diff --git a/nixos/modules/profiles/macos-builder.nix b/nixos/modules/profiles/macos-builder.nix
index 895dd04cb485..77f3224a7294 100644
--- a/nixos/modules/profiles/macos-builder.nix
+++ b/nixos/modules/profiles/macos-builder.nix
@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ config, lib, pkgs, ... }:
 
 let
   keysDirectory = "/var/keys";
@@ -71,8 +71,7 @@ in
 
       hostPkgs = config.virtualisation.host.pkgs;
 
-    in
-      hostPkgs.writeShellScriptBin "create-builder" ''
+      script = hostPkgs.writeShellScriptBin "create-builder" ''
         KEYS="''${KEYS:-./keys}"
         ${hostPkgs.coreutils}/bin/mkdir --parent "''${KEYS}"
         PRIVATE_KEY="''${KEYS}/${user}_${keyType}"
@@ -87,6 +86,13 @@ in
         KEYS="$(nix-store --add "$KEYS")" ${config.system.build.vm}/bin/run-nixos-vm
       '';
 
+    in
+      script.overrideAttrs (old: {
+        meta = (old.meta or { }) // {
+          platforms = lib.platforms.darwin;
+        };
+      });
+
   system.stateVersion = "22.05";
 
   users.users."${user}"= {
diff --git a/pkgs/applications/networking/instant-messengers/element/pin.json b/pkgs/applications/networking/instant-messengers/element/pin.json
index c92532b74b82..64a164c9b01e 100644
--- a/pkgs/applications/networking/instant-messengers/element/pin.json
+++ b/pkgs/applications/networking/instant-messengers/element/pin.json
@@ -1,7 +1,7 @@
 {
-  "version": "1.11.16",
-  "desktopSrcHash": "EeED62HRpaWN91yxcDvwwNUWmDRU38lyT5ba1S4go6Q=",
-  "desktopYarnHash": "1f0bghcbzab2dkvxmvhhc0dzyk3js09v2sh93gsjsq9mkhld1k0w",
-  "webSrcHash": "T6UcGNm4i+Nc4Yk/mVFc4L9jxWQtOpjps1ZtEhilHW0=",
-  "webYarnHash": "1jyzym34lzadniqrysbm1m5agw03hzw6ymmdxpbay38afrhrciyk"
+  "version": "1.11.17",
+  "desktopSrcHash": "VB7p/ThiwphcCd3loSwQ61TthR2ji0nX6l32Jrgv/NE=",
+  "desktopYarnHash": "15jsznsqxvi1bs26pmb7zfrybl071k3g3g6i0pm34mzs2r9nvrii",
+  "webSrcHash": "YeXsDyyoQnWNDnfx/7fMHooi48ST+LiA5ACy0gBnQaQ=",
+  "webYarnHash": "1zniyg869glhajcmcgq34qwmhb4jq2hbjqhhz6a79p892yx97chp"
 }
diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix
index 46bbc3b914b9..e0c875c1a379 100644
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@@ -117,6 +117,31 @@ stdenv.mkDerivation rec {
       url = "https://gitlab.com/qemu-project/qemu/-/commit/d307040b18bfcb1393b910f1bae753d5c12a4dc7.patch";
       sha256 = "sha256-YPhm580lBNuAv7G1snYccKZ2V5ycdV8Ri8mTw5jjFBc=";
     })
+    (fetchpatch {
+      name = "CVE-2022-4172.patch";
+      url = "https://gitlab.com/qemu-project/qemu/-/commit/defb70980f6bed36100b74e84220f1764c0dd544.patch";
+      sha256 = "sha256-8HGe3UQB9/8mwYwSmv1vlDUCCfiqFGjk+Pf6Ibvbn9E=";
+    })
+    (fetchpatch {
+      name = "CVE-2022-4144.part-1.patch";
+      url = "https://gitlab.com/qemu-project/qemu/-/commit/61c34fc194b776ecadc39fb26b061331107e5599.patch";
+      sha256 = "sha256-g4NGE8P7+lLyL2XAtXt8xSLsrPnvDyi7vbRPTQXgSSE=";
+    })
+    (fetchpatch {
+      name = "CVE-2022-4144.part-2.patch";
+      url = "https://gitlab.com/qemu-project/qemu/-/commit/b1901de83a9456cde26fc755f71ca2b7b3ef50fc.patch";
+      sha256 = "sha256-rTFGzrH+ksx1oytMAym9CJJ9VJ5fX8MTjL4wo5/V94s=";
+    })
+    (fetchpatch {
+      name = "CVE-2022-4144.part-3.patch";
+      url = "https://gitlab.com/qemu-project/qemu/-/commit/8efec0ef8bbc1e75a7ebf6e325a35806ece9b39f.patch";
+      sha256 = "sha256-Xhe1HyYO6FFGQomwYhmlB+UBKLV6U/A9Rl46C5qhS4M=";
+    })
+    (fetchpatch {
+      name = "CVE-2022-4144.part-4.patch";
+      url = "https://gitlab.com/qemu-project/qemu/-/commit/6dbbf055148c6f1b7d8a3251a65bd6f3d1e1f622.patch";
+      sha256 = "sha256-fd2tqcih17LdaECAGhIOpRg8dXSbDa7C4M3hHxhisBE=";
+    })
   ]
   ++ lib.optional nixosTestRunner ./force-uid0-on-9p.patch;
 
diff --git a/pkgs/servers/openvscode-server/default.nix b/pkgs/servers/openvscode-server/default.nix
index 4953ac8592c2..e4f558c790b2 100644
--- a/pkgs/servers/openvscode-server/default.nix
+++ b/pkgs/servers/openvscode-server/default.nix
@@ -1,12 +1,12 @@
 { lib, stdenv, fetchFromGitHub, makeWrapper, runCommand
 , cacert, moreutils, jq, git, pkg-config, yarn, python3
-, esbuild, nodejs-14_x, libsecret, xorg, ripgrep
+, esbuild, nodejs-16_x-openssl_1_1, libsecret, xorg, ripgrep
 , AppKit, Cocoa, Security, cctools }:
 
 let
   system = stdenv.hostPlatform.system;
 
-  nodejs = nodejs-14_x;
+  nodejs = nodejs-16_x-openssl_1_1;
   yarn' = yarn.override { inherit nodejs; };
   defaultYarnOpts = [ "frozen-lockfile" "non-interactive" "no-progress"];
 
@@ -27,13 +27,13 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "openvscode-server";
-  version = "1.69.2";
+  version = "1.73.1";
 
   src = fetchFromGitHub {
     owner = "gitpod-io";
     repo = "openvscode-server";
     rev = "openvscode-server-v${version}";
-    sha256 = "e2vEEZg2H37oFRN+0kZnWW5RU2ma2JJR66XLFDNEOXc=";
+    sha256 = "DZWAzNRRRZ/eElwRGvSK7TxstKK6X1Tj+uAxD4SOScQ=";
   };
 
   yarnCache = stdenv.mkDerivation {
@@ -56,16 +56,9 @@ in stdenv.mkDerivation rec {
 
     outputHashMode = "recursive";
     outputHashAlgo = "sha256";
-    outputHash = "sha256-5wOR7rKzGLE8EAlGd4CkrFUsUOEJOdwuNWQzEdbAL+g=";
+    outputHash = "sha256-7UBXigQj7c+fuHPIM5BbRe02DuL+cs6VbQ/D84Yk8i4=";
   };
 
-  # Extract the Node.js source code which is used to compile packages with
-  # native bindings
-  nodeSources = runCommand "node-sources" {} ''
-    tar --no-same-owner --no-same-permissions -xf ${nodejs.src}
-    mv node-* $out
-  '';
-
   nativeBuildInputs = [
     nodejs yarn' python3 pkg-config makeWrapper git jq moreutils
   ];
@@ -102,9 +95,9 @@ in stdenv.mkDerivation rec {
 
     # set offline mirror to yarn cache we created in previous steps
     yarn --offline config set yarn-offline-mirror "${yarnCache}"
-  '' + lib.optionalString stdenv.isLinux ''
+
     # set nodedir, so we can build binaries later
-    npm config set nodedir "${nodeSources}"
+    npm config set nodedir "${nodejs}"
   '';
 
   buildPhase = ''