diff --git a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
index c234cda499f8..31093bdbd013 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@@ -238,6 +238,13 @@
           <link xlink:href="options.html#opt-services.headscale.enable">services.headscale</link>
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <link xlink:href="https://0xerr0r.github.io/blocky/">blocky</link>,
+          fast and lightweight DNS proxy as ad-blocker for local network
+          with many features.
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
   <section xml:id="sec-release-22.05-incompatibilities">
diff --git a/nixos/doc/manual/release-notes/rl-2205.section.md b/nixos/doc/manual/release-notes/rl-2205.section.md
index 567a6d6780a1..258cd2fe3166 100644
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@@ -71,6 +71,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [headscale](https://github.com/juanfont/headscale), an Open Source implementation of the [Tailscale](https://tailscale.io) Control Server. Available as [services.headscale](options.html#opt-services.headscale.enable)
 
+- [blocky](https://0xerr0r.github.io/blocky/), fast and lightweight DNS proxy as ad-blocker for local network with many features.
+
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
 ## Backward Incompatibilities {#sec-release-22.05-incompatibilities}
diff --git a/nixos/lib/test-driver/test_driver/machine.py b/nixos/lib/test-driver/test_driver/machine.py
index b730c4b44d7f..569a0f3c61e4 100644
--- a/nixos/lib/test-driver/test_driver/machine.py
+++ b/nixos/lib/test-driver/test_driver/machine.py
@@ -241,9 +241,15 @@ class LegacyStartCommand(StartCommand):
         cdrom: Optional[str] = None,
         usb: Optional[str] = None,
         bios: Optional[str] = None,
+        qemuBinary: Optional[str] = None,
         qemuFlags: Optional[str] = None,
     ):
-        self._cmd = "qemu-kvm -m 384"
+        if qemuBinary is not None:
+            self._cmd = qemuBinary
+        else:
+            self._cmd = "qemu-kvm"
+
+        self._cmd += " -m 384"
 
         # networking
         net_backend = "-netdev user,id=net0"
@@ -381,6 +387,7 @@ class Machine:
             cdrom=args.get("cdrom"),
             usb=args.get("usb"),
             bios=args.get("bios"),
+            qemuBinary=args.get("qemuBinary"),
             qemuFlags=args.get("qemuFlags"),
         )
 
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index b6d9bd00629a..ca82ddfb5863 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -718,6 +718,7 @@
   ./services/networking/bird.nix
   ./services/networking/bitlbee.nix
   ./services/networking/blockbook-frontend.nix
+  ./services/networking/blocky.nix
   ./services/networking/charybdis.nix
   ./services/networking/cjdns.nix
   ./services/networking/cntlm.nix
diff --git a/nixos/modules/services/misc/airsonic.nix b/nixos/modules/services/misc/airsonic.nix
index 5a5c30a41233..2b9c6d80abbd 100644
--- a/nixos/modules/services/misc/airsonic.nix
+++ b/nixos/modules/services/misc/airsonic.nix
@@ -39,9 +39,11 @@ in {
         default = "127.0.0.1";
         description = ''
           The host name or IP address on which to bind Airsonic.
-          Only relevant if you have multiple network interfaces and want
-          to make Airsonic available on only one of them. The default value
-          will bind Airsonic to all available network interfaces.
+          The default value is appropriate for first launch, when the
+          default credentials are easy to guess. It is also appropriate
+          if you intend to use the virtualhost option in the service
+          module. In other cases, you may want to change this to a
+          specific IP or 0.0.0.0 to listen on all interfaces.
         '';
       };
 
diff --git a/nixos/modules/services/networking/blocky.nix b/nixos/modules/services/networking/blocky.nix
new file mode 100644
index 000000000000..7488e05fc033
--- /dev/null
+++ b/nixos/modules/services/networking/blocky.nix
@@ -0,0 +1,40 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.blocky;
+
+  format = pkgs.formats.yaml { };
+  configFile = format.generate "config.yaml" cfg.settings;
+in
+{
+  options.services.blocky = {
+    enable = mkEnableOption "Fast and lightweight DNS proxy as ad-blocker for local network with many features";
+
+    settings = mkOption {
+      type = format.type;
+      default = { };
+      description = ''
+        Blocky configuration. Refer to
+        <link xlink:href="https://0xerr0r.github.io/blocky/configuration/"/>
+        for details on supported values.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.blocky = {
+      description = "A DNS proxy and ad-blocker for the local network";
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        DynamicUser = true;
+        ExecStart = "${pkgs.blocky}/bin/blocky --config ${configFile}";
+
+        AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
+        CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
+      };
+    };
+  };
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 520c48bc45b4..a0beaf98de5c 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -52,6 +52,7 @@ in
   bitcoind = handleTest ./bitcoind.nix {};
   bittorrent = handleTest ./bittorrent.nix {};
   blockbook-frontend = handleTest ./blockbook-frontend.nix {};
+  blocky = handleTest ./blocky.nix {};
   boot = handleTestOn ["x86_64-linux" "aarch64-linux"] ./boot.nix {};
   boot-stage1 = handleTest ./boot-stage1.nix {};
   borgbackup = handleTest ./borgbackup.nix {};
diff --git a/nixos/tests/blocky.nix b/nixos/tests/blocky.nix
new file mode 100644
index 000000000000..18e7f45e1c73
--- /dev/null
+++ b/nixos/tests/blocky.nix
@@ -0,0 +1,34 @@
+import ./make-test-python.nix {
+  name = "blocky";
+
+  nodes = {
+    server = { pkgs, ... }: {
+      environment.systemPackages = [ pkgs.dnsutils ];
+      services.blocky = {
+        enable = true;
+
+        settings = {
+          customDNS = {
+            mapping = {
+              "printer.lan" = "192.168.178.3,2001:0db8:85a3:08d3:1319:8a2e:0370:7344";
+            };
+          };
+          upstream = {
+            default = [ "8.8.8.8" "1.1.1.1" ];
+          };
+          port = 53;
+          httpPort = 5000;
+          logLevel = "info";
+        };
+      };
+    };
+  };
+
+  testScript = ''
+    with subtest("Service test"):
+        server.wait_for_unit("blocky.service")
+        server.wait_for_open_port(53)
+        server.wait_for_open_port(5000)
+        server.succeed("dig @127.0.0.1 +short -x 192.168.178.3 | grep -qF printer.lan")
+  '';
+}
diff --git a/pkgs/applications/audio/orca-c/default.nix b/pkgs/applications/audio/orca-c/default.nix
index 420055884b45..be40def26441 100644
--- a/pkgs/applications/audio/orca-c/default.nix
+++ b/pkgs/applications/audio/orca-c/default.nix
@@ -13,6 +13,9 @@ stdenv.mkDerivation {
 
   postPatch = ''
     patchShebangs tool
+    sed -i tool \
+      -e 's@ncurses_dir=.*@ncurses_dir="${ncurses}"@' \
+      -e 's@portmidi_dir=.*@portmidi_dir="${portmidi}"@' tool
   '';
 
   installPhase = ''
diff --git a/pkgs/applications/graphics/geeqie/default.nix b/pkgs/applications/graphics/geeqie/default.nix
index 4ed4d257ba52..037cf7c8ed62 100644
--- a/pkgs/applications/graphics/geeqie/default.nix
+++ b/pkgs/applications/graphics/geeqie/default.nix
@@ -1,17 +1,18 @@
 { lib, stdenv, fetchFromGitHub, pkg-config, autoconf, automake, gettext, intltool
 , gtk3, lcms2, exiv2, libchamplain, clutter-gtk, ffmpegthumbnailer, fbida
 , wrapGAppsHook, fetchpatch, bash, doxygen
+, nix-update-script
 }:
 
 stdenv.mkDerivation rec {
   pname = "geeqie";
-  version = "1.7.1";
+  version = "1.7.2";
 
   src = fetchFromGitHub {
     owner = "BestImageViewer";
     repo = "geeqie";
     rev = "v${version}";
-    sha256 = "sha256-0E1TeAhkiK+hFJ4oMoeZLvfRehTzdGF3AtEVwf/MaF8=";
+    sha256 = "sha256-Abr7trlms6bxOAqE6xNKRv51TBGNilNdBhUZUg7OTKY=";
   };
 
   patches = [
@@ -47,6 +48,12 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = pname;
+    };
+  };
+
   meta = with lib; {
     description = "Lightweight GTK based image viewer";
 
diff --git a/pkgs/applications/graphics/gscan2pdf/default.nix b/pkgs/applications/graphics/gscan2pdf/default.nix
index e9c624d3c965..9d8ae0c8d35f 100644
--- a/pkgs/applications/graphics/gscan2pdf/default.nix
+++ b/pkgs/applications/graphics/gscan2pdf/default.nix
@@ -10,11 +10,11 @@ with lib;
 
 perlPackages.buildPerlPackage rec {
   pname = "gscan2pdf";
-  version = "2.12.4";
+  version = "2.12.5";
 
   src = fetchurl {
-    url = "mirror://sourceforge/gscan2pdf/${version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-UrBt0QkSk7IP4mZYFoxFNJQ1Qmcb53CemvlYfsxjZ/s=";
+    url = "mirror://sourceforge/gscan2pdf/gscan2pdf-${version}.tar.xz";
+    sha256 = "sha256-MFWW9DTJ/svtgN3fbw+zeGpgg3pgIoC9jZ1HkG5p6sc=";
   };
 
   nativeBuildInputs = [ wrapGAppsHook ];
diff --git a/pkgs/applications/misc/logseq/default.nix b/pkgs/applications/misc/logseq/default.nix
index 741a17be9ee4..0ce868ada676 100644
--- a/pkgs/applications/misc/logseq/default.nix
+++ b/pkgs/applications/misc/logseq/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "logseq";
-  version = "0.5.4";
+  version = "0.5.9";
 
   src = fetchurl {
     url = "https://github.com/logseq/logseq/releases/download/${version}/logseq-linux-x64-${version}.AppImage";
-    sha256 = "PGrx2JBYmp5vQ8jLpOfiT1T1+SNeRt0W5oHUjHNKuBE=";
+    sha256 = "e47aaabcd940b54962625e224961e9b95b7f18b99724adbb6334cdc549617389";
     name = "${pname}-${version}.AppImage";
   };
 
diff --git a/pkgs/applications/misc/p2pool/default.nix b/pkgs/applications/misc/p2pool/default.nix
index 184e09a275ff..230ec3182b7a 100644
--- a/pkgs/applications/misc/p2pool/default.nix
+++ b/pkgs/applications/misc/p2pool/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "p2pool";
-  version = "1.6";
+  version = "1.7";
 
   src = fetchFromGitHub {
     owner = "SChernykh";
     repo = "p2pool";
     rev = "v${version}";
-    sha256 = "sha256-SumAHliY2cX2Q1umyw0ljCFmgnGKKHqoEFGglNJ/Bfg=";
+    sha256 = "sha256-ohfC10U7srs5IrFWPF5AKPwXPHaRxlYRK4ZZ0pE8tEs=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/networking/blocky/default.nix b/pkgs/applications/networking/blocky/default.nix
index 8bc0963338fb..842cbe30309d 100644
--- a/pkgs/applications/networking/blocky/default.nix
+++ b/pkgs/applications/networking/blocky/default.nix
@@ -1,6 +1,7 @@
 { buildGoModule
 , fetchFromGitHub
 , lib
+, nixosTests
 }:
 
 buildGoModule rec {
@@ -27,4 +28,6 @@ buildGoModule rec {
     license = licenses.asl20;
     maintainers = with maintainers; [ ratsclub ];
   };
+
+  passthru.tests = { inherit (nixosTests) blocky; };
 }
diff --git a/pkgs/applications/networking/browsers/firefox/librewolf/src.json b/pkgs/applications/networking/browsers/firefox/librewolf/src.json
index c1cb916762ee..bcedf9d22d87 100644
--- a/pkgs/applications/networking/browsers/firefox/librewolf/src.json
+++ b/pkgs/applications/networking/browsers/firefox/librewolf/src.json
@@ -1,11 +1,11 @@
 {
-  "packageVersion": "97.0-2",
+  "packageVersion": "97.0.1-1",
   "source": {
-    "rev": "97.0-2",
-    "sha256": "00fb7xr6hrcyh3s7g52fs6f7a1iggpibj0xafblnl7118fh73g25"
+    "rev": "97.0.1-1",
+    "sha256": "10gbnkmyivawwqn3gf5c98l49b03j70gbniaar8bfl80j8av0v5j"
   },
   "firefox": {
-    "version": "97.0",
-    "sha512": "a913695a42cb06ee9bda2a20e65cc573e40ca93e9f75b7ee0a43ebd1935b371e7e80d5fc8d5f126ad0712ab848635a8624bbeed43807e5c179537aa32c884186"
+    "version": "97.0.1",
+    "sha512": "8620aace77167593aab5acd230860eb3e67eeddc49c0aad0491b5dc20bd0ddb6089dbb8975aed241426f57b2ad772238b04d03b95390175f580cbd80bb6d5f6c"
   }
 }
diff --git a/pkgs/applications/networking/cluster/kube-score/default.nix b/pkgs/applications/networking/cluster/kube-score/default.nix
index 6ef24ded1a67..c1383e8688d1 100644
--- a/pkgs/applications/networking/cluster/kube-score/default.nix
+++ b/pkgs/applications/networking/cluster/kube-score/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kube-score";
-  version = "1.13.0";
+  version = "1.14.0";
 
   src = fetchFromGitHub {
     owner = "zegl";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-QAtsXNmR+Sg9xmvP7x6b2jAJkUcL/sMYk8i5CSzjVos=";
+    sha256 = "sha256-6/+S1aj2qoUPz+6+8Z4Z5dpfyOi/DnrLLUpPgBn/OxU=";
   };
 
-  vendorSha256 = "sha256-kPYvkovzQDmoB67TZHCKZ5jtW6pN3gHxBPKAU8prbgo=";
+  vendorSha256 = "sha256-0Zi62FmX4rFl3os2ehtussSSUPJtxLq7622CEdeKZCs=";
 
   meta = with lib; {
     description = "Kubernetes object analysis with recommendations for improved reliability and security";
diff --git a/pkgs/applications/networking/instant-messengers/session-desktop-appimage/default.nix b/pkgs/applications/networking/instant-messengers/session-desktop-appimage/default.nix
index c998f869d1ea..9126a587dc7a 100644
--- a/pkgs/applications/networking/instant-messengers/session-desktop-appimage/default.nix
+++ b/pkgs/applications/networking/instant-messengers/session-desktop-appimage/default.nix
@@ -5,10 +5,10 @@
 
 appimageTools.wrapType2 rec {
   pname = "session-desktop-appimage";
-  version = "1.7.6";
+  version = "1.7.7";
   src = fetchurl {
     url = "https://github.com/oxen-io/session-desktop/releases/download/v${version}/session-desktop-linux-x86_64-${version}.AppImage";
-    sha256 = "PNjUslqLcSxkRSXFpesBr2sfre4wetZWfUQTjywdClU=";
+    sha256 = "iMJk7/Q3Kh2KwLs0m+DAPVv471iPZcsIs4+YCSbmeIo=";
   };
 
   meta = with lib; {
diff --git a/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix b/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix
index c76393d69f51..9aac3db3594c 100644
--- a/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix
+++ b/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix
@@ -42,11 +42,11 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution";
-  version = "3.42.3";
+  version = "3.42.4";
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "RGKeagIojsEApm/VlBOgaLa5zWJL7TJVqimhZuom0LY=";
+    sha256 = "+oprem1GsinbXfIv3nZCVFIjV/4b7NexjlNt/piJCmU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/science/logic/coq/default.nix b/pkgs/applications/science/logic/coq/default.nix
index fe99b045512b..bdd2796addcd 100644
--- a/pkgs/applications/science/logic/coq/default.nix
+++ b/pkgs/applications/science/logic/coq/default.nix
@@ -130,11 +130,12 @@ self = stdenv.mkDerivation {
 
   nativeBuildInputs = [ pkg-config ]
     ++ optional buildIde copyDesktopItems
+    ++ optional (buildIde && versionAtLeast "8.10") wrapGAppsHook
     ++ optional (!versionAtLeast "8.6") gnumake42;
   buildInputs = [ ncurses ] ++ ocamlBuildInputs
     ++ optionals buildIde
       (if versionAtLeast "8.10"
-       then [ ocamlPackages.lablgtk3-sourceview3 glib gnome.adwaita-icon-theme wrapGAppsHook ]
+       then [ ocamlPackages.lablgtk3-sourceview3 glib gnome.adwaita-icon-theme ]
        else [ ocamlPackages.lablgtk ])
     ++ optional (versionAtLeast "8.14") ocamlPackages.dune_2
   ;
diff --git a/pkgs/applications/version-management/mercurial/default.nix b/pkgs/applications/version-management/mercurial/default.nix
index 5f28580c7d40..80c2679d05cf 100644
--- a/pkgs/applications/version-management/mercurial/default.nix
+++ b/pkgs/applications/version-management/mercurial/default.nix
@@ -21,11 +21,11 @@ let
 
   self = python3Packages.buildPythonApplication rec {
     pname = "mercurial";
-    version = "6.0.2";
+    version = "6.0.3";
 
     src = fetchurl {
       url = "https://mercurial-scm.org/release/mercurial-${version}.tar.gz";
-      sha256 = "sha256-X7TDbThWKS6/WEBR1ZMG2WrYqjK1U3RSsdnEdvlasRo=";
+      sha256 = "sha256-Z/E2R6RlF6K1Z83Lc8mHIdddNqBDLeuxUCK3f5wTgzM=";
     };
 
     format = "other";
@@ -35,7 +35,7 @@ let
     cargoDeps = if rustSupport then rustPlatform.fetchCargoTarball {
       inherit src;
       name = "${pname}-${version}";
-      sha256 = "sha256-rIG57oPCTUz4HNJyuMBPlKTSh02ecF5052Q1P9wGq1s=";
+      sha256 = "sha256-i4WROxezeqLX4hTdcPrqsf6dBqsNZz6fFAPzItYuklE=";
       sourceRoot = "${pname}-${version}/rust";
     } else null;
     cargoRoot = if rustSupport then "rust" else null;
diff --git a/pkgs/desktops/cinnamon/nemo/default.nix b/pkgs/desktops/cinnamon/nemo/default.nix
index 47e43758447c..e8bf145e5028 100644
--- a/pkgs/desktops/cinnamon/nemo/default.nix
+++ b/pkgs/desktops/cinnamon/nemo/default.nix
@@ -24,7 +24,7 @@
 
 stdenv.mkDerivation rec {
   pname = "nemo";
-  version = "5.2.3";
+  version = "5.2.4";
 
   # TODO: add plugins support (see https://github.com/NixOS/nixpkgs/issues/78327)
 
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
     owner = "linuxmint";
     repo = pname;
     rev = version;
-    sha256 = "sha256-kPxwWciNf4KQx3JG1qPQcZJeOa4B+udMyQmH8A7JcfQ=";
+    sha256 = "sha256-v63dFiBKtLCmRnwJ6u814lSv+tfPG+IIJtcWCnOEZjk=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/compilers/swift/default.nix b/pkgs/development/compilers/swift/default.nix
index a72ae7d52aba..e3a9aa2b486c 100644
--- a/pkgs/development/compilers/swift/default.nix
+++ b/pkgs/development/compilers/swift/default.nix
@@ -52,7 +52,7 @@ let
   # - integration-tests
 
   versions = {
-    swift = "5.5.2";
+    swift = "5.5.3";
     yams = "4.0.2";
     argumentParser = "0.4.3";
     format = "swift-5.5-branch";
@@ -79,7 +79,7 @@ let
 
     swift = fetchSwiftRelease {
       repo = "swift";
-      sha256 = "1a9ja3r6ap4cappbvlk18krlvwi0q75z21j5yx5rhbnw4ihh7lda";
+      sha256 = "0ma96sfvwiv2f4qhzrvcwxi9igzd80930gnaw4r7ra4w190cnag7";
     };
     cmark = fetchSwiftRelease {
       repo = "swift-cmark";
@@ -99,7 +99,7 @@ let
     };
     swiftpm = fetchSwiftRelease {
       repo = "swift-package-manager";
-      sha256 = "0hdjvb2asfi6h3x9bjssxkc3bgjn3idlmyga3dl3lscfq88hjxr9";
+      sha256 = "0z90mg837jzwh516pypn48r3wsjf0lqymsyigdhgr7j2sgcckrr1";
     };
     syntax = fetchSwiftRelease {
       repo = "swift-syntax";
@@ -111,7 +111,7 @@ let
     };
     corelibsFoundation = fetchSwiftRelease {
       repo = "swift-corelibs-foundation";
-      sha256 = "1f7qcdx8597gwqa9pwl38d31w6w4d84c5hadj4ycj99msrm2f32x";
+      sha256 = "06gkdliihl1l86jx5khzwkjmjk45fq290x033rscramzcdxh7d1b";
     };
     corelibsLibdispatch = fetchSwiftRelease {
       repo = "swift-corelibs-libdispatch";
@@ -128,7 +128,7 @@ let
     };
     llvmProject = fetchSwiftRelease {
       repo = "llvm-project";
-      sha256 = "1gvqps5f9jh6lbhcjh1fyzp3bc0h9chbljzaspcrdi2qp878prlx";
+      sha256 = "18rn5xg5hpxxsacs0ygjmjpzpc8pq85898kknzc0s0z5m55h45z8";
     };
 
     # Projects that have their own versions during each release
diff --git a/pkgs/development/interpreters/racket/default.nix b/pkgs/development/interpreters/racket/default.nix
index 89c81e2b4a24..bd96562d9e5d 100644
--- a/pkgs/development/interpreters/racket/default.nix
+++ b/pkgs/development/interpreters/racket/default.nix
@@ -78,6 +78,13 @@ stdenv.mkDerivation rec {
     # fail to detect its variant at runtime.
     # See: https://github.com/NixOS/nixpkgs/issues/114993#issuecomment-812951247
     ./force-cs-variant.patch
+
+    # The entry point binary $out/bin/racket is codesigned at least once. The
+    # following error is triggered as a result.
+    # (error 'add-ad-hoc-signature "file already has a signature")
+    # We always remove the existing signature then call add-ad-hoc-signature to
+    # circumvent this error.
+    ./force-remove-codesign-then-add.patch
   ];
 
   preConfigure = ''
@@ -90,10 +97,34 @@ stdenv.mkDerivation rec {
         --replace /bin/rm ${coreutils}/bin/rm \
         --replace /bin/true ${coreutils}/bin/true
     done
+
+    # The configure script forces using `libtool -o` as AR on Darwin. But, the
+    # `-o` option is only available from Apple libtool. GNU ar works here.
+    substituteInPlace src/ChezScheme/zlib/configure \
+        --replace 'ARFLAGS="-o"' 'AR=ar; ARFLAGS="rc"'
+
     mkdir src/build
     cd src/build
 
-    gappsWrapperArgs+=("--prefix" "LD_LIBRARY_PATH" ":" ${LD_LIBRARY_PATH})
+  '' + lib.optionalString stdenv.isLinux ''
+    gappsWrapperArgs+=("--prefix"   "LD_LIBRARY_PATH" ":" ${libPath})
+  '' + lib.optionalString stdenv.isDarwin ''
+    gappsWrapperArgs+=("--prefix" "DYLD_LIBRARY_PATH" ":" ${libPath})
+  ''
+  ;
+
+  preBuild = lib.optionalString stdenv.isDarwin ''
+    # Cannot set DYLD_LIBRARY_PATH as an attr of this drv, becasue dynamic
+    # linker environment variables like this are purged.
+    # See: https://apple.stackexchange.com/a/212954/167199
+
+    # Make builders feed it to dlopen(...). Do not expose all of $libPath to
+    # DYLD_LIBRARY_PATH as the order of looking up symbols like
+    # `__cg_jpeg_resync_to_restart` will be messed up. Our libJPEG.dyllib
+    # expects it from our libTIFF.dylib, but instead it could not be found from
+    # the system `libTIFF.dylib`. DYLD_FALLBACK_LIBRARY_PATH has its own problem
+    # , too.
+    export DYLD_FALLBACK_LIBRARY_PATH="${libPath}"
   '';
 
   shared = if stdenv.isDarwin then "dylib" else "shared";
@@ -119,6 +150,6 @@ stdenv.mkDerivation rec {
     homepage = "https://racket-lang.org/";
     license = with licenses; [ asl20 /* or */ mit ];
     maintainers = with maintainers; [ kkallio henrytill vrthra ];
-    platforms = [ "x86_64-darwin" "x86_64-linux" "aarch64-linux" ];
+    platforms = [ "x86_64-darwin" "x86_64-linux" "aarch64-linux" "aarch64-darwin" ];
   };
 }
diff --git a/pkgs/development/interpreters/racket/force-remove-codesign-then-add.patch b/pkgs/development/interpreters/racket/force-remove-codesign-then-add.patch
new file mode 100644
index 000000000000..c34457ceb950
--- /dev/null
+++ b/pkgs/development/interpreters/racket/force-remove-codesign-then-add.patch
@@ -0,0 +1,11 @@
+--- old/src/mac/codesign.rkt        2022-01-08 18:25:53.000000000 -0500
++++ new/src/mac/codesign.rkt        2022-02-15 15:49:51.000000000 -0500
+@@ -17,6 +17,5 @@
+    #:args (file)
+    file))
+
+-(if remove?
+-    (remove-signature file)
+-    (add-ad-hoc-signature file))
++(remove-signature file)
++(add-ad-hoc-signature file)
diff --git a/pkgs/development/interpreters/racket/minimal.nix b/pkgs/development/interpreters/racket/minimal.nix
index ac15cd24e509..e56945ed651d 100644
--- a/pkgs/development/interpreters/racket/minimal.nix
+++ b/pkgs/development/interpreters/racket/minimal.nix
@@ -14,7 +14,7 @@ racket.overrideAttrs (oldAttrs: rec {
       as well as libraries that live in collections. In particular, raco
       and the pkg library are still bundled.
     '';
-    platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" ];
+    platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];
     broken = false; # Minimal build does not require working FFI
   };
 })
diff --git a/pkgs/development/libraries/exiv2/default.nix b/pkgs/development/libraries/exiv2/default.nix
index 5ef3bfa2ac40..d970f376d099 100644
--- a/pkgs/development/libraries/exiv2/default.nix
+++ b/pkgs/development/libraries/exiv2/default.nix
@@ -11,13 +11,14 @@
 , graphviz
 , libxslt
 , libiconv
+, removeReferencesTo
 }:
 
 stdenv.mkDerivation rec {
   pname = "exiv2";
   version = "0.27.5";
 
-  outputs = [ "out" "dev" "doc" "man" ];
+  outputs = [ "out" "lib" "dev" "doc" "man" "static" ];
 
   src = fetchFromGitHub {
     owner = "exiv2";
@@ -32,6 +33,7 @@ stdenv.mkDerivation rec {
     gettext
     graphviz
     libxslt
+    removeReferencesTo
   ];
 
   buildInputs = lib.optional stdenv.isDarwin libiconv;
@@ -94,8 +96,15 @@ stdenv.mkDerivation rec {
       rm *
       mv .exiv2 exiv2
     )
+
+    mkdir -p $static/lib
+    mv $lib/lib/*.a $static/lib/
+
+    remove-references-to -t ${stdenv.cc.cc} $lib/lib/*.so.*.*.* $out/bin/exiv2 $static/lib/*.a
   '';
 
+  disallowedReferences = [ stdenv.cc.cc ];
+
   meta = with lib; {
     homepage = "https://www.exiv2.org/";
     description = "A library and command-line utility to manage image metadata";
diff --git a/pkgs/development/libraries/qtstyleplugin-kvantum/default.nix b/pkgs/development/libraries/qtstyleplugin-kvantum/default.nix
index 909903c2c34c..5a747fd91063 100644
--- a/pkgs/development/libraries/qtstyleplugin-kvantum/default.nix
+++ b/pkgs/development/libraries/qtstyleplugin-kvantum/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "qtstyleplugin-kvantum";
-  version = "1.0.0";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "tsujan";
     repo = "Kvantum";
     rev = "V${version}";
-    sha256 = "0yvxj7r9z890nfq5cadw7ys144c2mnvaplvx4v4ndv7238b741l8";
+    sha256 = "0k3j74klvd386ijsd4j09ccxlhga54z4pgnh36s9cv3rs7ab39qm";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-bigquery/default.nix b/pkgs/development/python-modules/google-cloud-bigquery/default.nix
index 96a10e1a2221..5e5af855b86b 100644
--- a/pkgs/development/python-modules/google-cloud-bigquery/default.nix
+++ b/pkgs/development/python-modules/google-cloud-bigquery/default.nix
@@ -18,12 +18,12 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-bigquery";
-  version = "2.32.0";
+  version = "2.33.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-84Y6xCk/CkWF5ERh2CuR+SOXIe8z/JV11AG02n3BJ70=";
+    sha256 = "sha256-4VIlDMUmpwWE+AIAZs7L3y+i35hEF7a76/+Wqtwy498=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-error-reporting/default.nix b/pkgs/development/python-modules/google-cloud-error-reporting/default.nix
index c8edb677c64b..06c4d9e23696 100644
--- a/pkgs/development/python-modules/google-cloud-error-reporting/default.nix
+++ b/pkgs/development/python-modules/google-cloud-error-reporting/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-error-reporting";
-  version = "1.4.1";
+  version = "1.5.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "4a72a65586178daaacf6bbc4b718db0765b99a719fce88a95c2be4f82689b7c1";
+    sha256 = "sha256-qvhZU7T2fHA2uRyXJjRxqeEAFwShH+TpGwICczgX7Sk=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/httpx-socks/default.nix b/pkgs/development/python-modules/httpx-socks/default.nix
index 3600e173f944..e45e6a85487a 100644
--- a/pkgs/development/python-modules/httpx-socks/default.nix
+++ b/pkgs/development/python-modules/httpx-socks/default.nix
@@ -56,6 +56,12 @@ buildPythonPackage rec {
     "httpx_socks"
   ];
 
+  disabledTests = [
+    # Tests don't work in the sandbox
+    "test_proxy"
+    "test_secure_proxy"
+  ];
+
   meta = with lib; {
     description = "Proxy (HTTP, SOCKS) transports for httpx";
     homepage = "https://github.com/romis2012/httpx-socks";
diff --git a/pkgs/development/python-modules/pyinsteon/default.nix b/pkgs/development/python-modules/pyinsteon/default.nix
index fbf1fbce7931..81beedbfdce4 100644
--- a/pkgs/development/python-modules/pyinsteon/default.nix
+++ b/pkgs/development/python-modules/pyinsteon/default.nix
@@ -1,36 +1,36 @@
 { lib
-, buildPythonPackage
-, fetchFromGitHub
 , aiofiles
 , aiohttp
 , async_generator
+, buildPythonPackage
+, fetchFromGitHub
 , pypubsub
 , pyserial
 , pyserial-asyncio
-, pyyaml
-, pytestCheckHook
-, pythonOlder
-, pytest-cov
 , pytest-asyncio
 , pytest-timeout
+, pytestCheckHook
+, pythonOlder
+, pyyaml
 }:
 
 buildPythonPackage rec {
   pname = "pyinsteon";
   version = "1.0.15";
+  format = "setuptools";
+
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "sha256-bR+2885JdGoVHBIZQG8iF0OXsECew7m5N9vopKtGp3I=";
+    hash = "sha256-bR+2885JdGoVHBIZQG8iF0OXsECew7m5N9vopKtGp3I=";
   };
 
   propagatedBuildInputs = [
     aiofiles
     aiohttp
-    async_generator
     pypubsub
     pyserial
     pyserial-asyncio
@@ -38,13 +38,15 @@ buildPythonPackage rec {
   ];
 
   checkInputs = [
+    async_generator
     pytest-asyncio
-    pytest-cov
     pytest-timeout
     pytestCheckHook
   ];
 
-  pythonImportsCheck = [ "pyinsteon" ];
+  pythonImportsCheck = [
+    "pyinsteon"
+  ];
 
   meta = with lib; {
     description = "Python library to support Insteon home automation projects";
diff --git a/pkgs/development/python-modules/python-manilaclient/default.nix b/pkgs/development/python-modules/python-manilaclient/default.nix
index 21f29efb28f3..a2da2e4f4a76 100644
--- a/pkgs/development/python-modules/python-manilaclient/default.nix
+++ b/pkgs/development/python-modules/python-manilaclient/default.nix
@@ -1,7 +1,9 @@
 { lib
 , buildPythonApplication
 , fetchPypi
+, installShellFiles
 , pbr
+, openstackdocstheme
 , oslo-config
 , oslo-log
 , oslo-serialization
@@ -9,6 +11,8 @@
 , prettytable
 , requests
 , simplejson
+, sphinx
+, sphinxcontrib-programoutput
 , Babel
 , osc-lib
 , python-keystoneclient
@@ -25,6 +29,13 @@ buildPythonApplication rec {
     sha256 = "sha256-6iAed0mtEYHguYq4Rlh4YWT8E5hNqBYPcnG9/8RMspo=";
   };
 
+  nativeBuildInputs = [
+    installShellFiles
+    openstackdocstheme
+    sphinx
+    sphinxcontrib-programoutput
+  ];
+
   propagatedBuildInputs = [
     pbr
     oslo-config
@@ -40,6 +51,12 @@ buildPythonApplication rec {
     debtcollector
   ];
 
+  postInstall = ''
+    export PATH=$out/bin:$PATH
+    sphinx-build -a -E -d doc/build/doctrees -b man doc/source doc/build/man
+    installManPage doc/build/man/python-manilaclient.1
+  '';
+
   # Checks moved to 'passthru.tests' to workaround infinite recursion
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/simplefix/default.nix b/pkgs/development/python-modules/simplefix/default.nix
index 6e498ebeaea8..fc241ce278ac 100644
--- a/pkgs/development/python-modules/simplefix/default.nix
+++ b/pkgs/development/python-modules/simplefix/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "simplefix";
-  version = "1.0.14";
+  version = "1.0.15";
 
   src = fetchFromGitHub {
     repo = "simplefix";
     owner = "da4089";
     rev = "v${version}";
-    sha256 = "1qccb63w6swq7brp0zinkkngpazmb25r21adry5cq6nniqs5g5zx";
+    sha256 = "sha256-GQHMotxNRuRv6zXhrD02T+aFgfYe3RnvUGADsBeSPbA=";
   };
 
   checkPhase = ''
diff --git a/pkgs/development/python-modules/sphinxcontrib-programoutput/default.nix b/pkgs/development/python-modules/sphinxcontrib-programoutput/default.nix
new file mode 100644
index 000000000000..676f72c3f14b
--- /dev/null
+++ b/pkgs/development/python-modules/sphinxcontrib-programoutput/default.nix
@@ -0,0 +1,32 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, sphinx
+, sphinxcontrib-serializinghtml
+}:
+
+buildPythonPackage rec {
+  pname = "sphinxcontrib-programoutput";
+  version = "0.17";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-MA7puMrug1XSXMdLTRx+/RLmCNKtFl4xQdMeb7wVK38=";
+  };
+
+  buildInputs = [
+    sphinx
+  ];
+
+  # fails to import sphinxcontrib.serializinghtml
+  doCheck = false;
+
+  pythonImportsCheck = [ "sphinxcontrib.programoutput" ];
+
+  meta = with lib; {
+    description = "Sphinx extension to include program output";
+    homepage = "https://github.com/NextThought/sphinxcontrib-programoutput";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ SuperSandro2000 ];
+  };
+}
diff --git a/pkgs/development/tools/analysis/radare2/default.nix b/pkgs/development/tools/analysis/radare2/default.nix
index a55a5f09b7d8..f37d6a6ef82a 100644
--- a/pkgs/development/tools/analysis/radare2/default.nix
+++ b/pkgs/development/tools/analysis/radare2/default.nix
@@ -62,7 +62,7 @@ stdenv.mkDerivation rec {
   '';
 
   postFixup = lib.optionalString stdenv.isDarwin ''
-    for file in $out/bin/rasm2 $out/bin/ragg2 $out/bin/rabin2 $out/lib/libr_asm.${version}.dylib; do
+    for file in $out/bin/rasm2 $out/bin/ragg2 $out/bin/rabin2 $out/lib/libr_asm.${version}.dylib $out/lib/libr_anal.${version}.dylib; do
       install_name_tool -change libcapstone.4.dylib ${capstone}/lib/libcapstone.4.dylib $file
     done
   '';
diff --git a/pkgs/development/tools/buf/default.nix b/pkgs/development/tools/buf/default.nix
index 67c132bd9e08..60d8d8f58b8c 100644
--- a/pkgs/development/tools/buf/default.nix
+++ b/pkgs/development/tools/buf/default.nix
@@ -10,15 +10,16 @@
 
 buildGoModule rec {
   pname = "buf";
-  version = "1.0.0-rc12";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "bufbuild";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-UqyWQdlCDTSjW348f87W7g2kwB5nzIOviSE5/1T1soY=";
+    sha256 = "sha256-jJaob2eaozMFRsXwW6ulgM5De3UmpLZddTHwq6PnaeE=";
   };
-  vendorSha256 = "sha256-qBgGZTok3G0Pgku76uiV9bZperhiSNoWSrzxrHe4QXw=";
+
+  vendorSha256 = "sha256-wPnrkfv6pJB6tkZo2oeMbWHbF9njGh1ZEWu8tkHDhGo=";
 
   patches = [
     # Skip a test that requires networking to be available to work.
@@ -27,12 +28,15 @@ buildGoModule rec {
     ./skip_test_requiring_dotgit.patch
   ];
 
-  nativeBuildInputs = [ protobuf installShellFiles ];
-  # Required for TestGitCloner
-  checkInputs = [ git ];
+  nativeBuildInputs = [ installShellFiles ];
 
   ldflags = [ "-s" "-w" ];
 
+  checkInputs = [
+    git # Required for TestGitCloner
+    protobuf # Required for buftesting.GetProtocFilePaths
+  ];
+
   preCheck = ''
     # The tests need access to some of the built utilities
     export PATH="$PATH:$GOPATH/bin"
@@ -55,9 +59,9 @@ buildGoModule rec {
 
     # Completions
     installShellCompletion --cmd buf \
-      --bash <($GOPATH/bin/buf bash-completion) \
-      --fish <($GOPATH/bin/buf fish-completion) \
-      --zsh <($GOPATH/bin/buf zsh-completion)
+      --bash <($GOPATH/bin/buf completion bash) \
+      --fish <($GOPATH/bin/buf completion fish) \
+      --zsh <($GOPATH/bin/buf completion zsh)
 
     # Man Pages
     mkdir man && $GOPATH/bin/buf manpages man
diff --git a/pkgs/development/tools/ko/default.nix b/pkgs/development/tools/ko/default.nix
index ab206a090bb1..a7562429db59 100644
--- a/pkgs/development/tools/ko/default.nix
+++ b/pkgs/development/tools/ko/default.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "ko";
-  version = "0.9.3";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-cIrlhhk5Lt0Qt7q7rKw8EXrJqZWZEjrEUyHOvHiT6bs=";
+    sha256 = "sha256-Xhe5WNHQ+Oa1m/6VwC3zCwWzXRc1spSfPp4jySsOcuU=";
   };
   vendorSha256 = null;
 
diff --git a/pkgs/development/tools/stylua/default.nix b/pkgs/development/tools/stylua/default.nix
index 5d185dd153e0..7db111a50f26 100644
--- a/pkgs/development/tools/stylua/default.nix
+++ b/pkgs/development/tools/stylua/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "stylua";
-  version = "0.12.2";
+  version = "0.12.3";
 
   src = fetchFromGitHub {
     owner = "johnnymorganz";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Nry6P4nwcCmvJ4kdzeGEkaP1fm2LgnAwrINTBFK23tY=";
+    sha256 = "sha256-bgfG1cPhauU85FG/ZX1n2KqfydMeh92q347UsREkOGo=";
   };
 
-  cargoSha256 = "sha256-i5wOGPOe1lDZknrVzZGxC8dUgTGiZJSzLqkxSRt0mQ8=";
+  cargoSha256 = "sha256-njZTD6O67v787Z1tJ7G0QzxJLhqU2sfpOVw6r4woE9s=";
 
   buildFeatures = lib.optional lua52Support "lua52"
     ++ lib.optional luauSupport "luau";
diff --git a/pkgs/games/mudlet/default.nix b/pkgs/games/mudlet/default.nix
index aacc15d19b97..46ae45b2202b 100644
--- a/pkgs/games/mudlet/default.nix
+++ b/pkgs/games/mudlet/default.nix
@@ -1,5 +1,25 @@
-{ fetchFromGitHub, lib, stdenv, wrapQtAppsHook, git, pcre, pugixml, qtbase, libsForQt5, libsecret, qtmultimedia, qttools, yajl, libzip, hunspell
-, boost, libGLU, lua, cmake,  which, pkg-config, }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, git
+, pkg-config
+, qttools
+, which
+, wrapQtAppsHook
+, boost
+, hunspell
+, libGLU
+, libsForQt5
+, libsecret
+, libzip
+, lua
+, pcre
+, pugixml
+, qtbase
+, qtmultimedia
+, yajl
+}:
 
 let
   luaEnv = lua.withPackages(ps: with ps; [
@@ -8,25 +28,46 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "mudlet";
-  version = "4.12.0";
+  version = "4.15.1";
 
   src = fetchFromGitHub {
     owner = "Mudlet";
     repo = "Mudlet";
     rev = "Mudlet-${version}";
     fetchSubmodules = true;
-    sha256 = "023plm5mwm15xikmdh1mq3gx1n7y4a0r0kw9fvk3rvm9brm78hzp";
+    hash = "sha256-GnTQc0Jh4YaQnfy7fYsTCACczlzWCQ+auKYoU9ET83M=";
   };
 
-  nativeBuildInputs = [ pkg-config cmake wrapQtAppsHook git qttools which ];
+  nativeBuildInputs = [
+    cmake
+    git
+    pkg-config
+    qttools
+    which
+    wrapQtAppsHook
+  ];
+
   buildInputs = [
-    pcre pugixml qtbase libsForQt5.qtkeychain qtmultimedia luaEnv libsecret libzip libGLU yajl boost hunspell
+    boost
+    hunspell
+    libGLU
+    libsForQt5.qtkeychain
+    libsecret
+    libzip
+    luaEnv
+    pcre
+    pugixml
+    qtbase
+    qtmultimedia
+    yajl
   ];
 
   WITH_FONTS = "NO";
   WITH_UPDATER = "NO";
 
   installPhase =  ''
+    runHook preInstall
+
     mkdir -pv $out/lib
     cp 3rdparty/edbee-lib/edbee-lib/qslog/lib/libQsLog.so $out/lib
     mkdir -pv $out/bin
@@ -41,15 +82,19 @@ stdenv.mkDerivation rec {
     cp -r ../mudlet.png $out/share/pixmaps/
 
     makeQtWrapper $out/mudlet $out/bin/mudlet \
+      --set LUA_CPATH "${luaEnv}/lib/lua/${lua.luaversion}/?.so" \
+      --prefix LUA_PATH : "$NIX_LUA_PATH" \
       --prefix LD_LIBRARY_PATH : "${libsForQt5.qtkeychain}/lib/" \
       --run "cd $out";
+
+    runHook postInstall
   '';
 
   meta = with lib; {
     description = "Crossplatform mud client";
-    homepage = "https://mudlet.org";
+    homepage = "https://www.mudlet.org/";
     maintainers = [ maintainers.wyvie maintainers.pstn ];
     platforms = platforms.linux;
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
   };
 }
diff --git a/pkgs/os-specific/linux/apparmor/default.nix b/pkgs/os-specific/linux/apparmor/default.nix
index 8e95c44f95cd..5c1cf272e0e7 100644
--- a/pkgs/os-specific/linux/apparmor/default.nix
+++ b/pkgs/os-specific/linux/apparmor/default.nix
@@ -304,10 +304,10 @@ let
     meta = apparmor-meta "kernel patches";
   };
 
-  # Generate generic AppArmor rules in a file,
-  # from the closure of given rootPaths.
-  # To be included in an AppArmor profile like so:
-  # include "$(apparmorRulesFromClosure {} [pkgs.hello]}"
+  # Generate generic AppArmor rules in a file, from the closure of given
+  # rootPaths. To be included in an AppArmor profile like so:
+  #
+  #   include "${apparmorRulesFromClosure { } [ pkgs.hello ]}"
   apparmorRulesFromClosure =
     { # The store path of the derivation is given in $path
       additionalRules ? []
diff --git a/pkgs/servers/monitoring/grafana/default.nix b/pkgs/servers/monitoring/grafana/default.nix
index ca59c4943995..fdb6ea0efa99 100644
--- a/pkgs/servers/monitoring/grafana/default.nix
+++ b/pkgs/servers/monitoring/grafana/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "grafana";
-  version = "8.3.6";
+  version = "8.4.1";
 
   excludedPackages = "\\(alert_webhook_listener\\|clean-swagger\\|release_publisher\\|slow_proxy\\|slow_proxy_mac\\|macaron\\)";
 
@@ -10,15 +10,15 @@ buildGoModule rec {
     rev = "v${version}";
     owner = "grafana";
     repo = "grafana";
-    sha256 = "sha256-XYgSXgZJKsVYMtlvMq84OuQBbrbFJUh6m/lKCbOlzus=";
+    sha256 = "sha256-RVEgqFEwvXTHE8Kvc1q+0o+V3mEHtURQR/7x3Qcmtpg=";
   };
 
   srcStatic = fetchurl {
     url = "https://dl.grafana.com/oss/release/grafana-${version}.linux-amd64.tar.gz";
-    sha256 = "sha256-8gR95+xCJD3e25WxbmtXBMsS7HdbB+vwrcZ9sApSxFk=";
+    sha256 = "sha256-RTupkQ9LlppJeyfmgGMztMW2m+sJXkJuDAdtpcyRGe0=";
   };
 
-  vendorSha256 = "sha256:0bj9a45jciaayqlrakdndzjdw4x600xw48wwy1id4n50h2mkrbp8";
+  vendorSha256 = "sha256-RugV5cHlpR739CA1C/7FkXasvkv18m7pPsK6mxfSkC0=";
 
   nativeBuildInputs = [ wire ];
 
diff --git a/pkgs/servers/ombi/default.nix b/pkgs/servers/ombi/default.nix
index 1e63b44450e7..a99349d8c0db 100644
--- a/pkgs/servers/ombi/default.nix
+++ b/pkgs/servers/ombi/default.nix
@@ -10,14 +10,14 @@ let
     "Unsupported system: ${stdenv.hostPlatform.system}");
 
   hash = {
-    x64-linux_hash = "sha256-BLtoT6UHsur+jFp4KBlE10/Z/V6RDy0k16H10IC98WQ=";
-    arm64-linux_hash = "sha256-s8EV/VqiUXWRTNxacx4sy6r+TIAqkqhESAYYa9s0uAQ=";
-    x64-osx_hash = "sha256-woXFYmX+499NTtWmmGBpZ12PxTUazJ8klA6IPQIDjLE=";
+    x64-linux_hash = "sha256-O/dfLZst7RFnqDZj8UX6ejL2EBjGnCBY3e8JB3peRgY=";
+    arm64-linux_hash = "sha256-DkCOK1A7L1gMqY/XPIJFFz7qvUvxA6aJa24Hrh3dT/U=";
+    x64-osx_hash = "sha256-4N0/FTVhxUooauhh+7u527aViSBILiCb+a4cI17QTAg=";
   }."${arch}-${os}_hash";
 
 in stdenv.mkDerivation rec {
   pname = "ombi";
-  version = "4.3.3";
+  version = "4.10.2";
 
   sourceRoot = ".";
 
diff --git a/pkgs/servers/ombi/update.sh b/pkgs/servers/ombi/update.sh
index a549a9f1731d..9b49180b6f11 100755
--- a/pkgs/servers/ombi/update.sh
+++ b/pkgs/servers/ombi/update.sh
@@ -15,7 +15,7 @@ updateHash()
 
     url="https://github.com/Ombi-app/Ombi/releases/download/v$version/$os-$arch.tar.gz"
     hash=$(nix-prefetch-url --type sha256 $url)
-    sriHash="$(nix --extra-experimental-features nix-command hash to-sri --type sha256 $hash)"
+    sriHash="$(nix hash to-sri --type sha256 $hash)"
 
     sed -i "s|$hashKey = \"[a-zA-Z0-9\/+-=]*\";|$hashKey = \"$sriHash\";|g" "$dirname/default.nix"
 }
@@ -25,7 +25,7 @@ updateVersion()
     sed -i "s/version = \"[0-9.]*\";/version = \"$1\";/g" "$dirname/default.nix"
 }
 
-currentVersion=$(cd $dirname && nix eval --raw '(with import ../../.. {}; ombi.version)')
+currentVersion=$(cd $dirname && nix eval --raw -f ../../.. ombi.version)
 
 latestTag=$(curl https://api.github.com/repos/Ombi-App/Ombi/releases/latest | jq -r ".tag_name")
 latestVersion="$(expr $latestTag : 'v\(.*\)')"
diff --git a/pkgs/tools/admin/fits-cloudctl/default.nix b/pkgs/tools/admin/fits-cloudctl/default.nix
index 40c2f05a9bdb..a218f25f04e8 100644
--- a/pkgs/tools/admin/fits-cloudctl/default.nix
+++ b/pkgs/tools/admin/fits-cloudctl/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "fits-cloudctl";
-  version = "0.10.7";
+  version = "0.10.8";
 
   src = fetchFromGitHub {
     owner = "fi-ts";
     repo = "cloudctl";
     rev = "v${version}";
-    sha256 = "sha256-oqG9E1sSmpV2S7ywLCBRFs9d3Tbv5uxrbRh5DwpktkA=";
+    sha256 = "sha256-vqzHZ7DW4ev5soFMcafgL/81k6vCsm6Ds5yto/VheX8=";
   };
 
-  vendorSha256 = "sha256-+2KgRGQIkTHbVzFIv0FVLWuDegk7pZ/H+u07A1PjM/4=";
+  vendorSha256 = "sha256-f35Asf9l6ZfixpjMGzesTsxmANreilMxH2CULMH3b2o=";
 
   meta = with lib; {
     description = "Command-line client for FI-TS Finance Cloud Native services";
diff --git a/pkgs/tools/security/kbs2/default.nix b/pkgs/tools/security/kbs2/default.nix
index 5cccc1dd5f52..beaa06fd8360 100644
--- a/pkgs/tools/security/kbs2/default.nix
+++ b/pkgs/tools/security/kbs2/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "kbs2";
-  version = "0.4.0";
+  version = "0.5.1";
 
   src = fetchFromGitHub {
     owner = "woodruffw";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1bipphrzfz4dfzaqn1q60qazs7ylcx0b34gyl4q6d6jivsrhi8a4";
+    sha256 = "sha256-GKjumkeo7aAYaECa6NoXCiXU2kqekBX3wCysRz8seW4=";
   };
 
-  cargoSha256 = "0r254k85hqf2v8kdhwld8k7b350qjvkwfw2v22ikk2b41b2g4gbw";
+  cargoSha256 = "sha256-rJ110kd18V2VGj0AHix3/vI09FG2kJ+TTOYKIthIrjQ=";
 
   nativeBuildInputs = [ installShellFiles ]
     ++ lib.optionals stdenv.isLinux [ python3 ];
diff --git a/pkgs/tools/security/rekor/default.nix b/pkgs/tools/security/rekor/default.nix
index d982d73f5411..663cc38291cb 100644
--- a/pkgs/tools/security/rekor/default.nix
+++ b/pkgs/tools/security/rekor/default.nix
@@ -4,22 +4,22 @@ let
   generic = { pname, packageToBuild, description }:
     buildGoModule rec {
       inherit pname;
-      version = "0.4.0";
+      version = "0.5.0";
 
       src = fetchFromGitHub {
         owner = "sigstore";
         repo = "rekor";
         rev = "v${version}";
-        sha256 = "sha256-15p4hm4Cvs/yLaQIcxctVdMKRWPjIIFwBcbru6QcjXo=";
+        sha256 = "sha256-y8klkb0hyITxLhcNWF7RYRVwF8rclDKzQF/MJs6y//Y=";
       };
 
-      vendorSha256 = "sha256-XCCO4Vamzj5pJFmu1A8mpTLlVAtocrn20myYJVWtBrY=";
+      vendorSha256 = "sha256-0PPdnE3ND/YNIk50XkgBROpe5OhFiFre5Lwsml02DQU=";
 
       nativeBuildInputs = [ installShellFiles ];
 
       subPackages = [ packageToBuild ];
 
-      ldflags = [ "-s" "-w" "-X github.com/sigstore/rekor/${packageToBuild}/app.GitVersion=v${version}" ];
+      ldflags = [ "-s" "-w" "-X github.com/sigstore/rekor/pkg/api.GitVersion=v${version}" ];
 
       postInstall = ''
         installShellCompletion --cmd ${pname} \
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index fd784d145230..3d8884d950eb 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1238,7 +1238,7 @@ with pkgs;
   lilo = callPackage ../tools/misc/lilo { };
 
   logseq = callPackage ../applications/misc/logseq {
-    electron = electron_16;
+    electron = electron_15;
   };
 
   natls = callPackage ../tools/misc/natls { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index a5f36c610880..d84ba433fc7a 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -9332,6 +9332,8 @@ in {
     inherit (pkgs) plantuml;
   };
 
+  sphinxcontrib-programoutput = callPackage ../development/python-modules/sphinxcontrib-programoutput { };
+
   sphinxcontrib-qthelp = callPackage ../development/python-modules/sphinxcontrib-qthelp { };
 
   sphinxcontrib-serializinghtml = callPackage ../development/python-modules/sphinxcontrib-serializinghtml { };