diff --git a/nixos/modules/installer/cd-dvd/system-tarball-sheevaplug.nix b/nixos/modules/installer/cd-dvd/system-tarball-sheevaplug.nix
index 458e313a3f75..329bd329dc15 100644
--- a/nixos/modules/installer/cd-dvd/system-tarball-sheevaplug.nix
+++ b/nixos/modules/installer/cd-dvd/system-tarball-sheevaplug.nix
@@ -87,19 +87,19 @@ in
   boot.initrd.availableKernelModules =
     [ "mvsdio" "reiserfs" "ext3" "ums-cypress" "rtc_mv" "ext4" ];
 
-  boot.postBootCommands =
+  boot.postBootCommands = lib.mkIf (!boot.initrd.systemd.enable)
     ''
       mkdir -p /mnt
 
       cp ${dummyConfiguration} /etc/nixos/configuration.nix
     '';
 
-  boot.initrd.extraUtilsCommands =
+  boot.initrd.extraUtilsCommands = lib.mkIf (!boot.initrd.systemd.enable)
     ''
       copy_bin_and_libs ${pkgs.util-linux}/sbin/hwclock
     '';
 
-  boot.initrd.postDeviceCommands =
+  boot.initrd.postDeviceCommands = lib.mkIf (!boot.initrd.systemd.enable)
     ''
       hwclock -s
     '';
diff --git a/nixos/modules/system/boot/systemd/initrd.nix b/nixos/modules/system/boot/systemd/initrd.nix
index 6c1b42da1c41..fc4bd6ff69b6 100644
--- a/nixos/modules/system/boot/systemd/initrd.nix
+++ b/nixos/modules/system/boot/systemd/initrd.nix
@@ -65,7 +65,6 @@ let
     "systemd-kexec.service"
     "systemd-modules-load.service"
     "systemd-poweroff.service"
-    "systemd-random-seed.service"
     "systemd-reboot.service"
     "systemd-sysctl.service"
     "systemd-tmpfiles-setup-dev.service"
@@ -193,7 +192,7 @@ in {
       description = ''
         Store paths to copy into the initrd as well.
       '';
-      type = types.listOf types.singleLineStr;
+      type = with types; listOf (oneOf [ singleLineStr package ]);
       default = [];
     };
 
@@ -396,7 +395,6 @@ in {
         "${cfg.package}/lib/systemd/systemd-journald"
         "${cfg.package}/lib/systemd/systemd-makefs"
         "${cfg.package}/lib/systemd/systemd-modules-load"
-        "${cfg.package}/lib/systemd/systemd-random-seed"
         "${cfg.package}/lib/systemd/systemd-remount-fs"
         "${cfg.package}/lib/systemd/systemd-shutdown"
         "${cfg.package}/lib/systemd/systemd-sulogin-shell"
@@ -507,6 +505,5 @@ in {
     };
 
     boot.kernelParams = lib.mkIf (config.boot.resumeDevice != "") [ "resume=${config.boot.resumeDevice}" ];
-
   };
 }
diff --git a/nixos/modules/tasks/bcache.nix b/nixos/modules/tasks/bcache.nix
index 41fb7664f3d1..0a13522de11f 100644
--- a/nixos/modules/tasks/bcache.nix
+++ b/nixos/modules/tasks/bcache.nix
@@ -1,13 +1,23 @@
-{ pkgs, ... }:
+{ config, lib, pkgs, ... }:
 
 {
+  options.boot.initrd.services.bcache.enable = (lib.mkEnableOption "bcache support in the initrd") // {
+    visible = false; # only works with systemd stage 1
+  };
 
-  environment.systemPackages = [ pkgs.bcache-tools ];
+  config = {
 
-  services.udev.packages = [ pkgs.bcache-tools ];
+    environment.systemPackages = [ pkgs.bcache-tools ];
 
-  boot.initrd.extraUdevRulesCommands = ''
-    cp -v ${pkgs.bcache-tools}/lib/udev/rules.d/*.rules $out/
-  '';
+    services.udev.packages = [ pkgs.bcache-tools ];
 
+    boot.initrd.extraUdevRulesCommands = lib.mkIf (!config.boot.initrd.systemd.enable) ''
+      cp -v ${pkgs.bcache-tools}/lib/udev/rules.d/*.rules $out/
+    '';
+
+    boot.initrd.services.udev = lib.mkIf config.boot.initrd.services.bcache.enable {
+      packages = [ pkgs.bcache-tools ];
+      binPackages = [ pkgs.bcache-tools ];
+    };
+  };
 }
diff --git a/nixos/modules/tasks/filesystems/btrfs.nix b/nixos/modules/tasks/filesystems/btrfs.nix
index ae1dab5b8d8d..b7ebc37dd5cf 100644
--- a/nixos/modules/tasks/filesystems/btrfs.nix
+++ b/nixos/modules/tasks/filesystems/btrfs.nix
@@ -66,19 +66,19 @@ in
         ]
       );
 
-      boot.initrd.extraUtilsCommands = mkIf inInitrd
+      boot.initrd.extraUtilsCommands = mkIf (inInitrd && !config.boot.initrd.systemd.enable)
       ''
         copy_bin_and_libs ${pkgs.btrfs-progs}/bin/btrfs
         ln -sv btrfs $out/bin/btrfsck
         ln -sv btrfsck $out/bin/fsck.btrfs
       '';
 
-      boot.initrd.extraUtilsCommandsTest = mkIf inInitrd
+      boot.initrd.extraUtilsCommandsTest = mkIf (inInitrd && !config.boot.initrd.systemd.enable)
       ''
         $out/bin/btrfs --version
       '';
 
-      boot.initrd.postDeviceCommands = mkIf inInitrd
+      boot.initrd.postDeviceCommands = mkIf (inInitrd && !config.boot.initrd.systemd.enable)
       ''
         btrfs device scan
       '';
diff --git a/nixos/modules/tasks/filesystems/cifs.nix b/nixos/modules/tasks/filesystems/cifs.nix
index 47ba0c03c563..0de292a69208 100644
--- a/nixos/modules/tasks/filesystems/cifs.nix
+++ b/nixos/modules/tasks/filesystems/cifs.nix
@@ -16,7 +16,7 @@ in
     boot.initrd.availableKernelModules = mkIf inInitrd
       [ "cifs" "nls_utf8" "hmac" "md4" "ecb" "des_generic" "sha256" ];
 
-    boot.initrd.extraUtilsCommands = mkIf inInitrd
+    boot.initrd.extraUtilsCommands = mkIf (inInitrd && !config.boot.initrd.systemd.enable)
       ''
         copy_bin_and_libs ${pkgs.cifs-utils}/sbin/mount.cifs
       '';
diff --git a/nixos/modules/tasks/filesystems/ext.nix b/nixos/modules/tasks/filesystems/ext.nix
index a14a3ac38549..9b61f21643ab 100644
--- a/nixos/modules/tasks/filesystems/ext.nix
+++ b/nixos/modules/tasks/filesystems/ext.nix
@@ -1,14 +1,20 @@
-{ pkgs, ... }:
+{ config, lib, pkgs, ... }:
+
+let
+
+  inInitrd = lib.any (fs: fs == "ext2" || fs == "ext3" || fs == "ext4") config.boot.initrd.supportedFilesystems;
+
+in
 
 {
   config = {
 
-    system.fsPackages = [ pkgs.e2fsprogs ];
+    system.fsPackages = lib.mkIf (config.boot.initrd.systemd.enable -> inInitrd) [ pkgs.e2fsprogs ];
 
     # As of kernel 4.3, there is no separate ext3 driver (they're also handled by ext4.ko)
-    boot.initrd.availableKernelModules = [ "ext2" "ext4" ];
+    boot.initrd.availableKernelModules = lib.mkIf (config.boot.initrd.systemd.enable -> inInitrd) [ "ext2" "ext4" ];
 
-    boot.initrd.extraUtilsCommands =
+    boot.initrd.extraUtilsCommands = lib.mkIf (!config.boot.initrd.systemd.enable)
       ''
         # Copy e2fsck and friends.
         copy_bin_and_libs ${pkgs.e2fsprogs}/sbin/e2fsck
diff --git a/nixos/modules/tasks/filesystems/f2fs.nix b/nixos/modules/tasks/filesystems/f2fs.nix
index a305235979a2..1d52861aa39d 100644
--- a/nixos/modules/tasks/filesystems/f2fs.nix
+++ b/nixos/modules/tasks/filesystems/f2fs.nix
@@ -13,7 +13,7 @@ in
 
     boot.initrd.availableKernelModules = mkIf inInitrd [ "f2fs" "crc32" ];
 
-    boot.initrd.extraUtilsCommands = mkIf inInitrd ''
+    boot.initrd.extraUtilsCommands = mkIf (inInitrd && !config.boot.initrd.systemd.enable) ''
       copy_bin_and_libs ${pkgs.f2fs-tools}/sbin/fsck.f2fs
       ${optionalString (any (fs: fs.autoResize) fileSystems) ''
         # We need f2fs-tools' tools to resize filesystems
diff --git a/nixos/modules/tasks/filesystems/jfs.nix b/nixos/modules/tasks/filesystems/jfs.nix
index fc3905c7dc20..700f05af2bec 100644
--- a/nixos/modules/tasks/filesystems/jfs.nix
+++ b/nixos/modules/tasks/filesystems/jfs.nix
@@ -12,7 +12,7 @@ in
 
     boot.initrd.kernelModules = mkIf inInitrd [ "jfs" ];
 
-    boot.initrd.extraUtilsCommands = mkIf inInitrd ''
+    boot.initrd.extraUtilsCommands = mkIf (inInitrd && !boot.initrd.systemd.enable) ''
       copy_bin_and_libs ${pkgs.jfsutils}/sbin/fsck.jfs
     '';
   };
diff --git a/nixos/modules/tasks/filesystems/reiserfs.nix b/nixos/modules/tasks/filesystems/reiserfs.nix
index ab4c43e2ab82..7b017a83db84 100644
--- a/nixos/modules/tasks/filesystems/reiserfs.nix
+++ b/nixos/modules/tasks/filesystems/reiserfs.nix
@@ -15,7 +15,7 @@ in
 
     boot.initrd.kernelModules = mkIf inInitrd [ "reiserfs" ];
 
-    boot.initrd.extraUtilsCommands = mkIf inInitrd
+    boot.initrd.extraUtilsCommands = mkIf (inInitrd && !config.boot.initrd.systemd.enable)
       ''
         copy_bin_and_libs ${pkgs.reiserfsprogs}/sbin/reiserfsck
         ln -s reiserfsck $out/bin/fsck.reiserfs
diff --git a/nixos/modules/tasks/filesystems/unionfs-fuse.nix b/nixos/modules/tasks/filesystems/unionfs-fuse.nix
index f54f3559c341..f9954b5182f9 100644
--- a/nixos/modules/tasks/filesystems/unionfs-fuse.nix
+++ b/nixos/modules/tasks/filesystems/unionfs-fuse.nix
@@ -6,7 +6,7 @@
     (lib.mkIf (lib.any (fs: fs == "unionfs-fuse") config.boot.initrd.supportedFilesystems) {
       boot.initrd.kernelModules = [ "fuse" ];
 
-      boot.initrd.extraUtilsCommands = ''
+      boot.initrd.extraUtilsCommands = lib.mkIf (!config.boot.initrd.systemd.enable) ''
         copy_bin_and_libs ${pkgs.fuse}/sbin/mount.fuse
         copy_bin_and_libs ${pkgs.unionfs-fuse}/bin/unionfs
         substitute ${pkgs.unionfs-fuse}/sbin/mount.unionfs-fuse $out/bin/mount.unionfs-fuse \
@@ -16,12 +16,23 @@
         chmod +x $out/bin/mount.unionfs-fuse
       '';
 
-      boot.initrd.postDeviceCommands = ''
+      boot.initrd.postDeviceCommands = lib.mkIf (!config.boot.initrd.systemd.enable) ''
           # Hacky!!! fuse hard-codes the path to mount
           mkdir -p /nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-${pkgs.util-linux.name}-bin/bin
           ln -s $(which mount) /nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-${pkgs.util-linux.name}-bin/bin
           ln -s $(which umount) /nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-${pkgs.util-linux.name}-bin/bin
         '';
+
+      boot.initrd.systemd.extraBin = {
+        "mount.fuse" = "${pkgs.fuse}/bin/mount.fuse";
+        "unionfs" = "${pkgs.unionfs-fuse}/bin/unionfs";
+        "mount.unionfs-fuse" = pkgs.runCommand "mount.unionfs-fuse" {} ''
+          substitute ${pkgs.unionfs-fuse}/sbin/mount.unionfs-fuse $out \
+            --replace '${pkgs.bash}/bin/bash' /bin/sh \
+            --replace '${pkgs.fuse}/sbin' /bin \
+            --replace '${pkgs.unionfs-fuse}/bin' /bin
+        '';
+      };
     })
 
     (lib.mkIf (lib.any (fs: fs == "unionfs-fuse") config.boot.supportedFilesystems) {
diff --git a/nixos/modules/tasks/filesystems/vfat.nix b/nixos/modules/tasks/filesystems/vfat.nix
index 958e27ae8a32..5baab1c802cf 100644
--- a/nixos/modules/tasks/filesystems/vfat.nix
+++ b/nixos/modules/tasks/filesystems/vfat.nix
@@ -15,7 +15,7 @@ in
 
     boot.initrd.kernelModules = mkIf inInitrd [ "vfat" "nls_cp437" "nls_iso8859-1" ];
 
-    boot.initrd.extraUtilsCommands = mkIf inInitrd
+    boot.initrd.extraUtilsCommands = mkIf (inInitrd && !config.boot.initrd.systemd.enable)
       ''
         copy_bin_and_libs ${pkgs.dosfstools}/sbin/dosfsck
         ln -sv dosfsck $out/bin/fsck.vfat
diff --git a/nixos/modules/tasks/filesystems/xfs.nix b/nixos/modules/tasks/filesystems/xfs.nix
index 98038701ca58..80e46efcc780 100644
--- a/nixos/modules/tasks/filesystems/xfs.nix
+++ b/nixos/modules/tasks/filesystems/xfs.nix
@@ -15,14 +15,14 @@ in
 
     boot.initrd.availableKernelModules = mkIf inInitrd [ "xfs" "crc32c" ];
 
-    boot.initrd.extraUtilsCommands = mkIf inInitrd
+    boot.initrd.extraUtilsCommands = mkIf (inInitrd && !boot.initrd.systemd.enable)
       ''
         copy_bin_and_libs ${pkgs.xfsprogs.bin}/bin/fsck.xfs
         copy_bin_and_libs ${pkgs.xfsprogs.bin}/bin/xfs_repair
       '';
 
     # Trick just to set 'sh' after the extraUtils nuke-refs.
-    boot.initrd.extraUtilsCommandsTest = mkIf inInitrd
+    boot.initrd.extraUtilsCommandsTest = mkIf (inInitrd && !boot.initrd.systemd.enable)
       ''
         sed -i -e 's,^#!.*,#!'$out/bin/sh, $out/bin/fsck.xfs
       '';
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 5158bc681e08..ad426fcf4e0a 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -524,6 +524,7 @@ in
   systemd-confinement = handleTest ./systemd-confinement.nix {};
   systemd-cryptenroll = handleTest ./systemd-cryptenroll.nix {};
   systemd-escaping = handleTest ./systemd-escaping.nix {};
+  systemd-initrd-btrfs-raid = handleTest ./systemd-initrd-btrfs-raid.nix {};
   systemd-initrd-luks-keyfile = handleTest ./systemd-initrd-luks-keyfile.nix {};
   systemd-initrd-luks-password = handleTest ./systemd-initrd-luks-password.nix {};
   systemd-initrd-shutdown = handleTest ./systemd-shutdown.nix { systemdStage1 = true; };
diff --git a/nixos/tests/systemd-initrd-btrfs-raid.nix b/nixos/tests/systemd-initrd-btrfs-raid.nix
new file mode 100644
index 000000000000..40fd2d4dc611
--- /dev/null
+++ b/nixos/tests/systemd-initrd-btrfs-raid.nix
@@ -0,0 +1,45 @@
+import ./make-test-python.nix ({ lib, pkgs, ... }: {
+  name = "systemd-initrd-btrfs-raid";
+
+  nodes.machine = { pkgs, ... }: {
+    # Use systemd-boot
+    virtualisation = {
+      emptyDiskImages = [ 512 512 ];
+      useBootLoader = true;
+      useEFIBoot = true;
+    };
+    boot.loader.systemd-boot.enable = true;
+    boot.loader.efi.canTouchEfiVariables = true;
+
+    environment.systemPackages = with pkgs; [ btrfs-progs ];
+    boot.initrd.systemd = {
+      enable = true;
+      emergencyAccess = true;
+    };
+
+    specialisation.boot-btrfs-raid.configuration = {
+      fileSystems = lib.mkVMOverride {
+        "/".fsType = lib.mkForce "btrfs";
+      };
+      virtualisation.bootDevice = "/dev/vdc";
+    };
+  };
+
+  testScript = ''
+    # Create RAID
+    machine.succeed("mkfs.btrfs -d raid0 /dev/vdc /dev/vdd")
+    machine.succeed("mkdir -p /mnt && mount /dev/vdc /mnt && echo hello > /mnt/test && umount /mnt")
+
+    # Boot from the RAID
+    machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-btrfs-raid.conf")
+    machine.succeed("sync")
+    machine.crash()
+    machine.wait_for_unit("multi-user.target")
+
+    # Ensure we have successfully booted from the RAID
+    assert "(initrd)" in machine.succeed("systemd-analyze")  # booted with systemd in stage 1
+    assert "/dev/vdc on / type btrfs" in machine.succeed("mount")
+    assert "hello" in machine.succeed("cat /test")
+    assert "Total devices 2" in machine.succeed("btrfs filesystem show")
+  '';
+})
diff --git a/pkgs/applications/audio/ChowPhaser/default.nix b/pkgs/applications/audio/ChowPhaser/default.nix
new file mode 100644
index 000000000000..a828a1e1d041
--- /dev/null
+++ b/pkgs/applications/audio/ChowPhaser/default.nix
@@ -0,0 +1,76 @@
+{ alsa-lib, at-spi2-core, cmake, curl, dbus, libepoxy, fetchFromGitHub, freeglut
+, freetype, gcc-unwrapped, gtk3, lib, libGL, libXcursor, libXdmcp, libXext
+, libXinerama, libXrandr, libXtst, libdatrie, libjack2, libpsl, libselinux
+, libsepol, libsysprof-capture, libthai, libxkbcommon, pcre, pkg-config
+, python3, sqlite, stdenv }:
+
+stdenv.mkDerivation rec {
+  pname = "ChowPhaser";
+  version = "1.1.1";
+
+  src = fetchFromGitHub {
+    owner = "jatinchowdhury18";
+    repo = "ChowPhaser";
+    rev = "v${version}";
+    fetchSubmodules = true;
+    sha256 = "sha256-9wo7ZFMruG3QNvlpILSvrFh/Sx6J1qnlWc8+aQyS4tQ=";
+  };
+
+  nativeBuildInputs = [ pkg-config cmake ];
+
+  buildInputs = [
+    alsa-lib
+    at-spi2-core
+    curl
+    dbus
+    libepoxy
+    freeglut
+    freetype
+    gtk3
+    libGL
+    libXcursor
+    libXdmcp
+    libXext
+    libXinerama
+    libXrandr
+    libXtst
+    libdatrie
+    libjack2
+    libpsl
+    libselinux
+    libsepol
+    libsysprof-capture
+    libthai
+    libxkbcommon
+    pcre
+    python3
+    sqlite
+    gcc-unwrapped
+  ];
+
+  cmakeFlags = [
+    "-DCMAKE_AR=${gcc-unwrapped}/bin/gcc-ar"
+    "-DCMAKE_RANLIB=${gcc-unwrapped}/bin/gcc-ranlib"
+    "-DCMAKE_NM=${gcc-unwrapped}/bin/gcc-nm"
+  ];
+
+  installPhase = ''
+    mkdir -p $out/lib/lv2 $out/lib/vst3 $out/bin $out/share/doc/ChowPhaser/
+    cd ChowPhaserMono_artefacts/Release
+    cp libChowPhaserMono_SharedCode.a  $out/lib
+    cp -r VST3/ChowPhaserMono.vst3 $out/lib/vst3
+    cp Standalone/ChowPhaserMono  $out/bin
+    cd ../../ChowPhaserStereo_artefacts/Release
+    cp libChowPhaserStereo_SharedCode.a  $out/lib
+    cp -r VST3/ChowPhaserStereo.vst3 $out/lib/vst3
+    cp Standalone/ChowPhaserStereo  $out/bin
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/jatinchowdhury18/ChowPhaser";
+    description = "Phaser effect based loosely on the Schulte Compact Phasing 'A'";
+    license = with licenses; [ bsd3 ];
+    maintainers = with maintainers; [ magnetophon ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/applications/audio/shortwave/default.nix b/pkgs/applications/audio/shortwave/default.nix
index 49492d05d15f..4642565e678e 100644
--- a/pkgs/applications/audio/shortwave/default.nix
+++ b/pkgs/applications/audio/shortwave/default.nix
@@ -14,28 +14,29 @@
 , ninja
 , openssl
 , pkg-config
-, python3
 , rustPlatform
 , sqlite
-, wrapGAppsHook
+, wrapGAppsHook4
+, cmake
+, libshumate
 }:
 
 stdenv.mkDerivation rec {
   pname = "shortwave";
-  version = "2.0.1";
+  version = "3.0.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = "Shortwave";
     rev = version;
-    sha256 = "sha256-25qPb7qlqCwYJzl4qZxAZYx5asxSlXBlc/0dGyBdk1o=";
+    sha256 = "sha256-qwk63o9pfqpAm6l9ioj3RccacemQU8R6LF6El4yHkjQ";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-00dQXcSNmdZb2nSLG3q7jm4sugF9XR4LbH0OmcuHVxA=";
+    hash = "sha256-YrB322nv9CgZqt5//VMvVwjWA51ePlX2PI6raRJGBxA=";
   };
 
   nativeBuildInputs = [
@@ -46,11 +47,11 @@ stdenv.mkDerivation rec {
     meson
     ninja
     pkg-config
-    python3
     rustPlatform.rust.cargo
     rustPlatform.cargoSetupHook
     rustPlatform.rust.rustc
-    wrapGAppsHook
+    wrapGAppsHook4
+    cmake
   ];
 
   buildInputs = [
@@ -61,6 +62,7 @@ stdenv.mkDerivation rec {
     libadwaita
     openssl
     sqlite
+    libshumate
   ] ++ (with gst_all_1; [
     gstreamer
     gst-plugins-base
@@ -68,10 +70,6 @@ stdenv.mkDerivation rec {
     gst-plugins-bad
   ]);
 
-  postPatch = ''
-    patchShebangs build-aux/meson/postinstall.py
-  '';
-
   meta = with lib; {
     homepage = "https://gitlab.gnome.org/World/Shortwave";
     description = "Find and listen to internet radio stations";
@@ -80,7 +78,6 @@ stdenv.mkDerivation rec {
       desktop. It is the successor to the older Gradio application.
     '';
     maintainers = with maintainers; [ lasandell ];
-    broken = true; # incompatible with latest libadwaita
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
   };
diff --git a/pkgs/applications/editors/lapce/default.nix b/pkgs/applications/editors/lapce/default.nix
index 2da2a1f46773..d13b4c05302d 100644
--- a/pkgs/applications/editors/lapce/default.nix
+++ b/pkgs/applications/editors/lapce/default.nix
@@ -17,6 +17,13 @@
 , vulkan-loader
 , copyDesktopItems
 , makeDesktopItem
+, openssl
+, libobjc
+, Security
+, CoreServices
+, ApplicationServices
+, Carbon
+, AppKit
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -40,7 +47,12 @@ rustPlatform.buildRustPackage rec {
     copyDesktopItems
   ];
 
+  # Get openssl-sys to use pkg-config
+  OPENSSL_NO_VENDOR = 1;
+
   buildInputs = [
+    openssl
+  ] ++ lib.optionals stdenv.isLinux [
     freetype
     fontconfig
     libxkbcommon
@@ -50,10 +62,17 @@ rustPlatform.buildRustPackage rec {
     libXrandr
     libXi
     vulkan-loader
+  ] ++ lib.optionals stdenv.isDarwin [
+    libobjc
+    Security
+    CoreServices
+    ApplicationServices
+    Carbon
+    AppKit
   ];
 
   # Add missing vulkan dependency to rpath
-  preFixup = ''
+  preFixup = lib.optionalString stdenv.isLinux ''
     patchelf --add-needed ${vulkan-loader}/lib/libvulkan.so.1 $out/bin/lapce
   '';
 
@@ -76,6 +95,5 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/lapce/lapce";
     license = with licenses; [ asl20 ];
     maintainers = with maintainers; [ elliot ];
-    broken = stdenv.isDarwin;
   };
 }
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 125751b5a7f0..fe769c649231 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -554,8 +554,8 @@ let
         mktplcRef = {
           name = "vscode-markdownlint";
           publisher = "DavidAnson";
-          version = "0.46.0";
-          sha256 = "sha256-2FvE+6fnZPtR0At4NjLKSMCbPu8T7o8xtpvYiEjh7ck=";
+          version = "0.47.0";
+          sha256 = "sha256-KtDJo8rhQXkZtJz93E+J7eNiAIcLk4e5qKDLoR3DoGw=";
         };
         meta = with lib; {
           changelog = "https://marketplace.visualstudio.com/items/DavidAnson.vscode-markdownlint/changelog";
@@ -698,8 +698,8 @@ let
         mktplcRef = {
           name = "gitlens";
           publisher = "eamodio";
-          version = "12.0.3";
-          sha256 = "sha256-PHQXfk0JggkEBRflHp+OAUOCVuymCubaszfDCYbpfG0=";
+          version = "12.0.6";
+          sha256 = "sha256-Q8l/GryB9iMhFnu5npUcDjWuImfrmVZF3xvm7nX/77Q=";
         };
         meta = with lib; {
           changelog = "https://marketplace.visualstudio.com/items/eamodio.gitlens/changelog";
@@ -790,8 +790,8 @@ let
         mktplcRef = {
           name = "prettier-vscode";
           publisher = "esbenp";
-          version = "9.3.0";
-          sha256 = "sha256-hJgPjWf7a8+ltjmXTK8U/MwqgIZqBjmcCfHsAk2G3PA=";
+          version = "9.5.0";
+          sha256 = "sha256-L/jW6xAnJ8v9Qq+iyQI8usGr8BoICR+2ENAMGQ05r0A=";
         };
         meta = with lib; {
           changelog = "https://marketplace.visualstudio.com/items/esbenp.prettier-vscode/changelog";
@@ -1242,8 +1242,8 @@ let
         mktplcRef = {
           name = "vscode-peacock";
           publisher = "johnpapa";
-          version = "4.0.0";
-          sha256 = "1i65w70f0kikah1cx7m0bji6qd800jabfci0xisdqxyzaksg7ysz";
+          version = "4.0.1";
+          sha256 = "sha256-oYXYOamwacgRqv3+ZREJ1vqRlwMz8LpO+wa6CVEEdbI=";
         };
         meta = with lib; {
           license = licenses.mit;
@@ -1466,8 +1466,8 @@ let
         mktplcRef = {
           name = "vscode-docker";
           publisher = "ms-azuretools";
-          version = "1.20.0";
-          sha256 = "sha256-i3gYTP76YEDItG2oXR9pEXuGv0qmyf1Xv6HQvDBEOyg=";
+          version = "1.22.0";
+          sha256 = "sha256-+cY9uLQ4oIk7V/4uCNc6BdIAQCXvPPGeqd0apbDjDos=";
         };
         meta = {
           license = lib.licenses.mit;
@@ -1699,8 +1699,8 @@ let
         mktplcRef = {
           name = "material-icon-theme";
           publisher = "PKief";
-          version = "4.14.1";
-          sha256 = "sha256-OHXi0EfeyKMeFiMU5yg0aDoWds4ED0lb+l6T12XZ3LQ=";
+          version = "4.16.0";
+          sha256 = "sha256-AOHvWoVB26caNgEEnKBhw5Z/tRtaTSeVLkO6Rlc/kqo=";
         };
         meta = {
           license = lib.licenses.mit;
diff --git a/pkgs/applications/misc/archivy/default.nix b/pkgs/applications/misc/archivy/default.nix
index 2f07b6dbf959..e7146052702b 100644
--- a/pkgs/applications/misc/archivy/default.nix
+++ b/pkgs/applications/misc/archivy/default.nix
@@ -1,4 +1,8 @@
-{ lib, stdenv, python3, fetchPypi }:
+{ lib
+, stdenv
+, python3
+, fetchPypi
+}:
 
 let
   defaultOverrides = [
@@ -37,11 +41,12 @@ with py.pkgs;
 
 buildPythonApplication rec {
   pname = "archivy";
-  version = "1.7.1";
+  version = "1.7.2";
+  format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-UNGl5Dl/E3+uQ4HIxzHYliHF4lqD3GYdeoL+DtqUwCo=";
+    hash = "sha256-o5dVJDbdKgo6hMMU9mKzoouSgVWl7xSAp+Aq61VcfeU=";
   };
 
   # Relax some dependencies
@@ -54,6 +59,7 @@ buildPythonApplication rec {
       --replace 'python_frontmatter == 0.5.0' 'python_frontmatter' \
       --replace 'requests ==' 'requests >=' \
       --replace 'validators ==' 'validators >=' \
+      --replace 'flask-login == ' 'flask-login >= ' \
       --replace 'tinydb ==' 'tinydb >=' \
       --replace 'Flask_WTF == 0.14.3' 'Flask_WTF' \
       --replace 'Flask ==' 'Flask >='
diff --git a/pkgs/applications/misc/dasel/default.nix b/pkgs/applications/misc/dasel/default.nix
index 317613ffd533..7506f57e73fa 100644
--- a/pkgs/applications/misc/dasel/default.nix
+++ b/pkgs/applications/misc/dasel/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "dasel";
-  version = "1.24.1";
+  version = "1.24.3";
 
   src = fetchFromGitHub {
     owner = "TomWright";
     repo = "dasel";
     rev = "v${version}";
-    sha256 = "sha256-B6MWoGYNjFBUxnSqAXt2DRRjSlmgbqIC7qEoMFGQ+zU=";
+    sha256 = "sha256-aAP5hyo4t5IX4wLwyNDuXxAYbAkS36S1UewYs9ZFJM4=";
   };
 
-  vendorSha256 = "sha256-NP+Is7Dxz4LGzx5vpv8pJOJhodAYHia1JXYfhJD54as=";
+  vendorSha256 = "sha256-zli9SEBU6n0JusAquqb9+O2W4yPZS7zmC5PCebVSeIA=";
 
   ldflags = [
     "-s" "-w" "-X github.com/tomwright/dasel/internal.Version=${version}"
diff --git a/pkgs/applications/misc/nut/default.nix b/pkgs/applications/misc/nut/default.nix
index 41f46ff1c003..e0e196ac1432 100644
--- a/pkgs/applications/misc/nut/default.nix
+++ b/pkgs/applications/misc/nut/default.nix
@@ -36,6 +36,8 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  NIX_CFLAGS_COMPILE = [ "-std=c++14" ];
+
   postInstall = ''
     wrapProgram $out/bin/nut-scanner --prefix LD_LIBRARY_PATH : \
       "$out/lib:${neon}/lib:${libusb-compat-0_1.out}/lib:${avahi}/lib:${freeipmi}/lib"
diff --git a/pkgs/applications/networking/cluster/helm/default.nix b/pkgs/applications/networking/cluster/helm/default.nix
index 408f1bd3ed8a..b6f9028d52ab 100644
--- a/pkgs/applications/networking/cluster/helm/default.nix
+++ b/pkgs/applications/networking/cluster/helm/default.nix
@@ -1,19 +1,17 @@
-{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
+{ lib, stdenv, buildGoModule, fetchFromGitHub, installShellFiles }:
 
 buildGoModule rec {
-  pname = "helm";
-  version = "3.8.1";
-  gitCommit = "5cb9af4b1b271d11d7a97a71df3ac337dd94ad37";
+  pname = "kubernetes-helm";
+  version = "3.8.2";
+  gitCommit = "6e3701edea09e5d55a8ca2aae03a68917630e91b";
 
   src = fetchFromGitHub {
     owner = "helm";
     repo = "helm";
     rev = "v${version}";
-    sha256 = "sha256-AjNrn46l9gVC7MtGF59QWv+l6qYn+jzopsZtM/2faXY=";
+    sha256 = "sha256-lFAzp7ZxyMZAEO1cNFkEPLgTLEGa6azv36xiTIz4FZY=";
   };
-  vendorSha256 = "sha256-ffbp7J8XDxo/s79pjoiDVbft0pr/lJpuJuKiMpQwkT0=";
-
-  doCheck = false;
+  vendorSha256 = "sha256-FLEydmR+UEZ80VYLxBU1ZdwpdLgTjUpqiMItnt9UuLY=";
 
   subPackages = [ "cmd/helm" ];
   ldflags = [
@@ -23,6 +21,19 @@ buildGoModule rec {
     "-X helm.sh/helm/v3/internal/version.gitCommit=${gitCommit}"
   ];
 
+  preCheck = ''
+    # skipping version tests because they require dot git directory
+    substituteInPlace cmd/helm/version_test.go \
+      --replace "TestVersion" "SkipVersion"
+  '' + lib.optionalString stdenv.isLinux ''
+    # skipping plugin tests on linux
+    substituteInPlace cmd/helm/plugin_test.go \
+      --replace "TestPluginDynamicCompletion" "SkipPluginDynamicCompletion" \
+      --replace "TestLoadPlugins" "SkipLoadPlugins"
+    substituteInPlace cmd/helm/helm_test.go \
+      --replace "TestPluginExitCode" "SkipPluginExitCode"
+  '';
+
   nativeBuildInputs = [ installShellFiles ];
   postInstall = ''
     $out/bin/helm completion bash > helm.bash
@@ -33,7 +44,8 @@ buildGoModule rec {
   meta = with lib; {
     homepage = "https://github.com/kubernetes/helm";
     description = "A package manager for kubernetes";
+    mainProgram = "helm";
     license = licenses.asl20;
-    maintainers = with maintainers; [ rlupton20 edude03 saschagrunert Frostman Chili-Man ];
+    maintainers = with maintainers; [ rlupton20 edude03 saschagrunert Frostman Chili-Man techknowlogick ];
   };
 }
diff --git a/pkgs/applications/networking/instant-messengers/jitsi-meet-electron/default.nix b/pkgs/applications/networking/instant-messengers/jitsi-meet-electron/default.nix
index 2395a196f605..7dce1fd069d1 100644
--- a/pkgs/applications/networking/instant-messengers/jitsi-meet-electron/default.nix
+++ b/pkgs/applications/networking/instant-messengers/jitsi-meet-electron/default.nix
@@ -46,7 +46,8 @@ stdenv.mkDerivation rec {
   postFixup = ''
     makeWrapper ${electron}/bin/electron $out/bin/${pname} \
       --add-flags $out/share/${pname}/resources/app.asar \
-      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ stdenv.cc.cc xorg.libXtst pipewire ]}"
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ stdenv.cc.cc xorg.libXtst pipewire ]}" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform --ozone-platform=wayland}}"
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/version-management/git-and-tools/git-machete/default.nix b/pkgs/applications/version-management/git-and-tools/git-machete/default.nix
index bed96493e513..6b6da70bb942 100644
--- a/pkgs/applications/version-management/git-and-tools/git-machete/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-machete/default.nix
@@ -10,13 +10,13 @@
 
 buildPythonApplication rec {
   pname = "git-machete";
-  version = "3.8.0";
+  version = "3.9.0";
 
   src = fetchFromGitHub {
     owner = "virtuslab";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-WVPcyooShgFPZaIfEzV2zUA6tCHhuTM8MbrGVNr0neM=";
+    sha256 = "sha256-AuF4KUayMRQ2TsvjzpMHpppM+0e6igs7MrAXzGP9yp0=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/applications/version-management/git-and-tools/git/default.nix b/pkgs/applications/version-management/git-and-tools/git/default.nix
index 7f63f4bc8ce9..b3e6ea9e0ae0 100644
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@@ -13,7 +13,7 @@
 , pythonSupport ? true
 , withpcre2 ? true
 , sendEmailSupport ? false
-, darwin
+, Security, CoreServices
 , nixosTests
 , withLibsecret ? false
 , pkg-config, glib, libsecret
@@ -79,7 +79,7 @@ stdenv.mkDerivation {
     ++ lib.optionals perlSupport [ perlPackages.perl ]
     ++ lib.optionals guiSupport [tcl tk]
     ++ lib.optionals withpcre2 [ pcre2 ]
-    ++ lib.optionals stdenv.isDarwin [ darwin.Security ]
+    ++ lib.optionals stdenv.isDarwin [ Security CoreServices ]
     ++ lib.optionals withLibsecret [ pkg-config glib libsecret ];
 
   # required to support pthread_cancel()
diff --git a/pkgs/applications/virtualization/docker-slim/default.nix b/pkgs/applications/virtualization/docker-slim/default.nix
index a7261dac6d1f..dbf4bb734d84 100644
--- a/pkgs/applications/virtualization/docker-slim/default.nix
+++ b/pkgs/applications/virtualization/docker-slim/default.nix
@@ -6,7 +6,7 @@
 
 buildGoPackage rec {
   pname = "docker-slim";
-  version = "1.37.5";
+  version = "1.37.6";
 
   goPackagePath = "github.com/docker-slim/docker-slim";
 
@@ -14,7 +14,7 @@ buildGoPackage rec {
     owner = "docker-slim";
     repo = "docker-slim";
     rev = version;
-    sha256 = "sha256-MBs0ybBXsanNFt6R7+ZYvtCh7iHE3FtWXE9uy9tbrE4=";
+    sha256 = "sha256-Jzi6JC6DRklZhNqmFx6eHx6qR8/fb/JuSpgwtPThcc4=";
   };
 
   subPackages = [ "cmd/docker-slim" "cmd/docker-slim-sensor" ];
diff --git a/pkgs/applications/window-managers/phosh/default.nix b/pkgs/applications/window-managers/phosh/default.nix
index 77a65eef6671..6a37809bb5f5 100644
--- a/pkgs/applications/window-managers/phosh/default.nix
+++ b/pkgs/applications/window-managers/phosh/default.nix
@@ -31,7 +31,7 @@
 
 stdenv.mkDerivation rec {
   pname = "phosh";
-  version = "0.16.0";
+  version = "0.17.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
     repo = pname;
     rev = "v${version}";
     fetchSubmodules = true; # including gvc and libcall-ui which are designated as subprojects
-    sha256 = "sha256-nxQYVWUXT1fNgOTRB3iWCLWYI/STk8vtguTbPPNTHdg=";
+    sha256 = "sha256-o/0NJZo1EPpXguN/tkUc+/9XaVTQWaLGe+2pU0B91Cg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/gnome/apps/gnome-music/default.nix b/pkgs/desktops/gnome/apps/gnome-music/default.nix
index 4676710bfc61..8d5f5e5f28dd 100644
--- a/pkgs/desktops/gnome/apps/gnome-music/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-music/default.nix
@@ -8,7 +8,7 @@
 , libxml2
 , python3
 , libnotify
-, wrapGAppsHook
+, wrapGAppsHook4
 , libmediaart
 , gobject-introspection
 , gnome-online-accounts
@@ -30,13 +30,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "gnome-music";
-  version = "42.0";
+  version = "42.1";
 
   format = "other";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "nWgZj5hSveD4NFhLlqgSiX0xDLcXKLak8Ji8spsZxdA=";
+    sha256 = "x3R/pqhrVrGK1v+VD/kB5Z7n+sEcaLKmcnr4bq7tgnA=";
   };
 
   nativeBuildInputs = [
@@ -46,7 +46,7 @@ python3.pkgs.buildPythonApplication rec {
     itstool
     pkg-config
     libxml2
-    wrapGAppsHook
+    wrapGAppsHook4
     desktop-file-utils
     appstream-glib
     gobject-introspection
@@ -60,7 +60,6 @@ python3.pkgs.buildPythonApplication rec {
     gnome-online-accounts
     gobject-introspection
     gdk-pixbuf
-    gnome.adwaita-icon-theme
     python3
     grilo
     grilo-plugins
diff --git a/pkgs/development/libraries/libarchive/default.nix b/pkgs/development/libraries/libarchive/default.nix
index aabb471d9e3d..76e5a32316d8 100644
--- a/pkgs/development/libraries/libarchive/default.nix
+++ b/pkgs/development/libraries/libarchive/default.nix
@@ -45,6 +45,8 @@ stdenv.mkDerivation rec {
       'test_write_disk_perms'
       # can't be sure builder will have sparse-capable fs
       'test_sparse_basic'
+      # can't even be sure builder will have hardlink-capable fs
+      'test_write_disk_hardlink'
     )
 
     for test_name in "''${skip_tests[@]}" ; do
diff --git a/pkgs/development/libraries/libnftnl/default.nix b/pkgs/development/libraries/libnftnl/default.nix
index 2c351181ee22..66134eaffe09 100644
--- a/pkgs/development/libraries/libnftnl/default.nix
+++ b/pkgs/development/libraries/libnftnl/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "A userspace library providing a low-level netlink API to the in-kernel nf_tables subsystem";
-    homepage = "http://netfilter.org/projects/libnftnl";
+    homepage = "https://netfilter.org/projects/libnftnl/";
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
     maintainers = with maintainers; [ fpletz ajs124 ];
diff --git a/pkgs/development/python-modules/deezer-python/default.nix b/pkgs/development/python-modules/deezer-python/default.nix
index a694bd2882d0..b8ad686120ac 100644
--- a/pkgs/development/python-modules/deezer-python/default.nix
+++ b/pkgs/development/python-modules/deezer-python/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "deezer-python";
-  version = "5.3.0";
+  version = "5.3.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "browniebroke";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-Y3nn7q6wGBqWN2JxfpGYd/KDxW5yeuwkos0w1AENkJA=";
+    sha256 = "sha256-x1iZP+dGHeWwIr/AwQr1rYSFECtM6iDXEq9DrGH5J+s=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/dropbox/default.nix b/pkgs/development/python-modules/dropbox/default.nix
index eea638156e8e..efce258451ff 100644
--- a/pkgs/development/python-modules/dropbox/default.nix
+++ b/pkgs/development/python-modules/dropbox/default.nix
@@ -1,12 +1,13 @@
 { lib
 , buildPythonPackage
+, pythonOlder
 , fetchFromGitHub
 , requests
-, urllib3
-, mock
-, setuptools
+, six
 , stone
-, pythonOlder
+, mock
+, pytest-mock
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -20,29 +21,54 @@ buildPythonPackage rec {
     owner = "dropbox";
     repo = "dropbox-sdk-python";
     rev = "v${version}";
-    sha256 = "sha256-pq/LkyOCS0PnujfN9aIx42aeZ8tw4XvRQ4Vid/nXgWE=";
+    hash = "sha256-w07r95MBAClf0F3SICiZsHLdslzf+JuxC+BVdTACCog=";
   };
 
   propagatedBuildInputs = [
     requests
-    urllib3
-    mock
-    setuptools
+    six
     stone
   ];
 
+  checkInputs = [
+    mock
+    pytest-mock
+    pytestCheckHook
+  ];
+
   postPatch = ''
     substituteInPlace setup.py \
       --replace "'pytest-runner == 5.2.0'," ""
   '';
 
-  # Set DROPBOX_TOKEN environment variable to a valid token.
-  doCheck = false;
+  doCheck = true;
 
   pythonImportsCheck = [
     "dropbox"
   ];
 
+  # Set SCOPED_USER_DROPBOX_TOKEN environment variable to a valid value.
+  disabledTests = [
+    "test_default_oauth2_urls"
+    "test_bad_auth"
+    "test_multi_auth"
+    "test_refresh"
+    "test_app_auth"
+    "test_downscope"
+    "test_rpc"
+    "test_upload_download"
+    "test_bad_upload_types"
+    "test_clone_when_user_linked"
+    "test_with_path_root_constructor"
+    "test_path_root"
+    "test_path_root_err"
+    "test_versioned_route"
+    "test_team"
+    "test_as_user"
+    "test_as_admin"
+    "test_clone_when_team_linked"
+  ];
+
   meta = with lib; {
     description = "Python library for Dropbox's HTTP-based Core and Datastore APIs";
     homepage = "https://github.com/dropbox/dropbox-sdk-python";
diff --git a/pkgs/development/python-modules/flake8-bugbear/default.nix b/pkgs/development/python-modules/flake8-bugbear/default.nix
index ef014011bdff..a2fb820c1e5f 100644
--- a/pkgs/development/python-modules/flake8-bugbear/default.nix
+++ b/pkgs/development/python-modules/flake8-bugbear/default.nix
@@ -4,19 +4,23 @@
 , attrs
 , flake8
 , pytestCheckHook
+, pythonOlder
 , hypothesis
 , hypothesmith
 }:
 
 buildPythonPackage rec {
   pname = "flake8-bugbear";
-  version = "22.3.23";
+  version = "22.4.25";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "PyCQA";
     repo = pname;
-    rev = version;
-    sha256 = "sha256-s1EnPM2He+R+vafu14XI1Xuft8Rg6W3vPH2Atc6N7I0=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-y/hpBlIQ3aJj3Y1snpArOCIv2w1ncQNMSYJ+G0CeM84=";
   };
 
   propagatedBuildInputs = [
@@ -32,9 +36,10 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
+    description = "Plugin for Flake8 to find bugs and design problems";
     homepage = "https://github.com/PyCQA/flake8-bugbear";
     changelog = "https://github.com/PyCQA/flake8-bugbear/blob/${version}/README.rst#change-log";
-    description = ''
+    longDescription = ''
       A plugin for flake8 finding likely bugs and design problems in your
       program.
     '';
diff --git a/pkgs/development/python-modules/hkavr/default.nix b/pkgs/development/python-modules/hkavr/default.nix
new file mode 100644
index 000000000000..851150ea1dd8
--- /dev/null
+++ b/pkgs/development/python-modules/hkavr/default.nix
@@ -0,0 +1,37 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+, requests
+}:
+
+buildPythonPackage rec {
+  pname = "hkavr";
+  version = "0.0.5";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-wa0yS0KPdrQUuxxViweESD6Itn2rFlTwwrPQ0COWIPc=";
+  };
+
+  propagatedBuildInputs = [
+    requests
+  ];
+
+  # Module has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "hkavr"
+  ];
+
+  meta = with lib; {
+    description = "Library for interacting with Harman Kardon AVR controllers";
+    homepage = "https://github.com/Devqon/hkavr";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/neo4j-driver/default.nix b/pkgs/development/python-modules/neo4j-driver/default.nix
index 63a2efafbd6e..c86ae1b00c4f 100644
--- a/pkgs/development/python-modules/neo4j-driver/default.nix
+++ b/pkgs/development/python-modules/neo4j-driver/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "neo4j-driver";
-  version = "4.4.2";
+  version = "4.4.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "neo4j";
     repo = "neo4j-python-driver";
     rev = version;
-    sha256 = "sha256-rYedmxQvT+RjVdbDckLv00J4YuEQtMuIc8Q5FGWr3Rw=";
+    sha256 = "sha256-YApj4EA0e3Q9V+ujnJC7/eSS0DybnZH22LnnSla/mw4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/openai/default.nix b/pkgs/development/python-modules/openai/default.nix
index ff0f47965875..b137050ebff8 100644
--- a/pkgs/development/python-modules/openai/default.nix
+++ b/pkgs/development/python-modules/openai/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "openai";
-  version = "0.18.0";
+  version = "0.18.1";
 
   disabled = pythonOlder "3.7.1";
 
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "openai";
     repo = "openai-python";
     rev = "v${version}";
-    sha256 = "sha256-MC3xTiQJrUyfRbnv7jigIal3/paK08bzy+mJI/j7fxo=";
+    sha256 = "sha256-ii/w29aRGhuzR6E+kbknsSrVZlOurpy/tTVGeAYKkXo=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pencompy/default.nix b/pkgs/development/python-modules/pencompy/default.nix
new file mode 100644
index 000000000000..b2648e36e5a1
--- /dev/null
+++ b/pkgs/development/python-modules/pencompy/default.nix
@@ -0,0 +1,32 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "pencompy";
+  version = "0.0.4";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-PjALTsk0Msv3g8M6k0v6ftzDAuFKyIPSpfvT8S3YL48=";
+  };
+
+  # Module has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "pencompy"
+  ];
+
+  meta = with lib; {
+    description = "Library for interacting with Pencom relay boards";
+    homepage = "https://github.com/dubnom/pencompy";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/pyoppleio/default.nix b/pkgs/development/python-modules/pyoppleio/default.nix
new file mode 100644
index 000000000000..2503eb5d001f
--- /dev/null
+++ b/pkgs/development/python-modules/pyoppleio/default.nix
@@ -0,0 +1,37 @@
+{ lib
+, buildPythonPackage
+, crc16
+, fetchPypi
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "pyoppleio";
+  version = "1.0.6";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-q//uJ+2m9S0r+Jsa5Eye90YSw4cKzd04vPHMm89j8kg=";
+  };
+
+  propagatedBuildInputs = [
+    crc16
+  ];
+
+  # Module has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "pyoppleio"
+  ];
+
+  meta = with lib; {
+    description = "Library for interacting with OPPLE lights";
+    homepage = "https://github.com/jedmeng/python-oppleio";
+    license = with licenses; [ asl20 ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/pyrogram/default.nix b/pkgs/development/python-modules/pyrogram/default.nix
index d4d49fd26268..c8f7dccc4f0f 100644
--- a/pkgs/development/python-modules/pyrogram/default.nix
+++ b/pkgs/development/python-modules/pyrogram/default.nix
@@ -1,7 +1,7 @@
 { lib
 , buildPythonPackage
 , pythonOlder
-, fetchPypi
+, fetchFromGitHub
 , pyaes
 , pysocks
 , async-lru
@@ -12,14 +12,15 @@
 
 buildPythonPackage rec {
   pname = "pyrogram";
-  version = "1.4.16";
+  version = "2.0.13";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
-  src = fetchPypi {
-    pname = "Pyrogram";
-    inherit version;
-    hash = "sha256-ZYAPaAa92z3KtciVHOexdZf9bwZjKQ9WKg6+We0dW+Q=";
+  src = fetchFromGitHub {
+    owner = "pyrogram";
+    repo = "pyrogram";
+    rev = "v${version}";
+    hash = "sha256-8mnGfW8/2RbU4gFS8e72KAxMGGkb8XrhsyK01wD97rI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pytest-isort/default.nix b/pkgs/development/python-modules/pytest-isort/default.nix
index c06959b96c41..234742f2e6d7 100644
--- a/pkgs/development/python-modules/pytest-isort/default.nix
+++ b/pkgs/development/python-modules/pytest-isort/default.nix
@@ -1,26 +1,64 @@
-{ lib, buildPythonPackage, fetchPypi, isPy27, mock, pytest, isort }:
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, fetchpatch
+, importlib-metadata
+, isort
+, poetry-core
+, pytest
+, pytestCheckHook
+, pythonOlder
+}:
 
 buildPythonPackage rec {
   pname = "pytest-isort";
   version = "3.0.0";
+  format = "pyproject";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "sha256-T+Sybq0q93ZzDsI/WHDXQh81qs4ipBxOk4WG702Hh8s=";
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "stephrdev";
+    repo = pname;
+    rev = version;
+    hash = "sha256-gbEO3HBDeZ+nUACzpeV6iVuCdNHS5956wFzIYkbam+M=";
   };
 
-  propagatedBuildInputs = [ isort ];
+  nativeBuildInputs = [
+    poetry-core
+  ];
 
-  checkInputs = [ pytest ]
-    ++ lib.optionals isPy27 [ mock ];
+  buildInputs = [
+    pytest
+  ];
 
-  checkPhase = ''
-    py.test -vs --cache-clear
-  '';
+  propagatedBuildInputs = [
+    isort
+  ] ++ lib.optionals (pythonOlder "3.8") [
+    importlib-metadata
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  patches = [
+    # Can be removed with the next release, https://github.com/stephrdev/pytest-isort/pull/44
+    (fetchpatch {
+      name = "switch-to-poetry-core.patch";
+      url = "https://github.com/stephrdev/pytest-isort/commit/f17ed2d294ae90e415d051e1c720982e3dd01bff.patch";
+      sha256 = "sha256-PiOs0c61BNx/tZN11DYblOd7tNzGthNnlkmYMTI9v18=";
+    })
+  ];
+
+  pythonImportsCheck = [
+    "pytest_isort"
+  ];
 
   meta = with lib; {
     description = "Pytest plugin to perform isort checks (import ordering)";
     homepage = "https://github.com/moccu/pytest-isort/";
     license = licenses.bsd3;
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/rjpl/default.nix b/pkgs/development/python-modules/rjpl/default.nix
new file mode 100644
index 000000000000..8d5cfbc92aae
--- /dev/null
+++ b/pkgs/development/python-modules/rjpl/default.nix
@@ -0,0 +1,37 @@
+{ lib
+, buildPythonPackage
+, requests
+, fetchPypi
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "rjpl";
+  version = "0.3.6";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-GLNIpZuM3yuCnPyjBa8KjdaL5cFK8InluuY+LTCrimc=";
+  };
+
+  propagatedBuildInputs = [
+    requests
+  ];
+
+  # Module has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "rjpl"
+  ];
+
+  meta = with lib; {
+    description = "Library for interacting with the Rejseplanen API";
+    homepage = "https://github.com/tomatpasser/python-rejseplanen";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/scikit-learn-extra/default.nix b/pkgs/development/python-modules/scikit-learn-extra/default.nix
index a91f4ed74f17..f198b49c7ad2 100644
--- a/pkgs/development/python-modules/scikit-learn-extra/default.nix
+++ b/pkgs/development/python-modules/scikit-learn-extra/default.nix
@@ -38,6 +38,7 @@ buildPythonPackage rec {
   ];
   disabledTests = [
     "build"   # needs network connection
+    "test_all_estimators" # sklearn.exceptions.NotFittedError: Estimator fails to pass `check_is_fitted` even though it has been fit.
   ];
 
   # Check packages with cythonized modules
diff --git a/pkgs/development/python-modules/seventeentrack/default.nix b/pkgs/development/python-modules/seventeentrack/default.nix
index edce6b728347..8e70b4af51d4 100644
--- a/pkgs/development/python-modules/seventeentrack/default.nix
+++ b/pkgs/development/python-modules/seventeentrack/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "seventeentrack";
-  version = "2022.04.5";
+  version = "2022.04.6";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "McSwindler";
     repo = pname;
     rev = version;
-    hash = "sha256-IaR0Cfs3FL4Vguc2NLdPaunk23zC8B93Iyqe9xY/hWY=";
+    hash = "sha256-vMdRXcd0es/LjgsVyWItSLFzlSTEa3oaA6lr/NL4i8U=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/vivisect/default.nix b/pkgs/development/python-modules/vivisect/default.nix
index ddf6ce54b25e..8eddde2b65b7 100644
--- a/pkgs/development/python-modules/vivisect/default.nix
+++ b/pkgs/development/python-modules/vivisect/default.nix
@@ -2,32 +2,56 @@
 , buildPythonPackage
 , isPy3k
 , fetchPypi
+, wrapQtAppsHook
+
+# propagates
 , pyasn1
 , pyasn1-modules
 , cxxfilt
 , msgpack
 , pycparser
+
+# extras: gui
+, pyqt5
+, pyqtwebengine
+
+# knobs
+, withGui ? false
 }:
+
 buildPythonPackage rec {
   pname = "vivisect";
   version = "1.0.7";
-  disabled = isPy3k;
 
   src = fetchPypi {
     inherit pname version;
     sha256 = "727a27ac1eb95d5a41f4430f6912e79940525551314fe68a2811fc9d51eaf2e9";
   };
 
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace 'cxxfilt>=0.2.1,<0.3.0' 'cxxfilt'
+  '';
+
+  nativeBuildInputs = [
+    wrapQtAppsHook
+  ];
+
   propagatedBuildInputs = [
     pyasn1
     pyasn1-modules
     cxxfilt
     msgpack
     pycparser
+  ] ++ lib.optionals (withGui) passthru.extras-require.gui;
+
+  passthru.extras-require.gui = [
+    pyqt5
+    pyqtwebengine
   ];
 
-  preBuild = ''
-    sed "s@==.*'@'@" -i setup.py
+  postFixup = ''
+    wrapQtApp $out/bin/vivbin
   '';
 
   # requires another repo for test files
diff --git a/pkgs/development/tools/analysis/flow/default.nix b/pkgs/development/tools/analysis/flow/default.nix
index 7d3cdaab0d33..2325ab03c96b 100644
--- a/pkgs/development/tools/analysis/flow/default.nix
+++ b/pkgs/development/tools/analysis/flow/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "flow";
-  version = "0.176.2";
+  version = "0.176.3";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "flow";
     rev = "v${version}";
-    sha256 = "sha256-/4wEafdmrXj4ALUVYx8DM9XyRP/wvbwAl0St1S/+9Ws=";
+    sha256 = "sha256-ZjWIaZ4XT7v66ozjQu+ld0Tz2gVjQFUD6JoL1nW/DmE=";
   };
 
   makeFlags = [ "FLOW_RELEASE=1" ];
diff --git a/pkgs/development/tools/bingo/bingo_version.patch b/pkgs/development/tools/bingo/bingo_version.patch
new file mode 100644
index 000000000000..a3d85df6a9ce
--- /dev/null
+++ b/pkgs/development/tools/bingo/bingo_version.patch
@@ -0,0 +1,13 @@
+diff --git a/pkg/version/version.go b/pkg/version/version.go
+index 30f8f30..11c12a0 100644
+--- a/pkg/version/version.go
++++ b/pkg/version/version.go
+@@ -6,7 +6,7 @@ package version
+ import "github.com/Masterminds/semver"
+ 
+ // Version returns 'bingo' version.
+-const Version = "v0.6"
++const Version = "v0.6.0"
+ 
+ var (
+ 	Go114 = semver.MustParse("1.14")
diff --git a/pkgs/development/tools/bingo/default.nix b/pkgs/development/tools/bingo/default.nix
index 6e7ed39a221c..1b4ddd41c0e3 100644
--- a/pkgs/development/tools/bingo/default.nix
+++ b/pkgs/development/tools/bingo/default.nix
@@ -2,20 +2,22 @@
 
 buildGoModule rec {
   pname = "bingo";
-  version = "0.5.2";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "bwplotka";
     repo = "bingo";
     rev = "v${version}";
-    sha256 = "sha256-4D8YaA/AH1gIp5iwD7WEAdBl73sqwHpfOe7bnxVcRcw=";
+    sha256 = "sha256-t2nkY+mwek2NcbCwCkI3Mc1ULEJIjatBjChBdnKFAg8=";
   };
 
-  vendorSha256 = "sha256-xrz9FpwZd+FboVVTWSqGHRguGwrwE9cSFEEtulzbfDQ=";
+  vendorSha256 = "sha256-TCbwIHDg2YaLIscCoGPRBv5G3YSJ+qn/koOjPh+KKRY=";
 
   patches = [
     # Do not execute `go` command when invoking `bingo version`.
     ./version_go.patch
+    # Specific to v0.6.0. `v0.6` -> `v0.6.0`
+    ./bingo_version.patch
   ];
 
   postPatch = ''
diff --git a/pkgs/development/tools/build-managers/bazel/bazel-remote/default.nix b/pkgs/development/tools/build-managers/bazel/bazel-remote/default.nix
index a133526514f7..f519ce5233ef 100644
--- a/pkgs/development/tools/build-managers/bazel/bazel-remote/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel-remote/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "bazel-remote";
-  version = "2.3.6";
+  version = "2.3.7";
 
   src = fetchFromGitHub {
     owner = "buchgr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-geb7uHCBvhmqyaDr8wK9sQUcHT3xVgSclovFDpHhIiw=";
+    sha256 = "sha256-5VxPCfartTRYCmjwNrH7SM0o7IQ4+Tq8Q2IM8hFWyVc=";
   };
 
   vendorSha256 = "sha256-wXgW7HigMIeUZAcZpm5TH9thfCHmpz+M42toWHgwIYo=";
diff --git a/pkgs/development/tools/continuous-integration/dagger/default.nix b/pkgs/development/tools/continuous-integration/dagger/default.nix
index b204cfc1ae5e..2cecbce2f4c8 100644
--- a/pkgs/development/tools/continuous-integration/dagger/default.nix
+++ b/pkgs/development/tools/continuous-integration/dagger/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "dagger";
-  version = "0.2.6";
+  version = "0.2.7";
 
   src = fetchFromGitHub {
     owner = "dagger";
     repo = "dagger";
     rev = "v${version}";
-    sha256 = "sha256-3rkHWWpZGUL+7DoUtwY3v2tlcNXdbfVqs+u1wq3jNVI=";
+    sha256 = "sha256-sy4z/kyHUn9OSkB1uYQsmr/T5ij/0HfTrr0sIyIUGTE=";
   };
 
-  vendorSha256 = "sha256-DKjVY2G+sG5CjwN262aZkH90fosuBCKHlB8sRbILjaI=";
+  vendorSha256 = "sha256-l2Ydj7snWQa7L1uVQxBqtj9DsrH+ayUhlsiwDJSeOWk=";
 
   subPackages = [
     "cmd/dagger"
diff --git a/pkgs/development/tools/dapr/cli/default.nix b/pkgs/development/tools/dapr/cli/default.nix
index 59e04455c2a4..96b86719e6c8 100644
--- a/pkgs/development/tools/dapr/cli/default.nix
+++ b/pkgs/development/tools/dapr/cli/default.nix
@@ -1,23 +1,30 @@
-{ buildGoModule, fetchFromGitHub, lib }:
+{ buildGoModule, fetchFromGitHub, installShellFiles, lib }:
 
 buildGoModule rec {
-  pname = "dapr";
-  version = "1.1.0";
-
-  vendorSha256 = "0fng5a1pvpbwil79xapdalzgkgc9dwsdxs6bznjfwnkyd1vvw6fm";
+  pname = "dapr-cli";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
-    sha256 = "0x2mvlzlmcik6ys6xp722px9l4lj9ssyxb06bzxd7yj7m1wwcwp9";
-
     owner = "dapr";
     repo = "cli";
     rev = "v${version}";
+    sha256 = "sha256-+P1oXG+uvnFDGis5pz9VUQ4n1C7mjuetXz1OtN7IIrg=";
   };
 
-  doCheck = false;
+  vendorSha256 = "sha256-EvOyOy7DFQtFavOC9eBUZRJsj3pNdx7jumVmZ/THdaM=";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  preCheck = ''
+    export HOME=$(mktemp -d)
+  '';
 
   postInstall = ''
     mv $out/bin/cli $out/bin/dapr
+
+    installShellCompletion --cmd dapr \
+      --bash <($out/bin/dapr completion bash) \
+      --zsh <($out/bin/dapr completion zsh)
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/tools/go-protobuf/default.nix b/pkgs/development/tools/go-protobuf/default.nix
index 72dabc3b9380..00e62c87cb32 100644
--- a/pkgs/development/tools/go-protobuf/default.nix
+++ b/pkgs/development/tools/go-protobuf/default.nix
@@ -13,8 +13,6 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-CcJjFMslSUiZMM0LLMM3BR53YMxyWk8m7hxjMI9tduE=";
 
-  doCheck = false;
-
   meta = with lib; {
     homepage    = "https://github.com/golang/protobuf";
     description = " Go bindings for protocol buffer";
diff --git a/pkgs/development/tools/misc/devspace/default.nix b/pkgs/development/tools/misc/devspace/default.nix
new file mode 100644
index 000000000000..df59686b2b97
--- /dev/null
+++ b/pkgs/development/tools/misc/devspace/default.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "devspace";
+  version = "5.18.4";
+
+  src = fetchFromGitHub {
+    owner = "loft-sh";
+    repo = "devspace";
+    rev = "v${version}";
+    sha256 = "0s5117cgxgrxfki5drvg6d22dvrjffa03bi644zdl1p631r599r1";
+  };
+
+  vendorSha256 = null;
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=${version}"
+  ];
+
+  # Check are disable since they requiered a working K8S cluster
+  # TODO: add a nixosTest to be able to perform the package check
+  doCheck = false;
+
+  meta = with lib; {
+    description = "DevSpace is an open-source developer tool for Kubernetes that lets you develop and deploy cloud-native software faster";
+    homepage = "https://devspace.sh/";
+    changelog = "https://github.com/loft-sh/devspace/releases/tag/v${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ darkonion0 ];
+  };
+}
diff --git a/pkgs/development/tools/misc/go-license-detector/default.nix b/pkgs/development/tools/misc/go-license-detector/default.nix
index fc69d8cdd129..11e7547afc4c 100644
--- a/pkgs/development/tools/misc/go-license-detector/default.nix
+++ b/pkgs/development/tools/misc/go-license-detector/default.nix
@@ -1,23 +1,23 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub, git }:
 
 buildGoModule rec {
   pname = "go-license-detector";
-  version = "3.1.0";
+  version = "4.3.0";
 
   src = fetchFromGitHub {
-    owner = "src-d";
+    owner = "go-enry";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0ln1z3y9q5igf9djkxw05ql2hb1ijcvvz0mrbwz11cdv9xrsa4z4";
+    sha256 = "sha256-MubQpxpUCPDBVsEz4NmY8MFEoECXQtzAaZJ89vv5bDc=";
   };
 
-  vendorSha256 = "0gan5l7vsq0hixxcymhhs8p07v92w60r0lhgvrr9a99nic12vmia";
+  vendorSha256 = "sha256-a9yCnGg+4f+UoHbGG8a47z2duBD3qXcAzPKnE4PQsvM=";
 
-  doCheck = false;
+  checkInputs = [ git ];
 
   meta = with lib; {
     description = "Reliable project licenses detector";
-    homepage = "https://github.com/src-d/go-license-detector";
+    homepage = "https://github.com/go-enry/go-license-detector";
     license = licenses.asl20;
     maintainers = with maintainers; [ dtzWill ];
     mainProgram = "license-detector";
diff --git a/pkgs/development/tools/mockgen/default.nix b/pkgs/development/tools/mockgen/default.nix
index af3e21afc914..56615d9b7004 100644
--- a/pkgs/development/tools/mockgen/default.nix
+++ b/pkgs/development/tools/mockgen/default.nix
@@ -1,19 +1,24 @@
-{ buildGoModule, lib, fetchFromGitHub }:
+{ buildGoModule, fetchFromGitHub, lib }:
+
 buildGoModule rec {
   pname = "mockgen";
   version = "1.6.0";
+
   src = fetchFromGitHub {
     owner = "golang";
     repo = "mock";
     rev = "v${version}";
     sha256 = "sha256-5Kp7oTmd8kqUN+rzm9cLqp9nb3jZdQyltGGQDiRSWcE=";
   };
+
   vendorSha256 = "sha256-5gkrn+OxbNN8J1lbgbxM8jACtKA7t07sbfJ7gVJWpJM=";
 
-  doCheck = false;
-
   subPackages = [ "mockgen" ];
 
+  preCheck = ''
+    export GOROOT="$(go env GOROOT)"
+  '';
+
   meta = with lib; {
     description = "GoMock is a mocking framework for the Go programming language";
     homepage = "https://github.com/golang/mock";
diff --git a/pkgs/development/tools/protoc-gen-doc/default.nix b/pkgs/development/tools/protoc-gen-doc/default.nix
index 4774d1a11d5c..50badf258b08 100644
--- a/pkgs/development/tools/protoc-gen-doc/default.nix
+++ b/pkgs/development/tools/protoc-gen-doc/default.nix
@@ -1,19 +1,17 @@
 { buildGoModule, fetchFromGitHub, lib }:
 
 buildGoModule rec {
-  pname = "protoc-gen-doc-unstable";
-  version = "1.5.0";
+  pname = "protoc-gen-doc";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "pseudomuto";
     repo = "protoc-gen-doc";
     rev = "v${version}";
-    sha256 = "1bpb5wv76p0sjffh5d1frbygp3q1p07sdh5c8pznl5bdh5pd7zxq";
+    sha256 = "sha256-19CN62AwqQGq5Gb5kQqVYhs+LKsJ9K2L0VAakwzPD5Y=";
   };
 
-  vendorSha256 = "08pk9nxsl28dw3qmrlb7vsm8xbdzmx98qwkxgg93ykrhzx235k1b";
-
-  doCheck = false;
+  vendorSha256 = "sha256-K0rZBERSKob5ubZW28QpbcPhgFKOOASkd9UyC9f8gyQ=";
 
   meta = with lib; {
     description = "Documentation generator plugin for Google Protocol Buffers";
diff --git a/pkgs/development/web/flyctl/default.nix b/pkgs/development/web/flyctl/default.nix
index 720467ac4cd5..87b6ddfa923e 100644
--- a/pkgs/development/web/flyctl/default.nix
+++ b/pkgs/development/web/flyctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "flyctl";
-  version = "0.0.320";
+  version = "0.0.323";
 
   src = fetchFromGitHub {
     owner = "superfly";
     repo = "flyctl";
     rev = "v${version}";
-    sha256 = "sha256-hljQzMdA+dfZDQMqehkdZ1giv56IRygby4UF57Cogq8=";
+    sha256 = "sha256-7mPZ4p7fb49Lc+sx7/jEw+oFdFaYtEJcSzFS5haC6NM=";
   };
 
-  vendorSha256 = "sha256-8+EYVaWOppzv4bV/rBWyTTdAFSx7QI0a3+oplBglxyQ=";
+  vendorSha256 = "sha256-dTeFeDdT44k1HxIEuvTU/A8xAa1VhVv4ZFbvg1PagPw=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/os-specific/linux/firmware/fwupd/default.nix b/pkgs/os-specific/linux/firmware/fwupd/default.nix
index 272bd6dbe8fc..12a99b723137 100644
--- a/pkgs/os-specific/linux/firmware/fwupd/default.nix
+++ b/pkgs/os-specific/linux/firmware/fwupd/default.nix
@@ -116,7 +116,7 @@ let
 
   self = stdenv.mkDerivation rec {
     pname = "fwupd";
-    version = "1.7.6";
+    version = "1.7.7";
 
     # libfwupd goes to lib
     # daemon, plug-ins and libfwupdplugin go to out
@@ -125,7 +125,7 @@ let
 
     src = fetchurl {
       url = "https://people.freedesktop.org/~hughsient/releases/fwupd-${version}.tar.xz";
-      sha256 = "sha256-fr4VFKy2iNJknOzDktuSkJTaPwPPyYqcD6zKuwhJEvo=";
+      sha256 = "sha256-QUmU06zfZ0qQ9wotoW2k4XalrRH+Y25qs/DhpJ4GKWk=";
     };
 
     patches = [
@@ -153,13 +153,6 @@ let
 
       # EFI capsule is located in fwupd-efi now.
       ./efi-app-path.patch
-
-      # Drop hard-coded FHS path
-      # https://github.com/fwupd/fwupd/issues/4360
-      (fetchpatch {
-        url = "https://github.com/fwupd/fwupd/commit/14cc2e7ee471b66ee2ef54741f4bec1f92204620.patch";
-        sha256 = "47682oqE66Y6QKPtN2mYpnb2+TIJFqBgsgx60LmC3FM=";
-      })
     ];
 
     nativeBuildInputs = [
@@ -323,7 +316,6 @@ let
     passthru = {
       filesInstalledToEtc = [
         "fwupd/daemon.conf"
-        "fwupd/msr.conf"
         "fwupd/remotes.d/lvfs-testing.conf"
         "fwupd/remotes.d/lvfs.conf"
         "fwupd/remotes.d/vendor.conf"
@@ -341,6 +333,8 @@ let
         "fwupd/remotes.d/dell-esrt.conf"
       ] ++ lib.optionals haveRedfish [
         "fwupd/redfish.conf"
+      ] ++ lib.optionals haveMSR [
+        "fwupd/msr.conf"
       ];
 
       # DisabledPlugins key in fwupd/daemon.conf
diff --git a/pkgs/servers/calibre-web/default.nix b/pkgs/servers/calibre-web/default.nix
index 308654039983..e170d761115b 100644
--- a/pkgs/servers/calibre-web/default.nix
+++ b/pkgs/servers/calibre-web/default.nix
@@ -53,8 +53,10 @@ python3.pkgs.buildPythonApplication rec {
 
     substituteInPlace setup.cfg \
       --replace "cps = calibreweb:main" "calibre-web = calibreweb:main" \
+      --replace "Flask>=1.0.2,<2.1.0" "Flask>=1.0.2" \
+      --replace "Flask-Login>=0.3.2,<0.5.1" "Flask-Login>=0.3.2" \
       --replace "flask-wtf>=0.14.2,<0.16.0" "flask-wtf>=0.14.2" \
-      --replace "lxml>=3.8.0,<4.7.0" "lxml>=3.8.0" \
+      --replace "lxml>=3.8.0,<4.8.0" "lxml>=3.8.0" \
       --replace "PyPDF3>=1.0.0,<1.0.4" "PyPDF3>=1.0.0" \
       --replace "requests>=2.11.1,<2.25.0" "requests" \
       --replace "unidecode>=0.04.19,<1.3.0" "unidecode>=0.04.19"
diff --git a/pkgs/servers/gortr/default.nix b/pkgs/servers/gortr/default.nix
index 721570c5c0ae..44057033bd59 100644
--- a/pkgs/servers/gortr/default.nix
+++ b/pkgs/servers/gortr/default.nix
@@ -10,9 +10,8 @@ buildGoModule rec {
     rev = "v${version}";
     sha256 = "10dq42d3hb6a3ln3x1rag1lqzhwqb66xn4q8k4igjkn5my81nr6q";
   };
-  vendorSha256 = "1nwrzbpqycr4ixk8a90pgaxcwakv5nlfnql6hmcc518qrva198wp";
 
-  doCheck = false;
+  vendorSha256 = "1nwrzbpqycr4ixk8a90pgaxcwakv5nlfnql6hmcc518qrva198wp";
 
   meta = with lib; {
     description = "The RPKI-to-Router server used at Cloudflare";
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 6d51b0a1dbc4..963f81c1daf7 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -1055,7 +1055,8 @@
       hangups
     ];
     "harman_kardon_avr" = ps: with ps; [
-    ]; # missing inputs: hkavr
+      hkavr
+    ];
     "harmony" = ps: with ps; [
       aioharmony
     ];
@@ -1907,7 +1908,8 @@
       pyopnsense
     ];
     "opple" = ps: with ps; [
-    ]; # missing inputs: pyoppleio
+      pyoppleio
+    ];
     "oru" = ps: with ps; [
     ]; # missing inputs: oru
     "orvibo" = ps: with ps; [
@@ -1962,7 +1964,8 @@
       peco
     ];
     "pencom" = ps: with ps; [
-    ]; # missing inputs: pencompy
+      pencompy
+    ];
     "persistent_notification" = ps: with ps; [
     ];
     "person" = ps: with ps; [
@@ -2143,7 +2146,8 @@
       praw
     ];
     "rejseplanen" = ps: with ps; [
-    ]; # missing inputs: rjpl
+      rjpl
+    ];
     "remember_the_milk" = ps: with ps; [
       httplib2
     ]; # missing inputs: RtmAPI
diff --git a/pkgs/servers/routinator/default.nix b/pkgs/servers/routinator/default.nix
index e11fb3272f9b..ed57e21b6205 100644
--- a/pkgs/servers/routinator/default.nix
+++ b/pkgs/servers/routinator/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "routinator";
-  version = "0.11.1";
+  version = "0.11.2";
 
   src = fetchFromGitHub {
     owner = "NLnetLabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-8rILHWxUrQQx/ZpZQECa3JBCGD+a5Po8jdqb/rTx6WA=";
+    sha256 = "sha256-C6BY+Ba5KQgi+jMUKRi7osZNEDMLMDOhA4TQlbqb9jY=";
   };
 
-  cargoSha256 = "sha256-TYVpi4ZyM0Nl2RWRMEwLM+TeAEzk1IUCQTXZLG92vt4=";
+  cargoSha256 = "sha256-5ZBE7jbhO4j4FwGSXLIbYjmtmNxFpiME9JqXBqwHSUA=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ Security ];
 
diff --git a/pkgs/tools/admin/awslogs/default.nix b/pkgs/tools/admin/awslogs/default.nix
index 5b61e4828ef6..2f60e414d74a 100644
--- a/pkgs/tools/admin/awslogs/default.nix
+++ b/pkgs/tools/admin/awslogs/default.nix
@@ -1,30 +1,51 @@
-{ lib, fetchFromGitHub, python3Packages }:
+{ lib
+, fetchFromGitHub
+, python3
+}:
 
-python3Packages.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "awslogs";
   version = "0.14.0";
+  format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "jorgebastida";
-    repo = "awslogs";
+    repo = pname;
     rev = version;
-    sha256 = "1gyry8b64psvmjcb2lb3yilpa7b17yllga06svls4hi69arvrd8f";
+    sha256 = "sha256-DrW8s0omQqLp1gaoR6k/YR11afRjUbGYrFtfYhby2b8=";
   };
 
-  propagatedBuildInputs = with python3Packages; [
-    boto3 termcolor python-dateutil docutils setuptools jmespath
+  propagatedBuildInputs = with python3.pkgs; [
+    boto3
+    termcolor
+    python-dateutil
+    docutils
+    setuptools
+    jmespath
   ];
 
-  checkInputs = [ python3Packages.pytestCheckHook ];
+  checkInputs = with python3.pkgs; [
+    pytestCheckHook
+  ];
+
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "jmespath>=0.7.1,<1.0.0" "jmespath>=0.7.1"
+  '';
+
   disabledTests = [
     "test_main_get_query"
     "test_main_get_with_color"
   ];
 
+  pythonImportsCheck = [
+    "awslogs"
+  ];
+
   meta = with lib; {
-    homepage = "https://github.com/jorgebastida/awslogs";
     description = "AWS CloudWatch logs for Humans";
-    maintainers = with maintainers; [ dbrock ];
+    homepage = "https://github.com/jorgebastida/awslogs";
     license = licenses.bsd3;
+    maintainers = with maintainers; [ dbrock ];
   };
 }
diff --git a/pkgs/tools/admin/eksctl/default.nix b/pkgs/tools/admin/eksctl/default.nix
index c031051e89a0..e9afcb4d5682 100644
--- a/pkgs/tools/admin/eksctl/default.nix
+++ b/pkgs/tools/admin/eksctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "eksctl";
-  version = "0.93.0";
+  version = "0.94.0";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = pname;
     rev = version;
-    sha256 = "sha256-Ku6GmUaaiw1pePIWJcJgSjnLWiAfFsG8BGphT+4z6ss=";
+    sha256 = "sha256-6I/rzdSJ0iwoazt7EHsQ3gEynGfzBoLR7ekPNUo/YQs=";
   };
 
-  vendorSha256 = "sha256-ATrEDavlr14i0L28KEuivlRjVxnnFVZPDjZ4Ni+8kbo=";
+  vendorSha256 = "sha256-cWZvMP19xTq68kKJ50d2RYXHu9AfiEE+zQL2IsQ4eiY=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/admin/pulumi/data.nix b/pkgs/tools/admin/pulumi/data.nix
index 6e13f6747ccd..b21151d9b588 100644
--- a/pkgs/tools/admin/pulumi/data.nix
+++ b/pkgs/tools/admin/pulumi/data.nix
@@ -1,16 +1,16 @@
 # DO NOT EDIT! This file is generated automatically by update.sh
 { }:
 {
-  version = "3.29.1";
+  version = "3.30.0";
   pulumiPkgs = {
     x86_64-linux = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.29.1-linux-x64.tar.gz";
-        sha256 = "0chxkyarvci7x0x780chj9ksdjdqldvz8s8pnvvsw4v6ljxhp4jl";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.30.0-linux-x64.tar.gz";
+        sha256 = "1js63rdmim5dq40fi6vwz982bc2604c0y0hmyj4mc5ag114lfz5w";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v4.5.0-linux-amd64.tar.gz";
-        sha256 = "16wfnjk9y6zd2pqcn3sk2yhmwbq2zmbdg5yv3a89kdhkal9p785h";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v4.5.1-linux-amd64.tar.gz";
+        sha256 = "10vn054iia68rn37ibrri150k795hr3vdvwgsxdkr2qyp8rna6mx";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-akamai-v2.9.0-linux-amd64.tar.gz";
@@ -29,16 +29,16 @@
         sha256 = "1x1fvnxhnhhv9fhqp4syhqcybjqpa2rq8d9nb8yvm9rxgcjllr0n";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v5.1.3-linux-amd64.tar.gz";
-        sha256 = "1pcm9s76rp6s9ndw2y4mbs4p9cpsczpxb54ng4z40r3whisrzr57";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v5.2.0-linux-amd64.tar.gz";
+        sha256 = "0fwj6xdfvh0ysa58pzx37i4ysdf3idhp84d0lfwkbj4wvm6c15ga";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuread-v5.19.0-linux-amd64.tar.gz";
-        sha256 = "0jginwaq8inyhf1rw0xzaaiv7xpadvqrarbp543iz4yz64qncpk9";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuread-v5.20.0-linux-amd64.tar.gz";
+        sha256 = "1113nqv4hg8fp5algq3jjn0l6sl56vmlbgxpfm8211m6z99kpjyx";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuredevops-v2.3.1-linux-amd64.tar.gz";
-        sha256 = "0m89na1gqrb41h1dg5j876g5hp0mfk4g7ij7i4md1szk9fp4820k";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuredevops-v2.4.0-linux-amd64.tar.gz";
+        sha256 = "1z8f287mm2mqfa76021fp5a1bj9045iwxcy8xs1ygh48b1890j49";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v5.2.0-linux-amd64.tar.gz";
@@ -85,8 +85,8 @@
         sha256 = "17v460kbghvrvhxgckzg2bq556amy5hwmks4m1idkcz8akh6vlni";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-google-native-v0.18.0-linux-amd64.tar.gz";
-        sha256 = "0br9faaqaksfqyngf3s9kmsjfqmhmpc09rpyqjxprxh1vmd4s31n";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-google-native-v0.18.1-linux-amd64.tar.gz";
+        sha256 = "010jm1x4id53wx8jwabqglyvkv73j8bnhksk5jcg20wbf1864hli";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-hcloud-v1.8.0-linux-amd64.tar.gz";
@@ -125,28 +125,28 @@
         sha256 = "1jx9ngzk3k8ab5s1ms2j8k7sb2zfcxkwhjj7zwvdna5x2lxrvq20";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.16.0-linux-amd64.tar.gz";
-        sha256 = "01yaz2yh77fdcqcv94xh85b3km7q1gpjdys03gll6gz1vb0qlhis";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.17.0-linux-amd64.tar.gz";
+        sha256 = "1abgvb6bqdpy4rh94rq94bjcvz7ksd0f4ywzwxh02f7qv9lacsx9";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-sumologic-v0.6.0-linux-amd64.tar.gz";
         sha256 = "014aqs91gyzsi413v6f6npnmx72yflhxc6ybxngybkphc6hzx5y2";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-tailscale-v0.7.0-linux-amd64.tar.gz";
-        sha256 = "022wl1b2cv8j6lrzvzrik8jkxvngyd6jx7qrn4r2km65xfmgckz2";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-tailscale-v0.7.1-linux-amd64.tar.gz";
+        sha256 = "0yhsidz5mi6xznmrkvlg1jxyykhg3kccqd4fxg9zj9yv4l8ih2rw";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-tls-v4.2.2-linux-amd64.tar.gz";
         sha256 = "1x30qyrjrhn4gglcz2gc1h6n8px1v198fpsjf2wmf3v13pb15ix8";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vault-v5.4.0-linux-amd64.tar.gz";
-        sha256 = "0cj46m1jzfhx400qq4p40sqg0j6m2nggfpvyv4m1jxxzna11615n";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vault-v5.4.1-linux-amd64.tar.gz";
+        sha256 = "1n780mk61vshxyf7h9wdx3rddnrmjljzzx979c4hw1ycq40iwxkh";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-venafi-v1.4.0-linux-amd64.tar.gz";
-        sha256 = "0hf7jrr91wpq28xsf8ajbdillblryh35k5w367d5fps7ph3fjk3f";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-venafi-v1.4.1-linux-amd64.tar.gz";
+        sha256 = "1l3iplqqndvx98bcil1z2vhnmaldvrgyggbs2f15jyz4iv2k822k";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vsphere-v4.2.0-linux-amd64.tar.gz";
@@ -163,12 +163,12 @@
     ];
     x86_64-darwin = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.29.1-darwin-x64.tar.gz";
-        sha256 = "0c2k7sqk4y4lhazdcfdcgxzwaz21vp1i4fmdji7jizbkj7qybn2x";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.30.0-darwin-x64.tar.gz";
+        sha256 = "0hbdcn5aby9a9nz3jb1p8rr7r35mv7hxdbb8lsqph70bzavw5bzi";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v4.5.0-darwin-amd64.tar.gz";
-        sha256 = "0bq8hjcspb8wmyjfn73rzjfqq1clxjx3cwx9yd8v7wjbr2ijrlkz";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v4.5.1-darwin-amd64.tar.gz";
+        sha256 = "0i43sspz7bcg6nhdf3ncj6mcs087qn2z0fkfcylj7nsvvvwcacyr";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-akamai-v2.9.0-darwin-amd64.tar.gz";
@@ -187,16 +187,16 @@
         sha256 = "15a89ydv8yp71aamd9kciz9yggxza5njdikch5pvmd24jvar03gm";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v5.1.3-darwin-amd64.tar.gz";
-        sha256 = "0y78bwqf3zfivs29d1cdyx49fl8imdv3j6pvw1f23cyh6hsdfjfa";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v5.2.0-darwin-amd64.tar.gz";
+        sha256 = "1jqqycasnk2i8w16qf52yya0p35ilfmabpd6alfgmpkk6ag7asa5";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuread-v5.19.0-darwin-amd64.tar.gz";
-        sha256 = "1zfprji3l6gpb80s67049w1ggxz0idv0fg9jipivhakr6d8j5mzp";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuread-v5.20.0-darwin-amd64.tar.gz";
+        sha256 = "0lx3sfdck18ppmd76ijmih51adm9i2rc2ai564psqx41261zpjyr";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuredevops-v2.3.1-darwin-amd64.tar.gz";
-        sha256 = "0fjynq1ilfv6njjyyadhpc9ks8izwif3nf8mnb7wfxchxn7gqbsi";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuredevops-v2.4.0-darwin-amd64.tar.gz";
+        sha256 = "1shc7m4xlsmcjnrlbi2jyvmnvf9bg1cs6knfkl82jfs65ya5iidf";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v5.2.0-darwin-amd64.tar.gz";
@@ -243,8 +243,8 @@
         sha256 = "08b6p6gliay66bd7687kjc9n3n7xdgbrrcnbjbqi7a3am14mf5p6";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-google-native-v0.18.0-darwin-amd64.tar.gz";
-        sha256 = "0wn9jpvaj3hwlm3yakgm7y87dcv1ja606hkf3vllqjmjz99113c3";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-google-native-v0.18.1-darwin-amd64.tar.gz";
+        sha256 = "0828lrq07586liz2k7pjk7hnz4nxawkq03nw8x2s4j8paszrz295";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-hcloud-v1.8.0-darwin-amd64.tar.gz";
@@ -283,28 +283,28 @@
         sha256 = "0z5w42m0229gjlbp36aqh8cfd0l47nv5jh6gcjqfp5pkgwh37gnj";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.16.0-darwin-amd64.tar.gz";
-        sha256 = "1viwk26qj9civh4plqm34j5iky69sxvskmqbga03x1v5rd7567aa";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.17.0-darwin-amd64.tar.gz";
+        sha256 = "119a3dfrri8qdbianml7i2fm6yr8rrq1q0cnpk9r8qsyja2vsvp7";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-sumologic-v0.6.0-darwin-amd64.tar.gz";
         sha256 = "11zhgrljwqkj3a200kdh8gyzvxm6jcbwm71929a87wqppgwvcbag";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-tailscale-v0.7.0-darwin-amd64.tar.gz";
-        sha256 = "1argvhm2jirjddi5hnp0rxa7710ixaj63lw8k2aq4xkascllm4lb";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-tailscale-v0.7.1-darwin-amd64.tar.gz";
+        sha256 = "1n6w6da58crv2dyi0s7pjzjk3y85qlz6qaa77r0lm58f8wcj4a9d";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-tls-v4.2.2-darwin-amd64.tar.gz";
         sha256 = "1shfz3qz92plxsn31kqsvzk6sibgbglq66j34w5aj98g2g5891f4";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vault-v5.4.0-darwin-amd64.tar.gz";
-        sha256 = "1ghghaq9svy7sv2s1j8b1qjah6aj7vwwdh9wd9agm4xdiillprhf";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vault-v5.4.1-darwin-amd64.tar.gz";
+        sha256 = "0l89yiwjs39nhicln0bbwb8j1dajc1r1gdbqrl3zjpq6mnhanphb";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-venafi-v1.4.0-darwin-amd64.tar.gz";
-        sha256 = "08b3lyyf8zjkn9jaw4l0yb741i6kqhfb7cbwshrwqh6l3yh7kc2y";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-venafi-v1.4.1-darwin-amd64.tar.gz";
+        sha256 = "1gxk3gcyqk688m9dv2p4flbm1dw0z9478xip6jqaiw4awkrzbnns";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vsphere-v4.2.0-darwin-amd64.tar.gz";
@@ -321,12 +321,12 @@
     ];
     aarch64-linux = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.29.1-linux-arm64.tar.gz";
-        sha256 = "0px1nkji1pshxnbgfsnr0zr142j736vf6icm4aq0aq01llzq4adf";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.30.0-linux-arm64.tar.gz";
+        sha256 = "1d7a4r0wyig5fbbs9d6jal2ria44ajca0441szsf1rd5ds29fvj3";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v4.5.0-linux-arm64.tar.gz";
-        sha256 = "14g4kz6czw886znasl5pw7l2ar84h1dljkalgs9vaxszyhdr7mnw";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v4.5.1-linux-arm64.tar.gz";
+        sha256 = "0c55b6jn7xxkvpcbgc4l8nxbjpdlpy6xhrk8j65ch27jhn3nwags";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-akamai-v2.9.0-linux-arm64.tar.gz";
@@ -345,16 +345,16 @@
         sha256 = "0j5wa27zhqf4vvpxgs4cmay8n3a74jsif4sr9x60mhkrhr0s117k";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v5.1.3-linux-arm64.tar.gz";
-        sha256 = "0wbv2vj6gw251cnd4jbb71yp8vybikh0p4smm74acyscwphvjy5h";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v5.2.0-linux-arm64.tar.gz";
+        sha256 = "1i4rbjaabqwhgfrsi75i8rr5imrn3lifkrgng1amyf279svsrc3q";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuread-v5.19.0-linux-arm64.tar.gz";
-        sha256 = "1wxhpzrzn71f9p1zkzl073a74y28vwa8wj2rbh9vy041j68vya18";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuread-v5.20.0-linux-arm64.tar.gz";
+        sha256 = "15fszcgdnqnwjd1676sgrnlk45791927xagg22j5vf588v897ikj";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuredevops-v2.3.1-linux-arm64.tar.gz";
-        sha256 = "0a6bmiz6ys1h6n59mw3w7b2g8rhbnr0rb40rwidazvkni0s03yha";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuredevops-v2.4.0-linux-arm64.tar.gz";
+        sha256 = "0w55pk3ham08lrg3vq0hg3p23qipz21ln01g61xd0cpl79aysbq4";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v5.2.0-linux-arm64.tar.gz";
@@ -401,8 +401,8 @@
         sha256 = "0i6qxrdijf653nj6yqhdikbj3spzzwr5rbgngkc0v7yxkphlzlnj";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-google-native-v0.18.0-linux-arm64.tar.gz";
-        sha256 = "152qrcik44iz5lrfg649wmk67wcjdm4lnkwrc1gwhm34w0lrbarf";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-google-native-v0.18.1-linux-arm64.tar.gz";
+        sha256 = "1q5fxlrfiqlwib5bwwinmghq3j25rv14ldklpxihviyz1b5sdiyk";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-hcloud-v1.8.0-linux-arm64.tar.gz";
@@ -441,28 +441,28 @@
         sha256 = "0k5ic9i7cd6ccl3v20sj7jgpdrcc4bkv697p0pslb7i3fnhdcawf";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.16.0-linux-arm64.tar.gz";
-        sha256 = "0ksya9nywimkm4jcd67ccaaxbvsxq747d21j8aywpwp3nwfl58wi";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.17.0-linux-arm64.tar.gz";
+        sha256 = "1ssrqxf1gss0fcpffgh40hasbgh4cc4ysqkk0lxdl90avb7lf2zr";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-sumologic-v0.6.0-linux-arm64.tar.gz";
         sha256 = "10sb3lm8m90fwf20nqy6yzfwbxxlwf13hmygrqnyicvfmiajihkn";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-tailscale-v0.7.0-linux-arm64.tar.gz";
-        sha256 = "0nksi0ybjq0mwqiwwrnm4vifwjdjlyx6i446pyqm97wlph3ffg8h";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-tailscale-v0.7.1-linux-arm64.tar.gz";
+        sha256 = "0zkmkg9bivf5hlcbdj2aqyszpsqk7x8ag99z0x2yd00v72x2qcb5";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-tls-v4.2.2-linux-arm64.tar.gz";
         sha256 = "1km5fhlic0vidqijx8bfjr0h1w0wwl9zk60ydz86kdxpby4b2flb";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vault-v5.4.0-linux-arm64.tar.gz";
-        sha256 = "09rvvps2kijjr4r9h75xijpsxw5ar2gy3ncmrvjfyqx17zch92v6";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vault-v5.4.1-linux-arm64.tar.gz";
+        sha256 = "08rxnqdvpb7lrknhlnyhnfnvsmbdi7cxds7dc5zdslx27fcywz8a";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-venafi-v1.4.0-linux-arm64.tar.gz";
-        sha256 = "1lh459lxa4gvxkbypmcm4hwcwcchkvs79ajlb9gvrm4ds68nm5xb";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-venafi-v1.4.1-linux-arm64.tar.gz";
+        sha256 = "1ivbdpls45zjzw4v2hi7g3zfhy0nlnnh026bkzzfnfan1isnpp87";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vsphere-v4.2.0-linux-arm64.tar.gz";
@@ -479,12 +479,12 @@
     ];
     aarch64-darwin = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.29.1-darwin-arm64.tar.gz";
-        sha256 = "03lljjak5rbin4chj6z22c21hzw9p5hdhskkcwl10h1x134j3gjr";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.30.0-darwin-arm64.tar.gz";
+        sha256 = "10f2mamxg0h8lm4zf38j3a43s5d8r52f6lp6lrg0j705356w49bn";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v4.5.0-darwin-arm64.tar.gz";
-        sha256 = "0kdljrsb5kk9i1xf1fk461fsb3vbjmcvzvgkjd3yp0xij3fac6al";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v4.5.1-darwin-arm64.tar.gz";
+        sha256 = "0l2xmaybgrbln3zgpdx6pmrg05hm08maigr62hpj2q6l8z06gsfk";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-akamai-v2.9.0-darwin-arm64.tar.gz";
@@ -503,16 +503,16 @@
         sha256 = "1qx9717a5qajn3dp4i0gswd2pb80dq98igfad9nbz1f9sbbax2dv";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v5.1.3-darwin-arm64.tar.gz";
-        sha256 = "1a67ilb3sy3j53icz2njqz41ns4iylag9f95va061i08ip7fdlqm";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v5.2.0-darwin-arm64.tar.gz";
+        sha256 = "1sl0d642nb6xpga8izgzbl9h94faynjjrjygccc7ccnrfdh4i0dv";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuread-v5.19.0-darwin-arm64.tar.gz";
-        sha256 = "0fi0yw7y3m0q11d6bi1di8rbnqqq0fk3gj33q14rkqgj2984vzrq";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuread-v5.20.0-darwin-arm64.tar.gz";
+        sha256 = "0dwwwf7m7592nfk4lyc2vyh3ffqf6yfwr948b3padml89s2bmafx";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuredevops-v2.3.1-darwin-arm64.tar.gz";
-        sha256 = "0hlcfyxmjcq3axg35fx1dj081il60rqs7na0wx573gf028g6jj9v";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuredevops-v2.4.0-darwin-arm64.tar.gz";
+        sha256 = "0ivwpfhknhyidpafm2347g1pair7vk055ajhhyg631vizx53hrr9";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v5.2.0-darwin-arm64.tar.gz";
@@ -559,8 +559,8 @@
         sha256 = "1gvzjf5mp3iy43srvx3blxfwcg20gqbqvycysnl2p8g8sg3scx5f";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-google-native-v0.18.0-darwin-arm64.tar.gz";
-        sha256 = "04qjg2rd71375ny817h1l4174bafrhkl0d9n5qrp546dhaqmv6vr";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-google-native-v0.18.1-darwin-arm64.tar.gz";
+        sha256 = "0gjxk12z2ww31nhvnyvjgr0kxn80sn3i1x4a3f5w9mk7xc1y7bhk";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-hcloud-v1.8.0-darwin-arm64.tar.gz";
@@ -599,28 +599,28 @@
         sha256 = "0yqwxkd1rby0q7isxxyx1nn0vrz72znrms2d220haj1482gacj0a";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.16.0-darwin-arm64.tar.gz";
-        sha256 = "0wk8vdx3w5n60dbh2fjqmfxnc24cbrfxygsa211ckb2pcmmr93lm";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.17.0-darwin-arm64.tar.gz";
+        sha256 = "1j985hv5qmjvmh4vr978z3d6bpmj4mg3pil57402rifgdz3q7i17";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-sumologic-v0.6.0-darwin-arm64.tar.gz";
         sha256 = "1j9128vmm70mhdhl8rxgz1p7vf6ywbaq906jldm0izr7yi119k76";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-tailscale-v0.7.0-darwin-arm64.tar.gz";
-        sha256 = "00gpa2qrqfjyj83k40q5rfszhip5bbqd8z3rkdgrc93kbmxh37s0";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-tailscale-v0.7.1-darwin-arm64.tar.gz";
+        sha256 = "1vbbca4z6z92yk2y6g15s0cyvs5n6vx84h30ldnn4mn3gdfdi7gg";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-tls-v4.2.2-darwin-arm64.tar.gz";
         sha256 = "1ln8qizgisnf1z98vyflid99d5pl1zryrj0hg995d1lf2r0dy35g";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vault-v5.4.0-darwin-arm64.tar.gz";
-        sha256 = "1jfgphwcr3z31yyf36wh147spwdk82713m03kkahva11m6h4x6gm";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vault-v5.4.1-darwin-arm64.tar.gz";
+        sha256 = "0h423svxl2qfpgv4xl4kf3y2zsjz5lwndmvxjm9g8i01k9mn3v30";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-venafi-v1.4.0-darwin-arm64.tar.gz";
-        sha256 = "0pgrlz8nx1gfgwlp5sk70w14z0hrxcwkv9xkzjc694nwlwk1ipm8";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-venafi-v1.4.1-darwin-arm64.tar.gz";
+        sha256 = "1iabwi9cf0pvfhhhxbhp8283bzhd58rwwfcrhgh1wh9kgr0icqlx";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vsphere-v4.2.0-darwin-arm64.tar.gz";
diff --git a/pkgs/tools/admin/pulumi/update.sh b/pkgs/tools/admin/pulumi/update.sh
index f050b34e9bc5..671a9875a6f1 100755
--- a/pkgs/tools/admin/pulumi/update.sh
+++ b/pkgs/tools/admin/pulumi/update.sh
@@ -10,7 +10,7 @@ fi
 
 # Version of Pulumi from
 # https://www.pulumi.com/docs/get-started/install/versions/
-VERSION="3.29.1"
+VERSION="3.30.0"
 
 # An array of plugin names. The respective repository inside Pulumi's
 # Github organization is called pulumi-$name by convention.
diff --git a/pkgs/tools/misc/apkeep/default.nix b/pkgs/tools/misc/apkeep/default.nix
index ef7699ccf284..f7d3daf9fbcc 100644
--- a/pkgs/tools/misc/apkeep/default.nix
+++ b/pkgs/tools/misc/apkeep/default.nix
@@ -2,14 +2,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "apkeep";
-  version = "0.10.0";
+  version = "0.11.0";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "14vm3b2gbmn9pil0aagwchn4kyvi9311id6qv4a376qfb6r1aybf";
+    sha256 = "sha256-kwJ4/jkVVgem5Lb+uFDFPk4/6WWSWJs+SQDSyKkhG/8=";
   };
 
-  cargoSha256 = "0i8wzc58ji317kjdw3ls1908z4bqlh1cgjph0fxsvs5i552qjkzp";
+  cargoSha256 = "sha256-kJ81kY2EmkH3yu8xL1aPxXPMhkDsGKWo0RWn1Ih7z2k=";
 
   prePatch = ''
     rm .cargo/config.toml
diff --git a/pkgs/tools/misc/czkawka/default.nix b/pkgs/tools/misc/czkawka/default.nix
index 6385eade7aa4..1bbcaf1f34bc 100644
--- a/pkgs/tools/misc/czkawka/default.nix
+++ b/pkgs/tools/misc/czkawka/default.nix
@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "czkawka";
-  version = "4.0.0";
+  version = "4.1.0";
 
   src = fetchFromGitHub {
     owner = "qarmin";
     repo = "czkawka";
     rev = version;
-    sha256 = "sha256-UIgyKWMVSKAgUNqfxFYSfP+l9x52XAzrXr1nnfKub9I=";
+    sha256 = "sha256-N7fCYcjhYlFVkvWdFpR5cu98Vy+jStlBkR/vz/k1lLY=";
   };
 
-  cargoSha256 = "sha256-jPrkNKFmdVk3LEa20jtXSx+7S98fSrX7Rt/lexC0Gwo=";
+  cargoSha256 = "sha256-4L7OjJ26Qpl5YuHil7JEYU8xWH65jiyFz0a/ufr7wYQ=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/tools/misc/dotter/default.nix b/pkgs/tools/misc/dotter/default.nix
index fdfabf8f778a..5ca26be420ea 100644
--- a/pkgs/tools/misc/dotter/default.nix
+++ b/pkgs/tools/misc/dotter/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "dotter";
-  version = "0.12.9";
+  version = "0.12.10";
 
   src = fetchFromGitHub {
     owner = "SuperCuber";
     repo = "dotter";
-    rev = version;
-    sha256 = "0rxinrm110i5cbkl7c7vgk7dl0x79cg6g23bdjixsg7h0572c2gi";
+    rev = "v${version}";
+    hash = "sha256-uSM7M//3LHzdLSOruTyu46sp1a6LeodT2cCEFsuoPW4=";
   };
 
-  cargoSha256 = "0fr2dvzbpwqvf98wwrxv76nwbrv4m9ppx7br4x78gm8dhf2nj4zx";
+  cargoHash = "sha256-JpMEC2HjAQLQiXHSE6L0HBDc0vLhd465wDK2+35aBXA=";
 
   checkInputs = [ which ];
 
diff --git a/pkgs/tools/misc/nix-direnv/default.nix b/pkgs/tools/misc/nix-direnv/default.nix
index 7323a5fdf17d..ae091c8d386f 100644
--- a/pkgs/tools/misc/nix-direnv/default.nix
+++ b/pkgs/tools/misc/nix-direnv/default.nix
@@ -7,13 +7,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "nix-direnv";
-  version = "2.0.0";
+  version = "2.0.1";
 
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "nix-direnv";
     rev = version;
-    sha256 = "sha256-0gBb/U7tNNSjazJE/Z2qAxHPX53wRSPMJ8rHc7HtCNg=";
+    sha256 = "sha256-edRdnMNYB5N9v9QlfSFNqJl93X0rSCllmzSZO9+sCOg=";
   };
 
   # Substitute instead of wrapping because the resulting file is
diff --git a/pkgs/tools/security/chntpw/00-chntpw-build-arch-autodetect.patch b/pkgs/tools/security/chntpw/00-chntpw-build-arch-autodetect.patch
index 9c379adb7dfb..cd130affa6c4 100644
--- a/pkgs/tools/security/chntpw/00-chntpw-build-arch-autodetect.patch
+++ b/pkgs/tools/security/chntpw/00-chntpw-build-arch-autodetect.patch
@@ -1,10 +1,15 @@
-diff -urN chntpw-140201.orig/Makefile chntpw-140201/Makefile
---- chntpw-140201.orig/Makefile	2014-02-01 20:54:37.000000000 +0400
-+++ chntpw-140201/Makefile	2014-08-03 20:26:56.497161881 +0400
-@@ -12,14 +12,13 @@
- 
- CC=gcc
+--- chntpw-140201.orig/Makefile	2014-02-01 17:54:37.000000000 +0100
++++ chntpw-140201/Makefile	2022-04-21 00:14:45.000000000 +0200
+@@ -6,24 +6,7 @@
+ # See INSTALL for more info.
+ #
  
+-#SSLPATH=/usr/local/ssl
+-OSSLPATH=/usr
+-OSSLINC=$(OSSLPATH)/include
+-
+-CC=gcc
+-
 -# Force 32 bit
 -CFLAGS= -DUSEOPENSSL -g -I. -I$(OSSLINC) -Wall -m32 
 -OSSLLIB=$(OSSLPATH)/lib
@@ -13,13 +18,11 @@ diff -urN chntpw-140201.orig/Makefile chntpw-140201/Makefile
 -#CFLAGS= -DUSEOPENSSL -g -I. -I$(OSSLINC) -Wall
 -#OSSLLIB=$(OSSLPATH)/lib64
 -
-+ifeq      '$(shell gcc -dumpmachine)' 'x86_64-unknown-linux-gnu'
-+  CFLAGS= -DUSEOPENSSL -g -I. -I$(OSSLINC) -Wall
-+  OSSLLIB=$(OSSLPATH)/lib64
-+else ifeq '$(shell gcc -dumpmachine)' 'i686-unknown-linux-gnu'
-+  CFLAGS= -DUSEOPENSSL -g -I. -I$(OSSLINC) -Wall -m32 
-+  OSSLLIB=$(OSSLPATH)/lib
-+endif
+-
+-# This is to link with whatever we have, SSL crypto lib we put in static
+-#LIBS=-L$(OSSLLIB) $(OSSLLIB)/libcrypto.a
+-LIBS=-L$(OSSLLIB)
++CFLAGS= -DUSEOPENSSL -g -I. -Wall
  
- # This is to link with whatever we have, SSL crypto lib we put in static
- #LIBS=-L$(OSSLLIB) $(OSSLLIB)/libcrypto.a
+ 
+ all: chntpw chntpw.static cpnt reged reged.static samusrgrp samusrgrp.static sampasswd sampasswd.static
diff --git a/pkgs/tools/security/chntpw/01-chntpw-install-target.patch b/pkgs/tools/security/chntpw/01-chntpw-install-target.patch
index d3163a026f91..67c62273aeb6 100644
--- a/pkgs/tools/security/chntpw/01-chntpw-install-target.patch
+++ b/pkgs/tools/security/chntpw/01-chntpw-install-target.patch
@@ -1,20 +1,14 @@
-diff -urN chntpw-140201.orig/Makefile chntpw-140201/Makefile
---- chntpw-140201.orig/Makefile	2014-08-03 20:26:56.497161881 +0400
-+++ chntpw-140201/Makefile	2014-08-04 12:57:16.563818342 +0400
-@@ -10,6 +10,8 @@
- OSSLPATH=/usr
- OSSLINC=$(OSSLPATH)/include
+--- chntpw-140201/Makefile	2022-04-21 00:14:45.000000000 +0200
++++ chntpw-140201.new/Makefile	2022-04-21 09:15:42.000000000 +0200
+@@ -6,10 +6,16 @@
+ # See INSTALL for more info.
+ #
  
 +PREFIX ?= /usr
 +
- CC=gcc
+ CFLAGS= -DUSEOPENSSL -g -I. -Wall
  
- ifeq      '$(shell gcc -dumpmachine)' 'x86_64-unknown-linux-gnu'
-@@ -24,8 +26,12 @@
- #LIBS=-L$(OSSLLIB) $(OSSLLIB)/libcrypto.a
- LIBS=-L$(OSSLLIB)
- 
-+BINARIES := chntpw chntpw.static cpnt reged reged.static samusrgrp samusrgrp.static sampasswd sampasswd.static
++BINARIES := chntpw cpnt reged samusrgrp sampasswd
  
 -all: chntpw chntpw.static cpnt reged reged.static samusrgrp samusrgrp.static sampasswd sampasswd.static
 +all: $(BINARIES)
diff --git a/pkgs/tools/security/chntpw/default.nix b/pkgs/tools/security/chntpw/default.nix
index 5bda55c418aa..c4463d16d348 100644
--- a/pkgs/tools/security/chntpw/default.nix
+++ b/pkgs/tools/security/chntpw/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, unzip }:
+{ lib, stdenv, fetchurl, unzip, fetchpatch }:
 
 stdenv.mkDerivation rec {
   pname = "chntpw";
@@ -11,11 +11,47 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ unzip ];
-  buildInputs = lib.optionals stdenv.isLinux [ stdenv.glibc.out stdenv.glibc.static ];
 
   patches = [
     ./00-chntpw-build-arch-autodetect.patch
     ./01-chntpw-install-target.patch
+    # Import various bug fixes from debian
+    (fetchpatch {
+      url = "https://sources.debian.org/data/main/c/chntpw/140201-1/debian/patches/04_get_abs_path";
+      sha256 = "17h0gaczqd5b792481synr1ny72frwslb779lm417pyrz6kh9q8n";
+    })
+    (fetchpatch {
+      url = "https://sources.debian.org/data/main/c/chntpw/140201-1/debian/patches/06_correct_test_open_syscall";
+      sha256 = "00lg83bimbki988n71w54mmhjp9529r0ngm40d7fdmnc2dlpj3hd";
+    })
+    (fetchpatch {
+      url = "https://sources.debian.org/data/main/c/chntpw/140201-1/debian/patches/07_detect_failure_to_write_key";
+      sha256 = "0pk6xnprh2pqyx4n4lw3836z6fqsw3mclkzppl5rhjaahriwxw4l";
+    })
+    (fetchpatch {
+      url = "https://sources.debian.org/data/main/c/chntpw/140201-1/debian/patches/08_no_deref_null";
+      sha256 = "1g7pfmjaj0c2sm64s3api2kglj7jbgddjjd3r4drw6phwdkah0zs";
+    })
+    (fetchpatch {
+      url = "https://sources.debian.org/data/main/c/chntpw/140201-1/debian/patches/09_improve_robustness";
+      sha256 = "1nszkdy01ixnain7cwdmfbhjngphw1300ifagc1wgl9wvghzviaa";
+    })
+    (fetchpatch {
+      url = "https://sources.debian.org/data/main/c/chntpw/140201-1/debian/patches/11_improve_documentation";
+      sha256 = "0yql6hj72q7cq69rrspsjkpiipdhcwb0b9w5j8nhq40cnx9mgqgg";
+    })
+    (fetchpatch {
+      url = "https://sources.debian.org/data/main/c/chntpw/140201-1/debian/patches/12_readonly_filesystem";
+      sha256 = "1kxcy7f2pl6fqgmjg8bnl3pl5wgiw5xnbyx12arinmqkkggp4fa4";
+    })
+    (fetchpatch {
+      url = "https://sources.debian.org/data/main/c/chntpw/140201-1/debian/patches/13_write_to_hive";
+      sha256 = "1638lcyxjkrkmbr3n28byixny0qrxvkciw1xd97x48mj6bnwqrkv";
+    })
+    (fetchpatch {
+      url = "https://sources.debian.org/data/main/c/chntpw/140201-1/debian/patches/14_improve_description";
+      sha256 = "11y5kc4dh4zv24nkb0jw2zwlifx6nzsd4jbizn63l6dbpqgb25rs";
+    })
   ];
 
   installPhase = ''
@@ -27,6 +63,6 @@ stdenv.mkDerivation rec {
     description = "An utility to reset the password of any user that has a valid local account on a Windows system";
     maintainers = with lib.maintainers; [ deepfire ];
     license = licenses.gpl2;
-    platforms = with lib.platforms; linux;
+    platforms = lib.platforms.unix;
   };
 }
diff --git a/pkgs/tools/security/vault/vault-bin.nix b/pkgs/tools/security/vault/vault-bin.nix
index ebb70a1f6292..f29c3e493c5e 100644
--- a/pkgs/tools/security/vault/vault-bin.nix
+++ b/pkgs/tools/security/vault/vault-bin.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "vault-bin";
-  version = "1.10.0";
+  version = "1.10.1";
 
   src =
     let
@@ -16,11 +16,11 @@ stdenv.mkDerivation rec {
         aarch64-darwin = "darwin_arm64";
       };
       sha256 = selectSystem {
-        x86_64-linux = "sha256-enD/JcOmeavvUd/njbu7IksAqp9dKepVdYPkLJHA8OQ=";
-        aarch64-linux = "sha256-FDkgUqFEVJoSED/FWqOXa4BTO6AYwkLS2iZh+BkzlqA=";
-        i686-linux = "sha256-XUTWB5Ynu92SMP9Nt/0jAki6til4upKv1sdFzPbWxiw=";
-        x86_64-darwin = "sha256-QNCsbIza56NqSU7R6+Cx//WBXiEOz6CEMCjrx4AR1x8=";
-        aarch64-darwin = "sha256-LBgd8gqeU92336kypSIwMtKo7I1qB/RP2dNoIGJgq7k=";
+        x86_64-linux = "sha256-8qrCGJNEWs3I/IRK1CiGfbbpQhwziFgoQyMcUX40wbw=";
+        aarch64-linux = "sha256-/rW39m2XnJp0MsBmXs4ktRnQriLdYHRJ9MIEtO9MxNk=";
+        i686-linux = "sha256-NHIxN3rdX+3yLjbh25c1IwB+Q/QRQCrIBF9XwxIwVpY=";
+        x86_64-darwin = "sha256-2OuJZftsP+fKInhBYlcRLZ1Rs+j/jl7Ve4M6Oz3Q7Ac=";
+        aarch64-darwin = "sha256-JSu8eS4jzRl8d8MOWnAgmvO68xGzxFRn8HW28gQbzmU=";
       };
     in
     fetchzip {
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 726529e9aff1..4c8027bd36c2 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3749,7 +3749,10 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) Security;
   };
 
-  lapce = callPackage ../applications/editors/lapce { };
+  lapce = callPackage ../applications/editors/lapce {
+    inherit (darwin) libobjc;
+    inherit (darwin.apple_sdk.frameworks) Security CoreServices ApplicationServices Carbon AppKit;
+  };
 
   lcdproc = callPackage ../servers/monitoring/lcdproc { };
 
@@ -13688,6 +13691,8 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) CoreServices;
   };
 
+  devspace = callPackage ../development/tools/misc/devspace { };
+
   maturin = callPackage ../development/tools/rust/maturin {
     inherit (darwin.apple_sdk.frameworks) Security;
   };
@@ -25408,6 +25413,8 @@ with pkgs;
 
   ChowKick  = callPackage ../applications/audio/ChowKick { };
 
+  ChowPhaser  = callPackage ../applications/audio/ChowPhaser { };
+
   CHOWTapeModel = callPackage ../applications/audio/CHOWTapeModel { };
 
   chromium = callPackage ../applications/networking/browsers/chromium (config.chromium or {});
@@ -26498,6 +26505,7 @@ with pkgs;
   };
 
   git = callPackage ../applications/version-management/git-and-tools/git {
+    inherit (darwin.apple_sdk.frameworks) CoreServices Security;
     perlLibs = [perlPackages.LWP perlPackages.URI perlPackages.TermReadKey];
     smtpPerlLibs = [
       perlPackages.libnet perlPackages.NetSMTPSSL
@@ -34664,6 +34672,8 @@ with pkgs;
 
   vivid = callPackage ../tools/misc/vivid { };
 
+  vivisect = with python3Packages; toPythonApplication (vivisect.override { withGui = true; });
+
   vokoscreen = libsForQt5.callPackage ../applications/video/vokoscreen { };
 
   vokoscreen-ng = libsForQt5.callPackage ../applications/video/vokoscreen-ng {
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 2f1fe151f021..5025e836605d 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3821,6 +3821,8 @@ in {
 
   hjson = callPackage ../development/python-modules/hjson { };
 
+  hkavr = callPackage ../development/python-modules/hkavr { };
+
   hkdf = callPackage ../development/python-modules/hkdf { };
 
   hlk-sw16 = callPackage ../development/python-modules/hlk-sw16 { };
@@ -6210,6 +6212,8 @@ in {
 
   pdunehd = callPackage ../development/python-modules/pdunehd { };
 
+  pencompy = callPackage ../development/python-modules/pencompy { };
+
   pixcat = callPackage ../development/python-modules/pixcat { };
 
   pyprecice = callPackage ../development/python-modules/pyprecice { };
@@ -7497,6 +7501,8 @@ in {
 
   pyopnsense = callPackage ../development/python-modules/pyopnsense { };
 
+  pyoppleio = callPackage ../development/python-modules/pyoppleio { };
+
   pyosf = callPackage ../development/python-modules/pyosf { };
 
   pyosmium = callPackage ../development/python-modules/pyosmium {
@@ -8951,6 +8957,8 @@ in {
     python3 = python;
   });
 
+  rjpl = callPackage ../development/python-modules/rjpl { };
+
   rjsmin = callPackage ../development/python-modules/rjsmin { };
 
   rki-covid-parser = callPackage ../development/python-modules/rki-covid-parser { };
@@ -10669,7 +10677,9 @@ in {
 
   vispy = callPackage ../development/python-modules/vispy { };
 
-  vivisect = callPackage ../development/python-modules/vivisect { };
+  vivisect = callPackage ../development/python-modules/vivisect {
+    inherit (pkgs.libsForQt5) wrapQtAppsHook;
+  };
 
   viv-utils = callPackage ../development/python-modules/viv-utils { };