diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index e85efc82a4be..f6bc656610f8 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -6658,6 +6658,12 @@
     githubId = 1191859;
     name = "Maxim Krivchikov";
   };
+  MayNiklas = {
+    email = "info@niklas-steffen.de";
+    github = "MayNiklas";
+    githubId = 44636701;
+    name = "Niklas Steffen";
+  };
   mazurel = {
     email = "mateusz.mazur@yahoo.com";
     github = "Mazurel";
diff --git a/nixos/modules/programs/udevil.nix b/nixos/modules/programs/udevil.nix
index ba5670f9dfe9..25975d88ec86 100644
--- a/nixos/modules/programs/udevil.nix
+++ b/nixos/modules/programs/udevil.nix
@@ -10,5 +10,8 @@ in {
 
   config = mkIf cfg.enable {
     security.wrappers.udevil.source = "${lib.getBin pkgs.udevil}/bin/udevil";
+
+    systemd.packages = [ pkgs.udevil ];
+    systemd.services."devmon@".wantedBy = [ "multi-user.target" ];
   };
 }
diff --git a/nixos/modules/programs/zsh/zsh.nix b/nixos/modules/programs/zsh/zsh.nix
index 48638fda28da..6c824a692b75 100644
--- a/nixos/modules/programs/zsh/zsh.nix
+++ b/nixos/modules/programs/zsh/zsh.nix
@@ -53,7 +53,7 @@ in
       };
 
       shellAliases = mkOption {
-        default = {};
+        default = { };
         description = ''
           Set of aliases for zsh shell, which overrides <option>environment.shellAliases</option>.
           See <option>environment.shellAliases</option> for an option format description.
@@ -118,7 +118,9 @@ in
       setOptions = mkOption {
         type = types.listOf types.str;
         default = [
-          "HIST_IGNORE_DUPS" "SHARE_HISTORY" "HIST_FCNTL_LOCK"
+          "HIST_IGNORE_DUPS"
+          "SHARE_HISTORY"
+          "HIST_FCNTL_LOCK"
         ];
         example = [ "EXTENDED_HISTORY" "RM_STAR_WAIT" ];
         description = ''
@@ -278,15 +280,29 @@ in
 
     environment.etc.zinputrc.source = ./zinputrc;
 
-    environment.systemPackages = [ pkgs.zsh ]
-      ++ optional cfg.enableCompletion pkgs.nix-zsh-completions;
+    environment.systemPackages =
+      let
+        completions =
+          if lib.versionAtLeast (lib.getVersion config.nix.package) "2.4pre"
+          then
+            pkgs.nix-zsh-completions.overrideAttrs
+              (_: {
+                postInstall = ''
+                  rm $out/share/zsh/site-functions/_nix
+                '';
+              })
+          else pkgs.nix-zsh-completions;
+      in
+      [ pkgs.zsh ]
+      ++ optional cfg.enableCompletion completions;
 
     environment.pathsToLink = optional cfg.enableCompletion "/share/zsh";
 
     #users.defaultUserShell = mkDefault "/run/current-system/sw/bin/zsh";
 
     environment.shells =
-      [ "/run/current-system/sw/bin/zsh"
+      [
+        "/run/current-system/sw/bin/zsh"
         "${pkgs.zsh}/bin/zsh"
       ];
 
diff --git a/nixos/modules/services/networking/pppd.nix b/nixos/modules/services/networking/pppd.nix
index c1cbdb461765..37f44f07ac46 100644
--- a/nixos/modules/services/networking/pppd.nix
+++ b/nixos/modules/services/networking/pppd.nix
@@ -82,13 +82,21 @@ in
           LD_PRELOAD = "${pkgs.libredirect}/lib/libredirect.so";
           NIX_REDIRECTS = "/var/run=/run/pppd";
         };
-        serviceConfig = {
+        serviceConfig = let
+          capabilities = [
+            "CAP_BPF"
+            "CAP_SYS_TTY_CONFIG"
+            "CAP_NET_ADMIN"
+            "CAP_NET_RAW"
+          ];
+        in
+        {
           ExecStart = "${getBin cfg.package}/sbin/pppd call ${peerCfg.name} nodetach nolog";
           Restart = "always";
           RestartSec = 5;
 
-          AmbientCapabilities = "CAP_SYS_TTY_CONFIG CAP_NET_ADMIN CAP_NET_RAW CAP_SYS_ADMIN";
-          CapabilityBoundingSet = "CAP_SYS_TTY_CONFIG CAP_NET_ADMIN CAP_NET_RAW CAP_SYS_ADMIN";
+          AmbientCapabilities = capabilities;
+          CapabilityBoundingSet = capabilities;
           KeyringMode = "private";
           LockPersonality = true;
           MemoryDenyWriteExecute = true;
@@ -103,7 +111,17 @@ in
           ProtectKernelTunables = false;
           ProtectSystem = "strict";
           RemoveIPC = true;
-          RestrictAddressFamilies = "AF_PACKET AF_UNIX AF_PPPOX AF_ATMPVC AF_ATMSVC AF_INET AF_INET6 AF_IPX";
+          RestrictAddressFamilies = [
+            "AF_ATMPVC"
+            "AF_ATMSVC"
+            "AF_INET"
+            "AF_INET6"
+            "AF_IPX"
+            "AF_NETLINK"
+            "AF_PACKET"
+            "AF_PPPOX"
+            "AF_UNIX"
+          ];
           RestrictNamespaces = true;
           RestrictRealtime = true;
           RestrictSUIDSGID = true;
diff --git a/pkgs/applications/blockchains/ergo/default.nix b/pkgs/applications/blockchains/ergo/default.nix
index 8b8ff3f48ba4..a0e648218f50 100644
--- a/pkgs/applications/blockchains/ergo/default.nix
+++ b/pkgs/applications/blockchains/ergo/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ergo";
-  version = "4.0.12";
+  version = "4.0.13";
 
   src = fetchurl {
     url = "https://github.com/ergoplatform/ergo/releases/download/v${version}/ergo-${version}.jar";
-    sha256 = "sha256-cIMaCouzuI7UQ6UY4caGcTzA+Xp7vLdoOwIfGG+ahsU=";
+    sha256 = "sha256-HNpyUD2Tep2XnY3lr5a3ec+NmJtt0VvJx6ujVvSugXo=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/misc/clight/clightd.nix b/pkgs/applications/misc/clight/clightd.nix
index 192cddc2e172..7b52145f794b 100644
--- a/pkgs/applications/misc/clight/clightd.nix
+++ b/pkgs/applications/misc/clight/clightd.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "clightd";
-  version = "5.3";
+  version = "5.4";
 
   src = fetchFromGitHub {
     owner = "FedeDP";
     repo = "Clightd";
     rev = version;
-    sha256 = "sha256-CuTYCNZ9oiDsm5mUDmjbxkmAl61PEXv3WMrZRzgdZeE=";
+    sha256 = "sha256-ppaxfnZB3+aOzvc/wk1f8D2mFYngQspEOl9XArNMdBE=";
   };
 
   # dbus-1.pc has datadir=/etc
diff --git a/pkgs/applications/misc/girara/default.nix b/pkgs/applications/misc/girara/default.nix
index 6fde2c8fac8b..802c1532979b 100644
--- a/pkgs/applications/misc/girara/default.nix
+++ b/pkgs/applications/misc/girara/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "girara";
-  version = "0.3.5";
+  version = "0.3.6";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://git.pwmt.org/pwmt/${pname}/-/archive/${version}/${pname}-${version}.tar.gz";
-    sha256 = "1n3i960b458172mc3pkq7m9dn5qxry6fms3c3k06v27cjp5whsyf";
+    sha256 = "sha256-GPECj0CVxKh+gTfAkkvs13tdiy93il97iqbSTxLQSiM=";
   };
 
   nativeBuildInputs = [ meson ninja pkg-config gettext check dbus ];
diff --git a/pkgs/applications/misc/grip/default.nix b/pkgs/applications/misc/grip/default.nix
index a30778762b27..c182db8fdd3a 100644
--- a/pkgs/applications/misc/grip/default.nix
+++ b/pkgs/applications/misc/grip/default.nix
@@ -15,11 +15,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "grip-4.2.1";
+  name = "grip-4.2.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/grip/${name}.tar.gz";
-    sha256 = "sha256-3bFJURPbq9rzLsJCppRjSARhcOJxC4eSfw5VxvZgQ3Q=";
+    sha256 = "sha256-nXtGgJeNYM8lyllNi9UdmsnVcHOCXfryWmKGZ9QFTHE=";
   };
 
   nativeBuildInputs = [ pkg-config libtool ];
diff --git a/pkgs/applications/misc/udevil/default.nix b/pkgs/applications/misc/udevil/default.nix
index e83a5e9a2c7e..9d1df5245edc 100644
--- a/pkgs/applications/misc/udevil/default.nix
+++ b/pkgs/applications/misc/udevil/default.nix
@@ -1,12 +1,20 @@
-{ lib, stdenv, fetchurl, intltool, glib, pkg-config, udev, util-linux, acl }:
-stdenv.mkDerivation {
-  name = "udevil-0.4.4";
-  src = fetchurl {
-    url = "https://github.com/IgnorantGuru/udevil/archive/0.4.4.tar.gz";
-    sha256 = "0z1bhaayambrcn7bgnrqk445k50ifabmw8q4i9qj49nnbcvxhbxd";
+{ lib, stdenv, fetchFromGitHub, intltool, glib, pkg-config, udev, util-linux, acl }:
+
+stdenv.mkDerivation rec {
+  pname = "udevil";
+  version = "0.4.4";
+
+  src = fetchFromGitHub {
+    owner = "IgnorantGuru";
+    repo = "udevil";
+    rev = version;
+    sha256 = "0nd44r8rbxifx4x4m24z5aji1c6k1fhw8cmf5s43wd5qys0bcdad";
   };
+
   nativeBuildInputs = [ pkg-config ];
+
   buildInputs = [ intltool glib udev ];
+
   configurePhase = ''
     substituteInPlace src/Makefile.in --replace "-o root -g root" ""
     # do not set setuid bit in nix store
@@ -19,11 +27,18 @@ stdenv.mkDerivation {
       --with-setfacl-prog=${acl.bin}/bin/setfacl \
       --sysconfdir=$prefix/etc
   '';
+
+  postInstall = ''
+    substituteInPlace $out/lib/systemd/system/devmon@.service \
+      --replace /usr/bin/devmon "$out/bin/devmon"
+  '';
+
   patches = [ ./device-info-sys-stat.patch ];
-  meta = {
+
+  meta = with lib; {
     description = "A command line Linux program which mounts and unmounts removable devices without a password, shows device info, and monitors device changes";
     homepage = "https://ignorantguru.github.io/udevil/";
-    platforms = lib.platforms.linux;
-    license = lib.licenses.gpl3;
+    platforms = platforms.linux;
+    license = licenses.gpl3Plus;
   };
 }
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index 18565f31a2fb..6daafc204eb8 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -167,6 +167,19 @@ let
       # Fix the build by adding a missing dependency (s. https://crbug.com/1197837):
       ./patches/fix-missing-atspi2-dependency.patch
       ./patches/closure_compiler-Use-the-Java-binary-from-the-system.patch
+    ] ++ lib.optionals (versionRange "91" "94.0.4583.0") [
+      # Required as dependency for the next patch:
+      (githubPatch {
+        # Reland "Reland "Linux sandbox syscall broker: use struct kernel_stat""
+        commit = "4b438323d68840453b5ef826c3997568e2e0e8c7";
+        sha256 = "1lf6yilx2ffd3r0840ilihp4px35w7jvr19ll56bncqmz4r5fd82";
+      })
+      # To fix the text rendering, see #131074:
+      (githubPatch {
+        # Linux sandbox: fix fstatat() crash
+        commit = "60d5e803ef2a4874d29799b638754152285e0ed9";
+        sha256 = "0apmsqqlfxprmdmi3qzp3kr9jc52mcc4xzps206kwr8kzwv48b70";
+      })
     ] ++ lib.optionals (chromiumVersionAtLeast "93") [
       # We need to revert this patch to build M93 with LLVM 12.
       (githubPatch {
diff --git a/pkgs/applications/networking/cluster/helmsman/default.nix b/pkgs/applications/networking/cluster/helmsman/default.nix
index ed4a201db3a0..933f1bfe71b4 100644
--- a/pkgs/applications/networking/cluster/helmsman/default.nix
+++ b/pkgs/applications/networking/cluster/helmsman/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "helmsman";
-  version = "3.7.0";
+  version = "3.7.2";
 
   src = fetchFromGitHub {
     owner = "Praqma";
     repo = "helmsman";
     rev = "v${version}";
-    sha256 = "sha256-Xp86tCIM7XVtue/MjQ8/wGs2fHfxSWS3B6MzNMYRqg4=";
+    sha256 = "sha256-wzmn06nUycNaQ4tUEBd4q17M1CVC0+5X13rqF7zaHqU=";
   };
 
-  vendorSha256 = "sha256-icX8mOc8g+DhfAjD1pzneLWTXY17lXyAjdPOWAxkHwI=";
+  vendorSha256 = "sha256-XHgdVFGIzbPPYgv/T4TtvDDbKAe3niev4S5tu/nwSqg=";
 
   doCheck = false;
 
diff --git a/pkgs/applications/networking/cluster/linkerd/default.nix b/pkgs/applications/networking/cluster/linkerd/default.nix
index 9bd9a8e7a187..883d16319b17 100644
--- a/pkgs/applications/networking/cluster/linkerd/default.nix
+++ b/pkgs/applications/networking/cluster/linkerd/default.nix
@@ -64,8 +64,8 @@ in
     };
     edge = generic {
       channel = "edge";
-      version = "21.7.2";
-      sha256 = "sha256-rEO84t6znNb59a9i+SHgT4r0xzja6eMYi9lWmdU24Cc=";
-      vendorSha256 = "sha256-esVy+oIZa/ucvucdNV7MfUGFkIql9T2zl0+eu3hZAt8=";
+      version = "21.7.3";
+      sha256 = "sha256-fEkqZ/4BQVnmOKUrrLmi6DKlMVNeqvW95bxbZX0o7iI=";
+      vendorSha256 = "sha256-NqOmmeEGWvy/LYfSpIdnJZX4lGweCgiL008ed05XIFs=";
     };
   }
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index f7eb378e716e..cc46bf16ac7d 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -728,9 +728,10 @@
     "owner": "terraform-providers",
     "provider-source-address": "registry.terraform.io/hashicorp/oci",
     "repo": "terraform-provider-oci",
-    "rev": "v3.79.0",
-    "sha256": "11n2v537zniiv5xvhpypqrm09my8zybirvq4ly94hp69v73xj89c",
-    "version": "3.79.0"
+    "rev": "v4.35.0",
+    "sha256": "12acy39cr6pxq8gk483b6i78x463ml9pk10qp9jpz0dr05zcyhqw",
+    "vendorSha256": null,
+    "version": "4.35.0"
   },
   "okta": {
     "owner": "terraform-providers",
diff --git a/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix b/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix
index 868686bd5c01..23718bf636c6 100644
--- a/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix
+++ b/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix
@@ -62,6 +62,7 @@ let
       # Fonts
       "fonts"
       # ALSA
+      "alsa"
       "asound.conf"
       # SSL
       "ssl/certs"
diff --git a/pkgs/build-support/nix-gitignore/default.nix b/pkgs/build-support/nix-gitignore/default.nix
index 5d7b945bf1b1..497dcb0660b0 100644
--- a/pkgs/build-support/nix-gitignore/default.nix
+++ b/pkgs/build-support/nix-gitignore/default.nix
@@ -41,6 +41,9 @@ in rec {
         let split = match "^(!?)(.*)" l;
         in [(elemAt split 1) (head split == "!")];
 
+      # regex -> regex
+      handleHashesBangs = replaceStrings ["\\#" "\\!"] ["#" "!"];
+
       # ignore -> regex
       substWildcards =
         let
@@ -86,7 +89,7 @@ in rec {
       mapPat = f: l: [(f (head l)) (last l)];
     in
       map (l: # `l' for "line"
-        mapPat (l: handleSlashSuffix (handleSlashPrefix (mapAroundCharclass substWildcards l)))
+        mapPat (l: handleSlashSuffix (handleSlashPrefix (handleHashesBangs (mapAroundCharclass substWildcards l))))
         (computeNegation l))
       (filter (l: !isList l && !isComment l)
       (split "\n" gitignore));
diff --git a/pkgs/desktops/mate/caja-with-extensions/default.nix b/pkgs/desktops/mate/caja-with-extensions/default.nix
index 125e39d1f461..dd9ab9be1d37 100644
--- a/pkgs/desktops/mate/caja-with-extensions/default.nix
+++ b/pkgs/desktops/mate/caja-with-extensions/default.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation {
   pname = "${caja.pname}-with-extensions";
   version = caja.version;
 
-  phases = [ "installPhase" ];
+  dontUnpack = true;
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/development/guile-modules/guile-git/default.nix b/pkgs/development/guile-modules/guile-git/default.nix
index 254afae0cc4f..0b3dfefcbe8c 100644
--- a/pkgs/development/guile-modules/guile-git/default.nix
+++ b/pkgs/development/guile-modules/guile-git/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "guile-git";
-  version = "0.5.1";
+  version = "0.5.2";
 
   src = fetchFromGitLab {
     owner = "guile-git";
     repo = pname;
     rev = "v${version}";
-    sha256 = "7Cnuyk9xAPTvz9R44O3lvKDrT6tUQui7YzxIoqhRfPQ=";
+    sha256 = "x6apF9fmwzrkyzAexKjClOTFrbE31+fVhSLyFZkKRYU=";
   };
 
   postConfigure = ''
diff --git a/pkgs/development/interpreters/cyclone/default.nix b/pkgs/development/interpreters/cyclone/default.nix
index c0a11cf9f026..0d2984904d85 100644
--- a/pkgs/development/interpreters/cyclone/default.nix
+++ b/pkgs/development/interpreters/cyclone/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, libck, darwin }:
 
 let
-  version = "0.21";
+  version = "0.30.0";
   bootstrap = stdenv.mkDerivation {
     pname = "cyclone-bootstrap";
     inherit version;
@@ -10,7 +10,7 @@ let
       owner = "justinethier";
       repo = "cyclone-bootstrap";
       rev = "v${version}";
-      sha256 = "0bb3a7x7vzmdyhm4nilm8bcn4q50pwqryggnxz21n16v6xakwjmr";
+      sha256 = "sha256-/zAcCBdJ7YQXsspdjrMca1Oj9SUUFXQKLwZPoZLhHYg=";
     };
 
     enableParallelBuilding = true;
@@ -30,7 +30,7 @@ stdenv.mkDerivation {
     owner = "justinethier";
     repo = "cyclone";
     rev = "v${version}";
-    sha256 = "1vb4yaprs2bwbxmxx2zkqvysxx8r9qww2q1nqkz8yps3ji715jw7";
+    sha256 = "sha256-a3wiqKlIbnvIhyrI0lyVGciQiM7KSuYH5iUfGFrgOuM=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/cmark/default.nix b/pkgs/development/libraries/cmark/default.nix
index ec90d0086c9d..1cc19277522d 100644
--- a/pkgs/development/libraries/cmark/default.nix
+++ b/pkgs/development/libraries/cmark/default.nix
@@ -2,19 +2,19 @@
 
 stdenv.mkDerivation rec {
   pname = "cmark";
-  version = "0.30.0";
+  version = "0.30.1";
 
   src = fetchFromGitHub {
     owner = "jgm";
     repo = pname;
     rev = version;
-    sha256 = "sha256-SU31kJL+8wt57bGW5fNeXjXPgPeCXZIknZwDxMXCfdc=";
+    sha256 = "sha256-UjDM2N6gCwO94F1nW3qCP9JX42MYAicAuGTKAXMy1Gg=";
   };
 
   nativeBuildInputs = [ cmake ];
 
   cmakeFlags = [
-    # https://github.com/commonmark/cmark/releases/tag/0.30.0
+    # https://github.com/commonmark/cmark/releases/tag/0.30.1
     # recommends distributions dynamically link
     "-DCMARK_STATIC=OFF"
   ];
diff --git a/pkgs/development/libraries/grpc/default.nix b/pkgs/development/libraries/grpc/default.nix
index 00d3c4a5637e..2bf843241a6a 100644
--- a/pkgs/development/libraries/grpc/default.nix
+++ b/pkgs/development/libraries/grpc/default.nix
@@ -3,13 +3,13 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.38.1"; # N.B: if you change this, change pythonPackages.grpcio-tools to a matching version too
+  version = "1.39.0"; # N.B: if you change this, change pythonPackages.grpcio-tools to a matching version too
   pname = "grpc";
   src = fetchFromGitHub {
     owner = "grpc";
     repo = "grpc";
     rev = "v${version}";
-    sha256 = "0hjp946x5695srmc6bg2m7iih81jdmhpxn4bjcl80f09v4qsb0nl";
+    sha256 = "1wa7n7mf20fnvxqw093kr7a4c7vilcmx9yl3hicnyfcd663jgqvd";
     fetchSubmodules = true;
   };
   patches = [
diff --git a/pkgs/development/libraries/libsidplayfp/default.nix b/pkgs/development/libraries/libsidplayfp/default.nix
index fe02a96a565c..99c8b7352943 100644
--- a/pkgs/development/libraries/libsidplayfp/default.nix
+++ b/pkgs/development/libraries/libsidplayfp/default.nix
@@ -16,14 +16,14 @@
 
 stdenv.mkDerivation rec {
   pname = "libsidplayfp";
-  version = "2.2.0";
+  version = "2.2.1";
 
   src = fetchFromGitHub {
     owner = "libsidplayfp";
     repo = "libsidplayfp";
     rev = "v${version}";
     fetchSubmodules = true;
-    sha256 = "sha256-lDM4nJozZF8Rt+XWnM41hBAYatZVsmvvQajgHLI9uy0=";
+    sha256 = "sha256-Ut6tXaM97R8Y5D2dV/xPvxVzS6Ep6fOKAujtRNKoQCc=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/libxlsxwriter/default.nix b/pkgs/development/libraries/libxlsxwriter/default.nix
index ce9a72f00c1c..dfeaeed8ca80 100644
--- a/pkgs/development/libraries/libxlsxwriter/default.nix
+++ b/pkgs/development/libraries/libxlsxwriter/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libxlsxwriter";
-  version = "1.0.8";
+  version = "1.0.9";
 
   src = fetchFromGitHub {
     owner = "jmcnamara";
     repo = "libxlsxwriter";
     rev = "RELEASE_${version}";
-    sha256 = "1z9bkg0pfkzxbpj2rys4mx9wmcxyjjqsg0nbiaabsg455q00plki";
+    sha256 = "sha256-6MMQr0ynMmfZj+RFoKtLB/f1nTBfn9tcYpzyUwnfB3M=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/microsoft_gsl/default.nix b/pkgs/development/libraries/microsoft_gsl/default.nix
index 5a5257168eb4..11931199999b 100644
--- a/pkgs/development/libraries/microsoft_gsl/default.nix
+++ b/pkgs/development/libraries/microsoft_gsl/default.nix
@@ -1,44 +1,46 @@
-{ lib, stdenv, fetchFromGitHub, catch, cmake
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, gtest
+, fetchurl
+, pkg-config
 }:
 
-let
-  nativeBuild = stdenv.hostPlatform == stdenv.buildPlatform;
-in
 stdenv.mkDerivation rec {
   pname = "microsoft_gsl";
-  version = "2.1.0";
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     owner = "Microsoft";
     repo = "GSL";
     rev = "v${version}";
-    sha256 = "09f08lxqm00152bx9yrizlgabzpzxlpbv06h00z4w78yxywgxlgx";
+    sha256 = "sha256-gIpyuNlp3mvR8r1Azs2r76ElEodykRLGAwMN4BDJez0=";
   };
 
-  # build phase just runs the unit tests, so skip it if
-  # we're doing a cross build
-  nativeBuildInputs = [ catch cmake ];
-  buildPhase = if nativeBuild then "make" else "true";
+  patches = [
+    # Search for GoogleTest via pkg-config first, ref: https://github.com/NixOS/nixpkgs/pull/130525
+    (fetchurl {
+      url = "https://github.com/microsoft/GSL/commit/f5cf01083baf7e8dc8318db3648bc6098dc32d67.patch";
+      sha256 = "sha256-uouv35crtly8kYhKyvMyZkqwTKt1jXC6dZjw4sQ6uv0=";
+    })
+  ];
 
-  # https://github.com/microsoft/GSL/issues/806
-  cmakeFlags = lib.optionals stdenv.cc.isGNU
-    [ "-DCMAKE_CXX_FLAGS=-Wno-catch-value" ];
+  nativeBuildInputs = [ cmake pkg-config ];
+  buildInputs = [ gtest ];
 
-  installPhase = ''
-    mkdir -p $out/include
-    mv ../include/ $out/
-  '';
+  doCheck = true;
 
   meta = with lib; {
     description = "C++ Core Guideline support library";
     longDescription = ''
-     The Guideline Support Library (GSL) contains functions and types that are suggested for
-     use by the C++ Core Guidelines maintained by the Standard C++ Foundation.
-     This package contains Microsoft's implementation of GSL.
+      The Guideline Support Library (GSL) contains functions and types that are suggested for
+      use by the C++ Core Guidelines maintained by the Standard C++ Foundation.
+      This package contains Microsoft's implementation of GSL.
     '';
-    homepage    = "https://github.com/Microsoft/GSL";
-    license     = licenses.mit;
-    platforms   = platforms.all;
+    homepage = "https://github.com/Microsoft/GSL";
+    license = licenses.mit;
+    platforms = platforms.all;
     maintainers = with maintainers; [ thoughtpolice xwvvvvwx yuriaisaka ];
   };
 }
diff --git a/pkgs/development/libraries/vapoursynth/default.nix b/pkgs/development/libraries/vapoursynth/default.nix
index 3b6362f7396c..37d82b0b4bd9 100644
--- a/pkgs/development/libraries/vapoursynth/default.nix
+++ b/pkgs/development/libraries/vapoursynth/default.nix
@@ -10,13 +10,13 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "vapoursynth";
-  version = "R53";
+  version = "R54";
 
   src = fetchFromGitHub {
     owner  = "vapoursynth";
     repo   = "vapoursynth";
     rev    = version;
-    sha256 = "0qcsfkpkry0cmvi60khjwvfz4fqhy23nqmn4pb9qrwll26sn9dcr";
+    sha256 = "01jym2rq28j0g792yagk9dvm411gwmk6qgj9rgrg7ckpxmw27w2s";
   };
 
   patches = [
diff --git a/pkgs/development/ocaml-modules/mdx/default.nix b/pkgs/development/ocaml-modules/mdx/default.nix
index 7051c51cc5cc..c8035eea42d3 100644
--- a/pkgs/development/ocaml-modules/mdx/default.nix
+++ b/pkgs/development/ocaml-modules/mdx/default.nix
@@ -1,16 +1,16 @@
-{ lib, fetchurl, buildDunePackage, opaline, ocaml
+{ lib, fetchurl, buildDunePackage, ocaml
 , alcotest
 , astring, cmdliner, cppo, fmt, logs, ocaml-version, odoc, ocaml_lwt, re, result, csexp
 , pandoc}:
 
 buildDunePackage rec {
   pname = "mdx";
-  version = "1.8.1";
+  version = "1.10.1";
   useDune2 = true;
 
   src = fetchurl {
     url = "https://github.com/realworldocaml/mdx/releases/download/${version}/mdx-${version}.tbz";
-    sha256 = "1szik1lyg2vs8jrisnvjdc29n0ifls8mghimff4jcz6f48haa3cv";
+    sha256 = "10d4sfv4qk9569kj46pcaw6cih40v6bkgd44lmsp7cyfhvl8pa9x";
   };
 
   nativeBuildInputs = [ cppo ];
@@ -23,7 +23,9 @@ buildDunePackage rec {
   outputs = [ "bin" "lib" "out" ];
 
   installPhase = ''
-    ${opaline}/bin/opaline -prefix $bin -libdir $lib/lib/ocaml/${ocaml.version}/site-lib
+    runHook preInstall
+    dune install --prefix=$bin --libdir=$lib/lib/ocaml/${ocaml.version}/site-lib ${pname}
+    runHook postInstall
   '';
 
   meta = {
diff --git a/pkgs/development/ocaml-modules/ocaml-lsp/lsp.nix b/pkgs/development/ocaml-modules/ocaml-lsp/lsp.nix
index b501282c1558..6e172dee6ee6 100644
--- a/pkgs/development/ocaml-modules/ocaml-lsp/lsp.nix
+++ b/pkgs/development/ocaml-modules/ocaml-lsp/lsp.nix
@@ -1,4 +1,5 @@
 { buildDunePackage
+, cppo
 , stdlib-shims
 , ppx_yojson_conv_lib
 , ocaml-syntax-shims
@@ -26,16 +27,20 @@ buildDunePackage {
   '';
 
   buildInputs = [
-    stdlib-shims
+    cppo
     ppx_yojson_conv_lib
     ocaml-syntax-shims
     octavius
-    uutf
-    csexp
     dune-build-info
     omd
     cmdliner
+  ];
+
+  propagatedBuildInputs = [
+    csexp
     jsonrpc
+    stdlib-shims
+    uutf
   ];
 
   meta = jsonrpc.meta // {
diff --git a/pkgs/development/ocaml-modules/yojson/default.nix b/pkgs/development/ocaml-modules/yojson/default.nix
index 07025be296ce..2be9ce1b0210 100644
--- a/pkgs/development/ocaml-modules/yojson/default.nix
+++ b/pkgs/development/ocaml-modules/yojson/default.nix
@@ -1,48 +1,22 @@
-{ lib, stdenv, fetchzip, ocaml, findlib, dune_2, cppo, easy-format, biniou }:
-let
+{ lib, fetchurl, buildDunePackage, cppo, easy-format, biniou }:
+
+buildDunePackage rec {
   pname = "yojson";
-  param =
-  if lib.versionAtLeast ocaml.version "4.02" then rec {
-    version = "1.7.0";
+  version = "1.7.0";
+  useDune2 = true;
+
+  src = fetchurl {
     url = "https://github.com/ocaml-community/yojson/releases/download/${version}/yojson-${version}.tbz";
-    sha256 = "08llz96if8bcgnaishf18si76cv11zbkni0aldb54k3cn7ipiqvd";
-    nativeBuildInputs = [ dune_2 ];
-    extra = {
-      installPhase = ''
-        dune install --prefix $out --libdir $OCAMLFIND_DESTDIR ${pname}
-      '';
-    };
-  } else rec {
-    version = "1.2.3";
-    url = "https://github.com/ocaml-community/yojson/archive/v${version}.tar.gz";
-    sha256 = "10dvkndgwanvw4agbjln7kgb1n9s6lii7jw82kwxczl5rd1sgmvl";
-    extra = {
-      createFindlibDestdir = true;
-
-      makeFlags = [ "PREFIX=$(out)" ];
-
-      preBuild = "mkdir $out/bin";
-    };
-  };
-in
-stdenv.mkDerivation ({
-
-  name = "ocaml${ocaml.version}-${pname}-${param.version}";
-
-  src = fetchzip {
-    inherit (param) url sha256;
+    sha256 = "1iich6323npvvs8r50lkr4pxxqm9mf6w67cnid7jg1j1g5gwcvv5";
   };
 
-  nativeBuildInputs = [ ocaml findlib ] ++ (param.nativeBuildInputs or []);
-  propagatedNativeBuildInputs = [ cppo ];
+  nativeBuildInputs = [ cppo ];
   propagatedBuildInputs = [ easy-format biniou ];
-  configurePlatforms = [];
 
   meta = with lib; {
     description = "An optimized parsing and printing library for the JSON format";
     homepage = "https://github.com/ocaml-community/${pname}";
     license = licenses.bsd3;
     maintainers = [ maintainers.vbgl ];
-    platforms = ocaml.meta.platforms or [];
   };
-} // param.extra)
+}
diff --git a/pkgs/development/python-modules/datasette/default.nix b/pkgs/development/python-modules/datasette/default.nix
index 58920b406466..5a611c989f4d 100644
--- a/pkgs/development/python-modules/datasette/default.nix
+++ b/pkgs/development/python-modules/datasette/default.nix
@@ -31,14 +31,14 @@
 
 buildPythonPackage rec {
   pname = "datasette";
-  version = "0.57.1";
+  version = "0.58.1";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "simonw";
     repo = pname;
     rev = version;
-    sha256 = "sha256-BHsf3GOganPhsDiZlRxvAsRZH/Sq+Jr+CZcc2ubce+8=";
+    sha256 = "sha256-dtKqp7LV1fRjwOMAlmmAnC19j8hLA1oixGextATW6z0=";
   };
 
   nativeBuildInputs = [ pytest-runner ];
diff --git a/pkgs/development/python-modules/env-canada/default.nix b/pkgs/development/python-modules/env-canada/default.nix
index 3beb01e3b13e..22894ab9f2a6 100644
--- a/pkgs/development/python-modules/env-canada/default.nix
+++ b/pkgs/development/python-modules/env-canada/default.nix
@@ -11,13 +11,13 @@
 
 buildPythonPackage rec {
   pname = "env-canada";
-  version = "0.4.0";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "michaeldavie";
     repo = "env_canada";
     rev = "v${version}";
-    sha256 = "0y4yjzmg6ns7a13j1cxqvrff4fd6k97cpc1xjwqrwp7gq49rzhy7";
+    sha256 = "0v1wmjvi05i6mjh6yxqigbf2spf7842198yp98f7h0nyfjmz96hn";
   };
 
   propagatedBuildInputs = [
@@ -42,6 +42,7 @@ buildPythonPackage rec {
     "test_get_latest_frame"
     "test_get_loop"
     "test_get_ec_sites"
+    "test_ecradar"
   ];
 
   pythonImportsCheck = [ "env_canada" ];
diff --git a/pkgs/development/python-modules/grpcio-tools/default.nix b/pkgs/development/python-modules/grpcio-tools/default.nix
index 7236f7c22e3d..0e095126676d 100644
--- a/pkgs/development/python-modules/grpcio-tools/default.nix
+++ b/pkgs/development/python-modules/grpcio-tools/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "grpcio-tools";
-  version = "1.38.1";
+  version = "1.39.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "cd85f58038b92e1961f8127d79691e84e151390d35cae73c4c0cbe2042f76b77";
+    sha256 = "39dfe7415bc0d3860fdb8dd90607594b046b88b57dbe64284efa4820f951c805";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/python-modules/pyls-flake8/default.nix b/pkgs/development/python-modules/pyls-flake8/default.nix
new file mode 100644
index 000000000000..495c54d58593
--- /dev/null
+++ b/pkgs/development/python-modules/pyls-flake8/default.nix
@@ -0,0 +1,29 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, flake8
+, python-lsp-server
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "pyls-flake8";
+  version = "0.4.0";
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "emanspeaks";
+    repo = "pyls-flake8";
+    rev = "3df8606ad821100e64743f457c77c20170bde722";
+    sha256 = "14wkmwh8mqr826vdzxhvhdwrnx2akzmnbv3ar391qs4imwqfjx3l";
+  };
+
+  propagatedBuildInputs = [ flake8 python-lsp-server ];
+
+  meta = with lib; {
+    homepage = "https://github.com/emanspeaks/pyls-flake8";
+    description = "A Flake8 plugin for the Python LSP Server.";
+    license = licenses.mit;
+    maintainers = with maintainers; [ cpcloud ];
+  };
+}
diff --git a/pkgs/development/python-modules/pyls-isort/default.nix b/pkgs/development/python-modules/pyls-isort/default.nix
index 35b43969e529..a11acce3c8ba 100644
--- a/pkgs/development/python-modules/pyls-isort/default.nix
+++ b/pkgs/development/python-modules/pyls-isort/default.nix
@@ -1,29 +1,29 @@
 { lib, buildPythonPackage, fetchFromGitHub
-, python-language-server, isort
+, python-lsp-server, isort
 }:
 
 buildPythonPackage rec {
   pname = "pyls-isort";
-  version = "0.1.1";
+  version = "0.2.2";
 
   src = fetchFromGitHub {
     owner = "paradoxxxzero";
     repo = "pyls-isort";
-    rev = version;
-    sha256 = "0mf8c6dw5lsj9np20p0vrhr1yfycq2awjk2pil28l579xj9nr0dc";
+    rev = "v${version}";
+    sha256 = "0xba0aiyjfdi9swjzxk26l94dwlwvn17kkfjfscxl8gvspzsn057";
   };
 
   # no tests
   doCheck = false;
 
   propagatedBuildInputs = [
-    isort python-language-server
+    isort python-lsp-server
   ];
 
   meta = with lib; {
     homepage = "https://github.com/paradoxxxzero/pyls-isort";
-    description = "Isort plugin for python-language-server";
+    description = "Isort plugin for python-lsp-server";
     license = licenses.mit;
-    maintainers = [ ];
+    maintainers = with maintainers; [ cpcloud ];
   };
 }
diff --git a/pkgs/development/python-modules/pymunk/default.nix b/pkgs/development/python-modules/pymunk/default.nix
new file mode 100644
index 000000000000..92918efa8ed8
--- /dev/null
+++ b/pkgs/development/python-modules/pymunk/default.nix
@@ -0,0 +1,36 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, python
+, cffi
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "pymunk";
+  version = "6.0.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    extension = "zip";
+    sha256 = "04jqqd2y0wzzkqppbl08vyzgbcpl5qj946w8da2ilypqdx7j2akp";
+  };
+
+  propagatedBuildInputs = [ cffi ];
+
+  preBuild = ''
+    ${python.interpreter} setup.py build_ext --inplace
+  '';
+
+  checkInputs = [ pytestCheckHook ];
+  pytestFlagsArray = [
+    "pymunk/tests"
+  ];
+
+  meta = with lib; {
+    description = "2d physics library";
+    homepage = "https://www.pymunk.org";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ angustrau ];
+  };
+}
diff --git a/pkgs/development/python-modules/python-lsp-black/default.nix b/pkgs/development/python-modules/python-lsp-black/default.nix
new file mode 100644
index 000000000000..3c18d291e37f
--- /dev/null
+++ b/pkgs/development/python-modules/python-lsp-black/default.nix
@@ -0,0 +1,32 @@
+{ lib
+, black
+, buildPythonPackage
+, fetchFromGitHub
+, pytestCheckHook
+, python-lsp-server
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "python-lsp-black";
+  version = "1.0.0";
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "python-lsp";
+    repo = "python-lsp-black";
+    rev = "v${version}";
+    sha256 = "1blxhj70jxb9xfbd4dxqikd262n6dn9dw5qhyml5yvdwxbv0bybc";
+  };
+
+  checkInputs = [ pytestCheckHook ];
+
+  propagatedBuildInputs = [ black python-lsp-server ];
+
+  meta = with lib; {
+    homepage = "https://github.com/python-lsp/python-lsp-black";
+    description = "Black plugin for the Python LSP Server";
+    license = licenses.mit;
+    maintainers = with maintainers; [ cpcloud ];
+  };
+}
diff --git a/pkgs/development/python-modules/questionary/default.nix b/pkgs/development/python-modules/questionary/default.nix
index ecb33f6adb15..d7f93b3a47e5 100644
--- a/pkgs/development/python-modules/questionary/default.nix
+++ b/pkgs/development/python-modules/questionary/default.nix
@@ -9,19 +9,23 @@
 
 buildPythonPackage rec {
   pname = "questionary";
-  version = "1.9.0";
+  version = "1.10.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "tmbo";
     repo = pname;
     rev = version;
-    sha256 = "1x748bz7l2r48031dj6vr6jvvac28pv6vx1bina4lz60h1qac1kf";
+    sha256 = "14k24fq2nmk90iv0k7pnmmdhmk8z261397wg52sfcsccyhpdw3i7";
   };
 
-  nativeBuildInputs = [ poetry ];
+  nativeBuildInputs = [
+    poetry
+  ];
 
-  propagatedBuildInputs = [ prompt_toolkit ];
+  propagatedBuildInputs = [
+    prompt_toolkit
+  ];
 
   checkInputs = [
     pytest-cov
@@ -32,7 +36,7 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Python library to build command line user prompts";
-    homepage = "https://github.com/bachya/regenmaschine";
+    homepage = "https://github.com/tmbo/questionary";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/requests-cache/default.nix b/pkgs/development/python-modules/requests-cache/default.nix
index 64dafa7bca29..ce1dfc366f45 100644
--- a/pkgs/development/python-modules/requests-cache/default.nix
+++ b/pkgs/development/python-modules/requests-cache/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "requests-cache";
-  version = "0.7.1";
+  version = "0.7.2";
   disabled = pythonOlder "3.6";
   format = "pyproject";
 
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "reclosedev";
     repo = "requests-cache";
     rev = "v${version}";
-    sha256 = "sha256-Ai/8l2p3S/NE+uyz3eQ+rJSD/xYCsXf89aYijINQ18I=";
+    sha256 = "055dfyjm8dqwr62v86lyvq4r04692gmvlgp86218vwvzgm7p3p2c";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/skytemple-rust/default.nix b/pkgs/development/python-modules/skytemple-rust/default.nix
index d22d61099587..d98d23fada6d 100644
--- a/pkgs/development/python-modules/skytemple-rust/default.nix
+++ b/pkgs/development/python-modules/skytemple-rust/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchFromGitHub, rustPlatform, setuptools-rust }:
+{ lib, stdenv, buildPythonPackage, fetchFromGitHub, libiconv, rustPlatform, setuptools-rust }:
 
 buildPythonPackage rec {
   pname = "skytemple-rust";
@@ -17,6 +17,7 @@ buildPythonPackage rec {
     sha256 = "1ypcsf9gbq1bz29kfn7g4kg8741mxg1lfcbb14a0vfhjq4d6pnx9";
   };
 
+  buildInputs = lib.optionals stdenv.isDarwin [ libiconv ];
   nativeBuildInputs = [ setuptools-rust ] ++ (with rustPlatform; [ cargoSetupHook rust.cargo rust.rustc ]);
 
   doCheck = false; # there are no tests
diff --git a/pkgs/development/python-modules/sphinx-copybutton/default.nix b/pkgs/development/python-modules/sphinx-copybutton/default.nix
new file mode 100644
index 000000000000..8d408d300c71
--- /dev/null
+++ b/pkgs/development/python-modules/sphinx-copybutton/default.nix
@@ -0,0 +1,33 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, sphinx
+}:
+
+buildPythonPackage rec {
+  pname = "sphinx-copybutton";
+  version = "0.4.0";
+
+  src = fetchFromGitHub {
+    owner = "executablebooks";
+    repo = "sphinx-copybutton";
+    rev = "v${version}";
+    sha256 = "sha256-vrEIvQeP7AMXSme1PBp0ox5k8Q1rz+1cbHIO+o17Jqc=";
+    fetchSubmodules = true;
+  };
+
+  propagatedBuildInputs = [
+    sphinx
+  ];
+
+  doCheck = false; # no tests
+
+  pythonImportsCheck = [ "sphinx_copybutton" ];
+
+  meta = with lib; {
+    description = "A small sphinx extension to add a \"copy\" button to code blocks";
+    homepage = "https://github.com/executablebooks/sphinx-copybutton";
+    license = licenses.mit;
+    maintainers = with maintainers; [ Luflosi ];
+  };
+}
diff --git a/pkgs/development/python-modules/tesserocr/default.nix b/pkgs/development/python-modules/tesserocr/default.nix
index df1b02283043..0b21e17f96b0 100644
--- a/pkgs/development/python-modules/tesserocr/default.nix
+++ b/pkgs/development/python-modules/tesserocr/default.nix
@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname = "tesserocr";
-  version = "2.5.1";
+  version = "2.5.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0cc7d4r11z26rhcwpmcc42fi9kr3f20nq5pk84jrczr18i0g99mh";
+    sha256 = "1bmj76gi8401lcqdaaznfmz9yf11myy1bzivqwwq08z3dwzxswck";
   };
 
   nativeBuildInputs = [ cython pkg-config ];
diff --git a/pkgs/development/python-modules/twitterapi/default.nix b/pkgs/development/python-modules/twitterapi/default.nix
index 166e42ced821..cf3ec977d0ea 100644
--- a/pkgs/development/python-modules/twitterapi/default.nix
+++ b/pkgs/development/python-modules/twitterapi/default.nix
@@ -7,13 +7,13 @@
 
 buildPythonPackage rec {
   pname = "twitterapi";
-  version = "2.7.4";
+  version = "2.7.5";
 
   src = fetchFromGitHub {
     owner = "geduldig";
     repo = "TwitterAPI";
     rev = "v${version}";
-    sha256 = "sha256-HDPRpM1LDTtUbldzfCrsdh/GpbzNCVVUVGwohyMe/YE=";
+    sha256 = "1s5q3gzd69syk8khlyy7ap8gpymvhgqrlv3vp6vdmwnaafjvvyy3";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/async-profiler/default.nix b/pkgs/development/tools/async-profiler/default.nix
index 66177d3a34f3..3f31b921831a 100644
--- a/pkgs/development/tools/async-profiler/default.nix
+++ b/pkgs/development/tools/async-profiler/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "async-profiler";
-  version = "1.8.5";
+  version = "1.8.6";
 
   src = fetchFromGitHub {
     owner = "jvm-profiling-tools";
     repo = "async-profiler";
     rev = "v${version}";
-    sha256 = "sha256-vSBueRNraMgLcaprPsBUriX3WZ7N0UrllnSVLL2F738=";
+    sha256 = "sha256-MtRO0tbo4kDHcQmir8ulv0q1Qh+KnKIshb1NDtu1SKg=";
   };
 
   buildInputs = [ jdk8 ];
diff --git a/pkgs/development/tools/continuous-integration/buildkite-agent/default.nix b/pkgs/development/tools/continuous-integration/buildkite-agent/default.nix
index a8d35a44bb96..b32eed9a1662 100644
--- a/pkgs/development/tools/continuous-integration/buildkite-agent/default.nix
+++ b/pkgs/development/tools/continuous-integration/buildkite-agent/default.nix
@@ -3,13 +3,13 @@
   nixosTests }:
 buildGoModule rec {
   name = "buildkite-agent-${version}";
-  version = "3.30.0";
+  version = "3.31.0";
 
   src = fetchFromGitHub {
     owner = "buildkite";
     repo = "agent";
     rev = "v${version}";
-    sha256 = "sha256-U2UnT41IpICy08jPQkr25wjAL1kBxiQCD4lysYnLAPk=";
+    sha256 = "sha256-Rot5A2zSEleTifadHEvAlydchzCdDo/VPZELostDfng=";
   };
 
   vendorSha256 = "sha256-n3XRxpEKjHf7L7fcGscWTVKBtot9waZbLoS9cG0kHfI=";
diff --git a/pkgs/development/tools/continuous-integration/github-runner/default.nix b/pkgs/development/tools/continuous-integration/github-runner/default.nix
index b03dcc89d447..e2d40630905c 100644
--- a/pkgs/development/tools/continuous-integration/github-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/github-runner/default.nix
@@ -20,7 +20,7 @@
 }:
 let
   pname = "github-actions-runner";
-  version = "2.278.0";
+  version = "2.279.0";
 
   deps = (import ./deps.nix { inherit fetchurl; });
   nugetPackages = map
@@ -41,6 +41,10 @@ let
     # Online tests
     (x: "FullyQualifiedName!=GitHub.Runner.Common.Tests.Worker.ActionManagerL0.PrepareActions_${x}")
     [
+      "CompositeActionWithActionfile_CompositeContainerNested"
+      "CompositeActionWithActionfile_CompositePrestepNested"
+      "CompositeActionWithActionfile_MaxLimit"
+      "CompositeActionWithActionfile_Node"
       "DownloadActionFromGraph"
       "DownloadActionFromGraph_Legacy"
       "NotPullOrBuildImagesMultipleTimes"
@@ -80,8 +84,8 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "actions";
     repo = "runner";
-    rev = "62d926efce35d3ea16d7624a25aaa5b300737def"; # v${version}
-    sha256 = "sha256-KAb14739DYnuNIf7ZNZk5CShye6XFGn8aLu8BAcuT/c=";
+    rev = "6b75179ec79e2041b3b5b4e9206b73db2d206aac"; # v${version}
+    sha256 = "sha256-d7LAHL8Ff7R++d1HuLxWjtiBZRogySe7xHY/xJAcFms=";
   };
 
   nativeBuildInputs = [
@@ -123,6 +127,11 @@ stdenv.mkDerivation rec {
       --replace 'dotnet test Test/Test.csproj' \
                 "dotnet test Test/Test.csproj --filter '${testFilterXml}'"
 
+    # We don't use a Git checkout
+    substituteInPlace src/dir.proj \
+      --replace 'git update-index --assume-unchanged ./Runner.Sdk/BuildConstants.cs' \
+                'echo Patched out.'
+
     # Fix FHS path
     substituteInPlace src/Test/L0/Util/IOUtilL0.cs \
       --replace '/bin/ln' '${coreutils}/bin/ln'
diff --git a/pkgs/development/tools/delve/default.nix b/pkgs/development/tools/delve/default.nix
index 9a0d19840e46..57f30ec3ae48 100644
--- a/pkgs/development/tools/delve/default.nix
+++ b/pkgs/development/tools/delve/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "delve";
-  version = "1.6.1";
+  version = "1.7.0";
 
   goPackagePath = "github.com/go-delve/delve";
   excludedPackages = "\\(_fixtures\\|scripts\\|service/test\\)";
@@ -11,7 +11,7 @@ buildGoPackage rec {
     owner = "go-delve";
     repo = "delve";
     rev = "v${version}";
-    sha256 = "sha256-bTVCasemE8Vyjcs8wZBiiXEsW3UBndjpPQ5bi+4vQkw=";
+    sha256 = "sha256-RfBDeBuI/Yk24Q2jX/Re7fvx1bhYWJjqLhRkNHCaM9k=";
   };
 
   subPackages = [ "cmd/dlv" ];
diff --git a/pkgs/development/tools/kubie/default.nix b/pkgs/development/tools/kubie/default.nix
index c563d9bef096..5c86b9a24060 100644
--- a/pkgs/development/tools/kubie/default.nix
+++ b/pkgs/development/tools/kubie/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "kubie";
-  version = "0.15.0";
+  version = "0.15.1";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "sbstp";
     repo = "kubie";
-    sha256 = "sha256-uNlKxcU1iCR4JzNfBatEeKMMdu9ZqvOqna0sGrcwK30=";
+    sha256 = "sha256-jv5IhTxusB74pnpoopl+fKnXDJI/65D8PSuhGVgbDyo=";
   };
 
-  cargoSha256 = "sha256-4Xo17HlYvJLf90R0gS9EFJSJKmNHClXqAJTx9mY29KA=";
+  cargoSha256 = "sha256-6SaW3wqhn251GaH3GRNaSqRLnbQimDBRSt+RPgJG1M8=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/misc/go-md2man/default.nix b/pkgs/development/tools/misc/go-md2man/default.nix
index fe43da91b54b..8c43fe7f5947 100644
--- a/pkgs/development/tools/misc/go-md2man/default.nix
+++ b/pkgs/development/tools/misc/go-md2man/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "go-md2man";
-  version = "2.0.0";
+  version = "2.0.1";
 
   vendorSha256 = null;
 
@@ -10,7 +10,7 @@ buildGoModule rec {
     rev = "v${version}";
     owner = "cpuguy83";
     repo = "go-md2man";
-    sha256 = "0r1f7v475dxxgzqci1mxfliwadcrk86ippflx9n411325l4g3ghv";
+    sha256 = "sha256-DnXWnHWtczNnLaQg9Wnp9U/K4h/FbhqGgba44P6VNBQ=";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/tools/misc/terraform-ls/default.nix b/pkgs/development/tools/misc/terraform-ls/default.nix
index f48c6f9e0b63..86afbcc9421a 100644
--- a/pkgs/development/tools/misc/terraform-ls/default.nix
+++ b/pkgs/development/tools/misc/terraform-ls/default.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "terraform-ls";
-  version = "0.19.0";
+  version = "0.19.1";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-q97N9I1EzpcFlMuHe3X5rfZHt6XTytYO1inpGEvv1IQ=";
+    sha256 = "sha256-ag8Dq3lhLoKE4rgrnWLHtKRHEnw/ytyXI+pRt5CgZJI=";
   };
-  vendorSha256 = "sha256-7XcAt0+slNIjxxf7pUl7XO/PAN2z8WmzTuI0FsjgrBM=";
+  vendorSha256 = "sha256-/lpjlThr6HPkuJ6om9ifBsdsh0x4kVXM6PAonk7GJCY=";
 
   ldflags = [ "-s" "-w" "-X main.version=v${version}" "-X main.prerelease=" ];
 
diff --git a/pkgs/development/tools/pscale/default.nix b/pkgs/development/tools/pscale/default.nix
index 14518939dcd9..483a85db02a1 100644
--- a/pkgs/development/tools/pscale/default.nix
+++ b/pkgs/development/tools/pscale/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "pscale";
-  version = "0.58.0";
+  version = "0.60.0";
 
   src = fetchFromGitHub {
     owner = "planetscale";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-9XVvdAt/TWQdCY8s//QHZC6THFAf+pMYQpjHjUR3wrc=";
+    sha256 = "sha256-hrWSieWeVAg28f3Fh9mElr+mDh4v4T5JI1c3+Hrm7c0=";
   };
 
-  vendorSha256 = "sha256-m6eQ843aP68TO4W5Nq4zKqcf2wgdH/7Srzt37t/NSdk=";
+  vendorSha256 = "sha256-h4YUQWmFYouEvHup8Pu6OqfHf1EoPszVFzklU9SbJZQ=";
 
   meta = with lib; {
     homepage = "https://www.planetscale.com/";
diff --git a/pkgs/development/tools/rust/cargo-watch/default.nix b/pkgs/development/tools/rust/cargo-watch/default.nix
index 017fb7d484d4..c7cdf92dcd83 100644
--- a/pkgs/development/tools/rust/cargo-watch/default.nix
+++ b/pkgs/development/tools/rust/cargo-watch/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-watch";
-  version = "7.8.0";
+  version = "7.8.1";
 
   src = fetchFromGitHub {
     owner = "passcod";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ZbVBwSg3roIMA+5LVP3omtTgbAJ7HAdJDXyAybWuRLw=";
+    sha256 = "sha256-g6k/7jo8pvTn5snU05uSGzprNMt8/x+bJsLb/y0jHRg=";
   };
 
-  cargoSha256 = "sha256-6aoi/CLla/yKa5RuVgn8RJ9AK1j1wtZeBn+6tpXrJvA=";
+  cargoSha256 = "sha256-pfjWTkDw4D7eMADkPX01vapka8I6o0ZvkNjQt5X2pUk=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ CoreServices libiconv ];
 
diff --git a/pkgs/development/web/flyctl/default.nix b/pkgs/development/web/flyctl/default.nix
index 3c61121b0357..8828b0222cc2 100644
--- a/pkgs/development/web/flyctl/default.nix
+++ b/pkgs/development/web/flyctl/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "flyctl";
-  version = "0.0.228";
+  version = "0.0.229";
 
   src = fetchFromGitHub {
     owner = "superfly";
     repo = "flyctl";
     rev = "v${version}";
-    sha256 = "sha256-h8ZiAabB0IIJoeQMMvOO1lQNMdFYAoTXKcTAPmLP5Sw=";
+    sha256 = "sha256-mw+rTMFj41+T6lDe/MOQpmRcjt/gJhOCfaHcBkpjcsg=";
   };
 
   preBuild = ''
diff --git a/pkgs/games/simutrans/default.nix b/pkgs/games/simutrans/default.nix
index fc2654fd8e9b..60b2bc5faf77 100644
--- a/pkgs/games/simutrans/default.nix
+++ b/pkgs/games/simutrans/default.nix
@@ -11,28 +11,28 @@ let
       else map (name: pakSpec.${name}) (splitString " " paksets)
   );
 
-  ver1 = "120";
-  ver2 = "4";
-  ver3 = "1";
-  version =   "${ver1}.${ver2}.${ver3}";
-  ver_dash =  "${ver1}-${ver2}-${ver3}";
+  ver1 = "121";
+  ver2 = "0";
+  ver3 = "";
+  version  = "${ver1}.${ver2}${lib.optionalString (ver3 != "") ".${ver3}"}";
+  ver_dash = "${ver1}-${ver2}${lib.optionalString (ver3 != "") "-${ver3}"}";
 
   binary_src = fetchurl {
     url = "mirror://sourceforge/simutrans/simutrans/${ver_dash}/simutrans-src-${ver_dash}.zip";
-    sha256 = "0yw7vjvmczp022mgk35swwhpbiszpz91mwsgicxglwivgc30vvic";
+    sha256 = "1f463r6kr5ig0zd3mncc74k93xbjywsq3d06j5r17831jyc9bzb9";
   };
 
 
-  # As of 2015/03, many packsets still didn't have a release for version 120.
+  # As of 2021/07, many of these paksets have not been updated for years, so are on old versions.
   pakSpec = lib.mapAttrs
     (pakName: attrs: mkPak (attrs // {inherit pakName;}))
   {
     pak64 = {
-      srcPath = "121-0/simupak64-121-0";
+      srcPath = "${ver_dash}/simupak64-${ver_dash}";
       sha256 = "1k335kh8dhm1hdn5iwn3sdgnrlpk0rqxmmgqgqcwsi09cmw45m5c";
     };
     "pak64.japan" = {
-      # No release for 120.2 yet!
+      # No release for 121.0 yet!
       srcPath = "120-0/simupak64.japan-120-0-1";
       sha256 = "14swy3h4ij74bgaw7scyvmivfb5fmp21nixmhlpk3mav3wr3167i";
     };
diff --git a/pkgs/games/zandronum/sqlite.nix b/pkgs/games/zandronum/sqlite.nix
index c9baefcf0af6..e38dedbb7f73 100644
--- a/pkgs/games/zandronum/sqlite.nix
+++ b/pkgs/games/zandronum/sqlite.nix
@@ -9,8 +9,6 @@ stdenv.mkDerivation {
     sha256 = "0p5cx7nbjxk7glcm277ypi5w4gv144qazw79ql47svlpccj62mrp";
   };
 
-  phases = [ "unpackPhase" "buildPhase" ];
-
   buildPhase = ''
     mkdir -p $out
     cp sqlite3.c $out/
diff --git a/pkgs/misc/emulators/punes/default.nix b/pkgs/misc/emulators/punes/default.nix
index c0bf7a223a3b..d3ad2f681997 100644
--- a/pkgs/misc/emulators/punes/default.nix
+++ b/pkgs/misc/emulators/punes/default.nix
@@ -12,18 +12,20 @@
 , ffmpeg
 , libGLU
 , alsa-lib
+, libX11
+, libXrandr
 , sndio
 }:
 
 mkDerivation rec {
   pname = "punes";
-  version = "unstable-2021-06-05";
+  version = "unstable-2021-07-19";
 
   src = fetchFromGitHub {
     owner = "punesemu";
     repo = "puNES";
-    rev = "07fd123f62b2d075894a0cc966124db7b427b791";
-    sha256 = "1wxff7b397ayd2s2v14w6a0zfgklc7y0kv3mkz1gg5x47mnll24l";
+    rev = "15ab85dabb220889419df0c249c06f3db2b09dc0";
+    sha256 = "1w0c5lfdl9ha4sxxva6hcpcaa444px6x25471q37l69n71rmjpy8";
   };
 
   postPatch = ''
@@ -34,7 +36,7 @@ mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook cmake pkg-config qttools ];
 
   buildInputs = [ ffmpeg qtbase qtsvg libGLU ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [ alsa-lib ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [ alsa-lib libX11 libXrandr ]
     ++ lib.optionals stdenv.hostPlatform.isBSD [ sndio ];
 
   dontUseCmakeConfigure = true;
diff --git a/pkgs/servers/bazarr/default.nix b/pkgs/servers/bazarr/default.nix
index 7e7349408855..d15844e682e2 100644
--- a/pkgs/servers/bazarr/default.nix
+++ b/pkgs/servers/bazarr/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bazarr";
-  version = "0.9.5";
+  version = "0.9.6";
 
   src = fetchurl {
     url = "https://github.com/morpheus65535/bazarr/archive/v${version}.tar.gz";
-    sha256 = "sha256-N0HoZgAtWPgYPU9OWpMEXO2qUoNIGCsFn9vll0hLal0=";
+    sha256 = "sha256-aO9PIE/YlSIGEcntDCdxIYuuvV5jG266ldhC2QfT+e4=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/servers/imgproxy/default.nix b/pkgs/servers/imgproxy/default.nix
index 601e93a998aa..fc099e905e5a 100644
--- a/pkgs/servers/imgproxy/default.nix
+++ b/pkgs/servers/imgproxy/default.nix
@@ -3,12 +3,12 @@
 
 buildGoModule rec {
   pname = "imgproxy";
-  version = "2.16.6";
+  version = "2.16.7";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
-    sha256 = "sha256-wrd8G2y8oepaHMJaU4Bcvkf91ABX4ZapQSlztq4Gg84=";
+    sha256 = "sha256-7UGIkYChXIht/dyMhvPeu8oeGQEA7/Ns7+e56wEmAwQ=";
     rev = "v${version}";
   };
 
diff --git a/pkgs/servers/mail/system-sendmail/default.nix b/pkgs/servers/mail/system-sendmail/default.nix
index 28c54fc0fae9..76b92299409e 100644
--- a/pkgs/servers/mail/system-sendmail/default.nix
+++ b/pkgs/servers/mail/system-sendmail/default.nix
@@ -20,7 +20,9 @@ stdenv.mkDerivation {
 
   src = script;
 
-  phases = [ "buildPhase" ];
+  dontUnpack = true;
+  dontInstall = true;
+
   buildPhase = ''
     mkdir -p $out/bin
     < $src sed "s#{{MYPATH}}#$out/bin/sendmail#" > $out/bin/sendmail
diff --git a/pkgs/servers/matrix-synapse/default.nix b/pkgs/servers/matrix-synapse/default.nix
index c7894529e2bb..b2e61d506560 100644
--- a/pkgs/servers/matrix-synapse/default.nix
+++ b/pkgs/servers/matrix-synapse/default.nix
@@ -12,11 +12,11 @@ let
 in
 buildPythonApplication rec {
   pname = "matrix-synapse";
-  version = "1.38.0";
+  version = "1.38.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-k9/enFktixO4zvgBW3zw0COBakDP1PHVWAlbMi+FiWQ=";
+    sha256 = "sha256-bGKGzhuDjKaNbjXSwvidk9SrRmJsLQyLe5jps4DXN+s=";
   };
 
   patches = [
diff --git a/pkgs/servers/plex/raw.nix b/pkgs/servers/plex/raw.nix
index feab959a2df9..1d527fb203c1 100644
--- a/pkgs/servers/plex/raw.nix
+++ b/pkgs/servers/plex/raw.nix
@@ -88,6 +88,7 @@ stdenv.mkDerivation rec {
       pjones
       thoughtpolice
       maxeaubrey
+      MayNiklas
     ];
     description = "Media library streaming server";
     longDescription = ''
diff --git a/pkgs/tools/admin/awscli2/default.nix b/pkgs/tools/admin/awscli2/default.nix
index 1ce3cb452b8c..d84c1816fec4 100644
--- a/pkgs/tools/admin/awscli2/default.nix
+++ b/pkgs/tools/admin/awscli2/default.nix
@@ -1,4 +1,4 @@
-{ lib, python3, groff, less, fetchFromGitHub }:
+{ lib, python3, groff, less, fetchFromGitHub, fetchpatch }:
 let
   py = python3.override {
     packageOverrides = self: super: {
@@ -33,6 +33,13 @@ with py.pkgs; buildPythonApplication rec {
     sha256 = "sha256-LU9Tqzdi8ULZ5y3FbfSXdrip4NcxFkXRCTpVGo05LcM=";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/mgorny/aws-cli/commit/85361123d2fa12eaedf912c046ffe39aebdd2bad.patch";
+      sha256 = "sha256-1Rb+/CY7ze1/DbJ6TfqHF01cfI2vixZ1dT91bmHTg/A=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace setup.py \
       --replace "awscrt==0.11.13" "awscrt" \
diff --git a/pkgs/tools/admin/docker-credential-gcr/default.nix b/pkgs/tools/admin/docker-credential-gcr/default.nix
index 48851c3784b7..ee2efb206af6 100644
--- a/pkgs/tools/admin/docker-credential-gcr/default.nix
+++ b/pkgs/tools/admin/docker-credential-gcr/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "docker-credential-gcr";
-  version = "2.0.4";
+  version = "2.0.5";
 
   goPackagePath = "github.com/GoogleCloudPlatform/docker-credential-gcr";
 
@@ -10,7 +10,7 @@ buildGoPackage rec {
     owner = "GoogleCloudPlatform";
     repo = "docker-credential-gcr";
     rev = "v${version}";
-    sha256 = "sha256-yG8gpsD1KZBSbJnnNTXgZah/mcrOUH1O37s7AGpeHjQ=";
+    sha256 = "sha256-WrcGTXy5SMWDHJWddXUuvUvEWjOsJcoB1zBg02p5ggY=";
   };
 
   meta = with lib; {
diff --git a/pkgs/tools/admin/procs/default.nix b/pkgs/tools/admin/procs/default.nix
index e86bfb31101a..0578bb4703cc 100644
--- a/pkgs/tools/admin/procs/default.nix
+++ b/pkgs/tools/admin/procs/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "procs";
-  version = "0.11.8";
+  version = "0.11.9";
 
   src = fetchFromGitHub {
     owner = "dalance";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ZeCTUoi2HAMUeyze7LdxH0mi1Dd6q8Sw6+xPAVf3HTs=";
+    sha256 = "sha256-zqRjMCyFT7knI1/zH+RF1pA/OKaDhJZLLjWJhfmqopE=";
   };
 
-  cargoSha256 = "sha256-8myay5y4PGb/8s0vPLeg9xt6xqAQxGFXJz/GiV0ABlA=";
+  cargoSha256 = "sha256-W/ZMDbHC1VsllTSxCt77n4eb8Xgfj9YNx5NG5u+D+qA=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/admin/trivy/default.nix b/pkgs/tools/admin/trivy/default.nix
index f69909d85461..50ca76f0d6d3 100644
--- a/pkgs/tools/admin/trivy/default.nix
+++ b/pkgs/tools/admin/trivy/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "trivy";
-  version = "0.19.1";
+  version = "0.19.2";
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-oiaH0w7TEztR1i0wBuXXr+JN37UZOQ/zObBzQQvAnZY=";
+    sha256 = "sha256-aYPG0xvuijASKXBGgB+6UyF9bmeU8l5snOoPWI8Ewh8=";
   };
 
-  vendorSha256 = "sha256-bIQSZ+QQ0CnyOQ692Wpy4nXIPDSkD3LmnjwHZRG6soY=";
+  vendorSha256 = "sha256-4FO6/1eNyxy/CH7XMUkLfRqEg2+XUXL1gKleL6o4EoM=";
 
   excludedPackages = "misc";
 
diff --git a/pkgs/tools/backup/discordchatexporter-cli/default.nix b/pkgs/tools/backup/discordchatexporter-cli/default.nix
index 76b7d1da59b4..770a64b841c3 100644
--- a/pkgs/tools/backup/discordchatexporter-cli/default.nix
+++ b/pkgs/tools/backup/discordchatexporter-cli/default.nix
@@ -7,13 +7,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "discordchatexporter-cli";
-  version = "2.28";
+  version = "2.29";
 
   src = fetchFromGitHub {
     owner = "tyrrrz";
     repo = "discordchatexporter";
     rev = version;
-    sha256 = "1bcq8mwjr8635g8mkgbxnszk20hnwf0zk672glrxjqga6f6fnykg";
+    sha256 = "0hbhDlGEK2rxuCByW8RaT/0vne8Z+q0ZobCkW1FBoG8=";
   };
 
   nativeBuildInputs = [ dotnet-sdk_5 dotnetPackages.Nuget cacert makeWrapper autoPatchelfHook ];
diff --git a/pkgs/tools/backup/discordchatexporter-cli/deps.nix b/pkgs/tools/backup/discordchatexporter-cli/deps.nix
index a7703f2ba2c1..9849e6c63662 100644
--- a/pkgs/tools/backup/discordchatexporter-cli/deps.nix
+++ b/pkgs/tools/backup/discordchatexporter-cli/deps.nix
@@ -1,8 +1,8 @@
 { fetchNuGet }: [
   (fetchNuGet {
     name = "CliFx";
-    version = "2.0.4";
-    sha256 = "1wwpjli4y2545yi6k17mvjqy994wl3wm6nngszk87rbdwhkbncaj";
+    version = "2.0.6";
+    sha256 = "09yyjgpp52b0r3mqlvx75ld4vjp8hry7ql7r20nnvj0lach6fyh6";
   })
   (fetchNuGet {
     name = "Gress";
@@ -46,8 +46,13 @@
   })
   (fetchNuGet {
     name = "Spectre.Console";
-    version = "0.40.0";
-    sha256 = "17bb31nsvfk7m337zwqcz4v6cvayhfx51ri4yrv5i8nbp7f4rpb1";
+    version = "0.41.0";
+    sha256 = "104vyzwbbq5m75dm31xk7ilvmik8hw1cj3bc301a8w6gq8i0fpk3";
+  })
+  (fetchNuGet {
+    name = "Superpower";
+    version = "2.3.0";
+    sha256 = "0bdsc3c0d6jb0wr67siqfba0ldl0jxbwis6xr0whzqzf6m2cyahm";
   })
   (fetchNuGet {
     name = "System.Memory";
diff --git a/pkgs/tools/misc/diffoscope/default.nix b/pkgs/tools/misc/diffoscope/default.nix
index a4b2b888faea..88a9846e8352 100644
--- a/pkgs/tools/misc/diffoscope/default.nix
+++ b/pkgs/tools/misc/diffoscope/default.nix
@@ -72,6 +72,7 @@ python3Packages.buildPythonApplication rec {
     "test_sbin_added_to_path"
     "test_diff_meta"
     "test_diff_meta2"
+    "test_obj_no_differences"
   ];
 
   meta = with lib; {
diff --git a/pkgs/tools/misc/fend/default.nix b/pkgs/tools/misc/fend/default.nix
index 93e13996f7f4..4ed308643e56 100644
--- a/pkgs/tools/misc/fend/default.nix
+++ b/pkgs/tools/misc/fend/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "fend";
-  version = "0.1.20";
+  version = "0.1.21";
 
   src = fetchFromGitHub {
     owner = "printfn";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-2CzpPzUylzDiP9rbjneRR6joa9UEgnDfJ4Ffa/orhkk=";
+    sha256 = "sha256-LrHZsnW96+QsXuGxWoGqIEKTE86m3tMnh4fpDPIhd1w=";
   };
 
-  cargoSha256 = "sha256-xDh7SF73Qnx/GeW43JDmF+qeljSHbWWq4unWdTmAO+c=";
+  cargoSha256 = "sha256-GZ4Yt5iQkgupJMTYIbvCPtz19985MFf8IDy3ui0M6DE=";
 
   doInstallCheck = true;
 
diff --git a/pkgs/tools/networking/ppp/default.nix b/pkgs/tools/networking/ppp/default.nix
index 36d156a3994b..708932ac1c9d 100644
--- a/pkgs/tools/networking/ppp/default.nix
+++ b/pkgs/tools/networking/ppp/default.nix
@@ -1,45 +1,37 @@
-{ lib, stdenv, fetchurl, fetchpatch, fetchFromGitHub, substituteAll, libpcap, openssl }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, substituteAll
+, libpcap
+, openssl
+}:
 
 stdenv.mkDerivation rec {
-  version = "2.4.8";
+  version = "2.4.9";
   pname = "ppp";
 
   src = fetchFromGitHub {
-    owner = "paulusmack";
-    repo = "ppp";
-    rev = "ppp-${version}";
-    sha256 = "1i88m79h6g3fzsb4yw3k8bq1grsx3hsyawm7id2vcaab0gfqzjjv";
+    owner = "ppp-project";
+    repo = pname;
+    rev = "${pname}-${version}";
+    sha256 = "sha256-8+nbqRNfKPLDx+wmuKSkv+BSeG72hKJI4dNqypqeEK4=";
   };
 
-  patches =
-    [
-      ( substituteAll {
-        src = ./nix-purity.patch;
-        inherit libpcap;
-        glibc = stdenv.cc.libc.dev or stdenv.cc.libc;
-        openssl = openssl.dev;
-      })
-      # Without nonpriv.patch, pppd --version doesn't work when not run as
-      # root.
-      ./nonpriv.patch
-      (fetchpatch {
-        name = "CVE-2015-3310.patch";
-        url = "https://github.com/paulusmack/ppp/commit/858976b1fc3107f1261aae337831959b511b83c2.patch";
-        sha256 = "0wirmcis67xjwllqhz9lsz1b7dcvl8shvz78lxgybc70j2sv7ih4";
-      })
-      (fetchurl {
-        url = "https://www.nikhef.nl/~janjust/ppp/ppp-2.4.7-eaptls-mppe-1.102.patch";
-        sha256 = "04war8l5szql53l36043hvzgfwqp3v76kj8brbz7wlf7vs2mlkia";
-      })
-      (fetchpatch {
-        name = "CVE-2020-8597.patch";
-        url = "https://github.com/paulusmack/ppp/commit/8d7970b8f3db727fe798b65f3377fe6787575426.patch";
-        sha256 = "129wnhwxmzvr3y9gzxv82jnb5y8m4yg8vkpa0xl2rwkl8anbzgkh";
-      })
-      ./musl-fix-headers.patch
-    ];
+  patches = [
+    (substituteAll {
+      src = ./nix-purity.patch;
+      glibc = stdenv.cc.libc.dev or stdenv.cc.libc;
+      openssl_dev = openssl.dev;
+      openssl_out = openssl.out;
+    })
+    # Without nonpriv.patch, pppd --version doesn't work when not run as root.
+    ./nonpriv.patch
+  ];
 
-  buildInputs = [ libpcap openssl ];
+  buildInputs = [
+    libpcap
+    openssl
+  ];
 
   postPatch = ''
     # strip is not found when cross compiling with seemingly no way to point
@@ -66,9 +58,14 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    homepage = "https://ppp.samba.org/";
-    description = "Point-to-point implementation for Linux and Solaris";
-    license = with licenses; [ bsdOriginal publicDomain gpl2 lgpl2 ];
+    homepage = "https://ppp.samba.org";
+    description = "Point-to-point implementation to provide Internet connections over serial lines";
+    license = with licenses; [
+      bsdOriginal
+      publicDomain
+      gpl2
+      lgpl2
+    ];
     platforms = platforms.linux;
     maintainers = [ ];
   };
diff --git a/pkgs/tools/networking/ppp/musl-fix-headers.patch b/pkgs/tools/networking/ppp/musl-fix-headers.patch
deleted file mode 100644
index d6252a52675b..000000000000
--- a/pkgs/tools/networking/ppp/musl-fix-headers.patch
+++ /dev/null
@@ -1,137 +0,0 @@
-diff --git a/include/net/ppp_defs.h b/include/net/ppp_defs.h
-index b06eda5..dafa36c 100644
---- a/include/net/ppp_defs.h
-+++ b/include/net/ppp_defs.h
-@@ -38,6 +38,8 @@
- #ifndef _PPP_DEFS_H_
- #define _PPP_DEFS_H_
- 
-+#include <sys/time.h>
-+
- /*
-  * The basic PPP frame.
-  */
-diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux
-index a74c914..7acd2cf 100644
---- a/pppd/Makefile.linux
-+++ b/pppd/Makefile.linux
-@@ -126,7 +126,7 @@ LIBS	+= -lcrypt
- endif
- 
- ifdef USE_LIBUTIL
--CFLAGS	+= -DHAVE_LOGWTMP=1
-+#CFLAGS	+= -DHAVE_LOGWTMP=1
- LIBS	+= -lutil
- endif
- 
-diff --git a/pppd/magic.h b/pppd/magic.h
-index c81213b..305aece 100644
---- a/pppd/magic.h
-+++ b/pppd/magic.h
-@@ -42,6 +42,8 @@
-  * $Id: magic.h,v 1.5 2003/06/11 23:56:26 paulus Exp $
-  */
- 
-+#include <sys/cdefs.h>
-+
- void magic_init (void);	/* Initialize the magic number generator */
- u_int32_t magic (void);	/* Returns the next magic number */
- 
-diff --git a/pppd/plugins/rp-pppoe/if.c b/pppd/plugins/rp-pppoe/if.c
-index 91e9a57..9c0fac3 100644
---- a/pppd/plugins/rp-pppoe/if.c
-+++ b/pppd/plugins/rp-pppoe/if.c
-@@ -30,10 +30,6 @@ static char const RCSID[] =
- #include <linux/if_packet.h>
- #endif
- 
--#ifdef HAVE_NET_ETHERNET_H
--#include <net/ethernet.h>
--#endif
--
- #ifdef HAVE_ASM_TYPES_H
- #include <asm/types.h>
- #endif
-diff --git a/pppd/plugins/rp-pppoe/plugin.c b/pppd/plugins/rp-pppoe/plugin.c
-index a8c2bb4..ca34d79 100644
---- a/pppd/plugins/rp-pppoe/plugin.c
-+++ b/pppd/plugins/rp-pppoe/plugin.c
-@@ -46,7 +46,6 @@ static char const RCSID[] =
- #include <unistd.h>
- #include <fcntl.h>
- #include <signal.h>
--#include <net/ethernet.h>
- #include <net/if_arp.h>
- #include <linux/ppp_defs.h>
- #include <linux/if_pppox.h>
-diff --git a/pppd/plugins/rp-pppoe/pppoe-discovery.c b/pppd/plugins/rp-pppoe/pppoe-discovery.c
-index 3d3bf4e..b5f82d3 100644
---- a/pppd/plugins/rp-pppoe/pppoe-discovery.c
-+++ b/pppd/plugins/rp-pppoe/pppoe-discovery.c
-@@ -27,10 +27,6 @@
- #include <linux/if_packet.h>
- #endif
- 
--#ifdef HAVE_NET_ETHERNET_H
--#include <net/ethernet.h>
--#endif
--
- #ifdef HAVE_ASM_TYPES_H
- #include <asm/types.h>
- #endif
-@@ -55,6 +51,8 @@ void die(int status)
- 	exit(status);
- }
- 
-+#define error(x...) fprintf(stderr, x)
-+
- /* Initialize frame types to RFC 2516 values.  Some broken peers apparently
-    use different frame types... sigh... */
- 
-diff --git a/pppd/plugins/rp-pppoe/pppoe.h b/pppd/plugins/rp-pppoe/pppoe.h
-index c4aaa6e..70aef85 100644
---- a/pppd/plugins/rp-pppoe/pppoe.h
-+++ b/pppd/plugins/rp-pppoe/pppoe.h
-@@ -88,18 +88,6 @@ typedef unsigned long UINT32_t;
- #include <linux/if_ether.h>
- #endif
- 
--#ifdef HAVE_NETINET_IF_ETHER_H
--#include <sys/types.h>
--
--#ifdef HAVE_SYS_SOCKET_H
--#include <sys/socket.h>
--#endif
--#ifndef HAVE_SYS_DLPI_H
--#include <netinet/if_ether.h>
--#endif
--#endif
--
--
- /* Ethernet frame types according to RFC 2516 */
- #define ETH_PPPOE_DISCOVERY 0x8863
- #define ETH_PPPOE_SESSION   0x8864
-diff --git a/pppd/sys-linux.c b/pppd/sys-linux.c
-index 6d71530..86d224e 100644
---- a/pppd/sys-linux.c
-+++ b/pppd/sys-linux.c
-@@ -102,19 +102,11 @@
- #define MAX_ADDR_LEN 7
- #endif
- 
--#if !defined(__GLIBC__) || __GLIBC__ >= 2
- #include <asm/types.h>		/* glibc 2 conflicts with linux/types.h */
- #include <net/if.h>
- #include <net/if_arp.h>
- #include <net/route.h>
- #include <netinet/if_ether.h>
--#else
--#include <linux/types.h>
--#include <linux/if.h>
--#include <linux/if_arp.h>
--#include <linux/route.h>
--#include <linux/if_ether.h>
--#endif
- #include <netinet/in.h>
- #include <arpa/inet.h>
- 
diff --git a/pkgs/tools/networking/ppp/nix-purity.patch b/pkgs/tools/networking/ppp/nix-purity.patch
index 975ea9db6096..c3363e0ccb64 100644
--- a/pkgs/tools/networking/ppp/nix-purity.patch
+++ b/pkgs/tools/networking/ppp/nix-purity.patch
@@ -1,31 +1,33 @@
 diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux
-index 9664f70..d07e01e 100644
+index 22837c5..6f6fff5 100644
 --- a/pppd/Makefile.linux
 +++ b/pppd/Makefile.linux
-@@ -125,7 +125,7 @@ CFLAGS   += -DHAS_SHADOW
+@@ -111,8 +111,8 @@ endif
+ 
+ # EAP SRP-SHA1
+ ifdef USE_SRP
+-CFLAGS	+= -DUSE_SRP -DOPENSSL -I/usr/local/ssl/include
+-LIBS	+= -lsrp -L/usr/local/ssl/lib
++CFLAGS	+= -DUSE_SRP -DOPENSSL -I@openssl_dev@/include/openssl
++LIBS	+= -lsrp -L@openssl_out@/lib
+ NEEDCRYPTOLIB = y
+ TARGETS	+= srp-entry
+ EXTRAINSTALL = $(INSTALL) -c -m 555 srp-entry $(BINDIR)/srp-entry
+@@ -143,7 +143,7 @@ CFLAGS   += -DHAS_SHADOW
  #LIBS     += -lshadow $(LIBS)
  endif
  
--ifneq ($(wildcard $(shell $(CC) --print-sysroot)/usr/include/crypt.h),)
+-ifeq ($(shell echo '\#include <crypt.h>' | $(CC) -E - >/dev/null 2>&1 && echo yes),yes)
 +ifneq ($(wildcard @glibc@/include/crypt.h),)
  CFLAGS  += -DHAVE_CRYPT_H=1
- LIBS   += -lcrypt
+ LIBS	+= -lcrypt
  endif
-@@ -137,7 +137,7 @@ endif
+@@ -155,7 +155,7 @@ endif
  
  ifdef NEEDDES
  ifndef USE_CRYPT
 -CFLAGS   += -I$(shell $(CC) --print-sysroot)/usr/include/openssl
-+CFLAGS   += -I@openssl@/include/openssl
- LIBS     += -lcrypto
++CFLAGS   += -I@openssl_dev@/include/openssl
+ NEEDCRYPTOLIB = y
  else
  CFLAGS   += -DUSE_CRYPT=1
-@@ -188,7 +188,7 @@ LIBS        += -ldl
- endif
- 
- ifdef FILTER
--ifneq ($(wildcard /usr/include/pcap-bpf.h),)
-+ifneq ($(wildcard @libpcap@/include/pcap-bpf.h),)
- LIBS    += -lpcap
- CFLAGS  += -DPPP_FILTER
- endif
diff --git a/pkgs/tools/security/cewl/Gemfile b/pkgs/tools/security/cewl/Gemfile
new file mode 100644
index 000000000000..97d9ae757acc
--- /dev/null
+++ b/pkgs/tools/security/cewl/Gemfile
@@ -0,0 +1,8 @@
+source 'https://rubygems.org'
+gem 'mime'
+gem 'mime-types', ">=3.3.1"
+gem 'mini_exiftool'
+gem 'nokogiri'
+gem 'rexml'
+gem 'rubyzip'
+gem 'spider'
diff --git a/pkgs/tools/security/cewl/Gemfile.lock b/pkgs/tools/security/cewl/Gemfile.lock
new file mode 100644
index 000000000000..85bb2eb4b822
--- /dev/null
+++ b/pkgs/tools/security/cewl/Gemfile.lock
@@ -0,0 +1,31 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    mime (0.4.4)
+    mime-types (3.3.1)
+      mime-types-data (~> 3.2015)
+    mime-types-data (3.2021.0704)
+    mini_exiftool (2.10.2)
+    mini_portile2 (2.5.3)
+    nokogiri (1.11.7)
+      mini_portile2 (~> 2.5.0)
+      racc (~> 1.4)
+    racc (1.5.2)
+    rexml (3.2.5)
+    rubyzip (2.3.2)
+    spider (0.5.4)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  mime
+  mime-types (>= 3.3.1)
+  mini_exiftool
+  nokogiri
+  rexml
+  rubyzip
+  spider
+
+BUNDLED WITH
+   2.1.4
diff --git a/pkgs/tools/security/cewl/default.nix b/pkgs/tools/security/cewl/default.nix
new file mode 100644
index 000000000000..06d983c14e36
--- /dev/null
+++ b/pkgs/tools/security/cewl/default.nix
@@ -0,0 +1,33 @@
+{ stdenv, lib, fetchFromGitHub, bundlerEnv }:
+
+let
+  rubyEnv = bundlerEnv {
+    name = "cewl-ruby-env";
+    gemdir = ./.;
+  };
+in
+stdenv.mkDerivation rec {
+  pname = "cewl";
+  version = "5.5.2";
+  src = fetchFromGitHub {
+    owner = "digininja";
+    repo = "CeWL";
+    rev = version;
+    sha256 = "sha256-5LTZUr3OMeu1NODhIgBiVqtQnUWYfZTm73q61vT3rXc=";
+  };
+
+  buildInputs = [ rubyEnv.wrappedRuby ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp *.rb $out/bin/
+    mv $out/bin/cewl.rb $out/bin/cewl
+  '';
+
+  meta = with lib; {
+    description = "Custom wordlist generator";
+    homepage = "https://digi.ninja/projects/cewl.php/";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ elohmeier ];
+  };
+}
diff --git a/pkgs/tools/security/cewl/gemset.nix b/pkgs/tools/security/cewl/gemset.nix
new file mode 100644
index 000000000000..851a6d2442d3
--- /dev/null
+++ b/pkgs/tools/security/cewl/gemset.nix
@@ -0,0 +1,104 @@
+{
+  mime = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0nskys7brz2bylhxiknl0z9i19w3wb1knf0h93in6mjq70jdw5cr";
+      type = "gem";
+    };
+    version = "0.4.4";
+  };
+  mime-types = {
+    dependencies = ["mime-types-data"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1zj12l9qk62anvk9bjvandpa6vy4xslil15wl6wlivyf51z773vh";
+      type = "gem";
+    };
+    version = "3.3.1";
+  };
+  mime-types-data = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0dlxwc75iy0dj23x824cxpvpa7c8aqcpskksrmb32j6m66h5mkcy";
+      type = "gem";
+    };
+    version = "3.2021.0704";
+  };
+  mini_exiftool = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0ir4wigpm6nkd3f40wcjdqrhjx3l60w1hwcg143is1a95ypnvqhr";
+      type = "gem";
+    };
+    version = "2.10.2";
+  };
+  mini_portile2 = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1ad0mli9rc0f17zw4ibp24dbj1y39zkykijsjmnzl4gwpg5s0j6k";
+      type = "gem";
+    };
+    version = "2.5.3";
+  };
+  nokogiri = {
+    dependencies = ["mini_portile2" "racc"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1vrn31385ix5k9b0yalnlzv360isv6dincbcvi8psllnwz4sjxj9";
+      type = "gem";
+    };
+    version = "1.11.7";
+  };
+  racc = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "178k7r0xn689spviqzhvazzvxfq6fyjldxb3ywjbgipbfi4s8j1g";
+      type = "gem";
+    };
+    version = "1.5.2";
+  };
+  rexml = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "08ximcyfjy94pm1rhcx04ny1vx2sk0x4y185gzn86yfsbzwkng53";
+      type = "gem";
+    };
+    version = "3.2.5";
+  };
+  rubyzip = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0grps9197qyxakbpw02pda59v45lfgbgiyw48i0mq9f2bn9y6mrz";
+      type = "gem";
+    };
+    version = "2.3.2";
+  };
+  spider = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0fix7zhnvlfqg66bxwdpbsffbynzdnaifnxpakn07bjh3rdj75cx";
+      type = "gem";
+    };
+    version = "0.5.4";
+  };
+}
diff --git a/pkgs/tools/security/gorilla-bin/default.nix b/pkgs/tools/security/gorilla-bin/default.nix
index 68aa7c488198..228271742c64 100644
--- a/pkgs/tools/security/gorilla-bin/default.nix
+++ b/pkgs/tools/security/gorilla-bin/default.nix
@@ -11,7 +11,6 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ patchelf makeWrapper ];
-  phases = [ "unpackPhase" "installPhase" ];
 
   unpackCmd = ''
     mkdir gorilla;
diff --git a/pkgs/tools/security/open-ecard/default.nix b/pkgs/tools/security/open-ecard/default.nix
index 5c07add90563..00ff112ba844 100644
--- a/pkgs/tools/security/open-ecard/default.nix
+++ b/pkgs/tools/security/open-ecard/default.nix
@@ -23,7 +23,7 @@ in stdenv.mkDerivation rec {
 
   src = srcs.richclient;
 
-  phases = "installPhase";
+  dontUnpack = true;
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/tools/security/ssss/default.nix b/pkgs/tools/security/ssss/default.nix
index 34407f5f5ad9..61d10111120e 100644
--- a/pkgs/tools/security/ssss/default.nix
+++ b/pkgs/tools/security/ssss/default.nix
@@ -1,28 +1,45 @@
-{ lib, stdenv, fetchurl, gmp }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, gmp
+, installShellFiles
+}:
 
-stdenv.mkDerivation {
-  name = "ssss-0.5";
+stdenv.mkDerivation rec {
+  pname = "ssss";
+  version = "0.5.7";
 
-  src = fetchurl {
-    url = "http://point-at-infinity.org/ssss/ssss-0.5.tar.gz";
-    sha256 = "15grn2fp1x8p92kxkwbmsx8rz16g93y9grl3hfqbh1jn21ama5jx";
+  src = fetchFromGitHub {
+    owner = "MrJoy";
+    repo = pname;
+    rev = "releases%2Fv${version}";
+    sha256 = "18r1hwch6nq6gjijavr4pvrxz2plrlrvdx8ssqhdj2vmqvlqwbvd";
   };
 
-  buildInputs = [ gmp ];
+  nativeBuildInputs = [
+    installShellFiles
+  ];
 
-  preBuild =
-    ''
-      sed -e s@/usr/@$out/@g -i Makefile
-      cp ssss.manpage.xml ssss.1
-      cp ssss.manpage.xml ssss.1.html
-      mkdir -p $out/bin $out/share/man/man1
-      echo -e 'install:\n\tcp ssss-combine ssss-split '"$out"'/bin' >>Makefile
-    '';
+  buildInputs = [
+    gmp
+  ];
 
-  meta = {
+  preBuild = ''
+    sed -e s@/usr/@$out/@g -i Makefile
+    cp ssss.manpage.xml ssss.1
+    mkdir -p $out/bin
+    echo -e 'install:\n\tcp ssss-combine ssss-split '"$out"'/bin' >>Makefile
+  '';
+
+  postInstall = ''
+    installManPage ssss.1
+  '';
+
+  meta = with lib; {
     description = "Shamir Secret Sharing Scheme";
     homepage = "http://point-at-infinity.org/ssss/";
-    platforms = lib.platforms.unix;
-    license = lib.licenses.gpl2;
+    license = licenses.gpl2Plus;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/tools/text/mdcat/default.nix b/pkgs/tools/text/mdcat/default.nix
index 93f65f45d375..67f69ecc71d2 100644
--- a/pkgs/tools/text/mdcat/default.nix
+++ b/pkgs/tools/text/mdcat/default.nix
@@ -8,33 +8,24 @@
 , Security
 , ansi2html
 , installShellFiles
-, fetchpatch
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "mdcat";
-  version = "0.23.1";
+  version = "0.23.2";
 
   src = fetchFromGitHub {
     owner = "lunaryorn";
     repo = pname;
     rev = "mdcat-${version}";
-    sha256 = "sha256-aJ7rL+EKa5zWmCmekVuRmdeOwTmVo0IQ+GJ8Ga4iTI0=";
+    sha256 = "sha256-PM6bx7qzEx4He9aX4WRO7ad/f9+wzT+gPGXKwYwG8+A=";
   };
 
-  patches = [
-    # detect wezterm through TERM again which was removed in 0.23.1
-    (fetchpatch {
-      url = "https://github.com/lunaryorn/mdcat/commit/a897b223904748a47c277f7c9a07d59e7d5c916b.patch";
-      sha256 = "sha256-tSeNyrlqoGvlfQ3xMRkvqZ7HajMvPCIk7kyt/sVjmTo=";
-    })
-  ];
-
   nativeBuildInputs = [ pkg-config asciidoctor installShellFiles ];
   buildInputs = [ openssl ]
     ++ lib.optional stdenv.isDarwin Security;
 
-  cargoSha256 = "sha256-r0dJ/lDOfRzEdwySR/eEvsrO8qn4g7ZIfpekiirUp3Q=";
+  cargoSha256 = "sha256-GL9WGoyM1++QFAR+bzj0XkjaRaDCWcbcahles5amNpk=";
 
   checkInputs = [ ansi2html ];
   # Skip tests that use the network and that include files.
diff --git a/pkgs/tools/text/ocrmypdf/default.nix b/pkgs/tools/text/ocrmypdf/default.nix
index 1a60d7d013ef..0dff6d76fffe 100644
--- a/pkgs/tools/text/ocrmypdf/default.nix
+++ b/pkgs/tools/text/ocrmypdf/default.nix
@@ -30,14 +30,13 @@ let
 in
 buildPythonApplication rec {
   pname = "ocrmypdf";
-  version = "11.7.3";
-  disabled = ! python3Packages.isPy3k;
+  version = "12.3.0";
 
   src = fetchFromGitHub {
     owner = "jbarlow83";
     repo = "OCRmyPDF";
     rev = "v${version}";
-    sha256 = "0gs2w9kl5wwrs0hx2sivq3pdvpf3lkaifblwfbz5g31yl770blji";
+    sha256 = "122yv3p0v4fbx30zgppcznwnm7svg97gv0sa103xb6zcld68ggn2";
   };
 
   nativeBuildInputs = with python3Packages; [
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 03d4078b11bd..8b8df3b1bbec 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -241,6 +241,8 @@ in
 
   cereal = callPackage ../development/libraries/cereal { };
 
+  cewl = callPackage ../tools/security/cewl { };
+
   checkov = callPackage ../development/tools/analysis/checkov {};
 
   chrysalis = callPackage ../applications/misc/chrysalis { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index a1bd5d816af0..f235637a2eb1 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5414,6 +5414,8 @@ in {
 
   python-juicenet = callPackage ../development/python-modules/python-juicenet { };
 
+  python-lsp-black = callPackage ../development/python-modules/python-lsp-black { };
+
   python-openems = callPackage ../development/python-modules/python-openems { };
 
   python-openzwave-mqtt = callPackage ../development/python-modules/python-openzwave-mqtt { };
@@ -6185,6 +6187,8 @@ in {
 
   pyls-black = callPackage ../development/python-modules/pyls-black { };
 
+  pyls-flake8 = callPackage ../development/python-modules/pyls-flake8 { };
+
   pyls-isort = callPackage ../development/python-modules/pyls-isort { };
 
   pyls-mypy = callPackage ../development/python-modules/pyls-mypy { };
@@ -6273,6 +6277,8 @@ in {
 
   pymumble = callPackage ../development/python-modules/pymumble { };
 
+  pymunk = callPackage ../development/python-modules/pymunk { };
+
   pymupdf = callPackage ../development/python-modules/pymupdf { };
 
   PyMVGLive = callPackage ../development/python-modules/pymvglive { };
@@ -8240,6 +8246,8 @@ in {
 
   sphinx-autobuild = callPackage ../development/python-modules/sphinx-autobuild { };
 
+  sphinx-copybutton = callPackage ../development/python-modules/sphinx-copybutton { };
+
   sphinx-jinja = callPackage ../development/python-modules/sphinx-jinja { };
 
   sphinx-markdown-parser = callPackage ../development/python-modules/sphinx-markdown-parser { };