diff --git a/nixos/lib/test-driver/test_driver/driver.py b/nixos/lib/test-driver/test_driver/driver.py
index ea6ba4b65b56..835d60ec3b4f 100644
--- a/nixos/lib/test-driver/test_driver/driver.py
+++ b/nixos/lib/test-driver/test_driver/driver.py
@@ -163,11 +163,6 @@ class Driver:
                 machine.wait_for_shutdown()
 
     def create_machine(self, args: Dict[str, Any]) -> Machine:
-        rootlog.warning(
-            "Using legacy create_machine(), please instantiate the"
-            "Machine class directly, instead"
-        )
-
         tmp_dir = get_tmp_dir()
 
         if args.get("startCommand"):
diff --git a/nixos/lib/test-driver/test_driver/machine.py b/nixos/lib/test-driver/test_driver/machine.py
index a362e99f98ed..1a97cedb2e81 100644
--- a/nixos/lib/test-driver/test_driver/machine.py
+++ b/nixos/lib/test-driver/test_driver/machine.py
@@ -369,8 +369,8 @@ class Machine:
     @staticmethod
     def create_startcommand(args: Dict[str, str]) -> StartCommand:
         rootlog.warning(
-            "Using legacy create_startcommand(),"
-            "please use proper nix test vm instrumentation, instead"
+            "Using legacy create_startcommand(), "
+            "please use proper nix test vm instrumentation, instead "
             "to generate the appropriate nixos test vm qemu startup script"
         )
         hda = None
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index a25e28775e48..0efc948f402e 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -911,6 +911,7 @@
   ./services/networking/knot.nix
   ./services/networking/kresd.nix
   ./services/networking/lambdabot.nix
+  ./services/networking/legit.nix
   ./services/networking/libreswan.nix
   ./services/networking/lldpd.nix
   ./services/networking/logmein-hamachi.nix
diff --git a/nixos/modules/services/networking/legit.nix b/nixos/modules/services/networking/legit.nix
new file mode 100644
index 000000000000..90234f3955e8
--- /dev/null
+++ b/nixos/modules/services/networking/legit.nix
@@ -0,0 +1,182 @@
+{ config, lib, pkgs, ... }:
+
+let
+  inherit (lib)
+    literalExpression
+    mkEnableOption
+    mdDoc
+    mkIf
+    mkOption
+    mkPackageOptionMD
+    optionalAttrs
+    optional
+    types;
+
+  cfg = config.services.legit;
+
+  yaml = pkgs.formats.yaml { };
+  configFile = yaml.generate "legit.yaml" cfg.settings;
+
+  defaultStateDir = "/var/lib/legit";
+  defaultStaticDir = "${cfg.settings.repo.scanPath}/static";
+  defaultTemplatesDir = "${cfg.settings.repo.scanPath}/templates";
+in
+{
+  options.services.legit = {
+    enable = mkEnableOption (mdDoc "legit git web frontend");
+
+    package = mkPackageOptionMD pkgs "legit-web" { };
+
+    user = mkOption {
+      type = types.str;
+      default = "legit";
+      description = mdDoc "User account under which legit runs.";
+    };
+
+    group = mkOption {
+      type = types.str;
+      default = "legit";
+      description = mdDoc "Group account under which legit runs.";
+    };
+
+    settings = mkOption {
+      default = { };
+      description = mdDoc ''
+        The primary legit configuration. See the
+        [sample configuration](https://github.com/icyphox/legit/blob/master/config.yaml)
+        for possible values.
+      '';
+      type = types.submodule {
+        options.repo = {
+          scanPath = mkOption {
+            type = types.path;
+            default = defaultStateDir;
+            description = mdDoc "Directory where legit will scan for repositories.";
+          };
+          readme = mkOption {
+            type = types.listOf types.str;
+            default = [ ];
+            description = mdDoc "Readme files to look for.";
+          };
+          mainBranch = mkOption {
+            type = types.listOf types.str;
+            default = [ "main" "master" ];
+            description = mdDoc "Main branch to look for.";
+          };
+          ignore = mkOption {
+            type = types.listOf types.str;
+            default = [ ];
+            description = mdDoc "Repositories to ignore.";
+          };
+        };
+        options.dirs = {
+          templates = mkOption {
+            type = types.path;
+            default = "${pkgs.legit-web}/lib/legit/templates";
+            defaultText = literalExpression ''"''${pkgs.legit-web}/lib/legit/templates"'';
+            description = mdDoc "Directories where template files are located.";
+          };
+          static = mkOption {
+            type = types.path;
+            default = "${pkgs.legit-web}/lib/legit/static";
+            defaultText = literalExpression ''"''${pkgs.legit-web}/lib/legit/static"'';
+            description = mdDoc "Directories where static files are located.";
+          };
+        };
+        options.meta = {
+          title = mkOption {
+            type = types.str;
+            default = "legit";
+            description = mdDoc "Website title.";
+          };
+          description = mkOption {
+            type = types.str;
+            default = "git frontend";
+            description = mdDoc "Website description.";
+          };
+        };
+        options.server = {
+          name = mkOption {
+            type = types.str;
+            default = "localhost";
+            description = mdDoc "Server name.";
+          };
+          host = mkOption {
+            type = types.str;
+            default = "127.0.0.1";
+            description = mdDoc "Host address.";
+          };
+          port = mkOption {
+            type = types.port;
+            default = 5555;
+            description = mdDoc "Legit port.";
+          };
+        };
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    users.groups = optionalAttrs (cfg.group == "legit") {
+      "${cfg.group}" = { };
+    };
+
+    users.users = optionalAttrs (cfg.user == "legit") {
+      "${cfg.user}" = {
+        group = cfg.group;
+        isSystemUser = true;
+      };
+    };
+
+    systemd.services.legit = {
+      description = "legit git frontend";
+
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      restartTriggers = [ configFile ];
+
+      serviceConfig = {
+        Type = "simple";
+        User = cfg.user;
+        Group = cfg.group;
+        ExecStart = "${cfg.package}/bin/legit -config ${configFile}";
+        Restart = "always";
+
+        WorkingDirectory = cfg.settings.repo.scanPath;
+        StateDirectory = [ ] ++
+          optional (cfg.settings.repo.scanPath == defaultStateDir) "legit" ++
+          optional (cfg.settings.dirs.static == defaultStaticDir) "legit/static" ++
+          optional (cfg.settings.dirs.templates == defaultTemplatesDir) "legit/templates";
+
+        # Hardening
+        CapabilityBoundingSet = [ "" ];
+        DeviceAllow = [ "" ];
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        ReadWritePaths = cfg.settings.repo.scanPath;
+        RemoveIPC = true;
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [ "@system-service" "~@privileged" ];
+        UMask = "0077";
+      };
+    };
+  };
+}
diff --git a/nixos/modules/system/boot/networkd.nix b/nixos/modules/system/boot/networkd.nix
index 07f51f43184d..463e2b8d90b0 100644
--- a/nixos/modules/system/boot/networkd.nix
+++ b/nixos/modules/system/boot/networkd.nix
@@ -25,9 +25,11 @@ let
 
       sectionDHCPv4 = checkUnitConfig "DHCPv4" [
         (assertOnlyFields [
+          "ClientIdentifier"
           "DUIDType"
           "DUIDRawData"
         ])
+        (assertValueOneOf "ClientIdentifier" ["mac" "duid" "duid-only"])
       ];
 
       sectionDHCPv6 = checkUnitConfig "DHCPv6" [
diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix
index a8ac478aab4c..388ba8168456 100644
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@@ -893,7 +893,13 @@ in
                   The address must be in the default VLAN (10.0.2.0/24).
               '';
           }
-        ]));
+        ])) ++ [
+          { assertion = pkgs.stdenv.hostPlatform.is32bit -> cfg.memorySize < 2047;
+            message = ''
+              virtualisation.memorySize is above 2047, but qemu is only able to allocate 2047MB RAM on 32bit max.
+            '';
+          }
+        ];
 
     warnings =
       optional (
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 49a7db012a17..abe281a204b4 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -278,6 +278,7 @@ in {
   fsck = handleTest ./fsck.nix {};
   fsck-systemd-stage-1 = handleTest ./fsck.nix { systemdStage1 = true; };
   ft2-clone = handleTest ./ft2-clone.nix {};
+  legit = handleTest ./legit.nix {};
   mimir = handleTest ./mimir.nix {};
   garage = handleTest ./garage {};
   gemstash = handleTest ./gemstash.nix {};
diff --git a/nixos/tests/legit.nix b/nixos/tests/legit.nix
new file mode 100644
index 000000000000..3eb3f5035699
--- /dev/null
+++ b/nixos/tests/legit.nix
@@ -0,0 +1,54 @@
+import ./make-test-python.nix ({ lib, pkgs, ... }:
+let
+  port = 5000;
+  scanPath = "/var/lib/legit";
+in
+{
+  name = "legit-web";
+  meta.maintainers = [ lib.maintainers.ratsclub ];
+
+  nodes = {
+    server = { config, pkgs }: {
+      services.legit = {
+        enable = true;
+        settings = {
+          server.port = 5000;
+          repo = { inherit scanPath; };
+        };
+      };
+
+      environment.systemPackages = [ pkgs.git ];
+    };
+  };
+
+  testScript = { nodes, ... }:
+    let
+      strPort = builtins.toString port;
+    in
+    ''
+      start_all()
+
+      server.wait_for_unit("network.target")
+      server.wait_for_unit("legit.service")
+
+      server.wait_until_succeeds(
+          "curl -f http://localhost:${strPort}"
+      )
+
+      server.succeed("${pkgs.writeShellScript "setup-legit-test-repo" ''
+        set -e
+        git init --bare -b master ${scanPath}/some-repo
+        git init -b master reference
+        cd reference
+        git remote add origin ${scanPath}/some-repo
+        date > date.txt
+        git add date.txt
+        git -c user.name=test -c user.email=test@localhost commit -m 'add date'
+        git push -u origin master
+      ''}")
+
+      server.wait_until_succeeds(
+          "curl -f http://localhost:${strPort}/some-repo"
+      )
+    '';
+})
diff --git a/pkgs/applications/editors/jetbrains/linux.nix b/pkgs/applications/editors/jetbrains/linux.nix
index 7443842e7bf9..117a261e957f 100644
--- a/pkgs/applications/editors/jetbrains/linux.nix
+++ b/pkgs/applications/editors/jetbrains/linux.nix
@@ -1,6 +1,6 @@
 { stdenv, lib, makeDesktopItem, makeWrapper, patchelf, writeText
 , coreutils, gnugrep, which, git, unzip, libsecret, libnotify, e2fsprogs
-, vmopts ? null
+, python3, vmopts ? null
 }:
 
 { pname, product, productShort ? product, version, src, wmClass, jdk, meta, extraLdPath ? [], extraWrapperArgs ? [] }@args:
@@ -71,7 +71,7 @@ with stdenv; lib.makeOverridable mkDerivation (rec {
     item=${desktopItem}
 
     makeWrapper "$out/$pname/bin/${loName}.sh" "$out/bin/${pname}" \
-      --prefix PATH : "$out/libexec/${pname}:${lib.makeBinPath [ jdk coreutils gnugrep which git ]}" \
+      --prefix PATH : "$out/libexec/${pname}:${lib.makeBinPath [ jdk coreutils gnugrep which git python3 ]}" \
       --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath ([
         # Some internals want libstdc++.so.6
         stdenv.cc.cc.lib libsecret e2fsprogs
diff --git a/pkgs/applications/graphics/gnome-decoder/default.nix b/pkgs/applications/graphics/gnome-decoder/default.nix
index 473d66d9c8b8..a7e895fb4b6b 100644
--- a/pkgs/applications/graphics/gnome-decoder/default.nix
+++ b/pkgs/applications/graphics/gnome-decoder/default.nix
@@ -1,7 +1,6 @@
 { lib
 , clangStdenv
 , fetchFromGitLab
-, libclang
 , rustPlatform
 , cargo
 , meson
@@ -50,6 +49,7 @@ clangStdenv.mkDerivation rec {
     desktop-file-utils
     cargo
     rustc
+    rustPlatform.bindgenHook
     rustPlatform.cargoSetupHook
   ];
 
@@ -66,8 +66,6 @@ clangStdenv.mkDerivation rec {
     gst-plugins-bad
   ];
 
-  LIBCLANG_PATH = "${libclang.lib}/lib";
-
   meta = with lib; {
     description = "Scan and Generate QR Codes";
     homepage = "https://gitlab.gnome.org/World/decoder";
diff --git a/pkgs/applications/misc/cubiomes-viewer/default.nix b/pkgs/applications/misc/cubiomes-viewer/default.nix
index 3b2473795088..4cc4b9107581 100644
--- a/pkgs/applications/misc/cubiomes-viewer/default.nix
+++ b/pkgs/applications/misc/cubiomes-viewer/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cubiomes-viewer";
-  version = "3.2.1";
+  version = "3.3.0";
 
   src = fetchFromGitHub {
     owner = "Cubitect";
     repo = pname;
     rev = version;
-    sha256 = "sha256-67augXXZsriXdndrCFUFWZbL+rVKgTPAyqlbZua2Ul4=";
+    sha256 = "sha256-V6zPbL1/tP2B38wo4a05+vXCSjPE1YKpMR3zl/BbnY8=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/misc/scli/default.nix b/pkgs/applications/misc/scli/default.nix
index d300691934b2..4da57993fb87 100644
--- a/pkgs/applications/misc/scli/default.nix
+++ b/pkgs/applications/misc/scli/default.nix
@@ -4,6 +4,8 @@
 , dbus
 , signal-cli
 , xclip
+, testers
+, scli
 }:
 
 python3.pkgs.buildPythonApplication rec {
@@ -26,24 +28,27 @@ python3.pkgs.buildPythonApplication rec {
 
   dontBuild = true;
 
-  checkPhase = ''
-    # scli attempts to write to these directories, make sure they're writeable
-    export XDG_DATA_HOME=$(mktemp -d)
-    export XDG_CONFIG_HOME=$(mktemp -d)
-    ./scli --help > /dev/null # don't spam nix-build log
-    test $? == 0
-  '';
-
   installPhase = ''
-    mkdir -p $out/bin
+    runHook preInstall
+
     patchShebangs scli
-    install -m755 -D scli $out/bin/scli
+    install -Dm555 scli -t $out/bin
+    echo "v$version" > $out/bin/VERSION
+
+    runHook postInstall
   '';
 
   makeWrapperArgs = [
     "--prefix" "PATH" ":" (lib.makeBinPath [ dbus signal-cli xclip ])
   ];
 
+  passthru.tests = {
+    version = testers.testVersion {
+      package = scli;
+      command = "HOME=$(mktemp -d) scli --version";
+    };
+  };
+
   meta = with lib; {
     description = "Simple terminal user interface for Signal";
     homepage = "https://github.com/isamert/scli";
diff --git a/pkgs/applications/misc/snapmaker-luban/default.nix b/pkgs/applications/misc/snapmaker-luban/default.nix
index 615cf28103ae..8f2437e9de2a 100644
--- a/pkgs/applications/misc/snapmaker-luban/default.nix
+++ b/pkgs/applications/misc/snapmaker-luban/default.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "snapmaker-luban";
-  version = "4.7.3";
+  version = "4.8.0";
 
   src = fetchurl {
     url = "https://github.com/Snapmaker/Luban/releases/download/v${version}/snapmaker-luban-${version}-linux-x64.tar.gz";
-    sha256 = "sha256-CPeTTnwykaa58tpA7Aznrvrs0DqxOKjspZjHrT+e9tw=";
+    sha256 = "sha256-uY8MlLIZrbds5/QdYZFTLSSis0BwRU19XfLiBX+2VCY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/cluster/argo-rollouts/default.nix b/pkgs/applications/networking/cluster/argo-rollouts/default.nix
index c10391c5bfc5..4c5a1b211303 100644
--- a/pkgs/applications/networking/cluster/argo-rollouts/default.nix
+++ b/pkgs/applications/networking/cluster/argo-rollouts/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "argo-rollouts";
-  version = "1.5.0";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo-rollouts";
     rev = "v${version}";
-    sha256 = "sha256-bOGC4RAeydPCvqyQZE+K0N01xRIGsoiwKJ4lMwVVgGk=";
+    sha256 = "sha256-ODcT7dc4xBHOKYTP2pUTq2z3GMUEpZ9OUKKxlbd+Vvk=";
   };
 
   vendorHash = "sha256-IxSLlRsOz/Xamguxm+7jy8qAAEZZFm/NHDIBjm5tnCs=";
diff --git a/pkgs/applications/networking/cluster/kaniko/default.nix b/pkgs/applications/networking/cluster/kaniko/default.nix
index 923d07af1b1f..1dd2e9649fae 100644
--- a/pkgs/applications/networking/cluster/kaniko/default.nix
+++ b/pkgs/applications/networking/cluster/kaniko/default.nix
@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "kaniko";
-  version = "1.9.2";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "GoogleContainerTools";
     repo = "kaniko";
     rev = "v${version}";
-    hash = "sha256-dXQ0/o1qISv+sjNVIpfF85bkbM9sGOGwqVbWZpMWfMY=";
+    hash = "sha256-SPHayFfYFpg1AOoe003xh7NGQLpvhd1C2k4IilgMqSw=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/networking/instant-messengers/signal-cli/default.nix b/pkgs/applications/networking/instant-messengers/signal-cli/default.nix
index eeac2cfc5bb8..7137b62502b8 100644
--- a/pkgs/applications/networking/instant-messengers/signal-cli/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-cli/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "signal-cli";
-  version = "0.11.10";
+  version = "0.11.11";
 
   # Building from source would be preferred, but is much more involved.
   src = fetchurl {
     url = "https://github.com/AsamK/signal-cli/releases/download/v${version}/signal-cli-${version}-Linux.tar.gz";
-    hash = "sha256-8iWUhneAialoEn3igxxTGJBmopbZHHqkvtJPZEESWM0=";
+    hash = "sha256-IKKWJBe6A3TVWIRTDyWbfRYMwgRNhSqSJK0ZRZNCVkA=";
   };
 
   buildInputs = lib.optionals stdenv.isLinux [ libmatthew_java dbus dbus_java ];
diff --git a/pkgs/applications/science/logic/sharpsat-td/default.nix b/pkgs/applications/science/logic/sharpsat-td/default.nix
new file mode 100644
index 000000000000..de9e212d8cc8
--- /dev/null
+++ b/pkgs/applications/science/logic/sharpsat-td/default.nix
@@ -0,0 +1,64 @@
+{ lib, stdenv, fetchFromGitHub, fetchzip, cmake, gmp, mpfr }:
+
+let
+  satlib-bmc = fetchzip {
+    url = "https://www.cs.ubc.ca/~hoos/SATLIB/Benchmarks/SAT/BMC/bmc.tar.gz";
+    stripRoot = false;
+    sha256 = "sha256-F1Jfrj4iMMf/3LFCShIDMs4JfLkJ51Z4wkL1FDT9b/A=";
+  };
+
+in stdenv.mkDerivation rec {
+  pname = "sharpsat-td";
+  version = "unstable-2021-09-05";
+
+  src = fetchFromGitHub {
+    owner = "Laakeri";
+    repo = pname;
+    rev = "b9bb015305ea5d4e1ac7141691d0fe55ca983d31";
+    sha256 = "sha256-FE+DUd58eRr5w9RFw0fMHfjIiNDWIcG7XbyWJ/pI28U=";
+  };
+
+  postPatch = ''
+    # just say no to bundled binaries
+    rm bin/*
+
+    # ensure resultant build calls its own binaries
+    substituteInPlace src/decomposition.cpp \
+      --replace '"../../../flow-cutter-pace17/flow_cutter_pace17"' '"'"$out"'/bin/flow_cutter_pace17"'
+    substituteInPlace src/preprocessor/treewidth.cpp \
+      --replace '"./flow_cutter_pace17"' '"'"$out"'/bin/flow_cutter_pace17"'
+  '';
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ gmp mpfr ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    install -Dm755 sharpSAT $out/bin/sharpSAT-td
+    install -Dm755 flow_cutter_pace17 $out/bin/flow_cutter_pace17
+
+    runHook postInstall
+  '';
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    # "correct" answer from https://sites.google.com/site/marcthurley/sharpsat/benchmarks/collected-model-counts
+    $out/bin/sharpSAT-td -decot 1 -decow 100 -cs 3500 -tmpdir "$TMPDIR" \
+      ${satlib-bmc}/bmc-ibm-1.cnf | grep -F 'c s exact arb int 7333984412904350856728851870196181665291102236046537207120878033973328441091390427157620940515935993557837912658856672133150412904529478729364681871717139154252602322050981277183916105207406949425074710972297902317183503443350157267211568852295978718386711142950559533715161449971311118966214098944000'
+
+    runHook postInstallCheck
+  '';
+
+  meta = {
+    description = "A fast solver for the #SAT model counting problem";
+    homepage = "https://github.com/Laakeri/sharpsat-td";
+    license = with lib.licenses; [ mit asl20 ];
+    maintainers = with lib.maintainers; [ ris ];
+    # uses clhash, which is non-portable
+    platforms = [ "x86_64-linux" "x86_64-darwin" ];
+  };
+}
diff --git a/pkgs/applications/version-management/legit-web/default.nix b/pkgs/applications/version-management/legit-web/default.nix
new file mode 100644
index 000000000000..72de9d90c3e8
--- /dev/null
+++ b/pkgs/applications/version-management/legit-web/default.nix
@@ -0,0 +1,33 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "legit";
+  version = "0.2.1";
+
+  src = fetchFromGitHub {
+    repo = "legit";
+    owner = "icyphox";
+    rev = "v${version}";
+    hash = "sha256-Y0lfbe4xBCj80z07mLFIiX+shvntYAHiW2Uw7h94jrE=";
+  };
+
+  vendorHash = "sha256-RAUSYCtP4rcJ2zIBXfPAEZWD1VSfr3d4MrmUMiPpjK8=";
+
+  postInstall = ''
+    mkdir -p $out/lib/legit/templates
+    mkdir -p $out/lib/legit/static
+
+    cp -r $src/templates/* $out/lib/legit/templates
+    cp -r $src/static/* $out/lib/legit/static
+  '';
+
+  meta = {
+    description = "Web frontend for git";
+    homepage = "https://github.com/icyphox/legit";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.ratsclub ];
+  };
+}
diff --git a/pkgs/applications/virtualization/flintlock/default.nix b/pkgs/applications/virtualization/flintlock/default.nix
index 982530dad749..21413fde6e1b 100644
--- a/pkgs/applications/virtualization/flintlock/default.nix
+++ b/pkgs/applications/virtualization/flintlock/default.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec{
   pname = "flintlock";
-  version = "0.4.0";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = "flintlock";
     rev = "v${version}";
-    sha256 = "sha256-kHrVpQ4E8b1YV+ofZwd4iGJ9ucVUUam6rxdpOGmvRR4=";
+    sha256 = "sha256-jZi58mewQ2hlH/9H4iAF4Mvf9UK4F7sUR0xcCEaLzX0=";
   };
 
-  vendorSha256 = "sha256-A3LrikB2KrnSI+OREiLmlkTFpRKQWRB8w4OJ6ApX7oY=";
+  vendorHash = "sha256-IGfNMe1fQfAGAOVsxmn/oxleHfniqL1TJKllCwpuWOU=";
 
   subPackages = [ "cmd/flintlock-metrics" "cmd/flintlockd" ];
 
diff --git a/pkgs/applications/window-managers/weston/default.nix b/pkgs/applications/window-managers/weston/default.nix
index 13dd27e93865..86b9a84267cc 100644
--- a/pkgs/applications/window-managers/weston/default.nix
+++ b/pkgs/applications/window-managers/weston/default.nix
@@ -1,47 +1,58 @@
 { lib, stdenv, fetchurl
 , meson, ninja, pkg-config, python3, wayland-scanner
-, cairo, colord, dbus, lcms2, libGL, libXcursor, libdrm, libevdev, libinput
-, libjpeg, seatd, libxcb, libxkbcommon, mesa, mtdev, pam, udev, wayland
-, wayland-protocols
-, pipewire ? null, pango ? null, libunwind ? null, freerdp ? null, vaapi ? null
-, libva ? null, libwebp ? null, xwayland ? null
-# beware of null defaults, as the parameters *are* supplied by callPackage by default
-, buildDemo ? true
-, buildRemoting ? true, gst_all_1
+, cairo, dbus, lcms2, libdrm, libevdev, libinput, libjpeg, libxkbcommon, mesa
+, seatd, wayland, wayland-protocols, xcbutilcursor
+
+, demoSupport ? true
+, hdrSupport ? true, libdisplay-info
+, pangoSupport ? true, pango
+, pipewireSupport ? true, pipewire
+, rdpSupport ? true, freerdp
+, remotingSupport ? true, gst_all_1
+, vaapiSupport ? true, libva
+, vncSupport ? true, aml, neatvnc, pam
+, webpSupport ? true, libwebp
+, xwaylandSupport ? true, libXcursor, xwayland
 }:
 
 stdenv.mkDerivation rec {
   pname = "weston";
-  version = "11.0.2";
+  version = "12.0.1";
 
   src = fetchurl {
     url = "https://gitlab.freedesktop.org/wayland/weston/-/releases/${version}/downloads/weston-${version}.tar.xz";
-    hash = "sha256-ckB1LO8LfeYiuvi9U0jmP8axnwLvgklhsq3Rd9llKVI=";
+    hash = "sha256-sYWR6rJ4vBkXIPbAkVgEC3lecRivHV3cpqzZqOIDlTU=";
   };
 
   depsBuildBuild = [ pkg-config ];
   nativeBuildInputs = [ meson ninja pkg-config python3 wayland-scanner ];
   buildInputs = [
-    cairo colord dbus freerdp lcms2 libGL libXcursor libdrm libevdev libinput
-    libjpeg seatd libunwind libva libwebp libxcb libxkbcommon mesa mtdev pam
-    pango pipewire udev vaapi wayland wayland-protocols
-  ] ++ lib.optionals buildRemoting [
-    gst_all_1.gstreamer
-    gst_all_1.gst-plugins-base
-  ];
+    cairo lcms2 libdrm libevdev libinput libjpeg libxkbcommon mesa seatd
+    wayland wayland-protocols
+  ] ++ lib.optional hdrSupport libdisplay-info
+    ++ lib.optional pangoSupport pango
+    ++ lib.optional pipewireSupport pipewire
+    ++ lib.optional rdpSupport freerdp
+    ++ lib.optionals remotingSupport [ gst_all_1.gstreamer gst_all_1.gst-plugins-base ]
+    ++ lib.optional vaapiSupport libva
+    ++ lib.optionals vncSupport [ aml neatvnc pam ]
+    ++ lib.optional webpSupport libwebp
+    ++ lib.optionals xwaylandSupport [ libXcursor xcbutilcursor xwayland ];
 
   mesonFlags= [
-    "-Dbackend-drm-screencast-vaapi=${lib.boolToString (vaapi != null)}"
-    "-Dbackend-rdp=${lib.boolToString (freerdp != null)}"
-    "-Dxwayland=${lib.boolToString (xwayland != null)}" # Default is true!
-    (lib.mesonBool "remoting" buildRemoting)
-    "-Dpipewire=${lib.boolToString (pipewire != null)}"
-    "-Dimage-webp=${lib.boolToString (libwebp != null)}"
-    (lib.mesonBool "demo-clients" buildDemo)
-    "-Dsimple-clients="
-    "-Dtest-junit-xml=false"
-  ] ++ lib.optionals (xwayland != null) [
-    "-Dxwayland-path=${xwayland.out}/bin/Xwayland"
+    (lib.mesonBool "backend-drm-screencast-vaapi" vaapiSupport)
+    (lib.mesonBool "backend-pipewire" pipewireSupport)
+    (lib.mesonBool "backend-rdp" rdpSupport)
+    (lib.mesonBool "backend-vnc" vncSupport)
+    (lib.mesonBool "demo-clients" demoSupport)
+    (lib.mesonBool "image-webp" webpSupport)
+    (lib.mesonBool "pipewire" pipewireSupport)
+    (lib.mesonBool "remoting" remotingSupport)
+    (lib.mesonOption "simple-clients" "")
+    (lib.mesonBool "test-junit-xml" false)
+    (lib.mesonBool "xwayland" xwaylandSupport)
+  ] ++ lib.optionals xwaylandSupport [
+    (lib.mesonOption "xwayland-path" (lib.getExe xwayland))
   ];
 
   passthru.providedSessions = [ "weston" ];
@@ -61,6 +72,6 @@ stdenv.mkDerivation rec {
     homepage = "https://gitlab.freedesktop.org/wayland/weston";
     license = licenses.mit; # Expat version
     platforms = platforms.linux;
-    maintainers = with maintainers; [ primeos ];
+    maintainers = with maintainers; [ primeos qyliss ];
   };
 }
diff --git a/pkgs/desktops/gnome/core/mutter/43/default.nix b/pkgs/desktops/gnome/core/mutter/43/default.nix
index 56bd69e499c5..6c91193851a9 100644
--- a/pkgs/desktops/gnome/core/mutter/43/default.nix
+++ b/pkgs/desktops/gnome/core/mutter/43/default.nix
@@ -74,7 +74,7 @@ stdenv.mkDerivation (finalAttrs: {
     "-Dinstalled_tests=false" # TODO: enable these
     "-Dwayland_eglstream=true"
     "-Dprofiler=true"
-    "-Dxwayland_path=${xwayland}/bin/Xwayland"
+    "-Dxwayland_path=${lib.getExe xwayland}"
     # This should be auto detected, but it looks like it manages a false
     # positive.
     "-Dxwayland_initfd=disabled"
diff --git a/pkgs/desktops/gnome/core/mutter/default.nix b/pkgs/desktops/gnome/core/mutter/default.nix
index ec3d69459043..3a2d8981b0b8 100644
--- a/pkgs/desktops/gnome/core/mutter/default.nix
+++ b/pkgs/desktops/gnome/core/mutter/default.nix
@@ -81,7 +81,7 @@ stdenv.mkDerivation (finalAttrs: {
     "-Dtests=false"
     "-Dwayland_eglstream=true"
     "-Dprofiler=true"
-    "-Dxwayland_path=${xwayland}/bin/Xwayland"
+    "-Dxwayland_path=${lib.getExe xwayland}"
     # This should be auto detected, but it looks like it manages a false
     # positive.
     "-Dxwayland_initfd=disabled"
diff --git a/pkgs/desktops/plasma-5/kwin/default.nix b/pkgs/desktops/plasma-5/kwin/default.nix
index 47ddcc95451c..2334604903fe 100644
--- a/pkgs/desktops/plasma-5/kwin/default.nix
+++ b/pkgs/desktops/plasma-5/kwin/default.nix
@@ -144,7 +144,7 @@ mkDerivation {
   ];
 
   CXXFLAGS = [
-    ''-DNIXPKGS_XWAYLAND=\"${lib.getBin xwayland}/bin/Xwayland\"''
+    ''-DNIXPKGS_XWAYLAND=\"${lib.getExe xwayland}\"''
   ];
 
   postInstall = ''
diff --git a/pkgs/development/python-modules/johnnycanencrypt/default.nix b/pkgs/development/python-modules/johnnycanencrypt/default.nix
index 2f4e2613d6aa..dca215358e03 100644
--- a/pkgs/development/python-modules/johnnycanencrypt/default.nix
+++ b/pkgs/development/python-modules/johnnycanencrypt/default.nix
@@ -3,7 +3,6 @@
 , fetchFromGitHub
 , buildPythonPackage
 , rustPlatform
-, llvmPackages
 , pkg-config
 , pcsclite
 , nettle
@@ -35,16 +34,14 @@ buildPythonPackage rec {
 
   format = "pyproject";
 
-  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
-
   propagatedBuildInputs = [
     httpx
   ];
 
   nativeBuildInputs = [
-    llvmPackages.clang
     pkg-config
   ] ++ (with rustPlatform; [
+    bindgenHook
     cargoSetupHook
     maturinBuildHook
   ]);
diff --git a/pkgs/development/python-modules/torrent_parser/default.nix b/pkgs/development/python-modules/torrent_parser/default.nix
new file mode 100644
index 000000000000..f60300086f2a
--- /dev/null
+++ b/pkgs/development/python-modules/torrent_parser/default.nix
@@ -0,0 +1,21 @@
+{ buildPythonPackage, lib, fetchFromGitHub }:
+
+buildPythonPackage rec {
+  pname = "torrent_parser";
+  version = "0.4.1";
+
+  # No tarballs on Pypi
+  src = fetchFromGitHub {
+    owner  = "7sDream";
+    repo   = "torrent_parser";
+    rev    = "v${version}";
+    sha256 = "sha256-zM738r3o9dGZYoWLN7fM4E06m6YPcAODEkgDS6wU/Sc=";
+  };
+
+  meta = {
+    description = "A .torrent file parser and creator for both Python 2 and 3";
+    homepage    = "https://github.com/7sDream/torrent_parser";
+    license     = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
diff --git a/pkgs/development/tools/build-managers/rebar3/default.nix b/pkgs/development/tools/build-managers/rebar3/default.nix
index 6104b7779e84..f3ea408cf8bb 100644
--- a/pkgs/development/tools/build-managers/rebar3/default.nix
+++ b/pkgs/development/tools/build-managers/rebar3/default.nix
@@ -3,7 +3,7 @@
   writeScript, common-updater-scripts, coreutils, git, gnused, nix, rebar3-nix }:
 
 let
-  version = "3.21.0";
+  version = "3.22.0";
   owner = "erlang";
   deps = import ./rebar-deps.nix { inherit fetchFromGitHub fetchgit fetchHex; };
   rebar3 = stdenv.mkDerivation rec {
@@ -16,7 +16,7 @@ let
       inherit owner;
       repo = pname;
       rev = version;
-      sha256 = "QRQlqzYxRD4W63CawXBQ9ysPHzHQ5JrfjPqAivFyJAM=";
+      sha256 = "OCd9wGwnwOuv/Ojf1S4ALLn73AGKuXlRtukIiTSE2rs=";
     };
 
     buildInputs = [ erlang ];
diff --git a/pkgs/development/tools/continuous-integration/agola/default.nix b/pkgs/development/tools/continuous-integration/agola/default.nix
index effe905d762e..02cd0f25acd5 100644
--- a/pkgs/development/tools/continuous-integration/agola/default.nix
+++ b/pkgs/development/tools/continuous-integration/agola/default.nix
@@ -4,7 +4,7 @@
 }:
 
 let
-  version = "0.7.0";
+  version = "0.8.0";
 in
 
 buildGoModule {
@@ -15,12 +15,13 @@ buildGoModule {
     owner = "agola-io";
     repo = "agola";
     rev = "v${version}";
-    sha256 = "sha256-AiD7mVogWk/TOYy7Ed1aT31h1kbrRwseue5qc3wLOCI=";
+    hash = "sha256-nU04MVkUC+m6Ga4qDUH9KrA0zbYmttAicpvdxbaBG0Y=";
   };
 
-  vendorSha256 = "sha256-Y3ck7Qdo9uq3YuLzZUe+RZkKQqWpSko3q+f4bfkSz6g=";
+  vendorHash = "sha256-k3Sip9CqTGRTWxr3RzZf0jCrm4AfUrpY/wSTmHy+yik=";
 
   ldflags = [
+    "-s"
     "-w"
     "-X agola.io/agola/cmd.Version=${version}"
   ];
diff --git a/pkgs/development/tools/dtools/default.nix b/pkgs/development/tools/dtools/default.nix
index f1d841828b3f..d605e4d4ef40 100644
--- a/pkgs/development/tools/dtools/default.nix
+++ b/pkgs/development/tools/dtools/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dtools";
-  version = "2.095.1";
+  version = "2.103.1";
 
   src = fetchFromGitHub {
     owner = "dlang";
     repo = "tools";
     rev = "v${version}";
-    sha256 = "sha256:0rdfk3mh3fjrb0h8pr8skwlq6ac9hdl1fkrkdl7n1fa2806b740b";
+    sha256 = "sha256-XM4gUxcarQCOBR8W/o0iWAI54PyLDkH6CsDce22Cnu4=";
     name = "dtools";
   };
 
diff --git a/pkgs/development/tools/go-toml/default.nix b/pkgs/development/tools/go-toml/default.nix
index 96de13ace3e1..563c34626227 100644
--- a/pkgs/development/tools/go-toml/default.nix
+++ b/pkgs/development/tools/go-toml/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "go-toml";
-  version = "2.0.7";
+  version = "2.0.8";
 
   src = fetchFromGitHub {
     owner = "pelletier";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-bGLJSzSwcoKRMRwLSmGEWoQaC9NVwcKyFKpcEw+/Nag=";
+    sha256 = "sha256-pMy/cYyB9ncOuYysX0a9PmTuJdIrMcKL///57bniixI=";
   };
 
-  vendorHash = "sha256-MMCyFKqsL9aSQqK9VtPzUbgfLTFpzD5g8QYx8qIwktg=";
+  vendorHash = "sha256-44mxDswHIfVfAyvtyDHS4MnHCTPRlUvdhzHALICUJR4=";
 
   excludedPackages = [ "cmd/gotoml-test-decoder" "cmd/tomltestgen" ];
 
diff --git a/pkgs/development/tools/godot/4/default.nix b/pkgs/development/tools/godot/4/default.nix
index 2ca785fbcc23..87145c9f398a 100644
--- a/pkgs/development/tools/godot/4/default.nix
+++ b/pkgs/development/tools/godot/4/default.nix
@@ -53,13 +53,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "godot";
-  version = "4.0.2-stable";
+  version = "4.0.3-stable";
 
   src = fetchFromGitHub {
     owner = "godotengine";
     repo = "godot";
     rev = version;
-    hash = "sha256-kFIpY8kHa8ds/JgYWcUMB4RhwcJDebfeWFnI3BkFWiI=";
+    hash = "sha256-g9+CV3HsiJqiSJpZvK0N7BqKzp2Pvi6otjRLsFdmWGk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/misc/terracognita/default.nix b/pkgs/development/tools/misc/terracognita/default.nix
index 26f3b86326dc..55b13dad748b 100644
--- a/pkgs/development/tools/misc/terracognita/default.nix
+++ b/pkgs/development/tools/misc/terracognita/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "terracognita";
-  version = "0.8.3";
+  version = "0.8.4";
 
   src = fetchFromGitHub {
     owner = "cycloidio";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-ipPJMh88R9Ddo1QzN+No9H2bBsLSPARUI2HRaYvK6jc=";
+    hash = "sha256-pPY8y+pQdk9/F7dnUBz/y4lvcR1k/EClywcZATArZVA=";
   };
 
-  vendorHash = "sha256-7fGqChud9dcgA9BXyJysUgvvG7zI+ByA0oFlSMd+rps=";
+  vendorHash = "sha256-ApnJH0uIClXbfXK+k4t9Tcayc2mfndoG9iMqZY3iWys=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/ocaml/opam/default.nix b/pkgs/development/tools/ocaml/opam/default.nix
index 1db7ea151fab..0463db7482b8 100644
--- a/pkgs/development/tools/ocaml/opam/default.nix
+++ b/pkgs/development/tools/ocaml/opam/default.nix
@@ -71,13 +71,13 @@ let
       sha256 = "0jnqsv6pqp5b5g7lcjwgd75zqqvcwcl5a32zi03zg1kvj79p5gxs";
     };
     opam = fetchurl {
-      url = "https://github.com/ocaml/opam/archive/2.1.4.zip";
-      sha256 = "0zp8sb75pw1kyqlm7bsiagfwq46mv41mxh5q2prn2cwg6xri2wrg";
+      url = "https://github.com/ocaml/opam/archive/2.1.5.zip";
+      sha256 = "0s8r5gfs2zsyfn3jzqnvns3g0rkik3pw628n0dik55fwq3zjgg4a";
     };
   };
 in stdenv.mkDerivation {
   pname = "opam";
-  version = "2.1.4";
+  version = "2.1.5";
 
   strictDeps = true;
 
@@ -144,4 +144,4 @@ in stdenv.mkDerivation {
     platforms = platforms.all;
   };
 }
-# Generated by: ./opam.nix.pl -v 2.1.4 -p opam-shebangs.patch
+# Generated by: ./opam.nix.pl -v 2.1.5 -p opam-shebangs.patch
diff --git a/pkgs/development/tools/quick-lint-js/default.nix b/pkgs/development/tools/quick-lint-js/default.nix
index 922b58f43db3..15f5b05a1315 100644
--- a/pkgs/development/tools/quick-lint-js/default.nix
+++ b/pkgs/development/tools/quick-lint-js/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "quick-lint-js";
-  version = "2.12.0";
+  version = "2.14.0";
 
   src = fetchFromGitHub {
     owner = "quick-lint";
     repo = "quick-lint-js";
     rev = version;
-    sha256 = "sha256-OxzemfWYItYb4XWpW2tNUn4yZHUIpS8MJXaP8+3z4YY=";
+    sha256 = "sha256-TzkJupn2oy7zUZybAuTnXZXVLSe72GM7XByo0Kd66Qs=";
   };
 
   nativeBuildInputs = [ cmake ninja ];
diff --git a/pkgs/development/tools/rbspy/default.nix b/pkgs/development/tools/rbspy/default.nix
index d54d52e139ef..2a7ced543ba6 100644
--- a/pkgs/development/tools/rbspy/default.nix
+++ b/pkgs/development/tools/rbspy/default.nix
@@ -4,8 +4,6 @@
 , fetchFromGitHub
 , ruby
 , which
-, runCommand
-, darwin
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,6 +18,12 @@ rustPlatform.buildRustPackage rec {
   };
 
   cargoHash = "sha256-JzspNL4T28awa/1Uajw0gLM3bYyUBYTjnfCXn9qG7SY=";
+
+  # error: linker `aarch64-linux-gnu-gcc` not found
+  postPatch = ''
+    rm .cargo/config
+  '';
+
   doCheck = true;
 
   # The current implementation of rbspy fails to detect the version of ruby
@@ -39,19 +43,10 @@ rustPlatform.buildRustPackage rec {
     "--skip=test_sample_subprocesses"
   ];
 
-  nativeBuildInputs = [ ruby which ];
-
-  buildInputs = lib.optionals (stdenv.isDarwin && stdenv.isx86_64) [
-    # Pull a header that contains a definition of proc_pid_rusage().
-    (runCommand "${pname}_headers" { } ''
-      install -Dm444 ${lib.getDev darwin.apple_sdk.sdk}/include/libproc.h $out/include/libproc.h
-    '')
-  ];
-
-  LIBCLANG_PATH = lib.optionalString stdenv.isDarwin "${stdenv.cc.cc.lib}/lib";
+  nativeBuildInputs = [ ruby which ]
+    ++ lib.optional stdenv.isDarwin rustPlatform.bindgenHook;
 
   meta = with lib; {
-    broken = (stdenv.isLinux && stdenv.isAarch64);
     homepage = "https://rbspy.github.io/";
     description = ''
       A Sampling CPU Profiler for Ruby.
diff --git a/pkgs/games/unciv/default.nix b/pkgs/games/unciv/default.nix
index ee13a1a1e35a..1042060c171c 100644
--- a/pkgs/games/unciv/default.nix
+++ b/pkgs/games/unciv/default.nix
@@ -25,11 +25,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "unciv";
-  version = "4.6.13";
+  version = "4.6.14-patch1";
 
   src = fetchurl {
     url = "https://github.com/yairm210/Unciv/releases/download/${version}/Unciv.jar";
-    hash = "sha256-CNtaaMvBXJ6Fl5FJIWva5nAs/zniPA2rcfcf+RegymY=";
+    hash = "sha256-CVwME8lvRjJ0ugps0lcO8FRk8AsFYs8w0oGNAB9TCnM=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/os-specific/linux/rtl8821cu/default.nix b/pkgs/os-specific/linux/rtl8821cu/default.nix
index 35b068fd8d08..d85186301071 100644
--- a/pkgs/os-specific/linux/rtl8821cu/default.nix
+++ b/pkgs/os-specific/linux/rtl8821cu/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rtl8821cu";
-  version = "${kernel.version}-unstable-2022-12-07";
+  version = "${kernel.version}-unstable-2023-04-28";
 
   src = fetchFromGitHub {
     owner = "morrownr";
-    repo = "8821cu-20210118";
-    rev = "7b8c45a270454f05e2dbf3beeb4afcf817db65da";
-    hash = "sha256-Dg+At0iHvi4pl8umhQyml1bODhkeK8YWYpEckqqzNcQ=";
+    repo = "8821cu-20210916";
+    rev = "e49409f22ceea0d5b5ef431e6170580028b84c9d";
+    hash = "sha256-mElZRr4RkRFiraBM8BxT8yesYgvDaj6xP+9T3P+0Ns4=";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/os-specific/linux/system76-scheduler/default.nix b/pkgs/os-specific/linux/system76-scheduler/default.nix
index 1ca4fa27610a..99c54900cf71 100644
--- a/pkgs/os-specific/linux/system76-scheduler/default.nix
+++ b/pkgs/os-specific/linux/system76-scheduler/default.nix
@@ -1,9 +1,6 @@
 { lib
 , fetchFromGitHub
 , rustPlatform
-, llvm
-, clang
-, libclang
 , pipewire
 , pkg-config
 , bcc
@@ -22,10 +19,9 @@ in rustPlatform.buildRustPackage {
   };
   cargoSha256 = "sha256-hpFDAhOzm4v3lBWwAl/10pS5xvKCScdKsp5wpCeQ+FE=";
 
-  nativeBuildInputs = [ pkg-config llvm clang ];
+  nativeBuildInputs = [ pkg-config rustPlatform.bindgenHook ];
   buildInputs = [ dbus pipewire ];
 
-  LIBCLANG_PATH = "${libclang.lib}/lib";
   EXECSNOOP_PATH = "${bcc}/bin/execsnoop";
 
   # tests don't build
diff --git a/pkgs/servers/metabase/default.nix b/pkgs/servers/metabase/default.nix
index 2685444361e6..f6866a805d4f 100644
--- a/pkgs/servers/metabase/default.nix
+++ b/pkgs/servers/metabase/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "metabase";
-  version = "0.46.2";
+  version = "0.46.4";
 
   src = fetchurl {
     url = "https://downloads.metabase.com/v${version}/metabase.jar";
-    hash = "sha256-FHI8QUZIPMhBNOd0RfdSKGkILaRlS4he8EVSrQxjD0s=";
+    hash = "sha256-sWmX1k581t7Owjt2ksE0xno0q8sDW9WgSLmjjadf5QY=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/servers/mir/default.nix b/pkgs/servers/mir/default.nix
index ea6976cdd6cd..98b5fd39e5f7 100644
--- a/pkgs/servers/mir/default.nix
+++ b/pkgs/servers/mir/default.nix
@@ -86,7 +86,7 @@ stdenv.mkDerivation rec {
 
     # Fix Xwayland default
     substituteInPlace src/miral/x11_support.cpp \
-      --replace '/usr/bin/Xwayland' '${xwayland}/bin/Xwayland'
+      --replace '/usr/bin/Xwayland' '${lib.getExe xwayland}'
 
     # Fix paths for generating drm-formats
     substituteInPlace src/platform/graphics/CMakeLists.txt \
diff --git a/pkgs/servers/monitoring/prometheus/default.nix b/pkgs/servers/monitoring/prometheus/default.nix
index 1724c0f53faa..0abdb97a5421 100644
--- a/pkgs/servers/monitoring/prometheus/default.nix
+++ b/pkgs/servers/monitoring/prometheus/default.nix
@@ -120,7 +120,9 @@ buildGoModule rec {
     moveToOutput bin/promtool $cli
   '';
 
-  doCheck = !stdenv.isDarwin; # https://hydra.nixos.org/build/130673870/nixlog/1
+  # https://hydra.nixos.org/build/130673870/nixlog/1
+  # Test mock data uses 64 bit data without an explicit (u)int64
+  doCheck = !(stdenv.isDarwin || stdenv.hostPlatform.parsed.cpu.bits < 64);
 
   passthru.tests = { inherit (nixosTests) prometheus; };
 
diff --git a/pkgs/servers/x11/xorg/xwayland.nix b/pkgs/servers/x11/xorg/xwayland.nix
index a6c270182f75..f8d85231ca4f 100644
--- a/pkgs/servers/x11/xorg/xwayland.nix
+++ b/pkgs/servers/x11/xorg/xwayland.nix
@@ -108,6 +108,7 @@ stdenv.mkDerivation rec {
     description = "An X server for interfacing X11 apps with the Wayland protocol";
     homepage = "https://wayland.freedesktop.org/xserver.html";
     license = licenses.mit;
+    mainProgram = "Xwayland";
     maintainers = with maintainers; [ emantor ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/tools/misc/opentelemetry-collector/contrib.nix b/pkgs/tools/misc/opentelemetry-collector/contrib.nix
index a544dbd44bcb..66967b9213c7 100644
--- a/pkgs/tools/misc/opentelemetry-collector/contrib.nix
+++ b/pkgs/tools/misc/opentelemetry-collector/contrib.nix
@@ -8,17 +8,17 @@
 
 buildGoModule rec {
   pname = "opentelemetry-collector-contrib";
-  version = "0.77.0";
+  version = "0.78.0";
 
   src = fetchFromGitHub {
     owner = "open-telemetry";
     repo = "opentelemetry-collector-contrib";
     rev = "v${version}";
-    sha256 = "sha256-9OFNJgzMiTNRXuK4joPxnVfCI5mVGqgfKBGI1xpnhCY=";
+    sha256 = "sha256-5oTXPQU1aT8Xm1bTjbnauBUqzBqBH+yBzC1tmLHA0v0=";
   };
   # proxy vendor to avoid hash missmatches between linux and macOS
   proxyVendor = true;
-  vendorHash = "sha256-1an0PB2CV83DDWcw+1irT2gFLKuMkXYok5uglyyrprs=";
+  vendorHash = "sha256-ABaRedZXPr2q2AmslVNIJUvONZa4tv7OkxBLR9GuBRE=";
 
   # there is a nested go.mod
   sourceRoot = "source/cmd/otelcontribcol";
diff --git a/pkgs/tools/misc/tremor-rs/default.nix b/pkgs/tools/misc/tremor-rs/default.nix
index 91944817f3d8..71899299e2d7 100644
--- a/pkgs/tools/misc/tremor-rs/default.nix
+++ b/pkgs/tools/misc/tremor-rs/default.nix
@@ -2,7 +2,6 @@
 , rustPlatform
 , pkg-config
 , cmake
-, llvmPackages
 , openssl
 , fetchFromGitHub
 , installShellFiles
@@ -33,7 +32,7 @@ rustPlatform.buildRustPackage rec {
     };
   };
 
-  nativeBuildInputs = [ cmake pkg-config installShellFiles ];
+  nativeBuildInputs = [ cmake pkg-config installShellFiles rustPlatform.bindgenHook ];
 
   buildInputs = [ openssl ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [ Security libiconv ];
@@ -57,8 +56,6 @@ rustPlatform.buildRustPackage rec {
       --zsh <($out/bin/tremor completions zsh)
   '';
 
-  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
-
   # OPENSSL_NO_VENDOR - If set, always find OpenSSL in the system, even if the vendored feature is enabled.
   OPENSSL_NO_VENDOR = 1;
 
@@ -80,14 +77,13 @@ rustPlatform.buildRustPackage rec {
   cargoBuildFlags = [ "-p tremor-cli" ];
 
   meta = with lib; {
-    broken = stdenv.isDarwin;
+    broken = stdenv.isDarwin && stdenv.isx86_64;
     description = ''
       Early stage event processing system for unstructured data with rich
       support for structural pattern matching, filtering and transformation
     '';
     homepage = "https://www.tremor.rs/";
     license = licenses.asl20;
-    platforms = platforms.x86_64;
     maintainers = with maintainers; [ humancalico happysalada ];
   };
 }
diff --git a/pkgs/tools/misc/tremor-rs/ls.nix b/pkgs/tools/misc/tremor-rs/ls.nix
index 90fe5686f814..ea1b30b07e81 100644
--- a/pkgs/tools/misc/tremor-rs/ls.nix
+++ b/pkgs/tools/misc/tremor-rs/ls.nix
@@ -1,7 +1,6 @@
 { lib
 , rustPlatform
 , fetchFromGitHub
-, llvmPackages
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -15,7 +14,7 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-odYhpb3FkbIF1dc2DSpz3Lg+r39lhDKml9KGmbqJAtA=";
   };
 
-  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
+  nativeBuildInputs = [ rustPlatform.bindgenHook ];
 
   cargoSha256 = "sha256-/RKwmslhMm30QxviVV7HthDHSmTmaGZn1hdt6bNF3d4=";
 
@@ -23,7 +22,6 @@ rustPlatform.buildRustPackage rec {
     description = "Tremor Language Server (Trill)";
     homepage = "https://www.tremor.rs/docs/next/getting-started/tooling";
     license = licenses.asl20;
-    platforms = platforms.x86_64;
     maintainers = with maintainers; [ happysalada ];
   };
 }
diff --git a/pkgs/tools/system/netdata/go.d.plugin.nix b/pkgs/tools/system/netdata/go.d.plugin.nix
index 35a7cf3d13e9..1ce1d4974c60 100644
--- a/pkgs/tools/system/netdata/go.d.plugin.nix
+++ b/pkgs/tools/system/netdata/go.d.plugin.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "netdata-go-plugins";
-  version = "0.52.2";
+  version = "0.53.0";
 
   src = fetchFromGitHub {
     owner = "netdata";
     repo = "go.d.plugin";
     rev = "v${version}";
-    hash = "sha256-/oDUB6EGRq26cRdHwkuTgCRZ+XtNy238TnOYMX1H22s=";
+    hash = "sha256-FHcETEAQArzNyvlzEaOYzwtXk6jPA2b6Kp8pI7FeTo8=";
   };
 
-  vendorHash = "sha256-hxsLCiti/IiTjYPKm/9fWk3CNzDM1+gRgncFXgB/whk=";
+  vendorHash = "sha256-8JpeP2p09j45dkuQMtBj1j0C5CjNMshofHFVnvZvNQY=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/text/par/default.nix b/pkgs/tools/text/par/default.nix
index e4c6c5d0c086..49994d2dfa48 100644
--- a/pkgs/tools/text/par/default.nix
+++ b/pkgs/tools/text/par/default.nix
@@ -1,23 +1,14 @@
 {lib, stdenv, fetchurl, fetchpatch}:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "par";
-  version = "1.52";
+  version = "1.53.0";
 
   src = fetchurl {
-    url = "http://www.nicemice.net/par/Par152.tar.gz";
-    sha256 = "33dcdae905f4b4267b4dc1f3efb032d79705ca8d2122e17efdecfd8162067082";
+    url = "http://www.nicemice.net/par/Par-${version}.tar.gz";
+    sha256 = "sha256-yAnGIOuCtYlVOsVLmJjI2lUZbSYjOdE8BG8r5ErEeAQ=";
   };
 
-  patches = [
-    # A patch by Jérôme Pouiller that adds support for multibyte
-    # charsets (like UTF-8), plus Debian packaging.
-    (fetchpatch {
-      url = "http://sysmic.org/dl/par/par-1.52-i18n.4.patch";
-      sha256 = "0alw44lf511jmr38jnh4j0mpp7vclgy0grkxzqf7q158vzdb6g23";
-    })
-  ];
-
   makefile = "protoMakefile";
   preBuild = ''
     makeFlagsArray+=(CC="${stdenv.cc.targetPrefix}cc -c" LINK1=${stdenv.cc.targetPrefix}cc)
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 4d266e9b0124..c8310fc686de 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2152,6 +2152,8 @@ with pkgs;
 
   legit = callPackage ../applications/version-management/legit { };
 
+  legit-web = callPackage ../applications/version-management/legit-web { };
+
   lucky-commit = callPackage ../applications/version-management/lucky-commit {
     inherit (darwin.apple_sdk.frameworks) OpenCL;
   };
@@ -34270,6 +34272,8 @@ with pkgs;
     inherit (darwin.apple_sdk_11_0.frameworks) CoreServices CoreMIDI;
   };
 
+  sharpsat-td = callPackage ../applications/science/logic/sharpsat-td { };
+
   shntool = callPackage ../applications/audio/shntool { };
 
   sipp = callPackage ../development/tools/misc/sipp { };
@@ -35207,16 +35211,16 @@ with pkgs;
   weechatScripts = recurseIntoAttrs (callPackage ../applications/networking/irc/weechat/scripts { });
 
   westonLite = weston.override {
-    pango = null;
-    freerdp = null;
-    libunwind = null;
-    vaapi = null;
-    libva = null;
-    libwebp = null;
-    xwayland = null;
-    pipewire = null;
-    buildDemo = false;
-    buildRemoting = false;
+    demoSupport = false;
+    hdrSupport = false;
+    pangoSupport = false;
+    pipewireSupport = false;
+    rdpSupport = false;
+    remotingSupport = false;
+    vaapiSupport = false;
+    vncSupport = false;
+    webpSupport = false;
+    xwaylandSupport = false;
   };
 
   chatterino2 = libsForQt5.callPackage ../applications/networking/instant-messengers/chatterino2 {
@@ -39559,7 +39563,7 @@ with pkgs;
 
   rauc = callPackage ../tools/misc/rauc { };
 
-  rbspy = callPackage ../development/tools/rbspy { };
+  rbspy = darwin.apple_sdk_11_0.callPackage ../development/tools/rbspy { };
 
   redprl = callPackage ../applications/science/logic/redprl { };
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 8d7e8dd7c344..e7a81ab193cd 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -12229,6 +12229,8 @@ self: super: with self; {
 
   torpy = callPackage ../development/python-modules/torpy { };
 
+  torrent_parser = callPackage ../development/python-modules/torrent_parser { };
+
   torrequest = callPackage ../development/python-modules/torrequest { };
 
   total-connect-client = callPackage ../development/python-modules/total-connect-client { };