint/verible-verilog-lint "$out/bin"
+      install $V_TOOLS_DIR/ls/verible-verilog-ls "$out/bin"
+      install $V_TOOLS_DIR/obfuscator/verible-verilog-obfuscate "$out/bin"
+      install $V_TOOLS_DIR/preprocessor/verible-verilog-preprocessor "$out/bin"
+      install $V_TOOLS_DIR/project/verible-verilog-project "$out/bin"
+      install $V_TOOLS_DIR/syntax/verible-verilog-syntax "$out/bin"
+    '';
+  };
+
+  meta = with lib; {
+    homepage = "https://github.com/chipsalliance/verible";
+    description = "Suite of SystemVerilog developer tools. Including a style-linter, indexer, formatter, and language server.";
+    license = licenses.asl20;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ hzeller ];
+  };
+}
diff --git a/pkgs/development/tools/verible/remove-unused-deps.patch b/pkgs/development/tools/verible/remove-unused-deps.patch
new file mode 100644
index 000000000000..19d20309c106
--- /dev/null
+++ b/pkgs/development/tools/verible/remove-unused-deps.patch
@@ -0,0 +1,22 @@
+diff --git a/WORKSPACE b/WORKSPACE
+index 696cc7ef..55a5bb8a 100644
+--- a/WORKSPACE
++++ b/WORKSPACE
+@@ -81,17 +81,6 @@ load("@com_github_google_rules_install//:setup.bzl", "install_rules_setup")
+ 
+ install_rules_setup()
+ 
+-# Need to load before rules_flex/rules_bison to make sure
+-# win_flex_bison is the chosen toolchain on Windows
+-load("//bazel:win_flex_bison.bzl", "win_flex_configure")
+-
+-win_flex_configure(
+-    name = "win_flex_bison",
+-    sha256 = "095cf65cb3f12ee5888022f93109acbe6264e5f18f6ffce0bda77feb31b65bd8",
+-    # bison 3.3.2, flex 2.6.4
+-    url = "https://github.com/lexxmark/winflexbison/releases/download/v2.5.18/win_flex_bison-2.5.18.zip",
+-)
+-
+ http_archive(
+     name = "rules_m4",
+     sha256 = "c67fa9891bb19e9e6c1050003ba648d35383b8cb3c9572f397ad24040fb7f0eb",
diff --git a/pkgs/games/purpur/default.nix b/pkgs/games/purpur/default.nix
index e28106183e85..91db55f2a9fd 100644
--- a/pkgs/games/purpur/default.nix
+++ b/pkgs/games/purpur/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "purpur";
-  version = "1.18.1r1522";
+  version = "1.19.2r1763";
 
   src = fetchurl {
     url = "https://api.purpurmc.org/v2/purpur/${builtins.replaceStrings [ "r" ] [ "/" ] version}/download";
-    sha256 = "1060fsfcw6m30d47wla1vsnmc4czyla6m8wf91ws095hbvc22qsm";
+    sha256 = "sha256-6wcCwVIGV32YQlgB57qthy6uWtuXGN4G8S7uAAgVyDE=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/servers/keycloak/default.nix b/pkgs/servers/keycloak/default.nix
index ded809c163e5..b518f24c5340 100644
--- a/pkgs/servers/keycloak/default.nix
+++ b/pkgs/servers/keycloak/default.nix
@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation rec {
   pname = "keycloak";
-  version = "18.0.0";
+  version = "19.0.1";
 
   src = fetchzip {
     url = "https://github.com/keycloak/keycloak/releases/download/${version}/keycloak-${version}.zip";
-    sha256 = "0fxf9m50hpjplj077z2zjp0qibixz5y4lbc8159cnxbd4gzpkaaf";
+    sha256 = "sha256-3hqnFH0zWvgOgpQHV4eMqTGzUWEoRwxvOcOUL2s8YQk=";
   };
 
   nativeBuildInputs = [ makeWrapper jre ];
@@ -28,17 +28,14 @@ stdenv.mkDerivation rec {
     install -m 0600 ${confFile} conf/keycloak.conf
   '' + ''
     install_plugin() {
-    if [ -d "$1" ]; then
-      find "$1" -type f \( -iname \*.ear -o -iname \*.jar \) -exec install -m 0500 "{}" "providers/" \;
-    else
-      install -m 0500 "$1" "providers/"
-    fi
+      if [ -d "$1" ]; then
+        find "$1" -type f \( -iname \*.ear -o -iname \*.jar \) -exec install -m 0500 "{}" "providers/" \;
+      else
+        install -m 0500 "$1" "providers/"
+      fi
     }
     ${lib.concatMapStringsSep "\n" (pl: "install_plugin ${lib.escapeShellArg pl}") plugins}
   '' + ''
-    export KC_HOME_DIR=$out
-    export KC_CONF_DIR=$out/conf
-
     patchShebangs bin/kc.sh
     bin/kc.sh build
 
diff --git a/pkgs/servers/matrix-synapse/default.nix b/pkgs/servers/matrix-synapse/default.nix
index 90f747370f8e..d28bba446a13 100644
--- a/pkgs/servers/matrix-synapse/default.nix
+++ b/pkgs/servers/matrix-synapse/default.nix
@@ -11,11 +11,11 @@ in
 with python3.pkgs;
 buildPythonApplication rec {
   pname = "matrix-synapse";
-  version = "1.65.0";
+  version = "1.66.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-Kn5o6RKR3mMHvACPiMvIGKmjkAwdjcw6EY6MJXKKeAE=";
+    sha256 = "sha256-jrjNl3NlJ9sWNNM/VYrASPnVZ/U9fn1N1P6Yqd+MQ08=";
   };
 
   buildInputs = [ openssl ];
@@ -40,6 +40,7 @@ buildPythonApplication rec {
     psutil
     psycopg2
     pyasn1
+    pydantic
     pyjwt
     pymacaroons
     pynacl
diff --git a/pkgs/servers/monitoring/prometheus/gitlab-ci-pipelines-exporter.nix b/pkgs/servers/monitoring/prometheus/gitlab-ci-pipelines-exporter.nix
index 1c24c065ed77..31e511706474 100644
--- a/pkgs/servers/monitoring/prometheus/gitlab-ci-pipelines-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/gitlab-ci-pipelines-exporter.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "gitlab-ci-pipelines-exporter";
-  version = "0.5.3";
+  version = "0.5.4";
 
   src = fetchFromGitHub {
     owner = "mvisonneau";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1i0ry93w2pk8m7i4fbdn1xvsmvjn83d6lr6l7yywid9d0kmkjz13";
+    sha256 = "sha256-sVXLcz//1RLYOmKtH6u4tCPS8oqV0vOkmQLpWNBiUQY=";
   };
 
   subPackages = [ "cmd/${pname}" ];
@@ -17,7 +17,7 @@ buildGoModule rec {
     "-X main.version=v${version}"
   ];
 
-  vendorSha256 = "UszZaxql5sO4DSDVD/UIjeeDojCQEPF+ATL7O9MaTG8=";
+  vendorSha256 = "sha256-uyjj0Yh/bIvWvh76TEasgjJg9Dgj/GHgn3BOsO2peT0=";
   doCheck = true;
 
   meta = with lib; {
diff --git a/pkgs/servers/monitoring/prometheus/sql-exporter.nix b/pkgs/servers/monitoring/prometheus/sql-exporter.nix
index be881281faca..cc9fd7d484f5 100644
--- a/pkgs/servers/monitoring/prometheus/sql-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/sql-exporter.nix
@@ -1,10 +1,8 @@
-{ lib, buildGoModule, fetchFromGitHub, nixosTests }:
+{ lib, buildGoModule, fetchFromGitHub, go, prometheus-sql-exporter, testers }:
 
 buildGoModule rec {
   pname = "sql_exporter";
-  version = "0.4.4";
-
-  vendorSha256 = null;
+  version = "0.4.5";
 
   src = fetchFromGitHub {
     owner = "justwatchcom";
@@ -13,6 +11,23 @@ buildGoModule rec {
     sha256 = "sha256-A3hMSnfxiEgFYueARuldEHT/5ROCIwWjqQj2FdkVYqo=";
   };
 
+  vendorSha256 = null;
+
+  ldflags = let t = "github.com/prometheus/common/version"; in
+    [
+      "-X ${t}.Version=${version}"
+      "-X ${t}.Revision=${src.rev}"
+      "-X ${t}.Branch=unknown"
+      "-X ${t}.BuildUser=nix@nixpkgs"
+      "-X ${t}.BuildDate=unknown"
+      "-X ${t}.GoVersion=${lib.getVersion go}"
+    ];
+
+  passthru.tests.version = testers.testVersion {
+    package = prometheus-sql-exporter;
+    command = "sql_exporter -version";
+  };
+
   meta = with lib; {
     description = "Flexible SQL exporter for Prometheus";
     homepage = "https://github.com/justwatchcom/sql_exporter";
diff --git a/pkgs/tools/misc/czkawka/default.nix b/pkgs/tools/misc/czkawka/default.nix
index 06127a62df02..fce125b35cd5 100644
--- a/pkgs/tools/misc/czkawka/default.nix
+++ b/pkgs/tools/misc/czkawka/default.nix
@@ -17,16 +17,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "czkawka";
-  version = "5.0.1";
+  version = "5.0.2";
 
   src = fetchFromGitHub {
     owner = "qarmin";
     repo = "czkawka";
     rev = version;
-    sha256 = "sha256-ochHohwCOKCF9kiiMxMIaJXaHUWNbq7pIh+VNRKQlcg=";
+    sha256 = "sha256-+Z4R6eRYNU0/wmrrTCLabY1zgxGbdSkgrfJd8rI5fZo=";
   };
 
-  cargoSha256 = "sha256-ap8OpaLs1jZtEHbXVZyaGj3gvblWtyHmYrHiHvZKhfs=";
+  cargoSha256 = "sha256-hkqGOl6ew3GBMPem8bPRy0PYphHhXJVv6iQiH6lK0kE=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/tools/misc/goreleaser/default.nix b/pkgs/tools/misc/goreleaser/default.nix
index a2087307ee52..9bd75abd5d35 100644
--- a/pkgs/tools/misc/goreleaser/default.nix
+++ b/pkgs/tools/misc/goreleaser/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "goreleaser";
-  version = "1.11.1";
+  version = "1.11.2";
 
   src = fetchFromGitHub {
     owner = "goreleaser";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-3kaoBmq/GXZMSlShgI/ykxnOMn9DrdNAFuUcCGItZW4=";
+    sha256 = "sha256-Qe2Q7cFu9G0Zj/mHTnxSq57OpeNMX3yZQp8VApVtZDc=";
   };
 
   vendorSha256 = "sha256-7xySEPmc24yOwUerGoARsKaGIYnIvaJFjcwNvbHG4Ls=";
diff --git a/pkgs/tools/misc/manga-cli/default.nix b/pkgs/tools/misc/manga-cli/default.nix
new file mode 100644
index 000000000000..3f57b529e51a
--- /dev/null
+++ b/pkgs/tools/misc/manga-cli/default.nix
@@ -0,0 +1,39 @@
+{ stdenvNoCC
+, lib
+, fetchFromGitHub
+, makeWrapper
+, img2pdf
+, zathura
+}:
+
+stdenvNoCC.mkDerivation {
+  pname = "manga-cli";
+  version = "unstable-2022-04-11";
+
+  src = fetchFromGitHub {
+    owner = "7USTIN";
+    repo = "manga-cli";
+    rev = "a69fe935341eaf96618a6b2064d4dcb36c8690b5";
+    sha256 = "sha256-AnpOEgOBt2a9jtPNvfBnETGtc5Q1WBmSRFDvQB7uBE4=";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 manga-cli $out/bin/manga-cli
+
+    wrapProgram $out/bin/manga-cli \
+      --prefix PATH : ${lib.makeBinPath [ img2pdf zathura ]}
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/7USTIN/manga-cli";
+    description = "Bash script for reading mangas via the terminal by scraping manganato";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ baitinq ];
+  };
+}
diff --git a/pkgs/tools/misc/pandoc-katex/default.nix b/pkgs/tools/misc/pandoc-katex/default.nix
new file mode 100644
index 000000000000..e2bef6aebf30
--- /dev/null
+++ b/pkgs/tools/misc/pandoc-katex/default.nix
@@ -0,0 +1,22 @@
+{ lib, fetchFromGitHub, rustPlatform }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "pandoc-katex";
+  version = "0.1.9";
+
+  src = fetchFromGitHub {
+    owner = "xu-cheng";
+    repo = pname;
+    rev = version;
+    hash = "sha256-Sd+f1a3Y4XwSj5BupAH35UK6gQxzLy5jJCtc77R9wnM=";
+  };
+
+  cargoSha256 = "sha256-PVEQTzkkD6V9DqcIHznfnO1wOARSxutLApaO9dlokTQ=";
+
+  meta = with lib; {
+    description = "Pandoc filter to render math equations using KaTeX";
+    homepage = "https://github.com/xu-cheng/pandoc-katex";
+    license = with licenses; [ asl20 /* or */ mit ];
+    maintainers = with maintainers; [ minijackson pacien ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 091c82f64391..e59478e9c5b0 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9208,6 +9208,8 @@ with pkgs;
 
   pandoc-drawio-filter = python3Packages.callPackage ../tools/misc/pandoc-drawio-filter { };
 
+  pandoc-katex = callPackage ../tools/misc/pandoc-katex { };
+
   pandoc-plantuml-filter = python3Packages.callPackage ../tools/misc/pandoc-plantuml-filter { };
 
   # pandoc-*nos is a filter suite, where pandoc-xnos has all functionality and the others are used for only specific functionality
@@ -11885,6 +11887,8 @@ with pkgs;
 
   verco = callPackage ../applications/version-management/verco { };
 
+  verible = callPackage ../development/tools/verible { };
+
   verilator = callPackage ../applications/science/electronics/verilator {};
 
   verilog = callPackage ../applications/science/electronics/verilog {
@@ -28141,6 +28145,8 @@ with pkgs;
 
   hakuneko = callPackage ../tools/misc/hakuneko { };
 
+  manga-cli = callPackage ../tools/misc/manga-cli { };
+
   hamster = callPackage ../applications/misc/hamster { };
 
   hacpack = callPackage ../tools/compression/hacpack { };
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 45c3ee62c530..efb6c91d7f28 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -12003,6 +12003,14 @@ let
       url = "mirror://cpan/authors/id/P/PE/PEVANS/IO-Async-SSL-0.23.tar.gz";
       hash = "sha256-0vyuFuJ+F6yjkDpK1aK/L7wmjQZRzn8ARabQVG9YTy4=";
     };
+    patches = [
+      (fetchpatch {
+        # Fixes test compatibility with OpenSSL 3
+        url = "https://sources.debian.org/data/main/libi/libio-async-ssl-perl/0.23-1/debian/patches/upgrade-error-match.patch";
+        hash = "sha256-RK36nVba203I9awZtHiU7jwhCV7U8Gw6wnbs3e9Hbjk=";
+        name = "IO-Async-SSL-upgrade-error-match.patch";
+      })
+    ];
     buildInputs = [ TestIdentity ];
     propagatedBuildInputs = [ Future IOAsync IOSocketSSL ];
     meta = {
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index e39221ac359f..07c8f44f5cdb 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3787,6 +3787,8 @@ in {
 
   google-cloud-bigtable = callPackage ../development/python-modules/google-cloud-bigtable { };
 
+  google-cloud-compute = callPackage ../development/python-modules/google-cloud-compute { };
+
   google-cloud-container = callPackage ../development/python-modules/google-cloud-container { };
 
   google-cloud-core = callPackage ../development/python-modules/google-cloud-core { };