diff --git a/pkgs/applications/window-managers/icewm/default.nix b/pkgs/applications/window-managers/icewm/default.nix
index da97958fb346..2bff603cbd99 100644
--- a/pkgs/applications/window-managers/icewm/default.nix
+++ b/pkgs/applications/window-managers/icewm/default.nix
@@ -2,7 +2,6 @@
 , stdenv
 , fetchFromGitHub
 , fetchpatch
-, asciidoc
 , cmake
 , expat
 , fontconfig
@@ -40,17 +39,16 @@
 
 stdenv.mkDerivation rec {
   pname = "icewm";
-  version = "2.9.8";
+  version = "2.9.9";
 
   src = fetchFromGitHub {
     owner = "ice-wm";
     repo = pname;
     rev = version;
-    hash = "sha256-SjLXPlwL3tMBD7RCJkL60lqcld/ZXIxgjeNrAn8A6KU=";
+    hash = "sha256-55xi4GsP41FXJ/B/zEnjru72FhZQhXnpEdHcN0WF9Kk=";
   };
 
   nativeBuildInputs = [
-    asciidoc
     cmake
     perl
     pkg-config
diff --git a/pkgs/development/libraries/medfile/default.nix b/pkgs/development/libraries/medfile/default.nix
index c8ff0c05aded..1ef091a5d855 100644
--- a/pkgs/development/libraries/medfile/default.nix
+++ b/pkgs/development/libraries/medfile/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "medfile";
-  version = "4.1.0";
+  version = "4.1.1";
 
   src = fetchurl {
     url = "http://files.salome-platform.org/Salome/other/med-${version}.tar.gz";
-    sha256 = "1khzclkrd1yn9mz3g14ndgpsbj8j50v8dsjarcj6kkn9zgbbazc4";
+    sha256 = "sha256-3CtdVOvwZm4/8ul0BB0qsNqQYGEyNTcCOrFl1XM4ndA=";
   };
 
   patches = [
diff --git a/pkgs/development/php-packages/pdepend/default.nix b/pkgs/development/php-packages/pdepend/default.nix
index d1507040fcec..db0db7c86a4c 100644
--- a/pkgs/development/php-packages/pdepend/default.nix
+++ b/pkgs/development/php-packages/pdepend/default.nix
@@ -2,14 +2,14 @@
 
 let
   pname = "pdepend";
-  version = "2.10.3";
+  version = "2.11.0";
 in
 stdenv.mkDerivation {
   inherit pname version;
 
   src = fetchurl {
     url = "https://github.com/pdepend/pdepend/releases/download/${version}/pdepend.phar";
-    sha256 = "I5+n8+a3rHRgW4OM6FbVcf3T1wu9zBrTSb5sGq7ArH4=";
+    sha256 = "sha256-QhNO/yI2oJNhkwSn32gdId5IY0VR69eF/b/yMklhPKs=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/development/tools/yq-go/default.nix b/pkgs/development/tools/yq-go/default.nix
index 3b686aaa8b40..eb9478096ab6 100644
--- a/pkgs/development/tools/yq-go/default.nix
+++ b/pkgs/development/tools/yq-go/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "yq-go";
-  version = "4.27.2";
+  version = "4.27.3";
 
   src = fetchFromGitHub {
     owner = "mikefarah";
     repo = "yq";
     rev = "v${version}";
-    sha256 = "sha256-42rcptmZrMfUTN4kjnbulwosLOUNf0qw85eqmpD31gw=";
+    sha256 = "sha256-JEIKkiqVkzSXyZBAcZASHkn8MKoFZe52vKqrdJ4kX+I=";
   };
 
-  vendorSha256 = "sha256-fHqTgFsUKaDlWU9PGYqAFknzgq7tYzSTqNb+edwWZJg=";
+  vendorSha256 = "sha256-yv/qft4KpGi4xDfaQoylq1TanATUz5wd3a6RBlILG+s=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index 861519758f03..e7259845f491 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -2,42 +2,42 @@
     "4.14": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-4.14.290-hardened1.patch",
-            "sha256": "14bnps4y5k2aa0fd2g4bdbiir1w7xfrvgsqd3cfzni8zhf4xrw0l",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.290-hardened1/linux-hardened-4.14.290-hardened1.patch"
+            "name": "linux-hardened-4.14.291-hardened1.patch",
+            "sha256": "04fkfk5kdbqavdg5syyv35xbc8dl5pz8vf1xsvfcv30z5rslsr2c",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.291-hardened1/linux-hardened-4.14.291-hardened1.patch"
         },
-        "sha256": "0zyxb99a7fa2l85vnzmvg2nry99clj20d4j38piqm921iqxak2j4",
-        "version": "4.14.290"
+        "sha256": "15h76l81zn733g8dc6gsymf52nz325plhminv3m4x3klwhav34zc",
+        "version": "4.14.291"
     },
     "4.19": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-4.19.255-hardened1.patch",
-            "sha256": "1pi0na6gr0l56479dzny8fvb3yzvxvjbvwn7c6kxf0gdhdqjzsc9",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.255-hardened1/linux-hardened-4.19.255-hardened1.patch"
+            "name": "linux-hardened-4.19.256-hardened1.patch",
+            "sha256": "1vqdv2xnfr4ccnfvdrdhj7i0yjhjf48kgc9sziz7fwnfdis8zrrf",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.256-hardened1/linux-hardened-4.19.256-hardened1.patch"
         },
-        "sha256": "0hwa3g09cmllc2z01s2jqbczpznzdp3ldngx18k5c2ac7w394fbp",
-        "version": "4.19.255"
+        "sha256": "0jgm7ydha9achbcq3a6q85wq1nz4qg7phx122jzk0mqb1339bpk7",
+        "version": "4.19.256"
     },
     "5.10": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.10.137-hardened1.patch",
-            "sha256": "0qh94vcvrrd7kl4c32nbrw6bndvy8chkjfcip89akp7ks22w5yhp",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.137-hardened1/linux-hardened-5.10.137-hardened1.patch"
+            "name": "linux-hardened-5.10.139-hardened1.patch",
+            "sha256": "03n49hfc1ck82gzjhxsidbcy02r08qqy7qbahd8zmrhpw6vdqfwi",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.139-hardened1/linux-hardened-5.10.139-hardened1.patch"
         },
-        "sha256": "1j0n2r793pkvymjc70fzqwqi6h2j1wkja2kx012ydmsk2i6wssy1",
-        "version": "5.10.137"
+        "sha256": "1wdyk1w8lr5l4d038bd44rdndxjvfcva2n51h2i38jd4fp12l00w",
+        "version": "5.10.139"
     },
     "5.15": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.15.62-hardened1.patch",
-            "sha256": "08znbgkwsw9gl7hjcqrbj1aqysnxqj7bh8xikqvmpx54qqbk6brh",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.62-hardened1/linux-hardened-5.15.62-hardened1.patch"
+            "name": "linux-hardened-5.15.63-hardened1.patch",
+            "sha256": "02lgrnr8wkkrpwj6szd45dmdz4jdj2dpvpfvy8dmrl9hc870zk7k",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.63-hardened1/linux-hardened-5.15.63-hardened1.patch"
         },
-        "sha256": "0hgiag3mvdlcr6ckfy4bdr7h4471zqi53ahfybdvdkapivg7r086",
-        "version": "5.15.62"
+        "sha256": "0hbkxgadz0vcslni4r46yc202wcnxblcfvkcph1017b2b8gcvlvd",
+        "version": "5.15.63"
     },
     "5.18": {
         "patch": {
@@ -49,14 +49,24 @@
         "sha256": "1mc8zhiw0v7fka64mydpdrxkrvy0jyqggq5lghw3pyqj2wjrpw6z",
         "version": "5.18.19"
     },
+    "5.19": {
+        "patch": {
+            "extra": "-hardened1",
+            "name": "linux-hardened-5.19.5-hardened1.patch",
+            "sha256": "1f6zddx6mbpdn1glz32zrf13wr6j74vpk1lx56x3zllcfshds354",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.19.5-hardened1/linux-hardened-5.19.5-hardened1.patch"
+        },
+        "sha256": "1g9p4m9w9y0y1gk6vzqvsxzwqspbm10mmhd8n1mhal1yz721qgwc",
+        "version": "5.19.5"
+    },
     "5.4": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.4.210-hardened1.patch",
-            "sha256": "0qbz9h97m0lxa45j85sv2lhhmrlx9nv5z0bf5vdhyq6g0h7d2mm9",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.210-hardened1/linux-hardened-5.4.210-hardened1.patch"
+            "name": "linux-hardened-5.4.211-hardened1.patch",
+            "sha256": "061c1c3ha88798l9q3n2dd3ankvw0hlz8f8cisxljpzfj4napk8z",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.211-hardened1/linux-hardened-5.4.211-hardened1.patch"
         },
-        "sha256": "13l8zh5balciqhi4k4328sznza30v8g871wxcqqka61cij3rc0wl",
-        "version": "5.4.210"
+        "sha256": "1v1dgsk66fi6x6v9k6hg9ik3f3b3pv7a3gk8mybmgm9cnx0k5d5z",
+        "version": "5.4.211"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-5.10.nix b/pkgs/os-specific/linux/kernel/linux-5.10.nix
index d2fb4514a377..d4a38a79683b 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.10.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.10.138";
+  version = "5.10.139";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1a2vmcqzi71w88j79lxsrgyycq1l1gxp0cvh5ya4afhfisxh7819";
+    sha256 = "1wdyk1w8lr5l4d038bd44rdndxjvfcva2n51h2i38jd4fp12l00w";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.19.nix b/pkgs/os-specific/linux/kernel/linux-5.19.nix
index c9a864ddfab9..7ce20f3b6fe1 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.19.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.19.4";
+  version = "5.19.5";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "11xzz5glbc7p3j9mhv6dvi9iv345ykpyihm8mby8vyas12bln8d9";
+    sha256 = "1g9p4m9w9y0y1gk6vzqvsxzwqspbm10mmhd8n1mhal1yz721qgwc";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/servers/plex/raw.nix b/pkgs/servers/plex/raw.nix
index 5db0f12af878..4a565ad8bd70 100644
--- a/pkgs/servers/plex/raw.nix
+++ b/pkgs/servers/plex/raw.nix
@@ -12,16 +12,16 @@
 # server, and the FHS userenv and corresponding NixOS module should
 # automatically pick up the changes.
 stdenv.mkDerivation rec {
-  version = "1.28.1.6104-788f82488";
+  version = "1.28.2.6106-44a5bbd28";
   pname = "plexmediaserver";
 
   # Fetch the source
   src = if stdenv.hostPlatform.system == "aarch64-linux" then fetchurl {
     url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_arm64.deb";
-    sha256 = "sha256-sAyZGdo6VuoQLKrFJVidDgY3c51e8FroXS5x170Hupw=";
+    sha256 = "18wlw6fjmmq3k0g8rj6p87xsiqw12721s3njyr9qw1dmlzcwh1zg";
   } else fetchurl {
     url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_amd64.deb";
-    sha256 = "sha256-Drf+b+nyj+yfXjFBji3Xwx2J+3CGXOaW01sxkgzMf9c=";
+    sha256 = "0ii00qav7yamy9bwqgfdrvvmzywm7zga28g9y19g7n6f4bjzb5vh";
   };
 
   outputs = [ "out" "basedb" ];
diff --git a/pkgs/tools/audio/beets/default.nix b/pkgs/tools/audio/beets/default.nix
index f68a0381e12a..c21861bfc276 100644
--- a/pkgs/tools/audio/beets/default.nix
+++ b/pkgs/tools/audio/beets/default.nix
@@ -31,12 +31,12 @@ lib.makeExtensible (self: {
   beets-minimal = self.beets.override { disableAllPlugins = true; };
 
   beets-unstable = callPackage ./common.nix {
-    version = "unstable-2022-05-08";
+    version = "unstable-2022-08-27";
     src = fetchFromGitHub {
       owner = "beetbox";
       repo = "beets";
-      rev = "e06cf7969bfdfa4773049699320471be45d56054";
-      hash = "sha256-yWwxYSzSSmx2UfCn0EBH23hQGZKSRn/c8ryvxLUeHdM=";
+      rev = "50bd693057de472470ab5175fae0cdb5b75811c6";
+      hash = "sha256-91v1StaByG60ryhQqByBXu6sFCjk0qT0nsUPnocSEE4=";
     };
     pluginOverrides = {
       # unstable has a new plugin, so we register it here.
diff --git a/pkgs/tools/misc/toybox/default.nix b/pkgs/tools/misc/toybox/default.nix
index 07c875a94ccd..fc9465f35cdc 100644
--- a/pkgs/tools/misc/toybox/default.nix
+++ b/pkgs/tools/misc/toybox/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "toybox";
-  version = "0.8.6";
+  version = "0.8.8";
 
   src = fetchFromGitHub {
     owner = "landley";
     repo = pname;
     rev = version;
-    sha256 = "sha256-NbONJten685wekfCwbOOQxdS3B2/Ljfp/jdTa7D4U+M=";
+    sha256 = "sha256-T3qE9xlcEoZOcY52XfYPpN34zzQl6mfcRnyuldnIvCk=";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ]; # needed for cross
diff --git a/pkgs/tools/security/safe/default.nix b/pkgs/tools/security/safe/default.nix
index 6b5160e7e753..37666bf7c213 100644
--- a/pkgs/tools/security/safe/default.nix
+++ b/pkgs/tools/security/safe/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "safe";
-  version = "1.6.1";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "starkandwayne";
     repo = "safe";
     rev = "v${version}";
-    sha256 = "sha256-ankX4BeMvBEd0e01mQHfaPg4z1z+IZqELaSEJ5deF8Y=";
+    sha256 = "sha256-i8L7L06nBIiwrMEF5+jwCm2/iox6W+yE1HcruB6EQNM=";
   };
 
-  vendorSha256 = "sha256-7hX35FfFxfoiI/dSxWhZH8iJoRWa4slAJF0lULq8KL4=";
+  vendorSha256 = "sha256-w8gHCqOfmZg4JZgg1nZBtTJ553Rbp0a0JsoQVDFjehM=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/tools/virtualization/kubevirt/default.nix b/pkgs/tools/virtualization/kubevirt/default.nix
index 004e0aaf8af5..51dbf7fbfb1c 100644
--- a/pkgs/tools/virtualization/kubevirt/default.nix
+++ b/pkgs/tools/virtualization/kubevirt/default.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "kubevirt";
-  version = "0.55.1";
+  version = "0.56.0";
 
   src = fetchFromGitHub {
     owner = "kubevirt";
     repo = "kubevirt";
     rev = "v${version}";
-    sha256 = "sha256-aXH21dHWqSG8VxDufqh+N+heVf/jshWo1goBllOBwZ0=";
+    sha256 = "sha256-Yx6h9Q4/0fO1KOiAqCRpQcKZ5aSap+PdjX1wPG195Lc=";
   };
 
   vendorSha256 = null;