diff --git a/nixos/modules/config/update-users-groups.pl b/nixos/modules/config/update-users-groups.pl
index 5a21cb45d52b..4368ec24ea9e 100644
--- a/nixos/modules/config/update-users-groups.pl
+++ b/nixos/modules/config/update-users-groups.pl
@@ -186,7 +186,7 @@ foreach my $name (keys %groupsCur) {
 # Rewrite /etc/group. FIXME: acquire lock.
 my @lines = map { join(":", $_->{name}, $_->{password}, $_->{gid}, $_->{members}) . "\n" }
     (sort { $a->{gid} <=> $b->{gid} } values(%groupsOut));
-updateFile($gidMapFile, to_json($gidMap));
+updateFile($gidMapFile, to_json($gidMap, {canonical => 1}));
 updateFile("/etc/group", \@lines);
 nscdInvalidate("group");
 
@@ -272,7 +272,7 @@ foreach my $name (keys %usersCur) {
 # Rewrite /etc/passwd. FIXME: acquire lock.
 @lines = map { join(":", $_->{name}, $_->{fakePassword}, $_->{uid}, $_->{gid}, $_->{description}, $_->{home}, $_->{shell}) . "\n" }
     (sort { $a->{uid} <=> $b->{uid} } (values %usersOut));
-updateFile($uidMapFile, to_json($uidMap));
+updateFile($uidMapFile, to_json($uidMap, {canonical => 1}));
 updateFile("/etc/passwd", \@lines);
 nscdInvalidate("passwd");
 
diff --git a/pkgs/applications/misc/logseq/default.nix b/pkgs/applications/misc/logseq/default.nix
index 4210c50499ac..c79b70968615 100644
--- a/pkgs/applications/misc/logseq/default.nix
+++ b/pkgs/applications/misc/logseq/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "logseq";
-  version = "0.8.8";
+  version = "0.8.9";
 
   src = fetchurl {
     url = "https://github.com/logseq/logseq/releases/download/${version}/logseq-linux-x64-${version}.AppImage";
-    sha256 = "sha256-0RVGTANlnzULusQPZ14+a6G5mK1ezDC9VfWWdNqNcs4=";
+    sha256 = "sha256-s9xG2SLkuaz8wRK47ywSw9JjsJlRjaMNeRmQY0ZnrK8=";
     name = "${pname}-${version}.AppImage";
   };
 
diff --git a/pkgs/applications/networking/cluster/gatekeeper/default.nix b/pkgs/applications/networking/cluster/gatekeeper/default.nix
index 13a4d05f5271..3edf48b932e1 100644
--- a/pkgs/applications/networking/cluster/gatekeeper/default.nix
+++ b/pkgs/applications/networking/cluster/gatekeeper/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "gatekeeper";
-  version = "3.9.2";
+  version = "3.10.0";
 
   src = fetchFromGitHub {
     owner = "open-policy-agent";
     repo = "gatekeeper";
     rev = "v${version}";
-    sha256 = "sha256-g6OwUCUR/F4v62yt3cCnAcys0tYYYrYVHC8vZZF5OQ4=";
+    sha256 = "sha256-4U03gdOls1uPpTqxmjLo1ruE4eeuUlGxphOgS9e5C1A=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/applications/video/mkvtoolnix/default.nix b/pkgs/applications/video/mkvtoolnix/default.nix
index 9cce7bb3b333..05aaa8fe646e 100644
--- a/pkgs/applications/video/mkvtoolnix/default.nix
+++ b/pkgs/applications/video/mkvtoolnix/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitLab
+, fetchpatch
 , pkg-config
 , autoreconfHook
 , rake
@@ -46,13 +47,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "mkvtoolnix";
-  version = "70.0.0";
+  version = "71.1.0";
 
   src = fetchFromGitLab {
     owner = "mbunkus";
     repo = "mkvtoolnix";
     rev = "release-${version}";
-    sha256 = "sha256-7ryLf/SKM5m7MdOd2K2XhJEdLF2H8xjV1aZMKUjm+Ok=";
+    sha256 = "sha256-JHbnjcXOctB6HQeHXykWbykdn35S2fCYegMkc3GLmAI=";
   };
 
   nativeBuildInputs = [
@@ -102,7 +103,7 @@ stdenv.mkDerivation rec {
     "--disable-profiling"
     "--disable-static-qt"
     "--enable-optimization"
-    "--with-boost-libdir=${boost.out}/lib"
+    "--with-boost-libdir=${lib.getLib boost}/lib"
     "--with-docbook-xsl-root=${docbook_xsl}/share/xml/docbook-xsl"
     "--with-gettext"
     (enableFeature withGUI "gui")
diff --git a/pkgs/development/compilers/reason/default.nix b/pkgs/development/compilers/reason/default.nix
index ad075b5adb4b..6dca665ad99d 100644
--- a/pkgs/development/compilers/reason/default.nix
+++ b/pkgs/development/compilers/reason/default.nix
@@ -1,15 +1,15 @@
-{ lib, callPackage, stdenv, makeWrapper, fetchurl, ocaml, findlib, dune_2
+{ lib, callPackage, stdenv, makeWrapper, fetchurl, ocaml, findlib, dune_3
 , ncurses
 , fix, menhir, menhirLib, menhirSdk, merlin-extend, ppxlib, utop, cppo, ppx_derivers
 }:
 
 stdenv.mkDerivation rec {
   pname = "ocaml${ocaml.version}-reason";
-  version = "3.8.1";
+  version = "3.8.2";
 
   src = fetchurl {
     url = "https://github.com/reasonml/reason/releases/download/${version}/reason-${version}.tbz";
-    sha256 = "sha256-v827CfYrTBCPJubcOAQxYT5N5LBl348UNk7+Ss6o5BQ=";
+    sha256 = "sha256-etzEXbILje+CrfJxIhH7jthEMoSJdS6O33QoG8HrLvI=";
   };
 
   nativeBuildInputs = [
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     cppo
-    dune_2
+    dune_3
     findlib
     fix
     menhir
diff --git a/pkgs/development/embedded/bossa/arduino.nix b/pkgs/development/embedded/bossa/arduino.nix
new file mode 100644
index 000000000000..04e483ff38b5
--- /dev/null
+++ b/pkgs/development/embedded/bossa/arduino.nix
@@ -0,0 +1,13 @@
+{ bossa, git, fetchFromGitHub }:
+
+bossa.overrideAttrs (attrs: rec {
+  pname = "bossa-arduino";
+  version = "1.9.1-arduino2";
+
+  src = fetchFromGitHub {
+    owner = "arduino";
+    repo = "BOSSA";
+    rev = version;
+    sha256 = "sha256-sBJ6QMd7cTClDnGCeOU0FT6IczEjqqRxCD7kef5GuY8=";
+  };
+})
diff --git a/pkgs/development/embedded/bossa/bossa-no-applet-build.patch b/pkgs/development/embedded/bossa/bossa-no-applet-build.patch
deleted file mode 100644
index 4284245f485d..000000000000
--- a/pkgs/development/embedded/bossa/bossa-no-applet-build.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/Makefile b/Makefile
-index cc8882e..97b11ee 100644
---- a/Makefile
-+++ b/Makefile
-@@ -184,11 +184,6 @@ $(foreach src,$(COMMON_SRCS),$(eval $(call common_obj,$(src))))
- # Applet rules
- #
- define applet_obj
--$(SRCDIR)/$(1:%.asm=%.cpp): $(SRCDIR)/$(1)
--	@echo APPLET $(1:%.asm=%)
--	$$(Q)$$(ARMAS) -o $$(@:%.o=%.obj) $$<
--	$$(Q)$$(ARMOBJCOPY) -O binary $$(@:%.o=%.obj) $$(@:%.o=%.bin)
--	$$(Q)appletgen $(1:%.asm=%) $(SRCDIR) $(OBJDIR)
- $(OBJDIR)/$(1:%.asm=%.o): $(SRCDIR)/$(1:%.asm=%.cpp)
- 	@echo CPP APPLET $$<
- 	$$(Q)$$(CXX) $$(COMMON_CXXFLAGS) -c -o $$(@) $$(<:%.asm=%.cpp)
diff --git a/pkgs/development/embedded/bossa/default.nix b/pkgs/development/embedded/bossa/default.nix
index fbb1b4c1fd40..f3d6cd6a6d89 100644
--- a/pkgs/development/embedded/bossa/default.nix
+++ b/pkgs/development/embedded/bossa/default.nix
@@ -15,17 +15,15 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "bossa";
-  version = "1.8";
+  version = "1.9.1";
 
   src = fetchFromGitHub {
     owner = "shumatech";
     repo = "BOSSA";
     rev = version;
-    sha256 = "sha256-dZeBy63OzIaLUfAg6awnk83FtLKVxPoYAYs5t7BBM6Y=";
+    sha256 = "sha256-8M3MU/+Y1L6SaQ1yoC9Z27A/gGruZdopLnL1z7h7YJw=";
   };
 
-  patches = [ ./bossa-no-applet-build.patch ];
-
   nativeBuildInputs = [ bin2c ];
   buildInputs = [ wxGTK libX11 readline ];
 
diff --git a/pkgs/development/libraries/libebml/default.nix b/pkgs/development/libraries/libebml/default.nix
index 00fc506add7f..bded3d072353 100644
--- a/pkgs/development/libraries/libebml/default.nix
+++ b/pkgs/development/libraries/libebml/default.nix
@@ -1,31 +1,16 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake, pkg-config }:
+{ lib, stdenv, fetchFromGitHub, cmake, pkg-config }:
 
 stdenv.mkDerivation rec {
   pname = "libebml";
-  version = "1.4.2";
+  version = "1.4.4";
 
   src = fetchFromGitHub {
     owner  = "Matroska-Org";
     repo   = "libebml";
     rev    = "release-${version}";
-    sha256 = "1hiilnabar826lfxsaflqjhgsdli6hzzhjv8q2nmw36fvvlyks25";
+    sha256 = "sha256-36SfZUHJ2sIvrrHox583cQqfWWcrL2zW1IHzgDchC9g=";
   };
 
-  patches = [
-    # Upstream fix for gcc-11
-    (fetchpatch {
-      url = "https://github.com/Matroska-Org/libebml/commit/f0bfd53647961e799a43d918c46cf3b6bff89806.patch";
-      sha256 = "1yd6rsds03kwx5jki4hihd2bpfh26g5l1pi82qzaqzarixdxwzvl";
-      excludes = [ "ChangeLog" ];
-    })
-    # in master post 1.4.2, see https://github.com/Matroska-Org/libebml/issues/97
-    (fetchpatch {
-      name = "fix-pkg-config.patch";
-      url = "https://github.com/Matroska-Org/libebml/commit/42fbae35d291b737f2bb4ad5d643fd0d48537a88.patch";
-      sha256 = "020qp4a3l60mcm4n310ynxbbv5qlpmybb9xy10pjvx4brp83pmy3";
-    })
-  ];
-
   nativeBuildInputs = [ cmake pkg-config ];
 
   cmakeFlags = [
diff --git a/pkgs/development/libraries/libmatroska/default.nix b/pkgs/development/libraries/libmatroska/default.nix
index 1d5d13259bb2..7476c3afed23 100644
--- a/pkgs/development/libraries/libmatroska/default.nix
+++ b/pkgs/development/libraries/libmatroska/default.nix
@@ -1,26 +1,16 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake, pkg-config
-, libebml }:
+{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, libebml }:
 
 stdenv.mkDerivation rec {
   pname = "libmatroska";
-  version = "1.6.3";
+  version = "1.7.1";
 
   src = fetchFromGitHub {
     owner  = "Matroska-Org";
     repo   = "libmatroska";
     rev    = "release-${version}";
-    sha256 = "01dg12ndxfdqgjx5v2qy4mff6xjdxglywyg82sr3if5aw6rp3dji";
+    sha256 = "sha256-hfu3Q1lIyMlWFWUM2Pu70Hie0rlQmua7Kq8kSIWnfHE=";
   };
 
-  # in master post 1.6.3, see https://github.com/Matroska-Org/libmatroska/issues/62
-  patches = [
-    (fetchpatch {
-      name = "fix-pkg-config.patch";
-      url = "https://github.com/Matroska-Org/libmatroska/commit/53f6ea573878621871bca5f089220229fcb33a3b.patch";
-      sha256 = "1lcxl3n32kk5x4aa4ja7p68km7qb2bwscavpv7qdmbhp3w5ia0mk";
-    })
-  ];
-
   nativeBuildInputs = [ cmake pkg-config ];
 
   buildInputs = [ libebml ];
diff --git a/pkgs/development/libraries/rnnoise-plugin/default.nix b/pkgs/development/libraries/rnnoise-plugin/default.nix
index e68f74e28960..d5f5268ac8eb 100644
--- a/pkgs/development/libraries/rnnoise-plugin/default.nix
+++ b/pkgs/development/libraries/rnnoise-plugin/default.nix
@@ -1,17 +1,53 @@
-{ lib, stdenv, SDL2, fetchFromGitHub, cmake }:
-
+{ lib
+, stdenv
+, cmake
+, fetchFromGitHub
+, freetype
+, gtk3-x11
+, mount
+, pcre
+, pkg-config
+, webkitgtk
+, xorg
+, llvmPackages
+, WebKit
+, MetalKit
+, CoreAudioKit
+, simd
+}:
 stdenv.mkDerivation rec {
   pname = "rnnoise-plugin";
-  version = "0.91";
+  version = "1.03";
 
   src = fetchFromGitHub {
     owner = "werman";
     repo = "noise-suppression-for-voice";
     rev = "v${version}";
-    sha256 = "11pwisbcks7g0mdgcrrv49v3ci1l6m26bbb7f67xz4pr1hai5dwc";
+    sha256 = "sha256-1DgrpGYF7G5Zr9vbgtKm/Yv0HSdI7LrFYPSGKYNnNDQ=";
   };
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [ cmake pkg-config ];
+
+  patches = lib.optionals stdenv.isDarwin [
+    # Ubsan seems to be broken on aarch64-darwin, it produces linker errors similar to https://github.com/NixOS/nixpkgs/issues/140751
+    ./disable-ubsan.patch
+  ];
+
+  buildInputs =
+    [
+      freetype
+      gtk3-x11
+      pcre
+      xorg.libX11
+      xorg.libXrandr
+    ] ++ lib.optionals stdenv.isLinux [
+      webkitgtk
+    ] ++ lib.optionals stdenv.isDarwin [
+      WebKit
+      MetalKit
+      CoreAudioKit
+      simd
+    ];
 
   cmakeFlags = [ "-DCMAKE_BUILD_TYPE=Release" ];
 
@@ -20,6 +56,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/werman/noise-suppression-for-voice";
     license = licenses.gpl3;
     platforms = platforms.all;
-    maintainers = with maintainers; [ panaeon henrikolsson ];
+    maintainers = with maintainers; [ panaeon henrikolsson sciencentistguy ];
   };
 }
diff --git a/pkgs/development/libraries/rnnoise-plugin/disable-ubsan.patch b/pkgs/development/libraries/rnnoise-plugin/disable-ubsan.patch
new file mode 100644
index 000000000000..e2c4819d141f
--- /dev/null
+++ b/pkgs/development/libraries/rnnoise-plugin/disable-ubsan.patch
@@ -0,0 +1,14 @@
+diff --git a/src/common/CMakeLists.txt b/src/common/CMakeLists.txt
+index 4c2300e..273d76e 100644
+--- a/src/common/CMakeLists.txt
++++ b/src/common/CMakeLists.txt
+@@ -33,8 +33,6 @@ if (BUILD_TESTS)
+             $<BUILD_INTERFACE:${CMAKE_SOURCE_DIR}/external/catch2>
+             $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/include>)
+     target_link_libraries(common_plugin_tests PRIVATE ${LIBRARIES})
+-    target_compile_options(common_plugin_tests PRIVATE -fsanitize=undefined)
+-    target_link_options(common_plugin_tests PRIVATE -fsanitize=undefined)
+ 
+     include(CTest)
+     include(Catch)
+
diff --git a/pkgs/development/ocaml-modules/graphql_ppx/default.nix b/pkgs/development/ocaml-modules/graphql_ppx/default.nix
index 5c38602e8df0..020108a90362 100644
--- a/pkgs/development/ocaml-modules/graphql_ppx/default.nix
+++ b/pkgs/development/ocaml-modules/graphql_ppx/default.nix
@@ -1,4 +1,5 @@
 { lib, buildDunePackage, fetchFromGitHub, alcotest, reason
+, result
 , ppxlib
 , yojson }:
 
@@ -6,6 +7,8 @@ buildDunePackage rec {
   pname = "graphql_ppx";
   version = "1.2.2";
 
+  duneVersion = "3";
+
   minimalOCamlVersion = "4.08";
 
   src = fetchFromGitHub {
@@ -19,6 +22,7 @@ buildDunePackage rec {
 
   propagatedBuildInputs = [
     reason
+    result
     yojson
   ];
 
@@ -26,8 +30,6 @@ buildDunePackage rec {
 
   doCheck = true;
 
-  useDune2 = true;
-
   meta = {
     homepage = "https://github.com/reasonml-community/graphql_ppx";
     description = "GraphQL PPX rewriter for Bucklescript/ReasonML";
diff --git a/pkgs/development/ocaml-modules/tezos-bls12-381-polynomial/default.nix b/pkgs/development/ocaml-modules/tezos-bls12-381-polynomial/default.nix
new file mode 100644
index 000000000000..9a157c4db0f8
--- /dev/null
+++ b/pkgs/development/ocaml-modules/tezos-bls12-381-polynomial/default.nix
@@ -0,0 +1,36 @@
+{
+  lib,
+  fetchFromGitLab,
+  buildDunePackage,
+  bls12-381,
+  data-encoding,
+  alcotest,
+  alcotest-lwt,
+  bisect_ppx,
+  qcheck-alcotest,
+}:
+
+buildDunePackage rec {
+  pname = "tezos-bls12-381-polynomial";
+  version = "0.1.2";
+  duneVersion = "3";
+  src = fetchFromGitLab {
+    owner = "nomadic-labs/cryptography";
+    repo = "privacy-team";
+    rev = "v${version}";
+    sha256 = "sha256-HVeKZCPBRJWQXkcI2J7Fl4qGviYLD5x+4W4pAY/W4jA=";
+  };
+
+  propagatedBuildInputs = [bls12-381 data-encoding];
+
+  checkInputs = [alcotest alcotest-lwt bisect_ppx qcheck-alcotest];
+
+  doCheck = false; # circular dependencies
+
+  meta = {
+    description = "Polynomials over BLS12-381 finite field";
+    license = lib.licenses.mit;
+    homepage = "https://gitlab.com/nomadic-labs/privacy-team";
+    maintainers = [lib.maintainers.ulrikstrid];
+  };
+}
diff --git a/pkgs/development/ocaml-modules/tezos-bls12-381-polynomial/plompiler.nix b/pkgs/development/ocaml-modules/tezos-bls12-381-polynomial/plompiler.nix
new file mode 100644
index 000000000000..0f618f0d1e6b
--- /dev/null
+++ b/pkgs/development/ocaml-modules/tezos-bls12-381-polynomial/plompiler.nix
@@ -0,0 +1,40 @@
+{ lib
+, buildDunePackage
+, hacl-star
+, bls12-381
+, tezos-bls12-381-polynomial
+, data-encoding
+, hex
+, stdint
+, ff
+, mec
+, alcotest
+, qcheck-alcotest
+, bisect_ppx
+}:
+
+buildDunePackage rec {
+  pname = "tezos-plompiler";
+  duneVersion = "3";
+
+  inherit (tezos-bls12-381-polynomial) version src;
+
+  propagatedBuildInputs = [
+    hacl-star
+    bls12-381
+    tezos-bls12-381-polynomial
+    data-encoding
+    hex
+    stdint
+    ff
+    mec
+  ];
+
+  checkInputs = [ alcotest qcheck-alcotest bisect_ppx ];
+
+  doCheck = false; # circular deps
+
+  meta = tezos-bls12-381-polynomial.meta // {
+    description = "Library to write arithmetic circuits for Plonk";
+  };
+}
diff --git a/pkgs/development/ocaml-modules/tezos-bls12-381-polynomial/plonk.nix b/pkgs/development/ocaml-modules/tezos-bls12-381-polynomial/plonk.nix
new file mode 100644
index 000000000000..7eba7fd255de
--- /dev/null
+++ b/pkgs/development/ocaml-modules/tezos-bls12-381-polynomial/plonk.nix
@@ -0,0 +1,35 @@
+{
+  lib,
+  buildDunePackage,
+  hacl-star,
+  bls12-381,
+  tezos-bls12-381-polynomial,
+  data-encoding,
+  tezos-plompiler,
+  alcotest,
+  qcheck-alcotest,
+  bisect_ppx,
+}:
+
+buildDunePackage rec {
+  pname = "tezos-plonk";
+  duneVersion = "3";
+
+  inherit (tezos-bls12-381-polynomial) version src;
+
+  propagatedBuildInputs = [
+    hacl-star
+    bls12-381
+    tezos-bls12-381-polynomial
+    data-encoding
+    tezos-plompiler
+  ];
+
+  checkInputs = [ alcotest qcheck-alcotest bisect_ppx ];
+
+  doCheck = false; # broken
+
+  meta = tezos-bls12-381-polynomial.meta // {
+    description = "Plonk zero-knowledge proving system";
+  };
+}
diff --git a/pkgs/development/python-modules/async-upnp-client/default.nix b/pkgs/development/python-modules/async-upnp-client/default.nix
index ce8572566e3e..379a3725a455 100644
--- a/pkgs/development/python-modules/async-upnp-client/default.nix
+++ b/pkgs/development/python-modules/async-upnp-client/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "async-upnp-client";
-  version = "0.31.2";
+  version = "0.32.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "StevenLooman";
     repo = "async_upnp_client";
     rev = version;
-    sha256 = "sha256-/8gSx1oe2ljBGIPddzBLXuH3LiuHpUXi4/vO7stm5FY=";
+    sha256 = "sha256-pVeVn2Z+onRjG3bIeRl5dXoNPwAWtarV56PL/CQOQUA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/devolo-plc-api/default.nix b/pkgs/development/python-modules/devolo-plc-api/default.nix
index 5d44866da0eb..640c06a7bcc3 100644
--- a/pkgs/development/python-modules/devolo-plc-api/default.nix
+++ b/pkgs/development/python-modules/devolo-plc-api/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "devolo-plc-api";
-  version = "0.8.0";
+  version = "0.8.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "2Fake";
     repo = "devolo_plc_api";
     rev = "v${version}";
-    sha256 = "sha256-LMwvIwbP/nRFby295ur6QTgyXLLJ8ip30V9bti27qKQ=";
+    sha256 = "sha256-Gjs4x52LwCsE0zAJjLO1N0w5r1jDJkZoVY1JVZB8bmE=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/google-cloud-datastore/default.nix b/pkgs/development/python-modules/google-cloud-datastore/default.nix
index c5c2fdf988bd..a950f09050c6 100644
--- a/pkgs/development/python-modules/google-cloud-datastore/default.nix
+++ b/pkgs/development/python-modules/google-cloud-datastore/default.nix
@@ -9,24 +9,33 @@
 , pytestCheckHook
 , pytest-asyncio
 , google-cloud-testutils
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-datastore";
-  version = "2.8.3";
+  version = "2.9.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-JtSY/mQ7BAatBiq9XCO9O0x6nnyPpECnlSYNq9brxp8=";
+    hash = "sha256-8/gmeLpdheW7M9nhM0uTlxrpeRcODSgLVOVKPj9O870=";
   };
 
   propagatedBuildInputs = [
     google-api-core
     google-cloud-core
-    libcst
     proto-plus
   ];
 
+  passthru.optional-dependencies = {
+    libcst = [
+      libcst
+    ];
+  };
+
   checkInputs = [
     google-cloud-testutils
     mock
diff --git a/pkgs/development/python-modules/httpagentparser/default.nix b/pkgs/development/python-modules/httpagentparser/default.nix
index fae412075bc1..bc7a8e33f4ac 100644
--- a/pkgs/development/python-modules/httpagentparser/default.nix
+++ b/pkgs/development/python-modules/httpagentparser/default.nix
@@ -1,26 +1,31 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "httpagentparser";
-  version = "1.9.3";
+  version = "1.9.5";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
-  # Github version does not have any release tags
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1x20j4gyx4vfsxs3bx8qcbdhq7n34gjr8gd01qlri96wpmn4c3rp";
+    hash = "sha256-U879nWWZD2/lnAN4ytjqG53493DS6L2dh2LtrgM76Ao=";
   };
 
   # PyPi version does not include test directory
   doCheck = false;
 
-  pythonImportsCheck = [ "httpagentparser" ];
+  pythonImportsCheck = [
+    "httpagentparser"
+  ];
 
   meta = with lib; {
+    description = "Module to extract OS, Browser, etc. information from http user agent string";
     homepage = "https://github.com/shon/httpagentparser";
-    description = "Extracts OS Browser etc information from http user agent string";
     license = licenses.mit;
     maintainers = with maintainers; [ gador ];
   };
diff --git a/pkgs/development/python-modules/jupyter-repo2docker/default.nix b/pkgs/development/python-modules/jupyter-repo2docker/default.nix
index 6e07fcc28cc0..b889b7bf6204 100644
--- a/pkgs/development/python-modules/jupyter-repo2docker/default.nix
+++ b/pkgs/development/python-modules/jupyter-repo2docker/default.nix
@@ -17,8 +17,8 @@
 }:
 
 buildPythonPackage rec {
-  version = "2022.02.0";
   pname = "jupyter-repo2docker";
+  version = "2022.10.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -26,8 +26,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "jupyterhub";
     repo = "repo2docker";
-    rev = version;
-    sha256 = "sha256-L7jUaGRea5HJnb/SX2K2qfvtFwkq9jfhrpvsu+LHH3M=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-n1Yhl3QC1YqdsCl6pI5NjzTiSEs6NrGq9jwT0uyS/p0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/jupyterlab_server/default.nix b/pkgs/development/python-modules/jupyterlab_server/default.nix
index 8e8f8ef87b24..1b16814eabc2 100644
--- a/pkgs/development/python-modules/jupyterlab_server/default.nix
+++ b/pkgs/development/python-modules/jupyterlab_server/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "jupyterlab_server";
-  version = "2.16.0";
+  version = "2.16.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-0bo0LPfoQ+yyw6Pf4z3hS4Nd+Xiqe0Ecqt3/lacr0so=";
+    hash = "sha256-/g3lWP87tEejLiQJmqfhdET9vIwI9tvAFxyxoK44LT8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/launchpadlib/default.nix b/pkgs/development/python-modules/launchpadlib/default.nix
index a5fabd195db2..8ad74504e84b 100644
--- a/pkgs/development/python-modules/launchpadlib/default.nix
+++ b/pkgs/development/python-modules/launchpadlib/default.nix
@@ -15,11 +15,11 @@
 
 buildPythonPackage rec {
   pname = "launchpadlib";
-  version = "1.10.16";
+  version = "1.10.17";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0df4b13936f988afd0ee485f40fa6922eab783b48c38ca0108cb73c8788fca80";
+    sha256 = "sha256-QoyxsxkJmt/anZ3dfQk3Zn4dRgkOxcgA6aIkFf8asYg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/lazr-restfulclient/default.nix b/pkgs/development/python-modules/lazr-restfulclient/default.nix
index 74197621ee17..9db7239f44a7 100644
--- a/pkgs/development/python-modules/lazr-restfulclient/default.nix
+++ b/pkgs/development/python-modules/lazr-restfulclient/default.nix
@@ -16,13 +16,13 @@
 
 buildPythonPackage rec {
   pname = "lazr.restfulclient";
-  version = "0.14.4";
+  version = "0.14.5";
 
   disabled = isPy27; # namespace is broken for python2
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "bf0fd6b2749b3a2d02711f854c9d23704756f7afed21fb5d5b9809d72aa6d087";
+    sha256 = "sha256-B1FxfH502xmH6adzNXB9TX2XzwSxrQiYuCLxIzPWiHw=";
   };
 
   propagatedBuildInputs = [ distro httplib2 oauthlib setuptools six wadllib ];
diff --git a/pkgs/development/python-modules/mne-python/default.nix b/pkgs/development/python-modules/mne-python/default.nix
index 71a37c16596f..3aa925b63d2e 100644
--- a/pkgs/development/python-modules/mne-python/default.nix
+++ b/pkgs/development/python-modules/mne-python/default.nix
@@ -15,18 +15,21 @@
 , pooch
 , tqdm
 , setuptools
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "mne-python";
-  version = "1.2.0";
+  version = "1.2.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
-  # PyPI dist insufficient to run tests
   src = fetchFromGitHub {
     owner = "mne-tools";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-IqZYkPomS/AjZrPDZapPaZ1jhtrzAvi5MOd9rYrSdKo=";
+    hash = "sha256-PAgePQGf4pO+cciIk718Wlk0OEw4ltrhCdWRyDZzFh0=";
   };
 
   propagatedBuildInputs = [
@@ -55,14 +58,16 @@ buildPythonPackage rec {
     export MNE_SKIP_NETWORK_TESTS=1
   '';
 
-  # all tests pass, but Pytest hangs afterwards - probably some thread hasn't terminated
+  # All tests pass, but Pytest hangs afterwards - probably some thread hasn't terminated
   doCheck = false;
 
-  pythonImportsCheck = [ "mne" ];
+  pythonImportsCheck = [
+    "mne"
+  ];
 
   meta = with lib; {
-    homepage = "https://mne.tools";
     description = "Magnetoencephelography and electroencephalography in Python";
+    homepage = "https://mne.tools";
     license = licenses.bsd3;
     maintainers = with maintainers; [ bcdarwin ];
   };
diff --git a/pkgs/development/python-modules/mypy-boto3-s3/default.nix b/pkgs/development/python-modules/mypy-boto3-s3/default.nix
index 7e8dc34f4388..8a2aa8302583 100644
--- a/pkgs/development/python-modules/mypy-boto3-s3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3-s3/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "mypy-boto3-s3";
-  version = "1.24.76";
+  version = "1.24.94";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ciU2L9bw2JS1IWFf4SSVWFb/jx7NrlN1rCCzNL60rZw=";
+    hash = "sha256-CQffewwDqMFY19CPyzwlVQXvyog0ciRCWo/Gh+RZb6E=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/patiencediff/default.nix b/pkgs/development/python-modules/patiencediff/default.nix
index 99203d78dea2..4c14d161f46e 100644
--- a/pkgs/development/python-modules/patiencediff/default.nix
+++ b/pkgs/development/python-modules/patiencediff/default.nix
@@ -1,18 +1,36 @@
-{ lib, buildPythonPackage, fetchPypi }:
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pytestCheckHook
+, pythonOlder
+}:
 
 buildPythonPackage rec {
   pname = "patiencediff";
-  version = "0.2.3";
+  version = "0.2.6";
+  format = "setuptools";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "sha256-ATyTGFDomGUY8e53krBJzVgab7ked73fbIIwp63+tzI=";
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "breezy-team";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-oJOsqZ9XCbYHJ7VEbDpC9wquCkvfj05M0nerlV5jL7w=";
   };
 
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "patiencediff"
+  ];
+
   meta = with lib; {
     description = "C implementation of patiencediff algorithm for Python";
     homepage = "https://github.com/breezy-team/patiencediff";
     license = licenses.gpl2Plus;
-    maintainers = [ maintainers.wildsebastian ];
+    maintainers = with maintainers; [ wildsebastian ];
   };
 }
diff --git a/pkgs/development/python-modules/pex/default.nix b/pkgs/development/python-modules/pex/default.nix
index 36bf41a6e910..a5321f9a3ecb 100644
--- a/pkgs/development/python-modules/pex/default.nix
+++ b/pkgs/development/python-modules/pex/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "pex";
-  version = "2.1.110";
+  version = "2.1.111";
   format = "flit";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-MYHUTxVc5lh1JnOw10trB6nBiIIExm9cxeHRyKwVzhU=";
+    hash = "sha256-C7ihItw9tRXzaaD3WBZT2HnifnZS///pAODmxmp/sVw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/portalocker/default.nix b/pkgs/development/python-modules/portalocker/default.nix
index 2d57952de3ec..1c425f3711f1 100644
--- a/pkgs/development/python-modules/portalocker/default.nix
+++ b/pkgs/development/python-modules/portalocker/default.nix
@@ -1,16 +1,22 @@
-{ lib, buildPythonPackage, fetchPypi
+{ lib
+, buildPythonPackage
+, fetchPypi
 , pytestCheckHook
 , pytest-mypy
+, pythonOlder
 , redis
 }:
 
 buildPythonPackage rec {
-  version = "2.5.1";
   pname = "portalocker";
+  version = "2.6.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-ro6cwmYNoEv0H6Gg7vfjALteSlhprfsabYVRYytVmys=";
+    hash = "sha256-lk9oMPtCp0tdMrzpntN9gwjB19RN3xjz3Yn0aA3pezk=";
   };
 
   propagatedBuildInputs = [
@@ -26,6 +32,10 @@ buildPythonPackage rec {
     "test_combined" # no longer compatible with setuptools>=58
   ];
 
+  pythonImportsCheck = [
+    "portalocker"
+  ];
+
   meta = with lib; {
     description = "A library to provide an easy API to file locking";
     homepage = "https://github.com/WoLpH/portalocker";
diff --git a/pkgs/development/python-modules/pulumi-aws/default.nix b/pkgs/development/python-modules/pulumi-aws/default.nix
index b01ab969338a..ee3f7d22f35f 100644
--- a/pkgs/development/python-modules/pulumi-aws/default.nix
+++ b/pkgs/development/python-modules/pulumi-aws/default.nix
@@ -12,7 +12,7 @@
 buildPythonPackage rec {
   pname = "pulumi-aws";
   # Version is independant of pulumi's.
-  version = "5.17.0";
+  version = "5.18.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "pulumi";
     repo = "pulumi-aws";
     rev = "refs/tags/v${version}";
-    hash = "sha256-xqlQwVqjzqQ0cBNcAlS/R0Ut3aA6umEjogRnlSMHdro=";
+    hash = "sha256-IHvmiX5drRm4PNY+N5VZ7OjsH5xIswr/G7AREN1XYtM=";
   };
 
   sourceRoot = "${src.name}/sdk/python";
diff --git a/pkgs/development/python-modules/pyatmo/default.nix b/pkgs/development/python-modules/pyatmo/default.nix
index 9d8f12bc410b..5a570464abf2 100644
--- a/pkgs/development/python-modules/pyatmo/default.nix
+++ b/pkgs/development/python-modules/pyatmo/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "pyatmo";
-  version = "7.1.1";
+  version = "7.2.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "jabesq";
     repo = "pyatmo";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-qFF2uhaaw2hz5jH/xeLiNlyvFgx17P+WmujnoF9qcqo=";
+    sha256 = "sha256-5RlYTgxWm6BM/V2+1IF/rje5dNirN7PJs0eSiYeOpOQ=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/python-fullykiosk/default.nix b/pkgs/development/python-modules/python-fullykiosk/default.nix
new file mode 100644
index 000000000000..2cb8f1f8144a
--- /dev/null
+++ b/pkgs/development/python-modules/python-fullykiosk/default.nix
@@ -0,0 +1,39 @@
+{ lib
+, aiohttp
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "python-fullykiosk";
+  version = "0.0.11";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "cgarwood";
+    repo = pname;
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-Fndf9OOy3JLVTzHwfRzYrF/Khuhf9BMT6I+ze375p70=";
+  };
+
+  propagatedBuildInputs = [
+    aiohttp
+  ];
+
+  # Module has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "fullykiosk"
+  ];
+
+  meta = with lib; {
+    description = "Wrapper for Fully Kiosk Browser REST interface";
+    homepage = "https://github.com/cgarwood/python-fullykiosk";
+    license = with licenses; [ asl20 ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/twilio/default.nix b/pkgs/development/python-modules/twilio/default.nix
index 5e07b694e6d4..0558903b2f03 100644
--- a/pkgs/development/python-modules/twilio/default.nix
+++ b/pkgs/development/python-modules/twilio/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "twilio";
-  version = "7.14.2";
+  version = "7.15.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "twilio";
     repo = "twilio-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-lamP7ltKLizwPGX1063bZ90M89oPmXVSogi3HNksvHE=";
+    hash = "sha256-raRrEK1Ub5yV4T2onZj+Y+pmtm09z3KxGmtqK6TnlSk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/types-setuptools/default.nix b/pkgs/development/python-modules/types-setuptools/default.nix
index a4db1abb3664..4afc13df60f0 100644
--- a/pkgs/development/python-modules/types-setuptools/default.nix
+++ b/pkgs/development/python-modules/types-setuptools/default.nix
@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "types-setuptools";
-  version = "65.5.0.0";
+  version = "65.5.0.1";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-Izi8gJySVXnDu1ZWp31XE+r+UeOE3Kynsz9wuOnQKIU=";
+    sha256 = "sha256-Wylwgcjx+9mSzYswWpftlu5v/HZekRUSQClZfdELinE=";
   };
 
   # Module doesn't have tests
diff --git a/pkgs/development/tools/bundletool/default.nix b/pkgs/development/tools/bundletool/default.nix
index c23a18ff2702..97aae84e14d3 100644
--- a/pkgs/development/tools/bundletool/default.nix
+++ b/pkgs/development/tools/bundletool/default.nix
@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "bundletool";
-  version = "1.11.2";
+  version = "1.12.1";
 
   src = fetchurl {
     url = "https://github.com/google/bundletool/releases/download/${version}/bundletool-all-${version}.jar";
-    sha256 = "sha256-MCZW642cjuC0XQ0MXnLlyQEJft3z1gaZaXYD1qIiffg=";
+    sha256 = "sha256-yn8Nz2f0UffzTrI+g1MoDpOYj7frq6/US86auYkcs3I=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/development/tools/esbuild/default.nix b/pkgs/development/tools/esbuild/default.nix
index 1032e3e92efe..8a8562af65ec 100644
--- a/pkgs/development/tools/esbuild/default.nix
+++ b/pkgs/development/tools/esbuild/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "esbuild";
-  version = "0.15.11";
+  version = "0.15.12";
 
   src = fetchFromGitHub {
     owner = "evanw";
     repo = "esbuild";
     rev = "v${version}";
-    sha256 = "sha256-QgK1+cUW3ntPnzopYTGrIEzGvsQwzBwwryw5MXHX2+c=";
+    sha256 = "sha256-NyujxnBi55wMmLW488gmimcywfeO6WWAnx/y0KqhR7o=";
   };
 
   vendorSha256 = "sha256-+BfxCyg0KkDQpHt/wycy/8CTG6YBA/VJvJFhhzUnSiQ=";
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 0fbf7caea35c..577e87f522a0 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -1028,7 +1028,8 @@
       afsapi
     ];
     "fully_kiosk" = ps: with ps; [
-    ]; # missing inputs: python-fullykiosk
+      python-fullykiosk
+    ];
     "futurenow" = ps: with ps; [
       pyfnip
     ];
@@ -3801,6 +3802,7 @@
     "fritzbox_callmonitor"
     "fronius"
     "frontend"
+    "fully_kiosk"
     "garages_amsterdam"
     "gdacs"
     "generic"
diff --git a/pkgs/servers/mail/dovecot/default.nix b/pkgs/servers/mail/dovecot/default.nix
index 81d858d41b4c..9c9121baf0e4 100644
--- a/pkgs/servers/mail/dovecot/default.nix
+++ b/pkgs/servers/mail/dovecot/default.nix
@@ -63,6 +63,11 @@ stdenv.mkDerivation rec {
       url = "https://github.com/dovecot/core/compare/7bad6a24%5E..a1022072.patch";
       hash = "sha256-aSyRcQreyA9j8QwkODHqPpRuS3vzouVatEWCqhh+r+8=";
     })
+    # fix openssl 3.0 compatibility
+    (fetchpatch {
+      url = "https://salsa.debian.org/debian/dovecot/-/raw/debian/1%252.3.19.1+dfsg1-2/debian/patches/Support-openssl-3.0.patch";
+      hash = "sha256-PbBB1jIY3jIC8Js1NY93zkV0gISGUq7Nc67Ul5tN7sw=";
+    })
   ];
 
   configureFlags = [
diff --git a/pkgs/servers/mail/opensmtpd/filter-dkimsign/default.nix b/pkgs/servers/mail/opensmtpd/filter-dkimsign/default.nix
new file mode 100644
index 000000000000..a5b6cf9228d5
--- /dev/null
+++ b/pkgs/servers/mail/opensmtpd/filter-dkimsign/default.nix
@@ -0,0 +1,36 @@
+{ lib
+, stdenv
+, fetchurl
+, libopensmtpd
+, openssl
+, mandoc
+}:
+stdenv.mkDerivation rec {
+  pname = "opensmtpd-filter-dkimsign";
+  version = "0.6";
+
+  src = fetchurl {
+    url = "https://imperialat.at/releases/filter-dkimsign-${version}.tar.gz";
+    hash = "sha256-O18NtAuSNg82uKnUx+R4h3e1IBSElTrFWBBkr2AYNsM=";
+  };
+
+  patches = [ ./no-chown-while-installing.patch ];
+
+  buildInputs = [ libopensmtpd openssl ];
+
+  nativeBuildInputs = [ mandoc ];
+
+  makeFlags = [
+    "-f Makefile.gnu"
+    "HAVE_ED25519=1"
+    "DESTDIR=$(out)"
+    "LOCALBASE="
+  ];
+
+  meta = with lib; {
+    description = "OpenSMTPD filter for DKIM signing";
+    homepage = "http://imperialat.at/dev/filter-dkimsign/";
+    license = licenses.isc;
+    maintainers = with maintainers; [ malvo ];
+  };
+}
diff --git a/pkgs/servers/mail/opensmtpd/filter-dkimsign/no-chown-while-installing.patch b/pkgs/servers/mail/opensmtpd/filter-dkimsign/no-chown-while-installing.patch
new file mode 100644
index 000000000000..8ed5fc153a36
--- /dev/null
+++ b/pkgs/servers/mail/opensmtpd/filter-dkimsign/no-chown-while-installing.patch
@@ -0,0 +1,24 @@
+diff --git a/Makefile.gnu b/Makefile.gnu
+index 1f97bd2..807b692 100644
+--- a/Makefile.gnu
++++ b/Makefile.gnu
+@@ -46,11 +46,7 @@ NEED_PLEDGE?=		1
+ 
+ MANFORMAT?=		mangz
+ 
+-BINOWN?=	root
+-BINGRP?=	root
+ BINPERM?=	755
+-MANOWN?=	root
+-MANGRP?=	root
+ MANPERM?=	644
+ 
+ ifeq (${MANFORMAT}, mangz)
+@@ -115,5 +111,5 @@ clean:
+ 
+ .PHONY: install
+ install: ${PROG}
+-	${INSTALL} -D -o ${BINOWN} -g ${BINGRP} -m ${BINPERM} ${PROG} ${DESTDIR}${BINDIR}/${PROG}
+-	${INSTALL} -D -o ${MANOWN} -g ${MANGRP} -m ${MANPERM} ${TARGET_MAN} ${DESTDIR}${MANDIR}/${TARGET_MAN}
++	${INSTALL} -D -m ${BINPERM} ${PROG} ${DESTDIR}${BINDIR}/${PROG}
++	${INSTALL} -D -m ${MANPERM} ${TARGET_MAN} ${DESTDIR}${MANDIR}/${TARGET_MAN}
diff --git a/pkgs/servers/mail/opensmtpd/libopensmtpd/default.nix b/pkgs/servers/mail/opensmtpd/libopensmtpd/default.nix
new file mode 100644
index 000000000000..f740a12e53f5
--- /dev/null
+++ b/pkgs/servers/mail/opensmtpd/libopensmtpd/default.nix
@@ -0,0 +1,34 @@
+{ lib
+, stdenv
+, fetchurl
+, libevent
+, mandoc
+}:
+stdenv.mkDerivation rec {
+  pname = "libopensmtpd";
+  version = "0.7";
+
+  src = fetchurl {
+    url = "https://imperialat.at/releases/libopensmtpd-${version}.tar.gz";
+    hash = "sha256-zdbV4RpwY/kmXaQ6QjCcZGVUuLaLA5gsqEctvisIphM=";
+  };
+
+  patches = [ ./no-chown-while-installing.patch ];
+
+  buildInputs = [ libevent ];
+
+  nativeBuildInputs = [ mandoc ];
+
+  makeFlags = [
+    "-f Makefile.gnu"
+    "DESTDIR=$(out)"
+    "LOCALBASE="
+  ];
+
+  meta = with lib; {
+    description = "Library for creating OpenSMTPD filters";
+    homepage = "http://imperialat.at/dev/libopensmtpd/";
+    license = licenses.isc;
+    maintainers = with maintainers; [ malvo ];
+  };
+}
diff --git a/pkgs/servers/mail/opensmtpd/libopensmtpd/no-chown-while-installing.patch b/pkgs/servers/mail/opensmtpd/libopensmtpd/no-chown-while-installing.patch
new file mode 100644
index 000000000000..52d8b3e2d01f
--- /dev/null
+++ b/pkgs/servers/mail/opensmtpd/libopensmtpd/no-chown-while-installing.patch
@@ -0,0 +1,38 @@
+diff --git a/Makefile.gnu b/Makefile.gnu
+index b4bcaef..981721c 100644
+--- a/Makefile.gnu
++++ b/Makefile.gnu
+@@ -27,7 +27,7 @@ SYMBOL_LIST=	${CURDIR}/Symbols.list
+ includes:
+ 	@cd ${CURDIR}; for i in ${HDRS}; do \
+ 	    j="cmp -s $$i ${DESTDIR}${LOCALBASE}/include/$$i || \
+-	    ${INSTALL} -D -o ${BINOWN} -g ${BINGRP} -m 444 $$i\
++	    ${INSTALL} -D -m 444 $$i\
+ 		${DESTDIR}${LOCALBASE}/include/$$i"; \
+ 	    echo $$j; \
+ 	    eval "$$j"; \
+@@ -52,11 +52,7 @@ MANFORMAT?=		mangz
+ INSTALL?=	install
+ LINK?=		ln
+ 
+-BINOWN?=	root
+-BINGRP?=	root
+ LIBPERM?=	755
+-MANOWN?=	root
+-MANGRP?=	root
+ MANPERM?=	644
+ 
+ include ${CURDIR}/shlib_version
+@@ -138,10 +134,10 @@ all: ${TARGET_LIB} ${TARGET_MAN}
+ 
+ .PHONY: install
+ install: includes ${TARGET_LIB} ${TARGET_MAN}
+-	${INSTALL} -D -o ${BINOWN} -g ${BINGRP} -m ${LIBPERM} ${TARGET_LIB} ${DESTDIR}${LIBDIR}/${TARGET_LIB}
++	${INSTALL} -D -m ${LIBPERM} ${TARGET_LIB} ${DESTDIR}${LIBDIR}/${TARGET_LIB}
+ 	${LINK} -s ${TARGET_LIB} ${DESTDIR}${LIBDIR}/${SONAME_LIB}
+ 	${LINK} -s ${TARGET_LIB} ${DESTDIR}${LIBDIR}/${BASE_LIB}
+-	${INSTALL} -D -o ${MANOWN} -g ${MANGRP} -m ${MANPERM} ${TARGET_MAN} ${DESTDIR}${MANDIR}/${TARGET_MAN}
++	${INSTALL} -D -m ${MANPERM} ${TARGET_MAN} ${DESTDIR}${MANDIR}/${TARGET_MAN}
+ 
+ CLEANFILES+=	*.o ${TARGET_LIB}
+ 
diff --git a/pkgs/servers/matrix-synapse/default.nix b/pkgs/servers/matrix-synapse/default.nix
index bb970bb959f4..140ee000b6d7 100644
--- a/pkgs/servers/matrix-synapse/default.nix
+++ b/pkgs/servers/matrix-synapse/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, python3, openssl, rustPlatform
+{ lib, stdenv, fetchFromGitHub, python3, openssl, rustPlatform
 , enableSystemd ? stdenv.isLinux, nixosTests
 , enableRedis ? true
 , callPackage
@@ -11,26 +11,22 @@ in
 with python3.pkgs;
 buildPythonApplication rec {
   pname = "matrix-synapse";
-  version = "1.68.0";
+  version = "1.69.0";
   format = "pyproject";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-jQcprvKEbLuLWth0aWeh5mi/v8z83GIrjCsm3JdJcUM=";
+  src = fetchFromGitHub {
+    owner = "matrix-org";
+    repo = "synapse";
+    rev = "v${version}";
+    hash = "sha256-Epzvxy3w8Xdj8xz8GEry97J7zGudIgjUH51NcibKDvQ=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-k8iAYRgFCuv6QYAUW5kSEwFSEXVNAEGpPya7biS1Vlo=";
+    hash = "sha256-RJq4mdPtnAR45rAycGDSSuvZwkJPOiqFBp+8mnBTKvU=";
   };
 
-  postPatch = ''
-    # Remove setuptools_rust from runtime dependencies
-    # https://github.com/matrix-org/synapse/blob/v1.68.0/pyproject.toml#L177-L185
-    sed -i '/^setuptools_rust =/d' pyproject.toml
-  '';
-
   nativeBuildInputs = [
     poetry-core
     rustPlatform.cargoSetupHook
diff --git a/pkgs/servers/monitoring/nagios/plugins/check_ssl_cert.nix b/pkgs/servers/monitoring/nagios/plugins/check_ssl_cert.nix
index b3b8871b0ff4..2bd170520fdb 100644
--- a/pkgs/servers/monitoring/nagios/plugins/check_ssl_cert.nix
+++ b/pkgs/servers/monitoring/nagios/plugins/check_ssl_cert.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "check_ssl_cert";
-  version = "2.52.0";
+  version = "2.53.0";
 
   src = fetchFromGitHub {
     owner = "matteocorti";
     repo = "check_ssl_cert";
     rev = "v${version}";
-    hash = "sha256-rYOcbfKWFZN2kFY8H6jf5PXFH/VvXieL2ddvSdFCVPs=";
+    hash = "sha256-Pj2g4eZqeIWV5kb2N9cnVwV0ZASOQflZD3sChhzPbfM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/misc/ddcutil/default.nix b/pkgs/tools/misc/ddcutil/default.nix
index c386f7b26069..b61f396dc4df 100644
--- a/pkgs/tools/misc/ddcutil/default.nix
+++ b/pkgs/tools/misc/ddcutil/default.nix
@@ -1,6 +1,6 @@
 { lib
 , stdenv
-, fetchFromGitHub
+, fetchurl
 , autoreconfHook
 , pkg-config
 , glib
@@ -15,13 +15,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ddcutil";
-  version = "1.3.0";
+  version = "1.3.2";
 
-  src = fetchFromGitHub {
-    owner = "rockowitz";
-    repo = "ddcutil";
-    rev = "v${version}";
-    sha256 = "sha256-Di/feEQOHNhU3y/HwXQoOnu+gPQYP2Oedf1CPt8gHJ0=";
+  src = fetchurl {
+    url = "http://www.ddcutil.com/tarballs/${pname}-${version}.tar.gz";
+    sha256 = "sha256-vZI7OquGjZ0koArdOWKkfFtfRzCvtXm8lGFCUklloEI=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
diff --git a/pkgs/tools/misc/goreleaser/default.nix b/pkgs/tools/misc/goreleaser/default.nix
index 12cc1f3d21fb..65a1c82a6d89 100644
--- a/pkgs/tools/misc/goreleaser/default.nix
+++ b/pkgs/tools/misc/goreleaser/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "goreleaser";
-  version = "1.12.1";
+  version = "1.12.2";
 
   src = fetchFromGitHub {
     owner = "goreleaser";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-OObwteXfUPezJRIN01jOWzDWHEdkmkubBBk7W1LdrUU=";
+    sha256 = "sha256-64oivUXAPP0Wo4CYt82Xs/yVhvuiyWVEurZrporCyJw=";
   };
 
-  vendorSha256 = "sha256-EFBoqHiu1KZ0+16LwysMsqZAUMJSPerKKM2ydlUfKMA=";
+  vendorSha256 = "sha256-DJwHLitsyHJmZ8FhVAoLTI6HwoHPFAAv8RYmhMwh1Bg=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/misc/topgrade/darwin-cargo-lock.patch b/pkgs/tools/misc/topgrade/darwin-cargo-lock.patch
deleted file mode 100644
index bbe27c53fa9b..000000000000
--- a/pkgs/tools/misc/topgrade/darwin-cargo-lock.patch
+++ /dev/null
@@ -1,921 +0,0 @@
-diff --git a/Cargo.lock b/Cargo.lock
-index d91d01a..bade540 100644
---- a/Cargo.lock
-+++ b/Cargo.lock
-@@ -14,7 +14,7 @@ version = "0.7.6"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "fcb51a0695d8f838b1ee009b3fbf66bda078cd64590202a864a8f3e8c4315c47"
- dependencies = [
-- "getrandom",
-+ "getrandom 0.2.6",
-  "once_cell",
-  "version_check",
- ]
-@@ -35,41 +35,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "08f9b8508dccb7687a1d6c4ce66b2b0ecef467c94667de27d8d7fe1f8d2a9cdc"
- 
- [[package]]
--name = "async-broadcast"
--version = "0.4.0"
-+name = "arrayref"
-+version = "0.3.6"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "1bbd92a9bd0e9c1298118ecf8a2f825e86b12c3ec9e411573e34aaf3a0c03cdd"
--dependencies = [
-- "easy-parallel",
-- "event-listener",
-- "futures-core",
-- "parking_lot",
--]
-+checksum = "a4c527152e37cf757a3f78aae5a06fbeefdb07ccc535c980a3208ee3060dd544"
- 
- [[package]]
--name = "async-channel"
--version = "1.6.1"
-+name = "arrayvec"
-+version = "0.5.2"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "2114d64672151c0c5eaa5e131ec84a74f06e1e559830dabba01ca30605d66319"
--dependencies = [
-- "concurrent-queue",
-- "event-listener",
-- "futures-core",
--]
--
--[[package]]
--name = "async-executor"
--version = "1.4.1"
--source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "871f9bb5e0a22eeb7e8cf16641feb87c9dc67032ccf8ff49e772eb9941d3a965"
--dependencies = [
-- "async-task",
-- "concurrent-queue",
-- "fastrand",
-- "futures-lite",
-- "once_cell",
-- "slab",
--]
-+checksum = "23b62fc65de8e4e7f52534fb52b0f3ed04746ae267519eef2a83941e8085068b"
- 
- [[package]]
- name = "async-io"
-@@ -90,43 +65,6 @@ dependencies = [
-  "winapi",
- ]
- 
--[[package]]
--name = "async-lock"
--version = "2.5.0"
--source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "e97a171d191782fba31bb902b14ad94e24a68145032b7eedf871ab0bc0d077b6"
--dependencies = [
-- "event-listener",
--]
--
--[[package]]
--name = "async-recursion"
--version = "0.3.2"
--source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "d7d78656ba01f1b93024b7c3a0467f1608e4be67d725749fdcd7d2c7678fd7a2"
--dependencies = [
-- "proc-macro2",
-- "quote",
-- "syn",
--]
--
--[[package]]
--name = "async-task"
--version = "4.2.0"
--source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "30696a84d817107fc028e049980e09d5e140e8da8f1caeb17e8e950658a3cea9"
--
--[[package]]
--name = "async-trait"
--version = "0.1.53"
--source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "ed6aa3524a2dfcf9fe180c51eae2b58738348d819517ceadf95789c51fff7600"
--dependencies = [
-- "proc-macro2",
-- "quote",
-- "syn",
--]
--
- [[package]]
- name = "atty"
- version = "0.2.14"
-@@ -156,6 +94,17 @@ version = "1.3.2"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
- 
-+[[package]]
-+name = "blake2b_simd"
-+version = "0.5.11"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "afa748e348ad3be8263be728124b24a24f268266f6f5d58af9d75f6a40b5c587"
-+dependencies = [
-+ "arrayref",
-+ "arrayvec",
-+ "constant_time_eq",
-+]
-+
- [[package]]
- name = "block"
- version = "0.1.6"
-@@ -192,6 +141,12 @@ version = "1.0.73"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "2fff2a6927b3bb87f9595d67196a70493f627687a71d87a0d692242c33f58c11"
- 
-+[[package]]
-+name = "cfg-if"
-+version = "0.1.10"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "4785bdd1c96b2a846b2bd7cc02e86b6b3dbf14e7e53446c4f54c92a361040822"
-+
- [[package]]
- name = "cfg-if"
- version = "1.0.0"
-@@ -274,13 +229,19 @@ dependencies = [
-  "winapi",
- ]
- 
-+[[package]]
-+name = "constant_time_eq"
-+version = "0.1.5"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "245097e9a4535ee1e3e3931fcfcd55a796a44c643e8596ff6566d68f09b87bbc"
-+
- [[package]]
- name = "crc32fast"
- version = "1.3.2"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "b540bd8bc810d3885c6ea91e2018302f68baba2129ab3e88f32389ee9370880d"
- dependencies = [
-- "cfg-if",
-+ "cfg-if 1.0.0",
- ]
- 
- [[package]]
-@@ -289,7 +250,7 @@ version = "0.8.8"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "0bf124c720b7686e3c2663cf54062ab0f68a88af2fb6a030e87e30bf721fcb38"
- dependencies = [
-- "cfg-if",
-+ "cfg-if 1.0.0",
-  "lazy_static",
- ]
- 
-@@ -313,13 +274,24 @@ dependencies = [
-  "dirs-sys",
- ]
- 
-+[[package]]
-+name = "dirs"
-+version = "1.0.5"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "3fd78930633bd1c6e35c4b42b1df7b0cbc6bc191146e512bb3bedf243fcc3901"
-+dependencies = [
-+ "libc",
-+ "redox_users 0.3.5",
-+ "winapi",
-+]
-+
- [[package]]
- name = "dirs-next"
- version = "2.0.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "b98cf8ebf19c3d1b223e151f99a4f9f0690dca41414773390fc824184ac833e1"
- dependencies = [
-- "cfg-if",
-+ "cfg-if 1.0.0",
-  "dirs-sys-next",
- ]
- 
-@@ -330,7 +302,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "1b1d1d91c932ef41c0f2663aa8b0ca0342d444d842c06914aa0a7e352d0bada6"
- dependencies = [
-  "libc",
-- "redox_users",
-+ "redox_users 0.4.3",
-  "winapi",
- ]
- 
-@@ -341,7 +313,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "4ebda144c4fe02d1f7ea1a7d9641b6fc6b580adcfa024ae48797ecdeb6825b4d"
- dependencies = [
-  "libc",
-- "redox_users",
-+ "redox_users 0.4.3",
-  "winapi",
- ]
- 
-@@ -351,12 +323,6 @@ version = "0.3.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "0688c2a7f92e427f44895cd63841bff7b29f8d7a1648b9e7e07a4a365b2e1257"
- 
--[[package]]
--name = "easy-parallel"
--version = "3.2.0"
--source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "6907e25393cdcc1f4f3f513d9aac1e840eb1cc341a0fccb01171f7d14d10b946"
--
- [[package]]
- name = "either"
- version = "1.6.1"
-@@ -375,14 +341,14 @@ version = "0.8.31"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "9852635589dc9f9ea1b6fe9f05b50ef208c85c834a562f0c6abb1c475736ec2b"
- dependencies = [
-- "cfg-if",
-+ "cfg-if 1.0.0",
- ]
- 
- [[package]]
- name = "enumflags2"
--version = "0.7.5"
-+version = "0.6.4"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "e75d4cd21b95383444831539909fbb14b9dc3fdceb2a6f5d36577329a1f55ccb"
-+checksum = "83c8d82922337cd23a15f88b70d8e4ef5f11da38dd7cdb55e84dd5de99695da0"
- dependencies = [
-  "enumflags2_derive",
-  "serde",
-@@ -390,9 +356,9 @@ dependencies = [
- 
- [[package]]
- name = "enumflags2_derive"
--version = "0.7.4"
-+version = "0.6.4"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "f58dc3c5e468259f19f2d46304a6b28f1c3d034442e14b322d2b850e36f6d5ae"
-+checksum = "946ee94e3dbf58fdd324f9ce245c7b238d46a66f00e86a020b71996349e46cce"
- dependencies = [
-  "proc-macro2",
-  "quote",
-@@ -412,12 +378,6 @@ dependencies = [
-  "termcolor",
- ]
- 
--[[package]]
--name = "event-listener"
--version = "2.5.2"
--source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "77f3309417938f28bf8228fcff79a4a37103981e3e186d2ccd19c74b38f4eb71"
--
- [[package]]
- name = "fastrand"
- version = "1.7.0"
-@@ -433,9 +393,9 @@ version = "0.2.16"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "c0408e2626025178a6a7f7ffc05a25bc47103229f19c113755de7bf63816290c"
- dependencies = [
-- "cfg-if",
-+ "cfg-if 1.0.0",
-  "libc",
-- "redox_syscall",
-+ "redox_syscall 0.2.13",
-  "winapi",
- ]
- 
-@@ -445,7 +405,7 @@ version = "1.0.23"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "b39522e96686d38f4bc984b9198e3a0613264abaebaff2c5c918bfa6b6da09af"
- dependencies = [
-- "cfg-if",
-+ "cfg-if 1.0.0",
-  "crc32fast",
-  "libc",
-  "miniz_oxide",
-@@ -467,12 +427,6 @@ dependencies = [
-  "percent-encoding",
- ]
- 
--[[package]]
--name = "fuchsia-cprng"
--version = "0.1.1"
--source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "a06f77d526c1a601b7c4cdd98f54b5eaabffc14d5f2f0296febdc7f357c6d3ba"
--
- [[package]]
- name = "futures"
- version = "0.3.21"
-@@ -577,13 +531,24 @@ dependencies = [
-  "slab",
- ]
- 
-+[[package]]
-+name = "getrandom"
-+version = "0.1.16"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "8fc3cb4d91f53b50155bdcfd23f6a4c39ae1969c2ae85982b135750cccaf5fce"
-+dependencies = [
-+ "cfg-if 1.0.0",
-+ "libc",
-+ "wasi 0.9.0+wasi-snapshot-preview1",
-+]
-+
- [[package]]
- name = "getrandom"
- version = "0.2.6"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "9be70c98951c83b8d2f8f60d7065fa6d5146873094452a1008da8c2f1e4205ad"
- dependencies = [
-- "cfg-if",
-+ "cfg-if 1.0.0",
-  "libc",
-  "wasi 0.10.0+wasi-snapshot-preview1",
- ]
-@@ -652,12 +617,6 @@ dependencies = [
-  "libc",
- ]
- 
--[[package]]
--name = "hex"
--version = "0.4.3"
--source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
--
- [[package]]
- name = "http"
- version = "0.2.7"
-@@ -777,7 +736,7 @@ version = "0.1.12"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "7a5bbe824c507c5da5956355e86a746d82e0e1464f65d862cc5e71da70e94b2c"
- dependencies = [
-- "cfg-if",
-+ "cfg-if 1.0.0",
- ]
- 
- [[package]]
-@@ -813,36 +772,25 @@ version = "0.2.125"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "5916d2ae698f6de9bfb891ad7a8d65c09d232dc58cc4ac433c7da3b2fd84bc2b"
- 
--[[package]]
--name = "lock_api"
--version = "0.4.7"
--source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "327fa5b6a6940e4699ec49a9beae1ea4845c6bab9314e4f84ac68742139d8c53"
--dependencies = [
-- "autocfg",
-- "scopeguard",
--]
--
- [[package]]
- name = "log"
- version = "0.4.17"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "abb12e687cfb44aa40f41fc3978ef76448f9b6038cad6aef4259d3c095a2382e"
- dependencies = [
-- "cfg-if",
-+ "cfg-if 1.0.0",
- ]
- 
- [[package]]
- name = "mac-notification-sys"
--version = "0.5.0"
-+version = "0.3.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "297c13fc8ff9fa8b2d0e53850f80e0aa962628e865d447031ce58cdb062e5b29"
-+checksum = "3dfb6b71a9a89cd38b395d994214297447e8e63b1ba5708a9a2b0b1048ceda76"
- dependencies = [
-  "cc",
-- "dirs-next",
-+ "chrono",
-+ "dirs",
-  "objc-foundation",
-- "objc_id",
-- "time 0.3.9",
- ]
- 
- [[package]]
-@@ -902,17 +850,27 @@ dependencies = [
-  "windows-sys",
- ]
- 
-+[[package]]
-+name = "nb-connect"
-+version = "1.2.0"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "b1bb540dc6ef51cfe1916ec038ce7a620daf3a111e2502d745197cd53d6bca15"
-+dependencies = [
-+ "libc",
-+ "socket2",
-+]
-+
- [[package]]
- name = "nix"
--version = "0.23.1"
-+version = "0.17.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "9f866317acbd3a240710c63f065ffb1e4fd466259045ccb504130b7f668f35c6"
-+checksum = "50e4785f2c3b7589a0d0c1dd60285e1188adac4006e8abd6dd578e1567027363"
- dependencies = [
-  "bitflags",
-  "cc",
-- "cfg-if",
-+ "cfg-if 0.1.10",
-  "libc",
-- "memoffset",
-+ "void",
- ]
- 
- [[package]]
-@@ -922,16 +880,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "8f17df307904acd05aa8e32e97bb20f2a0df1728bbc2d771ae8f9a90463441e9"
- dependencies = [
-  "bitflags",
-- "cfg-if",
-+ "cfg-if 1.0.0",
-  "libc",
-  "memoffset",
- ]
- 
- [[package]]
- name = "notify-rust"
--version = "4.5.8"
-+version = "4.5.5"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "a995a3d2834cefa389218e7a35156e8ce544bc95f836900da01ee0b26a07e9d4"
-+checksum = "ca6ebab865e67efdd7182a88d76cadbdd2a8d02d1c7a4e16bb7c234016a12cac"
- dependencies = [
-  "mac-notification-sys",
-  "serde",
-@@ -1030,16 +988,6 @@ dependencies = [
-  "hashbrown 0.12.1",
- ]
- 
--[[package]]
--name = "ordered-stream"
--version = "0.0.1"
--source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "44630c059eacfd6e08bdaa51b1db2ce33119caa4ddc1235e923109aa5f25ccb1"
--dependencies = [
-- "futures-core",
-- "pin-project-lite",
--]
--
- [[package]]
- name = "os_str_bytes"
- version = "6.0.1"
-@@ -1052,31 +1000,6 @@ version = "2.0.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "427c3892f9e783d91cc128285287e70a59e206ca452770ece88a76f7a3eddd72"
- 
--[[package]]
--name = "parking_lot"
--version = "0.11.2"
--source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "7d17b78036a60663b797adeaee46f5c9dfebb86948d1255007a1d6be0271ff99"
--dependencies = [
-- "instant",
-- "lock_api",
-- "parking_lot_core",
--]
--
--[[package]]
--name = "parking_lot_core"
--version = "0.8.5"
--source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "d76e8e1493bcac0d2766c42737f34458f1c8c50c0d23bcb24ea953affb273216"
--dependencies = [
-- "cfg-if",
-- "instant",
-- "libc",
-- "redox_syscall",
-- "smallvec",
-- "winapi",
--]
--
- [[package]]
- name = "parselnk"
- version = "0.1.1"
-@@ -1114,19 +1037,13 @@ version = "2.2.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "685404d509889fade3e86fe3a5803bca2ec09b0c0778d5ada6ec8bf7a8de5259"
- dependencies = [
-- "cfg-if",
-+ "cfg-if 1.0.0",
-  "libc",
-  "log",
-  "wepoll-ffi",
-  "winapi",
- ]
- 
--[[package]]
--name = "ppv-lite86"
--version = "0.2.16"
--source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "eb9f9e6e233e5c4a35559a617bf40a4ec447db2e84c20b55a6f83167b7e57872"
--
- [[package]]
- name = "pretty_env_logger"
- version = "0.4.0"
-@@ -1137,6 +1054,15 @@ dependencies = [
-  "log",
- ]
- 
-+[[package]]
-+name = "proc-macro-crate"
-+version = "0.1.5"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "1d6ea3c4595b96363c13943497db34af4460fb474a95c43f4446ad341b8c9785"
-+dependencies = [
-+ "toml",
-+]
-+
- [[package]]
- name = "proc-macro-crate"
- version = "1.1.3"
-@@ -1205,79 +1131,29 @@ dependencies = [
- ]
- 
- [[package]]
--name = "rand"
--version = "0.4.6"
--source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "552840b97013b1a26992c11eac34bdd778e464601a4c2054b5f0bff7c6761293"
--dependencies = [
-- "fuchsia-cprng",
-- "libc",
-- "rand_core 0.3.1",
-- "rdrand",
-- "winapi",
--]
--
--[[package]]
--name = "rand"
--version = "0.8.5"
--source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
--dependencies = [
-- "libc",
-- "rand_chacha",
-- "rand_core 0.6.3",
--]
--
--[[package]]
--name = "rand_chacha"
--version = "0.3.1"
--source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
--dependencies = [
-- "ppv-lite86",
-- "rand_core 0.6.3",
--]
--
--[[package]]
--name = "rand_core"
--version = "0.3.1"
--source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "7a6fdeb83b075e8266dcc8762c22776f6877a63111121f5f8c7411e5be7eed4b"
--dependencies = [
-- "rand_core 0.4.2",
--]
--
--[[package]]
--name = "rand_core"
--version = "0.4.2"
-+name = "redox_syscall"
-+version = "0.1.57"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "9c33a3c44ca05fa6f1807d8e6743f3824e8509beca625669633be0acbdf509dc"
-+checksum = "41cc0f7e4d5d4544e8861606a285bb08d3e70712ccc7d2b84d7c0ccfaf4b05ce"
- 
- [[package]]
--name = "rand_core"
--version = "0.6.3"
--source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "d34f1408f55294453790c48b2f1ebbb1c5b4b7563eb1f418bcfcfdbb06ebb4e7"
--dependencies = [
-- "getrandom",
--]
--
--[[package]]
--name = "rdrand"
--version = "0.4.0"
-+name = "redox_syscall"
-+version = "0.2.13"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "678054eb77286b51581ba43620cc911abf02758c91f93f479767aed0f90458b2"
-+checksum = "62f25bc4c7e55e0b0b7a1d43fb893f4fa1361d0abe38b9ce4f323c2adfe6ef42"
- dependencies = [
-- "rand_core 0.3.1",
-+ "bitflags",
- ]
- 
- [[package]]
--name = "redox_syscall"
--version = "0.2.13"
-+name = "redox_users"
-+version = "0.3.5"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "62f25bc4c7e55e0b0b7a1d43fb893f4fa1361d0abe38b9ce4f323c2adfe6ef42"
-+checksum = "de0737333e7a9502c789a36d7c7fa6092a49895d4faa31ca5df163857ded2e9d"
- dependencies = [
-- "bitflags",
-+ "getrandom 0.1.16",
-+ "redox_syscall 0.1.57",
-+ "rust-argon2",
- ]
- 
- [[package]]
-@@ -1286,8 +1162,8 @@ version = "0.4.3"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "b033d837a7cf162d7993aded9304e30a83213c648b6e389db233191f891e5c2b"
- dependencies = [
-- "getrandom",
-- "redox_syscall",
-+ "getrandom 0.2.6",
-+ "redox_syscall 0.2.13",
-  "thiserror",
- ]
- 
-@@ -1370,13 +1246,25 @@ dependencies = [
-  "winapi",
- ]
- 
-+[[package]]
-+name = "rust-argon2"
-+version = "0.8.3"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "4b18820d944b33caa75a71378964ac46f58517c92b6ae5f762636247c09e78fb"
-+dependencies = [
-+ "base64",
-+ "blake2b_simd",
-+ "constant_time_eq",
-+ "crossbeam-utils",
-+]
-+
- [[package]]
- name = "rust-ini"
- version = "0.18.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "f6d5f2436026b4f6e79dc829837d467cc7e9a55ee40e750d716713540715a2df"
- dependencies = [
-- "cfg-if",
-+ "cfg-if 1.0.0",
-  "ordered-multimap",
- ]
- 
-@@ -1423,10 +1311,10 @@ dependencies = [
- ]
- 
- [[package]]
--name = "scopeguard"
--version = "1.1.0"
-+name = "scoped-tls"
-+version = "1.0.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
-+checksum = "ea6a9290e3c9cf0f18145ef7ffa62d68ee0bf5fcd651017e586dc7fd5da448c2"
- 
- [[package]]
- name = "sct"
-@@ -1519,21 +1407,6 @@ dependencies = [
-  "serde",
- ]
- 
--[[package]]
--name = "sha1"
--version = "0.6.1"
--source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "c1da05c97445caa12d05e848c4a4fcbbea29e748ac28f7e80e9b010392063770"
--dependencies = [
-- "sha1_smol",
--]
--
--[[package]]
--name = "sha1_smol"
--version = "1.0.0"
--source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "ae1a47186c03a32177042e55dbc5fd5aee900b8e0069a8d70fba96a9375cd012"
--
- [[package]]
- name = "shellexpand"
- version = "2.1.0"
-@@ -1558,12 +1431,6 @@ version = "0.4.6"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "eb703cfe953bccee95685111adeedb76fabe4e97549a58d16f03ea7b9367bb32"
- 
--[[package]]
--name = "smallvec"
--version = "1.8.0"
--source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "f2dd574626839106c320a323308629dcb1acfc96e32a8cba364ddc61ac23ee83"
--
- [[package]]
- name = "socket2"
- version = "0.4.4"
-@@ -1667,26 +1534,16 @@ dependencies = [
-  "xattr",
- ]
- 
--[[package]]
--name = "tempdir"
--version = "0.3.7"
--source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "15f2b5fb00ccdf689e0149d1b1b3c03fead81c2b37735d812fa8bddbbf41b6d8"
--dependencies = [
-- "rand 0.4.6",
-- "remove_dir_all",
--]
--
- [[package]]
- name = "tempfile"
- version = "3.3.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "5cdb1ef4eaeeaddc8fbd371e5017057064af0911902ef36b39801f67cc6d79e4"
- dependencies = [
-- "cfg-if",
-+ "cfg-if 1.0.0",
-  "fastrand",
-  "libc",
-- "redox_syscall",
-+ "redox_syscall 0.2.13",
-  "remove_dir_all",
-  "winapi",
- ]
-@@ -1837,7 +1694,7 @@ name = "topgrade"
- version = "9.0.1"
- dependencies = [
-  "anyhow",
-- "cfg-if",
-+ "cfg-if 1.0.0",
-  "chrono",
-  "clap",
-  "console",
-@@ -1879,7 +1736,7 @@ version = "0.1.34"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "5d0ecdcb44a79f0fe9844f0c4f33a342cbcbb5117de8001e6ba0dc2351327d09"
- dependencies = [
-- "cfg-if",
-+ "cfg-if 1.0.0",
-  "pin-project-lite",
-  "tracing-attributes",
-  "tracing-core",
-@@ -1911,16 +1768,6 @@ version = "0.2.3"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "59547bce71d9c38b83d9c0e92b6066c4253371f15005def0c30d9657f50c7642"
- 
--[[package]]
--name = "uds_windows"
--version = "1.0.1"
--source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "486992108df0fe0160680af1941fe856c521be931d5a5ecccefe0de86dc47e4a"
--dependencies = [
-- "tempdir",
-- "winapi",
--]
--
- [[package]]
- name = "unicode-bidi"
- version = "0.3.8"
-@@ -1978,6 +1825,12 @@ version = "0.9.4"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
- 
-+[[package]]
-+name = "void"
-+version = "1.0.2"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "6a02e4885ed3bc0f2de90ea6dd45ebcbb66dacffe03547fadbb0eeae2770887d"
-+
- [[package]]
- name = "waker-fn"
- version = "1.1.0"
-@@ -2005,6 +1858,12 @@ dependencies = [
-  "try-lock",
- ]
- 
-+[[package]]
-+name = "wasi"
-+version = "0.9.0+wasi-snapshot-preview1"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "cccddf32554fecc6acb585f82a32a72e28b48f8c4c1883ddfeeeaa96f7d8e519"
-+
- [[package]]
- name = "wasi"
- version = "0.10.0+wasi-snapshot-preview1"
-@@ -2023,7 +1882,7 @@ version = "0.2.80"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "27370197c907c55e3f1a9fbe26f44e937fe6451368324e009cba39e139dc08ad"
- dependencies = [
-- "cfg-if",
-+ "cfg-if 1.0.0",
-  "wasm-bindgen-macro",
- ]
- 
-@@ -2048,7 +1907,7 @@ version = "0.4.30"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "6f741de44b75e14c35df886aff5f1eb73aa114fa5d4d00dcd37b5e01259bf3b2"
- dependencies = [
-- "cfg-if",
-+ "cfg-if 1.0.0",
-  "js-sys",
-  "wasm-bindgen",
-  "web-sys",
-@@ -2285,66 +2144,39 @@ checksum = "d2d7d3948613f75c98fd9328cfdcc45acc4d360655289d0a7d4ec931392200a3"
- 
- [[package]]
- name = "zbus"
--version = "2.2.0"
-+version = "1.9.1"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "53819092b9db813b2c6168b097b4b13ad284d81c9f2b0165a0a1b190e505a1f3"
-+checksum = "2326acc379a3ac4e34b794089f5bdb17086bf29a5fdf619b7b4cc772dc2e9dad"
- dependencies = [
-- "async-broadcast",
-- "async-channel",
-- "async-executor",
-  "async-io",
-- "async-lock",
-- "async-recursion",
-- "async-task",
-- "async-trait",
-  "byteorder",
-  "derivative",
-  "enumflags2",
-- "event-listener",
-- "futures-core",
-- "futures-sink",
-- "futures-util",
-- "hex",
-- "lazy_static",
-- "nix 0.23.1",
-+ "fastrand",
-+ "futures",
-+ "nb-connect",
-+ "nix 0.17.0",
-  "once_cell",
-- "ordered-stream",
-- "rand 0.8.5",
-+ "polling",
-+ "scoped-tls",
-  "serde",
-  "serde_repr",
-- "sha1",
-- "static_assertions",
-- "uds_windows",
-- "winapi",
-  "zbus_macros",
-- "zbus_names",
-  "zvariant",
- ]
- 
- [[package]]
- name = "zbus_macros"
--version = "2.2.0"
-+version = "1.9.1"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "c7174ebe6722c280d6d132d694bb5664ce50a788cb70eeb518e7fc1ca095a114"
-+checksum = "a482c56029e48681b89b92b5db3c446db0915e8dd1052c0328a574eda38d5f93"
- dependencies = [
-- "proc-macro-crate",
-+ "proc-macro-crate 0.1.5",
-  "proc-macro2",
-  "quote",
-- "regex",
-  "syn",
- ]
- 
--[[package]]
--name = "zbus_names"
--version = "2.1.0"
--source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "45dfcdcf87b71dad505d30cc27b1b7b88a64b6d1c435648f48f9dbc1fdc4b7e1"
--dependencies = [
-- "serde",
-- "static_assertions",
-- "zvariant",
--]
--
- [[package]]
- name = "zip"
- version = "0.6.2"
-@@ -2360,9 +2192,9 @@ dependencies = [
- 
- [[package]]
- name = "zvariant"
--version = "3.2.1"
-+version = "2.10.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "cbd1abd8bc2c855412b9c8af9fc11c0d695c73c732ad5a1a1be10f3fd4bf19b2"
-+checksum = "a68c7b55f2074489b7e8e07d2d0a6ee6b4f233867a653c664d8020ba53692525"
- dependencies = [
-  "byteorder",
-  "enumflags2",
-@@ -2374,11 +2206,11 @@ dependencies = [
- 
- [[package]]
- name = "zvariant_derive"
--version = "3.2.1"
-+version = "2.10.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "abebd57382dfacf3e7bbdd7b7c3d162d6ed0687a78f046263ddef4ddabc275ae"
-+checksum = "e4ca5e22593eb4212382d60d26350065bf2a02c34b85bc850474a74b589a3de9"
- dependencies = [
-- "proc-macro-crate",
-+ "proc-macro-crate 1.1.3",
-  "proc-macro2",
-  "quote",
-  "syn",
diff --git a/pkgs/tools/misc/topgrade/default.nix b/pkgs/tools/misc/topgrade/default.nix
index 9d4287427fbc..5bdca2a0418f 100644
--- a/pkgs/tools/misc/topgrade/default.nix
+++ b/pkgs/tools/misc/topgrade/default.nix
@@ -2,6 +2,7 @@
 , lib
 , fetchFromGitHub
 , rustPlatform
+, AppKit
 , Cocoa
 , Foundation
 , installShellFiles
@@ -9,29 +10,31 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "topgrade";
-  version = "9.0.1";
+  version = "9.1.1";
 
   src = fetchFromGitHub {
-    owner = "r-darwish";
-    repo = pname;
+    owner = "topgrade-rs";
+    repo = "topgrade";
     rev = "v${version}";
-    sha256 = "sha256-9zP+rWhaK4fC2Qhd0oq9WVvCkvryooYo09k7016Rbxw=";
+    sha256 = "sha256-0WI05bfnCKjsUJJyurnouVE/wkCJZ+6DStQMPBNI+Bs=";
   };
 
-  cargoPatches = [ ./darwin-cargo-lock.patch ];
-  cargoSha256 = "sha256-rkcEF/INNVn9K4p0/1M++l6lnjtZp1Srx57gkaqcKek=";
-
-  buildInputs = lib.optionals stdenv.isDarwin [ Cocoa Foundation ];
+  cargoSha256 = "sha256-EVnH1YT5ivuBhhd54sho/1x4ZPhrdrWjE40FGL9HXRc=";
 
   nativeBuildInputs = [ installShellFiles ];
 
+  buildInputs = lib.optionals stdenv.isDarwin [ AppKit Cocoa Foundation ];
+
+  NIX_CFLAGS_COMPILE = lib.optionals stdenv.isDarwin [ "-framework" "AppKit" ];
+
   postInstall = ''
+    ln -rs $out/bin/topgrade-rs $out/bin/topgrade
     installManPage topgrade.8
   '';
 
   meta = with lib; {
     description = "Upgrade all the things";
-    homepage = "https://github.com/r-darwish/topgrade";
+    homepage = "https://github.com/topgrade-rs/topgrade";
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ SuperSandro2000 xyenon ];
   };
diff --git a/pkgs/tools/networking/dnsproxy/default.nix b/pkgs/tools/networking/dnsproxy/default.nix
index 6f7b4b65f9c9..b6446f7c9e86 100644
--- a/pkgs/tools/networking/dnsproxy/default.nix
+++ b/pkgs/tools/networking/dnsproxy/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "dnsproxy";
-  version = "0.46.0";
+  version = "0.46.1";
 
   src = fetchFromGitHub {
     owner = "AdguardTeam";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-2Oa94dOvvNyrm0CA8rjVPo4smkGpK6yTQFRewNvHYdY=";
+    sha256 = "sha256-MTnxKw1aH1DfUNCf3Rcrb93ShAsQ3/pJTpYB3LAu894=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/tools/package-management/nfpm/default.nix b/pkgs/tools/package-management/nfpm/default.nix
index d7e119a046d5..0fa63f3367ba 100644
--- a/pkgs/tools/package-management/nfpm/default.nix
+++ b/pkgs/tools/package-management/nfpm/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "nfpm";
-  version = "2.19.2";
+  version = "2.20.0";
 
   src = fetchFromGitHub {
     owner = "goreleaser";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-SCa60HOLs8+uxVmFs73UmUjS4j9v2XmKas+SLmM1xTI=";
+    sha256 = "sha256-yNSwJBN8ZgZHH62/Z8Tkg8e29Ee0mF4YwCFm+xXXsTU=";
   };
 
-  vendorSha256 = "sha256-+Aq54AAZ4094xZpTEOD63mHSff3Cm0oOQneJjGTe0To=";
+  vendorSha256 = "sha256-gepSzWqmG2nxej/D748w19fpt2sUGLThj9J57hOnBnw=";
 
   ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 
diff --git a/pkgs/tools/security/cloudfox/default.nix b/pkgs/tools/security/cloudfox/default.nix
index 1b0dcf86a170..bf461f1d0af5 100644
--- a/pkgs/tools/security/cloudfox/default.nix
+++ b/pkgs/tools/security/cloudfox/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "cloudfox";
-  version = "1.7.2";
+  version = "1.8.1";
 
   src = fetchFromGitHub {
     owner = "BishopFox";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-QntRCiY6le3gCuWoNT27WD/p4huxjCDFb24Sj/8luMs=";
+    hash = "sha256-eWo5l3yFEW7ztyYvN1zGGOhCzkJW7rUqaQ+2BPB7BWY=";
   };
 
-  vendorSha256 = "sha256-89VQ7RH2TTYME+fH1S0KHAIfUYXV6Oi72kz70JVBXTs=";
+  vendorSha256 = "sha256-ATHQUvUBDZh06LtWLAA1UyHU1c4LME0z/FsygQQJQy8=";
 
   # Some tests are failing because of wrong filename/path
   doCheck = false;
diff --git a/pkgs/tools/security/dirstalk/default.nix b/pkgs/tools/security/dirstalk/default.nix
index 59ad831b7a1e..1397a0b8aa9e 100644
--- a/pkgs/tools/security/dirstalk/default.nix
+++ b/pkgs/tools/security/dirstalk/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildGoModule
 , fetchFromGitHub
+, fetchpatch
 }:
 
 buildGoModule rec {
@@ -14,7 +15,15 @@ buildGoModule rec {
     hash = "sha256-gSMkTGzMDI+scG3FQ0u0liUDL4qOPPW2UWLlAQcmmaA=";
   };
 
-  vendorHash = "sha256-nesKIaMMuN71LpvX8nOm7hDecgGjnx3tmsinrJg4GpQ=";
+  patches = [
+    # update dependencies to fix darwin build - remove in next release
+    (fetchpatch {
+      url = "https://github.com/stefanoj3/dirstalk/commit/79aef14c5c048f3a3a8374f42c7a0d52fc9f7b50.patch";
+      sha256 = "sha256-2rSrMowfYdKV69Yg2QBzam3WOwGrSHQB+3uVi1Z2oJ8=";
+    })
+  ];
+
+  vendorHash = "sha256-XY4vIh5de0tp4KPXTpzTm7/2bDisTjCsojLzxVDf4Jw=";
 
   subPackages = "cmd/dirstalk";
 
diff --git a/pkgs/tools/security/terrascan/default.nix b/pkgs/tools/security/terrascan/default.nix
index 573f0324969d..21abae88c7af 100644
--- a/pkgs/tools/security/terrascan/default.nix
+++ b/pkgs/tools/security/terrascan/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "terrascan";
-  version = "1.15.2";
+  version = "1.16.0";
 
   src = fetchFromGitHub {
     owner = "accurics";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-lxieqHOmkazkBnwfKLVYy0TE7rfrKcLBENeABdmWpXI=";
+    sha256 = "sha256-J54x3t3tgo5CUnYEhduOGw23MhAiqq/XudGmSQ3ENbs=";
   };
 
-  vendorSha256 = "sha256-EfHcCk2NkicSPeJYgHJT2kh9EwLldksET75ZQambrWA=";
+  vendorSha256 = "sha256-0ZwTE2FrBung7HAlklGIJlX76eRWa0ALNWjZpZijkzA=";
 
   # Tests want to download a vulnerable Terraform project
   doCheck = false;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index f8ec850d1661..a0a216da124e 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10884,7 +10884,11 @@ with pkgs;
 
   rnnoise = callPackage ../development/libraries/rnnoise { };
 
-  rnnoise-plugin = callPackage ../development/libraries/rnnoise-plugin {};
+  # Use `apple_sdk_11_0` because `apple_sdk.libs` does not provide `simd`
+  rnnoise-plugin = darwin.apple_sdk_11_0.callPackage ../development/libraries/rnnoise-plugin {
+    inherit (darwin.apple_sdk_11_0.frameworks) WebKit MetalKit CoreAudioKit;
+    inherit (darwin.apple_sdk_11_0.libs) simd;
+  };
 
   rnote = callPackage ../applications/graphics/rnote {
     inherit (gst_all_1) gstreamer;
@@ -11975,7 +11979,7 @@ with pkgs;
   toml2nix = callPackage ../development/tools/toml2nix { };
 
   topgrade = callPackage ../tools/misc/topgrade {
-    inherit (darwin.apple_sdk.frameworks) Cocoa Foundation;
+    inherit (darwin.apple_sdk.frameworks) AppKit Cocoa Foundation;
   };
 
   top-git = callPackage ../applications/version-management/git-and-tools/topgit { };
@@ -16301,6 +16305,8 @@ with pkgs;
     wxGTK = wxGTK30;
   };
 
+  bossa-arduino = callPackage ../development/embedded/bossa/arduino.nix { };
+
   bob = callPackage ../development/tools/build-managers/bob { };
 
   buck = callPackage ../development/tools/build-managers/buck { };
@@ -23291,9 +23297,7 @@ with pkgs;
 
   dodgy = with python3Packages; toPythonApplication dodgy;
 
-  dovecot = callPackage ../servers/mail/dovecot {
-    openssl = openssl_1_1;
-  };
+  dovecot = callPackage ../servers/mail/dovecot { };
   dovecot_pigeonhole = callPackage ../servers/mail/dovecot/plugins/pigeonhole { };
   dovecot_fts_xapian = callPackage ../servers/mail/dovecot/plugins/fts_xapian { };
 
@@ -23718,6 +23722,8 @@ with pkgs;
   opensmtpd = callPackage ../servers/mail/opensmtpd { };
   opensmtpd-extras = callPackage ../servers/mail/opensmtpd/extras.nix { };
   opensmtpd-filter-rspamd = callPackage ../servers/mail/opensmtpd/filter-rspamd.nix { };
+  opensmtpd-filter-dkimsign = callPackage ../servers/mail/opensmtpd/filter-dkimsign { };
+  libopensmtpd = callPackage ../servers/mail/opensmtpd/libopensmtpd { };
 
   openxr-loader = callPackage ../development/libraries/openxr-loader { };
 
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index e305ffc5ab4b..979026baca3c 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -1442,6 +1442,12 @@ let
 
     tezos-base58 = callPackage ../development/ocaml-modules/tezos-base58 { };
 
+    tezos-bls12-381-polynomial = callPackage ../development/ocaml-modules/tezos-bls12-381-polynomial { };
+
+    tezos-plompiler = callPackage ../development/ocaml-modules/tezos-bls12-381-polynomial/plompiler.nix { };
+
+    tezos-plonk = callPackage ../development/ocaml-modules/tezos-bls12-381-polynomial/plonk.nix { };
+
     theora = callPackage ../development/ocaml-modules/theora { };
 
     toml = callPackage ../development/ocaml-modules/toml { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 78c2ade1037a..921cf434734a 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -7128,6 +7128,8 @@ in {
 
   python-flirt = callPackage ../development/python-modules/python-flirt { };
 
+  python-fullykiosk = callPackage ../development/python-modules/python-fullykiosk { };
+
   python-glanceclient = callPackage ../development/python-modules/python-glanceclient { };
 
   python-google-nest = callPackage ../development/python-modules/python-google-nest { };