diff --git a/pkgs/development/compilers/go/1.18.nix b/pkgs/development/compilers/go/1.18.nix
index d36cbc5e3c29..36b7791a2bc9 100644
--- a/pkgs/development/compilers/go/1.18.nix
+++ b/pkgs/development/compilers/go/1.18.nix
@@ -60,11 +60,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.18.5";
+  version = "1.18.6";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${version}.src.tar.gz";
-    sha256 = "sha256-mSDTMGoaxTbN0seW1ss8VLxVnCJvw8w5wy8eC9f1DSo=";
+    sha256 = "sha256-p/HVBCQ1XavOZtERKxyuQ5tu5eTxXtum8QTApLFz6JU=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/python-modules/Mako/default.nix b/pkgs/development/python-modules/Mako/default.nix
index a74f9988ad7a..9118f5a6fcf3 100644
--- a/pkgs/development/python-modules/Mako/default.nix
+++ b/pkgs/development/python-modules/Mako/default.nix
@@ -13,17 +13,19 @@
 # tests
 , mock
 , pytestCheckHook
+, lingua
+, chameleon
 }:
 
 buildPythonPackage rec {
   pname = "Mako";
-  version = "1.2.0";
+  version = "1.2.2";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-mnx+kiuH2zaGIQz0nV12cDOkHUAQsoTnR2gskr3dizk=";
+    sha256 = "sha256-NySGmzY7pjCicqX4n2jAcDUhN7j9F1dlABe34G/aFj8=";
   };
 
   propagatedBuildInputs = [
@@ -37,8 +39,10 @@ buildPythonPackage rec {
   };
 
   checkInputs = [
-    pytestCheckHook
+    chameleon
+    lingua
     mock
+    pytestCheckHook
   ] ++ passthru.optional-dependencies.babel;
 
   disabledTests = lib.optionals isPyPy [
@@ -51,11 +55,6 @@ buildPythonPackage rec {
     "test_bytestring_passthru"
   ];
 
-  disabledTestPaths = [
-    # lingua dependency is not packaged
-    "test/ext/test_linguaplugin.py"
-  ];
-
   meta = with lib; {
     description = "Super-fast templating language";
     homepage = "https://www.makotemplates.org/";
diff --git a/pkgs/development/python-modules/lingua/default.nix b/pkgs/development/python-modules/lingua/default.nix
new file mode 100644
index 000000000000..f116df7e2fda
--- /dev/null
+++ b/pkgs/development/python-modules/lingua/default.nix
@@ -0,0 +1,35 @@
+{ lib
+, fetchPypi
+, buildPythonPackage
+, flit-core
+, polib
+, click }:
+
+buildPythonPackage rec {
+  pname = "lingua";
+  version = "4.15.0";
+  format = "pyproject";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-DhqUZ0HbKIpANhrQT/OP4EvwgZg0uKu4TEtTX+2bpO8=";
+  };
+
+  nativeBuildInputs = [
+    flit-core
+  ];
+
+  propagatedBuildInputs = [
+    click
+    polib
+  ];
+
+  pythonImportsCheck = [ "lingua" ];
+
+  meta = with lib; {
+    description = "Translation toolset";
+    homepage = "https://github.com/wichert/lingua";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ np ];
+  };
+}
diff --git a/pkgs/development/python-modules/nose/default.nix b/pkgs/development/python-modules/nose/default.nix
index 31fd824ee3da..961de55f5dad 100644
--- a/pkgs/development/python-modules/nose/default.nix
+++ b/pkgs/development/python-modules/nose/default.nix
@@ -26,7 +26,7 @@ buildPythonPackage rec {
   preBuild = lib.optionalString
       ((python.isPy3k or false) && (python.pname != "pypy3"))
   ''
-    2to3 -wn nose functional_tests unit_tests
+    ${python.pythonForBuild}/bin/2to3 -wn nose functional_tests unit_tests
   '';
 
   propagatedBuildInputs = [ coverage ];
diff --git a/pkgs/tools/networking/inetutils/default.nix b/pkgs/tools/networking/inetutils/default.nix
index f5c9ff00d924..864b055fc8e9 100644
--- a/pkgs/tools/networking/inetutils/default.nix
+++ b/pkgs/tools/networking/inetutils/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, fetchurl, ncurses, perl, help2man
-, apparmorRulesFromClosure
+, apparmorRulesFromClosure, fetchpatch
 }:
 
 stdenv.mkDerivation rec {
@@ -16,6 +16,11 @@ stdenv.mkDerivation rec {
   patches = [
     # https://git.congatec.com/yocto/meta-openembedded/commit/3402bfac6b595c622e4590a8ff5eaaa854e2a2a3
     ./inetutils-1_9-PATH_PROCNET_DEV.patch
+    (fetchpatch {
+      name = "CVE-2022-39028.patch";
+      url = "https://sources.debian.org/data/main/i/inetutils/2%3A2.3-5/debian/patches/inetutils-telnetd-EC_EL_null_deref.patch";
+      sha256 = "sha256-NYNDbEk3q3EhQdJaR12JBbnjJIRRpOcKLBF/EJJPiGU=";
+    })
   ];
 
   nativeBuildInputs = [ help2man perl /* for `whois' */ ];
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index de0a92c240d4..a6401d46d40a 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4941,6 +4941,8 @@ in {
 
   line_profiler = callPackage ../development/python-modules/line_profiler { };
 
+  lingua = callPackage ../development/python-modules/lingua { };
+
   linkify-it-py = callPackage ../development/python-modules/linkify-it-py { };
 
   linode-api = callPackage ../development/python-modules/linode-api { };