diff --git a/nixos/modules/services/networking/ddclient.nix b/nixos/modules/services/networking/ddclient.nix
index d025c8f8177..faee99b175e 100644
--- a/nixos/modules/services/networking/ddclient.nix
+++ b/nixos/modules/services/networking/ddclient.nix
@@ -181,7 +181,7 @@ with lib;
       };
 
       verbose = mkOption {
-        default = true;
+        default = false;
         type = bool;
         description = ''
           Print verbose information.
diff --git a/nixos/tests/keepassxc.nix b/nixos/tests/keepassxc.nix
index d0f353c71e0..303be133040 100644
--- a/nixos/tests/keepassxc.nix
+++ b/nixos/tests/keepassxc.nix
@@ -62,7 +62,7 @@ import ./make-test-python.nix ({ pkgs, ...} :
         machine.send_key("tab")
         machine.send_chars("/home/alice/foo.keyfile")
         machine.send_key("ret")
-        # Passwords folder is displayed
-        machine.wait_for_text("Passwords")
+        # Database is unlocked (doesn't have "[Locked]" in the title anymore)
+        machine.wait_for_text("foo.kdbx - KeePassXC")
   '';
 })
diff --git a/pkgs/applications/blockchains/clightning/default.nix b/pkgs/applications/blockchains/clightning/default.nix
index 2ac761edd00..2cf31ae3c95 100644
--- a/pkgs/applications/blockchains/clightning/default.nix
+++ b/pkgs/applications/blockchains/clightning/default.nix
@@ -21,11 +21,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "clightning";
-  version = "0.11.0.1";
+  version = "0.11.1";
 
   src = fetchurl {
     url = "https://github.com/ElementsProject/lightning/releases/download/v${version}/clightning-v${version}.zip";
-    sha256 = "e2ad6eead19a0cd8869e291c27d318cf553bb015339c1f0e8d8b30e7bc0910d8";
+    sha256 = "0vsh6gpv3458pfc5cggay9pw7bxjzyxpcniks9b2s3y1rxwk15xi";
   };
 
   # when building on darwin we need dawin.cctools to provide the correct libtool
diff --git a/pkgs/applications/misc/keepassx/community.nix b/pkgs/applications/misc/keepassx/community.nix
index c2e7ae58eb3..3daebeaabc9 100644
--- a/pkgs/applications/misc/keepassx/community.nix
+++ b/pkgs/applications/misc/keepassx/community.nix
@@ -5,34 +5,31 @@
 , darwin
 
 , asciidoctor
+, botan2
 , curl
-, glibcLocales
 , libXi
 , libXtst
 , libargon2
-, libgcrypt
-, libgpg-error
-, libsodium
-, libyubikey
+, libusb1
+, minizip
+, pcsclite
 , pkg-config
 , qrencode
 , qtbase
 , qtmacextras
 , qtsvg
 , qtx11extras
-, quazip
 , readline
 , wrapGAppsHook
 , wrapQtAppsHook
-, yubikey-personalization
 , zlib
 
 , withKeePassBrowser ? true
 , withKeePassKeeShare ? true
-, withKeePassKeeShareSecure ? true
 , withKeePassSSHAgent ? true
 , withKeePassNetworking ? true
 , withKeePassTouchID ? true
+, withKeePassYubiKey ? true
 , withKeePassFDOSecrets ? true
 
 , nixosTests
@@ -42,13 +39,13 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "keepassxc";
-  version = "2.6.6";
+  version = "2.7.1";
 
   src = fetchFromGitHub {
     owner = "keepassxreboot";
     repo = "keepassxc";
     rev = version;
-    sha256 = "15rm3avdmc2x2n92zq6w1zbcranak4j6dds2sxmgdqi1ffc0a3ci";
+    sha256 = "sha256-BOtehDzlWhhfXj8TOFvFN4f86Hl2EC3rO4qUIl9fqq4=";
   };
 
   NIX_CFLAGS_COMPILE = optionalString stdenv.cc.isClang [
@@ -66,15 +63,12 @@ stdenv.mkDerivation rec {
   cmakeFlags = [
     "-DKEEPASSXC_BUILD_TYPE=Release"
     "-DWITH_GUI_TESTS=ON"
-    "-DWITH_XC_AUTOTYPE=ON"
     "-DWITH_XC_UPDATECHECK=OFF"
-    "-DWITH_XC_YUBIKEY=ON"
   ]
   ++ (optional withKeePassBrowser "-DWITH_XC_BROWSER=ON")
   ++ (optional withKeePassKeeShare "-DWITH_XC_KEESHARE=ON")
-  ++ (optional withKeePassKeeShareSecure "-DWITH_XC_KEESHARE_SECURE=ON")
   ++ (optional withKeePassNetworking "-DWITH_XC_NETWORKING=ON")
-  ++ (optional (withKeePassTouchID && stdenv.isDarwin) "-DWITH_XC_TOUCHID=ON")
+  ++ (optional (withKeePassYubiKey && stdenv.isLinux) "-DWITH_XC_YUBIKEY=ON")
   ++ (optional (withKeePassFDOSecrets && stdenv.isLinux) "-DWITH_XC_FDOSECRETS=ON")
   ++ (optional withKeePassSSHAgent "-DWITH_XC_SSHAGENT=ON");
 
@@ -95,26 +89,22 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     curl
-    glibcLocales
+    botan2
     libXi
     libXtst
     libargon2
-    libgcrypt
-    libgpg-error
-    libsodium
-    libyubikey
+    minizip
+    pcsclite
     qrencode
     qtbase
     qtsvg
     qtx11extras
     readline
-    yubikey-personalization
     zlib
   ]
-  ++ optional withKeePassKeeShareSecure quazip
+  ++ optional stdenv.isLinux libusb1
   ++ optional stdenv.isDarwin qtmacextras
-  ++ optional (stdenv.isDarwin && withKeePassTouchID)
-    darwin.apple_sdk.frameworks.LocalAuthentication;
+  ++ optional (stdenv.isDarwin && withKeePassTouchID) darwin.apple_sdk.frameworks.LocalAuthentication;
 
   passthru.tests = nixosTests.keepassxc;
 
@@ -131,5 +121,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ jonafato turion ];
     platforms = platforms.linux ++ platforms.darwin;
+    broken = stdenv.isDarwin;  # see to https://github.com/NixOS/nixpkgs/issues/172165
   };
 }
diff --git a/pkgs/applications/misc/keepassx/darwin.patch b/pkgs/applications/misc/keepassx/darwin.patch
index 95ca5d4587f..1ec7db58636 100644
--- a/pkgs/applications/misc/keepassx/darwin.patch
+++ b/pkgs/applications/misc/keepassx/darwin.patch
@@ -8,46 +8,30 @@ index 74b1a7ff..0a713a32 100644
  elseif(APPLE AND WITH_APP_BUNDLE)
 +    set(CMAKE_INSTALL_PREFIX "${CMAKE_INSTALL_PREFIX}/Applications")
      set(BUNDLE_INSTALL_DIR "${PROGNAME}.app/Contents")
-     set(CMAKE_INSTALL_MANDIR "${PROGNAME}.app/Contents/Resources/man")
-     set(CLI_INSTALL_DIR "${PROGNAME}.app/Contents/MacOS")
-@@ -369,12 +370,6 @@ set(CMAKE_AUTORCC ON)
+     set(CMAKE_INSTALL_MANDIR "${BUNDLE_INSTALL_DIR}/Resources/man")
+     set(CLI_INSTALL_DIR "${BUNDLE_INSTALL_DIR}/MacOS")
+@@ -470,11 +470,6 @@ set(CMAKE_AUTORCC ON)
  
  if(APPLE)
      set(CMAKE_MACOSX_RPATH TRUE)
--    find_program(MACDEPLOYQT_EXE macdeployqt HINTS ${Qt5_PREFIX}/bin ENV PATH)
+-    find_program(MACDEPLOYQT_EXE macdeployqt HINTS ${Qt5_PREFIX}/bin ${Qt5_PREFIX}/tools/qt5/bin ENV PATH)
 -    if(NOT MACDEPLOYQT_EXE)
 -        message(FATAL_ERROR "macdeployqt is required to build on macOS")
--    else()
--        message(STATUS "Using macdeployqt: ${MACDEPLOYQT_EXE}")
 -    endif()
- elseif(MINGW)
-     find_program(WINDEPLOYQT_EXE windeployqt HINTS ${Qt5_PREFIX}/bin ENV PATH)
-     if(NOT WINDEPLOYQT_EXE)
-diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
-index f142f368..0742512d 100644
---- a/src/CMakeLists.txt
-+++ b/src/CMakeLists.txt
-@@ -351,11 +351,6 @@ if(APPLE AND WITH_APP_BUNDLE)
-     set(CPACK_PACKAGE_FILE_NAME "${PROGNAME}-${KEEPASSXC_VERSION}")
-     include(CPack)
+-    message(STATUS "Using macdeployqt: ${MACDEPLOYQT_EXE}")
+     set(MACDEPLOYQT_EXTRA_BINARIES "")
+ elseif(WIN32)
+     find_program(WINDEPLOYQT_EXE windeployqt HINTS ${Qt5_PREFIX}/bin ${Qt5_PREFIX}/tools/qt5/bin ENV PATH)
+diff --git a/src/post_install/CMakeLists.txt b/src/post_install/CMakeLists.txt
+index 359c891f..a6a061a3 100644
+--- a/src/post_install/CMakeLists.txt
++++ b/src/post_install/CMakeLists.txt
+@@ -1,7 +1,7 @@
+ # The install commands in this subdirectory will be executed after all the install commands in the
+ # current scope are ran. It is required for correct functtioning of macdeployqt.
  
--    add_custom_command(TARGET ${PROGNAME}
--            POST_BUILD
--            COMMAND ${MACDEPLOYQT_EXE} ${PROGNAME}.app
--            WORKING_DIRECTORY ${CMAKE_BINARY_DIR}/src
--            COMMENT "Deploying app bundle")
- endif()
- 
- install(TARGETS ${PROGNAME}
-diff --git a/src/autotype/mac/CMakeLists.txt b/src/autotype/mac/CMakeLists.txt
-index 7427450a..a0a58d71 100644
---- a/src/autotype/mac/CMakeLists.txt
-+++ b/src/autotype/mac/CMakeLists.txt
-@@ -8,7 +8,6 @@ if(WITH_APP_BUNDLE)
-     add_custom_command(TARGET keepassx-autotype-cocoa
-             POST_BUILD
-             COMMAND ${CMAKE_COMMAND} -E copy ${CMAKE_CURRENT_BINARY_DIR}/libkeepassx-autotype-cocoa.so ${PLUGIN_INSTALL_DIR}
--            COMMAND ${MACDEPLOYQT_EXE} ${PROGNAME}.app -executable=${PLUGIN_INSTALL_DIR}/libkeepassx-autotype-cocoa.so -no-plugins
-             WORKING_DIRECTORY ${CMAKE_BINARY_DIR}/src
-             COMMENT "Deploying autotype plugin")
- else()
+-if(APPLE AND WITH_APP_BUNDLE)
++if(FALSE)
+     # Run macdeloyqt on the main app and any extra binaries and plugins as specified by the
+     # _MACDEPLOYQT_EXTRA_BINARIES global property.
+     # All install(TARGETS) calls should have already been called.
diff --git a/pkgs/applications/misc/system76-keyboard-configurator/default.nix b/pkgs/applications/misc/system76-keyboard-configurator/default.nix
new file mode 100644
index 00000000000..2708fb04a61
--- /dev/null
+++ b/pkgs/applications/misc/system76-keyboard-configurator/default.nix
@@ -0,0 +1,40 @@
+{ lib, stdenv, fetchFromGitHub, rustPlatform, gtk3, glib, wrapGAppsHook, libusb1, hidapi, udev, pkgconfig }:
+
+# system76-keyboard-configurator tries to spawn a daemon as root via pkexec, so
+# your system needs a PolicyKit authentication agent running for the
+# configurator to work.
+
+rustPlatform.buildRustPackage rec {
+  pname = "system76-keyboard-configurator";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "pop-os";
+    repo = "keyboard-configurator";
+    rev = "v${version}";
+    sha256 = "sha256-CVCXNPmc/0T8vkxfU+i1nSbfusZGFVkLEveSoCePK0M=";
+  };
+
+  nativeBuildInputs = [
+    pkgconfig
+    glib # for glib-compile-resources
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    gtk3
+    hidapi
+    libusb1
+    udev
+  ];
+
+  cargoSha256 = "sha256-/p2cVxOvWKkcVOYIR0N8tQSCniw+QhXhC+pus4NsQ8k=";
+
+  meta = with lib; {
+    description = "Keyboard configuration application for System76 keyboards and laptops";
+    homepage = "https://github.com/pop-os/keyboard-configurator";
+    license = with licenses; [ gpl3Only ];
+    maintainers = with maintainers; [ mirrexagon ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/applications/misc/yubioath-desktop/default.nix b/pkgs/applications/misc/yubioath-desktop/default.nix
index 3d35e3658e5..8a164523908 100644
--- a/pkgs/applications/misc/yubioath-desktop/default.nix
+++ b/pkgs/applications/misc/yubioath-desktop/default.nix
@@ -1,27 +1,38 @@
-{ lib, stdenv, fetchurl, mkDerivation
-, qmake, qtbase, qtquickcontrols2, qtgraphicaleffects
-, python3, pyotherside
-, pcsclite, yubikey-personalization
-, yubikey-manager, makeWrapper }:
+{ lib
+, stdenv
+, fetchurl
+, mkDerivation
+, qmake
+, qtbase
+, qtquickcontrols2
+, qtgraphicaleffects
+, qtmultimedia
+, python3
+, pyotherside
+, pcsclite
+, yubikey-personalization
+, yubikey-manager
+, makeWrapper
+}:
 
 mkDerivation rec {
   pname = "yubioath-desktop";
-  version = "5.0.5";
+  version = "5.1.0";
 
   src = fetchurl {
     url = "https://developers.yubico.com/yubioath-desktop/Releases/yubioath-desktop-${version}.tar.gz";
-    sha256 = "05xs6xh9pi50h0668arirj0gnz11adpixgsdkds072077gasdm0g";
+    hash = "sha256-Lm9F4eaG9T5brAV7XDAkoj0WClmXEYIhuUzh2rk0oc0=";
   };
 
   doCheck = false;
 
-  buildInputs = [ qtbase qtquickcontrols2 qtgraphicaleffects python3 ];
+  buildInputs = [ qtbase qtquickcontrols2 qtgraphicaleffects qtmultimedia python3 ];
 
   nativeBuildInputs = [ qmake makeWrapper python3.pkgs.wrapPython ];
 
   postPatch = ''
-    substituteInPlace deployment.pri \
-      --replace '/usr/bin' "$out/bin"
+    substituteInPlace QZXing/QZXing-components.pri \
+      --replace 'target.path = $$PREFIX/lib' 'target.path = $$PREFIX/bin'
   '';
 
   pythonPath = [ yubikey-manager ];
diff --git a/pkgs/applications/networking/cluster/kube-router/default.nix b/pkgs/applications/networking/cluster/kube-router/default.nix
index b9a282b5cd1..c74fdbc749d 100644
--- a/pkgs/applications/networking/cluster/kube-router/default.nix
+++ b/pkgs/applications/networking/cluster/kube-router/default.nix
@@ -1,23 +1,33 @@
-{ lib, buildGoPackage, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub, testers, kube-router }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "kube-router";
-  version = "1.2.2";
-
-  goPackagePath = "github.com/cloudnativelabs/kube-router";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "cloudnativelabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-/VToLQexvRtcBU+k8WnGEcfLfxme/hgRnhU8723BEFU=";
+    sha256 = "sha256-WBnJPCZHtJWckoFvE8e+eAa2EC/RA7yOMlW+Cemw53Q=";
   };
 
+  vendorSha256 = "sha256-5co+288KZf/dx/jZ7xIGh6kxuW3DdbpAsrZgYob3nWk=";
+
+  CGO_ENABLED = 0;
+
   ldflags = [
-    "-X ${goPackagePath}/pkg/cmd.version=${version}"
-    "-X ${goPackagePath}/pkg/cmd.buildDate=Nix"
+    "-s"
+    "-w"
+    "-X github.com/cloudnativelabs/kube-router/pkg/version.Version=${version}"
+    "-X github.com/cloudnativelabs/kube-router/pkg/version.BuildDate=Nix"
   ];
 
+  checkFlags = [ "-short" ];
+
+  passthru.tests.version = testers.testVersion {
+    package = kube-router;
+  };
+
   meta = with lib; {
     homepage = "https://www.kube-router.io/";
     description = "All-in-one router, firewall and service proxy for Kubernetes";
diff --git a/pkgs/applications/science/math/lrcalc/default.nix b/pkgs/applications/science/math/lrcalc/default.nix
index 96eb7796451..90ee50c6828 100644
--- a/pkgs/applications/science/math/lrcalc/default.nix
+++ b/pkgs/applications/science/math/lrcalc/default.nix
@@ -1,18 +1,17 @@
 { lib, stdenv
 , fetchFromBitbucket
-, fetchpatch
 , autoreconfHook
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.2";
+  version = "2.1";
   pname = "lrcalc";
 
   src = fetchFromBitbucket {
     owner = "asbuch";
     repo = "lrcalc";
     rev = "lrcalc-${version}";
-    sha256 = "1c12d04jdyxkkav4ak8d1aqrv594gzihwhpxvc6p9js0ry1fahss";
+    sha256 = "0s3amf3z75hnrjyszdndrvk4wp5p630dcgyj341i6l57h43d1p4k";
   };
 
   doCheck = true;
@@ -21,15 +20,6 @@ stdenv.mkDerivation rec {
     autoreconfHook
   ];
 
-  patches = [
-    # Fix include syntax:
-    # For private includes, use `#include "..."` instead of `#include <...>`
-    (fetchpatch {
-      url = "https://bitbucket.org/asbuch/lrcalc/commits/226981a0/raw/";
-      sha256 = "02kaqx5s3l642rhh28kn2wg9wr098vzpknxyl4pv627lqa3lv9vm";
-    })
-  ];
-
   meta = with lib; {
     description = "Littlewood-Richardson calculator";
     homepage = "http://math.rutgers.edu/~asbuch/lrcalc/";
diff --git a/pkgs/applications/science/math/sage/default.nix b/pkgs/applications/science/math/sage/default.nix
index 70e24e2608d..84b511de8fc 100644
--- a/pkgs/applications/science/math/sage/default.nix
+++ b/pkgs/applications/science/math/sage/default.nix
@@ -48,6 +48,12 @@ let
     logo64 = "${sage-src}/src/doc/common/themes/sage/static/sageicon.png";
   };
 
+  jupyter-kernel-specs = pkgs.jupyter-kernel.create {
+    definitions = pkgs.jupyter-kernel.default // {
+      sagemath = jupyter-kernel-definition;
+    };
+  };
+
   three = callPackage ./threejs-sage.nix { };
 
   # A bash script setting various environment variables to tell sage where
@@ -73,7 +79,7 @@ let
   # The documentation for sage, building it takes a lot of ram.
   sagedoc = callPackage ./sagedoc.nix {
     inherit sage-with-env;
-    inherit python3 maxima;
+    inherit python3 maxima jupyter-kernel-specs;
   };
 
   # sagelib with added wrappers and a dependency on sage-tests to make sure thet tests were run.
@@ -167,6 +173,6 @@ let
 in
 # A wrapper around sage that makes sure sage finds its docs (if they were build).
 callPackage ./sage.nix {
-  inherit sage-tests sage-with-env sagedoc jupyter-kernel-definition;
+  inherit sage-tests sage-with-env sagedoc jupyter-kernel-specs;
   inherit withDoc requireSageTests;
 }
diff --git a/pkgs/applications/science/math/sage/patches/Only-test-external-software-when-all-of-sage-is.patch b/pkgs/applications/science/math/sage/patches/Only-test-external-software-when-all-of-sage-is.patch
deleted file mode 100644
index a478f50d92e..00000000000
--- a/pkgs/applications/science/math/sage/patches/Only-test-external-software-when-all-of-sage-is.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-diff --git a/src/sage/doctest/control.py b/src/sage/doctest/control.py
-index 01f32fb8e4..4d83dc7b47 100644
---- a/src/sage/doctest/control.py
-+++ b/src/sage/doctest/control.py
-@@ -1253,6 +1253,7 @@ class DocTestController(SageObject):
- 
-             self.log("Using --optional=" + self._optional_tags_string())
-             available_software._allow_external = self.options.optional is True or 'external' in self.options.optional
-+            available_software._autodetect_safe = self.options.optional is True or 'sage' in self.options.optional
-             self.log("Features to be detected: " + ','.join(available_software.detectable()))
-             self.add_files()
-             self.expand_files_into_sources()
-diff --git a/src/sage/doctest/external.py b/src/sage/doctest/external.py
-index 84dae19ea5..badc61466e 100644
---- a/src/sage/doctest/external.py
-+++ b/src/sage/doctest/external.py
-@@ -409,6 +409,7 @@ class AvailableSoftware(object):
-             []
-         """
-         self._allow_external = True
-+        self._autodetect_safe = True
-         # For multiprocessing of doctests, the data self._seen should be
-         # shared among subprocesses. Thus we use Array class from the
-         # multiprocessing module.
-@@ -430,6 +431,8 @@ class AvailableSoftware(object):
-             sage: 'internet' in available_software # random, optional - internet
-             True
-         """
-+        if not self._autodetect_safe:
-+            return False
-         try:
-             idx = self._indices[item]
-         except KeyError:
-diff --git a/src/sage/features/sagemath.py b/src/sage/features/sagemath.py
-index 433338766d..233623b14a 100644
---- a/src/sage/features/sagemath.py
-+++ b/src/sage/features/sagemath.py
-@@ -12,7 +12,7 @@ class sagemath_doc_html(StaticFile):
- 
-     EXAMPLES::
- 
--        sage: from sage.features.sagemath import sagemath_doc_html
-+        sage: from sage.features.sagemath import sagemath_doc_html  # optional - sagemath_doc_html
-         sage: sagemath_doc_html().is_present()  # optional - sagemath_doc_html
-         FeatureTestResult('sagemath_doc_html', True)
-     """
diff --git a/pkgs/applications/science/math/sage/patches/configurationpy-error-verbose.patch b/pkgs/applications/science/math/sage/patches/configurationpy-error-verbose.patch
index e687281ad1a..ca01eba29a2 100644
--- a/pkgs/applications/science/math/sage/patches/configurationpy-error-verbose.patch
+++ b/pkgs/applications/science/math/sage/patches/configurationpy-error-verbose.patch
@@ -13,7 +13,7 @@ index 67d7d2accf..18279581e2 100644
 -    True
 +    sage: print(output)
 +    sage...[False, True]
-+    sage...Exiting Sage ...
++    ...
  """
  
  #*****************************************************************************
diff --git a/pkgs/applications/science/math/sage/patches/docutils-0.18.1-deprecation.patch b/pkgs/applications/science/math/sage/patches/docutils-0.18.1-deprecation.patch
index 94e0488e21e..0a19e7af104 100644
--- a/pkgs/applications/science/math/sage/patches/docutils-0.18.1-deprecation.patch
+++ b/pkgs/applications/science/math/sage/patches/docutils-0.18.1-deprecation.patch
@@ -1,11 +1,11 @@
 diff --git a/src/sage/misc/sagedoc.py b/src/sage/misc/sagedoc.py
-index 4c56aea078..e51a77ae8a 100644
+index 08c4225b87..3a9bbe4ed0 100644
 --- a/src/sage/misc/sagedoc.py
 +++ b/src/sage/misc/sagedoc.py
 @@ -1402,6 +1402,8 @@ class _sage_doc:
              sage: identity_matrix.__doc__ in browse_sage_doc(identity_matrix, 'rst')
              True
-             sage: browse_sage_doc(identity_matrix, 'html', False)             # optional - sphinx
+             sage: browse_sage_doc(identity_matrix, 'html', False)             # optional - sphinx sagemath_doc_html
 +            ...
 +            FutureWarning: The configuration setting "embed_images" will be removed in Docutils 1.2. Use "image_loading: link".
              '...div...File:...Type:...Definition:...identity_matrix...'
diff --git a/pkgs/applications/science/math/sage/patches/sphinx-docbuild-subprocesses.patch b/pkgs/applications/science/math/sage/patches/sphinx-docbuild-subprocesses.patch
index 1ff081b25e0..3e7e37508ff 100644
--- a/pkgs/applications/science/math/sage/patches/sphinx-docbuild-subprocesses.patch
+++ b/pkgs/applications/science/math/sage/patches/sphinx-docbuild-subprocesses.patch
@@ -1,10 +1,10 @@
 diff --git a/src/sage_docbuild/__init__.py b/src/sage_docbuild/__init__.py
-index 8a5c1a19d2..21fd192642 100644
+index b12d56a3c9..df9d949ed1 100644
 --- a/src/sage_docbuild/__init__.py
 +++ b/src/sage_docbuild/__init__.py
-@@ -89,27 +89,6 @@ def builder_helper(type):
+@@ -88,30 +88,6 @@ def builder_helper(type):
      """
-     Returns a function which builds the documentation for
+     Return a function which builds the documentation for
      output type ``type``.
 -
 -    TESTS:
@@ -19,10 +19,13 @@ index 8a5c1a19d2..21fd192642 100644
 -        ....:     raise BaseException("abort pool operation")
 -        sage: original_runsphinx, sage_docbuild.sphinxbuild.runsphinx = sage_docbuild.sphinxbuild.runsphinx, raiseBaseException
 -
+-        sage: from sage.misc.temporary_file import tmp_dir
+-        sage: os.environ['SAGE_DOC'] = tmp_dir()
+-        sage: sage.env.var('SAGE_DOC') # random
 -        sage: from sage_docbuild import builder_helper, build_ref_doc
 -        sage: from sage_docbuild import _build_many as build_many
 -        sage: helper = builder_helper("html")
--        sage: try:
+-        sage: try:  # optional - sagemath_doc_html
 -        ....:     build_many(build_ref_doc, [("docname", "en", "html", {})])
 -        ....: except Exception as E:
 -        ....:     "Non-exception during docbuild: abort pool operation" in str(E)
@@ -30,7 +33,7 @@ index 8a5c1a19d2..21fd192642 100644
      """
      def f(self, *args, **kwds):
          output_dir = self._output_dir(type)
-@@ -131,10 +110,9 @@ def builder_helper(type):
+@@ -139,10 +115,9 @@ def builder_helper(type):
          logger.debug(build_command)
  
          # Run Sphinx with Sage's special logger
@@ -44,10 +47,10 @@ index 8a5c1a19d2..21fd192642 100644
              if ABORT_ON_ERROR:
                  raise
 diff --git a/src/sage_docbuild/sphinxbuild.py b/src/sage_docbuild/sphinxbuild.py
-index d917c3e9d4..551cc8028a 100644
+index a39c99ffe9..73be823684 100644
 --- a/src/sage_docbuild/sphinxbuild.py
 +++ b/src/sage_docbuild/sphinxbuild.py
-@@ -327,3 +327,8 @@ def runsphinx():
+@@ -330,3 +330,8 @@ def runsphinx():
          sys.stderr = saved_stderr
          sys.stdout.flush()
          sys.stderr.flush()
diff --git a/pkgs/applications/science/math/sage/python-modules/sage-docbuild.nix b/pkgs/applications/science/math/sage/python-modules/sage-docbuild.nix
index 1766cec3e35..b0f40bf0658 100644
--- a/pkgs/applications/science/math/sage/python-modules/sage-docbuild.nix
+++ b/pkgs/applications/science/math/sage/python-modules/sage-docbuild.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , sage-src
 , sphinx
+, jupyter-sphinx
 }:
 
 buildPythonPackage rec {
@@ -11,6 +12,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     sphinx
+    jupyter-sphinx
   ];
 
   preBuild = ''
diff --git a/pkgs/applications/science/math/sage/sage-env.nix b/pkgs/applications/science/math/sage/sage-env.nix
index cdff1e8477a..4c22470de91 100644
--- a/pkgs/applications/science/math/sage/sage-env.nix
+++ b/pkgs/applications/science/math/sage/sage-env.nix
@@ -186,7 +186,7 @@ writeTextFile rec {
     export SAGE_EXTCODE='${sagelib.src}/src/sage/ext_data'
 
   # for find_library
-    export DYLD_LIBRARY_PATH="${lib.makeLibraryPath [stdenv.cc.libc singular]}''${DYLD_LIBRARY_PATH:+:}$DYLD_LIBRARY_PATH"
+    export DYLD_LIBRARY_PATH="${lib.makeLibraryPath [stdenv.cc.libc singular giac]}''${DYLD_LIBRARY_PATH:+:}$DYLD_LIBRARY_PATH"
   '';
 } // { # equivalent of `passthru`, which `writeTextFile` doesn't support
   lib = sagelib;
diff --git a/pkgs/applications/science/math/sage/sage-src.nix b/pkgs/applications/science/math/sage/sage-src.nix
index b230b0d42a0..95da9b26e54 100644
--- a/pkgs/applications/science/math/sage/sage-src.nix
+++ b/pkgs/applications/science/math/sage/sage-src.nix
@@ -58,30 +58,19 @@ let
   );
 in
 stdenv.mkDerivation rec {
-  version = "9.5";
+  version = "9.6";
   pname = "sage-src";
 
   src = fetchFromGitHub {
     owner = "sagemath";
     repo = "sage";
     rev = version;
-    sha256 = "sha256-uOsLpsGpcIGs8Xr82X82MElnTB2E908gytyNJ8WVD5w=";
+    sha256 = "sha256-QY8Yga3hD1WhSCtA2/PVry8hHlMmC31J8jCBFtWgIU0=";
   };
 
   # Patches needed because of particularities of nix or the way this is packaged.
   # The goal is to upstream all of them and get rid of this list.
   nixPatches = [
-    # Since https://trac.sagemath.org/ticket/32174, some external features are
-    # marked as "safe" and get auto-detected, in which case the corresponding
-    # optional tests are executed. We disable auto-detection of safe features if
-    # we are doctesting with an "--optional" argument which does not include
-    # "sage", because tests from autodetected features expect context provided
-    # by running basic sage tests. This is necessary to test sagemath_doc_html
-    # separately. See https://trac.sagemath.org/ticket/26110 for a related
-    # upstream discussion (from the time when Sage still had optional py2/py3
-    # tags).
-    ./patches/Only-test-external-software-when-all-of-sage-is.patch
-
     # Fixes a potential race condition which can lead to transient doctest failures.
     ./patches/fix-ecl-race.patch
 
@@ -120,81 +109,13 @@ stdenv.mkDerivation rec {
     # https://trac.sagemath.org/ticket/32959
     ./patches/linbox-1.7-upgrade.patch
 
-    # https://trac.sagemath.org/ticket/33170
-    (fetchSageDiff {
-      base = "9.6.beta5";
-      name = "ipython-8.1-update.patch";
-      rev = "4d2b53f1541375861310af3a7f7109c1c2ed475d";
-      sha256 = "sha256-ELda/VBzsQH7NdFas69fQ35QPUoJCeLx/gxT1j7qGR8=";
-    })
-
-    # https://trac.sagemath.org/ticket/32968
-    (fetchSageDiff {
-      base = "9.5";
-      name = "sphinx-4.3-update.patch";
-      rev = "fc84f82f52b6f05f512cb359ec7c100f93cf8841";
-      sha256 = "sha256-bBbfdcnw/9LUOlY8rHJRbFJEdMXK4shosqTNaobTS1Q=";
-    })
-
-    # https://trac.sagemath.org/ticket/33189
-    (fetchSageDiff {
-      base = "9.5";
-      name = "arb-2.22-update.patch";
-      rev = "53532ddd4e2dc92469c1590ebf0c40f8f69bf579";
-      sha256 = "sha256-6SoSBvIlqvNwZV3jTB6uPdUtaWIOeNmddi2poK/WvGs=";
-    })
-
-    # TODO: This will not be necessary when Sphinx 4.4.1 is released,
-    # since some warnings introduced in 4.4.0 will be disabled by then
-    # (https://github.com/sphinx-doc/sphinx/pull/10126).
-    # https://trac.sagemath.org/ticket/33272
-    (fetchSageDiff {
-      base = "9.5";
-      name = "sphinx-4.4-warnings.patch";
-      rev = "97d7958bed441cf2ccc714d88f83d3a8426bc085";
-      sha256 = "sha256-y1STE0oxswnijGCsBw8eHWWqpmT1XMznIfA0vvX9pFA=";
-    })
-
     # adapted from https://trac.sagemath.org/ticket/23712#comment:22
     ./patches/tachyon-renamed-focallength.patch
 
-    # https://trac.sagemath.org/ticket/33336
-    (fetchSageDiff {
-      base = "9.6.beta2";
-      name = "scipy-1.8-update.patch";
-      rev = "9c8235e44ffb509efa8a3ca6cdb55154e2b5066d";
-      sha256 = "sha256-bfc4ljNOxVnhlmxIuNbjbKl4vJXYq2tlF3Z8bbC8PWw=";
-    })
-
-    # https://trac.sagemath.org/ticket/33495
-    (fetchSageDiff {
-      base = "9.6.beta5";
-      name = "networkx-2.7-update.patch";
-      rev = "8452003846a7303100847d8d0ed642fc642c11d6";
-      sha256 = "sha256-A/XMouPlc2sjFp30L+56fBGJXydS2EtzfPOV98FCDqI=";
-    })
-
-    # https://trac.sagemath.org/ticket/33226
-    (fetchSageDiff {
-      base = "9.6.beta0";
-      name = "giac-1.7.0-45-update.patch";
-      rev = "33ea2adf01e9e2ce9f1e33779f0b1ac0d9d1989c";
-      sha256 = "sha256-DOyxahf3+IaYdkgmAReNDCorRzMgO8+yiVrJ5TW1km0=";
-    })
-
-    # https://trac.sagemath.org/ticket/33398
-    (fetchSageDiff {
-      base = "9.6.beta4";
-      name = "sympy-1.10-update.patch";
-      rev = "6b7c3a28656180e42163dc10f7b4a571b93e5f27";
-      sha256 = "sha256-fnUyM2yjHkCykKRfzQQ4glcUYmCS/fYzDzmCf0nuebk=";
-      # The patch contains a whitespace change to a file that didn't exist in Sage 9.5.
-      excludes = [ "build/*" "src/sage/manifolds/vector_bundle_fiber_element.py" ];
-    })
-
     # docutils 0.18.1 now triggers Sphinx warnings. tolerate them for
-    # now, because patching Sphinx is not feasible.
-    # https://github.com/sphinx-doc/sphinx/issues/9777#issuecomment-1104481271
+    # now, because patching Sphinx is not feasible. remove when Sphinx
+    # 5.0 hits nixpkgs.
+    # https://github.com/sphinx-doc/sphinx/pull/10372
     ./patches/docutils-0.18.1-deprecation.patch
   ];
 
diff --git a/pkgs/applications/science/math/sage/sage.nix b/pkgs/applications/science/math/sage/sage.nix
index 96122fba5ab..78fd8d598d0 100644
--- a/pkgs/applications/science/math/sage/sage.nix
+++ b/pkgs/applications/science/math/sage/sage.nix
@@ -2,8 +2,7 @@
 , makeWrapper
 , sage-tests
 , sage-with-env
-, jupyter-kernel-definition
-, jupyter-kernel
+, jupyter-kernel-specs
 , sagedoc
 , withDoc
 , requireSageTests
@@ -12,14 +11,6 @@
 # A wrapper that makes sure sage finds its docs (if they were build) and the
 # jupyter kernel spec.
 
-let
-  # generate kernel spec + default kernels
-  kernel-specs = jupyter-kernel.create {
-    definitions = jupyter-kernel.default // {
-      sagemath = jupyter-kernel-definition;
-    };
-  };
-in
 stdenv.mkDerivation rec {
   version = src.version;
   pname = "sage";
@@ -43,7 +34,7 @@ stdenv.mkDerivation rec {
       --set SAGE_DOC_SRC_OVERRIDE "${src}/src/doc" ${
         lib.optionalString withDoc "--set SAGE_DOC_OVERRIDE ${sagedoc}/share/doc/sage"
       } \
-      --prefix JUPYTER_PATH : "${kernel-specs}"
+      --prefix JUPYTER_PATH : "${jupyter-kernel-specs}"
   '';
 
   doInstallCheck = withDoc;
@@ -58,7 +49,7 @@ stdenv.mkDerivation rec {
     quicktest = sage-tests.override { longTests = false; timeLimit = 600; }; # as many tests as possible in ~10m
     doc = sagedoc;
     lib = sage-with-env.env.lib;
-    kernelspec = jupyter-kernel-definition;
+    kernelspec = jupyter-kernel-specs.definition.sagemath;
   };
 
   meta = with lib; {
diff --git a/pkgs/applications/science/math/sage/sagedoc.nix b/pkgs/applications/science/math/sage/sagedoc.nix
index 489fc2edfe5..67d754caff3 100644
--- a/pkgs/applications/science/math/sage/sagedoc.nix
+++ b/pkgs/applications/science/math/sage/sagedoc.nix
@@ -1,6 +1,7 @@
 { stdenv
 , sage-with-env
 , python3
+, jupyter-kernel-specs
 , maxima
 , tachyon
 , jmol
@@ -59,10 +60,15 @@ stdenv.mkDerivation rec {
     OUTPUT="$OUTPUT_DIR/options.txt"
     ${sage-with-env}/bin/sage -advanced > "$OUTPUT"
 
-    ${sage-with-env}/bin/sage --docbuild \
+    # jupyter-sphinx calls the sagemath jupyter kernel during docbuild
+    export JUPYTER_PATH=${jupyter-kernel-specs}
+
+    # sage --docbuild unsets JUPYTER_PATH, so we call sage_docbuild directly
+    # https://trac.sagemath.org/ticket/33650#comment:32
+    ${sage-with-env}/bin/sage --python3 -m sage_docbuild \
       --mathjax \
       --no-pdf-links \
-      all html
+      all html < /dev/null
   '';
 
   installPhase = ''
@@ -83,6 +89,10 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
   checkPhase = ''
-    ${sage-with-env}/bin/sage -t --optional=sagemath_doc_html --all
+    # sagemath_doc_html tests assume sage tests are being run, so we
+    # compromise: we run standard tests, but only on files containing
+    # relevant tests. as of Sage 9.6, there are only 4 such files.
+    grep -PRl "#.*optional.*sagemath_doc_html" ${src}/src/sage{,_docbuild} | \
+      xargs ${sage-with-env}/bin/sage -t --optional=sage,sagemath_doc_html
   '';
 }
diff --git a/pkgs/applications/science/math/sage/sagelib.nix b/pkgs/applications/science/math/sage/sagelib.nix
index 92eae35688f..8f864d13692 100644
--- a/pkgs/applications/science/math/sage/sagelib.nix
+++ b/pkgs/applications/science/math/sage/sagelib.nix
@@ -67,7 +67,9 @@
 , pillow
 , ipykernel
 , networkx
-, sphinx # TODO: this is in setup.cfg, bug should we override it?
+, ptyprocess
+, lrcalc-python
+, sphinx # TODO: this is in setup.cfg, should we override it?
 }:
 
 assert (!blas.isILP64) && (!lapack.isILP64);
@@ -157,6 +159,8 @@ buildPythonPackage rec {
     networkx
     jupyter-client
     ipywidgets
+    ptyprocess
+    lrcalc-python
     sphinx
   ];
 
@@ -188,7 +192,7 @@ buildPythonPackage rec {
     # Sage tests already catch any relevant API breakage.
     # according to the discussion at https://trac.sagemath.org/ticket/33520,
     # upper bounds will be less noisy starting from Sage 9.6.
-    sed -i 's/==2.1.0rc1/>=2.1.1/' ../gmpy2/install-requires.txt
+    sed -i 's/==0.5.1/>=0.5.1/' ../ptyprocess/install-requires.txt
     sed -i 's/, <[^, ]*//' ../*/install-requires.txt
 
     for infile in src/*.m4; do
diff --git a/pkgs/applications/video/makemkv/default.nix b/pkgs/applications/video/makemkv/default.nix
index 712ccacd7a0..2c15513d4d6 100644
--- a/pkgs/applications/video/makemkv/default.nix
+++ b/pkgs/applications/video/makemkv/default.nix
@@ -55,7 +55,7 @@ in mkDerivation {
   installPhase = ''
     runHook preInstall
 
-    install -Dm555 -t $out/bin                              out/makemkv ../makemkv-bin-${version}/bin/amd64/makemkvcon
+    install -Dm555 -t $out/bin                              out/makemkv out/mmccextr ../makemkv-bin-${version}/bin/amd64/makemkvcon
     install -D     -t $out/lib                              out/lib{driveio,makemkv,mmbd}.so.*
     install -D     -t $out/share/MakeMKV                    ../makemkv-bin-${version}/src/share/*
     install -Dm444 -t $out/share/applications               ../makemkv-oss-${version}/makemkvgui/share/makemkv.desktop
diff --git a/pkgs/desktops/gnome/extensions/update-extensions.py b/pkgs/desktops/gnome/extensions/update-extensions.py
index 8feee4437f4..9117ea27040 100755
--- a/pkgs/desktops/gnome/extensions/update-extensions.py
+++ b/pkgs/desktops/gnome/extensions/update-extensions.py
@@ -47,10 +47,6 @@ def fetch_extension_data(uuid: str, version: str) -> Tuple[str, str]:
     uuid = uuid.replace("@", "")
     url: str = f"https://extensions.gnome.org/extension-data/{uuid}.v{version}.shell-extension.zip"
 
-    # TODO remove when Vitals@CoreCoding.com version != 53, this extension has a missing manifest.json
-    if url == 'https://extensions.gnome.org/extension-data/VitalsCoreCoding.com.v53.shell-extension.zip':
-        url = 'https://extensions.gnome.org/extension-data/VitalsCoreCoding.com.v53.shell-extension_v1BI2FB.zip'
-
     # Download extension and add the zip content to nix-store
     process = subprocess.run(
         ["nix-prefetch-url", "--unpack", "--print-path", url], capture_output=True, text=True
diff --git a/pkgs/development/interpreters/bats/default.nix b/pkgs/development/interpreters/bats/default.nix
index da12e7a3e65..184d23b92b9 100644
--- a/pkgs/development/interpreters/bats/default.nix
+++ b/pkgs/development/interpreters/bats/default.nix
@@ -6,6 +6,12 @@
 , coreutils
 , gnugrep
 , ncurses
+, findutils
+, hostname
+, parallel
+, flock
+, ps
+, bats
 , lsof
 , doInstallCheck ? true
 }:
@@ -31,32 +37,99 @@ resholve.mkDerivation rec {
 
   solutions = {
     bats = {
-      scripts = [ "bin/bats" ];
+      scripts = [
+        "bin/bats"
+        "libexec/bats-core/*"
+        "lib/bats-core/*"
+      ];
       interpreter = "${bash}/bin/bash";
-      inputs = [ bash coreutils gnugrep ];
+      inputs = [
+        bash
+        coreutils
+        gnugrep
+        ncurses
+        findutils
+        hostname
+        parallel
+        flock
+        "lib/bats-core"
+        "libexec/bats-core"
+      ];
       fake = {
-        external = [ "greadlink" ];
+        external = [
+          "greadlink"
+          "shlock"
+        ];
       };
       fix = {
         "$BATS_ROOT" = [ "${placeholder "out"}" ];
+        "$BATS_LIBEXEC" = [ "${placeholder "out"}/libexec/bats-core" ];
       };
       keep = {
         "${placeholder "out"}/libexec/bats-core/bats" = true;
+        source = [
+          "${placeholder "out"}/lib/bats-core/validator.bash"
+          "${placeholder "out"}/lib/bats-core/preprocessing.bash"
+          "$BATS_TEST_SOURCE"
+          "${placeholder "out"}/lib/bats-core/tracing.bash"
+          "${placeholder "out"}/lib/bats-core/test_functions.bash"
+          "$library_load_path"
+          "${placeholder "out"}/lib/bats-core/common.bash"
+          "${placeholder "out"}/lib/bats-core/semaphore.bash"
+          "${placeholder "out"}/lib/bats-core/formatter.bash"
+        ];
+        "$report_formatter" = true;
+        "$formatter" = true;
+        "$pre_command" = true;
+        "$BATS_TEST_NAME" = true;
+        "${placeholder "out"}/libexec/bats-core/bats-exec-test" = true;
       };
+      execer = [
+        /*
+        both blatant lies for expedience; these can certainly exec args
+        they may be safe here, because they may always run things that
+        are ultimately in libexec?
+        TODO: handle parallel and flock in binlore/resholve
+        */
+        "cannot:${parallel}/bin/parallel"
+        "cannot:${flock}/bin/flock"
+
+        "cannot:libexec/bats-core/bats-preprocess"
+
+        # these do exec, but other internal files
+        "cannot:libexec/bats-core/bats-exec-file"
+        "cannot:libexec/bats-core/bats-exec-suite"
+      ];
     };
   };
 
-  inherit doInstallCheck;
-  installCheckInputs = [ ncurses ] ++ lib.optionals stdenv.isDarwin [ lsof ];
-  installCheckPhase = ''
-    # TODO: cut if https://github.com/bats-core/bats-core/issues/418 allows
-    sed -i '/test works even if PATH is reset/a skip' test/bats.bats
+  passthru.tests.upstream = bats.unresholved.overrideAttrs (old: {
+    name = "${bats.name}-tests";
+    installCheckInputs = [
+      ncurses
+      parallel # skips some tests if it can't detect
+      flock # skips some tests if it can't detect
+      ps
+    ] ++ lib.optionals stdenv.isDarwin [ lsof ];
+    inherit doInstallCheck;
+    installCheckPhase = ''
+      # TODO: cut if https://github.com/bats-core/bats-core/issues/418 allows
+      sed -i '/test works even if PATH is reset/a skip "disabled for nix build"' test/bats.bats
+      # TODO: cut when https://github.com/bats-core/bats-core/pull/554 allows
+      substituteInPlace test/parallel.bats --replace '&& type -p shlock' '|| type -p shlock'
 
-    # test generates file with absolute shebang dynamically
-    substituteInPlace test/install.bats --replace \
-      "/usr/bin/env bash" "${bash}/bin/bash"
-    bin/bats test
-  '';
+      # skip tests that assume bats `install.sh` will be in BATS_ROOT
+      rm test/root.bats
+
+      # test generates file with absolute shebang dynamically
+      substituteInPlace test/install.bats --replace \
+        "/usr/bin/env bash" "${bash}/bin/bash"
+
+      ${bats}/bin/bats test
+      rm -rf $out
+      touch $out
+    '';
+  });
 
   meta = with lib; {
     homepage = "https://github.com/bats-core/bats-core";
diff --git a/pkgs/development/python-modules/embrace/default.nix b/pkgs/development/python-modules/embrace/default.nix
index 414425ed6f2..1e38a550d17 100644
--- a/pkgs/development/python-modules/embrace/default.nix
+++ b/pkgs/development/python-modules/embrace/default.nix
@@ -1,4 +1,5 @@
-{ lib, buildPythonPackage, fetchFromSourcehut, sqlparse, wrapt, pytestCheckHook }:
+{ stdenv, lib, buildPythonPackage, fetchFromSourcehut,
+  sqlparse, wrapt, pytestCheckHook }:
 
 buildPythonPackage rec {
   pname = "embrace";
@@ -16,6 +17,10 @@ buildPythonPackage rec {
   checkInputs = [ pytestCheckHook ];
   pythonImportsCheck = [ "embrace" ];
 
+  # Some test for hot-reload fails on Darwin, but the rest of the library
+  # should remain usable. (https://todo.sr.ht/~olly/embrace-sql/4)
+  doCheck = !stdenv.isDarwin;
+
   meta = with lib; {
     description = "Embrace SQL keeps your SQL queries in SQL files";
     homepage = "https://pypi.org/project/embrace/";
diff --git a/pkgs/development/python-modules/lrcalc-python/default.nix b/pkgs/development/python-modules/lrcalc-python/default.nix
new file mode 100644
index 00000000000..66c0ad46e5b
--- /dev/null
+++ b/pkgs/development/python-modules/lrcalc-python/default.nix
@@ -0,0 +1,31 @@
+{ lib
+, fetchPypi
+, buildPythonPackage
+, cython
+, pkg-config
+, lrcalc
+}:
+
+buildPythonPackage rec {
+  pname = "lrcalc-python";
+  version = "2.1";
+
+  src = fetchPypi {
+    inherit version;
+    pname = "lrcalc";
+    sha256 = "e3a0509aeda487b412b391a52e817ca36b5c063a8305e09fd54d53259dd6aaa9";
+  };
+
+  nativeBuildInputs = [ cython pkg-config ];
+
+  buildInputs = [ lrcalc ];
+
+  pythonImportsCheck = [ "lrcalc" ];
+
+  meta = with lib; {
+    description = "Littlewood-Richardson Calculator bindings";
+    homepage = "https://sites.math.rutgers.edu/~asbuch/lrcalc/";
+    maintainers = teams.sage.members;
+    license = licenses.gpl3;
+  };
+}
diff --git a/pkgs/development/tools/fx/default.nix b/pkgs/development/tools/fx/default.nix
index d3ae227ca26..10f2e300b0d 100644
--- a/pkgs/development/tools/fx/default.nix
+++ b/pkgs/development/tools/fx/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "fx";
-  version = "22.0.10";
+  version = "24.0.0";
 
   src = fetchFromGitHub {
     owner = "antonmedv";
     repo = pname;
     rev = version;
-    sha256 = "sha256-BoWb27sRqcYHSLhUvjRIRIkcj90FitpbrH2R3VHsRyI=";
+    sha256 = "sha256-Sg+mluDOGpkEUl+3BoItuPnMqs8F6o+D5xIqF0w0EIU=";
   };
 
-  vendorSha256 = "sha256-ZDPRKrum2tnhscZxLzslezYs/hOOtHwAORrAWoQhXbs=";
+  vendorSha256 = "sha256-4hx1AZQQ4xHBTzBK0OmrTUGMK4Rfu36cmopVV4SOjCQ=";
 
   meta = with lib; {
     description = "Terminal JSON viewer";
diff --git a/pkgs/development/tools/misc/devspace/default.nix b/pkgs/development/tools/misc/devspace/default.nix
index df59686b2b9..0fe665606a2 100644
--- a/pkgs/development/tools/misc/devspace/default.nix
+++ b/pkgs/development/tools/misc/devspace/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "devspace";
-  version = "5.18.4";
+  version = "5.18.5";
 
   src = fetchFromGitHub {
     owner = "loft-sh";
     repo = "devspace";
     rev = "v${version}";
-    sha256 = "0s5117cgxgrxfki5drvg6d22dvrjffa03bi644zdl1p631r599r1";
+    sha256 = "1i4ir8p3xpfy8z8w8gzpk1hyzs04b5llrjd6hl2hzrxd1likl0sh";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/os-specific/linux/microcode/intel.nix b/pkgs/os-specific/linux/microcode/intel.nix
index 41091181ee8..002284e2154 100644
--- a/pkgs/os-specific/linux/microcode/intel.nix
+++ b/pkgs/os-specific/linux/microcode/intel.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "microcode-intel";
-  version = "20220419";
+  version = "20220510";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "Intel-Linux-Processor-Microcode-Data-Files";
     rev = "microcode-${version}";
-    sha256 = "sha256-i3OhOEqyK6gJfRIPewPGb4/6k6lO0atmedEqJ2e+66U=";
+    sha256 = "sha256-x+8qyC7YP7co/7qLhaAtjMtyeANaZJ/r41iFl1Mut+M=";
   };
 
   nativeBuildInputs = [ iucode-tool libarchive ];
diff --git a/pkgs/servers/libreddit/default.nix b/pkgs/servers/libreddit/default.nix
index 8274b744069..443905451dd 100644
--- a/pkgs/servers/libreddit/default.nix
+++ b/pkgs/servers/libreddit/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "libreddit";
-  version = "0.22.6";
+  version = "0.22.7";
 
   src = fetchFromGitHub {
     owner = "spikecodes";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Dx0eVg1T9WTHeIQO9hwUoCAcUgQey8rlZ5+uxPIX0Wc=";
+    sha256 = "sha256-kM+XvkSxc+OsHq2hGPdpy32jQ/35AJo75PlpbeWjef0=";
   };
 
-  cargoSha256 = "sha256-RGZgo9uxRmPpZzXu6AC2FPjOoZxLnh4gCjadAOTWJ4Q=";
+  cargoSha256 = "sha256-md56axw3tpl++wP3ga0iMX63ixu/35lhT4TA2Uo8GpI=";
 
   buildInputs = lib.optional stdenv.isDarwin Security;
 
diff --git a/pkgs/tools/filesystems/afpfs-ng/default.nix b/pkgs/tools/filesystems/afpfs-ng/default.nix
index 9c4268e402d..b56bfba62cd 100644
--- a/pkgs/tools/filesystems/afpfs-ng/default.nix
+++ b/pkgs/tools/filesystems/afpfs-ng/default.nix
@@ -11,6 +11,12 @@ stdenv.mkDerivation {
     sha256 = "125jx1rsqkiifcffyjb05b2s36rllckdgjaf1bay15k9gzhwwldz";
   };
 
+  # Add workaround for -fno-common toolchains like upstream gcc-10 to
+  # avoid build failures like:
+  #   ld: afpcmd-cmdline_main.o:/build/source/cmdline/cmdline_afp.h:4: multiple definition of
+  #    `full_url'; afpcmd-cmdline_afp.o:/build/source/cmdline/cmdline_afp.c:27: first defined here
+  NIX_CFLAGS_COMPILE = "-fcommon";
+
   buildInputs = [ fuse readline libgcrypt gmp ];
 
   meta = with lib; {
diff --git a/pkgs/tools/misc/oci-image-tool/default.nix b/pkgs/tools/misc/oci-image-tool/default.nix
deleted file mode 100644
index 8cac6d1c3f5..00000000000
--- a/pkgs/tools/misc/oci-image-tool/default.nix
+++ /dev/null
@@ -1,23 +0,0 @@
-{ lib, fetchFromGitHub, buildGoPackage }:
-
-buildGoPackage rec {
-  pname = "oci-image-tool";
-  version = "1.0.0-rc1";
-
-  goPackagePath = "github.com/opencontainers/image-tools";
-  subPackages = [ "cmd/oci-image-tool" ];
-
-  src = fetchFromGitHub {
-    owner = "opencontainers";
-    repo = "image-tools";
-    rev = "v${version}";
-    sha256 = "0c4n69smqlkf0r6khy9gbg5f810qh9g8jqsl9kibb0dyswizr14r";
-  };
-
-  meta = {
-    description = "A collection of tools for working with the OCI image format specification";
-    homepage = "https://github.com/opencontainers/image-tools";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ nzhang-zh ];
-  };
-}
diff --git a/pkgs/tools/networking/cdpr/default.nix b/pkgs/tools/networking/cdpr/default.nix
index 0b92fd7aa45..a3f821bdbb3 100644
--- a/pkgs/tools/networking/cdpr/default.nix
+++ b/pkgs/tools/networking/cdpr/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, libpcap }:
+{ lib, stdenv, fetchurl, fetchpatch, libpcap }:
 
 stdenv.mkDerivation rec {
   pname = "cdpr";
@@ -8,6 +8,15 @@ stdenv.mkDerivation rec {
     url = "mirror://sourceforge/${pname}/${pname}/${version}/${pname}-${version}.tgz";
     sha256 = "1idyvyafkk0ifcbi7mc65b60qia6hpsdb6s66j4ggqp7if6vblrj";
   };
+  patches = [
+    # Pull fix pending upstream inclusion for gcc-10 compatibility:
+    #  https://sourceforge.net/p/cdpr/bugs/3/
+    (fetchurl {
+      name = "fno-common";
+      url = "https://sourceforge.net/p/cdpr/bugs/3/attachment/0001-cdpr-fix-build-on-gcc-10-fno-common.patch";
+      sha256 = "023cvkpc4ry1pbjd91kkwj4af3hia0layk3fp8q40vh6mbr14pnp";
+    })
+  ];
 
   postPatch = ''
     substituteInPlace Makefile --replace 'gcc' '"$$CC"'
diff --git a/pkgs/tools/security/clamav/default.nix b/pkgs/tools/security/clamav/default.nix
index cc1eaf8265c..4a72c900ca4 100644
--- a/pkgs/tools/security/clamav/default.nix
+++ b/pkgs/tools/security/clamav/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "clamav";
-  version = "0.103.5";
+  version = "0.103.6";
 
   src = fetchurl {
     url = "https://www.clamav.net/downloads/production/${pname}-${version}.tar.gz";
-    sha256 = "sha256-HnSx4dKoqQVkScMT9Ippg7nVug1vte8LK+atPIQaVCY=";
+    sha256 = "sha256-qqEuPcGfHTI7HFDXoQ+or1V+Q5AUnoZNWb3jm2rZujM=";
   };
 
   # don't install sample config files into the absolute sysconfdir folder
diff --git a/pkgs/tools/security/gnupg/1.nix b/pkgs/tools/security/gnupg/1.nix
index b7bc395cc0a..5fa9bc0bedd 100644
--- a/pkgs/tools/security/gnupg/1.nix
+++ b/pkgs/tools/security/gnupg/1.nix
@@ -11,6 +11,12 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ readline bzip2 ];
 
+  # Workaround build failure on -fno-common toolchains like upstream
+  # gcc-10. Otherwise build fails as:
+  #   ld: ../util/libutil.a(estream-printf.o):/build/gnupg-1.4.23/util/../include/memory.h:100: multiple definition of
+  #     `memory_debug_mode'; gpgsplit.o:/build/gnupg-1.4.23/tools/../include/memory.h:100: first defined here
+  NIX_CFLAGS_COMPILE = "-fcommon";
+
   doCheck = true;
 
   meta = with lib; {
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 2abec13745e..271e5ba4c85 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -904,6 +904,7 @@ mapAliases ({
   ### O ###
 
   oathToolkit = oath-toolkit; # Added 2022-04-04
+  oci-image-tool = throw "oci-image-tool is no longer actively maintained, and has had major deficiencies for several years."; # Added 2022-05-14;
   oracleXE = throw "oracleXE has been removed, as it's heavily outdated and unmaintained"; # Added 2020-10-09
   OVMF-CSM = throw "OVMF-CSM has been removed in favor of OVMFFull"; # Added 2021-10-16
   OVMF-secureBoot = throw "OVMF-secureBoot has been removed in favor of OVMFFull"; # Added 2021-10-16
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 35424e0ad68..99f844bb984 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8876,8 +8876,6 @@ with pkgs;
     buildGoModule = buildGo116Module;
   };
 
-  oci-image-tool = callPackage ../tools/misc/oci-image-tool { };
-
   ocproxy = callPackage ../tools/networking/ocproxy { };
 
   ocserv = callPackage ../tools/networking/ocserv { };
@@ -23455,6 +23453,8 @@ with pkgs;
 
   system76-firmware = callPackage ../os-specific/linux/firmware/system76-firmware { };
 
+  system76-keyboard-configurator = callPackage ../applications/misc/system76-keyboard-configurator { };
+
   ocf-resource-agents = callPackage ../os-specific/linux/ocf-resource-agents { };
 
   open-vm-tools = callPackage ../applications/virtualization/open-vm-tools { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 59673d0f6f8..a00c35c61ba 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5000,6 +5000,8 @@ in {
 
   losant-rest = callPackage ../development/python-modules/losant-rest { };
 
+  lrcalc-python = callPackage ../development/python-modules/lrcalc-python { };
+
   lru-dict = callPackage ../development/python-modules/lru-dict { };
 
   lsassy = callPackage ../development/python-modules/lsassy { };