diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index eec282cfc90b..87639fc55d48 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -683,6 +683,13 @@
     githubId = 2626481;
     name = "Ambroz Bizjak";
   };
+  amesgen = {
+    email = "amesgen@amesgen.de";
+    github = "amesgen";
+    githubId = 15369874;
+    name = "Alexander Esgen";
+    matrix = "@amesgen:amesgen.de";
+  };
   ametrine = {
     name = "Matilde Ametrine";
     email = "matilde@diffyq.xyz";
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
index db5d2d44e1b0..5d09d3a93aae 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
@@ -406,6 +406,12 @@
           application tries to talk to the libsecret D-Bus API.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          There is a new module for AMD SEV CPU functionality, which
+          grants access to the hardware.
+        </para>
+      </listitem>
       <listitem>
         <para>
           There is a new module for the <literal>thunar</literal>
diff --git a/nixos/doc/manual/release-notes/rl-2211.section.md b/nixos/doc/manual/release-notes/rl-2211.section.md
index 37d53841b76b..f37d7d827bd9 100644
--- a/nixos/doc/manual/release-notes/rl-2211.section.md
+++ b/nixos/doc/manual/release-notes/rl-2211.section.md
@@ -149,6 +149,8 @@ Use `configure.packages` instead.
 
 - The `pass-secret-service` package now includes systemd units from upstream, so adding it to the NixOS `services.dbus.packages` option will make it start automatically as a systemd user service when an application tries to talk to the libsecret D-Bus API.
 
+- There is a new module for AMD SEV CPU functionality, which grants access to the hardware.
+
 - There is a new module for the `thunar` program (the Xfce file manager), which depends on the `xfconf` dbus service, and also has a dbus service and a systemd unit. The option `services.xserver.desktopManager.xfce.thunarPlugins` has been renamed to `programs.thunar.plugins`, and in a future release it may be removed.
 
 - There is a new module for the `xfconf` program (the Xfce configuration storage system), which has a dbus service.
diff --git a/nixos/modules/hardware/cpu/amd-sev.nix b/nixos/modules/hardware/cpu/amd-sev.nix
new file mode 100644
index 000000000000..32fed2c484d4
--- /dev/null
+++ b/nixos/modules/hardware/cpu/amd-sev.nix
@@ -0,0 +1,51 @@
+{ config, lib, ... }:
+with lib;
+let
+  cfg = config.hardware.cpu.amd.sev;
+  defaultGroup = "sev";
+in
+  with lib; {
+    options.hardware.cpu.amd.sev = {
+      enable = mkEnableOption "access to the AMD SEV device";
+      user = mkOption {
+        description = "Owner to assign to the SEV device.";
+        type = types.str;
+        default = "root";
+      };
+      group = mkOption {
+        description = "Group to assign to the SEV device.";
+        type = types.str;
+        default = defaultGroup;
+      };
+      mode = mkOption {
+        description = "Mode to set for the SEV device.";
+        type = types.str;
+        default = "0660";
+      };
+    };
+
+    config = mkIf cfg.enable {
+      assertions = [
+        {
+          assertion = hasAttr cfg.user config.users.users;
+          message = "Given user does not exist";
+        }
+        {
+          assertion = (cfg.group == defaultGroup) || (hasAttr cfg.group config.users.groups);
+          message = "Given group does not exist";
+        }
+      ];
+
+      boot.extraModprobeConfig = ''
+        options kvm_amd sev=1
+      '';
+
+      users.groups = optionalAttrs (cfg.group == defaultGroup) {
+        "${cfg.group}" = {};
+      };
+
+      services.udev.extraRules = with cfg; ''
+        KERNEL=="sev", OWNER="${user}", GROUP="${group}", MODE="${mode}"
+      '';
+    };
+  }
diff --git a/pkgs/applications/networking/cluster/terraform/default.nix b/pkgs/applications/networking/cluster/terraform/default.nix
index 239296c5b3e5..495fd38b63d5 100644
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@@ -169,8 +169,8 @@ rec {
   mkTerraform = attrs: pluggable (generic attrs);
 
   terraform_1 = mkTerraform {
-    version = "1.2.6";
-    sha256 = "sha256-IUm08/zoL6Tw36vQrCl+kvQ6q8qArBh8LvbFf2QPn7M=";
+    version = "1.2.7";
+    sha256 = "sha256-0AGONBurlm0cSM4HyAmUxLt8GdnqNPh146A8ibyfe+k=";
     vendorSha256 = "sha256-Whe1prBGsE0q0QdNkzAKwvAP7EVlnD/985gjngh+VI4=";
     patches = [ ./provider-path-0_15.patch ];
     passthru = {
diff --git a/pkgs/applications/office/paperless-ngx/default.nix b/pkgs/applications/office/paperless-ngx/default.nix
index 75bc494d3a87..679a732c2d67 100644
--- a/pkgs/applications/office/paperless-ngx/default.nix
+++ b/pkgs/applications/office/paperless-ngx/default.nix
@@ -11,6 +11,7 @@
 , tesseract4
 , unpaper
 , liberation_ttf
+, fetchFromGitHub
 }:
 
 let
@@ -19,6 +20,20 @@ let
     packageOverrides = self: super: {
       django = super.django_4;
 
+      # use paperless-ngx version of django-q
+      # see https://github.com/paperless-ngx/paperless-ngx/pull/1014
+      django-q = super.django-q.overridePythonAttrs (oldAttrs: rec {
+        src = fetchFromGitHub {
+          owner = "paperless-ngx";
+          repo = "django-q";
+          sha256 = "sha256-aoDuPig8Nf8fLzn7GjBn69aF2zH2l8gxascAu9lIG3U=";
+          rev = "71abc78fdaec029cf71e9849a3b0fa084a1678f7";
+        };
+        # due to paperless-ngx modification of the pyproject.toml file
+        # the patch is not needed any more
+        patches = [];
+      });
+
       # django-extensions 3.1.5 is required, but its tests are incompatible with Django 4
       django-extensions = super.django-extensions.overridePythonAttrs (_: {
         doCheck = false;
@@ -38,12 +53,12 @@ let
 in
 py.pkgs.pythonPackages.buildPythonApplication rec {
   pname = "paperless-ngx";
-  version = "1.7.1";
+  version = "1.8.0";
 
   # Fetch the release tarball instead of a git ref because it contains the prebuilt fontend
   src = fetchurl {
     url = "https://github.com/paperless-ngx/paperless-ngx/releases/download/v${version}/${pname}-v${version}.tar.xz";
-    hash = "sha256-8vx4hvbIqaChjPyS8Q0ar2bz/pLzEdxoF7P2gBEeFzc=";
+    hash = "sha256-BLfhh04RvBJFRQiPXkMl8XlWqZOWKmjjl+6lZ326stU=";
   };
 
   format = "other";
@@ -144,6 +159,13 @@ py.pkgs.pythonPackages.buildPythonApplication rec {
     zope_interface
   ];
 
+  # paperless-ngx includes the bundled django-q version. This will
+  # conflict with the tests and is not needed since we overrode the
+  # django-q version with the paperless-ngx version
+  postPatch = ''
+    rm -rf src/django-q
+  '';
+
   # Compile manually because `pythonRecompileBytecodeHook` only works for
   # files in `python.sitePackages`
   postBuild = ''
diff --git a/pkgs/applications/version-management/git-and-tools/gh/default.nix b/pkgs/applications/version-management/git-and-tools/gh/default.nix
index e7e756a243c7..9b1284c6e06f 100644
--- a/pkgs/applications/version-management/git-and-tools/gh/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/gh/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "gh";
-  version = "2.14.3";
+  version = "2.14.4";
 
   src = fetchFromGitHub {
     owner = "cli";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-03XB88Z3v0a9Wi1xF+TaVsiRml6JAdEOeKuMxAbybw4=";
+    sha256 = "sha256-vg91YnwtbD2j6zue5g5j+iyHRDrW83GQKEi/n9nDHBw=";
   };
 
-  vendorSha256 = "sha256-HCOSc6GevbvNuC1zgzaCSfewF13SY1sBV+grsSF1+Fk=";
+  vendorSha256 = "sha256-xyrz+oN9DLDh4jSVFM5gVZFJW+yJKrhYOtQs38URAjM=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/data/themes/arc-kde/default.nix b/pkgs/data/themes/arc-kde/default.nix
index de863524aa2e..267e1b8b8b5d 100644
--- a/pkgs/data/themes/arc-kde/default.nix
+++ b/pkgs/data/themes/arc-kde/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "arc-kde-theme";
-  version = "20220706";
+  version = "20220810";
 
   src = fetchFromGitHub {
     owner = "PapirusDevelopmentTeam";
     repo = "arc-kde";
     rev = version;
-    sha256 = "sha256-k/+VhqvOg3wkqal7q7nSVpubK/yHnNoTUUWhnxwcIjM=";
+    sha256 = "sha256-atL0sW3AedQl7PabOQOjeJ5U8a4/J4x0rxFCbxJ4ONA=";
   };
 
   makeFlags = [ "PREFIX=$(out)" ];
diff --git a/pkgs/development/compilers/openjdk/17.nix b/pkgs/development/compilers/openjdk/17.nix
index 45acc7f1ce98..1bd6431961b8 100644
--- a/pkgs/development/compilers/openjdk/17.nix
+++ b/pkgs/development/compilers/openjdk/17.nix
@@ -41,6 +41,7 @@ let
       ./currency-date-range-jdk10.patch
       ./increase-javadoc-heap-jdk13.patch
       ./ignore-LegalNoticeFilePlugin.patch
+      ./fix-library-path-jdk17.patch
 
       # -Wformat etc. are stricter in newer gccs, per
       # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=79677
diff --git a/pkgs/development/compilers/openjdk/fix-library-path-jdk17.patch b/pkgs/development/compilers/openjdk/fix-library-path-jdk17.patch
new file mode 100644
index 000000000000..4c38aca2b48a
--- /dev/null
+++ b/pkgs/development/compilers/openjdk/fix-library-path-jdk17.patch
@@ -0,0 +1,60 @@
+--- a/src/hotspot/os/linux/os_linux.cpp
++++ b/src/hotspot/os/linux/os_linux.cpp
+@@ -412,18 +412,8 @@ void os::init_system_properties_values() {
+   //        1: ...
+   //        ...
+   //        7: The default directories, normally /lib and /usr/lib.
+-#ifndef OVERRIDE_LIBPATH
+-  #if defined(_LP64)
+-    #define DEFAULT_LIBPATH "/usr/lib64:/lib64:/lib:/usr/lib"
+-  #else
+-    #define DEFAULT_LIBPATH "/lib:/usr/lib"
+-  #endif
+-#else
+-  #define DEFAULT_LIBPATH OVERRIDE_LIBPATH
+-#endif
+ 
+ // Base path of extensions installed on the system.
+-#define SYS_EXT_DIR     "/usr/java/packages"
+ #define EXTENSIONS_DIR  "/lib/ext"
+ 
+   // Buffer that fits several sprintfs.
+@@ -431,7 +421,7 @@ void os::init_system_properties_values() {
+   // by the nulls included by the sizeof operator.
+   const size_t bufsize =
+     MAX2((size_t)MAXPATHLEN,  // For dll_dir & friends.
+-         (size_t)MAXPATHLEN + sizeof(EXTENSIONS_DIR) + sizeof(SYS_EXT_DIR) + sizeof(EXTENSIONS_DIR)); // extensions dir
++         (size_t)MAXPATHLEN + sizeof(EXTENSIONS_DIR) + sizeof(EXTENSIONS_DIR)); // extensions dir
+   char *buf = NEW_C_HEAP_ARRAY(char, bufsize, mtInternal);
+ 
+   // sysclasspath, java_home, dll_dir
+@@ -478,26 +468,22 @@ void os::init_system_properties_values() {
+     // should always exist (until the legacy problem cited above is
+     // addressed).
+     const char *v = ::getenv("LD_LIBRARY_PATH");
+-    const char *v_colon = ":";
+-    if (v == NULL) { v = ""; v_colon = ""; }
++    if (v == NULL) { v = ""; }
+     // That's +1 for the colon and +1 for the trailing '\0'.
+     char *ld_library_path = NEW_C_HEAP_ARRAY(char,
+-                                             strlen(v) + 1 +
+-                                             sizeof(SYS_EXT_DIR) + sizeof("/lib/") + sizeof(DEFAULT_LIBPATH) + 1,
++                                             strlen(v) + 1,
+                                              mtInternal);
+-    sprintf(ld_library_path, "%s%s" SYS_EXT_DIR "/lib:" DEFAULT_LIBPATH, v, v_colon);
++    sprintf(ld_library_path, "%s", v);
+     Arguments::set_library_path(ld_library_path);
+     FREE_C_HEAP_ARRAY(char, ld_library_path);
+   }
+ 
+   // Extensions directories.
+-  sprintf(buf, "%s" EXTENSIONS_DIR ":" SYS_EXT_DIR EXTENSIONS_DIR, Arguments::get_java_home());
++  sprintf(buf, "%s" EXTENSIONS_DIR, Arguments::get_java_home());
+   Arguments::set_ext_dirs(buf);
+ 
+   FREE_C_HEAP_ARRAY(char, buf);
+ 
+-#undef DEFAULT_LIBPATH
+-#undef SYS_EXT_DIR
+ #undef EXTENSIONS_DIR
+ }
\ No newline at end of file
diff --git a/pkgs/development/interpreters/nickel/default.nix b/pkgs/development/interpreters/nickel/default.nix
index ccf34377de42..01b7fd54106c 100644
--- a/pkgs/development/interpreters/nickel/default.nix
+++ b/pkgs/development/interpreters/nickel/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nickel";
-  version = "0.2.0";
+  version = "0.2.1";
 
   src  = fetchFromGitHub {
     owner = "tweag";
     repo = pname;
     rev = "refs/tags/${version}"; # because pure ${version} doesn't work
-    hash = "sha256-Bh83qn+ECZnlCH/A34G5G5MdcAHPow24RMCVQXR5Awg=";
+    hash = "sha256-Sf0UJAfUtP7oU31VkVqCtdRmfjaHV34gYeUPNsTmQvo=";
   };
 
-  cargoSha256 = "sha256-vI+SaVyRJjLNqenUsYtaSTyOZRT0zZJ1OZHekcb5LjY=";
+  cargoSha256 = "sha256-oY4PYMZBN5+nsARHV+A5D7a6fUt9UMHBn83ONgaQp8E=";
 
   meta = with lib; {
     homepage = "https://nickel-lang.org/";
diff --git a/pkgs/development/interpreters/spidermonkey/102.nix b/pkgs/development/interpreters/spidermonkey/102.nix
new file mode 100644
index 000000000000..ef89d1ca0a27
--- /dev/null
+++ b/pkgs/development/interpreters/spidermonkey/102.nix
@@ -0,0 +1,4 @@
+import ./common.nix {
+  version = "102.1.0";
+  hash = "sha512-JQW4fOQRVEVWjra32K9BZ4vXh/0H8/eenwoi2QzfdSrl1DcYVs+cVuLZ2n1bfDk53CqrV1P8wBc5jn1lJg9vAw==";
+}
diff --git a/pkgs/development/interpreters/spidermonkey/78.nix b/pkgs/development/interpreters/spidermonkey/78.nix
index 0ce007057a23..05124a417fef 100644
--- a/pkgs/development/interpreters/spidermonkey/78.nix
+++ b/pkgs/development/interpreters/spidermonkey/78.nix
@@ -1,139 +1,4 @@
-{ lib, stdenv
-, fetchurl
-, fetchpatch
-, autoconf213
-, pkg-config
-, perl
-, python39
-, zip
-, buildPackages
-, which
-, readline
-, zlib
-, icu67
-, cargo
-, rustc
-, rust-cbindgen
-, yasm
-, nspr
-}:
-
-stdenv.mkDerivation rec {
-  pname = "spidermonkey";
+import ./common.nix {
   version = "78.15.0";
-
-  src = fetchurl {
-    url = "mirror://mozilla/firefox/releases/${version}esr/source/firefox-${version}esr.source.tar.xz";
-    sha256 = "0l91cxdc5v9fps79ckb1kid4gw6v5qng1jd9zvaacwaiv628shx4";
-  };
-
-  patches = [
-    # Fix build failure on armv7l using Debian patch
-    # Upstream bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1526653
-    (fetchpatch {
-      url = "https://salsa.debian.org/mozilla-team/firefox/commit/fd6847c9416f9eebde636e21d794d25d1be8791d.patch";
-      sha256 = "02b7zwm6vxmk61aj79a6m32s1k5sr0hwm3q1j4v6np9jfyd10g1j";
-    })
-
-    # Remove this when updating to 79 - The patches are already applied upstream
-    # https://bugzilla.mozilla.org/show_bug.cgi?id=1318905
-
-    # Combination of 3 changesets, modified to apply on 78:
-    # - https://hg.mozilla.org/mozilla-central/rev/06d7e1b6b7e7
-    # - https://hg.mozilla.org/mozilla-central/rev/ec48f15d085c
-    # - https://hg.mozilla.org/mozilla-central/rev/6803dda74d33
-    ./add-riscv64-support.patch
-  ];
-
-  outputs = [ "out" "dev" ];
-  setOutputFlags = false; # Configure script only understands --includedir
-
-  nativeBuildInputs = [
-    autoconf213
-    cargo
-    rustc.llvmPackages.llvm # for llvm-objdump
-    perl
-    pkg-config
-    python39
-    rust-cbindgen
-    rustc
-    which
-    yasm # to buid icu? seems weird
-    zip
-  ];
-
-  buildInputs = [
-    icu67
-    nspr
-    readline
-    zlib
-  ];
-
-  preConfigure = ''
-    export CXXFLAGS="-fpermissive"
-    export LIBXUL_DIST=$out
-    export PYTHON="${buildPackages.python3.interpreter}"
-
-    # We can't build in js/src/, so create a build dir
-    mkdir obj
-    cd obj/
-    configureScript=../js/src/configure
-  '';
-
-  configureFlags = [
-    "--with-system-zlib"
-    "--with-system-nspr"
-    "--with-system-icu"
-    "--with-intl-api"
-    "--enable-readline"
-    "--enable-shared-js"
-    "--disable-jemalloc"
-    # Fedora and Arch disable optimize, but it doesn't seme to be necessary
-    # It turns on -O3 which some gcc version had a problem with:
-    # https://src.fedoraproject.org/rpms/mozjs38/c/761399aba092bcb1299bb4fccfd60f370ab4216e
-    "--enable-optimize"
-    "--enable-release"
-  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
-    # Spidermonkey seems to use different host/build terminology for cross
-    # compilation here.
-    "--host=${stdenv.buildPlatform.config}"
-    "--target=${stdenv.hostPlatform.config}"
-  ];
-
-  # mkDerivation by default appends --build/--host to configureFlags when cross compiling
-  # These defaults are bogus for Spidermonkey - avoid passing them by providing an empty list
-  configurePlatforms = [ ];
-
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
-
-  # cc-rs insists on using -mabi=lp64 (soft-float) for riscv64,
-  # while we have a double-float toolchain
-  NIX_CFLAGS_COMPILE = lib.optionalString (with stdenv.hostPlatform; isRiscV && is64bit) "-mabi=lp64d";
-
-  # Remove unnecessary static lib
-  preFixup = ''
-    moveToOutput bin/js78-config "$dev"
-    rm $out/lib/libjs_static.ajs
-    ln -s $out/bin/js78 $out/bin/js
-  '';
-
-  enableParallelBuilding = true;
-
-  postPatch = ''
-    # This patch is a manually applied fix of
-    #   https://bugzilla.mozilla.org/show_bug.cgi?id=1644600
-    # Once that bug is fixed, this can be removed.
-    # This is needed in, for example, `zeroad`.
-    substituteInPlace js/public/StructuredClone.h \
-         --replace "class SharedArrayRawBufferRefs {" \
-                   "class JS_PUBLIC_API SharedArrayRawBufferRefs {"
-  '';
-
-  meta = with lib; {
-    description = "Mozilla's JavaScript engine written in C/C++";
-    homepage = "https://spidermonkey.dev/";
-    license = licenses.gpl2; # TODO: MPL/GPL/LGPL tri-license.
-    maintainers = with maintainers; [ abbradar lostnet ];
-    platforms = platforms.linux;
-  };
+  hash = "sha512-rD3nNbJGzk8OFhnNJmQyH/o3QkDOaEPnhdeaNQ3DDJZ5lrvMXjswHLPYIsqYHL6hFnWPxBIvFzjXXd/RFltjeA===";
 }
diff --git a/pkgs/development/interpreters/spidermonkey/91.nix b/pkgs/development/interpreters/spidermonkey/91.nix
index f763de4e649d..ca771fa75fd6 100644
--- a/pkgs/development/interpreters/spidermonkey/91.nix
+++ b/pkgs/development/interpreters/spidermonkey/91.nix
@@ -1,125 +1,4 @@
-{ lib
-, stdenv
-, fetchurl
-
-# build time
-, buildPackages
-, cargo
-, m4
-, perl
-, pkg-config
-, python3
-, rust-cbindgen
-, rustc
-, which
-, zip
-
-# runtime
-, icu
-, nspr
-, readline
-, zlib
-}:
-
-stdenv.mkDerivation rec {
-  pname = "spidermonkey";
+import ./common.nix {
   version = "91.12.0";
-
-  src = fetchurl {
-    url = "mirror://mozilla/firefox/releases/${version}esr/source/firefox-${version}esr.source.tar.xz";
-    sha512 = "323fb752488b45872b40f0b0ee1d8c1dffa16874dbff2afde19a54286c824ef48177233e029faeafa5946184e71c31c6bc5ba7ec17a571e21af64fc5f7334042";
-  };
-
-  outputs = [ "out" "dev" ];
-  setOutputFlags = false; # Configure script only understands --includedir
-
-  nativeBuildInputs = [
-    cargo
-    m4
-    perl
-    pkg-config
-    python3
-    rust-cbindgen
-    rustc
-    rustc.llvmPackages.llvm # for llvm-objdump
-    which
-    zip
-  ];
-
-  buildInputs = [
-    icu
-    nspr
-    readline
-    zlib
-  ];
-
-  preConfigure = ''
-    export LIBXUL_DIST=$out
-    export PYTHON="${buildPackages.python3.interpreter}"
-    export M4=m4
-    export AWK=awk
-    export AC_MACRODIR=$PWD/build/autoconf/
-
-    pushd js/src
-    sh ../../build/autoconf/autoconf.sh --localdir=$PWD configure.in > configure
-    chmod +x configure
-    popd
-    # We can't build in js/src/, so create a build dir
-    mkdir obj
-    cd obj/
-    configureScript=../js/src/configure
-  '';
-
-  configureFlags = [
-    "--with-intl-api"
-    "--with-system-icu"
-    "--with-system-nspr"
-    "--with-system-zlib"
-    "--enable-optimize"
-    "--enable-readline"
-    "--enable-release"
-    "--enable-shared-js"
-    "--disable-debug"
-    "--disable-jemalloc"
-    "--disable-strip"
-    "--disable-tests"
-  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
-    # Spidermonkey seems to use different host/build terminology for cross
-    # compilation here.
-    "--host=${stdenv.buildPlatform.config}"
-    "--target=${stdenv.hostPlatform.config}"
-  ];
-
-  # mkDerivation by default appends --build/--host to configureFlags when cross compiling
-  # These defaults are bogus for Spidermonkey - avoid passing them by providing an empty list
-  configurePlatforms = [ ];
-
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
-
-  # Remove unnecessary static lib
-  preFixup = ''
-    moveToOutput bin/js91-config "$dev"
-    rm $out/lib/libjs_static.ajs
-    ln -s $out/bin/js91 $out/bin/js
-  '';
-
-  enableParallelBuilding = true;
-
-  postPatch = ''
-    # This patch is a manually applied fix of
-    #   https://bugzilla.mozilla.org/show_bug.cgi?id=1644600
-    # Once that bug is fixed, this can be removed.
-    # This is needed in, for example, `zeroad`.
-    substituteInPlace js/public/StructuredClone.h \
-         --replace "class SharedArrayRawBufferRefs {" \
-                   "class JS_PUBLIC_API SharedArrayRawBufferRefs {"
-  '';
-
-  meta = with lib; {
-    description = "Mozilla's JavaScript engine written in C/C++";
-    homepage = "https://spidermonkey.dev/";
-    license = licenses.mpl20;
-    maintainers = with maintainers; [ lostnet ];
-    platforms = platforms.linux;
-  };
+  hash = "sha512-Mj+3UkiLRYcrQPCw7h2MHf+haHTb/yr94ZpUKGyCTvSBdyM+Ap+ur6WUYYTnHDHGvFun7BelceIa9k/F9zNAQg==";
 }
diff --git a/pkgs/development/interpreters/spidermonkey/allow-system-s-nspr-and-icu-on-bootstrapped-sysroot.patch b/pkgs/development/interpreters/spidermonkey/allow-system-s-nspr-and-icu-on-bootstrapped-sysroot.patch
new file mode 100644
index 000000000000..29966d90864d
--- /dev/null
+++ b/pkgs/development/interpreters/spidermonkey/allow-system-s-nspr-and-icu-on-bootstrapped-sysroot.patch
@@ -0,0 +1,40 @@
+From a26bb162d9403138d64b84e8fa4f0471084c45b2 Mon Sep 17 00:00:00 2001
+From: "Kirill A. Korinsky" <kirill@korins.ky>
+Date: Fri, 8 Jul 2022 21:21:25 +0200
+Subject: [PATCH] Allow system's nspr and icu on bootstrapped sysroot
+
+This patch partially reverts https://github.com/mozilla/gecko-dev/commit/9aa3587bbf0416dd2eb5b614f7b301c71c64286b
+---
+ build/moz.configure/nspr.configure | 2 +-
+ js/moz.configure                   | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/build/moz.configure/nspr.configure b/build/moz.configure/nspr.configure
+index 06f03d9bc72d..9687c84a7290 100644
+--- a/build/moz.configure/nspr.configure
++++ b/build/moz.configure/nspr.configure
+@@ -19,7 +19,7 @@ def enable_nspr_build(enable):
+         return enable
+ 
+ 
+-system_lib_option("--with-system-nspr", help="Use system NSPR")
++option("--with-system-nspr", help="Use system NSPR")
+ 
+ 
+ @depends(enable_nspr_build, "--with-system-nspr", js_standalone)
+diff --git a/js/moz.configure b/js/moz.configure
+index b7ba9790425d..5ff5cb2da266 100644
+--- a/js/moz.configure
++++ b/js/moz.configure
+@@ -1129,7 +1129,7 @@ set_define(
+ 
+ # ECMAScript Internationalization API Support (uses ICU)
+ # ======================================================
+-system_lib_option("--with-system-icu", help="Use system ICU")
++option("--with-system-icu", help="Use system ICU")
+ 
+ system_icu = pkg_check_modules("MOZ_ICU", "icu-i18n >= 71.1", when="--with-system-icu")
+ 
+-- 
+2.37.0
+
diff --git a/pkgs/development/interpreters/spidermonkey/always-check-for-pkg-config.patch b/pkgs/development/interpreters/spidermonkey/always-check-for-pkg-config.patch
new file mode 100644
index 000000000000..c6e43b60aa59
--- /dev/null
+++ b/pkgs/development/interpreters/spidermonkey/always-check-for-pkg-config.patch
@@ -0,0 +1,23 @@
+From 9d3f6e9ff5e66af90a5d187d902f7893fb91c24b Mon Sep 17 00:00:00 2001
+From: "Kirill A. Korinsky" <kirill@korins.ky>
+Date: Fri, 1 Jul 2022 12:23:37 +0200
+Subject: [PATCH] Always check for pkg-config
+
+---
+ build/moz.configure/pkg.configure | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/build/moz.configure/pkg.configure b/build/moz.configure/pkg.configure
+index 6b460ae174eed..0056ecd7ae2d8 100644
+--- a/build/moz.configure/pkg.configure
++++ b/build/moz.configure/pkg.configure
+@@ -15,8 +15,7 @@ pkg_config = check_prog(
+     pkg_config,
+     bootstrap=depends(when=target_sysroot.bootstrapped)(lambda: "pkgconf"),
+     allow_missing=True,
+-    when=compile_environment
+-    & depends(target.os)(lambda os: os not in ("WINNT", "OSX", "Android")),
++    when=compile_environment,
+ )
+ 
+ 
diff --git a/pkgs/development/interpreters/spidermonkey/common.nix b/pkgs/development/interpreters/spidermonkey/common.nix
new file mode 100644
index 000000000000..8e2b1234fdbc
--- /dev/null
+++ b/pkgs/development/interpreters/spidermonkey/common.nix
@@ -0,0 +1,199 @@
+{ version, hash }:
+
+{ callPackage
+, lib
+, stdenv
+, fetchurl
+, fetchpatch
+
+# build time
+, buildPackages
+, cargo
+, m4
+, perl
+, pkg-config
+, python3
+, python39
+, rustc
+, which
+, zip
+, autoconf213
+, yasm
+, xcbuild
+
+# runtime
+, icu
+, icu67
+, nspr
+, readline
+, zlib
+, libobjc
+, libiconv
+}:
+
+stdenv.mkDerivation (finalAttrs: rec {
+  pname = "spidermonkey";
+  inherit version;
+
+  outputs = [ "out" "dev" ];
+
+  src = fetchurl {
+    url = "mirror://mozilla/firefox/releases/${version}esr/source/firefox-${version}esr.source.tar.xz";
+    inherit hash;
+  };
+
+  patches = lib.optional (lib.versionOlder version "91") [
+    # Fix build failure on armv7l using Debian patch
+    # Upstream bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1526653
+    (fetchpatch {
+      url = "https://salsa.debian.org/mozilla-team/firefox/commit/fd6847c9416f9eebde636e21d794d25d1be8791d.patch";
+      hash = "sha512-K8U3Qyo7g4si2r/8kJdXyRoTrDHAY48x/YJ7YL+YBwlpfNQcHxX+EZvhRzW8FHYW+f7kOnJu9QykhE8PhSQ9zQ==";
+    })
+
+    # Remove this when updating to 79 - The patches are already applied upstream
+    # https://bugzilla.mozilla.org/show_bug.cgi?id=1318905
+
+    # Combination of 3 changesets, modified to apply on 78:
+    # - https://hg.mozilla.org/mozilla-central/rev/06d7e1b6b7e7
+    # - https://hg.mozilla.org/mozilla-central/rev/ec48f15d085c
+    # - https://hg.mozilla.org/mozilla-central/rev/6803dda74d33
+    ./add-riscv64-support.patch
+  ] ++ lib.optionals (lib.versionAtLeast version "102") [
+    # use pkg-config at all systems
+    ./always-check-for-pkg-config.patch
+    ./allow-system-s-nspr-and-icu-on-bootstrapped-sysroot.patch
+
+    # Patches required by GJS
+    # https://discourse.gnome.org/t/gnome-43-to-depend-on-spidermonkey-102/10658
+    # Install ProfilingCategoryList.h
+    (fetchpatch {
+      url = "https://hg.mozilla.org/releases/mozilla-esr102/raw-rev/33147b91e42b79f4c6dd3ec11cce96746018407a";
+      sha256 = "sha256-xJFJZMYJ6P11HQDZbr48GFgybpAeVcu3oLIFEyyMjBI=";
+    })
+    # Fix embeder build
+    (fetchpatch {
+      url = "https://hg.mozilla.org/releases/mozilla-esr102/raw-rev/1fa20fb474f5d149cc32d98df169dee5e6e6861b";
+      sha256 = "sha256-eCisKjNxy9SLr9KoEE2UB26BflUknnR7PIvnpezsZeA=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    cargo
+    m4
+    perl
+    pkg-config
+    # 78 requires python up to 3.9
+    (if lib.versionOlder version "91" then python39 else python3)
+    rustc
+    rustc.llvmPackages.llvm # for llvm-objdump
+    which
+    zip
+  ] ++ lib.optionals (lib.versionOlder version "91") [
+    autoconf213
+    yasm # to buid icu? seems weird
+  ] ++ lib.optionals stdenv.isDarwin [
+    xcbuild
+  ];
+
+  buildInputs = [
+    (if lib.versionOlder version "91" then icu67 else icu)
+    nspr
+    readline
+    zlib
+  ] ++ lib.optionals stdenv.isDarwin [
+    libobjc
+    libiconv
+  ];
+
+  depsBuildBuild = [
+    buildPackages.stdenv.cc
+  ];
+
+  setOutputFlags = false; # Configure script only understands --includedir
+
+  configureFlags = [
+    "--with-intl-api"
+    "--with-system-icu"
+    "--with-system-nspr"
+    "--with-system-zlib"
+    # Fedora and Arch disable optimize, but it doesn't seme to be necessary
+    # It turns on -O3 which some gcc version had a problem with:
+    # https://src.fedoraproject.org/rpms/mozjs38/c/761399aba092bcb1299bb4fccfd60f370ab4216e
+    "--enable-optimize"
+    "--enable-readline"
+    "--enable-release"
+    "--enable-shared-js"
+  ] ++ lib.optionals (lib.versionAtLeast version "91") [
+    "--disable-debug"
+  ] ++ [
+    "--disable-jemalloc"
+    "--disable-strip"
+    "--disable-tests"
+  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    # Spidermonkey seems to use different host/build terminology for cross
+    # compilation here.
+    "--host=${stdenv.buildPlatform.config}"
+    "--target=${stdenv.hostPlatform.config}"
+  ];
+
+  # mkDerivation by default appends --build/--host to configureFlags when cross compiling
+  # These defaults are bogus for Spidermonkey - avoid passing them by providing an empty list
+  configurePlatforms = [ ];
+
+  enableParallelBuilding = true;
+
+  # cc-rs insists on using -mabi=lp64 (soft-float) for riscv64,
+  # while we have a double-float toolchain
+  NIX_CFLAGS_COMPILE = lib.optionalString (with stdenv.hostPlatform; isRiscV && is64bit && lib.versionOlder version "91") "-mabi=lp64d";
+
+  postPatch = lib.optionalString (lib.versionOlder version "102") ''
+    # This patch is a manually applied fix of
+    #   https://bugzilla.mozilla.org/show_bug.cgi?id=1644600
+    # Once that bug is fixed, this can be removed.
+    # This is needed in, for example, `zeroad`.
+    substituteInPlace js/public/StructuredClone.h \
+         --replace "class SharedArrayRawBufferRefs {" \
+                   "class JS_PUBLIC_API SharedArrayRawBufferRefs {"
+  '';
+
+  preConfigure = lib.optionalString (lib.versionOlder version "91") ''
+    export CXXFLAGS="-fpermissive"
+  '' + ''
+    export LIBXUL_DIST=$out
+    export PYTHON="${buildPackages.python3.interpreter}"
+  '' + lib.optionalString (lib.versionAtLeast version "91") ''
+    export M4=m4
+    export AWK=awk
+    export AS=$CC
+    export AC_MACRODIR=$PWD/build/autoconf/
+
+    pushd js/src
+    sh ../../build/autoconf/autoconf.sh --localdir=$PWD configure.in > configure
+    chmod +x configure
+    popd
+  '' + ''
+    # We can't build in js/src/, so create a build dir
+    mkdir obj
+    cd obj/
+    configureScript=../js/src/configure
+  '';
+
+  # Remove unnecessary static lib
+  preFixup = ''
+    moveToOutput bin/js${lib.versions.major version}-config "$dev"
+    rm $out/lib/libjs_static.ajs
+    ln -s $out/bin/js${lib.versions.major version} $out/bin/js
+  '';
+
+  passthru.tests.run = callPackage ./test.nix {
+    spidermonkey = finalAttrs.finalPackage;
+  };
+
+  meta = with lib; {
+    description = "Mozilla's JavaScript engine written in C/C++";
+    homepage = "https://spidermonkey.dev/";
+    license = licenses.mpl20; # TODO: MPL/GPL/LGPL tri-license for 78.
+    maintainers = with maintainers; [ abbradar lostnet catap ];
+    platforms = platforms.unix;
+  };
+})
diff --git a/pkgs/development/interpreters/spidermonkey/test.nix b/pkgs/development/interpreters/spidermonkey/test.nix
new file mode 100644
index 000000000000..c3ef92bebfa8
--- /dev/null
+++ b/pkgs/development/interpreters/spidermonkey/test.nix
@@ -0,0 +1,10 @@
+{ runCommand, spidermonkey }:
+
+runCommand "spidermonkey-test-run" {
+  nativeBuildInputs = [
+    spidermonkey
+  ];
+} ''
+  diff -U3 --color=auto <(js <(echo "console.log('Hello, world\!')")) <(echo 'Hello, world!')
+  touch $out
+''
diff --git a/pkgs/development/libraries/gnutls/default.nix b/pkgs/development/libraries/gnutls/default.nix
index fe831b4b16e6..226b91b0ce54 100644
--- a/pkgs/development/libraries/gnutls/default.nix
+++ b/pkgs/development/libraries/gnutls/default.nix
@@ -124,7 +124,7 @@ stdenv.mkDerivation rec {
 
     homepage = "https://gnutls.org/";
     license = licenses.lgpl21Plus;
-    maintainers = with maintainers; [ eelco ];
+    maintainers = with maintainers; [ vcunat ];
     platforms = platforms.all;
   };
 }
diff --git a/pkgs/development/libraries/webkitgtk/default.nix b/pkgs/development/libraries/webkitgtk/default.nix
index 28dbfe796252..77cd8985c67a 100644
--- a/pkgs/development/libraries/webkitgtk/default.nix
+++ b/pkgs/development/libraries/webkitgtk/default.nix
@@ -67,7 +67,7 @@
 
 stdenv.mkDerivation rec {
   pname = "webkitgtk";
-  version = "2.36.5";
+  version = "2.36.6";
 
   outputs = [ "out" "dev" ];
 
@@ -75,7 +75,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://webkitgtk.org/releases/${pname}-${version}.tar.xz";
-    sha256 = "sha256-1VMvqITJQ9xI8ZEUc91mOrpAejs1yqewS6wUGbQeWQg=";
+    sha256 = "sha256-EZO8ghlGM2d28N+l4NylZR8eVxV+2hLaRyHSRB8kpho=";
   };
 
   patches = lib.optionals stdenv.isLinux [
diff --git a/pkgs/development/lua-modules/nfd/default.nix b/pkgs/development/lua-modules/nfd/default.nix
new file mode 100644
index 000000000000..6605202f6bd1
--- /dev/null
+++ b/pkgs/development/lua-modules/nfd/default.nix
@@ -0,0 +1,41 @@
+{ fetchFromGitHub, buildLuarocksPackage, lua, maintainers, pkg-config
+, substituteAll, zenity }:
+
+buildLuarocksPackage {
+  pname = "nfd";
+  version = "scm-1";
+
+  src = fetchFromGitHub {
+    owner = "Vexatos";
+    repo = "nativefiledialog";
+    rev = "2f74a5758e8df9b27158d444953697bc13fe90d8";
+    sha256 = "1f52mb0s9zrpsqjp10bx92wzqmy1lq7fg1fk1nd6xmv57kc3b1qv";
+    fetchSubmodules = true;
+  };
+
+  # use zenity because default gtk impl just crashes
+  patches = [
+    (substituteAll {
+      src = ./zenity.patch;
+      inherit zenity;
+    })
+  ];
+  rockspecDir = "lua";
+
+  extraVariables.LUA_LIBDIR = "${lua}/lib";
+  nativeBuildInputs = [ pkg-config ];
+
+  fixupPhase = ''
+    find $out -name nfd_zenity.so -execdir mv {} nfd.so \;
+  '';
+
+  disabled = with lua; (luaversion != "5.1");
+
+  meta = {
+    description =
+      "A tiny, neat lua library that portably invokes native file open and save dialogs.";
+    homepage = "https://github.com/Alloyed/nativefiledialog/tree/master/lua";
+    license.fullName = "zlib";
+    maintainers = [ maintainers.scoder12 ];
+  };
+}
diff --git a/pkgs/development/lua-modules/nfd/zenity.patch b/pkgs/development/lua-modules/nfd/zenity.patch
new file mode 100644
index 000000000000..59a91e0e546c
--- /dev/null
+++ b/pkgs/development/lua-modules/nfd/zenity.patch
@@ -0,0 +1,47 @@
+diff --git a/lua/Makefile.linux b/lua/Makefile.linux
+index 9f5aa68..77660d4 100644
+--- a/lua/Makefile.linux
++++ b/lua/Makefile.linux
+@@ -37,5 +37,5 @@ nfd_zenity.o: src/nfd_zenity.c
+ clean: 
+ 	rm nfd_common.o nfd_gtk.o nfd_wrap_lua.o nfd.so
+ 
+-install: nfd.so
+-	cp nfd.so $(INST_LIBDIR)
++install:
++	cp nfd*.so $(INST_LIBDIR)
+diff --git a/lua/nfd-scm-1.rockspec b/lua/nfd-scm-1.rockspec
+index 503399d..2d0a7da 100644
+--- a/lua/nfd-scm-1.rockspec
++++ b/lua/nfd-scm-1.rockspec
+@@ -17,9 +17,6 @@ supported_platforms = { "linux", "macosx", "windows" }
+ external_dependencies = {
+    platforms = {
+       linux = {
+-         gtk3 = {
+-            library = "gtk-3",
+-         }
+       }
+    }
+ }
+@@ -28,6 +25,7 @@ build = {
+       linux = {
+          type = "make",
+          makefile = "lua/Makefile.linux",
++         build_target = "nfd_zenity.so",
+          build_variables = {
+             CFLAGS="$(CFLAGS)",
+             LIBFLAG="$(LIBFLAG)",
+diff --git a/src/nfd_zenity.c b/src/nfd_zenity.c
+index 43ccc6d..3fcdea0 100644
+--- a/src/nfd_zenity.c
++++ b/src/nfd_zenity.c
+@@ -109,6 +109,8 @@ ZenityCommon(char**      command,
+         command[i] = tmp;
+     }
+ 
++    // caller always sets command[0] to "zenity"
++    command[0] = strdup("@zenity@/bin/zenity");
+     AddFiltersToCommandArgs(command, commandLen, filterList);
+ 
+     int byteCount = 0;
diff --git a/pkgs/development/python-modules/bluetooth-sensor-state-data/default.nix b/pkgs/development/python-modules/bluetooth-sensor-state-data/default.nix
new file mode 100644
index 000000000000..72edd0e6ca38
--- /dev/null
+++ b/pkgs/development/python-modules/bluetooth-sensor-state-data/default.nix
@@ -0,0 +1,53 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, home-assistant-bluetooth
+, poetry-core
+, pytestCheckHook
+, pythonOlder
+, sensor-state-data
+}:
+
+buildPythonPackage rec {
+  pname = "bluetooth-sensor-state-data";
+  version = "1.5.0";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.9";
+
+  src = fetchFromGitHub {
+    owner = "Bluetooth-Devices";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-Xr9MCTcEnO5bMk9AdBTwBCXwm33UUTP7FYZyjDYrMNA=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    home-assistant-bluetooth
+    sensor-state-data
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace " --cov=bluetooth_sensor_state_data --cov-report=term-missing:skip-covered" ""
+  '';
+
+  pythonImportsCheck = [
+    "bluetooth_sensor_state_data"
+  ];
+
+  meta = with lib; {
+    description = "Models for storing and converting Bluetooth Sensor State Data";
+    homepage = "https://github.com/bluetooth-devices/bluetooth-sensor-state-data";
+    license = with licenses; [ asl20 ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/databases/default.nix b/pkgs/development/python-modules/databases/default.nix
index 05431026ec88..24551340a0a8 100644
--- a/pkgs/development/python-modules/databases/default.nix
+++ b/pkgs/development/python-modules/databases/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "databases";
-  version = "0.6.0";
+  version = "0.6.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "encode";
     repo = pname;
     rev = version;
-    hash = "sha256-5+x735EFX9B25HgXiqzUJm0nbF7tDF5FOQVnbYQyomE=";
+    hash = "sha256-kHsA9XpolGmtuAGzRTj61igooLG9/LBQyv7TtuqiJ/A=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/deepwave/default.nix b/pkgs/development/python-modules/deepwave/default.nix
index c45115e53722..0e5e9b456612 100644
--- a/pkgs/development/python-modules/deepwave/default.nix
+++ b/pkgs/development/python-modules/deepwave/default.nix
@@ -18,14 +18,14 @@ let
 in
 buildPythonPackage rec {
   pname = "deepwave";
-  version = "0.0.12";
+  version = "0.0.14";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "ar4";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-WWu0LyHlOwWMVPUy+LAszKF3VlgcqlcMlDi4oon4Dl8=";
+    sha256 = "sha256-k1MUrnIkllxGIpkEScTZBEDBBNHgJHxau1e/L8TOEKc=";
   };
 
   # unable to find ninja although it is available, most likely because it looks for its pip version
diff --git a/pkgs/development/python-modules/diskcache/default.nix b/pkgs/development/python-modules/diskcache/default.nix
index cf3f7b514b1f..6a8d1e59cea7 100644
--- a/pkgs/development/python-modules/diskcache/default.nix
+++ b/pkgs/development/python-modules/diskcache/default.nix
@@ -43,6 +43,8 @@ buildPythonPackage rec {
     "test_incr_version"
     "test_get_or_set"
     "test_get_many"
+    # see https://github.com/grantjenks/python-diskcache/issues/260
+    "test_cache_write_unpicklable_object"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/django-js-asset/default.nix b/pkgs/development/python-modules/django-js-asset/default.nix
index e7001d15a9a4..f921077934fd 100644
--- a/pkgs/development/python-modules/django-js-asset/default.nix
+++ b/pkgs/development/python-modules/django-js-asset/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "django-js-asset";
-  version = "unstable-2021-06-07";
+  version = "2.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "matthiask";
     repo = pname;
-    rev = "a186aa0b5721ca95da6cc032a2fb780a152f581b";
-    sha256 = "141zxng0wwxalsi905cs8pdppy3ad717y3g4fkdxw4n3pd0fjp8r";
+    rev = "refs/tags/${version}";
+    hash = "sha256-YDOmbqB0xDBAlOSO1UBYJ8VfRjJ8Z6Hw1i24DNSrnjw=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/django-q/default.nix b/pkgs/development/python-modules/django-q/default.nix
index f81fc01bdd6f..a6ebb5714d9d 100644
--- a/pkgs/development/python-modules/django-q/default.nix
+++ b/pkgs/development/python-modules/django-q/default.nix
@@ -1,24 +1,82 @@
-{ lib, buildPythonPackage, fetchPypi, django-picklefield, arrow
-, blessed, django, future }:
+{ arrow
+, blessed
+, buildPythonPackage
+, croniter
+, django
+, django-redis
+, django-picklefield
+, fetchFromGitHub
+, future
+, lib
+, poetry-core
+, pytest-django
+, pytest-mock
+, pytestCheckHook
+, pkgs
+, stdenv
+}:
 
 buildPythonPackage rec {
   pname = "django-q";
   version = "1.3.9";
+  format = "pyproject";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "5c6b4d530aa3aabf9c6aa57376da1ca2abf89a1562b77038b7a04e52a4a0a91b";
+  src = fetchFromGitHub {
+    owner = "Koed00";
+    repo = "django-q";
+    sha256 = "sha256-gFSrAl3QGoJEJfvTTvLQgViPPjeJ6BfvgEwgLLo+uAA=";
+    rev = "v${version}";
   };
 
+  nativeBuildInputs = [ poetry-core ];
+
   propagatedBuildInputs = [
-    django-picklefield arrow blessed django future
+    django-picklefield
+    arrow
+    blessed
+    django
+    future
   ];
 
-  doCheck = false;
+  # fixes empty version string
+  # analog to https://github.com/NixOS/nixpkgs/pull/171200
+  patches = [
+    ./pep-621.patch
+  ];
+
+  pythonImportsCheck = [
+    "django_q"
+  ];
+
+  preCheck = ''
+    ${pkgs.redis}/bin/redis-server &
+    REDIS_PID=$!
+  '';
+
+  postCheck = ''
+    kill $REDIS_PID
+  '';
+
+  checkInputs = [
+    croniter
+    django-redis
+    pytest-django
+    pytest-mock
+    pytestCheckHook
+  ];
+
+  # don't bother with two more servers to test
+  disabledTests = [
+    "test_disque"
+    "test_mongo"
+  ];
+
+  doCheck = !stdenv.isDarwin;
 
   meta = with lib; {
     description = "A multiprocessing distributed task queue for Django";
     homepage = "https://django-q.readthedocs.org";
     license = licenses.mit;
+    maintainers = with maintainers; [ gador ];
   };
 }
diff --git a/pkgs/development/python-modules/django-q/pep-621.patch b/pkgs/development/python-modules/django-q/pep-621.patch
new file mode 100644
index 000000000000..e0a1568f4825
--- /dev/null
+++ b/pkgs/development/python-modules/django-q/pep-621.patch
@@ -0,0 +1,32 @@
+diff --git a/pyproject.toml b/pyproject.toml
+index 9a83e90..0cdffaf 100644
+--- a/pyproject.toml
++++ b/pyproject.toml
+@@ -1,16 +1,12 @@
+-[tool.poetry]
++[project]
+ name = "django-q"
+ version = "1.3.9"
+ description = "A multiprocessing distributed task queue for Django"
+-authors = ["Ilan Steemers <koed00@gmail.com>"]
+-maintainers = ["Ilan Steemers <koed00@gmail.com>"]
+-license = "MIT"
++authors = [ { name = "Ilan Steemers", email = "koed00@gmail.com"} ]
++maintainers = [ { name = "Ilan Steemers", email = "koed00@gmail.com"} ]
++license.text = "MIT"
+ readme = 'README.rst'
+
+-repository = "https://github.com/koed00/django-q"
+-homepage = "https://django-q.readthedocs.org"
+-documentation = "https://django-q.readthedocs.org"
+-
+ keywords = ["django", "distributed", "multiprocessing", "queue", "scheduler"]
+
+ classifiers = [
+@@ -31,7 +27,6 @@ classifiers = [
+     'Topic :: System :: Distributed Computing',
+     'Topic :: Software Development :: Libraries :: Python Modules',
+ ]
+-include = ['CHANGELOG.md']
+
+ [tool.poetry.plugins] # Optional super table
diff --git a/pkgs/development/python-modules/django/4.nix b/pkgs/development/python-modules/django/4.nix
index 1ab14001351e..29e45201e01a 100644
--- a/pkgs/development/python-modules/django/4.nix
+++ b/pkgs/development/python-modules/django/4.nix
@@ -6,6 +6,7 @@
 , substituteAll
 
 # patched in
+, fetchpatch
 , geos
 , gdal
 , withGdal ? false
@@ -39,23 +40,32 @@
 
 buildPythonPackage rec {
   pname = "Django";
-  version = "4.0.7";
+  version = "4.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-nG1a02vnmOVi3cqmsXscP/LTxPUppHQytp+5ow+EdGE=";
+    hash = "sha256-Ay+Kb8fPBczRIU5KLiHfzWojudV1xlc8rMjGeCjb5kI=";
   };
 
-  patches = lib.optional withGdal
+  patches = [
+    (fetchpatch {
+      # Fix regression in sqlite backend introduced in 4.1.
+      # https://github.com/django/django/pull/15925
+      url = "https://github.com/django/django/commit/c0beff21239e70cbdcc9597e5be09e505bb8f76c.patch";
+      hash = "sha256-QE7QnfYAK74wvK8gDJ15FtQ+BCIWRQKAVvM7v1FzwlE=";
+      excludes = [ "docs/releases/4.1.1.txt" ];
+    })
+  ] ++ lib.optionals withGdal [
     (substituteAll {
       src = ./django_4_set_geos_gdal_lib.patch;
       geos = geos;
       gdal = gdal;
       extension = stdenv.hostPlatform.extensions.sharedLibrary;
-    });
+    })
+  ];
 
   propagatedBuildInputs = [
     asgiref
diff --git a/pkgs/development/python-modules/elkm1-lib/default.nix b/pkgs/development/python-modules/elkm1-lib/default.nix
index f0815b15c71d..737f4a5a0b43 100644
--- a/pkgs/development/python-modules/elkm1-lib/default.nix
+++ b/pkgs/development/python-modules/elkm1-lib/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "elkm1-lib";
-  version = "2.0.2";
+  version = "2.1.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "gwww";
     repo = "elkm1";
     rev = version;
-    hash = "sha256-2UneQL8LT/zm0iusKay9SxeJClGrDi6yL0lRA8ugUms=";
+    hash = "sha256-uc+hU4RyF6IXUbdpZHozbF6vO2NE2hrfgxAnmmB27lw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/goodwe/default.nix b/pkgs/development/python-modules/goodwe/default.nix
index 6dc6f07e4ae0..3d4fd154c3f2 100644
--- a/pkgs/development/python-modules/goodwe/default.nix
+++ b/pkgs/development/python-modules/goodwe/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "goodwe";
-  version = "0.2.18";
+  version = "0.2.19";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "marcelblijleven";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-2AbEX/dYwcMIlp27umBcSGgPboGu5y0mmndefXCjkJg=";
+    sha256 = "sha256-H3N0hAJsjBX3pQ2i03r4MRBQQLCXjLhftokZQx0bF80=";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/govee-ble/default.nix b/pkgs/development/python-modules/govee-ble/default.nix
new file mode 100644
index 000000000000..1a3a31d7d717
--- /dev/null
+++ b/pkgs/development/python-modules/govee-ble/default.nix
@@ -0,0 +1,55 @@
+{ lib
+, bluetooth-sensor-state-data
+, buildPythonPackage
+, fetchFromGitHub
+, home-assistant-bluetooth
+, poetry-core
+, pytestCheckHook
+, pythonOlder
+, sensor-state-data
+}:
+
+buildPythonPackage rec {
+  pname = "govee-ble";
+  version = "0.14.0";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.9";
+
+  src = fetchFromGitHub {
+    owner = "Bluetooth-Devices";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-iJ3fvbQBIk2fpCfz9/uvxk6WcGaL8OVDsNQux+pTBhM=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    bluetooth-sensor-state-data
+    home-assistant-bluetooth
+    sensor-state-data
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace " --cov=govee_ble --cov-report=term-missing:skip-covered" ""
+  '';
+
+  pythonImportsCheck = [
+    "govee_ble"
+  ];
+
+  meta = with lib; {
+    description = "Library for Govee BLE devices";
+    homepage = "https://github.com/Bluetooth-Devices/govee-ble";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/inkbird-ble/default.nix b/pkgs/development/python-modules/inkbird-ble/default.nix
new file mode 100644
index 000000000000..896905306dd6
--- /dev/null
+++ b/pkgs/development/python-modules/inkbird-ble/default.nix
@@ -0,0 +1,55 @@
+{ lib
+, bluetooth-sensor-state-data
+, buildPythonPackage
+, fetchFromGitHub
+, home-assistant-bluetooth
+, poetry-core
+, pytestCheckHook
+, pythonOlder
+, sensor-state-data
+}:
+
+buildPythonPackage rec {
+  pname = "inkbird-ble";
+  version = "0.5.2";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.9";
+
+  src = fetchFromGitHub {
+    owner = "Bluetooth-Devices";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-ieVjgNCkU6AJDTgLzmn2YPCNm+kId65QW3SNu2Xou1Q=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    bluetooth-sensor-state-data
+    home-assistant-bluetooth
+    sensor-state-data
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace " --cov=inkbird_ble --cov-report=term-missing:skip-covered" ""
+  '';
+
+  pythonImportsCheck = [
+    "inkbird_ble"
+  ];
+
+  meta = with lib; {
+    description = "Library for Inkbird BLE devices";
+    homepage = "https://github.com/Bluetooth-Devices/inkbird-ble";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/mariadb/default.nix b/pkgs/development/python-modules/mariadb/default.nix
index 93260e9aac26..54e31065a089 100644
--- a/pkgs/development/python-modules/mariadb/default.nix
+++ b/pkgs/development/python-modules/mariadb/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "mariadb";
-  version = "1.0.11";
+  version = "1.1.4";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-dpFsiSvJNsWw824loUEfZRp7fOl4mSrjqN5+KD79rL8=";
+    hash = "sha256-c6CsvSrOOB7BvPxhztenmlGeZsAsJOEq5tJ7qgNxeHY=";
     extension = "zip";
   };
 
diff --git a/pkgs/development/python-modules/mcstatus/default.nix b/pkgs/development/python-modules/mcstatus/default.nix
index 26d3207cc4e2..f8001dbdd568 100644
--- a/pkgs/development/python-modules/mcstatus/default.nix
+++ b/pkgs/development/python-modules/mcstatus/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "mcstatus";
-  version = "9.2.0";
+  version = "9.3.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "py-mine";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-poq/8+gRlKtrYpuLHmkPgS6OTTMTMaQw9rS1V2sfd6w=";
+    hash = "sha256-kNThVElEDqhbCitktBv5tQkjMaU4IsX0dJk63hvLhb0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/moat-ble/default.nix b/pkgs/development/python-modules/moat-ble/default.nix
new file mode 100644
index 000000000000..33a59c72f8a0
--- /dev/null
+++ b/pkgs/development/python-modules/moat-ble/default.nix
@@ -0,0 +1,55 @@
+{ lib
+, bluetooth-sensor-state-data
+, buildPythonPackage
+, fetchFromGitHub
+, home-assistant-bluetooth
+, poetry-core
+, pytestCheckHook
+, pythonOlder
+, sensor-state-data
+}:
+
+buildPythonPackage rec {
+  pname = "moat-ble";
+  version = "0.1.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.9";
+
+  src = fetchFromGitHub {
+    owner = "Bluetooth-Devices";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-dy1Fm0Z1PUsPY8QTiXUcWSi+csFnTUsobSkA92m06QI=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    bluetooth-sensor-state-data
+    home-assistant-bluetooth
+    sensor-state-data
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace " --cov=moat_ble --cov-report=term-missing:skip-covered" ""
+  '';
+
+  pythonImportsCheck = [
+    "moat_ble"
+  ];
+
+  meta = with lib; {
+    description = "Library for Moat BLE devices";
+    homepage = "https://github.com/Bluetooth-Devices/moat-ble";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/sensor-state-data/default.nix b/pkgs/development/python-modules/sensor-state-data/default.nix
new file mode 100644
index 000000000000..a29ad29a92c3
--- /dev/null
+++ b/pkgs/development/python-modules/sensor-state-data/default.nix
@@ -0,0 +1,48 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, home-assistant-bluetooth
+, poetry-core
+, pytestCheckHook
+, pythonOlder
+, sensor-state-data
+}:
+
+buildPythonPackage rec {
+  pname = "sensor-state-data";
+  version = "2.0.2";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.9";
+
+  src = fetchFromGitHub {
+    owner = "Bluetooth-Devices";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-EywNH6REtopJoowsKQNNyJNYYyBR7L2pcrvmZAr5PZg=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace " --cov=sensor_state_data --cov-report=term-missing:skip-covered" ""
+  '';
+
+  pythonImportsCheck = [
+    "sensor_state_data"
+  ];
+
+  meta = with lib; {
+    description = "Models for storing and converting Sensor Data state";
+    homepage = "https://github.com/bluetooth-devices/sensor-state-data";
+    license = with licenses; [ asl20 ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/sensorpush-ble/default.nix b/pkgs/development/python-modules/sensorpush-ble/default.nix
new file mode 100644
index 000000000000..80fcbfa17694
--- /dev/null
+++ b/pkgs/development/python-modules/sensorpush-ble/default.nix
@@ -0,0 +1,55 @@
+{ lib
+, bluetooth-sensor-state-data
+, buildPythonPackage
+, fetchFromGitHub
+, home-assistant-bluetooth
+, poetry-core
+, pytestCheckHook
+, pythonOlder
+, sensor-state-data
+}:
+
+buildPythonPackage rec {
+  pname = "sensorpush-ble";
+  version = "1.5.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.9";
+
+  src = fetchFromGitHub {
+    owner = "Bluetooth-Devices";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-2Q56fXMgw1Al3l6WKI1cdGXfLmZ1qkidkoWKmvEXRaI=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    bluetooth-sensor-state-data
+    home-assistant-bluetooth
+    sensor-state-data
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace " --cov=sensorpush_ble --cov-report=term-missing:skip-covered" ""
+  '';
+
+  pythonImportsCheck = [
+    "sensorpush_ble"
+  ];
+
+  meta = with lib; {
+    description = "Library for SensorPush BLE devices";
+    homepage = "https://github.com/Bluetooth-Devices/sensorpush-ble";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/xiaomi-ble/default.nix b/pkgs/development/python-modules/xiaomi-ble/default.nix
new file mode 100644
index 000000000000..7d13d6d3a6d2
--- /dev/null
+++ b/pkgs/development/python-modules/xiaomi-ble/default.nix
@@ -0,0 +1,59 @@
+{ lib
+, bleak-retry-connector
+, bluetooth-sensor-state-data
+, buildPythonPackage
+, fetchFromGitHub
+, home-assistant-bluetooth
+, poetry-core
+, pycryptodomex
+, pytestCheckHook
+, pythonOlder
+, sensor-state-data
+}:
+
+buildPythonPackage rec {
+  pname = "xiaomi-ble";
+  version = "0.8.0";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.9";
+
+  src = fetchFromGitHub {
+    owner = "Bluetooth-Devices";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-HwA2NKsrqXBsC5/rUZUNfHDk8QA7I+zQmwqt0SVhw38=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    bleak-retry-connector
+    bluetooth-sensor-state-data
+    home-assistant-bluetooth
+    pycryptodomex
+    sensor-state-data
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace " --cov=xiaomi_ble --cov-report=term-missing:skip-covered" ""
+  '';
+
+  pythonImportsCheck = [
+    "xiaomi_ble"
+  ];
+
+  meta = with lib; {
+    description = "Library for Xiaomi BLE devices";
+    homepage = "https://github.com/Bluetooth-Devices/xiaomi-ble";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/tools/cuelsp/default.nix b/pkgs/development/tools/cuelsp/default.nix
index 2a0ece9b0418..60366f3f6fe4 100644
--- a/pkgs/development/tools/cuelsp/default.nix
+++ b/pkgs/development/tools/cuelsp/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "cuelsp";
-  version = "0.3.3";
+  version = "0.3.4";
 
   src = fetchFromGitHub {
     owner = "dagger";
     repo = "cuelsp";
     rev = "v${version}";
-    sha256 = "sha256-78snbfxm6nSNDQRhj7cC4FSkKeOEUw+wfjhJtP/CpwY=";
+    sha256 = "sha256-+E49TR2D26HSTwgwO1XFkIwXr5lmvv9l3KtR8dVT/cQ=";
   };
 
   vendorSha256 = "sha256-zg4aXPY2InY5VEX1GLJkGhMlfa5EezObAjIuX/bGvlc=";
diff --git a/pkgs/development/tools/garble/default.nix b/pkgs/development/tools/garble/default.nix
index 502aba4e64a7..2162b378ec01 100644
--- a/pkgs/development/tools/garble/default.nix
+++ b/pkgs/development/tools/garble/default.nix
@@ -6,16 +6,16 @@
 }:
 buildGoModule rec {
   pname = "garble";
-  version = "0.6.0";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "burrowers";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-VeqF1MB8knM+NtG9Y+x1g2OF7LFZRC8/c8jicGP3vpo=";
+    sha256 = "sha256-QQRnnH/lbleZYkmHj4XUj2uMB9h/mwolhqWfaWMk2ys=";
   };
 
-  vendorSha256 = "sha256-FQMeA6VUDQa6wpvMoYsigkzukQ0dArAkysiksJWq+iY=";
+  vendorSha256 = "sha256-Xax8KfNcFCLKqcLBNtRUNaneVCW4eUMFe4Ml+D4wLNA=";
 
   # Used for some of the tests.
   checkInputs = [git];
diff --git a/pkgs/development/tools/hcloud/default.nix b/pkgs/development/tools/hcloud/default.nix
index 9886d1753fef..7b764fa79c74 100644
--- a/pkgs/development/tools/hcloud/default.nix
+++ b/pkgs/development/tools/hcloud/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "hcloud";
-  version = "1.30.1";
+  version = "1.30.2";
 
   src = fetchFromGitHub {
     owner = "hetznercloud";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-0zVbk8NuPGYyEcYV1F1if8VdKa4MnW2v+VQcvgM9bZ8=";
+    sha256 = "sha256-1ay0cW1zBCfaLIWvJGW7A/OeDc4l7OldnQHvrGeqXjE=";
   };
 
-  vendorSha256 = "sha256-++uvg/vXRX2lPU4CmqAcLWbsWBXZHXaXO4qXEaq90T4=";
+  vendorSha256 = "sha256-DoCiyaEPh+QyKgC3PJ5oivJTlcKzscaphXET9et8T1g=";
 
   ldflags = [
     "-s" "-w"
diff --git a/pkgs/development/tools/jql/default.nix b/pkgs/development/tools/jql/default.nix
index 1333eac2e384..58af734a16cc 100644
--- a/pkgs/development/tools/jql/default.nix
+++ b/pkgs/development/tools/jql/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "jql";
-  version = "4.0.6";
+  version = "4.0.7";
 
   src = fetchFromGitHub {
     owner = "yamafaktory";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-1bwgG3VkIPU6lVl4OQNIaHNj7OXhTeMfAjQK2SMypZ8=";
+    sha256 = "sha256-5QVktJpGpHzwRUN8oIFoLydnA+ELhUprcQASeGzgLG8=";
   };
 
-  cargoSha256 = "sha256-VUrDrPVL2KkK1HA/iq8VBzEJSDzRvUfQ+9C8MuSfvkQ=";
+  cargoSha256 = "sha256-qmLmkWFP8T886uR8kJKCqB0G5XIfk+r+kubamKryktc=";
 
   meta = with lib; {
     description = "A JSON Query Language CLI tool built with Rust";
diff --git a/pkgs/servers/dns/knot-dns/default.nix b/pkgs/servers/dns/knot-dns/default.nix
index 20f7f831bdc1..23fefe80e764 100644
--- a/pkgs/servers/dns/knot-dns/default.nix
+++ b/pkgs/servers/dns/knot-dns/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "knot-dns";
-  version = "3.1.8";
+  version = "3.1.9";
 
   src = fetchurl {
     url = "https://secure.nic.cz/files/knot-dns/knot-${version}.tar.xz";
-    sha256 = "767e458a56277a1270b359294c3be6c63fd734884d62a045e01756a46507aa94";
+    sha256 = "sha256-s8pPHUROlf8n0gltPMWkfBDB1poeSIWuipcngfYnnYI=";
   };
 
   outputs = [ "bin" "out" "dev" ];
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 5cdc68e44a45..e8d156728d47 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -1038,7 +1038,8 @@
       aiohttp-cors
       bleak
       bluetooth-adapters
-    ]; # missing inputs: govee-ble
+      govee-ble
+    ];
     "gpsd" = ps: with ps; [
       gps3
     ];
@@ -1278,7 +1279,8 @@
       aiohttp-cors
       bleak
       bluetooth-adapters
-    ]; # missing inputs: inkbird-ble
+      inkbird-ble
+    ];
     "input_boolean" = ps: with ps; [
     ];
     "input_button" = ps: with ps; [
@@ -1660,7 +1662,8 @@
       aiohttp-cors
       bleak
       bluetooth-adapters
-    ]; # missing inputs: moat-ble
+      moat-ble
+    ];
     "mobile_app" = ps: with ps; [
       pynacl
       pyturbojpeg
@@ -2394,7 +2397,8 @@
       aiohttp-cors
       bleak
       bluetooth-adapters
-    ]; # missing inputs: sensorpush-ble
+      sensorpush-ble
+    ];
     "sentry" = ps: with ps; [
       sentry-sdk
     ];
@@ -3140,7 +3144,8 @@
       aiohttp-cors
       bleak
       bluetooth-adapters
-    ]; # missing inputs: xiaomi-ble
+      xiaomi-ble
+    ];
     "xiaomi_miio" = ps: with ps; [
       construct
       micloud
@@ -3464,6 +3469,7 @@
     "google_translate"
     "google_travel_time"
     "google_wifi"
+    "govee_ble"
     "gpslogger"
     "graphite"
     "gree"
@@ -3514,6 +3520,7 @@
     "image_processing"
     "imap_email_content"
     "influxdb"
+    "inkbird"
     "input_boolean"
     "input_button"
     "input_datetime"
@@ -3591,6 +3598,7 @@
     "minecraft_server"
     "minio"
     "mjpeg"
+    "moat"
     "mobile_app"
     "modbus"
     "modem_callerid"
@@ -3729,6 +3737,7 @@
     "senseme"
     "sensibo"
     "sensor"
+    "sensorpush"
     "sentry"
     "senz"
     "seventeentrack"
@@ -3891,6 +3900,7 @@
     "xbox"
     "xiaomi"
     "xiaomi_aqara"
+    "xiaomi_ble"
     "xiaomi_miio"
     "yale_smart_alarm"
     "yamaha"
diff --git a/pkgs/tools/misc/gh-dash/default.nix b/pkgs/tools/misc/gh-dash/default.nix
new file mode 100644
index 000000000000..2dcf9dfea461
--- /dev/null
+++ b/pkgs/tools/misc/gh-dash/default.nix
@@ -0,0 +1,28 @@
+{ lib
+, fetchFromGitHub
+, buildGoModule
+}:
+
+buildGoModule rec {
+  pname = "gh-dash";
+  version = "3.2.0";
+
+  src = fetchFromGitHub {
+    owner = "dlvhdr";
+    repo = "gh-dash";
+    rev = "v${version}";
+    sha256 = "sha256-y7PJ8BDTiip6cjKQ3CVIcf3LwlGsEj3DHn3EOtCGa4A=";
+  };
+
+  vendorSha256 = "sha256-Hk/sBUI2XYB+ZHfuGUR3muEzUtVsGR28EkRD1jKg0Ss=";
+
+  ldflags = [ "-s" "-w" ];
+
+  meta = {
+    description = "gh extension to display a dashboard with pull requests and issues";
+    homepage = "https://github.com/dlvhdr/gh-dash";
+    changelog = "https://github.com/dlvhdr/gh-dash/releases/tag/${src.rev}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ amesgen ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 6402cbaf1f8a..bca8e9b3c3d7 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1221,6 +1221,8 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) Security;
   };
 
+  gh-dash = callPackage ../tools/misc/gh-dash { };
+
   gh-eco = callPackage ../tools/misc/gh-eco { };
 
   glooctl = callPackage ../applications/networking/cluster/glooctl { };
@@ -15108,8 +15110,15 @@ with pkgs;
 
   sparkleshare = callPackage ../applications/version-management/sparkleshare { };
 
-  spidermonkey_78 = callPackage ../development/interpreters/spidermonkey/78.nix { };
-  spidermonkey_91 = callPackage ../development/interpreters/spidermonkey/91.nix { };
+  spidermonkey_78 = callPackage ../development/interpreters/spidermonkey/78.nix {
+    inherit (darwin) libobjc;
+  };
+  spidermonkey_91 = callPackage ../development/interpreters/spidermonkey/91.nix {
+    inherit (darwin) libobjc;
+  };
+  spidermonkey_102 = callPackage ../development/interpreters/spidermonkey/102.nix {
+    inherit (darwin) libobjc;
+  };
 
   ssm-agent = callPackage ../applications/networking/cluster/ssm-agent { };
   ssm-session-manager-plugin = callPackage ../applications/networking/cluster/ssm-session-manager-plugin { };
@@ -17815,10 +17824,7 @@ with pkgs;
 
   ganv = callPackage ../development/libraries/ganv { };
 
-  garble = callPackage ../development/tools/garble {
-    # pinned due to build failure or vendoring problems. When unpinning double check with: nix-build -A $name.go-modules --rebuild
-    buildGoModule = buildGo117Module;
-  };
+  garble = callPackage ../development/tools/garble { };
 
   gcab = callPackage ../development/libraries/gcab { };
 
diff --git a/pkgs/top-level/lua-packages.nix b/pkgs/top-level/lua-packages.nix
index 53e534811bfc..012a4d1e0c77 100644
--- a/pkgs/top-level/lua-packages.nix
+++ b/pkgs/top-level/lua-packages.nix
@@ -104,6 +104,11 @@ in
     };
   };
 
+  nfd = callPackage ../development/lua-modules/nfd {
+    inherit (lib) maintainers;
+    inherit (pkgs.gnome) zenity;
+  };
+
   vicious = luaLib.toLuaModule( stdenv.mkDerivation rec {
     pname = "vicious";
     version = "2.5.1";
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 6f90e3ca8388..4ab0b1b6194d 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1351,6 +1351,8 @@ in {
 
   bluetooth-adapters = callPackage ../development/python-modules/bluetooth-adapters { };
 
+  bluetooth-sensor-state-data = callPackage ../development/python-modules/bluetooth-sensor-state-data { };
+
   blurhash = callPackage ../development/python-modules/blurhash { };
 
   bme280spi = callPackage ../development/python-modules/bme280spi { };
@@ -3774,6 +3776,8 @@ in {
 
   gorilla = callPackage ../development/python-modules/gorilla { };
 
+  govee-ble = callPackage ../development/python-modules/govee-ble { };
+
   goveelights = callPackage ../development/python-modules/goveelights { };
 
   gpapi = callPackage ../development/python-modules/gpapi { };
@@ -4350,6 +4354,8 @@ in {
 
   injector = callPackage ../development/python-modules/injector { };
 
+  inkbird-ble = callPackage ../development/python-modules/inkbird-ble { };
+
   inkex = callPackage ../development/python-modules/inkex { };
 
   inotify = callPackage ../development/python-modules/inotify { };
@@ -5571,6 +5577,8 @@ in {
 
   mnist = callPackage ../development/python-modules/mnist { };
 
+  moat-ble = callPackage ../development/python-modules/moat-ble { };
+
   mocket = callPackage ../development/python-modules/mocket { };
 
   mock = callPackage ../development/python-modules/mock { };
@@ -9721,6 +9729,10 @@ in {
 
   sense-energy = callPackage ../development/python-modules/sense-energy { };
 
+  sensor-state-data = callPackage ../development/python-modules/sensor-state-data { };
+
+  sensorpush-ble = callPackage ../development/python-modules/sensorpush-ble { };
+
   sentencepiece = callPackage ../development/python-modules/sentencepiece {
     inherit (pkgs) sentencepiece;
   };
@@ -11547,6 +11559,8 @@ in {
 
   xhtml2pdf = callPackage ../development/python-modules/xhtml2pdf { };
 
+  xiaomi-ble = callPackage ../development/python-modules/xiaomi-ble { };
+
   xkbcommon = callPackage ../development/python-modules/xkbcommon { };
 
   xkcdpass = callPackage ../development/python-modules/xkcdpass { };