diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 7a28c2527642..33d6bcd382f3 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -11330,6 +11330,13 @@
     githubId = 35086;
     name = "Jonathan Wright";
   };
+  quantenzitrone = {
+    email = "quantenzitrone@protonmail.com";
+    github = "Quantenzitrone";
+    githubId = 74491719;
+    matrix = "@quantenzitrone:matrix.org";
+    name = "quantenzitrone";
+  };
   queezle = {
     email = "git@queezle.net";
     github = "queezle42";
diff --git a/nixos/doc/manual/configuration/user-mgmt.chapter.md b/nixos/doc/manual/configuration/user-mgmt.chapter.md
index 37990664a8f1..5c3aca3ef9e9 100644
--- a/nixos/doc/manual/configuration/user-mgmt.chapter.md
+++ b/nixos/doc/manual/configuration/user-mgmt.chapter.md
@@ -32,8 +32,7 @@ account will cease to exist. Also, imperative commands for managing users and
 groups, such as useradd, are no longer available. Passwords may still be
 assigned by setting the user\'s
 [hashedPassword](#opt-users.users._name_.hashedPassword) option. A
-hashed password can be generated using `mkpasswd -m
-  sha-512`.
+hashed password can be generated using `mkpasswd`.
 
 A user ID (uid) is assigned automatically. You can also specify a uid
 manually by adding
diff --git a/nixos/doc/manual/from_md/configuration/user-mgmt.chapter.xml b/nixos/doc/manual/from_md/configuration/user-mgmt.chapter.xml
index 06492d5c2512..a2d7d2a9f115 100644
--- a/nixos/doc/manual/from_md/configuration/user-mgmt.chapter.xml
+++ b/nixos/doc/manual/from_md/configuration/user-mgmt.chapter.xml
@@ -39,7 +39,7 @@ users.users.alice = {
     Passwords may still be assigned by setting the user's
     <link linkend="opt-users.users._name_.hashedPassword">hashedPassword</link>
     option. A hashed password can be generated using
-    <literal>mkpasswd -m sha-512</literal>.
+    <literal>mkpasswd</literal>.
   </para>
   <para>
     A user ID (uid) is assigned automatically. You can also specify a
diff --git a/nixos/lib/test-driver/test_driver/machine.py b/nixos/lib/test-driver/test_driver/machine.py
index e45c83086fb5..ffbc7c18e42b 100644
--- a/nixos/lib/test-driver/test_driver/machine.py
+++ b/nixos/lib/test-driver/test_driver/machine.py
@@ -684,10 +684,10 @@ class Machine:
         with self.nested("waiting for {} to appear on tty {}".format(regexp, tty)):
             retry(tty_matches)
 
-    def send_chars(self, chars: str) -> None:
+    def send_chars(self, chars: str, delay: Optional[float] = 0.01) -> None:
         with self.nested("sending keys ‘{}‘".format(chars)):
             for char in chars:
-                self.send_key(char)
+                self.send_key(char, delay)
 
     def wait_for_file(self, filename: str) -> None:
         """Waits until the file exists in machine's file system."""
@@ -860,10 +860,11 @@ class Machine:
                 if matches is not None:
                     return
 
-    def send_key(self, key: str) -> None:
+    def send_key(self, key: str, delay: Optional[float] = 0.01) -> None:
         key = CHAR_TO_KEY.get(key, key)
         self.send_monitor_command("sendkey {}".format(key))
-        time.sleep(0.01)
+        if delay is not None:
+            time.sleep(delay)
 
     def send_console(self, chars: str) -> None:
         assert self.process
diff --git a/nixos/modules/config/users-groups.nix b/nixos/modules/config/users-groups.nix
index b538a0119c06..2660b0e6c938 100644
--- a/nixos/modules/config/users-groups.nix
+++ b/nixos/modules/config/users-groups.nix
@@ -35,7 +35,7 @@ let
   '';
 
   hashedPasswordDescription = ''
-    To generate a hashed password run `mkpasswd -m sha-512`.
+    To generate a hashed password run `mkpasswd`.
 
     If set to an empty string (`""`), this user will
     be able to log in without being asked for a password (but not via remote
@@ -592,6 +592,26 @@ in {
       '';
     };
 
+    # Warn about user accounts with deprecated password hashing schemes
+    system.activationScripts.hashes = {
+      deps = [ "users" ];
+      text = ''
+        users=()
+        while IFS=: read -r user hash tail; do
+          if [[ "$hash" = "$"* && ! "$hash" =~ ^\$(y|gy|7|2b|2y|2a|6)\$ ]]; then
+            users+=("$user")
+          fi
+        done </etc/shadow
+
+        if (( "''${#users[@]}" )); then
+          echo "
+        WARNING: The following user accounts rely on password hashes that will
+        be removed in NixOS 23.05. They should be renewed as soon as possible."
+          printf ' - %s\n' "''${users[@]}"
+        fi
+      '';
+    };
+
     # for backwards compatibility
     system.activationScripts.groups = stringAfter [ "users" ] "";
 
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index a886332e90b7..2a23a32eaba6 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -382,6 +382,7 @@
   ./services/databases/pgmanage.nix
   ./services/databases/postgresql.nix
   ./services/databases/redis.nix
+  ./services/databases/surrealdb.nix
   ./services/databases/victoriametrics.nix
   ./services/desktops/accountsservice.nix
   ./services/desktops/bamf.nix
@@ -718,6 +719,7 @@
   ./services/monitoring/teamviewer.nix
   ./services/monitoring/telegraf.nix
   ./services/monitoring/thanos.nix
+  ./services/monitoring/tremor-rs.nix
   ./services/monitoring/tuptime.nix
   ./services/monitoring/unifi-poller.nix
   ./services/monitoring/ups.nix
diff --git a/nixos/modules/services/databases/surrealdb.nix b/nixos/modules/services/databases/surrealdb.nix
new file mode 100644
index 000000000000..27269eb02f64
--- /dev/null
+++ b/nixos/modules/services/databases/surrealdb.nix
@@ -0,0 +1,79 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+let
+
+  cfg = config.services.surrealdb;
+in {
+
+  options = {
+    services.surrealdb = {
+      enable = mkEnableOption (lib.mdDoc "A scalable, distributed, collaborative, document-graph database, for the realtime web ");
+
+      dbPath = mkOption {
+        type = types.str;
+        description = lib.mdDoc ''
+          The path that surrealdb will write data to. Use null for in-memory.
+          Can be one of "memory", "file://:path", "tikv://:addr".
+        '';
+        default = "file:///var/lib/surrealdb/";
+        example = "memory";
+      };
+
+      host = mkOption {
+        type = types.str;
+        description = lib.mdDoc ''
+          The host that surrealdb will connect to.
+        '';
+        default = "127.0.0.1";
+        example = "127.0.0.1";
+      };
+
+      port = mkOption {
+        type = types.port;
+        description = lib.mdDoc ''
+          The port that surrealdb will connect to.
+        '';
+        default = 8000;
+        example = 8000;
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    # Used to connect to the running service
+    environment.systemPackages = [ pkgs.surrealdb ] ;
+
+    systemd.services.surrealdb = {
+      description = "A scalable, distributed, collaborative, document-graph database, for the realtime web ";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      serviceConfig = {
+        ExecStart = "${pkgs.surrealdb}/bin/surreal start --bind ${cfg.host}:${toString cfg.port} ${optionalString (cfg.dbPath != null) "-- ${cfg.dbPath}"}";
+        DynamicUser = true;
+        Restart = "on-failure";
+        StateDirectory = "surrealdb";
+        CapabilityBoundingSet = "";
+        NoNewPrivileges = true;
+        PrivateTmp = true;
+        ProtectHome = true;
+        ProtectClock = true;
+        ProtectProc = "noaccess";
+        ProcSubset = "pid";
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectControlGroups = true;
+        ProtectHostname = true;
+        RestrictSUIDSGID = true;
+        RestrictRealtime = true;
+        RestrictNamespaces = true;
+        LockPersonality = true;
+        RemoveIPC = true;
+        SystemCallFilter = [ "@system-service" "~@privileged" ];
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/monitoring/tremor-rs.nix b/nixos/modules/services/monitoring/tremor-rs.nix
new file mode 100644
index 000000000000..213e8a474868
--- /dev/null
+++ b/nixos/modules/services/monitoring/tremor-rs.nix
@@ -0,0 +1,129 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+let
+
+  cfg = config.services.tremor-rs;
+
+  loggerSettingsFormat = pkgs.formats.yaml { };
+  loggerConfigFile = loggerSettingsFormat.generate "logger.yaml" cfg.loggerSettings;
+in {
+
+  options = {
+    services.tremor-rs = {
+      enable = lib.mkEnableOption (lib.mdDoc "Tremor event- or stream-processing system");
+
+      troyFileList = mkOption {
+        type = types.listOf types.path;
+        default = [];
+        description = lib.mdDoc "List of troy files to load.";
+      };
+
+      tremorLibDir = mkOption {
+        type = types.path;
+        default = "";
+        description = lib.mdDoc "Directory where to find /lib containing tremor script files";
+      };
+
+      host = mkOption {
+        type = types.str;
+        default = "127.0.0.1";
+        description = lib.mdDoc "The host tremor should be listening on";
+      };
+
+      port = mkOption {
+        type = types.port;
+        default = 9898;
+        description = lib.mdDoc "the port tremor should be listening on";
+      };
+
+      loggerSettings = mkOption {
+        description = lib.mdDoc "Tremor logger configuration";
+        default = {};
+        type = loggerSettingsFormat.type;
+
+        example = {
+          refresh_rate = "30 seconds";
+          appenders.stdout.kind = "console";
+          root = {
+            level = "warn";
+            appenders = [ "stdout" ];
+          };
+          loggers = {
+            tremor_runtime = {
+              level = "debug";
+              appenders = [ "stdout" ];
+              additive = false;
+            };
+            tremor = {
+              level = "debug";
+              appenders = [ "stdout" ];
+              additive = false;
+            };
+          };
+        };
+
+        defaultText = literalExpression ''
+          {
+            refresh_rate = "30 seconds";
+            appenders.stdout.kind = "console";
+            root = {
+              level = "warn";
+              appenders = [ "stdout" ];
+            };
+            loggers = {
+              tremor_runtime = {
+                level = "debug";
+                appenders = [ "stdout" ];
+                additive = false;
+              };
+              tremor = {
+                level = "debug";
+                appenders = [ "stdout" ];
+                additive = false;
+              };
+            };
+          }
+        '';
+
+      };
+    };
+  };
+
+  config = mkIf (cfg.enable) {
+
+    environment.systemPackages = [ pkgs.tremor-rs ] ;
+
+    systemd.services.tremor-rs = {
+      description = "Tremor event- or stream-processing system";
+      wantedBy = [ "multi-user.target" ];
+      requires = [ "network-online.target" ];
+      after = [ "network-online.target" ];
+
+      environment.TREMOR_PATH = "${pkgs.tremor-rs}/lib:${cfg.tremorLibDir}";
+
+      serviceConfig = {
+        ExecStart = "${pkgs.tremor-rs}/bin/tremor --logger-config ${loggerConfigFile} server run ${concatStringsSep " " cfg.troyFileList} --api-host ${cfg.host}:${toString cfg.port}";
+        DynamicUser = true;
+        Restart = "always";
+        NoNewPrivileges = true;
+        PrivateTmp = true;
+        ProtectHome = true;
+        ProtectClock = true;
+        ProtectProc = "noaccess";
+        ProcSubset = "pid";
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectControlGroups = true;
+        ProtectHostname = true;
+        RestrictSUIDSGID = true;
+        RestrictRealtime = true;
+        RestrictNamespaces = true;
+        LockPersonality = true;
+        RemoveIPC = true;
+        SystemCallFilter = [ "@system-service" "~@privileged" ];
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/web-apps/keycloak.nix b/nixos/modules/services/web-apps/keycloak.nix
index 521cf778a36b..d52190a28648 100644
--- a/nixos/modules/services/web-apps/keycloak.nix
+++ b/nixos/modules/services/web-apps/keycloak.nix
@@ -482,6 +482,10 @@ in
             assertion = (cfg.database.useSSL && cfg.database.type == "postgresql") -> (cfg.database.caCert != null);
             message = "A CA certificate must be specified (in 'services.keycloak.database.caCert') when PostgreSQL is used with SSL";
           }
+          {
+            assertion = createLocalPostgreSQL -> config.services.postgresql.settings.standard_conforming_strings or true;
+            message = "Setting up a local PostgreSQL db for Keycloak requires `standard_conforming_strings` turned on to work reliably";
+          }
         ];
 
         environment.systemPackages = [ keycloakBuild ];
@@ -544,7 +548,13 @@ in
             create_role="$(mktemp)"
             trap 'rm -f "$create_role"' EXIT
 
+            # Read the password from the credentials directory and
+            # escape any single quotes by adding additional single
+            # quotes after them, following the rules laid out here:
+            # https://www.postgresql.org/docs/current/sql-syntax-lexical.html#SQL-SYNTAX-CONSTANTS
             db_password="$(<"$CREDENTIALS_DIRECTORY/db_password")"
+            db_password="''${db_password//\'/\'\'}"
+
             echo "CREATE ROLE keycloak WITH LOGIN PASSWORD '$db_password' CREATEDB" > "$create_role"
             psql -tAc "SELECT 1 FROM pg_roles WHERE rolname='keycloak'" | grep -q 1 || psql -tA --file="$create_role"
             psql -tAc "SELECT 1 FROM pg_database WHERE datname = 'keycloak'" | grep -q 1 || psql -tAc 'CREATE DATABASE "keycloak" OWNER "keycloak"'
@@ -566,8 +576,16 @@ in
           script = ''
             set -o errexit -o pipefail -o nounset -o errtrace
             shopt -s inherit_errexit
+
+            # Read the password from the credentials directory and
+            # escape any single quotes by adding additional single
+            # quotes after them, following the rules laid out here:
+            # https://dev.mysql.com/doc/refman/8.0/en/string-literals.html
             db_password="$(<"$CREDENTIALS_DIRECTORY/db_password")"
-            ( echo "CREATE USER IF NOT EXISTS 'keycloak'@'localhost' IDENTIFIED BY '$db_password';"
+            db_password="''${db_password//\'/\'\'}"
+
+            ( echo "SET sql_mode = 'NO_BACKSLASH_ESCAPES';"
+              echo "CREATE USER IF NOT EXISTS 'keycloak'@'localhost' IDENTIFIED BY '$db_password';"
               echo "CREATE DATABASE IF NOT EXISTS keycloak CHARACTER SET utf8 COLLATE utf8_unicode_ci;"
               echo "GRANT ALL PRIVILEGES ON keycloak.* TO 'keycloak'@'localhost';"
             ) | mysql -N
@@ -632,12 +650,17 @@ in
 
               ${secretReplacements}
 
+              # Escape any backslashes in the db parameters, since
+              # they're otherwise unexpectedly read as escape
+              # sequences.
+              sed -i '/db-/ s|\\|\\\\|g' /run/keycloak/conf/keycloak.conf
+
             '' + optionalString (cfg.sslCertificate != null && cfg.sslCertificateKey != null) ''
               mkdir -p /run/keycloak/ssl
               cp $CREDENTIALS_DIRECTORY/ssl_{cert,key} /run/keycloak/ssl/
             '' + ''
               export KEYCLOAK_ADMIN=admin
-              export KEYCLOAK_ADMIN_PASSWORD=${cfg.initialAdminPassword}
+              export KEYCLOAK_ADMIN_PASSWORD=${escapeShellArg cfg.initialAdminPassword}
               kc.sh start --optimized
             '';
           };
diff --git a/nixos/modules/system/boot/stage-1-init.sh b/nixos/modules/system/boot/stage-1-init.sh
index 994aa0e33cbf..4596c160a957 100644
--- a/nixos/modules/system/boot/stage-1-init.sh
+++ b/nixos/modules/system/boot/stage-1-init.sh
@@ -342,6 +342,14 @@ checkFS() {
     return 0
 }
 
+escapeFstab() {
+    local original="$1"
+
+    # Replace space
+    local escaped="${original// /\\040}"
+    # Replace tab
+    echo "${escaped//$'\t'/\\011}"
+}
 
 # Function for mounting a file system.
 mountFS() {
@@ -569,7 +577,7 @@ while read -u 3 mountPoint; do
         continue
     fi
 
-    mountFS "$device" "$mountPoint" "$options" "$fsType"
+    mountFS "$device" "$(escapeFstab "$mountPoint")" "$(escapeFstab "$options")" "$fsType"
 done
 
 exec 3>&-
diff --git a/nixos/modules/tasks/filesystems.nix b/nixos/modules/tasks/filesystems.nix
index 399ea9eabe08..7ab8f8dc676c 100644
--- a/nixos/modules/tasks/filesystems.nix
+++ b/nixos/modules/tasks/filesystems.nix
@@ -167,7 +167,7 @@ let
          else throw "No device specified for mount point ‘${fs.mountPoint}’.")
       + " " + escape (rootPrefix + fs.mountPoint)
       + " " + fs.fsType
-      + " " + builtins.concatStringsSep "," (fs.options ++ (extraOpts fs))
+      + " " + escape (builtins.concatStringsSep "," (fs.options ++ (extraOpts fs)))
       + " " + (optionalString (!excludeChecks)
         ("0 " + (if skipCheck fs then "0" else if fs.mountPoint == "/" then "1" else "2")))
       + "\n"
diff --git a/nixos/release-combined.nix b/nixos/release-combined.nix
index bd7b452735f1..337b5192776f 100644
--- a/nixos/release-combined.nix
+++ b/nixos/release-combined.nix
@@ -77,6 +77,7 @@ in rec {
         (onFullSupported "nixos.tests.i3wm")
         (onSystems ["x86_64-linux"] "nixos.tests.installer.btrfsSimple")
         (onSystems ["x86_64-linux"] "nixos.tests.installer.btrfsSubvolDefault")
+        (onSystems ["x86_64-linux"] "nixos.tests.installer.btrfsSubvolEscape")
         (onSystems ["x86_64-linux"] "nixos.tests.installer.btrfsSubvols")
         (onSystems ["x86_64-linux"] "nixos.tests.installer.luksroot")
         (onSystems ["x86_64-linux"] "nixos.tests.installer.lvm")
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index b238c4384951..96330bd40f60 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -252,8 +252,8 @@ in {
   haproxy = handleTest ./haproxy.nix {};
   hardened = handleTest ./hardened.nix {};
   healthchecks = handleTest ./web-apps/healthchecks.nix {};
-  hbase1 = handleTest ./hbase.nix { package=pkgs.hbase1; };
   hbase2 = handleTest ./hbase.nix { package=pkgs.hbase2; };
+  hbase_2_4 = handleTest ./hbase.nix { package=pkgs.hbase_2_4; };
   hbase3 = handleTest ./hbase.nix { package=pkgs.hbase3; };
   hedgedoc = handleTest ./hedgedoc.nix {};
   herbstluftwm = handleTest ./herbstluftwm.nix {};
@@ -491,6 +491,7 @@ in {
   pgadmin4-standalone = handleTest ./pgadmin4-standalone.nix {};
   pgjwt = handleTest ./pgjwt.nix {};
   pgmanage = handleTest ./pgmanage.nix {};
+  phosh = handleTest ./phosh.nix {};
   php = handleTest ./php {};
   php80 = handleTest ./php { php = pkgs.php80; };
   php81 = handleTest ./php { php = pkgs.php81; };
diff --git a/nixos/tests/installer-systemd-stage-1.nix b/nixos/tests/installer-systemd-stage-1.nix
index d02387ee80e0..03f0ec8d746b 100644
--- a/nixos/tests/installer-systemd-stage-1.nix
+++ b/nixos/tests/installer-systemd-stage-1.nix
@@ -8,9 +8,10 @@
   # them when fixed.
   inherit (import ./installer.nix { inherit system config pkgs; systemdStage1 = true; })
     # bcache
-    # btrfsSimple
-    # btrfsSubvolDefault
-    # btrfsSubvols
+    btrfsSimple
+    btrfsSubvolDefault
+    btrfsSubvolEscape
+    btrfsSubvols
     # encryptedFSWithKeyfile
     # grub1
     # luksroot
diff --git a/nixos/tests/installer.nix b/nixos/tests/installer.nix
index d9f64a781c57..9b3c8a762991 100644
--- a/nixos/tests/installer.nix
+++ b/nixos/tests/installer.nix
@@ -911,4 +911,25 @@ in {
       )
     '';
   };
+
+  # Test to see if we can deal with subvols that need to be escaped in fstab
+  btrfsSubvolEscape = makeInstallerTest "btrfsSubvolEscape" {
+    createPartitions = ''
+      machine.succeed(
+          "sgdisk -Z /dev/vda",
+          "sgdisk -n 1:0:+1M -n 2:0:+1G -N 3 -t 1:ef02 -t 2:8200 -t 3:8300 -c 3:root /dev/vda",
+          "mkswap /dev/vda2 -L swap",
+          "swapon -L swap",
+          "mkfs.btrfs -L root /dev/vda3",
+          "btrfs device scan",
+          "mount LABEL=root /mnt",
+          "btrfs subvol create '/mnt/nixos in space'",
+          "btrfs subvol create /mnt/boot",
+          "umount /mnt",
+          "mount -o 'defaults,subvol=nixos in space' LABEL=root /mnt",
+          "mkdir /mnt/boot",
+          "mount -o defaults,subvol=boot LABEL=root /mnt/boot",
+      )
+    '';
+  };
 }
diff --git a/nixos/tests/keycloak.nix b/nixos/tests/keycloak.nix
index 6ce136330d43..228e57d1cdd6 100644
--- a/nixos/tests/keycloak.nix
+++ b/nixos/tests/keycloak.nix
@@ -5,10 +5,13 @@
 let
   certs = import ./common/acme/server/snakeoil-certs.nix;
   frontendUrl = "https://${certs.domain}";
-  initialAdminPassword = "h4IhoJFnt2iQIR9";
 
   keycloakTest = import ./make-test-python.nix (
     { pkgs, databaseType, ... }:
+    let
+      initialAdminPassword = "h4Iho\"JFn't2>iQIR9";
+      adminPasswordFile = pkgs.writeText "admin-password" "${initialAdminPassword}";
+    in
     {
       name = "keycloak";
       meta = with pkgs.lib.maintainers; {
@@ -37,7 +40,7 @@ let
               type = databaseType;
               username = "bogus";
               name = "also bogus";
-              passwordFile = "${pkgs.writeText "dbPassword" "wzf6vOCbPp6cqTH"}";
+              passwordFile = "${pkgs.writeText "dbPassword" ''wzf6\"vO"Cb\nP>p#6;c&o?eu=q'THE'''H''''E''}";
             };
             plugins = with config.services.keycloak.package.plugins; [
               keycloak-discord
@@ -111,7 +114,7 @@ let
           keycloak.succeed("""
               curl -sSf -d 'client_id=admin-cli' \
                    -d 'username=admin' \
-                   -d 'password=${initialAdminPassword}' \
+                   -d "password=$(<${adminPasswordFile})" \
                    -d 'grant_type=password' \
                    '${frontendUrl}/realms/master/protocol/openid-connect/token' \
                    | jq -r '"Authorization: bearer " + .access_token' >admin_auth_header
@@ -119,10 +122,10 @@ let
 
           # Register the metrics SPI
           keycloak.succeed(
-              "${pkgs.jre}/bin/keytool -import -alias snakeoil -file ${certs.ca.cert} -storepass aaaaaa -keystore cacert.jks -noprompt",
-              "KC_OPTS='-Djavax.net.ssl.trustStore=cacert.jks -Djavax.net.ssl.trustStorePassword=aaaaaa' kcadm.sh config credentials --server '${frontendUrl}' --realm master --user admin --password '${initialAdminPassword}'",
-              "KC_OPTS='-Djavax.net.ssl.trustStore=cacert.jks -Djavax.net.ssl.trustStorePassword=aaaaaa' kcadm.sh update events/config -s 'eventsEnabled=true' -s 'adminEventsEnabled=true' -s 'eventsListeners+=metrics-listener'",
-              "curl -sSf '${frontendUrl}/realms/master/metrics' | grep '^keycloak_admin_event_UPDATE'"
+              """${pkgs.jre}/bin/keytool -import -alias snakeoil -file ${certs.ca.cert} -storepass aaaaaa -keystore cacert.jks -noprompt""",
+              """KC_OPTS='-Djavax.net.ssl.trustStore=cacert.jks -Djavax.net.ssl.trustStorePassword=aaaaaa' kcadm.sh config credentials --server '${frontendUrl}' --realm master --user admin --password "$(<${adminPasswordFile})" """,
+              """KC_OPTS='-Djavax.net.ssl.trustStore=cacert.jks -Djavax.net.ssl.trustStorePassword=aaaaaa' kcadm.sh update events/config -s 'eventsEnabled=true' -s 'adminEventsEnabled=true' -s 'eventsListeners+=metrics-listener'""",
+              """curl -sSf '${frontendUrl}/realms/master/metrics' | grep '^keycloak_admin_event_UPDATE'"""
           )
 
           # Publish the realm, including a test OIDC client and user
diff --git a/nixos/tests/phosh.nix b/nixos/tests/phosh.nix
new file mode 100644
index 000000000000..6c6357f58096
--- /dev/null
+++ b/nixos/tests/phosh.nix
@@ -0,0 +1,65 @@
+import ./make-test-python.nix ({ pkgs, ...}: let
+  pin = "1234";
+in {
+  name = "phosh";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ zhaofengli ];
+  };
+
+  nodes = {
+    phone = { config, pkgs, ... }: {
+      users.users.nixos = {
+        isNormalUser = true;
+        password = pin;
+      };
+
+      services.xserver.desktopManager.phosh = {
+        enable = true;
+        user = "nixos";
+        group = "users";
+
+        phocConfig = {
+          outputs.Virtual-1 = {
+            scale = 2;
+          };
+        };
+      };
+
+      systemd.services.phosh = {
+        environment = {
+          # Accelerated graphics fail on phoc 0.20 (wlroots 0.15)
+          "WLR_RENDERER" = "pixman";
+        };
+      };
+
+      virtualisation.resolution = { x = 720; y = 1440; };
+      virtualisation.qemu.options = [ "-vga none -device virtio-gpu-pci,xres=720,yres=1440" ];
+    };
+  };
+
+  enableOCR = true;
+
+  testScript = ''
+    import time
+
+    start_all()
+    phone.wait_for_unit("phosh.service")
+
+    with subtest("Check that we can see the lock screen info page"):
+        # Saturday, January 1
+        phone.succeed("timedatectl set-time '2022-01-01 07:00'")
+
+        phone.wait_for_text("Saturday")
+        phone.screenshot("01lockinfo")
+
+    with subtest("Check that we can unlock the screen"):
+        phone.send_chars("${pin}", delay=0.2)
+        time.sleep(1)
+        phone.screenshot("02unlock")
+
+        phone.send_chars("\n")
+
+        phone.wait_for_text("All Apps")
+        phone.screenshot("03launcher")
+  '';
+})
diff --git a/pkgs/applications/audio/bitwig-studio/bitwig-studio4.nix b/pkgs/applications/audio/bitwig-studio/bitwig-studio4.nix
index 038a5277d2f5..8da04de579e6 100644
--- a/pkgs/applications/audio/bitwig-studio/bitwig-studio4.nix
+++ b/pkgs/applications/audio/bitwig-studio/bitwig-studio4.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bitwig-studio";
-  version = "4.4.2";
+  version = "4.4.3";
 
   src = fetchurl {
     url = "https://downloads.bitwig.com/stable/${version}/${pname}-${version}.deb";
-    sha256 = "sha256-nLXpf0Xi7yuz/Rm8Sfkr1PGLuazN+Lh6sIqkWFBmP3w=";
+    sha256 = "sha256-NP9cM1xIHblMdUFKIviPKDi6su6Nc3xsX2pnPeP7hdQ=";
   };
 
   nativeBuildInputs = [ dpkg makeWrapper wrapGAppsHook ];
diff --git a/pkgs/applications/audio/lollypop/default.nix b/pkgs/applications/audio/lollypop/default.nix
index 019196d74eb7..0da23254aa81 100644
--- a/pkgs/applications/audio/lollypop/default.nix
+++ b/pkgs/applications/audio/lollypop/default.nix
@@ -25,7 +25,7 @@
 
 python3.pkgs.buildPythonApplication rec  {
   pname = "lollypop";
-  version = "1.4.36";
+  version = "1.4.35";
 
   format = "other";
   doCheck = false;
@@ -34,7 +34,7 @@ python3.pkgs.buildPythonApplication rec  {
     url = "https://gitlab.gnome.org/World/lollypop";
     rev = "refs/tags/${version}";
     fetchSubmodules = true;
-    sha256 = "sha256-Ka/rYgWGuCQTzguJiyQpY5SPC1iB5XOVy/Gezj+DYpk=";
+    sha256 = "sha256-Rdp0gZjdj2tXOWarsTpqgvSZVXAQsCLfk5oUyalE/ZA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/audio/praat/default.nix b/pkgs/applications/audio/praat/default.nix
index d05a12ec30af..5dd17a74f491 100644
--- a/pkgs/applications/audio/praat/default.nix
+++ b/pkgs/applications/audio/praat/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "praat";
-  version = "6.2.23";
+  version = "6.3";
 
   src = fetchFromGitHub {
     owner = "praat";
     repo = "praat";
     rev = "v${version}";
-    sha256 = "sha256-gl+kT8wXLCWnNmOBx6Vg+FbmJ8kJ8pJKsahpqcYw9Lk=";
+    sha256 = "sha256-/XSBUM6HkANATl1Y9vs8mQFgBTyVeCv8TxcaIdP/Nm8=";
   };
 
   configurePhase = ''
diff --git a/pkgs/applications/audio/ptcollab/default.nix b/pkgs/applications/audio/ptcollab/default.nix
index 54d3fec5cabb..842b8f0aa070 100644
--- a/pkgs/applications/audio/ptcollab/default.nix
+++ b/pkgs/applications/audio/ptcollab/default.nix
@@ -13,13 +13,13 @@
 
 mkDerivation rec {
   pname = "ptcollab";
-  version = "0.6.4.1";
+  version = "0.6.4.5";
 
   src = fetchFromGitHub {
     owner = "yuxshao";
     repo = "ptcollab";
     rev = "v${version}";
-    sha256 = "sha256-/Z0UDxZtVnGKVmscNCZAvTGMALq/uMd7/h3r/QvUs0M=";
+    sha256 = "sha256-O7CNPMS0eRcqt2xAtyEFyLSV8U2xbxuV1DpBxZAFwQs=";
   };
 
   nativeBuildInputs = [ qmake pkg-config ];
diff --git a/pkgs/applications/blockchains/nearcore/default.nix b/pkgs/applications/blockchains/nearcore/default.nix
index a5c475308b32..058888d965da 100644
--- a/pkgs/applications/blockchains/nearcore/default.nix
+++ b/pkgs/applications/blockchains/nearcore/default.nix
@@ -4,7 +4,7 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "nearcore";
-  version = "1.29.0";
+  version = "1.29.1";
 
   # https://github.com/near/nearcore/tags
   src = fetchFromGitHub {
@@ -13,10 +13,10 @@ rustPlatform.buildRustPackage rec {
     # there is also a branch for this version number, so we need to be explicit
     rev = "refs/tags/${version}";
 
-    sha256 = "sha256-TOZ6j4CaiOXmNn8kgVGP27SjvLDlGvabAA+PAEyFXIk=";
+    sha256 = "sha256-TmmGLrDpNOfadOIwmG7XRgI89XQjaqIavxCEE2plumc=";
   };
 
-  cargoSha256 = "sha256-LjBgsQynHIfrQP4Z7j1J8+PLqRZWGAOQ5dJaGOqabVk=";
+  cargoSha256 = "sha256-4suoHP6AXhXlt7+sHMX5RW/LGZrbMhNNmzYvFBcnMTs=";
   cargoPatches = [ ./0001-make-near-test-contracts-optional.patch ];
 
   postPatch = ''
diff --git a/pkgs/applications/editors/neovim/default.nix b/pkgs/applications/editors/neovim/default.nix
index e5f1d658b5d7..0a3b5ca421d3 100644
--- a/pkgs/applications/editors/neovim/default.nix
+++ b/pkgs/applications/editors/neovim/default.nix
@@ -26,13 +26,13 @@ let
 in
   stdenv.mkDerivation rec {
     pname = "neovim-unwrapped";
-    version = "0.8.0";
+    version = "0.8.1";
 
     src = fetchFromGitHub {
       owner = "neovim";
       repo = "neovim";
       rev = "v${version}";
-      sha256 = "sha256-mVeVjkP8JpTi2aW59ZuzQPi5YvEySVAtxko7xxAx/es=";
+      sha256 = "sha256-B2ZpwhdmdvPOnxVyJDfNzUT5rTVuBhJXyMwwzCl9Fac=";
     };
 
     patches = [
diff --git a/pkgs/applications/emulators/basiliskii/default.nix b/pkgs/applications/emulators/basiliskii/default.nix
index f32abac9a6b8..8a58dd24555f 100644
--- a/pkgs/applications/emulators/basiliskii/default.nix
+++ b/pkgs/applications/emulators/basiliskii/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, autoconf, automake, pkg-config, SDL2, gtk2 }:
+{ stdenv, lib, fetchFromGitHub, autoconf, automake, pkg-config, SDL2, gtk2, mpfr }:
 stdenv.mkDerivation {
   pname = "basiliskii";
   version = "unstable-2022-09-30";
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
   sourceRoot = "source/BasiliskII/src/Unix";
   patches = [ ./remove-redhat-6-workaround-for-scsi-sg.h.patch ];
   nativeBuildInputs = [ autoconf automake pkg-config ];
-  buildInputs = [ SDL2 gtk2 ];
+  buildInputs = [ SDL2 gtk2 mpfr ];
   preConfigure = ''
     NO_CONFIGURE=1 ./autogen.sh
   '';
diff --git a/pkgs/applications/emulators/duckstation/default.nix b/pkgs/applications/emulators/duckstation/default.nix
index d02e08ed6cd4..31869fa9fe36 100644
--- a/pkgs/applications/emulators/duckstation/default.nix
+++ b/pkgs/applications/emulators/duckstation/default.nix
@@ -4,31 +4,32 @@
 , SDL2
 , cmake
 , copyDesktopItems
-, makeDesktopItem
 , curl
 , extra-cmake-modules
-, libevdev
-, libpulseaudio
 , libXrandr
+, libpulseaudio
+, makeDesktopItem
 , mesa # for libgbm
 , ninja
 , pkg-config
 , qtbase
+, qtsvg
 , qttools
 , vulkan-loader
-#, wayland # Wayland doesn't work correctly this version
+, wayland
 , wrapQtAppsHook
+, enableWayland ? true
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "duckstation";
-  version = "unstable-2022-07-08";
+  version = "unstable-2022-11-18";
 
   src = fetchFromGitHub {
     owner = "stenzek";
-    repo = pname;
-    rev = "82965f741e81e4d2f7e1b2abdc011e1f266bfe7f";
-    sha256 = "sha256-D8Ps/EQRcHLsps/KEUs56koeioOdE/GPA0QJSrbSdYs=";
+    repo = "duckstation";
+    rev = "8d7aea5e19859ed483699cc4a5dbd47165c7be8b";
+    sha256 = "sha256-92Wn1ZEEZszmVK/KrJqjDuQf/lyD8/VScfTI/St5dY4=";
   };
 
   nativeBuildInputs = [
@@ -44,19 +45,19 @@ stdenv.mkDerivation rec {
   buildInputs = [
     SDL2
     curl
-    libevdev
     libpulseaudio
     libXrandr
     mesa
     qtbase
+    qtsvg
     vulkan-loader
-    #wayland
-  ];
+  ]
+  ++ lib.optionals enableWayland [ wayland ];
 
   cmakeFlags = [
     "-DUSE_DRMKMS=ON"
-    #"-DUSE_WAYLAND=ON"
-  ];
+  ]
+  ++ lib.optionals enableWayland [ "-DUSE_WAYLAND=ON" ];
 
   desktopItems = [
     (makeDesktopItem {
@@ -80,7 +81,7 @@ stdenv.mkDerivation rec {
     cp -r bin $out/share/duckstation
     ln -s $out/share/duckstation/duckstation-qt $out/bin/
 
-    install -Dm644 ../extras/icons/icon-256px.png $out/share/pixmaps/duckstation.png
+    install -Dm644 bin/resources/images/duck.png $out/share/pixmaps/duckstation.png
 
     runHook postInstall
   '';
diff --git a/pkgs/applications/emulators/sameboy/default.nix b/pkgs/applications/emulators/sameboy/default.nix
index 26555acb61cb..035351885568 100644
--- a/pkgs/applications/emulators/sameboy/default.nix
+++ b/pkgs/applications/emulators/sameboy/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sameboy";
-  version = "0.15.6";
+  version = "0.15.8";
 
   src = fetchFromGitHub {
     owner = "LIJI32";
     repo = "SameBoy";
     rev = "v${version}";
-    sha256 = "sha256-WsZuOKq/Dfk2zgYFXSwZPUuPrJQJ3y3mJHL6s61mTig=";
+    sha256 = "sha256-SBK+aYekEJreD0XBvYaU12eIKmm9JNYIpPt1XhUtH4c=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/graphics/qimgv/default.nix b/pkgs/applications/graphics/qimgv/default.nix
index 8e4c4805750b..560cf666d262 100644
--- a/pkgs/applications/graphics/qimgv/default.nix
+++ b/pkgs/applications/graphics/qimgv/default.nix
@@ -15,13 +15,13 @@
 
 mkDerivation rec {
   pname = "qimgv";
-  version = "1.0.2";
+  version = "1.0.3-alpha";
 
   src = fetchFromGitHub {
     owner = "easymodo";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-YlV/ysm7bdPverpKpanrL+jPVvMtP1paoAm0PREMaww=";
+    sha256 = "sha256-fHMSo8zlOl9Lt8nYwClUzON4TPB9Ogwven+TidsesxY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/graphics/qimgv/qt5-12-compat.diff b/pkgs/applications/graphics/qimgv/qt5-12-compat.diff
deleted file mode 100644
index da64759e22d6..000000000000
--- a/pkgs/applications/graphics/qimgv/qt5-12-compat.diff
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/qimgv/components/directorymanager/watchers/linux/linuxworker.cpp b/qimgv/components/directorymanager/watchers/linux/linuxworker.cpp
-index 96ec9d3..6d95d08 100644
---- a/qimgv/components/directorymanager/watchers/linux/linuxworker.cpp
-+++ b/qimgv/components/directorymanager/watchers/linux/linuxworker.cpp
-@@ -21,7 +21,7 @@ void LinuxWorker::setDescriptor(int desc) {
- 
- void LinuxWorker::run() {
-     emit started();
--    isRunning.storeRelaxed(true);
-+    isRunning.store(true);
- 
-     if (fd == -1) {
-         qDebug() << TAG << "File descriptor isn't set! Stopping";
diff --git a/pkgs/applications/kde/kdevelop/kdevelop.nix b/pkgs/applications/kde/kdevelop/kdevelop.nix
index 4e7f576398e5..1d34e01813b0 100644
--- a/pkgs/applications/kde/kdevelop/kdevelop.nix
+++ b/pkgs/applications/kde/kdevelop/kdevelop.nix
@@ -1,5 +1,5 @@
 { mkDerivation, lib, cmake, gettext, pkg-config, extra-cmake-modules
-, qtquickcontrols, qtwebkit, qttools, kde-cli-tools, qtbase
+, qtquickcontrols, qttools, kde-cli-tools, qtbase
 , kconfig, kdeclarative, kdoctools, kiconthemes, ki18n, kitemmodels, kitemviews
 , kjobwidgets, kcmutils, kio, knewstuff, knotifyconfig, kparts, ktexteditor
 , threadweaver, kxmlgui, kwindowsystem, grantlee, kcrash, karchive, kguiaddons
@@ -24,7 +24,7 @@ mkDerivation rec {
   ];
 
   propagatedBuildInputs = [
-    qtquickcontrols qtwebkit boost libkomparediff2
+    qtquickcontrols boost libkomparediff2
     kconfig kdeclarative kdoctools kiconthemes ki18n kitemmodels kitemviews
     kjobwidgets kcmutils kio knewstuff knotifyconfig kparts ktexteditor
     threadweaver kxmlgui kwindowsystem grantlee plasma-framework krunner
diff --git a/pkgs/applications/kde/rocs.nix b/pkgs/applications/kde/rocs.nix
index bb5cd80bca23..80f5f4bb6d65 100644
--- a/pkgs/applications/kde/rocs.nix
+++ b/pkgs/applications/kde/rocs.nix
@@ -1,7 +1,7 @@
 {
   mkDerivation, lib,
   extra-cmake-modules, boost,
-  qtbase, qtscript, qtquickcontrols, qtwebkit, qtxmlpatterns, grantlee,
+  qtbase, qtscript, qtquickcontrols, qtxmlpatterns, grantlee,
   kdoctools, karchive, kxmlgui, kcrash, kdeclarative, ktexteditor, kguiaddons
 }:
 
@@ -19,7 +19,7 @@ mkDerivation {
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [
     boost
-    qtbase qtscript qtquickcontrols qtwebkit qtxmlpatterns grantlee
+    qtbase qtscript qtquickcontrols qtxmlpatterns grantlee
     kxmlgui kcrash kdeclarative karchive ktexteditor kguiaddons
   ];
 }
diff --git a/pkgs/applications/misc/eureka-ideas/default.nix b/pkgs/applications/misc/eureka-ideas/default.nix
index d9016bc341ae..ee15f31632cb 100644
--- a/pkgs/applications/misc/eureka-ideas/default.nix
+++ b/pkgs/applications/misc/eureka-ideas/default.nix
@@ -2,6 +2,7 @@
 , rustPlatform
 , fetchFromGitHub
 , pkg-config
+, libgit2
 , openssl
 , stdenv
 , Security
@@ -22,13 +23,15 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ Security ];
-
-  checkFlags = lib.optionals stdenv.isLinux [
-    # failing on linux for unknown reasons
-    "--skip=config_manager::tests"
+  buildInputs = [
+    libgit2
+    openssl
+  ] ++ lib.optionals stdenv.isDarwin [
+    Security
   ];
 
+  dontUseCargoParallelTests = true;
+
   meta = with lib; {
     description = "CLI tool to input and store your ideas without leaving the terminal";
     homepage = "https://github.com/simeg/eureka";
diff --git a/pkgs/applications/misc/metadata-cleaner/default.nix b/pkgs/applications/misc/metadata-cleaner/default.nix
index 5afd0a615b59..35832b0dafb1 100644
--- a/pkgs/applications/misc/metadata-cleaner/default.nix
+++ b/pkgs/applications/misc/metadata-cleaner/default.nix
@@ -18,7 +18,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "metadata-cleaner";
-  version = "2.2.5";
+  version = "2.2.7";
 
   format = "other";
 
@@ -26,7 +26,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "rmnvgr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Yb5tCvhVg9p4v7++MmoaeQDyP1qdfpHM+IGj8BoacVs=";
+    hash = "sha256-Kqvnw0cPPkqgJQdc6vkP4U96AQuyFSNMQTzTdIUghWw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/process-compose/default.nix b/pkgs/applications/misc/process-compose/default.nix
new file mode 100644
index 000000000000..c52adbc4f0be
--- /dev/null
+++ b/pkgs/applications/misc/process-compose/default.nix
@@ -0,0 +1,42 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, installShellFiles
+}:
+
+buildGoModule rec {
+  pname = "process-compose";
+  version = "0.24.1";
+
+  src = fetchFromGitHub {
+    owner = "F1bonacc1";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "TKLLq6I+Mcvdz51m8nydTWcslBcQlJCJFoJ10SgfVWU=";
+  };
+
+  ldflags = [ "-X main.version=v${version}" ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  vendorSha256 = "IsO1B6z1/HoGQ8xdNKQqZ/eZd90WikDbU9XiP0z28mU=";
+
+  doCheck = false;
+
+  postInstall = ''
+    mv $out/bin/{src,process-compose}
+
+    installShellCompletion --cmd process-compose \
+      --bash <($out/bin/process-compose completion bash) \
+      --zsh <($out/bin/process-compose completion zsh) \
+      --fish <($out/bin/process-compose completion fish)
+  '';
+
+  meta = with lib; {
+    description = "A simple and flexible scheduler and orchestrator to manage non-containerized applications";
+    homepage = "https://github.com/F1bonacc1/process-compose";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ thenonameguy ];
+    mainProgram = "process-compose";
+  };
+}
diff --git a/pkgs/applications/networking/browsers/luakit/default.nix b/pkgs/applications/networking/browsers/luakit/default.nix
index 8656b4aaa276..4812f69f34e8 100644
--- a/pkgs/applications/networking/browsers/luakit/default.nix
+++ b/pkgs/applications/networking/browsers/luakit/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "luakit";
-  version = "2.3";
+  version = "2.3.1";
 
   src = fetchFromGitHub {
     owner = "luakit";
     repo = pname;
     rev = version;
-    hash = "sha256-5YeJkbWk1wHxWXqWOvhEDeScWPU/aRVhuOWRHLSHVZM=";
+    hash = "sha256-6baN3e5ZJ8hw6mhQ0AapyVIYFSdmXcfo45ReQNliIPw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/cluster/kubeseal/default.nix b/pkgs/applications/networking/cluster/kubeseal/default.nix
index 6d30f4ba8785..6bcde313e9ad 100644
--- a/pkgs/applications/networking/cluster/kubeseal/default.nix
+++ b/pkgs/applications/networking/cluster/kubeseal/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kubeseal";
-  version = "0.19.1";
+  version = "0.19.2";
 
   src = fetchFromGitHub {
     owner = "bitnami-labs";
     repo = "sealed-secrets";
     rev = "v${version}";
-    sha256 = "sha256-+WwxYnVW6rdZ+A4L2qLtXXaMWLC4ulEoP+vtdtkLvlE=";
+    sha256 = "sha256-LluWV/GWBJ+dmn94GtqPNCIDTZk2zlNhrbcM2pALUpU=";
   };
 
-  vendorSha256 = "sha256-505nUMuFteOfIurGYRGHqo9diTSEa56tmQZ3jIGtULQ=";
+  vendorSha256 = "sha256-f7rznlRKEkHsU72QvRpOtvhg5rp9PuEoADhQOeD16rU=";
 
   subPackages = [ "cmd/kubeseal" ];
 
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 403b8d5dfd6d..bfc5e828cb27 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -423,13 +423,13 @@
     "version": "2.2.0"
   },
   "github": {
-    "hash": "sha256-cLBBz5qPRY+TpcO0yfyTXOQLQYz58hB1l6ufThbBSuM=",
+    "hash": "sha256-3ivfHKoj7jXQ3WsoTNSCL1zD93Pr0pjtZ9LneW9My4o=",
     "owner": "integrations",
     "provider-source-address": "registry.terraform.io/integrations/github",
     "repo": "terraform-provider-github",
-    "rev": "v5.8.0",
+    "rev": "v5.9.0",
     "vendorHash": null,
-    "version": "5.8.0"
+    "version": "5.9.0"
   },
   "gitlab": {
     "hash": "sha256-1Ljf9kwpj96mzu/uHqitYCKIixNn/sZL21zOM8xQsU4=",
@@ -642,13 +642,13 @@
     "version": "1.14.0"
   },
   "kubernetes": {
-    "hash": "sha256-93cGlfYUH4VTdDYbtGySOUw5Kak7hKs0gxLCT0Bxca4=",
+    "hash": "sha256-hWFC8VBbM3BRGrX1Y45Znd/W3klYy/7aS7JbbKN7EUg=",
     "owner": "hashicorp",
     "provider-source-address": "registry.terraform.io/hashicorp/kubernetes",
     "repo": "terraform-provider-kubernetes",
-    "rev": "v2.15.0",
+    "rev": "v2.16.0",
     "vendorHash": null,
-    "version": "2.15.0"
+    "version": "2.16.0"
   },
   "launchdarkly": {
     "hash": "sha256-AsFtlCIGvlG8c+PilhMhaMowaea/g1+IXYzEiIIbZ44=",
@@ -1121,13 +1121,13 @@
     "version": "1.78.12"
   },
   "tfe": {
-    "hash": "sha256-MDlRwB2iVi/Rv7/UtukI6mIDImz8Gnpm5Qv5R6EDpiU=",
+    "hash": "sha256-ikuLRGm9Z+tt0Zsx7DYKNBrS08rW4DOvVWYpl3wvaeU=",
     "owner": "hashicorp",
     "provider-source-address": "registry.terraform.io/hashicorp/tfe",
     "repo": "terraform-provider-tfe",
-    "rev": "v0.38.0",
-    "vendorHash": "sha256-reXq1MyAhHRet1WwDJZafdOg1r7J4sktQ/QhQUPhDak=",
-    "version": "0.38.0"
+    "rev": "v0.39.0",
+    "vendorHash": "sha256-Ws9IzlZQDDAdQ4JJ326jHXUe9oQphBXb/ZNO7Kl/A1w=",
+    "version": "0.39.0"
   },
   "thunder": {
     "hash": "sha256-fXvwBOIW3/76V3O9t25wff0oGViqSaSB2VgMdItXyn4=",
diff --git a/pkgs/applications/networking/feedreaders/goeland/default.nix b/pkgs/applications/networking/feedreaders/goeland/default.nix
index 016b77646f37..946e145a5707 100644
--- a/pkgs/applications/networking/feedreaders/goeland/default.nix
+++ b/pkgs/applications/networking/feedreaders/goeland/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "goeland";
-  version = "0.12.1";
+  version = "0.12.3";
 
   src = fetchFromGitHub {
     owner = "slurdge";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-7ZfZ5sf8vK51geWZ5iKFPwd/v26f7MTDmtKkxamKwRQ=";
+    sha256 = "sha256-R3ZkGTq0g90DkflLXr2MUBIv5Qspi3OM+sdDGqJYjyw=";
   };
 
   vendorSha256 = "sha256-iljGBe8c6dqEHRpMN5cz7wmminejoiXXDKuQDazDztA=";
diff --git a/pkgs/applications/networking/go-graft/default.nix b/pkgs/applications/networking/go-graft/default.nix
index 4fb3475c147c..7e268e27f1a0 100644
--- a/pkgs/applications/networking/go-graft/default.nix
+++ b/pkgs/applications/networking/go-graft/default.nix
@@ -2,19 +2,19 @@
 
 buildGoModule rec {
   pname = "go-graft";
-  version = "0.2.14";
+  version = "0.2.15";
 
   src = fetchFromGitHub {
     owner = "mzz2017";
     repo = "gg";
     rev = "v${version}";
-    sha256 = "sha256-XymtLguAHCtOrRADRcWsPYq9cZo+FVUPOceIj7SmH8k=";
+    sha256 = "sha256-INoJcb6XUMvT1E56hC3BGK3Ax+v4jSRpZV12zpjYfMA=";
   };
 
   CGO_ENABLED = 0;
 
   ldflags = [ "-X github.com/mzz2017/gg/cmd.Version=${version}" "-s" "-w" "-buildid=" ];
-  vendorSha256 = "sha256-MJMOCUIosLT9XhRsahQMx4Kq6j/aqCjhPq0ZvJc/Soc=";
+  vendorSha256 = "sha256-kKIekANzLY2TYFyII1/BkKkqPYgmHB9xEfAVhJyI8FI=";
   subPackages = [ "." ];
 
   meta = with lib; {
diff --git a/pkgs/applications/networking/instant-messengers/go-neb/default.nix b/pkgs/applications/networking/instant-messengers/go-neb/default.nix
index e554f631920b..4dc24073f5b5 100644
--- a/pkgs/applications/networking/instant-messengers/go-neb/default.nix
+++ b/pkgs/applications/networking/instant-messengers/go-neb/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub, nixosTests, olm }:
+{ lib, stdenv, buildGoModule, fetchFromGitHub, nixosTests, olm }:
 
 buildGoModule {
   pname = "go-neb";
@@ -21,6 +21,7 @@ buildGoModule {
   passthru.tests.go-neb = nixosTests.go-neb;
 
   meta = with lib; {
+    broken = stdenv.isDarwin;
     description = "Extensible matrix bot written in Go";
     homepage = "https://github.com/matrix-org/go-neb";
     license = licenses.asl20;
diff --git a/pkgs/applications/networking/sniffers/kismet/default.nix b/pkgs/applications/networking/sniffers/kismet/default.nix
index ad1ee0a0b302..1e4bb853742e 100644
--- a/pkgs/applications/networking/sniffers/kismet/default.nix
+++ b/pkgs/applications/networking/sniffers/kismet/default.nix
@@ -1,36 +1,43 @@
-{ lib, stdenv, fetchurl, pkg-config, libpcap, pcre, libnl, zlib, libmicrohttpd
-, sqlite, protobuf, protobufc, libusb1, libcap, binutils, elfutils
-, withNetworkManager ? false, glib, networkmanager
-, withPython ? false, python3
-, withSensors ? false, lm_sensors}:
-
-# couldn't get python modules to build correctly,
-# waiting for some other volunteer to fix it
-assert !withPython;
+{ lib
+, stdenv
+, binutils
+, elfutils
+, fetchurl
+, glib
+, libcap
+, libmicrohttpd
+, libnl
+, libpcap
+, libusb1
+, libwebsockets
+, lm_sensors
+, networkmanager
+, pcre
+, pkg-config
+, openssl
+, protobuf
+, protobufc
+, python3
+, sqlite
+, withNetworkManager ? false
+, withPython ? true
+, withSensors ? false
+, zlib
+}:
 
 stdenv.mkDerivation rec {
   pname = "kismet";
-  version = "2020-09-R2";
+  version = "2022-08-R1";
 
   src = fetchurl {
     url = "https://www.kismetwireless.net/code/${pname}-${version}.tar.xz";
-    sha256 = "1n6y6sgqf50bng8n0mhs2r1w0ak14mv654sqay72a78wh2s7ywzg";
+    hash = "sha256-IUnM6sVSZQhlP00C3PemlOPaPcAAojcqHuS/mYgnl4E=";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-
-  buildInputs = [
-    libpcap pcre libmicrohttpd libnl zlib sqlite protobuf protobufc
-    libusb1 libcap binutils elfutils
-  ] ++ lib.optionals withNetworkManager [ networkmanager glib ]
-    ++ lib.optional withSensors lm_sensors
-    ++ lib.optional withPython (python3.withPackages(ps: [ ps.setuptools ps.protobuf
-                                                                  ps.numpy ps.pyserial ]));
-
-  configureFlags = []
-    ++ lib.optional (!withNetworkManager) "--disable-libnm"
-    ++ lib.optional (!withPython) "--disable-python-tools"
-    ++ lib.optional (!withSensors) "--disable-lmsensors";
+  postPatch = ''
+    substituteInPlace Makefile.in \
+      --replace "-m 4550" ""
+  '';
 
   postConfigure = ''
     sed -e 's/-o $(INSTUSR)//' \
@@ -40,12 +47,58 @@ stdenv.mkDerivation rec {
         -i Makefile
   '';
 
+  nativeBuildInputs = [
+    pkg-config
+  ] ++ lib.optionals withPython [
+    python3
+  ];
+
+  buildInputs = [
+    binutils
+    elfutils
+    libcap
+    libmicrohttpd
+    libnl
+    libpcap
+    openssl
+    libusb1
+    libwebsockets
+    pcre
+    protobuf
+    protobufc
+    sqlite
+    zlib
+  ] ++ lib.optionals withNetworkManager [
+    networkmanager
+    glib
+  ] ++ lib.optional withSensors [
+    lm_sensors
+  ];
+
+  propagatedBuildInputs = [
+  ] ++ lib.optional withPython (python3.withPackages (ps: [
+    ps.numpy
+    ps.protobuf
+    ps.pyserial
+    ps.setuptools
+    ps.websockets
+  ]));
+
+  configureFlags = [
+  ] ++ lib.optional (!withNetworkManager) [
+    "--disable-libnm"
+  ] ++ lib.optional (!withPython) [
+    "--disable-python-tools"
+  ] ++ lib.optional (!withSensors) [
+    "--disable-lmsensors"
+  ];
+
   enableParallelBuilding = true;
 
   meta = with lib; {
     description = "Wireless network sniffer";
     homepage = "https://www.kismetwireless.net/";
-    license = licenses.gpl3;
+    license = licenses.gpl3Plus;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/applications/networking/twtxt/default.nix b/pkgs/applications/networking/twtxt/default.nix
index 792c13aa23fa..574540862562 100644
--- a/pkgs/applications/networking/twtxt/default.nix
+++ b/pkgs/applications/networking/twtxt/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonApplication rec {
   pname = "twtxt";
-  version = "1.2.3";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "buckket";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-AdM95G2Vz3UbVPI7fs8/D78BMxscbTGrCpIyyHzSmho=";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-CbFh1o2Ijinfb8X+h1GP3Tp+8D0D3/Czt/Uatd1B4cw=";
   };
 
   # Relax some dependencies
diff --git a/pkgs/applications/office/libreoffice/default.nix b/pkgs/applications/office/libreoffice/default.nix
index 4c3a4bd98844..a562548242b6 100644
--- a/pkgs/applications/office/libreoffice/default.nix
+++ b/pkgs/applications/office/libreoffice/default.nix
@@ -96,7 +96,7 @@
 , gpgme
 , libwebp
 , abseil-cpp
-, langs ? [ "ca" "cs" "da" "de" "en-GB" "en-US" "eo" "es" "fr" "hu" "it" "ja" "nl" "pl" "pt" "pt-BR" "ro" "ru" "sl" "uk" "zh-CN" ]
+, langs ? [ "ca" "cs" "da" "de" "en-GB" "en-US" "eo" "es" "fr" "hu" "it" "ja" "nl" "pl" "pt" "pt-BR" "ro" "ru" "sl" "tr" "uk" "zh-CN" ]
 , withHelp ? true
 , kdeIntegration ? false
 , mkDerivation ? null
diff --git a/pkgs/applications/radio/btlejack/default.nix b/pkgs/applications/radio/btlejack/default.nix
index 198c090b0ea1..c5eb8d5cfe4d 100644
--- a/pkgs/applications/radio/btlejack/default.nix
+++ b/pkgs/applications/radio/btlejack/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonApplication rec {
   pname = "btlejack";
-  version = "2.0.0";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner = "virtualabs";
     repo = "btlejack";
-    rev = "v${version}";
-    sha256 = "1r17079kx7dvsrbmw5sgvz3vj5m3pn2543gxj2xmw4s0lcihy378";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-Q6y9murV1o2i1sluqTVB5+X3B7ywFsI0ZvlJjHrHSpo=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/version-management/fossil/default.nix b/pkgs/applications/version-management/fossil/default.nix
index ab610624f371..ea06107ed7ca 100644
--- a/pkgs/applications/version-management/fossil/default.nix
+++ b/pkgs/applications/version-management/fossil/default.nix
@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "fossil";
-  version = "2.19";
+  version = "2.20";
 
   src = fetchurl {
     url = "https://www.fossil-scm.org/home/tarball/version-${version}/fossil-${version}.tar.gz";
-    sha256 = "sha256-RZ9/7b4lRJqFVyfXwzutO8C/Pa6XPyxtvpp7gmEGoj4=";
+    sha256 = "1knff50rr8f39myxj50fprb9ya87cslmwz7zzfya56l33r7i7jh3";
   };
 
   nativeBuildInputs = [ installShellFiles tcl tcllib ];
diff --git a/pkgs/applications/version-management/git-and-tools/gitnuro/default.nix b/pkgs/applications/version-management/git-and-tools/gitnuro/default.nix
index 7c0dbefc5069..db79637ef9ff 100644
--- a/pkgs/applications/version-management/git-and-tools/gitnuro/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/gitnuro/default.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gitnuro";
-  version = "1.1.0";
+  version = "1.1.1";
 
   src = fetchurl {
     url = "https://github.com/JetpackDuba/Gitnuro/releases/download/v${version}/Gitnuro-linux-${version}.jar";
-    hash = "sha256-tAFFl14mmXhLr6V/vTDe9lwX7trsaTWgIqkwxD3mBUw=";
+    hash = "sha256-ugZBk/aQ2pjL9xY66g20MorAQ02GHIdJTv8ejadaBgY=";
   };
 
   icon = fetchurl {
diff --git a/pkgs/applications/version-management/git-and-tools/gitui/default.nix b/pkgs/applications/version-management/git-and-tools/gitui/default.nix
index ccbe59317832..3b383647c2c9 100644
--- a/pkgs/applications/version-management/git-and-tools/gitui/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/gitui/default.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gitui";
-  version = "0.21.0";
+  version = "0.22.0";
 
   src = fetchFromGitHub {
     owner = "extrawurst";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-B/RKPYq1U40NV3AM/cQi2eQaK5vxynP3JA0DReSBuCo=";
+    sha256 = "sha256-ZLGA0LHdGPqIoNG2k4nunVWYlOnwRT8nqTSwUWGkfCU=";
   };
 
-  cargoSha256 = "sha256-r4kritS3v8GgFZfWeeyrsy6v3IlH3DByTU8Ir4FDngs=";
+  cargoSha256 = "sha256-ArJerq3gLzPm66RWDCvkpPFyh7ZyaoqLO/3zSjFTL04=";
 
   nativeBuildInputs = [ pkg-config ];
 
@@ -32,6 +32,11 @@ rustPlatform.buildRustPackage rec {
   # Needed to get openssl-sys to use pkg-config.
   OPENSSL_NO_VENDOR = 1;
 
+  # The cargo config overrides linkers for some targets, breaking the build
+  # on e.g. `aarch64-linux`. These overrides are not required in the Nix
+  # environment: delete them.
+  postPatch = "rm .cargo/config";
+
   meta = with lib; {
     description = "Blazing fast terminal-ui for Git written in Rust";
     homepage = "https://github.com/extrawurst/gitui";
diff --git a/pkgs/applications/version-management/git-and-tools/lefthook/default.nix b/pkgs/applications/version-management/git-and-tools/lefthook/default.nix
index f5cf94629e62..def387980d63 100644
--- a/pkgs/applications/version-management/git-and-tools/lefthook/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/lefthook/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "lefthook";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "evilmartians";
     repo = "lefthook";
-    sha256 = "sha256-mkGyY50WBmVbZ9FEfZRWoGLeZy0HkBzYACbF2u8EN1o=";
+    sha256 = "sha256-ZMqqiPSNNJw9t3p5h/GUHa9cvl9LcJ4u0HMf1ag8qCc=";
   };
 
   vendorSha256 = "sha256-NTZz0EDIjGdh8dD9jxbNVdWb7NFJsdtnMp7H6Ni0EbQ=";
diff --git a/pkgs/applications/version-management/git-repo/default.nix b/pkgs/applications/version-management/git-repo/default.nix
index ddbbc1d1e4f3..e47ea6b12dbe 100644
--- a/pkgs/applications/version-management/git-repo/default.nix
+++ b/pkgs/applications/version-management/git-repo/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "git-repo";
-  version = "2.29.9";
+  version = "2.30";
 
   src = fetchFromGitHub {
     owner = "android";
     repo = "tools_repo";
     rev = "v${version}";
-    sha256 = "sha256-MJMVKdftA4PZ5vmrekcKAKX+0khHl3e83SXsn+P7VT8=";
+    sha256 = "sha256-Ck+Q7sHhMqUWu6WeA3DhY+svMxH2sU0WvmyvZ5qsW+E=";
   };
 
   # Fix 'NameError: name 'ssl' is not defined'
diff --git a/pkgs/applications/version-management/gitoxide/default.nix b/pkgs/applications/version-management/gitoxide/default.nix
index 9e513fd9676a..2f207e8ee474 100644
--- a/pkgs/applications/version-management/gitoxide/default.nix
+++ b/pkgs/applications/version-management/gitoxide/default.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gitoxide";
-  version = "0.17.0";
+  version = "0.18.0";
 
   src = fetchFromGitHub {
     owner = "Byron";
     repo = "gitoxide";
     rev = "v${version}";
-    sha256 = "sha256-UtQ9LcGE9mLowttAAwR1ujD+BSCosFk+GHQvDwG/CAQ=";
+    sha256 = "sha256-VB7v51YW4aA5WHVD5ZWFzv9hQskjQeqMzm+pQ9glODg=";
   };
 
-  cargoSha256 = "sha256-0cZy7hOaREtdFB0Ww1VSV4ILpB0utSBcKlC3t9fhum8=";
+  cargoSha256 = "sha256-uII6o/cJktpUFxROuu11dNSXx0p6phVVqszmbYK9Rd0=";
 
   nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = if stdenv.isDarwin
diff --git a/pkgs/applications/video/kooha/default.nix b/pkgs/applications/video/kooha/default.nix
index 37644b10252b..ba959ec5717e 100644
--- a/pkgs/applications/video/kooha/default.nix
+++ b/pkgs/applications/video/kooha/default.nix
@@ -50,6 +50,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     glib
     gst_all_1.gstreamer
+    gst_all_1.gst-plugins-good
     gst_all_1.gst-plugins-base
     gst_all_1.gst-plugins-ugly
     gtk4
diff --git a/pkgs/applications/video/media-downloader/default.nix b/pkgs/applications/video/media-downloader/default.nix
index 3d76b524e442..76e26ba01766 100644
--- a/pkgs/applications/video/media-downloader/default.nix
+++ b/pkgs/applications/video/media-downloader/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "media-downloader";
-  version = "2.6.0";
+  version = "2.7.0";
 
   src = fetchFromGitHub {
     owner = "mhogomchungu";
     repo = pname;
     rev = "${version}";
-    sha256 = "sha256-pDldAg4q6qGvRHuffKU49akDwwSTNCZPJ6AgauxgotI=";
+    sha256 = "sha256-uu/4S7cVWHOhBq52NF0AargE0nbPwjF0txSWL0DquQo=";
   };
 
   nativeBuildInputs = [ cmake qt5.wrapQtAppsHook ];
diff --git a/pkgs/applications/window-managers/gamescope/default.nix b/pkgs/applications/window-managers/gamescope/default.nix
index 7e4003c68046..7fdffc27f652 100644
--- a/pkgs/applications/window-managers/gamescope/default.nix
+++ b/pkgs/applications/window-managers/gamescope/default.nix
@@ -26,7 +26,7 @@
 }:
 let
   pname = "gamescope";
-  version = "3.11.48";
+  version = "3.11.49";
 in
 stdenv.mkDerivation {
   inherit pname version;
@@ -35,7 +35,7 @@ stdenv.mkDerivation {
     owner = "Plagman";
     repo = "gamescope";
     rev = "refs/tags/${version}";
-    hash = "sha256-/a0fW0NVIrg9tuK+mg+D+IOcq3rJJxKdFwspM1ZRR9M=";
+    hash = "sha256-GRq/b013wFRHzFz2YCulJRtcwzX/dhJKd8dkATSLug0=";
   };
 
   patches = [ ./use-pkgconfig.patch ];
@@ -85,7 +85,7 @@ stdenv.mkDerivation {
     description = "SteamOS session compositing window manager";
     homepage = "https://github.com/Plagman/gamescope";
     license = licenses.bsd2;
-    maintainers = with maintainers; [ nrdxp ];
+    maintainers = with maintainers; [ nrdxp zhaofengli ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/applications/window-managers/phosh/default.nix b/pkgs/applications/window-managers/phosh/default.nix
index 332fd509e421..d71ff01362d2 100644
--- a/pkgs/applications/window-managers/phosh/default.nix
+++ b/pkgs/applications/window-managers/phosh/default.nix
@@ -28,6 +28,7 @@
 , polkit
 , libsecret
 , evolution-data-server
+, nixosTests
 }:
 
 stdenv.mkDerivation rec {
@@ -122,6 +123,8 @@ stdenv.mkDerivation rec {
     providedSessions = [
       "sm.puri.Phosh"
     ];
+
+    tests.phosh = nixosTests.phosh;
   };
 
   meta = with lib; {
diff --git a/pkgs/data/icons/numix-icon-theme/default.nix b/pkgs/data/icons/numix-icon-theme/default.nix
index 410439da6ca6..cb425ee00cb5 100644
--- a/pkgs/data/icons/numix-icon-theme/default.nix
+++ b/pkgs/data/icons/numix-icon-theme/default.nix
@@ -11,13 +11,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "numix-icon-theme";
-  version = "22.08.16";
+  version = "22.11.17";
 
   src = fetchFromGitHub {
     owner = "numixproject";
     repo = pname;
     rev = version;
-    sha256 = "sha256-EveIr5XYyQYhz0AqZQBql3j0LnD8taNdzB/6IV7Mz2k=";
+    sha256 = "sha256-B6Yg9NkPBpByMMV4GcEBmOlSKx1s0MClGWL2RWIJMwA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/data/icons/whitesur-icon-theme/default.nix b/pkgs/data/icons/whitesur-icon-theme/default.nix
index 6270d2a66429..80f6b5ce24ae 100644
--- a/pkgs/data/icons/whitesur-icon-theme/default.nix
+++ b/pkgs/data/icons/whitesur-icon-theme/default.nix
@@ -9,8 +9,7 @@
 , themeVariants ? []
 }:
 
-let
-  pname = "Whitesur-icon-theme";
+let pname = "Whitesur-icon-theme";
 in
 lib.checkListOfEnum "${pname}: theme variants" [
   "default"
@@ -27,13 +26,13 @@ lib.checkListOfEnum "${pname}: theme variants" [
 
 stdenvNoCC.mkDerivation rec {
   inherit pname;
-  version = "2022-08-30";
+  version = "2022-11-17";
 
   src = fetchFromGitHub {
     owner = "vinceliuice";
     repo = pname;
     rev = version;
-    sha256 = "pcvRD4CUwUT46/kmMbnerj5mqPCcHIRreVIh9wz6Kfg=";
+    hash = "sha256-crZ6JQeXeSjTHGIBptioNiFZas7MksJcjaKGlMP4fo0=";
   };
 
   nativeBuildInputs = [ gtk3 jdupes ];
diff --git a/pkgs/development/compilers/chicken/4/eggDerivation.nix b/pkgs/development/compilers/chicken/4/eggDerivation.nix
index 10cf91579a40..96b3612b34ba 100644
--- a/pkgs/development/compilers/chicken/4/eggDerivation.nix
+++ b/pkgs/development/compilers/chicken/4/eggDerivation.nix
@@ -42,4 +42,8 @@ stdenv.mkDerivation ({
 
     runHook postInstall
   '';
-} // (builtins.removeAttrs args ["name" "buildInputs"]) // override)
+
+  meta = {
+    inherit (chicken.meta) platforms;
+  } // args.meta or {};
+} // (builtins.removeAttrs args ["name" "buildInputs" "meta"]) // override)
diff --git a/pkgs/development/compilers/chicken/5/eggDerivation.nix b/pkgs/development/compilers/chicken/5/eggDerivation.nix
index a6d19eaeb137..d1c8fc9e4736 100644
--- a/pkgs/development/compilers/chicken/5/eggDerivation.nix
+++ b/pkgs/development/compilers/chicken/5/eggDerivation.nix
@@ -39,4 +39,8 @@ stdenv.mkDerivation ({
 
     runHook postInstall
   '';
-} // (builtins.removeAttrs args ["name" "buildInputs"]) // override)
+
+  meta = {
+    inherit (chicken.meta) platforms;
+  } // args.meta or {};
+} // (builtins.removeAttrs args ["name" "buildInputs" "meta"]) // override)
diff --git a/pkgs/development/libraries/hiredis/default.nix b/pkgs/development/libraries/hiredis/default.nix
index 2c19c4ae7d01..6431dc5a1718 100644
--- a/pkgs/development/libraries/hiredis/default.nix
+++ b/pkgs/development/libraries/hiredis/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hiredis";
-  version = "1.0.2";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "redis";
     repo = "hiredis";
     rev = "v${version}";
-    sha256 = "0a55zk3qrw9yl27i87h3brg2hskmmzbfda77dhq9a4if7y70xnfb";
+    sha256 = "sha256-0ESRnZTL6/vMpek+2sb0YQU3ajXtzj14yvjfOSQYjf4=";
   };
 
   PREFIX = "\${out}";
diff --git a/pkgs/development/libraries/libhv/default.nix b/pkgs/development/libraries/libhv/default.nix
new file mode 100644
index 000000000000..a4314b996f22
--- /dev/null
+++ b/pkgs/development/libraries/libhv/default.nix
@@ -0,0 +1,34 @@
+{ lib, stdenv, fetchFromGitHub, cmake, curl, openssl, Security }:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libhv";
+  version = "1.3.0";
+
+  src = fetchFromGitHub {
+    owner = "ithewei";
+    repo = "libhv";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-LMk8B/1EofcQcIF3kGmtPdM2s+/gN9ctcsybwTpf4Po=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = [ curl openssl ] ++ lib.optional stdenv.isDarwin Security;
+
+  cmakeFlags = [
+    "-DENABLE_UDS=ON"
+    "-DWITH_MQTT=ON"
+    "-DWITH_CURL=ON"
+    "-DWITH_NGHTTP2=ON"
+    "-DWITH_OPENSSL=ON"
+    "-DWITH_KCP=ON"
+  ];
+
+  meta = with lib; {
+    description = "A c/c++ network library for developing TCP/UDP/SSL/HTTP/WebSocket/MQTT client/server";
+    homepage = "https://github.com/ithewei/libhv";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ sikmir ];
+    platforms = platforms.unix;
+  };
+})
diff --git a/pkgs/development/libraries/qt-5/modules/qtwebkit.nix b/pkgs/development/libraries/qt-5/modules/qtwebkit.nix
index bebfbdda8d8b..76f3481386f3 100644
--- a/pkgs/development/libraries/qt-5/modules/qtwebkit.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtwebkit.nix
@@ -69,5 +69,8 @@ qtModule {
 
   meta = {
     maintainers = with lib.maintainers; [ abbradar periklis ];
+    knownVulnerabilities = [
+      "QtWebkit upstream is unmaintained and receives no security updates, see https://blogs.gnome.org/mcatanzaro/2022/11/04/stop-using-qtwebkit/"
+    ];
   };
 }
diff --git a/pkgs/development/libraries/wxwidgets/wxGTK30.nix b/pkgs/development/libraries/wxwidgets/wxGTK30.nix
index 89b7ae1f94c4..3b848f788c10 100644
--- a/pkgs/development/libraries/wxwidgets/wxGTK30.nix
+++ b/pkgs/development/libraries/wxwidgets/wxGTK30.nix
@@ -41,13 +41,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "wxwidgets";
-  version = "3.0.5";
+  version = "3.0.5.1";
 
   src = fetchFromGitHub {
     owner = "wxWidgets";
     repo = "wxWidgets";
     rev = "v${version}";
-    hash = "sha256-p69nNCg552j+nldGY0oL65uFRVu4xXCkoE10F5MwY9A=";
+    hash = "sha256-I91douzXDAfDgm4Pplf17iepv4vIRhXZDRFl9keJJq0=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/development/ocaml-modules/iter/default.nix b/pkgs/development/ocaml-modules/iter/default.nix
index 0154029b5504..3faa8244b6d7 100644
--- a/pkgs/development/ocaml-modules/iter/default.nix
+++ b/pkgs/development/ocaml-modules/iter/default.nix
@@ -1,25 +1,24 @@
 { lib, fetchFromGitHub, buildDunePackage, ocaml, dune-configurator
-, mdx, qtest, result
+, result, seq
+, mdx, ounit2, qcheck-core
 }:
 
 buildDunePackage rec {
   pname = "iter";
-  version = "1.4";
-
-  useDune2 = true;
+  version = "1.6";
 
   src = fetchFromGitHub {
     owner = "c-cube";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Kk92GM7IVXOSVBkeN6wj67Q3UGCyuOOVi2umpn1AZTo=";
+    sha256 = "sha256-FbM/Vk/h4wkrBjyf9/QXTvTOA0nNqsdHP1mDnVkg1is=";
   };
 
   buildInputs = [ dune-configurator ];
-  propagatedBuildInputs = [ result ];
+  propagatedBuildInputs = [ result seq ];
 
   doCheck = lib.versionAtLeast ocaml.version "4.08";
-  checkInputs = [ mdx.bin qtest ];
+  checkInputs = [ mdx.bin ounit2 qcheck-core ];
 
   meta = {
     homepage = "https://github.com/c-cube/sequence";
diff --git a/pkgs/development/ocaml-modules/mlgmpidl/default.nix b/pkgs/development/ocaml-modules/mlgmpidl/default.nix
index 33f9f2d8e6b0..7952f811e7be 100644
--- a/pkgs/development/ocaml-modules/mlgmpidl/default.nix
+++ b/pkgs/development/ocaml-modules/mlgmpidl/default.nix
@@ -1,17 +1,18 @@
-{ stdenv, lib, fetchFromGitHub, perl, ocaml, findlib, camlidl, gmp, mpfr }:
+{ stdenv, lib, fetchFromGitHub, perl, ocaml, findlib, camlidl, gmp, mpfr, bigarray-compat }:
 
 stdenv.mkDerivation rec {
   pname = "ocaml${ocaml.version}-mlgmpidl";
-  version = "1.2.12";
+  version = "1.2.15";
   src = fetchFromGitHub {
     owner = "nberth";
     repo = "mlgmpidl";
     rev = version;
-    sha256 = "17xqiclaqs4hmnb92p9z6z9a1xfr31vcn8nlnj8ykk57by31vfza";
+    sha256 = "sha256-85wy5eVWb5qdaa2lLDcfqlUTIY7vnN3nGMdxoj5BslU=";
   };
 
   nativeBuildInputs = [ perl ocaml findlib camlidl ];
   buildInputs = [ gmp mpfr ];
+  propagatedBuildInputs = [ bigarray-compat ];
 
   strictDeps = true;
 
@@ -19,6 +20,7 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--gmp-prefix ${gmp.dev}"
     "--mpfr-prefix ${mpfr.dev}"
+    "-disable-profiling"
   ];
 
   postConfigure = ''
diff --git a/pkgs/development/python-modules/aioairzone/default.nix b/pkgs/development/python-modules/aioairzone/default.nix
index 61b67cb32a31..98bb7a8c7bc3 100644
--- a/pkgs/development/python-modules/aioairzone/default.nix
+++ b/pkgs/development/python-modules/aioairzone/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "aioairzone";
-  version = "0.4.9";
+  version = "0.5.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "Noltari";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-qG+EPZjH3I4TRGka7J21ukGpuJQfA/Nuy6DbIUnykcs=";
+    hash = "sha256-L2R4Qu72bvUjJyE/bBMeKufK/TAFw9u/oGowS1rCqP4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/aioesphomeapi/default.nix b/pkgs/development/python-modules/aioesphomeapi/default.nix
index c1fd962a41f3..87db5ad026a7 100644
--- a/pkgs/development/python-modules/aioesphomeapi/default.nix
+++ b/pkgs/development/python-modules/aioesphomeapi/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "aioesphomeapi";
-  version = "11.4.3";
+  version = "11.5.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "esphome";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-g901qWU6aiaV0kLmtWJffXZrOsKjvOGI0TOgQFzuuPA=";
+    hash = "sha256-z3ILdtxDU4xLBY5mVAKal2nBo2sdO5rlSQDyexwHUtI=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/aws-lambda-builders/default.nix b/pkgs/development/python-modules/aws-lambda-builders/default.nix
index b5198752ad82..b7c2cf8994d4 100644
--- a/pkgs/development/python-modules/aws-lambda-builders/default.nix
+++ b/pkgs/development/python-modules/aws-lambda-builders/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "aws-lambda-builders";
-  version = "1.20.0";
+  version = "1.23.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "awslabs";
     repo = "aws-lambda-builders";
     rev = "refs/tags/v${version}";
-    hash = "sha256-+XOxz3xWIYacfUizztd4mH5kvBw/dkN9WiS38dONs7Y=";
+    hash = "sha256-3jzUowSeO6j7DzIlOkeU3KUFFIUi7cEyvjbIL8uRGcU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/azure-mgmt-security/default.nix b/pkgs/development/python-modules/azure-mgmt-security/default.nix
index 30c4fe2e7627..f0c116a1bb68 100644
--- a/pkgs/development/python-modules/azure-mgmt-security/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-security/default.nix
@@ -1,18 +1,24 @@
-{ lib, buildPythonPackage, fetchPypi, isPy27
+{ lib
+, buildPythonPackage
+, fetchPypi
 , azure-common
 , azure-mgmt-core
 , msrest
 , msrestazure
+, pythonOlder
+, typing-extensions
 }:
 
 buildPythonPackage rec {
-  version = "2.0.0";
   pname = "azure-mgmt-security";
-  disabled = isPy27;
+  version = "3.0.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-2sr3clHf5EvbXAx5FH3d3ab1/Y48r6Ojww3p9WX35aM=";
+    hash = "sha256-vLp874V/awKi2Yr+sH+YcbFij6M9iGGrE4fnMufbP4Q=";
     extension = "zip";
   };
 
@@ -21,12 +27,17 @@ buildPythonPackage rec {
     azure-mgmt-core
     msrest
     msrestazure
+  ] ++ lib.optionals (pythonOlder "3.8") [
+    typing-extensions
   ];
 
   # no tests included
   doCheck = false;
 
-  pythonImportsCheck = [ "azure.common" "azure.mgmt.security" ];
+  pythonImportsCheck = [
+    "azure.common"
+    "azure.mgmt.security"
+  ];
 
   meta = with lib; {
     description = "Microsoft Azure Security Center Management Client Library for Python";
diff --git a/pkgs/development/python-modules/boschshcpy/default.nix b/pkgs/development/python-modules/boschshcpy/default.nix
index 9b824c33e7b2..daee50ffa832 100644
--- a/pkgs/development/python-modules/boschshcpy/default.nix
+++ b/pkgs/development/python-modules/boschshcpy/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "boschshcpy";
-  version = "0.2.35";
+  version = "0.2.36";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "tschamm";
     repo = pname;
     rev = version;
-    sha256 = "sha256-MzVv0HN87eDsz0mP/rqH6FZVRgq95iTuu8mikkofT30=";
+    sha256 = "sha256-X/nlu/hwdgmUOw7+hALRhyCG/vphnWAK22fSWuUAjs0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/boxx/default.nix b/pkgs/development/python-modules/boxx/default.nix
index cec5c0d638dd..43fea29cc2f5 100644
--- a/pkgs/development/python-modules/boxx/default.nix
+++ b/pkgs/development/python-modules/boxx/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "boxx";
-  version = "0.10.7";
+  version = "0.10.8";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-OPbqCsTZZskZOJMcK1OJsG3Qgx4K0X217g5pNWQZDAM=";
+    hash = "sha256-uk4DYmbV/4zSyL2QzlAJLvgC6ieBjP/xkuyDktUEmIo=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/bthome-ble/default.nix b/pkgs/development/python-modules/bthome-ble/default.nix
index 4e53728642df..5831ea18ee33 100644
--- a/pkgs/development/python-modules/bthome-ble/default.nix
+++ b/pkgs/development/python-modules/bthome-ble/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "bthome-ble";
-  version = "2.2.1";
+  version = "2.3.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -20,8 +20,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "Bluetooth-Devices";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-IaDnQCZJZipiPW6lOLrdxw7QfPx/zlwaizkBxv8I2V8=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-4KsMYQQN/4A2sbk2Fj8CYOBf7/UAciJ4wTSFYZaCfdk=";
   };
 
   nativeBuildInputs = [
@@ -51,6 +51,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for BThome BLE devices";
     homepage = "https://github.com/Bluetooth-Devices/bthome-ble";
+    changelog = "https://github.com/bluetooth-devices/bthome-ble/blob/v${version}/CHANGELOG.md";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/clickhouse-cityhash/default.nix b/pkgs/development/python-modules/clickhouse-cityhash/default.nix
index 4e632cb34038..73be71e67e5b 100644
--- a/pkgs/development/python-modules/clickhouse-cityhash/default.nix
+++ b/pkgs/development/python-modules/clickhouse-cityhash/default.nix
@@ -2,21 +2,30 @@
 , buildPythonPackage
 , fetchPypi
 , setuptools
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "clickhouse-cityhash";
-  version = "1.0.2.3";
+  version = "1.0.2.4";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0z8nl0ly2p1h6nygwxs6y40q8y424w40fkjv3jyf8vvcg4h7sdrg";
+    sha256 = "sha256-ezEl19CqE8LMTnWDqWWmv7CqlqEhMUdbRCVSustV9Pg=";
   };
 
-  propagatedBuildInputs = [ setuptools ];
+  propagatedBuildInputs = [
+    setuptools
+  ];
 
   doCheck = false;
-  pythonImportsCheck = [ "clickhouse_cityhash" ];
+
+  pythonImportsCheck = [
+    "clickhouse_cityhash"
+  ];
 
   meta = with lib; {
     description = "Python-bindings for CityHash, a fast non-cryptographic hash algorithm";
diff --git a/pkgs/development/python-modules/clize/default.nix b/pkgs/development/python-modules/clize/default.nix
index a78b55704aec..a848125a55dc 100644
--- a/pkgs/development/python-modules/clize/default.nix
+++ b/pkgs/development/python-modules/clize/default.nix
@@ -8,9 +8,9 @@
 , pytestCheckHook
 , pythonOlder
 , python-dateutil
-, setuptools
+, repeated-test
+, setuptools-scm
 , sigtools
-, unittest2
 }:
 
 buildPythonPackage rec {
@@ -26,7 +26,7 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    setuptools
+    setuptools-scm
   ];
 
   propagatedBuildInputs = [
@@ -42,14 +42,11 @@ buildPythonPackage rec {
     ];
   };
 
-  # repeated_test no longer exists in nixpkgs
-  # also see: https://github.com/epsy/clize/issues/74
-  doCheck = false;
   checkInputs = [
     pytestCheckHook
     python-dateutil
     pygments
-    unittest2
+    repeated-test
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/compreffor/default.nix b/pkgs/development/python-modules/compreffor/default.nix
index 183645053771..0c1f376aeaf6 100644
--- a/pkgs/development/python-modules/compreffor/default.nix
+++ b/pkgs/development/python-modules/compreffor/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "compreffor";
-  version = "0.5.2";
+  version = "0.5.3";
 
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-rsC0HJCl3IGqEqUqfCwRRNwzjtfGDlxcCkeOU3On22Q=";
+    sha256 = "sha256-fUEpbU+wqh72lt/ZJdKvMifUAwYivpmzx9QQfcb4cTo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/datasette/default.nix b/pkgs/development/python-modules/datasette/default.nix
index 79f1f92a52bc..8394befc51e6 100644
--- a/pkgs/development/python-modules/datasette/default.nix
+++ b/pkgs/development/python-modules/datasette/default.nix
@@ -29,7 +29,7 @@
 
 buildPythonPackage rec {
   pname = "datasette";
-  version = "0.63.1";
+  version = "0.63.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -37,8 +37,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "simonw";
     repo = pname;
-    rev = version;
-    sha256 = "sha256-KMD4dmflmBp0s4nueLyPpDnXngpftS9/h5M6RPYMGrk=";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-VDmh2Q/ab5xaNbj0APuQ9pkZ+GHoNXW2crrJXi556Fk=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/datashader/default.nix b/pkgs/development/python-modules/datashader/default.nix
index 82f0851b1ab3..a72bc5b22bbe 100644
--- a/pkgs/development/python-modules/datashader/default.nix
+++ b/pkgs/development/python-modules/datashader/default.nix
@@ -25,14 +25,14 @@
 
 buildPythonPackage rec {
   pname = "datashader";
-  version = "0.14.2";
+  version = "0.14.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-q8aOpuJD6aX9m9jPm9PY5vZGBJL6Jpf+pPHbcQVOJLg=";
+    hash = "sha256-zHbo03Ll40H8okBIaqrWSJby4aQAg7ukETNHerUPX28=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/dbus-fast/default.nix b/pkgs/development/python-modules/dbus-fast/default.nix
index d8e4507ae8b7..b658eeefd77f 100644
--- a/pkgs/development/python-modules/dbus-fast/default.nix
+++ b/pkgs/development/python-modules/dbus-fast/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dbus-fast";
-  version = "1.73.0";
+  version = "1.75.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-JkhcDefz7SiZ+w6ijPAnKNyxTZ/5tmQUyOPnKb3EFGc=";
+    hash = "sha256-bmHUfRytUGlS0X1PEQHFocMZ4+FslA2rvzqHNE+3B3E=";
   };
 
   nativeBuildInputs = [
@@ -89,9 +89,9 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
-    changelog = "https://github.com/Bluetooth-Devices/dbus-fast/releases/tag/v${version}";
     description = "Faster version of dbus-next";
     homepage = "https://github.com/bluetooth-devices/dbus-fast";
+    changelog = "https://github.com/Bluetooth-Devices/dbus-fast/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/diff-cover/default.nix b/pkgs/development/python-modules/diff-cover/default.nix
index 2e62913220e9..a3ea4034e8b6 100644
--- a/pkgs/development/python-modules/diff-cover/default.nix
+++ b/pkgs/development/python-modules/diff-cover/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "diff-cover";
-  version = "7.0.1";
+  version = "7.0.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "diff_cover";
     inherit version;
-    hash = "sha256-aSWDVdr4J2BXqS5CzsUllK2M/n3VBdbw5W/kQLxEGNA=";
+    hash = "sha256-OENUR9rTKrt+AdHDlCU5AhpSI4ijtYXVg6biB8wTNJc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/django-webpack-loader/default.nix b/pkgs/development/python-modules/django-webpack-loader/default.nix
index ee51b0e7c8ec..d1d5f926fdab 100644
--- a/pkgs/development/python-modules/django-webpack-loader/default.nix
+++ b/pkgs/development/python-modules/django-webpack-loader/default.nix
@@ -1,17 +1,28 @@
-{ lib, buildPythonPackage, fetchPypi }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+}:
 
 buildPythonPackage rec {
   pname = "django-webpack-loader";
-  version = "1.6.0";
+  version = "1.7.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-opQY/0FpADW+ENLJSgZV2rCZAJxouJiDmBPWoQmxTXE=";
+    hash = "sha256-agZTglc3cbr0AHVMTTnAkTsKKaRTqUHfuRIu6+0hVy8=";
   };
 
   # django.core.exceptions.ImproperlyConfigured (path issue with DJANGO_SETTINGS_MODULE?)
   doCheck = false;
 
+  pythonImportsCheck = [
+    "webpack_loader"
+  ];
+
   meta = with lib; {
     description = "Use webpack to generate your static bundles";
     homepage = "https://github.com/owais/django-webpack-loader";
diff --git a/pkgs/development/python-modules/dulwich/default.nix b/pkgs/development/python-modules/dulwich/default.nix
index a79de8f96c01..c3bab1180cf9 100644
--- a/pkgs/development/python-modules/dulwich/default.nix
+++ b/pkgs/development/python-modules/dulwich/default.nix
@@ -10,11 +10,10 @@
 , glibcLocales
 , gnupg
 , gpgme
-, mock
-, urllib3
 , paramiko
 , pytestCheckHook
 , pythonOlder
+, urllib3
 }:
 
 buildPythonPackage rec {
@@ -36,18 +35,28 @@ buildPythonPackage rec {
     urllib3
   ];
 
+  passthru.optional-dependencies = {
+    fastimport = [
+      fastimport
+    ];
+    pgp = [
+      gpgme
+      gnupg
+    ];
+    paramiko = [
+      paramiko
+    ];
+  };
+
   checkInputs = [
-    fastimport
     gevent
     geventhttpclient
     git
     glibcLocales
-    gpgme
-    gnupg
-    mock
-    paramiko
     pytestCheckHook
-  ];
+  ] ++ passthru.optional-dependencies.fastimport
+  ++ passthru.optional-dependencies.pgp
+  ++ passthru.optional-dependencies.paramiko;
 
   doCheck = !stdenv.isDarwin;
 
@@ -70,7 +79,7 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
-    description = "Simple Python implementation of the Git file formats and protocols";
+    description = "Implementation of the Git file formats and protocols";
     longDescription = ''
       Dulwich is a Python implementation of the Git file formats and protocols, which
       does not depend on Git itself. All functionality is available in pure Python.
diff --git a/pkgs/development/python-modules/fakeredis/default.nix b/pkgs/development/python-modules/fakeredis/default.nix
index 2b42454805c8..317f3d406759 100644
--- a/pkgs/development/python-modules/fakeredis/default.nix
+++ b/pkgs/development/python-modules/fakeredis/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "fakeredis";
-  version = "1.10.1";
+  version = "2.0.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "dsoftwareinc";
     repo = "fakeredis-py";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Tqm1p3CNU61aHhiVyP5Gt6bMxni3wvEvR3HFv328Hk0=";
+    hash = "sha256-y9fuVg5Mu0ZT8hoja9V5mEfOz/hPH66Zbk5Rr/luPSc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/filemagic/default.nix b/pkgs/development/python-modules/filemagic/default.nix
deleted file mode 100644
index 96ee0a95b283..000000000000
--- a/pkgs/development/python-modules/filemagic/default.nix
+++ /dev/null
@@ -1,30 +0,0 @@
-{ stdenv, lib, buildPythonPackage, fetchFromGitHub, file
-, isPy3k, mock, unittest2 }:
-
-buildPythonPackage {
-  pname = "filemagic";
-  version = "1.6";
-  disabled = !isPy3k; # asserts on ResourceWarning
-
-  # Don't use the PyPI source because it's missing files required for testing
-  src = fetchFromGitHub {
-    owner = "aliles";
-    repo = "filemagic";
-    rev = "138649062f769fb10c256e454a3e94ecfbf3017b";
-    sha256 = "1jxf928jjl2v6zv8kdnfqvywdwql1zqkm1v5xn1d5w0qjcg38d4n";
-  };
-
-  postPatch = ''
-    substituteInPlace magic/api.py --replace "ctypes.util.find_library('magic')" \
-      "'${file}/lib/libmagic${stdenv.hostPlatform.extensions.sharedLibrary}'"
-  '';
-
-  checkInputs = [ mock ] ++ lib.optionals (!isPy3k) [ unittest2 ];
-
-  meta = with lib; {
-    description = "File type identification using libmagic";
-    homepage = "https://github.com/aliles/filemagic";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ erikarvstedt ];
-  };
-}
diff --git a/pkgs/development/python-modules/flux-led/default.nix b/pkgs/development/python-modules/flux-led/default.nix
index 65c6151fdf6d..21d1a51f8c41 100644
--- a/pkgs/development/python-modules/flux-led/default.nix
+++ b/pkgs/development/python-modules/flux-led/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "flux-led";
-  version = "0.28.32";
+  version = "0.28.34";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "Danielhiversen";
     repo = "flux_led";
     rev = "refs/tags/${version}";
-    sha256 = "sha256-YZ0ox04xakpazOIAERM2EO5c4PzmaSwYWULSjp0MJbw=";
+    hash = "sha256-bIL9ivjCLKeTLK3n0ytgGkXQggsuDiMCY7kAtE81qfY=";
   };
 
   propagatedBuildInputs = [
@@ -44,6 +44,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python library to communicate with the flux_led smart bulbs";
     homepage = "https://github.com/Danielhiversen/flux_led";
+    changelog = "https://github.com/Danielhiversen/flux_led/releases/tag/${version}";
     license = licenses.lgpl3Plus;
     maintainers = with maintainers; [ colemickens ];
     platforms = platforms.linux;
diff --git a/pkgs/development/python-modules/g2pkk/default.nix b/pkgs/development/python-modules/g2pkk/default.nix
new file mode 100644
index 000000000000..98e03806d2ff
--- /dev/null
+++ b/pkgs/development/python-modules/g2pkk/default.nix
@@ -0,0 +1,36 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, jamo
+, nltk
+}:
+
+buildPythonPackage rec {
+  pname = "g2pkk";
+  version = "0.1.2";
+  format = "setuptools";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-YarV1Btn1x3Sm4Vw/JDSyJy3ZJMXAQHZJJJklSG0R+Q=";
+  };
+
+  propagatedBuildInputs = [
+    jamo
+    nltk
+  ];
+
+  pythonImportsCheck = [
+    "g2pkk"
+  ];
+
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Cross-platform g2p for Korean";
+    homepage = "https://github.com/harmlessman/g2pkk";
+    license = licenses.asl20;
+    maintainers = teams.tts.members;
+  };
+}
+
diff --git a/pkgs/development/python-modules/geopy/default.nix b/pkgs/development/python-modules/geopy/default.nix
index 3ef58b9ec470..965411fe4af8 100644
--- a/pkgs/development/python-modules/geopy/default.nix
+++ b/pkgs/development/python-modules/geopy/default.nix
@@ -11,21 +11,17 @@
 
 buildPythonPackage rec {
   pname = "geopy";
-  version = "2.2.0";
-  disabled = pythonOlder "3.5";
+  version = "2.3.0";
+  format = "setuptools";
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
-    rev = version;
-    sha256 = "sha256-zFz0T/M/CABKkChuiKsFkWj2pphZuFeE5gz0HxZYaz8=";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-bHfjUfuiEH3AxRDTLmbm67bKOw6fBuMQDUQA2NLg800=";
   };
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "geographiclib<2,>=1.49" "geographiclib"
-  '';
-
   propagatedBuildInputs = [
     geographiclib
   ];
diff --git a/pkgs/development/python-modules/ibm-cloud-sdk-core/default.nix b/pkgs/development/python-modules/ibm-cloud-sdk-core/default.nix
index 3e2d61843de2..c1e70fbf9902 100644
--- a/pkgs/development/python-modules/ibm-cloud-sdk-core/default.nix
+++ b/pkgs/development/python-modules/ibm-cloud-sdk-core/default.nix
@@ -7,7 +7,6 @@
 , pythonOlder
 , requests
 , responses
-, tox
 }:
 
 buildPythonPackage rec {
@@ -31,7 +30,6 @@ buildPythonPackage rec {
   checkInputs = [
     pytestCheckHook
     responses
-    tox
   ];
 
   disabledTests = [
diff --git a/pkgs/development/python-modules/identify/default.nix b/pkgs/development/python-modules/identify/default.nix
index 4750b591f66e..86ac0542591e 100644
--- a/pkgs/development/python-modules/identify/default.nix
+++ b/pkgs/development/python-modules/identify/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "identify";
-  version = "2.5.8";
+  version = "2.5.9";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "pre-commit";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-QI4NtNPkR3mD/UVFeKimo5pgBmnRKaxQ6JiwPDbjh/0=";
+    sha256 = "sha256-5ISxzOTTlA1EcBO5N6YtBEah0SRehGeVIONj30zOKk0=";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/jamo/default.nix b/pkgs/development/python-modules/jamo/default.nix
new file mode 100644
index 000000000000..e7bebd52db44
--- /dev/null
+++ b/pkgs/development/python-modules/jamo/default.nix
@@ -0,0 +1,34 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "jamo";
+  version = "0.4.1";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "JDongian";
+    repo = "python-jamo";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-QHI3Rqf1aQOsW49A/qnIwRnPuerbtyerf+eWIiEvyho=";
+  };
+
+  pythonImportsCheck = [
+    "jamo"
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  meta = with lib; {
+    changelog = "https://github.com/JDongian/python-jamo/releases/tag/v${version}";
+    description = "Hangul syllable decomposition and synthesis using jamo";
+    homepage = "https://github.com/JDongian/python-jamo";
+    license = licenses.asl20;
+    maintainers = teams.tts.members;
+  };
+}
diff --git a/pkgs/development/python-modules/lupa/default.nix b/pkgs/development/python-modules/lupa/default.nix
index b2099e162d20..70fed80b282f 100644
--- a/pkgs/development/python-modules/lupa/default.nix
+++ b/pkgs/development/python-modules/lupa/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "lupa";
-  version = "1.13";
+  version = "1.14.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-4dlKwqYw0nECfawsIdFCh3HZ6p1NiPFfIKd4E0DwKk4=";
+    sha256 = "sha256-0P1OYK0Un+JckFMOKg4DKkKm8EVfKcoO24Fw1ux1HG4=";
   };
 
   nativeBuildInputs = [ cython ];
diff --git a/pkgs/development/python-modules/mastodon-py/default.nix b/pkgs/development/python-modules/mastodon-py/default.nix
index be1c3d6532ef..ada014a6b81d 100644
--- a/pkgs/development/python-modules/mastodon-py/default.nix
+++ b/pkgs/development/python-modules/mastodon-py/default.nix
@@ -18,13 +18,13 @@
 
 buildPythonPackage rec {
   pname = "mastodon-py";
-  version = "1.6.1";
+  version = "1.6.3";
 
   src = fetchFromGitHub {
     owner = "halcy";
     repo = "Mastodon.py";
     rev = "refs/tags/${version}";
-    sha256 = "sha256-ip2TT5ISOS6HJOnTWajOR5Bajs8ba9QX1EIuPmdHLsE=";
+    sha256 = "sha256-bzacM5bJa936sBW+hgm9GOezW8cVY2oPaWApqjDYLSo=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/name-that-hash/default.nix b/pkgs/development/python-modules/name-that-hash/default.nix
index de073e502dc8..e68764b13ff7 100644
--- a/pkgs/development/python-modules/name-that-hash/default.nix
+++ b/pkgs/development/python-modules/name-that-hash/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "name-that-hash";
-  version = "1.10";
+  version = "1.11.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "HashPals";
     repo = pname;
     rev = version;
-    hash = "sha256-3sddUPoC3NfKQzmNgqPf/uHaYN9VZBqsmV712uz1Phg=";
+    hash = "sha256-zOb4BS3zG1x8GLXAooqqvMOw0fNbw35JuRWOdGP26/8=";
   };
 
   # TODO remove on next update which bumps rich
diff --git a/pkgs/development/python-modules/od/default.nix b/pkgs/development/python-modules/od/default.nix
index de64e2f8fdc8..805aec6c1e69 100644
--- a/pkgs/development/python-modules/od/default.nix
+++ b/pkgs/development/python-modules/od/default.nix
@@ -1,25 +1,34 @@
-{ lib, buildPythonPackage, fetchPypi, unittest2 }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+, repeated-test
+}:
 
 buildPythonPackage rec {
   pname = "od";
   version = "2.0.2";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-uGkj2Z8mLg51IV+FOqwZl1hT7zVyjmD1CcY/VbH4tKk=";
+    hash = "sha256-uGkj2Z8mLg51IV+FOqwZl1hT7zVyjmD1CcY/VbH4tKk=";
   };
 
-  # repeated_test no longer exists in nixpkgs
-  # also see: https://github.com/epsy/od/issues/1
-  doCheck = false;
   checkInputs = [
-    unittest2
+    repeated-test
+  ];
+
+  pythonImportsCheck = [
+    "od"
   ];
 
   meta = with lib; {
     description = "Shorthand syntax for building OrderedDicts";
     homepage = "https://github.com/epsy/od";
     license = licenses.mit;
+    maintainers = with maintainers; [ ];
   };
-
 }
diff --git a/pkgs/development/python-modules/peaqevcore/default.nix b/pkgs/development/python-modules/peaqevcore/default.nix
index c3fe1c044708..a5220f018011 100644
--- a/pkgs/development/python-modules/peaqevcore/default.nix
+++ b/pkgs/development/python-modules/peaqevcore/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "peaqevcore";
-  version = "7.3.3";
+  version = "7.4.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-fg5/5x4vUsm0kvVJtvlgB3PZSmU4pXkU6V0+yEDqNRg=";
+    hash = "sha256-7b6fF6wVNo4kBJ+s1lxNSl1C2vZjnAmHOtVSmqoiY9Q=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/plotext/default.nix b/pkgs/development/python-modules/plotext/default.nix
new file mode 100644
index 000000000000..8c6d0b39985c
--- /dev/null
+++ b/pkgs/development/python-modules/plotext/default.nix
@@ -0,0 +1,30 @@
+{ buildPythonPackage
+, fetchFromGitHub
+, lib
+}:
+
+buildPythonPackage rec {
+  pname = "plotext";
+  version = "5.2.8";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "piccolomo";
+    repo = pname;
+    rev = "refs/tags/${version}";
+    hash = "sha256-V7N7p5RxLKYLmJeojikYJ/tT/IpVGzG3ZPVvUisDAVs=";
+  };
+
+  # Package does not have a conventional test suite that can be run with either
+  # `pytestCheckHook` or the standard setuptools testing situation.
+  doCheck = false;
+
+  pythonImportsCheck = [ "plotext" ];
+
+  meta = with lib; {
+    description = "Plotting directly in the terminal";
+    homepage = "https://github.com/piccolomo/plotext";
+    license = licenses.mit;
+    maintainers = with maintainers; [ samuela ];
+  };
+}
diff --git a/pkgs/development/python-modules/prodict/default.nix b/pkgs/development/python-modules/prodict/default.nix
new file mode 100644
index 000000000000..a6fdc61658dd
--- /dev/null
+++ b/pkgs/development/python-modules/prodict/default.nix
@@ -0,0 +1,35 @@
+{ buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, pytestCheckHook
+, lib
+}:
+
+buildPythonPackage rec {
+  pname   = "prodict";
+  version = "0.8.6";
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "ramazanpolat";
+    repo = pname;
+    rev = version;
+    hash = "sha256-c46JEQFg4KRwerqpMSgh6+tYRpKTOX02Lzsq4/meS3o=";
+  };
+
+  # make setuptools happy on case-sensitive filesystems
+  postPatch = ''if [[ ! -f README.md ]]; then mv README.MD README.md; fi'';
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "prodict" ];
+
+  meta = {
+    description = "Access Python dictionary as a class with type hinting and autocompletion";
+    homepage = "https://github.com/ramazanpolat/prodict";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ bcdarwin ];
+  };
+}
diff --git a/pkgs/development/python-modules/pwntools/default.nix b/pkgs/development/python-modules/pwntools/default.nix
index dad2c04b0d6f..35ad60317ad4 100644
--- a/pkgs/development/python-modules/pwntools/default.nix
+++ b/pkgs/development/python-modules/pwntools/default.nix
@@ -84,7 +84,7 @@ buildPythonPackage rec {
   '';
 
   meta = with lib; {
-    homepage = "http://pwntools.com";
+    homepage = "https://pwntools.com";
     description = "CTF framework and exploit development library";
     license = licenses.mit;
     maintainers = with maintainers; [ bennofs kristoff3r pamplemousse ];
diff --git a/pkgs/development/python-modules/pypandoc/default.nix b/pkgs/development/python-modules/pypandoc/default.nix
index eb7287e4a1b0..87cfe2708dfd 100644
--- a/pkgs/development/python-modules/pypandoc/default.nix
+++ b/pkgs/development/python-modules/pypandoc/default.nix
@@ -1,16 +1,24 @@
-{ lib, substituteAll, buildPythonPackage, fetchFromGitHub
-, pandoc, texlive
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pandoc
+, pandocfilters
+, pythonOlder
+, substituteAll
+, texlive
 }:
 
 buildPythonPackage rec {
   pname = "pypandoc";
-  version = "1.8.1";
+  version = "1.10";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
-    owner = "NicklasTegner";
+    owner = "JessicaTegner";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-1vQmONQFJrjptwVVjw25Wyt59loatjScsdnSax+q/f8=";
+    hash = "sha256:05m585l4sipjzpkrv4yj5s7w45yxhxlym55lkhnavsshlvisinkz";
   };
 
   patches = [
@@ -24,11 +32,16 @@ buildPythonPackage rec {
 
   checkInputs = [
     texlive.combined.scheme-small
+    pandocfilters
+  ];
+
+  pythonImportsCheck = [
+    "pypandoc"
   ];
 
   meta = with lib; {
     description = "Thin wrapper for pandoc";
-    homepage = "https://github.com/NicklasTegner/pypandoc";
+    homepage = "https://github.com/JessicaTegner/pypandoc";
     license = licenses.mit;
     maintainers = with maintainers; [ sternenseemann bennofs ];
   };
diff --git a/pkgs/development/python-modules/pyrect/default.nix b/pkgs/development/python-modules/pyrect/default.nix
index 54566658443c..1d0a0ba022fe 100644
--- a/pkgs/development/python-modules/pyrect/default.nix
+++ b/pkgs/development/python-modules/pyrect/default.nix
@@ -1,25 +1,28 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, tox
 , pytestCheckHook
 , pygame
 }:
+
 buildPythonPackage rec {
-  pname = "PyRect";
+  pname = "pyrect";
   version = "0.2.0";
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "PyRect";
+    inherit version;
     sha256 = "sha256-9lFV9t+bkptnyv+9V8CUfFrlRJ07WA0XgHS/+0egm3g=";
   };
 
-  checkInputs = [ tox pytestCheckHook pygame ];
-  pythonImportsCheck = [ "pyrect" ];
+  checkInputs = [ pytestCheckHook pygame ];
+
   preCheck = ''
     export LC_ALL="en_US.UTF-8"
   '';
 
+  pythonImportsCheck = [ "pyrect" ];
+
   meta = with lib; {
     description = "Simple module with a Rect class for Pygame-like rectangular areas";
     homepage = "https://github.com/asweigart/pyrect";
diff --git a/pkgs/development/python-modules/pyrogram/default.nix b/pkgs/development/python-modules/pyrogram/default.nix
index a0ce4ea814d3..bd5433c7a5fb 100644
--- a/pkgs/development/python-modules/pyrogram/default.nix
+++ b/pkgs/development/python-modules/pyrogram/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pyrogram";
-  version = "2.0.59";
+  version = "2.0.62";
 
   disabled = pythonOlder "3.7";
 
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "pyrogram";
     repo = "pyrogram";
     rev = "v${version}";
-    hash = "sha256-vGgtVXvi/zvbU8f+LBQJN8GSxyVqdv/fBYfsBR4BKf4=";
+    hash = "sha256-Kex9xIjcAYCzHeqWoDAIgTMuih0s42/O2zfTYxWEqbM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pysma/default.nix b/pkgs/development/python-modules/pysma/default.nix
index 96864141e054..de1bba50740c 100644
--- a/pkgs/development/python-modules/pysma/default.nix
+++ b/pkgs/development/python-modules/pysma/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "pysma";
-  version = "0.7.2";
+  version = "0.7.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-hIrdT0b9XKw1UoPZtQQ7IaW+HV8wuA9Rwoo8XYdGyw8=";
+    sha256 = "sha256-8LwxRiYUhKYZkrjDNcnOkssvfw/tZ6dj1GKZQ6UkqsQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/qiskit-terra/default.nix b/pkgs/development/python-modules/qiskit-terra/default.nix
index 71486b30bc8e..aa9ce69fa1a5 100644
--- a/pkgs/development/python-modules/qiskit-terra/default.nix
+++ b/pkgs/development/python-modules/qiskit-terra/default.nix
@@ -193,7 +193,7 @@ buildPythonPackage rec {
 
 
   meta = with lib; {
-    broken = (stdenv.isLinux && stdenv.isAarch64) || stdenv.isDarwin;
+    broken = true; # tests segfault python
     description = "Provides the foundations for Qiskit.";
     longDescription = ''
       Allows the user to write quantum circuits easily, and takes care of the constraints of real hardware.
diff --git a/pkgs/development/python-modules/regenmaschine/default.nix b/pkgs/development/python-modules/regenmaschine/default.nix
index ce962e7636a3..48505237ae4f 100644
--- a/pkgs/development/python-modules/regenmaschine/default.nix
+++ b/pkgs/development/python-modules/regenmaschine/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "regenmaschine";
-  version = "2022.10.1";
+  version = "2022.11.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "bachya";
     repo = pname;
     rev = "refs/tags/${version}";
-    sha256 = "sha256-BOJ2dFZ4CFII6OXzQU3Q9Mah6kRZPC5+b6ekx8ueYc4=";
+    sha256 = "sha256-aCgMAaur2ljjiQ7tt/gXm/Vt+o6j/MsCOLN661CkFw4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/repeated-test/default.nix b/pkgs/development/python-modules/repeated-test/default.nix
new file mode 100644
index 000000000000..bd8d8d765a09
--- /dev/null
+++ b/pkgs/development/python-modules/repeated-test/default.nix
@@ -0,0 +1,45 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+, setuptools-scm
+, six
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "repeated-test";
+  version = "2.3.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.5";
+
+  src = fetchPypi {
+    pname = "repeated_test";
+    inherit version;
+    hash = "sha256-TbVyQA7EjCSwo6qfDksbE8IU1ElkSCABEUBWy5j1KJc=";
+  };
+
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    six
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "repeated_test"
+  ];
+
+  meta = with lib; {
+    description = "Unittest-compatible framework for repeating a test function over many fixtures";
+    homepage = "https://github.com/epsy/repeated_test";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ];
+  };
+}
diff --git a/pkgs/development/python-modules/scikit-learn/default.nix b/pkgs/development/python-modules/scikit-learn/default.nix
index d9c4f07ccb8d..9739163cea50 100644
--- a/pkgs/development/python-modules/scikit-learn/default.nix
+++ b/pkgs/development/python-modules/scikit-learn/default.nix
@@ -65,6 +65,8 @@ buildPythonPackage rec {
     "check_regressors_train"
     "check_classifiers_train"
     "xfail_ignored_in_check_estimator"
+  ] ++ lib.optionals (stdenv.isDarwin) [
+    "test_graphical_lasso"
   ];
 
   pytestFlagsArray = [
diff --git a/pkgs/development/python-modules/sentry-sdk/default.nix b/pkgs/development/python-modules/sentry-sdk/default.nix
index a3816d9b7dbf..5db4264507a4 100644
--- a/pkgs/development/python-modules/sentry-sdk/default.nix
+++ b/pkgs/development/python-modules/sentry-sdk/default.nix
@@ -1,52 +1,46 @@
 { lib
 , stdenv
-, buildPythonPackage
-, fetchFromGitHub
-, pythonOlder
-
-# runtime
-, certifi
-, urllib3
-
-# optionals
 , aiohttp
 , apache-beam
+, asttokens
 , blinker
 , botocore
 , bottle
+, buildPythonPackage
 , celery
+, certifi
 , chalice
 , django
+, executing
 , falcon
+, fetchFromGitHub
 , flask
 , flask-login
+, gevent
 , httpx
+, jsonschema
+, mock
 , pure-eval
 , pyramid
+, pyrsistent
 , pyspark
+, pytest-forked
+, pytest-localserver
+, pytest-watch
+, pytestCheckHook
+, pythonOlder
 , rq
 , sanic
 , sqlalchemy
 , tornado
 , trytond
+, urllib3
 , werkzeug
-
-# tests
-, asttokens
-, executing
-, gevent
-, jsonschema
-, mock
-, pyrsistent
-, pytest-forked
-, pytest-localserver
-, pytest-watch
-, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "sentry-sdk";
-  version = "1.10.1";
+  version = "1.11.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -54,8 +48,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "getsentry";
     repo = "sentry-python";
-    rev = version;
-    hash = "sha256-wNI92LVGFN+7LPxnrezPeF7dSS5UgwCuF62/ux3rik4=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-PObYXwWYQ7cC//W3c+n/qceu2ShjFqMGAaLyNflwcL4=";
   };
 
   propagatedBuildInputs = [
@@ -155,6 +149,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python SDK for Sentry.io";
     homepage = "https://github.com/getsentry/sentry-python";
+    changelog = "https://github.com/getsentry/sentry-python/blob/${version}/CHANGELOG.md";
     license = licenses.bsd2;
     maintainers = with maintainers; [ fab gebner ];
   };
diff --git a/pkgs/development/python-modules/serpy/default.nix b/pkgs/development/python-modules/serpy/default.nix
index 7a1b8348a0e6..9f086e4c86e5 100644
--- a/pkgs/development/python-modules/serpy/default.nix
+++ b/pkgs/development/python-modules/serpy/default.nix
@@ -1,25 +1,37 @@
-{ lib, buildPythonPackage, fetchPypi,
-  flake8, py, pyflakes, six, tox
+{ lib
+, buildPythonPackage
+, fetchPypi
+, six
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "serpy";
   version = "0.3.1";
+  format = "setuptools";
 
-  meta = {
-    description = "ridiculously fast object serialization";
-    homepage = "https://github.com/clarkduvall/serpy";
-    license = lib.licenses.mit;
-  };
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
     sha256 = "3772b2a9923fbf674000ff51abebf6ea8f0fca0a2cfcbfa0d63ff118193d1ec5";
   };
 
-  buildInputs = [ flake8 py pyflakes tox ];
-  propagatedBuildInputs = [ six ];
+  propagatedBuildInputs = [
+    six
+  ];
 
   # ImportError: No module named 'tests
   doCheck = false;
+
+  pythonImportsCheck = [
+    "serpy"
+  ];
+
+  meta = with lib; {
+    description = "Ridiculously fast object serialization";
+    homepage = "https://github.com/clarkduvall/serpy";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ];
+  };
 }
diff --git a/pkgs/development/python-modules/sigtools/default.nix b/pkgs/development/python-modules/sigtools/default.nix
index cf32ad5db79c..a41bdbf184bd 100644
--- a/pkgs/development/python-modules/sigtools/default.nix
+++ b/pkgs/development/python-modules/sigtools/default.nix
@@ -1,14 +1,13 @@
 { lib
+, attrs
 , buildPythonPackage
 , fetchPypi
-, sphinx
 , mock
-, coverage
-, unittest2
-, attrs
-, funcsigs
-, six
+, pythonOlder
+, repeated-test
 , setuptools-scm
+, sphinx
+, unittestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -16,9 +15,11 @@ buildPythonPackage rec {
   version = "4.0.1";
   format = "pyproject";
 
+  disabled = pythonOlder "3.4";
+
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-S44TWpzU0uoA2mcMCTNy105nK6OruH9MmNjnPepURFw=";
+    hash = "sha256-S44TWpzU0uoA2mcMCTNy105nK6OruH9MmNjnPepURFw=";
   };
 
   nativeBuildInputs = [
@@ -29,17 +30,21 @@ buildPythonPackage rec {
     attrs
   ];
 
-  patchPhase = ''sed -i s/test_suite="'"sigtools.tests"'"/test_suite="'"unittest2.collector"'"/ setup.py'';
+  checkInputs = [
+    mock
+    repeated-test
+    sphinx
+    unittestCheckHook
+  ];
 
-  # repeated_test no longer exists in nixpkgs
-  # Also see: https://github.com/epsy/sigtools/issues/26
-  doCheck = false;
-  checkInputs = [ sphinx mock coverage unittest2 ];
+  pythonImportsCheck = [
+    "sigtools"
+  ];
 
   meta = with lib; {
-    description = "Utilities for working with 3.3's inspect.Signature objects.";
-    homepage = "https://pypi.python.org/pypi/sigtools";
+    description = "Utilities for working with inspect.Signature objects";
+    homepage = "https://sigtools.readthedocs.io/";
     license = licenses.mit;
+    maintainers = with maintainers; [ ];
   };
-
 }
diff --git a/pkgs/development/python-modules/smpplib/default.nix b/pkgs/development/python-modules/smpplib/default.nix
index 179ab7ce1bfc..a71d3d6bd3d4 100644
--- a/pkgs/development/python-modules/smpplib/default.nix
+++ b/pkgs/development/python-modules/smpplib/default.nix
@@ -1,4 +1,11 @@
-{ buildPythonPackage, fetchPypi, lib, python, six, tox, mock, pytest }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, python
+, six
+, mock
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "smpplib";
@@ -9,21 +16,27 @@ buildPythonPackage rec {
     sha256 = "c0b01947b47e404f42ccb59e906b6e4eb507963c971d59b44350db0f29c76166";
   };
 
-  propagatedBuildInputs = [ six ];
-  checkInputs = [ tox mock pytest ];
+  propagatedBuildInputs = [
+    six
+  ];
 
-  checkPhase = ''
-    pytest
-  '';
+  checkInputs = [
+    mock
+    pytestCheckHook
+  ];
 
   postInstall = ''
     rm -rf $out/${python.sitePackages}/tests
   '';
 
+  pythonImportsCheck = [
+    "smpplib"
+  ];
+
   meta = with lib; {
     description = "SMPP library for Python";
     homepage = "https://github.com/python-smpplib/python-smpplib";
     license = licenses.lgpl3Plus;
-    maintainers = [ maintainers.globin ];
+    maintainers = with maintainers; [ globin ];
   };
 }
diff --git a/pkgs/development/python-modules/snakebite/default.nix b/pkgs/development/python-modules/snakebite/default.nix
index b4d83e672271..62e233aec314 100644
--- a/pkgs/development/python-modules/snakebite/default.nix
+++ b/pkgs/development/python-modules/snakebite/default.nix
@@ -1,8 +1,6 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, tox
-, virtualenv
 , protobuf
 }:
 
@@ -15,11 +13,6 @@ buildPythonPackage rec {
     sha256 = "085238b4944cb9c658ee62d5794de936ac3d0c337c504b2cc86424a205ae978a";
   };
 
-  checkInputs = [
-    tox
-    virtualenv
-  ];
-
   propagatedBuildInputs = [
     protobuf
   ];
@@ -29,13 +22,17 @@ buildPythonPackage rec {
       --replace "'argparse'" ""
   '';
 
-  # tests require hadoop hdfs
+  # Tests require hadoop hdfs
   doCheck = false;
 
+  pythonImportsCheck = [
+    "snakebite"
+  ];
+
   meta = with lib; {
     description = "Pure Python HDFS client";
     homepage = "https://github.com/spotify/snakebite";
     license = licenses.asl20;
-    maintainers = [ maintainers.costrouc ];
+    maintainers = with maintainers; [ costrouc ];
   };
 }
diff --git a/pkgs/development/python-modules/sqlalchemy-jsonfield/default.nix b/pkgs/development/python-modules/sqlalchemy-jsonfield/default.nix
index 54962387967d..8270834ab609 100644
--- a/pkgs/development/python-modules/sqlalchemy-jsonfield/default.nix
+++ b/pkgs/development/python-modules/sqlalchemy-jsonfield/default.nix
@@ -4,19 +4,20 @@
 , sqlalchemy
 , setuptools-scm
 , setuptools
-, tox
 , sphinx
-, pytest
-, pytest-cov
-, pytest-html
+, pytestCheckHook
 , pytest-sugar
-, coverage
 , pymysql
-, psycopg2 }:
+, psycopg2
+, pythonOlder
+}:
 
 buildPythonPackage rec {
   pname = "sqlalchemy-jsonfield";
   version = "1.0.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "penguinolog";
@@ -27,18 +28,30 @@ buildPythonPackage rec {
 
   SETUPTOOLS_SCM_PRETEND_VERSION = "v${version}";
 
-  nativeBuildInputs = [ setuptools-scm ];
-  propagatedBuildInputs = [ sqlalchemy setuptools ];
-  checkInputs = [ tox sphinx pytest pytest-cov pytest-html pytest-sugar coverage pymysql psycopg2 ];
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
 
-  checkPhase = ''
-    TOX_TESTENV_PASSENV="PYTHONPATH SETUPTOOLS_SCM_PRETEND_VERSION" tox -e functional
-  '';
+  propagatedBuildInputs = [
+    sqlalchemy
+    setuptools
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+    pytest-sugar
+    pymysql
+    psycopg2
+  ];
+
+  pythonImportsCheck = [
+    "sqlalchemy_jsonfield"
+  ];
 
   meta = with lib; {
     homepage = "https://github.com/penguinolog/sqlalchemy_jsonfield";
     description = "SQLALchemy JSONField implementation for storing dicts at SQL independently from JSON type support";
     license = licenses.asl20;
-    maintainers = [ maintainers.ivan-tkatchev ];
+    maintainers = with maintainers; [ ivan-tkatchev ];
   };
 }
diff --git a/pkgs/development/python-modules/ssdeep/default.nix b/pkgs/development/python-modules/ssdeep/default.nix
index 6ad339a083f5..48ca8b6b938e 100644
--- a/pkgs/development/python-modules/ssdeep/default.nix
+++ b/pkgs/development/python-modules/ssdeep/default.nix
@@ -5,18 +5,21 @@
 , pytestCheckHook
 , six
 , ssdeep
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "ssdeep";
-  version = "3.4";
+  version = "3.4.1";
   format = "setuptools";
 
+  disabled = pythonOlder "3.7";
+
   src = fetchFromGitHub {
     owner = "DinoTools";
     repo = "python-ssdeep";
-    rev = version;
-    hash = "sha256-eAB4/HmPGj/ngHrqkOlY/kTdY5iUEBHxrsRYjR/RNyw=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-I5ci5BS+B3OE0xdLSahu3HCh99jjhnRHJFz830SvFpg=";
   };
 
   buildInputs = [
@@ -28,7 +31,6 @@ buildPythonPackage rec {
     six
   ];
 
-
   checkInputs = [
     pytestCheckHook
   ];
@@ -45,6 +47,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python wrapper for the ssdeep library";
     homepage = "https://github.com/DinoTools/python-ssdeep";
+    changelog = "https://github.com/DinoTools/python-ssdeep/blob/${version}/CHANGELOG.rst";
     license = licenses.lgpl3Plus;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/taskw/default.nix b/pkgs/development/python-modules/taskw/default.nix
index 0d4cd9c09e94..dfdbbcf5d814 100644
--- a/pkgs/development/python-modules/taskw/default.nix
+++ b/pkgs/development/python-modules/taskw/default.nix
@@ -6,13 +6,14 @@
 , six
 , python-dateutil
 , kitchen
+, pytestCheckHook
 , pytz
 , pkgs
 }:
 
 buildPythonPackage rec {
-  version = "2.0.0";
   pname = "taskw";
+  version = "2.0.0";
 
   src = fetchPypi {
     inherit pname version;
@@ -25,17 +26,16 @@ buildPythonPackage rec {
       --replace '@@taskwarrior@@' '${pkgs.taskwarrior}'
   '';
 
-  # https://github.com/ralphbean/taskw/issues/98
-  doCheck = false;
+  buildInputs = [ pkgs.taskwarrior ];
 
-  buildInputs = [ nose pkgs.taskwarrior tox ];
   propagatedBuildInputs = [ six python-dateutil kitchen pytz ];
 
+  checkInputs = [ pytestCheckHook ];
+
   meta = with lib; {
     homepage =  "https://github.com/ralphbean/taskw";
     description = "Python bindings for your taskwarrior database";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ pierron ];
   };
-
 }
diff --git a/pkgs/development/python-modules/token-bucket/default.nix b/pkgs/development/python-modules/token-bucket/default.nix
index 508e38da4500..072b084db6dd 100644
--- a/pkgs/development/python-modules/token-bucket/default.nix
+++ b/pkgs/development/python-modules/token-bucket/default.nix
@@ -1,4 +1,5 @@
 { lib
+, stdenv
 , buildPythonPackage
 , fetchFromGitHub
 , pytest-runner
@@ -25,6 +26,8 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  doCheck = !stdenv.isDarwin;
+
   meta = with lib; {
     description = "Token Bucket Implementation for Python Web Apps";
     homepage = "https://github.com/falconry/token-bucket";
diff --git a/pkgs/development/python-modules/coqui-trainer/default.nix b/pkgs/development/python-modules/trainer/default.nix
similarity index 97%
rename from pkgs/development/python-modules/coqui-trainer/default.nix
rename to pkgs/development/python-modules/trainer/default.nix
index 4c77506b9881..627c21ee4bf0 100644
--- a/pkgs/development/python-modules/coqui-trainer/default.nix
+++ b/pkgs/development/python-modules/trainer/default.nix
@@ -16,7 +16,7 @@
 }:
 
 let
-  pname = "coqui-trainer";
+  pname = "trainer";
   version = "0.0.16";
 in
 buildPythonPackage {
diff --git a/pkgs/development/python-modules/twilio/default.nix b/pkgs/development/python-modules/twilio/default.nix
index 8936d0e58273..6cf44ee9dc7f 100644
--- a/pkgs/development/python-modules/twilio/default.nix
+++ b/pkgs/development/python-modules/twilio/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "twilio";
-  version = "7.15.2";
+  version = "7.15.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "twilio";
     repo = "twilio-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-Y7rQxoculQ2Dp02/sEowsEf677pDA7AQpWuEiiywvwo=";
+    hash = "sha256-c1UNqp8eYK9tkogpcDtTOTHa5ME+yOkop2UccXwOAqM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/types-colorama/default.nix b/pkgs/development/python-modules/types-colorama/default.nix
index 2a0e3a38fa59..9fa0baac88e6 100644
--- a/pkgs/development/python-modules/types-colorama/default.nix
+++ b/pkgs/development/python-modules/types-colorama/default.nix
@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "types-colorama";
-  version = "0.4.15.2";
+  version = "0.4.15.3";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-FXy+ZuFjllliWEZNONeMrojYEus9erKoc+Da9PR8bIk=";
+    hash = "sha256-k2L0kWdQX3EbvJpjUtrmZQSVswUzg4aPf3a/642SMAI=";
   };
 
   # Module has no tests
diff --git a/pkgs/development/python-modules/types-python-dateutil/default.nix b/pkgs/development/python-modules/types-python-dateutil/default.nix
index c08117d2ad4a..acf092b8411c 100644
--- a/pkgs/development/python-modules/types-python-dateutil/default.nix
+++ b/pkgs/development/python-modules/types-python-dateutil/default.nix
@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "types-python-dateutil";
-  version = "2.8.19.3";
+  version = "2.8.19.4";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-oxMoTfXtP9B4MDJi7cDv3iiZjNCOUGHvHMwLtf700to=";
+    hash = "sha256-NRqMqa/UrqZi+HwXJNLhrln59fmWkb47OxHSOTzTqqE=";
   };
 
   # Modules doesn't have tests
diff --git a/pkgs/development/python-modules/types-requests/default.nix b/pkgs/development/python-modules/types-requests/default.nix
index f53c4a141a6a..730a0a591540 100644
--- a/pkgs/development/python-modules/types-requests/default.nix
+++ b/pkgs/development/python-modules/types-requests/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "types-requests";
-  version = "2.28.11.4";
+  version = "2.28.11.5";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-1PNCsN9DImLp4ybRdjjurpaliB5456aq5G0zhw1zlS4=";
+    sha256 = "sha256-p983zG+2GHqECX2pUfjiHTNUSKolAaawo5y9HXyp7io=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/types-setuptools/default.nix b/pkgs/development/python-modules/types-setuptools/default.nix
index c9ce9c92c4cd..c67524015ee1 100644
--- a/pkgs/development/python-modules/types-setuptools/default.nix
+++ b/pkgs/development/python-modules/types-setuptools/default.nix
@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "types-setuptools";
-  version = "65.5.0.2";
+  version = "65.5.0.3";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-mEfebXCH+x3UqIwqIVQ9G4amF5w2dE8IGXQwP+LzD1A=";
+    sha256 = "sha256-F3aRcfXyotxpslwNMQZVKlzadnu/azbLYhKyba5aqfw=";
   };
 
   # Module doesn't have tests
diff --git a/pkgs/development/python-modules/types-toml/default.nix b/pkgs/development/python-modules/types-toml/default.nix
index ec73535a9386..fff70bd611f7 100644
--- a/pkgs/development/python-modules/types-toml/default.nix
+++ b/pkgs/development/python-modules/types-toml/default.nix
@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "types-toml";
-  version = "0.10.8";
+  version = "0.10.8.1";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-t+fqVyMIsQMNyGw7qCXFIQgUwoJWEuxnnreBT43ZKVo=";
+    sha256 = "sha256-FxvbMWPXmlIFYPJLqRap/Jv/gWWcVEip/qiSQJI3Ir4=";
   };
 
   # Module doesn't have tests
diff --git a/pkgs/development/python-modules/types-urllib3/default.nix b/pkgs/development/python-modules/types-urllib3/default.nix
index 057ec581d0ab..55ab0f9ee1e5 100644
--- a/pkgs/development/python-modules/types-urllib3/default.nix
+++ b/pkgs/development/python-modules/types-urllib3/default.nix
@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "types-urllib3";
-  version = "1.26.25.3";
+  version = "1.26.25.4";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-GAe4e47hrgImgTuixSMw7/IPsr9jWbHeJN8I6zCQ5EI=";
+    hash = "sha256-7sVVZCjuyGKxrFePtpqrOHeZWpn/7J5aEs9/vQzJ2u4=";
   };
 
   # Module doesn't have tests
diff --git a/pkgs/development/python-modules/unicodedata2/default.nix b/pkgs/development/python-modules/unicodedata2/default.nix
index a14895fa7996..ea878d6e0cbc 100644
--- a/pkgs/development/python-modules/unicodedata2/default.nix
+++ b/pkgs/development/python-modules/unicodedata2/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "unicodedata2";
-  version = "14.0.0";
+  version = "15.0.0";
 
   disabled = isPy27;
 
   src = fetchPypi {
     inherit version pname;
-    sha256 = "110nnvh02ssp92xbmswy39aa186jrmb7m41x4220wigl8c0dzxs1";
+    sha256 = "0bcgls7m2zndpd8whgznnd5908jbsa50si2bh88wsn0agcznhv7d";
   };
 
   checkInputs = [ pytestCheckHook ];
diff --git a/pkgs/development/python-modules/versioningit/default.nix b/pkgs/development/python-modules/versioningit/default.nix
index 5f058d5f1b15..5cfe9861f465 100644
--- a/pkgs/development/python-modules/versioningit/default.nix
+++ b/pkgs/development/python-modules/versioningit/default.nix
@@ -16,13 +16,14 @@
 
 buildPythonPackage rec {
   pname = "versioningit";
-  version = "2.0.1";
-  disabled = pythonOlder "3.8";
+  version = "2.1.0";
   format = "pyproject";
 
+  disabled = pythonOlder "3.8";
+
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-gJfiYNm99nZYW9gTO/e1//rDeox2KWJVtC2Gy1EqsuM=";
+    hash = "sha256-c/KWXjDS6/1/+ra/JjaPIjdXBiLdKknH+8GZXenGdtY=";
   };
 
   postPatch = ''
@@ -35,9 +36,10 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     packaging
     setuptools
-    tomli
   ] ++ lib.optionals (pythonOlder "3.10") [
     importlib-metadata
+  ] ++ lib.optionals (pythonOlder "3.11") [
+    tomli
   ];
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/watchdog/default.nix b/pkgs/development/python-modules/watchdog/default.nix
index f38b732f9ebb..f42645940aac 100644
--- a/pkgs/development/python-modules/watchdog/default.nix
+++ b/pkgs/development/python-modules/watchdog/default.nix
@@ -55,6 +55,7 @@ buildPythonPackage rec {
     "test_create_wrong_encoding"
   ] ++ lib.optionals (stdenv.isDarwin && !stdenv.isAarch64) [
     "test_delete"
+    "test_separate_consecutive_moves"
   ];
 
   disabledTestPaths = [
diff --git a/pkgs/development/tools/build-managers/bob/default.nix b/pkgs/development/tools/build-managers/bob/default.nix
index d5b86139cb16..a647621d77d3 100644
--- a/pkgs/development/tools/build-managers/bob/default.nix
+++ b/pkgs/development/tools/build-managers/bob/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "bob";
-  version = "0.6.3";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "benchkram";
     repo = pname;
     rev = version;
-    hash = "sha256-jZDyZVjo4Purt2tabJew5N4MZmLXli6gqBTejv5FGJM=";
+    hash = "sha256-37VhzYxVrt+w1XTDXzKAkJT43TQSyCmX9SAoNnk+o3w=";
   };
 
   ldflags = [ "-s" "-w" "-X main.Version=${version}" ];
diff --git a/pkgs/development/tools/database/apgdiff/default.nix b/pkgs/development/tools/database/apgdiff/default.nix
new file mode 100644
index 000000000000..016259f0bbb4
--- /dev/null
+++ b/pkgs/development/tools/database/apgdiff/default.nix
@@ -0,0 +1,35 @@
+{ lib
+, stdenvNoCC
+, fetchurl
+, makeWrapper
+, jre
+}:
+stdenvNoCC.mkDerivation (finalAttrs: {
+  version = "2.7.0";
+  pname = "apgdiff";
+
+  src = fetchurl {
+    url = "https://github.com/fordfrog/apgdiff/raw/release_${finalAttrs.version}/releases/apgdiff-${finalAttrs.version}.jar";
+    sha256 = "sha256-6OempDmedl6LOwP/s5y0hOIxGDWHd7qM7/opW3UwQ+I=";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  buildCommand = ''
+    install -Dm644 $src $out/lib/apgdiff.jar
+
+    mkdir -p $out/bin
+    makeWrapper ${jre}/bin/java $out/bin/apgdiff \
+      --argv0 apgdiff \
+      --add-flags "-jar $out/lib/apgdiff.jar"
+  '';
+
+  meta = with lib; {
+    description = "Another PostgreSQL diff tool";
+    homepage = "https://apgdiff.com";
+    license = licenses.mit;
+    inherit (jre.meta) platforms;
+    sourceProvenance = sourceTypes.binaryBytecode;
+    maintainers = [ maintainers.misterio77 ];
+  };
+})
diff --git a/pkgs/development/tools/dump_syms/default.nix b/pkgs/development/tools/dump_syms/default.nix
index 4aff90f830a3..19e16bd0da73 100644
--- a/pkgs/development/tools/dump_syms/default.nix
+++ b/pkgs/development/tools/dump_syms/default.nix
@@ -7,11 +7,16 @@
 
 # darwin
 , Security
+
+# tests
+, firefox-esr-unwrapped
+, firefox-unwrapped
+, thunderbird-unwrapped
 }:
 
 let
   pname = "dump_syms";
-  version = "2.0.0";
+  version = "2.1.0";
 in
 rustPlatform.buildRustPackage {
   inherit pname version;
@@ -20,10 +25,10 @@ rustPlatform.buildRustPackage {
     owner = "mozilla";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-ei/ORKKoh9rQg4xZ5j76qaplw1PyEV7ABkyL7e8WIlQ=";
+    hash = "sha256-Q4opIGG1kOORECNB6al0oT4tjBe++ND6Eb4E86ED2+o=";
   };
 
-  cargoSha256 = "sha256-t3AQW0j/L/qIUx6RJKqf+Fv/2BNWkWmTc0PDNFlZeaQ=";
+  cargoSha256 = "sha256-j3bZaHFJEn/LW032CaRBaLN3Pb5GiQv1MReD0LFI8y8=";
 
   nativeBuildInputs = [
     pkg-config
@@ -42,6 +47,10 @@ rustPlatform.buildRustPackage {
     "--skip windows::pdb::tests::test_oleaut32"
   ];
 
+  passthru.tests = {
+    inherit firefox-esr-unwrapped firefox-unwrapped thunderbird-unwrapped;
+  };
+
   meta = with lib; {
     changelog = "https://github.com/mozilla/dump_syms/releases/tag/v${version}";
     description = "Command-line utility for parsing the debugging information the compiler provides in ELF or stand-alone PDB files";
diff --git a/pkgs/development/tools/go-toml/default.nix b/pkgs/development/tools/go-toml/default.nix
index 8cfa4c802992..2c1a78fec0fd 100644
--- a/pkgs/development/tools/go-toml/default.nix
+++ b/pkgs/development/tools/go-toml/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "go-toml";
-  version = "2.0.5";
+  version = "2.0.6";
 
   src = fetchFromGitHub {
     owner = "pelletier";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-9m0g8hfJ+gazYHq2TzSN/0d2o789QBhbIpGxdXhNBGk=";
+    sha256 = "sha256-RXKJJseRrwSTReMAkFjShKvCWGMowruYwsCovHwq4ZQ=";
   };
 
-  vendorSha256 = "sha256-yDPCfJtYty4aaoDrn3UWFcs1jHJHMJqzc5f06AWQmRc=";
+  vendorSha256 = "sha256-MMCyFKqsL9aSQqK9VtPzUbgfLTFpzD5g8QYx8qIwktg=";
 
   excludedPackages = [ "cmd/gotoml-test-decoder" "cmd/tomltestgen" ];
 
diff --git a/pkgs/development/tools/millet/default.nix b/pkgs/development/tools/millet/default.nix
index 3046df98839c..ccc895b89569 100644
--- a/pkgs/development/tools/millet/default.nix
+++ b/pkgs/development/tools/millet/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "millet";
-  version = "0.5.16";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "azdavis";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-YdCdB72f7IQsi8WKVmGlqAybcewisK1J7jfR5Irp6VE=";
+    hash = "sha256-tP1ccUtHfj+JPUYGo+QFYjbz56uNl3p53QNeE/xaCt4=";
   };
 
-  cargoHash = "sha256-2WEptDHo2t6p8nzd00fPu/XQqq0gUlLAyuSraMfbHL0=";
+  cargoHash = "sha256-umOlvHDA8AtoAeB1i8nNgbjvzTmzwZfdjF+TCTKzqAU=";
 
   postPatch = ''
     rm .cargo/config.toml
diff --git a/pkgs/development/tools/ocaml/camlidl/default.nix b/pkgs/development/tools/ocaml/camlidl/default.nix
index 5c3153a88493..a97ce8499b2a 100644
--- a/pkgs/development/tools/ocaml/camlidl/default.nix
+++ b/pkgs/development/tools/ocaml/camlidl/default.nix
@@ -1,16 +1,17 @@
-{ lib, stdenv, fetchurl, ocaml, writeText }:
+{ lib, stdenv, fetchFromGitHub, ocaml, writeText }:
+
+lib.throwIfNot (lib.versionAtLeast ocaml.version "4.03")
+  "camlidl is not available for OCaml ${ocaml.version}"
 
-let
-  pname = "camlidl";
-  webpage = "https://caml.inria.fr/pub/old_caml_site/camlidl/";
-in
 stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
-  version = "1.05";
+  pname = "ocaml${ocaml.version}-camlidl";
+  version = "1.11";
 
-  src = fetchurl {
-    url = "http://caml.inria.fr/pub/old_caml_site/distrib/bazar-ocaml/${pname}-${version}.tar.gz";
-    sha256 = "0483cs66zsxsavcllpw1qqvyhxb39ddil3h72clcd69g7fyxazl5";
+  src = fetchFromGitHub {
+    owner = "xavierleroy";
+    repo = "camlidl";
+    rev = "camlidl111";
+    sha256 = "sha256-8m0zem/6nvpEJtjJNP/+vafeVLlMvNQGdl8lyf/OeBg=";
   };
 
   nativeBuildInputs = [ ocaml ];
@@ -21,10 +22,10 @@ stdenv.mkDerivation rec {
   preBuild = ''
     mv config/Makefile.unix config/Makefile
     substituteInPlace config/Makefile --replace BINDIR=/usr/local/bin BINDIR=$out
-    substituteInPlace config/Makefile --replace OCAMLLIB=/usr/local/lib/ocaml OCAMLLIB=$out/lib/ocaml/${ocaml.version}/site-lib/camlidl
-    substituteInPlace config/Makefile --replace CPP=/lib/cpp CPP=${stdenv.cc}/bin/cpp
-    substituteInPlace config/Makefile --replace "OCAMLC=ocamlc -g" "OCAMLC=ocamlc -g -warn-error -31"
+    substituteInPlace config/Makefile --replace 'OCAMLLIB=$(shell $(OCAMLC) -where)' OCAMLLIB=$out/lib/ocaml/${ocaml.version}/site-lib/camlidl
+    substituteInPlace config/Makefile --replace CPP=cpp CPP=${stdenv.cc}/bin/cpp
     mkdir -p $out/lib/ocaml/${ocaml.version}/site-lib/camlidl/caml
+    mkdir -p $out/lib/ocaml/${ocaml.version}/site-lib/camlidl/stublibs
   '';
 
   postInstall = ''
@@ -40,15 +41,14 @@ stdenv.mkDerivation rec {
   '';
 
   setupHook = writeText "setupHook.sh" ''
-    export CAML_LD_LIBRARY_PATH="''${CAML_LD_LIBRARY_PATH-}''${CAML_LD_LIBRARY_PATH:+:}''$1/lib/ocaml/${ocaml.version}/site-lib/${name}/"
     export NIX_CFLAGS_COMPILE+=" -isystem $1/lib/ocaml/${ocaml.version}/site-lib/camlidl"
     export NIX_LDFLAGS+=" -L $1/lib/ocaml/${ocaml.version}/site-lib/camlidl"
   '';
 
   meta = {
     description = "A stub code generator and COM binding for Objective Caml";
-    homepage = webpage;
-    license = "LGPL";
+    homepage = "https://xavierleroy.org/camlidl/";
+    license = lib.licenses.lgpl21;
     maintainers = [ lib.maintainers.roconnor ];
   };
 }
diff --git a/pkgs/development/tools/oh-my-posh/default.nix b/pkgs/development/tools/oh-my-posh/default.nix
index bd7d3effe1e9..7493176e3ac6 100644
--- a/pkgs/development/tools/oh-my-posh/default.nix
+++ b/pkgs/development/tools/oh-my-posh/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "oh-my-posh";
-  version = "12.13.3";
+  version = "12.16.0";
 
   src = fetchFromGitHub {
     owner = "jandedobbeleer";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-1H3BlKxTthyVXEaLISruZDFIeXEAaeZjGp597clPeLs=";
+    sha256 = "sha256-YrrOwTLVgxoriVgVDmn99ORSh04os0q/QnfBXtTtl5g=";
   };
 
   vendorSha256 = "sha256-OrtKFkWXqVoXKmN6BT8YbCNjR1gRTT4gPNwmirn7fjU=";
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/overrides/build-systems.json b/pkgs/development/tools/poetry2nix/poetry2nix/overrides/build-systems.json
index e2e674d967bd..e5d5c946a403 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/overrides/build-systems.json
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/overrides/build-systems.json
@@ -4816,9 +4816,6 @@
     "setuptools",
     "setuptools-scm"
   ],
-  "filemagic": [
-    "setuptools"
-  ],
   "filetype": [
     "setuptools"
   ],
diff --git a/pkgs/development/tools/ruff/default.nix b/pkgs/development/tools/ruff/default.nix
index ccd9d3744931..baec7b093aa0 100644
--- a/pkgs/development/tools/ruff/default.nix
+++ b/pkgs/development/tools/ruff/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ruff";
-  version = "0.0.126";
+  version = "0.0.128";
 
   src = fetchFromGitHub {
     owner = "charliermarsh";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Qcjj+WgNsdms2VNOT/Ax66TruigxrHmC+tyoe5fCgo4=";
+    sha256 = "sha256-QJGlhwLXCj4lGI7VMu+1wHmy8K4wYnUFxwsut2q1MUs=";
   };
 
-  cargoSha256 = "sha256-aIZ3ZBiUFMC/RmJQp/V0Rjq/+oLg61Ve0zZJSZpT7nw=";
+  cargoSha256 = "sha256-vpfVXhJT65N18l/DZVi5ROgYKIi42rHW4Me+quqiG18=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     CoreServices
diff --git a/pkgs/games/starsector/default.nix b/pkgs/games/starsector/default.nix
index e929ef98fbf6..bbc781d6ab27 100644
--- a/pkgs/games/starsector/default.nix
+++ b/pkgs/games/starsector/default.nix
@@ -1,32 +1,27 @@
 { lib
-, alsa-lib
 , fetchzip
 , libXxf86vm
 , makeWrapper
+, openal
 , openjdk
 , stdenv
 , xorg
 , copyDesktopItems
 , makeDesktopItem
+, writeScript
 }:
 
 stdenv.mkDerivation rec {
   pname = "starsector";
-  version = "0.95.1a-RC5";
+  version = "0.95.1a-RC6";
 
   src = fetchzip {
     url = "https://s3.amazonaws.com/fractalsoftworks/starsector/starsector_linux-${version}.zip";
-    sha256 = "sha256-V8/WQPvPIrF3Tg7JVO+GfeYqWhkWWrnHSVcFXGQqDAA=";
+    sha256 = "sha256-+0zGJHM+SMonx3sytCQNQA/QBgzdPMEfQvOjrCDSOs8=";
   };
 
-  nativeBuildInputs = [
-    copyDesktopItems
-    makeWrapper
-  ];
-  buildInputs = with xorg; [
-    alsa-lib
-    libXxf86vm
-  ];
+  nativeBuildInputs = [ copyDesktopItems makeWrapper ];
+  buildInputs = [ xorg.libXxf86vm openal ];
 
   dontBuild = true;
 
@@ -47,7 +42,7 @@ stdenv.mkDerivation rec {
     runHook preInstall
 
     mkdir -p $out/bin
-    rm -r jre_linux # remove jre7
+    rm -r jre_linux # remove bundled jre7
     rm starfarer.api.zip
     cp -r ./* $out
 
@@ -66,10 +61,13 @@ stdenv.mkDerivation rec {
 
   # it tries to run everything with relative paths, which makes it CWD dependent
   # also point mod, screenshot, and save directory to $XDG_DATA_HOME
+  # additionally, add some GC options to improve performance of the game
   postPatch = ''
     substituteInPlace starsector.sh \
       --replace "./jre_linux/bin/java" "${openjdk}/bin/java" \
-      --replace "./native/linux" "$out/native/linux"
+      --replace "./native/linux" "$out/native/linux" \
+      --replace "=." "=\''${XDG_DATA_HOME:-\$HOME/.local/share}/starsector" \
+      --replace "-XX:+CompilerThreadHintNoPreempt" "-XX:+UnlockDiagnosticVMOptions -XX:-BytecodeVerificationRemote -XX:+UseConcMarkSweepGC -XX:+UseParNewGC -XX:+CMSConcurrentMTEnabled -XX:+DisableExplicitGC"
   '';
 
   meta = with lib; {
@@ -79,4 +77,12 @@ stdenv.mkDerivation rec {
     license = licenses.unfree;
     maintainers = with maintainers; [ bbigras ];
   };
+
+  passthru.updateScript = writeScript "starsector-update-script" ''
+    #!/usr/bin/env nix-shell
+    #!nix-shell -i bash -p curl gnugrep common-updater-scripts
+    set -eou pipefail;
+    version=$(curl -s https://fractalsoftworks.com/preorder/ | grep -oP "https://s3.amazonaws.com/fractalsoftworks/starsector/starsector_linux-\K.*?(?=\.zip)" | head -1)
+    update-source-version ${pname} "$version" --file=./pkgs/games/starsector/default.nix
+  '';
 }
diff --git a/pkgs/misc/wiki-tui/default.nix b/pkgs/misc/wiki-tui/default.nix
index e5601095ebbc..ae249eb9292e 100644
--- a/pkgs/misc/wiki-tui/default.nix
+++ b/pkgs/misc/wiki-tui/default.nix
@@ -2,20 +2,20 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wiki-tui";
-  version = "0.5.1";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "Builditluc";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-kcVfqj5vRfPcF6lO1Ley3ctZajNA02jUqQRlpi3MkXc=";
+    sha256 = "sha256-sqkVi8w4QoktC1ZLUPHzfMUxIzCadcIj3dEYigz854U=";
   };
 
   buildInputs = [ ncurses openssl ] ++ lib.optional stdenv.isDarwin Security;
 
   nativeBuildInputs = [ pkg-config ];
 
-  cargoSha256 = "sha256-OW2kutjvQC9neiguixTdJx2hUFsnmQhR9DbniBr6V8w=";
+  cargoSha256 = "sha256-xRj0bF5VymvFVB0tSBndWA+OHBIEY2/ovRIBdDoOHA4=";
 
   # Tests fail with this error: `found argument --test-threads which was not expected`
   doCheck = false;
diff --git a/pkgs/os-specific/linux/kernel/perf/5.19-binutils-2.39-support.patch b/pkgs/os-specific/linux/kernel/perf/5.19-binutils-2.39-support.patch
deleted file mode 100644
index 5f4f2fc0b4a9..000000000000
--- a/pkgs/os-specific/linux/kernel/perf/5.19-binutils-2.39-support.patch
+++ /dev/null
@@ -1,352 +0,0 @@
-Fetched as:
-    $ wget 'https://github.com/torvalds/linux/compare/00b32625982e0c796f0abb8effcac9c05ef55bd3...600b7b26c07a070d0153daa76b3806c1e52c9e00.patch'
-
-Adds support for binutils-2.39 API change around init_disassemble_info().
---- a/tools/build/Makefile.feature
-+++ b/tools/build/Makefile.feature
-@@ -70,6 +70,7 @@ FEATURE_TESTS_BASIC :=                  \
-         libaio				\
-         libzstd				\
-         disassembler-four-args		\
-+        disassembler-init-styled	\
-         file-handle
- 
- # FEATURE_TESTS_BASIC + FEATURE_TESTS_EXTRA is the complete list
---- a/tools/build/feature/Makefile
-+++ b/tools/build/feature/Makefile
-@@ -18,6 +18,7 @@ FILES=                                          \
-          test-libbfd.bin                        \
-          test-libbfd-buildid.bin		\
-          test-disassembler-four-args.bin        \
-+         test-disassembler-init-styled.bin	\
-          test-reallocarray.bin			\
-          test-libbfd-liberty.bin                \
-          test-libbfd-liberty-z.bin              \
-@@ -248,6 +249,9 @@ $(OUTPUT)test-libbfd-buildid.bin:
- $(OUTPUT)test-disassembler-four-args.bin:
- 	$(BUILD) -DPACKAGE='"perf"' -lbfd -lopcodes
- 
-+$(OUTPUT)test-disassembler-init-styled.bin:
-+	$(BUILD) -DPACKAGE='"perf"' -lbfd -lopcodes
-+
- $(OUTPUT)test-reallocarray.bin:
- 	$(BUILD)
- 
---- a/tools/build/feature/test-all.c
-+++ b/tools/build/feature/test-all.c
-@@ -166,6 +166,10 @@
- # include "test-disassembler-four-args.c"
- #undef main
- 
-+#define main main_test_disassembler_init_styled
-+# include "test-disassembler-init-styled.c"
-+#undef main
-+
- #define main main_test_libzstd
- # include "test-libzstd.c"
- #undef main
---- /dev/null
-+++ b/tools/build/feature/test-disassembler-init-styled.c
-@@ -0,0 +1,13 @@
-+// SPDX-License-Identifier: GPL-2.0
-+#include <stdio.h>
-+#include <dis-asm.h>
-+
-+int main(void)
-+{
-+	struct disassemble_info info;
-+
-+	init_disassemble_info(&info, stdout,
-+			      NULL, NULL);
-+
-+	return 0;
-+}
-
---- a/tools/build/Makefile.feature
-+++ b/tools/build/Makefile.feature
-@@ -135,8 +135,7 @@ FEATURE_DISPLAY ?=              \
-          get_cpuid              \
-          bpf			\
-          libaio			\
--         libzstd		\
--         disassembler-four-args
-+         libzstd
- 
- # Set FEATURE_CHECK_(C|LD)FLAGS-all for all FEATURE_TESTS features.
- # If in the future we need per-feature checks/flags for features not
-
---- /dev/null
-+++ b/tools/include/tools/dis-asm-compat.h
-@@ -0,0 +1,55 @@
-+/* SPDX-License-Identifier: GPL-2.0-only OR BSD-2-Clause */
-+#ifndef _TOOLS_DIS_ASM_COMPAT_H
-+#define _TOOLS_DIS_ASM_COMPAT_H
-+
-+#include <stdio.h>
-+#include <dis-asm.h>
-+
-+/* define types for older binutils version, to centralize ifdef'ery a bit */
-+#ifndef DISASM_INIT_STYLED
-+enum disassembler_style {DISASSEMBLER_STYLE_NOT_EMPTY};
-+typedef int (*fprintf_styled_ftype) (void *, enum disassembler_style, const char*, ...);
-+#endif
-+
-+/*
-+ * Trivial fprintf wrapper to be used as the fprintf_styled_func argument to
-+ * init_disassemble_info_compat() when normal fprintf suffices.
-+ */
-+static inline int fprintf_styled(void *out,
-+				 enum disassembler_style style,
-+				 const char *fmt, ...)
-+{
-+	va_list args;
-+	int r;
-+
-+	(void)style;
-+
-+	va_start(args, fmt);
-+	r = vfprintf(out, fmt, args);
-+	va_end(args);
-+
-+	return r;
-+}
-+
-+/*
-+ * Wrapper for init_disassemble_info() that hides version
-+ * differences. Depending on binutils version and architecture either
-+ * fprintf_func or fprintf_styled_func will be called.
-+ */
-+static inline void init_disassemble_info_compat(struct disassemble_info *info,
-+						void *stream,
-+						fprintf_ftype unstyled_func,
-+						fprintf_styled_ftype styled_func)
-+{
-+#ifdef DISASM_INIT_STYLED
-+	init_disassemble_info(info, stream,
-+			      unstyled_func,
-+			      styled_func);
-+#else
-+	(void)styled_func;
-+	init_disassemble_info(info, stream,
-+			      unstyled_func);
-+#endif
-+}
-+
-+#endif /* _TOOLS_DIS_ASM_COMPAT_H */
-
---- a/tools/perf/Makefile.config
-+++ b/tools/perf/Makefile.config
-@@ -298,6 +298,7 @@ FEATURE_CHECK_LDFLAGS-libpython := $(PYTHON_EMBED_LDOPTS)
- FEATURE_CHECK_LDFLAGS-libaio = -lrt
- 
- FEATURE_CHECK_LDFLAGS-disassembler-four-args = -lbfd -lopcodes -ldl
-+FEATURE_CHECK_LDFLAGS-disassembler-init-styled = -lbfd -lopcodes -ldl
- 
- CORE_CFLAGS += -fno-omit-frame-pointer
- CORE_CFLAGS += -ggdb3
-@@ -924,13 +925,16 @@ ifndef NO_LIBBFD
-     ifeq ($(feature-libbfd-liberty), 1)
-       EXTLIBS += -lbfd -lopcodes -liberty
-       FEATURE_CHECK_LDFLAGS-disassembler-four-args += -liberty -ldl
-+      FEATURE_CHECK_LDFLAGS-disassembler-init-styled += -liberty -ldl
-     else
-       ifeq ($(feature-libbfd-liberty-z), 1)
-         EXTLIBS += -lbfd -lopcodes -liberty -lz
-         FEATURE_CHECK_LDFLAGS-disassembler-four-args += -liberty -lz -ldl
-+        FEATURE_CHECK_LDFLAGS-disassembler-init-styled += -liberty -lz -ldl
-       endif
-     endif
-     $(call feature_check,disassembler-four-args)
-+    $(call feature_check,disassembler-init-styled)
-   endif
- 
-   ifeq ($(feature-libbfd-buildid), 1)
-@@ -1044,6 +1048,10 @@ ifeq ($(feature-disassembler-four-args), 1)
-     CFLAGS += -DDISASM_FOUR_ARGS_SIGNATURE
- endif
- 
-+ifeq ($(feature-disassembler-init-styled), 1)
-+    CFLAGS += -DDISASM_INIT_STYLED
-+endif
-+
- ifeq (${IS_64_BIT}, 1)
-   ifndef NO_PERF_READ_VDSO32
-     $(call feature_check,compile-32)
---- a/tools/perf/util/annotate.c
-+++ b/tools/perf/util/annotate.c
-@@ -1720,6 +1720,7 @@ static int dso__disassemble_filename(struct dso *dso, char *filename, size_t fil
- #include <bpf/btf.h>
- #include <bpf/libbpf.h>
- #include <linux/btf.h>
-+#include <tools/dis-asm-compat.h>
- 
- static int symbol__disassemble_bpf(struct symbol *sym,
- 				   struct annotate_args *args)
-@@ -1762,9 +1763,9 @@ static int symbol__disassemble_bpf(struct symbol *sym,
- 		ret = errno;
- 		goto out;
- 	}
--	init_disassemble_info(&info, s,
--			      (fprintf_ftype) fprintf);
--
-+	init_disassemble_info_compat(&info, s,
-+				     (fprintf_ftype) fprintf,
-+				     fprintf_styled);
- 	info.arch = bfd_get_arch(bfdf);
- 	info.mach = bfd_get_mach(bfdf);
- 
-
---- a/tools/bpf/Makefile
-+++ b/tools/bpf/Makefile
-@@ -34,7 +34,7 @@ else
- endif
- 
- FEATURE_USER = .bpf
--FEATURE_TESTS = libbfd disassembler-four-args
-+FEATURE_TESTS = libbfd disassembler-four-args disassembler-init-styled
- FEATURE_DISPLAY = libbfd disassembler-four-args
- 
- check_feat := 1
-@@ -56,6 +56,9 @@ endif
- ifeq ($(feature-disassembler-four-args), 1)
- CFLAGS += -DDISASM_FOUR_ARGS_SIGNATURE
- endif
-+ifeq ($(feature-disassembler-init-styled), 1)
-+CFLAGS += -DDISASM_INIT_STYLED
-+endif
- 
- $(OUTPUT)%.yacc.c: $(srctree)/tools/bpf/%.y
- 	$(QUIET_BISON)$(YACC) -o $@ -d $<
---- a/tools/bpf/bpf_jit_disasm.c
-+++ b/tools/bpf/bpf_jit_disasm.c
-@@ -28,6 +28,7 @@
- #include <sys/types.h>
- #include <sys/stat.h>
- #include <limits.h>
-+#include <tools/dis-asm-compat.h>
- 
- #define CMD_ACTION_SIZE_BUFFER		10
- #define CMD_ACTION_READ_ALL		3
-@@ -64,7 +65,9 @@ static void get_asm_insns(uint8_t *image, size_t len, int opcodes)
- 	assert(bfdf);
- 	assert(bfd_check_format(bfdf, bfd_object));
- 
--	init_disassemble_info(&info, stdout, (fprintf_ftype) fprintf);
-+	init_disassemble_info_compat(&info, stdout,
-+				     (fprintf_ftype) fprintf,
-+				     fprintf_styled);
- 	info.arch = bfd_get_arch(bfdf);
- 	info.mach = bfd_get_mach(bfdf);
- 	info.buffer = image;
-
---- a/tools/bpf/Makefile
-+++ b/tools/bpf/Makefile
-@@ -35,7 +35,7 @@ endif
- 
- FEATURE_USER = .bpf
- FEATURE_TESTS = libbfd disassembler-four-args disassembler-init-styled
--FEATURE_DISPLAY = libbfd disassembler-four-args
-+FEATURE_DISPLAY = libbfd
- 
- check_feat := 1
- NON_CHECK_FEAT_TARGETS := clean bpftool_clean runqslower_clean resolve_btfids_clean
-
---- a/tools/bpf/bpftool/Makefile
-+++ b/tools/bpf/bpftool/Makefile
-@@ -93,7 +93,7 @@ INSTALL ?= install
- RM ?= rm -f
- 
- FEATURE_USER = .bpftool
--FEATURE_TESTS = libbfd disassembler-four-args zlib libcap \
-+FEATURE_TESTS = libbfd disassembler-four-args disassembler-init-styled zlib libcap \
- 	clang-bpf-co-re
- FEATURE_DISPLAY = libbfd disassembler-four-args zlib libcap \
- 	clang-bpf-co-re
-@@ -117,6 +117,9 @@ endif
- ifeq ($(feature-disassembler-four-args), 1)
- CFLAGS += -DDISASM_FOUR_ARGS_SIGNATURE
- endif
-+ifeq ($(feature-disassembler-init-styled), 1)
-+    CFLAGS += -DDISASM_INIT_STYLED
-+endif
- 
- LIBS = $(LIBBPF) -lelf -lz
- LIBS_BOOTSTRAP = $(LIBBPF_BOOTSTRAP) -lelf -lz
---- a/tools/bpf/bpftool/jit_disasm.c
-+++ b/tools/bpf/bpftool/jit_disasm.c
-@@ -24,6 +24,7 @@
- #include <sys/stat.h>
- #include <limits.h>
- #include <bpf/libbpf.h>
-+#include <tools/dis-asm-compat.h>
- 
- #include "json_writer.h"
- #include "main.h"
-@@ -39,15 +40,12 @@ static void get_exec_path(char *tpath, size_t size)
- }
- 
- static int oper_count;
--static int fprintf_json(void *out, const char *fmt, ...)
-+static int printf_json(void *out, const char *fmt, va_list ap)
- {
--	va_list ap;
- 	char *s;
- 	int err;
- 
--	va_start(ap, fmt);
- 	err = vasprintf(&s, fmt, ap);
--	va_end(ap);
- 	if (err < 0)
- 		return -1;
- 
-@@ -73,6 +71,32 @@ static int fprintf_json(void *out, const char *fmt, ...)
- 	return 0;
- }
- 
-+static int fprintf_json(void *out, const char *fmt, ...)
-+{
-+	va_list ap;
-+	int r;
-+
-+	va_start(ap, fmt);
-+	r = printf_json(out, fmt, ap);
-+	va_end(ap);
-+
-+	return r;
-+}
-+
-+static int fprintf_json_styled(void *out,
-+			       enum disassembler_style style __maybe_unused,
-+			       const char *fmt, ...)
-+{
-+	va_list ap;
-+	int r;
-+
-+	va_start(ap, fmt);
-+	r = printf_json(out, fmt, ap);
-+	va_end(ap);
-+
-+	return r;
-+}
-+
- void disasm_print_insn(unsigned char *image, ssize_t len, int opcodes,
- 		       const char *arch, const char *disassembler_options,
- 		       const struct btf *btf,
-@@ -99,11 +123,13 @@ void disasm_print_insn(unsigned char *image, ssize_t len, int opcodes,
- 	assert(bfd_check_format(bfdf, bfd_object));
- 
- 	if (json_output)
--		init_disassemble_info(&info, stdout,
--				      (fprintf_ftype) fprintf_json);
-+		init_disassemble_info_compat(&info, stdout,
-+					     (fprintf_ftype) fprintf_json,
-+					     fprintf_json_styled);
- 	else
--		init_disassemble_info(&info, stdout,
--				      (fprintf_ftype) fprintf);
-+		init_disassemble_info_compat(&info, stdout,
-+					     (fprintf_ftype) fprintf,
-+					     fprintf_styled);
- 
- 	/* Update architecture info for offload. */
- 	if (arch) {
diff --git a/pkgs/os-specific/linux/kernel/perf/default.nix b/pkgs/os-specific/linux/kernel/perf/default.nix
index 709312ebdcdf..e4c8be02cbb0 100644
--- a/pkgs/os-specific/linux/kernel/perf/default.nix
+++ b/pkgs/os-specific/linux/kernel/perf/default.nix
@@ -4,9 +4,7 @@
 , fetchurl
 , kernel
 , elfutils
-, python2
 , python3
-, python3Packages
 , perl
 , newt
 , slang
@@ -61,34 +59,23 @@ stdenv.mkDerivation {
 
   inherit (kernel) src;
 
-  patches = lib.optionals (lib.versionAtLeast kernel.version "5.19" && lib.versionOlder kernel.version "5.20") [
-    # binutils-2.39 support around init_disassemble_info()
-    # API change.
-    # Will be included in 5.20.
-    ./5.19-binutils-2.39-support.patch
-  ];
-
   postPatch = ''
-    patchShebangs scripts tools/perf/pmu-events/jevents.py
-  '' + lib.optionalString (lib.versionAtLeast kernel.version "5.8") ''
-    substituteInPlace tools/perf/scripts/python/flamegraph.py \
-      --replace "/usr/share/d3-flame-graph/d3-flamegraph-base.html" \
-      "${d3-flame-graph-templates}/share/d3-flame-graph/d3-flamegraph-base.html"
-  '';
+    # Linux scripts
+    patchShebangs scripts
 
-  preConfigure = ''
     cd tools/perf
 
-    substituteInPlace Makefile \
-      --replace /usr/include/elfutils $elfutils/include/elfutils
-
     for x in util/build-id.c util/dso.c; do
       substituteInPlace $x --replace /usr/lib/debug /run/current-system/sw/lib/debug
     done
 
-    if [ -f bash_completion ]; then
-      sed -i 's,^have perf,_have perf,' bash_completion
-    fi
+  '' + lib.optionalString (lib.versionAtLeast kernel.version "5.8") ''
+    substituteInPlace scripts/python/flamegraph.py \
+      --replace "/usr/share/d3-flame-graph/d3-flamegraph-base.html" \
+      "${d3-flame-graph-templates}/share/d3-flame-graph/d3-flamegraph-base.html"
+
+  '' + lib.optionalString (lib.versionAtLeast kernel.version "6.0") ''
+    patchShebangs pmu-events/jevents.py
   '';
 
   makeFlags = [ "prefix=$(out)" "WERROR=0" ] ++ kernel.makeFlags;
@@ -127,10 +114,9 @@ stdenv.mkDerivation {
   then [ libbfd libopcodes ]
   else [ libbfd_2_38 libopcodes_2_38 ])
   ++ lib.optional withGtk gtk2
-  ++ (if (lib.versionAtLeast kernel.version "4.19") then [ python3 ] else [ python2 ])
   ++ lib.optional withZstd zstd
   ++ lib.optional withLibcap libcap
-  ++ lib.optional (lib.versionAtLeast kernel.version "6.0") python3Packages.setuptools;
+  ++ lib.optional (lib.versionAtLeast kernel.version "6.0") python3.pkgs.setuptools;
 
   NIX_CFLAGS_COMPILE = toString [
     "-Wno-error=cpp"
@@ -140,22 +126,23 @@ stdenv.mkDerivation {
   ];
 
   doCheck = false; # requires "sparse"
-  doInstallCheck = false; # same
 
-  separateDebugInfo = true;
   installFlags = [ "install" "install-man" "ASCIIDOC8=1" "prefix=$(out)" ];
 
-  postInstall =''
+  # TODO: Add completions based on perf-completion.sh
+  postInstall = ''
     # Same as perf. Remove.
     rm -f $out/bin/trace
   '';
 
+  separateDebugInfo = true;
+
   preFixup = ''
     # Pull in 'objdump' into PATH to make annotations work.
     # The embeded Python interpreter will search PATH to calculate the Python path configuration(Should be fixed by upstream).
     # Add python.interpreter to PATH for now.
     wrapProgram $out/bin/perf \
-      --prefix PATH : ${lib.makeBinPath ([ binutils-unwrapped ] ++ (if (lib.versionAtLeast kernel.version "4.19") then [ python3 ] else [ python2 ]))}
+      --prefix PATH : ${lib.makeBinPath [ binutils-unwrapped python3 ]}
   '';
 
   meta = with lib; {
diff --git a/pkgs/servers/hbase/default.nix b/pkgs/servers/hbase/default.nix
index 40b5dc7e0b65..aa00fe80743a 100644
--- a/pkgs/servers/hbase/default.nix
+++ b/pkgs/servers/hbase/default.nix
@@ -38,20 +38,19 @@ let common = { version, hash, jdk ? jdk11_headless, tests }:
   };
 in
 {
-  hbase_1_7 = common {
-    version = "1.7.1";
-    hash = "sha256-DrH2G79QLT8L0YTTmAGC9pUWU8semSaTOsrsQRCI2rY=";
-    jdk = jdk8_headless;
-    tests.standalone = nixosTests.hbase1;
-  };
   hbase_2_4 = common {
-    version = "2.4.11";
-    hash = "sha256-m0vjUtPaj8czHHh+rQNJJgrFAM744cHd06KE0ut7QeU=";
+    version = "2.4.15";
+    hash = "sha256-KJXpfQ91POVd7ZnKQyIX5qzX4JIZqh3Zn2Pz0chW48g=";
+    tests.standalone = nixosTests.hbase_2_4;
+  };
+  hbase_2_5 = common {
+    version = "2.5.1";
+    hash = "sha256-ddSa4q43PSJv1W4lzzaXfv4LIThs4n8g8wYufHgsZVE=";
     tests.standalone = nixosTests.hbase2;
   };
   hbase_3_0 = common {
-    version = "3.0.0-alpha-2";
-    hash = "sha256-QPvgO1BeFWvMT5PdUm/SL92ZgvSvYIuJbzolbBTenz4=";
+    version = "3.0.0-alpha-3";
+    hash = "sha256-TxuiUHc2pTb9nBth1H2XrDRLla2vqM+e1uBU+yY2/EM=";
     tests.standalone = nixosTests.hbase3;
   };
 }
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index a91323534397..790f7a012570 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -31,6 +31,16 @@ let
     # Override the version of some packages pinned in Home Assistant's setup.py and requirements_all.txt
 
     (self: super: {
+      # https://github.com/postlund/pyatv/issues/1879
+      aiohttp = super.aiohttp.overridePythonAttrs (oldAttrs: rec {
+        pname = "aiohttp";
+        version = "3.8.1";
+        src = self.fetchPypi {
+          inherit pname version;
+          hash = "sha256-/FRx4aVN4V73HBvG6+gNTcaB6mAOaL/Ry85AQn8LdXg=";
+        };
+      });
+
       backoff = super.backoff.overridePythonAttrs (oldAttrs: rec {
         version = "1.11.1";
         src = fetchFromGitHub {
diff --git a/pkgs/servers/jackett/default.nix b/pkgs/servers/jackett/default.nix
index 982169125a08..630d7b845b7b 100644
--- a/pkgs/servers/jackett/default.nix
+++ b/pkgs/servers/jackett/default.nix
@@ -9,13 +9,13 @@
 
 buildDotnetModule rec {
   pname = "jackett";
-  version = "0.20.2238";
+  version = "0.20.2264";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "3kYpx3s4gYBTrqSOt7eLOf8x4cPnlDVmesYBbFzRZVU=";
+    sha256 = "Y1m828STKL4ANuf11oCekvT2ctCRBlT7Blyvvoltdxc=";
   };
 
   projectFile = "src/Jackett.Server/Jackett.Server.csproj";
diff --git a/pkgs/servers/kubemq-community/default.nix b/pkgs/servers/kubemq-community/default.nix
index 81e9e1b671fa..a3428a8db8a3 100644
--- a/pkgs/servers/kubemq-community/default.nix
+++ b/pkgs/servers/kubemq-community/default.nix
@@ -2,12 +2,12 @@
 
 buildGoModule rec {
   pname = "kubemq-community";
-  version = "2.3.4";
+  version = "2.3.5";
   src = fetchFromGitHub {
     owner = "kubemq-io";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-+HJpjKMSndcV+xQJM+FesdtoUSGHnpILQFuf3sbxBY0=";
+    sha256 = "sha256-kR2/Is1fQqpRyQ8yKSEvXV5xzXcHldCqgnCRNRZ+Ekg=";
   };
 
   CGO_ENABLED=0;
diff --git a/pkgs/servers/matrix-synapse/tools/rust-synapse-compress-state.nix b/pkgs/servers/matrix-synapse/tools/rust-synapse-compress-state.nix
index fcf123d6e1db..fe1dc5f6b207 100644
--- a/pkgs/servers/matrix-synapse/tools/rust-synapse-compress-state.nix
+++ b/pkgs/servers/matrix-synapse/tools/rust-synapse-compress-state.nix
@@ -1,4 +1,4 @@
-{ lib, rustPlatform, python3, fetchFromGitHub, pkg-config, openssl }:
+{ lib, stdenv, rustPlatform, python3, fetchFromGitHub, pkg-config, openssl }:
 
 rustPlatform.buildRustPackage rec {
   pname = "rust-synapse-compress-state";
@@ -22,6 +22,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [ openssl ];
 
   meta = with lib; {
+    broken = stdenv.isDarwin;
     description = "A tool to compress some state in a Synapse instance's database";
     homepage = "https://github.com/matrix-org/rust-synapse-compress-state";
     license = licenses.asl20;
diff --git a/pkgs/servers/monitoring/prometheus/artifactory-exporter.nix b/pkgs/servers/monitoring/prometheus/artifactory-exporter.nix
index 60027e1d02a9..47cf29f55fbe 100644
--- a/pkgs/servers/monitoring/prometheus/artifactory-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/artifactory-exporter.nix
@@ -2,17 +2,17 @@
 
 buildGoModule rec {
   pname = "artifactory_exporter";
-  version = "1.9.4";
+  version = "1.9.5";
   rev = "v${version}";
 
   src = fetchFromGitHub {
     owner = "peimanja";
     repo = pname;
     rev = rev;
-    sha256 = "sha256-vrbuKWoKfDrgJEOYsncwJZ8lyAfanbV8jKQDVCZY2Sg=";
+    sha256 = "sha256-QUluuxuOgeq5CnpmVh5uDC4SEWD97JbQCHiYjYUs/nI=";
   };
 
-  vendorSha256 = "sha256-wKBSAZSE/lSUbkHkyBEkO0wvkrK6fKxXIjF6G+ILqHM=";
+  vendorSha256 = "sha256-5yzBKgjJCv4tgdBS6XmZUq1ebbka0LOuv6BARWO7kQg=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/servers/nosql/surrealdb/default.nix b/pkgs/servers/nosql/surrealdb/default.nix
index 6e89e5ba03ad..f6bca761f23f 100644
--- a/pkgs/servers/nosql/surrealdb/default.nix
+++ b/pkgs/servers/nosql/surrealdb/default.nix
@@ -31,6 +31,8 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [
     pkg-config
+    # needed on top of LIBCLANG_PATH to compile rquickjs
+    llvmPackages.clang
   ];
 
   buildInputs = [ openssl ]
diff --git a/pkgs/servers/photoprism/default.nix b/pkgs/servers/photoprism/default.nix
index 4c5fb08c30df..678f30c372d0 100644
--- a/pkgs/servers/photoprism/default.nix
+++ b/pkgs/servers/photoprism/default.nix
@@ -1,4 +1,4 @@
-{ pkgs, lib, stdenv, fetchFromGitHub, fetchzip, darktable, rawtherapee, ffmpeg, libheif, exiftool, nixosTests, makeWrapper }:
+{ pkgs, lib, stdenv, fetchFromGitHub, fetchzip, darktable, rawtherapee, ffmpeg, libheif, exiftool, makeWrapper, testers }:
 
 let
   version = "221102-905925b4d";
@@ -74,7 +74,7 @@ stdenv.mkDerivation {
     runHook postInstall
   '';
 
-  passthru.tests.photoprism = nixosTests.photoprism;
+  passthru.tests.version = testers.testVersion { package = pkgs.photoprism; };
 
   meta = with lib; {
     homepage = "https://photoprism.app";
diff --git a/pkgs/servers/photoprism/libtensorflow.nix b/pkgs/servers/photoprism/libtensorflow.nix
index 869f9fc8da1c..e1c8f9338cc8 100644
--- a/pkgs/servers/photoprism/libtensorflow.nix
+++ b/pkgs/servers/photoprism/libtensorflow.nix
@@ -15,12 +15,14 @@ stdenv.mkDerivation rec {
         aarch64-linux = "sha256-qnj4vhSWgrk8SIjzIH1/4waMxMsxMUvqdYZPaSaUJRk=";
       }.${system};
 
-      url = let
-        systemName = {
-          x86_64-linux = "amd64";
-          aarch64-linux = "arm64";
-        }.${system};
-      in "https://dl.photoprism.app/tensorflow/${systemName}/libtensorflow-${systemName}-${version}.tar.gz";
+      url =
+        let
+          systemName = {
+            x86_64-linux = "amd64";
+            aarch64-linux = "arm64";
+          }.${system};
+        in
+        "https://dl.photoprism.app/tensorflow/${systemName}/libtensorflow-${systemName}-${version}.tar.gz";
     })
     # Upstream tensorflow tarball (with .h's photoprism's tarball is missing)
     (fetchurl {
@@ -49,13 +51,15 @@ stdenv.mkDerivation rec {
   '';
 
   # Patch library to use our libc, libstdc++ and others
-  patchPhase = let
-    rpath = lib.makeLibraryPath [ stdenv.cc.libc stdenv.cc.cc.lib ];
-  in ''
-    chmod -R +w lib
-    patchelf --set-rpath "${rpath}:$out/lib" lib/libtensorflow.so
-    patchelf --set-rpath "${rpath}" lib/libtensorflow_framework.so
-  '';
+  patchPhase =
+    let
+      rpath = lib.makeLibraryPath [ stdenv.cc.libc stdenv.cc.cc.lib ];
+    in
+    ''
+      chmod -R +w lib
+      patchelf --set-rpath "${rpath}:$out/lib" lib/libtensorflow.so
+      patchelf --set-rpath "${rpath}" lib/libtensorflow_framework.so
+    '';
 
   buildPhase = ''
     # Write pkg-config file.
diff --git a/pkgs/servers/prowlarr/default.nix b/pkgs/servers/prowlarr/default.nix
index f7fde43b75e9..9a7a96d6920f 100644
--- a/pkgs/servers/prowlarr/default.nix
+++ b/pkgs/servers/prowlarr/default.nix
@@ -16,14 +16,14 @@ let
   }."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
   hash = {
-    x64-linux_hash = "sha256-H0OTEaUD6NVzZT0OpPONRl+wuCdrFXbiY9yHqc6/9e0=";
-    arm64-linux_hash = "sha256-L7jTqC5IMB2pD3d71Uc/kDsfw5LVScJ97sjkq73XgVM=";
-    x64-osx_hash = "sha256-tFpfgRq7Xlh8uBoNBHb6aXBDzsa48JC8ge9XGdSvZaI=";
+    x64-linux_hash = "sha256-nzMMVsDwE5GRtqzzBVs04bXfCEbNmRiLeaohBG01NL0=";
+    arm64-linux_hash = "sha256-av979aV5LYWTsFajihwV0QzYbSwg1rac+q1NCnaU8K0=";
+    x64-osx_hash = "sha256-9oinpaetF0mphraGjAt3yeDsE+nz+59vxQG5ZTVLWXM=";
   }."${arch}-${os}_hash";
 
 in stdenv.mkDerivation rec {
   pname = "prowlarr";
-  version = "0.4.7.2016";
+  version = "0.4.9.2083";
 
   src = fetchurl {
     url = "https://github.com/Prowlarr/Prowlarr/releases/download/v${version}/Prowlarr.develop.${version}.${os}-core-${arch}.tar.gz";
diff --git a/pkgs/servers/web-apps/outline/default.nix b/pkgs/servers/web-apps/outline/default.nix
index 03f8a0e45b7b..19cc2ee94cfd 100644
--- a/pkgs/servers/web-apps/outline/default.nix
+++ b/pkgs/servers/web-apps/outline/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "outline";
-  version = "0.66.2";
+  version = "0.66.3";
 
   src = fetchFromGitHub {
     owner = "outline";
     repo = "outline";
     rev = "v${version}";
-    sha256 = "sha256-jRnw6UIUA3gAgyqQg6R1GOI4O8HXKnVfTH3d3SFBa9A=";
+    sha256 = "sha256-2o5rRVOd+dvJOzQFGuuA0PZmmK/wnItcNu8WX9WShQ8=";
   };
 
   nativeBuildInputs = [ makeWrapper yarn2nix-moretea.fixup_yarn_lock ];
diff --git a/pkgs/shells/fish/plugins/default.nix b/pkgs/shells/fish/plugins/default.nix
index cb2d73dacc5a..c67639a85a2f 100644
--- a/pkgs/shells/fish/plugins/default.nix
+++ b/pkgs/shells/fish/plugins/default.nix
@@ -31,4 +31,6 @@ lib.makeScope newScope (self: with self; {
 
   pure = callPackage ./pure.nix { };
 
+  sponge = callPackage ./sponge.nix { };
+
 })
diff --git a/pkgs/shells/fish/plugins/sponge.nix b/pkgs/shells/fish/plugins/sponge.nix
new file mode 100644
index 000000000000..2afc3ec61585
--- /dev/null
+++ b/pkgs/shells/fish/plugins/sponge.nix
@@ -0,0 +1,20 @@
+{ lib, buildFishPlugin, fetchFromGitHub }:
+
+buildFishPlugin rec {
+  pname = "sponge";
+  version = "1.1.0";
+
+  src = fetchFromGitHub {
+    owner = "meaningful-ooo";
+    repo = pname;
+    rev = "${version}";
+    sha256 = "sha256-MdcZUDRtNJdiyo2l9o5ma7nAX84xEJbGFhAVhK+Zm1w=";
+  };
+
+  meta = with lib; {
+    description = "keeps your fish shell history clean from typos, incorrectly used commands and everything you don't want to store due to privacy reasons";
+    homepage = "https://github.com/meaningful-ooo/sponge";
+    license = licenses.mit;
+    maintainers = with maintainers; [ quantenzitrone ];
+  };
+}
diff --git a/pkgs/tools/admin/lxd/default.nix b/pkgs/tools/admin/lxd/default.nix
index c15861ed69d4..348760fb3e88 100644
--- a/pkgs/tools/admin/lxd/default.nix
+++ b/pkgs/tools/admin/lxd/default.nix
@@ -32,14 +32,14 @@
 
 buildGoModule rec {
   pname = "lxd";
-  version = "5.7";
+  version = "5.8";
 
   src = fetchurl {
     urls = [
       "https://linuxcontainers.org/downloads/lxd/lxd-${version}.tar.gz"
       "https://github.com/lxc/lxd/releases/download/lxd-${version}/lxd-${version}.tar.gz"
     ];
-    sha256 = "sha256-TZeF/VPrP4qRAVezJwQWtfypsxBJpnTrST0uDdw3WVI=";
+    sha256 = "sha256-mYyDYO8k4MVoNa8xfp1vH2nyuhNsDJ93s9F5hjaMftk=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/tools/admin/pulumi/default.nix b/pkgs/tools/admin/pulumi/default.nix
index 42daa857c163..027e4eac013c 100644
--- a/pkgs/tools/admin/pulumi/default.nix
+++ b/pkgs/tools/admin/pulumi/default.nix
@@ -14,16 +14,16 @@
 
 buildGoModule rec {
   pname = "pulumi";
-  version = "3.46.1";
+  version = "3.47.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-bEAggHGMhSSwEiYj+DdJRajR4DLunpidbd4DflkBrQ8=";
+    hash = "sha256-r0VPWVyyWGZ2v2yKKiJGJV+ah77zxFm7Zwm9yag3fxc=";
   };
 
-  vendorSha256 = "sha256-+JKCCNkByqWuvAv8qUL3L9DlDhvIbMsDbsfn3KYolUo=";
+  vendorSha256 = "sha256-eipxqX2m425FnPkf+ao/k1dYwDHDmJf+eS3S0sEiXkk=";
 
   sourceRoot = "source/pkg";
 
diff --git a/pkgs/tools/audio/tts/default.nix b/pkgs/tools/audio/tts/default.nix
index 4e9148db9663..9b3bce6f44cf 100644
--- a/pkgs/tools/audio/tts/default.nix
+++ b/pkgs/tools/audio/tts/default.nix
@@ -32,14 +32,14 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "tts";
-  version = "0.8.0";
-  format = "setuptools";
+  version = "0.9.0";
+  format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "coqui-ai";
     repo = "TTS";
     rev = "v${version}";
-    sha256 = "sha256-A48L1JGXckSEaZra00ZOBVxcYJMvhpQqzE8nABaP0TY=";
+    sha256 = "sha256-p4I583Rs/4eig7cnOcJjri2ugOLAeF2nvPIvMZrN1Ss=";
   };
 
   postPatch = let
@@ -53,7 +53,6 @@ python.pkgs.buildPythonApplication rec {
       "numpy"
       "umap-learn"
       "unidic-lite"
-      "pyworld"
     ];
   in ''
     sed -r -i \
@@ -61,7 +60,6 @@ python.pkgs.buildPythonApplication rec {
         ''-e 's/${package}.*[<>=]+.*/${package}/g' \''
       ) relaxedConstraints)}
     requirements.txt
-    sed -i '/tensorboardX/d' requirements.txt
   '';
 
   nativeBuildInputs = with python.pkgs; [
@@ -71,27 +69,29 @@ python.pkgs.buildPythonApplication rec {
   propagatedBuildInputs = with python.pkgs; [
     anyascii
     coqpit
-    coqui-trainer
     flask
     fsspec
+    g2pkk
     gdown
     gruut
     inflect
+    jamo
     jieba
     librosa
     matplotlib
     mecab-python3
+    nltk
     numba
     pandas
     pypinyin
     pysbd
-    pyworld
     scipy
     soundfile
     tensorflow
     torch-bin
     torchaudio-bin
     tqdm
+    trainer
     umap-learn
     unidic-lite
     webrtcvad
@@ -127,15 +127,17 @@ python.pkgs.buildPythonApplication rec {
 
   disabledTests = [
     # Requires network acccess to download models
-    "test_synthesize"
+    "test_korean_text_to_phonemes"
+    "test_models_offset_0_step_3"
+    "test_models_offset_1_step_3"
+    "test_models_offset_2_step_3"
     "test_run_all_models"
+    "test_synthesize"
+    "test_voice_conversion"
     # Mismatch between phonemes
     "test_text_to_ids_phonemes_with_eos_bos_and_blank"
     # Takes too long
     "test_parametrized_wavernn_dataset"
-
-    # requires network
-    "test_voice_conversion"
   ];
 
   disabledTestPaths = [
diff --git a/pkgs/tools/misc/gitlint/default.nix b/pkgs/tools/misc/gitlint/default.nix
index c32171585969..626739864c71 100644
--- a/pkgs/tools/misc/gitlint/default.nix
+++ b/pkgs/tools/misc/gitlint/default.nix
@@ -7,13 +7,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "gitlint";
-  version = "0.17.0";
+  version = "0.18.0";
 
   src = fetchFromGitHub {
     owner = "jorisroovers";
     repo = "gitlint";
     rev = "v${version}";
-    sha256 = "sha256-RXBMb43BBiJ23X0eKC1kqgLw8iFKJnP5iejY0AWcUrU=";
+    sha256 = "sha256-MmXzrooN+C9MUaAz4+IEGkGJWHbgvPMSLHgssM0wyN8=";
   };
 
   # Upstream splitted the project into gitlint and gitlint-core to
diff --git a/pkgs/tools/misc/ncdu/default.nix b/pkgs/tools/misc/ncdu/default.nix
index 4844e81079a6..b8b5d93c3813 100644
--- a/pkgs/tools/misc/ncdu/default.nix
+++ b/pkgs/tools/misc/ncdu/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ncdu";
-  version = "2.1.2";
+  version = "2.2.1";
 
   src = fetchurl {
     url = "https://dev.yorhel.nl/download/${pname}-${version}.tar.gz";
-    sha256 = "sha256-ng1u8DYYo8MWcmv0khe37+Rc7HWLLJF86JLe10Myxtw=";
+    sha256 = "sha256-Xkr49rzYz3rY/T15ANqxMgdFoEUxAenjdPmnf3Ku0UE=";
   };
 
   XDG_CACHE_HOME="Cache"; # FIXME This should be set in stdenv
diff --git a/pkgs/tools/misc/nncp/default.nix b/pkgs/tools/misc/nncp/default.nix
index 497910cd809d..d7dcc901666d 100644
--- a/pkgs/tools/misc/nncp/default.nix
+++ b/pkgs/tools/misc/nncp/default.nix
@@ -3,12 +3,12 @@
 
 stdenv.mkDerivation rec {
   pname = "nncp";
-  version = "8.8.1";
+  version = "8.8.2";
   outputs = [ "out" "doc" "info" ];
 
   src = fetchurl {
     url = "http://www.nncpgo.org/download/${pname}-${version}.tar.xz";
-    sha256 = "426463C97211AD88DF74DDDF61BDBB830BAE275668B2F23158D43146517469A6";
+    sha256 = "02B98DC4654C46328A043209CD2DA28BF33A53BAF15574429C6C0747AE2FCF39";
   };
 
   nativeBuildInputs = [ go redo-apenwarr ];
diff --git a/pkgs/tools/package-management/nfpm/default.nix b/pkgs/tools/package-management/nfpm/default.nix
index 11a192bbd318..c38f32fc997c 100644
--- a/pkgs/tools/package-management/nfpm/default.nix
+++ b/pkgs/tools/package-management/nfpm/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "nfpm";
-  version = "2.22.0";
+  version = "2.22.1";
 
   src = fetchFromGitHub {
     owner = "goreleaser";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Qb4jzn1UM/0B4ryk3cPVuhqVtJML+Vv5KtebBjirSuI=";
+    sha256 = "sha256-BdPY1DzF2zunhEp7Z13X3jOxhTPHHUejAe7HZSoexYk=";
   };
 
   vendorSha256 = "sha256-fvSA0BQQKhXxyNu0/ilNcMmTBtLm/piA4rJu6p5+8GU=";
diff --git a/pkgs/tools/security/ghidra/build.nix b/pkgs/tools/security/ghidra/build.nix
index 9f97e3ece315..2857019612d5 100644
--- a/pkgs/tools/security/ghidra/build.nix
+++ b/pkgs/tools/security/ghidra/build.nix
@@ -19,13 +19,13 @@
 let
   pkg_path = "$out/lib/ghidra";
   pname = "ghidra";
-  version = "10.2.1";
+  version = "10.2.2";
 
   src = fetchFromGitHub {
     owner = "NationalSecurityAgency";
     repo = "Ghidra";
     rev = "Ghidra_${version}_build";
-    sha256 = "sha256-xK6rSvI3L5wVcTBxJJndAVQMxjpsA5jMq0GeWNmCodI=";
+    sha256 = "sha256-AiyY6mGM+jHu9n39t/cYj+I5CE+a3vA4P0THNEFoZrk=";
   };
 
   desktopItem = makeDesktopItem {
diff --git a/pkgs/tools/security/metasploit/Gemfile b/pkgs/tools/security/metasploit/Gemfile
index 7959e18698d2..68cd26e5cc34 100644
--- a/pkgs/tools/security/metasploit/Gemfile
+++ b/pkgs/tools/security/metasploit/Gemfile
@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 source "https://rubygems.org"
 
-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.2.26"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.2.27"
diff --git a/pkgs/tools/security/metasploit/Gemfile.lock b/pkgs/tools/security/metasploit/Gemfile.lock
index d635a1231580..2fef911c967a 100644
--- a/pkgs/tools/security/metasploit/Gemfile.lock
+++ b/pkgs/tools/security/metasploit/Gemfile.lock
@@ -1,9 +1,9 @@
 GIT
   remote: https://github.com/rapid7/metasploit-framework
-  revision: ef8b26c32cbcf48e9ba6a4d6c01d587a1d45f6cc
-  ref: refs/tags/6.2.26
+  revision: 1847611817b4dbea38ac13c83ac2c4abd92d7bc2
+  ref: refs/tags/6.2.27
   specs:
-    metasploit-framework (6.2.26)
+    metasploit-framework (6.2.27)
       actionpack (~> 6.0)
       activerecord (~> 6.0)
       activesupport (~> 6.0)
@@ -32,7 +32,7 @@ GIT
       metasploit-concern
       metasploit-credential
       metasploit-model
-      metasploit-payloads (= 2.0.99)
+      metasploit-payloads (= 2.0.101)
       metasploit_data_models
       metasploit_payloads-mettle (= 1.0.20)
       mqtt
@@ -129,13 +129,13 @@ GEM
     arel-helpers (2.14.0)
       activerecord (>= 3.1.0, < 8)
     aws-eventstream (1.2.0)
-    aws-partitions (1.659.0)
-    aws-sdk-core (3.167.0)
+    aws-partitions (1.664.0)
+    aws-sdk-core (3.168.1)
       aws-eventstream (~> 1, >= 1.0.2)
       aws-partitions (~> 1, >= 1.651.0)
       aws-sigv4 (~> 1.5)
       jmespath (~> 1, >= 1.6.1)
-    aws-sdk-ec2 (1.349.0)
+    aws-sdk-ec2 (1.351.0)
       aws-sdk-core (~> 3, >= 3.165.0)
       aws-sigv4 (~> 1.1)
     aws-sdk-iam (1.73.0)
@@ -176,10 +176,10 @@ GEM
     eventmachine (1.2.7)
     faker (3.0.0)
       i18n (>= 1.8.11, < 2)
-    faraday (2.6.0)
+    faraday (2.7.1)
       faraday-net_http (>= 2.0, < 3.1)
       ruby2_keywords (>= 0.0.4)
-    faraday-net_http (3.0.1)
+    faraday-net_http (3.0.2)
     faraday-retry (2.0.0)
       faraday (~> 2.0)
     faye-websocket (0.11.1)
@@ -204,7 +204,7 @@ GEM
     i18n (1.12.0)
       concurrent-ruby (~> 1.0)
     io-console (0.5.11)
-    irb (1.4.2)
+    irb (1.4.3)
       reline (>= 0.3.0)
     jmespath (1.6.1)
     jsobfu (0.4.2)
@@ -236,7 +236,7 @@ GEM
       activemodel (~> 6.0)
       activesupport (~> 6.0)
       railties (~> 6.0)
-    metasploit-payloads (2.0.99)
+    metasploit-payloads (2.0.101)
     metasploit_data_models (5.0.6)
       activerecord (~> 6.0)
       activesupport (~> 6.0)
@@ -286,13 +286,13 @@ GEM
       hashery (~> 2.0)
       ruby-rc4
       ttfunk
-    pg (1.4.4)
+    pg (1.4.5)
     public_suffix (5.0.0)
     puma (6.0.0)
       nio4r (~> 2.0)
     racc (1.6.0)
     rack (2.2.4)
-    rack-protection (3.0.2)
+    rack-protection (3.0.3)
       rack
     rack-test (2.0.2)
       rack (>= 1.3)
@@ -367,7 +367,7 @@ GEM
     ruby-macho (3.0.0)
     ruby-rc4 (0.1.5)
     ruby2_keywords (0.0.5)
-    ruby_smb (3.2.0)
+    ruby_smb (3.2.1)
       bindata
       openssl-ccm
       openssl-cmac
@@ -380,12 +380,12 @@ GEM
       faraday (>= 0.17.3, < 3)
     simpleidn (0.2.1)
       unf (~> 0.1.4)
-    sinatra (3.0.2)
+    sinatra (3.0.3)
       mustermann (~> 3.0)
       rack (~> 2.2, >= 2.2.4)
-      rack-protection (= 3.0.2)
+      rack-protection (= 3.0.3)
       tilt (~> 2.0)
-    sqlite3 (1.5.3)
+    sqlite3 (1.5.4)
       mini_portile2 (~> 2.8.0)
     sshkey (2.0.0)
     swagger-blocks (3.0.0)
diff --git a/pkgs/tools/security/metasploit/default.nix b/pkgs/tools/security/metasploit/default.nix
index cae6648f5ef9..8acd5d35d510 100644
--- a/pkgs/tools/security/metasploit/default.nix
+++ b/pkgs/tools/security/metasploit/default.nix
@@ -15,13 +15,13 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "metasploit-framework";
-  version = "6.2.26";
+  version = "6.2.27";
 
   src = fetchFromGitHub {
     owner = "rapid7";
     repo = "metasploit-framework";
     rev = version;
-    sha256 = "sha256-qPhN+N0AFSrkdxtUPZwJMicDafKpuwaQg+sDA6ssHow=";
+    sha256 = "sha256-0wovO6Dt65vA5C2/XNfHf4fsc3GvWp4mnh9gsY3O8Is=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/security/metasploit/gemset.nix b/pkgs/tools/security/metasploit/gemset.nix
index 8e9709c984e3..38f9f23b3344 100644
--- a/pkgs/tools/security/metasploit/gemset.nix
+++ b/pkgs/tools/security/metasploit/gemset.nix
@@ -104,30 +104,30 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0iwkwvx56rivfrqgsjap7bkn0zd9d5m712fx0b1mgcfalm6xjcpl";
+      sha256 = "1h69kvk5nrjfznms3dy9xk552xzv4kbq7ks9wgj1fdbxzc3rszng";
       type = "gem";
     };
-    version = "1.659.0";
+    version = "1.664.0";
   };
   aws-sdk-core = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "095nj7sf8914y60m1grnpy7cm6ybnw4ywnc0j84gz2vgv1m8awfk";
+      sha256 = "1vnnv9gk3dapng8siaqdimqkr4a99lfavx7lkwx2jiyy1p6c50rb";
       type = "gem";
     };
-    version = "3.167.0";
+    version = "3.168.1";
   };
   aws-sdk-ec2 = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1xk33r0q44ngsy9d6nh4isw9aa9rz31ajb69apk4b2wmc2gi1mcw";
+      sha256 = "0fcisnrj46idp0gmzjba39w5ay7phs0q8lai5mdwgn790n3cxkqr";
       type = "gem";
     };
-    version = "1.349.0";
+    version = "1.351.0";
   };
   aws-sdk-iam = {
     groups = ["default"];
@@ -344,20 +344,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0mqv17hfmph4ylmb2bqyccy64gsgpmzapq5yrmf5yjsqkvw9rxbv";
+      sha256 = "1wyz9ab0mzi84gpf81fs19vrixglmmxi25k6n1mn9h141qmsp590";
       type = "gem";
     };
-    version = "2.6.0";
+    version = "2.7.1";
   };
   faraday-net_http = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "13b717ddw90iaf4vijy06srmkvrfbzsnyjap93yll0nibad4dbxq";
+      sha256 = "13byv3mp1gsjyv8k0ih4612y6vw5kqva6i03wcg4w2fqpsd950k8";
       type = "gem";
     };
-    version = "3.0.1";
+    version = "3.0.2";
   };
   faraday-retry = {
     groups = ["default"];
@@ -504,10 +504,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1g2xhrjjgbix2acss59kwzfzgcwf450j91paz7vqa578g95i32my";
+      sha256 = "0s28igrsspxmhwmwalv9c7g6ld2glzns2vhlfqmc3jnvnr68yhf1";
       type = "gem";
     };
-    version = "1.4.2";
+    version = "1.4.3";
   };
   jmespath = {
     groups = ["default"];
@@ -604,12 +604,12 @@
     platforms = [];
     source = {
       fetchSubmodules = false;
-      rev = "ef8b26c32cbcf48e9ba6a4d6c01d587a1d45f6cc";
-      sha256 = "130y5jmh60zbhf80dfx9y9lh69rj16f3sm0vfzj2l580vpw4vy58";
+      rev = "1847611817b4dbea38ac13c83ac2c4abd92d7bc2";
+      sha256 = "12zhrs6v2q0zkqk9wnmgf5ryr1vzqzbmrgrdwk09pszdl0xjy2nk";
       type = "git";
       url = "https://github.com/rapid7/metasploit-framework";
     };
-    version = "6.2.26";
+    version = "6.2.27";
   };
   metasploit-model = {
     groups = ["default"];
@@ -626,10 +626,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1rfnxkg31ksylg1rjk05d9kk4af4rbw66ipwl3q0vl3qvnbymfm8";
+      sha256 = "0m9w4yy5iwpbbjycpxyhfql2b4dnm4wgcn039aw43igjgfdrkmkz";
       type = "gem";
     };
-    version = "2.0.99";
+    version = "2.0.101";
   };
   metasploit_data_models = {
     groups = ["default"];
@@ -907,10 +907,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "09a5z9qhxnybahx162q2q1cygdhxfp6cihdivvzh32jlwc37z1x3";
+      sha256 = "1wd6nl81nbdwck04hccsm7wf23ghpi8yddd9j4rbwyvyj0sbsff1";
       type = "gem";
     };
-    version = "1.4.4";
+    version = "1.4.5";
   };
   public_suffix = {
     groups = ["default"];
@@ -957,10 +957,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0jmixih0qrsdz60dhznkk29v50ks55cqq51jjf0yn3amqghh4bhk";
+      sha256 = "1sfk4i52yijcggkzkwj3z6k2iv9fdacmcgcid1c8xjcldh93fhpg";
       type = "gem";
     };
-    version = "3.0.2";
+    version = "3.0.3";
   };
   rack-test = {
     groups = ["default"];
@@ -1287,10 +1287,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0iyp4j0j2bd0barp7057mr7280921c05ij2ygr1715lj1p9j4h5x";
+      sha256 = "0rsxb9bi3x4kxhhsaa4araxfz0zk573v0j4xv64d3p176kii6cmm";
       type = "gem";
     };
-    version = "3.2.0";
+    version = "3.2.1";
   };
   rubyntlm = {
     groups = ["default"];
@@ -1337,10 +1337,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0c2vmy0j5amy9fihs2gz2ssm4bdpqqh4llyjfl6qqqry7f87c6xz";
+      sha256 = "0znx4qhvgah5k696crv954xkrh8z4gick2fx04xl67wng7nnwrrc";
       type = "gem";
     };
-    version = "3.0.2";
+    version = "3.0.3";
   };
   sqlite3 = {
     dependencies = ["mini_portile2"];
@@ -1348,10 +1348,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1i95rgfxdj2rhxifps27dz7fjfdih5iyl7b01di9gdmh9m04ylk6";
+      sha256 = "009124l2yw7csrq3mvzffjflgpqi3y30flazjqf6aad64gnnnksx";
       type = "gem";
     };
-    version = "1.5.3";
+    version = "1.5.4";
   };
   sshkey = {
     groups = ["default"];
diff --git a/pkgs/tools/typesetting/sile/default.nix b/pkgs/tools/typesetting/sile/default.nix
index 92baf044d3cc..9cc4941853d5 100644
--- a/pkgs/tools/typesetting/sile/default.nix
+++ b/pkgs/tools/typesetting/sile/default.nix
@@ -43,11 +43,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "sile";
-  version = "0.14.4";
+  version = "0.14.5";
 
   src = fetchurl {
     url = "https://github.com/sile-typesetter/sile/releases/download/v${version}/${pname}-${version}.tar.xz";
-    sha256 = "091sy3k29q15ksqr650qmf9lz8j9lqbabfph4cf63plg4dnf9m98";
+    sha256 = "01wf0rihksk2ldxgci5vzl3j575vnp6wgk12yd28mwzxkss6n39g";
   };
 
   configureFlags = [
diff --git a/pkgs/tools/virtualization/cloud-init/default.nix b/pkgs/tools/virtualization/cloud-init/default.nix
index 5e438d887211..4b5f335938bb 100644
--- a/pkgs/tools/virtualization/cloud-init/default.nix
+++ b/pkgs/tools/virtualization/cloud-init/default.nix
@@ -14,14 +14,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "cloud-init";
-  version = "22.3.4";
+  version = "22.4";
   namePrefix = "";
 
   src = fetchFromGitHub {
     owner = "canonical";
     repo = "cloud-init";
     rev = "refs/tags/${version}";
-    hash = "sha256-agffkTEaURjw/Ro8znYRQLKhDP2Ey0LimuzqbW5xb28=";
+    hash = "sha256-MsT5t2da79Eb9FlTLPr2893JcF0ujNnToJTCQRT1QEo=";
   };
 
   patches = [ ./0001-add-nixos-support.patch ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 41ff5fb69f59..24bbf58576b0 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1553,7 +1553,7 @@ with pkgs;
 
   dosbox-staging = callPackage ../applications/emulators/dosbox-staging { };
 
-  duckstation = libsForQt5.callPackage ../applications/emulators/duckstation {};
+  duckstation = qt6Packages.callPackage ../applications/emulators/duckstation {};
 
   dynamips = callPackage ../applications/emulators/dynamips { };
 
@@ -15258,6 +15258,7 @@ with pkgs;
   };
   rustup-toolchain-install-master = callPackage ../development/tools/rust/rustup-toolchain-install-master {
     inherit (darwin.apple_sdk.frameworks) Security;
+    openssl = openssl_1_1;
   };
   rusty-man = callPackage ../development/tools/rust/rusty-man { };
 
@@ -16249,6 +16250,8 @@ with pkgs;
 
   anybadge = with python3Packages; toPythonApplication anybadge;
 
+  apgdiff = callPackage ../development/tools/database/apgdiff { };
+
   apkg = callPackage ../tools/package-management/apkg { };
 
   augeas = callPackage ../tools/system/augeas { };
@@ -17581,6 +17584,8 @@ with pkgs;
 
   privacyidea = callPackage ../applications/misc/privacyidea { };
 
+  process-compose = callPackage ../applications/misc/process-compose { };
+
   process-viewer = callPackage ../applications/misc/process-viewer {
     inherit (darwin.apple_sdk.frameworks) DiskArbitration Foundation IOKit;
   };
@@ -20404,6 +20409,10 @@ with pkgs;
 
   libhugetlbfs = callPackage ../development/libraries/libhugetlbfs { };
 
+  libhv = callPackage ../development/libraries/libhv {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
+
   libhwy = callPackage ../development/libraries/libhwy { };
 
   libHX = callPackage ../development/libraries/libHX { };
@@ -23706,9 +23715,8 @@ with pkgs;
 
   hasura-cli = callPackage ../servers/hasura/cli.nix { };
 
-  inherit (callPackage ../servers/hbase {}) hbase_1_7 hbase_2_4 hbase_3_0;
-  hbase1 = hbase_1_7;
-  hbase2 = hbase_2_4;
+  inherit (callPackage ../servers/hbase {}) hbase_2_4 hbase_2_5 hbase_3_0;
+  hbase2 = hbase_2_5;
   hbase3 = hbase_3_0;
   hbase = hbase2; # when updating, point to the latest stable release
 
@@ -30828,7 +30836,7 @@ with pkgs;
 
   smplayer = libsForQt5.callPackage ../applications/video/smplayer { };
 
-  smtube = libsForQt514.callPackage ../applications/video/smtube {};
+  smtube = libsForQt5.callPackage ../applications/video/smtube {};
 
   softmaker-office = callPackage ../applications/office/softmaker/softmaker_office.nix {};
 
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 44b34cf2071f..fd1f7cb50bf9 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -77,6 +77,7 @@ mapAliases ({
   face_recognition_models = face-recognition-models; # added 2022-10-15
   fake_factory = throw "fake_factory has been removed because it is unused and deprecated by upstream since 2016."; # added 2022-05-30
   faulthandler = throw "faulthandler is built into ${python.executable}"; # added 2021-07-12
+  filemagic = throw "inactive since 2014, so use python-magic instead"; # added 2022-11-19
   flask_login = flask-login; # added 2022-10-17
   flask_sqlalchemy = flask-sqlalchemy; # added 2022-07-20
   flask_testing = flask-testing; # added 2022-04-25
@@ -179,7 +180,7 @@ mapAliases ({
   qasm2image = throw "qasm2image is no longer maintained (since November 2018), and is not compatible with the latest pythonPackages.qiskit versions."; # added 2020-12-09
   qiskit-aqua = throw "qiskit-aqua has been removed due to deprecation, with its functionality moved to different qiskit packages";
   rdflib-jsonld = throw "rdflib-jsonld is not compatible with rdflib 6"; # added 2021-11-05
-  repeated_test = throw "repeated_test is no longer maintained"; # added 2022-01-11
+  repeated_test = repeated-test; # added 2022-11-15
   requests_oauthlib = requests-oauthlib; # added 2022-02-12
   requests_toolbelt = requests-toolbelt; # added 2017-09-26
   roboschool = throw "roboschool is deprecated in favor of PyBullet and has been removed"; # added 2022-01-15
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 6af64e445511..a52782b78aeb 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1580,8 +1580,6 @@ self: super: with self; {
 
   coqpit = callPackage ../development/python-modules/coqpit { };
 
-  coqui-trainer = callPackage ../development/python-modules/coqui-trainer {};
-
   cepa = callPackage ../development/python-modules/cepa { };
 
   cerberus = callPackage ../development/python-modules/cerberus { };
@@ -3230,8 +3228,6 @@ self: super: with self; {
 
   filelock = callPackage ../development/python-modules/filelock { };
 
-  filemagic = callPackage ../development/python-modules/filemagic { };
-
   filetype = callPackage ../development/python-modules/filetype { };
 
   filterpy = callPackage ../development/python-modules/filterpy { };
@@ -3564,6 +3560,8 @@ self: super: with self; {
 
   fx2 = callPackage ../development/python-modules/fx2 { };
 
+  g2pkk = callPackage ../development/python-modules/g2pkk { };
+
   galario = toPythonModule (pkgs.galario.override {
     enablePython = true;
     pythonPackages = self;
@@ -4655,6 +4653,8 @@ self: super: with self; {
 
   jaeger-client = callPackage ../development/python-modules/jaeger-client { };
 
+  jamo = callPackage ../development/python-modules/jamo { };
+
   janus = callPackage ../development/python-modules/janus { };
 
   jaraco_classes = callPackage ../development/python-modules/jaraco_classes { };
@@ -6969,6 +6969,8 @@ self: super: with self; {
 
   ppdeep = callPackage ../development/python-modules/ppdeep { };
 
+  prodict = callPackage ../development/python-modules/prodict { };
+
   proxy_tools = callPackage ../development/python-modules/proxy_tools { };
 
   py-nextbusnext = callPackage ../development/python-modules/py-nextbusnext { };
@@ -7143,6 +7145,8 @@ self: super: with self; {
 
   plone-testing = callPackage ../development/python-modules/plone-testing { };
 
+  plotext = callPackage ../development/python-modules/plotext { };
+
   plotly = callPackage ../development/python-modules/plotly { };
 
   plotnine = callPackage ../development/python-modules/plotnine { };
@@ -9650,6 +9654,8 @@ self: super: with self; {
 
   reparser = callPackage ../development/python-modules/reparser { };
 
+  repeated-test = callPackage ../development/python-modules/repeated-test { };
+
   repocheck = callPackage ../development/python-modules/repocheck { };
 
   reportengine = callPackage ../development/python-modules/reportengine { };
@@ -11250,6 +11256,8 @@ self: super: with self; {
 
   trackpy = callPackage ../development/python-modules/trackpy { };
 
+  trainer = callPackage ../development/python-modules/trainer {};
+
   traitlets = callPackage ../development/python-modules/traitlets { };
 
   traits = callPackage ../development/python-modules/traits { };