diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 860ac22872e4..99907a6877f8 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -69,6 +69,12 @@
       fingerprint = "F466 A548 AD3F C1F1 8C88  4576 8702 7528 B006 D66D";
     }];
   };
+  _0xB10C = {
+    email = "nixpkgs@b10c.me";
+    name = "0xB10C";
+    github = "0xb10c";
+    githubId = 19157360;
+  };
   _0xbe7a = {
     email = "nix@be7a.de";
     name = "Bela Stoyan";
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
index 6a00abf1bbd0..3a1fa9510ff9 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
@@ -961,6 +961,13 @@
           configure this behaviour.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <literal>mastodon</literal> now automatically removes remote
+          media attachments older than 30 days. This is configurable
+          through <literal>services.mastodon.mediaAutoRemove</literal>.
+        </para>
+      </listitem>
       <listitem>
         <para>
           The Redis module now disables RDB persistence when
diff --git a/nixos/doc/manual/release-notes/rl-2211.section.md b/nixos/doc/manual/release-notes/rl-2211.section.md
index e6a6ed1e14d3..771163baa32c 100644
--- a/nixos/doc/manual/release-notes/rl-2211.section.md
+++ b/nixos/doc/manual/release-notes/rl-2211.section.md
@@ -296,6 +296,8 @@ Available as [services.patroni](options.html#opt-services.patroni.enable).
 
 - ZFS module will not allow hibernation by default, this is a safety measure to prevent data loss cases like the ones described at [OpenZFS/260](https://github.com/openzfs/zfs/issues/260) and [OpenZFS/12842](https://github.com/openzfs/zfs/issues/12842). Use the `boot.zfs.allowHibernation` option to configure this behaviour.
 
+- `mastodon` now automatically removes remote media attachments older than 30 days. This is configurable through `services.mastodon.mediaAutoRemove`.
+
 - The Redis module now disables RDB persistence when `services.redis.servers.<name>.save = []` instead of using the Redis default.
 
 - Neo4j was updated from version 3 to version 4. See this [migration guide](https://neo4j.com/docs/upgrade-migration-guide/current/) on how to migrate your Neo4j instance.
@@ -372,7 +374,7 @@ Available as [services.patroni](options.html#opt-services.patroni.enable).
   [systemd.oomd.enableRootSlice](options.html#opt-systemd.oomd.enableRootSlice),
   [systemd.oomd.enableSystemSlice](options.html#opt-systemd.oomd.enableSystemSlice),
   and [systemd.oomd.enableUserServices](options.html#opt-systemd.oomd.enableUserServices).
-  
+
 - The `tt-rss` service performs two database migrations when you first use its web UI after upgrade. Consider backing up its database before updating.
 
 - The `pass-secret-service` package now includes systemd units from upstream, so adding it to the NixOS `services.dbus.packages` option will make it start automatically as a systemd user service when an application tries to talk to the libsecret D-Bus API.
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 90825aa3401f..cadcb2e99dc9 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -321,6 +321,7 @@
   ./services/backup/znapzend.nix
   ./services/blockchain/ethereum/geth.nix
   ./services/blockchain/ethereum/erigon.nix
+  ./services/blockchain/ethereum/lighthouse.nix
   ./services/backup/zrepl.nix
   ./services/cluster/corosync/default.nix
   ./services/cluster/hadoop/default.nix
diff --git a/nixos/modules/services/blockchain/ethereum/erigon.nix b/nixos/modules/services/blockchain/ethereum/erigon.nix
index 162774730976..892262d246b7 100644
--- a/nixos/modules/services/blockchain/ethereum/erigon.nix
+++ b/nixos/modules/services/blockchain/ethereum/erigon.nix
@@ -13,6 +13,15 @@ in {
     services.erigon = {
       enable = mkEnableOption (lib.mdDoc "Ethereum implementation on the efficiency frontier");
 
+      group = mkOption {
+        type = types.str;
+        default = "ethereum";
+        description = lib.mdDoc ''
+          Group of the user running the lighthouse process. This is used to share the jwt
+          secret with the execution layer.
+        '';
+      };
+
       settings = mkOption {
         description = lib.mdDoc ''
           Configuration for Erigon
@@ -55,6 +64,19 @@ in {
   };
 
   config = mkIf cfg.enable {
+    users = {
+      users.erigon = {
+        name = "erigon";
+        group = cfg.group;
+        description = "Erigon user";
+        home = "/var/lib/erigon";
+        isSystemUser = true;
+      };
+      groups = mkIf (cfg.group == "ethereum") {
+        ethereum = {};
+      };
+    };
+
     # Default values are the same as in the binary, they are just written here for convenience.
     services.erigon.settings = {
       datadir = mkDefault "/var/lib/erigon";
@@ -77,10 +99,11 @@ in {
 
       serviceConfig = {
         ExecStart = "${pkgs.erigon}/bin/erigon --config ${configFile}";
+        User = "erigon";
+        Group = cfg.group;
         Restart = "on-failure";
         StateDirectory = "erigon";
         CapabilityBoundingSet = "";
-        DynamicUser = true;
         NoNewPrivileges = true;
         PrivateTmp = true;
         ProtectHome = true;
@@ -97,7 +120,6 @@ in {
         RestrictNamespaces = true;
         LockPersonality = true;
         RemoveIPC = true;
-        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
         SystemCallFilter = [ "@system-service" "~@privileged" ];
       };
     };
diff --git a/nixos/modules/services/blockchain/ethereum/lighthouse.nix b/nixos/modules/services/blockchain/ethereum/lighthouse.nix
new file mode 100644
index 000000000000..6002b16785a7
--- /dev/null
+++ b/nixos/modules/services/blockchain/ethereum/lighthouse.nix
@@ -0,0 +1,335 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+let
+
+  cfg = config.services.lighthouse;
+in {
+
+  options = {
+    services.lighthouse = {
+      beacon = mkOption {
+        description = lib.mdDoc "Beacon node";
+        default = {};
+        type = types.submodule {
+          options = {
+            enable = lib.mkEnableOption (lib.mdDoc "Lightouse Beacon node");
+
+            dataDir = mkOption {
+              type = types.str;
+              default = "/var/lib/lighthouse-beacon";
+              description = lib.mdDoc ''
+                Directory where data will be stored. Each chain will be stored under it's own specific subdirectory.
+              '';
+            };
+
+            address = mkOption {
+              type = types.str;
+              default = "0.0.0.0";
+              description = lib.mdDoc ''
+                Listen address of Beacon node.
+              '';
+            };
+
+            port = mkOption {
+              type = types.port;
+              default = 9000;
+              description = lib.mdDoc ''
+                Port number the Beacon node will be listening on.
+              '';
+            };
+
+            openFirewall = mkOption {
+              type = types.bool;
+              default = false;
+              description = lib.mdDoc ''
+                Open the port in the firewall
+              '';
+            };
+
+            disableDepositContractSync = mkOption {
+              type = types.bool;
+              default = false;
+              description = lib.mdDoc ''
+                Explictly disables syncing of deposit logs from the execution node.
+                This overrides any previous option that depends on it.
+                Useful if you intend to run a non-validating beacon node.
+              '';
+            };
+
+            group = mkOption {
+              type = types.str;
+              default = "ethereum";
+              description = lib.mdDoc ''
+                Group of the user running the lighthouse process. This is used to share the jwt
+                secret with the execution layer.
+              '';
+            };
+
+            execution = {
+              address = mkOption {
+                type = types.str;
+                default = "127.0.0.1";
+                description = lib.mdDoc ''
+                  Listen address for the execution layer.
+                '';
+              };
+
+              port = mkOption {
+                type = types.port;
+                default = 8551;
+                description = lib.mdDoc ''
+                  Port number the Beacon node will be listening on for the execution layer.
+                '';
+              };
+
+              jwtPath = mkOption {
+                type = types.str;
+                default = "";
+                description = lib.mdDoc ''
+                  Path for the jwt secret required to connect to the execution layer.
+                '';
+              };
+            };
+
+            http = {
+              enable = lib.mkEnableOption (lib.mdDoc "Beacon node http api");
+              port = mkOption {
+                type = types.port;
+                default = 5052;
+                description = lib.mdDoc ''
+                  Port number of Beacon node RPC service.
+                '';
+              };
+
+              address = mkOption {
+                type = types.str;
+                default = "127.0.0.1";
+                description = lib.mdDoc ''
+                  Listen address of Beacon node RPC service.
+                '';
+              };
+            };
+
+            metrics = {
+              enable = lib.mkEnableOption (lib.mdDoc "Beacon node prometheus metrics");
+              address = mkOption {
+                type = types.str;
+                default = "127.0.0.1";
+                description = lib.mdDoc ''
+                  Listen address of Beacon node metrics service.
+                '';
+              };
+
+              port = mkOption {
+                type = types.port;
+                default = 5054;
+                description = lib.mdDoc ''
+                  Port number of Beacon node metrics service.
+                '';
+              };
+            };
+
+            extraArgs = mkOption {
+              type = types.str;
+              description = lib.mdDoc ''
+                Additional arguments passed to the lighthouse beacon command.
+              '';
+              default = "";
+              example = "";
+            };
+          };
+        };
+      };
+
+      validator = mkOption {
+        description = lib.mdDoc "Validator node";
+        default = {};
+        type = types.submodule {
+          options = {
+            enable = mkOption {
+              type = types.bool;
+              default = false;
+              description = lib.mdDoc "Enable Lightouse Validator node.";
+            };
+
+            dataDir = mkOption {
+              type = types.str;
+              default = "/var/lib/lighthouse-validator";
+              description = lib.mdDoc ''
+                Directory where data will be stored. Each chain will be stored under it's own specific subdirectory.
+              '';
+            };
+
+            beaconNodes = mkOption {
+              type = types.listOf types.str;
+              default = ["http://localhost:5052"];
+              description = lib.mdDoc ''
+                Beacon nodes to connect to.
+              '';
+            };
+
+            metrics = {
+              enable = lib.mkEnableOption (lib.mdDoc "Validator node prometheus metrics");
+              address = mkOption {
+                type = types.str;
+                default = "127.0.0.1";
+                description = lib.mdDoc ''
+                  Listen address of Validator node metrics service.
+                '';
+              };
+
+              port = mkOption {
+                type = types.port;
+                default = 5056;
+                description = lib.mdDoc ''
+                  Port number of Validator node metrics service.
+                '';
+              };
+            };
+
+            extraArgs = mkOption {
+              type = types.str;
+              description = lib.mdDoc ''
+                Additional arguments passed to the lighthouse validator command.
+              '';
+              default = "";
+              example = "";
+            };
+          };
+        };
+      };
+
+      network = mkOption {
+        type = types.enum [ "mainnet" "prater" "goerli" "gnosis" "kiln" "ropsten" "sepolia" ];
+        default = "mainnet";
+        description = lib.mdDoc ''
+          The network to connect to. Mainnet is the default ethereum network.
+        '';
+      };
+
+      extraArgs = mkOption {
+        type = types.str;
+        description = lib.mdDoc ''
+          Additional arguments passed to every lighthouse command.
+        '';
+        default = "";
+        example = "";
+      };
+    };
+  };
+
+  config = mkIf (cfg.beacon.enable || cfg.validator.enable) {
+
+    users = {
+      users.lighthouse-beacon = {
+        name = "lighthouse-beacon";
+        group = cfg.beacon.group;
+        description = "Lighthouse beacon node user";
+        home = "${cfg.beacon.dataDir}";
+        isSystemUser = true;
+      };
+      groups = mkIf (cfg.beacon.group == "ethereum") {
+        ethereum = {};
+      };
+    };
+
+    environment.systemPackages = [ pkgs.lighthouse ] ;
+
+    networking.firewall = mkIf cfg.beacon.enable {
+      allowedTCPPorts = mkIf cfg.beacon.openFirewall [ cfg.beacon.port ];
+      allowedUDPPorts = mkIf cfg.beacon.openFirewall [ cfg.beacon.port ];
+    };
+
+
+    systemd.services.lighthouse-beacon = mkIf cfg.beacon.enable {
+      description = "Lighthouse beacon node (connect to P2P nodes and verify blocks)";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      script = ''
+        # make sure the chain data directory is created on first run
+        mkdir -p ${cfg.beacon.dataDir}/${cfg.network}
+
+        ${pkgs.lighthouse}/bin/lighthouse beacon_node \
+          --disable-upnp \
+          ${lib.optionalString cfg.beacon.disableDepositContractSync "--disable-deposit-contract-sync"} \
+          --port ${toString cfg.beacon.port} \
+          --listen-address ${cfg.beacon.address} \
+          --network ${cfg.network} \
+          --datadir ${cfg.beacon.dataDir}/${cfg.network} \
+          --execution-endpoint http://${cfg.beacon.execution.address}:${toString cfg.beacon.execution.port} \
+          --execution-jwt ${cfg.beacon.execution.jwtPath} \
+          ${lib.optionalString cfg.beacon.http.enable '' --http --http-address ${cfg.beacon.http.address} --http-port ${toString cfg.beacon.http.port}''} \
+          ${lib.optionalString cfg.beacon.metrics.enable '' --metrics --metrics-address ${cfg.beacon.metrics.address} --metrics-port ${toString cfg.beacon.metrics.port}''} \
+          ${cfg.extraArgs} ${cfg.beacon.extraArgs}
+      '';
+      serviceConfig = {
+        User = "lighthouse-beacon";
+        Group = cfg.beacon.group;
+        Restart = "on-failure";
+        StateDirectory = "lighthouse-beacon";
+        NoNewPrivileges = true;
+        PrivateTmp = true;
+        ProtectHome = true;
+        ProtectClock = true;
+        ProtectProc = "noaccess";
+        ProcSubset = "pid";
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectControlGroups = true;
+        ProtectHostname = true;
+        RestrictSUIDSGID = true;
+        RestrictRealtime = true;
+        RestrictNamespaces = true;
+        LockPersonality = true;
+        RemoveIPC = true;
+        SystemCallFilter = [ "@system-service" "~@privileged" ];
+      };
+    };
+
+    systemd.services.lighthouse-validator = mkIf cfg.validator.enable {
+      description = "Lighthouse validtor node (manages validators, using data obtained from the beacon node via a HTTP API)";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      script = ''
+        # make sure the chain data directory is created on first run
+        mkdir -p ${cfg.validator.dataDir}/${cfg.network}
+
+        ${pkgs.lighthouse}/bin/lighthouse validator_client \
+          --network ${cfg.network} \
+          --beacon-nodes ${lib.concatStringsSep "," cfg.validator.beaconNodes} \
+          --datadir ${cfg.validator.dataDir}/${cfg.network}
+          ${optionalString cfg.validator.metrics.enable ''--metrics --metrics-address ${cfg.validator.metrics.address} --metrics-port ${toString cfg.validator.metrics.port}''} \
+          ${cfg.extraArgs} ${cfg.validator.extraArgs}
+      '';
+
+      serviceConfig = {
+        Restart = "on-failure";
+        StateDirectory = "lighthouse-validator";
+        CapabilityBoundingSet = "";
+        DynamicUser = true;
+        NoNewPrivileges = true;
+        PrivateTmp = true;
+        ProtectHome = true;
+        ProtectClock = true;
+        ProtectProc = "noaccess";
+        ProcSubset = "pid";
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectControlGroups = true;
+        ProtectHostname = true;
+        RestrictSUIDSGID = true;
+        RestrictRealtime = true;
+        RestrictNamespaces = true;
+        LockPersonality = true;
+        RemoveIPC = true;
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+        SystemCallFilter = [ "@system-service" "~@privileged" ];
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/monitoring/prometheus/default.nix b/nixos/modules/services/monitoring/prometheus/default.nix
index 7c03c188356e..892d8e537ccf 100644
--- a/nixos/modules/services/monitoring/prometheus/default.nix
+++ b/nixos/modules/services/monitoring/prometheus/default.nix
@@ -1796,6 +1796,33 @@ in
         WorkingDirectory = workingDir;
         StateDirectory = cfg.stateDir;
         StateDirectoryMode = "0700";
+        # Hardening
+        AmbientCapabilities = lib.mkIf (cfg.port < 1024) [ "CAP_NET_BIND_SERVICE" ];
+        CapabilityBoundingSet = if (cfg.port < 1024) then [ "CAP_NET_BIND_SERVICE" ] else [ "" ];
+        DeviceAllow = [ "/dev/null rw" ];
+        DevicePolicy = "strict";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "full";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
       };
     };
     # prometheus-config-reload will activate after prometheus. However, what we
diff --git a/nixos/modules/services/web-apps/mastodon.nix b/nixos/modules/services/web-apps/mastodon.nix
index dad8c3d3e38b..83890e969909 100644
--- a/nixos/modules/services/web-apps/mastodon.nix
+++ b/nixos/modules/services/web-apps/mastodon.nix
@@ -425,6 +425,39 @@ in {
           Do automatic database migrations.
         '';
       };
+
+      mediaAutoRemove = {
+        enable = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+          example = false;
+          description = lib.mdDoc ''
+            Automatically remove remote media attachments and preview cards older than the configured amount of days.
+
+            Recommended in https://docs.joinmastodon.org/admin/setup/.
+          '';
+        };
+
+        startAt = lib.mkOption {
+          type = lib.types.str;
+          default = "daily";
+          example = "hourly";
+          description = lib.mdDoc ''
+            How often to remove remote media.
+
+            The format is described in {manpage}`systemd.time(7)`.
+          '';
+        };
+
+        olderThanDays = lib.mkOption {
+          type = lib.types.int;
+          default = 30;
+          example = 14;
+          description = lib.mdDoc ''
+            How old remote media needs to be in order to be removed.
+          '';
+        };
+      };
     };
   };
 
@@ -585,6 +618,22 @@ in {
       path = with pkgs; [ file imagemagick ffmpeg ];
     };
 
+    systemd.services.mastodon-media-auto-remove = lib.mkIf cfg.mediaAutoRemove.enable {
+      description = "Mastodon media auto remove";
+      environment = env;
+      serviceConfig = {
+        Type = "oneshot";
+        script = let
+          olderThanDays = toString cfg.mediaAutoRemove.olderThanDays;
+        in ''
+          ${cfg.package}/bin/tootctl media remove --days=${olderThanDays}
+          ${cfg.package}/bin/tootctl preview_cards remove --days=${olderThanDays}
+        '';
+        EnvironmentFile = "/var/lib/mastodon/.secrets_env";
+        startAt = cfg.mediaAutoRemove.startAt;
+      } // cfgService;
+    };
+
     services.nginx = lib.mkIf cfg.configureNginx {
       enable = true;
       recommendedProxySettings = true; # required for redirections to work
diff --git a/nixos/modules/services/web-apps/wordpress.nix b/nixos/modules/services/web-apps/wordpress.nix
index 660f1b2d7f86..43a6d7e75dc6 100644
--- a/nixos/modules/services/web-apps/wordpress.nix
+++ b/nixos/modules/services/web-apps/wordpress.nix
@@ -409,6 +409,8 @@ in
       "d '${stateDir hostName}' 0750 ${user} ${webserver.group} - -"
       "d '${cfg.uploadsDir}' 0750 ${user} ${webserver.group} - -"
       "Z '${cfg.uploadsDir}' 0750 ${user} ${webserver.group} - -"
+      "d '${cfg.fontsDir}' 0750 ${user} ${webserver.group} - -"
+      "Z '${cfg.fontsDir}' 0750 ${user} ${webserver.group} - -"
     ]) eachSite);
 
     systemd.services = mkMerge [
diff --git a/nixos/modules/services/x11/display-managers/lightdm-greeters/mobile.nix b/nixos/modules/services/x11/display-managers/lightdm-greeters/mobile.nix
new file mode 100644
index 000000000000..31cc9b3deaa1
--- /dev/null
+++ b/nixos/modules/services/x11/display-managers/lightdm-greeters/mobile.nix
@@ -0,0 +1,26 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+let
+  dmcfg = config.services.xserver.displayManager;
+  ldmcfg = dmcfg.lightdm;
+  cfg = ldmcfg.greeters.mobile;
+in
+{
+  options = {
+    services.xserver.displayManager.lightdm.greeters.mobile = {
+      enable = mkEnableOption (lib.mdDoc
+        "lightdm-mobile-greeter as the lightdm greeter"
+      );
+    };
+  };
+
+  config = mkIf (ldmcfg.enable && cfg.enable) {
+    services.xserver.displayManager.lightdm.greeters.gtk.enable = false;
+
+    services.xserver.displayManager.lightdm.greeter = mkDefault {
+      package = pkgs.lightdm-mobile-greeter.xgreeters;
+      name = "lightdm-mobile-greeter";
+    };
+  };
+}
diff --git a/nixos/modules/services/x11/display-managers/lightdm.nix b/nixos/modules/services/x11/display-managers/lightdm.nix
index b0508c3b4f79..f74e8efb8f64 100644
--- a/nixos/modules/services/x11/display-managers/lightdm.nix
+++ b/nixos/modules/services/x11/display-managers/lightdm.nix
@@ -83,6 +83,7 @@ in
     ./lightdm-greeters/pantheon.nix
     ./lightdm-greeters/tiny.nix
     ./lightdm-greeters/slick.nix
+    ./lightdm-greeters/mobile.nix
     (mkRenamedOptionModule [ "services" "xserver" "displayManager" "lightdm" "autoLogin" "enable" ] [
       "services"
       "xserver"
diff --git a/pkgs/applications/backup/vorta/default.nix b/pkgs/applications/backup/vorta/default.nix
index 32d989e7a253..ad55ef1ab8c8 100644
--- a/pkgs/applications/backup/vorta/default.nix
+++ b/pkgs/applications/backup/vorta/default.nix
@@ -8,13 +8,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "vorta";
-  version = "0.8.7";
+  version = "0.8.9";
 
   src = fetchFromGitHub {
     owner = "borgbase";
     repo = "vorta";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-9SfHZbNM+lRtwLO/0dE9C4cHb3pSPkxBUITYNEdPMQw=";
+    sha256 = "sha256-5RZXHMov3CX0zRprs7sgz0+cGEdESLrg4I2glRnTkcU=";
   };
 
   nativeBuildInputs = [ wrapQtAppsHook ];
diff --git a/pkgs/applications/blockchains/btcd/default.nix b/pkgs/applications/blockchains/btcd/default.nix
new file mode 100644
index 000000000000..34a6aa1dad83
--- /dev/null
+++ b/pkgs/applications/blockchains/btcd/default.nix
@@ -0,0 +1,31 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "btcd";
+  version = "0.23.3";
+
+  src = fetchFromGitHub {
+    owner = "btcsuite";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-LdK68Ianiyrs+HVMwrkiX2ruCWKkdpuY8ylxhNbm9qI=";
+  };
+
+  vendorSha256 = "sha256-3w8rb0sfAIFCXqPXOKb4QwoLd7WsbFv3phu/rJCEjeY=";
+
+  subPackages = [ "." "cmd/*" ];
+
+  preCheck = ''
+    DIR="github.com/btcsuite/btcd/"
+    # TestCreateDefaultConfigFile requires the sample-btcd.conf in $DIR
+    mkdir -p $DIR
+    cp sample-btcd.conf $DIR
+  '';
+
+  meta = with lib; {
+    description = "An alternative full node bitcoin implementation written in Go (golang)";
+    homepage = "https://github.com/btcsuite/btcd";
+    license = licenses.isc;
+    maintainers = with maintainers; [ _0xB10C ];
+  };
+}
diff --git a/pkgs/applications/display-managers/lightdm-mobile-greeter/default.nix b/pkgs/applications/display-managers/lightdm-mobile-greeter/default.nix
new file mode 100644
index 000000000000..a4ea16aa4a78
--- /dev/null
+++ b/pkgs/applications/display-managers/lightdm-mobile-greeter/default.nix
@@ -0,0 +1,53 @@
+{ lib
+, fetchFromGitea
+, gtk3
+, libhandy_0
+, lightdm
+, lightdm-mobile-greeter
+, linkFarm
+, pkg-config
+, rustPlatform
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "lightdm-mobile-greeter";
+  version = "2022-10-30";
+
+  src = fetchFromGitea {
+    domain = "git.raatty.club";
+    owner = "raatty";
+    repo = "lightdm-mobile-greeter";
+    rev = "8c8d6dfce62799307320c8c5a1f0dd5c8c18e4d3";
+    hash = "sha256-SrAR2+An3BN/doFl/s8PcYZMUHLfVPXKZOo6ndO60nY=";
+  };
+  cargoHash = "sha256-NZ0jOkEBNa5oOydfyKm0XQB/vkAvBv9wHBbnM9egQFQ=";
+
+  buildInputs = [
+    gtk3
+    libhandy_0
+    lightdm
+  ];
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  postInstall = ''
+    mkdir -p $out/share/xgreeters
+    substitute lightdm-mobile-greeter.desktop \
+      $out/share/xgreeters/lightdm-mobile-greeter.desktop \
+      --replace lightdm-mobile-greeter $out/bin/lightdm-mobile-greeter
+  '';
+
+  passthru.xgreeters = linkFarm "lightdm-mobile-greeter-xgreeters" [{
+    path = "${lightdm-mobile-greeter}/share/xgreeters/lightdm-mobile-greeter.desktop";
+    name = "lightdm-mobile-greeter.desktop";
+  }];
+
+  meta = with lib; {
+    description = "A simple log in screen for use on touch screens";
+    homepage = "https://git.raatty.club/raatty/lightdm-mobile-greeter";
+    maintainers = with maintainers; [ colinsane ];
+    platforms = platforms.linux;
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/applications/editors/neovim/neovide/default.nix b/pkgs/applications/editors/neovim/neovide/default.nix
index 3d1aa9cdc57c..3a32516b7d3c 100644
--- a/pkgs/applications/editors/neovim/neovide/default.nix
+++ b/pkgs/applications/editors/neovim/neovide/default.nix
@@ -31,16 +31,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "neovide";
-  version = "0.10.1";
+  version = "0.10.3";
 
   src = fetchFromGitHub {
     owner = "Kethku";
     repo = "neovide";
     rev = version;
-    sha256 = "sha256-PViSiK6+H79MLIOFe26cNqUZ6gZdqDC/S+ksTrbOm54=";
+    sha256 = "sha256-CcBiCcfOJzuq0DnokTUHpMdo7Ry29ugQ+N7Hk0R+cQE=";
   };
 
-  cargoSha256 = "sha256-GvueDUY4Hzfih/MyEfhdz/QNVd9atTC8SCF+PyuJJic=";
+  cargoSha256 = "sha256-bS7yBnxAWPoTTabxI6W5Knl1DFiDztYSkEPJMa8bqlY=";
 
   SKIA_SOURCE_DIR =
     let
diff --git a/pkgs/applications/misc/fuzzel/default.nix b/pkgs/applications/misc/fuzzel/default.nix
index 421f98b1fb62..162b6362fd7d 100644
--- a/pkgs/applications/misc/fuzzel/default.nix
+++ b/pkgs/applications/misc/fuzzel/default.nix
@@ -25,14 +25,14 @@ assert svgSupport -> enableCairo;
 
 stdenv.mkDerivation rec {
   pname = "fuzzel";
-  version = "1.7.0";
+  version = "1.8.2";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "dnkl";
     repo = "fuzzel";
     rev = version;
-    sha256 = "1261gwxiky37pvzmmbrpml1psa22kkglb141ybj1fbnwg6j7jvlf";
+    sha256 = "sha256-5uXf5HfQ8bDQSMNCHHaC9sCX5P/D89T2ZOUiXTDx3bQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/mangal/default.nix b/pkgs/applications/misc/mangal/default.nix
index f4c7869f152c..1c7840be855a 100644
--- a/pkgs/applications/misc/mangal/default.nix
+++ b/pkgs/applications/misc/mangal/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "mangal";
-  version = "4.0.1";
+  version = "4.0.2";
 
   src = fetchFromGitHub {
     owner = "metafates";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-pMiZgO/+koyIDm7ONZn0qEq+d6HeFfQFaU1Qjovqmc4=";
+    hash = "sha256-ssvd8gdF5h6EKLY/W+1zbZWcVQqy+UirIS0p0DBQj0E=";
   };
 
   proxyVendor = true;
diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index 007714644374..185974539a1f 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -3,7 +3,7 @@ let
   versions = if stdenv.isLinux then {
     stable = "0.0.21";
     ptb = "0.0.34";
-    canary = "0.0.142";
+    canary = "0.0.143";
   } else {
     stable = "0.0.264";
     ptb = "0.0.59";
@@ -22,7 +22,7 @@ let
       };
       canary = fetchurl {
         url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        sha256 = "sha256-/EWJC3hFIBqwHa9z4nMWR7CpoaqYY+pvw+1vcq4F0LU=";
+        sha256 = "sha256-K+yyg9GTAvggfn4JQCTmq016tMyyzq+nD7aL3+bWFlo=";
       };
     };
     x86_64-darwin = {
diff --git a/pkgs/applications/science/math/gmsh/default.nix b/pkgs/applications/science/math/gmsh/default.nix
index 03a427e06cc2..22eee8b305a5 100644
--- a/pkgs/applications/science/math/gmsh/default.nix
+++ b/pkgs/applications/science/math/gmsh/default.nix
@@ -5,11 +5,11 @@ assert (!blas.isILP64) && (!lapack.isILP64);
 
 stdenv.mkDerivation rec {
   pname = "gmsh";
-  version = "4.10.5";
+  version = "4.11.0";
 
   src = fetchurl {
     url = "https://gmsh.info/src/gmsh-${version}-source.tgz";
-    sha256 = "sha256-zAMMWu5l59WPhQuLb1WmiUXIm8hx+U4SOSefWiEPxOo=";
+    sha256 = "sha256-PPLyRFXuCSUsmeZNTmRilW5o8P8fN7rKC3jICdbMVXo=";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/virtualization/OVMF/default.nix b/pkgs/applications/virtualization/OVMF/default.nix
index 9a4276997b8e..1e2e8c764a9e 100644
--- a/pkgs/applications/virtualization/OVMF/default.nix
+++ b/pkgs/applications/virtualization/OVMF/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, nixosTests, lib, edk2, util-linux, nasm, acpica-tools
+{ stdenv, nixosTests, lib, edk2, util-linux, nasm, acpica-tools, llvmPackages
 , csmSupport ? false, seabios ? null
 , secureBoot ? false
 , httpSupport ? false
@@ -33,7 +33,8 @@ edk2.mkDerivation projectDscPath (finalAttrs: {
 
   outputs = [ "out" "fd" ];
 
-  nativeBuildInputs = [ util-linux nasm acpica-tools ];
+  nativeBuildInputs = [ util-linux nasm acpica-tools ]
+    ++ lib.optionals stdenv.cc.isClang [ llvmPackages.bintools llvmPackages.llvm ];
   strictDeps = true;
 
   hardeningDisable = [ "format" "stackprotector" "pic" "fortify" ];
@@ -44,6 +45,8 @@ edk2.mkDerivation projectDscPath (finalAttrs: {
     ++ lib.optionals httpSupport [ "-D NETWORK_HTTP_ENABLE=TRUE" "-D NETWORK_HTTP_BOOT_ENABLE=TRUE" ]
     ++ lib.optionals tpmSupport [ "-D TPM_ENABLE" "-D TPM2_ENABLE" "-D TPM2_CONFIG_ENABLE"];
 
+  NIX_CFLAGS_COMPILE = lib.optional stdenv.cc.isClang "-Qunused-arguments";
+
   postPatch = lib.optionalString csmSupport ''
     cp ${seabios}/Csm16.bin OvmfPkg/Csm/Csm16/Csm16.bin
   '';
diff --git a/pkgs/applications/virtualization/crun/default.nix b/pkgs/applications/virtualization/crun/default.nix
index 3bd766e7ae94..810fefa2863f 100644
--- a/pkgs/applications/virtualization/crun/default.nix
+++ b/pkgs/applications/virtualization/crun/default.nix
@@ -38,13 +38,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "crun";
-  version = "1.6";
+  version = "1.7";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = pname;
     rev = version;
-    sha256 = "sha256-JO07bF2Xucz8lSvj7om17a/NT0I7Vru1vayZhPDFLIw=";
+    sha256 = "sha256-Ly6GBR7nF7J5Dwe1jrQxR4XYsao7KxBAxGn8fsJwmMs=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/window-managers/eww/default.nix b/pkgs/applications/window-managers/eww/default.nix
index 6420b79072f0..4e74fcd26e77 100644
--- a/pkgs/applications/window-managers/eww/default.nix
+++ b/pkgs/applications/window-managers/eww/default.nix
@@ -3,6 +3,7 @@
 , fetchFromGitHub
 , pkg-config
 , gtk3
+, gdk-pixbuf
 , withWayland ? false
 , gtk-layer-shell
 , stdenv
@@ -25,7 +26,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ gtk3 ] ++ lib.optional withWayland gtk-layer-shell;
+  buildInputs = [ gtk3 gdk-pixbuf ] ++ lib.optional withWayland gtk-layer-shell;
 
   buildNoDefaultFeatures = withWayland;
   buildFeatures = lib.optional withWayland "wayland";
diff --git a/pkgs/desktops/cinnamon/cinnamon-gsettings-overrides/default.nix b/pkgs/desktops/cinnamon/cinnamon-gsettings-overrides/default.nix
index a8d46d578996..30caaaf6e3df 100644
--- a/pkgs/desktops/cinnamon/cinnamon-gsettings-overrides/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-gsettings-overrides/default.nix
@@ -2,6 +2,7 @@
 , runCommand
 , nixos-artwork
 , glib
+, gnome
 , gtk3
 , gsettings-desktop-schemas
 , extraGSettingsOverrides ? ""
@@ -35,9 +36,20 @@ let
     cinnamon-session
     cinnamon-settings-daemon
     cinnamon-common
+    gnome.gnome-terminal
     gtk3
   ] ++ extraGSettingsOverridePackages;
 
+  gsettingsOverrides = ''
+    # Use Fedora's default to make text readable and
+    # restore ununified menu.
+    # https://github.com/NixOS/nixpkgs/issues/200017
+    [org.gnome.Terminal.Legacy.Settings]
+    theme-variant='dark'
+    unified-menu=false
+
+    ${extraGSettingsOverrides}
+  '';
 in
 
 # TODO: Having https://github.com/NixOS/nixpkgs/issues/54150 would supersede this
@@ -53,7 +65,7 @@ runCommand "cinnamon-gsettings-overrides" { preferLocalBuild = true; }
     chmod -R a+w "$data_dir"
 
     cat - > "$schema_dir/nixos-defaults.gschema.override" <<- EOF
-    ${extraGSettingsOverrides}
+    ${gsettingsOverrides}
     EOF
 
     ${glib.dev}/bin/glib-compile-schemas --strict "$schema_dir"
diff --git a/pkgs/development/compilers/edk2/default.nix b/pkgs/development/compilers/edk2/default.nix
index d51601404868..8ce4322a12e9 100644
--- a/pkgs/development/compilers/edk2/default.nix
+++ b/pkgs/development/compilers/edk2/default.nix
@@ -61,7 +61,7 @@ edk2 = buildStdenv.mkDerivation {
   ${"GCC5_${targetArch}_PREFIX"}=stdenv.cc.targetPrefix;
 
   makeFlags = [ "-C BaseTools" ]
-    ++ lib.optionals (stdenv.cc.isClang) [ "BUILD_CC=clang BUILD_CXX=clang++ BUILD_AS=clang" ];
+    ++ lib.optionals (stdenv.cc.isClang) [ "CXX=llvm BUILD_AR=ar BUILD_CC=clang BUILD_CXX=clang++ BUILD_AS=clang BUILD_LD=ld" ];
 
   NIX_CFLAGS_COMPILE = "-Wno-return-type" + lib.optionalString (stdenv.cc.isGNU) " -Wno-error=stringop-truncation";
 
diff --git a/pkgs/development/compilers/openjdk/meta.nix b/pkgs/development/compilers/openjdk/meta.nix
index c66ecc29cf51..0fbd9eff3e4c 100644
--- a/pkgs/development/compilers/openjdk/meta.nix
+++ b/pkgs/development/compilers/openjdk/meta.nix
@@ -5,7 +5,7 @@ lib: version: with lib; {
   maintainers = with maintainers; [ edwtjo asbachb ];
   platforms = [ "i686-linux" "x86_64-linux" "aarch64-linux" "armv7l-linux" "armv6l-linux" ];
   mainProgram = "java";
-  knownVulnerabilities = optionals (builtins.elem (versions.major version) [ "12" "13" "14" "15" "16" ]) [
+  knownVulnerabilities = optionals (builtins.elem (versions.major version) [ "12" "13" "14" "15" "16" "18" ]) [
     "This OpenJDK version has reached its end of life."
   ];
 }
diff --git a/pkgs/development/libraries/SDL2/default.nix b/pkgs/development/libraries/SDL2/default.nix
index 9900d8874b25..a38761ed7c50 100644
--- a/pkgs/development/libraries/SDL2/default.nix
+++ b/pkgs/development/libraries/SDL2/default.nix
@@ -59,11 +59,11 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "SDL2";
-  version = "2.24.0";
+  version = "2.24.2";
 
   src = fetchurl {
     url = "https://www.libsdl.org/release/${pname}-${version}.tar.gz";
-    sha256 = "sha256-keTDSxdo+S05mweOFxRIxq8Yyv2nQ5h+0gZKKJVNbZc=";
+    sha256 = "sha256-s17wqAKwnZDtOt0NysDpWCCAQgKRT1u3sP63EPGhMp8=";
   };
   dontDisableStatic = if withStatic then 1 else 0;
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/aspell/dictionaries.nix b/pkgs/development/libraries/aspell/dictionaries.nix
index c0d9d87aa422..74caec57c2d8 100644
--- a/pkgs/development/libraries/aspell/dictionaries.nix
+++ b/pkgs/development/libraries/aspell/dictionaries.nix
@@ -105,6 +105,26 @@ let
         homepage = "http://ftp.gnu.org/gnu/aspell/dict/0index.html";
       } // (args.meta or {});
 
+    } // lib.optionalAttrs (stdenv.isDarwin && elem language [ "is" "nb" ]) {
+      # tar: Cannot open: Illegal byte sequence
+      unpackPhase = ''
+        runHook preUnpack
+
+        tar -xf $src --strip-components=1 || true
+
+        runHook postUnpack
+      '';
+
+      postPatch = getAttr language {
+        is = ''
+          cp icelandic.alias íslenska.alias
+          sed -i 's/ .slenska\.alias/ íslenska.alias/g' Makefile.pre
+        '';
+        nb = ''
+          cp bokmal.alias bokmål.alias
+          sed -i 's/ bokm.l\.alias/ bokmål.alias/g' Makefile.pre
+        '';
+      };
     } // removeAttrs args [ "language" "filename" "sha256" "meta" ];
     in buildDict buildArgs;
 
diff --git a/pkgs/development/libraries/lzlib/default.nix b/pkgs/development/libraries/lzlib/default.nix
index 7ddf4fa5f178..4e28fc3a5b0d 100644
--- a/pkgs/development/libraries/lzlib/default.nix
+++ b/pkgs/development/libraries/lzlib/default.nix
@@ -12,6 +12,10 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-3ea9WzJTXxeyjJrCS2ZgfgJQUGrBQypBEso8c/XWYsM=";
   };
 
+  postPatch = lib.optionalString stdenv.isDarwin ''
+    substituteInPlace Makefile.in --replace '-Wl,--soname=' '-Wl,-install_name,$(out)/lib/'
+  '';
+
   makeFlags = [ "CC:=$(CC)" ];
   doCheck = true;
 
diff --git a/pkgs/development/lisp-modules-new/ql.nix b/pkgs/development/lisp-modules-new/ql.nix
index 8e06ef75a1f6..4ffce7a8d769 100644
--- a/pkgs/development/lisp-modules-new/ql.nix
+++ b/pkgs/development/lisp-modules-new/ql.nix
@@ -60,6 +60,9 @@ let
     trivial-ssh-libssh2 = pkg: {
       nativeLibs = [ libssh2 ];
     };
+    mssql = pkg: {
+      nativeLibs = [ freetds ];
+    };
     sqlite = pkg: {
       nativeLibs = [ sqlite ];
     };
diff --git a/pkgs/development/ocaml-modules/ppx_yojson_conv/default.nix b/pkgs/development/ocaml-modules/ppx_yojson_conv/default.nix
new file mode 100644
index 000000000000..3feeaa84ab47
--- /dev/null
+++ b/pkgs/development/ocaml-modules/ppx_yojson_conv/default.nix
@@ -0,0 +1,34 @@
+{
+  lib,
+  buildDunePackage,
+  fetchFromGitHub,
+  ppx_js_style,
+  ppx_yojson_conv_lib,
+  ppxlib,
+}:
+buildDunePackage rec {
+  pname = "ppx_yojson_conv";
+  version = "0.15.1";
+  duneVersion = "3";
+  minimumOCamlVersion = "4.08.0";
+
+  src = fetchFromGitHub {
+    owner = "janestreet";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-lSOUSMVgsRiArEhFTKpAj2yFBPbtaIc/SxdPA+24xXs=";
+  };
+
+  propagatedBuildInputs = [
+    ppx_js_style
+    ppx_yojson_conv_lib
+    ppxlib
+  ];
+
+  meta = with lib; {
+    description = "A PPX syntax extension that generates code for converting OCaml types to and from Yojson";
+    homepage = "https://github.com/janestreet/ppx_yojson_conv";
+    maintainers = with maintainers; [djacu];
+    license = with licenses; [mit];
+  };
+}
diff --git a/pkgs/development/php-packages/deployer/default.nix b/pkgs/development/php-packages/deployer/default.nix
index 661a6310958c..bd15bb7db856 100644
--- a/pkgs/development/php-packages/deployer/default.nix
+++ b/pkgs/development/php-packages/deployer/default.nix
@@ -30,6 +30,7 @@ mkDerivation rec {
     description = "A deployment tool for PHP";
     license = licenses.mit;
     homepage = "https://deployer.org/";
+    mainProgram = "dep";
     maintainers = with maintainers; teams.php.members;
   };
 }
diff --git a/pkgs/development/python-modules/amaranth/default.nix b/pkgs/development/python-modules/amaranth/default.nix
index 938b44202b9b..5a3f7e449e23 100644
--- a/pkgs/development/python-modules/amaranth/default.nix
+++ b/pkgs/development/python-modules/amaranth/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
+, fetchpatch
 , setuptools
 , setuptools-scm
 , pyvcd
@@ -31,6 +32,23 @@ buildPythonPackage rec {
     sha256 = "P9AG3t30eGeeCN5+t7mjhRoOWIGZVzWQji9eYXphjA0=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "fix-for-setuptools-64.0.2-preparation.patch";
+      url = "https://github.com/amaranth-lang/amaranth/commit/64771a065a280fa683c1e6692383bec4f59f20fa.patch";
+      hash = "sha256-Rsh9vVvUQj9nIcrsRirmR6XwFrfZ2VMaYJ4RCQ8sBE0=";
+      # This commit removes support for Python 3.6, which is unnecessary to fix
+      # the build when using new setuptools. Include only one file, which has a
+      # harmless comment change so that the subsequent patch applies cleanly.
+      includes = ["amaranth/_toolchain/cxx.py"];
+    })
+    (fetchpatch {
+      name = "fix-for-setuptools-64.0.2.patch";
+      url = "https://github.com/amaranth-lang/amaranth/pull/722/commits/e5a56b07c568e5f4cc2603eefebd14c5cc4e13d8.patch";
+      hash = "sha256-C8FyMSKHA7XsEMpO9eYNZx/X5rGaK7p3eXP+jSb6wVg=";
+    })
+  ];
+
   SETUPTOOLS_SCM_PRETEND_VERSION="${realVersion}";
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/construct-classes/default.nix b/pkgs/development/python-modules/construct-classes/default.nix
new file mode 100644
index 000000000000..479f0703118f
--- /dev/null
+++ b/pkgs/development/python-modules/construct-classes/default.nix
@@ -0,0 +1,41 @@
+{ lib
+, stdenv
+, buildPythonPackage
+, fetchFromGitHub
+, poetry-core
+, construct
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname   = "construct-classes";
+  version = "0.1.2";
+  format = "pyproject";
+
+  # no tests in PyPI tarball
+  src = fetchFromGitHub {
+    owner  = "matejcik";
+    repo   = "construct-classes";
+    rev    = "v${version}";
+    sha256 = "sha256-l4sVacKTuQbhXCw2lVHCl1OzpCiKmEAm9nSQ8pxFuTo=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    construct
+  ];
+
+  checkInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "construct_classes" ];
+
+  meta = with lib; {
+    description = "Parse your binary data into dataclasses.";
+    homepage = "https://github.com/matejcik/construct-classes";
+    license = licenses.mit;
+    maintainers = with maintainers; [ prusnak ];
+  };
+}
diff --git a/pkgs/development/python-modules/sh/default.nix b/pkgs/development/python-modules/sh/default.nix
index d6334251bff4..17dcc5acbee0 100644
--- a/pkgs/development/python-modules/sh/default.nix
+++ b/pkgs/development/python-modules/sh/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchPypi, python, coverage, lsof, glibcLocales, coreutils }:
+{ lib, stdenv, buildPythonPackage, fetchPypi, python, coverage, lsof, glibcLocales, coreutils, pytestCheckHook }:
 
 buildPythonPackage rec {
   pname = "sh";
@@ -9,17 +9,12 @@ buildPythonPackage rec {
     sha256 = "sha256-5ARbbHMtnOddVxx59awiNO3Zrk9fqdWbCXBQgr3KGMc=";
   };
 
-  patches = [
-    # Disable tests that fail on Darwin sandbox
-    ./disable-broken-tests-darwin.patch
-  ];
-
   postPatch = ''
     sed -i 's#/usr/bin/env python#${python.interpreter}#' test.py
     sed -i 's#/bin/sleep#${coreutils.outPath}/bin/sleep#' test.py
   '';
 
-  checkInputs = [ coverage lsof glibcLocales ];
+  checkInputs = [ coverage lsof glibcLocales pytestCheckHook ];
 
   # A test needs the HOME directory to be different from $TMPDIR.
   preCheck = ''
@@ -27,6 +22,21 @@ buildPythonPackage rec {
     HOME=$(mktemp -d)
   '';
 
+  pytestFlagsArray = [ "test.py" ];
+
+  disabledTests = [
+    # Disable tests that fail on Hydra
+    "test_no_fd_leak"
+    "test_piped_exception1"
+    "test_piped_exception2"
+    "test_unicode_path"
+  ] ++ lib.optionals stdenv.isDarwin [
+    # Disable tests that fail on Darwin sandbox
+    "test_background_exception"
+    "test_cwd"
+    "test_ok_code"
+  ];
+
   meta = with lib; {
     description = "Python subprocess interface";
     homepage = "https://pypi.python.org/pypi/sh/";
diff --git a/pkgs/development/python-modules/sh/disable-broken-tests-darwin.patch b/pkgs/development/python-modules/sh/disable-broken-tests-darwin.patch
deleted file mode 100644
index dfeb50db8d0e..000000000000
--- a/pkgs/development/python-modules/sh/disable-broken-tests-darwin.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From c596ad546fe7460b57a62799837757eb641309c1 Mon Sep 17 00:00:00 2001
-From: Sirio Balmelli <sirio@b-ad.ch>
-Date: Mon, 20 Jul 2020 19:51:20 +0200
-Subject: [PATCH] Disable tests that fail on Darwin (macOS) or with sandboxing
-
-Signed-off-by: Sirio Balmelli <sirio@b-ad.ch>
---- a/test.py
-+++ b/test.py
-@@ -377,6 +377,7 @@ exit(3)
-         self.assertEqual(sed(_in="one test three", e="s/test/two/").strip(),
-                          "one two three")
- 
-+    @not_macos
-     def test_ok_code(self):
-         from sh import ls, ErrorReturnCode_1, ErrorReturnCode_2
- 
-@@ -982,6 +983,7 @@ print(sys.argv[1])
-         now = time.time()
-         self.assertGreater(now - start, sleep_time)
- 
-+    @not_macos
-     def test_background_exception(self):
-         from sh import ls, ErrorReturnCode_1, ErrorReturnCode_2
-         p = ls("/ofawjeofj", _bg=True, _bg_exc=False)  # should not raise
-@@ -1779,6 +1781,7 @@ exit(49)
-         p = python(py.name, _ok_code=49, _bg=True)
-         self.assertEqual(49, p.exit_code)
- 
-+    @not_macos
-     def test_cwd(self):
-         from sh import pwd
-         from os.path import realpath
-@@ -2777,6 +2780,7 @@ print("cool")
-     # on osx.  so skip it for now if osx
-     @not_macos
-     @requires_progs("lsof")
-+    @skipUnless(False, "Flaky on Hydra")
-     def test_no_fd_leak(self):
-         import sh
-         import os
-@@ -2879,6 +2883,7 @@ print("hi")
-         python(py.name, _in=stdin)
- 
-     @requires_utf8
-+    @skipUnless(False, "Does not work in sandbox")
-     def test_unicode_path(self):
-         from sh import Command
- 
diff --git a/pkgs/development/python-modules/trezor/default.nix b/pkgs/development/python-modules/trezor/default.nix
index b4a2925a4155..ae9778d91039 100644
--- a/pkgs/development/python-modules/trezor/default.nix
+++ b/pkgs/development/python-modules/trezor/default.nix
@@ -7,6 +7,7 @@
 , attrs
 , click
 , construct
+, construct-classes
 , ecdsa
 , hidapi
 , libusb1
@@ -24,13 +25,13 @@
 
 buildPythonPackage rec {
   pname = "trezor";
-  version = "0.13.3";
+  version = "0.13.4";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "055d32174d4ecf2353f7622ee44b8e82e3bef78fe40ce5cdbeafc785b422a049";
+    sha256 = "04a77b44005971819386bbd55242a1004b1f88fbbdb829deb039a1e0028a4af1";
   };
 
   nativeBuildInputs = [ installShellFiles ];
@@ -39,6 +40,7 @@ buildPythonPackage rec {
     attrs
     click
     construct
+    construct-classes
     ecdsa
     hidapi
     libusb1
@@ -58,6 +60,7 @@ buildPythonPackage rec {
 
   disabledTestPaths = [
     "tests/test_stellar.py" # requires stellar-sdk
+    "tests/test_firmware.py" # requires network downloads
   ];
 
   pythonImportsCheck = [ "trezorlib" ];
diff --git a/pkgs/development/python-modules/zeroconf/default.nix b/pkgs/development/python-modules/zeroconf/default.nix
index 7049f5afc965..6bc6b7888d8c 100644
--- a/pkgs/development/python-modules/zeroconf/default.nix
+++ b/pkgs/development/python-modules/zeroconf/default.nix
@@ -28,6 +28,9 @@ buildPythonPackage rec {
     ifaddr
   ];
 
+  # OSError: [Errno 48] Address already in use
+  doCheck = !stdenv.isDarwin;
+
   checkInputs = [
     pytest-asyncio
     pytestCheckHook
diff --git a/pkgs/development/tools/buf/buf-tests-dont-use-file-transport.patch b/pkgs/development/tools/buf/buf-tests-dont-use-file-transport.patch
new file mode 100644
index 000000000000..a26f41d71974
--- /dev/null
+++ b/pkgs/development/tools/buf/buf-tests-dont-use-file-transport.patch
@@ -0,0 +1,51 @@
+commit e9219b88de5ed37af337ee2d2e71e7ec7c0aad1b
+Author: Robbert van Ginkel <rvanginkel@buf.build>
+Date:   Thu Oct 20 16:43:28 2022 -0400
+
+    Fix git unit test by using fake git server rather than file:// (#1518)
+    
+    More recent versions of git fix a CVE by disabling some usage of the
+    `file://` transport, see
+    https://github.blog/2022-10-18-git-security-vulnerabilities-announced/#cve-2022-39253.
+    We were using this transport in tests.
+    
+    Instead, use https://git-scm.com/docs/git-http-backend to serve up this
+    repository locally so we don't have to use the file protocol. This
+    should be a more accurate tests, since we mostly expect submodules to
+    come from servers.
+
+diff --git a/private/pkg/git/git_test.go b/private/pkg/git/git_test.go
+index 7b77b6cd..7132054e 100644
+--- a/private/pkg/git/git_test.go
++++ b/private/pkg/git/git_test.go
+@@ -17,6 +17,8 @@ package git
+ import (
+ 	"context"
+ 	"errors"
++	"net/http/cgi"
++	"net/http/httptest"
+ 	"os"
+ 	"os/exec"
+ 	"path/filepath"
+@@ -213,6 +215,21 @@ func createGitDirs(
+ 	runCommand(ctx, t, container, runner, "git", "-C", submodulePath, "add", "test.proto")
+ 	runCommand(ctx, t, container, runner, "git", "-C", submodulePath, "commit", "-m", "commit 0")
+ 
++	gitExecPath, err := command.RunStdout(ctx, container, runner, "git", "--exec-path")
++	require.NoError(t, err)
++	t.Log(filepath.Join(string(gitExecPath), "git-http-backend"))
++	// https://git-scm.com/docs/git-http-backend#_description
++	f, err := os.Create(filepath.Join(submodulePath, ".git", "git-daemon-export-ok"))
++	require.NoError(t, err)
++	require.NoError(t, f.Close())
++	server := httptest.NewServer(&cgi.Handler{
++		Path: filepath.Join(strings.TrimSpace(string(gitExecPath)), "git-http-backend"),
++		Dir:  submodulePath,
++		Env:  []string{"GIT_PROJECT_ROOT=" + submodulePath},
++	})
++	t.Cleanup(server.Close)
++	submodulePath = server.URL
++
+ 	originPath := filepath.Join(tmpDir, "origin")
+ 	require.NoError(t, os.MkdirAll(originPath, 0777))
+ 	runCommand(ctx, t, container, runner, "git", "-C", originPath, "init")
diff --git a/pkgs/development/tools/buf/default.nix b/pkgs/development/tools/buf/default.nix
index 5d5e4084085d..28e568338567 100644
--- a/pkgs/development/tools/buf/default.nix
+++ b/pkgs/development/tools/buf/default.nix
@@ -26,6 +26,9 @@ buildGoModule rec {
     ./skip_test_requiring_network.patch
     # Skip TestWorkspaceGit which requires .git and commits.
     ./skip_test_requiring_dotgit.patch
+    # Remove reliance of tests on file protocol which is disabled in git by default now
+    # Rebased upstream change https://github.com/bufbuild/buf/commit/bcaa77f8bbb8f6c198154c7c8d53596da4506dab
+    ./buf-tests-dont-use-file-transport.patch
   ];
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/development/tools/electron/generic.nix b/pkgs/development/tools/electron/generic.nix
index 97e7fb520346..8c64b86b43a1 100644
--- a/pkgs/development/tools/electron/generic.nix
+++ b/pkgs/development/tools/electron/generic.nix
@@ -31,7 +31,7 @@ let
       ++ optionals (versionAtLeast version "11.0.0") [ "aarch64-darwin" ]
       ++ optionals (versionOlder version "19.0.0") [ "i686-linux" ];
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    knownVulnerabilities = optional (versionOlder version "15.0.0") "Electron version ${version} is EOL";
+    knownVulnerabilities = optional (versionOlder version "18.0.0") "Electron version ${version} is EOL";
   };
 
   fetcher = vers: tag: hash: fetchurl {
diff --git a/pkgs/development/tools/esbuild/netlify.nix b/pkgs/development/tools/esbuild/netlify.nix
index efd5b917e9cd..6520c53dd1f4 100644
--- a/pkgs/development/tools/esbuild/netlify.nix
+++ b/pkgs/development/tools/esbuild/netlify.nix
@@ -1,4 +1,9 @@
-{ buildGoModule, fetchFromGitHub, lib }:
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, fetchpatch
+, netlify-cli
+}:
 
 buildGoModule rec {
   pname = "esbuild";
@@ -11,7 +16,25 @@ buildGoModule rec {
     sha256 = "0asjmqfzdrpfx2hd5hkac1swp52qknyqavsm59j8xr4c1ixhc6n9";
   };
 
-  vendorSha256 = "sha256-2ABWPqhK2Cf4ipQH7XvRrd+ZscJhYPc3SV2cGT0apdg=";
+  vendorSha256 = "sha256-+BfxCyg0KkDQpHt/wycy/8CTG6YBA/VJvJFhhzUnSiQ=";
+
+  patches = [
+    # Both upstream patches update the same dependency "x/sys". It's required for darwin compatibility.
+    (fetchpatch {
+      url = "https://github.com/evanw/esbuild/commit/2567e099fcc6959e630f100b2c737ca80e88ba82.patch";
+      hash = "sha256-KdX/Ru9TBX0mSDaS1ijxgzDI+2AoCvt6Wilhpca3VC0=";
+    })
+    (fetchpatch {
+      url = "https://github.com/evanw/esbuild/commit/fd13718c6195afb9e63682476a774fa6d4483be0.patch";
+      hash = "sha256-va/bXRBQf9qgE9LZXcKKAa0ZpMt/QG7BFClJ8bPWG1Y=";
+    })
+  ];
+
+  passthru = {
+    tests = {
+      inherit netlify-cli;
+    };
+  };
 
   meta = with lib; {
     description = "A fork of esbuild maintained by netlify";
diff --git a/pkgs/development/tools/gllvm/default.nix b/pkgs/development/tools/gllvm/default.nix
index 460f59dc3d0e..d2d7e523a94f 100644
--- a/pkgs/development/tools/gllvm/default.nix
+++ b/pkgs/development/tools/gllvm/default.nix
@@ -1,18 +1,23 @@
-{ lib, buildGoPackage, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub, llvmPackages, getconf }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "gllvm";
-  version = "1.3.0";
-
-  goPackagePath = "github.com/SRI-CSL/gllvm";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "SRI-CSL";
     repo = "gllvm";
     rev = "v${version}";
-    sha256 = "sha256-nu6PRFk+GoN1gT1RTbX6mTPZByAGf0bSsj2C5YriGp8=";
+    sha256 = "sha256-CoreqnMRuPuv+Ci1uyF3HJCJFwK2jwB79okynv6AHTA=";
   };
 
+  vendorSha256 = "sha256-pQpattmS9VmO3ZIQUFn66az8GSmB4IvYhTTCFn6SUmo=";
+
+  checkInputs = with llvmPackages; [
+    clang
+    llvm
+  ] ++ lib.optionals stdenv.isDarwin [ getconf ];
+
   meta = with lib; {
     homepage = "https://github.com/SRI-CSL/gllvm";
     description = "Whole Program LLVM: wllvm ported to go";
diff --git a/pkgs/development/tools/nil/default.nix b/pkgs/development/tools/nil/default.nix
index 29a4a4c425bd..c943d4715e57 100644
--- a/pkgs/development/tools/nil/default.nix
+++ b/pkgs/development/tools/nil/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nil";
-  version = "2022-10-03";
+  version = "2022-11-07";
 
   src = fetchFromGitHub {
     owner = "oxalica";
     repo = pname;
     rev = version;
-    hash = "sha256-Oo0y/333YyeW9zeYQyiUUay7q7GK/Uu/FdEa6+5c4Pk=";
+    hash = "sha256-ioY9RvKx9DKnNTeMW8mAIEq23w7Y+lAOFWMkgUQ5fu4=";
   };
 
-  cargoHash = "sha256-z7wjap7IL2OTd2wEUB6EbSbP71dZiqbKDmJ7oUjVi0U=";
+  cargoHash = "sha256-sL/bnLK3TifmVHy3LOsduETHh9SGz639vgEKkbHE0HQ=";
 
   CFG_DATE = version;
   CFG_REV = "release";
diff --git a/pkgs/development/tools/yamlpath/default.nix b/pkgs/development/tools/yamlpath/default.nix
index 60cb97511bbf..55e86e42da4a 100644
--- a/pkgs/development/tools/yamlpath/default.nix
+++ b/pkgs/development/tools/yamlpath/default.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "yamlpath";
-  version = "3.6.8";
+  version = "3.6.9";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "wwkimball";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-g4Pw0IWLY/9nG2eqbiknWCZjJNGbmV42KEviIENXYYA=";
+    sha256 = "sha256-0r1jlDWlYPIjUEudHbwt324rt0H8K3PUb7RILoxNNnw=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/servers/roundcube/plugins/contextmenu/default.nix b/pkgs/servers/roundcube/plugins/contextmenu/default.nix
new file mode 100644
index 000000000000..90f130a83f94
--- /dev/null
+++ b/pkgs/servers/roundcube/plugins/contextmenu/default.nix
@@ -0,0 +1,11 @@
+{ roundcubePlugin, fetchzip }:
+
+roundcubePlugin rec {
+  pname = "contextmenu";
+  version = "3.3.1";
+
+  src = fetchzip {
+    url = "https://github.com/johndoh/roundcube-contextmenu/archive/refs/tags/${version}.tar.gz";
+    sha256 = "0aya3nv8jwfvd9rlvxfxnyfpdcpw858745xal362l3zzkbkhcrmb";
+  };
+}
diff --git a/pkgs/servers/roundcube/plugins/plugins.nix b/pkgs/servers/roundcube/plugins/plugins.nix
index a9c73874b69e..72738eb4c407 100644
--- a/pkgs/servers/roundcube/plugins/plugins.nix
+++ b/pkgs/servers/roundcube/plugins/plugins.nix
@@ -6,5 +6,6 @@
   roundcubePlugin = callPackage ./roundcube-plugin.nix { };
 
   carddav = callPackage ./carddav { };
+  contextmenu = callPackage ./contextmenu { };
   persistent_login = callPackage ./persistent_login { };
 }
diff --git a/pkgs/shells/zsh/oh-my-zsh/default.nix b/pkgs/shells/zsh/oh-my-zsh/default.nix
index cd9054208a6c..d8e01c339ce7 100644
--- a/pkgs/shells/zsh/oh-my-zsh/default.nix
+++ b/pkgs/shells/zsh/oh-my-zsh/default.nix
@@ -5,15 +5,15 @@
 , git, nix, nixfmt, jq, coreutils, gnused, curl, cacert, bash }:
 
 stdenv.mkDerivation rec {
-  version = "2022-11-06";
+  version = "2022-11-07";
   pname = "oh-my-zsh";
-  rev = "4806f755694d160f20e3fb8ae0a1d009d56d966b";
+  rev = "0145d744a9c4c11f00992f7f3ad9555bc8ac6177";
 
   src = fetchFromGitHub {
     inherit rev;
     owner = "ohmyzsh";
     repo = "ohmyzsh";
-    sha256 = "zaaTcTka4L3Ec2bWgT0Yd8vSVG/n21G0PC/VxK2DfT8=";
+    sha256 = "F1h+yTYCVS3rz/ADahOQWyee3TKjkNfUc8O7Ug+2z48=";
   };
 
   strictDeps = true;
diff --git a/pkgs/tools/misc/edk2-uefi-shell/default.nix b/pkgs/tools/misc/edk2-uefi-shell/default.nix
index 78e0ba28afb0..e3d73775021f 100644
--- a/pkgs/tools/misc/edk2-uefi-shell/default.nix
+++ b/pkgs/tools/misc/edk2-uefi-shell/default.nix
@@ -1,5 +1,7 @@
 { lib
+, stdenv
 , edk2
+, llvmPackages
 , util-linux
 , nasm
 , python3
@@ -8,9 +10,12 @@ edk2.mkDerivation "ShellPkg/ShellPkg.dsc" (finalAttrs: {
   pname = "edk2-uefi-shell";
   inherit (edk2) version;
 
-  nativeBuildInputs = [ util-linux nasm python3 ];
+  nativeBuildInputs = [ util-linux nasm python3 ]
+    ++ lib.optionals stdenv.cc.isClang [ llvmPackages.bintools llvmPackages.llvm ];
   strictDeps = true;
 
+  NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isClang [ "-fno-pic" "-Qunused-arguments" ];
+
   # We only have a .efi file in $out which shouldn't be patched or stripped
   dontPatchELF = true;
   dontStrip = true;
diff --git a/pkgs/tools/security/grype/default.nix b/pkgs/tools/security/grype/default.nix
index f4624b87e80a..c690c0f62941 100644
--- a/pkgs/tools/security/grype/default.nix
+++ b/pkgs/tools/security/grype/default.nix
@@ -26,7 +26,8 @@ buildGoModule rec {
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
-  vendorSha256 = "sha256-K6MJp07JEit/6AHqLtnzXIaVCi7W6jfX41M96VwnS5A=";
+  proxyVendor = true;
+  vendorSha256 = "sha256-tRux9M9vFPj3TqhsF1zSV4V1YKnLVViuQjum9YFr5FU=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/tools/security/metasploit/Gemfile b/pkgs/tools/security/metasploit/Gemfile
index f1cd325ad15a..4a6dd4336fab 100644
--- a/pkgs/tools/security/metasploit/Gemfile
+++ b/pkgs/tools/security/metasploit/Gemfile
@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 source "https://rubygems.org"
 
-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.2.24"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.2.25"
diff --git a/pkgs/tools/security/metasploit/Gemfile.lock b/pkgs/tools/security/metasploit/Gemfile.lock
index 301c3acbb90d..1817df3c473a 100644
--- a/pkgs/tools/security/metasploit/Gemfile.lock
+++ b/pkgs/tools/security/metasploit/Gemfile.lock
@@ -1,9 +1,9 @@
 GIT
   remote: https://github.com/rapid7/metasploit-framework
-  revision: 1c805324f10bafa3a99fcd0315cc99ef83430b23
-  ref: refs/tags/6.2.24
+  revision: 2ab12336a4a6197c88ca4777c016311fa4fb7a3d
+  ref: refs/tags/6.2.25
   specs:
-    metasploit-framework (6.2.24)
+    metasploit-framework (6.2.25)
       actionpack (~> 6.0)
       activerecord (~> 6.0)
       activesupport (~> 6.0)
@@ -129,13 +129,13 @@ GEM
     arel-helpers (2.14.0)
       activerecord (>= 3.1.0, < 8)
     aws-eventstream (1.2.0)
-    aws-partitions (1.652.0)
+    aws-partitions (1.656.0)
     aws-sdk-core (3.166.0)
       aws-eventstream (~> 1, >= 1.0.2)
       aws-partitions (~> 1, >= 1.651.0)
       aws-sigv4 (~> 1.5)
       jmespath (~> 1, >= 1.6.1)
-    aws-sdk-ec2 (1.343.0)
+    aws-sdk-ec2 (1.345.0)
       aws-sdk-core (~> 3, >= 3.165.0)
       aws-sigv4 (~> 1.1)
     aws-sdk-iam (1.73.0)
@@ -152,7 +152,7 @@ GEM
       aws-eventstream (~> 1, >= 1.0.2)
     bcrypt (3.1.18)
     bcrypt_pbkdf (1.1.0)
-    bindata (2.4.13)
+    bindata (2.4.14)
     bson (4.15.0)
     builder (3.2.4)
     concurrent-ruby (1.0.5)
@@ -174,7 +174,7 @@ GEM
       eventmachine (>= 1.0.0.beta.4)
     erubi (1.11.0)
     eventmachine (1.2.7)
-    faker (2.23.0)
+    faker (3.0.0)
       i18n (>= 1.8.11, < 2)
     faraday (2.6.0)
       faraday-net_http (>= 2.0, < 3.1)
@@ -237,7 +237,7 @@ GEM
       activesupport (~> 6.0)
       railties (~> 6.0)
     metasploit-payloads (2.0.97)
-    metasploit_data_models (5.0.5)
+    metasploit_data_models (5.0.6)
       activerecord (~> 6.0)
       activesupport (~> 6.0)
       arel-helpers
@@ -245,7 +245,7 @@ GEM
       metasploit-model (>= 3.1)
       pg
       railties (~> 6.0)
-      recog (~> 2.0)
+      recog
       webrick
     metasploit_payloads-mettle (1.0.20)
     method_source (1.0.0)
@@ -260,7 +260,7 @@ GEM
     net-ldap (0.17.1)
     net-protocol (0.1.3)
       timeout
-    net-smtp (0.3.2)
+    net-smtp (0.3.3)
       net-protocol
     net-ssh (7.0.1)
     network_interface (0.0.2)
@@ -309,7 +309,7 @@ GEM
       thor (~> 1.0)
     rake (13.0.6)
     rb-readline (0.5.5)
-    recog (2.3.23)
+    recog (3.0.3)
       nokogiri
     redcarpet (3.5.1)
     reline (0.3.1)
@@ -359,7 +359,7 @@ GEM
       rex-socket
       rex-text
     rex-struct2 (0.1.3)
-    rex-text (0.2.45)
+    rex-text (0.2.46)
     rex-zip (0.1.4)
       rex-text
     rexml (3.2.5)
@@ -399,7 +399,7 @@ GEM
     ttfunk (1.7.0)
     tzinfo (2.0.5)
       concurrent-ruby (~> 1.0)
-    tzinfo-data (1.2022.5)
+    tzinfo-data (1.2022.6)
       tzinfo (>= 1.0.0)
     unf (0.1.4)
       unf_ext
@@ -427,7 +427,7 @@ GEM
       activesupport (>= 4.2, < 8.0)
     xmlrpc (0.3.2)
       webrick
-    zeitwerk (2.6.1)
+    zeitwerk (2.6.5)
 
 PLATFORMS
   ruby
@@ -436,4 +436,4 @@ DEPENDENCIES
   metasploit-framework!
 
 BUNDLED WITH
-   2.3.23
+   2.3.24
diff --git a/pkgs/tools/security/metasploit/default.nix b/pkgs/tools/security/metasploit/default.nix
index 2ff0eb70831d..6b3578105cf7 100644
--- a/pkgs/tools/security/metasploit/default.nix
+++ b/pkgs/tools/security/metasploit/default.nix
@@ -15,13 +15,13 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "metasploit-framework";
-  version = "6.2.24";
+  version = "6.2.25";
 
   src = fetchFromGitHub {
     owner = "rapid7";
     repo = "metasploit-framework";
     rev = version;
-    sha256 = "sha256-BU6R4/wCgXjxLcWrIGo5MSRD71SV3kEHWil8HIeHK0k=";
+    sha256 = "sha256-lrooEMmSu7pgG3Nm35G385ipdc4WdlM696Dd5KdwVJ0=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/security/metasploit/gemset.nix b/pkgs/tools/security/metasploit/gemset.nix
index 78630b3a15b3..0e3186c100be 100644
--- a/pkgs/tools/security/metasploit/gemset.nix
+++ b/pkgs/tools/security/metasploit/gemset.nix
@@ -104,10 +104,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0jxv2az9l3q1nk4bif07yr7kc0wi9znihgdph6cf8z74lbbpl7kv";
+      sha256 = "1l4n8wrjhm4n9hn8c1dm92vwqlcf5wryw4dqmmp5whm6k2k9slkh";
       type = "gem";
     };
-    version = "1.652.0";
+    version = "1.656.0";
   };
   aws-sdk-core = {
     groups = ["default"];
@@ -124,10 +124,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0crzfd4g0ym8gnn989cbv6xdwzkkp8fdqn4y7aqahyh4vixq0zki";
+      sha256 = "1lqx1iadp1vdm3rgb79a219a7xkss409fadqnd5k7vl0cncxkg2s";
       type = "gem";
     };
-    version = "1.343.0";
+    version = "1.345.0";
   };
   aws-sdk-iam = {
     groups = ["default"];
@@ -194,10 +194,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0gbwv05hlpqrz483zd8kbsgf4i62n1gzh7rnk6nl4ik4swkdmxwa";
+      sha256 = "0mz9hz5clknznw8i5f3l2zb9103mlgh96djdhlvlfpf2chkr0s1z";
       type = "gem";
     };
-    version = "2.4.13";
+    version = "2.4.14";
   };
   bson = {
     groups = ["default"];
@@ -334,10 +334,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1wslw5gh335zcahxmdd497xaa7h0d8l60c0jfv942mn47fxy8m47";
+      sha256 = "0fcrgzjvqc9fxhnn7mzvzxd41m63cil7n19mjxnisx836p0k93hl";
       type = "gem";
     };
-    version = "2.23.0";
+    version = "3.0.0";
   };
   faraday = {
     groups = ["default"];
@@ -604,12 +604,12 @@
     platforms = [];
     source = {
       fetchSubmodules = false;
-      rev = "1c805324f10bafa3a99fcd0315cc99ef83430b23";
-      sha256 = "0j9bhy3iqz19b83l3plmakpl691i75m21ay55pqpi082zkir2kh5";
+      rev = "2ab12336a4a6197c88ca4777c016311fa4fb7a3d";
+      sha256 = "17alf2ky9pd0ywx56xhnrrssk67kny8xyrkk3dhbmfwjr482ifln";
       type = "git";
       url = "https://github.com/rapid7/metasploit-framework";
     };
-    version = "6.2.24";
+    version = "6.2.25";
   };
   metasploit-model = {
     groups = ["default"];
@@ -636,10 +636,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1h7w6kavbylbs55rkv12hg28wcchwqvzmagw9yrkqmncwdavl0dl";
+      sha256 = "1dli79r6rh77mwh6xqjzvz5kld70j93myg0gd5q0jxjhimwcrgya";
       type = "gem";
     };
-    version = "5.0.5";
+    version = "5.0.6";
   };
   metasploit_payloads-mettle = {
     groups = ["default"];
@@ -756,10 +756,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0d1y3nkgwypfsivip8vzphs3a01a40ds4ng8i314fpr9fdk48dad";
+      sha256 = "1c6md06hm5bf6rv53sk54dl2vg038pg8kglwv3rayx0vk2mdql9x";
       type = "gem";
     };
-    version = "0.3.2";
+    version = "0.3.3";
   };
   net-ssh = {
     groups = ["default"];
@@ -1027,10 +1027,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0axq8hw515b8hbv1jm4lbrqnjm5bvjjnj7xbx9pvp17zlklvsfzb";
+      sha256 = "1apkzqm07bccnfqf0fgpkcyshkqxb43fj7mkd78za4niimm3lk6w";
       type = "gem";
     };
-    version = "2.3.23";
+    version = "3.0.3";
   };
   redcarpet = {
     groups = ["default"];
@@ -1217,10 +1217,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0x7ppwzvwz8fag1n2j231wxvb0vl4qbbsqw7v8y0hx8vrfs3k5km";
+      sha256 = "0arm3yakxs541qbm52rxjjd9b3p70sqim7syd83m3vqh366gr67d";
       type = "gem";
     };
-    version = "0.2.45";
+    version = "0.2.46";
   };
   rex-zip = {
     groups = ["default"];
@@ -1438,10 +1438,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1w2qlazh0r23bz9qf2d4smvlv4a1yin8kprkqqxwkiwfs5v1n55s";
+      sha256 = "0dpwi70x9jrpvc7p103ci0kppam79wqqrskq9n39r3jrp4b4j27w";
       type = "gem";
     };
-    version = "1.2022.5";
+    version = "1.2022.6";
   };
   unf = {
     groups = ["default"];
@@ -1568,9 +1568,9 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "18hihq3hxs2ywxh3ixm366cawwy4k733mh680ldaa1vxjiraxj58";
+      sha256 = "10ipi1b3rh2vgwskfzcrgagc6hw5ppsz7jamsimglvww8bvya3zy";
       type = "gem";
     };
-    version = "2.6.1";
+    version = "2.6.5";
   };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c5727e673e8c..34a60663f017 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -31894,6 +31894,8 @@ with pkgs;
 
   lightdm-mini-greeter = callPackage ../applications/display-managers/lightdm-mini-greeter { };
 
+  lightdm-mobile-greeter = callPackage ../applications/display-managers/lightdm-mobile-greeter { };
+
   lightdm-tiny-greeter = callPackage ../applications/display-managers/lightdm-tiny-greeter {
     conf = config.lightdm-tiny-greeter.conf or "";
   };
@@ -33399,6 +33401,8 @@ with pkgs;
     inherit (darwin) autoSignDarwinBinariesHook;
   };
 
+  btcd = callPackage ../applications/blockchains/btcd { };
+
   cgminer = callPackage ../applications/blockchains/cgminer { };
 
   chia = callPackage ../applications/blockchains/chia { };
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index e929a59cd70f..7276fab86d8a 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -1314,6 +1314,8 @@ let
 
     ppx_tools_versioned = callPackage ../development/ocaml-modules/ppx_tools_versioned { };
 
+    ppx_yojson_conv = callPackage ../development/ocaml-modules/ppx_yojson_conv {};
+
     ppx_yojson_conv_lib = callPackage ../development/ocaml-modules/ppx_yojson_conv_lib {};
 
     prettym = callPackage ../development/ocaml-modules/prettym { };
diff --git a/pkgs/top-level/php-packages.nix b/pkgs/top-level/php-packages.nix
index e5eb38c32e44..0b9f4237327b 100644
--- a/pkgs/top-level/php-packages.nix
+++ b/pkgs/top-level/php-packages.nix
@@ -58,6 +58,7 @@ lib.makeScope pkgs.newScope (self: with self; {
   # with how buildPecl does it and make the file easier to overview.
   mkDerivation = { pname, ... }@args: pkgs.stdenv.mkDerivation (args // {
     pname = "php-${pname}";
+    meta.mainProgram = args.meta.mainProgram or pname;
   });
 
   # Function to build an extension which is shipped as part of the php
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 6e5648173dd1..3810767e7d2a 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1928,6 +1928,8 @@ self: super: with self; {
 
   construct = callPackage ../development/python-modules/construct { };
 
+  construct-classes = callPackage ../development/python-modules/construct-classes { };
+
   consul = callPackage ../development/python-modules/consul { };
 
   container-inspector = callPackage ../development/python-modules/container-inspector { };