diff --git a/pkgs/applications/networking/browsers/firefox/wrapper.nix b/pkgs/applications/networking/browsers/firefox/wrapper.nix
index c52c7caef868..963028ae321a 100644
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@@ -194,7 +194,7 @@ let
               actions = {
                 profile-manager-window = {
                   name = "Profile Manager";
-                  exec = "${launcherName} --ProfileManger";
+                  exec = "${launcherName} --ProfileManager";
                 };
               };
             }
@@ -220,7 +220,7 @@ let
                 };
                 profile-manager-window = {
                   name = "Profile Manager";
-                  exec = "${launcherName} --ProfileManger";
+                  exec = "${launcherName} --ProfileManager";
                 };
               };
             }));
diff --git a/pkgs/development/libraries/wolfssl/default.nix b/pkgs/development/libraries/wolfssl/default.nix
index 0b6045884270..580af7235e05 100644
--- a/pkgs/development/libraries/wolfssl/default.nix
+++ b/pkgs/development/libraries/wolfssl/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wolfssl";
-  version = "5.5.2";
+  version = "5.5.3";
 
   src = fetchFromGitHub {
     owner = "wolfSSL";
     repo = "wolfssl";
     rev = "v${version}-stable";
-    sha256 = "sha256-d8DDyEsK35WK7c0udZI5HxQLO+mbod8hlbSoa3IWWS0=";
+    hash = "sha256-d8DDyEsK35WK7c0udZI5HxQLO+mbod8hlbSoa3IWWS0=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/cloudscraper/default.nix b/pkgs/development/python-modules/cloudscraper/default.nix
index 1d66da4e2bc6..85b7a9447919 100644
--- a/pkgs/development/python-modules/cloudscraper/default.nix
+++ b/pkgs/development/python-modules/cloudscraper/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "cloudscraper";
-  version = "1.2.64";
+  version = "1.2.65";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-FS+p+dtfGfStp+dWI+k/RdBb/T+ynZyuhPKRc6JZFTA=";
+    hash = "sha256-vwH5sSA9rFrnFO4zIvjloYXSNWK5Vn1rODO74vPWvEE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/datasette/default.nix b/pkgs/development/python-modules/datasette/default.nix
index 85eb37772af9..79f1f92a52bc 100644
--- a/pkgs/development/python-modules/datasette/default.nix
+++ b/pkgs/development/python-modules/datasette/default.nix
@@ -29,7 +29,7 @@
 
 buildPythonPackage rec {
   pname = "datasette";
-  version = "0.63";
+  version = "0.63.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     owner = "simonw";
     repo = pname;
     rev = version;
-    sha256 = "sha256-kzehFvGSmGo2TAtiNZCjRVv/kaiE+shniNnD0gO58b4=";
+    sha256 = "sha256-KMD4dmflmBp0s4nueLyPpDnXngpftS9/h5M6RPYMGrk=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/deepwave/default.nix b/pkgs/development/python-modules/deepwave/default.nix
index f69c386047db..37cb3968da39 100644
--- a/pkgs/development/python-modules/deepwave/default.nix
+++ b/pkgs/development/python-modules/deepwave/default.nix
@@ -18,14 +18,14 @@ let
 in
 buildPythonPackage rec {
   pname = "deepwave";
-  version = "0.0.14";
+  version = "0.0.17";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "ar4";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-k1MUrnIkllxGIpkEScTZBEDBBNHgJHxau1e/L8TOEKc=";
+    sha256 = "sha256-4B3V87/voYs61pXhqmydLe48JsnRGuJlUYOOdmJlroA=";
   };
 
   # unable to find ninja although it is available, most likely because it looks for its pip version
diff --git a/pkgs/development/python-modules/hpccm/default.nix b/pkgs/development/python-modules/hpccm/default.nix
index 74372f57641e..05a1085a8e18 100644
--- a/pkgs/development/python-modules/hpccm/default.nix
+++ b/pkgs/development/python-modules/hpccm/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonPackage rec {
   pname = "hpccm";
-  version = "22.8.0";
+  version = "22.10.0";
 
   src = fetchFromGitHub {
     owner = "NVIDIA";
     repo = "hpc-container-maker";
     rev = "v${version}";
-    sha256 = "sha256-nq1zixIu/Kv2CtkQX1Sw7Q3BsOZKcCJjV0+uroXPEBs=";
+    sha256 = "sha256-dLMbwtvn7HTVVlWHAzXU19ERdJxytf9NlnqMXW6ShKI=";
   };
 
   propagatedBuildInputs = [ six archspec ];
diff --git a/pkgs/development/python-modules/python-rapidjson/default.nix b/pkgs/development/python-modules/python-rapidjson/default.nix
index a9423a7a58df..1d8456df5fd0 100644
--- a/pkgs/development/python-modules/python-rapidjson/default.nix
+++ b/pkgs/development/python-modules/python-rapidjson/default.nix
@@ -27,13 +27,13 @@ let
     ];
   });
 in buildPythonPackage rec {
-  version = "1.6";
+  version = "1.9";
   pname = "python-rapidjson";
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-GJzxqWv5/NhtADYPFa12qDzgiJuK6NHLD9srKZXlocg=";
+    hash = "sha256-vn01HHES2sYIEzoj9g6VOVZo0JgaB/QDf2Pg6Ir88Bo=";
   };
 
   setupPyBuildFlags = [
diff --git a/pkgs/development/web/grails/default.nix b/pkgs/development/web/grails/default.nix
index 0d0ae17729fa..1a8b232c2808 100644
--- a/pkgs/development/web/grails/default.nix
+++ b/pkgs/development/web/grails/default.nix
@@ -11,11 +11,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "grails";
-  version = "5.2.4";
+  version = "5.2.5";
 
   src = fetchurl {
     url = "https://github.com/grails/grails-core/releases/download/v${version}/grails-${version}.zip";
-    sha256 = "sha256-jtv14Y6TfiIHwbqqaX36j2H/4+UCikbpFhYgNeAP3L4=";
+    sha256 = "sha256-RI1O10kObIaEjOuUFuAchjIgjrNDKmwRY0+Vep6UT54=";
   };
 
   nativeBuildInputs = [ unzip ];
diff --git a/pkgs/servers/keycloak/default.nix b/pkgs/servers/keycloak/default.nix
index d4ec9d6e9ed7..9fac37bffbc9 100644
--- a/pkgs/servers/keycloak/default.nix
+++ b/pkgs/servers/keycloak/default.nix
@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation rec {
   pname = "keycloak";
-  version = "20.0.0";
+  version = "20.0.1";
 
   src = fetchzip {
     url = "https://github.com/keycloak/keycloak/releases/download/${version}/keycloak-${version}.zip";
-    sha256 = "sha256-dJueuXKv3GoDnaQnvYMzIJJSr+NNSYgS7KY3MTGE37Y=";
+    sha256 = "sha256-UriiCCVKxdcaKEcDyn8HsS1S4zJAUC2chYu6iiNsJwA=";
   };
 
   nativeBuildInputs = [ makeWrapper jre ];
diff --git a/pkgs/servers/lidarr/default.nix b/pkgs/servers/lidarr/default.nix
index 9bd998cd8505..501aabaca9e3 100644
--- a/pkgs/servers/lidarr/default.nix
+++ b/pkgs/servers/lidarr/default.nix
@@ -1,35 +1,52 @@
-{ lib, stdenv, fetchurl, mono, libmediainfo, sqlite, curl, chromaprint, makeWrapper }:
+{ lib, stdenv, fetchurl, mono, libmediainfo, sqlite, curl, chromaprint, makeWrapper, icu, dotnet-runtime, openssl, nixosTests }:
 
-stdenv.mkDerivation rec {
+let
+  os = if stdenv.isDarwin then "osx" else "linux";
+  arch = {
+    x86_64-linux = "x64";
+    aarch64-linux = "arm64";
+    x86_64-darwin = "x64";
+  }."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+  hash = {
+    x64-linux_hash = "sha256-iuI24gT7/RFZ9xc4csd+zWEzPSPsxqYY5F+78IWRjxQ=";
+    arm64-linux_hash = "sha256-yHAoZxLeKF6mlR/Av0EH0Lh2XquM9Vx6huNDTEs4wyU=";
+    x64-osx_hash = "sha256-ES6njZTSfd/36+RvibE1hlQlCT+hEEcOem8epBSsnXc=";
+  }."${arch}-${os}_hash";
+in stdenv.mkDerivation rec {
   pname = "lidarr";
-  version = "0.8.1.2135";
+  version = "1.0.2.2592";
 
   src = fetchurl {
-    url = "https://github.com/lidarr/Lidarr/releases/download/v${version}/Lidarr.master.${version}.linux.tar.gz";
-    sha256 = "sha256-eJX6t19D2slX68fXSMd/Vix3XSgCVylK+Wd8VH9jsuI=";
+    url = "https://github.com/lidarr/Lidarr/releases/download/v${version}/Lidarr.master.${version}.${os}-core-${arch}.tar.gz";
+    sha256 = hash;
   };
 
   nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
-    mkdir -p $out/bin
-    cp -r * $out/bin/
+    runHook preInstall
 
-    # Mark main executable as executable
-    chmod +x $out/bin/Lidarr.exe
-
-    makeWrapper "${mono}/bin/mono" $out/bin/Lidarr \
-      --add-flags "$out/bin/Lidarr.exe" \
-      --prefix PATH : ${lib.makeBinPath [ chromaprint ]} \
+    mkdir -p $out/{bin,share/${pname}-${version}}
+    cp -r * $out/share/${pname}-${version}/.
+    makeWrapper "${dotnet-runtime}/bin/dotnet" $out/bin/Lidarr \
+      --add-flags "$out/share/${pname}-${version}/Lidarr.dll" \
       --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [
-          curl sqlite libmediainfo ]}
+        curl sqlite libmediainfo icu  openssl ]}
+
+    runHook postInstall
   '';
 
+
+  passthru = {
+    updateScript = ./update.sh;
+    tests.smoke-test = nixosTests.lidarr;
+  };
+
   meta = with lib; {
     description = "A Usenet/BitTorrent music downloader";
     homepage = "https://lidarr.audio/";
     license = licenses.gpl3;
     maintainers = [ maintainers.etu ];
-    platforms = platforms.all;
+    platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" ];
   };
 }
diff --git a/pkgs/servers/lidarr/update.sh b/pkgs/servers/lidarr/update.sh
new file mode 100755
index 000000000000..cff608e7ebf0
--- /dev/null
+++ b/pkgs/servers/lidarr/update.sh
@@ -0,0 +1,42 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl gnused nix-prefetch jq
+
+set -e
+
+dirname="$(dirname "$0")"
+
+updateHash()
+{
+    version=$1
+    arch=$2
+    os=$3
+
+    hashKey="${arch}-${os}_hash"
+
+    url="https://github.com/Lidarr/Lidarr/releases/download/v$version/Lidarr.master.$version.$os-core-$arch.tar.gz"
+    hash=$(nix-prefetch-url --type sha256 $url)
+    sriHash="$(nix hash to-sri --type sha256 $hash)"
+
+    sed -i "s|$hashKey = \"[a-zA-Z0-9\/+-=]*\";|$hashKey = \"$sriHash\";|g" "$dirname/default.nix"
+}
+
+updateVersion()
+{
+    sed -i "s/version = \"[0-9.]*\";/version = \"$1\";/g" "$dirname/default.nix"
+}
+
+currentVersion=$(cd $dirname && nix eval --raw -f ../../.. radarr.version)
+
+latestTag=$(curl https://api.github.com/repos/Lidarr/Lidarr/releases/latest | jq -r ".tag_name")
+latestVersion="$(expr $latestTag : 'v\(.*\)')"
+
+if [[ "$currentVersion" == "$latestVersion" ]]; then
+    echo "Lidarr is up-to-date: ${currentVersion}"
+    exit 0
+fi
+
+updateVersion $latestVersion
+
+updateHash $latestVersion x64 linux
+updateHash $latestVersion arm64 linux
+updateHash $latestVersion x64 osx
diff --git a/pkgs/tools/filesystems/bees/default.nix b/pkgs/tools/filesystems/bees/default.nix
index 75b8feeccdb2..5e9e1ca17aef 100644
--- a/pkgs/tools/filesystems/bees/default.nix
+++ b/pkgs/tools/filesystems/bees/default.nix
@@ -15,20 +15,16 @@ let
 
   bees = stdenv.mkDerivation rec {
     pname = "bees";
-    version = "0.7";
+    version = "0.8";
 
     src = fetchFromGitHub {
       owner = "Zygo";
       repo = "bees";
       rev = "v${version}";
-      sha256 = "sha256-hD6/pMRnQgPqL1M6QOuRka6ESJv9kjeKy+29nRMTY1o=";
+      sha256 = "sha256-xBejyi/W8DLQmcicTqEQb5c4uZKu7jsLGjmWmW74t88=";
     };
 
     buildInputs = [
-      # Works around build failure for flexible array members.
-      # Can be removed after 0.7.3 release where it was fixed upstream.
-      linuxHeaders_5_19
-
       btrfs-progs # for btrfs/ioctl.h
       util-linux # for uuid.h
     ];
@@ -61,10 +57,10 @@ let
     meta = with lib; {
       homepage = "https://github.com/Zygo/bees";
       description = "Block-oriented BTRFS deduplication service";
+      longDescription = "Best-Effort Extent-Same: bees finds not just identical files, but also identical extents within files that differ";
       license = licenses.gpl3;
       platforms = platforms.linux;
       maintainers = with maintainers; [ chaduffy ];
-      longDescription = "Best-Effort Extent-Same: bees finds not just identical files, but also identical extents within files that differ";
     };
   };
 
diff --git a/pkgs/tools/networking/subnetcalc/default.nix b/pkgs/tools/networking/subnetcalc/default.nix
index db8c983be096..8b0c987059ef 100644
--- a/pkgs/tools/networking/subnetcalc/default.nix
+++ b/pkgs/tools/networking/subnetcalc/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "subnetcalc";
-  version = "2.4.19";
+  version = "2.4.20";
 
   src = fetchFromGitHub {
     owner = "dreibh";
     repo = pname;
     rev = "${pname}-${version}";
-    sha256 = "sha256-70OHHcdCsZBa95KQEEYhs6LfpjPg+ULOB+A+VrQVltU=";
+    sha256 = "sha256-ZKEcDLwZPPgbaSx+LvTHNWcdYR/mZEGLc9b0Fb+CyEE=";
   };
 
   nativeBuildInputs = [ cmake ninja ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index b9419096455f..0eb6e51fdfde 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -15782,7 +15782,7 @@ with pkgs;
   php81 = callPackage ../development/interpreters/php/8.1.nix {
     stdenv = if stdenv.cc.isClang then llvmPackages.stdenv else stdenv;
     pcre2 = pcre2.override {
-      withJitSealloc = false; # Needed to avoid crashes, see https://bugs.php.net/bug.php?id=78630
+      withJitSealloc = !stdenv.isDarwin;
     };
   };
   php81Extensions = recurseIntoAttrs php81.extensions;
@@ -15792,7 +15792,7 @@ with pkgs;
   php80 = callPackage ../development/interpreters/php/8.0.nix {
     stdenv = if stdenv.cc.isClang then llvmPackages.stdenv else stdenv;
     pcre2 = pcre2.override {
-      withJitSealloc = false; # Needed to avoid crashes, see https://bugs.php.net/bug.php?id=78630
+      withJitSealloc = !stdenv.isDarwin;
     };
   };
   php80Extensions = recurseIntoAttrs php80.extensions;
diff --git a/pkgs/top-level/php-packages.nix b/pkgs/top-level/php-packages.nix
index 0b9f4237327b..69d849f2208b 100644
--- a/pkgs/top-level/php-packages.nix
+++ b/pkgs/top-level/php-packages.nix
@@ -58,7 +58,9 @@ lib.makeScope pkgs.newScope (self: with self; {
   # with how buildPecl does it and make the file easier to overview.
   mkDerivation = { pname, ... }@args: pkgs.stdenv.mkDerivation (args // {
     pname = "php-${pname}";
-    meta.mainProgram = args.meta.mainProgram or pname;
+    meta = args.meta // {
+      mainProgram = args.meta.mainProgram or pname;
+    };
   });
 
   # Function to build an extension which is shipped as part of the php