diff --git a/pkgs/applications/misc/privacyidea/default.nix b/pkgs/applications/misc/privacyidea/default.nix
index 2a3a1a47410..225dfb93637 100644
--- a/pkgs/applications/misc/privacyidea/default.nix
+++ b/pkgs/applications/misc/privacyidea/default.nix
@@ -9,7 +9,7 @@ let
         version = "1.3.24";
         src = oldAttrs.src.override {
           inherit version;
-          sha256 = "ebbb777cbf9312359b897bf81ba00dae0f5cb69fba2a18265dcc18a6f5ef7519";
+          hash = "sha256-67t3fL+TEjWbiXv4G6ANrg9ctp+6KhgmXcwYpvXvdRk=";
         };
       });
       flask_migrate = super.flask_migrate.overridePythonAttrs (oldAttrs: rec {
diff --git a/pkgs/applications/networking/syncplay/default.nix b/pkgs/applications/networking/syncplay/default.nix
index 4927bc51b23..96420ff04de 100644
--- a/pkgs/applications/networking/syncplay/default.nix
+++ b/pkgs/applications/networking/syncplay/default.nix
@@ -14,7 +14,7 @@ buildPythonApplication rec {
   };
 
   propagatedBuildInputs = [ twisted certifi ]
-    ++ twisted.extras.tls
+    ++ twisted.extras-require.tls
     ++ lib.optional enableGUI pyside2;
   nativeBuildInputs = lib.optionals enableGUI [ qt5.wrapQtAppsHook ];
 
diff --git a/pkgs/applications/office/paperless-ngx/default.nix b/pkgs/applications/office/paperless-ngx/default.nix
index dce6869f36e..17a1a56b769 100644
--- a/pkgs/applications/office/paperless-ngx/default.nix
+++ b/pkgs/applications/office/paperless-ngx/default.nix
@@ -122,7 +122,7 @@ py.pkgs.pythonPackages.buildPythonApplication rec {
     threadpoolctl
     tika
     tqdm
-    twisted.extras.tls
+    twisted.extras-require.tls
     txaio
     tzlocal
     urllib3
diff --git a/pkgs/development/python-modules/buildbot/default.nix b/pkgs/development/python-modules/buildbot/default.nix
index 743c9f2c4b1..2eff37314e8 100644
--- a/pkgs/development/python-modules/buildbot/default.nix
+++ b/pkgs/development/python-modules/buildbot/default.nix
@@ -53,7 +53,7 @@ let
       unidiff
     ]
       # tls
-      ++ twisted.extras.tls;
+      ++ twisted.extras-require.tls;
 
     checkInputs = [
       treq
diff --git a/pkgs/development/python-modules/fastapi/default.nix b/pkgs/development/python-modules/fastapi/default.nix
index c3abc2163be..63071fd9e44 100644
--- a/pkgs/development/python-modules/fastapi/default.nix
+++ b/pkgs/development/python-modules/fastapi/default.nix
@@ -49,7 +49,7 @@ buildPythonPackage rec {
     pytest-asyncio
     sqlalchemy
     trio
-  ];
+  ] ++ passlib.extras-require.bcrypt;
 
   patches = [
     # Bump starlette, https://github.com/tiangolo/fastapi/pull/4483
diff --git a/pkgs/development/python-modules/flask-security-too/default.nix b/pkgs/development/python-modules/flask-security-too/default.nix
index 8379ec7bcfe..c3d98e405f3 100644
--- a/pkgs/development/python-modules/flask-security-too/default.nix
+++ b/pkgs/development/python-modules/flask-security-too/default.nix
@@ -32,6 +32,7 @@
 , passlib
 
 # tests
+, argon2_cffi
 , flask-mongoengine
 , mongoengine
 , mongomock
@@ -85,6 +86,7 @@ buildPythonPackage rec {
   };
 
   checkInputs = [
+    argon2_cffi
     flask-mongoengine
     mongoengine
     mongomock
diff --git a/pkgs/development/python-modules/passlib/default.nix b/pkgs/development/python-modules/passlib/default.nix
index ab29ab74d68..9e35fb8f76a 100644
--- a/pkgs/development/python-modules/passlib/default.nix
+++ b/pkgs/development/python-modules/passlib/default.nix
@@ -1,9 +1,10 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, nose
-, bcrypt
 , argon2_cffi
+, bcrypt
+, cryptography
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -15,9 +16,17 @@ buildPythonPackage rec {
     sha256 = "defd50f72b65c5402ab2c573830a6978e5f202ad0d984793c8dde2c4152ebe04";
   };
 
-  checkInputs = [ nose ];
-  propagatedBuildInputs = [ bcrypt argon2_cffi ];
-  propagatedNativeBuildInputs = [ argon2_cffi ];
+  passthru.extras-require = {
+    argon2 = [ argon2_cffi ];
+    bcrypt = [ bcrypt ];
+    totp = [ cryptography ];
+  };
+
+  checkInputs = [
+    pytestCheckHook
+  ] ++ passthru.extras-require.argon2
+    ++ passthru.extras-require.bcrypt
+    ++ passthru.extras-require.totp;
 
   meta = with lib; {
     description = "A password hashing library for Python";
diff --git a/pkgs/development/python-modules/relatorio/default.nix b/pkgs/development/python-modules/relatorio/default.nix
index 3185213123c..86e53cde95d 100644
--- a/pkgs/development/python-modules/relatorio/default.nix
+++ b/pkgs/development/python-modules/relatorio/default.nix
@@ -1,24 +1,48 @@
-{ lib, fetchPypi, buildPythonPackage, genshi, lxml, python-magic }:
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchPypi
+, genshi
+, lxml
+, pyyaml
+, python-magic
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "relatorio";
-  version = "0.10.0";
+  version = "0.10.1";
+
+  disabled = pythonOlder "3.5";
+
+  format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "6b9390eab696bdf569639ff58794fb9ef8ff19f94feea5b505a6ba06d0cfd026";
+    sha256 = "a0c72302d50d5dfa433ddab191672eec1dde1c6ed26330a378b720e5a3012e23";
   };
 
   propagatedBuildInputs = [
     genshi
     lxml
-    python-magic
   ];
 
+  passthru.extras-require = {
+    chart = [ /* pycha */ pyyaml ];
+    fodt = [ python-magic ];
+  };
+
+  checkInputs = [
+    pytestCheckHook
+  ] ++ passthru.extras-require.fodt;
+
+  pythonImportsCheck = [ "relatorio" ];
+
   meta = {
     homepage = "https://relatorio.tryton.org/";
+    changelog = "https://hg.tryton.org/relatorio/file/${version}/CHANGELOG";
     description = "A templating library able to output odt and pdf files";
     maintainers = with lib.maintainers; [ johbo ];
-    license = lib.licenses.gpl3;
+    license = lib.licenses.gpl2Plus;
   };
 }
diff --git a/pkgs/development/python-modules/treq/default.nix b/pkgs/development/python-modules/treq/default.nix
index c894d3103b9..1902a578ec2 100644
--- a/pkgs/development/python-modules/treq/default.nix
+++ b/pkgs/development/python-modules/treq/default.nix
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     requests
     incremental
     twisted
-  ] ++ twisted.extras.tls;
+  ] ++ twisted.extras-require.tls;
 
   checkInputs = [
     httpbin
diff --git a/pkgs/development/python-modules/trytond/default.nix b/pkgs/development/python-modules/trytond/default.nix
index c2509c662d3..431342cf02d 100644
--- a/pkgs/development/python-modules/trytond/default.nix
+++ b/pkgs/development/python-modules/trytond/default.nix
@@ -1,9 +1,8 @@
 { lib
-, buildPythonApplication
-, fetchpatch
+, buildPythonPackage
 , fetchPypi
 , pythonOlder
-, mock
+, defusedxml
 , lxml
 , relatorio
 , genshi
@@ -13,44 +12,30 @@
 , werkzeug
 , wrapt
 , passlib
-, pillow
-, bcrypt
 , pydot
 , python-Levenshtein
-, simplejson
 , html2text
-, psycopg2
-, withPostgresql ? true
+, weasyprint
+, gevent
+, pillow
+, withPostgresql ? true, psycopg2
+, python
 }:
 
-buildPythonApplication rec {
+buildPythonPackage rec {
   pname = "trytond";
-  version = "6.2.6";
+  version = "6.4.0";
   format = "setuptools";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-Sof6A9lxU70YnCbboJr56CAdTL0cRbaRNxdvG5Tnqnw=";
+    sha256 = "3c04d75c2a779b88b8c7ab6dd252cf4fc51f9546bf42760d10dbd1a17f61b288";
   };
 
-  patches = [
-    (fetchpatch {
-      # werkzeug 2.1 compatibility for the tests
-      url = "https://github.com/tryton/trytond/commit/86a50ca06cf0d79404dbd731141ed29f8e9fcb9d.patch";
-      hash = "sha256-xY5Sdhkd0lEgscV7NHwX2YWxobWqQFElY5BJvDT+we8=";
-    })
-  ];
-
-  # Tells the tests which database to use
-  DB_NAME = ":memory:";
-
-  buildInputs = [
-    mock
-  ];
-
   propagatedBuildInputs = [
+    defusedxml
     lxml
     relatorio
     genshi
@@ -59,20 +44,29 @@ buildPythonApplication rec {
     python-sql
     werkzeug
     wrapt
-    pillow
     passlib
 
     # extra dependencies
-    bcrypt
     pydot
     python-Levenshtein
-    simplejson
     html2text
-  ] ++ lib.optional withPostgresql psycopg2;
+    weasyprint
+    gevent
+    pillow
+  ] ++ relatorio.extras-require.fodt
+    ++ passlib.extras-require.bcrypt
+    ++ passlib.extras-require.argon2
+    ++ lib.optional withPostgresql psycopg2;
+
+  checkPhase = ''
+    runHook preCheck
 
-  # If unset, trytond will try to mkdir /homeless-shelter
-  preCheck = ''
     export HOME=$(mktemp -d)
+    export TRYTOND_DATABASE_URI="sqlite://"
+    export DB_NAME=":memory:";
+    ${python.interpreter} -m unittest discover -s trytond.tests
+
+    runHook postCheck
   '';
 
   meta = with lib; {
@@ -86,6 +80,7 @@ buildPythonApplication rec {
       modularity, scalability and security.
     '';
     homepage = "http://www.tryton.org/";
+    changelog = "https://hg.tryton.org/trytond/file/${version}/CHANGELOG";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ udono johbo ];
   };
diff --git a/pkgs/development/python-modules/twisted/default.nix b/pkgs/development/python-modules/twisted/default.nix
index 02a993fdf13..8bc03b1e5cf 100644
--- a/pkgs/development/python-modules/twisted/default.nix
+++ b/pkgs/development/python-modules/twisted/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv
 , buildPythonPackage
+, pythonOlder
 , fetchPypi
 , python
 , zope_interface
@@ -14,11 +15,24 @@
 , setuptools
 , idna
 , typing-extensions
+, pyasn1
+, cryptography
+, appdirs
+, bcrypt
+, pynacl
+, pyserial
+, h2
+, priority
+, contextvars
 }:
 buildPythonPackage rec {
   pname = "Twisted";
   version = "22.4.0";
 
+  disabled = pythonOlder "3.6";
+
+  format = "setuptools";
+
   src = fetchPypi {
     inherit pname version;
     extension = "tar.gz";
@@ -27,7 +41,14 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ zope_interface incremental automat constantly hyperlink pyhamcrest attrs setuptools typing-extensions ];
 
-  passthru.extras.tls = [ pyopenssl service-identity idna ];
+  passthru.extras-require = rec {
+    tls = [ pyopenssl service-identity idna ];
+    conch = [ pyasn1 cryptography appdirs bcrypt ];
+    conch_nacl = conch ++ [ pynacl ];
+    serial = [ pyserial ];
+    http2 = [ h2 priority ];
+    contextvars = lib.optionals (pythonOlder "3.7") [ contextvars ];
+  };
 
   # Patch t.p._inotify to point to libc. Without this,
   # twisted.python.runtime.platform.supportsINotify() == False
diff --git a/pkgs/development/python-modules/txtorcon/default.nix b/pkgs/development/python-modules/txtorcon/default.nix
index 167e090fca0..7196e88e8dd 100644
--- a/pkgs/development/python-modules/txtorcon/default.nix
+++ b/pkgs/development/python-modules/txtorcon/default.nix
@@ -13,7 +13,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     incremental twisted automat zope_interface
-  ] ++ twisted.extras.tls
+  ] ++ twisted.extras-require.tls
   ++ lib.optionals (!isPy3k) [ ipaddress ];
 
   checkInputs = [ pytestCheckHook mock lsof GeoIP ];
diff --git a/pkgs/development/tools/devpi-server/default.nix b/pkgs/development/tools/devpi-server/default.nix
index 8e78bebebe9..3f89bd4a1c5 100644
--- a/pkgs/development/tools/devpi-server/default.nix
+++ b/pkgs/development/tools/devpi-server/default.nix
@@ -46,7 +46,7 @@ buildPythonApplication rec {
     pyramid
     strictyaml
     waitress
-  ];
+  ] ++ passlib.extras-require.argon2;
 
   checkInputs = [
     beautifulsoup4
diff --git a/pkgs/servers/radicale/3.x.nix b/pkgs/servers/radicale/3.x.nix
index 9867922d852..7171b4550fd 100644
--- a/pkgs/servers/radicale/3.x.nix
+++ b/pkgs/servers/radicale/3.x.nix
@@ -20,7 +20,7 @@ python3.pkgs.buildPythonApplication rec {
     passlib
     vobject
     python-dateutil
-  ];
+  ] ++ passlib.extras-require.bcrypt;
 
   checkInputs = with python3.pkgs; [
     pytestCheckHook
diff --git a/pkgs/tools/networking/p2p/tahoe-lafs/default.nix b/pkgs/tools/networking/p2p/tahoe-lafs/default.nix
index b0f4cd1f788..938bfa1dcd6 100644
--- a/pkgs/tools/networking/p2p/tahoe-lafs/default.nix
+++ b/pkgs/tools/networking/p2p/tahoe-lafs/default.nix
@@ -60,7 +60,8 @@ python3Packages.buildPythonApplication rec {
     html5lib magic-wormhole netifaces pyasn1 pycrypto pyutil pyyaml recommonmark
     service-identity simplejson sphinx_rtd_theme testtools treq twisted zfec
     zope_interface
-  ];
+  ] ++ twisted.extras-require.tls
+    ++ twisted.extras-require.conch;
 
   checkInputs = with python3Packages; [ mock hypothesis twisted ];