diff --git a/lib/default.nix b/lib/default.nix
index 5a85c5421172..68d73220fa9a 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -119,7 +119,7 @@ let
       mkFixStrictness mkOrder mkBefore mkAfter mkAliasDefinitions
       mkAliasAndWrapDefinitions fixMergeModules mkRemovedOptionModule
       mkRenamedOptionModule mkMergedOptionModule mkChangedOptionModule
-      mkAliasOptionModule doRename;
+      mkAliasOptionModule mkDerivedConfig doRename;
     inherit (self.options) isOption mkEnableOption mkSinkUndeclaredOptions
       mergeDefaultOption mergeOneOption mergeEqualOption getValues
       getFiles optionAttrSetToDocList optionAttrSetToDocList'
diff --git a/lib/modules.nix b/lib/modules.nix
index d9b4000e56bd..92ddc8c5bc70 100644
--- a/lib/modules.nix
+++ b/lib/modules.nix
@@ -956,6 +956,26 @@ rec {
     use = id;
   };
 
+  /* mkDerivedConfig : Option a -> (a -> Definition b) -> Definition b
+
+    Create config definitions with the same priority as the definition of another option.
+    This should be used for option definitions where one option sets the value of another as a convenience.
+    For instance a config file could be set with a `text` or `source` option, where text translates to a `source`
+    value using `mkDerivedConfig options.text (pkgs.writeText "filename.conf")`.
+
+    It takes care of setting the right priority using `mkOverride`.
+  */
+  # TODO: make the module system error message include information about `opt` in
+  # error messages about conflicts. E.g. introduce a variation of `mkOverride` which
+  # adds extra location context to the definition object. This will allow context to be added
+  # to all messages that report option locations "this value was derived from <full option name>
+  # which was defined in <locations>". It can provide a trace of options that contributed
+  # to definitions.
+  mkDerivedConfig = opt: f:
+    mkOverride
+      (opt.highestPrio or defaultPriority)
+      (f opt.value);
+
   doRename = { from, to, visible, warn, use, withPriority ? true }:
     { config, options, ... }:
     let
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 4dbc5909a8f3..b14431dbb7a4 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -7578,6 +7578,12 @@
       fingerprint = "DB43 2895 CF68 F0CE D4B7  EF60 DA01 5B05 B5A1 1B22";
     }];
   };
+  milahu = {
+    email = "milahu@gmail.com";
+    github = "milahu";
+    githubId = 12958815;
+    name = "Milan Hauth";
+  };
   milesbreslin = {
     email = "milesbreslin@gmail.com";
     github = "milesbreslin";
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
index 0f974705558d..a64379b19ef6 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
@@ -1298,6 +1298,21 @@ Superuser created successfully.
           would be parsed as 3 parameters.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <literal>nix.daemonNiceLevel</literal> and
+          <literal>nix.daemonIONiceLevel</literal> have been removed in
+          favour of the new options
+          <link xlink:href="options.html#opt-nix.daemonCPUSchedPolicy"><literal>nix.daemonCPUSchedPolicy</literal></link>,
+          <link xlink:href="options.html#opt-nix.daemonIOSchedClass"><literal>nix.daemonIOSchedClass</literal></link>
+          and
+          <link xlink:href="options.html#opt-nix.daemonIOSchedPriority"><literal>nix.daemonIOSchedPriority</literal></link>.
+          Please refer to the options documentation and the
+          <literal>sched(7)</literal> and
+          <literal>ioprio_set(2)</literal> man pages for guidance on how
+          to use them.
+        </para>
+      </listitem>
       <listitem>
         <para>
           The <literal>coursier</literal> package’s binary was renamed
@@ -1343,6 +1358,13 @@ Superuser created successfully.
           <literal>services.ddclient.passwordFile</literal>.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          The default GNAT version has been changed: The
+          <literal>gnat</literal> attribute now points to
+          <literal>gnat11</literal> instead of <literal>gnat9</literal>.
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
   <section xml:id="sec-release-21.11-notable-changes">
diff --git a/nixos/doc/manual/release-notes/rl-2111.section.md b/nixos/doc/manual/release-notes/rl-2111.section.md
index eeaff0eeda4b..9a76b4cca449 100644
--- a/nixos/doc/manual/release-notes/rl-2111.section.md
+++ b/nixos/doc/manual/release-notes/rl-2111.section.md
@@ -388,6 +388,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - `boot.kernelParams` now only accepts one command line parameter per string. This change is aimed to reduce common mistakes like "param = 12", which would be parsed as 3 parameters.
 
+- `nix.daemonNiceLevel` and `nix.daemonIONiceLevel` have been removed in favour of the new options [`nix.daemonCPUSchedPolicy`](options.html#opt-nix.daemonCPUSchedPolicy), [`nix.daemonIOSchedClass`](options.html#opt-nix.daemonIOSchedClass) and [`nix.daemonIOSchedPriority`](options.html#opt-nix.daemonIOSchedPriority). Please refer to the options documentation and the `sched(7)` and `ioprio_set(2)` man pages for guidance on how to use them.
+
 - The `coursier` package's binary was renamed from `coursier` to `cs`. Completions which haven't worked for a while should now work with the renamed binary. To keep using `coursier`, you can create a shell alias.
 
 - The `services.mosquitto` module has been rewritten to support multiple listeners and per-listener configuration.
@@ -402,6 +404,9 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - The `services.ddclient.password` option was removed, and replaced with `services.ddclient.passwordFile`.
 
+- The default GNAT version has been changed: The `gnat` attribute now points to `gnat11`
+  instead of `gnat9`.
+
 ## Other Notable Changes {#sec-release-21.11-notable-changes}
 
 
diff --git a/nixos/lib/utils.nix b/nixos/lib/utils.nix
index 439b627dc385..f1fa9f07a974 100644
--- a/nixos/lib/utils.nix
+++ b/nixos/lib/utils.nix
@@ -10,7 +10,7 @@ rec {
   # Check whenever fileSystem is needed for boot.  NOTE: Make sure
   # pathsNeededForBoot is closed under the parent relationship, i.e. if /a/b/c
   # is in the list, put /a and /a/b in as well.
-  pathsNeededForBoot = [ "/" "/nix" "/nix/store" "/var" "/var/log" "/var/lib" "/var/lib/nixos" "/etc" ];
+  pathsNeededForBoot = [ "/" "/nix" "/nix/store" "/var" "/var/log" "/var/lib" "/var/lib/nixos" "/etc" "/usr" ];
   fsNeededForBoot = fs: fs.neededForBoot || elem fs.mountPoint pathsNeededForBoot;
 
   # Check whenever `b` depends on `a` as a fileSystem
diff --git a/nixos/modules/services/misc/nix-daemon.nix b/nixos/modules/services/misc/nix-daemon.nix
index d04937004777..4ea45888e5fc 100644
--- a/nixos/modules/services/misc/nix-daemon.nix
+++ b/nixos/modules/services/misc/nix-daemon.nix
@@ -184,34 +184,51 @@ in
         '';
       };
 
-      daemonNiceLevel = mkOption {
-        type = types.int;
-        default = 0;
+      daemonCPUSchedPolicy = mkOption {
+        type = types.enum ["other" "batch" "idle"];
+        default = "other";
+        example = "batch";
         description = ''
-          Nix daemon process priority. This priority propagates to build processes.
-          0 is the default Unix process priority, 19 is the lowest. Note that nix
-          bypasses nix-daemon when running as root and this option does not have
-          any effect in such a case.
+          Nix daemon process CPU scheduling policy. This policy propagates to
+          build processes. other is the default scheduling policy for regular
+          tasks. The batch policy is similar to other, but optimised for
+          non-interactive tasks. idle is for extremely low-priority tasks
+          that should only be run when no other task requires CPU time.
 
-          Please note that if used on a recent Linux kernel with group scheduling,
-          setting the nice level will only have an effect relative to other threads
-          in the same task group. Therefore this option is only useful if
-          autogrouping has been disabled (see the kernel.sched_autogroup_enabled
-          sysctl) and no systemd unit uses any of the per-service CPU accounting
-          features of systemd. Otherwise the Nix daemon process may be placed in a
-          separate task group and the nice level setting will have no effect.
-          Refer to the man pages sched(7) and systemd.resource-control(5) for
-          details.
-        '';
+          Please note that while using the idle policy may greatly improve
+          responsiveness of a system performing expensive builds, it may also
+          slow down and potentially starve crucial configuration updates
+          during load.
+      '';
       };
 
-      daemonIONiceLevel = mkOption {
+      daemonIOSchedClass = mkOption {
+        type = types.enum ["best-effort" "idle"];
+        default = "best-effort";
+        example = "idle";
+        description = ''
+          Nix daemon process I/O scheduling class. This class propagates to
+          build processes. best-effort is the default class for regular tasks.
+          The idle class is for extremely low-priority tasks that should only
+          perform I/O when no other task does.
+
+          Please note that while using the idle scheduling class can improve
+          responsiveness of a system performing expensive builds, it might also
+          slow down or starve crucial configuration updates during load.
+      '';
+      };
+
+      daemonIOSchedPriority = mkOption {
         type = types.int;
         default = 0;
+        example = 1;
         description = ''
-          Nix daemon process I/O priority. This priority propagates to build processes.
-          0 is the default Unix process I/O priority, 7 is the lowest.
-        '';
+          Nix daemon process I/O scheduling priority. This priority propagates
+          to build processes. The supported priorities depend on the
+          scheduling policy: With idle, priorities are not used in scheduling
+          decisions. best-effort supports values in the range 0 (high) to 7
+          (low).
+      '';
       };
 
       buildMachines = mkOption {
@@ -587,8 +604,9 @@ in
         unitConfig.RequiresMountsFor = "/nix/store";
 
         serviceConfig =
-          { Nice = cfg.daemonNiceLevel;
-            IOSchedulingPriority = cfg.daemonIONiceLevel;
+          { CPUSchedulingPolicy = cfg.daemonCPUSchedPolicy;
+            IOSchedulingClass = cfg.daemonIOSchedClass;
+            IOSchedulingPriority = cfg.daemonIOSchedPriority;
             LimitNOFILE = 4096;
           };
 
diff --git a/nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix b/nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix
index 8ae62931a8f9..cca61b9ce930 100644
--- a/nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix
+++ b/nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix
@@ -569,6 +569,16 @@ in {
         these sections offer more flexibility.
       '';
 
+      ca_id = mkOptionalStrParam ''
+        Identity in CA certificate to accept for authentication. The specified
+        identity must be contained in one (intermediate) CA of the remote peer
+        trustchain, either as subject or as subjectAltName. This has the same
+        effect as specifying <literal>cacerts</literal> to force clients under
+        a CA to specific connections; it does not require the CA certificate
+        to be available locally, and can be received from the peer during the
+        IKE exchange.
+      '';
+
       cacerts = mkCommaSepListParam [] ''
         List of CA certificates to accept for
         authentication. The certificates may use a relative path from the
diff --git a/nixos/modules/system/etc/etc.nix b/nixos/modules/system/etc/etc.nix
index 8f14f04a1f64..6cc8c341e6df 100644
--- a/nixos/modules/system/etc/etc.nix
+++ b/nixos/modules/system/etc/etc.nix
@@ -85,7 +85,7 @@ in
       '';
 
       type = with types; attrsOf (submodule (
-        { name, config, ... }:
+        { name, config, options, ... }:
         { options = {
 
             enable = mkOption {
@@ -172,7 +172,8 @@ in
             target = mkDefault name;
             source = mkIf (config.text != null) (
               let name' = "etc-" + baseNameOf name;
-              in mkDefault (pkgs.writeText name' config.text));
+              in mkDerivedConfig options.text (pkgs.writeText name')
+            );
           };
 
         }));
diff --git a/pkgs/applications/blockchains/electrs/default.nix b/pkgs/applications/blockchains/electrs/default.nix
index 84b2a2f736a1..13d0994799ab 100644
--- a/pkgs/applications/blockchains/electrs/default.nix
+++ b/pkgs/applications/blockchains/electrs/default.nix
@@ -3,10 +3,13 @@
 , rustPlatform
 , fetchFromGitHub
 , llvmPackages
-, rocksdb
+, rocksdb_6_23
 , Security
 }:
 
+let
+  rocksdb = rocksdb_6_23;
+in
 rustPlatform.buildRustPackage rec {
   pname = "electrs";
   version = "0.9.2";
@@ -24,12 +27,9 @@ rustPlatform.buildRustPackage rec {
   nativeBuildInputs = [ llvmPackages.clang ];
   LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
 
-  # temporarily disable dynamic linking, which broke with rocksdb update 6.23.3 -> 6.25.3
-  # https://github.com/NixOS/nixpkgs/pull/143524#issuecomment-955053331
-  #
   # link rocksdb dynamically
-  # ROCKSDB_INCLUDE_DIR = "${rocksdb}/include";
-  # ROCKSDB_LIB_DIR = "${rocksdb}/lib";
+  ROCKSDB_INCLUDE_DIR = "${rocksdb}/include";
+  ROCKSDB_LIB_DIR = "${rocksdb}/lib";
 
   buildInputs = lib.optionals stdenv.isDarwin [ Security ];
 
diff --git a/pkgs/applications/blockchains/ledger-live-desktop/default.nix b/pkgs/applications/blockchains/ledger-live-desktop/default.nix
index 636d377ebe48..ac24baa934a4 100644
--- a/pkgs/applications/blockchains/ledger-live-desktop/default.nix
+++ b/pkgs/applications/blockchains/ledger-live-desktop/default.nix
@@ -2,12 +2,12 @@
 
 let
   pname = "ledger-live-desktop";
-  version = "2.34.4";
+  version = "2.35.0";
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "https://github.com/LedgerHQ/${pname}/releases/download/v${version}/${pname}-${version}-linux-x86_64.AppImage";
-    sha256 = "00zl7ywmkbhwzkj7p618rin5pd0ix8cas5q1b8ka6ynw4wlg3w5c";
+    hash = "sha256-o2XGBTqyHqQ/yq54B0GBFEk35Zxt2ZWGZCTjbEbKqiw=";
   };
 
   appimageContents = appimageTools.extractType2 {
diff --git a/pkgs/applications/blockchains/lnd/default.nix b/pkgs/applications/blockchains/lnd/default.nix
index 62dcac327f78..ffd2d926b63c 100644
--- a/pkgs/applications/blockchains/lnd/default.nix
+++ b/pkgs/applications/blockchains/lnd/default.nix
@@ -6,18 +6,18 @@
 
 buildGoModule rec {
   pname = "lnd";
-  version = "0.13.3-beta";
+  version = "0.13.4-beta";
 
   src = fetchFromGitHub {
     owner = "lightningnetwork";
     repo = "lnd";
     rev = "v${version}";
-    sha256 = "05ai8nyrc8likq5n7i9klfi9550ki8sqklv8axjvi6ql8v9bzk61";
+    sha256 = "1ykvhbl5i0kqlh0fpzpjass55clys8bpa28brg7d9fs72zv2ks6x";
   };
 
-  vendorSha256 = "0xf8395g6hifbqwbgapllx38y0759xp374sja7j1wk8sdj5ngql5";
+  vendorSha256 = "13cjb188bzgd3m3p73szxffkab6l7n6wmbvqvicvi9k3mixn5qql";
 
-  subPackages = ["cmd/lncli" "cmd/lnd"];
+  subPackages = [ "cmd/lncli" "cmd/lnd" ];
 
   preBuild = let
     buildVars = {
diff --git a/pkgs/applications/editors/emacs/elisp-packages/elpa-packages.nix b/pkgs/applications/editors/emacs/elisp-packages/elpa-packages.nix
index b7f861a4cd7a..60fac91839a1 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/elpa-packages.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/elpa-packages.nix
@@ -36,14 +36,16 @@ self: let
     inherit (self) emacs;
   };
 
+  # Use custom elpa url fetcher with fallback/uncompress
+  fetchurl = buildPackages.callPackage ./fetchelpa.nix { };
+
   generateElpa = lib.makeOverridable ({
     generated ? ./elpa-generated.nix
   }: let
 
     imported = import generated {
       callPackage = pkgs: args: self.callPackage pkgs (args // {
-        # Use custom elpa url fetcher with fallback/uncompress
-        fetchurl = buildPackages.callPackage ./fetchelpa.nix { };
+        inherit fetchurl;
       });
     };
 
@@ -69,12 +71,7 @@ self: let
         dontUnpack = false;
         srcs = [
           super.ada-mode.src
-          # ada-mode needs a specific version of wisi, check NEWS or ada-mode's
-          # package-requires to find the version to use.
-          (pkgs.fetchurl {
-            url = "https://elpa.gnu.org/packages/wisi-3.1.3.tar.lz";
-            sha256 = "18dwcc0crds7aw466vslqicidlzamf8avn59gqi2g7y2x9k5q0as";
-          })
+          self.wisi.src
         ];
 
         sourceRoot = "ada-mode-${self.ada-mode.version}";
diff --git a/pkgs/applications/misc/bluetooth_battery/default.nix b/pkgs/applications/misc/bluetooth_battery/default.nix
index 19c2f3b99a4d..d9c3f5bc2a43 100644
--- a/pkgs/applications/misc/bluetooth_battery/default.nix
+++ b/pkgs/applications/misc/bluetooth_battery/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonApplication rec {
   pname = "bluetooth_battery";
-  version = "1.2.0";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "TheWeirdDev";
     repo = "Bluetooth_Headset_Battery_Level";
     rev = "v${version}";
-    sha256 = "121pkaq9z8p2i35cqs32aygjvf82r961w0axirpmsrbmrwq2hh6g";
+    sha256 = "067qfxh228cy1x95bnjp88dx4k00ajj7ay7fz5vr1gkj2yfa203s";
   };
 
   propagatedBuildInputs = [ pybluez ];
diff --git a/pkgs/applications/misc/dbeaver/default.nix b/pkgs/applications/misc/dbeaver/default.nix
index f7782d0a577c..65375172f405 100644
--- a/pkgs/applications/misc/dbeaver/default.nix
+++ b/pkgs/applications/misc/dbeaver/default.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dbeaver";
-  version = "21.2.4"; # When updating also update fetchedMavenDeps.sha256
+  version = "21.2.5"; # When updating also update fetchedMavenDeps.sha256
 
   src = fetchFromGitHub {
     owner = "dbeaver";
     repo = "dbeaver";
     rev = version;
-    sha256 = "BPcTj2YIGyP3g4qrQlDp13lziJwSUt0Zn00CayDku9g=";
+    sha256 = "bLZYwf6dtbzS0sWKfQQzv4NqRQZqLkJaT24eW3YOsdQ=";
   };
 
   fetchedMavenDeps = stdenv.mkDerivation {
diff --git a/pkgs/applications/misc/downonspot/default.nix b/pkgs/applications/misc/downonspot/default.nix
new file mode 100644
index 000000000000..4764fc4d5e63
--- /dev/null
+++ b/pkgs/applications/misc/downonspot/default.nix
@@ -0,0 +1,45 @@
+{ lib
+, fetchFromGitHub
+, rustPlatform
+, pkg-config
+, makeWrapper
+, alsa-lib
+, lame
+, openssl
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "downonspot";
+  version = "unstable-2021-10-13";
+
+  src = fetchFromGitHub {
+    owner = "oSumAtrIX";
+    repo = "DownOnSpot";
+    rev = "9d78ea2acad4dfe653a895a1547ad0abe7c5b47a";
+    sha256 = "03g99yx9sldcg3i6hvpdxyk70f09f8kfj3kh283vl09b1a2c477w";
+  };
+
+  cargoSha256 = "0k200p6wgwb60ax1r8mjn3aq08zxpkqbfqpi3b25zi3xf83my44d";
+
+  # fixes: error: the option `Z` is only accepted on the nightly compiler
+  RUSTC_BOOTSTRAP = 1;
+
+  nativeBuildInputs = [
+    pkg-config
+    makeWrapper
+  ];
+
+  buildInputs = [
+    openssl
+    alsa-lib
+    lame
+  ];
+
+  meta = with lib; {
+    description = "A Spotify downloader written in rust";
+    homepage = "https://github.com/oSumAtrIX/DownOnSpot";
+    license = licenses.gpl3Only;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ onny ];
+  };
+}
diff --git a/pkgs/applications/misc/pdfarranger/default.nix b/pkgs/applications/misc/pdfarranger/default.nix
index 5657c7f7e1a5..dd7d3f4768ef 100644
--- a/pkgs/applications/misc/pdfarranger/default.nix
+++ b/pkgs/applications/misc/pdfarranger/default.nix
@@ -5,13 +5,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "pdfarranger";
-  version = "1.7.1";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "1c2mafnz8pv32wzkc2wx4q8y2x7xffpn6ag12dj7ga5n772fb6s3";
+    sha256 = "0xfxcwb24rp0kni2b4wdk6fvhqnhd6fh559ag6wdr4sspzkqwdjf";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/slstatus/default.nix b/pkgs/applications/misc/slstatus/default.nix
index 613d2f8e78bf..5badb7f1b35a 100644
--- a/pkgs/applications/misc/slstatus/default.nix
+++ b/pkgs/applications/misc/slstatus/default.nix
@@ -20,6 +20,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ libX11 ];
 
+  makeFlags = [ "CC:=$(CC)" ];
+
   installFlags = [ "PREFIX=$(out)" ];
 
   meta = {
diff --git a/pkgs/applications/misc/visidata/default.nix b/pkgs/applications/misc/visidata/default.nix
index b1b92ebe2d3f..79a0758a2a5b 100644
--- a/pkgs/applications/misc/visidata/default.nix
+++ b/pkgs/applications/misc/visidata/default.nix
@@ -9,6 +9,7 @@
 , openpyxl
 , xlrd
 , h5py
+, odfpy
 , psycopg2
 , pyshp
 , fonttools
@@ -24,13 +25,13 @@
 }:
 buildPythonApplication rec {
   pname = "visidata";
-  version = "2.6.1";
+  version = "2.7";
 
   src = fetchFromGitHub {
     owner = "saulpw";
     repo = "visidata";
     rev = "v${version}";
-    sha256 = "1dmiy87x0yc0d594v3d3km13dl851mx7ym1vgh3bg91llg8ykg33";
+    sha256 = "0b2h9vy0fch0bk0b33h8p4ssk3a25j67sfn0yvmxhbqjdmhlwv4h";
   };
 
   propagatedBuildInputs = [
@@ -60,6 +61,7 @@ buildPythonApplication rec {
     tabulate
     wcwidth
     zstandard
+    odfpy
     setuptools
   ] ++ lib.optionals withPcap [ dpkt dnslib ];
 
diff --git a/pkgs/applications/misc/wmname/default.nix b/pkgs/applications/misc/wmname/default.nix
index 438bd5c5d56a..45e7cf3d8f1b 100644
--- a/pkgs/applications/misc/wmname/default.nix
+++ b/pkgs/applications/misc/wmname/default.nix
@@ -9,9 +9,15 @@ stdenv.mkDerivation rec {
     sha256 = "559ad188b2913167dcbb37ecfbb7ed474a7ec4bbcb0129d8d5d08cb9208d02c5";
   };
 
+  postPatch = ''
+    substituteInPlace Makefile --replace "@strip" "#@strip"
+  '';
+
   buildInputs = [ libX11 ];
 
-  preConfigure = ''sed -i "s@PREFIX = /usr/local@PREFIX = $out@g" config.mk'';
+  makeFlags = [ "CC:=$(CC)" ];
+
+  installFlags = [ "PREFIX=$(out)" ];
 
   meta = {
     description = "Prints or set the window manager name property of the root window";
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.json b/pkgs/applications/networking/browsers/chromium/upstream-info.json
index 624dde9e1702..ca73b620cfbb 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@@ -1,20 +1,20 @@
 {
   "stable": {
-    "version": "95.0.4638.69",
-    "sha256": "1rzg48mbd5n75nq2rfwknyxpmfrddds199ic82c736kcgirpv8rq",
-    "sha256bin64": "1jhxm12sdlgvgnny0p56xsfyxd78mwn9qwc20c33qfvwxrzp9ajp",
+    "version": "96.0.4664.45",
+    "sha256": "01q4fsf2cbx6g9nnaihvc5jj3ap8jq2gf16pnhf7ixzbhgcnm328",
+    "sha256bin64": "0546i4yd1jahv088hjxpq0jc393pscvl5ap3s2qw5jrybliyfd2g",
     "deps": {
       "gn": {
-        "version": "2021-08-11",
+        "version": "2021-09-24",
         "url": "https://gn.googlesource.com/gn",
-        "rev": "69ec4fca1fa69ddadae13f9e6b7507efa0675263",
-        "sha256": "031znmkbm504iim5jvg3gmazj4qnkfc7zg8aymjsij18fhf7piz0"
+        "rev": "0153d369bbccc908f4da4993b1ba82728055926a",
+        "sha256": "0y4414h8jqsbz5af6pn91c0vkfp4s281s85g992xfyl785c5zbsi"
       }
     },
     "chromedriver": {
-      "version": "95.0.4638.54",
-      "sha256_linux": "0p228x7w423p3zqwfdba2jj4x4gkxz4267qzzswpba335p3k1nyk",
-      "sha256_darwin": "1yxi8c18fa07w8kdm63v4663lhgx1y56957bkqb7hf459bzz594l"
+      "version": "96.0.4664.35",
+      "sha256_linux": "0iq129a4mj4sjs08s68n82wd8563sw8196xda27wk3pfpprr23db",
+      "sha256_darwin": "1prc7zbgnljqz2d89clpk5c0y48r79zmb9in4vinf3j6p2rxn0vy"
     }
   },
   "beta": {
diff --git a/pkgs/applications/networking/browsers/firefox/wrapper.nix b/pkgs/applications/networking/browsers/firefox/wrapper.nix
index aa6f7da503fb..462c24a62319 100644
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@@ -290,7 +290,7 @@ let
         else
             for res in 16 32 48 64 128; do
             mkdir -p "$out/share/icons/hicolor/''${res}x''${res}/apps"
-            icon=( "${browser}/lib/"*"/browser/chrome/icons/default/default''${res}.png" )
+            icon=$( find "${browser}/lib/" -name "default''${res}.png" )
               if [ -e "$icon" ]; then ln -s "$icon" \
                 "$out/share/icons/hicolor/''${res}x''${res}/apps/${applicationName}.png"
               fi
diff --git a/pkgs/applications/networking/irc/ii/default.nix b/pkgs/applications/networking/irc/ii/default.nix
index 93056ef399fb..18a9a8882fac 100644
--- a/pkgs/applications/networking/irc/ii/default.nix
+++ b/pkgs/applications/networking/irc/ii/default.nix
@@ -9,9 +9,9 @@ stdenv.mkDerivation rec {
     sha256 = "1lk8vjl7i8dcjh4jkg8h8bkapcbs465sy8g9c0chfqsywbmf3ndr";
   };
 
-  installPhase = ''
-    make install PREFIX=$out
-  '';
+  makeFlags = [ "CC:=$(CC)" ];
+
+  installFlags = [ "PREFIX=$(out)" ];
 
   meta = {
     homepage = "https://tools.suckless.org/ii/";
diff --git a/pkgs/applications/networking/irc/sic/default.nix b/pkgs/applications/networking/irc/sic/default.nix
index 129b72d847d4..705fc12510db 100644
--- a/pkgs/applications/networking/irc/sic/default.nix
+++ b/pkgs/applications/networking/irc/sic/default.nix
@@ -4,12 +4,15 @@ stdenv.mkDerivation rec {
   pname = "sic";
   version = "1.2";
 
-  makeFlags = [ "PREFIX=$(out)" ];
   src = fetchurl {
     url = "https://dl.suckless.org/tools/sic-${version}.tar.gz";
     sha256 = "ac07f905995e13ba2c43912d7a035fbbe78a628d7ba1c256f4ca1372fb565185";
   };
 
+  makeFlags = [ "CC:=$(CC)" ];
+
+  installFlags = [ "PREFIX=$(out)" ];
+
   meta = {
     description = "Simple IRC client";
     homepage = "https://tools.suckless.org/sic/";
diff --git a/pkgs/applications/networking/nextcloud-client/default.nix b/pkgs/applications/networking/nextcloud-client/default.nix
index b7ff968f79bd..071f5adfd497 100644
--- a/pkgs/applications/networking/nextcloud-client/default.nix
+++ b/pkgs/applications/networking/nextcloud-client/default.nix
@@ -73,7 +73,7 @@ mkDerivation rec {
     description = "Nextcloud themed desktop client";
     homepage = "https://nextcloud.com";
     license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ caugner kranzes ];
+    maintainers = with maintainers; [ kranzes ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/applications/radio/flex-ndax/default.nix b/pkgs/applications/radio/flex-ndax/default.nix
index 4d27907cdd18..8be72ef3d6b5 100644
--- a/pkgs/applications/radio/flex-ndax/default.nix
+++ b/pkgs/applications/radio/flex-ndax/default.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "flex-ndax";
-  version = "0.1-20210714.0";
+  version = "0.2-20211111.0";
 
   src = fetchFromGitHub {
     owner = "kc2g-flex-tools";
     repo = "nDAX";
     rev = "v${version}";
-    sha256 = "16zx6kbax59rcxyz9dhq7m8yx214knz3xayna1gzb85m6maly8v8";
+    sha256 = "0m2hphj0qvgq25pfm3s76naf672ll43jv7gll8cfs7276ckg1904";
   };
 
   buildInputs = [ pulseaudio ];
 
-  vendorSha256 = "0qn8vg84j9kp0ycn24lkaqjnnk339j3vis4bn48ia3z5vfc22gi5";
+  vendorSha256 = "1bf0iidb8ggzahy3fvxispf3g940mv6vj9wqd8i3rldc6ca2i3pf";
 
   meta = with lib; {
     homepage = "https://github.com/kc2g-flex-tools/nDAX";
diff --git a/pkgs/applications/science/logic/elan/0001-dynamically-patchelf-binaries.patch b/pkgs/applications/science/logic/elan/0001-dynamically-patchelf-binaries.patch
index 48b1263e7961..dc76305bd749 100644
--- a/pkgs/applications/science/logic/elan/0001-dynamically-patchelf-binaries.patch
+++ b/pkgs/applications/science/logic/elan/0001-dynamically-patchelf-binaries.patch
@@ -1,24 +1,19 @@
 diff --git a/src/elan-dist/src/component/package.rs b/src/elan-dist/src/component/package.rs
-index c51e76d..d0a26d7 100644
+index c51e76d..ae8159e 100644
 --- a/src/elan-dist/src/component/package.rs
 +++ b/src/elan-dist/src/component/package.rs
-@@ -56,11 +56,35 @@ fn unpack_without_first_dir<R: Read>(archive: &mut tar::Archive<R>, path: &Path)
+@@ -56,6 +56,30 @@ fn unpack_without_first_dir<R: Read>(archive: &mut tar::Archive<R>, path: &Path)
          entry
              .unpack(&full_path)
              .chain_err(|| ErrorKind::ExtractingPackage)?;
-+        nix_patchelf_if_needed(&full_path);
-     }
- 
-     Ok(())
- }
- 
-+fn nix_patchelf_if_needed(dest_path: &Path) {
-+    let (is_bin, is_lib) = if let Some(p) = dest_path.parent() {
-+        (p.ends_with("bin"), p.ends_with("lib"))
-+    } else {
-+        (false, false)
-+    };
++        nix_patch_if_needed(&full_path)?;
++    }
 +
++    Ok(())
++}
++
++fn nix_patch_if_needed(dest_path: &Path) -> Result<()> {
++    let is_bin = matches!(dest_path.parent(), Some(p) if p.ends_with("bin"));
 +    if is_bin {
 +        let _ = ::std::process::Command::new("@patchelf@/bin/patchelf")
 +            .arg("--set-interpreter")
@@ -26,15 +21,15 @@ index c51e76d..d0a26d7 100644
 +            .arg(dest_path)
 +            .output();
 +    }
-+    else if is_lib {
-+        let _ = ::std::process::Command::new("@patchelf@/bin/patchelf")
-+            .arg("--set-rpath")
-+            .arg("@libPath@")
-+            .arg(dest_path)
-+            .output();
-+    }
-+}
 +
- #[derive(Debug)]
- pub struct ZipPackage<'a>(temp::Dir<'a>);
++    if dest_path.extension() == Some(::std::ffi::OsStr::new("lld")) {
++        use std::os::unix::fs::PermissionsExt;
++        let new_path = dest_path.with_extension("orig");
++        ::std::fs::rename(dest_path, &new_path)?;
++        ::std::fs::write(dest_path, format!(r#"#! @shell@
++exec -a "$0" {} "$@" --dynamic-linker=@dynamicLinker@
++"#, new_path.to_str().unwrap()))?;
++        ::std::fs::set_permissions(dest_path, ::std::fs::Permissions::from_mode(0o755))?;
+     }
  
+     Ok(())
diff --git a/pkgs/applications/science/logic/elan/default.nix b/pkgs/applications/science/logic/elan/default.nix
index a5709b69fbb8..cc4f0680de3e 100644
--- a/pkgs/applications/science/logic/elan/default.nix
+++ b/pkgs/applications/science/logic/elan/default.nix
@@ -1,9 +1,5 @@
-{ stdenv, lib, runCommand, patchelf, makeWrapper, pkg-config, curl
-, openssl, gmp, zlib, fetchFromGitHub, rustPlatform, libiconv }:
-
-let
-  libPath = lib.makeLibraryPath [ gmp ];
-in
+{ stdenv, lib, runCommand, patchelf, makeWrapper, pkg-config, curl, runtimeShell
+, openssl, zlib, fetchFromGitHub, rustPlatform, libiconv }:
 
 rustPlatform.buildRustPackage rec {
   pname = "elan";
@@ -32,13 +28,13 @@ rustPlatform.buildRustPackage rec {
     (runCommand "0001-dynamically-patchelf-binaries.patch" {
         CC = stdenv.cc;
         patchelf = patchelf;
-        libPath = "$ORIGIN/../lib:${libPath}";
+        shell = runtimeShell;
       } ''
      export dynamicLinker=$(cat $CC/nix-support/dynamic-linker)
      substitute ${./0001-dynamically-patchelf-binaries.patch} $out \
        --subst-var patchelf \
        --subst-var dynamicLinker \
-       --subst-var libPath
+       --subst-var shell
     '')
   ];
 
@@ -50,8 +46,6 @@ rustPlatform.buildRustPackage rec {
     done
     popd
 
-    wrapProgram $out/bin/elan --prefix "LD_LIBRARY_PATH" : "${libPath}"
-
     # tries to create .elan
     export HOME=$(mktemp -d)
     mkdir -p "$out/share/"{bash-completion/completions,fish/vendor_completions.d,zsh/site-functions}
diff --git a/pkgs/applications/terminal-emulators/xterm/default.nix b/pkgs/applications/terminal-emulators/xterm/default.nix
index 4bb9386a112a..738260646f20 100644
--- a/pkgs/applications/terminal-emulators/xterm/default.nix
+++ b/pkgs/applications/terminal-emulators/xterm/default.nix
@@ -4,14 +4,14 @@
 
 stdenv.mkDerivation rec {
   pname = "xterm";
-  version = "369";
+  version = "370";
 
   src = fetchurl {
     urls = [
       "ftp://ftp.invisible-island.net/xterm/${pname}-${version}.tgz"
       "https://invisible-mirror.net/archives/xterm/${pname}-${version}.tgz"
     ];
-    sha256 = "ce1qSNBkiT0hSXQaACeBqXNJb9JNUtrdNk9jQ5p2TiY=";
+    sha256 = "ljxdhAoPD0wHf/KEWG6LH4Pz+YPcpvdPSzYZdbU4jII=";
   };
 
   strictDeps = true;
diff --git a/pkgs/applications/video/kodi-packages/libretro-mgba/default.nix b/pkgs/applications/video/kodi-packages/libretro-mgba/default.nix
new file mode 100644
index 000000000000..a58f1c51b295
--- /dev/null
+++ b/pkgs/applications/video/kodi-packages/libretro-mgba/default.nix
@@ -0,0 +1,31 @@
+{ lib, rel, buildKodiBinaryAddon, fetchFromGitHub, libretro, mgba }:
+
+buildKodiBinaryAddon rec {
+  pname = "kodi-libretro-mgba";
+  namespace = "game.libretro.mgba";
+  version = "0.9.2.31";
+
+  src = fetchFromGitHub {
+    owner = "kodi-game";
+    repo = "game.libretro.mgba";
+    rev = "${version}-${rel}";
+    sha256 = "sha256-eZLuNhLwMTtzpLGkymc9cLC83FQJWZ2ZT0iyz4sY4EA=";
+  };
+
+  extraCMakeFlags = [
+    "-DMGBA_LIB=${mgba}/lib/retroarch/cores/mgba_libretro.so"
+  ];
+
+  extraBuildInputs = [ mgba ];
+  propagatedBuildInputs = [
+    libretro
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/kodi-game/game.libretro.mgba";
+    description = "mGBA for Kodi";
+    platforms = platforms.all;
+    license = licenses.gpl2Only;
+    maintainers = teams.kodi.members;
+  };
+}
diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix
index 477b1603d27d..c230fac1e61c 100644
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@@ -23,6 +23,7 @@
 , libiscsiSupport ? true, libiscsi
 , smbdSupport ? false, samba
 , tpmSupport ? true
+, uringSupport ? stdenv.isLinux, liburing
 , hostCpuOnly ? false
 , hostCpuTargets ? (if hostCpuOnly
                     then (lib.optional stdenv.isx86_64 "i386-softmmu"
@@ -77,7 +78,8 @@ stdenv.mkDerivation rec {
     ++ lib.optionals openGLSupport [ mesa epoxy libdrm ]
     ++ lib.optionals virglSupport [ virglrenderer ]
     ++ lib.optionals libiscsiSupport [ libiscsi ]
-    ++ lib.optionals smbdSupport [ samba ];
+    ++ lib.optionals smbdSupport [ samba ]
+    ++ lib.optionals uringSupport [ liburing ];
 
   dontUseMesonConfigure = true; # meson's configurePhase isn't compatible with qemu build
 
@@ -187,7 +189,8 @@ stdenv.mkDerivation rec {
     ++ lib.optional virglSupport "--enable-virglrenderer"
     ++ lib.optional tpmSupport "--enable-tpm"
     ++ lib.optional libiscsiSupport "--enable-libiscsi"
-    ++ lib.optional smbdSupport "--smbd=${samba}/bin/smbd";
+    ++ lib.optional smbdSupport "--smbd=${samba}/bin/smbd"
+    ++ lib.optional uringSupport "--enable-linux-io-uring";
 
   doCheck = false; # tries to access /dev
   dontWrapGApps = true;
diff --git a/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix b/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix
index 23718bf636c6..4773a1e2cf6e 100644
--- a/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix
+++ b/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix
@@ -66,6 +66,7 @@ let
       "asound.conf"
       # SSL
       "ssl/certs"
+      "ca-certificates"
       "pki"
     ];
   in concatStringsSep "\n  "
diff --git a/pkgs/development/compilers/ghdl/default.nix b/pkgs/development/compilers/ghdl/default.nix
index e7886eb8f5ed..266ee97a2e90 100644
--- a/pkgs/development/compilers/ghdl/default.nix
+++ b/pkgs/development/compilers/ghdl/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, callPackage, gnat, zlib, llvm, lib
+{ stdenv, fetchFromGitHub, fetchpatch, callPackage, gnat, zlib, llvm, lib
 , backend ? "mcode" }:
 
 assert backend == "mcode" || backend == "llvm";
@@ -14,6 +14,15 @@ stdenv.mkDerivation rec {
     sha256 = "1gyh0xckwbzgslbpw9yrpj4gqs9fm1a2qpbzl0sh143fk1kwjlly";
   };
 
+  patches = [
+    # Allow compilation with GNAT 11, picked from master
+    (fetchpatch {
+      name = "fix-gnat-11-compilation.patch";
+      url = "https://github.com/ghdl/ghdl/commit/8356ea3bb4e8d0e5ad8638c3d50914b64fc360ec.patch";
+      sha256 = "04pzn8g7xha8000wbjjmry6h1grfqyn3bjvj47hi4qwgl21wfjra";
+    })
+  ];
+
   LIBRARY_PATH = "${stdenv.cc.libc}/lib";
 
   buildInputs = [ gnat zlib ] ++ lib.optional (backend == "llvm") [ llvm ];
diff --git a/pkgs/development/compilers/llvm/13/llvm/default.nix b/pkgs/development/compilers/llvm/13/llvm/default.nix
index a15bcc872a6d..957f29e44994 100644
--- a/pkgs/development/compilers/llvm/13/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/13/llvm/default.nix
@@ -46,7 +46,8 @@ in stdenv.mkDerivation (rec {
   buildInputs = [ libxml2 libffi ]
     ++ optional enablePFM libpfm; # exegesis
 
-  propagatedBuildInputs = [ ncurses zlib ];
+  propagatedBuildInputs = optionals (stdenv.hostPlatform == stdenv.buildPlatform) [ ncurses ]
+    ++ [ zlib ];
 
   checkInputs = [ which ];
 
diff --git a/pkgs/development/compilers/qbe/default.nix b/pkgs/development/compilers/qbe/default.nix
index d58e9bf9b0cb..fd6dea1cb1d5 100644
--- a/pkgs/development/compilers/qbe/default.nix
+++ b/pkgs/development/compilers/qbe/default.nix
@@ -6,12 +6,12 @@
 
 stdenv.mkDerivation rec {
   pname = "qbe";
-  version = "unstable-2021-10-28";
+  version = "unstable-2021-11-10";
 
   src = fetchgit {
     url = "git://c9x.me/qbe.git";
-    rev = "0d68986b6f6aa046ab13776f39cc37b67b3477ba";
-    sha256 = "sha256-K1XpVoJoY8QuUdP5rKnlAs4yTn5jhh9LKZjHalliNKs=";
+    rev = "b0f16dad64d14f36ffe235b2e9cca96aa3ce35ba";
+    sha256 = "sha256-oPgr8PDxGNqIWxWsvVr9B8oN0Io/pUuzgIkZfY/qD+o=";
   };
 
   makeFlags = [ "PREFIX=$(out)" ];
diff --git a/pkgs/development/compilers/vala/default.nix b/pkgs/development/compilers/vala/default.nix
index ba9abc0def1d..32c9e6f2290a 100644
--- a/pkgs/development/compilers/vala/default.nix
+++ b/pkgs/development/compilers/vala/default.nix
@@ -129,8 +129,8 @@ in rec {
   };
 
   vala_0_52 = generic {
-    version = "0.52.6";
-    sha256 = "sha256-FNfrTZZLfDrcFuRTcTIIbdxmJO0eDruBEeKsgierOnI=";
+    version = "0.52.7";
+    sha256 = "sha256-C7WptPbRdUmewKWAJK3ANapRcAgPUzwo2cNY0aMsU2o=";
   };
 
   vala_0_54 = generic {
diff --git a/pkgs/development/interpreters/bqn/cbqn/default.nix b/pkgs/development/interpreters/bqn/cbqn/default.nix
index 44d63ace738b..4d872f0084e4 100644
--- a/pkgs/development/interpreters/bqn/cbqn/default.nix
+++ b/pkgs/development/interpreters/bqn/cbqn/default.nix
@@ -52,8 +52,9 @@ stdenv.mkDerivation rec {
 
      mkdir -p $out/bin/
      cp BQN -t $out/bin/
-     ln -s $out/bin/BQN $out/bin/bqn
-     ln -s $out/bin/BQN $out/bin/cbqn
+     # note guard condition for case-insensitive filesystems
+     [ -e $out/bin/bqn ] || ln -s $out/bin/BQN $out/bin/bqn
+     [ -e $out/bin/cbqn ] || ln -s $out/bin/BQN $out/bin/cbqn
 
      runHook postInstall
   '';
diff --git a/pkgs/development/interpreters/lunatic/default.nix b/pkgs/development/interpreters/lunatic/default.nix
index 39e8323e194c..de0c927567d1 100644
--- a/pkgs/development/interpreters/lunatic/default.nix
+++ b/pkgs/development/interpreters/lunatic/default.nix
@@ -1,4 +1,4 @@
-{ cmake, fetchFromGitHub, lib, rustPlatform }:
+{ lib, rustPlatform, fetchFromGitHub, fetchpatch, cmake, stdenv }:
 
 rustPlatform.buildRustPackage rec {
   pname = "lunatic";
@@ -11,7 +11,17 @@ rustPlatform.buildRustPackage rec {
     sha256 = "1dz8v19jw9v55p3mz4932v6z24ihp6wk238n4d4lx9xj91mf3g6r";
   };
 
-  cargoSha256 = "1rkxl27l6ydmcq3flc6qbnd7zmpkfmyc86b8q4pi7dwhqnd5g70g";
+  cargoPatches = [
+    # NOTE: remove on next update
+    # update dependencies to resolve incompatibility with rust 1.56
+    (fetchpatch {
+      name = "update-wasmtime.patch";
+      url = "https://github.com/lunatic-solutions/lunatic/commit/cd8db51732712c19a8114db290882d1bb6b928c0.patch";
+      sha256 = "sha256-eyoIOTqGSU/XNfF55FG+WrQPSMvt9L/S/KBsUQB5z1k=";
+    })
+  ];
+
+  cargoSha256 = "sha256-yoG4gCk+nHE8pBqV6ND9NCegx4bxbdGEU5hY5JauloM=";
 
   nativeBuildInputs = [ cmake ];
 
@@ -20,5 +30,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://lunatic.solutions";
     license = with licenses; [ mit /* or */ asl20 ];
     maintainers = with maintainers; [ figsoda ];
+    broken = stdenv.isDarwin;
   };
 }
diff --git a/pkgs/development/interpreters/php/generic.nix b/pkgs/development/interpreters/php/generic.nix
index dbe01acb6dfd..7a1ee2a2ebaf 100644
--- a/pkgs/development/interpreters/php/generic.nix
+++ b/pkgs/development/interpreters/php/generic.nix
@@ -7,6 +7,7 @@ let
     , lib
     , stdenv
     , nixosTests
+    , tests
     , fetchurl
     , makeWrapper
     , symlinkJoin
@@ -31,6 +32,7 @@ let
     , sha256
     , extraPatches ? [ ]
     , packageOverrides ? (final: prev: { })
+    , phpAttrsOverrides ? (attrs: { })
 
       # Sapi flags
     , cgiSupport ? true
@@ -52,6 +54,16 @@ let
     }@args:
 
     let
+      # Compose two functions of the type expected by 'overrideAttrs'
+      # into one where changes made in the first are available to the second.
+      composeOverrides =
+        f: g: attrs:
+        let
+          fApplied = f attrs;
+          attrs' = attrs // fApplied;
+        in
+        fApplied // g attrs';
+
       # buildEnv wraps php to provide additional extensions and
       # configuration. Its usage is documented in
       # doc/languages-frameworks/php.section.md.
@@ -129,10 +141,20 @@ let
             passthru = php.passthru // {
               buildEnv = mkBuildEnv allArgs allExtensionFunctions;
               withExtensions = mkWithExtensions allArgs allExtensionFunctions;
+              overrideAttrs =
+                f:
+                let
+                  newPhpAttrsOverrides = composeOverrides (filteredArgs.phpAttrsOverrides or (attrs: { })) f;
+                  php = generic (filteredArgs // { phpAttrsOverrides = newPhpAttrsOverrides; });
+                in
+                php.buildEnv { inherit extensions extraConfig; };
               phpIni = "${phpWithExtensions}/lib/php.ini";
               unwrapped = php;
               # Select the right php tests for the php version
-              tests = nixosTests."php${lib.strings.replaceStrings [ "." ] [ "" ] (lib.versions.majorMinor php.version)}";
+              tests = {
+                nixos = lib.recurseIntoAttrs nixosTests."php${lib.strings.replaceStrings [ "." ] [ "" ] (lib.versions.majorMinor php.version)}";
+                package = tests.php;
+              };
               inherit (php-packages) extensions buildPecl mkExtension;
               packages = php-packages.tools;
               meta = php.meta // {
@@ -163,139 +185,151 @@ let
       mkWithExtensions = prevArgs: prevExtensionFunctions: extensions:
         mkBuildEnv prevArgs prevExtensionFunctions { inherit extensions; };
     in
-    stdenv.mkDerivation {
-      pname = "php";
+    stdenv.mkDerivation (
+      let
+        attrs = {
+          pname = "php";
 
-      inherit version;
+          inherit version;
 
-      enableParallelBuilding = true;
+          enableParallelBuilding = true;
 
-      nativeBuildInputs = [ autoconf automake bison flex libtool pkg-config re2c ]
-        ++ lib.optional stdenv.isDarwin xcbuild;
+          nativeBuildInputs = [ autoconf automake bison flex libtool pkg-config re2c ]
+            ++ lib.optional stdenv.isDarwin xcbuild;
 
-      buildInputs =
-        # PCRE extension
-        [ pcre2 ]
+          buildInputs =
+            # PCRE extension
+            [ pcre2 ]
 
-        # Enable sapis
-        ++ lib.optional pearSupport [ libxml2.dev ]
+            # Enable sapis
+            ++ lib.optional pearSupport [ libxml2.dev ]
 
-        # Misc deps
-        ++ lib.optional apxs2Support apacheHttpd
-        ++ lib.optional argon2Support libargon2
-        ++ lib.optional systemdSupport systemd
-        ++ lib.optional valgrindSupport valgrind
-      ;
+            # Misc deps
+            ++ lib.optional apxs2Support apacheHttpd
+            ++ lib.optional argon2Support libargon2
+            ++ lib.optional systemdSupport systemd
+            ++ lib.optional valgrindSupport valgrind
+          ;
 
-      CXXFLAGS = lib.optionalString stdenv.cc.isClang "-std=c++11";
+          CXXFLAGS = lib.optionalString stdenv.cc.isClang "-std=c++11";
 
-      configureFlags =
-        # Disable all extensions
-        [ "--disable-all" ]
+          configureFlags =
+            # Disable all extensions
+            [ "--disable-all" ]
 
-        # PCRE
-        ++ lib.optionals (lib.versionAtLeast version "7.4") [ "--with-external-pcre=${pcre2.dev}" ]
-        ++ [ "PCRE_LIBDIR=${pcre2}" ]
+            # PCRE
+            ++ lib.optionals (lib.versionAtLeast version "7.4") [ "--with-external-pcre=${pcre2.dev}" ]
+            ++ [ "PCRE_LIBDIR=${pcre2}" ]
 
 
-        # Enable sapis
-        ++ lib.optional (!cgiSupport) "--disable-cgi"
-        ++ lib.optional (!cliSupport) "--disable-cli"
-        ++ lib.optional fpmSupport "--enable-fpm"
-        ++ lib.optional pearSupport [ "--with-pear" "--enable-xml" "--with-libxml" ]
-        ++ lib.optionals (pearSupport && (lib.versionOlder version "7.4")) [
-          "--enable-libxml"
-          "--with-libxml-dir=${libxml2.dev}"
-        ]
-        ++ lib.optional pharSupport "--enable-phar"
-        ++ lib.optional (!phpdbgSupport) "--disable-phpdbg"
+            # Enable sapis
+            ++ lib.optional (!cgiSupport) "--disable-cgi"
+            ++ lib.optional (!cliSupport) "--disable-cli"
+            ++ lib.optional fpmSupport "--enable-fpm"
+            ++ lib.optional pearSupport [ "--with-pear" "--enable-xml" "--with-libxml" ]
+            ++ lib.optionals (pearSupport && (lib.versionOlder version "7.4")) [
+              "--enable-libxml"
+              "--with-libxml-dir=${libxml2.dev}"
+            ]
+            ++ lib.optional pharSupport "--enable-phar"
+            ++ lib.optional (!phpdbgSupport) "--disable-phpdbg"
 
 
-        # Misc flags
-        ++ lib.optional apxs2Support "--with-apxs2=${apacheHttpd.dev}/bin/apxs"
-        ++ lib.optional argon2Support "--with-password-argon2=${libargon2}"
-        ++ lib.optional cgotoSupport "--enable-re2c-cgoto"
-        ++ lib.optional embedSupport "--enable-embed"
-        ++ lib.optional (!ipv6Support) "--disable-ipv6"
-        ++ lib.optional systemdSupport "--with-fpm-systemd"
-        ++ lib.optional valgrindSupport "--with-valgrind=${valgrind.dev}"
-        ++ lib.optional (ztsSupport && (lib.versionOlder version "8.0")) "--enable-maintainer-zts"
-        ++ lib.optional (ztsSupport && (lib.versionAtLeast version "8.0")) "--enable-zts"
+            # Misc flags
+            ++ lib.optional apxs2Support "--with-apxs2=${apacheHttpd.dev}/bin/apxs"
+            ++ lib.optional argon2Support "--with-password-argon2=${libargon2}"
+            ++ lib.optional cgotoSupport "--enable-re2c-cgoto"
+            ++ lib.optional embedSupport "--enable-embed"
+            ++ lib.optional (!ipv6Support) "--disable-ipv6"
+            ++ lib.optional systemdSupport "--with-fpm-systemd"
+            ++ lib.optional valgrindSupport "--with-valgrind=${valgrind.dev}"
+            ++ lib.optional (ztsSupport && (lib.versionOlder version "8.0")) "--enable-maintainer-zts"
+            ++ lib.optional (ztsSupport && (lib.versionAtLeast version "8.0")) "--enable-zts"
 
 
-        # Sendmail
-        ++ [ "PROG_SENDMAIL=${system-sendmail}/bin/sendmail" ]
-      ;
+            # Sendmail
+            ++ [ "PROG_SENDMAIL=${system-sendmail}/bin/sendmail" ]
+          ;
 
-      hardeningDisable = [ "bindnow" ];
+          hardeningDisable = [ "bindnow" ];
 
-      preConfigure =
-        # Don't record the configure flags since this causes unnecessary
-        # runtime dependencies
-        ''
-          for i in main/build-defs.h.in scripts/php-config.in; do
-            substituteInPlace $i \
-              --replace '@CONFIGURE_COMMAND@' '(omitted)' \
-              --replace '@CONFIGURE_OPTIONS@' "" \
-              --replace '@PHP_LDFLAGS@' ""
-          done
+          preConfigure =
+            # Don't record the configure flags since this causes unnecessary
+            # runtime dependencies
+            ''
+              for i in main/build-defs.h.in scripts/php-config.in; do
+                substituteInPlace $i \
+                  --replace '@CONFIGURE_COMMAND@' '(omitted)' \
+                  --replace '@CONFIGURE_OPTIONS@' "" \
+                  --replace '@PHP_LDFLAGS@' ""
+              done
 
-          export EXTENSION_DIR=$out/lib/php/extensions
-        ''
-        # PKG_CONFIG need not be a relative path
-        + lib.optionalString (!lib.versionAtLeast version "7.4") ''
-          for i in $(find . -type f -name "*.m4"); do
-            substituteInPlace $i \
-              --replace 'test -x "$PKG_CONFIG"' 'type -P "$PKG_CONFIG" >/dev/null'
-          done
-        '' + ''
-          ./buildconf --copy --force
+              export EXTENSION_DIR=$out/lib/php/extensions
+            ''
+            # PKG_CONFIG need not be a relative path
+            + lib.optionalString (!lib.versionAtLeast version "7.4") ''
+              for i in $(find . -type f -name "*.m4"); do
+                substituteInPlace $i \
+                  --replace 'test -x "$PKG_CONFIG"' 'type -P "$PKG_CONFIG" >/dev/null'
+              done
+            '' + ''
+              ./buildconf --copy --force
 
-          if test -f $src/genfiles; then
-            ./genfiles
-          fi
-        '' + lib.optionalString stdenv.isDarwin ''
-          substituteInPlace configure --replace "-lstdc++" "-lc++"
-        '';
+              if test -f $src/genfiles; then
+                ./genfiles
+              fi
+            '' + lib.optionalString stdenv.isDarwin ''
+              substituteInPlace configure --replace "-lstdc++" "-lc++"
+            '';
 
-      postInstall = ''
-        test -d $out/etc || mkdir $out/etc
-        cp php.ini-production $out/etc/php.ini
-      '';
+          postInstall = ''
+            test -d $out/etc || mkdir $out/etc
+            cp php.ini-production $out/etc/php.ini
+          '';
 
-      postFixup = ''
-        mkdir -p $dev/bin $dev/share/man/man1
-        mv $out/bin/phpize $out/bin/php-config $dev/bin/
-        mv $out/share/man/man1/phpize.1.gz \
-           $out/share/man/man1/php-config.1.gz \
-           $dev/share/man/man1/
-      '';
+          postFixup = ''
+            mkdir -p $dev/bin $dev/share/man/man1
+            mv $out/bin/phpize $out/bin/php-config $dev/bin/
+            mv $out/share/man/man1/phpize.1.gz \
+               $out/share/man/man1/php-config.1.gz \
+               $dev/share/man/man1/
+          '';
 
-      src = fetchurl {
-        url = "https://www.php.net/distributions/php-${version}.tar.bz2";
-        inherit sha256;
-      };
+          src = fetchurl {
+            url = "https://www.php.net/distributions/php-${version}.tar.bz2";
+            inherit sha256;
+          };
 
-      patches = [ ./fix-paths-php7.patch ] ++ extraPatches;
+          patches = [ ./fix-paths-php7.patch ] ++ extraPatches;
 
-      separateDebugInfo = true;
+          separateDebugInfo = true;
 
-      outputs = [ "out" "dev" ];
+          outputs = [ "out" "dev" ];
 
-      passthru = {
-        buildEnv = mkBuildEnv { } [ ];
-        withExtensions = mkWithExtensions { } [ ];
-        inherit ztsSupport;
-      };
+          passthru = {
+            buildEnv = mkBuildEnv { } [ ];
+            withExtensions = mkWithExtensions { } [ ];
+            overrideAttrs =
+              f:
+              let
+                newPhpAttrsOverrides = composeOverrides phpAttrsOverrides f;
+                php = generic (args // { phpAttrsOverrides = newPhpAttrsOverrides; });
+              in
+              php;
+            inherit ztsSupport;
+          };
 
-      meta = with lib; {
-        description = "An HTML-embedded scripting language";
-        homepage = "https://www.php.net/";
-        license = licenses.php301;
-        maintainers = teams.php.members;
-        platforms = platforms.all;
-        outputsToInstall = [ "out" "dev" ];
-      };
-    };
+          meta = with lib; {
+            description = "An HTML-embedded scripting language";
+            homepage = "https://www.php.net/";
+            license = licenses.php301;
+            maintainers = teams.php.members;
+            platforms = platforms.all;
+            outputsToInstall = [ "out" "dev" ];
+          };
+        };
+      in
+      attrs // phpAttrsOverrides attrs
+    );
 in
 generic
diff --git a/pkgs/development/libraries/ada/gnatcoll/bindings.nix b/pkgs/development/libraries/ada/gnatcoll/bindings.nix
index 666989af0acc..fb2a744be7fb 100644
--- a/pkgs/development/libraries/ada/gnatcoll/bindings.nix
+++ b/pkgs/development/libraries/ada/gnatcoll/bindings.nix
@@ -33,13 +33,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gnatcoll-${component}";
-  version = "21.0.0";
+  version = "22.0.0";
 
   src = fetchFromGitHub {
     owner = "AdaCore";
     repo = "gnatcoll-bindings";
     rev = "v${version}";
-    sha256 = "1214hf0m8iz289rjpxdiddnixj65l2xjwbcr7mq5ysbddmig5992";
+    sha256 = "0wbwnd6jccwfd4jdxbnzhc0jhm8ad4phz6y9b1gk8adykkk6jcz4";
   };
 
   patches = [
@@ -68,13 +68,13 @@ stdenv.mkDerivation rec {
 
   buildPhase = ''
     runHook preBuild
-    python3 ${component}/setup.py build $buildFlags
+    ${python3.interpreter} ${component}/setup.py build --prefix $out $buildFlags
     runHook postBuild
   '';
 
   installPhase = ''
     runHook preInstall
-    python3 ${component}/setup.py install --prefix $out
+    ${python3.interpreter} ${component}/setup.py install --prefix $out
     runHook postInstall
   '';
 
diff --git a/pkgs/development/libraries/ada/gnatcoll/core.nix b/pkgs/development/libraries/ada/gnatcoll/core.nix
index f5f84342137e..690361bb1119 100644
--- a/pkgs/development/libraries/ada/gnatcoll/core.nix
+++ b/pkgs/development/libraries/ada/gnatcoll/core.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gnatcoll-core";
-  version = "21.0.0";
+  version = "22.0.0";
 
   src = fetchFromGitHub {
     owner = "AdaCore";
     repo = "gnatcoll-core";
     rev = "v${version}";
-    sha256 = "0jgs2299zfbr6jg5bxlhqizi60si2m8vw7zq6ns4yhr38qqdskqg";
+    sha256 = "0fn28dp6bgpp1sshr09m1x85g2gx11xqkiy410hiicfyg5hamh1l";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/ada/gnatcoll/db.nix b/pkgs/development/libraries/ada/gnatcoll/db.nix
index d0512507db24..0c597f199c34 100644
--- a/pkgs/development/libraries/ada/gnatcoll/db.nix
+++ b/pkgs/development/libraries/ada/gnatcoll/db.nix
@@ -51,13 +51,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gnatcoll-${component}";
-  version = "21.0.0";
+  version = "22.0.0";
 
   src = fetchFromGitHub {
     owner = "AdaCore";
     repo = "gnatcoll-db";
     rev = "v${version}";
-    sha256 = "0fdfng3yfy645nlw8l3c2za0zkn6pdhkvyrw20wnjx4k26glgb6r";
+    sha256 = "1c39yg13faadg5mzpq3s83rn24npmpc4yjj0cvj7kqwpqxci4m55";
   };
 
   patches = lib.optionals (component == "sqlite") [
diff --git a/pkgs/development/libraries/ada/xmlada/default.nix b/pkgs/development/libraries/ada/xmlada/default.nix
index b855166d5590..cd0aad61d403 100644
--- a/pkgs/development/libraries/ada/xmlada/default.nix
+++ b/pkgs/development/libraries/ada/xmlada/default.nix
@@ -9,14 +9,14 @@
 
 stdenv.mkDerivation rec {
   pname = "xmlada";
-  version = "21.0.0";
+  version = "22.0.0";
 
   src = fetchFromGitHub {
     name = "xmlada-${version}-src";
     owner = "AdaCore";
     repo = "xmlada";
     rev = "v${version}";
-    sha256 = "00vljkvck951nj853v9sda5qbfm1mp8y2k61ja2595rmp8qcrazw";
+    sha256 = "1pg6m0sfc1vwvd18r80jv2vwrsb2qgvyl8jmmrmpbdni0npx0kv3";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/ceres-solver/default.nix b/pkgs/development/libraries/ceres-solver/default.nix
index 794a09749c55..f5c000f2271e 100644
--- a/pkgs/development/libraries/ceres-solver/default.nix
+++ b/pkgs/development/libraries/ceres-solver/default.nix
@@ -1,10 +1,16 @@
-{ lib, stdenv
-, eigen
+{ lib
+, stdenv
+, fetchpatch
 , fetchurl
+, blas
 , cmake
+, eigen
 , gflags
 , glog
+, suitesparse
 , runTests ? false
+, enableStatic ? stdenv.hostPlatform.isStatic
+, withBlas ? true
 }:
 
 # gflags is required to run tests
@@ -19,9 +25,24 @@ stdenv.mkDerivation rec {
     sha256 = "00vng9vnmdb1qga01m0why90m0041w7bn6kxa2h4m26aflfqla8h";
   };
 
+  outputs = [ "out" "dev" ];
+
+  patches = [
+    # Enable GNUInstallDirs, see: https://github.com/ceres-solver/ceres-solver/pull/706
+    (fetchpatch {
+      url = "https://github.com/ceres-solver/ceres-solver/commit/4998c549396d36a491f1c0638fe57824a40bcb0d.patch";
+      sha256 = "sha256-mF6Zh2fDVzg2kD4nI2dd9rp4NpvPErmwfdYo5JaBmCA=";
+    })
+  ];
+
   nativeBuildInputs = [ cmake ];
   buildInputs = lib.optional runTests gflags;
-  propagatedBuildInputs = [ eigen glog ];
+  propagatedBuildInputs = [ eigen glog ]
+  ++ lib.optionals withBlas [ blas suitesparse ];
+
+  cmakeFlags = [
+    "-DBUILD_SHARED_LIBS=${if enableStatic then "OFF" else "ON"}"
+  ];
 
   # The Basel BUILD file conflicts with the cmake build directory on
   # case-insensitive filesystems, eg. darwin.
diff --git a/pkgs/development/libraries/farbfeld/default.nix b/pkgs/development/libraries/farbfeld/default.nix
index 07957674bb31..3e1045ab852b 100644
--- a/pkgs/development/libraries/farbfeld/default.nix
+++ b/pkgs/development/libraries/farbfeld/default.nix
@@ -12,6 +12,8 @@ stdenv.mkDerivation rec {
   buildInputs = [ libpng libjpeg ];
   nativeBuildInputs = [ makeWrapper ];
 
+  makeFlags = [ "CC:=$(CC)" ];
+
   installFlags = [ "PREFIX=$(out)" ];
   postInstall = ''
     wrapProgram "$out/bin/2ff" --prefix PATH : "${file}/bin"
diff --git a/pkgs/development/libraries/fcft/default.nix b/pkgs/development/libraries/fcft/default.nix
index 8f2d56fad285..2101ee6dd42b 100644
--- a/pkgs/development/libraries/fcft/default.nix
+++ b/pkgs/development/libraries/fcft/default.nix
@@ -1,39 +1,54 @@
 { stdenv, lib, fetchFromGitea, pkg-config, meson, ninja, scdoc
 , freetype, fontconfig, pixman, tllist, check
-, withHarfBuzz ? true
-, harfbuzz
+# Text shaping methods to enable, empty list disables all text shaping.
+# See `availableShapingTypes` or upstream meson_options.txt for available types.
+, withShapingTypes ? [ "grapheme" "run" ]
+, harfbuzz, utf8proc
+, fcft # for passthru.tests
 }:
 
 let
+  # Needs to be reflect upstream meson_options.txt
+  availableShapingTypes = [
+    "grapheme"
+    "run"
+  ];
+
   # Courtesy of sternenseemann and FRidh, commit c9a7fdfcfb420be8e0179214d0d91a34f5974c54
   mesonFeatureFlag = opt: b: "-D${opt}=${if b then "enabled" else "disabled"}";
 in
 
 stdenv.mkDerivation rec {
   pname = "fcft";
-  version = "2.4.5";
+  version = "2.5.0";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "dnkl";
     repo = "fcft";
     rev = version;
-    sha256 = "0z4bqap88pydkgcxrsvm3fmcyhi9x7z8knliarvdcvqlk7qnyzfh";
+    sha256 = "0agqldh68hn898d3f6k99kjbz8had5j5k0jyvi71d4k9vhx8cy7c";
   };
 
   depsBuildBuild = [ pkg-config ];
   nativeBuildInputs = [ pkg-config meson ninja scdoc ];
   buildInputs = [ freetype fontconfig pixman tllist ]
-    ++ lib.optional withHarfBuzz harfbuzz;
+    ++ lib.optionals (withShapingTypes != []) [ harfbuzz ]
+    ++ lib.optionals (builtins.elem "run" withShapingTypes) [ utf8proc ];
   checkInputs = [ check ];
 
   mesonBuildType = "release";
-  mesonFlags = [
-    (mesonFeatureFlag "text-shaping" withHarfBuzz)
-  ];
+  mesonFlags = builtins.map (t:
+    mesonFeatureFlag "${t}-shaping" (lib.elem t withShapingTypes)
+  ) availableShapingTypes;
 
   doCheck = true;
 
+  passthru.tests = {
+    noShaping = fcft.override { withShapingTypes = []; };
+    onlyGraphemeShaping = fcft.override { withShapingTypes = [ "grapheme" ]; };
+  };
+
   meta = with lib; {
     homepage = "https://codeberg.org/dnkl/fcft";
     changelog = "https://codeberg.org/dnkl/fcft/releases/tag/${version}";
diff --git a/pkgs/development/libraries/gtk/4.x.nix b/pkgs/development/libraries/gtk/4.x.nix
index 78d9174d0953..38df17765c86 100644
--- a/pkgs/development/libraries/gtk/4.x.nix
+++ b/pkgs/development/libraries/gtk/4.x.nix
@@ -59,7 +59,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gtk4";
-  version = "4.4.0";
+  version = "4.4.1";
 
   outputs = [ "out" "dev" ] ++ lib.optionals x11Support [ "devdoc" ];
   outputBin = "dev";
@@ -71,7 +71,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gtk/${lib.versions.majorMinor version}/gtk-${version}.tar.xz";
-    sha256 = "4KFQj0QWhsOiDf7EivUzsZpLLgF8GOruMdzNt9KSUFs=";
+    sha256 = "D6ramD3GsLxAnLNMFxPB8yZ+Z8CT+GseOxfbYQCj3fQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libwebsockets/default.nix b/pkgs/development/libraries/libwebsockets/default.nix
index 777beb9bc14b..15bf77d2fc68 100644
--- a/pkgs/development/libraries/libwebsockets/default.nix
+++ b/pkgs/development/libraries/libwebsockets/default.nix
@@ -1,4 +1,11 @@
-{ fetchFromGitHub, lib, stdenv, cmake, openssl, zlib, libuv }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, openssl
+, zlib
+, libuv
+}:
 
 let
   generic = { version, sha256 }: stdenv.mkDerivation rec {
@@ -64,4 +71,9 @@ in {
     version = "4.2.1";
     sha256 = "sha256-C+WGfNF4tAgbp/7aRraBgjNOe4I5ihm+8CGelXzfxbU=";
   };
+
+  libwebsockets_4_3 = generic {
+    version = "4.3.0";
+    sha256 = "13lxb487mqlzbsbv6fbj50r1717mfwdy87ps592lgfy3307yqpr4";
+  };
 }
diff --git a/pkgs/development/libraries/libxlsxwriter/default.nix b/pkgs/development/libraries/libxlsxwriter/default.nix
index f1d4bd298ded..a2f506de0133 100644
--- a/pkgs/development/libraries/libxlsxwriter/default.nix
+++ b/pkgs/development/libraries/libxlsxwriter/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , minizip
 , python3
 , zlib
@@ -8,15 +9,23 @@
 
 stdenv.mkDerivation rec {
   pname = "libxlsxwriter";
-  version = "1.1.3";
+  version = "1.1.4";
 
   src = fetchFromGitHub {
     owner = "jmcnamara";
     repo = "libxlsxwriter";
     rev = "RELEASE_${version}";
-    sha256 = "sha256-j+tplk8Fdx92YKj7PnchMZWctVmBmNirUmDw5ADmJy0=";
+    sha256 = "sha256-Ef1CipwUEJW/VYx/q98lN0PSxj8c3DbIuql8qU6mTRs=";
   };
 
+  patches = [
+    # https://github.com/jmcnamara/libxlsxwriter/pull/357
+    (fetchpatch {
+      url = "https://github.com/jmcnamara/libxlsxwriter/commit/723629976ede5e6ec9b03ef970381fed06ef95f0.patch";
+      sha256 = "14aw698b5svvbhvadc2vr71isck3k02zdv8xjsa7c33n8331h20g";
+    })
+  ];
+
   nativeBuildInputs = [
     python3.pkgs.pytest
   ];
diff --git a/pkgs/development/libraries/pcl/default.nix b/pkgs/development/libraries/pcl/default.nix
index ee8f4dfe2e0a..8afcdbf33f23 100644
--- a/pkgs/development/libraries/pcl/default.nix
+++ b/pkgs/development/libraries/pcl/default.nix
@@ -32,6 +32,12 @@ stdenv.mkDerivation rec {
     sha256 = "0jhvciaw43y6iqqk7hyxnfhn1b4bsw5fpy04s01r5pkcsjjbdbqc";
   };
 
+  # remove attempt to prevent (x86/x87-specific) extended precision use
+  # when SSE not detected
+  postPatch = lib.optionalString (!(stdenv.isi686 || stdenv.isx86_64)) ''
+    sed -i '/-ffloat-store/d' cmake/pcl_find_sse.cmake
+  '';
+
   nativeBuildInputs = [ pkg-config cmake wrapQtAppsHook ];
   buildInputs = [
     eigen
diff --git a/pkgs/development/libraries/unixODBCDrivers/default.nix b/pkgs/development/libraries/unixODBCDrivers/default.nix
index b4e574e85b1a..958e417ca17c 100644
--- a/pkgs/development/libraries/unixODBCDrivers/default.nix
+++ b/pkgs/development/libraries/unixODBCDrivers/default.nix
@@ -29,13 +29,13 @@
 
   mariadb = stdenv.mkDerivation rec {
     pname = "mariadb-connector-odbc";
-    version = "3.1.4";
+    version = "3.1.14";
 
     src = fetchFromGitHub {
-      owner = "MariaDB";
+      owner = "mariadb-corporation";
       repo = "mariadb-connector-odbc";
       rev = version;
-      sha256 = "1kbz5mng9vx89cw2sx7gsvhbv4h86zwp31fr0hxqing3cwxhkfgw";
+      sha256 = "0wvy6m9qfvjii3kanf2d1rhfaww32kg0d7m57643f79qb05gd6vg";
       # this driver only seems to build correctly when built against the mariadb-connect-c subrepo
       # (see https://github.com/NixOS/nixpkgs/issues/73258)
       fetchSubmodules = true;
diff --git a/pkgs/development/node-packages/default.nix b/pkgs/development/node-packages/default.nix
index 4c72f1527aaf..ea5ab3eadae8 100644
--- a/pkgs/development/node-packages/default.nix
+++ b/pkgs/development/node-packages/default.nix
@@ -340,6 +340,19 @@ let
       '';
     };
 
+    reveal-md = super.reveal-md.override (
+      lib.optionalAttrs (!stdenv.isDarwin) {
+        nativeBuildInputs = [ pkgs.makeWrapper ];
+        prePatch = ''
+          export PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=1
+        '';
+        postInstall = ''
+          wrapProgram $out/bin/reveal-md \
+          --set PUPPETEER_EXECUTABLE_PATH ${pkgs.chromium.outPath}/bin/chromium
+        '';
+      }
+    );
+
     ssb-server = super.ssb-server.override {
       buildInputs = [ pkgs.automake pkgs.autoconf self.node-gyp-build ];
       meta.broken = since "10";
diff --git a/pkgs/development/node-packages/node-packages.json b/pkgs/development/node-packages/node-packages.json
index ce30a571d86d..701f187ee997 100644
--- a/pkgs/development/node-packages/node-packages.json
+++ b/pkgs/development/node-packages/node-packages.json
@@ -239,6 +239,7 @@
 , "redoc-cli"
 , "remod-cli"
 , "reveal.js"
+, "reveal-md"
 , "rimraf"
 , "rollup"
 , { "rust-analyzer-build-deps": "../../misc/vscode-extensions/rust-analyzer/build-deps" }
diff --git a/pkgs/development/node-packages/node-packages.nix b/pkgs/development/node-packages/node-packages.nix
index 368ff2647358..17d137e36bd6 100644
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
@@ -30834,6 +30834,15 @@ let
         sha512 = "om8L9O5XwqeSdwl5NtHgrzK3wcF4fT9T4gb/NktoH8EyoZipas/tvUZLV48xT7fQfMYr9qvb0WEutqdf0LWSqA==";
       };
     };
+    "highlight.js-10.7.2" = {
+      name = "highlight.js";
+      packageName = "highlight.js";
+      version = "10.7.2";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/highlight.js/-/highlight.js-10.7.2.tgz";
+        sha512 = "oFLl873u4usRM9K63j4ME9u3etNF0PLiJhSQ8rdfuL51Wn3zkD6drf9ZW0dOzjnZI22YYG24z30JcmfCZjMgYg==";
+      };
+    };
     "highlight.js-10.7.3" = {
       name = "highlight.js";
       packageName = "highlight.js";
@@ -37595,6 +37604,24 @@ let
         sha512 = "04PDPqSlsqIOaaaGZ+41vq5FejI9auqTInicFRndCBgE3bXG8D6W1I+mWhk+1nqbHmyhla/6BUrd5OSiHwKRXw==";
       };
     };
+    "livereload-0.9.3" = {
+      name = "livereload";
+      packageName = "livereload";
+      version = "0.9.3";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/livereload/-/livereload-0.9.3.tgz";
+        sha512 = "q7Z71n3i4X0R9xthAryBdNGVGAO2R5X+/xXpmKeuPMrteg+W2U8VusTKV3YiJbXZwKsOlFlHe+go6uSNjfxrZw==";
+      };
+    };
+    "livereload-js-3.3.2" = {
+      name = "livereload-js";
+      packageName = "livereload-js";
+      version = "3.3.2";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/livereload-js/-/livereload-js-3.3.2.tgz";
+        sha512 = "w677WnINxFkuixAoUEXOStewzLYGI76XVag+0JWMMEyjJQKs0ibWZMxkTlB96Lm3EjZ7IeOxVziBEbtxVQqQZA==";
+      };
+    };
     "ln-accounting-5.0.5" = {
       name = "ln-accounting";
       packageName = "ln-accounting";
@@ -45825,6 +45852,15 @@ let
         sha512 = "jB5hAtsDOhCy/FNQJwQJOrGlxLUat482Yr14rbA5l2Zb1eOeoS+ccQPO036C1+z9VDBTmOZqzh1tBbI4myzIYw==";
       };
     };
+    "open-8.3.0" = {
+      name = "open";
+      packageName = "open";
+      version = "8.3.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/open/-/open-8.3.0.tgz";
+        sha512 = "7INcPWb1UcOwSQxAXTnBJ+FxVV4MPs/X++FWWBtgY69/J5lc+tCteMt/oFK1MnkyHC4VILLa9ntmwKTwDR4Q9w==";
+      };
+    };
     "open-8.4.0" = {
       name = "open";
       packageName = "open";
@@ -46266,6 +46302,15 @@ let
         sha1 = "75e75a96506611eb1c65ba89018ff08a981e2c16";
       };
     };
+    "opts-2.0.2" = {
+      name = "opts";
+      packageName = "opts";
+      version = "2.0.2";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/opts/-/opts-2.0.2.tgz";
+        sha512 = "k41FwbcLnlgnFh69f4qdUfvDQ+5vaSDnVPFI/y5XuhKRq97EnVVneO9F1ESVCdiVu4fCS2L8usX3mU331hB7pg==";
+      };
+    };
     "ora-1.4.0" = {
       name = "ora";
       packageName = "ora";
@@ -46752,13 +46797,13 @@ let
         sha512 = "RpYIIK1zXSNEOdwxcfe7FdvGcs7+y5n8rifMhMNWvaxRNMPINJHF5GDeuVxWqnfrcHPSCnp7Oo5yNXHId9Av2Q==";
       };
     };
-    "p-memoize-4.0.2" = {
+    "p-memoize-4.0.3" = {
       name = "p-memoize";
       packageName = "p-memoize";
-      version = "4.0.2";
+      version = "4.0.3";
       src = fetchurl {
-        url = "https://registry.npmjs.org/p-memoize/-/p-memoize-4.0.2.tgz";
-        sha512 = "REJQ6EIeFmvT9O/u0H/ZVWjRII/1/0GhckleQX0yn+Uk9EdXTtmfnrfa3FwF8ZUrfUEe8NInvlRa0ZBKlMxxTA==";
+        url = "https://registry.npmjs.org/p-memoize/-/p-memoize-4.0.3.tgz";
+        sha512 = "lX9GfP1NT5jheKsmvc1071L74/Vw7vul+uZEnst7LNuMtbKlWYwKItqcLSAVUyJnrfQAqFFCJQ5bt0whrDsWQA==";
       };
     };
     "p-pipe-3.1.0" = {
@@ -46788,6 +46833,15 @@ let
         sha512 = "2USApvnsutq8uoxZBGbbWM0JIYLiEMJ9RlaN7fAzVNb9OZN0SHjjTTfIcb667XynS5Y1VhwDJVDa72TnPzAYWw==";
       };
     };
+    "p-reflect-2.1.0" = {
+      name = "p-reflect";
+      packageName = "p-reflect";
+      version = "2.1.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/p-reflect/-/p-reflect-2.1.0.tgz";
+        sha512 = "paHV8NUz8zDHu5lhr/ngGWQiW067DK/+IbJ+RfZ4k+s8y4EKyYCz8pGYWjxCg35eHztpJAt+NUgvN4L+GCbPlg==";
+      };
+    };
     "p-retry-3.0.1" = {
       name = "p-retry";
       packageName = "p-retry";
@@ -46815,6 +46869,15 @@ let
         sha512 = "e2xXGNhZOZ0lfgR9kL34iGlU8N/KO0xZnQxVEwdeOvpqNDQfdnxIYizvWtK8RglUa3bGqI8g0R/BdfzLMxRkiA==";
       };
     };
+    "p-settle-4.1.1" = {
+      name = "p-settle";
+      packageName = "p-settle";
+      version = "4.1.1";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/p-settle/-/p-settle-4.1.1.tgz";
+        sha512 = "6THGh13mt3gypcNMm0ADqVNCcYa3BK6DWsuJWFCuEKP1rpY+OKGp7gaZwVmLspmic01+fsg/fN57MfvDzZ/PuQ==";
+      };
+    };
     "p-some-4.1.0" = {
       name = "p-some";
       packageName = "p-some";
@@ -51730,6 +51793,15 @@ let
         sha512 = "l1jNAspIBSFqbT+y+5FosojNpVpF94nlI+wDUpqP9enwOTfHx9f0gh5nB96vl+6yTpsJsypeNrwfzPrKuHB41A==";
       };
     };
+    "puppeteer-1.19.0" = {
+      name = "puppeteer";
+      packageName = "puppeteer";
+      version = "1.19.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/puppeteer/-/puppeteer-1.19.0.tgz";
+        sha512 = "2S6E6ygpoqcECaagDbBopoSOPDv0pAZvTbnBgUY+6hq0/XDFDOLEMNlHF/SKJlzcaZ9ckiKjKDuueWI3FN/WXw==";
+      };
+    };
     "puppeteer-1.20.0" = {
       name = "puppeteer";
       packageName = "puppeteer";
@@ -55762,6 +55834,15 @@ let
         sha1 = "fece61bfa0c1b52a206bd6b18198184bdd523a3b";
       };
     };
+    "reveal.js-4.1.3" = {
+      name = "reveal.js";
+      packageName = "reveal.js";
+      version = "4.1.3";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/reveal.js/-/reveal.js-4.1.3.tgz";
+        sha512 = "5VbL4nVDUedVKnOIIM3UQAIUlp+CvR/SrUkrN5GDoVfcWJAxH2oIh7PWyShy7+pE7tgkH2q+3e5EikGRpgE+oA==";
+      };
+    };
     "reverse-http-1.3.0" = {
       name = "reverse-http";
       packageName = "reverse-http";
@@ -58939,6 +59020,15 @@ let
         sha512 = "oie3/+gKf7QtpitB0LYLETe+k8SifzsX4KixvpOsbI6S0kRiRQ5MKOio8eMSAKQ17N06+wdEOXRiId+zOxo0hA==";
       };
     };
+    "spdx-license-ids-3.0.11" = {
+      name = "spdx-license-ids";
+      packageName = "spdx-license-ids";
+      version = "3.0.11";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/spdx-license-ids/-/spdx-license-ids-3.0.11.tgz";
+        sha512 = "Ctl2BrFiM0X3MANYgj3CkygxhRmr9mi6xhejbdO960nF6EDJApTYpn0BQnDKlnNBULKiCN1n3w9EBkHK8ZWg+g==";
+      };
+    };
     "spdx-license-list-6.4.0" = {
       name = "spdx-license-list";
       packageName = "spdx-license-list";
@@ -61684,13 +61774,13 @@ let
         sha512 = "33+lQwlLxXoxy0o9WLOgw8OjbXeS3Jv+pSl+nxKc2AOClBI28HsdRPpH0u9Xa9OVjHLT9vonnOMw1ug7YXI0dA==";
       };
     };
-    "systeminformation-5.9.12" = {
+    "systeminformation-5.9.13" = {
       name = "systeminformation";
       packageName = "systeminformation";
-      version = "5.9.12";
+      version = "5.9.13";
       src = fetchurl {
-        url = "https://registry.npmjs.org/systeminformation/-/systeminformation-5.9.12.tgz";
-        sha512 = "9tCCSA5ChSWBadJrrs7GYSvCBt9oKeqBAp0tv4FaeAIrYjIJ4gxrkFc+2xdMrJd8HEGKBMD2TSTMsXhmn+dBtw==";
+        url = "https://registry.npmjs.org/systeminformation/-/systeminformation-5.9.13.tgz";
+        sha512 = "AGL34jWboB7bjmNYIcJ5hbYEVYXQuLPbIq7bJg3rJJNHYZvZkQC9hH15KpH9CPg9ZxCsTqAfUNyGMv1jmv78Tw==";
       };
     };
     "sywac-1.3.0" = {
@@ -63602,6 +63692,15 @@ let
         sha1 = "405923909592d56f78a5818434b0b78489ca5f2b";
       };
     };
+    "try-require-1.2.1" = {
+      name = "try-require";
+      packageName = "try-require";
+      version = "1.2.1";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/try-require/-/try-require-1.2.1.tgz";
+        sha1 = "34489a2cac0c09c1cc10ed91ba011594d4333be2";
+      };
+    };
     "try-resolve-1.0.1" = {
       name = "try-resolve";
       packageName = "try-resolve";
@@ -65978,13 +66077,13 @@ let
         sha1 = "23f89069a6c62f46cf3a1d3b00169cefb90be0c6";
       };
     };
-    "usb-1.9.0" = {
+    "usb-1.9.1" = {
       name = "usb";
       packageName = "usb";
-      version = "1.9.0";
+      version = "1.9.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/usb/-/usb-1.9.0.tgz";
-        sha512 = "nybH1SzvwYkRQ5s8ko9XXyZkrcWV5VWMMv7yh5H++wALhjBFjt2XBoSJWxBUdu6U/UfceQz42inhv3/maxM8jg==";
+        url = "https://registry.npmjs.org/usb/-/usb-1.9.1.tgz";
+        sha512 = "T6DZbJAFNcxhY1FzaYdXhV2oqoRlvLhtSSmnbFAqyCxahUkc+g0BPZVXv7hIeQQxDCAQnr4Ia8bfOk1JlzNzzw==";
       };
     };
     "use-3.1.1" = {
@@ -70210,6 +70309,15 @@ let
         sha1 = "e52e84fea6983b93755e9b1564dba989b006b5a5";
       };
     };
+    "yaml-front-matter-4.1.1" = {
+      name = "yaml-front-matter";
+      packageName = "yaml-front-matter";
+      version = "4.1.1";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/yaml-front-matter/-/yaml-front-matter-4.1.1.tgz";
+        sha512 = "ULGbghCLsN8Hs8vfExlqrJIe8Hl2TUjD7/zsIGMP8U+dgRXEsDXk4yydxeZJgdGiimP1XB7zhmhOB4/HyfqOyQ==";
+      };
+    };
     "yaml-include-1.2.1" = {
       name = "yaml-include";
       packageName = "yaml-include";
@@ -97645,7 +97753,7 @@ in
           sources."supports-color-7.2.0"
         ];
       })
-      sources."systeminformation-5.9.12"
+      sources."systeminformation-5.9.13"
       sources."term-canvas-0.0.5"
       sources."type-fest-0.21.3"
       sources."wordwrap-0.0.3"
@@ -98047,7 +98155,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.10"
+      sources."spdx-license-ids-3.0.11"
       sources."split-string-3.1.0"
       sources."stack-trace-0.0.10"
       (sources."static-extend-0.1.2" // {
@@ -98444,7 +98552,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.10"
+      sources."spdx-license-ids-3.0.11"
       sources."split-string-3.1.0"
       sources."stack-trace-0.0.10"
       (sources."static-extend-0.1.2" // {
@@ -102052,7 +102160,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.10"
+      sources."spdx-license-ids-3.0.11"
       sources."split-string-3.1.0"
       sources."sshpk-1.16.1"
       (sources."static-extend-0.1.2" // {
@@ -104272,7 +104380,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.10"
+      sources."spdx-license-ids-3.0.11"
       sources."split-1.0.1"
       sources."split-on-first-1.1.0"
       sources."split2-3.2.2"
@@ -106234,7 +106342,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.10"
+      sources."spdx-license-ids-3.0.11"
       sources."split-string-3.1.0"
       sources."sprintf-js-1.0.3"
       sources."sshpk-1.16.1"
@@ -108206,7 +108314,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.10"
+      sources."spdx-license-ids-3.0.11"
       (sources."sshpk-1.16.1" // {
         dependencies = [
           sources."assert-plus-1.0.0"
@@ -108926,7 +109034,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.10"
+      sources."spdx-license-ids-3.0.11"
       sources."sshpk-1.16.1"
       sources."ssri-5.3.0"
       sources."string-width-1.0.2"
@@ -109490,11 +109598,13 @@ in
       sources."p-limit-2.3.0"
       sources."p-locate-4.1.0"
       sources."p-map-4.0.0"
-      (sources."p-memoize-4.0.2" // {
+      (sources."p-memoize-4.0.3" // {
         dependencies = [
           sources."mimic-fn-3.1.0"
         ];
       })
+      sources."p-reflect-2.1.0"
+      sources."p-settle-4.1.1"
       sources."p-timeout-4.1.0"
       sources."p-try-2.2.0"
       (sources."package-json-6.5.0" // {
@@ -109594,7 +109704,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.10"
+      sources."spdx-license-ids-3.0.11"
       sources."split-1.0.1"
       sources."string-width-4.2.3"
       sources."strip-ansi-6.0.1"
@@ -111853,7 +111963,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.10"
+      sources."spdx-license-ids-3.0.11"
       sources."speedometer-0.1.4"
       sources."stream-buffers-2.2.0"
       sources."string-width-1.0.2"
@@ -112667,7 +112777,7 @@ in
       sources."statuses-1.5.0"
       sources."string_decoder-0.10.31"
       sources."supports-color-7.2.0"
-      sources."systeminformation-5.9.12"
+      sources."systeminformation-5.9.13"
       sources."to-regex-range-5.0.1"
       sources."toidentifier-1.0.0"
       sources."tslib-2.3.1"
@@ -116267,7 +116377,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.10"
+      sources."spdx-license-ids-3.0.11"
       (sources."string-length-3.1.0" // {
         dependencies = [
           sources."ansi-regex-4.1.0"
@@ -116315,6 +116425,290 @@ in
     bypassCache = true;
     reconstructLock = true;
   };
+  reveal-md = nodeEnv.buildNodePackage {
+    name = "reveal-md";
+    packageName = "reveal-md";
+    version = "5.2.0";
+    src = fetchurl {
+      url = "https://registry.npmjs.org/reveal-md/-/reveal-md-5.2.0.tgz";
+      sha512 = "vd3fS4qP/g7pUwLhbPUONK6YKPcgD3cxExDeZFOq+LRZqLgRWxnzXWMCIPsszvMCo0+n+hXEadNqrf9QrVeWkw==";
+    };
+    dependencies = [
+      sources."@sindresorhus/is-0.14.0"
+      sources."@szmarczak/http-timer-1.1.2"
+      sources."accepts-1.3.7"
+      sources."agent-base-4.3.0"
+      sources."ansi-align-3.0.1"
+      sources."ansi-regex-5.0.1"
+      sources."ansi-styles-4.3.0"
+      sources."anymatch-3.1.2"
+      sources."argparse-1.0.10"
+      sources."array-flatten-1.1.1"
+      sources."async-limiter-1.0.1"
+      sources."balanced-match-1.0.2"
+      sources."binary-extensions-2.2.0"
+      (sources."body-parser-1.19.0" // {
+        dependencies = [
+          sources."debug-2.6.9"
+          sources."ms-2.0.0"
+        ];
+      })
+      sources."boxen-5.1.2"
+      sources."brace-expansion-1.1.11"
+      sources."braces-3.0.2"
+      sources."buffer-crc32-0.2.13"
+      sources."buffer-from-1.1.2"
+      sources."bytes-3.1.0"
+      (sources."cacheable-request-6.1.0" // {
+        dependencies = [
+          sources."get-stream-5.2.0"
+          sources."lowercase-keys-2.0.0"
+        ];
+      })
+      sources."camelcase-6.2.0"
+      sources."chalk-4.1.2"
+      sources."chokidar-3.5.2"
+      sources."ci-info-2.0.0"
+      sources."cli-boxes-2.2.1"
+      sources."clone-response-1.0.2"
+      sources."color-convert-2.0.1"
+      sources."color-name-1.1.4"
+      sources."commander-6.2.1"
+      sources."concat-map-0.0.1"
+      sources."concat-stream-1.6.2"
+      sources."configstore-5.0.1"
+      sources."content-disposition-0.5.3"
+      sources."content-type-1.0.4"
+      sources."cookie-0.4.0"
+      sources."cookie-signature-1.0.6"
+      sources."core-util-is-1.0.3"
+      sources."crypto-random-string-2.0.0"
+      sources."debug-4.3.2"
+      sources."decompress-response-3.3.0"
+      sources."deep-extend-0.6.0"
+      sources."defer-to-connect-1.1.3"
+      sources."define-lazy-prop-2.0.0"
+      sources."depd-1.1.2"
+      sources."destroy-1.0.4"
+      sources."dot-prop-5.3.0"
+      sources."duplexer3-0.1.4"
+      sources."ee-first-1.1.1"
+      sources."emoji-regex-8.0.0"
+      sources."encodeurl-1.0.2"
+      sources."end-of-stream-1.4.4"
+      sources."es6-promise-4.2.8"
+      sources."es6-promisify-5.0.0"
+      sources."escape-goat-2.1.1"
+      sources."escape-html-1.0.3"
+      sources."esprima-4.0.1"
+      sources."etag-1.8.1"
+      (sources."express-4.17.1" // {
+        dependencies = [
+          sources."debug-2.6.9"
+          sources."ms-2.0.0"
+        ];
+      })
+      (sources."extract-zip-1.7.0" // {
+        dependencies = [
+          sources."debug-2.6.9"
+          sources."ms-2.0.0"
+        ];
+      })
+      sources."fd-slicer-1.1.0"
+      sources."fill-range-7.0.1"
+      (sources."finalhandler-1.1.2" // {
+        dependencies = [
+          sources."debug-2.6.9"
+          sources."ms-2.0.0"
+        ];
+      })
+      sources."forwarded-0.2.0"
+      sources."fresh-0.5.2"
+      sources."fs-extra-10.0.0"
+      sources."fs.realpath-1.0.0"
+      sources."fsevents-2.3.2"
+      sources."get-stream-4.1.0"
+      sources."glob-7.2.0"
+      sources."glob-parent-5.1.2"
+      sources."global-dirs-3.0.0"
+      sources."got-9.6.0"
+      sources."graceful-fs-4.2.8"
+      sources."has-flag-4.0.0"
+      sources."has-yarn-2.1.0"
+      sources."highlight.js-10.7.2"
+      sources."http-cache-semantics-4.1.0"
+      sources."http-errors-1.7.2"
+      (sources."https-proxy-agent-2.2.4" // {
+        dependencies = [
+          sources."debug-3.2.7"
+        ];
+      })
+      sources."iconv-lite-0.4.24"
+      sources."import-lazy-2.1.0"
+      sources."imurmurhash-0.1.4"
+      sources."inflight-1.0.6"
+      sources."inherits-2.0.3"
+      sources."ini-2.0.0"
+      sources."ipaddr.js-1.9.1"
+      sources."is-binary-path-2.1.0"
+      sources."is-ci-2.0.0"
+      sources."is-docker-2.2.1"
+      sources."is-extglob-2.1.1"
+      sources."is-fullwidth-code-point-3.0.0"
+      sources."is-glob-4.0.3"
+      sources."is-installed-globally-0.4.0"
+      sources."is-npm-5.0.0"
+      sources."is-number-7.0.0"
+      sources."is-obj-2.0.0"
+      sources."is-path-inside-3.0.3"
+      sources."is-typedarray-1.0.0"
+      sources."is-wsl-2.2.0"
+      sources."is-yarn-global-0.3.0"
+      sources."isarray-1.0.0"
+      sources."js-yaml-3.14.1"
+      sources."json-buffer-3.0.0"
+      sources."jsonfile-6.1.0"
+      sources."keyv-3.1.0"
+      sources."latest-version-5.1.0"
+      sources."livereload-0.9.3"
+      sources."livereload-js-3.3.2"
+      sources."lodash-4.17.21"
+      sources."lowercase-keys-1.0.1"
+      sources."lru-cache-6.0.0"
+      (sources."make-dir-3.1.0" // {
+        dependencies = [
+          sources."semver-6.3.0"
+        ];
+      })
+      sources."media-typer-0.3.0"
+      sources."merge-descriptors-1.0.1"
+      sources."methods-1.1.2"
+      sources."mime-1.6.0"
+      sources."mime-db-1.51.0"
+      sources."mime-types-2.1.34"
+      sources."mimic-response-1.0.1"
+      sources."minimatch-3.0.4"
+      sources."minimist-1.2.5"
+      sources."mkdirp-0.5.5"
+      sources."ms-2.1.2"
+      sources."mustache-4.2.0"
+      sources."negotiator-0.6.2"
+      sources."normalize-path-3.0.0"
+      sources."normalize-url-4.5.1"
+      sources."on-finished-2.3.0"
+      sources."once-1.4.0"
+      sources."open-8.3.0"
+      sources."opts-2.0.2"
+      sources."p-cancelable-1.1.0"
+      (sources."package-json-6.5.0" // {
+        dependencies = [
+          sources."semver-6.3.0"
+        ];
+      })
+      sources."parseurl-1.3.3"
+      sources."path-is-absolute-1.0.1"
+      sources."path-to-regexp-0.1.7"
+      sources."pend-1.2.0"
+      sources."picomatch-2.3.0"
+      sources."prepend-http-2.0.0"
+      sources."process-nextick-args-2.0.1"
+      sources."progress-2.0.3"
+      sources."proxy-addr-2.0.7"
+      sources."proxy-from-env-1.1.0"
+      sources."pump-3.0.0"
+      sources."pupa-2.1.1"
+      (sources."puppeteer-1.19.0" // {
+        dependencies = [
+          sources."mime-2.6.0"
+          sources."ws-6.2.2"
+        ];
+      })
+      sources."qs-6.7.0"
+      sources."range-parser-1.2.1"
+      sources."raw-body-2.4.0"
+      (sources."rc-1.2.8" // {
+        dependencies = [
+          sources."ini-1.3.8"
+        ];
+      })
+      sources."readable-stream-2.3.7"
+      sources."readdirp-3.6.0"
+      sources."registry-auth-token-4.2.1"
+      sources."registry-url-5.1.0"
+      sources."responselike-1.0.2"
+      sources."reveal.js-4.1.3"
+      sources."rimraf-2.7.1"
+      sources."safe-buffer-5.1.2"
+      sources."safer-buffer-2.1.2"
+      sources."semver-7.3.5"
+      (sources."semver-diff-3.1.1" // {
+        dependencies = [
+          sources."semver-6.3.0"
+        ];
+      })
+      (sources."send-0.17.1" // {
+        dependencies = [
+          (sources."debug-2.6.9" // {
+            dependencies = [
+              sources."ms-2.0.0"
+            ];
+          })
+          sources."ms-2.1.1"
+        ];
+      })
+      (sources."serve-favicon-2.5.0" // {
+        dependencies = [
+          sources."ms-2.1.1"
+          sources."safe-buffer-5.1.1"
+        ];
+      })
+      sources."serve-static-1.14.1"
+      sources."setprototypeof-1.1.1"
+      sources."signal-exit-3.0.5"
+      sources."sprintf-js-1.0.3"
+      sources."statuses-1.5.0"
+      sources."string-width-4.2.3"
+      sources."string_decoder-1.1.1"
+      sources."strip-ansi-6.0.1"
+      sources."strip-json-comments-2.0.1"
+      sources."supports-color-7.2.0"
+      sources."to-readable-stream-1.0.0"
+      sources."to-regex-range-5.0.1"
+      sources."toidentifier-1.0.0"
+      sources."try-require-1.2.1"
+      sources."type-fest-0.20.2"
+      sources."type-is-1.6.18"
+      sources."typedarray-0.0.6"
+      sources."typedarray-to-buffer-3.1.5"
+      sources."unique-string-2.0.0"
+      sources."universalify-2.0.0"
+      sources."unpipe-1.0.0"
+      sources."update-notifier-5.1.0"
+      sources."url-parse-lax-3.0.0"
+      sources."util-deprecate-1.0.2"
+      sources."utils-merge-1.0.1"
+      sources."vary-1.1.2"
+      sources."widest-line-3.1.0"
+      sources."wrap-ansi-7.0.0"
+      sources."wrappy-1.0.2"
+      sources."write-file-atomic-3.0.3"
+      sources."ws-7.5.5"
+      sources."xdg-basedir-4.0.0"
+      sources."yallist-4.0.0"
+      sources."yaml-front-matter-4.1.1"
+      sources."yargs-parser-20.2.9"
+      sources."yauzl-2.10.0"
+    ];
+    buildInputs = globalBuildInputs;
+    meta = {
+      description = "reveal.js on steroids! Get beautiful reveal.js presentations from your Markdown files.";
+      homepage = "https://github.com/webpro/reveal-md#readme";
+      license = "MIT";
+    };
+    production = true;
+    bypassCache = true;
+    reconstructLock = true;
+  };
   rimraf = nodeEnv.buildNodePackage {
     name = "rimraf";
     packageName = "rimraf";
@@ -118828,7 +119222,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.10"
+      sources."spdx-license-ids-3.0.11"
       sources."speedtest-net-1.6.2"
       sources."string-width-2.1.1"
       sources."strip-ansi-4.0.0"
@@ -120471,7 +120865,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.10"
+      sources."spdx-license-ids-3.0.11"
       sources."split-1.0.1"
       sources."sprintf-js-1.0.3"
       (sources."sshpk-1.16.1" // {
@@ -120686,10 +121080,10 @@ in
   stylelint = nodeEnv.buildNodePackage {
     name = "stylelint";
     packageName = "stylelint";
-    version = "14.0.1";
+    version = "14.1.0";
     src = fetchurl {
-      url = "https://registry.npmjs.org/stylelint/-/stylelint-14.0.1.tgz";
-      sha512 = "ZcAkmFLVCultmwkQUjxKzxW/o5+CzNmDk6TPJj/d4Y7ipTGGrewIWmNm+InjdSr04PR5/yynsAJeYJY/wisdMg==";
+      url = "https://registry.npmjs.org/stylelint/-/stylelint-14.1.0.tgz";
+      sha512 = "IedkssuNVA11+v++2PIV2OHOU5A3SfRcXVi56vZVSsMhGrgtwmmit69jeM+08/Tun5DTBe7BuH1Zp1mMLmtKLA==";
     };
     dependencies = [
       sources."@babel/code-frame-7.16.0"
@@ -120859,7 +121253,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.10"
+      sources."spdx-license-ids-3.0.11"
       sources."specificity-0.4.1"
       sources."string-width-4.2.3"
       sources."strip-ansi-6.0.1"
@@ -121880,7 +122274,7 @@ in
       sources."node-addon-api-4.2.0"
       sources."node-gyp-build-4.3.0"
       sources."q-1.5.1"
-      sources."usb-1.9.0"
+      sources."usb-1.9.1"
     ];
     buildInputs = globalBuildInputs;
     meta = {
@@ -122164,7 +122558,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.10"
+      sources."spdx-license-ids-3.0.11"
       sources."sprintf-js-1.0.3"
       (sources."string-width-1.0.2" // {
         dependencies = [
@@ -122560,7 +122954,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.10"
+      sources."spdx-license-ids-3.0.11"
       sources."split-0.2.10"
       (sources."split-transform-stream-0.1.1" // {
         dependencies = [
@@ -126639,7 +127033,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.10"
+      sources."spdx-license-ids-3.0.11"
       sources."split-string-3.1.0"
       sources."sprintf-js-1.0.3"
       sources."stampit-1.2.0"
@@ -129428,7 +129822,7 @@ in
       sources."spdx-correct-3.1.1"
       sources."spdx-exceptions-2.3.0"
       sources."spdx-expression-parse-3.0.1"
-      sources."spdx-license-ids-3.0.10"
+      sources."spdx-license-ids-3.0.11"
       sources."sprintf-js-1.1.2"
       sources."sshpk-1.16.1"
       sources."ssri-8.0.1"
diff --git a/pkgs/development/python-modules/ha-philipsjs/default.nix b/pkgs/development/python-modules/ha-philipsjs/default.nix
index 14b60f551435..8bf2b5863f08 100644
--- a/pkgs/development/python-modules/ha-philipsjs/default.nix
+++ b/pkgs/development/python-modules/ha-philipsjs/default.nix
@@ -12,14 +12,16 @@
 
 buildPythonPackage rec {
   pname = "ha-philipsjs";
-  version = "2.7.5";
+  version = "2.7.6";
+  format = "setuptools";
+
   disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "danielperna84";
     repo = pname;
     rev = version;
-    sha256 = "sha256-CAYyVNVq1rZZ/AYOAE8bfd7f94+PlAsnFRdguparNtY=";
+    sha256 = "sha256-U5XigLFkpRoIXcFB4dpxi8pxqcmmb20sv9i9J70s0C0=";
   };
 
   propagatedBuildInputs = [
@@ -34,7 +36,9 @@ buildPythonPackage rec {
     respx
   ];
 
-  pythonImportsCheck = [ "haphilipsjs" ];
+  pythonImportsCheck = [
+    "haphilipsjs"
+  ];
 
   meta = with lib; {
     description = "Python library to interact with Philips TVs with jointSPACE API";
diff --git a/pkgs/development/python-modules/jupyter_server/default.nix b/pkgs/development/python-modules/jupyter_server/default.nix
index 0e1469e0940e..2cb7d06b646a 100644
--- a/pkgs/development/python-modules/jupyter_server/default.nix
+++ b/pkgs/development/python-modules/jupyter_server/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , buildPythonPackage
+, fetchpatch
 , fetchPypi
 , pythonOlder
 , pytestCheckHook
@@ -34,6 +35,13 @@ buildPythonPackage rec {
     sha256 = "c1f32e0c1807ab2de37bf70af97a36b4436db0bc8af3124632b1f4441038bf95";
   };
 
+  patches = [ (fetchpatch
+    { name = "Normalize-file-name-and-path.patch";
+      url = "https://github.com/jupyter-server/jupyter_server/pull/608/commits/345e26cdfd78651954b68708fa44119c2ac0dbd5.patch";
+      sha256 = "1kqz3dyh2w0h1g1fbvqa13q17hb6y32694rlaasyg213mq6g4k32";
+    })
+  ];
+
   propagatedBuildInputs = [
     argon2_cffi
     jinja2
diff --git a/pkgs/development/python-modules/nbclient/default.nix b/pkgs/development/python-modules/nbclient/default.nix
index b6cfbc51cac0..caf98c420602 100644
--- a/pkgs/development/python-modules/nbclient/default.nix
+++ b/pkgs/development/python-modules/nbclient/default.nix
@@ -18,6 +18,13 @@ buildPythonPackage rec {
   checkInputs = [ pytest xmltodict nbconvert ipywidgets ];
   propagatedBuildInputs = [ async_generator traitlets nbformat nest-asyncio jupyter-client ];
 
+  postFixup =  ''
+    # Remove until fixed by upstream
+    # https://github.com/jupyter/nbclient/pull/173#issuecomment-968760082
+    rm $out/bin/.jupyter-run-wrapped
+    rm $out/bin/jupyter-run
+  '';
+
   meta = with lib; {
     homepage = "https://github.com/jupyter/nbclient";
     description = "A client library for executing notebooks";
diff --git a/pkgs/development/python-modules/pyTelegramBotAPI/default.nix b/pkgs/development/python-modules/pyTelegramBotAPI/default.nix
index 6d1dca6b699f..4c1723edd8ef 100644
--- a/pkgs/development/python-modules/pyTelegramBotAPI/default.nix
+++ b/pkgs/development/python-modules/pyTelegramBotAPI/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "pyTelegramBotAPI";
-  version = "4.1.1";
+  version = "4.2.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "cc8011ca05301653f2e5c2d02eadff0e882b611841a76f9e5b911994899df49e";
+    sha256 = "05f85dacbcf0bdf2459698bab4325f3a699d1c04bc61581627d76d075c3d5488";
   };
 
   propagatedBuildInputs = [ requests ];
diff --git a/pkgs/development/python-modules/pyefergy/default.nix b/pkgs/development/python-modules/pyefergy/default.nix
index 007e605709c3..9906be5154f4 100644
--- a/pkgs/development/python-modules/pyefergy/default.nix
+++ b/pkgs/development/python-modules/pyefergy/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "pyefergy";
-  version = "0.1.3";
+  version = "0.1.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "tkdrob";
     repo = pname;
     rev = version;
-    sha256 = "sha256-TGvS/ntIRbkcMsD5y0QdqyLE2dcPUbX3d79jHc3ddd0=";
+    sha256 = "sha256-X/dWEBg3WG6SmMore5otLL4iIueGUS5KgjCPYoMSNd0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyflunearyou/default.nix b/pkgs/development/python-modules/pyflunearyou/default.nix
index 953f381ff498..99506de1026a 100644
--- a/pkgs/development/python-modules/pyflunearyou/default.nix
+++ b/pkgs/development/python-modules/pyflunearyou/default.nix
@@ -15,15 +15,16 @@
 
 buildPythonPackage rec {
   pname = "pyflunearyou";
-  version = "2.0.2";
+  version = "2021.10.0";
   format = "pyproject";
+
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "bachya";
     repo = pname;
     rev = version;
-    sha256 = "07n2dvnfpfglpdlnwzj4dy41x2zc07ia2krvxdarnv8wzap30y23";
+    sha256 = "sha256-Q65OSE4qckpvaIvZULBR434i7hwuVM97eSq1Blb1oIU=";
   };
 
   nativeBuildInputs = [
@@ -44,11 +45,14 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  # Ignore the examples directory as the files are prefixed with test_.
-  # disabledTestFiles doesn't seem to work here
-  disabledTestPaths = [ "examples/" ];
+  disabledTestPaths = [
+    # Ignore the examples directory as the files are prefixed with test_.
+    "examples/"
+  ];
 
-  pythonImportsCheck = [ "pyflunearyou" ];
+  pythonImportsCheck = [
+    "pyflunearyou"
+  ];
 
   meta = with lib; {
     description = "Python library for retrieving UV-related information from Flu Near You";
diff --git a/pkgs/development/python-modules/pyvolumio/default.nix b/pkgs/development/python-modules/pyvolumio/default.nix
index f4164b884c74..05dcbce167e8 100644
--- a/pkgs/development/python-modules/pyvolumio/default.nix
+++ b/pkgs/development/python-modules/pyvolumio/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "pyvolumio";
-  version = "0.1.4";
+  version = "0.1.5";
 
   disabled = pythonOlder "3.7";
 
@@ -15,7 +15,7 @@ buildPythonPackage rec {
     owner = "OnFreund";
     repo = "PyVolumio";
     rev = "v${version}";
-    sha256 = "0c6kcz9x0n9w67h2gncyhq0dw3q17nmzipcgx59pwqnn33jan5nf";
+    sha256 = "1nyvflap39cwq1cm9wwl9idvfmz1ixsl80f1dnskx22fk0lmvj4h";
   };
 
   propagatedBuildInputs = [ aiohttp ];
diff --git a/pkgs/development/python-modules/slugid/default.nix b/pkgs/development/python-modules/slugid/default.nix
new file mode 100644
index 000000000000..34f394bee302
--- /dev/null
+++ b/pkgs/development/python-modules/slugid/default.nix
@@ -0,0 +1,29 @@
+{ buildPythonPackage
+, lib
+, fetchFromGitHub
+}:
+
+buildPythonPackage rec {
+  pname = "slugid";
+  version = "2.0.0";
+
+  src = fetchFromGitHub {
+    owner = "taskcluster";
+    repo = "slugid.py";
+    rev = "v${version}";
+    sha256 = "McBxGRi8KqVhe2Xez5k4G67R5wBCCoh41dRsTKW4xMA=";
+  };
+
+  doCheck = false; # has no tests
+
+  pythonImportsCheck = [
+    "slugid"
+  ];
+
+  meta = with lib; {
+    description = "URL-safe base64 UUID encoder for generating 22 character slugs";
+    homepage = "https://github.com/taskcluster/slugid.py";
+    license = licenses.mpl20;
+    maintainers = with maintainers; [ milahu ];
+  };
+}
diff --git a/pkgs/development/python-modules/stripe/default.nix b/pkgs/development/python-modules/stripe/default.nix
index 384d7e3902ed..a8c451ebf9a9 100644
--- a/pkgs/development/python-modules/stripe/default.nix
+++ b/pkgs/development/python-modules/stripe/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "stripe";
-  version = "2.61.0";
+  version = "2.62.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8131addd3512a22c4c539dda2d869a8f488e06f1b02d1f3a5f0f4848fc56184e";
+    sha256 = "1fb51d67a961ea889c5be324f020535ed511c6f483bd13a07f48f6e369fa8df0";
   };
 
   propagatedBuildInputs = [ requests ];
diff --git a/pkgs/development/python-modules/striprtf/default.nix b/pkgs/development/python-modules/striprtf/default.nix
index 18ca9313f035..efde42b51954 100644
--- a/pkgs/development/python-modules/striprtf/default.nix
+++ b/pkgs/development/python-modules/striprtf/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "striprtf";
-  version = "0.0.15";
+  version = "0.0.16";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1yvgnmds034z28mscff0amm0g47ni0753nshvrq2swdpipymiwz0";
+    sha256 = "690387117f3341354fddd0957913158d1319c207755c0cc54a614f80248887b2";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/sunpy/default.nix b/pkgs/development/python-modules/sunpy/default.nix
index 8101986f854f..d7ca6c23e4ce 100644
--- a/pkgs/development/python-modules/sunpy/default.nix
+++ b/pkgs/development/python-modules/sunpy/default.nix
@@ -31,12 +31,12 @@
 
 buildPythonPackage rec {
   pname = "sunpy";
-  version = "3.1.0";
+  version = "3.1.1";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-0DF+/lQpsQKO5omBKJAe3gBjQ6QQb50IdRSacIRL/JA=";
+    sha256 = "c8fcd3700d8f4b7880a669f28c44f784422da1dbfe59fb175f155703817695ed";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/torchvision/default.nix b/pkgs/development/python-modules/torchvision/default.nix
index d5b40471c7a5..d17eabb8c35b 100644
--- a/pkgs/development/python-modules/torchvision/default.nix
+++ b/pkgs/development/python-modules/torchvision/default.nix
@@ -24,13 +24,13 @@ let
   cudaArchStr = lib.optionalString cudaSupport lib.strings.concatStringsSep ";" pytorch.cudaArchList;
 in buildPythonPackage rec {
   pname = "torchvision";
-  version = "0.10.1";
+  version = "0.11.1";
 
   src = fetchFromGitHub {
     owner = "pytorch";
     repo = "vision";
     rev = "v${version}";
-    sha256 = "0dw4q4yf86wwkm38bpsjf0yfzai46icvaly861ymh5v9f90q60jw";
+    sha256 = "05dg835mmpzf7k2jn101l7x7cnra1kldwbgf19zblym5lfn21zhf";
   };
 
   nativeBuildInputs = [ libpng ninja which ]
diff --git a/pkgs/development/python-modules/total-connect-client/default.nix b/pkgs/development/python-modules/total-connect-client/default.nix
index fea974adfdee..bcf4910b0d44 100644
--- a/pkgs/development/python-modules/total-connect-client/default.nix
+++ b/pkgs/development/python-modules/total-connect-client/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "total-connect-client";
-  version = "2021.11.2";
+  version = "2021.11.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "craigjmidwinter";
     repo = "total-connect-client";
     rev = version;
-    sha256 = "sha256-JXau+NmulnZ0gg2XsXD9EFv3j2FBMqVqzpT1XGvMZuA=";
+    sha256 = "sha256-iggxKefrVZP4ljf8jGRrCAq0/xQLsr54L42KkdjBqgI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/traits/default.nix b/pkgs/development/python-modules/traits/default.nix
index d0c8f26f8aae..4e93f1369dd3 100644
--- a/pkgs/development/python-modules/traits/default.nix
+++ b/pkgs/development/python-modules/traits/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "traits";
-  version = "6.3.0";
+  version = "6.3.2";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "770241df047feb9e3ed4c26a36c2468a5b754e6082a78eeb737f058bd45344f5";
+    sha256 = "4520ef4a675181f38be4a5bab1b1d5472691597fe2cfe4faf91023e89407e2c6";
   };
 
   propagatedBuildInputs = [ numpy ];
diff --git a/pkgs/development/python-modules/wcmatch/default.nix b/pkgs/development/python-modules/wcmatch/default.nix
index 0cc08a9bf2ce..55cb45b712c3 100644
--- a/pkgs/development/python-modules/wcmatch/default.nix
+++ b/pkgs/development/python-modules/wcmatch/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "wcmatch";
-  version = "8.2";
+  version = "8.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "4d54ddb506c90b5a5bba3a96a1cfb0bb07127909e19046a71d689ddfb18c3617";
+    sha256 = "371072912398af61d1e4e78609e18801c6faecd3cb36c54c82556a60abc965db";
   };
 
   propagatedBuildInputs = [ bracex ];
diff --git a/pkgs/development/python-modules/west/default.nix b/pkgs/development/python-modules/west/default.nix
index 680e37e7a8f5..1f9aad67f19d 100644
--- a/pkgs/development/python-modules/west/default.nix
+++ b/pkgs/development/python-modules/west/default.nix
@@ -3,14 +3,14 @@
 }:
 
 buildPythonPackage rec {
-  version = "0.11.1";
+  version = "0.12.0";
   pname = "west";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "30771f3ec2a4281cd05c277a90f7dc94ded97d6dc1e1decdf4fe452dbbacc283";
+    sha256 = "d7ce0d719fd218fee5983442fe93a33a21a6be6a736915a7ffbe75369714e9ce";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/yfinance/default.nix b/pkgs/development/python-modules/yfinance/default.nix
index 917fbf34d0c9..30b17f6897a9 100644
--- a/pkgs/development/python-modules/yfinance/default.nix
+++ b/pkgs/development/python-modules/yfinance/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage rec {
   pname = "yfinance";
-  version = "0.1.64";
+  version = "0.1.66";
 
   # GitHub source releases aren't tagged
   src = fetchPypi {
     inherit pname version;
-    sha256 = "bde7ff6c04b7179881c15753460c600c4bd877dc9f33cdc98da68e7e1ebbc5a2";
+    sha256 = "9ea6fd18319fd898a8428a4a3d67171812b54779e330ead4d4ed0c59eb311be5";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/youtube-search-python/default.nix b/pkgs/development/python-modules/youtube-search-python/default.nix
index 8c1010552206..634ff5ec54e1 100644
--- a/pkgs/development/python-modules/youtube-search-python/default.nix
+++ b/pkgs/development/python-modules/youtube-search-python/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "youtube-search-python";
-  version = "1.4.9";
+  version = "1.5.1";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9c75540d41f6dcfd19f2f70fbe8346406e026a016aae56b87c207a0b4ff571e0";
+    sha256 = "68c70e1b6a2ce5c2c0ee64ba9c63efc9ab6e6f8acb2f51e19d570b0287e61cc9";
   };
 
   propagatedBuildInputs = [ httpx ];
diff --git a/pkgs/development/python-modules/youtube-transcript-api/default.nix b/pkgs/development/python-modules/youtube-transcript-api/default.nix
index 6829df668b2f..cd40f800c1b4 100644
--- a/pkgs/development/python-modules/youtube-transcript-api/default.nix
+++ b/pkgs/development/python-modules/youtube-transcript-api/default.nix
@@ -2,14 +2,14 @@
 
 buildPythonPackage rec {
   pname = "youtube-transcript-api";
-  version = "0.4.1";
+  version = "0.4.2";
 
   # PyPI tarball is missing some test files
   src = fetchFromGitHub {
     owner = "jdepoix";
     repo = "youtube-transcript-api";
     rev = "v${version}";
-    sha256 = "1gpk13j1n2bifwsg951gmrfnq8kfxjr15rq46dxn1bhyk9hr1zql";
+    sha256 = "04x7mfp4q17w3n8dnklbxblz22496g7g4879nz0wzgijg3m6cwlp";
   };
 
   propagatedBuildInputs = [ requests ];
diff --git a/pkgs/development/tools/build-managers/gprbuild/boot.nix b/pkgs/development/tools/build-managers/gprbuild/boot.nix
index 352cd0b137be..060a74314bd4 100644
--- a/pkgs/development/tools/build-managers/gprbuild/boot.nix
+++ b/pkgs/development/tools/build-managers/gprbuild/boot.nix
@@ -7,14 +7,14 @@
 }:
 
 let
-  version = "21.0.0";
+  version = "22.0.0";
 
   gprConfigKbSrc = fetchFromGitHub {
     name = "gprconfig-kb-${version}-src";
     owner = "AdaCore";
     repo = "gprconfig_kb";
     rev = "v${version}";
-    sha256 = "11qmzfdd0ipmhxl4k2hjidqc9i40bywrfkbiivd3lhscxca5pxpg";
+    sha256 = "0zvd0v5cz0zd1hfnhdd91c6sr3bbv1w715j2gvzx3vxlpx1c2q4n";
   };
 in
 
@@ -27,7 +27,7 @@ stdenv.mkDerivation {
     owner = "AdaCore";
     repo = "gprbuild";
     rev = "v${version}";
-    sha256 = "1knpwasbrz6sxh3dhkc4izchcz4km04j77r4vxxhi23fbd8v1ynj";
+    sha256 = "0rv0ha0kxzab5hhv0jzkjkmchhlvlx8fci8xalnngrgb9nd4r3v8";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/build-managers/gradle/default.nix b/pkgs/development/tools/build-managers/gradle/default.nix
index 877f28419055..443e91325af1 100644
--- a/pkgs/development/tools/build-managers/gradle/default.nix
+++ b/pkgs/development/tools/build-managers/gradle/default.nix
@@ -1,21 +1,20 @@
 { lib, stdenv, fetchurl, unzip, jdk, java ? jdk, makeWrapper }:
 
-let
-  gradleSpec = { version, nativeVersion, sha256 }: rec {
-    inherit nativeVersion;
-    name = "gradle-${version}";
+rec {
+  gradleGen = { version, nativeVersion, sha256 }: stdenv.mkDerivation {
+    pname = "gradle";
+    inherit version;
+
     src = fetchurl {
       inherit sha256;
-      url = "https://services.gradle.org/distributions/${name}-bin.zip";
+      url = "https://services.gradle.org/distributions/gradle-${version}-bin.zip";
     };
-  };
-in
-rec {
-  gradleGen = { name, src, nativeVersion }: stdenv.mkDerivation {
-    inherit name src nativeVersion;
 
     dontBuild = true;
 
+    nativeBuildInputs = [ makeWrapper unzip ];
+    buildInputs = [ java ];
+
     installPhase = ''
       mkdir -pv $out/lib/gradle/
       cp -rv lib/ $out/lib/gradle/
@@ -44,9 +43,6 @@ rec {
       echo ${stdenv.cc.cc} > $out/nix-support/manual-runtime-dependencies
     '';
 
-    nativeBuildInputs = [ makeWrapper unzip ];
-    buildInputs = [ java ];
-
     meta = with lib; {
       description = "Enterprise-grade build system";
       longDescription = ''
@@ -57,7 +53,9 @@ rec {
         between the flexibility of Ant and the convenience of a
         build-by-convention behavior.
       '';
-      homepage = "http://www.gradle.org/";
+      homepage = "https://www.gradle.org/";
+      changelog = "https://docs.gradle.org/${version}/release-notes.html";
+      downloadPage = "https://gradle.org/next-steps/?version=${version}";
       license = licenses.asl20;
       platforms = platforms.unix;
       maintainers = with maintainers; [ lorenzleutgeb ];
@@ -65,20 +63,11 @@ rec {
   };
 
   gradle_latest = gradle_7_3;
-  gradle_7_3 = gradleGen (gradleSpec (import ./gradle-7.3-spec.nix));
-  gradle_6_9 = gradleGen (gradleSpec (import ./gradle-6.9.1-spec.nix));
 
-  # NOTE: No GitHub Release for this release, so update.sh does not work.
-  gradle_5_6 = gradleGen (gradleSpec {
-    version = "5.6.4";
-    nativeVersion = "0.18";
-    sha256 = "03d86bbqd19h9xlanffcjcy3vg1k5905vzhf9mal9g21603nfc0z";
-  });
+  gradle_7_3 = gradleGen (import ./gradle-7.3-spec.nix);
+  gradle_6_9 = gradleGen (import ./gradle-6.9.1-spec.nix);
 
-  # NOTE: No GitHub Release for this release, so update.sh does not work.
-  gradle_4_10 = gradleGen (gradleSpec {
-    version = "4.10.3";
-    nativeVersion = "0.14";
-    sha256 = "0vhqxnk0yj3q9jam5w4kpia70i4h0q4pjxxqwynh3qml0vrcn9l6";
-  });
+  # NOTE: No GitHub Release for the following versions. Update.sh will not work.
+  gradle_5_6 = gradleGen (import ./gradle-5.6.4-spec.nix);
+  gradle_4_10 = gradleGen (import ./gradle-4.10.3-spec.nix);
 }
diff --git a/pkgs/development/tools/build-managers/gradle/gradle-4.10.3-spec.nix b/pkgs/development/tools/build-managers/gradle/gradle-4.10.3-spec.nix
new file mode 100644
index 000000000000..598deab87e06
--- /dev/null
+++ b/pkgs/development/tools/build-managers/gradle/gradle-4.10.3-spec.nix
@@ -0,0 +1,5 @@
+{
+  version = "4.10.3";
+  nativeVersion = "0.14";
+  sha256 = "0vhqxnk0yj3q9jam5w4kpia70i4h0q4pjxxqwynh3qml0vrcn9l6";
+}
diff --git a/pkgs/development/tools/build-managers/gradle/gradle-5.6.4-spec.nix b/pkgs/development/tools/build-managers/gradle/gradle-5.6.4-spec.nix
new file mode 100644
index 000000000000..41e567c1449c
--- /dev/null
+++ b/pkgs/development/tools/build-managers/gradle/gradle-5.6.4-spec.nix
@@ -0,0 +1,5 @@
+{
+  version = "5.6.4";
+  nativeVersion = "0.18";
+  sha256 = "03d86bbqd19h9xlanffcjcy3vg1k5905vzhf9mal9g21603nfc0z";
+}
diff --git a/pkgs/development/tools/electron/default.nix b/pkgs/development/tools/electron/default.nix
index 38f1827e5126..ff61c109b671 100644
--- a/pkgs/development/tools/electron/default.nix
+++ b/pkgs/development/tools/electron/default.nix
@@ -125,23 +125,23 @@ rec {
     headers = "1bd87c74863w0sjs8gfxl62kjjscc56dmmw85vhwz01s4niksr02";
   };
 
-  electron_14 = mkElectron "14.2.0" {
-    armv7l-linux = "a1357716ebda8d7856f233c86a8cbaeccad1c83f1d725d260b0a6510c47042a2";
-    aarch64-linux = "b1f4885c3ad816d89446f64a87b78d5139a27fecbf6317808479bede6fd94ae1";
-    x86_64-linux = "b2faec4744edb20e889c3c85af685c2a6aef90bfff58f55b90038a991cd7691f";
-    i686-linux = "9207af6e3a24dfcc76fded20f26512bcb20f6b652295a4ad3458dc10fd2d7d6e";
-    x86_64-darwin = "d647d658c8c2ec4a69c071e791cf7e823320860f987121bd7390978aecacb073";
-    aarch64-darwin = "f5a7e52b639b94cf9b2ec53969c8014c6d299437c65d98c33d8e5ca812fbfd48";
-    headers = "1y289vr8bws3z6gmhaj3avz95rdhc8gd3rc7bi40jv9j1pnlsd3m";
+  electron_14 = mkElectron "14.2.1" {
+    armv7l-linux = "d95b5055a53ffb4c502885c3b35f0b938c1be3a7b77e378587d99e6ce009e5d5";
+    aarch64-linux = "52d71b92606b639881b82efd369e4cc3fd01cade476cbb25cafb22e05a8c423b";
+    x86_64-linux = "820271f62c17cdfe61ed7bce4eff1e82c375d317b7e8b47f965ce9fa863e5994";
+    i686-linux = "478efa82bf017f65fda6f90405d3ccc6adb073bd4b2ab2985e550b5ac6135cba";
+    x86_64-darwin = "d1684580a1c6e800e488428cc15cb223e9615a456784a7cb86ec116a0afafb85";
+    aarch64-darwin = "b40c8a5b4680d509e1ab799d5a0bee19cebfc5c948196b35d9a92e52ebc8fafd";
+    headers = "14yaw3kml2kmi7sns8z32kv4cd8anyj5nd7rfxcg74hj2pbl9dvp";
   };
 
-  electron_15 = mkElectron "15.3.0" {
-    armv7l-linux = "dfe2851ef94c17eb905cd8cf00b585be072e20a79a02c0c42585a0f51b8cdb20";
-    aarch64-linux = "e0bb8d663dfbe8b65b9e38d4af992a919adc639acfb8748d95ca5b9bbcd7a83c";
-    x86_64-linux = "7cb9c6c9c61848f7d82aaac47ca97bb78c6061e73b176fd3a323652c07335087";
-    i686-linux = "289ef7d53c440a576839a4ee092284009235d740404ea07e6bf82f33254ae8df";
-    x86_64-darwin = "667da0d56bab968d28c41c1f53b901fb685e56d1f56faf33912a240a0397bab5";
-    aarch64-darwin = "9cf5caafc7cbf0e91483e24d5a696b81618d293a5eccd4d122c57baaab88724c";
-    headers = "0jicbplni608cjxwhlrzxkxc9w9b4h6zqssilc9b0yr73jq1fyrd";
+  electron_15 = mkElectron "15.3.1" {
+    armv7l-linux = "b3e73ad174f692da36a4e1d2cd6b849080ee891027e37126868c88e6b89d82ac";
+    aarch64-linux = "35ebfeeedcb71bd256c24550c75b9515fdda2db7a2ee1deb1097040480a26198";
+    x86_64-linux = "941330103b9ab66a0195dd86e1503b5d2087f93a0b1e8453d8270d47cfe2bfc2";
+    i686-linux = "1eeef6b189b4305845a0832b98efcba773c329e351181debe003562a7885afff";
+    x86_64-darwin = "a91b089b5dc5b1279966511344b805ec84869b6cd60af44f800b363bba25b915";
+    aarch64-darwin = "89fafef20426c0a3a2326172d222d29fc5d24d64c8910b7abddf61bd2c6a6700";
+    headers = "0f665x7yp0xz1p1cl8c3vcw3k7g53c13rkbz8cz3phl6v3n1s1w0";
   };
 }
diff --git a/pkgs/development/tools/rnix-lsp/default.nix b/pkgs/development/tools/rnix-lsp/default.nix
index d5a6f962c013..327a93637fc2 100644
--- a/pkgs/development/tools/rnix-lsp/default.nix
+++ b/pkgs/development/tools/rnix-lsp/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, rustPlatform, nixUnstable }:
+{ lib, fetchFromGitHub, rustPlatform, nix }:
 
 rustPlatform.buildRustPackage rec {
   pname = "rnix-lsp";
@@ -13,7 +13,7 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "sha256-Tw05eOIMJj+zX0fqtn6wJwolKNkYqfVuo/WO/WvYu2k=";
 
-  checkInputs = [ nixUnstable ];
+  checkInputs = [ nix ];
 
   meta = with lib; {
     description = "A work-in-progress language server for Nix, with syntax checking and basic completion";
diff --git a/pkgs/development/tools/stylua/default.nix b/pkgs/development/tools/stylua/default.nix
index 229cc9dd4d82..d0b7bbdca9db 100644
--- a/pkgs/development/tools/stylua/default.nix
+++ b/pkgs/development/tools/stylua/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "stylua";
-  version = "0.11.1";
+  version = "0.11.2";
 
   src = fetchFromGitHub {
     owner = "johnnymorganz";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-+5c8baeToaT4k/2VSK/XQki0NPsWTnS6Ap3NpWvj+yI=";
+    sha256 = "sha256-rdtFzHpOvv1uJBigJWenWyIZF/wpYP7iBW2FCsfq2d4=";
   };
 
-  cargoSha256 = "sha256-uIcP5ZNb8K5pySw0Qq46hev9VUbq8XVqmzBBGPagUfE=";
+  cargoSha256 = "sha256-/4ZW1FIfK51ak2EIV6dYY3XpucPPR+OZySPWwcKP4v0=";
 
   cargoBuildFlags = lib.optionals lua52Support [ "--features" "lua52" ]
     ++ lib.optionals luauSupport [ "--features" "luau" ];
diff --git a/pkgs/games/steam/steam.nix b/pkgs/games/steam/steam.nix
index 74ee8778b393..fdc0058a2eee 100644
--- a/pkgs/games/steam/steam.nix
+++ b/pkgs/games/steam/steam.nix
@@ -2,7 +2,7 @@
 
 let
   traceLog = "/tmp/steam-trace-dependencies.log";
-  version = "1.0.0.72";
+  version = "1.0.0.73";
 
 in stdenv.mkDerivation {
   pname = "steam-original";
@@ -10,7 +10,7 @@ in stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://repo.steampowered.com/steam/pool/steam/s/steam/steam_${version}.tar.gz";
-    sha256 = "0l54ljnlnx289i1ssnss78251vyga726dnzsrhgnxwn1p1125m45";
+    sha256 = "sha256-uVO6D1K8zGlq12lrIs7aTQEVnj1bk1P4wRUtkPWkNZE=";
   };
 
   makeFlags = [ "DESTDIR=$(out)" "PREFIX=" ];
diff --git a/pkgs/misc/screensavers/slock/default.nix b/pkgs/misc/screensavers/slock/default.nix
index 63ca76e391f4..9f364ba520cd 100644
--- a/pkgs/misc/screensavers/slock/default.nix
+++ b/pkgs/misc/screensavers/slock/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ xorgproto libX11 libXext libXrandr ];
 
-  installFlags = [ "DESTDIR=\${out}" "PREFIX=" ];
+  installFlags = [ "PREFIX=$(out)" ];
 
   postPatch = "sed -i '/chmod u+s/d' Makefile";
 
@@ -24,6 +24,8 @@ stdenv.mkDerivation rec {
     cp ${writeText "config.def.h" conf} config.def.h
   '';
 
+  makeFlags = [ "CC:=$(CC)" ];
+
   meta = {
     homepage = "https://tools.suckless.org/slock";
     description = "Simple X display locker";
diff --git a/pkgs/os-specific/linux/cpuid/default.nix b/pkgs/os-specific/linux/cpuid/default.nix
index a434501d5126..49c64c9378d3 100644
--- a/pkgs/os-specific/linux/cpuid/default.nix
+++ b/pkgs/os-specific/linux/cpuid/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "cpuid";
-  version = "20211031";
+  version = "20211114";
 
   src = fetchurl {
     url = "http://etallen.com/cpuid/${pname}-${version}.src.tar.gz";
-    sha256 = "13sxb2ar4gypiv0l87lr7hf3qjccwgsg1r92adv9jvrfxcv36pbn";
+    sha256 = "1dz10d958hz7qbh77hxf2k6sc7y9nkvlmr2469hv6gwgqs6dq1vi";
   };
 
   # For pod2man during the build process.
diff --git a/pkgs/servers/blockbook/default.nix b/pkgs/servers/blockbook/default.nix
index b10f8919af7a..475541231b16 100644
--- a/pkgs/servers/blockbook/default.nix
+++ b/pkgs/servers/blockbook/default.nix
@@ -1,35 +1,35 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , buildGoModule
 , fetchFromGitHub
-, packr
 , pkg-config
 , bzip2
 , lz4
-, rocksdb
+, rocksdb_6_23
 , snappy
 , zeromq
 , zlib
 , nixosTests
 }:
 
+let
+  rocksdb = rocksdb_6_23;
+in
 buildGoModule rec {
   pname = "blockbook";
-  version = "0.3.4";
-  commit = "eb4e10a";
+  version = "0.3.6";
+  commit = "5f8cf45";
 
   src = fetchFromGitHub {
     owner = "trezor";
     repo = "blockbook";
     rev = "v${version}";
-    sha256 = "0da1kav5x2xcmwvdgfk1q70l1k0sqqj3njgx2xx885d40m6qbnrs";
+    sha256 = "1jb195chy3kbspmv9vyg7llw6kgykkmvz3znd97mxf24f4q622jv";
   };
 
-  runVend = true;
-  vendorSha256 = "0p7vyw61nwvmaz7gz2bdh9fi6wp62i2vnzw6iz2r8cims4sbz53b";
+  vendorSha256 = "0d17qaqn33wi7lzw4hlym56d9v4qnmvs6plpm5jiby2g5yckq0mz";
 
-  doCheck = false;
-
-  nativeBuildInputs = [ packr pkg-config ];
+  nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [ bzip2 lz4 rocksdb snappy zeromq zlib ];
 
@@ -39,11 +39,14 @@ buildGoModule rec {
     "-X github.com/trezor/blockbook/common.buildDate=unknown"
   ];
 
+  tags = [ "rocksdb_6_16" ];
+
   preBuild = lib.optionalString stdenv.isDarwin ''
     ulimit -n 8192
   '' + ''
     export CGO_LDFLAGS="-L${stdenv.cc.cc.lib}/lib -lrocksdb -lz -lbz2 -lsnappy -llz4 -lm -lstdc++"
-    packr clean && packr
+    buildFlagsArray+=("-tags=${lib.concatStringsSep " " tags}")
+    buildFlagsArray+=("-ldflags=${lib.concatStringsSep " " ldflags}")
   '';
 
   subPackages = [ "." ];
@@ -64,8 +67,5 @@ buildGoModule rec {
     license = licenses.agpl3;
     maintainers = with maintainers; [ mmahut _1000101 ];
     platforms = platforms.unix;
-    # go dependency tecbot/gorocksdb requires rocksdb 5.x but nixpkgs has only rocksdb 6.x
-    # issue in upstream can be tracked here: https://github.com/trezor/blockbook/issues/617
-    broken = true;
   };
 }
diff --git a/pkgs/servers/monitoring/grafana/default.nix b/pkgs/servers/monitoring/grafana/default.nix
index 1ebac5327339..9c36a023b460 100644
--- a/pkgs/servers/monitoring/grafana/default.nix
+++ b/pkgs/servers/monitoring/grafana/default.nix
@@ -2,7 +2,7 @@
 
 buildGo117Module rec {
   pname = "grafana";
-  version = "8.2.3";
+  version = "8.2.4";
 
   excludedPackages = "\\(alert_webhook_listener\\|clean-swagger\\|release_publisher\\|slow_proxy\\|slow_proxy_mac\\|macaron\\)";
 
@@ -10,15 +10,15 @@ buildGo117Module rec {
     rev = "v${version}";
     owner = "grafana";
     repo = "grafana";
-    sha256 = "sha256-GC4pHwthsXu/+dXb1cBk5bC0O6NnyiChC+UWleq7JzA=";
+    sha256 = "sha256-dOV22xwdNLt0TnONzyDw0skGKuAYmiHafhFwhtRMN5M=";
   };
 
   srcStatic = fetchurl {
     url = "https://dl.grafana.com/oss/release/grafana-${version}.linux-amd64.tar.gz";
-    sha256 = "sha256-LOswYw0P3dy6arrmUbnzBU0ie2YcPtk6xqtp9CowG2s=";
+    sha256 = "sha256-nfHUpAnFc2lDGAoHB1fJjF08ndfNlaMJAlsMH+TJNy0=";
   };
 
-  vendorSha256 = "sha256-yZbdUiuRNFRaXduOYps5ygiaUgvNXw+Ah4wZrfYcJlY=";
+  vendorSha256 = "sha256-VvmSNSChbxeLWEQDE4JPfoZckQZ7nG7ElupNCc175Fk=";
 
   nativeBuildInputs = [ wire ];
 
diff --git a/pkgs/shells/zsh/zsh-fast-syntax-highlighting/default.nix b/pkgs/shells/zsh/zsh-fast-syntax-highlighting/default.nix
index d1791e4962f4..5b77978c0221 100644
--- a/pkgs/shells/zsh/zsh-fast-syntax-highlighting/default.nix
+++ b/pkgs/shells/zsh/zsh-fast-syntax-highlighting/default.nix
@@ -5,7 +5,7 @@ stdenvNoCC.mkDerivation rec {
   version = "1.55";
 
   src = fetchFromGitHub {
-    owner = "zdharma";
+    owner = "zdharma-continuum";
     repo = "fast-syntax-highlighting";
     rev = "v${version}";
     sha256 = "0h7f27gz586xxw7cc0wyiv3bx0x3qih2wwh05ad85bh2h834ar8d";
@@ -23,7 +23,7 @@ stdenvNoCC.mkDerivation rec {
 
   meta = with lib; {
     description = "Syntax-highlighting for Zshell";
-    homepage = "https://github.com/zdharma/fast-syntax-highlighting";
+    homepage = "https://github.com/zdharma-continuum/fast-syntax-highlighting";
     license = licenses.bsd3;
     platforms = platforms.unix;
   };
diff --git a/pkgs/test/default.nix b/pkgs/test/default.nix
index d1ec7169e170..e3ef7839c4b4 100644
--- a/pkgs/test/default.nix
+++ b/pkgs/test/default.nix
@@ -37,6 +37,8 @@ with pkgs;
 
   cross = callPackage ./cross {};
 
+  php = recurseIntoAttrs (callPackages ./php {});
+
   rustCustomSysroot = callPackage ./rust-sysroot {};
   buildRustCrate = callPackage ../build-support/rust/build-rust-crate/test { };
   importCargoLock = callPackage ../build-support/rust/test/import-cargo-lock { };
diff --git a/pkgs/test/php/default.nix b/pkgs/test/php/default.nix
new file mode 100644
index 000000000000..3c6c8f61b6db
--- /dev/null
+++ b/pkgs/test/php/default.nix
@@ -0,0 +1,116 @@
+{ lib
+, php
+, runCommand
+}:
+
+let
+  runTest = name: body: runCommand name { } ''
+    testFailed=
+    checking() {
+      echo -n "Checking $1... " > /dev/stderr
+    }
+    ok() {
+      echo ok > /dev/stderr
+    }
+    nok() {
+      echo fail > /dev/stderr
+      testFailed=1
+    }
+
+    ${body}
+
+    if test -n "$testFailed"; then
+      exit 1
+    fi
+
+    touch $out
+  '';
+
+  check = cond: if cond then "ok" else "nok";
+in
+{
+  withExtensions-enables-previously-disabled-extensions = runTest "php-test-withExtensions-enables-previously-disabled-extensions" ''
+    php="${php}"
+
+    checking "that imagick is not present by default"
+    $php/bin/php -r 'exit(extension_loaded("imagick") ? 1 : 0);' && ok || nok
+
+    phpWithImagick="${php.withExtensions ({ all, ... }: [ all.imagick ])}"
+    checking "that imagick extension is present when enabled"
+    $phpWithImagick/bin/php -r 'exit(extension_loaded("imagick") ? 0 : 1);' && ok || nok
+  '';
+
+  overrideAttrs-preserves-enabled-extensions =
+    let
+      customPhp =
+        (php.withExtensions ({ all, ... }: [ all.imagick ])).overrideAttrs (attrs: {
+          postInstall = attrs.postInstall or "" + ''
+            touch "$out/oApee-was-here"
+          '';
+        });
+    in
+    runTest "php-test-overrideAttrs-preserves-enabled-extensions" ''
+      php="${customPhp}"
+      phpUnwrapped="${customPhp.unwrapped}"
+
+      checking "if overrides took hold"
+      test -f "$phpUnwrapped/oApee-was-here" && ok || nok
+
+      checking "if imagick extension is still present"
+      $php/bin/php -r 'exit(extension_loaded("imagick") ? 0 : 1);' && ok || nok
+
+      checking "if imagick extension is linked against the overridden PHP"
+      echo $php
+      $php/bin/php -r 'exit(extension_loaded("imagick") ? 0 : 1);' && ok || nok
+    '';
+
+  unwrapped-overrideAttrs-stacks =
+    let
+      customPhp =
+        lib.pipe php.unwrapped [
+          (pkg: pkg.overrideAttrs (attrs: {
+            postInstall = attrs.postInstall or "" + ''
+              touch "$out/oAs-first"
+            '';
+          }))
+
+          (pkg: pkg.overrideAttrs (attrs: {
+            postInstall = attrs.postInstall or "" + ''
+              touch "$out/oAs-second"
+            '';
+          }))
+        ];
+    in
+    runTest "php-test-unwrapped-overrideAttrs-stacks" ''
+      checking "if first override remained"
+      ${check (builtins.match ".*oAs-first.*" customPhp.postInstall != null)}
+
+      checking "if second override is there"
+      ${check (builtins.match ".*oAs-second.*" customPhp.postInstall != null)}
+    '';
+
+  wrapped-overrideAttrs-stacks =
+    let
+      customPhp =
+        lib.pipe php [
+          (pkg: pkg.overrideAttrs (attrs: {
+            postInstall = attrs.postInstall or "" + ''
+              touch "$out/oAs-first"
+            '';
+          }))
+
+          (pkg: pkg.overrideAttrs (attrs: {
+            postInstall = attrs.postInstall or "" + ''
+              touch "$out/oAs-second"
+            '';
+          }))
+        ];
+    in
+    runTest "php-test-wrapped-overrideAttrs-stacks" ''
+      checking "if first override remained"
+      ${check (builtins.match ".*oAs-first.*" customPhp.unwrapped.postInstall != null)}
+
+      checking "if second override is there"
+      ${check (builtins.match ".*oAs-second.*" customPhp.unwrapped.postInstall != null)}
+    '';
+}
diff --git a/pkgs/tools/admin/netplan/default.nix b/pkgs/tools/admin/netplan/default.nix
index 77f2ad26de1d..b298078aae35 100644
--- a/pkgs/tools/admin/netplan/default.nix
+++ b/pkgs/tools/admin/netplan/default.nix
@@ -20,7 +20,6 @@ stdenv.mkDerivation rec {
     repo = "netplan";
     rev = version;
     hash = "sha256-d8Ze8S/w2nyJkATzLfizMqmr7ad2wrK1mjADClee6WE=";
-    fetchSubmodules = false;
   };
 
   nativeBuildInputs = [
@@ -39,12 +38,14 @@ stdenv.mkDerivation rec {
   ];
 
   postPatch = ''
-    substituteInPlace netplan/cli/utils.py --replace "/lib/netplan/generate" "$out/lib/netplan/generate"
-    substituteInPlace netplan/cli/utils.py --replace "ctypes.util.find_library('netplan')" "\"$out/lib/libnetplan.so\""
+    substituteInPlace netplan/cli/utils.py \
+      --replace "/lib/netplan/generate" "$out/lib/netplan/generate" \
+      --replace "ctypes.util.find_library('netplan')" "\"$out/lib/libnetplan.so\""
 
-    substituteInPlace Makefile --replace 'SYSTEMD_GENERATOR_DIR=' 'SYSTEMD_GENERATOR_DIR ?= ' \
-        --replace 'SYSTEMD_UNIT_DIR=' 'SYSTEMD_UNIT_DIR ?= ' \
-        --replace 'BASH_COMPLETIONS_DIR=' 'BASH_COMPLETIONS_DIR ?= '
+    substituteInPlace Makefile \
+      --replace 'SYSTEMD_GENERATOR_DIR=' 'SYSTEMD_GENERATOR_DIR ?= ' \
+      --replace 'SYSTEMD_UNIT_DIR=' 'SYSTEMD_UNIT_DIR ?= ' \
+      --replace 'BASH_COMPLETIONS_DIR=' 'BASH_COMPLETIONS_DIR ?= '
 
     # from upstream https://github.com/canonical/netplan/blob/ee0d5df7b1dfbc3197865f02c724204b955e0e58/rpm/netplan.spec#L81
     sed -e "s/-Werror//g" -i Makefile
diff --git a/pkgs/tools/graphics/pngcheck/default.nix b/pkgs/tools/graphics/pngcheck/default.nix
index 266b85c54c54..a4680dff6f64 100644
--- a/pkgs/tools/graphics/pngcheck/default.nix
+++ b/pkgs/tools/graphics/pngcheck/default.nix
@@ -11,6 +11,10 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
+  postPatch = lib.optionalString stdenv.isDarwin ''
+    substituteInPlace Makefile.unx --replace "gcc" "clang"
+  '';
+
   makefile = "Makefile.unx";
   makeFlags = [ "ZPATH=${zlib.static}/lib" ];
 
@@ -21,10 +25,11 @@ stdenv.mkDerivation rec {
     cp pngcheck $out/bin/pngcheck
   '';
 
-  meta = {
+  meta = with lib; {
     homepage = "http://pmt.sourceforge.net/pngcrush";
     description = "Verifies the integrity of PNG, JNG and MNG files";
-    license = lib.licenses.free;
-    platforms = with lib.platforms; linux;
+    license = licenses.free;
+    platforms = with platforms; [ unix ];
+    maintainers = with maintainers; [ starcraft66 ];
   };
 }
diff --git a/pkgs/tools/misc/apkeep/default.nix b/pkgs/tools/misc/apkeep/default.nix
index 53e49cc02ca2..4f6d4d983eb8 100644
--- a/pkgs/tools/misc/apkeep/default.nix
+++ b/pkgs/tools/misc/apkeep/default.nix
@@ -11,6 +11,10 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "sha256-YFs2AOMGp0WNrceK14AnigZdJl+UsQdUchpxaI7HSXw=";
 
+  prePatch = ''
+    rm .cargo/config.toml
+  '';
+
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ Security ];
diff --git a/pkgs/tools/misc/broot/default.nix b/pkgs/tools/misc/broot/default.nix
index 96788f8c7319..9817df780ea2 100644
--- a/pkgs/tools/misc/broot/default.nix
+++ b/pkgs/tools/misc/broot/default.nix
@@ -9,19 +9,20 @@
 , oniguruma
 , libiconv
 , Security
+, libxcb
 , zlib
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "broot";
-  version = "1.6.6";
+  version = "1.7.1";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-Aezi005CKhGwCRZ2HwxFRRORBvVoZEzljTcKQZ8b8XI=";
+    sha256 = "sha256-Gg60jeDfHNKUYynJRgN4oLWhcdApWUdO5kRwl5hrFMM=";
   };
 
-  cargoHash = "sha256-d06lvS5ajXPY/AwmE2rkya82mAOeEv04EtBElDvX2+I=";
+  cargoHash = "sha256-xsTlFfgX3Np3M/RqmK30DZBCrY1OXnEkjqBDI+ffd/U=";
 
   nativeBuildInputs = [
     installShellFiles
@@ -29,7 +30,7 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs = [ libgit2 oniguruma ] ++ lib.optionals stdenv.isDarwin [
+  buildInputs = [ libgit2 oniguruma libxcb ] ++ lib.optionals stdenv.isDarwin [
     libiconv
     Security
     zlib
diff --git a/pkgs/tools/misc/cloud-sql-proxy/default.nix b/pkgs/tools/misc/cloud-sql-proxy/default.nix
index 512381d67f29..7228fb84cb72 100644
--- a/pkgs/tools/misc/cloud-sql-proxy/default.nix
+++ b/pkgs/tools/misc/cloud-sql-proxy/default.nix
@@ -2,23 +2,27 @@
 
 buildGoModule rec {
   pname = "cloud-sql-proxy";
-  version = "1.26.0";
+  version = "1.27.0";
 
   src = fetchFromGitHub {
     owner = "GoogleCloudPlatform";
     repo = "cloudsql-proxy";
     rev = "v${version}";
-    sha256 = "sha256-Xgz8ku6szzbgL3cyiggHJYaj4aUhaqgIOUnwKUE1AeY=";
+    sha256 = "sha256-x44nG5M2ycBaf/Fbw5crmAV//yv/WtIYbTjJ7/6TnoI=";
   };
 
   subPackages = [ "cmd/cloud_sql_proxy" ];
 
-  vendorSha256 = "sha256-7KiLJoQ0xH35ae4NGODF4t1S9h86L0TJbCqFVm+bBmk=";
+  vendorSha256 = "sha256-Uw8YJ1qzLYlTkx6wR/FKeDRHGSwZm2za/c0f/OKHiE0=";
+
+  # Disables tests that require running fuse with a hardcoded path
+  doCheck = false;
 
   meta = with lib; {
     description = "An authenticating proxy for Second Generation Google Cloud SQL databases";
     homepage = "https://github.com/GoogleCloudPlatform/cloudsql-proxy";
     license = licenses.asl20;
     maintainers = with maintainers; [ nicknovitski ];
+    mainProgram = "cloud_sql_proxy";
   };
 }
diff --git a/pkgs/tools/misc/less/default.nix b/pkgs/tools/misc/less/default.nix
index 9c5a4b1568be..3c64f4240ea8 100644
--- a/pkgs/tools/misc/less/default.nix
+++ b/pkgs/tools/misc/less/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "less";
-  version = "590";
+  version = "596";
 
   src = fetchurl {
     url = "https://www.greenwoodsoftware.com/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "044fl3izmsi8n1vqzsqdp65q0qyyn5kmsg4sk7id0mxzx15zbbba";
+    sha256 = "sha256-QhqP1ZfnIELu/P6OV2NnerxL6EM/bA321zmhbMDk1cM=";
   };
 
   configureFlags = [ "--sysconfdir=/etc" ] # Look for ‘sysless’ in /etc.
diff --git a/pkgs/tools/misc/miniserve/default.nix b/pkgs/tools/misc/miniserve/default.nix
index b6d0bc9ede23..480201b88792 100644
--- a/pkgs/tools/misc/miniserve/default.nix
+++ b/pkgs/tools/misc/miniserve/default.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "miniserve";
-  version = "0.17.0";
+  version = "0.18.0";
 
   src = fetchFromGitHub {
     owner = "svenstaro";
     repo = "miniserve";
     rev = "v${version}";
-    sha256 = "sha256-DqH/6Uu4L0fWbnGX8s3jCGwBgPE2PLIkS/dZIj+BA9Q=";
+    sha256 = "sha256-5rFxVk+D11Iqr0SP2VYdMEnFwijpxQT8e5EoK2PYtmQ=";
   };
 
-  cargoSha256 = "sha256-LgdVO41e56DIRkky1aF0X80ixs7ZH93Qk9Yx67vkO9E=";
+  cargoSha256 = "sha256-40TJzhaD1bi/u8k472K89A51wKhm/XjBs13W6oU/06Q=";
 
   nativeBuildInputs = [ installShellFiles pkg-config zlib ];
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv Security ];
diff --git a/pkgs/tools/networking/strongswan/default.nix b/pkgs/tools/networking/strongswan/default.nix
index 601446abb95c..9edc1c79fb0c 100644
--- a/pkgs/tools/networking/strongswan/default.nix
+++ b/pkgs/tools/networking/strongswan/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchpatch, fetchFromGitHub
+{ lib, stdenv, fetchFromGitHub
 , pkg-config, autoreconfHook, perl, gperf, bison, flex
 , gmp, python3, iptables, ldns, unbound, openssl, pcsclite, glib
 , openresolv
@@ -17,13 +17,13 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "strongswan";
-  version = "5.8.1"; # Make sure to also update <nixpkgs/nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix> when upgrading!
+  version = "5.9.4"; # Make sure to also update <nixpkgs/nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix> when upgrading!
 
   src = fetchFromGitHub {
     owner = "strongswan";
     repo = "strongswan";
     rev = version;
-    sha256 = "1a1hw2jsbwvkdhhxjmq87hz13ivbgvqwks1q3adz14mqgbc64snd";
+    sha256 = "1y1gs232x7hsbccjga9nbkf4bbi5wxazlkg00qd2v1nz86sfy4cd";
   };
 
   dontPatchELF = true;
@@ -40,19 +40,6 @@ stdenv.mkDerivation rec {
     ./ext_auth-path.patch
     ./firewall_defaults.patch
     ./updown-path.patch
-
-    # Don't use etc/dbus-1/system.d
-    (fetchpatch {
-      url = "https://patch-diff.githubusercontent.com/raw/strongswan/strongswan/pull/150.patch";
-      sha256 = "1irfxb99blb8v3hs0kmlhzkkwbmds1p0gq319z8lmacz36cgyj2c";
-    })
-
-    # fix build with -fno-common tollchain
-    (fetchpatch {
-      name = "fno-common.patch";
-      url = "https://git.strongswan.org/?p=strongswan.git;a=patch;h=91c6387e69c09beaa9b9ca1e28471751a834fc24";
-      sha256 = "0jp9walxwffp5cl7q0hb80h3s2gdj1nn3n8bvnbmwgh2s6pi148f";
-    })
   ];
 
   postPatch = optionalString stdenv.isLinux ''
diff --git a/pkgs/tools/text/hck/default.nix b/pkgs/tools/text/hck/default.nix
index 00ab04a56c66..88ad2308913a 100644
--- a/pkgs/tools/text/hck/default.nix
+++ b/pkgs/tools/text/hck/default.nix
@@ -3,27 +3,26 @@
 , fetchFromGitHub
 , cmake
 , stdenv
-, libiconv
 , CoreFoundation
 , Security
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "hck";
-  version = "0.6.6";
+  version = "0.6.7";
 
   src = fetchFromGitHub {
     owner = "sstadick";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-DUFJZEtJM5Sv41zJvSZ8KsNWFzlictM2T1wS7VxPL04=";
+    sha256 = "sha256-m4YVz3kh4nOkdf6PbbyxjKacUVKdFQet76CMrFYMRHI=";
   };
 
-  cargoSha256 = "sha256-kubQL+p7J2koPDOje5wMxKDeCY4yi0kupfHsJCKYf44=";
+  cargoSha256 = "sha256-4z1kHSev+5+0wpYFEGvvafB50Wz1wr6zObCjvHR9FPU=";
 
   nativeBuildInputs = [ cmake ];
 
-  buildInputs = lib.optionals stdenv.isDarwin [ libiconv CoreFoundation Security ];
+  buildInputs = lib.optionals stdenv.isDarwin [ CoreFoundation Security ];
 
   meta = with lib; {
     description = "A close to drop in replacement for cut that can use a regex delimiter instead of a fixed string";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 1e86312d4c4b..1e3e2b65bb0b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2244,6 +2244,7 @@ with pkgs;
 
   broot = callPackage ../tools/misc/broot {
     inherit (darwin.apple_sdk.frameworks) Security;
+    inherit (xorg) libxcb;
   };
 
   bruteforce-luks = callPackage ../tools/security/bruteforce-luks { };
@@ -4601,6 +4602,8 @@ with pkgs;
 
   dorkscout = callPackage ../tools/security/dorkscout { };
 
+  downonspot = callPackage ../applications/misc/downonspot { };
+
   sl1-to-photon = python3Packages.callPackage ../applications/misc/sl1-to-photon { };
 
   slade = callPackage ../applications/misc/slade {
@@ -7313,8 +7316,9 @@ with pkgs;
   inherit (callPackages ../development/libraries/libwebsockets { })
     libwebsockets_3_1
     libwebsockets_3_2
-    libwebsockets_4_2;
-  libwebsockets = libwebsockets_4_2;
+    libwebsockets_4_2
+    libwebsockets_4_3;
+  libwebsockets = libwebsockets_4_3;
 
   licensee = callPackage ../tools/package-management/licensee { };
 
@@ -9038,6 +9042,8 @@ with pkgs;
 
   reuse = callPackage ../tools/package-management/reuse { };
 
+  inherit (nodePackages) reveal-md;
+
   rewritefs = callPackage ../os-specific/linux/rewritefs { };
 
   rdiff-backup = callPackage ../tools/backup/rdiff-backup { };
@@ -11872,8 +11878,7 @@ with pkgs;
     inherit (gnome2) libart_lgpl;
   });
 
-  # aarch64-darwin doesn't support earlier gcc
-  gnat = if (stdenv.isDarwin && stdenv.isAarch64) then gnat11 else gnat9;
+  gnat = gnat11;
 
   gnat6 = wrapCC (gcc6.cc.override {
     name = "gnat";
@@ -14595,8 +14600,7 @@ with pkgs;
     java = jdk8; # TODO: upgrade https://github.com/NixOS/nixpkgs/pull/89731
   };
   gradle = res.gradleGen.gradle_latest;
-  gradle_4_10 = res.gradleGen.gradle_4_10;
-  gradle_4 = gradle_4_10;
+  gradle_4 = res.gradleGen.gradle_4_10;
   gradle_5 = res.gradleGen.gradle_5_6;
   gradle_6 = res.gradleGen.gradle_6_9;
   gradle_7 = res.gradleGen.gradle_7_3;
@@ -19321,6 +19325,17 @@ with pkgs;
 
   rocksdb_lite = rocksdb.override { enableLite = true; };
 
+  rocksdb_6_23 = rocksdb.overrideAttrs (old: rec {
+    pname = "rocksdb";
+    version = "6.23.3";
+    src = fetchFromGitHub {
+      owner = "facebook";
+      repo = pname;
+      rev = "v${version}";
+     sha256 = "sha256-SsDqhjdCdtIGNlsMj5kfiuS3zSGwcxi4KV71d95h7yk=";
+   };
+  });
+
   rotate-backups = callPackage ../tools/backup/rotate-backups { };
 
   rote = callPackage ../development/libraries/rote { };
diff --git a/pkgs/top-level/kodi-packages.nix b/pkgs/top-level/kodi-packages.nix
index a7a24a2edb78..175e940eed29 100644
--- a/pkgs/top-level/kodi-packages.nix
+++ b/pkgs/top-level/kodi-packages.nix
@@ -3,7 +3,7 @@
 with lib;
 
 let
-  inherit (libretro) genesis-plus-gx snes9x;
+  inherit (libretro) genesis-plus-gx mgba snes9x;
 in
 
 let self = rec {
@@ -78,6 +78,8 @@ let self = rec {
 
   libretro-genplus = callPackage ../applications/video/kodi-packages/libretro-genplus { inherit genesis-plus-gx; };
 
+  libretro-mgba = callPackage ../applications/video/kodi-packages/libretro-mgba { inherit mgba; };
+
   libretro-snes9x = callPackage ../applications/video/kodi-packages/libretro-snes9x { inherit snes9x; };
 
   jellyfin = callPackage ../applications/video/kodi-packages/jellyfin { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index b540b14a8454..627fdbb039ae 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -8635,6 +8635,8 @@ in {
 
   slowapi = callPackage ../development/python-modules/slowapi { };
 
+  slugid = callPackage ../development/python-modules/slugid { };
+
   sly = callPackage ../development/python-modules/sly { };
 
   smart-meter-texas = callPackage ../development/python-modules/smart-meter-texas { };