diff --git a/lib/attrsets.nix b/lib/attrsets.nix
index 4b663db2ce4a..9009feb87d90 100644
--- a/lib/attrsets.nix
+++ b/lib/attrsets.nix
@@ -16,6 +16,8 @@ rec {
 
      Example:
        x = { a = { b = 3; }; }
+       # ["a" "b"] is equivalent to x.a.b
+       # 6 is a default value to return if the path does not exist in attrset
        attrByPath ["a" "b"] 6 x
        => 3
        attrByPath ["z" "z"] 6 x
@@ -23,6 +25,7 @@ rec {
 
      Type:
        attrByPath :: [String] -> Any -> AttrSet -> Any
+
   */
   attrByPath =
     # A list of strings representing the attribute path to return from `set`
@@ -96,7 +99,7 @@ rec {
        => error: cannot find attribute `z.z'
 
      Type:
-       getAttrFromPath :: [String] -> AttrSet -> Value
+       getAttrFromPath :: [String] -> AttrSet -> Any
   */
   getAttrFromPath =
     # A list of strings representing the attribute path to get from `set`
@@ -109,10 +112,7 @@ rec {
   /* Map each attribute in the given set and merge them into a new attribute set.
 
      Type:
-       concatMapAttrs ::
-         (String -> a -> AttrSet)
-         -> AttrSet
-         -> AttrSet
+       concatMapAttrs :: (String -> a -> AttrSet) -> AttrSet -> AttrSet
 
      Example:
        concatMapAttrs
@@ -168,8 +168,7 @@ rec {
        ] { a.b.c = 0; }
        => { a = { b = { d = 1; }; }; x = { y = "xy"; }; }
 
-    Type:
-      updateManyAttrsByPath :: [AttrSet] -> AttrSet -> AttrSet
+    Type: updateManyAttrsByPath :: [{ path :: [String], update :: (Any -> Any) }] -> AttrSet -> AttrSet
   */
   updateManyAttrsByPath = let
     # When recursing into attributes, instead of updating the `path` of each
@@ -252,6 +251,7 @@ rec {
      Example:
        attrValues {c = 3; a = 1; b = 2;}
        => [1 2 3]
+
      Type:
        attrValues :: AttrSet -> [Any]
   */
@@ -341,6 +341,7 @@ rec {
 
      Type:
        foldAttrs :: (Any -> Any -> Any) -> Any -> [AttrSets] -> Any
+
   */
   foldAttrs =
     # A function, given a value and a collector combines the two.
@@ -394,7 +395,7 @@ rec {
            { a = 2; b = 20; }
          ]
      Type:
-     cartesianProductOfSets :: AttrSet -> [AttrSet]
+       cartesianProductOfSets :: AttrSet -> [AttrSet]
   */
   cartesianProductOfSets =
     # Attribute set with attributes that are lists of values
@@ -413,7 +414,7 @@ rec {
        => { name = "some"; value = 6; }
 
      Type:
-       nameValuePair :: String -> Any -> AttrSet
+       nameValuePair :: String -> Any -> { name :: String, value :: Any }
   */
   nameValuePair =
     # Attribute name
@@ -600,7 +601,7 @@ rec {
        => { }
 
      Type:
-       optionalAttrs :: Bool -> AttrSet
+       optionalAttrs :: Bool -> AttrSet -> AttrSet
   */
   optionalAttrs =
     # Condition under which the `as` attribute set is returned.
@@ -646,7 +647,7 @@ rec {
        => { a = ["x" "y"]; b = ["z"] }
 
      Type:
-     zipAttrsWith :: (String -> [ Any ] -> Any) -> [ AttrSet ] -> AttrSet
+       zipAttrsWith :: (String -> [ Any ] -> Any) -> [ AttrSet ] -> AttrSet
   */
   zipAttrsWith =
     builtins.zipAttrsWith or (f: sets: zipAttrsWithNames (concatMap attrNames sets) f sets);
@@ -737,7 +738,7 @@ rec {
        }
 
      Type:
-     recursiveUpdate :: AttrSet -> AttrSet -> AttrSet
+       recursiveUpdate :: AttrSet -> AttrSet -> AttrSet
   */
   recursiveUpdate =
     # Left attribute set of the merge.
@@ -795,6 +796,7 @@ rec {
   /* Turns a list of strings into a human-readable description of those
     strings represented as an attribute path. The result of this function is
     not intended to be machine-readable.
+    Create a new attribute set with `value` set at the nested attribute location specified in `attrPath`.
 
     Example:
       showAttrPath [ "foo" "10" "bar" ]
@@ -831,11 +833,11 @@ rec {
      If the output does not exist, fallback to `.out` and then to the default.
 
      Example:
-       getOutput pkgs.openssl
+       getBin pkgs.openssl
        => "/nix/store/9rz8gxhzf8sw4kf2j2f1grr49w8zx5vj-openssl-1.0.1r"
 
      Type:
-       getOutput :: Derivation -> String
+       getBin :: Derivation -> String
   */
   getBin = getOutput "bin";
 
@@ -844,11 +846,11 @@ rec {
      If the output does not exist, fallback to `.out` and then to the default.
 
      Example:
-       getOutput pkgs.openssl
+       getLib pkgs.openssl
        => "/nix/store/9rz8gxhzf8sw4kf2j2f1grr49w8zx5vj-openssl-1.0.1r-lib"
 
      Type:
-       getOutput :: Derivation -> String
+       getLib :: Derivation -> String
   */
   getLib = getOutput "lib";
 
@@ -857,11 +859,11 @@ rec {
      If the output does not exist, fallback to `.out` and then to the default.
 
      Example:
-       getOutput pkgs.openssl
+       getDev pkgs.openssl
        => "/nix/store/9rz8gxhzf8sw4kf2j2f1grr49w8zx5vj-openssl-1.0.1r-dev"
 
      Type:
-       getOutput :: Derivation -> String
+       getDev :: Derivation -> String
   */
   getDev = getOutput "dev";
 
@@ -870,15 +872,19 @@ rec {
      If the output does not exist, fallback to `.out` and then to the default.
 
      Example:
-       getOutput pkgs.openssl
+       getMan pkgs.openssl
        => "/nix/store/9rz8gxhzf8sw4kf2j2f1grr49w8zx5vj-openssl-1.0.1r-man"
 
      Type:
-       getOutput :: Derivation -> String
+       getMan :: Derivation -> String
   */
   getMan = getOutput "man";
 
-  /* Pick the outputs of packages to place in `buildInputs` */
+  /* Pick the outputs of packages to place in `buildInputs`
+
+   Type: chooseDevOutputs :: [Derivation] -> [String]
+
+  */
   chooseDevOutputs =
     # List of packages to pick `dev` outputs from
     drvs:
@@ -900,6 +906,7 @@ rec {
 
      Type:
        recurseIntoAttrs :: AttrSet -> AttrSet
+
    */
   recurseIntoAttrs =
     # An attribute set to scan for derivations.
@@ -909,7 +916,7 @@ rec {
   /* Undo the effect of recurseIntoAttrs.
 
      Type:
-       recurseIntoAttrs :: AttrSet -> AttrSet
+       dontRecurseIntoAttrs :: AttrSet -> AttrSet
    */
   dontRecurseIntoAttrs =
     # An attribute set to not scan for derivations.
@@ -919,7 +926,10 @@ rec {
   /* `unionOfDisjoint x y` is equal to `x // y // z` where the
      attrnames in `z` are the intersection of the attrnames in `x` and
      `y`, and all values `assert` with an error message.  This
-      operator is commutative, unlike (//). */
+      operator is commutative, unlike (//).
+
+     Type: unionOfDisjoint :: AttrSet -> AttrSet -> AttrSet
+  */
   unionOfDisjoint = x: y:
     let
       intersection = builtins.intersectAttrs x y;
@@ -930,9 +940,10 @@ rec {
     in
       (x // y) // mask;
 
-  # deprecated
+  # DEPRECATED
   zipWithNames = zipAttrsWithNames;
-  # deprecated
+
+  # DEPRECATED
   zip = builtins.trace
     "lib.zip is deprecated, use lib.zipAttrsWith instead" zipAttrsWith;
 }
diff --git a/lib/options.nix b/lib/options.nix
index 0fd5b64a65d1..9425e803c056 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -104,8 +104,6 @@ rec {
   /* Creates an Option attribute set for an option that specifies the
      package a module should use for some purpose.
 
-     Type: mkPackageOption :: pkgs -> string -> { default :: [string], example :: null | string | [string] } -> option
-
      The package is specified as a list of strings representing its attribute path in nixpkgs.
 
      Because of this, you need to pass nixpkgs itself as the first argument.
@@ -116,6 +114,8 @@ rec {
 
      You can omit the default path if the name of the option is also attribute path in nixpkgs.
 
+     Type: mkPackageOption :: pkgs -> string -> { default :: [string], example :: null | string | [string] } -> option
+
      Example:
        mkPackageOption pkgs "hello" { }
        => { _type = "option"; default = «derivation /nix/store/3r2vg51hlxj3cx5vscp0vkv60bqxkaq0-hello-2.10.drv»; defaultText = { ... }; description = "The hello package to use."; type = { ... }; }
diff --git a/maintainers/scripts/haskell/regenerate-transitive-broken-packages.sh b/maintainers/scripts/haskell/regenerate-transitive-broken-packages.sh
index 94104e00edb8..69455bfb6879 100755
--- a/maintainers/scripts/haskell/regenerate-transitive-broken-packages.sh
+++ b/maintainers/scripts/haskell/regenerate-transitive-broken-packages.sh
@@ -1,5 +1,5 @@
 #! /usr/bin/env nix-shell
-#! nix-shell -i bash -p coreutils nix gnused -I nixpkgs=.
+#! nix-shell -i bash -p coreutils jq nix -I nixpkgs=.
 
 config_file=pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml
 
@@ -12,4 +12,4 @@ dont-distribute-packages:
 EOF
 
 echo "Regenerating list of transitive broken packages ..."
-echo -e $(nix-instantiate --eval --strict maintainers/scripts/haskell/transitive-broken-packages.nix) | sed 's/\"//' | LC_ALL=C.UTF-8 sort -i >> $config_file
+nix-instantiate --eval --option restrict-eval true -I . --strict --json maintainers/scripts/haskell/transitive-broken-packages.nix | jq -r . | LC_ALL=C.UTF-8 sort -i >> $config_file
diff --git a/maintainers/scripts/haskell/transitive-broken-packages.nix b/maintainers/scripts/haskell/transitive-broken-packages.nix
index d4ddaa957658..50ccb14577bc 100644
--- a/maintainers/scripts/haskell/transitive-broken-packages.nix
+++ b/maintainers/scripts/haskell/transitive-broken-packages.nix
@@ -12,5 +12,5 @@ let
     (getEvaluating (nixpkgs { config.allowBroken = true; }).haskellPackages);
 in
 ''
-  ${lib.concatMapStringsSep "\n" (x: "  - ${x}") brokenDeps}
+  ${lib.concatMapStringsSep "\n" (x: " - ${x}") brokenDeps}
 ''
diff --git a/nixos/lib/testing-python.nix b/nixos/lib/testing-python.nix
index 134d38f1b676..4904ad6e3591 100644
--- a/nixos/lib/testing-python.nix
+++ b/nixos/lib/testing-python.nix
@@ -1,3 +1,4 @@
+args@
 { system
 , pkgs ? import ../.. { inherit system config; }
   # Use a minimal kernel?
@@ -5,7 +6,7 @@
   # Ignored
 , config ? { }
   # !!! See comment about args in lib/modules.nix
-, specialArgs ? { }
+, specialArgs ? throw "legacy - do not use, see error below"
   # Modules to add to each VM
 , extraConfigurations ? [ ]
 }:
@@ -13,6 +14,13 @@ let
   nixos-lib = import ./default.nix { inherit (pkgs) lib; };
 in
 
+pkgs.lib.throwIf (args?specialArgs) ''
+  testing-python.nix: `specialArgs` is not supported anymore. If you're looking
+  for the public interface to the NixOS test framework, use `runTest`, and
+  `node.specialArgs`.
+  See https://nixos.org/manual/nixos/unstable/index.html#sec-calling-nixos-tests
+  and https://nixos.org/manual/nixos/unstable/index.html#test-opt-node.specialArgs
+''
 rec {
 
   inherit pkgs;
diff --git a/nixos/modules/profiles/macos-builder.nix b/nixos/modules/profiles/macos-builder.nix
index 77f3224a7294..0cbac3bd61fe 100644
--- a/nixos/modules/profiles/macos-builder.nix
+++ b/nixos/modules/profiles/macos-builder.nix
@@ -62,7 +62,7 @@ in
 
       # This installCredentials script is written so that it's as easy as
       # possible for a user to audit before confirming the `sudo`
-      installCredentials = pkgs.writeShellScript "install-credentials" ''
+      installCredentials = hostPkgs.writeShellScript "install-credentials" ''
         KEYS="''${1}"
         INSTALL=${hostPkgs.coreutils}/bin/install
         "''${INSTALL}" -g nixbld -m 600 "''${KEYS}/${user}_${keyType}" ${privateKey}
diff --git a/nixos/modules/services/security/aesmd.nix b/nixos/modules/services/security/aesmd.nix
index 7b0a46d6d029..8b3f010d7c4d 100644
--- a/nixos/modules/services/security/aesmd.nix
+++ b/nixos/modules/services/security/aesmd.nix
@@ -25,6 +25,22 @@ in
       default = false;
       description = lib.mdDoc "Whether to build the PSW package in debug mode.";
     };
+    environment = mkOption {
+      type = with types; attrsOf str;
+      default = { };
+      description = mdDoc "Additional environment variables to pass to the AESM service.";
+      # Example environment variable for `sgx-azure-dcap-client` provider library
+      example = {
+        AZDCAP_COLLATERAL_VERSION = "v2";
+        AZDCAP_DEBUG_LOG_LEVEL = "INFO";
+      };
+    };
+    quoteProviderLibrary = mkOption {
+      type = with types; nullOr path;
+      default = null;
+      example = literalExpression "pkgs.sgx-azure-dcap-client";
+      description = lib.mdDoc "Custom quote provider library to use.";
+    };
     settings = mkOption {
       description = lib.mdDoc "AESM configuration";
       default = { };
@@ -83,7 +99,6 @@ in
         storeAesmFolder = "${sgx-psw}/aesm";
         # Hardcoded path AESM_DATA_FOLDER in psw/ae/aesm_service/source/oal/linux/aesm_util.cpp
         aesmDataFolder = "/var/opt/aesmd/data";
-        aesmStateDirSystemd = "%S/aesmd";
       in
       {
         description = "Intel Architectural Enclave Service Manager";
@@ -98,8 +113,8 @@ in
         environment = {
           NAME = "aesm_service";
           AESM_PATH = storeAesmFolder;
-          LD_LIBRARY_PATH = storeAesmFolder;
-        };
+          LD_LIBRARY_PATH = makeLibraryPath [ cfg.quoteProviderLibrary ];
+        } // cfg.environment;
 
         # Make sure any of the SGX application enclave devices is available
         unitConfig.AssertPathExists = [
diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index 953f31632934..8377e8a76d52 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -524,7 +524,9 @@ in
       };
 
       validateConfig = mkOption {
-        default = pkgs.stdenv.hostPlatform == pkgs.stdenv.buildPlatform;
+        # FIXME: re-enable if we can make of the configurations work.
+        #default = pkgs.stdenv.hostPlatform == pkgs.stdenv.buildPlatform;
+        default = false;
         defaultText = literalExpression "pkgs.stdenv.hostPlatform == pkgs.stdenv.buildPlatform";
         type = types.bool;
         description = lib.mdDoc ''
diff --git a/nixos/tests/aesmd.nix b/nixos/tests/aesmd.nix
index 5da661afd548..848e1c599201 100644
--- a/nixos/tests/aesmd.nix
+++ b/nixos/tests/aesmd.nix
@@ -1,7 +1,7 @@
 { pkgs, lib, ... }: {
   name = "aesmd";
   meta = {
-    maintainers = with lib.maintainers; [ veehaitch ];
+    maintainers = with lib.maintainers; [ trundle veehaitch ];
   };
 
   nodes.machine = { lib, ... }: {
@@ -25,38 +25,78 @@
 
     # We don't have a real SGX machine in NixOS tests
     systemd.services.aesmd.unitConfig.AssertPathExists = lib.mkForce [ ];
+
+    specialisation = {
+      withQuoteProvider.configuration = { ... }: {
+        services.aesmd = {
+          quoteProviderLibrary = pkgs.sgx-azure-dcap-client;
+          environment = {
+            AZDCAP_DEBUG_LOG_LEVEL = "INFO";
+          };
+        };
+      };
+    };
   };
 
-  testScript = ''
-    with subtest("aesmd.service starts"):
-      machine.wait_for_unit("aesmd.service")
-      status, main_pid = machine.systemctl("show --property MainPID --value aesmd.service")
-      assert status == 0, "Could not get MainPID of aesmd.service"
-      main_pid = main_pid.strip()
+  testScript = { nodes, ... }:
+    let
+      specialisations = "${nodes.machine.system.build.toplevel}/specialisation";
+    in
+    ''
+      def get_aesmd_pid():
+        status, main_pid = machine.systemctl("show --property MainPID --value aesmd.service")
+        assert status == 0, "Could not get MainPID of aesmd.service"
+        return main_pid.strip()
 
-    with subtest("aesmd.service runtime directory permissions"):
-      runtime_dir = "/run/aesmd";
-      res = machine.succeed(f"stat -c '%a %U %G' {runtime_dir}").strip()
-      assert "750 aesmd sgx" == res, f"{runtime_dir} does not have the expected permissions: {res}"
+      with subtest("aesmd.service starts"):
+        machine.wait_for_unit("aesmd.service")
 
-    with subtest("aesm.socket available on host"):
-      socket_path = "/var/run/aesmd/aesm.socket"
-      machine.wait_until_succeeds(f"test -S {socket_path}")
-      machine.succeed(f"test 777 -eq $(stat -c '%a' {socket_path})")
-      for op in [ "-r", "-w", "-x" ]:
-        machine.succeed(f"sudo -u sgxtest test {op} {socket_path}")
-        machine.fail(f"sudo -u nosgxtest test {op} {socket_path}")
+      main_pid = get_aesmd_pid()
 
-    with subtest("Copies white_list_cert_to_be_verify.bin"):
-      whitelist_path = "/var/opt/aesmd/data/white_list_cert_to_be_verify.bin"
-      whitelist_perms = machine.succeed(
-        f"nsenter -m -t {main_pid} ${pkgs.coreutils}/bin/stat -c '%a' {whitelist_path}"
-      ).strip()
-      assert "644" == whitelist_perms, f"white_list_cert_to_be_verify.bin has permissions {whitelist_perms}"
+      with subtest("aesmd.service runtime directory permissions"):
+        runtime_dir = "/run/aesmd";
+        res = machine.succeed(f"stat -c '%a %U %G' {runtime_dir}").strip()
+        assert "750 aesmd sgx" == res, f"{runtime_dir} does not have the expected permissions: {res}"
 
-    with subtest("Writes and binds aesm.conf in service namespace"):
-      aesmd_config = machine.succeed(f"nsenter -m -t {main_pid} ${pkgs.coreutils}/bin/cat /etc/aesmd.conf")
+      with subtest("aesm.socket available on host"):
+        socket_path = "/var/run/aesmd/aesm.socket"
+        machine.wait_until_succeeds(f"test -S {socket_path}")
+        machine.succeed(f"test 777 -eq $(stat -c '%a' {socket_path})")
+        for op in [ "-r", "-w", "-x" ]:
+          machine.succeed(f"sudo -u sgxtest test {op} {socket_path}")
+          machine.fail(f"sudo -u nosgxtest test {op} {socket_path}")
 
-      assert aesmd_config == "whitelist url = http://nixos.org\nproxy type = direct\ndefault quoting type = ecdsa_256\n", "aesmd.conf differs"
-  '';
+      with subtest("Copies white_list_cert_to_be_verify.bin"):
+        whitelist_path = "/var/opt/aesmd/data/white_list_cert_to_be_verify.bin"
+        whitelist_perms = machine.succeed(
+          f"nsenter -m -t {main_pid} ${pkgs.coreutils}/bin/stat -c '%a' {whitelist_path}"
+        ).strip()
+        assert "644" == whitelist_perms, f"white_list_cert_to_be_verify.bin has permissions {whitelist_perms}"
+
+      with subtest("Writes and binds aesm.conf in service namespace"):
+        aesmd_config = machine.succeed(f"nsenter -m -t {main_pid} ${pkgs.coreutils}/bin/cat /etc/aesmd.conf")
+
+        assert aesmd_config == "whitelist url = http://nixos.org\nproxy type = direct\ndefault quoting type = ecdsa_256\n", "aesmd.conf differs"
+
+      with subtest("aesmd.service without quote provider library has correct LD_LIBRARY_PATH"):
+        status, environment = machine.systemctl("show --property Environment --value aesmd.service")
+        assert status == 0, "Could not get Environment of aesmd.service"
+        env_by_name = dict(entry.split("=", 1) for entry in environment.split())
+        assert not env_by_name["LD_LIBRARY_PATH"], "LD_LIBRARY_PATH is not empty"
+
+      with subtest("aesmd.service with quote provider library starts"):
+        machine.succeed('${specialisations}/withQuoteProvider/bin/switch-to-configuration test')
+        machine.wait_for_unit("aesmd.service")
+
+      main_pid = get_aesmd_pid()
+
+      with subtest("aesmd.service with quote provider library has correct LD_LIBRARY_PATH"):
+        ld_library_path = machine.succeed(f"xargs -0 -L1 -a /proc/{main_pid}/environ | grep LD_LIBRARY_PATH")
+        assert ld_library_path.startswith("LD_LIBRARY_PATH=${pkgs.sgx-azure-dcap-client}/lib:"), \
+          "LD_LIBRARY_PATH is not set to the configured quote provider library"
+
+      with subtest("aesmd.service with quote provider library has set AZDCAP_DEBUG_LOG_LEVEL"):
+        azdcp_debug_log_level = machine.succeed(f"xargs -0 -L1 -a /proc/{main_pid}/environ | grep AZDCAP_DEBUG_LOG_LEVEL")
+        assert azdcp_debug_log_level == "AZDCAP_DEBUG_LOG_LEVEL=INFO\n", "AZDCAP_DEBUG_LOG_LEVEL is not set to INFO"
+    '';
 }
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 6f056de2ed5c..4a07ec7dad30 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -69,7 +69,7 @@ in {
   _3proxy = runTest ./3proxy.nix;
   acme = runTest ./acme.nix;
   adguardhome = runTest ./adguardhome.nix;
-  aesmd = runTest ./aesmd.nix;
+  aesmd = runTestOn ["x86_64-linux"] ./aesmd.nix;
   agate = runTest ./web-servers/agate.nix;
   agda = handleTest ./agda.nix {};
   airsonic = handleTest ./airsonic.nix {};
diff --git a/nixos/tests/keymap.nix b/nixos/tests/keymap.nix
index 4306a9ae2cf9..0bde21093b0a 100644
--- a/nixos/tests/keymap.nix
+++ b/nixos/tests/keymap.nix
@@ -64,7 +64,6 @@ let
 
               # wait for reader to be ready
               machine.wait_for_file("${readyFile}")
-              machine.sleep(1)
 
               # send all keys
               for key in inputs:
@@ -78,9 +77,18 @@ let
       with open("${pkgs.writeText "tests.json" (builtins.toJSON tests)}") as json_file:
           tests = json.load(json_file)
 
+      # These environments used to run in the opposite order, causing the
+      # following error at openvt startup.
+      #
+      # openvt: Couldn't deallocate console 1
+      #
+      # This error did not appear in successful runs.
+      # I don't know the exact cause, but I it seems that openvt and X are
+      # fighting over the virtual terminal. This does not appear to be a problem
+      # when the X test runs first.
       keymap_environments = {
-          "VT Keymap": "openvt -sw --",
           "Xorg Keymap": "DISPLAY=:0 xterm -title testterm -class testterm -fullscreen -e",
+          "VT Keymap": "openvt -sw --",
       }
 
       machine.wait_for_x()
diff --git a/pkgs/applications/audio/squeezelite/default.nix b/pkgs/applications/audio/squeezelite/default.nix
index dad4402e2d46..19b72d1c3788 100644
--- a/pkgs/applications/audio/squeezelite/default.nix
+++ b/pkgs/applications/audio/squeezelite/default.nix
@@ -34,13 +34,13 @@ stdenv.mkDerivation {
   pname = binName;
   # versions are specified in `squeezelite.h`
   # see https://github.com/ralph-irving/squeezelite/issues/29
-  version = "1.9.9.1414";
+  version = "1.9.9.1419";
 
   src = fetchFromGitHub {
     owner = "ralph-irving";
     repo = "squeezelite";
-    rev = "dbe69eb8aa88f644cfb46541d6cef72fa666570d";
-    hash = "sha256-BN6eBHMMecucfHwzmho3xi1l2O3YnYcBUE321Rl6xrc=";
+    rev = "226efa300c4cf037e8486bad635e9deb3104636f";
+    hash = "sha256-ZZWliw1prFbBZMFp0QmXg6MKuHPNuFh2lFxQ8bbuWAM=";
   };
 
   buildInputs = [ flac libmad libvorbis mpg123 ]
diff --git a/pkgs/applications/editors/jove/default.nix b/pkgs/applications/editors/jove/default.nix
index ca494a37fa85..fc8026fb5caf 100644
--- a/pkgs/applications/editors/jove/default.nix
+++ b/pkgs/applications/editors/jove/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "jove";
-  version = "4.17.4.8";
+  version = "4.17.4.9";
 
   src = fetchFromGitHub {
     owner = "jonmacs";
     repo = "jove";
     rev = finalAttrs.version;
-    sha256 = "sha256-/n/TgVqyG/WeK+/DZqFZCdkQR4SD5+YmljLlzAehMvw=";
+    sha256 = "sha256-Lo5S3t4vewkpoihVdxa3yRrEzNWeNLHCZHXiLCxOH5o=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/misc/1password-gui/default.nix b/pkgs/applications/misc/1password-gui/default.nix
index e6cf00d669de..3c08f1d8a9da 100644
--- a/pkgs/applications/misc/1password-gui/default.nix
+++ b/pkgs/applications/misc/1password-gui/default.nix
@@ -9,43 +9,43 @@
 let
 
   pname = "1password";
-  version = if channel == "stable" then "8.9.8" else "8.9.10-1.BETA";
+  version = if channel == "stable" then "8.9.10" else "8.9.12-4.BETA";
 
   sources = {
     stable = {
       x86_64-linux = {
         url = "https://downloads.1password.com/linux/tar/stable/x86_64/1password-${version}.x64.tar.gz";
-        sha256 = "sha256-s5GFGsSelnvqdoEgCzU88BG0dc4bUG4IX3fbeciIPIk=";
+        sha256 = "sha256-aoa00W5zvZQeHKd2Eqyrxl5Z1PwLMHc5lkMUskLiD74=";
       };
       aarch64-linux = {
         url = "https://downloads.1password.com/linux/tar/stable/aarch64/1password-${version}.arm64.tar.gz";
-        sha256 = "sha256-wNF9jwHTxuojFQ+s05jhb7dFihE/36cadaBONqrMYF0=";
+        sha256 = "sha256-Zt64UGKI3+DayS6XP7jTE+pxv52tUUZbUHiuzjcm1JI=";
       };
       x86_64-darwin = {
         url = "https://downloads.1password.com/mac/1Password-${version}-x86_64.zip";
-        sha256 = "sha256-Ok0M6jPZ513iTE646PDPu+dK6Y3b/J8oejJQQkQMS2w=";
+        sha256 = "sha256-sx9eASpMcgkIH1GRzJMqSQa5Y5GJlYU/20CZFyFK+OU=";
       };
       aarch64-darwin = {
         url = "https://downloads.1password.com/mac/1Password-${version}-aarch64.zip";
-        sha256 = "sha256-zocY/0IgiGwuY/ZrMbip34HoRp90ATWRpfAIRhyH9M8=";
+        sha256 = "sha256-Z1cEynO9iWZra542CVGmefrTNerMe13OcTAzWXNi8jI=";
       };
     };
     beta = {
       x86_64-linux = {
         url = "https://downloads.1password.com/linux/tar/beta/x86_64/1password-${version}.x64.tar.gz";
-        sha256 = "sha256-fW+9mko1OZ5zlTnbZucOjvjus8KVZA4Mcga/4HJyJL4=";
+        sha256 = "sha256-/WXaLINqLFLft+wrmr+fV0kM9qS5w4etFiGltnzoVdo=";
       };
       aarch64-linux = {
         url = "https://downloads.1password.com/linux/tar/beta/aarch64/1password-${version}.arm64.tar.gz";
-        sha256 = "sha256-jczDhKMCEHjE5yXr5jczSalGa4pVFs7V8BcIhueT88M=";
+        sha256 = "sha256-Zv9uHkFCZ0flBMAwQBjNhqFWhAXKyHBfZk733hbSag4=";
       };
       x86_64-darwin = {
         url = "https://downloads.1password.com/mac/1Password-${version}-x86_64.zip";
-        sha256 = "sha256-apgXMoZ7yNtUgf6efuSjAK6TGFR230FMK4j95OoXgwQ=";
+        sha256 = "sha256-Vryk6nMQY+0NIgwJkZ2j3vrxyhrzxbe96jbyoNbPIR0=";
       };
       aarch64-darwin = {
         url = "https://downloads.1password.com/mac/1Password-${version}-aarch64.zip";
-        sha256 = "sha256-tdGu648joHu5E8ECU1TpkxgfU6ZMHlJAy+VcNDtIscA=";
+        sha256 = "sha256-74iOaNkuPRKUsTNNd7UTpy5ahjoMmxiNT84Op5ztRGk=";
       };
     };
   };
diff --git a/pkgs/applications/misc/gallery-dl/default.nix b/pkgs/applications/misc/gallery-dl/default.nix
index edd5f491cced..2ec4d7df2402 100644
--- a/pkgs/applications/misc/gallery-dl/default.nix
+++ b/pkgs/applications/misc/gallery-dl/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonApplication rec {
   pname = "gallery-dl";
-  version = "1.24.1";
+  version = "1.24.2";
   format = "setuptools";
 
   src = fetchPypi {
     inherit version;
     pname = "gallery_dl";
-    sha256 = "sha256-pjm410aT4+Lj3PBAlibmglNPGlmBgkRoHAg7JrIDp0s=";
+    sha256 = "sha256-KqDprKoqpbNpUrM7nAYj71cuMh6U3s65kqVTW2cHeLc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/applications/networking/cluster/linkerd/default.nix b/pkgs/applications/networking/cluster/linkerd/default.nix
index 83d75d7d189a..896c2ac5a016 100644
--- a/pkgs/applications/networking/cluster/linkerd/default.nix
+++ b/pkgs/applications/networking/cluster/linkerd/default.nix
@@ -2,7 +2,7 @@
 
 (callPackage ./generic.nix { }) {
   channel = "stable";
-  version = "2.12.0";
-  sha256 = "0p8k5c0gzpmqp7qrhfcjrhbgwd2mzsn2qpsv7ym0ywjkvrkg3355";
-  vendorSha256 = "sha256-qjXpzS1ctEQfXFjzyBUiIp6+oqABedpwHqDxQz0DJ8U=";
+  version = "2.12.3";
+  sha256 = "01vnqhn5lc4pv1rgwmmzzf7ynqc4ss0jysqhjq0m5yzll2k40d8z";
+  vendorSha256 = "sha256-7CkeWbgiQIKhuCrJErZrkkx0MD41qxaWAY/18VafLZE=";
 }
diff --git a/pkgs/applications/networking/cluster/talosctl/default.nix b/pkgs/applications/networking/cluster/talosctl/default.nix
index 93f6f97a6a39..fcd2ef9fb5be 100644
--- a/pkgs/applications/networking/cluster/talosctl/default.nix
+++ b/pkgs/applications/networking/cluster/talosctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "talosctl";
-  version = "1.2.7";
+  version = "1.2.8";
 
   src = fetchFromGitHub {
     owner = "siderolabs";
     repo = "talos";
     rev = "v${version}";
-    sha256 = "sha256-AQTBiHlaVFV1fvZ278DYf2XnktnLNa1Hb4qS2D2r/fM=";
+    sha256 = "sha256-5oleIRJHEmIOXLXwBuklY16WhkePAokPGDfcPoxOUo0=";
   };
 
-  vendorSha256 = "sha256-GKDhqIfYmPwbxt+hId3Axr64xOTXkLklZzNYWDo9SG8=";
+  vendorSha256 = "sha256-+jKbBWDBNgDYf6Ka69NqHzB2KAwKIDJWZpjXl3aylBA=";
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/data/misc/v2ray-domain-list-community/default.nix b/pkgs/data/misc/v2ray-domain-list-community/default.nix
index 9fd794d9d5bb..3d44e34f2b0d 100644
--- a/pkgs/data/misc/v2ray-domain-list-community/default.nix
+++ b/pkgs/data/misc/v2ray-domain-list-community/default.nix
@@ -3,12 +3,12 @@
 let
   generator = pkgsBuildBuild.buildGoModule rec {
     pname = "v2ray-domain-list-community";
-    version = "20221130032508";
+    version = "20221223102220";
     src = fetchFromGitHub {
       owner = "v2fly";
       repo = "domain-list-community";
       rev = version;
-      sha256 = "sha256-1UkP88HGh0KBYaekskeQHkJh02veUYmATKJD/wy4erc=";
+      sha256 = "sha256-bvTNxJcogF3KxZbC8jW0PMIiJJZnzubWybDcNK7id8s=";
     };
     vendorSha256 = "sha256-CCY3CgjA1w4svzmkaI2Jt272Rrt5UOt5sbVDAWRRfzk=";
     meta = with lib; {
diff --git a/pkgs/data/misc/v2ray-geoip/default.nix b/pkgs/data/misc/v2ray-geoip/default.nix
index 2842394f7347..4cb78dcf7c99 100644
--- a/pkgs/data/misc/v2ray-geoip/default.nix
+++ b/pkgs/data/misc/v2ray-geoip/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "v2ray-geoip";
-  version = "202212150047";
+  version = "202212220043";
 
   src = fetchFromGitHub {
     owner = "v2fly";
     repo = "geoip";
-    rev = "29c096b1285812a0a9a955b98ff2998c46f9b80a";
-    sha256 = "sha256-44kP+4Bc7fwxNViWiKo7jLtUov+7k60v+7NF7CTkbjg=";
+    rev = "4a54320369805321b90c7c5ca4cdda4f12bdd295";
+    sha256 = "sha256-PFbjzzjeCKL9aak45B+R5Y+H3fTBzdXpyEvvEEdInbQ=";
   };
 
   installPhase = ''
diff --git a/pkgs/development/coq-modules/Cheerios/default.nix b/pkgs/development/coq-modules/Cheerios/default.nix
index d7763d87c9e6..5c79969c756c 100644
--- a/pkgs/development/coq-modules/Cheerios/default.nix
+++ b/pkgs/development/coq-modules/Cheerios/default.nix
@@ -9,5 +9,9 @@ with lib; mkCoqDerivation {
   release."20200201".sha256 = "1h55s6lk47bk0lv5ralh81z55h799jbl9mhizmqwqzy57y8wqgs1";
 
   propagatedBuildInputs = [ StructTact ];
-  preConfigure = "patchShebangs ./configure";
+  preConfigure = ''
+    if [ -f ./configure ]; then
+      patchShebangs ./configure
+    fi
+  '';
 }
diff --git a/pkgs/development/coq-modules/InfSeqExt/default.nix b/pkgs/development/coq-modules/InfSeqExt/default.nix
index 1f11ae8e84a2..7f21386c86f6 100644
--- a/pkgs/development/coq-modules/InfSeqExt/default.nix
+++ b/pkgs/development/coq-modules/InfSeqExt/default.nix
@@ -7,5 +7,9 @@ mkCoqDerivation {
   defaultVersion = if lib.versions.isGe "8.5" coq.version then "20200131" else null;
   release."20200131".rev    = "203d4c20211d6b17741f1fdca46dbc091f5e961a";
   release."20200131".sha256 = "0xylkdmb2dqnnqinf3pigz4mf4zmczcbpjnn59g5g76m7f2cqxl0";
-  preConfigure = "patchShebangs ./configure";
+  preConfigure = ''
+    if [ -f ./configure ]; then
+      patchShebangs ./configure
+    fi
+  '';
 }
diff --git a/pkgs/development/coq-modules/StructTact/default.nix b/pkgs/development/coq-modules/StructTact/default.nix
index 6618e75bab80..3fb8a42cfb56 100644
--- a/pkgs/development/coq-modules/StructTact/default.nix
+++ b/pkgs/development/coq-modules/StructTact/default.nix
@@ -12,5 +12,9 @@ with lib; mkCoqDerivation {
   release."20210328".sha256 = "sha256:1y5r1zm3hli10ah6lnj7n8hxad6rb6rgldd0g7m2fjibzvwqzhdg";
   release."20181102".rev =    "82a85b7ec07e71fa6b30cfc05f6a7bfb09ef2510";
   release."20181102".sha256 = "08zry20flgj7qq37xk32kzmg4fg6d4wi9m7pf9aph8fd3j2a0b5v";
-  preConfigure = "patchShebangs ./configure";
+  preConfigure = ''
+    if [ -f ./configure ]; then
+      patchShebangs ./configure
+    fi
+  '';
 }
diff --git a/pkgs/development/coq-modules/Verdi/default.nix b/pkgs/development/coq-modules/Verdi/default.nix
index 190758855f78..80b964b39042 100644
--- a/pkgs/development/coq-modules/Verdi/default.nix
+++ b/pkgs/development/coq-modules/Verdi/default.nix
@@ -21,5 +21,9 @@ with lib; mkCoqDerivation {
   release."20181102".sha256 = "1vw47c37k5vaa8vbr6ryqy8riagngwcrfmb3rai37yi9xhdqg55z";
 
   propagatedBuildInputs = [ Cheerios InfSeqExt ssreflect ];
-  preConfigure = "patchShebangs ./configure";
+  preConfigure = ''
+    if [ -f ./configure ]; then
+      patchShebangs ./configure
+    fi
+  '';
 }
diff --git a/pkgs/development/interpreters/erlang/R25.nix b/pkgs/development/interpreters/erlang/R25.nix
index 885dd13efef7..0f2dff14fcef 100644
--- a/pkgs/development/interpreters/erlang/R25.nix
+++ b/pkgs/development/interpreters/erlang/R25.nix
@@ -1,6 +1,6 @@
 { mkDerivation }:
 
 mkDerivation {
-  version = "25.1.2";
-  sha256 = "0fn6zyqrgyiznyghkhygak524f3clc3kz91rarq8cqn3r920dmg9";
+  version = "25.2";
+  sha256 = "zZ6i0NIftTcjzB5J51Q16GmVPlc5gPnGfo6EoBT2HY0=";
 }
diff --git a/pkgs/development/libraries/libcouchbase/default.nix b/pkgs/development/libraries/libcouchbase/default.nix
index a1d75d65aa63..50fc23aa5f10 100644
--- a/pkgs/development/libraries/libcouchbase/default.nix
+++ b/pkgs/development/libraries/libcouchbase/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libcouchbase";
-  version = "3.3.2";
+  version = "3.3.3";
 
   src = fetchFromGitHub {
     owner = "couchbase";
     repo = "libcouchbase";
     rev = version;
-    sha256 = "sha256-nGZHAp2ajGHNHjfKTAQrQSlBmyufzP9V8/vRO6S8Ui0=";
+    sha256 = "sha256-kg/dVarfmDibZXLGY4zXfReNQ1DC4T/3g54g8zxNmEs=";
   };
 
   cmakeFlags = [ "-DLCB_NO_MOCK=ON" ];
diff --git a/pkgs/development/libraries/libdigidocpp/default.nix b/pkgs/development/libraries/libdigidocpp/default.nix
index 7d34388aea39..21da1a917bf1 100644
--- a/pkgs/development/libraries/libdigidocpp/default.nix
+++ b/pkgs/development/libraries/libdigidocpp/default.nix
@@ -2,12 +2,12 @@
 , xercesc, xml-security-c, pkg-config, xsd, zlib, xalanc, xxd }:
 
 stdenv.mkDerivation rec {
-  version = "3.14.10";
+  version = "3.14.11";
   pname = "libdigidocpp";
 
   src = fetchurl {
      url = "https://github.com/open-eid/libdigidocpp/releases/download/v${version}/libdigidocpp-${version}.tar.gz";
-     hash = "sha256-n/+R4ho1Qcft3YSKE12oxZjbFHAsUDwoLFNuk5GXf5c=";
+     hash = "sha256-5QYKHwRB5nck5yqukX/UA+M3jFlBvkQ/ekB7JFIY5tI=";
   };
 
   nativeBuildInputs = [ cmake pkg-config xxd ];
diff --git a/pkgs/development/libraries/libredwg/default.nix b/pkgs/development/libraries/libredwg/default.nix
index a3b43e9377e1..155af3f74f4f 100644
--- a/pkgs/development/libraries/libredwg/default.nix
+++ b/pkgs/development/libraries/libredwg/default.nix
@@ -59,7 +59,6 @@ stdenv.mkDerivation rec {
   checkInputs = lib.optionals enablePython [ libxml2 libxml2.dev ];
 
   meta = with lib; {
-    broken = stdenv.isDarwin && stdenv.isAarch64;
     description = "Free implementation of the DWG file format";
     homepage = "https://savannah.gnu.org/projects/libredwg/";
     maintainers = with maintainers; [ tweber ];
diff --git a/pkgs/development/libraries/matio/default.nix b/pkgs/development/libraries/matio/default.nix
index c92c712e1500..a1aee4dd8f51 100644
--- a/pkgs/development/libraries/matio/default.nix
+++ b/pkgs/development/libraries/matio/default.nix
@@ -1,10 +1,10 @@
 { lib, stdenv, fetchurl }:
 stdenv.mkDerivation rec {
   pname = "matio";
-  version = "1.5.22";
+  version = "1.5.23";
   src = fetchurl {
     url = "mirror://sourceforge/matio/${pname}-${version}.tar.gz";
-    sha256 = "sha256-gMPR4iLhFXaLV7feZAo30O58t6O9A52z6pQecfxSBMM=";
+    sha256 = "sha256-n5Hq5mHfRupTwxGhstz/cgUQlbAjxhLXy/wJQGyfTW4=";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/btsmarthub_devicelist/default.nix b/pkgs/development/python-modules/btsmarthub_devicelist/default.nix
new file mode 100644
index 000000000000..540155c07c62
--- /dev/null
+++ b/pkgs/development/python-modules/btsmarthub_devicelist/default.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pytestCheckHook,
+  pythonOlder,
+  requests,
+  responses,
+}:
+buildPythonPackage rec {
+  pname = "btsmarthub_devicelist";
+  version = "0.2.3";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "jxwolstenholme";
+    repo = "btsmarthub_devicelist";
+    rev = "${version}";
+    hash = "sha256-7ncxCpY+A2SuSFa3k21QchrmFs1dPRUMb1r1z/laa6M=";
+  };
+
+  propagatedBuildInputs = [
+    requests
+  ];
+
+  checkInputs = [
+    responses
+    requests
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    "test_btsmarthub2_detection_neither_router_present"
+  ];
+
+  meta = with lib; {
+    description = "Retrieve a list of devices from a bt smarthub or bt smarthub 2 on a local network";
+    homepage = "https://github.com/jxwolstenholme/btsmarthub_devicelist";
+    license = licenses.mit;
+    maintainers = with maintainers; [jamiemagee];
+  };
+}
diff --git a/pkgs/development/python-modules/dacite/default.nix b/pkgs/development/python-modules/dacite/default.nix
index ba74695fb5ea..12b14b226def 100644
--- a/pkgs/development/python-modules/dacite/default.nix
+++ b/pkgs/development/python-modules/dacite/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "dacite";
-  version = "1.6.0";
+  version = "1.7.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -16,19 +16,14 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "konradhalas";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "0nv2bnj3bq2v08ac4p583cnpjq2d6bv5isycgji5i5wg1y082a3d";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-+yWvlJcOmqDkHl3JZfPnIV3C4ieSo4FiBvoUZ0+J4N0=";
   };
 
   checkInputs = [
     pytestCheckHook
   ];
 
-  disabledTests = lib.optionals (pythonAtLeast "3.10") [
-    # https://github.com/konradhalas/dacite/issues/167
-    "test_from_dict_with_union_and_wrong_data"
-  ];
-
   pythonImportsCheck = [
     "dacite"
   ];
@@ -36,6 +31,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python helper to create data classes from dictionaries";
     homepage = "https://github.com/konradhalas/dacite";
+    changelog = "https://github.com/konradhalas/dacite/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/datasette/default.nix b/pkgs/development/python-modules/datasette/default.nix
index 8394befc51e6..91517c564f91 100644
--- a/pkgs/development/python-modules/datasette/default.nix
+++ b/pkgs/development/python-modules/datasette/default.nix
@@ -29,7 +29,7 @@
 
 buildPythonPackage rec {
   pname = "datasette";
-  version = "0.63.2";
+  version = "0.63.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     owner = "simonw";
     repo = pname;
     rev = "refs/tags/${version}";
-    sha256 = "sha256-VDmh2Q/ab5xaNbj0APuQ9pkZ+GHoNXW2crrJXi556Fk=";
+    sha256 = "sha256-SnUhF7QOXwCU288L4BB4JnhtP6XyHsBS1PpaFM32J0w=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/volkszaehler/default.nix b/pkgs/development/python-modules/volkszaehler/default.nix
index cbc51d024a6e..dcb153ba98ca 100644
--- a/pkgs/development/python-modules/volkszaehler/default.nix
+++ b/pkgs/development/python-modules/volkszaehler/default.nix
@@ -8,16 +8,16 @@
 
 buildPythonPackage rec {
   pname = "volkszaehler";
-  version = "0.3.2";
+  version = "0.4.0";
   format = "setuptools";
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "home-assistant-ecosystem";
     repo = "python-volkszaehler";
-    rev = version;
-    sha256 = "sha256-EiruMlhXvbUhCaDtHc3qCLbpp/KHp9rVpk2FmbR4A/k=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-jX0nwBsBYU383LG8f08FVI7Lo9gnyPSQ0fiEF8dQc/M=";
   };
 
   propagatedBuildInputs = [
@@ -35,6 +35,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python module for interacting with the Volkszahler API";
     homepage = "https://github.com/home-assistant-ecosystem/python-volkszaehler";
+    changelog = "https://github.com/home-assistant-ecosystem/python-volkszaehler/releases/tag/${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/tools/azure-static-sites-client/default.nix b/pkgs/development/tools/azure-static-sites-client/default.nix
new file mode 100644
index 000000000000..60d151147251
--- /dev/null
+++ b/pkgs/development/tools/azure-static-sites-client/default.nix
@@ -0,0 +1,97 @@
+{ lib
+, stdenv
+, fetchurl
+, autoPatchelfHook
+, curl
+, icu70
+, libkrb5
+, lttng-ust
+, openssl_1_1
+, zlib
+, azure-static-sites-client
+  # "latest", "stable" or "backup"
+, versionFlavor ? "stable"
+}:
+let
+  versions = lib.importJSON ./versions.json;
+  flavor = with lib; head (filter (x: x.version == versionFlavor) versions);
+  fetchBinary = runtimeId: fetchurl {
+    url = flavor.files.${runtimeId}.url;
+    sha256 = flavor.files.${runtimeId}.sha;
+  };
+  sources = {
+    "x86_64-linux" = fetchBinary "linux-x64";
+    "x86_64-darwin" = fetchBinary "macOS";
+  };
+in
+stdenv.mkDerivation {
+  pname = "StaticSitesClient-${versionFlavor}";
+  version = flavor.buildId;
+
+  src = sources.${stdenv.targetPlatform.system} or (throw "Unsupported platform");
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+  ];
+
+  buildInputs = [
+    curl
+    icu70
+    openssl_1_1
+    libkrb5
+    lttng-ust
+    stdenv.cc.cc.lib
+    zlib
+  ];
+
+  dontUnpack = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    install -m755 "$src" -D "$out/bin/StaticSitesClient"
+
+    for icu_lib in 'icui18n' 'icuuc' 'icudata'; do
+      patchelf --add-needed "lib''${icu_lib}.so.${with lib; head (splitVersion (getVersion icu70.name))}" "$out/bin/StaticSitesClient"
+    done
+
+    patchelf --add-needed 'libgssapi_krb5.so' \
+             --add-needed 'liblttng-ust.so'   \
+             --add-needed 'libssl.so.1.1'     \
+             "$out/bin/StaticSitesClient"
+
+    runHook postInstall
+  '';
+
+  # Stripping kills the binary
+  dontStrip = true;
+
+  # Just make sure the binary executes sucessfully
+  doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    $out/bin/StaticSitesClient version
+
+    runHook postInstallCheck
+  '';
+
+  passthru = {
+    # Create tests for all flavors
+    tests = with lib; genAttrs (map (x: x.version) versions) (versionFlavor:
+      azure-static-sites-client.override { inherit versionFlavor; }
+    );
+    updateScript = ./update.sh;
+  };
+
+  meta = with lib; {
+    description = "Azure static sites client";
+    homepage = "https://github.com/Azure/static-web-apps-cli";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    license = licenses.unfree;
+    mainProgram = "StaticSitesClient";
+    maintainers = with maintainers; [ veehaitch ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/development/tools/azure-static-sites-client/update.sh b/pkgs/development/tools/azure-static-sites-client/update.sh
new file mode 100755
index 000000000000..156771e7f12b
--- /dev/null
+++ b/pkgs/development/tools/azure-static-sites-client/update.sh
@@ -0,0 +1,9 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl
+
+set -euo pipefail
+
+dirname="$(dirname "$0")"
+
+curl -O --silent --output-dir "$dirname" 'https://swalocaldeploy.azureedge.net/downloads/versions.json'
+echo "" >> "$dirname/versions.json"
diff --git a/pkgs/development/tools/azure-static-sites-client/versions.json b/pkgs/development/tools/azure-static-sites-client/versions.json
new file mode 100644
index 000000000000..0cb5de090269
--- /dev/null
+++ b/pkgs/development/tools/azure-static-sites-client/versions.json
@@ -0,0 +1,59 @@
+[
+  {
+    "version": "latest",
+    "buildId": "1.0.021731",
+    "publishDate": "2022-12-14T02:22:20.0230853Z",
+    "files": {
+      "linux-x64": {
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.021731/linux/StaticSitesClient",
+        "sha": "d2f88cf8b855169534c7e330dd95385b993b1c0f83331306e685faa8468a82b5"
+      },
+      "win-x64": {
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.021731/windows/StaticSitesClient.exe",
+        "sha": "525d13ebffd79ea9663a15a4bd2e6d49bca72d20aa44838aa4b83133943d450c"
+      },
+      "osx-x64": {
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.021731/macOS/StaticSitesClient",
+        "sha": "5de3ac4b205d3871e7a8ff3b5869f2a57002277ac7fa6317032239d114e25ab8"
+      }
+    }
+  },
+  {
+    "version": "stable",
+    "buildId": "1.0.021731",
+    "publishDate": "2022-12-14T02:22:20.0230853Z",
+    "files": {
+      "linux-x64": {
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.021731/linux/StaticSitesClient",
+        "sha": "d2f88cf8b855169534c7e330dd95385b993b1c0f83331306e685faa8468a82b5"
+      },
+      "win-x64": {
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.021731/windows/StaticSitesClient.exe",
+        "sha": "525d13ebffd79ea9663a15a4bd2e6d49bca72d20aa44838aa4b83133943d450c"
+      },
+      "osx-x64": {
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.021731/macOS/StaticSitesClient",
+        "sha": "5de3ac4b205d3871e7a8ff3b5869f2a57002277ac7fa6317032239d114e25ab8"
+      }
+    }
+  },
+  {
+    "version": "backup",
+    "buildId": "1.0.021671",
+    "publishDate": "2022-12-08T00:34:47.6310685Z",
+    "files": {
+      "linux-x64": {
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.021671/linux/StaticSitesClient",
+        "sha": "306c2d24cbc6461cdf1fe29e9206ccb9d452ba3514ee9d67a1d7e0f8edbc036f"
+      },
+      "win-x64": {
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.021671/windows/StaticSitesClient.exe",
+        "sha": "ee868ca5e73a6ad8758698c168bb01d07b66288d353813fefe41d441f82b9f1f"
+      },
+      "osx-x64": {
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.021671/macOS/StaticSitesClient",
+        "sha": "5ef513530a45d4b8e135e272f7e7112e900fbb8c8137c19e645a694e71b98c74"
+      }
+    }
+  }
+]
diff --git a/pkgs/development/tools/database/clickhouse-backup/default.nix b/pkgs/development/tools/database/clickhouse-backup/default.nix
index 4db8dbe263ff..81c53082b7ec 100644
--- a/pkgs/development/tools/database/clickhouse-backup/default.nix
+++ b/pkgs/development/tools/database/clickhouse-backup/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "clickhouse-backup";
-  version = "2.1.2";
+  version = "2.1.3";
 
   src = fetchFromGitHub {
     owner = "AlexAkulov";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Vc9zPERRF6AWSOGSiOe6n33Ioc3uOtHQEehfMhPkSFk=";
+    sha256 = "sha256-RaThNBTRBECSeSeJOQ2UsrkBHjSjrS91vIRF/4MGek4=";
   };
 
-  vendorSha256 = "sha256-kbIztD0g+92gxxBYhWILudgFRFCshagmAUs8bY/Z8yg=";
+  vendorSha256 = "sha256-sSN+HAUC9rJc9XMTG8H+Zg7mzZSVxn6Z7dixJ10mOuM=";
 
   ldflags = [
     "-X main.version=${version}"
diff --git a/pkgs/development/tools/fq/default.nix b/pkgs/development/tools/fq/default.nix
index 293e16508276..2145a3ab74c1 100644
--- a/pkgs/development/tools/fq/default.nix
+++ b/pkgs/development/tools/fq/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "fq";
-  version = "0.1.0";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "wader";
     repo = "fq";
     rev = "v${version}";
-    sha256 = "sha256-ZUbeAZGHG7I4NwJZjI92isIMX8M675oI833v3uKZE7U=";
+    sha256 = "sha256-OAdKt5RgLVoTmccN50TUwUAU7VLiTU9hEnDAKxKBRzI=";
   };
 
-  vendorSha256 = "sha256-GGbKoLj8CyfqB90QnOsomZBVd6KwJCTp/MeyKvRopSQ=";
+  vendorSha256 = "sha256-Y9wfeAX0jt3KrpRa5kJi8V8WN/hp4jTcPCbvy0RDGRk=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/development/tools/grpc-gateway/default.nix b/pkgs/development/tools/grpc-gateway/default.nix
index 3870e87dcb45..54e6ccd471dc 100644
--- a/pkgs/development/tools/grpc-gateway/default.nix
+++ b/pkgs/development/tools/grpc-gateway/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "grpc-gateway";
-  version = "2.14.0";
+  version = "2.15.0";
 
   src = fetchFromGitHub {
     owner = "grpc-ecosystem";
     repo = "grpc-gateway";
     rev = "v${version}";
-    sha256 = "sha256-lnNdsDCpeSHtl2lC1IhUw11t3cnGF+37qSM7HDvKLls=";
+    sha256 = "sha256-NOcV3XrSFeb/LYzeZQ0M1l1l4TkC+fVqAXCDUTaMN3c=";
   };
 
-  vendorSha256 = "sha256-dGdnDuRbwg8fU7uB5GaHEWa/zI3w06onqjturvooJQA=";
+  vendorSha256 = "sha256-zYKRWJ09SnE0Y9iahTyODas/04an8x9w+rsY0x4/NRM=";
 
   meta = with lib; {
     description =
diff --git a/pkgs/development/tools/ocaml/omake/default.nix b/pkgs/development/tools/ocaml/omake/default.nix
index bcfd86a2d4de..f6c7955c6863 100644
--- a/pkgs/development/tools/ocaml/omake/default.nix
+++ b/pkgs/development/tools/ocaml/omake/default.nix
@@ -3,11 +3,11 @@
 stdenv.mkDerivation rec {
 
   pname = "omake";
-  version = "0.10.3";
+  version = "0.10.5";
 
   src = fetchurl {
     url = "http://download.camlcity.org/download/${pname}-${version}.tar.gz";
-    sha256 = "07bdg1h5i7qnlv9xq81ad5hfypl10hxm771h4rjyl5cn8plhfcgz";
+    sha256 = "sha256-VOFq2KLBbmZCRgHzfpD7p0iyF8yU1tTbyvTiOcpm98Q=";
   };
 
   buildInputs = [ ocaml ncurses ];
diff --git a/pkgs/development/tools/rust/cargo-semver-checks/default.nix b/pkgs/development/tools/rust/cargo-semver-checks/default.nix
index 19c487368e78..ab86d41d7c53 100644
--- a/pkgs/development/tools/rust/cargo-semver-checks/default.nix
+++ b/pkgs/development/tools/rust/cargo-semver-checks/default.nix
@@ -5,38 +5,38 @@
 , libgit2
 , openssl
 , stdenv
-, Security
+, darwin
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-semver-checks";
-  version = "0.12.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "obi1kenobi";
-    repo = "cargo-semver-check";
+    repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-gB8W/u/Yb/rMMB+654N3Mj4QbTMWGK6cgQKM0lld/10=";
+    sha256 = "sha256-upGVWCK3gEPH6BZ7W410AnQPIWOCeD4sawQqPLRowfw=";
   };
 
-  cargoSha256 = "sha256-ML4cTNtCvaLFkt1QdA34QvAGhrFTO90xw7fsUD2weqQ=";
+  cargoSha256 = "sha256-PYZe7OO/cevictnWGc+NHVpJXctU2XyejF8jPjSNp3M=";
 
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [ libgit2 openssl ] ++ lib.optionals stdenv.isDarwin [
-    Security
+    darwin.apple_sdk.frameworks.Security
   ];
 
   checkFlags = [
     # requires nightly version of cargo-rustdoc
-    "--skip=adapter::tests"
+    "--skip=dump::tests"
     "--skip=query::tests"
   ];
 
   meta = with lib; {
     description = "A tool to scan your Rust crate for semver violations";
-    homepage = "https://github.com/obi1kenobi/cargo-semver-check";
-    license = licenses.asl20;
+    homepage = "https://github.com/obi1kenobi/cargo-semver-checks";
+    license = with licenses; [ mit /* or */ asl20 ];
     maintainers = with maintainers; [ figsoda matthiasbeyer ];
   };
 }
diff --git a/pkgs/games/fheroes2/default.nix b/pkgs/games/fheroes2/default.nix
index 7d3123b3eb93..e1b15b6248f4 100644
--- a/pkgs/games/fheroes2/default.nix
+++ b/pkgs/games/fheroes2/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fheroes2";
-  version = "0.9.21";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "ihhub";
     repo = "fheroes2";
     rev = version;
-    sha256 = "sha256-b4OAuwMgVgZUdLWJp6Rv/+1X+rPcG7piIBk8SlEXoUY=";
+    sha256 = "sha256-86+4rFSvJ3xIVx+qDXZ65TSqIrPkbyoLNo1A+mFPdy8=";
   };
 
   buildInputs = [ gettext glibcLocalesUtf8 libpng SDL2 SDL2_image SDL2_mixer SDL2_ttf zlib ];
diff --git a/pkgs/os-specific/linux/sgx/azure-dcap-client/default.nix b/pkgs/os-specific/linux/sgx/azure-dcap-client/default.nix
new file mode 100644
index 000000000000..5440e4175351
--- /dev/null
+++ b/pkgs/os-specific/linux/sgx/azure-dcap-client/default.nix
@@ -0,0 +1,93 @@
+{ stdenv
+, fetchFromGitHub
+, fetchurl
+, lib
+, curl
+, nlohmann_json
+, openssl
+, pkg-config
+, linkFarmFromDrvs
+, callPackage
+}:
+
+let
+  # Although those headers are also included in the source of `sgx-psw`, the `azure-dcap-client` build needs specific versions
+  filterSparse = list: ''
+    cp -r "$out"/. .
+    find "$out" -mindepth 1 -delete
+    cp ${lib.concatStringsSep " " list} "$out/"
+  '';
+  headers = linkFarmFromDrvs "azure-dcpa-client-intel-headers" [
+    (fetchFromGitHub rec {
+      name = "${repo}-headers";
+      owner = "intel";
+      repo = "SGXDataCenterAttestationPrimitives";
+      rev = "0436284f12f1bd5da7e7a06f6274d36b4c8d39f9";
+      sparseCheckout = [ "QuoteGeneration/quote_wrapper/common/inc/sgx_ql_lib_common.h" ];
+      hash = "sha256-ipKpYHbiwjCUXF/pCArJZy5ko1YX2wqMMdSnMUzhkgY=";
+      postFetch = filterSparse sparseCheckout;
+    })
+    (fetchFromGitHub rec {
+      name = "${repo}-headers";
+      owner = "intel";
+      repo = "linux-sgx";
+      rev = "1ccf25b64abd1c2eff05ead9d14b410b3c9ae7be";
+      hash = "sha256-WJRoS6+NBVJrFmHABEEDpDhW+zbWFUl65AycCkRavfs=";
+      sparseCheckout = [
+        "common/inc/sgx_report.h"
+        "common/inc/sgx_key.h"
+        "common/inc/sgx_attributes.h"
+      ];
+      postFetch = filterSparse sparseCheckout;
+    })
+  ];
+in
+stdenv.mkDerivation rec {
+  pname = "azure-dcap-client";
+  version = "1.11.2";
+
+  src = fetchFromGitHub {
+    owner = "microsoft";
+    repo = pname;
+    rev = version;
+    hash = "sha256-EYj3jnzTyJRl6N7avNf9VrB8r9U6zIE6wBNeVsMtWCA=";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    curl
+    nlohmann_json
+    openssl
+  ];
+
+  postPatch = ''
+    mkdir -p src/Linux/ext/intel
+    find -L '${headers}' -type f -exec ln -s {} src/Linux/ext/intel \;
+
+    substitute src/Linux/Makefile{.in,} \
+      --replace '##CURLINC##' '${curl.dev}/include/curl/' \
+      --replace '$(TEST_SUITE): $(PROVIDER_LIB) $(TEST_SUITE_OBJ)' '$(TEST_SUITE): $(TEST_SUITE_OBJ)'
+  '';
+
+  NIX_CFLAGS_COMPILE = "-Wno-deprecated-declarations";
+
+  makeFlags = [
+    "-C src/Linux"
+    "prefix=$(out)"
+  ];
+
+  # Online test suite; run with
+  # $(nix-build -A sgx-azure-dcap-client.tests.suite)/bin/tests
+  passthru.tests.suite = callPackage ./test-suite.nix { };
+
+  meta = with lib; {
+    description = "Interfaces between SGX SDKs and the Azure Attestation SGX Certification Cache";
+    homepage = "https://github.com/microsoft/azure-dcap-client";
+    maintainers = with maintainers; [ trundle veehaitch ];
+    platforms = [ "x86_64-linux" ];
+    license = [ licenses.mit ];
+  };
+}
diff --git a/pkgs/os-specific/linux/sgx/azure-dcap-client/test-suite.nix b/pkgs/os-specific/linux/sgx/azure-dcap-client/test-suite.nix
new file mode 100644
index 000000000000..71fdb2bab39c
--- /dev/null
+++ b/pkgs/os-specific/linux/sgx/azure-dcap-client/test-suite.nix
@@ -0,0 +1,27 @@
+{ lib
+, sgx-azure-dcap-client
+, gtest
+, makeWrapper
+}:
+sgx-azure-dcap-client.overrideAttrs (oldAttrs: {
+  nativeBuildInputs = oldAttrs.nativeBuildInputs ++ [
+    makeWrapper
+    gtest
+  ];
+
+  buildFlags = [
+    "tests"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D ./src/Linux/tests "$out/bin/tests"
+
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    wrapProgram "$out/bin/tests" --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ sgx-azure-dcap-client ]}"
+  '';
+})
diff --git a/pkgs/os-specific/linux/sgx/psw/default.nix b/pkgs/os-specific/linux/sgx/psw/default.nix
index 2077d23bc9d7..ba2d0967e45d 100644
--- a/pkgs/os-specific/linux/sgx/psw/default.nix
+++ b/pkgs/os-specific/linux/sgx/psw/default.nix
@@ -121,7 +121,7 @@ stdenv.mkDerivation rec {
 
     mkdir $out/bin
     makeWrapper $out/aesm/aesm_service $out/bin/aesm_service \
-      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ protobuf ]}:$out/aesm \
+      --suffix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ protobuf ]}:$out/aesm \
       --chdir "$out/aesm"
 
     # Make sure we didn't forget to handle any files
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 7b8fdcff2b10..b72fa929a7db 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -429,7 +429,8 @@
     "bt_home_hub_5" = ps: with ps; [
     ]; # missing inputs: bthomehub5-devicelist
     "bt_smarthub" = ps: with ps; [
-    ]; # missing inputs: btsmarthub_devicelist
+      btsmarthub_devicelist
+    ];
     "bthome" = ps: with ps; [
       aiohttp-cors
       bleak-retry-connector
diff --git a/pkgs/servers/misc/oven-media-engine/default.nix b/pkgs/servers/misc/oven-media-engine/default.nix
index f41dd379f4cb..0529a2bb0716 100644
--- a/pkgs/servers/misc/oven-media-engine/default.nix
+++ b/pkgs/servers/misc/oven-media-engine/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "oven-media-engine";
-  version = "0.14.17";
+  version = "0.14.18";
 
   src = fetchFromGitHub {
     owner = "AirenSoft";
     repo = "OvenMediaEngine";
     rev = "v${version}";
-    sha256 = "sha256-vCew+JUBCMeVfXm6Vt5nO59o1/N76Nu8aoygEsouCFE=";
+    sha256 = "sha256-M204aIFbs2VmwgZbOmkpuyqOfpom/FnKc6noEVMuZfs=";
   };
 
   sourceRoot = "source/src";
diff --git a/pkgs/servers/x11/xorg/xwayland.nix b/pkgs/servers/x11/xorg/xwayland.nix
index 22e224013617..ae3025461449 100644
--- a/pkgs/servers/x11/xorg/xwayland.nix
+++ b/pkgs/servers/x11/xorg/xwayland.nix
@@ -43,11 +43,11 @@
 
 stdenv.mkDerivation rec {
   pname = "xwayland";
-  version = "22.1.6";
+  version = "22.1.7";
 
   src = fetchurl {
     url = "mirror://xorg/individual/xserver/${pname}-${version}.tar.xz";
-    sha256 = "sha256-nkJD8D0A/RJDWu4520zhBx/EeG/8UlR+igemWrVbDnw=";
+    sha256 = "sha256-1Tr6xscZU/XPZtA9KJ2s2JYdpb0wnB3/El1ZVdnbX3Y=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/tools/admin/exoscale-cli/default.nix b/pkgs/tools/admin/exoscale-cli/default.nix
index 475fbe4cdde0..1c78b5a0278c 100644
--- a/pkgs/tools/admin/exoscale-cli/default.nix
+++ b/pkgs/tools/admin/exoscale-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "exoscale-cli";
-  version = "1.61.0";
+  version = "1.63.0";
 
   src = fetchFromGitHub {
     owner = "exoscale";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-3ak/z6Ww+/VY1/TErQ+CBxq5xte3VeGbCz2P5QlHxLg=";
+    sha256 = "sha256-YRpaPUKExHewuDqIlXjS32Bu6eMHam153Cfbv+crs9M=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/tools/admin/rhoas/default.nix b/pkgs/tools/admin/rhoas/default.nix
new file mode 100644
index 000000000000..d88cedf81ad4
--- /dev/null
+++ b/pkgs/tools/admin/rhoas/default.nix
@@ -0,0 +1,46 @@
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles, testers, rhoas }:
+
+buildGoModule rec {
+  pname = "rhoas";
+  version = "0.51.7";
+
+  src = fetchFromGitHub {
+    owner = "redhat-developer";
+    repo = "app-services-cli";
+    rev = "v${version}";
+    sha256 = "sha256-sgAr9v3nkMZ8linvR5AhYZV0NQuVqMnueGOo/KLqPc0=";
+  };
+
+  vendorSha256 = null;
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/redhat-developer/app-services-cli/internal/build.Version=${version}"
+  ];
+
+  nativeBuildInputs = [installShellFiles];
+
+  # Networking tests fail.
+  doCheck = false;
+
+  postInstall = ''
+    installShellCompletion --cmd rhoas \
+      --bash <($out/bin/rhoas completion bash) \
+      --fish <($out/bin/rhoas completion fish) \
+      --zsh <($out/bin/rhoas completion zsh)
+  '';
+
+  passthru.tests.version = testers.testVersion {
+    package = rhoas;
+    command = "HOME=$TMP rhoas version";
+  };
+
+  meta = with lib; {
+    description = "Command Line Interface for Red Hat OpenShift Application Services";
+    license = licenses.asl20;
+    homepage = "https://github.com/redhat-developer/app-services-cli";
+    changelog = "https://github.com/redhat-developer/app-services-cli/releases/v${version}";
+    maintainers = with maintainers; [stehessel];
+  };
+}
diff --git a/pkgs/tools/backup/percona-xtrabackup/2_4.nix b/pkgs/tools/backup/percona-xtrabackup/2_4.nix
deleted file mode 100644
index 0d2f951c5f89..000000000000
--- a/pkgs/tools/backup/percona-xtrabackup/2_4.nix
+++ /dev/null
@@ -1,6 +0,0 @@
-{ callPackage, ... } @ args:
-
-callPackage ./generic.nix (args // {
-  version = "2.4.26";
-  sha256 = "sha256-/erBv/Asi/MfoSvAcQ647VAgOfiViPunFWmvy/W9J18=";
-})
diff --git a/pkgs/tools/graphics/oxipng/default.nix b/pkgs/tools/graphics/oxipng/default.nix
index 57c7a35e0b94..a48f18af51e9 100644
--- a/pkgs/tools/graphics/oxipng/default.nix
+++ b/pkgs/tools/graphics/oxipng/default.nix
@@ -1,15 +1,15 @@
 { lib, stdenv, fetchCrate, rustPlatform }:
 
 rustPlatform.buildRustPackage rec {
-  version = "7.0.0";
+  version = "8.0.0";
   pname = "oxipng";
 
   src = fetchCrate {
     inherit version pname;
-    hash = "sha256-egAt2XypPFxsOuo8RsIXTmFdmBUe+eZh3p3vlnnx8wo=";
+    hash = "sha256-stTwsU9XK3lF4q2sDgb9A1KG1NnhCfVxYWRiBvlmiqQ=";
   };
 
-  cargoHash = "sha256-GbJU31UBdRai2JLEdx9sPh6rJWnU4RlDL8DooI9MCUg=";
+  cargoHash = "sha256-XMIsdv2AHMGs0tDEWe3cfplZU9CbqEkHd7L5eS+V7j0=";
 
   doCheck = !stdenv.isAarch64 && !stdenv.isDarwin;
 
diff --git a/pkgs/tools/misc/vttest/default.nix b/pkgs/tools/misc/vttest/default.nix
index 33091b418118..0f3096cc4b06 100644
--- a/pkgs/tools/misc/vttest/default.nix
+++ b/pkgs/tools/misc/vttest/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "vttest";
-  version = "20220827";
+  version = "20221111";
 
   src = fetchurl {
     urls = [
       "https://invisible-mirror.net/archives/${pname}/${pname}-${version}.tgz"
       "ftp://ftp.invisible-island.net/${pname}/${pname}-${version}.tgz"
     ];
-    sha256 = "sha256-Vyaq5YE3dzzmzgH+aob8D4PEd2PjBIi/81ubxPyUbOI=";
+    sha256 = "sha256-asC/ZqWAc3gP3rdGMRT1HYCxzJ6O8djHNjBT/Nwxgac=";
   };
 
   meta = with lib; {
diff --git a/pkgs/tools/security/vals/default.nix b/pkgs/tools/security/vals/default.nix
new file mode 100644
index 000000000000..d886908389c3
--- /dev/null
+++ b/pkgs/tools/security/vals/default.nix
@@ -0,0 +1,37 @@
+{ lib, buildGoModule, fetchFromGitHub, testers, vals }:
+
+buildGoModule rec {
+  pname = "vals";
+  version = "0.19.0";
+
+  src = fetchFromGitHub {
+    rev = "v${version}";
+    owner = "variantdev";
+    repo = pname;
+    sha256 = "sha256-0TO8aN1qKpGQnec6hKph6EHkRWb1dfHtyRdFYX0BjM0=";
+  };
+
+  vendorSha256 = "sha256-wxM8g553DCkoL09Icz+HoXB98z1f6mm4qzk01k09++0=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=${version}"
+  ];
+
+  # Tests require connectivity to various backends.
+  doCheck = false;
+
+  passthru.tests.version = testers.testVersion {
+    package = vals;
+    command = "vals version";
+  };
+
+  meta = with lib; {
+    description = "Helm-like configuration values loader with support for various sources";
+    license = licenses.asl20;
+    homepage = "https://github.com/variantdev/vals";
+    changelog = "https://github.com/variantdev/vals/releases/v${version}";
+    maintainers = with maintainers; [ stehessel ];
+  };
+}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index d459d90fd2bc..a77df8b115ee 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1100,6 +1100,7 @@ mapAliases ({
   pentablet-driver = xp-pen-g430-driver; # Added 2022-06-23
   percona-server = percona-server56; # Added 2022-11-01
   percona-server56 = throw "'percona-server56' has been dropped due to lack of maintenance, no upstream support and security issues"; # Added 2022-11-01
+  percona-xtrabackup_2_4 = throw "'percona-xtrabackup_2_4' has been renamed to/replaced by 'percona-xtrabackup'"; # Added 2022-12-23
   perlXMLParser = throw "'perlXMLParser' has been renamed to/replaced by 'perlPackages.XMLParser'"; # Converted to throw 2022-02-22
   perlArchiveCpio = throw "'perlArchiveCpio' has been renamed to/replaced by 'perlPackages.ArchiveCpio'"; # Converted to throw 2022-02-22
   pgadmin = pgadmin4;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index bdbc3f6410eb..31326355f96f 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2697,6 +2697,8 @@ with pkgs;
 
   azure-functions-core-tools = callPackage ../development/tools/azure-functions-core-tools { };
 
+  azure-static-sites-client = callPackage ../development/tools/azure-static-sites-client { };
+
   azure-storage-azcopy = callPackage ../development/tools/azcopy { };
 
   bashblog = callPackage ../tools/text/bashblog { };
@@ -10464,10 +10466,6 @@ with pkgs;
   perceptualdiff = callPackage ../tools/graphics/perceptualdiff { };
 
   percona-xtrabackup = percona-xtrabackup_8_0;
-  percona-xtrabackup_2_4 = callPackage ../tools/backup/percona-xtrabackup/2_4.nix {
-    boost = boost159;
-    openssl = openssl_1_1;
-  };
   percona-xtrabackup_8_0 = callPackage ../tools/backup/percona-xtrabackup/8_0.nix {
     boost = boost177;
     openssl = openssl_1_1;
@@ -11249,6 +11247,8 @@ with pkgs;
 
   rhash = callPackage ../tools/security/rhash { };
 
+  rhoas = callPackage ../tools/admin/rhoas { };
+
   riemann_c_client = callPackage ../tools/misc/riemann-c-client { };
   riemann-tools = callPackage ../tools/misc/riemann-tools { };
 
@@ -13099,6 +13099,8 @@ with pkgs;
 
   urlwatch = callPackage ../tools/networking/urlwatch { };
 
+  vals = callPackage ../tools/security/vals { };
+
   valum = callPackage ../development/web/valum { };
 
   inherit (callPackages ../servers/varnish { })
@@ -14448,12 +14450,12 @@ with pkgs;
 
   gnu-smalltalk = callPackage ../development/compilers/gnu-smalltalk { };
 
-  gccgo = gccgo6;
-  gccgo6 = wrapCC (gcc6.cc.override {
-    name = "gccgo6";
+  gccgo = wrapCC (gcc.cc.override {
+    name = "gccgo";
     langCC = true; #required for go.
     langC = true;
     langGo = true;
+    langJit = true;
     profiledCompiler = false;
   });
 
@@ -15425,9 +15427,7 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) Security;
   };
   cargo-readme = callPackage ../development/tools/rust/cargo-readme {};
-  cargo-semver-checks = callPackage ../development/tools/rust/cargo-semver-checks {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  cargo-semver-checks = callPackage ../development/tools/rust/cargo-semver-checks { };
 
   cargo-show-asm = callPackage ../development/tools/rust/cargo-show-asm { };
 
@@ -26079,6 +26079,8 @@ with pkgs;
 
   seturgent = callPackage ../os-specific/linux/seturgent { };
 
+  sgx-azure-dcap-client = callPackage ../os-specific/linux/sgx/azure-dcap-client { };
+
   sgx-sdk = callPackage ../os-specific/linux/sgx/sdk { };
 
   sgx-ssl = callPackage ../os-specific/linux/sgx/ssl { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index e51082db63f6..d2aa9dad8af3 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1443,6 +1443,8 @@ self: super: with self; {
 
   btrfsutil = callPackage ../development/python-modules/btrfsutil { };
 
+  btsmarthub_devicelist = callPackage ../development/python-modules/btsmarthub_devicelist { };
+
   btsocket = callPackage ../development/python-modules/btsocket { };
 
   bucketstore = callPackage ../development/python-modules/bucketstore { };