diff --git a/lib/default.nix b/lib/default.nix
index 791eba8a9301..a0d3339ef08e 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -71,7 +71,7 @@ let
       info showWarnings nixpkgsVersion version isInOldestRelease
       mod compare splitByAndCompare
       functionArgs setFunctionArgs isFunction toFunction
-      toHexString toBaseDigits;
+      toHexString toBaseDigits inPureEvalMode;
     inherit (self.fixedPoints) fix fix' converge extends composeExtensions
       composeManyExtensions makeExtensible makeExtensibleWithCustomName;
     inherit (self.attrsets) attrByPath hasAttrByPath setAttrByPath
diff --git a/lib/modules.nix b/lib/modules.nix
index 0bbf9d43c575..48ddb31508f2 100644
--- a/lib/modules.nix
+++ b/lib/modules.nix
@@ -350,7 +350,7 @@ rec {
           evalModules (evalModulesArgs // {
             modules = regularModules ++ modules;
             specialArgs = evalModulesArgs.specialArgs or {} // specialArgs;
-            prefix = extendArgs.prefix or evalModulesArgs.prefix;
+            prefix = extendArgs.prefix or evalModulesArgs.prefix or [];
             inherit extensionOffset;
           });
 
diff --git a/lib/trivial.nix b/lib/trivial.nix
index e4f95234b21a..ec5dd5a5a5ed 100644
--- a/lib/trivial.nix
+++ b/lib/trivial.nix
@@ -229,6 +229,13 @@ rec {
   */
   inNixShell = builtins.getEnv "IN_NIX_SHELL" != "";
 
+  /* Determine whether the function is being called from inside pure-eval mode
+     by seeing whether `builtins` contains `currentSystem`. If not, we must be in
+     pure-eval mode.
+
+     Type: inPureEvalMode :: bool
+  */
+  inPureEvalMode = ! builtins ? currentSystem;
 
   ## Integer operations
 
diff --git a/nixos/lib/make-options-doc/default.nix b/nixos/lib/make-options-doc/default.nix
index 353fdb87a9f1..3324ef7fcd6f 100644
--- a/nixos/lib/make-options-doc/default.nix
+++ b/nixos/lib/make-options-doc/default.nix
@@ -47,8 +47,11 @@ let
     else if lib.isFunction x then "<function>"
     else x;
 
-  optionsList = lib.flip map optionsListVisible
-   (opt: transformOptions opt
+  rawOpts = lib.optionAttrSetToDocList options;
+  transformedOpts = map transformOptions rawOpts;
+  filteredOpts = lib.filter (opt: opt.visible && !opt.internal) transformedOpts;
+  optionsList = lib.flip map filteredOpts
+   (opt: opt
     // lib.optionalAttrs (opt ? example) { example = substSpecial opt.example; }
     // lib.optionalAttrs (opt ? default) { default = substSpecial opt.default; }
     // lib.optionalAttrs (opt ? type) { type = substSpecial opt.type; }
@@ -90,9 +93,6 @@ let
         '';
     in "<itemizedlist>${lib.concatStringsSep "\n" (map (p: describe (unpack p)) packages)}</itemizedlist>";
 
-  # Remove invisible and internal options.
-  optionsListVisible = lib.filter (opt: opt.visible && !opt.internal) (lib.optionAttrSetToDocList options);
-
   optionsNix = builtins.listToAttrs (map (o: { name = o.name; value = removeAttrs o ["name" "visible" "internal"]; }) optionsList);
 
 in rec {
diff --git a/pkgs/applications/editors/vscode/vscode.nix b/pkgs/applications/editors/vscode/vscode.nix
index 3f4555430a68..912af05e6d3e 100644
--- a/pkgs/applications/editors/vscode/vscode.nix
+++ b/pkgs/applications/editors/vscode/vscode.nix
@@ -14,17 +14,17 @@ let
   archive_fmt = if stdenv.isDarwin then "zip" else "tar.gz";
 
   sha256 = {
-    x86_64-linux = "0yahcv64jblmz5q0ylgg1sghcnyam4nq47var3y18ndjpaqyb1fl";
-    x86_64-darwin = "0zsizwrhc0na9dfics27i48q4x3kz0qq5m2vdjvrgi69y2iy5z4c";
-    aarch64-linux = "01wpi9pdf1fjxfx8w5g5da31q561qw7ykjm9spb3arvnivq20dp2";
-    aarch64-darwin = "0qk22jyn0vypsx8x4cmpab5wrmhqx6hdkm314k8k06mz5cg1v4r3";
-    armv7l-linux = "04r0x31flahzw8y0kkbzqnvcwllifaa0ysr163bb5b8kiyc189kk";
+    x86_64-linux = "1kvb92ygsvzi06nqwd6d9dlqbz44dxcjm0iq1rvvxnr7x33l8218";
+    x86_64-darwin = "0jz0nik6wkqhgmfnhiwsq510hxbc9jw0z7s84154p2lhwcmpsbjp";
+    aarch64-linux = "16jzpzxxmcq690d3w0ph0cnzhpyvjpk8ih48pyzzf25bgp94yi33";
+    aarch64-darwin = "00xw4xml4zijpqj8305gdgn15shllpkv9ld1yh1aqrz11v522w3h";
+    armv7l-linux = "0fzzdh9gkw51djrdwhzi3fbjxkm2l78v72gc0233xm8riq0gczsv";
   }.${system};
 in
   callPackage ./generic.nix rec {
     # Please backport all compatible updates to the stable release.
     # This is important for the extension ecosystem.
-    version = "1.67.2";
+    version = "1.68.0";
     pname = "vscode";
 
     executableName = "code" + lib.optionalString isInsiders "-insiders";
diff --git a/pkgs/applications/networking/n8n/node-packages.nix b/pkgs/applications/networking/n8n/node-packages.nix
index 106107899bb2..1f38f4854d24 100644
--- a/pkgs/applications/networking/n8n/node-packages.nix
+++ b/pkgs/applications/networking/n8n/node-packages.nix
@@ -1102,13 +1102,13 @@ let
         sha512 = "z4oo33lmnvvNRqfUe3YjDGGpqu/L2+wXBIhMtwq6oqZ+exOUAkQYM6zd2VWKF7AIlajOF8ZZuPFfryTG9iLC/w==";
       };
     };
-    "aws-sdk-2.1151.0" = {
+    "aws-sdk-2.1152.0" = {
       name = "aws-sdk";
       packageName = "aws-sdk";
-      version = "2.1151.0";
+      version = "2.1152.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/aws-sdk/-/aws-sdk-2.1151.0.tgz";
-        sha512 = "VvyzXAmWrX+klvwzA+9gSTY7blDnZOTl0UTKrqmFL4K7tOLieGLYTUkpUegcPxCjYgEg7JwvYolYUnUKiHa4oA==";
+        url = "https://registry.npmjs.org/aws-sdk/-/aws-sdk-2.1152.0.tgz";
+        sha512 = "Lqwk0bDhm3vzpYb3AAM9VgGHeDpbB8+o7UJnP9R+CO23kJfi/XRpKihAcbyKDD/AUQ+O1LJaUVpvaJYLS9Am7w==";
       };
     };
     "aws-sign2-0.7.0" = {
@@ -4504,13 +4504,13 @@ let
         sha512 = "etgt+n4LlOkGSJbBTV9VROHA5R7ekIPS4vfh+bCAoJgRrJWdqJCBbpS3osRJ/HrT7R68MzMiY3L3sDJ/Fd8aBg==";
       };
     };
-    "mappersmith-2.38.1" = {
+    "mappersmith-2.39.0" = {
       name = "mappersmith";
       packageName = "mappersmith";
-      version = "2.38.1";
+      version = "2.39.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/mappersmith/-/mappersmith-2.38.1.tgz";
-        sha512 = "ecZ+YyzBK7r3tC8MTaGo5tySHPhB6f9jdxN706Tux6dMlcE2fgwiBM/bf/+Sz5m2yKlTq5ntiahz7xSPgurD6w==";
+        url = "https://registry.npmjs.org/mappersmith/-/mappersmith-2.39.0.tgz";
+        sha512 = "udHrBOOLU3nI2FK4hlnhoZDOT/UzntUJYWTnlJSgBs8GRNsf10Fyk/M6qAfX9Wn6NfZH/KSO5gZ+xHSPTu0gPA==";
       };
     };
     "material-colors-1.2.6" = {
@@ -4837,13 +4837,13 @@ let
         sha512 = "z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==";
       };
     };
-    "n8n-core-0.121.0" = {
+    "n8n-core-0.121.3" = {
       name = "n8n-core";
       packageName = "n8n-core";
-      version = "0.121.0";
+      version = "0.121.3";
       src = fetchurl {
-        url = "https://registry.npmjs.org/n8n-core/-/n8n-core-0.121.0.tgz";
-        sha512 = "dPCj0mVw1KkS+GDNIuvleJh8T0NDDQ62QKUh2YXSdQl7mvtAitKS1qqix3P8HnHYYCWBMjG20mLcnqPAzuA3QQ==";
+        url = "https://registry.npmjs.org/n8n-core/-/n8n-core-0.121.3.tgz";
+        sha512 = "Jg48X3j6MK0OmfNDeo4Ph1RLpdWjxr36aRAJobZHEaf+tT4iQgFNBcC9OChj/IVYG4lVINTIiPstHWJMyNsF0A==";
       };
     };
     "n8n-design-system-0.23.0" = {
@@ -6985,7 +6985,7 @@ let
       version = "2.0.0";
       src = fetchurl {
         url = "https://registry.npmjs.org/supports-color/-/supports-color-2.0.0.tgz";
-        sha1 = "535d045ce6b6363fa40117084629995e9df324c7";
+        sha512 = "KKNVtd6pCYgPIKU4cp2733HWYCpplQhddZLBUryaAHou723x+FRzQ5Df824Fj+IyyuiQTRoub4SnIFfIcrp70g==";
       };
     };
     "supports-color-7.2.0" = {
@@ -7084,7 +7084,7 @@ let
       version = "1.6.0";
       src = fetchurl {
         url = "https://registry.npmjs.org/thenify-all/-/thenify-all-1.6.0.tgz";
-        sha1 = "1a1918d402d8fc3f98fbf234db0bcc8cc10e9726";
+        sha512 = "RNxQH/qI8/t3thXJDwcstUO4zeqo64+Uy/+sNVRBx4Xn2OX+OZ9oP+iJnNFqplFra2ZUVeKCSa2oVWi3T4uVmA==";
       };
     };
     "throttle-debounce-1.1.0" = {
@@ -7102,7 +7102,7 @@ let
       version = "2.3.8";
       src = fetchurl {
         url = "https://registry.npmjs.org/through/-/through-2.3.8.tgz";
-        sha1 = "0dd4c9ffaabc357960b1b724115d7e0e86a2e1f5";
+        sha512 = "w89qg7PI8wAdvX60bMDP+bFoD5Dvhm9oLheFp5O4a2QF0cSBGsBX4qZmadPMvVqlLJBBci+WqGGOAPvcDeNSVg==";
       };
     };
     "through2-2.0.5" = {
@@ -8020,10 +8020,10 @@ in
   n8n = nodeEnv.buildNodePackage {
     name = "n8n";
     packageName = "n8n";
-    version = "0.181.0";
+    version = "0.181.2";
     src = fetchurl {
-      url = "https://registry.npmjs.org/n8n/-/n8n-0.181.0.tgz";
-      sha512 = "6hYVCqKmnrssazcosXwCAPtz2HGzWJG15jdxrQ/ZRq2XnmdK0cgC9B60/yohIDdtFtvB4F9Tn18CC7HOlUYTJg==";
+      url = "https://registry.npmjs.org/n8n/-/n8n-0.181.2.tgz";
+      sha512 = "ntxmXyiPpRNvvIEG9n9MsMt1WC5ZlP4sLY7W1Ta5oBP66Wacslt2eajL6OiO2yFoJseCkhVRcHR2TwIDk4HeYQ==";
     };
     dependencies = [
       sources."@apidevtools/json-schema-ref-parser-8.0.0"
@@ -8236,7 +8236,7 @@ in
         ];
       })
       sources."avsc-5.7.4"
-      (sources."aws-sdk-2.1151.0" // {
+      (sources."aws-sdk-2.1152.0" // {
         dependencies = [
           sources."buffer-4.9.2"
           sources."events-1.1.1"
@@ -8752,7 +8752,7 @@ in
       })
       sources."make-error-1.3.6"
       sources."make-error-cause-2.3.0"
-      sources."mappersmith-2.38.1"
+      sources."mappersmith-2.39.0"
       sources."material-colors-1.2.6"
       sources."md5-2.3.0"
       sources."media-typer-0.3.0"
@@ -8805,7 +8805,7 @@ in
         ];
       })
       sources."mz-2.7.0"
-      sources."n8n-core-0.121.0"
+      sources."n8n-core-0.121.3"
       sources."n8n-design-system-0.23.0"
       sources."n8n-editor-ui-0.147.0"
       (sources."n8n-nodes-base-0.179.0" // {
diff --git a/pkgs/applications/networking/protonvpn-gui/default.nix b/pkgs/applications/networking/protonvpn-gui/default.nix
index e69fa4089930..46ac403b0d89 100644
--- a/pkgs/applications/networking/protonvpn-gui/default.nix
+++ b/pkgs/applications/networking/protonvpn-gui/default.nix
@@ -17,13 +17,13 @@
 
 buildPythonApplication rec {
   pname = "protonvpn-gui";
-  version = "1.9.0";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "ProtonVPN";
     repo = "linux-app";
-    rev = version;
-    sha256 = "sha256-+YLrIhe7kzQHPRk/3D1r56ESS1BdDxP1PFeNIg/kGLw=";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-6IRkJKtdQQ9Yixb9CkT3tGNY0MYFZyvz1/6buZo5eYU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/science/misc/snakemake/default.nix b/pkgs/applications/science/misc/snakemake/default.nix
index 56335397e884..ac44ce6e2135 100644
--- a/pkgs/applications/science/misc/snakemake/default.nix
+++ b/pkgs/applications/science/misc/snakemake/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "snakemake";
-  version = "7.8.1";
+  version = "7.8.2";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "snakemake";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-bb6bu4IiW3zaQ3PP/wgRuIwHihC5/6ZS4YSNRk3Tu4s=";
+    hash = "sha256-ZJg7yJS4uODnXwyuwE0uY5CNg1CYyGqSIFYPntAlU5k=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/desktops/gnome/core/gnome-bluetooth/default.nix b/pkgs/desktops/gnome/core/gnome-bluetooth/default.nix
index 7d8fc2bc8674..678790217808 100644
--- a/pkgs/desktops/gnome/core/gnome-bluetooth/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-bluetooth/default.nix
@@ -26,14 +26,14 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-bluetooth";
-  version = "42.0";
+  version = "42.1";
 
   # TODO: split out "lib"
   outputs = [ "out" "dev" "devdoc" "man" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "PR4nIGc7yaJCYZ3F0jH9bndsGKSdop9DzcQzBVrbAXA=";
+    sha256 = "2f5dZz8npAqGqeI9k8uZNn57Bt9Rhy6KxezJk45Vtes=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/interpreters/php/8.0.nix b/pkgs/development/interpreters/php/8.0.nix
index 60e8192d9bf4..55a8f55a6799 100644
--- a/pkgs/development/interpreters/php/8.0.nix
+++ b/pkgs/development/interpreters/php/8.0.nix
@@ -2,8 +2,8 @@
 
 let
   base = callPackage ./generic.nix (_args // {
-    version = "8.0.19";
-    sha256 = "66Dmf9r2kEsuS4TgZL4KDWGyy2SiP4GgypsaUbw6gzA=";
+    version = "8.0.20";
+    sha256 = "y3Zmv2ftn2yYfUg2yvA9SzZFN+anXlbNXJhnYOzC/dg=";
   });
 
 in
diff --git a/pkgs/development/interpreters/php/8.1.nix b/pkgs/development/interpreters/php/8.1.nix
index 72d00639b622..7c289dbb6cbd 100644
--- a/pkgs/development/interpreters/php/8.1.nix
+++ b/pkgs/development/interpreters/php/8.1.nix
@@ -2,8 +2,8 @@
 
 let
   base = callPackage ./generic.nix (_args // {
-    version = "8.1.6";
-    sha256 = "ezUzBLdAdVT3DT4QGiJqH8It7K5cTELtJwxOOJv6G2Y=";
+    version = "8.1.7";
+    sha256 = "uBZ1PrAFUR5pXZCUXCcJPDI2zHPbEmJlbZ+t1z6tfp0=";
   });
 
 in
diff --git a/pkgs/development/libraries/amtk/default.nix b/pkgs/development/libraries/amtk/default.nix
index 961c63a3037f..30a16cb48df0 100644
--- a/pkgs/development/libraries/amtk/default.nix
+++ b/pkgs/development/libraries/amtk/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "amtk";
-  version = "5.4.0";
+  version = "5.4.1";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "g10IUHo96sie91NRzOu0szWv/qNhuIvQ+mZ/QM53enA=";
+    sha256 = "frq8QpsO67KzI2DJv9vjaOSJs1w83AhqhWz8mzpGanI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gnome-desktop/default.nix b/pkgs/development/libraries/gnome-desktop/default.nix
index 49f21fa54041..32f491c97cec 100644
--- a/pkgs/development/libraries/gnome-desktop/default.nix
+++ b/pkgs/development/libraries/gnome-desktop/default.nix
@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-desktop";
-  version = "42.1";
+  version = "42.2";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-desktop/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-JDOrYG0kTDUk3luBIJTbimcPsR7Z/3GAwtAhrh/J/AU=";
+    sha256 = "sha256-9CsU6sjRRWwr/B+8l+9q/knI3W9XeW6P1f6zkzHtVb0=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/gupnp-av/default.nix b/pkgs/development/libraries/gupnp-av/default.nix
index 52baba6bfa58..0ef4ac9a0192 100644
--- a/pkgs/development/libraries/gupnp-av/default.nix
+++ b/pkgs/development/libraries/gupnp-av/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gupnp-av";
-  version = "0.14.0";
+  version = "0.14.1";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "IK7VRvyILnij8YagyLzlyEHMOkS36lKCmPvcgllvsVY=";
+    sha256 = "t5zgzEsMZtnFS8Ihg6EOVwmgAR0q8nICWUjvyrM6Pk8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/tepl/default.nix b/pkgs/development/libraries/tepl/default.nix
index a10ad67b23d9..e7918ea56e29 100644
--- a/pkgs/development/libraries/tepl/default.nix
+++ b/pkgs/development/libraries/tepl/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tepl";
-  version = "6.0.1";
+  version = "6.0.2";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "J08Fa75V8wpq5EQq0i8VfQTTphtWjZC8hRF7txMgIME=";
+    sha256 = "W0qcbGG9AAVT75eZ9MpiXQX1gBA2+ywvkopJRIyQPAk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/tracker-miners/default.nix b/pkgs/development/libraries/tracker-miners/default.nix
index b4e2e3b78715..3224355e0451 100644
--- a/pkgs/development/libraries/tracker-miners/default.nix
+++ b/pkgs/development/libraries/tracker-miners/default.nix
@@ -47,11 +47,11 @@
 
 stdenv.mkDerivation rec {
   pname = "tracker-miners";
-  version = "3.3.0";
+  version = "3.3.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "izh967d0BhwGrfsmeg4ODz0heZNxvwHQVklaubjdlBc=";
+    sha256 = "Pt3G0nLAKWn6TCwV360MSddtAh8aJ+xwi2m+gCU1PJQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/nim-packages/build-nim-package/default.nix b/pkgs/development/nim-packages/build-nim-package/default.nix
index d32a9543cf20..46d898cc1d22 100644
--- a/pkgs/development/nim-packages/build-nim-package/default.nix
+++ b/pkgs/development/nim-packages/build-nim-package/default.nix
@@ -1,12 +1,13 @@
 { lib, stdenv, nim, nim_builder }:
 
-{ strictDeps ? true, nativeBuildInputs ? [ ], configurePhase ? null
-, buildPhase ? null, checkPhase ? null, installPhase ? null, meta ? { }, ...
-}@attrs:
+{ strictDeps ? true, depsBuildBuild ? [ ], nativeBuildInputs ? [ ]
+, configurePhase ? null, buildPhase ? null, checkPhase ? null
+, installPhase ? null, meta ? { }, ... }@attrs:
 
 stdenv.mkDerivation (attrs // {
   inherit strictDeps;
-  nativeBuildInputs = [ nim nim_builder ] ++ nativeBuildInputs;
+  depsBuildBuild = [ nim_builder ] ++ depsBuildBuild;
+  nativeBuildInputs = [ nim ] ++ nativeBuildInputs;
 
   configurePhase = if isNull configurePhase then ''
     runHook preConfigure
diff --git a/pkgs/development/php-packages/composer/default.nix b/pkgs/development/php-packages/composer/default.nix
index a046f345dbe3..c153aa531409 100644
--- a/pkgs/development/php-packages/composer/default.nix
+++ b/pkgs/development/php-packages/composer/default.nix
@@ -1,14 +1,14 @@
 { mkDerivation, fetchurl, makeWrapper, unzip, lib, php }:
 let
   pname = "composer";
-  version = "2.3.5";
+  version = "2.3.7";
 in
 mkDerivation {
   inherit pname version;
 
   src = fetchurl {
     url = "https://getcomposer.org/download/${version}/composer.phar";
-    sha256 = "sha256-OztaiZwGpGrsKAcnvfUKrRQzT2vEBDbqdrB7ZQhw2PQ=";
+    sha256 = "sha256-Py1GeH1RBw+SK/mRqggyRWb3JvGGB2wqXk6LAajqP9A=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/development/python-modules/azure-mgmt-cognitiveservices/default.nix b/pkgs/development/python-modules/azure-mgmt-cognitiveservices/default.nix
index ea12d27e56bc..312b317d6f62 100644
--- a/pkgs/development/python-modules/azure-mgmt-cognitiveservices/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-cognitiveservices/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-cognitiveservices";
-  version = "13.1.0";
+  version = "13.2.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    hash = "sha256-FXS834v5uDGiEGcQMIv9iaHxhfcW9uY3VmX7l91Tfj4=";
+    hash = "sha256-XUsi5fNpirCTQ9Zz4AdYPvX8/WS7N5sQcT5t2q2YDkg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/azure-mgmt-containerservice/default.nix b/pkgs/development/python-modules/azure-mgmt-containerservice/default.nix
index df03e41d56b9..36e77700b74c 100644
--- a/pkgs/development/python-modules/azure-mgmt-containerservice/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-containerservice/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-containerservice";
-  version = "19.1.0";
+  version = "20.0.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "sha256-t06Cesxvjk31aDxkX2Yj0VzFubWbiAc26LzNTIgVEqs=";
+    sha256 = "sha256-dCPFy24cXij50OH8go2idgCEXakMZu8swT5UcpNIzmA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/exceptiongroup/default.nix b/pkgs/development/python-modules/exceptiongroup/default.nix
index cc6a45c5117f..5fe9e716ddb6 100644
--- a/pkgs/development/python-modules/exceptiongroup/default.nix
+++ b/pkgs/development/python-modules/exceptiongroup/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "exceptiongroup";
-  version = "1.0.0rc7";
+  version = "1.0.0rc8";
   format = "flit";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-IBnm6dbvhP9lxcfEUbdYAsZi1TvLEkq/R60RjTn5oco=";
+    hash = "sha256-aZDCTwa40zyAZc/kPl6KS/o4TgNYvgNq+cxgtjIb0Ro=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/fastavro/default.nix b/pkgs/development/python-modules/fastavro/default.nix
index e4d1bca57309..805914b670b8 100644
--- a/pkgs/development/python-modules/fastavro/default.nix
+++ b/pkgs/development/python-modules/fastavro/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "fastavro";
-  version = "1.4.12";
+  version = "1.5.1";
 
   disabled = pythonOlder "3.6";
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "refs/tags/${version}";
-    sha256 = "sha256-t3SM7pTsl3JLWeJSESzXGONyjufwCHMaqK95JI3isYY=";
+    sha256 = "sha256-kI1KRJ4iQP19hYTSRQ6VHZz+Pg5Ar7CaOB7yUJbHm2Q=";
   };
 
   preBuild = ''
diff --git a/pkgs/development/python-modules/fpyutils/default.nix b/pkgs/development/python-modules/fpyutils/default.nix
index 36064d33d76c..b57e04ec75a6 100644
--- a/pkgs/development/python-modules/fpyutils/default.nix
+++ b/pkgs/development/python-modules/fpyutils/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "fpyutils";
-  version = "2.1.0";
+  version = "2.2.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.5";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "frnmst";
     repo = pname;
     rev = version;
-    sha256 = "sha256-QO7g0wjlaboZwvA+JYL1ax7M8zzCc0hizBdaN2b1TCs=";
+    sha256 = "sha256-QnsLQq5u5Fhy9DJD/UE46NstSPvmHyDjS4WiubSTmSA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/oauthenticator/default.nix b/pkgs/development/python-modules/oauthenticator/default.nix
index b3a4c5db7a0e..08a34aed2155 100644
--- a/pkgs/development/python-modules/oauthenticator/default.nix
+++ b/pkgs/development/python-modules/oauthenticator/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "oauthenticator";
-  version = "15.0.0";
+  version = "15.0.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-d1toYgrufnVd10QhJ4nhQqyDRaq4CjWLDjC+7ABNp6Y=";
+    hash = "sha256-LjC/Ly3wQL55gjCyoWZikvK6ByiS1CEsZXK0/lmzmGA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/sagemaker/default.nix b/pkgs/development/python-modules/sagemaker/default.nix
index 2976f89e9c6e..5bcf2b6d1a4f 100644
--- a/pkgs/development/python-modules/sagemaker/default.nix
+++ b/pkgs/development/python-modules/sagemaker/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "sagemaker";
-  version = "2.93.1";
+  version = "2.94.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-EzIJ9+eo5eaXu4TdsvktHtA/wuqr8HUMqsl2pGyvs40=";
+    hash = "sha256-WASgnF1IwqwiYcNEkHlhbV13rKdTTZgwvLcbBZaBNK8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/snapcast/default.nix b/pkgs/development/python-modules/snapcast/default.nix
index 7e7491fe8b6d..0acf9cfd22c4 100644
--- a/pkgs/development/python-modules/snapcast/default.nix
+++ b/pkgs/development/python-modules/snapcast/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , construct
+, packaging
 , fetchFromGitHub
 , pytestCheckHook
 , pythonOlder
@@ -22,6 +23,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     construct
+    packaging
   ];
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/timetagger/default.nix b/pkgs/development/python-modules/timetagger/default.nix
index db674f2d0227..6b99e9882c37 100644
--- a/pkgs/development/python-modules/timetagger/default.nix
+++ b/pkgs/development/python-modules/timetagger/default.nix
@@ -15,13 +15,13 @@
 
 buildPythonPackage rec {
   pname = "timetagger";
-  version = "22.4.2";
+  version = "22.6.2";
 
   src = fetchFromGitHub {
     owner = "almarklein";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-CWY+5O4Y1dvKQNy1Cclqj4+U6q5vVVj9hZq41MYqXKs=";
+    sha256 = "sha256-8Rl7g0OwjabBI9ekh3+vb+20KsqttvwwzZU0U1ee8dQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/unicrypto/default.nix b/pkgs/development/python-modules/unicrypto/default.nix
index 56a57ccaf0ef..cac681b5b8e0 100644
--- a/pkgs/development/python-modules/unicrypto/default.nix
+++ b/pkgs/development/python-modules/unicrypto/default.nix
@@ -1,23 +1,25 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, pycryptodome
 , pycryptodomex
 , pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "unicrypto";
-  version = "0.0.5";
+  version = "0.0.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-aSQPJgSTNGhh5jlpfi/aJF8UZWx98grm2eaxuzassp4=";
+    hash = "sha256-vGapqRrXkcQJK8plFSup2UmBhlRnFkeLPhXwBtgQyOs=";
   };
 
   propagatedBuildInputs = [
+    pycryptodome
     pycryptodomex
   ];
 
diff --git a/pkgs/development/python-modules/velbus-aio/default.nix b/pkgs/development/python-modules/velbus-aio/default.nix
index 84e1bac03044..2196d9b71f2c 100644
--- a/pkgs/development/python-modules/velbus-aio/default.nix
+++ b/pkgs/development/python-modules/velbus-aio/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "velbus-aio";
-  version = "2022.5.1";
+  version = "2022.6.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "Cereal2nd";
     repo = pname;
     rev = version;
-    sha256 = "sha256-XdPrKNUvAHsqw3nv7Ws2zBYDBqEOEeEUHLdB2+f+p+w=";
+    sha256 = "sha256-YHq194H7T4IxyCvPgA92vkWf7MX+ulXyw/uxo4WRupU=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/tools/continuous-integration/dagger/default.nix b/pkgs/development/tools/continuous-integration/dagger/default.nix
index da7e4b2074b3..79538e4be2ce 100644
--- a/pkgs/development/tools/continuous-integration/dagger/default.nix
+++ b/pkgs/development/tools/continuous-integration/dagger/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "dagger";
-  version = "0.2.12";
+  version = "0.2.18";
 
   src = fetchFromGitHub {
     owner = "dagger";
     repo = "dagger";
     rev = "v${version}";
-    sha256 = "sha256-t58+dfsf6A38RG4uT8SJPi07gkC9dGZo0WpVwN9N31k=";
+    sha256 = "sha256-nxBevv7COhywEYeRq1gXAuLswxe2WgHI0Pm78IvzapM=";
   };
 
-  vendorSha256 = "sha256-7YKuOApIw4SG39BLb4kh7ZuZjhCBduzKo3iS8v8KZZU=";
+  vendorSha256 = "sha256-27cXvgpw4Te0w/rMk6g5jF3UY6N8saArUwfbVO6xpes=";
 
   subPackages = [
     "cmd/dagger"
diff --git a/pkgs/development/tools/misc/clojure-lsp/default.nix b/pkgs/development/tools/misc/clojure-lsp/default.nix
index df5917b972d3..0d878ffe9069 100644
--- a/pkgs/development/tools/misc/clojure-lsp/default.nix
+++ b/pkgs/development/tools/misc/clojure-lsp/default.nix
@@ -2,18 +2,18 @@
 
 buildGraalvmNativeImage rec {
   pname = "clojure-lsp";
-  version = "2022.05.23-13.18.11";
+  version = "2022.05.31-17.35.50";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "sha256-puoHuFk1ZF6pu5SFflL0Zn5Xe4j4be9eCG5svYMSf4I=";
+    sha256 = "sha256-turIdgW1gr+b4rjCTet9demJvtaSdw3INbWgXetngLM=";
   };
 
   jar = fetchurl {
     url = "https://github.com/clojure-lsp/clojure-lsp/releases/download/${version}/clojure-lsp-standalone.jar";
-    sha256 = "47da76d6b6438abf31f32f1e12ce4aca944fb4c88527a61f721f7928e58a2b38";
+    sha256 = "e67140bca87347ab639c40504c897c36307ed64278bb764db41a32627582bd71";
   };
 
   extraNativeImageBuildArgs = [
diff --git a/pkgs/development/web/deno/default.nix b/pkgs/development/web/deno/default.nix
index 402626d9dfd2..c8d5cc2cac3c 100644
--- a/pkgs/development/web/deno/default.nix
+++ b/pkgs/development/web/deno/default.nix
@@ -16,15 +16,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "deno";
-  version = "1.22.2";
+  version = "1.22.3";
 
   src = fetchFromGitHub {
     owner = "denoland";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-HKuP3P7gBimzbhdEr2NwZNkp8hhkN7sJA9qRa0CDVew=";
+    sha256 = "sha256-Ode/kbf2aHgSh+k7ZK0aoVqUTPzfLtWkSF2saP/DG0k=";
   };
-  cargoSha256 = "sha256-hxaqMcvwVeOSybqp10BzJOetVTwCx1mrUIP2H8WjCGw=";
+  cargoSha256 = "sha256-YNJbT+88YDWDv/ydz9sZQ/QddjB+ggK57/6LzKN+zNE=";
 
   postPatch = ''
     # upstream uses lld on aarch64-darwin for faster builds
diff --git a/pkgs/development/web/insomnia/default.nix b/pkgs/development/web/insomnia/default.nix
index ae6200df5ef0..c93be3155ac1 100644
--- a/pkgs/development/web/insomnia/default.nix
+++ b/pkgs/development/web/insomnia/default.nix
@@ -15,16 +15,21 @@ let
   ];
 in stdenv.mkDerivation rec {
   pname = "insomnia";
-  version = "2022.1.1";
+  version = "2022.3.0";
 
   src = fetchurl {
     url =
       "https://github.com/Kong/insomnia/releases/download/core%40${version}/Insomnia.Core-${version}.deb";
-    sha256 = "sha256-AaRiXGdKCzcsY4GEgLr5PO+f7STsR+p7ybGISdJlCVk=";
+    sha256 = "sha256-Y+M9nnJEE8FSrD58Q+spjICqV8zoc7Y2eVJLH/8qYDE=";
   };
 
-  nativeBuildInputs =
-    [ autoPatchelfHook dpkg makeWrapper gobject-introspection wrapGAppsHook ];
+  nativeBuildInputs = [
+    autoPatchelfHook
+    dpkg
+    makeWrapper
+    gobject-introspection
+    wrapGAppsHook
+  ];
 
   buildInputs = [
     alsa-lib
@@ -61,6 +66,7 @@ in stdenv.mkDerivation rec {
 
   dontBuild = true;
   dontConfigure = true;
+  dontWrapGApps = true;
 
   unpackPhase = "dpkg-deb -x $src .";
 
@@ -69,7 +75,6 @@ in stdenv.mkDerivation rec {
 
     mv usr/share/* $out/share/
     mv opt/Insomnia/* $out/share/insomnia
-    mv $out/share/insomnia/*.so $out/lib/
 
     ln -s $out/share/insomnia/insomnia $out/bin/insomnia
     sed -i 's|\/opt\/Insomnia|'$out'/bin|g' $out/share/applications/insomnia.desktop
diff --git a/pkgs/servers/dex/default.nix b/pkgs/servers/dex/default.nix
index 3352911a4434..ed5a0be8913c 100644
--- a/pkgs/servers/dex/default.nix
+++ b/pkgs/servers/dex/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "dex";
-  version = "2.31.2";
+  version = "2.32.0";
 
   src = fetchFromGitHub {
     owner = "dexidp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-x9U+LtcgVYODQoiTkFShdALFfrTIhingrJ43RpHbc78=";
+    sha256 = "sha256-7nuolUA4U99o+bM/pwwd2Q4GPpyxu8TpYRKkCK+b1aI=";
   };
 
-  vendorSha256 = "sha256-l+/qjYokg5zHAFkKxtkdX49HqVW6kfz7OHqs6SRKDYg=";
+  vendorSha256 = "sha256-LXZ/QL2+Ty9oq4BXXWceO3+uyY1EOeU5jqVcakSaE94=";
 
   subPackages = [
     "cmd/dex"
diff --git a/pkgs/servers/http/apache-httpd/2.4.nix b/pkgs/servers/http/apache-httpd/2.4.nix
index d72dcb9170b5..72ad91d017e1 100644
--- a/pkgs/servers/http/apache-httpd/2.4.nix
+++ b/pkgs/servers/http/apache-httpd/2.4.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "apache-httpd";
-  version = "2.4.53";
+  version = "2.4.54";
 
   src = fetchurl {
     url = "mirror://apache/httpd/httpd-${version}.tar.bz2";
-    sha256 = "sha256-0LvREhpXtfKm/5LXuW+AUMWkXT8U2xGPZJedUlhY22M=";
+    sha256 = "sha256-6zl/7u/MryVPjUXeN2jZ1o6Oc4UcSa/VtxdtHs+Aw0A=";
   };
 
   # FIXME: -dev depends on -doc
diff --git a/pkgs/servers/nginx-sso/default.nix b/pkgs/servers/nginx-sso/default.nix
index 572f4d94e72b..56aa8205c5d1 100644
--- a/pkgs/servers/nginx-sso/default.nix
+++ b/pkgs/servers/nginx-sso/default.nix
@@ -1,19 +1,24 @@
-{ buildGoPackage, fetchFromGitHub, lib, nixosTests }:
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, nixosTests
+}:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "nginx-sso";
   version = "0.25.0";
-  rev = "v${version}";
-
-  goPackagePath = "github.com/Luzifer/nginx-sso";
 
   src = fetchFromGitHub {
-    inherit rev;
     owner = "Luzifer";
     repo = "nginx-sso";
-    sha256 = "0z5h92rpr1rcfk11ggsb9w4ipg93fcb9byll7vl4c0mfcqkpm2dr";
+    rev = "v${version}";
+    sha256 = "sha256-uYl6J2auAkboPpT6lRZzI70bCU9LvxfCdCyHfLNIsHw=";
   };
 
+  vendorSha256 = null;
+
+  patches = [ ./rune.patch ];
+
   postInstall = ''
     mkdir -p $out/share
     cp -R $src/frontend $out/share
diff --git a/pkgs/servers/nginx-sso/rune.patch b/pkgs/servers/nginx-sso/rune.patch
new file mode 100644
index 000000000000..5e5480787dec
--- /dev/null
+++ b/pkgs/servers/nginx-sso/rune.patch
@@ -0,0 +1,13 @@
+diff --git i/main.go w/main.go
+index bf80f3d..632f7d6 100644
+--- i/main.go
++++ w/main.go
+@@ -174,7 +174,7 @@ func handleAuthRequest(res http.ResponseWriter, r *http.Request) {
+ 	case plugins.ErrNoValidUserFound:
+ 		// No valid user found, check whether special anonymous "user" has access
+ 		// Username is set to 0x0 character to prevent accidental whitelist-match
+-		if mainCfg.ACL.HasAccess(string(0x0), nil, r) {
++		if mainCfg.ACL.HasAccess(string(rune(0x0)), nil, r) {
+ 			mainCfg.AuditLog.Log(auditEventValidate, r, map[string]string{"result": "anonymous access granted"}) // #nosec G104 - This is only logging
+ 			res.WriteHeader(http.StatusOK)
+ 			return
diff --git a/pkgs/shells/oksh/default.nix b/pkgs/shells/oksh/default.nix
index c56bd179c74f..79fc1e481c02 100644
--- a/pkgs/shells/oksh/default.nix
+++ b/pkgs/shells/oksh/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "oksh";
-  version = "7.0";
+  version = "7.1";
 
   src = fetchFromGitHub {
     owner = "ibara";
     repo = pname;
     rev = "${pname}-${version}";
-    sha256 = "sha256-076nD0aPps6n5qkR3LQJ6Kn2g3mkov+/M0qSvxNLZ6o=";
+    sha256 = "sha256-cRUL4JwwZ1Nfs9exzleEvJYCZz6knKbjnC9xeRMvClA=";
   };
 
   strictDeps = true;
diff --git a/pkgs/tools/misc/fsrx/default.nix b/pkgs/tools/misc/fsrx/default.nix
new file mode 100644
index 000000000000..151d1eefa560
--- /dev/null
+++ b/pkgs/tools/misc/fsrx/default.nix
@@ -0,0 +1,32 @@
+{ lib, fetchFromGitHub, rustPlatform, gitUpdater, testers, fsrx }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "fsrx";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "coloradocolby";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-pKdxYO8Rhck3UYxqiWHDlrlPS4cAPe5jLUu5Dajop/k=";
+  };
+
+  cargoSha256 = "sha256-5h+ou9FLCG/WWMEQPsCTa1q+PovxUJs+6lzQ0L2bKIs=";
+
+  passthru = {
+    updateScript = gitUpdater {
+      inherit pname version;
+      rev-prefix = "v";
+    };
+    tests.version = testers.testVersion {
+      package = fsrx;
+    };
+  };
+
+  meta = with lib; {
+    description = "A flow state reader in the terminal";
+    homepage = "https://github.com/coloradocolby/fsrx";
+    license = licenses.mit;
+    maintainers = with maintainers; [ MoritzBoehme ];
+  };
+}
diff --git a/pkgs/tools/networking/assh/default.nix b/pkgs/tools/networking/assh/default.nix
index a52e9bf00444..34c498181fad 100644
--- a/pkgs/tools/networking/assh/default.nix
+++ b/pkgs/tools/networking/assh/default.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "assh";
-  version = "2.12.2";
+  version = "2.14.0";
 
   src = fetchFromGitHub {
     repo = "advanced-ssh-config";
     owner = "moul";
     rev = "v${version}";
-    sha256 = "sha256-KVxEhA9tXAUhqMZ+MLX7Xk5aoaOcukiVFMLme9eHTUw=";
+    sha256 = "sha256-7I4HFinTuVoy1FIiVJqY7vjd5xms0ciuegwhTHRYDKI=";
   };
 
-  vendorSha256 = "sha256-xLsiYM0gZL5O+Y3IkiMmzJReNW7XFN3Xejz2CkCqp5M=";
+  vendorSha256 = "sha256-2VNMwmZY2sb9ib+v7mRkeZ2zkTUtXMaDvAbd3jyQMZY=";
 
   ldflags = [
     "-s" "-w" "-X moul.io/assh/v2/pkg/version.Version=${version}"
diff --git a/pkgs/tools/networking/networkmanager/applet/default.nix b/pkgs/tools/networking/networkmanager/applet/default.nix
index cca96577ad4c..0cdd01247653 100644
--- a/pkgs/tools/networking/networkmanager/applet/default.nix
+++ b/pkgs/tools/networking/networkmanager/applet/default.nix
@@ -25,11 +25,11 @@
 
 stdenv.mkDerivation rec {
   pname = "network-manager-applet";
-  version = "1.26.0";
+  version = "1.28.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-aWEbKQZK29Vzlf4+Uanr3h6nlGFfd2kARTorvj2M3f0=";
+    sha256 = "sha256-XANIWB3p5hkYWqdLdH8H9AMSQX45Wv4LKTzJVd8U5Jw=";
   };
 
   mesonFlags = [
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index adbbfeff4851..47c442cc8da0 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -95,13 +95,13 @@ in lib.makeExtensible (self: {
 
   # remember to backport updates to the stable branch!
   unstable = lib.lowPrio (common rec {
-    version = "2.8";
-    suffix = "pre20220530_${lib.substring 0 7 src.rev}";
+    version = "2.9";
+    suffix = "pre20220610_${lib.substring 0 7 src.rev}";
     src = fetchFromGitHub {
       owner = "NixOS";
       repo = "nix";
-      rev = "af23d38019a47e5bb4cd6585a1678b37c957130c";
-      sha256 = "sha256-RH77Y4IhbTofNYlLQSGKLL0fJAG9iHSwRNvMEZ4M0VQ=";
+      rev = "45ebaab66594692035f028796200a6db2b1fedaf";
+      sha256 = "sha256-82M5jKdGUxQBfYj+8nK2SvfVv4Uo0YrPxiuWV/fnvtI=";
     };
   });
 })
diff --git a/pkgs/tools/security/metasploit/Gemfile b/pkgs/tools/security/metasploit/Gemfile
index 10ba01253e27..9ef9000b8992 100644
--- a/pkgs/tools/security/metasploit/Gemfile
+++ b/pkgs/tools/security/metasploit/Gemfile
@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 source "https://rubygems.org"
 
-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.2.1"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.2.2"
diff --git a/pkgs/tools/security/metasploit/Gemfile.lock b/pkgs/tools/security/metasploit/Gemfile.lock
index 8df40a01cc2e..62d171cd0dc6 100644
--- a/pkgs/tools/security/metasploit/Gemfile.lock
+++ b/pkgs/tools/security/metasploit/Gemfile.lock
@@ -1,9 +1,9 @@
 GIT
   remote: https://github.com/rapid7/metasploit-framework
-  revision: 4acd1765f0d11144fd01b7812dd66a4c94efa610
-  ref: refs/tags/6.2.1
+  revision: 1bfa54f5d72a9c088ee4a65443753e1d10b05504
+  ref: refs/tags/6.2.2
   specs:
-    metasploit-framework (6.2.1)
+    metasploit-framework (6.2.2)
       actionpack (~> 6.0)
       activerecord (~> 6.0)
       activesupport (~> 6.0)
@@ -20,6 +20,7 @@ GIT
       eventmachine
       faker
       faraday
+      faraday-retry
       faye-websocket
       filesize
       hrr_rb_ssh-ed25519
@@ -31,7 +32,7 @@ GIT
       metasploit-concern
       metasploit-credential
       metasploit-model
-      metasploit-payloads (= 2.0.87)
+      metasploit-payloads (= 2.0.93)
       metasploit_data_models
       metasploit_payloads-mettle (= 1.0.18)
       mqtt
@@ -129,7 +130,7 @@ GEM
     arel-helpers (2.14.0)
       activerecord (>= 3.1.0, < 8)
     aws-eventstream (1.2.0)
-    aws-partitions (1.595.0)
+    aws-partitions (1.598.0)
     aws-sdk-core (3.131.1)
       aws-eventstream (~> 1, >= 1.0.2)
       aws-partitions (~> 1, >= 1.525.0)
@@ -138,7 +139,7 @@ GEM
     aws-sdk-ec2 (1.317.0)
       aws-sdk-core (~> 3, >= 3.127.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-iam (1.68.0)
+    aws-sdk-iam (1.69.0)
       aws-sdk-core (~> 3, >= 3.127.0)
       aws-sigv4 (~> 1.1)
     aws-sdk-kms (1.57.0)
@@ -181,6 +182,7 @@ GEM
       faraday-net_http (~> 2.0)
       ruby2_keywords (>= 0.0.4)
     faraday-net_http (2.0.3)
+    faraday-retry (1.0.3)
     faye-websocket (0.11.1)
       eventmachine (>= 0.12.0)
       websocket-driver (>= 0.5.1)
@@ -235,7 +237,7 @@ GEM
       activemodel (~> 6.0)
       activesupport (~> 6.0)
       railties (~> 6.0)
-    metasploit-payloads (2.0.87)
+    metasploit-payloads (2.0.93)
     metasploit_data_models (5.0.5)
       activerecord (~> 6.0)
       activesupport (~> 6.0)
@@ -256,7 +258,7 @@ GEM
     mustermann (1.1.1)
       ruby2_keywords (~> 0.0.1)
     nessus_rest (0.1.6)
-    net-ldap (0.17.0)
+    net-ldap (0.17.1)
     net-protocol (0.1.3)
       timeout
     net-smtp (0.3.1)
@@ -271,7 +273,7 @@ GEM
       mini_portile2 (~> 2.8.0)
       racc (~> 1.4)
     nori (2.6.0)
-    octokit (4.23.0)
+    octokit (4.24.0)
       faraday (>= 1, < 3)
       sawyer (~> 0.9)
     openssl-ccm (1.2.2)
@@ -300,7 +302,7 @@ GEM
     rails-dom-testing (2.0.3)
       activesupport (>= 4.2.0)
       nokogiri (>= 1.6)
-    rails-html-sanitizer (1.4.2)
+    rails-html-sanitizer (1.4.3)
       loofah (~> 2.3)
     railties (6.1.6)
       actionpack (= 6.1.6)
@@ -376,7 +378,7 @@ GEM
       windows_error (>= 0.1.4)
     rubyntlm (0.6.3)
     rubyzip (2.3.2)
-    sawyer (0.9.1)
+    sawyer (0.9.2)
       addressable (>= 2.3.5)
       faraday (>= 0.17.3, < 3)
     simpleidn (0.2.1)
diff --git a/pkgs/tools/security/metasploit/default.nix b/pkgs/tools/security/metasploit/default.nix
index c72972433ea5..e1d253177f1c 100644
--- a/pkgs/tools/security/metasploit/default.nix
+++ b/pkgs/tools/security/metasploit/default.nix
@@ -15,13 +15,13 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "metasploit-framework";
-  version = "6.2.1";
+  version = "6.2.2";
 
   src = fetchFromGitHub {
     owner = "rapid7";
     repo = "metasploit-framework";
     rev = version;
-    sha256 = "sha256-0BskBkQjj3qvNtaTj4tR4BStVYvyiZ58IICPnP7yhBI=";
+    sha256 = "sha256-Did2OFR/0F3aeS3qbHIRLRmqOlvC29l1yCVZgsdxPAM=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
@@ -56,7 +56,7 @@ in stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Metasploit Framework - a collection of exploits";
-    homepage = "https://github.com/rapid7/metasploit-framework/wiki";
+    homepage = "https://docs.metasploit.com/";
     platforms = platforms.unix;
     license = licenses.bsd3;
     maintainers = with maintainers; [ fab makefu ];
diff --git a/pkgs/tools/security/metasploit/gemset.nix b/pkgs/tools/security/metasploit/gemset.nix
index 3cbdacc33fec..93e43a72ba22 100644
--- a/pkgs/tools/security/metasploit/gemset.nix
+++ b/pkgs/tools/security/metasploit/gemset.nix
@@ -104,10 +104,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0vgm7l4nyj23sif850mfsh170jbkhm7j34686ygc0nfyzzm90c08";
+      sha256 = "1vcw9p4ngkcdrdallp6fgzmj4cgm7i04z1dc8rcxd5awybbglvv8";
       type = "gem";
     };
-    version = "1.595.0";
+    version = "1.598.0";
   };
   aws-sdk-core = {
     groups = ["default"];
@@ -134,10 +134,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "15rhfl5g49422g8bi90dv0cx3imbza99223pqdi4vsg6gwzhszhy";
+      sha256 = "0rms5bbqsgy7wb13y0chm1mw9qasdrbmd5bpdwlkn0ib58s174d6";
       type = "gem";
     };
-    version = "1.68.0";
+    version = "1.69.0";
   };
   aws-sdk-kms = {
     groups = ["default"];
@@ -369,6 +369,16 @@
     };
     version = "2.0.3";
   };
+  faraday-retry = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "153i967yrwnswqgvnnajgwp981k9p50ys1h80yz3q94rygs59ldd";
+      type = "gem";
+    };
+    version = "1.0.3";
+  };
   faye-websocket = {
     groups = ["default"];
     platforms = [];
@@ -604,12 +614,12 @@
     platforms = [];
     source = {
       fetchSubmodules = false;
-      rev = "4acd1765f0d11144fd01b7812dd66a4c94efa610";
-      sha256 = "04l4ybz9r3w041y9x2gjidass570a65qz4yn6sppm3r38h3286yh";
+      rev = "1bfa54f5d72a9c088ee4a65443753e1d10b05504";
+      sha256 = "00rwf73q4n95r1sxkny2bcxal69d25r6rsidg7d5vl3zahw7c9qf";
       type = "git";
       url = "https://github.com/rapid7/metasploit-framework";
     };
-    version = "6.2.1";
+    version = "6.2.2";
   };
   metasploit-model = {
     groups = ["default"];
@@ -626,10 +636,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0dj3vxv17wfjgv24n5wwij2vlbk83s8d69rpxzmkbjpi6qscw17x";
+      sha256 = "0y06rkm2zh13qz1b40srx7dd1f5yl669k01ji4ha41pqn7wcv32v";
       type = "gem";
     };
-    version = "2.0.87";
+    version = "2.0.93";
   };
   metasploit_data_models = {
     groups = ["default"];
@@ -736,10 +746,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1j19yxrz7h3hj7kiiln13c7bz7hvpdqr31bwi88dj64zifr7896n";
+      sha256 = "1ycw0qsw3hap8svakl0i30jkj0ffd4lpyrn17a1j0w8mz5ainmsj";
       type = "gem";
     };
-    version = "0.17.0";
+    version = "0.17.1";
   };
   net-protocol = {
     groups = ["default"];
@@ -827,10 +837,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1h34b0jcvzkivx1n9vgpmys4rzwgsvmd4zij4xhbzc3pi05602zf";
+      sha256 = "0mzrjqsdm4gdiwjpqs089ihfr3l184lfjxlmxvyma85ayyqarmkv";
       type = "gem";
     };
-    version = "4.23.0";
+    version = "4.24.0";
   };
   openssl-ccm = {
     groups = ["default"];
@@ -987,10 +997,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "09qrfi3pgllxb08r024lln9k0qzxs57v0slsj8616xf9c0cwnwbk";
+      sha256 = "1mj0b7ay10a2fgwj70kjw7mlyrp7a5la8lx8zmwhy40bkansdfrf";
       type = "gem";
     };
-    version = "1.4.2";
+    version = "1.4.3";
   };
   railties = {
     groups = ["default"];
@@ -1317,10 +1327,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "054913a0v0jwparf4ajk3k7lhbsrq906f2m10429hr7lkhxfxx2a";
+      sha256 = "1jks1qjbmqm8f9kvwa81vqj39avaj9wdnzc531xm29a55bb74fps";
       type = "gem";
     };
-    version = "0.9.1";
+    version = "0.9.2";
   };
   simpleidn = {
     groups = ["default"];
diff --git a/pkgs/tools/security/rekor/default.nix b/pkgs/tools/security/rekor/default.nix
index 096455f84f14..80f88fa575cf 100644
--- a/pkgs/tools/security/rekor/default.nix
+++ b/pkgs/tools/security/rekor/default.nix
@@ -4,13 +4,13 @@ let
   generic = { pname, packageToBuild, description }:
     buildGoModule rec {
       inherit pname;
-      version = "0.7.0";
+      version = "0.8.0";
 
       src = fetchFromGitHub {
         owner = "sigstore";
         repo = "rekor";
         rev = "v${version}";
-        sha256 = "sha256-JKEo9sm3NiUiIA9eM21FLNdpa/9zg5YdvduW6MASBxA=";
+        sha256 = "sha256-DLgNHyw8PuQ5OS/5okzLqe5/J2m+JFmV4/xgt5fDNRI=";
         # populate values that require us to use git. By doing this in postFetch we
         # can delete .git afterwards and maintain better reproducibility of the src.
         leaveDotGit = true;
@@ -23,7 +23,7 @@ let
         '';
       };
 
-      vendorSha256 = "sha256-QUiQcbzNou3EUpuajJ5AE+g8wZ0XNh+WQ6DaSvfX1fM=";
+      vendorSha256 = "sha256-OZyRIi6y47c9eS8GLClgV4JGbSsvjd6KvED3N8LIe6I=";
 
       nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/system/wslu/default.nix b/pkgs/tools/system/wslu/default.nix
index cab427e16578..cb85505ba421 100644
--- a/pkgs/tools/system/wslu/default.nix
+++ b/pkgs/tools/system/wslu/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wslu";
-  version = "3.2.3";
+  version = "3.2.4";
 
   src = fetchFromGitHub {
     owner = "wslutilities";
     repo = pname;
     rev = "v${version}";
-    sha512 = "2mkvdl65hnwflmi635ngmsm1aqsablz2gypn3a1adby1mwwdc57xym8kkg5359g3mvksac6n43ji2z48lfpvlay64z793q2v0z6by02";
+    hash = "sha256-bZFccqFZF6Xt0yAw6JSONNhosBliHQc7KJQ8Or7UvMA=";
   };
 
   makeFlags = [ "PREFIX=$(out)" ];
diff --git a/pkgs/tools/typesetting/sile/default.nix b/pkgs/tools/typesetting/sile/default.nix
index 565b0345e50a..a56b3991ae0f 100644
--- a/pkgs/tools/typesetting/sile/default.nix
+++ b/pkgs/tools/typesetting/sile/default.nix
@@ -17,8 +17,11 @@
 let
   luaEnv = lua.withPackages(ps: with ps; [
     cassowary
+    cldr
     cosmo
+    fluent
     linenoise
+    loadkit
     lpeg
     lua-zlib
     lua_cliargs
@@ -41,11 +44,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "sile";
-  version = "0.12.5";
+  version = "0.13.0";
 
   src = fetchurl {
     url = "https://github.com/sile-typesetter/sile/releases/download/v${version}/${pname}-${version}.tar.xz";
-    sha256 = "0z9wdiqwarysh3lhxss3w53vq58ml46bdi9ymr853kfl7m4gz5yy";
+    sha256 = "0ff4gcfabr6259nl1nkyfrn2r7mww2q8srvi0wakwxgh427faby3";
   };
 
   configureFlags = [
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 4fb7a2ce6f01..e0e58fec366c 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1324,6 +1324,8 @@ with pkgs;
 
   flycast = callPackage ../applications/emulators/flycast { };
 
+  fsrx = callPackage ../tools/misc/fsrx { };
+
   fsuae = callPackage ../applications/emulators/fs-uae { };
 
   fsuae-launcher = callPackage ../applications/emulators/fs-uae/launcher.nix { };
diff --git a/pkgs/top-level/nim-packages.nix b/pkgs/top-level/nim-packages.nix
index e808ebef8540..a666177a92f1 100644
--- a/pkgs/top-level/nim-packages.nix
+++ b/pkgs/top-level/nim-packages.nix
@@ -1,4 +1,4 @@
-{ lib, pkgs, stdenv, newScope, nim, fetchFromGitHub }:
+{ lib, pkgs, stdenv, newScope, nim, fetchFromGitHub, buildPackages }:
 
 lib.makeScope newScope (self:
   let callPackage = self.callPackage;
@@ -6,7 +6,9 @@ lib.makeScope newScope (self:
     inherit nim;
     nim_builder = callPackage ../development/nim-packages/nim_builder { };
     buildNimPackage =
-      callPackage ../development/nim-packages/build-nim-package { };
+      callPackage ../development/nim-packages/build-nim-package {
+        inherit (buildPackages.buildPackages.nimPackages) nim_builder;
+      };
     fetchNimble = callPackage ../development/nim-packages/fetch-nimble { };
 
     astpatternmatching =