diff --git a/.github/workflows/update-terraform-providers.yml b/.github/workflows/update-terraform-providers.yml
new file mode 100644
index 000000000000..33ebb6f14ac3
--- /dev/null
+++ b/.github/workflows/update-terraform-providers.yml
@@ -0,0 +1,47 @@
+name: "Update terraform-providers"
+
+on:
+  schedule:
+    - cron: "14 3 * * 1"
+  workflow_dispatch:
+
+jobs:
+  tf-providers:
+    if: github.repository_owner == 'NixOS' && github.ref == 'refs/heads/master' # ensure workflow_dispatch only runs on master
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - uses: cachix/install-nix-action@v16
+      - name: setup
+        id: setup
+        run: |
+          echo ::set-output name=title::"terraform-providers: update $(date -u +"%Y-%m-%d")"
+      - name: update terraform-providers
+        run: |
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git config user.name "github-actions[bot]"
+          pushd pkgs/applications/networking/cluster/terraform-providers
+          ./update-all-providers
+          git commit -m "${{ steps.setup.outputs.title }}" providers.json
+          popd
+      - name: create PR
+        uses: peter-evans/create-pull-request@v3
+        with:
+          body: |
+            Automatic update of terraform providers.
+
+            Created by [update-terraform-providers](https://github.com/NixOS/nixpkgs/blob/master/.github/workflows/update-terraform-providers.yml) action.
+
+            Check that all providers build with `@ofborg build terraform-full`
+          branch: terraform-providers-update
+          delete-branch: false
+          labels: "2.status: work-in-progress"
+          title: ${{ steps.setup.outputs.title }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+      - name: comment on failure
+        uses: peter-evans/create-or-update-comment@v1
+        if: ${{ failure() }}
+        with:
+          issue-number: 153416
+          body: |
+            Automatic update of terraform providers [failed](https://github.com/NixOS/nixpkgs/actions/runs/${{ github.run_id }}).
diff --git a/doc/languages-frameworks/beam.section.md b/doc/languages-frameworks/beam.section.md
index 6552f6cce5e5..f6c74cb01e40 100644
--- a/doc/languages-frameworks/beam.section.md
+++ b/doc/languages-frameworks/beam.section.md
@@ -74,7 +74,7 @@ there are 3 steps, frontend dependencies (javascript), backend dependencies (eli
 
 ##### mixRelease - Frontend dependencies (javascript) {#mix-release-javascript-deps}
 
-for phoenix projects, inside of nixpkgs you can either use yarn2nix (mkYarnModule) or node2nix. An example with yarn2nix can be found [here](https://github.com/NixOS/nixpkgs/blob/master/pkgs/servers/web-apps/plausible/default.nix#L39). An example with node2nix will follow. To package something outside of nixpkgs, you have alternatives like [npmlock2nix](https://github.com/nix-community/npmlock2nix) or [nix-npm-buildpackage](https://github.com/serokell/nix-npm-buildpackage)
+For phoenix projects, inside of nixpkgs you can either use yarn2nix (mkYarnModule) or node2nix. An example with yarn2nix can be found [here](https://github.com/NixOS/nixpkgs/blob/master/pkgs/servers/web-apps/plausible/default.nix#L39). An example with node2nix will follow. To package something outside of nixpkgs, you have alternatives like [npmlock2nix](https://github.com/nix-community/npmlock2nix) or [nix-npm-buildpackage](https://github.com/serokell/nix-npm-buildpackage)
 
 ##### mixRelease - backend dependencies (mix) {#mix-release-mix-deps}
 
@@ -82,13 +82,13 @@ There are 2 ways to package backend dependencies. With mix2nix and with a fixed-
 
 ###### mix2nix {#mix2nix}
 
-mix2nix is a cli tool available in nixpkgs. it will generate a nix expression from a mix.lock file. It is quite standard in the 2nix tool series.
+`mix2nix` is a cli tool available in nixpkgs. it will generate a nix expression from a mix.lock file. It is quite standard in the 2nix tool series.
 
 Note that currently mix2nix can't handle git dependencies inside the mix.lock file. If you have git dependencies, you can either add them manually (see [example](https://github.com/NixOS/nixpkgs/blob/master/pkgs/servers/pleroma/default.nix#L20)) or use the FOD method.
 
 The advantage of using mix2nix is that nix will know your whole dependency graph. On a dependency update, this won't trigger a full rebuild and download of all the dependencies, where FOD will do so.
 
-practical steps:
+Practical steps:
 
 - run `mix2nix > mix_deps.nix` in the upstream repo.
 - pass `mixNixDeps = with pkgs; import ./mix_deps.nix { inherit lib beamPackages; };` as an argument to mixRelease.
diff --git a/nixos/modules/services/monitoring/prometheus/default.nix b/nixos/modules/services/monitoring/prometheus/default.nix
index f20b8dde1abd..b36b5fd06504 100644
--- a/nixos/modules/services/monitoring/prometheus/default.nix
+++ b/nixos/modules/services/monitoring/prometheus/default.nix
@@ -251,6 +251,13 @@ let
 
   promTypes.scrape_config = types.submodule {
     options = {
+      authorization = mkOption {
+        type = types.attrs;
+        default = {};
+        description = ''
+          Sets the `Authorization` header on every scrape request with the configured credentials.
+        '';
+      };
       job_name = mkOption {
         type = types.str;
         description = ''
diff --git a/pkgs/applications/audio/gnome-podcasts/default.nix b/pkgs/applications/audio/gnome-podcasts/default.nix
index b91e861c5d5a..ee60cbff04be 100644
--- a/pkgs/applications/audio/gnome-podcasts/default.nix
+++ b/pkgs/applications/audio/gnome-podcasts/default.nix
@@ -21,20 +21,20 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-podcasts";
-  version = "0.5.0";
+  version = "0.5.1";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = "podcasts";
     rev = version;
-    hash = "sha256-Jk++/QrQt/fjOz2OaEIr1Imq2DmqTjcormCebjO4/Kk=";
+    sha256 = "00vy1qkkpn76jdpybsq9qp8s6fh1ih10j73p2x43sl97m5g8944h";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-jlXpeVabc1h2GU1j9Ff6GZJec+JgFyOdJzsOtdkrEWI=";
+    sha256 = "0y34b5rnr75h7dxbx93mafrmwsh187wq5js7fmkb1m1yyybj1v1x";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/cluster/terraform-providers/gandi/default.nix b/pkgs/applications/networking/cluster/terraform-providers/gandi/default.nix
index 13afa8d3818a..359adcef5d04 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/gandi/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/gandi/default.nix
@@ -1,21 +1,25 @@
-{ lib, fetchFromGitHub, buildGoPackage }:
-buildGoPackage rec {
+{ lib, fetchFromGitHub, buildGoModule }:
+buildGoModule rec {
   pname = "terraform-provider-gandi";
-  version = "1.0.0";
-
-  goPackagePath = "github.com/tiramiseb/terraform-provider-gandi";
-  goDeps = ./deps.nix;
+  version = "1.1.1";
 
   src = fetchFromGitHub {
-    owner = "tiramiseb";
+    owner = "go-gandi";
     repo = "terraform-provider-gandi";
     rev = "v${version}";
-    sha256 = "0byydpqsimvnk11bh9iz8zlxbsmsk65w55pvkp18vjzqrhf4kyfv";
+    sha256 = "sha256-PI7cujatzmljyxosGMaqg3Jizee9Py7ffq9gKdehlvo=";
   };
 
+  vendorSha256 = "sha256-dASIvZ3d7xTYMfvqeTcSJt+kaswGNRNqjHDcgoRVxNk=";
+  deleteVendor = true;
+
+  doCheck = false;
+
+  subPackages = [ "." ];
+
   # Terraform allow checking the provider versions, but this breaks
   # if the versions are not provided via file paths.
-  postBuild = "mv go/bin/terraform-provider-gandi{,_v${version}}";
+  postBuild = "mv $NIX_BUILD_TOP/go/bin/terraform-provider-gandi{,_v${version}}";
 
   meta = with lib; {
     description = "Terraform provider for the Gandi LiveDNS service.";
diff --git a/pkgs/applications/networking/cluster/terraform-providers/gandi/deps.nix b/pkgs/applications/networking/cluster/terraform-providers/gandi/deps.nix
deleted file mode 100644
index 3d4a3547502d..000000000000
--- a/pkgs/applications/networking/cluster/terraform-providers/gandi/deps.nix
+++ /dev/null
@@ -1,21 +0,0 @@
-# This file was generated by https://github.com/kamilchm/go2nix v1.2.1
-[
-  {
-    goPackagePath = "github.com/hashicorp/terraform";
-    fetch = {
-      type = "git";
-      url = "https://github.com/hashicorp/terraform";
-      rev = "27b720113ed5143a870ec151b3b7c9d955a09bc0";
-      sha256 = "1f0hwdf2z68p0ll3pgrx949h09q52gcfaxap0zz52m7px98sfab4";
-    };
-  }
-  {
-    goPackagePath = "github.com/tiramiseb/go-gandi-livedns";
-    fetch = {
-      type = "git";
-      url = "https://github.com/tiramiseb/go-gandi-livedns";
-      rev = "4773a84f8ee7365ed21edc6cd0602aaf93e94e59";
-      sha256 = "1i8s7yclrkhf974vs2splh5symzk0ym54px0bc216bq4ifzkwkqc";
-    };
-  }
-]
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 8d656bc928b0..f9dc7056ebab 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -40,10 +40,10 @@
     "owner": "aliyun",
     "provider-source-address": "registry.terraform.io/aliyun/alicloud",
     "repo": "terraform-provider-alicloud",
-    "rev": "v1.149.0",
-    "sha256": "0v9jhpvz33hzq09i8bxp1dif9jdypb5g2xy3d2g1mw4lgqrdpjix",
+    "rev": "v1.150.0",
+    "sha256": "16apk8axn2kkbnlvnzcjwf29vmxyhqhp3bx9vdz4ckvk1ajsw4dw",
     "vendorSha256": "18chs2723i2cxhhm649mz52pp6wrfqzxgk12zxq9idrhicchqnzg",
-    "version": "1.149.0"
+    "version": "1.150.0"
   },
   "ansible": {
     "owner": "nbering",
@@ -76,10 +76,10 @@
     "owner": "vmware",
     "provider-source-address": "registry.terraform.io/vmware/avi",
     "repo": "terraform-provider-avi",
-    "rev": "v21.1.2",
-    "sha256": "1j96k7yklaxykqj6v1yvxxib2zr2jyx37pkan34jxd8nk43lix67",
-    "vendorSha256": "0pz0n2ijmbhqzvhq41h1hs80yiphwwb0lf3zacifp6rxyv8aawlf",
-    "version": "21.1.2"
+    "rev": "v21.1.3",
+    "sha256": "160l9864p73283hc27qaabd3lrh7lm8fyh6k9xlal5isfd9vrm5p",
+    "vendorSha256": "1hw1xp20nhs4p1q9l887m82456fg5977pm66165gdkczwrq2zr6v",
+    "version": "21.1.3"
   },
   "aviatrix": {
     "owner": "AviatrixSystems",
@@ -311,10 +311,10 @@
     "owner": "dome9",
     "provider-source-address": "registry.terraform.io/dome9/dome9",
     "repo": "terraform-provider-dome9",
-    "rev": "v1.24.4",
-    "sha256": "01zvav3r25qbhq1dfxjwmcgyk377cisn1k6406xq66fsyijcf5rw",
+    "rev": "v1.24.5",
+    "sha256": "0a4q5lf11xxfc9ndicdmjir77rdsiq5a8fwb6065879qaamvaxqi",
     "vendorSha256": null,
-    "version": "1.24.4"
+    "version": "1.24.5"
   },
   "elasticsearch": {
     "owner": "phillbaker",
@@ -329,10 +329,10 @@
     "owner": "exoscale",
     "provider-source-address": "registry.terraform.io/exoscale/exoscale",
     "repo": "terraform-provider-exoscale",
-    "rev": "v0.31.1",
-    "sha256": "1k6z7mi20ijn3lj734abrbpgcpa6lr5ziacg8h5xr99xs5r9g5yi",
+    "rev": "v0.31.2",
+    "sha256": "1fncpy8vc72g6h560mnkwm160wah8iik4bn12mjgbz3nvjlsm04x",
     "vendorSha256": null,
-    "version": "0.31.1"
+    "version": "0.31.2"
   },
   "external": {
     "owner": "hashicorp",
@@ -938,10 +938,10 @@
     "owner": "jianyuan",
     "provider-source-address": "registry.terraform.io/jianyuan/sentry",
     "repo": "terraform-provider-sentry",
-    "rev": "v0.6.0",
-    "sha256": "0246hv52kslrzj43dkbk8r8gimwz3sgzxsbv7sxwmk3ll3sl2zrk",
-    "vendorSha256": "1d4c8cg4a81mndrzwrsi1k9ll553csnb0r4avlq9hyc03z60dwdc",
-    "version": "0.6.0"
+    "rev": "v0.7.0",
+    "sha256": "09rxgq4m28nhwg6y51m5sq3d12lx7r1q3k76zrd5gpbxagqhvhkr",
+    "vendorSha256": "1cpwa8a3p6mixdgvbgim1pnhvqh72sask950w2bxsgrpgdbnys5m",
+    "version": "0.7.0"
   },
   "shell": {
     "owner": "scottwinkler",
diff --git a/pkgs/applications/networking/cluster/terraform-providers/update-provider b/pkgs/applications/networking/cluster/terraform-providers/update-provider
index 47206914f7a9..0cbb855da200 100755
--- a/pkgs/applications/networking/cluster/terraform-providers/update-provider
+++ b/pkgs/applications/networking/cluster/terraform-providers/update-provider
@@ -149,7 +149,7 @@ if [[ -z ${vendorSha256} ]]; then
     vendorSha256=null
   elif [[ -n ${old_vendor_sha256} || ${vendor} == 1 ]]; then
     echo "=== Calculating vendorSha256 ==="
-    vendorSha256=$(nix-prefetch "{ sha256 }: (import ../../../../.. {}).terraform-providers.${provider_name}.go-modules.overrideAttrs (_: { vendorSha256 = sha256; })")
+    vendorSha256=$(nix-prefetch -I nixpkgs=../../../../.. "{ sha256 }: (import ../../../../.. {}).terraform-providers.${provider_name}.go-modules.overrideAttrs (_: { vendorSha256 = sha256; })")
     # Deal with nix unstable
     if [[ ${vendorSha256} == sha256-* ]]; then
       vendorSha256=$(nix --extra-experimental-features nix-command hash to-base32 "${vendorSha256}")
diff --git a/pkgs/applications/video/plex-mpv-shim/default.nix b/pkgs/applications/video/plex-mpv-shim/default.nix
index b82b7fd2436d..f5678276004e 100644
--- a/pkgs/applications/video/plex-mpv-shim/default.nix
+++ b/pkgs/applications/video/plex-mpv-shim/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonApplication rec {
   pname = "plex-mpv-shim";
-  version = "1.10.1";
+  version = "1.10.3";
 
   src = fetchFromGitHub {
     owner = "iwalton3";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1ql7idkm916f1wlkqxqmq1i2pc94gbgq6pvb8szhb21icyy5d1y0";
+    sha256 = "0hgv9g17dkrh3zbsx27n80yvkgix9j2x0rgg6d3qsf7hp5j3xw4r";
   };
 
   propagatedBuildInputs = [ mpv requests python-mpv-jsonipc ];
diff --git a/pkgs/desktops/enlightenment/enlightenment/default.nix b/pkgs/desktops/enlightenment/enlightenment/default.nix
index d00f57f77159..3c2dc7f33165 100644
--- a/pkgs/desktops/enlightenment/enlightenment/default.nix
+++ b/pkgs/desktops/enlightenment/enlightenment/default.nix
@@ -21,11 +21,11 @@
 
 stdenv.mkDerivation rec {
   pname = "enlightenment";
-  version = "0.25.0";
+  version = "0.25.1";
 
   src = fetchurl {
     url = "http://download.enlightenment.org/rel/apps/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "01nzyvjy06043m01fdb1309xx3wxxg0s3hj9g9di7jjsxp774vkx";
+    sha256 = "0i1424vsc929h36hx04646pbrjiya6nc1nqr6s15xwvfv7imzw1c";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/lxqt/lxqt-config/default.nix b/pkgs/desktops/lxqt/lxqt-config/default.nix
index d46e8e05e09b..85fd5aa70343 100644
--- a/pkgs/desktops/lxqt/lxqt-config/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-config/default.nix
@@ -13,6 +13,7 @@
 , libkscreen
 , liblxqt
 , libqtxdg
+, xkeyboard_config
 , xorg
 , lxqtUpdateScript
 }:
@@ -57,6 +58,10 @@ mkDerivation rec {
     substituteInPlace lxqt-config-appearance/configothertoolkits.cpp \
       --replace 'QStringLiteral("gsettings' \
                 'QStringLiteral("${glib.bin}/bin/gsettings'
+
+    substituteInPlace lxqt-config-input/keyboardlayoutconfig.h \
+      --replace '/usr/share/X11/xkb/rules/base.lst' \
+                '${xkeyboard_config}/share/X11/xkb/rules/base.lst'
   '';
 
   passthru.updateScript = lxqtUpdateScript { inherit pname version src; };
diff --git a/pkgs/development/libraries/audio/roc-toolkit/default.nix b/pkgs/development/libraries/audio/roc-toolkit/default.nix
new file mode 100644
index 000000000000..b8790298e71e
--- /dev/null
+++ b/pkgs/development/libraries/audio/roc-toolkit/default.nix
@@ -0,0 +1,63 @@
+{ stdenv,
+  lib,
+  fetchFromGitHub,
+  sconsPackages,
+  ragel,
+  gengetopt,
+  pkg-config,
+  libuv,
+  openfecSupport ? true,
+  openfec,
+  libunwindSupport ? true,
+  libunwind,
+  pulseaudioSupport ? true,
+  libpulseaudio
+}:
+
+stdenv.mkDerivation rec {
+  pname = "roc-toolkit";
+  version = "0.1.5";
+
+  src = fetchFromGitHub {
+    owner = "roc-streaming";
+    repo = "roc-toolkit";
+    rev = "v${version}";
+    sha256 = "sha256:1pld340zfch4p3qaf5anrspq7vmxrgf9ddsdsq92pk49axaaz19w";
+  };
+
+  nativeBuildInputs = [
+    sconsPackages.scons_3_0_1
+    ragel
+    gengetopt
+    pkg-config
+  ];
+
+  buildInputs = [
+    libuv
+    libunwind
+    openfec
+    libpulseaudio
+  ];
+
+  sconsFlags =
+    [ "--disable-sox"
+      "--disable-tests" ] ++
+    lib.optional (!libunwindSupport) "--disable-libunwind" ++
+    lib.optional (!pulseaudioSupport) "--disable-pulseaudio" ++
+    (if (!openfecSupport)
+       then ["--disable-openfec"]
+       else [ "--with-libraries=${openfec}/lib"
+              "--with-openfec-includes=${openfec.dev}/include" ]);
+
+  preConfigure = ''
+    sconsFlags+=" --prefix=$out"
+  '';
+
+  meta = with lib; {
+    description = "Roc is a toolkit for real-time audio streaming over the network";
+    homepage = "https://github.com/roc-streaming/roc-toolkit";
+    license = licenses.mpl20;
+    maintainers = with maintainers; [ bgamari ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/development/libraries/openfec/default.nix b/pkgs/development/libraries/openfec/default.nix
new file mode 100644
index 000000000000..2a0588a71ebd
--- /dev/null
+++ b/pkgs/development/libraries/openfec/default.nix
@@ -0,0 +1,40 @@
+{ stdenv, lib, fetchzip, cmake }:
+
+stdenv.mkDerivation rec {
+  pname = "openfec";
+  version = "1.4.2";
+
+  src = fetchzip {
+    url = "http://openfec.org/files/openfec_v1_4_2.tgz";
+    sha256 = "sha256:0c2lg8afr7lqpzrsi0g44a6h6s7nq4vz7yc9vm2k57ph2y6r86la";
+  };
+
+  outputs = [ "out" "dev" ];
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  cmakeFlags = [ "-DDEBUG:STRING=OFF" ];
+
+  installPhase =
+    let so = stdenv.hostPlatform.extensions.sharedLibrary;
+    in ''
+      # This is pretty horrible but sadly there is not installation procedure
+      # provided.
+      mkdir -p $dev/include
+      cp -R ../src/* $dev/include
+      find $dev/include -type f -a ! -iname '*.h' -delete
+
+      install -D -m755 -t $out/lib ../bin/Release/libopenfec${so}
+      ln -s libopenfec${so} $out/lib/libopenfec${so}.1
+    '';
+
+  meta = with lib; {
+    description = "Application-level Forward Erasure Correction codes";
+    homepage = "https://github.com/roc-streaming/openfec";
+    license = licenses.cecill-c;
+    maintainers = with maintainers; [ bgamari ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index af5f238c9df7..c00e297b68af 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -54,6 +54,8 @@
 , libpulseaudio
 , zeroconfSupport ? true
 , avahi
+, rocSupport ? true
+, roc-toolkit
 }:
 
 let
@@ -134,7 +136,8 @@ let
     ++ lib.optional ffmpegSupport ffmpeg
     ++ lib.optionals bluezSupport [ bluez libfreeaptx ldacbt sbc fdk_aac ]
     ++ lib.optional pulseTunnelSupport libpulseaudio
-    ++ lib.optional zeroconfSupport avahi;
+    ++ lib.optional zeroconfSupport avahi
+    ++ lib.optional rocSupport roc-toolkit;
 
     # Valgrind binary is required for running one optional test.
     checkInputs = lib.optional withValgrind valgrind;
@@ -147,7 +150,7 @@ let
       "-Dpipewire_pulse_prefix=${placeholder "pulse"}"
       "-Dlibjack-path=${placeholder "jack"}/lib"
       "-Dlibcamera=${mesonEnable libcameraSupport}"
-      "-Droc=disabled"
+      "-Droc=${mesonEnable rocSupport}"
       "-Dlibpulse=${mesonEnable pulseTunnelSupport}"
       "-Davahi=${mesonEnable zeroconfSupport}"
       "-Dgstreamer=${mesonEnable gstreamerSupport}"
diff --git a/pkgs/development/python-modules/gphoto2/default.nix b/pkgs/development/python-modules/gphoto2/default.nix
index ddc638b55cb3..b239dfc6e998 100644
--- a/pkgs/development/python-modules/gphoto2/default.nix
+++ b/pkgs/development/python-modules/gphoto2/default.nix
@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "gphoto2";
-  version = "2.3.0";
+  version = "2.3.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a208264ed252a39b29a0b0f7ccc4c4ffb941398715aec84c3a547281a43c4eb8";
+    sha256 = "5affd12421ba75f4c04f5678aef62f78aae2a7ae74aa23614c6f3799d2784b28";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/development/python-modules/graphql-core/default.nix b/pkgs/development/python-modules/graphql-core/default.nix
index 8906af53ce19..6a33cfd7b352 100644
--- a/pkgs/development/python-modules/graphql-core/default.nix
+++ b/pkgs/development/python-modules/graphql-core/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "graphql-core";
-  version = "3.1.6";
+  version = "3.1.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "graphql-python";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1ip0yrqmnqncgpwvba18x020gkwr7csiw4zdy6mrdnvwf5qyam4x";
+    sha256 = "1mwwh55qd5bcpvgy6pyliwn8jkmj4yk4d2pqb6mdkgqhdic2081l";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/intensity-normalization/default.nix b/pkgs/development/python-modules/intensity-normalization/default.nix
index 806153288216..ec16470ef11d 100644
--- a/pkgs/development/python-modules/intensity-normalization/default.nix
+++ b/pkgs/development/python-modules/intensity-normalization/default.nix
@@ -15,12 +15,12 @@
 
 buildPythonPackage rec {
   pname = "intensity-normalization";
-  version = "2.1.1";
+  version = "2.1.2";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-aGuGdUqaUgoD95PLFch+lF9o7eeKwK0bNWTF1beslIY=";
+    sha256 = "sha256-92STD5sOc9TLf3Ooaoi3afWkXiGjVgUUFvSVTeP8MaA=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/jc/default.nix b/pkgs/development/python-modules/jc/default.nix
index 1a4ce8f7498a..9546225dabca 100644
--- a/pkgs/development/python-modules/jc/default.nix
+++ b/pkgs/development/python-modules/jc/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "jc";
-  version = "1.17.5";
+  version = "1.17.6";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "kellyjonbrazil";
     repo = pname;
     rev = "v${version}";
-    sha256 = "004773a1wsip1gnqvas78k0snv7yq83qv1spir891sz4mmg7fyin";
+    sha256 = "sha256-JWipvhMsVI/AX7Pj4iHJh5GIgfwGLc7s1hZZJnsYGIw=";
   };
 
   propagatedBuildInputs = [ ruamel-yaml xmltodict pygments ];
diff --git a/pkgs/development/python-modules/trimesh/default.nix b/pkgs/development/python-modules/trimesh/default.nix
index e2ccb99da682..3c2abb8e1445 100644
--- a/pkgs/development/python-modules/trimesh/default.nix
+++ b/pkgs/development/python-modules/trimesh/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "trimesh";
-  version = "3.9.36";
+  version = "3.9.39";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f01e8edab14d1999700c980c21a1546f37417216ad915a53be649d263130181e";
+    sha256 = "2fe246ff69267a1e8cdfcf962d4eddad5d748f744e4095c94711b68da73e29d2";
   };
 
   propagatedBuildInputs = [ numpy ];
diff --git a/pkgs/development/python-modules/types-protobuf/default.nix b/pkgs/development/python-modules/types-protobuf/default.nix
index 382bd3111741..398f71a4c4c5 100644
--- a/pkgs/development/python-modules/types-protobuf/default.nix
+++ b/pkgs/development/python-modules/types-protobuf/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "types-protobuf";
-  version = "3.18.2";
+  version = "3.18.3";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-yiHe3+d1msvrDNj1xyp0/zxAmuDAe8HZTv9RI6wPojw=";
+    sha256 = "d3e253ebc1ba5e78932fef703dc4316afb7e5facd0ce8661b3921c9d541e16a7";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/misc/drivers/utsushi/default.nix b/pkgs/misc/drivers/utsushi/default.nix
index dcb04f5ce578..b802431d4e0e 100644
--- a/pkgs/misc/drivers/utsushi/default.nix
+++ b/pkgs/misc/drivers/utsushi/default.nix
@@ -33,6 +33,10 @@ in stdenv.mkDerivation rec {
       url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/media-gfx/iscan/files/iscan-3.61.0-imagemagick-7.patch?id=985c92af4730d864e86fa87746185b0246e9db93";
       sha256 = "sha256-dfdVMp3ZfclYeRxYjMIvl+ZdlLn9S+IwQ+OmlHW8318=";
     })
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/archlinux/svntogit-community/b3046e0e78b95440f135fcadb19a9eb531729a58/trunk/boost-1.74.patch";
+      sha256 = "sha256-W8R1l7ZPcsfiIy1QBJvh0M8du0w1cnTg3PyAz65v4rE=";
+    })
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/gfshare/default.nix b/pkgs/tools/security/gfshare/default.nix
index 3079c7fb57f2..e0da2fdaf35b 100644
--- a/pkgs/tools/security/gfshare/default.nix
+++ b/pkgs/tools/security/gfshare/default.nix
@@ -24,5 +24,6 @@ stdenv.mkDerivation rec {
     license = licenses.mit;
     platforms = platforms.all;
     maintainers = [ maintainers.rraval ];
+    broken = stdenv.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/trunk/gfshare.x86_64-darwin
   };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 433f70196a9c..ec38b74b5c1c 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8370,6 +8370,8 @@ with pkgs;
     opendylan-bootstrap = opendylan_bin;
   };
 
+  openfec = callPackage ../development/libraries/openfec { };
+
   ophis = python3Packages.callPackage ../development/compilers/ophis { };
 
   opendylan_bin = callPackage ../development/compilers/opendylan/bin.nix { };
@@ -9307,6 +9309,8 @@ with pkgs;
 
   rmtrash = callPackage ../tools/misc/rmtrash { };
 
+  roc-toolkit = callPackage ../development/libraries/audio/roc-toolkit { };
+
   rockbox_utility = libsForQt5.callPackage ../tools/misc/rockbox-utility { };
 
   rosegarden = libsForQt514.callPackage ../applications/audio/rosegarden { };