diff --git a/pkgs/applications/version-management/git-and-tools/git-machete/default.nix b/pkgs/applications/version-management/git-and-tools/git-machete/default.nix
index 4f774f5b2f4..d5fc50ff3fd 100644
--- a/pkgs/applications/version-management/git-and-tools/git-machete/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-machete/default.nix
@@ -12,13 +12,13 @@
 
 buildPythonApplication rec {
   pname = "git-machete";
-  version = "3.9.0";
+  version = "3.9.1";
 
   src = fetchFromGitHub {
     owner = "virtuslab";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-AuF4KUayMRQ2TsvjzpMHpppM+0e6igs7MrAXzGP9yp0=";
+    sha256 = "sha256-/oX3x5F5/gV8YuRLzAviE7RM+Gen0gIypHs34iUnVOM=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/data/fonts/work-sans/default.nix b/pkgs/data/fonts/work-sans/default.nix
index 16a0e9ac021..49722fc3e01 100644
--- a/pkgs/data/fonts/work-sans/default.nix
+++ b/pkgs/data/fonts/work-sans/default.nix
@@ -1,23 +1,19 @@
-{ lib, fetchFromGitHub }:
+{ lib, fetchzip }:
 
 let
-  version = "1.6";
-in fetchFromGitHub {
+  version = "2.010";
+in
+fetchzip {
   name = "work-sans-${version}";
 
-  owner = "weiweihuanghuang";
-  repo = "Work-Sans";
-  rev = "v${version}";
+  url = "https://github.com/weiweihuanghuang/Work-Sans/archive/refs/tags/v${version}.zip";
 
   postFetch = ''
-    tar xf $downloadedFile --strip=1
-    install -m444 -Dt $out/share/fonts/opentype/ fonts/desktop/*.otf
-    install -m444 -Dt $out/share/fonts/truetype/ fonts/webfonts/ttf/*.ttf
-    install -m444 -Dt $out/share/fonts/woff/     fonts/webfonts/woff/*.woff
-    install -m444 -Dt $out/share/fonts/woff2/    fonts/webfonts/woff2/*.woff2
+    mkdir -p $out/share/fonts
+    unzip -j $downloadedFile "*/fonts/*.ttf" -d $out/share/fonts/opentype
   '';
 
-  sha256 = "01kjidk6zv80rqxapcdwhd9wxzrjfc6lj4gkf6dwa4sskw5x3b8a";
+  sha256 = "sha256-S4O5EoKY4w/p+MHeHRCmPyQRAOUfEwNiETxMgNcsrws=";
 
   meta = with lib; {
     description = "A grotesque sans";
diff --git a/pkgs/development/libraries/libkqueue/default.nix b/pkgs/development/libraries/libkqueue/default.nix
index 39a6efeb6fd..8a4bfdedd1e 100644
--- a/pkgs/development/libraries/libkqueue/default.nix
+++ b/pkgs/development/libraries/libkqueue/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libkqueue";
-  version = "2.6.0";
+  version = "2.6.1";
 
   src = fetchFromGitHub {
     owner = "mheily";
     repo = "libkqueue";
     rev = "v${version}";
-    sha256 = "sha256-qh1r95A/ngg4KWSVYlC8ldv2ClV+rRPNcJDH+aAGxHs=";
+    sha256 = "sha256-YKKBHOxjUS7+/ib4gcR7EYjjVOwhHVksYasLhErdV8s=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/microsoft_gsl/default.nix b/pkgs/development/libraries/microsoft_gsl/default.nix
index 187508a9981..35765ff2d43 100644
--- a/pkgs/development/libraries/microsoft_gsl/default.nix
+++ b/pkgs/development/libraries/microsoft_gsl/default.nix
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , cmake
 , gtest
-, fetchurl
+, fetchpatch
 , pkg-config
 }:
 
@@ -20,9 +20,9 @@ stdenv.mkDerivation rec {
 
   patches = [
     # Search for GoogleTest via pkg-config first, ref: https://github.com/NixOS/nixpkgs/pull/130525
-    (fetchurl {
+    (fetchpatch {
       url = "https://github.com/microsoft/GSL/commit/f5cf01083baf7e8dc8318db3648bc6098dc32d67.patch";
-      sha256 = "sha256-uouv35crtly8kYhKyvMyZkqwTKt1jXC6dZjw4sQ6uv0=";
+      sha256 = "sha256-HJxG87nVFo1CGNivCqt/JhjTj2xLzQe8bF5Km7/KG+Y=";
     })
   ];
 
diff --git a/pkgs/development/python-modules/emcee/default.nix b/pkgs/development/python-modules/emcee/default.nix
index f41bfae5942..c79adccc41f 100644
--- a/pkgs/development/python-modules/emcee/default.nix
+++ b/pkgs/development/python-modules/emcee/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "emcee";
-  version = "3.1.1";
+  version = "3.1.2";
 
   src = fetchFromGitHub {
     owner = "dfm";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "0q9dj7mihjjkcy6famzwhz1xcxxzzvm00n01w4bbm66ax9zvis52";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-MguhnLLo1zeNuMca8vWpxwysh9YJDD+IzvGQDbScK2M=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/itemadapter/default.nix b/pkgs/development/python-modules/itemadapter/default.nix
index b082387e23c..74b8eabd866 100644
--- a/pkgs/development/python-modules/itemadapter/default.nix
+++ b/pkgs/development/python-modules/itemadapter/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "itemadapter";
-  version = "0.5.0";
+  version = "0.6.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-BbanndMaepk9+y6Dhqkcl+O4xs8otyVT6AjmJeC4fCA=";
+    hash = "sha256-Px9g69bJGwAiKCDzi/USaqSaj7bkZ9NR8DZEIflToV0=";
   };
 
   # Infinite recursion with Scrapy
diff --git a/pkgs/development/python-modules/karton-core/default.nix b/pkgs/development/python-modules/karton-core/default.nix
index 562d8880692..b839230b5f2 100644
--- a/pkgs/development/python-modules/karton-core/default.nix
+++ b/pkgs/development/python-modules/karton-core/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "karton-core";
-  version = "4.4.0";
+  version = "4.4.1";
 
   src = fetchFromGitHub {
     owner = "CERT-Polska";
     repo = "karton";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-TwTq44l/Nx+FQ6tFZHat4SPGOmHSwYfg7ShbGnxpkVw=";
+    sha256 = "sha256-smgKrFexuL0bgt/1Ikm1tpSGPJNJm7Ko68iZn3AQw5E=";
   };
 
   propagatedBuildInputs = [ minio redis ];
diff --git a/pkgs/development/python-modules/rethinkdb/default.nix b/pkgs/development/python-modules/rethinkdb/default.nix
index 2c6123df5f2..c9c61e34d8e 100644
--- a/pkgs/development/python-modules/rethinkdb/default.nix
+++ b/pkgs/development/python-modules/rethinkdb/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "rethinkdb";
-  version = "2.4.8";
+  version = "2.4.9";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9f75a72bcd899ab0f6b0677873b89fba99c512bc7895eb5fbc1dc9a228b8aaee";
+    sha256 = "sha256-dV8I9xdTWlXAUSj2vmwoJI+pr/JningWqrh+H59YFcE=";
   };
 
   propagatedBuildInputs = [ six setuptools ];
diff --git a/pkgs/development/tools/misc/libtree/default.nix b/pkgs/development/tools/misc/libtree/default.nix
index 141ccc24c36..219ce239f48 100644
--- a/pkgs/development/tools/misc/libtree/default.nix
+++ b/pkgs/development/tools/misc/libtree/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , binutils
 , chrpath
 , cmake
diff --git a/pkgs/servers/invidious/lsquic.nix b/pkgs/servers/invidious/lsquic.nix
index 292d37ce6cd..9c3bc68615c 100644
--- a/pkgs/servers/invidious/lsquic.nix
+++ b/pkgs/servers/invidious/lsquic.nix
@@ -1,9 +1,11 @@
-{ lib, boringssl, stdenv, fetchgit, fetchFromGitHub, cmake, zlib, perl, libevent }:
+{ lib, boringssl, stdenv, fetchgit, fetchFromGitHub, cmake, zlib, perl, libevent, gcc10Stdenv, buildGoModule }:
 let
   versions = builtins.fromJSON (builtins.readFile ./versions.json);
 
+  buildGoModuleGcc10 = buildGoModule.override { stdenv = gcc10Stdenv; };
+
   # lsquic requires a specific boringssl version (noted in its README)
-  boringssl' = boringssl.overrideAttrs (old: {
+  boringssl' = (boringssl.overrideAttrs (old: {
     version = versions.boringssl.rev;
     src = fetchgit {
       url = "https://boringssl.googlesource.com/boringssl";
@@ -14,7 +16,9 @@ let
       # Use /etc/ssl/certs/ca-certificates.crt instead of /etc/ssl/cert.pem
       ./use-etc-ssl-certs.patch
     ];
-  });
+  })).override {
+    buildGoModule = buildGoModuleGcc10;
+  };
 in
 stdenv.mkDerivation rec {
   pname = "lsquic";
diff --git a/pkgs/tools/admin/certigo/default.nix b/pkgs/tools/admin/certigo/default.nix
index d31cb6a0ef6..541f23058ef 100644
--- a/pkgs/tools/admin/certigo/default.nix
+++ b/pkgs/tools/admin/certigo/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib, stdenv, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
   pname = "certigo";
@@ -13,6 +13,11 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-qS/tIi6umSuQcl43SI4LyL0k5eWfRWs7kVybRPGKcbs=";
 
+  # Go running under Hydra Darwin x86_64 picks CHAPOLY instead of AES-GCM as
+  # the default TLS ciphersuite, and breaks the arguably flakey `TestConnect`
+  # test.
+  doCheck = !(stdenv.isDarwin && stdenv.isx86_64);
+
   meta = with lib; {
     description = "A utility to examine and validate certificates in a variety of formats";
     homepage = "https://github.com/square/certigo";
diff --git a/pkgs/tools/security/yubikey-agent/default.nix b/pkgs/tools/security/yubikey-agent/default.nix
index d2496df94c7..eca528f1c90 100644
--- a/pkgs/tools/security/yubikey-agent/default.nix
+++ b/pkgs/tools/security/yubikey-agent/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, buildGoModule, libnotify, makeWrapper, pcsclite, pkg-config, darwin }:
+{ stdenv, lib, fetchFromGitHub, buildGoModule, libnotify, pcsclite, pkg-config, darwin }:
 
 buildGoModule rec {
   pname = "yubikey-agent";
@@ -15,7 +15,7 @@ buildGoModule rec {
     lib.optional stdenv.isLinux (lib.getDev pcsclite)
     ++ lib.optional stdenv.isDarwin (darwin.apple_sdk.frameworks.PCSC);
 
-  nativeBuildInputs = [ makeWrapper pkg-config ];
+  nativeBuildInputs = lib.optionals stdenv.isLinux [ pkg-config ];
 
   postPatch = lib.optionalString stdenv.isLinux ''
     substituteInPlace main.go --replace 'notify-send' ${libnotify}/bin/notify-send
@@ -27,6 +27,8 @@ buildGoModule rec {
 
   subPackages = [ "." ];
 
+  ldflags = [ "-s" "-w" "-X main.Version=${version}" ];
+
   postInstall = lib.optionalString stdenv.isLinux ''
     mkdir -p $out/lib/systemd/user
     substitute contrib/systemd/user/yubikey-agent.service $out/lib/systemd/user/yubikey-agent.service \