diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 8b760f0c1fe..d245f534648 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -5029,6 +5029,12 @@
     githubId = 222664;
     name = "Matthew Leach";
   };
+  hexchen = {
+    email = "nix@lilwit.ch";
+    github = "hexchen";
+    githubId = 41522204;
+    name = "hexchen";
+  };
   hh = {
     email = "hh@m-labs.hk";
     github = "HarryMakes";
diff --git a/nixos/modules/misc/version.nix b/nixos/modules/misc/version.nix
index 931201ade29..010acdb72f6 100644
--- a/nixos/modules/misc/version.nix
+++ b/nixos/modules/misc/version.nix
@@ -146,6 +146,15 @@ in
       "/etc/os-release".source = initrdRelease;
       "/etc/initrd-release".source = initrdRelease;
     };
+
+    # We have to use `warnings` because when warning in the default of the option
+    # the warning would also be shown when building the manual since the manual
+    # has to evaluate the default.
+    #
+    # TODO Remove this and drop the default of the option so people are forced to set it.
+    # Doing this also means fixing the comment in nixos/modules/testing/test-instrumentation.nix
+    warnings = lib.optional (options.system.stateVersion.highestPrio == (lib.mkOptionDefault { }).priority)
+      "system.stateVersion is not set, defaulting to ${config.system.stateVersion}. Read why this matters on https://nixos.org/manual/nixos/stable/options.html#opt-system.stateVersion.";
   };
 
   # uses version info nixpkgs, which requires a full nixpkgs path
diff --git a/nixos/modules/services/matrix/matrix-synapse.nix b/nixos/modules/services/matrix/matrix-synapse.nix
index a498aff7a55..87a977f8e1e 100644
--- a/nixos/modules/services/matrix/matrix-synapse.nix
+++ b/nixos/modules/services/matrix/matrix-synapse.nix
@@ -296,6 +296,7 @@ in {
               default = if lib.versionAtLeast config.system.stateVersion "22.05"
                 then "${cfg.dataDir}/media_store"
                 else "${cfg.dataDir}/media";
+              defaultText = "${cfg.dataDir}/media_store for when system.stateVersion is at least 22.05, ${cfg.dataDir}/media when lower than 22.05";
               description = ''
                 Directory where uploaded images and attachments are stored.
               '';
diff --git a/nixos/modules/services/networking/pleroma.nix b/nixos/modules/services/networking/pleroma.nix
index c6d4c14dcb7..9b8382392c0 100644
--- a/nixos/modules/services/networking/pleroma.nix
+++ b/nixos/modules/services/networking/pleroma.nix
@@ -1,7 +1,6 @@
 { config, options, lib, pkgs, stdenv, ... }:
 let
   cfg = config.services.pleroma;
-  cookieFile = "/var/lib/pleroma/.cookie";
 in {
   options = {
     services.pleroma = with lib; {
@@ -9,7 +8,7 @@ in {
 
       package = mkOption {
         type = types.package;
-        default = pkgs.pleroma.override { inherit cookieFile; };
+        default = pkgs.pleroma;
         defaultText = literalExpression "pkgs.pleroma";
         description = "Pleroma package to use.";
       };
@@ -101,6 +100,7 @@ in {
       after = [ "network-online.target" "postgresql.service" ];
       wantedBy = [ "multi-user.target" ];
       restartTriggers = [ config.environment.etc."/pleroma/config.exs".source ];
+      environment.RELEASE_COOKIE = "/var/lib/pleroma/.cookie";
       serviceConfig = {
         User = cfg.user;
         Group = cfg.group;
@@ -118,10 +118,10 @@ in {
         # Better be safe than sorry migration-wise.
         ExecStartPre =
           let preScript = pkgs.writers.writeBashBin "pleromaStartPre" ''
-            if [ ! -f "${cookieFile}" ] || [ ! -s "${cookieFile}" ]
+            if [ ! -f /var/lib/pleroma/.cookie ]
             then
               echo "Creating cookie file"
-              dd if=/dev/urandom bs=1 count=16 | ${pkgs.hexdump}/bin/hexdump -e '16/1 "%02x"' > "${cookieFile}"
+              dd if=/dev/urandom bs=1 count=16 | hexdump -e '16/1 "%02x"' > /var/lib/pleroma/.cookie
             fi
             ${cfg.package}/bin/pleroma_ctl migrate
           '';
diff --git a/nixos/modules/testing/test-instrumentation.nix b/nixos/modules/testing/test-instrumentation.nix
index 81541477b9e..4ab2578eb81 100644
--- a/nixos/modules/testing/test-instrumentation.nix
+++ b/nixos/modules/testing/test-instrumentation.nix
@@ -129,6 +129,9 @@ in
     # Make sure we use the Guest Agent from the QEMU package for testing
     # to reduce the closure size required for the tests.
     services.qemuGuest.package = pkgs.qemu_test.ga;
+
+    # Squelch warning about unset system.stateVersion
+    system.stateVersion = lib.mkDefault lib.trivial.release;
   };
 
 }
diff --git a/nixos/tests/pleroma.nix b/nixos/tests/pleroma.nix
index 90a9a251104..bf3623fce38 100644
--- a/nixos/tests/pleroma.nix
+++ b/nixos/tests/pleroma.nix
@@ -32,7 +32,8 @@ import ./make-test-python.nix ({ pkgs, ... }:
     # system one. Overriding this pretty bad default behaviour.
     export REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
 
-    echo "jamy-password" | toot login_cli -i "pleroma.nixos.test" -e "jamy@nixos.test"
+    export TOOT_LOGIN_CLI_PASSWORD="jamy-password"
+    toot login_cli -i "pleroma.nixos.test" -e "jamy@nixos.test"
     echo "Login OK"
 
     # Send a toot then verify it's part of the public timeline
@@ -167,6 +168,21 @@ import ./make-test-python.nix ({ pkgs, ... }:
     cp key.pem cert.pem $out
   '';
 
+  /* Toot is preventing users from feeding login_cli a password non
+     interactively. While it makes sense most of the times, it's
+     preventing us to login in this non-interactive test. This patch
+     introduce a TOOT_LOGIN_CLI_PASSWORD env variable allowing us to
+     provide a password to toot login_cli
+
+     If https://github.com/ihabunek/toot/pull/180 gets merged at some
+     point, feel free to remove this patch. */
+  custom-toot = pkgs.toot.overrideAttrs(old:{
+    patches = [ (pkgs.fetchpatch {
+      url = "https://github.com/NinjaTrappeur/toot/commit/b4a4c30f41c0cb7e336714c2c4af9bc9bfa0c9f2.patch";
+      sha256 = "sha256-0xxNwjR/fStLjjUUhwzCCfrghRVts+fc+fvVJqVcaFg=";
+    }) ];
+  });
+
   hosts = nodes: ''
     ${nodes.pleroma.config.networking.primaryIPAddress} pleroma.nixos.test
     ${nodes.client.config.networking.primaryIPAddress} client.nixos.test
@@ -178,7 +194,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
       security.pki.certificateFiles = [ "${tls-cert}/cert.pem" ];
       networking.extraHosts = hosts nodes;
       environment.systemPackages = with pkgs; [
-        toot
+        custom-toot
         send-toot
       ];
     };
diff --git a/pkgs/applications/editors/gnome-latex/default.nix b/pkgs/applications/editors/gnome-latex/default.nix
index 8fc6feecd57..fe8666fd741 100644
--- a/pkgs/applications/editors/gnome-latex/default.nix
+++ b/pkgs/applications/editors/gnome-latex/default.nix
@@ -1,7 +1,6 @@
-{ lib
-, stdenv
+{ stdenv
+, lib
 , fetchurl
-, fetchpatch
 , autoreconfHook
 , gtk-doc
 , vala
@@ -22,22 +21,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "3.38.0";
+  version = "3.40.0";
   pname = "gnome-latex";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0xqd49pgi82dygqnxj08i1v22b0vwwhx3zvdinhrx4jny339yam8";
+    sha256 = "xad/55vUDjeOooyPRaZjJ/vIzFw7W48PCcAhfufMCpA=";
   };
 
-  patches = [
-    # Fix build with latest tepl.
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/Archive/gnome-latex/commit/e1b01186f8a4e5d3fee4c9ccfbedd6d098517df9.patch";
-      sha256 = "H8cbp5hDZoXytEdKE2D/oYHNKIbEFwxQoEaC4JMfGHY=";
-    })
-  ];
-
   nativeBuildInputs = [
     pkg-config
     autoreconfHook
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index ffe7f9a336a..db018bfb67e 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -79,6 +79,18 @@ let
         };
       };
 
+      alefragnani.bookmarks = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "bookmarks";
+          publisher = "alefragnani";
+          version = "13.0.1";
+          sha256 = "sha256-4IZCPNk7uBqPw/FKT5ypU2QxadQzYfwbGxxT/bUnKdE=";
+        };
+        meta = {
+          license = lib.licenses.gpl3;
+        };
+      };
+
       alefragnani.project-manager = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "project-manager";
diff --git a/pkgs/applications/editors/vscode/vscode.nix b/pkgs/applications/editors/vscode/vscode.nix
index f479c6686af..3d663c39ec9 100644
--- a/pkgs/applications/editors/vscode/vscode.nix
+++ b/pkgs/applications/editors/vscode/vscode.nix
@@ -14,17 +14,17 @@ let
   archive_fmt = if stdenv.isDarwin then "zip" else "tar.gz";
 
   sha256 = {
-    x86_64-linux = "1si0r8nww5m3yn3vzw0pk3nykfvxnlwna4pp11bsli4vqj1ym2nz";
-    x86_64-darwin = "002rkvc8fa7r9x2dsjhkwzmc1sp5mq998frrw5xd6bym0cp4j76l";
-    aarch64-linux = "0w9gjk2a5z8cqlg43jn2r588asymiklm1b28l54gvqp7jawlb0fd";
-    aarch64-darwin = "18h2kk6fcdz38xzyn37brbbj4nbrjgzv9xsz7c7iai8d01vh7s33";
-    armv7l-linux = "16cs2ald40nh76m3fxxfd233hr687dhwbqdkvjz4s6xxwi0rhvwc";
+    x86_64-linux = "0ss7c0dvlgnfqi0snhx73ndzjbw24xz6pcny4v52mrd1kfhcmpvd";
+    x86_64-darwin = "0ds5jv5q6k1hzrwhcgkyvx0ls9p1q7zh0fqigpxandx6ysrd7cga";
+    aarch64-linux = "12zz02hdhhw19rx9kbi3yd5x81w1vs8vxjrnqqvva8bj0jnwf4iq";
+    aarch64-darwin = "07ws2dc2il7ky77j5pxaxqp5cyw0v04jnv98z1494pdmxyn8gf7q";
+    armv7l-linux = "0khyzc69rbfz2pnbab9v3as1hdzkzxfg3mxvf6g7ax9npvsrqw92";
   }.${system};
 in
   callPackage ./generic.nix rec {
     # Please backport all compatible updates to the stable release.
     # This is important for the extension ecosystem.
-    version = "1.66.2";
+    version = "1.67.0";
     pname = "vscode";
 
     executableName = "code" + lib.optionalString isInsiders "-insiders";
diff --git a/pkgs/applications/graphics/drawio/default.nix b/pkgs/applications/graphics/drawio/default.nix
index f93e415bcd6..bb501947415 100644
--- a/pkgs/applications/graphics/drawio/default.nix
+++ b/pkgs/applications/graphics/drawio/default.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "drawio";
-  version = "17.4.2";
+  version = "18.0.1";
 
   src = fetchurl {
     url = "https://github.com/jgraph/drawio-desktop/releases/download/v${version}/drawio-x86_64-${version}.rpm";
-    sha256 = "294f99d9060bc394490b20d2ddab75ed5c0166d7960850f065eb8897ef31a2e3";
+    sha256 = "4f3893f53e47a3937320676e02337a61c358c684d5cd0b378809b3d7deab0139";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/instant-messengers/alfaview/default.nix b/pkgs/applications/networking/instant-messengers/alfaview/default.nix
index eae63701d4d..94ad490aead 100644
--- a/pkgs/applications/networking/instant-messengers/alfaview/default.nix
+++ b/pkgs/applications/networking/instant-messengers/alfaview/default.nix
@@ -1,21 +1,22 @@
-{ stdenv, lib, fetchurl, dpkg, autoPatchelfHook, makeWrapper
+{ stdenv, lib, fetchurl, dpkg, autoPatchelfHook, makeWrapper, wrapGAppsHook
 , alsa-lib, dbus, fontconfig, freetype, glib, gst_all_1, libGL
 , libinput, libpulseaudio, libsecret, libtiff, libxkbcommon
 , mesa, openssl, systemd, xorg }:
 
 stdenv.mkDerivation rec {
   pname = "alfaview";
-  version = "8.42.0";
+  version = "8.43.0";
 
   src = fetchurl {
     url = "https://production-alfaview-assets.alfaview.com/stable/linux/${pname}_${version}.deb";
-    sha256 = "sha256-O440sk6OJUsO+5TuzLxkUELnCfxKd5byoxSD+Rs4h1c=";
+    sha256 = "sha256-Rm1U3gxrToNCigL5AomftSUED7X3i7a6enmFnEzWV4c=";
   };
 
   nativeBuildInputs = [
     dpkg
     makeWrapper
     autoPatchelfHook
+    wrapGAppsHook
   ];
 
   buildInputs = [
@@ -25,6 +26,7 @@ stdenv.mkDerivation rec {
     freetype
     glib
     gst_all_1.gst-plugins-bad
+    gst_all_1.gst-plugins-good
     gst_all_1.gst-plugins-base
     libGL
     libinput
@@ -72,7 +74,7 @@ stdenv.mkDerivation rec {
     description = "Video-conferencing application, specialized in virtual online meetings, seminars, training sessions and conferences";
     homepage = "https://alfaview.com";
     license = licenses.unfree;
-    maintainers = with maintainers; [ wolfangaukang ];
+    maintainers = with maintainers; [ wolfangaukang hexchen ];
     platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix b/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix
index e5edfaa4670..92a8563633c 100644
--- a/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix
+++ b/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix
@@ -3,12 +3,12 @@ electron, libsecret }:
 
 stdenv.mkDerivation rec {
   pname = "tutanota-desktop";
-  version = "3.91.10";
+  version = "3.95.4";
 
   src = fetchurl {
-    url = "https://github.com/tutao/tutanota/releases/download/tutanota-release-${version}/${pname}-${version}-unpacked-linux.tar.gz";
+    url = "https://github.com/tutao/tutanota/releases/download/tutanota-desktop-release-${version}/${pname}-${version}-unpacked-linux.tar.gz";
     name = "tutanota-desktop-${version}.tar.gz";
-    sha256 = "sha256-RlEgpXco0lkkjlJ8FZz4MxYznKLPl1Lxkb5MSmhOTzI=";
+    sha256 = "0kkkp0nw4fby4663w7g0k2y1sg89pm336slzii1s3n70h8cak3dx";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/version-management/gitlab/data.json b/pkgs/applications/version-management/gitlab/data.json
index 4585eda4947..cc8cd00b7d1 100644
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@@ -1,14 +1,14 @@
 {
-  "version": "14.10.1",
-  "repo_hash": "13868wb0zr862xaxapp8nxh16gjsawklw66rlxx95bhhm3r81nrp",
+  "version": "14.10.2",
+  "repo_hash": "0f7cfc1wrzz4m5yhd6jnp3dqpdy7vbj8bf826zjsi2ss48430bk0",
   "yarn_hash": "17wxqvig34namf8kvh8bwci3y0f3k2nl4zs99jcvskdad9p45rlc",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v14.10.1-ee",
+  "rev": "v14.10.2-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "14.10.1",
+    "GITALY_SERVER_VERSION": "14.10.2",
     "GITLAB_PAGES_VERSION": "1.56.1",
     "GITLAB_SHELL_VERSION": "13.25.1",
-    "GITLAB_WORKHORSE_VERSION": "14.10.1"
+    "GITLAB_WORKHORSE_VERSION": "14.10.2"
   }
 }
diff --git a/pkgs/applications/version-management/gitlab/gitaly/default.nix b/pkgs/applications/version-management/gitlab/gitaly/default.nix
index 3126ce718e8..127a4ec461f 100644
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@@ -11,7 +11,7 @@ let
     gemdir = ./.;
   };
 
-  version = "14.10.1";
+  version = "14.10.2";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/v${lib.versions.major version}";
 in
 
@@ -23,7 +23,7 @@ buildGoModule {
     owner = "gitlab-org";
     repo = "gitaly";
     rev = "v${version}";
-    sha256 = "sha256-4TbCfe41Nea1p0aDqGbF4SskUl5r9LRHKA16DH97jMI=";
+    sha256 = "sha256-hLTzkW5GDq1AgTwe1pVj6Tiyd0JpJ76ATFu3Q+m9MVg=";
   };
 
   vendorSha256 = "sha256-ZL61t+Ii2Ns3TmitiF93exinod54+RCqrbdpU67HeY0=";
diff --git a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
index 602d8650f33..2613fe85f81 100644
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@@ -5,7 +5,7 @@ in
 buildGoModule rec {
   pname = "gitlab-workhorse";
 
-  version = "14.10.1";
+  version = "14.10.2";
 
   src = fetchFromGitLab {
     owner = data.owner;
diff --git a/pkgs/applications/video/ffmpeg-normalize/default.nix b/pkgs/applications/video/ffmpeg-normalize/default.nix
index 9331471c747..4f77118c0a4 100644
--- a/pkgs/applications/video/ffmpeg-normalize/default.nix
+++ b/pkgs/applications/video/ffmpeg-normalize/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonApplication rec {
   pname = "ffmpeg-normalize";
-  version = "1.22.9";
+  version = "1.22.10";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-RBrCIDinPXbXKqrrhqVf3rV4rfi+2PttIaYxUKOk7hs=";
+    sha256 = "sha256-F058lCuIxH0lqJlPrWIznu2Ks2w+KXrTnJD7CmYSZFU=";
   };
 
   propagatedBuildInputs = [ ffmpeg ffmpeg-progress-yield ];
diff --git a/pkgs/applications/virtualization/docker/compose.nix b/pkgs/applications/virtualization/docker/compose.nix
index fc264cdc590..1b58b4ee9cf 100644
--- a/pkgs/applications/virtualization/docker/compose.nix
+++ b/pkgs/applications/virtualization/docker/compose.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "docker-compose";
-  version = "2.4.1";
+  version = "2.5.0";
 
   src = fetchFromGitHub {
     owner = "docker";
     repo = "compose";
     rev = "v${version}";
-    sha256 = "sha256-6yc+7Fc22b8xN8thRrxxpjdEz19aBYCWxgkh/nra784=";
+    sha256 = "sha256-gb2XFIzYU1dZh8WPheb4073AOLdfT7CbBD89HxobY9Y=";
   };
 
-  vendorSha256 = "sha256-N+paN3zEXzzUFb2JPVIDZYZ0h0iu7naiw4pSVnGsuKQ=";
+  vendorSha256 = "sha256-2pWBMXVnmKE4D7JXaKOqtuCz7nsX2a/58lyLp58OTYI=";
 
   ldflags = [ "-X github.com/docker/compose/v2/internal.Version=${version}" "-s" "-w" ];
 
diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index ef9050f47d9..125061bedaf 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -186,7 +186,7 @@ rec {
       export BUILDTIME="1970-01-01T00:00:00Z"
       source ./scripts/build/.variables
       export CGO_ENABLED=1
-      go build -tags pkcs11 --ldflags "$LDFLAGS" github.com/docker/cli/cmd/docker
+      go build -tags pkcs11 --ldflags "$GO_LDFLAGS" github.com/docker/cli/cmd/docker
       cd -
     '';
 
@@ -243,19 +243,19 @@ rec {
   # Get revisions from
   # https://github.com/moby/moby/tree/${version}/hack/dockerfile/install/*
   docker_20_10 = callPackage dockerGen rec {
-    version = "20.10.14";
+    version = "20.10.15";
     rev = "v${version}";
-    sha256 = "sha256-eDwgqFx4io++SMOjhxMxVzqzcOgOnv6Xe/qmmPCvZts=";
+    sha256 = "sha256-uzwnXDomho5/Px4Ou/zP8Vedo2J9hVfcaFzM9vWh2Mo=";
     moby-src = fetchFromGitHub {
       owner = "moby";
       repo = "moby";
       rev = "v${version}";
-      sha256 = "sha256-I5oxpFLH789I2Sb29OXDaM4fCbQT/KvPq0DYcAVp0aI=";
+      sha256 = "sha256-+Eds5WI+Ujz/VxkWb1ToaGLk7wROTwWwJYpiZRIxAf0";
     };
-    runcRev = "v1.0.3";
-    runcSha256 = "sha256-Tl/JKbIpao+FCjngPzaVkxse50zo3XQ9Mg/AdkblMcI=";
-    containerdRev = "v1.5.11";
-    containerdSha256 = "sha256-YzFtv6DIjImSK0SywxhZrEeEmCnHTceAi3pfwnPubKg=";
+    runcRev = "v1.1.1";
+    runcSha256 = "sha256-6g2km+Y45INo2MTWMFFQFhfF8DAR5Su+YrJS8k3LYBY=";
+    containerdRev = "v1.6.4";
+    containerdSha256 = "sha256-425BcVHCliAHFQqGn6sWH/ahDX3JR6l/sYZWHpgmZW0=";
     tiniRev = "v0.19.0";
     tiniSha256 = "sha256-ZDKu/8yE5G0RYFJdhgmCdN3obJNyRWv6K/Gd17zc1sI=";
   };
diff --git a/pkgs/desktops/gnome/core/gnome-control-center/default.nix b/pkgs/desktops/gnome/core/gnome-control-center/default.nix
index c7da1e43a15..dbe3665f1ef 100644
--- a/pkgs/desktops/gnome/core/gnome-control-center/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-control-center/default.nix
@@ -2,7 +2,6 @@
 , lib
 , stdenv
 , substituteAll
-, fetchpatch
 , accountsservice
 , adwaita-icon-theme
 , colord
@@ -64,11 +63,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-control-center";
-  version = "42.0";
+  version = "42.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-BzLvp8QXHOCg7UEGWAtM41pXsQFSwOo20jkTSRN3fto=";
+    sha256 = "sha256-+zCv+Q++HSrVYQfW6fX4pKOq82NbvYiSDXW1aLt3Z4U=";
   };
 
   patches = [
@@ -79,13 +78,6 @@ stdenv.mkDerivation rec {
       inherit glibc libgnomekbd tzdata;
       inherit cups networkmanagerapplet;
     })
-
-    # Fix Online Accounts configuration on X11
-    # https://gitlab.gnome.org/GNOME/gnome-control-center/-/merge_requests/1272
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/gnome-control-center/-/commit/7fe322b9cedae313cd9af6f403eab9bfc6027674.patch";
-      sha256 = "cv1abqv0Kbfkfu7mZzEaZKXPE85yVBcQbjNHW+8ODFE=";
-    })
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/development/compilers/gcc/11/Added-mcf-thread-model-support-from-mcfgthread.patch b/pkgs/development/compilers/gcc/11/Added-mcf-thread-model-support-from-mcfgthread.patch
index d9809e828f1..77202438e47 100644
--- a/pkgs/development/compilers/gcc/11/Added-mcf-thread-model-support-from-mcfgthread.patch
+++ b/pkgs/development/compilers/gcc/11/Added-mcf-thread-model-support-from-mcfgthread.patch
@@ -222,16 +222,16 @@ index de920d714c6..665fb74bd6b 100644
 +#ifdef __USING_MCFGTHREAD__
 +
 +#include <mcfgthread/gthread.h>
-+
++namespace __cxxabiv1 {
 +extern "C" int
-+__cxxabiv1::__cxa_thread_atexit (void (*dtor)(void *),
++__cxa_thread_atexit (void (_GLIBCXX_CDTOR_CALLABI *dtor)(void *),
 +				 void *obj, void *dso_handle)
 +  _GLIBCXX_NOTHROW
 +{
 +  return ::_MCFCRT_AtThreadExit((void (*)(_MCFCRT_STD intptr_t))dtor, (_MCFCRT_STD intptr_t)obj) ? 0 : -1;
 +  (void)dso_handle;
 +}
-+
++}
 +#else // __USING_MCFGTHREAD__
 +
  #ifdef _GLIBCXX_THREAD_ATEXIT_WIN32
diff --git a/pkgs/development/compilers/vala/default.nix b/pkgs/development/compilers/vala/default.nix
index 8013f283c70..8dc2b4c02bb 100644
--- a/pkgs/development/compilers/vala/default.nix
+++ b/pkgs/development/compilers/vala/default.nix
@@ -100,8 +100,8 @@ in rec {
   };
 
   vala_0_56 = generic {
-    version = "0.56.0";
-    sha256 = "2SvRPFYwkF7rapg9y3AiBNqXMUYMKm5OOfhnmW83EEA=";
+    version = "0.56.1";
+    sha256 = "xRi4Hf3agtHN9Yaz+bIyMWLLlr08taLANlDOoCXZH7k=";
   };
 
   vala = vala_0_54;
diff --git a/pkgs/development/interpreters/hy/builder.nix b/pkgs/development/interpreters/hy/builder.nix
deleted file mode 100644
index 6757f859ac1..00000000000
--- a/pkgs/development/interpreters/hy/builder.nix
+++ /dev/null
@@ -1,40 +0,0 @@
-{ lib
-, python3Packages
-, hyDefinedPythonPackages /* Packages like with python.withPackages */
-, ...
-}:
-python3Packages.buildPythonApplication rec {
-  pname = "hy";
-  version = "1.0a1";
-
-  src = python3Packages.fetchPypi {
-    inherit pname version;
-    sha256 = "sha256-lCrbvbkeutSNmvvn/eHpTnJwPb5aEH7hWTXYSE+AJmU=";
-  };
-
-  checkInputs = with python3Packages; [ flake8 pytest ];
-
-  propagatedBuildInputs = with python3Packages; [
-    appdirs
-    astor
-    clint
-    colorama
-    fastentrypoints
-    funcparserlib
-    rply
-    pygments
-  ] ++ (hyDefinedPythonPackages python3Packages);
-
-  # Hy does not include tests in the source distribution from PyPI, so only test executable.
-  checkPhase = ''
-    $out/bin/hy --help > /dev/null
-  '';
-
-  meta = with lib; {
-    description = "A LISP dialect embedded in Python";
-    homepage = "https://hylang.org/";
-    license = licenses.mit;
-    maintainers = with maintainers; [ nixy mazurel ];
-    platforms = platforms.all;
-  };
-}
diff --git a/pkgs/development/interpreters/hy/default.nix b/pkgs/development/interpreters/hy/default.nix
deleted file mode 100644
index f5d80c11d71..00000000000
--- a/pkgs/development/interpreters/hy/default.nix
+++ /dev/null
@@ -1,15 +0,0 @@
-{ lib
-, callPackage
-, hyDefinedPythonPackages ? python-packages: [] /* Packages like with python.withPackages */
-}:
-let
-  withPackages = (
-    python-packages: callPackage ./builder.nix {
-      hyDefinedPythonPackages = python-packages;
-    }
-  );
-in
-(withPackages hyDefinedPythonPackages) // {
-  # Export withPackages function for hy customization
-  inherit withPackages;
-}
diff --git a/pkgs/development/libraries/amtk/default.nix b/pkgs/development/libraries/amtk/default.nix
index 5743a18c0fd..961c63a3037 100644
--- a/pkgs/development/libraries/amtk/default.nix
+++ b/pkgs/development/libraries/amtk/default.nix
@@ -1,10 +1,13 @@
-{ lib, stdenv
+{ stdenv
+, lib
 , fetchurl
 , gtk3
 , meson
 , ninja
 , pkg-config
 , gobject-introspection
+, gtk-doc
+, docbook-xsl-nons
 , gnome
 , dbus
 , xvfb-run
@@ -12,11 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "amtk";
-  version = "5.3.1";
+  version = "5.4.0";
+
+  outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "12v3nj1bb7507ndprjggq0hpz8k719b4bwvl8sm43p3ibmn27anm";
+    sha256 = "g10IUHo96sie91NRzOu0szWv/qNhuIvQ+mZ/QM53enA=";
   };
 
   nativeBuildInputs = [
@@ -25,6 +30,8 @@ stdenv.mkDerivation rec {
     pkg-config
     dbus
     gobject-introspection
+    gtk-doc
+    docbook-xsl-nons
   ];
 
   buildInputs = [
diff --git a/pkgs/development/libraries/babl/default.nix b/pkgs/development/libraries/babl/default.nix
index 7a3c8bc727b..3d396a0b285 100644
--- a/pkgs/development/libraries/babl/default.nix
+++ b/pkgs/development/libraries/babl/default.nix
@@ -1,7 +1,6 @@
 { stdenv
 , lib
 , fetchurl
-, fetchpatch
 , meson
 , ninja
 , pkg-config
@@ -12,21 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "babl";
-  version = "0.1.90";
+  version = "0.1.92";
 
   outputs = [ "out" "dev" ];
 
-  patches = [
-    # Fix darwin build
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/babl/-/commit/33b18e74c9589fd4d5507ab88bd1fb19c15965dd.patch";
-      sha256 = "bEjjOjHGTF55o1z31G9GNDqERxn/7vUuWZQYHosSEBQ=";
-    })
-  ];
-
   src = fetchurl {
     url = "https://download.gimp.org/pub/babl/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-bi67Y283WBWI49AkmbPS9p+axz40omL0KRHX9ZBqkkM=";
+    sha256 = "sha256-9mdzUCiUS2N1rRjxYKZM65P1x9zKqdh1HeNZd3SIosE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/glibmm/2.68.nix b/pkgs/development/libraries/glibmm/2.68.nix
index e0ef34a451e..f1f3df86349 100644
--- a/pkgs/development/libraries/glibmm/2.68.nix
+++ b/pkgs/development/libraries/glibmm/2.68.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "glibmm";
-  version = "2.72.0";
+  version = "2.72.1";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-eCkkvxNklvOHj9wqCqnvQPDFFeLD4FTK/6XS5SOAxx4=";
+    sha256 = "sha256-KnZJooq13FOsTau3bJ9hWZ+8Yokjq2p910v2ddkVXNg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/glibmm/default.nix b/pkgs/development/libraries/glibmm/default.nix
index 8ba33b98634..996eacd65f4 100644
--- a/pkgs/development/libraries/glibmm/default.nix
+++ b/pkgs/development/libraries/glibmm/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "glibmm";
-  version = "2.66.3";
+  version = "2.66.4";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-r7liAkkUhdP0QQLZghmhctotP563j848+5JVm6SW5Jk=";
+    sha256 = "sha256-GZrOVoLYGxWh1WVIC0qVBoLy22QCyKpd1yF9ce3/gdU=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/gnome-desktop/default.nix b/pkgs/development/libraries/gnome-desktop/default.nix
index 5d682e23b27..49f21fa5404 100644
--- a/pkgs/development/libraries/gnome-desktop/default.nix
+++ b/pkgs/development/libraries/gnome-desktop/default.nix
@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-desktop";
-  version = "42.0";
+  version = "42.1";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-desktop/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-88qik6Xob2zK0Y+BcnPbHGcGHmgNedg5qop1KOW7JtY=";
+    sha256 = "sha256-JDOrYG0kTDUk3luBIJTbimcPsR7Z/3GAwtAhrh/J/AU=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/gtkmm/3.x.nix b/pkgs/development/libraries/gtkmm/3.x.nix
index 2d0921cf097..420dee6cbaa 100644
--- a/pkgs/development/libraries/gtkmm/3.x.nix
+++ b/pkgs/development/libraries/gtkmm/3.x.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gtkmm";
-  version = "3.24.5";
+  version = "3.24.6";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1ri2msp3cmzi6r65ghwb8gfavfaxv0axpwi3q60nm7v8hvg36qw5";
+    sha256 = "Sz4ULpROFjO7oAiQBgXDQak8/XVaf6KgCwXQQTQfEdY=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/tepl/default.nix b/pkgs/development/libraries/tepl/default.nix
index f561efb473c..a10ad67b23d 100644
--- a/pkgs/development/libraries/tepl/default.nix
+++ b/pkgs/development/libraries/tepl/default.nix
@@ -9,17 +9,19 @@
 , gtksourceview4
 , icu
 , pkg-config
+, gtk-doc
+, docbook-xsl-nons
 }:
 
 stdenv.mkDerivation rec {
   pname = "tepl";
-  version = "6.00.0";
+  version = "6.0.1";
 
-  outputs = [ "out" "dev" ];
+  outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0qvs7s86gqyyrzi0r5fbrj8zczlgv8xhdjswgbgc1afwjnl9fqx8";
+    sha256 = "J08Fa75V8wpq5EQq0i8VfQTTphtWjZC8hRF7txMgIME=";
   };
 
   nativeBuildInputs = [
@@ -27,6 +29,8 @@ stdenv.mkDerivation rec {
     ninja
     gobject-introspection
     pkg-config
+    gtk-doc
+    docbook-xsl-nons
   ];
 
   buildInputs = [
diff --git a/pkgs/development/libraries/xdg-desktop-portal/default.nix b/pkgs/development/libraries/xdg-desktop-portal/default.nix
index 9a8bee561c1..c8706c737b1 100644
--- a/pkgs/development/libraries/xdg-desktop-portal/default.nix
+++ b/pkgs/development/libraries/xdg-desktop-portal/default.nix
@@ -27,7 +27,7 @@
 
 stdenv.mkDerivation rec {
   pname = "xdg-desktop-portal";
-  version = "1.14.3";
+  version = "1.14.4";
 
   outputs = [ "out" "installedTests" ];
 
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     owner = "flatpak";
     repo = pname;
     rev = version;
-    sha256 = "CDqTQQ8dOatOxDKR+HiVQgSJKxH6ZstskKdR84U/870=";
+    sha256 = "///X0inMi9Znuhjn9n0HlVLa5/kFWpKorKS8RY9WeYM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/ocaml-modules/janestreet/0.14.nix b/pkgs/development/ocaml-modules/janestreet/0.14.nix
index 800b1c1e531..cee30da45c9 100644
--- a/pkgs/development/ocaml-modules/janestreet/0.14.nix
+++ b/pkgs/development/ocaml-modules/janestreet/0.14.nix
@@ -313,6 +313,7 @@ with self;
     meta.description = "A library for building dynamic webapps, using Js_of_ocaml";
     buildInputs = [ js_of_ocaml-ppx ];
     propagatedBuildInputs = [ async_js incr_map incr_select virtual_dom ];
+    patches = [ ./incr_dom_jsoo_4_0.patch ];
   };
 
   incr_map = janePackage {
diff --git a/pkgs/development/ocaml-modules/janestreet/incr_dom_jsoo_4_0.patch b/pkgs/development/ocaml-modules/janestreet/incr_dom_jsoo_4_0.patch
new file mode 100644
index 00000000000..4e7a45ce96d
--- /dev/null
+++ b/pkgs/development/ocaml-modules/janestreet/incr_dom_jsoo_4_0.patch
@@ -0,0 +1,24 @@
+diff --git a/src/js_misc.ml b/src/js_misc.ml
+index 65f7b44..bfef103 100644
+--- a/src/js_misc.ml
++++ b/src/js_misc.ml
+@@ -28,17 +28,11 @@ type rows_or_columns =
+ [@@deriving sexp, bin_io, variants, compare]
+ 
+ let innerHeight () =
+-  Js.Optdef.case
+-    Dom_html.window##.innerHeight
+-    (fun () -> Dom_html.document##.documentElement##.clientHeight)
+-    Fn.id
++  Dom_html.window##.innerHeight
+ ;;
+ 
+ let innerWidth () =
+-  Js.Optdef.case
+-    Dom_html.window##.innerWidth
+-    (fun () -> Dom_html.document##.documentElement##.clientWidth)
+-    Fn.id
++  Dom_html.window##.innerWidth
+ ;;
+ 
+ let element_is_in_viewport (elt : Dom_html.element Js.t) =
diff --git a/pkgs/development/ocaml-modules/ocsigen-toolkit/default.nix b/pkgs/development/ocaml-modules/ocsigen-toolkit/default.nix
index 12a92c5be39..60a07d30d05 100644
--- a/pkgs/development/ocaml-modules/ocsigen-toolkit/default.nix
+++ b/pkgs/development/ocaml-modules/ocsigen-toolkit/default.nix
@@ -5,7 +5,7 @@
 stdenv.mkDerivation rec {
  pname = "ocsigen-toolkit";
  name = "ocaml${ocaml.version}-${pname}-${version}";
- version = "3.1.1";
+ version = "3.2.0";
 
  propagatedBuildInputs = [ calendar js_of_ocaml-ppx_deriving_json eliom ];
  nativeBuildInputs = [ ocaml findlib opaline eliom ];
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     owner = "ocsigen";
     repo = pname;
     rev = version;
-    sha256 = "sha256:1fm0vvccmjib9yj5m2760vhzb4z3392swlprp51az53g3vk4q218";
+    sha256 = "sha256:13n0y8a80bl94la4lnp9dr2x7b8plhm17g9zgf0l6x42g3886pw7";
   };
 
   meta = {
diff --git a/pkgs/development/python-modules/ailment/default.nix b/pkgs/development/python-modules/ailment/default.nix
index 9f6828fd632..bc977348a71 100644
--- a/pkgs/development/python-modules/ailment/default.nix
+++ b/pkgs/development/python-modules/ailment/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "ailment";
-  version = "9.2.1";
+  version = "9.2.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-F0t4vVxi4KUUtIZc8FJD9+2qf1XA58haFfjmHwAQaWA=";
+    hash = "sha256-JJ5wrjXazq0+6f4nccLRYaAgTg0d39REXmPHVchDzaE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/angr/default.nix b/pkgs/development/python-modules/angr/default.nix
index 31629eab9d6..a65d681a17b 100644
--- a/pkgs/development/python-modules/angr/default.nix
+++ b/pkgs/development/python-modules/angr/default.nix
@@ -46,7 +46,7 @@ in
 
 buildPythonPackage rec {
   pname = "angr";
-  version = "9.2.1";
+  version = "9.2.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -55,7 +55,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-7t4NV1udBq3tK7czuKYUsQ+9tLahFM8DlUUBT3d6bco=";
+    hash = "sha256-aniLMNKfEqlVkniS2mSCaeXIOc0EC4zOR59kiGTNUWk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/angrop/default.nix b/pkgs/development/python-modules/angrop/default.nix
index d32441a989c..47ecddb0447 100644
--- a/pkgs/development/python-modules/angrop/default.nix
+++ b/pkgs/development/python-modules/angrop/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "angrop";
-  version = "9.2.1";
+  version = "9.2.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-VhlsRd5IN8zF6aUU5Ji/ULkdecOpR+egU3vhYpi+KL8=";
+    hash = "sha256-LCgY/eOtRulnMeYt96ZYI8vPyyM+jxjlkxTd8Cmnfe0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/archinfo/default.nix b/pkgs/development/python-modules/archinfo/default.nix
index b9b29a7167a..e6cd183d413 100644
--- a/pkgs/development/python-modules/archinfo/default.nix
+++ b/pkgs/development/python-modules/archinfo/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "archinfo";
-  version = "9.2.1";
+  version = "9.2.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-RWdY7tzT5wDVjAn1QIkQm8b5lIo++VzktsYZxn8taeg=";
+    hash = "sha256-wJEipAlqBsP2tgsRDVDe1ZtiEg1uhpP+1P1VGU7tBBw=";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/brunt/default.nix b/pkgs/development/python-modules/brunt/default.nix
new file mode 100644
index 00000000000..1c11e92b234
--- /dev/null
+++ b/pkgs/development/python-modules/brunt/default.nix
@@ -0,0 +1,47 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchPypi
+, aiohttp
+, requests
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "brunt";
+  version = "1.2.0";
+
+  disabled = pythonOlder "3.8";
+
+  format = "setuptools";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "e704627dc7b9c0a50c67ae90f1d320b14f99f2b2fc9bf1ef0461b141dcf1bce9";
+  };
+
+  postPatch = ''
+    sed -i '/--cov/d' setup.cfg
+  '';
+
+  propagatedBuildInputs = [
+    aiohttp
+    requests
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  # tests require Brunt hardware
+  doCheck = false;
+
+  pythonImportsCheck = [ "brunt" ];
+
+  meta = {
+    description = "Unofficial Python SDK for Brunt";
+    homepage = "https://github.com/eavanvalkenburg/brunt-api";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ dotlambda ];
+  };
+}
diff --git a/pkgs/development/python-modules/ciscoconfparse/default.nix b/pkgs/development/python-modules/ciscoconfparse/default.nix
index 49b36a5c658..535c46fc40a 100644
--- a/pkgs/development/python-modules/ciscoconfparse/default.nix
+++ b/pkgs/development/python-modules/ciscoconfparse/default.nix
@@ -1,24 +1,27 @@
 { lib
 , buildPythonPackage
-, fetchFromGitHub
-, poetry-core
-, passlib
 , dnspython
+, fetchFromGitHub
 , loguru
-, toml
+, passlib
+, poetry-core
 , pytestCheckHook
+, pythonOlder
+, toml
 }:
 
 buildPythonPackage rec {
   pname = "ciscoconfparse";
-  version = "1.6.36";
+  version = "1.6.40";
   format = "pyproject";
 
+  disabled = pythonOlder "3.7";
+
   src = fetchFromGitHub {
     owner = "mpenning";
     repo = pname;
     rev = version;
-    sha256 = "sha256-nIuuqAxz8eHEQRuH8nfYVQ+vGMmcDcARJLizoI5Mty8=";
+    hash = "sha256-2j1AlCIwTxIjotZ0fSt1zhsgPfJTqJukZ6KQvh74NJ8=";
   };
 
   postPatch = ''
@@ -45,17 +48,19 @@ buildPythonPackage rec {
   ];
 
   disabledTests = [
+    # Tests require network access
     "test_dns_lookup"
     "test_reverse_dns_lookup"
   ];
 
-  pythonImportsCheck = [ "ciscoconfparse" ];
+  pythonImportsCheck = [
+    "ciscoconfparse"
+  ];
 
   meta = with lib; {
-    description =
-      "Parse, Audit, Query, Build, and Modify Cisco IOS-style configurations";
+    description = "Parse, Audit, Query, Build, and Modify Cisco IOS-style configurations";
     homepage = "https://github.com/mpenning/ciscoconfparse";
     license = licenses.gpl3Only;
-    maintainers = [ maintainers.astro ];
+    maintainers = with maintainers; [ astro ];
   };
 }
diff --git a/pkgs/development/python-modules/claripy/default.nix b/pkgs/development/python-modules/claripy/default.nix
index 8f66e8551ed..eafc0c3f427 100644
--- a/pkgs/development/python-modules/claripy/default.nix
+++ b/pkgs/development/python-modules/claripy/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "claripy";
-  version = "9.2.1";
+  version = "9.2.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-pCqhSpZfX3u9vJ8Oy1yyicagBQYK5+jBVCEab0TnGA4=";
+    hash = "sha256-b07WygCR3IhRgyt7u1ipyyK4MM3TNeLW04WoZJ2eQZk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/cle/default.nix b/pkgs/development/python-modules/cle/default.nix
index 8ee898b445e..cbbb130a6aa 100644
--- a/pkgs/development/python-modules/cle/default.nix
+++ b/pkgs/development/python-modules/cle/default.nix
@@ -15,7 +15,7 @@
 
 let
   # The binaries are following the argr projects release cycle
-  version = "9.2.1";
+  version = "9.2.2";
 
   # Binary files from https://github.com/angr/binaries (only used for testing and only here)
   binaries = fetchFromGitHub {
@@ -37,7 +37,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-OGdnrRFfx2LMMsw6giPC+4izWX603cYbpKHuslj4Gng=";
+    hash = "sha256-vEnhoVxn/p4CNzfHFM1cKaQ3ESsJx5U4+Lz4/LDCtao=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/dnachisel/default.nix b/pkgs/development/python-modules/dnachisel/default.nix
index 0f30113ba2f..1c86e3bccf6 100644
--- a/pkgs/development/python-modules/dnachisel/default.nix
+++ b/pkgs/development/python-modules/dnachisel/default.nix
@@ -15,13 +15,13 @@
 
 buildPythonPackage rec {
   pname = "dnachisel";
-  version = "3.2.8";
+  version = "3.2.9";
 
   src = fetchFromGitHub {
     owner = "Edinburgh-Genome-Foundry";
     repo = "DnaChisel";
-    rev = "v${version}";
-    sha256 = "17jldscmsq5lwp3pnjlxg56k3vfpr7rj4qbcbzkzhphifrfgm729";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-Fg0gkI+01xIt8LQmNmRzkzd4AObg/99x34y5NclMtDQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/flametree/default.nix b/pkgs/development/python-modules/flametree/default.nix
index b4311eeb7cd..047f2849d04 100644
--- a/pkgs/development/python-modules/flametree/default.nix
+++ b/pkgs/development/python-modules/flametree/default.nix
@@ -10,13 +10,13 @@
 
 buildPythonPackage rec {
   pname = "flametree";
-  version = "0.1.11";
+  version = "0.1.12";
 
   src = fetchFromGitHub {
     owner = "Edinburgh-Genome-Foundry";
     repo = "Flametree";
-    rev = "v${version}";
-    sha256 = "1ynrk1ivl1vjiga0ayl8k89vs5il7i0pf9jz2ycn771c47szwk4x";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-oyiuhsYouGDKRssKc0aYIoG32H7GS6Bn4RtI7/9N158=";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/hy/default.nix b/pkgs/development/python-modules/hy/default.nix
index 63625bd7ee6..a962f86854f 100644
--- a/pkgs/development/python-modules/hy/default.nix
+++ b/pkgs/development/python-modules/hy/default.nix
@@ -4,31 +4,44 @@
 , colorama
 , fetchFromGitHub
 , funcparserlib
+, hy
 , pytestCheckHook
+, python
 , pythonOlder
 , rply
+, testers
+, toPythonApplication
+, hyDefinedPythonPackages ? python-packages: [ ] /* Packages like with python.withPackages */
 }:
 
 buildPythonPackage rec {
   pname = "hy";
-  version = "1.0a3";
+  version = "1.0a4";
+  format = "setuptools";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "hylang";
     repo = pname;
     rev = version;
-    sha256 = "1dqw24rvsps2nab1pbjjm1c81vrs34r4kkk691h3xdyxnv9hb84b";
+    sha256 = "sha256-MBzp3jqBg/kH233wcgYYHc+Yg9GuOaBsXIfjFDihD1E=";
   };
 
+  # https://github.com/hylang/hy/blob/1.0a4/get_version.py#L9-L10
+  HY_VERSION = version;
+
   propagatedBuildInputs = [
     colorama
     funcparserlib
-    rply
-  ] ++ lib.optionals (pythonOlder "3.9") [
+    rply # TODO: remove on the next release
+  ]
+  ++ lib.optionals (pythonOlder "3.9") [
     astor
-  ];
+  ]
+  # for backwards compatibility with removed pkgs/development/interpreters/hy
+  # See: https://github.com/NixOS/nixpkgs/issues/171428
+  ++ (hyDefinedPythonPackages python.pkgs);
 
   checkInputs = [
     pytestCheckHook
@@ -43,10 +56,22 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "hy" ];
 
+  passthru = {
+    tests.version = testers.testVersion {
+      package = hy;
+      command = "hy -v";
+    };
+    # also for backwards compatibility with removed pkgs/development/interpreters/hy
+    withPackages = python-packages: (toPythonApplication hy).override {
+      hyDefinedPythonPackages = python-packages;
+    };
+  };
+
   meta = with lib; {
-    description = "Python to/from Lisp layer";
-    homepage = "https://github.com/hylang/hy";
+    description = "A LISP dialect embedded in Python";
+    homepage = "https://hylang.org/";
+    changelog = "https://github.com/hylang/hy/releases/tag/${version}";
     license = licenses.mit;
-    maintainers = with maintainers; [ fab ];
+    maintainers = with maintainers; [ fab mazurel nixy thiagokokada ];
   };
 }
diff --git a/pkgs/development/python-modules/hyrule/default.nix b/pkgs/development/python-modules/hyrule/default.nix
new file mode 100644
index 00000000000..46ed096486b
--- /dev/null
+++ b/pkgs/development/python-modules/hyrule/default.nix
@@ -0,0 +1,43 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, hy
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "hyrule";
+  version = "0.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "hylang";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-sqS5vOcbln+Vfv/Ji/8rJ4GTQpXIuhgf+MukjV0Kkuw=";
+  };
+
+  propagatedBuildInputs = [
+    hy
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  # Some tests depends on hy on PATH
+  preCheck = "PATH=${hy}/bin:$PATH";
+
+  pythonImportsCheck = [ "hyrule" ];
+
+  meta = with lib; {
+    description = "Hyrule is a utility library for the Hy programming language";
+    homepage = "https://github.com/hylang/hyrule";
+    changelog = "https://github.com/hylang/hylure/releases/tag/${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ thiagokokada ];
+  };
+}
diff --git a/pkgs/development/python-modules/jupyter-sphinx/default.nix b/pkgs/development/python-modules/jupyter-sphinx/default.nix
index 2da21db1eb1..56cd051ecf4 100644
--- a/pkgs/development/python-modules/jupyter-sphinx/default.nix
+++ b/pkgs/development/python-modules/jupyter-sphinx/default.nix
@@ -5,6 +5,7 @@
 , sphinx
 , ipywidgets
 , pythonOlder
+, nbconvert
 }:
 
 buildPythonPackage rec {
@@ -17,7 +18,7 @@ buildPythonPackage rec {
     sha256 = "37fc9408385c45326ac79ca0452fbd7ae2bf0e97842d626d2844d4830e30aaf2";
   };
 
-  propagatedBuildInputs = [ nbformat sphinx ipywidgets ];
+  propagatedBuildInputs = [ nbconvert nbformat sphinx ipywidgets ];
 
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/jupyter_server/default.nix b/pkgs/development/python-modules/jupyter_server/default.nix
index 2cb7d06b646..dd8368676d1 100644
--- a/pkgs/development/python-modules/jupyter_server/default.nix
+++ b/pkgs/development/python-modules/jupyter_server/default.nix
@@ -10,6 +10,7 @@
 , jinja2
 , tornado
 , pyzmq
+, ipykernel
 , ipython_genutils
 , traitlets
 , jupyter_core
@@ -62,6 +63,7 @@ buildPythonPackage rec {
   ];
 
   checkInputs = [
+    ipykernel
     pytestCheckHook
     pytest-tornasync
     requests
diff --git a/pkgs/development/python-modules/nbconvert/default.nix b/pkgs/development/python-modules/nbconvert/default.nix
index 69aa660f142..9b85586f7d9 100644
--- a/pkgs/development/python-modules/nbconvert/default.nix
+++ b/pkgs/development/python-modules/nbconvert/default.nix
@@ -1,25 +1,19 @@
-{ lib
+{ beautifulsoup4
+, bleach
 , buildPythonPackage
+, defusedxml
 , fetchPypi
-, pytestCheckHook
-, glibcLocales
-, entrypoints
-, bleach
-, mistune
-, nbclient
+, ipywidgets
 , jinja2
-, pygments
-, traitlets
-, jupyter_core
 , jupyterlab-pygments
-, nbformat
-, ipykernel
+, lib
+, markupsafe
+, mistune
+, nbclient
 , pandocfilters
-, tornado
-, jupyter-client
-, defusedxml
+, pyppeteer
+, pytestCheckHook
 , tinycss2
-, beautifulsoup4
 }:
 
 buildPythonPackage rec {
@@ -42,37 +36,38 @@ buildPythonPackage rec {
     substituteAllInPlace ./nbconvert/exporters/templateexporter.py
   '';
 
-  checkInputs = [ pytestCheckHook glibcLocales ];
-
   propagatedBuildInputs = [
-    entrypoints bleach mistune jinja2 pygments traitlets
-    jupyter_core nbformat ipykernel pandocfilters tornado jupyter-client
-    defusedxml tinycss2 beautifulsoup4
-    nbclient
+    beautifulsoup4
+    bleach
+    defusedxml
+    jinja2
     jupyterlab-pygments
+    markupsafe
+    mistune
+    nbclient
+    pandocfilters
+    tinycss2
   ];
 
-  # disable preprocessor tests for ipython 7
-  # see issue https://github.com/jupyter/nbconvert/issues/898
   preCheck = ''
-    export LC_ALL=en_US.UTF-8
-    HOME=$(mktemp -d)
+    export HOME=$(mktemp -d)
   '';
 
-  pytestFlagsArray = [
-    "--ignore=nbconvert/preprocessors/tests/test_execute.py"
-    # can't resolve template paths within sandbox
-    "--ignore=nbconvert/tests/base.py"
-    "--ignore=nbconvert/tests/test_nbconvertapp.py"
+  checkInputs = [
+    ipywidgets
+    pyppeteer
+    pytestCheckHook
   ];
 
+  pytestFlagsArray = [
+    # DeprecationWarning: Support for bleach <5 will be removed in a future version of nbconvert
+    "-W ignore::DeprecationWarning"
+  ];
 
   disabledTests = [
+    # Attempts network access (Failed to establish a new connection: [Errno -3] Temporary failure in name resolution)
     "test_export"
-    "test_webpdf_without_chromium"
-    #"test_cell_tag_output"
-    #"test_convert_from_stdin"
-    #"test_convert_full_qualified_name"
+    "test_webpdf_with_chromium"
   ];
 
   # Some of the tests use localhost networking.
diff --git a/pkgs/development/python-modules/pweave/default.nix b/pkgs/development/python-modules/pweave/default.nix
index b97d5149652..c9e2ff020f8 100644
--- a/pkgs/development/python-modules/pweave/default.nix
+++ b/pkgs/development/python-modules/pweave/default.nix
@@ -7,6 +7,7 @@
 , nbconvert
 , markdown
 , isPy3k
+, ipykernel
 }:
 
 buildPythonPackage rec {
@@ -21,7 +22,7 @@ buildPythonPackage rec {
   disabled = !isPy3k;
 
   buildInputs = [ mock pkgs.glibcLocales ];
-  propagatedBuildInputs = [ matplotlib nbconvert markdown ];
+  propagatedBuildInputs = [ ipykernel matplotlib nbconvert markdown ];
 
   # fails due to trying to run CSS as test
   doCheck = false;
diff --git a/pkgs/development/python-modules/pyupgrade/default.nix b/pkgs/development/python-modules/pyupgrade/default.nix
index e2c48948b97..ffd7a89dbb0 100644
--- a/pkgs/development/python-modules/pyupgrade/default.nix
+++ b/pkgs/development/python-modules/pyupgrade/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "pyupgrade";
-  version = "2.32.0";
+  version = "2.32.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "asottile";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-VSGi93R8O0LGKFBkWMclje64suOqq/Gf2vE2OHXLP5Q=";
+    sha256 = "sha256-fjahaMetgZaH+IzdyaZSkVbasgc0bqQL+1ae0OJriT0=";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/pyvex/default.nix b/pkgs/development/python-modules/pyvex/default.nix
index 799271371c7..509da93663d 100644
--- a/pkgs/development/python-modules/pyvex/default.nix
+++ b/pkgs/development/python-modules/pyvex/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "pyvex";
-  version = "9.2.1";
+  version = "9.2.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-b6LZJmAyxklvZxvane19dK/kQfbLPjkk29RydiWMZCY=";
+    hash = "sha256-jfquDFZylrrtYb3PbDmLDy7wHcvM8H2nIv4dRqRvY2U=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/scrapy/default.nix b/pkgs/development/python-modules/scrapy/default.nix
index 073059aec62..70feaa7108e 100644
--- a/pkgs/development/python-modules/scrapy/default.nix
+++ b/pkgs/development/python-modules/scrapy/default.nix
@@ -31,6 +31,8 @@
 buildPythonPackage rec {
   pname = "scrapy";
   version = "2.6.1";
+  format = "setuptools";
+
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
@@ -92,6 +94,7 @@ buildPythonPackage rec {
     "test_nested_xpath"
     "test_flavor_detection"
     # Requires network access
+    "AnonymousFTPTestCase"
     "FTPFeedStorageTest"
     "FeedExportTest"
     "test_custom_asyncio_loop_enabled_true"
@@ -99,6 +102,7 @@ buildPythonPackage rec {
     "test_custom_loop_asyncio_deferred_signal"
     "FileFeedStoragePreFeedOptionsTest"  # https://github.com/scrapy/scrapy/issues/5157
     "test_timeout_download_from_spider_nodata_rcvd"
+    "test_timeout_download_from_spider_server_hangs"
     # Fails with AssertionError
     "test_peek_fifo"
     "test_peek_one_element"
diff --git a/pkgs/development/python-modules/stripe/default.nix b/pkgs/development/python-modules/stripe/default.nix
index c49dd79679d..b47f3917b92 100644
--- a/pkgs/development/python-modules/stripe/default.nix
+++ b/pkgs/development/python-modules/stripe/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "stripe";
-  version = "2.75.0";
+  version = "2.76.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-iAjXsbeX+vZW8FtaJRIB5lR3EEkDUU/dPpLpdHSxLME=";
+    hash = "sha256-/T/Gk1w7YYmWcZFge2846+SQAFpZC00NQ/vjq6Rd7Kg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/tldextract/default.nix b/pkgs/development/python-modules/tldextract/default.nix
index 139f58660c4..fe32af26713 100644
--- a/pkgs/development/python-modules/tldextract/default.nix
+++ b/pkgs/development/python-modules/tldextract/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname   = "tldextract";
-  version = "3.2.1";
+  version = "3.3.0";
   format = "setuptools";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-rJMEzfgLCcN+6pZXmeDZrAqhzLZTH65Uiqvgm68aJUk=";
+    hash = "sha256-rc0kq/Ic40UEF81aAPI7fldVTOiugnM03RK/y7YnTPE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/tweepy/default.nix b/pkgs/development/python-modules/tweepy/default.nix
index a2c815b45e2..bcb6fbd3b06 100644
--- a/pkgs/development/python-modules/tweepy/default.nix
+++ b/pkgs/development/python-modules/tweepy/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "tweepy";
-  version = "4.8.0";
+  version = "4.9.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -20,8 +20,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-RaM2JN2WOHyZY+AxzgQLvhXg6UnevDbSFSR4jFLsYrc=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-BMRRunPRDW5J/7KU+pr2Uv9Qa6oHBwkA7tsGa5YdzLw=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/tools/security/whispers/default.nix b/pkgs/development/python-modules/whispers/default.nix
similarity index 70%
rename from pkgs/tools/security/whispers/default.nix
rename to pkgs/development/python-modules/whispers/default.nix
index 07c1f1e707e..02a1b050f91 100644
--- a/pkgs/tools/security/whispers/default.nix
+++ b/pkgs/development/python-modules/whispers/default.nix
@@ -1,20 +1,33 @@
 { lib
+, astroid
+, beautifulsoup4
+, buildPythonPackage
 , fetchFromGitHub
-, python3
+, jproperties
+, luhn
+, lxml
+, pytest-mock
+, pytestCheckHook
+, python-Levenshtein
+, pythonOlder
+, pyyaml
 }:
 
-python3.pkgs.buildPythonApplication rec {
+buildPythonPackage rec {
   pname = "whispers";
   version = "1.5.3";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "Skyscanner";
     repo = pname;
     rev = version;
-    sha256 = "sha256-jruUGyoZCyMu015QKtlvfx5WRMfxo/eYUue9wUIWb6o=";
+    hash = "sha256-jruUGyoZCyMu015QKtlvfx5WRMfxo/eYUue9wUIWb6o=";
   };
 
-  propagatedBuildInputs = with python3.pkgs; [
+  propagatedBuildInputs = [
     astroid
     beautifulsoup4
     jproperties
@@ -24,7 +37,7 @@ python3.pkgs.buildPythonApplication rec {
     pyyaml
   ];
 
-  checkInputs = with python3.pkgs; [
+  checkInputs = [
     pytest-mock
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/widgetsnbextension/default.nix b/pkgs/development/python-modules/widgetsnbextension/default.nix
index 5b4f535563c..563e792850d 100644
--- a/pkgs/development/python-modules/widgetsnbextension/default.nix
+++ b/pkgs/development/python-modules/widgetsnbextension/default.nix
@@ -8,13 +8,20 @@
 buildPythonPackage rec {
   pname = "widgetsnbextension";
   version = "3.6.0";
+  format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-6Ep6n8ubrz1XEG4YSnOJqPjrk1v3QaXrnWCqGMwCmoA=";
+    hash = "sha256-6Ep6n8ubrz1XEG4YSnOJqPjrk1v3QaXrnWCqGMwCmoA=";
   };
 
-  propagatedBuildInputs = [ notebook ];
+  # setup.py claims to require notebook, but the source doesn't have any imports
+  # in it.
+  postPatch = ''
+    substituteInPlace setup.py --replace "'notebook>=4.4.1'," ""
+  '';
+
+  propagatedBuildInputs = [ ];
 
   # No tests in archive
   doCheck = false;
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index 1245603c53a..52899ac238e 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -32,13 +32,13 @@ with py.pkgs;
 
 buildPythonApplication rec {
   pname = "checkov";
-  version = "2.0.1110";
+  version = "2.0.1118";
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = pname;
     rev = version;
-    hash = "sha256-HtXJGi20SbbOofL8TAZDZ9L3aFVx33Xz+QS/f7NxYFI=";
+    hash = "sha256-8zhCyIHI3Pl5fTqQGSe8l6+7DZQsI6YgyTSCs1BNe94=";
   };
 
   nativeBuildInputs = with py.pkgs; [
diff --git a/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix b/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
index 1fbb4244250..946d660610e 100644
--- a/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
@@ -1,7 +1,7 @@
 { lib, buildGoModule, fetchFromGitLab, fetchurl }:
 
 let
-  version = "14.10.0";
+  version = "14.10.1";
 in
 buildGoModule rec {
   inherit version;
@@ -20,7 +20,7 @@ buildGoModule rec {
     owner = "gitlab-org";
     repo = "gitlab-runner";
     rev = "v${version}";
-    sha256 = "033b68hwqk5hn2by4hk1z7v6p08d505grl9hrx72p4wpyk18c80l";
+    sha256 = "1ph8byrh8kbg6s3gm5fakqk0ss6995pidgm664z3rwibr0h6m7sm";
   };
 
   patches = [
@@ -55,6 +55,6 @@ buildGoModule rec {
     license = licenses.mit;
     homepage = "https://about.gitlab.com/gitlab-ci/";
     platforms = platforms.unix ++ platforms.darwin;
-    maintainers = with maintainers; [ bachp zimbatm globin ];
+    maintainers = with maintainers; [ bachp zimbatm globin yayayayaka ];
   };
 }
diff --git a/pkgs/development/tools/goconvey/default.nix b/pkgs/development/tools/goconvey/default.nix
index fb6ce653cc4..802be18e566 100644
--- a/pkgs/development/tools/goconvey/default.nix
+++ b/pkgs/development/tools/goconvey/default.nix
@@ -1,25 +1,28 @@
-{ lib, buildGoPackage, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "goconvey";
-  version = "1.6.3";
+  version = "1.7.2";
 
-  goPackagePath = "github.com/smartystreets/goconvey";
   excludedPackages = "web/server/watch/integration_testing";
 
-  goDeps = ./deps.nix;
-
   src = fetchFromGitHub {
     owner = "smartystreets";
     repo = "goconvey";
-    rev = version;
-    sha256 = "1ph18rkl3ns3fgin5i4j54w5a69grrmf3apcsmnpdn1wlrbs3dxh";
+    rev = "v${version}";
+    sha256 = "sha256-YT9M9VaLIGUo6pdkaLWLtomcjrDqdnOqwl+C9UwDmT8=";
   };
 
+  vendorSha256 = "sha256-sHyK/4YdNCLCDjxjMKygWAVRnHZ1peYjYRYyEcqoe+E=";
+
+  ldflags = [ "-s" "-w" ];
+
+  checkFlags = [ "-short" ];
+
   meta = {
     description = "Go testing in the browser. Integrates with `go test`. Write behavioral tests in Go";
     homepage = "https://github.com/smartystreets/goconvey";
-    maintainers = with lib.maintainers; [ vdemeester ];
     license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ vdemeester ];
   };
 }
diff --git a/pkgs/development/tools/goconvey/deps.nix b/pkgs/development/tools/goconvey/deps.nix
deleted file mode 100644
index d329359da70..00000000000
--- a/pkgs/development/tools/goconvey/deps.nix
+++ /dev/null
@@ -1,20 +0,0 @@
-[
-  {
-    goPackagePath = "github.com/jtolds/gls";
-    fetch = {
-      type = "git";
-      url = "https://github.com/jtolds/gls";
-      rev = "77f18212c9c7edc9bd6a33d383a7b545ce62f064";
-      sha256 = "1vm37pvn0k4r6d3m620swwgama63laz8hhj3pyisdhxwam4m2g1h";
-    };
-  }
-  {
-    goPackagePath = "github.com/smartystreets/assertions";
-    fetch = {
-      type = "git";
-      url = "https://github.com/smartystreets/assertions";
-      rev = "0b37b35ec7434b77e77a4bb29b79677cced992ea";
-      sha256 = "1j0adgbykl55rf2945g0n5bmqdsnjcqlx5dcmpfh4chki43hiwg9";
-    };
-  }
-]
diff --git a/pkgs/development/tools/misc/saleae-logic-2/default.nix b/pkgs/development/tools/misc/saleae-logic-2/default.nix
index c3349661c55..7478c27ce9f 100644
--- a/pkgs/development/tools/misc/saleae-logic-2/default.nix
+++ b/pkgs/development/tools/misc/saleae-logic-2/default.nix
@@ -1,10 +1,10 @@
 { lib, fetchurl, makeDesktopItem, appimageTools, gtk3 }:
 let
   name = "saleae-logic-2";
-  version = "2.3.51";
+  version = "2.3.52";
   src = fetchurl {
     url = "https://downloads.saleae.com/logic2/Logic-${version}-master.AppImage";
-    sha256 = "sha256-Z5GPA1cJbQJOjntWXe1uF26e7nJ99+ANoCP57Y/OO5A=";
+    sha256 = "sha256-Z1xDVb1qFPtTi40dZ1CBw6ZqtQbYjuUjeUinBV+wdw8=";
   };
   desktopItem = makeDesktopItem {
     inherit name;
diff --git a/pkgs/development/tools/ocaml/js_of_ocaml/compiler.nix b/pkgs/development/tools/ocaml/js_of_ocaml/compiler.nix
index 82d84c819dd..7805ca26403 100644
--- a/pkgs/development/tools/ocaml/js_of_ocaml/compiler.nix
+++ b/pkgs/development/tools/ocaml/js_of_ocaml/compiler.nix
@@ -5,12 +5,12 @@
 
 buildDunePackage rec {
   pname = "js_of_ocaml-compiler";
-  version = "3.11.0";
+  version = "4.0.0";
   useDune2 = true;
 
   src = fetchurl {
     url = "https://github.com/ocsigen/js_of_ocaml/releases/download/${version}/js_of_ocaml-${version}.tbz";
-    sha256 = "sha256:0flws9mw0yjfw4d8d3y3k408mivy2xgky70xk1br3iqs4zksz38m";
+    sha256 = "sha256:0pj9jjrmi0xxrzmygv4b5whsibw1jxy3wgibmws85x5jwlczh0nz";
   };
 
   nativeBuildInputs = [ menhir ];
diff --git a/pkgs/development/tools/ocaml/js_of_ocaml/ocamlbuild.nix b/pkgs/development/tools/ocaml/js_of_ocaml/ocamlbuild.nix
index c67d05c1503..fa9ff95b0fd 100644
--- a/pkgs/development/tools/ocaml/js_of_ocaml/ocamlbuild.nix
+++ b/pkgs/development/tools/ocaml/js_of_ocaml/ocamlbuild.nix
@@ -1,13 +1,26 @@
-{ buildDunePackage, js_of_ocaml-compiler
+{ lib, buildDunePackage, fetchFromGitHub
 , ocamlbuild
 }:
 
-buildDunePackage {
+buildDunePackage rec {
   pname = "js_of_ocaml-ocamlbuild";
-
-  inherit (js_of_ocaml-compiler) version src meta useDune2;
+  version = "4.0.0";
 
   minimalOCamlVersion = "4.02";
 
+  src = fetchFromGitHub {
+    owner = "ocsigen";
+    repo = pname;
+    rev = "852302c8f35b946e2ec275c529a79e46d8749be6";
+    sha256 = "sha256:03ayvakvbh4wi4dwcgd7r9y8ka8cv3d59hb81yk2dxyd94bln145";
+  };
+
   propagatedBuildInputs = [ ocamlbuild ];
+
+  meta = {
+    description = "An ocamlbuild plugin to compile to JavaScript";
+    license = lib.licenses.lgpl2Only;
+    maintainers = [ lib.maintainers.vbgl ];
+    inherit (src.meta) homepage;
+  };
 }
diff --git a/pkgs/development/tools/perseus-cli/default.nix b/pkgs/development/tools/perseus-cli/default.nix
index 9ec8aa21e2d..4b39fccdd36 100644
--- a/pkgs/development/tools/perseus-cli/default.nix
+++ b/pkgs/development/tools/perseus-cli/default.nix
@@ -1,17 +1,25 @@
-{ lib, rustPlatform, fetchCrate, makeWrapper, wasm-pack }:
+{ lib
+, stdenv
+, rustPlatform
+, fetchCrate
+, makeWrapper
+, wasm-pack
+, CoreServices
+}:
 
 rustPlatform.buildRustPackage rec {
   pname = "perseus-cli";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-YyQQjuxNUxuo2PFluGyT/CpG22tgjRCfmFKA5MFRgHo=";
+    sha256 = "sha256-IYjLx9/4oWSXa4jhOtGw1GOHmrR7LQ6bWyN5zbOuEFs=";
   };
 
-  cargoSha256 = "sha256-SKxPsltXFH+ENexn/KDD43hGLSTgvtU9hv9Vdi2oeFA=";
+  cargoSha256 = "sha256-i7MPmO9MoANZLzmR5gsD+v0gyDtFbzhsmE9xOsb88L0=";
 
   nativeBuildInputs = [ makeWrapper ];
+  buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];
 
   postInstall = ''
     wrapProgram $out/bin/perseus \
diff --git a/pkgs/os-specific/linux/pax-utils/default.nix b/pkgs/os-specific/linux/pax-utils/default.nix
index b22af8d7083..7172aca65f6 100644
--- a/pkgs/os-specific/linux/pax-utils/default.nix
+++ b/pkgs/os-specific/linux/pax-utils/default.nix
@@ -1,12 +1,12 @@
-{ stdenv, lib, fetchurl, bash }:
+{ stdenv, lib, fetchurl, bash, gitUpdater }:
 
 stdenv.mkDerivation rec {
   pname = "pax-utils";
-  version = "1.3.3";
+  version = "1.3.4";
 
   src = fetchurl {
     url = "mirror://gentoo/distfiles/${pname}-${version}.tar.xz";
-    sha256 = "sha256-7sp/vZi8Zr6tSncADCAl2fF+qCAbhCRYgkBs4AubaxQ=";
+    sha256 = "sha256-i67S+cWujgzaG5x1mQhkEBr8ZPrQpGFuEPP/jviRBAs=";
   };
 
   strictDeps = true;
@@ -15,6 +15,12 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "PREFIX=$(out)" ];
 
+  passthru.updateScript = gitUpdater {
+    inherit pname version;
+    url = "https://anongit.gentoo.org/git/proj/pax-utils.git";
+    rev-prefix = "v";
+  };
+
   meta = with lib; {
     description = "ELF utils that can check files for security relevant properties";
     longDescription = ''
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 1a7cd964ef5..0515f9a5198 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -311,7 +311,8 @@
     "browser" = ps: with ps; [
     ];
     "brunt" = ps: with ps; [
-    ]; # missing inputs: brunt
+      brunt
+    ];
     "bsblan" = ps: with ps; [
       bsblan
     ];
@@ -3218,6 +3219,7 @@
     "braviatv"
     "broadlink"
     "brother"
+    "brunt"
     "bsblan"
     "buienradar"
     "button"
diff --git a/pkgs/servers/pleroma/default.nix b/pkgs/servers/pleroma/default.nix
index dd4025a76c0..99dd29db147 100644
--- a/pkgs/servers/pleroma/default.nix
+++ b/pkgs/servers/pleroma/default.nix
@@ -1,51 +1,22 @@
 { lib, beamPackages
 , fetchFromGitHub, fetchFromGitLab
-, file, cmake, bash
+, file, cmake
 , nixosTests, writeText
-, cookieFile ? null
 , ...
 }:
 
 beamPackages.mixRelease rec {
   pname = "pleroma";
-  version = "2.4.2";
+  version = "2.4.3";
 
   src = fetchFromGitLab {
     domain = "git.pleroma.social";
     owner = "pleroma";
     repo = "pleroma";
     rev = "v${version}";
-    sha256 = "sha256-RcqqNNNCR4cxETUCyjChkpq+cQ1QzNOHHzdqBLtOc6g=";
+    sha256 = "sha256-x8j/2Eot/EEHsedgZntB5MPxlYMNDlFyZtmiMdhcS7U=";
   };
 
-  preFixup = if (cookieFile != null) then ''
-    # There's no way to use a subprocess to cat the content of the
-    # file cookie using wrapProgram: it gets escaped (by design) with
-    # a pair of backticks :(
-    # We have to come up with our own custom wrapper to do this.
-    function wrapWithCookie () {
-        local hidden
-        hidden="$(dirname "$1")/.$(basename "$1")"-wrapped
-        while [ -e "$hidden" ]; do
-            hidden="''${hidden}_"
-        done
-        mv "$1" "''${hidden}"
-
-        cat > "$1" << EOF
-    #!${bash}/bin/bash
-    export RELEASE_COOKIE="\$(cat "${cookieFile}")"
-    exec -a "\$0" "''${hidden}" "\$@"
-    EOF
-        chmod +x "$1"
-    }
-
-    for f in "$out"/bin/*; do
-        if [[ -x "$f" ]]; then
-            wrapWithCookie "$f"
-        fi
-    done
-  '' else "";
-
   mixNixDeps = import ./mix.nix {
     inherit beamPackages lib;
     overrides = (final: prev: {
diff --git a/pkgs/servers/pleroma/mix.nix b/pkgs/servers/pleroma/mix.nix
index 31ab20c2940..9c512889531 100644
--- a/pkgs/servers/pleroma/mix.nix
+++ b/pkgs/servers/pleroma/mix.nix
@@ -1375,12 +1375,12 @@ let
 
     sweet_xml = buildMix rec {
       name = "sweet_xml";
-      version = "0.6.6";
+      version = "0.7.2";
 
       src = fetchHex {
         pkg = "${name}";
         version = "${version}";
-        sha256 = "0wrm3wx1c4wg8xj8lx1pg9xdpxhsbbry71l3kwgsizwjz1cc87if";
+        sha256 = "sha256-aJTmihIPRUU02ZBF6jMl93QOpxJgvDFfguKXMdVwpug=";
       };
 
       beamDeps = [];
diff --git a/pkgs/test/nixos-functions/default.nix b/pkgs/test/nixos-functions/default.nix
index f2914455246..5e9857134de 100644
--- a/pkgs/test/nixos-functions/default.nix
+++ b/pkgs/test/nixos-functions/default.nix
@@ -24,6 +24,7 @@ in lib.optionalAttrs stdenv.hostPlatform.isLinux (
       system.nixos = dummyVersioning;
       boot.loader.grub.enable = false;
       fileSystems."/".device = "/dev/null";
+      system.stateVersion = lib.trivial.release;
     }).toplevel;
 
     nixosTest-test = pkgs.nixosTest ({ lib, pkgs, figlet, ... }: {
@@ -31,6 +32,7 @@ in lib.optionalAttrs stdenv.hostPlatform.isLinux (
       nodes.machine = { pkgs, ... }: {
         system.nixos = dummyVersioning;
         environment.systemPackages = [ pkgs.hello figlet ];
+        system.stateVersion = lib.trivial.release;
       };
       testScript = ''
         machine.succeed("hello | figlet >/dev/console")
diff --git a/pkgs/tools/misc/pre-commit/default.nix b/pkgs/tools/misc/pre-commit/default.nix
index df211378f4b..f85490736d9 100644
--- a/pkgs/tools/misc/pre-commit/default.nix
+++ b/pkgs/tools/misc/pre-commit/default.nix
@@ -13,7 +13,7 @@
 with python3Packages;
 buildPythonPackage rec {
   pname = "pre-commit";
-  version = "2.18.1";
+  version = "2.19.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "pre-commit";
     repo = "pre-commit";
     rev = "v${version}";
-    sha256 = "sha256-d/ukUTjNgpqr6IeDJHDaOXQm0EdsX+vq0sVX7HG3gSE=";
+    sha256 = "sha256-5YV0FJhHiq/NJFKYvwddIWUQVxKJpnIJLLNmyY0NX4A=";
   };
 
   patches = [
diff --git a/pkgs/tools/networking/aardvark-dns/default.nix b/pkgs/tools/networking/aardvark-dns/default.nix
index 412b3e0349c..ec0ca525354 100644
--- a/pkgs/tools/networking/aardvark-dns/default.nix
+++ b/pkgs/tools/networking/aardvark-dns/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "aardvark-dns";
-  version = "1.0.2";
+  version = "1.0.3";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-d4YSCVZkNung4frgAeP46E9Ptpnu9y0HwmPRADo4t0U=";
+    sha256 = "sha256-m2uKTVRonnun+/V69RcPWkkRtDcoaiulMCQz0/CAdCw=";
   };
 
-  cargoHash = "sha256-fu7ZopS55IzzeO7uzLx1wVHQ8A1Ff+9f7FagoZPerxk=";
+  cargoHash = "sha256-Z/OZgWlpwcdqns26ojTLPQBVNrwU/i86tZVx19sRUTw=";
 
   meta = with lib; {
     description = "Authoritative dns server for A/AAAA container records";
diff --git a/pkgs/tools/networking/netavark/default.nix b/pkgs/tools/networking/netavark/default.nix
index 3116644eb68..fba769d2a55 100644
--- a/pkgs/tools/networking/netavark/default.nix
+++ b/pkgs/tools/networking/netavark/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "netavark";
-  version = "1.0.2";
+  version = "1.0.3";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-2ElEhKit/XysRsUw+dg7SnhDl+Zf+FJb5pIYpq1ALNs=";
+    sha256 = "sha256-M0jsCwle57YM0RO1hGMju5+8XvHPWc8tJqKWJL/sFsg=";
   };
 
-  cargoHash = "sha256-w3qz4ygjIvn+Rxd1JEVO6Ax08leuuJvC4Bk7VygbBh4=";
+  cargoHash = "sha256-zTgHjDZdsseUpB5Xqn9yE5T6Tgqx22pQKQLlUtZq+lc=";
 
   nativeBuildInputs = [ installShellFiles mandown ];
 
diff --git a/pkgs/tools/networking/networkmanager/sstp/default.nix b/pkgs/tools/networking/networkmanager/sstp/default.nix
index 8b75db6495f..93fd87b005b 100644
--- a/pkgs/tools/networking/networkmanager/sstp/default.nix
+++ b/pkgs/tools/networking/networkmanager/sstp/default.nix
@@ -1,51 +1,59 @@
-{ lib, stdenv
-, autoreconfHook
-, fetchFromGitHub
-, fetchpatch
+{ stdenv
+, lib
+, fetchurl
 , file
 , glib
 , gnome
 , gtk3
+, gtk4
 , intltool
 , libnma
+, libnma-gtk4
 , libsecret
 , networkmanager
 , pkg-config
 , ppp
 , sstp
-, substituteAll
-, withGnome ? true }:
+, withGnome ? true
+}:
 
-let
+stdenv.mkDerivation rec {
   pname = "NetworkManager-sstp";
-  version = "unstable-2020-04-20";
-in stdenv.mkDerivation {
+  version = "1.3.0";
   name = "${pname}${if withGnome then "-gnome" else ""}-${version}";
 
-  src = fetchFromGitHub {
-    owner = "enaess";
-    repo = "network-manager-sstp";
-    rev = "735d8ca078f933e085029f60a737e3cf1d8c29a8";
-    sha256 = "0aahfhy2ch951kzj6gnd8p8hv2s5yd5y10wrmj68djhnx2ml8cd3";
+  src = fetchurl {
+    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    sha256 = "+IJw3jvOYs/+NDS9HvCrSQ6wxh1x1yqwiFij7UZb+rU=";
   };
 
-  buildInputs = [ sstp networkmanager glib ppp ]
-    ++ lib.optionals withGnome [ gtk3 libsecret libnma ];
+  nativeBuildInputs = [
+    file
+    intltool
+    pkg-config
+  ];
 
-  nativeBuildInputs = [ file intltool autoreconfHook pkg-config ];
+  buildInputs = [
+    sstp
+    networkmanager
+    glib
+    ppp
+  ] ++ lib.optionals withGnome [
+    gtk3
+    gtk4
+    libsecret
+    libnma
+    libnma-gtk4
+  ];
 
   postPatch = ''
     sed -i 's#/sbin/pppd#${ppp}/bin/pppd#' src/nm-sstp-service.c
     sed -i 's#/sbin/sstpc#${sstp}/bin/sstpc#' src/nm-sstp-service.c
   '';
 
-  # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
-
-  preConfigure = "intltoolize";
   configureFlags = [
-    "--without-libnm-glib"
     "--with-gnome=${if withGnome then "yes" else "no"}"
+    "--with-gtk4=${if withGnome then "yes" else "no"}"
     "--enable-absolute-paths"
   ];
 
diff --git a/pkgs/tools/security/erosmb/default.nix b/pkgs/tools/security/erosmb/default.nix
new file mode 100644
index 00000000000..c0b4586c352
--- /dev/null
+++ b/pkgs/tools/security/erosmb/default.nix
@@ -0,0 +1,47 @@
+{ lib
+, fetchFromGitHub
+, python3
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "erosmb";
+  version = "0.1.1";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "viktor02";
+    repo = "EroSmb";
+    rev = "v${version}";
+    hash = "sha256-d7iSl7weIHWXDnMYQKxafVd5JrZ0fnuWRDpEirBVdcg=";
+  };
+
+  propagatedBuildInputs = with python3.pkgs; [
+    chardet
+    colorama
+    cryptography
+    impacket
+    ldap3
+    ldapdomaindump
+    pyasn1
+    setuptools
+    six
+  ];
+
+  # Project has no tests
+  doCheck = false;
+
+  doInstallCheck = true;
+
+  installCheckPhase = ''
+    runHook preInstallCheck
+    $out/bin/erosmb --help
+    runHook postInstallCheck
+  '';
+
+  meta = with lib; {
+    description = "SMB network scanner";
+    homepage = "https://github.com/viktor02/EroSmb";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/tools/security/swaggerhole/default.nix b/pkgs/tools/security/swaggerhole/default.nix
new file mode 100644
index 00000000000..8455867b4be
--- /dev/null
+++ b/pkgs/tools/security/swaggerhole/default.nix
@@ -0,0 +1,37 @@
+{ lib
+, fetchFromGitHub
+, python3
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "swaggerhole";
+  version = "1.1";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "Liodeus";
+    repo = pname;
+    # Source is not tagged at the moment, https://github.com/Liodeus/swaggerHole/issues/2
+    rev = "14846406fbd0f145d71ad51c3b87f383e4afbc3b";
+    hash = "sha256-3HmIpn1A86PXZRL+SqMdr84O16hW1mCUWHKnOVolmx8=";
+  };
+
+  propagatedBuildInputs = with python3.pkgs; [
+    requests
+    whispers
+  ];
+
+  # Project has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "swaggerhole"
+  ];
+
+  meta = with lib; {
+    description = "Tool to searching for secret on swaggerhub";
+    homepage = "https://github.com/Liodeus/swaggerHole";
+    license = with licenses; [ gpl3Plus ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/tools/security/trueseeing/default.nix b/pkgs/tools/security/trueseeing/default.nix
new file mode 100644
index 00000000000..4aa9e1852ae
--- /dev/null
+++ b/pkgs/tools/security/trueseeing/default.nix
@@ -0,0 +1,44 @@
+{ lib
+, fetchFromGitHub
+, python3
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "trueseeing";
+  version = "2.1.4";
+  format = "flit";
+
+  src = fetchFromGitHub {
+    owner = "alterakey";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-zc0AOv7OFmEPLl//eykbh538rM2j4kXBLHt5bgK1IRY=";
+  };
+
+  nativeBuildInputs = with python3.pkgs; [
+    flit-core
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    attrs
+    ipython
+    jinja2
+    lxml
+    pypubsub
+    pyyaml
+  ];
+
+  # Project has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "trueseeing"
+  ];
+
+  meta = with lib; {
+    description = "Non-decompiling Android vulnerability scanner";
+    homepage = "https://github.com/alterakey/trueseeing";
+    license = with licenses; [ gpl3Plus ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/tools/system/collectd/default.nix b/pkgs/tools/system/collectd/default.nix
index 8d272b15acf..e957c10a85c 100644
--- a/pkgs/tools/system/collectd/default.nix
+++ b/pkgs/tools/system/collectd/default.nix
@@ -36,7 +36,8 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--localstatedir=/var"
     "--disable-werror"
-  ] ++ plugins.configureFlags;
+  ] ++ plugins.configureFlags
+  ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [ "--with-fp-layout=nothing" ];
 
   # do not create directories in /var during installPhase
   postConfigure = ''
diff --git a/pkgs/tools/text/gtranslator/default.nix b/pkgs/tools/text/gtranslator/default.nix
index d5e7922831e..e15941b5fc8 100644
--- a/pkgs/tools/text/gtranslator/default.nix
+++ b/pkgs/tools/text/gtranslator/default.nix
@@ -1,7 +1,6 @@
 { stdenv
 , lib
 , fetchurl
-, fetchpatch
 , meson
 , ninja
 , pkg-config
@@ -12,11 +11,10 @@
 , libxml2
 , libgda6
 , libhandy
-, libsoup
+, libsoup_3
 , json-glib
 , gspell
 , glib
-, libdazzle
 , gtk3
 , gtksourceview4
 , gnome
@@ -25,22 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gtranslator";
-  version = "41.0";
+  version = "42.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "E28R/gOhlJkMQ6/jOL0eoK0U5+H26Gjlv3xbUsTF5eE=";
+    sha256 = "Kme8v+ZDBhsGltiaEIR9UL81kF/zNhuYcTV9PjQi8Ts=";
   };
 
-  patches = [
-    # Fix build with meson 0.61
-    # data/meson.build:15:5: ERROR: Function does not take positional arguments.
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/gtranslator/-/commit/7ac572cc8c8c37ca3826ecf0d395edd3c38e8e22.patch";
-      sha256 = "aRg6dYweftV8F7FXykO7m0G+p4SLTFnhTcZx72UCMDE=";
-    })
-  ];
-
   nativeBuildInputs = [
     meson
     ninja
@@ -55,11 +44,10 @@ stdenv.mkDerivation rec {
     libxml2
     glib
     gtk3
-    libdazzle
     gtksourceview4
     libgda6
     libhandy
-    libsoup
+    libsoup_3
     json-glib
     gettext
     gspell
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2af2f8d6c8e..2febdae0b36 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -440,6 +440,8 @@ with pkgs;
 
   enum4linux-ng = python3Packages.callPackage ../tools/security/enum4linux-ng { };
 
+  erosmb = callPackage ../tools/security/erosmb { };
+
   onesixtyone = callPackage ../tools/security/onesixtyone {};
 
   oletools = with python3.pkgs; toPythonApplication oletools;
@@ -602,7 +604,9 @@ with pkgs;
 
   packr = callPackage ../development/libraries/packr { };
 
-  perseus-cli = callPackage ../development/tools/perseus-cli { };
+  perseus-cli = callPackage ../development/tools/perseus-cli {
+    inherit (darwin.apple_sdk.frameworks) CoreServices;
+  };
 
   pet = callPackage ../development/tools/pet { };
 
@@ -10613,6 +10617,8 @@ with pkgs;
 
   swagger-codegen3 = callPackage ../tools/networking/swagger-codegen3 { };
 
+  swaggerhole = callPackage ../tools/security/swaggerhole { };
+
   swapview = callPackage ../os-specific/linux/swapview { };
 
   swtpm = callPackage ../tools/security/swtpm { };
@@ -11016,6 +11022,8 @@ with pkgs;
 
   trousers = callPackage ../tools/security/trousers { };
 
+  trueseeing = callPackage ../tools/security/trueseeing { };
+
   trx = callPackage ../tools/audio/trx { };
 
   tryton = callPackage ../applications/office/tryton { };
@@ -30399,7 +30407,7 @@ with pkgs;
 
   wafw00f = callPackage ../tools/security/wafw00f { };
 
-  whispers = callPackage ../tools/security/whispers { };
+  whispers = with python3Packages; toPythonApplication whispers;
 
   waon = callPackage ../applications/audio/waon { };
 
@@ -35057,7 +35065,7 @@ with pkgs;
 
   simplenote = callPackage ../applications/misc/simplenote { };
 
-  hy = callPackage ../development/interpreters/hy {};
+  hy = python3Packages.hy.withPackages (python-packages: [ ]);
 
   wmic-bin = callPackage ../servers/monitoring/plugins/wmic-bin.nix { };
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index c5e45f2478d..dee60882cdc 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1389,6 +1389,8 @@ in {
 
   browser-cookie3 = callPackage ../development/python-modules/browser-cookie3 { };
 
+  brunt = callPackage ../development/python-modules/brunt { };
+
   bsddb3 = callPackage ../development/python-modules/bsddb3 { };
 
   bsdiff4 = callPackage ../development/python-modules/bsdiff4 { };
@@ -4001,6 +4003,8 @@ in {
 
   hyppo = callPackage ../development/python-modules/hyppo { };
 
+  hyrule = callPackage ../development/python-modules/hyrule { };
+
   i2c-tools = callPackage ../development/python-modules/i2c-tools {
     inherit (pkgs) i2c-tools;
   };
@@ -10936,6 +10940,8 @@ in {
 
   whisper = callPackage ../development/python-modules/whisper { };
 
+  whispers = callPackage ../development/python-modules/whispers { };
+
   whitenoise = callPackage ../development/python-modules/whitenoise { };
 
   whodap = callPackage ../development/python-modules/whodap { };