diff --git a/pkgs/applications/audio/dragonfly-reverb/default.nix b/pkgs/applications/audio/dragonfly-reverb/default.nix
index 4c62e6a8b6ad..731578d04e46 100644
--- a/pkgs/applications/audio/dragonfly-reverb/default.nix
+++ b/pkgs/applications/audio/dragonfly-reverb/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dragonfly-reverb";
-  version = "3.2.6";
+  version = "3.2.7";
 
   src = fetchFromGitHub {
     owner = "michaelwillis";
     repo = "dragonfly-reverb";
     rev = version;
-    sha256 = "sha256-hTapy/wXt1rRZVdkx2RDW8LS/DcY30p+WaAWgemGqVo=";
+    sha256 = "sha256-DJ6J5PuRFDin6PtkNYjIRI1gEVQkKmnZLhnj7L4JtPM=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/audio/helio-workstation/default.nix b/pkgs/applications/audio/helio-workstation/default.nix
index 9801f2d2b2ad..91505e3da225 100644
--- a/pkgs/applications/audio/helio-workstation/default.nix
+++ b/pkgs/applications/audio/helio-workstation/default.nix
@@ -5,14 +5,14 @@
 
 stdenv.mkDerivation rec {
   pname = "helio-workstation";
-  version = "3.9";
+  version = "3.10";
 
   src = fetchFromGitHub {
     owner = "helio-fm";
     repo = pname;
     rev = version;
     fetchSubmodules = true;
-    sha256 = "sha256-AtgKgw+F5lc0Ma3zOxmk3iaZQp2KZb2FP5F8QvvYTT4=";
+    sha256 = "sha256-TqwebaFZXUto+azVJQlggqAc7WKDxAaXxyXcG8x5S/w=";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/misc/hugo/default.nix b/pkgs/applications/misc/hugo/default.nix
index f1eaadc61c00..87b4f8df8e1b 100644
--- a/pkgs/applications/misc/hugo/default.nix
+++ b/pkgs/applications/misc/hugo/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "hugo";
-  version = "0.104.1";
+  version = "0.104.2";
 
   src = fetchFromGitHub {
     owner = "gohugoio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-cR+S84ROSAnK1FXLX+f3BXKcxp8W/noA9cg0XvEXbaU=";
+    sha256 = "sha256-7GB2bLf6J253oFkTLg8iblE6c2wFYS3WCUqTDsc61/8=";
   };
 
   vendorSha256 = "sha256-K7rQSs4PqFGV4gZ6UevS7S0w0OQykAkHntklKz5vPrU=";
diff --git a/pkgs/applications/misc/qcad/default.nix b/pkgs/applications/misc/qcad/default.nix
index 66c159471d24..0fc2697848d0 100644
--- a/pkgs/applications/misc/qcad/default.nix
+++ b/pkgs/applications/misc/qcad/default.nix
@@ -18,14 +18,14 @@
 
 mkDerivation rec {
   pname = "qcad";
-  version = "3.27.6.7";
+  version = "3.27.6.11";
 
   src = fetchFromGitHub {
     name = "qcad-${version}-src";
     owner = "qcad";
     repo = "qcad";
     rev = "v${version}";
-    sha256 = "sha256-PGGm7XhjGngj2oD8NNh8aQOKRgcdx9qiQu/4ZYBceG8=";
+    sha256 = "sha256-FfbHedJgzZdUpamLL2Wz2P8glaC/IVYCGZQk9EEc83k=";
   };
 
   patches = [
diff --git a/pkgs/applications/networking/cluster/argo-rollouts/default.nix b/pkgs/applications/networking/cluster/argo-rollouts/default.nix
index 266e9f90947e..731fe0553fc5 100644
--- a/pkgs/applications/networking/cluster/argo-rollouts/default.nix
+++ b/pkgs/applications/networking/cluster/argo-rollouts/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "argo-rollouts";
-  version = "1.3.0";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo-rollouts";
     rev = "v${version}";
-    sha256 = "sha256-CsH/qYhi4sw4u7MZMSdNT5fAae5APwrvJQbubDCLbLY=";
+    sha256 = "sha256-qgOhiJdaxauHIoPsMfcdxwrKiv8QD/tFksCbk13Zpiw=";
   };
 
   vendorSha256 = "sha256-gm96rQdQJGsIcxVgEI7sI7BvEETU/+HsQ6PnDjFXb/0=";
diff --git a/pkgs/applications/networking/cluster/werf/default.nix b/pkgs/applications/networking/cluster/werf/default.nix
index 6c0571332179..275bc98ac23d 100644
--- a/pkgs/applications/networking/cluster/werf/default.nix
+++ b/pkgs/applications/networking/cluster/werf/default.nix
@@ -10,13 +10,13 @@
 
 buildGoModule rec {
   pname = "werf";
-  version = "1.2.175";
+  version = "1.2.176";
 
   src = fetchFromGitHub {
     owner = "werf";
     repo = "werf";
     rev = "v${version}";
-    hash = "sha256-p60+IBy9f31BfmKdYlaHPO93mpIpWeOrDa6vFYrL1eQ=";
+    hash = "sha256-E6xRnEIo6ks8E9bWjo8d+mDhYe+nsKIFdUEGS6tbgXM=";
   };
 
   vendorHash = "sha256-NHRPl38/R7yS8Hht118mBc+OBPwfYiHOaGIwryNK8Mo=";
diff --git a/pkgs/applications/networking/feedreaders/newsboat/default.nix b/pkgs/applications/networking/feedreaders/newsboat/default.nix
index a03b03b035f9..464883ef8fca 100644
--- a/pkgs/applications/networking/feedreaders/newsboat/default.nix
+++ b/pkgs/applications/networking/feedreaders/newsboat/default.nix
@@ -3,16 +3,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "newsboat";
-  version = "2.28";
+  version = "2.29";
 
   src = fetchFromGitHub {
     owner = "newsboat";
     repo = "newsboat";
     rev = "r${version}";
-    hash = "sha256-MHbGCGtFPXG+82Qveoiv7f8qqZOxThEYb9y9Kv3pnFc=";
+    hash = "sha256-/R+ahUOgQR71kTZIpsic1gEYxJzbnY8x6AxtkzYTCDo=";
   };
 
-  cargoHash = "sha256-9YcVKZn51fhkE6bZmaNu7PXsSG8j0M4piBnTWtX8Kcg=";
+  cargoHash = "sha256-uHhP5XurJHM31fJqsqW9tumPzzMMOEeEWAAsllazcME=";
 
   # TODO: Check if that's still needed
   postPatch = lib.optionalString stdenv.isDarwin ''
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
index 5c9caf3b67d5..733486b242b1 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@@ -9,7 +9,7 @@
 
 stdenv.mkDerivation rec {
   pname = "signal-desktop";
-  version = "5.61.0"; # Please backport all updates to the stable channel.
+  version = "5.61.1"; # Please backport all updates to the stable channel.
   # All releases have a limited lifetime and "expire" 90 days after the release.
   # When releases "expire" the application becomes unusable until an update is
   # applied. The expiration date for the current release can be extracted with:
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "sha256-1EPOuvul/Dh/gFwgCy7Wme6GYIP1Mi3TofTrIF3kU3g=";
+    sha256 = "sha256-iEWJ0/rzQMZaZKwume+akMgRg71tVwhlovIGC129B/8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
index d295bde3ae5e..530e9377828b 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
@@ -32,7 +32,6 @@
 , jemalloc
 , rnnoise
 , abseil-cpp
-, kcoreaddons
   # Transitive dependencies:
 , util-linuxMinimal
 , pcre
@@ -74,7 +73,7 @@ let
 in
 env.mkDerivation rec {
   pname = "telegram-desktop";
-  version = "4.2.0";
+  version = "4.2.4";
   # Note: Update via pkgs/applications/networking/instant-messengers/telegram/tdesktop/update.py
 
   # Telegram-Desktop with submodules
@@ -83,13 +82,10 @@ env.mkDerivation rec {
     repo = "tdesktop";
     rev = "v${version}";
     fetchSubmodules = true;
-    sha256 = "1wpqn79pbarz48kmrh6gciw4a9y5hiki5qczlvj8smvx9is6yrf8";
+    sha256 = "sha256-X2ZbjlL3YbPdXSgS+wqZL3FUW2xQ0DhqiOO5MR1QyLY=";
   };
 
   postPatch = ''
-    substituteInPlace Telegram/CMakeLists.txt \
-      --replace '"''${TDESKTOP_LAUNCHER_BASENAME}.appdata.xml"' '"''${TDESKTOP_LAUNCHER_BASENAME}.metainfo.xml"'
-
     substituteInPlace Telegram/ThirdParty/libtgvoip/os/linux/AudioInputALSA.cpp \
       --replace '"libasound.so.2"' '"${alsa-lib}/lib/libasound.so.2"'
     substituteInPlace Telegram/ThirdParty/libtgvoip/os/linux/AudioOutputALSA.cpp \
@@ -139,7 +135,6 @@ env.mkDerivation rec {
     jemalloc
     rnnoise
     tg_owt
-    kcoreaddons
     # Transitive dependencies:
     util-linuxMinimal # Required for libmount thus not nativeBuildInputs.
     pcre
diff --git a/pkgs/applications/networking/novnc/default.nix b/pkgs/applications/networking/novnc/default.nix
index a4efc6889ad4..818e8764dd99 100644
--- a/pkgs/applications/networking/novnc/default.nix
+++ b/pkgs/applications/networking/novnc/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub }:
+{ lib, python3, stdenv, substituteAll, fetchFromGitHub }:
 
 stdenv.mkDerivation rec {
   pname = "novnc";
@@ -11,7 +11,12 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-Z+bks7kcwj+Z3uf/t0u25DnGOM60QhSH6uuoIi59jqU=";
   };
 
-  patches = [ ./fix-paths.patch ];
+  patches = with python3.pkgs; [
+    (substituteAll {
+      src = ./websockify.patch;
+      inherit websockify;
+    })
+  ] ++ [ ./fix-paths.patch ];
 
   postPatch = ''
     substituteAllInPlace utils/novnc_proxy
diff --git a/pkgs/applications/networking/novnc/websockify.patch b/pkgs/applications/networking/novnc/websockify.patch
new file mode 100644
index 000000000000..dd335cdbfc6c
--- /dev/null
+++ b/pkgs/applications/networking/novnc/websockify.patch
@@ -0,0 +1,13 @@
+diff --git a/utils/novnc_proxy b/utils/novnc_proxy
+index 0365c1e..7eba2db 100755
+--- a/utils/novnc_proxy
++++ b/utils/novnc_proxy
+@@ -167,7 +167,7 @@ if [[ -d ${HERE}/websockify ]]; then
+ 
+     echo "Using local websockify at $WEBSOCKIFY"
+ else
+-    WEBSOCKIFY_FROMSYSTEM=$(which websockify 2>/dev/null)
++    WEBSOCKIFY_FROMSYSTEM="@websockify@/bin/websockify"
+     WEBSOCKIFY_FROMSNAP=${HERE}/../usr/bin/python2-websockify
+     [ -f $WEBSOCKIFY_FROMSYSTEM ] && WEBSOCKIFY=$WEBSOCKIFY_FROMSYSTEM
+     [ -f $WEBSOCKIFY_FROMSNAP ] && WEBSOCKIFY=$WEBSOCKIFY_FROMSNAP
diff --git a/pkgs/applications/networking/p2p/frostwire/default.nix b/pkgs/applications/networking/p2p/frostwire/default.nix
index 05fb734d7bf2..9f4261e07c81 100644
--- a/pkgs/applications/networking/p2p/frostwire/default.nix
+++ b/pkgs/applications/networking/p2p/frostwire/default.nix
@@ -94,5 +94,6 @@ in stdenv.mkDerivation {
     license = licenses.gpl2;
     maintainers = with maintainers; [ gavin ];
     platforms = [ "x86_64-darwin" "x86_64-linux" "i686-linux" ];
+    broken = true; # at 2022-09-30, errors with changing hash.
   };
 }
diff --git a/pkgs/applications/version-management/git-and-tools/git-branchless/default.nix b/pkgs/applications/version-management/git-and-tools/git-branchless/default.nix
index 902211ef3d7f..c6cd7079191d 100644
--- a/pkgs/applications/version-management/git-and-tools/git-branchless/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-branchless/default.nix
@@ -15,16 +15,24 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "git-branchless";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "arxanas";
     repo = "git-branchless";
     rev = "v${version}";
-    sha256 = "sha256-WFrN5TRFr9xHBUawTfvri0qlTiWCfAeC5SL+T6mwlU0=";
+    sha256 = "sha256-jAc17poNTld3eptN1Vd1MOKS5iloMWkq3oZgpWBkGTY=";
   };
 
-  cargoSha256 = "sha256-AGW1jUKPc5iiuDlgIDHG1sOn1flAB3UdxJJNKPH5+f8=";
+  cargoPatches = [
+    (fetchpatch {
+      name = "build-run-cargo-update";
+      url = "https://github.com/arxanas/git-branchless/commit/0ac3f325520f79d15368aa9d14893ebc17313ab6.patch";
+      sha256 = "sha256-S1kazUzvz3FzFpphSRhWiv/l2b/+zC9HtAl7ndq5aJA=";
+    })
+  ];
+
+  cargoSha256 = "sha256-Lo/Q6OSIzWrRNiTGsOWRX+6FEcj4fk1kn7V9tw67UVo=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/development/libraries/armadillo/default.nix b/pkgs/development/libraries/armadillo/default.nix
index 2eea7e2c0e9b..5f67eda61a20 100644
--- a/pkgs/development/libraries/armadillo/default.nix
+++ b/pkgs/development/libraries/armadillo/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "armadillo";
-  version = "11.2.4";
+  version = "11.4.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/arma/armadillo-${version}.tar.xz";
-    sha256 = "sha256-3EyRlUqxFJC/ZNLfzFSoAvFDk8dWqNVFrBVe7v+n/ZM=";
+    sha256 = "sha256-AWUxFSwCcppgKqbxb0ujsEdXQNXBvSjTTt1yZPR2Rhw=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/python-modules/casa-formats-io/default.nix b/pkgs/development/python-modules/casa-formats-io/default.nix
index beb6dc351420..dc1032567288 100644
--- a/pkgs/development/python-modules/casa-formats-io/default.nix
+++ b/pkgs/development/python-modules/casa-formats-io/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage rec {
   pname = "casa-formats-io";
-  version = "0.1";
+  version = "0.2";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "16rypj65wdfxxrilxfhbk563lxv86if4vvs9zfq3f8bkzdr8xl9s";
+    sha256 = "sha256-omDPTR/RRHosOF+ejZzuGUBO1LAN/SefNQsvnXxezOQ=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/gaphas/default.nix b/pkgs/development/python-modules/gaphas/default.nix
index 52bbf757dc9e..85d1256b0583 100644
--- a/pkgs/development/python-modules/gaphas/default.nix
+++ b/pkgs/development/python-modules/gaphas/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "gaphas";
-  version = "3.7.0";
+  version = "3.8.0";
   disabled = pythonOlder "3.7";
 
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-iT8Gez8PgIrdAS9Kd83aY1yOQFL45KB+SES/50wTFEI=";
+    sha256 = "sha256-szES3oLJayboCAMCGKtQqclOcbpYtEn3rg95OPtOZpU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/benthos/default.nix b/pkgs/development/tools/benthos/default.nix
index 8884a8ae8977..a32a2bfe4c8a 100644
--- a/pkgs/development/tools/benthos/default.nix
+++ b/pkgs/development/tools/benthos/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "benthos";
-  version = "4.3.0";
+  version = "4.7.0";
 
   src = fetchFromGitHub {
     owner = "benthosdev";
     repo = "benthos";
     rev = "v${version}";
-    sha256 = "sha256-tRB9eTeyEyPkiR/sph76CMbPjJUNoDzfYuHmtFAzY7E=";
+    sha256 = "sha256-aj4MkVj1+9IcyiPWOilrk/x5Rwtoq9wwP4oCtgeb+vU=";
   };
 
-  vendorSha256 = "sha256-nnaBQ7ADdAdo/+RQzXJHBBpXgTmxny0O/ij+eWsS5YM=";
+  vendorSha256 = "sha256-aQ3z8KBTLHNs5y+8I02AIZc7p5fr10GA99YdizwSJko=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/millet/default.nix b/pkgs/development/tools/millet/default.nix
index abd786167a44..809a2cedbb2c 100644
--- a/pkgs/development/tools/millet/default.nix
+++ b/pkgs/development/tools/millet/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "millet";
-  version = "0.3.11";
+  version = "0.3.12";
 
   src = fetchFromGitHub {
     owner = "azdavis";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-6xuqzeYTbBirkleyrza4y1i2m4sWhTHizq5BtAtoIHo=";
+    sha256 = "sha256-VqcC5RWo7az1SyrdLmbModK9I5za33plXm/PJ8b7Pbk=";
   };
 
-  cargoSha256 = "sha256-DZCeEd/bg8/IlJ/3XgPc28tI8w8j/nH99Bj3HffuqtU=";
+  cargoSha256 = "sha256-1gU1SnKqLsIbipAbczu/WvAGxKHZ2NYhAqXwMAuISa0=";
 
   postPatch = ''
     rm .cargo/config.toml
diff --git a/pkgs/development/tools/protoc-gen-validate/default.nix b/pkgs/development/tools/protoc-gen-validate/default.nix
index c91ce0f3379e..435386ea45ef 100644
--- a/pkgs/development/tools/protoc-gen-validate/default.nix
+++ b/pkgs/development/tools/protoc-gen-validate/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "protoc-gen-validate";
-  version = "0.6.8";
+  version = "0.6.12";
 
   src = fetchFromGitHub {
     owner = "envoyproxy";
     repo = "protoc-gen-validate";
     rev = "v${version}";
-    sha256 = "sha256-s66HfafyiAwr4tvWiPVj7ivWE9C03KTGgI/iu0LgNGk=";
+    sha256 = "sha256-JoOTIteE4/IFsVVXcRI1KYpRONjo3veQ6uCtxYFlz8Y=";
   };
 
   vendorSha256 = "sha256-vFi1DT7o2fyzxO/aZHtdsU1/G/sGmamqZPeql0vQVjs=";
diff --git a/pkgs/development/tools/rq/default.nix b/pkgs/development/tools/rq/default.nix
index 68669e88516b..17a85c0145e8 100644
--- a/pkgs/development/tools/rq/default.nix
+++ b/pkgs/development/tools/rq/default.nix
@@ -1,29 +1,35 @@
-{ stdenv, lib, fetchFromGitHub, rustPlatform }:
+{ lib, rustPlatform, fetchFromGitHub }:
 
 rustPlatform.buildRustPackage rec {
   pname = "rq";
-  version = "1.0.2";
+  version = "1.0.4";
 
   src = fetchFromGitHub {
     owner = "dflemstr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0km9d751jr6c5qy4af6ks7nv3xfn13iqi03wq59a1c73rnf0zinp";
+    sha256 = "sha256-QyYTbMXikLSe3eYJRUALQJxUJjA6VlvaLMwGrxIKfZI=";
   };
 
-  cargoSha256 = "0071q08f75qrxdkbx1b9phqpbj15r79jbh391y32acifi7hr35hj";
+  cargoSha256 = "sha256-WAgWc9rAQBjrsaHP6s3Djpg3iYmfRVC9J9yq0T/zMqA=";
 
   postPatch = ''
     # Remove #[deny(warnings)] which is equivalent to -Werror in C.
     # Prevents build failures when upgrading rustc, which may give more warnings.
     substituteInPlace src/lib.rs \
       --replace "#![deny(warnings)]" ""
+
+    # build script tries to get version information from git
+    # this fixes the --version output
+    rm build.rs
   '';
 
+  VERGEN_SEMVER = version;
+
   meta = with lib; {
     description = "A tool for doing record analysis and transformation";
     homepage = "https://github.com/dflemstr/rq";
     license = with licenses; [ asl20 ];
-    maintainers = with maintainers; [ aristid Br1ght0ne ];
+    maintainers = with maintainers; [ aristid Br1ght0ne figsoda ];
   };
 }
diff --git a/pkgs/development/tools/ruff/default.nix b/pkgs/development/tools/ruff/default.nix
index 0a7994170a50..671d7ba58d9f 100644
--- a/pkgs/development/tools/ruff/default.nix
+++ b/pkgs/development/tools/ruff/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ruff";
-  version = "0.0.48";
+  version = "0.0.49";
 
   src = fetchFromGitHub {
     owner = "charliermarsh";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-KTvssDMy9Gol98jRPxDwjRIPAWNKU2Dx0TKAFvsX2zE=";
+    sha256 = "sha256-Ytjtw13tVn29rfHd5yPg3ZdAzBevHQblPkWZ+i3cX/g=";
   };
 
-  cargoSha256 = "sha256-9OX1s461S5KDfwYq0kEI55LV4FmLGLEWI69wWOmDxtI=";
+  cargoSha256 = "sha256-nryWFPjsipweTFe9Snggv7O/xmtgO7XFDcR6VmBYHkc=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     CoreServices
diff --git a/pkgs/development/tools/shellharden/default.nix b/pkgs/development/tools/shellharden/default.nix
index ee56e58f6ca9..5006c5fe9cba 100644
--- a/pkgs/development/tools/shellharden/default.nix
+++ b/pkgs/development/tools/shellharden/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "shellharden";
-  version = "4.2.0";
+  version = "4.3.0";
 
   src = fetchFromGitHub {
     owner = "anordal";
     repo = pname;
     rev = "v${version}";
-    sha256 = "081b51h88hhyzn9vb9pcszz1wfdj73xwsyfn2ygz708kabzqpvdl";
+    sha256 = "sha256-yOfGMxNaaw5ub7woShDMCJNiz6FgV5IBJN87VmORLvg=";
   };
 
-  cargoSha256 = "1gwlmds417szwvywvm19wv60a83inp52sf46sd05x5vahb8gv8hg";
+  cargoSha256 = "sha256-o3CBnxEQNmvn+h/QArIkzi9xfZzIngvwHpkMT+PItY4=";
 
   postPatch = "patchShebangs moduletests/run";
 
diff --git a/pkgs/development/tools/symfony-cli/default.nix b/pkgs/development/tools/symfony-cli/default.nix
index d231f764a91f..03209f7ba3d2 100644
--- a/pkgs/development/tools/symfony-cli/default.nix
+++ b/pkgs/development/tools/symfony-cli/default.nix
@@ -2,14 +2,14 @@
 
 buildGoModule rec {
   pname = "symfony-cli";
-  version = "5.4.13";
-  vendorSha256 = "sha256-/HJgMCRfSS3ln/bW7pb6x9ugece8MFHTLHARTNMHNEU=";
+  version = "5.4.14";
+  vendorSha256 = "sha256-A0Dq5QoKSFDpif8x27a1O8CGZ9s5PzOycvPfvEp4qn4=";
 
   src = fetchFromGitHub {
     owner = "symfony-cli";
     repo = "symfony-cli";
     rev = "v${version}";
-    sha256 = "sha256-yTCq+kx86TGjDZ9Cx4d4ni1Q8yvgXSmJP3YD1owrLN8=";
+    sha256 = "sha256-XALXgEzVlgUbqatQMBd+blLK9Lt1rJ9+mWEvxhxneIo=";
   };
 
   postInstall = ''
diff --git a/pkgs/servers/squid/default.nix b/pkgs/servers/squid/default.nix
index 23749170386c..41073e8cc839 100644
--- a/pkgs/servers/squid/default.nix
+++ b/pkgs/servers/squid/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "squid";
-  version = "5.6";
+  version = "5.7";
 
   src = fetchurl {
     url = "http://www.squid-cache.org/Versions/v5/${pname}-${version}.tar.xz";
-    sha256 = "sha256-ONJzOKNHWXzg6T0MO+bl9mtnUEF8R0yofuDWG7bRSNs=";
+    hash = "sha256-awdTqrpMnE79Mz5nEkyuz3rWzC04WB8Z0vAyH1t+zYE=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -16,6 +16,8 @@ stdenv.mkDerivation rec {
     perl openldap db cyrus_sasl expat libxml2 openssl
   ] ++ lib.optionals stdenv.isLinux [ libcap pam systemd ];
 
+  enableParallelBuilding = true;
+
   configureFlags = [
     "--enable-ipv6"
     "--disable-strict-error-checking"
diff --git a/pkgs/servers/traefik/default.nix b/pkgs/servers/traefik/default.nix
index 9938a490ff5c..ed6afbc1145e 100644
--- a/pkgs/servers/traefik/default.nix
+++ b/pkgs/servers/traefik/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "traefik";
-  version = "2.8.5";
+  version = "2.8.8";
 
   # Archive with static assets for webui
   src = fetchzip {
     url = "https://github.com/traefik/traefik/releases/download/v${version}/traefik-v${version}.src.tar.gz";
-    sha256 = "sha256-qRnt2ZyGMwnbilaau66/SEJOSWkKyZf1L7CLWVHme5k=";
+    sha256 = "sha256-DfCHoo6CmEzemzOQrjKj0+p1jogMUkT6wFIOXJssn1s=";
     stripRoot = false;
   };
 
-  vendorSha256 = "sha256-6gUnM+axlkzBwVx0OePTybPP1Fk+oqsFRED4+K9Weu4=";
+  vendorSha256 = "sha256-kKm8yvw5KVwXm2xz/8RxXAI+y1jD9IukSZWiRYG/pHA=";
 
   subPackages = [ "cmd/traefik" ];
 
diff --git a/pkgs/tools/graphics/shotgun/default.nix b/pkgs/tools/graphics/shotgun/default.nix
index c7692988677b..7f644a51b278 100644
--- a/pkgs/tools/graphics/shotgun/default.nix
+++ b/pkgs/tools/graphics/shotgun/default.nix
@@ -2,7 +2,7 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "shotgun";
-  version = "2.2.1";
+  version = "2.3.1";
 
   nativeBuildInputs = [ pkg-config ];
 
@@ -12,10 +12,10 @@ rustPlatform.buildRustPackage rec {
     owner = "neXromancers";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ClQP/iNs9b4foDUVpH37YCZyjVSgweHLKnSwnpkRwZI=";
+    sha256 = "sha256-hu8UYia2tu6I6Ii9aZ6vfpbrcDz4yeEDkljGFa5s6VY=";
   };
 
-  cargoSha256 = "sha256-w5s9I7lXO8HN9zHqZQCeqBXSd7jmbsaqMZRwPLnbqNk=";
+  cargoSha256 = "sha256-UOchXeBX+sDuLhwWQRVFCj9loJUyr4IltiAKsQoh5/c=";
 
   meta = with lib; {
     description = "Minimal X screenshot utility";
diff --git a/pkgs/tools/misc/fluent-bit/default.nix b/pkgs/tools/misc/fluent-bit/default.nix
index 4b34c79c4482..7a90a8686959 100644
--- a/pkgs/tools/misc/fluent-bit/default.nix
+++ b/pkgs/tools/misc/fluent-bit/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fluent-bit";
-  version = "1.9.8";
+  version = "1.9.9";
 
   src = fetchFromGitHub {
     owner = "fluent";
     repo = "fluent-bit";
     rev = "v${version}";
-    sha256 = "sha256-qHfEcLqCajGFXlEP6as7kvqFUcEAr74UZ9zSAL+OC/I=";
+    sha256 = "sha256-6+4DOi61WwUstIkHzUU4eBsfeqEUxJY54RccvpXjlJY=";
   };
 
   nativeBuildInputs = [ cmake flex bison ];
diff --git a/pkgs/tools/misc/infracost/default.nix b/pkgs/tools/misc/infracost/default.nix
index f16a1cf16fdc..9f7e0f0bf2cf 100644
--- a/pkgs/tools/misc/infracost/default.nix
+++ b/pkgs/tools/misc/infracost/default.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "infracost";
-  version = "0.10.11";
+  version = "0.10.12";
 
   src = fetchFromGitHub {
     owner = "infracost";
     rev = "v${version}";
     repo = "infracost";
-    sha256 = "sha256-ZBm93lBu6sblc/P5m1igf5K8yJ8ff5qcvECZ9o3Gn6I=";
+    sha256 = "sha256-sobIgUiFMLZ2/vkKO2DIQfEM92eRK1PV+oKaWfwk/nE=";
   };
-  vendorSha256 = "sha256-Hs+WWc2UJtxc2isSfef8xvKDqhWytkUWh6DEq+bbAt4=";
+  vendorSha256 = "sha256-QowKhRakXkkmKDI0vbSjWdftz4nXnjKNpdD4gscR3dM=";
 
   ldflags = [ "-s" "-w" "-X github.com/infracost/infracost/internal/version.Version=v${version}" ];
 
diff --git a/pkgs/tools/networking/getmail6/default.nix b/pkgs/tools/networking/getmail6/default.nix
index fb14bc8923c0..965ef759ff6c 100644
--- a/pkgs/tools/networking/getmail6/default.nix
+++ b/pkgs/tools/networking/getmail6/default.nix
@@ -5,13 +5,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "getmail6";
-  version = "6.18.9";
+  version = "6.18.10";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-qzlURYdE7nv+/wxK3B6WddmhW6xiLS7em3X5O5+CBbI=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-nRi0HUq8jEugFogerFD7Xu9fgn1njfumbwhChz2t4t8=";
   };
 
   # needs a Docker setup
diff --git a/pkgs/tools/networking/netbird/default.nix b/pkgs/tools/networking/netbird/default.nix
index f9bff389805e..e8d4134f1b45 100644
--- a/pkgs/tools/networking/netbird/default.nix
+++ b/pkgs/tools/networking/netbird/default.nix
@@ -14,13 +14,13 @@ let
 in
 buildGoModule rec {
   pname = "netbird";
-  version = "0.9.6";
+  version = "0.9.7";
 
   src = fetchFromGitHub {
     owner = "netbirdio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-VNKVl1C14iZROl3JFHY7+8EYbgZTuoz5rVOOBqkmmo0=";
+    sha256 = "sha256-phFkMJlzNUw5IrjXcAIGSWiGuRismNDuOQFqc5jJU5s=";
   };
 
   vendorSha256 = "sha256-VyYw8Hp2qWoRBeOFsgtxmvFN2cYzuDeYmWAwC/+vjI0=";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 59f045c29651..0e26d5ed13c0 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -31810,10 +31810,7 @@ with pkgs;
 
   toxic = callPackage ../applications/networking/instant-messengers/toxic { };
 
-  toxiproxy = callPackage ../development/tools/toxiproxy {
-    # pinned due to build failure or vendoring problems. When unpinning double check with: nix-build -A $name.go-modules --rebuild
-    buildGoModule = buildGo117Module;
-  };
+  toxiproxy = callPackage ../development/tools/toxiproxy { };
 
   tqsl = callPackage ../applications/radio/tqsl {
     openssl = openssl_1_1;